From 4d2b2e766a5a60afdfa85652a328c967c248d47f Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:32 +0200
Subject: [PATCH 0001/1353] target/tricore: Introduce ISA 1.6.2 feature

we also introduce the tc37x CPU that implements that ISA version.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-2-kbastian@mail.uni-paderborn.de>
---
 target/tricore/cpu.c | 13 +++++++++++++
 target/tricore/cpu.h |  1 +
 2 files changed, 14 insertions(+)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 7fa113fed2..f15169bd1b 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -104,6 +104,10 @@ static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     /* Some features automatically imply others */
+    if (tricore_feature(env, TRICORE_FEATURE_162)) {
+        set_feature(env, TRICORE_FEATURE_161);
+    }
+
     if (tricore_feature(env, TRICORE_FEATURE_161)) {
         set_feature(env, TRICORE_FEATURE_16);
     }
@@ -164,6 +168,14 @@ static void tc27x_initfn(Object *obj)
     set_feature(&cpu->env, TRICORE_FEATURE_161);
 }
 
+static void tc37x_initfn(Object *obj)
+{
+    TriCoreCPU *cpu = TRICORE_CPU(obj);
+
+    set_feature(&cpu->env, TRICORE_FEATURE_162);
+}
+
+
 #include "hw/core/sysemu-cpu-ops.h"
 
 static const struct SysemuCPUOps tricore_sysemu_ops = {
@@ -226,6 +238,7 @@ static const TypeInfo tricore_cpu_type_infos[] = {
     DEFINE_TRICORE_CPU_TYPE("tc1796", tc1796_initfn),
     DEFINE_TRICORE_CPU_TYPE("tc1797", tc1797_initfn),
     DEFINE_TRICORE_CPU_TYPE("tc27x", tc27x_initfn),
+    DEFINE_TRICORE_CPU_TYPE("tc37x", tc37x_initfn),
 };
 
 DEFINE_TYPES(tricore_cpu_type_infos)
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index d98a3fb671..041fc0b6e5 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -273,6 +273,7 @@ enum tricore_features {
     TRICORE_FEATURE_131,
     TRICORE_FEATURE_16,
     TRICORE_FEATURE_161,
+    TRICORE_FEATURE_162,
 };
 
 static inline int tricore_feature(CPUTriCoreState *env, int feature)

From fd6f446a5e34f160cbdc9bb300d326cec0eca6c6 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:33 +0200
Subject: [PATCH 0002/1353] target/tricore: Add popcnt.w insn

reported in https://gitlab.com/qemu-project/qemu/-/issues/1667

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-3-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c       | 7 +++++++
 target/tricore/tricore-opcodes.h | 1 +
 2 files changed, 8 insertions(+)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index cd33a1dcdd..26b284bcec 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -6197,6 +6197,13 @@ static void decode_rr_divide(DisasContext *ctx)
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
         break;
+    case OPC2_32_RR_POPCNT_W:
+        if (has_feature(ctx, TRICORE_FEATURE_162)) {
+            tcg_gen_ctpop_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+        } else {
+            generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
+        }
+        break;
     case OPC2_32_RR_DIV:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             GEN_HELPER_RR(divide, cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
diff --git a/target/tricore/tricore-opcodes.h b/target/tricore/tricore-opcodes.h
index f7135f183d..59aa39a7a5 100644
--- a/target/tricore/tricore-opcodes.h
+++ b/target/tricore/tricore-opcodes.h
@@ -1133,6 +1133,7 @@ enum {
     OPC2_32_RR_PARITY                            = 0x02,
     OPC2_32_RR_UNPACK                            = 0x08,
     OPC2_32_RR_CRC32                             = 0x03,
+    OPC2_32_RR_POPCNT_W                          = 0x22, /* 1.6.2 only */
     OPC2_32_RR_DIV                               = 0x20,
     OPC2_32_RR_DIV_U                             = 0x21,
     OPC2_32_RR_MUL_F                             = 0x04,

From 73f874d9fe67bc0395d629d4d1ce083f61605ba5 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:34 +0200
Subject: [PATCH 0003/1353] target/tricore: Add LHA insn

reported in https://gitlab.com/qemu-project/qemu/-/issues/1667

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-4-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c       | 14 ++++++++++++--
 target/tricore/tricore-opcodes.h |  9 ++++++++-
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 26b284bcec..898557d22a 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -7931,7 +7931,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
 
 static void decode_32Bit_opc(DisasContext *ctx)
 {
-    int op1;
+    int op1, op2;
     int32_t r1, r2, r3;
     int32_t address, const16;
     int8_t b, const4;
@@ -7982,9 +7982,19 @@ static void decode_32Bit_opc(DisasContext *ctx)
         tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
         tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
         break;
-    case OPC1_32_ABS_LEA:
+    case OPCM_32_ABS_LEA_LHA:
         address = MASK_OP_ABS_OFF18(ctx->opcode);
         r1 = MASK_OP_ABS_S1D(ctx->opcode);
+
+        if (has_feature(ctx, TRICORE_FEATURE_162)) {
+            op2 = MASK_OP_ABS_OP2(ctx->opcode);
+            if (op2 == OPC2_32_ABS_LHA) {
+                tcg_gen_movi_tl(cpu_gpr_a[r1], address << 14);
+                break;
+            }
+            /* otherwise translate regular LEA */
+        }
+
         tcg_gen_movi_tl(cpu_gpr_a[r1], EA_ABS_FORMAT(address));
         break;
 /* ABSB-format */
diff --git a/target/tricore/tricore-opcodes.h b/target/tricore/tricore-opcodes.h
index 59aa39a7a5..9fab4bd75c 100644
--- a/target/tricore/tricore-opcodes.h
+++ b/target/tricore/tricore-opcodes.h
@@ -430,7 +430,7 @@ enum {
     OPCM_32_ABS_STOREB_H                             = 0x25,
     OPC1_32_ABS_STOREQ                               = 0x65,
     OPC1_32_ABS_LD_Q                                 = 0x45,
-    OPC1_32_ABS_LEA                                  = 0xc5,
+    OPCM_32_ABS_LEA_LHA                              = 0xc5,
 /* ABSB Format */
     OPC1_32_ABSB_ST_T                                = 0xd5,
 /* B Format */
@@ -592,6 +592,13 @@ enum {
     OPC2_32_ABS_ST_B                             = 0x00,
     OPC2_32_ABS_ST_H                             = 0x02,
 };
+
+/* OPCM_32_ABS_LEA_LHA */
+enum {
+    OPC2_32_ABS_LEA                              = 0x00,
+    OPC2_32_ABS_LHA                              = 0x01,
+};
+
 /*
  * Bit Format
  */

From dc0b4368be92d85fc9fb2d48922149759c1f7804 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:35 +0200
Subject: [PATCH 0004/1353] target/tricore: Add crc32l.w insn

reported in https://gitlab.com/qemu-project/qemu/-/issues/1667

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-5-kbastian@mail.uni-paderborn.de>
---
 target/tricore/helper.h          |  3 ++-
 target/tricore/op_helper.c       | 10 +++++++++-
 target/tricore/translate.c       | 12 ++++++++++--
 target/tricore/tricore-opcodes.h |  3 ++-
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/target/tricore/helper.h b/target/tricore/helper.h
index b64780c37d..24da5e97c0 100644
--- a/target/tricore/helper.h
+++ b/target/tricore/helper.h
@@ -131,7 +131,8 @@ DEF_HELPER_FLAGS_5(mul_h, TCG_CALL_NO_RWG_SE, i64, i32, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_5(mulm_h, TCG_CALL_NO_RWG_SE, i64, i32, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_5(mulr_h, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32, i32, i32)
 /* crc32 */
-DEF_HELPER_FLAGS_2(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+DEF_HELPER_FLAGS_2(crc32_be, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+DEF_HELPER_FLAGS_2(crc32_le, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 /* CSA */
 DEF_HELPER_2(call, void, env, i32)
 DEF_HELPER_1(ret, void, env)
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 54f54811d9..8ce404cb93 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2284,7 +2284,7 @@ uint32_t helper_mulr_h(uint32_t arg00, uint32_t arg01,
     return (result1 & 0xffff0000) | (result0 >> 16);
 }
 
-uint32_t helper_crc32(uint32_t arg0, uint32_t arg1)
+uint32_t helper_crc32_be(uint32_t arg0, uint32_t arg1)
 {
     uint8_t buf[4];
     stl_be_p(buf, arg0);
@@ -2292,6 +2292,14 @@ uint32_t helper_crc32(uint32_t arg0, uint32_t arg1)
     return crc32(arg1, buf, 4);
 }
 
+uint32_t helper_crc32_le(uint32_t arg0, uint32_t arg1)
+{
+    uint8_t buf[4];
+    stl_le_p(buf, arg0);
+
+    return crc32(arg1, buf, 4);
+}
+
 /* context save area (CSA) related helpers */
 
 static int cdc_increment(target_ulong *psw)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 898557d22a..250de80de5 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -6190,13 +6190,21 @@ static void decode_rr_divide(DisasContext *ctx)
         CHECK_REG_PAIR(r3);
         gen_unpack(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1]);
         break;
-    case OPC2_32_RR_CRC32:
+    case OPC2_32_RR_CRC32: /* CRC32B.W in 1.6.2 */
         if (has_feature(ctx, TRICORE_FEATURE_161)) {
-            gen_helper_crc32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+            gen_helper_crc32_be(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
         break;
+    case OPC2_32_RR_CRC32L_W:
+        if (has_feature(ctx, TRICORE_FEATURE_162)) {
+            gen_helper_crc32_le(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        } else {
+            generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
+        }
+        break;
+
     case OPC2_32_RR_POPCNT_W:
         if (has_feature(ctx, TRICORE_FEATURE_162)) {
             tcg_gen_ctpop_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
diff --git a/target/tricore/tricore-opcodes.h b/target/tricore/tricore-opcodes.h
index 9fab4bd75c..be07f82ec1 100644
--- a/target/tricore/tricore-opcodes.h
+++ b/target/tricore/tricore-opcodes.h
@@ -1139,7 +1139,8 @@ enum {
     OPC2_32_RR_DVINIT_U                          = 0x0a,
     OPC2_32_RR_PARITY                            = 0x02,
     OPC2_32_RR_UNPACK                            = 0x08,
-    OPC2_32_RR_CRC32                             = 0x03,
+    OPC2_32_RR_CRC32                             = 0x03, /* CRC32B.W in 1.6.2 */
+    OPC2_32_RR_CRC32L_W                          = 0x07, /* 1.6.2 only */
     OPC2_32_RR_POPCNT_W                          = 0x22, /* 1.6.2 only */
     OPC2_32_RR_DIV                               = 0x20,
     OPC2_32_RR_DIV_U                             = 0x21,

From 0eaafe33d03447f36ff152010836d501ba68c710 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:36 +0200
Subject: [PATCH 0005/1353] target/tricore: Add crc32.b insn

reported in https://gitlab.com/qemu-project/qemu/-/issues/1667

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-6-kbastian@mail.uni-paderborn.de>
---
 target/tricore/helper.h          | 1 +
 target/tricore/op_helper.c       | 8 ++++++++
 target/tricore/translate.c       | 7 +++++++
 target/tricore/tricore-opcodes.h | 1 +
 4 files changed, 17 insertions(+)

diff --git a/target/tricore/helper.h b/target/tricore/helper.h
index 24da5e97c0..a10576e09e 100644
--- a/target/tricore/helper.h
+++ b/target/tricore/helper.h
@@ -131,6 +131,7 @@ DEF_HELPER_FLAGS_5(mul_h, TCG_CALL_NO_RWG_SE, i64, i32, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_5(mulm_h, TCG_CALL_NO_RWG_SE, i64, i32, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_5(mulr_h, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32, i32, i32)
 /* crc32 */
+DEF_HELPER_FLAGS_2(crc32b, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(crc32_be, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(crc32_le, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 /* CSA */
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 8ce404cb93..b6ef1462e4 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2284,6 +2284,14 @@ uint32_t helper_mulr_h(uint32_t arg00, uint32_t arg01,
     return (result1 & 0xffff0000) | (result0 >> 16);
 }
 
+uint32_t helper_crc32b(uint32_t arg0, uint32_t arg1)
+{
+    uint8_t buf[1] = { arg0 & 0xff };
+
+    return crc32(arg1, buf, 1);
+}
+
+
 uint32_t helper_crc32_be(uint32_t arg0, uint32_t arg1)
 {
     uint8_t buf[4];
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 250de80de5..85526ef4db 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -6190,6 +6190,13 @@ static void decode_rr_divide(DisasContext *ctx)
         CHECK_REG_PAIR(r3);
         gen_unpack(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1]);
         break;
+    case OPC2_32_RR_CRC32_B:
+        if (has_feature(ctx, TRICORE_FEATURE_162)) {
+            gen_helper_crc32b(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        } else {
+            generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
+        }
+        break;
     case OPC2_32_RR_CRC32: /* CRC32B.W in 1.6.2 */
         if (has_feature(ctx, TRICORE_FEATURE_161)) {
             gen_helper_crc32_be(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
diff --git a/target/tricore/tricore-opcodes.h b/target/tricore/tricore-opcodes.h
index be07f82ec1..27f80e1702 100644
--- a/target/tricore/tricore-opcodes.h
+++ b/target/tricore/tricore-opcodes.h
@@ -1140,6 +1140,7 @@ enum {
     OPC2_32_RR_PARITY                            = 0x02,
     OPC2_32_RR_UNPACK                            = 0x08,
     OPC2_32_RR_CRC32                             = 0x03, /* CRC32B.W in 1.6.2 */
+    OPC2_32_RR_CRC32_B                           = 0x06, /* 1.6.2 only */
     OPC2_32_RR_CRC32L_W                          = 0x07, /* 1.6.2 only */
     OPC2_32_RR_POPCNT_W                          = 0x22, /* 1.6.2 only */
     OPC2_32_RR_DIV                               = 0x20,

From 4e3377bb5abe8914eec0650730536d5d48e22008 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:37 +0200
Subject: [PATCH 0006/1353] target/tricore: Add shuffle insn

this is based on code by volumit (https://github.com/volumit/qemu/).

Reported in https://gitlab.com/qemu-project/qemu/-/issues/1667
and https://gitlab.com/qemu-project/qemu/-/issues/1452.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-7-kbastian@mail.uni-paderborn.de>
---
 target/tricore/helper.h          |  1 +
 target/tricore/op_helper.c       | 36 ++++++++++++++++++++++++++++++++
 target/tricore/translate.c       |  8 +++++++
 target/tricore/tricore-opcodes.h |  1 +
 4 files changed, 46 insertions(+)

diff --git a/target/tricore/helper.h b/target/tricore/helper.h
index a10576e09e..31d71eac7a 100644
--- a/target/tricore/helper.h
+++ b/target/tricore/helper.h
@@ -134,6 +134,7 @@ DEF_HELPER_FLAGS_5(mulr_h, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_2(crc32b, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(crc32_be, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(crc32_le, TCG_CALL_NO_RWG_SE, i32, i32, i32)
+DEF_HELPER_FLAGS_2(shuffle, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 /* CSA */
 DEF_HELPER_2(call, void, env, i32)
 DEF_HELPER_1(ret, void, env)
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index b6ef1462e4..026e15f3e0 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2308,6 +2308,42 @@ uint32_t helper_crc32_le(uint32_t arg0, uint32_t arg1)
     return crc32(arg1, buf, 4);
 }
 
+uint32_t helper_shuffle(uint32_t arg0, uint32_t arg1)
+{
+    uint32_t resb;
+    uint32_t byte_select;
+    uint32_t res = 0;
+
+    byte_select = arg1 & 0x3;
+    resb = extract32(arg0, byte_select * 8, 8);
+    res |= resb << 0;
+
+    byte_select = (arg1 >> 2) & 0x3;
+    resb = extract32(arg0, byte_select * 8, 8);
+    res |= resb << 8;
+
+    byte_select = (arg1 >> 4) & 0x3;
+    resb = extract32(arg0, byte_select * 8, 8);
+    res |= resb << 16;
+
+    byte_select = (arg1 >> 6) & 0x3;
+    resb = extract32(arg0, byte_select * 8, 8);
+    res |= resb << 24;
+
+    if (arg1 & 0x100) {
+        /* Assign the correct nibble position.  */
+        res = ((res & 0xf0f0f0f0) >> 4)
+          | ((res & 0x0f0f0f0f) << 4);
+        /* Assign the correct bit position.  */
+        res = ((res & 0x88888888) >> 3)
+          | ((res & 0x44444444) >> 1)
+          | ((res & 0x22222222) << 1)
+          | ((res & 0x11111111) << 3);
+    }
+
+    return res;
+}
+
 /* context save area (CSA) related helpers */
 
 static int cdc_increment(target_ulong *psw)
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 85526ef4db..a4c60e8ae2 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -5011,6 +5011,14 @@ static void decode_rc_logical_shift(DisasContext *ctx)
     case OPC2_32_RC_XOR:
         tcg_gen_xori_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
+    case OPC2_32_RC_SHUFFLE:
+        if (has_feature(ctx, TRICORE_FEATURE_162)) {
+            TCGv temp = tcg_constant_i32(const9);
+            gen_helper_shuffle(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
+        } else {
+            generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
+        }
+        break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
     }
diff --git a/target/tricore/tricore-opcodes.h b/target/tricore/tricore-opcodes.h
index 27f80e1702..af63926731 100644
--- a/target/tricore/tricore-opcodes.h
+++ b/target/tricore/tricore-opcodes.h
@@ -885,6 +885,7 @@ enum {
     OPC2_32_RC_SHAS                              = 0x02,
     OPC2_32_RC_XNOR                              = 0x0d,
     OPC2_32_RC_XOR                               = 0x0c,
+    OPC2_32_RC_SHUFFLE                           = 0x07, /* v1.6.2 only */
 };
 /* OPCM_32_RC_ACCUMULATOR                           */
 enum {

From 3b5d136db6484f2b625fb98cce4fd8b7ac26e348 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:38 +0200
Subject: [PATCH 0007/1353] target/tricore: Implement SYCSCALL insn

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1452
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-8-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index a4c60e8ae2..f01000efd4 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -5236,7 +5236,7 @@ static void decode_rc_serviceroutine(DisasContext *ctx)
         gen_helper_1arg(bisr, const9);
         break;
     case OPC2_32_RC_SYSCALL:
-        /* TODO: Add exception generation */
+        generate_trap(ctx, TRAPC_SYSCALL, const9 & 0xff);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);

From 0b9f9b63c2d1e26cfe4e593f384898837c7c941f Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 14 Jun 2023 12:00:39 +0200
Subject: [PATCH 0008/1353] target/tricore: Add DISABLE insn variant

this variant saves the 'IE' bit to a 'd' register. The 'IE' bitfield
changed from ISA version 1.6.1, so we add icr_ie_offset to DisasContext
as with the other DISABLE insn.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230614100039.1337971-9-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c       | 11 ++++++++++-
 target/tricore/tricore-opcodes.h |  1 +
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index f01000efd4..6712d98f6e 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -75,7 +75,7 @@ typedef struct DisasContext {
     int mem_idx;
     uint32_t hflags, saved_hflags;
     uint64_t features;
-    uint32_t icr_ie_mask;
+    uint32_t icr_ie_mask, icr_ie_offset;
 } DisasContext;
 
 static int has_feature(DisasContext *ctx, int feature)
@@ -7883,6 +7883,13 @@ static void decode_sys_interrupts(DisasContext *ctx)
     case OPC2_32_SYS_DISABLE:
         tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
         break;
+    case OPC2_32_SYS_DISABLE_D:
+        if (has_feature(ctx, TRICORE_FEATURE_16)) {
+            tcg_gen_extract_tl(cpu_gpr_d[r1], cpu_ICR, ctx->icr_ie_offset, 1);
+            tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+        } else {
+            generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
+        }
     case OPC2_32_SYS_DSYNC:
         break;
     case OPC2_32_SYS_ENABLE:
@@ -8302,8 +8309,10 @@ static void tricore_tr_init_disas_context(DisasContextBase *dcbase,
     ctx->features = env->features;
     if (has_feature(ctx, TRICORE_FEATURE_161)) {
         ctx->icr_ie_mask = R_ICR_IE_161_MASK;
+        ctx->icr_ie_offset = R_ICR_IE_161_SHIFT;
     } else {
         ctx->icr_ie_mask = R_ICR_IE_13_MASK;
+        ctx->icr_ie_offset = R_ICR_IE_13_SHIFT;
     }
 }
 
diff --git a/target/tricore/tricore-opcodes.h b/target/tricore/tricore-opcodes.h
index af63926731..bc62b73173 100644
--- a/target/tricore/tricore-opcodes.h
+++ b/target/tricore/tricore-opcodes.h
@@ -1467,6 +1467,7 @@ enum {
 enum {
     OPC2_32_SYS_DEBUG                            = 0x04,
     OPC2_32_SYS_DISABLE                          = 0x0d,
+    OPC2_32_SYS_DISABLE_D                        = 0x0f, /* 1.6 up */
     OPC2_32_SYS_DSYNC                            = 0x12,
     OPC2_32_SYS_ENABLE                           = 0x0c,
     OPC2_32_SYS_ISYNC                            = 0x13,

From d34b092cab606a47a0d76edde45aab7100bb2435 Mon Sep 17 00:00:00 2001
From: Siqi Chen <coc.cyqh@gmail.com>
Date: Mon, 12 Jun 2023 13:32:42 +0200
Subject: [PATCH 0009/1353] target/tricore: Fix out-of-bounds index in imask
 instruction

When translating  "imask" instruction of Tricore architecture, QEMU did not check whether the register index was out of bounds, resulting in a global-buffer-overflow.

Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1698
Reported-by: Siqi Chen <coc.cyqh@gmail.com>
Signed-off-by: Siqi Chen <coc.cyqh@gmail.com>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230612065633.149152-1-coc.cyqh@gmail.com>
Message-Id: <20230612113245.56667-2-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 6712d98f6e..74faad4794 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -5339,6 +5339,7 @@ static void decode_rcrw_insert(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RCRW_IMASK:
+        CHECK_REG_PAIR(r4);
         tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
         tcg_gen_movi_tl(temp2, (1 << width) - 1);
         tcg_gen_shl_tl(cpu_gpr_d[r4 + 1], temp2, temp);

From 5434557ffc5b46f178ccf325517db2b1f5e2c037 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Mon, 12 Jun 2023 13:32:43 +0200
Subject: [PATCH 0010/1353] target/tricore: Correctly fix saving PSW.CDE to CSA
 on call

we don't want to save PSW.CDC to the CSA, but PSW.CDE must be saved.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1699
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230612113245.56667-3-kbastian@mail.uni-paderborn.de>
---
 target/tricore/op_helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 026e15f3e0..9a7a26b171 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2499,7 +2499,12 @@ void helper_call(CPUTriCoreState *env, uint32_t next_pc)
     }
     /* PSW.CDE = 1;*/
     psw |= MASK_PSW_CDE;
-    psw_write(env, psw);
+    /*
+     * we need to save PSW.CDE and not PSW.CDC into the CSAs. psw already
+     * contains the CDC from cdc_increment(), so we cannot call psw_write()
+     * here.
+     */
+    env->PSW |= MASK_PSW_CDE;
 
     /* tmp_FCX = FCX; */
     tmp_FCX = env->FCX;

From 6991777ec4b2a344d47bddec62744bedd9883d78 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Mon, 12 Jun 2023 13:32:44 +0200
Subject: [PATCH 0011/1353] target/tricore: Add CHECK_REG_PAIR() for insn
 accessing 64 bit regs

some insns were not checking if an even index was used to access a 64
bit register. In the worst case that could lead to a buffer overflow as
reported in https://gitlab.com/qemu-project/qemu/-/issues/1698.

Reported-by: Siqi Chen <coc.cyqh@gmail.com>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230612113245.56667-4-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 74faad4794..d1b319e374 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -309,6 +309,7 @@ static void gen_cmpswap(DisasContext *ctx, int reg, TCGv ea)
 {
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
+    CHECK_REG_PAIR(reg);
     tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
     tcg_gen_movcond_tl(TCG_COND_EQ, temp2, cpu_gpr_d[reg+1], temp,
                        cpu_gpr_d[reg], temp);
@@ -321,7 +322,7 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     TCGv temp3 = tcg_temp_new();
-
+    CHECK_REG_PAIR(reg);
     tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
     tcg_gen_and_tl(temp2, cpu_gpr_d[reg], cpu_gpr_d[reg+1]);
     tcg_gen_andc_tl(temp3, temp, cpu_gpr_d[reg+1]);
@@ -3219,6 +3220,7 @@ static void decode_src_opc(DisasContext *ctx, int op1)
         break;
     case OPC1_16_SRC_MOV_E:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
+            CHECK_REG_PAIR(r1);
             tcg_gen_movi_tl(cpu_gpr_d[r1], const4);
             tcg_gen_sari_tl(cpu_gpr_d[r1+1], cpu_gpr_d[r1], 31);
         } else {
@@ -6180,6 +6182,7 @@ static void decode_rr_divide(DisasContext *ctx)
         tcg_gen_sari_tl(cpu_gpr_d[r3+1], cpu_gpr_d[r1], 31);
         break;
     case OPC2_32_RR_DVINIT_U:
+        CHECK_REG_PAIR(r3);
         /* overflow = (D[b] == 0) */
         tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
         tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
@@ -6230,6 +6233,7 @@ static void decode_rr_divide(DisasContext *ctx)
         break;
     case OPC2_32_RR_DIV:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
+            CHECK_REG_PAIR(r3);
             GEN_HELPER_RR(divide, cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
                           cpu_gpr_d[r2]);
         } else {
@@ -6238,6 +6242,7 @@ static void decode_rr_divide(DisasContext *ctx)
         break;
     case OPC2_32_RR_DIV_U:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
+            CHECK_REG_PAIR(r3);
             GEN_HELPER_RR(divide_u, cpu_gpr_d[r3], cpu_gpr_d[r3+1],
                           cpu_gpr_d[r1], cpu_gpr_d[r2]);
         } else {
@@ -6764,6 +6769,8 @@ static void decode_rrr2_msub(DisasContext *ctx)
                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MSUB_U_64:
+        CHECK_REG_PAIR(r4);
+        CHECK_REG_PAIR(r3);
         gen_msubu64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
                       cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
         break;
@@ -7847,7 +7854,7 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
         break;
     case OPC2_32_RRRW_IMASK:
         temp2 = tcg_temp_new();
-
+        CHECK_REG_PAIR(r4);
         tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
         tcg_gen_movi_tl(temp2, (1 << width) - 1);
         tcg_gen_shl_tl(temp2, temp2, temp);

From 82736612e75b84f51d8f3529cb35fa3835de5741 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Mon, 12 Jun 2023 13:32:45 +0200
Subject: [PATCH 0012/1353] target/tricore: Fix helper_ret() not correctly
 restoring PSW

We are always taking the TRICORE_FEATURE_13 branch as every CPU has TRICORE_FEATURE_13.
For CPUs with ISA > 1.3 we have to take the else branch.

We fix this by inverting the condition. We check for
TRICORE_FEATURE_131, which every CPU except TRICORE_FEATURE_13 CPUs
have.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1700
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230612113245.56667-5-kbastian@mail.uni-paderborn.de>
---
 target/tricore/op_helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 9a7a26b171..821a4b67cb 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2584,12 +2584,12 @@ void helper_ret(CPUTriCoreState *env)
     /* PCXI = new_PCXI; */
     env->PCXI = new_PCXI;
 
-    if (tricore_feature(env, TRICORE_FEATURE_13)) {
-        /* PSW = new_PSW */
-        psw_write(env, new_PSW);
-    } else {
+    if (tricore_feature(env, TRICORE_FEATURE_131)) {
         /* PSW = {new_PSW[31:26], PSW[25:24], new_PSW[23:0]}; */
         psw_write(env, (new_PSW & ~(0x3000000)) + (psw & (0x3000000)));
+    } else { /* TRICORE_FEATURE_13 only */
+        /* PSW = new_PSW */
+        psw_write(env, new_PSW);
     }
 }
 

From 8da70480f59b4fd423918ac756747c1e35f6f53a Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:22:55 +0200
Subject: [PATCH 0013/1353] target/tricore: Fix RR_JLI clobbering reg A[11]

if A[r1] == A[11], then we would overwrite the destination address of
the jump with the return address.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-2-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index d1b319e374..cca52c75b2 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -6064,8 +6064,8 @@ static void decode_rr_idirect(DisasContext *ctx)
         tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], ~0x1);
         break;
     case OPC2_32_RR_JLI:
-        tcg_gen_movi_tl(cpu_gpr_a[11], ctx->pc_succ_insn);
         tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], ~0x1);
+        tcg_gen_movi_tl(cpu_gpr_a[11], ctx->pc_succ_insn);
         break;
     case OPC2_32_RR_CALLI:
         gen_helper_1arg(call, ctx->pc_succ_insn);

From 1706e04f6e807431b460b4109ab65bb469adc53a Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:22:56 +0200
Subject: [PATCH 0014/1353] target/tricore: Introduce DISAS_TARGET_EXIT

this replaces all calls to tcg_gen_exit_tb() and moves them to
tricore_tb_stop().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-3-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index cca52c75b2..ef74e9f234 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -37,6 +37,7 @@
 #include "exec/helper-info.c.inc"
 #undef  HELPER_H
 
+#define DISAS_EXIT        DISAS_TARGET_0
 
 /*
  * TCG registers
@@ -2836,6 +2837,7 @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
         gen_save_pc(dest);
         tcg_gen_lookup_and_goto_ptr();
     }
+    ctx->base.is_jmp = DISAS_NORETURN;
 }
 
 static void generate_trap(DisasContext *ctx, int class, int tin)
@@ -2896,8 +2898,7 @@ static void gen_fret(DisasContext *ctx)
     tcg_gen_qemu_ld_tl(cpu_gpr_a[11], cpu_gpr_a[10], ctx->mem_idx, MO_LESL);
     tcg_gen_addi_tl(cpu_gpr_a[10], cpu_gpr_a[10], 4);
     tcg_gen_mov_tl(cpu_PC, temp);
-    tcg_gen_exit_tb(NULL, 0);
-    ctx->base.is_jmp = DISAS_NORETURN;
+    ctx->base.is_jmp = DISAS_EXIT;
 }
 
 static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
@@ -2996,12 +2997,12 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
 /* SR-format jumps */
     case OPC1_16_SR_JI:
         tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], 0xfffffffe);
-        tcg_gen_exit_tb(NULL, 0);
+        ctx->base.is_jmp = DISAS_EXIT;
         break;
     case OPC2_32_SYS_RET:
     case OPC2_16_SR_RET:
         gen_helper_ret(cpu_env);
-        tcg_gen_exit_tb(NULL, 0);
+        ctx->base.is_jmp = DISAS_EXIT;
         break;
 /* B-format */
     case OPC1_32_B_CALLA:
@@ -3153,7 +3154,6 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
     }
-    ctx->base.is_jmp = DISAS_NORETURN;
 }
 
 
@@ -3495,8 +3495,7 @@ static void decode_sr_system(DisasContext *ctx)
         break;
     case OPC2_16_SR_RFE:
         gen_helper_rfe(cpu_env);
-        tcg_gen_exit_tb(NULL, 0);
-        ctx->base.is_jmp = DISAS_NORETURN;
+        ctx->base.is_jmp = DISAS_EXIT;
         break;
     case OPC2_16_SR_DEBUG:
         /* raise EXCP_DEBUG */
@@ -6078,8 +6077,7 @@ static void decode_rr_idirect(DisasContext *ctx)
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
     }
-    tcg_gen_exit_tb(NULL, 0);
-    ctx->base.is_jmp = DISAS_NORETURN;
+    ctx->base.is_jmp = DISAS_EXIT;
 }
 
 static void decode_rr_divide(DisasContext *ctx)
@@ -7915,8 +7913,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_RFE:
         gen_helper_rfe(cpu_env);
-        tcg_gen_exit_tb(NULL, 0);
-        ctx->base.is_jmp = DISAS_NORETURN;
+        ctx->base.is_jmp = DISAS_EXIT;
         break;
     case OPC2_32_SYS_RFM:
         if ((ctx->hflags & TRICORE_HFLAG_KUU) == TRICORE_HFLAG_SM) {
@@ -7928,8 +7925,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
             tcg_gen_brcondi_tl(TCG_COND_NE, tmp, 1, l1);
             gen_helper_rfm(cpu_env);
             gen_set_label(l1);
-            tcg_gen_exit_tb(NULL, 0);
-            ctx->base.is_jmp = DISAS_NORETURN;
+            ctx->base.is_jmp = DISAS_EXIT;
         } else {
             /* generate privilege trap */
         }
@@ -8391,6 +8387,9 @@ static void tricore_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_TOO_MANY:
         gen_goto_tb(ctx, 0, ctx->base.pc_next);
         break;
+    case DISAS_EXIT:
+        tcg_gen_exit_tb(NULL, 0);
+        break;
     case DISAS_NORETURN:
         break;
     default:

From 2dbd73bf17f4c6bf016709d995ea46477cb6133c Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:22:57 +0200
Subject: [PATCH 0015/1353] target/tricore: ENABLE exit to main-loop

so we can recognize exceptions after re-enabling interrupts.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-4-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index ef74e9f234..98e2767d21 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -38,6 +38,7 @@
 #undef  HELPER_H
 
 #define DISAS_EXIT        DISAS_TARGET_0
+#define DISAS_EXIT_UPDATE DISAS_TARGET_1
 
 /*
  * TCG registers
@@ -7900,6 +7901,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_ENABLE:
         tcg_gen_ori_tl(cpu_ICR, cpu_ICR, ctx->icr_ie_mask);
+        ctx->base.is_jmp = DISAS_EXIT_UPDATE;
         break;
     case OPC2_32_SYS_ISYNC:
         break;
@@ -8387,6 +8389,9 @@ static void tricore_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_TOO_MANY:
         gen_goto_tb(ctx, 0, ctx->base.pc_next);
         break;
+    case DISAS_EXIT_UPDATE:
+        gen_save_pc(ctx->base.pc_next);
+        /* fall through */
     case DISAS_EXIT:
         tcg_gen_exit_tb(NULL, 0);
         break;

From d8f466af7cad3a997c3f9d0396f2a63826fee239 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:22:58 +0200
Subject: [PATCH 0016/1353] target/tricore: Indirect jump insns use
 tcg_gen_lookup_and_goto_ptr()

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-5-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 98e2767d21..fb6f0caa24 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -39,6 +39,7 @@
 
 #define DISAS_EXIT        DISAS_TARGET_0
 #define DISAS_EXIT_UPDATE DISAS_TARGET_1
+#define DISAS_JUMP        DISAS_TARGET_2
 
 /*
  * TCG registers
@@ -6077,8 +6078,9 @@ static void decode_rr_idirect(DisasContext *ctx)
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
+        return;
     }
-    ctx->base.is_jmp = DISAS_EXIT;
+    ctx->base.is_jmp = DISAS_JUMP;
 }
 
 static void decode_rr_divide(DisasContext *ctx)
@@ -8395,6 +8397,9 @@ static void tricore_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
     case DISAS_EXIT:
         tcg_gen_exit_tb(NULL, 0);
         break;
+    case DISAS_JUMP:
+        tcg_gen_lookup_and_goto_ptr();
+        break;
     case DISAS_NORETURN:
         break;
     default:

From 878d1b6a90173d61859f1b5083266d2bbc3db17c Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:22:59 +0200
Subject: [PATCH 0017/1353] target/tricore: Introduce priv tb flag

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-6-kbastian@mail.uni-paderborn.de>
---
 target/tricore/cpu.h       | 17 ++++++++++++-----
 target/tricore/translate.c | 14 ++++++++------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index 041fc0b6e5..257fcf3cee 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -263,10 +263,11 @@ void icr_set_ie(CPUTriCoreState *env, uint32_t val);
 #define MASK_DBGSR_PEVT 0x40
 #define MASK_DBGSR_EVTSRC 0x1f00
 
-#define TRICORE_HFLAG_KUU     0x3
-#define TRICORE_HFLAG_UM0     0x00002 /* user mode-0 flag          */
-#define TRICORE_HFLAG_UM1     0x00001 /* user mode-1 flag          */
-#define TRICORE_HFLAG_SM      0x00000 /* kernel mode flag          */
+enum tricore_priv_levels {
+    TRICORE_PRIV_UM0 = 0x0, /* user mode-0 flag */
+    TRICORE_PRIV_UM1 = 0x1, /* user mode-1 flag */
+    TRICORE_PRIV_SM  = 0x2, /* kernel mode flag */
+};
 
 enum tricore_features {
     TRICORE_FEATURE_13,
@@ -378,15 +379,21 @@ static inline int cpu_mmu_index(CPUTriCoreState *env, bool ifetch)
 
 #include "exec/cpu-all.h"
 
+FIELD(TB_FLAGS, PRIV, 0, 2)
+
 void cpu_state_reset(CPUTriCoreState *s);
 void tricore_tcg_init(void);
 
 static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
 {
+    uint32_t new_flags = 0;
     *pc = env->PC;
     *cs_base = 0;
-    *flags = 0;
+
+    new_flags |= FIELD_DP32(new_flags, TB_FLAGS, PRIV,
+            extract32(env->PSW, 10, 2));
+    *flags = new_flags;
 }
 
 #define TRICORE_CPU_TYPE_SUFFIX "-" TYPE_TRICORE_CPU
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index fb6f0caa24..6932a54663 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -76,7 +76,7 @@ typedef struct DisasContext {
     uint32_t opcode;
     /* Routine used to access memory */
     int mem_idx;
-    uint32_t hflags, saved_hflags;
+    int priv;
     uint64_t features;
     uint32_t icr_ie_mask, icr_ie_offset;
 } DisasContext;
@@ -378,7 +378,7 @@ static inline void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
 static inline void gen_mtcr(DisasContext *ctx, TCGv r1,
                             int32_t offset)
 {
-    if ((ctx->hflags & TRICORE_HFLAG_KUU) == TRICORE_HFLAG_SM) {
+    if (ctx->priv == TRICORE_PRIV_SM) {
         /* since we're caching PSW make this a special case */
         if (offset == 0xfe04) {
             gen_helper_psw_write(cpu_env, r1);
@@ -7920,7 +7920,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         ctx->base.is_jmp = DISAS_EXIT;
         break;
     case OPC2_32_SYS_RFM:
-        if ((ctx->hflags & TRICORE_HFLAG_KUU) == TRICORE_HFLAG_SM) {
+        if (ctx->priv  == TRICORE_PRIV_SM) {
             tmp = tcg_temp_new();
             l1 = gen_new_label();
 
@@ -7942,8 +7942,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_RESTORE:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
-            if ((ctx->hflags & TRICORE_HFLAG_KUU) == TRICORE_HFLAG_SM ||
-                (ctx->hflags & TRICORE_HFLAG_KUU) == TRICORE_HFLAG_UM1) {
+            if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
                 tcg_gen_deposit_tl(cpu_ICR, cpu_ICR, cpu_gpr_d[r1], 8, 1);
             } /* else raise privilege trap */
         } else {
@@ -8313,7 +8312,10 @@ static void tricore_tr_init_disas_context(DisasContextBase *dcbase,
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPUTriCoreState *env = cs->env_ptr;
     ctx->mem_idx = cpu_mmu_index(env, false);
-    ctx->hflags = (uint32_t)ctx->base.tb->flags;
+
+    uint32_t tb_flags = (uint32_t)ctx->base.tb->flags;
+    ctx->priv = FIELD_EX32(tb_flags, TB_FLAGS, PRIV);
+
     ctx->features = env->features;
     if (has_feature(ctx, TRICORE_FEATURE_161)) {
         ctx->icr_ie_mask = R_ICR_IE_161_MASK;

From 57b9c589b621b40f3a81662ad1aa960ab6a60497 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:23:00 +0200
Subject: [PATCH 0018/1353] target/tricore: Implement privilege level for all
 insns

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-7-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 43 +++++++++++++++++++++++++++++---------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 6932a54663..82b61e912e 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -388,7 +388,7 @@ static inline void gen_mtcr(DisasContext *ctx, TCGv r1,
             }
         }
     } else {
-        /* generate privilege trap */
+        generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
     }
 }
 
@@ -3375,7 +3375,11 @@ static void decode_sc_opc(DisasContext *ctx, int op1)
         tcg_gen_andi_tl(cpu_gpr_d[15], cpu_gpr_d[15], const16);
         break;
     case OPC1_16_SC_BISR:
-        gen_helper_1arg(bisr, const16 & 0xff);
+        if (ctx->priv == TRICORE_PRIV_SM) {
+            gen_helper_1arg(bisr, const16 & 0xff);
+        } else {
+            generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
+        }
         break;
     case OPC1_16_SC_LD_A:
         gen_offset_ld(ctx, cpu_gpr_a[15], cpu_gpr_a[10], const16 * 4, MO_LESL);
@@ -5236,7 +5240,11 @@ static void decode_rc_serviceroutine(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RC_BISR:
-        gen_helper_1arg(bisr, const9);
+        if (ctx->priv == TRICORE_PRIV_SM) {
+            gen_helper_1arg(bisr, const9);
+        } else {
+            generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
+        }
         break;
     case OPC2_32_RC_SYSCALL:
         generate_trap(ctx, TRAPC_SYSCALL, const9 & 0xff);
@@ -7890,20 +7898,33 @@ static void decode_sys_interrupts(DisasContext *ctx)
         /* raise EXCP_DEBUG */
         break;
     case OPC2_32_SYS_DISABLE:
-        tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+        if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
+            tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+        } else {
+            generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
+        }
         break;
     case OPC2_32_SYS_DISABLE_D:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
-            tcg_gen_extract_tl(cpu_gpr_d[r1], cpu_ICR, ctx->icr_ie_offset, 1);
-            tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+            if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
+                tcg_gen_extract_tl(cpu_gpr_d[r1], cpu_ICR,
+                        ctx->icr_ie_offset, 1);
+                tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+            } else {
+                generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
+            }
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
     case OPC2_32_SYS_DSYNC:
         break;
     case OPC2_32_SYS_ENABLE:
-        tcg_gen_ori_tl(cpu_ICR, cpu_ICR, ctx->icr_ie_mask);
-        ctx->base.is_jmp = DISAS_EXIT_UPDATE;
+        if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
+            tcg_gen_ori_tl(cpu_ICR, cpu_ICR, ctx->icr_ie_mask);
+            ctx->base.is_jmp = DISAS_EXIT_UPDATE;
+        } else {
+            generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
+        }
         break;
     case OPC2_32_SYS_ISYNC:
         break;
@@ -7931,7 +7952,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
             gen_set_label(l1);
             ctx->base.is_jmp = DISAS_EXIT;
         } else {
-            /* generate privilege trap */
+            generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
         }
         break;
     case OPC2_32_SYS_RSLCX:
@@ -7944,7 +7965,9 @@ static void decode_sys_interrupts(DisasContext *ctx)
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
                 tcg_gen_deposit_tl(cpu_ICR, cpu_ICR, cpu_gpr_d[r1], 8, 1);
-            } /* else raise privilege trap */
+            } else {
+                generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
+            }
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }

From 19a18edd8860064d3dbe71bc5315347bcfeb4c24 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:23:01 +0200
Subject: [PATCH 0019/1353] target/tricore: Honour privilege changes on PSW
 write

the CPU can change the privilege level by writing the corresponding bits
in PSW. If this happens all instructions after this 'mtcr' in the TB are
translated with the wrong privilege level. So we have to exit to the
cpu_loop() and start translating again with the new privilege level.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-8-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 82b61e912e..9e408f44ec 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -334,7 +334,6 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
     tcg_gen_mov_tl(cpu_gpr_d[reg], temp);
 }
 
-
 /* We generate loads and store to core special function register (csfr) through
    the function gen_mfcr and gen_mtcr. To handle access permissions, we use 3
    makros R, A and E, which allow read-only, all and endinit protected access.
@@ -382,6 +381,7 @@ static inline void gen_mtcr(DisasContext *ctx, TCGv r1,
         /* since we're caching PSW make this a special case */
         if (offset == 0xfe04) {
             gen_helper_psw_write(cpu_env, r1);
+            ctx->base.is_jmp = DISAS_EXIT_UPDATE;
         } else {
             switch (offset) {
 #include "csfr.h.inc"

From a9c37abdff65a07d0191123a21d318c4d8cc7f33 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Wed, 21 Jun 2023 16:23:02 +0200
Subject: [PATCH 0020/1353] target/tricore: Fix ICR.IE offset in RESTORE insn

from ISA v1.6.1 onwards the bit position of ICR.IE changed.
ctx->icr_ie_offset contains the correct value for the ISA version used
by the vCPU. We also need to exit this tb here, as we might have enabled
interrupts.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Message-Id: <20230621142302.1648383-9-kbastian@mail.uni-paderborn.de>
---
 target/tricore/translate.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 9e408f44ec..2f32463d4d 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -7964,7 +7964,9 @@ static void decode_sys_interrupts(DisasContext *ctx)
     case OPC2_32_SYS_RESTORE:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
-                tcg_gen_deposit_tl(cpu_ICR, cpu_ICR, cpu_gpr_d[r1], 8, 1);
+                tcg_gen_deposit_tl(cpu_ICR, cpu_ICR, cpu_gpr_d[r1],
+                        ctx->icr_ie_offset, 1);
+                ctx->base.is_jmp = DISAS_EXIT_UPDATE;
             } else {
                 generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
             }

From 26fcbf00226115bc58cf5bf3c6d3aa24d5d9b01c Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:30 +0100
Subject: [PATCH 0021/1353] q800: fix up minor spacing issues in hw_compat_q800
 GlobalProperty array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ensure there is a space before the final closing brace for all global
properties.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 68f0cd8cac..dda57c60bf 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -719,14 +719,14 @@ static void q800_init(MachineState *machine)
 }
 
 static GlobalProperty hw_compat_q800[] = {
-    { "scsi-hd", "quirk_mode_page_vendor_specific_apple", "on"},
+    { "scsi-hd", "quirk_mode_page_vendor_specific_apple", "on" },
     { "scsi-hd", "vendor", " SEAGATE" },
     { "scsi-hd", "product", "          ST225N" },
     { "scsi-hd", "ver", "1.0 " },
-    { "scsi-cd", "quirk_mode_page_apple_vendor", "on"},
-    { "scsi-cd", "quirk_mode_sense_rom_use_dbd", "on"},
-    { "scsi-cd", "quirk_mode_page_vendor_specific_apple", "on"},
-    { "scsi-cd", "quirk_mode_page_truncated", "on"},
+    { "scsi-cd", "quirk_mode_page_apple_vendor", "on" },
+    { "scsi-cd", "quirk_mode_sense_rom_use_dbd", "on" },
+    { "scsi-cd", "quirk_mode_page_vendor_specific_apple", "on" },
+    { "scsi-cd", "quirk_mode_page_truncated", "on" },
     { "scsi-cd", "vendor", "MATSHITA" },
     { "scsi-cd", "product", "CD-ROM CR-8005" },
     { "scsi-cd", "ver", "1.0k" },

From cbba124319812657975ba0bcd17dbf6793494884 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:31 +0100
Subject: [PATCH 0022/1353] q800: add missing space after parent object in
 GLUEState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This brings GLUEState in line with our current QOM guidelines.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index dda57c60bf..465c510c18 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -100,6 +100,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(GLUEState, GLUE)
 
 struct GLUEState {
     SysBusDevice parent_obj;
+
     M68kCPU *cpu;
     uint8_t ipr;
     uint8_t auxmode;

From a8019229c489a51508099d38ec54e035dee94234 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:32 +0100
Subject: [PATCH 0023/1353] q800: introduce Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This provides an overall container and owner for Machine-related objects such
as MemoryRegions.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-4-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 MAINTAINERS            |  1 +
 hw/m68k/q800.c         |  2 ++
 include/hw/m68k/q800.h | 40 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 include/hw/m68k/q800.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 88b5a7ee0a..748a66fbaa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1236,6 +1236,7 @@ F: include/hw/misc/mac_via.h
 F: include/hw/nubus/*
 F: include/hw/display/macfb.h
 F: include/hw/block/swim.h
+F: include/hw/m68k/q800.h
 
 virt
 M: Laurent Vivier <laurent@vivier.eu>
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 465c510c18..c0256c8a90 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -38,6 +38,7 @@
 #include "standard-headers/asm-m68k/bootinfo.h"
 #include "standard-headers/asm-m68k/bootinfo-mac.h"
 #include "bootinfo.h"
+#include "hw/m68k/q800.h"
 #include "hw/misc/mac_via.h"
 #include "hw/input/adb.h"
 #include "hw/nubus/mac-nubus-bridge.h"
@@ -749,6 +750,7 @@ static void q800_machine_class_init(ObjectClass *oc, void *data)
 static const TypeInfo q800_machine_typeinfo = {
     .name       = MACHINE_TYPE_NAME("q800"),
     .parent     = TYPE_MACHINE,
+    .instance_size = sizeof(Q800MachineState),
     .class_init = q800_machine_class_init,
 };
 
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
new file mode 100644
index 0000000000..f3bc17aa1b
--- /dev/null
+++ b/include/hw/m68k/q800.h
@@ -0,0 +1,40 @@
+/*
+ * QEMU Motorla 680x0 Macintosh hardware System Emulator
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_Q800_H
+#define HW_Q800_H
+
+#include "hw/boards.h"
+#include "qom/object.h"
+
+/*
+ * The main Q800 machine
+ */
+
+struct Q800MachineState {
+    MachineState parent_obj;
+};
+
+#define TYPE_Q800_MACHINE MACHINE_TYPE_NAME("q800")
+OBJECT_DECLARE_SIMPLE_TYPE(Q800MachineState, Q800_MACHINE)
+
+#endif

From 1a514d3a8a9b058701f0b8693067e44b08e924f2 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:33 +0100
Subject: [PATCH 0024/1353] q800: rename q800_init() to q800_machine_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will enable us later to distinguish between QOM initialisation and machine
initialisation.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-5-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index c0256c8a90..062a3c6c76 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -362,7 +362,7 @@ static uint8_t fake_mac_rom[] = {
     0x60, 0xFE                          /* bras [self] */
 };
 
-static void q800_init(MachineState *machine)
+static void q800_machine_init(MachineState *machine)
 {
     M68kCPU *cpu = NULL;
     int linux_boot;
@@ -738,8 +738,9 @@ static const size_t hw_compat_q800_len = G_N_ELEMENTS(hw_compat_q800);
 static void q800_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Macintosh Quadra 800";
-    mc->init = q800_init;
+    mc->init = q800_machine_init;
     mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68040");
     mc->max_cpus = 1;
     mc->block_default_type = IF_SCSI;

From 36e2e338b34e9ac6b86102ef81571277613903e2 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:34 +0100
Subject: [PATCH 0025/1353] q800: move CPU object into Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the CPU to use object_initialize_child()
followed by a separate realisation.
Restrict valid CPU types to m68040.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-6-mark.cave-ayland@ilande.co.uk>
[lv: update commit message]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 18 +++++++++++++-----
 include/hw/m68k/q800.h |  3 +++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 062a3c6c76..2b651de3c1 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -364,7 +364,7 @@ static uint8_t fake_mac_rom[] = {
 
 static void q800_machine_init(MachineState *machine)
 {
-    M68kCPU *cpu = NULL;
+    Q800MachineState *m = Q800_MACHINE(machine);
     int linux_boot;
     int32_t kernel_size;
     uint64_t elf_entry;
@@ -407,8 +407,9 @@ static void q800_machine_init(MachineState *machine)
     }
 
     /* init CPUs */
-    cpu = M68K_CPU(cpu_create(machine->cpu_type));
-    qemu_register_reset(main_cpu_reset, cpu);
+    object_initialize_child(OBJECT(machine), "cpu", &m->cpu, machine->cpu_type);
+    qdev_realize(DEVICE(&m->cpu), NULL, &error_fatal);
+    qemu_register_reset(main_cpu_reset, &m->cpu);
 
     /* RAM */
     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
@@ -430,7 +431,8 @@ static void q800_machine_init(MachineState *machine)
 
     /* IRQ Glue */
     glue = qdev_new(TYPE_GLUE);
-    object_property_set_link(OBJECT(glue), "cpu", OBJECT(cpu), &error_abort);
+    object_property_set_link(OBJECT(glue), "cpu", OBJECT(&m->cpu),
+                             &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(glue), &error_fatal);
 
     /* VIA 1 */
@@ -605,7 +607,7 @@ static void q800_machine_init(MachineState *machine)
 
     macfb_mode = (NUBUS_MACFB(dev)->macfb).mode;
 
-    cs = CPU(cpu);
+    cs = CPU(&m->cpu);
     if (linux_boot) {
         uint64_t high;
         void *param_blob, *param_ptr, *param_rng_seed;
@@ -735,6 +737,11 @@ static GlobalProperty hw_compat_q800[] = {
 };
 static const size_t hw_compat_q800_len = G_N_ELEMENTS(hw_compat_q800);
 
+static const char *q800_machine_valid_cpu_types[] = {
+    M68K_CPU_TYPE_NAME("m68040"),
+    NULL
+};
+
 static void q800_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -742,6 +749,7 @@ static void q800_machine_class_init(ObjectClass *oc, void *data)
     mc->desc = "Macintosh Quadra 800";
     mc->init = q800_machine_init;
     mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68040");
+    mc->valid_cpu_types = q800_machine_valid_cpu_types;
     mc->max_cpus = 1;
     mc->block_default_type = IF_SCSI;
     mc->default_ram_id = "m68k_mac.ram";
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index f3bc17aa1b..4cb1a51dfe 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -25,6 +25,7 @@
 
 #include "hw/boards.h"
 #include "qom/object.h"
+#include "target/m68k/cpu-qom.h"
 
 /*
  * The main Q800 machine
@@ -32,6 +33,8 @@
 
 struct Q800MachineState {
     MachineState parent_obj;
+
+    M68kCPU cpu;
 };
 
 #define TYPE_Q800_MACHINE MACHINE_TYPE_NAME("q800")

From 0b9b41fb8b4879d4dd3d2ce0a13493541c2d8d66 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:35 +0100
Subject: [PATCH 0026/1353] q800: move ROM memory region to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-7-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 13 +++++--------
 include/hw/m68k/q800.h |  2 ++
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 2b651de3c1..9f9668c2b4 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -372,7 +372,6 @@ static void q800_machine_init(MachineState *machine)
     int bios_size;
     ram_addr_t initrd_base;
     int32_t initrd_size;
-    MemoryRegion *rom;
     MemoryRegion *io;
     MemoryRegion *dp8393x_prom = g_new(MemoryRegion, 1);
     uint8_t *prom;
@@ -646,11 +645,10 @@ static void q800_machine_init(MachineState *machine)
         BOOTINFO1(param_ptr, BI_MAC_VROW, macfb_mode->stride);
         BOOTINFO1(param_ptr, BI_MAC_SCCBASE, SCC_BASE);
 
-        rom = g_malloc(sizeof(*rom));
-        memory_region_init_ram_ptr(rom, NULL, "m68k_fake_mac.rom",
+        memory_region_init_ram_ptr(&m->rom, NULL, "m68k_fake_mac.rom",
                                    sizeof(fake_mac_rom), fake_mac_rom);
-        memory_region_set_readonly(rom, true);
-        memory_region_add_subregion(get_system_memory(), MACROM_ADDR, rom);
+        memory_region_set_readonly(&m->rom, true);
+        memory_region_add_subregion(get_system_memory(), MACROM_ADDR, &m->rom);
 
         if (kernel_cmdline) {
             BOOTINFOSTR(param_ptr, BI_COMMAND_LINE,
@@ -692,11 +690,10 @@ static void q800_machine_init(MachineState *machine)
     } else {
         uint8_t *ptr;
         /* allocate and load BIOS */
-        rom = g_malloc(sizeof(*rom));
-        memory_region_init_rom(rom, NULL, "m68k_mac.rom", MACROM_SIZE,
+        memory_region_init_rom(&m->rom, NULL, "m68k_mac.rom", MACROM_SIZE,
                                &error_abort);
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
-        memory_region_add_subregion(get_system_memory(), MACROM_ADDR, rom);
+        memory_region_add_subregion(get_system_memory(), MACROM_ADDR, &m->rom);
 
         /* Load MacROM binary */
         if (filename) {
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 4cb1a51dfe..d1f1ae4b88 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -26,6 +26,7 @@
 #include "hw/boards.h"
 #include "qom/object.h"
 #include "target/m68k/cpu-qom.h"
+#include "exec/memory.h"
 
 /*
  * The main Q800 machine
@@ -35,6 +36,7 @@ struct Q800MachineState {
     MachineState parent_obj;
 
     M68kCPU cpu;
+    MemoryRegion rom;
 };
 
 #define TYPE_Q800_MACHINE MACHINE_TYPE_NAME("q800")

From 8e0932802f5fd6d8c5c12080d144f01b09863c3c Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:36 +0100
Subject: [PATCH 0027/1353] q800: move GLUE device into separate q800-glue.c
 file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will allow the q800-glue.h header to be included separately so that the
GLUE device can be referenced externally.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-8-mark.cave-ayland@ilande.co.uk>
[lv: update comment]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 MAINTAINERS                 |   2 +
 hw/m68k/meson.build         |   2 +-
 hw/m68k/q800-glue.c         | 252 ++++++++++++++++++++++++++++++++++++
 hw/m68k/q800.c              | 238 +---------------------------------
 include/hw/m68k/q800-glue.h |  50 +++++++
 5 files changed, 306 insertions(+), 238 deletions(-)
 create mode 100644 hw/m68k/q800-glue.c
 create mode 100644 include/hw/m68k/q800-glue.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 748a66fbaa..7f323cd2eb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1225,6 +1225,7 @@ q800
 M: Laurent Vivier <laurent@vivier.eu>
 S: Maintained
 F: hw/m68k/q800.c
+F: hw/m68k/q800-glue.c
 F: hw/misc/mac_via.c
 F: hw/nubus/*
 F: hw/display/macfb.c
@@ -1237,6 +1238,7 @@ F: include/hw/nubus/*
 F: include/hw/display/macfb.h
 F: include/hw/block/swim.h
 F: include/hw/m68k/q800.h
+F: include/hw/m68k/q800-glue.h
 
 virt
 M: Laurent Vivier <laurent@vivier.eu>
diff --git a/hw/m68k/meson.build b/hw/m68k/meson.build
index 31248641d3..84bc68fa4e 100644
--- a/hw/m68k/meson.build
+++ b/hw/m68k/meson.build
@@ -2,7 +2,7 @@ m68k_ss = ss.source_set()
 m68k_ss.add(when: 'CONFIG_AN5206', if_true: files('an5206.c', 'mcf5206.c'))
 m68k_ss.add(when: 'CONFIG_MCF5208', if_true: files('mcf5208.c', 'mcf_intc.c'))
 m68k_ss.add(when: 'CONFIG_NEXTCUBE', if_true: files('next-kbd.c', 'next-cube.c'))
-m68k_ss.add(when: 'CONFIG_Q800', if_true: files('q800.c'))
+m68k_ss.add(when: 'CONFIG_Q800', if_true: files('q800.c', 'q800-glue.c'))
 m68k_ss.add(when: 'CONFIG_M68K_VIRT', if_true: files('virt.c'))
 
 hw_arch += {'m68k': m68k_ss}
diff --git a/hw/m68k/q800-glue.c b/hw/m68k/q800-glue.c
new file mode 100644
index 0000000000..e81f9438f1
--- /dev/null
+++ b/hw/m68k/q800-glue.c
@@ -0,0 +1,252 @@
+/*
+ * QEMU q800 logic GLUE (General Logic Unit)
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/m68k/q800-glue.h"
+#include "hw/boards.h"
+#include "hw/irq.h"
+#include "hw/nmi.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+
+/*
+ * The GLUE (General Logic Unit) is an Apple custom integrated circuit chip
+ * that performs a variety of functions (RAM management, clock generation, ...).
+ * The GLUE chip receives interrupt requests from various devices,
+ * assign priority to each, and asserts one or more interrupt line to the
+ * CPU.
+ */
+
+/*
+ * The GLUE logic on the Quadra 800 supports 2 different IRQ routing modes
+ * controlled from the VIA1 auxmode GPIO (port B bit 6) which are documented
+ * in NetBSD as follows:
+ *
+ * A/UX mode (Linux, NetBSD, auxmode GPIO low)
+ *
+ *   Level 0:        Spurious: ignored
+ *   Level 1:        Software
+ *   Level 2:        VIA2 (except ethernet, sound)
+ *   Level 3:        Ethernet
+ *   Level 4:        Serial (SCC)
+ *   Level 5:        Sound
+ *   Level 6:        VIA1
+ *   Level 7:        NMIs: parity errors, RESET button, YANCC error
+ *
+ * Classic mode (default: used by MacOS, A/UX 3.0.1, auxmode GPIO high)
+ *
+ *   Level 0:        Spurious: ignored
+ *   Level 1:        VIA1 (clock, ADB)
+ *   Level 2:        VIA2 (NuBus, SCSI)
+ *   Level 3:
+ *   Level 4:        Serial (SCC)
+ *   Level 5:
+ *   Level 6:
+ *   Level 7:        Non-maskable: parity errors, RESET button
+ *
+ * Note that despite references to A/UX mode in Linux and NetBSD, at least
+ * A/UX 3.0.1 still uses Classic mode.
+ */
+
+static void GLUE_set_irq(void *opaque, int irq, int level)
+{
+    GLUEState *s = opaque;
+    int i;
+
+    if (s->auxmode) {
+        /* Classic mode */
+        switch (irq) {
+        case GLUE_IRQ_IN_VIA1:
+            irq = 0;
+            break;
+
+        case GLUE_IRQ_IN_VIA2:
+            irq = 1;
+            break;
+
+        case GLUE_IRQ_IN_SONIC:
+            /* Route to VIA2 instead */
+            qemu_set_irq(s->irqs[GLUE_IRQ_NUBUS_9], level);
+            return;
+
+        case GLUE_IRQ_IN_ESCC:
+            irq = 3;
+            break;
+
+        case GLUE_IRQ_IN_NMI:
+            irq = 6;
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+    } else {
+        /* A/UX mode */
+        switch (irq) {
+        case GLUE_IRQ_IN_VIA1:
+            irq = 5;
+            break;
+
+        case GLUE_IRQ_IN_VIA2:
+            irq = 1;
+            break;
+
+        case GLUE_IRQ_IN_SONIC:
+            irq = 2;
+            break;
+
+        case GLUE_IRQ_IN_ESCC:
+            irq = 3;
+            break;
+
+        case GLUE_IRQ_IN_NMI:
+            irq = 6;
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+    }
+
+    if (level) {
+        s->ipr |= 1 << irq;
+    } else {
+        s->ipr &= ~(1 << irq);
+    }
+
+    for (i = 7; i >= 0; i--) {
+        if ((s->ipr >> i) & 1) {
+            m68k_set_irq_level(s->cpu, i + 1, i + 25);
+            return;
+        }
+    }
+    m68k_set_irq_level(s->cpu, 0, 0);
+}
+
+static void glue_auxmode_set_irq(void *opaque, int irq, int level)
+{
+    GLUEState *s = GLUE(opaque);
+
+    s->auxmode = level;
+}
+
+static void glue_nmi(NMIState *n, int cpu_index, Error **errp)
+{
+    GLUEState *s = GLUE(n);
+
+    /* Hold NMI active for 100ms */
+    GLUE_set_irq(s, GLUE_IRQ_IN_NMI, 1);
+    timer_mod(s->nmi_release, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 100);
+}
+
+static void glue_nmi_release(void *opaque)
+{
+    GLUEState *s = GLUE(opaque);
+
+    GLUE_set_irq(s, GLUE_IRQ_IN_NMI, 0);
+}
+
+static void glue_reset(DeviceState *dev)
+{
+    GLUEState *s = GLUE(dev);
+
+    s->ipr = 0;
+    s->auxmode = 0;
+
+    timer_del(s->nmi_release);
+}
+
+static const VMStateDescription vmstate_glue = {
+    .name = "q800-glue",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(ipr, GLUEState),
+        VMSTATE_UINT8(auxmode, GLUEState),
+        VMSTATE_TIMER_PTR(nmi_release, GLUEState),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+/*
+ * If the m68k CPU implemented its inbound irq lines as GPIO lines
+ * rather than via the m68k_set_irq_level() function we would not need
+ * this cpu link property and could instead provide outbound IRQ lines
+ * that the board could wire up to the CPU.
+ */
+static Property glue_properties[] = {
+    DEFINE_PROP_LINK("cpu", GLUEState, cpu, TYPE_M68K_CPU, M68kCPU *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void glue_finalize(Object *obj)
+{
+    GLUEState *s = GLUE(obj);
+
+    timer_free(s->nmi_release);
+}
+
+static void glue_init(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+    GLUEState *s = GLUE(dev);
+
+    qdev_init_gpio_in(dev, GLUE_set_irq, 8);
+    qdev_init_gpio_in_named(dev, glue_auxmode_set_irq, "auxmode", 1);
+
+    qdev_init_gpio_out(dev, s->irqs, 1);
+
+    /* NMI release timer */
+    s->nmi_release = timer_new_ms(QEMU_CLOCK_VIRTUAL, glue_nmi_release, s);
+}
+
+static void glue_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    NMIClass *nc = NMI_CLASS(klass);
+
+    dc->vmsd = &vmstate_glue;
+    dc->reset = glue_reset;
+    device_class_set_props(dc, glue_properties);
+    nc->nmi_monitor_handler = glue_nmi;
+}
+
+static const TypeInfo glue_info = {
+    .name = TYPE_GLUE,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(GLUEState),
+    .instance_init = glue_init,
+    .instance_finalize = glue_finalize,
+    .class_init = glue_class_init,
+    .interfaces = (InterfaceInfo[]) {
+         { TYPE_NMI },
+         { }
+    },
+};
+
+static void glue_register_types(void)
+{
+    type_register_static(&glue_info);
+}
+
+type_init(glue_register_types)
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 9f9668c2b4..9f9de2ebaf 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -28,7 +28,6 @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/or-irq.h"
-#include "hw/nmi.h"
 #include "elf.h"
 #include "hw/loader.h"
 #include "ui/console.h"
@@ -39,6 +38,7 @@
 #include "standard-headers/asm-m68k/bootinfo-mac.h"
 #include "bootinfo.h"
 #include "hw/m68k/q800.h"
+#include "hw/m68k/q800-glue.h"
 #include "hw/misc/mac_via.h"
 #include "hw/input/adb.h"
 #include "hw/nubus/mac-nubus-bridge.h"
@@ -88,241 +88,6 @@
 #define Q800_NUBUS_SLOTS_AVAILABLE    (BIT(0x9) | BIT(0xc) | BIT(0xd) | \
                                        BIT(0xe))
 
-/*
- * The GLUE (General Logic Unit) is an Apple custom integrated circuit chip
- * that performs a variety of functions (RAM management, clock generation, ...).
- * The GLUE chip receives interrupt requests from various devices,
- * assign priority to each, and asserts one or more interrupt line to the
- * CPU.
- */
-
-#define TYPE_GLUE "q800-glue"
-OBJECT_DECLARE_SIMPLE_TYPE(GLUEState, GLUE)
-
-struct GLUEState {
-    SysBusDevice parent_obj;
-
-    M68kCPU *cpu;
-    uint8_t ipr;
-    uint8_t auxmode;
-    qemu_irq irqs[1];
-    QEMUTimer *nmi_release;
-};
-
-#define GLUE_IRQ_IN_VIA1       0
-#define GLUE_IRQ_IN_VIA2       1
-#define GLUE_IRQ_IN_SONIC      2
-#define GLUE_IRQ_IN_ESCC       3
-#define GLUE_IRQ_IN_NMI        4
-
-#define GLUE_IRQ_NUBUS_9       0
-
-/*
- * The GLUE logic on the Quadra 800 supports 2 different IRQ routing modes
- * controlled from the VIA1 auxmode GPIO (port B bit 6) which are documented
- * in NetBSD as follows:
- *
- * A/UX mode (Linux, NetBSD, auxmode GPIO low)
- *
- *   Level 0:        Spurious: ignored
- *   Level 1:        Software
- *   Level 2:        VIA2 (except ethernet, sound)
- *   Level 3:        Ethernet
- *   Level 4:        Serial (SCC)
- *   Level 5:        Sound
- *   Level 6:        VIA1
- *   Level 7:        NMIs: parity errors, RESET button, YANCC error
- *
- * Classic mode (default: used by MacOS, A/UX 3.0.1, auxmode GPIO high)
- *
- *   Level 0:        Spurious: ignored
- *   Level 1:        VIA1 (clock, ADB)
- *   Level 2:        VIA2 (NuBus, SCSI)
- *   Level 3:
- *   Level 4:        Serial (SCC)
- *   Level 5:
- *   Level 6:
- *   Level 7:        Non-maskable: parity errors, RESET button
- *
- * Note that despite references to A/UX mode in Linux and NetBSD, at least
- * A/UX 3.0.1 still uses Classic mode.
- */
-
-static void GLUE_set_irq(void *opaque, int irq, int level)
-{
-    GLUEState *s = opaque;
-    int i;
-
-    if (s->auxmode) {
-        /* Classic mode */
-        switch (irq) {
-        case GLUE_IRQ_IN_VIA1:
-            irq = 0;
-            break;
-
-        case GLUE_IRQ_IN_VIA2:
-            irq = 1;
-            break;
-
-        case GLUE_IRQ_IN_SONIC:
-            /* Route to VIA2 instead */
-            qemu_set_irq(s->irqs[GLUE_IRQ_NUBUS_9], level);
-            return;
-
-        case GLUE_IRQ_IN_ESCC:
-            irq = 3;
-            break;
-
-        case GLUE_IRQ_IN_NMI:
-            irq = 6;
-            break;
-
-        default:
-            g_assert_not_reached();
-        }
-    } else {
-        /* A/UX mode */
-        switch (irq) {
-        case GLUE_IRQ_IN_VIA1:
-            irq = 5;
-            break;
-
-        case GLUE_IRQ_IN_VIA2:
-            irq = 1;
-            break;
-
-        case GLUE_IRQ_IN_SONIC:
-            irq = 2;
-            break;
-
-        case GLUE_IRQ_IN_ESCC:
-            irq = 3;
-            break;
-
-        case GLUE_IRQ_IN_NMI:
-            irq = 6;
-            break;
-
-        default:
-            g_assert_not_reached();
-        }
-    }
-
-    if (level) {
-        s->ipr |= 1 << irq;
-    } else {
-        s->ipr &= ~(1 << irq);
-    }
-
-    for (i = 7; i >= 0; i--) {
-        if ((s->ipr >> i) & 1) {
-            m68k_set_irq_level(s->cpu, i + 1, i + 25);
-            return;
-        }
-    }
-    m68k_set_irq_level(s->cpu, 0, 0);
-}
-
-static void glue_auxmode_set_irq(void *opaque, int irq, int level)
-{
-    GLUEState *s = GLUE(opaque);
-
-    s->auxmode = level;
-}
-
-static void glue_nmi(NMIState *n, int cpu_index, Error **errp)
-{
-    GLUEState *s = GLUE(n);
-
-    /* Hold NMI active for 100ms */
-    GLUE_set_irq(s, GLUE_IRQ_IN_NMI, 1);
-    timer_mod(s->nmi_release, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 100);
-}
-
-static void glue_nmi_release(void *opaque)
-{
-    GLUEState *s = GLUE(opaque);
-
-    GLUE_set_irq(s, GLUE_IRQ_IN_NMI, 0);
-}
-
-static void glue_reset(DeviceState *dev)
-{
-    GLUEState *s = GLUE(dev);
-
-    s->ipr = 0;
-    s->auxmode = 0;
-
-    timer_del(s->nmi_release);
-}
-
-static const VMStateDescription vmstate_glue = {
-    .name = "q800-glue",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT8(ipr, GLUEState),
-        VMSTATE_UINT8(auxmode, GLUEState),
-        VMSTATE_TIMER_PTR(nmi_release, GLUEState),
-        VMSTATE_END_OF_LIST(),
-    },
-};
-
-/*
- * If the m68k CPU implemented its inbound irq lines as GPIO lines
- * rather than via the m68k_set_irq_level() function we would not need
- * this cpu link property and could instead provide outbound IRQ lines
- * that the board could wire up to the CPU.
- */
-static Property glue_properties[] = {
-    DEFINE_PROP_LINK("cpu", GLUEState, cpu, TYPE_M68K_CPU, M68kCPU *),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void glue_finalize(Object *obj)
-{
-    GLUEState *s = GLUE(obj);
-
-    timer_free(s->nmi_release);
-}
-
-static void glue_init(Object *obj)
-{
-    DeviceState *dev = DEVICE(obj);
-    GLUEState *s = GLUE(dev);
-
-    qdev_init_gpio_in(dev, GLUE_set_irq, 8);
-    qdev_init_gpio_in_named(dev, glue_auxmode_set_irq, "auxmode", 1);
-
-    qdev_init_gpio_out(dev, s->irqs, 1);
-
-    /* NMI release timer */
-    s->nmi_release = timer_new_ms(QEMU_CLOCK_VIRTUAL, glue_nmi_release, s);
-}
-
-static void glue_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    NMIClass *nc = NMI_CLASS(klass);
-
-    dc->vmsd = &vmstate_glue;
-    dc->reset = glue_reset;
-    device_class_set_props(dc, glue_properties);
-    nc->nmi_monitor_handler = glue_nmi;
-}
-
-static const TypeInfo glue_info = {
-    .name = TYPE_GLUE,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(GLUEState),
-    .instance_init = glue_init,
-    .instance_finalize = glue_finalize,
-    .class_init = glue_class_init,
-    .interfaces = (InterfaceInfo[]) {
-         { TYPE_NMI },
-         { }
-    },
-};
 
 static void main_cpu_reset(void *opaque)
 {
@@ -763,7 +528,6 @@ static const TypeInfo q800_machine_typeinfo = {
 static void q800_machine_register_types(void)
 {
     type_register_static(&q800_machine_typeinfo);
-    type_register_static(&glue_info);
 }
 
 type_init(q800_machine_register_types)
diff --git a/include/hw/m68k/q800-glue.h b/include/hw/m68k/q800-glue.h
new file mode 100644
index 0000000000..a35efc1c53
--- /dev/null
+++ b/include/hw/m68k/q800-glue.h
@@ -0,0 +1,50 @@
+/*
+ * QEMU q800 logic GLUE (General Logic Unit)
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_Q800_GLUE_H
+#define HW_Q800_GLUE_H
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+
+#define TYPE_GLUE "q800-glue"
+OBJECT_DECLARE_SIMPLE_TYPE(GLUEState, GLUE)
+
+struct GLUEState {
+    SysBusDevice parent_obj;
+
+    M68kCPU *cpu;
+    uint8_t ipr;
+    uint8_t auxmode;
+    qemu_irq irqs[1];
+    QEMUTimer *nmi_release;
+};
+
+#define GLUE_IRQ_IN_VIA1       0
+#define GLUE_IRQ_IN_VIA2       1
+#define GLUE_IRQ_IN_SONIC      2
+#define GLUE_IRQ_IN_ESCC       3
+#define GLUE_IRQ_IN_NMI        4
+
+#define GLUE_IRQ_NUBUS_9       0
+
+#endif

From 101b4764c7312dff04db8bf277eda875f7c00fa3 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:37 +0100
Subject: [PATCH 0028/1353] q800-glue.c: switch TypeInfo registration to use
 DEFINE_TYPES() macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The use of the DEFINE_TYPES() macro will soon be recommended over the use of
calling type_init() directly.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-9-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800-glue.c | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/hw/m68k/q800-glue.c b/hw/m68k/q800-glue.c
index e81f9438f1..34c4f0e987 100644
--- a/hw/m68k/q800-glue.c
+++ b/hw/m68k/q800-glue.c
@@ -231,22 +231,19 @@ static void glue_class_init(ObjectClass *klass, void *data)
     nc->nmi_monitor_handler = glue_nmi;
 }
 
-static const TypeInfo glue_info = {
-    .name = TYPE_GLUE,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(GLUEState),
-    .instance_init = glue_init,
-    .instance_finalize = glue_finalize,
-    .class_init = glue_class_init,
-    .interfaces = (InterfaceInfo[]) {
-         { TYPE_NMI },
-         { }
+static const TypeInfo glue_info_types[] = {
+    {
+        .name = TYPE_GLUE,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(GLUEState),
+        .instance_init = glue_init,
+        .instance_finalize = glue_finalize,
+        .class_init = glue_class_init,
+        .interfaces = (InterfaceInfo[]) {
+             { TYPE_NMI },
+             { }
+        },
     },
 };
 
-static void glue_register_types(void)
-{
-    type_register_static(&glue_info);
-}
-
-type_init(glue_register_types)
+DEFINE_TYPES(glue_info_types)

From 1ecc6ec1ffbf5c209233be137f04344ec4eac6b5 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:38 +0100
Subject: [PATCH 0029/1353] q800: move GLUE device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the GLUE device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-10-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 24 ++++++++++++++----------
 include/hw/m68k/q800.h |  2 ++
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 9f9de2ebaf..505e50d4af 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -158,7 +158,6 @@ static void q800_machine_init(MachineState *machine)
     SysBusDevice *sysbus;
     BusState *adb_bus;
     NubusBus *nubus;
-    DeviceState *glue;
     DriveInfo *dinfo;
     uint8_t rng_seed[32];
 
@@ -194,10 +193,10 @@ static void q800_machine_init(MachineState *machine)
     }
 
     /* IRQ Glue */
-    glue = qdev_new(TYPE_GLUE);
-    object_property_set_link(OBJECT(glue), "cpu", OBJECT(&m->cpu),
+    object_initialize_child(OBJECT(machine), "glue", &m->glue, TYPE_GLUE);
+    object_property_set_link(OBJECT(&m->glue), "cpu", OBJECT(&m->cpu),
                              &error_abort);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(glue), &error_fatal);
+    sysbus_realize(SYS_BUS_DEVICE(&m->glue), &error_fatal);
 
     /* VIA 1 */
     via1_dev = qdev_new(TYPE_MOS6522_Q800_VIA1);
@@ -208,10 +207,12 @@ static void q800_machine_init(MachineState *machine)
     sysbus = SYS_BUS_DEVICE(via1_dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
     sysbus_mmio_map(sysbus, 1, VIA_BASE);
-    sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(glue, GLUE_IRQ_IN_VIA1));
+    sysbus_connect_irq(sysbus, 0,
+                       qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_VIA1));
     /* A/UX mode */
     qdev_connect_gpio_out(via1_dev, 0,
-                          qdev_get_gpio_in_named(glue, "auxmode", 0));
+                          qdev_get_gpio_in_named(DEVICE(&m->glue),
+                                                 "auxmode", 0));
 
     adb_bus = qdev_get_child_bus(via1_dev, "adb.0");
     dev = qdev_new(TYPE_ADB_KEYBOARD);
@@ -224,7 +225,8 @@ static void q800_machine_init(MachineState *machine)
     sysbus = SYS_BUS_DEVICE(via2_dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
     sysbus_mmio_map(sysbus, 1, VIA_BASE + VIA_SIZE);
-    sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(glue, GLUE_IRQ_IN_VIA2));
+    sysbus_connect_irq(sysbus, 0,
+                       qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_VIA2));
 
     /* MACSONIC */
 
@@ -257,7 +259,8 @@ static void q800_machine_init(MachineState *machine)
     sysbus = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
     sysbus_mmio_map(sysbus, 0, SONIC_BASE);
-    sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(glue, GLUE_IRQ_IN_SONIC));
+    sysbus_connect_irq(sysbus, 0,
+                       qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_SONIC));
 
     memory_region_init_rom(dp8393x_prom, NULL, "dp8393x-q800.prom",
                            SONIC_PROM_SIZE, &error_fatal);
@@ -294,7 +297,8 @@ static void q800_machine_init(MachineState *machine)
     sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(escc_orgate, 0));
     sysbus_connect_irq(sysbus, 1, qdev_get_gpio_in(escc_orgate, 1));
     qdev_connect_gpio_out(escc_orgate, 0,
-                          qdev_get_gpio_in(glue, GLUE_IRQ_IN_ESCC));
+                          qdev_get_gpio_in(DEVICE(&m->glue),
+                                           GLUE_IRQ_IN_ESCC));
     sysbus_mmio_map(sysbus, 0, SCC_BASE);
 
     /* SCSI */
@@ -349,7 +353,7 @@ static void q800_machine_init(MachineState *machine)
      * Since the framebuffer in slot 0x9 uses a separate IRQ, wire the unused
      * IRQ via GLUE for use by SONIC Ethernet in classic mode
      */
-    qdev_connect_gpio_out(glue, GLUE_IRQ_NUBUS_9,
+    qdev_connect_gpio_out(DEVICE(&m->glue), GLUE_IRQ_NUBUS_9,
                           qdev_get_gpio_in_named(via2_dev, "nubus-irq",
                                                  VIA2_NUBUS_IRQ_9));
 
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index d1f1ae4b88..fda42e0a1c 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -27,6 +27,7 @@
 #include "qom/object.h"
 #include "target/m68k/cpu-qom.h"
 #include "exec/memory.h"
+#include "hw/m68k/q800-glue.h"
 
 /*
  * The main Q800 machine
@@ -37,6 +38,7 @@ struct Q800MachineState {
 
     M68kCPU cpu;
     MemoryRegion rom;
+    GLUEState glue;
 };
 
 #define TYPE_Q800_MACHINE MACHINE_TYPE_NAME("q800")

From 7527c52fd0472dbe06cc1f2f3b7979e202995ea2 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:39 +0100
Subject: [PATCH 0030/1353] q800: introduce mac-io container memory region
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move all devices from the IO region to within the container in preparation
for updating the IO aliasing mechanism.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-11-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 6 ++++++
 include/hw/m68k/q800.h | 1 +
 2 files changed, 7 insertions(+)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 505e50d4af..359bdf3443 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -177,6 +177,12 @@ static void q800_machine_init(MachineState *machine)
     /* RAM */
     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
 
+    /*
+     * Create container for all IO devices
+     */
+    memory_region_init(&m->macio, OBJECT(machine), "mac-io", IO_SLICE);
+    memory_region_add_subregion(get_system_memory(), IO_BASE, &m->macio);
+
     /*
      * Memory from IO_BASE to IO_BASE + IO_SLICE is repeated
      * from IO_BASE + IO_SLICE to IO_BASE + IO_SIZE
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index fda42e0a1c..17067dfad7 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -39,6 +39,7 @@ struct Q800MachineState {
     M68kCPU cpu;
     MemoryRegion rom;
     GLUEState glue;
+    MemoryRegion macio;
 };
 
 #define TYPE_Q800_MACHINE MACHINE_TYPE_NAME("q800")

From f18a2886328d92c617a08692157d2b3f68477548 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:40 +0100
Subject: [PATCH 0031/1353] q800: reimplement mac-io region aliasing using IO
 memory region

The current use of aliased memory regions causes us 2 problems: firstly the
output of "info qom-tree" is absolutely huge and difficult to read, and
secondly we have already reached the internal limit for memory regions as
adding any new memory region into the mac-io region causes QEMU to assert
with "phys_section_add: Assertion `map->sections_nb < TARGET_PAGE_SIZE'
failed".

Implement the mac-io region aliasing using a single IO memory region that
applies IO_SLICE_MASK representing the maximum size of the aliased region and
then forwarding the access to the existing mac-io memory region using the
address space API.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-12-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 100 +++++++++++++++++++++++++++++++++--------
 include/hw/m68k/q800.h |   1 +
 2 files changed, 82 insertions(+), 19 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 359bdf3443..51b8d8ec3c 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -59,6 +59,7 @@
 
 #define IO_BASE               0x50000000
 #define IO_SLICE              0x00040000
+#define IO_SLICE_MASK         (IO_SLICE - 1)
 #define IO_SIZE               0x04000000
 
 #define VIA_BASE              (IO_BASE + 0x00000)
@@ -127,6 +128,68 @@ static uint8_t fake_mac_rom[] = {
     0x60, 0xFE                          /* bras [self] */
 };
 
+static MemTxResult macio_alias_read(void *opaque, hwaddr addr, uint64_t *data,
+                                    unsigned size, MemTxAttrs attrs)
+{
+    MemTxResult r;
+    uint32_t val;
+
+    addr &= IO_SLICE_MASK;
+    addr |= IO_BASE;
+
+    switch (size) {
+    case 4:
+        val = address_space_ldl_be(&address_space_memory, addr, attrs, &r);
+        break;
+    case 2:
+        val = address_space_lduw_be(&address_space_memory, addr, attrs, &r);
+        break;
+    case 1:
+        val = address_space_ldub(&address_space_memory, addr, attrs, &r);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    *data = val;
+    return r;
+}
+
+static MemTxResult macio_alias_write(void *opaque, hwaddr addr, uint64_t value,
+                                     unsigned size, MemTxAttrs attrs)
+{
+    MemTxResult r;
+
+    addr &= IO_SLICE_MASK;
+    addr |= IO_BASE;
+
+    switch (size) {
+    case 4:
+        address_space_stl_be(&address_space_memory, addr, value, attrs, &r);
+        break;
+    case 2:
+        address_space_stw_be(&address_space_memory, addr, value, attrs, &r);
+        break;
+    case 1:
+        address_space_stb(&address_space_memory, addr, value, attrs, &r);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return r;
+}
+
+static const MemoryRegionOps macio_alias_ops = {
+    .read_with_attrs = macio_alias_read,
+    .write_with_attrs = macio_alias_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
 static void q800_machine_init(MachineState *machine)
 {
     Q800MachineState *m = Q800_MACHINE(machine);
@@ -137,10 +200,8 @@ static void q800_machine_init(MachineState *machine)
     int bios_size;
     ram_addr_t initrd_base;
     int32_t initrd_size;
-    MemoryRegion *io;
     MemoryRegion *dp8393x_prom = g_new(MemoryRegion, 1);
     uint8_t *prom;
-    const int io_slice_nb = (IO_SIZE / IO_SLICE) - 1;
     int i, checksum;
     MacFbMode *macfb_mode;
     ram_addr_t ram_size = machine->ram_size;
@@ -187,16 +248,10 @@ static void q800_machine_init(MachineState *machine)
      * Memory from IO_BASE to IO_BASE + IO_SLICE is repeated
      * from IO_BASE + IO_SLICE to IO_BASE + IO_SIZE
      */
-    io = g_new(MemoryRegion, io_slice_nb);
-    for (i = 0; i < io_slice_nb; i++) {
-        char *name = g_strdup_printf("mac_m68k.io[%d]", i + 1);
-
-        memory_region_init_alias(&io[i], NULL, name, get_system_memory(),
-                                 IO_BASE, IO_SLICE);
-        memory_region_add_subregion(get_system_memory(),
-                                    IO_BASE + (i + 1) * IO_SLICE, &io[i]);
-        g_free(name);
-    }
+    memory_region_init_io(&m->macio_alias, OBJECT(machine), &macio_alias_ops,
+                          &m->macio, "mac-io.alias", IO_SIZE - IO_SLICE);
+    memory_region_add_subregion(get_system_memory(), IO_BASE + IO_SLICE,
+                                &m->macio_alias);
 
     /* IRQ Glue */
     object_initialize_child(OBJECT(machine), "glue", &m->glue, TYPE_GLUE);
@@ -212,7 +267,8 @@ static void q800_machine_init(MachineState *machine)
     }
     sysbus = SYS_BUS_DEVICE(via1_dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
-    sysbus_mmio_map(sysbus, 1, VIA_BASE);
+    memory_region_add_subregion(&m->macio, VIA_BASE - IO_BASE,
+                                sysbus_mmio_get_region(sysbus, 1));
     sysbus_connect_irq(sysbus, 0,
                        qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_VIA1));
     /* A/UX mode */
@@ -230,7 +286,8 @@ static void q800_machine_init(MachineState *machine)
     via2_dev = qdev_new(TYPE_MOS6522_Q800_VIA2);
     sysbus = SYS_BUS_DEVICE(via2_dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
-    sysbus_mmio_map(sysbus, 1, VIA_BASE + VIA_SIZE);
+    memory_region_add_subregion(&m->macio, VIA_BASE - IO_BASE + VIA_SIZE,
+                                sysbus_mmio_get_region(sysbus, 1));
     sysbus_connect_irq(sysbus, 0,
                        qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_VIA2));
 
@@ -264,7 +321,8 @@ static void q800_machine_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_abort);
     sysbus = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
-    sysbus_mmio_map(sysbus, 0, SONIC_BASE);
+    memory_region_add_subregion(&m->macio, SONIC_BASE - IO_BASE,
+                                sysbus_mmio_get_region(sysbus, 0));
     sysbus_connect_irq(sysbus, 0,
                        qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_SONIC));
 
@@ -305,7 +363,8 @@ static void q800_machine_init(MachineState *machine)
     qdev_connect_gpio_out(escc_orgate, 0,
                           qdev_get_gpio_in(DEVICE(&m->glue),
                                            GLUE_IRQ_IN_ESCC));
-    sysbus_mmio_map(sysbus, 0, SCC_BASE);
+    memory_region_add_subregion(&m->macio, SCC_BASE - IO_BASE,
+                                sysbus_mmio_get_region(sysbus, 0));
 
     /* SCSI */
 
@@ -325,8 +384,10 @@ static void q800_machine_init(MachineState *machine)
                                                   VIA2_IRQ_SCSI_BIT)));
     sysbus_connect_irq(sysbus, 1, qemu_irq_invert(qdev_get_gpio_in(via2_dev,
                                                   VIA2_IRQ_SCSI_DATA_BIT)));
-    sysbus_mmio_map(sysbus, 0, ESP_BASE);
-    sysbus_mmio_map(sysbus, 1, ESP_PDMA);
+    memory_region_add_subregion(&m->macio, ESP_BASE - IO_BASE,
+                                sysbus_mmio_get_region(sysbus, 0));
+    memory_region_add_subregion(&m->macio, ESP_PDMA - IO_BASE,
+                                sysbus_mmio_get_region(sysbus, 1));
 
     scsi_bus_legacy_handle_cmdline(&esp->bus);
 
@@ -334,7 +395,8 @@ static void q800_machine_init(MachineState *machine)
 
     dev = qdev_new(TYPE_SWIM);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, SWIM_BASE);
+    memory_region_add_subregion(&m->macio, SWIM_BASE - IO_BASE,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
 
     /* NuBus */
 
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 17067dfad7..1ed38bf0b1 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -40,6 +40,7 @@ struct Q800MachineState {
     MemoryRegion rom;
     GLUEState glue;
     MemoryRegion macio;
+    MemoryRegion macio_alias;
 };
 
 #define TYPE_Q800_MACHINE MACHINE_TYPE_NAME("q800")

From 6d32c0643f263da92d24af4c87c86ea2c0f7f251 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:41 +0100
Subject: [PATCH 0032/1353] q800: move VIA1 device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the VIA1 device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-13-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 16 +++++++++-------
 include/hw/m68k/q800.h |  2 ++
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 51b8d8ec3c..fccdad5f3c 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -212,7 +212,7 @@ static void q800_machine_init(MachineState *machine)
     hwaddr parameters_base;
     CPUState *cs;
     DeviceState *dev;
-    DeviceState *via1_dev, *via2_dev;
+    DeviceState *via2_dev;
     DeviceState *escc_orgate;
     SysBusESPState *sysbus_esp;
     ESPState *esp;
@@ -260,23 +260,25 @@ static void q800_machine_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&m->glue), &error_fatal);
 
     /* VIA 1 */
-    via1_dev = qdev_new(TYPE_MOS6522_Q800_VIA1);
+    object_initialize_child(OBJECT(machine), "via1", &m->via1,
+                            TYPE_MOS6522_Q800_VIA1);
     dinfo = drive_get(IF_MTD, 0, 0);
     if (dinfo) {
-        qdev_prop_set_drive(via1_dev, "drive", blk_by_legacy_dinfo(dinfo));
+        qdev_prop_set_drive(DEVICE(&m->via1), "drive",
+                            blk_by_legacy_dinfo(dinfo));
     }
-    sysbus = SYS_BUS_DEVICE(via1_dev);
-    sysbus_realize_and_unref(sysbus, &error_fatal);
+    sysbus = SYS_BUS_DEVICE(&m->via1);
+    sysbus_realize(sysbus, &error_fatal);
     memory_region_add_subregion(&m->macio, VIA_BASE - IO_BASE,
                                 sysbus_mmio_get_region(sysbus, 1));
     sysbus_connect_irq(sysbus, 0,
                        qdev_get_gpio_in(DEVICE(&m->glue), GLUE_IRQ_IN_VIA1));
     /* A/UX mode */
-    qdev_connect_gpio_out(via1_dev, 0,
+    qdev_connect_gpio_out(DEVICE(&m->via1), 0,
                           qdev_get_gpio_in_named(DEVICE(&m->glue),
                                                  "auxmode", 0));
 
-    adb_bus = qdev_get_child_bus(via1_dev, "adb.0");
+    adb_bus = qdev_get_child_bus(DEVICE(&m->via1), "adb.0");
     dev = qdev_new(TYPE_ADB_KEYBOARD);
     qdev_realize_and_unref(dev, adb_bus, &error_fatal);
     dev = qdev_new(TYPE_ADB_MOUSE);
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 1ed38bf0b1..5cf66d08a0 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -28,6 +28,7 @@
 #include "target/m68k/cpu-qom.h"
 #include "exec/memory.h"
 #include "hw/m68k/q800-glue.h"
+#include "hw/misc/mac_via.h"
 
 /*
  * The main Q800 machine
@@ -39,6 +40,7 @@ struct Q800MachineState {
     M68kCPU cpu;
     MemoryRegion rom;
     GLUEState glue;
+    MOS6522Q800VIA1State via1;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From d7942e166ae2da7f70a55365470177d9e71cca3f Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:42 +0100
Subject: [PATCH 0033/1353] q800: move VIA2 device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the VIA2 device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-14-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 27 ++++++++++++++++-----------
 include/hw/m68k/q800.h |  1 +
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index fccdad5f3c..988b4981b8 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -212,7 +212,6 @@ static void q800_machine_init(MachineState *machine)
     hwaddr parameters_base;
     CPUState *cs;
     DeviceState *dev;
-    DeviceState *via2_dev;
     DeviceState *escc_orgate;
     SysBusESPState *sysbus_esp;
     ESPState *esp;
@@ -285,9 +284,10 @@ static void q800_machine_init(MachineState *machine)
     qdev_realize_and_unref(dev, adb_bus, &error_fatal);
 
     /* VIA 2 */
-    via2_dev = qdev_new(TYPE_MOS6522_Q800_VIA2);
-    sysbus = SYS_BUS_DEVICE(via2_dev);
-    sysbus_realize_and_unref(sysbus, &error_fatal);
+    object_initialize_child(OBJECT(machine), "via2", &m->via2,
+                            TYPE_MOS6522_Q800_VIA2);
+    sysbus = SYS_BUS_DEVICE(&m->via2);
+    sysbus_realize(sysbus, &error_fatal);
     memory_region_add_subregion(&m->macio, VIA_BASE - IO_BASE + VIA_SIZE,
                                 sysbus_mmio_get_region(sysbus, 1));
     sysbus_connect_irq(sysbus, 0,
@@ -382,10 +382,14 @@ static void q800_machine_init(MachineState *machine)
     sysbus = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(sysbus, &error_fatal);
     /* SCSI and SCSI data IRQs are negative edge triggered */
-    sysbus_connect_irq(sysbus, 0, qemu_irq_invert(qdev_get_gpio_in(via2_dev,
-                                                  VIA2_IRQ_SCSI_BIT)));
-    sysbus_connect_irq(sysbus, 1, qemu_irq_invert(qdev_get_gpio_in(via2_dev,
-                                                  VIA2_IRQ_SCSI_DATA_BIT)));
+    sysbus_connect_irq(sysbus, 0,
+                       qemu_irq_invert(
+                           qdev_get_gpio_in(DEVICE(&m->via2),
+                                                   VIA2_IRQ_SCSI_BIT)));
+    sysbus_connect_irq(sysbus, 1,
+                       qemu_irq_invert(
+                           qdev_get_gpio_in(DEVICE(&m->via2),
+                                                   VIA2_IRQ_SCSI_DATA_BIT)));
     memory_region_add_subregion(&m->macio, ESP_BASE - IO_BASE,
                                 sysbus_mmio_get_region(sysbus, 0));
     memory_region_add_subregion(&m->macio, ESP_PDMA - IO_BASE,
@@ -411,11 +415,12 @@ static void q800_machine_init(MachineState *machine)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, NUBUS_SLOT_BASE +
                     MAC_NUBUS_FIRST_SLOT * NUBUS_SLOT_SIZE);
     qdev_connect_gpio_out(dev, 9,
-                          qdev_get_gpio_in_named(via2_dev, "nubus-irq",
+                          qdev_get_gpio_in_named(DEVICE(&m->via2), "nubus-irq",
                           VIA2_NUBUS_IRQ_INTVIDEO));
     for (i = 1; i < VIA2_NUBUS_IRQ_NB; i++) {
         qdev_connect_gpio_out(dev, 9 + i,
-                              qdev_get_gpio_in_named(via2_dev, "nubus-irq",
+                              qdev_get_gpio_in_named(DEVICE(&m->via2),
+                                                     "nubus-irq",
                                                      VIA2_NUBUS_IRQ_9 + i));
     }
 
@@ -424,7 +429,7 @@ static void q800_machine_init(MachineState *machine)
      * IRQ via GLUE for use by SONIC Ethernet in classic mode
      */
     qdev_connect_gpio_out(DEVICE(&m->glue), GLUE_IRQ_NUBUS_9,
-                          qdev_get_gpio_in_named(via2_dev, "nubus-irq",
+                          qdev_get_gpio_in_named(DEVICE(&m->via2), "nubus-irq",
                                                  VIA2_NUBUS_IRQ_9));
 
     nubus = &NUBUS_BRIDGE(dev)->bus;
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 5cf66d08a0..06c771635b 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -41,6 +41,7 @@ struct Q800MachineState {
     MemoryRegion rom;
     GLUEState glue;
     MOS6522Q800VIA1State via1;
+    MOS6522Q800VIA2State via2;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From 2db48d0364f9bbc0d22370fc26debfaa4adca31f Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:43 +0100
Subject: [PATCH 0034/1353] hw/net/dp8393x.c: move TYPE_DP8393X and
 dp8393xState into dp8393x.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is to enable them to be used outside of dp8393x.c.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Jason Wang <jasowang@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-15-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/net/dp8393x.c         | 32 +--------------------
 include/hw/net/dp8393x.h | 60 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 31 deletions(-)
 create mode 100644 include/hw/net/dp8393x.h

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 45b954e46c..a596f7fbc6 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
+#include "hw/net/dp8393x.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "net/net.h"
@@ -85,7 +86,6 @@ static const char *reg_names[] = {
 #define SONIC_MPT    0x2e
 #define SONIC_MDT    0x2f
 #define SONIC_DCR2   0x3f
-#define SONIC_REG_COUNT  0x40
 
 #define SONIC_CR_HTX     0x0001
 #define SONIC_CR_TXP     0x0002
@@ -139,36 +139,6 @@ static const char *reg_names[] = {
 #define SONIC_DESC_EOL   0x0001
 #define SONIC_DESC_ADDR  0xFFFE
 
-#define TYPE_DP8393X "dp8393x"
-OBJECT_DECLARE_SIMPLE_TYPE(dp8393xState, DP8393X)
-
-struct dp8393xState {
-    SysBusDevice parent_obj;
-
-    /* Hardware */
-    uint8_t it_shift;
-    bool big_endian;
-    bool last_rba_is_full;
-    qemu_irq irq;
-    int irq_level;
-    QEMUTimer *watchdog;
-    int64_t wt_last_update;
-    NICConf conf;
-    NICState *nic;
-    MemoryRegion mmio;
-
-    /* Registers */
-    uint16_t cam[16][3];
-    uint16_t regs[SONIC_REG_COUNT];
-
-    /* Temporaries */
-    uint8_t tx_buffer[0x10000];
-    int loopback_packet;
-
-    /* Memory access */
-    MemoryRegion *dma_mr;
-    AddressSpace as;
-};
 
 /*
  * Accessor functions for values which are formed by
diff --git a/include/hw/net/dp8393x.h b/include/hw/net/dp8393x.h
new file mode 100644
index 0000000000..4a3f7478be
--- /dev/null
+++ b/include/hw/net/dp8393x.h
@@ -0,0 +1,60 @@
+/*
+ * QEMU NS SONIC DP8393x netcard
+ *
+ * Copyright (c) 2008-2009 Herve Poussineau
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_NET_DP8393X_H
+#define HW_NET_DP8393X_H
+
+#include "hw/sysbus.h"
+#include "net/net.h"
+#include "exec/memory.h"
+
+#define SONIC_REG_COUNT  0x40
+
+#define TYPE_DP8393X "dp8393x"
+OBJECT_DECLARE_SIMPLE_TYPE(dp8393xState, DP8393X)
+
+struct dp8393xState {
+    SysBusDevice parent_obj;
+
+    /* Hardware */
+    uint8_t it_shift;
+    bool big_endian;
+    bool last_rba_is_full;
+    qemu_irq irq;
+    int irq_level;
+    QEMUTimer *watchdog;
+    int64_t wt_last_update;
+    NICConf conf;
+    NICState *nic;
+    MemoryRegion mmio;
+
+    /* Registers */
+    uint16_t cam[16][3];
+    uint16_t regs[SONIC_REG_COUNT];
+
+    /* Temporaries */
+    uint8_t tx_buffer[0x10000];
+    int loopback_packet;
+
+    /* Memory access */
+    MemoryRegion *dma_mr;
+    AddressSpace as;
+};
+
+#endif

From 804ae67ee6fc3ff5a6c82edba7ed4cbdd33de091 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:44 +0100
Subject: [PATCH 0035/1353] q800: move dp8393x device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the dp8393x device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Jason Wang <jasowang@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-16-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 6 ++++--
 include/hw/m68k/q800.h | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 988b4981b8..13806613fa 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -315,14 +315,16 @@ static void q800_machine_init(MachineState *machine)
     nd_table[0].macaddr.a[1] = 0x00;
     nd_table[0].macaddr.a[2] = 0x07;
 
-    dev = qdev_new("dp8393x");
+    object_initialize_child(OBJECT(machine), "dp8393x", &m->dp8393x,
+                            TYPE_DP8393X);
+    dev = DEVICE(&m->dp8393x);
     qdev_set_nic_properties(dev, &nd_table[0]);
     qdev_prop_set_uint8(dev, "it_shift", 2);
     qdev_prop_set_bit(dev, "big_endian", true);
     object_property_set_link(OBJECT(dev), "dma_mr",
                              OBJECT(get_system_memory()), &error_abort);
     sysbus = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(sysbus, &error_fatal);
+    sysbus_realize(sysbus, &error_fatal);
     memory_region_add_subregion(&m->macio, SONIC_BASE - IO_BASE,
                                 sysbus_mmio_get_region(sysbus, 0));
     sysbus_connect_irq(sysbus, 0,
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 06c771635b..d11bc020ed 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -29,6 +29,7 @@
 #include "exec/memory.h"
 #include "hw/m68k/q800-glue.h"
 #include "hw/misc/mac_via.h"
+#include "hw/net/dp8393x.h"
 
 /*
  * The main Q800 machine
@@ -42,6 +43,7 @@ struct Q800MachineState {
     GLUEState glue;
     MOS6522Q800VIA1State via1;
     MOS6522Q800VIA2State via2;
+    dp8393xState dp8393x;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From 836126c77326d9a7b629063c9caa9deff3a26aed Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:45 +0100
Subject: [PATCH 0036/1353] q800: move ESCC device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the ESCC device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-17-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 6 ++++--
 include/hw/m68k/q800.h | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 13806613fa..8bf94b2511 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -346,7 +346,9 @@ static void q800_machine_init(MachineState *machine)
 
     /* SCC */
 
-    dev = qdev_new(TYPE_ESCC);
+    object_initialize_child(OBJECT(machine), "escc", &m->escc,
+                            TYPE_ESCC);
+    dev = DEVICE(&m->escc);
     qdev_prop_set_uint32(dev, "disabled", 0);
     qdev_prop_set_uint32(dev, "frequency", MAC_CLOCK);
     qdev_prop_set_uint32(dev, "it_shift", 1);
@@ -356,7 +358,7 @@ static void q800_machine_init(MachineState *machine)
     qdev_prop_set_uint32(dev, "chnBtype", 0);
     qdev_prop_set_uint32(dev, "chnAtype", 0);
     sysbus = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(sysbus, &error_fatal);
+    sysbus_realize(sysbus, &error_fatal);
 
     /* Logically OR both its IRQs together */
     escc_orgate = DEVICE(object_new(TYPE_OR_IRQ));
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index d11bc020ed..9e76a3fe7c 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -30,6 +30,7 @@
 #include "hw/m68k/q800-glue.h"
 #include "hw/misc/mac_via.h"
 #include "hw/net/dp8393x.h"
+#include "hw/char/escc.h"
 
 /*
  * The main Q800 machine
@@ -44,6 +45,7 @@ struct Q800MachineState {
     MOS6522Q800VIA1State via1;
     MOS6522Q800VIA2State via2;
     dp8393xState dp8393x;
+    ESCCState escc;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From 1a7a3f004cb9a4913b2a5eb8b1c8dd178db3bee9 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:46 +0100
Subject: [PATCH 0037/1353] q800: move escc_orgate device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the escc_orgate device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-18-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 16 +++++++++-------
 include/hw/m68k/q800.h |  2 ++
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 8bf94b2511..c6314c6bf9 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -212,7 +212,6 @@ static void q800_machine_init(MachineState *machine)
     hwaddr parameters_base;
     CPUState *cs;
     DeviceState *dev;
-    DeviceState *escc_orgate;
     SysBusESPState *sysbus_esp;
     ESPState *esp;
     SysBusDevice *sysbus;
@@ -361,12 +360,15 @@ static void q800_machine_init(MachineState *machine)
     sysbus_realize(sysbus, &error_fatal);
 
     /* Logically OR both its IRQs together */
-    escc_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-    object_property_set_int(OBJECT(escc_orgate), "num-lines", 2, &error_fatal);
-    qdev_realize_and_unref(escc_orgate, NULL, &error_fatal);
-    sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(escc_orgate, 0));
-    sysbus_connect_irq(sysbus, 1, qdev_get_gpio_in(escc_orgate, 1));
-    qdev_connect_gpio_out(escc_orgate, 0,
+    object_initialize_child(OBJECT(machine), "escc_orgate", &m->escc_orgate,
+                            TYPE_OR_IRQ);
+    object_property_set_int(OBJECT(&m->escc_orgate), "num-lines", 2,
+                            &error_fatal);
+    dev = DEVICE(&m->escc_orgate);
+    qdev_realize(dev, NULL, &error_fatal);
+    sysbus_connect_irq(sysbus, 0, qdev_get_gpio_in(dev, 0));
+    sysbus_connect_irq(sysbus, 1, qdev_get_gpio_in(dev, 1));
+    qdev_connect_gpio_out(dev, 0,
                           qdev_get_gpio_in(DEVICE(&m->glue),
                                            GLUE_IRQ_IN_ESCC));
     memory_region_add_subregion(&m->macio, SCC_BASE - IO_BASE,
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 9e76a3fe7c..36e1bd8e4e 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -31,6 +31,7 @@
 #include "hw/misc/mac_via.h"
 #include "hw/net/dp8393x.h"
 #include "hw/char/escc.h"
+#include "hw/or-irq.h"
 
 /*
  * The main Q800 machine
@@ -46,6 +47,7 @@ struct Q800MachineState {
     MOS6522Q800VIA2State via2;
     dp8393xState dp8393x;
     ESCCState escc;
+    OrIRQState escc_orgate;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From e78d17ca7d1dbfbe0a312e1ed40694d1485c763b Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:47 +0100
Subject: [PATCH 0038/1353] q800: move ESP device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the ESP device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-19-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 9 +++++----
 include/hw/m68k/q800.h | 2 ++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index c6314c6bf9..9da46f4456 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -376,8 +376,9 @@ static void q800_machine_init(MachineState *machine)
 
     /* SCSI */
 
-    dev = qdev_new(TYPE_SYSBUS_ESP);
-    sysbus_esp = SYSBUS_ESP(dev);
+    object_initialize_child(OBJECT(machine), "esp", &m->esp,
+                            TYPE_SYSBUS_ESP);
+    sysbus_esp = SYSBUS_ESP(&m->esp);
     esp = &sysbus_esp->esp;
     esp->dma_memory_read = NULL;
     esp->dma_memory_write = NULL;
@@ -385,8 +386,8 @@ static void q800_machine_init(MachineState *machine)
     sysbus_esp->it_shift = 4;
     esp->dma_enabled = 1;
 
-    sysbus = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(sysbus, &error_fatal);
+    sysbus = SYS_BUS_DEVICE(&m->esp);
+    sysbus_realize(sysbus, &error_fatal);
     /* SCSI and SCSI data IRQs are negative edge triggered */
     sysbus_connect_irq(sysbus, 0,
                        qemu_irq_invert(
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 36e1bd8e4e..8f23e0c4c6 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -32,6 +32,7 @@
 #include "hw/net/dp8393x.h"
 #include "hw/char/escc.h"
 #include "hw/or-irq.h"
+#include "hw/scsi/esp.h"
 
 /*
  * The main Q800 machine
@@ -48,6 +49,7 @@ struct Q800MachineState {
     dp8393xState dp8393x;
     ESCCState escc;
     OrIRQState escc_orgate;
+    SysBusESPState esp;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From 01f35a4f1cfa34a998d0bc11dbdefa7dd26d2c7b Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:48 +0100
Subject: [PATCH 0039/1353] q800: move SWIM device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the SWIM device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-20-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 8 +++++---
 include/hw/m68k/q800.h | 2 ++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 9da46f4456..50fc7de9a2 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -406,10 +406,12 @@ static void q800_machine_init(MachineState *machine)
 
     /* SWIM floppy controller */
 
-    dev = qdev_new(TYPE_SWIM);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    object_initialize_child(OBJECT(machine), "swim", &m->swim,
+                            TYPE_SWIM);
+    sysbus = SYS_BUS_DEVICE(&m->swim);
+    sysbus_realize(sysbus, &error_fatal);
     memory_region_add_subregion(&m->macio, SWIM_BASE - IO_BASE,
-                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
+                                sysbus_mmio_get_region(sysbus, 0));
 
     /* NuBus */
 
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 8f23e0c4c6..06e095ae29 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -33,6 +33,7 @@
 #include "hw/char/escc.h"
 #include "hw/or-irq.h"
 #include "hw/scsi/esp.h"
+#include "hw/block/swim.h"
 
 /*
  * The main Q800 machine
@@ -50,6 +51,7 @@ struct Q800MachineState {
     ESCCState escc;
     OrIRQState escc_orgate;
     SysBusESPState esp;
+    Swim swim;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From 36df1c5a635c11e5514ac561ed90a9c459cdbff2 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:49 +0100
Subject: [PATCH 0040/1353] q800: move mac-nubus-bridge device to
 Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the mac-nubus-bridge device to use
object_initialize_child() and map the Nubus address space using
memory_region_add_subregion() instead of sysbus_mmio_map().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-21-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 21 ++++++++++++++-------
 include/hw/m68k/q800.h |  2 ++
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 50fc7de9a2..b22651931a 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -415,14 +415,21 @@ static void q800_machine_init(MachineState *machine)
 
     /* NuBus */
 
-    dev = qdev_new(TYPE_MAC_NUBUS_BRIDGE);
-    qdev_prop_set_uint32(dev, "slot-available-mask",
+    object_initialize_child(OBJECT(machine), "mac-nubus-bridge",
+                            &m->mac_nubus_bridge,
+                            TYPE_MAC_NUBUS_BRIDGE);
+    sysbus = SYS_BUS_DEVICE(&m->mac_nubus_bridge);
+    dev = DEVICE(&m->mac_nubus_bridge);
+    qdev_prop_set_uint32(DEVICE(&m->mac_nubus_bridge), "slot-available-mask",
                          Q800_NUBUS_SLOTS_AVAILABLE);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
-                    MAC_NUBUS_FIRST_SLOT * NUBUS_SUPER_SLOT_SIZE);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, NUBUS_SLOT_BASE +
-                    MAC_NUBUS_FIRST_SLOT * NUBUS_SLOT_SIZE);
+    sysbus_realize(sysbus, &error_fatal);
+    memory_region_add_subregion(get_system_memory(),
+                                MAC_NUBUS_FIRST_SLOT * NUBUS_SUPER_SLOT_SIZE,
+                                sysbus_mmio_get_region(sysbus, 0));
+    memory_region_add_subregion(get_system_memory(),
+                                NUBUS_SLOT_BASE +
+                                MAC_NUBUS_FIRST_SLOT * NUBUS_SLOT_SIZE,
+                                sysbus_mmio_get_region(sysbus, 1));
     qdev_connect_gpio_out(dev, 9,
                           qdev_get_gpio_in_named(DEVICE(&m->via2), "nubus-irq",
                           VIA2_NUBUS_IRQ_INTVIDEO));
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 06e095ae29..8f2c572a81 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -34,6 +34,7 @@
 #include "hw/or-irq.h"
 #include "hw/scsi/esp.h"
 #include "hw/block/swim.h"
+#include "hw/nubus/mac-nubus-bridge.h"
 
 /*
  * The main Q800 machine
@@ -52,6 +53,7 @@ struct Q800MachineState {
     OrIRQState escc_orgate;
     SysBusESPState esp;
     Swim swim;
+    MacNubusBridge mac_nubus_bridge;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From 464085e8f6776a0ca5a2677cf8b93b25c8a94da4 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:50 +0100
Subject: [PATCH 0041/1353] q800: don't access Nubus bus directly from the
 mac-nubus-bridge device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead use the qdev_get_child_bus() function which is intended for this exact
purpose.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621085353.113233-22-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index b22651931a..a32e6fbf8d 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -448,7 +448,7 @@ static void q800_machine_init(MachineState *machine)
                           qdev_get_gpio_in_named(DEVICE(&m->via2), "nubus-irq",
                                                  VIA2_NUBUS_IRQ_9));
 
-    nubus = &NUBUS_BRIDGE(dev)->bus;
+    nubus = NUBUS_BUS(qdev_get_child_bus(dev, "nubus-bus.0"));
 
     /* framebuffer in nubus slot #9 */
 

From 7a1f3acb3f41a6bc896c1d7d1749336c21eb8cee Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:51 +0100
Subject: [PATCH 0042/1353] q800: move macfb device to Q800MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also change the instantiation of the macfb device to use object_initialize_child().

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-23-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/m68k/q800.c         | 6 ++++--
 include/hw/m68k/q800.h | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index a32e6fbf8d..b770b71d54 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -452,7 +452,9 @@ static void q800_machine_init(MachineState *machine)
 
     /* framebuffer in nubus slot #9 */
 
-    dev = qdev_new(TYPE_NUBUS_MACFB);
+    object_initialize_child(OBJECT(machine), "macfb", &m->macfb,
+                            TYPE_NUBUS_MACFB);
+    dev = DEVICE(&m->macfb);
     qdev_prop_set_uint32(dev, "slot", 9);
     qdev_prop_set_uint32(dev, "width", graphic_width);
     qdev_prop_set_uint32(dev, "height", graphic_height);
@@ -462,7 +464,7 @@ static void q800_machine_init(MachineState *machine)
     } else {
         qdev_prop_set_uint8(dev, "display", MACFB_DISPLAY_VGA);
     }
-    qdev_realize_and_unref(dev, BUS(nubus), &error_fatal);
+    qdev_realize(dev, BUS(nubus), &error_fatal);
 
     macfb_mode = (NUBUS_MACFB(dev)->macfb).mode;
 
diff --git a/include/hw/m68k/q800.h b/include/hw/m68k/q800.h
index 8f2c572a81..b3d77f1cba 100644
--- a/include/hw/m68k/q800.h
+++ b/include/hw/m68k/q800.h
@@ -35,6 +35,7 @@
 #include "hw/scsi/esp.h"
 #include "hw/block/swim.h"
 #include "hw/nubus/mac-nubus-bridge.h"
+#include "hw/display/macfb.h"
 
 /*
  * The main Q800 machine
@@ -54,6 +55,7 @@ struct Q800MachineState {
     SysBusESPState esp;
     Swim swim;
     MacNubusBridge mac_nubus_bridge;
+    MacfbNubusState macfb;
     MemoryRegion macio;
     MemoryRegion macio_alias;
 };

From ce47d531c33c35eca985f2dffc340c09433690fa Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:52 +0100
Subject: [PATCH 0043/1353] mac_via: fix rtc command decoding from PRAM
 addresses 0x0 to 0xf

A comparison between the rtc command table included in the comment and the code
itself shows that the decoding for PRAM addresses 0x0 to 0xf is being done on
the raw command, and not the shifted version held in value.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-24-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/misc/mac_via.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/mac_via.c b/hw/misc/mac_via.c
index 076d18e5fd..85c2e65856 100644
--- a/hw/misc/mac_via.c
+++ b/hw/misc/mac_via.c
@@ -399,7 +399,7 @@ static int via1_rtc_compact_cmd(uint8_t value)
         } else if ((value & 0x1c) == 0x08) {
             /* RAM address 0x10 to 0x13 */
             return read | (REG_PRAM_ADDR + 0x10 + (value & 0x03));
-        } else if ((value & 0x43) == 0x41) {
+        } else if ((value & 0x10) == 0x10) {
             /* RAM address 0x00 to 0x0f */
             return read | (REG_PRAM_ADDR + (value & 0x0f));
         }

From 532009054b45d75a3cf7ba9c31921add669d290d Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 21 Jun 2023 09:53:53 +0100
Subject: [PATCH 0044/1353] mac_via: fix rtc command decoding for the PRAM
 seconds registers

Analysis of the MacOS toolbox ROM code shows that on startup it attempts 2
separate reads of the seconds registers with commands 0x9d...0x91 followed by
0x8d..0x81 without resetting the command to its initial value. The PRAM seconds
value is only accepted when the values of the 2 separate reads match.

From this we conclude that bit 4 of the rtc command is not decoded or we don't
care about its value when reading the PRAM seconds registers. Implement this
decoding change so that both reads return successfully which allows the MacOS
toolbox ROM to correctly set the date/time.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20230621085353.113233-25-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/misc/mac_via.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/misc/mac_via.c b/hw/misc/mac_via.c
index 85c2e65856..0787a0268d 100644
--- a/hw/misc/mac_via.c
+++ b/hw/misc/mac_via.c
@@ -362,10 +362,10 @@ static void pram_update(MOS6522Q800VIA1State *v1s)
  *
  * Command byte    Register addressed by the command
  *
- * z0000001        Seconds register 0 (lowest-order byte)
- * z0000101        Seconds register 1
- * z0001001        Seconds register 2
- * z0001101        Seconds register 3 (highest-order byte)
+ * z00x0001        Seconds register 0 (lowest-order byte)
+ * z00x0101        Seconds register 1
+ * z00x1001        Seconds register 2
+ * z00x1101        Seconds register 3 (highest-order byte)
  * 00110001        Test register (write-only)
  * 00110101        Write-Protect Register (write-only)
  * z010aa01        RAM address 100aa ($10-$13) (first 20 bytes only)
@@ -373,6 +373,7 @@ static void pram_update(MOS6522Q800VIA1State *v1s)
  * z0111aaa        Extended memory designator and sector number
  *
  * For a read request, z=1, for a write z=0
+ * The letter x indicates don't care
  * The letter a indicates bits whose value depend on what parameter
  * RAM byte you want to address
  */
@@ -389,7 +390,7 @@ static int via1_rtc_compact_cmd(uint8_t value)
     }
     if ((value & 0x03) == 0x01) {
         value >>= 2;
-        if ((value & 0x1c) == 0) {
+        if ((value & 0x18) == 0) {
             /* seconds registers */
             return read | (REG_0 + (value & 0x03));
         } else if ((value == 0x0c) && !read) {

From 14180d6221502bd4b9d96fa5f1065e7cda4bcf00 Mon Sep 17 00:00:00 2001
From: Ira Weiny <ira.weiny@intel.com>
Date: Fri, 26 May 2023 18:00:07 +0100
Subject: [PATCH 0045/1353] bswap: Add the ability to store to an unaligned 24
 bit field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CXL has 24 bit unaligned fields which need to be stored to.  CXL is
specified as little endian.

Define st24_le_p() and the supporting functions to store such a field
from a 32 bit host native value.

The use of b, w, l, q as the size specifier is limiting.  So "24" was
used for the size part of the function name.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230526170010.574-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/devel/loads-stores.rst |  2 ++
 include/qemu/bswap.h        | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/docs/devel/loads-stores.rst b/docs/devel/loads-stores.rst
index d2cefc77a2..dab6dfa0ac 100644
--- a/docs/devel/loads-stores.rst
+++ b/docs/devel/loads-stores.rst
@@ -36,6 +36,7 @@ store: ``st{size}_{endian}_p(ptr, val)``
 ``size``
  - ``b`` : 8 bits
  - ``w`` : 16 bits
+ - ``24`` : 24 bits
  - ``l`` : 32 bits
  - ``q`` : 64 bits
 
@@ -65,6 +66,7 @@ of size ``sz`` bytes.
 Regexes for git grep
  - ``\<ld[us]\?[bwlq]\(_[hbl]e\)\?_p\>``
  - ``\<st[bwlq]\(_[hbl]e\)\?_p\>``
+ - ``\<st24\(_[hbl]e\)\?_p\>``
  - ``\<ldn_\([hbl]e\)?_p\>``
  - ``\<stn_\([hbl]e\)?_p\>``
 
diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index 15a78c0db5..933a66ee87 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -8,11 +8,23 @@
 #undef  bswap64
 #define bswap64(_x) __builtin_bswap64(_x)
 
+static inline uint32_t bswap24(uint32_t x)
+{
+    return (((x & 0x000000ffU) << 16) |
+            ((x & 0x0000ff00U) <<  0) |
+            ((x & 0x00ff0000U) >> 16));
+}
+
 static inline void bswap16s(uint16_t *s)
 {
     *s = __builtin_bswap16(*s);
 }
 
+static inline void bswap24s(uint32_t *s)
+{
+    *s = bswap24(*s & 0x00ffffffU);
+}
+
 static inline void bswap32s(uint32_t *s)
 {
     *s = __builtin_bswap32(*s);
@@ -26,11 +38,13 @@ static inline void bswap64s(uint64_t *s)
 #if HOST_BIG_ENDIAN
 #define be_bswap(v, size) (v)
 #define le_bswap(v, size) glue(__builtin_bswap, size)(v)
+#define le_bswap24(v) bswap24(v)
 #define be_bswaps(v, size)
 #define le_bswaps(p, size) \
             do { *p = glue(__builtin_bswap, size)(*p); } while (0)
 #else
 #define le_bswap(v, size) (v)
+#define le_bswap24(v) (v)
 #define be_bswap(v, size) glue(__builtin_bswap, size)(v)
 #define le_bswaps(v, size)
 #define be_bswaps(p, size) \
@@ -176,6 +190,7 @@ CPU_CONVERT(le, 64, uint64_t)
  * size is:
  *   b: 8 bits
  *   w: 16 bits
+ *   24: 24 bits
  *   l: 32 bits
  *   q: 64 bits
  *
@@ -248,6 +263,11 @@ static inline void stw_he_p(void *ptr, uint16_t v)
     __builtin_memcpy(ptr, &v, sizeof(v));
 }
 
+static inline void st24_he_p(void *ptr, uint32_t v)
+{
+    __builtin_memcpy(ptr, &v, 3);
+}
+
 static inline int ldl_he_p(const void *ptr)
 {
     int32_t r;
@@ -297,6 +317,11 @@ static inline void stw_le_p(void *ptr, uint16_t v)
     stw_he_p(ptr, le_bswap(v, 16));
 }
 
+static inline void st24_le_p(void *ptr, uint32_t v)
+{
+    st24_he_p(ptr, le_bswap24(v));
+}
+
 static inline void stl_le_p(void *ptr, uint32_t v)
 {
     stl_he_p(ptr, le_bswap(v, 32));

From 9547754f40ee5c5e3d1dbed0fbc972caacd075e8 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Fri, 26 May 2023 18:00:08 +0100
Subject: [PATCH 0046/1353] hw/cxl: QMP based poison injection support

Inject poison using QMP command cxl-inject-poison to add an entry to the
poison list.

For now, the poison is not returned CXL.mem reads, but only via the
mailbox command Get Poison List. So a normal memory read to an address
that is on the poison list will not yet result in a synchronous exception
(and similar for partial cacheline writes).
That is left for a future patch.

See CXL rev 3.0, sec 8.2.9.8.4.1 Get Poison list (Opcode 4300h)

Kernel patches to use this interface here:
https://lore.kernel.org/linux-cxl/cover.1665606782.git.alison.schofield@intel.com/

To inject poison using QMP (telnet to the QMP port)
{ "execute": "qmp_capabilities" }

{ "execute": "cxl-inject-poison",
    "arguments": {
         "path": "/machine/peripheral/cxl-pmem0",
         "start": 2048,
         "length": 256
    }
}

Adjusted to select a device on your machine.

Note that the poison list supported is kept short enough to avoid the
complexity of state machine that is needed to handle the MORE flag.

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230526170010.574-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 90 +++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3.c          | 56 +++++++++++++++++++++++
 hw/mem/cxl_type3_stubs.c    |  6 +++
 include/hw/cxl/cxl.h        |  1 +
 include/hw/cxl/cxl_device.h | 20 +++++++++
 qapi/cxl.json               | 21 +++++++++
 6 files changed, 194 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 702e16ca20..1f74b26ea2 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -62,6 +62,8 @@ enum {
         #define GET_PARTITION_INFO     0x0
         #define GET_LSA       0x2
         #define SET_LSA       0x3
+    MEDIA_AND_POISON = 0x43,
+        #define GET_POISON_LIST        0x0
 };
 
 /* 8.2.8.4.5.1 Command Return Codes */
@@ -295,6 +297,10 @@ static CXLRetCode cmd_identify_memory_device(struct cxl_cmd *cmd,
     stq_le_p(&id->persistent_capacity, cxl_dstate->pmem_size / CXL_CAPACITY_MULTIPLIER);
     stq_le_p(&id->volatile_capacity, cxl_dstate->vmem_size / CXL_CAPACITY_MULTIPLIER);
     stl_le_p(&id->lsa_size, cvc->get_lsa_size(ct3d));
+    /* 256 poison records */
+    st24_le_p(id->poison_list_max_mer, 256);
+    /* No limit - so limited by main poison record limit */
+    stw_le_p(&id->inject_poison_limit, 0);
 
     *len = sizeof(*id);
     return CXL_MBOX_SUCCESS;
@@ -384,6 +390,88 @@ static CXLRetCode cmd_ccls_set_lsa(struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+/*
+ * This is very inefficient, but good enough for now!
+ * Also the payload will always fit, so no need to handle the MORE flag and
+ * make this stateful. We may want to allow longer poison lists to aid
+ * testing that kernel functionality.
+ */
+static CXLRetCode cmd_media_get_poison_list(struct cxl_cmd *cmd,
+                                            CXLDeviceState *cxl_dstate,
+                                            uint16_t *len)
+{
+    struct get_poison_list_pl {
+        uint64_t pa;
+        uint64_t length;
+    } QEMU_PACKED;
+
+    struct get_poison_list_out_pl {
+        uint8_t flags;
+        uint8_t rsvd1;
+        uint64_t overflow_timestamp;
+        uint16_t count;
+        uint8_t rsvd2[0x14];
+        struct {
+            uint64_t addr;
+            uint32_t length;
+            uint32_t resv;
+        } QEMU_PACKED records[];
+    } QEMU_PACKED;
+
+    struct get_poison_list_pl *in = (void *)cmd->payload;
+    struct get_poison_list_out_pl *out = (void *)cmd->payload;
+    CXLType3Dev *ct3d = container_of(cxl_dstate, CXLType3Dev, cxl_dstate);
+    uint16_t record_count = 0, i = 0;
+    uint64_t query_start, query_length;
+    CXLPoisonList *poison_list = &ct3d->poison_list;
+    CXLPoison *ent;
+    uint16_t out_pl_len;
+
+    query_start = ldq_le_p(&in->pa);
+    /* 64 byte alignemnt required */
+    if (query_start & 0x3f) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+    query_length = ldq_le_p(&in->length) * CXL_CACHE_LINE_SIZE;
+
+    QLIST_FOREACH(ent, poison_list, node) {
+        /* Check for no overlap */
+        if (ent->start >= query_start + query_length ||
+            ent->start + ent->length <= query_start) {
+            continue;
+        }
+        record_count++;
+    }
+    out_pl_len = sizeof(*out) + record_count * sizeof(out->records[0]);
+    assert(out_pl_len <= CXL_MAILBOX_MAX_PAYLOAD_SIZE);
+
+    memset(out, 0, out_pl_len);
+    QLIST_FOREACH(ent, poison_list, node) {
+        uint64_t start, stop;
+
+        /* Check for no overlap */
+        if (ent->start >= query_start + query_length ||
+            ent->start + ent->length <= query_start) {
+            continue;
+        }
+
+        /* Deal with overlap */
+        start = MAX(ROUND_DOWN(ent->start, 64ull), query_start);
+        stop = MIN(ROUND_DOWN(ent->start, 64ull) + ent->length,
+                   query_start + query_length);
+        stq_le_p(&out->records[i].addr, start | (ent->type & 0x7));
+        stl_le_p(&out->records[i].length, (stop - start) / CXL_CACHE_LINE_SIZE);
+        i++;
+    }
+    if (ct3d->poison_list_overflowed) {
+        out->flags = (1 << 1);
+        stq_le_p(&out->overflow_timestamp, ct3d->poison_list_overflow_ts);
+    }
+    stw_le_p(&out->count, record_count);
+    *len = out_pl_len;
+    return CXL_MBOX_SUCCESS;
+}
+
 #define IMMEDIATE_CONFIG_CHANGE (1 << 1)
 #define IMMEDIATE_DATA_CHANGE (1 << 2)
 #define IMMEDIATE_POLICY_CHANGE (1 << 3)
@@ -411,6 +499,8 @@ static struct cxl_cmd cxl_cmd_set[256][256] = {
     [CCLS][GET_LSA] = { "CCLS_GET_LSA", cmd_ccls_get_lsa, 8, 0 },
     [CCLS][SET_LSA] = { "CCLS_SET_LSA", cmd_ccls_set_lsa,
         ~0, IMMEDIATE_CONFIG_CHANGE | IMMEDIATE_DATA_CHANGE },
+    [MEDIA_AND_POISON][GET_POISON_LIST] = { "MEDIA_AND_POISON_GET_POISON_LIST",
+        cmd_media_get_poison_list, 16, 0 },
 };
 
 void cxl_process_mailbox(CXLDeviceState *cxl_dstate)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 2adacbd01b..ab600735eb 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -947,6 +947,62 @@ static void set_lsa(CXLType3Dev *ct3d, const void *buf, uint64_t size,
      */
 }
 
+void cxl_set_poison_list_overflowed(CXLType3Dev *ct3d)
+{
+        ct3d->poison_list_overflowed = true;
+        ct3d->poison_list_overflow_ts =
+            cxl_device_get_timestamp(&ct3d->cxl_dstate);
+}
+
+void qmp_cxl_inject_poison(const char *path, uint64_t start, uint64_t length,
+                           Error **errp)
+{
+    Object *obj = object_resolve_path(path, NULL);
+    CXLType3Dev *ct3d;
+    CXLPoison *p;
+
+    if (length % 64) {
+        error_setg(errp, "Poison injection must be in multiples of 64 bytes");
+        return;
+    }
+    if (start % 64) {
+        error_setg(errp, "Poison start address must be 64 byte aligned");
+        return;
+    }
+    if (!obj) {
+        error_setg(errp, "Unable to resolve path");
+        return;
+    }
+    if (!object_dynamic_cast(obj, TYPE_CXL_TYPE3)) {
+        error_setg(errp, "Path does not point to a CXL type 3 device");
+        return;
+    }
+
+    ct3d = CXL_TYPE3(obj);
+
+    QLIST_FOREACH(p, &ct3d->poison_list, node) {
+        if (((start >= p->start) && (start < p->start + p->length)) ||
+            ((start + length > p->start) &&
+             (start + length <= p->start + p->length))) {
+            error_setg(errp, "Overlap with existing poisoned region not supported");
+            return;
+        }
+    }
+
+    if (ct3d->poison_list_cnt == CXL_POISON_LIST_LIMIT) {
+        cxl_set_poison_list_overflowed(ct3d);
+        return;
+    }
+
+    p = g_new0(CXLPoison, 1);
+    p->length = length;
+    p->start = start;
+    p->type = CXL_POISON_TYPE_INTERNAL; /* Different from injected via the mbox */
+
+    QLIST_INSERT_HEAD(&ct3d->poison_list, p, node);
+    ct3d->poison_list_cnt++;
+}
+
 /* For uncorrectable errors include support for multiple header recording */
 void qmp_cxl_inject_uncorrectable_errors(const char *path,
                                          CXLUncorErrorRecordList *errors,
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index d574c58f9a..fd1166a610 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -3,6 +3,12 @@
 #include "qapi/error.h"
 #include "qapi/qapi-commands-cxl.h"
 
+void qmp_cxl_inject_poison(const char *path, uint64_t start, uint64_t length,
+                           Error **errp)
+{
+    error_setg(errp, "CXL Type 3 support is not compiled in");
+}
+
 void qmp_cxl_inject_uncorrectable_errors(const char *path,
                                          CXLUncorErrorRecordList *errors,
                                          Error **errp)
diff --git a/include/hw/cxl/cxl.h b/include/hw/cxl/cxl.h
index c453983e83..56c9e7676e 100644
--- a/include/hw/cxl/cxl.h
+++ b/include/hw/cxl/cxl.h
@@ -18,6 +18,7 @@
 #include "cxl_component.h"
 #include "cxl_device.h"
 
+#define CXL_CACHE_LINE_SIZE 64
 #define CXL_COMPONENT_REG_BAR_IDX 0
 #define CXL_DEVICE_REG_BAR_IDX 2
 
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 02befda0f6..32c234ea91 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -242,6 +242,18 @@ typedef struct CXLError {
 
 typedef QTAILQ_HEAD(, CXLError) CXLErrorList;
 
+typedef struct CXLPoison {
+    uint64_t start, length;
+    uint8_t type;
+#define CXL_POISON_TYPE_EXTERNAL 0x1
+#define CXL_POISON_TYPE_INTERNAL 0x2
+#define CXL_POISON_TYPE_INJECTED 0x3
+    QLIST_ENTRY(CXLPoison) node;
+} CXLPoison;
+
+typedef QLIST_HEAD(, CXLPoison) CXLPoisonList;
+#define CXL_POISON_LIST_LIMIT 256
+
 struct CXLType3Dev {
     /* Private */
     PCIDevice parent_obj;
@@ -264,6 +276,12 @@ struct CXLType3Dev {
 
     /* Error injection */
     CXLErrorList error_list;
+
+    /* Poison Injection - cache */
+    CXLPoisonList poison_list;
+    unsigned int poison_list_cnt;
+    bool poison_list_overflowed;
+    uint64_t poison_list_overflow_ts;
 };
 
 #define TYPE_CXL_TYPE3 "cxl-type3"
@@ -289,4 +307,6 @@ MemTxResult cxl_type3_write(PCIDevice *d, hwaddr host_addr, uint64_t data,
 
 uint64_t cxl_device_get_timestamp(CXLDeviceState *cxlds);
 
+void cxl_set_poison_list_overflowed(CXLType3Dev *ct3d);
+
 #endif
diff --git a/qapi/cxl.json b/qapi/cxl.json
index b21c9b4c1c..ed1c7eea3a 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -5,6 +5,27 @@
 # = CXL devices
 ##
 
+##
+# @cxl-inject-poison:
+#
+# Poison records indicate that a CXL memory device knows that a
+# particular memory region may be corrupted.  This may be because of
+# locally detected errors (e.g. ECC failure) or poisoned writes
+# received from other components in the system.  This injection
+# mechanism enables testing of the OS handling of poison records which
+# may be queried via the CXL mailbox.
+#
+# @path: CXL type 3 device canonical QOM path
+#
+# @start: Start address; must be 64 byte aligned.
+#
+# @length: Length of poison to inject; must be a multiple of 64 bytes.
+#
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-poison',
+  'data': { 'path': 'str', 'start': 'uint64', 'length': 'size' }}
+
 ##
 # @CxlUncorErrorType:
 #

From ff04b207a0525b3f77b6352ce3a2e610b11ea34f Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Fri, 26 May 2023 18:00:09 +0100
Subject: [PATCH 0047/1353] hw/cxl: Add poison injection via the mailbox.

Very simple implementation to allow testing of corresponding
kernel code. Note that for now we track each 64 byte section
independently.  Whilst a valid implementation choice, it may
make sense to fuse entries so as to prove out more complex
corners of the kernel code.

Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230526170010.574-4-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 1f74b26ea2..6c476ad7f4 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -64,6 +64,7 @@ enum {
         #define SET_LSA       0x3
     MEDIA_AND_POISON = 0x43,
         #define GET_POISON_LIST        0x0
+        #define INJECT_POISON          0x1
 };
 
 /* 8.2.8.4.5.1 Command Return Codes */
@@ -472,6 +473,45 @@ static CXLRetCode cmd_media_get_poison_list(struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+static CXLRetCode cmd_media_inject_poison(struct cxl_cmd *cmd,
+                                          CXLDeviceState *cxl_dstate,
+                                          uint16_t *len_unused)
+{
+    CXLType3Dev *ct3d = container_of(cxl_dstate, CXLType3Dev, cxl_dstate);
+    CXLPoisonList *poison_list = &ct3d->poison_list;
+    CXLPoison *ent;
+    struct inject_poison_pl {
+        uint64_t dpa;
+    };
+    struct inject_poison_pl *in = (void *)cmd->payload;
+    uint64_t dpa = ldq_le_p(&in->dpa);
+    CXLPoison *p;
+
+    QLIST_FOREACH(ent, poison_list, node) {
+        if (dpa >= ent->start &&
+            dpa + CXL_CACHE_LINE_SIZE <= ent->start + ent->length) {
+            return CXL_MBOX_SUCCESS;
+        }
+    }
+
+    if (ct3d->poison_list_cnt == CXL_POISON_LIST_LIMIT) {
+        return CXL_MBOX_INJECT_POISON_LIMIT;
+    }
+    p = g_new0(CXLPoison, 1);
+
+    p->length = CXL_CACHE_LINE_SIZE;
+    p->start = dpa;
+    p->type = CXL_POISON_TYPE_INJECTED;
+
+    /*
+     * Possible todo: Merge with existing entry if next to it and if same type
+     */
+    QLIST_INSERT_HEAD(poison_list, p, node);
+    ct3d->poison_list_cnt++;
+
+    return CXL_MBOX_SUCCESS;
+}
+
 #define IMMEDIATE_CONFIG_CHANGE (1 << 1)
 #define IMMEDIATE_DATA_CHANGE (1 << 2)
 #define IMMEDIATE_POLICY_CHANGE (1 << 3)
@@ -501,6 +541,8 @@ static struct cxl_cmd cxl_cmd_set[256][256] = {
         ~0, IMMEDIATE_CONFIG_CHANGE | IMMEDIATE_DATA_CHANGE },
     [MEDIA_AND_POISON][GET_POISON_LIST] = { "MEDIA_AND_POISON_GET_POISON_LIST",
         cmd_media_get_poison_list, 16, 0 },
+    [MEDIA_AND_POISON][INJECT_POISON] = { "MEDIA_AND_POISON_INJECT_POISON",
+        cmd_media_inject_poison, 8, 0 },
 };
 
 void cxl_process_mailbox(CXLDeviceState *cxl_dstate)

From 6bda41a69bdcee8ff7dcf75df2f9647ce55908ab Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Fri, 26 May 2023 18:00:10 +0100
Subject: [PATCH 0048/1353] hw/cxl: Add clear poison mailbox command support.

Current implementation is very simple so many of the corner
cases do not exist (e.g. fragmenting larger poison list entries)

Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230526170010.574-5-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 82 +++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3.c          | 37 +++++++++++++++++
 include/hw/cxl/cxl_device.h |  1 +
 3 files changed, 120 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 6c476ad7f4..e3401b6be8 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -65,6 +65,7 @@ enum {
     MEDIA_AND_POISON = 0x43,
         #define GET_POISON_LIST        0x0
         #define INJECT_POISON          0x1
+        #define CLEAR_POISON           0x2
 };
 
 /* 8.2.8.4.5.1 Command Return Codes */
@@ -512,6 +513,85 @@ static CXLRetCode cmd_media_inject_poison(struct cxl_cmd *cmd,
     return CXL_MBOX_SUCCESS;
 }
 
+static CXLRetCode cmd_media_clear_poison(struct cxl_cmd *cmd,
+                                         CXLDeviceState *cxl_dstate,
+                                         uint16_t *len_unused)
+{
+    CXLType3Dev *ct3d = container_of(cxl_dstate, CXLType3Dev, cxl_dstate);
+    CXLPoisonList *poison_list = &ct3d->poison_list;
+    CXLType3Class *cvc = CXL_TYPE3_GET_CLASS(ct3d);
+    struct clear_poison_pl {
+        uint64_t dpa;
+        uint8_t data[64];
+    };
+    CXLPoison *ent;
+    uint64_t dpa;
+
+    struct clear_poison_pl *in = (void *)cmd->payload;
+
+    dpa = ldq_le_p(&in->dpa);
+    if (dpa + CXL_CACHE_LINE_SIZE > cxl_dstate->mem_size) {
+        return CXL_MBOX_INVALID_PA;
+    }
+
+    /* Clearing a region with no poison is not an error so always do so */
+    if (cvc->set_cacheline) {
+        if (!cvc->set_cacheline(ct3d, dpa, in->data)) {
+            return CXL_MBOX_INTERNAL_ERROR;
+        }
+    }
+
+    QLIST_FOREACH(ent, poison_list, node) {
+        /*
+         * Test for contained in entry. Simpler than general case
+         * as clearing 64 bytes and entries 64 byte aligned
+         */
+        if ((dpa >= ent->start) && (dpa < ent->start + ent->length)) {
+            break;
+        }
+    }
+    if (!ent) {
+        return CXL_MBOX_SUCCESS;
+    }
+
+    QLIST_REMOVE(ent, node);
+    ct3d->poison_list_cnt--;
+
+    if (dpa > ent->start) {
+        CXLPoison *frag;
+        /* Cannot overflow as replacing existing entry */
+
+        frag = g_new0(CXLPoison, 1);
+
+        frag->start = ent->start;
+        frag->length = dpa - ent->start;
+        frag->type = ent->type;
+
+        QLIST_INSERT_HEAD(poison_list, frag, node);
+        ct3d->poison_list_cnt++;
+    }
+
+    if (dpa + CXL_CACHE_LINE_SIZE < ent->start + ent->length) {
+        CXLPoison *frag;
+
+        if (ct3d->poison_list_cnt == CXL_POISON_LIST_LIMIT) {
+            cxl_set_poison_list_overflowed(ct3d);
+        } else {
+            frag = g_new0(CXLPoison, 1);
+
+            frag->start = dpa + CXL_CACHE_LINE_SIZE;
+            frag->length = ent->start + ent->length - frag->start;
+            frag->type = ent->type;
+            QLIST_INSERT_HEAD(poison_list, frag, node);
+            ct3d->poison_list_cnt++;
+        }
+    }
+    /* Any fragments have been added, free original entry */
+    g_free(ent);
+
+    return CXL_MBOX_SUCCESS;
+}
+
 #define IMMEDIATE_CONFIG_CHANGE (1 << 1)
 #define IMMEDIATE_DATA_CHANGE (1 << 2)
 #define IMMEDIATE_POLICY_CHANGE (1 << 3)
@@ -543,6 +623,8 @@ static struct cxl_cmd cxl_cmd_set[256][256] = {
         cmd_media_get_poison_list, 16, 0 },
     [MEDIA_AND_POISON][INJECT_POISON] = { "MEDIA_AND_POISON_INJECT_POISON",
         cmd_media_inject_poison, 8, 0 },
+    [MEDIA_AND_POISON][CLEAR_POISON] = { "MEDIA_AND_POISON_CLEAR_POISON",
+        cmd_media_clear_poison, 72, 0 },
 };
 
 void cxl_process_mailbox(CXLDeviceState *cxl_dstate)
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index ab600735eb..d751803188 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -947,6 +947,42 @@ static void set_lsa(CXLType3Dev *ct3d, const void *buf, uint64_t size,
      */
 }
 
+static bool set_cacheline(CXLType3Dev *ct3d, uint64_t dpa_offset, uint8_t *data)
+{
+    MemoryRegion *vmr = NULL, *pmr = NULL;
+    AddressSpace *as;
+
+    if (ct3d->hostvmem) {
+        vmr = host_memory_backend_get_memory(ct3d->hostvmem);
+    }
+    if (ct3d->hostpmem) {
+        pmr = host_memory_backend_get_memory(ct3d->hostpmem);
+    }
+
+    if (!vmr && !pmr) {
+        return false;
+    }
+
+    if (dpa_offset + CXL_CACHE_LINE_SIZE > ct3d->cxl_dstate.mem_size) {
+        return false;
+    }
+
+    if (vmr) {
+        if (dpa_offset < memory_region_size(vmr)) {
+            as = &ct3d->hostvmem_as;
+        } else {
+            as = &ct3d->hostpmem_as;
+            dpa_offset -= memory_region_size(vmr);
+        }
+    } else {
+        as = &ct3d->hostpmem_as;
+    }
+
+    address_space_write(as, dpa_offset, MEMTXATTRS_UNSPECIFIED, &data,
+                        CXL_CACHE_LINE_SIZE);
+    return true;
+}
+
 void cxl_set_poison_list_overflowed(CXLType3Dev *ct3d)
 {
         ct3d->poison_list_overflowed = true;
@@ -1168,6 +1204,7 @@ static void ct3_class_init(ObjectClass *oc, void *data)
     cvc->get_lsa_size = get_lsa_size;
     cvc->get_lsa = get_lsa;
     cvc->set_lsa = set_lsa;
+    cvc->set_cacheline = set_cacheline;
 }
 
 static const TypeInfo ct3d_info = {
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 32c234ea91..73328a52cf 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -298,6 +298,7 @@ struct CXLType3Class {
                         uint64_t offset);
     void (*set_lsa)(CXLType3Dev *ct3d, const void *buf, uint64_t size,
                     uint64_t offset);
+    bool (*set_cacheline)(CXLType3Dev *ct3d, uint64_t dpa_offset, uint8_t *data);
 };
 
 MemTxResult cxl_type3_read(PCIDevice *d, hwaddr host_addr, uint64_t *data,

From d7b84ddc3b99ae4dcac052a03817aeeab9d12514 Mon Sep 17 00:00:00 2001
From: Ira Weiny <ira.weiny@intel.com>
Date: Tue, 30 May 2023 14:35:57 +0100
Subject: [PATCH 0049/1353] hw/cxl/events: Add event status register

The device status register block was defined.  However, there were no
individual registers nor any data wired up.

Define the event status register [CXL 3.0; 8.2.8.3.1] as part of the
device status register block.  Wire up the register and initialize the
event status for each log.

To support CXL 3.0 the version of the device status register block needs
to be 2.  Change the macro to allow for setting the version.

Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230530133603.16934-2-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-device-utils.c   | 43 ++++++++++++++++++++++++++++++++-----
 include/hw/cxl/cxl_device.h | 23 +++++++++++++++++---
 include/hw/cxl/cxl_events.h | 28 ++++++++++++++++++++++++
 3 files changed, 86 insertions(+), 8 deletions(-)
 create mode 100644 include/hw/cxl/cxl_events.h

diff --git a/hw/cxl/cxl-device-utils.c b/hw/cxl/cxl-device-utils.c
index 86e1cea8ce..517f06d869 100644
--- a/hw/cxl/cxl-device-utils.c
+++ b/hw/cxl/cxl-device-utils.c
@@ -41,7 +41,20 @@ static uint64_t caps_reg_read(void *opaque, hwaddr offset, unsigned size)
 
 static uint64_t dev_reg_read(void *opaque, hwaddr offset, unsigned size)
 {
-    return 0;
+    CXLDeviceState *cxl_dstate = opaque;
+
+    switch (size) {
+    case 1:
+        return cxl_dstate->dev_reg_state[offset];
+    case 2:
+        return cxl_dstate->dev_reg_state16[offset / size];
+    case 4:
+        return cxl_dstate->dev_reg_state32[offset / size];
+    case 8:
+        return cxl_dstate->dev_reg_state64[offset / size];
+    default:
+        g_assert_not_reached();
+    }
 }
 
 static uint64_t mailbox_reg_read(void *opaque, hwaddr offset, unsigned size)
@@ -236,7 +249,27 @@ void cxl_device_register_block_init(Object *obj, CXLDeviceState *cxl_dstate)
                                 &cxl_dstate->memory_device);
 }
 
-static void device_reg_init_common(CXLDeviceState *cxl_dstate) { }
+void cxl_event_set_status(CXLDeviceState *cxl_dstate, CXLEventLogType log_type,
+                          bool available)
+{
+    if (available) {
+        cxl_dstate->event_status |= (1 << log_type);
+    } else {
+        cxl_dstate->event_status &= ~(1 << log_type);
+    }
+
+    ARRAY_FIELD_DP64(cxl_dstate->dev_reg_state64, CXL_DEV_EVENT_STATUS,
+                     EVENT_STATUS, cxl_dstate->event_status);
+}
+
+static void device_reg_init_common(CXLDeviceState *cxl_dstate)
+{
+    CXLEventLogType log;
+
+    for (log = 0; log < CXL_EVENT_TYPE_MAX; log++) {
+        cxl_event_set_status(cxl_dstate, log, false);
+    }
+}
 
 static void mailbox_reg_init_common(CXLDeviceState *cxl_dstate)
 {
@@ -258,13 +291,13 @@ void cxl_device_register_init_common(CXLDeviceState *cxl_dstate)
     ARRAY_FIELD_DP64(cap_hdrs, CXL_DEV_CAP_ARRAY, CAP_VERSION, 1);
     ARRAY_FIELD_DP64(cap_hdrs, CXL_DEV_CAP_ARRAY, CAP_COUNT, cap_count);
 
-    cxl_device_cap_init(cxl_dstate, DEVICE_STATUS, 1);
+    cxl_device_cap_init(cxl_dstate, DEVICE_STATUS, 1, 2);
     device_reg_init_common(cxl_dstate);
 
-    cxl_device_cap_init(cxl_dstate, MAILBOX, 2);
+    cxl_device_cap_init(cxl_dstate, MAILBOX, 2, 1);
     mailbox_reg_init_common(cxl_dstate);
 
-    cxl_device_cap_init(cxl_dstate, MEMORY_DEVICE, 0x4000);
+    cxl_device_cap_init(cxl_dstate, MEMORY_DEVICE, 0x4000, 1);
     memdev_reg_init_common(cxl_dstate);
 
     cxl_initialize_mailbox(cxl_dstate);
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 73328a52cf..16993f7098 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -13,6 +13,7 @@
 #include "hw/cxl/cxl_component.h"
 #include "hw/pci/pci_device.h"
 #include "hw/register.h"
+#include "hw/cxl/cxl_events.h"
 
 /*
  * The following is how a CXL device's Memory Device registers are laid out.
@@ -86,7 +87,16 @@ typedef struct cxl_device_state {
     MemoryRegion device_registers;
 
     /* mmio for device capabilities array - 8.2.8.2 */
-    MemoryRegion device;
+    struct {
+        MemoryRegion device;
+        union {
+            uint8_t dev_reg_state[CXL_DEVICE_STATUS_REGISTERS_LENGTH];
+            uint16_t dev_reg_state16[CXL_DEVICE_STATUS_REGISTERS_LENGTH / 2];
+            uint32_t dev_reg_state32[CXL_DEVICE_STATUS_REGISTERS_LENGTH / 4];
+            uint64_t dev_reg_state64[CXL_DEVICE_STATUS_REGISTERS_LENGTH / 8];
+        };
+        uint64_t event_status;
+    };
     MemoryRegion memory_device;
     struct {
         MemoryRegion caps;
@@ -141,6 +151,9 @@ REG64(CXL_DEV_CAP_ARRAY, 0) /* Documented as 128 bit register but 64 byte access
     FIELD(CXL_DEV_CAP_ARRAY, CAP_VERSION, 16, 8)
     FIELD(CXL_DEV_CAP_ARRAY, CAP_COUNT, 32, 16)
 
+void cxl_event_set_status(CXLDeviceState *cxl_dstate, CXLEventLogType log_type,
+                          bool available);
+
 /*
  * Helper macro to initialize capability headers for CXL devices.
  *
@@ -175,7 +188,7 @@ CXL_DEVICE_CAPABILITY_HEADER_REGISTER(MEMORY_DEVICE,
 void cxl_initialize_mailbox(CXLDeviceState *cxl_dstate);
 void cxl_process_mailbox(CXLDeviceState *cxl_dstate);
 
-#define cxl_device_cap_init(dstate, reg, cap_id)                           \
+#define cxl_device_cap_init(dstate, reg, cap_id, ver)                      \
     do {                                                                   \
         uint32_t *cap_hdrs = dstate->caps_reg_state32;                     \
         int which = R_CXL_DEV_##reg##_CAP_HDR0;                            \
@@ -183,7 +196,7 @@ void cxl_process_mailbox(CXLDeviceState *cxl_dstate);
             FIELD_DP32(cap_hdrs[which], CXL_DEV_##reg##_CAP_HDR0,          \
                        CAP_ID, cap_id);                                    \
         cap_hdrs[which] = FIELD_DP32(                                      \
-            cap_hdrs[which], CXL_DEV_##reg##_CAP_HDR0, CAP_VERSION, 1);    \
+            cap_hdrs[which], CXL_DEV_##reg##_CAP_HDR0, CAP_VERSION, ver);  \
         cap_hdrs[which + 1] =                                              \
             FIELD_DP32(cap_hdrs[which + 1], CXL_DEV_##reg##_CAP_HDR1,      \
                        CAP_OFFSET, CXL_##reg##_REGISTERS_OFFSET);          \
@@ -192,6 +205,10 @@ void cxl_process_mailbox(CXLDeviceState *cxl_dstate);
                        CAP_LENGTH, CXL_##reg##_REGISTERS_LENGTH);          \
     } while (0)
 
+/* CXL 3.0 8.2.8.3.1 Event Status Register */
+REG64(CXL_DEV_EVENT_STATUS, 0)
+    FIELD(CXL_DEV_EVENT_STATUS, EVENT_STATUS, 0, 32)
+
 /* CXL 2.0 8.2.8.4.3 Mailbox Capabilities Register */
 REG32(CXL_DEV_MAILBOX_CAP, 0)
     FIELD(CXL_DEV_MAILBOX_CAP, PAYLOAD_SIZE, 0, 5)
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
new file mode 100644
index 0000000000..aeb3b0590e
--- /dev/null
+++ b/include/hw/cxl/cxl_events.h
@@ -0,0 +1,28 @@
+/*
+ * QEMU CXL Events
+ *
+ * Copyright (c) 2022 Intel
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef CXL_EVENTS_H
+#define CXL_EVENTS_H
+
+/*
+ * CXL rev 3.0 section 8.2.9.2.2; Table 8-49
+ *
+ * Define these as the bit position for the event status register for ease of
+ * setting the status.
+ */
+typedef enum CXLEventLogType {
+    CXL_EVENT_TYPE_INFO          = 0,
+    CXL_EVENT_TYPE_WARN          = 1,
+    CXL_EVENT_TYPE_FAIL          = 2,
+    CXL_EVENT_TYPE_FATAL         = 3,
+    CXL_EVENT_TYPE_DYNAMIC_CAP   = 4,
+    CXL_EVENT_TYPE_MAX
+} CXLEventLogType;
+
+#endif /* CXL_EVENTS_H */

From 2f6b8c8f420d90579b29a96f46630e241dd2c1cc Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Tue, 30 May 2023 14:35:58 +0100
Subject: [PATCH 0050/1353] hw/cxl: Move CXLRetCode definition to cxl_device.h

Following patches will need access to the mailbox return code
type so move it to the header.

Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230530133603.16934-3-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-mailbox-utils.c  | 28 ----------------------------
 include/hw/cxl/cxl_device.h | 28 ++++++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index e3401b6be8..d7e114aaae 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -68,34 +68,6 @@ enum {
         #define CLEAR_POISON           0x2
 };
 
-/* 8.2.8.4.5.1 Command Return Codes */
-typedef enum {
-    CXL_MBOX_SUCCESS = 0x0,
-    CXL_MBOX_BG_STARTED = 0x1,
-    CXL_MBOX_INVALID_INPUT = 0x2,
-    CXL_MBOX_UNSUPPORTED = 0x3,
-    CXL_MBOX_INTERNAL_ERROR = 0x4,
-    CXL_MBOX_RETRY_REQUIRED = 0x5,
-    CXL_MBOX_BUSY = 0x6,
-    CXL_MBOX_MEDIA_DISABLED = 0x7,
-    CXL_MBOX_FW_XFER_IN_PROGRESS = 0x8,
-    CXL_MBOX_FW_XFER_OUT_OF_ORDER = 0x9,
-    CXL_MBOX_FW_AUTH_FAILED = 0xa,
-    CXL_MBOX_FW_INVALID_SLOT = 0xb,
-    CXL_MBOX_FW_ROLLEDBACK = 0xc,
-    CXL_MBOX_FW_REST_REQD = 0xd,
-    CXL_MBOX_INVALID_HANDLE = 0xe,
-    CXL_MBOX_INVALID_PA = 0xf,
-    CXL_MBOX_INJECT_POISON_LIMIT = 0x10,
-    CXL_MBOX_PERMANENT_MEDIA_FAILURE = 0x11,
-    CXL_MBOX_ABORTED = 0x12,
-    CXL_MBOX_INVALID_SECURITY_STATE = 0x13,
-    CXL_MBOX_INCORRECT_PASSPHRASE = 0x14,
-    CXL_MBOX_UNSUPPORTED_MAILBOX = 0x15,
-    CXL_MBOX_INVALID_PAYLOAD_LENGTH = 0x16,
-    CXL_MBOX_MAX = 0x17
-} CXLRetCode;
-
 struct cxl_cmd;
 typedef CXLRetCode (*opcode_handler)(struct cxl_cmd *cmd,
                                    CXLDeviceState *cxl_dstate, uint16_t *len);
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 16993f7098..9f8ee85f8a 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -83,6 +83,34 @@
     (CXL_DEVICE_CAP_REG_SIZE + CXL_DEVICE_STATUS_REGISTERS_LENGTH +     \
      CXL_MAILBOX_REGISTERS_LENGTH + CXL_MEMORY_DEVICE_REGISTERS_LENGTH)
 
+/* 8.2.8.4.5.1 Command Return Codes */
+typedef enum {
+    CXL_MBOX_SUCCESS = 0x0,
+    CXL_MBOX_BG_STARTED = 0x1,
+    CXL_MBOX_INVALID_INPUT = 0x2,
+    CXL_MBOX_UNSUPPORTED = 0x3,
+    CXL_MBOX_INTERNAL_ERROR = 0x4,
+    CXL_MBOX_RETRY_REQUIRED = 0x5,
+    CXL_MBOX_BUSY = 0x6,
+    CXL_MBOX_MEDIA_DISABLED = 0x7,
+    CXL_MBOX_FW_XFER_IN_PROGRESS = 0x8,
+    CXL_MBOX_FW_XFER_OUT_OF_ORDER = 0x9,
+    CXL_MBOX_FW_AUTH_FAILED = 0xa,
+    CXL_MBOX_FW_INVALID_SLOT = 0xb,
+    CXL_MBOX_FW_ROLLEDBACK = 0xc,
+    CXL_MBOX_FW_REST_REQD = 0xd,
+    CXL_MBOX_INVALID_HANDLE = 0xe,
+    CXL_MBOX_INVALID_PA = 0xf,
+    CXL_MBOX_INJECT_POISON_LIMIT = 0x10,
+    CXL_MBOX_PERMANENT_MEDIA_FAILURE = 0x11,
+    CXL_MBOX_ABORTED = 0x12,
+    CXL_MBOX_INVALID_SECURITY_STATE = 0x13,
+    CXL_MBOX_INCORRECT_PASSPHRASE = 0x14,
+    CXL_MBOX_UNSUPPORTED_MAILBOX = 0x15,
+    CXL_MBOX_INVALID_PAYLOAD_LENGTH = 0x16,
+    CXL_MBOX_MAX = 0x17
+} CXLRetCode;
+
 typedef struct cxl_device_state {
     MemoryRegion device_registers;
 

From 22d7e3be0714f39bae43bd0c05f6e6d149a47b13 Mon Sep 17 00:00:00 2001
From: Ira Weiny <ira.weiny@intel.com>
Date: Tue, 30 May 2023 14:35:59 +0100
Subject: [PATCH 0051/1353] hw/cxl/events: Wire up get/clear event mailbox
 commands

CXL testing is benefited from an artificial event log injection
mechanism.

Add an event log infrastructure to insert, get, and clear events from
the various logs available on a device.

Replace the stubbed out CXL Get/Clear Event mailbox commands with
commands that operate on the new infrastructure.

Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230530133603.16934-4-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-events.c         | 217 ++++++++++++++++++++++++++++++++++++
 hw/cxl/cxl-mailbox-utils.c  |  40 ++++++-
 hw/cxl/meson.build          |   1 +
 hw/mem/cxl_type3.c          |   1 +
 include/hw/cxl/cxl_device.h |  25 +++++
 include/hw/cxl/cxl_events.h |  55 +++++++++
 6 files changed, 337 insertions(+), 2 deletions(-)
 create mode 100644 hw/cxl/cxl-events.c

diff --git a/hw/cxl/cxl-events.c b/hw/cxl/cxl-events.c
new file mode 100644
index 0000000000..5da1b76b97
--- /dev/null
+++ b/hw/cxl/cxl-events.c
@@ -0,0 +1,217 @@
+/*
+ * CXL Event processing
+ *
+ * Copyright(C) 2023 Intel Corporation.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2. See the
+ * COPYING file in the top-level directory.
+ */
+
+#include <stdint.h>
+
+#include "qemu/osdep.h"
+#include "qemu/bswap.h"
+#include "qemu/typedefs.h"
+#include "qemu/error-report.h"
+#include "hw/cxl/cxl.h"
+#include "hw/cxl/cxl_events.h"
+
+/* Artificial limit on the number of events a log can hold */
+#define CXL_TEST_EVENT_OVERFLOW 8
+
+static void reset_overflow(CXLEventLog *log)
+{
+    log->overflow_err_count = 0;
+    log->first_overflow_timestamp = 0;
+    log->last_overflow_timestamp = 0;
+}
+
+void cxl_event_init(CXLDeviceState *cxlds)
+{
+    CXLEventLog *log;
+    int i;
+
+    for (i = 0; i < CXL_EVENT_TYPE_MAX; i++) {
+        log = &cxlds->event_logs[i];
+        log->next_handle = 1;
+        log->overflow_err_count = 0;
+        log->first_overflow_timestamp = 0;
+        log->last_overflow_timestamp = 0;
+        qemu_mutex_init(&log->lock);
+        QSIMPLEQ_INIT(&log->events);
+    }
+}
+
+static CXLEvent *cxl_event_get_head(CXLEventLog *log)
+{
+    return QSIMPLEQ_FIRST(&log->events);
+}
+
+static CXLEvent *cxl_event_get_next(CXLEvent *entry)
+{
+    return QSIMPLEQ_NEXT(entry, node);
+}
+
+static int cxl_event_count(CXLEventLog *log)
+{
+    CXLEvent *event;
+    int rc = 0;
+
+    QSIMPLEQ_FOREACH(event, &log->events, node) {
+        rc++;
+    }
+
+    return rc;
+}
+
+static bool cxl_event_empty(CXLEventLog *log)
+{
+    return QSIMPLEQ_EMPTY(&log->events);
+}
+
+static void cxl_event_delete_head(CXLDeviceState *cxlds,
+                                  CXLEventLogType log_type,
+                                  CXLEventLog *log)
+{
+    CXLEvent *entry = cxl_event_get_head(log);
+
+    reset_overflow(log);
+    QSIMPLEQ_REMOVE_HEAD(&log->events, node);
+    if (cxl_event_empty(log)) {
+        cxl_event_set_status(cxlds, log_type, false);
+    }
+    g_free(entry);
+}
+
+/*
+ * return true if an interrupt should be generated as a result
+ * of inserting this event.
+ */
+bool cxl_event_insert(CXLDeviceState *cxlds, CXLEventLogType log_type,
+                      CXLEventRecordRaw *event)
+{
+    uint64_t time;
+    CXLEventLog *log;
+    CXLEvent *entry;
+
+    if (log_type >= CXL_EVENT_TYPE_MAX) {
+        return false;
+    }
+
+    time = cxl_device_get_timestamp(cxlds);
+
+    log = &cxlds->event_logs[log_type];
+
+    QEMU_LOCK_GUARD(&log->lock);
+
+    if (cxl_event_count(log) >= CXL_TEST_EVENT_OVERFLOW) {
+        if (log->overflow_err_count == 0) {
+            log->first_overflow_timestamp = time;
+        }
+        log->overflow_err_count++;
+        log->last_overflow_timestamp = time;
+        return false;
+    }
+
+    entry = g_new0(CXLEvent, 1);
+
+    memcpy(&entry->data, event, sizeof(*event));
+
+    entry->data.hdr.handle = cpu_to_le16(log->next_handle);
+    log->next_handle++;
+    /* 0 handle is never valid */
+    if (log->next_handle == 0) {
+        log->next_handle++;
+    }
+    entry->data.hdr.timestamp = cpu_to_le64(time);
+
+    QSIMPLEQ_INSERT_TAIL(&log->events, entry, node);
+    cxl_event_set_status(cxlds, log_type, true);
+
+    /* Count went from 0 to 1 */
+    return cxl_event_count(log) == 1;
+}
+
+CXLRetCode cxl_event_get_records(CXLDeviceState *cxlds, CXLGetEventPayload *pl,
+                                 uint8_t log_type, int max_recs,
+                                 uint16_t *len)
+{
+    CXLEventLog *log;
+    CXLEvent *entry;
+    uint16_t nr;
+
+    if (log_type >= CXL_EVENT_TYPE_MAX) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    log = &cxlds->event_logs[log_type];
+
+    QEMU_LOCK_GUARD(&log->lock);
+
+    entry = cxl_event_get_head(log);
+    for (nr = 0; entry && nr < max_recs; nr++) {
+        memcpy(&pl->records[nr], &entry->data, CXL_EVENT_RECORD_SIZE);
+        entry = cxl_event_get_next(entry);
+    }
+
+    if (!cxl_event_empty(log)) {
+        pl->flags |= CXL_GET_EVENT_FLAG_MORE_RECORDS;
+    }
+
+    if (log->overflow_err_count) {
+        pl->flags |= CXL_GET_EVENT_FLAG_OVERFLOW;
+        pl->overflow_err_count = cpu_to_le16(log->overflow_err_count);
+        pl->first_overflow_timestamp = cpu_to_le64(log->first_overflow_timestamp);
+        pl->last_overflow_timestamp = cpu_to_le64(log->last_overflow_timestamp);
+    }
+
+    pl->record_count = cpu_to_le16(nr);
+    *len = CXL_EVENT_PAYLOAD_HDR_SIZE + (CXL_EVENT_RECORD_SIZE * nr);
+
+    return CXL_MBOX_SUCCESS;
+}
+
+CXLRetCode cxl_event_clear_records(CXLDeviceState *cxlds, CXLClearEventPayload *pl)
+{
+    CXLEventLog *log;
+    uint8_t log_type;
+    CXLEvent *entry;
+    int nr;
+
+    log_type = pl->event_log;
+
+    if (log_type >= CXL_EVENT_TYPE_MAX) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    log = &cxlds->event_logs[log_type];
+
+    QEMU_LOCK_GUARD(&log->lock);
+    /*
+     * Must itterate the queue twice.
+     * "The device shall verify the event record handles specified in the input
+     * payload are in temporal order. If the device detects an older event
+     * record that will not be cleared when Clear Event Records is executed,
+     * the device shall return the Invalid Handle return code and shall not
+     * clear any of the specified event records."
+     *   -- CXL 3.0 8.2.9.2.3
+     */
+    entry = cxl_event_get_head(log);
+    for (nr = 0; entry && nr < pl->nr_recs; nr++) {
+        uint16_t handle = pl->handle[nr];
+
+        /* NOTE: Both handles are little endian. */
+        if (handle == 0 || entry->data.hdr.handle != handle) {
+            return CXL_MBOX_INVALID_INPUT;
+        }
+        entry = cxl_event_get_next(entry);
+    }
+
+    entry = cxl_event_get_head(log);
+    for (nr = 0; entry && nr < pl->nr_recs; nr++) {
+        cxl_event_delete_head(cxlds, log_type, log);
+        entry = cxl_event_get_head(log);
+    }
+
+    return CXL_MBOX_SUCCESS;
+}
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index d7e114aaae..3f46538048 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -9,6 +9,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/cxl/cxl.h"
+#include "hw/cxl/cxl_events.h"
 #include "hw/pci/pci.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
@@ -95,11 +96,46 @@ struct cxl_cmd {
         return CXL_MBOX_SUCCESS;                                          \
     }
 
-DEFINE_MAILBOX_HANDLER_ZEROED(events_get_records, 0x20);
-DEFINE_MAILBOX_HANDLER_NOP(events_clear_records);
 DEFINE_MAILBOX_HANDLER_ZEROED(events_get_interrupt_policy, 4);
 DEFINE_MAILBOX_HANDLER_NOP(events_set_interrupt_policy);
 
+static CXLRetCode cmd_events_get_records(struct cxl_cmd *cmd,
+                                         CXLDeviceState *cxlds,
+                                         uint16_t *len)
+{
+    CXLGetEventPayload *pl;
+    uint8_t log_type;
+    int max_recs;
+
+    if (cmd->in < sizeof(log_type)) {
+        return CXL_MBOX_INVALID_INPUT;
+    }
+
+    log_type = *((uint8_t *)cmd->payload);
+
+    pl = (CXLGetEventPayload *)cmd->payload;
+    memset(pl, 0, sizeof(*pl));
+
+    max_recs = (cxlds->payload_size - CXL_EVENT_PAYLOAD_HDR_SIZE) /
+                CXL_EVENT_RECORD_SIZE;
+    if (max_recs > 0xFFFF) {
+        max_recs = 0xFFFF;
+    }
+
+    return cxl_event_get_records(cxlds, pl, log_type, max_recs, len);
+}
+
+static CXLRetCode cmd_events_clear_records(struct cxl_cmd *cmd,
+                                           CXLDeviceState *cxlds,
+                                           uint16_t *len)
+{
+    CXLClearEventPayload *pl;
+
+    pl = (CXLClearEventPayload *)cmd->payload;
+    *len = 0;
+    return cxl_event_clear_records(cxlds, pl);
+}
+
 /* 8.2.9.2.1 */
 static CXLRetCode cmd_firmware_update_get_info(struct cxl_cmd *cmd,
                                                CXLDeviceState *cxl_dstate,
diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
index 1f9aa2ea1f..e261ff3881 100644
--- a/hw/cxl/meson.build
+++ b/hw/cxl/meson.build
@@ -5,6 +5,7 @@ system_ss.add(when: 'CONFIG_CXL',
                    'cxl-mailbox-utils.c',
                    'cxl-host.c',
                    'cxl-cdat.c',
+                   'cxl-events.c',
                ),
                if_false: files(
                    'cxl-host-stubs.c',
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index d751803188..ec5a384885 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -724,6 +724,7 @@ static void ct3_realize(PCIDevice *pci_dev, Error **errp)
         goto err_release_cdat;
     }
 
+    cxl_event_init(&ct3d->cxl_dstate);
     return;
 
 err_release_cdat:
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index 9f8ee85f8a..d3aec1bc0e 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -111,6 +111,20 @@ typedef enum {
     CXL_MBOX_MAX = 0x17
 } CXLRetCode;
 
+typedef struct CXLEvent {
+    CXLEventRecordRaw data;
+    QSIMPLEQ_ENTRY(CXLEvent) node;
+} CXLEvent;
+
+typedef struct CXLEventLog {
+    uint16_t next_handle;
+    uint16_t overflow_err_count;
+    uint64_t first_overflow_timestamp;
+    uint64_t last_overflow_timestamp;
+    QemuMutex lock;
+    QSIMPLEQ_HEAD(, CXLEvent) events;
+} CXLEventLog;
+
 typedef struct cxl_device_state {
     MemoryRegion device_registers;
 
@@ -161,6 +175,8 @@ typedef struct cxl_device_state {
     uint64_t mem_size;
     uint64_t pmem_size;
     uint64_t vmem_size;
+
+    CXLEventLog event_logs[CXL_EVENT_TYPE_MAX];
 } CXLDeviceState;
 
 /* Initialize the register block for a device */
@@ -353,6 +369,15 @@ MemTxResult cxl_type3_write(PCIDevice *d, hwaddr host_addr, uint64_t data,
 
 uint64_t cxl_device_get_timestamp(CXLDeviceState *cxlds);
 
+void cxl_event_init(CXLDeviceState *cxlds);
+bool cxl_event_insert(CXLDeviceState *cxlds, CXLEventLogType log_type,
+                      CXLEventRecordRaw *event);
+CXLRetCode cxl_event_get_records(CXLDeviceState *cxlds, CXLGetEventPayload *pl,
+                                 uint8_t log_type, int max_recs,
+                                 uint16_t *len);
+CXLRetCode cxl_event_clear_records(CXLDeviceState *cxlds,
+                                   CXLClearEventPayload *pl);
+
 void cxl_set_poison_list_overflowed(CXLType3Dev *ct3d);
 
 #endif
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index aeb3b0590e..d4aaa894f1 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -10,6 +10,8 @@
 #ifndef CXL_EVENTS_H
 #define CXL_EVENTS_H
 
+#include "qemu/uuid.h"
+
 /*
  * CXL rev 3.0 section 8.2.9.2.2; Table 8-49
  *
@@ -25,4 +27,57 @@ typedef enum CXLEventLogType {
     CXL_EVENT_TYPE_MAX
 } CXLEventLogType;
 
+/*
+ * Common Event Record Format
+ * CXL rev 3.0 section 8.2.9.2.1; Table 8-42
+ */
+#define CXL_EVENT_REC_HDR_RES_LEN 0xf
+typedef struct CXLEventRecordHdr {
+    QemuUUID id;
+    uint8_t length;
+    uint8_t flags[3];
+    uint16_t handle;
+    uint16_t related_handle;
+    uint64_t timestamp;
+    uint8_t maint_op_class;
+    uint8_t reserved[CXL_EVENT_REC_HDR_RES_LEN];
+} QEMU_PACKED CXLEventRecordHdr;
+
+#define CXL_EVENT_RECORD_DATA_LENGTH 0x50
+typedef struct CXLEventRecordRaw {
+    CXLEventRecordHdr hdr;
+    uint8_t data[CXL_EVENT_RECORD_DATA_LENGTH];
+} QEMU_PACKED CXLEventRecordRaw;
+#define CXL_EVENT_RECORD_SIZE (sizeof(CXLEventRecordRaw))
+
+/*
+ * Get Event Records output payload
+ * CXL rev 3.0 section 8.2.9.2.2; Table 8-50
+ */
+#define CXL_GET_EVENT_FLAG_OVERFLOW     BIT(0)
+#define CXL_GET_EVENT_FLAG_MORE_RECORDS BIT(1)
+typedef struct CXLGetEventPayload {
+    uint8_t flags;
+    uint8_t reserved1;
+    uint16_t overflow_err_count;
+    uint64_t first_overflow_timestamp;
+    uint64_t last_overflow_timestamp;
+    uint16_t record_count;
+    uint8_t reserved2[0xa];
+    CXLEventRecordRaw records[];
+} QEMU_PACKED CXLGetEventPayload;
+#define CXL_EVENT_PAYLOAD_HDR_SIZE (sizeof(CXLGetEventPayload))
+
+/*
+ * Clear Event Records input payload
+ * CXL rev 3.0 section 8.2.9.2.3; Table 8-51
+ */
+typedef struct CXLClearEventPayload {
+    uint8_t event_log;      /* CXLEventLogType */
+    uint8_t clear_flags;
+    uint8_t nr_recs;
+    uint8_t reserved[3];
+    uint16_t handle[];
+} CXLClearEventPayload;
+
 #endif /* CXL_EVENTS_H */

From 6676bb973ba53d60886b06213ec98fbd736d66a1 Mon Sep 17 00:00:00 2001
From: Ira Weiny <ira.weiny@intel.com>
Date: Tue, 30 May 2023 14:36:00 +0100
Subject: [PATCH 0052/1353] hw/cxl/events: Add event interrupt support

Replace the stubbed out CXL Get/Set Event interrupt policy mailbox
commands.  Enable those commands to control interrupts for each of the
event log types.

Skip the standard input mailbox length on the Set command due to DCD
being optional.  Perform the checks separately.

Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230530133603.16934-5-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/cxl/cxl-events.c         |  33 ++++++++++-
 hw/cxl/cxl-mailbox-utils.c  | 106 +++++++++++++++++++++++++++++-------
 hw/mem/cxl_type3.c          |   4 +-
 include/hw/cxl/cxl_device.h |   6 +-
 include/hw/cxl/cxl_events.h |  23 ++++++++
 5 files changed, 147 insertions(+), 25 deletions(-)

diff --git a/hw/cxl/cxl-events.c b/hw/cxl/cxl-events.c
index 5da1b76b97..d161d57456 100644
--- a/hw/cxl/cxl-events.c
+++ b/hw/cxl/cxl-events.c
@@ -13,6 +13,8 @@
 #include "qemu/bswap.h"
 #include "qemu/typedefs.h"
 #include "qemu/error-report.h"
+#include "hw/pci/msi.h"
+#include "hw/pci/msix.h"
 #include "hw/cxl/cxl.h"
 #include "hw/cxl/cxl_events.h"
 
@@ -26,7 +28,7 @@ static void reset_overflow(CXLEventLog *log)
     log->last_overflow_timestamp = 0;
 }
 
-void cxl_event_init(CXLDeviceState *cxlds)
+void cxl_event_init(CXLDeviceState *cxlds, int start_msg_num)
 {
     CXLEventLog *log;
     int i;
@@ -37,9 +39,16 @@ void cxl_event_init(CXLDeviceState *cxlds)
         log->overflow_err_count = 0;
         log->first_overflow_timestamp = 0;
         log->last_overflow_timestamp = 0;
+        log->irq_enabled = false;
+        log->irq_vec = start_msg_num++;
         qemu_mutex_init(&log->lock);
         QSIMPLEQ_INIT(&log->events);
     }
+
+    /* Override -- Dynamic Capacity uses the same vector as info */
+    cxlds->event_logs[CXL_EVENT_TYPE_DYNAMIC_CAP].irq_vec =
+                      cxlds->event_logs[CXL_EVENT_TYPE_INFO].irq_vec;
+
 }
 
 static CXLEvent *cxl_event_get_head(CXLEventLog *log)
@@ -215,3 +224,25 @@ CXLRetCode cxl_event_clear_records(CXLDeviceState *cxlds, CXLClearEventPayload *
 
     return CXL_MBOX_SUCCESS;
 }
+
+void cxl_event_irq_assert(CXLType3Dev *ct3d)
+{
+    CXLDeviceState *cxlds = &ct3d->cxl_dstate;
+    PCIDevice *pdev = &ct3d->parent_obj;
+    int i;
+
+    for (i = 0; i < CXL_EVENT_TYPE_MAX; i++) {
+        CXLEventLog *log = &cxlds->event_logs[i];
+
+        if (!log->irq_enabled || cxl_event_empty(log)) {
+            continue;
+        }
+
+        /*  Notifies interrupt, legacy IRQ is not supported */
+        if (msix_enabled(pdev)) {
+            msix_notify(pdev, log->irq_vec);
+        } else if (msi_enabled(pdev)) {
+            msi_notify(pdev, log->irq_vec);
+        }
+    }
+}
diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 3f46538048..02f9b5a870 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -80,25 +80,6 @@ struct cxl_cmd {
     uint8_t *payload;
 };
 
-#define DEFINE_MAILBOX_HANDLER_ZEROED(name, size)                         \
-    uint16_t __zero##name = size;                                         \
-    static CXLRetCode cmd_##name(struct cxl_cmd *cmd,                       \
-                                 CXLDeviceState *cxl_dstate, uint16_t *len) \
-    {                                                                     \
-        *len = __zero##name;                                              \
-        memset(cmd->payload, 0, *len);                                    \
-        return CXL_MBOX_SUCCESS;                                          \
-    }
-#define DEFINE_MAILBOX_HANDLER_NOP(name)                                  \
-    static CXLRetCode cmd_##name(struct cxl_cmd *cmd,                       \
-                                 CXLDeviceState *cxl_dstate, uint16_t *len) \
-    {                                                                     \
-        return CXL_MBOX_SUCCESS;                                          \
-    }
-
-DEFINE_MAILBOX_HANDLER_ZEROED(events_get_interrupt_policy, 4);
-DEFINE_MAILBOX_HANDLER_NOP(events_set_interrupt_policy);
-
 static CXLRetCode cmd_events_get_records(struct cxl_cmd *cmd,
                                          CXLDeviceState *cxlds,
                                          uint16_t *len)
@@ -136,6 +117,88 @@ static CXLRetCode cmd_events_clear_records(struct cxl_cmd *cmd,
     return cxl_event_clear_records(cxlds, pl);
 }
 
+static CXLRetCode cmd_events_get_interrupt_policy(struct cxl_cmd *cmd,
+                                                  CXLDeviceState *cxlds,
+                                                  uint16_t *len)
+{
+    CXLEventInterruptPolicy *policy;
+    CXLEventLog *log;
+
+    policy = (CXLEventInterruptPolicy *)cmd->payload;
+    memset(policy, 0, sizeof(*policy));
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_INFO];
+    if (log->irq_enabled) {
+        policy->info_settings = CXL_EVENT_INT_SETTING(log->irq_vec);
+    }
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_WARN];
+    if (log->irq_enabled) {
+        policy->warn_settings = CXL_EVENT_INT_SETTING(log->irq_vec);
+    }
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_FAIL];
+    if (log->irq_enabled) {
+        policy->failure_settings = CXL_EVENT_INT_SETTING(log->irq_vec);
+    }
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_FATAL];
+    if (log->irq_enabled) {
+        policy->fatal_settings = CXL_EVENT_INT_SETTING(log->irq_vec);
+    }
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_DYNAMIC_CAP];
+    if (log->irq_enabled) {
+        /* Dynamic Capacity borrows the same vector as info */
+        policy->dyn_cap_settings = CXL_INT_MSI_MSIX;
+    }
+
+    *len = sizeof(*policy);
+    return CXL_MBOX_SUCCESS;
+}
+
+static CXLRetCode cmd_events_set_interrupt_policy(struct cxl_cmd *cmd,
+                                                  CXLDeviceState *cxlds,
+                                                  uint16_t *len)
+{
+    CXLEventInterruptPolicy *policy;
+    CXLEventLog *log;
+
+    if (*len < CXL_EVENT_INT_SETTING_MIN_LEN) {
+        return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
+    }
+
+    policy = (CXLEventInterruptPolicy *)cmd->payload;
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_INFO];
+    log->irq_enabled = (policy->info_settings & CXL_EVENT_INT_MODE_MASK) ==
+                        CXL_INT_MSI_MSIX;
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_WARN];
+    log->irq_enabled = (policy->warn_settings & CXL_EVENT_INT_MODE_MASK) ==
+                        CXL_INT_MSI_MSIX;
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_FAIL];
+    log->irq_enabled = (policy->failure_settings & CXL_EVENT_INT_MODE_MASK) ==
+                        CXL_INT_MSI_MSIX;
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_FATAL];
+    log->irq_enabled = (policy->fatal_settings & CXL_EVENT_INT_MODE_MASK) ==
+                        CXL_INT_MSI_MSIX;
+
+    /* DCD is optional */
+    if (*len < sizeof(*policy)) {
+        return CXL_MBOX_SUCCESS;
+    }
+
+    log = &cxlds->event_logs[CXL_EVENT_TYPE_DYNAMIC_CAP];
+    log->irq_enabled = (policy->dyn_cap_settings & CXL_EVENT_INT_MODE_MASK) ==
+                        CXL_INT_MSI_MSIX;
+
+    *len = sizeof(*policy);
+    return CXL_MBOX_SUCCESS;
+}
+
 /* 8.2.9.2.1 */
 static CXLRetCode cmd_firmware_update_get_info(struct cxl_cmd *cmd,
                                                CXLDeviceState *cxl_dstate,
@@ -611,9 +674,10 @@ static struct cxl_cmd cxl_cmd_set[256][256] = {
     [EVENTS][CLEAR_RECORDS] = { "EVENTS_CLEAR_RECORDS",
         cmd_events_clear_records, ~0, IMMEDIATE_LOG_CHANGE },
     [EVENTS][GET_INTERRUPT_POLICY] = { "EVENTS_GET_INTERRUPT_POLICY",
-        cmd_events_get_interrupt_policy, 0, 0 },
+                                      cmd_events_get_interrupt_policy, 0, 0 },
     [EVENTS][SET_INTERRUPT_POLICY] = { "EVENTS_SET_INTERRUPT_POLICY",
-        cmd_events_set_interrupt_policy, 4, IMMEDIATE_CONFIG_CHANGE },
+                                      cmd_events_set_interrupt_policy,
+                                      ~0, IMMEDIATE_CONFIG_CHANGE },
     [FIRMWARE_UPDATE][GET_INFO] = { "FIRMWARE_UPDATE_GET_INFO",
         cmd_firmware_update_get_info, 0, 0 },
     [TIMESTAMP][GET] = { "TIMESTAMP_GET", cmd_timestamp_get, 0, 0 },
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index ec5a384885..c9e347f42b 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -659,7 +659,7 @@ static void ct3_realize(PCIDevice *pci_dev, Error **errp)
     ComponentRegisters *regs = &cxl_cstate->crb;
     MemoryRegion *mr = &regs->component_registers;
     uint8_t *pci_conf = pci_dev->config;
-    unsigned short msix_num = 1;
+    unsigned short msix_num = 6;
     int i, rc;
 
     QTAILQ_INIT(&ct3d->error_list);
@@ -723,8 +723,8 @@ static void ct3_realize(PCIDevice *pci_dev, Error **errp)
     if (rc) {
         goto err_release_cdat;
     }
+    cxl_event_init(&ct3d->cxl_dstate, 2);
 
-    cxl_event_init(&ct3d->cxl_dstate);
     return;
 
 err_release_cdat:
diff --git a/include/hw/cxl/cxl_device.h b/include/hw/cxl/cxl_device.h
index d3aec1bc0e..1978730fba 100644
--- a/include/hw/cxl/cxl_device.h
+++ b/include/hw/cxl/cxl_device.h
@@ -121,6 +121,8 @@ typedef struct CXLEventLog {
     uint16_t overflow_err_count;
     uint64_t first_overflow_timestamp;
     uint64_t last_overflow_timestamp;
+    bool irq_enabled;
+    int irq_vec;
     QemuMutex lock;
     QSIMPLEQ_HEAD(, CXLEvent) events;
 } CXLEventLog;
@@ -369,7 +371,7 @@ MemTxResult cxl_type3_write(PCIDevice *d, hwaddr host_addr, uint64_t data,
 
 uint64_t cxl_device_get_timestamp(CXLDeviceState *cxlds);
 
-void cxl_event_init(CXLDeviceState *cxlds);
+void cxl_event_init(CXLDeviceState *cxlds, int start_msg_num);
 bool cxl_event_insert(CXLDeviceState *cxlds, CXLEventLogType log_type,
                       CXLEventRecordRaw *event);
 CXLRetCode cxl_event_get_records(CXLDeviceState *cxlds, CXLGetEventPayload *pl,
@@ -378,6 +380,8 @@ CXLRetCode cxl_event_get_records(CXLDeviceState *cxlds, CXLGetEventPayload *pl,
 CXLRetCode cxl_event_clear_records(CXLDeviceState *cxlds,
                                    CXLClearEventPayload *pl);
 
+void cxl_event_irq_assert(CXLType3Dev *ct3d);
+
 void cxl_set_poison_list_overflowed(CXLType3Dev *ct3d);
 
 #endif
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index d4aaa894f1..4bf8b7aa08 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -80,4 +80,27 @@ typedef struct CXLClearEventPayload {
     uint16_t handle[];
 } CXLClearEventPayload;
 
+/**
+ * Event Interrupt Policy
+ *
+ * CXL rev 3.0 section 8.2.9.2.4; Table 8-52
+ */
+typedef enum CXLEventIntMode {
+    CXL_INT_NONE     = 0x00,
+    CXL_INT_MSI_MSIX = 0x01,
+    CXL_INT_FW       = 0x02,
+    CXL_INT_RES      = 0x03,
+} CXLEventIntMode;
+#define CXL_EVENT_INT_MODE_MASK 0x3
+#define CXL_EVENT_INT_SETTING(vector) ((((uint8_t)vector & 0xf) << 4) | CXL_INT_MSI_MSIX)
+typedef struct CXLEventInterruptPolicy {
+    uint8_t info_settings;
+    uint8_t warn_settings;
+    uint8_t failure_settings;
+    uint8_t fatal_settings;
+    uint8_t dyn_cap_settings;
+} QEMU_PACKED CXLEventInterruptPolicy;
+/* DCD is optional but other fields are not */
+#define CXL_EVENT_INT_SETTING_MIN_LEN 4
+
 #endif /* CXL_EVENTS_H */

From ea9b6d647f2f4708708d19ba1cb17d332d3eff06 Mon Sep 17 00:00:00 2001
From: Ira Weiny <ira.weiny@intel.com>
Date: Tue, 30 May 2023 14:36:01 +0100
Subject: [PATCH 0053/1353] hw/cxl/events: Add injection of General Media
 Events

To facilitate testing provide a QMP command to inject a general media
event.  The event can be added to the log specified.

Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

Message-Id: <20230530133603.16934-6-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/mem/cxl_type3.c          | 111 ++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3_stubs.c    |  10 ++++
 include/hw/cxl/cxl_events.h |  20 +++++++
 qapi/cxl.json               |  74 ++++++++++++++++++++++++
 4 files changed, 215 insertions(+)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index c9e347f42b..b1618779d2 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1181,6 +1181,117 @@ void qmp_cxl_inject_correctable_error(const char *path, CxlCorErrorType type,
     pcie_aer_inject_error(PCI_DEVICE(obj), &err);
 }
 
+static void cxl_assign_event_header(CXLEventRecordHdr *hdr,
+                                    const QemuUUID *uuid, uint32_t flags,
+                                    uint8_t length, uint64_t timestamp)
+{
+    st24_le_p(&hdr->flags, flags);
+    hdr->length = length;
+    memcpy(&hdr->id, uuid, sizeof(hdr->id));
+    stq_le_p(&hdr->timestamp, timestamp);
+}
+
+static const QemuUUID gen_media_uuid = {
+    .data = UUID(0xfbcd0a77, 0xc260, 0x417f,
+                 0x85, 0xa9, 0x08, 0x8b, 0x16, 0x21, 0xeb, 0xa6),
+};
+
+#define CXL_GMER_VALID_CHANNEL                          BIT(0)
+#define CXL_GMER_VALID_RANK                             BIT(1)
+#define CXL_GMER_VALID_DEVICE                           BIT(2)
+#define CXL_GMER_VALID_COMPONENT                        BIT(3)
+
+static int ct3d_qmp_cxl_event_log_enc(CxlEventLog log)
+{
+    switch (log) {
+    case CXL_EVENT_LOG_INFORMATIONAL:
+        return CXL_EVENT_TYPE_INFO;
+    case CXL_EVENT_LOG_WARNING:
+        return CXL_EVENT_TYPE_WARN;
+    case CXL_EVENT_LOG_FAILURE:
+        return CXL_EVENT_TYPE_FAIL;
+    case CXL_EVENT_LOG_FATAL:
+        return CXL_EVENT_TYPE_FATAL;
+/* DCD not yet supported */
+    default:
+        return -EINVAL;
+    }
+}
+/* Component ID is device specific.  Define this as a string. */
+void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
+                                        uint8_t flags, uint64_t dpa,
+                                        uint8_t descriptor, uint8_t type,
+                                        uint8_t transaction_type,
+                                        bool has_channel, uint8_t channel,
+                                        bool has_rank, uint8_t rank,
+                                        bool has_device, uint32_t device,
+                                        const char *component_id,
+                                        Error **errp)
+{
+    Object *obj = object_resolve_path(path, NULL);
+    CXLEventGenMedia gem;
+    CXLEventRecordHdr *hdr = &gem.hdr;
+    CXLDeviceState *cxlds;
+    CXLType3Dev *ct3d;
+    uint16_t valid_flags = 0;
+    uint8_t enc_log;
+    int rc;
+
+    if (!obj) {
+        error_setg(errp, "Unable to resolve path");
+        return;
+    }
+    if (!object_dynamic_cast(obj, TYPE_CXL_TYPE3)) {
+        error_setg(errp, "Path does not point to a CXL type 3 device");
+        return;
+    }
+    ct3d = CXL_TYPE3(obj);
+    cxlds = &ct3d->cxl_dstate;
+
+    rc = ct3d_qmp_cxl_event_log_enc(log);
+    if (rc < 0) {
+        error_setg(errp, "Unhandled error log type");
+        return;
+    }
+    enc_log = rc;
+
+    memset(&gem, 0, sizeof(gem));
+    cxl_assign_event_header(hdr, &gen_media_uuid, flags, sizeof(gem),
+                            cxl_device_get_timestamp(&ct3d->cxl_dstate));
+
+    stq_le_p(&gem.phys_addr, dpa);
+    gem.descriptor = descriptor;
+    gem.type = type;
+    gem.transaction_type = transaction_type;
+
+    if (has_channel) {
+        gem.channel = channel;
+        valid_flags |= CXL_GMER_VALID_CHANNEL;
+    }
+
+    if (has_rank) {
+        gem.rank = rank;
+        valid_flags |= CXL_GMER_VALID_RANK;
+    }
+
+    if (has_device) {
+        st24_le_p(gem.device, device);
+        valid_flags |= CXL_GMER_VALID_DEVICE;
+    }
+
+    if (component_id) {
+        strncpy((char *)gem.component_id, component_id,
+                sizeof(gem.component_id) - 1);
+        valid_flags |= CXL_GMER_VALID_COMPONENT;
+    }
+
+    stw_le_p(&gem.validity_flags, valid_flags);
+
+    if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&gem)) {
+        cxl_event_irq_assert(ct3d);
+    }
+}
+
 static void ct3_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index fd1166a610..4dfbdf9268 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -3,6 +3,16 @@
 #include "qapi/error.h"
 #include "qapi/qapi-commands-cxl.h"
 
+void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
+                                        uint8_t flags, uint64_t dpa,
+                                        uint8_t descriptor, uint8_t type,
+                                        uint8_t transaction_type,
+                                        bool has_channel, uint8_t channel,
+                                        bool has_rank, uint8_t rank,
+                                        bool has_device, uint32_t device,
+                                        const char *component_id,
+                                        Error **errp) {}
+
 void qmp_cxl_inject_poison(const char *path, uint64_t start, uint64_t length,
                            Error **errp)
 {
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index 4bf8b7aa08..b189193f4c 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -103,4 +103,24 @@ typedef struct CXLEventInterruptPolicy {
 /* DCD is optional but other fields are not */
 #define CXL_EVENT_INT_SETTING_MIN_LEN 4
 
+/*
+ * General Media Event Record
+ * CXL rev 3.0 Section 8.2.9.2.1.1; Table 8-43
+ */
+#define CXL_EVENT_GEN_MED_COMP_ID_SIZE  0x10
+#define CXL_EVENT_GEN_MED_RES_SIZE      0x2e
+typedef struct CXLEventGenMedia {
+    CXLEventRecordHdr hdr;
+    uint64_t phys_addr;
+    uint8_t descriptor;
+    uint8_t type;
+    uint8_t transaction_type;
+    uint16_t validity_flags;
+    uint8_t channel;
+    uint8_t rank;
+    uint8_t device[3];
+    uint8_t component_id[CXL_EVENT_GEN_MED_COMP_ID_SIZE];
+    uint8_t reserved[CXL_EVENT_GEN_MED_RES_SIZE];
+} QEMU_PACKED CXLEventGenMedia;
+
 #endif /* CXL_EVENTS_H */
diff --git a/qapi/cxl.json b/qapi/cxl.json
index ed1c7eea3a..d509430844 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -5,6 +5,80 @@
 # = CXL devices
 ##
 
+##
+# @CxlEventLog:
+#
+# CXL has a number of separate event logs for different types of
+# events.  Each such event log is handled and signaled independently.
+#
+# @informational: Information Event Log
+#
+# @warning: Warning Event Log
+#
+# @failure: Failure Event Log
+#
+# @fatal: Fatal Event Log
+#
+# Since: 8.1
+##
+{ 'enum': 'CxlEventLog',
+  'data': ['informational',
+           'warning',
+           'failure',
+           'fatal']
+ }
+
+##
+# @cxl-inject-general-media-event:
+#
+# Inject an event record for a General Media Event (CXL r3.0
+# 8.2.9.2.1.1).  This event type is reported via one of the event logs
+# specified via the log parameter.
+#
+# @path: CXL type 3 device canonical QOM path
+#
+# @log: event log to add the event to
+#
+# @flags: Event Record Flags.  See CXL r3.0 Table 8-42 Common Event
+#     Record Format, Event Record Flags for subfield definitions.
+#
+# @dpa: Device Physical Address (relative to @path device).  Note
+#     lower bits include some flags.  See CXL r3.0 Table 8-43 General
+#     Media Event Record, Physical Address.
+#
+# @descriptor: Memory Event Descriptor with additional memory event
+#     information.  See CXL r3.0 Table 8-43 General Media Event
+#     Record, Memory Event Descriptor for bit definitions.
+#
+# @type: Type of memory event that occurred.  See CXL r3.0 Table 8-43
+#     General Media Event Record, Memory Event Type for possible
+#     values.
+#
+# @transaction-type: Type of first transaction that caused the event
+#     to occur.  See CXL r3.0 Table 8-43 General Media Event Record,
+#     Transaction Type for possible values.
+#
+# @channel: The channel of the memory event location.  A channel is an
+#     interface that can be independently accessed for a transaction.
+#
+# @rank: The rank of the memory event location.  A rank is a set of
+#     memory devices on a channel that together execute a transaction.
+#
+# @device: Bitmask that represents all devices in the rank associated
+#     with the memory event location.
+#
+# @component-id: Device specific component identifier for the event.
+#     May describe a field replaceable sub-component of the device.
+#
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-general-media-event',
+  'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint8',
+            'dpa': 'uint64', 'descriptor': 'uint8',
+            'type': 'uint8', 'transaction-type': 'uint8',
+            '*channel': 'uint8', '*rank': 'uint8',
+            '*device': 'uint32', '*component-id': 'str' } }
+
 ##
 # @cxl-inject-poison:
 #

From b90a324eda7113b62b558aad43e2166eb52567d2 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Tue, 30 May 2023 14:36:02 +0100
Subject: [PATCH 0054/1353] hw/cxl/events: Add injection of DRAM events

Defined in CXL r3.0 8.2.9.2.1.2 DRAM Event Record, this event
provides information related to DRAM devices.

Example injection command in QMP:

{ "execute": "cxl-inject-dram-event",
    "arguments": {
        "path": "/machine/peripheral/cxl-mem0",
        "log": "informational",
        "flags": 1,
        "dpa": 1000,
        "descriptor": 3,
        "type": 3,
        "transaction-type": 192,
        "channel": 3,
        "rank": 17,
        "nibble-mask": 37421234,
        "bank-group": 7,
        "bank": 11,
        "row": 2,
        "column": 77,
        "correction-mask": [33, 44, 55,66]
    }}

Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230530133603.16934-7-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/mem/cxl_type3.c          | 116 ++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3_stubs.c    |  13 ++++
 include/hw/cxl/cxl_events.h |  23 +++++++
 qapi/cxl.json               |  61 +++++++++++++++++++
 4 files changed, 213 insertions(+)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index b1618779d2..3c07b1b7a3 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1196,6 +1196,11 @@ static const QemuUUID gen_media_uuid = {
                  0x85, 0xa9, 0x08, 0x8b, 0x16, 0x21, 0xeb, 0xa6),
 };
 
+static const QemuUUID dram_uuid = {
+    .data = UUID(0x601dcbb3, 0x9c06, 0x4eab, 0xb8, 0xaf,
+                 0x4e, 0x9b, 0xfb, 0x5c, 0x96, 0x24),
+};
+
 #define CXL_GMER_VALID_CHANNEL                          BIT(0)
 #define CXL_GMER_VALID_RANK                             BIT(1)
 #define CXL_GMER_VALID_DEVICE                           BIT(2)
@@ -1292,6 +1297,117 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
     }
 }
 
+#define CXL_DRAM_VALID_CHANNEL                          BIT(0)
+#define CXL_DRAM_VALID_RANK                             BIT(1)
+#define CXL_DRAM_VALID_NIBBLE_MASK                      BIT(2)
+#define CXL_DRAM_VALID_BANK_GROUP                       BIT(3)
+#define CXL_DRAM_VALID_BANK                             BIT(4)
+#define CXL_DRAM_VALID_ROW                              BIT(5)
+#define CXL_DRAM_VALID_COLUMN                           BIT(6)
+#define CXL_DRAM_VALID_CORRECTION_MASK                  BIT(7)
+
+void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
+                               uint64_t dpa, uint8_t descriptor,
+                               uint8_t type, uint8_t transaction_type,
+                               bool has_channel, uint8_t channel,
+                               bool has_rank, uint8_t rank,
+                               bool has_nibble_mask, uint32_t nibble_mask,
+                               bool has_bank_group, uint8_t bank_group,
+                               bool has_bank, uint8_t bank,
+                               bool has_row, uint32_t row,
+                               bool has_column, uint16_t column,
+                               bool has_correction_mask, uint64List *correction_mask,
+                               Error **errp)
+{
+    Object *obj = object_resolve_path(path, NULL);
+    CXLEventDram dram;
+    CXLEventRecordHdr *hdr = &dram.hdr;
+    CXLDeviceState *cxlds;
+    CXLType3Dev *ct3d;
+    uint16_t valid_flags = 0;
+    uint8_t enc_log;
+    int rc;
+
+    if (!obj) {
+        error_setg(errp, "Unable to resolve path");
+        return;
+    }
+    if (!object_dynamic_cast(obj, TYPE_CXL_TYPE3)) {
+        error_setg(errp, "Path does not point to a CXL type 3 device");
+        return;
+    }
+    ct3d = CXL_TYPE3(obj);
+    cxlds = &ct3d->cxl_dstate;
+
+    rc = ct3d_qmp_cxl_event_log_enc(log);
+    if (rc < 0) {
+        error_setg(errp, "Unhandled error log type");
+        return;
+    }
+    enc_log = rc;
+
+    memset(&dram, 0, sizeof(dram));
+    cxl_assign_event_header(hdr, &dram_uuid, flags, sizeof(dram),
+                            cxl_device_get_timestamp(&ct3d->cxl_dstate));
+    stq_le_p(&dram.phys_addr, dpa);
+    dram.descriptor = descriptor;
+    dram.type = type;
+    dram.transaction_type = transaction_type;
+
+    if (has_channel) {
+        dram.channel = channel;
+        valid_flags |= CXL_DRAM_VALID_CHANNEL;
+    }
+
+    if (has_rank) {
+        dram.rank = rank;
+        valid_flags |= CXL_DRAM_VALID_RANK;
+    }
+
+    if (has_nibble_mask) {
+        st24_le_p(dram.nibble_mask, nibble_mask);
+        valid_flags |= CXL_DRAM_VALID_NIBBLE_MASK;
+    }
+
+    if (has_bank_group) {
+        dram.bank_group = bank_group;
+        valid_flags |= CXL_DRAM_VALID_BANK_GROUP;
+    }
+
+    if (has_bank) {
+        dram.bank = bank;
+        valid_flags |= CXL_DRAM_VALID_BANK;
+    }
+
+    if (has_row) {
+        st24_le_p(dram.row, row);
+        valid_flags |= CXL_DRAM_VALID_ROW;
+    }
+
+    if (has_column) {
+        stw_le_p(&dram.column, column);
+        valid_flags |= CXL_DRAM_VALID_COLUMN;
+    }
+
+    if (has_correction_mask) {
+        int count = 0;
+        while (correction_mask && count < 4) {
+            stq_le_p(&dram.correction_mask[count],
+                     correction_mask->value);
+            count++;
+            correction_mask = correction_mask->next;
+        }
+        valid_flags |= CXL_DRAM_VALID_CORRECTION_MASK;
+    }
+
+    stw_le_p(&dram.validity_flags, valid_flags);
+
+    if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&dram)) {
+        cxl_event_irq_assert(ct3d);
+    }
+    return;
+}
+
 static void ct3_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index 4dfbdf9268..e904c5d089 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -13,6 +13,19 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
                                         const char *component_id,
                                         Error **errp) {}
 
+void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
+                               uint64_t dpa, uint8_t descriptor,
+                               uint8_t type, uint8_t transaction_type,
+                               bool has_channel, uint8_t channel,
+                               bool has_rank, uint8_t rank,
+                               bool has_nibble_mask, uint32_t nibble_mask,
+                               bool has_bank_group, uint8_t bank_group,
+                               bool has_bank, uint8_t bank,
+                               bool has_row, uint32_t row,
+                               bool has_column, uint16_t column,
+                               bool has_correction_mask, uint64List *correction_mask,
+                               Error **errp) {}
+
 void qmp_cxl_inject_poison(const char *path, uint64_t start, uint64_t length,
                            Error **errp)
 {
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index b189193f4c..a39e30d973 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -123,4 +123,27 @@ typedef struct CXLEventGenMedia {
     uint8_t reserved[CXL_EVENT_GEN_MED_RES_SIZE];
 } QEMU_PACKED CXLEventGenMedia;
 
+/*
+ * DRAM Event Record
+ * CXL Rev 3.0 Section 8.2.9.2.1.2: Table 8-44
+ * All fields little endian.
+ */
+typedef struct CXLEventDram {
+    CXLEventRecordHdr hdr;
+    uint64_t phys_addr;
+    uint8_t descriptor;
+    uint8_t type;
+    uint8_t transaction_type;
+    uint16_t validity_flags;
+    uint8_t channel;
+    uint8_t rank;
+    uint8_t nibble_mask[3];
+    uint8_t bank_group;
+    uint8_t bank;
+    uint8_t row[3];
+    uint16_t column;
+    uint64_t correction_mask[4];
+    uint8_t reserved[0x17];
+} QEMU_PACKED CXLEventDram;
+
 #endif /* CXL_EVENTS_H */
diff --git a/qapi/cxl.json b/qapi/cxl.json
index d509430844..2ad310387c 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -79,6 +79,67 @@
             '*channel': 'uint8', '*rank': 'uint8',
             '*device': 'uint32', '*component-id': 'str' } }
 
+##
+# @cxl-inject-dram-event:
+#
+# Inject an event record for a DRAM Event (CXL r3.0 8.2.9.2.1.2).
+# This event type is reported via one of the event logs specified via
+# the log parameter.
+#
+# @path: CXL type 3 device canonical QOM path
+#
+# @log: Event log to add the event to
+#
+# @flags: Event Record Flags.  See CXL r3.0 Table 8-42 Common Event
+#     Record Format, Event Record Flags for subfield definitions.
+#
+# @dpa: Device Physical Address (relative to @path device).  Note
+#     lower bits include some flags.  See CXL r3.0 Table 8-44 DRAM
+#     Event Record, Physical Address.
+#
+# @descriptor: Memory Event Descriptor with additional memory event
+#     information.  See CXL r3.0 Table 8-44 DRAM Event Record, Memory
+#     Event Descriptor for bit definitions.
+#
+# @type: Type of memory event that occurred.  See CXL r3.0 Table 8-44
+#     DRAM Event Record, Memory Event Type for possible values.
+#
+# @transaction-type: Type of first transaction that caused the event
+#     to occur.  See CXL r3.0 Table 8-44 DRAM Event Record,
+#     Transaction Type for possible values.
+#
+# @channel: The channel of the memory event location.  A channel is an
+#     interface that can be independently accessed for a transaction.
+#
+# @rank: The rank of the memory event location.  A rank is a set of
+#     memory devices on a channel that together execute a transaction.
+#
+# @nibble-mask: Identifies one or more nibbles that the error affects
+#
+# @bank-group: Bank group of the memory event location, incorporating
+#     a number of Banks.
+#
+# @bank: Bank of the memory event location.  A single bank is accessed
+#     per read or write of the memory.
+#
+# @row: Row address within the DRAM.
+#
+# @column: Column address within the DRAM.
+#
+# @correction-mask: Bits within each nibble.  Used in order of bits
+#     set in the nibble-mask.  Up to 4 nibbles may be covered.
+#
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-dram-event',
+  'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags': 'uint8',
+            'dpa': 'uint64', 'descriptor': 'uint8',
+            'type': 'uint8', 'transaction-type': 'uint8',
+            '*channel': 'uint8', '*rank': 'uint8', '*nibble-mask': 'uint32',
+            '*bank-group': 'uint8', '*bank': 'uint8', '*row': 'uint32',
+            '*column': 'uint16', '*correction-mask': [ 'uint64' ]
+           }}
+
 ##
 # @cxl-inject-poison:
 #

From bafe03083255da3a053144b77a5fbc7dbf9494f3 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Tue, 30 May 2023 14:36:03 +0100
Subject: [PATCH 0055/1353] hw/cxl/events: Add injection of Memory Module
 Events

These events include a copy of the device health information at the
time of the event. Actually using the emulated device health would
require a lot of controls to manipulate that state.  Given the aim
of this injection code is to just test the flows when events occur,
inject the contents of the device health state as well.

Future work may add more sophisticate device health emulation
including direct generation of these records when events occur
(such as a temperature threshold being crossed).  That does not
reduce the usefulness of this more basic generation of the events.

Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Message-Id: <20230530133603.16934-8-Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/mem/cxl_type3.c          | 62 +++++++++++++++++++++++++++++++++++++
 hw/mem/cxl_type3_stubs.c    | 12 +++++++
 include/hw/cxl/cxl_events.h | 19 ++++++++++++
 qapi/cxl.json               | 53 +++++++++++++++++++++++++++++++
 4 files changed, 146 insertions(+)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 3c07b1b7a3..4e314748d3 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1201,6 +1201,11 @@ static const QemuUUID dram_uuid = {
                  0x4e, 0x9b, 0xfb, 0x5c, 0x96, 0x24),
 };
 
+static const QemuUUID memory_module_uuid = {
+    .data = UUID(0xfe927475, 0xdd59, 0x4339, 0xa5, 0x86,
+                 0x79, 0xba, 0xb1, 0x13, 0xb7, 0x74),
+};
+
 #define CXL_GMER_VALID_CHANNEL                          BIT(0)
 #define CXL_GMER_VALID_RANK                             BIT(1)
 #define CXL_GMER_VALID_DEVICE                           BIT(2)
@@ -1408,6 +1413,63 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
     return;
 }
 
+void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
+                                        uint8_t flags, uint8_t type,
+                                        uint8_t health_status,
+                                        uint8_t media_status,
+                                        uint8_t additional_status,
+                                        uint8_t life_used,
+                                        int16_t temperature,
+                                        uint32_t dirty_shutdown_count,
+                                        uint32_t corrected_volatile_error_count,
+                                        uint32_t corrected_persistent_error_count,
+                                        Error **errp)
+{
+    Object *obj = object_resolve_path(path, NULL);
+    CXLEventMemoryModule module;
+    CXLEventRecordHdr *hdr = &module.hdr;
+    CXLDeviceState *cxlds;
+    CXLType3Dev *ct3d;
+    uint8_t enc_log;
+    int rc;
+
+    if (!obj) {
+        error_setg(errp, "Unable to resolve path");
+        return;
+    }
+    if (!object_dynamic_cast(obj, TYPE_CXL_TYPE3)) {
+        error_setg(errp, "Path does not point to a CXL type 3 device");
+        return;
+    }
+    ct3d = CXL_TYPE3(obj);
+    cxlds = &ct3d->cxl_dstate;
+
+    rc = ct3d_qmp_cxl_event_log_enc(log);
+    if (rc < 0) {
+        error_setg(errp, "Unhandled error log type");
+        return;
+    }
+    enc_log = rc;
+
+    memset(&module, 0, sizeof(module));
+    cxl_assign_event_header(hdr, &memory_module_uuid, flags, sizeof(module),
+                            cxl_device_get_timestamp(&ct3d->cxl_dstate));
+
+    module.type = type;
+    module.health_status = health_status;
+    module.media_status = media_status;
+    module.additional_status = additional_status;
+    module.life_used = life_used;
+    stw_le_p(&module.temperature, temperature);
+    stl_le_p(&module.dirty_shutdown_count, dirty_shutdown_count);
+    stl_le_p(&module.corrected_volatile_error_count, corrected_volatile_error_count);
+    stl_le_p(&module.corrected_persistent_error_count, corrected_persistent_error_count);
+
+    if (cxl_event_insert(cxlds, enc_log, (CXLEventRecordRaw *)&module)) {
+        cxl_event_irq_assert(ct3d);
+    }
+}
+
 static void ct3_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
diff --git a/hw/mem/cxl_type3_stubs.c b/hw/mem/cxl_type3_stubs.c
index e904c5d089..f3e4a9fa72 100644
--- a/hw/mem/cxl_type3_stubs.c
+++ b/hw/mem/cxl_type3_stubs.c
@@ -26,6 +26,18 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log, uint8_t flags,
                                bool has_correction_mask, uint64List *correction_mask,
                                Error **errp) {}
 
+void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
+                                        uint8_t flags, uint8_t type,
+                                        uint8_t health_status,
+                                        uint8_t media_status,
+                                        uint8_t additional_status,
+                                        uint8_t life_used,
+                                        int16_t temperature,
+                                        uint32_t dirty_shutdown_count,
+                                        uint32_t corrected_volatile_error_count,
+                                        uint32_t corrected_persistent_error_count,
+                                        Error **errp) {}
+
 void qmp_cxl_inject_poison(const char *path, uint64_t start, uint64_t length,
                            Error **errp)
 {
diff --git a/include/hw/cxl/cxl_events.h b/include/hw/cxl/cxl_events.h
index a39e30d973..089ba2091f 100644
--- a/include/hw/cxl/cxl_events.h
+++ b/include/hw/cxl/cxl_events.h
@@ -146,4 +146,23 @@ typedef struct CXLEventDram {
     uint8_t reserved[0x17];
 } QEMU_PACKED CXLEventDram;
 
+/*
+ * Memory Module Event Record
+ * CXL Rev 3.0 Section 8.2.9.2.1.3: Table 8-45
+ * All fields little endian.
+ */
+typedef struct CXLEventMemoryModule {
+    CXLEventRecordHdr hdr;
+    uint8_t type;
+    uint8_t health_status;
+    uint8_t media_status;
+    uint8_t additional_status;
+    uint8_t life_used;
+    int16_t temperature;
+    uint32_t dirty_shutdown_count;
+    uint32_t corrected_volatile_error_count;
+    uint32_t corrected_persistent_error_count;
+    uint8_t reserved[0x3d];
+} QEMU_PACKED CXLEventMemoryModule;
+
 #endif /* CXL_EVENTS_H */
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 2ad310387c..d5b5293eb5 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -140,6 +140,59 @@
             '*column': 'uint16', '*correction-mask': [ 'uint64' ]
            }}
 
+##
+# @cxl-inject-memory-module-event:
+#
+# Inject an event record for a Memory Module Event (CXL r3.0
+# 8.2.9.2.1.3).  This event includes a copy of the Device Health
+# info at the time of the event.
+#
+# @path: CXL type 3 device canonical QOM path
+#
+# @log: Event Log to add the event to
+#
+# @flags: Event Record Flags.  See CXL r3.0 Table 8-42 Common Event
+#     Record Format, Event Record Flags for subfield definitions.
+#
+# @type: Device Event Type.  See CXL r3.0 Table 8-45 Memory Module
+#     Event Record for bit definitions for bit definiions.
+#
+# @health-status: Overall health summary bitmap.  See CXL r3.0 Table
+#     8-100 Get Health Info Output Payload, Health Status for bit
+#     definitions.
+#
+# @media-status: Overall media health summary.  See CXL r3.0 Table
+#     8-100 Get Health Info Output Payload, Media Status for bit
+#     definitions.
+#
+# @additional-status: See CXL r3.0 Table 8-100 Get Health Info Output
+#     Payload, Additional Status for subfield definitions.
+#
+# @life-used: Percentage (0-100) of factory expected life span.
+#
+# @temperature: Device temperature in degrees Celsius.
+#
+# @dirty-shutdown-count: Number of times the device has been unable
+#     to determine whether data loss may have occurred.
+#
+# @corrected-volatile-error-count: Total number of correctable errors
+#     in volatile memory.
+#
+# @corrected-persistent-error-count: Total number of correctable
+#     errors in persistent memory
+#
+# Since: 8.1
+##
+{ 'command': 'cxl-inject-memory-module-event',
+  'data': { 'path': 'str', 'log': 'CxlEventLog', 'flags' : 'uint8',
+            'type': 'uint8', 'health-status': 'uint8',
+            'media-status': 'uint8', 'additional-status': 'uint8',
+            'life-used': 'uint8', 'temperature' : 'int16',
+            'dirty-shutdown-count': 'uint32',
+            'corrected-volatile-error-count': 'uint32',
+            'corrected-persistent-error-count': 'uint32'
+            }}
+
 ##
 # @cxl-inject-poison:
 #

From 5c33f9783ace0b5e077060b220978d94fecb3e81 Mon Sep 17 00:00:00 2001
From: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
Date: Tue, 16 May 2023 14:01:39 +0530
Subject: [PATCH 0056/1353] cryptodev-vhost-user: add asymmetric crypto support

Add asymmetric crypto support in vhost_user backend.

Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>
Message-Id: <20230516083139.2349744-1-gmuthukrishn@marvell.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 backends/cryptodev-vhost-user.c |  9 ++--
 hw/virtio/vhost-user.c          | 75 +++++++++++++++++++++++++++------
 2 files changed, 66 insertions(+), 18 deletions(-)

diff --git a/backends/cryptodev-vhost-user.c b/backends/cryptodev-vhost-user.c
index b1d9eb735f..c3283ba84a 100644
--- a/backends/cryptodev-vhost-user.c
+++ b/backends/cryptodev-vhost-user.c
@@ -232,9 +232,9 @@ static void cryptodev_vhost_user_init(
     backend->conf.max_auth_key_len = VHOST_USER_MAX_AUTH_KEY_LEN;
 }
 
-static int64_t cryptodev_vhost_user_sym_create_session(
+static int64_t cryptodev_vhost_user_crypto_create_session(
            CryptoDevBackend *backend,
-           CryptoDevBackendSymSessionInfo *sess_info,
+           CryptoDevBackendSessionInfo *sess_info,
            uint32_t queue_index, Error **errp)
 {
     CryptoDevBackendClient *cc =
@@ -266,18 +266,17 @@ static int cryptodev_vhost_user_create_session(
            void *opaque)
 {
     uint32_t op_code = sess_info->op_code;
-    CryptoDevBackendSymSessionInfo *sym_sess_info;
     int64_t ret;
     Error *local_error = NULL;
     int status;
 
     switch (op_code) {
     case VIRTIO_CRYPTO_CIPHER_CREATE_SESSION:
+    case VIRTIO_CRYPTO_AKCIPHER_CREATE_SESSION:
     case VIRTIO_CRYPTO_HASH_CREATE_SESSION:
     case VIRTIO_CRYPTO_MAC_CREATE_SESSION:
     case VIRTIO_CRYPTO_AEAD_CREATE_SESSION:
-        sym_sess_info = &sess_info->u.sym_sess_info;
-        ret = cryptodev_vhost_user_sym_create_session(backend, sym_sess_info,
+        ret = cryptodev_vhost_user_crypto_create_session(backend, sess_info,
                    queue_index, &local_error);
         break;
 
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 74a2a28663..2ad75a7964 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -11,6 +11,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/virtio/vhost.h"
+#include "hw/virtio/virtio-crypto.h"
 #include "hw/virtio/vhost-user.h"
 #include "hw/virtio/vhost-backend.h"
 #include "hw/virtio/virtio.h"
@@ -163,13 +164,24 @@ typedef struct VhostUserConfig {
 
 #define VHOST_CRYPTO_SYM_HMAC_MAX_KEY_LEN    512
 #define VHOST_CRYPTO_SYM_CIPHER_MAX_KEY_LEN  64
+#define VHOST_CRYPTO_ASYM_MAX_KEY_LEN  1024
 
 typedef struct VhostUserCryptoSession {
+    uint64_t op_code;
+    union {
+        struct {
+            CryptoDevBackendSymSessionInfo session_setup_data;
+            uint8_t key[VHOST_CRYPTO_SYM_CIPHER_MAX_KEY_LEN];
+            uint8_t auth_key[VHOST_CRYPTO_SYM_HMAC_MAX_KEY_LEN];
+        } sym;
+        struct {
+            CryptoDevBackendAsymSessionInfo session_setup_data;
+            uint8_t key[VHOST_CRYPTO_ASYM_MAX_KEY_LEN];
+        } asym;
+    } u;
+
     /* session id for success, -1 on errors */
     int64_t session_id;
-    CryptoDevBackendSymSessionInfo session_setup_data;
-    uint8_t key[VHOST_CRYPTO_SYM_CIPHER_MAX_KEY_LEN];
-    uint8_t auth_key[VHOST_CRYPTO_SYM_HMAC_MAX_KEY_LEN];
 } VhostUserCryptoSession;
 
 static VhostUserConfig c __attribute__ ((unused));
@@ -2357,7 +2369,7 @@ static int vhost_user_crypto_create_session(struct vhost_dev *dev,
     int ret;
     bool crypto_session = virtio_has_feature(dev->protocol_features,
                                        VHOST_USER_PROTOCOL_F_CRYPTO_SESSION);
-    CryptoDevBackendSymSessionInfo *sess_info = session_info;
+    CryptoDevBackendSessionInfo *backend_info = session_info;
     VhostUserMsg msg = {
         .hdr.request = VHOST_USER_CREATE_CRYPTO_SESSION,
         .hdr.flags = VHOST_USER_VERSION,
@@ -2371,16 +2383,53 @@ static int vhost_user_crypto_create_session(struct vhost_dev *dev,
         return -ENOTSUP;
     }
 
-    memcpy(&msg.payload.session.session_setup_data, sess_info,
-              sizeof(CryptoDevBackendSymSessionInfo));
-    if (sess_info->key_len) {
-        memcpy(&msg.payload.session.key, sess_info->cipher_key,
-               sess_info->key_len);
-    }
-    if (sess_info->auth_key_len > 0) {
-        memcpy(&msg.payload.session.auth_key, sess_info->auth_key,
-               sess_info->auth_key_len);
+    if (backend_info->op_code == VIRTIO_CRYPTO_AKCIPHER_CREATE_SESSION) {
+        CryptoDevBackendAsymSessionInfo *sess = &backend_info->u.asym_sess_info;
+        size_t keylen;
+
+        memcpy(&msg.payload.session.u.asym.session_setup_data, sess,
+               sizeof(CryptoDevBackendAsymSessionInfo));
+        if (sess->keylen) {
+            keylen = sizeof(msg.payload.session.u.asym.key);
+            if (sess->keylen > keylen) {
+                error_report("Unsupported asymmetric key size");
+                return -ENOTSUP;
+            }
+
+            memcpy(&msg.payload.session.u.asym.key, sess->key,
+                   sess->keylen);
+        }
+    } else {
+        CryptoDevBackendSymSessionInfo *sess = &backend_info->u.sym_sess_info;
+        size_t keylen;
+
+        memcpy(&msg.payload.session.u.sym.session_setup_data, sess,
+               sizeof(CryptoDevBackendSymSessionInfo));
+        if (sess->key_len) {
+            keylen = sizeof(msg.payload.session.u.sym.key);
+            if (sess->key_len > keylen) {
+                error_report("Unsupported cipher key size");
+                return -ENOTSUP;
+            }
+
+            memcpy(&msg.payload.session.u.sym.key, sess->cipher_key,
+                   sess->key_len);
+        }
+
+        if (sess->auth_key_len > 0) {
+            keylen = sizeof(msg.payload.session.u.sym.auth_key);
+            if (sess->auth_key_len > keylen) {
+                error_report("Unsupported auth key size");
+                return -ENOTSUP;
+            }
+
+            memcpy(&msg.payload.session.u.sym.auth_key, sess->auth_key,
+                   sess->auth_key_len);
+        }
     }
+
+    msg.payload.session.op_code = backend_info->op_code;
+    msg.payload.session.session_id = backend_info->session_id;
     ret = vhost_user_write(dev, &msg, NULL, 0);
     if (ret < 0) {
         error_report("vhost_user_write() return %d, create session failed",

From b3b408ffb9291e887029051a522a2c968a816d22 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:35 +0200
Subject: [PATCH 0057/1353] softmmu: Introduce qemu_target_page_mask() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since TARGET_PAGE_MASK is poisoned in target-agnostic code,
introduce the qemu_target_page_mask() helper to get this
value from target-agnostic code at runtime.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230524093744.88442-2-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 include/exec/target_page.h | 1 +
 softmmu/physmem.c          | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/exec/target_page.h b/include/exec/target_page.h
index bbf37aea17..98ffbb5c23 100644
--- a/include/exec/target_page.h
+++ b/include/exec/target_page.h
@@ -15,6 +15,7 @@
 #define EXEC_TARGET_PAGE_H
 
 size_t qemu_target_page_size(void);
+int qemu_target_page_mask(void);
 int qemu_target_page_bits(void);
 int qemu_target_page_bits_min(void);
 
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 6bdd944fe8..bda475a719 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -3359,6 +3359,11 @@ size_t qemu_target_page_size(void)
     return TARGET_PAGE_SIZE;
 }
 
+int qemu_target_page_mask(void)
+{
+    return TARGET_PAGE_MASK;
+}
+
 int qemu_target_page_bits(void)
 {
     return TARGET_PAGE_BITS;

From 8f691f1cb76f0591874e91eb18569a150bb3cfe0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:36 +0200
Subject: [PATCH 0058/1353] hw/scsi: Introduce VHOST_SCSI_COMMON symbol in
 Kconfig
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of adding 'vhost-scsi-common.c' twice (for VHOST_SCSI and
VHOST_USER_SCSI), have it depend on VHOST_SCSI_COMMON, selected by
both symbols.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230524093744.88442-3-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/scsi/Kconfig     | 6 ++++++
 hw/scsi/meson.build | 6 ++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/Kconfig b/hw/scsi/Kconfig
index e7b34dc8e2..1feab84c4c 100644
--- a/hw/scsi/Kconfig
+++ b/hw/scsi/Kconfig
@@ -48,13 +48,19 @@ config VIRTIO_SCSI
     depends on VIRTIO
     select SCSI
 
+config VHOST_SCSI_COMMON
+    bool
+    depends on VIRTIO
+
 config VHOST_SCSI
     bool
     default y
+    select VHOST_SCSI_COMMON
     depends on VIRTIO && VHOST_KERNEL
 
 config VHOST_USER_SCSI
     bool
     # Only PCI devices are provided for now
     default y if VIRTIO_PCI
+    select VHOST_SCSI_COMMON
     depends on VIRTIO && VHOST_USER && LINUX
diff --git a/hw/scsi/meson.build b/hw/scsi/meson.build
index 7a1e7f13f0..2a005420d2 100644
--- a/hw/scsi/meson.build
+++ b/hw/scsi/meson.build
@@ -17,8 +17,10 @@ specific_scsi_ss = ss.source_set()
 
 virtio_scsi_ss = ss.source_set()
 virtio_scsi_ss.add(files('virtio-scsi.c', 'virtio-scsi-dataplane.c'))
-virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi-common.c', 'vhost-scsi.c'))
-virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-scsi-common.c', 'vhost-user-scsi.c'))
+
+virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI_COMMON', if_true: files('vhost-scsi-common.c'))
+virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi.c'))
+virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi.c'))
 specific_scsi_ss.add_all(when: 'CONFIG_VIRTIO_SCSI', if_true: virtio_scsi_ss)
 
 specific_scsi_ss.add(when: 'CONFIG_SPAPR_VSCSI', if_true: files('spapr_vscsi.c'))

From 04ca164ad3fc5309732e482534410a36b4713b11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:37 +0200
Subject: [PATCH 0059/1353] hw/scsi: Rearrange meson.build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We will modify this file shortly. Re-arrange it slightly first,
declaring source sets first.

No logical change.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230524093744.88442-4-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/scsi/meson.build | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/scsi/meson.build b/hw/scsi/meson.build
index 2a005420d2..d9b5673c14 100644
--- a/hw/scsi/meson.build
+++ b/hw/scsi/meson.build
@@ -1,4 +1,7 @@
 scsi_ss = ss.source_set()
+specific_scsi_ss = ss.source_set()
+virtio_scsi_ss = ss.source_set()
+
 scsi_ss.add(files(
   'emulation.c',
   'scsi-bus.c',
@@ -11,18 +14,15 @@ scsi_ss.add(when: 'CONFIG_LSI_SCSI_PCI', if_true: files('lsi53c895a.c'))
 scsi_ss.add(when: 'CONFIG_MEGASAS_SCSI_PCI', if_true: files('megasas.c'))
 scsi_ss.add(when: 'CONFIG_MPTSAS_SCSI_PCI', if_true: files('mptsas.c', 'mptconfig.c', 'mptendian.c'))
 scsi_ss.add(when: 'CONFIG_VMW_PVSCSI_SCSI_PCI', if_true: files('vmw_pvscsi.c'))
-system_ss.add_all(when: 'CONFIG_SCSI', if_true: scsi_ss)
 
-specific_scsi_ss = ss.source_set()
-
-virtio_scsi_ss = ss.source_set()
 virtio_scsi_ss.add(files('virtio-scsi.c', 'virtio-scsi-dataplane.c'))
-
 virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI_COMMON', if_true: files('vhost-scsi-common.c'))
 virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi.c'))
 virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi.c'))
+
 specific_scsi_ss.add_all(when: 'CONFIG_VIRTIO_SCSI', if_true: virtio_scsi_ss)
 
 specific_scsi_ss.add(when: 'CONFIG_SPAPR_VSCSI', if_true: files('spapr_vscsi.c'))
 
+system_ss.add_all(when: 'CONFIG_SCSI', if_true: scsi_ss)
 specific_ss.add_all(when: 'CONFIG_SCSI', if_true: specific_scsi_ss)

From 5268f5f5224ed67de63e0b91b05e410a97dbb976 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:38 +0200
Subject: [PATCH 0060/1353] hw/scsi: Rename target-specific source set as
 'specific_virtio_scsi_ss'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Following the SCSI variable named '[specific_]scsi_ss', rename the
target-specific VirtIO/SCSI set prefixed with 'specific_'. This will
help when adding target-agnostic VirtIO/SCSI set in few commits.

No logical change.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230524093744.88442-5-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
---
 hw/scsi/meson.build | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/scsi/meson.build b/hw/scsi/meson.build
index d9b5673c14..43746700be 100644
--- a/hw/scsi/meson.build
+++ b/hw/scsi/meson.build
@@ -1,6 +1,6 @@
 scsi_ss = ss.source_set()
 specific_scsi_ss = ss.source_set()
-virtio_scsi_ss = ss.source_set()
+specific_virtio_scsi_ss = ss.source_set()
 
 scsi_ss.add(files(
   'emulation.c',
@@ -15,12 +15,12 @@ scsi_ss.add(when: 'CONFIG_MEGASAS_SCSI_PCI', if_true: files('megasas.c'))
 scsi_ss.add(when: 'CONFIG_MPTSAS_SCSI_PCI', if_true: files('mptsas.c', 'mptconfig.c', 'mptendian.c'))
 scsi_ss.add(when: 'CONFIG_VMW_PVSCSI_SCSI_PCI', if_true: files('vmw_pvscsi.c'))
 
-virtio_scsi_ss.add(files('virtio-scsi.c', 'virtio-scsi-dataplane.c'))
-virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI_COMMON', if_true: files('vhost-scsi-common.c'))
-virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi.c'))
-virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi.c'))
+specific_virtio_scsi_ss.add(files('virtio-scsi.c', 'virtio-scsi-dataplane.c'))
+specific_virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI_COMMON', if_true: files('vhost-scsi-common.c'))
+specific_virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi.c'))
+specific_virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi.c'))
 
-specific_scsi_ss.add_all(when: 'CONFIG_VIRTIO_SCSI', if_true: virtio_scsi_ss)
+specific_scsi_ss.add_all(when: 'CONFIG_VIRTIO_SCSI', if_true: specific_virtio_scsi_ss)
 
 specific_scsi_ss.add(when: 'CONFIG_SPAPR_VSCSI', if_true: files('spapr_vscsi.c'))
 

From 6df956299a751c1eff03a8ea791a0182a688a7cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:39 +0200
Subject: [PATCH 0061/1353] hw/virtio: Introduce VHOST_VSOCK_COMMON symbol in
 Kconfig
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of adding 'vhost-vsock-common.c' twice (for VHOST_VSOCK
and VHOST_USER_VSOCK), have it depend on VHOST_VSOCK_COMMON,
selected by both symbols.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230524093744.88442-6-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
---
 hw/virtio/Kconfig     | 6 ++++++
 hw/virtio/meson.build | 5 +++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/Kconfig b/hw/virtio/Kconfig
index 89e9e426d8..de7a35429a 100644
--- a/hw/virtio/Kconfig
+++ b/hw/virtio/Kconfig
@@ -56,14 +56,20 @@ config VIRTIO_MEM
     depends on VIRTIO_MEM_SUPPORTED
     select MEM_DEVICE
 
+config VHOST_VSOCK_COMMON
+    bool
+    depends on VIRTIO
+
 config VHOST_VSOCK
     bool
     default y
+    select VHOST_VSOCK_COMMON
     depends on VIRTIO && VHOST_KERNEL
 
 config VHOST_USER_VSOCK
     bool
     default y
+    select VHOST_VSOCK_COMMON
     depends on VIRTIO && VHOST_USER
 
 config VHOST_USER_I2C
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index e83c37fffd..a6ea5beae7 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -23,8 +23,9 @@ specific_virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-bal
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_PMEM', if_true: files('virtio-pmem.c'))
-specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock.c', 'vhost-vsock-common.c'))
-specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_VSOCK', if_true: files('vhost-user-vsock.c', 'vhost-vsock-common.c'))
+specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK_COMMON', if_true: files('vhost-vsock-common.c'))
+specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock.c'))
+specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_VSOCK', if_true: files('vhost-user-vsock.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_RNG', if_true: files('virtio-rng.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_IOMMU', if_true: files('virtio-iommu.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem.c'))

From 21e6435066bd3818969b520b69415ba62a85cd24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:40 +0200
Subject: [PATCH 0062/1353] hw/virtio/virtio-mem: Use qemu_ram_get_fd() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid accessing RAMBlock internals, use the provided
qemu_ram_get_fd() getter to get the file descriptor.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230524093744.88442-7-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/virtio/virtio-mem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 538b695c29..74e63bd47a 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -135,7 +135,7 @@ static bool virtio_mem_has_shared_zeropage(RAMBlock *rb)
      * anonymous RAM. In any other case, reading unplugged *can* populate a
      * fresh page, consuming actual memory.
      */
-    return !qemu_ram_is_shared(rb) && rb->fd < 0 &&
+    return !qemu_ram_is_shared(rb) && qemu_ram_get_fd(rb) < 0 &&
            qemu_ram_pagesize(rb) == qemu_real_host_page_size();
 }
 #endif /* VIRTIO_MEM_HAS_LEGACY_GUESTS */

From a64da64ac671e81f3bae0fbf4e99fe7f8b65b668 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:41 +0200
Subject: [PATCH 0063/1353] hw/virtio/vhost-vsock: Include missing
 'virtio/virtio-bus.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of having "virtio/virtio-bus.h" implicitly included,
explicitly include it, to avoid when rearranging headers:

  hw/virtio/vhost-vsock-common.c: In function ‘vhost_vsock_common_start’:
  hw/virtio/vhost-vsock-common.c:51:5: error: unknown type name ‘VirtioBusClass’; did you mean ‘VirtioDeviceClass’?
     51 |     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
        |     ^~~~~~~~~~~~~~
        |     VirtioDeviceClass
  hw/virtio/vhost-vsock-common.c:51:25: error: implicit declaration of function ‘VIRTIO_BUS_GET_CLASS’; did you mean ‘VIRTIO_DEVICE_CLASS’? [-Werror=implicit-function-declaration]
     51 |     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
        |                         ^~~~~~~~~~~~~~~~~~~~
        |                         VIRTIO_DEVICE_CLASS

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230524093744.88442-8-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
---
 hw/virtio/vhost-vsock-common.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
index d2b5519d5a..e89af9b329 100644
--- a/hw/virtio/vhost-vsock-common.c
+++ b/hw/virtio/vhost-vsock-common.c
@@ -11,6 +11,7 @@
 #include "qemu/osdep.h"
 #include "standard-headers/linux/virtio_vsock.h"
 #include "qapi/error.h"
+#include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-access.h"
 #include "qemu/error-report.h"
 #include "hw/qdev-properties.h"

From e414ed2c47da70381a66846cf9353f7612daa4b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:42 +0200
Subject: [PATCH 0064/1353] hw/virtio/virtio-iommu: Use target-agnostic
 qemu_target_page_mask()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to have virtio-iommu.c become target-agnostic,
we need to avoid using TARGET_PAGE_MASK. Get it with the
qemu_target_page_mask() helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20230524093744.88442-9-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/virtio/virtio-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 1cd258135d..85905a9e3d 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qemu/iov.h"
+#include "exec/target_page.h"
 #include "hw/qdev-properties.h"
 #include "hw/virtio/virtio.h"
 #include "sysemu/kvm.h"
@@ -1164,7 +1165,7 @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)
      * in vfio realize
      */
     s->config.bypass = s->boot_bypass;
-    s->config.page_size_mask = TARGET_PAGE_MASK;
+    s->config.page_size_mask = qemu_target_page_mask();
     s->config.input_range.end = UINT64_MAX;
     s->config.domain_range.end = UINT32_MAX;
     s->config.probe_size = VIOMMU_PROBE_SIZE;

From 4ee4667ded5841ff9278d4e4a4c765a3220023bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:43 +0200
Subject: [PATCH 0065/1353] hw/virtio: Remove unnecessary 'virtio-access.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

None of these files use the VirtIO Load/Store API declared
by "hw/virtio/virtio-access.h". This header probably crept
in via copy/pasting, remove it.

Note, "virtio-access.h" is target-specific, so any file
including it also become tainted as target-specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230524093744.88442-10-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/block/dataplane/virtio-blk.c | 1 -
 hw/s390x/virtio-ccw.c           | 1 -
 hw/scsi/vhost-scsi.c            | 1 -
 hw/scsi/vhost-user-scsi.c       | 1 -
 hw/scsi/virtio-scsi-dataplane.c | 1 -
 hw/virtio/vdpa-dev.c            | 1 -
 hw/virtio/vhost-vdpa.c          | 1 -
 hw/virtio/vhost-vsock-common.c  | 1 -
 hw/virtio/vhost.c               | 1 -
 hw/virtio/virtio-crypto.c       | 1 -
 hw/virtio/virtio-iommu.c        | 1 -
 hw/virtio/virtio-mem.c          | 1 -
 12 files changed, 12 deletions(-)

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index b90456c08c..c227b39408 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -19,7 +19,6 @@
 #include "qemu/main-loop.h"
 #include "qemu/thread.h"
 #include "qemu/error-report.h"
-#include "hw/virtio/virtio-access.h"
 #include "hw/virtio/virtio-blk.h"
 #include "virtio-blk.h"
 #include "block/aio.h"
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index f44de1a8c1..17c548b84f 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -22,7 +22,6 @@
 #include "qemu/error-report.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "hw/virtio/virtio-access.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/s390x/adapter.h"
 #include "hw/s390x/s390_flic.h"
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 6a0fd0dfb1..443f67daa4 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -26,7 +26,6 @@
 #include "hw/virtio/vhost.h"
 #include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 #include "hw/fw-path-provider.h"
 #include "hw/qdev-properties.h"
 #include "qemu/cutils.h"
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index b7a71a802c..ee99b19e7a 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -26,7 +26,6 @@
 #include "hw/virtio/vhost-backend.h"
 #include "hw/virtio/vhost-user-scsi.h"
 #include "hw/virtio/virtio.h"
-#include "hw/virtio/virtio-access.h"
 #include "chardev/char-fe.h"
 #include "sysemu/sysemu.h"
 
diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
index d55de4c8ca..1e684beebe 100644
--- a/hw/scsi/virtio-scsi-dataplane.c
+++ b/hw/scsi/virtio-scsi-dataplane.c
@@ -19,7 +19,6 @@
 #include "hw/scsi/scsi.h"
 #include "scsi/constants.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 
 /* Context: QEMU global mutex held */
 void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp)
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index 01b41eb0f1..e08e830006 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -25,7 +25,6 @@
 #include "hw/virtio/vhost.h"
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 #include "hw/virtio/vdpa-dev.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/runstate.h"
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index b3094e8a8b..3c575a9a6e 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -26,7 +26,6 @@
 #include "cpu.h"
 #include "trace.h"
 #include "qapi/error.h"
-#include "hw/virtio/virtio-access.h"
 
 /*
  * Return one past the end of the end of section. Be careful with uint64_t
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
index e89af9b329..321262f6b3 100644
--- a/hw/virtio/vhost-vsock-common.c
+++ b/hw/virtio/vhost-vsock-common.c
@@ -12,7 +12,6 @@
 #include "standard-headers/linux/virtio_vsock.h"
 #include "qapi/error.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 #include "qemu/error-report.h"
 #include "hw/qdev-properties.h"
 #include "hw/virtio/vhost.h"
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 23da579ce2..7f3c727777 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -23,7 +23,6 @@
 #include "qemu/log.h"
 #include "standard-headers/linux/vhost_types.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 #include "migration/blocker.h"
 #include "migration/qemu-file-types.h"
 #include "sysemu/dma.h"
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index c729a1f79e..a6d7e1e8ec 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -21,7 +21,6 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-crypto.h"
 #include "hw/qdev-properties.h"
-#include "hw/virtio/virtio-access.h"
 #include "standard-headers/linux/virtio_ids.h"
 #include "sysemu/cryptodev-vhost.h"
 
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 85905a9e3d..1bbad23f4a 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -32,7 +32,6 @@
 #include "standard-headers/linux/virtio_ids.h"
 
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/pci/pci_bus.h"
 #include "hw/pci/pci.h"
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 74e63bd47a..12ea58d5ad 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -20,7 +20,6 @@
 #include "sysemu/reset.h"
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/virtio/virtio-access.h"
 #include "hw/virtio/virtio-mem.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"

From 7a0903f7ea8ac7e5b3191c9a2cfd1751b153f48c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 May 2023 11:37:44 +0200
Subject: [PATCH 0066/1353] hw/virtio: Build various target-agnostic objects
 just once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit remove the unnecessary "virtio-access.h"
header. These files no longer have target-specific dependency.
Move them to the generic 'softmmu_ss' source set.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230524093744.88442-11-philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/block/dataplane/meson.build |  2 +-
 hw/scsi/meson.build            | 10 +++++++---
 hw/virtio/meson.build          | 11 ++++++-----
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/hw/block/dataplane/meson.build b/hw/block/dataplane/meson.build
index 78d7ac1a11..025b3b061b 100644
--- a/hw/block/dataplane/meson.build
+++ b/hw/block/dataplane/meson.build
@@ -1,2 +1,2 @@
-specific_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c'))
+system_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c'))
 specific_ss.add(when: 'CONFIG_XEN_BUS', if_true: files('xen-block.c'))
diff --git a/hw/scsi/meson.build b/hw/scsi/meson.build
index 43746700be..bb7d289aa0 100644
--- a/hw/scsi/meson.build
+++ b/hw/scsi/meson.build
@@ -1,5 +1,6 @@
 scsi_ss = ss.source_set()
 specific_scsi_ss = ss.source_set()
+virtio_scsi_ss = ss.source_set()
 specific_virtio_scsi_ss = ss.source_set()
 
 scsi_ss.add(files(
@@ -15,12 +16,15 @@ scsi_ss.add(when: 'CONFIG_MEGASAS_SCSI_PCI', if_true: files('megasas.c'))
 scsi_ss.add(when: 'CONFIG_MPTSAS_SCSI_PCI', if_true: files('mptsas.c', 'mptconfig.c', 'mptendian.c'))
 scsi_ss.add(when: 'CONFIG_VMW_PVSCSI_SCSI_PCI', if_true: files('vmw_pvscsi.c'))
 
-specific_virtio_scsi_ss.add(files('virtio-scsi.c', 'virtio-scsi-dataplane.c'))
+virtio_scsi_ss.add(files('virtio-scsi-dataplane.c'))
+virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi.c'))
+virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi.c'))
+
+specific_virtio_scsi_ss.add(files('virtio-scsi.c'))
 specific_virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI_COMMON', if_true: files('vhost-scsi-common.c'))
-specific_virtio_scsi_ss.add(when: 'CONFIG_VHOST_SCSI', if_true: files('vhost-scsi.c'))
-specific_virtio_scsi_ss.add(when: 'CONFIG_VHOST_USER_SCSI', if_true: files('vhost-user-scsi.c'))
 
 specific_scsi_ss.add_all(when: 'CONFIG_VIRTIO_SCSI', if_true: specific_virtio_scsi_ss)
+scsi_ss.add_all(when: 'CONFIG_VIRTIO_SCSI', if_true: virtio_scsi_ss)
 
 specific_scsi_ss.add(when: 'CONFIG_SPAPR_VSCSI', if_true: files('spapr_vscsi.c'))
 
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index a6ea5beae7..f32b22f61b 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -2,13 +2,18 @@ softmmu_virtio_ss = ss.source_set()
 softmmu_virtio_ss.add(files('virtio-bus.c'))
 softmmu_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('virtio-pci.c'))
 softmmu_virtio_ss.add(when: 'CONFIG_VIRTIO_MMIO', if_true: files('virtio-mmio.c'))
+softmmu_virtio_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto.c'))
+softmmu_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK_COMMON', if_true: files('vhost-vsock-common.c'))
+softmmu_virtio_ss.add(when: 'CONFIG_VIRTIO_IOMMU', if_true: files('virtio-iommu.c'))
+softmmu_virtio_ss.add(when: 'CONFIG_VHOST_VDPA_DEV', if_true: files('vdpa-dev.c'))
 
 specific_virtio_ss = ss.source_set()
 specific_virtio_ss.add(files('virtio.c'))
 specific_virtio_ss.add(files('virtio-config-io.c', 'virtio-qmp.c'))
 
 if have_vhost
-  specific_virtio_ss.add(files('vhost.c', 'vhost-backend.c', 'vhost-iova-tree.c'))
+  softmmu_virtio_ss.add(files('vhost.c'))
+  specific_virtio_ss.add(files('vhost-backend.c', 'vhost-iova-tree.c'))
   if have_vhost_user
     specific_virtio_ss.add(files('vhost-user.c'))
   endif
@@ -20,20 +25,16 @@ else
 endif
 
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-balloon.c'))
-specific_virtio_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('virtio-crypto.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_PMEM', if_true: files('virtio-pmem.c'))
-specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK_COMMON', if_true: files('vhost-vsock-common.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_VSOCK', if_true: files('vhost-user-vsock.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_RNG', if_true: files('virtio-rng.c'))
-specific_virtio_ss.add(when: 'CONFIG_VIRTIO_IOMMU', if_true: files('virtio-iommu.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user-i2c.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
 specific_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'], if_true: files('vhost-user-gpio-pci.c'))
-specific_virtio_ss.add(when: 'CONFIG_VHOST_VDPA_DEV', if_true: files('vdpa-dev.c'))
 
 virtio_pci_ss = ss.source_set()
 virtio_pci_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock-pci.c'))

From 1e3ffb34f764f8ac4c003b2b2e6a775b2b073a16 Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Mon, 29 May 2023 17:13:32 +0530
Subject: [PATCH 0067/1353] vhost: release memory_listener object in error path

vhost_dev_start function does not release memory_listener object
in case of an error. This may crash the guest when vhost is unable
to set memory table:

  stack trace of thread 125653:
  Program terminated with signal SIGSEGV, Segmentation fault
  #0  memory_listener_register (qemu-kvm + 0x6cda0f)
  #1  vhost_dev_start (qemu-kvm + 0x699301)
  #2  vhost_net_start (qemu-kvm + 0x45b03f)
  #3  virtio_net_set_status (qemu-kvm + 0x665672)
  #4  qmp_set_link (qemu-kvm + 0x548fd5)
  #5  net_vhost_user_event (qemu-kvm + 0x552c45)
  #6  tcp_chr_connect (qemu-kvm + 0x88d473)
  #7  tcp_chr_new_client (qemu-kvm + 0x88cf83)
  #8  tcp_chr_accept (qemu-kvm + 0x88b429)
  #9  qio_net_listener_channel_func (qemu-kvm + 0x7ac07c)
  #10 g_main_context_dispatch (libglib-2.0.so.0 + 0x54e2f)

Release memory_listener objects in the error path.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Message-Id: <20230529114333.31686-2-ppandit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Fixes: c471ad0e9b ("vhost_net: device IOTLB support")
Cc: qemu-stable@nongnu.org
Acked-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 7f3c727777..7e1f556994 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -2003,6 +2003,9 @@ fail_vq:
     }
 
 fail_mem:
+    if (vhost_dev_has_iommu(hdev)) {
+        memory_listener_unregister(&hdev->iommu_listener);
+    }
 fail_features:
     vdev->vhost_started = false;
     hdev->started = false;

From 77ece20ba04582d94c345ac0107ddff2fd18d27a Mon Sep 17 00:00:00 2001
From: Prasad Pandit <pjp@fedoraproject.org>
Date: Mon, 29 May 2023 17:13:33 +0530
Subject: [PATCH 0068/1353] vhost: release virtqueue objects in error path

vhost_dev_start function does not release virtqueue objects when
event_notifier_init() function fails. Release virtqueue objects
and log a message about function failure.

Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Message-Id: <20230529114333.31686-3-ppandit@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: f9a09ca3ea ("vhost: add support for configure interrupt")
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: qemu-stable@nongnu.org
Acked-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/vhost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 7e1f556994..fb7abc9769 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1941,7 +1941,8 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
     r = event_notifier_init(
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier, 0);
     if (r < 0) {
-        return r;
+        VHOST_OPS_DEBUG(r, "event_notifier_init failed");
+        goto fail_vq;
     }
     event_notifier_test_and_clear(
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);

From 8eb85fb5ac60bfb6ee4c729cc087078d490670c4 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Mon, 22 May 2023 23:17:40 +0300
Subject: [PATCH 0069/1353] pci: ROM preallocation for incoming migration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On incoming migration we have the following sequence to load option
ROM:

1. On device realize we do normal load ROM from the file

2. Than, on incoming migration we rewrite ROM from the incoming RAM
   block. If sizes mismatch we fail, like this:

    Size mismatch: 0000:00:03.0/virtio-net-pci.rom: 0x40000 != 0x80000: Invalid argument

This is not ideal when we migrate to updated distribution: we have to
keep old ROM files in new distribution and be careful around romfile
property to load correct ROM file. Which is loaded actually just to
allocate the ROM with correct length.

Note, that romsize property doesn't really help: if we try to specify
it when default romfile is larger, it fails with something like:

    romfile "efi-virtio.rom" (160768 bytes) is too large for ROM size 65536

Let's just ignore ROM file when romsize is specified and we are in
incoming migration state. In other words, we need only to preallocate
ROM of specified size, local ROM file is unrelated.

This way:

If romsize was specified on source, we just use same commandline as on
source, and migration will work independently of local ROM files on
target.

If romsize was not specified on source (and we have mismatching local
ROM file on target host), we have to specify romsize on target to match
source romsize. romfile parameter may be kept same as on source or may
be dropped, the file is not loaded anyway.

As a bonus we avoid extra reading from ROM file on target.

Note: when we don't have romsize parameter on source command line and
need it for target, it may be calculated as aligned up to power of two
size of ROM file on source (if we know, which file is it) or,
alternatively it may be retrieved from source QEMU by QMP qom-get
command, like

  { "execute": "qom-get",
    "arguments": {
      "path": "/machine/peripheral/CARD_ID/virtio-net-pci.rom[0]",
      "property": "size" } }

Note: we have extra initialization of size variable to zero in
      pci_add_option_rom to avoid false-positive
      "error: ‘size’ may be used uninitialized"

Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20230522201740.88960-2-vsementsov@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c | 79 ++++++++++++++++++++++++++++++----------------------
 1 file changed, 46 insertions(+), 33 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index bf38905b7d..e2eb4c3b4a 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -36,6 +36,7 @@
 #include "migration/vmstate.h"
 #include "net/net.h"
 #include "sysemu/numa.h"
+#include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
 #include "hw/loader.h"
 #include "qemu/error-report.h"
@@ -2308,12 +2309,18 @@ static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, uint32_t size)
 static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
                                Error **errp)
 {
-    int64_t size;
+    int64_t size = 0;
     g_autofree char *path = NULL;
-    void *ptr;
     char name[32];
     const VMStateDescription *vmsd;
 
+    /*
+     * In case of incoming migration ROM will come with migration stream, no
+     * reason to load the file.  Neither we want to fail if local ROM file
+     * mismatches with specified romsize.
+     */
+    bool load_file = !runstate_check(RUN_STATE_INMIGRATE);
+
     if (!pdev->romfile || !strlen(pdev->romfile)) {
         return;
     }
@@ -2343,32 +2350,35 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
         return;
     }
 
-    path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
-    if (path == NULL) {
-        path = g_strdup(pdev->romfile);
-    }
+    if (load_file || pdev->romsize == -1) {
+        path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
+        if (path == NULL) {
+            path = g_strdup(pdev->romfile);
+        }
 
-    size = get_image_size(path);
-    if (size < 0) {
-        error_setg(errp, "failed to find romfile \"%s\"", pdev->romfile);
-        return;
-    } else if (size == 0) {
-        error_setg(errp, "romfile \"%s\" is empty", pdev->romfile);
-        return;
-    } else if (size > 2 * GiB) {
-        error_setg(errp, "romfile \"%s\" too large (size cannot exceed 2 GiB)",
-                   pdev->romfile);
-        return;
-    }
-    if (pdev->romsize != -1) {
-        if (size > pdev->romsize) {
-            error_setg(errp, "romfile \"%s\" (%u bytes) "
-                       "is too large for ROM size %u",
-                       pdev->romfile, (uint32_t)size, pdev->romsize);
+        size = get_image_size(path);
+        if (size < 0) {
+            error_setg(errp, "failed to find romfile \"%s\"", pdev->romfile);
+            return;
+        } else if (size == 0) {
+            error_setg(errp, "romfile \"%s\" is empty", pdev->romfile);
+            return;
+        } else if (size > 2 * GiB) {
+            error_setg(errp,
+                       "romfile \"%s\" too large (size cannot exceed 2 GiB)",
+                       pdev->romfile);
             return;
         }
-    } else {
-        pdev->romsize = pow2ceil(size);
+        if (pdev->romsize != -1) {
+            if (size > pdev->romsize) {
+                error_setg(errp, "romfile \"%s\" (%u bytes) "
+                           "is too large for ROM size %u",
+                           pdev->romfile, (uint32_t)size, pdev->romsize);
+                return;
+            }
+        } else {
+            pdev->romsize = pow2ceil(size);
+        }
     }
 
     vmsd = qdev_get_vmsd(DEVICE(pdev));
@@ -2379,15 +2389,18 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
     memory_region_init_rom(&pdev->rom, OBJECT(pdev), name, pdev->romsize,
                            &error_fatal);
 
-    ptr = memory_region_get_ram_ptr(&pdev->rom);
-    if (load_image_size(path, ptr, size) < 0) {
-        error_setg(errp, "failed to load romfile \"%s\"", pdev->romfile);
-        return;
-    }
+    if (load_file) {
+        void *ptr = memory_region_get_ram_ptr(&pdev->rom);
 
-    if (is_default_rom) {
-        /* Only the default rom images will be patched (if needed). */
-        pci_patch_ids(pdev, ptr, size);
+        if (load_image_size(path, ptr, size) < 0) {
+            error_setg(errp, "failed to load romfile \"%s\"", pdev->romfile);
+            return;
+        }
+
+        if (is_default_rom) {
+            /* Only the default rom images will be patched (if needed). */
+            pci_patch_ids(pdev, ptr, size);
+        }
     }
 
     pci_register_bar(pdev, PCI_ROM_SLOT, 0, &pdev->rom);

From 25c893037b89ddd4e42927a2a9b524dbbc0c34a3 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 23 May 2023 20:30:36 +0200
Subject: [PATCH 0070/1353] virtio-mem: Simplify bitmap handling and
 virtio_mem_set_block_state()

Let's separate plug and unplug handling to prepare for future changes
and make the code a bit easier to read -- working on block states
(plugged/unplugged) instead of on a bitmap.

Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Gavin Shan <gshan@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230523183036.517957-1-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-mem.c | 112 +++++++++++++++++++++++------------------
 1 file changed, 64 insertions(+), 48 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 12ea58d5ad..ec0ae32589 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -398,33 +398,46 @@ static void virtio_mem_notify_unplug_all(VirtIOMEM *vmem)
     }
 }
 
-static bool virtio_mem_test_bitmap(const VirtIOMEM *vmem, uint64_t start_gpa,
-                                   uint64_t size, bool plugged)
+static bool virtio_mem_is_range_plugged(const VirtIOMEM *vmem,
+                                        uint64_t start_gpa, uint64_t size)
 {
     const unsigned long first_bit = (start_gpa - vmem->addr) / vmem->block_size;
     const unsigned long last_bit = first_bit + (size / vmem->block_size) - 1;
     unsigned long found_bit;
 
     /* We fake a shorter bitmap to avoid searching too far. */
-    if (plugged) {
-        found_bit = find_next_zero_bit(vmem->bitmap, last_bit + 1, first_bit);
-    } else {
-        found_bit = find_next_bit(vmem->bitmap, last_bit + 1, first_bit);
-    }
+    found_bit = find_next_zero_bit(vmem->bitmap, last_bit + 1, first_bit);
     return found_bit > last_bit;
 }
 
-static void virtio_mem_set_bitmap(VirtIOMEM *vmem, uint64_t start_gpa,
-                                  uint64_t size, bool plugged)
+static bool virtio_mem_is_range_unplugged(const VirtIOMEM *vmem,
+                                          uint64_t start_gpa, uint64_t size)
+{
+    const unsigned long first_bit = (start_gpa - vmem->addr) / vmem->block_size;
+    const unsigned long last_bit = first_bit + (size / vmem->block_size) - 1;
+    unsigned long found_bit;
+
+    /* We fake a shorter bitmap to avoid searching too far. */
+    found_bit = find_next_bit(vmem->bitmap, last_bit + 1, first_bit);
+    return found_bit > last_bit;
+}
+
+static void virtio_mem_set_range_plugged(VirtIOMEM *vmem, uint64_t start_gpa,
+                                         uint64_t size)
 {
     const unsigned long bit = (start_gpa - vmem->addr) / vmem->block_size;
     const unsigned long nbits = size / vmem->block_size;
 
-    if (plugged) {
-        bitmap_set(vmem->bitmap, bit, nbits);
-    } else {
-        bitmap_clear(vmem->bitmap, bit, nbits);
-    }
+    bitmap_set(vmem->bitmap, bit, nbits);
+}
+
+static void virtio_mem_set_range_unplugged(VirtIOMEM *vmem, uint64_t start_gpa,
+                                           uint64_t size)
+{
+    const unsigned long bit = (start_gpa - vmem->addr) / vmem->block_size;
+    const unsigned long nbits = size / vmem->block_size;
+
+    bitmap_clear(vmem->bitmap, bit, nbits);
 }
 
 static void virtio_mem_send_response(VirtIOMEM *vmem, VirtQueueElement *elem,
@@ -474,6 +487,7 @@ static int virtio_mem_set_block_state(VirtIOMEM *vmem, uint64_t start_gpa,
 {
     const uint64_t offset = start_gpa - vmem->addr;
     RAMBlock *rb = vmem->memdev->mr.ram_block;
+    int ret = 0;
 
     if (virtio_mem_is_busy()) {
         return -EBUSY;
@@ -484,42 +498,43 @@ static int virtio_mem_set_block_state(VirtIOMEM *vmem, uint64_t start_gpa,
             return -EBUSY;
         }
         virtio_mem_notify_unplug(vmem, offset, size);
-    } else {
-        int ret = 0;
+        virtio_mem_set_range_unplugged(vmem, start_gpa, size);
+        return 0;
+    }
 
-        if (vmem->prealloc) {
-            void *area = memory_region_get_ram_ptr(&vmem->memdev->mr) + offset;
-            int fd = memory_region_get_fd(&vmem->memdev->mr);
-            Error *local_err = NULL;
+    if (vmem->prealloc) {
+        void *area = memory_region_get_ram_ptr(&vmem->memdev->mr) + offset;
+        int fd = memory_region_get_fd(&vmem->memdev->mr);
+        Error *local_err = NULL;
 
-            qemu_prealloc_mem(fd, area, size, 1, NULL, &local_err);
-            if (local_err) {
-                static bool warned;
+        qemu_prealloc_mem(fd, area, size, 1, NULL, &local_err);
+        if (local_err) {
+            static bool warned;
 
-                /*
-                 * Warn only once, we don't want to fill the log with these
-                 * warnings.
-                 */
-                if (!warned) {
-                    warn_report_err(local_err);
-                    warned = true;
-                } else {
-                    error_free(local_err);
-                }
-                ret = -EBUSY;
+            /*
+             * Warn only once, we don't want to fill the log with these
+             * warnings.
+             */
+            if (!warned) {
+                warn_report_err(local_err);
+                warned = true;
+            } else {
+                error_free(local_err);
             }
-        }
-        if (!ret) {
-            ret = virtio_mem_notify_plug(vmem, offset, size);
-        }
-
-        if (ret) {
-            /* Could be preallocation or a notifier populated memory. */
-            ram_block_discard_range(vmem->memdev->mr.ram_block, offset, size);
-            return -EBUSY;
+            ret = -EBUSY;
         }
     }
-    virtio_mem_set_bitmap(vmem, start_gpa, size, plug);
+
+    if (!ret) {
+        ret = virtio_mem_notify_plug(vmem, offset, size);
+    }
+    if (ret) {
+        /* Could be preallocation or a notifier populated memory. */
+        ram_block_discard_range(vmem->memdev->mr.ram_block, offset, size);
+        return -EBUSY;
+    }
+
+    virtio_mem_set_range_plugged(vmem, start_gpa, size);
     return 0;
 }
 
@@ -538,7 +553,8 @@ static int virtio_mem_state_change_request(VirtIOMEM *vmem, uint64_t gpa,
     }
 
     /* test if really all blocks are in the opposite state */
-    if (!virtio_mem_test_bitmap(vmem, gpa, size, !plug)) {
+    if ((plug && !virtio_mem_is_range_unplugged(vmem, gpa, size)) ||
+        (!plug && !virtio_mem_is_range_plugged(vmem, gpa, size))) {
         return VIRTIO_MEM_RESP_ERROR;
     }
 
@@ -651,9 +667,9 @@ static void virtio_mem_state_request(VirtIOMEM *vmem, VirtQueueElement *elem,
         return;
     }
 
-    if (virtio_mem_test_bitmap(vmem, gpa, size, true)) {
+    if (virtio_mem_is_range_plugged(vmem, gpa, size)) {
         resp.u.state.state = cpu_to_le16(VIRTIO_MEM_STATE_PLUGGED);
-    } else if (virtio_mem_test_bitmap(vmem, gpa, size, false)) {
+    } else if (virtio_mem_is_range_unplugged(vmem, gpa, size)) {
         resp.u.state.state = cpu_to_le16(VIRTIO_MEM_STATE_UNPLUGGED);
     } else {
         resp.u.state.state = cpu_to_le16(VIRTIO_MEM_STATE_MIXED);
@@ -1372,7 +1388,7 @@ static bool virtio_mem_rdm_is_populated(const RamDiscardManager *rdm,
         return false;
     }
 
-    return virtio_mem_test_bitmap(vmem, start_gpa, end_gpa - start_gpa, true);
+    return virtio_mem_is_range_plugged(vmem, start_gpa, end_gpa - start_gpa);
 }
 
 struct VirtIOMEMReplayData {

From 0f2bb0bf38b04e9dfdc32ce5c762dd317f5a4c5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 26 May 2023 17:31:42 +0200
Subject: [PATCH 0071/1353] vdpa: return errno in vhost_vdpa_get_vring_group
 error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need to tell in the caller, as some errors are expected in a normal
workflow.  In particular, parent drivers in recent kernels with
VHOST_BACKEND_F_IOTLB_ASID may not support vring groups.  In that case,
-ENOTSUP is returned.

This is the case of vp_vdpa in Linux 6.2.

Next patches in this series will use that information to know if it must
abort or not.  Also, next patches return properly an errp instead of
printing with error_report.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230526153143.470745-2-eperezma@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 37cdc84562..3fb833fe76 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -362,6 +362,14 @@ static NetClientInfo net_vhost_vdpa_info = {
         .check_peer_type = vhost_vdpa_check_peer_type,
 };
 
+/**
+ * Get vring virtqueue group
+ *
+ * @device_fd  vdpa device fd
+ * @vq_index   Virtqueue index
+ *
+ * Return -errno in case of error, or vq group if success.
+ */
 static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index)
 {
     struct vhost_vring_state state = {
@@ -370,6 +378,7 @@ static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index)
     int r = ioctl(device_fd, VHOST_VDPA_GET_VRING_GROUP, &state);
 
     if (unlikely(r < 0)) {
+        r = -errno;
         error_report("Cannot get VQ %u group: %s", vq_index,
                      g_strerror(errno));
         return r;

From 152128d646973ed298d41dafd7a5bccff43336c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 26 May 2023 17:31:43 +0200
Subject: [PATCH 0072/1353] vdpa: move CVQ isolation check to
 net_init_vhost_vdpa
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Evaluating it at start time instead of initialization time may make the
guest capable of dynamically adding or removing migration blockers.

Also, moving to initialization reduces the number of ioctls in the
migration, reducing failure possibilities.

As a drawback we need to check for CVQ isolation twice: one time with no
MQ negotiated and another one acking it, as long as the device supports
it.  This is because Vring ASID / group management is based on vq
indexes, but we don't know the index of CVQ before negotiating MQ.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230526153143.470745-3-eperezma@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-vdpa.c | 157 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 113 insertions(+), 44 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 3fb833fe76..46778d5313 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -43,6 +43,10 @@ typedef struct VhostVDPAState {
 
     /* The device always have SVQ enabled */
     bool always_svq;
+
+    /* The device can isolate CVQ in its own ASID */
+    bool cvq_isolated;
+
     bool started;
 } VhostVDPAState;
 
@@ -362,15 +366,8 @@ static NetClientInfo net_vhost_vdpa_info = {
         .check_peer_type = vhost_vdpa_check_peer_type,
 };
 
-/**
- * Get vring virtqueue group
- *
- * @device_fd  vdpa device fd
- * @vq_index   Virtqueue index
- *
- * Return -errno in case of error, or vq group if success.
- */
-static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index)
+static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index,
+                                          Error **errp)
 {
     struct vhost_vring_state state = {
         .index = vq_index,
@@ -379,8 +376,7 @@ static int64_t vhost_vdpa_get_vring_group(int device_fd, unsigned vq_index)
 
     if (unlikely(r < 0)) {
         r = -errno;
-        error_report("Cannot get VQ %u group: %s", vq_index,
-                     g_strerror(errno));
+        error_setg_errno(errp, errno, "Cannot get VQ %u group", vq_index);
         return r;
     }
 
@@ -480,9 +476,9 @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
 {
     VhostVDPAState *s, *s0;
     struct vhost_vdpa *v;
-    uint64_t backend_features;
     int64_t cvq_group;
-    int cvq_index, r;
+    int r;
+    Error *err = NULL;
 
     assert(nc->info->type == NET_CLIENT_DRIVER_VHOST_VDPA);
 
@@ -502,40 +498,21 @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
     /*
      * If we early return in these cases SVQ will not be enabled. The migration
      * will be blocked as long as vhost-vdpa backends will not offer _F_LOG.
-     *
-     * Calling VHOST_GET_BACKEND_FEATURES as they are not available in v->dev
-     * yet.
      */
-    r = ioctl(v->device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
-    if (unlikely(r < 0)) {
-        error_report("Cannot get vdpa backend_features: %s(%d)",
-            g_strerror(errno), errno);
-        return -1;
-    }
-    if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID)) ||
-        !vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
+    if (!vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
         return 0;
     }
 
-    /*
-     * Check if all the virtqueues of the virtio device are in a different vq
-     * than the last vq. VQ group of last group passed in cvq_group.
-     */
-    cvq_index = v->dev->vq_index_end - 1;
-    cvq_group = vhost_vdpa_get_vring_group(v->device_fd, cvq_index);
-    if (unlikely(cvq_group < 0)) {
-        return cvq_group;
+    if (!s->cvq_isolated) {
+        return 0;
     }
-    for (int i = 0; i < cvq_index; ++i) {
-        int64_t group = vhost_vdpa_get_vring_group(v->device_fd, i);
 
-        if (unlikely(group < 0)) {
-            return group;
-        }
-
-        if (group == cvq_group) {
-            return 0;
-        }
+    cvq_group = vhost_vdpa_get_vring_group(v->device_fd,
+                                           v->dev->vq_index_end - 1,
+                                           &err);
+    if (unlikely(cvq_group < 0)) {
+        error_report_err(err);
+        return cvq_group;
     }
 
     r = vhost_vdpa_set_address_space_id(v, cvq_group, VHOST_VDPA_NET_CVQ_ASID);
@@ -799,6 +776,87 @@ static const VhostShadowVirtqueueOps vhost_vdpa_net_svq_ops = {
     .avail_handler = vhost_vdpa_net_handle_ctrl_avail,
 };
 
+/**
+ * Probe if CVQ is isolated
+ *
+ * @device_fd         The vdpa device fd
+ * @features          Features offered by the device.
+ * @cvq_index         The control vq pair index
+ *
+ * Returns <0 in case of failure, 0 if false and 1 if true.
+ */
+static int vhost_vdpa_probe_cvq_isolation(int device_fd, uint64_t features,
+                                          int cvq_index, Error **errp)
+{
+    uint64_t backend_features;
+    int64_t cvq_group;
+    uint8_t status = VIRTIO_CONFIG_S_ACKNOWLEDGE |
+                     VIRTIO_CONFIG_S_DRIVER |
+                     VIRTIO_CONFIG_S_FEATURES_OK;
+    int r;
+
+    ERRP_GUARD();
+
+    r = ioctl(device_fd, VHOST_GET_BACKEND_FEATURES, &backend_features);
+    if (unlikely(r < 0)) {
+        error_setg_errno(errp, errno, "Cannot get vdpa backend_features");
+        return r;
+    }
+
+    if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID))) {
+        return 0;
+    }
+
+    r = ioctl(device_fd, VHOST_SET_FEATURES, &features);
+    if (unlikely(r)) {
+        error_setg_errno(errp, errno, "Cannot set features");
+    }
+
+    r = ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
+    if (unlikely(r)) {
+        error_setg_errno(errp, -r, "Cannot set device features");
+        goto out;
+    }
+
+    cvq_group = vhost_vdpa_get_vring_group(device_fd, cvq_index, errp);
+    if (unlikely(cvq_group < 0)) {
+        if (cvq_group != -ENOTSUP) {
+            r = cvq_group;
+            goto out;
+        }
+
+        /*
+         * The kernel report VHOST_BACKEND_F_IOTLB_ASID if the vdpa frontend
+         * support ASID even if the parent driver does not.  The CVQ cannot be
+         * isolated in this case.
+         */
+        error_free(*errp);
+        *errp = NULL;
+        r = 0;
+        goto out;
+    }
+
+    for (int i = 0; i < cvq_index; ++i) {
+        int64_t group = vhost_vdpa_get_vring_group(device_fd, i, errp);
+        if (unlikely(group < 0)) {
+            r = group;
+            goto out;
+        }
+
+        if (group == (int64_t)cvq_group) {
+            r = 0;
+            goto out;
+        }
+    }
+
+    r = 1;
+
+out:
+    status = 0;
+    ioctl(device_fd, VHOST_VDPA_SET_STATUS, &status);
+    return r;
+}
+
 static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
                                        const char *device,
                                        const char *name,
@@ -808,16 +866,26 @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
                                        bool is_datapath,
                                        bool svq,
                                        struct vhost_vdpa_iova_range iova_range,
-                                       uint64_t features)
+                                       uint64_t features,
+                                       Error **errp)
 {
     NetClientState *nc = NULL;
     VhostVDPAState *s;
     int ret = 0;
     assert(name);
+    int cvq_isolated;
+
     if (is_datapath) {
         nc = qemu_new_net_client(&net_vhost_vdpa_info, peer, device,
                                  name);
     } else {
+        cvq_isolated = vhost_vdpa_probe_cvq_isolation(vdpa_device_fd, features,
+                                                      queue_pair_index * 2,
+                                                      errp);
+        if (unlikely(cvq_isolated < 0)) {
+            return NULL;
+        }
+
         nc = qemu_new_net_control_client(&net_vhost_vdpa_cvq_info, peer,
                                          device, name);
     }
@@ -844,6 +912,7 @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
 
         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
         s->vhost_vdpa.shadow_vq_ops_opaque = s;
+        s->cvq_isolated = cvq_isolated;
 
         /*
          * TODO: We cannot migrate devices with CVQ as there is no way to set
@@ -972,7 +1041,7 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
     for (i = 0; i < queue_pairs; i++) {
         ncs[i] = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
                                      vdpa_device_fd, i, 2, true, opts->x_svq,
-                                     iova_range, features);
+                                     iova_range, features, errp);
         if (!ncs[i])
             goto err;
     }
@@ -980,7 +1049,7 @@ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
     if (has_cvq) {
         nc = net_vhost_vdpa_init(peer, TYPE_VHOST_VDPA, name,
                                  vdpa_device_fd, i, 1, false,
-                                 opts->x_svq, iova_range, features);
+                                 opts->x_svq, iova_range, features, errp);
         if (!nc)
             goto err;
     }

From a1f85cff902f3260d85c74ec11d4c4b182cead80 Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@bytedance.com>
Date: Wed, 3 May 2023 19:54:37 +0800
Subject: [PATCH 0073/1353] cryptodev: fix memory leak during stats query

object_get_canonical_path already returns newly allocated memory, this
means no additional g_strdup required. Remove g_strdup to avoid memory
leak.

Fixes: Coverity CID 1508074
Fixes: f2b901098 ("cryptodev: Support query-stats QMP command")
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20230503115437.262469-1-pizhenwei@bytedance.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 backends/cryptodev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backends/cryptodev.c b/backends/cryptodev.c
index 94ca393cee..7d29517843 100644
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -522,7 +522,7 @@ static int cryptodev_backend_stats_query(Object *obj, void *data)
 
     entry = g_new0(StatsResult, 1);
     entry->provider = STATS_PROVIDER_CRYPTODEV;
-    entry->qom_path = g_strdup(object_get_canonical_path(obj));
+    entry->qom_path = object_get_canonical_path(obj);
     entry->stats = stats_list;
     QAPI_LIST_PREPEND(*stats_results, entry);
 

From b9f335c24705883391ea52035c9b2229e6992eee Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:43 +0100
Subject: [PATCH 0074/1353] target/arm: Add isar_feature_aa64_rme
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the missing field for ID_AA64PFR0, and the predicate.
Disable it if EL3 is forced off by the board or command-line.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 4 ++++
 target/arm/cpu.h | 6 ++++++
 2 files changed, 10 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 353fc48567..842e1b53ee 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1989,6 +1989,10 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
                                            ID_AA64PFR0, EL3, 0);
+
+        /* Disable the realm management extension, which requires EL3. */
+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
+                                           ID_AA64PFR0, RME, 0);
     }
 
     if (!cpu->has_el2) {
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index af0119addf..c84ec2752f 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2195,6 +2195,7 @@ FIELD(ID_AA64PFR0, SEL2, 36, 4)
 FIELD(ID_AA64PFR0, MPAM, 40, 4)
 FIELD(ID_AA64PFR0, AMU, 44, 4)
 FIELD(ID_AA64PFR0, DIT, 48, 4)
+FIELD(ID_AA64PFR0, RME, 52, 4)
 FIELD(ID_AA64PFR0, CSV2, 56, 4)
 FIELD(ID_AA64PFR0, CSV3, 60, 4)
 
@@ -3814,6 +3815,11 @@ static inline bool isar_feature_aa64_sel2(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SEL2) != 0;
 }
 
+static inline bool isar_feature_aa64_rme(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RME) != 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;

From aa3cc42c016116615b80359ab4dd8a934339aec5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:43 +0100
Subject: [PATCH 0075/1353] target/arm: Update SCR and HCR for RME

Define the missing SCR and HCR bits, allow SCR_NSE and {SCR,HCR}_GPF
to be set, and invalidate TLBs when NSE changes.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  5 +++--
 target/arm/helper.c | 10 ++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c84ec2752f..318d1033b8 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1655,7 +1655,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TERR      (1ULL << 36)
 #define HCR_TEA       (1ULL << 37)
 #define HCR_MIOCNCE   (1ULL << 38)
-/* RES0 bit 39 */
+#define HCR_TME       (1ULL << 39)
 #define HCR_APK       (1ULL << 40)
 #define HCR_API       (1ULL << 41)
 #define HCR_NV        (1ULL << 42)
@@ -1664,7 +1664,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_NV2       (1ULL << 45)
 #define HCR_FWB       (1ULL << 46)
 #define HCR_FIEN      (1ULL << 47)
-/* RES0 bit 48 */
+#define HCR_GPF       (1ULL << 48)
 #define HCR_TID4      (1ULL << 49)
 #define HCR_TICAB     (1ULL << 50)
 #define HCR_AMVOFFEN  (1ULL << 51)
@@ -1729,6 +1729,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_TRNDR             (1ULL << 40)
 #define SCR_ENTP2             (1ULL << 41)
 #define SCR_GPF               (1ULL << 48)
+#define SCR_NSE               (1ULL << 62)
 
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index d4bee43bd0..d2f0d9226e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1874,6 +1874,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_fgt, cpu)) {
             valid_mask |= SCR_FGTEN;
         }
+        if (cpu_isar_feature(aa64_rme, cpu)) {
+            valid_mask |= SCR_NSE | SCR_GPF;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -1903,10 +1906,10 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     env->cp15.scr_el3 = value;
 
     /*
-     * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then
+     * If SCR_EL3.{NS,NSE} changes, i.e. change of security state,
      * we must invalidate all TLBs below EL3.
      */
-    if (changed & SCR_NS) {
+    if (changed & (SCR_NS | SCR_NSE)) {
         tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
                                            ARMMMUIdxBit_E20_0 |
                                            ARMMMUIdxBit_E10_1 |
@@ -5654,6 +5657,9 @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
         if (cpu_isar_feature(aa64_fwb, cpu)) {
             valid_mask |= HCR_FWB;
         }
+        if (cpu_isar_feature(aa64_rme, cpu)) {
+            valid_mask |= HCR_GPF;
+        }
     }
 
     if (cpu_isar_feature(any_evt, cpu)) {

From 87bfbfe7e595372251037c28223919659a294fd3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:43 +0100
Subject: [PATCH 0076/1353] target/arm: SCR_EL3.NS may be RES1

With RME, SEL2 must also be present to support secure state.
The NS bit is RES1 if SEL2 is not present.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index d2f0d9226e..9132d4de6a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1855,6 +1855,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         }
         if (cpu_isar_feature(aa64_sel2, cpu)) {
             valid_mask |= SCR_EEL2;
+        } else if (cpu_isar_feature(aa64_rme, cpu)) {
+            /* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */
+            value |= SCR_NS;
         }
         if (cpu_isar_feature(aa64_mte, cpu)) {
             valid_mask |= SCR_ATA;

From ef1febe758c893dfc2164c5324bbbe5ba4916413 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:44 +0100
Subject: [PATCH 0077/1353] target/arm: Add RME cpregs

This includes GPCCR, GPTBR, MFAR, the TLB flush insns PAALL, PAALLOS,
RPALOS, RPAOS, and the cache flush insns CIPAPA and CIGDPAPA.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 19 ++++++++++
 target/arm/helper.c | 84 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 318d1033b8..c9c87b515d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -541,6 +541,11 @@ typedef struct CPUArchState {
         uint64_t fgt_read[2]; /* HFGRTR, HDFGRTR */
         uint64_t fgt_write[2]; /* HFGWTR, HDFGWTR */
         uint64_t fgt_exec[1]; /* HFGITR */
+
+        /* RME registers */
+        uint64_t gpccr_el3;
+        uint64_t gptbr_el3;
+        uint64_t mfar_el3;
     } cp15;
 
     struct {
@@ -1055,6 +1060,7 @@ struct ArchCPU {
     uint64_t reset_cbar;
     uint32_t reset_auxcr;
     bool reset_hivecs;
+    uint8_t reset_l0gptsz;
 
     /*
      * Intermediate values used during property parsing.
@@ -2341,6 +2347,19 @@ FIELD(MVFR1, SIMDFMAC, 28, 4)
 FIELD(MVFR2, SIMDMISC, 0, 4)
 FIELD(MVFR2, FPMISC, 4, 4)
 
+FIELD(GPCCR, PPS, 0, 3)
+FIELD(GPCCR, IRGN, 8, 2)
+FIELD(GPCCR, ORGN, 10, 2)
+FIELD(GPCCR, SH, 12, 2)
+FIELD(GPCCR, PGS, 14, 2)
+FIELD(GPCCR, GPC, 16, 1)
+FIELD(GPCCR, GPCP, 17, 1)
+FIELD(GPCCR, L0GPTSZ, 20, 4)
+
+FIELD(MFAR, FPA, 12, 40)
+FIELD(MFAR, NSE, 62, 1)
+FIELD(MFAR, NS, 63, 1)
+
 QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
 
 /* If adding a feature bit which corresponds to a Linux ELF
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 9132d4de6a..006447dde8 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6910,6 +6910,83 @@ static const ARMCPRegInfo sme_reginfo[] = {
       .access = PL2_RW, .accessfn = access_esm,
       .type = ARM_CP_CONST, .resetvalue = 0 },
 };
+
+static void tlbi_aa64_paall_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  uint64_t value)
+{
+    CPUState *cs = env_cpu(env);
+
+    tlb_flush(cs);
+}
+
+static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    /* L0GPTSZ is RO; other bits not mentioned are RES0. */
+    uint64_t rw_mask = R_GPCCR_PPS_MASK | R_GPCCR_IRGN_MASK |
+        R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK |
+        R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK;
+
+    env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask);
+}
+
+static void gpccr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    env->cp15.gpccr_el3 = FIELD_DP64(0, GPCCR, L0GPTSZ,
+                                     env_archcpu(env)->reset_l0gptsz);
+}
+
+static void tlbi_aa64_paallos_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                    uint64_t value)
+{
+    CPUState *cs = env_cpu(env);
+
+    tlb_flush_all_cpus_synced(cs);
+}
+
+static const ARMCPRegInfo rme_reginfo[] = {
+    { .name = "GPCCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 6,
+      .access = PL3_RW, .writefn = gpccr_write, .resetfn = gpccr_reset,
+      .fieldoffset = offsetof(CPUARMState, cp15.gpccr_el3) },
+    { .name = "GPTBR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 4,
+      .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.gptbr_el3) },
+    { .name = "MFAR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 5,
+      .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mfar_el3) },
+    { .name = "TLBI_PAALL", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 4,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paall_write },
+    { .name = "TLBI_PAALLOS", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 4,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paallos_write },
+    /*
+     * QEMU does not have a way to invalidate by physical address, thus
+     * invalidating a range of physical addresses is accomplished by
+     * flushing all tlb entries in the outer sharable domain,
+     * just like PAALLOS.
+     */
+    { .name = "TLBI_RPALOS", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 7,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paallos_write },
+    { .name = "TLBI_RPAOS", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 3,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paallos_write },
+    { .name = "DC_CIPAPA", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 1,
+      .access = PL3_W, .type = ARM_CP_NOP },
+};
+
+static const ARMCPRegInfo rme_mte_reginfo[] = {
+    { .name = "DC_CIGDPAPA", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 5,
+      .access = PL3_W, .type = ARM_CP_NOP },
+};
 #endif /* TARGET_AARCH64 */
 
 static void define_pmu_regs(ARMCPU *cpu)
@@ -9130,6 +9207,13 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_fgt, cpu)) {
         define_arm_cp_regs(cpu, fgt_reginfo);
     }
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        define_arm_cp_regs(cpu, rme_reginfo);
+        if (cpu_isar_feature(aa64_mte, cpu)) {
+            define_arm_cp_regs(cpu, rme_mte_reginfo);
+        }
+    }
 #endif
 
     if (cpu_isar_feature(any_predinv, cpu)) {

From 5d28ac0cf7a5cd91f03da658edd6e934c5a431bd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:44 +0100
Subject: [PATCH 0078/1353] target/arm: Introduce ARMSecuritySpace

Introduce both the enumeration and functions to retrieve
the current state, and state outside of EL3.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 89 ++++++++++++++++++++++++++++++++++-----------
 target/arm/helper.c | 60 ++++++++++++++++++++++++++++++
 2 files changed, 127 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c9c87b515d..125e53b83f 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2414,25 +2414,53 @@ static inline int arm_feature(CPUARMState *env, int feature)
 
 void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
 
-#if !defined(CONFIG_USER_ONLY)
 /*
+ * ARM v9 security states.
+ * The ordering of the enumeration corresponds to the low 2 bits
+ * of the GPI value, and (except for Root) the concat of NSE:NS.
+ */
+
+typedef enum ARMSecuritySpace {
+    ARMSS_Secure     = 0,
+    ARMSS_NonSecure  = 1,
+    ARMSS_Root       = 2,
+    ARMSS_Realm      = 3,
+} ARMSecuritySpace;
+
+/* Return true if @space is secure, in the pre-v9 sense. */
+static inline bool arm_space_is_secure(ARMSecuritySpace space)
+{
+    return space == ARMSS_Secure || space == ARMSS_Root;
+}
+
+/* Return the ARMSecuritySpace for @secure, assuming !RME or EL[0-2]. */
+static inline ARMSecuritySpace arm_secure_to_space(bool secure)
+{
+    return secure ? ARMSS_Secure : ARMSS_NonSecure;
+}
+
+#if !defined(CONFIG_USER_ONLY)
+/**
+ * arm_security_space_below_el3:
+ * @env: cpu context
+ *
+ * Return the security space of exception levels below EL3, following
+ * an exception return to those levels.  Unlike arm_security_space,
+ * this doesn't care about the current EL.
+ */
+ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env);
+
+/**
+ * arm_is_secure_below_el3:
+ * @env: cpu context
+ *
  * Return true if exception levels below EL3 are in secure state,
- * or would be following an exception return to that level.
- * Unlike arm_is_secure() (which is always a question about the
- * _current_ state of the CPU) this doesn't care about the current
- * EL or mode.
+ * or would be following an exception return to those levels.
  */
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
-    assert(!arm_feature(env, ARM_FEATURE_M));
-    if (arm_feature(env, ARM_FEATURE_EL3)) {
-        return !(env->cp15.scr_el3 & SCR_NS);
-    } else {
-        /* If EL3 is not supported then the secure state is implementation
-         * defined, in which case QEMU defaults to non-secure.
-         */
-        return false;
-    }
+    ARMSecuritySpace ss = arm_security_space_below_el3(env);
+    return ss == ARMSS_Secure;
 }
 
 /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
@@ -2452,16 +2480,23 @@ static inline bool arm_is_el3_or_mon(CPUARMState *env)
     return false;
 }
 
-/* Return true if the processor is in secure state */
+/**
+ * arm_security_space:
+ * @env: cpu context
+ *
+ * Return the current security space of the cpu.
+ */
+ARMSecuritySpace arm_security_space(CPUARMState *env);
+
+/**
+ * arm_is_secure:
+ * @env: cpu context
+ *
+ * Return true if the processor is in secure state.
+ */
 static inline bool arm_is_secure(CPUARMState *env)
 {
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        return env->v7m.secure;
-    }
-    if (arm_is_el3_or_mon(env)) {
-        return true;
-    }
-    return arm_is_secure_below_el3(env);
+    return arm_space_is_secure(arm_security_space(env));
 }
 
 /*
@@ -2480,11 +2515,21 @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
 }
 
 #else
+static inline ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
+{
+    return ARMSS_NonSecure;
+}
+
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
     return false;
 }
 
+static inline ARMSecuritySpace arm_security_space(CPUARMState *env)
+{
+    return ARMSS_NonSecure;
+}
+
 static inline bool arm_is_secure(CPUARMState *env)
 {
     return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 006447dde8..f68923d73b 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12136,3 +12136,63 @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
     }
 }
 #endif
+
+#ifndef CONFIG_USER_ONLY
+ARMSecuritySpace arm_security_space(CPUARMState *env)
+{
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return arm_secure_to_space(env->v7m.secure);
+    }
+
+    /*
+     * If EL3 is not supported then the secure state is implementation
+     * defined, in which case QEMU defaults to non-secure.
+     */
+    if (!arm_feature(env, ARM_FEATURE_EL3)) {
+        return ARMSS_NonSecure;
+    }
+
+    /* Check for AArch64 EL3 or AArch32 Mon. */
+    if (is_a64(env)) {
+        if (extract32(env->pstate, 2, 2) == 3) {
+            if (cpu_isar_feature(aa64_rme, env_archcpu(env))) {
+                return ARMSS_Root;
+            } else {
+                return ARMSS_Secure;
+            }
+        }
+    } else {
+        if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
+            return ARMSS_Secure;
+        }
+    }
+
+    return arm_security_space_below_el3(env);
+}
+
+ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
+{
+    assert(!arm_feature(env, ARM_FEATURE_M));
+
+    /*
+     * If EL3 is not supported then the secure state is implementation
+     * defined, in which case QEMU defaults to non-secure.
+     */
+    if (!arm_feature(env, ARM_FEATURE_EL3)) {
+        return ARMSS_NonSecure;
+    }
+
+    /*
+     * Note NSE cannot be set without RME, and NSE & !NS is Reserved.
+     * Ignoring NSE when !NS retains consistency without having to
+     * modify other predicates.
+     */
+    if (!(env->cp15.scr_el3 & SCR_NS)) {
+        return ARMSS_Secure;
+    } else if (env->cp15.scr_el3 & SCR_NSE) {
+        return ARMSS_Realm;
+    } else {
+        return ARMSS_NonSecure;
+    }
+}
+#endif /* !CONFIG_USER_ONLY */

From 4d6e1c6495f483e8c48526189c4c6984b44365fc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:44 +0100
Subject: [PATCH 0079/1353] include/exec/memattrs: Add two bits of space to
 MemTxAttrs

We will need 2 bits to represent ARMSecurityState.

Do not attempt to replace or widen secure, even though it
logically overlaps the new field -- there are uses within
e.g. hw/block/pflash_cfi01.c, which don't know anything
specific about ARM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/memattrs.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
index 9fb98bc1ef..d04170aa27 100644
--- a/include/exec/memattrs.h
+++ b/include/exec/memattrs.h
@@ -29,10 +29,17 @@ typedef struct MemTxAttrs {
      * "didn't specify" if necessary.
      */
     unsigned int unspecified:1;
-    /* ARM/AMBA: TrustZone Secure access
+    /*
+     * ARM/AMBA: TrustZone Secure access
      * x86: System Management Mode access
      */
     unsigned int secure:1;
+    /*
+     * ARM: ArmSecuritySpace.  This partially overlaps secure, but it is
+     * easier to have both fields to assist code that does not understand
+     * ARMv9 RME, or no specific knowledge of ARM at all (e.g. pflash).
+     */
+    unsigned int space:2;
     /* Memory access is usermode (unprivileged) */
     unsigned int user:1;
     /*

From d38fa9670d14331fc766dfc15b2bc6628d0149d0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:45 +0100
Subject: [PATCH 0080/1353] target/arm: Adjust the order of Phys and Stage2
 ARMMMUIdx

It will be helpful to have ARMMMUIdx_Phys_* to be in the same
relative order as ARMSecuritySpace enumerators. This requires
the adjustment to the nstable check. While there, check for being
in secure state rather than rely on clearing the low bit making
no change to non-secure state.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 12 ++++++------
 target/arm/ptw.c | 12 +++++-------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 125e53b83f..b338619775 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2860,18 +2860,18 @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
     ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
 
-    /* TLBs with 1-1 mapping to the physical address spaces. */
-    ARMMMUIdx_Phys_NS   = 8 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_S    = 9 | ARM_MMU_IDX_A,
-
     /*
      * Used for second stage of an S12 page table walk, or for descriptor
      * loads during first stage of an S1 page table walk.  Note that both
      * are in use simultaneously for SecureEL2: the security state for
      * the S2 ptw is selected by the NS bit from the S1 ptw.
      */
-    ARMMMUIdx_Stage2    = 10 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Stage2_S  = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2_S  = 8 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2    = 9 | ARM_MMU_IDX_A,
+
+    /* TLBs with 1-1 mapping to the physical address spaces. */
+    ARMMMUIdx_Phys_S    = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_NS   = 11 | ARM_MMU_IDX_A,
 
     /*
      * These are not allocated TLBs and are used only for AT system
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 37bcb17a9e..3f3517f70b 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1449,16 +1449,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr |= (address >> (stride * (4 - level))) & indexmask;
     descaddr &= ~7ULL;
     nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
-    if (nstable) {
+    if (nstable && ptw->in_secure) {
         /*
          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-         * Assert that the non-secure idx are even, and relative order.
+         * Assert the relative order of the secure/non-secure indexes.
          */
-        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-        ptw->in_ptw_idx &= ~1;
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
+        ptw->in_ptw_idx += 1;
         ptw->in_secure = false;
     }
     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {

From bb5cc2c860c4d359e107ede2464dfe5cd297f16b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:45 +0100
Subject: [PATCH 0081/1353] target/arm: Introduce ARMMMUIdx_Phys_{Realm,Root}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With FEAT_RME, there are four physical address spaces.
For now, just define the symbols, and mention them in
the same spots as the other Phys indexes in ptw.c.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 23 +++++++++++++++++++++--
 target/arm/ptw.c | 10 ++++++++--
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index b338619775..590216b855 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2870,8 +2870,10 @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_Stage2    = 9 | ARM_MMU_IDX_A,
 
     /* TLBs with 1-1 mapping to the physical address spaces. */
-    ARMMMUIdx_Phys_S    = 10 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_NS   = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_S     = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_NS    = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Root  = 12 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Realm = 13 | ARM_MMU_IDX_A,
 
     /*
      * These are not allocated TLBs and are used only for AT system
@@ -2935,6 +2937,23 @@ typedef enum ARMASIdx {
     ARMASIdx_TagS = 3,
 } ARMASIdx;
 
+static inline ARMMMUIdx arm_space_to_phys(ARMSecuritySpace space)
+{
+    /* Assert the relative order of the physical mmu indexes. */
+    QEMU_BUILD_BUG_ON(ARMSS_Secure != 0);
+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS != ARMMMUIdx_Phys_S + ARMSS_NonSecure);
+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_Root != ARMMMUIdx_Phys_S + ARMSS_Root);
+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_Realm != ARMMMUIdx_Phys_S + ARMSS_Realm);
+
+    return ARMMMUIdx_Phys_S + space;
+}
+
+static inline ARMSecuritySpace arm_phys_to_space(ARMMMUIdx idx)
+{
+    assert(idx >= ARMMMUIdx_Phys_S && idx <= ARMMMUIdx_Phys_Realm);
+    return idx - ARMMMUIdx_Phys_S;
+}
+
 static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
 {
     /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 3f3517f70b..a742bc1826 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -215,8 +215,10 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     case ARMMMUIdx_E3:
         break;
 
-    case ARMMMUIdx_Phys_NS:
     case ARMMMUIdx_Phys_S:
+    case ARMMMUIdx_Phys_NS:
+    case ARMMMUIdx_Phys_Root:
+    case ARMMMUIdx_Phys_Realm:
         /* No translation for physical address spaces. */
         return true;
 
@@ -2672,8 +2674,10 @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
     switch (mmu_idx) {
     case ARMMMUIdx_Stage2:
     case ARMMMUIdx_Stage2_S:
-    case ARMMMUIdx_Phys_NS:
     case ARMMMUIdx_Phys_S:
+    case ARMMMUIdx_Phys_NS:
+    case ARMMMUIdx_Phys_Root:
+    case ARMMMUIdx_Phys_Realm:
         break;
 
     default:
@@ -2861,6 +2865,8 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     switch (mmu_idx) {
     case ARMMMUIdx_Phys_S:
     case ARMMMUIdx_Phys_NS:
+    case ARMMMUIdx_Phys_Root:
+    case ARMMMUIdx_Phys_Realm:
         /* Checking Phys early avoids special casing later vs regime_el. */
         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
                                       is_secure, result, fi);

From 86a438b462406c7944be1fea8b027604e85253ff Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:45 +0100
Subject: [PATCH 0082/1353] target/arm: Remove __attribute__((nonnull)) from
 ptw.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was added in 7e98e21c098 as part of a reorg in which
one of the argument had been legally NULL, and this caught
actual instances.  Now that the reorg is complete, this
serves little purpose.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index a742bc1826..f7cbb984f9 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -34,15 +34,13 @@ typedef struct S1Translate {
 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                uint64_t address,
                                MMUAccessType access_type, bool s1_is_el0,
-                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
-    __attribute__((nonnull));
+                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
 
 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
                                       target_ulong address,
                                       MMUAccessType access_type,
                                       GetPhysAddrResult *result,
-                                      ARMMMUFaultInfo *fi)
-    __attribute__((nonnull));
+                                      ARMMMUFaultInfo *fi);
 
 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
 static const uint8_t pamax_map[] = {

From 90c6629393e0d7121c84033b3aa886fd0662a1c7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:45 +0100
Subject: [PATCH 0083/1353] target/arm: Pipe ARMSecuritySpace through ptw.c

Add input and output space members to S1Translate.  Set and adjust
them in S1_ptw_translate, and the various points at which we drop
secure state.  Initialize the space in get_phys_addr; for now leave
get_phys_addr_with_secure considering only secure vs non-secure spaces.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 86 +++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 71 insertions(+), 15 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index f7cbb984f9..e1e7c9a3d2 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -21,11 +21,13 @@
 typedef struct S1Translate {
     ARMMMUIdx in_mmu_idx;
     ARMMMUIdx in_ptw_idx;
+    ARMSecuritySpace in_space;
     bool in_secure;
     bool in_debug;
     bool out_secure;
     bool out_rw;
     bool out_be;
+    ARMSecuritySpace out_space;
     hwaddr out_virt;
     hwaddr out_phys;
     void *out_host;
@@ -249,6 +251,7 @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
+    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -266,6 +269,9 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                 .in_mmu_idx = s2_mmu_idx,
                 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
                 .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
+                .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
+                             : space == ARMSS_Realm ? ARMSS_Realm
+                             : ARMSS_NonSecure),
                 .in_debug = true,
             };
             GetPhysAddrResult s2 = { };
@@ -277,11 +283,15 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             ptw->out_phys = s2.f.phys_addr;
             pte_attrs = s2.cacheattrs.attrs;
             ptw->out_secure = s2.f.attrs.secure;
+            ptw->out_space = s2.f.attrs.space;
         } else {
             /* Regime is physical. */
             ptw->out_phys = addr;
             pte_attrs = 0;
             ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
+            ptw->out_space = (s2_mmu_idx == ARMMMUIdx_Phys_S ? ARMSS_Secure
+                              : space == ARMSS_Realm ? ARMSS_Realm
+                              : ARMSS_NonSecure);
         }
         ptw->out_host = NULL;
         ptw->out_rw = false;
@@ -303,6 +313,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         ptw->out_rw = full->prot & PAGE_WRITE;
         pte_attrs = full->pte_attrs;
         ptw->out_secure = full->attrs.secure;
+        ptw->out_space = full->attrs.space;
 #else
         g_assert_not_reached();
 #endif
@@ -355,7 +366,10 @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
         }
     } else {
         /* Page tables are in MMIO. */
-        MemTxAttrs attrs = { .secure = ptw->out_secure };
+        MemTxAttrs attrs = {
+            .secure = ptw->out_secure,
+            .space = ptw->out_space,
+        };
         AddressSpace *as = arm_addressspace(cs, attrs);
         MemTxResult result = MEMTX_OK;
 
@@ -398,7 +412,10 @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
 #endif
     } else {
         /* Page tables are in MMIO. */
-        MemTxAttrs attrs = { .secure = ptw->out_secure };
+        MemTxAttrs attrs = {
+            .secure = ptw->out_secure,
+            .space = ptw->out_space,
+        };
         AddressSpace *as = arm_addressspace(cs, attrs);
         MemTxResult result = MEMTX_OK;
 
@@ -909,6 +926,7 @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
          * regime, because the attribute will already be non-secure.
          */
         result->f.attrs.secure = false;
+        result->f.attrs.space = ARMSS_NonSecure;
     }
     result->f.phys_addr = phys_addr;
     return false;
@@ -1616,6 +1634,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * regime, because the attribute will already be non-secure.
          */
         result->f.attrs.secure = false;
+        result->f.attrs.space = ARMSS_NonSecure;
     }
 
     if (regime_is_stage2(mmu_idx)) {
@@ -2400,6 +2419,7 @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
              */
             if (sattrs.ns) {
                 result->f.attrs.secure = false;
+                result->f.attrs.space = ARMSS_NonSecure;
             } else if (!secure) {
                 /*
                  * NS access to S memory must fault.
@@ -2750,6 +2770,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     bool is_secure = ptw->in_secure;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
+    ARMSecuritySpace ipa_space;
     bool is_el0;
     uint64_t hcr;
 
@@ -2762,10 +2783,12 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
 
     ipa = result->f.phys_addr;
     ipa_secure = result->f.attrs.secure;
+    ipa_space = result->f.attrs.space;
 
     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
     ptw->in_secure = ipa_secure;
+    ptw->in_space = ipa_space;
     ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
 
     /*
@@ -2854,11 +2877,12 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     ARMMMUIdx s1_mmu_idx;
 
     /*
-     * The page table entries may downgrade secure to non-secure, but
-     * cannot upgrade an non-secure translation regime's attributes
-     * to secure.
+     * The page table entries may downgrade Secure to NonSecure, but
+     * cannot upgrade a NonSecure translation regime's attributes
+     * to Secure or Realm.
      */
     result->f.attrs.secure = is_secure;
+    result->f.attrs.space = ptw->in_space;
 
     switch (mmu_idx) {
     case ARMMMUIdx_Phys_S:
@@ -2910,7 +2934,7 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
 
     default:
         /* Single stage uses physical for ptw. */
-        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
+        ptw->in_ptw_idx = arm_space_to_phys(ptw->in_space);
         break;
     }
 
@@ -2985,6 +3009,7 @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_secure = is_secure,
+        .in_space = arm_secure_to_space(is_secure),
     };
     return get_phys_addr_with_struct(env, &ptw, address, access_type,
                                      result, fi);
@@ -2994,7 +3019,10 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 {
-    bool is_secure;
+    S1Translate ptw = {
+        .in_mmu_idx = mmu_idx,
+    };
+    ARMSecuritySpace ss;
 
     switch (mmu_idx) {
     case ARMMMUIdx_E10_0:
@@ -3007,30 +3035,55 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
     case ARMMMUIdx_E2:
-        is_secure = arm_is_secure_below_el3(env);
+        ss = arm_security_space_below_el3(env);
         break;
     case ARMMMUIdx_Stage2:
+        /*
+         * For Secure EL2, we need this index to be NonSecure;
+         * otherwise this will already be NonSecure or Realm.
+         */
+        ss = arm_security_space_below_el3(env);
+        if (ss == ARMSS_Secure) {
+            ss = ARMSS_NonSecure;
+        }
+        break;
     case ARMMMUIdx_Phys_NS:
     case ARMMMUIdx_MPrivNegPri:
     case ARMMMUIdx_MUserNegPri:
     case ARMMMUIdx_MPriv:
     case ARMMMUIdx_MUser:
-        is_secure = false;
+        ss = ARMSS_NonSecure;
         break;
-    case ARMMMUIdx_E3:
     case ARMMMUIdx_Stage2_S:
     case ARMMMUIdx_Phys_S:
     case ARMMMUIdx_MSPrivNegPri:
     case ARMMMUIdx_MSUserNegPri:
     case ARMMMUIdx_MSPriv:
     case ARMMMUIdx_MSUser:
-        is_secure = true;
+        ss = ARMSS_Secure;
+        break;
+    case ARMMMUIdx_E3:
+        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+            cpu_isar_feature(aa64_rme, env_archcpu(env))) {
+            ss = ARMSS_Root;
+        } else {
+            ss = ARMSS_Secure;
+        }
+        break;
+    case ARMMMUIdx_Phys_Root:
+        ss = ARMSS_Root;
+        break;
+    case ARMMMUIdx_Phys_Realm:
+        ss = ARMSS_Realm;
         break;
     default:
         g_assert_not_reached();
     }
-    return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
-                                     is_secure, result, fi);
+
+    ptw.in_space = ss;
+    ptw.in_secure = arm_space_is_secure(ss);
+    return get_phys_addr_with_struct(env, &ptw, address, access_type,
+                                     result, fi);
 }
 
 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
@@ -3038,9 +3091,12 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+    ARMSecuritySpace ss = arm_security_space(env);
     S1Translate ptw = {
-        .in_mmu_idx = arm_mmu_idx(env),
-        .in_secure = arm_is_secure(env),
+        .in_mmu_idx = mmu_idx,
+        .in_space = ss,
+        .in_secure = arm_space_is_secure(ss),
         .in_debug = true,
     };
     GetPhysAddrResult res = {};

From 26d19945944b4878fa84667487a5c4fe38df960a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:46 +0100
Subject: [PATCH 0084/1353] target/arm: NSTable is RES0 for the RME EL3 regime

Test in_space instead of in_secure so that we don't
switch out of Root space.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index e1e7c9a3d2..ea0ad56f13 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1275,7 +1275,6 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 {
     ARMCPU *cpu = env_archcpu(env);
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    bool is_secure = ptw->in_secure;
     int32_t level;
     ARMVAParameters param;
     uint64_t ttbr;
@@ -1291,7 +1290,6 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     uint64_t descriptor, new_descriptor;
-    bool nstable;
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
@@ -1453,21 +1451,21 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         descaddrmask = MAKE_64BIT_MASK(0, 40);
     }
     descaddrmask &= ~indexmask_grainsize;
-
-    /*
-     * Secure stage 1 accesses start with the page table in secure memory and
-     * can be downgraded to non-secure at any step. Non-secure accesses
-     * remain non-secure. We implement this by just ORing in the NSTable/NS
-     * bits at each step.
-     * Stage 2 never gets this kind of downgrade.
-     */
-    tableattrs = is_secure ? 0 : (1 << 4);
+    tableattrs = 0;
 
  next_level:
     descaddr |= (address >> (stride * (4 - level))) & indexmask;
     descaddr &= ~7ULL;
-    nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
-    if (nstable && ptw->in_secure) {
+
+    /*
+     * Process the NSTable bit from the previous level.  This changes
+     * the table address space and the output space from Secure to
+     * NonSecure.  With RME, the EL3 translation regime does not change
+     * from Root to NonSecure.
+     */
+    if (ptw->in_space == ARMSS_Secure
+        && !regime_is_stage2(mmu_idx)
+        && extract32(tableattrs, 4, 1)) {
         /*
          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
          * Assert the relative order of the secure/non-secure indexes.
@@ -1476,7 +1474,9 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
         ptw->in_ptw_idx += 1;
         ptw->in_secure = false;
+        ptw->in_space = ARMSS_NonSecure;
     }
+
     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
         goto do_fault;
     }
@@ -1579,7 +1579,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      */
     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
     if (!regime_is_stage2(mmu_idx)) {
-        attrs |= nstable << 5; /* NS */
+        attrs |= !ptw->in_secure << 5; /* NS */
         if (!param.hpd) {
             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
             /*

From 2f1ff4e7b9f30cc73e32bcb8e85fbe80a8925db1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:46 +0100
Subject: [PATCH 0085/1353] target/arm: Handle Block and Page bits for security
 space

With Realm security state, bit 55 of a block or page descriptor during
the stage2 walk becomes the NS bit; during the stage1 walk the bit 5
NS bit is RES0.  With Root security state, bit 11 of the block or page
descriptor during the stage1 walk becomes the NSE bit.

Rather than collecting an NS bit and applying it later, compute the
output pa space from the input pa space and unconditionally assign.
This means that we no longer need to adjust the output space earlier
for the NSTable bit.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 89 +++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 73 insertions(+), 16 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index ea0ad56f13..bbae432861 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -990,12 +990,14 @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
  * @mmu_idx: MMU index indicating required translation regime
  * @is_aa64: TRUE if AArch64
  * @ap:      The 2-bit simple AP (AP[2:1])
- * @ns:      NS (non-secure) bit
  * @xn:      XN (execute-never) bit
  * @pxn:     PXN (privileged execute-never) bit
+ * @in_pa:   The original input pa space
+ * @out_pa:  The output pa space, modified by NSTable, NS, and NSE
  */
 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-                      int ap, int ns, int xn, int pxn)
+                      int ap, int xn, int pxn,
+                      ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
 {
     ARMCPU *cpu = env_archcpu(env);
     bool is_user = regime_is_user(env, mmu_idx);
@@ -1028,7 +1030,8 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         }
     }
 
-    if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
+    if (out_pa == ARMSS_NonSecure && in_pa == ARMSS_Secure &&
+        (env->cp15.scr_el3 & SCR_SIF)) {
         return prot_rw;
     }
 
@@ -1285,11 +1288,12 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     int32_t stride;
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    int ap, ns, xn, pxn;
+    int ap, xn, pxn;
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     uint64_t descriptor, new_descriptor;
+    ARMSecuritySpace out_space;
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
@@ -1592,15 +1596,75 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     }
 
     ap = extract32(attrs, 6, 2);
+    out_space = ptw->in_space;
     if (regime_is_stage2(mmu_idx)) {
-        ns = mmu_idx == ARMMMUIdx_Stage2;
+        /*
+         * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
+         * The bit remains ignored for other security states.
+         */
+        if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
+            out_space = ARMSS_NonSecure;
+        }
         xn = extract64(attrs, 53, 2);
         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
-        ns = extract32(attrs, 5, 1);
+        int nse, ns = extract32(attrs, 5, 1);
+        switch (out_space) {
+        case ARMSS_Root:
+            /*
+             * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
+             * R_XTYPW: NSE and NS together select the output pa space.
+             */
+            nse = extract32(attrs, 11, 1);
+            out_space = (nse << 1) | ns;
+            if (out_space == ARMSS_Secure &&
+                !cpu_isar_feature(aa64_sel2, cpu)) {
+                out_space = ARMSS_NonSecure;
+            }
+            break;
+        case ARMSS_Secure:
+            if (ns) {
+                out_space = ARMSS_NonSecure;
+            }
+            break;
+        case ARMSS_Realm:
+            switch (mmu_idx) {
+            case ARMMMUIdx_Stage1_E0:
+            case ARMMMUIdx_Stage1_E1:
+            case ARMMMUIdx_Stage1_E1_PAN:
+                /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
+                break;
+            case ARMMMUIdx_E2:
+            case ARMMMUIdx_E20_0:
+            case ARMMMUIdx_E20_2:
+            case ARMMMUIdx_E20_2_PAN:
+                /*
+                 * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
+                 * NS changes the output to non-secure space.
+                 */
+                if (ns) {
+                    out_space = ARMSS_NonSecure;
+                }
+                break;
+            default:
+                g_assert_not_reached();
+            }
+            break;
+        case ARMSS_NonSecure:
+            /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
+            break;
+        default:
+            g_assert_not_reached();
+        }
         xn = extract64(attrs, 54, 1);
         pxn = extract64(attrs, 53, 1);
-        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
+
+        /*
+         * Note that we modified ptw->in_space earlier for NSTable, but
+         * result->f.attrs retains a copy of the original security space.
+         */
+        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, xn, pxn,
+                                    result->f.attrs.space, out_space);
     }
 
     if (!(result->f.prot & (1 << access_type))) {
@@ -1627,15 +1691,8 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         }
     }
 
-    if (ns) {
-        /*
-         * The NS bit will (as required by the architecture) have no effect if
-         * the CPU doesn't support TZ or this is a non-secure translation
-         * regime, because the attribute will already be non-secure.
-         */
-        result->f.attrs.secure = false;
-        result->f.attrs.space = ARMSS_NonSecure;
-    }
+    result->f.attrs.space = out_space;
+    result->f.attrs.secure = arm_space_is_secure(out_space);
 
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;

From 4a7d7702cdfa776567535e55bdfb0a25f9c73d6f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:46 +0100
Subject: [PATCH 0086/1353] target/arm: Handle no-execute for Realm and Root
 regimes

While Root and Realm may read and write data from other spaces,
neither may execute from other pa spaces.

This happens for Stage1 EL3, EL2, EL2&0, and Stage2 EL1&0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 52 ++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index bbae432861..45271d666b 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -943,7 +943,7 @@ do_fault:
  * @xn:      XN (execute-never) bits
  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
  */
-static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
+static int get_S2prot_noexecute(int s2ap)
 {
     int prot = 0;
 
@@ -953,6 +953,12 @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
     if (s2ap & 2) {
         prot |= PAGE_WRITE;
     }
+    return prot;
+}
+
+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
+{
+    int prot = get_S2prot_noexecute(s2ap);
 
     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
         switch (xn) {
@@ -1030,9 +1036,39 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         }
     }
 
-    if (out_pa == ARMSS_NonSecure && in_pa == ARMSS_Secure &&
-        (env->cp15.scr_el3 & SCR_SIF)) {
-        return prot_rw;
+    if (in_pa != out_pa) {
+        switch (in_pa) {
+        case ARMSS_Root:
+            /*
+             * R_ZWRVD: permission fault for insn fetched from non-Root,
+             * I_WWBFB: SIF has no effect in EL3.
+             */
+            return prot_rw;
+        case ARMSS_Realm:
+            /*
+             * R_PKTDS: permission fault for insn fetched from non-Realm,
+             * for Realm EL2 or EL2&0.  The corresponding fault for EL1&0
+             * happens during any stage2 translation.
+             */
+            switch (mmu_idx) {
+            case ARMMMUIdx_E2:
+            case ARMMMUIdx_E20_0:
+            case ARMMMUIdx_E20_2:
+            case ARMMMUIdx_E20_2_PAN:
+                return prot_rw;
+            default:
+                break;
+            }
+            break;
+        case ARMSS_Secure:
+            if (env->cp15.scr_el3 & SCR_SIF) {
+                return prot_rw;
+            }
+            break;
+        default:
+            /* Input NonSecure must have output NonSecure. */
+            g_assert_not_reached();
+        }
     }
 
     /* TODO have_wxn should be replaced with
@@ -1601,12 +1637,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         /*
          * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
          * The bit remains ignored for other security states.
+         * R_YMCSL: Executing an insn fetched from non-Realm causes
+         * a stage2 permission fault.
          */
         if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
             out_space = ARMSS_NonSecure;
+            result->f.prot = get_S2prot_noexecute(ap);
+        } else {
+            xn = extract64(attrs, 53, 2);
+            result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
         }
-        xn = extract64(attrs, 53, 2);
-        result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
         int nse, ns = extract32(attrs, 5, 1);
         switch (out_space) {

From fe4a5472ccd62a6d10fa4b4f518a5dc707e62efd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:47 +0100
Subject: [PATCH 0087/1353] target/arm: Use get_phys_addr_with_struct in
 S1_ptw_translate

Do not provide a fast-path for physical addresses,
as those will need to be validated for GPC.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 44 +++++++++++++++++---------------------------
 1 file changed, 17 insertions(+), 27 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 45271d666b..6d5e4855a3 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -264,37 +264,27 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
-        if (regime_is_stage2(s2_mmu_idx)) {
-            S1Translate s2ptw = {
-                .in_mmu_idx = s2_mmu_idx,
-                .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-                .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-                .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                             : space == ARMSS_Realm ? ARMSS_Realm
-                             : ARMSS_NonSecure),
-                .in_debug = true,
-            };
-            GetPhysAddrResult s2 = { };
+        S1Translate s2ptw = {
+            .in_mmu_idx = s2_mmu_idx,
+            .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
+            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
+            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
+                         : space == ARMSS_Realm ? ARMSS_Realm
+                         : ARMSS_NonSecure),
+            .in_debug = true,
+        };
+        GetPhysAddrResult s2 = { };
 
-            if (get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
-                                   false, &s2, fi)) {
-                goto fail;
-            }
-            ptw->out_phys = s2.f.phys_addr;
-            pte_attrs = s2.cacheattrs.attrs;
-            ptw->out_secure = s2.f.attrs.secure;
-            ptw->out_space = s2.f.attrs.space;
-        } else {
-            /* Regime is physical. */
-            ptw->out_phys = addr;
-            pte_attrs = 0;
-            ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
-            ptw->out_space = (s2_mmu_idx == ARMMMUIdx_Phys_S ? ARMSS_Secure
-                              : space == ARMSS_Realm ? ARMSS_Realm
-                              : ARMSS_NonSecure);
+        if (get_phys_addr_with_struct(env, &s2ptw, addr,
+                                      MMU_DATA_LOAD, &s2, fi)) {
+            goto fail;
         }
+        ptw->out_phys = s2.f.phys_addr;
+        pte_attrs = s2.cacheattrs.attrs;
         ptw->out_host = NULL;
         ptw->out_rw = false;
+        ptw->out_secure = s2.f.attrs.secure;
+        ptw->out_space = s2.f.attrs.space;
     } else {
 #ifdef CONFIG_TCG
         CPUTLBEntryFull *full;

From 7c19b2d6d9c67910812da976c968500a1d6eb170 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:47 +0100
Subject: [PATCH 0088/1353] target/arm: Move s1_is_el0 into S1Translate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of passing this to get_phys_addr_lpae, stash it
in the S1Translate structure.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 6d5e4855a3..558b4b731b 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -24,6 +24,12 @@ typedef struct S1Translate {
     ARMSecuritySpace in_space;
     bool in_secure;
     bool in_debug;
+    /*
+     * If this is stage 2 of a stage 1+2 page table walk, then this must
+     * be true if stage 1 is an EL0 access; otherwise this is ignored.
+     * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
+     */
+    bool in_s1_is_el0;
     bool out_secure;
     bool out_rw;
     bool out_be;
@@ -34,8 +40,7 @@ typedef struct S1Translate {
 } S1Translate;
 
 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                               uint64_t address,
-                               MMUAccessType access_type, bool s1_is_el0,
+                               uint64_t address, MMUAccessType access_type,
                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
 
 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
@@ -1289,17 +1294,12 @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
  * @ptw: Current and next stage parameters for the walk.
  * @address: virtual address to get physical address for
  * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
- * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
- *             (so this is a stage 2 page table walk),
- *             must be true if this is stage 2 of a stage 1+2
- *             walk for an EL0 access. If @mmu_idx is anything else,
- *             @s1_is_el0 is ignored.
  * @result: set on translation success,
  * @fi: set to fault info if the translation fails
  */
 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                uint64_t address,
-                               MMUAccessType access_type, bool s1_is_el0,
+                               MMUAccessType access_type,
                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 {
     ARMCPU *cpu = env_archcpu(env);
@@ -1635,7 +1635,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             result->f.prot = get_S2prot_noexecute(ap);
         } else {
             xn = extract64(attrs, 53, 2);
-            result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
+            result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
         }
     } else {
         int nse, ns = extract32(attrs, 5, 1);
@@ -2858,7 +2858,6 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
-    bool is_el0;
     uint64_t hcr;
 
     ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
@@ -2872,7 +2871,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     ipa_secure = result->f.attrs.secure;
     ipa_space = result->f.attrs.space;
 
-    is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
+    ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
     ptw->in_secure = ipa_secure;
     ptw->in_space = ipa_space;
@@ -2891,8 +2890,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
         ret = get_phys_addr_pmsav8(env, ipa, access_type,
                                    ptw->in_mmu_idx, is_secure, result, fi);
     } else {
-        ret = get_phys_addr_lpae(env, ptw, ipa, access_type,
-                                 is_el0, result, fi);
+        ret = get_phys_addr_lpae(env, ptw, ipa, access_type, result, fi);
     }
     fi->s2addr = ipa;
 
@@ -3078,8 +3076,7 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     }
 
     if (regime_using_lpae_format(env, mmu_idx)) {
-        return get_phys_addr_lpae(env, ptw, address, access_type, false,
-                                  result, fi);
+        return get_phys_addr_lpae(env, ptw, address, access_type, result, fi);
     } else if (arm_feature(env, ARM_FEATURE_V7) ||
                regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);

From a5c7765202f3afcc1e0bf4ae87a89bffcfb50b33 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:47 +0100
Subject: [PATCH 0089/1353] target/arm: Use get_phys_addr_with_struct for
 stage2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes a bug in which we failed to initialize
the result attributes properly after the memset.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 558b4b731b..7c4526e2da 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -39,10 +39,6 @@ typedef struct S1Translate {
     void *out_host;
 } S1Translate;
 
-static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                               uint64_t address, MMUAccessType access_type,
-                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
-
 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
                                       target_ulong address,
                                       MMUAccessType access_type,
@@ -2886,12 +2882,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     cacheattrs1 = result->cacheattrs;
     memset(result, 0, sizeof(*result));
 
-    if (arm_feature(env, ARM_FEATURE_PMSA)) {
-        ret = get_phys_addr_pmsav8(env, ipa, access_type,
-                                   ptw->in_mmu_idx, is_secure, result, fi);
-    } else {
-        ret = get_phys_addr_lpae(env, ptw, ipa, access_type, result, fi);
-    }
+    ret = get_phys_addr_with_struct(env, ptw, ipa, access_type, result, fi);
     fi->s2addr = ipa;
 
     /* Combine the S1 and S2 perms.  */

From f65a9bc7197a0cc7f4546631e3ad82945a36270f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:47 +0100
Subject: [PATCH 0090/1353] target/arm: Add GPC syndrome

The function takes the fields as filled in by
the Arm ARM pseudocode for TakeGPCException.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index d27d1bc31f..62254d0e51 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -50,6 +50,7 @@ enum arm_exception_class {
     EC_SVEACCESSTRAP          = 0x19,
     EC_ERETTRAP               = 0x1a,
     EC_SMETRAP                = 0x1d,
+    EC_GPC                    = 0x1e,
     EC_INSNABORT              = 0x20,
     EC_INSNABORT_SAME_EL      = 0x21,
     EC_PCALIGNMENT            = 0x22,
@@ -247,6 +248,15 @@ static inline uint32_t syn_bxjtrap(int cv, int cond, int rm)
         (cv << 24) | (cond << 20) | rm;
 }
 
+static inline uint32_t syn_gpc(int s2ptw, int ind, int gpcsc,
+                               int cm, int s1ptw, int wnr, int fsc)
+{
+    /* TODO: FEAT_NV2 adds VNCR */
+    return (EC_GPC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (s2ptw << 21)
+            | (ind << 20) | (gpcsc << 14) | (cm << 8) | (s1ptw << 7)
+            | (wnr << 6) | fsc;
+}
+
 static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
 {
     return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)

From 11b76fda0adcf84055863c42f8f6cebe3eef8ca0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:48 +0100
Subject: [PATCH 0091/1353] target/arm: Implement GPC exceptions

Handle GPC Fault types in arm_deliver_fault, reporting as
either a GPC exception at EL3, or falling through to insn
or data aborts at various exception levels.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 +
 target/arm/helper.c         |  5 ++
 target/arm/internals.h      | 27 +++++++++++
 target/arm/tcg/tlb_helper.c | 96 +++++++++++++++++++++++++++++++++++--
 4 files changed, 126 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 590216b855..11c3850ad9 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -57,6 +57,7 @@
 #define EXCP_UNALIGNED      22   /* v7M UNALIGNED UsageFault */
 #define EXCP_DIVBYZERO      23   /* v7M DIVBYZERO UsageFault */
 #define EXCP_VSERR          24
+#define EXCP_GPC            25   /* v9 Granule Protection Check Fault */
 /* NB: add new EXCP_ defines to the array in arm_log_exception() too */
 
 #define ARMV7M_EXCP_RESET   1
diff --git a/target/arm/helper.c b/target/arm/helper.c
index f68923d73b..323cadd3c8 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -10184,6 +10184,7 @@ void arm_log_exception(CPUState *cs)
             [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
             [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault",
             [EXCP_VSERR] = "Virtual SERR",
+            [EXCP_GPC] = "Granule Protection Check",
         };
 
         if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
@@ -10915,6 +10916,10 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     }
 
     switch (cs->exception_index) {
+    case EXCP_GPC:
+        qemu_log_mask(CPU_LOG_INT, "...with MFAR 0x%" PRIx64 "\n",
+                      env->cp15.mfar_el3);
+        /* fall through */
     case EXCP_PREFETCH_ABORT:
     case EXCP_DATA_ABORT:
         /*
diff --git a/target/arm/internals.h b/target/arm/internals.h
index e3029bdc37..0f01bc32a8 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -358,14 +358,27 @@ typedef enum ARMFaultType {
     ARMFault_ICacheMaint,
     ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
     ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
+    ARMFault_GPCFOnWalk,
+    ARMFault_GPCFOnOutput,
 } ARMFaultType;
 
+typedef enum ARMGPCF {
+    GPCF_None,
+    GPCF_AddressSize,
+    GPCF_Walk,
+    GPCF_EABT,
+    GPCF_Fail,
+} ARMGPCF;
+
 /**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @type: Type of fault
+ * @gpcf: Subtype of ARMFault_GPCFOn{Walk,Output}.
  * @level: Table walk level (for translation, access flag and permission faults)
  * @domain: Domain of the fault address (for non-LPAE CPUs only)
  * @s2addr: Address that caused a fault at stage 2
+ * @paddr: physical address that caused a fault for gpc
+ * @paddr_space: physical address space that caused a fault for gpc
  * @stage2: True if we faulted at stage 2
  * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
  * @s1ns: True if we faulted on a non-secure IPA while in secure state
@@ -374,7 +387,10 @@ typedef enum ARMFaultType {
 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
 struct ARMMMUFaultInfo {
     ARMFaultType type;
+    ARMGPCF gpcf;
     target_ulong s2addr;
+    target_ulong paddr;
+    ARMSecuritySpace paddr_space;
     int level;
     int domain;
     bool stage2;
@@ -548,6 +564,17 @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     case ARMFault_Exclusive:
         fsc = 0x35;
         break;
+    case ARMFault_GPCFOnWalk:
+        assert(fi->level >= -1 && fi->level <= 3);
+        if (fi->level < 0) {
+            fsc = 0b100011;
+        } else {
+            fsc = 0b100100 | fi->level;
+        }
+        break;
+    case ARMFault_GPCFOnOutput:
+        fsc = 0b101000;
+        break;
     default:
         /* Other faults can't occur in a context that requires a
          * long-format status code.
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index 8df36c2cbf..b22b2a4c6e 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -107,17 +107,106 @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
     return fsr;
 }
 
+static bool report_as_gpc_exception(ARMCPU *cpu, int current_el,
+                                    ARMMMUFaultInfo *fi)
+{
+    bool ret;
+
+    switch (fi->gpcf) {
+    case GPCF_None:
+        return false;
+    case GPCF_AddressSize:
+    case GPCF_Walk:
+    case GPCF_EABT:
+        /* R_PYTGX: GPT faults are reported as GPC. */
+        ret = true;
+        break;
+    case GPCF_Fail:
+        /*
+         * R_BLYPM: A GPF at EL3 is reported as insn or data abort.
+         * R_VBZMW, R_LXHQR: A GPF at EL[0-2] is reported as a GPC
+         * if SCR_EL3.GPF is set, otherwise an insn or data abort.
+         */
+        ret = (cpu->env.cp15.scr_el3 & SCR_GPF) && current_el != 3;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    assert(cpu_isar_feature(aa64_rme, cpu));
+    assert(fi->type == ARMFault_GPCFOnWalk ||
+           fi->type == ARMFault_GPCFOnOutput);
+    if (fi->gpcf == GPCF_AddressSize) {
+        assert(fi->level == 0);
+    } else {
+        assert(fi->level >= 0 && fi->level <= 1);
+    }
+
+    return ret;
+}
+
+static unsigned encode_gpcsc(ARMMMUFaultInfo *fi)
+{
+    static uint8_t const gpcsc[] = {
+        [GPCF_AddressSize] = 0b000000,
+        [GPCF_Walk]        = 0b000100,
+        [GPCF_Fail]        = 0b001100,
+        [GPCF_EABT]        = 0b010100,
+    };
+
+    /* Note that we've validated fi->gpcf and fi->level above. */
+    return gpcsc[fi->gpcf] | fi->level;
+}
+
 static G_NORETURN
 void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
                        MMUAccessType access_type,
                        int mmu_idx, ARMMMUFaultInfo *fi)
 {
     CPUARMState *env = &cpu->env;
-    int target_el;
+    int target_el = exception_target_el(env);
+    int current_el = arm_current_el(env);
     bool same_el;
     uint32_t syn, exc, fsr, fsc;
 
-    target_el = exception_target_el(env);
+    if (report_as_gpc_exception(cpu, current_el, fi)) {
+        target_el = 3;
+
+        fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
+
+        syn = syn_gpc(fi->stage2 && fi->type == ARMFault_GPCFOnWalk,
+                      access_type == MMU_INST_FETCH,
+                      encode_gpcsc(fi), 0, fi->s1ptw,
+                      access_type == MMU_DATA_STORE, fsc);
+
+        env->cp15.mfar_el3 = fi->paddr;
+        switch (fi->paddr_space) {
+        case ARMSS_Secure:
+            break;
+        case ARMSS_NonSecure:
+            env->cp15.mfar_el3 |= R_MFAR_NS_MASK;
+            break;
+        case ARMSS_Root:
+            env->cp15.mfar_el3 |= R_MFAR_NSE_MASK;
+            break;
+        case ARMSS_Realm:
+            env->cp15.mfar_el3 |= R_MFAR_NSE_MASK | R_MFAR_NS_MASK;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
+        exc = EXCP_GPC;
+        goto do_raise;
+    }
+
+    /* If SCR_EL3.GPF is unset, GPF may still be routed to EL2. */
+    if (fi->gpcf == GPCF_Fail && target_el < 2) {
+        if (arm_hcr_el2_eff(env) & HCR_GPF) {
+            target_el = 2;
+        }
+    }
+
     if (fi->stage2) {
         target_el = 2;
         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
@@ -125,8 +214,8 @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
             env->cp15.hpfar_el2 |= HPFAR_NS;
         }
     }
-    same_el = (arm_current_el(env) == target_el);
 
+    same_el = current_el == target_el;
     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
 
     if (access_type == MMU_INST_FETCH) {
@@ -143,6 +232,7 @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
         exc = EXCP_DATA_ABORT;
     }
 
+ do_raise:
     env->exception.vaddress = addr;
     env->exception.fsr = fsr;
     raise_exception(env, exc, syn, target_el);

From 46f38c975f0a077a8f82081cc81a7cbd4f78f946 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:48 +0100
Subject: [PATCH 0092/1353] target/arm: Implement the granule protection check

Place the check at the end of get_phys_addr_with_struct,
so that we check all physical results.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 249 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 232 insertions(+), 17 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 7c4526e2da..6015121b99 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -39,11 +39,17 @@ typedef struct S1Translate {
     void *out_host;
 } S1Translate;
 
-static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-                                      target_ulong address,
-                                      MMUAccessType access_type,
-                                      GetPhysAddrResult *result,
-                                      ARMMMUFaultInfo *fi);
+static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
+                                target_ulong address,
+                                MMUAccessType access_type,
+                                GetPhysAddrResult *result,
+                                ARMMMUFaultInfo *fi);
+
+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
+                              target_ulong address,
+                              MMUAccessType access_type,
+                              GetPhysAddrResult *result,
+                              ARMMMUFaultInfo *fi);
 
 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
 static const uint8_t pamax_map[] = {
@@ -230,6 +236,197 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
 }
 
+static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
+                                     ARMSecuritySpace pspace,
+                                     ARMMMUFaultInfo *fi)
+{
+    MemTxAttrs attrs = {
+        .secure = true,
+        .space = ARMSS_Root,
+    };
+    ARMCPU *cpu = env_archcpu(env);
+    uint64_t gpccr = env->cp15.gpccr_el3;
+    unsigned pps, pgs, l0gptsz, level = 0;
+    uint64_t tableaddr, pps_mask, align, entry, index;
+    AddressSpace *as;
+    MemTxResult result;
+    int gpi;
+
+    if (!FIELD_EX64(gpccr, GPCCR, GPC)) {
+        return true;
+    }
+
+    /*
+     * GPC Priority 1 (R_GMGRR):
+     * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
+     * the access fails as GPT walk fault at level 0.
+     */
+
+    /*
+     * Configuration of PPS to a value exceeding the implemented
+     * physical address size is invalid.
+     */
+    pps = FIELD_EX64(gpccr, GPCCR, PPS);
+    if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
+        goto fault_walk;
+    }
+    pps = pamax_map[pps];
+    pps_mask = MAKE_64BIT_MASK(0, pps);
+
+    switch (FIELD_EX64(gpccr, GPCCR, SH)) {
+    case 0b10: /* outer shareable */
+        break;
+    case 0b00: /* non-shareable */
+    case 0b11: /* inner shareable */
+        /* Inner and Outer non-cacheable requires Outer shareable. */
+        if (FIELD_EX64(gpccr, GPCCR, ORGN) == 0 &&
+            FIELD_EX64(gpccr, GPCCR, IRGN) == 0) {
+            goto fault_walk;
+        }
+        break;
+    default:   /* reserved */
+        goto fault_walk;
+    }
+
+    switch (FIELD_EX64(gpccr, GPCCR, PGS)) {
+    case 0b00: /* 4KB */
+        pgs = 12;
+        break;
+    case 0b01: /* 64KB */
+        pgs = 16;
+        break;
+    case 0b10: /* 16KB */
+        pgs = 14;
+        break;
+    default: /* reserved */
+        goto fault_walk;
+    }
+
+    /* Note this field is read-only and fixed at reset. */
+    l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
+
+    /*
+     * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
+     * R_CPDSB: A NonSecure physical address input exceeding PPS
+     * does not experience any fault.
+     */
+    if (paddress & ~pps_mask) {
+        if (pspace == ARMSS_NonSecure) {
+            return true;
+        }
+        goto fault_size;
+    }
+
+    /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
+    tableaddr = env->cp15.gptbr_el3 << 12;
+    if (tableaddr & ~pps_mask) {
+        goto fault_size;
+    }
+
+    /*
+     * BADDR is aligned per a function of PPS and L0GPTSZ.
+     * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
+     * unlike the RES0 bits of the GPT entries (R_XNKFZ).
+     */
+    align = MAX(pps - l0gptsz + 3, 12);
+    align = MAKE_64BIT_MASK(0, align);
+    tableaddr &= ~align;
+
+    as = arm_addressspace(env_cpu(env), attrs);
+
+    /* Level 0 lookup. */
+    index = extract64(paddress, l0gptsz, pps - l0gptsz);
+    tableaddr += index * 8;
+    entry = address_space_ldq_le(as, tableaddr, attrs, &result);
+    if (result != MEMTX_OK) {
+        goto fault_eabt;
+    }
+
+    switch (extract32(entry, 0, 4)) {
+    case 1: /* block descriptor */
+        if (entry >> 8) {
+            goto fault_walk; /* RES0 bits not 0 */
+        }
+        gpi = extract32(entry, 4, 4);
+        goto found;
+    case 3: /* table descriptor */
+        tableaddr = entry & ~0xf;
+        align = MAX(l0gptsz - pgs - 1, 12);
+        align = MAKE_64BIT_MASK(0, align);
+        if (tableaddr & (~pps_mask | align)) {
+            goto fault_walk; /* RES0 bits not 0 */
+        }
+        break;
+    default: /* invalid */
+        goto fault_walk;
+    }
+
+    /* Level 1 lookup */
+    level = 1;
+    index = extract64(paddress, pgs + 4, l0gptsz - pgs - 4);
+    tableaddr += index * 8;
+    entry = address_space_ldq_le(as, tableaddr, attrs, &result);
+    if (result != MEMTX_OK) {
+        goto fault_eabt;
+    }
+
+    switch (extract32(entry, 0, 4)) {
+    case 1: /* contiguous descriptor */
+        if (entry >> 10) {
+            goto fault_walk; /* RES0 bits not 0 */
+        }
+        /*
+         * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
+         * and because we cannot invalidate by pa, and thus will always
+         * flush entire tlbs, we don't actually care about the range here
+         * and can simply extract the GPI as the result.
+         */
+        if (extract32(entry, 8, 2) == 0) {
+            goto fault_walk; /* reserved contig */
+        }
+        gpi = extract32(entry, 4, 4);
+        break;
+    default:
+        index = extract64(paddress, pgs, 4);
+        gpi = extract64(entry, index * 4, 4);
+        break;
+    }
+
+ found:
+    switch (gpi) {
+    case 0b0000: /* no access */
+        break;
+    case 0b1111: /* all access */
+        return true;
+    case 0b1000:
+    case 0b1001:
+    case 0b1010:
+    case 0b1011:
+        if (pspace == (gpi & 3)) {
+            return true;
+        }
+        break;
+    default:
+        goto fault_walk; /* reserved */
+    }
+
+    fi->gpcf = GPCF_Fail;
+    goto fault_common;
+ fault_eabt:
+    fi->gpcf = GPCF_EABT;
+    goto fault_common;
+ fault_size:
+    fi->gpcf = GPCF_AddressSize;
+    goto fault_common;
+ fault_walk:
+    fi->gpcf = GPCF_Walk;
+ fault_common:
+    fi->level = level;
+    fi->paddr = paddress;
+    fi->paddr_space = pspace;
+    return false;
+}
+
 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
 {
     /*
@@ -276,10 +473,10 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         };
         GetPhysAddrResult s2 = { };
 
-        if (get_phys_addr_with_struct(env, &s2ptw, addr,
-                                      MMU_DATA_LOAD, &s2, fi)) {
+        if (get_phys_addr_gpc(env, &s2ptw, addr, MMU_DATA_LOAD, &s2, fi)) {
             goto fail;
         }
+
         ptw->out_phys = s2.f.phys_addr;
         pte_attrs = s2.cacheattrs.attrs;
         ptw->out_host = NULL;
@@ -332,6 +529,9 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
 
  fail:
     assert(fi->type != ARMFault_None);
+    if (fi->type == ARMFault_GPCFOnOutput) {
+        fi->type = ARMFault_GPCFOnWalk;
+    }
     fi->s2addr = addr;
     fi->stage2 = true;
     fi->s1ptw = true;
@@ -2769,7 +2969,7 @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
                                    ARMMMUFaultInfo *fi)
 {
     uint8_t memattr = 0x00;    /* Device nGnRnE */
-    uint8_t shareability = 0;  /* non-sharable */
+    uint8_t shareability = 0;  /* non-shareable */
     int r_el;
 
     switch (mmu_idx) {
@@ -2828,7 +3028,7 @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
             } else {
                 memattr = 0x44;  /* Normal, NC, No */
             }
-            shareability = 2; /* outer sharable */
+            shareability = 2; /* outer shareable */
         }
         result->cacheattrs.is_s2_format = false;
         break;
@@ -2856,7 +3056,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     ARMSecuritySpace ipa_space;
     uint64_t hcr;
 
-    ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
+    ret = get_phys_addr_nogpc(env, ptw, address, access_type, result, fi);
 
     /* If S1 fails, return early.  */
     if (ret) {
@@ -2882,7 +3082,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     cacheattrs1 = result->cacheattrs;
     memset(result, 0, sizeof(*result));
 
-    ret = get_phys_addr_with_struct(env, ptw, ipa, access_type, result, fi);
+    ret = get_phys_addr_nogpc(env, ptw, ipa, access_type, result, fi);
     fi->s2addr = ipa;
 
     /* Combine the S1 and S2 perms.  */
@@ -2942,7 +3142,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     return false;
 }
 
-static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
+static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
                                       target_ulong address,
                                       MMUAccessType access_type,
                                       GetPhysAddrResult *result,
@@ -3076,6 +3276,23 @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     }
 }
 
+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
+                              target_ulong address,
+                              MMUAccessType access_type,
+                              GetPhysAddrResult *result,
+                              ARMMMUFaultInfo *fi)
+{
+    if (get_phys_addr_nogpc(env, ptw, address, access_type, result, fi)) {
+        return true;
+    }
+    if (!granule_protection_check(env, result->f.phys_addr,
+                                  result->f.attrs.space, fi)) {
+        fi->type = ARMFault_GPCFOnOutput;
+        return true;
+    }
+    return false;
+}
+
 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool is_secure, GetPhysAddrResult *result,
@@ -3086,8 +3303,7 @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
         .in_secure = is_secure,
         .in_space = arm_secure_to_space(is_secure),
     };
-    return get_phys_addr_with_struct(env, &ptw, address, access_type,
-                                     result, fi);
+    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
 }
 
 bool get_phys_addr(CPUARMState *env, target_ulong address,
@@ -3157,8 +3373,7 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
     ptw.in_space = ss;
     ptw.in_secure = arm_space_is_secure(ss);
-    return get_phys_addr_with_struct(env, &ptw, address, access_type,
-                                     result, fi);
+    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
 }
 
 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
@@ -3178,7 +3393,7 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     ARMMMUFaultInfo fi = {};
     bool ret;
 
-    ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
+    ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
     *attrs = res.f.attrs;
 
     if (ret) {

From a834d5474e24a279ffc16558c34d4536e84fe09d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 23 Jun 2023 11:15:48 +0100
Subject: [PATCH 0093/1353] target/arm: Add cpu properties for enabling
 FEAT_RME

Add an x-rme cpu property to enable FEAT_RME.
Add an x-l0gptsz property to set GPCCR_EL3.L0GPTSZ,
for testing various possible configurations.

We're not currently completely sure whether FEAT_RME will
be OK to enable purely as a CPU-level property, or if it will
need board co-operation, so we're making these experimental
x- properties, so that the people developing the system
level software for RME can try to start using this and let
us know how it goes. The command line syntax for enabling
this will change in future, without backwards-compatibility.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-21-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu64.c | 53 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 2976f94ae4..6fec2d8a57 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -142,6 +142,56 @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
     cpu->sve_max_vq = max_vq;
 }
 
+static bool cpu_arm_get_rme(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    return cpu_isar_feature(aa64_rme, cpu);
+}
+
+static void cpu_arm_set_rme(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint64_t t;
+
+    t = cpu->isar.id_aa64pfr0;
+    t = FIELD_DP64(t, ID_AA64PFR0, RME, value);
+    cpu->isar.id_aa64pfr0 = t;
+}
+
+static void cpu_max_set_l0gptsz(Object *obj, Visitor *v, const char *name,
+                                void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    /* Encode the value for the GPCCR_EL3 field. */
+    switch (value) {
+    case 30:
+    case 34:
+    case 36:
+    case 39:
+        cpu->reset_l0gptsz = value - 30;
+        break;
+    default:
+        error_setg(errp, "invalid value for l0gptsz");
+        error_append_hint(errp, "valid values are 30, 34, 36, 39\n");
+        break;
+    }
+}
+
+static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
+                                void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t value = cpu->reset_l0gptsz + 30;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
 
@@ -700,6 +750,9 @@ void aarch64_max_tcg_initfn(Object *obj)
     aarch64_add_sme_properties(obj);
     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                         cpu_max_set_sve_max_vq, NULL, NULL);
+    object_property_add_bool(obj, "x-rme", cpu_arm_get_rme, cpu_arm_set_rme);
+    object_property_add(obj, "x-l0gptsz", "uint32", cpu_max_get_l0gptsz,
+                        cpu_max_set_l0gptsz, NULL, NULL);
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
 

From 57223a4c24d58493d1eade8c1b38fd707f845d5e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 22 Jun 2023 16:30:46 +0200
Subject: [PATCH 0094/1353] docs/system/arm: Document FEAT_RME
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20230622143046.1578160-1-richard.henderson@linaro.org
[PMM: fixed typo; note experimental status in emulation.rst too]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 23 +++++++++++++++++++++++
 docs/system/arm/emulation.rst    |  1 +
 2 files changed, 24 insertions(+)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index f4524b6d3e..6bb88a40c7 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -435,3 +435,26 @@ As with ``sve-default-vector-length``, if the default length is larger
 than the maximum vector length enabled, the actual vector length will
 be reduced.  If this property is set to ``-1`` then the default vector
 length is set to the maximum possible length.
+
+RME CPU Properties
+==================
+
+The status of RME support with QEMU is experimental.  At this time we
+only support RME within the CPU proper, not within the SMMU or GIC.
+The feature is enabled by the CPU property ``x-rme``, with the ``x-``
+prefix present as a reminder of the experimental status, and defaults off.
+
+The method for enabling RME will change in some future QEMU release
+without notice or backward compatibility.
+
+RME Level 0 GPT Size Property
+-----------------------------
+
+To aid firmware developers in testing different possible CPU
+configurations, ``x-l0gptsz=S`` may be used to specify the value
+to encode into ``GPCCR_EL3.L0GPTSZ``, a read-only field that
+specifies the size of the Level 0 Granule Protection Table.
+Legal values for ``S`` are 30, 34, 36, and 39; the default is 30.
+
+As with ``x-rme``, the ``x-l0gptsz`` property may be renamed or
+removed in some future QEMU release.
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index ecbbd63adf..bdafc68819 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -66,6 +66,7 @@ the following architecture extensions:
 - FEAT_RAS (Reliability, availability, and serviceability)
 - FEAT_RASv1p1 (RAS Extension v1.1)
 - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
+- FEAT_RME (Realm Management Extension) (NB: support status in QEMU is experimental)
 - FEAT_RNG (Random number generator)
 - FEAT_S2FWB (Stage 2 forced Write-Back)
 - FEAT_SB (Speculation Barrier)

From b0438861efe1dfbdfdd9fa1d9aa05100d37ea8ee Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 22 Jun 2023 14:08:23 +0100
Subject: [PATCH 0095/1353] host-utils: Avoid using __builtin_subcll on buggy
 versions of Apple Clang
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We use __builtin_subcll() to do a 64-bit subtract with borrow-in and
borrow-out when the host compiler supports it.  Unfortunately some
versions of Apple Clang have a bug in their implementation of this
intrinsic which means it returns the wrong value.  The effect is that
a QEMU built with the affected compiler will hang when emulating x86
or m68k float80 division.

The upstream LLVM issue is:
https://github.com/llvm/llvm-project/issues/55253

The commit that introduced the bug apparently never made it into an
upstream LLVM release without the subsequent fix
https://github.com/llvm/llvm-project/commit/fffb6e6afdbaba563189c1f715058ed401fbc88d
but unfortunately it did make it into Apple Clang 14.0, as shipped
in Xcode 14.3 (14.2 is reported to be OK). The Apple bug number is
FB12210478.

Add ifdefs to avoid use of __builtin_subcll() on Apple Clang version
14 or greater.  There is not currently a version of Apple Clang which
has the bug fix -- when one appears we should be able to add an upper
bound to the ifdef condition so we can start using the builtin again.
We make the lower bound a conservative "any Apple clang with major
version 14 or greater" because the consequences of incorrectly
disabling the builtin when it would work are pretty small and the
consequences of not disabling it when we should are pretty bad.

Many thanks to those users who both reported this bug and also
did a lot of work in identifying the root cause; in particular
to Daniel Bertalan and osy.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1631
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1659
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Daniel Bertalan <dani@danielbertalan.dev>
Tested-by: Tested-By: Solra Bizna <solra@bizna.name>
Message-id: 20230622130823.1631719-1-peter.maydell@linaro.org
---
 include/qemu/compiler.h   | 13 +++++++++++++
 include/qemu/host-utils.h |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index c2f49df1f9..a309f90c76 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -184,4 +184,17 @@
 #define QEMU_DISABLE_CFI
 #endif
 
+/*
+ * Apple clang version 14 has a bug in its __builtin_subcll(); define
+ * BUILTIN_SUBCLL_BROKEN for the offending versions so we can avoid it.
+ * When a version of Apple clang which has this bug fixed is released
+ * we can add an upper bound to this check.
+ * See https://gitlab.com/qemu-project/qemu/-/issues/1631
+ * and https://gitlab.com/qemu-project/qemu/-/issues/1659 for details.
+ * The bug never made it into any upstream LLVM releases, only Apple ones.
+ */
+#if defined(__apple_build_version__) && __clang_major__ >= 14
+#define BUILTIN_SUBCLL_BROKEN
+#endif
+
 #endif /* COMPILER_H */
diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index d3b4dce6a9..011618373e 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -649,7 +649,7 @@ static inline uint64_t uadd64_carry(uint64_t x, uint64_t y, bool *pcarry)
  */
 static inline uint64_t usub64_borrow(uint64_t x, uint64_t y, bool *pborrow)
 {
-#if __has_builtin(__builtin_subcll)
+#if __has_builtin(__builtin_subcll) && !defined(BUILTIN_SUBCLL_BROKEN)
     unsigned long long b = *pborrow;
     x = __builtin_subcll(x, y, b, &b);
     *pborrow = b & 1;

From 4315f7c6147431a69a02613fbdf9964d68f87a27 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 19 Jun 2023 16:02:16 +0200
Subject: [PATCH 0096/1353] target/arm: Restructure has_vfp_d32 test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

One cannot test for feature aa32_simd_r32 without first
testing if AArch32 mode is supported at all.  This leads to

qemu-system-aarch64: ARM CPUs must have both VFP-D32 and Neon or neither

for Apple M1 cpus.

We already have a check for ARMv8-A never setting vfp-d32 true,
so restructure the code so that AArch64 avoids the test entirely.

Reported-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Mads Ynddal <m.ynddal@samsung.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Mads Ynddal <m.ynddal@samsung.com>
Message-id: 20230619140216.402530-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 842e1b53ee..a1e77698ba 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1402,25 +1402,27 @@ void arm_cpu_post_init(Object *obj)
      * KVM does not currently allow us to lie to the guest about its
      * ID/feature registers, so the guest always sees what the host has.
      */
-    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
-        ? cpu_isar_feature(aa64_fp_simd, cpu)
-        : cpu_isar_feature(aa32_vfp, cpu)) {
-        cpu->has_vfp = true;
-        if (!kvm_enabled()) {
-            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property);
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        if (cpu_isar_feature(aa64_fp_simd, cpu)) {
+            cpu->has_vfp = true;
+            cpu->has_vfp_d32 = true;
+            if (tcg_enabled() || qtest_enabled()) {
+                qdev_property_add_static(DEVICE(obj),
+                                         &arm_cpu_has_vfp_property);
+            }
         }
-    }
-
-    if (cpu->has_vfp && cpu_isar_feature(aa32_simd_r32, cpu)) {
-        cpu->has_vfp_d32 = true;
-        if (!kvm_enabled()) {
+    } else if (cpu_isar_feature(aa32_vfp, cpu)) {
+        cpu->has_vfp = true;
+        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
+            cpu->has_vfp_d32 = true;
             /*
              * The permitted values of the SIMDReg bits [3:0] on
              * Armv8-A are either 0b0000 and 0b0010. On such CPUs,
              * make sure that has_vfp_d32 can not be set to false.
              */
-            if (!(arm_feature(&cpu->env, ARM_FEATURE_V8) &&
-                  !arm_feature(&cpu->env, ARM_FEATURE_M))) {
+            if ((tcg_enabled() || qtest_enabled())
+                && !(arm_feature(&cpu->env, ARM_FEATURE_V8)
+                     && !arm_feature(&cpu->env, ARM_FEATURE_M))) {
                 qdev_property_add_static(DEVICE(obj),
                                          &arm_cpu_has_vfp_d32_property);
             }

From 9fe2b4a2899507bc66122840f060fab74b5dd161 Mon Sep 17 00:00:00 2001
From: Shashi Mallela <shashi.mallela@linaro.org>
Date: Mon, 19 Jun 2023 19:09:13 +0200
Subject: [PATCH 0097/1353] hw/arm/sbsa-ref: add ITS support in SBSA GIC

Create ITS as part of SBSA platform GIC initialization.

GIC ITS information is in DeviceTree so TF-A can pass it to EDK2.

Bumping platform version to 0.2 as this is important hardware change.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230619170913.517373-2-marcin.juszkiewicz@linaro.org
Co-authored-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst | 14 ++++++++++++++
 hw/arm/sbsa-ref.c        | 33 ++++++++++++++++++++++++++++++---
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
index f571fe645e..a8e0b530a2 100644
--- a/docs/system/arm/sbsa.rst
+++ b/docs/system/arm/sbsa.rst
@@ -46,6 +46,9 @@ to be a complete compliant DT. It currently reports:
    - platform version
    - GIC addresses
 
+Platform version
+''''''''''''''''
+
 The platform version is only for informing platform firmware about
 what kind of ``sbsa-ref`` board it is running on. It is neither
 a QEMU versioned machine type nor a reflection of the level of the
@@ -54,3 +57,14 @@ SBSA/SystemReady SR support provided.
 The ``machine-version-major`` value is updated when changes breaking
 fw compatibility are introduced. The ``machine-version-minor`` value
 is updated when features are added that don't break fw compatibility.
+
+Platform version changes:
+
+0.0
+  Devicetree holds information about CPUs, memory and platform version.
+
+0.1
+  GIC information is present in devicetree.
+
+0.2
+  GIC ITS information is present in devicetree.
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index de21200ff9..0639f97dd5 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -65,6 +65,7 @@ enum {
     SBSA_CPUPERIPHS,
     SBSA_GIC_DIST,
     SBSA_GIC_REDIST,
+    SBSA_GIC_ITS,
     SBSA_SECURE_EC,
     SBSA_GWDT_WS0,
     SBSA_GWDT_REFRESH,
@@ -108,6 +109,7 @@ static const MemMapEntry sbsa_ref_memmap[] = {
     [SBSA_CPUPERIPHS] =         { 0x40000000, 0x00040000 },
     [SBSA_GIC_DIST] =           { 0x40060000, 0x00010000 },
     [SBSA_GIC_REDIST] =         { 0x40080000, 0x04000000 },
+    [SBSA_GIC_ITS] =            { 0x44081000, 0x00020000 },
     [SBSA_SECURE_EC] =          { 0x50000000, 0x00001000 },
     [SBSA_GWDT_REFRESH] =       { 0x50010000, 0x00001000 },
     [SBSA_GWDT_CONTROL] =       { 0x50011000, 0x00001000 },
@@ -181,8 +183,15 @@ static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
                                  2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
                                  2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
 
+    nodename = g_strdup_printf("/intc/its");
+    qemu_fdt_add_subnode(sms->fdt, nodename);
+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
+                                 2, sbsa_ref_memmap[SBSA_GIC_ITS].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_ITS].size);
+
     g_free(nodename);
 }
+
 /*
  * Firmware on this machine only uses ACPI table to load OS, these limited
  * device tree nodes are just to let firmware know the info which varies from
@@ -219,7 +228,7 @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 2);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -409,7 +418,20 @@ static void create_secure_ram(SBSAMachineState *sms,
     memory_region_add_subregion(secure_sysmem, base, secram);
 }
 
-static void create_gic(SBSAMachineState *sms)
+static void create_its(SBSAMachineState *sms)
+{
+    const char *itsclass = its_class_name();
+    DeviceState *dev;
+
+    dev = qdev_new(itsclass);
+
+    object_property_set_link(OBJECT(dev), "parent-gicv3", OBJECT(sms->gic),
+                             &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, sbsa_ref_memmap[SBSA_GIC_ITS].base);
+}
+
+static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
 {
     unsigned int smp_cpus = MACHINE(sms)->smp.cpus;
     SysBusDevice *gicbusdev;
@@ -436,6 +458,10 @@ static void create_gic(SBSAMachineState *sms)
     qdev_prop_set_uint32(sms->gic, "len-redist-region-count", 1);
     qdev_prop_set_uint32(sms->gic, "redist-region-count[0]", redist0_count);
 
+    object_property_set_link(OBJECT(sms->gic), "sysmem",
+                             OBJECT(mem), &error_fatal);
+    qdev_prop_set_bit(sms->gic, "has-lpi", true);
+
     gicbusdev = SYS_BUS_DEVICE(sms->gic);
     sysbus_realize_and_unref(gicbusdev, &error_fatal);
     sysbus_mmio_map(gicbusdev, 0, sbsa_ref_memmap[SBSA_GIC_DIST].base);
@@ -482,6 +508,7 @@ static void create_gic(SBSAMachineState *sms)
         sysbus_connect_irq(gicbusdev, i + 3 * smp_cpus,
                            qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
     }
+    create_its(sms);
 }
 
 static void create_uart(const SBSAMachineState *sms, int uart,
@@ -788,7 +815,7 @@ static void sbsa_ref_init(MachineState *machine)
 
     create_secure_ram(sms, secure_sysmem);
 
-    create_gic(sms);
+    create_gic(sms, sysmem);
 
     create_uart(sms, SBSA_UART, sysmem, serial_hd(0));
     create_uart(sms, SBSA_SECURE_UART, secure_sysmem, serial_hd(1));

From 7c347c7333d9c6651b0d0f985e7d919dc3aba607 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 20 Jun 2023 15:46:59 +0200
Subject: [PATCH 0098/1353] target/arm: Fix sve predicate store, 8 <= VQ <= 15
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Brown bag time: store instead of load results in uninitialized temp.


Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1704
Reported-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620134659.817559-1-richard.henderson@linaro.org
Fixes: e6dd5e782be ("target/arm: Use tcg_gen_qemu_{ld, st}_i128 in gen_sve_{ld, st}r")
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index ff050626e6..225d358922 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -4329,7 +4329,7 @@ void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
     /* Predicate register stores can be any multiple of 2.  */
     if (len_remain >= 8) {
         t0 = tcg_temp_new_i64();
-        tcg_gen_st_i64(t0, base, vofs + len_align);
+        tcg_gen_ld_i64(t0, base, vofs + len_align);
         tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEUQ | MO_ATOM_NONE);
         len_remain -= 8;
         len_align += 8;

From 497fad38979c16b6412388927401e577eba43d26 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 20 Jun 2023 17:20:24 +0100
Subject: [PATCH 0099/1353] pc-bios/keymaps: Use the official xkb name for
 Arabic layout, not the legacy synonym
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The xkb official name for the Arabic keyboard layout is 'ara'.
However xkb has for at least the past 15 years also permitted it to
be named via the legacy synonym 'ar'.  In xkeyboard-config 2.39 this
synoynm was removed, which breaks compilation of QEMU:

FAILED: pc-bios/keymaps/ar
/home/fred/qemu-git/src/qemu/build-full/qemu-keymap -f pc-bios/keymaps/ar -l ar
xkbcommon: ERROR: Couldn't find file "symbols/ar" in include paths
xkbcommon: ERROR: 1 include paths searched:
xkbcommon: ERROR: 	/usr/share/X11/xkb
xkbcommon: ERROR: 3 include paths could not be added:
xkbcommon: ERROR: 	/home/fred/.config/xkb
xkbcommon: ERROR: 	/home/fred/.xkb
xkbcommon: ERROR: 	/etc/xkb
xkbcommon: ERROR: Abandoning symbols file "(unnamed)"
xkbcommon: ERROR: Failed to compile xkb_symbols
xkbcommon: ERROR: Failed to compile keymap

The upstream xkeyboard-config change removing the compat
mapping is:
https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/commit/470ad2cd8fea84d7210377161d86b31999bb5ea6

Make QEMU always ask for the 'ara' xkb layout, which should work on
both older and newer xkeyboard-config.  We leave the QEMU name for
this keyboard layout as 'ar'; it is not the only one where our name
for it deviates from the xkb standard name.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20230620162024.1132013-1-peter.maydell@linaro.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1709
---
 pc-bios/keymaps/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
index bff3083313..0bd8ce0077 100644
--- a/pc-bios/keymaps/meson.build
+++ b/pc-bios/keymaps/meson.build
@@ -1,5 +1,5 @@
 keymaps = {
-  'ar': '-l ar',
+  'ar': '-l ara',
   'bepo': '-l fr -v dvorak',
   'cz': '-l cz',
   'da': '-l dk',

From 50ba97e928b44ff5bc731c9ffe68d86acbe44639 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Fri, 23 Jun 2023 08:24:30 +0200
Subject: [PATCH 0100/1353] target/hppa: Fix OS reboot issues

When the OS triggers a reboot, the reset helper function sends a
qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET) together with an
EXCP_HLT exception to halt the CPUs.

So, at reboot when initializing the CPUs again, make sure to set all
instruction pointers to the firmware entry point, disable any interrupts,
disable data and instruction translations, enable PSW_Q bit  and tell qemu
to unhalt (halted=0) the CPUs again.

This fixes the various reboot issues which were seen when rebooting a
Linux VM, including the case where even the monarch CPU has been virtually
halted from the OS (e.g. via "chcpu -d 0" inside the Linux VM).

Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/machine.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index b00a91ecfe..9facef7f14 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -418,10 +418,16 @@ static void hppa_machine_reset(MachineState *ms, ShutdownCause reason)
 
     /* Start all CPUs at the firmware entry point.
      *  Monarch CPU will initialize firmware, secondary CPUs
-     *  will enter a small idle look and wait for rendevouz. */
+     *  will enter a small idle loop and wait for rendevouz. */
     for (i = 0; i < smp_cpus; i++) {
-        cpu_set_pc(CPU(cpu[i]), firmware_entry);
+        CPUState *cs = CPU(cpu[i]);
+
+        cpu_set_pc(cs, firmware_entry);
+        cpu[i]->env.psw = PSW_Q;
         cpu[i]->env.gr[5] = CPU_HPA + i * 0x1000;
+
+        cs->exception_index = -1;
+        cs->halted = 0;
     }
 
     /* already initialized by machine_hppa_init()? */

From 069d296669448b9eef72c6332ae84af962d9582c Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 24 Jun 2023 00:28:44 +0200
Subject: [PATCH 0101/1353] target/hppa: Provide qemu version via fw_cfg to
 firmware

Give current QEMU version string to SeaBIOS-hppa via fw_cfg interface so
that the firmware can show the QEMU version in the boot menu info.

Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/machine.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 9facef7f14..866e11d208 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -122,6 +122,7 @@ static FWCfgState *create_fw_cfg(MachineState *ms)
 {
     FWCfgState *fw_cfg;
     uint64_t val;
+    const char qemu_version[] = QEMU_VERSION;
 
     fw_cfg = fw_cfg_init_mem(FW_CFG_IO_BASE, FW_CFG_IO_BASE + 4);
     fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, ms->smp.cpus);
@@ -147,6 +148,10 @@ static FWCfgState *create_fw_cfg(MachineState *ms)
     fw_cfg_add_i16(fw_cfg, FW_CFG_BOOT_DEVICE, ms->boot_config.order[0]);
     qemu_register_boot_set(fw_cfg_boot_set, fw_cfg);
 
+    fw_cfg_add_file(fw_cfg, "/etc/qemu-version",
+                    g_memdup(qemu_version, sizeof(qemu_version)),
+                    sizeof(qemu_version));
+
     return fw_cfg;
 }
 

From 34ec3aea54368a92b62a55c656335885ba8c65ef Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 24 Jun 2023 11:45:52 +0200
Subject: [PATCH 0102/1353] target/hppa: Update to SeaBIOS-hppa version 8

Update SeaBIOS-hppa to version 8.

Fixes:
- boot of HP-UX with SMP, and
- reboot of Linux and HP-UX with SMP

Enhancements:
- show qemu version in boot menu
- adds exit menu entry in boot menu to quit emulation
- allow to trace PCD_CHASSIS codes & machine run status

Signed-off-by: Helge Deller <deller@gmx.de>
---
 pc-bios/hppa-firmware.img | Bin 719376 -> 720216 bytes
 roms/seabios-hppa         |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/hppa-firmware.img b/pc-bios/hppa-firmware.img
index e7660b0458b78b101c7ed2dc17595e94438ffeb8..0fa3808f163ea60766272188a634d9296f2b5be4 100644
GIT binary patch
delta 356358
zcmdqKe_T}8wKshBVHgg>3^V+mfq^;0h=Pcs92ii9Q8bQ{M2sQ>VjQE!F_;9SwwPiW
z6%`YWn1eZJvB5Sr=3Z?`(P~<}!B$gjl3tD4Xs)KDG0jOex1>#OvDNx~*O@We``-6`
zpTC|z9zWTfz4p(w*Is+Awb$Nz(*9NMrN8C2ry3ZCe-dXH&fhg6GxDcBTtvgJO1D!t
zOXb)ftES{VGIMUlIB!+e6tQYrh4{dVXP*4_;%AnL#k=-<N9N}(mkNuECKN4^@|Lc6
zX3e_13HcKW@{1<qFUl{L3M6-4<M{l1WzJ;2F^a|dIl<(Ak!6(+3j13{F<anx4>u?r
z5Q}%-k(?YC%yObrE|dGz>baLDo(-3KlS311(CU#rER~Pu<a%Zwb2rW9$zbj}ZqOUS
zi9vtaR?!p7q^Ufo`ullN!~mT}i+q+jA9ZIi$*JR{GA`&^Q^wri(G7}g$1-V&DJXsq
zd9C^<f}39ctI;2SP<)~c>4tW+!2yS<&ZJmYC<p-)mvm;cSpG#Auh-6Hr#6d4=+7zi
zy7&Zsq;Aml0nqtK$EmZ7cK1hIQ1qhdsnOZjgM<zhjqu6=T?YSu<;N?Geq1-G&Wh@!
zvAaJi-%$CB^2@5HpR4?j@{^)SQ@{<XB4{z1;<|ouG||Lt4Z-?@;qQ<*3RB?Jw};@U
z;?P&{-YqXz37H1WAZ8!4?UQxU^}WI9hj~6#C!dW;<xPFPH)5h9()Uhn=JKbmVMXV=
z($>GfJMH$S-C}mGU*x=n<^kDaPGfs}$C$sbOHRE;s0!(Pohy^$+$FKj>o=mB<-vrJ
zv8gNXW?jEwn%A3{sOMvorx6oS@#{CD$H>{qzvoSjy~dPGo);Q>^KDT&o8Xo?K2X33
zJA-0o?&BgSC2%9XrJO~sN>8(Kl&d-%yHSEeuxKTmoK<d3pAl&dj1a8y+4Q1J3n$sj
z?|2K$Y6I}w;&=MYVmz1oxP>cf<^-=~9+I;&a+#-hUPck)^=j{S#~sE3z1yAUh{!5$
zw%#XqkC09N_q$Sujm_~!sYvgaJz2kEjj}Lu0ehx*>BxWMlP%oxE9FV&OKn5vE7FD$
zPxq9Xhvnj&_5{h!albugZ5QnPyjilbcw=)={*N3xJ1P(7)Ue}n)#wT)_I8YJVd<Wy
zf5`<UtBw;GU!g9Fculfl0Rnw#vB}e$KPHN?y>fA0CA%TF=2gZ8W9kg`Zfp6S54waU
zfnp&j59Xz?c6m5&G#}F~j~Kg&y&@kRyOnjw`Qr-M7<uWq7x@&OJUmWe7v%PQlp2)#
z@@Jqq-T0Bb(Jzk~KZ6<NHRC6tO3(Ol%qkC#cj2#Yf(uP$PZ-Ch$-W7{W36&=!6&Rw
zwoAQio_tms%^L^hTheS+FF#nAp|^0_=o<^?GmHGI!sYR1wY9%I3!|Dzg!h($=$@jH
zyjhh4MO&Fi9xD2I^fSL*9b=VBBcG9vxF6=DdSqSkEIz7Jt}4FH@_S25%n=y;gQZ28
z(QDjY9Ivs?b-Rz)$R!5(n0<y+cM0=f|6JcCzfw9Eg@;QY;3JpHp2>@tD0fdzGl^J9
zJYk@rH!#`djNjN?eld*Gpxgx>vuj-SIymd9r&NfSjb#qjDUT@|#RBrYvKcv@;6{J$
zVvZARd<8}{&AXQcq$TBd)JKy~LXZmE{pG)-H2GB7chIk={B;mvsQg#VD<Ah%uwnU@
zCoSDaGyVLYZjThfX&4Eqe64q)xk{au*d|L;a@jMoe@a<$RA=R#s7^vKP;L&!4p?56
zBy&(cGNmEXU$h!T8ZmWldR3*&^=M@Z%s#}=QoOQ@8weDby>iFYU$LNEUon@p$vqV*
zEZ93xQN+?Cj^r-3a4yk&M=Fl^Nz6opO`T>Oi1F#HmA@#HpUzL|oiP0uYy{REFC~UJ
zcvhFOc#|BgGV~hkBmyKoCwfN+f^41PirZSW8YA&@9KL?3R3GepaK?8S^UDL?Ue?sx
zJkv$Y+db=h_*+^zK_8xkHI+Nrjb7b@70kBO{bA|;?LqMpxISC5a@j&8U#nJt$NUdH
z#;}lS)`)IfH;VaE3de1273&BONS9i_h`GA<a1D#^EuB4%w|R<Im*0sgFeJo?I$KNu
zpI~S<*aM|zPjBm-rz0>sU(L&9oxNgp0b|ATy!j9C!a=!feo>2XaA$DQW_K4R)Zthg
zC>0Lo`txZ)&ZNQNJ8Sz_nO13JlsL0M=ngCs4${C^AZ~ouQh&b7F@%L)XEIn4g+#vg
z`X56a`rP{OehRu?rnU@SI=k_bWv=%nu2XUe1Jtf@O}y8*I)0uI#rPT0XnnuztI15(
z_kXb2{8pe;-yg=IQYsdX%k4Eqslsu?DMK=<%|kVx_ZEt7bi5V7S01cMZb|K-b>Tii
zqe#zNF&WqmSn5oI#df~VF?9Wpsg0EHZ59qvnN58jt9PAnP+ertlTx`viW64uQV3v_
zkqY!@G4grdE=>4KTzgEb!ESD|q(0H5KYLw`J5pE^CC09gubNpRbeo^Eq+WNaaoY($
zLK`R#A#)xz7`r^)D<tr>(nS4`-0AxlgN1AOW%(|z3zFc$+Q+~YP%A_7k=oxuAa~UL
zyN(UWOBZEkL}j}kiDl{{N42|7m+z8d8NoE~?h<`aer3@lmM;%38qMo2$wt2mK)yeN
z*Y)>S`O6q@w94&^C-NDC^1F-6_=xsi<6}^C5&gaOOXC@@^U00Niujc5-h<0t;Ca4N
zE)M*bPq)jK6%%>$p#0#9EC)JlKZv1#Xzkr1r*d4plp2w(IxM##bGm!mSL|bE6hh)J
zRELcc&&s6@pNG;SJJm%|k?s=CCl97u<p)=8;Ufk4!pa}on*7UHhJPs=>0iwfp<RN+
zBLSDtB)2~~3aj?`laKI1mE8Ybo1FDjGDLgnQ@KbEJmtXOwx`CW2cP~8;~L&Ak860R
z+=eNtr1jA7>vAVds`lOsPyIVX!B-l8!wcE+npOYBN2v13XFlS23~Tik9>VCt>PP7#
ztyvbrm7A|FO5Fim2W3mMC=aZG2(|ZG*5>KM`PbA%rs>EZkRSZczuFoN%{n_4%s!eE
zDOKODE{ZvU+@@Yj^AC7~zKXOL4NC6L8qquW-JdheO;>OR%a*SN$FYIl#0`4JM-IyN
zjV~pqTQp$~^MQoBW<q=(eNZ0QIDsbV*2dQ(pYcFH^!99u;2|H6Y_7py<Cf(}E`Zu-
z+VXTbc4N!a$f@7D6R?Dwp{=8n<2@gAMR$^I@=fDv#uYig?O9$|EFWqENA%0L+8*E|
zg1ytWJqG>=^d5YEFXQ<pdD;$`B~8779k3AiKyUX8Z-i%CcMz-)z-$L)e|t`hMgv`|
z26wdIOabf-l&|xyDBmTe>I~{4ZWr?Wy|3*0H6zw)l)n=lpc(VJghu%*Kz<DxDFo!E
zj!I`INxPl<L=iJv5n2Hmr`>f?{efnErx!uK)=>!&o4?y_sv;>(wF3o$PhPXTJR004
za!;HF|Mcx1W%EHlO-J3~fo5?)vz4If0;Q;ZYxk%*e(%qiUtO4d;)6P2s@6)W5P%??
zwlnDLM(;CR1+XVm`3&{Z_>=CEsGh(p%&%eeXcE?>;2G!(w+ej`D1dxj^U|oK0O>(>
zVbXhOwKd#oquldSsy?bMunC3EzO)2?C8Yv?o0QqGsRoqQtg*MW^Ecp%re5RTSQZNz
z@picra-sxsqFc`X9yMS8J%=q2LLh2|yDmCNid4|?zQ8Y0rsI2~Al&=DH<j@Q?kD?F
zVc1RUwSV8hc#GPb{qnPnXOjF%cM;E>lCN}sABE)R{XfJkia%H$7bHw!VhGw|EY-Kk
z;&iLr^Mk1*P`>)X1c;3O-t1S#@_JpP#@dY=ljK!D+Rf`=62AIvFnI7)H~t=fb$N8t
z2QS+l5a3O6_Q9<hv`B-FAN=V^vP?m&Vsk%DuV(6{a$Lie@;&OKu_sBvdDofy<&M`z
zj!ZixMRVB=SIbLCwM!$+n!1<X<_DxGScd|v#4K}v@8E0md0yWr7a!WlgE{&REoc4m
zh{Lb4c=_GK2gi^l`t)hYi&N#%uwJHtq;ar2Dk{5-o?l(*@2A03PUni%dh?TV*N?}s
zYWdwCJ6Mu@1M%sy{q;1qUM_y!!5)%*uaD*9Z_913yV!2|(Ce$&8CmRE!p_O9J<C~%
ze51$3K9wzRq*WglpTQ0zh0{sTMioP;b6~Q~7;6SXDqxHI!}2(FVbmP)eXSg)m8rMv
z3zxTCST8K0vO)x3<9Z~6p?;(se8Z7+8Z)j#X&spfXeCcwsNW?Yd82^k$m$!DCclAv
zPSSBf)SO;<rQF%p{E7+=snuGkk4<;i@xFoP{hb7(9l<pM8c)L}vPAa(B#p(%%|CHW
z*(WXGc+`*EwCUx2R9~&L?SPj2DZ+8Y*J7DeApSGN7t)fUDZ;lV;5PS2rRE;_%1>M^
z7inIpC-1k-J>Dksadn|}3KotfgpF|-;=ZjxF`t-EvKzUjFrhTeY(~&5<#Xf*m-m;&
z(TG70L0uRz$Ngbh+>9$_aj4f_`HRVyiH2%@%zM&@LJ!Q;CQ1vnA0Kl74V)e5>#m|i
zwcegCxA!LNqlSS8lMnTdV{_yyy}8j}Q=4ji;$_)#B!#^xXCEn#E7bb=u-xgcEB_jK
z(Q?y~Njdu|weo|qIMClW<8qk|uv1-Vev;^=I#N#%&Ar6>SB{LDKAl9n>PRb>QkkgM
z+mei3@xg)SZc(x_F(h2Lf2a=o*AOmeHN&qiZarqM4*8sPS?E#g;`Yhjqprv%(vQ83
zN6Q&A$vr=9V1@WA%B9C@*c)=kvCMeuZTE+h<KF4&_f`I)^s>6ZFjF2l=3x6|_1Ige
za`5=e>^<50=Ax`Gun49D2fypZ3>H#g5znX#V=lW(B02P3udVJLDOvvgn<IF3Qx<-<
z1kAPaXK95_K~Jc0`Gl$#PvJ(W3u3-Be8$(Pb;(D`j3Q<b1m33&XF<$1x$kESO3qQ~
zU*8g~sO=Bs7%o%V2McUAwJvG56vKHW1GAv^Od;lOZNp-@>gTyh7lB$owdq|4Hw@Sb
zOJ}Cs{&PptIqKQFoNGe6K_QB-Q|olg<WoO)v30Wg^OsFWF+IE7A5Pq*)|qz89ewYx
zJlTI@97F9B4)%rIb0URZmIqE0urK9XNJ*0I|5m|Xll}kZvMs)F$KK*?=9*MTMv{4J
zyfxG_8!vbL+l=)6?mDASb)<Ysx?Zi1xO%TA;lzt?9jji4Rr3(ZGoZ$W_%Y!ODh)%R
z*))F75(N5^0V9nPIOCwDYtt@|rSg2a?YYN2ftgJLS2UjEKbR9O2ys|}3sSOVW50`W
za(@5Z=w<GY+~9jYOWxj}!NUSR)L$OAnGyvPW+$F#VZ*5Um*?cf*2n7}ujj<`UA7@1
z7P*ngt=HW|+K4CWvF9*T^YQ8O_LDAlQSLcez}CvwPA*D+12b9$W@#g)3^A<Uuhyp?
zaF^)XW&bZGu{V0VeleS8i{%@qQe&e6m8Z&gRsIsf+@4e@C!QW<^0vS1(Mt~Or<{UU
z_MZM%RwaLR`e~NkyY%fD{P>4Jr8=5$tZp=%$Ot}rDRmg|M0Ejgx-WmJTAy%IzA`W=
zZf2+y219hIPsl-P-ngZi`RA-iGg4ao8{d=xIRNj{T8aW|fdClnKDqVGB(OmL8O8QB
zv0`gCOb+BrdpLn$b%Euy-1zJ7#XaeoTK;#}l(+7HIV;o!j)!FXI~eQj3rnJNa<QG1
zoY>t>d*=yWFUURbybM}Yz3X5*<i>YrvlVjxyVz{WUm^afJng;QtQ{csEUfD|tq(`~
zVOlWcrJ-$u`=dBC#}~^T@6Ba4S$(eo(=qQio1F2Gc2Lpz9416?O@O<w#N3A2cZxs3
za;UX`ArJq?k!M4$fl38Na)UF@kE?zGJH(1#kDDtcn1k=HNmXZ@9=A|y#l@+;)BfGe
z;x284t&@vUY<?ivuZ?8s*}t&KvhUn?(Dj9Lm29CbzMsOH<l^^dGoRe{esA1bkg1|!
zplp?iv$U!UEw9NBo_AoytvsLcm|)jrULD8C;zVXN(S2udac79`(KiJPW;_;owZ;?D
zPG~YPA87C}aQ_!|LG+u_E>0if_vrnQoAXfaNtCHW8r7+mZ=BD4=uMKtkdjl~mnTA#
z#w;e7G=c`##+;D$a<PE@WFdi<g22M3);m6h^aD12Y_-{?P+i04^3n?~c2#b>P+`hD
z_nXweLtw<Iwdp4L(uE2vcl*VkgCLhKKF#*X-rvqJ9q_Dz`Ky(&ZI-)!I|&-&(r;%&
z5NCf-K4&t<k&h+gBRYrVYt)09k@2hYXlxP=R=!;xS9!YJhNa@fQpr*67U%4Na%Nl}
zpXx0Ydfa<B9=jqt36?;K&?6uJU=rIPfAzuayw}VgOC4x6{p^*rI~ZM?7&JREI#GQz
z>b9mg;6xyP0(@0&ytE)LE1X&!PK}hWTvAx1yyo(#^hnBs#>|J7jtgPR{u7$?OJF(N
zd;D??OIk)!t>IMJ9+IsPWTIND2Pr<BU2@g^c6k;-Fdib1lj*)(HeRibJd7GAk#3?d
z(hW$TgY@+pyVpiumHq!wz^2F@|M9x*V|N`JfWu)r5UIb{Lqwrme`OIQa^IDT@i24Y
z>Y9Lk7PVCp-Kf@bpHiP>qr0z^opirj_6cEzWe@hivdh1^Wo(p=xKKy}*QE1v5o)hr
z(`nAvo!#Q-rCr=KEf1UW>wicH$k(n`M|Hqkza3r?&qtL>LA5saQz<IEwdmtSDHk?r
z_eTrzk}$i)nB9DISsd1$18O}R4}loOP$H$zG=Ag2KYQft-&L}&<u$*n$b0f^YuYgC
z#A3FPXNT=pwqK;JlQX8<I6~}Nex>X+nh&);<u&=*@7!^xVfUn;DHR_x1}uA!I!7Ke
zIF4n>^@Aj$gM*Wtn^7lypi69;aiQ#h5Y0~ul}u*T&i0@<TFxI#lm9wc1vA$Bae3Ys
zD1UBeux#y&Uza68j$IZEeBBv)w~th7c>e!}aro2)X<y4nJ|2a7S3Z6j+|vB}Z;y}D
zdb{%TSE(0ZPd1rXtxY1;Ufb}?G8@wOf<L=7-R6uMlt+A02^rS-$<wfn2S0JJ%P(F_
z!9ucLTfjEUYp&%&7k6JvnY@e8MPp<>&IEaMYHi92O4}@Eb|THYHJI6k;X#O-G!g+_
z5*RZ9Z<D{eHUo>J^ixOD91<+QuJ7)|*QY6g1&QnB#!nr254r0ij)z(>uA-Ky1-0H-
zOL4f0vS_JkBB$1}O78n~0b%)vr(qei{b9lQ0~#wCs7CY|t+s|s^c(kDir%BeK?s!D
zASZt29)CGx`ej4{(^+c0@MZ{3|1^ZTuqO<krV%24o!tD{q&$rlm=e+T$XKQ>h`s8r
zixgBx+-)Md@i!Lx&W%oOr{*ojLBzGs3J6m*m#vbgskvD;Oi@y3Z2EPC(bi!8=D-#6
z0JVme+SLW7>2inqM11_s<(JCRcLv9;4;7D`BU?VNbj|^Hw}ZPIF&*t;j@Yg)Fs{W0
zUL+#PJ>ME3cYmIS4*NdenZAlPR4DI9`Czzw8EntpkRaF){%L$ft^N(U>yJNAuSLsb
z`QBgBuPzYQqojb6PI>qBc*xg-*Z&0l*?A*_Hy@WR|2f%}7Wt(6qoNJ8Y}_9f?ZOJb
z>^@br3mrCwmJ)=o^^4cp=kmZ86L@o{eCvw_TL}pR^j3_o4_uDk*+Ezn3+3Q{rmz!o
z=YQtHq&@YYFQ-rWrx6s;cAp(l7jVm<UmJl}0a*3OpMGd-cYnllQi8}DeuZ86DQrmt
z<8TUTZj&2_Dhl^3mzhfL1-KR(iT}w#Ob&!r9OX%y%5Ubj{O*o4Lho%|Cw60Eu$#&_
zEvrK{k%GUJe?gx1W#(u-SJ)8QS@@f%rounz#rEz|H&u=wjqTlHCx?T{h59+p31gY}
z6L_B6zszNV-1lVx{tkVa8!1THv7NH`X9paIo<BDfP9ffck|U$at1gV&P4=E(pHKn6
z%>=bBeJv&<d!P$K%*Hi^Y(Lu`dGOC^&JyFM_;w)Z16S5yvm%6Sb?X$^lrV@uH2Ytc
zfaijLNkP2xFRsaJiO&L$L&3uAl2QdutxNklu$1!$nz?{v<7rh_A?-a<yhy{W@!0M|
zN7SVqkca;=Y362Hw~`elX;u0XmU*8=seABrz)jw7a{=W0NZ6>g*2QF0AdMK+5>6|T
zo4-n{)eK0KtU-=7l#_B<EB!1Pn6~|1>><=g4JQe2Ip`<1CTL=N67r$$*Y<7?zCIYF
zFcFjBzlspF^7Xdy^3Yd~!Y^l~V*f%0W}S6CjrIw9Xq2H5S*vN3NNdEX;oQKy)mii8
zX<tv8Ii70HN(o^+3kHc=n;cDPz%xGtC%t(WHk9%;;k1)lJuF8JUJ#Gn%GYzJY$ogn
zy2?L*T-Zc$P%~1Bgban50~pxHeNH2SF`JD&(VHadX;dV*Ri7Ce_P;hxHE1@&KR07r
z|If`>7K517j8(0R7!StLY1=arfj-k=S^Vp-rZ|m3OWg-SJ9#&->S3djMY2#hL1Z83
zD}UP9W@)9kT9-0eiWV}#R6fA)NoYdOCT9<i0#j8DyIHN=HavqZlg|$4!d||GzsS8g
z3Tw9NrUQ<c#+zwLr-_|$G7Af+{Iq5j`V#la-8a+N$8z7z*)0b`#BmOX2$PT}ZNa4J
z_!_{zY3sNVWNJW4vG7PSl8nnPkHBG+0mM&Yl<^wt_%dEYoQO(gcDbs&9^*l7Zx~)B
z9pHqve=YwVrBPd|k9$wh$<O^QJt>;%Q5xDL<yEKp(t+LI(lE|Te{0MpuN0kjlNSnx
zoK@h%<X9My1;^f?Mw*2YCb{wN1(5>~7boO{e_uX+rs&7zhjrY5>PvIFJRC!_yQF8i
zflNQgo|iNC(nj;{rc<p;{aE(gN`YAQ-Ey?7bJyW=!lRL^v^LPct2=fI2`l*K{DH~(
z0O927Hh-xp@Mp<Ss;@%2&n5o*9o1+19HQETz8eug2QkSZ-jDd3A1tzFQXSWeV_9XF
zxfAt@H5k*YwRwO;A0zc1H0D(o=wQ+r2B-j}Bqz0UywGZBz0fKwQR|{3W&3TMVGPOb
zx663lV!8SD+?F%$kIFXSkdcQex$Asg8oW2r8<xN@h3DjU1-{@n(B5&A<~zhw{9<=q
zjF<X=6t40X2tv^_<u_lb6^Eq+qoDPjCvee+4Xq@Zg{6j5(%8uC&E3<hLiHI;Qyfdy
zMtv+qB$Mpqagu|^68U;>f!^bl^j>-CKR#($OjEn#-Ar2V4@%a2Mr%x)?mGQt$&}Be
zIGBS5un<X<x@bmukQL`N#iXU_w^7<=PiC<4YT3EM<q(6!E_K3dVAEPiXOhKUimP?{
z@st;e3oC?ZZ1Odsh|WWakzdM}?tH>>cK5N@O_Au77Cmgr#P^gY#wyvT$|-C{S)StK
znagw-o1lM?dQ@vISxOtv${$)x<qNUe(J47%fCyiLP9NC$vPjOE>6^=8Ym!&Xm%d)x
zm7!c)G#EIYpY`12paG7DnOKvvuwJT_#0a*WtyP*M*k9sy!1qyw8JkQNvRa$*wGz~^
zl&sU?4)du)Bp(RF#eipN2-Ie*SNe3UhD}!zBiX2u_2k=lr>h&<h4WI}C7AE1wW+sp
zDd1yDgXvvJ>7esvNLLa^NJ~9&Y)vGKU@hx`$U%(-z~5ftZ}2I$K)c|W*`uYq^?q-$
zK7dU+)}rx}>PtOJthK4tRRtD&4eQN{J<*%0&$<KO{ebfkUrX$XvJ0s!)^xnaN)9tl
z3QSe1FL@ti?`!T4N0;p)IwD~`X!Zal0-mAzlBNUp0;c>*z*&kI#nQ6i1T}RcsTSGT
z;qbeO{9$+NT$~*Cc#F)(6@L`_1k*cBV7Vr)t<N(^LTXloASlfOOG_V;qIo?SQGlaO
zCmFfs?dxz;3W`E2aztQHw`5Ig;zXn0GEHNpS{|YdbS@P=8s}q7-XeYRANsKh9Q;(U
zUG4c!EX7*x3o1uV!N+zIVzUnHq8VLkU4o{0J-AF064zi8^6hE*Ghsi~BmD*cnn_xs
z{2-bo^4x9Zcr<gc&B~={_B6YycnvJqwpoN|!Bpxol>$(#lUif@F+Fc6+YPLtdcB4L
zDHXB~>MU<k5sZR1HU#e>7`@y!Hd!`lu9n3i>FX_JK6B90Mc82@oK0t|+N{CNtUMUQ
z%1wo6hMI!>wx3WsW7w!H5Bb5U6pUhsB7P=B#jv_4;~dS4u*9%Qaz=~FwHUU9c@(da
z6-*I{g4i4;NiNQ!Z4zA(7Q*9y)&gblZ*top@ZfRO;;WQCG-KLJ9tGH+Hfa<;q}(#H
zk+J-smWGoeDThC+<eOM7+pE-@*j%<v=`pcmY@ZT{1$0vBi)DXdJCq(Xdxu?Ank{S`
zTYKz~g~jk}y>dLBm4n#B@$6+-J#??5&ai<LKg}oNE0jYC%oXPhXT?z#l9@7?z{chI
zv=h5UqDn_P8qW1`@Vv7g?-J&NY_ZXbARiO?mz2^(Hjz)hp)@73jL~c*QH|<=yRmz+
z>_fdl%+=RacT?ZXyF=|+o>cl1!50=~Fp=SMj-pG#05&U95_4xI(V+&>n3S%!M1Y-V
zUZx2t_!hu6^VIs-_muV|md17~hmx411#6NYLNAbj+&tVaQ;o$IyK$mLhvQOBJ;b!~
z)95A))^QNrRgaeMx!r0Lz7T(cnW>3AD*Y_NhZCheQi4u9{%AOlQ_tfOWO=8mwQ-+P
zJ*xk~2%!TeQX(!%t*ZP`U%m<(#oJ0%GD~6UN+6jPu+vIcGMmi`l^e+{EgBoYh_h;q
z?Sx`UVGXQZX-;9kv+Z5lAJvJbIkhGxU0TBShKL&RQ)P{nxoL1#=88THVYWwIU@cTG
zSy@9mn$lqh2z+a~NW_OVYLf`6b$qP&ZLD(6QL?Dc*bj@eU_x%*i0{Jbp0C!$oY4qb
z6Y~&;l8Bog!y%(N{*S;RiwKUOL)=7CjfSh%7`|3+*;w6J(<%3<$#F3!40~~BOA8;=
z2}`bD<2tlS$NeP|X>>Sz{r83oN^2@}&D`g2=B^P_yJo%Z^_RjRtEaUf9wdqPPS+c4
zw5@VY6-Fby)?KGRDA+UWRW4=LU8_fPwb!O^P=-=L+*(CQ1KV^f+4!_vMunluE0g0^
z*tu@%1aX_GG`<ZBkw<4gp)~1DP9NxJ+|qs~EY0GMK%`e=TzaJI5GVg0uaUDZssu;N
zJsJyXbE2b@vO3xa(-|$!bh6>0T}ziYyniqcNH($qXg&F&&nRcpSOw&DqMg0E3`L@b
z!}y11%61YbSKZo{axx1#`};XfGi7Vr%7-Z3`Dbiab6ArTjw{M56v}TF{zmVC#i1|!
zlQ2-YowrK)=CeC&B|S5L1U(?8v&<HqP-M|%Z@-*5V&<!Y;1v5gCpg2oCYCujhTL7!
zXJ{u!58o80E1VVWEo_Le7H*GqN_pm?_Q6rul}3FF%6*&07LP_gseNm0<T{`g0Isr?
zoZp+Kaaqh}12`_a?d*ZHA#EoaQOAF*oJwbt{4mh;>N_XIHkwztThytXX(Wue>D1oN
zV4hJMZ>a$9&zS!r8ND+&=30pC>`S!Sqs8mf!2<>hwV~Z^3+D4G<A(q%i!zu!&Lo}(
zmB<W_g6exaN>H|Eu+(JkHcWSZdr$cZP+bszf?GBVz_fiCY?RIGj4xxkP!P@usQNa9
zv=Lzxmf)=nmR6Wf(;r%b_DIBaG#8#y)&@zTZT;0c<_wL&Uqxe3Yjtat2OTV}WgC2J
z;5rz}b8$tYL<oYFVVF3c1c!7|ItdlrjcOPFf+_v(ojW+k<)j0;<I+guko1{uV5S{)
zx&lF!#cH?Xkgp4jFpI8iNQ7GcqRR(1ftd9aL>!NibqRiasa>y2-`MVtZ{$$%(%B_x
zLxccqt@X;VgU#X-t|`+*2-Q7GKxE^xUW2D7;F=f9Fq_jLg0TANCQ=#01t=Zznvk|w
z=@UUK2>HnN86QrbEZKEEG4*XhY^I-uizZ3ACF0U`WWHi`qT$_2sgq6MQ*J7aPUcSE
zR`_gGwtE}L@5uBNlL{p1Lq<d4x~OdBl#`9-lW!_RPBw|{QpRMmni6bVC&yKsnw(Z~
zezJ{5CT%VMcnRVmQzhMo{PD<}M0rS`L=1romjg;)CUY!?)ipT|JoTQ7rd0DI>qWID
z$w}3azAw}aIb}6?eTb*+AJcM%pG3sh7ZQv7O4VV?gJ|@-FHersc(69*Yo*i$uEG*e
z<ucTo$m!rX?Hp9CvBoJYUF_AQuMN+VuRU)Wi7uKGDJ$|BC3^&$0F}021gm0=%Apag
zDAhc?HJJMaNbl83K`w3PNBI3vMar!aph%-qoW&N|F2lLd_D=nQAuurCFi^fnNWuAr
zPyd?IlLf=$gpxQC*2`j|EYSjY09D05k|pErSs=?i1c&@GB{&jB^^?k_k?aB9JgkVL
zASkyfo>43<Zcbq>mk5r=of!+UmQz_din*7aB)w0)p;rqCsiR`5kKaY<FrY-Fmr@my
zr|5H#U?Lu{9gW?w69h8AaqmOA<h}$SvW@qsHIA<-{fvEo_LPFiMn%YG3*eYTlfS;z
zjoqifHGB{nAa<b1s*go0!EENR<!IC7&^;ZR8r@@Rt%*+3Ez0q1HkQZitJ!SQ^bJIM
zxa<h&VnPP3(U#Gu)<U^~KpIz&600>W#?87m)e&J1&1}qJ@V<YAf$LTRIcyUc`9=;K
zmG?2>27lUgu=_+~k7Wyv3*N*KyaTtowR?KFGX!J|pSnx<V#PBWdZ<M4jb=54CfYK=
zF8GpKkZdF!OgZE;l5C8mXC+{A9khkv2XNr^xpHkZgD+k&=0eA>Q>Nv@TDYt<<zl+t
zR629n>(FxEG3>3lGpI>-NWCHX#NIq+&11MeeNqv}qRx0_-dNbLr!^bhK4FID`Kpcl
z618xXse1zaaO5bxh51fby2rv=TC4Qo({jT92A%vw@28r;ENJYv)VUy>utDDCwq|hC
z-h`K_R-c2GU<yQ&E-+9Uz9<uUlbpPvGLavL(sXa&D-s1T>KTxcB^niQxPtgPq|HJ;
z#TN^9Wj-$Au%k-XI2fsg%9U{tEorxv;c;wH$$m6#o%Sl1O%5(~e*6yUCOGpZO>V>#
z>MGQ21W;oezah>1RG5SLm==q2Fdtjg&lSsfkoZld7@wAhG@IW(;Q^Xn7)>;+d=Myn
z-ouY}mqY+H`%L0LqiWfTYXIj+Z4xt~k9>8$^#DzQ@l`le_1K1B^X~sKCu%s>rhXpy
z5s@q69QEVv1)1Pkf1;Vo*5Wqhqwy@-q#aZeji3{=l&{7!H{7@aU!_d}9mLH~S*w&z
zV5`9qJrn4KOPBKQ1Xdn-6xeZ!rGP!k$1hbH3s^EAyHsf_U~}V~XW!Nip}aKH>ionc
z<wgOlkU}M2Vl8p&2>q?WmQO>xZ{4BvOCZrv<&wlQTFkehbc?ZsILVsOrWNr;<6y-A
zcaY@`vg6vWOjxX~ea#bQ+4fJ(EikV~Sxw71VIO(31TPsLqyeP^(62aa)AX!~n^u@(
z7=-b$w{VtWKsb~Qox=Z3o$Iq~AaaNH)v#r?vk}9k_7C%UDK+M}^9VGW&osq(J{EiV
zvUOw~WyT{w;ujt^3>N+-(qH%|qrb>v^cIabcB1S_WuTBfoRM&d+I0o{>Gs=?vEwK_
zdo)9BxLCFde$r?~Dq=3%Wa&eLMfJs!zR^fT<MiZ0Xf_sM|KX9|Hdv&HsIxdK*^J#S
zoQuY_A&<FnnRe6-%#?SF*d$vzsg!dKj$yF4=4RG-VnNJdMRc>=!s^29#wG~VYVy;P
zD-|sGFB-8I#H7O)Ayl3(Tean}yj`R=XX*uSVU*xif^H~=NTtusCMHMUKKtjiJ1=-(
z%F{VJiJJw{7ZqbM*73gRQG7H`)w-!g3TUw(*_sX4`Zjqih_W=TrlD}W&|MeXzQvRI
z`!JjYcmTb7$Ya$2Q#zC`e2Vm8q(Azrt-r`dx-Fc36uV<EI5(l;it?jkmP9h87`xPT
zMJ<LyYLz0DV0(I1X)9r)#_vF3T(?QThzez)2K392)(^N87w>h*!|vv8<N7>hu!OzL
z&M3i&kXE~tu8GW@bB<^SWz=7ZOJbyy$lAfK(gN3`iRM~$SYL<#^qg{QBKDAPC}SpR
z;&t96_I*C#rt;M!hAaF^V<~gn_Msm3i3zu9cG2#W&eh<v8h(}1UkdSy{!6j0Hej<R
zw)#bjW>+n6ELNsXX5-Q|XP@v1Zx2tTL0yocow?$BMrohS{sUB4S%yve9%V#18#i+?
zP1)9<l&)b}W5;20)Y+}u7ZytCT<O-0^|R@M{?3hXdebNtq<&1oKy}1UC+u4L$1Dty
zEcFegs~p&QmA-P87U_i{G^kuDhandIk_YR3n=;J<hWS_tde|c7R0ch;1J)_UQ`ooJ
z2Bl{Ti1L~;IEBrQGhtwtAkpS&3T1xE3dJ*(rPz*R*-qECN)uTzD7l&N@$~V>mBy*s
zuI9*8wjlC2HcNR*Vg*v5{VLeElG7zD3Lgep1MUyGv!<jQm1`C3G2S+)c&D*4UN0(b
z(^w`Sc}Y1m4MrpEfx&5z`+15uoxMng;gRWVJ|B~>7$0Ci%xMdu!2^x>tB^Rjl9jw0
zxBmA4Yk$DST?%0yTcTWgfPFjfJzUevS2HXJG*g<~`ZbZ-ae<UD;;ButD4_UHpy6O0
z+Vhm=8EgTlb!i53OrJ@#zB`fa-TBzBuxHeoh%=Oa#x7<%;T786En2~<c!py1oDVK~
z3uS&rz7NQQ#f2q0K`HgJ8749-y>J7)h3Yn?-3tOal?z@rcS_ZgD`oo|E|l$Q>vfVV
zuIqt4;QLeycm4PFLnM2NZs(6<GiAjSvX60x7KC4Z6&~3X3}s5ZP6^B;W6q-V%w&%|
zoHpj0e7XsNy4Qc7rfWD~_J-#Au$TXX+B|Pf8=A3~D^;ghR%-1yGQK$9XV}+zu=E%W
zh7iX|?RceX7IaC(B_%M6IigRReem4XMCU2(v%pOG%Dc0`U?yc~7F>yO&_M^G)oznR
zjUMvRqdszYk)=k*9_oU~Gbq#e|5~Ob!t?aoTo7j4E?m}~)^NIf8@X93AK;2BD=>u%
zB4+}D&1#MQC{4iDpx=_|H#^(T<B^PA`KXdT7$0GI`V<#LsaDk7hQ(j2ls?GDw9uH`
zA88kYr)X`TDYwC<b;7fjgFDyb(N_s-%+w|kjzRQS47H=8?|i8l7mpK|caywfQ0xuw
z(wtEP#!_*!w~fo*-stT2ZiRNPNr)s}0Z+^};HRBDfjeu_N6Rjf5@bZ<m>F_OKaAtE
zE-eji8`zsc9G5A^c1x#P=QwTb1S{LQjlt#(e#y>8w?4MP3M6iOJGo*)#0}G7lf2ij
zZ5Km`?4buM<j)StJ>w8yNM!U^=g9IZEnNOTcWCOo*I~w|;SMzx#>I=Nnr&@03E1}g
zV9u)GoIL4({<uqqAarC*cH=b+o=bgqll=YP5mK2*FX}K2#de7uf5h|EU~|xm0sNz_
z`TM)^9W9MpQqF?S-`}bgUX8-5%|o$EMEQ^YejX!ypsl%VHsyKuaQQpM;wHuZF#Hz0
zrvWFK7)ic&6PJxQP}$zioVc|$cpOyVAmv{SY=S+xiL=t^&v)9c8av}VffzSyHST%K
z{Z-l#yp#D)-|BBP7K?i_|AM~%s=ox^ueKi!QOJH6GjIvdd0}=i^5Suj3fa<RJN#N4
zE0%2Kcc>y(?+#Qx3u<-Zt`^L7SbKQMqE=_*k=<kLj-Q6n(o@YRjeW{bA7)vmbYow9
zkQ)?!rp`~Atf&vOjLe9BY*_6=v*DNCb-Zt<C}NJw|4QXx4Tmq{Ud&V;p3STeq#On#
z`HVk8Cyw;51Ag8|6xv#}!ROt}WxHft3GCv!&3nWydNrKuCqoT8ffAt+7e@;<je&)&
z9GcD2s*hqEH!*t$%=KDxdGrOoc2vorIL5V?W?rpMyNFpIK-q_Aj9!@&wWcYKS7L_d
z>>%2@jQk|UUd2XF6zDeD9<M@%Yx<l}x9K}j<~AlSf4g5iPUz<PX@4F;hu=e5dnJ+W
zO0Wu=r(Nl(V(ylMXz?_)5~?-nFs3^j#Ct`ZAE(_3#ZBjlA>I^VkMqY}kBnt>zN|Up
z7bcvfo{g{2=u+2$pl!r9-d11`oOFV)!O<57Ib5q&TQ8D`CL5g9TRk+3#%AU5IV_HS
zp)}2bDuOq^YYw~}+GyVCsyj^7i|I1R8s??QzA}fEPoIu8yBABT3--khjTsz{!?11|
zTMzBIh$?@jH?GDeG~Z^CC40m_o@?HNZ9@6i*<1!gxj~%SpHTddK*(a3-}DHZf!qGX
zS71hjHiUNUGzygqk1%&qp4k@P=4u`HcPPBW=Fa$_yUR4Fh;wQGVz$S3Vg|ctCSbMq
zhh`(CBs3c-Yiax>6fm3lTLMZo!I@y7q7KHz%As{joJ~&c7`q{HqpX-v<_k^NmY6&-
zd+=`3k#ZF?DgJZ0mq6Q=P(g5~C`~lM+Dh3Gv)7QS&Np8SA&?9Nz&_s~@REjrs}~%6
zf@Pa~#eLVi`}zOY@HYs6F>XsG(Vl<K-~HZQ1idZj80*d?O^o)?2vkR6o>`6$YS?26
zsB_9wtK;{D5K0098bbLygN2hd>Oj~){#%|e?LC@p!r7CP<DPfoT2?SNE<2uX?GfDZ
z8Py}BET*(=58_zwiKkc6+9gS~bE8D_tC4zVP}+g`ox4gUY)MQA$%E)DLWJZsDQUIN
z{3JF@RcduQobC}SSTrt#Xkw&>C>Bs?SrmM#<X5w_>4&Ks-1Uuzzyl8PSv1}k9uqCZ
zp%54Ec?%-jaE<KiKxt$fR#JZJ4>GBV?ABLYLs*0S_U?i#rM;S^#C?sX{z}z;+l(hD
zBf;FqtJ!n0v0n?SK`<`Ef|?(dr&P^n70#nz@^;d8kQ`;fTl;PcpBc7N)ep9Ys~(w;
zqaM>fWeCM#<4ZMc;%MC$v^L}*+@1RgIn!0N+J?IXR&{>ldSa<}y2d#O3%Pr#Rq3gL
z-+nTxv}xi_6a&OKJ2S_&(3lYya~Gq>u4so>V!qg*MSg#E+8skPU#~8VJRRFb5+F8<
z$VTP71vrp$#6}W*z(BM@c9B@6<4bDmo*FhB#1?S{R!+9+7;B<=yh9?0@C(sCZ#^O4
zzKn-F^CRed*!NCX9&z$tm8u^whw?oi8(}-G%@=s#gJ633&W+icW>X!;-O42&bIe>w
ztO7g~D7^4CCC01zVlHE>=+~G;)rrw*F%fRa+mD+Kct@kx9OW9D1#?d;o?4a?ecUKo
z<SqW(t%@ID%NGr@XbY7X`5CEH)e)1Y4Fm{n?RxG>;(*N6Sof=0RV>~;YAP6Vk$P3D
z1ye{aayptY%rPF|;i0}A#<3&15b-vWp`o%-+5tJr+*fwiH--06VLTfxbOm?b2?_0(
zUt{L+VwCTM)V$C7F;)>dz`_q{Bq<<O8@W&M)Ug>Yq5TxxMHlVDRLI}1T==>#Gz+cL
zNGQ@xx(HX0V;6oXED?Tb_+@aZ=m|8#^Jq2QcVNp0af|6{NJnssX;C?!ftIU_I9m9u
z!J-{p!&l>)o57qi#1UOju8UajEXZI&cRY5F5&Sf|&4II(;=*x!K(Q`hqi6A78~eCU
z5W1MQ+az>xsl{X51uJeFS#kVP;|9x~Z4Z|($Jk`*2x&W<=tTN42nat~;VizrFbC~z
zUx2N#NjbiNWyG`haP@4kZF~80?`nqISM0EY8+Zk*U$NJ-%qO_p-pf4ay~28ki3w$F
z)-2vDyq7TWe!zRYmsq=6#~t=wW^Kl^mOWGk@D7yok^&}SVYFDf0tFFmxsO317sU3{
z1M&dAVfnO?(v<FcHuZtnei*@m)`r9JSJ;vp(2ieSn6aP8Na5azHm@zVhToKZ-0)u6
z=MC?cecA9%*-gCAWwNI^y`|MCR?0@}i>u+g3B8<b!dI;9Fcur+&R_$6F9P|+gcISC
z>Bp<*-9}5%n({k_BU-+8;)7jiJ)OSbRQb7v4Q3B5aIhemu3lWk3?P4oS{E4-^0lTf
z2uIrRv_Rr<+CXYjrr_+QX=hKc7#=JirGcL<NbA8h$z4<dk6pCw_||_3iX_`y8(zN?
zC>5$G9w?0>|2qsVKHOgNew>IP4{zacoE?}P;n(`{v2{ofhRSj+@DpGrYLaInv4`SR
z81X^)wsYtKAB_aORwEVTy{T3<31?n<Yd9SZGap9h4K*H#8P$6O%|?v^looI?Iw!>?
z6I~wi0(kxUgsTAk&|b8<C4Ch=AcxT`fLwf_kG0*)OfNxRdpJ)=d9=bq9qCS>v4eyJ
z$V;bJ4`>uYhd8xrL|#8STnnxhvEW5gWg+Apn~`@Z)JBBKJ*qCsf_o)ajRz-21fb{W
zR7T9ie3LDNxAOBbr#@xnA|?@6SQ<L?-Qn-S@VBR-OMg6b6UQmX7co~0+}?58I)_LJ
z-QjYi!6juLCPv!gFF%d^sl;H!XwS((i<E?2sKc?3#8Kwn&$BZdX00q*&9@eH=(*V5
z_+ac2Xq>;WKtmVTjz`9PgUof#On`=216fG-faNG+Vhg_cmGWpUQVjVPg`WtJUG1jh
zu*QwgHILzPoBni1a>a;VkYs1jRjl~^tfc%R3l<$Mzw^S6f|`z|9s(Cw(2I2Z)=D=n
zm~~Tr>_u^(;i6$TZq9WBqoB7?-yO4Cm#7T-*$8j!?)Y|E6qwfefi+xyraYF-+8ucu
zC6Xu}Sj)8m?!OQ20X%RY90Yt;sanjE<0CJ{bm$V%PP^7lN93T=w3tn7iB!Ys2gB(@
zVfc6$9uC9(Az04=wu1vy*R6lQV_0HHz*~!X2=(qef@R~k4syTkh!$d-<EIk$NbV@n
z`z<c0S!c!3oR(G+rF{**G$czc6Qer+&@XDYj)+~UV4xJPXsq;xO-2EJ>?yQRy<pXy
z!R#0RpL38+J{jySIgOpQeV~==hsBLs)fSvbM0rAK%p;X>-AKb(4lX8=BzfLg+(H<^
zehSiF2fN@uV+V3lTckk5wXyu~fl^TZ*?!L39A)*cH5M1G)&)sBdDj>%^s^5X$8Xh4
z#d@f_K4=r)@35_*IOSpC*IfU-P}Oh&2V6-StVtoYCIx=asABJGV~gd3m#u=KnGRQt
z|ALIenpmof(!`Uu*{I1v9Jcl2_DrPM3(2w|c2!7p*%*BTOJF=aLTWC)L^~~qc%sE9
zm0<1F#mC{MK~P(qb#XVbUC^Y8c%FQwG1=l@TA&LPNO8oS)bwBkj%E%-^hj@G-~U;}
z@j@YDpfJbipIL7#ZfpM6PVi!A1a)zX;a(n|S!<+|Lh*cwZB4k7@o+C=enr|rdNnBm
ziGuZr-6|vaL0Ht6HBpzu&-b<zFb~NxDFw#_ct;qc&@{xPzSu2tD>|6>Mes(Tmw9G(
zF>l3IuBxJqdj!1Tsn~}2bKE1^JZ_4D-D=QYSL_Vtimq1k--FG$*{+S_=sQ7N4QedW
zWryZm@Sto7-91EEOABqSsltZlTmx0WH$Jr8){$F<u5Z@hWQMK*?SjuolX*~edoW5^
z8|K=x&pXI5{`R(JQ6R(!Q5qej2+7eZ46Y(f4FMy+xpj{?dPWCHsnK<~_%O4c<RrWl
zUH;ODF;p3Pcyxu#X=<jT3nO$!h{l5Wc4KLLXPCP=aIy!_;>Lr!yS1g|G<lSH%a}6_
z7@&bvYQT@fA!@*1%B<dIR;9ErW7ZZO_XvJJ0<+O)wC>!vEu^gKOsnAFZ}a}tXbl`N
zTD?Du;=FGfMelKAw)dDZ|Ly`+9cCrA-;y44grE2R3Ea@`78~F1NQ1=SyWqqY&nu3h
z-*ySkErWjXeK=lziysQm^1tFc2*&TSwA|U*U4E1bVv)=%`Yml}Ql=Lj#dp5`rpsey
z_<ru1X8t<`#LwX_7xob;M?u`S0D>k$v=uH`a1H&Ow!%r&SeXaqzK}|ydUm#!AER=B
zcN5L9F$%hZ=D$~VJwamHX`vZM<2Kh+Y_aF-qg@r_@CKC9BEO_XrFBB5R@u??YBcma
zIRdV%;%OxDv}EF{oSi%GMCTZ~Xe$*P;1cM!o}%rBE9Q-sMDrF)q+-!Ai1KQt*NZ{v
zif~-XUe3hqVDGp=`XvTTzWjo}{3>-<m_u}Mm<nfcRjq#4pk$4huQV=awJllLqsuUa
zXn+ZLPB4<=u)B!`9<!Xquixpo0ntae^apX5gtJCJXs~Z+4z@{e<1#l)jp!xW!9ra4
z6FxCSfJ;5W=BZ5}{B)eQRMDwiaG7*b+aWD6>?Q7wPBna}RvQ+F-n%>AnixIHAV(({
z&TFpy1c)`d3A!NC2~2r3H1}Mobr`~)J6CEOj$IM2M`Mcs^XE#HjR7{H$OyFto!NnJ
zn;Cn7vq!AMaM-j%(OU3hWtOwOwqXp2Kii9+B6|&G<#?TWv+~CPt7zF09~*tfknsNM
z)Ro5b@v&#mTdAl}m?Ls$&ui5TXV0e&V+UM_bR&qiQS)j!jCgm%i{5ocjl1v4C)FWL
zC-)zDYBAOttn9jWf4lY;pdHd4s~peVBlm>Ho^VGwxB|y4JCuPHY-CH~*V2-ROC(9)
z1h@)mB8KCqk&ZK@q$GD&#3d3O$iMCG(uv{tr$`?H1>iSIT1x`JdoYT_%f>gwYuc1r
z&B6GCKVG%y3;I&PG{s^!9*M((lMScK-XO8+Y{4Hog2R60b2>@&p25$&nQ)4lQ+~N{
zmN|dh7_o__$a@9pt>pzIW2Gegb{(cjO6CS2THmHOiiPXT3!YmGc1$e4{Cr2|BlH6+
zD#x{v#4=@Dx@MMeA|0@))seLoFK|`#suykeTCk_NNr#y;b7<=dilgIg-*P?^>$h~g
zu*JDCHel(XMgnVC74F?OZ4Hh%POx}>EOQo&Wg-j~=Ulj2-sT5!L3u)9PJ~rzU{z8p
zl+3J%0F4p`oe%xw(24*b(dG2GCG_(UHqJCwU1-#PodMUAPAY2}*yI+vN57EM^yIb{
zF`h8l(pt8aFlpT$Or`Hsg{#_htZW%!GHW$qp1vD<pv$!O@V&j|v0yxLC%jJSR0cmV
zMr9Tf`P?1l<q%%O8@GS|E&4euq@5&AN7;P@EBPx~dNq*1y6k*jhRnTEmVo$=K%S#?
zlM?agkUlz`-a~26%aivJ->DAXjr`W<<?<)P`QH!cFBGDcCsyLX)30n<$wtFK5jmPJ
zQm2GhOb2O54);$pv^(6mbia?NMV9H*wHR-q7#|vk;{cU6t%j4NHe)T#UYMFZ<mOFn
znro76xP_1i6yku+7D55{Sl`+tPx>phiTVp?Lpcp^-57+4%c_V-U{LyzokoJ`02T-G
zZ@MtGxR`$!dn@=MICI4wt}2{{-GNRkiw@twqZOR+mc6+%SbkE|No`N!_Cad(5->Z#
zbQ(taGjK9?{bSR1Y{zvt0XvO8IcOM;7Q~WYV`1QtMZ?vy%Xr#FKh5yQK-a&0>1u^m
zdyNfx|COmmm8;!^%kADDv7rzicC3Bu`y3fRM4c}*T)@WEr?&-vs6(0<>iqi0aT2Hz
zyW~9HAER;Mv_VguEk9Lu8ZW+X<5j>psz^43hHMw=((&8JmQ#cvAxv$B)4DW-Q71$I
z>w0R7>XVW#e3sL<eBiNX1mvh5($>Py43UAZsN>$QsBBQzPkT2CxLt@vLR3!0p?hRL
z%>+p@??l#!shWRJN83LE2hvYC_~5a-C%o|x1U4xaRZ1bf(GU(52Z3M(bb7=Wg*nGY
zKFwyaV=EikjCfo>I<gUG$F^gMn{X|P#VMVw0Ou&ftvHScv>EqOaunkh_7ZQosl2j<
zPSlTyTiL4&=j{V+IBy2H4Hx`z^4b0zz*UO+99mkTtb87)(Cd_I&$FGl*0g3jpcTh%
zY-dw>K4ZU<zmvVFw^zGAn!G`2-pQs%q+~2sEbVM`YI+>*=i-Iwqst)8gS2O*a~O55
z?XWVh9p}nP+mw!W_9H&Urj+ht&+x`QO3yA_n~A-xyt@lde)B42XculC+U6+s7Xc?-
zR6H+&^9(naT$#KNm;H9BHM&~5y>X@)PmDoVoZf2B9RN2GjDC%H0x|_>KuMZ#nrm99
z;ZVcxA^1$QM?BZ8z1#OnA3~kaHKj{2<+ruAstt6@$g<f#i5|ez<2Pe=;H8GORk`{i
zbMkujlFTxbQ?zH816O>z>2e9YcL8;7#xkW?W`AsnavHmF{LqKpDZNU2wfrJnsy?+k
zYRXw$#zh<(|EQd^d-2N}>$rNv<Ie82QT)-fd#%ILa=2fs^`A=tt`*vCixiFPvU<*-
z&W)zak@U(4w2a;iexS$t6n_%&X>?7Vw8r*?VCll>EIyJ>z$?y|ZByskmnla&;Qmc`
zO&RK7sj-p!rN{AB6OBQ2Y*Vbe*+@RJMDgsVi=s@a-_6FxN6~ZSx*h$a1ZrHJ8?{jB
zLVAmBGB!%n$g)8C!)mpT(V*aM!|_eT=QJqoMpJdfIT}>uMf_d?{V>Sf$P?N#|9CBa
zfF=*u!1TNNamgDOx>0u(2tdCZQ;T#F@Elw`f}NG2sB`t&Bx(~GF*owI^59G03d?Is
z<4Y`qHx(-FFR?%KiC2|Yg=J>Mme7n0^v&Mk@^YN#Ij+&OjeEvjmv~a0n~FzQ3VVT1
z%v0udq7Ck%($vW^rbZ+YF{16?+z;8S&gH)#>V_!HUnC;nhWh?s*SMqL2Cg+2x>77n
zj2%$ta!JZ1YA@lUa;uXS@d?WmX%8Da*8Vj_%fmQ?a%(5<x^C^Xn^pt}TJ5TUvbcMr
zV{R12v4^FO#KSVER6ORptl74>-2@x<pPXyz0-H%WyN6AUjdn_{%&4_j%@!--Uic0K
z?De9(P&ymWKAtwDR>z%D@GEE|CnSWfs8s9rXzfB#1#lM`k7e=*er_4wlwrJ(^>DD$
z1aOO$?!CB2U{Ox(WzXXntm=Dkh+2;|e-8uY)4o)?_d)MjmA-u#ux-V$ulC_b&2XpH
z(8bq#B=hh~FXQ58%;!q}%aARWW8E*a_gQM<%$PlVEnbZM1Txz~+R_Mn62C`dJ+^&6
zF5vR~QKkO}?2pOj%k)cF?{xK<&&$?fDu|bZ*-HNpS=odrc$Kh)u1-7+x97od9NH|R
zpUTla2k%6|L$4GA_^N3R2&-3E^4O^2a9LcW`lep`-Fjd{E+7gXs*gIhV{2YveTHMf
z9%g7yHH{hKOm+n05NEuFa0B5A!n?{V9{zp&2&>XGh5tw9!r~#W-X98&o(g>zqR!p4
zg{smym9OKgS04LnD*s;sZ>l<WqmoZxZ2L<O@y`*s{UJV{kC(3uvE2uUn36xlc2*6s
z&cLyr+5CS+#D6Xgai2YiP>-+@q50VHx%^|y@W(Mj+;w#Sr)kQFYJO}+mt}}`p_P}5
zhgf$2p>>G;;M5TN;UNU|SYtK+JDwd<s(k#frl6P^S!VkXi}fP(gufL3{|ROf>diam
ztL6U@-7>Lhh?Ss`|0zra4*xxUqJM}@Y(xOA6N3m{2*7V*Kf;9}=AIV{lTddO+Mb5*
z1L6>yegj{B))I~zVzYpF<%0;>LnG-AtDIK-aOK0ZYaVuT;eU^<T>MmnxOBzp#+8fL
zjS-dWOZaE9@SEt1D!fzX&Yd}TqL{T>%+6YxGX{}xnkeQsW#u26zm)%oZ}B|s(V7}!
z4|@=XhuG{RL#zte&KZNS2I2S+o12JmaEQ$V67v8*lphKY_YJXX9qQ57ANp$XX2592
zhtX5nhcR+WzgzE{Z%eqLZxa3w!!6XY514DA{eQp^`L&pfS}TGtlwS*~{C9+F@1qLk
z)xH}lL!+L378G5H?+tv>PE~0*)DN|=s->Y!DxeiIg46>DLm>6`5b5Tj(mXFh;J&m@
zbfThBl>h$<b(q#V)V*7#4pUi|=%RmOMU^70;19)!qF6Pz2E5W_IQGd3{!=z?+_E)G
z#;scR<l4M%EqiA5il?6flNhR|(C_YxbC)fiI&=2iZ+><ktfgFQ;71vkiVsZ{ADQyd
zSR7s{$t!UyefCOR@@`nkXT}tZ*>k2pR1Gf7QFc<+xt08MWpE`QeJuG&{#B;D^%S4Q
zxMQC@#joTEA?@FE-%LeZ#oH6b=}jxvh*}FkYUScJK<U`StN6Dg%4R?QIQPKfwJX;E
z#d*tC(}$b+)QUAL7O!0K>@tp<8(6z$>C@k)5pXq&pLuG<Q_HzW);`5eS-Dc2{ge{F
zmj6Y||K9&I0Be$8twTse5D~HwBm@tF7hxWPA0dFS2BCF`Us4|mt2+R9hvSD3??X6+
z@GgSs0{&bJXMT08>RbE^OnLNMym9^-bhpNWU=QW484>zYvuh-T(r|he;!DHvCdAti
zIuQ;c^dR&j421J9Dd?dnV~rYyhllvJ=x42fkcfc3){4j4n)u=f_-?pkZ+(Yv)w3aG
z@O%7-m%4eKkw`hj2}Ae@vJ<EG-AEmCUura37=w_HP>cWqt$h%|hX4Yt#g*~3{L)eX
zn`Bo~Hu3o_@KXf0aNH`(9sCRR)fG<5vEEDD?+=x0v~V0_ls?4GmBMx7?oXpU`gbqw
z5ggfB;ELcLz`!`l8{%riX)RRn{zMI#1S%9lrXoMoNlyNKX?<w00r@z;yAy8EyEL4Z
z`Oj&=Eunf5;c^GwrFOshCy$MeYB3mMVnDu?2#pA9I31%2YaZgH8(a)8BHlX0jkRz_
z9g%+f5SM?5GYLfgjv;Qmor||nnJ%r>Q6j}((c;-2D&M2UbAnVJm~-6t2?bJNk-NBL
z@ncJtE_+;gr<EU-d}#y*z;j&1u6qMb=ma06D2~m%r6mY|-*!Q3ivC2mBlO${AAu;b
z3V6wiOaue=)CT-=$2V{r;Gz5AuQ)EI{vI6T2OLC2{6`_C6}K1a1-%AivRaHNU~CH)
zKpEq9IF%k0BJNf&RRM0K+M$1@HGrx7U6{)E-v^%pJbWK~3%|B)y$8o)0I^lyz%5+t
zJS6l9>~4p#{eabP3UIME;5`-Z!DbND+;kt@47dw$ILX`%c;LQ#aE8Tx54MPaTkpax
z0NN0)+)Y4ykmKU+s}P3@arO7|<NSctdlZTTg7No8#KmJk3B~vF6G{R5@6}IO3b-Q-
zqkk@;lfr!kx&R-!4?Yff2yi$l0dt&)-|4suCuVb8l6a4TNuW@&E}V}~GKGBn3I9u$
zIL?|V#8CYf&H@08U@sQ1!$1j&17my7y$bdtfC+){KRXae&jw6M2<c-G+VAD3cL2V1
zj{+Gemho=5JjKt#$Ji>EP?zWrpbeqxUISt`;N$nfeR%u1^d9UC06qwql2G4y2;n}8
zIYF^Z&%N@Q({NsHya&5b2R{de%0z$s8)4+QtbU|~8_YTdc;H@ztakz5xDOrz{MCK%
zFvpD=4lgS-KI#_7W%mpC0VOmJI2-Nd2;nILoP+*yP62MA0w8(L0K)LS26NEBXz?CA
z8gn}Oz7dVah(@>Gm*0jf3W0lY?n;guqq~RD7-WsXxt4|y#pfYh5OgiyBwXUSyp{I~
z<TV2BM@ecEArB)MOC%&1{~$KGam@nW@B+w3Jc!T1aEE@x4?!T}H*~aol!Z9u#<$%E
zZwK5jw0wincyutKLx{XvVL~Uz74(HGco6T0H&G3DP>lEuT+;F1Yp`%B?)`O#nHU|q
zU*Wjo`zZ9kNc$4-sEQ@rb574p_Ki$-l1xYlfh3az!X6+5W=KLfOcIt!2n=BfAc*WD
z0)s3H2ndKd$Sx)jcH9zFL<AI&MO553yw~d$MMYe$>-GIrXOfBca=-Vz?*%3~e^+&N
zb#--hb)PdcJyrs@nq@t<0Usp$dwSI4s3i4F^LlO13}C01-m?n$s#n3Duvo8F^SoCc
z@HUS^sMc#2UN>7|%$nZ2y!CrS!8~`qH&*8jM8QFiHWIF(P#>HVHe0069AF9@#DZ5J
zSg6l&FMl6cs4sgp==kXyh!;L}x|zT4a^M?Yh5Fuv|MyGt3h0L(_oD_pKmE`^{tS-*
zm^2>>^f!2Yq(4~uw{oifaH@h<k+NVca08e~Bwhsv@w(ayzl-@dAj7K>Wd#F{wZg}N
zfA=;B14#q%c`D5U2Np__E!$&3C}_*YYm>LW4IQu#^V023oHmd34ng4r%>TkA9*rOz
zk0axQX*>cTu<!=b<6)i#fr}uZ=xMJ>i;m$QMWL6!xCEHyHAK>@_#Ey}jP>#lo*+pj
zlRf;=xOPvIq#;*53_WoDt|X}x`A7g7RAGUkX<mUtGbG8;Jg>p;0H348+hd0V_%koR
z;|obD&Gq6^)G2K>MDEhDC|F6Y=|81wfOi3Vic0H%FSZhJMUu+Q-UcZPEQ|KmFKY`t
ztrdL+@JX+emz}{TBfG^SZcaDLCwm(xhegU;nYjEIaH}4be}SEg*{k3%C@^ffx4~g6
zfv<Vx4f{-zhEs3wpMHiL@M>uf<3Ah?ju_|_FrrYBoOQl9ZUr}nz}bLTD+QciNK%E_
z+W_Uf6}ez0e*9GQkfh3+9{OZl{~$@DXj*#cqXH$#)x6reQQ3vS;hN)Nz#rFqypFcQ
zPXk}^U^L*mDoJBo&6=^<z|*|+u`v16<G#Vo9hiC&_+2l3>W9ET>zLQSslQ9owB;>h
zB28N<Nq5$Hr^%fSk~F;mT|gbO$n=AfG~<SEU^AX^6FZGoJ)DUi&fMmeH***87ha3a
zydg=mbbfAMnuQ9pS}8CK3d~;aRbV#ooPk~ea|(f5In^9E)tqb44*%(A4#s?LhL?XX
zEHrnrhmJpUr%BShE3|k~`{>a;m~?(yZ;$3%fG>JO@BAy0bkB$0KyuGDe5%5HPY+Rl
z!9q#8x6aFdZ-XQ)O!Im@9y*g2f9SQ~V$@#}3VvSyAz+DFlI~mM6>#5r9Nez-;-zcw
zwwGoTqX)}iv1Qx5JzBO4XVH`);XnN>pN!W*uLYJLm82DEUMF7xg;vy2{zVn=TG4>l
z@3<h0A8a0_`<<<D74St5#-IDI;Cqkqz4(EFz^&5w2TtM+^+j)kE5X0Y;N@S1%T+VT
z{<xsmsyULhW}#>O#uQq!M3NrDT^yzZKLitR%=RQ4g}BbeYY8giKmBZ6j@L;K#-EMw
ziHDDR6?ph*N!rxI>r<QZfS-1I$7s_r6#U>d*`}W*Y4aLSgQ2)yFG-K$5S|+Ze$*gI
zTh{1lH2KgL(6<`A^sP{0YoJFvD7Y0oTd#Q)*!r0yZF3*@PLpjXQE<)M1KO}}-|Tg|
z?b{@2r^AbP4wIzEn)iATPMi7N4c-QJAC#o}bKW>Wd*r>X@`=5$xch*^)5B;<IskzO
zR(ceGzyoU}>0qnn^56vEpS>14_`4(>YL0xUb_m0CxH<Nt{^1#tbj0ADB}c$><eX<n
zKtFO3{&%#*YqFybNjiGQ+rZItlJv}ckAfCl!v`8$^|%o|Zfq8qjcfF<Dc92ga1#_d
zmg|uRe2j4OYD@TC_}{a0JQ||l+4++6T#DDk&!tJyi@3+kWA4Otz9hYL)8nM;as7iN
zojK!+4{?(?j+}wQFTd;Uz{?*>(ktWxM90r7p_26K@7|r(1&Tix=6jv)0(y9X=C$YN
z!Y<%<y<U6)0x#)XC*C()S}94d=jsZ|5dJ!P_(q1_A;NED<8{>QV{bf-cV^`JhOk0o
zG5+tM!n+o4prP}M_u6_b@Sa7I-k;!gs`n>L(#QB{2NnR@#~G4zJ=@bG;On`P^ktfN
z)_e*2SGnH$U!lDl`7PKj-54lI-{yM+Y{oV4&5{-d>83-HejDg*;I~5Hg|HC*)9be-
zcpYzrPfBt?N{fl*fHdH-Ep$0xf+Pp7Z<g-{*o4=IUWUMHlH8`m)5B<7J0#g`XjvO%
zvoG+KmLZePS0y=eVT+f`kxL{wD#eSVpunJ&9)+@Ty+)FY@!9I!0j&RW@mNV7+&r%#
zeDE;5y!n7Ucs}rEuY!0`L@u$kIGJ3M0z9F`N92;pl3dxmH4DWx6dFB{x7*~T^5{ZI
zz6;;UKnl1eizKf*F3DS(GZJXKB@eIWgaQ?|%)slQSAi`@C3)-o7N3!~E(Bfzy8a_?
zT`tLW2U~ndt^<GF(_VVrG2mm2)2WJF2L<YA4D}zm?xZBwdlw729#*L@)N(f~`|b4(
zN#47uu!VQ;E=k_E%Zu;&L6T?YdhtFqekjF@m(GynrRTJiN0kl{b0DS4Bgull8Gru!
zi{skZN0sDmyCli@g)}gHMwoK%{nDTn@^WRFK+TJiyz+|I_A4>?>yEYH#>0w9(XKtJ
zoTOg{ZSOYaMX~*78Rva*+VbuAV%f&ufA0a*DfG`PaBTdvJ{k^eU8tFNDC7JN;!OHb
z^iAcUHuF<CCiKsr>0JF_8eW_6nh#OY+Q}V?$?pId4}$SPGvi4x9suJ3FdonuLw71B
z|NUS*0LJ}4YnGi#g8zQ-><7<&oo6g~{PuxoKX~?egk6~dVf(<i4~+YC#-k*x0gU^=
z*zmJ<l7uyYrvW?-%!Bi9liyyjG=ODqv#k3dYcKfrf^V-b%R!8Lz_=HTdvr#GRxs`X
z;~p^X(HU`eZt|-K;~p^9dnEowjP+ow2V=d?c#|0Gz*rB)IuGN|p<t}*aZ}uZ6a2cB
zP54^lB1N0|xRM+<cly-nxbI={-ocS%#j>PWl4@b&V(rSava#u#$CW+4RdqL|6}ZXT
z_vTIPXm3i(cHNZj$6eS5PTrK3AI0?*TqB6-KR0m@0iM8{Qu{ODAB(>i!GmG%k6Qxy
zbATadMFVwK+ICXAc~DW6!~BiQOG0lVskq6B22nS!hbES$n}?KFMdyf=n-U%T5h3ix
zO`KZZlxD5;V9QNu*h;*jbzJ_1BpDP`&S;8$Qi+p|KirghW;FG9O6e!?nG<7w5J}pj
zjY@nWoH<1VEB)l8<RtwkrF~LTN^(}a)a0zBly*t@jTc>mBRQvCQdSB|_$MVRIX5di
zsa;l*h}OPuR65EQExt*qR`TMSmNY5YaV^oVzo_(<>$LVKmG9-xn_^y4hU12J(_N>O
zPi1@nX6YH+0N<}oJfl1>Pt}rMRyyIirIMGGd1-qTi^bq?j1})Mk`0P6+$8E1i_sWv
z^fSpuqv=q%NjCVK#CzJ8FDr@W2Nf%5;l?<VY_S|fJz4yq#lND=&buLlJ=_prj4_Fg
zi%FE9_(slyh@B)Npt;m6-j_)}%Qy&rS=2XOd`0OiM_iF0!fXtbWeaKqqpCRW))LMs
z_@+h8c@EuvMq7GLsdVF84fVEUllW;7#KpAZ_Esvb+xvBqYz*X1WPxfH-?4_=E(sUw
z7Ux+&h!eMDInN1A(B3*|9&9v)LA=QdrOjXn7x=PZ6nHGMGrX(bpFbhL4dnZxJEk0?
zFE0H|+1%6@a*LU)>mk|CBs6XPdBxK4u~w>o00A-WjB*0%_`&S0mH$|K@4S*6zLLkH
z#a58>FD>L%C9(YymUH{gEY<t+=OV5ARi%6Qf0{L1RA}2@RaAMCcH>ngOV+fu7nHX6
zR2HBFZR7<dME+8nbV12%e_gT~LX5p6#UO;{CS!Hr>+6yQ<!OBV5AE3tN<+yGn8?oz
z6NH;W|9SyVIMr*5X>4IQ$Ph<l8Kr^ZpxbJU6i@4t#V(noCW~v@p^HlDpvV6&60f$F
zxF0@)%8}xO#jK{N_XvBtDfW^w)Ff}#?s!wlkpHG>Zz}D>x64*i-eL$h;^9q$Fp0lu
zuf3_PQkKZtjjKv~&3#od75%2WF&GrF9P+}AL45uDVhjDX8siwww0O!xsA<33uxppE
z!oa_1UtLu)<z-sTTgrHUU0|q5e5c+2ma;hN->rQtiKYxb{#iVr#l5ZcZu5h8%2>F3
zXA{1^bd(5x2o|Kd6l;>LhFJ38@0#9zPx+^uc61Tk2^7qLBx6LPF&uiyCW|qG|6-iz
zuf-VH^v(y$9kO-rLY{lFxSRf>AMxTp{U%X7<CYC^7`Jz{yFOBe;Pc^L_(+MZ*sWL$
zZK3POi!2snfGG);!^JN4PtTO$?zA<w7azgn18BPF)8rA46GMBWUmB!{&xpa4$Rf6B
z*&izr?oV6SX(Q@%!8F^9CXZm5f)`D)1vU9bxj*_10cNp=SxGmOxW&;8lU}i!*jy+!
zitiWEkj09%6a-OVLW!(Li`5?8;-DP!{^;R-u!Z->rcXXrqI~4Xw153WDU?rW`JXFx
z1pNm-S1RQ#O@I4bDG>4{j=g?QvM-s%MXmpr2*oG0;a@5{(kf{55b$X9B4NTbnjeZu
zR5&?u`E#jB^wi?MQYv!rVdliH2j(ntkyw*>5z`<T#y}LpG@EZlB=I9D;o=2ZyAm%V
z<Wt)7UnxoQ5$&U|lsruH*c-~++`rN635UzTHk&aWDFS_gxq|{=c4WfMHjXvsh^^Y`
z8_N8Y54k2s9*@h_as4=x0Eq?EYp$=Ak?y^2ZyQ+txQ&CD?9|3pgb->I*xN>sc$=00
z6OBN)*u&LZyHKpLjd-UONBwO$g2lU@rrdkDtzhxK#BH$9I<6A#G2RD~oDB=WaQ7`P
zhCL#{V-_3O&bn>B<Z&~KTDjS8Fw4ZZ9A#p`3BTcK_w8a`k|D_?{?4+DO;3M=$IK!k
zXg;Noo$nzN7*`omObOb1H<i2a7U!bx6l+9;sk1S#9gSb8F@i!UsjEHkow7-Ox~c6g
zWt&0%qUqV6;9K&h+Mktsm47d4TJ*Eh(}0fxYx-R&l}|SL{h_=b7<qt<+3X-ZH?Zu!
z*>uxSylIfX)6N8o9`X(Ck6<z7zZL~dZtb2BF|_?M?}}r^`W_<wSX2YG;{*s!6kv}0
zzDWBzL`21`Z%GtLVP59_X%>E?#fOTN+cq&QRJi0OZAqAjl+S7xLPh)AvWYO!VZ<{W
z^jeR9fHBA<&cpwrV5LxMRQOwsVZ5rCP2y2+l*9@cCa$ypCK&zn2@jt#iM@K;?`T@s
z|7iQQFcH^gjaQTfvSjhS_IsEpzMZm76>UVE5?5$7iU{b3_+_<X_O><2d4?b|M{?6c
zX0b@QU0p3PN<4L2!at%!s<JSnDJWXplyAq;6dEhOzrE1Nc(EwY8@+W$?oZAaDEe7U
zdU9nJV`L*V?dJ4&@EwSt6gR`gYVEanjL#3+=kcQ5?b_Dj5=4fwEKn;-5Nbq8tEj|I
zhp5y=JD4Dn+)wDUjnhR67O=)^JUh+eh?nFEBX2S#964VrfqIxT`ihr$-siA_PyaWE
zNxTXMtO{0|Y0oUCz#4%MA{J@x<(!Ohe&$&*Vj=GrcB3K2AbqX)n#6k-(gc%Ok4B>8
z|9`ss|G5Dg5U&EpX!O}EzWA$xaQ)3#jTJ=1UzqZj{+YxIXwTO0%Q9sdLz}0_XOf;3
z(4rO#ci89&WZ&q44CAv^d(0wAqW(!S6QAk@e{L~aps3XhNn&i@2p*un(4xg;*%*>!
zj84QLCsCK%i17brLj%*a-AST);I-C^S+m>h)aN#8`-xAm3eiA4#<RFH%EGaA;8F5K
z?|N-eJJHVif?mi@ru*1w&ti*jBIiM+-HK68qUG{sO=~A+hJTHQJbREl)PXfOYH`V8
zLJGT??gzIs5ExImwa1dh&URJ0g#TelFs5kZQpB+Tm_M<`Y_UZ<pCZcJ#F2$LG*L$p
z*(PY#_98hlmjt&Cd$GuCi?m7Y|3|>u*<OtOk5+<>6wlkFimKZYn(j*#>9-9XdtXcw
zO87CdI5Z=(=@I{&_C_Z$<F>Mfr;E9_mDTi7rnvXEp-Y>ZCB|ZDyO<>&H{Mq0(ypRR
z3_7d(pc0NfB@(148m41zEZ4?h$`BFpUun%j4B}bdOvDJ(wdggTZHntD@NszYGH|dM
zPk9Hbvh|I+Y!BxIhz2nRG-jRPVU6XfpoHu4Ceo}U9#5@_O|SJ4os8B<44c^yX%bTq
zNZTV%P84k{#%K!?J3leqf`Ty7#!3*~n9|f?fPlcA3urzfWQ7_1l8ka<G5ztiXpTW5
zO8!^V<Uu0B=XMs-)~jOW?FdcjLq)g1+fwF?5>E%;meTtU5gTR=GUOPI?a?_AM_0mW
zK_}4%Y!bo&%g7pmBGm$-Sxnbf-75~?vAQJ%XbuxF?XyUogTxE>!fa-5==qO542*CI
ze1W3zUNW39l0y_$=-Y@ihKlF4#}<m1sM`^P#Y;`EFBB1m+xG33B_c*nh(=4{G}<D<
zWJQLZWemhporkU<BHg8BFBPY=AK<-|cP#Xw07I71*rzXTmy(PD^hY)bWCS}j%QDg4
z{04R&*pitk{wZcqjN)`t#WHcqSN=(ByGEqSuW19;hzDZ#&g5jjWvIR4wNKZG1o=$u
zS~1-3jAt`-TpP1i<X}&+el1e?7qvZW@wKC8c~8<hD4S@t`>g5KS}{||7qtl+MCY(q
z=2*oI1iW;y2@^RCTaLXOAb+3s$_9~-{fN&-kskQmJed+FtHmVV()w-`6Xj2u>Nbkc
z6u;NeKNEU!MBDI)NbiE3HF;?BB<x4t`<5rZ?rTl67?}3%Vp(f?L|C=>THzz_ZE9aD
za(r()GE;Vl07FFDe?~i`tRuBmyG7T5i8waG&{xBcJiE$xV&>#Mz}O8j#2DF3YXd`*
zo~;(80Am6qDUXYK?bJchrihN9uqyV&k``t$_C-z4{O0{ZIGtUE;Pi`E)j0711rR<H
zqFqJ^DurWGm?)dnwm&Z7jpRACT1wsjh{{!UA}Qel$0tZOiAImyS0%&%mfNUptrPRY
zPwG5+v}HnnExBG)RCVXhwkj{?A!|_^-{I8~rMcb^rel_34(6bH+$A*q6c1ONxI~LQ
zbE?|A_2NXdzMP^XkmNb0qh8f%hxdrs@K?O6C!N!!K#=yq9#I^hs>=@6kIVEEv}VZ_
zdkgjok%yq+(Tz3{a2Z!C-4gZsX~>erkGwCB6TGWt&T4J(esP~%S9?I1hrN$=I=(qF
zJkCiuG=yRFtv|LKf>?~EF5YdxT4rm#eBA<zo&q7hY$w6kr7t=ly12brvYr)NDJwQx
zj8==W8%_sVp^uPXwd^q-@Cx_z>}Lqa4kM{q%i7y%X~Je&KaHd#!eH7^02{TegW|R!
zS#ul|8SY!`8vohh2jP#{BYSna*4l$u<(*(@>F~|lNRh=lH>JfUF}_vje*3GSY><~j
zQcLH5{VN@0N;6x?zi3|{6j55iA(7JW$Nyqo1J=%LB)I1-Paf(`G1j(Lc`1!i&Jq?5
zXYtI_8~-Kqk=B)dl{EPPlFk*{zYhtE{0+%)tY0jLdo}#vzecYP!_d-!RwvUm^rD`#
zW5fcQIBeK@ZP{T_EWbpuQ(r(`K6=5S3!hn-#bNK9$wLiHrq?y!BVt_XHZQ>=>hG;v
z-s)A%L;kEadCPy1|IzgP5s~L-eQv=)T0K2y=51(1FB&OBi5E{UfS<G?wGkJa+CM8M
z80CLxt51m8@{p!~pAd1P^B+d<%7lZ8wno2AID<fhGbNchpwbd(7JDJjF9HQvF@~QK
ziIGp-V?lwb29~;Ll1<C;-G&CaSX+GxtH}lJ<|&apf{rtiEJh?kL71^*X=5nu*t4*~
z0ZcR|6&l0ZSwZc>n|g3TlDKNXETp}hQEb0gwu=2mjFR|d0Wk`{JgxAw*drfo`u4QA
zPmynFGhY!YVwI1qojipbBu9aY>ai?S=h0x4cn?`hR+2F)k+d)-qm2I2X?2h(TkO$U
zk;s#lV3u*5D)yoj=tC|3toYRrhYftppRL886IMU!2NK9oi&lD0M1_2T#T17NR^)i7
z@~C$AIk88{b7~3a#S~*6$__O>cwWqv<>xf{0+#bvo1!j=ZL$)xOMB*`81BA7NB>yY
zaN=tUGPZ4R#OIisQxPN<Sd497q;X*5bg~%DG-uoCgTg9tb`s9y2+R~y_FrgyjK&B<
z2MGH5E;5HK<6V$Q?BTRf6|S-&)QPItr^Q%|Q6!og!p)B)leYSji1qK2M?-3|iW2Sc
zCGohM8wkcRRd~BRV;Gb+CBd)5^(uL09NnTBQ=b;6F&6AZD=*EU#?81bkOZqEmkjTV
zLkRIqh-{2Tg-E?&*dN(4>(J_wPI^c!awN*zv==T5YbLZ3bLbaZ?ux&Z&>87(xUmQQ
z0WbZDq+gS?z}H00NPLeG*w6(1MKcVOje+!6{E5lNC1zuYhY#=AB?3Z@pQ*wSk8Ygz
z2a_4Y6v5iCKlIa@UK3;d6CpUBb=UH);EvybE5b4))@rnx;*GQmjyC3jBTx*&c#59H
z*v`mx`XqAiu*4ZHS;jaWVJR{uW*OskM0}Pkt?7zLZ~Fq`U9vb0rIOhA#vI-eS+LhQ
zr~Q6KWV)XO2mBs~v4NC?&tawDSnW(9Mn4OV@o@a!4(G%u7nq5#KkZBqr%ue34V}=-
zQ|u{GW;jWP5v&i>q|MWLo(hGhKpl3vZp~KUY+BG7Yc#t}VhubZ$W+0MMx1Q=g;$vR
zp_iR0lcD+XJSD<p$M6V!o9k<#&WIDia#Xf%TcfET!b1!UkYo(ZZ2oP^l4a9UlM@>%
zNMidB4A0Ku<Sd9fnv*>_E1Px_xNg^{svr20jmCJRAAYA}YLF9Qe?_-G6w^q)6+$k-
znCf@#1O3cK#HP`PFle-M4kSfj&X|@O+g5=AhkDjx1C0BLR{DmBbX}Q2UEwIx!-{~C
zVeDZt7gOqe1kR0h?zP)7P{3>mk(VNrSv^yw4@aXw@!cYt3}O>*E(M8yYOlN@ta7dP
z;~QdpkM_xWw|TLN$fAS;1?`N`34fE=x*aUWY))<cET$}z#So8tR-5xCvadI^t8a>A
z+(-TSO%d;RF&e#q)0}8ZxGEGmaaS;=GkWfaV<(H#G{<N$Wg<p|(Y=Vnb1YiVw?yZZ
zrxxZ}tn`mG5Ko6tH@;aU!#bGEC!jI*a@s?0i4GA*^qWX=7z%ODm*g15G3~-zVz9rT
zX!5lh!YG$)_qIqa@)M_hu_n-Blgzd-iY9j+(z-~CpmXr{*moKO(@+o$$L)Z>fmCV|
zg_iK}NEqo5JG{86t$SN!%Rg!_zAXk}=jHQ`XrGV`MY|Y{9a(S;Iay!tWu?~T9nss;
zc(-h(5zfP`qf-W+3{W~-EP$Tk1#R6sB3(Y;^xQkbEhm4C&=M*h#wewVuhHesNl;<q
zB61#mJj9n;)q5hD!ivE(Cz$;GU2VgAVv_sj<YI45O#Ky)<9IQO_Kn5}V_I`&bQ7P=
z<w>3M5O%;;$83}SCmXoZ#JVU-l5j73GEx<;R?pRHnyba=`+}R3;b6^YJIuF7TmQa@
z3%^Nv{DrVrJ8^r$KJCW)BK<#Wz$Xr9ojwrBAiy4f5%r8V_5;zm%+m(+8(<PgqbN;@
z6IUi<LxefXCB`gxb9Z*(D3cfkIe#(DU*w|36WV8Ju+4uoD2s=*m=DEww^8J8TKq>M
z1!M6SNig!?*;);B1BF}kq@4e4uFsf}Z*BcWwf`Koe}FH|B=*sv0&ZGieKp~Z7Kt|~
zZe&ycZST)nGVM11+UXX_|6`#4$@Tcg)?YMg8EC8S5MM;enBgWQep<he#bvyYHuw|K
z9>@H-pNM0vN0a!$w^{r16A>}EmEYb@0Wdy_)0HTF0l2*ap7GtHxvq(b{~Q$v*s48n
z4L6MbdsKF5C$0$#2!H7dYCNuecMZ2=TGjA$@=%ldshBD&>y9@)|F{2jc=q?};tgd>
zp4RlG$X2$@(5`<eYLqQUwbHM|1!e0(E#ZbpQnoH{>VHGT7?rxCTGe+VL8&{YE&L9I
zy5rhT#wWEGzY|N9dS7k8EpbGtcW6J{5+5jgcWJMGFJ4vd`a#?NgV?O>JKEI!N6}GM
zX684I`$;@4D@$i+(Lal=%F>HX&-{#gUCPR<P3L|S-Guvi8+xn=Klm&<DS3&E-}5Ep
z^Z08v;nz@n=983#7t#NL_r6N~@v_ppqq}sIh&{nz0PTr$NZTZ7%CA(^%ZOitNCxgv
z-BjkaZLU|t^-8(k2x4;gq2D#cHTRq(i9hFf8XtWXf=afd^|H(0Knqz#_=_Joe2I()
zE~O_<ERpq=m&gjR>(X1Y!8m359H~%}>JtZ~#euo}ZR*OQy;PJsU_3oTHRyhMZV$;1
z?@N~EbxpzVnkBOA3)R2tN=5g}vwKMX5x883a_Z9ek5~-RzGwuht_^u4-(U-Z1_1JU
zh)oE4WTU|<&wJ!0LxQ~Zk!uFCtUdChAuYJg!1h6q(kPkn9@xEFx@<`67u_qC`dh0=
zb^~83VKB|X&3bW-1aQdT17v{n=R80GIQ6@>Q8pCxEA18M6+)NFMo<@is~5A7Mg2U0
zgsi*l0VHIlj~1>#$dq1fy+Y_xgoB!SNH1m~R(}s5A^n$m014^cSK9<3axd*2#b6EY
z-YcGD)evd7riBZTQnV2Qq|9CkEu<y)Ya5A_sl7#{mAw*MNE<e3VFr-4X~PU4t?FfI
zAw9E5TW>IA$_3g9gF$r+=#_-Ak+)gU*1h9<weur$rjd;!WV0<E<7oT>q*ZQP0+F~Q
zV@}%=8Bj-NEw)*>5^0-xMyoO!V!JL6wWXq}i42*$!q$NqXf$%y+S0t-ezuM*#{kNj
zo!SATAx3^cd)a76b&s=UF`qw3XfK;VAV5Q*Er%-w10-Fyb!HGE*+XrEaA`V?V)rk$
zLcBp=`k0#R?q@3^P=kknsX{RWKgk|#E1?QM=oN;b*z|*^f*Qa~^xpKO>)KqCAypou
zZ8I67r}Q0W>xQ2B`~eb-(w$nbrCJLfwBh4`$rk~F6kAUMjnuOR(Y9U;e4}R1m?PPG
zGoZfscemvc_?Q|xlVR&apcbFbEybs5@jix_0$*D`mDQx6tlN*a{tVg^_|sOv+^GN^
z&)Nn6`23Lu;8SiJ2;du(0pMGr&G#{MaYu*RhC^-NvnYddBe*K79c>#4g6?d?y4vVn
zEmDmDTSK<3f&um6%;UC7u44qic#L9-55Q9!Y*h@%yn%n%Ml+iqz=Ckw7^Va$c#>Zo
zZgVk-2eGSdER#HgSj`}W+^%V5fNdh6-vo#-EVk7!iBzo|X`94=+-|@P8@*>q*L&Vi
zwkZr)@2<8x7?9puBWzOv+z5$4XKXfla$Bk~0X*=X?M?>N3;$@_bOzLmMx*U62Gol-
zMYb6X{7Jk1n}Th#0sZzwO&Eu<oD)MvCGCRlvCU(?0Dub%ZFe)E&IXRPx#u$qA`#OL
z3L8BS?)L#`@QwSJL?Vn&*p@P&4o)9yTgE`4N;O?WZTAEEcL%BaMcV@{mEwwRE1`tn
z9;$S8nT_5%B;kP%NwTl9t!9cbO55va2pzWAwuVNaF;Kb_@#%sh*&ZU14}v#*fNecr
zOJ$O@bd_x*Gs?$+<Y#P~c;MvYKm|K&wTSxu+vF2KGgoT?{)Q~~*l^o!R1e65D9nn-
zSqJLUrgv?13`o1w4K_Ti?isTsy={9K(3lNdX4}gxlHSk6*&4V(8jHtH*!D4?KoEM|
zwx5A#@*H3g9Hl+$Z%A^#AqUzcAu@O?Sp9ypM}r!?m9)5WhdqYC0h0Jk8+)u?58w_z
zds_xH1IIb-6!4^)HUOuDog-c?#qkl}+Y^}*0Z@I_Zeb7!uxFJ$i3LQtfkG<m?U)n;
zP=Csv%%oU=yovS{2DEn9Znjf+41PWVpxt_V2d>i>;KF5l8iRfSqOZLZgM5H}rS^0N
z{Q*{dWzPTzzEA*=yv2@>CnFy(0`kA#ZsmrG0g}eq^)OljF!5!(9!6Dwx<Ph|oWUPB
z00QRO@d<j+Yb?M+7wuiSp>Y7i&)T~&Wjw&1f%fi9nFwIavG-t51JHJ+y{DVkkx4)&
zW9+?{bQi!gL+pCMn*lH^)!v6Ga{#u@v-f2%7ogWRdp~Yy9>Cts_I#$y2k2|I_h)bq
zK<oy40fPkq6@m5v4DJOO=3Z$Z2;}p}LZC^{*li4!0E{fM)6yW-E(ciH(O$^let=Ue
z?L{nMCBW!&_F|^20w@?^AIub*9S482moQiZF#m{s2!pi%Ppq=54AxPMyD-B(l+i;V
zRU7OM2I~QyJ7F(numPZ<&R)iVmdBX!_HqUf6Xmj<!nDsHn*dzf>>~hzzuFA2=V7}Z
zr?&tE1={sEO`hKGLwg08zHr+%pwXY$IZ!v&0o=FTuE*vEfNnkQqe<L_eE=hWw2$HO
zIttKzm)*s!9s}s1Xl;WHi`?hs_V#rs4WYiQa@#3X=*xe%AMF$?LLQ<y-F|_60}E;g
zu(H6uk=Z&CQ0)&hNCzkmv~L2?7o~=I_F59KGZ&Q73j3q@+Ov=&<kt<0?AwU)Vzm|>
zV(33PSCY<-%C;cj1mqzK9^CF5699TB#f;8h#sq>8igP}U>XDd03qX)T>Wcawgm`|1
z`l8w!XAChRR4o&nam6vAdNtw<Z3DXHPVJ=-LyY@MfgiZ^CFS7b1^!5BLq4F0RG3~6
zKy^N(xYMv5pD9S*6bcYpRuD|7LM?@is&fS)Ofdso4l00ZkVa9Wp|Bv7Gm0pH`qv7=
zm_iG^;oE{X3}VQEUKmgiK@$44mC%FG&gg&ip9N8|q$sYZ{8<nkNMtBIe5AR6Vog{f
zq^K_xaHwe{TkQFufI|%@AJC~iNo=Ih=XMsPGN678FDvK(VPVywY=~c$Ywv~{Lf!A+
z$!?SmL359e9Mld&Bjer&-qTu$lD1iCzKNjD!u5)&X}%pj*9)$tg_2^8ZSboGg$--*
zO)*&B{wNF&0NjS_vu_uMqa$G_AzrE>kyA7?`nTJFPa;J5=g?{333p+yND_op5zgGJ
zs3)rU9|T|Ch3w*N@U<a-yt=Fyp8!cs0gQjOxHALt$92BNU7$pAIHh3?U5h!caemdw
zRNR$2PiB9zp|~5@p>W*(t>T^x;uS>EGa1F4uGLa-o-@3-H;c0XoL*n7N3XP~Y53T$
z;y!o}p;Xh6%olbG>Yk8_dcjTF>>>l+g3iY`TLy<iayW(QnX3nzxqZ_4wJC#npliv!
zR=Ed95~UVtiCgj?I5>*6p%GhAHaMCAr6M7p4yI*Hs-?AX&y~Tvj5X3&7X58-9Lpx3
z9CLbbTh!4WAva9AK3HGV5&>5A9Grm3s?}S_x;yq4Ik2Y-SD|j3dZ-(=EUm=N`o0b3
znX5}!UrwTvu9vXBoJ2qRTnXvh@lR5!p|B*1nyv`}sOVKftFF{YdUVPtVRaixk8#IJ
zSly4w`fFoKSlt@3>X_3dv;@aLltfCohrU--W`S0JgI3}6aa(!M6_vAZ;rgZgqG5Dh
z3vB~;Bo3iqU_K2YGgl7@<c7((N!N!2vC+u5oic_5GoS>pJZT680zCno`P~qGhEf7}
zZs?FO65y^Svo}6BM4y#p=`qR>GKxJm06;rE#EcK6yK^1&@PUOxB3K-y1shin(MORc
zyw3|m*eZ?G-NWODuvKcw*&6x`iQzg4)ZNNsMU~0u!)w&rKT+Ur*jjWadS||d67wy%
zmigKeec${mfiJ=HazN3Yn1$wRxb7_#tt5+ljO*zaidJH}@b#0=6|HJ6e`-R}s<u>4
zvvVePb_3w0QkEdcjp%}k)wM;d5uPFj<ih{%npU)<+1`^c7wxkknVJBmB;TTUsl4C2
zn7Uy%ir$Av-?K6(m!=ebfLSip;JSme=qu(zTjpDkxgU{$+SySJjzLATKO#!Regb^}
z@aabp`|Spmw(*f2hNA!7G&PR*`N0z4l9_5-MshHawpxwXQ3%k{-fDu5LV@h7)I=SH
z0d>kyEsTQONL!(A_F01(6M{BWC%SuwnuG(6i1WD4KC5~nXCdCjeo=L&;7BF112m3Q
z&EP2vRVh`Ad>%s=AFt|}8adfR{Z&0vqo_0dkjgvR-4u1!9#lJ#E1f0xd-#T$&W=fL
zb$-2?!61-w`ny-;sacR6<pgPPy~@d%n>Q2kCn|4pcasSDOO-ddyAd9wSzoAKNW^ZE
zH|qzL<J)d>(@qmrj&HjuAauG@<-Bb-ZLnU;Q)!<X<s_f=*{kwC^=vl4j=rkCPo<UE
zx?b(&r+pY{h;@JMt5O0My#}V7_>Icj&PJIAWYOCy?>if1nb0_uHl9+WtN<OjsM5|8
zNB{-hsoHd807}eI?K(07Z7`^uku}ODprya7oRT%lK0sHVP~Am3t1sZX2UX6>8f8DA
zOOL37b(%j=aUYeo@MtgqDCoL6L`Q)@Tb@@{9R&f+c~KpzBl4p)@2CzPksnR8tED<3
zKRRMi%SP!iY_&Y2dV*9=Ed<j7kMSGEBm<4#-hI9*<z&&9L7KH(brPvYilRDd1wiy=
z@{RCADraPTFmQgoHZ<B0?@skqX>S}uLyDp2oiUF*24SqXiB~QMsuPH>H~2<K>O>+j
zA1c)_AP<3Flem&E>9uLTuS(n8n3>eMZ`3=PBujd4=+i43+a;1_sCF0AxI3r6H>k6y
z+8QQlK{3!%3{)4QEVf*4e-SrH?hg-LOrY6A-3&Y)x`ctpL+@kY@zA9VJRZ7?0eR>P
z->J(9oFxxUep+3@z)UI8;Qi|Tj3|=!*{9OZH~4vqq{}a<D~ZyW2LQXRVvsM{eO21$
z#`&+7=SypeArO7PM_R|1fve@o3#5nW+9w(Ya?MiLb4583sM|DkgN`gflid4N&rUcA
z&@WMaSSPjvGC!+s(or%{$Px7s9i;$uZB%P@)Lyr`M(u^9f;2o(-OMD>70B6EeUy=J
z52+9d`yh1-;!kWj;!m8v8PPbd;G{|^aXf7=uP#%!<J#vB8i8%Es5=1kz5bCN>P`l<
z%60j-x(guqD;f^}1?ppHA>K{HVH~VJ&drgXv))ka7|{A$6Q$NOATuvpuI^#rCOhwa
zUDfyF7J%fN>OLaXQodhzQRV%3V+w%Z5taAjjcEY8PpSu5LI%KzN$Oz+6mk$MkFWp=
zIoc-mD68F#z<Tuw26V=ueyTpnpMY1>1L(p@^(m0zAL<Eks!V;F#nHIGv0rUukPk50
zPi<l_5MZ2-dW=CKz>BxkXBm_L>~^WoF>n9`q^Zv{7zVJsP(99oLUQN!s`~{-RX|Y}
z)DsNG0tln}B7+G47DYYDU@}0+P4y)P(*P#Lsizpsh?+PZLE$umIiNiLy81Feyn8;t
z_!;V1rYr$ytX9u4SPn3{_?UX0(Mq7rebiSOtN}=vqh4UJ9w20bdXd2<fLA-Kml$jY
zSa4ar%wQY9fq$#7G1vugF0nS=(8rw|s$PX@6X?JJ-}3wx(fL4gbfNk-16tFT)vE9C
z*cbq|ex<(4fX~!a^*sjUY-cB`?=zs3%BM*EfLrsWI-jZ^G9?gTLz(&!gCGTI!nR-3
zkAZ@}3a04w>{r_5cx=YLQvZ%jAz@OeL|Mx`T;Ba47ING>0h9ZwQ1uJcNw@}S(Hqt4
z+>Qi*3H2obj!R8j)UUW5((Un7^#%jd&3BdhHM5a!zU$R*7*LQxQ2Z9aO;H0a4ISpI
z-a@rRn$`%W-xH(06y`;#Kj=u-C;5*=N+5GV$WKh-$ZFSo)n7;kIUl0<uSDV~4!++!
zeBJQ*H81+A{0TaVPpOD}Xib*&1|$^+qZU<GbSML2d6k6@6+kE>8+0fR@v<e;k$+=b
z1JWQgBb%6LkkHPRFtaMtR@agbB8(*avtcA4SV^X=8mCDzV8&Ec4y2m96+$yrIfxNS
zg$?CkMkYdNBZLt?OoRMI4rSyI1c#A1yWSlLMB20=T4N|_6Ow{nQyOiV3L?xSN8+y=
z2J-Mm;V(|oiFfhc;Ki5SNtV;-GZ`q31<7Qf(Wh0J5A%?l0FLdT%JDi?@mPdDYqK$4
zc;qG`kGGsQNFgXa3*m>ZLO5-yE#C)86_gvv$;{HMNQ$Qdczd|POUYmorJ$sA8a36T
zb4M?0j6Ya2h}FqDYtQ4Is&3dI%gZxpeV{6LCY}utmp)pRImu&jQ(sZ#T<%BnP<G{t
zzGRTcmO?n4!zCT}=)w71iypl^Z6M#i9HGknaikF!hY8iy{3YtVh1?vJ!7y9_swbTX
zc=&`W4`2ZAUw_dcXt&aiX2$R`?ZG5NW|xt|hW$g*w{(;7sjC?Xb9aep-jXX&D>o)k
z$ZM$L0}wTRt@c%tp-1rb;s`z~p?R9HPRnU$NOQj(T}<wV{W`*rZ*d@<7K|YV-!a8O
z5ww}6h*Rt+);Do9U1u#WW=E^_pM(aEhSD^h_LOgNN0Kuf44qdOcOrvv80+^#F(=@h
zeibGbXE4RUSz2-CNJb{wicK^XPjBAE%wAeN9X;Y5jV2f0g&j@UNi_51(&(YS)XcYN
zCU?b9Kb!!_rKE1|+M)Pf2LMvHYkMs#88K|cP@XL{K`3h)G?XVx4dpvouMXud^rLmS
z-F-v(MCwB`^(60HkD;{POi2N0Tm4Wo%EE3@6Nirujlh0AC54vJD}#s9SvP42|4qIJ
zTq{=RJA6>q-W)Y+;v{_fp_>_~>h$>z{b-BQzG8<%pYIf@j^A{U{q<Wu?z<h{jk7t#
z;oUfACONzt=g=~TcjJ7A)zO9p(9leL%R#zJHFPp?!ac%aW<=i8U~=etW!gpicX#M#
z9JCtv%y#H!9Au^mV;uVSn9P(~=Ag;0pDj$7;GkoT_GW!Wz$sJv6dI!}UJ?8cnH_XQ
z-+nggwY$$jXNKC#DF*YTk&brkRJ;mxbR_dsqIU0?=SX1?ikpXybcD<HPoQ}CZ;lK&
zEsmf7I{xa&WMF_zXG;z%0}^%bct;ikUM5z(sO7iEh|h757Y09{ud~zfeem;R!M^2D
zM>h7H?Z00_>skBR=$!DbXFcjIj$H7jmg$mtBgYC{*y`xUN|IkeHQLDOhj~zqH*$@E
zdRsK{wRhVaqTP4Ok|U3#eU3VX7aVkGmHIh#2iBz{cb`8fuj?c^`Vr+P3sELGXvf#V
zL}}TIJq|i@PyH#MD0evM$ld1;N|1Ki9CYOF8$=0G-7gM0aqkdG9h@-3K_~7VQg>;0
zr5c8H-29uvQAh>Pg1D{TQG@}}{W$71M=|b8b$FKi_-?y)Bh}C)ZjNIp4QAs&l+8Tu
zaDbuR1BC!l!?j)=aCc{(rPKg%X?LLPi5aE5obl1r*|Jif7NhieuGE(S4RDZB>PLW2
zY8OP8>RwM9xrVN#y4O?KX=*CvC63Rjo;y&gPl0GqwoES7r$CH?^Oo9gO7*xy_jC4a
zFXi>Eu`Nwn`(Evr4u<x@UzO?3OVb*PXQUaryK|<MS)h2w9F)~hFH2(eXfP@qW$hTy
z(C#cLW6$K{r|uWaQcy*zp@}o-=d$(;XyWXDu#Ao)I-~|l<0#r06Ac`OFA}Q8bM`=D
zYA#%?%`UWw2Q)@whA2EwLL{3ct-jBggdp5;2v-ZFYIhpj;Rz?ia^HL5K}|+^HzJDh
z3o3f@XLK$wF0`Di)$va#Q0yoVWNoMi_m0>4bu`4pttj^fhgplu*)X+~W_6Ra*&Pj?
z+>=7fX})(V)g|cDU6)X<TZ{tJ%lDMibjMc{ada+^<3{<u>r3DGmM4$|x(U?KwLG!K
zif1y)ExHwHAf}uREvIF<(_4B=`VkEtHzsAvX>KB~0qDBFTwfw626oCQPiG1ZMAr*i
zQ75RpxD7sul|DBbW!e8M_Z~NgzEn;twJrxjyD%U*)7O^k3pL%I*mSPED^ti0FPO{q
zS?n8CJ$t-V-kmArqm%9Bw0ujvMs$xa=jFRGSQ?AYl($JKrx}|5any_nbEI;bp!$*b
zlMUtiJuy#TXo3cRMLM8a{hpZKmvWk*@efg=-mtyghHN1HV~So!j%a1+hT@@1L(A!A
zR>s{Z!_cZNEudpV8BhzphsqrcsD+H$a{ai3dWq34BkMPh_E+gRJ=zghJ`(JiNnn`r
z&vGZO;~%0Sm^rSzg5^+E%fHL{T!e2^pauPr0#Xj+QN?V2QRDBKCY6t70W=pDM3;|Y
z3N00b=asvdLQ6%j9_3>hgeg6-UD#e;&1#uJ8r8OZ9FroWX3e-$Dj(037^x8Zy<f}k
zgtKR6(yz`7wHGoBiS8#q!#sKFcy27_Nt<0f4X%yD<)+-YFh(EJjs)vZ=5o)x!n~R4
zKTK}Iqfwc2nB^jppabjiUbZ$Q`C}{;iPubWIJZpcWMmhUY-U7xb!wSOj$mZSuhvFo
zBHTGmauiMiGCwA9Pkn(F_Tl-|*-$A{<DzRQvc7MU=Xs0Xh0k<5vt~FY0oEz#dFL;O
z`y%7BPAB8XUKs9&@wd(<&sgOi?oSOiE(dt}>EQubBCXq2(n+ng160<2%QUo+7iz&)
z=pyIm(2;H}_v}>|=go@z&YUW7$$6BVKAGReTXGI1X>0T8JGbO*%ySYY?IQB?y*$TJ
zVqcu!-&^uLN?vf~7kEpaLrKs_rTGKAMbDzB_+b7(Z^<z%tNVTO?XZJy5RB5}+kB-1
z$exjCKvBTbd?n3Wqh9;dYUm`#Yn`$T3GP|>3O#<8wI7n(#I{SoAnFg$Jz0mUQPbMV
z{7hXV_hT2BUQtIx8o|_$OSYk8)q)Xe-jdBINnJ7`jhsX0*@Tkq&y0A=D|#bJrsj`$
zDghfEPiq^{TGFx+vdPP}o*b<f@n;G<+Mo2;o-%x70E)9KaD8S`QY4K`Bcz4<_!b*m
zT3iEHc&e8ri?Y5PO2%HBlEup(ClzZpWbyJxQ?I);YHJpUbPf#pPi67?$G6P7zLUl4
zAK%5;d@75h{4&ZN5cwBnW2y&*X2l@w&7o%(Qp>Vp*{8_cI%Q<(TQl;uo^!K!V}@-$
zCf&NAtavzLj$bY&^ygWL+yh*nsL!&{HQmYxIi8h7*Zpv9U7Xc968sB1&nKQ9hfJcz
zGC9yFY*?aJ-eGY1q31bII&lMWzLRd-b`Hn&{Rf-@xE<1YF)a*x^Ucn7Fh*wz7JIHc
zlOYilfM;%KqjIo_O?9TiMZ(5VRKB{*NvnudLksz)liEW$hA6i?&`G&}=X)lhvGr6H
zY@U2MYT^vZ=}nhMc5r%E#6CYdz3FnGkCS)8yw2bMo>R}A{b}NLj>g3691UeR6}5Fz
zcHjAzsL6B3NzN!J+r@n^HF@`CXEdu$cFpbWjA4sY)O_`nGd3A~KT!wn{mvPe3Wmkh
zfmiaJZ2o=}4WUguca0Jp=t--pR1-rs8v197lQybd?v1(&-O0rC&3%~~op*=R8Usho
zeU(~;jk9nx(>a`44P55TM%Azj)at=m&K%Z<T7`0a+k(@o#dkS*N6Vfxv4c}zC&`l*
z?{Mnbu7x%-oqvI_(DQ!I{iMfFp!fRJ$;XN{Zqj61zVjfpz>D}Ohx0H2-rA+_cOGF1
zsaTWbJj#F;zTH=yPcWcUp#DY9CmGPPoRj8!ih(b+-DL^d-rwNoY((3+i$O=*e4fa+
zncZlc4-~oWW6Pa<hR6?TKHlJbp5@TGmMuB?43VF~TJ@=uj}ZCsv${u}e1yo4pP80A
z`3SLw6gjuf$w!Dax+1?pk$j&}XHQb(WzZjNboS~A@67!>8DY`e&fW~DtLdfAJO(rx
zeGfbPVA|yV5=b4&T}BpNwot3gHFS1|`8pRtUe_Vun={V27}t6-(d9>{n*lBLciwXH
z={?(YP>u6G>KEUou6e=9r}woca@O2`Lr3SZHqLdZ+Kp~`!dMTn5j^9xo&m|s&U0?`
zgZt<MRpfL&%p}sj^I_*E1~gF9?sGoEfCj4Yb!RODvd^H)PK^N1nyn+8e1gum!HX9=
zA7u*ppVR2v!gXkpmt;7%GN2pNgG=1bZH&k@CqC)i&LE83K5~PP^ECBh7D(vD876sp
zL8r93w>jQ)@+mEkINXR&Y57UX`^Gr=ke1DK@7vB-xsHisZ%r{*&`j=jna=Mo&8yJ2
zy(GNrjtV^wCKJt=R>3ow%|7mMg&s)BLPx_Z^gv4E`$V@2J&^LI^ZsiCE0Q6+`xuZ?
z##HFLS(1HXY(;xgf^(~-^D9#Qq>(@*V)X+R9hgK0i@Q<5=T>~bJ~h6gBU30$9JpG+
z2{KREF{dl&45j-Rny}S>tKc(~#(aQXXS7ec88X~253Hc{3-8^-n0{Ho$rmp*^B=Dm
z*P_Y%eHEO1u_ESf6%$$%>HK*`4FejU8Rsh|F(5@&$`z9tL`RLATO(CW0q9{QMGl{+
zxPw79ZVY!f#CANKpI`AHX;DL3d|t7J>yb*3xRwD~bfv6a>W;noi3)Pj9!3j24%rhQ
ze_C;fDlY}gf^!uVS$Zr*N<e1B<-=ofk%jjYVpJ!rX<JDH*^~VK(!9!OlFdP)>yAnu
zM~)FQrd9Gd@}M66d!=_lJp4^%TfSq)mN@)NrG8LJLvl2{lAk-|A?cV>sqb{i5~fj=
z`c5aBbT}BDS4qbUJ)Z(8WlSX>a<R!zjIGoMh&r1zxiXV`PGb-4tN`(DYRH`)TA9Tp
z5}rK0GMfP{3#EN3^*Byu?z+E{;&^JA1>l0MQjg==0Eh0W)Z=(Az^kV!^*G*xv^$&{
zT1nBX=Z_%mI#bz;Wz$eR{#<2m25wTXHmWj@kw?8g4A{FjuQycECZ`v<#H90;1-b~5
zzN^VnIhaWIgY=5IvP35V_&-}YgaHYkwxCjF;1NEQ0rh?4gOv{5{v`ZxpUP4uks&sl
zDtSl4jz4KvWjRxLmp^!orINh7*IQBJ=ggNX$;;z;Sqh#~se3uKwByf8-OH(^P8pTD
zms3Nq|3uV@L3U=A(xvgceJiJsJbIXX^59DHX8qVH^j76m27Lcu%H7(UUU(*cN98OO
z_Qvkh<CMJ%I4?AkO=dn8S~(BGdN0?7-Q8N)d|enQ-7i+&!+<nREvsC>fDOL(_0URM
z6?(s-OVABOV+M7wC?JA!JXz(g<W+%v7hU32LBCtF@T$)!%4qW1p;oV=QQ;(=C&sq?
zQM}*biE$=)6mNGpls^B`s7PX~rN#5;^P{4;4y^}OVw66!IFz1qPcw|7^dzqsw8Md;
z*sp6zzk9wJMSe~11A!&(I1yS!M~!)FNZ_g}md-PyYi$)v=WZOGRK?P{8}p<pp10@*
z7Pq`&h*{wiT15vhd2i}sQoZ)DCsye(l)P+xc$FSQ$)cmXR_QU6pRq14lBFuz!S|s+
zvF-0w`N(_wMDjEkSJfXtYFq-!qerU>7|_^_IbAh?*iu(E4|AVX9%k)uo*~lx&H5@k
zB=#K#)`r5WL0pd{rj}I|G9aZE9Ih&2KuXn2ttw_f4%y|Cs=*A%A#HV4B@D>(%hf8C
z0fhi_X4Oyz6atRLRyi10=#G4GdQ~Z-6p*3<s>&Fo0hFdxl{3fySh=@q7=vtpL77z}
z7*ME)9b7e%K@Wf}SE`&0@&MW<RaG#^2T<Oss$?(_Abe_76#;i+A)&cdqnT6!(EUu+
z7zPf2F5y)!fWG5~HCwOmEVf=SMfr$|P-%1#nQt9<7n~bi47Z^ukMWM&7dm=6k*<LB
z@TSpskw>xHbiX)y1_M~O2bPb~GZ~R-*F83RmcDBs5n+dXN6#e@KkFjqwTMXgK)a`}
zp@VyspG>!3`UTP6amAI6@Ye2r^4q)xLXntC$@H4fEgdOo=(iwh?(A_=$0*dud6LF>
z?Z}Sov$Zr{%YN?|6G2=wUOoTl7>ft8`nmbZ(Y{xZ`SqOzS(o>>?MV54zc-?0PL|vq
z6HwOo3dwr0TgODI{s#5KcTh(QK<8+35wwy-n%9!xGtnJs-z3$<QcBr(T?Wp5(>prj
zD81wj@O((DH%H@(7$qq`j5YR;Y0<cDo_{PhWcgucsy?VsH*n9~pW#nB<<E?oI6?9!
zmGX*7CEr2*q*CYTPyp1la82^S%rpK;Y-bC=ti{?t`WX_3o$#;lsxcW-)_#-{Kr=u8
z9abYCvPF%p9Rs3B*gIsnx_JT71U{tx&3Qe5teF2PHPgR?=FB&=jjgE)AO-v9lF<T4
z!S0JB&|mDPt;<L1a3;XQ+K~JC4hl$Or5)769uY8*tto)MG>>=xVrm9Tl5Pdu>DASV
z{rcu1J|R%A^I|sQFqGKF`-FN+9B9;t?~0&9#Qu$FXOy2$H(XOVg}^bVee^>_${xpl
z;?n~pI-o_ZVN-+;EmQsf3DUt(t*pPHOWsVMz0j!tKXGbs@lT&)xDNin?(6d-#<?J0
zm;Mtr@_MlLS?%*L2D)(VrT&IE_ZgpGaa4u(RG|qq*w^QKG*NID_QD1E&>b^#yw4xl
z78Z=+4i$py<m&uPx*b$-8Vzi#&-C8Pdc9L-1n*+AK`Eb@8Ieeq$mPdsGdW)O<21r*
zNX#Vf8<0VPr|Mss$t^SL!1YW$-=%QZ;asMk?~*Tfy`D*D<Wdd!@{}o=`c9rs44+HN
z)DMJde=t2Tlg@)P=kVK(Mx6-Cv{FmcL0WS@Q_qZO%qxG(q|7KnU;OqxlBuUg)KYqH
z?b`xFJLhR@I@|%<gs3^ylO$^f0jx!ZIQ4nOnh7*uy1lKHL=L3QNXjB>HuIDCO_|ml
zy)wZ05mx<RjSgCqW@=LgVA=0#?FNQ{A^6T!Y6O>wo;ycqAhX2Uof_D0Pq6l+2IisW
z&Jt@clF5r>_ls8AE$WZ8k2!6n-D2<sT5PovYaeE#qt*G(Tl)eGoEO;A%>DYZ6Fksh
zau2ljBWk)`So>2m<dH|VTluh#n+fk_)sN}8--Euh(h=RjjrKsR9sD-xYX3;<AZm{j
z0%%gmfP8FX8*34PT7_M}S`6TeXZg{=`;J)$2VhYic<PP>>rkBY*yxMuiXB!5&UOYS
z;(Gss)>68@AJ-!WTFY>4lW;xgXYJfTL&s4AtivJBW`{?1y|d6tN7J@<(df2%s}p7V
zO{sZzSS#qf<5luVNUvn~q}2-ctF(}N_5es+XRYi=fL5zs`C5t15Sw-^H1HIJ+UdSf
zu_KW7l6oJz?g%`?1nOg_3~ikaHx^{y!1GjS<E{q23hUrqN;Iot=KBU-A`-p1rBg=W
zWsvk0Xw2!r*BFqquR9%h1p&vtfb&3mCtR-fIK(*k>DaE_V|WVYLS*g^|E|R(@>10J
z$+M-dgWDkRCFAolu$_qPS^|pxzQ_v;HPw#i{pz|pN%SQW@WlI=)hnvIo@zOee1cAx
zM;s0edK4809e|MIH-omY5R&NMJ!mTf>aP3lpluAumCYeR+ZmACWhMpfU_hM-EeqPo
zfD*o9w<Bm5BRT<SFa_;qKqmk`vx6RIK=bYnYfv2nI@z4~R!}_y^5PRCg7z>7pr<3w
ze&ZV?Qz#ttHbR#MKq)&+3N&kRknGu+N*(b&jNBl6>>`2;-u*}Ga2n=XSRrcu5{<Gf
zh0?-7*TMMw=pgYu&e;b2LN;2l2^LAOh#o^HsD*ZDkgbjhqDJ`M<SO@=U<Rc1)n#Ks
z2;i|72&Xrw7MAI6leoM8m?$`3p`E^?an?O!THfUGLeKopStMD%iQ1Wu+HT<y)A3WJ
z&N<L5^h5I3wIe&z7ENj-e?7fk%Phoua3|+?>4U08)bzIcE`6aWT%D_S>DQ`im;BaM
z7Zw^iO#T#ySkkKRWc==RMZxdb&jo(>E-~Quz2}Yiz2iF*ewUkk@Oumn>+EgQX%|+c
zp|uN%>GW<|-F08Mk*<a!LYru`3s0pFWeP3uDV?=|B13ZUiu7SE+=q{8c}0ep;8W=%
zxr|n5@Qp7r^a+}oUWR#GRD!A9W|4NN2zR=>^+=~(X7LYE<L{gxrT4<MKJ)6Qr}t(+
zt~md#bh;g`M?m?xbTW(nz=Ql&I;H1$hLR^^dOibk#h_*B`W-g%#DIh81xz7N+;J{_
zAY05=Nypf~mu_Q3i_N{`(+3gY8_tuSO)q3XH=K`WXm=GG+RE#-HN}S1fm_ojVVdcW
zZf?p<pA4Yiq+8`qpF)(6eJNdyTW;`8C;uJ16f$NlPOqjFm~+ykk=jqih$c_ur{6^k
z-+*CTefkW2lmW5|(r02-9sG^%AnCMq)E(rRru5mY7zMP`>(l3O*Lvv|p!8L$=}oCj
zad!xN>R<Uev}TqRa059VTe(qAr)X{GV1u7~WR8CNpu1lVZPKKg9xN~?lR;1EVLZII
zYg|q?f{D)`eAD`gtB}?1i|CxLXlw|r&ky?LbVp{Q4`FuaoE{8l2p9g4(~|*3lW7}r
zdNH7A()F7hcW*}IU}d#Ac?@U_^S{iY(@_209^DFZ=sRB}K5t!;k<*U=@BQNM$;l^B
zOG8+jkkg+5r3hh;oC0PecU89M3}9fEGDz>7fw*f_G6GS+tvqoYU0HF-oTH+*L(YR6
zT^UN;yw;&B4hGbf^*`m5GVpYzjDe>s{7x4>IYv+TtuB0WjGhc<Hu6UFWCR29M)YK)
zn-F&e+B*qwSMJTqsbD}|nf7c>CA0D4QvS~DoY9z->ROPR=H`qc5*}SIm^)j_aWU{%
zeJlfys?`ig)ssaz;~0?9JH9qEXFMaa`b9No0t1h(6B+2bYL|u}d!CsynaUc?Q3D1R
zNI6pgGUw1t-}G_L9ZX3Bc<_assSGkG4S0D&&NL*@L(ap{+V{RWGf4ZFz;@h{qi@G(
z1zK5|qx(6h4ylznvr$KV^ay;<{fkA$Q#V7~Ag!R=S5s6&n!H!rs2Z&P4S#0K3qX71
zJ?&Ls`919y6&de1m%NOkP<Jau|Dm0?K+Mq2@8kC?599kjUGn`H?b3OelQZsi$t&T-
zcsdoR=iglNYDV<LUddvYyoM1y82Q>Tm%Nq{Jql_5!X-b%C=|%G$R)2gK}tU}&>Htz
zm%IV6bY3*zb3I)0MrKVRVy#Plm}vK>5!&FAaV#&D*5*6tZOktDQ9^qZ2{59sOWp=3
z^%L|3xCi`Q@^&2#1Dy7rOWvVFCt!G}OWw(?h$=VmLyx-T$AL>5#aO_xpSk2ZoxB7v
zD#|7A(cyByVNEW%L5C{=XRmh2`*gSl@aztkd`O4u0jF<w$%plZHvu|wUGfo~x*1Ts
z=#t$>b-e8;EWRa1eu}Iwb`df($xk!7LTF{8{0t!jb@%K7mwXIzOJ6Z$lc0B9^7D{W
z`nHLv59YY!<1E%>05qVxFA()}lYXey57&Cyt4LaCsbP-$Mv6<mh;c4k21Cz{bIF%N
zu^V4N<9yGrF8MMe8fW<xm;4$d8s`Pyxa2F0Xq-1f$m@(~oDVL<$9XZLan37u$!{{E
zVP5iYmwc5Gz3=H_fZHX%#n3_tO$Q%?OMVyHl*iy%(&P-6{1Jjs&H@8H|GJ{BOa54g
z2Ef24T=FLjg)d-awoAUoPzeCMywN3p%1{mhJUhoF|4pX`13v$~Oa41Uw+ICuH{2zE
z#@Ig`@R<%S`5z2LJgGI^4z<1@wKjmNEOE)#u@lT$5J+mxMHjx-MF#?o&veP(FqEk!
z-~BH6TOEb~c7)P5b;;DOVHPTX$Jj^>&xNDkV(1%94G+FD-zEQuhKCP?wR)a&$+U0P
zN2mBpm;7@i4IGV*^07<)g=sW8J3G7NUm4NpTu61vzcHfGdE#rA{5vBW9e2b_F8SXK
zX?XVD>yrOup)@>W@>~jiyJ^k>3y}7)OOYAT3|;iFOHmln4DI=hOA(Cd*}~U+T#AuV
zHqg2RmtsO#E04(q>M+x#_%N*pP?md=OTpJ8qKQ0W9qv--nbVvF`9NE$TnasOnzMj<
z|N2WVC4f;OP*Rgi31n0PlyJtS1Tk^|jfik5A&iCrnWJ1vC^zo}+7aYZ!kAVClsL}q
zQra*a3mALFrGzt@0F;*FQt&V)nx72R{|A>6!Dt%Lp=Vu6B%>KX_v~;fQH<tD6pOcS
zcPI$VBj}BO>+g0cZE0gWkERqRm=aGhcb=R-dq%b7(*77`2+UmOQWCjTzzIsBu!ZNa
z!2)<?luJos7@h)nBwgz^+|VgwlS^rjCZ&1w06IdVlFEpDKk2$lp@&?gtkAK5*qE&u
zZpd`MVQ?vwt&Et38f~V!6f4&twZay;lq^Q{P<+^Amy*qh9^ScMaw$2C1i7U9AE7RV
zp5+|zEQs<&mqO`{zAz+X_`2zugXZ>kDc$jbOe50CCC7~XmrLovFp%WDzAw<F3?n(W
zK)v%9moglU=&qgkf=d~}h+KOz{AVO1ek6SB0biF=gNh?Nfrypvp%I3jg`Zno$_y%;
zh{CJ}mogI@!4bEpa~t=%lv&VfXgjW-{{iaLorIC=^C!~~D0jCse0j4LI@0iLrw`<L
z)zd&ZrFRYL7IlR68d1wR9!EkWPhyZU&@Y|Rz8`7m*6)Bzd6ijZivx>Hp-Z`-!xTVs
zkxRL#!!*G9?_J6z?BShwYMzChuGS_y4LuwXa+Px94obd9$Xhxr^ay#Ig(wb>kat*!
zGK>zVhAY9HaCX3(JLQREaQ90Y+D)e+Iw&(F1_7m_8bwdbT115*Ek+5ArlR|Eu`?er
z)(_J?XF(y3EkD*qfb2eeY#eqnV-n~y^=~SNk7i)!9+?=7)~wUHgx;>+b@ckg$uLJH
zJsI<+oHzwitQ{yv$vl&I2lg>xW7g1~f7VBBt9^-&KG$L9>S{mE%!zN6yV@TFeb>_e
zdNn<<<MW45@Fs>ar>kkdS-FL>s*KQT-f;41?F0B0j7sd|Pe)hN$=j%ET`J#t;eA8H
z_G-TM!uP5}%c}KTFO;fnDXZq2Bek?)JhHi3KWL^+b!nIC7}kUm<jSkn^pK|hz~Zp6
z)qGR4mQu`$HPw7`8oM9tqn++*zNyKdjBs^XbpltS<JT=asuLN|yQa|<zNuLoN!B<x
z#!^jpw5tY#1Z(Igd}NJ=!fO2~SnSj$PM4}vSpwyo4?C;*W(>W1Uh4WoHSJbLG=JJt
zH68KkkE8GTpt=+9fv8J~FIV%Hg%uw*teS6_^0w{nXRGxs3vJtGyjQK?Sfb~Iv&U&`
zM&Ut<z-qn)%J1fW@Xu<#1zMXx&t@fb?;A@gYd>7?N$VSn+056w*Yu6WF^$ykMa+qa
zjeX_)#t(5Ny7!e2px0Foz;P>SgFbGDc^r8|)fZ@Q=IU|m4LokIO&O<qgMl6-=#(*z
zAK>E6LDKbc<PG{ZCw=rddfSA&ja=jZaCIGEQCwYnW?6e<5rMF%sMrt%OB6+f*bA0u
z?25!i7S;tUh!kOLyDKQ7iGs1m7B#jcim~@-qQ)BI_a!EpuK7}oDW>WFzGrrq<bNJr
z=DnxfbNjhv?j)X>To;tS!Lr2J{G_jGsxS7a!a)kYXtJXgHgz#`GaH!FC2Q!-Xa8Wz
z5WsqHwYw=(Ky5nV%}<)9`Jikke1kf_{-%jLD--)mou}V7F&x3cznf-C9w69fY8XQN
z_nLkub-FOpeQfGNaGa0nk4nbS)|kHrn$(MxK_Lig{=7-O<OwqD*$Br@TU20DuSysg
zu77S)uT?UvMbPZmP3rZ^pjD6=cGjfckf7sgb(8uxx`M<eZ=wj=o>iZq3sfoyT1{4;
z%8^BawOb7efZs-T#=Tz-F{ytdD-$#7ApJKNnAE>&us{`bb`!s6FI=2sG8iO`F2#(#
zCW8+~EdRT7DRyl(8I0&}>wV<UwWb6glc6fQ3tvCUkrf#I_^N#3a%86x*@Tmg#ChNg
zUurVE0Y@rvIr$vZU`R~g>YB-C5-qt2#W2JtNjC(j)nt>8zQASV3RB_^{Qp99)>pE7
z_8Fy^d@QINi8om^wmFF5rErsvOxAc#(Z`m9prorNADOc0L0JfTqYZ+nM}jolw0t;f
z15Cy~>`@tJ*t0AhF4iK|-%<mnO}dAgGribSvj*ty+H0vrAid7e9+uitMcH5{^|DCs
zRly#l*=kE&p|I@@duoy8vNA5K&TnS%6$K&eTh<3zOv2X)q|8<pKLITOu6<>xFQ6Sj
z;u(v-nA6#_q&?}OWXByYu1v>gGAumBF?j%ZM?JR425=eM!@>&|y^rI(xBUT&8C?2;
z(R<Y_n%>E=sjR<e(fc^2r0#8t9NdupGjg{@4sOU9rJ(*6Zmy|o*?%to)6zsz!mhB>
zD;C+&C<_1xFS1B~Cmng6Cl<ZGW9pN$EqZ@v2G9oWwCGzJ+_5_L(83N+Nx|JEN{3X7
z-rq4_rbSu8h0++HV+~6i0ighfp%#6KrU^jjZ!LO%*A!skb_<sqm6T=xS3j^s2?zri
z^rA&S0^gkdk56L@P9cDgdET(p(osN5fT+V3IzLJZr|^59Sh#(KJ5m5ng<16dD|SEc
zjj-t3S8V_`{$%0Sg;Eg#(D@gOeprO-R-K<(<giE?SC*FlY>5S%rj&ICG7Plz5ZzqG
z8qwLJujBFk;DxVR^mV*$09W6)=<9fVgMQFBi@uJ>)q9^HOD|Cn3(#<pg(u~e6b{!>
zZ&~^Xhy&RBo29RScz{z4E&Vh>&jF>Lvd9WwMNa@!wgI3_9?;iQ*(Q&b%680)^;5hp
zIZ^~ScutmC;x?#h8A?!ccSyb;I88~8<tXqzD`CSO$vx;7<6DZTY2nFn%%ZsJtpB#5
z$+Bo0#|kxacrtfkCV$37s<vm7xeH@Tl<ig}dk$qtjA0;G^(NooeHa(37?TIW4olrJ
zXoGi?2cfI849D}Uo01dwJdsW0&32}R$?R+_!=bxb)nxWHn&kq`n_iI2zQ%I9H^BaG
z$&=AhS-x2~90$byO18jo%VTvRBec}zT|aBM=wTU+)J6J+BoC#|3xUZNC3%=6iy9rx
zlZP|)Uo*iimL!i5z)`5fgX9;4t#+U#t-PJZ*rxAo$y@zZFeK3Ojo^Bc*V(|21wR!W
zi565NiCL*1-x`!#JDD35$=%C0Sd8H{#`!02B6O8sw-|eBg`-;~V?|q;!dhZnmi#)R
zp3+?znK>&<N!~>;xN1Do>Dx7VH&J43qAE?3_e$B-Bg!aA-UpQ2y<TsicH@)Zz+f;X
ztKJx(k>4c0Nwl!uA|T&x$!{U+rmU#<7zjn7?T6`8cKSXZiJFmofJHWIbal|ye4Bhw
za$$5R(1Nn$gV3VHjSiDUA`_+zmPD$h-hf0sK=TG<Nwyf|H;$pnOo9F$gAcJ~GV0fq
z6~Z6^eD!+DP90Z@S?VJ6@c-j_&rQdGdwo>0;bH)JYUQO_m1G|tTAp$k5wJQ=`B^xt
zDd3#FCE2GL2Cpe!AioUD{ikSkkoPIWkoPxIrql&v%1f*rRhmwzC;7|Tv7l^<3<qcq
z%$F%9$(P!Jlc!C?UZMb5=WJHjIEAygl$XF~4x6HPZd6xo-W0uaQvpuQpQ3ke?C-Tp
zgQn=6n-8mR%CHrvz9k1>d1Oj87@Tq>3JZYw+#;D`=N8G<S7pod>`y6m=whUhf893W
zx03%McxJXC|I8lbpZPquRAwgo(BthorFH_xOlv%%9%f6ZDF<a`)%g6G1Q|5t$ds#R
zLT#o?j!faoBpEd2^l8^w3HlzBoE3X1H7kKf<I;{pAFgm3EVCY_7}qiBfEkEen*_Ko
zMRfyir@f*b7S#GF{p77538-F&oy+`YI-eYkYaA~?f0c0ZA~z)zY&WVV456uVE5zd6
z2}1>NJm~#nf;9IOy`xWfUQ*N+l%u^9h7**vWB(R+F+o3e$1&jg!vtykDI5dNT}v1#
zLeBzpyPq&h0LO#QPZLH9;O!9&auUW6RB&*x8xqC}V0+%uIboat=6B1;gz*B{hfN-k
zFo8fnVO01uVWN-{Kzd<qLZSfH%2`zsCJA@}VCRzr@xM~W08B9_i2Ic?7GT1r1le9p
z83$lonIK03Q^o_Vn3}*=r=&~(2>3LCM*@|Ui2x&iO-RwpKM|-)jRZLcn=%O?@sos9
z^2rsAN4q8P7_3q@8I*2q6Kn#K0qTS%Ocjs<aI9^DoggI@AmzCP@$pmA0OHaT#K%vu
z0feL`h>xE#6`=nZEn%7n*@3#$Pmsm+lyra>%n7o%o{|AzuqDVQQc5O3z9k`xG8NNU
zrGwML5@w?c+Bim{3g-T^3hKaJ1qFDjpbl!V{Bgk;k+%vGc&niBd8#0Rw+iZ%P}(r+
z{jh|&wBed=!~B2RpaZuJ0z5Vl;N}Bq2Zs}gyfzScZ4e=k4Fp~rbPAino4yGPkSVrn
zdjDL3$GfS>BzaxA-MO%Y#jtPcG~K=u=+Ir|a4jN1M{WZJcns8m+dcxXeFR?ngw10g
zf!98r;<j%o?3+4Gx9<}?YP3%i1J|#NPbi~--{=OelJZpm(2u+#fcCBLpRig0JK|ni
z!Wsc|OU{-jtQEkX0~KVQ06M*IPEA-3K=-IK)(LDK5>$GL_6-;XP+c^&i=G*Ph|7&Q
z#X_g0qZBTf;YvC;ssV&5BMA8cgl<a^G6V?ymd;thC0uk|f{-OZ=(*gqP@n=OLDiyh
zeo!e316=D&P`eUUv;f+<JVE7s3d$$pG(6Fikf73?OkWBj3|D*q%WfTc>=xv;TSp$d
zi7M^Z2rCU2R<Geim4@pykKuf~Q@0!AgW6XR?e6j*L6u{opR@uRcPByB&xu9>oqQ`n
z<v~%r_YK7K4%8@E5f8`&%URJ+deb%Fl@aOdW#pEjru$dM!8|3G&I7VH7Yx={c=ReV
zxG@O&dlSa9gF{*NWpX&}=;NTlVW4FcK<LuzgPVs@DTQWF9xRg_O}0PJhYr>!Ib7nI
zTX%3PQNelEsa=EhNe-)A)GveeNe-LD^T~rb$*Eq4BUkZ<gE`5m`z_~^D~Al$CpoNt
zZ}|`ANiQXZ>rY!_2kTA&XJG052S-&$|AX6**ohpgY97qVOeW2Pt-Re{w{_W(!TMZ=
zZ6Kw5us)Zespp#y=21L-F{aAx!91Rz?>Q%39L)0xZL?^1{QHCT^9kJce7pZ({d~eR
z02{O|gY^Rn!3sTzJWRHgNNZ1c5}7^WH>}t|PvY7YdJ=UX(UYjv(Feb_D?FUBIfjQb
z^5^hyMp9`trefTnAS?at%-5lPb*}Y!%n$UFVTos~JW+v?0VQ*-bp-s$%zbh$KVr1?
z1(IY}*;&KN6I8en2Yj=`t)qmG?YhGc*3m-o=b}YsPxwoj2kxkdHE3jrbsS=y#?c+I
zPLPP0k%)Do0C%j30H#D{BqE(uOOBZ{ix6v)=w_^)pIToOz*u3zWD#O%!UT&@<gJLF
zpNCje7%hjT=1r`!(JXU%M9Yn4J+a+JTJ?=)M%(z2l^e}1ewEwPmT50mw`NcUJt$Z{
zO{CnGPxq>T@)-iC0_Mr0m#jf<x@64)W!iClOECqHms1h5^sCFJ8?781r!)1?k^4{W
z*f2x?E5(ufmNg$}y1^*EJCsZ}d6lf#8)7Y_5|?h`+<z*WC%~P#^U-cI_qj870V$pm
zT_}Kg+i9lNAwbXDepaUlxii-#q#%~>bR6PUR@|s=EoR)O^aLy+-IK#50vLC<k>$@#
zH#X3y6Pft(Ke<+Txlrj={?o!TQpCbt5%}yEfgH%6erki7m8Mj;uEx@uMOV4@pDNdR
zRU%L2`bt@9>a0DrZV(cCj^u~djQ}$&-h!DiL(fxa&s2=o%^+?ABXn&2r}k}L?Nv5g
zd5(6*HgB=aIN&XoMk_<DoH)uG)~LR_YD;Bi)#;RN-AyI(<^d|)9spE0P^Jc0_X;Hh
zpv7$KK7g6VP*17PtnXF7`F2g~EvoM?$4spsQcQCG-5u83qJugA-n-WS2;f^2n$kwC
zY5kZ|1-jIoe@cDgm5Tb>`l(k+snNQr^)m{+8JL<pL$Q92-MX1_Y7oi#LipInA|YP_
zwD?tS?y@XyWc`Lh|J8-=Lr9z1pUDT~17VcQ9J2ZbSib{fR*25{y;u8<rq&<4+E=Z!
z{wRP;gH`5R9}4hepBC{>fb}nG=&dK}Z;~V{@-5aU04;tsD4(GB)P^johVvfiK;;hA
ztWxxg)gQ74UHA!m&||yVgQiz!58C%H_MoA0>_Ky<u?KzWaW(uNye|7<W!u86D(9wI
z7vd#T)Vj30Key0|G^<)q%%k^FcEGCohBAG1HF^q1H`lYO9Q0<XZpr5VlEh^ms2P-u
z`@yR6Qf4KkE(J?|Y-CkAzRl|97Hsn`!3eKloqkreEl`W$B6zJR*s5}VtIe9}mTdno
z$qru0YpbkkN1$hxh-7pvf2%r&QSNdJ7ErLhCzXXV4%1d+u2q#+Vo-@->xmw<t?GOV
ze&`ll06|TcoG{j^F4QH-yW?npRds<kn;WRiyhTD}Buihlszo5N1i^ZFRH#*MlFDxD
zR$HPcBz^{N)U&Efv9LPp!<u9*SX;xYE~nNkns?T!>TjLOanE@#Sk;#$5_)8fU$d$!
zz=>fR=;|V?x>9J>sHggy?XBu6>Uq~4<tyGSFrKuky2HyXxbme{)ji(2Kn1XTEjY8=
z`Z0<>tm?W3a3*GbXr|WZx|*%(MrfVg$gTBNuU0fFbrTJcN<gif1$ne?snq(&s%{k}
zW={_>yKO2YBN@laz!0mto#grMIJ6z!NND=be?`KDE!=GCHhq^jl5@AL>TYOJQpEDe
z3Ru36T0Qyk#=n%l`7fn!{Y$B~U)M_O`kX;g9)zBp2)A`_|4YxIf9W~=FFi-R#x2`p
zRgVgdrw695v8u<!)W(eB&^A=8lZ?V$?KSn3H;$<&=F{Fdc9mMyGu}A1qlKOo<VQVi
zEWqcf=djz<3sfU*{YB))yAma<0F}Ncg0+C!qS9RyF?}TxFRd#%@1}an$2_i?Rec}y
zTu%;M@mj~?x$3o!b>N!UI@YY~-W-@wXjN|rjXB_i%9~JG?Qh9}HsAVK)ejj3H~PD3
zyRGVN@|Lk}#SOKp{{aoFNI+rxtm=P-Q(x$VkCB^|>ajKZveByEA(`_s#`%fFNj=U8
ztNLkUl4Kanjlkm`ujJIj2CMpzlK<gmSy!0wlh=f8F!zzr44w*{`;Aw0)EYzzKMdcF
zaYy=_H&Tot>SJtv=hfFE-Gj%bUdf?9R<{}qlpIe3Ygi3Fl+>j0WArr`MUgcAM^-}>
z;q>|ec{Z=2gI$bP1NUI_RzeX*XM=ka76`+$p{9_$!++iuujKHikZgdiH17&{W52Q*
z0+@b1>t8rwHONJVm<F+;W`$S{98B_ufOmSa)le6pZ5DI)-8EK&?0i*l^4egv)!+-7
zlHw0kGtFu+32FdjnQJxp3F4KBJswyM-1Nun1?WgGtHECulVtKZ`&p|Y2n+uCL*zA*
zye)W4biXwKd#dEao+c2^FNbWiIIE$VH{+QHVgJfKzH38w8G`fP4YeA$1C{?jw_x}`
z1?w2vcqJ3hln>3vu}WlrJ5f+u>Fe*;6r=PUuGy`1`h{U3Twev*x!kWMfaxS%*LJ)8
z!i7SA>B=_0wnCxn8g|$(N`SA@2Xp97e(iB^BmaN0B{>JR^2!vy6`-dak?l=8Le@^y
z{8plj^ke?ER0K60=vUSZMrgv6j5$nhRywwuV$^AVYmu@!yTwiMTZa~y*HpjX*>AlN
zycKB9@g(SsRIT(*R{vGoZ!5;7f;up9>0rNY%mVRF_Ad5&O~y=F#=Tz0Z#zk{j2nE>
zZwKa8{&$(;kwg4;!pH)wL&NW$b9^B(si0Mi`$wt3lj$T^r<LiT7qr4tfgc>{0+c~P
zKlkD~DP54h)qnZDj%+FD$82%<YOQfLu!En^DdvK{$(xjq?XZ=8K9z5J?8!yYI|u!$
zIO#pf_vH5E%tjxc;aBwn1yhjD(I5NQ=K-*SV}YqkeI6@`#_~je5bo3uV2oQPV}Ijb
z3*Y)uAX!A;wb1x6QEVCWsCx5fLsLf}Ckwe$xc)+_oOqTuCswAW%86&Wl;&N(R5|fn
z!P!K!CaI%ofxH7be0r*W;5k693`^yK=Z2b01!GPuNu5C5Tmn3>A$1~!Dip3SE}5U2
zD2RDI<Vvb+#mTfI<MmWI<SbL&US+9r$XTL|`8ZY1IOEhZFZfR79(mz4PTz;NNwtc$
zxd4-!rs{{A7Xr*Un<{h8ibbBjuJB&aSeOwh^<>tmxv6$osNtvqQ=d*PlKM7FQZodw
z#v>~-1u*sdmZi#sRKBBte31!hMJOmZ>2<6SA5eRt{KG<g@oQOX4uw*Bfuy=pWuBSR
z8(_(XRL(QCt$jR3X$PdnbYtBe{8#PN0^0NdtWC313(@0h59q`92uan@=W9PO(|X=d
zolEeuTv$^094cVpJ=Vf6S^v+(r#4>zC3E|Ob?w&Fg$UGNvnm;#>X4~>6exI8WsipQ
z;ImQ}LD$^=(X7$h0j_#1&1EjdY{WLxy!P<HdmN(AKH?F5cE51?>_xlivmbg&pS}1m
z`t1D&&}ZLyiaz`Bp4IVtX;KaR?w(K+zuGIc@Y`}_ZTz0htApQ&g1Y#foTJslpDB-g
z@w?J!!td}pe)xS>tB>Dxv;6V9Bf0^8D>???x9a3T{B{`~gx{tup22VPd%^e}nrp`I
z^KUf7Z^gRC_^o{|6u++*G{J9RK~wy;{kj=`L*|BYcXi=tH8kd9UUEH;+fxfC#N5H5
zka;gDBd26%DKVb_#Pn2^;mE>yF`okA-eF&$L2ty|)sg>5%S<Kao(_UQs=XlQGa%DN
zReJfDp3t{R3Rg}5tsQ2F`4Z(a?>)p9H6-RMJS+OeIx`Amz80ji7Oc3R5c2?V{#JRB
zHs)I>)!#slnjZ7L#K+|UTXxJ30@w_Sy2kt{fD_s7#W4>FQdl$J+#K^0z`RXO09MtD
zc_e^G4A!)c`PH1pcv|twp_t#yc-|QiIBkX!^O(<jqXN_L{5zlbcfvQ<l$byGd?*^y
z{#RrECOFQGo%Vh)PYBM$12k?K^He}@bcoLnjZqb%3*`~>jbVM;qn5=i<nhFVgVpXa
zDtf8~UBK6)NsMZwY3-F^m<9BUQF%zGLy#H@nA$2vtp<oPhyZ-`$MUlI#zqMzW7L`q
zjZ>r9n*8rVm)`%@<K|{iofws8YZr6@QMrMKWOr$xb6)VmTd?6`Qj8h|>Vo951;)Nw
zvlz7rP#jO|Dj>7vDX>s6LfyqDF={zd(rG~i*1vy?D3fRDO_TZ~In&af!6_qrh7;<3
zML?aTv|z^91<$^_)64;Qj>L2Fn6wb+UsxZeP0gsC)|y~qpxuHiQx_PUYnf?0KC`e5
z$UDFFP3uhZa)eCHN{hyDx^N<`^6^XK+W5lda@WwpYS6p$e`(!e>%ue$UfLcM%|kQ`
zpMZCIakQBu9lBqbIXYU7(8yZI$lz!>LL<HJ#g);Gz{b0`!M8Ugy0Hkc-?R3LmQ~~m
zxg@vO&7kP!Q10jmQq+)W+;8K3<1SiG1IoB@b3wGM8&}9?aLM56(QPS|DvJiubV78C
zinQoR0mi`e7pEy&bQE5tccjYbzVHbiXQwjf*fMtiQ9GIoypDHtCHlb?CJRcs=}G`D
zd>b7@Ap16ny`#Ge;39S657B(-*6~hFsW4bmcYNU0ZtCM3-IFWO&YHUVUZT;hzPDGs
zseiP*b@quYS;pk~Mh}Ed&Ny9Y&_9I|yh7DKiXKd$3sw8Fdh~D#W$Ct$@CqFt*gRTx
zT%~}jc8KPVt24{%>o^za_MSxbjM)}F79)gnIlFEr&pn!JMQ=ijaPksSN5}Fgr_q08
zUTCz+vo<bnK=dn)R`rz7*}ak$t?Dn((KX-kYqZMOg|P+*WV;)!%KLN`JW>~!60P<Z
z8r|Z~<>jw9agX+bplFq=+pfh3q-xn<{zQrADbZ+Ec9=yO>Vhg;%%ZHx{b*HBv92sy
z)l*C#JMMI}IubS8wK&LAM6T6(lHu@nKCw1h9m5!Z0IzmKjaJ8^UEypmV4d61>Nqq(
z*AGj8+MbP8$IEE945+9<v^qiTUjdYF0b-|6v5HyeY6aE4`$MAD&!KwJXmHTrFNB|(
zU%3*kekq9g)VVxb{felXr0uol<%eDHtYP?l;gOxSUVlK{PgKYC5G^BGebj^iBPb&L
z8ISt84{_N#T(TvytH|z;e4k^Rgfl?WZ7gbOOJbkGZsX`t+ly!zN=vi@M`vFf{e(qW
zrcrY8Z5r}GTeOxnwWhCaF3_U2bQEeFvdt4fPbTq<ZN30GO}frxTZn#a(SE2KXY{qX
zpsuKQV8*O;#a1M2dcC(5|5MvyueSQ7wk4I?+636Nr5&NcVDq(YMlVz}V+@?cFKt_!
z(MmkO@ri9)IHSN9LTs1esTN@_rnK*8yMp?vo4%!*?JB`Cqtdsk?K*kB2T!X<wwuV1
zMGI-rl3unC1gHS>eze^Zz?E06{+G571^ECq++({ffY}hc)b<|%RTNuw+eMgHY`}cG
zXa;}E*s;73l4Dzj99TRP?D-bk%ibK=`nL_Iquu#g+hi;E=D@7pw$*wLK<09VW?LtS
z{bi@mZ5st}oUYT>_NsuOz*&mzH708qN9lf9ww)3l0kE%z?R5ck&3szh_6X<%kloj|
zR{#gymQ8JM3gDny9AY~lARZu98)17}5Z%m7qwR<Q`he3_+fe}t0Cm^fju9*y1~8<N
z?YMy904;v8oe=N>!1yrRNdcn(s;;!1CfGg(U_qMg48htYfH$_-&I(ATXP=*DJ0~a=
zq#-}p-e~~7g?509TekNEq+404a#EqjT3_4G%<}_aF#c`(O+;D96F#u<-66dWU#_tI
zDWJNz{<bFq<j$m#tCvl!M-6u%gw9~9FKC`~{!>lT_?K{Q+R}e&ceHc&v~vPNTK#8g
zcXXZZkTLyn{3qYutT{qb@O;B=50mG<7JC%h^itNM34hw3WuOeB{X*>BgoBjQz4o}~
zNWcD_+ldeDy@kYGkCX)a00Gqi`bFD^2w-y@KhZuy0LP_EL+oP+<izSbYwZ&Sa2%dy
zv`-emb@&09_EZ6^WK|y6GX!vtb=h#uo<$@VK3=_J&lNz|@P)1Rc>-AJ`h?k?A`}X6
zc)q<vC`|$Sy=i|*KnsBIj`mjsgaedrwXYXIzr=dozEwa6fVA=UodP=Z+j)!c*!L2Z
z@#yD@m+bomu%=FaXg?&N2SB04ep~>n?e2Q^GXi>2X21P{09N7iZ`&^m=nGJ*j{Uj-
z)@T17_74dv1_HF$Xul^w8v@jFu>C8d6jtb<Ap5sM8Ue67%KoE((EwxD+kX+j6G4WW
z_CEwn;_P|C9s8f?AeKB+*vc*o<4X^q|GpGySC<GAhl97;+12HOI2^Q1v8!dxk$!#L
zoLS$lt|76E<7WH<ySh;jS9;I4x2t;Yap1fBmtEDfj{{%F2X<AmPgaaV58GAAzY3m{
z2;FU0B?Bu$fwn(yS0x84!j#z<oWkwu2`(Zo^({2oWg&IxZ(s{DmycVD3o_3BZCB63
zgeCB`!JY>jE+B<VPZw6Ps~@6vm-f@S*Df`-67G-4jW>0{JtEz%ehltXBe@@tyIkk~
z-%?|1?Verzo~cU_=8;|O@;YJZ3pC_sGJiY-yZp#5J-g*gAy;AkuN2b16oRU+{wA=I
zfib@Jxm|tC7`GI*wyS?b$+B*U@%je4`UGstx=9IqZ&#l(&zB8kPG;UmCj(+>Iln>|
zU*B#}sWBxC=-Kb>1_NmyH|Nm1^f%}j$iWt$-~%r02Ru%&ME`0RyTOOi-`|KK#%`!i
z1LnsMe{nWI4d{s)i?w+4iI?q$np|gDX5FY78`x#haCtBy%<oX%dKvtId3Hl%T2aAW
z4*PPuLAn&#WN6XOZfH$f8EZwKns!4wK}^f6J9a}yLEOl=(9v#?UPl%n&mo=cc9sV>
zpzX`%<1t)pS7}osm}6*CX`#Wc8R&d2UyA~$<8L<%7M1d<YE%ciLHeOGe1jhI+v9e_
zP@$@PRdw2RyJ46PYXF|@WH*cxXs8KT*2r!cudAxfC>OqHH%vg3%exfzu^V^*?`5`$
z{JZw@p38AXF)|^O?A}b!J1H*SZ`o!yNH3MbOxUv7ZYU&YN<E-G1MG$c5)HG&=T*C5
zksxMCW-q%zx~(!co55e&4eYm;ujMN2EEM)C;pAbXm`R%5uwEbwrdovEuvrk>)QQ7(
z!*)UZh|Kc+cEfHWX<^6TvK#c)#~L)YncZ+iX!M|8x@R|>78C)Lm}WP;D<}%+>=C=+
zJ))FOK&$*w2p5I;ETBI|!b^g>0(C>iN&i+6OO#?ayf3upn5zd*+6`Bjt2<E2xEert
zxrvmrrfgJ0|F-+QihN#C1#->(?LM0*Cp!$U)v){M3FHpL<>PiAZHp*nksN7c_tE<v
zdiRZo*?qPNjlI-s%j`bviI$CHcK7(%?(@1RrJ*ZacAs5>Vt~+t`RMsXvujkd`@9L-
ziYm_y!*KG%?(-HoD?;xBcG-dW^;``74%oTL?sGsVKLkYY=To7>UjT={YWHz>alf-}
zFNd?ZqJgBk8na~MMZ3=tWXa1-c$Y<~+PxuY^+)*1{5y(aRjYJwj4An2qlE1~nSqpO
z6T7#@xuF%KF#0b&fRI-2bq{BN6#*+6d<rpVe0SN&Eqls~f0so0rgQ&c#Y2n?(~Hw9
z-vP^8m0lCst{)-@k4UctE`5f%<4L;y3K&Q7Cim01v!H)H;x+B>bZ#vuDYZb_UNxQG
zihea#;+b@AEHo^Y&(cr68<E}saOHMAT6r;091X-2$Y|w6#et^jL85`K1!B@)45VwZ
zdsKQbW=;C{1%f_HHv_EP?#tIj%wMMKGk%W$Cp)IgjK7TIe?z}?&iM7u$#p1A*C+g8
zpj3%T*N=_00@(XZIyWbj6gmU2yQzRSEG3>wTluz>QZ4$?D<Au(^AuPa7n^P_NZ0gN
zT@;`pucveVuOCa>{3yMh0DA7LP3e&W=(sQYAe|nUp3S>{NN+EI4ijST0D${b8PiMi
ztEcneVi_G&#MD_dFrxO)rgss5{##Rqc24J!!qKoDQb(ezr}OAn85eya)!i!v^I|<x
z3e4*vfac{}()HI{Xx<xZ(&KgWs4k#+^>j|H%juj!o&FXJjhKEay$=ZdkQY!?P`XU4
z<#5sT57YaJa=MP)KThv2fXCPB4^JN;fW;fLE1k;<IKIZ1j^FkfR28rso)+#$98^t6
zjOk3hK^&u$GFdxx9rqo?npy6^g}pPC@@r*S;=M4aE*#@>2UC+7Gf1z5G#MW&)_1pL
z!?e6Em{v+*diNyDw+fc!lJd@=?@vWsk;-IP+p|G{Kbzm~x2FT$YLNO2Rv?;JX>g_`
ztbT~+J|zv#!U;zvkp1fh=Vb3;_kN;B4c^hwzEfy~{%0DfVbJAcdm$Zdy@RS`RP{y8
zcne1ME6%7US<cj6Nz0Jb>dRN-GxYY!>M?eHhTcBuH6Oj7AqVzl^FZs>C__%{i*IaS
zol#fR(Kk;2HbdX+W83IACc`9@P=G0p3_k&E4%-)I)EB_!khwj>UqA#v$kPnHt#aO0
zJ~l(zs@w#1wL?abutl>GUU?_u89{W1U+$KnFUZ9MjQ=e|Z=Q5|XH?D57v%Z_%&eLr
z&9fo_!0(R?eF={9wwd2&G!bo_s%4oonhN0TEbB>zzIQkQpu3jA%|fi`B>}bAn;|Q8
z70Ccii!x-Tt|Ap6+mg{rG{B2ej=z_oZz4_um|ZtR-$KkHFlR&vTMj@@-Hf&Z<^Y^1
z%Fvha<^pUC%FtWzLb5H%XfJzi6^np!k7lq5D-}xs3QuHo60i*5+?I@I1*`yQyE3D*
zfK>qbYcskCSPKw0BST;F+X&F?afZI;w*}x}a)zw=Rcr^a9L$h4zlvP|FKF*&^bigE
zfCg1$#0l6BFl$(b-kRSA$Y_`GoKTJeq?KfF^>6iCCjriXnxU_fJqGC2DMMc*`->eQ
zW`o#qkv39?(}#^6GWubZT2-fSY$o^Q)+p?RZm5~O4RehwC<mrw24b&Ke?4Nz#LOU6
zbS0&`r#oH4&ygvSU6j7FGFixLIIr=YoY~Z?;QHU0%>+b)(z!e{Oti7MinL6*b|EE8
z>DxP#MY0AtE%8Tr#Uat&8-LW0%nky&Lp(epv!j4`rEhK~^K8wBdgO6lX+$3HjlAvn
z%;&t3cYZmurvTO!Skg<<m800SIhnPqz|U+r29p(g<}>ILR$sw$;Om+E=))RcJU4nS
zvlE~Bh3MVUnY_Mm%@W)}k*s9)L$|cHp(lIRwhdzT<g-(J|JK}0o(NdWEE+g0vlc8y
zfmms`QQ3ojMTyKDR24I`wOLVEFB!xQtn1^sfz{LCgWtt{y==p=!oPMY!ba>T*BDfz
z$rwup286Pk^05sg8WkWPYx1%6Cz>1(rgvex`oJSO8PEcWbnofLBjjpMKr0E+x3;^(
z`&iW}V00+r`3Bxc)XV5jn@?R4pw2`R*72<P4K+Z`3h*pv_G%lT&SHw<xSV-nHW0Hn
zZW(v}&42g@$oY|VlR)e`D?t5-te<dl6dn<vek_Qd-pvJCfO<!AM!xvCa$3~@S?650
z&CM(8oZ>(>PYO`EMWr86Y5ycZ)i<epz<IECfciDnl*z{+$G;yRU`U|l-+@@91sDcn
zm__ab!E%FKW?V+cGf_JeV36yK%QzDXz8GNOea35)>hf{$=wa2vcs63aKZ-siI*dLI
zzHo*D{ZCjh;=>)^Sf{j&3X=oB^1}1(?cAjd+lcrg1H({o>xZGpaC#ZP*+DG6EFTu~
zEbP3au4>#ETAw8K#z18^!UMUxvVIsxFNYCj*}x~Ty<V0ZiRuM*(9x>tK<2=XRrt4M
zV5cf5*No=_pJlnq$ANY)gQ9^ywF;!mvEiA(<SE%oU^Jrg{a6W{{NfBHuxpL-@#~E>
zG%Zj%E7=+eObL|EO1|@Q(mzl-tGFNoODixIYoO~}gaGW?9M~g}FRq8Ownv?*9muz7
zH#`T@$Ug&RcS1I-XZH>44L)B#*^o#GYZXWbV}msi(f0>ogH_@3T(2(z`5idlkHeTN
z8?Yj}VYWL{nCSk2DK#ZS6!&|p8(xVaH-3~jW?QGpfz#0zH@r@+-Mm$6g98OO_+j8%
zwaJ5mXuK{^t?B_jsex*U02YF&Kls0r`0DUn#fDq0VbZIC>ab=cQ0IbgprWQRP?gPd
z>RYV@8XAG#@AuPc6ZEb>AnBuT#y0ikGrCsg)R(c%q|;&7Yz>Rm`@+A5qYCVeWnZ}Q
zsfsP#7jw$*Z7>#SL62iw^nk4u>d#=g78lzREV!BSF>{0yt&LB`!rwgj)p~-jD5q7J
zyQ!ZZe>kKz^<(^qvW>*gC}B*50NFRrdN;N$`9`Zo(3&5LZD%UKv(fmcHd<8v>4{>K
zRq#~h3|z(7P*kl=i)W^F?4ZQ*t4SM!W~O!Sq{Q;h+E?pw=ej9I=~%wuv1ucEx=r|h
z7p<Xof`Z@JP6*#zABN4Sh<z4a$)?5J!rrt!wzB{OkfyBgiPeWxBZ<}0W4WicxxSHh
zzM2y&BkU)0Njn@A+l{oaxz$Hnrp;1fV?+&h<^1&g+8maIhsb<yYBoPB0R_J)XJOBk
z1^1-_@VTJP{ifiJ)6fxaYBH?>+fW7C)z~A`0{C+2na@I}adxx$J(xeec-k}QBsRat
zOb(Bj#?4He%LQn1f0}+HKs|tALDO{K#}~jnY?|)-_yhFYJWY3S*s9L?P17A5Zp^ol
zS<B}CO0L(Dgk&S8Z^dp?C*>S$-J3QYVw?YaaPDSfjH%~yGhUQR$V7wpfWCf&tz6i4
zd!_+-a-f^aOG|~CDw=1LI;ebRRZ_>4|Ggj8Z}-e+blzyt22PvVP)9jH?{=QqL`PxN
z+9b=ZH4|vr+APu1O)UiqK9f~b=bQr+)hmn6J>ri9a@EW7(@`(CH5D0>F7-vE3mH1}
zGY&8n6A$`S7*lbA7^lHS_$q`GTVxH?(ITKj1G0wbXfROy^;yGplnAuHPSz+Lbp={f
zZ<gEGjzFh|&vF~v8>ppomfP6TZiC*Iovz4H%$^#~A7;_|w}+HJI%u2_v3gdBt~Lt9
zRo~4D)ln=^qf4{GbTp6~_uAs}{I`t*;t$Nt=5*%Jq`+x7s*vrA-p+3;>r7GCY~E6F
zXi_Lkm{XTSnNluQ7;(EE+5YJN4s|Iv9x^(#7S(5S(sVcsf;ZIJwV_4-Y+Kv2v+JPY
z;SCw~!1a$9XEV0L3E<n>dA2Wy!#KuP|Gn9!P!i;5;-SCrIHB?bqsMLp&gSg?Fkb=+
ze0{de7^LU!Ts|8!23a}|oH`{}nJrU>vfAJa`E|BFy=SH0wRtu#a<BJMJ>Fli=-BKK
z3=+P6uqp5@-<(kD{vB*J4&}(?{1bdR4Lh(o%|OuK=*YL^@C>|uH)V$hIo!X;>LXLt
zJytX3@DSmVc2EJvaG@!IX~{WC4rlZFYdZ@k<Zw2Bq@8~JvJ8*0sUXVEeCQX|b2y1V
zk_<5=r#+=A+*WiDAURm;BV!I{?MGhGqmqewS$WkXMn7#rPFF179C=05ABn}|j>;@F
zMfv7%vVP=S*`myeWj`Cqte<`~hlAviZ;b%md*$$U-6KC%2WXa-6Hm%7az^6tK@3=j
zc^A%+<o=lX*>X5E9<A!GmPfU~B&uxX!#=jlf5Ss_IQ>5Af}&maoIyBwapVtniKeKW
z1VnyhM=N%h=4m;D!KRe8@&_7~o-;&80YJ+R<O~Ih8rzDegPP6Gd7iYmaH4T%a=8Bw
zBp)}K_G@)5XCwlS?nQhk#!;wR`t?BJ5jmqVjNm2;7S`!k{d4O99+T~t|Kv&)l!c<~
zr@8v<mHF`UbGiELmHBYBL$1tTrCJsKk}I=UxqHd)k6cbt<jUNsxNAFCYG#UGVA{+X
zN-k<9`dkhszQc1_F?*w%?oS(Xd282E-ndYv_~y2T-N!hc>QO6K>W;iXziC6R)E!v>
z={7xAUkTz8#G0hCV_20KmdgsG-@MzoJXfDH(%$fhTz%C?7J6Pa_~&v|JN9v)1;;~j
zpG74()`KO#D>_%7CdvVmi{JX^b_L&Yqt4gO%QyQ}F4ugj{VjafvC+9bkb~L@F4y&H
zl&jAGsqpCiTzv+}ES%!V?a2&~voZa~<chmh!IoLxB)7LG*OVTg=E~eqZrVEjUT$B+
zg!7qH-6>aJ=i!@<Ay0D$icA2&yxqBj^iOhea4J5QE5}6Ss-0!qbLE(b+;27ROzsd7
z!p;ch*ttW+o=|{|LAk>Ou*dQ><vuT<6+n&X+~EQu0AfON^>Y?c03Bb-eL*OlScq0_
zZ0<;u;&CHNvEln_E-Tpy9Qb0%^MnPxA@DVPKX)wHPBgF?b0=fSK4BY!Qm>b5K|?Yn
z;yF1eHyLidQi10qqvYT_T0WF6EvuRPA{3oC0T<;&ceumJDN3%DCX}I!${U=(22$hP
zsS;NWN~AT4&dmTk$@>L5&dbe2qdQ?^$<$YJGf|!=Y&CTQGcg>WurZfWH8WcgFppku
zoSPX%z??w!m?r6EQ(1R2ce+Hx^|S6za%TwWqA}X=RrbzwDNd$>wsvdh5QO2tWMKAm
zrE^2vB6c!0DlmJR(zy}FpA#qKlix=J!SmXJ7rKbtJ(26;k>mZ~UAR20-w)n%YL`Yb
zhI9g3@Wn2TF$}l)KAP&gXrZFNKlOKMg8t~_J&rABmUR)grfis8<J?8unzG?Mt8(H5
zVm?w570dzU)G{#F=@%RTm8ayRh}TvH2MS;nZn7#k2=3RZZERIB0l}PkpL&B;_}IGO
zU_SuuC>^KBSAxw#Vup_O2@WB+%DQ>%<=}=w;dErdv%yTrsr#&f(@q9A1~_eC4J_*t
z%ujNhdV~2MJU*CT3ppJSL3{C$Qw-Oqw#DFQnfx&H)XH}ds#Iuvex1)LyeIZl1*aYr
zc(@8y)If%v@`T+-SV3D7DunQXn{e8IFw;r=AP*?<y@wEhu#|F!ovw!Dp8N_AE%jU9
zV}1_~3&zNMnqP!bPUBxMlo&S!F*iBgF#@wkTW|zur+dlN<hF;+CTwyg{poRFTb>l$
zk!&_$yM&OG`@!9i?awShh>tA_A+MN&c}sSS;Sv&xkOT3-u?WG^oCJj+sG4tZ4@|F2
zi4wvo@$q`WabUvLOxPdW6&znl^+$}7n%~44Rk?>OJl)a|j23hHYbY@6ZrvKMJ#7s(
z=%1gEpjN0lVXdR{_@2U<x7kg$RPtmrfWweIQ^}LTKsvma_T<S}ARS)Rjq*=U8-vUj
z^7J)K){MHZ<Z*VcRIp}@=v8hyV|-R?*tb<4R~*l>m#a9C*Ft7PY`}+?=Cu^Sdb#vM
zUMm8b3%47X*IEE;;`Et$GM$nG*6%#Zlj+nap^7a&uNgX@v+c*A@B1r{yK-mSqk}qg
zT>N*`n6u9X(T|FhqqZlT#^=!yIy(|w4-csH_04;hcJ0>f>g=@(rgZVzb@+?CXo51f
zmtkx2x(cX?YmbtZylw*6c)DE5ixE&)vH9k8q+J)pE-jDSel3Q>u(KoCv(y~wn@8{G
z?8mfYH`ck)Em^DPaT<Tlhy%5DC6C{p(%Y`}ex3|6SYQEPtg}uY2a|K0b9S7U*AKnJ
zSu848rcY7w`Xf!}`f;0}Lvfy*I4r9<6zMOjmp2r(1n)v5vDTlx07a{}`{mKsIJa6?
zG{UWDCKbIvMXReqtCBYw{_?pEHFc%qSh(UObWhKlD8N@#J_o($IB2|na7bPf^u7};
zpEbyPF$nq3WsezCtV-VG#-y;c_owA0Q(o#-hjn>;dEs0FGcw@UJS%~befP!B^3sH@
z4M4ls@}>$~B*443^X$U*91S?b`$LyIuI6Pj?xUcu-I~YO8B9OP*Wd!L<neaZcaCz*
ztF<_9rYL3K8}>q;tfzev4bZ4x-fW@71MGe$FGoOcfJ<e0xdQqFEM1p32c20{7rW(c
z)AIDS>|p@YbMoebVoH1gU|;9FdGzDoIW>khp4-CS;uBbLP1<K&)>7`3y>m}+OTj+@
z>sR7+W~cMcy*JQ^8|=+DqRqeakS%t>3d(`+{4*l=Jo(Po5Wb`NRls*%zBaNT9zDc!
zi?x=V{I$=M4#amdj9b=nu)dHL)(JKG&pBftg6|Muu`F&5-`3Ed8_gN#d4A7l&UikT
zA!2#}=a);wPZh{?zcGgw37nsY=ak>)@O}W(T09?$o5Sk?OlviQadYH)020>xG>5kX
z2$OU6oMg}QsPl8=osBr~xP0cwD;seUIP6fPz^^5|=tI(51tFy4)Pg`%q|x0Nvg<KI
z^4}~l!=#bDC1g87)?O~anJ-FdWLkxw(Paf4E5&jUGND^RmrAi#2<bYsV4yd$U5qSe
zO2JUC)a#6FPMv}gUa8j^*{j<NQoK^HGp@S+1ykKp+K-0U8CmPk3pm%*ZG4@Pb$PB}
zex(>Ao7Jws<&A77Bg;!Hz?oOK)J{gW|FeSiUa6goto53L&6QG&tJ!}FUh_z4hMkP8
z;hzPEE5#UDg{$C%S8N9(JMu>XcP(@icQCRZEedXVrFJl~I;#sls+3}6g|326E2S9M
z%dZst<dxEPFtXB`1;2U4wllIp{sn(}#kOy6jYB#03e>t@x$UbEG;Vf*TE9{*2SG_y
z3)H|$!Bz+|oG4JkD+PlP6t}!UjTAvHv>RS~jIiFO0=1)8@-;@8?J7|FdL>_DlyBWG
zPzQOVe2r1Qy}CdhS}DjVL)H|ilPd)o<+@J`RI68T8)IzPqd?WBdL_3p$~eCQwa_cM
zjZvOlSD-Galw_3iHx{U_N<l{XUPytux>Ar)c8V`hH+TiNGRkfN1?pz6;MVP}HLPV;
zD^M%El3N*NpTPy{kxEHM*?&`kdZJR2QMytJ)a#XkjB=T?K>g4wxP?)!>{6h9<Q3e)
zMDBa9K>c19MEmox84+fVC{Q0&N-jcBqum86ofW;tZHe}Wt>rZfxk7P?3)-WO7s>*K
z%pDh$71E8so;E0JzAcn}OZh})p{cMXMD&xEWqk^{ZlPcI(qUVn#+j&o-^-}a3uPCx
zOy1$U$WJF3dsHdpy2Pb?D9yJNa$rUm2T*r?VMlLt@h1vpTe3`Uh^x5bt8uOM(i8A)
z8=-}gPv+a!2#u#A8kTa5YnZ9Q-$4G$2TuA|*JR~I-aqKCYI?#r-ONwa^n`JgO`U~>
zC&d0O$HKDzYI?%B+>=_O=?SaHe%F4sa8wi8JsHD;-Q0pbx{pm9AN0_dTPMLJPNmOl
z7(Yzg%_xk^LDTWL-`uK-yC1(iM7Xr4@+p{zf#%k56E4Tbv&B46`k=+MGPj}UaGN3b
zuOg(jW{$vECOcY&EuFABJ;vM?F<jm`2Cwxbn%ki?$5`+@Vv9MF&$s2K!^=*v=$8}L
zlgQd0HAi6vd3k4bsy@q&v<6OdC;1A^*@O&CSu@R@t8#qAbED7AT&b4lsBPvhp75N<
z<}N5h{|7KEYNNSJD4#{&AV_sGnxny~3Ayi==B^?p<be=~zHIIa1Kk1xATWKTxts8S
znv`hnj_G8r1oEGWWym;lYzQ*EuY^P+D;wmPdo+ODmTYreT^x^z#B=g>b3F2=eIA~B
zCYj+EX#hxFy({LPCW;=3hO)AS=4n+t*?6QALJZHDvnxZQ5OQFrIS1yn`JPf+!Vpq4
z*_@Avlt|GNfsnBQ<~fxitq@Q940B;Up;MyRZq_s}!<JB3RXo)^S3*#U+9#PEa86fl
zr$+%#<jVLYs#j%XpE=v?1o6s1FwR(EcHwyqE@X$BP-@;PE(M;s@>sIL{2IJOB@z*q
zw>9snf@j&1I}(ZzE&6lwUZms7ez7V<Y7hGV_B+jwkpF%gC75GGR;ih{P`X3>5fXaQ
z{7YqsFG6}gGFOfxTa?09W>rD!yP6~y<C|3#a~=Ig{&laKRjxpHyPCue$7^q!RiEbI
zoWlLjEl<p<5wq;8HlB2=KhCUHVH=L)Nw=M;X0<AHW|n_<1xr#IEZ{=hZ1|>Dvsw++
z_Ns~uyNZ^5b*&H^E3M&D7n@byOn;SAJi`VyMOdO-WuK}<)+Wo!8)nr;mc3+Ie~Ild
z8}RcavLM^R)9^F1Pd)NnC(j{yIe1QYvk$#EJ?tRAN$LM3(xf|p)#w0TtC5ds#Avfm
z1X{#3-2n`Ry52vUecr&T_Vd3=l<b_RZZuc>93An{l?<ByBZA5^%+>B!2AxFEqD*tO
zA0Vg=?I4mIB4XQ_tNns7cTj%>Z9ZeJ_GhK!GL%tl-*CU$NRZTlgS8Rz;&<Wxjj$}8
zDw?_@B))ZcXecst5<@EfLda}Kcr&!G0KOP*SkJA+*LH-rYKry~BpJGnPQ&sR;So?2
zB-^a(eniMS?}xWX^v_fkMGP7GLU<?eG`h=>b>ARFdn-JeA+sgqHbVNAhsQ#yF^?A+
zD#)|pM0h+yq`|Mdijb?O@ZJc~8own>HxX1XEW97A4wW9Vg2hKa{Q5d6;ioKy>m>)!
zDvHK5L*=@@4uWb$JlF!p0iG2$DXr`K$+lo_b4*IEpB1)HhFlxV<Ta9<i`ZC!kQcQu
z6$=)6P~*7_s_W#ZIwVB>Er}r;w-|SOLJl&%8y)#y;*%>=8^xihR<&tZo9}$wXvPGs
zI|)9%e|TfOn-AvS7z92?R>Rt7&{S^lyP+!XYv5t5CPy3Aevf#cf=<Nm#N0-h?T*`t
zXS;pw$SNrAGCc1aId>|;)wSpz&;MucYHpFA|8nk{DyWq2eHpJ+$B1;Zs{#JUKCK3x
z^`Z7~JB=qc^kZ=ywrSjU(XUmFe?ima%$AJvb<WF8wAKFRxwx4twYtK`A++NntscP5
zt{g(EHr055t;Mg+0JcomOr#9x!UoCN%T4ZgD;S(S7`Gk*%Qm^aUX;c)w3~eWWXo4t
zKm*i2Ro<bRcu)&OFQ=~MI>5F-El2>@Cwh<9_`O<nEtf!sS~Q%)1_%X6Jfm?fuzH<V
zoV>5v-dp49_Xit6vY*u=gpa<)^;Q~>L4L52x(`*?+5t2yZ2|B`k*0AN*Dvgzc~*-O
z5DrqIL6a5nGR}<+Lp9xX;pJ|z*;+?o<KE4Y{Tf%wl@!jJv!XTbv?wW@2XFjN(+^0t
z2Uz_dO+O&Xh0)DlYux><`)x-a6gpF`aSdHb;R-BV5^nw~DO@u(-O{*-uB3DUhzZxY
z8Pl?=ym!l-{$QWvY(pk~@6E>Zs(^ee2CNsZ&Z~-=e=CNG-&$i{wHi<&r}rWo&(n|c
zRp;Bs^H43yXMJF7l(=dh571VxV}d|tvw3n@uk0CsK85q@a!4sN1H8R*o}An(Ysd+=
zICxv%HqHxVyoG@|$~<l*!?M6!JYwRh*SPAt%O8G#W9i+D^H^H9PGS*khB7Zi=Y`sW
z7V~&GT<0!mIxhr+4C<%6dNeNtEgknoFpbk!beewyQXkfX(DhdHZ{oSdS4`uf>hnJU
zX#JE6V|CZhzr_TXH3fLqXa0v$55jmN@Yx#kZwrc0_+g4mPv#rza!r=G`C)hx9wMtf
zRnCKSe%%7b#Lqelv7Zp@JXKyLafgc3ec0JUOcr82H}QZ0<Nt>vgz=OQR``S7=d*VH
zGQW=y^gi3{^9zHd?M__yjQmYo7%YEhEi}vD<qJcMow49s+Sj2Dfg!i8$e@Z=4tetv
z1_6bA?@)(<glq$v`ag#%TU~O|P5CZ|%H=0y9B4;>bf_cvjxAmp0jzW0p}qhj+Bs0!
zD2F;ySa~^T$3+fx6cAcEP}Qambu<u~I?$Hs4tWg}Z5=3Sm_r>a*&GkFFW#Y!6P-Qf
z3pNFR`WPMR1{i)E)FyKr>PCHIm6pHxrbB&IqNL^LzbX&CjeGNs`wRo=U5C0wNO&K_
zoxQiONcI|@dILBgRw7T(IeNat8Gy35eTC0u&eq=N4bJY~=k3m+d_E4I?AM$t@m%e1
zJln&ZWq7{X70;>KPUjkc7QX_le9gImgaH)T>wMKK5aHb95y(F1e9ar)$+_JVZdvWz
zjb~lYUgsMO7d_{kZ+ZC#Irn?{_c{-eUz3OrI*)k->?52fJWN>!ojla5D?Q=7;NhA5
z#Q7ecB{k{0oEJU($z{%~9{$Zf&YK?ooT|=SUjF^g4?X<pN1fWo9+14=c@NJLS>6KY
zm!9X0M$Y?Qo_o&kJ>faeI)B2m7?IJ!`N+$2-}%_XQ}0>lUkqnX%x>y@B0Q+z>MvnV
zwJHkyBds&)LZ8M?RXQs<8JAJwRI6hIy?C3iR-FIJsp`X6?fB#uEs9g+(L>Y8I-tFD
z&Z+9-m<g!Pd8f*=$EK6KQ)%W(r>c)+fj}J>IaT&yrjvYGrD{{B%H3Sk$q)^2%XFt|
z5-0~4{<{Wt^_99NcN=UQ>Qw#F9eu=^Q?8FweK8D48jEUrqXMDRgfm0|@%>+%s)d|M
ztixq^C=sH{Dtqyui#tRg72r9if$JGO*IiQ$&GT(vSFiw&&?ynBO`)NCT@5MphKF`X
zXeQDcCb^oCcG*MwU1))%P4;tzlXf4^?Q>kb_wJ+1c(#vsalb^uJ9cyR;)j5Ru(HfG
z&_ftI)-}Q-aQLQ+3zi~~_qL1I#0dZXYpyg;_?#5ibWeE2Fc(jh3ICXA7ccA-{+=CO
zE>C#wBv+{?Tx)XH#mg{7Aiuh6y@$|zm20af{H6V_-JbBoORoK%@K$fTj(Wo9E_I#p
zgh#h?UGjv#vch#k!ZDH@9vb5M2(|7`HU@=0ja@joiS(CoD6w{PeJleWcg-_OTz8}b
za=oF4-SsId2Nvi9XHJ=}xb9*T;Z8O^l<Rw4_XKb+ul`-vX99vaNXnw_9n`HmTxaA~
z2{M2Feb<+$9e46kRSIKVY8?RWP8}NdzuJq8H0%;I^=Z6FrcGj3M#&-`@j+W)H+W|Y
z{@>Pj)wT^;RHF$+I$`%Jdr?gca2UqmgbyszPXgk(Ps3t;&Vc9Gq~iLRWL&(B=VG;(
zXL9h2^lz<J+yFU**I6<0>~3EC8Vvd5Z@FQicso-rYcNGx@eTpZld*BduM^0w(#wO2
zcL{}g690SgZUM}bI{S+E2%rmh>|ya<XjW1<Sohpfyib7E5NOHJ;x`0wb0T6>@tXn~
z1Jr+5{FZ=FfE}*l{Q{Z*#I7zrAb`Vte%Im(0rXAt2NfR_5T<Ox0K8+XOMO~r29~`Z
z%spyi$l|GH<6YB1Jhd&*G6pHir%{*-oV<r0d^!Z2E8E5v)ggWEcLR=qJQNhUi^~5l
z$=!Djuv8^^&$$8jKu#k$g_QO`E$(8%-*!V6hx2dmD@)?5;%}{rrhiuX3=*fN_peK@
z9v#Q0I~kvr=+TX^&%xolxOa4&Xc*b8_%0yMJSlh0wJnoVmEy1A+}$;!_?%CQ|A$H4
z-B3K&I8^+X6h&=*6QcNUNjWN5;y1;rDwz+^;ast5@PMr~id7#0sHx8=3weRXClT$@
z*{mx*f++7gp`*s3@)MsL1E2Y(_(*Hoiy$aD@~r!LYmM?BJ~aktD~sR9dd^)ZCULBt
zu)F5!;*B1=w?pc})#8mU#3==_bW-s=5Aj!>IIk&*c+R&J&x>S&k*LVeis^^(g&d`t
zwRo{Sn`*;%Eq>Wd4;Twgm@qc2Rh;Wqcdt!(>0Mltake-&LW&V||CHjH9x^>2m@=~^
zW2?)L`W4Sa!$J0fF*&9<-NQItXG|AH61x@@TRp_pI?)<lsm0pGqb0II@rzs*WRcxt
z4Mcn|3MbVV`xlS*5bx^5@vSP=jAzb@F~yyWM|v1pn$R**7^$UwVDV5l@iWd$KpcwE
zNHTEqtm2^>icyKv(>FBMqjK}q;sGA1@w(K2e@G1wAqBrPwibtj@w4M~XJTWqI2=6>
zc4%>0WK?l@C<-_m&wY!E!`tu~WwY@_aRh5poT+x2Qj9k*(VfJZK&Zd6xC?Udt`pCF
z8W-zZy<kKV>TAV;@bocDQ9gSFeIN&dRf(etc?rj(A=F*9x}&AFD^feTlki2AS~I3(
zDMhNBNaE4u5l@QT_oq|=%4u7^>ocq{Z7Wh=lxkiJ=ktnG8=v{{;7%)xRJ#X6&n{Ba
z1=LChQ)Xit4W{GyMYt6Y5|QXvKi`Lt?dyuvLFmy%N7rgaY63xAEuK6FK<A0_Bl80=
zFDNT|MxEi|Uh{2{I@1FRP303mH@2AiVUao)VWyLkE3N&C9(&T4D@9cF7>fn&mQnP$
z1Jy(EsN+Sd3OW|zB^FiYbxal`siCK2atbV>D<rli4J-ftb7N5JgGFC>VtA)6KO<lC
z1=<p73(LCb3seXx>$YdhBfl^PY9&PvWIR*)!RyZ{y6Tqw(x~%aMF%AO86`zmTd+RV
zW;S1!SW%QkxA_!D=`NW?$34<Rbm`+5eLT{~QOs`XlV0g_<>$UY|B_TBua=-ieK}vx
zl|7YhuV|07J&E^Ck!1ba_EXVTPi#ANnXMutd@_cWk<TZ;2=DRHMCHrxbiT5--UeAz
z)(y1sabM!JWR0RVEIcqm?6O}`v0Ln`&bnB!h)Mrjv{X`!TEDeMQK>xF&QXe%=});z
z(Q<jBqOC<mp5EfCbX}2#cIED!aLE#*WLwe>ttwhjX~3B4MYBBy6zg)cMUG1S*A&@2
z#1lHv*3w;#HqR=uNtY+xLy;|B(gdLmpB5!~guc;*lKvqSnWT4={ot_fE0Vq`MNz&s
zN`C5dK?R-o9JOc&8o}4C%U}5lALguGG=TH@GKBQ4%VP>f1Hc4~Zf4|LMI900*K733
z(9u&F(nb|^l*#}j`W6*+Y$p{1?ebY^mdFb<OPPL0GGqEQF49kmNWo0>FKXfLSH6Cq
z(_WBUpy1K5Ktrp4XlO0%nl*D$yP`&PeNePt|E8zB5yqffF?v*?IwSg@&40QK!`*rG
zO|0}kE`uEL)B7KnA(aJNQHuxfT!u6`a!AsgZ7xFwNo7h7T=q6DLtm;v27WW8RyJ7m
zw@_>4;Bg=<0ObN0T%j&QoW$1?-h;tqXbtcUE7z860GvqvW+{i<Dv?;&+_%SNXh!-G
zHyta!8W@n09r*vvMY7O+<g)5F7lRNB7S1u?d~*cSSB)-1LrQ<^mTria4ecOZ`o?7l
z1nE8(?iq2Qm-PO-E`y1rCT^0cl7xf2)mgRg4{+0}3k|t(66voAF9w}I)Gxm3Qhz5O
z&#XYb`ny-hqMu#rBa(OsgrrB6r0XvAe<ZDTljsWR_Qp+csb7+Gfca0cFTJ!y`&{Y=
zr19k~l0Fa;%RsIXM#guCUs~!?=>xGwJm68l3$XEsxF`Vm769a^^u$PudKw+*gJveA
ztX+Q~bl4AC>8_Ag2c>iAIi&K<TP~HI*n=c!D18Ee43Lg_Mxjf61A!Ps(qM&jVR6c4
z@Sc3=Qn#xRe!aU(g}bjjSP#BH2$!HnKWK&sM;&*m>!iZe%FKZDdcE>MrsZyzIxn6=
zA3&(>S)e9tNC2HM>zIemLMb!Vq7UR!7qVkPBSqSm-*c&15M$cEty`Y?z}QHGaF*^*
zfuZ0Fm+EnazU>Ef%pBbp^3}EJ&Je6i8s<{dzyZ||JYjUH<2;)8xdq2br|jmPAiT9E
zcYsL~^;Au6uei!<e`{>7?RBZcJks~w(!-F?w_@DU4io3etxAsMO0>`2bgBK^g8z$j
z3-%L1H!mxwUKGepz4?KXdBCL((z6rBhcq7TQhRvRu$eR2J;Z+k*gUKJqi?ay+0=y#
z()7&x-wHQVbR`q0x|fCa+}78nHV5zjKKJF&3m|?LgwjR<gt`l>ZxH|r>rS>*kCvcg
zK!AOixvH%z%PpdtOATUsqf7N&J+P613+di^8Z7mcMKK8l!*<I;{;r+dPLot{_RK-o
zN?2FFn<_nX$sUgbxHi0GPh&bO$d;%fC3{dOa3KR6#=;VP5XOEiwm6QJY@qaZU3vpe
zp!*2v4XBtN=?$!bZs`r3#TE#!$u23U@F@sPeW#?Hz6ttL1kGz-vJ8Ke6mXq3mpJhJ
zy+63dgp@cKMM~Ywl=2zh8H1)QFIj|e-1?BMlyGc>0?2f|T9Qv0-Vy+rd?t#~BbNM7
zKBKp<wY;QI7r=m+9Z`}g5ke?O7s`}~gt7dG?~DP@yjqe%oyS2=8dj3x$*3_Q<&D0_
zH`aTXa7g|B2c4WGO<vcOgkHiEeG)s96b{@W*Gk5^qx^x(>CnmB_9XjY^H_Rkk{Iiq
z5;le(xXug0Fi!@gC?&&CLd=W|rKJ45?~M(H-YXeM*4a8MUpVqaJTO%BA>!c8CA~Zm
zuh1ELiB9HRuf8SSsNsDfl(+i<DZ5cZNBjr6?uftBKa_UzDt#}jgvS?PvGOA~jlkH}
ztF&eJk`^HT*a^i3t6R8J0IOSIK}1hw=W!*W<QWWM6cb-g0)dr5+q0o0Said_k#kGx
zlWnHX#`O(1+tqa?b%bjreuus4G}Kp7`xj!N@eG4e`yY;x+K&LZ9Jlz6XubsiXWErG
z6bnbrhp7}niwpkPslJN}`7phzk)ucX#2<};1F*u#To6}0X_!-PVUpft)N!X=pN=mt
zL8b{5wCfKAEzu>nQrLpudfusCLkl*Y1W5X>{Me7i2u**NtsV#Fhhs2${C5r7j3L6Q
z@+-{`OWfAJ87d7O-AMhbPW3gCJ^_hKsIS2-Q254u{ks6DF{1tg*mlU6>rM#2fABC}
zAGDn6F5N1nr-oh8H=HVK^-s6J+6%dn4l{nbh3?0xW<js?C)-9i)pZ0FNZe1&z!`~U
z*i@`)U`LNZTqb3Ztup8x1ku85abp2?Bs<kyRM(%r0-%L?X2gFh253Q<Q|0yE64{z>
zoob;6AX`=3NTO$Whiy)oKM5PlXED@0Os4@A&{EdNsX9#5A{oy7UyN>t!?WInI#pix
z&!LY_UJ5GKPx>3PA@r+mR3L-jd*oE<^gZe){WO3yW28N86hISiKMjBmQTl18e!r&l
z)3j=oSOtTa{L$_hQ4<>tcdGOR*=IkR3zdB|Fz^jQ@dljw4WM2%14Rwyw%GLg(W&aL
zAtX0IlGzuh_u%hB<Lj?D)H_sz6s+muP;W5>oR*!t1%SGa8*;K0hk9G8F2{tf;SM-G
zgmH@Ub5Obck+G3_wtVp;3~Qe`)VHAE=Xl8i0MtpP4B9f#55Luw6z11$E5h6T>VVgR
zpmaC$cJ|>O=Ixz@8GNOo4z+-MyWM;RZ1*0%0$B9(Zqzvk-kH>B6mpN-P7cJ1@<MDM
z?t_*K-5hEnwfyAPlE~`s(UM5hcDp6%c`0S0(#pp;rrLPXq4t416a5R9|1Vrc09pfz
z1mqT%9mr;hAM{u^Jr4E9?RJ2Sma6Mo^r=Jb>d{4ChPt{6FLk}U&!I+o$Sd9CNK{9!
zsz~(2-h{RXhweD7(mrsg>@3B|_uY~$MADtMR>BNW<B&sbO(3aTkIlA59>G7{f{j}L
zBg#f751n^zf<vX7&q#jd`9E48D7>1ui4N7hi-)v~a5}sW#IKXw%qEO!(uHoG1!@PX
z64wl%hbNZSMGm!=Czi!-!CL<mtR;fXu%Ndcs!HCPWiaWiB(*&JS7S?Us^brY|9S_t
zH8$Vz2a8;W#T3=?5QN_hAatGOc*vT^l|)pWM~DmAiQyuDq2oT8c>1qaw&T83JDrJ>
zA26X9O4>O7%czkVzx4(qGULBuC5InPIrXCB8p&nQcj!|G7dC#oApVYn_j}5K-ENiR
zcoTFqi4dPr=s1pftb|7mamcYH`b5#o94F9dWkB9J#&Lq<4jqw<?vB%93!W!Ua-69}
zJy=h1oMmYF(BF(zr(Scs!Dv5)o8vgB8@>bq8?HFEsxT{jx8r5N$86H!M;$NAu)y>m
z%XE<MaWDu6nmU$vor;;495YF<fB+-8N-74=C@equo3W`D?3m;3x}ar4fWt!OjbLuR
z(_v}Cfd<bpogEg=6;8tPEiD{V5F{zmx;f}=>E)D}>li`dYY2(^!7+j{k=pjGV}xWu
zZO$YdT&2_n5^6gJv+X>7pi2x6@ldLEar6Y?_h<Cn?->e$?roMYdkhb)(9wnD{yMqK
zKgcIQ9<|ItwZBh=+N@6<k?h)2n9tJs;>6eJ|HQ$0w>X}g=Qx^?e>wOMhB}&|O6Ue2
z81D!mfy*riL(ALzZfv53FI3-V*nd$tTe1OA9rY<{#!CxT7TzCRjwk62l#X|*{s+dQ
zjF&u9^*{WA5J_ZBdIWzMkn^4IF8rIaFCr?){w<;tut)mJLbU-J$%U&6)hbAc;Z{uf
z<=;_mqnD0{m~-J$4mE#p1#L_A(!MYq#-Q>wJ-xIg3AaF4wr6Qej)ZJ9`Ie>b<Gs|m
zw5@m#wJp<>rBSHjx8lJvY0}ajQZ?~h&|+yEG$1>u^Z3$w(D~<RgtUinJybGT#Y6=4
zU<}q9si@vSx1w6vOWFA<Wl$6~q<q64#)eh*;km=M^3#7H3EN8zi=gjTA#|?xg(xth
zxfL(zEj1L2aR8Ghl^T}Ulwmj<OfTu}q9=~_mz5f3(4_mi_ze1c@xGQ9!8M~ZRl8MX
z{Zmzeq|T&)wxn*Uf&0Yh9~9^t_C={-6!iTS?mHV_E(d5#g@|v-HUJcsfY|&}!)RF*
z)}tED`EDWCJ(l~I8d!7xa<~=rWFC1G^z25U%k&Dv0OYl=kH@|v&Qik=rjJ8oL5otu
zP(88G-C;<nf%W>Y?-7(X3P4f|P~{4M=mwy1k^S8oE?g}&wEw5>Zd6Cz%dE&$zSU+*
z1e#j~fGs?cee~&Wr3Ma7K+4}O^sH?mIRRE$C?gZKJbSX#AR|)+<u*l?8dyV6U6jAA
z<tP8by{Rz3BnH&N7Eh_60oL)b$Ai3HH>6bk4a|QZhe>E%hQCoIu9m95S8}U=3pe7~
zFtJqs`cWMHq~Rk=)pHPK&3Tdy@&6<2J)o;9w#WZ7w<VB5LXf~c2_X<#NTVe|N<#0w
z_Yz710YWID-*`caA_+C9sHoVU1w=%#Mny$LA3RY}QL&@))%YyWr-;ALo^#G6y!Bt}
z&th(7@0r<q&z?Pd%9%5VYN}V0L3Gi=s#lqMX){6@`Wsm3OCi$!{t9(M*I#$63iXqg
zNxh}HL~w@5<Vr-DPiYOMlKmZR{FHseQ}u!fD0}mfM=I0>Jz3Qg&ST$Ks7owQm?Mh`
zG{3JxZAZAjttB{s*t9L!4s8zF0@RKisR8taKozrFwa=1guTyIg`1ac3+|li-JQeB=
zoP=JXpdBT<NP2!*p=2Az+D=&9yh0t;l0yFPq^f;aJV}AaE0jE`6LJ5Z9aBJ+ZxHVw
zHJfsxLalcgidY-8SW+#|rxj|URO?03Mc)g>`np(Vt`>F^g_A-*QHyF-auH_n-a4yZ
zi*>#F!AB~lUn0vB(y_@EYKk(H;kQXo(HaB5%GDI1Af&N!HPtcsZmX+q_}dc~kjFPd
zO}`tLCw6u4tqR#1QbxxZu{hPQiNs}Y`R*Z-8~3SD-6VOsmCO-!l5NJ_n5HmCM5c|y
zDpaIo`^?G~X-c*TuHdUs(N3>f7aOS1$4j)mBy_J(^&zAIT$YM+@}(cIP}k9Ntr{{>
ztxyehCRwXI)wDv%TbNwz${c%dg~~uo>2>``YgC~h8_hA4dV<31Vk>?}frj{F%E@QM
zjH8LT(;{Dm%mTH0U$v~_j~F{%cHQoS-bsN<NU!{|LdiifW<J+J?p_-ur^P^tB$7k!
zm6Ev;%*TaSd_iLyM-Am#Z884>(KK_s(ieI)Zt?!A7VodF@~-%be#{1a)fVL)++`wp
zVNt_5I!gvuv4#1`!pNRK>HoGM8Eg*SR>AT{xsF%GxV#DNS6953Y4gVcy@yR`S?J&I
z_182Rf2#IZyx=pGTV50?8e28h<xTaaK$x!zZF6~B1v=_6*DKVIJzv2IKILXh1smZj
zhBPiYX|;Q;!2y8wc-(FdN=*2rf~k@6r05a_jiiKrE>tnwQ2?dqgi6!qTXoN~C{@XO
z4Y5<vzWWpyQWuD>WLkJnmx_h4x(<^1ot0WD7#TQ8T^dUDgj=a=Yn5GRrHTfjy1rJq
z4OR*RH{Nz$MWDUN|A>~qeXSa2YndsY`dmehWtsrgew?m7LV4C%#O1;VN94S#LhZ9s
z`_)SAe~nNhbc)yyl03V%g0V$;RaFm<w{?0>MN2xJZcG|hUn?aRPQ$ij9)Yn?Bx`g<
zk`x(RwZ|%wRLd5U@b!)@B=vKOwEv?bPKrES^*u!bt1IF<T;&p%f3-;5U|pmq*TT;Z
zde~G`-hZNm1Iq!h@{8N(jcgbx@2B?MjhMEhI?Ub3OE-MEUeMEvf<8I0CIx%xIUzDi
zL0<wJ5HIViL3v06s7pskX<sCz11E!?EGaFEU@4uYOGn85anRFV8e|V0H2rwc)4_2l
z2|ors;<H%!%G2JUrxPkO=1i9PV$joFKg0@pawUiMuz|zSWgVz|Z`e%YYcpx=Fj;s@
z(Bn^(Y~m9#Uk!Q^z1B!U<DGpHX=CpWdOSktTbqza6B3u%`1YXt3Q1uy>7yd<D=fmS
z`ELL{ge6NBM~Pv{S`BiC83iakvrEwZo0RThm;Ozc7Q!>rgYF+CNtWM2_{UJvx_<`U
z?@Q9FcGCM+y_ie}-5=-~Efpy>*9F}&Vb_`*HX!JhCq;S-ZEee{)G%*yV4WVj52Xg(
z)k5xqO|CjryNUM%-OrE|9&RT+6RMqExrz6Pu=B?T-A_oqEIZ#5|C?|ASjjhwN<AX^
zWUul-fLcBBzZqwx>x@Z3_kEI4Ucr{y-xsR={PscjK1sUIPU3<`G|nDS(0!-2h=}Fw
ziQlE;npoYSd#9ABwoB}^hy{?S;BwH-^KTU{t7>6%(^YC)H3d{Tw_(tIONd;-4?%Y^
zMe4|eP>K}mB6hxoPN99Y?V?bj={<w)8B%DtU1&z4ex^yO>BEEW0<cWS5op~LK{wkt
zs?K~nW1moKWWkG_GF4}%os_2;+g(mfEo-@uc=_X?TZZvEvcVz(M(TX{v^p<FELntZ
zV)V?ds$U&%gFwBY+b5ZA+jjeOW})-+H$gWZU)A;4bc|3^^%p@G8yBi>l9lB8<7(2o
zLDw&mB(rX~yMD2fa5k}VLDxr;bg$mx0*EuJK12xhebtY3yeWZgL6_`=7<25N==#*|
ziAYoZdeFrKPgVCVo9?@su9Nfqt2x&_5Ol4PoEPn!YeFg<*Er}}PEtgSowQsNu~irl
z9gb_Pn_*ngC0#zEt)1~|mtQw1D35tn#8fLu$w$sGz=9b@Q2oUUiK(A-MJ1mbc`sk6
zMIH;Pe@l^-c9DOFBwCjlRNqSy57`2uFZKP^wB|u|UeXTQ#m<M42K^e8olq6=zMb@5
z?TSb}2K}n*5g$}9k}ope&i7(1VPC2x?8^un(94I?bwTR`yV{FB@?cOsDFnvZ1fHx#
z;Hg>!<O?#P^2f+*dEqs;1=XWcew|(Z(OTu@8YpWGxn^5XJ<wnB-D>B1AXL{i!Jv|f
zOXLwdNj|`AZ9m-jaZs_1rJ`2YNt?79s>Vfn`*bP{D%qFQ{;%JHpxWjDeNoDG0c16o
z)*gWIRs+ni&qUHGWHr9^{-C<usnpt*LA5U=?IY`hvYb#+c286{gd|!+3$Bu+XKjgA
z>7-iY;u_saJ2wfc63O?uov%davn(gDBxE{kCI(dz`J(IC`HE`gn}0Ri(4dm3T6Bt?
ztso>(_&<a4yjew0u#<-CBx=|vDQJCKOZ2e1AZUGAi~Uws=@m1A3cnz&sOoj5q-54N
zp5*~ZW*OtP(oUQXsyfyJRt~ZSt)p5(bN!y+)z!i6-v?D3Wp$acF9el5^VBP__GtP#
zox)NfsM=fG<oK)T8i?%a6I882^Z0shPz=(lv(@3rRj;9ql3i{6&_>m3W20mZ1<Ljk
zs+R@o-LTHxgMU-O_qybAXe2pEN3$w>cXUD3XVG4N;CS#ndmOP-ndvb{;M0w&-rX|e
z<jtHPMIM={Qg_*#W&I?Jt@o-iB=4@E7<|3U(Iw&r9&M)M;vF8%7IUZ6<ig-9Qr|tX
zk+S6ye4RzD-iE^FPB`%ZHunY-23hb6?R;n-*%!PE+A%FG+B}68K0^C0S;eiBiR064
zf{P@N?5c%78eD|c>iH|8F4L_fJ72+7+H{bm^RnP-kwqWYJkTpRM|6@;dEXXIpz7~>
z-uQ{(!7)M;-B5N+vd#jp)i(!+2>uzeMl25wfvC0XJb8OiKS0=HsMs*Lkl01nnD`5c
zLF@8-;%t$X#CYQa_XlMPWR-pPzF=Ev3@Ixav6Z&62$X$QEUGQs^~NX$)i%v3bTBrU
zAcZj3SlOzjwh6jnV6rYYD9a;uXxcI3nO}Y<BFBCK=D_muJJImPZOqm5yfyY`$q*@K
zT>hBWN~wL&x+8L@mA^(q@P!VZ)LvKqn#eIHatWV3D?g#hV~eq8Bjw0cxm=J;1;ku3
zUoC&$9-QjyGfOH~UTKzh2|I}#TM;|Z{ABq}3Wc_>U(T5oRevmedz6;1kW<(7!pm0*
zq35=juhLr+#Ba+kU#;Wttl!V#vYL@bY~6y^!c4Y14nV#rvV0-L!={#x7vi^2!6iny
zKBRIK2E#W6%4fvd<!0Kl(koWpUoLxZvLKF=hxl6p<(W{`r>Fn9vpiEf0PuZ&D$i^K
zUiMnE%gXhR^U>JIk_Bj{1B<RWxsj^vl=56X?I1p?cX?N*2POThysLH#(w$hfZmsWa
z9N5YNr7$)z>JOH-aW~SJ>s?Nax-7giXUJRdiBa6h2Se%QOB186kn&CkfLp@=7y>ll
z9Rz?}?{vVeBu4$M+cP$zw8Th^t`jGOb;oKrv@@^JJf0Z!2~XHn+@CR}i+U^||0k^l
ziYOo|Gh;n-UR)0V$u$tyD>3RbAu3Cirttt`r2;(RshS<f3T)Pu#HbJBYg}EcN${wB
zC(&m7>rwAwm_}ZWdh#NF!_~ggw0m-5)a&dvYV>jbrqFh(K~<6HgrwdAsCg6c7Ku?O
z1lp&HCM;UE6!48cfOo6H2?cZJ0-hA`el@qT5n=ozIx*@Lo5(L!R>e2)CMJjg5h+nG
zqaw{ol!yQWI2X{nYIp<hb=NnxIj-+(sOuU#95)EmB*gK?et^wG95;$Q_gCH3z}qk|
zDKTm}`&F8{hrf|hkLv<9)#d#KaHy6Ev>`-w#Q?x9A*w6kDfJNN7hlLvqfhv0>_gap
z-Jckh&xV_DIaH0E_ZBXVGm4l(iMsL!)@IYA={0P6CSSv*7e3Tdm)2Gvtu08mAS7e3
zJBK7j^{oSNl+cxs%jQ}0Z)()z9Sx;_QDI^f_gtxl>)mY)l_EZ3IAJKW=M)!_DTGM?
z&3`2_pHMW&a6ge(^~rT8Y$EV-!csT5Aw<>_Zs28bn@d*%5}wS&D5jgLVU5rf2HOc0
z4ud-YZg&_w3h?k0VSse9&^J6?5+l!gg}yL*nsC%%cATMJuCQ~sjn~}zB}PqyTl@@%
z+ds+mmc#8MfDasQ-vfNBs{^;`oL$kshNm{i-^lZe%~4SsjL>kDSoQCQ-umh9*^J~(
zN)=%<QsOS+ZAPjUKnqK6?cy!HsrKNwAVlj;bqAn*9Kz*V7Jj95W>T9*gB&I(MGbVA
zj04~{OWinXHb8+>n+=)*zt_}8m5^tlJ79BN4Ycwq*In8sc2OoKF{)6wRy$m`kaLs6
z^;Uo?hwB3X_c>f~+31j8<i6T!>M(f@IaQ^>0;*aJ%d*5TMWvomiBXH|INaVMKcB1A
z1}Ntz)JG1t{{#5m;dV)L<M&!_zmw-To0~j>cHz_vI^IloVw5}qGxBEEsKa;<byj*_
z;$N*TKgDA(0P@pxuGm!Vtzy8*i%_oqgnZj)#SQ`)7V7Ku@dS1!JobHJl-yDHPKT<N
zjlIcgPgVcM-URh_)$GRJ_WoswQH{j>*|Bv`AdKlv#hGFG4^}<in1O?S`NUai1AcYO
zcXl-5t|0p@wnp5y0qnIk;(id|ep@3?oD+@6?=`LNeu6xY+Zu7d0Pq|+=rv6uQACP?
ze%$XSMzu_&$^D-}xJg?uZxc=mz{u?WH{l1%JgXM@z1O9W6=A51hr%9@0BFe*OQ;7R
z&cefp;7QbyRXy&vjNZeX)WcQ7+UPx<06K)a@8N2MGTdJ$Mz!`D%6#2n(2HC>90o%H
z20IL<0!+56e)zalU4E~rx~B+uu4ag{@GK>ih7A7jDP4wNG59ucP2fw?R<$JeT8HaR
z0Gl1IXy3Ef;i?sW_<t4dxsN=24%VvXA%Mp)db@KUK5w{?^gLV}B}SzRSK7wn`Yc(G
zIb7cac*Eg}-|~FmaJ{JI=GTa<)y+I#ljlo^D}KxKOGvp-co<!z9TTJ4!ZER#&Cx4;
z?{Ax<T&(A<YjgDa0UFsHDUQtilDig1FXN22xy{j=1(0!-W4L%@wiKh%gkc3vN7vDd
ztMh6#lkBBEy-s_2X;1HD+xb7y0A7ZtZf$O~rPpdpBKR$DS;&h#(Nz2XhKW(>j1?B6
z4djqbAhAqurP0~&Zgc9kAIzOj-CFBT!|ye2#QQLL9@2HITAk=^68%MD6!-Dcdm+-K
zbJYWh-lRZLV&oSo;Etl4FL5YM#i2AWMNmfa$S;@#G%vL$43S?7ROU<=BEMo9(tM5M
zL?XZLWjPVsNT4PPhbBf6c@YgJ=}tzE^S(^bj@czm^iP6}ZqntvpAtUS^{SfI#OiY1
z@4#Jj+UP$3WOTS()?6-IT)q`9D<LKQTJG5N83ITIm*$JHnfRIkG_{p?BwUmyzt@<e
zFP%JXopHw34X8`VGWhf|G~G8OMt&z8zjiqGCs$vG<9Gn^F;XpGAz_Yf7)P4I3ujo%
zFnmi$Uu;*=#}ve8PeH_^9!b;OZcU8*9&Sy?Io!69ZL7oWPJn$5H~OmY5vP6~b^Z9g
z#_)Z|$n%uL@eP32uU3zGAmDw8k(UC(@r1+iEZP3$aHOStA3Gd>1o%IPV}EIrBSNHh
zSM&Wr9=;E%T}qgj^^p52$H|)G<B5^~2gBsfHp8$Ox_nr)%`wabXl!!~!@-BOaX3!a
z9EC`2j$zs4>F99m0gx9moFnC0E&NK68pe&}#~iMM$!Ske0!A1!lrU$862=TA%$cD;
zLh5Og2+i=qO31U&;kp`tj&7Ulk-eHLztU6x4cBHkA8oE-TgbV|sp>9(9RT&jdcy7@
z?ALXzT9<5fim*q)@s%7)n@<BAy{gS>=o{|m6C-~W4wVjv*T{9;;cy1vp8%QxZ5j5l
zW1iL8+}@~Vo?-OBFsBEG{W=8b=c{!(r|ZP8)af@ka&?har*K+0T-hAMqX8mqj`9vq
zxZkSM^k!C-!kJ@+x3H@e-X0)}eN@OvANWNx;g^9f@^@!e5uQ)3?i`MylSfEjm)e96
zA`Ea$<9A(<-)l@Gd@OlJJG^EXRlhd#HdfxMdd*pcowL2)`@;O3<NeMF^l`}heZXg1
zntvYhejn;7RMphx-iGn1iIHdI$yZ8Zj9wE)p6M*EvFhgLINZev-F-Diny729_}Ugc
zdvhQDKaCQnGBF{aE|4-yWD7^gMT7+ahyNskHHEJ<oC3edywhEj&{GQRb_(1~o-Iy+
zDuCTmVA`%4BfYgDM^N3%68cMtV~hpvWgLfcPrJK`VR#VX7sK_Bu_V2%)I4`x_eDXb
zhl`LPztBi7Koex7jr<QtSNN|Q*TBNHh}0QlYBUndm(negKysWgP?y3fg3|?Q&{2F)
zrGJ84#>{%sNE^-H4WgKqlQQH%V}kWQAN6233%^h5zLRV#blrO<bc%qM)cx>%BxB*>
z$E8}R#C`ZM(0hclhS3sGbiA1{T>gkTB;=rl7EBN=MSn)lPaVBo0{BiVT9~n{facHy
zzN*UkS%(>ePWT_fY^cqw4zrIsbuDI{DRw~fI-q%Ri@0i;?KT4L!<eV+*Vf@XI_|^c
ziD372T8OgJj$8U~IZ%|doCB-iP76-pr4Smy%ggU1WN2kUa03=HaCkySW0K?%_Kf2R
z87*ahM6}v_Lqe>jRTX)`FuWzARaaYoRjZcX)WGtDIL1V8W||x-O^_+San7~9Bl?{<
zw?;)hNN+NdrY1C^Kex%G$`fH<XAfaTLx4)MR2y(ider9{iym8Fkvxn-b*B(opq8XZ
zsoz8zEn*#EvH(vr#=<A!vKKu}d=;oIf&0PT6aPhIB4MNexT8pXUgT}P04~Am6s0)+
z(CTJM{fU(0glZN5?nwh`R5Xf)-xZ%L8fja-jU<!s+L5fgB6-F|N+Ot9uI=G<YgD}>
zhWmC?u?qqW*#wdngPuiW$**Ay_PJOHtJe4`_aypDWDVg5I8WNjB^0P7N(sGNrM#3*
zrrarATEvX;xwr#KweBXRGs%qGi{cTWds0^^AT|2CM#Tgg2`BOu31Q+<EeJ^hL=hQD
z7%bGMb*WLYUkY`8xpBqk>Pa12zXSDYgUB?GP)Mn1R5)rGVTk|*M9K;41i*ttRS<3w
z01pzij}X`^&?aI`7NQ=(`c!nW;l6hw#J|JZ<o3DovkX7z<H&SBkr<Dmkk;VQi+kb?
zhS5}NH8E(ZHOf+})~ZrP?(H3YN)@`oQxV$gvnq;t0i}`>;^_;4HeAQ0J8cv*k*KF=
zrlwMR>9kQyN1~XHP;T;Q_#z#tZ4-F7qEeanyC=^e1HC%xUs9~?9t4{57P0O=<%=Ot
ze0vZdeg%5!OB#LH3ufxq^7Enmyd6ioHti0-ssDz|H-s+)xI%>WbJU-r9C~szjTc>4
zfQCe9p=gnDS~DWU3DWVWWe}kOqbE>P(GrT7Ty|CXHCp%)2}vTnjG-cY^gQ@S7mD;F
zFybjsP;P_P&NQD2lPWN?a!;uy(<;J>fynlf&Lf(b=Hs4iFszoMZz60K;6oyG&*)tO
zyiJ4-6un<KOhZbkW;CjeJ|qCu3`C=u=ogzxJ>{pN{4|pv>Z9wi!Kz1d+N3jGkUpk=
z#c?*e4kqHqqE8dvhNSqh=nI5Tc;S&3OV+2ZXOtV;-!NR$#qFeT&nPfb*ZZxvhNJ&u
zRGmomMhE_63%C<OZihVfed<OY@}zGE9!lstzjRTVk-8}cdGuY2N2})-EGh<bT?liW
z?d|kWYm9MSK^bA+rtYKbrOEU${dY*LC)@y#0gbCbJ^=lp-YxAJ3^JG>s*Kivw-as^
zfT@X<E&%$j_Xy!10O^;AJVkgCwT8)JBV#boaYFT4gxD)ydKHJ=id;+h)fZ_VJ*CuK
zaphtWmaInv2>Uhlo+$XIT@u0~>_>zTgrx`@0`dVc&w5`;N=G6;6Mhl^nOV>nF*3gr
znPVCd>I;C(G3kW103vftXF`t1{HrZ<OkXfP*9H*!;{UJE8Ea~c@x4Xpa8K&vP)OH0
zeH0S-`WV?-&A6Kgt|*31tul5K*+7t`YsMBLI|<w2AMO$UXfS3!VV_s@{|Yg|Jc$O!
z@3%eA9Y|HAFTgzK=n>3Z!Q3f=FfNW~Qqk5=esw(>;br)Pd2GBEr!M8OsY-t?x^&S3
zBXwyjd592Z7{QlQmormH|Iq$KBC#$wq3Z(tUbjJhw(!&7ekf7611}l>kUB*kNMuZ~
zC{0NdN(>lj^HZl_vU<2pTbw#2-;RfGNu8SM#4A(vMLaSjuiuk8&B5RPed;u%)n%g=
zq)xXI5D#uM5ig_65ig?*ahjLPkB+SgNtZDJ>E1|99jK){ZAmw<jYvnF4l}U5%^~O3
zs>}@Ub%7<RgN61F@S%^5u=>~<$s||^C;r7x6TZd5p5RqJr@vObYT3*T?-x^}rt~+A
z`j1FY?$#r@$S}hP)Q14|iopZKR5SlLa}P-AnIL295u!l8)5Q!A45a1dlHFK(e{3VL
zO+Pln2PWD`oN8?I<Rwc>Av!36<9eGwVCb<jsoA)|441Ey%Du<2qX>hr>ytZ>VuaYj
z%GP6R6d&NFRScDRiUNy<nssvVpWPOdnO+yWv~GYb`G)(RKW*Dugemi%!|N)mK1F6M
zH|z9~A{Au6fe>IUT(n<Gkb@V8^jKKB*Eog)T=X1$SvvSKm?jviIEZde$vTi<<TS&_
zW8zsI<@8i>h2$s<yi=p59T)G(FVh$^e79sNqjMC}Ib*jHZW7=Ek=qD+NG`-9#Nw}G
z4;d>B)qQr2n*N}W;1>sMh9BY*V-=SOqS~OD(pQ+_k2Aou+l8*vS3n>xmBJ?pF9Zal
z!u976n1-o1CXw~`5h?|kN`#40eNOPGxcR*8iJ8>@OXQEs>BY}-cpwZDH`Oji@|2M$
zi;yAv-*Gq9sF{Pc2wM}Q(`4Znx0l48gzh5CR_Ww%_W{l#Ocer$h-@H~3-CM<x^$dW
zIu3c`ULx?oR>i$f<XgfA0(^;X(+DX7{77U10fW$ukiG{Yilq_wHH@xi_+in-F9?%<
zFS~{fmXLWdCDRWQVNhsr!&>t0vzzwLu8y;*ahwg2kh8J%KT|g$zx*@9pXVAiHT!an
zD!^M)&Bx5}H(}6WIy~ppg#&eJAcyMH9~1r0=?3^J;VA(I8ho}E;4cBj0ni7oGX<DQ
zq>#W<U^Qm}5p;Q7`TaD;oRc+bE`1FXQ+G4Swcpbo<oTxjd~4+Ji{+%B1~2V6hq3Is
z{}O&>!W$^O$R_3sR5o%|U{#=fO0y0rD~x8LQOdOzs+j!TjuiYA3O|TmV$1ixv`(YD
zTIdd53w;4J)10|9`kY@WR(L|@(^NfII4lV)xrRd-PL^pPJrPM3U2p^`3zS`xO$N<E
zEeLaZSJv?wHEWhOs?W_jOutkI9-p|f&alG~OJEM}%KC&zJ3_iB`ExIr?}0GwhC^}y
zFxhk})8Pf|&z1ET=(&UfqnqJs7g3|;4VFq%svYgu@J0eXUmhsT&4l+^;zout>+tn!
z)v+IKI+qzqL;6fZd1^7Y2a%@<hnxbKCj}atY9?#oj@dNL+@Vg!fJk~y>Oboo_{pe=
z=>a$Zn9Y`=Mn;;=><Ne2pXB(DO+#+Dis!y@tAMt+j69p!J++z1YnJgXgx743!z-}b
zVwQIXY_VuHW29L}%&k*<=;wV(5r)qAE&^O4GKnw_jv1`QR32s&4~6)$UWUr|X%dEk
zyX?gBRpsNb<F^xTL9r^oF^WYmqF9yR1T_6EKJc)`Kfed5bRq~Bn00#7Lp#eRTRvtU
z{~F<C0j3lAkZ?|bQAB9e_-{p+0-?DI|LFqrhX4!|jhYjZ5&?F(x1TcvdpDTwgzE)(
zj7R`7jfM&IERlJHS=d<SGe}dTr8!`RZLDvoY*w(Y%u}Re4vlUQo(C|H%nyL>C+xwj
zGSLPz7M0y45#S0-A9}!i)=hi=2ALvFyFJ`CWg21r8b*<T3_SL<a2=`;GG9aHJxYuf
z22`=pM}!X~DT~oN<8zYmSFWra&_56^>ZCp-{Xo)INy3RVM#jdmEGb=CJO-Oz4slvN
z`(a6@pEO1}jgyRkq>ryr#U*z7NlBkV+VzBNU3@#qyX<7<wXQ5y5{>CgjfaRW&G*zE
zK4s>>ic96cgE*JXu$ySf+%2Lmmh~$CGfLrw8_$wf`2lr^|I7aq%$)=oa(eiPpw-6j
zE(M5_ACrNy=N34fGen{1U=d@6btQAo5}eI^JQ$-f&DO3%jaslmR!W&kW>{feGW<ZZ
zwL>+HQB>pa1Q^KzCXx`2P?<^aceR@a*p!ffirXPxW(FnCNXlZcOgH>l+BGm)Sa1mL
zn3Ag<gOq<bVKA_WRb$Nwa$VA(xHQ3CMtU4)E?+gU+P+BjlZ0YgV&(`EG6JM9N2MCY
z_{<_Ni3@hwlm<zurJB-$Y8y9Aa2UGe!=Y>HE3Q&+CoQr7Pcn0aMOf!tm|~Z9X3(Vx
zLSSL8;SR_=Cif{a%ao}!SL6E|?vjr{vpSh4Jx3##+Q`ppBM;fg-)bYzS=>5DIaJ4M
z0zC5he7T`IGq{APE($cYD0I$ouvB2tbU``@bj$<_RUWyI2%qeA<qkvosXS&G#7e5O
zs8EET*H!uE?(`Jy^tiJgY$b)Jb`(h@!Z1}dRSM0r3mvr!1?D~Il=9Y92IV9dJyZ5N
zI=|(RuGVNi#i%(l0kAlpbIQ7N?UDzqlGlehS!AD6O?}QPd3_TbJwH;T&v8_s+b%<0
z-^Ib>C1ic5Q-3ksXPMVsKfy`t*u!uQ9-*=%by_$hD_-LI<)rErrCt)v&)11GxK7-8
zZDN0&n9p=pm>wiCAex&$8m>0kS$5)U4%6wn%nG|+A3Nw`jox63C|*oc+FV=2y_W0i
z5^tv-pmv2SUz%p-(*`@>o|=G~iJ$FGJ9g<!F1D4iQC$<}&ay?M*%#1XbRJQKyROF&
z5(O!S8s8dK6l}JH>$1|3VxLZ@EgtDF86Pp!Gf5J8&QO(yC33=WkN-d-fz$K>j}SR;
zS#6i+Z6aI^C1|@_cX29SoNvo_AVsHNwu}8@7b`v>=vj>{bk_(QO{W$#Jxe-VSLp+y
zuZ012fWTw$8sFW)ms^@5ZT4V0ZJCo+EjGg33H7Ytcdm;`sB7C`8AV*%`rFns`-G*k
zuCnidT2DJ_trW`IgytM){w0&Tu8)z&lix2TNrahm%9_)4eN`C7mY2V*r+RbnDmwFd
z3mvr4zgv75;jd}FJMl`o`RLE{(xeKci=?XPx@8=yS`x?~l+rA+YExH^beHiG?GmFM
zyB4Y;Zkg4iyqVN(L?e7FmtuAz-eUu!O1H&bWMTL}Ke8<EHdd!^>O$1|G0GJ)4MXjg
z)a9c&Y5I{Fo>x!G*BFcULwT^QSi9%8W)a|jlQb6Y4K83>%mw`gt@(`143Gn?m8icQ
z<SKh5+9SeRiTZB?xmPCO-E*N?4b22IychGI?nz8hx-$y<A0ph#P}QBOyq}qjzZw^9
zEPg~fj%e&&HLnMgP~EMK*@of%)C}*ar4+KWW307r#{}W1FUT;%vr!RC=50)tj(=f>
zXEK@@c@sIt_LUhP9aW<uW>M`dsa)P+s!=o+H0#+sR*e2{2%m!78fJ#qO9uHA3l{lY
zt62x^k(Fk6Ohd?Jf{@UvF{^wQrPgbtAgF~oBDt_+2Fsi{OAf<ij515e$v1hz<@WN^
z%%jXLgiZE>Jnxhk`-;n0S41UCqcbpWEA~)kh{XjWkag|@AoH#wBhFfOpEn1b6d!ll
zHsKXS3f*<Xn@TT_xL~{X$gZ+}fJTMTSSE(1-6BTVR7S<f(f0Zxe5nDoV=-43IaLkw
zIOcpxTU)GHTi$b>S<`Md!(FnElHawCVf6hCC`(i$z&3zxx=G}#z-G9IvN7kcBX48o
zFB$#KaGy+Uy2{(F`Dxdp<h*;W9I`zX<8FZwKAvxet<sGtOy$Kmc1XfjrP%-*BVnuh
z*Z_MUVe%!Z2H)v->&&pVWY=eIU#T?1)^UP1|84lxd%z3}(4fuU1UNL<3_C*KGBN?S
z4=}@?bbwd+Qc&QihD4lptN1Z8(LuvYW>`njL5~#5+*4$RWjlO=Z<}E`OtE^TL=+fi
zSg!69WP1Gu04>>M!&r3C4C}(*<rmGc?z&%pCzBSf>3BJ`Hc*+qE97priOE%c=2Ki|
zfid*llDc%oQiHT4NyC)rYUU11G-d)w{>mvc^HsvJWMOaA6<yH(kih&sxn$82kV?x6
zvM=F!R!B2j!sLS9N=JVYtdx63V8l%q&{%<)x#VKvmQc#%bY>qWr<9m`juLtS*L0of
z;#~{XL$AAp)n>v*u|Y_vf{hX>k;iV@rt3dvnQzY|F-L0_7e~!x+Sjv#;H)`f+yNUG
z=qJb(^iSv<5hOh$?yQ|Ut5%8gHcrp`D1dRZ1!7J4gsSlko}o#N>H9WH;rE{Wuj$)L
z@5Jw^iRJ9MpAZfA{wuYlXaO4D+EoBKzg0zjwp)GMw=LfCdkIHD9;Wn@znQ*mcp=%V
zOE^JzExDj%8RaXYtj0)q7vz~_9zgpl#FA*Age!!L$t9pF8;Ri>Mk0PHaWM4w(wuL5
zQ;T)tBOn6@!1B#G-wv>Sn8P;#ZgL$zi*Gl5JCkulLqQBA^tRoKFG2jm%KY9e=Zg*1
zYj<)18-+eRz813yi^nEK;$S8+(iQC|$3vpVmAZi@MOqEii;+?MOW>-5S(&dLjBmfR
z1>aV(=8lt?s>&eUi;0PLNY)Ht5`IU}y`AZ9;g{liEYCKn+)ivIjMr$Vv}%QjG-<z`
zB2zzC0R0Q{h>aY1EsI}lbg|@>?T{kZQcY!Y13RT$Qml$iX7Z;6s=9{A<TW;027A$4
zk)B#jW|pLL2lQ|+_{}2UWJeS|+zVPyY^LPe*?)GZ91<l>>5Y=S;ycF67v#sE!|rBJ
zGJPI#BzZMzaG_yDHxj!W{#)vd(z&#fhecNY+q4in1Wnea&In`)vb|+FO@09Rb?S_E
zwQxzMVI;++&S+m7*B@Md%#02pT+ED)wc?#>#j|V0b85wNtvF4P7c--Ct%P=0C5oBR
z?y4vNS7pFH7r0HI&mIet9!8)AAYVOc`oe5v(_{FUhi#)Bp}%vsa%qC0#(jcj^v*56
z@DDeAb@4ELhckH?S3{Yf2|vm{vE&@mQ4XufFWbaE*&pq@($1KSqf7S6rqKwtuZA)K
zVbi;g>08@?Os|t^1fz0t62U~Iv^ta>kqX3&C%K&fIoMzF5TJfE<|s^)<&TgXw*zwd
z;xN+^OkV@Y_3I-%50I7Kl{{C-B|u@^<3N>!4FbGC<Q0N!)sB0U$ftx4u&SZ9we`!e
z&8Og!xUZpK8twqk-LYXka5F#E>_=>?Q4^Nx+O#))3x&Nrgd4FRa{nRxD(u@!1s-LX
zK+0yun+#TSPEu?aBpP^+*JlUJ*$K6()Chh|S}B=t`r@J4U+X)7LYm>YnneoHe32Zj
zG|MEk5dbIC4Cm9Vw*c&ZG%Fy?5MU~i5<;;6MMQ!GX`gX8<7Sw5vzvPXtglhSnj(}3
zj+v6mK+)_8!sF6|h6Nbsi}s_8VdzM9WS!}Ycywutv7Evjc0>z4&h+_3@JCU`Se$XQ
zYQl3O_c#cTy$JLffh`O*_E*Db-i*))(!;Z4MFwf@HyKk3Rh~_}JLB*0eY&NWn!ZG+
z50Dd?V~10ePS(7yP+uwprvQy6$Ohopc|>Lsrb-oP#Vaom8NMrIKx3Y%Q6s1sg}0i%
zrb1Ruu8lcG8QfL#B|?@hD>WwY0pM+fT>^bg<OqQ$(rV1lM5tx+<H8Yno1Z6~L#Jb5
zHiBVWbUHvZJ{BL*yoR97YDB)MRIF+#d35*agJqo3;_Nkj%MoW_JH#0=j$SM$K~oHo
zhtm&g#4MnO1li>sv6#s9gj{TR#AM3_4!C67@VLv;fFla+abg1ATK2pLHW1G8te3U5
zUJR9stxseax!tT<G{D;^u!Leu<;e}d@@T@>TqL?f6m%op(0huQ+n60hrV%Cya2JtM
zLWuy3oGEJwtD!uiQYeR*QfZs3)O<`B8J^ZPf5!B+gwLQg0bzu%O4&--EH!^dXto5p
zk8qa&9f;7CQ(hDxpU8)V_XNOQr2I&bbEji)7cJ0V3qt@FP%WYe5qPdb9&n93E1pY!
zjWp9Ui)q)Oaj-57Tp|<vTf_@=fk+ENb4bV&E)IqnEiy#4BWd2*XCyLSER3p-+-LO>
zmH}|pO*{H6JQvl1$0^g-Mk@FhWJlwATCiYj(OK$u3fiNEYd=CC*?b)RUt*&OBUqb`
zhX+@~(IEPQIFIRB(|8a)^$Li=8a)_hpv!s6pvFg1jAm&;j}R4)-buCxbr(8s`uK{c
z8azlOK$k5R5(-6v^TP8m&{kY-iwy$32=o}?LAZ}*@-x1*MQ#FMYfbKw>B|&yl|pVl
zSzjl-BIGU!0p@@$E)dQMfZ?=62`&E8L`G4UF>6FC>0zd?pAdN$BBLnVQjWQ_j3t)N
zfm=1I0}xH$Qr!8dd?Et~=!u$*dJrnpMU-^E>FW-aA#yTx)HCE5O&BRe{8A3VTB4Gc
zQv{&FTOw`CBB|IR-791;8=VIDG*9FL@`rV}>1!_}CrItOlOK=QQe4gGK}2pK1f<xg
zZxDjrKmE&lx~7k>O{<}?A_$Gx@)iO|z|`m%B6|sYdI9hhbW9pdFrguwIa8yXkaB=<
zkCDK-`=NJ9?=MZuuZ+N+?=jCI->_5s(C6ejNO%;38#9=Lc6#TsuKGpK(Z}S9bHN|*
znv0%64R!YXX15lj9W$Qq?$i_QjbsCT%n{uNtxexRgdP@y&?D~^{nPj@pB44BM!1oO
zfIcDoOMvGMqg6CPo^g#lNu(8lVP1`Vp9pK3Rx(PB{E|o^VY<BaKJq6>iO(4MZ%{W8
zHY4I#rlI1JhCUwh4&sukt_<;pHyOKC9tM#p6F|manf;Ap$3_?Uvg)THoDvxKh@Izm
z$%DP2l5r;tHH#fm#;HgdN!p=5X{V9nYSeh9Ao`cL?M&Ygsq$p0GNWUw-GrSYA<f+C
z9>SdhtS5pow36*P&XcI3(L!s)MW9M{N%bGYC^3EP`>J8@Lu|w!WIs*dh>;o@M&x6H
zJP;n)fJhC2b9wsi+*W@A{8xZ<!)Waz@abSR@_N>IRAfArvnpaeo>@XYXtoj0GFCA8
zN1=h~rf&{>hc^?xZ&5y$P*0j|I#fsC6I(YW_@Opounc~vNygaOSeoc_@LBZ7q+@ut
z=&#Je{chRK@CA0}f;FN{nE(~)VM9&^>5aV=JSCT%J*(Uhdv9_02B%!LuozNkle^tU
z&(SM{A#9Gy{C@ah2YpI%kKbVJnGS!~M$eW#V0*)ah9S!Y2+A(_@Jn(YQrG6Z7`9Bv
znCsVPdc`K)2wx+rm>FYqBIj@T?}IOz-tX{?MjqxkqEC#T?R&Wl+1im{UhKVu;@YjE
z8JfRhdjAi-vNEJ(z%;#Yg-UL-OTI<PfZoiIqW`R2^t3KYlggowuw*@{87!3CHKtd-
z)@I4@tWD{;^jb2!pb1Il-1DYaKKW*4zG!EDG`Uvhz`;=N(=VIeTb<k^``fv1ZCNY#
z?T(Cl{xH4!q(}6Rn8hO4dq-p9Ln3C)UJh_4!jBw@62>Q(-n%UN^|<0>Ha|n(;^%Y#
z;ims;dT*33=V|FiZnyc}*rpc0O%6X%=jM<)3lE##fsUl3xN|_3U0yj16w>D4+9joz
z=D&eJY~y){CL+MR2))tg9Tsr%u@~r-TXML~&#uNwsozM(8$>^4dUHYyhuREtcmpv1
z?KV7q8)14o`=#Zjq3-AiCuz~^9oiy&myq<2PcyxyLo6_AvrWy^)a;^(wTm_h6<s>f
z^vY>#t+G)M+9m7gk|O7{-%ZcYq4dwKbkEPVEYu?l3vHnbZ!tZ;abLI^^|`EW$CgsQ
z_;1tmiBo=bnqB^r=2Fjla2M7$-z*tDpJ__55wbJk`8L(snSjWdcBbd`5RnNsk=JVr
z@rEuc5(g$MH9Zf9a__WrKU_QaqmIbv(eqeH8B@-ho^7F$Z`mccwYX{pp32%Kw}(pJ
za?$iGvr1C`F=2MmWwlzsQ&zj^icrxz?l3)_9HwKI*d;q@4cU6hsa;YA^87a}YxBrN
zP3t~<oatfL&Nw|iKp{-eqpzvRll?|dSA6`;w?#P}Y0jh&vuA8(NwsU3?2r`QG}FwW
zIQLuA(_E(rnRiB*p1Ka1v2AQJb#-lpKep<TrJ>`vJW;iUj@BvMWng;h>HcARrLmp0
zSDI`afU{+8JI}G5weyq@imS105TfmF(|sW%#NCz<?hApGtIg&9yp|B|FSHQ!u0dx_
z_m_Ui+^u_8E)qZetLgp<osWH-6{@&Muf8&l9XwE)vHr;NsO>QBeaUn`;V>TOwi!R6
z`L<ziq8##1#xoU;)AgBUDa3uWwk+H@B%a)^+qgK*B3kM;j{R+;_v@y+Jj7y$&7!=P
zIk|(i$*sSt-+<}f5K^#P?xoXP-KFbHH-|H<4egUR0<f4cGA&)Z<$#s!R>FGM7}Gs1
z#QFo9^|V?}+dZQ;YdNT+UE$_iO?N>g^N(>KNcT4$gV??&O?Nx2ufYWdxN%ov7IMi5
zn6{c*XP(IvnC_OcXFlGqFD3_SO3|bGfz8k?)18b>w_7!lJ<pF#cY`S2;s_^QKaCnc
zO<w9qvDa~;>SHmC%K^QBwAMPKnRKL@u0KT_*;z~BufAeo!fn>hn(NOFVl7NZt|w%t
z&R`qM^=FP`2OdEfqBqvA;+Q?Qo~1X|uHqPSTCdg{YvA<wqj%Qq3^6m<SqsJ4SqsJ4
zSqsJ4SqsJ4SPR8vW9=%y#@bbYjWrvfDd}>qzocCPG-K;sgdJe%!>%iqsTr;B0(pns
z*X(1To0)_SX5~NQ3R4?-zJ>y|(QY;jloy?6x<0m*H)tPP*(}?VlRDYT`?#a6Jf`BU
zAGDPBvGsv85dR{)ZE5f0Tw9~xfn%#uBzJIaSShu>VrkF9S;}+bqC6)q%5&nPJSQ&7
zbK(Kfo&#v@g#giB2)HVPwT<uk)b0cF6|Xi8ZIxbdkQpFTZH<0rYqU*IkljJzZ(X13
zp2qmo2F10J$+NhTNqw|B_j9~<&?S@*2`Y>dd4HL%OH7z$pTEsC!W5ZC4mu%CL6#Jn
zL+?pgt+8L$5Q9$3%3czfb2^@5QXlO(8j9zb)CtZD0xM0|`%as!Ag8{8W%4Au&EC(p
z+N{k2m=;-W_CCfh2H$1_q1<Y+5bkzxRaTRQaEHM?W;L0GvzkoD1MCb-n>h*6W=>q%
z%!x~zIdN$+C$5_;1W1#G0BJG{u(dmRzSi#3qMgmQ6$fgY@zWtiO`fk6)kqXIc@m1+
zSzx-(IC=uM^fcuLTTf?f$IwO^=v7NkXKcsN<^s6$mYzbm|A6}$Jp~ZbL8e9<MrvJ4
zQ5McploJ;{IdRdG6Bj)>anX|#7d<&~t)~zmda{6kwdHO@*LL@_qNrK_AKm?|?(VLy
zP1nP=N(N3xCBH~_pH^n8<YBwJr?#P1$(BkU&LtbBlRAtrNK_JlhJ&07vcR&P5H0}D
zc9s^-Qi&56l{j%xi4zx<IB`*l6Bm^@ajlX-2ojxy0I?klu)Di82Sk`E!cM!pKW2CL
z)W<;n!|v|f?x*`{>Z>4Mvb+1CI(EfB1bMDjZx8U4?Gj63c^W$Koa_U&rLRBFa%O4`
zE8@Ahz|^k@U&xwWG7VziO8>HwG+nQeaav<1BMbA?AH*{ZWaB|R!!*4pUM3r*+Vn5!
z#9h`ofobx#V?Z`=rNmj;_M-%60(9O3a-LH47gsXy7g#@F`54{uV+WY7VRp;++sboK
zeI3e-Z|#;J*4}a&ZK-tXf321umTf7ZEu&;xdz2JhK+K_S5n;B~@}Z3EPPJWYbp{J(
zwY(FTmUrUP@=jb@-ib@gJ8@}wC$3xG0>u8M<wHr*@)lsX{0O^|+un*myX}^jZ8@0%
zwPh@8`-t80vPUW&y6x+PSCZvAHPimQBnUR2+I|>O%;!}>($kGRdAuHQjfvoS!X^?g
z6KdM%lLfA^Ok|q9$tH?zDl`5o?YGKfTS~vv>;@Zczc*bI*bbV}&^7?3H%3}BY0iG<
zX|l;ArP?Ea;4a%ZISM7C0=WJGWR~+GGvv9bgY0Tq&x}Qa)7$J8cU{8X^_a2VO4K+k
zN^_IvqC$kdjQ;2BC-?oao|YTH3@FCLPQY{k4>9Bv<P1*21@!Bnqz>fq=amy;ZKH+z
z|8jOluo?f=j=6z2<{94(=9t5srmLrqXY?(txu>hAp7vsTV@8tFL1vROQO*3xbajjZ
z`i}YI%n{78nd7>$17zebeOkiBkqbHKP+}Mb@0qSNAMZL{BvBvtnRy^pvZOKC%UOuD
zPK0z%jWNN1*a5;e1XkUQ?x1LqnFj#Fm>~5}>EF^YCh|%^r0HtTgmnCakjxiHIr9%8
z8E`dEwP}(oZKR(p$3>eQr5b<M;8iPf%46{mwPF%3NO2*1;-Kl0d2Z*)kX<8W3pQ#=
z8(<1r(zQ@6!$9jCGhGd15SI>^b}L~wChYk*kX*c^l$y!GU2Y0A(jF!}M9n&D5urC%
znxags#pry%a6gHz3swsb$AK)JPlM}Y$cdB61k>fhaOD_S+hXYL6M<&Er3G?f$ztYd
z&k>Ha*2hg;uI~7E=|^dw5<alS^f+SDBhvmzp1p7u0($KpmmbC}-AhhsKIhqRx*udr
zZ?>nHugrShu2Z;Or}XZmc1<u`4?m7z*rooJEooOYUj$LJc)7s!@JnQ(66yV#1H7%X
zxb2Ld=$!hzk9o9I!`=`!E3zBd^$yJYm`9ltr87N9A4&B^Wo@6fR5t4oQ5jpntU}tJ
z5}d#*@P8V!pH1;8U=(#gh+z??`hhj!$dNThDwAvDOVQ-)twr2?KbNHbvW2AP0kXxV
ze#{lWqly4`+zr@^0(q)1S?`9apBh-(Na;LPO`np?I$Ci7h8~8~Z-9UL+9^UBu|T51
zHm3S-G!A9<)8uDIIen)9m__=2!kq%#NkkA2(I#$rggg6Hpl1k2pg?C!U1qBHMf<W-
zIr|LkG9LuPK!183fYjlf1yFyH`2);Vf6~HKA6dddWqh2e-Uv~-9HY0))EjNYWMn@;
zy=i6b%*BxFO|?;0hI9S_uEQjtEGWwTjO|KHwYjaNh!fja0xG+yskSr+^^7+F?zR%V
zLH`(2-K14zZI-B;wZUmVTQ#2uHX4<_=szz4&#t!W5fE}Gelt}CHfy~udq<Y-v+YGw
zOsq}t@p#MDSyqodCd|c?1v2$@@#C%saZ(V#RDHl*rdr`tea^3T)mPAM?5eNQB8dyw
z{ko}&aRI5Aj<sB!n>oQ!RdGAXujc7SUucyu(m$Y`-VrAEujGAv7Ub4?d+ubL3!iVL
z6uEmN#7rLWF+^k1NhoNtS0H#vbLlIK=5DfiO~#E0FF9!$`GKi;#e%G~$lM2Px?^<?
zA+;;sR3j`>0izAQ+-NQKJ@;IyCHDxFDqbP|XTpy{aq9w84GvNK-KIEL>qDyY{8&?&
zPE88$w9`#Y8hz=5genp3#+=vf*+i@2Iv$4h55TJ1VUyQtfbJ9vx#N%=Ei9abO>mY_
zb;G=^(}snsBNohNLqc`e4M}>>`2Y!8Rw=UW+9LL8M2CVN!8oH=_?T|yI&v%PKQaU6
zS2)zdccL}vuc$)o)M!0P_^OpAoJV&FnD6<}WRW*qu8uY3((7iMh^MBR?@>kN<|E$t
z$a4|e#a?8ibnScQag&poyU?xP{wNyFz#DnQdSX!|r{tur<Jtcfe6@|28KK7O=WLOu
z;5nMFnD9331@qY`^{px_#_}IGYm7hpLpfJkO`g;lf7*{oiniJmM%Rd6`*W!fwozk{
zcnF=ZwYg7Qc8$^Ig!sRXn#xDhbldOKO{V6h(7*4{%|tVhJ;Nsx#kX?J38IO43R<|n
z3Fyl>s=tJ8PDmpDiR6k}Vvg3i23fh}u_d`?&sbrYqiL>}Dx+u5lz2<}p8y2{;4dUT
zOXAl{+<1VB7j!l`jUkqd`;5&tNBH<V=T&pK4@RlKn8P%q^)Pzmh&c?OGH<<XXT`or
z@@pmLP@Q~_l{_?ACzEn`syRfbJQpA-`=~i2S>NqVQonD^!8%Dk=S9lkCOQSK;Y-Xx
z!aZ|`IZ*yCOECw?--li``};)JsGCjs;tp>Kft|YD>?^6Sc+5WX*R{;-?W-i$+Og|;
z;o6M6e(3W=M5XLeqct^uYSqp2ya|Ehm6eQ_e3^#y#t&64cap{6PMoe>-qqmVXRY$e
z<pXq4GS*vHS?pvyU}Y@U8HGxxoXYV|;!9TIcr?uI(IgJ-T{*-_{Efr_JceXTD!{$V
zDu?tE9u~i$co0OTRQ0S%s}hDPPO?b$s#U0$E@Vh`pMSlwou*Hz?aM10*}RIy8e!F_
zqs?k{L1m*JkPm434^OU)Ox7Z*;!<+<Nve!w&IfZ;xngIlaiZeh_qQ4@r+hY^Y}H3$
zmBsrYHm+N%0WvVm5lftYvDNiD<tQ}LkGHxWOGdM~&}iC9KENxAFMh{L?8v}i91R$w
z*bH6KDxK8WsWrxk>0r~Oi!7ML^kGY&mArXr998pL@j~95R_Qncxulg7{zgVK3~<3D
zUC3n@ZQUxf0b}-p`6Txt^b%k_5!hr56M(s0Mj>Gio^C-!fY=hkVtwh&xXf051i=}r
z1^W<l=#*CeCUzWA{4mw`A|r^OVZ%5Yrt6u2h?J3zP`ZWk_ujGH9X^|j5Z>MH`b}3G
zbuIW(zPAKIg#I#O;S%D1a&kZ|_||frfb^IJKVV+68sg`*B!22w3^t6uIeynlh%A&3
zYDe`0z^lGg32<gFKpO!fmU5AbYc>033tI_^>aUsm8%H+zU8A%NHAaiy=@=eS?xJw2
z(lo*E3djKtnF(i<6V{}b&Rz_WQSBrPh<$`zWIcAm?;6cqSH9qs@iO5VkPVlCq*?GC
zM#e?L1>|{Yh~G7aA!<%lvX*C}C69a&kmKUXMWqGMw=Sgy(R&&{xk09=EiWUt-2EgI
zZ9%ju0r4vc_x8a)gKHaF9g<XeU8P8G@=?VlanDe-+~52zJS|QOo!4LNcXbCj=ULRX
zs9#lJA=iGP5SeHC$N60m;*5{h7&ku1-|<=(e^3_@JEDV#jX+3{SyH7C)unyuDd;s#
zaK%z$4pZ^D$NVn+9s_omxrMNaDdn1KO%sO{InnQGP<IljGlu;BssjAs+p$>Rns3R@
zd@^&Nq<lP>1=NjHeC-YyG-6McpXMbj4nXiOjy}2g7L50FaQSSRTht%{H#wu;lIQ&D
z|1_FvmdKY@w%rYe-Vs|JBLgY`?&Br-Mpn~6f?xeRT%-qz*yC4!ke^-zo%QYfN<V@;
zDs*;$Pd^T(4URM2rt=AE(Vy|cUewo`j41Q@3cq^W7HlIqjLD+R#dEaY)H_nf(wjO<
zC)0|nyyRE!TC9!CC(y#<3EYas1ZyKxdi{&`{7T*}UtEv7U*sm^%ohmH2|yEPo+O-*
z8v#V!+(^v^Qsg4PI(Ln_uhsU4GV462)t!&JH;xafyZV3CEib|}?Ce)B>uOQQ@qhc(
z(~j~_Q476Yy!d?#MwIb1qpS3t%x?%^a21?f{?+0FXVmmBSI?>Ey@(!=E7meE6aD~_
zE7r0=WYHM#Sl-RA9<q7#oDM-ffhj%5g*|cw87Q}5`0Dx9W9){MrV4@kC>%$SBUiq9
zaxczdpyq^RIXGjLTOlg#xdMWofM3ZrUFmeEa0Xe^oN^3*SzSZLHt1p-q?lhFVo_GQ
z$0>!dS^b<+69C3>y2WC)%RqI$CVureGsDsoPKjA$ni<Ee$Jc~QoDLsW#d`hMb1w}j
zlQKE#BR2m0t?FLtGUr(ocO2H1jgR_=U#-)c!8Vt)ju6+OHfZ}nb+7&9S6dvQ&N08*
zC%`A7(hRgU*H-DK-n759SFkjdcB7-KxgFp|N6$h#S*6LEZm}i>yo*ptFP8>hKr=}L
zXR+g%CHr1<eWh0xbp5Pjgr`IUwE8Bhge^YkS8|$iiD*C?J&W38z0C1QtJTi{{Zozv
zt&OJ00d2lV{Hm0*+Dn__9@h3E!+FAo0_4;Nm?&mlByhWwTARdVbJK%F@Ee6HU))8$
zY(p8FhI3JMW6{C%EWbWiD84SR@ig^VD*bcmk5+Z3IMw|Xnm^gql~4alb=%=u+sVZ$
z(qX6BIotU`HnL^kctOj)&#z{P>|fckw@V`rCaPt>3It@9+nJCfNl8Qo5e7&l((FpO
z!pr3a#PD)m4anQoSlQLD^6aMEa0v1AuFtYxT3ZfJK8_Sy4KX}LyV0qZ<IB^I4+PEI
zt`vV1DB!IM${wXk*;Rhk$Eng@GF0*|-VzL}uY-IF<de2W`Z*eT9ptOhwYYI_!!OcD
z_|<)6AX`?;jz|kjrT#@YEq!D>kxvO9)3dmZk775<kwf{_#Rl^>;WFMMw~Bp7&Wlbl
znxx&&(wZCC8narn#m#<I-?3=wt74=vSM)#);;-ws5r54G2Iv><uGng*kCn?*sXb3!
zjP|LPUyc`?tp+aLvofH(_M<_b`NOXoJIFGS%Rq+b`juahdq8X>1Z~}zwr<+L1oB0Y
zO&a-Cf>Zny$dh_A%dY~74)y}r^9cG-Ce!>kW$m>pf%okn%EuJ+<ABI&ze+?kWqERN
zayZ$4Cj4Y?Qf;C<Ir%j_(bIFA8+wxp7{%Jy&?c1yqtl}ssDB490Y_^2M>_20$wEqg
z#nH86U#x5yts$MZLkxjEA>C&?V6Gh!9rw7oT$-L=T`IW|r5=`yc;pUggjCx-cE|zf
zL@B)q7uZ~>i&avLF`+p=az!Hbdl=1i=t;=8>qkB|;rNyMg*M@U*@UyPq54^{t{)T_
z96MltmJ>KDW<&4V{Gj2!lh<wnytk`(YO0@ftV+<sPQ-A(az#=A|FBWCpxwjD#+I3c
zNrK(Z;dVQBz@$5j1zGvIU&)7x#JD;X5N6m;aN{BE1lRdh1Ws_pD~>(`3&~XMD0DTz
zO2-Lq<b`(p=1qPT$t!>>>&e*ND_?$d^2J%;IXY}4Y|w5`#&4biYq#eL7r)1^<uQtN
zS3wOkulQ^1dTl5~$o^^{lkAnZ(2ltDU!BTSL9{~d>y!>%F18@Q*uwA8<X$7fqR$Rb
z6OP&)v%?91*JPo;fzG$`7MYGNp$tr)-RnPNGhM$Q)CuXHs~0ovgy$J<G}nH$!@CeT
zlOp5Idyf9T2lZ{ri~?})JF@)_?zfa;!+%b4<*{cFCHn@{An_;v2X@JhUBTtrHCTU9
zY9PPV;3MwgTGh?2LB|n{e;tR}Rp>}dcbq6!9?GD#{<2nnr2kXQf7L>}xjHT)&uqK3
zI^F}Y*SXkqLsQx0<yY+ZOWJtVy-uO?<YUy*eWoLFbo^Qu679C;c(nY{!hJ2maqo&&
zZ$~<J$DbV8t^iziWZTf6>_%j={~`m->N+-?PE@{An9ZhBLx2XxKn#N6bi-&}nRNfR
zbX`4?c1k8a37~}xr6EXcsuMGyPHB!!ZI~rCRdvrQZ;QZQ|0_{7M$Q44>s{#8=V(M$
zT(2~d*)*j(6LP?@@OlL=rg441^-5W~h;igZT^lzF+_02c%fP+i;4r#QyTx8!e87Ly
zwwIodz)G)p*YFt~h6)-69KOnz>VFm;uW9a7{$7gT?Nt6Cz@uV}J?RnFY$^-8VFk3_
ze_s?crZqBqdA`5@J|s8t@HuPbBUgz1V6+xdJ_SU@4qA}xhu{3YKTr{esmj`E&CPs3
zXs+SkZrK~jtN-IK(n3pWb)=Z_BAp1Kq&@y+PMn$9>QJGcE&ZH(!dFmeZ8Q?mAqsSV
zh}Pr_P^JFRQ~of2L6&Tg$>zb_Z~X-*T7M1dl}G&rI7ucZ$nfB2{;45y!!2@CH96vt
zm@4FK3RBUCLt(0>CKR47_D={=*kMu7n`v`|!lYsT38_~}OhBIwi3wdLE+pRg#NX2)
zu`b-IM^C0lvDKCkJ)2*p&@(MWp{mJRZ?m*aIX<UHzBFlp`LFp02`#2wgP9z^kfXRg
zM6H|6Nd9JYRq<Lrcfs>M_GWXGz6wdd3BGR3wJ2)?A(TV*T30vD`C16QiAX)?=X@;_
zrKyq27aKX>60I(bTwY@2d>2pjGpv~Lm|GI06e8uE%Bi80{ngc+02{7FMvh)H=0z@D
zw3N6=tapx9CgjLTRoU1HWbnN*GTuXtW6oP_@1f(d!z;Y*8791<MS^>guey*NuT<vT
zD-9!Gh3XrdbAMy-3-pJ%a^%5=#Uk*?M>*_$SUjGLE?&0K$YEAwHFNmgIV<VQ_4h;J
z&FGxfT5jU^^vGGm#4PY6@%S-0>ohgN_s!X=@ph#HC)vvU$YNQgGhu<R-<q>e+6JYs
ztz*n{_GGFT)aT*BzoBY9x`>mfvVmus8OCkha%Q3I@(kF+VHVF{0#91nnBC^8HfDDW
zX=6_7kT&M@4r!xmL4cRJ2IaJ}t6ToPeA76mRjO<mS<=fB(!i6t_0o0g={C)<+EjLL
zax$CpfMFiF4;;#o1!3!VBbUrIa@w($EB_w!KflfCsB0Q2)8!nwlR$4|x!gJ3BtBWb
z@YU>aPIsM&c%OYac{+{{DL)Say`<rl*{TvP&3Y!MKjRaPC42tQZ6ed3jes*<V$l!G
z%T|%-=7#Z>MNcoMhBtK5_M5HZ@o(1Sh8y}{i?U2QltWB<@|x_|gwh9Sx##@s*XZ{8
zyL~yQvQIee-u<rZlcwac+jqu)rQBp`(`@AxwPk-0PZL*vhU72p%KlI)_6hNgv$FN0
zIEg>?RQ7oXzxcWAD-rrZLp@4$qL27jXImR;u=zvUCwo*IX&(b8)!^Sd)FV9M2tFJG
zE8?w$RgClt09M*Ok|~%`wfqKebn87k^r}4gFct5Uv_l<=l}A$m*;PB#<HG+az?eU)
z9=QQ0aBPP<tYrdscKr_h;dEmTEfTyPOdXPcx=xDduOJHe2i76mb%_1qJY3g{1v^x(
zmn?ME_025ta<Sd&&mh~pj70H!($EF-cc{)(X??Q@Ig+|VbqN>0yeERbyF)(#sxGwD
zYy3frzgVEvyF=X{vAmQFE8{3??LZd7{Mm=l%N^5qC_dn**3YmQH`I({G{J_brMghs
zTPkjfDKW96&~TIzE`?UdEDwk_!?EV-&tyM&!23J?@{n;3sa4`$cKl_fVJ1&3-oY0o
z)%s^OzNV#=!8~$K?WjrDMJPY=_Z?q3<=@x&zDm)wDIec<#~I3Rh}HNrx}%1Z`K4V|
zeb;-N#RqrrHnQwAs13bzmgjXNR|VF4%@!wjER(W_qYGvr)UqTo1(;K_Wf0OM)0RNh
zi|e^2WIL8dL#?qYOiOOK*TUR_)@V8DTcqD<D+H;_*6c{MS>M>g;*iMeM-GQXs%mrC
zkw``OZsGD7v`CV+8yMW^u}G!}$-q&0@ONWF3)T4=o<nV(5NUhY&MnmF#`#j!ojgWH
zo8rWGZlS+xC%&r5&Mo~Qm={U&@8mf$tq;+zy>`lF5p3x|<(Vlv3!t*m)I|#zA*!Qf
z04VFbb5={iSADj@YbGV^oFkqij})lRkzv%L${UYRtuk+<C)~8NC`J<CvF6auA|`=4
zzWBMF^C<kRxHx#v*Ssw=<&_>0LAt_oo6zIUckLWx_k@i>EzuxG_3A?XBy#7VZuq3P
zb!B)|V^yZ<k2`shMQseq{UFVYb`BFxzg9heBTtaJQ9pLUSbM9Dr!=+pni`d8f78zP
zbUh<eQ|stZL)1=MRL0ev*>oYU$w92<Q+M*pDz)JgVumKvJYB@1La=P1SrV`F#?F?~
zqWS~!^ZyfAF$t%*>H282zhV-j!}?ay(rs5vLJIl*r141cib*uq%(r2;Vjc*J!tQiU
z89NmgyC=c=-z+=bT3ir3+D<9^R|-^R_}mgGdq?vlo?TV;4qDU-zc0J&9aA>fq$T1`
zmYwA!(xzvKrynnS7nd13)z<!`KEmulHM_LbC{x-a?MsKsGbwn1w>y;G&gx@x4<vx=
z?E{1>aR~0~XA_K>S#~GhEMp<W|MgedUCEMP7)>hMAB|@+G6Ax8mfg)%R>$KXF1tq?
z{X?4RDHrMg7+F@0scr6SOSO5DFc+IRc3Fg(Y!B|6xu*jv2{O2E9)yI+@0D#33E#6M
zWMLAL@W#Fj#=6e$sIpCtSSV?;BT3fKvMoBU2ivln96UO@83|*nEeWfXBh}Z!&^i9K
z`D-nUsbzT&S>pGW%|(_iV=P(bqM?AJuEIW7)iuwN1$E7L;>cC(@JB-nYH6t4;lE|J
zFmd>AnXUQzh5wc@@GqQFmMi?fvH0iq<`xr&f9IYy|DjXL<n^ls`_MXi>FV&O&fT<K
z=;>BjXnqkty-IEI#_@SpwdFs;gC@PJYuSvD6#vmu#A_+Op|?$cw2Z5e)J^?hfX%ei
z&5AR-sU?Vv{$+BJgEgzTDfb$THK}vbjea=wRb@#^%*jv_Z(2pI=mkl5iv|~nV}ngu
zBW`+zj#Ji5_W_yG-1EgQ^*4oX9>AEDHFTHDN3EJ|Vyu;Ebl@b|w|?5?ijo2{gg>8H
z^}`l#ruoJ$S5r*{oIiS(E5!jCyit{VlQ((l&8eh}`Ei#k)$+eGCRR1t<;vEeK$4gn
zD|873hH>|M%csaQ*(oD;H<Tx@TR*41Ctu#px9Eu55``s$T)d&`shhmb1KW1DWu(&+
zzQ)~lx7Q+&{OXb2ovE?@hH&o=ySt*zt>5qs;bq3|u30)>WbD?{L+R~_^>+_&N)D^q
zJy>#Iik!(>clTiCs#`CSr(OHq@-=bo9d7+*_jHRoGvH^t?w-NM+18)PRKMA7j-IQn
zzY%ZPX7_x~vu*t?QciO1)*JG|Y~rD+TW<Eo=a{>1a_FU|?LO+n>kZ%iToQ+D_)@Og
zT1Ebh{<~!l-ZFr#FI9bXv$sv)oof;-J8-gz57_k+Kf9miXHT;HjFq4JXzatyOI;(-
z>@5%JgEghD2^eF{dD>!lqf!@}<D>vQbrOIMq8mJ`xYSjMH@xK-DetIK*W!S7UsiiC
zX#%}xW~u8o$@2oh?UALf+au*@3%~<SOI`OTV11*g(Ji-viN8|nTHYMs6@5onscW?u
zM4q1N-TY{&>lU4+r{5R`Y;}K$lX}g~=VxAzh5Q!1K-U>_wq!G1XPYePN<#WvcuUF6
zSj;vzTIzRi$ySyM+rncbXB#Cum`rb@=_r5i41W5@LL`57$!a0emFyH<>l7W{sD$S=
z;Hye*@iwTluVkhV&28IVb;~W@j)CG5@g@^q7tV9oW#EZ9Bh*{_OD0oueRgWwPto!%
zo|4I}1Q9LonU+j$FC&RG*pXu;vh;7aiuj!?CC&|f#8(ce6(4WMMLkBZ6D2t!L4`O9
z7c=Re+q_)@H<espS8&?Bd`E1YR#&7!^X-T(X^VfWSQx$3C~4af;oW*!{(Cp&5<*Oc
zjF^$#RJd5*9^sMPwHw!WkaQ3pH^+ASNt*}po=3a=gd>SLFY}+e-*w{_HC2IE2^goJ
z?e?~qicE9zukZGDhQui`|Fv#%c913{^&ffN_CdDNOTxYm-5#QsRC*(q@U`V`|Il%1
zl6&@(^T-3;IJ2ZGWe_Cij#@c)S~(XnQ+l#n9`C*%c+P->J_1mAxN1WM4gspA^tW!-
zLy?e)VtbX_q1f*GZsVE?Z<#Gt$_(|u@@_M6LGk1D3>9b@(1g46{zb~$@gBL<y;3^J
zu#|YuF)3y5_&fU^D@63WdUVDqrNsw4#j;toT}C4*P>jQ^JRc#xB;I4K$RV+P3iO^{
z6Yp8VjN>l38n1nO06dunHryKTStots6H;D&J>J7PR|`1PFWyt`0K<^(1`X)0b9Q~a
z=T@DQcH|jI!ZY!n$!z|;#`Kb7V(j4V&TVZ;H5pT=JkO5XD}?7$OOb8zFi8jeituUj
zLQqqs?P=6(q{wzL0c|@a-ZPEfvAY`xHi)tt^~RbXr9MBCn$bVrGhMC@!BrXAEeR=x
zq(4IeIr3ZQSiEP3C9c6`-$r&8Pv3U;tT9e(mVNfvEAgH=_@7;`vc<W33hDg_Jp>p|
zWI3UPZWen54!h?8?IF;PYIhltcL-;o7dW`3#yBaHRHJ@}cu#K#?i>q^gU^uRYr^LO
zJVxXX!fyiH!(yrlK@Qp+glNt!1i6~IK2KTH!PkJWhMYTa9S7gh#9gH2#ZRmU?OZ8T
zL-HZQgKlH0I`}0qo_Xc`BqZ`Mwu6_O+eP=vw)RPWjfD8Yd?`s6l`%b+=jys-E`@Sq
zh3{n|h{czi^+V>9lMQ#@*Q&~Quw>xMkiIivZXe|4Nr)QElhg1OMx9?$>Ri@e#X7;M
zz`nc4B-b8Tua~*Px!a=9#RCg=y-#rRTN9}crK=%AWO;2O7i=OILYZ9Q?YY0lq4EaL
z5QWPwS5?|hZ=<?zq}gyv)ldy{vQVe@tttT?{Kg6!F1$)`tpPpHawA{M{RVF+^nDGA
zo3G|rCpqj>>~9>mZeQ5-Ox4+)e6IYYP^67Gu5hp#<#Nrn{$<V+@0lwb?FZjNi&=yW
zcIFShPXzPL?IOSzMEVo@a;TS5TT!(KgKF(qGwmS8oI8pzLU%H4<ThHmeapuD-g&4q
zGp2vWd%BA2+%50nN>}OH0YD}hb&gfty^D5p$9wcVLqFB8zdzo7J-dd>lo%}a1&@2y
zrCPossf*P`bD0+9PC=kozlirF;{c_T=58RY136(&yr-Fi+z0Zu<RvVY;yrC(%bMQE
z{RcrdBID=an^GODsN_|wAf>CJ_RTfao<!015^WhNgKZq=cJ%Qj$+yB#x4%w4j>?5_
zbX#3kE+4jDL^4t?+4<z|4xz_}ehXB(Pu@ca=*LSf4CBzZ@gA2mO73|&#;URFda1F`
zFz!DZ@2RIN6=78-#uA&7bAO0;uW?H5m1o>IS@#+gjgysasd)Dd;<bc~=f`;W0VydD
z3##~FaX?&@`~T7P9`I2X&*T5|JeNxX2_g67az`hDBM=CoLx4aCHT2%3hXfLuAVvBi
zAfTes%poAXN)?e_1r-nl1S<%rsHiAWv3*4Oy=R~20{H#^^Lp*&+1c6I+1c6I*?o5R
znQ672z<ODBS&m0be#t#w3{;x<rkGR5LWTl$qWZX-2u_cRJmdE|7D<YjXByfew_J!#
z6q>_<{im4eHmHJKv@3$az(J!})y=5lb!-VnF3$>F$wO6|dL6GxJ!Om2bCtY~-NDEU
zxn9Sf0w!ry$KD_-!q-6+vE=5s9!xor>~-9bNE+m%E<Xk%!hXJDU+SD($LlyO>u!E=
z^n0Xu9Y-XF9;t%?d;at~h7?GDhFS*%Qbz=ipndDTj-mDF4hdxL{<qhW%izJ97VY-J
zAg`lELC$=u#T_lwFhtG^RJR2kO;xv8h}Yq_b}9%@=4W0<8>w&}k#k&$)h;NC+SR>|
z4#CK%U%igr3QfHa-crcxs3M)QQNDJ9tqs;8w`EUQy~|N0QG~B)^+V_g_bQ8r4t~1w
zZ?yW!s7n2W%9*S-c^yfmDVq_selJ2Nm=!T6B>=oeL>eFo<Dw#>GD!^uofHvsQVWUD
z`$Wvi_Q+X(CWIzewWe3k{Gr~RWPmeur`OSt|IyUKU!NhT{wwOfR<9#9m~%V8Eoj-x
z*O7&2StCoCd11YCLB4j1=?Ej_OI}Ah@MS(Rew)a0p75?jUg6<O!VN|l7a!Dd?0lWr
zkAxpo*MBoZbL?Qov#eT*^j~&W()ZtF%hoCuahCM}#*NtwBG#LCIbNu}xmph82Ufn!
z5+H&pj>Azt8ZPdM!?FCGT$ZB02b?a3OCMHw+~bI}go;t>KZHNT*Km}QUW>Xkz^!N?
zpF3*#3_wIL(rCa^ZUdh!#?rPh8sHu@Xn}*_;1%rha8msukutV%ZqSwF&SKVmA{6ZF
z@+#mwf-(S<e$s1~H@4+z=Vnxs!KC~rvd^LXWpYP*9n5d_<#X);r2!sD1G%`&!4jq#
zRT_-<0~%`&D-C84nQjeBv`qP%8p9I5+)?RuR8YebEz{sR!ZUWuG{E<0z$JgGQ5viv
zf)2FSwAIwAsHpk1d~R9f|2YxuilMzlJBxB#s0dcfzMr@Y&6EDx02il$9BLKKGlL?#
z2=F~fz>B^j#TG|QP-5SZdQ)6B<37nf|C{_P$v+1NK}Rqb3|74Eb;viw{la1Vei)dq
zIQ(95=w!Yv9NN5u1$ns-xqoOLm7x*^zGD{{Zu8R+k_`(>^Q`#HZXP>HnJT0b#KgcH
z`^Rhe)kcXldi^V7q7jaf&lvhrie;vZpMz$KUTXZ@7%s&aMwIm$eDBwq=prlQAH^Sq
zzS6-e)DVZ$nti`A=uwc(M-Zc^R-YZHXT1g|BQ<?xO5o@UXPNS!d5w1%InM8)l=B0K
z;0&%zA(FS6NHs|b++X3W;&*$EbHa(RB|M%(yHsT8cV6Q?Nx7yjI`<maRYXef{*u@D
zk{+Vw=~XLujhiZ>Cb-%)*y-|(*Whw9ij<LLW2D!REkVl8w)1%n^#$)CGFwRXFYy}v
zQTMgmQ0h2oz_lwZYiaanmLevQ@3&|TV=FN=B5QviHsm+}`eDPg_{^*!NPM8G0D!TC
zTpG0RX|KVaI+<N+4VM!FRV~A3ov)fa5OpicYlSsW`@ud=1E{NYhJg7RVJpCzN4>^0
z(SHGcKsXC<ct@}CY!LW6z<eRpRMS^|Me4d*USok+A+m6EP)m)DmlqgbV_^^oc4||}
z(v>W7kMp{r)x5?M8SVCx)RE90+qeE6-erAI)b5xG%1CagZh4@q)`*Ryk7ETlbQ74w
zr$Iq7-V*td5nWJ+Y6U4vkOEPwFqP}w5RNAOo|P^>d;^sc4_a;)TdnTLo`mOX8QXym
zT;TN_wr%k(D9T7r5EPDjOQD_Yyxk!x<4Q}erOPqKTO19fL}m@E$B`IVzshO)*N?CX
z*|ifwtrejqHlbH-LaiuDZb4ItY{OE7&OBhfwUlEg@3Dz~`5?KC%6HnzhuD-z^gx}}
z&Z7RyqMIl{Nr8@)$`}(ZIg4ix!)rK%AtDs+IO3FJyP6wTSUj%jNwQS7RVm49RdxeY
zB$48pQNhH%s+o=pSjbIQ1&tG<#o)Qim9MQ+S4tL*@fvcJV$D9R@-CJ#Ql)S7l1Moo
zM4z&xGV8dDMimhJ{zc0Rl&;3|fe&Q94pnLP64d^XGRLVhEe6-oRFbmR@A^MU=cqTT
zu~vNvK-Jrx`>eZZNo1}10*;k31)@1rM=^ERP9H8bt@P<C9jz4opl7Q>pO$n>)_(XA
z-JC5+0)8^crHnmmx_S*h7EMRW*OuSp|5Y&z>-JZ+x_cdQIOy4_5J`QUUevvh*QjTA
z_tYf-7uX%Ih2;ursaTiP^_cw?qsf}YgneC0@--OaHQL+VIrTIsZ^P~i6hQQRUCjp~
z8fyr*E0)^rC<1ShqAJJiM~Q9SfC6j|9SE6XcEZF52{mOu>WUPo_#YFLZknU{DoRpa
zI@nIOPD^?8+!o&!WH-h-a9mjRPVgG)Mx*tGtjUK_N!*yLj2`R0302O9!8Ho@=&|mv
zM?u!;QOp}e5sDw2_ZnfcfV945pvO9ASuX}r7rAh%ARf_aks|-~YXkGwIm`JMc@2kc
za8oZKw2S>v(-#ybOBBXUlDSaRu?s&U^*h41Y-(js)oQOUJLJ~ij8?6vU-wBX!W=6!
zy1YJD6Pw6bul}V(WGb*x_v&A%h;ZrL@6~q|;j8HShB{Wo_1(dWZ;;hsyexfB!LYfZ
z!lNL2*bHI_#bw`k_03Z64RdUQtO{C^+%VYAz4ZaX2?|uvtJ|<3MLQ}Keb0IIMT+9#
zz@_!hs{UJEeM%^ud2ko6UJ);K!#RAy%_7dt6|4z>Ua`8AiJ<-=aK8%+w&3E>%f^F7
z3|x&8i!<lm=hYJ#(UV63z`<{n4zTV@uO6ITH=>kAJ*;s~`&oU^c5;ee2AeER-xLkD
z2s)XC14VZd*yHgyw||tcZA{U0^-D{G;?eYtvLSc-ui(rlJS!2Ju~C5V5}LWOiN+B$
z(M)FOd_lUf3~+MZXybhHo_?UR4WwVohjFA!Y^49}cZ0xg+Tis78^x@%@Uk&q%xL&M
z>1P{HNk0puY;>0Oe_`{T9^@PUwb44^dnSlC72jeZ;5!|@H%$>%(Y!_n2x3jQFXrJC
z;Z32;LV?A%GE<HwO?>J?f{o*3vH^>m*lgVXE_9a4RiApzn!@)cpT+kkbsit<EwI`a
z-<ysrzLlNdqz1x3_$J<G-_?wEuRw>PPz@6qZY6<8>&sIdY`4Lc3cguoeI-lV7^gY*
zO%vbfgBo5v4wY$knEEwWDznp8nYbF3$~3x6#V*(?6PIc?Ewd_rqi_46VyqE1V>ZDq
z$Pr%M$A`7`%|~Fq*$s>N%}b>rEQ=f-Cl^sP`;(MRRi!30oVrD}KHsu=#;cp6)|=n8
zd#_m@rt*Z%cba+iLc%6$Y`NfDPF3!pRz>teIGUo`jWG<3{<Zlm)WG7iaS0MUu({<F
zxib`-1HF2ru({=;u-Q(SA<`@`db2aOaI+kX?Je1X7dNx)*KDGlK0EN*W~Zmnd^>ql
z;KF8S3IA$Il?qyxHT(mq5S7ttvCFNR_iw4smTOVU8vR{SRi~$>jc)4wjoM^n0Z{(v
zs}qw|WqxDvSk;C9jgymAH~p=VU6t0rTC`#PlyzXTQr$3rZ||SZK7bBt?^Dvw9W!Pi
zNFLT|vg*qC)p#JGZw$D-=LyE!(X>Fu45<Yzpi2Wd!|%&?p!kEe^7FlSU`^hgS*&f1
zu~@r<$Dmky5`tqb*6#GAs?yUNzd(4_=8e4Y79Q>W<x$pV|ChB5WLg7j;n5FR>#cM?
zkoKz6+vjcXEm-L)Be6Qsy>+F<%B^6FqqL3pTddp)HuxoA=Y2}x--}rn8Qda#Lt}HJ
zw_3B^Iw$ZN1;lq{@N2n5X<}0Z;V3+V4CQ#s_p<jhhLNo&1K+*sEZyLccOQJL8HiPF
zCtYOwy=1klvagOUlHZ~Ki^a#jCYD6fq8Ql<2byeU6P+A$Nh{~eePWE}Js3$5OgPfo
z5Hga`g)h8^@F1do;8GoSd%w|wlJ0_|Mg8eL$GEVK5!vwuGEVD3=q8aaJfJ#hnX(02
zGOP`e3`Ik{?@5OB!3_8zY3vpETREl^o61&i*e8cu&M)xGi!HBQJ-xj&Jz_^8gv72;
zWi7Xf{}<HjCSqCErjkNm+4j#vDa{d_5k5m~>RN1*s8vBO>}`(I_1IH0-kG3LGFA^H
zc7Lm1_B(nnOUcVQV9}vC+&xQ}ClO|PX|!9~5{Y10(q1KOjw4b*eriZrQ#Hq>MuA=1
zoXP%k7F*j77ZmLndqa&0IB)R1MobZWZ+}oD$5^~C7zaU!ML*<pwcLe5ggvP((Zla!
zJ?O|IKlQ48+B-Z}N8VuBC3;J}S>8oO{CH6}5u{q>-dW4i(M5GF-AH>A)(=~{u_)cv
zjW2+G&P@W|C8D9C4Gha^zgZfx#MY1|akNbdOG91?Y6zzYq`_b5E3aGRR}1$JSdA2S
z9JO1$Nhh*(u+^jqdefwDP)%ML0lpTs#=Ax`+zDnF22M^e1EXk@2_m#tq^}^fo$f%x
z9nMnDC2G9vy91+F%{xr-NWG6kP#v}0`HWTXVRpTn%z@C%<k7h-feoXEQp+Z<5MD;!
zD=s`F?-nbRke@m0?IpAMotL7NDeP561Q?}ODtn0uke9G{7roTphHFHQy9593pnL7*
zg%jzrZ+%xGD|0(ct=id~SIOH>#teCD%gRGnvN3aJWLxp0?^Veld$!K)_U&ROz^?0@
zCq`>NYe%QN$SzgMcNASzdoWtH^&J&TdvSqx2}3Qv_8s-`F2?`8`aXHed%mOfh<-1n
zG3k!*1*AH=W<n>ri*K!Ei%97=(8t+fQr?UdE9LVm9gyPYAM&Y}o_l%T{EBa;6fGOB
z$v(59JSz)be~GUHUQmmrK#pUM{Q7J6k`<*6Wh|s7`;qf5ayYvBI!MO7#BUHjLz}uy
z@pX%3pXZO*8{g<bBQ>9F{%{@Fv~+q}lfU-xJNGZ&W5U&5dH*YbtzY^c^92DYu8-{$
zs+#GInP#TfW!BT;Paxr%{@Ns;Tp8k1??Wj#eGs9acAit!dlxFU85~0Q`8xCAQ>}$`
zT^1o;+gQ+b?P+d{n|8|a2PqR&Z*EzM6ui0DKC@E%V!!FfjB71}21qWYDtw<a!Fq1^
zIz6}0y%Oayk#yL~?R=>sJW;4DvE{puSh8awS_zmh^J(dmEZL>nvP)kFEZ~z<5I$=!
z6mb?D(`CUil<yhqyI=On_s4wAm9~)bBjJa#%o@A+S}@_={XTK}c>3RbG+t{l&gr<5
z-#kP3w;ZE!6fWYR&&jlK_v?=&ahp|(1wb!p^2Nj5@5?%Tp8QDr=>FYDq+)G+Wg*=>
z1MqFB*q)YF#mdGBHoF{Lgb1r*WfN6qttoCs(<DnN$~~$S6>Ozw+8LC#(&UxwCU5#Q
z5IGw<%JfwQrf$k>x)GpEew*8B@cKBbi`0!)eS%K&`Wy>V&r}dm8Mxq2e|<G6^q&+f
zMR0dpxG5L`dK98*E`AuA^7^?4`aq+T;%`3RPWt9SlBFumuUe|I2U{N;l&nn6Z`&!T
zNHB#w*rpbYjOy#?G66rustijXcYcwFoCtxmR^U>ay!(ls;xU#sQ?`(X*|UMUoA+Oj
zv8*)xOWqWn>Etn%7bCKfNVBRQV};02W}VOYi6C(md189t!t2groz8fSQK8WJ7KA6J
zdyL5nJ0e^27}J6o#}av7B6%`1lmg_;+AA9sKQsG#jIKd;-Y64D+2c%1^mq(Y?9Cgp
z{d~)Ak5O8(%L~4|1s<cUL}XpI#JhoK_c(q2fXAq;NYD&#Jg4pj^cYFX6sZ;Rb6Y(|
zeFnf+2B?LC>YsY_9~60^SiZPN|2@cR)e0UXOqC_9R_W)_|B4sE@HWz;|4%5UF&U-h
zU-RgE!%4JM-|LSAcVcUgu9k&WB^U4X=pR@Na9odVhfa_FmSU02#RhtGxmrSH&ZM+U
zI)F+thlLRG(GQn`Y$h(F?D-q?mt?Uf)gJu>PTt<3cuq1N@ROWd-_MJUDjuD$#*rlV
zc$IjU7;RW?E)m*L--3gvUV|Nbl1Q>0p+WU6DH5@Z-KvVMY87jJ0c`SYsqTACJ^FIt
zI8D>{m5Cn9=_~*xW&Dv6g#YFA%VasdUN=C5JlbA$#RC!P-+S%K$dQ=$nhMQhB|ZA{
zL7G{CQG1<b^g!VGy$sebdUWedPQKQC1ew(`*Z$H-NJ^TNV9oZM9;W~9shl--9L!9j
zc=76+enYqh=Hu}IErX*qqeC~7cTytTX{wR{NNgroRqeADhder)d_=S%%_x=y<NYH@
z`=8a<WPz#&Z_W>_mWS#j?xf%KNCjf|Q?;1Wx|xT$lw=L$?sFzqv|F!rGikkqE*^cj
z=)_*7g|W9idLL=B{W}8(_BkupCb|EE<YS{evW<k~cWpVgW7<IjVDv|%dUUQKq3nQn
zzq3p+ijj}qb4w6&n|>8Nat}ADiGlX}St>a1(aT_F<8#QarppIbBcJ-?0n_P4Xw5Lj
z%{l|DoCL74#bPsTOS91ch3_(TZQx>nFD5c8n&8pnJnZ0VtiDbnUsZFwu~3AyFkJ0-
zTD!}m7o*s2e(^KajPbyY%0p<XVq!z`pz|tWBST<!M*TNrku*32N;S2q$2}}*Yx+Sa
z99nx{#o_3%+w+}B2@KraN@G1IWWIW^EJ>wb_MAikdExdrH#nqwR#N<?ar6$y4H;dI
zrZMyt{T$>EeNSMMcG$vhb`m~h`oE>Q=4kpC>Df|`@Y-UjIVEnv<g3j_cpU|sZ!Lx#
zd|408T^usZ`jod?7^$JsSBR?!9lY{k>Q+2%>4etSB%9VLMXS1)?yV^TQ*k`JlES4h
zt>JJKo#hcP`OsyWw&*OLj<$o*8wB|})6pJ0{6Y9tA_Hk!s?%J)nRj$J5Ag&(Md)Z!
z16Ln<PG~Im$bPUx%~9b^+YouEFtzD8qYA_Qp}sI7ij!-t({2)HM&R;-!h&0iK6h=n
zyrocZBRok6Z4R*$#4oZFl1cDuo7-9PI3%wqWQfYRDgKWvKd9Ff@UxjE3`8bVy`!J1
zs8GzIF*|w0^FO>vDn{RKo<yizn#eDXg*P;L_}8)UsyrMk>{xhOJ$Tf-6fT5@9}iC}
zy4}-Q$V^~~VOV2GVD_5Vl?ZmDc}qfbi6rpQjnG9ROr)A;5(Y|ysd4is2%}Y1nOMk&
z%MUN6LX@Qj+<c>Tw6y5v^->kPrmeZ3L0WZBOA_|0Ryge0R#?-IoRU^O4BLBp*=+C0
zh7?Thk#e3TOqU4i+x#5il%UR+stWXFAiop77ug*L@U6(}vREEySD|#ll*Vjb6)EdV
zmpA_@CWCafZAh`rYYC~)mT=9nf_=G1vI7ebbEVN1X3e6(N2Uhrks=mw%QgtC2LILC
zHl@|7q|;K8F^PePq#WrS@}PPN0(o__Ef6V;@z$DCZ^4^^;%y+MJcrqEr{>cwd>mIR
zSJj?Sw_x(pBH5l$%jSX>O&^(1zlzE+q3(LbS)~ZZz<b>@NsPhKCj-yfpy57GZw2}^
zaPo+=Nx8Q@!^A@DjclJWS@Vom&tgZyzwy);ykq496^^o<_*qXXjl?!yxeM;XSdaDf
zYR6n+FCOw(&PG$-bN&=-Xp*gWwD{6QOl48!p056TWA#6AxSrh{t8XK&HX$FAw+@X{
zWAz<gd${l9iPd+iNJRE%Emq%Emd)9LPmVex{enC3Myz!-Pu>XBdYgy`QWBYC#_F$A
z0oQRNor)1bqg=<U2Au}=_G_sOJO@_A>gUDS<)Lyc4P1h&DwAXRUXm~i`^Q&7r+Nn<
z#RWoS^D9JVz>50@vGcjH`V6F`B5!^|Bts%x;u)*YM7xju6(N@<#_F?}l9roGkuCm;
zwJy_<-CoD10(r(Ct3Qhs!f*@dMH}>-1rjy|<9REpVd)0?PsZx9ec<?45#usPKs}wJ
zj(-Ja^J%eqQ~0vBh7Ei-R&T*fK?%b9L#&S3(yESAbsaSgN^Ad!)j9O4pQvoLl3r0H
z)nBn+C61b$hvvC4v3hM4u_YMlSKsZOyi3C(L{*N}(GPOvYjOA;+BO+cPMpex`aO~=
z2^D=9|EBIDT30ZULSKShY9X?9sp&d^sf2Or@{(BH3<7Tgyb+(1^#t`SQ$a{;oz?ub
z#a);+KCzR$?35x&Yl%H-DRzzKT*<((rdaG9YWQXt!(jChu|JoSjru&V{66-s2uh~s
zsmB5}POzEndhAU>O;Sh8V{g)xd7dx`3ExZwb%+oh@-sxoKOHOIDSfjInF}3=Rolm}
zX;{umJ!0PwjowS*SgXW+!4j)Yi{;QVa3M3?-<8?s-PmVs(JhDNT5<uCrk^Y{o-NwX
z#y%_F05|YKCNDGgMIm#PXXmik1w5ZDgtEN(W#HZkXF2_3pzNE@3S}6sh4!!;aI(o0
zI~8n%t)Cn$oOB3ezRAAxZp_6BJsvw97nQk~i&&YjVnw@Ut%ItaDH%JQs-0XDrTXn~
zI+Z%@TRAEAaiv($LL;6~%~Q?lQsQErDXF#6w8QOUyGi}=hELwGD9BxyF1g|eE$&u1
z5OR_i`bn|9mF%U!qA$f(qrg+OE%a(`L64*Z)rb=)#Zk2EL$MZaX2jN)XIV*s4XhqG
z78~4bBh*9!OQt}${H)mGLU_DIxH!6R5iaR3h9&7>QSd!n5!bJhO?>c?ajE)HtIO%9
zwyCW-01{;(Dk3v;td^<|#|1dGjp<LSZk?Htf)|I7cf-U~y?-$8A9mjUDle?pZkQUW
z_h)dmcHfN;#GP`w{oAC_R!36xu6D+^+SnO6<xHWHu?MNad>7ghVYucxV~d@hiXFOZ
zuTrUcFVJa&iG2QnOid$IOn)mE@UXW5FqUBQM$`7QQuPE5DEQa!2NWXe_tt`3Icxx&
zVgA+&+_jsgX>S}Io+d8mTX!NyX69<c(@Uvmp4zLTB1b-+r48>uYrJ*Wc1nB3h*SD_
z$>E&@`WMf8_6+Zgv2`6+hw_GZ5yQJzY3#Fp1K~Y4R({?<d5bm5n`_JA^t7l6W3{}w
z<u(2EG_<JdioAIxc%I3#Z$jR@%9=L2EYF8W=gnh9;q+XdBmS573~H45KF_H|^PZ_-
z<2*4i@0mJ+gL>sXR~YC**h+XiZ@!;e%ob01>4?1N$u;YDo;PmEdqI$5cwX~c-izuv
za>QV!+CbDQ<e24oi-XT4_T()IqL(<3w*(GU))GhamXxud>mAEmQc0eb2=ZPE=Jh)+
z=H;>cb9z3I&VS?ug3sxhc}s&tUznEnvU;ZHzte#8Jb9~VSyhIkXx?h|EJMgUZ6s}j
zLwHn&MRtVcy(+0v+dhsw`4E}P)%0-QHr0Hwydr<+5UDHc<?W$EsIAEFYy+@wc%E7`
zO>;$N=8n_y-lU0C%`bM&JIRnfdm#-99?|#cU=kG$ICZ1F<IK}#)aT1jfKGb=g{;og
z<D}VTUR^gp1oI-1$F$=w<>~Q?f{Q+tr>82$_!JaPr6NLFty#=#kf%3QM1*WJh2835
zY>6noC}dBcz`S?3UuIjLE=QIX5$I5h*~nYdrpuGu_c_}@?=mLmjSA}B2dKgOYw|{M
zsl;h{KGQO96z{~8;yvTf8`WDlr{<ZP^G3UPo}h^KYsW#rCMiZ`I?EY3S9nQJF_Pu#
zgXB>%ls{fF#i&JxP-$szrWnk#aTrJ$b2!DQ3nS&`3SM$Xic#C8sRa!oJa-vR)hoO?
z`$GsHriMj6Awox<dnaP_ph=|Mqg$Lg95I%K%@q9~hKMsK*ul+$M2ddj4+&R)=;roF
zF@&CqBv(x_bkz$<S@T|sVW<dVJtMaxbnlX46m}Cit+~_*xD>-HV-og2NX+XgeBJ#)
zM_13hO}(cbOVPK&-r4jB8Lm_GUBx8=r7f*~PtlJ_8_9Cnv2!W<@nA%%aRM)I?j751
zob4g?Z}n`7{+4hf3sDG7Kdpoo7;}abtNYL@xe(-Rk78g{GqpNAw}h?iWhuPPBC<SU
zaOOxja6oy^T2v%OFDxaB-aRp$2wgzFfhahU@sh#PiGLvy_G`)&IlgxGLKL#QQdWjW
z+WBaO6t(AMZ<wD8TL!0Cdrm|cn_8yu-4acIw^`)i%p5I6oYotBbCAm~QZ56ckk=I-
zbjy@|iVf(&#y-Ub&l8TNoTByKZN~GWX({i@bA~IDj0Y5RfG^KVIjCBPHCp68r!YTH
zKZ(wIe@|J=kb46c@ZAX(11~8CcpjpqEG;H*X|Jb01iRMzDJ(nF{6H^9DRyV0L^n!C
zjT?mC%&v-D_C|_VnKB1MP)<(z!RcJpT*CjnLRv);omH=AaU<rerMVc5*QJcI`8Zde
z{=#9B#CM%lMwWy^+0RnO+suP`W^PJfaS~V|JeL`jIUX+i((~12<CN7GXN3C)Mr$ek
zv38$Nh?K(>DFYM-;{I;!7%<8s?sMm8%u9N}s6=(u0^zRGffMiI$H~di<cxq(mkD7L
zb#u?T!;gZjE>?gcm%nFx5zvbXTjE)t`$29E27trK6(gP5AnHz9sZurly)IO5!my;3
z<r$REQoS*Ulh&gq4c}HLtdj!0&oNVMm~>P%wOGgLuB6wb{$ejOswC}Zb*c7QO=}O?
zq$H7=?3;QyMB^x}48iBmCFhLK)RIQU(O^^XXA=qKD~j)sG>T^#HCwhJH0L$OI4w!d
z)=<Qj!wK2E2}ASzNo?m{7CBsQSxjQvj+R=EU8O#mjU-L5WT~~B4gL(8To#e6@2^fi
zj2?YZS8-$D-49F}P4|AEH`V$F1HfKN$dd@}Ys-y<wGwH?!$HDc9Koo8%*Q_%?zg7w
zA3O>89N{eU-IrPRulb71h}DOBSx!+4I~QLfX*GKsw5W+m6Q#J55WRSmTvrJ4z3Yp+
zdH9`hS0a?#ib}S;FU3uyxQl14(k^~P3Z1G|;leELynO1B;;c=zB{lhGw6?4|vr{c<
zcG4{Ny}kbjGimu;bSpHeRV<t?tF2j|i#8_0BQLw<qaH8k%jO||nH48-fKflsi&k};
zAYb#)TE&+q^1eb~{_a<J4_zln+-c_yi7L2G(86Lfy?oQ773<Hfk{~ZD4=>Myr+ySN
zg_Q*E(FC-N#fX(x0jXU$;WO;jmC1)yVliuF;`|$GWr9yWHJ>P=W-=ia@`+lJV($R}
zDsRvlZ%oRjPD>XMRW}h{*kq|*Ha?T6UaN+LdY0;C!=9*KE0&{Lb+A-#sM2xb^9Zxi
zor|{=IRo<-)j4S>t$AU-s0c%3t7U|x5@C#OwVA-?2L0k+JRBzMm)7ho%2V3b9aO#5
zMZ$S1u=MgHjj42p71E_Fx)rP`HSb1+`P5o2T`QgKP;VslqLHO<Et3jPl)iQGC98tH
z;_V7vqkzw>3ihgOS5R2`Igoh4S=yh07o6ddilL>;R)C;IElTP`y)LqIOlfIG4e8Yq
zK}$0_5ZXutEzQUz^p|=q`j3`o&@VE^OT+N?{GmQ!DXGA3sfx9*)&-l>;%Z;BoZTK)
zCMiSJ3qy7Bt0-kEGRjGHuuGVT3~)Hdt$Kb&YrzQ=zUVAhc}i0KV73qHTG{HWX120%
zoQP~ZAI=Z-xajm%b|m4&0HT-=W?T4`QS@Ljl|@r+{Pp1b3ni5)z&{9`@K#A>;@B5I
zoo6hdT0YOiM2^vt;xI_H|CP#&*^^YXAXmPXi;ebHE(~kYCX}9U<#JiM7|R;I-3>Q?
zXv2_~RbEb5?~;*N&7Uv5+<UY}O1uzJpRcKUiYRT%l1?t;KzOT$AzW;tUwWCyyTcoX
ztYVD3v@$T~1812&#~X&MQ#x(CBRykqhb}z>W^xAEICXJpoqf23jAe;#R<6U$_h9R(
zv;5SYBtKCMDSO&A44E3N+~vW6`yU{sT~HT>rWF&0h}8Ur2+gOQ6XETthk2W+c#9Z3
zm@2*ae;B*m#AfU%i!pe;+|>rnw3rjuZ48;`R3vRMi>`22r#;-g{%XUJdT@u3H2p()
zMLb~`5a|kMiFD5<(nOMpBwlS8l7g4@p=^<z^J&A7rnHngoe>$*Fr=B{ixlC$#lzgU
zRNUL5Ogk5mJIW6$oq&E=SyuHLhIEtXYF7PvC_2>P!&tixEgqG3%LnqV>!BVE{*j+K
z?eJ@7HZ+z>JyxoHxebk15U)C3x${axL$zq0`r@^}p|Kvf^uzU14A&`0vl=T49EA^G
zcobwg3I!N^Yzjx^fAszjS5oSx!#Qdp?!&)SsX2NpRjQEwNYUZjb`MB@Cm?@D0nDOZ
z5EU=u>8&}Jl)`BGN6*V8XE`iMT9?ozPs;fizwo2y!#LM6KIc>V$c&80v0Bb&WpD|_
zLtXrIj=D>2FVE*c&5<<&d^u_ToX^4b--&!;>}bE1b4?<5L8^By=ek0Y4BzG4QsNhX
zB{?JK6UN1nKPlDr|0S!oGpoCe*Xy&y)yi#b5O?>Z+p5xTV{@?5ADvN^b{ks?D*ch1
za81rA0J-Wt8khHSlSx*aXg<zXYaYbttg7*9H*^~lX|9j61KmF2>`_m*F+IYby?D>N
zjhV$c)^))4V63A$Q=&z~E7pbZ3khyRy-56c6;-QxikRwjupopvtqftg-`s6TN5q1(
zW>q@Ut;=j#h7Ec3>?|h3#`PXN*6!SpG(3lo={_0r2s0=jK6JUHyy5`>I|#4Fj~?}e
z=GM0hO~%WNw+JT^S)I*y>pNIIzuv>Ka9#+27uEzie(WsiN6s0aK;rCfx4tXN%GDZm
zXx%YhZf^p}VuFxr-IwrK{J0?kBZGqF0?U^B#ogBZbr{0dcoVIss-;x7e#qvdHO#eM
zZwV{7-}^>$r0K`;{OlA`*<8o1|5*gGGV5yB-L3ztA{5l;lv}?KXR=Dz`YPcvz~NuI
zjYtvIEKO@ev$XyPV7oeQqeu|ghJ>a7mke?nQ9<BTfFnw2`i}|u+L2!Dee<h-S~0g#
z39b8-o#gtDRHDrh!Xb&&;^8deba~CO>^qf<ZHJOqi*}dc6^UaxytVm|a7iKt4_^{)
z5Lxy+4?huZGpZiRl2f4K22E1$fOxCNe#eX^5W>GYJYRF1y8s98gCR{MgYLrcbj^5o
zfPKjH@KPdAgYu;i;f=0j<3-`>zY(DssP?I|V*SgS(U`f-XS{3@_e<U~sRJHIcsVBT
zjy_|1s(RbkexPJOvPaXuo(*_-;Kfg!ak2qYVa>F$I;cX9!np#!9LzjVG9R61gVh^V
z-XON$BktZ&-01?hs6FjPGe`fZ=~qV5u#4Yw8?B`=h6n-WXHdEv{gF2#?K>n1-{X`-
zj{a#$<cjR9`Tv&4G459viCjqr#g@piI7=c|dIqL^#*6l2xYLdE9u`ONj_!kqn|^iy
zZo=LAn>f{1uG>y^o4;tZKWwKO44i6(_mEFb9G}{T7WmXw-1e#4hG6X4q7b}Iv)uSY
zSyCjws>ly1@@i+h$hKIHwngkB!JtTm_fV0<Dbj`(6lukSMdC8H#n4EJO3D3)4$BTt
z`9;a~FR+eRzp$0OZ3U3IYFH_G+nPkG+e!{PO0F_Jq~u(ar?qWpD|uV`SKAC*$=miI
z(v8MHbULWyPpa3C;{x8R&LV!*-R{Y>$K`hG-_p}Q&kZs$h^zyGOpGEjqK#(tw0kly
zbHzRAWo;*s{A7@UIYed$8CXPQfoPu=WMHDjfb@ah>dtV{*@L4s{ReFC=j!T=2@1vP
zChBzH!TFm09o^~kouW{WB<uRnkSDb!@rufN8||aOy{pbLte~su(&yii%Q~WX@VHgZ
zwL<?PB$GP$I7IUZAJ-E9n;x$E>me+?FmkQ+|4(|VRphn)r28F(r&(0H*;J?hHy6_>
zDRqW5iMzIfbS{Yhh;E_YNZwGXwvD)UfK=5TBgI773}Y!2LpT0ITF=k}#jZIc3*EL%
z$@L<Es@I%8-wn-ZI-T)G^=R7?Aw$DDopv-%umv;DAH0?6y1EInS|!;Kw|25y?Fsrg
zo6-LIPDT+%O?_HZHENC<Ihyf?7e_LL%JorheTEum?7=wgoT}708Q`ZickAQiCGvII
zgC#`9)l!2fg=AlI>)qstmMZ0j8w43pyOC7!K(sZGcB@9mk(EQq%3DKl9~s3E>|?xs
z?&#K2=-E%nTu&YA|Kc)(wopq^)X>gNgyoejsws*pfN#V?d=@V+`rLX0RSAZ%ctUY|
z1Xa6~8GhTfA~buX?8*7IS$T@CMd9}-981;$v+@O9M=cMu>r1xBY_kFeW<}vWFe`om
zU{`E#fnBlUwq0pA6f)V+7e#sMw55Ds#9C@}R{^hDy7xsLQIOznR8b(No092IOM$-V
z{-5+}HUhH^wZiblSc_`QpmOF*_L)g`_CVnH4QGi8GgIy2_Wp;Q-b6O=&Kx1=f%`XD
zk}K}k6R|vMGWo@?vbYAIytuaFb8Uaxjdn<KzBU6_N1rM_*H>>=R(LEp3ZB+(GC}rT
zt!)dsv>r}EJLcT&)?40Bn6#b181CDBpUCTsK5jkSgU9ZduN>otxE8zBHxyjQHLX2^
zLc4zfCKht5)nNrB-aeMmGU5;n#1dO|z^%*W4zfp}eRV<-2XU8;LYR@la>P4s4mxT2
zm;Z_tTugdXLKBJ1<)IUS{ri5$GL*D^A3|>o<Wp|V+LrpTd6OoPvHK~y<yUWtM6Hb|
z^nJM=V#Xf+cOr>9SQJwwf=uN=HOppd#wUuYoo>A>OntS;W-75gvTHvv$Q7<@`#BO3
zriAB(lsn_5FcmoZCA;v?J<5V`MuX1CvBCD|?Cqr%UeJH;{?Tr}={IOT^|8gTt0YVF
z{a8&?t=E1%<*cZvTJOht5Tv2nzfX9(EbTJTeMj|c;&<te?el%grpUE!6;HFb4ezo;
zn0&&){fphm9pV6$k(L^%={NgAglWbdQ7Kx#1AVkZqU<la{W)uKbW!jox$iRae$6MY
zbm6uGc{|Wh`t9F&=tt-&k?(o%PvU1h>oyUS$nhhB?toG0Fkd1_zr#+#c6)?`IF>15
zwYyT#5AAS}<o$?O{Ll{X5Z)45ODUHK7m>9e2g&k7#VWJ0O!{be6Qm*<;P=ytU(Xg5
zum(^W$Hj@1DPqsP?vI?{r3s2m5#1kErP6XwIa0i$q!_7$_qh@t@bllf)vJp%`FMc)
zYb8Kyn&-Y^3#>hFm#VpQ#4Dr^`llwbwPKHS!tdmu8-#NxM5a9*ZV;{lqZ8&dP<&_|
z{seXxSoJt}PAd!6(d5pfC}1zFapy`4_a|PNkPyyF+%$JCYd_jvpEA0`g`>Tsbs#hW
z*<bIRdw7%$d<vlKP;cD9ExQpE;!D8f#p{&8?%^b9d-<tw-#t9RPJfN`Ex=r-+{0}%
z-|-@__kb}VjGz%^y4De0>-dYMY9j@Ps?lRLf5(4)LvqJz?ok3f2@n<NREW$^wsgz+
z@rt-Ooyrm7d}=VU_e*J=(7R4m)GE7su3f86^?}tRfmL?<>pN2_*-OgPm&l;OuM8SX
zdEfVKri>W_PmrYrp_x5sfWe@l@E!~r5@*b?p#@`x6}QKXPE@B8VpZmU>T%0nfBRHm
z=QkXGylk2CZ&zDUcJ_*Q@$FlIAHQ*yDs$HwV7~oK4F#5SGcDSt@V`KjTTU;2g359$
z?mq*7(%Yf3_RO#`4YMJB)~zOipU6~*xsH@`YoHZH1S)lg72Rb=R|nqv7UWYl@^LE)
z%L@61D!-7;@^_kwwq|&f)bIWeJK=G{$aJ@z-sHdRS{pT|+YaA%If3VIIm?uuo+57n
zpr@AL)ehF_?JR!2TN5~a%UP=M^u9L96T-cx@bqzZ`WJzy@3=o>myD-US~&AI<>yVQ
zq*mVFD(fD^ImEctG)*b#Xg?H3TIl8=<^UBB=);ngVhu_qovzUd`_!p-vYc9R4?;5(
zY#gxB15_6pByGG`ABu_win<2}RnPxCD09UO#;LL}NX9|;VC3-qb}@F1NIpW4S@!K3
zJV*z48^dQD#Ma$zP3&U=U58iSw;6@t7uv=dcNW%8zs>m38SB?ML?Vy#5K9mPdwVbs
zEm&>rj0&rd4aV(}IgtEnA?{9ME9E<bozc(Ea=`8N_B=2?cJ2)V&$*S{eZ(5=CC@zm
zt5ulWah8nwU<x0|sE?Q-WYjr_kY&lJPcsFhd_TY`mRS1PV(GjTm|U@{q{4d^YP7=L
zPqgEN@QzeEBZ$s#O9ZKO#%y=KC{kHrOQrLdK(1O+nWs1uscd!km&+1wZ_u<Z2%<|-
z2Y&7CmwBSax`-g;(}HnJrO)##f@n(y^&P7&T|ntTuicG9(*;p>83_VL@{RZ0>J*5a
zh`Ze*N@+z`Opm&9KH*DuS7k`Cg|vHjtAe%I8k6nrfX5xK-<}sPY8BZ018dKt+-lyh
zNbOc|cWWg|wd2j*+7cw$SLM3X$gbc1Bud%AG|rRW{)8M1C20*QJWm$ce2JizYUVB{
zs6QrHsO9RaY%(yF$IBmilU$4y<;lh2qR0`MgEY4+HmlD+wCUuQ@qn#$P-+zBE~O~7
zvnZ7!yDAi{Qc~y;`D*RysR^4Iy=A}Q*7*QGk<RneW_4gOVKW1OoNMkfgD{cNr_h0f
z&6r(Lk1m^0g)XaoatJYDtE~!M&H+1J)p`YL%~__TpyyjJkf{`eHB_f+g#`8bR)}0D
ze2y*IdRbFPn0~x1y<3gq#)J?Vy|=0r6`(Q!YJHa%)|{4GwUz|`eu#!7Y=>;wn!par
z&rZA)mAnmO%6e;l!a=6yKaD^yRvo4={E;rVB(jr-{}KMAjBRQga<B|`&0D4=1@e@$
z$71cLIS;WWj)h;_#-{!Exo64d7)K4iqGmb=)lQ0gfp~ZSny>^mv^)yQ;{Q?+@128|
zc$ZYL#M`w9xK2yFOOnAtGF=gK*D98D)djKwYelf<OM2%}zer?CyP!O_%~Rrd8Txz^
zsz4l^iWO;X+a}$FU;2K+N<?yJnk|y9n24_UYDy$sbBPQUksQ|^EP1sq5J@{Fl5Mj^
zB=q<@>eZ=QR8ZclWTd^`e=YFEPfqtxC56W+aeTsal-^Yuthz`bU$Z3eT%s+3$rL+|
z++A6i5{c$ovaDSoOWNY?YYDQG7=_gHheqXQjnxwTbfo;DfxdT~B|GQ0q}L{ABs{q3
zF~8R%5X(mkrb~}=Wpw5P)29-GyOi?RSY$`><zUF3zQY^KV+ni|$13z5ee0P{30ZEc
zkryc^aT8>IuWo+HzhafeE=PNlME;MDK<v`(bdCCyJd+?VRHZ&Y4~BGyBMH5*bLu-%
z8?PkDD^)GeZ<WIbh^=ydZfa5OQ&7&&-5!D1<=E+RLS?`=39(50SQBijazgL6Nz$}a
zuO}2Mrs;RvFfXE0PTiSMqBv!UDy}3f0=6+Sp`>4Wb{c@s2^W2GXJ<kw8zy^EySYJ}
za3ev!9xZs?G6<=_IxbEq6=%by1DgQsiRlTY&})Ua8Q984EyX~l5UwOm|MeGjM?nH}
zE-`W-en>bksXa+O;*%Q&63Rhcj8nIt2|q&p%!P!iE{l41M$zsDu#74R$u?ehMA+Q}
zZ2qBy#)3zW>Rz4@4=g1uAw3AA2X;^LQ9{dTDSrsj`h<E?{#;G}<vRE^k0x-Vh}clA
zduu`~boT^?!n!WVvR^Yur}xPfjVD4x=lPZ1SE&e<h^NEt+(gc91df5ITN=9$AkvRf
zOD<^aK8%o)CMM|k0!>}e_^Voon94gIVEOb|W-Y&V5&IMF3mUC~lHr6}G9>Ydz^Y%^
zJ#!+*vSGi@FECbeWtm{IekNx}f0ffTw&A6@q&gJ(aCQ7JFT6x+>NcrguaF`1DJ{iU
zqZDNuPg$Ah{nmw2)^Z6@GDT>|4$BM;b&Cn4{pu`M=z?an1><hrz`$QQh&S&cV<U4z
zW;@a??uy!L)$WTHcPJhs7u?jo4P>I&kh_0Xl($eZGijx1m5|jW!dPIHlVWC;08838
zKv)QDWBHhw3}&w5#NQz796os5L@j1+6nT#r{)OSxtWK&BB|LN$0%xVM=|S68r(JNN
z!KxkJDFz?C=n0vtF+Jh07A5FO!r$-HlT{gP=jNF*QR43J!AqM@V|wCoD4y>F`=cTj
z7^ZvLroRV9v4<#S-9U`Jv0LlGSkj}lPd<qfqmG~F5vK)vh%Z)pOH3c>l2o|Ie8QaJ
zPiirJvGKpp3S7L48(q7U@U7{;oelha7dN|hC#yAn`#IqK4I5XRDaG%L2@#?M);h^J
z)!Mb$V<heNd*y-@dv={Fhj3~$5bU3U>}s#JDYP%Zv)_5tzF?L8`_N#DT7N~sYTuAN
zKxK22s1QYpRi1W)=BF|ws^;$~;$5{TrUc?Ga{=-07xDf%d;qm9L8m>jKp!?hiCR8$
z|NC@3*O#lsC?h2j*+Y2MH%N<7XL|+mE#bN^6A0@d6y(=>Qew|g-(W!491&zsdUek<
zUltHpQjqaLM*6aW*p{LvhO*}(-w+^T{Uq0U!aF`$&5bEzH%ZUmfZg%sW}$CoZJ6AV
z&`WlF%w7}|@1bYC*-Q=Q<8WT~7RuMkMk_CRVoYUbh<}{JJnY3+=rxegUm{rQULy#@
zDA$-MlhYc+<`HH~q!ABi2q$Gjm_=~CA~-vyDKFdq<g=}cU~j73I~uoIQS4oYnAmYc
z5rJZFoZ;RTZHm2n5NRh)x<&Cc>#>@#Af|PZAT>H}?-y+Ldaod|Oo(w=yJD~R79bmf
z#Eug=iqPbIvcGwXSty)Hnl7)#!^)fCcd@ut&zRx7I)q=@KHF}w8Gb>;C!0<el`_LG
z!u+&=tgPqUG{YB=Q7wo5C7)nhJ>3jnBov1bc|4zp$Bxt-V20<Z6xlDZ^Eos8<w)eO
z4PjTS8NMviMl1fW8D4M`^YC0Ve7ER@95VV#Ub&~;F~e73cNF~!x6Sa?w21qL+Q|~y
z#SGsg8j?n!8XN1I;mnZ9xsIHY+B8^=XI~`3m&L6lsZ=vnDe%TDH^aHc9x95l=5Bce
z9$wuHZ=v8~Bq>Ax>vh#jLZz&*VrH1yvilb=q=ZJ8yhBz;BPc8EAD_m(qe3w3zC{D+
zC06#EVP6Kt_rEx+@UWX!;iHFu{B<1r*-DWx^ST-KO+n6Cjm@xg1sTOGQH8K`AWsvQ
zwL~b9s#3h#?res=Uy!rNP%~_2LC&}}5#zZ3#|(R|BuhdwBiL6#<S3D`sxcD+@BZa1
z(JIjlTNupqw*jrUJ_6#UfFX8i3#lKajbmNT3|owieX^=eY|TT&lK$r`G4um7EVF=E
zD*1)=%!gUee3<pD0@fFoGsD=!ML9I--?E1&aT1Wy0<qaht0WO6uE6&HIpdm?5-oit
z)eI|Mknt;UH}(c1{7c4_gNf97h)M~SVo@pbH-jXyFWB34PmEdf-9V^VLBU0_C<W41
zcLJwL$<vCOq4~j*@5$m?ZwC-j8z~twq4^09$b{zCQ)Hy+Lw|{rrk4ifrB>*#prdop
z+`7>W{j`AQUf>IM0FiEHiy`z=nO3JoC^A<H$Ux<)MWr?RblD7jS5e8=DxCs7LrnWW
zRS_Vn7WyugJCFVD&CuD~|6U>{?RzuyJ&GT9nlU3@w(FXqwpwYu?}GIU14|{YU5+}=
zz@p<XaXFsOWt%x_j2WuaDMz!ue9{b^z(JkmvzgP%Xl)oi%3MDIFeCJ>7kCBcgxWv6
z2YBs$g@={YO0G0Rr{H-1^Bh+0HHMMLVCk`n61l=d9YQT_lBPdigb#0Exz#V@s2Mst
zibZp0B7mz3jNht7o1rfyLhN1ED4h+-+l0`Vi%AV<ArNoN{I%pRGc>O}Ncog+IFZL=
zZ3(Rfi+fV^S8y!BI%bA0!K?gtC!|8~X&&oEV3)BGLh55<2*WYOC676Q2#uEr&q##I
zK6Z}qwnP||9=k>0o5)5;IuHL4{+37wwygMRwLW1I>%#-e*(YWkksLlUvU0TMI6H#!
z7s(he-tSPo20o;|@>I}a8mC71@%$=>iNydVj#Vil4t|w5me+yCC$>2Hbfk#(3K4Ov
z%3$$F{#lqSz`U;uCe`Wl7@?OE$!Jh|DUp0^hRP?|?k@((@gfLA34<jvlLrZtMI;|n
zAqQhspRI%qaYQy#E5{oGJ_6`6;dE&tXRR&RhT~(lnO7$yQ@_=CBcpg7tj?ixMQw<@
z4#t^LcNfCxBr;}#hJU4gvEOFs>R7w-t691Qj1Gz}tY@X?KKpHyF7$0k3H5`zuzCqq
z;(YfHX6OdN`qQp>-<DuC7cApX2r<Q{Mtqow-FSvJT<S_Q_3cXND3QWEFsbM(-z_Tn
zKdGUQ*wch*5|K)6C$QbjaNt7pJw<p^q|t_|uH`CA8d;ha#9;faWkH!VFr^BwR;1h|
z!75xJ`}@Hvti3GEmBJEjjR)yKum)E^`c&26ZRlLqLO?1Fr6M4)JKZq82H_jRO~1rG
z;praX&l36ix&<;r2o|tT)xK1c8M-S`GxXwi0sSyS{o+&s3(0a^agkz%?nFd-TOqj<
z1WbLuDiT@81IpO1t|Ci+U3W|6Xl{o3->5~F(L$HT=|?y0r@EoxW54V`h1J6heIo*-
zpM?~X?uX0NuUkzb{RGm9ST<phM4It1l`vT%b$NJ}Fo%{Y)dO`io<xmk2V*wSHH1}c
z!PnPMwVJ^4(WQ^^zTL7=>)A;K!cri`%+Mo+Yy;JA8+l)~4OGAVME3G(hgbhw%}_P|
zv3O}13+dV~tO0^Ka2+Qy>UlGCFcD1*du3#rRT2GDu{njz(ClE+)NjquAsEgR3mB)$
zykv&v;FLV^hHL^fLr0Pqr<l@ORx?9;)BG%{Q`+I^ad;r1z1`OH<MLdd=M&=mKM^ZG
zPmpQr&t_=5f=s_g`*Q|Kws!PUL&l+v<%uM!Ih|yQCQDU@6JIckqbo>Db^<{wt;i)J
z4T$uz7)($M!ud0PGqj>a^6Y9<iUF%%U)IgnnW0UEuQ7AwoY0v0Qq&tSP)6D&GqkiS
zi-KSI&2;`yP_VobTrdcT6s#g+h@=wvUKQ;8Q5B4zlB1c<pGq-cgxh7sM99G*)A>h`
zn?_g7&~Sww@H#?G|Kl()T1LRyuba+Y!6HM(fKqh>kUE%Ti8TGnbiPJM2$^6N`MRPZ
z)f;R&_izhki0syVva;!X17G#=T|{c$F`d%hYHtXQ>D;HJKniW{+^<sn7N5>9L?(}K
z6=vikn2+y+qn+QHPB}ZJTG?3$d?B*9tca3G;V+2Pl(L8{s7j=X;1WrA(sVAtPgVQ3
zCvPI+BPEUdm5{`8rt(u~!$jyt)43{8F(fp>5B~G9f=}OZ$~SKqxSh{qmKeBUWE70d
zD@bo`r_ZaV(wj1u{MU4HuG(;pupCpTnmwo4RhuHGqJ~^Doh<}q4Y>;)AQF!sRf!0_
z!S8Ir#7K#$V^h=F9s#;<NUrTKo6fqDOT4>c&k~_Ot11c!`8ZaPgtM*~QQ3qe6l6Kd
zqOhil=_~<-P+8L#3Npbhpilz2K!KhJ7tRuDy}%|>&LTnWnqD@Yg@lAS<Wg>-QX+J9
zxepPTP~|$On9eAKJ|&>Zq-%Mu8S*nTh{R!L$fwL!jL;>Pa6+y?Mze(z@;${Z_I_)I
zTo0$+ewRuw-EW5MlMFipUpPZ!hQDZrup~_uT4K>-X2>)Z5rnU8icdXEah<eS@+~vO
z`W!WQVMT1b9uMP<7rcgZ&5$}ldSUeg142WKv10(f_x)praCbhrGhva+g~TKKDg8OX
z$z&p=LL3r4FNlL$n;~-Nml3uwk>!S_W{4YAiM8h6qGzREGecsf<h`;D>afcU31i`*
z6ZKWzsS#cVgC|H~ZiVF6`n`i)Jpq)q3<;~O+EVNHHNflf@^x}EL^^}45A?fF_=ok9
zPV87%aSSH@7LRGHT0856g$OSraamW&73Wp1tr2HJFoc`p<xIy<aMLk~xZGA{6k6%0
zU^=Mdr#P#O{?XhC!Z%#Bj9&pN9Ra|g*1sk|`kLbo|4}!se{X_Z$Mo870BhOVX91i7
zzw}r6Mv$el^jAkd{-L&ag7iwqZ>m=^MioZ|=$Vecq=so^#gFR0!Sc)<_kzGv0FUDg
z6;4vT8+HvK^h;r+(UEcO-}_W1CeS22)LV$LEGD05N?>4kXes|@&4>sPRV$s=QW5fC
z`KjY!5r7c5W#^Dr%gWQwW&e-JZ=w=y$9tMlV#tFuS-z7m3W&Ql9>x)Ep`xbaT}0dA
zF!9kM+QLat?r=}@8|DVexkh$b`{I^twsWz6M7cuB)l>T$JF+l(4p*$uUsBH4h;%4y
z$5#^e*as#_h21Ji4<<2J>4+kn^C)m+5Uk1g5<S9nyrop#kK!->z;sv_qoKKlUqG&l
zzXigIjk=Ab<T}&wN+JvK<E;6vV<&F0J$W`AVsN#+R;O~jX0-`4+ch>FQ-YnT@Ezb6
z{Xno5%HXhi;Fy9kYyKhDNadK0HavO8F5&ryOAv+%N{~6RHA(FDvFYI67h-T7(TVRr
zF{O0$7t<_WMv>o%Pz659uBQBsfn}+JK_5I>#&l#88NZE)u{t3zxo~KSsxwSS^8#uC
zQbHz~j+SwtjkO7MdcaiR1X=vIOh<~!lCQPR!daIiO-AJNm6a0n;dq`=%^L*S+$f5i
zB2`9_2S9g#yOd@W*+$;=xViGnDJ0X8%IaL?EXJN9XTj-3kf~M?ma_&tK^TGmR^(%}
zu(a07D00(S$Td<%k)P%EB|N$!|AO)&;dvCJU5Hv7H6nY71}sDma-A$Wm$#=$=m+i&
zGmOBRh|miDc3f;7xkyIdsk2-25@3z#@I(r?`C84TRIZX#u1KC$IZrjKasyUU)>6B2
z9yPNEfW;bcq&Q7*%ybl^#V4EraF6gyqH+Zt6~cuSm53krgmn0X()5EOo3NkAXHdBb
zR)bYl@^&nI&Ox@-38o{t5d7?QEL`faO+YmPAkIOZ2_30&trV-uMOav;%H<!fvN0}O
z-aORGvS(Fd{pfGf<#QYh1E(Ts(M<y(SWTZPVwi9SHQrvzbQnRkh>B#KgI&WXwWn-p
zQbVkzEDK4B%zwvDv-KrXBD>Kf;k}6B-R>q)7T*jQ@rz76YZN%D4v7AXOHD&I%@v<d
ztVk=<5LYdsi;PZ1>Y2vb0!}8|>F0bXsBV$9KIkJ$Lqg^Q@{DgF%W($hgG5XKoMEP+
zE^U-P6Ls9`GX_`PaH1O|Kb^)nDDH=~vSJ)fU^V1LoBT10Olw|fWtzrDTk|W@u-p!b
zaul6kdGH{{Lt`WMTLz>-0|}3z9rND=Sl$Ls130O&YGPw!Q^^J(Kv-C*3#Ts)P?`Ry
z{QH6KPGlkbh-qvVX?{j?5kDGZ8kXHL7RFh+VA!Td8}uQWF3Cd8Xr<iSqe9F3GpKvq
zMAJ}9uu}J;N2v@8xyCZs3mO;emQW?Aq_0dv9efw$=*>2A-(rG{fZw=o8vT*l#4}8;
zW={__jbU8=A6>o(i?Z8ILtT)Vrx8o*Xc{A|HDH6NZ<lF|q*s-G(V<0*8$A|b@x^uu
zQ0??M#i*q{R*sF);Y4JGxk+Es7!!=J+-!_t8pM*aCBX%%lYoYjsi{^$Wfm)HvJm}(
zzrATZDZZY%)^q50rZHLEiy;IPS$q!%`=x5t99nAzhd9%yZ?|q4pxOm#UDuIZk}8t~
z%ynEH*33a&>f?12&5a+MJ%Z|_GlO!mwlU}y;hNf$Z5sZj5g_&F0uGAJG-EKkov;rg
zoEBnZU?h{CpIHWAyxTNd()|>AAAr39zCZ=65B33okIZa<BBi#$>}XZyq<GPG+07_B
zjx(1KUg*cz?D6w%M=jhKL&;JSds?C*i8~0d3NySnH%j25WS$}%CA;+hNl7S8t=CP%
z6YO=SoTy|fYZRk77Q5*4%%+UuSOc?y-A76(p@VkPV;bcoBI@F24ro{t!m8Hxm9st6
zE17vx(8RG6w7ZR||5H%V267Ic2ZU;>@p9XXL=x@D6Vr)^vE3W3ltBMCNxBhv=so(s
zbtJ`RPNUaNOmf1*(U`z_7bfncsb94lH&KLlSQ<AbzY-m!6iJ9fHOH4o;xm9}&j1uH
zpg#{TOb7v3y1S`=?g5DH9gMjcTmj&qQveeH<^gC&XbD3n+5>C~$-wkTQ@`%S&c|fX
z5y~Af^&5=AV`HS3NY*d-ujLiiCdeU3Q~xpwuHt1_qt?-dOkK_!SCl&u5y{e}rv7s&
z%XADLOHo5Xs{OI4s}0AD5SKN}D(LDvY{KOl!YW3H!iibxrK1sZGQb*u$2mh;iO87H
zO8zdUF4x@3kXI)QwP+%u@$^(fo_@NLHRKHzLA*+Rabfk-b;X4R@H62%9!{kLYz_^u
zvgn#wF#s#HGW9dkzhES*HK7r_duCC}1sVDIrHZERe~+QxeFW|FpqW`{bk-D!z<Sm^
z0=vKs&r3WkCde-EIxP3zl}j4=VwenNEMkgNAI>xY%)|Lw-6UB#3VG7h&-2k9!*iF6
zYY8hP@+}YOd)9G@e8z+S3O^r9?0p^t_b0R=<ViY*7c$u__hs`LVZ$56Lv2EJiBQRG
z>Xh9=B2+dzhtO9d=wbG1!ZL}V1KISf?ETmWZ^x&ws$Tr!kU5e@FVBVne>R(?4X@<?
ziEvvY<53;7bVw);Zt?N?T0NQBY9Y%_eRUxiEep5BUnLzS9Kuq$QT!Di5c80R5?R1Q
zSAr~17H8@)WGG><RBAcIi|->giSVSn`>)rRHE>VZf2H}9a`Ede6{V51r<A0p3KwEp
z*lAxENkMUksXre}IVCzmaV}w&l(U0!N>INcs|YU(qFNy<bk)?4BU9zOdS)rNLiZo9
zVfz&wijzz&P%TVD&4wm#rGv<aE#&=`ZCp{q19VU|`4{y&kOZn)87up(sgDn4^v<+0
zj(<4ggoiWwC#al-EQOuWSW0Aui&fXB&}yzDSP`tVK2;fWby*@2tgU@pk*QBpDWHjk
zk|lj*{U+5W!n_fqGyz&WL<45ZxP<-JIhlcEh-{7aBSA3&X$tM7@}MC{vBbCJX9rrg
z?VzcbQZ?dBDJgiR%6b*gTCMBPn|i!x%!MX$p^>SVOT>viuQeGxD2rHmhUem0rNo#p
zN!5J}y53FVfLisdD)sX-Yz>jH4-+F5O;*(bfN~D`$QsM^WL04RcL?lYR&}ke>dLo-
z!w5P+sdIHzX8<VY(6Rtu3p0b)y=g;HilH*JO<8B^vY6sJ?guiGFkH=o_5LNq6?ZIr
z$$>p#7nM<516^cRQ^^d>rwG#kZpC^uQlbNZ`5h_?UQ(J|rz=)xD1Bt;dRt*1qgz0+
z4tatKJM>-Bo4td^hS#w*cIX#?u7HTq?9D3}nL-zjQ*O1qZBZLFc>DFdq(3HZx1^^B
zMivY8hCaqzqQsEEv&BNoH5)$=8rAgCvOJPf*3=`|Hfj_<NsaN8^oTf8^N3Vs2#BZ^
zRO1#z8j&IkcpJ+H?i6Dsrm)F7QCVA%{6CSv_^)ea!BVf+bpx}+xR0=3sAt|4CCLM`
zga>m7=G}6F7>R@Mdja0o1oM{Q4H3M?;K9+Yl9EyIzAwQ0z+qnH*c*}*#32^qRVi5^
zUb7I}qgs!fqlF*?NDWM@c3B3HlAS8bCG6&C&JmRCgi!w>`~i&F!{{1<%_ak8NjV;1
zDCd~cvZ6*@;Prv^+is4jBrD_s7)W@mtXfr`gbZYy$(crwtvX#VnX<N`V9x@Z11z_P
zIWxlYrgGK;TkGSk=Iqk2(w*3AgzYpSi#M`|$0%8!rnOEC1wYYJvzH|4x<9z+F_seO
zkCV&E&oIQ@u!z}3)f(xPoEXLu=uWd6v)_^v1#iSEP!ji>%?ePKgYw=LvxT567nI?*
zklnrnvzF*JvMarW|09&_?o<C)7n-%=slV$u+`daV32?<6vvxdaQvZCyEylyr$AeZ{
z-V(|kEY?B{ipMI}p6pzw(ASJoy`nPNM3bEh2Rx6?9n5oG9G>@S+F5zoxd>X_ma_bZ
z>|x?f%FQYM>8|Wym`fGOZIwMNQ4xdvA@ZuE`9Il%LLs-zB0Y%J`BJ?sa)U@dFJDE4
z+#t02{GO=H(G)+Zjd}qMZ)N_@ZXe|BSBpS<yh=r&>Z$DZpk(@mxuYYp<;<G8oNE5h
z*<GZy^F-n^vaS8(JU3pD-OJJfvJEVq-IAA4rFv;b>F7vR>x|+mPJehRG`k_M!b(3L
zC0Ea7H>@O9h*ENUWH*Fo^^7<gHk1<kSQSX61SNt%{p?iiMNk~6v@%=9bG7WoQn<R|
z{f$LgA>kBIrc(6d<Hu=4P{{LpqDA0D=<S*BgFGuQaHUje)#_KWLL%G(V>EDAB0^VG
zk>dTcLLv)GR#G;G5phW*kWxCdcBML5jyqDu7giaLI}eqi)*XXoEGezZaQyO68IE5b
zD#P*XLuELAwaWNe%Gj9Y_=qyfF0;${i0&G!hvTE_59-mrj8(>`50~-j!)1K-a2cOj
zWxQG@w02WZmZO)H@p|+ajmHu^p0s!2@Kg+$R!gI^fPfOtI-KRGBiMf`>^d|i@`x)N
zTB`hsEJqbm;_60^$sGlyDtHh|1n+kuLbHN6ploQ#Y8$f*sZ@MYwBQ*Z;oeav)lkMq
zaT1|zq8pHsq%v(O8@kZ{IxTS4n`KA^)n=b8<1^LX5yPPInd-ox%<7b7Tv0NRoBr1<
z&oV|zQ3s=Q#)CF88E;v1_vx8L>e)r@sheetO0=6irdgIT+9Euh99(RMPDSJf4#b7F
zC|5emXb-t^Z7j~EtMHsP7!@<xS5?f$#fN%IbcDdZm$D4`JP*vOvSr>mxJ#f@d}!m;
z@lYL{Ig#xkC9;eXigzd-u&9>6C4j2RRDzzQ7(VnBi0P_?v+<$TT9S8It1SI~Fz=Tt
zuYMm>U#?BWNchoJCFFY7$iyuDD;u$VvW57SDkP9rF0_{a-7NhIwJP7$O1cuS${)?w
za<0_YXhOMlc6e5n{(@~Od|pV;?+1YT`@B}K(qCYhwKbj;Wh+2i{zI1jVywuJ$aEJG
zv7Hjhh5Z+kh?Geae)WaGtnEd=6H)Bao@0vyik1)cMO6ZZt|^2%69ehxLrV;rOCg?F
zS^7N8pRY67g{OJE9aId?$|C~*N}Gg@c}*lDm1%q_ORo~F%mq7R6+}m6WHFc2hEkcp
z;qsxq{6n+!3QPigUcwz%l2R(tO8_9;wy9ZqF<ZD5irch`;ZOU#EUjeeB~-OU8LKbK
z(xZ@b1*yFdiK<?J6>VX)V&ClWtapOse#i37FVZjT9cI}+FOi{>1FL<Z6Z|u?zC)&i
zKZ!&|zf)qtIHJbiV}b_X(lqF7{v+#{O(!8y==94vrbH7txQ3Q>LX{UexF(O5r$&}Z
zow5!Fv$V9b98_7f!MvJ_O8-k|c$(NXJ(KS*X-374lzDkpdJdS{5S}|7O3zhfdEV9`
zeHhQK<2+}MP9Gb5p5HHhoD!WH5z@!25doa$Vd)c)v7$M~nf@df@Kx;AKX~BA&st!u
z^q(R#pU~20Ff96=)yT8?mGt=$vVO?(&YkJct7mn&V)~*WAG7k(7m1T3cPcLbA$^h3
zM4q!|q+6?0Jn!h8{zedgK)Lk8&{3CJPj{ss3Br9b>8I4Qcnt&m&E)rIq|y1q^h!z?
zPblW9z?`$1#`rSnWIDH@P>biHgzFO6ZQkOJ*0k2|xp*g-uWt~s$@fHzN^P+ma=D`O
zx>}l9!S1Zpxe6mh)8gKDg>=U=uEf03v3dgirYIgsuIx@-&BQVn6Q5h0jnJ#Nk%RuI
ze(CcL{l4TXBX|eFVU)~GWW&pbB<;ZonBF&JlBsXtZB4;NFugD1!B~vQd2W3}bInMU
zn_Xms3>A2Dy2~HZni{M>P7P#d8_AE>U^A1OF`6r+oh33Y7fYL4$F3IHq*}*ZA#GtW
zQNHP`szqncZ4#_i2O{n4TCKmT_JCZaG`m**O1}oHg^uL*r3&kBK3oN>TI)Y~7*<fN
z&A50}OQY}-@`@~Guq&iA^>JTjTDMK=Q)NLVRAeJyt8Zwz)H^pPJ~x|6C9ty<3;-_?
z7EYjfT_I_z;hENz(u}01^YvH?v3|A9u8<n67*zh6DSFakvK%2CqUuSjc{oduU1~|&
zdH9@gMIzE*KM}r{$UB&N%+9b7I*4-(RPVCff&`bl9Fku7c?dfXfq-%ki;>7_9x$`R
zWRb$TgNJH_s`yNCvijiskXUm<Q|r|w1UWY>zx<ib6kc8G9u|bc7HUT23~Bh<wnlV3
z#hgp`6l3?byydMtfJD)h-rGcrJSp;`H?So!G|`VJ<2He@nqemCL&+7pOLMIK8_>RB
zrhy8)UvrGO3;12Y@;(?su@?k2h^FqRBtf<=C8bkLmhc((x+|m}Vy#kJ#M)8QhIJ!!
zkvhIE?{t#-(irTf@-T_`qPuW6;$fnPAwen<Gpf8K+@)A+b5;5Z8|r1Onr9l}l@*sv
zLxuS&a^r=nagxeDkFswH$4ee2-kc7Kf#|;l<$7m{E2NMpS2!h}6Xi-uSMzySh)a40
zvxs2>2>s|C?e~DUAD|ZZyelLI(_7^lN8Z}MEiAa1C@B_xvsvi%i2~OK;WAX!^)-k|
zP`9!5U2v0R)-3GylAAen_bD4(FIbB>sfC-hKqe>*-$|dj9QVa)C5a)glu1mC=iZ31
zkE7!T(xL+3rRTUDumRrF;9b&*m6pqyB`xj)m*a{WAd+OS^@<HdF@EN1RJh(bm*Wem
zwY(}S_N>eCtw=@IV21B@Ic`Zx9+B|@mqYC(QZEgvz2$P`TSZH6eQ$=#v4>T&?J01R
zA_7gmRLP>YN0=RgFu6Za8<qpKPb-kIkTQWC_7dTl;#OHQy_e<UVeb=8t3K>F5bVR?
z2n&~jI6s4PhYnNpo@P{C5I<6SyyFb+K=LJ0?i2oDHEug|z@XOpjW)fo?s%~ba8-9g
zP-^j!T?=_h!)*rAoxdXADfR?v(Gf1k1v+OkyV?xrKOod1@LI$O#cv<pme7hFcg}n?
zJURlzP`u{hBMF18UMzH&PxH%PLzCk$5@Q2_bmQcBTHN}I&2~Dwbl&6?TM61sm3%ws
z@Zn_u4++ev8tN;(1LLdErUlVv$UDp(sj82^Q#G`re|ul6&m^A#<v)F91gHb0=SfE>
zTo1i?@v6%qHv$^f<b~wxg^6LJ^c6%z6E<L?SWZ!*-E57b?bwg<rOWZ8<PifH+0*5i
zDs93mLcSIg7?~Uz=Evw6)mo97oZ)g5oRKuDJ@zO_7X2Q=P~9^gZF;M%%aMaNl}>_g
zj%ZW0gSq0?0H&2#cNs=hdO{BJW(!zud?u&#T#nIfB4ZHnYs1&m25aSR=o%|rjylY%
z%++vQUFI-zMgpN??(Y@HE=L2@p_*b@K29SHH4GkjG^$4e8gtm?NaY1Y^*vmNZ&WY)
zf3a#l0`e=g7B;Nu17f`Z9lGUmw1FYCUx*F=zgW}%FKD3+>hgfr`bR-QSqg@qo3mxE
z$c=wS^;5+tt6DqRJ@uU5<w(RWuOV;F$1zeR*0Uqq*SH*&QM4M#woH<OGN}<^ms7Q%
z=o)1n1qF+?F|?v|baOSbKZ#W+qda<KUt=wW)_4_2RlCrW3y3rlN!W$P6%^{XOJE7t
zI^k;6SoA0;Sg4I5)r)=FWgMcUn*KMzeJ0ao9HU5O)>^c18Smpls_*#BS>`g%2U9W*
zxC~`e<i%XO#V+H+V9J@lU4~^BE%uBr6?>pHs_QboENgdwCQV(&|6}Vs;HxT{{(sK7
zAp}Uf5$Te^4N^i&La(7nks>Gp(whj<d*_BG9qBjHks`fFS7{0Yij^WhqM{G_sGvsW
z@kK@be}8+<P4IpH@R^&lv%9mqv$Hd^<?Oj*^3a`WdSQo)LjBIab84RUC^$sOxtSwE
zY2B6VpQ(ob6Q%aGpW%0YH3Cnde9-UwX#y%|otxU1k2mkkJ?T!`{u~sZ2)HnZyd=E1
zYFUqV_B$`)rf6BM{%HOtYjmX-MJtb5OcZ)dT6qwT%OEX#s|K4*<3PL*yo<W2KT}yy
zFIpKiWOq05JLWVdWb5s-da?0k=ziqUHSgAmF22;Dk6laatPou+?Vw+PpU}JMzmof|
z<-=PK`JE7xvh)p9C{Kvx$!byPGL_9Cmes{W7t<n(1`iU9vY0F6+3I&*P;y<?gJHG?
z{RP~UYOME-EOAa<%V+}Wcl60CvwEBUt5I&wTvxdf-F|}K$vLQ0?LjwsiW`kH9BA%$
zh9P6s9@WXnN@oaRKg?lLb@8yWT9Kw<g`XtA>I&S%OU*am?{r6@eOMLDOtGeVKUjkq
zcDiGu6E;}ZU{vzpydXuUJLwAE0Fe&p1r?F&UdNEL2Db&-qGNUs>%(qfm|avaOjiYe
z@jHDXQhGMg1A%8a>pOT2g=T73kzfA#o&NBt+P`^~eeiY*3-ck{pM%~8r8^{bJPn?G
zI3DN!k5Hp(k;Q{I2`<p>ANo~(d=jU68!TW=`e`sCG<YO|8o%-YLk3ULWm6ySBAWML
zp0(3;n8rv6T=3uUI~}RY+3QfMCN9*7^|-(>be9W@pfSheLdU9Ta>IsQV7Gc~=on@L
zPWs?8B_Ki_&)!uX^{YB|Rvoj$b-YQsFT-{Gk-+z=<D2XNxphqQ>c|m0^X{!hH?Mrg
z?>t5~*R0Wm&Qw1=hFwfxlhO3gW7Y2K=EoXPXhY>Xea-K1yS-CmS!hZ1$cNJDNnI~*
zHZ;_O%_}LT#wCu2^Qh-|knwCYzf)fsZ-&089$7L-#`?+kWvpNM{)`!3Mx=GoRlie{
zF=91TYvsGn8xJN?7y=)n&uW@N<)p2B-tYL~|C#fc_=4hpt;b+0X4UZ<8hkq`0{-09
zDNohcPp?QF45<&Kf|R`b5pfOMA!7l3983c1$Cpq~4cQHB!Wz>H+`xueCHxU^iCW}-
zs$kMV1a|UXzf+pOx&~m#ZQz?y@*w<9fU5~jPJKCcC=RYu)4ht=?<Big6}Mb(x}WVw
zRV@ETzmran*9yPpJ`~0bHG#D})B<!g+P{(4LH8aY)C6c`HnPrSn|IxvTFj-MwOdOr
z&K9wJ!SxNLG4iv|?M=E5S{4F)=nX%2K4x3Xku#re*Kq1~ZOT!sO%%=@Xx7F5`t8qY
zjo34^J<x^|D1Q6jLczwN1A)HEaEJ_t&8>xg`z!eZ%J3X8U1M?ur;PP|PN&ve8kAAB
z43a5@!RctI6IEXWbw!47UK)9>jaz}dX`$U>-t^l)!<5?k&}NM0vW+`Ke+Q7IKwlpI
z27ZK<Sy!{IP=?9%h2Jh3!$hsN?&!$+#j=Ls;|^=Cz&AXQYgl(v8`SFMZIB;B>6*(l
zx!1^YTDNC4f}^r4S<Tq9l$NY)XYLJfYI_%E#)bK*S&|h>)=B_G4tPYGMk#lw0~4jJ
zL9{Q#?9i-$nAg1Aced5cM=nFUvkXPd_kQ~q+Ecf-n)y9Xk9<KL(N)7HDsYR3e*quj
z=rlvNV|fpx&JALk<*_VT+~E-lpf-my9U30b92#x}t<X(6#fq)w--3dv)5l}R@aCjx
z;xS`*F9O~4&a>ek(={?Y;(rnST8H<*4EKhkP=}8QXF#_NH#h%=?olR2t<FpE!x<G}
z!HldZ5BI9sTjSJ*kW|+se9t6|R;OoG4KsxSs6;Dq>D3o?{tB}(>Hfah9PW$rZeP^p
z_67tf6z+;MA{sjA5mjF{4a!VOzL>(c3Qw+^d}BvGvn*o3vWPtSzw5OPEzp5m1K#!9
zJ7A^!i6e|OwqzL<_0FOe#y(3_3W^>*J$w(awZh;rLm3V`YAQX5Yry;EjRLXv=T|mt
ze5v7FYHjZ?<QlROBpv>{IlSYybw*DaM=;bz6sF}zMq9q`TG0DyxjWZU{aatA{mpB#
z8*L75ADIK`D@x8$@A~rzn3Ef$4D*iA@Qt|1^~~o(%~^P7OlWl7$U>>FSx%#W5%ZKw
z+!BS09)%&oc@%DX6c&eGts7aa=xs0CW-l9jJjyD;#_vKu)QwCEUMWH&s{C!W<mHL8
zetQFTEIm8h+Sd-Wu9~2R6|~w-RG0_Sv85{v={;V^M2`o}KxS0X2P8mNcRz?Rq94c}
z;-J07IJ*Qhfyq>T-(+#YD(%!aiz)75S0so5w+{x@pHDsaAuH5#Z@tLU!8U$7D_Uh`
zTP5!B*G%f`ANM*otD@VnBSMg0qSgB)Yy38sEUJT?2HNE)_BIH5*SJHkWfDkNEMpFX
zVJ|WL&DSb<blVAy5(WHrrb{E}G<d|^C=UkXXTG8*BAG^bJR-AliOk9&GWsjOJv>~I
zl^zXkth-<0t4pl$AgJQ0F$B=ZIklRYLojGhbSWa_@fm)*k0<1ZFOuBsMK?TOLAUY{
zWoXl^L%?1bRIMXO&r2C`3FJE<-){wyPBQ}h6UbZeMw}RA%0zlgFxH>Vwhkje+15b*
zusPwk2cw@F9>Kad!>`k)8%OfGozrY54-A8mg%w!O!^1#n1(xvuFGunrV5iw69<cl)
zJ4nkN;b9Cg3UN4$pRJ+OaAl}UMr6@=Z@3@?M=*d0!Houy#Z!+YNtiuBRxdB43-GQ?
zFK6i3a^pcDDqvlE5O`y8sA5ALb6VBSv`Q*s?o7YkI?TOZWHsDtl;Lr&b((sHTFnHe
z!YF2icI&#P2y5hvAlG<$LpS(}dm~Q)Y=Ic=J#jzxUZ-7|mNUrwG2BzT8)?0!+2>@!
z5{%Rvzt}Tt<Tt?AiuoTN{tM_u%4WALYZOc##U*!6Gx}~6<%|kIr8zcY6tXg^vADOu
z<zA!M|INL_yA1a_XYeY?!T-g)`mg)#CLZ$|4fdGVq>Py733PLpYcM*gr{As_PMhUP
zaZMv>UfKpZ9G)`PZ&!|hIsI`>j`G(WRBROd7j-|s#qS<GYADUP_BA?q`8BUz#%|wW
z^8;_Mo!>SuGcw$lQ@k}<s;F@*`lH|(q6)k2-KZyEfa}zlR~YGyQKNuC@ML*EnGiD7
zL0&{U*yNO~)@Wl&mM?~dTD4MGTQP+m_v`Wqr}5MRQg#kZFFl*RIlmnVXRL<*^cSz`
zezU<}`7zzZp;56N)&|wF$@}JZFaHfsjz(ospT$_GYQc{F8=f4EIt}s|NJilePmD(W
z2i)hC`wqb6{GyTwS=MMgwb6OdZ4AtB!;;12E&f{%a_*)DkyLAR3VV_osmF?Fr1C3K
z)1rTqlaiX*B&h{FW=0?bbu`0%bW=q!P)D~{lmg3mV54Mo7X=uoqsIXwyn#A;DS^eX
z^;ohiYE9M|Q48h{)MHI0YD`{?&4bs^=p`e)z{Mb!`99Vf56F8F$(+#%JOCFv_3&Q|
zbCGJgTzsUg%f*ZIj7H<=O~7gx#%R1Kd7!69qxwb%&r~*6{36US$e%%e=W_9#$}Shj
zz>zWWE*G!d&&7{CE{>txF}$JZG-Jdb9WO5OD=zB9=Ocy05XS46CO{(s8n0vE+nC3E
z8ALH)$8-Y>;~21G1_Dnj(<L6J1CzZ0JBA6snALFc=uDT3P5=A92kg<!X23RV%7EQ<
zKfkEs!4m%C-WYtOf2`5=$Bmf98mT${h}xUiNXu!{&S*sC4Y!eP7<;Gv2Qcs5TVz|y
z4${0ilGjHr!&S!AffDYJ8iQ*zW@|Ene>i9apWuhUMQXk5hC8IV;m`B3@uPD_RK@=_
zqSn3d=hi^D@K7`(YMvQT(a>FV|9EO2DQTH>#vk3!@^8R`bZ<ceK77c(C64`MtsPMD
z3qSeCdVWa>Rov*4X3tjcJBBs(v3}Pz<MgdH=9`{)bYqKKx)*6+@({~EUWFaT`%3_#
zb^5N#I)7I~OjUb5^x7kl<zhPeyCELttkC<dLO(qcStzEqpZPWwAXW2Xp@PjK%h`)V
z^_xYOj#=%mn-eo7G`Lx03H!6q+-8xrgAx8x;c7}ojr-L6l*`{zw5{L`DnUVG%T*pV
znyQzgItIs-du%=JpFelJ_DkA7pPpHJwRqS3rXO}xIa~WhG#=e0wNtZ3?dK?l>rCy{
zlldE^ZfsFz42u)*PN@AH?D%x7`PB28GPQN+o>PFjE2Q@GE-O}$_vDoZ_HE{uR)nvC
z{RZW<&<j0})N5d$HJxL=#?!#Q%D~YDe@=^mL|1On!2Zac?+P{fpD0!lD&C(&3!wWa
zG_VIly=7I>ZYtTp9?4#u3AC&ey4{?YnQwSR#^=)g<^P~sM*b7UXQ+k^u^QNO5ZP|C
z3k)ARoWLRu47AK3;cJ-<?3L(EX#+al`b>BlVpZv>1^upi8EfNL4K9m?EpQH7PBtT{
z!R16X)?9bpz`T*PQmilhUV~3X3=wK>S<T*T&`kN1ZGWt(MYB?>MCjudkq_njxB>HY
zqOOMiZV_3c;jsq1e&@9O!%bMr)Hb$Hzy4MOeMEqbrF7Pak2K&dFw1%LaW_?<q{v0-
z{<Bb*mXTG0XB$+d*6MnRMcu^tCiOB>6ni^yJ_{n|TbG00Oq`FLneSRxI+M6CzeYeM
zcZtLMmeD;Gm-1KQBtzhaOJEXGX$X*M5|#44uAMlkidsqggTsm^PGM^J=napWcd_X=
z;$@dYZIGo<;!wjA4wWt-mvPKn=`OlUcH+<gax)a^?hbUS+;7xqD{&~a_4dqIY|Pj(
zq#IT$QL7?mn1;ad);!;7O&qCWgEv5I2VO$vTJ@$zm0Ki^;%<|}&&Z^t?sHFnYUy{N
z86CxsB|fR@e3ossJj&nY8Xc{xQw;oi5`LKhCynqjxE;L{pX3ihVvT(lc#EQ`b|*%g
zsrL5>&e(53wtF?Ps~H-W#a5Fw_RmnsR*??{$Dv%uJ%DO#`97tr1s+5-niWPJ+JBV&
zveqfmk>)i%yB22(tVdamI5NdT470i>)_@qyAg|jYHR%6>>YVp_Ce|p=pMx}+8r3p2
z;+cxnGZo>vQt(V-hS95D=eXK*azQiT6PvpgMrE9vomiQID)Xs<mYr#CFEOP}V_FVV
zDi?E^GVWp8Qj#+@ZE#pyjwhLwcR*s*Xb`Dg`B}~ahtp;biJAi}J2-8U(Ldwp+Hu_T
zM`Em8n+=5M*m3$GVM}b;n!=&(tvMdulC_gHC*^R-8>pp^h$faZbt2Os8eAz~V!0%*
z@ssx@mSe&~7oZ{QB_(nz00D+co84~8Vx_&52i{FIR{`h<EV+ucQo?8%hQtzXCo*g*
zMkF#VQ1){qgPVSO6yhk{X1<aubUwC6o05x^;0_6@wk^2`Eoyzn^W0#`MGRa71UhB*
zm24+6ZHK$5+QsIk(!o8G<MND9&o+^zf}NtDwn}#6`oKj|bk)q)OLmVjbo|1PybnLt
z#cOzWeW0Y#AZ<5bC`&dr{b$lQy)QlA12F;%Yu;#4G8NXCGv{qjP^rr^N~RVhntS~q
zSF&_T_Vz93u?J!ym!vj{PqZ%yxem84i81QcykruBWF6*5Yon1RWSb|KQ-v!ORzq|d
zVe>U53nSW<&XBUT<mj>Cm7!kPP^aUU1B)B5W>q=b^1aZ99{020o|?>0>GWg>?m1eT
z5%Ir~@6)5h(YJL2b|X$gtl9^8a}uK6_(GPwZ#t-Nv;|&#K)~iOveWKqM6Ng@XYYHS
z5_bYG)g-VQ><prVB@~6)9CreEO@VDZTma4~fFCjLD)1pk9#%8O<Q`DxF|%$n*3y6-
zr{x%Xb%tf{zXv&PP0$B~bP{4UZfyJhid~g$t^;-2)lh7{zwgTz#hRgJAMJD}q}bSD
zGy2M2J^Y_ngi?y3x$36n+totEyOC$SI1%$ffWsve!n5n~wC~Rj%3JS)n!^r?e)$)$
zYls`~CK2^1{`Onn>M1*kJ-4^+@%VP6eiHOkl8cM%!Q$i`E034IU_jG4r(O0ImdXY{
zud9vP4<l}kDFOCbQ31OSDcV25{c}$HDUlokDqL<o3ZeaM3k}_VnTJW@d4qm->*tlG
z`aP$g%d~sd2FrQ;V_2c%VKj49CK3JhKvP~xG`Dc1oC(;azek)4Spir{hSx(U+VM)@
z<5)<v(Bqe}?uj1-+zFYsM+;62*m*Tb6c{=zU`G|O+{tT!uLE|zaA0ANfNhRWp2LQ;
zztfwW)Uu(%IAKE?)Z=+UB`pSp;CrZIpt{e8{Da!_ag$Z@lI26`d#DUh50nqs3Frt9
z^#rJnk)Uekp!$QV6AakAQ6Ek<0aRumP`RlVfNJ(tz%GQ>;?Y_UYG7~|xZIk(4DRiA
z0lTnUe?LJrr-)43ciPRPLGRWTAFNe|i5$v){M{dHc6FS<S>#4<!By?2ksJC6ZJ#y7
zpcq<7p9ap;(;c1{_EWIqwWOUC{4t<e;1g9Da7jP%ltnS)1Ya}O2#(3Ni}2REWtEBy
zj1+;+q%0MQaAZwKIGi`?ub)FrvKHCOyb8yd#es2u8QfNj9dh6PGKK^f^+8BN-8Q)i
zNna*BTw2<q_>D-YlXXNTwz)&Z8B=1RKu?vZ8?V};fybj1$Cp<ih6i{%zPbX`ZG0=B
zr7Bhkp=?`5KdDG&k;|6vQvFcPC-6p#V57M3)#*@M<Jl}pn)6+(+-j-YE`qn=zGmkx
z%<6Xlk@DtPckj8JBsX+!u~g{*Uwd&nOjdcNX{fK~MhrXh4o~faTX-NL+g*l#U9;_?
zEUY7Fr78#BCSRWeP;2zLL5tc`frVh7%mjPr5wO%9?9&Y!sf^n!=O5}p<9Y&IwdFhX
zI1ht?XH_Yap`gV8DK(;DeUW)6oM8fK#)UJ?!q*!=BPR!XfE-gAHc$?IRKXOngdER@
zbF3q<#tL{vlw;OxYv10AYS@_7DmTLp(rgQ7I6~l%IAtHZLE5UOQgZ_<D5A?eI29~4
z_hGaFs;Q{9nDlE|1q*$qD*Out_DTYMP?SZ&oIQXp{la?yzN*>*fb_|yNYmPM!b^p|
z7U>{gzCPK<V8w-(9<+bYr+#?}GjMV=b$SChO(1x38c**77x~2U$wfGAN+N;134E!*
zRvvx=*xIpA9^eEoW^aN|fm1xR10Gf29Ug`N&tSVweUojMK5C@(?1N@^sM7*I?QrV9
z#4iJ8sWNBD6+8{kCwv0DLu*gRczFYe04c6LXqROKbb7+eJF&QBP1HVVscTB@KtPAI
zCpHB#5U`@}Ykvhc2BPr1?vj%W`q-5yl53>`*u6a$i2=t#SkRcfK!$6%I@JX!%hlE7
zFb=G{cxDIMd0w{`c#LyP1u3aC>jS1FZpsUv^~%t|DScOtU{3LdYCL1du1-d*_Q`K)
z#;u^`bj~O4p<5<)0Xjf4X^s3w>Ui9%PM3o!DruL8)>#VCo3Y%WPkHED;nc6G{3Nyq
zbB-=|IZvG<^Z)(#M68`m;>o|V?NaUFzxiX?Ne|k$xOd>GCE_${b>awMm;x1em=0tr
zfOeTk|4lT>;(6E%yh!~|sSEZ2yj^RbdW?rNz$*%L<KYM38ybCTAdO~MwKFIB>{CpV
z9-b7%`<9Wkt`r+dYINs);b!PloOUT(a6YT`dnXP;OeRQyc+$>OWkdkkorE+@@+-f`
zou~5Ta!2_uhWpLDfabD|Zg9{9>V{KzQl+`W@2RmOxENw6tw|+B@Qz!dr#gBBqq`W!
zmX0?y+R!<&SY+v{<|xdm&XErWi*|6QLr-lBH$dkH?V|lW^vN(f%VM5n7sVJobrqbq
zvARUNjdsy}+A1W5MMX1hP|~Dc3~BQkv@3h)QyMVF$X^oIaGtK9A#Zlnpu#vP6#<oR
z_0Uw(4&Bm|RcVr$`?~KZGtm{}IW(35(<S%PB-<6^ZHiE3az+u1(^#uz*^6H`Mxb3B
z!5|+Kg_VT^t587QG{8$2X1Bi`@;0eFP*wqS<)lXdmf(Hus`1bpz?%8mW$-Wsn1udr
zJP~^DThWk6DNR17>kg6Q#S~xTd8GLec%P-qo%^%xK&HGlei_M8QMK6l?W)5tJ5Q75
zQ-CjYIXk)0l@xe!{L<XmnhB`z!y`=?)$3uypMdhhly-O~6utql`i4zKv79;q&~+9Z
zF`vn_1N86q?v@kmnk8IA32k7wl6gJovWS6JG+R_k*DkHw2D`qCiD)Nz`vv$(MyQ?A
z+%sv~mM*U}KZn!&MVfozG{qP)(CJdTf*($^Qfuf0bpmv9UJ^MwuV>pNiXc({(kV(*
zM=ZHbJPs7EhfB~<4{Av_2?QRhPzbz1^%5#gsA86f(hfAoWNBM5#+i5EA&qK0%7I&a
zfMTx&O?e{&YxAhD<P$}1q_93fH_i(b@1jIjUgG8?M7)NB*6ofG&LLs(K_p@<PoAP8
zPg(ZstVehImLl^+r?qL<LE@HNgmfFsS@+^oNcFyqb?FxpB2GZ6dqZA5AS7Cgpc4X?
ziPkljR(G8($rIhET@yp=;p<^q_ORlRPL`o6{Zc~28!)~5bX7}+a#$tE><6|_W1=t&
z%Ut@f(6vEfu_j-k`Lrx@FC^}AV1xMc2@&t3O!_=5{PAp?Ta`rmdP2nhc+2Vel}KL~
zYu>Z0DOj#4z8ToJNcyYX2HcO>Xp;p&C8K3!CPV~D+@lR{Wo$9NA8hNPEH)bRKI9it
zF$SS{E5Z3IPZ0e)R3xe1lyn84Fr_2VL8acJ=0oYuDZPQ7aInlAc;Xr}Q6{k(<A0qP
zdVn0iCq%qJTYAn__TMSlf7y5kj{gftOapX_tRK}rWhD??uFxMmZ2{I3NT3Z<FauLg
z(X@mLhA^WI@-Q#KDM82e)S0P-dZf7qTvebY4>tiF7fVp}88uUWP+&L@438<lE6|sh
z<`DR)d8t^!6j~4za}wtHmTZ>Goqz~TEd<DadbkK}=hohVYN%AF^xrc|X$JMfouw_Q
z%oE~>t5zQ#?dr>(LyWP<j(aa(+vSeR#~>wVlTwM4MVU0mvSKw}%AnK}wm|A&=xUG1
z()rkaG{Jv`?4B&0&EblJ1-uzYmw%OQm#r$*#jj<LPl(tXPqicehbpH6WhEDRp=jhH
zFZWBAZD&%qgL$J9B6`y^y>u)-Zz8F?0i9`n-iq`PnaW}?RBo@{s{O?L)ZXTZUBzcu
zjZ-x0>3lt+C%Yoh$Z}#|u$!5vZC=i8q3oWK1w+?+M#kkiC7i;ggR#}g&ZsiK_=E`&
zPg9fLyC^)ixho#A9jMJnV6c$A#dDnZ*r9kGlG$?67S}uT%WD7$j<)Q2_wz(|>OykO
z_C$B;9s=7ushxU(z_}^eiFP?wqp(G~InB3ZrQ3mJzkxoL>^(QMuUBO8$a0p#p$~dR
zK9s*~Q@26AuZHgSicHF1Zh#x^<Ah50<{GM*UQpIkM<rob0qL7^Fd`rBKBAkqHbKan
zU$&4EA}&+wK3QV8*XF!x^M8P^U~l<ymhLHb`aCPCSrRX;S)OXRcRd<6#IE6qVdzZn
z$U>3jaUJq53Ekj1I1{yXQ@S*eFK~%+`p#$k1@a|XzV=HnN$siA)H^`70y~*Olm_Il
z6uYBY0vYf!jeFR-^FL+^Bq<*4`ni28c}co*5JewZSJxMBtw<cwzD>ii;|+eMraPd!
z=dfsu&qOTtBE~90W5F5Yn8x<I&-LuOkDkUTm1UAre7UrCph!Rr>~~TPV-D|>?T_Rz
zk2$qI+YS~tliWbXM%9!?*O&(?A_b>*(aZ(_3p4hqV>~<ww3i3>CP^|#YhuoUMfifx
zGMzbfS;9xtO5pUb;kA^04^vZTOq3BGqY7-}<dndL_TEtGit~?>5kD@wo>f1i7R(A6
zc2a$rtq4(am(5_Gn*q07>tFq*6KDK=9kH{EV=y(t?zb`YZeKb$x2$ZZvE~_`D{r`z
z^)$6TWBF*(V*$2goT;bq3`$-zSp2KN{J=E$GUW$!^`Ae0y<s?dE}#7e=pl>5u5&#7
zi6RcZ0IcBD-Ct2)Z(7dNRfq}xg^>vE26jr}|HX@p6$(n>2YxAFKZgG_qy_r*uht|u
z0lXrLI^Or!Q-rPn?<vrqhaUmViu2bfOciwt{w;cop=S(8@&g6zrbG{p6}`2jVP270
zJP5($2b66)!SaASyuS|dP#s8D;1myyfQAZO<berAW~<Qz{v!+pXHtR8J_^v#%t^pF
z0)OLPWG(~dE0Dm0$a0X)=Ww-m#d~UIFu8I8o0VJVnU;7?P8|}w4d|kk<jRaGrx~Fy
zfKMMH&<@G0$zL>Va$C#k|AkU?Cl*DW30r*5K+Bp&!=@GI(@%V#(5^&xn_tVST3`|!
z>A#n9UdAX+LoZEx7>jN`QaG(Xp}Ja2IM9&vx2040W#zuWRK3Hh&pS?Q0W?#f4G&KM
z?U^#+Z(boSu7&x<?=2vic%}$^-u@+t1_1pL)Jm)%?qK2hS-Ytb&`O+XUEK#!e5R(P
z*USRUVh^8_l3-V=hNykvMo|$2Z}(Nxn`ootZUsIqMb4$vX7?`?FdD$q_U%UPxdA9t
zIM0gerO@gAkp+XwdRfw$JfOg5iDdmaoOL=mGQ(M)C$Laiu_}WvsqiTD50|cH=GFk&
zh0M4DpC?()fTS>)HRN0sCWA0ddr4%z@yG=4qvLf=3LTJb>(`1X@Gb7gfG5dry5=a^
z4~BaNd6;%V%~#K))FZi-Jfnb2)qv;7V0z{%X)Y_Eo<UrueXehRNdQu?1^fp2Lowg0
zm{-Ha(7)55;|c&GH0{6YPR(OdSWPs)>dtJ2;lPS?r=~H}Y5R2K#7tvIhIH`@?c8Y$
zVH_(D>rG>rOt=V&(>!K6!+v@JwI$rJ1qviTU*I<yHc+c*YS{E5faVlx*z{zeG&az1
zqGByIOuw|t)}h^jI%I2d;j>Jy63zw3rq>DPWV@)ARlMkCi&3@<;cP8Qsgup7Fc>!d
z@tj=OO=0}1F!@FU{|@KsO~RhxT!RTbizaicc$4&2^6CQi1M-}oO$}!mM=GqAThI&w
z)1>_VPD1E$gvjzz0lNq}1_j{y-<3#!8kzpQlmb%$=kMBt5V7f76nKP(v%srO2(*U;
z!_?|WaUUoapLII@9GtF|xWD^w^F|dQC1Cl|(n*^sM}lAe6*#AXo`!OpF%Wo0fhIgq
z*%@OjOVn}HD@$GrQZ>KmO(kwRkjYT^dtLxxUqccGuKAVlT*_zOEMY#(aHyP2vYi@L
z5S52-*i^Z-0?CI8*t{C%4ALl2FV0v9%vXTEpOFQu6qlrJDt9nkI$gj{RF1iDNvdYX
zCSaq==@wQs)#xxpFP_aHK3C@q+GK__T4kU!*^Oc^NfYKlM@-D`COOL!>#l?Qz~Fwm
zFEvJ0)^iZJu)&><`_A{io2r2o@ml`xr@))Se@T+YV+E#n=GRD4B^orCgJ5RZ&)7@#
zcYEV;#%ly#5sOT&;W8G<?-a0WG4mWeIh+IkV#ZmC#XI3_AAz|dN745(j$(!JrnK=|
zk3ev1(@le4R_0bD6US~SUuPbeIL)}N##dl^@;yu${I;4%ey;M$FcB5q#h}5T8?Gc9
zT!zcn!JOP<3S!(YIS|uInAmPEw}zCkgQm|#tE%CaoBN>aq71?ReAZ#Vj9wXU1f{}j
z7T+m#D}Zd!n!T-XbugLc*W%q;n+*nM$Osy<w;Of;4fr3cJ|>tsbOktWNhSQ1#C}X9
zp!u+vS*%F5{SZ<J%RbI$-y_M$Eb;GS_)x422{E2Ci(+Gov7C_n6D548n3`ZwDl@AX
z8Uv89$)-d8EN>U48Y3U48pRkSGaCa9MDR~#n??vnW#$ukkiTNc^Gu}~rh078wyRWB
zJ<1d*Z%0#)5v+>%iXA3i>EvdYK?V4Vy-w%_Af&*%JYc(LZc^Z1JnRSdD)1E#$AMQB
z_=$%Lz&YlP#Ubu9e$LEKKwVNujl@%#`I~1{tJG6#%A}Wn1*1CjKU73Ubr$~1ENvvn
zsJa0}yh?^=(tP>j)noc2H^5h-M7CXZj(Uh+PFt4eJr-w}{Dl&gkiS_ELgWFwm=d+!
zX<^mnu5=8mu73VM=ATz<?=%0<FWwHyuSs9=Ygxm~OQQ|14E^HWA)N%EKYYbeUb9kw
z@=XY^GgcM#ho41VZYp{rQFQ<udSCJ9cz7IWr@&GkM5$}QRgP6zGbj69vRmbshLz*2
z0VL^9sZx%!=+9ZBq#S+4cW2wFMM#Qr9G)zCOc`fo0#lhS1&hDpX~)!LQRNrySbm+W
z9nBIZ#|C`GKhbQjGOL_s<Dg1acP(J}qp-*wg}k?GmIsEL`48JH^oX}&FnqXDxu^{;
zZ-+lG-i~8souS32p_qA_v0UYb7r#gG(qQ3eH~T#=`W;0Z9pL3Q(N!7OhaRDs#yg8L
z6sryfw*=fD$}-VV9A_4htBxloI0y+ZNR-Aud;5{9c-5K2D59M5M4grfO|2)K!p1}}
z@{3o1BluC~muY%=JHLj@CAy%vx?nzl1@IMTkj@GLx+tPDeb;O`$>yoJs8d0j?#qvN
zCw@hE#jaI-%*tXF`KBF7zE7y?CKW}S%Do{}Rn@IZIj?R6m85c}#mB12^}XurPQRj(
zObnAzEu4?E6$37)<fmM&j!Y8Loq4<3(9Lt*)rKQ86penN;-Wb~oS^i|H^Vw{EV2{U
ziIuVR#PtIcU*0YxWi$z9NGHyE5!irE^c8yq{|l+2)(B>?N5NxjX6*!lE{Z9NPBa#k
zE01gxmow!ZsUPM$zL<we_a^W<Ix!|4ET(lNi-x|KT3}H@v#uE$T!fR_%V?1S`Rz2S
zF@>cQUkp{BbqfgoM-&Gr-%Ji!qW5N@e0?!X2$Tehs2+Qu!Qu%C=j69F51YJ6G+rgX
z22f2TSfTaBVD_GC3}h&9iHEj8YXv^%p$pI%%@^}Km{`a?HwgXnTwjHv2`vETu%hLQ
z#TcX)6uK0sO#mP2^Tl?^w$spK6t+A6A2`h8rDI}85RJBdZnpwY^Kc$GqbkW{$4(*i
z1@MUibGc<h<^H9>3Iav2zq3tAtUt^~JIyYS7qLBql8%}NzmZ>y(4*-(XL~!MY47Z6
z0oTh;L*0>3N-rX|SFM1%SwNVM_pmve1#XyP<z(yPt=So5<5ShHACX4e$;7V}k$-<t
zO58_tH0PL&lQp{)8THBf*|2bS=kOFFZMn(BFPUCuUvBhQ;Y{#hw)ko?jU+H!nKV&J
z+iWuNOQs{(KW9uaa>=oq4X<WPNafhgo&!9WQ`9b#i(hgbMFPgO3>U@7p1ln7@$$>|
zV3Hd@Fm0a(8^7q%{Ku4hn&%467N7SpYSIoGS5W>(RGP6<rgqm&IsB6GxH29NSME3&
zUkz980)cbV?y;{z>L$snTF%(z>Q=gA_Eq4rH_=M_#*pNfs-MKK8=Eg&^)InMvyG=E
z-u?)DuNG*cm3BvpjbBydb%xE@iL^iyt=Yc=cf%rZM@GXWyKkaJn2DB$%@qL=(>Rw1
zFkGxTKKY+gA?fjQY>i4ntC^*qX_+}pNzYIV^h*maz?88UJf_TvhYAZPrpI*XcTTZz
zKc}}anfN8sTgvoTI8%AjmGv?O=Ts+@o|6k1rzn2O^)|W2u}5HpV-7MqCnH=G0y3vn
zPNqzgiC;2l-Dli@a3-W`PUmnYgmO;boJ@;NrXYXFg)`@jTN}=Wz|I*S&V^9UnWS9u
zx6`vsE`G^`%jAr^NIH#^ISYZgxpHWPJ$;)=&M(QYk$k)zE@LanH~Xxh%Q_UuoV{9Q
zF@@|ix%eg5Cvvn*0jEgwTDSl+KaLwqjSgD4V`VPq{~NDr!ax$o%_iZ;z(-O-m+A1h
zWrV&4z9f6xdfcpVbB@yg&^T&}dPX{JL%6uVNH0~aAv`x4$e+VHYC<M{kxjkjKmH1t
zG=k?A1|C#^4w_pA2!!YH=@&_EmH8_Fvt*bM8P1@?kaNxaS2^h8xfv8=266f|DKdU7
zD?0xm<*Mlo;<=BLt}PBx`V9?YjrH_w*M?5$Bq=sdqk|RJ1k5ZNRl~Ob-$kR;Z-Q1H
zYV}k8AGp$Ff@VN+aOXY?NQUI#x&a1BDvMuc=|``NGD`HvnA_OOlwZ))q9B-Z`Rzz*
zJ8=pGV(UU+JixxaFSa=kvw&$~_7`FNk+%rBBJ%$m4LY#|nbg~JR{<-->_0$Ye-8W0
z8TRu_rkg6MJ(&#qPmu041;k8r)ZBA9GF8=N;+ITcg=K2)HTr+<<s6~H*v7t<ZCAtV
zfh&K~K*&#)s*U}Kgg*g4KA;%2=HG<=1X$Ab#iG3C<pc71O{*5K^7Ko2%h^?&_+PJO
z^WYI*5OW1<Ua%CQ#BkH9nMp9e>T)i3b|#hP0<8mGye7@7Na6}c?fwDr43cG#X1ywK
zkEr@UO#*RIJTSkS_XM@kaz-`gt>%{;`8S|VCryW>mNbI%Mv#spB*tx@$GXM5$?(jq
zS5zBsa?yRr`HL~`O&B><H8YxObBK({zYR7`GV5#%f_ZZRIXUWud06>*%W^U;HeBJ?
zipalRybb14Lgji9(BLz<m?F&Em6I#W<l>iHJCv(II1?_=ykp@^xMTCqXr555mgW0w
zi930~;WSf*R2*MzA5MOn0b*wu`&iZTMQYVz@^hhmlem35EklDS^bXHKS;N%JDp<cT
zz)n`lABRi6L}4F<OTIziGr4;v7a?p%eoo(!V@iQ=j_*lyE1ctZ0(Vu3R8|zVtS}{6
z1D6?zyR1;37+f{^%2TuqY_~9pnE<K6Q=U}fTu<4HJ>xpcQ^tfgOr{B}=(%eJIGZ_s
zacT=0R(|n|S(lJQDpyB-@q831OY-&c5Sx+2^b*n((+V^~J3pR0=z$WK?>pz#tzCHc
zDk7?%d(h3-iQUJC*6{soxKJoC6DCaE%&2*|5X3s6;^tQY%HmP(`-OxTHP#+3T?Ply
znff^5zCW7!U=XbNt$|0CvotyPqb24eDDyib2IONVccBegMu|IB8$r64`)4rg=t{s#
zYHo_>|5qe!c<8)XMNTcsbUQ;~h|NRGEj#%kJ*;738leZYYUhtp;oQkY2)BaDR1V;>
zI17iWVr)e?se7r^K;Rh#aDV2H21d%YOGO9Gp9V}(6kgH%l>ly%lZy73{}RC9byBl=
z_ymx}PerFJKm#l&Mj$Oe4-C@<trWnzETEtTeVKyo&Ca$<q66JuE5h%br7wdM;GMod
zxnMS`b-^r)eWkSFRCKlF%+ocTX$<!TESoIQ*~T=6`+@_&&O(-bcS5#Z!^~95Cis08
z#OCe>{acG{yJm*G{<5<ZqW(rF&Fn|Z%g$zl@3)TRr6CJ0v5ogzU+k)o6t}Q85M&L~
z{tfqG;Xz=R0`qu4kuJQV0GeUpSHKr4<p8DJktCG8oDiiuinVKD|Hit`LJaZ3-xWB`
zEiMlNI$Bs3yKesm&lWWU%F*97@42@FW=bIVu7?$*18c<#sRtJ6+=mu=AbqV4UivMb
z81yjXu~sh+{hEjFX+~bH;T~Fh9}=3L{Ul_y=6LAu!f11vtQNxgV(<@Ip?R)JZVmy~
zI^`yx#)hIn_lg#k+6z2%6%XCRP^o>;LpKW(dCjCoc6B@AG_7<P+BY;TYu^+)jJhk=
zR*d}*oH29Qa#0CUt#QAn=}R@`Oi%p=>)rw0p!<H0)Gn+Z5_IH34DIZmKbWTb@e~<8
zfIwk2Pg(Z8!v?S887k=yEKHq>5|nbq5~7~tbh<N>wITbDQk0;QFo5<S=#l430@11j
z5^n!dnb3S-kZ3#)jmw5c?S#A>8gyo`f@uG-(Xtjt0*(UMhQ+wri`huC|G)saF``$S
z>i=<GRTW`vgD$QHR4zg2-%!3Md&V!yFd=VQyuBHvMdQDuLB}n|&fE78!Nr{b28(?!
zj)%TLZ;wJ<{J?BmzgD#Q?7K4q_3ly_O1i;e3KIzg$0vyd+^Sp9^8L98ZrQ1gK((|}
zjUugU!QhW_(9a7E-|Ji>&0#7hy|2bdH`T#>z4(V{G0{puWLdoFPBoN%rpS<9XItG8
zL@I)%jXKDoiF!^^C`tRCi6REs`g0MPB>iT2I=613iHw=(GbW>qQcl&0u8U|$1ZR9g
zv_!C%89Q}Z>-w@U=>IBLP&xkSN>x<t$%-<>!dO%Jn(bUlGiClnsryW|sV0<Ez|6WH
zx<`c2wQhUp$31i}<J{J+g)Vy?lvadzebGjnO-KIAwMfY4pt0tzk#w}6NAE7CW6(m2
zu}b#cwLI(uHX(YyCsD~cRs;#BCPe*6u34=2+P|j}{{irx0u6ci3@}4zDkOf#L@mAr
zd@B+g4GEmDa?dB^y~2SmXI3v|J3s;k<l<iyI28`4PS0z=y@TS^-+zTi;D6lXQTFe5
zxGe;uyu>FC-nI0}K|Z?saPuzNcD*Dkuldy}t-K!<p{#QvGT0+FAx!MKFtKG2Dh?Ed
zSUqM45SunLvS_p`jP-VjwV~KqoZ#I_f}>^>Zb*pwR+gZxD!T#tcaQs)9Fdy1`<8FX
zVU4r9DD)*2fn-j3+`UP<56DnWF=+QCPXcWe_?d^v0A~*EyMOYq71&JRH*DOJBfx$L
z{8kvn#pkuScurA_^Cg!7&QRIEmFMAG;48FP(Ko0g9AO2zazfMwR<WOZo!L=Q#{3cy
z|BVWlmvt`sCEvRxur$WVTmA8_1U+YF`&#)mTPw&`{RLi3Hfy3<sg>B)UoND=V-YOX
zuO@WsSk9dPsz$Y-i!-ydJT;12l5ICYPY~ZbAxbaw%t2<HxJ|^PU6wXije1j~xP644
z1^O%336sl59N*MigHD>Wnlpk<-1{WJh%KF{Y*RUY6Zfg<StmZ=DmW*;D$$~@1C{Y8
zlcmV%(hDSwZ{b^Vh)#0ipY$y`Xde1V3WOQvTe1(<I`Q<y(qDm}aS`I@QpifmX7=F3
z2N@vCVAry|j3mAoL)=Sz2Cq2r#nV9ittx51wO9cXQHy1Ce|<8BVAyr|R8CZ~z+;=2
zH8y;2FdWoTC_Di(RVf&+N@`R$xZ|GUn=@35UQ*U?;?R3^K*MrIP!G+HEE`vQye|3`
zva@tx=+<n$zS)qIVrj2K_@)Tw_kCk>8M7SjHj1ccj3aVst{I->ib5^7!{;WEP^zc*
zV$<a<ye>B=MyrO)8P#3|AoHenN9bqOJy_$YN2QO7gQ*~EcxHaCj$AoYT%2dM=d$o_
z+!M&wct5PSMnO#l)nL^+SCir9=}zV9H)M76Yi0PI|0zQ=uHxqD`o?9!r}*h)H6h!4
z)F$O~AlsRXbUJB^i5dX(GtujaK1j5MCm79sXWAxJwPb6z`tt%*%jjRTH&Gq0Je_6G
zd9^?ru402~)MDgv+n8OWTMmnYXlxW-3Cnr7Ep;rY$pyds^E<d`&b%uW^>A1HJfojc
z`U&c1zJ5ab*`%Mnqxm_br?>TURX<<q=Lh}#&QIA${Uqq8q<$*sCs;$jjg6m+(_H=#
zMRMlONkdsIn+Z%eQ5v=M;rtp5fwX!IB${3`nybhD2AQZHK_RkO!ib}NHIu#edHXfU
zi(%oTMB#E{B%Jy92M!bHptWoTr7Y3pZ|^BYbD!E?{+i#Xa|-iUX=;UwwQL8lP2+}D
zFyG#f2ps|rDDZC{P5~#(ro&z~3>uy>YUHNhr#Zj^&4>18lHzUPf&wU`WuE{aKg#+w
z_xmY_RLISusao3D%fw>Y*T78$*7CqWU#5fH<!`FQ1A6%!%->X1GC+HDBymC5{cJTl
zJgM`gGN+^KVK`l{v>BE;J-6U7S6-Sp-OTa1Y6oEl!*GFYymwTw8kM@tHqZjRU{|)H
zaUspscTlQ!-79r-=;HjyVh?-n`-0P6;?`@Vo5z?MR%Zdl)bQ(2^a2c2b<ADb>kz44
z(JgkNFSpq0^<0r&SS(y@Yc-*Irq_h(o}ynEzJ90sU~!>3zLIVtU-%T+V)Ey?UUjUM
zszaiM9*|5lBs%O~_cb!FX<^nAu%w-)h2^sY@YV@U1{;Ze28-pc@JIj?=PcgH0Lj}2
z>`V<1e%S|3$itga&O(l-IeBN$BaE8m`6;R7E^|k9zJ-w$gMG8@40e;vuVvpzi1-u7
zWN|mLM2;Xi_Gftwb2fcyw%zCk!X1gZpJP*60d|GS%IY}3T+Epe@d?J|`2^Aw=;K<F
z0@wm`SiQhx*GF&)U<Z~r2b!RIc=IBt+i}r7`n4hwe63hxUGx$Q1czsYk;s$Q)0cMz
z&_!-OI|DHxMTVQLEh~GAJ_~0v$Z)p)Wb0>U-x=uLqnWfn10LxdIARn^TNGKU&yV1C
zS!kIGof9H%aFF@=l~~9Ev1An!SiEuyAkNDfyvrve<P~(tx<GNSk>xzgSD?CQ`3hi>
zmSf_U&rxAFUHd{gUGmp~i5LYaJe?46lY$mA`*8B(<1J^9FJC6wPeVKZQ!efN{XN?G
zM|rgKXOeCsz!x*^MhN0xD44~0LRFuSER-+HHFJy0gdTf7vT&Y*rsP4-N0v)rbB|NZ
zWGR`cBgSMIPy2JeThRNuBrt<viq$*uJm;aSaMZjc=9CJJ49FC(tgOo6TRByVQT#4I
zD`i#6@^B0|gq5#SjU-1P{*z*AgGDnfe_N_+#l>v9Nrbdcg*W^@J|^fa(_YVtk4f+u
z@Gnt+gHBt4T3P-}kROQnR{UaFD<S{~8Y{nmhH-!@{G7+^MK9F?*-HF}6$wDBX#7mB
zmA?~0Bd=h6%omE}VG}S*0n)9k4+In_$-_l}{Vrdqf@Ose_fV1o!5Tc>20mmJDa6?>
z$*X0hl*%&#pK9qWiVgMQ7K@?4vlL4N7=;kktV{(a@~|2RDexQ*`vL7(hL-Yh4p4JL
z>v%xZX6YPE2qm6{1Df?!kagA2SyL<<O%%?-mOPI$G?y}m^o6ck)(Z~<$yg0vh}&?Q
zv?E11qDP3#5u(z8Drlu9-7LM$qo>P=$9X+`qX&7Lz7V3CQiXgQl&=YS9s!zI`4ERk
zFjAYkguY%9nG#&tm~d6Yf;M^V7`k`a3t~Nk@`cBNwhFL}^uja1(_#oJ#J5tR(ZFy8
zM)5EoU}49%k`8`h1F%j3VRr*8*!ot6cz7K+p#c5%0=6vpf=<t@+)Ieget}mAeJfw3
z5PZI6bCL+0dXHV@eP2<@>zZMu49{~rpG5i*oF~1uHqg$1K_HqGAvGSBF&76~%hek7
zo3YFo0^?@1WOJ}_vV}_I7q<I-vtn3jTTY)lEl*h1su+MtxzqA39*P2m1G?(Qq(>*Y
zxf(RWPCAdGQ&yD$be!<fr27LX<5j7E&SG;dinR)<TveB`|7b1OduUwEHH6Ct*mh{q
zGTt(5+|;Zd?^(v3A}cAVgN9SeWWR4N!)Zl3x<GQisuj?j;iARQ#*<B&xq0klglG8=
zq}d-$d=H?T0<>_|v%moL*<6^cRnS%A0QeCm^1dOmB9C1TA}h3E7&KIn>QyttR7^lr
zR)nc6BYKG?t~X|JE0^oha9y6@0mfbv6h(6qyhcS(KP!ewbF?PoW?+M~{R;Y{*)H`5
zzm}Ec_bt)2xGP?v;1%i*w9l#|6w>U}{e>)W3-Jx&oiFpwj?sRnEOU|Q3Y{-h6`I^I
z=xY`?HdFd9G73@I<j`rEXL3^{V(_XALkkv=+Dz4{9=octCNk(ugxp)bTq8VVj0Op>
z&ADNBNQN5$Yc>X?Ggs~wn>NBGeUfq&BXQO1WJ#oZL;n`dcC5?eAFnhEjZtnngWdCf
zD;Jw82FG|joZe3SZFXIfp_tq^_Z>2-d~SY$<Z!tVDSHDbAScw9xAoc%H`u(wmJI1-
zy%dhKIc=Ftthxn!jy`WY8!SFoi21eCb`D>NN&@6E2HT><RzC@_1LU;bkZm_-u(-cg
zM9F5zNvH-g-xdK|{WQ>5)ok8DBCTqgZ3y$)HR!~d9$NhFL+2ZrNxbO2aq4T^khPnE
zzKnVl!RsOWI0YC?ykTVW)4+e!Af0hZ`IHIsKBSh5My%CC#m9T@2nxMQk%l(QFVtdy
z<!gq&7rK(eFr0H!KRmd7W|?P{D#1sPl3I}NCyS08>I9A;gRA7IRMV^3xMqX+8b{zb
zCM8c5cg(J$=d^v2RWsBx6j>y4RWCDQr-axn85!7UKTm%Tdo{oetuNmpD;x;w@7^wf
z{&qUAP|gWFs=Gh3E=Bk0*PDwV*fGtzL<ddl9B7}9Vs$Cip@aZt0Gq{gT>U^-K4zJ9
zjirFBGu1dEu_4d_y~14>enKOj4D`W_>1K>LRA_<L{Kgfapu)`qrBu+W=FtPKz{7?#
zBwmPwW|gx62DvWX5~hfYshEqY;9~UE3NMX5J4voo<jcdfbunqVm|l6A$B-yJ7d6sN
z#4=7e+e{ZzJr|=!lB-58W}Ay)6(OAK6&F)07jx0Y)Xv3x1||rhI=QH9H&NXj%qqvl
z)XT*bbTRdFF%P?#2DzA8E=Kni(R%mBx<E5GUScz&PyFYRT-H?rgJ%sViL>fIWi74{
zivPSY?=Y4_REb$V0bGTO@t>C>)nUR+saA);Z4JbKUWuvhDZ&`M)rSW49X;NP|03S9
zp4w|<&SHPhSv?!NZ%Ldr%M5=e)?5sxo5Dt8@9h(z_*EE=tMTWlPgSW>Q=Qeb-RhhV
zR|k)5^(D7D=fl<cA8<dp)j97~XU&87{Bdq|-ny?kRqwdfS^ez)w>mf$R%!(GIT6~Y
z>LkRkipjRBWWv6R;?CN<l}!s*1@uf2)qzSB{piQ>tI}MKt?3D_lUv1A4P1_`nG0@O
zqQ&KL@%m(rxVYvJurqn+m?2jDTH#g_z5(zWiuKU;_;vZL+U7c`HQ$5$cF;I0em#n7
zZ8VHc9zA5Z6~95bKC`T~44t(x5mfZ9s%|-Jx`i@Vb4_K{a_)d%GlSORSC6qu2Ur1e
z4_oJn3XZ{ok*#Vy$d(|R4n9Ji6jC{gY3&ivZjc)z)5EEXOcUM9%Xl>>I-GGaHR07P
zhjag4&H?TjZq$G>g|Y5k?KI%2y=W?0LmW2Vs`8kwv^xAne0@5g2$%@-0g{a|J>f(B
zM9W@R%YL?}=?uPkKxc5P<Y+6tp~u{{$i~{>L&?3Z_>3@@(2Z-WaYt)>MzqJb31EgL
z_XR@*3@5SJYY!&(1LM}lT8B<t`&;tUU=S&#SqGhUHIn;-QALGeB&~Zo`57?9Jq-Q3
zZci|I0H~54>K9PAk~^eY@r}G1t*>BN>&qo~NCSo2CQ|G1c-OO8XU$w1-wa=V<3q9x
zlWU>1H<pGG7!PD|T>Ky`#JXLWu#ITU^(%m7O7gQwf-Se7i?0)nU$|}}X}D?LTE7M0
z*rfBKj|c4DdYv~4=g8xcj*72SJe=V)X-<YSyi4GsvDX_LkQQT08B5~_RkED*9D{T=
zK1Kr7|9ZF@b1=iC*&JUznl$+4ZZ&X_*WV6PWg@ixu3pYJ73c0NG8~AnUd&6pA-`p9
zi1HF|C`17BA^Kgit)ge-N!usmGnrhk|AIst2a$kj$A)CD3PpowbdinyZoIC_TR%Na
zwFYVQ**S4y1N`2QVTi&zh|)Fozv8PxV*P<|hQ~>R|LSJwL7-c>&SXHA?62diRtP6%
zmbHO>FeMIJ8zvD#%2cD*4SfX7{y9D~(Q-B<l4|3BNH8CmtH7r`tOl68I2$kVuoKvB
za*xfniVc=iVgDUJEtcFLD$Q)-Uj>eNO(qEqa0<q!aM{L&;3(3l^EbQ=uyW?M;2MFe
z;U<#<HaLO!6nM0O6KQUSZ%FfXIKv$RKZl!42AJxk#ixWNWg{K2(eV;*^b??w>eS#;
zQ)xKlG>V_5<QtC=%h23t+P<5IRG^AtHu2C1XlPj)df$P1$WsK>d5%fp`prG@wH_eu
zGo^13i>0XrErtzoOB=+e=frhUTzaXt;mD?+$7_AS%{W$(mC><o#tzHlxy8bZTdKJ7
zIdKC=#3$#(y&k%;A+mIAzF*@Lb8tV0;x|SHVh+R?3!`2v63W=f&E})yPGHC?V|r|3
z$Tr=?B2+pPcfvDd8_{kXA2U`W?u1%_#@ILwkgeSsh&xfqwW}KufsLDtA&WaDLpG5`
zD~ImhbQAK}Q#51GxDRkMH=Tnm`UKO)E0)!N<2!^l{YmH#fW2pD(@&PA%W7YIfVxKX
zB*$hn+KXvG1qG<YiyeUu3Q+os{eWIf`8Mmt4E=55Te8i;D(F1~nVC(+Lk(W!BQ)1s
zBeAJ5N*yaR8Y?3kVk||TsD`6lD^vM4B%UT$w_M#nhMGVRPgs8Grb#(5o|UPm=qgEG
z#uYiy?z*T|rJpK-n%lHD9A&P|!HQQItxRF8SxA)=ZRynseU(1!<m(U-<}ArvHGXnm
z+|n3a&&};(Wm)2u2J{>y^B%VpMolTlbA^g=OB<-e^2(gYEzgI}u?|Pej>nlVRmm@W
zXnP#z*MuKu#f322o1YA2ZsN+kr;SWElyQ51aa?VTTOpib`=-2$Z5=UgakUY@(~CXh
z7FQeNwz-`#ZgF)DMS3L@7>jL-GZ&5`IWMBnU)+gpi>t?IlPtaX0dN7^7FUnaXfSud
z1hX-2arHF9NVF*c6vnv4)k72vrZbp!7`M23s;JTgfpHkOxO&As%vLb#ux)YmN_rRy
z+jLg8Ev~*-$4!5Mx+mKfS04=|N|Mds=DZbU+~OKz+_v?XahrOSuHVMZriF}gvku1f
z#kg&e$ZnfVE^4;<0Vb-4ZkQw(H|veK8fdF6Z!pI`bdTsHpriuXJV1YQ1#DY51Gddj
zj)<#K)W?2-$x)L;)x$ZO5NKqS^tRa~rcnO97uOdZx|M6#oNZYoK$&cA9j?Y?&6lmu
z;!>%`R;_s%qEC^eQ<&(}1p1-|-D*s>ux-|NalurMZMdmv?dGB3)M_Y8a^l3MY^yM9
z-X#AuZal{AC7G6O2T3p+nB`T0B<O8BPh3S+;q5Tdr6gG#Cc2Km8fcm-kO93NwEb}v
z**(~LFPvjLiCzllI7Hw;xYFdH$LxpVDwYW+K1KYAaN>&u-ZFLG&cGryqGy+n8;>XX
z5~pXK?I@AW9|2bsK-4yWiAmgiL!qLCz6WlZCZ8lb=kmy2J#GTVZJTVxw)crgW;g#D
zZb1vv<fd_DY4S@t=PIsmfel-1uTI=eZf%LlX>to=|J%itrNu9OuQWmBC<d5rKwP#k
zdbcF!G`WRoa<{m$;U;fMB_0E1WNS-(0(FgX+xCg6vzk00ZUWStZGRKl0^rp)XWM^y
zcmm*TuCwhH4?Tcxv|mGyMT>3yHNL7ev@mYlI%2?HnG~lNS**j#FdI7*SIr$=iW?nQ
zB`0o^;;Q7tP1zS$At&yn;wqF785zYXJLAga#C@W;kbhg`gU<H+p>o?ID>~b2g*t9y
zIlXA?({_8yYW`7d56RtOI!L>kE4#(^aP`6yT&~kQ_9+v|2qDfg^P%lmuvQO6$37Kr
zvRPY((8^~5=KU0_5Z)Sz`L!ZqyH*KU+EP*2$-%lWCj@7N5iB}sH)RWwzGW8qtcI3#
zp+M{tktpTuKT_<-sj*M^O<BY==os5hF+1|PG40$KdaO{d*fx<m8}3H5aU+JYsC+55
zC3g9NJJ2v6mfO*>ES&<`mTnqr%Sy^#%x%yGlOeEKv*h&?Vw)+`Q8Lw&qTVr&W|OB`
zI1i(9%O3JPkZtl%w~0$)o0z(7cB|0DO^VvjyFa$BP0}?`D<Nt-gZm*@u6=CXFgYZD
z%f&=iOxnhV_34(c!2LV<>7o6s*an`C-6Hw@ffX*U4ii22YN$rU)@QkJXA_U(;IN`z
zO!##WFKiedgbZH7mfxt6`ffj|Hydi3!9>M2<Q$uM_hc&?WNU=iy(AG?CCPpFL}9VY
z#pV`f!d~xgrI}l0lq_AfU3f%nu(|}Rq1q8^8mP~(B85vqZ#^4Z*@&G4^isjtB<WEE
zbm!gJA)~C=q{1dh+_bB)Ed80dT@S+Z8pUFZxx!0ttX~=Xpw^UjRUxLqnb-$4Dpp#3
ziOGtM5At%PHEu{MP6tW2x4!Q{E7h*e05x~)@9IahE4N71ZM)hEWa()aFDl-T(wF+~
zOQDH-zIRh?c4bNXCEZo&3?ZuH@8MC;W2lp@;ic4uwmuU4=~zMwJEi7coIC5CR69R|
zxlJOUJ4v-GsM{OrHtJ_ir~Zk`b9NV`IZr+wO5Mc@UZ>PQ5hM5V`m<e9e^%MMA2(O%
zr~X`CZ6PuAf5wrq4)grR;?$o}XjcEcSmbM|cM4fnt6!`(7>V+!<`Vvf+18IuQE<_c
z(!CYT_dHTBlZ+0qww4BpQDW4_)XV6aV8R9vj{+G;?$UQsuNGD&!q~N~!-e}W^;#IW
z72F2wgKo2S??w+EB}uWjQ@<>Lu9;2r3E(wwg`Z5l>9*Y3dI8+IWPLOt^{X)MGPn<e
z4B~Syq~4})_9W3BI^!cgcsk?<*_XXlXb3~pvWg_9vJUI)SqAg=4kqL0z^4lI;^8~s
z8wEP>fCAt8ivley>m{;o{Y!y*1gPLkS}6LF-J9HH?a-UMBV+6S$m*>Y$M^8THrDDh
zG(>*PbQj0>=rExZ^)Fmw`8~m-Ci1rBG`T{C??Z8WA`^qz(H5W7q@?^NaXT;Z6PYaA
zTiJNR8L<?dUC(kpDX$b}MO}+7T19R33&PQ9Lh3p7{oV=mF+4w4hUW^d9Gq*AD+gLq
z3(LWII@9VOJ9tcRsFkWUG^@YH=7jfC4|+p$@2%Kj!>!bVWnt<~7+i8u>M`h78qM>2
z-=@A|dV}Zo%~P4;P$16;*eT&xM(ay3si(~|c!cnEJs;MBBt3P~?I~HTVB_JbV@;8?
zVBa1}AhA9XVjVW+^N|k9kL}y9kCi$OwEq-ID2LNoltTk3XIxo5gQs5Os_HpfS|xRY
zDU%|*l}^=#o=wLdr=)==YDJ_@#-rFb3!l!}{8MQ6UM`96s=A%OmbxiMWh=0GU+NaW
z0s#7=!<`g+vMTwP8PO^B%&@-L_leO4DK=ZWp1#=k!#`23zQ{=-eX(Fq3R5Ns?$`2=
zQ|V0Tv3-#bKiMh89%kxom9eaz+f(c!(Ujj%=}wrBJ%Pa^F`q2!SA+lq*4(;Xy>g0O
z%;co#xX}bme-o&eC-fGigBMcl4E!+DpiW$kJt^fErX#l@z&TAu{K4Ior3q7hsV4de
zeG*U*<}U1%@{1G)oOr1x@I*!CrT0?)i(l2MHFHG<ZI#9;zw)Qm4@9p7mU?47_?8j<
z>l6|!{I%sA_@Wdg*agJphNRmGywqJ~XInoE0BIHeEyeb8Am2IoC2_9<cz({ot2}%T
z@Is1n@GTyG2Yyumy|In4u&n?(zVL61_JdSn+rt31!#PO0ZH$6#^@4;B!H#V$f#wPz
zPun^IkK=Ie!FBoJjNJSp{*=!+%6fo0`1U+R^dMlM0!YKQ@xWL{<PYb)x5J!Ft#La+
zs?ON|f#ntHg9BwWSSRbGhxNl8^G;4hp4PY%-ve!Phw>CNAtj}9<4#C992gyX;pNB@
z`SE~^ayYOtbn<2VwjWDa=mX+)Xoxwn3fA6Lc&YWrTKB7oXB4NeK2c}>v4_9v+idH5
zov+a^ot*NgIMjf)t&XK#&jH#%T@4quEd!PiSoJFp>w&fTdy%ii{W{Q{^6NXKs{L(R
zw`(;7b)v|7X-;tyiDJgDdshyc6M|9N0(a#?`MyU5YB}KG%FyWp<~<(g&?Ys_TvUL@
zV>gY_J0Rtqu%b9r*{HXacan3|Tgp4qVy>A>d4~!a^~Pr_-f5y|#&gwoQ{JPLLzQ_h
z_I3(4Vq$lAF8pN52O2jG&9^#IK6qBHN<&wEt)I*{w1O9nwq1&fEO;elqo*PdZIX&g
z*~nGdLvBV(MWt*(&3Gy@Wvd}d0S(?x*&Z&Kak4W};{^PnBcam=xq7Wd$_`H<w&AM#
zH7VoGh|ji`o}nVy8ktAZ$|`xv_)=gPUfXs7diw|sFy6GA@OeO=IHHINHQk}O?PqY`
zQC`Zilu1T6V1Y{j1y9k2I(JfZJ8KZ_LXu9qQl?OQ41u-1G0?#Ho+;+LMTZG@20FN0
z30v@NxuQ6a%h>uizc>deOL0XHGgCJX<o0LDH6S2Q&m{19$s%%YiQ-6S2a72?G!UZL
z91qeBdmiNWF_4iQNL-e(>7g4Y4u6W6Y2Ao36KC|&fVHfaVo0(qLo*tZ=qR&~kCH0i
zGKS{5>oBv322a$ounZQ+);iI$ZI+Ig^gJB-V3)J$9Ihqd)M)9$^xH)wWq2A#y3=cw
zTcm%Vqvwwd`v=CgZ{c`(ZtbGd+1w}VE0T;ep?43<b4$N$I)nYr^w0EUoV+dz(~TWJ
za@PoV`nmEs!kvCDja061r=QF9;nFV@vaA-z<ipKvn7+fvWwvz->34m&WA7RtE`0~d
zq`kM#0j35KlBkX8`UGpj1`w|R`;dU8@1*a-lplMSFs{+|8^V2<zQ@Cf$d34bNI+%;
zNs7Ile%Op9qALRx!4-Zo-SrR%W9xR*G(KGVtERC*5ZHqqjd?itLi%Yqd-P40kGpex
zxMP=S$Tq5N6@E9JbED3&+Q`%^sI480!X0fCh~NQn-O-Q0vAaBs0CYU=*liwAsXMeA
za_j~Vvw>N3^Q~Q6j>kKXCw4~`s(Y)OtE`W;F%pp>DY?b&q%_qrvtbyu&y$i&y^mqt
zy6x)YW2-`kk77}8N4Wa>*dBdjZ<He;yv=;q_-wbU-mi>v_PtshLo7;dNoVhkCOm{#
zz~i-LDDhpl-`D2)Z0T#8!vL?}*QpcbvkkS<*GUod56Wjtos-_)bUf5PkU~mtANJYW
zH&1`kbRNuoV{v*Xao_dL(mR`H@Ff?eKPAz0{krrnriZ{U?3CVJ&xa+XJ;K-#tJ8ZJ
z?L>;27h9zFB&*e*4t(Vx7=}hiw*xg0-g-HGgwpm`VC2;FDemmdEW9rICY_hOEaz3d
zy1TGbsPrpXxAW=E<h?cIzcqbH+GUfVs~Ll7*TZA*)jFo2G##&S=Vq_A{s+b#gW-6M
z!6G}-u$L4TQbW(AA#lvgT)J-<x)4~{DVTO9+~Bl#O@o!W;{LS5Ci4~3J86f@=Zwm<
z!?~j}?Qrg>Ogl<XwRl#ea^|mTFL<N!yNcmad3?7Sm1!@iLk}aES-|45jE1O<X)k!A
za>pr<hZ8j_(^k`o$9EIX2EG>V!?d*?ZYSz|r#?!OJG06xLXu){r)lD%nbl7Gxt(d?
z3O|{)-EEk)vmv<pW>ltOeZ=*kwewMsErJ@AY5VBZ*EYGFWe3}vSsi~l+xl(|$*sc2
z(q3d#9xucQJN_g2o&=sy;NLv-0(vO$5f6g^{3qx5+dPZ~Mk{cVhiO2NQTg2lJOJAp
zmEUn{MK09w3b~{5JEmD0mB*VK-1_jSETU2Q-DP(a9v|*bslL18j?&``P2!v>RfdM=
zttiVKp0`-;`TtC*T0BdqpKPDTfh~%=hs40_1q{#QyIlcTkUKon7Bq(w?(j@osNVFZ
zRA~#%_|))xcWN5no)dqa6TfJ9rq#+Fo@w<=FT&+F7N?n29(Q=AnQd+DE0kQ6mLaKi
zhi97EN!G!eg`Luxs@o1n_Z!mNN_)gSgWp{~E!dn4v9}1+yqMOCXXE`0n32{xjIZ!v
zTAMJwMOxZpY*(E4CA!}zDmT~=az$V^B5*>-S1PwiV_8ZfV8-?Sv~gx!6H{kUn(<cT
zU)7nAHbM9xDjClj$#zcq7+zMD2d!E->z%TCdW<-kC`M%UG>(%-`>R*7%yP|1HTjaA
zRlG2T4&}Mw>sclJI9)e*o*T?c3^((@=B!eBZWuj$*eENj9Fp$u(Zd}C!Mvr6Czn;#
zq#);-Em_qW^9dVx9`RaM9d}%`=CgTaV<O_|=aUCCL922$CgLG_5sym~v?|dtzI&2_
zQxRsy7ZZ`sC=0l9@(YqzZV?laKSv9lyc0$-&yZ$vr+hg{L~&-77~d^Jv67j}5h^cj
z65o5|GZq2HDc=g}!eQfDF}|;GsjlJQTKD7uo?d6ZiVT`*p(bZLmjd%DxH-Q<Z<5p6
zc~AptAD++Yb>zm#TGoRP#rXb{hY@%B7?B?W=M~t+!(YI!4=4#E`ShEXwF|M`Rh&1G
zoYR-sz;I6AAdF($#pxyI^!GgArR{2~0Mn{nLxE=*fY(}BzDNE8qkd#uI*p^uF5b0%
zmbnz`G+Tq=gMh}uUSkvUhi#DH)K@s7smAfO*DT+yQ$#cm4LilBEBbSGQE1M4n)JPL
z)9W2&>)H)3VnS|2Yx!~?bE4<gsa#~Ltn+BAk>$KDn*5_PDwm4!aS{()VXre@O%iJn
zns;M}DyM|~>C{eN$M}w$;X<H#*%;pmBUc38dnLwqUIBge>b+B;^wW{$gDqlw8w}Y^
z9$8-2bIDfgNEDjdY8XFo<On)^1J$rJ)J13`GH)GL;1q$<UO?q-R36!#Bh6!co8py6
zlc&SyDRs}j7~f{rLXwk7gbA>M?u;d~gXC!b%Q3zukfRTgi-?($qx09x$p(UEh)QI3
zJqJuJ>QZ{rPy(?J*hYy9Vq<(AsaW7gcA+Ck^?KJBpX(!#;xphwkngvO@pUyEqWs+;
zcE=%l1vgRL2}0Fo#rS#@WL%*Rcee!^gRFTm#@91OZ2>VGm;tg7#q}||1;i#GRI1+q
z7&R!2y94fasZo8w4fSxEqVIXI)Tp80hDBq=G=tfb0W_cii#Epif)rC#uP{);2b7Rm
zLVO?r_1V)BWZ*=MZ@KES5(EZn&uCSj&rrNsxD?;XjPcD7(?vD}tSF`R$Qa*T6q9Pd
z=S5%xG(RqvZCx(Uz7~I45EoAx^!phuv2{MKO`_evPUQ142T!lg4^4Z6$=`dv{8LEF
z?&yUI#Prgx*n@dve2c)m$+bDog_h*H2xz0|LOl*>RtL&z*yd#*Ug$_@0x(7a7P$8=
z0p=$W7_OfwLeB%W7ue3O{)Lcl$*BloH-iacllNXwXg?2Efy<1n%L6Ru?SEO$S&d!w
zyvDWr-Jz)48hTf*Th3ecND%l(0vXt=nC~NeGQ+yM-11#~pEP=PN@co47=>^5bfU_M
z%vG`N?OCMhtI@hd@8Vfk&%5UP?8eakGm+JU*EKOCi8k>i_w6c*&}dv7(z0OEU?rJ8
zVnMI*R8oE7dE&xBym~)yngz0q;AYcm$yAg1ql(n@b#qGKay@2_kxC{*tIlAH@^TUj
zV^*->JBUmf%Q^S5Islp9`wQ^70v}k`zSckny;1NTaq$+RX@Ft-T^?2dONe=ky$XHz
zaNkz?;4SVPIHf+&S5Ei63LI-ffEA)E6%mFEy8cVWRw5?lO@7YM)+_MawDn47x2<oU
z_1cO^U7^RSJsOI8GqQ00%N5<;JLd~keKWF1*9A}_@41q+FSj$r>dWuDU39LIiTeL_
z(dFxI51o5b+;My8O0?TU=R%=PZ${RNyaJ<`JAd&e@;oowx@1nN6#O>E*ALI)+zmLj
zgMqV8+<K3OT*@+=W|V)a9V77z(%dnuM@fMjPFFkvK32F)(`)pXVm7#`&zHV0^*%3k
zJvTM)G7nVuDmmta^*-l34xo7hRX7@Kh`X~p+GJMl6oZ(Vn3+l)wL>v<q+)J*bg~qK
zei1I)!|f7|bQ;x&+m#320wE?F)TIoqY=xrEb7%&ASBJ4}mU1st$j3g;A7Ie)tfpAj
z>dG;`dPap3kZ!DR0tkTodiTS@nf0_L+_6WD&%tb+zs}EvlMs@Ub^^i>kiv7Y1D}p9
z;Hs%SAgzXx)LXhQKRe^+uT#dh>M_28iu#N|>nCG;X6;yku2_fS`4Q;v2sF)(@g?QA
z?9V$A81Y(+uat3~2oxsI|0C->;G-(Kzkly8Y_huv(gZ?H0s$6CfKa7nK@da~kQf93
z0qI4m0RdSMD^0KvP!v>D>@*_?Dkx356s0#Q0YQW9uVQ(>zqxlqd|p1xX6DS9GiT16
zIn(Ec3~h1MVQ9SPNR+D`Er7$7=SWHcR}n(>Z?NSNudrpf@|=ls_1x}w&&8-1$lH@w
zC~watleY#|WbXM{790C}J2YbAJ=;z0`PT5i0MAxmw=-PRVT0WcPec}f#d+Kbph(HH
zoyCe1So@VwUFmiD2G0(|2>^Iq8FIxRlO(${txiSk#ff}t1oyJdFB!#q4pgCe{lr4)
z$3KwdPTU<;E$_NH27~o3u=!_q3hP?yx>tz5AJ^Nc(TH-End<B`riZ0cRBJ>%%S?54
zR+A<LJiE|DCwnQ`2)Yh5>cJf>BXx-P@X1D|c$9qS<H%D2TTelfpCs@!5?^19tTm=k
zdDlByF%+Ji5sa0Ic8!epyl2#sP22%sn@#eaM~6CT-YYK|*~1|E6__7FN}c4&F}TPm
zpnIwJ6{f;~JcgU1`lw6wEOe<pe3~?iRUf-{A$gS0vygQ|RmaM=aj(18v9N(#9XkMS
z2H3F+nAET8cqMjq<@xLZOdH}oi_1{Nou1zFW3wL^IRL=x6*<dbd*&x1zDd|7Ehg_8
zua<e^{t1#aBA-Mhn)qiGZ_YlOvuEZ>DQi+EH+DtN>79HnU{YVpv*+S}G0DfW23ppx
z1M!|aqAhy&%;JW(JGekQ@*Emkd2YPtZUj@qM_})zcuzOUP743AC*IRNs_=~8JUz^)
zix>t<o}LUfj74ZTC*G4YZkMlGWKq25X=1Sop3#N~GmzbrfG`8`bmwlECT78bW5*&2
zXJ%&j%Xl>2Q>TExEe?Nml3o791<w>y5AH<8!&Ahfr22d1$$0y^TYnRK?1Q7?s=z&S
zYN?QV;)X(6)~aGSA650*9RNd4Rjp#Kx2j&!i2nV+{9F8<1keZ9^G8VD+AH4v*OVfX
zoil2;uS!XVKdUBFa}P6WSIz7howIZ|!+)j-j_93zj%<1YzFUJxF*hYV@%Ghd+4h_@
zWwWoU0OyJuov^RciS9Y;h}*tq3hEd{`)8B8TWb57Tk4ynLbo%(?-XzE7v%`M;S&?_
ztWeSSb#sco-{b+uvvE(jMc=PZ8!cV+KJKkr4g>q|6axVE;I`9Lkhp!&H7~0!0lWy1
z`nSJvN8PI!-LCoxAbMbb8!?Ii<X_z1g3gJz54*tCahA0@))|P}Crp6=gm6{%!Th#G
z@%DMxU)t8Pg8eMd-b18ETkL~wX;*gy)l8x$a->rI-rgV3a+@pS(W?NFiK8vgfj20+
znZP+$q{f*xG;ta+U5PQL`mt}+-o%BL=j)olTB@}asxs5?uv`;aVE?F{GHL2&qKcgR
zYrH);T9IE@bt-Z&$Nfh}&QUBW*5DeFE&*DRJ-DF)RO`^Jc-vX5aO-%q5iJ3Ul&^X-
zB_hx$CEgwvZBjd5inp^RtlXehP2%mzJo)f-RnYdViMOXj1LH@<+s|<TmLWea?Q1n)
z$!@eGJ1NfCsX2G<^Cd>c#M`9}^Z8cxK^b|e%Km&uRX9&%TFL7Bkaag#RZ6?6vifm=
zj{sDmO5dVF0r(L27F8uxNpMwV^#Ooi15~*xxT>=H6u=V^pwg9!QLVTFG*3WOrIHI=
z!x(n8^k?kUc)PMnPflwXcdV%lFef(Nu0jW>so<I>I9|b!rLhyEm~;|rI%GKoB(Z0I
z6EGx?glfFhFN3j$>BX9-G-^KlPrfywmo`y@cgNceILx?z4x_&#aJ`0ZW6kpl(9+g0
zw_EcnS~H=qGmhFnMOrh-44Nh|ls&@gu=Bdno7|*b!#4^iY#{T*c)Kp!OZyMdm9A;c
z^6Z*b5aL>dcMW>6<^t{{FY2wSfxb=Hh=&aohl~JpovT;nRNBuyp8@fgOub2uu_(y<
z63c<xj~6p-_fmT`T_ysE{CgvD{0RDr5vlxh;;$ONS!jy?$;hgg)9#9D-S@7S<D(~P
z9;yf9<`mh1H_&9r94sG^jb}%%8ZNPl5%@Q*yg#}HSQFTN2m^L_KKyfUYM3RW13JgQ
z>uTFWBcL!u+IHwEh{FH7Oe@r<esmkIO`0jkyT%3*?u+Y5K9uKul_#Q%vAZ8l2FUDP
z=PoqA{b&~MNnmjKp{qY1y#j2p!{n+clkWjr4vY!=N71xj0Q(Hsx?AEuj>5hH#&_MV
zhnA{NEzd!7hxDO{F&Pi-aw`AelWr{uQG;#F(ZQEwBqkWVY`Sa%<IuM@g=KECYr3#6
z1#?VLc0(7&8)F4&8G)O$th?zMb(6M}P6aEIe+3-x0Pl5Rhe`?NX5!k$Lp20*Ga2pT
zH5bffaEc3KrdyE7Q!b2|Z9yK)h?Vc5$OHi&iqVKJdzo9$7)`U$y{mit(@~3fXosVn
zPghj!qIuNd>_Qqj$5aw<n(SOh=-oL6x<5XX5$dEVD2X|?d3e5~B$<^RC5h<Z^hbGA
z7WA?VJ&a;$TuERkM0d9Wb1~7mm4KlT_qqy^+aB1hg3XE7IZ$bGZhxFK3_c!kl_YmA
zu&1;sIle*sw0vuFr&MP)Q}k5C3}^>{e{e?plxSXWf&T`UW)jR<SdnjMnl0$~A@PKB
z`M(;slCh)qoF{WI$o#Tv5<do`@NELd<=su7e1_Y=d`NrFpfLvLmrA~|=NtjRp0f)s
z*mHKm?w)h*SCH98I;qU0-<=KRZ`0HuwPFL1GexF4zwIFXWl~U3`IC#QPT{GSVyIVP
zCxXp%^xM(49Wn1~QTdZQXir*5v13W@h($*=^dhn~iIq?Dt1|X2O4?17QD3;pJ&4;6
zfl2IrI3LqWH_5aHHF=&9%{*8y7e5sve7KnGE`}xdH11>|KVnT@Y_SAoG7gLHSblXc
zy)}sLl9Y<Q)+ym(8o)5Sl@Of~z@&|2n+0XPDP!w93DzXFW|aGIH-XGR!o@xAwEe?_
zl^w#Er2O4xba;}mo2ns9HmyiFu}fW1%IeK)8Q;mZdgB>$TBeUZ{0|C^PIgLi_3s)5
zyTst}otgO-XzGE&@mi=ptjlLwe)t$w{kRy*4-fGQvkv;U!pnfgbTy8Rt<BZxtoSx2
zH%UylKggs_qB4<xPCU;bNa4Y(+9<xc!DRMz<ThfN&o?h)V&S@IulR;ht~bMVqHOh%
z7vUPThGm#mso8v-jH?JE<4>zPay~nJV?~fGVk7ZYqs$yFN*04J#aCs_Z4JUd`GNSV
zWnDistA<=A2d|5-+5ot72rfQFtueQt<rxhdt!*4yD(C8r*>7W6pUrIK`IeF#O^h(U
z>9wbk=LC7sClGggl}2WEeY7ou1T9AtJrx`@cAVA7v)93C0r*@acOD6i{u;&+PB8-@
z<^vCGX|&1|gvb|2^K_)qDnw;Amm94y_M$}G16HG4mP;eI?lVJ_IRhGTM1uqu8H63x
z_Hx}VjdF@oN^=?fs7?$VoY82BQwHH2b|7y!5S5V>@84`vSa9)PVxtG)q9lFMu@GF;
z_cwa51YBg`U%jl+gP0>OwMVpH)aW6Sm0ViaDX*`h5^K7=Cppeea_jZz5X<szR=u81
zuc<^tQJ;{vK1OOEH>)+y0@R3=l+y%9;0AzK_8x#pOvA8`7vSas{Bj<^b^r%iwXBaf
z09{*L8~s4L2x?}&advftmb}wDf4fC(bDHGOqdX3E7VLe5m%kimrv}80cm8x6z=t0K
z2mxs0oqyWO9y>4_dT9a68adZH|5-a}^nmdI8X56h)>_zDTP=af#_~A3aTM4JU^8ev
zI5^I}D~ZccUA^;X+F*^@5NAIegq@~Og3=4u6VrWc8QgZVJjeIAC>f0Qv<JO*Fm51b
z;@EL#?eO@=IlGSe>P4<--BOL7MMLKtn+2T{3{b3HmgmGI@=h!kXAh~tR{R9d{5p!9
zLgaWNi;+pZC(a(OTFfN_y6Cl|tvf8w`PzmC2jmT<E^+qIn`qJJ+k>zcr?vF+RKnWG
zHhwlSb~@k9JO7&O*a=1vnueY*=86YPjM0NPJ1i@80>d?$MP?THwv($yy%)&l=sww;
zo73a$T0A>-;u7>PREG3r+*t)mF)%_F>->0bPA9_)wI~gbmRd)Vh{@1gsy6d1XGOx~
zcdYn-^Q#D}1M{upnHIV7YgtX>?9RO1bdsA$p7YbmA`PcIMCY^dP~vs1RlYgOjwF4Z
z+)ipL=9%DpY)i`|ZuyQgZYfkgQXJjxrqJ0vl^Tf@S~59C536V8PA)Lf(`^ZCesK}J
zMe;m`JQofp{#`fT0Nc8WhVC@b(?-ntmirK%-BqeiZmQF6yaD!dQ!#FferIQXO{FnC
z&@qN<%IOqCIMcz3&O&GR;8eGqekXm6BgY$Bp0nBD3^8=6LXeKr3u}wv)Z+kUA-kM&
zYTZO`bR%DLBfA=2>BmTUqKF&$c{DOnDcwj`_w;?&Q)f+Hl1xsSQ@-MXlhmose4nn6
zQ}2|oZscU5HYz|W)Cky~<EaeVZaJ#BZmf3HP55pTF0KWr2Xo`>(ilXuq<mV(4L5cJ
zQcE_7faewhw-Bubz{mcLvu~yir6!qGkT|<6Kr16CBa?ITlrKKgJ?^BT#rA0;CbNSK
z+gZ*ki0DadgY4QmCL-(l1B2Yju&5D!9yi;ZB#Aq1h!SQ9woZpv;Nd&LXq@XV;=Th`
zp>mw2_6Bwx*dLrQiaVDx>@)|eR>b{)EY3FN3KZSYCq>+TYe$ypx27z&M?EB)RSYX|
zv?4UxTAnk9O(EiJe>{Mb%ojapTe{KJfO3@g49Dj@XEho)+Y_o-jZbb;U;v(5aV@QN
zjI)m3>xnq49JCu%?vaU>dC%<3Z>k!pw5#`KfBVQ%)^52mcs8KeaZU=xOFE`<R^ug4
z?EjI%VO*Bu$Ue7anMEvY!ENp6<5R<N2h?Gm6yNb<Vl8X99d`h$eRfRFOJ`VPI2$+5
z?QnJ;r(WJuy_{Q_Mh_b|&s~T6<S7a<4bg6E8Mn}_f=^Zedk5Iw4sna3umiw$nn88k
zi*6Ns@&~YA+oD}efX^*)>hV>HGJ|s&#n?|>AE?8zqgiopreOZh!#u|E{PuinSH4VM
z={w@y!s2~5Q3mH6NfL3D6*z*20<PC>>(Y0~1m%0?mq)I<es>JYcY`D)V_^#!JkInw
z21qhx8BVz^A<+iyjF!GX?o}%EyTi(W60UEI(>1!%_bY?-aHkA5yBTa%24-MhD1%++
z{*!?_pV-w)29;liU2%(f!Rp-Y<nivN2pP1-WmI)06ksR^;T4)t5at$?3oV#WIAM1_
zvAz>jI;u!YKi;t$=la5-RHU;x>ag22MCUXrW)h12L|kLCJDOsyq9&M?lHF4@D^XY)
zi;C@{S1<r?pcFdMjrEX>IF55rnJn+O;BQT%K1c4C`aG4W@fnK?j6}!A$Bi_2NU^p~
z=fsUP$`wobE6<G^Nkx|EgL004DsE&G(PO;E+I!qMI=RpSvL*xfp7nU5H9*e&Auh|1
zM6=KLH8i<<M~;w5-5i(IQDBG4y-Y#t6w?{&Iul5_a&TPxXv&21FPfz7&0x|=+Wt0@
zzL>M;oUhECd*htrRmx<$!F0}7IfR?RUag14&7R?LHKR1o|7{R!IwdsR)NDigzjNxJ
zX8@iWS1yWqp^3pPSM>(p<yz5qH*v_9cgVwc?I8$pS)a7SCM6hqU^RPK+Tp598+ODn
zT)&ofvO4~$aRWzNX%{KYp%lO!yQJlnv8?o|_?zrX<5_JhVggm>rd^IkGz+JFAN7yf
zkamTpTVf*`xNT9IT>(4!*pW25L|MyfH_90IG`p13;O}JY^lI8h!&1I=sUh|9yXrr0
zxjBHCw$U9ot?!3w-ctk32b)iX8C$>pMS%0FFg3WI_62K^dCLj!!hHd3@f&HIqp;tB
z{p1>IUqxf@l&tJMY3?aXYeR9%+EC1xmbASNYt{y;d_w}m_KVXgdRm9HFQbPHBc41i
zgIqH0z3j3y9Ztw=Ok2E!wb@V;SB*g4Z+M#Fnkv93YePHStqPpP!=QP?T?*{Sb04mU
z0$cG6!s)zl-Y0mlFdIg3FQUO-GTf|LGryGIN?Xm&bsq1McpIDo=W*N&HLyzz25wvd
zi(Y@|VA}L0Mpinvm}iEwv1WDs5?zQoggi5tjKv-~9l|^rflGf`p62%v`KZ%`iPSta
zpo}gf-D9DgT^D`HcQs%#yCm&>O@=Prgjyl|_mfDr96u`dKJB`p)``%i4-kC%RQ%}D
z2lV~Mk1Bl_g*OZ5w8&!tbWECa7%$&i!Wfb<G-`3>zBC$s+WlsWh!QWx%_ZULEolSX
z%HD7k*umis4Ykq+(`&WUH!#51dnwJV#b*$UI&ApKsq0a0U4L5BvOX;qF$%j}3qmhO
zR;0b2Z!Mihzf<fW#rhZ`=)eHAGgg#8eG2!eZmgvDg2ThA8Gc#MNE=0GbGZf;lRgie
z*KkV}cnr^K-1`bl#IpytOMwx1j^hp^)g@OfZ^J6cIj7qtU-@p(UfNW&`Q>hI+C+xY
zmls88|45>%F73~V|MX9n_GhT>X9+It&uS5<4(+8~L_25WB`)=e@Iv)h#ZITq5W~N?
zL_b49pEZvX?L(kvl;{`&oLx5ze>RQ46cJ@WVHnl}OuFVSc`RjF2+~*5W<mP<4pGuC
zkVY4F(jP<8pRK{Ih|=ChU`v$tAp&2s4zd)B-OzlBNkm^|<I?;}5DO8+_v@mBFOlG)
zA&lowoGA@L{`_WKDVOf&)d(cQ^Q&P7#Yp1JWllXzb9&<M4@<>w?6!Jh^%XB`$$Rv(
zN63qjQuKt5GYJT56>!Nx%R7~0NLS*BHcK>OJ62sMiI+05(7fqNqXOEVSY`&i?vbps
zL9dqPVaV5eiX(;;POEj^x+=g@&$qH`>I%fkaL04yDlI2_Sn7%!Mmsgv7;Q|{mTsw=
zqDJ^N{J@Q&u6<kT7g1}z=W6O^<2SmVdL*VI`{vV9cbj%#E=8s~HW7L)ZqF%y#aF&o
z%hb6hds_F^{^U<Sa}lL!x#TmqrR&cgmec2ouWZFPQlF(UUhVH%+>Bku;x2|_*?V&4
zU-4BcIWcu=0mZkW7~4K)BPk=(QlBVAL9@-KMXJsSQ0Q(<P;W_f*1Ynqmud6%S{Z|D
zb!7}v+qlNy^VZaEBU<U)lc~3x{0Wc6JvjV<{u8X!JDH!f`7&w^QaigX|MMq7nL)Ch
zFQrEA7BCmUi@1fxM5NvqMSKs~GTDZ0i&7`#Tdyn~{=his4uS5ib$BFSmg0TO^Mh7t
z(mJHx?rvm$zLRv@bm{jRmwsRAWm?9%)ca@|KQ_S3UmHL?J;LY5y%9q9;=6*&Q&cDB
zHgNR$KMI5i#Nh&nsMtFCoNJ>A(W!2{nKwPuLLlx_Txv_5<dFH<n2bwwTgJwE1nMY2
z%h(9J8{4=oV`CQrcLic0F~qctE|+|zb4LH*^G6KRQ#A5?WeTiROdU$g`|-NV_(poJ
zjq16?_r~G4fl<DnAiz~UhwtYI=!}_Rc`1R#Rb7^+STO~pZ?L@@l$ByG@)*7^ai2!{
zMpPS*NBO==;1ccUmFI6*A<eey>D<};8oFC(qn-uQ-+<pLwmr2!($D|MEyN~Z8;yu5
z#HM(h-z~(ZM4HJa%@rj5O$^dDX|7OgyIYh^O@TCw7G;AB#w*IA^o<(W)E$(2#4jb;
zL|t#{>y~8G1OgAaCE29dX(|be)Ywy9ie!$it{$Q<Z+8qy{(%BR;!GDho7lsSjmqbO
zeSwWCD>1Z?je5m$Y}B=wsErbvbx5<4a#e8Bs7HTgx$G8Uwbyp}W{6zA(-WzUqiyxt
zBeYeTS7ZA2tNnAH$>%}8mr@(Ih0k1CcWnFArpEqQFOZ_v7curGIIt?e6l3enI@zyl
zj9M5406=femU+L;1gdGcXnh6J-k)P^x(O?zvSqbi7h^w)(Yf}2XmxD+82brBUEABK
zq?$!zVEx$)C}Zr|)SD)Rq-!xY#vV_)pR{l&%<=I1Q={NSE5@Ek39K2xhvlVjux3Ck
z<Hs2LVZnK0h+K0A^6jGsW9;6BXX^f^!7kIil|uXcV!Ag?tHj2L^$BQm#>ChRQmhOw
z+1L3k#%`_b-*ee+_aC-9!glI-m+L!jaQ$op>W5@MC%9bO%ol%72#y*t0A_v2tId57
z{Iqk79RP!sk)gnYLE~qX`m;Z$!B4*Qgl#c-qN3{)Tgu1eQ6jS#KW9tM)Ss9-REjyF
z=$XZa4@3wjiWfx3oG9n|Np_;9{M4!M?wB*mVSz<)`yPwgq{Qo?O~fWG^e@0aXG_c`
zMjR#|604mcOM0%cp%{*S!7GXKLChW&iFxuy*A+9Ty5<{X6FMIAoavS{5!zZLW{62e
zUcXc~$zp~uwKqdZFo!nK)Wq}=G3Ew+hEg?N9@DBIRWB!1E0Y&~Qf1Uvs;W*h*ZPy}
zi6$}C3zE$TmA>espM6zJc8y6WfNyi)mw)zE>(Vdi(HgzV^y|ptqb-6->Htlx5n!}c
zqK~Qhpl2LwYrl>RjvoNlc(kB(Ln5BCgPw;ZQ=Q3=i^=Kp3y-s<20c@QZp!q_LC>QG
zn`-^FH&|&MpjFwj54>)b=x1@)JLri}H20<2@C9^l)5}4RvlWwXJ%gq8m_G8)YPG~+
zRl^}jZ{uFAHDKsi0c)C4Sew4(MCGQP=1>q&#^j?`aE!h*E&xjE=Afq<s-g22U(g|a
z5r+5S6#$|URz`v(7WC9KB_)>b^ovM{Y5dBdCpFgc{8=rh>#x32k#)dVCK*Yjb&w<o
z|Bkx=fw-8UCtVU*U|C;=aV-FDE*JDP5HJ_O{kVGo4$TUBT1A1+0DKbQsJ{S8|AhGo
z?t@fkSEPF>GxFG&H1NTQs-VA{ax=JJ{+TosP;@JJGwC-cV9DYcI{bDHs*-t4N9NXM
z2r_I^bOX!te`AQA{%X+E&TYM$yAj<PVEyAk&uvlQg8)a|fdm@m^Xaj_w97m1FLJIJ
z^xUZq=FeUrJdD$WUVnDR^91fu1#ZQ&5VwGS=Fg#c-om}AKsKI@xX-k*XvKH1Jb&~x
zhpd90fzgcj68}{`jpxtDKp99(sdR=Ge}2ds<DakVX91m9{6Nv$0PZ#1RdxxkSLNz5
zRYu$+K~G8Mm;d)2++44ZB|!<d6tOC@!o<$@{An7A^Gn?aJvK{Gzth8+t?ex(K)k7{
zvl0acg*JGRLQ7Eqin`!J*QpH}C(g}tOIs?+dO_d16($dZJrDoAl(wz7K0<5_T#5o0
z@TBAFDeyBMI{YoXQ|!4;k}c@kmfOm(pQ_TaHK5YX3VLG2^yksiQGZ*yDy!@9Ae|;1
z4d{1Pn?2XDaa+**EoM<|{!(p*6ZMz6(txLEbhf-g{qTGi^|VO;M>Dq%y_Ey9I&DE$
zoYUubU)7t~_Wk!=b+ykj0pUFQyx+0N(vN4P7*>3>pr;vP|3i#PJ+=(T4ORg4*h16V
z@`wVc$Ch_-Z>buqso3bqmM?MZ6+lO}e1|)wy&rGAkKv3}H&AnE0_7opjX_7f17Q4$
ztN61*+c3K}p?_77XWZe&pCxiy|G}_)v6cv!ugveO#XEC#ZV>r2>I=_x?a!=RENfM>
zpeI4y*Po9SH;p_YS&f_qrzV?#Q8bJEY9I+TeR?lliwk;mjC<3(pk6~EKog=7W9n;N
z4BCIfkJ&hAdtHaZurhoS&KO-~VE@@f85B1uZG8vM*wZGvg7#lvM>mwMyq(4dtjMYG
zC(~XmYY{ZmpthYD^!Oooy|Q!Ck`Rl32bL3klVydUqEz#|LHn9YbzQx_IJj0-9B6N2
z?aHA21uUjBmGNBvllbgmKv2tuI|$q}kU-e&7(&N`_Lq$;J8~$6hV;adpsm#qb9W0a
z?A_R$>y?RFnH#jfE~7*Ql-)67R<S<X)OIIQdBlzXI%r?I87|MzMO=4YcYzM465(IP
zQR0KlIes1K7S2A%JSjp4Vos+P=^fP2%3=O*ugm<SRFh#|{LWzA!LTb1ACGcaIW1^A
z^D;8QZrig-OKtM<RnVSm{6vhM8nmB@2E@udrz4DvA0WK>6w!2r^ey(YrrUFi*zXTh
zTl>)cZHt2TCya4|_7W$HK_l?Lg9-YZXRADa?I9m*wEehKXn{_fp4NU9!$JQd$j>0P
zt`f9$<tu!~ibxoN`9XV?Yb&Yfrh|G~*0hsB`vGiP$xKR<r`hG-=W9Are1N0*)VQ^k
zdEQoah^poXT1Zj=_`9_sKuK%>-(x<6@@^f3>qCx9o(b9y^4DNuz_v!7BBbhfhnv>c
zjX>98$t{}J-`j{C@oLZ>Z7PnKE4T~S#McH;ETUE7(X2tKB89#U6M#J_Io|Tt*HIqt
zIF?>8I?i78LnP8kt(N72b{2hiWXaD#_RTEMKdsD#(V*Rlp5440@sE~iMg7jAmV0ge
zpS1siqMGDlsM&9+7qr>lgy1}Lmyi%TR9x3LUJ3>6T8vu5-xBcm3EHWC&1N*{kw(=u
z8s%2Ib9-cZMXLdCkxU4(6oa8mq=}#)hf$UiePT?iqb5<DG~t9%1i)19Nz)SW(=1LI
zzf0E{08Ec_)hRJ2{U2YAnkc8Ux2Wv;ycpbIvU`*4U~B`MOxG(ztKMBX)BnNvJ%XPR
z*_Q}Ad<H-2ywzz~1Q6I(^yA+*;gKNicMr;ER$aj3TR3Wf4&Hv+pJ{&5IX$*I_U_<w
zRPDH@sHBakoYxboVOV$$ir1M)Y{RH+i!`dHZH(YcY6Q6ehT;ZS8#kVYq$hC<EF0KZ
zvuhSy9L1Xn><L#6?)8wrSgu_499b^s)fV$>6$!p_ljXHEL0$C*DVE?~q7z=V3eQ?x
zBv)s>)a#F1t6ra9WDr~yPpYkSMmo>7?MvJyEThh|fk3Bk&<geWgz58LXu<ZA6L$Oj
zZF``y3+h@`HEf=P&4@LQKk&J<6gjf);P812+;5|N{y^Z0Qt`2GYuxXqaQu?!T~O?L
zB+>`XxBY?pKLzgOA*~`fPc*CXggE2GFNr=tA~x$7Ca1`D`it%HZdTjT?(H?B5*c4w
z65&@8S&2mKZ(NCNZv<WgS0W%F5rbApB7~8M3oVd{6LuxCJxr6`-U{;3!i{fg_~aKp
z*MjEZ!#bvL+wUMpHUyo*-Af=#UHQ0$rpxwvSW{-dcL3k$u*MxXqnO&3HEekBA<Tn%
zS+8e;(*Pbyk@m%5cqdAga-OwgN=E7iC!uSb=Ap_<HwP!j6M-(G#OsF!2O@(KSSm}W
zeZAi7`-eQ#-wF<_&NCX5?O~{N!{)((b)6L32gBF{Rg9VsHjSC^6x<|Wuhb0=2`CrB
zXz%tXfRWo!$8G>vhx?d~b(0&b8s2y?Xo5P8uYP;`X51HAgqHe%1-n*eaA-+T+q(6+
zeLpyRu$mUHN*guTvcvX&_0FWxpOV!iV*Ofmf-Hqdyb%^j<8T32zF%S2zQWL;M{nF8
zbgtO&JZDYP=q|jssFh}fa7U7a04_tGuj)CXxC0fE@V>$xf7O8kV07+uMe$XCV10oh
zio0A<eDxqo@YM)_$imE9m3TJpF+^eVL=;8JfPg6ObVc#ihakKk6$Mxl#fV^ML{Ws7
zX^d)rwH};x62*w9C=LMm+AQO%DU}|f#Y$^pFwzZ#BH2b3V4TJs=M+2b2n(lkprz?C
z!F((zp%!_YR-iMWU(pD^`i<_X^s@h)0X5Yln2BMo7|be0vTq={>J68b9kj(A9=B2=
zR_Q#|ihik;UQC~i((k~Q?ud6dQDw|&8LVgYIp4Zj6{t6?y}mw9Wz=Its>;}rh%4t*
zMm-vVDq{z&XGeRdGSc13*wGKz{iZS^!3J(^>=+4fxKkM#-I~Nt1Dio*m^`VBqD!61
z;6)RompfhsVM(+yz*1$*3pS)Oihk=>#*X*Fc~_M&FDij8K(MUXwTNot=Eo!g{UQSH
zFM54NqGH$w=ALMU7%je;Lr@?t4l-Zz`ck8an9UtW97Hy^RdYB0Zfb6MupO#yYHh~_
zkj_zSWh}SWJdxORh%weF@nFDH#z@%m#?)c;gJ6<6JVcSYnE=Y|u6_hO70U{VG1)lK
zDyd%{L+779GvKKl4YU{;@KlKg#!d}*5+ze-auD!14``4kl72bhNsi*h#RNRgy-uP&
z86NP|3c9%#8x!!<Hi4VTx+2kO9pIzz%1OXer|ONBlQN9=rav37cbhWhTeGK8X48ZN
zJy<y*!jvw8MCd$rTr*22K-JPS*fW6C&I)Gb1mG>s%E?X?ac4U)5Qx2}oLB=e0XK@m
z4X*$YO>|dI0`@^8C1PL2EedJnBw&9VYkAE#4OuZkdJ&sX79l<`XrViIY8@qDAHL0j
z?P6rQ^PdEb#{;&xwYq?#iT!aJgl;YuaPD8B=DR4!t_c8JJpmAsQr}(g;Fba$nia6~
zB!2;q<MeXEsJ{Sm#Kk~&7q_h4p47stE7Mz;<%fW$n5jA9Dedl_$Uk<GBY*p#BmcHA
zm<M<_RHwfhuz!q~6hI!28x64j@qnEl1=0!Zp38!R(dNiptZ%-hU#m#K6NgUwy{=C0
zehEx%iK<uM{U&Z%blN+YL+)hyFU--U`x}9zY47gUIPETI*1P+2+^0$r7)B1|)NJB|
zPKrQvkOEJkf4g^qwOt`PtKEz@c3-Bc#s^^}@B&9SXwZ9#G9uMDY3^eh74XZbAYgya
zu)u%W9Tx1NruGzfhXr6TEHHS5h6RKf7P!#pupr_B$WD(@@2P}Sm1q-@tvDv-boFzw
zbu3PJ10~GjguT&SoS5EFGlXY2u2`_R-v-01(ZTGEW?#V@xJ{!2%^92n13ZnGDB5#I
zJ2U?l)-xk4@5%Y@)E`mxg+N_9O>^~r(*pK7(|#C51XdLvDBWC_AU`TGcwNpue@sGz
z`D@lKn%uz-R=Y*VfwaQRfIX9xnnHVnW5LcI21KUWnL-l?yVfOya?D~1?arVBHY-)p
z8FavYp_~YyZ!2>HwqC7rXV3xrHPgIOQT!WI=;@un#17dX1~lA2SA*SLU46kZ*_!Ia
zwh!2g8B4^}aV9>53Ju{iE>ZNYH3D|WXaV9zx&`Q1%PoL-zQdVDlYiTZ0h^BA;j?mD
zz&4$^ZVIa1W|G*MM+fXI<0k@(Xm^hW#LvBjOsd@@Y7k{;dK$C0+}0)Afc<FD)WQIY
z7Ffk38VfQcN~hah0ecK|;zkl1*U>GwJ8%$4E6%$%2JG>s4$X2xV1B@U*ln7sy#oxV
zC!7x0Ej9M*3+J=d)5a%Y^~7e&WQh$Wm8%XgJ3_^_qyy1Zcn=MAPkW$}Pb+uQyk`W!
zL0AEasjU$cfM;+|VmPc0@bwq5*mJwB+pX?dPwZ+bcZq54^w%>^XCMpBemil9aect9
z9YMq5hnh)mKyyzs>Gj6n=9ZqdLub<KjqmYaP_*t{3{84(8xpYNnKOFhKQNPCLe#jK
z^e)Q|*f%ja3@e#RQp%Jh)w<uPpF7W8tchpM<iI5nDVByJQ-eBK<<4^h-<wnz73%5-
zQ&sq>k{?ZdrvAtN&hBMdee-hK#K%-0IyLaGsb$e`xI1vh(9eWEtemMV)q_s%w19i!
zwKlsZodX|6+io!}N`c8y95C^d`-e@WD5Pp%E3i_uwb7S5E$8d_n6k8K>(7#=O;3v(
zgp!$)1LkGoCc6R{KGSEwO38VFd1B?JYEB08IPG9q8MiR-ydi2H$qKw^nxp2+^!JO6
z_TfjNmN?Cj0QJ8F<+`aF#3Rzg+0b8KD=^j2&xSr#Ff~av05%1f9u?p0{((oGytHH(
zm|^^`D4qH7^uF3hy03AdUsNJDz2`98FGUQ;jUCd@3TQKsYaxv9BUa!+nqc}L8hTFn
zG2m=J<y&K);)sH!22mp03_Sy_U`RvHJr{AOYEU`N1Fg^*^|X7LU+(o+F_P!=UF1W!
z39f;e<OkZA{0QHL>u4tVfm;m>o3fW)es7=uD#U2oOR%QpE#4iX$SdqNm%R)@_Kwpi
zRHMnUE6CmoHVm|;Qz`xwU7M!JduQWjDnOC;zKB~8og$C@MP0CdtvZ2r^ryum+LPC+
z!QM@{Pobk#gS{7U=b}^Oadph10d|1S@OJvb5@~K<xc3@(Ke~M(Xj(K7TA{v>uoev*
zXtXbM!{ioGU%2-#+@GXVe>Ro_zbsIDOSExkyTHa_I@B$exZl9;i1vz%?ug7(B`G5M
z_>P&?e*Ai%u`F96WW%b+l4Z=SHqf|wp;>Jt(3lpWI^0Kn>?`WjVN<sb_t8o3tDxDc
zs4y!ian7larfz-cM$En%(P?Lini8*mt%d<QN~b>dH3ElIBBnm}wI|Tp%sN~90;x9j
zuS2cHPxIH|a=XK2YH}ei1F0yrVG{g(x=u?I#{wEf+xHx>`HrHQ$LLg;CAgPi+z^KG
zlDb=qBGrvD{tgJsEq&=;^X%eRpifH-)Vqn9#i}<-Dc~x@KG9nv0K?0sAyy&qXIS1+
z{g^utq+Pgk2Ldz*ckU4Kq|j_j_0xK8$Wxt0ma!j$+GJPAQ^Tk}fv4<9$Wt>K`Y1Kz
zscX7GqS7yiJPl1E>}9F0K+-xuvhXw@<f(UK8j$f=Cey5sL$<a+B+{qHQ*50$^p<^@
zX#f$1QOdFn_qmw`gzU&x)m8?OpK;%tX#lA75ZXZfn)?6xW-wAWhwN?cG~nxY05bp%
zuK<v0Qu41Kz}-*h7TZ2#?=%GmFcp^#FfJx!J4dnre1Llg;LOyJy*Hx5EBzMSCZOGG
zglwsz0UiZ-7~tk|A$xxmcopDxA<Z#D_Muo6j{{L=juEoIF%q+^{pj5O+N6Bz|3da*
zH|73`07tNqN`=_R1k7bMcmKOU-`a=Nwk-;I$}*rFfZj-Y{PULH2N5K1?{v3O_iqLL
zGu@t=Daq0HZjRAZCS;!lGh;uo=+gen1U7vgvcHQ52?g4J9rvsDJLC3}WRjEQ$ApNJ
z=0F*X&v2MoNT^``aDWOsPz6HukB97EL<m70NW;}~ssEo#{XiICD{R5c_mIa2vIWlD
z5K~A5tFzSAFnGRso5|M`>#}+vll%|d?d0n*S38u&{kYyxn^iAL&9N+^R*@+OyKys_
zW13%V7Q!qK?Z0W_nwlIKh8v;)igq9yH(sgA{szG*O2w~bO$m9*#9{x+a-qswj%qtF
z9T!m`7SC+l%<1&E<?17{<21!`>3|mDa@;w}tl1X!jbD^5WWS7EF0<aX%LkT$_nK>$
z!N4vXyh3)FFm`!XM9B;7;5ukzC%b&$L)`lySS`t)HZ^N8{$64xOw0zH)-TK5iAM$B
zjj5is%rVtvnTW8x%BdmeF!J;@GVZfB=(z-hQQEQBRwV(qyFhj!FybB=^;vmlb9H=~
zm|Bs)oC!`@uCu!~-W;6L+wYp-%q*=A1J5iFD;y*7>=A|MNv9dS!1f^3WnVmX?P6wo
z@=D15019T|wCr!%@dRKL!)!<rK>yh5Kt(WG_6pNrQk`*|I}O?>LT|1Q**Q@{<$8f8
z8<11USV*U_<uF``?q+hY)eN`RXn6VD{E)40tMe@gLUX!@>?I5(tOdqs+DkD%8GMAq
z(q82=@H?1n%tWi)uVj-w3<#9ni57vdYl=fOm?1YNS|NKBI^}LvhU~F)9OZr`zm>Tm
zJDZm0PP9VyRAac@GCEt8(@*QF?u@@e_8i%kN#axXV65AbFn-HuiWEwo57|jk_R5!Y
z*-N57aCaj^cJhtg$dJu(6o-k*X(7A1Wb4eLLUwHv&~9W%`%RcA#f+UAveTky5^%j}
z?;^bV#_oY8L!EB=5VsW0Zshdsy^MXc?*~VQ_m(Ir*<1GOo$O_2wM)z-ZYWfBO2*2_
zNl1t(9+A9M?rKiC>6FUH0%~0)WOtF$OmgQ~A-lWk6Eo6@J?K3l-ZTPrh?%v7?9$O$
zOZj##y_*YWE#>e1FDNQ$gAr-LaDWajCd4%{2)=Ee2@d^+e2eSF22|&Fak~J2+lisS
zjC5TQI5U<<ON+poFG6cXph7J)0%5J8`rR2zDAy!{K<{v9oe`*Z=|Z1Wq&SfX@FGJ(
z>y6a$&wM4cp|G|%+jNf>L0joZuCn(Ka=v!}E_HX_h*BKvo*8=GaL@$~VD)uoD&>AH
z)_=etEA)CuMG#hxbD<{<);A7T<Vofm<$g7DjL<BjiBv&__o4pW^PxEsc`klN4f9NG
z;73X3Gf*zoPqPTBZa#C43g1v%f@uDt@=|;U@8!aHFBe)NX!Se14C)=q<|wA+tymFe
zkaTt_SJJcl=d`R~CQ-IK{rE-GkK|iIeWM1U;%!a=`lcBEwWSc^!5_^yy0fz433bJY
zcgurdJ&jc=o;0(KP}l0tY~#Rh*wvqEXtojR>W)+oQrd&gY$Mc7br$&*00WVOiB(t@
z+#E9N5DN&?S02<|W<#Ieyy6}Z5Jfk)@g8gsLOZ=tkjehmN5e6&c0DsV-SuQB!xVui
zbk=+}+gs_N!(2v^!`#7pNZwUnI)l3mR8c+s!4bG2<U`%IHX22EIxgZcXXZj;ZVql1
zFpO(^qq>CO#4UqilP3&Un(8pzI?C`$5I$5-lG#=agOQ_$F4Q4JUyaD@#FBRwG4H52
zjSVux6m>h5K6APd^)Q*Ni#a83=%&>au;ukoooKnAqCmY=DU}a9<>py4GX*^OIb5uF
zDy0tf9Wmwp2H<|!rQB)Ja(@r(5-=*IZnTX52kcj1l-mr~k;S3nI9)f*RGyT(@^}!a
zs5H0Shgc~*l%NTj*84MespsccJwJ~oN4%BaqvzLl%^|otl%nEsRopz;;nBLk1ooa~
zWKfwkMRlV_2K2l}26{d#Dg_-jsIuB`|2&!_K_0(-guG7HVV)T)S)|peB^?Hw=m_Ib
zGs=G`omMxnhCe#2v<~%!k6uYbK|Jj=ee2K!Kx0y!4%BHbkA@i#-rNqV$)wL7=C{w%
z<!OEC(6cyRrzO99>l7Uac<^+YEt6C>XuWC8h<^k3I&Cp>GoNnorlHJ-(2qkOD!^>u
z(C0W#Q+d<+;W>c&dIqgH?ZJHObSHtc0iDO47*Ak^AhRs%n*h$IoR@?5yj6q~SQY*D
zwi1@Nc0c9(3Gvj<Hx<aaOhvl+w8%E^{C$?v9|WF-W2MQPb_UNi+(qI1po{;4G7$cj
z?ci_I2-L+keET$x*Sx(vU~YZ;DehwhP_=I_;ZDI@-MXCYyK-N?b&h3eGJV`{Kg&*f
z)wxvqmEn~CFsvLdA$}g`@YodueHac8>%r|SGw@(I4u=$Y22W?)?FzhvXC!W@0&n4Y
z92Y@Eo-3>Kt@E=5rm%-!!@Z)wRy^x)`cTG|{dm5??Q6opyelWkd!gk`?yIO%fGPOl
ztL#r*xeBRXmWTLvQ}=O=$8(jU9SP!M6exoSO*&Fh0YrbK5w5-p_79$pxZ6}N4gq+s
zV$P0Gl}GMV;C4I@<0hd0o~u}*BaB#&Jjza+?%AC;_w4xPU+O}%CTT5or)zdckin5T
zY7yuATDnT-P2%xOy#Z@rh?}c)-lPkH#Xhe_F~y15=nO-XeTsS1G?(f84)IJ2IS5xQ
zU9|HiCpryGNhg_@3mnKi79yr&&ZwlA#K?t;g~q2{*NR74_SM0#gspXct%j+)*;`Cz
zea3TjA}qg%TgY+ptB*0=)8BdC`Df86&(+1m&=iimPP0EB=9U5<{cs;r7K&lv9K&+X
zHF}c|%3Nvy+I6DJdu{{sls>?JE@0YDSD|93ndp5^bXDy~U^F0XqUj}+m_d4jQ7B^V
zf>;k#qL|;^81w#vGkc;C68iI2L&Hf`9d$B{95?W#q>xe<TFHTyiiF{6P%39ra!jen
z`h4r+a?=LB^xF$qz)I0`$v^L;^treXq$*z`lb^pObQE_`f$#9p?2cSxr~Bvpd@Jug
zLn1Hc<>HpN8cSs!%`T79WR6x+fHrotHct0M%H%=emjpshXlO?pQBl9lhXg&g^J^u>
zJPae%`YI)J`=f1eVFg~pa~G}?we`y<)Eb4kROCkenAuBSqAG^jOCHA6+#|bGTC%$#
zQRHSWzx-02gESY<iS@FvF)zV-%2Z`@D_Pu!V<PGK1tyPTw~vm1^|G;Io#uX&hJAE;
zlygiux$z6<oh3pp89JQjfc8R^^VbQyT8Q(!4wkoXRJDx4{=#*oyn78bexcSa2(>{X
zK+PSMEYvOif{i)49=A@^q`k-?k9Ky0m;lpM>YSC;sAX3tQ_$n6(lu~(63mM<*@9iL
zyJ_@hPF~d*YmWY6vKdSH?H&}ZIwr<jFHGKaDMvRe&=Ai>+<A<0J$+UVil;Z;V1|4m
zvgXu0hIebeb;jKGDtoiv9$5#9yC6~*?K=7kE?-i<8A^4(GmX+)mly2SD7|&jH!ZOo
zD@veV3?8)WSON{;%xq-_r70?%4i*np8kLW$3qsIY-4C7xg9Uf<T%mw#9lKPW3%b~)
zze%OG^JpElkTa(p{{M%ZQ5=<GcD|)oDBv~OZ$CjL)ksn)-i4#axP}V6f~PeuqZHkF
z*<_Vzts|YY)J(Lh;8FubWMl989;(ju=`_Fn4AKr&^#WGG(fVT@C7ZNLmc2X1JO45=
zv3CPGHXPSa&?-<DkcM__KJFR5)3N^(Xl{&1rOs|7n-+EW^s=|cSJ2&$%#SU_y{N!W
zJam=E)<bE(WRDciVsi@dsZ1GUkppd_Y<tUFvxTy2N~&GBtqQcoa{+g@Dr6qZx4yeq
z1FHysQ0F>pdCbS&|0?mn<9<`%1<T^znsuCeJ@)?hRc~bcT~wDHYs>1qy}vQwji#w~
ztFw_Z)O=sb?<Z+7T$}>k@RY}uQ=mPb6kJtg6e-(H<cB+|WbdB<oH5+-ddlmZTga%+
zAS`1YG%oz^FO%c_b+({%HILHvG$cHpfoqP1IafqOLaEqy7!NMBdTahEZE~)wIxpYG
zR<rb4(78Cqpl7JkVh)0ed9GricGtBF+3HoI7DOO5L_FMYKaT;g-GO{BbRticwuiJ}
zICkg)GCfXDdVHb+Xyb9(>G8P=jKZ@5_nrciDgW_pgk;7qJc);)#qpyGJcs93+%*N3
z@Q!mFE>`1}3-9Jz7p`DlF03|M<+-qts3cq!c+^Gz3y*0CQg%j~T@u;UdITPI)Bi*r
zTrC2+>3;&<IMLY4a6(u8PheM1v{n=hoIs;bbW(s}&xsy5S=+p=cqqz={tA48=ONrk
zcL;L9JdnpP|8&#eTZ=Bj3_(tyMkk(=OfO&z3f~##QU><N6WhV*MJGz)BxD$3y2`uF
z_rWf31LE|XfL9jO9=1R)FHp%Bt|$$4eBl>$n_$u7yH?a4j$E|dm>+J$V6aJZk!o*H
ziamkau{WY7I#K1EM75J|#AKTu>|!P{qsaQ=fT)KC;Xodf$MoW7I&mj*e>Ck7jfVMm
zD+A(%W`J+jXY0^J8BQ-kJanEXUU64CPxX~W(61Hew?BZB+Sib{j;)?pgIiVAIkpN0
z%c};j&`Kv^isnKKcA%Uv*=eEk#75j_kf$s0yd9w_G3>??@XPv&-)7g;TPH-8YELIH
zJ}17S@=i^3r&v4;Wj#W;i;CwgJkw@P2htSqQlok=`0dXzy{Xe=Z5h{|ID$K*=J5ht
z)a_0vABPr4ymbet3z7{UWAxcucPel9(4Cz0ib3(W*6_EMY-0U(DirE$clkS+2wr9J
zw;{@3GpAsrJ56t9eoeY|q)WA;>1YclYmu(}Y2;Y&+@oZ-%REu!O|6o1SDlzL5qH>^
zsyi~ypwRS~V4hBtd4g!Sf+46gR6Jb|O+Xt{2Rmt`{HM{5|ER=1N@G1Lxi18hiG3ky
z3Va$JO8vlourOSi9(HMe;nJoqPXGR&)JBC*q4(-nQ`xg0#>cr;GIUA9{WR`vYPDJ~
za+!WLECx^2QR~d<ni^B4`t!)Ww@wZeDeJdi(`r!Kaw;TsGa;<F+4SP_{G8O7gxbyh
zw%*CIa(i){y@B7}Wp0Z4?X?1C0Q|C*-~QUCg|VEkQ)4P7Lga2ts9B1x+Y~HKh3~GV
zsW4de$L7SRar`F6Z)<hgS^z9`+;0!4#@>G!0z1B7a8i}&_-_OzU-jGLOhyEDZTH*b
zgD!iMulenVszY=tENolkXF5-p^ZYM<JEb6VT?J9*Da4q}+fMY`HPO=aQbnN`I-c`R
zT1<^nOZ;}QAk9|NaO3hE5hXwNUj^RaH{?^VDzjVQmFmXSjeOz1ZWwf@|IXSnqZfMr
zQTO@JL}}IQVbb`|fNb6-s6W<!hQ7OA5AJ-9vHagvgsp#c_^8p{-FR2FoPRI7^oLT|
z!F&qI+^ZFedLLtjDZ^f9G~8hiBXrQ7k+Z9AOohmC|JNzb1&@;$`;(1z!FAClzwQ9B
zWb3VW+R6TlL^u2NpZs4?4aAY#hJOB!4I;UL;GC7N-^<DEV=BYVjk;NDPQ=(ltB`7_
z{}WRk<QKV}pVn0|Ivt_WP*zR9R@krSX1uxg5e>PMV`P^G;&~3o;0O~M+sgkoP2i?o
zpl7O>^<M@vw!QytSYb~<#iY=0)6`*OC?VK*$K02-hlu;!vi^k;*iWAdm8DRrBP!{!
zHMC;oUnnZ2$c>nji%I>&5&yyvSc6O<Cf4x3$ZBso;yJkvw;EKd9;JhU#i)O}>=Rw%
z$vx)cRr=Hn%X;&Se~#KodILwObE-13G%K#;Hy;Azhxor7?SH}*f4Z*x5~)Mu>7|@h
zPcTA-I*2Xr_KSbjQ~Jw9ess<sNmOJp-G%i>P%ZPwCQULz<(h}2hF9=M+L$y*pnB_`
z{%p4bpT+81X2ZQfDI`EKvQb4-j68~QF3qT0c4x~z_<&`dBGt+3;6ZyrvS<T?$x{hf
ziD%bf#;WABOpmE>>jD2rDrxv}h$l+C4MvfOYEkRdvev1VxF$}9BU?Bbo}$)I-NPE}
zaC+>9`*U7Ok4b2MlYbz2s;-7_gjhvGY_CIXpiwmv(aD?|2aK8?<Q~B~#c<=)OcBE<
zLhL%kA`|`h7KI3cYjDL8+`Tk!3X7OV9q_kzrP{EH6WKmdk@zWX`?@M^iLosI_4Icu
zZfTA5ol^evs2HWaUBq0&{V+n6q?^Prk&9cNrmBhf(@os~V3c(#&paFMPjBVyv7e@b
zPuC<dxiu*3$o6zLupw|j{WVAu>ywakFBbFJ#cTMvY&B09Y3B4g3ljDa{_xV`VEzo&
z<%nlTaCEJ{JX5&5Gd3coXaD0*bS2t%G^H_2hvOZICdw*OJ*U^;mIFf{5>a94!x=<(
z`VugtoYc@U9%r5bKAiz{Ii|pU4{G=u`=h@)qw1!;XvgKABKlk0P6Z}MEbA=lepZvw
zau4D`na{Qd;%95eTkZuy<a2hC0t|c3K8u^Dz=wF2;ub5g0T1k*U7^5XJlk+vD$*F3
z^uhzZ8NVFJ4A~<<X>^9%(rKD!wSjncAE0zfdG-YEn1&|h{>-=fbr9?RaL675?@e})
zBq0HWA8;2GV1)f$Ib2C`+Y1^A(D;sC@ViC|G{BRI(`sr$7|#rx)-n^2_;+vO_<E-|
zlF$R+=Qv(G@g@wya}{?<fpHx0_Yn9;foTNLfODm^Oq;Nn0_6+53=m_Jb2SxMiKi2;
zg94x75rvToFf2Q_5XZWuH{lyRn96h88UIJ#{hgvdWr{kPT|`!L8~@0lM+d{soyMJH
zn&?gVl_JhW3VdzRoA4*#E4a%VqL$}Tl?NbgjV79PRPz<1bAJ&1tHj=~i+T>CZq=B>
zdE9Zl8FBP`&+>lA2C}zFR>6>?-v+?|jQ~_+vel3o7c>sK&>29BK4eYi5e$aZ{i&8E
z8N~Om>CD)gysJDWY1P0J(PV*f3^u5Li-N<GCQ3}0RsqvRs^?n+N~^;lQwBKhDuHLB
zVUfpzxpj!*7RjmKB&JMwKwD>!)RY}B4U%AD0OR@(eK0X#qQgW}-spCRX3i5PhKB)9
ziIS)=gU}JR0OuqIm?^1$fxjjtY5o>E75L7w&ZAD}nO%DW)YJKTICDz-D?AV2?kC!>
zReVZjou7isR^V?uFXFgS?+pg<pbO`9J1mIOoTvGoXHxGCHed#M{wyKh?lg@99>n}#
z$f9(>eg>RdZYFOvjtl7C1+CYpZCr@Q1=Ti!6Y{NrHI2gT4%pAbdb1;>2rd9Ysmdtu
zG@kmnRB?-y@CIKe)B)F4O(3`eAEmj#YPC1`DIVJO1tz@SAgo^a2)9xJBya&uy|7&Y
zWOG68lmZm~0(yAiHw7sC#S*yq@tkUsipG)c#hN%Sk9*^);9+oavAF`ZkpIOeaMRF!
zDL)5^)y{wCBr?k1j5{Yr`7iDRXOA>Ij`7GKtP9ukz0InMMrWdq<Bpo>-uc$x*+ioW
z&Dtos4^fwJ=Ox;K^_&LKOiQ|I01u*_P74^w7+>1nY_y_c>lpNfF6=SEFnuDi!iBvA
ztmqU*3Y87`oTG8g)(h2HM>cb0kwQBL(q+btH9CjjDM+wezBL3!Efl_a12_$0pYkx_
z7yngkKR1?{K=U$+?N4knuCl1n<A~b*&0@;k2Vpgs=65P%vr4D8eBg9QHK&0z@242p
zpoI+S;<k_>eI0(AKV87DX(2AVLq->{OBJy@a-BmpLl&!Y0!93_ic>Gwhr>-nT)F~?
zIqx=HD+RjZ8HpQC%?A=$1i4NV&YO&555#l*aXj;IT2r}>uI0Ugdr^TUc+keY4-{CB
zhrT3|$G*O49^|iLEtb%N_BN!_LY<hJM;?7lo)(kTJhb$Yw~yw*O?mLQ8?IXi?Onw!
zFP{pvJUZK*cM5k*fjB(B;eHagJ;|AytJWo&*d@OLkp}os-%BdUUtv7maorTS6A#_w
zrC|!tbzGukm!>N)2oHQ-TByJ{JgadS3eR8D@X(4bZ5>a5{?hXoy~d^AahDaKC%sHt
zy`1Vch@qTQkkGTa<4%icDfy~9xZD=kMke3`#^yt-8Kg(K`_94ZmQNrReFyY%7u;P6
z&>%1O#@&bV4CR#U2=lg6EX{y#9l%nQPE)M_=+63lWZrU*l14;m7)~d}3?bC(@;DJ{
z5hWx|*GChyjLBtrNT87|={G%p9RT?;+%zqI>jdYpBAQL;ms_RwJ6QErRiM1;4Uk^K
zEut26wD<CI+?!St9uxWNG!%0|Y$l55fg{e#D``etx`);jXkqbN^-%OLL~X=vFv_ye
zY4EMaNzDuQctbHDYVWN$y%GJ4;n2lSqiFS3L8I_Y)ce-#GW8O<p>&g4j%>9}2#=Uj
zPc-q<Op_bB!HvJDcxQpdiKi7wV!OC_9~<p?VE_6t2EY<UIaISR>|Z|)>vG>H_L3Wm
z70AGvd9Gh3<~r{GL~S@Xj{esAmv`KXh$_Hzrm|;}we(_mMRCn9!@i(>O8WnvYLP09
ze2<2IuM54Z)9-0R-<K23#Auz~P!8FRu-m;4``s}&8GBX2!scdp2dC^AHx}z$i_*(5
zd#}r^YaDZ$H;M5h6$bm(%|jCTX0hcB*Dv;fmH2QO+V|xc2D;4?AMt~+z@m4$dwt??
z8{A<(B;IRqyMZxyU7}fN$gpTLA3TxRSwx13Nau1QqIaaKwNGp#@En2LlyYg4@-}nT
zH$w~rk`vPm(VY<O-#bwgLGvQj>iZJ;Y?I^P-#M{K6kcyuVw2*6ThG!udyT4F3&Om}
zrO?Rcb!*%R-TPu)EtM0ujJUg}EE=W1rK>C&LcT*6ja|gXqvdTa%8MRe)J~b{0}S`v
zy{KKtvTQwMShN44j*>%$<ZxTcqE?cF_rju(NjVVgN181P6$4`s{<aqvg&1bQ8Zs%i
zZBZ4GUzf8o%&NlUi?q~XO4d4kk@LL_GHB3oQPpZLe9~`=sy2=$A6<D77cjl8_mgVy
zrA1{#cY*aJ1$g1aqGJ597QoV?5*f|xrkurSl;OM-Y<b&+N#S3YQBFe2#XojxMmc@w
z$rLXA!HjY#^2h1aVMYa0$?!3#Y(_=-bwKK!q>MzvtBSEJBeo}ewCO>_*r~C79BB}-
z=bqR*6*1O{=vpAAm;U7wE?q4v^J1*?&M`<il}&!J?p0cn4|_XS;%Re$obIidlh>LB
zpdqp52vwUu3@o;+k!!K+ej}{dvM3dD?PghbHHy7S#UI2Hg{)6C%`9&nT|;DIZ=z*^
zW_=&RrBt`PAGHJRF|B9vOH+*1(*CXLyFQ}d{JuHv76tCc6S;$*+jY|ECP<o(@D?p`
zZQ8UBEU&Q!u_tK-4Bz@>T(*_8%8}1oFfu4R=?(FdVZ+?=ACh!5MrX^LFXQi0G1qoU
znoh1IJ+1PfKi}Vr%S`M4&^TbKSHVWfE(~qU_gd)x+xD(TCOIn10^(-lW>T0H??E<C
zCw2MdU()j&=xtjb{#SeoN)GM?P6>EdjLx@O#90)YU*YkJxVLQ^;Y|nUHQZ7ehUQq5
z+lpgNeB3?#_uoi)Su(nqC=H6hTDd8Rl{Aa>?Y56cX}k{&^TJVc%zQi9T!)58*sUy8
z)bL2ss3H)fqMFe&n6DRl+db^aVw4P{%C-TQOXYPQn-m#UP3QoQ;SQxe&~LPrG^(x(
zW0d>-FV%)xNn;#Mv#wyQt`x7LLsCh)Qz&v*sHiKc7~bZIDjKXcl(BSfJep%(%^9Ay
zyNK)HM94}vX8;Opn73X30&Hxh5z#_L6@pT`<gs~d(qNRK-7DyUe_hgGMm5$+{N;Bh
z4X%xiIjuU4S&+nC6s0#O7nAOXVe^ije_hUBZPEAmq)a0qvFe~?iqHawXeJhvLt|Yz
z4tYAMV^Kwbc#DJBkzON;*s*F9@r&=1!a}6OzOBE57%qeub`W80Td}0ZKG~Pso_Ek1
zoBA*r=WJ{jQ!esmQXQY-w>t54Zp0_mkpamy?J}v3s%L>po3Js7V=tum-AR#LC`EFi
z6v;}Ft3}=U2a_sEKXXadKG{iCiT+XLib$-L7!5k8TN9GX(Rxbs5o#v~wOpcuD$H`U
zcQ9K}XZyNq`_2ff{czO6`w#$$)mY_QKAm+yH0Ds$W!bY1Af3FqSOPAMa>q?o+ok3#
zR&XQU_8&SZA6K}6V*4tpUn^<PS}7vjtPqiv@SHan0=jt`lcacIJ^jk8w}thCgT)um
z!7>rGXT3&5hZrZ~wHpzYW-U?#);A);iwa^oZ=6N{=IwBcljPZgh^OsYS_tWIw-Yg=
zAY$CFv!*CwxDzp@AmYjIW=VBBJmy3Ub|NVF@aJa9(sy_ngWe+Y`7CE2K@2~6XjZ0T
z)SJLo<_%igW_41;UMGS>EN&4?RhZRI5qVBTyMl-(SIlZe#O;13qLGOhOPl&>R+ADY
zuh(YLYj`8K>+ms|)r?}Kb)HqrV3gc7D@i17br6yYXx}k)Rw+ejg_xA3oQO6&K3FG9
zdnex8CzyMj1SnMT<NBghw}n}@#wfSz@u_9m1Wa}7K>ydnv+UbtS2BdyV@Q@=Ux?dW
z#QF}RgQxu%@G6tn>MU)QcyB-J=9N;@<VDmiKW5n#6s2#`Dz6H3YN!NJ3G=dSw8q=9
zoEsG>X*5%DA9l{N{fg5oiAv^oq9{ZC=2`zJrjt48o%K(m$%=?2v01+<VxSZ88z9Qd
z?^|`Vt|(%v6LF<VG@`<htnU<&<3vQhE1)%DQPv*CtT1BD(!)oN9#?CYwN(*cIT2fF
z@J__AXR<z1#91fevx12G-p*2E?|9vb$SsIiHaUyy5#Bp0JGtjn?jgS723T1yAtP9C
zZ&@|+v&Nae6};wgqaPS*W$^(uH?sO8StFy7_c}zhp6;alcxu-D(a1SD%R9zYjJ%yS
z<R*p#@si2rxmn$m`I`<`9G7;>vHf(GhB$Y8?nK;KQ1bhZW@RYiZzm$dM9^$%pUY}(
zGy#9hpR!tqq!o@~kae-{JF5J?XrC2nNb*i)oa7A)==Ka})mB7ZC!%&i#D|Y$X|&Yo
z9w(xTQSCw&=fg(~;pegvgf-d0O88%_FP@Vo7pawOM|OaBXL29MW)(f<v#dKtB->w;
z&|CotKb&l9<Y^7+rR~XN`%f^!os->nBRE#yX@9W)SS#7qvt32&@(7!^(|K?nK9_7?
z(#SJIpgT(f>RvM0{vHEtFD9`0iDW$p5#dQ)LhI6#?R<3sgUrncCH}31No?BY#biA=
z;Jve@QG5cX$*E10Z<%bbQq({<YSsUiwR}sF$c#zW%LCp!*SL5y4T-vtkg>*`gCe%>
zO}6zYtSLM@t|vRil#et?=B+q!BLWA_g&!cLf#g~PEi1WCvW>wcr1)RRpi&%=QqlOv
zgwQJ|{;tx*kDUrcT~V%iIk{_IG7kvDW&7pHc3p_v)w-ZU5N-tNHbQBTF6@4>FWD|H
zoL;c|QMY8<8Lq349Zx6QF^Zbz7BYrBqP-ediIlwN8_8^ff};)TW!VHALEMl-%{Qb%
zA2m$=RcJe%E-3j|gJ$-2a+9yquY%J%l6+b?`9{r>Pa708e%Xj*Z5>gWLK>I+IY^z8
z9i-0-Awe4?S9?_jy~ioV=vR}MDn+J~VyPY@Dd<*(Hu_a36LmvQCZlI0Kcgg*oFvcu
ze<@~&@QkeFF~VBnV2vrn%Huak^-aECNLw7F`zxTM|INLxVKOsWwxaW82d!I_R^#%?
z_aIqnRvD%w-v&~bn;fLu3L%*eC0FC66{C`qG&<~}TQhYYNOrEc;vd{KIV4gM&BeOk
znq14!#ZMmQ-cv3utBYRB^XDWta9WQbqk+`jlHBZOH8pdCg-{FA@UTqW#@U;Ub#T<N
z%gbi?maNSiMA?RAsL#V5EU353ALy5VUDz|Wn)1~-f?buu9&=hifdGN=Mrs6TDP_9E
zRIN9W_n!uaJ^e+E9mKBXg5%hU4|@iPL<S2)){I}no_nIvU2}$ZiK!Dg7xwTjwzunJ
zVD-710OrozstWUPuDs+>{!Ri;x=v{N{ILBmD@R@R5@x7>*i*z5mO!1k1kiJ1WW;_^
z!##58x|8U-Tf&|a7<>uF4OU_SUSSnJqi)zfN#VQxMyh4m1e~!01RuC9Y#)ZpyY)7y
zq7K*iAGLhoHZ`!cbzytA@N{cTc)JarqLTe#d#j={-Kec5O3T+)xhr9Nh2loJaVrXv
z6`K^cpHozh8}*!tg8i{m!}bdR8F)h?re#>KqI>VwGc3w^b^(cMe}wg%hxhK?Zq&mC
zQ87g#VS9|?^4z#F1#!igzz-*?n;r}m#o+}}zPzwKKv7X~47d?>JZv{ol-@^CszxRX
ze((A>Y&+{W1lm;z+fAiFkwJvMm>ae=s5OQ+Fq?px^s8KBT8HiGqW4<y2ZoGgBfh$s
z9zy()>ICX25rLvF5@@7=65YBYY$qtur@;qCjUZ74LtIf=p|BlL)ZyURQ4_3i6Fbg{
zd!1I%EGBFhji>D{UmN~INY~>`dW}>ZTQlv|@J~c!Cg!y77E>v8d-$|M?cxk?8tIs|
z9auZ-tU*94;X-(`kcQ>VCrM;Xc)dc;6f@bcudXD;OfKuwqPfg29e!6xYl<1V??T1U
z4IBx-PhqKXAn{$oONF$XT*+{0Vl;J^*5R3o_^a5U!B&_h1Le?P-c;mm)~FI@g=aR5
z;@2r3egyn`k{p&Esc8}zmL92RkY*#BcMgQd$IIhM4399LaW97lNm!9@!gnhDWQSYc
zmT|bH0d_XrnpK~07x{B@-ph<BUAjoPgK5sB&Yl>qq15Yg4ra!LBK5;bL6fKVo^Q+@
zzHn8i#O+b1Ps0_Wkv}_;m7K_V@D+F>T*kyI@WoT%5+=|F|9})TXwRw-^0I6K|9{U|
zWmJk?i?$!h>fs{Q`rmG($|&hikHaZ;B8XYjUA#nthZ6hOrP#?1JHp$QVzWZ!&B}H0
zZYqpd!r+l;*@zVT<^t{Nu`!ZzRf+xu1gBS{eFn6DG)asoQ+}3T9RtaKGpS3k9+je<
z6x3A1<fYwHP9X*@7Ibgq5IbeYk%h*gOS?k>%I3zUnY};vM<j)HWzuveYV6dMLnc%8
z8w(#!*=PtVRvl);<|!LB3R-}F@Vb<Z*h-^Xq}muVd@!55{e=|Ge!IWru<-W(2%hRM
zTO~!);O^35N}ToD|BAhA6)F3&yHhkZ=>C&~mQzSDiyR(73hhgI1f+ZGJ4lb*K+5Ud
zJ*IlXij@9}9_>W;FBCnO=*Zv{O=ItU-HGmWBRb_SlZCE>=9Wmwau?)~a?z(#TDelb
z_lT3M)&EMl=+lmr+d6EHvaBYnQtGfOw-X^*Q?xYLGl3>EHZnCO-NCW0K>JE-_Bnbc
z7(6JHyd$Ln&nEU5%Gz5`l={m3xZVmh#xopeVrt=;fP07mXvsTR{_1&`e)QF$oh*cX
zwVg$*q9vxS*u)b$y#56T(OfFB&qJEtDGikk2kD(`o`jgz`%E^^5}2oevUvr!SlRUc
zZ#INXHbqKI%kS%Cu!2pZonb?NXbO8s-kwEyJY;1Yq*j7)g>}R$?`DbCP$E|{^}4bi
zx6UlS?QEfQ%Ho@A44qjjLmT(>PAL=B#-4+bJlg1d#2P=^SVn7HT8w9G@??*gYW|r%
zj|O8s=jE*F!M&=dd^VD>y!UDR?7N!~Lu}Lgta#LCJ3~`i=bSA*_caXy56<y<QpzX|
zffbW|&T}Nr(8%XJQMiDSMo)$&)_cGD>^)9v)JP+o==0PyK?0!}zS}+Z+@{KCBsJ$2
zn!!Pz&CWH{H8xbf>&^U0(<`67(U|~%w{DKl{?OoQ0hG^tEbbYTQ1P12UTlDGx``L7
zWoqQqV}8!pU__4i>{;mCP3k<&*~ebBhC2DoQpq#yVKq5WTLLUePHU*UaNEI&WB@eX
zfIWoZi!ATWY9$<7>z&BKo<pW4$wiW!5)c{AMfkEsSBbo8m(`-&uF^hx62mPSrCu5Z
zg=XYTyN^}I_kF*K`(6`Bvn<>98zc%(T)H#<I`2CN`^B!1x~ZB>@9H#}NW^y`nhkdC
zYHeWgalVUDSXW?o0NZ<$PfJjSokxL9HQ##j>AQs*gGa8u3UEnP%iAXh5t$`(emO$!
zyP~5febx|-ie7zJf#rBU#jRh@b%LJ;n*^-In*^5cL1;GM(AW>YlPXg0JIR+KoixS-
z9;5Tk;15D;HqXcF*PQz4Egc5$u)$N*_C>yZhQf3wW}g#-l^eFow@sv9bRxDDM0~Qu
zrv;bZtDT6?3TS=uobO{p%Q3P(XE9T`WIf|sVMmlmLW6-7H>lm}V@Txfqen)Fc-=%`
zi27~zy#c7$_vYIwK4~06gx0zw-?Pf4Pr8%h*#c7Cj`?OO;tnTbRsmyckNG&oMEUy+
zbfRVyq*=Syr<Kb-I$cQiQ*K0j>Ejh+s>+FY$cexveDJMrgls~FVmA@nv5RknSx3MR
z*CXhaOKcRUACB=g5vTVzH#8!?CWZ)sVT*lDQbYs)S9!iB)EJ*&x2&F*edg(h1^736
ze9cv8`FB<FnYo<&wCj!}GXu3A^L_oJI9pEo9x#3_;ujs|OA?cV$o+Y+A&?XilcGQ>
zXRw2xRL;~3Ke<<rQX_ZsD3b6;*7un?qUpPzY3eIw3iV#xM9Wvk$&rrYiJqBWp9=eB
zA4mOI3IKfjtW3{&z<o<<6L?uRq5n2JjK>q@Gd)hjkrA8wXr?D$Mrn{jD-UIQeon$-
zF9ia<F4r<Wd~3+tS8@`$6Na3t^5hAI#!t&DWqLjp-g7SAr^)1>H<ysI`;>|-SQXfj
zCH!7Gf}ZKo!}76xGCjMQ?3G+978Ke_E@A=7i#la`mW%QZm-6!e?TQz5D$x&$Lo+?^
zz?Z(KL$Z#8BAK4&l<p@t-E)R>0?ObyFv$SK^cOPC+_+zP7jI-)mvP~ZWNhu=Rd_qo
zqqX&Z8vIHUvXiEO!W(Sp6%tE@x6Kr=Zk<feeM&XKO?6-4RQDBd(fG+skCx&4z31X(
z8r>xz>Y4S$g-czlC5@jH>+R}gdhSx9Gj5{03MY!(^}ngw)iVM;mg(t0s{T?Y6{JJq
zR2}{|(W3uH*PFoUT)qGQ@8!PDV2r_-8Dkp^#+qd;`B)}9Nzzm*NkWt@TdLunET1Tq
z{T^Es6*Xm-EmVr4QYkGyrJ|5BF?RBMzRvr7kE!qfKaa<C&-<KnUDvtJb*^)r<$cb1
ze=nl<*JnCyMRc=I<SnK9^0oap(fjMIO4R@RFJ(F{MddAC5h$Eh%l||5lBp0x(t=sP
z4SrTP6js>{|5kLPu_8+UGt;RF(St>NqMEu{s-Svm8Y*)NBh$Zj*w>~^IQ>uA-3=d*
z#27`(25@YUmg#6l@SrZ8k(yEpi;-d&3a{SUO#5%)P4n<<UE-^ZL#jIa?|;i%Z!LK(
z>7VIHQq!3~5|`;j85g5rL8ep68x}~0*i8GRcyIT4pDZMUee&O|8^lVWUY#>-xq#4v
znol6PeYB9)?W6zJdaur+O1PG3AA+iXTc7AqVWLBZ$P?WDp^)JAk4A7`nKI3UYhpLK
zOlHX5D}FP5etQe^+gq65Cx!Wa`fq-d%NTx9nGB?0ci3mQwJ^J_h1tF1vkS42C)3{k
zfA~d-U!&+uTd(;BMEm^K6xQsTg4(^|w@mwW;pwIh=~5TBMa;^Uzwx|7dW}q5{px^T
zKHjpz_Gd3EKy3IyrmgpY12nu6!}*07&Nq1cXh0#;Z1{nsO>32DKPRI1e4^(H6Fv8D
zqO?{bYFNEaru`UH1N8z+S?SW~0@)w?H&yjI;idzkI);j5+9O0Y)Th#|&IME>{!LZ6
zh!L=8Ci4!6UiOIw7bY6~Zz7gM5wIpEC*L^mFQ3Tx#v<x7qWgsHfsAkWW!k2b_207?
zmDDr_meM5Cmcx8VU8oADx9bIBX8t?JlqM#}hca!w^m*uBpXiptM7R8#sOFsyi7IJ#
zrmb1VLo<A;j)kc@{+lXkw}`6Tl4+NLXi!<7sLXYu@Tq}O8Fx*{w37=Pr>eWkEq<45
zH}Yo^j0~&P%RDbmS{kRM=M5vCaWCipoq3gd;r~7ql^&Xq`M2TCaH36qrq&(IG^o)t
z=*$F)_a8ojb3{?R;i;-c)Mlu<1fnwNQ<l{-^OWWH;F4utp)B)EmO`p9HuE@0gT)Y}
z<Asny#|yBMs%8Extm+<?E(tuQSp?GmT!2*lZ046j@?H;Qepv|VOM}EZNT%M%Gr}V0
zl>AJMl?T7*@!VYqeYZgmZyLmvUHdXU*FsdJJ*DJ}e(0i1HP(lH$(L2WF4Hnr8%r;R
zZ`U4~%i59QycnaYSB#=i=lE%vud=J~Vawxc{WVDZNI-*|Jq4Dutl<2rR!!^P5t-wZ
z&sI;)ak$4w*~c|1$R|8(a8%-r6EZa>Hp5J6%v=kp!C>dgnd&^vK$6<i@{~2t&-&P2
z-a3v5Zyy|$-eO<o0x$DU9Kd=x^AR&-ChLRxvV7(vDV9C-h*pq#-<F9jTkM^4ABiPH
zT3X$QnXIkJ?0((iN`0K!2)Q58c$u1QWPB~pZPGFuMaI!xE@w8n(d>pnp-Z35RPXyp
zmPb%C%`a%#UovY_P_tDHf|{L0K&i^K%d7>eSDSCVn^{hil}9#v)aA?ok7uaMX=W?K
zhq_#g>(u2vYAsw2e11V)+dNEJP)%R(9QIVYt(PHHpU$&BZw~zhO)ZDyr|FyKBq1+O
z+xp{6;G?ms-E=$L_7U98pHTgAu@-~km(uMTWO1+@$8WK&w{p_$HpRu#vi`(c{?xUF
zpZE55W)2y^Duz3ADx0mmo7ZjgQTERVS<cU6$@mFBS-X)w-)6ZZz9;g9!ja#==xYu(
z4ap_enOPJ@W>sXlNWQRql6MP{e1Qory$qjU!m&fBzAxC6o}=r#oKY0`c7`R-q)(wV
z+N}1;R5+}b4u<E~G&-1qAxZ^*Qa695Jz`Wa)fl*nLHU;SPuFlp)963@0e#HWI{k%6
z+*8DjscZD4>CVBB^prZJ-vd_qa^Y+weKn8^uQ}hO?*vEF^gs6jyNDYTo35@*%L{*=
z2Bg#JHPZL^ar&yjDVOW8bTP2i!*YjeFT=<Q>0gr|p-%k=Xw2%@ezy6K_@240sQ_la
zMC}2G?a#wXRvF58D&6LEh*O`+K6O8EpH{|lN}`oq(5(0o>C;$18<x!)Kn{7FdIZpt
zTMjdpQ;z{!a*H3q`c+OdLX&}PzSNx477k_yeEig4!xFl-Gp7$}VSpP{+?<{~ybLTQ
z6E0o}4#~4V{YJa?_@z~+Z-e9T=IlBT{uivb0Co^N!N+;n25ezha&R^eyMYfLx13^i
z4Jk_!hJjT&*r^!C@oB#0M9s7sxx@0Qe47n%p5^S4<$QX@au@9&pW>t$gF38jZ=Z35
zJi1aib68Ybh!wp3Lo5s>KAg@($sL}B@N4h{rw#&NDS)_MK#B<a3wfuG5c@Ox4N${L
zuNe&2$&LTp3_j)32{nV^tNmmnS-NM_q2V7Cj_u{OgW*3D`HyCR)Su><nvPU7Mi5w$
z&JjRjE8<aT*`v%9k_nrfy?-5H4;^t#h)=)Uv;}Z)ls`<rn~nYQhantGUV5cS;`b)8
z5;xrrJp#{lAEc)ko~8>(uM+73FhnzP*AhbGp6QHctWrB!BOLLvSv*OvZ>*HWsV}5A
zM3<PpQg?c(Z3?A^+Ih*Pyd>VYVBQ{K4=;racC9x54LS_TcwoJCDgRrlF+bX&Hbo)D
zh)Z>x2mUfw*#@1lYDwrQuM|)c50<@^NWFejB+WlBS!>6k_2MIKk0ObzmSqN=3@<DD
zc?_|5wz8VA%F8OFicy=DcN+}qBq$-ze!(29D?KLY+(k<ouZylHylYv1!6lE|y_{8#
z=h-><LR`+8ppy>HXdP`?H4U6lH-2<cOzGWR-mz+qJM*-K<*!;w^gY0x3gq%I1kiDi
zRhxKt3>c%pE*@}hfBjd1{X8rIc!}Vw`kg#ym^^=O_<jsoT4cGp8Oa|5A1Xit|0{He
zAKjC(x-t)c0KY4MKzJqVuPX}RyG|zoocVHAUE!fNP*pPjOtz~TBb>e+xQzm=zSW(1
zm}?uH)l=|?oY`1C6SREG9kpGkvp~BaxKAlB(hEkjMm8#1NeF)WVPH@o&z_&fMSW8&
zcjR||#VBs7ALpL}pdH)uSFn+JCOB%^Yq;gZT!4swb5@=r)p(~e@eNnetVgv(_>~fV
z48S21dp<`dUcZy$4LVO@Toj)@vFB%6j`?L^&~ORw??$}|;Tu%v>4`vgH3FX+1j&TG
zaCLCA($zSuKGKAX6vRgE+3>M&8@gxX^mD+okQw<0S&vXqi9n6w7VMlkNO>Q*eo3TT
z>_lHh&QG=Um2-EL*{M6;Bkk-L9W_&KchpYtd?L@DF$e4Wj`}Vu4xABIMmgNmapc=@
zpHXy_&*a&&;^gqkR0%rOWsJut;U|lbiyApSk9sXrpBnjO1)=wVZFtMCrb0Cx@2y{^
z<t3b!qI?(1ujYgEJ@73=U%kS^ufP!n@SLYHqtl#Wb-rS4`SdjwrB7c?h6`<KLlMb4
zE1Rr7fY;ZB<ejw>f{&$_(JB^gXx~0isWF6W9dvY*a_lc;zV8RiIuip#OYB=PynQER
zfn>N3Z*YdO+L_7(J_+z}6VQr%5zZ(0gfn*neCNygq!JGg0{1IGn>aH87z?XUnxkAr
zb|8Wd>dewfERBECGtZtqL(#O)Gd}^}qo8m8CU%e%#II$=m2gIIciotuknvjvk7q6b
z+@IuptIs{;2LYFwojt^;!5zbrxG_WOYW8Tb%$ID&!l)hjprzR~a>nZJ*yt1@o)p@2
zk&0|AbqTLoCsoIwq$$!IA(AF^K(?jQXQMNY7=_%ihPg2t@9e6V+yH(ZAZJte!*&a`
zC7OlkT3XJRuaLk=8h@`jYB4F@NV$y^E;-PV9TUd}^mS{AGq-e^V>}Tlv_ajTU5Q@I
z<ny8OY3}Ev0&!jE=V{^CvDoMpf`^PUaZmQXpi>{=AIGse+o|k)7HjikRpF|#?TLgc
z0LcpQmPf<f{2B@{OUS49%Wq0$ZvT&O7u!1#b2HFMC^)YCz5pk?o$a`${Bb}?wZEO)
zrzUdCm9zaZcjgrHFiGB7F)z3?C!3gso`r0G4Jw8)`4eR!+t=mUb60RuVI!TxoIE)c
zewju$8jcrujOONU+ynAUfIj)OaT^a`17FZG=HM(to8m1z<o10O5epeNO~QQw!ZF}i
z1-|9s44{jkwjZ^uv#`&<;yb>%*`|3v*@$_QJFW*>ljA#E8i+&DbGZoW^*jA4Q=QE1
z=2_vm{))sCg%rt9gcj<K8>dLLB1$UPv$;{^r`lxjC7T<!LP*BupqI&ID4CJ5aa`lJ
zdC4ZT7_a`veM?+$v=x0V+4yapi!~oW!Z_Nv<1UgKJ=!XopIY=vb%RjPATY|8^*mnA
zPd{0ZUf)RAT<PJy<D%k2TPnhEg>e~A2b~63P*wwUv85h*s0vh&1uaB@Td<L{t$~&b
zwCAB4&{=^VJPZN`QtMlKdzHOK5%`F+V}*f(I{ON+Sb=OFz5+fX5ZdyLWt~d^<c+q>
z<KYotFcrIHJvq}zo_t#=8;GTEIX7A<?~<~M6dCgtyzjZq0PnS&EuZJv^H!jCtIX$(
zCval(2_4|yibFidAmH44D%m+6J_A1C>*!lTClvJqLE6x{Z_w_%Tu*sVsEHR+y{XE1
zoBTxei2u-h$V*2mY5s{N|JFQ(7V`t7&m?`FYU?S_h~^#kBR_%2JEy|Ep{l5PnE3{c
zyJDgzHJ)HKsGnxp3B2d=donRx<QdPCu4uhpFC6fxoah<K23ytKLcRS09EJI{teD2L
zF#OPyx1j)8{<%MalVrMpk+`vZyNM@rZ`fhuPYzHP*toK#!I?PY?y^i=7~3&%g&ZB<
zAn@W|675)1s0Hc7sZeZuwL_kGu$)V8rdIN#x;Vd;Jbt~E%snJ3l252eo)mMBd2v|*
zk$A^T$wTr<7O=CDgze=!udbi36WunV7K`&<&W6T$cDR8Y5Wkk)Jm@rvLn#{=vYopG
zTu>AE3ESS#-Lvft^l9g#fdKZmfeGt*I<NEP6d1`vO`y60nE!cnc)p<m*!g)J>iJGg
zEEgOnuik2Op)!Bg;b5|xrLW!U8^7oK06Lqtkks?Eh4Y$bF2HEdQ;+AzP(k6o>Z4R-
z@1oTP=7cQGlY)mcJS~pLUqrNMZtTO?K$^qAZNsvNwgx$)!b7q+2YP@JQM&N~mx4|w
zbT|G1E*t!bA<B7)ojru~!$h3nWUGC&4xy8>BYs)J4?10-m@pNJqs+I@(^Ajt-k<p5
zL1H=*qPd>mp+HX_XnN=ODxiYml+XVZ<c#%EMz!b918g?7Pp-|gXC|5HW>P$3BzHnL
zn4jEhSr-_gTwsiDpWMMi0uW!#Qz!VYp<-AOe-p>djW#b-0Y&GVrOgZVfx5mnFSH=g
z9F@#WrMLIgX-*9Lr)D!K8v2|W<LPsPZsG8((jBwYA1{cyKeC(q2}Tp?uj@2~mf^?@
z%W{r$r{e_OPih94tr>v8@Q;;|2wkkz=k8F@NwJ~PyXy(x#hK|^N;S=)O1(_{vQ9zg
z#yB(Y>iS{OVP6@jY=_v%e{(rgC~&u-DaqBCLys_+9bsAjSr@dgu#S+|gGOgowq{pi
zg!tWD6NNUCZVcMGO(oRsDOS~-?_MUVJL9JB=%qp2F%QJ`sM<=pCum;-F?)cb*Acx-
zRg*NLL;#a_vu~%alSW|TJKja59e{SU`c-)bk%b7*@irygzp0@Rs~7HSs4pPah3*=-
z?f5CLlLa#BCLPOgc3^iG`T>2Y0W0sM<?fqC(n-~T(K2>_6ZSWU9ZVqn1>fIyB1n~R
zvrtrOiGf5jY5fZ~^ZU;5pioq`kfP*!th`N{IY|4(@RgL){(2UuOcN+WR?wjna-aU}
zKB5<zXvR@VS@F)6pvstq)qcGaxgH0`G$XK)*q6weRT}&2t;D_nJZspV%(G7C8a=I!
z4>@n)YM)+%-F}TjxqyZ*EEC7o&>f5-v<=`BDfYp59zF*?Q=keDbWIn&Q$WVcG~q&?
z0<^P>h<xFy0-Xs|2Fg*KANS^2XR=McU&T9%XqXd!cJCnm1PC_*O%US8|MAcr(3Cpq
zD|q}!)4TW}a6bw?GnrHAwJrClXQXio%L()|OD*q$nKNiwXYij|7ycnTD)HU}mYchf
zpy|7^)CL^W9av{@&L-u!Q8y<K=(dVc^~&Ljmo_o@f72L?nhYjZ5BGSAO9b<&9A!8$
zL%heqW>ADpelI`i-v67#YSr<}P(7(KcvfTlpx1R+`RK@`FZfqFC#exIf03WOgZ=sc
zpx4^jLt=t8<*yc2xX8q)N}-1ddd=l*yu(2<cgmw^`XGoG#{#3J>9eY>DTJm1*$T|!
zVFmE2s*Xdl`TJFM<;uo81F5<xRa9AG@iwpq7UjySvc%#`;1dPJ;t$>;Up$U){&5vN
z<eT+NtBbd%Aj+f#;=|PP5;k+mraJTUE&Fi1?kRZl>pbghlFH1lp_s{(Y|^i^(>Kq6
zO_y{jMuFcV0SbOLC2~zcq{bQku+C$cF-AeqCh_(x#$S^eOnQteK%X38WCCK8?lV%A
zMhv7tEc!A~GCZ+niyIeNd)#WnEiJ;0K<HAM*meH@VyF7VOyAlE1NJBxlU5uCsyiJg
zYZ6BOc=5r`lg2*JMstznc9M)$V=APmuN~yKhO_ZfpL90avy;goh9!f1+d7-$M{@h}
zAkUu8uCR3e$(<6XsLnE;v)hE_1x*vnC&Dnz$G;w20<yV2X_O}s!Y|{B*C{<!00tJy
z{Fvo5=}+81-PP`78!l%rSWbFZ-n!98PNk)#${6@%VjS<x;9}7!-(U<UUqOG(0j{yN
zPtNC|J<ztAcSp#XG>h9S^lJs;Z&vNE75;6&EjUPB4|3^YV33y$i|J=VI9UG4&63Yd
zu>RXktkLJCF~BGVhVy`wm#9ViB;MxIbl@2>)kg}?q#F+Wl4%ch;OiJ>T?zwQDc45|
zFVRO`T6(=~&1D~FD25dsig#vXxBp!y))ICVz@n5_I9&6k&E%sCP|mb8`SAOX!tDWN
zSEO*?6ZrOeKJAST(U8ifyNjR3kiBf^sxBQN5Hd={KVQm=<kQ*Y!|y-xxdsYnsEiUX
z)8Z~Oh@nBA#&?8&p;AxpwCq2+kwq(2w0DPzE?XvLzh}cw_aMb?Z=#NPCj9gxnvd{t
z4r9Z#MbK%yI?(PuO%j*GX!*iALsuy)dRo&He~hgx7zi4Nc7}F+YKxaKa<`(t`iP8=
zsSNm<uRlfJ>Hr;+(N6YdddX~Y4)G851Ra;MJ^eR)o?;QkeyS{G`-`dcO*yj230#o&
z*Ho*B`8DXUb*I(?b3$4DR2BMkgU(=MEAL<anqd{eo!k_3f}lP#sEi4ah6}k&C0=gM
zgm7ybW#;xccj}{zAGR`gz1#!nu0_tR_vTsW$Qy(Kjo1O@K65jJ`>lgWzaO|y3<rp6
zG$F>@mj^3AX)e?AUDo>XR?PJB^8g12ovmyVJ(tN?#VYq?qy4a(c2w*_+elvqEKz7R
z54h~hSfjIbIS&k7FYi`PPcn_zx`$~5tln8`SkeENo7rd!rJF{>aNaouE*<n`-H!Cm
zFFYIvepBEe5Bb1p1;p|ia8-dFl>bT`pbO5=^|kx~t#@Phlct8Bpnl$9pm(?@7|3K*
zX!H(Qe#|WR@T2;fpr8JX01rP)p%3T4ttn7n9M@aU)~{q2V~sWGn53eog7>PTXLi>5
zDhtfkiMp`HAkI;pf36^dYfATS<jV3=@cE~<P!CLG%?kx#xAzS5na1Hh)9Cci^@z;X
zyesTR$HTQ1LbL#va>^W?t!)tRPM{|dn9JLZFqfU0#*}+4=oCSr)3vLd0BOP<3TS2F
z?VE{}1iDH5Z7k)=Q$R@8^7aHWIBYI`D)(VycAU7=xf{fJ`&kfX0MCozhaw9TS_CXm
zfSSMZI`FCjxSlKT0b9gxOP+O}?iH$ojoFmsK6^myek7Tyz4D_1U-EDsIIF;J%ev}N
zn^!I6bP#iS`*+V=Hh*bY$z1+u%sAP7b~6N9(8kpgKyd}g=W2N%k-+8)Jlp`(Q{W^I
zOnI*AUE=1$JfMTC?Wn}_ssFSV&ACH^)DfzR&-W;(;z$kuE{Cf+JL1*wv)6ANaxgNb
zT<~gmx^umTnJ*jHGrg+fG>nUMskA#~6z|u#-N>v8jE*4}YW!`klsk7oIZCz63a(O%
zR|gY8jjw)-8fSG47mDkNLMJagirNT}hSR?~8OWx_SMMRVHI=E_TKx&JnD^CrhR5Gz
zPEkPUTF2IHDlcS)P?FwmUS+g@^%ZgC?hQwKzpm~C816f3YVbfGarH|D8e7)ih;;Q5
zLan(e&$_^J0#uLJvDwh+KL3OG^#!LAkfgxvJm9_lZYt)Fiv`8{TPRv>53NCwf6oKB
zq|#aQG!GvF+bGGJIS|mUo_|LvbBX;EILYF=zDIxIkh(;E8OhbL?_kLE+?QmhH#2`<
z1};`3@TtL|o($ggH!}+3n)${43VrL*LqoY6QK$9@>5PL}bYJswo^^3L&)CrOS_)i4
zL%3EJD5bz#JTw6sBAqTHzqnK#DZjY>IyT#*+~=Dioi0nihB;pAf*o93ZaJ@qjFHeN
zWf>P|=$)3VW(*M$`v5e&{(0U^<i;P)R0n#I?r!}QQZLr^4DI<RM1mPBE)(No+3oq~
z6_@SBjrQYSBhF?=xLL|qemhwZFfYvf*c3EQuJBkth4c&4m4O&}zG)OvDU<UjEv{xE
zlfU5Q?d@Q>!Z^VfG|yocVx&*<8pjJ-oQ=f!GQZH0IJ{`c$utXBqmAdL*b-|$8r|;E
z_`;e7vif_n-YF4K`Rc={@owM_BJQ)C+-7v&bo!Lwc+e@TX)F)Kw+CkgFa(pzWnh=g
zjO>LqO2MIC3#p<fs&(YDIp$J~T1WZf4Q<{@yR+fu<jw^_p!=E27Z=^jgmQru3g7~-
zeE_iP<K%AR;Vf_pXO{bsJ9Cev*soz)1}MS2VO<uv3{jIQpW4t)W<kiE(MN;6FbLdO
zY}IZ=V7X$RA@m3^7?oTarz(^(P_3kWGoDEF1fS*&?YcC*nUj(B%^M-W<yfN?sK>)}
zfCVe(P2N;nSf!<-Oy!#+;F}%rwj4WmR^4ED1&Qy`@Eq1Zvmykmm{(eBfz=B1<zYLp
zO@T}vJ_2?tz(mA40DPf9OCF8_|C7vz{^@SBO%;zv{z&J1nFT3&=Y|)_a`69u?`+$}
zA=TBVmsz@d)65J0(K}ye9oO%jBd+@t)y_D~$^98YTFO=Mi>qj8(_Y<~a#MUM5&v6@
zpPGbnFY`cuZ8uWj6b~7IzM#v5!D}RLM%UCx6+~F07clyItP@~8t3`zMEzoNKW;pjE
zaA$;be**o)c~GSN1!LOcX(G&NVwZR&t3k!A+tm)d)z1tys!J(eqnh=Qmtf+WdyZh%
z(~2`MTnx!WextjjF$PXy)>6{#8%;LphOjsGXHxv3u#(1_#><QaCjiZ-;^{T$OSwMw
zZ{ovZtiRxFU1F)k_z`A}#JZz*p%C?Hx&5iMB%ak|a|e^Cq6}9m)e+k?7_xt*#jyv&
zo!vEV0Qc$!ZQUnpFDi=X>_dQVz4TI@sppzu`&A!z&R`$+Rk|62yY2&08w(dbzU>6<
z+$77{bBMrOtAqAi<#F7p1oqz?v{&KR&EC)S=Yn?lr&&>nX;XssS~BD-v%0!0Xs=U1
z$I6O45wzDw@E_<GPMOW7xTZn-J0WZYA?`AP3JS2HWsb6_-<ix)S)Tk;dtBx;BdYpW
zL3<OOtheoDPS*!?I3s8uL@Ewvcw6m*_F?p7FY-=qcp;tKP|-g)ALQJdGJ)aTP@E^^
zqSD07Ll6n6E9YSka{I19n<EBBr*miedTLp<kWO1Rlb#@a?fanJid?OY1ZrjxNEH_X
z(cK83PLmS4NT8hpTy*e|l^pcG2&)r;<EI7f47~2#nFOYV!ne(dD#w=v9+?xB5vm)s
zbuz^JIK%Fs{X{8>dl<Z^+k^HL6VPW1qH1)bhaDC)mj%sT1I40O2p}-^PST<mgXXfJ
zx%>R2($u+^bVqG^8&;C%*?y93lBmQ7EG&x~5}ceb$*^;cplxnQFz2@>4hx<&RBfr)
z#Cw8gY0C}k^E`4w@N7-(T;drS^a`-_(t44tvf5KJv9E<vZp#erF$@lQh<m6<vqP4A
z_SB%nZDNKEc`&?kZdB*c-NCOI?#(-dDa`wX0qqSR1a%ybJw!TXOX!prk|v@n!o2!t
z!Qo;azRhDkyqcJUixE9al-UpaL{e}xbY>512`4zlJjaY0G1>~6eNNgZyP`?(F>~+b
z4+I|F793|Zu3U$_7JRw{)Emta(`S={J!CEemFWjwrah|onI4!F%q)~?pF)}5UntYQ
zk$5tFK+no^ekj<_?ArZ7nIisOUK7x{*13~{U5t$?(_g$yyI_3OD_!*Mw+EZj8_6r=
zl#J;&h9;?#Xr*@gmEnIYV~B9;KM<@N!BvGW-w>=@M#V8q!^6VNu?`2TlNr3(5$d5-
zSNVl9wrH?=IX!Ey*T+i&<|7{3CmT!H8lt^kIbYY72qb~XeplP3PqqJBWypYGMEYCA
zZF?D!FPTrt2khA5J|@eicJAG{`dDVFi+0GBj)Lz1&XxTdknO?{735rt8wD>rUM(c<
zK|Nwql>c@P@x2{5XYgPmM`MnK&hIydOFi!l_s(H=#2zx)S>K3r4h`8X(%4slGpYTp
zzy)6vhmnEPPz>+-BX9(UrTXMq^%xj=-_DqSpgzb)utL7%U^~Ns`|Bgq5n9x6O5yAV
zwtATyN%Jysix79I7%Lt1rfL;2d^snod?+^XF(q1H$HMPprfjA9#KPy}%Hk7ig#1`-
zWTQkW@?qdLUzELBM4H<z7Yw_<e?u$qTC8a8hwmSyfDywU><RE%Enk3+6t=ZW$#;ZI
z)wtuB(7Gd1$#G{S>J4I+p-XGl!N5Y4<1ScA#kadFu#gsEzKJn#Q(z&@EF#~+28Mk@
zbiE)jRfRbY!3~E3Qz?$Q2Vh55U}{C5xO?lsR1{+3A8Z`Bf9ij(bDG-4a3b$L{Q?t;
zz-nRn*b$>gT7d}(Ml-tYGcbX|8DpFl3QVYND9}y$MFGyLAYh(V;tB{Uvc-jc!=n~N
zRj>9PW%^q8_r3W?Kn-`{LQlehrcdB`M^<?2f~czHJ__8W<gdMC_9I3L5I#q8Xh@(d
zdFUNm33b`VwiYGUm&&^uV<ex`z=`^!8WBYcjX!MJf$Bg-Rbcyb0k5xt!Sn(K4;uz8
zVIb29F!l-bFbrD4z(hSu)TH{uLRO$99lR_yuoKv1HRp8p+kyH<D76^m&NvfbyAN{5
zO04>(qKGb1H&DNh7maB3an{ryEwaARc`0sF3p7+KNBIc)*sMS`nA)t{a9=!cD5T9r
zEiT-TrBpK|wI5C$VFhYp6Q+oa00X~^vdZy5MTx^Zi`$USN)zScY2hA=IA1@_L^2AG
zdMr>`%g2l7TQ)1YcHo)<YY3DB$|~>*4~)oz`i5rIV+<7+zeA`4&`JRsSa1OF0D0VI
zS$kg!ls4Itbb#V+pBN||sobaU43w@S(+Hnh6jd|S%5`+`=S7{VT|SmTnhqNfDEkY6
zM(|Vr-sLiZ&VCnMrk(5D30E@?YLn(VcY#5hY|9DarmllgxG#?M*>$BWE@0QSZXtGE
zL61KiqK6f~ZiV^XQoyfkqU-2&?~AYb{Mt~1hM)3ngTu1gkRtKg++>sw*PZ`yon|6B
z<P$ZcxfKvKt67MsS%?Nlm5t!$oqn#<fbsaFCrLN$Wl0-!p?n%p$C!d0WQj01hDhbt
zfd8uOAd|1)?ACeKNV9Z<msV%rcC?1F1)o#lH2_(pm2sUkvbcYJK^EyR`+1~A^1$eW
zulsqVMe^83<R0?4pT+HE_k?%9$Q?NwTqlK6F40L|NtvQiTtpiw^^J7h=(+B69j<|J
zmt6C;kw7~t&_)7y1w;v^N>q>IA99@-h?b`NL@~IT0-_ki;>rV(q==Z75yd~6;5q?O
z4fd%5^f?7o0W-Ssi2^Mm@@@Ox<qbSU-qA(^k=lZ}eT5c|mJw<BbFO_xc)1>nkbQ<O
zm9!gicTc$XFB<qP)tLv(*#3nyZdima;|<r=rHo52$Mv^(EUUI2r@n*$@|mIf$O*2^
zDm4Lh<%!!}U71IxkY{aXRBV~!9xt7s*waEJ(adcZ#}qsc{8)S7P}WH7wOFR?p-3W7
zGRLkm3RmsgZ~Hw-5#ACMX@bFOJAJ7$W<Z!-i<@1Wxb`-U4YX;7@TZT5H!r0pyc_hp
zn6hnV+N8J4FL9woWGc0J7uCu5<|Vy%<CWZIY|Ue+6_714mb?5hVSDS^-kS?1W-1!r
zBCwapHQ=>Z?c@Jsd8C);*Y>1cg0IvlrAWs?{Pgn+yaYAL%@&ykJmr^niDzMUk++Ck
zkz@O1S^m$m%zufpd<4dBBwNk;S0Tx09)t8!WhQdn!$7;QYtN!}l<0w2rZa!}ufe)e
zglGmdRa5MT?|u-C&ccr3PuMyWDdo*cM*hFZfpvr;UuZs5zcaB_i9Kg&WL!1WUBAU>
zfJ5iHb{1LWULgy!?SI)lesQvBf2R6=fzAI+aXx+AwL|I!?m?4?|7MymzI45Azt_MY
zHYMn7+V{{|u02rgyJZ3UeX#E$^B9=u@sHvKZjs9c{6|OlGsa)`M)3#7$Yvg{NMN7p
z^8P`Evpf*K{4!I>imrVJxm?aBmkd?k^2hu_+)>8Qq_Sm4mCNDnmsO!3=`D<5xpprs
zH&U9*7?!CFQyT4e*WQ~*X)3UcxsW_o>k4gtnS{G`U%Hy*Lqj?_yzvzi9gHM8=>e_&
zUEXHdgZo%_aRo{}_XI-T8v|tn3Ay4s9PhSr?g>+u$VY>SYF6Jgo)caxx1)L!*9$yU
ze?m&UhwvgmgEIG|*S&`9==&@?`j*r&Si>Jh!NN61F932Ve)R3BM4w{(#{}4pMxN;9
zskHTTw0qTW(ON+9%3QNI!#ywMLtJznu$Z_tv)v0mWiiLHi&@0&jCU_m2nP9fF&5&A
zl?WBrz{|B`MZFs<EZWJn&28#*`^6|#v3eNc3kO|0&g9A7-4)-V2^_oml`60B684qX
z>DX8N4*tu)QWoai73cD-`zSBPSnAq!SeJf{_Z9BSk|5B`isdT6s=HlmGr&$xbI&;x
zE)==$A!duOoM#P?JI<B%yy3?DDSDIp18J|8QQ8udHo~OgoT7KRY;ka3Wr<mLp4-KC
z0q?OB(p@>;;KZ6=Rx8}Y)c>oC$lqNlY4!v9_{K`fe+c+afq6U}1GF__CCiY-t^k*?
z<@;6;QLt1rh@~bpK{S(_mE&Q&RW8doE4|xzNa;#O)o;`!*}PX%a%o=EwlGPPeaifB
z%B#%OSO9;cW`qeyI4E?wvO=EKCz`yh=>4wUf~DElUX^G#*y2S2U9z<D7RB5|h{0*`
zatbuzfu+jgJr%%aic|l^`^mueqlJ~M!WEwYux-~}If93^R>&@%D}fIYLwQ~^i|EX>
zD0-jX{}gSa#Hm0WjjIn6Li5W>2-of?`A(AO8x>&sDX>R@I39ijj*8i)>&y(7*Y^;)
zpZv`~e5Y%7h0Thdl<f7NAb<TUNEwM2XH%5>Iu=LQZWq7YiU0-&DQuK-o|I%jpV;Vg
ztZ*(;cW=KYR<Mu4ykt-url;Cj!CM6OR!~|+=J}Cx3RQ-7T(i_pE_k{XE3UJ+Z<~+(
z-gWFJjn?klb6o`7lM}73m{I$_O|Isk?Ce&HiG9#=kEnt68L0J@7P;<s8VRhdK%L`m
zzN@0H!(4Oheuqopnq#oOXzT7XSmQmceKd5iOvB!%iNO!VPnzfMOIJQTubCa5u_CH!
z`3df4p2vYn?@cay(aCCyVG{miMO0#Fp1TdZv)aVUJ8ipBk8+2*D!Z$wpP0Txn9Yc<
zm-XD?Dw8uxuL)GEZzNbH2{saL4Ya5)POFR{1bYJAIsO<k)u;{D%{#k`VO@MOM2A9h
zwXg5-crRu|STzNLp}+u-_hOC0ejq#-c;OK(PPj{pS=NW2)5$R#c3;9LXb2Fq6X4yf
zG13?e5V}<Nb=k=V6fgUXIRdEB%RWm)0l}u2PE4jmQ*CO{L9bApQR}q_^>C7hp{jtU
zA@@1y?hV(|UDE4ZYe@V(=iEsqzNU$HCncJS!TV1_De;G;%eQ8`V^rY2l1Sx!V}@7W
zF$Nhi;(@sOsBH{mUG)Pc>HsxS^&LIk@fb^0+Ifi#pfx_OxK1U|`Gx5H21hYw@0{8h
zEs;~&Z|;NSbWc7xnMq%+<K^@q!(nN*M0cR8a(YnWDJQ03B_7~RYc8)1APnF!+Pe(T
zh{27Qcmf#5NdDev%kFm@8DGyZB*kQwac`9Za+77)w|c!1H}_f(pLLttHW+U`=hiV8
zojn!RVZ4m(f?bFCKQaurtSKekY6yP6T8tUz<SwN7-H(UVzLwkx<g0GKtzMt$VbUDF
z<q@*(&lN%>QET)jF~ia)AIH3y){YKMYYMl?WptM6-<*g-5(lQWlUZT1C0+m~5jQQA
z)~=x+_W^O6&6(%4_E?t|iAtOSPSMG{IT3b8EOtfR7UG{3lh&SY?@dnFxo<A9>{zTS
z)>U9O4{UmlO~k@(I~mznH;N9yd#{Dc-^?ZHf-E&^Qd%d?sNZDh8Ov8&W9umJ4iC2i
zUC@6|^l!c|Ma2(>2miv`a-*U{x1?p5Qi>oK4O6%b^lFaHQ>ct4rcl)O$Nke<6<}(O
z1k6?pv?7?T)MU-q8{+LWT{T=v@9N&NJj@p8D1zC-Ota<MZs;6JYgT}&d;MYB%;=V9
zvTx?;l<H{ppR|SslQJ)dm+>lZ&GJ;=FxBL3vwCL7KIEysk+1sLmxx=8Io!4yab^M8
z)VMRs(&t=m3o*BNOLGm42F)#*yDz2HHyJ6xlY#>lDq1H#74%?Qok-$7FR_j(nG!dD
znU)qw)G8SAr&W(ojysuF-A`Oq#7nGBVhFyJuKTXEswNeYrbA*{->RFv(p8O=ZUZG*
zBdM2OuS_*!JHvDo?>A_hTt@k!_f>;UAJ8_LTJidTM%m?Vu$A&GD?jCKs78Er?4S^j
zyq#Y4tfmferD<=a+muT+csqrcO3ROnM&7Jd<x-pQjNh{wohVl$N%5uycP*D}@biS9
zZ16pt3I>N~Xe%;sj4Po!Zx>T8Ud~nB+3J{^V+UE~;%OMGV~hm#!1%muk}1bLVf-gn
zU&BdCt}7DcsQXw_GIDVEAI#DvlM+>8gE=Dn%qkA0Z%&HW+Rs1{KX1MVk`ylm8iMWf
zl5|0mmzwLPmQo#=)G6Vl=z`Rbz0_zgbp|5u{cnROO>VOYBz)0;W8qHDH|FzF8)6%1
zGJ+sdVay{9+Q*asn(7E#VraPCYId7fx!QoGI$p9Up&ixIw@-t{2v)qCY$qmfA;WE1
znY*S>>{x4IF<JqhqpD?fyRU`TnAS{!+48Y1y4KWGpXV~|T6ArovIr@<VvF`dTI3<M
zC(8TcLhBAKS}7s4!AohC5=oi7riGS`)_m$EG-ILy3F0^I-=dCcbWOgO!dY!E$E?&A
zbs(pUN8+VJ7JcIz^xC-CQNyi8-!!u<oFs#Q2X{F3SZQGGjSL@pRUj0?FszMn>hKB4
zZ~UNR4mTz__Wco^uhr|cqMM09FT+=xiHBqNMG6WD@+ZGL-Yxp7@3p!tPRRF=Qh=<x
zd8kaH-aF^mrcTrx*6s}X*mo4hzEjv6g}w4A$L^sD;BB|NR?{r8?ok-|HX;9@;_WWy
z*xgjTbqPLVw<@YFzjWQ?KL;AbHICicAhwC*-?=bmXKWa0VOegkV;h@UH^^t%zA$2Y
zA#Sv|cgA`#<k%VUdUCEhcB^=Z8y<D+MkX7*nN9x>Aq2N2aJ^jwu#$H}x_@Zo1VSuD
z!HN}#?qSES#omaXBZx6y1z%q-&7-en=y5mufjvZuPc8WTZ!8gKfj@{8yILMQyJQ2)
zE}2Sa)sq441}+ovz88gbo9j7tLcFF?>-COP;%QB;K)i$-#MYNC0Rp7sH$B_2ORG@p
z*{p7;N*AUo&9Jl7PM@lDb3=8;9z0Cu6=hmdo>eTLX!Blb{qB%ovM5>x-ypL~jsYG;
z-r{Ts@V1L+`1Uz09<#2B!8{mDjWF0ygl326S0m(1V@ghiyx6{fllQYu8-pgTLIHV)
zkVk)-S~b}(gMNwVnGasip4K<%N#{2edxKuTJ@TRRo0#bJ8@c~Rp`iw=)l<$PgQZQE
zU>#yqWL~R)bqIxm#enYBbmwy_xafLyG=nsN*>D&+!2ewM3}8xb2lSOK=sx%8?2`W@
z?pw(gS6H@Od*twumh-V8bT<|y<E2-fk8vBOV^3)8e5|R!4VDn8hWC8Lu4bMQa^5qT
z+$XLys*=l*Mh+NdIqy@6=Hluq&7Aic03sIF-r$t;nyE%qv2kSVILmp>h-~h<a8?!p
zuZ{4ECpy_AG<-sMGfTxhh=>yz@-}>eMF|>7{iRN3y!!$dids*Nb7&=sd}^puA>Kue
z&#$n1ON|@9qBNZw*}ZGgRA%tJccI<8jp0Hbvmdv6Nf!BrjejAF-HYxMUqITn&#rr!
zw@WDP4yBng^nAwdDLT2U(A%|?*i(t7v$^R``_>54w>v29)&i#ETG`!{CfD`$14`>w
zz;sL>yGw-W+vAni#pB5^;@<Ig2g5VZYQ6~icvbn^@6`t>v4h9mE}2j5<}r$B&ggej
zb~tY%=Y8L>+nW5q{-0Q~=ie{GfA-sL3bMPXG`*9c2%RkJ<+655lO2rWmDJM914-sj
zwQn>W$!BUrl1=>?q1!ha-uA=QEO#@D6(l=%_*ijv3k_p8^XezAG!UCY0AGNf7w)#T
zE7It4Q?@c|>d8T7AG~YVG;(0-Gr%#kq|Ft=-@F}FJES~_4G<q=*N#Edyhs+zLF3GK
zAY=S|7*red<yv845LTx^niiloR~|_|s$`n>sGVdADTW=5ncJkJxhTGk^POD*KM<lp
zfZFj+yQ~pWsQo?EvKSjiL;>24xAl#5Ya^m&^FL1Yw)wgH)mz%7g|?B=DQwn-?2<y1
zMQwh=V^dP;^Q;zHhha9V;o~mRZ*@Rg8DdQ;?q;B!Li2cFj2t&q0oJkN<^aztzzSE~
z+rTPD$}y}&tYjzjmRQ_)V3gIZy4FcYo7Ik(Z~U}|8b#wonKX^EiXLOPR{;uZDTX`~
zlyGQsRASK!e#~RxC7W5&EfMX97yN@sejz3$l6;hR{(*9#FiM(_a`+!8S0X6bc!|zJ
zAz8zFiOTG!O)|UH^?CD$SU$0wofNoC4oV9crPY|pAZ=%9`(g9HvOQRe)wd#>uLj3l
z&A#=06vlTU?YN(SZxvvQ$5Ol<_cs<~kn=#c0`K{*T*-BT8Xn;db}2TzmFh&!HwGYJ
zyV=$k5t7T52N%7PjGXS6BW8YbW2*Rtk8X*o9Lh}vUBh6rzPybs+ios%y;6gL0Sd4d
zTWTVZg%BAfKxUAM5TCm@Xgbd4{_Ijqfdv>);Byu>GExcQ|4VH`Q#bZfPQDOaEFe-!
z-mxD^-|*buEVaDD_CL4daA>{<4l2M)!cr`@mHJZw7E(%=0D_2MNH2&_;56S9j3hTA
zxwcPO`gQ`hDgevU4+8^Pf$7LM$8Y4o5*Oi>sKRCzciRC_Dt0PMdI%WLLSLt%T3~Cz
zO0Kl`juWoDEh@E0i*%!|F56I7$2ihkN^;ffJ8YwOJElNQ$6cCDo^D4fr1UGm63Hs$
zZjv=vfiEgXlHVu!oe1HN1itsh16SfTtip)KeTO5Qu8|JcTKcpCMXj=S>1%|p8Zn3X
zV*U`mf|#Lf1~t1;b<`+pv{kj*AhJc(9ezWGr97LV*mf<1c3_FJObie$Ay^16Qw^w$
zzy?_sX$9Nyt;k3+ZmLYv2qB}KGPgtoUTp;KQ|0cWRvmY{Mq`q=49mP_`YXWNaG6Je
z;YQ#Cp1|ARG<prSI7zq&5*Nop8z;wDQP*-bEJ5m94)86}_B@+$){abg-SR7ZCIC;|
z?5B^@f=5e!t#o}ED}pl@oSAIUedCZxl}6d)-3K4Nqapi0-#AJ7>p*A)OR0QF3#@D{
zcLbjm7F@d1=E`gU))`@(+t_%}Du-vY@nB~X$M{Xu3gzF5Un{<vUDZacwj7%vf<-G6
z9aGItQ?0jEmY)E76*$ZTc3viQkO``qHMqP2G8EC#$uyxIN5E6-FOvtT3CJ(RTLk{L
zs`*5y9wJp%AiBJA5kWl7BwlYj3_(Q#8Xloh`@$n&@8r3g40q?K3M_S-xWlFt{8~w+
zi$*hb+u6sz+pX1MlZBG3(nVRl`~oMYOW#@tjJ`INE*cvr-kZ@wYeq-bIPrd$)qZ<(
zEP3Am(6sd(H9P(;;MT`2dq*{p@e!<)@ek<}?50H%d?sFF*_FW7Rv4v6XvahQScL0~
z1ahdk^|!*PmxK%MPq1$+N~zaBM%udor&ZkbwETE9AAd}N`z)Jzr5%5T5oqgiD5ywj
zEKiH=#wE7yj0Cm9Pwu22Sp~*qqK)mnyN`S~y#sY6ATCmX9138ymQh#<c2CK_Nn{5U
z5j>P&ca!{F0pgKnLfQj&*qV1bn`@D;Irz_JXD#fu-Xv+H$E=}*(2Kv^_#S69?5qjU
z;*85agth2QA#A94ewm&p&*aGedsQeOhbHZ^qk)mw&)T&-Oa>-eT|KUC0!FZ7$uE?_
zPX~`h7{370bJaY?;J~;|K=}ufb4o_IE&zv*+k0GTIAvw=5_iDopsVXJih6H5eVaYt
z7yIE9{^jjeKnN7l>TQ1%gNGjQ3;7Pfrpwa0%F?>%D35##j`Vm)w)1}2wL;F3<0O9w
zY^S{*!Tps*Z)Ir|&QYq6J>GWNi|q)+Kza;P{Pp`KIZSr61g*p4$on!9uaGz*W+<+~
zqihCsV*=utz^ZdXR|Uu|;X&X5woAjap-;yK{i7vV&!<Popg+~Q@b{mP&7fx8zF=WV
z+IhRMeE8k>cxf@B6yee2I7cPf)tAa2Q4O|ZfguVomrYm!EM-TVJ))I`o<?-#<(g_0
zLaHd3pKPDO_wSNtR+T2;H4^r!%DAD*)Ih@ji22^K7<`!wbJct^_zhXTlkGq7UtUHh
zK>O7fA(8(HSCt+6oXC@LdljIf3UEdH1}PO|n1`!r{zJu%=#^*P6wR~o6(3X(n};E2
z4m47LW|nv-&_g^YOO#%i?M*ai2>G>AlI<UiD8fWviNhj1W)a|^5oA2%0<WV1oyolk
z?(8XZlWnZi{XoM^4&~a3n*hyNIFxHA?gHME;=wj@N8Y!)%R&sQjPzNJNzTMjVpI<w
z%#&GWW!Mk5<6k$DWNht8xDzR|=*<!j0AFA^wkX>ssSx_L+9$tK0<p6)NIwGn+=@V-
zNTR6kC-xNZ2iPHvYd$3P8v?zQ^@rmSyW^LZ&8O1sM9xmS9qH|pl7M&xe&>OqR#F`e
z6+|g>wTj%xca0;-x02k2fl0?7Bdi`F<{`iPg@E3z$Zb_>Vl&AfR@DfmY{4+59m8P_
zV?OMm?zRe7NLlTedUKPN`(c0C@hIc@+A-cWO9g>a$Fln(fXZ=W9xCF`yq?&dq0GCG
zG2_6b2@2f7!+c<_L>F?Lu!~IQbI_9ZjtIeOaB@9q8wg3_&act|aX&n5qy<rfgrpCE
z_ccgpZ^W_O-6@i~VrbM6yb;k2@ZnR4Zi3|QC|dmxA~Q4(HI@Dlqq~m1SiLfpzK1s-
z_Ml?${2KTaD;<=mpHzAQgSp3u`+j-5JT+l3%Q;|PqNNql%?X1NExQ~OxpJW@3Z?SY
z9%!9UO%7r~BdRv8WKd@wnj+Ju!ofVt-3#1pDd}F4I#}+WN=oWW^ax;(WEe_mI*pdv
zNRCoHjFCU_E)KFfO;yVE*wAB0iro!*5~}GubBx0tlnt}Fz)TebCmQ=ip4E9W&t^4d
z4<l$Nb~@>(zuXG^SnR9#G0uO)(lM07Aj^GnFM;_9h|+nf=i2tnRi?gcV<uyFl-fJ9
z$m7KBMAEI{!@H@DJ-)l}FrAqR9;&>?6?Q{(K8X;fJNW1p6nh1ODR&w;R*}FWBZPeg
zADB!yIT3YTdBG-|E*3eowA_#CNr;)zH%U4qprLnZZ#ku3A=-4AA^kqYkMn#tJg{u_
zE`|YJyOFJ#MSZjfi@IwZ+;Jz#jqW8dBwoLLRh+K9O;_uFG+hkYv`Uml(bUvOOXSqO
zC=Cx3wMo)Mzh2<&yJqXKjz+A0-uh@(SJ~1cwfB$l^7>$vo!lGfp+H+6o(HA|3DDsr
zzX5PYnD1oq@D8vQ;qGawdvm*LI83%5*Ehn+CK#P4Az!(Y&{mfU`;j-(^O#6;Z`>$H
zy1JQ0;@x&-P6laggK-41^Q>+|EXy|avM&MS2;ha2KLtKiU<nWB09G)Z04}+FS%B`}
z3D5_ZZwl1Mh5}zwF#|B708XqtB`n`d0R~v*8R3^7F8s|rWC2fbpd;a~JnNR0>W2Ac
z@u75Z37&qhy59sWzWj5*vkDC6VF8ds32x~u`wI8@I4ZG)=ravH&Rq1;+uq3$`qv<N
zB|^WRz*^DwHT0{X4_zd<6G{}dm-}v<z$K901$GE=m*o@>tA4#}7x8vzy4!xs&c6rz
z??_=T@4wSD8|=Kg=ysS4u7PpsIxWi9H8CSp1-Il_PO{nC5$>=zs!R`d58a{;;fM@m
z-!$YcwiFS_r~Jn#wb&N&*Z<wl%ryN!;LJ=%)?z<_K>twwI1RPfo8sJ^Mn9}>c*S1c
z`r!L|^nh!Q;kuuemM68VfcXkcwd@L1Vug~lu)H}I3phQ#xn3eUei_Ez4C0UR+(T?W
zVHoM`?Fkhvrvlx)vv&v&%%v-E5r?yvk#7Ymy28+V8KLdHUss^q#yZ0F8@_3a8<=GD
ztN=$d+5F@an!pCyVuk+#6BU@u!!lrgH6Iz54GF(ioWJxe6il;%8nPi~>{sDeO_jvF
zzYHS8KkCc*#X;<K5x!@@`^zV)h&N~b78!eD5$0fAq&i2_p{V$7$2p|#;(3IM|EZ?i
z9bba1B%mo&$2WOM1F9;3X;<tBWYFV<45{H0^+J`prngo)!d2`Op~Ur7%!=@2&QfuK
z*AH4fkEk1rT3w|f-QcIXaZPjPitB(i1)X=#D-xUZdDL6{C@cC(G6S??*RCZuPpuLz
z`A$@c5L1BL>q;$n3eBJ!{bL5*;YE^Z_1+lnvnFKI0q0Y37qCr%w|QXXTk$6aKC|pf
zF@P>I=<pp6c(F>UxTX%KQ@(vV8er`38CxCvvye^<LtTlmnxr}5`#<Fv3}$&pfGkZf
zv_A<;-1G!|XvCEmXxp1u$Eh?4cw7NoP^GoN3TBmNQV6N^vLnI1&&;R9Ee&o~)ZPU1
zQI5|TLV0xmgN{zl<9Lw(>oE4FT4Yu^4v2XQmYbG9`5nFGCK_DjIzTnVy(7cS^D2MF
zTFxEacwVYVDvtV#yspPK!oRT5;{bX0mTl~xgj&MbSLOSFyRk*3_ob-buN9}$Qttjo
zQ-p@m^+i`p+DKQ?T&?15E2b_;x&H#M#npqj#X`~WC$D)}bYJ>1D?@pG&S2f07fU`k
z$;w($otMnRLSU`}HF!YQ%ImO0Lzw}k6@8c!brHg^Nd7!Rh<~np%qL7iOO>xN#)&>m
zsY88x6-ap@B4uB3Yhl?N(f*LBmSv|%s4s4VawF<ZNdf3V?2XiA3eF;>vjTH?m<;f`
z#NJ37O4$f-;f1~NEgp^lKO_(k&z%;3#okM>S8@}a`}rZCag~5&S7CkJFs@RbfF><s
zT%{3E-)CHfQD_ytj41YAinvpZAxHdD;DX=ui}A!{GGPhmmN)aPq1iI4VxK428>yo&
z(2{e@7P$05lT~`l>knDari|L8l{Gas$He7%!=f+J!+k%GDjOPV>5Q1tM+L})eU&(U
zCpufoa=LFPn-!L2o5kKQTaiWgy>O=nt30FtHByE4R%I1Oth@iDpFeP^w?-57CvcJ@
z;D*NqqnzI=rJ$NG13sIorMWu3DzhoWr)qu6uF6U$e0b;%Py_JeVHohRbn{z^n4_Cv
z45ocMtmdmGOHB$x9M;=%=l2WW`~_cTVF_$lu4OsxRo4ePh#w88>aze#dQSHeJRAiM
zN^<VubGlcz>}nZ6O9hz2RC@rpm-GGI{{#1PNY8y?PIsZ;2dj-!peqmG0|&`{1f#m{
z=7NDy?BFW$(ComV*#Y;JU`>nBv(ufIjK!l6#pKlsnoGbrG3jU7sbrp7nR*+sh+=X>
z(t&7GFQ!-{xTosY$Yn1o=kN^W6z=<FRLz?xCu3ChX_|7b@XMKc2mDwrHswqW5qR8`
zGliJy`e}$JIr!;**($u}OD0m?nh=hGkD2Iy^#G*ZIzYyVBy|}=cEd}gz6)$sfZ<K*
zH^A2lU=gWkGW90~X7F$xI7=Vj?KWB6qp3VCw%o50<soqRCX!~V9Y$ZVVT}<w?;M3W
zLN!ZdXGNMzMzza~4fu5SkIqmed10vN*L#H`S5y9bPS{9tGgkhZ;g?&U?zMUmz@l}O
z&*vc(NFhK!ZdYe4P(7UsU3KBdNc<(gp>8mUt~G((v0uw7x$wiTPUTkbT#dk|2G2FW
zR-vodMa?QFzlx1q#qNj6Z6p4pIyF)Kb`Z3=+Q`~lf#T(Ajio_+eH*=F`D0~RpDJE1
zMZ)q^L4D9jrc*B-GK%0OjB&S5<wJ;`M$!V-?}m7Ql1F)Q++m<QJ-*gzj$5qERN2YM
z3?ceRYSiB@$g@UwhKteF!7G&XTRPC{{jreh^zzQPwCL(scXfJs=iB#rSPJOUmv1ri
z>f3-Vn^-aZ_OtO;JN})6-#GX&Xgc_Wu&Dd$yMYgU{f?e4{ql=?OVmca2N@iA>iq(=
z{nb46hQL6-2CvYCDumImA6uYbFC5V?{bqI6j!a7#oyFKeJ&_p>B7!OKBK2vb`DI@f
z$MxKUCuj@bzM-GD{bGiy%VbzvqGUXr1<ue+zWu%xKPsf5R?K<yI(m6Q-C)0_Zn8)C
z5{ytim^v6w3_9QQQ=auCj?_C)^DP4_XAj+OjVQoIWglUZHP~}u*QlxxeyIj7rbcU~
z8!}Ml$S9CsOLu^FLWAF^k;_19+zfQ7=4lWN6lm}YDUdJ<^kWMY=!Ja+*0={QA&pjb
zvxTJ1GJ^p9qA<4w8vBN^h$r;`kRL=3AF<MhuqY!d##e@0%%$Oa+GuI2<H-Y&>R?=j
zF6{BM@~nxng=~4N@9DSf@yp;i7W=C)LZMYW%mrRhU@H%6fwvUEs%m@;aCwwH{!1PX
z13xJ60}l)dYH)zWS;_c+;tD!ltN546omol#_9H}J*@I-pR5i|a^|S>_5R{{_eVa4p
z*f=s|sCXAmR09pQ+>MhI@O4x(*0O8HAU8&Dk7p7#aX-&A)$g8>0C@76<$y$gIh$1K
z!r%mwZ;l780$xdLpEYqrHK}K_?8(;>?V9y0RbYsko=AbrFHI%62di|Zl53*2n$3lS
z7Xn3$50iPJN+wJt`>_R;?1du*=m3{?kXdBsRRb0Uk?blixorriXR4xRPY}B+Kuy$q
z2pG_az*hb2R$0+}O}uc;Q7Hs|(4chuMKtx7f;!AGk-?zvx7fsNtl^2e%9nDCJe6ln
zk{V4Xb4V-aqhL^T67OwlhTt%&gnp74S7q%qsH(@S$@XMEs{Q@zl1k|FfH?%RXr?un
z0WT@QxWDFVK*o}VQ>eKe*rveekpSXNqM?nSMf>D4-r4)dBB5JsOanXo{dZBNLK3gN
z)S_Q4Jx_>{JhW0Ig9+wWbB~d*0yW4AH+Z~WFxY`)dm8=rq1Z@Ge+4pkTX{8ol)x`K
z*r8S7N&QvP{L-Y8Z8qn*huTB6E_4rAH20c+Ds&4Ee*;$v$Z#!?jesmV*`6yhZROE|
zavJuTMim;Wv<d{0MP)=}KM+)M(ooG8)oKuBjA?a&+P;WsEvbaG7OcUu1rUO%M#iZg
z*`hd+d;xkVphHChKNcA>J1}&%oCGzS^=zIsMb&INmLF!Kv8+X)GHOV>1C3?9rk{0;
zfyehSm{e>`o8;lt>;JN;qw!NfZ1My@tS{T+ALpSUFqFX4z!arCz(W|AOI=RsOvJ44
zi-&koto%`^_sc5x;FyRA%fNm~f!BDzK+-gZ&sxXBF5o@C$wG{p#De!kV@e~|>4=u-
z5Yia=nTkyNk--1dl}oo%SO=gS-IJdTQT0F6icp*Y=@^67nC=m>OT=8TbaqMxFoh|A
z`Bi35QzbuWhOLUMg>1E41*ra7rGSz&SdWNR7>II^FfMso(Fj2ma4Ng3;TZ}%O09aP
zO5BpQ@~o-*d2TLW`y<0uw`5zA+W<NmUXpQkE&O6F30YEk4*(v7Z^@=Si~xrDo%mGa
zcKEfd=we**;r`gg_fEC4L7PyG)f2fVFmOZ$uaJ8p990lo;GR4zveqD}7Q^yd(_pXR
z&D2BQQ0B)zrW<7_!*Gbih+CQJyOpQ<%JkgCw@5YfPO}zx_&G|DxD$TZUoG5(o4AjM
z4*{;7a}&Sif$q1~?|%O}4Tk^&%^;#{*&8U_;Z(nHwejh-6MfeU2CmoO6)GEHN<2;1
zXBHj-dT4&(YUA^3R|P>$(n#A}hB}R3E3TIP7M;yuRu7EOwV8L+uICF~8~d)^K1D)f
z?b9*}`dNEpL<Ku7jq|3lIla*Fj5(%BuKz91S{O$j2UPz*-GODTzX(H`WbJziu+VDP
z9u7Q0)7(%Br(r0vB-=uMt&9ZccKY_8nvuT#qL7MI6eg>C)Y8Jq-jR`?TshM+jMLli
zRP8N9?VE-`RxRB9Fe{d;3rW`gfT`ex?Jd?QK)D%GjnsHyys)o^3e=}l|C>DPjZE@4
zcKg$2?JlbSt246~ONlpFWKQkWrv_^?Os$<wj&G3LvU^~+Sdt(}ms~03jV#S}89PUo
zL$##oMAtUTdEoCn>n(Xwv)cGGR&Vz!4nMk<+A|bL;(@Vn?KO<C404Y2@)o~V@A6Jt
zMsXg_*Wi2+p{Cu}{uPPdTB=tvmiu#^LW|pPF(`QXGLhYVF}rdKPA60(77MY6j3t8-
zNk&<6t(RMJAUm4pU8=`l29p^Vv)XkWGP^{DT;`lKQycp-y>cDq|8-KRs>>7a<>y{I
zfq|7_&<h4uT=mjXx-{XJUSa}9omRkqA{<$VsM86z6<1vx21R({8tU{^MiWs!RkaF3
zeEBlPT-Doq!|{t|cBDn#a42cI-f)nU-7ehkXI6JHgMyOX+znYM?kcjmf+<6r;+gC#
z90lKljjUHuPjn`I{aXF((9g#S{0QTUDNA~SGpq<$ttD|f@~vO%&YYpXdi@S0o&bzi
z?8itZHEgJ4NFA_yCpeGMIDZ`}(%v9#sO!$0D$)%%Lbd{URk0l*)&JYwne$9)UsB!&
z)(G_x%dT4*DAJ6;I5>^ryx}t8kCz~5VclU2-6Hn(@|04Ms&U?aDJ`E9btg!BJpAG>
zQ56QPk74ZxOFlB+Q>HMfQEX$BX&~$4X;-WC9&W?4<Tc51kN!t_P51L!PiJoO;=p!6
zR*##k)@S-z<%cUDiAt!oeu$UVQ8q35jU$ptmNKDg*3&#+IuY)3B&t$_HRLSGjy?do
z+Skpa5zcOnY~GtI^MYwj10QQ@IQIxI)z;9+4b@u_szst=0r4MHy*zJm)Ld9V9SDcz
zMgQ9GHG?eYW{&tB&AZMdvar%%MNR2(4c&+G`Bg?}q{|hLaOa~@rK&IY(;7$8b{hVM
zZj+buubJTqN28L0Clw4YJjz~~gXniY95<og_1|CvWV0T0srT2HU_}&sXu7iE_4}2H
ziH%cr=?xW@x?y3SwKhZJgSgicoGF;wF&&ACV{f*-VP(YJHex@mftKxveIE*VhPcGe
z{Y@6VVHY{c)EL3m?Fn>4lC{~MB)`@Eha@!2wM$tB%(ou5+>E`*bx0i>zt}*6eJzgu
zPW!^vA2ZR%h)zpzTm~P%eT+x#PG4777CqRlONh~K-N%42N@C1i_gP>XQ$Bz7h;na;
zF{?*E{2EoS%G%DBS>yTbCtuNB^r0ndZGTV4$DDB8-=dN_tY@d#MHG=B$)oQzC_DW)
zQ<`YAcDZ(+ABTy7cc1Xq1x(r8V*|s}e&cfi>yirfE8XNCSsLxy6T}%t=Nl9Fu%+c5
zUrGVG-jDDv0gDw-A>RewQEjk%>U32>e*yl-{IM&;x(ygSX&+UdO|2bgChBxuO7a!p
zk^-1Qs2<I=UNMDoc}M~h#P1{V+eN54z>=?7t=+&je$sxb{IvKrgh-3E^=QiVnyBwv
zhhCPnp^zIWlooA|tBc^{Ln`<Nj6vIUjt^7ZC_IAv0^J&Y*$mm=hHn2@#Z?pN)=SB_
zBufbE=7=lQ+M8u`&X7l4^zj`;`d-QIqDE(~Z(Qdu*d70xWW&x>=DPM?H+wvv=y2+B
z=1c2(d5lh&ZD-y~$8_;A9$_8x6)pUo(B?2tEF;cjMMt6rArdNBoljHyP2GPdLK`&v
zFmD%s--)(5)j?BTfeZy`DfMtu^+q%3bvoV3)2qOXD83UtT0JHy^;jZsIt{Sw`YwU1
z3Oq`HzO;UGEnaovFc%|n-GZ=Tle%^Naz>^T%LOOCW$?vK2zGrktl!z-vAzlhqd$We
zDAlRH<^FEFoXgX-2=(s-GEG(Gs?#FP9C044sxrmSreo~XjHP^|{SAjaZ~Xi1;TKOt
zC5ES+h>9tC#g7Xqu4=K3>3;at@W&@`rW-RAMrXzV1{tnP)nz*GCFWTNn<M>6b(trh
zK|}9hd-Wd%`YO<fheg0F1={fNDX>d{ZkBz6Mc^C@Vej3Imfrg>G4+A8dkJti9jq~v
zxArxGGdC|hY<K3fJk~+_1})Q`>_HTZKCk-a%r;6m$hb$Nv6I>1g}+DD2z`U!d2g8p
zGBeh44aiQ*DrsJ&U2T^_)DB*sw|hFzx{{<OQsL3Wz?-z%lgG&VN(v)F-WHye83r<L
zPOVHnuC~r#(^s?vIz{;_LjG3VuSgMAg-~MP6-GH%Z=glqQXzx`ow0*bsk|M*e6f|m
zRDS0Z1FLD1f6M^0!g&y1ycr}`w{IAL`+c#O=lid;_j;i}288>b2_|UM(UsmL4}@}p
z)Y3qWlH)}Pb`|&f;y^!a1Y5QV^r<Rd#b9DU?`!^SNOl#2lz-WW_gVJxq6UF|Y9Kfb
zgBb1dL_~NJ&|AgjsgZy(-exX$C1>-pev~@QK&hqKBUD>g_IN7$GajjUks~oiH8=V?
zpcG<*F`;YM{wBd4by&)h>XskLv!mBrOvx*jN(|t_+`ND!EQLarpC<F!z!coo@@vGl
zVy^Kg*ZSM91c=@Td??@Br9+-wl#vq{T@uYa>d#|XS(iINI0gJJj$N>_E)Q5JjF@Y@
z73ngRST3UZQ*RQw3?n55D8`4OiqcFv{H79&LrO(#)B9Q?LK;C?);xIRy#)D)M0;y-
zZg#1UspqXxHY1QO?;RLb0+L%1_&(1r)>~9cIZSLi(10-B<dxDe-^X(RCTt6^UqSl~
zFoXu3v?1#%s#|sspQ9><qm^ZcP7ReJ@w0bLMeBC4abEnXXCl$uLamn+CUJ&d!^8M>
z#XW{k7-ToTN$;TT1}2@BFQ%t<smhGc@F|PO_>@OQIaZW7en>-x7L63IAPl9BGpUa$
z)g+o~ormH5O#??E6A}YEXjc~|U{3QsreytqK2p^L$~*5MAy_mRt-ui;o(G;mHS_+0
zMGUGzmb`&VJxAZy;AN7RYA71+1&ht3Jw;j=TW+uhFr(D)1d@13aW+FqA)?;}cza}r
zpW)$q;9CX4Jg{`vfTdPDyqpKtyc%3l09FmLhK3peg}3ui1*jaP?+fqcsUc8DGJHcu
zXDm0L_jY#pTVi_xT^0D1hdIDx1(-56Vp!8CiguSHJIGO}3D8)9WF9hr)-;Hmj(N7D
z)hw%0YNES|)u6xLKyx_*NWX>r8?pRh=g|2zdH~QDFe;^r$4El-(2X9&Dx7T070dpM
z@%&)t2~$DQ*JQ}f^oV71@J{ar?HpbaR%&3mrzeUFy>lbxwvDnBkbJoBMmb`+50*F5
z{{K2DW5GYbIm>(`)j4dE+|%aeho2H70}C)u*S5UVDTQd_Ov)lZrA48Xc$1Rrr(_mN
z(Kn8CpCUU&#Lf&y{ERB7SV0Ca1y@AevB{X=q7!+xyWc3Xb)x$R7-y!Vy2bI7XdAFe
zfhZon06rzK=n4<G&_+k3)YfQVF}2<pD{gd20eYv#9DK1Gmql%hc`sY(PGm7jR9<5|
zK;s5#(~G+!kmiZ>6K8niYA?Q>B)Y%GtyGL)hF8Edni%k{NGZ~MB*qT*BIQGf?g&pf
z9hEdV*x$$G`rJa8Dlg5x<A;S~)wbnRR8<!!%R{hPDg;)Ch;x%Hdm%02%=$ucSc#hd
znIqwAr=w~V3sBM=Rsr%Wgl{+#RX-FMT}Y{SrrD9nk9n(1^Ix5tXWLk+_sgXa?n=gw
z`2#eF!2veLi#6^dAD@#A%2YXnO8pYu^_6LurO<cI5)d%t#+eGt;sGDrSTEcw^+Ri+
zoLqwFr*XE-lnGF!5wMrObG8us9Kgp;?3~>^<N)&&IKac3z#9tu#Dh{lKxH=llX2nB
z<8+5aIK3^m{Svg#-O{)>rmIF%Hkq_vf{39Tq$*=&c7~^3vB|RRmzhnPuM-$IgxV@)
z;ok<6W4I`}eFM;?*kOv^7&p-PXHQwy-^|wVX|l;cqWj;PWWsunr>slhU9j{@BU}ZB
zbB(L1YT4;UfPlEMyqaDLD5*e89_V1wlNDg?BwZ0L$Z+wadDb<WGd$KLy0ckQyif=A
zE?!5v@H!~)Dh~|O(g!LqpND6Grxlpa18PrS!Lb2*F`hI1ePD;`MC%TVcM|#zQ27>r
z!owMWy%+XkVw=PPTKiu78xQq>Y6|4@&=0tiz>5^H$vj||0<k=71GZ4XFP0~dPb~L*
zC8boL{+qzR3ExVwU#!IgT5a+*<BV%7yhd@(yjy<UG#~n8rEF89u-tR>-1<(K8rEa{
z4)WT7bxjt4`#8_I<$5}%U|l;T%EGZwg-qv<N>_bpR2oFS?-QMm7^t70kFHkbA<<Fb
zCk5!anp_6XOI6>e5ObxPA=SqVXd?Qxk`lY=U6&}EmIQduW+<EDRhr6Eth&NO4IowC
zLuKmb%e?NobWeJv9pshv{FmXs&qXElxrPmz(*5y&FlTs}7fKXPkzSbUVA2+TwQ%WW
z@<wM~Y7ZJxUU=mBsOF)+qYHV2JC;)-)HCBJY}y>Ot8_du@IE8B%T+1Y3<h3JvC5`8
z4_xUug`1(m(N8zM1FCrw3>A&1a*@QqFa`)0HDj7LgY-!NFEvPkYTjZ(*l5$a`qb#W
z*Lk9IZu$nw`5V#X)GiiR!A2Qzi=c*rp5V^Rh|>xdi?dj>F+Co0bE|T^<zAXo(Xwa8
zIy2+-zr45HF_Rv!DYe>EF9>JS12#Pea9G5i*_Qm9(ZHJp6}puN?6O&P=8S(YCDYGw
zvqkn;_JWZ}^s<pCMkYAZbZbR$OeSTUNnzig8MTY%kY&%E0?mHE6pEwGn35e)oW~(5
z(B6+^bD5Tb<kzF(Jzsx`tO^iQ{kW7ucp2U_;!?ZtBNtg_ippfC|9BWgcb2|T#)BYh
zTzTga@r}-;h(n1UFCL>zTS5%1CAzOt3dOSiLGzvY|G0bq_$Z5O5BPbWog_O+l!XMc
zAq#BC0s#U95+Fc;1p-8k5+s3uQKAG05CtVls?m)lYQ$7SNu8)sVjJ7EjhgmSL5;Uj
zqop>jX^m~Pv8I*Vi<-9SEw`6@Z?y0CoOzzzVB7a|KcDx%cVRQX&zw1P=FFKhKlXYM
z6%y@#{+oz%0|;|9zUv7TxSc_rjT8#O)I>?(2u}K4BniJAgj%GBQpUs{;sVj_8r%Q%
zAc?W9q}<V+L_(cgGvzaj0lkJ6KGU+2#2aAB(XSFmk-GKFI>@%A2Z7!JApT4tqM^I~
zFR7T%V8yT$?6>q@;_PSc2O>V2x29d4Wa5Qa*C=dK<}*#mfaz)}t=y)u(*86;t@ySO
zjOXBixLx`^v{0to2)|C)-Oh9bqhc9n${bR~Q1J(pRK-aUWM9T_^Gfv2|NhZ#4`nUG
z2!%d33e%sH74n2qD)kSnj*^{&6?Ibn*I=H}Kd@>_j0ai+j21?U-ih|}jOVEAMDS*<
z&pY62fDiqUl#|7vOB2uRLdF(Qm?orWD$qvE2TQvs0t-MMd8p~zsEPWfIG?O5qjiS)
z=Uqtu3`-p1w9y~at9+cHoXUOX*M_H2n+~+h|EyLo^G9hz!WAp<3Zvf5ujUe?+AM|5
zc{G}tla|4Ju^rO<b7pB9iEZt`ju!10@L{=7OwWug$D^P{SjfPuUnBeM;WRrcpCoo1
z{u+rXFJA^S#}(@Rlh2MiVEfQEGp>{$79~)l_$l^DwJ6a}wvf;N6?}qMg3YBL;`<H-
zat$*FgEc1}!e%tIRZE*u%!@fW_~K%PIeLW&W@A7@guo>HHG&hOA)#HLf0JNf0?&cW
z%elq@i28GO*j451Ltr;%o>7`;8S*`dseugyzu#mgVMOs?>@`lviiw71@Oe2F$@l>$
zGv`5k9{?95CE^F1==Ymku`y6n(DF$mdNbwo`_%KF#Ux#s6t5}qIq5*uiQCT;CFnK~
z6d-_@1X*|%8Wl+>XH&*_2V*GuO?<n$;KT7fe3j?(n0c|3k^+`W`KsFZIi4S1_SDkD
zyKlT{-@(K4Dh?gGao!zE=4H;?o4q(^$)Y8@vgeiWyRGU=^A=?;%F0}_D063KPIgxI
z(s_p#Vm(ceA1$CS`EGwle+?rQzkY&g#`7jrkClr?FyPN3_zu=T@6>_7X|>25&J=nd
zxmJxEF~8MX_s?_vkuqUffAB&NB+NesHQqv|)whqB-|oB^{ZBJZLZ)Erh<R(UeL7`=
zwjROC{8*ztevTW_=cZsg^)*T#F~1CPXrS}gW|?jr9QxkBN)fg17RV4mp|d8&CnTbY
z)hni5(~Xw&W3LNP_Wjv3fz7`E(K#WNDD)T8Le8&@Gp#a|-}zH$kMDd?I}UYVJJ@(<
z@ZL%AX2aWmZym+1C2#G06g$%t1Ra%7T)nRAWfNyMjQ(%MqVPLz%ls4`;}6I;Z^qYV
zyI1B^TjoV%F#d2E@Vgw3$pi*W%R~Lp=(Npjp{IW=yf1=CaOX4lKK-?)+)E~WWbNE}
z#IO=kJ3Yi_Ecobazjp_wK4Ef{aUV=6M*pKuNEm?7->TA0cObL|{&!Qx(y<pj=>{G9
zgr;MHrlZhw6q=4g(@|(T3Qb3$>8NwQu0wwjnvTL^GUAUzM)D3`rRfO2Lr3!3bQGG7
zLeo*#^|H`(OuU4SP+#WFP+sX?8443JiHPAPmN%m&5FwucA-Qo7M}}B5?iK?;j3+=v
zEO&F>99M2k)8S=UMl740OqoywBNG(;s~MFT8;7VOq^-g?n*s&!V1>494+Wr$Ec-qb
zqGeA_rUGCeaXtO1pg%ZRWe5nL<tV#+4h0}!mOqMb9R-@;`2)W1QsAUvuGo$58VW$W
zTY<I1ijOGp1H;U<5cn$vx)E55?<xww1e3cB-_RBcy$fF@zL>xbF%*wKpN^PEsUf+B
zVJ)ZF5qjTHe1=CkvJgeDazz1h?gRMVO93oIa=(S|(-fEt&yVr_AqAj}=VFbM`v(eO
ziN6v{u$7VmXj^C{#muMBmGE4F?;4n^jA%>-bu~5uF9Ct*=@cEc4bh{B4g!gvBRZ;-
z@QQjJc;y?03&)|1sI&B^pFj=)9M&%@Z>GR7JWu2M1O+a_^Fw??rxA)4@KN4D3P8%Q
z{4ad}#E|y^atR=xpi=0&RjK%<P~c8@Fr%-+c7zdiKRh?#yOjdaY*s0Jze0hh;CTaI
zysm9Tp?6k6t6%jo1zv!3!#m{W>L|m5dST7atU-KqCZaO%rEZU20nZYAv(e1x4am}f
zZkR?XFb=HVfG_oDH2QKirt#GWD6k72jP})!Q2<)n>i6;OqW~5rK@8T_pHl#R7n}?7
z2Qw&i0-kH}&1Ym<Q4?(IM)WX<ZQ#U|(f>cHI?DaZrZ>c7hzAG>h`p$77R13MF_UA+
zKYolqevCgR;_v^@G5!(t>}76m(LO5shFBDV{JMsG6`F0_ry)oD@gm}niTD9I9N#~p
zMxxzQR!$OyV~~sZ<Hy9uMEn2|&I1rv#<-`LZ>Zy!yVKUTYK&UOU=;Dki-<oa;s>~J
zJiz@l#=Q(;Ry@ft42U6!Svw>QlB%sL;C9am4S!M0*7t+j=M8iHNB=(&vyT>-QTXi}
z7PGo>EM~W3&a%a95KGqJgX8XS#BA_0g#SAk<2lL=`AL#^O)|a-5T9cEh*>{`NF(z{
zW>hRoUhw)FjE^;|klBaFoy;}0_})RH_W(To_;!J>Gk>H;q&q1D`M0(l2#HR3n(@Vx
z2!?nWo<HJCqlfOEuDcuGZ4~&qVdh2S3nj%6gYYEbJCOnqzj-t9^;6(K;8~CFY6^_P
zvmf6wl29>Vf+%cWJcz+><U(z+un;n$l345n5KrQ-8__SJXw+;JdjwyWDU0Dj^Yav?
ztbylwe7{QpEE)59@a?9+c6dI(mu88m-C!Q*xp{x1z^w>)@tr`GMdyu}$3hjTEoe*C
z=qnhBdk}xojy_Mg9c3B(35fO=h{VkV3DRu+QhXOv;D6ykW7n@kAUXyfh^6&3!$c>*
z0}8LNpujYEj^c~sz((|3c%H;Wu%4wAf%-na9b8i*YQi3fiz)CmM1$z--$tn@2=ev6
z#`ir6JPQwv4SGF1>P2|KDeM260&f`RhD3ZXrvM6Xn2#^X)hN(q!#aFdvbfudV;c+c
zCISo64dsY0qW~oOh9meMrWpx)T?^CEi5n>8HpCvo_kIdsp5A~-cmub9Vlnq^c!g3h
zVQ=^xUtH2RqQ7pK8zI*>PN%?g@NC7mkOD8^5*#kzn;R<`n;)U3&7gNo0*DXhW#RjD
z{1=7qJz60Be-yq`AkoLj-A^>oupEU%kNE%3a@Sjyr{RQ!Dd0r>|0m&V=XdSgd9z{r
zY0in>N|0G5r$f4j#Vaa^`2Wx1*rz6pb5Hr_GI=V=<kMG=b61jXK|8-$^G(;~%i~tW
zEsL9#?2j`Mm7Q%kQCB3aPR>m}{m}&XGI3Qb7r<s~B-Mh3c?Yt)0U>Hx+!YBFaRl4w
z1d=20WRYD1g0qsZNT3?Nq{@=q6GM0A;|Tqi@dN}%-ep(I#a1U1q?(Di%AkwfO?eID
zo&+;4PQxZZp;!l*R3z4#0V6JMRh$b8h<ouXcMB7Wp$321q@tAjs7Xy2kDPTTAgljP
za#t+Gve&&l^=AeskSec8xGe4fMCwCkszI+cHkdeF5hf2-M2J7#<aIydN&&&HNbn)=
zt7f*bF@bSP^%2&usm(rjLg;lf2|wF_c;uwodyo&XQdd$0il#zFzM<nNPwFJZVGZ=A
zInkg-<GES~FcJktoOQ6VNog2AM$GDDo7$;NEWG&5k?JEKrh%WBQ$U9C=7i{y)RgT}
z+kkJcjmKnkP^y~{!Jz!92AxWg+)Y#@=)DumfS=*8;lczTc=c`E_+FTBt$Ai`RB=*C
z-1ayE*9W485g^+B+(d_iq!t>bzBI)>e$p?#P>#`fN3~9ICx-gX@#c)n6VPWVmlr3E
zH$CXFcb$HOH2<YJ4t+{J`YZMs#z2H-Ami%fdNVE;XufB1PugsU$Q&T|zL@~_j*CJt
z!Zg1glQWU%I_N;OS?~1XsqWuLLr(Dr<`QyA?Sc`8|H@pIIm4Y5g&BBHm8zKGzBcr5
zmtn-!j+l?<B1bmdLvVv|JK^?@n0$!Y4Y$rPWX6cuM)3%@oq-FpN*l_v+YL7#MhUcC
zzYqhLK7@ual5I5DN@?ZmB>V+0=?r)|j6P(q!0e|39Al^Na?%f8Ffe`UB>t<**E{Lo
z27<2Yze|7CNxwB{7~?U4=uZ(G4d53}2HPaz<gnANABNL=A^oV8&WFp(SDp0weic8<
zJ^ggfEceiz(TDc!T6FN1(@9@<zdG*p@4n~$!<^V#ci(*b&O3JBc6i_EcLv>Wc*Tvk
z?LB;2{ipl>81>O-?n&zA&)kLT>d)Lc(Q#Ok#m!d-KXWIk_dj#{q7aVf@FX?wb9X=`
zf9{?bI~9@mnmNZ$7k%zN=w3OHXl0%R-C?oL7)Xr9C7svq!OY0v3-Q*%h(CIKJ*S~9
zrfEbYf6=2cGC7n{EuzOa=p>84)Zmp68$!L?+~RoSqsP~2;GC=J3#FjIp%f>zAxUR7
zINVN2R4J%AV#W^%JPxp5RA5`TSoEmo7&*ZlQs0e{tIc-xX^ec+>^}W{xAdDy-2y+S
z0(;%-zY@NHSs?;t98w=kdBD7&ieu$$%i~tHv2q@{&&SFQmdB(1D^{l7G$0Itqdp?u
zjfWG4W~Z5&O6KKl@e;3!)=tJtlpqceG{=<}jEN$g&2hDvCKh$X{^NQ*V^XmXr<>vN
zsypN4+>pmBaPoea$O&3?rU(`|#m1j2gO>-;_zR`x9t~{#g#vB@md^xxf+#R|!^?!3
zkSOr1Zn;Rzwds#Xs&mb9!y<$(%fE!)=4Ay$RAFpInx~`IjBYi|SpWqkhKTIx7e<h4
z+9rY}$Qe!5dHPE@Zo5;Z2Yuni`3m9Hc-xqGhSZ($a&~CEJAnF`3h>&93x-sa>C{NP
zXL{<=ov==?ODEn7`@y4*-^mwem(y56`_y1;1gT@@n3rA3O6Fx?r7boqaT~a`#@2jQ
zaG6{=8RpL%vq<E%3A0G^o1I>#zHyn%3T?|RrO`s9H!k&G7jx7I27)ugiPxdwPCfvm
z4~ERPpfEC{tBm`N=_f_zHoI4iZKtv$aN$SGb=gx{(MJttGzy21F)OC-l8R1cjRS)}
z72RY}^+yd~xacJy$Dq&yLOLk8(|`h3Rgza~ZX+xS&5}HUmx}j^z;zP9U+9Tm$Y4Wg
zc1hlKMBx{@k&}a^L@K*j37EzK9o!fOU9yqJFFuryKP*7Z8^HRBG%PpaPhEUVJcuA#
z;=3+0w}=Z#jb1p7Ugbri@-};2heM&0qS-r$cmP3f?<(;FF!RsB@^TZ(ImME<*sceh
ze8WXyB$$;Vp`5^(-!N@lC<l_SZxGnNK&N+_Eh%vNQfhs0x&nAMn7R!B_vEMOjtT*I
zo6o6dXOGv)g#^%T*-2y-vH8YH;r7Dy;5Y>pMlOWnsaGN&)LS+p@DymdNN=$&KWc26
z89VN8laCtHb7z7A);Ywv>^K+4owG))$!dj1ric-1)Kbem(&xGu+o!gB<ebor`2sIU
z?-uc1^Jd{?ux%D~)01aKYwX2X?RDxGH2naD8`B{kfr2k^8M3~diC$h50B4FoCctFo
zAStIugXtCBvCVM|22&b;2mrV_9o2@?J9M^g(H>i?vvm_;=wsJK7*hAfd%@kp8?Y9g
z6oEF&$~wsy!qvT3b}>HMHDbQtCvnSY-c%qAKgD%|wk_@pZrcy~(g%2iZYlzFCku$M
zM>M&I-OPU)1k$~bu^dZcS$|NJOKQBpBTeoOH=H3VOjB5-u!yU3pXBoF3xi-lk4})$
z8V4IvIdV3;LBCc4SS~u;X9(_DcQ1wd+(Y47NIHgRwmr3&a|nb8L<PTsp)3OFQES+f
zo~>gdjUJ2nZqXDXoOf%UyQwnQp-~j^;7yea(8FeDP{&Spm=W#Y<q?L*yiPQ@&s_%R
zO!B#86ZZsc0)@%M*$6Y_bCY|{-7Ybn+GV$-V7Cm_#v$At*H43&!O$S34{F)lPPG(^
z^bVS`TRpu9I3xr&B1c69L;-O|V!r!M<A~wId@CwyBL12|E1DBdib1Q^6;9A~7}1kZ
zOO-J4%<ZCd)WqL@PwjYfyZTOo^d;()ZKAZ^GPj9(s|!EPq25oBQ$jm1oce_8PDqwM
zaY2|nQ0}}3na+DIdR#{keUae6DxzCb(I<>r3*c+5CJTGp4wIIb3!@O^wO&pHq_{@n
zM)LoCx@SzfC#1Uq1Sqe=%m5zgj2npq@7dEZgQa2jToXgpUI*xYj0|BlBtl7XHJ~mV
z$8yZw0itDVTu+>yOEi_J8l?HrL#=Ub)L)^FxK47<#C5@OXo+m+sKd61mbg|*ZjbAr
zWE=i&@JBxNdUM>FIJjI4usI$~MA2X(`cN!5%!}B@xOR%Qw7A?|DU1ved%%M+-5Wa)
zD{xi?#2S-G1Z<1eskWa-3W3B^2_Dd@EB0(G(P~U7CQucF)LtGiD6{{J`f#G07~0<>
z@a%SxXf|;)gC=>5kNrJelC+8iA5#ruBl^(>Xv=oPZvnk&<W^MUPjwT`8g1qPfuU?v
zZn#OB#qb=gHKMD*#`aJ{{kL=z;kREcGQopk{pl89;{$Or>MYQPs$rVx=&d57(A+8t
zce-xB2qbjUe#{%Bqf}xqx=3|Tl8K=MiA3S;!b|)Eu?<}^AHMu*#8uau2%oXeTX4=>
z4KC1&=cNN~PlTBO8z>&|3nN!Yipm<>(}BTeXXM$nvOHeg^%(fpmd*!i=MxitiJ9<A
zU_z4009JX3qK|U)(a1QcY*P0oVbO4N5qK28VoSP>2&{vyQBdFn3l8EHR!s{{dc!1u
zZUA&0hZGh*w58cRLoMsHIxV!d(>i6j8Xz)GVRA&c+0{%fr4NeUd>%y+D*|+a$OWK#
zDYhD9<6-JODbn+7AKHceVLKIQrRM<|Vhf6^*ZuF!25eZ8!})AlrRUj{atRh{H+QO9
zubecwRT$&2U>R2+@ET7<_!_sis!p#=_H=@o303A}<JNBVo>%(JZuM8MoMy$9tE6N(
zlibzGaw@qyljW?uW`S4PwunJ<$b@s=#1UoEY`MX44Z=V)q?kz(51_%5@rfnjA<nrb
z6sot9u>ykopUHBymEciJCd*Y6zGJeSe;@(lJRW2_R7L2~B4WZhUWvKvKHgCaeGd%_
z(ohm-&9hOufi|n|=oWa)8$1{?D>MqFJ>`*J+0iSEZUH0*#HbpVBBxl_1=ai%xpLZo
z3*gSV>PZVHHlwfppcAeuQO8o`?Acu|iTj@;)*FRTrF&f?V}ed@>iZodYA{9447G^K
zM~p=Q49RT#VUI5>fbu<5{uGe-e@S-+-wq7E7IE1TBi1UJI=1YkQAUh23W!1#?u93x
zRQLL13cB=3pPU{lz+}fO*dDY{^oU-;bc1^_3K18h+M;ztTXerfM89l^)e#M`O|gh*
zitV!_`eK`*u8wUm0mlFm2fHnl*@wB=>bDT?x0-z%VT7}TJUVxUox8%$UE$=eaJZEj
zMrYn@XWnaP-piTQnyY2viA*_Oot`4oLaoARB)+V-dM!A;P-(^CS`5&0R=W!k17cXf
zxggr3;50>dMN_Wm;TSlhF|{xoh+21}+tpx^u5n&_8e}6W9gXrEk`wyn0EGwSUv#)R
zwj~zfme`I^ENAGA?bn{6_zRdK0qa71J<V&)p0nfOoE<+no}&lHH&3AG31=p7_*7z7
zB70gVeRmRjMkb9UA;(D4Xp(NokayIpeP@z8CfmN0{uG)g@w}ETzo=)3%%DeufG}?o
z-BECcqejSSipI}*Y!zoG^pkTcu`dx$>!hI+USsHz?KDGx8Wu*fo}mHn>TDAE6{34`
z?_>-vd%#_TsWubran>6;=e4;4nXke8kO2<p@eX;zk~JJ(iTJZ#4D++zKCe}U!%&Pm
zr3VF`;VlwXHTY9U@;1ylwyZL*$)km0r3jQ-RbFw3=EYjG!L&jMHNb;#1D0G!WYNSe
zx+b4y;4PxE3V&)kNo?^1OLWp{#gtaeX{07X@NBQjL*+bi!AszPB>qzotnU(mpsxad
zn#?Z7lFr`f)KRs<FDHjawF2tJ(oi%~Q*6MS0x@_X%?7n8L(6whB1<XMyQvjDLVFl?
zT?9tNn$Uf`<=Q1+>_dH2fZ-7Zf!d~1v_2{lIRmQSFO#fIXVf435VUaTr^-N9VGG6x
z(G&#>TS2X`id6`Hse)v!LZt3q2Dmvx-Ipq-g*F3G4^iBc4jSg>qoBQ}qm*>C5pi0>
z1{#}liCKz72J{A0rXiu@Fze7#FFZ|Nl24Pp7xfd}@o|)(?Y%;!O_$RvDJ_if<|-mx
zk#Og+pmO9NM-!rM>OXGi=IS69Lz_1@1zhrPVZC+pnebA4(6Uk0$abmkO_x*5F7@_w
zIVl7ooB-NX*W$n(V+K&y<|Uc?$UTHJdAg!&1$860<JwYTRgoQ*a`b0dhpCwMJ3W2v
zU;ySe&b=kEF5E3!yr_k=5#(ln1%9f50|f#-qh}`2cuTvwGfny|xXo$OpS`7n)U-;G
zhY3$q9!4#;zEqU1_0L0qi~E~|2tI&Nl&*%;(6>eC!7?gT<6vK0!yQK*;B-Q9EiwHr
zk?14h!nV0f1Tx5*k&RYx+luR`YuPwbTt;&QI%vd%7uoC_<z5hwa}=E^uyd?2;ioLR
zq$ou^FCvRYR-|MmjT)vyaXzdb=7n%47N1f-31BWSKBGPf$oZwk=+sjr@w;3DkoeSC
z6hwQsqMi9L9^`Mcsyw2}b<zcwlbIY_{U}GP#ZeP8ND1bcR+m|#(?JCQDDGEPGh}M0
z7XnD*QsOBDw)8=A38Y>Yq+V{pSeZw$U<;85Y9&&dQ?&6AirRWjNuw~P5jCeBVvIqz
zk|u3bB5!jN^Bs9R(@n1pVY@eISI*UM_o<AT(i<uW02a7)nmsUV>?qm|?0CHF3ooH`
z?h2jTo_x_39lcja@1@+RydXC~1Buoh<kbzg!C%!Pj0LE5fqH$WoNTtJ-^`Rr$sAcB
z7Sx*<q!H*>wW!Ny$)p3_0vhF3QACzB2Tl)l(iTxz#$%RSb`|1+=orM2nGMxng~u~N
z1;XU2;dnjLbk=G;R1*SPDmYN9RpTr<apP5-Tp>7l3_cvaS4VSeHL#+846KNOWnaa~
ze-DhKF9l|!ab=lWoGt^QE6eP@xIlD?bOyyQz$CkX<0JU#_`P;~1i>rogwc#qjYVM}
z3lKeNTv^Z2nApu;GcvK;(OZNXNSBu-!CZvVDnP<32Mly3d#_4Yqv_IXHmHfS<wiKy
z&qg;k2xAM-+R{(zb_A`B4eBdM-hghrh<ZeW)e0Sh+DgM=W1qm5FpsCksL0$v(YSB1
z4Z{r4jse)bqE&q|8{#a#RJrHKSrhsUg2d8?pcy6S)tWgnfc=&|b7ZQutW-TXN2UaT
zSvG3U-e}8UV_CaEvz!kK&aG5usRZ0l=SbhQwo)F{uq4lI&qw_%<7_F1C^d7gOq<z7
zK#0AJxsV}1lD&hx7NMz@Fq+e)4$g%^2gIfwEs=;;(as1J!Y^s)1qgd-&ah+4sZEwe
z<>z`aNxF{0;NvArp*NlUEVOC$Y0SxU?3d|~9yt*0R4)~r4V}P`q2^B~9#?T0GCp+H
z$?QXBe|DGz$i5j&1uYB};C$#bEIczb&yj9}#B{Q!=&9n1Sy>`e7F+Zhn``1(*fSb4
zF4BavU*yyYp&reU<IRhzJwwib^E2&S$dLZrnHUZtzQJ&3()#7u*;xCCb&2FnZ!)nM
zkHmBPoIgN(X0s}sCl{d0Yv;k}&@SSRVHrgwug6JG+8#3Q`$8ns`TiXGr8=4`jQevU
z8;bBpkMG8dfYe+{%S&LU(T(Y)mFIpDAC?=)F=NQBjalRm4Y@%E7Z#<)+A>e{_(6um
z+l6bP0$?WRB-)xB7?XspNhhfeN$1BT)pJr50c<j&$Dh+l%=Bpe1L%KV!;{ilRU<Cv
zmAsxWkf>VcOYapA6oENFGQfDCnVQ3`exNzt<%T)i2>@?y@dIscD`>a=fwmZAx53@t
zr_2Sgkqm7jwrAoDZE|yWMW?xKat#%_WUWKHe~?UN@!_e`sOuC4CM}Uv1?dFrFEvBx
z)P0o7ZDScIXuo|-@f;ddIfWP+g+)9}ifTYgZpeLZ5q)1|m&&L+OZE)zfVvC9)j*pc
z)Ejjd4f7!HMjH1CmJ1YnpBq2tM5ywINDTo-$SQ9p*tc7)%9OJfBd*aT6dKKL6E^f(
ztI@&^8)+se&`e3Brt^nH0>e>{XUavPfg*>D4-8a0WQ^yW$W@;&j9u97AVb;BcE=1H
z8k3D=%>%G|>_rK9>q|w{VWW<I*xC+q1G%;Jwc%FP*D*VxaLA}{6adXatG<b%^|+`E
zGt2#*DGsyT-w9>`SLkl<#2~QyyK5Y>KwWg?Rb7Q6=tv-?r?d4deW|O#aHw5Ny>iq@
zA{!)=A1FBsNaJX$`t3qFF|D<SNyq(Im*FO+vBDo0=yP;bB`=cmvxfxE7C~;+nIIH2
zY=U_7yr8aQ@328T&A?Fq(<Sd(Bo~>Z>bXTSCsgNmW6uZ4C<s3a(!R7&mmY>um%$R9
zGvsSBFs179!(^x{@-TTczC}b6&a$)(=1^O(FKruQ43PpXmJX7>T`u;QcbJQ449#IV
z7i7sboBjELR7#l30sJxo1u{603epieIW%?d!uW)LZ3my2aQt*Cf`k}8daS+aQEz8S
zzXkWtS#sLCANfh(Zxi087_vSxyf;tvz`~)q_f3zm9<<|slrtI~z3qf3!84zZ#n(7n
zueM~%`Kg%Mn#h*YWQ~wM-6%RppXT|G8hW-#eLY*|rnl5u(ZwgkR(>gzN$^%KP0Pii
zw3-z*J5EI}meZ}ba@Cy0^5z+oCk@&-^4PQHTLq+3>IIHdq-(KU7ow~lCoA*mTg^Ue
ziA^f_scVT+@Vf8wf{-B`l+ZENiLS$bCua?b38u$ewKS74YrNGE&t!6RfIz%Gy;ism
zS7A%&jJjuu^jLv_YQ!)8c>)=YAO=yNXb`AVFD#MMp(wq#L@vPz56@CL8_sg=lrNR(
z)@udo;ib|yt{H}7>QXNF`dRhjQt8j^$p#YE;ec@S)JkK&Cp+HR%J0dAMVsr=rP4e~
z=E#&#S`C)M7}n4v7+PAoz$1_tEdAIWupTtTfC+8HX4SO(9@>It{z*&sTgPmP9>99Q
z77b|wRHe=VuT2?>wJDo+jtn_WQh1Xb{L;=Rat=mfdY*bIN2Xpgy+#<dWGZhkv174I
zGu`yOUNc<t^kI*6)UQQO>QK4sXqnwZ2rx>z$)NAoJJjrDplFBMvP{mgzLBFs%jB#i
z=#WVeLisznKPflzw&ki<mPx-^r+%|cra_Kd%OTFssr2P?)}mqT$Riub`wSLoTJbf$
zk#4Z|10|UJHnTFYC(fyRmt$4g;!~~5<)qmyklJL&^Grj%)5s29S<P&KqAj%~O_`Ze
zJJg5E<-~~{hILFgLjMJN&-5y}LM}*#rZE>iHMiZR^)SkS<ZlYKd4)^}eKSBu8uWM)
zMO|MUTHl0PK+DN&$OlqhQT;b_;-S(yUcIjc(LhS%H%CYmRKj+Ik)?B-i{}*ql{*(N
zg24bw62f3z7Z_iC1SGuhd4QvbmXNeOf&HB_WU9+^vAeJ?la!@>(CRK(z8LxC>U+6z
zVsd`Do$lAgZ6>vot?gc&Z95cT26JgPJGp2JMn)oL<-{C7u{SY*1VwWxiUw}XlZa$`
zYt8!UGFvn4C4)2-b>h|Jl`x7ot0gO8_ki58*OSK67leoveKr>&geMK~0g=9rJ7Tfo
z=XMH0^ynPd`Sqf7nqC}#>{BFC@d=_jE?Jar$9?|uZp1rdwdEWMM`#=UE3wczr~a@~
zPPU%(D!B@)lqa!>Uj^Li{x+TG1H0ZQO9=}HKZI}z86V*HWM%vq{177i=mS!<bb}{R
zlRK=`hNGb?>ea5j__Rx`ZzjVnaC-~LfKJ1!FrF@|%T~)=ILCuBQQfdwUXB^|=G9oN
zt<P2ut%gj8`}}H|VXZGzAFP&>XRa?zk9PfOBro44&zLadM#$ymt0_V3Ho;vLlvB+%
zb$w7~!9gwlq_gGGI0Q%M-Dr}tu`9+>E(n1N_djgcw?@v{-XO5v+Am7T##;q*td`E)
z)>J4hyjGfv`~6}r@$=aIFiPfQM@Wv>$>G(wky@cnt^vEFzfu4`h1hg#;cu6zx7SEt
z2m_k7Mn#{cjfh}(wC`IOdXNyJ!#cxebRF9cF;Rh;vBhc+Ghe$KLlo^qZ?@O*87epR
zY<q=I96t-?DiRvJBs8Q$iJUdM)iApr0ZZtj>YlYS$vmSTT`SkX8CVM$I-sm|a$f4N
zkJy%F{kMmG4%?Dl(2i4u>rl2!RjiZK%n?<;PVU`+wI1m-6^B^zvouJ>K=eb(`_mz^
z(MR}?W~ZWo*<h}sBK#?<;5o?dzQ=@GoQEEVyA^KeG0YR=Ae_d*swD8BA<=+gJk~^{
z+bUX2Ok7*F*7lgFwz7$x3=6e9Ca`gg3UW!o7!!90{e(RMSf)tRdkl*&n)mSGLamS-
zuHzmY37SRLj9KXv&`Y|<T4BSEcpU&|2>{E@$1^?FVra?KOOK6UV?}q^V;5M1)bgdd
zQEglgR&G>#*2{U@2FMPF)p!OWLHIN`=F@u8#<#gqQ!1N`>7)UpT@=UroB595qGB-5
z(A>qedAw15vK|JuMisR|`n~;_29f0nV575eOCN7hD>q2r3P8&Ml``^B1IR!%JdU_r
zP$}0L3WV6>{aid+uV;|!rF7M_K?agvs)Pzirk!>Z`+{`bjgfe%QvG~`oMpXKqyA@u
zyeS*Iic~uwz3kWXEN6SUL>O%*OsP##%~51^q2l<Uf|o~B<3{l0DfQAu2#&4_b$+9q
zZw{)Ye7OqF)_l1TPJO;y9eSn2>ym%6B_RSh%)kQnm69>4IRZSD6B6(v4|ml|eS)}w
zdhI1N5{ydTm&*m6h+uC;czyJ87wUQ1t_K0kuT)RSc)4p#MF@l|g5Q~hUm5kd<gmSr
zLIBO>;q=O=o7WFcfXX_4BFUH!$Z{|9#D0-I04W9~?nA6G)EigG4D|PZTp^d^)bYG4
z<&5k;-t5G|CbNS#mZ&B7jtZL2$opkDq}e$iK(0+x_g^WOSaARKO1WYpAdm(H(<?DJ
z_epJ=y8J5acC-mxXMl_vq#b@TxN_>f@wCsgh0Y7p8h|Q{$JAp%2st5S4tp^^5TJ^o
zOV9w%FLcV)4q!(sTn-^eAt7(EahV~*GuS;ts`Dza$&h;gDjBdso<|Gh#1$c*z=Z{1
zc;1BFQJaK~&>&6@ILL-P0?%cF^DdY;=TbsLj&KS2RAGTkT1)^83<9$EZ`DvBW}H0s
zHh>MB1fwq6QXr?6H<EVDwx^I!_pB43o^|{YvejgeJ$t{%KV=_PAQS<Q;-SLP@|IH~
z(@sr>ntHXIWWil>H73`)E7gvx<-$pK=a4?M3;Pn7W=P_q3+~QSPhSm<rboSUHBM^W
zoufXu8XFWf<v3VIvmmn6R9vU&Li%70#xt90o5Wd`VVvX87D#o5S99nbj~9k*oOKa*
z6GPq86t;ri)9i>E!1I$xMI++vjegxY7vfdzHPCKaRq7@=MZIv1oUpyspzW&|K=Z>3
zeK{&BI@%6mL&rF&Q``?4O9N@OmK}_vV7)P&VsIIj^LSwz39|^QLLCc=T4`&ETkJn2
z9NP(b!%X3?w~_TixJKwr(E{^<@QV6c+(f`@0r*hk>Iw4fB8_u>1bukNqF-->(XTfy
zLBHPk0{Q?<LYN>I$_1C#L%*fUIIdaUP$+#9S{(9H0`h*hK{XW0Sy*A7DwJt!F`9UL
zq+P2ypvQLyNaS+&b)*aE0j|Ftrm=@4gkA2JNTTTvz;%?X<jvB5bw{}{($I5h&6n!%
z9Swp{`4rJclm^nFfnq)5gkA2Z7^t>CY&oOu-z?K&yD{6)nWpEe)W2+&i=l6PycxoL
zK&4+R=fWwvmLrc{%eu%ZL|WZG_1kN)p2dWZrJN`mvP?X{17v~etI#jJ7@oeR+=Xb)
ztAUM<t>D#4wj5C-U#)`@p;3FaSwzFqOsjvEgRh<mgp-8V5l^qey90GlSvS^FhOvRk
zgF3T^srCCs!4{BaOZ68NKAnn#W4swcsbTGz%c@tmKx67wzukfscB{A|b{1=AXOT=F
zpPhXOSdgiOo0!$Dnv2l4eX6@iF0`fv)nAa=nwF=g7R$xfv_e%}j8*TnB6V*urrT*{
z>N~|U6FTy*iy;lCd6c;o1a4Eot#Zz~X&!^M3pd&YzvpOn^ihBGtfOvxjp$h?aho{C
zPMh$Bw1oj0ZGiXeR-F5S`|ehmzrM{NjmP3LZH9Sm7(km5b(^tRmuWLDgFi7bkTfmL
zKLh5g=omeKxPjB!)J@yuvJGbq>l(~^l4^lYwFh^U+;#xZB3z?EA>n$AKF%W$y=cZI
zoSWXGe!ERhop9cf^VDhBXL_PejW3bYuY978j)?N)ia5wz<_WW95X*Mt#6DNcFdyWH
zphvMMp+ffPV_y&w&R!-bsJj8rdQzyTOXT9KDI=Z#%lQ+XXgudaZp^LdLCTBu19-Mr
zbh!Fl_Dp0x+0;Px77K#Ye6p)S>-jo+mrC0%mn=S+6UOOeK6^E|lTetT^5XoJ31hQ^
z6Bj*Mq8{E39)NqA-Ci}cUGA9CD%kW*&1<a-Lv3y1mcpV3BwIVw&K+{%l-3SmJmEqc
zF1kkH@Hn&Efh@;&$eEjU7MPqkk2XCK<ntd|4n4o#!?m~&{dH(mq*$`|ho(I2ZnEgN
zUa1op>96-I_jNL`{u>>M)CWY6Z**f03wz~Z7#DRBk}c*p&O1gGv#l)0br{Du>4QeJ
zm8n~=lM@fLl})n_>y<XgLPkVCh?gc(v5iLCKHSl5wX~ul<;`qs_Gq13`<WFqNTbkA
zR*wC`gKcyXbTn>CM1@FIf4)w76AClO@od8Jl&~p7`AX%?G&;Le05MTOtGw#LF=Et)
zfQ-9Kv0R1wNU5APxy4@Y_>n)a(#C`UcBsBm*Z{67SHq<^4GA~ndbu<OdKkk$WrHT6
z!Khu;rtZ03ri?Gh$l&Fe9lfYoedl_aj%E8h*UN0P`Lz26InRWJVaZN8V|>=3LKdEO
z=2@evawitAqqKJ3Cra>|(WT;S7E+F2T0GKCs%SS3FC&A!_sdvNhB9-nD5C>VqDyDs
zy=jc#^lCO|Qf26DRs^R8Xbo8@%4<zm!`-y6(rTJ2rVPiFre-RCnM|~%W~(J-a>0tJ
zL74pY77ge#6{8}@JSa*lv6(~Q0Do#thPjK}9@2D4b>mIbsST>NOnSXkB;XVw4URFM
zTB7>OV78bYul`sDK?irzjaZPvU23}}H_92->>?GqQO=uGKc)>1jK$^ZwHxI!3+`t(
zqI2QSx(O>7xWzZgteJftbEnps7Q=f(#5=}tz9d6Eca!v6aQkkO6H}IelR%3bu*$k<
zQ5mPQB^i(IlBrvk<k7LXU7#5B)m@^EEDG0$^FRf2o7cl2I5x6C7`3F^)|&$stySs6
z1}G-Pk|I^L3yT4`9lJmfxNq%}DOt@J5Y|yk<d)$ti%(-|yudG!<kH^leF=_DDooL(
z@yc6{J@BQO)I~Rn(kk;tt_$6!<91Tq&P(HNptu_@jVqxzd(E^olWu&VM>Vn+NDnAM
zQ<|aClW2*=Q$E~&Qm4vgB9!1Cm&=p|JK~8Tdqnwp6BCWC)o<@1Zr&|AOc>$m+5mlk
z<n|twup7qW9<_A0oWFU8-{U^+k6si=!}T*>WbW`6x{n)&p@70rN*#kjJA_TA%6gLs
z#m0smo$1kE(IzXBeyr2&=u|K4hBd2^EF}kNv2{>OU53)A{;->Mcew{fgC3Q>2O9}J
z>Z(1`52tdEOj)wXT@_h%FM_;s%cI5}#`Ffds)MU^<+_s=c@s#e;sfj!WvW;9$Yirg
z{c4X4z!}{mr|f#h%^UsD2k9C#U43-@?K@=HrEq{QN})8#$cu51^idSu)*UGVKNoq?
zF48t=7vWk_t(n-bYWCtB?nDsRjh%Wr>g?KIgYABItt%duvv7p2Xkt4KnR00qp4g?A
zqe(C}XtmRvIJlI~wtxTkR3lX|5qyvjNt0h1Q)R@B7?@^Q!cWRgjH)uS(LEF_MZSD$
z4X44cmzs8HS{#G4O{+ZROiF~U5)bTk*aVnVuJHl^66schZXgl%*&KCe1;hi~rz_-A
z>)8VJeuYe(`dly|Vr!gr@UsoHam{KF$~+fT$@{Pi(W6%HgHf$VZQBRKYQOr@KDjtF
zrN$fA5FwOJ3}a=Lz4PywZAsv*tkViFcX4i~FjipZTG2y7nQfBDl6#>N%o0O-)k-%X
zpTSVES@stgpjjx91%nwMj~AgjHE%!mwSJMQR_~X|Yjutak%ePv;!s^!+5_4z%3&(d
zT>gs&KJ7?GBl0>b3R?Qcpn7~ij!X`!GjLW6(x9yn-UX2O3$pF0gNnU@J$X#ij@O~D
zCNtploK>C!GRHituF%ex4`5>ryJZJ(y%#Jn3jotGwCO$s6XT6sj7DB}G@TS4$kENV
z`eD3L1Xhf`6_3|owB*#9w%4Ka8|6s08gNw9gEG7xc%$6IGb-U(DXd$=SbYr>N~O85
zQna{mnw)eC`T*Upp|fBe+KsArK{nUAaN#996u(xlzFG<CGOS*xlttJUjJsK0Iavis
zd@MgHf`$0YLWM!8pgMRnRJ=#aRrAfVz<RV&{r+Y-H>vlGUh8p{PKT-sD*YBYXTdqH
z-hWaY!n8_<K5V=cC7{C*&6=C8p-<g=3zp@5>hW7(E;yZ|Ub+Qy7~FHWU_Lxuqv8)r
zZ$URLsPqRd>@2iT_LV{pDE;D^NT==-3l3qnIpnN~94tEv)uDrsV|6%`44QU!I0ph4
z9Ur=r6)@hS%5hlPZovz^>eYi_s9yD<c0M~OlYPUPyx3;#+IV3&6D)|nAlt?Z!^*rB
zN(9{eLnt?_9zHCS$DbDZ@T3E^OhYZxP|FlUt-S<l?O3R_Hq=@TwN^uY!9J2{Lv6}c
zJ8uO=n<`Z3RtVhz_55w<$uk4$r?+DC52(*?!-5UL<lE%b#V;0;dg`KK{i1hl%?M!;
zK??^;h&1g*uQ1f6Lvo_^qL=GWcri25DyHR`9J|UKU1g44We!z2ExR*Z<C*HQH6rBH
zNZv3p&r~}#o~fo9Cr@bnLWL(_x;+fuKBs<j7}P$cMh`=>ol;Y)pnv%=CV5My8qB9Z
z=pkROx~2-Y>jt&2N=_+ipjmOB@XrF9&Z6F@)ihpxM$Uyu^Fe(0W??X4lp>~GFK)Q8
zSDdl8WSYYA&yH8`SIMcNeiVV2a6?8qbM_SwNOU&Nm*qNEM?w)WucXaf!p>pWD=^CG
zAW%{+q@-;j7kT>BsjdKI@j^ZZ_~dQ47-D@W;nM<Js3W(_%TunXp}bp!*N<xbx#7vq
znAf9PZ^y;J$1e(l##A}%fc6UY2_H#$o|m+ju*2N<grBT6yF~65rU#w<F_Wt4SO`4c
zT)ehZMl&8h0=d11U@5eg;YeZtRR=0OnBRJ?iW@a1<JSj#K`g7OhLGv)Nu;eHt`2@@
zD<~FVz8FWKc@9nX!|M4<dwQjS?AB&aGda<1tsLWb=HO%>l#chE5<a?a%%H9`lhXmK
z-$_X)We(M#MagABUQBb_ld;Aw1I^D})_ploILP2Xv;dQcp4&`+gZk_a48G(FHRTBG
zA*WR75t(A83iYKU7<^~c$s;(*dRF~A60J0$W>sToroj|kjrAm0h3w$@rT9}?K^96v
zAhod7qA6v^DH}VEXob#n)}})^N0&{&)Iwge^J>`k6Vbq1U=wsoDi$BrGJSh0cr1vP
zieMfVrlO!G-0IYt0N>N3`cFl?qkg)?%48WSop8I6Jp=oq%ctIMtfmJ+aMntvjjGLG
z!Xk3ATiwjAM?Lr@xg{?RhrWt{1c0X1I(s2zS{-i?5E~_r@VN)}j`EC7-pNoP^vHu(
z`R~MZ6!58A?vzs(_K+2|QuK}g)dYK*K<g%Bc+rsSOgc)E2Ku!<I82<IdF4)-o*f84
zeIuGaJNu+Kiw8I({)TAwZ|BL2%|}eJ8LcY$E;;9x895k80>2!HCH^J|j7^0c&^$T=
zCj{+#Ix})M{o`|`r0oO88Qr|GQG~ltwb3X<a>bmPOEMt*YQW4q^}V~WpqYsU6rEri
z5+k&$5>3aXXLQ$)K`iViEzgP1iTGXaTG-m`1ZG%+0yBM}8do^hz{`lu$|rGFDQX}H
zDn-53W~r-dWU_ZwxwaU1h@|?1X3QE^_aN0uk5`Y?U>h|Z>zy3e@kvl|)<Jfy%Ok(R
zZ<VCS|I?GUz$ATmb)*ARG9Y2%D^3XX(92yXtP_^#^u6r6BqoBx<WV{qf3rwvHr3L*
z<peLfA39mFXijN`By>h*%AmUOZd@$AsP4I2&R8`C3m6}5$|Mg?$4ZV&eWq_nUjVLR
zhC%b@B+`|#5|P{IMjm`H$|)L_;=3`k%t<F0TSa=QUe?;FnQHt!GAY!JQ?1*e{sHhD
z?Pqy1r@t|V?}t<Txl_)Hn81#JC(y&9E2=XZh+FuF=((T<F?mL7G@FVUg}LAf932w5
zL6D7wtsdDKz*s+`puTmF^jh<B)vNc&iSt0CAdca6nr(C=)@H&Crrd5FOD7V!zIh$W
z6_PVTgLxQrv{!7->&T3|&x2c|-stIR0waSX2WeEYY@Rm^14!6=NmiZic3XM&6E<_Y
z6YbmXOqhP?t4Lz8F^2-+R~-nQ!y(9U5(SWi5B4X_xgfki>jloncr`k6Gc+p$-MP7X
zd18B^0TaG+i`Z7mUYt<cq2<tA?7o7ZNhHm!U^zr+&BZaikTU@w;A(K&vq46Va5@iO
z``rPQ$e@nXB!Jg-)a&FQ<XQ=62E65H0D19@g#F45`Nh$0gPP4fJ1<ulhtO3S=geAt
zds#;ZN$KA$hD`j{$!=mq`vY>!3#y;jVlg<cT3xJ_Ypi*-YQ?=cbULrr5J&q6G!1%$
z(DmHZ`TDFYp)$X~ZErxZ*S1v7FY?d{2cFyK1kg@uKap-uIxXh#qA9$GjOZhY(Zmog
zI}B3lBGu@a#8SIR4fPBb1S95b2=x+&`{+`Eu&U9C@vdqBp${4}1rnA9Rmb$kbXr0Z
zl2h;!2xP%?;ek27MqTq|IcZ9rZN~J0V3}B&pnc9DosYZr$Wpi<qlLPL1+4AoK3I^8
zQ!kVs@E7D`I?~%P=7ORN`l=Phm$sYO1R68GGJWdbzYIaw1+%(7@@6i`#nv;u-@v?{
zSr1XISva$cHdwfV%;CArX111)iII-;j<6Qd>rqfT?a`BY(E~5@zxFa=GcOvhqc}$H
z1OPO|-MBEKq0K*^K*z8ch56_62nFi%`7p|CbqGGcod|vh6a0=b1g|9BcbgcT)jc0=
z(gZKcyp-Sz%SaM#6S=+7L^M*%xVIKosLSi*<V_2!Y57zsFg+BDz$q=hfWX4@J#^oO
zsc-w4APX;?iDFY6<r&3#Z7h)&m8&Cla@w{m2s3Qd{0(n;n9Z)RZjv3}O2#(`JW?<h
z)#GxpY3>xK%npm~onxbmbu`G~vN2u+Q&*kz(;aOX`9ur75undL5U>F<X51{wQ3DRG
z6K`ad(hU~wlSOCzv`A*!FY0D_Lt|o50|p323lES*jco1U_$I^?ojHK5YO03vw+XWZ
zZx`BrSA!aO01E}C(V|YMq0obM;$TEfEE>cuaEwBY$Z)sIEVBWhA2U1`4I7AO4QtT_
z=iI%y2xbnNw5c^g)_EPjtHE#Al@-b#laddZ=}t<aaC$1M5b=&^%fgs(XjBW4M-<>H
z8YA(ILd!O!klZGtF4F`&7=62z9lA`rNOs7R)y`Q^M3?DQz4zlP;i(d4YJOTGs|$<)
z8DaQi?l9v1%185v$XREEXrN<iO!BNQ?h3}K+bx2*0S7~b8b~hcx_jfJ@bF(vBq$ns
zk!Z`~EU<)#xkK%GKu++T$56-V0L{-?iF8hjKGd{;I{pBT%w~E2K@%A_U!)Uo>fh-P
z?1~@NW047z`S+#y0lVyYT$Z-wN_HZQ&#<Et)a+m>ZBDS)1G<GAe#=gz#<M)g4#Yck
z;OA(8Yc?crItFWcwsoH&a!Y^=1e4ZYvY}Y`k><~!wCr5seUc>E1%|7^V^1Xr02vLu
zp4rCnhg|nNRL*XUFckc*qZu}Zvzwjc9wxjtYN%piKUQ$K5Y4?p0eU$_2ZqL`AVA`f
zXOxBcG^yG8%)&;YQXho5xkasbQ2I)HeIkx#RvuYXdi7(7S8I?{-ANAjX7|%}Jbj2Z
zL##b+70seQjOOCR7|zU@DA!`2`j-dgB5QF_{riJ*qqVq1Wgf$BIl|W+lgU>>(lQbI
zEZ6ZaQ#80vC6Wi_(axzj89}pI6I!Q<z8EV%tn9^*HB39Sl#f2BXi2vE;W0ViT9&K+
zbW9fG2;};Q<d>|aLDl_`O!X{JWE$J7nlqyQ{1Eig3&OZS`(RD3I$CAfsY@@Y)CQRe
z%ipyP@;+;6k$SHI8~V#LRMb~w8o6`6A`g(Oz9R2j0F?L{rSwC*XQ>fg&aqf9B9`<c
z#uR8SA5_7I<)q-KkD^)UT@Jsa<E#+Qu@G}bJR9qoU&zl{oW}O6M<14cSlLcLEN7I~
zcUrW@p<7Po3JL%;9cn@VuTLQ$i7{8y>-$fD!NF1384#W8HyA_8pIZ%U3)Mj%+J(;T
zRXLAfcM?m2N90U8+xG|zx>!;-;MOBeEKK{AtwaJe7MIJhI?lLYPeGiRdy&Raxv0dw
zAkyk|2@HNWOhu);uz0tjP)0vxtU*3v)Npa?I-K;uVB_2FDzj0>;*`>gMr_3Ns%?#O
z%B0mny&ChOQ7Gsl<X85pV~w!u^{VF^v8URrK4_F_$*VK;l5Ta7#SHJSQRYFFd|Xc7
z)2pZF9<!gU)lLHkff^y<&vb;y;vs_>m1av6Us{88gMQWruZDcfc{GW8VR2CF2u<87
z%ABsAJ}wgv;NF(4#H@xF#zpD_^6DKTb9E0tJVgA@Y=AHd=v<K`CyXTK0LrCb1_Nq(
zu`{(!`M-*7o{m$@4u~fX2-a&32zF==Al*I)s^~+OW-t$@?fCST8SKDg9eMgtGY1@#
zNANtvqsC}W4pcyTu?kSuoY8y)@6;aNhF~g{np4roboKY*`u<Ijx{UhNL5Dmxwbu!I
zd3QdlIR>MgiMUR*$B;019o8zYV_ke}3@=WY{_A{d>In?ab=7L!3Ax`|SF4^sAs;jA
z)fG+hVHht5n(&ruqssf5{1-SEzb0$F>wIL&D;5p(bO22m8d6X-J}M_|>cEW;>vq4G
zi=FbF4kN77vC}#BhHw!b8xV6b_gt@AwXOrD@q4Z|&<^#VkIEH=>%gBZL5V-tmC@Ni
zJTidi7|~N8R$dcLQZ`Gi#}tRUcZgwntO~ylMwDHj=?4ItQ0sG4t&$UWug~Grk2m1e
zoC~xSt#jrSur|VtT94u3v2LF(JQe6K`k?;xnBC&3iSb9kJ5FQ)CRXeAfDi}m;i~gi
ztN&3jv8)Y1eRgYhWPdcy(E+cu0TKYZW;;GAJ`!&uytar|=*1#F1=_U@q=sZh*za<$
zaiG-rX*|7-A3mUluk8yU4cmv@IE3s(n^<eRRA;kH^mGt;@Ii%WA<kg+H)DUcUj0|I
z%(`)-8-p~i%E+gU@#oH9movBtXZ<3<O(k(vp>PmjQ1M3p(&)+);%2@mN8tc1J#<o~
z!`oDwvCyX;dJG%$aKCN4sgKKKHT0MixC@1}DR7WP4pOF>wQ9}dIBr&}4ru3VkK@c;
zt$G!qahdU?#}SnPdO@xF@5iNoL1v-Px%d|YO&#WNueZ<&(m}A~9zBZr)h)&+xklwb
zAy-&%?|VY7BloQ*<XW>$UDkqA$){9)3+`QZsk>U_25fS^)`I&YJ?d{Qa`EKJl{L}3
zPl!GC?LeX^gPc5|u6a^!4tcSpwTVJXkAbkYPU}46chUr%6h+wO#;A1yPNKny^@jc1
zxvV`I-g<o=j)6wfbXlaqWCwo;P{$-*uAA=w#xXTbj#ZcjZNHP|j<eI&LYmorCoRr~
z<8sf2DeenEFCTALa@`408UkIy5!+9Q9b>~bT}*;L85^FvPKa`(b8QH_+_UVe$0X8<
zl`>leU~t>-6pW%Ka6y=jbpSsn;iNL21ZnRH0Yjk1o5Gt<h-=4&Z8QwGa}LXx?@_x>
zVkZ&qS8Vq*yH)D9CuLyS{3=K<7$=QRec&30;-Dx)OoAaP4bgO(8_~tM!GaH)#gL>{
zwaT<{ZMC#R66GdMnj#Oi!qPn{TQ#&ox5C-yRt$i%>VsD375z#)E$3jzZNbwx19eW7
zKaI%q>LGG2sP9wSMfJhccm_KuKZgYvNRm|5#@8u{jV2v3Ag!1c;k6(`96zF&c_<nj
z>i9{vaY5KzV9+CWn^a?1OPzuoturGU%%c4vj_0nW9}UFqOX@6m>0+znM>Ka6MX#{C
zOy_1Epy(@X7SPe$hveO(yN|q^BVK3&#7jxg;6s=lxW;^g?*rL>G(p#hXpA(+k7!*Z
zqVYQ>jvvvwMgTk*@!lNq>Qh|Y(UTxEaj%-*4905|E9e;tI=X<_%9!NU3pHCdBwPq@
z3?nC<9vFM?D&dUk{)SB1(n5+KZnx3dbENY@^@LVunP()l@#$&;pU_I+d0#aFh5&3y
za%_8~QbzDkd1`(e_QB!ywqpVCr&2ZAj>nGwRH-+Kk}|Pdmvhe9tuscvIc(oY4I=><
z@PR#fgKP?=8vb;O3{zYgd2w38iPc6y&VW^=6RXd|5E1ADULVH1ir)!;MlQF8^VET7
z<dS)<_EG6`k;mDLKSIsHwN6pgZJW0B$ogZ2`q?ws34{CTGkD(Nj}@dAZx<PZtX?^p
zD6*I%dA_rw4~30OTSNdFtlptC{uHk-_)zQo)MnCpf$1NS-^+?S?)hT+CYy=z#~xT#
zAZK-8a}Pb-gtZ~f!p0vwuskEp2~Z)&AK5GYY7g1K_KQsXF#Q-V;3~h`qx!#zIj={3
zPR@Ci{w*2EKLM>H&8o6Q&QAPw2zdg8ggFpLE`Ty~$_dz}(PKpV6EJLPt%b8wb3V;c
zP2ZB47Th<#1y=YpU;Xu4V1-YiXwiP*7g^!ci}aio_y4dr%nHNV%nG_MKg9wyz<b9|
zOHlQv?LpQuY_GPBaxB<_$V3?;Y!L<2KFQEr3YWR`lRV9(pFkt}hp6FXo{ie4@nO_H
zO%HSFCoN$vC9ln;<h8k!yf&AT7wGU(hdW^)K<tCZXw);`#-`LjKy`l`ipxNr`pvho
z(uEuQ9o%ajC{**lBPS;h5SxGqxiF^?QuINa2C7xrcVu!hwBH1*<?^q?TF&_(`4^|u
zSHFYl<sG-``VJ0TzLT#$`3??Y!kzJ5nPt6Gpmuy$E}i-gNPz7;JYdU%(Sg8Kyi=i`
z|E?@F&pz6LRp_vq-65w>xIk+qeC*|?(VwHP?~rNB-aX_`I%?$LSUVj~PMSo2CrwN9
z&;fVumj0mD*U&@#CC)<I=+9R#cHq)@f0-KSkbB8p^Q>GuxgP=q<c9kF7rYfq)v;1(
zygQ_xd=}LDWx0C!S(!4spP7hQ@|PFWS^MTDFm~+2ACRNpum1L|+-AWoc}`~S>4$nx
z;7hpKyiUV!h3Ysr#=1Rp`+KY9Jq9&pF|-nH#=G7khd18MqZ)anzEhQsf!auU^aphw
z7*&6M4!h~2D(QI~WvTS3mCwt`%POl4_w9Hk!d*-HG|eHG#Be1E6`8JMtuTW{=$ufY
z8UY6Px_<Dy^uzh3cK+*msMvjKawo=fpUUe*O<yw9{!Tg7)8PyyCPB4dHFx6ZF5DO4
zUSI7O#zt_?Mn0s}X`fzWc~V_aPK->0sk(@T7ZJF+tb**>h)3h9F{)#%2K>rsxvL6S
zfFd7CtWt}=C#NOYa3V_a9sO$W_kd`>I<B3UzbDfc_TwfxlpRv2k7VliCb*6xK|21t
zP1FqWE(U`E^dmtv?)!2|HYHa;gi|uDX2WGlA+RZumeODx9Lu$lK2oX5zAqQg))jKc
z9Vzv=?gai$fZI(4sG=_QuiwW7>n`;l-<P?oZU@is^Fq0{G$Nwh9%O`df!o2fEPBs7
zx9FKH0Cjt%s{9w++CdKMSSI%>#WvG&?^w1FL6R0k@7r6j-$N51x90XX&60H%^gJGR
zgxBr;G<OvV%qy6e@u9c@sv6If;x!9~#R-&hCyXPE6mIva=u<LzLaP>OksNJm;VGHw
zgS5qxw^;Pjmfl$Vo^fZpy5*FdTRx=iJlX3obehbQ+DHSe@2bU9e1Jz3xeG_|?K^OH
zWeB1t$7a%m!Q6FcA3rj~{<|6-qb6YkY^%<x&rZpy3FmUgjwed!QS*O*BP;J$sB3-z
z!3MY5cEA1uFg?O&$^CVr`r{8|p7+;P!l=Qk-KWe^llDS2L4RGXu6#lIrv4^TAJ_xF
zzaAp5p7t1p4{B813v$)?4+4e2K0F_O5K!;Dz+>&NFJK(@sg%=lO3EPQr&}C9hLaZV
z9J4f%eXvMvISn!Xo?qQ@8u-F(wcWQ)%URj)`LR<<2D{2WGMRJdzlWD5$m|8I-W%lm
zAC?t`m(xv?Uio?7r)Hd?miyGEGcphMz@{^}2{ov?&H$}J_2C&A*xy?!3<xMu*5TZS
zLCN0pG)Z78FW{B}eD6pO#xgTKdF^{^y<HjbveE}Q&a~EBHdg7g`|0Csb@Pij(F^yR
zFJjjJI8P0{h}r(*a(hYzP=0gTmZYE1aSh$dPk28Nep;G*+(q13Br<U~9Wg-d<E~ty
zhvNnRI9_Z_IbIBH$4dhz49bHyFGUQU93#8C@o|qj{u0gro-9)BFUeg0NsNU;)K-ec
z3;mkNIoxKV;`jiUlbuSujMvjfRQAjAhI#)mGk4C(0k8d9m{W2<{qSWuIctFQIbt;i
zhariF7PCb>ode{8tvNoI8w*Lw!FgJ9RD73Ap2-Qd;i9duDdFwd9O1z;3J$#1X7zNJ
zoSFln;l=By!kdO$HX3X*%rj$3bB?N9%Hdd1jn+Oc9qRl0(tT__vaxQZ46dqfhHo?D
z)9GJ8`{{Hvjo*2PdbC%h_{gtu;k*%CC}*T4hES_s!DARL>grcy=87J=Y`;|mVPWH5
zB&t0*XdhS})(nhZd<wt6!b60qMh91)s#IrQ!Di$o0GJd{m3pjAVLCpA(SW;1Vw@*}
zAmwlrXZTSw8E%cIN+H|X+6gbiun$Xr0S4b!wqb<q0F~si^i++HmVjZI@f7$Cbee_t
z6C66h{@`Q{A0shP4tO{fqL9bBBU5)i-|n;FhVR+ha8>`m%EVG6G9*eR+FVkc<;qiC
zi8lQxy^Giq{DbLZFN#pxyTT9QJ#~sOu_x1~x>Vy2C03I<69LgC)h__C(+Nm8ol2%z
zkJP9i{1ECV+>d?;YZzRAH?GmZE$N0CtWBNh#<K-|>Wyw3L+n%HRh&EQQw6W$dPko+
z@G903jq&P<SFvf;=u>aLD)X%4l`8%<nVfhWQz`n9P^AxA_DF+T_8JtfKDF~TIr*l(
zY%&oL>W!oLNf)P4jia<o+e;@s_d3bEZ{cVO$I%E_8HFd2HvL4R-?lg!$MK^E^nRK>
zQW{&-uV2F!{qbrtRv&ST>PJjCx_iIsCOY!6={R<vu~wp4@OT}WEws0(h_;eBwz&|x
zip~qKe#_T5K1A>LvM@f5x4-Fp1VP|fr@?4Sd@{^(qP&`nb6U{}C#n;#W6Oo|K-iU6
z1MnDq@{v*X_UkyC*hp}3VyCRiF~uB5zT*YjECWC5!UU6PJfTQU?ZG4jH{W(|>w!jh
zO11PrbPlWD9#~Pk)WsgWz|f^;yn+6xS696uXD>akPmR#&E#okjEue}hEwh)A6xSjQ
zQY`XXNUy+$=7+=WYRa3^yQ72E2cp*DGvQU};Vz1Ga-P#5aoXyzS5FUz&+Bw5bus*M
z7kSYM8h(`^_(?b6<!ON8KERv9R6o^4Z<tdB<i$BEeObT`@R<pu0m<>hL}T3PuYhKV
zBiY<j<A*Eg^)7o*j~`Z#zA5LWOz;zM=1MyQhAlM|8GeHdizoQ?Y>QeZ1TvTq+B+Vg
z({Q})m^(VnIpL<OPfS<AAIV99M9A8^fW}>;q|7^bAXei6Fvxl5kFa`5#C?e$;nf2>
zjb#k{mp}Lg_%z2R!U9H`8@DtO8ZLI1gfBDZs1f%$9cf@`me|5N9Z$-My<wsyp4Tlv
zVO@S=Kp5Dj*)JN+7E`F4v)I+3xJ00h*I>t>jo2{S@P84tu!x;lMmB<7qO2T$Dxi|;
zJvzfK&rSOW<r&k7Wx#YHFhesZ);XsGjfrP70fpN&@uG9kg<C+K-B7EdehiMURSUGU
zT{}m~X;;tw81n3t`tZkmta|EOaucjAx4eZTojvNIw_r={Q7^oOETiiDTiBZaid*@9
zA`85aK#$~;Nq+lq0h9YHEvoh>GG%2;I^W|2nh(c2$5zOz&)Sgv^kLXFok0t~J!paM
z!(KJ;6X_2=?7>B8%XRn={k+34dvwDePCo)JW6pmV8}T;hKU~j}id#+GS*CJ&v3P{L
zy%)=MxYfPTI(yX<y%_K8OuJ0eh%vvdUj3yP1gTe3ekx~_W4PN(i$Q%rgfkuXYe`#D
z!J~|a+-)P*@%uc7s~xQq)!+7o^4w#$b>?96#li5lPW8>7vc>wRKgDM2VGJXCJRim?
z#BSALUWHH*Y7=VbQ5$qUSm_K}e~`FNk5BFAy2htx<5ryMtaGU}2Aha|FmX|!0XH2n
zPY8GHgLrILht$EJ$&@RGNVMYp@G%v5hPVQ@d5?#5v1NfB&0MLY$I$Y@D)r9KU>Sn@
zx1T}w!kzs#jIMAuzm5H@CUx*_7?Kb?_O@K$g&gb>xZXM}TB0JCULQQKe*U&hOoWw$
zR%coRWjZ`~QT_MZn07C!HGMdidCX9CeRAQHV?JTj3$qlzyK)YWK{Gpj(00`Hi#|Nc
zeJq`p4&kAAj7Z`->>*k}M!0bs-9r=udmd}AWDSJ8opf5qmM6!$s1Hg6w%hh-{qfk@
zg4kLd)Xxs!2B}^8A%2dD+2bL$4>I|VVeuR0`C|~+n72q^JycUe3o+a4s;YvF;y_&$
za9~D%sDWCf0XEuvMnd=@@L7UY6)zI>lRZFQN2?EiE~l5BCrjLZ{DzZl0MOLff@tn$
zigu(fBE#Yf{&5c)3t4g}Hd)itKo#aNI}^YVRg1jp#$Vu)OOcn(Y~WXo4vm3_$S^$k
z{|+8gxu_J@QVrV9?|`niO^&6PU|xjiS*U3iMLU>pMr@?2`hQkcCmENx6?T4Bzl(bR
zPG0^dLv45m2enaG9=NiqV<MO`%rn1f1<yc_6Cw|mp3<g?WH8Y5_)yqO$xd1dGx!g4
zMib!YYHdH>#3AB+m;?SKt=2$}Vy)714hH8kU6^JmTeJG}J2Ef{i=0F#MTz>luC8yW
zNzLuY#mOFZQ@?!7`mI}i)-Ma7#9aBVyu$jOP+xl&0vqm+-^F13om>6qyK?rFx=woA
zlxO^N<fqeYb_33JsujP)K3k`{?w4{(@>yE#Y{%&->_gB|4JQ|jVZW3qoByqV4!`dd
zm5`7-?a>B|DVi26^yb12PNc&KcG<CsH*g}Z!oyBR<*L<Zzm(pLe=DUKdxt3P!D$Al
zlLna*bR_O3B9a#TcBESKE18h26Y&#$NMt<i<Z^ZMuVm7yk?=zP_q?&e3+;dF;gc&g
z)c?&p7kVp?t$)iSCV>HtyBqcXd%Jq=SGWP!u73Y37%{t5%m5vXspW&RRQNpkZIi*r
zZZgbpzn?!(2Y}FM%5ok*)xbn1fDm@skRN&24h`ETbtGPlKqO#k+uV83k)_gHKJ-L@
zGBnU_3^hYTrT7xR%k5aL&zDfVp4m{}P!r^pIF3`9BA$PCAd>^gfPzC!3kWmxKXU%I
z^wIZZ;)X_j^t-4MO~J=b1Ji?wA_YJBA+pP99YE!OR}M>j#2aqp@4D2E_n<(Gsw3~o
z8J=#s;I2QY=Xc$z1Bsz-=jI;Q{!t$AB(90iLOpzNi%KB>N1y{pAj+#8I(&pC+H@u_
zswHXp5w5b+UX$%7zP7!*l;)Z0qw^#?S(FQu7*$uj4-4J75_RBxnKJntIL~jEiOy)8
z#xA4kb?bkhty<rglQ;ez>q^{!!LK{giwii{?j&>cb{)+&T*BMVU819D<;2YaF!R^A
zlx8QFA-T`u+R%pI_tINMyoCCFU644)@uN9mFYI8X>mvu)J?y2iV#hjD9N(G!eVw}Z
z*Em{_X@k0rk@&DspC!uX?QtshVHu9`;FnU^4+Yw$?}t?$ejrHW{vp_)2`q}2KrU!b
z)zI4cs5pLWie8iBuGaa70`@%uyw$fv<Q$?!Bk|3LXWaT$H2gz&=+r)#ZFrjUsrig0
zL-zPp@gQWECtKY+i073(xT(PFCnE5;R@E_x2l9bb0FzuG0LH-rgcM;eJPv3jLOT#%
zpYu>JN`1A?z9k=w%q*P!t99zK51^dXsk!6~sw?0u86=U8SM0q!;m}1-Sp777`e_rs
zNosFSb37q-pj)+k0L$)Iv(;-K;65T;>o?k6Yr9|mjm)*m4yo?n$W7#q|4`PG`^1OP
zYx>nkAIcSQrVYuJaIPQ1QHC3XBo<3VUsP8NI+ACUa*soAs<s@{Fd0n~us`D9SdL)@
zgS80Y5{GTGEpIIaky-wi^<x>MyQGYt)<d^BCF$3HAy4U@q7gVM=C?9sl^wYak!Nws
zL!7moU+0TLIpAPt*h(3k-w7dzlvJw9ev6+(zp+X^@>@B5a=kF>Ag^JTua5#_gr|rb
z>(x(?FL;LR!aGFyfWAVaVPG1}#Um;O-6Hb1$c^ZuOia|lUOG-^*LG8Z%K06}_DyA~
z<afBkb5oTH{SNjWxNX0aS@{foj~Jqn3`LG?uQ%57DG8QrHx2tEjJB(dUZvP2@+)H&
zZmKbSIEhV!B9f1)X&<qm%l(KSr9b!)p1RrXSM?vsDc%t(wpEmLL^e23X75Gy3UW=Z
zz~F$MATq1bU1JDe@&9!8K5%svXa4^=mlJY1kZ?%|xk*Su5|WUJiWL<V4T-3zsF+~I
ziUt+CBw~Y#7Ax(=geWRiRCG{ri!I&KN-f4zX`628F1zJhX-nJew`qTDOTVRU+S2V+
zQK?e>y`PymaAWuP`@Md9m7Mv^GxN;MGtWHp=giD$RR8sxl(jd_&eaW{VAkzXCwWUA
z-&T=3t)`NYFsmIVC)WEK<9!X|iNw%+8%{z8R@jh=)xJsU<CaSGkCUwX-%_i-JDHLd
zZTFm(B)avsBu3G@MVwO7TRPNVpjPzj%doEJtDnOR+2^Q;^C(N6d_|YVj$p^3^YL2G
zVVmbJ7OuH6LEld*G3an)O$x3buTxk5mVIRX>ha&El$~`;tv6>2K0aPRq2(ts>yloR
z8?mdXfqQff%;`&=qcVP%vT9QuI?YFJz0|qES6z3noB`FcWgioK>blj=-^q6yA<PZi
z>S)J3@*3%|$C*)CF+>^mPNPjmUc}owYe#n6j!BN7-<r#!PvEYv3|drO_gt;j^(NF>
z-3Zz)wbq{0@44sARh#v{#`w=woAu^%I}-eaYO5Ppg}+ZZ<<x2J$D|WtbjE6(oUzh^
z+T(c+E%RC~Dvl?a!H|@D52q-8&#m2iiZI}E-G6uJNWu;Gdn(j-evjhr;hpyHnH|TK
zcRb~+tM`Uw1ia5{#LDbLj1(LG!Eth!W+sKJr7Z|S0ITSF5n@kKlpZZ`+D}jD{O#qt
zO2<={ZQkp#6d=bCq>J7gmYqdftb0pjld~<%-ZnLQoLykIdg}Ob)?IF;aE!3L^eB?o
zwREf8&q)^M0a>uI)0^?7U*P&b8JLhxdTTg2Bi_<dX7db&WP_jEE0dVLULHotm`|Ny
z<IUWr(^aj1NLhN?tX>Y2x8Ub8n6R&HiqpiYCwb@g%06iGL-OZLtC2sjHax9<&qFRZ
z(W5YV*;H*td%8Uk^4tdL$1v6TNq6zVAilXK2HRvJSBk<>RaP7I`keNCjbh8W0M@p|
zjBJCZ7mr@kzVmL5Rt5gC<cyYq?*?y=U*o-&3>7E~PU(>YHwSm(H32N)GKs~G74mCl
zcRKrQZQjz!TLC>}L6w=3X@8UL^b#}5$jpaMdHBQ;2VYG8X$QIKWlR?I-rS#g5m^<>
z&9}&Yb555u-BIWMDJ92Gr^HcBSGW8rW%DkBTb;A`+;23;m;JxTI$aRyOMOT6bpxjE
z)6$ZAoTTedk#U&N<YL>%pN+PdJW~fhE>gex6RZC}u2+kuQnHu*Bqw5&VSY2r58BlE
zQ!E@$s839>uJpqq_1P(`=nrevktuZbM|tYl6n+1X^40rbCJrn9%xQvIb@88>IE?Fa
z96AF(=r5eJb-1;T>caj26KkrqP{vELR`!DtnXCj(iKZ*+hsU`2C``?0h9FT#Dclcd
z^nFKHPFT`deV*PaU8YA3AiEoSuH3Kn*r7}znp7BU7to5Kuh-PW!q@uqxRpuY<oCq7
zl+El@avwROuK%x;7ekMhs6~HCx#a4uI$nYWy@K0C3)HiQa#UH8cDq^|FvwClZdco=
ze0$y8|E@jSM?%T>1Rg=wTrS*x;V&s$Zjx)W7otK7i(n?jhcY}DVcx^CG-E)*uqMPz
z%WHFoL*8R=AgsBdbF+F8yG>{PPLsJFdw`r|p03xcagyTGeEm>Nw>U>QIV}~zfZ2VT
zeP$SG?POACW*AZe_&y#{Ux{<oB+nnlQ<j%M-Yz_}G#+nf>81dkh6V1V#sXP;7tkZq
zP+Nq@NA*p}*E3e(_6Z|g!#S=_dp%`k?&C9_!w{pA;rApD%VO4SUeY0-NK^Y>XTgo<
zL$C9O>WLEd&DT>-i#^d~>`FMozJtP2b{*)lJ;7}vcVQ#~K-r9Qd^Cv+=mQo{j33r%
zNtvIR%t^j0s5rsLTU|a>ZmZVhfIRB4DRZ5mS9LGw#GoIM?&wIUH_5y6+j2?>eRn%c
zFpam7sE*soII4=`RSmj&CMVy)Hs-_ajH|D{k#hPK5`^V6J=Qh#@MNVqIsvyQYj~Xm
zE6wc5I<tK&H&0iSkXzF96lX3(pE~8ul$AT4>?0HN@doG~lJC}q^72kiekdrOa5!9&
z{K)`oHd66V4y%XWWaRnen0o0=g#MJLe*GrjX??0dt)EWWwL<YpxS*pkk!0!4eX2%1
zGR?(dPjxj0b@^0Zg&ysalsM<|^i-cTi9O!J3fu7AXP86FeXgQJs$eis7uc#&Q|`4~
zRA3vUD(5Y=RTov!HNV%?Rn?x_@m9*x?dqs3QqjdQFBXLqw$*gGcE6_pJxR3$vLQ-q
zek9sasGfR@6JQ-vbgEWyw7ZfXNmob5l-|i%>}?=K(BHX_MeJ~^MoWlPAFGoVVHM)B
zs2vB;?-|W}jGL5fsUC~6=d{GESGoZ57c<Qbpp(Er#wW6gs;yysIIK?%%A%{zlM_do
zcqQk_0s1@T+^6w=y+)*PHJ`ojO@R+{Wf@t$P6s9vtf)Da)F_H6{%>H#*%soJ9ZPn1
zG9YHSitn4)SuM{_`S7Uid*93#17ip5Z=%Fz^=v@K>tY+6H!BAg$Q}WHmie$se}~Ok
z)Q)acvND*%-4=7h$~RjiS0D9?v>7vEbBre+4#qRkA?M9Dd81M96|nurN@V(Qy9|LA
zNHZfrvORrR27;_lm5VNv3)yQAjh#8SZZSP#R=!xbmfa51V=`A|Ov1hvubAm$jpQ9>
zLOZ5@^-ju)TaXWyk^(Gfceb;5rF*yOsWej7g?=ka2kix&+go{2v#(fm(0QxGo)^|D
zJa6WPgG&`0+@@@@3jSuEx_*WmL*C36o2-WfZx)Ci1x|?;xNS>t-Yg8vy*TwLTD=(m
zW|2{K8L;9`NTnEcp(Koq<!iv2UZOhz?JNzSA1bDJ79_+&a~K4tv6Ad1H}Z~@v$rO8
zxx^OXQ-(K=tJD6<h5g+!INaqO5BKviawkKi@OsDG?F|Co&ZZNvRcPI?5FT&mT0Q9%
zgBCK&t#6}frfJJd2Ai6AvRT=y_^{tc(J(yaLLI|W2jmm3jU>5H7LDGnED%!=xZyeH
zq_x`+5?C^2RN?JP_4@m~m3bRG7DiiHKHclF^W|=azmXiY-!{m%F$e!$gG9?jCNn9W
zsW8?nny(M(@uS>mp=C0GSqWrf+>*G+<hYedvzu;Yg6<08ov8ZZyD4k;zJrnB9J-fR
zEW>f5lkY@}wFoG#IBm(_iRur!P%zQ&xp;*-o-R2dh&SgvK?tOW5SFR>_fpa-kN&p>
zeS_3xL-nLTo(>;V&}n__S{GCo=$%P@s!wj|osmsqGC!8=OsdiMxDIeq{q{XNqnWTu
zo8^7_Oo7^JpJlU*PQdlEDTSe#diD8PIxFx`W>YrjjTa|9HjbW1{mqPf8tB2`%!F=J
zNlDVs{@SkA{f+kqoof5vQkGrTqpzj0mG{n&l&Mi$)5dvg`bL2q&F0fN>0L_@<YK9<
zH|C9~$^5%%>UkKhdN+*)Mj0n`g=DxORmhKo-)&Pr{u|kSH&eOqvuHQ0*7AtGi(PTV
zs=suEt}C2!m!sWsPie#gInEc!o~P)}&3U(8zG-c9{x13@jiIs$Wj?{LQv5y?ZkPCB
zHIdYr&bwo}F$fSh@#maumI-|2TYdT`dh_m>ZVY?g%lm(948p8f#xmLn;tcv;@wT&U
z38Tk5TK{p%QKP_}6y|7>RgCx4&>8-+?WDYzwyaxTEfTKP>;96%#kI12AwLPzAS!4-
z1caCLa@s#z9sPja`HQokO!3bNEzWuJLccI{a>JAN`X80YPyO?Fs3op{e(1GkwbS(r
zLa()`R@XmGp0B$8DYD-ull6VJE$IURvIAOJFXGIH>wkngJuSqeUDcY03i*Yg(U5;~
z)uKj}3!~x5p5`ReIbKy{dr<SPjCV!CP5Uxd;%*7PahK@F*T<OmQzTO?30tDBO7ho)
zc;24mFJq6;ktBcRs@tbzI<v=oB#M`h=12J5hb6$OHHZI>uEnI&|3;H~E6L9f@!a6~
z8}kS32uDxdS%vqCM0<2+^vz6p2{6a~Yon^s^X2sZlb)Y@=BUSZ<vOqYI&yMdtK9^z
z;|=6XJl%ONs$fNYo<;wx`itjhhjw$@fjr-9Q70|nd0m>iWP!h0o^=bTA)b8;{O^RW
zt5<uH{o)02tY@Wa38zGpMTXb4tC3{Co;mFq3;hRqd}pD5#S*zfO26t70TQY@tk#D8
zyij$Hx+Lt^#s(a@V_vJ^_1zJ)cg}gWle!2+yT03zz1Z5U5ki!D&dph0>rVF@`PAT9
zav$EDpBc~TRBs5IZMj^!&e%reZvW&s%?)97T8e*iK7r&QBu7=XY&1opT`hODn>G$X
zS|c$YO7TAu;`z@h{wnU%U_evJ?T<-~bWXfwu*JBcU8bYDL^q7djDyx?`jH#P)FR)H
zp3Rp#=H3{j)yV5>Zo&-C#Tki-w>~e&y|+Qe(rVNVzQ2;U5%>81W**P`{#H?Y-(Md}
zi>SEouS-vha3U;-ky@j2QvGGcsc_S;EOO0)j2`9UneYzeW7A?|SQ?YJ8ur*7h5p#I
zx;@p;%$l}YHrmU-(5@O&&!+lkuvPKLss72^;$~)_Ewd>3NeDV152a+W+Drp<EGZcq
z5OTD@f{-)nyfl9``!}vj^EbG?DwgJ-yo}Z(gV{`T7l2{euD+Y*uL$jIP~(J@r@P2M
zTb{*>{8ARx?px$%v1La;venlXA+f{i`-}WFQP}BaDZ9hXCSBD1)M9`2Ic*VlFPc}>
zWk*_K?@~HgD3m7)coa%|4LIh05-kbJlh&@TSxj}btJq?iBsbA7_T|H%|GL=U!dvq{
zFZOeJEJ^n_vW8le?&q9|ptzjT%R37xoHe(wqDyynzO99X-5Hjk9!aNpo?WQ=d7gPT
zBTW6N##ORzbLb&2JK-(V*~hGiYfq@lv$>Bp9cgeKZG=qCsPiLa__*2~@w18<`{?Sg
zG*R@r<=Hd(&Sq1W=a8bVw*;m-Yv&ZJmm*~CoO1P}h`&;vFJ<{lPdkS(D|S^DtHe3C
zs(Mb3Wn`1G)o@OaIyJ-3s>TXZ6fdXLsA@pPTjx)_QBT8`x(HIhIhO)gxH31{OA9`s
z{KZY``3!&QqT(hv!Iz8`b5uUVUw(6+={G&O^2j-_4_gr0#xNl*DdkafD+-=-3&nb?
zHCPjMzkA*Q-}ruAuObInOqTwcrhk5#I(Lb`Da7;UC4O$`{Brf+5`V2czp}(%7dpR6
z{a}f|CF}euDd#RPTMjYEkNiMOTT0t#Ra=+R+>WZ6rG92?M&=}X8ghP|tPRY6Vf=im
z&CJZ5ZQ;34+n7>hbk2v`#tOSMRHU%2v_d;|f|BAkY@2)!GG9;DjL5xG_H@kUY1<kd
zWRF)m7OaSv*gD7Cx>QD{e_9FMcq$!Js%!$PGx8Abcw>^idb>Bs<bj*Xf>E4sB3wzM
zYRU97*F5YdJ@l#1c@Jaj=j(Gm%$GC$4Y86&zRf;7U%HZ3S$*dxmb;{1I!Hd*AsQF-
z(g8t#6>pbLVb_ToS)!W}mzndfxLJ7dgWGnxl{|!#$6d7EspUFL>au0N9}|lHtfXGg
z7fO(rjEJ}AO4YKHPL4V*l^4Vxrs`AD7+OOWEteVM_T2du;_b{h?OhiR?&OS7U1Z(a
zY>#!7GQdsRE1D;!YDbhhG~;xfnv^qF2|IM*FvGG&KX32FTW9iwrF(KOgwx6R=_P1q
ziBN5YYMJbyO4HS@EI)ctU`P@^tU~ls$2R)E_twdYw-twkj%X9Iv@{a5YAgGTs?^W2
z{F6BKpS0ZHaM{H<GES_NZ?ROe2*X6cEMn+dznCO>W9#vu#hbnQdc6q%sa%|vDJGLy
zk{Pk;{9oLpZeQ-_X1D+S#Kfjt)~a4w?yt`ov~xsxO)Kv&glvCgylhInx!m6py2Mj!
zqV!UimaDU)^k*aL`lx>zk4K|^cJ7SGnEl6cvPCQZW!ch9gCBg#>(!5<m<yioL>Z0o
z%vyoD;Ca>xKR0%HITz1xpN`jPuGP_8F7GxAVidBxekzpwE>`jzjPykpE-#KG-6_Xg
z0-(>jXuy}w=P3Z87=9yWVMOvpo-RiNbYp3B)h|}~84*^kYi*t(S5&C?R#0S~Su6eZ
z*PsVQv=Y9hpg#f_6i-4z(tB37B|UiQ=e%tdw(jkyf@(915D7z{o!L^C95=31FMTOx
zX=rD*>RpMPcUGw%t@NW?c2-4b?z$Q5to0UTOtsY5DGqSnYV90WkyU<_`NNh~7}Q~P
zF^?N3W#Cfhttyp4pJXOcvv(e~ZCbwusX0MSg{C_t@eVqros&VQY2~)7Uj5rDMk+l2
zxC&Fxb5S;_cc_!H853XasjIX7ljYfJpD$-qw5#*fFSGrXE3VFyF%)Y_2^Iq(Le5x?
zxOwKUMzv<u4XgdEP)&ildo}$F&+gT9$~?ch+FyBjO^MB_9p2f2xp?aVnt0Rx61<lq
z61~M`P8!l)NV%S`*sUQ&z7}sD2hHQvHU7yln#ZYRwtziRtW2>@M7Op6fN}kh)Z;Z?
zPM(pNO;5b_im7<dXG6U85L>*-MnY(gJb4lE{s*(P?cCNP8lY}o>n~vza`#$)JCDJ&
z{+Zj`a<izN4X*y@wA}UbL6XpmJ&7mSZqqH2!LJ^d6`qi{+h)|MIsRIPOIMo5z8pWB
z-3jeE{<S=Q$0M}QQ`^`1Yh(KuK*;UvGGgW9P*bv=>oNe~XJogpnIUNEoe38P6%?i3
zIe%f0SJZd{wZ-jlPw?pAR<Xngy8Tfp`#LcQ>R0Rhl_xh;a6a&aNHsktFwt>zlWu5H
zo7VesSn#9k8Lh@u%X)uP?DjO7EpQ$FiTy39+^)MYc13g9vzOb<+(xfX-d<jA4X=c$
zw$s>B-R`hGw|B@?-24b|2kgy2GU-mb_1b15ZmC_N7R1aF3m*;*7XO_)ie)^)^#LU^
zXArA(NBP{*&O0iC4Pcr<W0_^o^o>n}mU&PCLe-yPXaAwsDAb@6mc%tx^=|N&U*6ax
zX=yvy*dmrlC)?OQmuzE)Bx`)Tc`I;_HLi`_EJS~rMe4Z%-`l6cxqi--eT*AKIr3yw
zRZ<^_=iXy7z0r*BjeE40q+9b$2Y&Cg4AC^DnHLX@Br(Tyf4ll*uD>QmkEQ2{dbrkN
z51&XVinAZ$KAQ19?Qh%hoc}*q|DXl!@2irrg)Z{`v6GnP*kz&pWSq&7X>TGfset_q
zxEW-|Wc;}QsB~XRGFaI^=E-Ia?L0b{`~4Ha1*y({%p+yuq`YK=sZc7tb84Dxa<b=Y
ze_W7Q0gYz$bxveUCK3naHf4F13Kyoa+~ag0jpHUQb~m~P9rM8R?_xNl=ev+(P_75)
z2g-6J_ma&6rHqRcM$ZSzOa_Hio930Ar?++)6a+Lp8o21Rd>iBd&XG0WCWdDd^CQv&
zEm~hRsSVO`Lz1fEhcFJ7s~a}?t6~T96UqZfPIFRkAFzc0o0$a}I@pvag|M;fY&Q`}
zYUhZDo})+rxocd))>6ure;m7;>eIMRms0ku9BguejLS_9G4UXp?o1DM>hp<#I|!!>
ze6Wl1&lMkZ0=4bf!iDcTN$F>9h#K+Zk!n4XH?)W;C+)TgbGlcYV?~TulF~QHJxHQq
zZ72<9LpxC#w95XF)q`R6+-5pYp5NQ-pA>p9M@?^LT=Za`7o1IeFkj0X1`@tVq{E_M
zplI{nsazPT^-uRZr2A}HqpTB`4vNTi%{+_IFfZWbb%z$l3zd@F&?#>wG|3kmFkQMG
zc1Z8n!H3I?TAO^6jTaka5WUAco!4dT`!WHn0TObTG>1K2YW2K16+fNxYHcs(SbZ&Q
z8)Ye+^r&U;=RB3Q#ZN!;Yk`%PF)FX{?ZD`3RdQ4x29y!EB%#+ZbP>N+qpsV+GSZ=Z
z72D$Ht$wL~6$Sv^GQF1xYNoO;9Z|zu{3|$9uym_`Qfz8faB&!{O)qz-NsJPoK*>+K
zQ?@M?1z9+JJa2BR81CT9BTfl1C0p};AG|k2+ODp=mpd4ONtKjWea>r1noP28O^+cr
z6Toa^G6C$CCdrXuffQK@m43O>n+c7}+YtQ%<Lj9<^W4Y*Sid+Ft;22VK{V*=j6l&<
zZ$lM@F;VMft5iB^*q?-IR+pW`dN$8bpM-w${L)GOR(bvue|J!M`Tm)w9jTn#93hSI
z>w`|{E{ZE6`1&B5t^<zpgzL|W)UEk&<@ua_{>VPvlUYFiS%W(DWCnYG%T<@3?61n7
zWdtCL2)sPI&Fu4<ZEG@SW1h2&<=pU)>O9#mim@_g-yO+%CU3a;f_7(;e$|ZtC1eVn
z00(otf->DL^Zq?$NViWi?WRn4$$WrUUk<Ia?1qn-EX;)TE>H7<(e)V{aKMF8Qdsjg
z?aNJxjiTfUFNEws?|sL-WA1VLWpF1yr13sAk>lRvwYp;q+?(cn^F`;b_l6cQ5WJp<
z$nyQPG&|K3(Yj7UIJDoRIEInyOvw&X4lfkPk{a_q=M@k6y1ohO7EPzHquSV3*F8>(
z(sLhnN97h5&CRVJN|8G`_#qw_m1kxAT0Y)BV@{k1mo~Nqa70W0B#`hyhjQvdkL7u6
zKML~{q923^h1IT8{gP0qSUq{F|H)8Nj#^ycZ>}3Rb0K(oUb$FBelQGC=m^8<(z3a&
ztJd#Y@soouL<u!=c1B0hk-Rpk8U}GPhR)$aCUcHQ*iEYE3jDPfj!A%PIAS@juRbwp
zC28Lqjqi<`9Z`($ZsWUqK9L2b%010r89QRqim<=jt7{<V(iOW4+Iz@VjuGSnZZB@n
zK`%sN7;V{cWMoQ4YY^#(%WQ(ZZi&8?#@CF{+)#~~sS1Ztv&GgpGx^Y->`p7(w2fB;
zrrt)?i>LW3sz%cmLUZMNg4!g$KcUBV_Eq=?(O?#OG>MHidMNV#m=oG>nkjjyb#F9<
z5ofU37Js$&BXr`fQz?U9x$Xy*{h+{e#@u8!8@^rUutWYxl6C(#0eJB~7k~lq-*Y%O
zA;7sG3cx;iiR@N!g==EcG#BkZ*IYg*@th&<lwnhFZxSL$(`|SN=@ipThb()B`xEvI
ze^8+^PWM-Zc%E{)f4V$xKAl%0A5<xIy3cn^A`7|5^07SqGKB{C!Qpa!z(kx!^Jxlp
zM~ldVucVTv3At_d1YgN1zBf_d)S=T9mA92zk8$H|nsQS#yg$nK9Amm#p^KP9@0Y9d
z3Rxxz*Q*-}{oI20%Z&k<NIxtFgspV45ceTpiL9f)U!x8c`XAY}(3uP+U;TvlQCkdm
zVdQ8ixHQ#-br<F+{|w#-E-X@8&tQRPN?mb=ziwx{EDcK6&o(Maj}nBN=e7X}Ov!GM
zWmIcfQfR>Ga^f$&Auv5D#j;C}%8&-0(yhLG2J1grEo$Nn1kQ8Wnf`{Iy|xK!i!5*C
zjI^>im}|Ru7q?hy-6I3c?wjnAU_?SzvZmz}oEG!)$g2;X=?{fBrDi*9FprCVdg5;L
z`cnh<aO!dEezjqnzd1SfQ#J&NJe&pcsst0x#%k?mGRphcY;mVWNSV(pi(8+*VL4UY
zkx3oCP}~`#umNiKl(^Hh{}QZ6o>z_9$f<wv&n(vNdO5%ri4|yo<@I>|CT`Bi&jngG
zq66tL%UGxh!elidJ1;HM=0l)lT%u<+i#wXlCEfEdCwJa$vc8-mk=byJD=md)uwh|o
zx+umS(IPSKT+MfRnT{Xf+GZVHLmS<YOmyu|i_C|KkZGM8`O;g&i$!z1ydohBW`3lD
zM%%=lm+uvpcx5%3I_F~oYgkkwq!q(DEBRiL7OaI@7{+aQ8h12jK1xlS>%?HNvQi{V
zB}b!Pw1|)ANf6_SPl2w+l{Gp{8t<qymD-cqw#8qmVNR}>Um;X(>=%Zu+~hCo{oQVl
zJMUc}gXT`{v6k|~#?;PQ+Cxx@YlnmZXFFh)ql+p~i^f1N%&jPz+G8_fsTvAZSIau`
zSm;$&O2~EnCZxF6m(q!&Z(d<ci*r3Aois1AKxiA#3{fnyWou@G);v!qzqLzpRyU;c
ze^Q?=r>=#3L?A*G7WwTu`)S$@YpNAh*ZIw#o+q7*m{jBv|97!d(0K}&=H(Z76)ho_
z!H<R{@|pQ^>_ZNH7+5W8UtI1rb%wm2(2()0k+@@gm&NO6^;}0YiBOw4j8M9CUW?*V
zWK^m^m-y^LY0}wR6VJ}76BZ~yZl0G{!Cnzz!kfm2FZEZRMgGH7v#lk0gNSrR@8z3`
zdD<qN;HmY47lGqMmaoRlh1P^~C&VXQ%+N*>DQ?nGTa)4zkyNHO0>wwHK#I$CuyKLX
zbh5qtI`KJgMk1zZ5uaZ!HI}DqPrrM!<vRZ;bGbkjws{gLCr=`mG)hWniK(vbMLH9j
z*AAqaK-ytyGAyxn^q)|Z`YnqV1DaGUAE7VTdN${uo9EOK?E)l?02_qG1*TX=dIer#
zk!PB4siQNBe<7{dw!nE$M6HE)VTFhxO;_55U6LEqbS@fE)#dut#3SW?;m2nsRFTfi
z#cAT6)4q$*Z4IlN>7hrpvXs^85|g&Bg-aTAkW4RMtF_)=!yX>V{Z&ThT8~+U&%4~u
zk&CYqwBu@o>{v~gHE)EUY59H#UQ-~+r0Kf6hN4irl(IsSsiHa{X@OlEJt1?~P6;WR
z$Gl<6^=90bjk*XQYZLD<-At`8kZllx=^zAN7gbZ2`<GpHeYxk9dlfa}cfFQmxmK?0
zb&2!ywSTAPr0e_oV`88=|I*m4TaaFUmsVnIOU+UB;uZdiMJ)@xwuL=9hVk0U8tl)n
z@K>E17hY9WURAF&O*X}Mdp!%hz6D*$lGKgOA|H;cm=5Ts0SO(^wZ`$oQ?KL|$E+&5
z($7Bo79=^D#8JO-j~g&X7D#OILuvlbyISX88^1bcnpg5JpXWEOq^d?_w8)UVHA#-2
zC3%NAgC?xxP#UcMdz#jzu;#ZXTk{S&-8}^wMuf$lqq-~+F$pcQBGO|`z8p29E=vg%
zbL3Tk)(F!IZ;J@6w$5v4@EV)E<`ykwy^JqvlV2#D^<q0K>aZQv^nF^YHCz)q#O;t0
z<PKeC>cuGV9c@w^(=hHpsI*RP@y>0W6auS95p28m`lQx0?0l|Ht0_kU<Y`6t%!Ih}
z3nYQhOsXYUv8GOZZG=plZ5b43Mj7|f%*t7cmeAr(^P04Kzg8#78d573s;t8jO{<Hn
zoKpQ-f(M8t{$84HY6p-zW>R!bjJPgM%xNu?B*WTJwU%o)5dwugn12F`gY^=?SjdAq
zRjfPxOG&vkRQH$a@Z>-@llzfX!2JHhA7+04gm)PkEU1t|JkT{C^nq^e)`fV07L(=`
zSF<ZXf<4qM4Jc~*pN9dINQ<SN4L&>lWtYiSK$4~e7B|jeU8Rq<3&9Mn9-Y>NOpn`X
z3D-e53Z3UQFuWL~*VCTe>eoAYqtmV4-{~*Elq@-1*xQmMw8uttf38*dF)K9j@0^iP
zIm50uo7AEk!joi?EabAdG^^P@Ij(l^@>eWYB~lPG{(Y)S-M`D<#46BNck#C9h(yUN
z^17_Tt1$^`G(iq2Q3H9bw@89dV;q6#qpk<+e2p&A(-fA0lva<Y$-3uty1iQ0pD_&R
zwxt0%&*>U9)&HC>V{R-@2>(d_;GD^h6Aex6WsCcBl~PK&BHTSx8`e2jyUAzZett@#
z8@|uaYPYDB1p7inU{nk53tIcqFw=$JuzT3^M!aL{`;~rr><c8q$S}|ANFoV|Rwb2$
zG3d6U{ih;nh$S7mSpU=@)W!}MsZDC1FEyGRNOxK=?RtIKC*gB~zm`E?o#dN_VTSR2
zgYwF(>S{mx+Akx78n55&cfI3Dh?M9rP%u8&rETh0@zSC<<Dah%b1N%m$_V;J;s!<j
z8d(ivAiNT-s{^y@2Uq)>W5}gD<V`H-P4@be+ZK8q3kMcT8ZRA@viI<{S&g)fV4gGV
z^@yoA#`;jcuxwk<r%m@E5*ue!ykJbjm#O4juO+EF$?Hv;(#3wcU&2p@j)ypp-IBzS
z?XjJj@bzkuQ$(AHZ;~S8zJ={!uQPm1x1l3Z&lyajo9XksL9auz|8`s#O)G<S>*oHQ
zYV~g)<rOv0_(%Oy&iIaIJ?6FOSi|HPmC&*NO;b!C@bBn@<24zn{d-jHy2jrT;;F9j
zPcQv`v5dB>wNi^aV%>6}Rk+Ph*j~%j?6r!$hB&Z}Vu4-G8!oQ$&xv+uRV%CTdLlDR
zyq2ZyONH7|rfRDE6|pX=l6~igL!2)gk%sC%4G-M_G8-B2>dA%sbh-HH(W3iwg}9qq
zMcFvHCo|IeBXfZ4&ErweIp%UEPa76j4(a84`3XKxj5DYt#;8<?`(%Mm7$aS+Atu%H
zilw=`Pxb|z=xW2ADS;nx4ZC^or{GfIRk1MGPjyPbrw{-ZXISUafU0VbUJv3$90AjV
z_d#8DRiP_bDwTs-BFoxZug}#%T{(wEf~MedzABg(zjj=G`&xg~wa0b-BVHv(DeZ*f
zwOR4Y&Y^>ylJuM(w2OxxMCy4_j%`wN{>8--Y^+}7Xu8jzjHu#|`CHB%(J|@&qF!aS
zcZ_+AH<Z+?RqQ7-mTR-orlYjG60av|MpL<dz2{?o=GJ3*Ix{t1(**6By$F)hFPdyr
zGFfE?XTK~~zx<eAAL3blo&OK={5sE)U!sR$ZzOFp-J42}r%P<()wTG@VsCcw<OyCq
zi@lx`{JT_jHQOw^)P2<$dm4A4T;?NOeqAl*rm0VZ{{uim+RFZ)BeG7&+B=sYwn`I@
zhh}td@*9++*sE`p*uQBJt5H&?-LtxR=w5xYN{qpHQp*C&#qa`ebis%oEdH*QmGPLE
zSbFfn5{YImZQ)qRw9djG`Xvj}yA*oGOh?Kk%pW^-zGVI&y-tCyr$6-sp3K(^WWHf~
zwm%<Zw-4hi=AUg`%qQ{1E1#7xMq5YRmRJG-y$YisBQA^O6FLKb(HUUtabj9=lrvBr
zx`Ucp;VPbvoukEdRTeihqKDV0JEnQXhuLDms82$_UZPo)(AliM!C#eOG2M$cgRhsV
zOKxCi&g<ps6F0D!_j-kT#6Dl-8G8!_68+PxI)v?XxHZLVPignPPJh4;{3Vy#twolW
z>$Rn{`Cf<LZ$fC_Xs$Pu((-q{w3L)%Dc(d%TpGFa`jDteo8RSoJ^se-)WDAwF>UZ(
zr*I5|^So}q%MeFY!)||Bwr(t$Io_Cm-1p-CwC~OMttP~@dVaTm#?omKoXsb0ENZrT
zakro6Ti_i@Q!nlI*MyI0wSJwO^lJQVSG^IHnjKDWUE;Mb>02Th5-+J4D;a?xMi9s+
zz2(Gkx&j#`AC1Iy0p2K8Kd$k!R=$BkdtOUMTZY%3(VOA*XB^3ZxBJYXa&Kf?6VGg(
zv1d_U8O^a;;FXD9y4|Rc=BlSsZg<?m%u=uXSdurBga`@txhlD<hC64DyIiMaEOL*o
z2{A@erLK%=G^fls(;BZ=$NT(INwD7?6lHR21u`labd5Rv0*Y#vW85zc>gdwXxnDRg
zu}q6-lupd;E%s#0Ag0}UuTAtwCaJoW&myoK#+cK(oy-=g=uQ6J*|SB)h8@<u^(;|p
zy*k|={%uTs<tG269fwVJg?refEhV9J^D8=T7)1zs9ehh(2RkNcCe*5VzVE2zH~VKt
z-Y0#}JH~&Kx%UfH&CR@`<k^0+e`-v>Q}RlswYedZEb&H@5IIQR^`tShm`-BYd(`u~
zQo41|w4h!0!UYn>CEqpr-Hb+1SSZs%cpuX-mgF5v>h-*Sk0Ia@208?CK5!&E(a8`Q
z9Zpi`)cT7<A2{mLTGoIJt=rDl^lJnCdO+gIGJd5uk=~u*^=5QudOeu~{IhIiSwJj>
zcvx%Q`&}Z3-pE+QI~Ez!1A;JRqC=AkVToRJyvMad17Qs%Vx}8z(M=_vg~)C#(zFTn
zPAzZ0C)7o^_!Tjf#^c;;m!>UBlfd0Fj2v(eYXw@QWv$mi-9=Rr_-OLch2GJH$7BR(
zy~a=Qs+Lea$zx)?-9;MpS+oS*PV;gq=%Wq$nD}TN&drtJnMIycCU#gSzKk+LtPo08
zv1q6+m77(e?V7HzUKmIq<{A?0i{TUC@;rfM!%5zV8DF}~n<NXFM_q3m<9#~)s_y9B
zD79fmY3(}g=%B`8XWi(8#EIx(T69W%@8kZ~D|OcN+{BG)ccFAJ?uty4e&Cj}X?KBK
z$m4a>>CzduM!fdO>{72avsaH@R+OuffACk!GDX;nXG|{frk0p-pIlfN_Kqw`@XG1r
z?f`~*JvyK3YOMg%SiP3c(Oq|3qJ)cdvZ(x|3?8Ofk6t>gHD?8Wne!;FCB))Tr5BTN
zmTow5fDL<~i?lK<ZaoHe#U1v_8-({t)1C{wiHzx}HyiC+o#2~|?{TrV?n<59k>wrQ
zX65FZ)s_V<T0I1odS$Zyf)BUA$6eW7+?m7}eqf<@c;SdvvyCLn(oOHeK?BheZ94R#
znY$4cfWy>+Ss6aLD<|c{Y~D<Eo6gXxPW4iqzchE)bLia%R`q0iec1!q5^@zujWP#b
zIkie)_OLo$=byWPkRz^|s`JmHmDKF<vm?|$IwotxI$T_}?_o#ftm@x`sbB4=?*U_4
z3x@czxP;kCo&rO=byQc8?TOv3;~MIUKS^t~UIlPZYS(hs>XJ_xM5~3>$%JX}CXEeo
zPbr_Lh?_uKuv^RPG|*92=SpWkw7zYF*Rf$T*PF`i);Sk{yGH4*&eIKnu5EqG2Csd?
zM6P!{x61^}S1;}LSDbZfp~<-9Vs)k1nCZ<!dEQ9g@D^`$OaCd};Zu&C5)kd0g}b^+
zxwkSHSzWEx-O9;^)iuI|fl=Sq!zX#;Cmqe#F#_LXTW7Xvk6IgSEWht$@i^T`O^f3+
zDu9BDNplO+Jg3oX?$FvVgg{QKyJaD&Tw9CPL}rPf)=T%YdRl$&R{z$}no?C*@88Y7
z+863MdDo|MZu84|+;*G)ksW7IzKB;x8|}rsOG4-53lE0wH60;N>2`&<VM@=t#&r$r
z?;Cr0b*$e>=rdc@uW$3u*w7&jBr}^6+&wz$XU=<c$auy*vtOP43AWPotG%D_&*AaK
zPx$K=p@}(WeC(dxpnm!Ze`AQ}yPx1y{CVY)vlh3_Wi&eIdSmXio`0Q385v6zF%+HD
z!Z02~?zl#0lxUerJCS71D77#<pViMv&0$-waL{Y8?zSVEuI=5L3eV|aNO8g71s)r0
z_W5O}idUWWxuEA_;V7q4YQ1`6F1JU7Rh}Ngx@!hiYJ*?8Xk4?@O>NDDs&4R4p+P;|
z;GZ11Ae*%d-h~ZoQI_)Am<B&PX1@0tj4b%lD_5z|t{ITe`;BO=)s1HdRmKXno`$$P
znq~H&XJC9ORowcOs=Jn2EcJS>JbI<%d2NH}NY|BvS9-%&9yea?x--e~X4TEN`%7YI
zRF2njWv?b)+-aqjk9F17@X}-AWBQ>hD0G3>mfDr-jYP+_n6E(U^|CRy)zp`sFu7MC
zDrREKTC*e*S5VoEHd)%@RZtx(UZyX+^03Sy)t_(oqZ^T2ggzLnHstn%ygobEzly@-
zSu=lCrP_LjpHq0%pdO?2$skX^IdgYq%4DmQY_w`k*wrVvjKyZtt?rsspSi<dv7xd<
z8qbsrzq&(abWlmq2#iK`#H$ahZ{C3hB2E^a^qfww)ErOp;z=Y+S>z=J@5gk<^RX7;
zXF8#pA;z6aUSH}=s@Jiof02Z}5#f7AFkN!<{J2aLXHrIdZz6S8w~d<-C|zTCDC~`g
zds4i<l+i`r(b%H#Mc&|w@fE_Pu2Do;Jtl7kk8AB=%FhbISn5=&H=Ww18=ZK`g1khi
zJu1r3liHigR)B$2Z!q<UPOElOYN0!|CzV|GYp+`z5${}3iG2$>ibcJS)Xr2LR{O!7
z4z|!c>K~IClDl`9_982K(vP_VbY4kElbFfsfo7-Ybz@N&F-|S;rWf>vy?#@)ffR2r
z<%k}E?u~0RMr+cqj2VB8Gv?)0MW3|On7bE^k@wA_G_`HIZf*^Wml<5#nv>uz5qEEB
zK+ERV0haE}1cE_zAN?N-9gIL*Jg?0|$;kX|O;Up_<Cc^LFfg_IbU`Ds>{;zBWRFD4
z^r)I@^h>uta-?PXLS{R~h4ODhiTpb->hgHDIV}IS_AlYlJ0PHU(35|U=zoXGaDOrU
z>g{*=pLf@_u=zr6ok`=*kxdvpa{0^QPw-(?_(^tk`q`@Ilm4m{>+QFl2&V<EUzu7%
zq}&UZHe`hE#br3bCAC$Jf70KSl~#ja{&qvnmH=$;XjjoDrpk*dfReJ!$)ZNw(FEL%
zyC?w<e+bWlbLQ!bg};Q)<d1X~%TBNQ9Xf9Z#LK3$cnEjC!&ZR6V+xOigwiEbRs4yV
zV3gj>Bi9zf#!2tNFQ2~vkK&dDEoRZwaq1Fq8*bql&?hzmO6EN>axAt|%BTUi?@+6o
z{1wYHrU1gt5|>Cy#|<&Iv>1@bpJlzY7I$F+?!xUQ;BMT)$QEzuAnsyYyufc7zrr1+
z-ZF6`hD=FgHbI`o|0HLb$ZIk|32a8P!uaRgKN#>C-ttfRr-Y(W)%+>{%uBN+<4ye8
z@Y#oPm+)s3%$~+w^!I#M3(o{;tnO5^pYqpat-;$FyU=91KmdC~##F(*{^_wcP?SHL
zR89|WkwJiu;O^(oCcRGBm+n|v6X>-Kw@$){JHR5l_IbR%6!+*n-XQXvmED?oILJ?K
znwq-TKk2k#P?$f<XQRXsF$Oqp>EcJUjWepOnG@r)s-f9m#VNG*W~RDZB=nKer4{6I
z`++P8I>%wl2=2lJOfC|&WUFw_nWt|p#Vvm}2V2{4Px2?>$iYeVJi3iU+MFE^xc7(D
z#!vgpR_04F%1h^)Sq_*8`IV~j(`<7)rkXzOzarOn6nw^CzHC@RTgA#VA^8+^^=CMt
z*`nG$<DYtVKfVnYXwmOzU9#iAQm|AVJWrD<`!LN`*=g-6P6Eg#93$B-l^;V=L#iz1
zpR{_4cufJ%g*y&No{RW{=NYxCBj%rbMlVRpYs+6G<rmhrMHF=lKGBjD4LsF?-kqHf
zslbwQaKrWNYE{^xOJ7Bh4d)c&TYI4vQmeD$0GmGN3Uy8o?#c_*ulM`QLR|DYK)ll=
zH$6u6?{~JhhAudebWkGM+_7m2+s0ome<WATC*1Dio$+~%;%C~ZP=fI1b>S9q+xX`V
z;V$P-1WNq##lOkKJ4pUQ3}f`q3jX|7khP_)&UTZ3%j<m6RViPZvz&i9ter1``LoP9
z+C6k1(-RJ7Pu%BcZQU-?FE_$SG|by89mf@>wnlew6~%sk`HFtL@)OEr^R(lbs@Ttl
zgA2HHXurQ|#Swy)CUCV}N*&d+pJR@tWomFg9ovP4YMkIG$c(^?s#Nv?fBi?wYKfj>
zE77J<CZ(=3YI8wr>H*1Hpo(Qvs^I{sUs9#o4=^(wRQ<q}mzEQxIl)L;8C*J|CJrEj
z%W9u$B^HNrvs?YOryV2oWa+$_v3b5i%F>X~rljhS?3MYdzSZ9vs}Kp6nN(Vx3ruy`
zxD^%9x)S0B{>SmJNbuLCVVg}6{=z@NHMsNnvx<LJJMO3zjN!G)xvEzJB^1+2jQc$b
z4*DyX?-cAwME=P5P7y<8snK!n-Do;U+Za~e2mLi4-&F{$C?R83WV`C|FE?qRldUdl
ziO-yR>>9*fkPy#ic$XA3XpT00zA=(>zrX61Hb~V8*|t$CC-MJK<zFq?uQOqH97qE2
zv+S;xtc{!IIoF&;h7|RqWvb_X|D+51KqV%KR&rYnRXTTnpM`6M^@p->ZIOyR;ICRX
z4JoLB65OQ19Xllt_&Z{|i-E<4olt_dv%5+B6Z%eD(%pyg|4=f!kK$Kt1Uc8ZZTOl3
zXeGAx#ZB5Z4UUsqp}PX*w)tBx8Nxf;hOzN(9mg+7$5!aAv-q`}yq-{@IrzhuQ^JjH
z=tZCEYNI>oSHo@oS<B+k0_K*{?P)6VAZ@Nk6+B3nGDV0FC3Q!ds+JIKs`)`UGI)Iu
z6VQkW!1u!8gb21;8bt#Vdok;Omy|hCzPVuX%7<;UAEHA(s!AVXH#;8}ZW1`AdLHsO
zteYTAx9KalA57iRns&hf{V9zc{E7UjW;IDL3L1VG6V#lq@*gJhgsOa)1N<$Ss`+84
z9jXW471I1#j9HV|K?NU3QxgyS%P;A{YvhF1>9p42SC-H)tk$*;;NNWIKc}^}oCot&
zNxQ#%i)d}tiB)+&UQYFiN!(wpS_n>gd1QqiC{+W%%ZD)Fk^eq{wlTOA{k@_-7{<Ro
zp?t+)WW=|YGC%8YV^C1}S%kue6PrKlZ@u*KLZ}rdX6Er${A^Q`$U!T8T<SR<=(V+y
zITC;mxgS>X&-&}n>6GM}gN}B`L05OR_*uDh4&p9Jkfp8v&KXtyh`)Jt2joW6LzErx
z0Q^K{NaATvbv)vqezF9yV~>jt$hif6Y4Q)}2Bq-wm&2c6Ze)7I-*EOM$eNdf^!^{V
zeBDFP6K7pHV4`<Vs`5wCoNm?dD18lIf9;Ux^EGNfy!+MBN0I2L%IrYvzSO9SI*{xO
zm8zzLs%%$H;@w}Xx;y-}S4&$>)O)K#UoE1F8I#MvczbL51qUL8v(56w2HahSc0#so
z+^>aI<S}~QQI-D~ec(WaDtnAJI-=?xBOjc1>v)XZzCv!rdsK}He6>i$AM@AWG)Tfu
z&yJ-%F-iI0jvcKR>^M+5pZMUh|9AQ~nxGGuHd%Uq^1+3z;R7jn=`k|0`(~bMeB3`X
z^qmsb|G0l8mqN`x?w?NP3ZC#cEE|`AcGM~wLxg{isJbWo^S8bx&}vZPXy&zM{6$+t
zV;z0T_1F{sS*v?MR<Lu8P|60&*Tz+Dr++Tys-_d8!ZqTZom9zB3e;dH5;?4nb^2Gx
zk-oeq5!kU@Rq-Se;tR_Sg8343*ONr!!&9SAa*H0HC=Ne`{~z;J!BepLQ<18a=Txa`
zddj~v^p{fcU!{Kal)o?(uTaOIqWI4gD~_pTt$ar6vLvCoN=YciGXttZ`J0wJE2R_7
z%{KnewyHMeuer2$!1@~vXCVUY@fYAD7TfmqUKtpDnp;2!{99C9p_M}_+(ouh`P5?<
zh9<RERdx9rR&)}pJRw#AnB4KEt+NXeEU8c<JY$)X!_kD+Yjc}<6fN#I%5dR9-VGhd
z5C%c3cYB9$mnHBwxndCo|I!41%P*@1|GvQBhj$$CceJ8hsdJUTJWsVg&C88;b>wM(
z)51$@2tQq_p6~FZG54}cP-1hosa+;2o9J&-yQ~}kHd87yIXLL*0ZJ5qq);w(Rch#S
zDrW1iyv}hJM}zhozWBkU>^AR#1=1i)bFkLS{a6bppGH*AGyZ1w$ZNjWQ&&s+FIZYa
z3%p!C`YAvAiH#{4D)KCnJ~$y^7$r$vJMqxd9TsbY2kx<0?j{$y=!t~a7rBCmEEWk1
zeavFrM!^#n>vNCs&@<&0BV)qv3_VkAJ&dA-v;s>4y5o(9UOr~&i*<z1%M%vs)40%&
zTO2X;S6*G(?MK|0P6scU4;9C;eM06Zco#UXk->YxBMJCZV5uwlN%#lBy&4(Z#rZQ`
z*OuPOQ<vXyK6oAX=i^Q+MGM~s=;x__o(b^Ehw%4h!4SU)17%5YJXqhe__wmYhku>L
ze~deRHn`s6{{puq;5XPt?N85pEIfs!y&7<?jqtWC^?`XmqZ53e<vpS28|<daavzwN
z4nlXAa3N;}*v5BPfg8b5OJ5I`@I@AH;j)HB!wDV*;8}2v4R99gd{TlS!nR=D&(f~~
z4?zzyR12O;2!9*Pd%55$8=fjN%Y7Ed4&c#~z@QU63a+#Ps3Wu1XYos55n;gaJKza$
ziKYK2?quX7;NO62!0nd)23Rs^t0*R?56yC)2@qmHY*zd%Mr3Bi&*C$|T`=%0z6>l%
zm~HVj;6ZS)#W#SZiVH2iC0OaxIOc>J<&Yc!CQX2aPqUI223wJaT4iOAy0!GsWAV^u
zNWhf}r~QSV<*-?l{Mb4V^~FQYMfkT^`k}aERswAX{uz82{#s(J(uPLxkQ~}N4jqj<
zW(m+n7>_6IZG`T@5IY|FJ-8_W$H5H=_&snlxW|V70Dhg|dc!X%!m=UI83S`F*Gbw!
zgjzgo0!inA>k{xs<Dr8QaE&QZ(#K`p5eW=hhPTH<_eusMmVR%XV`ku}r9TYr0oy7{
z>INSH_lH=emN<Q!CzAwAZG?Z0hrT6M5@cvh&YOYLEd6(2svuCRq<7>D8hF&uJ#=b=
zWO&x%&9X2#pJDH!c<8HL(8DhB$AEfQ;nAZ#3`S`-4hyyn?f^@xuyyRk!0`n7W3q%v
z)p$015B&0=bJSGxKMdXi770pvLvd&GEO;blBm76)$&&=jEXHz~)lZB6N|n@GhUmb8
z1<*&pR;w3efrVk73BMpe?wA!&i!T6+gsg-YTp17jqZBAsXmYgRS^~7;F=->*5f6P1
zxIpTM951*pSR%Fb$5{al6QJB;6%Ty_k%uI_WbmJ4g%o<LrN06`2JW(WIPM<uNMF|}
zehYpYcVC`FVmSc8|49HC$_q%1r{eCw5Like^!MWK*I^LEPfh_x!6=o`le56015$;8
zH-d-3xfY)ZJ}z%bf&dr9L&ZY`@N57K%gGI3YYCI-4Nn#Zw#3Q1<IX9P!3M%p=ww>O
zsVzA3EpCWA1^t8%=${PMcP;%h;C9jv+I{jPct`?LVqr)#`3PF-+B!}Ca@;w6C?Nq%
zap4r<n{0SQd`2yWEwT7}ap$aF=#v&7jfW0M71(B){0DGMlpu}Nuw=;?3bQP1A}pkL
zI{_~TcN0F-(l>wyz|9utu`ZksF0lA?Stm}QUkH{A)LJ^GI%Zamtw$aAqV^ELihSWc
z;A!xHrGJ+1KS_ytEPjfW;ZktD#l5mp3?8=lRZcdFVam1m-@r&TXeA4O5sxM91qX&^
zA%?{)9oq;qG`pI4dU#2&lx*nX9O%Ufbh>Y|lx*qegX7R`XB6HUtR7qXjTn+`lB03!
zu`kYXN^qye%_NYSkibE?Y!hsiF#I_5>;(Gfz|jQ!CBj#tGijFJVdw?WrOIih;n*-9
zIe3Uth{sPknOOr45@3k6L$o;GGWf0BdkL<x_#KX63d44TQ<AZCQUzR8BX%QYsT|V;
zms)ymT)%}03|%bc3_QvRFl7T&#6!cEg2i-_p_CiJmn7h`;?9MIV5>waG_wmuf<rbw
zgV2krNI%Wu$IZo-x{4)3&&5N}Nd~#+f(*u-6gnTXIBp|+6WmIGI*WfTcUXe!Eq*`l
zTtWg)jlq5@35bNGvmyb1IrKrWtwNv9$E=#$@H@aG(7OfG{{5Td&SkZ@#Sp>6|Abst
ziPI+NKO`4T5@FKPzZ!SU0=mWDmW6ZZR)_p!+$SkIQfBGD2Umct=}k=n9|u=Jm;OI>
zU9d`SBBX8w*AO7z;v#e;0=C_8>UQYu;HagSe+XaqA-v~9_^x@Z`~Orr7qjAS8McGR
zNWhjLl_8l~akumrf)#g*2fz)4w{{~HOSp3w++gV=amTE}Tl_OH5=P09zer#j52>>P
z6Cf=GEFuc<YWa-!Ji|1)*UC0<wGCeko&@Juj6}@(y2UkMNzhhN+MTkFj*`~c{y(ib
z9(py609M3lZSl}6Qi1?K3LZ+pPtkt^xqVbCUD_9*9|dQEX*FptqvayOu%-Vi^ihk2
zPG9hx=u}MFJzAUg8v;m)C4vNalK=sRz9_^=;y&mlrbLTYf`x7+v}jA*F-!cGPBXo>
z2;m;FxJnKZ6W;2~qFPzwCw(tqz)Zy~_S*=bWX>ujvdwA{I${?6E&UOCuTJP^kzttz
zBas6o;GGut$QK8|wn`R#4J`a@l`Z;iJhZ=F`u`<1!Vg*bFCair!ea!e0gIuK1h9NH
zC|PQS&A{97(0wD&ml^uvB=7{-@>?7MmnY!W@lcCYNf3T3_&Dj$ML=Y?4uP{x0*fyK
zkArOq7FU92!R?lQ6Abdfi){w58})67JP03)hd$K`J;Tx&hTldNx}J^Ckgb^$k5sk|
z@P)YZiGH-w+UmtG#~rNee1?v2aV2#YShmGKhe2jS0!Zlg9&ou$fbqobQ(&8+^u?Sm
zmiWzvo}L{K#qOKN!<HZ&CAvdO;Mf2~h!BzU-3?s@=@-VGJD~@*K7AJw5QzlwX=aUO
z;2?p!p-X&Qh3OAMmsS;IXg~9R^Jc^*sCe^HK!9S4zbJ1)$dK&|(qD`_ccVnEEn)h1
z;!aZz;RkH^G4L4lh{eB*JNHaL@3uHDFGrwT%bNZ!b<|Qz0Gq=|a@@JM58P@ZM6%7*
zmw_FKY$ALy^eiKh$VcK%b3Rpe*oNQ6R4fnrB1>lw`<V$6EVT50h&wG*nQJ8!i7{8Z
zuY(A)Ho(IuO&n|oi7ePV``f`Smi|0+5}eC0osoWTY<s)NtKc5!BR2eS+`g}|_&>n|
z&}{}{5oS6Eg<+5*Oz}aHfE{3DAQAJ1#xTf;fUBW5T8tsOACb>tO!EV!^ZYUxe?2fX
zUnLorQGjgdMnW+s;~KeW5sxCvklE~gHDIe$8K0566~XnEen0dfuvkj$LdFyFG6!dx
zrGFm!Vd%C>GcY{uEmV<}a0Zjx`=koBQq%r3Uc;j>fg%0(qs>GZv<!bwoeu>O2tN%L
z5!yOl;_|s}iEj<ll63ieH@L*aU&65banbs?#b?v(;$X20F-ow6X7z;RxXlKrMCo$D
zw)0u?aYi^&CDs%#q4zTHm2CJ=6Fw&)d^_QL6T&l0H}9Ej_%GA995M8mbUsVyuRCWD
zVV4as1cROg20sFKCE))AcPHRKk%4TB>AaTwl~y3Vo2|m73&0`)YYCTT#GS4VaHH-2
zm*&drER>|(WMJt>P!h>uzyKwBMj|v>`sKm9EsL+0cU#bpT6`NLrV_A~;8G?s&rX8J
zE&U&PnKcB?wf+CnuglvlJZzmWMJEmdH3O<>DQiN{QQ~09W$AC^EIK-3m2T-9ap(CO
z=;bDX%!P61^ZiIP$6`94PeBjtMkbc_i=%{(_1OR@#i!`6gLa>ZPJF2m1`~$9p@b4u
zK({5z+zBoN+wnpsruPLh6ttquW^g<BnB`A*eXsDhy<_Gxai_l){R>8=nJ*BaoB+0t
z7SZ$c&w`6BgI5_3jDf8ZX8uduF)!;ZeN^reg>H2y^A}v{83qqq`uku?99Y(6NNAu!
z`hQ!e%d+qof&XC>VOcI2k_=c=yQ~0w9BfOlteBfAo57PdJa*)j8gRYEw}U0Y05gn#
z6$u2L+p_MsGgu`3e~*oT=`?ToEdFuaF>m!O{sjY)7Q&|(!?W!7@>Y+Pkf^1<LlsUy
zx28LbasGEo=KF@MWfY(Wx-CG~y14V**fasG)@F$glo23m639XahLMPyX%fhyyS?`?
zblWPjcGC<y!L~}Wn7;qpIJnS;Z<M!)kgeg#dKjgql?CICEF=(n4IJ41rC7e#dcd~M
zv%W0v49P&hWr&1+(1ubDSd0$*Sd?nU;-AKypA>*?@0s;0Fd63Hu*luXqObXxgr72a
zd2&1!dW8}OTD?3S(^?6(B3!;I?i|YnTid;y&gJJh@G7$m=x$p?2bLO%Eoa>Si#jrB
zm2Nq9;SYt-Z3dU`;k<M{W5}?L|H&AZOLA<R)$#{m*bTOIw7io#F9BPTFQ@xGI0g<f
zcnCTSgYYY<q8Do{9m~4>JMilO+aca^TFD;?AFKx~k6}t%q6DzbZuuYL&Yuv`T!43>
zOPyJIl<s({loC3o1ksgrCQ|1z@xV|;8KCGjC7Z!01C+lIKHwL<0Q%rOzgYB2Il)YC
zX+;#hj<sJhz^7P96o$7@Vo@@g=|}>y*bEFL5dAbtE6vPGEczhy2-r5;=#%n&JFqA<
z5{Z5(?k>+`-cqXz5ObmftXT9Bz-n>yo19K<0hibk4uOa0uImg=`VYdlCxrh#SVU~6
zTG5}Ap(e2H|D(TUVsab_*j5#tj=QO3z$iKGe?<x<&bACG@rq>xs3k&yNpQvHc<6;0
z=sBhYE6$6Dnr6Ya#49e3hkAi?bh_)WNCtxN&GO<HJJDeI(G2BnU}yw>F+{cESv&}!
zOTg>G74*;gb)uAr*NH1$jk`;zqM-9x@h_aJ3=@9TG8_dTg>IYa3MQ9&5Njo{VglSv
z_yDt%Yu+f^_5YQrtnpk%0K4Y1at$Kv0^6z5%B^%Zm0;USR-Qqt5v>pKc1BQXU^`D(
zc?I8pssf7=Qs*nLrImOIbR@Jt6PzXMFDTW@J7FMo8Zc;qL0tj^M0Rg0SQ3=*-DIE;
z9Avl`hDc~G{!3I5A`V)`%5PJ^@`Ui{%%=vxY5M&O4F5L?wBcb5$;$sjhD0Z<7O(sZ
z8In2;N<_1~Pef|zs}_P=z^NvKt1@Xd4dC?_i$p~NR-&s;LFc02m=)nFZ2vt|cr3RO
zE&)@ga|s~Adj`QPEPW5SCn5YjU@1V5p$FrkyQ#8Jrwvatyr&VmwIi#(NUO+^{$I2d
zk*?}zMWc@ZxnSyS6_)LuTClB>RamlKA_UEJ)oTnQi@;4b{Lcwr4Hl&pet)3V<bf*;
zJ)7b0s}VBffN5pfONd`6{l7?n1hdz}K<dbv+HA&v_mqIG>CD~{5B*^bY$cYx6A|Vo
z;2SA`R8fKDw+~#FfLY@CR!%~AmUzBZNcwXOvGw07NWjlg;#{z;^X#vXAt{j+arQTP
zBLd{0suat~{$AXDB?l}L75p<wI0O#jPe2FG(f<n^D?y3*Pe+(x4Jb|kyEwc$3<JT|
zvaMcDiHZ|2wtm0RrNoGQHPiL|LkSoidaeL$CA|7$6fo0bs$ew|ihV1R;Bg-eIuaN>
z8V_|hfQLwcDq8&v8zaEF4h5q`_egvzk=0)(0g;fcqSgNr59RkD0FeL^S&d;@+XAZq
z|Bi!D@6_-<An^EW+<mpgaY`&+lST<<oH+@sS&M{b!9u45YZw#u_kk-+2G?9nUl0Y0
z1j*o<>!C~h9E-6t{gS~T{6jH3x)LJvfSVE`yn+@dCh!C3i3zZ5_d;U)zk(CuuT7^f
zNQl3dDtjRz{@PeE0cPeCT#HtJB_W4vY3E-_NMJ1){&FJ2r=TY?q#1uXksnp?<wSlo
z(=R9Ri>>_&9!>KZ$XO5%^(7>b!y?g_6B5XwS@tC)kW&UuNFZl7I3a<YyTFP3G38&H
z=a2pQJOL6D7$iVq0zU*NCP07wrNji@11BV~E+ZcLr}+e&b$QSe_^&%3`W%1S|GG*%
z5)xQ<D>xy6b+n3qN=!h-Ltjix;6><(2@FG@O91}A04MT)9USnFp{48TJieHa!1~n~
zo`eL}7eY@+VEv`g6B1Zo11_QptyZu9B;B=iHr9@;|19*j`6^!j1>E|_K}gvMwEl$;
zKKMX7AATAi2FDZdw?9PxcSED0oACdC<Nt6je(Zn7;D66C_@Bl9O%R{kul`38_*1~Z
z#{d7qZ^a$66>*8!duRP$*{W3okC=n~#ACxECJv$l?mBI`HZc1=G?;*~bb5O2VfN6O
z4d-C#q;m>zS={}~5ZGC*t@8%#$f2$TdNuJo1Y7>tl|$c>^n(QN2{!hb9Bz0t?)Fb7
zFzkxEOb7Yd1fGXMr7*M^`dZw*v<5tF<NrJK?gaYJIU`y@H&ABd|5~=Jl74E7jqsPa
zYjyw{oVy_IepPxan_zA_xIl13ODvZS26~ts(AUQ8ZcrP4YuvrPgl;0wB$#^|6A_W9
zl|VZ4fV58O|I2NJa}iN9IMawIm+3b(<GA@YK^C3Nrdu1nlI^O}9T!@B10|jS+XQkO
z;-P;n0xv*9{GWRu&TZ@9a?9@#!pFXkN602f_xjZ#@Xbb~xi83mSn#M#fO&w~Uup3O
z3<{wyw&5E|@H{e{W)u7+B9|%(B=lQ3%L@$K`0=<K`|?CWfOjzz!qC>~MpiJq7RDBF
zljDu4Tw8RM0v%tXm24w3r5Ci_Fe2Va73?2nBSYBIw~)ay_=QaYH)6<MP6H2_3@>_w
z`TyP7c$|d?Bbbe7^&zoTK?W{G>4w0z1RI%NADRR%wG6Li9&m=xO^G+|#`0AIB|iUe
zybYZ=BG{C8V-q?+0fH*pxIcyx)!-2%@Gx30rZ>QyB-jhItz=_&JX8YIN=Sxt|Cu^%
z02W&b^&$~bvLHTv!=e8L4B~$a353Bx0b~D*06pSiOY{pns1z+{$h7efC?yP&q&T$u
zjc*cui11;9H&G@1f^CAEGUK5?f?BLZHmzgCr0GT?n>NWwZq~5!jYMLb=nfBwh-?lw
zu^teX5)_#dZK^?uB*&#D!lu1(_e(wG%`<hr>2{R%Fmzj@O$<;D&444OK%0>0#qESY
zYU4A)Iy3^^q!)8GiHN>A=izMnXGGW!wk29|BrbrT%@A5IgHYz*S|ak|@h)MwlM+%T
zn^?9BOZ+q&{@3vD0|yy84*yQD=1=?I^ae`t3-HIRNdHEJFM_Q^HYdkJB|x14s$}!h
zxNEjfn-Xo#C;VfOT@!!vxhU;`gf|k}T!DlnLsmkYZ$c@Dz-7dj`RC?(6CtU|MqtP^
zTtQv8z>xnp??(p;h>&L!K%`%hRud#3N;(b<68Hl2!UTGAAhC#+*k;CvhrR)w0_yeu
z&4Y-fIw1lJ40_ZWB*0wn(Bl%pW?&plod!y~nIYMWQsN*37#6eX+(;-dnF5Z@^UuSS
z_lr(Bt66_X0(nuI#VFV&kSD#LU|VN-^nPZ8wJAZ~Sy;vf=p{A*QDUi6n}Iw=NQXKS
z_+5+02f)_y<<-UQ2K1O^(1_&{hSkP$<$anulU5KgJV*)e5r#&q^BzND9@t7K?^$q5
z0{$Xfuk+FR$_Q~N;LCA$-!#rrQ^k4A9lr|6xjbONemt}9-e&0k!je@HKr+DpdDwwN
z6&7O$@}^l}m;g(wK<o2R+Lw;0qu=*W-En8*jdwKO)v){HcieJk-R_(A?Q6WH*2xWg
z_uh49<L*0d3B32*x%;+#pSbako9lMp+;EpAyz0K@7q3db^By8Ks^Z`IZ)~~!mfP;y
zefKSQ+_`7pC!F28FS`1Q3o0+U@`~NNPx(lJb7$k8-3@o_yLtB=`)*U`{oY^mYTfVs
zf|OT3ANTnV<<htOrJ=7DsJyp0U2@@sYI@6GlT7AA_t&WIxBT_~(;ZIe8IeXr^+5BV
z?g8f{-~n(!0v-aF%;Dsx$G{b;_HBQCG8_3r&(x@P+&-K5L(gb6(tMNI!ykHPT#aj5
z1MWEMDRnCR4*5a7LWiqV{yXq^86JmgRHb$w$6cqI#r+EDzFMGq-{I5?&rzPquXZ}_
zC2Q2oJN~*P&pD*BXZ(!|J<jBNkw2=k8DeGpj%A-0R0HnN<}TGaL#!=bj`JU{sUh+E
z;AS<6U+9A_mG)O6r*OdEy|_yi{gueFGwQTzRU__uh8XwFs5acEJcn`?<RF5zjuUF;
mDat4!OyLiGus{C?#~f$NLUoKdS#SRe1-vRC@kB8l=l=$?Ad<=e

delta 355342
zcmdqJeOy%6wLiS~VSqEk3=GK23=D8!d;#$VWe`wcM$tHkMtmP$jAJx$4BC*WHzdW&
zsHm7|#T@mZ#Rgk#NN;jOf?i3hH`r>5jY%<T)LhbFW15r1+>+MZVygA|t}|n>&+mSo
z=fCHVhmYH{U)NrH?X}lld+oL7>UUYqx3ZcO4b0CNb1=g#b<gnh(BsW4<cU3Hd8xu*
zRK~t6pE`Da>4K8+?(*`fQu*`}>7mt6uYG3u(~s@>nLA;^*i{o&JpSlod6OOoi0}X8
zCO#tRGmA^g-+j-K#+ZME)FU#%#rnm!7?1SIH+iBE-YtuQ&BOaGF3Quf`7XOFlIK-M
zwYfu>Bq8pY#%on?w;<)Ea7UWJ9L3CUUti4gekk~*4db|DMTB4aG0GZsPx!aI^f#k7
zrd@IrQ(eDYE~HI-0`V1k5il6~pOzLE$#cc93=@kxw^ed}9mMIC3mJ*^(j@ek7S{QD
zVVE#c@Y}DX@Vq|=Oq~^RC+`o;FS*gpG*SA>-z|JUPDCV$n(+Zy3{4UKfB8|x(T@v$
zbyj#U(IM{-&P`>%c3x9m-K^}toTmfhk7`pTOw(x4C@rK*8cj5bGzZe5ZNaZ9jiRXu
zZ3?8rvIF06*ZunPfS7K;%({rw+#(;*SIZKY-ZVTc2$q#{xiL{N+B(-5!$Xq4n^w=V
zr>*CcF199Z{9s?w-7Wj1j4ZFj+__Pz+#Hp}zw3N8>L<E*>vY0aOcpBb>5SzSM5cXp
zGqg|k#*U1%oWEc6)y;@woqJ=$gvi(<#1mBgtDE6F<@WeL3K9O!oeAlJ5a#dfu!ifb
zzC4);z8vP;?U&NC9+#M77#ry>WVLc{a+1|crD|&GKGg6c)M_=-Se>j(nHiez8!qO{
z<tdZW(ah$&=gwj78sN9ho92m<Vi;APRL?}WgO$teDOo(f^HRzrE`+j9qjZn+o=#(W
zR7hy8J0q-4mPW`X{|Bv!gU0$8qhnH-U+y09Tiz@;jjZA?cHS8IpF+IER`ogKE*4q`
zE|w$>BA)CjWFEOIvw2vS7i-?e7`n>%@PwuLg}stoHQL5c$#tWb@IkqEbP4x%#%49}
z<hCb&!~715j)`0-QJ00h;;>R%=RL=AQ(I@pm~hU&le@;2@f)&kTv>EmM5UoR&*Hpy
zrBz(v%NN^Z@3;isA=ix?EkrW;$ha-MRn8c{o$r)8#^><i@{RE?3h{U3x@?7?m(3GU
z%Ow|1m<e!=6GjS=-SVqQ=;T`yrl3jo#PK{|_D;0p|3>`ZDz_u2P`*0x6J9TO<$TJI
z$*qn~K3gu&9W6w;<oevXe4%_kHziDB+UN&z7jsFTIcZf4b2oN7M_^Q?M0m_$x!gTz
zq`=&=I%zxL*XI37|Kf-1A}o%=&=+M#{=-73TW-vsC4^?nz4>49^3Ib5Q6U)o`NB!*
z;g|ASnV_-GSBYK3Ms~?BL>w|C<`r=7S6_tc<l#jNP`R$?AtB_v++DPc`(>#($>hgk
z5(ongJ$JD^ZQ|y7=j9+yF1eMMMdPa1!C4=>3dM=?&f-)|(yPUzc#nLkcxL7xxY3)n
zoH5ZVlwd^D-3NJ(V}<jc`bhlgyh<kS^g2JGJbAkFhukZ7J74FbT<iKRZ<q6@mOygV
zPfbehqM3f-K%2`E!hn&PiHSmmdva8VIz84eADf!RUzGc&7RQHXm)#4^rV2i1RDWcT
z`6Y)Vs$X_Ys|oF%v<^f%GHpR}N14nzv^qIaU5NKmysVY=_;RA!<=B$n@;14zWC0M!
zo}R$lI^EMJ@nl_W)^anmOHub6`MQ{h$p))B-Pj%B(OJrVT`d1OJE8N<8NcSkHSQh8
zg!|mPS@xG3It?}w0gf;xxrd7xa?4D6^zKRPFcR=OzFtRRSa;|7nLp&*BfCpGc}wS=
zQadrPRQ6;1f3j@ieIB`0wwvGRY@A)ft<`xS6&~K{m#%{AGaMF{A%+SSYKd)3XaAf>
zITkX_8qsb0W+~f|z}WUisgm%3bgA%4n5&g@m+*<5C+ChAtZkFlIqyZ}7=}eiI%`CZ
zFw9VIu=xt3+B$XfpA5n5tY4JH2Rqvq<#662Ut0W-pciG^l1UAEakqcj*1T3sXlm*P
zU!h*i@@CV5ETzHWJ8S2ybc<tTxVJP%&wP*RMH={O#Es|8)fZb+2Sl4tX)>5&#aN-@
zt1kl_`uxU!{S0)yMz9R6I-BvTd4YRBYjN21kfw|o*T=Yx>tYs);ar&M7#+^!t4q@3
z!`YRsQE&SS!&wlAGDp7NBAY#v67?3t8ACjpEkrYq`wpsZPJP>luk7{2H(1TIF7i&%
zD3ZsnE&_Hv=1P-jwqC4E9r)@?OD~nX>-8el*>cilaX*Xgdzo#lBay{YoUqC(gaAez
zM^3mIBVXul#f0x?%@K_TTU3)d@rl-O^H-`lHg`$5H*#Z4d1-;3MLlm${K~FI-6Z@7
zZJ=C^!i5Ada#f65941saCWmLsmWp2(Bv$hq=N`8mlHh#BqhJbmE@XqF@)HQ;*s9;_
zxGLXRmY$*;w9k*^>ax^Dd6l|syCafQn&v&PKvymg_fFyEve!FW5L9`m*N#MoH$@P7
zJA1vwTrkwh=0_(B$u4>Jqs0Oiz|Kdp(ed8SzLhat5W3`n$0iAJO`RE!|40y6yWHjb
zP)Mqmn^#XJ0eOD)h}4{7-rSC%fN0Ha5>pwAaU_OhsHx_=c?D4&o#rPF@hDV6=C9RM
zD`ob}Cu_b4<b}4V%fdskCHiD<ibX!ZW}6Tq$qU#1%-Z68jHh^4@{!(kJQll)pLoP)
z7h7cW4@P0t=Ko;65ayFz4OaQ+58@%(PyQea+3F8c@xS=wc<dPOb5?WS8C~<P(~2o7
zqxDepJ7=0BP3-7g_~h?7Dh_|@eId*x-+JnQ1c<VmPea=pkk7B%CNNQ6xc(9P99#cb
z09UqHU6!~DxDLq8^^)w~01;Z>*}P$FSg`zty38~K<yYnNKm0dquc2ON!-6?v*G3=K
ztS*Z<h0><Z=K7xs2Az*~FB+6AjU3+TZTJ<(+}JkF#J;d{(|F$9xpz|-7eWT**3J9l
zlWH|#4)uYAJD{X}^@S+P?ky7qp;oTn@_OitF6<AT*^MCr<fCKT68yh&+bU$|VA~kn
z_GB=&X8V&U>D#^=X$MMbn?}c*+pe_gTSzzg9=MuZD0ehHCkW;8m>mxbtXHnz@sPlq
zJJ0NR6#P-wnX&UA7g&>gW>-2so$4-V2&}GC+Wkgwwsq}b1s`U+S?+JnjL>MHYt+)Q
zdu}Hn?e;mJb+2~raU|*t>N2(mWwo8dU;G^xOat<O{6l>Y&6wLRHp}bx{!rhorACTP
z^5EXGw5ufTb{~=?%xp<u1*DwKs|@e<)rVbmBgiZFm0@q|*q3Ljb;L4=35oe~#5(!b
zKBvA;?w8mTXT@5%aQ`T47xt$aXgk<bFZIxlM?0Obkax@V`$x^|cK?!ht4rfgU8xkO
zX;2EqCJ3_WyZvcx=zV5jeuWhEk(kqY1))8@BfML~=#e<ANzv7FG6)rWg)ay4_16AT
zaXqvTs!QYE1JuSK)MhzbNel~Z^KC(;a%BZ?l8-4R_<vBD3!Tc{vJMk)vgLhnMRVuQ
zgONNE4E>HX4RWFYa)Qb2KPK>fKTfsw1P};comZ*%(?%-l1ds1Gs1w^d3c|gxbs87K
zTRQ!R61ku|(%JeG0~ey)o$W6@$A#2pdHCT;LaHQJAN~ny$#)L_3~QzBr>mmd2vz79
zqP7|f!`kJx85TMFXVV1XYUlc&O@z$2+Sz_&oDe27X}mqKIZpoO=lcYqNp5=i8D9Qk
zdmh+4zkQXy<;qL8R9|6Oi`?G6T}v&~Qu(j^$H?Fm<TGu0HB~Q>v6?>T0rio{)3m|4
zpJkF9`-_ny6NfwWETiUQXMr|z!<kw8z9aNF!l50Cj5$Uysnh$5#e$$~lDl5rEa*Dq
z!q-;ue)-62FY}4=?0;|9HX7(&*-xH@%sAuJLxY(PvPS>5ue%HSM@iWXmakSvZIGqc
z$MdCf`Rl1XS*}HVj@<To65lGHM9w0)@AYxQuu$39VdsbB?2dK(f_$W71-~YXZ>-`|
z<=Qvw4PQ$~fKmbzu#GdvTTEx4k5gV{xEU;VTzVSEjs&K2JQto%<;dHG(Wf9JB5lt5
z$Qi9J4X=<s(CRU*PPO@Hu)g`yMsWqz6+?t21Q+d1fbDVAF>~1!r`2H{$r3;Oo46v_
zsh>Cy?4bi79qAP4V63_{?0}sAW)7bquX%F{e@kwEGqqquUZvpasXyF8Em2#v5632`
zp%XeauYiS>^*N)r`-k@ugE(~1P;}5xsuQd)cBW1}>R7=9s<36tONX?AO6xxCrvHJ^
zrB+%uVmXx{{!7FkqoqYti0=|#9y2=%nOXLB+8aKm`KRvP&oHyQj#<>DmQpM*vo_Ld
z<66W$+x=3uhJww=Ru+b}Y3N#wpk%@~DEF`GE{>+bf=Z&gGz0@Kj-J_94AiBzvR@Zn
zBg(4P5tkhwi5*a9>nJY(e_X_C0MOfWvaOsl)oR-ape**Z{<Pn|+4=W?6yPa&1!0&<
zi(bw?HlA0=-eXy5cc~M#I`;a^kDO^U`>+Ewk|v!rL##K1sMW(x%dZ}DMi*(QphjM$
z^IO!8mhT*!lKBedmR%{1#_V`zUMsdDou)30+CU^#Qxi{ttZ8mqMc(71X3U{o0+5}K
zL@ue-)?{OAjK8P8O>$Vc6u^-ELrt}P3pu4~I%H+^RxnE?%9-Pu*r8TNAC=D^w}-aS
zR@-^&xRdiZx$T4`tN&q_pE;4ii;#K-OkwFtkFkd4eN+_vZfm!v?AL|Y)GEU~d3IMS
zKPs>3dK=Bgy!8^lET4aCS@O47Pcwjr*ZyJ(CmjXaz|-o|i0gR;A!gbAONb9H@BHNo
zu-w2elX5e~FhYrC6N*|qfelxyB5oT#7nZ1%@uxueSmF~=6g=86sv`Etu3uFZT%+2*
zyCYf9+8Zb_T&KJ%RaUE78F$DL!CVdlH=}i_7;(R~VYPheS6QVW1D&e`6Vk=6&HB>t
zd3luvi<+9UOFL}-GfpGbD*ZLW$-Rozp+~<ME>x<Oy0x<Vq@8b)*PMLGbP5x;C-0-l
zd(=wPA=z^3U7jo7I5oat-sM!=C+>Py7u6JFA&FMg?K~hR2p({zpf0t2OVhI5@6B*L
z6Oa*vle$#6F3<kY9DZB&|0ju{w*M^QZ^$?P({5dT>7K2D-~rdTsO>S90RFr{mfoJ3
z{7PP>(W9m&d`6>Ct3y5;!b&_VH@<yh(I%|RIfMts!2%pV>;hU1LbO`76*WSHn8dn-
zD&-g@O2&S3>y|w(bJ<0w_4&tLzS25Tnlyn4SLW$OF&c}%Dq*bL+--+GbF6!Ter?_#
z^02amv9kGeilDnHXP<UP@1ji6gh`Ge!dWq_)2lKkL{`V>9<OH7#a8Qp7>UwQlvamw
z<PCqK8nPvdz{iY`&A+zuk7dWNbNEKt_v>ZJZ-Ft&!DmfGyrACYRjU(U%PSDt<r}|-
zH0zXpGgsiN<=V4}k)i&wGtNC_zrnU*iz|{_&W<wqnqP8-IZ`2>(?p+q{_MZ;TDk6>
zC%M$AzB5ypun1JDB)-8c0dTCI(!Ey`2a%qvRta$rl&{3nJ|}z6O^KctsD;50U8;vo
zK<-%i+PTQIx4tg{5!C9K16uoV@Fj+gAs&^*-%a7)%F}<RSnm=aH?~3LLAm1q6Dh4$
znctId{qD!n8|>2{gr>fI51d`1R;4bI+ulu#6hkkq&}U{XH!~Orzmt33eL~RH%8v6d
zrLA@(j-pjC9Xjqw5$CSmepegjUJA^8=sx+@`MLZldHQ=fTrbzXH<y1c_q>;--v{E)
zf|#(%civ0F8P@Xt0-h$XdA|k|arONzX%ity{o3IM!qGkvds{(N6XrcrdJ~eh!uG9P
z|NB%^8Yap>wR|Hv^p@YlZYg&5{630D4{nEAMF?+w$lt9Yt@i$v&yf2r{182OJ}A?6
zh)QtzAxv^LS+0mHH4%97gSos;HeT$E-Uu3%)btcTWn$(=b*cFcx%Xl!R^-6Nlt;rF
zH7Qxi^rY^hFq(+I+rPXeKy(8a&6wm!lvNndI(B1c1iyh)4+H66V9B3$>|tR67T3Q5
zNxKmBHlR)=@~F*Hx%N`loYN$^Ay=p6U7L(eJ7P7ZX`9i~6%l702U#T2UQ*A%K7L@~
zQL9tGhO7iOSojuxHPF`ZjjUd>^Uq}C<q}iwh4&Nx4uKM_RwT#C)t5`K#M>_a3M8uj
z@JW7HKL6oN(`&A$pnGd|th;3C$`pQDuD&uCV*AxA&UrI1j%=(F4^2Q|m4weGZLRFL
zPCd>RU1je$qsz`ZtymptSRI+F&73*6$H|SWViMhjdUM_ZCg4bBBVpnz(3|DLt5f(6
zx$f%Rv2R4V%$1<kjNZPadl+4l<c~_j=p^+KF;v@WV8I}^Qy&TcOulusDtc@%H$Rwb
zlD*dyZjuMDjY>9A8MfhUZ2i#zO!<Ffd%g{(5<3e&ir{f;Ns`r^DLz25m-tt$2m>kp
zYi_}3dG9z!Pzq{F2ujlPt`$#ED?*Q>#cAZn(HHp!<j+I?R&701gnlO9_^%vZDqH$q
zw|<dV2{k=6bq4X;P!AzRa(~}4NMYB<B@>>4YUHv{#HL2D3iP#V1^b%%qys`;U-9X@
z^TnSMW}=bUgYT1%eY`C`bPaK#7zeIN78W2>e04)OCYS#qUWo3MeScUKE*JCMol$Q2
z%pc0)`qhfauN~pRW6Vh=IkIq!9{x!c_5lAU32_AwaLvFo)bY8-ObpC%Sbp`BGJaPc
z{G?>;hTg`cLEsRHsX&=+ImUiiqK!CBpKly4wXW(beuan)mF*4L*Pj>t9yF!obA{5Q
zMxXfrax3JH{_%XQ+}}?kS9g61-zB@QCqOoMuCId{eEzy~?6-h&VYk0{!_40m$3X^N
z7Y#z?Ia`~D_SC?(&%XnvKD8?8uAKkJQE2D=<4fH1;-}A8t!SLw)Ay^FsY9SgYMNWE
zh`S~?e;O}{kP@GkLDJm%^vQy$tKO%63eGy-VM0k?@wKMDhFy+6#6K$jM6F1@ex*`O
zQ<ueRDpeU~*FJw7SF7S@$gMZ3fcM~ytg*S6wE<8pH?Xfm{joBgT9I%-V@K?PV8_y6
z-cxe<X9>}7PzgptqM%f*Htmt?KAQ=)@BS=xc?F4#-&MD@;OoIWLw3h*g=omgoyCM5
zbC(^b$==mn)PO}^9l&N74u>IKqMqcw@!9*Z5nry&Lu&E}!b}r073ODU*Pp7e#9ROL
zB)={jKd+kbn#Mi`YOTMZwbmf%-x`9XKdi;Wv^qQFme2DhT-QWjYDy@^FiWi#PY2S;
zp9RJw9uB6@BJD=`rWe&I(HcoGjo2E9jFF$ov(+S+pL}W#p`>Q<XXPF>YeX7mFpdbM
zR)=k(uDAQMxBB{`RBD%38QQE?ndZorFP?}Q##db}PTuVwzcElfv_jtdMOktM1XD8v
zQ!S>xIk?<+s#V5~Snk>Koi9qzk?YId$<Na94E4OI=MUB^hWdF3!pkM!{4xiEPWtLs
z$;$zc)ZYi|dDSX$E9zNLFHN@IjDg4;bMw#82y9=c2&Nvn@M~w<hP*#a+C)nw@1se3
zuw<|2otd-;oz(`G52R`9*RS($<k|l{Q82a3{{OC-FqKv}`pU=G1HQ*tcsn$L$B3fD
zr`WMRgW@ldx}$nh&dRnwXF=a}|M{il(*I>V$J8peHm|_s2c8o`JhokO{=m<y19Ttg
z7$)(W-{RbV28UkXcwBG7mVIlWB=_(tnX7bmg7HE-h>;1JOcaf{J9KPu-p*?H<ep=A
zn5*$wsSOiUp;o56C$ITtNoa<*Q21}T=bQA=I!kU%NJsAb;dQxx*5x<1jk>KeVKmN!
ztJ4^+BA13$q)i;h-Jim?9s8Foo*}#bl7s)(|0Qcgh9e`gOZv+=uBnSFoVOh?Vmdw-
z`=NAaJB+YgXGW^>nZMM`D<z^}k0Uk8tuBo|L>iuGn^*#y(L}W}c_St+qo=hk8|8HY
zZO?kxkr*l(+s#{Hwlz79I&T}>%$3HiF@Ci&YO3u2Yl6NMq=iBRqPG2Yg>?p&7EMSw
zzQG9*-c+kB6J*;hd(lSXPv7I%b+K3-i6T=glkWOf;=Zh&`5aa#MK+-vd6#K7MjmEf
zfB^y<M`hA$a{a9-rMqa!J1nS49Pb&n*8Lo64W;KGU5BHp59J<gEfs2oWi@FU$Rh?f
z2lJ-B_-ztQ>!eqT!V(l%0tE@zwaU+to@sr>P1^q>hSP+$?DvwL6@;>Gph5o5*5=X%
z8G%l!;tt?&C2IAntpz~B3xdrd4%BA+5#wis_$(+KYPIF|tVEoXjN{O-(gJ}cvL|eT
z@dw6gSxVzaUM=WRLNq|VT)F4lDWwI}bXG!OEE>3q_-M+*5V8a5xYPI3hC*RUFz=k!
z4hvjMSH<8!^FIrw?xKP9v^uXq`fs5)=xlO?LJUJI(h#qT{)Pq%#Ww>-tkbl$KoQpt
z@Tw;Y8}k2bo))3082=2$y7iyIm{)_&1jeFPh7^F&blN$Pq^HMpTt4!*-%iam`puPB
z{5G<?WXpb7w@HCnDxReo={f0q(%58fq_|p{FvFo2)4{$Tq$`2~GEIJUa1=!2rNKPD
zTsGdG$=AvYZ)ZV+_Tzt)-X68~EX@LB!ezUgv7OzLnNF*F`m<?fpI1E$lffdlGRf?S
z#(+~(Hag5KGWX5c)2c^!kCqE=ouObk&uU7iC-&&1`ObSkayd^?J=7mTaA99^sh-p?
zWY>3dqhAY<IBhUM-eI|N+jj|z^g-&7OuBA&i42tSA$|`1$7r1BNqGZtnh2_Mz+Ucl
z8Qa;xVES3dQ6@J1oAVROBUr%wvTXc&YFsq6q8vbMqN!6o$-w0ANu;X&y*4Au3;Bxc
ze6qViQ?!Uekbp}=#=>mbuMu-;NSu7@?>V6=MAcb&%$-%G^CT}kI-X@cswXMa4!;e6
zJ>Ynb^`v_le?d+^NC%kv2U)c;5h|Q<a7B0V9_UylQ1xJM29isShvmLIbR@WQC#k{j
zD++6(n`nDm)Hj;+dX6l>VYSGwvrE6fr+Td4z{=%9zqN>8gK%evcO!oK$}&qjwXwfA
zj+eDYwV)j|YoxL3X)up62;?v?U_tTGL0vTTP&tINM3x}2(O_u2)F`e{EA=M1?QV(?
zBFf!&oqY9+|5(s)A@2{xn{at55b75zlLpnL`W-8v^TLdC7y8Z~@Fvk*<NN^s39Iue
zBiz&lWPiCkN6eV?wDb0lDx^WjFr%n-Jyw+TuNfL?KM+?M&N#+}N?Y4zln2^#kSwZP
ztqA`@42dVXEZ~L;z+#1JcTSks?ZCZ@`j1bsWuCv6lzH7@%I08F!C?TCkO->O>uI_n
zK`v;Up_Ui6XP=oT<h}tVx&jj2Lkb4P)yl8}svU@nPib+Im^NW{ATRXxzH0s{pP;xn
zf8At47qsx9sm5Mb?r>hlzgFBZAMsqJPvCabah#j}K^w4IVIHd(L%1_;HPz3>iU&}#
z`e5A(Qx$IrPvBdXx)7eqmntnGd==lgU&sGCXCFAG9ONw`Wm>IBxl2v9zcghnnm>g6
zQyQCBq`Vgdn@wO*@3ml>PBOE!ZYol?Dy~qzgwIi0Lis54)*Z^@)00Bsns6Nx2mLm=
zh-@FA)iuaX5;Vw5JbPj=l!x%#t-z#Rn=tUAn|KjCg|pBe7-bG<`FUY}cYatC4&+!f
z#;d9)@syGs&J!B;;Y@TG%OYF#ST+*xpy)AL`B-W(+B~O5K?60FtDg9yP`Am@xCe;O
zKzb{d%0rZg^i0(gHwS5Vu)GZEu}IIpzr<+pNYBz>R_eY1%ofp>f?1~1b%k(<_WGbf
zcLDA&&F)FeqTC3_lzy%Bh&;<AHJx<zlQ@|bB4+H@bLf_ejXoJlzMen1XzcVlCK<iv
z=^8&&2$xZ}^4&torEw*O<en7f`BOJIG*y^JyYa;qERzcME!ETZj!M%xh_XuXmZk})
zmBX$pcc_O~6pMkU3p`XQG=L3uDb)u4B>zk~Z{S(hT@qF_W+e=>BBK9FM`L6+DE*dV
zj^H(ETQ%?``Dt^nG@qs_K#@*6ls>GqM(`wSSCrq}O2QiF*bKUt)d&UCv(g*Eou(qR
zpjMEMwzG=O$VZKsL@F)Sg2aI>S(u0AIH)d5xj>W@R~WY7(B@TqM!tf#Dd&wmXR4Pd
zfx}Fk!;T53W1u}GJ7605-(+ktE(UPlR>@!_)Z))7E)&l&eMbfXXqHyTs1UQ_H}R2?
zAxz7|Et4Zt7*LLxcozRo={NBOe2;?j;|YFLxfzMnImH#l|H}6%4l{q3f4o1MkLMdt
zWJmJ|0c>A5j5|Tr`eFPf=qKb7Qfb&h`!G!l;!i2rvD_Y=87#6=5wi8l%2+;rY?pS~
zw@gwY&v4lXl&hm*jOQKh6}$_}JdOC8Y(``+Qo3XLWFf9vxf9D%W~FMk`P2sNh=Ymw
zDBAU7fBcr(ZaMkVz5qP)20F#7%c6E^L<XUWe0hK1nm-h|Rw*mvxSiK2O>r36E~P7u
z=S@wfTM?o??J4d85h_*GS^|JMm;ugNs8&Z_Mx7>b5DoyTFkEvM<u-2#bQ*a`$&Tl#
z(Mtno(UjMy3C18Q-gur6Fr|UXssVk-lvXk9Tj@=ZU`gaDr3I~XzoufUc4fG@7g|d!
ze5{@-`^fo}T5SjoAd`HQAP;qH8ll{b=Q;d6MM~gvd680^z?1Z!;XvA}F0r0f_9pNe
zKCs`yKe2wdvOBy5=reUm#0bX<{#}61x_D*K!t*#rVC8oGaR{XYP_B!VYAdfv1|%J>
zAc18CGa){xO#lg(iqtQZ8&(Kyh^a&#KRLv$Rz_%y4fu;Nl34hO3<fmZm@kn>UKd1O
z9pZ5$pJ=q|62o1^pU5l68OP+EDT<CbWjF|rFD>Bgzv8PKDT6d}@_r&Qq<KI6Q9oS~
zlem5PQExrFL2PZG^^V(H$Y7qN)gZN#lzO-IjV3xW*{6x4k-t2zGOS&+rB|ygVb*<-
zr<q7Al6T-fsN>?%q=Ck^G>OzVZN!!0a%E={gh{vZDn1R@0b!u5uPA!8jdfG6h+9pC
zF{Ez@==}rAgQ6DZ>*j1_Hy2lqV3#1Qmtvq{bU}zX4O$3551)z)y$+30v`Nt&B{6j0
z?*l#`gD|#kBwrBspK#)`(xyyn%%i`cEVS_w2;CMNf4K-%!Uux`3Qm>v90t^;oga&M
ze_D4p*1p8t8QK|g4&|r)rI<T1`BkMpnI}d9e0J2pE^9$Y>CeRs<w!D5e_XIkG7I@T
zucZ$!eOb&%le$?N*dT3vBv0E+)+-G4bLZ{c%rF?Am@apg-kn<mE6L8tG{;zGZtfq2
z<7W83K+oKxaqc6bf#p<T#UTwN(OAejRT+~4;r)dIhuA3%(00PqcTY)8grVFf=~QMK
z39WYyLD=mdYt%+jDEhYh$NUco<K6x-Hv+`ux1nfuXz}V~OtnF~Jl0&`{Mmxag#itw
zKU=5r5SPOy?6l{=W(E$#O%WtdNSt&r5+ordH=K!%cS0q_oXQj9c_`FkVP^-_@dPGH
zZ^A>T3M}hN<)f^=w3uR^wVbiEiD>$c^P0nmFp3W-{#2fnJA&pqu;6Sa#C3#%tB|YM
zxNB)BY9-GM49#1vr7LtBm0mP$fD47tL0R?%ksRWv4U7zRA{DYt*FyOuI2?AdL;7nZ
z&-&MU_i$0m97lCsj*%vx<8xh4sSRyfeSVckwveYB%5}csQGR;{)_;ZYvE2inSZ-#n
z9GxXX)(!LGOK{!xu;ylOOf5shtGz3d1_%LYL|c`5iO&*ZW-C1sgy&)9ro_jOcmuW|
zpM7B@$8=7IyusQFNC-Gj=}=aOyw!>;4YY!k4{e_LQBje@rt65PZt~-F^c)N_$%;P>
z{@WpLr8NzJ4=LSge4=3C%B?h>7rH0+Io+U=ozCM0eBJ4Mw2;7+_33;HKcIA^LmykN
zh<2W8O~d`=gp!LzQ)n<N@FiM9*k>p%6!SL}ubn59W>PIM(xHI<LB>-py-{P)3fmX7
z0%5I?@bv`DQNkKE)if4NQkQqFC|YB%iiEpLw;jBJWs}HK)Fq*Fz&F}8rn<ypRR-+*
z<+!_s=g8na_AwGaL|Mm(&=-|ghx3VCQa%~Z%XzbsJ%Ue4WVq?h`Wgh(^n4N}TZQ3X
zFWfQ}{|Jn;Svfg^FSA0)6q??xJ~{w46l!_`H;k$$><z^+66(WQrDY^{j$KXXNgBGZ
zkhyV*?+4sU<ayMk20aEaUMm~Ha3%;{tLR37fE$$RQT(BY87>vWpTRx!M%Z`+j4N=B
z88Bo(a)sb{!Y964{nNHI94%`;avlI8W=Jn8tH`ZjvEb?+0uT1eR0c-zyvNSb=1;iZ
zuS(T$>ODaDP@*K{7g7@%H86Hjnn;haj>btS6KEJ<d-ovUk#`k_WUJs(m!#gM{ByR$
z8B=pYo0XjzylPP?f&AT_HjiBbc2@%Afz}nTdN>_l!`^L`ym?oP(%}F49CZh5U6jTx
z&jfAuQ*}=UW?c8ET4B12d-V*ZFq4lHz(Z>?`IH$uXhvbFqtWCOmgt7gY(}*L`yS|S
zCn-StTZL&goCliJ)R3qE!$cg1jP|ZJux{mMCf@=suN}=t&G>?lhOul0*1}|Chj|<B
z22KNlyXQ`u<^bqO6o8E3YYfB<zeYd|J(MfL90!AXK(K^QRr*HrCAo2QYo%61-zJa_
zE6svw0$F@8Yb0#TkS01nf6>wpVcg#+zAPMN<|xfs*#9>vJy}pBpiXCD!JJlXWBBV>
zUFXN}x1%qhC3&j`JLRWOw2tL))IO&i8HY9n%GGgv)YSJh&D=I|CWbQ+40ao>;4{@W
z5e5<neSQa=F@k6fH_dG@Wley{q@lR9p)5|>sJO;M_MP><L3cm;R|p)?^&7j*m3GKC
zoMR8<SyI^aw_r!92%7-#&?WS=pBN|)U(^XBWm^o?3H>6Fr+W)uiO2#{%v39MQ#H~g
z!WF1Ow+VT(P)_mHqD}c|Jf8ujM#_ewTcmiiA)RcYN_{q8Ht!XHwoHE+_g=7Bsf%Ow
zIc{SO+$I(XDW$Fg-G%@)zWIB4El$+VIW=dC(!hB-+B$3cic0a8C0iLY0f*IZl)V!$
z5vP@t_+&29&JnhW4-r>D?V@pJgN*rsdlz9ebRg^nwt0$iB2OCe8d1;qa!fPG<srG|
z{dXp5_*Eo+<NG<0D&(3ndm>LYX%~`23GAt3mAZ*M5B6G7DAx#07jBCaHY(i{`MTsy
zsI_udVmKK=Pm*DkbTYb&`RY?qr<CV#XXq)QVOI9$@JABO=OeZW4_!HBFpD1xOP|=t
zd=agNkG}fUcwR9&_=4!n-gmS+D>pHMx;QpjsdYeqDN>F(cthqUT07hQ4W9+pie(@9
zX<&^p5KzF}%+T^Z`cq1EE>D?n4#iHNA1EKz6f9eWHZbRy-y$8csc+(PO{!=%Ec2d!
zf?pN26?L^eG!3U7_XyFaoX_Qnlf^pdF$Z&J8G6K5Gq5`e-vQnZV%NYq8!9j^Owjgf
z^GDebkP%&J$FMbeOr?r6iO0u_b-C|{dUOA5^iDDx-IFF5TTpgRnLUX=EX3H9)=AKF
zqLr>m+-{xW_{d;ZJ&|cN(=>9z)|JIP%B@K}Z$!T19fR2s65fjolU*P_EaAqD0gJeC
zt#+GDotEeEDb^9RVO^+69R!^`FjQ1%6JHf^Tse}*vvQZ_?ljgx;4a0HKbp*+V5whd
zB&&)T0V{)8cCq-WZI6!K1HNRXVWKZL9OTgDW7{z)u6#Z@-VoaRmn2vtC6TP0nvki|
zf2=g;^Q0L^^`iv+Rw=!WAW{ItZrrMGAfh$CL&garnjVv58VJUV@+u>nx4F{)7)&QC
z1Nl6``Zcl#fy5)f-TvzgEDmd+Si~|cfHZ<+D8O-bgtDdp2aaczt^%A>KU0j8`KSqC
zmngW(Bwt4J;y|;owaDv6x)9#`I+VRO1TrjFSvi@%luROxlrwAu1zU-FD&w`9vg5HG
zP^2k5FY_8v4ck<A8QjWfyP{$oI?b^C#nBkmRLkqIU0zfCQ*e@eOX--RiBnvm|3rx8
zN?jrUA=fLn3L%k>q8%<Nhux)l1>Ci1>%crqglE%oB6-Pgil0ma?A#imDHn(HT$oQZ
zt5X#NwnbP$IG}_`jb6#DVOW*ATIng`<C8V(ocO6=3(l=UtxD0ZYVp0G#1`}a0?h`B
zakf9Kv^)9u=+!if+x?DY4gDpyWJPsCd-{STfSMXPgRpDt9<ww+$Hcc3$p!NJ6qk!9
zh5DdRxfHJpYFf0?=)wx#qx87ID_<zOseBpFR8~%fLa|9XIh8-dcPMyvH6EJR%4vM=
zj5rM7Di-v@fUHk=iWpamGuDl%AfH8#qd>R{MR$gFxR}g6pzSU~)OAw0x_h&9P$@6r
z7R6iwDu1oym+-1kGLz*hEhWGO8(|6mm-wVstP~H1xdf9Muv|?|TCez~^G5}XTRA_S
z7Yn*3#W(}TBArXgo&jw$<f^iA2Bdwia%2X7ku=QwhxlSa-=Z`>#DA8l2Jiukcw#;y
zJk`|reb~beU_4%*osr8BQx`{0RjOz5XU1NJLtnO<Vm_+r;ACrG5~^A39m9tIV2dn?
zsQxDQHA!7!%iZthRUl)vo2Sm0N3(E$CY#%ERAKySbxFtt%0Fk5GSXm8+Sw*SQD>yv
zW?%F#dmD9rsa*q98CT~P2$It6<}*#C$hu*scpJ^rl-N?xCsXm1V%2mgua@$}kx8*6
zL5V~cyOIV(3!bQ5kIW!qull(7D7@Dy)T!n*%FR;#kYK7)9JBcRc<bKp%gNaRZNK`X
zb&b+GiziNsyri{BP5JubNyDMW_QDe+QV1d3(iUh4rrOB!?k-tlNYTRfF`(R>#Z&d?
zqCDm;*vNC0*fMZatx{eF7K>BXm+>b<t*F<n7-w^91a27As?ZC_!2Hd|w#+?B#%utX
z2LM~uC1IzO^4a{67@qOu8Rkb`BOHHsV6iS&x@Yq-4Vn!Iq=QD9N#`keTo*V-B7MeL
z3fJK2cv4`kIfvWW-#RDMoOMn`>v`@zkQpYwvJ#e$eLyXni3`wrxFZka?k)1Bt5Rq1
z{FNrUjD^xx_wy`cXKh-Sdk41DB{AOy%;(M>kn{~pKnBgp5uNOzg^UglsFkVT;@Eo?
z7geoV9?UPKEaGBHF*ci9P=4Il0$#JR&HnmL9*2#OZhUl;8A#l9x3GLdBoFQdTjT>*
zwS!;)kpuLMh3v}#nPseVw>H4Jnru6jsc~+FW&d-BCTXa{l*`m1jT|0aA81Ok#bi)f
z*j11o#>tdi$I-AZy9@!AnldA=HLMqp7XNjN{FBcKp>*U=+H3Mhwn}@y^mhyXdcPaU
z|D!3d{wIeJ84b%I_t*bqw^n%_DzA(3N3M|MFTLFYM)y!teen`1b01*YyQREArR8Cs
z-oU$R4zLWj%(5}EjBP8W4EGi$ZCeT8v7G(LE2aA|Vn-{pppNvxI_t+qIi@Abk6UHN
zH4Ss~dR)N`gUN|;sDjRW7-UP74C@V6FTQ?t5$ygjKjPi*bl^!=zOC?$a-qNM?aIcv
zJjIl2JQ?H1yW?M~i{nly?Z}#>lW^j+!T<L+?q>zhZb|Zi$^S<6pkh{QzF1(ZGO$${
z*baVK6X26opturv>~LVP4Lw%44>GB_`%SMSOn_5^B^m48WBfTVf_sOOU5-0|?5G1$
zE4>z`rLQTL1#t1LN;s;?aq>sNAV4r_yM$AfjXktIUHh5=0t%w@Hok|VstIIr5q(j|
z1~@4c2O0-ymeobJIZ$x>X;w9OAf(oxHHPGks2b`s`~Y?h6->(2az1);co(r0*a<3S
z^0@#q$y-t9E@mftr&sF2*fO%bX0#7!Lx%$zz=F_TrEng0hhAmPJf61}mhP0Z1SQaF
z%2D@LmH|2+Q5VCj89N0$lP3olQ5*vld+qbbaa`FR*X-#_W3>~U@dynsaVu!w1UMP)
zMquEda-6UsuV}!jP#0O}DCYSPFLxEkd~5+?yW*J-^Mr=`yRDT+iCEBHWev|lSm#^j
zbLZ0ISc(U+LRzuqAEGx*V2;-u1-!ZO)dTOL$=~QftFaEWY%<FZTgX42uRm}I`QK)+
z6z(WsZSVjctHEeC%b<5F-roIPE2BezV*#HTcZx_3-t!|gAvD9ucZSlufak@Hh_c2s
z*&E0I9UIT7sFoOiUaP5A>07`@6)laj#k3GWng=Mx?!a6myb+j-gtat!S~0Y8w)vDf
zlunmZutZt2;#$ZPR)-?%Yi)}wFttS-z#GZbgpY|O0k*|4OvfT@hS<&Wej=n+kNC_n
z+0=%5yCM!664k|K%|Zw4&>dLi`|kE@-Pt?gJ9>(BDc$I<;rs3|=XV_i`nG@WX5ZNd
zy8)R^j>-BqLPJfBEuwX*p$c+SS5&4h8Wz;X;?SMeefDmDZZ3@!sAiO6BYL5*^K6C*
zcR*>%;zc~J;S;Jz?;j%yn+_n3#U6W#7A!6H-J2aWcN*Dt`yE>mzjuEh2yV|4142Nr
zU5Sy1rQHzjD>xtMud0iZ&%$#<RTo(b0@DDsj}XIB2r#&i^RaSs5ze|tsUHZh7zifd
z5R*#-{L!P5nb;3&^*wh^Xb<v3eTAVtSQOcfKTRhX8I4Em16WSN&bFLnf&n6K$C@r~
zy5l#CpBuoZF<&G9Zv^MVdb}kWsrN=c&W6$ZW3kWB7q!_O8?{Z@wwTvN;-W(}h{ngj
z)r-TAD#j(y7S1Z=OQ89AmD(k^gNck&UZvd2$^eohLm#6hAp2p4JWObszDDCF+@f35
z#i8F4>%7}KK0zt>z@|F~RhvkZLo)e@Gj^wsdxkJZT*_L`7+$QUx*fbL(r=bOSeJCq
zP%l)&IVm@?l~!3KMh9y%>bY}pLzHT|OB4z+{2uJ8no9}68rnP!xG6PV$3n<ZQ^%QT
zD({gzA-n?QAG?7N$h(FoIE!^-X;*%?bu6*!-;}nW@l<6=1s~pUN}DpU!xewBbNA+q
zE3_x6sm5IzJV-aF;~8|zMfIA!%{WXr@1lGWu@MkdP(OHLF!ZV(<2>R;l$)qN@jNXf
zLK<aOT=Tmy=;OpL8VmXxvVcH<O6e=c|NRAd$|+4GrHO+^$t-X4W;LMv>*wp8AH$F!
zVtHrS8>1j0^ml7y$r=DM>d64oxbGn%&_>q!{A0vFQV!%&8taG7vWb3efdnKWrY;h<
z(kAFoj#l#c=oxUBYI>k-tkPD=lcw&YY&;CjwflG93&`b&^E5e-%^eVP4`?zGSBVy2
z$2l53a!6?i8=>5(<TK&@NA3c!$XvFG(;#$PvtW_FR4+C<M(QNRTLtUJG=fgj9+066
z=@tbfKD$7aN_!fcR;3O|Rq=#m54?cBO~bgvHk}D$m`-jCxjT7J?sz_^T&jZYIArbq
zYMwGWWUO(M`M{2covVPGockOO<CP(yX$wG-e+L<0YRa7@NV%D4=C0;h6SkWASc|)!
z=LfYp+<P(?oWBO}b_wn*!VLIm^*8Nwu5z#A@I?|vC`YPc7Ase-R`c{n`3Cnj{0cyy
z;I^ZOfSeZE+*dHuS9vq;0CL^ec$2Z$e1OW4##u?|p*@p?g3)Yl_2q=LXFZBNG$%@;
zC*OGTE(HbAX3A4mF6Gl2q9iD&q6Q;1^>1n=-PZ~I>eAFSq7?;VpulA)Jm5&lg(d<;
z_#sk&9m505tmZ=T^_t$|FKT{Y{7udK#kXtTb8@`B)#L4L^!ExfG@1JfGHr@-D-0qH
zP?<3GTj8;I6_Q9Ij(on}FQS8)KH3owXb^axF1ar;X7}STEj#ZS<QBiL51rEw1aP5R
zv)rWdFKag8r(0TCKCOM^&jQ>YwKDWu8VKy9+Kv;n5-}QdgSsT)Fix3+yZ_yv4>OR5
zGQrZ3bb|&@#Ba2Q)rlMEyZsk_iKt=U^!hztq1a4ue6<(%<oTyjaY+JB`?_A53BarH
z6@|2E`5t}^ml-VBIgaF*wI%TluOKs<5>y#+FHFxn@FYN!Uf{<ij(j{P4OE_o@)m7m
zQ2%^IybB{N3jhy=Ed)<bu~w;^@_cqq_vLQYquYft6^~n=u;-v3tW)eYI1q)g-Tnp~
zEHMSEZCrhz@BqDHgYAOKbW}!*JlIh(&K(&+@|J+S{TfBkp(9i5K$#02UM?+Q(&|Dc
z(FPYlJ{6l>82Nib5j8_#Bx}ah^eD_NX*78Hz8I3lqKxsv<$`9qW^Y&<LOVi7`WB>H
z!@3l|m)pmVc37gv(F(`v_R%VbPY$?0YLJ+RIDOl{zH|z8vK?{Euk?Gl#Z|h1_tdnq
zX1oLzYGl?@x(-{%dMLEyN-Kv;?u+O^4$nr&hja?Z6Mos=Z0f>OSL5^bS?$W~<-B0#
z2HrpEIK1qB?l;q*37Bs^?{^~~zkSjV$0)5l^0IWuaM`dA4qyF|$71~M+_3(vx<B8G
z*r$ti*iC-r%yK?_w*BPq??vv5X`Zy+c`xsjX!fmV+3E5)K5L(@2{q#=?%TkckZ!)8
zp0!`sg1nB1{kr&I-8SF9V3665^7t5Cd&FK{EZ{V2WqWlUisw;2xk1+z%x@3ocL&p5
z!E{eB-5pH#B5i}PR>gIOVR)jj5TP1;vutz2%UvJt)r;Eb^YF_C^)b^l#VTL#)$$6$
zUGz2l#t`qA9Demr-4YWU;FUu>Miud+5iN+bnk_~Vr=e(CRi)ss-TsXE|0mr?kx0Pl
zF2IAD^RfkYp8{SBpW#;=iRg?Rnk_h~!K#cr7@$Q)2)GMFyLbCX^|*Jjj0Tw84{Iw5
z2+&ha+!>XpKiAFN_2HID>vVqFL+Ga$=!@TrnFgk<{HotlN61l}%CI_@eD%lhHp+um
z$M7_5J&6kv%*5c@Hoe3GLuFXA`x^9<mn`B7g*)k0U;~cymaS>Su!mKOt7)qt03@)0
zhy<6E%hE;2f~u&gw3ooy_d?n_ypo(>jQYc{$HS@%d8DnP%9z_Y<zEfPuj9JDnc|um
zyE5jq<DHOf{I*nYZe~b6tbw>%k7(CU@J;pqMo;22;igu`JOz`h3uKjye(373=+G!G
zTCD4XfG42bo#mD2_~s)SLdzYC2{$>s9qBpHfv;&IAWm2e4U6uXA95t%78?)eA{4TN
zM+h&rNo@5o-u_|(n80_Dx0Rmc?Ik-{dCBu^zPpdNmAruXPBx$Tp=?Vy)X0cEB%F5p
zvqU?T5`TS`*}i!^eG?^6#IYizU90;e(S^DNWYga5A3bQ7K`qqZ)HnJsR3G2(C@-%y
zq#Xm>(Ey|95?HuBu*~eiUaScuY)%I-O6(2hir#-u9R%QacJxUiAx4O5BOXRm#5*v$
zk{~rQF!I~m4@jeD?q$;R^5|*sC#WV-4{J}Ww=iT4wZ(=yx<qE>lwZ=yGUww5sl3LV
zm}X;POiPf98IE@y@Iu99Wq6ymgwjlH%EHHaS`sh-ghYbi&EfHYFyC9qEzl%7l;+2|
zrGYlj-J5raFjEJFa%JSRFqZeaKMH4bkRvq_d+Gty+pn!aEI_DTGo$*=35Hw3!VgX)
z-P_hL)qb!yX&_>+&<YNaF1Dl&eAp_cZD(HTgVv;h5Air(D?cXerSzn~LGJZCPoQ4I
z02al<ynA%?NZ2*$IKGQTz1<bXaS*s|pC0vh3W$S0;V+(=@GY(I)d-r1&{nWm4mZ|o
z+6u;Mr4@`L@>oYf_`vQ)=LxEZc9)4(J}I=@?vMIAezZrzrLNiD_^1Xv(>`rHbz-%b
zjK{l2EsxXc)H;C<=g87~G3&D_4Gwr1ar#lBQus%grw#7Dr{8I4r87=sP2hZ^ufKo3
zF^h`X$KxV=0uBI@KeteXGl7pw8JmWU_t1|YVAACud7U3qcey)>4ymTx_gQ(P*WT~2
zgj6bZK3>s~p>svZ&`i)jR5Gt4leusTi3A=Gr?tF(Z{J*qHsF#j`B|>WEc)LYY@1H{
zVamtVCiZ{*&ocbEKXcyGml#68oi2a<v^o&pjh{OxCmq%A%MArLd*Bdw5HKtB&lx^a
z7ezb;Et3#>d$Rt0gREa?xCpDZ2O=!s30W1E2~6pNY{7+A%OC_eyU=PKj9e2F24KsO
z7A~|Z&#&ea^G&fae(ZyL@okENc77q&GH9~JG-Ka1;|Idb7lv5}F(Bc>u*5-=5q0Gl
z9Ue1>$z8u4r6fJU6B~BKL>k5zhJCOuag8Y_Ch|g#g&K&tJ0*4@M{8`jkdruw6Dyry
zjUe4N+SYO0p(8;)Nu!Ge*7Z1@ghK3P!@yMmB$v=72aZlLxP+`|hD^uk@hUv*t-#1*
z<49-36dkg`87NF;Y&4F_2HMf#AG#QPg!5GFQRUJTeB{D76QqiVqzm%CMZ7H-{}}OF
zH8pN5q=<*43F2{xw*}&{cM-1zOdOfxc9BqUp9^Pr?Dv**MtQgfXY_Lh-3mMxffw!@
zG!7E!xUF(Q7v<#dQ)&=>4inuRI<Mu{MAq$?E!EK#M5zt=N1Zt&VI6V!)i_L)BcAm@
zvcA)MG-)vRV`t9u8zjFY)_LuPz3H>)r%f=#Cg>p@Cbzk@w1P==0o9-`3VW(#H!G*t
zGXR2PjxL%AS2~Nv4~nDX9UrDW5$QGW{n56x=OTUPy#&O4hhK#Yh>HZE^w)7bZNWG^
ze#Unl>>!`>4j?@-cNR3lHHaU@%~Oq_O%w*#hVxLVwrPe7R=975On}=xyf4@|b*bqs
z!b)9|cwK2+!;2c|CVVM>g=+8kM2aCSwlx;-CM+6X^(WGIn!?JroG5;hu$r}wuueV%
z?d}?_K78+Pd(<C8{0WQD2&xm9+2qHFba{K7PKd9;&AWc`HvI?{@=g=4qb^`DL2<3+
z$pt_HE3@$h+4(VE5e`HAC**zjf?V_-c&ZZ986CAbJLf~M?d=cNr4C}re@<y=aPP0>
zqtmsy!aPui5qoLZV~IFGEvK7fAR8x!D=9w!E0C3#UK@k@L4x3czhOs!APH~a9xE2z
zN2B{~)ID4{-`*k@K1tWS06iC5%i#9Seu*{!ZCip)gl(yp(saKF-|@HXm?b!R&A>@U
zR8#rPk^`(fn3vpuOczx~hi|BrwjyePhIc8C;vlGv2o&t-OGq2yA=FL!jCh#pITFp#
z5{loNd4Lsub=}km38cfF&so}#9m&ujz~?J|2Y!dsf6d3m*U*+;=Dq<Bgod&9MyL)=
zP?TTbs_`7F*aF{e_jW!Iz%cn^Am|5A{udf;)H()#Ql}KCL-J0c&cC`IJqA>YTyYVP
zY5`olVF;(rR-G+Ai<cg|YR(p4pf*Hl4cS(-wKd?z>ALwOVMrJgFf0hl+pA%WMuE{L
zng|#HpuIQuITm)sWlQmOhIh~&EFQ#fHk}Oba-R&(0QJ0dT%rIcFEua_*ug7xfpZ&-
z#_q|y7gM<SPessw$TJ<hmxNIsr5~Bl&w4;M(=QxAKI3K8S$Zz2kIMH0!4hoQ8*+D^
zc)FI);wQSF;w3R~v(Yu;$~5i7%0~DDajT+kMY2M1Z{sgfY8zjNcM{dx`F<f9zHr;=
zCiz5d6MvcGp4sv|u33?M9v<$v*Xw@)$!C@Poq+U|a&jjwUpFa^U3@p(ch2lW>Zucj
zKjQdh4mLyaH}e<6lE2OSL(wMXd^4XBlE6Y0?;bun5pRRuqBoY0JO)h{W`69o#Qh7B
z<|s$@;L<c9Q@OE+|6H)VrR;o>KP^NS?3Zx|XFjCZWEj$;qZOA76HDSZ${I>1Y*3nI
zp3-1Eu%fT%5M0mp;2QKc+49fT<8du~Y>{5B-E7vk)lnMV8u7egs=6rkIOVGgBJXM_
zEYTGN>bax~_1ar>x8oyhjSC`AIU<}?2X_64b69=mt==g|!86tP<&<6UW3x0WWB2kj
zA^fmXzL%%RTdtEEMNgk+AAMm5^Qj9NSDN<nFB`<uc!qe8E^f4UP%k?#!=UMbJ?wh#
zL3pn`%W&2f&-EU}FGM`csu6#q_n?*HkMth23_4c9__;{j;qb9W>|Wcjx06<9P!~i5
z-UWbH5g!3|n4z897ets4pB~XDOs5y!JBRrTm+D6dp>)4na<O=ax&U`Sy8Yw;U#htF
z!$~)Ms^f8HCRw5`3eQx0`}s&A?3&VyG9m1+^6Gv*E=HeBi(*&zD3O4x3&gw1P2@Ku
zevBi|babr!`hmJA^e_#Ib`->S(4e4OQ2Z$xRM}-b!lxg&SP;Hcd)FSL#b?m$!LuoB
zPdA)@;ZukD(I5c*SV{%*C3TVR8#vKGX-QGgR+~j_CPNm4A5vNsutiL%(yj0mA@Z`)
zukgPJ@f(#(Ej&FX>Y6q)C+F_6yBTvm&uU#e*wcBHcqO;MwpEEez<(sfy{8;G02sms
zrRM-onWj5V#L(NmcYipjF3{~F>INvR+dxEsllEbM>-ghf2iE8hINCZUN2=-qeq6~o
z2zYTDl-UP4ejP7VX*|fsjZ4`F-Q;1Yv3c5EwXO}1+k)271>(2%5(#Q<(2-$*h;bam
zeR}u>+5q9O@GO1*H(Qokm3UN<e$1yu8csVJxsg_wx+sJzwLiv*-vFIL@5a8fx%cs;
z0bFUUR$6|{M^22}q!Dlto>mcDFU~RW(8Uvyv6O!PG09A0-R*bcCV?hE;L5;{alMtT
z#J2Jm;5^#a3dfoJ6X#oraLId=fuFz+DPJ+ZgaIe<6VqSf0>|TCL#t5ja=-(rybUgo
zrX7mE4Z<b+#6TPWfG5U%5ph7Mc(=9fO$cpROeBWORr+C-{1bgYg-5HPTcnte@Gs+|
zpQT@tdbjmt)J54cNEPvD&8?V^^5Ti`6rK;2a8dkY*d^M7aR}OwZmL&?_cZRwqL&`X
z`S8WN^diN7l*f+?Ef3U<yFAn`?$rHu;6vt<L@%{hli2YSXO8ldh7;Z*p`4%acW^^<
zqVd%MW^6^+iBONQ2B8{ZwsOQJd?1wcD0NeXf23D;4X~>IKzL+&;9HG0_w$zel$L2i
zrLgekiCfcz{}Baa?}?jb!Z6N_`{xMHQ*!4VAx4OKapwTv>lxtt`Um)r*Z@~7CpzW|
z{}U3Ub_}pT^&nhDP!R@CbS)4b<%TcX2iTX#2H1ahE5jEF<5CWG5AYuY${}@tzhpsh
z4DiG22l!8`5n4{vE)qTw_!!)<2)~_*j-p%x@bezvrZf1C34AI3{}v)oqJHlQPlfOg
zeM7;m0iF*a|63@y@qgwQ^bPQWn+U+O;LZS_3_K@iAQU2$5AaF7fiM|uCj)i~zB5`8
zd<cCbRxnUz77(A+gK%UZp8n&rx)(iM_VC;#52vxfpYrz=!qZChV}k9(@s+}_ga*oX
zJ?YX)2l$*b1N`B9guwwmw|{__*CKQw0HOIF1R%Iz4Fb}$kx$`aaeyy$2fyf((pp|O
z@&^a_l7)eKa}cNe`|Y%ELlDS6W&VGd*Koh%CBR$@m;P@U29fbhAK;#91dyECc>Wh8
zJr7WY>QtBmb!pUdV-Y$KvJn7hu3rlcd~O>e?FdvD3=hu+iH!&jgkDU`Aiij{U?;+>
z59IZslQAIc?EmLb(TI9zd%s?V2WgKTe~NFl&=G=D^9lPC!e?But$`R@qvWj-Mn$aI
zAkCR3&7V4FoI!bFjgX(TW+gH*$4F~e|6ujn4Qr*<>!cBsHO^pAPOTA!3nNx4H&Kx@
zWx`rKBz3J7OedaRE4<8wHER^>lfsA-t|x^W;l$@p31>r;n;V4gh6jJ8en5D74MIIa
z6GAgWD?&R$2f|5&9)w<mK7^YC!iwrZc>2zOuucrb*To_}9AONC1ECOMcCaj1|9-m_
zC+0pQY~jko&j{k;b?AIu9YSNU^3K4QDz9rrI1<e7Li~I%-jDdefUuq+m=P=p83@^d
z^7Sso^^7nnWqo-t?L`^-Szn7#kAS|`H=U?|R>%)I(N!;O3Bx_tK&voZ@oo_!Ld&r(
zML8O89GdSZ^-A{^VP(VvbW_S2h3tlvuzYM|>?!j-{LykAV6DNtOv_MSTYsQlt(h^-
zDSv>?KNf5o{a_xI(ce(sycWjHI9IcWfEA;%0p<zjHBiL|Gc{y}QKbMf(>em3WM&WL
zl@tPC4a#9^y%z*H^F}ZaKfC&1o_|}QT}ZIr(b)v|`#(8_hb#WALfGT$_kyG?2(3)V
z!3*n;3^2zU7+xjBv3HGaW=0*RXFWEE>@mzFx)48!cq@xBQ=Ky!&`}b_&uj4v7uCP2
z#WVd>|AumNt1vnKN*j<B7%SN`G^k+~OjtsLh}slfjG+S4Q!r9S;7<?w>$4w7JCJS>
zby^!_>sxVKpc_gXkY}iUAiW;xz6a9%j73mm0*TNNp+iQW7^Y=d5Jv^07_5LgMkB&`
zG30&&V=vMJ)H?8Iyv0D9p|lD0O|A#h(~-ti!2Lf{J<=`TryH0FBQW8W>HR;`CH$Ck
zp~&xd80kXVH&h<E2I;m3(npXUd?0-Xj%7BagIQ4$((a-1sM$!j-cL6m(T2&<-OoTA
zQFHYJX)n^>H$a@~_dQVF&sel?h(ggoF#3T3MPooQT|?zDCz0+CwnzUg<_2TKVut_@
z!!!)DJdm~_?RX%ak8~~4!K`7J<6%c0NVhW<i#r9a9NDp;P+ViM9G|!*gbqaTNBy(7
zV^~^yMU5{Q7%riOv7{~$7qBP<GD*PLmK|t7^=%FWLLm5O0|K^oq$vx*_9|n^=ArWB
zSfuNRD3I)DEM>M<U+bTxl*3r26HOWbARwVkvJC-{B&72nNEae~<AJn_*MJ#FQx@8%
zjX`*TVrigQTK7=>v@?vQ@1%5~f0o{itAM7V3ih3hjc|$LeSjmTBkdk4A2A#0H4mg~
zkzW5mx{k3?b-`5yghtgfmf;fdt|Ne82H<5hVT!c%j|v&+Fmrlv&Oq`^H$vSIz)S$h
zY<nP$In8`vM41@T=m(g1G^&nPhw6{Mi7T_lA%wD;knR<EgN706WnE%y%)%i-F~)=R
z%^@ZlGr-tb7b+4=gs~XGSRx^%@dt6q#@!LawRARP<B^x05$w>5_!xwiAqqf@vI(Nt
z@I6T;7?I%`>Tm)&m>4UDY5+l@iJ(eOVGw`|aRi4i*g-zxYY_T}I&j>8ubC8NVzkd2
z&RG5f6e4!Yw`lYSs`$&dA&eOsQ9eeI-#)~(`L7~<^?~v}#tIe=Ay@#46+E!c3r^xC
zku8W2noX7vY9B~r)l7l^!1p7Z0t}~g4^6?8GmI4yLcza6AXGRoG>3(^7%L*VK~)fn
zK%t_-q54HGq#t1FqMeKtv!MYM>%jlTYlbi?u0@6RAppe~v6DIo{yEWsb07!+By|D-
zSL4u>xtfp$Q{6|%1)iGvfTWz-&)BpKz$1_d)5c)^O<VXt21q#V)ggpP87RpgN|Pc`
zQa{u|i67}R52SnW7_1{mK_EE&7-KVHhuY7;0A^eoDxYx`>wjkd&=inX;U?7ZkN(^s
zk=qvp0Dx{Vnfp?(LrP!83m(T1NlWvQ?is3IdY-Xa_m?$b&T=F457nR5fDX&lU;|)R
zc9XF=3xgE^Y>tPqhly1QA$0gKDDW`ukhL`O9>x^Sy}zzee{K`P`JoZd?PaWd<xu@{
zAJWH$(hcQZ$ar9m%KI6cCsJ>Lzj;QaC8UE{^M)fm`~M>CO~9inmOs#QPR~px`y`p{
zflL-cAY`(zLx2!7Lr7pq2;d}y3?UE}k$n?{VP6yk5p!4~AZu6zL`-l;K>^tn6fcN+
z^<GiAUjE{~zF*auFj2YR``-7^NzSjUy1Kf$y1Kg0nG>&ol49U>-Ucc8D_P&HejV_w
zX7t;VG%)wBle?vX`6xK#H3?;z18;g87zm4$HZyT4dRf}6N2Ozc*Lf8zg#v?g-Ui9N
z1`YSh8#EGleiJ{&f6!ulnl(5G4Guox6)^aeBsr6fI9h~7Fa*w2e3~iX90R=0+W@7y
z&LdzZe*AMDm89}X9y)l-r{S~QL#Oqpe5E8+Hd}5h5jZNp^)TR9<&To&qU9I=)5p~T
zpJES2k!uh>&1Q}35b&*LbeQ~s9Ai*Z2Oh`;c4~BLUwWVdpIP1t4?HYM<8|I484uEf
z$=+G=V5%fdNQIN2oGdb-og_^fZwzR{lO_Q-^$;wR(80-ZUU`!(z+>1VXdgl*kH@E3
zg~_NerI`X#z%vzJR%&WsD&Z4elTSS*Nz=SeB~61*O&bm-{7?U;Va%uP_wr9W1bma|
z)PMY*c1x0G6nj=L^k@c5I<wB(qnTSJX;wdP=$%z8Ne@+c1Ia_ff$?InCIuh*Rg&f;
zd-><20@vU5dTGvnNt#yy3pTC)^B};DFOxP2aIcf31p!{X07@;y8;hIh3j=_gEQSs&
zgvAz7#)SXrv&e!EWk`haZ_!Ph!?yEUU~wjJy%7gH#DLFYXtX357aqJM75HHf2FsH9
z_*`v<uS?R>ejbcpOJR|v$C}|2_$xZi()eY$xXaqlJFAw1fB9mvKkCqD`Eq=2dj%~2
z77vjB>RG?L;2m#Zd+bM#4*)*~6F+{)Gh_w0J|anLNf7?0e`|I4<a*_;&BtGF$n+}k
zL<iubZm&~4@v<bX>);)ub!cSWG_T3l&61?`0bU<jk0Dt<-$SSC#geo!z?(&HMA^p0
zUi!x6z$-o4LBWk{Bx#d-xL1KqBPFRW$2(2xa)F0?dqDg2r=q-0_f(uDZNBKmn=eb!
z)~3B48mB${HvFk0wg~XHc9OKSz#9i>YwX_DETPy1lkde%H?9zcYY5y2Cv6h2F95jN
zYPs(-N!mZlYq9+g12;uJRNH@4lAdXb{ZQbU+mdu(zIT=!Sd8`mV7_Nez;LhtpHp6w
z9Xu;ZhnmgnL-~?)<Xew|7F_=*NzY&PTHyKXlGM;7FB8|0*Ko)qpYRc!U^V3jz>P=X
ze@BZw8lm9mAbgrK9Kx{33tPPnys$%(Ud2mi*&<F{!)IO}?{U&KxSk|QCvuH`O%^)=
zh2LzJRlkWkZ#GR^_`sX)m6G)KEbmt9ZJ6-wZ@o_UHhOp_3byq8I}-;y$m_*tAn=^z
z**QhwS|>>t4`~X@CS0S(mpn-<;Y<4^>7907A9KHxiLWXgG6u88!*PuYc!=+AprNCS
zt4#+E5OB3ll0InW10Q@QNgwX;^w@&ydfZ^y@97Zm%|nv(#SZVR`2zGW58ZW2HxA$>
z>8qFT7D!(mlccX-_6S&yYvBK$^3wkcpZNKhw}GEe0RIRJ;eY!4{HrAW(#4B^$&qBg
zt#>Uf`|SXxgopXv03S<oK)~Gw<Ny<}vxx!M6_Ols%G1LrT%VQXFueDa1%Nkfu_T+l
z8If!*mgI2nS|Er2D#;OeU2GG71Qh6_^C;xb1Tac+->Y}0o!s}jBp05&JFVoxi@@H<
zC>MS!$wg+bf<;iOsLsn@v=z8%Cj{9=pGk7rG0bD?F%&L4A;}f<HJ@=)K?Qm+VTZ>D
zERwuxyd<x`>CrG1*S92jL(}2{{te*SP~lZz!*EI7*tFLJePcU(C}Gk5$s0RJ@^<fP
zDQ^e=_K{5QPAu~FG4%0P*bW7@k8g%20eb_By!|NfkLs8W%3k{p)Zdj~pfyF;#gbfK
z?8Ou6C3)gaFRn-9`!0L&0*fRsn58;5Dy_pYnWPGjBny7G`{VbUTh(<Nm86b~B}so%
z$`6|qqRd$;^;se>Ru&1=d{~l~&G*`V8BDoqOcTZlU#j}cQ%XQ%#zEx=S-bqBPMIky
zbvM=jQ+>nm$1#1?%teY$UB6jL)II;}uU$~7t?7@8#jM9|$w(J`xEs*CP)**VjPTpH
z{I;_1M|`fLR+Q<FA90?m?86E7zFGJ<sZhPRMKSp81>;^Y?rmZ`2FAT$+zZCN8lz<^
z825m24;c4cRWr9LE&cX@XAgMxXgrgMrye}@;HmcryEqBL>cLnK#(ItM7%}b!<8CnS
zzN%g%VY|Vz8$7!;9@Ep{*#(|m;MvtAYypJr0^=?)?$Q{C6XQ-W?gZmbjS-O<j61=&
z6O21G#zVxo1B^SsxWgmy7h>E2#vNeX!Hl)rz_%TI+rhWp!}p^JeA}aLi?KTV9@ALT
zL+Pui3w9_;xQQ*vie-MGB-O&Eh3dr@WPM}MPUu;Yd>gsbZK>y^+t|<EM&fl_T5|oi
zv@93pnYWP_;e!yR{kx50h}%fkZcD9jtF!mV_}vfu^KVPJ%Wq>p4GcMydr3H#&s9wa
z6o>MRNqx3Ko^QG>ZN!Jt45H#YG&t~YG#yml7TIPTUWe6dgpl#KCDZWR5+%*VXxe&P
z8f3gJ(Z+~y=@?1UDX848vCDI~jiaA-Tk5jE(RoDaCFJ+iz#s74^%okI7Cp{Na<T|E
zzL%i=Yn_~wk&v8}oRN@_oPnRo2}ub_Nm+>*tum52WMn3Qs{KpMND$F#%cDvgSgPQt
zQl)fn-?;CnLK(kmeqHH~*De;nuH2EoY|MW{8H^jbjT?_EpUB~tWLd8d)8kJ-MH^%*
z@_oHQ98lN1sk|hQR{OoBw8hucXTGJ(2-~JuEIL1ZjJPpZ)+zchgLu03BwqgTp&EWt
zi8n7(tdJ9?k2S~^%YHD*0^cb*iCa83xdoj+8W6SfsIIU0QqDm`Tfz*o&cCVDEZ&nX
zO)~a_Ulw~Be>kc1l+Cb;UT@Y1$g%}Bf=I_)weYmkRX(dOK8-%VpdL7_l)D$=t(f{S
zs%j8F&xN$;L~d@e(!9Cf=gRs312_#Cpqj;hSV2~uWQ(=)ax5Ukimzok#|dd@ZY>lK
z(i=h`-e85!W-x?_Uo_+Sval^-My)%G=BcaSR-(<H$#+d+T>~+`2C+$f`EAA0=BZ|S
zegtiz6ZLXS*7WH=Y5Gr9e@00PTde%aE|Bw!+Wm|Y-wLmiZ8F&3G+(GG4rSbDl+Iy)
zHDQ<-rk*~dIPl;^)LA7%-lP_sRpRh2OrVw~Nzn;(CRpEwuEf{s6K9q5R{xT$DC)*V
zo7`lh)_nah93%(pQ~CM}^<QU|dU<2*c_qHxyYpz=APAgdpG*P+#38p;A0dut^+lab
zb(6$r>IdhP6nP8PYkjqOy<He}utbQD=5dqaX-}1ZG}_NA0}T3gWCeB0WhE*kjC4SI
zVfqNx=HKe^%Sx-T4YHM>1?6}U5gg**>Mxg-6?&uzsA_pniE2w#6|NdcSK<%NRrz{8
zS`5=`<@4R@nJY>{&|k`azJhlreRo%!+WtK}&bCaoy{A<BX{;uL_)b0io-z;b`^<V@
z36~#L`@FAo554X6dW+5suixId?tNvb2zwNUqA3+a6ElXq@ViFkn)10Eb9gTN8I*81
zUVtS-PrA#7czAVV$cM@}*}C&#GCX9>q~9=q3-MP6h!-!oWnC-=<O6lj4W+;PiP<C+
zQzu04n+bo^w@T2<@$8kG6^kwo(*8NuV$u5>5>OZ>>ez|l)o8+yKvOwR-%5M}clL+7
z8ZyCT7LPL%_d)NQ3Mt|yF&Id0m{{LTL`;*6*5Y5yWrT{Y>gtb_a5v%(O`+K}xq7)b
zG-dhAwV4Fv4B~qZOnUK%Vl{A!P)IL+m`h$0BUVuSLV*D#vNrLTdX;0=pFFI~?y~*_
zR{Ezi=o^zhRswzSLbI&Tl>+$<b@u0qUH(*k{d1*UUf&pZQ^^xqr?q(Sr(oK^eq<J>
zn$s-0B+}%By80_+bLwCkXGAv|=Lnd&9ZeX;AO<@*PWf@ELG(}u-%`r5j%k84yJwKy
zV+`UrW=s%9!f2t$Jj;q0>q}C?#0#<-5--B#x76=$DG7K>P2_)+99dNd{YRPJ;Ra2#
zFgO>?SBLpYvH3GhGZgU5^x&oej?rg{E$VOoQD!Cc6xHIr$2se{eyl-&!~*uH8@^WV
z&)x3!wsBR`+Nj6ur#7x4a!?z<-ZlcoKWH9tbPf~S)Xe{4^shB5dYUCR_q-T=kU$2{
zvbM48AaO%tnQVluTqDe5tdAra4sL*<7R)O||HHv!7OU8<nk~NOLBmoYdt50B<$7_4
zBTx)j;Y&Ot?=)WjFP^Rl!@^+JB|~U1Wa*dak`0M!_&3T#`JlSw8^vl0Fl6h)E&6~&
z8Xps4&Z%#db@JiHVRw`|ojj)T=O5rrh{e5sQsyWN=QY0ilhRcupHYAOO(~IIZ7lp<
zxfBqwo2(Spyx&+n-*3$F7w_uiTdLk9y5J3KJxyZl-@-j+yZWL@3~2R-H`-XSN(aLP
zHBdQLfZ#*{ymJ0L)fyrqqgV2>L(P#Pd9n7R8TgG_86uMJ*~F6}!X-baz8)$fpnO26
zXmwAv{7}&vo(Q(Eu7L(|4qg}u=QU9~!q2J?fm35h4B|<zwph+W#DC@yOG~{k=C@k8
zU&I)AS-qxS{a;O)!bEK7a<3Q*<jCR&wMUpJyq9i`8&N@t&9~}BxIPd{`CF}+g>eQs
zM;A!FZ{2t?T+CJORaYGzC7!z{AthR*D0B8VI-<pG`Cc52C9&epy@lT2Qq0ZqMsLkQ
zZDgPT(cNOuG9t4WA?u-OC#T0T$01l!hzt`;@p@Mb$B%03c#(Low$+Mw(N0;oQhg*|
zIKm5Pwl?=MM3>I$f8s@g`x$K(agIlm9@co5C!JaB^O8K_;C-fqiKERYs}`>C-v2jw
zI%lzhhyKoC5a+>we9B6Z>G^pSAj8#F7Ln?n&si1G;0e6!;BTym-`Iuv>jSlA;R_P)
zT{>GD#5yz*DgXbcyZ=8oKm+1cKp#b(EpR;0TtT>f9advSA1XM92>Vn23}OYeXKVOo
z7&7#xrs?sqq~!s~5YR{f(raz4`%;Tf7@sZbKNCbhtWz0@SOYeywnQ<!X9y4RpDY+9
z#>@KP1btLIMm2%@7%GDQ&IXB-)K3#dRsQwntB^Jf2C-e6$f)frt|4clk=e;pHXCJO
zNbtGWo-n*eU7jQotuJVW>{Xgmo%Af3jm;=}If2%>)9TeEF*)oDUbi@9&p{oSuU4%{
z79$gT+%@aH3<AD9^|NHLCDHl+#+Rz@Y$XQ$WxB-ZGsR{#AVrjhMp7u|EQ7j<AT~yw
zoFbAUGTCU&lA;)7uKm@$DgPrB{xd}k|4S=DdWzPATZ@W&5gJdl7HRj46uXtSLJ2!U
z_SP0=+OMI@XVvg_V$wZjt#2o$-&0njB}2@)XQWaOWD0!Wy)igTY}emY=$oCyK+)$o
zEx+E4Wh80xvKy<eK8TV(1ot<ZbLhYzUg1qav_M@86&S=Tjg{TRP+eKH3>+jzlYgTs
zTi>&3^>B`XXb_`8W7aVq)(DRpn!K?z$%w~OYiwg^FVR+Sjl!^*brA+J8ga7~(&Bhw
zw&<fQ$j5xecnb<bgxN|EN{wzDmoLI})~B0g%nAB13({r1u}E()wA1^B8!T4CONNDd
znW}|S?!Lc3g!|mfV(R4qV)?xYjT4JSr+|A>j#h{xLHDG%9}qDi9gz9!vS3nQGJ_B^
zEsQEGBGw{8k;MmufjE$e0V0uzW-&!Q`LH-JZt2}+AARMS4THaeR5?(*G6%*qd*jbv
zwk|NuCGZ7^hB;(TeFVoTq*?b6iDcz9^`p5WI`Uq`An|5n@H`Q&yJrtOFBH+TY*tGa
zi8y(xI$@DGp1y)NOIR(id!c=c-k5+$)<duF(UUeu33|NiS%(Z&P-d%EEf%fJ=dq!{
zhRZC*$a=*Lie8*-+_+f0VZ>rNY?VlnPpOMniDjJ*Oy&grUa~W2cLqECxe?kcy`knm
zCI<T+^K6}tsoNeCS&=XDmZSOd8mCVY$JH+%6CLE^YW!-f)HfSDtrn975~%vMB0J>t
zG^@CU1SU<a!_*Ez2>fcTXesYk{hkoH^4n_B6Cy3(l^HT+O;(FRyrV9BLX46>ZoK(~
z_)PIVhfW*Nwdd3;wIWU4rOK)ZQ~RkR++@-9B6q&-3Afvr)Z#-Ad|Hd}O`93su<UCb
ztBNe+JxAr4Ey7<HmHgNEhZJ?FtdCa{=8ACjU)x2Cj947{VE9MDmpog^XsX27xxc=X
z7%A&%(lRYnB&u0EgjpV{+INVZ5jVA%(Ja2w`H?E`6ye?9V;UX*1RKO2UQT1h`xHv}
z2nQt~$oeo$3r`B!<e#6ZB|BmGjp~@4|07Iq-6;}Uo@{EsAYSx{e@nvbX7MkoAMF$~
zLUSnGXvbh$xlJ9jOO#c#=PqiC9P>MP!1Q`gn93v<YhJH}>6o9Ged#O|^3d5v9-dfn
zn$~!hG*E4^TfA!17FW0yBzcb307N~ON=!tY6JV9ffHX{GHmzB_;ay+pye%2RRZG1n
zY=K=0l+gug=U&=TSW|1mb}y?JA}8){KWQ5QFRE^)Z>&~76^XOJ78;$16}+it&Qa>|
zePV%oD<|d6r-GkB(1x@{)39v$I|rgM?^zA)y_<v;&9i%M;d@BYk|YG54S$zn5dWH|
z9^Wsr|K`Y6F+w#yBU*M_<Q3}a;I9yheMdr*c5DAGm+XB@9sbP!$g`h(MznK({WlNB
zrb?`)92moMcjt3m^EJ(3xKp%`zT2r=_mCoswQfp||2!5y{8^AX?||^_N<#v_`u@)}
z)TBi7t`6V*jl5D_ctEsq|KHyTYfvwnEd#M%d(u)m3)Y<D@#eb!&b9wC@Qb-&_>E^i
zXcOHtA-Mk=?#gguR5jKAA_UqSuwRIm!x4c0iSg2#u}+vNMx(>1g~S-1{g+zn=E-5+
zPQU-Rfu|XC*CupE9q*Z`)Hkt*b8ZA0nvbmL9`)2gQP};Jd$sjCWbru-PG~&G&wIVI
zFb4wQLRZxOhs21I^<IKU^5@MpQN4<K$TyplYyU?6qTyMQ<7;i0y`L6m&tZBf`O8H;
z*{6j#Fq=%~C54KMjpJSvBlYs<>V?<DRQdkK`;LiNk@Ks*X+^Z?eR1p&_ots>v(g|n
z!OWW&bQ4Q#JtX^vqd;6%*Blq|5r-c_&2U2vEO-WEwitg@PABK6Zyv|ebyiI~A(A@M
z%9>!&hf?552#e$+0$kAuU)ISK$)JSTJV&;QJ$j02;^u6ty5oe{CBN8M^rl##$amCp
zCq**eqWjHB(KBcl7JTX+<VNC6$URSq7A<#cWoV0<5m&K3W1CTrQlM+<L#M>g1{|tk
zg;yUwEv)U}(|Qw~P-N)ahM`V~A;b#S{&aUhe2!I^ZxF;%?TzXOr=iP2b-~-Xy@itZ
z8~^*Zm@Y@YG}Gxhx+N!IeZYRYan4yBx+(Z7Z}fRF*!4Nx3c#vp*5mL&kGE3C4d9=x
z^kyVDVzx!!_Lx4dJ6W2ey55lJF?f+a6g8-vPE~O1gwt3LsZ6gA*R@9VZ`4cYMTGxK
zlarbBhN9XFBF3+44j(03MX{QEL2OT?aFU2FVFqBR3<+?_FuDtpV8{vYzXe@BtNwmL
zM0D7T%_6NbQ5MhIt&j4k(DXYTnSW$FYemP_kfjz}6xIZNN3^IE>h<(1Oy7lmflR;X
z3?E;C-F{Kj;3-mEQ$7Bjqz|CqVi95jmzedz9tM0{6og+8V|)!|x)xCJ9X~Lc$&%{u
zOQJFm>x(|#qHjTV$xu&S61@k-iXm2<5x2GIt%er*Fz`p|bHElWN-g?0UVmYRc$Bp0
zq4j};;N(3voqL2s7=3(#zJ-Q}&w}@Fz9Z6Ndds-E(aWMwz+hrPvUn4O5Q4Mcr`{3i
z?gr|C8P0)U@N%<0(GaZnMSh-yD`+T8R$W`f<xw*F5+#0!LB0`7LE`!8vaT(9cV;39
zh%_5&4815!<!I!+CfrtnP;xMRCw4cuu|n=9XnCaYzg))GtKJon$n4*mEUOdW72)pZ
zg5=1|aOT$=dST3>(cc7pz}=sQ3|TfTG%Uo%2;zBa<cDQuczVz)Gb6KyqgOu=!}zv@
zV(6>a=k{2p3xTeCr=j6+e2o<QqPPll7@ln{)ZxtdvOng!AwsWqzAS>fe>e$#r%lu@
zR%qHz-^E}qq!f4?{0y33zZV0=l1=J@%OWD^hq>gq;xXKm3>5!ScU~4&9IjrzEUM#@
zJu{(4cn@A(U~I!^gGJZEAR5$(S8#rLTD@>ZB(=UaxsV-SZ%AtDDmE0j7tn&znzy5%
zH-_<8WAuAMk)xjs$`LIK4b$`%LpoJMe{q8U!ZfSe?R}A*{QSc?7AyTnabN5XCSAXs
zE5j1V*bhU^0Bji6yf0dZAJJ~v#9}&$<3^H$eX)A>eNhx(5(kY|6hOjDYQj~KVmFDG
zjN~{;+$p_y$(@5_BGe+V8O6<*A@HMA6!=;6iLLP)IiS9kLG-hPg+;(H2iW(-yXu;&
zB2)feef_HFBY&s*ejr-;pppK1eY)E30~|8GG*dRys9{UXH!0Wwp<Jez4Sk^b?hmlF
zIMMj-2f{5UeS-OG5?e3?DdH1!Ejs~iZJtZh4Z)kVzoAaQCX%r9V6N)MQVCWAgut)V
z9oNKY_pLDq2U;?0g|#t|yK!_EN&7T?xIVQh&A5eE#d_FsG`4zX!xsL3uz@R8ti=HV
zr?g|RV6*f+T&<?5S|2Srx-|wq)RdAl-(K*g;-m+RA}R-QllL&%-Gf_H`X}yv>ZR)<
zHtg?&XVgEgi?qKIV1$Eej}Ju>2r$*3M7^L+{ZM3EJffiVeFkwPlGf~4adr$MLJP9t
z5%tXvMf_i@gYdli1LTJOMXoHKP}|)Q|M%AlF!#UJ%#TEJ&R;5k@HtzG@7C}@c#^fh
zo9d>z<|7df(SIGHFVv$SiIzowx5}3+dMCN$y~p@}4Bl62!pGdw-O=*+%q_L=$H>ZV
zsR^HmR@l+^`2=Ut&Dte47^e<LKasez^VfFoy5POqMZKrE-Zy`%cUKM1sBC7w|I_&5
znmO;E1{ngks2l%@+bVxI`VRHdKZON^yP`d+?^bo6;x0zB8lJ8{+gSCfctBQGjc+{v
z+5b9p`u;2Nj<Wui`t~i6scf*Qzupox%7)?U$p45l%EoqT*4H9I+1R0R(AOebuWTQ#
zPP`*p;u#%v^&OFrxP83nMIKLEA|zxu&sSs#M-3r*S<)-F<?WNyckYOV%J!q`kZ;97
zWrw8td?&6Mb`^`=I$7=goiMAveuvOEp<X@oJ?;e84{t2|L9~&TiMJc4|0s^g$^wg;
z_OsZeEO@x_)XySBD9aW%Ui(dS67D*D8<zk1;Ai@L89!%9$YJr@Y`~8)yxm9YiVxBM
zLErK0jgJ*?D3jX9O2pn$rvvTTE4XbgN#k@>)D3?`M=Bv1xc75gnV#QNuZHWDaJ?bK
z<nBX1YlsWa@krv2Ku_btu0T+~-DrK_RdAq%j1v6DKiRlI#?yw<vu75_TFVP$1=#ie
zd$LYHcEU7#1xDK0?!MGmFqghhU3umR6}7*wItoR7mdew+NWPJ{oY65KKWi4qvQd)8
z{?d_(@DiOak{{l7C_RR9bZP8wsF2l3@~6t3LB@4J1g;ODU1+~5PAye*wm@hFByU7h
zEo0T4iq6_`zA--xn#m<K_z^sHM%8#JKb*cJdxLbm@Kk;*$;q%A^Ak`iFMydkJ*^sr
zE;T4Fzf~Y;4U!q(4}DhciLzda-D1dEwTfid@ud=i8vA!@#WnN|+-D*^Kn6H{!2|FX
zAL+PIcM4rzuR+~ny+Y_xSqtjJ-)O}wWNw}ZkdVi&c>oDn?x&{cAY^K{IIj@86k(vI
zH)_Q!#A@~c64HB>2au5N1?p}Hk^87$>U7qi{BA8sRt=H1?NC$nAX(M1dXO@^wY*E3
zze3$fqz>v$B0bqH{x0e9r`2QwNL$p=29VZtv)m;;|A@NXpi7qrsFw^nM{)md2^d+q
z&Vsh))O1Uvv8YWY8;ARwZ7tvh`kNrFSZHfWB<@J%Ia@pf>d2JkHVaoGZPU-I6Mb|s
z9Un8<Qc%@EhU~D~)|we;G&-oZR4;d!tqsf3fwFSH`l^pE8h^#*s*f(kJ>HhVe10II
zy-WrH0QG}ySzIXyAmNTJn?bN-H`)5&(r_Hb?q6*MG>dOglbyqCeF@ayA#18o$iP>!
zN7?#Og>SVA{ZVZA)>FaZ&rI|c?}R(*a-%K<FM&E})J1hH7-Z{&p85O+5{%NBTCb&A
zv!AqeVL)~W46t=2&_F$#ov8k5)J4bkw&hUS4U&4Iy{!jx<1NWji%d1sR~MZZYRjdv
znq-u9`oq?nK`VgHzP3E(P623h$#x%r&u^&!KErJJ0LH*}0LCHeqrSTK?nIMqFmyDY
zL>V+0!c|$vMBDu!Xr48wmyI5ZmTCmp>U-GA7?8pz_S(w1jvfHUAIcOTfaf;b=rLi<
zmVrLDVa(<W%Ip@lN~ZYJyG0x>n~O<2VtKaVO!ACa6@y^%vBuT@wo!n-BOyY!+*ZRR
zQnkFwHktwX*nQvI_+et65i=#*Sf;SvdA4y3NbgOFwg&**h@L<v`q}u2;~E3NvTtn<
zG9UHAFVQxE0eM72fNdfJ>P2X&Z4v`N(ysUBARB!%$#+-e$Pv>d+q7shDrpzE$Toxd
z`~l7^vdv^boedagbI)QFNFv5J2-|!TaSgQDiM9nyA`$wRYzrAs2PcfPEn=WhrJ7zQ
z+fqQk&LDMu&$jGtrPx8X<xs+R7gf5v#I}Md)OY(6wnvzvk5pgu*O>+_x2>cRXb6xV
zL@>I7x0bCYk&l8mtiNpyUrPfeJiBUJ%Z&0-Ao(@hIvzOrWuUxzTP<R|U!D9a(ByS$
z%K%-5dt8`p8>;)~Koq9HcGiKqwC-QF9Slgjlub7LSrw13&F^X3#el|a&??(*ZjtnU
zKGjyw4boUVea5zj0nK{TTeiIn$gF<7ZTlDmMdB}f>k{18<p6sGL<Vgls@@(2YS1Rq
z;^KIFG=Y62@%earj8+d|T$nwM0nNY>BkUC2q?%BGH~j1z-fAgm5Bbd=&y;Y0svC9-
zg9w0KwRT#Tq}oV)%~=YrwkI+v8er!IdlHjk0CFbUlNrPT)b6xXEDU<7B|zdvduy)K
z6X47hdn$uo0HVN7-|?1easl>K+S3^H23Yd7y&XW%nLL1`9d^94ihR5;klz}+l^ZGq
zNEmO|VrD;pQ5Wo5%ya<k7-Xj~8FZ}}z<<6SuT_Iy!vR)*V8^>w(dr0*!I$ivm{JX}
ztHj=!DWd@N-R)f%)BwcIv3GUzqA?oin8n_WNfQB{FSmCm2@R6~24&iNFl8D*-6DHW
z2Gaq$?XvgchGqcl-f7Qe$}E7ME$zJ-JOmK4$)3kxHb7Z~{XPbB00z0&+Vg>YetQ^b
z^lNq-gZTjWm)dC^kZKnLJlxJ+z+frB8>{Vj8z=g@9AMZx_Cltt0LU9|FJcPKj%SSa
zehgLu%zDAzpTR1CXKU>a29HsUJ2TThfYEA@s)Fpr4Aua=_@=#t!Q%k+&)NqvptUgi
zL3=5KCx~**PGQ>Tw{-xnUG^aWL0_#0*tONJ#p#Uzff05sPLrqi`nSD|OkYq}2Q=&p
zI|u599RLfK*|peQ576m8`!EuBW)Hyqf7mN|ybb|$-fMSpt49I41gIG%-CXy(ax42|
zC=I5*tXOELP@%2$o&K;>tO#CBbGp@H`{OJq5n#E^zLweA5-71h!5|HwFv7kLKwFgR
z7ujn`z?Kf6lvLX{gaI5Rzpj78UPqMIs?@X)U2k``B%K_QX+gm8&p{O2zt<S;54wqB
zM)tSS0U(%g0EbaM935Z*2-Ha(QU6-7=ZDFNYVW+Iiw>r0>EMhV6m8O~5vM5>bjwUj
zo)6KlM~)a-Bjp*{3n11loqj*h7Zh!I+<z#~4;gXrHHuON9rGyJHC?AzRKGVbh%1=@
zOci-Slq=Ly7^!$CFPJH2fb-@&s0(QnIqC=JnK-401lV~!FN7(y`0IYk3uWM@F!D-a
z9;d^-;w1FSlnt9i`{qUB?QEt{T#xh3iwc0uUg*f+DsvvipO6C7bDYfM@Y6u{*>y9I
z!w+X4(5V&a)Ij0TJv1+c0rg{WMP6$N3#l@(anvtDb)oL7c#axn{n6Nlk$n;|SaL}n
zHXcihP!iWQ)ff-z6kIRC7lzw-u4jLlY9h57LaDzftbat7z%xfG2*Xz`Lh5jR^235K
zbR*;##7i|Ka_rOSMbv&B-dBh6e?z1EQ|^Lpv;k<qh{L_}`*uYYzy09Lxsq9!3BFMB
z(925-v)E?T+v>}O*$l`-9}6#R4<(YqC=094E96MW8CP3VVMp#d8U66{g`Kz#1?W~E
z72>skP^twv!HM>T-H5N2!u2#)VRsg10XVJ}YVj;Ja{TlOQeh7hRcb@V3;71>zUtGr
z8=NF`D;e+`==|~)OHmjkhf(03yspU1?UT+I9w_2rt|jMMv9KtDTSTJbmi!z=k*p1k
z*OI|SQ4A<K3I3{x7B;DtR>xf*7V*N?KqJ}rR#7a=CXcK<R}_aj>N;}5ggZsrDi;s1
zBB!V&rmwogLe|~f*tZxP!Y~Ka4c!TKLsq5sbF;qhfqC+}eylI&&<S_?vA&!`Z#dbH
z^lkG8DOEqXUnDhM6AVz6-;dT|se$xp+o>O`+dz7Zc%vVydxNaMDy1K*TSHc@JlBsF
z<rb?GNGbP#Px}tEK&yX3tFTg(<ecbR%D#o`*ZcGxMAx;@HlRMfKZOVLaR`~bu73bG
zOvX*P(?5`nM#gR1secdyN(oET`cr6-I3=9?OMh*CQc8GgNdFKL;I1XJH@x0oo0DYe
z%7Ff46nhNidg{ggW<Pv+eiij_nY({Di=#wgt=eB3MVjtDC;PKi8mPMmCiQ2l)RME+
z7xs_lIxVTY<!|&YPeLCqP;dW0!QlG(z7L{z=8sWg{syjP{#e^|kJAzO5<G8)_I(hu
z(EKs3yZiNBP8PX=>j_u-F2{7?>%%Aeu4pQMZnAnhLKjEzwQ6hMM-Ya>@5A-P8GSc5
z8FtLozI!Z`hNC<owC`0a@AU!ZXvp_{{}D%7uMEn$Nqw);H>YZF-Figdub3;8^n}R0
znDWptd~+2zO8Uxv2p!>j3G@MI3Dbt}wd)+TUyo=#fVTCHSl-VENkH?bIpP?}K|reN
zXrZBCphE?YmKrhv*`IL4YbXS$Z6}9?QBbI~3HoMU(mA4o(S*Z^-cEBQ;IJY5G_Er*
zxgDMeS%9y0f8a>Q!AnGIXdK~yy~78Z9F(O+yo51o(b}OUY2;0-9S$u?qwq4g(ZM^`
zZ4_Qsz2Im|K68@%?1`ToY3zaIKc`hkI|c!i&d*$(<H*390i;MLXhjDdoS5-GLjJ<R
zo7rt7LjKmlo7ruM1Jaal9PLTOHj+2xcLxWuZRC$_CptKgZKIjrcBX?<wr#Yxy3o@>
z`_V`zIj7IF4&INR%mmn6<ml?p8qq3j-KgG*(zS5^V02LC6}1wE9QC7v_nQqe4aeLM
z9K7LdkYz%n9JJ$<8e|1%-v<ubasmmUz?lx4hIByjog8)z>46>(ad0ZuARB-d{^8(U
ztU>kxy7-*K-B)8Z0zS6h!Rc6o><e_R&QYY%{D2DkIB27e2K|8o?>PEvC;({VDThNt
zfk4wvI|gWoylCZTj$#dw7mX@*lxT>&=wOIrAe*#74tZ3bR5em6r51u{702ieVon{6
z-tGpYgOahR^B_%mOzj?{i*`3UIPa<@Hvs!k4?E@pEq_rrunb5Um>94@d!vIk#?dsW
z7<=9p^VnNAI);0jdFx7mV<ho)2j37s$0#B(A1c)_ARj?vqkX0RP}NA%*DWzRXp<W~
znR@u6<3ScEOInvEP?zG#Z&7Wcx2@wp>l{<4)=DO+mRLALV7}vFl*N>4?a#g2K74c@
zfhHeyGw}H6d<GsLUBJNOqYD{$d~^{5^3hj*bSx%tl6*AjRmTzrW=g1wjyRSwqM+I1
zIR|ZfgI=Pbx%i@EIZ+yN0ARNj400vA(LtNsSieW*S<)(E2td~#k{;vBfJfyqv!&H^
z?Gpw2xE^+_;fiuRP^TG=$2DXD8tp#f@N9z<0Dapyp3sPiK<49)bs9<n3Vy-yq=u4#
zIv#V>YN(ZFbd}l*P626fgkwFEL`NWJiem#KV;89a*?OU4BO*{tDI!p;pBd31w%;)a
z<-;v#Z+Ur%<0)MG{6-<D?p?=b014lvfalsATNu!S*1_o53J~-a4Ts-i$J1z`g`0*$
zKiILIn<G1CTzBkXKud8=f@3EGGV`Kkj$I7gWar&C9QA~1X<<(K*|CQ~BEXIh9K0EC
zNCxnI!NHsHhE#xU=N$W4LOXz0CpZo;prC_bd5{HA%u%0q9AdRQ5qQe+ECV{=aD3%B
zOwm!Q=>l}-q~ke|TCDC0@J5;A2#cd}e`mj=fk7_7urNm>gM5GyA&#RA3IJaF$?*b%
zegNCXJ6>c^4B(&bc!|LvfW<|Qml;q@&dzYSUtv@M6nVw*DudwwBG~a7gOLE10LL)~
zV*rAGcD&ADJizEyjyD)giX1gzq~tixU>YdfZ#dorXyKj(P(9mmk}2~68pb$IF<1;R
ztndxTX-3O|))zY7X0Q^V<vhn325SI<CpgYBSO@TSSI0R9>j7q8b)08V2e9AYae={B
zfKw@ISiG)>yRFG_8MbXn#|`Rtjw{5#XP3hUI^JVI@odos$NM}uI)F_-I<7L{6ScvP
z4;YZQogDA@2Lno<d`cbHxH%)$`Py-vDFFbFyBr@f2viUqpE5XZ00n&&MA7SoZ`4oX
z5lz2we2QeD<!F;c0dxi~XRgFrjtB}ScZ11s6LngC3~5nyjxV?!2>>(dO9C928lQH2
z#qE%8+uJ*CF(BQHPdNU=Y^0lUqvLA^6r~Uq{|n%zuz{8aR2m)Mpjtf5YXs9f#Hg)@
zISGz$HH5c;(`xY@ky?7f|MyJd)x!R?(eV?>An!vM|CvY}#?ja>9==YJwB@YP!SDQv
zf6kG`t;w?1faJijXlsY8Xix^k8Y>G8Du6i&YMTV)bE-o&cqLv8GdpD3zFKmT5WyU>
zADch|f<0u)m8BXPsNHmj96%MfDTL-Y<UmF`AQ(#yVq_q+(IE#j!pkMdF=P`XKcG$S
zA00C1%-aG0(LFhohz%wQ{R_6Df0P_s9sm)BkR$LLmhiAf5^B&9>%7@ujUm?K=p5`W
z$FdxmEHUhyL*_F(WFmmWvm9~@jjE{kC1SsdX5*2NTaN3bU}^vYpZNp=X=iM?gI19G
z$Vtr6)ONCmAFN$gfR%E+1j;Z;%~X<pSIstF)@U<W+YzhNqh>l-)ys*x2vQ=$%h_jR
zfJ4qE&c`7%ZL~w?Opb*<aM2-m;0}<r$!Hz9qLD1|^lCIg=WGctd$j5LCvCcU+CWl$
zKF%Tc#_>dKET&9H^OvY|1qnDPMX*>NswbQVc;bvhzK;R?d(8(rL3@ux^8LXT>gFU}
zdizR2@6b#5FWqlEe54&B*+XKyx8xAi>W~y5<dsx$8AMG`)!&nJU4p(U4CiwXnu#sf
ztNF>g)Q%rV6_T4__YKR07Y5MYzmgb?V+sSqX=_X|rLeqE+mg|QoU&YfI$0Oye#KbW
zhN=!mS@ycZw$yQsO}&0EOk+Tkt)NX|I|jN)nuUcl1X8Vmwo;=^g%g@KCsS7zPM{Qw
zHY#dR;Y4gyLXN=#hgU}pFj6c3g{%&%2hhuS<q}fR-9a7T$A~oSm@&YgfiZIIl*!Tn
zo-H*L&N>Vqz>}pW5TMa9fagjLB{mtC2k=zsMGJ1?qXYQd>AIN$OU^r82GABVIT@t7
z!voAH3;BkcJ@CqaaO}a8lcQ<Dyx4z01lXjS4&=*84}opTD)me&gvf=(+Q}3pbA{!_
z+SDeCy!=D4HnZuJ%sso<yYn?i7khWU>1oB@ov*2)*t_!`*QGd=8>P`0^-(b?D%H@|
z{?%c{^imqB#!s<f;~G}1ZFXrJ?AN<kJES0+_{=TV4k^ecBgYhL`&+U}N<}eEZ0&Gh
z<OH=oMc1OH(OgW&>#e4OA@R{-I`1=Gm)Ow72{fLZ=Byf7oXGCOD@v#0B%<(P$GG{$
z+Ub@F_xy^}u%B%8EJO{_7q^3Z;^+vVtxipAt&46`Q=GwN9N$;GF~6ARdaFB;HDjkr
z#i_Vol8ko{z^&$~4}!gPS8*oxi>>a=r-i81RCGXi7osi)EyW#BJ!K$j%&95nO&GU!
zW?OM5R*!rKdeA0JJ8y#?AGFrBb<dQg;vA~`Z))vIF`Xl&{F|DFz35!r=Qql~+WHmu
zBFgs`qD&~J-C1h`rB6%t6w|qQ%J;cMnO02a;y%AoBC};+F`bJW11XW&X(*;+@zxQ;
ziEVZ<9gDY4*{Uu~)eUO1!B|{eKm{*=Sa-O%FD$RQVdMwJg)m0z7sv}|7OQ`x>e|Q7
zD;_{|s39L^liw;X21DYq0)R-D+P@8M!OXXm=pZh29Lk=ZTf%D*pB9}gEAhE&f*vPI
zjCaQ_FrdVjKrKy@*@-2ZAJe9*KCeXcV~QP(ua@wX<D;V&50_|89R<q9=_Q&|M=Ll2
zsr{vd=Ugq_blJ7Hgjc7AIGS_zXVrkVx>iBo4b<F`8ieA#+Uh#HyN@4ef#PklP_}c<
zKz2GF$g=W*iL5IP<d(95>~wr0)cL)E$*4ke0RyNEY{h`4!rt`*>ENJsN`N$i;+H;N
z$FX!jp(;Fa4kX5PfJ23DMVolwLjA6-F4(<TpMdz;rav)1dyAMK)F<NEFQA)q5w=d~
z<!y)p`kP#I6<rEwWhx~bwfO_h7M7O=uny!zb81R86UmX|M^s6r9F-a<JiNKG)I0B|
zEH7mX)gmntQYSxkX&QWUnyHlLa@!J3sy3B9QZ?IA(0OxyDNSYkc^QtprLn9C-zI(i
zJ7Z}}l0f%t>hntD*@PtFMEg>UW=|TDv6oDxH2>OO(OS}uRnk38QS?WC0#e5#rCRu>
z4z%r5n#L3wl8#r@igr+WerPG31*eTcS?2$hde4GQXG&?|)#Sh`?HQ1q32Ldf?oymw
zccru=Qz$=tCAL(Xy~fC@snt?xXQohK8&h0LtFgqvzH{qRUX2@qq~YjHX<TwC&DFFU
zk&{MFlS*l-YIjTyKVPcd!t(TmrfSevqyw7OZeeMCDW$2}Vl`#f^?OTgSlrWYP_#Sv
zvN|eVS2$p`skA>h+Ra26hTCzs1$1lx18Tw8SX#`0T4=YmR6FFLUShZh@?@i4Vzhrx
z*TuN&V@vM`dwK%O#{OTa6W1+P(-2G^Us}d;sA__-ln*%g4gy-xo&X@_Fdh}m<{Mf4
z(0HkI7z?0TF*~uek}0$d6wNPnF@=_aZh57{8H6ZZk>BqwtzxyzAPr3^9l@lC$SIQ^
zluE0a5-k;AhxS|PgO~v6>GUIej(X9mi+4YJ0!z_z_#;)AJE2>7Y8)GZ%XJ-MLm0h`
ziAHBI>5D0NWduu@OAnX_$&GmEDSaBV>_<+s?<sskIg}*dzycBfr9lqkmMKS!=wXn}
zj3_@&sW8aljC8qG>Vymgz7YmF5_|Xb8zk=VDYUQ$&#q2|O6e*W9Yc}zGlM+CTXYmY
z)9L)m!9M7%bu4<G{q0~Q5;*GwGJedJ!M+%O>s0cL6$=OZQG*SO0gk*r*dOblwQf0`
zu3B3|Wi=>M7b?$D6EdNTe=faeTdL)r?S*mP9h#fXc@UTELCNuxx$V6r^(aYIbLsCU
z$#u-L6(x!Bxw&4RI+WO#=l1rNY(mK^HMx1-l8q<{{JbRhK5x+m6csk)=6g%lV>#Vx
z&b7l1#y}XQ%TKxZ10#1wVmXTZSLQ0I-Wp5P&@5eBIa%$IrEBSaI9H(u>oTZgp~;CY
z=>a-^H165Os2VvVQSPB9OL0HugXyioLn5f87neMYk`;4@q<Twcp(N#zA*tjX8qYM8
zJoUzq=e(k)pyYwVA<wnsLkSi%8LcI(8X_CKT$9MrY7u|NvZMV$59BGX`~6XzS%&Kq
zixVPfWEvnXEW}u-zuV$?xWaRNEE$y1Wl^Ga;eiZZ2zd=!xjBOuLYjJ=rJ*}BILvck
z$bBV)!#v;5>i9_puY`PyVf}>+4)cpBi<ncRuF1w!k1=ILBa6+VM-5UcGGf@L$lKa>
z%Fwo0<ZWHu8N9*5z8sV8v6ze&aKtR%Y)t6e8S&f$T)(<M!$Q||pCS0Ij0C#wg=_2b
zjO+;T&-OfdcyR=BiW<w90KKqbB^xtN=k!I-vkp6PcW<GS?x<#m;d<!-r$6phWY438
zVRwJCGZDtfreLw_duI|Pf&%dT9d$x`U9^3=GX*XZQb|$y@)9SlB2o=4>FdrpwPhrP
zrbpIcOpmO?5b0QfH$IZcheo4h4avH^L_ODD7nPdj^sb0K{&0FT;eZe)?`L_zUwT~)
z?4XNu4~cV9PM-Z!<e2FrBxfX4Yd?p?&AjT2Vm---9c<2MHZO(9w@*7`lEC&oX*=gz
zXKV@>=8?8<-RERm_oC2;wp(yND6hFc%SlV9R1-}GDfUfv(pIzm9CzfzNs==ileNQ}
z)as0BPAh@8sZ|&>0|zJBVbp5CDrY9DhMb{R_q&~0tPiyc<@mk=XH)a0IC(e9ZZj&&
zsV$1+HuIi#YALOSb|2Y4L73@Xx36<ADe^rSx_#y3V?TZdu&%#zKefOs_Rw<Y0Rns;
zo_54}kSU~MO`7u%16t*_ed2tU0iDtGE_EJeK&w+$w(~g#MrynLe6+pyd0%G(y-v8p
zJTRbbKJRO4o6q~W?W2!6`G}974cq>_^Cgx;i&&<glaKg#Ke6I7C!g@~qhULCIr)T-
z?*kfEI{AdJh7>vVq?1qhYBWWD=?_hELrl)DFhYkn!SLvDXE(TFhfirV=6>Mp&Vag_
zHq@EJfJUR|QD+a#kq$ovP=`7!B8x7XqdwS4m+g)+I_E-M$Nu1(Hr_c8*IMS#{tu^{
z0j=u~{_5nzb+&1rNzMh-FTP(~bJEF&>)7|g=R5ok6`hr#&c{%-6Wx4-tyZ%UNJWg(
z8U`dY)9zgB3zKRC)pvyR2_}*D*+-r07|=kCf7JOT0~)A;YtC8*WS>4)ohkvIBb%z7
ze89~&qzjijH!y|#&l&98$aQE&_v_@`#DH!Q7Y%Vc>ll%1j(XYo6oU|Q`-n|G&g0aJ
zDIlR2Cz#~v1s$Sl-d6mflMhjO#NkGKh{{hfE~s+y87iA;&Iiu7xsHKkZ^|;4(M0Za
zo{rbg%`MaRuOz%<eVLZ@l8GkGDC3#TW*>31OpBUip+lB3Eo##EK6_u87BzWix%AWg
zvLp!aTnSS0m@;jDO0r)aUDk?};6!TSoU#;O>3$#*@yH`(t(imyi~YWgPoDVBc}nZD
zHcX)~vG0>I&W3ryR-P-P!;sFEG-0c5mGNOnLoUG9OX@dWbnV<1^2;dK!Z+P8rr(xv
zrp4>ZtY^wb+|^{(b7h=qu_ET&vXOTc$-Z4y!+?fo(z|7&8IU5&b!B51L`9C6UL%!_
z1?ZwDMGl-P8^<6MC;MG>F>RjD%`JPBw5TC1ZkMg(dZZF0u3|tIU9M9<?y8G!ai)x1
zw2R(Ck1BRkOj6l1RCys-X1}9GbVDLg8&^&P)|LGG+}!dglEJZ{V|_V~7srB0Gs=0q
zc<>I~F88i-2YxB%@!}32G?Z(Hh-CRgmU4ddk1gNETCVM0sKbU)<=XBgN^--4_P5F@
zZ%aBn2U_x&az2$})4n>oTpI}LRKk>UK9%B@pq&+}ws2ERX))y)+;<Y5G^;$50Y(3k
zKIK}tCTn&)QcmGIWuOJ%Ouupp*Epii1bSv^xfZWG0K9#=T#MIT$iEM?H<eS6>iQi>
zTQ8M&W8q}-?I+8-Ga&71lgo1$kOxA$9t_xt*FU8zr;STD8u`)hmgi{_NcdLw2}^kq
z(UyYtR&04cjRxR%yu3dHl0JTMxr2d6`Tz#h_xqnLFJ?f(4-}S{Fd##$4=d+g3j6oy
zz2&7$;XQm&t)-ltx!V<YWc9RJcqSOM7H;ZP(A09xo2jKO0p*%EQ%h|-m22KiEun{_
zP$zmNpTkw}H<phjdGzr1n8D@bwAy)*>DTfH81Nzf*aepIiQwy=9XWE;c>JvgU-e)P
zj(O|Lr+}$Dc9@}DQR<$@xu2eFG<lz?d<IootO=jlT=*<aI4GUpD}RUqDV|bMKAQm#
zz^WUja#{?!zokiVH<y650D+ss$clyKycjfj7%v9eEsTfX_Zdp3c{zy?(XDi77>V$#
znL~L`!}H`s_)y-`a0Gqn)X)fGtEDyb(5a!3T!)r{iol`TMB@m0$~{##l(LeXLeLIG
z4`ny6rO|lk$D!or^gRq%V%#ZH1sxUUtR#W86)c@6O2@4gES<Y?Xj%nJ=WfjKtKeyj
zZeUHzDTJ6Mex?dKX32S16O*DvA8OCura}vy<aBE+6<X*diw^5mp@mL<?76g5mMUnM
z-h<*s-R+88<hDH`cveiT=nWt>%m-z|D;0SRXzVJ_se60s(%rwTsj#DJ&k-oAA6(Ig
z8K`PXMMVJvYJK+6ioOh}^_uAwg$&3M+ka6}#DE;pcA%mk19JINXN7|S&3$v{iUAC0
z?jKF4C}v=x8{&l>D@qt8gA^HFF_1wjK#8@YltDXy<$EgzF~|hy)45^@0}2r_gDdW5
z&;?-QhZRl+IRJ5K6=e)^0hEs_${FMXgiWugAmDB&AmpwX#-x4#ozGWPGAIUU-=e|=
z&~wC~rrFSQ3eSchisIqbCTUn-GT&q1o&C<RLik6Qh5SfF#B-)$6Nq#Xq$i#pHj!M1
z{iE}H!zM9+WxHT`7&e&^nf9>*!=`9k0CKUAM&q#QB;rR+#EiQlTK-F2nX79(^a)>?
zZjJN`r2X6Cx;Ajj-oEmCyq`gl7)QzS$~%@eloa%u9XWmK2&qjZYGfUzF<v#Y4LfHo
zjn|?-+C+yF7mZgpA2q1AF0y8STpLQ?d%Y7md5qMiC8YJdNHt&U(I%dl-yyAyC2cGK
z*-_*WkeNVw){>YL@oi|!Bh|!Eg4px1cDTphrHvCe13E0?EvFL_cP6Nh_SQuYTI3gl
zjZ<!jnRt720%h`%c7D`+?&Qc(BPBm-J_mm)om%vx=Ch+r06P}>S-2wkR{D9r1h$|B
z0JmL!?5&F*bjq*H+hhTxtokz9pC)ha`)m^bh`T1))X6`RguPED*|Eq!iokX1%d~6$
zWS`tmsF~hb>H~SYxR^;5{-j{<4rCvHQn2$}3G~-`s88qNj>dU^3u{A;Wi0VeV5N(x
zgI&U54BPAe$uwBBNf+bVp(No~{|CLgcEPrKeYsCC)XSd72J3(l+k-wPZwU>tKHKO+
zXMMdJ(9X~>pH8@@hzNm|=X|uYKFa%sf8j%CeRQ^pT7#wvA6j{Oe-6_A7V4<`@U@z$
zKD(h&@6WNhKWFecitC_jcB9XC7}LC5P5SrPZ)@?^XPwUv3_QZ|E^-z=&gk<kHpF>D
zaYmIFjGb`$d7qzg%!KbMp<PFm(dQ1@&6|jAYhErogo#+=^BZ<~dF_XCH&elO?D5=m
zx=)jL9L?4pPWRqWy3{T`oOh*}pp;Hj3-fUh5EP$IzIGo4i(zs)pK9}b+xLCCma0-D
zYyD2Tma3BDcD$2Lr`i(V^cp)gUE6Wf$=-{p>DrE)Qu_%J>2z+JK8?T4GxStox|JH5
z0Mg3$(zR?yiU%61PuJ2NYH825bS>SXmeOphV$&tYowKIFACTckPOBO%S=$l7dQyPX
znRnG(o6elN%$ms@<VEYcS+g{DfYZaQ+L0F>fhNpRAGYaI;(J*;fgwLQj>8kIogeSH
zmjjXML)6zHvSXQ*HgnpI#?J3qX)~ui{aty^N}IW$GqfnGW!4_dM#r49-c<eUcwWkG
z?S-=ZG`q0&h6m)6e;wRw<rA`6QZX#ws-2B-C;I$irE{_Twe|q39sD+8>20z0A;G*t
zqsamW<T0b-tbGa8D*UXmwGhCF=iQ<Ef|smC{#YgR-x$}@Ism?8v%`%F%dN#YP|1(S
z_1^W?61rZB>md&7KwR4-To)+nHM_3O(EirJ5NET)lRC~Uu+n+3?J63rJ8Y$>qumpl
zG0j@WCk^CDkY3JiMXL%7Rc@ha*99Pcy|ugz0a{hM6{@a2x|q~AO#yE}sGV-h6qX0j
zo=)py$NGR1OrSot?W8{42WNf$>RD8BFEj?6BN~0#qiv^v^DvUODpZ~exWIsX=dp_c
z7ZED#vpET~x5ecno^c(4WoLND&e1$gXi9Xb_v=_lBF{xukC`fUEJA2V!t1P&+FLsI
zW2MLg&n)VQb9Qx90ix1@j!u$(j$|Bq5wmZ}$c}H^J@h+7r?^9o1_W+E<v#mR_vIe~
zH?km->eoAP69ej<dv+i_&84}MIXdtu2INlZX@Q#=P=8Dnfm;|*!d2)l58TR#Hs1AN
zf!i3+#@lCZ;C2S2@whI5I~dUE;i!)ScQPRFe05mhE(ZSeK*7oHjDa%6u|Dr1#Hitc
zGG)-PD$tbWfwE^qC}99~Jp=JJKsp<s!&EUY6}Ac~K+T_`P?n)kTGr<aFupW0P~5@s
zR-d29MvI5TB5Bo8m2^s3V21{o&dNY)gzp5dSXddvfV956q%xQQo)Cd>`hsS`K<#@1
zGm9!C;cEqUTQ(G1RC)J14zJ|qW@nIO?UrRWpKyI6MNX<7D`jUvGt+f)&s8I{Y0D%v
zkb53i)!agS2X#tr`yQy;mzu6S+`gyg*<7_f{o%u=s_k=|S6yAGYdz*GDH8|B-^%#e
z?H>w$#@rV8*?ou(Kj)m)<LBnz4ft7V^1;u_BSy&{mqweSzA9QflafZ?Ce^(6l{;w;
z6QZkuM!Vo_+5o1|>YSXTwk*;m1+7gRbeH?Uo9cifU3AddwEMY?mRIo2DAM%^oRc;X
z)3$Fv%;eBz>aikSlsmUe8g2Rtzm2SZaHN#h4cFR4+c_t#I|FjXSs$g*&1cOO<r8US
z7VT@F@<(Zu9^;lfhncio2IPu?tJ1W)SmcTR4QY8yAy3?VB`u#VW>g9=_MfKN7*U2Z
zrzWir0lvLE`gmFa1G>HYa{IKt%x1>IR_GgrTlZ<zh+Rdr{A0wn^wXu}?@Sww$*0}_
zU)L>d41jifY{kN~u|&CHq}($0F`Y4uyt;@^2&ODgtD^Oj7qo;b)we%x5WbX~MjN=I
zufb4vIBk+P_5d0E(k90fL35il+R$lk^Zcu6Q(0Y#YRA>IY24v%nq4T@lxn(Dc2d|G
z!j9;2vuG9Um&XlcwQ1&DS#2pZYVxiu?U=yhn5X;eV%-z7G7(XHe&hSZhmN3X;x|!Q
z9U;3vEwGP9WOYVvp^al^PF5ENG>#Adkkyp|t#jiyWp!gfA*JJwS=||slMUROmBWC>
zG56anI*8Q1^3bVYR!^SeeAYQXBdZsYcmvjAQC2R2S{ldNw5;9?XpIjk&&p#q@>ykf
z)_n}jQajQ+D<8LK`VHZ5S%;o1xoFOEz%cz!gBd*;K+L?np(n)*+|-rFMHc-bO3fwF
zm4OUAUE%M0@To1j!e98{Q(JUpFtd?MqANofkV~Q`_Y>frKzSzt?#Z0&tTG1Flkvy1
z$^&>CZK7n$Z$xI+FicIyD$p7q&Z=a2Qe@ursZy4Ufye5@8F;K-#eh^jR-8400a^XR
z)U0X-Wc9Oyvqm!Ts5**)rmFh!04y|fvc^zZgE{iP{5&aZEI|4+n(gbp${NR%RDeg{
z&U%1BJ6ieQT%R=_8F2s8P=38+%%Z>L?sy$+FSpLpc1pAgEgzPpc{OJXDI>F{qK;$3
zK|E3E{?#Jmsg?nu$Ry}C(Zj{MRQZUyvsh>K+Y^u}&j#(uf2bb<%b%(NC2-d9E_o3}
zqRv)Y0S07mgqQ)@*YNW#EPO_nycDBdG6OSk(gK&f98QeKHi5d{a><V{q6gjjEqBQ)
z8PS7;7lydxRgCD#LGw2*c{L*wkZYMsUSoiiUS^<`?u{<_aln!pQGhS@a>;9%HJOOp
zUGft|TbfE}vrEQ_xKvV`TTI{Xb;%nD?NTJb@B)`y2PpLt#en-FUGh^J90WN2Q<uD1
zgHFJ(7?-?-TM-p*;MKca@^;{o1~D9P_}4CZhen<c7@6RbcWH1j;GoxCa=ixWFCtD|
z=aTnma3$c$oi6zq4Xy#4u-hdc&>CI`SlrVkAJnMp0mW&TJo1o+>kh%<8&l-x$ogU{
zA>Hfp5k?mYEl-r6C#0k9p2Scbh1`<2beSaRpDy_&$SHZxK-5Rk%*!m+paay!sK!#=
zYWMfaF8M45bKoLab9yV6e9na3@N62)**ceeo)HbEe9<LeU_^sC`$w02kr55%+ANoR
zi4hIv{uM6y9Y!>mIm2A?yNqZo7sxL8G9&up&)HD7OTNO;LYYhJ5Hxue+LT7)Y0IQe
zF8M<QnylG6dMI>Byi2~JK^<VgOD_2%hQbIK(aj})%uw+MJdY9hgrOV=cyf+Q{-;I_
z0(|Lbm;5P1w=e;ZaJl5q82g0*KHtG5|BIn$L26AXhFUjCt;a!C9&yQEU~85&JAl-h
zj^6%96CD6p-Pt97%}}P6j7MDZe>E5k*ak}9)+AHAx`)yK|6{DDhNo|G$=@(EMp45>
z|Cr^HzeB@=^I@&7@3>^zU23CK_^nI+F@gq;Mn}2nl7C_vjn0-{F8OChG&*O}UGguC
zXmp-M-+yI9qvH-g<C1@8NW-%mGxiS_O2boWcPaS8a%j*3q<-a6=x+~Z&8BHMx7MX7
zjA$Bmea)o^M)Wk^1z(q<XOs!_Sei>QAa<2TcK~WV$EEl%tqV|wd$LQxU#Nr79AX{e
zQt0W-tl7Ch8^^j7dO9;}Hue6}ahF1mXJ*YV07`h>rQk380rdlFdETW2GAafd67N!i
z84Ut5C%6<7H}3@69OF_#m{tK4Ki=(9LKzMRjQNL431c)8D7CvwF*6zi)cbdr63%Em
z&@*qjln6$XfF7!MDUpn(NfdCO+FPt3`VOIQx~*C4QsR*K;sJLcOfaPd1=bmI?$k+D
zl1nw+uM0?D;!@(dRKN*Jps<A}s?Gv<ahOX<U>KGRc(9Aw_kLa5cAH#ED>Nz1pr^7C
z_mmVy<ogMCTnargB4wC{17gFq<$j!OUe~#lbokPcDX0-T-Gx6P(xg_%GMAFUh@KP=
znc`A18PSt4ONC3xVuXjs;4n8$E`=V59P$E)@_R0YQW!1zC%IfoCrxwE+<`8oa|<x0
zkxRPnmt9I1h5;n!(!KzfGKl1S1L_1cG8m0$t{s2Ur3_(2u01BzrQFYmAD7;A)aX)b
zQ1Sk@AYwV&=G1j9xNUJMlc;bM3NsG7l*!1(hI~UdUwg!*Oo3Jd61jfvzfhl!?C)Qb
zJBEfpnR&P2^BdKqGTjU2>oUEf$fdlYbq(tFZLi)g(}m+jeui>gr(Q>0%G*qnEyY+m
z2D+3p8cYT>m%5a*8cYS;1wrSq8F%7Aa_K3!$MG@hoN`?kH-ucK{I<1{>k)EAg9RQT
z@39c2*dye97NQKI<DtO;L2Z#pYtO(OS`Ys|*WMCLPFOZOa*PyA$C#1WG8BN&AvhW_
zrK}1}M}l%q<hNy8BFCuNLv<~qgH2IHT#7AN(D32DnERMuIBC48jvcB?bw9Iy1cX$!
zq*uG&R-ReY4!2b-@j=kUI)O`Yk45S@dQJQoShSp;IeAyakA)O#YsyN}&&Q9$?j@vh
zC8b_dK98$15+A+bVDh>uU(URVZ^gnYeilZ%xqGLIo`v!GO(^&RY2~>p+GUn+q&%u!
zOcif4`7m|ald81>XENuas_0m3Xq6_FZ+P&&pnh)^-|*lY!={QV?S=;>XB%Brd`qI1
zwuuLKR%xfcw3RODQ56kg+7Vd!jj9+1l%WqASH*W0YbmKLtF7WYi`es&VrW-X@vTLE
z9l+%!RV}#^otSRiR~65IzATKc@U6w#2(rfh2P{=|`?#VABv?Z`lOt=?4^~?Y(?yRR
zRmJx^YDwdczgN-Lqv?G{RdfKSJ+Qs&W|elUnADHIP{mshR&r2f72l!cjoHlORW$px
zH=j)Uv`V{mL(ko2j#sw~!xIY8Rdmx);x8<(45;FJj<qf638$95d&W>g+6&jaI`)jg
zH0JAV8+yjzEJo_}8r(X3ZBKcx{ur)A@1F8LbZja7x14t1BkIi~Xy7Y8M{|?cjo^Xj
zA-eFu2yNhXbnBySrxE-V6es=(cSg{_YkQcq(Ie=q1acjDLFKs-L7>=U`24Ze+oq5Q
z;M2p}fE05jWIP-$aT(chVtmMh)FZy}G~=g`2@Gh+FZK-4?mq<33~BXt$RvRsLdEBB
z@6Dft&>f9oeb~JzwH?+5#jzq}Dw_bsVq7vx%rAueMAS*lxEPm-%TU}aFyv=1qoobD
zqRAoh8E;V>idqc~k<T_2DbLJD*0$U|KSaLBWng&cUm@}(FT=wqn)!T){EoM17U~qA
z50T&HqE}^Oi2NHOLZ#&}Mj-vX{5wLQ)IcD0y!;2wS>!qbb%zxRAapAQ;ryrKLgZgy
z%E|`=(f`X!LgZh4X*?zD*N6RwqVFSfLKKC|D3zE}9HI!UROXK<mDqnMMA0G6246GN
zVN$=q5XFGVU<zf6Ov9>2-x04|19M6l3AB@_oDaUX>qC@hkw8_hA-=^qP^5dYF~lug
zq{+Jw3`N9nO%b5f@gbs$5WYDCnU(eUe9AJzr0IFKAySB_hHq59OG7i3OtrRih~S+V
z-$xib3q`~K5h8d$rWH*?(X(ApL~^tu_ar>-*QPW?XQRMMWy&*nI2G@Olg-t>P|fu*
zJZJK{YCqP69PGja)&2xHzzis;4qz9h>FVlV&4H?cf<@Af>L8}jnMjFmHJ^v^)9VXU
zs!c2a_fXu@=2q1q%-0fp6SJ#B8KeMQx>+5@zzR@#uG-A%bZR=}cHL%kd`Racll^5~
zH9a*kq5!=2E7g35mCvRZpQ+Zu8SQDaUaO7;mv$obc2IR3-+1PpZ2r1h3un}mpnq2L
zlM);%Ga9S;NeO=TCu(3d-R6?(=<r~zu{wc!LQ${7_G-S}Q2YOIbsb<)9bNn0WmQx}
zKm=qhsMrt%8={C{Z=lBB8?XzwfCUv$xVGIDBBD{jjy0BOG!~4#N0X>ACYF3jjHxE3
znV4dVpa1)wySw`R&!fwIXU;iurky!c?p$ubhOJBz(<V0C+cQZ&M9)Ry<oQYZc7q9E
zfOa@Z-*4c4(y1p&y1B#c97@|6NxHdXxlHSv#Pb-6nHvo4Y9+N45CUKrofIyhAwbmc
zNxHdf1hDwEB(5ha=EeXw?j%JD2n850HAz25-h}qYqeT+7`9a4rueUa-oq%Qlkr$Kb
z^eAS|&ks~j;^q==0RcGIGD+WE3Ilj&Op?C2)DmFxv!qVaRKfwGo+asrGq?oRv1*bW
z&M4&q(JN|FEXlOeC?LbIq^=^H3sOVllk|l;z81T9dy>9T*BRi(jU;`cjxUZ6NKWc5
zJY0?UXq41LKrBGLSCV+#TrqQGjy#prOF$gJ0b^2c0r3FmLX-ON(4AuL29)}4k}Tm>
zbO%6V>j%0ieS5na+mun#*iN}|s^DfED1sYwlO>e6ay2be2}<q)&TE0wl;l{B0@v7Q
z>K#h%ie9YXdx<c%9h2jj_c$13O-Ub}EUU6{Y*53;C39D0%I92wYIQxCyDGjDWG_^i
zJ(oO;jA0-b=%(D{MG)_L8I$`%kE9x-&<7tT4}hsldI`^4_9rLsc^tdQ!5H7g$uu@e
zeEXrXPcm&yk|r-~PIn~J)+F8OiKxSUlBd8>B|TU?1SwQbPJ-e|f2xa_U{Vd<X0v`B
zA4ec}5y5qn2T|tbz~m$)S<b!0F~hdz$wQd?Z<yhxrO87Da1?6$Tk<f;y;opTT5?&B
z6k}NLJ5reXJF&=N(gVRYrLboM|0(#H;0Saf&q*vxk7x8K1}ySQUJn(LW6BOeR@G$x
z<gJAEvTst1-L)knn<wu9PGOrdu1kImX{W>}!?R{(E6IBa5-P_dqdq;7_YsZvBB~Ug
zyq_9ht4WkumV5vxIi_Y$pw=nLZ(uY?nOSob(C}ZA4-ze^xdh0kXYwJGUCPRuPk>Mt
z+F_`kvfJm$a5RnNBdoLRk)DWK|0MaS6vN06phatwk3xzPH!@T*i9$$8kW8v2?tt-n
zfaVUEDaB%t-#CUQGoy<Hdk`m0M*B`#`8<Gc9H;Eo@pHB$j5jIA{vXxb&UlQtH%BEK
z-VGp4^}IBTlI+3Lz$wR&0NZ2AW1*~~fO5|3$sUa<?MsxGVZDEfRs$-T2chggNKNqu
zp?L+HN2TzTno_=O9*fqd$auj1fO1Lkm2&Y4oHA{ilHw;o7BL$K8B;iYGp_)hsdb8O
z-6*cg%PG2bQvuEtrs&p<24A~6Bt^Gw9&EqnL95Vyi_b&z2y+!EY(5@|<-LX61WB3A
zO^_Y0%O2*%zsxo0W0*<5@sQA4NdE{lGdqxeW?$0J9Lr6UnVBAJi=DE(5;$mDXlw>&
zCsdOYsIn$}`JDtAHRVu}qgR3#^Cg}?ZUvH2Q;v0Z(h~GtBsrb+%B<`Jo<&PL1$nro
zC{boV%rR~p(g6z)7ZV9^Ui;|;+%Q|KT^7{h8U5rP-wN=oLF=-xsZJ+{(His@pud_o
z<rQa42*^J0Oc+R2<u-(uk0%TgzyYD>-wD#+&AO#ecu8{93Na@KBn%-aZO!o|?pA_+
z(2aw@&BqDS`^_8#F5OKSE=(N&IzLVrA%Fuy$Epb<1@P8{+6xm#5maz=uzDqo7C^JV
zy+^_r0r3FMIwg!1KqEF~Xu>!G{b-M7NEk0s35Xi@YQh8og8^pMOqeKO7{F`Q6T|^C
zj{-<(k|6$<c{ISdy$P~`XdVM#EKiU#c;>MHt8x;ODZo4qAmF<Mp21Vh;{iq}31+?i
zCjfP<m0*!5tS%`NzD-Cakb4PFc1uVTFa<H4J0{3cz0zcW8es`jCB_VJs(pf01f&9(
z2PBA-Z%zY<o0%X^zBwJB?u-O+^378L`cBajrU{c3sAIhZSvogo01RuAAWP@wOaMc6
zf@}zxvjFCr6SB!uF^x?+cxGtA95lgn7BQM&?u$)O2hJuaz|{nGP?hzMJG6-0O_0Fd
z1clDk1PR<tP>%_r4kPY{Cd{V}H*_5qzNmu^oH___=|F(XBc&f)P9SpYK;YIvm|Qv#
zxOLED*bNTWOIU<LNxz}n=L$T2mWo1>dmCE67n<-g^qb1!Lm3rAhQ3J`rbRiCQ$dMx
zDX0Udegtm)2;BM!nM*$cw|;tzQ@>@<Z)%pV-#t7QP(Mu++_W`5p_B^hQ_+MqQojnc
zg&kQdfckA3p0G{;4RMdcg!KaGmt5SGut5MV2O7vm0rYwg<|J$apnnvFHG%B52`b%0
z>n4l>C<;yOs22tx(sClsv0$`xWadg4Ze4Stsz7Kmf>0hnFk6C9AV9ENI%NgdZeh3t
zp-6yWxtwt!K>7G!rxwjqe5Ij)8&)Q$oro%$0`1w9pz@Ld<z5&SpI}NzQ0Y%*6eALf
zt3CfmZymYx7Ub4jM=rgIp6jg<K37~w-HH=ES6q*CDb9B!b-gh@sJ#VI?~cDEsB%8@
zUUQ%^4-!=UfMz7n+2aW+PiW#jY9QvfzedK2ctB=Y4r$)&N!Nh)C}eDukz0nEE{}|f
z^_c&gsMHT_iTY}e-b51h)f^74#_Ne8tou?qJ9hF}P+};UGUp-c>cPY&p%hA{Io3p(
z<!G|EdAV7lKFi^T;e6l3<|2X<t#gMG^;r&^T;#JveU`&6@ls|YXE~lVIC2$zmB?9+
z_xGGkt{$7H&vMxQ4mC{VIV{D@wWb~Y6LqJ6Q?QI7iIKX0A4nr|s)i|%vzg3ih=Z;j
z+`2BmlBiE+*ays867|UpRlOXZ$dhvVYD}ds5_teYkqzZZw-R{*p;b2Zj=!52BQf06
zd~;BuegdHmK)LotqJ9J+SfMA8XM=zUOLuq@S>50_tlCRY;{EsONq9e{Cs94t1Hb7X
z@%Y8IzC3<0SL5-ENo%Vx7h{G8S?F+Q?Sb@lcFRkcAn0ehCS0@d%miu%F<Gx#hQgoB
z+OIKB;gc=H7$tkgb}tK$MClg{%xP~KA$085ZU3^2lo)@mT4Z&Dzm#?OQx&NOO{{Af
zgH)$+s7I>fBq7!_QXMbAnd$@p-wDn{Csv33b*DN>WYd~-tZJDofT==-DZ<3sgbGO#
z6U5AR|FN#c%w#!6HEC&)ZDg6$BUx@E>zVC5(V}l7GuZ}DE!;+K`iEQ^wp`2fv}95Q
zJt$~CO}LzzPj`!e@EHOq0_w@Cmn=bU{m7Dym}#f<lkjFdUQI>HVpo?J7%dzer?YE7
zM(&H!u~P>7E7g&E$}$&dIzC50rx`+~`?!UyI$76JKp}Qr#rZD^Ss=h!xC_CYwclB|
zix}go(ZvE-w(avRHUWCsY8JaNISbbzQ9-QV>D(V$b>Guc#I(=q8Cc4AR|yvjVA?3*
zWx{Dx%GK1#X^M|!1=huC>I$!Xk!h8i32kt-AL`$&ajA%4huPc7QYJu-z)wG0u4bnx
zo|bixIYpPb;YFDn-7-<ea*?B~*r1-uC5DD1`5((>fEiQV^)v&Aanb%FpmKJWVzg{S
z><&;u#*P=Izv`A=X`hA1UT5rZSJRBc?rN%E9%A7{awd;MpcCySn=I$HpKsYGz}fy@
z2SED++0+otvR|U=0ySM=IRG%zBgEATX8O6sZ~MBM<u=9lkwc-DJ7klZc>93muE=0b
zymQ0ykpOv5p=I@ImQTnuPiOk{MW%ZMS_Qcxf3bY_oU3ZPMwTzg^+sT7@(jiDCARHm
z`ms+STVDwsZ7zD!*8olbkPEDmR@b+DOQw%>rtiqqhfJV*D0Ff|LiXSQ%a5STHVK_(
z`N=K)gHX%QZs}|GSRM)RhKNc_Ex!oxW48~#5n%b3B6{e#ddes%in(UXe*v2QVNmYD
znht!W3J!O`p30{>vX{Y3dj3O$y7+S%)KiBIk!XJzezd54D$}Bd^rJ=1&7(zKS*Z$s
zkA5T@WTl5fEh^`#*_Y#`P*iU{gBUpr7h2Ssq8`1G((@M8CxjXFrsHsOPfd%;F>sdR
zWNh*xqoy`>bH@E;QF#loViwNgr}Zr=$GcgboSZFR<W$4mj5S`esI7pS4iU!pUk<jY
zobS$>;bd&{Ka6eNjPI}0ENVNzI!lE!y0*VXokz~soSgaO^i!O<ERb=Txil`asIoSS
zR)k!h>E&fn7n1R|lW~!oaa@u`U92;bbobi<7S#dL+1ysuSa?e$mWeET-J%vEjx`9{
zYvV&Ka^2GGaHrT}Jty%qaI>66U51s`S+}c^G{3y6MO{I$GpXKni~0(s%K6R(BQ5Gm
zNrMhrgEuVdDiC7S=KB7PB8$3OBCAl2=gBq}bq(cQaVELeofG3b7FBnESp@Gru&BBR
z><yH^-J)&)<?L`jpb(=)-6+bLD70G-lSSPOp>ygvg>G>QMf*diQn!k(E~(oDxukA)
zOGQsodA@Z{J(J5q%n46LP9m7d>d?9tbr+)-I1}0ZKbr6PpES76g-bp)r|Ns%iCp^B
zqV9tf#Vo2voQ3KKDAiRSZ~Twcga0G-(En(DSQkp=dR;?J9)*~kmQLl~6fqiWo#lG$
zf8-qhA2}!7$}K-(QBO)7j}c7YVNo&eLe&OL<Jdm5tg}qR)$Y%^Rh{~ZMLq9MV($iv
zdO?uJQr?AvyC~3)a$07f%U-6OV@_SKP);AJI=P8OeOr=bWl`!o!dM-s6&l^U!ltiG
zVi?c4lIp4+Q*vXAdL7ZZt`c|;QZ>DEu>@|o)nm(gUy!Q}+;o?~j3pNJ1Bqh^*qd6^
z4<WP4Qz?O#zvH{=cbG;pB0C+msCP+PO3mX&TU6LG6c!IKgdVr3{{hl+lVv54K1c4%
zRF|@|@1OyHN<o~bG0l6DCI#7HPd{tGC>aKGTjFt_n{(<#gGK#?oOeM>6@GQA@M@$*
zeJoK1SNqj+AGldZ>_DRM%alBJAtw5#J5e_MC)oJT^V1XEhsTC)&Ov{BS_}qqj-i5H
z7K4YI6Qi%eC`da0Q;VUJ5bAz_hJ5Fxxdk2VYP1-*DVw(nf~JO849;CyAPmojY7*rh
z{`0oEIfsOUvo=g=-gVH%KC&3(mOm-_VQ*Uua?2lPMQo>Y>skyPOXeolK>we<%3|;a
zYL(5>eS53LAX{M-oXpnVZZY^EPBHrfRhwxs_zJ2GlvHFf_z7Z4U4OF}xZ$sunbL{=
z7K6WJnv>u;aTY@mHUQ=(${Qeg@O0*m*WVP-s8A&v6lw_Oxuu|P+|OcY>@Gf*LFoS!
zAK#3j`wYefR}srCskz@f8N>dEv89_44!J?!cK3{*W}d8A46PVfs<9iPat*CTs+ZE+
z->(sd?s-ud_BX8b3&m==?nUj{<kt+q_bk1r)<^xqB!*tpd%OHvNeunl(2IVN0(_KS
zm}qzPYlD*<bHA63%W>f#w)m|=y!p87i&`}VZAkZ9jf&Gx`=_NMq|q?H(#BANZ&P`s
zC1awKJ2L|(b^EH*{5BxF^Y)7K;<pjqGOr=d;Nt>5zfBV1b}#3hngp2<s)a7g`l?=j
zJ1`#PQ^jRt{9cvJ!#mQH{cHSo63JTc&6<9@1ki~LzU8+YlP~}K%<=G1etV!~ej86Z
z=krc2Mj_=li*f!a6?pPJ%Oz}OI^y$r)G6N=u6;h4dOKI(854#4t*`3$8j2;qcO?xQ
zx{E$(fs=z>{5;Nq*17LH3ERFN<$fN|U-;NJ8bNQJ_N!#4PbD|c>>D*3mOaO>@)a_g
zk<XFe_}Aj`u>6yOsY)%LGl|9;Mqflcs1?8zw@tw&$mdOcYDt9*n}YW5^J7zfdlMVW
zgCU_wTuACrlw?6XGQH_ms+@V27bsTGN|iIua{tTQbyDTba|Nd{ja#P5nP+)Jamd_M
z{mgTKR7)z)JlE4?z8LfN($sO3eFIEK_NI>aQevI0YiUX91ZF}`MGX8XRW|Ho_LO-f
zRgO8!g?l|Vr^+#BNjB!2vNrQ^U*io<>j!m6wTOWE08_$K^&`!T0cKoJmAPoe5|_~{
zxG(h~Eo0WZ^HZ(RN!t!m<TrytB)=_7Q!@pyjU)3}0+`<e8&hSTDqj$I+q+JxOjIjE
z5QU>(@6X4l!zPq{KOgVum8Is8%iIG|>WWmEf0}y&EZv*R`KPwMmrE(xiBcjuv$+ne
z?3J2NrM?4cqxq=?u)NxL3P9JUsTyp*_7mG=_s6O831HLF+zR6PbDs_GE67-PBR*AI
z1R?YLfONyb)WrzY-=`{0PPNIDJ`yn(%2Ms1!cC9zenBc-L&eM${{$^{3B=Fu6HW2j
zVJ?s?vm-VlX0tbpPbA#)t{3Rf4}D61-mg6uNDBAUoj)$_y!LWc`tyB<(x2aRo&Nlg
z1W){4HCM&&zO-ui)izYeZ?keQ{GMG<1Ha)8Z~RVKSQEb~Pkr#a+SeDqLjwKq+o7-)
zem5@k$M5c5weefgIRL+vt%3OMI5`NvjUwydw~6+BF#Zf$WWw)DC+gw1VtWJpdc7Bd
z-`9#7;y2LI2*0g<X^h{xMWNh^T|7n&iTMQOuz)*Rizmi>iUTAIRw%<$W@jrg_W)wL
ztI80R>av*6fN(Rf572-UG52-kKRjus67zX*S@0rbHLW=23k3VVtBUoH=?+<2qyfrF
zp$+2=F<&#Sw~<!lsF-i0{8`sCmc%>|pt4P@`XeFcA>hL8@-}SD_mHW-ARIY2<|j#)
ziwNoSV}2IEPEpt;=20-ZxKhFSZI@Lszc9+ohI;To%&!0owloA-Q#a<Z03JnH9~JWl
z?CQep&3WNZ%%6PT9UeGsh7$9H&#y<~f=ngmFFqe?kI#`QF@N*<&1f+D|0m`t!Kp3)
zZR*DS*QC@}7M_m>YS1R;8Kchk#E|pS=onQYx?C2&*cjS75-ludF%Kdh9j11PQDLhV
zMS-qs%NW&2)gqO_m>j$mqw+9M+aNjOnA$c*tpbSh4@c~lr)7H<8|x=ri&3jFG)|3X
z=kmV~S-J(T$vx1Zz!;TlD~qBKseFJ3`SK+0XM=fOH1rU3c-Io61|fD)QklQa*jsH{
zHr8gWJK<`j7_|&aw_g;FCZ>j$%Cnfx_`cA5PFfutJi>=7!TCD^YNV$Hv!XlV+2?4Q
z{yj-NCr?SM>w|{HZvair@k(n!Fs|&D&DcWAO>2#^S{#O`Jx_enq8POtAyW&|qA_kR
z9><p9Q8$e%<%^fgl|G9rL*|~p(z>9~7N>&o>i(c;o~c><6tvS<MVmOJ$x_JC3DI>0
z(0mLJjjktv2JYPr(e(j%0X5M67SVE~M(nI5F<RD?E9B;i9`}Nxn?Sg&E$AXgMdKP7
z_ZxQ6ax_o|h!1VivWi?GTf@a;JfmBY$s$Vz(eyTSjS3e=M+h(mW=x)@Xwi}Q#)r)!
z!}#K-c$}RIQd!M=y^2>fmwRoObRnHy6w+B20-dh>8XZF*yEqdDMt2dwCF==)Mf2rZ
z+ofvKF0jIG`_L`jcaTqXcdkd<tLox=yePh>TfFa(XnD)*o-AO-EcS`+51s5?b*2F?
zG9|c~Jim@kB+!|v{OlP$giJG`6bfLdo9VO`9xeN?G7eVm63zWr`%Je}V_&H2dk&2>
z=0Nmlj0^VVw9fXf@GniZqqm~r+qWRV)^<9Y{)f@qYVhx$(c9|5U!0#G60Pzej-wg+
zR-aYTs-7=8zVA(qR(n-#&w8PwzQ-e4<;%fX!URfx7_IgZ!~=JM)1uYBg6JdTqp16q
z;12NOplFp#-;N>#Qnu_q-&5kPDVa*ND%;N@3{68F;uhBMakQ!zfG#Xr)eC?Qcih!z
zbvPQjqbSH#V~(|Y2_QF7Z*PcJM=`~pK&yQKjYkK_Az#26Uqq{8&>I~;Ed^?IJz5<r
zL*8<rLTEZp6yPjlt{I4?pkfV6($Nf}eNNYnR=<SkB_lvVg})Md7S!5LqSdbjv7Dl|
zM62HrRgt{yY+H7{5br8oidMf98rgR1X@t06DUORH+Vp7kaYF)(nMm+49`!>Z;;Oa1
zoj!q9V|HJZyFGm(P6&wwSrV2$iRL8&;U_PoPewmcnxVJbI{Bp2Sy=KrT2qcKT|*gY
zOXT~5)q>OK11(w4?q2mm`T_y$?h~%1FBBkWO*ht0UksDB<PgM-@%Bll4^Y@6FmqOh
zl3plev^s?g(~Dk|_Oe@At+nY(pG#{QlCCXl2YNN#Cw&`?QsMMbm}>l*zN0a<#Pb{9
zr@tD;B=Fgc^lR`?3s*yao0rnxL-W;D-|nA&gP_Ey^sbzKlQchqruozK4^bdX7Ez(4
zgVS#b;PU>0$LY5Pa6wh8^>g|iL3HHny_tSj0E;1ZP5MUyDk<rn>F+|lA{CR+!s+~3
z&5`zv7CGt5Q35Z|0Qp>V`bu{Ryjm?C$E2O*>19eUbC<xZf$8h?5&+M&Q(F2)LG%{e
z|Cqj60Eg!q9n-f62nw8~r0-<5261feQ;@z#!ovX$1f;(vfc}|ByY$xuv<H|yIDNkW
zj<wCg(+>*ZSX<N}{fGb#wW-?p^fv|d1j_PGKOvwm!1U_rCj}$`c<)L-MNl#rU|{p~
z(*lM7G<}wSM!+zDv8~h33K#)Uxjg+m!Ol?ti>&Dv2-Z&mc;k)qivp5)tYEG+{gR+m
zL=F5a{jJ)dTVw^uyr2G#fD8+3RgN)Kebp!ZH<tNf5LBv?{-?0AlE;0P&NqtmHhk?=
z`ac3ZWpa`JUjcGu(eUldr`Du|Prw9YFx3Zft^@y5eWmj+<(#xx{i$8h&z;lFaR_Pt
z<<u^)q|T60eQ`F(W^LRAA!a;(kZBE-=iW)yNc8DtY*OPZSvxRLM%6w|t(}E}?W^RZ
zHLeMLE;%ng{vT^kiQ*oJd4#o}fGPlex?2YdV0RpAu?`i$Ve0B|>nH*_&-&Ij>v#bi
zmZy1JrwHJpe7{_4ssJ{!O21h%1#km)`9#f{O(fSW-uTR#D}Wy1u>IBr0@&z!wYJ)Y
zDFonnp|x0I8Uge<X?;aNQ-H8o>skR}03`>ln*`8Jv3z3PA%MO>T8ed#04yD7%F7R}
z`-w_<FmzS9^{@c8)G7a1j|t%M&jPdcv;a2SeRZuD1av3QIqMYxY{Hk%Sg#4_4NyJM
zdQ$+~vwvUf9fFGf08RH;KNp}41Zp<Y`VEnp4LYci^?QjL3a~HM`bfY?fYH0GzYE}T
zA%nm5ZvhiIYaaK&`VS1m(x3tySLZ7Evcs_7SEH=zQX%4Sa45#At`NlGpw%?1TG|Bp
z*T>D7^{nc8MwW8ij4!sTn+0)Q@p80P)k}{9-*peGsuv#zzIMM^RVh9>ix6_rs!I7)
z@DN4FQL8EiSP=rWYl2mk608X2;lZ^Xt?C)BC@!m6V6@7r>assT7SyCHb2+cWK;UJl
zuvGCNc^;I%f*dY8S5V2S-a!sadh65&mK&Q3^~a?4GLm}e9IN^Xs7pLZ{gBk9LS4E7
zp6mBk^(SV|EVRSBS>+wWlA+Y&H`0EL_r7)@LA|u)n;JKUTGc<uq<>QbEnodpV0{A<
z-1*3=K4F5}3R+mzrx3Ed6B4|+#j5@nWXn5A1^k0o30UOI`>`Oi9>c~UvZR#XW{a<9
zHK>$m4h8D)#A+}w4w=HpyX+6h=*O`(LKb05dIOIZEXi-_X*GB-`ENI4gs~btslbBx
zA(Q6-RE3<#(J;v{iFd4qYFu7fZr-dKYg=UjaYY>@IJZMt>??2wUbY$<P>Tv|dEj+<
zt3fPE1sC6%Mq3Rn7+1<h(aYazXf23&nf1VGXeWp(vR67=4Pta;G4j$QtASQ$1@1dS
zUY0MwV++w;rA`xKt%ew?w5-5j#rZm@zG6KpphkVGAyGui`>T;%tOhYdrAEHLy5U``
zVUWbCe1CP?CsxB?9aaUr7-Kbz5oo9eSlZHR7^{o&Vv>uKt%h+(az#`@FROuv^HzF5
z?YUnf{S={7;`u_m)sRk9!FBNdD48rlu9DFW7fWXQA*(?wmzgEA{eaa_KuU8>pw~xO
z4U0r3%gN(4t6_;CmQz-u)gY#<lwB$DXRAS@F<Y@d0B{zXz#1Xt%4|%U)v!rWFi@2!
zt6`fU_OmnRtcG2J>I1C++D9b4?(}i1LGO`lR-;>44JRayXMSG!$!a(+C>&_QOsnB-
zO<*M8#q(CfJ4EL8Kx-OW4ev@^2O$4tR>M_6Y~-D%S`A|JDq@MISq;}Et{aQ`=w++n
zJr?yYI<D|sR`S~wcym?RtcE<bdTc@AucAF_Qs3&aRfZ#33EvrD_0V(3!oPOO>aksf
zlJrCqtA}on=<zogWA%7d;%K>cZnS#PIxQc~;_muitH*1ME2W~VR#`pv3W@=ORrAox
ziE3B%wR#+6-&|$vh8g;aN>-0UA~fVXz>bHk9(pN;{0L~@Vf8qo$NmBci|A3I!`}gi
zyk_-qn!Uf+;8(Oj(*Ba`DlC%CcdZ^LP$VluR$_8g;@zbl;%W``;q+YF=fl9tHM=yx
zlzo|p1n%9OiL6+<w7@~5Rm0&CEIW*V<{x$mV}Ka}tNcF$m%T?9+3GEQ_79xHrLjI4
z+@M(X2&2XHRT<9x34pw<8P!ni`VwYXR7Q1B>66esTJ;S5tuYSo4IgK4^FjZ9!>(!>
z+<Q>W)e*C+Rt7y7{WZS{*D|>CP_INj-ah4Fct&l&)jRcMpI>B%lmeNo9Jx3Wkr5;k
z=x!h({jI?&8qmI^j9^Tq^n3k-e#kHZtlmlA!Sr*6z9>MS;B4m%Srm}(uGOoX!9@Y3
zls-Y*wHf-FKqx?^UK#p1v*rN%n`UtLLNU`pfZmM+v}7&u7~ATjSpG%htWM{;w32@Y
z&y9)v4{aIx%P|TV2Oi1b5`liP?sg@kwE%ka>*{Aj2%zV+{EG~FVR|v|{WqhH06I}f
zxh(*0IAubwlz3+Fq+{uDx+6#_N<=WFHgOpp1#sRlC_aN{5Jy6HaGi+r%-~tE((Q->
zQx`WA)Qfd9LA|a5sNP(2hW<hf)q7)CM!c>b#RWuoW?;UpDP??F6Y_ex<xPJ#qnBG=
zWTOn3Y|Ck+>7Qrxkr=v@UB1caD}d+SYK_b2CxF!(Q<1@y2b_0fN~b^b7*H9oj4QV*
zw+yHvQOxayfC05Raw(;<j_5e&Gk{IAY;oEBHMq|9<^b;iBIYEk*8sf%(!a#Vd-bg^
z*-b4&Z!TLU_2}NPEZZ(vR#VEb=v8(o70E;>Q=n=0+5!ITdVAMk{h`+F+NpK0K+&XT
z?F-GI@gqF<Dyw}FPB{($ll(#LOR@*CcNNj&+HdJ-`FV6e{|mL%P{{H~8<v579;Ygq
zm3`1E4noO3t1_!daWkjyP0f^y%HqlJluW&EvT2N7nyL3qdeJ8zWqJt@8^6}0d8Qoi
z7hl=BJ=0sF=qqRZo~iEyvS0L>lIbfkApj{QnSKJ;6?U!2tR;Y5A?skKzV8<fP_JsH
z-cKU|%FLP4Pvv5$8|^cLgeRI^^SvvXbp+8pUfCy8U$2V?7^i0HU9%^^44+JWy{<37
zOrK2YniUBEwTzki3f*AFJjrY*(l~X?Zj#wZ0B38nJTvu;#c=>#3NyKrhy}k%KuwQj
z%0ga6GC-r1nX-^qkqR(7BeS_kfLo=Uem_&+VVnjqCn!_jV9X|Hk}3O(6*&MoL7B3>
zSTPUa%<@cqg>OE<<|dhX?_Er?(#$q;h^1l)Q0`lq?7m9HQh<W<ne7EE2e|ZFW(NVQ
z09uu2MhRF0Ft<Fjqks(naq}|uCBe-Ap@vL-NpL&B(W#lTBv`QvAn9DDED2WZ1sJA%
znAue%8~_?{HZx8DXQ8vkWa>TnO@Pek%x)5M5+JQClZ%7v4xR<L{7t5;2Ua`*=+QM(
zUo`ud#t*YYW!-t{BQ-dk*c_MH2P4!Puimj)+?!j6qplj>P0!-Zmg}A=5D+*mD-e5*
z`nwbZEm=Wm=!&_E%apFKDbhMBy=P^ylGi7K$H$u0$SvUJv#iDfq7f6dB`Z{<vAPNu
zX36CY=4_>R&n#BS`j?&QN4nX;(Z-#A<fyE+0=j@bEGny=fOw^MZWhaI{cSz*I5#&E
zk9Q~DDkZC%JMpNES=|M&tw56=lCK;kU7MHXRSAw~-BFml<Yv`@NmzFs&w)p>_??CI
zyqB{6fUNd>PQ>%RURk`naQ(};sUlg)>f=pbSMh8J4?=N8%%wrRes_Krj|*&I5%nLF
zRUI0mLa^kp{<cwh9d<>D$Qn=?GqnvfBe8xmkXu+c$8!s-yO#%kUmofv8&Vlm#RwaE
znpC4;d8S|(=^qe6Gv$#sm}o?Rd^5=-tuN7(fKc6pE$szw<XS*eWYW2}8;_71c>(&T
zKr|811)j&6ZUG}hkj?{m9+4}fU@d2@3Q)23t88on<NJX}fSL_UjU^4B9vuVJS<F!!
zmp9K80I_)Emh)IZU88@1oG#fo0g;`w0QF;%-XmjJRDk-4AbNQp+7S7vl#F~Uadm#>
z09p6kxWh>+>z?8}Hc1aqxlyGbU}@_apz2#y^zo0@3Q!+VOsRZFaqQjr07C*b{{fMO
z3j+*^7-CWSK+xPER}Pob>71Zl3oyu~!=;=61m6lU@YdmV&phQD+R<Y?LwRyy6F<~Z
zw|gl48GK$075ZgpFw(;f+*r3vpA;&mgXQ(;y-T=H8M+7QMFfVT;x-LJl})V8eM)?!
z1;5!fSjn@F$T+6?-v`M=X*UK6`yf29C7REsK^(mn-9TN|_6TgF*X4Yont^R~lrtU3
z6xgm3|27M3UkUY^IX18ZYg)d?vv(Q<_5ZhdAia(9Al%?RTM3LtQvAr=l*u!cz)n@m
zvNjv5Y6}C!Sjo;w;Iu$7R`O|;v!*~XR&hZF)>dFF)<icosSB|8Kwwua2iN>KgsnaD
znpYs-y)BPN)QC!fv`_jr_ME|iJwfM#qbi_FXx%)J&PBO75XtvNL^)o6Lnr9*Qy^!;
zKA(iLGnM19e73VtnCZTO=4w(PSLZ@-9AekRkQzTgD7N<2!0G6V<$FlA*NQe=z8Dpk
z_)p*=FVdhQ8te>IE4zTlj6k)n03@gR_67adl3opN!<FA^0hL}0R0lU^1Z6Hf3=!45
z16A2kr@VDF0uA*M-{-FjYC~AppOE#D_hK9Q@R`Q++z+vh#puv9TUy8Jw(#E}XadJ#
zX$v?1SH-68<eakKw;1!aI)>P$U7>4*`Wr~z?-tt(B)GNm2}^{Ntj+%w4gYlEEqq~8
ziFi-BphDfPT$@7rVc^=@o9QFTmXbb`gfig*Wal{hgV<K28=)Ez*W^NMYu~b8wi^G@
zMu^CNTuE#-3!bW6gs&PKf~K{#Xl7cwwn{8NRJ1v8W?EExC6<@bZjsBb8_fn8UkBM*
z4okNcO5aCs@EW1uH?}>(xA{S_8E0cVz?5t);wJXiBe78e3_zHv`NZl&s*#aZ=EQQ#
zZJVEwdTz1B$_RUJKI4uzi0#a{#`8UgCrz8B#Kwr2|H`fg%WGTXNi3ha?%Zr^F9G>~
zDwm+od$#YS0q{A$^>>Xx8>hh#Zf!lSHv3Qo`qk(Y(*pP=>V@w@rg3Jojl1O2S52z}
zBeCsm7IIkBH12ic&@Mp3$J6xt19<d(aHDCu@8bht8Z%Azef$CX?3<=LIP6uI>P*ue
z91bHbWyZ4YBPsP7QVX+@(nHbPx4rTfblpFDI@q>-bad4YV~lV2fioscBlLq3pgp25
zC}Ecux_vRzfHFDKN#z};5^E93a~L~d%goA*9a-jk6wUAG%sM)4G~)W_&8(-R9H6&j
zXExMPD5bW{c1q0xTE075q;yhCfP$}OSJNry0YxTe)450b5kL;VY(E|KaB5SLA^B1#
zBVQ=cK|gSSsTg-O@J(Z?ss&{C*2!;xc|v4%e;q9WIyN|appFuOYVFD%qN52whl8_6
z=%^FW62DnaW!nLr8$HXZY)_zO%V#;29qCl)&GAw^BUn6D?Z3{V_HQPZRXJ`P7ruQ~
zU0rM>BG>#qD?~@JK=p6W3e{16Zr^Lm%1VwK`^CRGe>SHx$0h_$!-<92KCpIvJJ@Cl
zyUgaD7RM%pu!cExIVK-zji|(gTlbyqj~$|8QDs3Vj5aOOa}MWA#~Xw31CKdgkfMJn
zt=088HPG?!It?vrtxLu^Ozrpp(Cz3k$A=bJ-nFmw;T+!(M##CvWB=fB?DKDVp88MV
z9M0^I?*U)nkvTGBkON3jTjpTK0NY&Q88|g17ydRy%3YH6lsWp;o{fI*fjPXBz2?U?
zdE3E~vvcZVknrK*g1}QgIU$ry16cJ!j!ew&DS_OP&1sAX{RNe|=A2Lh5#9E;9B%Jp
zIg+{R(kH=~!xM%lT0sN|!z2#hNKMYcSz-a4IWC@<!<qbvR{Gh@QapA^g%sJi5BbS6
zhZFb{No5aCV#@ioF^4nr6KiylG8Zp(ilnvCUmJqRP9{=`$P>7=;l!@z#pc`DCx?^s
z6AxvZGAEX{HG-8p{jD4hj3*u%0lFmS#Gy%@_}LSn@ywif#AqjelXDZtD=<nOe}bPA
zNqsTh%g*6=c(RhSEuIXRM3K!scqFLfS79MJoNk}AL(tyboB_4K_7}~dZ|9r@Bz|I7
zbDBs~UQVK9p}9ZMh&ed}brb-!{Cv(JAT4rq^B};+3vym!WLy~0m}@ya696P19GR|o
z<_rfu`8v`=)r~;i>lX-xMdggd(1E)uSV8A^`RCRIJk<ttX<z0_vy)w^IaPD@87s?S
z<-lBh#)@(XQ*N}+l_{%Kc)^ognX=05Otp-;oSEp?=61YYw)ZqH2pyNpme&(@xGxjT
z<;`6uUq|AlHGFdUdf=%;NTO@)TxlHgI{ntYxzae~b^6Y8bM<8&wv_c5x%x7Xhqyqw
z`Z5o7>@y~ptwg_PH)>0+K2h|fcM=wrtFQCO($1Ee{<$2>PJJAhgfk<#9nefp#j@`A
z_R7^KhjQxV-CzB4JAv-BhfdeoO*iM=T(0s|c`9_4r0CqPD8n;sBt4qv>eD{TJNYQL
zo4g|~OA09^x!qYfaxSsYlw5JLD!f2f);d>CQplxNUBAnf8KGRfb^86>-be|jGby`k
zuD-HU8=zj*-2PJ30RRgQ<jT>JQjSPP@8rtS5xI?L`4KHw&W^|xSYxi`4iqMAkYHw=
zJ4o~i0odFmcd&p^03TECO9Gk$RPCNSL_jz|Ow(Nbv_&L9yA8R+B&I!U){>Mv95s8|
z12tRkuA0kMb|xY)ZPd&eO71Ahgd9+)cQ<!5=+5}38*`^%pgxl}3QeJIZW4Nu?*u$2
zH<I)3N(G)zjL+rmckulob=kIRxsxI2%xO3$XJX3goHKUPTI5a@*;PrA);u~l6Yy+%
zs`qkk7P{G)G*(5eYPngczcXpo0@J8a76#ojX)INrak*K|30Nkth395P5-{gz4$~xm
zZ2>lZo;zI<!v3TZ>zO-4K*s@0Hf*akijKos3*t5$jH-(;UtI1zd%6-;uO7oA17}ZD
zqUvLmIdfXRiG4BvG&`3M>nMEpg|Dpcd32Xq9qY@mz$^sc>d0@xxBMxZvO0!{tiF`h
zu_27j+4~6~x=_|p9F@|+as;!ZI4Y$>cpBx*X{2&uRb()Sh;t<%uJKZE03@E1FQvY}
zE;vvC`%lBI!9j4Sv~xSyj$=ZCIhj6pfbH|t_TXSYfD?3uBDMvaB!-1Ix<+tag7?_)
zPOS^BCo!C0EQ$_hKF)p1)-~;&;06HaRkp6up27TJ#<>G5<KUEFe#_&0?QrUgFNJCt
zfzR!T!B2_&F!<c6%Lr9yaL?`Gqxm==kIa>pfz&|>kC9<#U18rMEI*tP6%z5GGvd68
zFyFKIK^c(aM^{8`gqce<2A;2s?4JD^4^8!Z-Me@MhhkVf&tg!{<6n0S3*7g^;D5et
zIOc=d!QqHI-(4mf+g)U7LMC_4pC1jf6&b<pNR}pKYY<|79NZbjUS}ynJklb=VXoFT
z59S@%O@~NO2#Ag(2FD`AdBmVDLaGD@cg2LscY@Gxl6yKJI8JB~yZu;j{PS3Uq$rvB
zL$pzq&ryWun;L@AJI;SYP4-r8f!Cb&2ODClqgm<4!}ofk?S!_A&Z~vCbKz*&<%`C8
z-A?3*gCSNc^3yzhNzx}UDM`uGS0vdemfgzJ7bMvzytn0Xs;!?P9hz9y<dU(2R=0Qa
zJT4zzq$R63nb%aNHteUzSLZboz$OVn%?V^;+j>}D3ju6|)ARFWZX{=@-}*aG=0^8I
zl=S$##;_?DBVjwXRFzv@FGgZ6aY4V@sRB{)_y`)RPEOCBZ4sYGujb+~Sd@$K>3aL*
zajo#;UR|#!w_Z@Cqg$`z-{(aWl(MG`-jUZyKsDZYq~vuLz;4s=c3zACZzbI)uO0Qe
zEP82q+`el%1d3f8Mgvl9v`=1J>hUr4*o#GLSfA|5d7P79^1vZktCGj>I_cfk@;Fb%
z4y=}dE_Qj1JdP2UIDu^Ua$X<Q;Kh%Xz@+IZN?u=BoJ+kcBc|=DJbj3$HVFAI^vfHB
z27(tHCb7L=ybM9>j`-!#hq$y>7c|r<XeI>>qoB2wAyvs6iGsScshTcy3@cX#|1NX#
z#tZNfk@1jwiG#sw7YF7|g50<2$R`W(CI^*`xNP*%>adCr&(2FGlMIS&cjoamgi8Zh
zdVxxwg}{S$`Q7jG(uAxfK<hX1rV3dEz}uhY@iVlSJi0N}3rF$1;*}eDSxoQ*;x`=3
z<2nk=F+ku)dAvmRtrHl&G^P6LyqO}DrZ#j!o~(%7iw3CwQr;Yii3iyCL0*o4o&Z-j
z=H&|L3$ScY-aHtuMver4SM&4q)#$+h(--E=M~v@;VE_ku<ShWtTW3d6#Y@|09PT0g
zw{A#(^yVyrJ6&(-FBUWt{42121)hmU=B@j0pwrggKi7yp{?;RQ+J*DT2fE8aBIhO2
zUG@~ZlXEM9?sAaOHHSs$wz?T-Z*B6#UieIbq4!<hEKy&IGPcE$>PquQfkmmn^TdAh
z_}+#7+<e{`*Yi8o=8ffZDH7%k{jz=y;xh$2T|S-1djl@d$Fs#_9<KxN-GJv~z31^Z
z0R4ILJh=>j;p??$^LQD6MA-A@CA*$SygyG~#o$MI9hK+Fn;3E7IKSYN@7D}I@iFG<
zwI>K^H!DA|0TxX<OUPY>%srBCLRk#&DIrS`vf)4ZSn_mn<sf9_=KOZ#(sZ^_2pZQj
zzvFW@PlR+Do!{Thwug!3WaSTXC$@))&GX40>gL+R#I_vCH$UfMV&3)hr#|OmS}lIe
z&k`;!-5T~Vv5o`s7rNPYGqG9G`3^VRZYGwOn*XvpvE5AU@Xz_1o^vs=7CZ8{J?CO#
zjlay_`J9Vs)vuI)T<7AuL%Wz*#j^Y}Znj-a?4+81!OgadiFJ+4zwJ(J7Za<oJ^$n9
zTuiK>DF3tPTuf}`tNFjWxpp$GlEC~wom|=@!%ikPpnm>8Znm9ETHu^boqW~%IbRNf
z#w^HJYq^u#ISN6OeDc-6=Zu~RGQ6FyhPfGEeS)C4_4#UqoAK4V2<mCdSKDzA(3{Dt
zOmg;$e6{y;P9}Ni>wI;<b517t=9YYQkUPm&nPlA^`RWum;|?ad@rQiX;%3~zB<uCf
zSEsrecQC~`t!}<r@SKxLp530WE_%+%Bo}VWR~^qendCc-^VM~3#_de9egAy5+|9V1
zNp=p&SGTztw=+pk-+Z;g&8Tf>lD$Uet0$gwGReMs^VKuYIhmv*EnmIq=G?|4m#@rM
z@3<MaG0D|E^VN^tjN6#xfjjx?PcBA}G$VpcQTgg)Flu_g-Ij{5`bYCs-U6uC$hIID
zY|ky#3b@8_l_q$^l>%8}kjdeqwFUGYupy0@^-l_9=TW}-Sm0mK3@rND$<iSOTzSxM
zcWHZ|fHO_~c9#)97GN7v<M>UJ`R*MgXY5<4059h$SMwlruDO7tF-#nQ_pX9=?&RX%
zE|87IQn?VW;<k^*)zYhcQ{vT0n!bxlCQFpo5E1oCIL6h>)nw^Ju9oTRr^(WZS)=pN
zx4Nchj7K}>PS*5{acE7|w5E{Y{XNIR(g&KJF)rAomT7v%YSQjnuNRDHNWG_Ec(9t9
z)1rH%$<iY%^tI-bkPps_uVDD_-DN^yUkjX$$HST_Ox7w$l_*r&Gll0|!iSk!!Z*0q
zC7u@QJEa%8Oj}bcx(jz1^6d?TcomvjV=&Y2l-=f!_2p5f2rysUJqlw<swon+IVuUy
zLti)X^G2iYQl)D){MWA{tf@(2t==-V#cc4}ZcmE7z^$;_c2ksmQRYHICZ?acrs&EX
zAMsrOM^iKgF?o(WVCv)w&o!7jp$`2YLb1p_rcNPz7I_1})!y6GStt?P`)5;(JXi97
z{khN|LD6?iF;LLS&<_mLCz`sr7$&8fx?-wWJ%QrR$AW%RvMCOS=dbpXkZ6=;?Hp5l
zZSZYhWa{RP!z~ebPX5Hy9p%#|56|7xO+DlpnXCDpsi!YFk89B=5L^zgT)&{tF^bNb
zQjojrN0CVB3R89^SMeU_2LTNOOnJ{kA`w!UV#-HyN`#0DN66?9Q^E6)=18thrfGgn
zi4R45QI=_eJ6_x71Ko-;O$#LmO{q<~$pOD~^-d^8f8@PMlPF%5@qOk3(-K6!Hwc6?
zHkk_Xyzbdy)cC};rk&zh;F&9k#d}S=;UFpzNU*H4=|Cks%huZQ5QIekXnF%>``$5m
zclCH(X+szV+8j3hj#}{BEXoEUBzvui^A%@^KSDxonP?=OAwCG{{?zoB+XiiYRM6a{
z8qim7q{ub+Ce;Ho9R2?Njjx+jBh<W+!hOT{kDJuUN=*RMxsSP{x=F2!x%G`Ko>r@s
zY*OV^NE}bA?U`j#c`W2ccG*AgV|u<A8gTJ!Hjd{^H>p+8cyDmFcw;gC>o4XtP|(ZP
zm6_D)OmGErwDA#0SlKr&3cnXgR^K<NR+1bRl9M2z*c;zYViG8J(A4_@w{(-{4r$)>
z(GWH-&g9|m4y*71pa0j$RDBU$g*NSd@3W|my~!qz){FpC&%aF`2eB^w(jSu88U#(<
zW2$lw#W!d*gBH-Lm(4X*`RaMl6$CArVXE>FjDy;eO4~?#9UE<`^2i;wF&aVJZkVe4
z@tkuFYA1GZn4cH2BDG)Pg^<aAhWX>Dd|;~R5RQ=ec3~kQD9VWpIr1+;=9GjrM*j*p
z!H^A)5VEr(ta&3GLgo}%Gi>-4K`YvYg+ow~Y?N-ekC3-+g|$KQbt;P>vJILL)*dwV
z?~5S18d^nIG(+Y{$Q6Y2-VzoIt_D0HWH>^}<yXVv86q8i!&!vfs1??eA%{q#9r+MJ
zHCu=Efz}~nA&*>T1^kNb{|!<B&sYIBmmWa{6pn3-W_5D|IMs@HkOhnZq;I7}NIl&=
zM6yMTnqXFP^Ma6tFy#HQ%wBydx$w;u2$|fP3m5e@32HE(LEg*xNe&@W|D42-&2Jd@
zxk8RIy${;*zoaKOq}Go^RjrAx=f$@;K4`=oZ8!irzFhdh7$+Un|DZqUY;)>)T|g)K
zV2mh+<r@@X!;|&A-XT7qz<l_<J-<GtxMTL<**bgv@Jh&8DV`5ZnLicb>IRs{%XjCm
z<0kjzuja3>1T+245Am8OMx+lp)9Q6xtBPlRs6F06<CzQn3}4#=8aGb#H|ygkXmaSP
zRPz8+jrZl^*(y(Ys%>Vu<}Gv_LfgHf)dcu3nnP&iaE(XMn*PDPm+b|bFJt<4bd8N4
z_Lcm~yJ4Koe5hXnEgRj|I*}UJ%sxC!*2h`^ESkCjBfF-IKc@u>;`se)s1_uEixNFk
zG=4o+-N1E^K^a=GfDnKQ*EFv4dDdvo8T*<eJvA<G-zrCx^|}@=baWeThG|^gzEw`y
z$7*U^-L6;C6yS|gjiWfeq1pmy=5_2Vv24Ns3My%`x?Re-v0=2PyDr>tiJh;t6SCF-
zCr)Tw^;XQBHD`C%xQC*cF%eca|E=k#8@UOv?i)=%-N;4HZNF*UQStu19l(W6S||O+
zJsuK-OTz72#mx0k-}@RD#1%6ybd71RaciYn<!Dz)-`X!FU5}aH|9OK2l@NWKZ+2X{
zv!F6s{_W1p{EmPHVs>S*Jfg({T3v2l;Wgp~db98f%qc6mV+`t1zMuv~c;a$?oSAF2
zKn~rN@<zU1OBQ%@NGUY|yt!e4oWLus$9cE7c{?r{7X&i({IZ94@TtzD3xd3<w?SSA
zT0qAWx5rb@X+4b#SZBA-VD*27vY;-W^;VkSVgV0$>#a1u$%48VWZV+!qQ5&OOyAUg
z;RoQlL#OR#*uoF--1Hmf^jOV>w*Xo^)3{RVy=&oZW>t>KcBrxNjx>i*#B`{&@UDPx
zg<qq%`gEbuTUH>^TJN-&1fGa0&&0F4ykQYj;#<dT%6EE8WQ}La7Vur(rDAe@r-Lgp
zNg`_^l8ddE4;xSfcZLY%Sr4q*2VIxvtNbcL&~^6Q!Ha{W2aj7^NB*WR4wk>!i%s%(
z`Qp09D3saS-Zph06uE0g0aZlU<c&@!1QhzjrVd6FiVbM$A2#(Ro@_<I0hS%Jsa$$O
z$pM}G)20p;#Id@@`!;nL5PCaMX_8GHE^)k(v)wB;bp#OlJ5c3tn>rE*9Uf?VflXfT
zM2`oWG{&ZmmQs!fI*@2n$AD6+^0d2rzb5~`9!8s54$V&?x}n`B_dV&FA3S4Iw@8xI
z{PK@Bb*msleDdTZ#inipx_ioFFy4y4ZBw^P9NznImiFE2QrZUndUMpx-Fwm*&d^uV
zUMjN(pl<G72Y6|-y@mUEx4nz|`JjCepHG2i_8a!qc&_pk&(_xVQapbcjpx+E_Vsvf
z`Ujp@AGVh>yf5jG*|)gqqwHH<^s~>|cj6iOr=YI(U9O0v?e=|m)&-rkzrk=3^q&0?
zo^|@+_QP)aWA<Zi`iu5cE_&;D`xzHa_BlJx>gqDD+ON21ay&KrI{+dyqr(2Kiy?Wl
z{f3KSn~(iNH-nG;wwwO6{f>)1<1PCquIJ=k_RsMwiRBgBzji%mHn)H0rup9flZ0!?
zeNLSHR{&8WGt&OpP4w9QM2J9BGtT}m!&wq@!tMVR8Z>zIS*TsDj2i!#Z(#IlVb>i;
zIq;TQW>-BitiF4PE&TG2cGYRbq}kY2o+#9O&(=WXD>v<`KD_w?)p*~o@=USs*;+s|
z%k8Q@zVT+DcCXk~+BDy@eE+0!xLxIrt?yYHr0oTEm0PyHXG7Td{<98h^^&$G7Z<!b
z&aV2yI(^)sGEU3Zu&a|p(f>Xi1=0_WAegICN<>`+vDg2!t4SoC$VOa>hous!vdzAG
z+QEIIkLR)M8aV3U*?T>n-wbpF%d?B;tnhe|XV5W6J@U}i5P6?SoUg{ndg+eFjHDYS
zkxwKtka1J$I>H$DEuPyfbnvpfkFVm{n&RNDiG;W7>FD7KU%k!I-xWSO$uZOwe*9wx
zS22Y?@4SPzz)+5+9KPpBb4AQcbMPt_NuXk+BgYj!s=I@?c1n2nSck(Eo}1<<afLU$
z?%)NOlEB>Rj!mxcCR-i6j#9#3Ip^5t3ZHP>ahPB5l!)f%9VcB8^H(@7xEP|N9aml9
zYqvN)kZ_Dm$4At4e2iB2=`0Kqy;?ZrM5bJ!XzA(rM8-evm1mYYK9vT@MToAm9iO3b
zV5vTEX3BKMaUa_WpK7z{x7>Wg@j1~fZr;>-==efF5C=_J>irbyeu{VK(LCgg$ig2S
zU!!$=nun%R(AA;VAn>AIkG+-{sn@#@)T_mkN|GQ)yv(vCJh_9uz^3`>HvGSXS+CX>
zF4Wj1RU48A&!_X3RKtKr=UC}ItWZDUhv#0+iu9QTo@3LCYGLZ}?j1ZA8H;$<MxJ;0
z7uANMcxx2{(a|PFJE6$Ef8}0<qFq!(jx`i6EZQxAWindpSM(Z@Y%r}HRkT;4SSH;(
ziuMU$nbbI5^tu2#cBh^c?T2W^%(1)sp`rr<>H#brSM-Je?pTEHEjlQm0YI&PiVg_~
z0oc8&=&*o>Jev@^z37ObMu?i*rKmyxJ=VDci;fBiRkmWB-hI%aKC3YUi($XbKk3Vm
zmvc<U&wY>Lsg)yhfTDaBff>Tt`}o24LqNE?b8KM^M$doL?*yU;B1W#7^1sjME{FSR
zNtGG@`ptfyBR-Y!W=6I7_vMbh_}hB)%VGT6^P{ElmGQUw*+&0V`T`v1a{7AH*RKHE
zZb{H38$n-!z-M*O=o-<`u}{%`KpbUK?gx7%O-WUX9>C+fAB@^_s9r@sV5)b&0YKFY
zW%-{Q1GQg^R8`6vjjQc@MKYhqi;r{<i&PJZVZ&U^TPp6gYy;b}v*-j;xNk#QRlQJj
z0@9Ux-u${m(TNZ|n-M<Y*P;_G@XW%6&=Vb;&yabd8=t+>l%i7<uEqI6nOfyV*Rkqz
z-v-mq=8B9|+g`NUl@T_rD|d=EHx<_vktNom1+K{7^~eQ{7>Vb(=As1=kQ@iO5kC~s
zPvc8BN|otFFUzy97d+gel_vQ8`(Y6vE+o7t*D3DvFmHYkyC^q^BD`m&Sn%8s&!ymP
zb-gGzTxuIk{?m$Px|rxaLBW~LsDn2@{8u!yJq1vDa<8Hc7vVIWFhd9#sdaMTMol4A
zK3}WHTEd=-v2=8aiD*zX*+s~5MS7EkkYbEOipIJkKhq<}Hh(T<EGs~iDe6=-+(q~=
z2sMZqE|e70reV<_XY3bkbTNZMo#nc1VbLH|KMF<iHz?L6a$8POKNl07JV@;K0#iR>
zQt&%te^D3+zc{5AYZwfaQlI6THmN8q1ob`(&%IX`g|*}}s%-PsvQ}Ri1H;RUI-<bt
z+Yr>NMUlQ03|=T)tFR~#(*aCqlrMe-cdr&@)4nnWbS^InakeKMM0-7^P;Kwj@GE2W
z87bMg>_QG6@m%sS&qC*ADF8Vg%g%m<Rj1vB&JW&K$JsmFjKQYLZv?k5FI25A5WS#K
z%@9yM14LO3s3V9@FD%5(ci@PCZT)gTLU!#bR0qIi5E-3(3)KXIxavGr4gd>^+9C0G
zAYQb#u#P&zMZNw>p~`DWgtfrGZ2H&6rrPI)>U@Oxo|QsqQMd4kD|<Oo0fkSRIBRXL
zx$sF_iihA4R|-`X@mQjlRAik^<T8<}dQPU8p%L97iI_B|P?eKtrPXI6oKrbiEDa^!
z?_A+mu0$_MpDFwbUCP;K3co@NaQ2zPuh1QRCwNJ@e?!Uanwe#V4`tj_`e3%Ou<(Xc
z*w-G?Itp*VP>BE#-e}4O;l--BN&d3c-xz&Da|=(qcoKD<(-@mvJf~6rpUx_K`x_Kj
zdZD~P0-N~t0=;}*f8NCkUzaW>(ho|$*|1)HR=C3@eYeiDLwJNvhO|=BdDsf^q8_VH
z`T7T)uC$fA;}w>oVJiLNe7$HN3)it8nfV<7h3n;6>hD^eLX6EK<C_k;j3SYtb1icf
z*^Yp+qYsQBT4^EYkxcR%t4^+=$2bj7AuC4_t9q=waMANrMtxE^$Hi8tv&|7UX2X9+
zVY(~wv>ut>%-MvtEi6nIV<sKHFnwgaBo40f9||YAxE|<SlV0GOq?<t0ulMmnu{vf&
zdEg->sLu@*80~q+!hz@j51N<l`xal~3@Gf!`F$xudU?-)`7P`RB48Mh;in4QA-xCd
z^y+Tss_wK&h3%xep+oPLh3#5Pb3vc%AYBp#jxHG`J(8nMuNH;+p%E$l@%0OvI!(xf
zYg}(ZbW>Ed66Xa8&0mnvLL{)gPK++BPu~Ys@Zb+U<Mq+VZ+F&{3egE+dbWEy3`3kn
z^lcY0Jr08$;?qr!!;s3_t*AaF*{nDWX>xjzQS){?44HasoCBA=gTv69Vo-qJCZj7l
z4E>NS-b2p8V}E&6-UflAvBMB2>2-(q;N>v10Qj~Tg0?RL2qxeVTPXs|od-@h42>Co
z+!>E`U=0Mw$!_TW?K>o)|H#GGZ{G<*f)R4X{I|!!eWS9&P><XXo!s@%V<8<;SATXG
z0ul8c9a1J7=#IMnuEXHVDDK@c%J+HHX@|j+E&IE^&NxqrLus6C>o8OcWC2tB%bz;b
zzety))2V;CWi0vAp+06*fivpy^Qc=6^#?|+bw<$@()EoqJJhckb(rN3t<<mGaZ3(4
z)LV@EkCW||M6nL!?qF0&7x<-X9V)#dwupy39eCvq0>mW&m<#zQP^w~ukr(wmEak&S
zzQ|eYAwV$J51Z+(kLHEixf+jL9{kdw(ri7P2noxp1E2uJD9>2pP~Six29PvpAx0}s
z*#_FPPaNtl70j>obEw5+-UzxNPXM&&hmDZnh${|tquzG1GQqt`Z#>{>cGRIRV6{E`
z5KOJE12tqv0%+f>Y|Ib1H0&pbnhgTx^7|S-bd(Ulb`j@8PYD1VN~x1QTlbYvJoyhC
zs>{pyp08Z8cyu?%hu#E$7-8r)X^cZn0|k0K7|$TzV_Yfj=SW1(F=B~@xU9;L#{Swd
zhdS6r^{ta=aC5d7r})9*06E1Eaf|PE&!P5lGXBuo$=F92owWUg7GMU-P48#`S!W#T
z0KMR#WZedn9covX7>iR(SMh-Wwk<6C`A4jMhC9?~7tu;5QS@^n#Oj_BdTy&=huQ?R
zKYZaV*CzCpSgvW45EJ68mfkA?#95MtATP<pu~lJ?s<xo%hZ%)};XNH{5PKH=q#wN@
zh6G$lcelu3X^|wJhzej2WhMXE%BiQXG-cZ0ppT2$Dt}BD8(jRlD2Afg(6RXS26RdA
z9674^b=18~1!gQM)(2RP+_tmD<>cO}bC**EdVt_AM-y~$mm^ay?(!(n1<dOg6_=5j
zNld*_%)1@Y`y2>b(7t#%{wQWpoo`fZ!}CwIKsBmqv5iTXy|c_^_MeSG>iV+spN#?9
ze~Ralrl(Fbmzm(a1ybjR@ELZz`ugGm1R({CbhD$1vm^m9&C!{%M6gacLkPWQE5+G5
z3-m~Tt=P;oP9bE{m}0Z5prDhvto<WnOKo5=N6(*r(g`L>_r@~_Ccz@O6q-cCAxhN!
zxOlWviJ$3-K`L+1lL7?OXu4cxma^qRF}uUhSn;K_!LA}OE5(CRM=Xv^rMT?gBV+AB
z-xv2M>1>^pFAcd8?jIuZko(|$#XVdJuha>9h)gEdV{mb2O1LHwW!--<w(9?BG5zhI
z>5(J-_Adx+?-u&b+~QVFp^vzS1j1Hsq0M?1H$~*5c4fzYf!#?i4k1ba8LEh{5;-gW
z^}WTxA_R&IFDkA@Dpm%lxM<;|x=~(SL#S5cckpX=LoF2zeQ_hZdV#@c=)a7VhK>OE
z5w|-7%ryhxXu1*?q12P{@D~et(7S@av8!*R@%>^2*uJQ2`me^oepohqjD*Fvo;1cT
zcPNRq9&yDk7op>uN?-{AOY0%vhrNf*XJ<V$!LGiK&gy#>VA7vu@BeBH*DNyH$|a}2
zjKq-epLOUShA6wr4>13-)T!;k5b4vf7`6UmS9dasuLpBsbSK7oB@Uq0LjW`l5r5^5
zUEM7MDbiv-_DVkVkqAiFO6jg)1N4MlWdr{87D#(!*wqZE@#`&E8oQbexneqAon%)z
z#3&WW+^;O0i1+MjY9-mdV-OcV8I=A!=n{gc;cW3u0d`NftGQ^GzkUrs4f9M$|27Yi
zELv+<^Idf7pV-v`7eKM9xH?2H@U{o+G9eP3n5~x~?iVW+I07l9C~%uERh9y0`M(Sc
z!!cL4mUgwAa!awnN{N^j|Ej;<T9?k!2S-rA@BD37>B&9rEhZU2`YZCDhB6q^&~1_d
zVEaCuB?YCsdQ5~`jS#H>nEjE?6wwmvW2u<#9nJG&4I+DKAmHnKGQ`{U>pR7=Q%rvm
zgOzdYY+>bC_xHfL37jmxINeyk1BtJ_YEwU@8027mPn&w1Id~s*mp%nRTZaod8+$5u
zrRmcAcWQ5gCqo#gD8B`k&Hvq4U%g&d{yRpn?`-NJ2>4AO?E%mxWmL*61L(vUme*Y~
z!XqGc7m2M>UH~-L9KuMvD@uq#SJKL+=96x(lP({tn{K*%X!P4&6r~N{Ptm9pN{@R>
zHV8s}A+<aEA>~Rpn>v9~esM~fz~=8tZ30!>>*SmyoFbA#HL{5`jJIrRFYq(dzjKNI
z${hrteV|GZ-4rNJmGlwMSG*Y?*PQX<VE}Y+$y)M-P3`28HP%VnNoXnS?V~o8C$}W2
zRnF)LG)K3n2$)=VM)j>`GOp1em{w6ZuQ@rJ3a2w~%@HU@r|Jcp+JZoGw+TCH^<9jA
zIT`D>cp=I9s1KcX{vex5Cy<H!(Zop`D70F2`f4^+f0vOe4P9<?`wD+da1#4s@DdZc
zZ6RXYQk1ide7m|*X|d9#R(GXR<YcV=B4c%7WFkT5ZK_JzYUrPTT#&4mb$w!Nrp>bb
zjqpD{L2He*+5Tpg%lK!mZu<ohf3g{O(rmx5<#F1LhVvL{q1|A(nCq~8N1~=6sy^TL
zoisb0=zE<A)leL5`wx>wVf@(xgsArah?aCaH04~X?R`d<Lf)}&Y+R4{^Rl=$HeSvt
zBXjGmw$lw^XeNMt#uD3UOim>{a+HmyKIJ)jo$U-dt&F^TQfy~9?$8Ix>}@+Qy5M<Y
zn(ab$%E8*H?IJ_9QqG^>xodla>E46;VLPg8PS?Nu6Wb0IdW9Xetpt3cApNknY%674
zU;&((ZQ~1?PgtEtB5X_D?!(O6wwa8Wf(U5IRZY<n+RtRIlv0D)Rh6<Y{xbS&p|*KW
zO9q+cjcrL}EeC6p!?vV`9Cz>>6K_l6Y~U<1vb~)x1woQQE!IZAORu)9MYf@2zJZXq
zzidO9E@N9=w+)pN@sjp8*3FO*U`wQ1`{X;F10U>gimKer)*TUl1?iR1Jp>WDpK0sf
zf_g9u@(y4ei=yOZTSt=j(aAf$K;F?!-ic)^<Oes}*n|H{N3sL5zq3VfC@@o`^wv1>
zN&9))IQbTzbX%dVF&UPF;b=2kV>BT>%STde0gN~;5oK}z7#nJ>7OQVE>?5SNeGvef
zuRc%B+^|?>UH{D$dq%y1%5=}y|Mo?L+2ES5|LrRtL^U3c`kU<_>fz$2<eh}1!248K
z$6=>*^J29&I@Ogsi`7cVh~akUvd{l9Hqs_68w)nOV;P60zqxR>ebKVsP#wyk-8H(p
ztQjM2A!7N7Wz9HpvXjj<FKdAysopDhmbHS&+nv3VrYXxJ(Isw^WMbN~uF{n8oZn(u
zoREvmE6Zv^=0774G7QW$(I#b49|_ciGFV-tpql-if~wD7=F3_sg`mh$%lt$T)|Zl%
zWq#71xYWO_7M6Ez?FUKQ17)}WMa~YE7?vQJ+xbXptq&vugZwrJmn(Nl3`L?dz{Io?
z!-{G$n$HH&E0UJd9WMiHD>2NVrr+x9Gw3$P`6NvS)r=^Lc8bb=QB=NU+E+u|Qd5b6
zUz4KG0eOReDlv?JynkEx%t_0H5V{Jt>Ao#J1b{je5Nj(jjFi=4J*knL2<LN6WJSXg
z16%yRi=6_xv*=s`x_2hfd3uCm9CPc}%cb9m;u6C^=8uJt-=f4YNY5-}w;fetV0-`f
zM+Bu!0+8GSRQd=&WCKvSh`vq<EXFo3%BD{(vX^ITC3x?RmJBJ)_XMD2m_Sp1zFUcb
zBOH+Ow25A{O{FA2N)2UzqlO*cDKW?ZS3$n5u_XpJ9CRw>so5t71y~b}4ev$g@=;7X
zn5dL*AR5~3&ehQ{N({B7Wv~J^jxACDgoLNul{(t2EZ`a1$(<7QFUf;Yt51a*a>~<7
z3`WTheXt=DOVmqXWpny3S4)tLdZ{4-I!g}JOED~c@S%j{OIfY50oooYQLl&)>4YWf
zFM2B1B$eto1Z7f6)SE&9@-UEpAnhCA?doMWsbC78y-t^?_r(zwXZF~yCF&2D`rz~&
z+ePF3CF%+&_e`J31F)ex6?;Y6h%^iJm5$5-<WWEwJZE)-uFo1*uBq_)7uDIQ->@h8
zl&BkFP-OOl(oyM(itk#Y9*{@6z|&ims0T$;h<{dp^?^zav=b#Nck-z1vt*wn<ahxM
z33n*Q-z-rVxzeLni$yEu%J^N0n#o+9Mm&o<lP$8d-t^VXSe7?p(0A0V7xI{ergA%9
z&(?Iw7P}(zC9k5zQM7N%5_P<)s7f8D=<!lu0BHH@cuJsXw0w1fs~fOhCy05{Wlwss
z$mDgqIJU9<|0&^Wld81yVe3=-)K@TiwWAYzYd_-a3@TA$89z~vkF85ury8*sdG+N_
z`;ZdVi)8n8GA|R!s^en564l$)uL}H2<Zy~~xw?Hz^j#b_LfAC5mW#~L>U!BgL#3ec
z%}Ufznj`M~w%%Hz@?`_|!anE?4N7Et$*idAL9{@Keu4}tG}}j;mGC=bN(HQInor5!
zP*w(kJgww!ALsL&24xovmBwl%5S{x|iONG}7)NVE+*W50Pnsc!jf51uTZ%3h5+CVT
z@+B%7yWFZFPfz?ys3wWSN_{Dld_D26Ur7Ax=ZTkmjV_GE{IZQ6l@hekphXgocnVQ;
zFih1$e$hj?KY;jOb;L30z|Q|8>^-2XDz*pib8bsQ3JEQ6PXY-EEsYRDLJJ8^s`L_i
zPeKo&geEs!x`GKML<I#A6&0n5SkNHo!-inRCn7$3k3LkM_51BP=Ul>nee3(O)||}V
zGqd-eJ$v@ldrmp4Cf#u+V*0{GTKRj7#!(X^7M5VE@3oXTQuSU}{$5*4D%{k2Sc#Gl
z!+5W+;)HcnJzoBN9gn6v6DTora#e}To#aV?A73Hb=W@65@gphLO>SZO^x5+JVd|U_
zA(nE#YGHEHb`O|i2msA=#A+o<jQP8qnV0TLP$i}{7MoD#N98kYy->O!P&)N|`DWD@
zO-faDna)N{q*0u&fgyFSs8A-M`}&s8i&B-4)UVCd62Zu@OX{LPsw>D$y{%T+Rc5Lv
z7OHD%m0N43FqOdnmX`Z6ME=K={28@soTX%@c+$(|*{Uu=i`vV+h!WX#n@L>W3So<!
zdqXI>Ed}d7wNm@uB-BuqB4&jo&#o<J2-4kJ)ku%Kb!zwWmNMrRW2a@+8>b{r%eG_|
zf(=n5ePVetDKfI^QL{+1TE@@}?{6DJvp#l__O9~!QsmL9e<<QxS6;vU4KDTbZWO6M
zP!;LHG2(o`i@iGCeI6z3Uju;gf3<~9%4v=6zGBV%h$%Y?Vdh6(dgqIc{H~r9^vD%B
zDcDoZD3MVLdH`ngjR4#(=RAO_bf}c}gi_k~hToMgrPo@e(^ctE+3@$fGNeJ|WIXk}
z-__oBD>47`yE0Wus2mdbU2?3c6^xhJW>r+MyP*#$SY_%S839G4=-NcZ^(vzCs{Af*
ztYj0{(DqHgE7ole7Btp7$B{1TF~7?tgub!}xfCJs<V_y*JO3srNY?Z4aQ@9az?v=l
zK*vcIyV^nK8=2*GW)z_G)ZTvQuTnbCD*dY}Erh3L`<*{Zk}U3p@Q;C{Rd4y7?@Q8I
zE9rf+Ud%E5&JWc5mx`2Z^!lB0o}?-{c(~vBA%NPTyRA)Cw-9%{?>04hABI!4ko(vo
zR~@L`*n@uOGb9De9c~fgnH#mE0F@hiP=uX5+3!3i`Py3fj{V<!vnNZw>99H|`D7<_
z|3C;H{J$BeXRC~D{LTj@V~IuZL6uMO>gspymZbew(r%Shl~l(a<7?n|ZkMzdthDWc
zV$(f-=k1d8vz2taN@8Qm@7$~m2b~qh`JG!7Ae^RM_wxpRO%IVX52^heRm93S&n~pP
zuirV}Eaaoq<bi%CcWCqwncGUKDR!yJWBpD!O=LPwzEvmuPIiOz5V`ju`FaP`o?hm6
z=1S5wD=Alzu=<jyJ-tjwy!e^lDT8!~?9&K|&@hz|7aH<>)!<NfoUf7J>5&|k<vQgT
zQRX`D<PUx){#&o(v<kBWZ6#HI<9D#>q1S0@COLk;k#yPbxF$)mP=%%Anwf;_h>G<)
zK9r<=YI_WzzFari89Be8Km&@Anp0}m^(tqWJJDC^cYLJOW_3Hq$5ywaX4U8Y4h}^1
zI<H%7-c@YuobTVrx$05BW2NN$(#p9qpvKV&e#a7$LhD*dOB4}HjXu%i=mgaiWBm^4
z-=RrX#vA>6)gZqd1M8s^%p_gDarV^~X3m;l|BF=;Q$6W-x_oxzJvF%tJLA`XmLl?k
z0aT>_9FS;LhF||yk~o_4skCozq_y<xmnH29tJvj0(tv;bvZ<<vzGo%9SGyuoj{*Ov
zdU*Z%3*-xHWaWFImawO535zGzd}_5&ve9pTc2|jh@JYY^q!1Wo5qPo|0eK69U0eB*
zOrZSJWM+(_*;d}`*B_Viw^`*MuT}n#DzCC__3ID!m3((u`5q3`b>%w0F0+!bV^$LL
z63Z;tUG?kii0R>_R?-HghN{^S?%uu<zkUa3<?Q;D`t>_);Ffs5zEuF3m!@<DU@%oc
z4y<Hvlr@B`hyA*Iu1D2s^D)1^%LZ<1<JWfwWItHpm&Jr0ZuL!lwUW=L>b1<TFPF4u
zpeilDT&2|-16MASe4SeR^<v5QiIuNd<ueUwq2jB^P4Me8$rcf8Wt&+m+w2?JhWhns
z%<=Vz1S{V(l}|_nf8duxYds?0N*bb)&_r))H4LQE#EJsH`N1u<lUqK|uj4dG()79=
z$s>8?=aA~CNAh~4FN;3Uz3<mUWcBLntnQuo&0AfPwB~OAjrG8;>wdky&27{<zuv(1
zo*9SzdP9{GI+G^IP*EIM#E;O}In1xiXUWW2bX^B1#%H~g+5O2?S2mRd<;$TU3p~NK
zws112g0h^3-qQrtzFDWf{(q?9d!0LS$0Wf|zcXvQS6wpmUq-psB{TnJwg%L;9+QvD
zY=uNkWTwZQf$uu%b@$3Fk>C3KXl}Crpb^;$mQxm{5AVs2tNT8`bc(uvL==mwc)Yoa
ziwAi;i!3s)9ADx;BQ@U{6{bw_U#xT0E*6$}&W>Y<uP|?tEdU`cCosn!@$Z3jWTMZc
z&H1+Q5!!oXEq9yD98aeE=SwEplnZ{!KObARHqQKurR~(lnSZ%5C}ip6^REzD)K$*?
zL;MAzC`=)8qglQ{)@21@OP6VW8M+wF;NdH%=N~Cd&>(dj8L!Hau;Nbtt%84=!l7mU
zTSc?#Qrq}leszGcQ`4h7uqCmJB1ioBM8EvnOi7uZ?>G1E)Rvn+&&Fdo-A(qi;j_Mj
z{$y!Hp(ejt!^V=8oW!xjWaLqeh#@AY*diQi>W`5^R4!^d8ELy1)pm%ms)0XIv68LZ
zri;t&qY_d70keNi*?qKvy(6mg5*pHd>gHjY_--w?#JbN-3q0Sx>}48DD<D3yS=q}X
zM?u)a#dEc?bBa6$8})XW+{`L_NGyG)CMMPP&9YP07+24nGDrOkQ~A+<2a!Ye-V@#_
zyIn`a88KyxI5yJjjf8Lam1Rria(CT&Wy^%nb9a?3S34TS@99~#LdD@(?-rBG3Y>)W
z5fi!%X0l7NAM!IBmCb{CP*GVvRj;?13NF;j#!CfHz+lMMvMEtkv8irGGbu+)EIV8#
z+jz2;t}pioHu=liLRH<;ezUTS-=d%(@V);iYuiTRaL!s?ruMW?M1>X4MKkSLnAMLa
zA-S-uquOR7K73GFSEV50%`TU9mDZKD;fjJXJ}XkSzX22eJ6OjQ8L{ENvjVQa7B>*-
zi4Ff#*teY`zqXGJ=k0#*6bG>?HvDf=-p&BHy8!@$i2~ds0TAu&3_Mb7_&=&iqe4rH
zwb%%EeIcy+U!y^t__5BjvEf(3(NF!~BTMFYpG*ELtpy65M)WF0)r5ON699x)K>b@|
zmE%`KRa`uPstRHpi>g}IkcHZe;MnkgN7p#IRwJxS-~Ad2jlLNEF1D%V*62@u#s6S^
z_XyfPIX3)X;-Cb5mj8(~gWh20OwkKTy#&x_jbV6;4L>K)E`8>h`HL3;zS0|TuU<4}
zT0tS;s{%f#7dFvCwMWt6>ugD%F0V>%<c{@;0HJB&FQOvFNtB2H{kW^pCpLTyW}?ty
zp$A2PhK(%&*4!e1Ex=lVVgmxK>jT(4Ai#PN4*|rvHR&Rc1@eH)Ol@CLZ1@s(!W0`9
z|HBlURTi5ieWA3<W>YHAngE-n{Qx%x*epW`n@w~P92#E{HXbVT)`6<@Xm`WesTSG1
z{<X<=kGqL%kNBI&_Qdm=>Qmb5t+a=rEeP@0@b<B>;c_XBj-jqgX&qxUJ>iS0!!Y#8
zOgvF`gN6_W2_Ri)0%06L!ZjkZ2{Q+1&ZGaW(T`+m{8pPMtq>dbj@zj@k4fnzghc{K
z={1Da{5V~>kh!b;V#n1sHhf};rZ@W0X1JAH<vyF^y+FHcj*kO8Ho@X38w8rGOKol^
z!JM$UiS503gIm7hhHXrOTl8d`+neNi!)Ep&zz2$%bn9;kU#t36U1;oX<dgdRO1Nfm
z&=Fs%rL;zUrfUxM6cvPX+^$EzYjKeubn2lN7hT*(wBkaf6`_T##3HWo=tp>Ju3FX7
zGsu(f^qE@Jy8(5*!L>}4;VE3F!nJXKn=2a96@ZlbXaX<JR86PP0GMWT#d*M$=gnM;
z$urNc>Ix?G`m!5bcW63gc2FiVHoQo<zF>3RM7a$D2-mv_RW{d$0Uk6J+SY3-R6h#t
zu+4?$(yPVFOau8$)ax1^8@_<oUnpzT-yjEH!!(J11n{9v{Cj|J?J9kzs>JgqYvdj2
zn*OWB%n=-h|HZ{=bhD}9RTsSOh9m!MZF(tA+Vt2zNvEwGQAx^IMS_#t1dhIhJj-K6
z4FKs0^yGT<bF0fe{c~)%yb<y34Bk%Sj@R$58gIB`^f#)O8SV^yY1Ki)-Pm{{UXFHS
z!!yL*=!VV`!YpXg4L>$a6*<enZL#X?ya(VetIo~?01sJpK6Xj!EYF*o(RqwKN31$K
zp9gr39CX2^p*8x^L=6Qv-;E8Ar3t-Pq1%-Cr1L!CRRMgsSLe@!A8ac>3Qr316nkso
z)^tOxN?e5tS}vCW(roNBy6OUmt8g(MxMD3qj~-MMc-|za3&t*9W2{_-s{=rL=5Us;
zI9g3^&G|)acx&PKvdyt4*}B^t2LTMUIZgx^Z*#;IAhS4x+WpFfPjwaA92WtgeXBDc
zeO(pt@lPzg4P0Zo*j#;Nz0Kx&JHSSpE3M<Y%jT*Y<mmrx5Z8m`;d`@YJr4ssaf9n+
zaUn-9!?ba1c#>OdtH;neOzl2P)~9W*uK~PbbH#1BK2Th%;+nb}jgz+cg7BHm1+V3z
z87yTUb3vbGjSWwxTCwpK1Glu=KNbUdt)IJ&#lX#U-`&_`uoVX43FWOe?gWd0I~^eH
z27_Snwd^~FrwD^PZ3cKQH=qAj_Te4`V7Hc=)^d-x9J_qp7fI^W@_=qy%5ArldznC`
z0XK0hPI>l5vEiu<J4#n>oS9pVVARQ7K@b_l65V?V_gO7;thF?<Ja2Ln?#IaUh^ksu
zc{6v@h;L%UHJK3QLZoTOs%M+In~h!=8}?};xDycg47U;|qkqBzL}Qi{_9-KJ!UAjb
z5Bp4@CHCka_BoS`gcY{W2>YU^=`+m1w_O~AFF)%y>w!abR|_EZV5oA-P^IeeF~CQ5
zJ*XIB@VvPm-;n1kyNP}S_$6Rz$Nm&c<0+OF_BGAaY^lZ6<G{W>n#ENX*`7#?tEV|Y
zoW=EcuyB>97FMgRJgMYKwzzt70J;PW<9GvQ7^`E$z7dX}+Z_9n>lT|~J~MaED4Syu
zNd=Z=9FKz+zOXj8g`_XAxiP`;tiHi5MRB`3Htbut#R*AqQ=U5sn{96Q0qnM!JppiV
zfaX(En&X+OemrmT8lI=g^pwr<6@Y);;7COf@WI%y?}X#OY>w}c>n)ojE$8{j=J+GP
z_qIa&N}C+-OZ{)=_&b^Sz^L*VL2ed6&Kn%ZD~?BE!@h@Od`F98P$an`ERI120B=KA
zh7*(w(8lICUU3u}wH>1`D2q&)HplJ&xdF>LUZ&K-Q_9pZZp1%sa~()dd%_XKgd@nF
za0D^o2(l*}P>_0B6asU_pknf<2}dN>9<+jBPdKWEB+x6G+iW(Gw85_24uEZT<@N#W
zwJWz<3Ci=P$^|`6p2zIEodjUqwLIhTYBFoiQ?X&cP_O3YHp7?6b=IDe23-Vt)8<HP
z27P4PXSFi8S8Ca35PdMn?t?+}zo7r#(4-n5j>`bSocUKcCaBR98x5v~gLSKl!GZ{5
z{-+vHejF6+wd;6U)sg2-bqr=!8Qj9EV{isQI`cQmGwnWpO%>tEz!rAho>>Lwk*gaQ
zu<$jZ()q>91P>tevv^hgC(+$NTz~K=!U&uC6o5$(t1B<FlE*O~ae4jl&vj$N-WMOq
zO7N(Q|7wMl@V@0E-xq=2w|(R#fi4Gp<Oc%*KMDBAe_Qh^ElG&amd81H{I?UY#mkHh
zyC{chi7}CC-57SUlX%psJuSFsu_C6Mr$$T3hy7jRqFb~zSU=paP%=o3jme|qBu=9`
zN1vlA^9geWI79>+3|^+$1r}-8rE_LX4=J$2E^r5VHrWNL04k-xr2cR?pvm1?=i->Y
zQsN{-h;uO)u$+@dH`O#385U`dM``xNH*|fLvySsCh1@7Yg8Yv{@_IJOx!FSg3epk$
zi^4Gnmy9h!RmR8~g;Z4p*%Tz#-+Xl_yk9b^g0$&yKHD-ZM&1%lyJ*Sp@PDl+rsdc)
zIkSv0e_cpD7zKkLl)CpJ+jUj<9x)w4p{43RhGhCh@L8!ADsdhy0D6xA$(DekV}4ht
z%RiX7VzSXf3nne5qCX+$$F|<S1NcTM8fGaC6th7we79AH5(R|WpM>9q*&vHq2y>K>
zI*Qqm?<tn3c!|NeVtBE+-m-%eSAOIlazzvPT8~q%;e^mRLRu(g^)mI}vY#kt2{&z_
zGDL6!FM`leenovXCQT^|g7TyK{$pd(nvf(rMpMqmq_vbi6wzw0J7c0ut?FUpHO*Zt
zT6H8hsp`_&o#a~+Q=gI4-8MyzL1ScLpj~oo%|yRrV{7#AM5?JZn;6p=b7+%BmF2fy
zAv+068v)!xmaZBcn?3Gvj6#pC|B^f-5P1Tj1!`&bIQ1J#Zwy^U7%#v)x*U8$|70`F
zITm9M!}*8t;&SKMjYP&0h6zwf1kV|EPfvh-u<A=GZc?<mT~Z$=<t(8ZFX<fnPmLZC
zC+*YhZ;vAaX<IQRagJmC62@{Yi~}}OV!?PFTZ8M==ylUI=RI%gJ`}nY`I%ok$F+jS
zRT@j4eC*5PV12B&W_|3GAMA(K5PpF3xE{O`1GR+fLT|8?r}WtOA&NUtPkfli!5f<N
z*32uNV?QS|4l0~8N9Wj|rGV7vNwWHO2q*FtNtI5Jrv;&z0B48{BMcPk6Mw4Fqb3V=
zp1l9X<LE&hTQhh&CsFC}Sp*?5i3*1=CM*;Hdk8NhtP(&7mlL)K(2mG%g6}SYm<@$L
zK{$x@>ET~#&IckO{x#MnZ^+A^u6fZ(9+e$Wq;8p}7rnu&dGQ!yvo$SF)vBYZ)^Jm;
zN~^j))44U%qw7VEV64XKMmmj#gNthx6HQ<6wV6Q`q#uPpO?ZlCij&$)rwxCFz$6A+
z98Zfyw$^agamg`>)I5pRfpa|FC!Ag#{+1L=-ibgH))4FF(fP!wp46y4h>FiaPb^jF
zqi!%0cgv$f9&7942jjZIZ{h*Sd`b9Jfa65|BK#phHOCe-UPK)MUMGSgBSglDjF1sS
z2-5K<enw;*fvSkQB2mQn)PV4HuPfn)#xxV*zqEvpm<9icB9VS5Mm%9A<us+8Ngl2}
zkn=J*C*T1hmJ^othfk@>Bbu1x;a%WhXvc`#39R<07ZJK=g!saVYl+Z-BK8W0Ng^fH
zj5tc*wWO+=zKGL6FT?>=%j0!<T#^U%QT5QwdL*z~{~qI@kEy3Pv&Ic!B7Q950^vL)
z#g9qniMYa#GI@Q&mZUX|awE@CsmbDYQY+G?X-R8Xx5;mqBYxAWE~mI78ZwcrOAo6n
zZ?Js&=cM(V7o}EI{gdKu?0d3$_O$tPw4@CUkw?A!@yWC7d8b~f(MCN7N(=frX*V4$
zMW&dkzd-~GsJj|KuFTy4asjaZx?9?l(q58rw{>?B?iRqXlLeq}*F8vh6hEz}eoO2r
z!jmX5NLD0i1AxvFs#n%%qZ^A)Ue4vYnT~}#)vG<9d|lTI#c@mfD_KWpDp`L?+9$Gp
z3l}Bphfw)ISc<FxKxD-h>#`2<AuO@~5`L0=2+g8Li<CK-2p!pgP)`8CVsDYj03vf_
zCqlN!{EH=X<Sk%&h|ER*zcQz-ARBe`X<D!==?D~3%Y+MRiNv!<%4TcYULrW2NZuHz
zr|lquy+z9MHf<x3?S!rH4|WNETwA2%-z~t4L{MqulL(U^XStc(m(ZblBj-6=jbGuP
z3l*vc^)U*LKCJ1<O(>vuMkD+X{}8%*Y+2GGxw(=0Y(&ZYxmwbqR&uNmgok=5X$kX!
z)DN^36wj4d7ulwk#~OKT<k8?k2vL>>df}I(335V_mTwZ8kb?f}{~pX?_~N7q7^oUt
zQ&uER$g|?X+mj}?wd40BP3&UD*W8^n$;R)xo-_$*RoU>;B=!4IIm&_CRHRE=VoR5{
z1aT4;$V0_e5c8ShrR5{uEA5i{EAiem#p~Zj>Pfs*OX{CtamaokslSpUf{xaIkaRS7
zJz17CP<VY$oDMcrb+7>6?_m`CCy%DOJXjc8T1k7;_XVR%eu@#?BeF&xPy5zW$0j*(
z@iR3exK};6QqM^Ge`IwN-rKq#r1VsfQFRI7Am7e0f_q~K^8Vi_FQGBWxGzD*T1Y%<
zR6_j1MJ3R@B~+77b!qZTrKmI?S=aMb!oGE=$v0s76MA6huimZcIq6~>OEX8+=rhod
zmZIrx&v@`W`9??^yl2i3hK(6rHRrxVmW|E(iun-I_0aV65J*ocGeR;Y=RC;HCCp|3
zoHs&BK<m1$`_u?ng4S?*^NJm%s-rK0S&XL7>0hHyh?7MlPvkR#hhyF8$#NZQ&S=R|
zw5vv+<Pw+3levo#yjgOvn$(Mq!)_^Ii2w(PtS9(ME~+MSA7Qt)lzD2mUX*@a(Rdvi
zE+hEi5Y~nDV?e8&=+p&9@BxOEc6XrU)CEwe--gmc|4{*Y(rW1hKBBAFA3}t&wcc0(
z=*jgSCfqLoJ-HrB$a?=0@#|;x<gvKMr%%SEGhNf$vBKBu<J0Q>PPi_c;q^Dw=xh^X
zA*r{=Mzm%y((7083s*|i4;ERNr|I?g1EmpK3vh@CMp?hV0Qm3vMTE%$Fxc0>gRnt>
z_lO)LJm3@PQ)0gon0)E=e?ZX*1Z+pGk5elVqCy7E)Z<3*Bcg}z5hRsyuR#u>iwJU@
zlBrJs4JHg&Nr~f@MckWWd!4Jc*QvpI+fK))Ej3$U%4KN*p8OfX$9bEZKI3eSK9%th
z`qf78i?C=v2F^3yg2yt#Lg8Euy1)&zm#|F$`b-0c#|D=KXvR7biVc1hAPIoRYM3Jc
z?xx{F{BOf?578b4+iLWJbCT20A7BW{C}$ii*bn!DBU(1ksqp#__zO~Y8fD)hT)_Sd
zud?G=LT$rV`BwQd5}UVAT%k1&3|Edah+^~wbe@7!5cpCQ6IHhN^eRF73NkJH-zNSl
zc&0Z6y#!5$!fKgEQ}uSjVxe#0O)O+wEOMX>1ev$P7G$|^`AxZ2sazrmQ+Y@FiW+^|
zbfwm7hA;RZD%AcRC-{xj=sN=27LN2v@?vL=l$~93gQ3A2r4U+Y17K%qK@@ySQs@bd
zdJwv4eC96w#TtEP9;_Ia9O?f8J()0G@zx7|gEyL^bbTX4XMLh)=Fz5wjmT3<SSUaU
zk?n*#FalNLGgTtl(5JIR%xp{36gILmK264BQvYd}KqsOl<_X};qSK|Mmex%%(=!j+
zyyyUpWM|H&m|^pczOhS0suDvjX1i)Li^j=BD`ii|>6pw`k)5Kshimlds;{O^H$oy&
zY6qDq<UUUcd~&qNoBJA(EJ6mBn>L+1xjyE&(W3~%dIEi}XyEH99U;kh<mfqsA~dV#
zUPrSBVJ8EA?q8s9C*akDe_kAkC#6->78@b_ibC(y2bOsQ$#Os8UI7@)qn{)k69E4o
z{j!gTtmM-cLo;s-&_{%K1;C3%|4rb=rJlFYx%HAJ*fP9q6GB4)wh&1pBnfa2k=}${
zY^?19q*2Z@?T8V?Ph9k@->|B-Ye=6=7%wcD^*DTOD*#s$7GPFw4}-oy=FC`tCt32)
z17=O;<m(v7SZUj>!D8{ZsYaMpYz;k*6>8X^GW1nP+k2t%DFp_@pe<(G_ypm&O8T0l
zA4!@eNi@5!F@CY}8I|@YX@8KmP7D`CHYUCCcPu3xZO<UaBB;~qS^K3ZuA(u@Y5cn+
zr`N5~XHzYed`3z);26IlAxb6pC3&rt{2xial_a`Slh(3NqtCovYXqGiM@Cj!dfrjS
z(GVkO9ZlJBJ^E@JB3iDdSRVrSaP_=5P=_G@4FV_7WVQgG6QM^oIn3CW_cMZ@TSnw}
zM#~;W0%@XCadnYKP#5w4*~K`VS(ntHEdJq}8huW>IQ+J)jG$?C$iRHsk&b$rpsXe@
z0mvPhCSMXh6~S6jr*@5i{viBD3$#lBn?*s^ERJ@qS?DlV@rH_fXqN?b)hi{b3r*%t
zCbU8xkqc)kQ-kb(q^)rXg8NR>yVpkvY9%1;KU43c60T|b)Fvb(lbH!CwV2(N;r$H?
z&FO0r>eyEZEmnl)EV6Lp1-C-sd~?=X)E5iVq~1>4$(+qX-K1<5H#MYpyceX5UklcX
z6m!0_sM;gmg1rj;r{*l)ig2%xTRM**=eD+xS8SwDu+uH<e{HNFH=ATT)v>u%D++gM
zj{l@;dZ%W!^S)ye=#*(Ak$+wTLD~pZ%q(i4rXL?GkrA4sqX#Y%d|X}_kOaMz7Mq!W
z>Yl>wuA=QOXZnFws?=JML`tENnJuN%ajVcVtI(_>yO6t%u2D=fy>4!Ebb8g!RHo2Z
zt+L-MG+#-Xb(dY(+0iO`%`Dp4WfwgxMJI-tMLQcd`gMhF&HQqqrg!dWqdzl8UzONP
zbG|d4#8GzQweFf@V6dL9QuDc7vFmn{7m}>jmuiJHTea3i>_sJ3+?*J!idI-$4_bt0
zHxR=#$sV`T&e&;js>nI3TK~4utbe3l7?uq2o&N`3Pgi7ca?U!zn&^KD4lyx?eEdFL
z?>0=+yR;-9+s1pzDR#J;c{E!<lZD4ry1B~JMde|<g2Ghh7^7<>b+;)&mvOcPzP>8M
zan1SIpOW)AO@I0wiNLg?P$CGIUoH{4=BkrI#4`9Udn_UoltQLr@X~d=JZsbbPHK`Z
zQcVlC(%!Pt=$?Y+D_Le4dn;^iM}^Nbv(uT)o;FYEZyE!EaOf%nfmD26qVBkJpq?jX
zrVq3dN7#weVb9b^bR*NGLK!5;?pP`R`pP7MV!r9;OoeqVr5sAVU@P@53YyJ11Et8+
zt?L%DxbpfWHj|Pw&RW?0!Z50=>_s)9n}Om~W~GLxGQWkcvDkcUva#Ea@10nUCj&u@
z)PW4<c-C+UljDWHya9>L!^+qZPQlO{)tBrGebgs>nYLV8sI^N|Xx0o&Uim>&j(i$P
zUd74n%$&Hjj3hZjSg^KR{(l~_D$nWQQyB_ak>;2WZMDwyLeuw1^2ia~KD}ZDcgB6U
zTVA6rh=cS%*=Xt(EnfXyk~+ZlDsd)&-fkctod>d?x$yLk13A)Kc*+asW#Q??8+#YZ
zq`O;mjZa&U2hA8Gm>;w0Ie#-T>DGpHhD$HIs(Lr3OJ3$L-d(aiu^>fyvuN-EeU{yi
zwHcb`{MrcS<<ST!WP3%LOI^9)*?fa~i-!^1j**HL@|_IqXTLFm<+a~h?pVg3aX%Wt
zA>lQ89cn@EqjI@hsmIL8pgRiy_ZJDzfZWU)v`#$8ogkQ;c|QYre7zAYpW=~4xlxB8
zw}<kZ8^Pg>l5C4;22(8~CBCS53QL;^Qx44-403?1zxg~+u>5BG!hA3cjmFeebN!wB
zm{|EznFNJ~vG8F@o-4zFH86&<RbMzCoSgaCxFKdY$n6bIN{{~2GU%l;al)q<(&0nL
zTdq7k^rWmBATm#gET*Ga`)rQjI2i^*FIcOJV7wt;2&&5M?r!dTOxakJ*jVnaPOM+I
z89{%^-btQ8o%?7&>7o#TTkZnLQ4LW%jZKZ9e<&MynTx-<*FDU*h8e-E11QKsP0tIx
z86_9yYvqtFsYquFR&7UaHG&qaCKRTu&Se)QXmN@Ku=^3TxVHtczY(+~0yF(a{V>1?
zT1s|x^Y%=Y5wwh{Mc(7^smn}NZk{)P4dCz?Bj^x4N^1+Sb(9gLUM(-cOG}I({Ycg1
z9vq7PY6P{HT6cGnu#bceHf8@sBPffhQ+H?RH0qqKY@ba3+6bUzVMR3mX(OmJ|Cju1
z1m&py`;AOSly0N7ew;al8lJz%-FyS*60c*PC&fH_6eTTMx=1rTzQ3AD8WuyBGMHRw
zk<%!^e`R%hLGFl$z2_gSQg(NYPY7?v7tddaOq!CFz86nu$P!}84>fu{ZU$&t+*~7w
zFJ9=~zrk4J=F&V<p&2uja4Yl9so_kNDBvsHONq%OX>qFz2Y2T6?(flq3z@pcuttuV
zBDPj<C3g-7N#r{@N>gsPUPseRyUVIqPTVkY>aC`8J?aT=iHTzYE>pZ7GUPdy(&5OL
zE;uRR8)BvQtW_f4!i}~{V8it%3(m@;eTfHX`n%!zI$X!Soj^TX=!Cd8eau<*(W^zp
zy)Gve&zvhsT?L>jC4@O<7xt9129(V<Uktt>MoK^Vm*FYL+Xy!10mA+9(~1{Uz9Jmu
z-~wV;*~A=-=TO;GA!a404+v-Ci$QIr>Ujq=-g`=D1wFoS=h;Txg>@_q94mf;Pu+R8
z3zAlhy(UQcM%ID{4bKjmFn<u$YC&jbc@K}FyvM*^>|D&y^q!02r?LO%*-0M~F`M=!
z^b*DM5^H^C5ji%Bik2zGkG1?rPkU$Yh94QI{D|j%&FiD=c*~KDWfCicbI&&+B8<&h
z!Pqhj&168Ki<mFXw4Bx0vu0v1&ah_5xJ=6OrAnmFtQ4=L_)L+mTR7PXQ5<|~;xW#$
zrCtLhuMG7w9g7r|arst>Ns?k#Y+R9rTVhi&iBwx?8RLcc%+?~uxT_Xg4f28>qR=%8
z?bCbNlO4XyO!o2kNKryBd!941SS)sYnXF30dF4-&$0h7;#tg&b29Qe<13uHV@T+2X
zL!M8XQc_4OajOomL<`L!<R?u@7hHyEI89#xcRFcGJ6~<&uONR&nvziq*DOKPni-K(
z+6QovQ!;DCJJgD2)rx1=ig&CP?^G+^4vBo0NRd<8wX2<ULk8?~Zn)tIvc|k->k+6g
z$d@h}9@$wELyW5+thbDI$a!V7WiiZHAF9y@(%03KV-7=p&#m9m76&u>Bt@QM7>GM5
zyTB^vb8@|9AWwFIJ*#n9x8&P7-y-*U*(4eAc8z}P4h;v85@L8(H6YVNWE%208NMQX
zhDa&0%pUSH5bOK6-v#(b)8ZKz;v;FxVOS=ow?b{SZ!F~0X=_T1;b{oDKAc<YqiM7F
zEJC`Fi-E#uY%hK!VSoTAA$}!ci2&P)R1vn~rv@deGjnW}<&0WPC_Y2kf6qUuiPXu4
zhu=);eWt)>Xc7G){t3cC;UjlChcXVtKTUY*bw(xG)6BnwLK?VVs@EQPKhA^gOht6m
zRrqyOL^~NCK1`+eZ4A*-R6HL0ia#SX`E{E<N^1WF;i`zsklP$V;yJmc{<LIsFQKtO
zEs3y<Z=N7PJ0hJ3a`$6&HzIhO<~@1>41n)sWMC_$&u@}Ckd#@3BIzoF=7=v6U3_KE
zJM7sA<AEvnD$=eixrg`+k0F9D7QwNi=4===mtEnMArKyg%WZxaVWR-2h<reJ6WW96
zrgyP+Rja3^#rQKl*P`wrl@%%^<{F-+Li}|h-k6f;p}D*gCq>4?QFz(}AESDLn9C@7
zW&+AcXh;<Xw-(7Iaw%XcBmFh{kYXkEI>QqW-F{=CJ8}nQ(g{gImwhLF<o!TH31TTD
zY21X_ghBzHB|?iQtPtQFk?jJNqtlW9fjSl?I_=k2l0PNoVZsA4g&VR~bSf@zk)_0;
zOn1jbDsi?No>CF#e~2@*8AYBZ$TfkKtq>ZT0`vxfT`hem4Vv&1;YVEEkiD9-rTDsj
z_P)pHKcxYO9JB_6F}P(})%LqwwPygg_{L2CKgKN!ncy-cq6d%cLP<<qJvFVX;YmcO
z{xd{Jx55$KCy2?79Lw*D=!%K;1SllZhQR)lK9ag6W)d=_#_!z3i+Xd=X>z0Aj(C$C
zf2!IaGd!(eG@uuZMtnl)o`hVf{V`~c_yK4<L2llR_=5=UDp9)a$Y3H{30(HjM>Zt#
z5MiGH&55AH#HR#kON2>9;)^kC#>rvTFf7S@YAJ?m26L<d&EPGERf!h}=LI-G<TByk
zkSMAq@+IMO(eBW`vJ8+2EBU`msOnHgC^>#$YLC^bE;51>n_>B?elHoGB&pv^a*J>T
z7LiE*POOm%z69|R!WK7|$W0-A#A$va#6+=0@KSmuCN&JTsV9bIxNd7Q0QAcsDioUj
zCg|15<Gn*Mnx#bpOM-D^`%ZPEcMVS}5)Aa!7ZuMX4?U+vGm$`cnMa_}7AU<%7Xda9
znL(ID4Tn#MU5#0xc)&S|+~<ae%~gG%`1TR)$-0WLT&R661oD9JrY*_^z;IfeBv8pl
z95f7jrA8l7Eow<+u<9#RWK(?Dhh%w`a1JV|vd2A)mTvJ8;cbB7v^1VgYk``uo#Dk0
z*)O7`);B!4LWIpxeYl@oc!QQ9LZrTwD+fX)EgJ~1o3W}TmeDd!YIaTa46*y+*8tU(
zY@RHw4NrSW-pb`0eT0YXsRVKCBOu$dBOyzbI)o7F(lAecv1@qvJh6VOTyz*tBerD5
z*RqGOy+mX%;ntqie>kTLBZ|q7m$+57`-gu)(m28xh&mqGNb+WBTAni8y1v6YZ#~3r
z?<19DDj-b9;6`v3_{h6>6K5U$nwpT0SSkJmpD<#hIsLiSo&!$*PK<WMZocBf1ya;E
zYz(0C-l_41X8=+Ux+HCYlWVzzP$KG!N48;0frRZQ0oD<DiEvtgZA7jR<a}?~9wL7c
zWF#4OP}5rB!dgXhbxI#bCrp)-zG2UR>K?@-7a2#MHQmynWmWTsxEnSdc|i_xkV7VZ
z)<*HDVk^%<mB%-##>!JId5{b>FcRw1D`l>^FiZxJcIZsnW>_=QMu-}D@+&&S!`B}4
z!HH5!^0XRAki*$w-H41Kj1*u1k@<v~sB82_)EOhRhH|Df`W>21{nNB!!!t>U?Sa_P
z7s*b4X(gk^&^L+fAXEr|>u5z+Z}p%6UlTb>I4r;~L>LHLJ<B3)n1e-}RD{Zz6)}%i
z79uq*HFOP=hw-Yn_{JEXLgD+3@TE~&og=&~O*KZS?gM(Ca1m<x6*A_bCYi>~D1sI`
z9|)a7dfs5Q+FNGg%1m1s(!t6+ZH_2YHXzvF;#tTdLG9Nq$92huomGx;M~0mt1MPBZ
zZ+M_NBiDyav(N=yh4ZbER_^6Cx<b&S&zbw6L+q{m8JsQHGYuvYWXV5hWjQW)7*%cd
ziZRPXjJbS0W>svq4LRSKDz=T3jgTSF<Jk_qZn(b<1DA^l4h@e~vw8Qot*t!<=DqIk
zQCvIuwpqd(hWiKf%F2(DzNUuze4ykgtK@k~`qcJ>6unTp=tWf&4<T1Ig5uP?IbSF_
ze>dEx0+iNRlumJK5Fqq|A|#nReqp$u2xLBNWqu;QR%YMfK<*1?4fj2E?qQKu?t5C+
z%Dvl`u`0-L-zz;LGITnNT=#vf<A*g2ojzj;z#fDj=0yqlEe*F^pJOFZmzSW-;4$b8
z9v9Xk+~j`@_xdoOrOshvEPm_T)Z(|%<|pdh6i{c;bB23BK+;#Nk^^d&ytQ^o>7{uG
z5QyD4_uyCrm>;S(?A$|qc0Ts>+(Sb|nkcIp%cXu^Mh8TH&v19N84hn`G3>}27V;iv
zlG0?H;qFY%cFU!qb|=C~T2yXN1dO3;K>8zd_|2eA%r|_9MJ+~Avx+vYU9?%C=%VR{
zyN+FSc(GNojw&f~PIefsYk~Af&2-nbS{Ca1)uueJ%5eS0%gOcOk4o!|Dxv(`5X1Fx
zp!_wf{KpAW&wUK8=2zoP8D0NTl%hgq=fU+&l4@oV;$nNlb<QR-BHki$uC@@bs-lwF
zH)fULIvB`3&dPnTcJ3!^k+A~Tp@1?bTrpho4Mo)*M^suR%Ug)BmWXnN&TawMwm``(
zzZkA1W=WYky=fI)QmX}AOKTTh7ASh}qlPQXW;(KqRWeIy$YR>Dc1an$^A4ES=IU&x
z1Wz$sU6?>znBk)krstCPaPxu~HuPLM4K!`)8={;JG-q6Zncrd-SG$JIZIYs!1jP)B
zh5t2Ni7G|Nygl4-vBzvGYUEEAnNU?*;g7Al!fVrss4a9|mBKp;441roOv|;r(kNYd
zr6S7!8kp>C=Q&DO&Qm^Au8;f)A(HnP&QEM1M$I&ZaDL)rc($9%DF@DWb2&d#LeRSg
zTrr%Vds&F7CEad$?aIkN4d)l=eAKduri(P+7>Az$r5LNvHV@wl<6gfS&f@{buUU+b
zE52=*x|O|eI8Q`V@IzIfVpAbbStbQ!IjLj`)a^sXB0}mm>NR0;(QvM|S&SZQu~=Qp
zoSbWFlUsX3zdpmcP9=$go$Hl?k)ULw;oQJDq_(JE-3-t~08`h_yHyG0nRZMyoKpg<
z@3&Y_spYht(`vJpOE$_CZrp7+XYdtKef0g({k12k$L<#mCv#NJd>G(HzZ^M__lJN<
zR$aRjXDhP|XKUFLAN?Qo7IdIEik?shFM~Q8&ID|_-SV+)Uw&yg8-?>5lZ~XSL#6yy
zobe>@x7Kc=>XVU-%RV_1wbnPxsZuiy$6q3j?40f8e=pfN8#C41IdlBQPKWHAwfc$h
zz1lf*{FN=)HLZ0p!NtxQXEXsEGsf12+Bmy`%L137HqOAQ@ki~PSs5ayuyYoOvvU@R
zvvU@RvvU@RvvU@R%g)&i;D#vdqOoyirO=dgImbWJF23bR!wj)?Kd|&+`F^-e8no7<
z2qUb%W?k0Y!6a<Jb8P0n%#25l$xxs&TBe66FQT8}_}EsSnCM1P-q^n^<$auKDz9}R
zlqZ?W``G-#8i-AVb*A<{?r3TBesK4i+6&;G2KS_?Jridt&yI`o?6@e;j*If_xG2w#
z`$T&-ptKhNM0){1v}Xe5KE2};s}Hokh(K>xDm8~B5T6r1F*WM=)Yj<#K>h*}f9v>6
z^)$vG`D}KZ5KGVF!j(D?vMDz}=C`Z^#=c33ydcBzLu0dH+F;{t8pt$qKrd+uvV2E#
z$UcPC8V6+!F<_vq<|SbXgsds$xNzk;8j0r^`xi|%*SE%Sd|<U%|7+w_SA@qWSZ($}
zmf2=)5@8x=w%G@r&E{#-1zfh-WC7eTaD&Vy3*csgn_)JYi8Gr_#eKP^!P^PaW_DcK
z%#KT&*>PzyJFc2607#Ps0BJH4u(UhAz0&Sk(T>ZqVqa}DW;exB)cE#FQH@1W;}cNS
z_F}{Fwyh^NQ%pTg=x6EaZObvVDWk3{O+CGBIfgb>;I^B33gFm%Yx5|2Vw>F&K)wX>
zw5cc)XDZ5$i*4I+(UTn)J=t;5lN}d5*>R<(03doY0iWd=Oz7tBeicRazxw~u-LI<d
z?x-;wk6S9~$GT9vCf$8fuBDR4t?u52+-)wIDtX-M*+~pBNe)qo4;nVIDM+trI{_Td
zGRbn5CeBoe9T%0@aZ!mK7nRs?QHdQFmDq8m5?=rkodf`}9TTv+`ys2lCk;X%d0DJ@
zP;2d?CCvai1tbpCam4EGNh?7vwYvLJtGg#{1zB#XS$aEnl$Ks+Ni3(G{kb{CMCC8T
z@dC@4i6>bR%V}p4TO3LE$eLYcVuOgR`_Z?{aGaBjpV%2$m?u3bo}quR=@}-fMe*W*
zXW)lSBu1LY{gdP@)F=D4f*c}SeKcR1<wf?%#UH(|xRU<Gu%2)F7}fHlh8vEdR?GKc
z*mJxiEkEUm)$&6#OsA1ljXa0VmLEz($|#vk_GD|66r4{X<3PrkEg#5;RU~Jcox#MJ
zEpNxA<?Xn%yd9U8x8u_Cc3fKCj;oe80kMB+`9PAiya`w>Kiq2h<RJ(&&}w<vGn4bB
zWX7`OX;#aRv|2uS70BiB@{Lx*A+MNJb!2ZNd28q#KD-JtLXdKN?sJT00FZO`<YR<~
z+o-z&j{HU-Ut<%+GL<Q(#dR%<v@E61K=u-~<ZlhfI2v>E70UpUKLq)KG-scDnv5yt
z<e#k(KyXV<+!S>px<oa5A76#EEsduRLoFoR5HhYz$(F*hU!q3&WsyR;ugl!^n4(TZ
z7b+@!5kk04QD>nLVK1Za2<v3NFV@p?jbP-|WhEr~v2h~T7pL4QztNzQlE2?^NyXaw
zT@dd7m$U7dr<_)fxq&$5DMto!jp2ad=;Z<U!JK<KdZ}qIS|2%{l=d>4ltoC}KMY4!
zIM6rDAE!1k=eUlJKGi(3?s0Ttf0~O7>|##4YB<vP?OVQ#!Rpq|)Hz9#CC#g{XvyE9
z=+F2Kb$%Jd<`Coxpq`_31BFJXvfnf-hzU~P#J(+gdoUN@8ySukOi1%vLo!dg%hVTz
zq|ecUm8;yJNQokZc*(-BUYN*@sC-nIOb4HOvNp9jButj#LiXGV!y)tBj^ck;3fXCc
zl%$OquocxzsLF4PL(UkE#*rEuM<6iel!5hWyN`VFa~76RGqoX50D3B6GBxXjzk!E7
zt*tbL+PBg=C2G#&&wx{RB5)kY(h0|L{C}F<D5+>;I9wR6+~!I`L)vZ;XnLg*$b}_~
znWtbfDYMZ6*GU|%Zp?qBAEoRhR9Is2`%hEMV<3;j%O^+-hkeYO@;u1r$jK7LVIT9R
zFbPZHEpVEX`O5TlR-M#Nh17|y$rL_b>UeBAO8|O?ddfDmBa#<d>eDB)5B(U`K}0R(
z?*xF=DvQ&~=!(d$$8RW4v{bM=fK3m}0h?{Z{D$%bUMrOjEnkR`uAwD!QY9*zzDU%#
zShjcZB7zfmDgIAk;@J0QIWkM94rp?4Lqo4&O*jm5NWx=kpNS@CjF`!r?-!BOSGJJ!
zS%7SD=|6RpnV~)taN84r9C@%OQ53Is!}R~+m1G+!RYHS!mU-s)^l-+h9pRsvIYCIn
zsEl%&vyGwu5rIRQ0hme$OO=;z@J>W6bu?k50O&LoJ4v042|3%aO*>-?&;r72DA3uG
ze1`r(7;)LDoN;#u-R~$ElyhM|fYjmNCP4i~<_|Gf^^FTd|A-7YOsM3?8v1JiDrY0r
zmYM!q8!;JKuIlnWXtH+VosSiUzEM_&1ts9x&j3m%O<uj&Zn>e~o-8TiLU&CDm6c@Z
zcO-!FyM5s9p6t=IzFtG$tW;%gmgrlkoW<u(#V3@FM*U7DPbi*Uzf+BXkURI6p>M@z
z&7ZjLj>C*<{lYCK$|86y+O&11n4_K+=HkhG+$;n!x-*Dvf&ixK{T?y&<#yEzPFYo7
zPPef{TB$@57f|_*q0hqwv^h&@wOlRuZH%d^dF>>>K1(%vu~|Y(t)QK57bXv_H@KtP
z07oI~?ZQNh%k&H>Mebe*F`Y?1Djvbz3KTTaEfBo+^FK~(vT(4)YogkK(`RWjShjp>
z==mzE(4BA5%~v^u)Q&_$A8wNJF<pjMYej2sk}3Calqy~!^-;n@LUA*VI4D4|+M+l}
z=|ie=YJ#E1+BGREu+n3bmA=%~K)o5-jl8VvCQhlMA)D=yK3L^EXXx1i6^MoG-Yb^{
zixRL2ZU^eQn74U<u&8I~+!<_0=y|FkN$;^3AV$e5MMm9R#JXQ-Q&1xqckqgqsAdk)
zXq-p8`iw6byoz>3DAHe21wM$OCJA4*QiSQIRhx}V@*CNrH*f{%`Nk!7kehEHo|I)=
zqKdkF1{@#xZyXOU_A53@Z~MS_*{IRO#46SH$4t589hPp6-9>-kYNW3D?0*ZstBIc}
zGeU)LEkklxUri2+%AvRBQ{z;){<U7j?;MO{MveBnSX)PFH94Kre*es(VBe6&pWx|!
zuMxCGRL-?;rSoMN_bJQ9jMQt1G8L5vCaJc+Pc@l7E0O-aM>P{BaE5S7CQ)zX8skJ0
zGhcxgu5TRr(oU#vsT<>(5x*k2!f!K1Nv>J-&0M2I3nwCGOj)WKqiC+v<q<QcO1vfg
zPk?Cxq?-xTCEi)$+QU?QT2EtyX?N3Tnml8;hyMj{8pAv=O8VOvsu;=liw~YQhT>Cr
z(H?#w>NS#IE;WXz<XL9&ka(3$%F)@zV3o3#Yi3$jwJ|tez5Sb{K0g_QRMLHB${<!n
zyvZJ}!M7Q=3ir0Vje+uiahfqe{y*}T(cdGohF2Q>FhPFd19svrqpzf%2{ro2e}~Vw
z#Zy79+s3TwiEGnx`=HM^eH9f7(Dd0Y)k~o(D(I%xOQ9=x(E{WUB=vknMK`fc?%!%n
zj#VtN3k@dm-1`+vx@x>&Sv5q(l72!!GS=N#F~`n0$ILiKWt7AY-7E6zGmRswK6{gy
znvde&>ny2*235!rib|9Zy20btEJ-BJN1%OkdA-2w3bP`V|I*CT^G246o;_7@sq(4w
z6>>vcRe9^0ipCb<Ik9G`#+er36$KTIyW7G)HnSouUWud65w5-4RD>Zd5~0nd_qH1C
z6E*ib+-iti@LB&xD{e(={QL;-Il51)elj=|kXf7jbF0oOWfeqH&$sG~@uSC%5J_q!
zpZ1kH&e>%qW-=DApE;cU&~>d+NsO9UqYb$VGDUjH+=NB)s^M0tQUl)!eO4<?i!N@J
zibJ53mijT_1B`HPf-2>(%C>IRwgKbz-1a2@N%&oW0r<B%1djm7nbwRDi?^H0IG=_Q
zq_tM>su|s>l@~$q$NZQGDF+p{^70bcxzojTk;O|k_1a?u@ltv9{UYiagNziC&QP)m
z0uMa8)ftQ{5Bhkk<5yK})HU~@e0K?i2z@Yg-a_Jk#1KDXdQTua&0OjRo#wCcc)2N$
zdgTMD|1I6Uj%7mRM;t}?PyjsZ>2iRJ_W-mJAaoHgKyj>SEV+b6_2<n0wc|Uyj^Rp%
z8m+}rI)_WNJMRKjiEBxcsJ8$OWE0vamCRTGjp6Mi2Z-T>0p#>O{ifG3qLFG%Eo~Xt
z1z;QbK+-Ju4=rsEp$d6UkMKH1GE5chj92oEHRaLLPLttO{LGSRFfiXa4dM^Nk87Bv
zwp<Cz$8evrNLPp&5T`&mw+{69G~U3_itTHep0h?%8+}x9VZCRlS|=#tZJB|g^Li`1
zj&2|eNYUrlWf1f_^2F5G(N_ZX5S{<Xyo0sd6t6>_)|{x()=Asui*Dw>NK~p3iV+p;
zq-3&>N2@9w*&WKkz5#={mX0XV9rN?TGhRnM>Mn-aHjmJadFINEiYQ(xY^>MOpw2i@
zcWd%IrOWdb4QpI^gxn(u!v*!=Ko(W&(8O(HWgv-qz3c+lYq=CrRldL->^l$Fop}zA
z3@J$5qL}}@vl(R<zwFh&S7<6-EMxwiPk^DXL{&%15DS2rpDsrlT3!D+n4$#$p?kgh
z@22FCS(EA2uLQ`91)q8zOdC9DO5_}$qH_hMsLy=~oi7v}QRS(fUR@o#iz>^=GG0`<
zAWbPve_P6!O4HvVE=sHTpI3j^WUaNGg$j!J*$(eQ*4CYrWeZO<=hfe*n-;&%3tW!n
zvy;%4WkuVC0-=kxs|h~&g}>6Zx<MK?->YBx|IqbTij*r|=ZUT_iLR@@FL4{bo?iV$
zRd;GLCd8|swADNiLDW|9f;||9RQn_&t8|*S_Yv-q_q*Lsb4=z+ntJknIsKFyA&)*s
z`Z2;00S*y)fpALM-jY6E{Sk{r_p5X<bMjKMmly2FE5pD!HO*7kt3Sa`$bz4R!Wc@w
zN{}m7p1SfL8xi8)giCU1#w>STwAcMQ61u#)9O0I<w#$A_&QI-PzX1H#F4e=u>1>VG
z!(|pb%z~_BqE(F9g4XtLt5`brpDuTh6tf<XN0g>s{Rp$dk_x+oL8c}mWK-TGb+kaA
zqn3U>a0M%5J|?$(#F$U*)gK^N!87R1*9$hLH4i`T)mJIiV9g~pq2e<1waQdH{Pcrr
zZL)!oGhThS09V8a)0%koLQALXW!9#)2^Rir_Gi7YJ-q18>1_#Z;uYCBiW0DoK_a~m
zb}0=!*R*Rb9fy)GdtUT#eV(0_ewRK^G(f9wpibE70k2++p)OP!pw-h?5SEELXmxob
zK>B*Q4Ycw-N+inGXBc&4{iZMc3NIiZ`1GZ3C)ZZ-3I7lY0RIKRx2E6Aw)@I2nP_g{
zyk7i6k)Frx9z9RCptSYuBrW|!bTGNISI@U~Fa#Yel8(6ODYLp0>^dBT<N>R;6Q#C3
zOey_k!dbA=Hz(OyFM@p25`O(;CH!u$J_X?yJ#Gn~{waB6Z&t}307Uj0!Vi-2C1WHN
zmmdXd>knFW;O44aQ3@`@{-ql1_L$XJc8gcfwW_f;-EPXo&(W0P+T`;|QPoh3B7`QH
zE-qKOI1sdNyEdlh5vw{ujk50d>b<QRwHr)&AAU}^5WBM9;O=WT59}OEC9>5kJ-pp2
z!b-Z9ydiJxBIzSMRoCk8)%3+HX<~V^RJ%=t4bn%Dxg9pvZijR&RcbA}*xK5)W+`6r
zs4qThm%5*fd(2WktsQOB?om<0TDHYZHMFSo>h&x&Y{+B%6Dh5^Gz2w>Yp&NuTr<V+
zDea!L)W98e>I~v*!Y8I0q6KBCp|Pcg40M+f3i9HgUcHIh9i&u78X*O2a1XEUm8{ez
zqc@?Gr5nT2O$M`xj3pqOHuvf=HqkX8SF4RIug+Vsl_VKeAh)wuz=z|suU?g9*Rt09
zME(HYeuH|kd|0)Q?C7R6hz+VooaBF$aKPH2+Avvst2{MV#N>_%n%bZOMza<+ut8<Q
zC{;G7GU$sL&rnP`I_a;M6(yeH9^0`cR+=N-^f@0H|3!F7AUbWvdxUpv|F{v=*JwOd
zv3NRtsf<G6kuxy&j8820nDGO^ca%~aa2q34sYpsOBqZP>OFyT2vj3LxKf-TT^~lHR
zh{ivuUtj|cm<>1!8>pWNTlH)2Vhe~~rJTTq5n?uUuZ>)tzpp~(PIY)4skNnz$@F8u
zAM4c}mO-r(EhzV}^ph%|%x?4`Fk&a-1cR-1ZeJH3;UFu1^y(p2leYJQY-~Bf_36q9
zuJY=kIKicND20;Vf{<Y8vpw_W_UX10T;Emsk=wm`7{BgY`u;d>N8A>gCj;|8dEzZ_
z9qn@nU6k8ns9w(sUAa9+u=qWms?O`alRC>{ds?u!#;Vwwuc$^}=_$)bHdB@P#jeXB
zXx_q0F;&kb7oCkKw&1(Yy9AeUfnD|I_VdZd4-`~?ZjWuWzfJts+87}z)6j(!g6Xq+
zyccbzaiGo#(-obV6r;h5F<@{a?KcxPCdzp8o~^!pp!OzCnFj8CC7bZT?Akw`I7jnd
zl5Dv^X9*{%LhK*j5A33%njftytSOQz$df93$g8us7H8HV6RMdWs|K0%0irZ{8!3HY
z%}S;GFz?5h|MD!ewR~D;OESe+&6SB|XAb7dwpn7YZ1Aqx3!7l?XSDJ1*=8v%b36GM
zwN#(U+yij06cY8WIUwDWr^xn&$hMb!;w>}j+nEP!*`5SA#_6cV>KysCuz2rR3^2<t
z+H9)H^t{dH4S?6Q{+J2l>6&*`ZBo5o%T}%orJ2lzGUW%9G8)|g&|Bu`gimdgTJxD{
zQnMmBzNosk(%saz&wGab#q2~xQ2Wp;_R^HBx6ZINA<LXhhO^8cz_IK))7HZM3GVmA
zMe`X>&ebt-9r)kDlQ?}bxL0f(w%1{xSj`Jhcu!bX(<22|YQekW4@2IZP5Xeu0eX_W
z&!XuS+>2Ke$qr*F&V7BQ=?<7xhv{OHJ?Izaq>528ll9LQ?}OpYn^tzf08S0|K8WO6
zF0N-~OFB1VABa#Q%7=ca*dY_rlDTns-RmpIP}It4<#4_ZRH%8?ch*iw@`~TRGnLRn
zd}EkcvutpyHE^@N-o<vD`PmB7R4LRW-8(H%=shH&TTD~kB0`a$hAP#rOWqjov~)Ql
zI6<bu|9Yo&BB6lznd9DRJtQtN9QeV@+bhU~47W8l$xT$`h(ltckh3UEL?1SViHe#~
zIJwX}CP0B-Y>Gf*nprvX#*OigNxDH|O#2%o#&ngqka*>DZ;t?p3uZlf;0~jzO(A+D
z+@PSE*Q`d>Odr4a?yB*jRW$&1loptM!K-f9(wqaCBcIFGdGUw7D%GQDuQklp!=R`Y
zgvzdNw%(wz?CR2ztN0u+8@AcHdU=rg!S|}zn^ESLLLi51z^;hN{(>_Xebsh|_E?<#
zg-oF)hAmm3Wq(byx-e`>v6lS}GllA_ShjrQH3t>0h(XNk_p)o0DC3!b@2whCMptQ>
zE!R|KM`zWqe5woy_oaw{CiQ*ULOnuA?i(y5BZScd$WdKLjx$x+4@jHH=bmmcvL9*!
zevbO!RyJ>R7OH*NX8bCfJrBjgw<==J;(1#3GBT<L4)#5ky(|rL-wOp)wL*zUeBYq#
zmCVe1tB6NW%3h_Y34VC?W`(!v=EHFv{K{l0`xaVm8NB|rH+#3V3);O6|6}dORL@}p
zLGG#hw$lb$TiMI==|1^N(mnmNr_*A--{236>72eGt5U~|HaFBUgPv)rqo8#_9R<B^
zsG|@I(sr7)ENm%pd3$o{$m~{@3d)YlCyujQB_Y<qAg!;kOI9^f4VS7KPBmwm*_^VM
zlifCs6Ng#UX#c6~^myX$hAk}AvfHu1D?1MQ&2OvH{qAUAcy^AhspijRceCTYAIi>E
zam=plK~pg)reZ`*)6Zu24M)~o8bZ^aTTiC5N<$7Y=Z8zPborR+>Ud?&S$y`8yrwy4
z>5Xi2F8kX<$4?uUrAOoM%mawkrU3^~{|6L%9=|^8Wg)%~qCFO8y^I@BAM(q7FYBD*
zgM8f{$$Hh0JXWJmIW6Us5ohUc(OcFBN^i5te0o>bzoo8Mh_5fq`p}L)^?cT4JHFuM
ztiMCm(L-IDE|V7WuFEpF*I;u-S}2Pn9a>1kX*KwBn|_cp5C5V_SP^d}O<#3*4c+H~
zZEA7uUxaRYx7ns2j*`PEfUNts=|_a$34l><08+FQp>r3{fy5ESRVg87w&_QeSY&%=
z-8TK0sx<B7pAJTne`+Xs)z=aQ{GFomZFVGoVJ419dtuf#y`!5v^kM(Erifg$M?~l*
ztR_)>p|t<B#oP2wRLlQus9aRtrgsr$J45Ny+w^W|zPixVu=YE`zA#H^c$@xE=#mmL
z$g3gzHEK(;5a!PwKsCO5=Wf#*p_?^HCgVnmaipTi8}OhgZ7#|%#KKsaP-+N@3YJ2>
z%tFCfboEu)VD9(Hw!d8DD<E;QxSef(nQ86#2-~V{HBxA;!q>EvGQFul_IulEQdJoU
z40mk%+$OMBW&E630K_2>-C^5BA@Fa7zt~#vls~<zs$!kHdGzLOr$mcaG<|KD%5lnU
z=U3LTt@O^e#S~q;B4XMUgj(DTRV<<`6<Z7)<;yntw=Gs94TlQoYcca)?FtRKc5IMp
z$d#r71T)9PY(b4QrF21B_C8BN)S`6#HukkmS$+_fK5bhpzf!V!#!`8kXDl`2%Y}+(
zGi6D_;SG~!;tif3o0v{F@f>9Fghuis+c#0gb(vE4?VA|=OmDw^6K<iOa`($yZ{O4h
zZn<F?#CG2Qi9JBI>#f^2<Itb|QI!15^zGAx%x5xEY@fzhqKcLd**?9cpsSKMpw5=t
z3-BB2CAAPOkfGKjTBL}E&D6Hfl)B`GO<6)TOrmhg*s*<Pq!nLzZ2QbcR(!$B+h;-V
z*>6l~W-Dn-Q`UpxL?|)a=hmazI}UCi;AVm%y=DCXCFB5R1J#A<40HQ{9DLW~s(zg2
znDvYM-}XT$fBgWcCoJ4PSU6n^;~fXvhlq?P)abL_{3(p^dA2Kha6Y%44;bp}D;0|j
z#R7w&1{qytg49;=U`B89pavaO4W#N>YNK2FLqgH^1gmSWe??JBNEKmCNm?jLh=;tr
zy`@r@eDQORzH}TOb%Qg4R$4lavBh5#A^m;nIHZs-RcgM2%a)F#S*N}MyQOm2hdN+)
z;pfr|7P}2{_~U)IR8ANgT!lw+Vd-0mkd+a6lfU$B#gBN_{iWtLQ{oTyEPb0zL)BLG
z-zj~Ei%lEWfKNSN`Y!%9O5R>9GZLS?DgVOH2lN>wC0ePjoZ0RaRQF5*6*%9ybQepS
zjdhR!uDkjPSK?6I%}0Y2#mG6O_u&ZB=0W|fe@genOMc-rqjWEGVXZCktb0rEx8u=I
zmhKaYuRJ0=ecI~|GCVq|v>Kz_Sl1G3Bd+3nXKBKx{}5ruS@VUBi6~m*{Yf3j+yDvV
zua>SA3HO*1u4VFWOStY9OTxFEr5kLi(9uR)lJxx2O;vff^BeH<rSf6qsA?sWR;8O#
zXfM|Y18K?VeWiu4*%V^3DU`}viYV%RLlLuVHYj4Y9f#!{n<bT>d!zDNnaRlqWjadq
zK6TE|v}jWkRZXu{b5jWXiwa9S3jf_E|Bg&MZT_8lSo{YSmUdzLc<yxcNtL_W{AuzW
z)#R#olm@0E(X&c(m0XYbRO?T(s;zH2C=6xxwx?g|lz>bJl}yn}rrq?b$xoH0(62WA
z2|tXZooYWk-lh*hqzx<02uwaU$?K<YV9fcTozBFxKs&v<w3#l3qv^Lxx4_(+G2Aqe
zQ2}F%<5uW~HT00u=E~S*GPJK|hyD*`ZfCZ`&4wKg50z}bf$><`^>(mtT;JhP@4Awa
z|5Retz|HQq#(O&)a-O5!v*c~O!@*YtOrXKrRXaDk<0sz!F}X+nZ-*nvbjdPoR<+on
zZUAa01d_y#Q50hkl@s0jKV33G4ss`quWTg8wVSJ`@2js=Hs!2ybCo4gP#nkwcUCpr
z;!f~YRwiTNYN^+xPi2M@f#jE-t?WdN)kl4M<y3Y>o11rs$s2nryRs!je5O_zm{-Qe
zRQ9t=4!*x~pya+kY${9S%7IL3H{TD%c3mq++j;K3Ryo<Ej@Ns(XXO-j-8Mf&rg|xr
zvnBo*@kZ?{XJ<(~Os;@cs_lGn_+y``oZA4=vcqI9UO69Qh`bEGq($ZJHiM+B$`f|H
z?%2xbnsHr+PwVQN2a+*uSf%XftLdmy-@K%%)1B@%zKu7fn3iGZlkUHxhDYU7Ja)#(
zW28Lx)BH!%OB_Sd^_GchHCN&oqa>nrhBPm6OkzsCWg@^+7Xj!%YKoV>q{LB#C)_fR
zl((HFjs-sDxy%+~ss(!I{1V4Kl4l{nt|ldpT?~1;6X4<0630VK&FT-QN?QhjX&hYQ
zSdsv+RK38f#IZswCRa@m?|7!fu|=h+sXV3vTh)W=OT7wndCbc5@tk>z&NT8$@kTn+
zmXow_aX_K-s*3NxhPIqUOMM<M-pnFn%c-ca8Cvl+X5m{-DR=$AWQg>Qf=J%{;uS*V
zC$dxYHoNGM=EWTUfEVIE)j}de)I>QDShJ^is$3emvwzjM<?c*<NmX2hyV0zNi^r3w
zF5%tzkh<MbJie76BIKvT#p5%iytLQxmy2Z!q1|%g_pO&Wuk0hfY<R8sR4Xpp(R#jB
zoUJ&D=NRR#+FRl7;@eT&na+RbpUT~Qqv_>gN?BpzeYY9K$#}o=gos62adIX#IVm0>
z)RCh*ki5JbZ4o&>M-P^&?GzUAx8(4{7Lvpn-qAGYC)-?mROkGJV~M;hGo(7#a?Yc#
z^2%W50T)i?oEJmMrHkbC$~m7VaZ1m=kaJP!o)AeM9hkFQ$UZ~D?!25w=r!ffge{yq
zSIc=+#YM0C_K@@V@f<Ec>E)l9Ik}$~$jO?QxO^vL<;k2}enkJk91RZY9zjK6)ql3)
zAfQ@8|I0CtSONx$<yG7Q#dg2sjE+-O1d|VD|C*esxTNTOHHigU3^Zns+6GCy6z!6i
zyH{*QQG?T>T~AA?t;}D<Ra)C8Yen=ud7W@lS<yb%9NF{QD(+Sa%)tRyYz-CP674cq
z_mJ3H4|*rpM7tI;)!5S*Afqb)o=pL3cSpNcNsqWf%8TctUFr+)0$l7D?JBcV1|!{S
z1*nem&bnyV-6|*T$QE79*=W~z_7Gp%jEZVxJ9x+Utxc)MV+s{p*|=LySd>(PY~u$@
zI^b@?&iHwtCQ94Ws2%7o9iC>KO)iXfO`>n?_!-1S!kfJ?=Etdz9N?u5i*`-+nVw4P
z@Da%$%BKUOo}s`qq=%e|c1<zG)jE7l@|PUt?f9)mJLl3EGNb;Eb`{`#b}VPVw32B{
zhrbEe1z<jxl}c#Eo?sN`zj|depj!!j1V|xrJ7FXAe23Vff8`{))9SU4cJ+eb_E2aX
z!f3MYCEP6lLr>Nbf}9#28cpO~!fOHyz)>S~b{?$iwTJp4&QG&P5k}xR4snwL;ttYs
zqsMYcwC#H-^dQNFgh@_qqJHRZVh0HaghVdJcIZfgS@c!Lff`MoT1@o7FuUmUWPVNn
zDfuelobW}yY{bfbo80WKzQVhQZdqA%Wrw>-2)nYk&=t0)@2qskuzq&l(jRDuoCYk?
z<Wfp77gUPO7b0utxcIDcFAk*Zw~`#ZL<_l=81kq3fY!P377<>65g?LLi^yG8`cpU3
z%V1UHS{kM0nIsNaSw5&bSm|zD=Nz{am0W*RomVg~NfCHQY*kIAyGa{<(s0X4z?>Tt
zR|!Sy+WRYc=Ia`E%&*GW$#=_Nk>V@)VX)>rv<P)v)7aAI$y_JeRT#o<^r6*g>q`PJ
zj&UBkg9xeFKMPPr<R8LcxJ?>B#&T?K$49o+qHl&*tz#WRu<A_8m@Tw)@0N{u-gl@I
zGo=rrU0uaRR(7V3OPA={9$G&Ggq*4RXQ#V~FFe|%<`?QJK)pw!UCqMa$Q9lMx}y2Y
z$DQqyOrOxKi`f-Bvg_8d0Rp}BO|&bX)|JlKu?wLC$T54PUCnLeaF9de7qT3RcC~>m
z>wT@`6v6~@Mi=9Ql5Ff+u>AT%OL$JxcgG;}TcYiS;t;fi*Dc%^W(z3Xbxq$zt5p7e
z1D6<V=G!T60Wp8Mq;WK)^6lii2#OvSnz&Z-0sGXMR0~Zz{A;w!p{kC$cFv77YwYMO
zHO84eghQySDivy0M*Y<Mid-!&ydLdbX_u_}gX-W+ohwl^&Q#`6(azOsWP*(Af6>nU
zQein;*!i@%g%|Dgo2>_~D%|wH&h`ARgYr^(vpAw$nYZ9Jom-;>0;o0snA#{{lRw(I
zO;W`3($LPknW>BK6Pj`0Fp}DA+FK}}#X2e!r|)D(*{p8g4$;m>Y(TgkQZj^2onAn;
z!vgGt!i8SZ&LdKFxfOK>W#k}V0e3Emb{-GNO+!0R*wTrp&nN&@`Y;UV$9B?bNL&@b
zuHW}IAXTbSRT4d<<wiT7Q~PuPqk2R;PYHl&sUH_S>5g_5*bQ=5he)#x<eM9jvL%`L
zM6|Oon;z1F!oE>to++KIK-%)odC|_^fuawZR^aTdh9HVceS3G6%oJ@L5$!Z@Jcvm3
zK8tqtxApRRO0;vJt%}Uf(au3OFz>Hu=NOeu9V|cMYZUEF#^QGTT%(;X=AxncrQAKO
z%pT`VZX*ps$9R@-EJ<eT<nONLHd@EeL4K4pmF=%+XG$z$F__ARQ>P$g6*Z@{1bGEO
z8X$#p2?a=drqEkulhUWmD5bYR^hi;2nl);6>I9{BspkA)(?NCoGJ-rSk48JY@IR7j
zbYisWG(x@8HQL$LE;t?JWDM`_9VkW&FUPcR4!#fds?p9IhMN{u8SU)O){uTTua0sa
z8b_J+1it`7iQG-7Vpxh|NOc}!$m+D8uur*z(`Pm3<5wv9y>#hdd0VD-`ZCA&|JC&W
zhpsb$kD^!__{?l}6G#ZzVY3S%Kmtp+Lbw71h$P{@Zv^Cq1QS5cfFQ?msi>$Rm<72J
zkoyn}f?NtHD5oIa3g~;HphQI<J`cWs^~?tJ`@Z~sy_v4AuCA`GuCDIs?s+K^7<Xwi
ztXQYgddZOV7W+#0BA_w=B&b9Ek})9O$HPzg9OdvnDldeuKg9c3K0S}+?C$|*iFMOQ
z*32J^kmFPgHue&Bh~wdiw;hir7XZmo>^6%5(iloSR{?$sP~=)6B%Z$j{=vZQ;O%bU
zr9&i(j4Ij|91mGzJ2AGu$}Eu+HM;Uo6fY<q>Dn*-Y)jbAO)X`_snS=|`RzsS7@vd5
zuf9Cp9(9@~lD86ab+F{=*co8#X_`!^X^%Zk=^1jZwv1i0Rh4Xwv5Q~y-RG#P#x9zw
zX$wN8-Be9G6XD80)k;nK5<x54YucLLK1XR${4a{M#N+%wEuvi!-%s?lG<S?5*uY3@
zaB#TMQt81>a|m)&RzzmnB5OJyAp3iS7k&Bnwm8a!B!;ilbh-F%#$D(~{WEzB$(uqW
zr6ZIJ2CIGR3pku14%1*@f#Ptr;?T)tT$<kIB|OASA>{VbJc*K_It5O*3ycWya}10(
zrFmA!)=_C(J4xBDdr>S7{V&XCs4W;7n1Pi^F$l*fVxV2}y=AzJA47(Verx>LoI=Gq
zM%M5dzlh9a*#lV_e=7bcbfwH=Dbx_}(|R$ql6MC8gKR#)@L1kN6Q+n~d<Lf~$^U&Y
zezmh=mCt>~I}9)9_EXBap+xWuSAI{VU^|gIk`f%a+F2`5-e;T^PJ}Jt@if|{A`k!U
zGt?2RFVr>YKI2P4`$9_Zz1nA76FVsE*RJC;zE%-6*VVp&ogPI#W4ExgsyrAQ%lQoJ
zRSl6&DL!MbWwPnK>48-~V-V^tFH#)|(tzu_TjtXkR9-ltH7*fOSGTeb@?%tv0-zr@
z{WVbyX~qy$0ZnUGlaN4z4tU>Zuv<^2np(3Sgf6u$OK4qnF?BTRR=Sd=uWcFt`)Ib$
zm?Vlc0?b?j_eN{=Px_1*A>dO0X9FD7&u2Ux0&WNRiV$LXZ}n1AU(WOy3uA0L7fF35
zQQm;~j71^f?*M<3EIrBcuw)6O`-~+r{-K!Zh$lS^Yq);8=4gEjlon$1CM&DCewXE@
zu9mZ?#!Tg^ufHTPiO+z7WXu)$k#U-x5#zZY_t-+3rd)RAO^bIW8D0)7p{TdXL32q_
zVqTl7lx=o-mn31TB&b1zv#%k~`Q_KiyOO-hkXw1%sl4Z{ylX;VAZa7V&5cP`kyr4q
zamLov5W+#nI;T7E@=c4<8oR>6MSE2tk4;I=9!vRc(@3-Z%JuB|Qj})i<GsBUG|>`9
zs!cR_FS&yv+Rn~bXeR_Hu7hNZP@hg--%Au14$n*aL?yK;7Rfty&Rh49l#GZIX>P!R
z%lBE=Mv<(z#Y>f&=~QA}JF!YAae$0%8#37lXSL5`sw8O{8Ea3_DcDYgvXt=|e5Xub
zJ6cTkHFN~OD!sHsF7v=>m0n&7ShwCT;03#YHt>I6qgiaMLyuZ^gxWT#f;Ec^*hw^-
zN>b;utt7k6nA(Y!ti2+cR7=~lr<b!WiL8V7P>Sf8d^tmydO6=tPq>#pQ>CM_l0J(v
z*@&#K;}}gy*c2*~2@`e%`Y0Kc7-e8uJH%)3O=)^-k+wXW|DTD~c=?f<mMv(Q3W#o>
zjzLLJqKoy;@fnS6TaexnU|YLa%KK31^6A3^{Pbr~SY8Aq8D4%TU(;zmqqE)D(*<J&
z>@G(EMCI4Xx7cjyO*Dkt6=g;GK&9PVGr9;il@qbO>?y`p-v!Z@FSQeDs|5TgG_bzx
zgI)f*kdeHXG)Jr6<W>DW)EKsQQ{HmAb!)kVFvNue$Ao41x;`UG7KUCvY)xN`>Se{@
zWN3MLIrc?{mRh(J*3k0u4h0%m3=54dHi}Su|ANm5R}{aAQ7)_zj)-GEQwQ=%!b0<2
zmWD}X9MeT$%s&&6zV-3;^?ichZD1GB3ZLPSRscQyX~O)0nqyZBg^7+EUy~ezO7H4P
z+8V+tHrcZ4Z;MZtEqm*i#i-`hzw|>xW-l!A=vRfH%$cGp`SfcNkpXFAv`_y^MTC9l
zTRwePDZZ+%um8@Hi2iCwBJ1B#)%WRpiwE2FpZpzU3nYXg6kqz;r*9I0Y-nZ^WMR<~
z@djC8L&W;lVuBlLDNwayScsyHA{6~E`t%nR#qq&<uQ+Q5e(~wkTnvxH2l(`A__iB5
z;Yn^1J%8mBYaXFjt1D$9sJ#U4nqkQo+-9mVwDhk5isRYuO`l!^KOkicfIkR#05;m>
z(?b*Y2e2g%l(I%g?ML--#i_02U_$9^P2YF|Y!S441XuP^$nK~IlCg5zpN6T|#ZToI
z`Gdlm*v28W;PzL*X-UYE$Z{UK5IRYRKB{pPPE>Y^D7>Sj42yE`X(KDr8)w|p<)+f%
zbHS2Mw2_Xr?<5HFMJn6sY!u5s9oPmj3=w}w2i(|7dQPxlle1Ewz~(zE#JBMNknr6I
zL~5pf72jF#{YqV770r8K9AS(^+VU`sFjXkC24V57ET1DY6D8zwgblZ4(jqLb(2UMo
zq0?Ee9o4z^M}X@szF!$?RZPM5T71945*d7}0brvVEWr`O(Qb+)(A(v6Lkwe*X+yqd
zbm|55?I9$&A4=P>KvUn}dPPPlmA886YghsM16<mMHSkbRW=Zci@aYL?QcIZtw-Qa-
zlx=HLLOn~99$+@{z>~HnC4i?|d>z150|lMT%uLv&IohZD`CPZYX##At9AZ^zQ)j8B
zHCP5B66CIomQ%#`tD0ugo^k|6w7vggpKgk_Z<=LyYOY@pn+==qbnxkXQAcaB3yAXP
zH&3mpmH_k;IIW`a59}wrX0yp>b}Tk806YVmo2QaF9d&`vAwE4y_}u&ie6~0(%upz<
zNXTYJu)LP5HxX&JxNcQrb6oKIEi5XwxMQJjZW1iL)#)t}WhV~^rfhY_1rj9nK0>T^
z2_dx|^}R;E-=%t+7e_0b^?Nl{yFQvWu9NQ<D%Y0YsVQG~OYIa@xnJtrb^DfT{3}Iu
z=3gGLs@5Fj2mW9^Qx=@binR<6^z+?u_6IapJ4Z=7htHaYTzTlD$?`6vTyr{o^D<??
z?KfXArp1uEohG%QL3C*kXT)9kAQgYGR;9pq3)cEBC2FyD(qiovZ&^g_&H3NFrp4N=
zK2%k-qd7|t&9iLY$O~@~F}|Pv&f2_xvNnKB91aHc9&3G7&j_yE=JfSH@4F5wJuqz6
z8T73^Emp4E8ql1M(R{4M%5_@-nlq*}f5NW>{+$?qT!7}Q2`g#b9@6%3xwToa^meB&
zQNF~`28WL>h{MVKfV0R@nU{$heV;JcY@HHpyWLr#=?ULH_*ioV+uKQc%=X<WY5?5V
z&=v_ZfaaSmKK5nW5;+0v&ETr-oM3Lw0z&hT{dp6{YrX?&U}X41F`M6IbR2iX_XZ9~
z^bKyvVITP3--@)g`LLly-|?Mh^w=gx*k0r9L`EqBZx$S{F_2`GCzR7d84xX&I?Q)Q
zGV}{&K;JT|@_}+I2h3(P(2|6Giddp??Fqk{mg#$6a=lLn*?t%yt=%Td0YuzK+o_1i
zl)ka{ASra6ZLi*!(h9*D5wpbduEm0hS{3Ii676z7G<()N%w3YiHiE>Sb@j`%+johQ
zw|C=QNayo#mqo~s$Z;Mz6FN$SaV29YVQ>PG&*bO2l=X+^c>l*>^iF3=pp(Vc_VL9<
zJ0@OHBL@zo@GYhZzPI12kz?XFAp{||@IIfd%`Oxo{84R*9&tBLb>v6B@~M60+uyS~
z@&?OH(OVin>wBRT$5&QlBS`gSr5)ET9etsZr5hPjVSS>d8!u2n=`9&_u8bwzec)Rn
z8j2^BfsSWvvovH$NJBmZcEQpRUVB;^!ubNxkQH=9>sO2L4PJv3cgUF>QIpJYf}Dg9
zHOY)6lnJTHikp<CMX&X(l?>}c84|&%6v{x?%B(FyTOoY~q3t*oT(-*@&l-b_st0yq
z^qTlaDjq?~grGVgy0f`e?~!)BGqGBkO;X0?vAi~t8cHoQdlC5Hx3;3&ee!O-LJ9e)
zGrqpEQm}J=v@(T#Yl#4()w*ckR3U&2@Im^jO%-1dIa)qAU^m_CC~vk%myPi|4_lc#
zq55h&c0og5r@E3Esj#ZilWe&93_vUX>)%3#T@^?;z2CnpQko_zcfvT$Z|y*p7v}Nx
z{fFswYV$|i-u}ZvsSpo(S1Igtn_K?FUS0+TzEdAUPy5h+xG~Z1q%<b<W&KPyL2V43
zm;wHEmMtP>;7I>umGWqmSSf!%>3|fs;G|!@T`lB!(-!|6DOz@klYLG#c~%y>$tr&r
z{Fc^bfgHsg1@zs!Qxqk+L_&}<#}XbUhhw0>i)1V$9waP6n|eL&?}b*ZyotT>j~n`k
z=9gV3?xQ5r(=vDM)iv$OKm2k6ntY`-O#oYO`5*F!04T11uwokgUs(Lg{GK^e>nWs1
zX!`CHzg%+SS1(>EI14_rJlc7kQ)#Ug+YAn_eg5uFl&m#fR~9&S_b=|c_AI$|ww-eC
zC8E6m(s~n$iGAAryp<<L>^B{qajms7K*3pioD~8O`qPn8D>{~zEk^s*36_vp-&R7(
zY6M?(Eg_}bLdwGP$m-&k;~9Qy^A+*=1X;Co;n=;}#V=nz^S4r3LBe{%x=Ktg2l!jZ
zkUp0<MP|Jk;A`|+tJ_Y;t)iAEg;C2R%BOJZ-HOg7)5llUH&u$0@Ff+M`I>xF@zuF_
z@mhiWNJCJAK3qo9%U=n~El&cyDfQa(yH&4B34%<~q-4ESEudPzQVo?^%la1JS61s+
z{(I|Jr6r~HThKLH7}B=Y?Y3=^4kVSzjfwZy4#5TjlPPj5ySew&u)0E{7^VAkjy=r;
z61e4Wj5VS=2=Xl0VD#M6n<P3)nw28R4-4`we;U0VTtw3nhf7pq&+LDyM5`z}MNJ*7
zneb#woC7SC*z;O(o`9`Ktw!5P>a{^}CX7%khCubzb@7>xi5Ea){Ui^$kpgM2!10>A
zQHpuoYb;eZk9OJn5SF!Ugx7ef0{uwdKb`91HI}32D>o2n+1P8WDB-2PG6{WZ4lyLI
zA`|8ZQwp7ByIu4e>}%5Zt^i@ee6R7CNVhODNAnsSy|8d6mh>9WN~Az0ic&%VURG{U
z{LC5ZHF_5F!)~}jXN?+FyoM=;<+W~P*nGrmRFLd4EiPE;H7ZF&7I))52wpFA`U7jd
zMomS6W_T@AU0LWgl9kO-%j~CL^%_kW=~fO>-g@1yy!s7AUiRx%sp8dt4Y69gj@OWv
zRo0?#t%tq(Z;UA`tMcB{tN&LhV)js`v^Tu^dsq|HRDUh-CS<1c^jg<@sY)(B=+)o1
z7|>3Ems{GapHM84x$H=<E;n9C=0YE(U337bE>l_vAs_u<yreLI$yOOT?of85HOKbq
zZ{p1rB0kL7iktkT<Tas#bZqF=H%pZYXF)IS17b8{<tK^Ii27zcL3IS+$V?)*y(&V3
z>YLLfVi&tr6<gaX*82F^)P+*rGwr?la^X0G5-!F}<k%Ph95?qMDM9#Oj`pX>;rd2v
ziI7JtRCiVoX(ti8GIC(&Onaeuq_S6k)~30yT=4Yk&Wifl;EmTAm6v&S>&Q@%*6Svj
z)pFRr_mPm4G&RYZ{I|eoZZWE6_QZUcnM(2EkhEAycoEF8wE$WMM{Ds8z$4`>+0Iav
z1n?8#CK|KPT14{dY#S2MhP5oxdb8^MdLn5%t!^mmSiN~izrVLU>>`n`zi7P=@?dvV
zwYJl~vzJMeWDUNv-&v!Y-FodiOY0>K@am&PCkmAo#{TNn87qWT(09ODGeGj7d&x&8
zd2!Jtd6q55PRuW80F3_VHeQ|EQ7D@i!Xv1CbNZ-zkd4<IJEvvX@_z7BL6<q|z<OSJ
z%Sf&->|Ax}%*DCt29F+amJEFC)hl9@6Rtx;&8heIMwm?kfH4sw;g-<^-c)j#7r>fU
zeOjV4Evo^PN>*%S13Lh0Q-itEEU%sbi}ji_QX{v-7<@YUCM!|3-D=$-uU?j7dj-V%
zRFk#+FV>Wrl@)_i0G*+PfeehjW|6lNdF8gsl6S?grAtmf<~=2K+kXHKt*yA?hIBdT
z{Z>Q@27Xud8QwQ#7Q6ovNflo99z$Ds#W$8adfItcQT)c+bS1|X8H*0xW}Gbjxuzd@
z+CO2U=G|epOv}gMBOl|w>A2=-v6J*TsYgVr82n8P+6tDUU=0Pv?I3C)<v<tRmA5!-
zr1dFrwWv~0rL%-13+xAS$fIueYrjO`TejJ>rYc%>WmdA~b%Cikejm&Ehi(hg8g5AG
zxnA*|-*^foDLt2`!*s2dcuFl7O9Y>=<qpCYi6GLJ#|cLzlEA}9gv(68GQME~06ix(
zmV0G8+JWED_g9i})ei_$uVgZAvHJUl8zw}XcyX=Z;^GKgUVvEe`U;+J!{sH2f*TRZ
zDq)_TAl{OlkU~PF_R48X9&gMHc00s=pjTMMKt3|tJNz6RTvyqz({kOs;`|>RAhlRd
z4Zb2=tw7`z$D%8mJnV5S`b<3>aV$Ei9^{5v<d%0zQ9}7jZ}&DADz#W-7)d8>d5a($
z)AIhy!=GB3*7A3W{Xlm>h^=_xtmj?h0c*nM3nG_!K*w9jciy#4%q`?A=?B{d6AtrD
zT)!|+6=h&<kJYB^J->sNreu83yR9UR$jK_L^g$TjTgv8hZybEW)?U21R#}9G5<!Jq
z;gz+TCa76bH-UBmvYoJ&mfDmFV1@9(;u`iVT|an*(gju8O5P;tmZnY->j9r?uabQ0
zNZrOHIp<S@_uwinc<Zp!8`#85S@iQzy-+pM#29Yoox=X!;BVe*Q99IH6~r<Xq?joR
z&UI0J9=51HAPQXFmWMdN484*L9*&LrWt!qW$b?VLp<7|OT76vGo<z6$hS<OCNp!2<
ziTw7rN%UqEib?eDBhFf-kdyCQ?^NmPhm(Wf+MrP>-hK-7TrlydGqdt}??~zYg;AZ`
zJ*IipWs`+sB_fKvO%&co!MR7BsevWlbQ+00!g6EX`AOb7Y8ZDsN$mNPUd!)j!AsCP
zv4%#8N1|iIuO?zDdnq@G4LTaD-@*5KdTXq{jkwz2d_-PUG;b5D@9^0pf478KeW!{<
z=8V%~^<9<N_Z_$!nO~R4Zd6BQnett%b!1Rp88kRg#0y1<JP{kK@1aiaqeQw@CW2zQ
zk7AlFH$s$f>UtT9_HT^U&xu7VK=Zg%|9zONH7`~Vz?^#!wK&=fI(7R3k+;cel;5-^
zR-Xk&o+~7s8%3mn9eL|ZBJCs+DQwSCoJPtGkFok(I!)y#DYA_t*1G*icA6cn2jr<a
zvHH`P8mzN`xD#1{p0Pl}reFm4sGu_7oiuI8nOI$RB^+HEnLlha)Uzn+=u$9SJsGRF
zkmgj|(uRBxtG9OBg7EzktGB_Wubr>zI%YbAUJi@Zs|lemt;W*T?pQYUL$g)_H8}^(
z(^F#g)C5KZ&pBI!)<=Y=9@KiV_K+H@qbA6P(Nf%<Z8B`UIW-UJB}l3+`Sg+eo4$u=
zBf;d1C@s=jZs8Ewx{-|nBFNUY)NL!Vx)}mu(pm=-a|dQmfT@aAg*K3#gsl)UK1$40
zDL!^&sgx6>9I={nC8NXIs<F4I;hP5;>*`L9{jo9|*yXg;s{h2^7D36(JpEMg`D57F
zZ)3j})T`<geC*e$>Ur`|B>c71Y=r2@h$4tidOjAfSAX*^nM)jtRa?}*z(#7-hs3@n
zie0GbZ&kNS+!rdb&XchRc;-Gf$c&oVllkXgu}|BgducvOEH_4haF`Yvza;i)HOF9p
zM?J^JJ}+b@^6boyT_|K2zVx?(!H14JE9+B&Gmbl}R-8h~&>kt@yLhEa>~ye^tA4Dk
zaMCw;^f-IlOW+`um>N5?JndpFb5#63R+L+oIjGvH%CV!U+OY?tRrei5r&0%zYc`4<
zs}u`bXv757Jaw!tCC=5U%5up4V9(fIQh)s8V=r11dSUL}gCdj`_o^8jcEV`}8pZZg
zvX=r&ua2!F1%7Lx*YOB?6dG7BL7)^z(P^QkYWs9-6M2?J6xe8?a4a^si$|!51eQDo
z;VRF@mV@x|nik=5=)Og`e4s1_rHe(ue}6^X_`+456|ek}n&~<pSXDJSK2+`a0Z>EM
zpdyD2o5+YVip7EBLzxhz>()6PDR{Aiyc-@*w=diUW1F3Kkje||sjbrk`XE|C%{`7z
z2UnCU!zMdSkrfu&zLRcWwhNiNHkqEqWQLF$qH?}7k>>YN>7%I7dHW`%>wPJe7I~D<
zIgqIZ-|kV>I#Ch$$n!w_q!(!8aNVCx*OTN-L@tmpQN|Ok^W=B~U>wZr&vH$0hNiuC
zVpN8BnJ3mqJu)m$8<iEWo_Xr5ii&z<Y_>M43vF{^v+ajI_^J4zW2=tp1~hPD2a&yR
zj_Qu>bsvqA3$I4?5IbC`6!>W!Q9d(4e)giuW!n~T8I|JsWc}#L6SaaTt7!Vk`sh^c
zjRo^L*?F=t&;D5j^J{9_yox*@e6(PG6X5AQM}-ye1vn0Q@|<3-;3?VMrI03!EO@G+
zAfasq&y*zVLfA?=U$B5$%&W-r(y0Z{l56fSJZ~&4cusIkp4S-#&#ULC(ZjU@$)%Pf
z$8RWD9D0sBT(BgB9(Sx@2^^@baVHCw1S;B*#-|FFRF`KZf`S)AnH`@N@I`k0WEOxP
zdO<MsoHe>&X^7}^PZumx&)9*tZ*jP&U^OGMD#KB(V2yf~0p;zxlD5I21SpNL!xJdL
z6R~RBzf{52P_`Ct7i?4QN3M6qfw`(x!CtzD+7$iHPyqWT6sXnH40qJ9ynL<TEt*Kx
z{6f!yW2TU#J;5V-hVCX&p*0spd?%_v7gu1Osm1cf{+;)Lg>5O&6QtQ?;@xO15v+}h
z99>bMGdqHUn;ur6rz^hriWM!TB0^fNY0Q71KyRUFNJ)1TcH8^0C8GGEjJ>%9dWX_l
z@Wv@;LZGlfmy^?q62z#=yceZDGv!GxE1jpKeC_5Hj0q{<ljy?PmkY+!qG{y$ROf;*
zyn9mG_tcz%G5v&lsz2=2f^lx1Co7@@I&mJcZJJS&9&_?bxVY#@Gg5qX!jv&Gx{s}z
zW;CEzsI-jJX+}c~zq&kO{M%_pBN(atq~N9WNHe(hNUeGZ;U|~jZmleprvC@Rr^Zvw
zQrC#knV<Y2a@^3VykYx;zHw@N<V03K)AT<XHBL=tLpiG!Y5H9`{pKD7-Mk@bhR{=y
zl*Va>u6iOVYd=Xd3>87Pr-lIOJs`~}=^-*hbE{)_X@*aRDU5=UnE#;g_45t-uYPJ8
z^`7xon!Z)o`!!OA=`?*8o7YeM3Z*RpN1A>_8mf@kk&9{i(NILH@h1M?lRwzT<K0N9
zf7>N#`U&Ai*1r&%eo_fdEpw&m7nKeuE}kev&*XxWcOx<MS{+ksNTI*OW6t`tKgDpp
z+bwc<VAvz@<Di@;)}l3OdPyl?G;zXwB6JG*qNCtMB}xuUL;i$H_@8N?$`QJEACE?o
zpH`BwlU6^RoThfIh(|GPM4Gi}MI`e|&$L%mslP=HAC{}7iEn!)E-;IM@|`tlmjF_V
zTr&T}TDof5KE($_;A5X+gXhVo(vH)Z@BYT~3s0xLC(nPmqsX{laR>O)<7o#}V_8Bd
zK~p?FS<I)FwwR)>kmbE(i-Q*_tn-yPA|tf4rMwb)FIk%J@k^jL_$ZB~YP139)6t6I
zdFa%Yxaj<$sL{OI2&OPf{LZu|Fb<WURGbF8pK(?wyOvgBT;7s4CRE_ZbQ6xWJaLBo
zsBvIc`Z{fr%_Nwoo=Y15rYr!SE*mXtIB5gu_3DmvYCizCgu4&MX=#J7be~U(k|Q2z
z>P1DNhIVZo5HzaL5U1zRY8M?rqdN6ci-)^v1`TzrB}47w2^!og5UhLF86Fr6YD$lw
z(TF)?rn+tD^n|~ItiD!^A-CAKyAjmO3Zvq6pI$3h9|OP_<z|%b>`ASdyh^2N`Wd-r
zZgPI|sw#~1?^5CMZzr!uLz=y<4uB^I3(qo{Y@K{qHL}>snV#g`N_Tl~*D(22mX}iB
zrFkIRC|Tqvo3575(>Td11M;~!DY=t|X~|;}XsT)Wx>pFFR1?1<c}xwk3z=h(tM%`^
z^vKteLthVQQyF+XFUZh2SMtIlZP|ig_j6p`(hPWG8dc^-)(2y!o@6?4;if9pz{4Ms
zJdXZ+wj{Is_v!3yx)M4|ggUetNZ|Ffe&J6Z#uFaFD~}$+)cpNKYx4d+#M>}mZ!?>j
z?^50c)aS1GJkn$qUUxVwOK~0HD1j{wTJ)6UDN@{2A&Mv5<^{q6iRALIov>9R19*6y
zP$<Psp|}gPtl};#0D6q@CdDmlCB+51pLdoCaPDpyE0&<oOP<R<xwG4uM$1>M+ngnw
z7VNzMK4AWCOo1!jZp(K^mW`7=Mf@@)PUdK&ey$?<<krJBpAbH(LS(i=VDhfe?z{Am
zxYLFP!lH|BJ+#o+nJ>3Gw)q#~E6B^j$+8Goz<E0-%M4s_B_LKJRxJe7ML3I?h49o2
z_M}Q&YAs8g8%3gkTTKz+PEy+}m#r6lkzDyWT^3k&gf!okoI{<K($%aR6VDH{lq#pH
zrBrQxf+e{a4yDRT0Sl#S%ZS$2X(`piN_&Z8-P$&j=3Ax6iMDi4=2{&6d<$u$cSxpx
zwCzeHaN!M}1{3;A(oP;G62?mVb(i+LXt&>&K<5*l5OwMG4|RbT7C)D=o>sh`)JoKe
zufgT1PV@f0<i2*Nc}eOwMLNxejw!hT={0>5tqQiK+1oC%Dkz_~P!-$-Y||*YNHv)a
zWm<Y=c6VF#?H{V|1yIh|>iQBm@cu$_f9iXoo>U5@XnUP-O(LjkJ3NPWx<m$W;ZHlv
zS-V)N?+gFX*LKLbT{883iPz}&bq{NMxxjO!!okFg&e(d@liR5ZVu~&-i&n;<9i6*@
zTpC7uwW|eJ8PTd5?b-`Y@ZpQj$~7NPZc?1>rj@OUYHllA6KQ67A%E~c!95q9{+gwd
zaab&i_kL3gzh;$t#neo`hp%69`uj&ES1iUK2c3xS$rTgWY(JA{Y@AvlFTe<n*OC*E
zT<TwP``q}$$)$^PZM1T+d*8~1=`5Xz9oZP1bqS+6zFF8Zh0FY82!*T3^2M(G#%UxZ
zN*?uLo!V!K(xj~4<YCw&x;G2siWL1~S0e9CXco4b;qGED<ux=5TPqD)$kDzL5Lw4?
zrktRHGtI(YR!v?!dx_QB>KDa1Na+DRj&xk?XP;bwVkM$rGJ?)I&Cl#p{M4T+KhZfj
zo&B1HO%GM_Qn}!O4|r9#6Y|38jIvTDk@|lSp&6A2B23S|pXoUk)5C|u=JWsLOur}&
zl`uBjVhnHXQVAP0$6`*rwee(rq8e%Cm;u3E!_IKGXJ50h#&C!9NRey8Cg%f@uJJCB
z-eZYmN-~ie|85qRhA(yLQ;0wDS+g*C!>rESMMXCYYpM7mMYwN$Kliff<YF&dmKj?k
z^TxD*m2N;UU6CceW?{YL`CpN$eh(@-QU{qMNVQu3UEXa}m4ZhvJ7dc)Xl5*h@eg{b
zalV<c5_!gaM!ucbgGHBFd432&AJnr58LNs1{SRcB4cZ})HRu;d`2rRz0bz9P4|?Hf
zymBg6Ex3KKQx%h|w^hXm=>>`oAKbe~di8yv06vCAyBI}0hR1j0UQ{Zf>6cr|J!`oa
zl{XO%Q*(1a#8tc8lIKo=+>hxEv)V>Y)N((m$gxOS4_W*|uDZ@m9L;l|=Bn%5<o2cU
zTJGmy2Y!f}FcFGh$aCOlkQ!gk{ZfRgGTg|$t^_Q;M@o-eE@us03>dg0i?nkZc#J(w
zSjy_|G1!9(C+k$DJ;tU`r7s6m4L!!@;!0nB;qM@;&K{$#jUsQ}9_!&T)IOOH%d6E4
zV)RqhTB)r)#uTOoAC?d9{s>nw+hfcO^+w;v9%Bxsv)X>!OR-M+JQgoHT&)p=pMz!f
z3h~3<RIT<|Vyaugk`U%dGlb>hb&nxk4WGO{i_oP#x=e$`z1qK?b+xiGQhXUzolM<Z
zlU7%9VV5%qjVT{K^lgd{0Q8)8Llei1nV@;}?Lw0gvfXsTlp3tU{@0`LV6ptmD957t
zVE~@n5#07M_kC>u;dw~ByWgYlinemKrw_GvCCU|009hswQtcTf+Pf3;M+l4z3YGvY
zUT!}3SXb)7SbMy;_6^jMsYidq=A%8#weN2UE41<ZW-IJW04MU3$B@dV79RahDaguH
zs?%VP{+EhSQ2(<Y{VtrzYGC`tgl7Pby6G{ZL{xJDyhYdxuv3P|C}jgXpf~M*1Gr?2
z$A}IA8)#aGD)E|r^RpuD;3c-V1=K&StjDO1)_pvbf$`=qATexqm>`jFd6-QIRN++U
zN|lS9g_2i`@l=#8a4%7OhXsVEC4!_nEF%OZvV{i(+~H-$%Y#<{sQn>R)f*pP(Xpkm
zT_%L^s18PGj?=uw{&*g~ku;Izk7jAcdtUq0>Ol_?JmQa+iu=UtS;>~JIo9k1b~3o&
zQ)e|kpl3AiO!TVdaVd9J@DA}>S6&r;e8=|5IuB7`6zX41HT{#s;LT52e`sf6eUfHl
zby0;Jf^*6IN!L*3`I7l?m<=8g0`HYKp@-F5(-7!0R1Zmguj!vwp<x$);xXDwV~h|2
z**1aDR`bqXl7(+%FR3_GB9TwdL+k&R$l+O*L_YZ%6k8&PS6CAHv{dk;&)A%Qc$bLe
zesP2@4?oaJyl8$I9z6P6xY3`!XuHuJ@Vh$fu-#}daHAF8eQq>y+-MtG>_uB~+l%gi
zcNyrgANs{bUQtC}v5NeFB0rPs*u``2@HXLis7NFZalyO4$SbNy3wp0e6%Q4OH`w7E
z*(gyddEkvS*~BToD7k(W>-ZU}X(>64)8Uhll8d5$V=Fo6D7ngXzmneuMZS|EO5TzF
z)#0wK<Q?g&9V2P{H<;X5N-l>gXiC=AM9niP-fMAmXo^gD+#Zkq4L$C2_Jk^CI$|C>
zdTnMpRwYuU1GMOIWN?rn;a+d+SeN9K5F-x|X%=FnJ(0FBa%j56Nbu(`oZfExZ)*B?
z=P0eYD9U8T+9csjZzrmDfE|V3?j~7Y^#47Xo6y4^)iM(mT7r$XAlUCqrm5AfdC}*q
z$z>g5JV5tU<sA73A(_2NK}+rQFaMbyp<dP>*k+e-_y0-fk`|eYeIZA@0*;b1EUM=%
zs$Zo3GuJdL{SRxl_C*iUxv~B-Eu*GuH-)D+Y}4??SW*Stne&99<1lYvAVe}>6#Rp<
z-cFBIqG_o_^9Gx8#E^V(Eco;lr{6z7Gg>qxdhNcBCzr}wr`Hax5NyHZ9iA+VeaFBQ
zj{<0Qs>?>Wbx(S9*$ebxdB*xLa~MMyGxZrQ)R>w7$T&tDUJuCtI{cArBC@ecE3`%z
zJ!7k?+eb3I&uHt>^W}~4m$Pjm`D{RE2&Ism>mI$Aj#;xx5zo^1aWHU|mu?jHprUV)
zv<ED{q4*FlmIrwBH0;J~naQaO0IojG_$(uF8dR&%-8<q|cI;8p8i~{D2yXyZ5*8)O
zt2>V_SF9-DM*z>;W2M@1ESQ16`1$YO%AWd1yfyWoJzXpazshK}#)4cav@M8iLh9tU
zEeIG`5QTT21tE^nvZ2Km#ERP%q*Fz$hSn(_`l1}O+gS>C<vmMvZY$sbOW&^C2p+lS
z^p&7Pi;i54RMBco|5q&}DjQDFwl*Pc`$OfmHT-JlV1=)oaV2LTv}j!&9nAX58S9!&
zPyKdxaKKkILwS#015=?^xUO!N6)pf()CyO7P22v0hlZ8pB8_v!nm%2erLU&cRCpSb
z3Rc3jPW1?~`)OTY(4{SKQ99)j`de;GxHN^pHW1d<;0;5rN00Eb;unw|Ddn&{D?RF~
z4DO>~(7c^q16ZSsN3G5(;CX<j8RjD2(DZBXk-GYAk1m%w$V>cA-w?jyjO|O6i?mq_
zgyqP0Je)}acdwYOwxs_?_>V+zo;u?NcgC>@I9`I^&h(GYF<7)&OEhaI>HP*uPN>PC
zJ8O+pUHYiCVFYs{TViLW^1mBNgKehbY^FL_f@=8?Q+*XvJ3V?OnEI-n%~YT>vg=$Y
z#1%5?EMM|aOm!gAPReBnSKC`z-jS{@rd8Pv#Z;%iGbOyTQWCgsgIORMNv7g;lGfjN
zzPB56<`9NXU46~*>#Hf!qTkoiRD*WzPtiTAsRsSNF%*Tb#|bm2l6$1*mg=~~w-R3Q
zD+3|7y;VC&98azDVfjvkNA5LJSw95yfwbKtn*Oy3jg%gqTcTuz0aCsuT#?1Vn~RII
znH;<WajNGwqv+QsWUSgp`tJnVPQQt|b@347GYL1>@W3$DC7E6sIh71Ij}fD-yR?)D
zV|14hglv0|gEsC_<Qh-)kW1MmFrM_WB5{mDmzf0l7>@XqU7jY)NBlF_08l=q62I)$
zvIkp{e}H!VmpbT752bNrNM?D{`V!w!&t<0)0Vp!t^IWd2Az*Y5A#x9i{-IeuN=ff?
zB|Q?(-6;5mo6LK7K2`Fe+Pv&Z_vDH{M<<*{{f)iS3BTP<`#>fak}_ZE5+p1JMkmZ|
zY6-r}PGDPs)vf8tZEM3$0XqTgxgDN7X-*7jm#c)&nUG9*(v!#Xj24867&gFZUH$_~
z<IA2=_N=9A8rLbwPV(k`J+enY3~bj<gbv~I_QNxZB(0F2q!OM{Np^ZJ=|h0I&w56Q
zb&x#s3G;wq(?`>9#H4pco4RhcwCNFG0a2%}w0_su{3G%vYMwEINDFs8PB=>DN4t5(
z3hXfPj|m_8)p%fUX41N%SzWLBWhaj3Nzp|qxQOtBZTGFO_&mlpL)4P*Ox|$O-l!MO
z>Qbgn`Zr~5yWjN>vi;Y#`(R-A72bVzpE!2kh8Ej>D{kBUZV0KHXoOhl>6w;Q{-&{*
zl+eim(Vk3|%tr~8$^YiT|2rLTKt_abrUg5E%T;dq)*$lDLNy{-PRn$L2yvCZ+4T<+
zwyQLKlT8C}<!>yIE}jI-$-*eML{a(mpIDPs`iwBB1YqU5_y0jau0r5?qyHxz2S}wq
z_|J69W1G>+V)Ods|0lf{%gl;E!9NkO(bQmuEvxH=|4%yARrxRfGd&_f<zHf_|N6hu
z)ppJqyR>lC7~fV5e)k<->kRQBKY(ksoUb;z&NyvV;@dv|o5np^&-lzL>Dx#DiDk?B
zwoN7Yf251Csw<8`KoTRC*-pV@3{ZVE?L?AiD2E>t5>UT*u^``_%UAtxXnpB_`p6X3
zd4{HwPDklRH|Q3VA}44(LtEQ0Y(uwdgOz_Zw2Q#>hv|mFc+YUVdv(LgcWcgPaP%9O
zRaqEw<A7(lXuxnx_KlxOr`T>X@4xX44*|jq?6+|MlYQeZvF8Yw2i~yXj8Zh9ZJhFC
zW3=^~442&w5#EqURUS?g-j)c4pc}ok8@-e-(C|^N1nO=5YGIykV)FN3#k$i6yQ>Jp
zV0Q-o?lDvZE1Or}(_gG?A$cPBuhxZbT()G?AB%oZM*YRUBBSn9zI%B~M*Umbutr#}
z?)5FP47A14y(@_ALsH>g4>elh8HiMFJSu`fD%}x8_ZbpFD%}};y3ZG>tgxlheHoC&
zmQ)zu;ZUTq)iX%0g1pIi-5o)6SAyuuGH-Vz(H%*s4;&_x6}!eSox#(Q4C<3#Js{A-
ziDi0~F|r4?x`!VGTKKg~9(5u`j^W*midI_Dv$E6<u_WE}^pp`o))Z-XS$IPdNZLQv
z(?w<hH=DD{B3{1p2iChMdDKdTB9%*a%zb+$O10O{)7}y!*;h~YWT@=VMJrpM!R4nn
zpCiY)8=j126jC6|e*PMu#&`BqR;Zs@sFfQDsv2LbF!Ok18@U(+tB@<eYvj?xhH4%;
z8>PO9(cvLa66tK}gVF<TPrOk2-moaelU)@GR=gBCLcZ*Ka&FQlbVYVL%AOhRBk4Rp
z3{s~glQtnZIZWN7F`-U1dF!3D$sXi-45m$c^zqBd$E2;6q_iG$fd#Aq$eu?%)(SUr
zYd1*8!;6fbwd*9Qm&52-j{?FHjM&y*>>0lW!aC{QwksGWKFHQw?cQs#_P2RK&Jn%U
zLNmZ{t%W6RC)WoJfQ^%%;rLosGUlJx7ez@2SS0wNGJ3Ik9EGhVtd_`d9(EIUN*M?5
zFXMQ~w9ws!wN#6>A2@wq%$oSj0d4Df&2d&u`7Q5>>2t1LKMVY+;w2&8JzCNd*w6}~
z!+@<V74hC0XNh+SU0jLxID8zm#JeN~ERoE=3D+#?21C;Q3z$8v)4QDw$Tan_z9D&t
zW+0Ab)b`qa;@~K*NNZcNbQ6B*`$?-1$*l&qNP5P=DITX1NzVi#6%om{%>Pp)eU(VI
zv2fS=7B0js_4-yVhbSjpGSXg_OcWRw9GTQBmdRMk4<tPUFFmFC>MD5@TJm_Nh9wU^
zZmjjJ1+AXlELwRMmDFM?WPSTzz9iYwi~#kb3ekDl6SbrO{i>)!aQ}}iOW%^api_Dz
z-Mj9xDEe;@>s>)8T{@t<U3X1ebRj9UH>#+QMRrU*RfL@PO&VKMij0;k50b_<R30Xo
z2AoRb8$%W^uhI@r^$a9sd#GQ5y4*ZzL|I9Uh0G$02ex6_J2i@4{u{*R%1+m)X!(mt
z^72>e`C~a~cX=nNZ>*5!dE@mYdHWkG=Aq(Z?gT8V{fo=_vE<(%b~$#soRb+`loU&|
z96pHYRZjSA4Q)AoAgL@CmUAeJBIvu*UrmZ*ERv~d&)$Ugz&4gkDlZzEL3{~ezMuO{
z16opi2zU|Tdmv8!E=j(_tq|`5`x#i*l}Ygl7OWTI>{T1sg!xJFVr4Rj4<_{fyFnRE
zzjUL{KW|d^CnPcFv~U-I`-CL+!Dae+qF-)5NU98V>14e&5oFiOsSlHCyX_ndw!QWP
zYu7L-C4_el*co68P9`-MJUU~qPY53YOKYE$6@vW>*jIi^XhR3Wm}<R>2tP>qPg4F*
zau;*`lS%DF4M;^=TCcxQ>NoLXtecQ5GdGI_I;mWMcytyTBEQl}tC!OBpFX5t%5{~!
zBMIt4M6|89m*8P=+xajLw14kPVyKQrY3icNpE&=>U9;19IR%jO7jjeO&+JUWZSsd~
z+h~<Tt#OiAT@vT0Io=GJ<4I<r__byFer|Ek^jXgLQC0-SUjIDcUdl|hknkp4P`$3j
zwlY9%pmk({rf%!{c@a5Wv$ZsTy?B{Z&bD%~3}9WJWz7|Us!VAzJ*Aja!4<za%a-V*
zsXJtTz8O693ug&2L&ZBLx-8^gRI8iZj-elDb?%B*cd1fl4l+$04P=TKo7+39$?LQ-
zb7-|0Joc_jsL4akMrG#2fkk`w?m}n>Y-8Ora~K2NM~OqB_lQx$^QUNKp2XFfanJ}X
zilAbt2ZbnMv4|pHglMfx<c3UQ>gmuLhgCVj$z>mmIIc6kEYk=68f3Emlq~%Hnwp}@
z=u<|XDHE;kJr7<wd{w3oj*8-0c-&E~pJKX?J!15}0#KB+(b_WhPIT?TlC0ure)&R7
znTMo177&N%gW|$f*i)vzz##S@{@sHQjCxcnGk~Gt*CxS~|2VxR8>|q%HT{=a!7l${
z7S@2_PFmv^cK(eFU!+aaDpx5%b=9hYGa_RWLp%a$z?ACO_Mp8f0<o5p@>O#-xMLHz
zQk-J1IHb#&qEy=R^;8jQf<@t1M=>6PRo4`yG9(C3zg7q(snsI-Rq7DQ6oRUkKw{Kq
z97HRqBWX%2x{B0SzgZ>@saNcV)L$2=-$@)y<>TnvZ$7V&9IRR(jyLqbrs{eAJgtn_
zvVfA*C?qx1KU6EDjxCGqRuKyP!+_9970xLjhy25Vh-m_cBDDv9^=AWtB?U<a>i6dW
zu?<QeEJUC7{t-aLNJ_3J2s8b%UR|c5T%W6e+W>C#=VhaZmF(v0a|75_D9(GaOrn>o
z@mna@U>2^>Ylo=jLgkZBDN{2>)BiIElk(cf?4tJ(VkL5hhbn|b$~C57S6;)m_01qO
zlgN)e%pwFHlU;3!VkPy3Y-3)T7NwzhF+`Di_kAZs@dF|kh2p#r#cM#muqn#D#QhxN
z@>>LXaR}<dGVM#*#QL=bp|wq{Ur!=|?m}&$O|9P$K%5U${Pla3$RwmDN3UD8FiS8t
zvg#|Z{=;jV5x1Mr<u95MXXVxZouMw)N>`c@=S6z5{pE!kX2b=wWJZB3>*xMpMl2+w
zS~b4&7wK!BF(Y1(FFL4gA!Gkb3?ZvX{X8>524Zc5Y!2AD)QngbB{4SNnh`IlN8oW0
zW<>GT)uSew5wEHt3xD9w_atZhW=5>W94U%be>Ef4FvNPUs67_00cONr(U1%|K0!S;
zwlO0zr5?ZaBda902-V~17l>dsREkuprK%KY<2M8={m#l;Q!}Eq!WL5rN&UAx)hS#;
zIlQtNu67dtwi2B28;HS&I?(~;@IU<;x3EgZ!tYu%5LS&;GyGaeSifCXMVaAWtMtfm
zBf$Mv0{ijgTGct%%;fNY7w4RtWrm*)<@|39a5xS>4fc!zB5^UntG{F7$D83hi?RAd
z=5slb8P0h*?a|qhvLnO{KTKp|TMAgyzzjbk^b6H4ZZrI7abf3bnc<6y$-EBy#OFZh
z0on*v7!j(+ft7sLcFpj`7}`gZDIg#vti8X4b@!KGZKx8h+5Dv$KCHL|Ssa$?47*ny
zBDGZsvV+wO&lWNnl5=q#Gn_5B#AwvtrFm-11yVsEC20A$7-H2Wri2(Q`KL1>Q@wy%
z+1?B<SDbShIX8{~BDKmOvT7WW26jZK#HkdE%E&(v?zd)m@lLhh<*Q$<4g#UJD!*hY
zjZr}=7SHP1WX1Cg({vSuO8z5>oc&4x5nYm!A>%4ax<|%U)L4-bg>e0pAPONQQ;7Wx
zx+RCLdra5I#Wdyk(ZV-?NKX@*C`7%#oMj$SImxJY2&qjkb3Qa(@2QMMT6IQMt({o(
zKfXd{=$z|4>T_;C94;WttAP!=ZMx1N`22SmoDx;lTxTsdw0>Jb+RSKDox7-`CkJ=`
z#T_kYOxI)%5WU2}SwhBWL;nQY>*oSyT)zG+Sq>8R@-}4m9EFE1E5FKgO~d>CGYcEG
zdpYS>2wzC#c^+;OzSCHm8}k7<j^g*pFQcUCnitKhy09;c^yLc#ygUHoT8!y>u?Ey;
zvt}EHMeg?>!Y{lMH^Pp9Lxm}Fm+2~~0@6l7y1?msL!H0}$*}>Xy$b1w=~{wo`Bx4|
zj^iLOB0Ur-k$pT+v4<*SXUiXP0udUWuzL?>O6+qU<`QN|<U1Z#6P8N^W**v0c$G+4
z7!OqCp~DhEfgd_ccy}t1ihOQmWrF5-m+}3tb~03p3;ZxQ?Uf`UKjbCl<EygWmtW;2
z1#l~rJXYdZfOp*z$MS{{dCnF`f3&)Pm_kGxEAJ@8I~L*!LELAHq(2O?w^c-vRHUzp
zP$EHr<g0Xd+lv%hgHVwWCy_KB0@%j>^+YBgN?m&p8%7wAKx7cra*Pu2L_p6F0u_kN
zLbC*jYV`kx@Gt7OY8T5lx2d${^5nBY=V9@V)D?_yItBc)MY?R|RKKj#o31sn@mfGt
zes!vXql2Og>sc1M`&6j%KT$+cNEcSKpbW1!OxFfM+7YVwpCJ7%NX8E64^T+|g;Ffe
zK_W=T8RoJ0ivwH|Im$yK0beAbmH#i5F_;7mNGGI9<lj7G6NX6SXC9^zriwJAE!W(Z
zMwX_<yACxU_r*~&b!!|o*iwyhJJ>ZC@Fck(57l5Tn|8=m+H`GA1S!BPETzr^UI1&M
zs={;#&C}4d_zI9J1=befnr=2=C1JTlp5tK;VP{;CzAh67JtkDZI#v7lWYe{)23gOA
z=zk3Mhl+k%vW!z)q?rNNPGqF(LNf=9uL*31HjI8e+#-Ch=+a@=Emc`snXcCwkRwUx
z{>bedbi;wNeFek8K3|+L_<j(iNFc8Wr34U45hBTElo1H}JTRWXJDPx@|He}TLOqgn
zOvk`1!UJW54C-dow$zOeh-d@*5+0-pUQV`}!1BPQkFh7fGEgt`P9B7IK+2k~Lo%%t
z12u3sVW@4O29722h$aJ6AoVrVrN%Z^It`;Ort-NRK(Kvo8Dhr-P1kTDS|O2|jZ9Z|
zDDp&<>B<R3rhjL;MqpmvlzZwct~On{_#hMZ$`(e`^@!NtLMg3H6VufX0kQl}VH0BV
z^Vs3x>c`eKiHw!!Dm*_bzWoG`{ER2p*1t?wr{Y|jV{(V$r?@)NMUBmn-dLAN4K<OI
z9Hq%o`wP?M59M%_0BH%MmLILOB3FnsB@!JOP#nr2XJ3_Mx~fT}z^+I2GN6?iz#{v0
z)73)w8vlg+JR?QzeU36RcAKsWsw@g#Wth$z#RV^i(!w!7q+k`9NhF=f8YLO$_a$mc
z!8j(ln(6!@o)P1`T~?V$IlW{${}bZofqw@_J6&;sF_b*+G-ah8GM&3ZWrYdXwRZw(
zh+ayh#rLLjH$5N>SBF+`$^`?ejujs<oqNlYP>(u3nrb><!)%V-Nu>U7rc>J4LR)P*
z_o>>GLSs9{v(gF!7JtsGB8#zGgqdV{Dukn*w@s&<+)~XOChi)l;9OiuL`bCM4I=fW
zEFue=63G-?B1yAN=aO<Xq3m{jY&Q`<DH-f}hw<fcEKSXY3D+*uxjHz{<w^?7Go8=I
z3O;=%>`OAOp9=(g#DEPWV}3N9^NZ8(+UfJ_sPq<ilaZ#g7b@tiY<WLUHCN8Ct2RyR
zgzNaZ>1-`1eaKzn7?DJopA(@M1e~o^!@*S7PNuUn0`y#wT-!IA&PI|;9JaDch|rH!
z6@^5jq<bWsjl_Bu+7x6l%A&9~&2+{Ig->k?GH)%W5Qkh~f>9eToN;P(z$Q`IB0=q1
zd|^6EK*A-Cx0G8VUWBf086pA`s$A#erZXC$Pb<)5F138J8TMln9MpU>>|^F2hO2`m
zoG{@;vxO7(9mOpU+&06$jG*0ql}ax?VTSFK3^{g&gDQh2y<_bPGmJ%S^3yCYJZy%|
zP!YjiZez>lt77smOY^1tWQO%D#ye)?J$Mh#Ylck{#Ab`ku!hBmw}J;FTxEHMM=f3t
zGs7xLEyCp*Y^oY26X0nBIa-R>A67L1d7l%+p*_toxw6a%Z(D;`3Z2X_4~i4pQcbcK
zk~jVhGb~n$E|d*k2g{ma;jAvmHUQ;|8sV3)dx8}1QAl01fh?8{oB|Zx2n%OTnU>WC
zt{@a7%E@svOe~Vj_XkSY%c4kEwrZ@H2ot--ahj->&AJ{Wekr)NgsWm8*>wCssa>{_
zPcGFmO7wz0z0&bRf=%ijNF4##?oWXBveCd>0KWxD2Xoxwzi={$+2|m-2kKP=U;``r
zAcmJg^<j%nD&I%4RGm)hD8efltQAg@zUcTx^+iS`^oH)}_)RL3K~|imK?5v*+wn&T
zh}$seQCy!A*A(k)8dVj5&QB$&bQjhc|JtJ&5vPJHOS*g|ut{Y$68#}~sH7{t9UCYk
zJChk#F|^WzU|34(iUlpvOQe=-<tQO9tHs?4ZDWyL0{Hn|r)x%Bd@wQ6RWYHQ>3B~h
zm=43^lmxE{3t*W2A-5zrIMP)qz(S+ry?2T4RP7L%r5PoM<L3w}JJ(dwyDCW!B~eZn
zTJJpz92Ej9?T?vkI!=VNfAN>5!@7$NZ7bOdAuYZQ1b0;3`%-?p=?JW>!Akl>Yx3*Z
zS^nPS*Re~4YEOP0yDbUR13I-c9n(TRpyUSN7ij8fba-VmnCLsEp@A$~s4>Pdlcs(2
zq+P(X_ZRRSc~gr^u+HpAAM171ba1l_%?#U-E_DSN5V5Y}AVh1yT~RL2LpojMSXI-J
zQ;FL~wi02+?ieL}hL~1vfSO?rdfIffDkj+(<gmG>qfG)iC)liYyT@9vVkw5bUrdf)
z3l~LN2b?rr4pSLXEo&;ZOsg!<Xj_o*45}@<nI`oX-TaX7Uc6?M8djur^y8<>FUOor
zM|uqTnlOfxnuU@xj188#QmK3%Y7na6f0cR`#j2pyFiO2-EUGC0ZmBw{;Tf0O3rZV8
zE3~8IJelA?EjoCml&h?(;~I?#LGZ6quBw5KT$CNvPR7gWbK5h%Z8aU<D61;<%Tkr<
zQk7Djtg3kHSXCL^8_Hens(2e)RT+$B8JthwD|O0rl%<g;p9HXnuo-@F+#FSTMPI5D
zEGOnqkPe$vLF;Oi!a*H!mGJQ-wXEW(t)%N%^o)aS(oiWSD4@`>XsN^Q!*v9J@P<YZ
zTvV|B>sAFzB?Nzrc9nD0|5{ZrrnIY8VBipt>*#Z&ijz;GGuvyJ4kOgSrQTxXffa*w
z#V9#*C5>Yw3w@MQQo@9t>2}LUNo2RJK&2F4)&Ss$ws^v5C$2DYa?!_9H$V(rc*!(m
zRi>PrZ7S8>G{k92>LJ=&D$6w94RI1(*G@l8`%ls=vet)%Wc@|R$c0Lin#e+!!9gPt
z0RX4lG}OJ1(gmU?TV255ZX6DNgA|Ac`+ztE9NuOX#5kP90>pDRd2xdv)1DVhqfKL@
zt;5x(13f7XU%Exj;X@gdjE&e<85D;42yR+_!8w3cY#>&6Xx*Bs`HYP%BpZM(gm%?y
z&<mqL?P#Np1)2wN-ci%oB+~pCeIR}~E_gM@RX%zF=}%*}suigwEa`St3ACk}33E(C
zEo(|OOXrtBHJ$+iC!s#frJ_WXOp?Dh4RsV=kYmJe6XXHtvvMw8`?qNfLO@eaHiD7a
zF4GvvU1Fs_W+K#NpJ}M;6bm$B8U0LSbW{%6Mi@l>2TbD;I!A@)9a?1mxQWPROt=)F
znq;gho~B|k){rxsYE?CJglUWqMOeW##xwcA;#tC4sC1n?YZ?UICYIzO(|A;TDs|uI
z!#|tGV;(^#m~gm;!mKYZJEYBGYMMq9yUi-h0_VK6nR{X$NvR|$>#dG)ipn&>yLBJc
z^AacKj3%1J6vfS$HFP!MMYWOJGy*Lm#c>7l9^q6OO*6XDqeTwtgMlzI^eW*4fQc1N
zqYa%((1%f}VKD%oqXO0k0s$lt;sJ_4I*L&t`!IB6SlvWnsH;e#4pDStSnGkBQSNl0
zNUQLX%u<bq$x<GBSMGBXX@Oxwg&E#X8|A(wHjOZe?9!{J)<QoT95M~Bk_AofmLru|
z9HT6fUmQbEX0~FKqmR2kwKYFJ)LO?Xm_}uZh`Sqj3N^DPT(zx3{O?98XKRTRG-Uz>
zz1qjr{|psmif=yZ1t3&Y4Qks~5UF8DCd?-y=CLqFwYUCPvUCpe&?of28cK@IoJL=o
zQp*Vs^n_#&s&K~CKU3wfCP=T)4oc&e*@(s`B$0$TlsuOqiA4b4Jr9r;mtH#TO~M-h
zD-1UE&%FS#mcy<QJ_9)PEWjjy1$;Qg0q{>4db1Zmy6uR9nXvYyQ|oV-a*nO?F;l-%
ziGFHIhmfpS`L7j}WH{uEq^Vzv#!LB7h8=1hQ^wSbBG}aBrB@@8r5jBB$9SnTMKR<J
zuLx4=)nG!bE8b+mVEBVr@9JNxmvcs$slhI>F0YeOhtVl7)>S<)z|>FLGDu}$H8Mp8
z-co8b(of=q$-p}N5yDU^hI^<>mzFn`!#5Gu06g9fU@KTgF2mm^ybG{ucT+zl<^Z{5
z^KbZVnDjO&(i(P?A(&t4V(Ni2jKQ9XsG%3EY*aV9zC`-)AUWAoZg|mNwnA&!vZ=fw
z>pQn&#0Q(n`eL48ogtbSfu{@R1Q51~c85J`>gV{1kKx@y#(spJ5@7);8^z9M^P1sZ
z$V1=-eq^Q5JCBF0gbg%%*rW6U?>=H@2`43ToQE5PZzOVo6C&`R{f9)pAVTxyl#vK1
zIq;s-T_SgQpbO=UP0$RVa}M3chw~lw1Zh4@P|hN{Lk{=k89uZsX9MA7iPYlZ7~v4B
zO66)5X^nPKmKL_$)Yp{IjMxw0w%icX(Y72GosDumdH9vU@hhWT8#JsWL6-W;HQ@o;
zBjTh|vYcCvmK;%+kRo5ZY4lkb1P=ul`CPt0S<w*@>}(}i8KFd`<+!V~QNBdNc9{CJ
zyj3*fP@oab2~CCU4#>(Zb;N^&Zi1+mmP-8F)Q>97qTb#n$_d~CLE8!FQiW6+7)7ee
z%0p{3;q_wV2^R9}HEm?ky8To`&A&z4_9s(@T2iX?qp42{W%Q+487JMJaq|5cC##Hf
zMp4hnRDm&D8Ebu7NgByL5$ljxF}SO&t6X4+sn3WM;|om8On_|4giUQugoebjOs0G8
zkk(CegM|^-XDcgAWNQVaB^^0KVZB%dtOqP>`i+>>?d>&f+dHNnuej%XC$G~hl?5sn
zw?@~W4VZeOXu}hkauboMSEgS-c2>(AH#D1A6^7Gtaq(ginB3`p21(yQ@%yaW)K-<D
zJ!rTQvi+Q)L{Cw*0f63(c-9(^^c02&8DB<hB&-8ds#=$-s#oG84g-B1sMNWxsxtr-
zZ^UJQyFF&;vNr8u=sYar)3lAIF8dMOM*;W=mDSu)AEf4vjzupzTCx1iqEOjFutj9`
zmB_$MBcuWp(LKP`B_spsOz3Errf$6#;7~$;TRR^TzO;yjWD05L!*fWViFQUbw6*i$
zr9kNHGMDRHWX(Lws%_J1;;0txIgs?Mr1ukNw=z@Hvj3q!2+N_J5MYdxsbxQWdZw1&
z#JMWBtThCxb$~a)$E#uLk?hPg%1uQCxH@`d0;vT=YGc@01Gbg86A`pQ4QLzd20N8^
zm3^R;$y-91q)YzwWMNd-HB5{3&RI92d8{KlU7u@Z-WIhf5X{rqzMV^hYs<U5O&gfk
z1wKOHw}HdKbsQizk>L(}SDgQSr)dp*;Kju&yx@=I4@@=3Nq%No^=KtcJ|b+CcVX;n
zJ#3ESw1K?reRwZn2QVD@arFe7_(j4QU?}7G3bNcp9Fz2L5wL;#%<<JNyj&kI;oVdT
zFF+(DLq;w}KUX%b^!z+vP749E06qXPZ-_a^*4y0v!20=l#X7G7tN_i;C1lfL^)^}4
zlek;7l)XiV7f{kv^*)lMdusy|DV6^BSfc#Mp^;`jvxlm*&T@SDlyJ6?95j0|r7WK!
zh@)45Q{yeOrHx~h?+(hDYi4Uf=`JXvzClO#)ixW5A|tyB9{!J3vU`pCZ&_tFNVGac
zE_#{!7_b$K%~W8j{;vRA4W|_{10fSE@6P1glCocmE-ZTmpV*g^huuZmMtpSiFgA|l
z<iP>Y<MM{{+z2;At_+;JEGLf^QFo&(zmqePeyN^kdU8f$3e|I7_neV66fL+{A0ufU
zp2OaWfDzx#B0ZEf>-cDk+)x_%+<u-RHx#8kw?BH=IEo+2n9SQ(c&p^h=^Wy1vqhjY
zuAm}N`)p2UP!w;6C+2i+A>|^$1%KtpPHuHG=IUp2)Q0SU?9OifQchn>3&=L4T233@
z(8S{c#lIb;YR$DY60gj~B_(p2@qVa6)o8gRE~i;_5i)${4asQ+&*~X*G;3y88~)QN
zK#3sOCMO;H5E4f^jjUxfrkmt6m%`P3?XRuQ4vUZizK9t+DPJRkLY~_nBLXKvXC8J2
z<hjd&X_Z{H>wb|P7D>wwJ3}Y&)F(pEQ;~A$XcS}eIX={`ZS)XvOC<PWC0A<ov~0&M
z%BUE$%5dDeuMD+57b@dNs|?3a_m$!J>Ao@?Ki^k|<7cakE(w&eC);tEGAebm%ec(i
zL8u;%%XRP7V@ranhvVb>%lP>IGCsM#j8CjG!V_JoEfTUFeWi@NnDH8qaXe17x1#V=
z7Ma$`ptFF07S27A?Pw_2I}~<98WVZUNOZ+lIiBsPB`G&!#`EPKBKQYN1ZVpYp;<vZ
znCL2BXIHi%l}fl4BY4JTObc~V4P{(TkO*xP(~6X2mC04vwP>VVvGZ=lY(pxjcD!U8
zpQ!eZ90`q2R0jrSZqIDvQzZkrw}0)XY~vA%N*ouHI|;N$Qt)THlkM@xi8Qv0+S@YQ
z7*oS;@-m%+dKK40J*s6Joyl2QvzU}#!E^R-w8`jPTXMz-^PTCvT1L!7^vdYm1{^2U
z_pQh_<byi!sfv|(;_&Xl?NwaO)AQ-L!-qb~Hi!z@Mx0`sTw|?L;u!rYMP-Vk6DeNb
z_zuJ@p%$#>chzY_-jUt2^}C_GOI2R|E>^y>9C*w&bR`(Mhc&7}w*FNJ@oNk5D^*Bv
zh2Pa6a5h{2lv-9PVI_T<sLCJ5XKy}D)o4B0-!y7Ww*H)LB&tZaSuhd+@~Cpg>QMS~
z44}5MlcMYdXv^<p>(9rEc!<pO5D~j6kv!OcKAA|x4B=N_1kBn=^BWPxE=@Vn7aU#H
z<&Ulp3^h{-4d(<`RdvM;eS$)~&t~iMU7Fz!C%f=8pSNa;!MV$bz`s%?VPk%#M5Hp!
zKhM@{*_H7>VP~v`=%|cb&O~Z6sZ6k3lB;hZKU=SgFJI*hrO5YLq?BrO5C90bW1DQf
ztSwysIh$5l9OWu!SoO%(<5aao59_YT)}xWL{}&r8x^6L+yzIehwPmB|r0jQWa#iKv
zz=BdEv)^G>Tt!BQhvx<VOma<5e?0qJWIFuAs8L$>w@NG+Ml|?4tk3XoG@-LOEc-}^
zj=b%G>my1u!JXAy<pU389|)!XVWl2WsoHSfPL<92O=l3AGB9hHtkYF<LH*L>S#pv_
z8^Lq86IpqRVV<}3&l<_I`zX)D9?O~-dR{OxD_;ponf<Iu%It&F%AGaY%TT3=jxU|{
zXn6{V9AqsfWNe+Kv-<Wx)(=s`CTLl+82y}e$h2uo)&d*`b^GJagIUk2XLZG4)(as<
z<}S;6L0lvmotEFpdO;~2&)H9BEe_%A7?JgwdX`Q2gOjrkLP*^=J=2qQD1_v%kab)=
zi*qoTeUxm#M;hI~%&M-WQA6=oOYz2{yEgSq7GI;F7A>NMY212wkvUG&+JETgO&IU<
zUxzLEtcOwEz-XusWjMc3%O;!HnY5;YLJ8BfgtP9j-gvy#m<l@9)WorPn{Zqrjd^&V
za6X>M5Heg+I|VL5Im)5ml}yYm9c#vbbB%CCHX3|(-!ANaSHz#vUuLH;JF^4UeGvUF
z;iy=Q$oXykWlj@Rzkt^)yF;kKTaUZL+Di?1wqBT3zhKwEuE1WVEaNqISSL$j?9rs~
zo1t2blZ_w=N8Di@VX(SvKvlK+jp<45f9z_BTa@PrRcnE&)`EN0s?PQiRjoW4G_Q<Q
zVafkdt@-!EifgqOM~)1;q*n3*u*@UwunN@26X?ctZJRVnt+v(CkzK$`Q7G-4SB+39
zF)xQ&CGiTqR$Jno2<;}(yza0J)$mN#SP@B1FVbWEocB||+9r2cJ?8i|S1`*??m(7&
z!UU?G+=qwR1lgdKoXzwsZwav%BsQLh4TQB4naRT;!W$SIXCKI_tu6`6-Hz`_uGtF0
zPRVeZ@UBE8!$*Y65`l2uzX@OC8YRejf%6$+zY~75UgQZqhfr-rU3oj7#+y7n7MX{)
z)r=Z)Gl`t%Q5wN%XGufW@@liDmo!n7e%nNgV)v@Io6clcjg}OV@Cq1x7*UcJs7!2d
zS+^6=m{6u63Y@ArMsEQ;2e9>;RFCZ>sKN2cE>ED=9SC0$#uE0p!y1bqZ-^i<xg+VP
zBTGoF_AqxyE`#*hIuv_Jb6hPU>|7Trp~4PAfmF|Q+O89I@a(mg&uW#Ca_`L-jfk4U
zmglC$ZJ<`o5QSvP9~(wV%Y}N({nU{h7GcmPwCSDY?ywSQQ<-^`cv>mb9W^g^hq<LY
zFgqIQC3xr#okvnqDnKpaS$9|&Y;CO<ISbZ#y0B1YJtd4mVzuO3>LTX8A1U}QFrEf{
zR5+g~vtQj)-D0=ahauD=1<tg=KZGigpoGv#({s<r+&1}Zw}S?zP6_Z<eRS~0+N_dH
za65icz;u8Y9mJUaJ^6!VNcha{_*A7WCvC;6#IS7U8k(c=WjBJSF7o1~>=L)*8#OWz
z8FkR@xGpILL?*3uJHA&DSzf7g&h03o4<je(if5j5JN5=x#oC5-<k}UwV#?EWMIpCW
z?Dz;ISCvo+VE^s_@nfZbj-)S+%*2_Jvebr`0sxN_xO0;Z>ewIZpx_7#7ZnSnZzAw<
zXRY)fno+xL;v>T*1VBIKlafi2=Gx04*X>G_wir9~#dPC{GJMq@0YRz7WxEz5kCWr5
z>>hJ2BU>vrtZ6ZkZpV3gUJBc_4CfvYz9alwB1d5vjFEpeAhHo<j*09qee?`)KOxS3
z*$yG*#QgGSI^*SK`*z-yOBb#E5o}rClG&bb^~~DLnU%_P5LME)FO;51`4xiK>bU$B
zwy&_zQs~zf+ANt?Z$GFyaFx2QYJqJG6C55fQf7hjkNz<l)GN}<MCnU5MlGKI*6oms
z`ivAAB=`7;;nC^xZb_PMLmjvt5vdwtlWGXrWD<YV?Rb<tbrMm8sG)AhbZHY_xQ(5t
z1>BC=NViTR6U7wS)SuGB?I=DQXw(tixexS@sOpRf=+g;u<)TjU+n}5)>QrZZp13W5
zm1S4&d8&^l>I0*Y_dLTmh30ky#@R-GRDT+wpDYd6+vs*QWO8J#f#<sN9{h=MK&YCB
zPrt*n+tD<{a-Cf^f6YP%`iwfq0F8g!?MP?dTXz(f(i?Ry|8J~sEl|L5U(P>lv=+t0
z>Xrud#x1v_0}P@65UX4He`7WL-=KCjsK-58vKd!oX@it31NY)G;p4(4qwch_lvSsb
zG~F``+>RPJ*meJf81gp|X>3Qf?{GV6R+NY>ljM+0>b_-{Q~O@gAN(B@YR1}5UIDOa
zUfR)IgY1uC7b-fXs>r@xKMJk47f5Zp&|^U&tYX;8<8~y33a!`3E`fDd>jbA!ul?Ua
zp+ap8sb1{!0k`o6Mb)1Q?o&B#;|N76!`8a1+c?X>qduhb#7egz-n~j`cg$@lt5Qgw
zPNaMgN_p3C8<u6XWMW)X?1A<`rrWs2x~b{{nVsB*`W_6Q<p~(|ez4dyzAEOtzU;_A
zg^aI@Rj9t_e`8hqJ4ou+{aLs1t5SF(HJ)-Cf2s&-Q@^)`ExRaf0oBiC)ktZC4GT%g
zj<SJ-gFwUF#yZ?`SsP2g&40i2uKMS(%M)KB2}>q+dDH}gELIB#vi_-nPXc@#gYy8R
zY5nsU7+Ky^WVd&78?xV!!}8F@-_(u^-3HIubQg;b3SB&<Q46hc)p$|pVyH)LA>ce4
z4YrecisoRV5Of<srdJI(pGO2gp}`TX8D*!ly~BDp@{e6cvh&vwU})CT=WEOeoEzQ7
zG9e+i@h~)Nqh2HI5rdhYD?@QH|5cgneB?Idb5u%E8*Eo5&v?o*c_eqA>o$t__B1$c
zCC{*uTX5TJcegPXwM$hmCTgE0#;BsUP)f6p#R*lPeDVz@Qcp<&AH2kiZet)u?t&P(
zc_OZc<q;QyvoVl?+gt;?Zxap!6fy%5tLF*;2BA@30~B%tn<{eJXnNVGyAKYA+($r|
z%cq{D`2xSXjp6jh$~4{R1VTl2wvNsQ>koPL$1i_wV+3+aeW?LS<2A;e3ycz@W&_$G
zgUBScc6;GAp8L+=%0|pLmltX8N65t(@+<jq`;CTSjEjv9P)0364T)^$p%Ecfu9M>1
zlSZSH5Y!v6lxk@XQgDCgHXekP6O7H8TqI>QJVD(=3T(PoQW)JD8ge#Ar0`%}luX1h
zn#t|xfj~tJ4~E1r8z6hGj7IQyB42ovU*WN@@F?5B6_3loTNdJRBa!vO<B9)a>pbAA
zDw_U(&bc9kK&nWGRB9lQgf0+zlWGG2r9}kky>mnFO245Rnp7#$6*MRaDk3T>R#16;
zR8V7k1XTQge|ydi_`d&qK6A4>yF0r(J2N}GXV0E_!8WFQZRBvhdB2o9xUE%VVw}zl
zbG<sZkX*H}bAnn(L@n!F`>tW`+=NOqRqEvB7^e-T>b4L3P%pH6207a#k*Eg|YI>U*
z$|+sN9dX)w?g#}>cZ_iwtKix|<NBODq+nxQi-LlUQ|~U=)GLUzKK*r!Q_m=}I(U|P
z7EA^cr|d-DL+<LCO69t(Ul-%V!2eUYD0Xr2zkVo8WvX>z3=Mem60q0ru{wrPktz@Q
z4fqzM<UIxvmnsj1?$88~Vn_@ghDM6J|E!@sn4uYkdyNSt{xq<F+*&}p-wv3RhrmvO
ztBL&AtM5ZM1J5RyIoe6$CPC~im=nM;Oklm`t_gIKT}zAl>+SAS)W~>mjBzp;@p_lg
ze!bc~^fSOjx)S&a_<`=luuwDacMrV<=7xDBb!v#E7rdQ%dcoW7Ah|fT0@JeLS6Pg3
zr(|%Moo87H@S!(jxT!JUS~0=0e7bnTxi1!8Mr?+Y&(V`}f5q6B>5bSkEDQ+YJV=cF
zwNS8eSUgZh1rAYQsJVDB#{M7q2P)7QXds<j;m7%F&a$Gu`4n<keS>5*WN<5`s9}v|
z+*afXXX5qE+Yrq;?YT0`!n#Gg9%KIkQyMI!>k+RL(uT;ezCdS1$`DYc&%w%^1^L#h
zJX7k+7`t=?Q(J>bc$u@!vW7ckx~&NA|8PnTFRs?C#H?QI1$l0VHSTGPznWQ2hcNaZ
zI4inxx8>W@TG`mO;9YsA!GngMc2tm`S4CtM%O@_ebs9Y75osBw(yK1=Kqe=S{;gt(
zw>eV%bDzu@^=9&DwGh%gV4`O~#Mr;mpN9GB<`0Bg<<Q0!K$;?(2rLEW<NUNjwj+y^
zH=vZ`U=gq3FDZiU9sWLWhPQFyhTjSx$K<XZvlRo=uyl|ax5;zMW5x*FQCv{Bgcaa?
z1qE8gY{I@aZ0{8qQJp+hf(5W`BQn+Tz!d7l*>Ctb{BTBx7##M<;CN`}2WhVP4Xp5x
zb4<o!8uS2*OP49*Xrh>m3D;OOJQQSO{9R+QD%l&0Rc+m|XvpFa0pdm|cL(W$AzIrb
zszq$e2&NxlS3acM0RopBg_ieUim`Vx@o3UNd=UGg^`O&e3i>~83`tA``X0%MCxFMQ
z4H-KOx!+k&`9VAb%&lrHg}pyq#hBm|Mv!HH33tL8afB@U%`wOr`(-SbDR%+nd3t!5
z<EOsw{zBc<MR%#AhIY6}M_d2M<6(0|`3SyBqebLD!YDW9xZZv5Df?){r6aX0-^LB#
z{tBFK9GZ|--*TEQCBHe;vea<<NL#m9Bkpu4DAva<)~Jnex@SP2&0xkb^_%-Mj|}uk
zak;n}C(a!~v^Q=Dv~Lm`?_X4k?r?WPJ6;laC&tdDv59l@t-a?!>jDLuT1~sxBn7!~
znT~&4ZD`*KLdJRA_#5OO)$}C?kagTIRE#VOSMN2f+-h82qHuj=23**CL+r2;oyKMZ
zMUOSjXG>ABeQ>IAbK1Et-n6r5W@w_nTa2AkOm(pslct%qed96S2<ITm8sU+hfVSF=
zU%Dg4USvc9VtP-d%m*MCX5#=IpGzb|<S^Y#5%y9u@O(6qpxaMql)E>^&UR_|oyLEe
z3*W&o-9>)}MG?t1QsfbteTT^G0wQC6im^v{4QbNRqoHTyhDPmHq&8GTAec9W2o|`Y
zRg($``t3<B#fK=^KF026C?b4q$!;DiXZow@#u}0gZMroC&>L8_`+zicfLH*`0(qe$
z$kwV0#CBj4yb&h`2UVaP(wjgH2vEK?h<`k6h_UhSoXla&=dE!pM!pK<DbkMs3NiA$
zB99RG9Qas~_5^+feo!RcvPQ)KMWNDq7y-s@R5dBl7|ZBTX2-z7=AosdJ-tB)4m0H;
ztc{xC?;S=So9RLk39?3c@!}X8e@eY@GEc+8=3_xrV?KSH2+KOVdu^pgyE@;!sUqHJ
z@$w_OuC>T~2C{?4&_kb*#W1w#A09(H(CTQ=qx7AjQFUOR2zMYN=8bw3c+fK{9ol%v
z@gPTf9DVR^j!w+C4q+?IuVLszu%fB9a$2vV%u;}Ju1@P02|Np|S7Z-?-Q4ssYP(`g
z8>3+SsN;$-o};b+pNONc6ZjLjDUOD@9Bq2qaMXVnN2`dVK`XIO@1>%Cyq9W@6^P|L
zLi!h*8=s4@TX<}4mgKRyMMbgMV`dwdnG8w%pcuPeFmGp1-s`3L#X~Q1lLF39ofu=M
zhQPA{_zQRmR#TarW=rAR+1)Yj>7q;-vvs>^*NX05yM$>$uiN3d_K2~QF<LSV%a8Ma
ziYPR97^ULpNh;~Oexv>2mNnY-c=X1WMs756GCC1fEx)Sy1=>F&T84I>tPy5Ll}1}m
z8|`x$?jTJidd2A41gCkOqB4t)v1~k*i?Kru;eY#*S9LAeke_1wS3ChbiojX9YGjMK
z<{qq=E1rCf?o4~y;J~7=S3Kz&JptSZaOmq5Pq;>J0Jkc&|3J2kzN{fS#7_ao(I!;*
zyP&*rNlDB#-0{aK=pTKR9AEJ`Qc8W4soVTY1oaT0#W)EQDn0rq!00L}JsPV%`cI{x
z(qmA$F`<gICji+oF^bT5-t4!=RPj`L41+SJ4O~5%>k43thsC_WGtEQqy-Ns>=G`rX
z@cT*4UlPKx@CUvhJ&SkY-TGoSa+2<Wlidc!obwoY<Y17IEx&LXc@B#%MIF-vcmSrM
zr{@q!4fdFsfPZqTF$Cw@ddM9hH@cjBJJsdnn0LVOY*d{5;BHQS<Z*Hg92)b37>O<)
z`Av-ESB&I>T&LyRVhXA}<`!^65mb3Byc-+pYf21V9(xa9n1?EljR(ppAF4dI0iflA
zRCz3tGWG#+(sDW3a`*o>jz{B-aa`Lvv>eN#yZD7J9jqF2!qdZ6<s;49aKcDhq>-Ex
zt<>Mbrk^KGKZ_wQueqJ<i2j|8Ie=b0)&~8kP50(WWLqtStLW8%a;{p9eS#)FmW=Qp
zZtH2)*!iGlN~`*~TGeV&P^;G6(W>RU|Cd&6_&f$TQVwNcS{q*3V>Q<0ymWEWg_vSl
zR!lA{n8(`C-1p*Qwnn*r8LfQdM$9<RWhtjt8vD^YA+`TlHtokT)o8<E>^9)p-gtfE
z%38YdXHfD`D`tWke3+CsfY)?{uIBcbo`x7#4l=rdQf))4)anz{3t=#4g3!TUGE(}S
zUrZm@qoG*a7BQ^Gsfp&dem5|JQg$G)x@~A;#MYSmf+=lk2hO$)EoXll_@B0+4g8TY
z30}L)%4!)`tIc?qy9xBQ_!V09HE=m~^ceb*Kt%?36Wp(Qpgt$B!8ScmpE0w+T5+z;
z+8EeV^PL8puz3uY3{SnL4dze{KB~P&y$I7Fw)t#~6=N+p-Cz#<`FyPTI`g{pz@B!Y
zrAvO+#J<i_(+Y`bV!sB_wk@#Pty%}ZAhBya;nWA3*dG<_D7MY`H_F}VE6Aa}(EW3o
z*h56=KV;pU(!?IcGdL4z*D}zyJ#X#?JQ`d@<n17~-T8k}C;pA%V^G6~T21VENMf%!
zMMn%9LF8%92DJTyjK}9Tu~&Hu+gSR|D!T0-r3lpQtv%tMeY<jk=a(iI#T!4qL%R&4
zAWbgD$%2?`tecpZeO8I5B|mQRxriYwZ7i$xg(j_4PQ?aBnpU(<P$SF-aGP{8Vr4$_
z*rYRRZw-+7dF@J*Obt@I#gY1wX_L%IQdUI{qSb*R_lFkEe60!ZvN`Qua0%8oy^8FY
zHNa}3uLSVY0MdQ$$tFo6(!PkBE2)C2rH;BA1BdSqt?7TKNiBM(v6oyliCbuLw<kxL
z58@V<my8k~d?8M1Y_2`6aXxM_Gvmo;YPdTf?sthMhpD>iVR4fUfq+Y3GGb{6P-rrZ
z^1g^2H@POnbU?yCykgu`wn*CtJZkQz6(;>Ap7$uxk#D4Kh#O{j#~I9GlrmoY{ko3r
zeP7(LB*beNOSa-bWNOyvF;?6#XzM8QI4sw=>f{@q5;sgb$XJZ)1hi+wsCJa9^#?%o
z0eBVBxnExlPkkV6G&g-5E~gnKjYXDDeQLLOkWr7auf;vA=6sQFwG+`5QjhzuQw{uj
z7=B6P#tjAZ{C?-KxQF?NFj?bf1JkLRW_Lr~OtZHjVB@qP>T)_xZ>VSx#vKI?1}1f6
zkvi@i;Wx32?YgiVq1Ed-w=qvyI(XlXhivzMB@?L)<$-*-m*-^d*sM5`rq6BV42-Kw
zTVV!e-2th~_!qxI_?^CSb*u947+t1C^-YTi(-1v^HG@;be?G3Mv02{WxaM_oygBg_
z*T!uyHsj3Gaj8_4IxOF6dx^q*#FP#<={ZbEE#ooebNccDr))YVlI;fBtil81Y84~r
zx4b;tk*g>86$5Sq>`FKt{TY@uo}nEdd5<zP$#v{TjDa1m&jz+*D`2g@8evwj+IWBo
z#^=)5wPmwq-Do$}9DQw6J+6vrC1es|L5+Ljs>FNjm~tSlN<%X!7|ll2;&^$U?)cH1
zj#+NjGKpT+1E0p3SLQRpQ>@JW%2`aaM_f5~T<Jsg$ha6OLdR+3g1<Vf%!p%yTSrt_
zsjD^~?^fYyW!OcATHPx=jbXLEAUuCYg{M(vL?+YXOC>K>=ps6uD!bXb$Ow4Zbdb-4
zFU}6U)HyW4AITeV6?$>a^5PSW<gC*bbYlpFVuT-c7k-?Jm&W!iU%^<JPTe@PTA{fa
zQj@>sUHMyi`QgoLohzilo8nj0DETNCXIDsLh|n%S<SOv>L(|?jBOw>BPKi%+(A>Z5
zwLBiR^;%vb9@#4Ruu5oI&EJ!2tHISusw27>ug!B6N+RtwT9UJaM5}Y<RH*Ca7b(nm
zMqqrKChT(6SY-KD>x4)Q4|md%`AN)3hT!u#i73hcM($%oM_{U3CE3k5J+ZnE<jm=b
zE;UP7_P%<ca`Y&@?7$?ObIDE@T}@gRDYW;|lJWh3$LkU40(K^i^1rX7uAuQp$B$Oz
zF#_4ZG(`pxSPabP^u+43mTt#%I-3okab_!Hy!Lf$p5WX2_mlF5M0Xr21nw`(;bWmn
z%{6yqI-P$|Y7q`n=$i{B<tV$1T9R}@3(S(_p)II^y#{~p?t3%I?b2kCyz4KB^RlMX
zrKUI$@o5q-Fi=T6S(=K`UCZ;#<;~fk>hsJ+zx*ZHb;XU@@gyyq$j=6ao{Q%J>YFbp
zcw9ec^>dM%ee5CaP02!D`Qk}h>^WVwZDr4GNH^X6)0K;sR&zqc{90C6lHHITUBkJM
z&FNY@l#@awwmgfC=-R}>Xm@SzVd4pQ(@&OuMz+-NH2o~3->b2h4=jNdY~dOn)*_+2
zm`PWTT{O2<q?}K(6MsOQON1wxGbs;D43v40SNeJ}X~LEV7UCGheVODg)AW$F_^c#b
zCp^s?Ji{g?*<nR3cS&0`Kgli<j4U3UWSgUuXP8#H?&`~xVz;1zp72;(sFy*-uK|Vh
zd#HCoJ+>0^Jc<qCu6o&u;A4B){s47PMv@(ik#JEDgoAn{8dSXkRC!Ph=O@|4@8qfl
zD*FjgcXG7=)%vF-y95r8N9z$#gZziV6}0SuLEzr%mSmT7+aE(z-6^Hn?t4A|gHy9v
zeKOIkQJ8Olg80$qIZ%<L(~N3~Etr5T2~=PU6F^S9L7`glpC{?HxQAK`y9DfSOafNC
z|EHvppda`T3K#zqp`7*T%|?L#%33AgE_ubGf`rhdQ6dmU&V*2eBc~3+;k?@T*?F`i
zr<tw79Vz${aLC{uwRp_#+xM{{!5wuFl2CU_Zb8;3h+l{Q{5cPHM?#&Pr&MFdUHNvY
zrl!UcNxdQZ-~~-k7ohqTa7B?*1bzgrD{>SEoepvZCk-osP<H%GKi?vmrMg(Y_kOlR
z2Q3eIYI%sS*7nMF=#$Gs1}+aN)G{-fm=oChaA<g?lHa=LVIItvuAA-7;QK||IJZkx
zS9;*`!w4)YR;rf{IVL0~@g*4Np$yfVNQZsByD{e@_wd#}*n<EWc~EBf7)cBtf~=`Y
zZ&9q@K(_yztu$B>do*b=*oW(ZJ$Mr=BMA11%x0=$GtU7IAvqH`Mr%zdt{56J0oy(y
zL5~qki6s`egprwzRpMf>1S&ZpHCUh#k%k2YjLA)yn%P7Z>q7;miniow9W3xLkq3DX
z*R5d-%jrRODMZW)%j8;9uLMFmp?9zZF5-kC5*_=PI=9<2YJSp6>gdr-oSI*Wq!&p#
zC|k;}Wfd>+g_^JwJ9g}h*nJ9Tt6HE>H+B`px3h-b+e&;RB6T0L>{m(}topm{Ui+4g
z2_|gA@N?YRnlK5_YUP!>1m*%W`55vmEpXg~><nTpuv(Fx1hxZP6d6e1EbyWt%qtU_
z*(drDYx|WMgpz>@%vO2p^X<giMm|s9Yn~u=YvBXEll1n0UQ$UoO{u&i#FhcG=vUsW
z!J^r8*h;u`uU#3D?-m{``W_k2s^}%<KBDrkf*SZIKYt)fr90>u3>-_Gg|o#1{gIa>
zt4mAWnU@loXZB>1@{Ur*n7JzPxI0xn@(Vc4_&rSl<HRZp+)g|v&pYsC_t1N|EXvTv
z0*SURXtA4`JY$0XpQ+Fgik2T-ht4oFzp{arU!y;HV%M{lH3^SlQc;?VGh&XDb{pe0
zfV&BWW}8!|OuMlPGVPk7vuqXY_(mRnQ!x8+)gPawZUmM-$^pg$M9*mk<JYp|@3pUS
z55S{sVdN_?aZ(kak|LK0Gyv);a-9I9Gs$E-O@N`F^r#wplfaX}6Jj}<IB7C~O|<jW
zg{{D|bTALiPPl0~-RJt1gyv0p1vsIu<hxDo{$#Mp`f{e75bZ5!oH1g#Sk~j9yyl6p
ztOYdE$P-VvK2$#wQRH>fo4{F!@^swrr~C0c{1MT%)<f<x$#uj<b;gt+RkgDv%RsKO
zdsOGJ@>)Ud1K@p89N|)YG$Pnc!`TEJIY$4l9+<X--N92cW5PA`wKT#wB9tz5!Ce(S
z+B;ZU<7Jn+;-SX{(K%W!*`-U-gvH>z^@4dyW|yw62a2R@bW=>$xX(bmEJR>s&(K(Z
z92ZOGT?S{Kz)=w4kI$yydIj<%;_A%}H5+pv7Ysp`7EIuGpo998o)|)J(UKkoS5pTi
znU%~sow>cEI*b9Nu|)QgC$X>C)6S=j!WDv-C6m@*b$Usw6H9UoptEG`3V_M-b^e0D
zU%)LzzPBu$qMOX?`o7NpB~Tkkhg|bohFmd7q$E~`T+hBDmqNbgP02GKn9H8!uB?39
zpZJ$#n_rA<SbZJ|_tYsFeN=Sv3Se0hk?AG_&YH<~=hIM%<NSHp;HROyIJF&SFejs(
zlbPHNn@Tf5>S#dEMsUP@_0n%AGNwDC!F3ic)2RP-WfRk|i<UUlr4C)f&eM$siMn*J
z=WJ$xF0G-x6WCsmXM)MoDY2^Z><H#LM4kf$d1jeBJrb+MSdPCZd$ca0JTkpZCTG_(
zR5nYKK;nSJ6f*VvSu9aU-U8mxfS1NXs3*N75ICYjA@K&qS&XObbc34Wp>*(@Q?;m6
z88pp136V}a{O!5wtUYLsPFPmrsHF9UG*)tbLc6gHEe+hmL4vZ;CJ%E&;=I_9<M?5{
zb}8dLGL}ss6Re)X{pofYHcMaSK|rrusw`A2y<?Y$ByLG;@|S%Cf0%z6<m#aLK5=!d
zKjdZ6`mbm)M>%C%LWjMSDeXn;A&-_0ofIn8tV;_+t5WwMEqmD4kj~ZYl(;Q6<TaT7
zSObyL>^SUq$S})I>BG$i_Ha6zco;Ni(yS@VfJI<R_~|FE887XsJ!fM>E?`aieo8Y#
zM}wYaNPiX^vL6ZQy;h{LT~6q1%AW#WRQYB3c9nAFxb5dvQvx}qoMmOlhG0CM$9*`D
z5f}Ifu&u!7%ri{sLti2nD(HvewOHpi-i19B+chO0_+Am_=BW`tQB``4h7bLU7z#JF
z1UHaYykiJNnd-#am<gmX0F<~D8?u_N^v+cAThtu0z_<iXOaKy$)>Pf48spzW2sd`>
z{fg};&<l7(k(UWDIZPc-*J7?1!YCW$X<@8Wj$wQJcjPkW7xFv<ELP+n0&4*sBa6iX
zOx*@-RiqMu1HgVo5UZ(qz{|R_Ha5d!PHa=((k*hVW7VR!fj5xYiYw^*Z&*C#lF1u`
z;d@d!jZRm*C}T-a`5b^zSOlkHzH2UfGqJOUg+dIJDnqPFZTS`C<jhhUi6u0pOv2Jg
zT`FS6b=_L;rve#$LlcYC@}f%ukN0KIjH3W0oAW*#L%ufOuEaea=GU?(#D?sRrrDv-
z)8ub~FC-Q(dSVg!8rjSY&M(hlVng~eFnwmL03)tj0H#I3hS0AVAX-t08A7e-!+ygc
zXA)BrANHZgDa=hu#yFkHCz<AJDrm-?Po3@7N~)afm3%Bvsb6SPp+<@ZI`!koLc}$a
zQ77|@*B2Y|gao}W^+x>d3Pxl&4Z)+FrhCOAON!epEFzOxXiHiv&$Eh{UtSl8b@ZIB
zFQ<Ks&`v{Xr#10}cG?p}SjZT8ot8~x+LZh_yR!Bdou%rNZz=ZznD%Bte;kCG1S0!~
z@*e*b#RE0_hn5eol;`%P@4~<%{X^r!D_`~EM*`XXLz9MDUi1QFb$Aj^6_uf>0uPEj
zWNGmq`V&!jV19XM6dQ7pR`=^DUVD8mtUhl5*1^6iTP$7F>-3A0yey42@<KDX<uE!c
zv`T1|3xwMQnq+YiK|`!lA1j3AU6CYqXPo{`8OEd{Y>9Mj!_3o_7EId(V2FHO`x5vV
zkY7?}gq(dUIZeYQd>y(67in6si7jR3xlU|9Heg*RwwL;c04wpV5|OWdH-o7YgfDAp
z)j~sJ3m7uiXA+8e2`NgD%sXQp)3qz26eO|_(PZwajGZqF59my(B(W=Nj5@}O+^Jk1
zIborb_fWq5c-f}1GD+2&$%<sfD^GRCJWpNy9r#%h7Ds+;fIm#08m1(vspa%%)otfZ
z0gI^l6IiR{&6lXD3pn&^-y+MWfqhSK;S0X;Ce6a)QcoNNW$8lx%hZUk?tSc<$q&7*
zIz$NtNO$5^0sL|8U1ik^61rsQFbnF9kgP{kL<Yrm|MbQb)XJ)Af3WW6L5CKn-7qPK
zyRyqQ)rLY+=OiA@IMc@9BUE4>0E-uuv@mHpY?-<Vll=EKu)PdJ&lIu$1U<BcxOIlm
z-v?nq7oY=&?*2Xr79r2Ns+8Bk`m^}yC%gXlAM|jE;rOpb?ap{fL;l8$-li@;V&NYt
zioa6sb}TU_HoxxhxgAH~Ibf3_)d?I24nyyDyL`KvnJ1F(DQdSQdGKqZ#{})a2)qZq
zWdA)X){p2FKugx!8qn*2wEy-*0ylvFD#C=A9SY#?JGXO%*-orHP+Ac>nvJ`WovKJ4
zf%ZUiMet~{hX4aPUTJ@oZ&$~yrSjCGwx4ZSXMj#r+P{)v1|VCR3=Q4~C6)uMD9_{3
zA_!(Z{@+V#C(5iMhf{*oJpgC%e7rGkWz(_j_xRe;3vKf48jQdBwX9l2C&Q5eS=95w
zqhz@Zd`_7c`~wL62K=HO0X}?a*BB@R$}ijSMW;njLLWZNR$CYjpB_<9$Dm9P<DL<m
z%6aq#2g3Z~-4>Nh4A3L_9V^Mi;7l)%tW}=};seA`U*$n!tLM0)Il#Ui$Q!{qh3fl|
zEuN~HHLm2(_xu7gd|034UPV7o;8L_URR26v?er7?2io^Mldv11ifS#{4;2Mpc(g=a
z|Lzd#BH>IPSoDiH2t6Gn)PV9VC4JBPMX5E=Qk0lN3?(P5r7THU_8mHX44v^sFULbi
zuj-lxJxIx}!3Omq^0>%k{a-TP$W+^+mreC+g%te`C&NFGO#?GD)A8Y^57y8yGSiWV
z>Dl6jMyA?P@>|I>i%K#F-bVqA%=E>;LPaz(h|Ba<42%(gY8Om3{8G&iR5Nfyu$Il_
z+Ze264=beUyEU9ztyH_B;pA7tnU5L{{F33+VrBX<;7AgY=_UixWwPD1SRs!8<Y5aI
zD{h?Xv{;#b3V0Rj!G5KfPrq2n&lJ5$#|Fg)JN6Fwv~VyT`;^GXOn8P9DX3b$tzSB3
zho}^r04_VeCF3{2Qs~t5pM#~Uw>5Iw)-4sGQq#Orei&^{ml~=v-E}jgNI|jgs;oM{
zs!T4>po3nq8KuZrB3OzIgc%7~GSkHBeaLSmuPtiJ!VEGkVzg$Y0@Z^h8WO25+vmT{
zhHCYrM!2>WwM$XtDUPf=x4$6=W@JWd83pE9=Qf_`3~0~b(>%`Y+XS%JGe)(roPUtH
z>hPAE-khgo8vltRg@K;2UXii{MD432%a`^&S^tvLz%PGA{b!`;>7iV@5f4-#l6H##
zt(}QY74^Cp1qp0%sOtdvKlMmMfo9f275-_Fgs>w#HPB=8E8%&+NCw!E#wV?jORg*_
z_;}UmajC{xMUoHsi`o^SIapdCp`O_iXs!suF|#w!QEZa6seyw+k&{L3IF)Dumt<;Y
z_5ixWf*O~CrlvLnhAb|UGfd9zsyysVX*4WT3J0FFC>}gSFVZ_<w+xa^hz(0XaySOu
z&v&w?Fw1H>9sHb9+=ov3q#NJ!ZmIb+1*hfze(IZ!7(v1wS7i-nevKg2pg)6e(nT3$
z|4g)fW|pUrGe;8{X?Ub!*Ue<{c2T=NuKSQQugJ`4WSSzecsp3^X)udSb^Cvy+;673
z-)I1G+kjCT@+4*VW65W(1_CNpjKEgazgeBHy29dfrew@k7q$1I9Tp{QcXxS)tT0?j
zHn`(1V~4x|jzib-y5z-VyQ!C4ZVh=?CB_?4+I!*?d4|okT$g2tR=tj&hhGfK1S2Wc
zc*6A42%(9a-t75@7SI~=Yw^OZ-3hZalpR6eUX1+AeZU^8F)qYKvgE15h{oR^gFXQq
z1A)AieitVNDTHGm7qN9~;HZvb-^cL5U-}C&UIZ>M$CkbZ`e$mGOH%24uo#t@--t+=
z1SIT+8IZrL+9hemsKPWukF;mr1b!FAzbRG*-JV6`W`!%#ngDt<tCC3c%ePavs~r_f
zRke%JjuAikMPoP_5SLlap-~YN;43qkSQns^B6A7!0(vO2oWMX}fFc_Ri~-ot@Riv~
zARCxAkqCR%zA|qUTLvsp<Rbzv0Q<ZtHub1F<FA-e^+o2`VcdCOrnFfvlZW%JW{!0u
zh<NI8Z%X^u9LsD|_QQO;R)|K3U(Qoj<uw*(7zY`BW&Z=AbHJN8F=c;sSASe$XH;p}
z_ZntA)4-V#p;3Nh;*Jj>s#IC4zRVQAmNla4H!y4X*P>byit5S-^r<X{ch*<Hl@>&5
zk{izGMY!Q?w)o0o24?*Xu)W|b+m!o)iU5Tb=|G@35SwI7qTjB?mN>=XrDauJ7Bq>o
z@nU9|r&gK7*$m_CYBGtwvQLtC1z9nP!zD#!sdsigpbkr<vSU1xSS!~M%_U=4)eS+D
z$SSVZ5^}B7dM=d>%niT#QMA<E?m~Y!4^*FWbuSgWqP71Bv*_s{?Md~v14dL-E`zGc
z)F|sT0++?pH{4V$tBnHJ?Byl*SF+63ATQZ1J%MDuiqB9wy7s@)(Pk~YMyyhDm`n0o
zo)xtMw@<i9rpS1`IbqlQjT9WM5qb!3qxC#x4^=`f%S-s&kU1%{S?j29iu=dIA{omv
zSLq_&llf&OUe!j4oRRYwf---@-sV74MHtrEodDerk;>R{P}Uilsrth5=(;cb8B765
z*>1HXA5eSDreP`$=}s0kBlUG*o_HviKgY{9LAY9KT<R9DacVkwYW!vK@n(wYQHD1M
zgvFcEtU$F7KJu_qJX|A}=_BR&vRb2I;s!R*Ez;e!fg^uc@)XOjhHG9Ks5w%#_X%3U
zaUN%632R)DM(~RztZJ8#391D%WC>?K3UtE~`byuXcrsbAgg(BsWX)!RncWWr7O2>J
zSVA+6R?IA7W38O2)3G`JikW0CcA1P*fr(hcV%IT6EbK-tRf^cX6nI8NA`%(9&tyC*
z4h*-`X~tB!q<UFs_9kG1tQf~Vd=ZU_9Rm(1(w@Kvz&j#=0;S=tka1qPU0EB6Q@V);
z3OM@*;F@T#`|69xCWd{T{f8opIE%@uaE?!r90D;w6!tE{RPhqAM4*h4PZMYXWOBYE
zf*BxviLjr5!C{!w9V-|a0T$bZ6I}86@IP^r$A3j5BCC;(LeJ5nDY60qKQLJ>dL9yy
zb&09&Wr{Q>Ko{p6QUr;d^A7NqB7+Eg1zcg@VLMKIdTrC+*TRoe(U_X@UKpJ@^mdN_
zT9WHpr(^BNDVrA(*{6OIeltfrh%@dUw!pP^<J2VAdJZg_^9RL(D}eMcLy2E2Bz%8q
zY78y`=VGVlI+W8oV=fGw8^tGuiMF8*M9KZ7)C)X`8^cbg@l)oOBcu3gN>wFN*%VU8
z;!PobDRhLP9K)+A#+jR2n|$etAS`n;fyM<jRWXJ5rI7!qN@<ZPmuN0*oZFsB<AnkC
z5b_)6FTJ{SjbChO_%X7Nt>gKBbDt#p6DUo3EzkdR!dQ%}M`~PmQxCtCJE3w<1sjK~
z%^hVL$N0|82ByilM~<OXAM!(PTw9IgSdtb43xizBGBo+6?XTd?jXe=;`f9Qn_e#8d
z4%ng&XmOQ3LS~I$HRM&4W*iUl&EjhAe$~G>C;}riX_$O>t*(f(y7I7hL_pM}=MsUr
z$AK3?$bh8F_g!KP(rXwO<DJdB!xXZThhIAIMj_tw95*${l`~K|ZMZ_<ec;^!R-Q7Y
z_@&gFuyWiB!9rKa_eHP}mSgVs1%=L;Li|z)y>Q0;Cs+uPovTZv4(Kt#yb!=CDD{^q
z#V@7aq11Se?HiGrhrrH@@~YB_<auR+g))k%kbWujo(gGYu0_Q><aJ)<U?GHZUb-oS
z#Ag(zkl*~H)cY!xO-9M#yp}-IJ922`DI?ib!Y|n`Df^*dC6AH4XRwliL<X3h6;)E*
z6yldcpYkxorH`$jH(K=l5_GdFj>3t_sAUz#)?5t#2UlvM+>fZH<Xi$gEhEIfr7x-j
zvGu@e%13p_x$<N)gWf@cU#fZ%OEcl2V0DMcE;A_&p7$DXGRQf9Mk7;-UxZU{_D`6v
zj)-;VfpdzW!t*`@J_)YgGuo2fs`x+QPpQC*!2;it=i6Wb#(3TzRAY2F<008Gel4q5
z_+S;%{ZOpoDp>Q2aDuZC4p9bk&W;bH>ls7bIdo#tz?YNQlg?l+zvCpT5!xtX7GXlD
z_;dJ=6=2o?>ear?`~)CQk+s1HN|D9}m$y;GBQtFj(I>eb5&uCOmKXyAm#r${b||fz
zqy<;RZxE;n_<08JgCW*@xHP|h&=jl?<I?$s-CtucCvv{YjPCrdWb5d$d;U{I1_s%k
zzQq*cmqJ%nlSD$?o{y=SKUxu5Ha{Df7L*}>`fgK-UrPN?P>AN^=*;K5xoa#nJx9)j
zcQ`q4<!?F&`N^`Zk@Rf-c0e~5Rn$TyaviaQzzd2fDG%WD8D=WTSY$+kU#jEHEWa~}
z`O57YyPESc8%C1mUn25huxlA+rOU5|nClLlNgr}c)`7@im%b+Rm&VE-q?O0X)|B==
zs0JXO^Tq5R6**~H3!;H=TBALSjI%rw&_7C8;klU4$#tQreTxNE0Idk+q%WugWWY1C
zCz0`+DFju-dQ*hAC!r29Gt@S#7Jk*i?P8PMOpU^VrU2UuW)v25AkyBdgco5-6%$)(
z^Gm56Dka-*N?|e<$cfR|EqDUxALL5y;-(P46xyjmzXS`7BA@o=Od*`F1(UTb$T(>E
zzG!7mGH`g`92Kfyr{U*nIWVO(cHM3&aZTIp>d2Iafv9ObQ%F0mxXix0OOY*~lB`C`
z)%>(BYKeZ~h@DJRrYsINWdXGt7O4FJV5P*#l<Gx(t5SHlT~Q@o36?;D7i<bPe!pck
zTCi8Gs&&OOn+a1csU_|XfN5^6eAiW;qP4%>*7Se{kXA2Kiv+%$7J6@yrmkl^wQArW
zb%>2ScSitQS+FBe>y%k<o&poi?t>gqIXCiy7qEI=a9n<HF&t*|;)CYL2u67UQoDfJ
zP19q!E_zHwBQ!Dg>JofJ6%v-kGb)*uM|hxEz7&o*-7b+di(XIbj^0!%0kKDJK<FFb
z3o`E8M#i?%wn~W=KUKa^1b$y0?b&zGve=%r7TPMANXdQYh%tfb`-Sj{L&Cl{I5#$}
zve;3pndR$N!u^-XZn-k}t9UtD{I5j%P`;&D73_nUf#8&92Ryl)0;Me9w4(}OM!P>l
zpSX;P7=8qeNlm&!Qx_+yVR~qh#+0xy9?)J~+GqkPK-EGhU0OCF+>3>J6qbe?w6G&^
zzanc0JPzo2dKy-DA$tuAXDFhce+s;-2)euoJza#)>7+58ETW=CW$63fEi?!ja(}Im
z80R!&>93)&#2PGWf@8j@k;T)abVjApTFY5b1RCim{30ZH5ib%u=_vdntm~qF9Lc-E
z>{-XGOe)95_$-Lc?<+J*qPlEgSXSk^v0?vUm1dQq=at#yv2UWui|ELr1w5;}S(=Gd
z$Vwpc0sn`JW$^a%V4%MuO$j^=EK=lt0$9<-In;7<P`+Jnge0Nz#n>=iJ3Jk$WZ#@c
zI=xxEUlGK3F+#9dhXX4!k=r+y68jst%y`$E;9dflErD>Ru`pu*>n##e0k-1Yz$pck
z|ALqQQBMpWzag=y_nC(t;h}pQRjYU1L(dJOvy{7jh==AqWup(h&0#R!i_$|v%gNSJ
zd+AB<6()NlFT0+23*D!f&<(;o^w%ExaYLm+Ef0MwNaVQ5jqGlM_Vkz_`ij)DK_8)m
zDAdf41+s5)Mzih(F}4a{d+&h1J$(u6t71lKFL&R-;io5Q_>Q|LE$o|Tb$)_Y)xGGR
zCYU}IqDl-NC!n%=jrf%H5QEoQ3)OV%C~ep-L8($EHf)aW_L_N;VY~GaHS7a+EAl3R
z4*<^NkdHCEb(L%NngfZ@__I~M-LQ+H(IB=kt43#LD5d`FM*0chm?BvO-Ur@MWMnW!
z^cv8QKc}gw5dPD@khE*S|CA%P8p;ziqw$L|j4fOl|8B;IqOr@emcXDTJhip|JW7CR
zYzaGz_MfK-lmYl)nM+}w6s{q^Rx$IDa%Tqi+@(;Fd`UqHX+-=r<3$2)HH7rv&Eb}v
z)(q4?HpxOyv3zG22GM`D5*ofY<U!hBLui}~y*eY?)R6gW(_R(gC|_((?RkVfMl+P(
z5*b((|1VM@ev*(wlhja27)jgIqC&{l-`wsoQ_^oXq3^U!$;g;Vb~kmX?%&CXhD31Y
zGn6)RY;>m~ds|<X1ieE<{id@q^h(XXp`>6d{uI_UzV11XlBPRRdTf^ZR2NF7f}cF}
z;~_%VALycIg?i{d$s%6=Ahv8GDD4385+V-jjrz!cmA0`(94yxSE|LzGqxOx~3`{dX
z*ACuzkU&46hZKdq*!!r2jMHMnexlUuwT$M?Z%Jpom&{S*cLFPc<)SwY61OBbn}A$t
z0C(0xB8;?WVhexp5aK(V6YBOYb~BcsYfGM2giR?oA{x&ivA1SoIQ4&tr-8TDyJwy3
zTRX|iq`c%sI(Z)(zI^%U(>bA)+Hex%zI9e%^Q$9Qg+JmM$Lz@>lIRhu86?&yNUR-%
z-UBX(SiT{4Wlm`6Vy-YYsv_0~hR)@rdEb1yQEj7zxv^p2X(n*g*j(t}80}kn#8x2N
zxAd^|>;}`?5?s?IpK_Gr2D1UT4LkF`RSN5erA!e^@gnRS+X-X<RTViv0P$VgQ;|FZ
z!+?Pz@HU34YB9^vrjUJu_AW(@muj}TahX6aunsF$dLnIvBkVY*#)jpxZ9Qik>!H%h
z%mli09}TXm*|~HMF|5wgQ%2sn!_NrT9J9XHR<C)0f^0Po^HR33qo|!(Nmk=%Ar)uX
zm`v>(KR~x39mIXLZ~O?|Z-6VbD2lae;~dkXzOi9?2WQ?)S`>w6y9_B=dRr~(ON*ig
zfJp$#s}vh1l)}@gIxW^&hfSK-na3JV)EqL@0rZ9Us?#`Q6SdroEMKB?4V)82&C7ZK
zT}1R}0?6qy4pul(w|z?wF-T5yQQy*oCQwRJAWTKy(tQk@6P-@x=Ybu#2+^5TvdVJi
zUQ^0rO+mx1WiO*ie9ncmZG3qSFKF&N86Xa+N!!R-`XrhD12FuJDcF&|bcat>M5PmW
z=H_LrV#VF-poY=A!htX6hu#xE!aapIFHyW*%9L%6@QLM3wiwYYz96)6RQ=y{gRhVm
zW%UB>7w}QaCRe5HkjkN~FWmR7N@bdfI5<#L*vL$W<T@ebWOwinx<fqgA~+eFzDrcL
z(J60`4JywJd?S`t(Zf^$Qf^wucY+NOf8E+HmH8z^d5S^S^(OZD@{66RF3y{$=Qj}!
zhlHx?b_iOk(NGhn4*Sw~Y!~)gmnGL>&EWo8O=FxtDx!f4aO`v|<8pnzX?Y~eKqtL9
z1aCkFb(xPmI_YgliUZ1;<cFE3YpEKN^WsVFp^+$m)@%MpG|O0A^Yoz(et0^L!u;!?
z4Of|U>KsJK6V%E}1uXLCJC9-F%2`e&sMTI#u`|ane=!bDnX_O%RaJ`7PkH@R)lVJ$
zG}BK<{XD9lCm6#@lN6evpT+uFt)H#>*{`1y`gub?AL!>x{rG>-?@f8OX`dp9hp2K3
z^`>2+<M#m#OcJVD^%P0pBlKzB1GKvHxS8w#$oDlOSPz~Vc;k}m_0M}EgS;3P(zm+E
zKhuJ<(74aKGIV(dYH5ql<J*h&W>zQNs(LBLr}GC3JIMi`PKLffZ)pk}UB128rR75a
zwtIYg0|c0<mX9^h74~uker8i+IJl-7pU7FL70}+=<d^|uD^iWXGGIx2*3w+trxG$6
zS4*d9H$yk}Eng2XXZiMaC4g!#*D>s>S5@Pa#Et@o)fZ$S+dXNxFz9gJKPI@0^QEzh
zW9ZAT)6gsLamyT&TjX=)rG?YWoRh0v3xQz>7im`aP9WB%Q5V^ST2#l)>pWHrr_tPK
zCt2z4*1D*BAm!=MGL<}sebHDibBA@Z#xO;B7kPQt1O`9NlvI0#YE!~?ui7JbReRJG
z=|$&*)pk%9YX9YRp^j(T7yTGaAEG+yNZS^$l+$}45#fbCt2NF_t6IgfOWb2j3duo-
zy1$WmEd+CTd$0UCEd;CPC&61MP!nt@Gcwr1d_SU9lB99TLnugL4g*%Oq#*oS79XtF
zGH$U<XW<5n##_Kiw5viDbCPu6GojV}r5V~qD#EX2Ux^Lj`-{$!D2nJ?R?B|^eqd!8
zT07rv)(hDVWqzM$Q&~|OMj7_MRnp??<)1Q}JbjuxMN7F;M^TKwIci=s-E|6_q8R?=
zw}D%9R*y^knTQD___ab}efP7A`g9L=1P=3NvWrBVv}3*^7Kk?63M!Y0l$c*rtP`7g
zPcID?J1$zmV&y4T)-1O(F}p`=)BUD&RHwKlMS<l@LgV{w1zAOoRJHE0Ay+t!{7gIM
z#PCy;tpcz#bi$7iV1itsmkz6Sr<dXHy1fkl!kg>DuX%G__zm(k12R=xA2Yw)yEHVR
zN0EHuObSqVA~xhI6)i!VoN(sr6&--~qWy$uM|rf%1!-3e(ymLs?f@UFw3{M`w=po!
z91Sd48d{=Aad(z`=2Bqq($JEHYMGkfS{hm<CCeN|rbzj}baI%AQ(!>B2MGFpW+V_b
zW!9^(jL+Pro<dG)Yav%{RFWiU<(Fz4hZmgGcd5QVAnzje3j!m6AsEQiYh*bBafxJV
zKG<2n44JN#+4*+!Y+0RZuf_QI+Mlz07`9{OVlu1*mWujojM_?Ex)nS9{A^cj8-bUA
zW6)T|dyUPF%Tw)_Lgs1nvRTkrwTbjMfYYM!3#C@=A%;a>!5b33RWDlBO8l0UjTCvE
zz;D1OioA#OJ`)(O2pw64xUc$15&!p=71#{SXWuBm;~eT`*isS-jl_#uR-bAECAfWp
zRai~})sg@vk=T7eJw;LpJOJoeNT4Bsfk2ibtqDv6CMlvU%K$y`3_MOC7g*<K<1>KI
zNwsd}9F-{a0IIq4FIByOJf8!fGHdt(Pm%8&LXTQ6OBR{IB+-GKZ?H<uFIjpQhfs?y
zh{qHKvJ{Yi>09+*+Fp}#+SXn52W9>OZdv-$LrW$pUj1vmf)7`({4ep{h6No9*%1uy
z@(yBslx3~valmR#3aeny>I#7F5J>4If@t3A6ri#q*pt=GfhLM%5a<RxtO!<Nbr#S^
zk^2cu1jZ_&EKlR2uU?>7e_~q!-V5}t8cro_;Vi!|p2(OByal|EMR%+2T2rNrD0IDu
zM7kBulU_O-WTW*$G+%*G1$Rkas4iD)^i4A}GZ7d!quoGEU9N>m<QKNb_-0370aq~Q
zPCGKKJ_Wq0$aDf1fb&VZqQ>OMD7mGYG?QkxdxhlBfKL?p=<di{M7{-dTBhCC1dz(r
zzo7f=enR)r)MoqKiEu?(+YbD=GPF!+vpns;1|nB+5mb9JT#!1YOo{Q$N1ays7=o4X
zYYjTP`ZnsK?apR5OrH6L>|}&z#YXb%%OlUdz&(l_B#;2aY0T!sWbJ#dL3Y<vH{ODX
zH1A-DtSn?#5s_~w=QmUulTF773>6a*m6bs%?MZHHxZaHItOBm@$K^9mIbYaqyq;9H
z{F-Cp<@Ky&>($|TyS1h#po<fHE1$@>TQf_VU(1S*@h#PDw=0KI@yb!;!uqTk#?ZEI
zbXO%W3~?**Jylz7mj)M}R%m2#jULs^@@D21R}A_gi;I{+n?r+P`PzuD#d|JtSG^oL
zG>b=LEA_r4`xky45-~-$cnKdWAzhMIOUg!vR6zUF!*^0KZUn5^n4~8PtNMsd8)4J%
zBeWe`w`L+mDloi(fLh5W#U5<&s!Gsw!rXekb<gpwYGH7GoEXEy>D?vOt-A-GCER(1
zUIkS@_p?Cqx?G5qy-A#kZ~`Sbfzzq7!4?*_LO`$DrR*iG6K>#|O~5Mbd8Z~|U!?$r
zola=!8bo-FHj4e7Sl+KK2JqC!>BLS%>s(Fb`n5tTv_?)=eTU3<!sx9n2b3|*ydaTQ
z2h4*8XAE7Z^>LPm7Qg#-fP%rc_1+itb;?Ypx4x#0lGPu39}cWPu9uO?&y)V64y{r1
zKWB-&uNrk>Xx3JQk8u-R4GL&sWoXaSkhQ*Q`C7eBDc<4o?i|25H|@iN+c)0D(g;3h
z6nBbzTP$qNuwqF^kinemB-FO!*U2>-%%?Y!PQ+SPp_;DFuBIn?LK65s@XG4YQlYD(
zjmCbyn#Ut!lQ!DVps>SFCoQn;{(L+vA<3`*d!I}iz#EZP`(;V(b+1g$oMQd5`f^(X
zPf2s;FhJ9LCUwQgn)`|l#U(KfFinAvYLnEnGI<uV_|F-i&MAnUNe>n0q}%sa46%{D
zlls*)F<ms}FWQ0MsG?L<vTIU;Dq4Mu`*4yf8PX!5dy;CtlZ296_BvhRk@J>|seT9Z
zxr<4?gZatDq#<8!snxcNNxy@+r!eanNN3zZRdh4)q#{_Xo{On-2h+~Q)V+i0>0+2*
zgQbSLnEH1x`ra6IHMoOW3dRqr;T_awHxv7EK|+UI3|>MIbH>FqzJvML#V~^f^IUT=
z&0T)DSIs50cGD#`GoOgQ9GcJf=n!>l1PpT4tf_2qDSPzglDwWra4loBwibbEb)zq1
zigkzA+J}Hn;GU}$eYplp-8|yhy0t?F_a8ICivBX%vL4-QWX`H})pFLdMYKly=I#qb
zy1gG8W-j#NmZ)04G2h#x0wdNjaa@T$tM*h6HfL=^w>f8n%~?V<3*6?M4K`;FI6ZBn
zIcI~-IS1}_w>fX#-JCIQbJmvs|27B5!m2fk_KXTductY2(Q6{|`BX0qtuF4Ydok7Y
za1C?nIy|?v=-b+>RNemT=rstnIL3yYwJy?a;u=hpIJT}SP#;TDcVo1^k7IB{!1YTW
zHg>2Ly<WIg!~?)e@|8ajy`hN3vgivCTY%ib<E`jtF<k5PDU0MWd^R>(-wrSta2wa1
z3ZbEx6utevE-G+kJ-18N-0mv;y1MkX@KS56m6*iapY935LSeiTRSuJ5)jUoS?83S(
zVv4!mK_*8j*m_xvb;Ao%H1%-$Fxw<w@e0l_NcIZqbnb1xnzA{VG|)YpZPkibp&-`W
z*eVO~=-yb<8`4S<sM%TfP96R>x-kP#GKbcfZ;j;U^@b08PuO1ngZ)%*GZ=izfWhE?
z$T3!QW{|m;V2S@?a$hUDX^>05g1W}_s?kl0xqMsC6tuola(^&1K%899OuT+@auyi3
zHP-s0VD=?H0S2$c<blrmACd=vQ9~)Ufthqex#TCo;8GgQP%uyUlLvyT;GuSc+LZiI
znibv5Yte=;L0wLMC>>OUm+K~|pQ>}zcx7~JeEHl9ni(cT*U9|=M&y&tvd2dcj<%c)
zy_v#tzp<=mI{@v;vT>`)!d!08iEda7zi<POK%I?wr1t`PD1taX%e?oj&J+bp6!J)i
zMK>%PEHHsQ+C?@6W)qod=Ih*_^Q}^0rWwnk2iKsAFO`WppIr&C+h&N8#lfi9TcYc*
zA-CZ`km^?QYz|W0Ph_vfbgza}LWb!;bREu`x@|s5I**jxCcI4qw^Z~IiPA0QN!zbP
zXS2F~c7-y*=x14WJo~BFgwp<&Rw#MSN7teW&+3$);lvN*(QzTuG5G!LABHGRfG9&_
ze-d2_63-6s3P{azIiYU~<RS&R_XOKa0c6SkCc0L&VCIUXC%KvZRxUOn7b#PV#v1wv
zn*B?3b{zEIQ?4~+Xbv=0WC?)>fG&#6A<z%#V@g-0w0Vic{wI1m?`h`FRvs2^xubv)
z!7g7{2b|*3Db>j0*Vcf#oI3-^R)oRNeFj)u&}DpIN+d<6z@uCaowx;_CC~a`fn7v)
z6m<EznChfQrvxP>_a)MK80k_!OXPJ7B2j-U(`Y#4G>e{YvOh&Cs+r59MrUIm0^b6-
z?9RqV2;2bvYgtmg?`h2i=@*8e4&l5MuFX6eT_0D<;(VZ!`*S2SO?^!PU+5axW%oyG
z@57{Rj8IxeLZ@J2%kQF73lgg;F%=u@7JO(!G<Q&V1zRbtYC+nd$<fILX=4LTH-{$j
z@^`dWBW^`o10yzvCPkcxE>nPdE0DXH+i0dmz05>bgAujOyt+BSj8Nlz)XUyPwlR{+
zOhds{s~h#QH<4|u4^DIKbG4#guHnwB8xetxJ<LQFl^2bfoW!n`!*Fj7K%OT8SjOH_
za(XvUf-RemlYNn84cN%ugR^-bu@?ZIHanY{MmC-Y-lVM|y;Xv-+V~ytr6LzCi!V)B
zn~ExOg#fl}Q%RP5o3Aq`=>LCxOSe1B3aM2rGtF!|AK0*kZ_60>-f}kmj!|cp8N)1N
zt_adhQ79~Pv^&eB4zZjqJek`Zb;tH&Zbfg3JIicNElBZZnMNi#*DKhzAlcm)wNmkw
zZ}aIsXLG+`lDS8RSv>VO6$)a_Myi}>D|MfW2=6-i=F1B@OmE?OzH%gLSp=@<7GI=h
zmZ)V(3S;cre;u_fUDG>Z25eaq1VEoSue&j7MUhI16w^E&Wj;zJ=ePWUD1D*_{CF!W
zz_h(3EO2Ejcj=TeGM%Z(?ZUFC23WFt4<aL1<y~wq!sHg!0P*9xV|Q|kYQW^S#b+kB
zsQU~>Mx`E5gSjorToj5<ZyE^nV{VITgtp1M*fbBwW^RjWq`6I)y?}oklUr0HX_!!-
z0Oy(9q8e#(1GAaTn+r3!MKw}Gg{cdqCO-*AlbbM)0S_~`MK#jgCJdEro}#%es<GF`
z&4)l8(A*Z)7^yP3^6+yvzg%6DTU2u<x9z1hxlPSOnzvVg5&7if3hb!<Om17ZBeL6T
zLgXCqCJWU=D@+!LEU!h?#aeA;cJduU#5aEge4q#-zWHn5OXjv<0p>PCIV7rXX&=uE
zOo<=KbUj$&7LgmqNN;aQ=D$oc-ihju4Sh~_ef#~E#h#(H#TRVGUs^9)Uqo>%%-O0v
zFA?1m4d{HLnz4mt<(4v-LAM#)ze9oVqx@;5g1OQ2Efs^gGl-<QO?V{VD#3Fkvi~<~
z0+ZWwpQ{N^k^!mP!XOxmWWjFRg`%p{gy*IOiMAt4n;_ALi9Cp*4;H{~`|X&h>L}rJ
zdxItVkm>PYi6KOu3O1T57)-l-RCUu#^>92eHkf%Pk?C%mPnb3%dUn;Q3FRzjn~eST
zD`a>YSft2@1Xi=o+7eKVLER!QZPGlneH6vds>^nrsEJH&+s-SG=p(aRo)7lmtm$&g
zsLFJC+wfoqUL?!WV4IkEwwx;H@>w(gcZsS@kGJJ2k6*oDhj`07!4h~3TRtu5@>$d6
zUQv|`y8JEa+EX%v`Wum7%;dKHY13wPd0^B;2G!Y)q22Niz!_O*`*zFP8V-ahvVi~!
zw)GzRFV$nyVtZ-N5HPuIFTw=&;*6-;nnVt(KttxCsM@Y}DQ$98&4RQ?lvcAKZR&xj
zY6WSdlvWMVL*FPjbx%~qg0!cV78toR^j>HCiNL&_q1B!3*8+!kvYnn3`Gnoovf6wZ
z`MBinFbAij!&s0EisVve#UHe+#KDn|nnW}Nb+^oVXvaLHxO|DoM-hFg_|{~gLXvp}
z#kzL|doJeJ3W@AlGl@qfl}wz=_mu|LegD8;FNk2%Nsm*uBI#Qjk;BTgtT$pK9}LAP
z@7P3>M$L<SFviqHN|Qd3T};YxH>Hc4lE&8HQ;{7*b^O~+=;$U4XH)s}$ac)j_l$vt
z`Ci=4B9$2w$hLFySX(<%cbg&PVef2bH?5MNofFwwg=m@8NQQc6W4cY5*1<A^Df5KN
zu;oh`+BRuzWDB)zXE(PAE!?b_{lYIr-e;3lqf}1RcKNd)SEXm<eL-?_AvZIQ9h2^n
zL3_G&9k?~gPYlblBAa+NcI!59TiM~_U3$@juZC(!WMiIG?fkFDad1qsUP|zd4=-*Q
z?uQJ*yA|Egnt*pqtb39THHOm)i_DBbCiU|E))T->-tdw|WR>O4>m`bdRW9~UWhNdR
z-Lp_ZQTgl2cF*KUe;o-{ruq?SI;bzMB2LRdKlff_su4R0==&ui<7Gz?&|SMChmN))
z<4c+-Y12QB<Y}>+b{3x3O^z(%3NNGa?B>XOwWqY}D^i-AkGxk}vC8UC%GStezb?-o
zKRyko!*X^vEUM2gq}dHn(CE+DXWCs7!<qU(ny$q4?z-Py?cb=Fe@C@&FLEi(<{>e~
z<rLI7PmJcoJnm61WT;at^YgS!I}}s#`B-9$v(oO|Zae!znjMaqbd2LmC24jw4SS~i
zlqcUx``czrcAud;5BCZz-NO!ER@&c)5xpYA>Aq>dsP5+rnJe<seyOUykQw^Fq>D?0
zUkjxD(wOjo!pz8@ru|leE1Q0`5PyI5G;_&5UuXF-4+B?BQo830^BIn`i)1sZ{xPHY
zE;WYjO1p@y@yF&eS`5|JKakvIpQL?QQiZ^!0hNWjoOUUQ!-aURTMhU6diPHAX?bKR
z^Fi8IMX@z=NgfM~23N9o+Eusb)^pk5rX`PhVvLohkI+ido?8ga&(@niXL8f7GhWYM
zq(h9?M||9L=wVGTd%n)MeyT-&t5k9t8?nwF=16C6JSA5FT0QP9PGBSOtRisdx!u4{
zB76QKa0ED{NIrpAfjoT4pLl%Zo{?u?JFxBL(5U-<#3S94O+F4KdM~+JKmO%zj_=X&
zK_~1JZ*P2Bp7iIZftJ%^5d}5|ettPL&i~Uqi!WsoH&-8qu_I$P(jUxb+ur(#ameHh
zrS;QM%lYJr$eA5=ZMtX=<^Eq8`))JS&S>oS)}R;g{7gltec{T%84PPs4z#5fl!LR0
zga<?p8S5WrrD+e%8X(=A_(|G9DIco2_u0tdBlrMsWq7(9{#M9II|lt4V+g-<E$u}!
z8ic!cO=F2eg@h5XJmFUr(+6DAPMR=ygz!~`4{Jk`fqKOqD9u=Pn@>s`XR4$J`}$D>
zna63)JZ$P8S6%f-_Rs2PrHuz2lSh`<0)dnJLrd1amNs64ysDUtNZLeG1vT`lo;I0W
zEytaJ@SwBxL(-<;K<sOP3%BKVpx6uC+a9HsoV}d3IU?AsEho~p#wY?{9Ui)!Voy<%
zUNHKbV$TX%hkef&-A}Q(r_8es`!@X><ywb=9I_6JUP@sbP6U6anNE%KfjuvTR(d!q
z#U5^&ZB?|a-Um|bQaBjqv$Fd~nXfW|xlcn#rmRFFE!9M7t5ZM4E@Mg(iJC^lj4qKz
zQGu!l_+ZETDR$G+UWdAITlMUeUs-%y%j21Vc8i^ZeN$!kQY1prpCREN0dG~-0HpjX
zGXW>Iq5IpytMgrm(3IcHAa5O58KR;!JEZ)VfA`~6Z|exOLxS{aPXBT__|vY^N`J|3
zEa$+=1ZuF0ip!|(wtm3lkE!l_>xZi#t&%rW>=+K*I|otBZ4&|BVR8;GARxpNMWzwh
z4{(6gIXH^I>%gm6^pZDG?Sq?$eGc%X+&Q?1!0*7XdNKGQuHtqo*>+nIN^Peh+l$~{
zK7SBX*Hlh@shE^6II8->X<WYN-z7N_h*#t^fto-K^zX-(-uqupwmCG3@sTqB@U5%;
zFMKT3oT7sr){i0Pt()qEO1aD21I``AooXKLl9SRu4slJvfhvI;2Sdw+|2WGv1qU7u
zR5*l}_G6B;A1?BA&3hHxEMkKjt3MvR+bBG#G<}+Bg7~WUht{mmx323njeZ&Al)qua
zfnVs`npf!;W4!%7MHuMq?SZz6>?H6A@KAUk%H@DDTeo*V$g6K!f1Td#?hIdben{`b
zVYwVWG&+f56I=s$(3}ShyAd>iSJmt57(8t;A8a3pKWyI9aSnA;S#$FM_Kjy}DDSA0
zw}WQk;8(_&rM!((;Tf}(w~;u{n5Dc;gN!j7W~IE{LSdA<)}@qpm<bMkMYzldDcoMk
zEJL_t@053?H<{*(8Y%BSg&DOnUHP?sHqTh6T{O0J83wWV<&=${K|It=1}SAD*H#bR
zT}%ckWh++3Gl(hA8KP9s<b#wQ!HUt7T}Ds9A9^_ue}tD2A4uU20nJmIc^`W&WrET8
zd~2ChJ71c4_?ybgp2D5pn%=GLxGmdzgTn$$F#RTu1a2P>jw&YBb5(Ks4saW(FXgqA
z$;LJie;;`3Bz<UjJ7o$;zPW9arQ6|@sk9!mZ*9K`{BAtWlto^#9dKnwQI{*;C!VI=
zkmH#}LoZ6C_{9}SS%%|zcsz<JcX0;|-Vv8X1pkx_J}=u{?&318QDcE_N(Yw%tOne;
z=P&NS;OwXdd5Oz1Wa&^VDp`t{X_tr-5~uW1fVJ$XQj{f6>ld=@HIn#!A5)Hf&J9aI
zo|E!~Ef2~dH?yJ7%d1#--hgT`MdC;MWuvmsW?Yq>K9XKc<}m{?N9gb}j<}Oo#t#K%
z|40(Un)*Nx^Y3(dWnE%3xXFg1!z3u@Gv37^45T09a^tLwi-yxY@yz%_A>-!t2xOR<
z{K#%2@EK>S76^RCnLA!w#u=Gs*Ne+|qXgf!Iwo0~-#lZdk=1<b`-4F*?$}J@#bxXy
zn=JYcy11i`AHfORm7!0r#^!<;2|S5ZEc+y5H<S4>R^mH00s-MJXY2{$-UfH(UsB;O
zMwT)kWE?j7Me_duUxO>zJHz!6h~q=;_|bTA884a6`a%2&+{~uIXL2)6!r!BlU2Z;K
z;Kd!A$9#p(L+pG8uOB-{e?-uZVV8Hp&z&KP93xO3(Eh`*=Lu8+v<-fY_V3I9coo+<
zwvqs@(9TAT{WZoO3lzwGIkaTMORfPwW=wQgQ%TPE`L6XkW-b^B+viD+UoR_J*9N*a
z`dH^c@t2roui^X2ojcZFAIBT*NHDJ<cE)SFw)<`aUGU_q?J;B{VQ<EI$;Pqw=nFhv
zUy<-kcih+C@!B%hx6#0n=e0n_1`VRTwqaJrh6IKE^4ijtWpss)$dL2m92u#Mu0gM@
zYuAj2&EUaX2y_$oUGFTTy9tA@kdyH!^gTnC(Zh@o_{CWnk12duLi%_RJ92Br<Hll<
zquz&YGkR0h8o>CyI0y{d@Q6Ep(uOyWWsFqb0g8;8moXLjHx3s4fBN@~*6RO@ry#I6
zE0BGh8Skx()^g}FrHC_Dq;pW+a$bryikSXcP!V6$BmUF}(sjV1X<3V^U(zG~I~Z3H
zgXvPlQU}vd8d@FH(evrZ8!I!H?rVlF1Quuc(@zCEoPOSPScR*<l+Gb|YFS`LC;f2M
z0<BCxd`BzO58u(s^rO<sr=*p$Zl<p`gOhK4w>_wpC;A($OkeG3<<8E?W}C{WMcA%%
z9Z{23?i>#cMU|F)lD?KfJi#=ua~rT;xXbD5gE&n5PR)n%z}&T!Kb|aQK1ko@Y30sq
zWcdzU$=>NZ+>Tj0{|oLnqm}8*NaDKR+C@`${^M$8`aW2D{85*+JjC|aRwo9cBJd1i
z$I>^UmB-JaVJEg))-J|+SGXdp36uoxRb(*%oT^<oRnCd&1Ze866h+1os1MXdE5GM#
zmE&q<iTl3ujvO7oVvM&@%kNle=}xxee;eGhLA8uGI@`rn!xNRXs*3lIaJBS=dpxON
zQPouH`TZ<UJ-^TW|EuRy4EihG(-&#bPrQJ{!0bh+=ZXHV0PuEc&<{yp)CNYl>Y2W{
zKt26d`r-r<%%bXib~;~;GwS*BPN`>l{X6QJ-pGt1OnxnpZuWUx^-MPpw)JG8LQZ;9
zNv*r^N;l7v^&PjxS?Mh`Y=?_w4ee{Cw=!Yy&(}?F<EKER&VtnYF#UeQX0jN#I9=jz
z@YOy`?-<0lZIs@b2No~yES5Ez#tkuqJQ0|S2)sNKLTDE|QxXBA*hkaH8^tE2;n;NJ
z!e~BfI5T~s@VX(C#TvTqy!@hMrRKdB1HCOPr+1JOABqz>y^S{|b${uz9J6EdN=N9t
z@5|9`U8%zeXP(Qc5Q8Unh4B0tIdQ>$9@w9gpfKNg96s90se-7-JpQ<=1^&YB2h(zD
znH-c{_d-q`ls-0>@W|J58oG+nft5{KL`XCP{mN5XwbgtlB7_%{v_R6Tt!9Y`-(M1g
zS6(v9z=)6{^v1XYujG(D^?`_x@B%aR%B~=aW3Mtz?mDm_izv=YkMQwkBNVR&_MT+@
z-zviQKe$sL<<gbE<o%s|*nH6#bVXH#db9(YRqH$INed+QQJ>n|H5ho3rPRrXDV#@P
z>)!GazW)?LuTG92Z9d>v1go*@5b*px%7VV0oJ#Bx@E$K$`kj*tcvRt>41o9z$X8^G
zW$lJTy9+6@p8!qS&Fc`>N2fTfw%&5`IGTvJZywiubj33FTjjkX#dH@6Mq@w9_YyAM
zN#H4dzICa-<-5kgoV?rig9Sx!?euloW|s46d2^W2y2L?GU7U5&ykp@K*6YaDB~II!
z1j+<!>>#)9Qnm;O;$92Ax2K5k2hUSeB7852=O@pbH8rt#u@>1lUz|u4vJGJ9y5&ds
zP8h8qQYS6K_p*^5BJUiJ@SRmeOYe7H4LtK&XjT9H5x!heeYJ;2mG|&ms<r!&gq7oy
z)`LckWYltLh52~62yH~Nt;0}z=T#zDMiWte8&yWr%aKkIzRl4pqxJNmv(&ohM1+qo
zIa$fcWWv&0es{6r?`8Gib@^8!d=DZ<@6qRwSrVhOxVTJppix9g%x<Qq-E~U4lpZ#e
zKs*Wbrp85OBYcn0u%w@O+#Eu#SNlcyTvvb`D}nhSFLaFX^)wu!{@oYAzRs$p_-3jb
zOLFaJB7Bb*M|*HeIN53Kz6rA4hY`Ns5$X#_Ea&qLL6#^L;p=BC2ngE$e5Zu0fiP-t
z5Vs55=7iDx!3_)IE`mFkFnSoc;l-G&w0L>`58!t?@bsPtpPy=KJ<1jZHM|=g;ma;3
zKG0*DyvG8WbT-1bLTy<E0zU3ZQS)zF&gt_BqsKsZrkD=dJ)M9K3EFs!@Xg2ksP%gu
z1-e1=(&c>XeZQ`fu--pK8dc55jGy9lSLaebnX-U>$m9DLEZ>KjX1;1_6oy}2(~ppU
zJjWM~BJwhVbM{Meex}D^_ZE)uJq_mc2`Ifm>K;7tJsd4|&i+c^I>2TH+0e_!-=HIV
z8SlN-iM>&VKwF@BJdw)!(X9(_Gy_F{_V(d<{u`ZqOY=g6?FnWEkgdo-0*ir#Xx96j
z-g}D^$){ckEPXw+R91J=nR8FEhpCsbL)3|-`V@=x0aNsmG>Uu}ZTZeIrJfEodGfqG
zbn&ecPFNM`>xb~{twv-iBUVsexR&k|eY$%f;!J2Aohi_D<fpaQA))V5U3HDYjUg`^
zB~3c2&^*g&UWZ)EJa1b#c1h~6;6D9=hzGYv#ph{m;q5eZoH+~dJ}bt9FDjcRQ~3PG
zIJ&&f@*&N|-$q_4TF#k4Vm$)Cmz|Kks}z}MS^LPc_YYWK{B5yp6By>ReTKz*33LE>
z!`gY{IDy{4W8(K4L4JP-W)v`@1z7f`FK%aSn_AB6t5xPIDIJi7eUs_yMRs~kUoT#C
z`}#VoQ?s%_o-Q&x93cO{{S-&v=TNuC?)4V~i_V6YLQl=uz5W6D?;1ODUhLow+3W1g
zko5l>vWtwohU`o+)#eV_#d+?Ko#_<#=WJ+w|3x@gaE(a8cp1j-Y>X|!{KK&CB79l6
z7iaVscxQWhDR$1Gr|%ax&(3Jid*={vhVjfURmPYL$NF8jN1oB=0Gw<~(!hYKpGcE(
z`_GtNH#htH)xGTcgvGzJGuf~a=$tLA6psW95b?7dJZ5v?VG+lkh&Xa+QtmS;JC!os
zP3hy&>8uoTbM>b6{tyqz^6x2Sl+x3-52h0r(+%dm<J$7_Frp|a<xC|a6eW|(>^c}L
z*${S_z2CE67GcA-5Ey0$yK5+CPVbBGH3}nH^OP(q?`zY90oX8k{q6^WIsOKvM+Qdt
z9HynS%lUa@9F%0+og`t1$WA&n_4KKzYuyTgv@#(piy2-@*@$d!9^osllrM;M=pErR
zo6U;!WKJm?&cOP=C)V;-gfBkavM(1SGV=8ZUxM+hh?JyIRYO~?YCAf@`M97}zk;V#
z&c`TRuvN~-X?I%XXmSp=%K0+bs^y<VIR6Q<!B5@Jw|CX;d}r#G*G1*duh>VK?RIpn
zNQ86N)Shn*o&tK2rpPz{sNyz*ry(>0v0Mk}9XpuhoK018K)edP=*}q4o2DfozGeLP
zUGdmoI9?XZUz;V&k)_nYTQ268iXxo%<EUu|TdPN~8v7B5{fve0STmD@9WrwBXE!ZI
zmSYc)jQhF2xDmO*IhJ|2^yUdk7vh4%4c_N2gWmkqFM$eo*xxcwjQAET!Z(;*xBu^s
z?Gr3x9*$tCtbI^e@m3=^EDpXz*AnLvnLmR_GHsD>A`ZOdipd~4;d(;WLx|g?2xqqu
zRDZq|i|KM7tG~5$kXvXs6Olew4%IitL^yk)rP+2rT-{#@<U4~SoPA*+2Y|Q_$j|`Q
zWV~_=)qHDWA5zz8fX>aN6k_S*u=S_`+E3E{9w61cE;$+Q2<@K^b~4!ZJ;=(4Yt;9P
z+v~<=vC4>WbVNJxEzH>1{zJ2fZ!X8-2isX14?`y|633`4C2;#~_Gc$z)l9sdnC^c2
z4nK3Cxpc~!c+N|G(xk@2d~<ZoZY1tcyka@$bs5fG<*3E7;QqN!BAok87vcWf&7w`i
z?&nRSp}P^-3ONzZ1F)rX!%$-HT#IlX6z8OuM-bj_K@GqSbRIR%8!7l(P7gd5V<Kt?
z0&kyZM=CeMnNJ!<!Wm&mu!MU%4GfDFr(3eShAaBSs8R62UBsE@WiE<vsuwhGirc*E
ziC**6hBVU#Z%yN*xs)_`8&*Wve|m%W|HwKI@TiKekKelsNp?2@La&kp0xXh*-b4~Q
zB1nq?lwLzoI)WmLVnGoB3oBMsRO|?fpr}DQ(xmrZLerqApuGD1{&Vk!=$Gf2&CHoI
zXU?2CbEeOo+^Y-x6jSYOYh6=iwEs#J5o%){?i;G<t)2jbZZ-W3@Lb}kfdjz&pZGm$
zSxZad;(vx@tD$lBKc*C+iQyl%GheDtR9&iVGMgo;rft>#EpE3WYD6l+yrAp8kV`iv
zTNED~XX_KR#@23IV2WyAR(U=uX7t0pOy9h1fg^kSiYd2aE$xs@mzC~H!M@^3p{Vrf
z4rUEmarRDE6b~!}bBQFe!|zC9r^$l?w8Gu)N@8a%5d<(8*SDs_z|Kx$0Knt85Y2`P
zuy?~qNX=j=l$X8^6m78gx<mP;44Id{4-l=e_Zh7KupIZffZ;fMe+0M&;CIg8);?m&
z1K>Dr?~m}lVPTwo1_39uwyeMa%d`C%(xW`~ZrBfL<6;?DOaGBIdVob4b(h=Up%(0>
z>f4<D_<=mjv#U1|W>V-Jy&P|h+GL9u#wOd%GX#WGnUrkDF<@6!nFXp0`(}F3$*kFa
zex1mW-Pp}UH95x<XAg_i<c@<*O|p<pO;RlB*|6%8E&-a9Jq+bBO=@`mINMq0aO-%C
zsbd0?DBta7nnj>NTAV#T(!PFpE6$$e3lG^DRkXp5gT!uI9%u6zIFAWTm=b3{k9wJ<
z&>i0pEs2eB)I-`bZf5xXovchvi?d6*3Ni_EYIl@^?0nBrkdm%~EGv$X{jP$PbQNS-
zGl2C0swgF!s3-u2;`&lSQV@=q88f-;X@D~Usx%c`{aA(-UiN}?NeWWY)rDnm1ARk4
z6r@rF_!U5D&A6Fy_ARc0EIR;j55RD#IJ+`EttOSr*a2R40U+kaPH-_lCvw?89BWho
z`Sbkv6Bv?5xvD(cFAe&<1uk7f@cmzacUU{I0TAkO{&8n(MvD7)g3t+frvmHo+=J_h
zu1q@a47qmJlde2y)MHXENM>E|0rKNeig(#oloNqj32}BBdsI80rh8rX8-u3LheK$P
zLb-Te!@a0?CJ$l0AIO08Ln13O04C9!E*t6qq;}30B^s{Ptd%3<&YPN)K2!D7!1=1G
zfFh<1pXXZpwgt>HsDz8A4)E6x&565Yq^v+V?y~Wlt;o1vjQDyx4Y07*j_-OeE^;ns
z!V)qyXVG@`My093-Q{KYVgC?rUu9DTdm}ZF2ka*bFd+xQ=oq!`U|G-%S%Z7UX_eRF
zu+M}`kjRz-?n#Fz1^AF@i!99N|HEBRH3j+57(;d>%i!Y4hyrm$lO{r#7WGA4V5|&i
zmaSg>i<Y?Nz+h4jD~ic4?#6Wo7D7>$x?FxS2w*>etOk4$NjwGEL|`j3;=YW)W&`6B
z?$*QvRkP*UZT6KX8q+aRLwSbxyUjZ@)SK`I%US^Irb=^RbnC!Ep54@^YSJJwH#CS3
z3g+0NiJ!Z$XA30Gaba%>HpxlLNWi3Jb0A{%Chm7(n+0?8a82ayqk@IpO!8brPHp9L
zc*BA1VIm#LWKxU^W9A&mWKu~N#_4&^xknpCMe$5M>!7^$&$slAd&<-@gN;3pINJGC
zMN9n$nnw*jldqC<;%1v#0#4;T>j=FEhe`LuWipPPa)T-~hd=kXca$WPo1jvXFW$qw
zL0v&EE20oT0NVr%h0sYzqY#II?FNQIgnC9a;%|U|3K)*lX;Nv)a?HeXX&8JAa+PFx
z8(`_$*qm^C-1I!_!7VAyoTu<nGw2=#`tHZ$rn-48$0#lDjqQ1G44L<~Jo{Rho$a{n
zIKs=(|K+rU<=O6D_Jbd3sLn4tFL7hB6MJ`HZ?u=a96>H0&#Xy%*&r}dH)sX+vI(=5
z?Lza9K00A{D|`8Ls7!;pwC%yk$X^@Pd(WsvYWYV{X4TT8z5mG0Og0l;N5dXuA8~(s
zicmr^j=Dd%5Ny<apBeUmM<ai5BU6I8!igD&N;qQC2@pM<Y(3b;6tRmbV*hR|IP9BD
z8TI{}<+E^4i9)8%&O*ViYtm_f>!D&w$1mGwanrEN`#2(FmbaFNN%kVi9%90?H$D99
z0fx=)a+V6D2{#4Whr*ArX_lJrnv!Bj^!<c=R}`V|Cs+@v^@6+KFOV5OxVTiEn)?1*
zh)~%d1lesg9JB<vu_?M~GXz7Pn1#v-iO6!!?GV>7V&oWCS*DlW{{{Ms4t7j*)on55
zSjf_mRx2h9HhoY=91mo8_P<S0wOFxy18yCQ6%$@EixtiBEf!~F>6ld7TH*e2Ekh<Z
z3FsJ_NG2^4l!^S|xRzK+^c&PF>2bFiOq%8X{}Ib9|F+U57Oo2qjjJEwn!%TqAk%z+
z&0L|?ckTW11F*D9jP$pVzQhwV-R|PfL&Q{zo2!dt8S_+Jl?ZbOR*~hfU*oD2f%;JV
z4-Jj0QpWX@N0p$<^sqJIv4=RE!`gz|&L(T$hjz(XeAB2g^54#D;Mqq(4(wxm(|dmd
z&k-on;EB2;*uYG<5Bx=Y)Cxu6qk*C0##;?M+Z`Ob=J&5OaA%Ti!<Ez6jc~HYZt7hJ
zZEvttXFM6?cn)gc>ZwN?EJadgJG#N=#yZ5u4ze07XXUlklftuRk8SY0R^$)9&Yb7q
zNElAr-XL6<GMW412OkEq`|$>EI7JZ790&4_15pu4@o_1W0xm+<M=1^NM|#B<f_xk<
z>Xc}3f4sQDzwEOH_hWs`Mfg{jHke4V;tQEGtGrRz!;exlVcr&uwG-W1J#gBxylYjf
z$IjQ#rW8?0hPt)<Iz_uubG!wp0jn#=>5r=*r7tUhSf(FP0xIN}D9V>@0ImrG#5&5v
zeo3qOa&$4B3;?LMK6GNZ#gV9zp>45t5MFNOyPYv+$R8UyS8RQ`fJ9GH<%>UvwNw0J
z$~*578^EWl00aSC_s%<RO&m955@b{TmUZ83@4V;i#4&>>0BB$;0UF0}hp^pCzlgOP
zMu5Koyb?qJ_m7RW?@HtzRafu4r)|*2u8*~+1hnd4Su0B5;<49<5@5Qc<vIMgi;>Qp
z%3$0AMn!DJA(rNJQugru;TlJyYKO8TYoX3lW^}9;bPg}%KkJD{>QIh^vaxn{b++&y
z@XV{F$ZJHh@pO0{nZ(7$+9Oq$%gKOhTTxwKuswa!(BNpjq0}YT9$u7Yefn<@M&q;?
zfBIKEA<X)U$&8oI_`UP4$e0~wX+~4hBgSS;HJ040^w}A*RfjKG-ZArJIOc66R}Fs8
ztjx0xQfQX+>ryX8NxKmGXZAq)O&p)l@SNF<hXL@497I*Bt};A9X?Wn&I*3F}hUN?F
zW|HMBMwt8#KJ)MVDw47yV%%X-IDQ$##@d~E_30>gm^^1_b1Tl^bi4OV3LcgCnzC!H
z>_~Fh&5a#VM#$kk$D-mZ6#7>lU>$7jU>!{f+sC6y`42M0(yMbvJB1UD(@z{kNH4J@
zc2qa`q;8Vj!5kOqQ3E_~L^rRjR$W?{czQUKDD1`?;C?p|1F*=e<@0JNjp<qr9(U6)
z7Bdf6st6@xoNb0<{_r=)qZ)<|EwMZ&xzl{CvLQ^p2y3m2)C{26i{M09q!T;b%#G~j
zMs_vKPBbYGPj@3HMIsZF(v5t<`HJhY1tu?6i0$&Gvu?d2pXnpinRNWv&hRrQqSB&{
zU@96^2(La7RjR|W>t(64v>5HI^QMO9xb~v0v|?IZx<4n@E{UNtOB%=f&<1nv0a8=8
zg@C6OfhI(2Y434QIN@Ye_0WLWqb3F0rmte~+RH4R_?gy1(xccHY@W4}cDu41u*W^I
zM>E(^RQOI@D|2up_BixplvYy2l{%|JPNxK;O|5(#_cE{wHDXUkU`v55;XqOB>G1lK
ztX6#!`%{9l1^f-}YZOoBb92CqVjf#;kDe$~Q-sEQ;3ep`26;}vv2(sS07seac}`q)
zqpQZ+K2GzVm{yN^)$a948u&_dedT%uFoY}r#9g&kGPXIeTc3}Lj2fu;{Z}pXfZ2(U
zsUgq2Vnjt2_lP~fXy@aj5MQlW46b1Hoz>VA8tZss{vd_JxElNc1~;a`V|vX>f7>?n
z$0;3Rcd5HM3g0K=Y7jFr5W5Rwd$LCOk5jA=oQa)l6Q7=E{m_$o`AGG0Iy;sAF?O!I
zl=c-O|Edw9-OxJrCASK`8U}0tu<adU^$3=#<*TQ0kD38+?8|Nye6<AFM+`4mZ19}U
za_aF-iBbvH(dT`&x)!H^UW$D;8KZp$<{2WL!Q5;aB}-NE&e-=bRHxEpCte}RJ{*@Z
zJ!j_PIf*-tp(=T&EXRAEdF7GPmI;ncI8{kfGKR5$o!YW6A|_<Y3{kmJ-CG))?W2CN
zZ&IPB<|qS|@G?%Hcq-XX8H|HFWsu=!@USv4W9Whz^#4}|?$G~-{j!7nGDM1fH4a&@
z56I9zL<ZMz+@>;Pe=x|w;1wAA6Xx2J3(X(<J7IV1|FxG>EviYAp0TU;H&5#<gH)um
z-cho)xTfZ`hO}mRVR*<j7h57J+9>J)Gt%F3O($Iyo&;G`><5gw0eJl-W?H(o_j$)y
zj&&IIDZYyTHH`Yq?I-n_nV``X3jxfv#+8Y^&)~t+Nu9-sz0W9DOkXWV$KHpg#`i@z
zCp;H>Un9|Du*KSW?D$)F`*A*5r;nkrFyAm6c4p4G{I}RFLlVtCQ^wHDGAErNld>%~
ztAoJdytDKI6Jp!tV|F!|?aau}!EDzS%&ty;caR?)V^NJC;A!pNSm!X6@(7uf&S@$K
zyQ#3JXr#SuTx^Z}EIv1gHJk#%45OkNJpX;>b0<|zCzbLzL(;O1V$0?y{mCRPTSby{
zxGUS7ls`Es%jc)OH5;KW8kxG^q_jL|9|wEVgw*|2m;!8$W~hBN^=LKx(_)8=30bM<
zDDUn=z&qTNnp@hk>Q2MoXm9HIh`;hnsTU&trX5l*M*L&fr(U8d$LI9cN>Qp^fx-7<
zhg0qNGM3e5v{|N3wM(e6r)wsZ@L_6>VJXkbrR7`Kqz|Foe&zsTYK}Yp`MNB+8e3iG
z4^wmCviL&66zJ=A7?kfkso$5iJh}Y{&%jLq_Uh8qwGr5-z}`=ZjC+m!qqAnvn(7{+
zw7%W|$~t3eQn$kzhtL7+#O+`dey%Y^PwkevCjX3K?qE(!n)Y92QR*fv_qofo&D@nF
zIEFi<z{hy5;C@!%O*}Vne=6{zWvznZDxHPOeF_g9=Bi=}FymfT374+p!ntGd(L=7P
z#$AbePmp7VX1x6Jm%5CJ>bW0TCagCflxDc5YH;W2{yC+Xb3Uqcw_FB9pG=1kJvqkT
z98Jol3(+aXTr&oYSs&>TUQ%m6KiTr!#!Nc5iPMCMG?PfteL)k9aE%L5N!sEFyq`)R
z1m=3Q2w8ueh`*nsQ6Ixh{muB%oKKK*-D&vIoKNWBjUUbVGy+F+J~eQ2YB+TXqM&ca
zPAs3C>YT;PvtHj#za1;RxKtu_w3M@-+4rH$Ag*cytz|n?2fNk1Y96pzBPR~GQisux
zwHbs724nlhRI{R<PAm$s>V2oSM>~pWtvUv5-E=e&on5TuoR_~zeLK%uNRMt6*=>2w
zkA?_JFu2NKn%Z*9`UXnhG|@elx+U_gH+rgW_@#NKj;8-Pe~h}R+YX#wxE>1JhGztB
zumWj#9>>j4fHwHe^SC)k`i)W4>E7^%7o#e57vU9#@Cpc5Or6YV_(InR;de=~C_?y4
z0-r?)qq*O(P~;FkLEwl8?=XZbTw<3B!VAl)|0;4kbq3sC_$Wg3cd&H@N8El}3K#DZ
z{k8@HPOclG-(qsVtq0MCjYSkiVUn+__eK~CS<->@rBuEK<GDz;Wd!kUN7CpHPu<%>
z_(tM}MQBeWFf~H^83Hp|(^!ZFuV=o$BndBEEJ5%qLA-<@E{=^5UPyx14PiW=;XaJe
z-9lh<gzg~%`^0ljAtQ-qm!obOVmUqYMYBG2b2rr!lcW~$MlHG@mbotK>V`QM!TBOH
z?$6M2&l{PRciOW=uO-?v71(}brn*uk{@kT~IsDyaI+cYlC_)S@QiLcvZ(GH%w8n7@
zX4+lZZS0$}1nFUcJeS_3<xHB8vgD?XPFZejH0ER7Jt?arHutUmDXW1S8+~h+l<y<9
zd)v<`YmHxu9on!k<p2pcJ(;rAXuY`wnc~<$;LW<HY}2|6J*iG!r0j?@T&S~3Z<q3{
z;fW@HxdKd)`Lk8s=1k_#-tPKgc20FQf76^(=F}4jXurBN<vH#CT(02S;q(uU9bQCS
znSSAmKSfmvg;J*F=b?+1F<n!pC5kTWjI~lYEN9jK8+`bGq6Bm&Ic(}^0K&o&tjI`d
zX(;4buYqi@kjco)#bj71EnSQ8EkmboFVU2ry_j-`VTk@Ch)eD<a?rpBtdvezpq6VQ
zHY268YahOA4o*|j{qR;wH^Hy~-%(rNbvAY+<=zP1AYk{(ejsf&8DCEbAN`qys_G<7
z?Ur(fv*Bia_b6!7XfN;ww}(x8S($P#?d7LS*#0Z@0^iY3eD}Np@p#_G=_>G*!gy%x
z-|6;m-gP`{aH|nWk(G2rS5%g5xGlW&p=JZ^DC)k*%9Pu6f<qSRy92m=ZhQIe9D!4A
zd-?7!0@vO4l7p;s3Zt&C<+^R$8MD^bc`p=~yL@(MB%y^|Q;Hk>w_dveq+-f&8tBiT
zyCumfPJ_=;52vE!pyxS!^w1O~2hGX3%`Hk!2Ld{#rc&hez;&<Umg0sLoliTzAURmm
zoNTusIS&$;;1(nY+2tTRW2|x(@hDc#LQ3*_Nz?GBT|wQ%^6PX}2ySD_Km?z6e}rAc
zn<McWZr2jXiEz7*faVesd=7Jo9L*()Y>cq{Gmwie%h1LKm>f#pl>KU2*lJZo8yVQu
z6>w!-o>!+5sO9p!TCt79GLtk6tS(MY6tg1wT6@Q^<UJGa_e)f%P*2B5<(cDY&I!YL
zjN`L8Yk-k@ZMtKm@^T_ZN+doa4J%Z6++i`3MP*e(_KC2XW}7@SX6`sQrD3F1UTH|H
zq}?>6v%g%S$l&4QtdxeeEi3%%FI*XWE2SY_rFn&jmfP5vChJAg*4z?puZ9)tmUp7<
z*9|d5tIoK?Jpjs(NE_e-wh_Rl#OGL>LE8RXv`r;i>5O1otckWC#q?ZRf-1*!jkcdK
z)U|D$LaJG@K*Nvy8db9N)M$Hx5PyQ8q9(xVm7l_&{K`v5*Q4zz6oBQ(qL5sU<)8CV
zwB5%rM3w%M;BwTbQ~{3qpsaB86<D*UMcXVFTIpU`O0lBt7UcBH5SOJk|6-{FETv2^
zgWYKRPGd;hA^^@fWkfR?Bi&AyLz`*hFFOOHM-7Hz6vAkEFBHGYinje=Sn0g95N!vH
zm!aq{--l;kjj9{^F*+9_zedRvCr0N|AhTRPduMbmBV}tSD;UuiOd^W{RIMI;MCh%G
zj2tq>iat{8Ci)SB?vOcBLvUJsRPSh=@Z($*iTj_4UaiCvKq5j4Y=!0%AT#N&$rvV9
z(@!8<Y~r|j(VXCdcT&9%;-m@DPu}doqGwmrEQ4%<XQQ7ty_33_^?~SYlSp|Tb5dm|
zyCX?3hu715#F+f(DaHb)D_O&((aj^tu9k9=H8+{zCs}%(o5@^TPO2xGMpw&E)d9?y
zuHmA;M^!1F8C@<PKHY)0{ynN{C_CWMGP{cOTeV_iEP{#Znvhb;HUc#@8#S5`@Qi1{
z|F>!ZHf#c(31~%&`b5ku6!1)xOm#v(Ha_5)YHBB-yCDHS5h&Wke9<)EnHF$~)x8?<
zJZcDpsQTYZ6Q9}*`nOp2u3lFB0LxlDDc}iFT9(_S)EQ^d&((_p9%n-(&w3VP>@nTo
z^&>UKbrr)kNd0j=YpMwYtYJ!Kt$r5ZqvnJUz$U!C`ze4QaG}+psGwC*7oDr%L2qmI
zA8<V~86a9>rI(Ww1D+bD^k6i{H4HMr|2p8|<p<C8BXk;x69%iisissQjKO6C6s)~O
zMVL&#e+_DqQe6pVKJ&5f{{Z?c(6yBVo_c~Vx2!dgSrZFzc>jQ>c?8%NU~_<Dq5w)k
zg*g^C#2tHN@ts<ZLvBpevkU>xz(~R`!TBt4IH1Vp?ivQtYj(6I|2W19zl$r?Kn<q`
ztTm^JKCBr+9P4?1)Fk>5q~FFJIIZ==ZWO>eX9J$L5g<Cfw#uEz<EK1p?o{pD@=KQ)
z@O1KFhW^C*ti`CVO;rFDTuTobTHA!sb!u~MXIv-xn?DiyT54i#PX*HOJb<H%5I5~X
zE@yUA0-hm}jGrK$&kBGI#ke8Flz{6$v-Q(kKb`5z;)aMEWY#XmEn*Mg&%=3EXx>aM
zt;IbY@Dyj>`Nyl`4V_#24eo2JA}djY^Q?J{xy&z`5b)S6SzXi0y>_eDZp5vx;;dMK
zN2&RxGb_@lIQ^yGVIs_KwF}K(v2wyZmSEmtTDuD}KPq7>7~m-DJee}OziWCr;LqoX
zJ&HT5z#DkZ<IXAY5uU3!K6l{xb0waCaQ|~lHxF@9xLE;DjCj`WvkJG4>RT6Ma%#Jt
ztokco;@PnC{JDWRYHD2x^~duPw82f(7wTdCp2Cq?^$HW)+A>RP*M1GZ`zJRE*vS27
zu;%LX9#e$d-?r+lNfd(T55A-wbEFqmT-AW5DMG()_)?zK{JLAjB-*i#X11<A0V&72
zfw;b^MJ{+54Oz#aXx%sk(2#X6<K{CI<F)(R_oH`AYrzfE1j<9;1BM>8p9TeCtuujX
zcvj$+s~B_KLC1BoU!grMXYrY*6{hPF#9Wr2U;kB}<684G_v?nLApI#sn*FWS#IlyQ
z3wVZ=Q~&qp?Zr&1FGpco)Tafi374x0s<r^sV9H?&=>8l7sRP}s=LDPvTY)A;qoyI%
zyb`egG<I1e_mL74WdE5U102q{5ml+|-hh1ru(dqJtp8ZKn@!ta5uSL1X)p%1P`qL>
zt*svoczmS%bDwi~k`Rl7yJ%v@w9bV6xy1rDX9K{w=4N%Jin7uU$BGpJ`+Hca%OuA0
z7ppULdqAqI2P1IzXaX5-mk~T0u-7!;u;T7RWc<Y8fUV^cb9Nps?5)_EKecE5*_wd;
zBQ~z?Gy*EwA!A&fqS)>fDv!7chXVF_R3qaA9mQWS0KrVzTRCV5|0<3W?`F2~TQ#?E
z_HHIbA-WNB;<V7PfCg9&^EXzx%s)zX80N+A43@hLyW;Ti2#2>c4%p5Fj7%`t_A{iV
z)_4jlU_Wd8M2wpmu;)YqVr8z=MW&eEz@A4DO(#hYV?SqlKevbjR-4-5J{{AkaPz-;
z0sF=(ig@Emw}_8BMHFa(>2d8h%bRXQ5S?3Y5e(QLqc0gJj2!&01ni}8V$sxU<DvIh
z*7Oqrdk}^zemC%3%^Cm4NZ5#M5C`w6UTfVZoch2?Au4rHGsy+WueggqC7;1{B_GBy
zm2joV@r_pl_Wk@9=K6Lx^^mG-cMxi=$6&7?jk&h^ljU?`M|~Ku^>VJVT>m!iwJY#d
zoa`*!4pW_$8^cPks%`xa9Hg-$@mKjmbcyhN|1ii+3fNg4Eo&j-Z;vAW?+<e?G+=k6
z<2Ls~|F_!}9i51KJ^g>@{tb$#h>M|yyRK2dX6w@O{C$VHOh^djD0Y~HuQUwUHOnAj
zX>7=s9k5eW)ozor(~PRP_37LLnO@bRZ8v`;u-{NTfbLWC`_Y2<zR{*39yEz!hmNuW
zN9bH`Xt|V{JZe-NKl*;m_+7eAk3PL*??O_P7oUo*8A9dC7?o3AeHR5*DX)L}krxWQ
zimjzT_d%$3&p?hLWG?9jR!7><KMjdw{Iv$LXPm%~)~<Kj4*@D-J(}@PKR6~xGu?*P
znbjBYb_y?4O)((uq@9^&R#b;Fd(aqq2cD-^$HR%0gSL6?lhqAV&qMOhebnmjxJy;F
zn-O@$h>}7j;BKipegf_46^+1`6Q=MRf@bq9@M;9F1+d$R2x*tnx%V->5Nni6+mR)z
z>ik-T0<RafycXTF`Rw_IERu2b%6#^G!)OBcX;!aJeLU^n{33(EqBs(T=xx-eZ+H+l
z83U*jXrR%j^XvBMylbjX9RQuW3(oJ<ov_=dZ+ILsGf1bURKw<A!zRD5xv&H|vX0=e
zNe92-*$A8O5O~`p`jspun?(GQ=)=Ndk`HQ_ua|FF0^%nMVBt1=ja!+Y)ng_VzohyE
ziP-e3PF5SiTN}yh1c77u5_!Q$<OLGN1U^F|wl@EaL@t4M!AOMd$nh-qnO|2Vu0&oi
z5>e^`@5_KoI3kfhAoCl5{KBm;Z1M}6E5NeXx@Fr)2fh&rnX+v}#Wu#NuO44EWcpyQ
zO%r43e=r~Cu*UZ`qZFn;BPIqWA`5NCdp)(CCNVKt+Q+;xFxfPl*zAb|t-uT#MBVFB
z<=2}99z^k0>qOGR9|I4?ksc*Pp}!sz7=nt#j{>5@x?XQuzwD4w52<EZ^&YZEpx^b|
z1copKQId_f;L2AvIzP-bbi(y;b%2pgwqMy0Mwd78vc9q#?&|l(F~II;_toUaIMTBo
z1e%!+)vK@G_z-T2RYBjhN993-Un?^(yg0Z#glZ~x<5M6#&N#`+bZdAcvfT)8RX{+S
z;ulHa`n75WSPpR%Y2zA@R!4-rjldR5TUhUm3OE;McxQ4kNpwv<<Sn!^)rj!UL<s@p
zi@0-+DDK2~N)(&C!2WSW(a9CXCQQzzGL9(jaz(Kz8CVrZ6lNByw5@QrAqtZxqVR5a
zMA1p22qBA2Lve$(C@)cfCQ*zEbVd|~qFhmI8VAl8iDHy1icL=gnQ7MYC5jT4v^Hr?
z4(O9th1gU#ZE8~(q~~=m-PR(e&T*E+P=okbKr$^98c3Va8O}|g;y$LA(sq7<Gn|Ge
z!AuO(#6VUN(y?Mp6-8K~v2I!!sg#o0sucZFDZQC1Ih?EqXRX7DDr0tsKy4Ui2M=6T
zpkA`}MwM|Yqc+1$RmLXl?56EbWz?ocs4_Og{-(d3%BbsB2KVW#&83~nsOMJ3=BmJw
zoXXJ1)uhb;)|ARHSyCCH!o8f@;PAOo%*{Q)$cj`3XsV34f%;TN;kj;QY#t2GKvl+E
zR|1=-0>RG8G*TI*3P}X|MFh=!B;_Ku5yR#uL3}(?A>O4SVYfF`_iCUu)C!-CU}8i!
z&vh`_@mAH9nry0WaiER1BvoshU&FmZt(BVY)|w}#F1a!kiJ$EEl$J`QBi1vlg%Cu=
z-L((`=yrVHCQ<4${ho?tgvHQoJb0C`CK+Risr!Q8b4w)9>;b>0awNbtls+-h<w95e
zo}>sYHs0@XZfcVBt8so$O*2L$P~;)M=T;LaMK*hYq;@0Ef(s;mPpv997f4EHGDUyU
zZ*MgP$g`fI93Hh-ufKRriehgyML~Tw(`#&AY*t8s)-dI@HXj7I)2xsHWL%^bk{_s!
z%{RbE+2*&mp)gt?`5_fo4ec123=pkz7fAf}ZX*$5QHUS91hqioxA(<}gUAAj-wy3J
zg$IMy_`{=GA@SS$+e&<dH{rg(OduHhurzQ!M+ymV(YSMMWxsQ23YFf{5SI$D`CNdI
zl&)?Wfa?Kpcz?g0tK<Sck9!K>m?(glPY1dI=t_nY8cn!^tkz~-!S5-el<AhW6|!67
zk$+4#NB;J1NB*s0Fc<I>P<>>P-~L%$h7!=;wpIsN=d9n(ivZgJY{N=|(ev3MDkjgG
zt?DV{_wcoMZ_FxJf46o6vx@@M;nqI5dm|It+04Po^dFd`FOT^NBu!|yj=*V~p!PI8
zlW-H1!e50PUQ!c@3pgo!$3XJ803kF(KMFO#!$@N*r+mPJ5&vC;zQwI_mpz^>r11d1
zXuRM4jsb!1ZFfMhm73bR!3+ot2IB#PS76zLFe4-vnm<D7?*Pb7&rfgNjoS%*&9i4O
zqD2;?lYbUrvFhOUX+q8{oaKFUxNEw(>iO)J0*ebRuSt-odxqIK@cRA<?+8Sf4n33S
z&e@;6WO<Laap&wvra$;;cB<ys1D^KVD-n_zE%-+k8zNO)Sq?#rL<5GcA&{t8GdcI$
z<^eT#wrywGn!mwNQA|gNA+*E3e*0;NX_o8_gl>hxqzQnkyEDzZM-#|!tw|95n8h^N
zohAG2=VHi6H_Tf<>bGAk3x!(=d<F}8sLGus`|Y<(3v;#BnI%up1QDxaf9luZ0&NY%
z>SMu}3;RXKLOauBzx^uxWz-pG4n(NH@IC!J;#i;Rw>v~i5UUoh0(7Y97C=1Td2_1l
zx9Qd$Hg9R{x1AMeSW(N(^o0k-MVG8G({J~Hj9LH1WZFFom`uBuu>+*wMb<asqAP|*
zvLWENvm*(*_w?IiNf29&GR1m9RFTXOpsyv6R*ko8@Y@qijk%LxzdglmcdD3O_wd^E
z1;2eeYFz9%oIE3g7`qdbCVp;Dl0eYFQ@D^e2~^_S-AV8^^nUB#09Eql?j(2{CU;vU
znz$;ewUGdTwz%e41&fuWSlKVJ+S=_Ow~ZrqgqhCLebzBoO2+GiBNsNcJ3f(g9qHHG
zuJhZsqC9a)W@hWx1k=oHy|MqerLP^C*?QxO{~HvkRTo1u+qUEUb{um<Z`?35vn51b
znwjmQ8GgHH8EmeSsU#)JT7#)fSF_y7>>^DtYt-_eH$-&%pMF56q}<7@|Dq{>v}I9O
zKbfk+PnG;k_4xT<Q9<MSLT}6J|4aDQqS4htGyTrZV$rX^&woPni^M@6R!-a^t%A<-
zC;g|S3+8$KhQ0isMp|l-84e~VZNS7&?w>Y7@YP7wuD<^>lggp6)cDOS#eOaRnAI}P
zAgw>+O#_}8I~1)mCk4zK$&L2<v2&)2fVtu?`#C)UbGlyvb91Y@%#DA`|AIqWt9bsG
zP21CCqV84yt41I3qhfD3O^yH>@doNv<Oox9V>F(D{?~Q<(?q{0XNxT=MW+HXM1~?g
z5)tS#qr-W{qRRwtPJ6SpKXh+~e?UYeMTa>24M-M$;o9-hl|tA3&h}BBHI7KzlIF*!
znZcsJIr(U?xb1bEzQ<a>jlVg{q5g8)Mx0&<r@R>v1^)@y1v5$aw>0Hu8?!LZHj{LJ
zs|XC$-(Jd8d?>$LolL_B)Udq8ia``HWVr2OI|GUBHO;t@A>FvzWN!uP`&-a86l*~T
zwX6v7t#BqlQMY%+b&AYz$4yX2s$Z*?zYV=&u}LIa+6$b?xX=XXEFFrE0pIplB2(OP
zAE`^@S6$j2^k~J-xjowU#o)c`_Glo`qZzaUJsM$pG#8rRqd8%6Q-`*F8SXQvhb(%f
zabwh@k;z}~WL2<@PUjZSVH+l}cSicQ$+8gRcB_&U;cRxRbUnDv@qxdgOxQw#8Kxq)
z_tO;2->_PNd8of(8u3)&_8juxzRIb?#%>*M-%Z3$2J(gqmMC7Y8B!mOBlU3{grku;
zNioC$F27cNf0M{War-53E~s);AAjTMe><^+Rm`7al#wL;Ns?iQP`BcbI9#TfxrsYl
z_NSn{;&MkroNln9XqY+_mv9GMdq>e~yGpeq3s|NY7iAbPez(JTn#=f(0U-3#heeh$
z8!R@;V1=6bYZo<BE`~Q&GgldQ+z0AN0T?8<40<XXrY&!Y@(lM0Cb}JT$~FQt2zTo<
z=t-tEmME`<*r10F$x7de<!rP!=&5eFBrvm3&{HE4_@Zej=t&E>1nOQ5dg_}*7{(HQ
zkW;%svfyAo=&4Q5;_h~)KbFbFXm!wD@5*%MRf?^1g5EM&4CaY2j8YcHeLE(Zu{^*U
z6f7OU2e{B%W-t$wu0VtN9n}AhEuc^~djnmI2J<^^;C=@<G8v#5%=7L?d0c6la!l8t
z{evkufCjh}fU)sG+t^ET`jLUpj{^WcT{~!RSK$Smikln)+M`a;-VuS$13Cxb+R8zD
zX9Tzi;LAbH6oU4i7!@xvQwZ97jl@7e=YBj%%Eg6(_I@|zPE>to6|>J7v=0f0M(rGk
z>+8Ivfc(qkS+h=~H<BKI-jbRHAbI--cb9YL!{ATU-KD3b=b517XhIUSm0ddH(w%SP
z-XySkf6zYVb__e00{lqZk+It?Z>f4tlAj|<wi5e8Vn`>=g88$6o%@0A1*Oi}pnX+@
zkkn4b9y?FC)c=T3{{!G}*n+2PA&+6Q1<tb!h*hjUjm#J?cuP$;`Fix^npoY1w(atn
zDNNAg<4e^hi(RFGmK3!m5o(TQ5w(g;9PX#^%!JJ^BWZ+L9@@)k;+kOWLeF+pRscoY
zm4drfsmgo`!5d1&uVqaQdP>Iv<s6i^%r=lPgrQvx6<SRQ8@{Urn=sxo7Z4d+nBFoM
z0d>LM<<2xX=z@LIaThBlXupPCF3o`_v-G&@UhsOkb{P!pvcW50mkDE+U8rl9S*COV
zu3_Fa6f%RMZ{1G**NCl%zqgpVPRw|mzW!d8#<@!ce+*MSi|$_YkkTuu1+SkYKJGkZ
zm5lqWX565Ch}f-;y*4lgfChGg0Uk!&BcnbmTN9S>wzAPReN&xjN}1YWyIgeXwoh^R
z`2AwceP$6+K{tD6T`D-cInEdaHiyFHu>N?`>>_4&@b{qoiLnim>Zjp8<>>JD2JI!L
zAy7?bR_jbrHY&lp8-sQ@lAvrU(A2iWm5k-n-Xj5q0g=r__v-2NRT>{Y|9a4V*(j$%
zvj+$5H{wB^Z;YY6u#%&GRtQ@#=X%h*3SuTfWj`UCNfUr*fZ=Qv63B2(Y><YKeRB>J
zv`5E4)tLhY?QwJnWj`Um&(;L(Nhq;92MXHLj6rhC=+1$1K@83KCuq->&3I6Js-2H>
zI|!x%>5Y*>@t=csB2qBymD6MNVlT0#%bqw&x;euM+MEe-n7E~J(AI>=%w%K$HNA5-
z1B1?{P<qsG?FI(z)CigcTszWhj7PwAj6H)j8Q{96Z*WWDYz9u>(VNxrg+aR?I5MbB
zBBW$T*(i6iUt2lcze04Ckc6W`R&@$V&r)tRpccWP-9;whL3c(Jw0o%XFgG398N`eg
zLubk-nmI<$E=fnA-7{~wzg>Ez^5+=kBXV>>{|eq;0jbeT#Rq@a2)6t{^FnX%cZ6B&
zFe6y>L|e(``_!!;4c;)Kbj$0^FCM8V0-tXWer^byruvc0=hU@3zX&cji6GXeLwHO@
zX7%HOUmJ-6diu@as)Cx}tl>NoJDvJPh?iOK4?3S40GWz8W8|kCx6TW`tsE=($r0Ax
zW*$-YlOh8L54D1C2gS0mdi@l9(qPSXu%5&ggvx$mcGH4<Xd3||wF<+a{`{N4*%I+`
z{B-qmjr8%O0rMFDmniRSm<8uC{;x2X;t_{hFQA)sch-Wh6~ue3z|6e)HFz01EXcJ+
z@~^NLW{~V8jcMjX=9$q!^YInuLoC4uRmjK^g}X;~Lz9K1R>A&}=3mirO4L7D<u<z^
zL7ow3H$+3tVX?uknBwl)P^zsFN5z-SoFUk?8e>{b8g_k*d%rr>-zM1A9dYhj3(T1`
z1iPDBBYXg-=TVw(3uYQsAbbXQieAjnr%$dp69m+l7fQ@x@-D`dyKY!qvhU6&(-*oN
zYBMwF#Juv^V2EuU1W(*c{2wFkDn09Pm!9a%Xm-<u?2d7mOGg(qEZEJ+YIkMwp|V@J
z%<ZO&+TGA$&dg}$6K;)b35;=FJD1_zeSqC7hRHGnJ#Qt(%i_3&%kgd`wR@<HfA_WG
z7>urlYt8WKRur*?Ck$BAt~6K?4GoBazB-CZlTANicDuW?X62NamnKbGmAiT2U@f=U
zp-gJd>aB9$@|;s{-U&06vU?I-jC0CeiwZa8o(=3NxTV~wk#fHUY#}fzB`s3MPk?;{
zjB=Ynw`8#aw~lg~EGhOae8*L*N<sdcn%d2nWA_fttF+Lb*-;%hzv{r7(2?FUl>S=_
z?z@lT4%4$`b^)NLF3f^EV#%y!85!Kd8!(ZRx|wvKMh1F+Dk25Fr&9SFA5Vad;iOGb
zpM8M5jx1)n7$aGvoT{nG5a0w?7+1*hJk4-O9bf+7a1ZMpdrEK!&SyvN&hB9bx~E2p
z(_K2v<&pL%L8&$nJwW<N6MXhbIyjwl*mDQv-_wTW)s$0t*3r+kyjp6R&*m_yH)S?s
zofLB2g9+br53RElUrq3)pv-$vk3B;Pq+;>+P)mC_wB)5atUXWTW`+nP=UK-%Y3)sg
zl|8TGUYJ6FZ=iWoTM}B0`-Xf|L;dos<Hf8(oO7z^vp2+B-doF(aq3tQ_TqMuap{V5
z>Z#Mb^LAKDKg+WA#u3F?F>fj=ycenMeO)N;=<d9rjAr-#hC8Fccb2s;1J_W2EqEs2
z?pJ`;9NM>#(0nm>mXlnUO5|CmwX|TBe%xn2SHkjEX-lPFqPguuVEZ<ToyR$%bqOo6
z4+i(`R^T=~XK}|BXlGgb>3H_TiRV&xJXLWC3iQL%4A+ni-%BI&tTQo%<r@#E7w&H1
zgz%se`$s51QTL<q`=4w?AWYUTS>B|wilN;5Dfj+G><V3a7pC`H9^yYt*-=9L9wO>{
z+_wsB$FmQ&OMx|bF5z+&_>%hPAx&%l|5Pq^;ystnS=Iq+@<4F{mmzroQ*|I!0oE=K
zP|yQS*x%9(w=)@PAN=x{@)9bOIEI?j4YvbraprOE(}ykHYV#&OruH!1n2yuf1a7r?
z6B&DsDC3EFL2Y8Hi8|BF8A~R98=hMwx=fX9OIO^yiDqNm8RS3cAU>uWZV1B@-drV`
zYt9HJ|8!p06=I22d^rKZyr4<Hey#c`TOpP-k&<7o1BYF4ojK8c`F3V#`hSOa-bvNk
z<-3VN?GM~T8$Z2@iwT+HQTKnch2j(=L0LkNr~ONrQ}|sc%M6}w%+!K@H0i_ew5oLQ
z9o^t2$09(;uB+qz=F0Br!AJ~wCY{QU^-OWdPjF+*OJq*jCp%>?=44!@Bx$tb*Y&XS
zJyQ`rH>0q;<P=$JfmDbhoT;Ixn_%cr-8v?oXPx7c3xPF0dp-+J$s-WXua8mm`*1^~
z6>AX4uX72_!_88F=6rw_c3?4^$-nYFmfRYKL~itJa8|XYD6A)%)^T9B7X|<ID||@p
zfbL(E&J_s^?SY?gm#C$y9Uw7SwWMDwA$kgoRK*H-t_}m`I_?hz?zOCgg>hc0>gsrE
zgOcT<Tan5!8!qQwm2jASaI_weKQCnE&XpwpQ+ly}jMDcP>t$l1UxD>xrgxrSZ;(ZC
z9LH@uEaF)QtK+J`d6^hEzZyfR8LqL*`8ir4bohny&f@$>m-B;nf!2|IDTnoY2=y$$
z`Z>DRo2-jkDd_Ar)cA#3_W(TU?C90Hq#c4Aq(C)1<8Wg{Osb0<&gB&(Ccq81&>?r(
z&D1$+a?VxH<h%1FV)OVNH`=CaVt0<tD!(ChLlHDLPCICfG+%tfR5OP1*}bGI-_hLD
z{(zH5a1SYP5zp(mSFy&my@s`rb-dY4-b@490S#<_+QZP>Z{%OfXWvK9S?w_qc@_d6
z;@*?YOF=2^Whm+YyH5M`rY$8p2e%3<p7t#sbnV~{N_Qegc|nQchVzU^Xt)xofV`U^
z4D{lYwqUduhGR`m)ORdWwIPDV(BjPA+#}`@+!MVW_T5)OBGlYA<V|Y@&Eu5FDwE{1
zpP<UB9Z)F-!qH`1=%PXxl!MoBzpG41D$8i6;!aRc5iM}6f@EWFc{9&C$-E8hRG&Qu
zY1cT!m-e=NW?6@51BYzUNv#Cr8}Gae*erX?CcsI!vV!h`x_~Dz@Q2z1ZOgYYc8-B4
zy6gN}&1$^^-Rh4(cPE|9p&q!d3Q(PgCg8?FY3Blm&y$#=0(>e{23O=j8OyYT%vEJa
zlRh*9_pkzg;(1N^FW?m9&ZgwLTO9_!D0i(DMU|EE{1o@G0(auUR2*8Nd<RL;DCEhA
zW-H8J1<U^NQl52+tpjrIUMokk8KUH+NV*QUMghiwhknFur~TPK{tw?_+(C)0yT~Vs
z99-^90el{Jj=WCwcMBP*WIAKzXoiEQCYv1l)mn$r)p(AUsG;DY-*LZSZ%&!B7t*kk
z&p4e}jiu72kaKHvl2O4J^VQo^GZ{<10ue5B>sG0XdFrJC?XGJVvc*21!Ty{=XfQp}
zXTQK`q~<^5%i$2~aA{mI6=x(?>1<I#^>AqlRKSBQ54TYugt<739X&iqAq>gkX}AX!
zXpV;>9G<5@2Rt9)7Aug2hk?T3@37uy2j*F4v#~X2#j9c;AZ9;qFD&YE{aKD>z{reL
zn?ZxOrVhC4cKzW~xD&|VT(3X;Goi~0yom?hIDAb3@;`z?AMq;i6dnxB5t&|HuRlUb
zj+9eiES_4ps_xk1tXW*+mp|RE_tw<KJdHh$bi{R#NY7#mUfv#ZWUT&sx>E-<2Wsim
zRSBGg>{ggwv|Ay8&$hNa$NK=z&QC`dtJe;w<FnaHBdjqf3Vm(OS;8tfFgZKbjd{n7
z36ZhWqo1YPO``8^Cc=t{+zW2ZftxXtOm}v6hs?OLX0YRUXb;A7&XUK>vW{=Gy!D@o
zq-BV5MRIAyn6@+hALDwnx_axc8uOxBM|$Dzc9$uS(k>YL^J~TW>`$<cw=PEFIw5&v
zByM;W=gcS=tc@DH0?U+y;opVkZyz~fa%1}_WF0|Yj!YCsWT}bOQQq=5zpShHZ1y(2
zw;m@;HK!ww;-*u1N3R0V%*t-SVk}`^CXcKdLr?uj>d(wEAc^X|=(E4W@}@MBt);mf
znTvZyt>Z=AMoB9|@IBnyvb+^Ek&vf`(PwWOIULEsedY3ZtiJf;mx-UxPJuuzX|dsN
zA9#D<?^xpqe@*ktb&Sr87@CIC(fYi#zSQ`~B&0DMIiZBeG5=&8vOCt^JQL)t#l3u<
zu-c&+qH}e(kwkmU9U#`?Dub(OLNZaWqBWV6+ArlcgHvZvdF&%col^8{g!+HAhU2Kq
zzjOp5mNi2RmxRV${}QhOqf{xTLv+^akvjYwCqpT5$`pqm)y?q<|4MA|j?xa)&8CDF
z63HjBr6#Dk2L37E0%Gl14`FHi`bc{*cyzIvt3x$k1~g`r|7bB}R?KPw<wT#&v#C^m
zKP)`g;qAA|yE{^v*e)ukiEY4{I=_R7toM)(71VFzv)=`u$2>WXetWoB?dXy|U_TPa
z8Mc(#9MynSH#El_oJsu|WYOzZQ}n>9Gu3DJOyUveZswXO10a#pCBWEtpWR!5`2>Pz
zefHq0Ty)eyj?J4G)l`9p-w8aF=d;I0(rnr8vnK>xz8|{kvnN)=7T2E!cN-S^nExkR
zT*md;$q|Oqv>Ppkl8G@4wSLrR*FeGRmN40dqv}LgFY&(54&*1%HAQYpW)M;QTi<2i
z^?pZiX$NBrd`g|@w9qEsUxq<CK`pO4OV12@Ze@RMi0?#%R_$UYjqe1==1~yDae_|2
zb}@6?-*>7aT>Y&h01diz=LOef-*z_VcOPQsl7v=It!UJ~AB#c}wnL--W_tvo-J!>Q
z+tZB9hxgO%M&EX-m>S5gY()8EvU5x02wlgK%et((V4F|Zc3AoK)($&7eV^d+RQHDO
zd#Z~#SXh<q`_drhSw$BDG)JB5lyF%1k{U8B(7jV*E6h0<dpMb{8sq!QRFZi)-a2xv
zisk*{Z)kijBdK32!?&s`R%SVcJxY&sw1&(aYIl?l^k{qJhIHHe-lts^MR~1EmAy_T
z8OL<>y`LanP1%ve`%TFoK86zs8y}d<uXeWBUw(`4CD^Y!4JxFuY8fiuRoA+g?<G;8
z>W}uobtmx?hkY*v!5V7HFu9KJWmb{vd`IjU+z3#u+7u23UZt_rrT;(r6z*|rgsQCW
zv~<gQ_b1<MHLE%o9I4JWH63m8n+E~%L;PzV@IB#*zitT-Vde=48$Z;aXlST|czbVO
zD1xZfwl6M*i`0)ULn8|{mf8avnd}R-gfmlJ)$a67a;xjPLIBNyfV!J0FJvd7jfUwr
zVEUC*y)WUL)EU)~)K}n^f`=)1fcB{k;G=tSJFqCv)u)FvW|enLHS-8Bsvlh}bli6z
zwKI~&W+h0j^{SDc`cPZdsu*35b@V4E@B5lLc^@loS;u0VlWc-(M)iOQW{Q8q-Elkh
z_H}9B5Vzh&W<bB9q5p(Ke~3{#I>ckC5UUB0S|92j!aCLtSPNy)^WPbmzCgKHs(~#b
zA6H0C1E}}55v;E#CIRsv*U?9O?OdtX)2jLx7k%v#6p0`Cv`dqG;zP_G1A~3ti&<KV
z{UE_t*OmOd&mr7J9M^ve=15)Fq=vEkaQ#wE6RnG_pwg^kALHIIk9zy+V!gB<f9x{u
z7-`9^UKyu0^jVYRm7NN&mq^+o=?`+7@-UkStSi@_6i#o*`pvvcmN)7G_a5fm;6Bc+
z;%s)nm*C2hH9{+3I7?pxb?Pdinp0QD8KNBT2Mj$)fGg?A@m08mzz}aDUAZoLooI_|
z%#K7^CfWTnHKdOD*;lQY<!xM?)*LF^g7{}~j}j_d9}kLfg4Hu`SqPnk{S$xF418=G
zdCT4fgfYX(Ittv2=MG#u1+wwbDo^V8ec6e4VDIEG1?J&_x06#V(#X~t9_SI_gcA}$
zJEZgc4PGL<IzNI$>pb}+kUB^3ynuU7<DIh0NU%|?`!a&|Sa@$VT@3C7;T_y-3arDk
z9k)r`YAd+xF+#}i<Rt|zS=Oll&a1$6Jd9pWHDndiTaJF@R3BU~qROG}rx<~r8lymE
zJd1D(6~N}5T8aBYfhKsi;WmrF-LPlyMdcLkm{3M=sNYNA9|aggoUVzhs=#A-I^$aD
z0#La*_-5cjOe#M7FwYtgV@moE+m9>?H+)B9(yxgR<6dOu=`HsOC48Ew91&Xv_-)*q
z8upf3oo5Xyi)hCXZMgWJs3o|MG!E&%L)`~a*EQPEqm7}+bLazVF>Lt?$?8j0&ZuQT
zGZ&NusL(@JeKUs}z&OYtHUV0AqV*8(MKDqsFjqqy@)%%7GY}e}JRa1j&J*G{8={z|
z0jsE8=h&p8!uK?ZE>?9A<D)vzZS=CzXvP?MMt%^~>M;Fl^i_C3v*;47$Y2o5M;c%?
z(pEi0$$Zdh@uawG&J48CRS`17H)lv`@*W%`Vj@(E=MlYrRs{x6HNu|ntASSC)(1uM
zzlyYI1E<$3pvpOiJEFj&mUV`H<V<O)*ry2J|30C5I1QEk%kf~T&Tt{o>tBP1Msa4K
z0z2?Lf@5{S>qisMEC}&4&utO#0PFnHBK-Coa2o$Wc4`o3P`EQ+0#SoFvljQg8bqKr
z_=^qaTmAM6u-=r*UETmnbw;VSDnK7|CKq>F+@63&pf{m^aDPefIG}5tr8H+Xbq%2M
zXKBo5HFgi6jb}&UvK2rAX9du7B7khpzKol%0EIvM8SY~RDE!%txV3C31Xwxs2DT8Q
z37%!y#v9mgS%}d(`-=jnSe!j~JCH`M$`3wm%5se(#;AOguUwTs_ar!vORr;@i4Mg$
zaf#mB<N!2cV~BblH_t?u&SS5WXyyz}t|=NDd~PA`RU_IZj@maZF0C+cm5%aEFr)P$
zg&b{eYL-c3Y6*P^Q$cBXQyx-}eCljSZ5O8Pz`|4M%Wg5KWXRLO-lk)P>P&~-$#yMi
zJI98+vA0U&%C(Gz$La7`67=&DLmd3A!Y!wO0kqh}GFfT5MX?o#Ie^<EI>TlfI;)yR
zm%SH~YAd&Sm8H{GFu3qNY!N)tFmBW1m>$X^nmfd|BAG^u)7#SXIW;Xqc*-Cz!f2@w
z8!LZurY5_hD#c&OSF;%P@fUsgxr;dND|-Htc>jm{O#wgmk%`SsLecyQtdsmzhfrOd
zc2EAIi_C3@)1u5@cjCDl*HwX@c!uGIC_sJWj>nA+xy^$7;hSGX7O*!UlV<9%)GTu8
zP;#dNQM1tEN$!(03+}Un-`;TDB4BSRW_g=`Ee7c)a_8f;boCeggdRQ2eP7((qnuIF
zT$)xc=G61oC8{=8kbMeWx2*F;aD1KCbAx{3JVTE2i3-q9oNtC}tUzTv-Eo~2sD%gH
zf1Z6p&kg#C^D}S{Pa&Xft{Z&_eTsWi0W8FM+UWVyZbQg^jO*_3HHn+(w1j3?;aJB1
z{9m~1YWg34P8k=OGIGOxE(fe{Z-!JpMk*JgaXQ@jF=f0^5?7p>&E}Bos8@_en712Z
z(7_0u6<R~^&kNWxMYn4W8ag5CLLzA^M+i}#3pGV(RfLc<oR{=6v<}K8cSyWO@;6kV
zXF$FU*GQ}9I>9;oF-;)!%cW5JgBl?6GL<>nd!ZYMU8u#SL-F*(^%23)jRjC#4q~1t
zz78C5UdX1Qb6Fl*H=s3{x-F_`s`3Jz>xJ<~S-Ln4y?IdObsi;l+IjYVr~Nj+T``Cl
z)fx_qY7))+<TnWqOP%578PR?p-JywlINUWOx{R-x8+<K1mSEwI<h)wVx=e_N4DzfI
zDj#Mey)-=i^&<Q{kDCq0f4$|#(y*Ijnmm8KP0Ui<Cu(;ixC?Y+HTiqTFJZw>A2Fe;
zlyQ;(RoNqq3FDW6TfjbsQl}4eD$2Tm)`l*8AE_v*z;@AG7^$e3{2G@j$Z>n<5eQEf
zB>i!fyPyRbvC%1J`l5V^xJIJ4VV12{!>nuR#A|qTv*>8^5NWA#2`r63_FR!cR>G9h
zG+Sw8{Wb~a-Jto_Aj|5uE@7mdZdoI)CG-?-h7XKkYZA;lLb`?B_~iM7&WcD7k<JWd
zI7XYq+fZE-S_<4s;FdI9Lz|RseF!FGK6US}mB0=lNRL2t;IM>x^bzKvsAbs+d=bg<
z@9dh;C<3qjVnU;0f?LmF>3UB|s|jHq&Qj>UHfhywhI%ea(?%F^i-_y?#DdZKUoyBL
zo5Cyz4O`I0WPBOQ3!YfeMwzAKzq|K>HbKj>UxlF>qZV`!uj!IQ+q4DEB?oWb0#w!V
zw$N*Z58u8Zh_Nv*RkgmdAc&ELHDprc#|4~i_O=)uF48KxLg={#RU##5(QJY9;R!OR
zm${%yRVBgy#g_}JG>jx4Q)2-)A-yeTl4{tm3rdUbeCtUH@ZyC9MfhjUhouF#q&Kx2
zb2cMA-Fdc`6u*<gw<f);gtQ$0xS8o?%bP+Fs5?3QSt}YqVtPe^bYSX()bs>m9Im&t
zjk$+xTNWi^+{~E1PT?uew%#$F6j8&8=$bE;S7T!`?5>uTc_pTX*kZAxWhZmrBgVbK
zO6n2IVkC@~Pmxj2YB80=?OI2tght2E=>h%JftE3HEHY`pC@ZE6N(4vUE$goIn4+RP
zG|ws`BT`jUzE+w9L#Qa-F=*C><G91Dwts$|HHbo5*yNYS7o&kvD|JC%P`?*`!R0AH
zw{S6p9i?+*7F(2NYd(%!IR47?>FrrSWA$K9B5!4STiqTz$x2-62<SZ+89F`j9aByl
z<`(~z=zMA@&$><3xKPZszB^S%*%F^pdC-@OMR9@DffL6AQ#}e+jRtTrp*0T^jUh#e
zs$>#YVd(NMw!*cbFiZMFHe2Uy`Q<N>?>Bo}?STI!V?ntK*O7w*-X&GRc*dg8{0fgJ
zy}hm2u<$Nv08TGl51E47upw=<ixb6-nScHXm6z>e7?MxJT$wfnu@Yyo(B1mB2#vwe
z;I;!au-0u}%cmg{HiHFZG4iRz(ULh8)l{Z%iDc0x&5_0Eia=Dh@woe_yv|b-L!%`!
zYVYE6xMxxa4H#o3j!tu7p8@-@>ToM@tfOky#jQX#RMsJ>#BqX&TrTc3-9poaDjFPL
zkP)0<i7j)?tLbU+OT^z!g!+)%7(W6FdE1y9AO_oAcfO7Oz!cA+;Tca=qYP`OBo0Fv
z+Gusiw<d8|IkG>Bzx<xWVYgyaj;l_i7bf<TKDT+z9A!-GS6WOuDf+>;wY<paq3A`w
zpx{MDhwpC}T|QJMG1EwmbnBgTnWFBd%fyUwlB}y`Z9SLRp|B!A{MkY5z)T>5*r7@U
z@%vvAGlWQI+_tQPm{9;R!$E}K4W$wrM#;#u?cks_G?io+4p(X)UAFwkiM65>Kh=q^
zRUp2z;x{KInRw^yW@1u-_(zBjok*+{D^5gXzeA%^rJFogq7lF*0$iVvSeDij-xthw
z9tX2*!cEMw64`RA8DortJ+yCU<j^h=HSmT2NMgq7HrX(1muR%26pKPLX6>TnxwHG4
z1!HcUsV=+JoyB6Sx1DZmEt)awOUCRG41Kx=ffo<V`b-$J9E{IkId?XC`96!z(Fuwd
z)>CiJdS6(J9IW>ZmWfE6^_C*O2{|!u-Hb_?wLmd@orneb5uG>BqW|)?``L+jE<fU_
zLbGNN(LTnBn2{eb{-0S>6_MyfOwEsY^6V_BYWt@8N;2ge=EP9&k+02?ZExQl6W(mo
zEN2@)3_rPlR;D6GIkYlw(%L+$qaq%6B0A<rlt`Y{MiH+&5pD7#o?JGofg-+B1oCfS
zV#d*kZp>;FZ!&vl7X5^`{c$I0jR-<&uURz>Lh-$`5`}QxK}gJ}edo+sC5X7AxD!#r
ziD=2=ef6@m8{)kq#ay!_K%t5qwzOi~{jDrpgOEG!MpqWiAYke{iW@EWW!ZNCr0Ig!
zYh0FHM|c|d2(L~-yv7dRE#&o8mNq)Pcf920m0ZK*MO2gPS#||Q>4h$l2vwjL%bl&a
zIm^AAWfxbRF77C<xKT_+ecC&V%@d-|yHP$TiZaw`ll3<-9X#e}ch=wN9>pT!jZ#^^
zE24rE@jD<V;=N{BmlRQ75g{u}&k;K@6;5THQcNc&$*Fu=54@eVO%X$lShMup5IjS%
zYU?bnKY2SiYMiy6*6l=$SdjItB3^P*e48I}@3Jhl^$wpo5uxSzF^gtqar?pBVYice
zm~t0896Q*`dIb@|U^~mI{%4k~E!E-ea3vP@t*nXpk=35ey3dWgvxq}O3*b)5FCWk9
z7l~};MD|k#p~GzW470KZ!j2hX-MuU;o6eZ0_$c1m7qhy<(w)5>W;rzN7H{LZEDd$;
zoajV!$`{DJr?b)(vCN4`HxV?ZTYt)GVH5=a?KiSo1XT*`g?r7_vhF>t48OlCi%*<+
z@7&@f*GJ79dEV0@OV^I?JmW;%nji7$(^(oebqqKWm5s(1Fhrj|ZRoz7#ml1Jj&&TY
za`{;LgqiHs_b*Gs3)N4uHw$lnU&oXcK1wUNb5fH1BMHsDkBk{f_D&P%t)0gt`%f@3
zdL_9}IdDv{<IKRoaaNM87qtqfS%SO*&Xk{$?DHCMrW?>kKs_oZh3tzMX8Tn_YiB2!
zM;hXD2&`<9Wap`47;0`vDDm&{Cb9VJekDnd0(d+AYT5$<(-PHG%C}3hmlD;ff*Z9o
zzpQRi%eNDW%=jcd1(4?LG{QxE+R$)Chm{9KT=h$`=S2$7*6MAY>5y9_@noC0QASS}
z)7=~(%*^S4hFDfoc9M-5b$Yc<A3(oSX&@yc@eK)~S8n`f;>XPdq8@6wd9%3dFG)P_
z3zzMdCfRKNdprG+Um*xLL~acjt0G-W{QbTpyF55|X=C_{{z<koY*!&WTu8E`6{XLP
zEu!Y4$s@lfD|}SRYkZo-)+RU_$P0(#LEsdSLyb?RLSM8<`b}t$IGsk)Zw4(MyB)|$
zV&zddeV$4>E}VCbnk5}KC}{kmDM^=%3=Pu5N#6-+zk~E$0i+)cQh}`dJggLBK1^Cj
ziq5(V0*4D(<o!2?V?J~;(Od?NQIgq7bCjgElVr~SOJU5{j9y7&g>|=sHMRgN>d#zK
zBa-?F=^+QHUj?ls6_n4I5hlmJNwO847dmL&BeWV;O;W!?&BE4<8cA)1w9Y|lTL8)Q
zGs`tdTrxE&QG>)T4JcKu`;wdstN4fAn`9oM329E&qf=5%Ll-}Jn9EMfX>46e0`R?=
zRL^NWf>Z;Nwmqq7DYZ0nvxQJI)9$cLT+=z6gmrM#u}gO|yGknOByY*0(xwa#hSl5U
zQ}oNXCc`tXs`Az8fGt%sJmw650{-e5o(V>31ZXMayG2*2%@WS0Q5l|rqK4J(vMn&4
z-OdcpV3A0-h@NpR!*jPA-8DMAzFTyyB3Cjzyjtz;+7zt5z2|plHrgY@)5*c=h+e;v
zVe{OAx9dEz3PQh-DH?%VFA+eijYSc&g$=Jrq3a_=r)|&h#20nM;07z9x=2OMCA~?8
zeUy@R{fI=1W)N`356}w@>XKpa7f-w0xc$}tqlAOHs5zys$*{KyPbV%!W2?baR8oly
zdp%Lz{BG3x{HU_OXV^;=mFz|>$&V`XScd(49NSUdI=OMrn>g4XH#5V25g-G8$Va!!
zu%8hPz0RSWpUJ0@?9I@V8{Td++^8w}QPD**?6Hb^-HjTXA62AyhCNbID}831NGLxp
z>X!_Au;L=(7<@D8Y=+%{sP0u<iVaK@{C4(b*v=vifi}SmyKzKazJD>pZW0Oj=Myj!
zeHCl$of&pDmA`w>VuP~Bv6EiS%n2d>FeIwgqWnV%6kbGtxh##ARIR?su*->w@qt03
zN0CSiF-}xgy$sv0sAmJ?Mn6DQtP}M%O`vIfhFv(0hPrrN#&zL*7Hg9Kr4fK*4yG^4
z_(d^$i<s2E)Ko+fgY`?@2-5sL8OMe6SFB-K+pT7F0mmnu^$7APmzS{?q|AiyPj_=Q
z^r4Ke6>8(q{kqysx?iV8=suH}@u84L6ftx^go>f-Kb7$@GC&c4#NCszP)IY#l?)dq
zL{fLTGvjGREG;s0n3eIglfyuHQ_yg;K2`3;jHl~I@M~4gcv$%R9F`ugp$Mm_57#zG
zvys^c$1^6x$>XV+G0J$xzn3voLJS?q=tTOv>p0x<ER4e~?Xt7s)~o?#bdi5~*w-Vv
zWXbr9_NJASdeWmA)s=d5xK5AgVCc4t#DK}ud-pTuf?tO8ixRg(+c#%ah(x~cL{@Sl
z=fanNZboSntHAejGU833CH|4gW<Y=UIgl64An^aY$I4TZ?V8wxP*zbFspfzClFC!0
zalK9^+X*0MHFEJ13?7>9Ta#=jIqV2;Z?aufc%xjrq6P8d4IYUWk#DJdrR%l1Z1QC#
z`T`J~UXFAezBS=7Ju#0{l7BbI@hn9p-;fB0GJ0UOX>jr}O06Y<tcy<CV`l8=bh4W7
zf)j0+G`BD3s|R`^Dw%U@mbXV?V#du(-s5n8t7X0PL~@Ryr`X#dSienjPDzx<EHVsR
zlbnOeG@3-RoS@-@dF35%Bx@qvqmRSF`~Q(MwOuBdtQm0+DJ=zj>%T%S6O?K%>X)oJ
zLXX7`RyZPt>d1J3!z5V2gUJsIORwQT>){9%!uqIJbhUEJk_Qsa+MtOZSRnc$(V?-)
zn$h;`<wSS98J&EW$wF5{mzPb>a@XRJa^dHbo4Zo(Imb!X{J&BztS^hhW^0Gd(U#R{
zRdOvB<Tg)5N>jBG)=N()jtk99uIu1f7yoAM>Ka?xy|x=XC=|alxgLjndubb|*EP$!
z#3=hxNd+$9q41Xy6gZ9tt8u9ogU;f2CRpBk3hAd9%X6EbvAmn6veZ>Le)^Kt)3gkx
z#vIAzCC+z}rcZKxWy3L1C!6LF(}tAE<_-ewBH7$cpu4i^^Y3gZkjbV{{Pev3P6kWf
zBl}f`{_y0cg`xI!JysxdAhqOk$PC5}%o45PL@wDvkn!cEF|=V4uFzR!@y!X#&Mb(b
zj@t$&vpR+HQDOH~Lh`6%X(VqxEsZvo)=HLUt&B%b-y2=k_d=9M1F(DAhU0s4O6R#K
zd!rQn9v!cb>P@J)643sZ%!#s{;V6OGJEPp^FbLcqj`AdzRvMwrjB*|nafU-t&P##w
z8E@R91>}!CQT8^cHEJ@EQ8UVuW`YEQv!fC{wVg;ETT2Nyp&1;FvcEPQ>Gh@AJHtQr
zjxN{wg(&+|0q@mACSvAOGm+9fE6QF9%gh8wyx{LB`&EOdg&X0$syT@cb@qBCoZ5$n
z4bMi|v(ULBi-4O`jQ1WN?x4<6$<yr-H7x7Vl3+=4ET3MQfeV2XY6;L-eLI`r%V`8r
z3Pi7^PUK+ECR3B-b&|{%5E(v;@MViG<=|G7(fZt$3Q_ihjJjl$dTT5coE<*Whqb^j
zqkb3ny;DfDXhziUkSI7=>A`2Oe~vmW_D7Mrv6@Wp!!()Dqfuug*_<VtlfdFiN2&QM
zYwg}#_5j-+AC(({A+E~}%*T_WE{X4S$XxCTFsq8??c0ew%xXEmoQRFO#N7^WU$!eR
zqoS9!PuI6Eo(Z^de8kf8OM*$jGQ3G(Mcofg`q99(sG}-UA20b*q@%`|IJVb(1Uqm|
zXiZ;^;zA%}oIcWF@b()#MQvOdwZl-*z=@b0P7Dow#Hy$bBHhJ_*pMIb)w@wzd+9UW
ziTF03)>kh_eQ9VpMmEY>*HkW93!;{oiDsYIoJ31*QtJ@K$jIAgn-lT2iNFvI*cN`X
zUvx=*j&Eg+sOJn_Nf#cU%TL_>Ow=qA_qCmfS^2E2I2koVN&0GBMv@u%NmlHQ(yC?O
z`cA~un-QC%cs7{2aUv!<5h1L=C#R!E$qHyX-uD5bJKPgB%B&XPAFwTI)Ge$V=ct^Y
zPK#<}vc2LEX=I4tAMtKfqhyi5zv<_wMpTjca@ajrqcjOI_xRWPqHc@$w^WTX6Snyw
zL_tgLKsqxL>-9?1zzEX1Gf{(#UyJjFr$i-+$)T3FpRl2jC?54f0EwKz41N+h^DF%1
zUM)h5+|~LG{(ZManTa5sb%+N&+C*{i3bF%ZCtFdaog7<oindRtS8MP6rl6}@m}bHc
z_>LDdJ!b^o2<D<01peL5uoh2L%JeubMON$CIhme38JwXCeReX_^J^j|dLfXO^!#1^
z%JlGkA8)@rm);RW&sB2r1VaO)#WgcM-+<R&f>XZVpv1W{8p`e)>d_kNCfXbjdT$*b
z&-CbF_n7QV&sOGm#TSYNh1QdaSO`IRL9a~DVo{#%QeOPu&UZnt_yLfdl<E0^EZBM$
zLmkFsdY)IZ#cs0a4dVoq!Sf)J0eE%a$TSn+{ySW}`^vbCgBSAL$KcsPtgtN8qlNVW
znslm!vW%vLA~?(tbW13)R9GhJX$><y_bO3}o9NzxiSEtkqT#$ukCxyENWDZn)97x9
zkf>)e$|}ClrLNVhhVw+dP18)zT}l;pQ{81!xry%jZ=yC$m1se3rl-9UZE+K|FPNzP
zzY=LJW<jn}t@%3B(~?vJZ8w#(jP7RD@?WV)wB~D*XmO^enG!iGR0IlU)$IQzTC7BM
zr)PT7lxU>SYGY)PR#0YX{}puI=}J}qTBfJEQmu0Nt9~<4c<f+0N2iH^C?!kVp6Lm)
z;H$L(QrE7V>Cy0h;AuB?!p+pg<X2P5s!aQD@CKzjc=q1~@a(_;%Ua4RvU+1|rYFj0
zVHDI=k1QXK9|AXJGi|NY51QZ-x>S&mZtLe)x0I=NS#jC3Tc)kHJ?MQm(U}6`w9ouk
zoISfKQ5j#ReOQU~77UtYA6BA}S|*xhA2z8RHtnMTT`n{2W5(#giHwVMu8dFg9xI(`
z{{X$g?Ob|46lCIug5<UqB&QxG-vmTSu^uaJ==n1l6G3mjOYiG~^u8`g@0)`3zWo<H
zk@JgO-Qt<H_U;CM>yrDdpkP0X)MUs?yOL>tAjGpS;s*s0Wk{T6U%z&ytuAs%5f|_6
zf_QJ|<JH-oX=`t9NGlg_K|#C)29F=tQirTM+r@5;c9}M_YwwWBZmQV@Q)wOYUwTlZ
zof0KC$h03&qMzJE4-`!Fz<(1ZHwX;M9?#W|M;QcGDG|7T)F3PT&amkEp<<c#80ZXD
z_axOAQ;^P>|I(>k%y3*HlQ{*6db){*7fdw#zlpf?qhg|jGJ`|ka}yae809EoxNkNM
zVsEBxx>N0&xI!YC5+|f*+Omy954(xAKOQl>cIJO`Oh{Lv>SHtQP9z$pIk(EzsbHc`
z|4mdqYphb0{V~(l3}RSYH&xq$soMTGRoNevD6vPTT|$X|a1)idnJC<GcyvaOnVEL^
zg6gU!o!G<eeeJsLEP)O)u~Ft9P|9{TVl)3Rgh)wC{o}uxCpHS78XjH0+|10s4Q)mg
z>3?VbWBjz|x-W!lk8tD~_kV1i37pT>_y6DT&-?Q+V~lBxF`L2IN0tU7%a`mzh?=4(
zO4$-)D`ofyg%;UAQz(T(vW|UCl8T~5>f54HQDp4f;QxHx_xm&S{r%_hIG?%8x#ymH
z?z!ild*Anc-|&SCEc!LG@<m_IJP=C$P4x2(eIcce%{nF|?YD!ZTU?I5LKr5F6(S|o
z%=%SG|8<dcTVELI*FvPq*RvA80;|8fx1aUZ4Xn`510oWVuVu-}?XOc6)b#O9*)dPB
z?{P58H6aiTt3=v0vH0XWSsIi5Jr)<>{)cN{z%F5&w&~kHn6;oK4WAwT*x+m{YY|K7
z3ZEgQ(JyDc!y%9U>s+eVslK8|M*V|X?1f5Fw^&x-wF-DY-Ji`GNj(FGxD1X=y;0A|
zIydSW+3ZF=&xY$6Iw@-m#f;xb$7m`y?p@nzS@L8|xX#S1=S<k+<>;q8D}0u1MTYB(
zaiNL>BWfUo*Ilme<npj(Sx*>W7@l6y$Jw)<NVE7jyEcP*bk9O{8Q|pYqGGyB+8Z~Y
zXP}U4YX-k|Hv*fpI^9sY5?^Q4Q4`O(O{`<AFX5(jvg*iZ4$5h6AIPfH&>V9?`15nK
zG}As&$1PDc-4jZw6IoReiaB#efvRm)fci>y%&G<|zA=U0`#ej}Dxc6*b98yK@#P3p
zIJwe|!pV)og*$Z2@^*K%3)v_4^%^pmR-ad2uc$9(4tgom*5i!|6Z5V8c@Vg$h2y}b
z>H01(SyYJ~w@$nWj2#hr?a7F84Nhzzva%Y!@A6Dr`$XR+@jfcDTD~aLZi;tWVIl|z
zfv-6%wEvKMymDaaQ2vv=gRuXI<@>cJb!4zx;Y^#vZ9w_ffd-b7J&i<;6y8YWxaJ&Q
z`55>piN0w?*^Du}8w*W|9IwRFH<y@cIrCRg;x!U&UUD@BI<V~LK8OtMlN<=nx18K^
zA~=lJ-pkIy%*^KzfG*|Q$G(YUj$I92TGa^Pc{J9v{}`?L`3a4L%t=N=#W};~%^{hS
zUG=j5K?47jGOOmySHo!yNUKr9h-#*hR1i^B8u;iVR^~$CtRufK&>LDaf6v?jj#lOW
zu(9yZDAGnGW$qN-Y~o9RMWnr4H&d$<leUYrO<Z!N8-p#5mOc442ty}j>dGW7+y6NY
z{6)jRm@0X(j&{YXdpP-cB2x=xJ}Untn<bfcu|&&Pi=IA73s1&t(<}5LQb8BcrtHkg
zv6eGPcVdRVA|K5-sok{D&ji>_JE`5Yc)bx6`kUB)fcou;oQFay3kk<h3e+yn3(`(5
zL+NBEpaaEov9%{30J>5M*P;X}<XfL-S?pu*YguhGb?L_-J{RB%GzRN&ptmB7_>=VD
z$swFB4zwdM2FMv{`HJ%T6Gho=Fa)f)z@1TO*ymhi9KlPhwFfPgZg63Ut4zD3OrMXm
zoVmlOM~9M)jvbb=e4b00uS2V{BhovvIrqg;(~MB&X^!>{t^@NccTnjR;AKS^K5j&U
z;7f#NkM86gQeU%F%RY`G>Uj0wF78O!H`W~qgZofxcqHsw>FV|1Q8y=k?T&=Oxg`E;
zB#6s+w`aYMrPKYZGkIB&ioU{pFpP(p#UU#(%>v#vgWW8>o0(8H^8us$AfJ>$%zU6y
z*dVsMoLSb(%bsTP%5v-MlgpsF=F7}9L(|L+ndQ+JGdG}kW=XEkir4LtiT`1h*ui#R
zb~p2J*vwi+E6JQRJ+pSuHKNLPKNp_a^rq~VZm#>i^Gu$Upw4c=&Ytl_J(^Ap`0&8Y
z;QfrDYBiSi%D!?dEg{FSi};rVi_N{V0pC*^Imqbbo*+M3D39GnYK)gE%|3uoKg$pu
zNgE}zsA|C@0bet>D*KgzY+j93RbzU)RW&Pbq-Nzaeoy|&{^yw9`Sz3s(wDdq0bf@}
zP7c>}J7Y%hVgTkde_?_Z^sT6wZ-<i1j_;~~FB7C;x~FSJ6U#c~05*yg_c3>ItZ3^@
zJ8hxqE8s+5zCKl4kzNEU0(v)N1w5Uq1=LUkYjBE2o@%1V1OoR1tZscP-lWQArpn;2
zwLgreN^Z*atzgKWdJY(^$j=030MisfBBvGtZ!7XKf%U)|MYa(50@$a>N&>$C--+j6
zRqX}KIvoXYmyd6y<4iluEeyVu4Y7Z`@368p?m^sHs^^w--^w=Np+u+Sm30quUZmv=
z-KLy-Ni7eQ^XJ>Syq}QQkesPr$0&`N!=!nq_Zhc#ZZ}RSYbMc9UYW;GH@&EvUEU^_
z*Bz)KK3IDN<9O(4xL>k@8fpN%@?q!ZSlo4}8t5#UBtErf=lU(5`Nc7){U%S|hRF))
z+Kkf;f%+ARJZBKZlb?b&uFX)qNMUOD+6+7BqG2bvH^VxOF+Saba;5=EYLr-bT9oKA
z?kV9)1ZUV}5}l~OdYMGN5qbohGEB#beWOju&_%E5=7xy=&afRK`E0)ZYAdvF3do;{
z0&g?xsxUj04hbX8(U!!7Xn1F_8AW(EXJ7Mtd+H7&tnvY0WvU<k294gQF1ZirNLQEC
z+fMs>5_<+1mTLLFX_{|O!_JsrmfppEjaBk#N`BKBoaw++3VjpoL1-Q@N3nhcmH_W6
zBC)Om@=~DEL1)X=1ZHsGKBoQQT*2lxffh`|u7C5K1VACf_TKTN(uXj2N5H379G~J<
zTi@PU5d09>F19<CVf^iVOIk^Vd$ACwe*g|DvYEg|fIE(Sd-qt@8H~@FVv2l20FUd8
zUU=F2D}j1IP1JhtN#w1>0uq>`&UEEL(Y~Vj_Vi|??qkHB$pxk(pF?X&O+r3F{j;pt
z;=XL|sT(mH9uIv961sTieMNQ?V2qvNO*Wg7l7chByuLER^!0R(n;*KWrauLpmef-l
zM0APG5@*ELG!p6{q3MlP)S#jF(3&<^ozC&?5kD%`^t=S2u5WA*cDNJO2x9=vjYj5;
z7%%rQ^e!RQcuL!iq&Dy)y2mZwS3St!g%s}$IZ`n>1?0fgQ!NY|27CG)%v)>N@O{d-
zcjk?pFc&&`ZclIP)uWlvZs66U1~G5$|2Z^pBu_<F6V<Z_{aW_kfUg$)JrYyv+qx6c
zVXw}7r2g(nH*DQU>?`1aBHt0f(4F~Fk>3fN1WwSGTTgjfvGuBDokfk#Tmwb>A!ieT
zl8Tffa2pU*=WpY7sd2UfHJxeCn?OU^Yo)YyrcE#@U0em(_7J6-01Z))ZT<7@ncb>j
z0GKUi%$J4Xmt}OF!B~Z-`I57<E(hFhKxaj=3A_SKW?anR#mDu*J$iX;+jv?ykao-5
zZ^PW5eG{0c$W#JLfyIi<C4lulyT-GGGc(NK9#w}0l{3<h&}0bDegb@qoM&c+4dGKT
zMUTuVaFuYRIrfif@(019U!|ENYp8EW8qJ(Z*Sab<%q=;6p;0+!B=2T<8t1<Bg{@In
zZ*VQy$ZR*;RJO(K{*l~NF(5G9io9-Kw-~0kRqYvj+|1y}_sNYMZWTRSsc1oEW9e%e
zgs;8QdS6=k#|!go$->S!s(kYN!>zV%Ir>vpZ{wHh6k|Rn27DQ)(<t6(_ibdjpG9ZR
zekFC1$=Y~=)!o^1ByrP{Z{sD);>A$w>~$iW0z}FIoYwbkD&cnhrZObd19)%Rx2YO|
z9zd2NN=1Lqja8&60W|d-Z$SGt-DO!ioP0iwZr;?NnpeZm6UrGtDoSLXudXb5sN^oo
zdG>Q<(KF{!mGgt>=S?r<+p|z0@(<J<!|RpLE}%7=P=oWMfM*nWkH8DS1im!B=}o1~
zASQSfS<hlfYrH?J7uav=2&qKSp4HFGt^2<n0dFcj+{?fBe>-BVn?FGl7S#Ky^PY3l
zrg~|fU02RHqgb<0ded#uk>l%*u`+_S(k(jy#=MzM74n**X2oZDnirlGXXSate349c
zdf(7Y?8X~dDeIBDl9cGW(-{Y&c$w6UgY%0Jzyfq7H_safHvOa;@S3FYqmu2%U6og2
zs+U+()iP?8h8;DC&6P$MDQ&NpW-eqTO%)s=P0Gl*R*yR{XEL*4rkznQh8`Ks!g=P)
z!Xo~LkQivf$@S7Us0R1lPq&_#s$1CHq}5+_Ye4_t)#HoA5W8Zq_}qQopYU~9=7(R)
zZV>R*iA4x`7ZAWIV1-mZ_zSwc*5~T-TKwhn+kwsK+ghf?^UPf5_bXC`0Q+<2e^8_j
zf#bkYMeeYy3z*aM*H~D-J}=*%9c@P0Kh;-Y?Q&LN;9lPeN-2O_ZJpQG5kU7ZXqEZ;
z(hh|1Z!grKA+s5k|9g3qFS3Cv;CxqXIiE`;u3MwYMQ#m6LpXA4yM}g*;pyy)_~=Ir
z50?YJJE1wc6xRp-f|<O~9H>7Kw`nQ~OL#5SKJp8(xl$H>*)9+G+EHQ*$3E;Mr@$Tv
z=<=O-JO%qm0WrGh!c#<aEd2uG>%uri;t8mRT(04;e@`QX^KoGr7abn&2kkvF$?-|?
zN07-F3*yHa6BlqvF05B%1Obf0h0iJ?0b~fiV}5ZY;+yL|Xd}Zzpd1X#kjd@BZ$^d$
z#Og`p@aoq%0Im#g+!$eAZ<b!Yy2TaZn6yG6IwNoejfX(#sqyg6)E|CTEJHc95eshG
zl$Dn6=x(^ztpUc<yn_M|JfVr+Bv_R>y4pJ!@TJjM^JIF=lvuN7ORK1bR0&QySqriP
zzJ{@8@zs8Rz{jyLv(AfY#(#4|(wGeom@>C;+2xbV@My7l|JfR_3)nn3xfhK$ds)-J
z#HfGY!6c!5Neu%w^SLwT!nh!36TW|dq)xa>-#=`u|8@>H<YypvE9t?2jV*V^CR2X<
z0Fs-jYm%~y`;(O%L0>1a-QnA=epY{9#ssWbXb{<b03DN3+_{D?AMAzrSFB}sjU_Da
zL${<<ZvLHCK1#!7*iJAgI`ha&21?NbRz4<dZxgcS7fP8$Omp<Fy>0Fi&Yx*He`8#O
z--KpA7g4Er8IoDJ=C4$8=;P=3z=D!A@U47i@+Gm7e$;4E5-j^*TT*wKcIE_p_`uG@
z@eh&Q#Uw}5w48XRF}0B^2ke7A;R|9HYt$zK*GX?70$Oh$971XvpoJm(cD{8QlMKSj
z_@Hk&_H^Ro=<UIkU?Aa(I_ICXQsuT18wTL&*atr)FbQ};k#7mi0;VZ)guoJjb%A{l
z<-NEG$W!DRfrG$)n)CB>)LUTc{U+Wwmw`EMwsRlp^Fhc5j>E*yGc4;8GxH^_tCPNg
zhHf>wg!Q_VfW*&OynFtW<ve$XB>s%0n<UQArRIW{GmT|&$m|<xGCm@)duPj8b~jNo
zL*+0q!gpGqdCbevqKsSbl%;>_(=#Kzyp8{#Jf<j9!FQn*<GDxr44q@*T<YSj%L>VS
z?PiU;<^N`}MRjZyt-noe7;gA7#?PHEEUr6t^Vu8yS3WO6!{AxgC8qc=Ud#V?J{x9z
zUGL61TSHj?i_q9ZFzWR!M}E$_!{}VR?@iR;`O5Ubw;1qCHG%5tfphf0xBns56sWIA
zTLNg>rH2x*jX$SCql5Z1xm3Kb4}Cg;OB8Hfr*&x%&<`5PrPPa}@ggum5z$x(%uglq
zI3)TpX7tNwjJKbMmGPZKW*9i=(xnY_^Vw_?KE=vA@4rZFriEjxf2PPZR%hd1X8^zd
zF6bWtA1X2@9ASK&og2P<pimVU4KA^TrUmul?ddpQ<8dWjI$u$otD{{yCL%gGBj(x)
zCwP<Q6!L`)1!s%P)(pr^&?cl|>leuV942QXBDX6{?q+K0XViE3Sjx9iFQV#7LveLo
z<Ag^@Q~liG-rqOM&6~ijl|#uh>OR(}mF|7%=M9sy%#uHU3XyZT4^p5B_$d86ojb=|
zVbV~Uey*OKW0UbOM$?2{N;3CBo@?MLm7)wi$)6NM^el$=+xx&iEpF*IRn%7J9Z{<y
zN*m**J!bjp;afb<Lc!cVPtTqkZuxj=3=!JL@4!aPmoo6n8aduKl}kjQXY1BJ-W~Cs
z1WqV&H-X?4elAsXuk$#KK2eHa%O8JNG-6)Ov~f8S@MAew_aRUoDCgD_4el~if?w5x
zA#+|Zb2(Gw<r=`Ps)tGNa($qlA{hS5ErI5$^9=X6p2lQCh+iu0teIV(6TI9B=%5IV
zx-2fb-e??tDkbvVN@t+9FZA^qcUdex<~8o}P$Jo?=T6W!m}>a_SKER?a7Kk2H=W4T
z8};lkLfqljqkD>9_&i(>bJ*oM;d-#!m){N7v&+=O@4xE7$Gf~bT+J6maBk?f(?N_!
zC`3n}Zfx0nn811AlseVDo7BBm`E&<Yi6{EWv0F(iPWN(kc%mNg@cj*=!n8zLIhJ{k
zeIn}=u5r;mhjp4MR7x~aYZK2^R1N)n!zjc6I?cE~Y1X9pU6$2^SqH^D{g@hotvNUW
zhJOHXw~Tbg?qd2Z5NUqt`hd@&Z4+0gS@zfi`uT~rF^Tz_-z|+Cy`Px&2K8&urA`xn
z0W&!IM}9~DCHzQ(j~B8D@~5J$BG|p=0bc;z7gI}`2zdwK;|y?8%fTN>eZX=iRmQK_
z^s8lE!SA>d;E9fJb1Z`**Vv@T>->T>oO~Tue{&h~6M%Tp<7%RyZ!;^@E4bfR(x9=q
z9)S!%yUUxK6KD-I7d<?ybNls0kK|ExI0NQPeogd-ko_QVzaozlz+zt+pa?p9WgIX@
zHH~6Tv3WFW3Mg&uXDGpG^0YcZme9^*%$slPB9Jk~SEeiS8iDzMHX^saLV&gFl_iQi
zM*wZQlBWpWb>(AVJDqs$2g`GG-MhI*nI3)?fxm|Xc(`ajt7{^ub+%ID7?!|?)9cdy
z!}Sy_jca(g1&uz8Rk(5j_#KkxGc4cc7o{{$F;VI^UZXDOSz8=_NXe!qcAu?diy@6Z
zoI{iTd6){;DBHa=E62^j=AX<a=VLd=VDI2DnKX0qpGth@CWAZN)O1d(NUa#XyXJ<+
zQ%w{4`Xp7otSZ&<XDzFsI8c-X)Mwovs83_9caq-?_=+Ilm!s4P+Hzfo>J(H0w9&Bc
zI-B#!tZ-lKMb>)ywx9uUyYy#$9h%?6=+ExDr|9pOu$jK~P07C#Xf1-fRf?U9f_s53
zieRJ)9swRwq&I<Q0NyC{tsewA=37dATlcWYO%k~ojK6}{0qu&epGaUiuuKtVq=JpW
zde!tT`m_E`SARB6GNhzGC+dDi>t1>i{EZ)hy9?N<hzfoQV6S`|-zV?~V77POBEZNj
zIH{ajwErq{D!8o9p8s$CQE&9q#3&1Ke((S3^1t#Vf3kYHUCw0&g<X!;DF??)UH;O#
z8(n^$DONrH(m|z-)a8MCYN4v!E<Zoj>vDZhgbNI#sf8Y2UjllaRii}95WY$;UQHu`
z9$)z=J<c`)HWgbGflOYljM#{fHyFJC0QKqdmFQy19VkR6<uH_jSJC&Y9SxDy`PK#6
z0!I7lwysclH4-7M+yO!_pob`OwT5ryK4MP;!xZ_R0CUFG7Zv%Fz<OYnm^uf&WrnF|
zs@qS~=TkJaSH+Y64e*5`Iyrpx3~)l!pMl1z@|JZi5ztQjs#*j(0xcDx71u@s!)VDW
z+=rCK&>W(icBEoIt}RHl^ccsw$i|-e#j~q!--iqJ%0#NubDV3dft3}BJO@Uwn>q?~
z1RGO7j!A4?6%)r;d#T|EIbIy$u49y3+YW4{m=<}fc*?G87_3TER3L^J2-o%kdlY$;
zz;WOx-07zDOUw!87x_n4w>f^|yu$Y+%#GsL>BQ^OxJy_h_ajtvlSzn1F&av1uzH5;
z&S1nMf)XS;qq)PIS>z(~UtUAC3E@c5rkGuN)L3cz-3_-XYzrCBN&YYECbKg)r8|i>
zC&SG?zc^^Dj2nq*NSrQ(MqWd*FGi{Y5pwUr90pga<U&7Y;FDCm2vT@?N*e19kttdb
zNzauwQ-cHhH$_{w;lwc0`K0NoUKU%>H+_CwT(R%BYN%Vp<JAn1m9Ijxu~<OlD`z6b
zSU{uaA^Q3+1_)jNEjSkN71er|0O`RCAXNn_qEpK-PbmfHJrko(ufJYL<E}T<;8@m(
znkQ*+lrC1=<^i@dT@%nUwD5Wdpe+<jOJkSaM-0n%y{97d{B?%hb+(6m%NU5)mjUl!
z%$DUi)Am@Jf0s=riFNVyU92S5WKhjfjhWJwYTGI3+SE8Xff(8A$ADkz66vOtJK&`P
zkS39wbvw#jcWSu(I3MrPkZDlcuEEfo)<E1Ir@(DMbwv&nXo>yd-Y;Tb6X*))C8p91
z#NkEP+%Esk&<c>;x%PQ+#B#>BA`RUB0G_9B1)jf!LuCz9B$5FAZH*zaynw(<z+^@8
z2{1oeGvWDiH)CysbiF%WQv@5x@GhLLFV82ETAR(yX=S|W`u{Uq+tyA<ZW2j0q}~rm
zGyXMOUmp8^O!q%KM42|uLjN!EP{RCTD{9*%XyG*3sb!lWD;fQy$Z`UI1IHA3o4^G?
z-@d)H!y6<{v-Xu-UG+$l_k$VdKTsKzd6?)-(*YMzw*7$5u?8B__ASJUd!%i)2<>E%
zKH`xMM7O{f3=?PUT;frfyo~7)YOV1y>}DENmk_UJoav?A43n1U8iMKn36+@1j>9E<
z3hl&C&jQEBprAIH2Jw)WF-V177yKzRR#^fu<|#5xIqvwqobF-I5g9fHz1?T)a@cIR
z{){u6S=o%xWr_6BOlEvDM3<$~qFaF~%4XokGz-{&Fu*vq;Y`04`}kvzStO*;@VN}d
z$bLj_<IKT)y)R$CZoq!W!<|{i!+oc$hr8xWa_b5gv8^u}u$LuSzCAODEZ-VPwwIU2
zP*)<hzhl5gT{($GBr_DcV^&0R`l|tZHTCh;SY1vQu-7P}Bk4sZ1nj&p_9FvBL9m1H
z{Jjv?flwkqBvld4y3EkW;%ePP-K>G1TxTiiZ;~qi9I!XYD)li**B;Ru83FrSc;bx=
z_so63KAfbcxUXxtF}<##mVb0D!0T<Q#Bye~3&y%k&W$5QC&R_0u7ig>$gQ#hHZK+!
zk<M!EiK%ggn?%~UzQjbqcaH|_Ce&)JBU1GRBKQ~Po$|>0i6Bjr6D%OoQW5Sj=xe0}
zY#s48_aKaZIbb(SvYc71Y3Af{p_Q{ElI`b1pU#eG7Non}mz~L~b|7FsTY}~uCKB;b
zz<%CDbec4x3bwT6$bh*XXx8IUp1Ya|49Cs4$eR0Jz}yZrOD98>6-Sr5S@&f!@;M7N
zYps`Mn=Cr<5i1b1xemdX`vMiV%?Q|fGX*Wn<R!l$fpezRc{(=nvA{WuLWcJ7hfWHd
zV_GPogL+hS?he&cGkm^QGt+bZM4-#V0rT$U?5Qr|9{SN7tEHYjRa8wh=g32mxe;xH
zy#wFGTh8pMr~*5=dbuK?x9&J!q~oT<PP#EkBC-s`D}NUlEbc-9m-yg{A`UJ}q@%Xx
z%<Quj0(v>ZoRcjc9T;K4(ZjNbTLE(hO0QNeZV`C8s0Q9oM274Rj5HEgtpisDCKe}y
z6;*Z1dZ}`tv(%-JDt*SSv~zi{(yyNnWZhKh!#7ph^QKCBh103@5rtLfYcB^LH79$2
zQl+rp)g1z=bk@{BJENnjG~`y=4&|d?yKr*zp}_6TJu(WR52GI)!I0GZXC-!co#B1l
zVz_W?JrQ8t>f)+H7w!z`u%dbQb?)k5KnFBA=i8q*Ma5WCm05WrP?_4PjN_tinaUD~
z-j{u<WT0}g!a5lC={tV&84jJGE&esB19dPg_r+Vq6Imc~9@e&70!_*fe0&gz-idPC
zevrgqH}esAza3M|L+wjyZw!6$!xqO9Wm<<p_i<h?JHuWFTveEeOmf%6a{sGs$7{&M
z_Er!jgZq1Vm2a2-yupLWToTRepsytix2*oX{O8dlC=94IY$&D92g{3q7y+KHWjH*K
z6m7O~>^xv;rN=D)#V~VB*7i}=(e;A=2z8WrINz#~PaWpl7q3mK1@aMU;M)wgk0&#}
zgj%q9gi*&g18lbHY~N6~k|XJ+l33ffmBdvvn0H&*XVf<WN`(f`iQqLC|EIL{wY4!2
z{S?2g#KSQV`?Q>h#TZUM)nHmDev0h(zw7by=|vLFMVGHv==oS}%l~eS%Gv{Z4pYSN
zV)u8sc(<C{RNqyYIH#uaZ6VWT&TUA<salB|cZ8E3CFMb6Y)wDnpM!*)*QNU{AMwv&
z=$J2E^x5g3!*~qyHz&i8uT38;^iQHOuj?h!+y3xRqB-VXfbHY`lh}SSg*&zNPeLjt
zy>}CT&q@EeL1|JuLy5Zg^!JY`B2r((WDg%|`Ny#ALo&Mf(?5pB86}-O&Ohc>Qv%tP
ze#g%nFCd{0IUuA-N9V+czMLCTx#Be1^onlwd;hXuBYe)?E{A>0<Ux4*_)yBchziMH
z`MWCnMK`<ajRu77BRlw%zdd#6Aa(Ip{5Lu`=d)T8d3&Rz)UyP5tJbhOBr%kwb`H*v
z^R+s#wdHpwB?!n27y@(48Ul?WApP;<5&0twfyNLpNi9ffRBKR>;<uRw+kT#e`v+SM
zFyx#3wG2}lN$}n5s-F`=2slP;)iNDLa*^BpwW_<xuvQDJPX94dYZ;lBh(;@FYxE<0
z7=3!Kzam6!_IIMslA0uG&TX`;Cz?{xwA3C@DckZ_MJLom|2x3jDp~%Fzl_-FlW%q2
z!2fiWoYy3@;tk%nZ(<Vh@gtu0m(wouypEK^DfF*X<Z%M~fxU`6K;Q^)xTMhWAm<Gs
zRse8n&6&p@R{%dMpozPSWqr2TA7`p1YZA@fHrXE+?%atF_~Xh;HA0=<jHnuH<(L;K
z=Y5MMTsWRcx?WEpQtAYeI?$6N&^|z<ty;&_S+b+!yC15?U20m#@pT1*G1-Fmi<>z<
zl)`yK$AU$!J#%&;x%SxILUQdvk3Ssr=ykZ6UdKXu?aMnpy~zAVcaL6EdeG2Qy-l%N
zmi!K}*R;72K2&$KaD4SuXsTDJKEtiBQ2nYm6{;U(z|m#d+?zYl@nx_aA2N`9GhW^}
zgDg}}27Qbw*a5!g5~x9<>dWB2Iy=w_XwS2TA(Omyu)Km6!*PUp_T8VwjQa?jD$>h1
zzI3YSnHjF)&EWlB9qHjZm<$4scy*+Q>ljaBkUDyHzPSz_!Tr0A4)p7G$CpOq-yB2Z
z#eAB)z_5_g*hhhB@Zx$oK5mN$I&aFcRaYf2z6zz30AgXO1k+XO-_ZjcU$m$n^$JB}
zehLdk!){@rXk2-!qR@~u$LFWed|gAMn*2D&UZEf{;~tSEsrnm*8Qk)#!;^hVwRTI{
z1>s%<&n{r(yVMuH?$~F9Cx=5>XPAM>YKRq_;Ml*(ahjjw(fEx#?hu5jW@{arYaD~T
zKN9<xMYxn~K&<8%A~0xt{h^Z_TQ54(`&l@KdmLS-$7GRjZ8%G+d3WTkH)!_cabz+4
zHHil11G8`K^W<<ytwv$t#twWA?9R2z55s~x_IhuE2?oxRejG*CS^W~HjYm1Dnq^IE
z;n-W`OLSsgO#H=<9DA!w(u2Nf@y3C0><>I5MPhm5R39$f$XZN~wBPD|V|})<86$z`
zd~fMl9*>mSdT~F?Hc6XF!HsC`!s<eIm*4L55SDvtaN|CX{U!~TjbG80{}W`t-tKs-
z+lV)@tnzh=lmn7IDZGj7B!wc)fCiov-gNcOE`m`j(lgig8n`gI-oIP8=zm(cB;3NW
zlp6!TEAY=2Ru7e5$eL?_V^3!^Mem0(Gx@*0sK0I`AsNT0LYh6`f!>IEI{Fp=m#z0M
zCDfTIv|thB*p4VNSqrUN_mEnF)TNeO?h2js6UBIa@=eFip@wBS)L>pUSP<hiC`Z@)
zs9%e`4$L$yQWpii2I#B3%NBd0Rj00A=?+$2)ZpEu9+phblXD%r5A+}2Qb>QSN54;^
zt2RY8Kz?;0`Qc&mtQ~?2dKT+FLdrCt3|3*Ry7S?qH&>bWKULDM5+9wWKc7o;?E9$r
zasd@LQ=cxZ?p1tWNw4CARJ=cz=WJH$qmci{)4^^ixpXixiY=2X=$la<)58C)E|ne9
zyFsd<mvi`Kz3<pOVQ?0f*Bi|19x$naaGo#2uYJWUJO=Jxg*_<i^+wKLF!|ui6wDBl
zi>F|_x1>3LneN3|E5hI@@=q-@(*ANSf*n!PvLkK*k?#1bv6v-(FCfRxIqpr-k!)2(
z`YVk<K~59}3F{u&1-P5$N8VeB<de9NEVk`PwpAj#SHdiu$3&>hBLzFl1-Y(ohI2tZ
zLg}IdfUI)(?DL(AUeTf(Nn20aj?&JhXz=<F{}k9&Oun0A$EdJg<1E_6vCZA=C&{Hz
zMUSADuO4yiSW_oQh8IuCx4LI&ABkT{vLMI<-$f5QWW8zGQ8)-uUD@+<7B9`W9>N!(
z9rGQ#I$PfFY!}jpATau(dMmP?KsLaMQFCiL1sn=2bADiDy68Q27r8NAc`XdF2=X>K
zKPm5H<=v~ipsrD;AVV~AmvdN|Y+maMbvp`wB<dO7rEr$iHaIcnmosb5Vfz0a9d2HN
zYaNC0h<aX;`w7edrYX{%fZC)_UM*pRGinW>^}<8w+mi6ER7VEV(-K9#)q{o8lG+ev
zne6UZ_0v<6zRFkjam!iyU$XT!MfjO=Bjr5g_X;i!1sAg?7AwS?kT6>k>3%RLQI!?B
z-?1C9>HF@3Vy!rA?EtnQlO@<ZXYn~=KLGm`IcC|#iUCCx`H?^wAXy5=!AWOH5;0^|
zjN`%15;lj5^|yj{vEJgU2Prh?U9&wu!tDA#^uxbd8z*+?wWaGB_0g8Bh%_w2vD=8h
z`P8`-@3GkPKv0og1l|DV%1ku4LCmGXcRnBPO#S8`=G3v<LuPRiTDEkSich8}&U`T*
z9y&|uoMITJVyii@wiJD%C}foL9;pWaeWK&xek6F(B%g+L_c~&+Ik7>*)H!MdowJzd
z6G8J#Ly7ENn#8s@b%qXlTRp}in@>PDC(B(D4>k6%pSpoP%9UE%8!TW9eUT$!q`GD8
z-R@{Dt1WK^OiXXfIU?yj+(&ykjn+Be%WGJ?Khl_+@5^g8G4~`p-(yj@L>a6vTR9xH
zRY$p4dl~0onSs5RD$ITN<6m?3f@^NlSv5a&aw*HENzNCp#UZ1|PG^fDGRP%jW_*vx
zmdX@dM><5dpomt}7@4ar4HcAq+*QR{L5CGPOoBNex#SbqKCUpV&<j5S-`6rMtq@D=
zhzHTpVy9|})C$9zWk(kU0t1;!BaI-T-QXT)o@o0i^@D8h(j1reJlx3&Y2c%=(Wx%&
zdGg?>E1J_=(QTg4Mu;;%%CdIvXP#h%?YxDJkfRXIIxQH@b6}&k#iq(ip=(Q}IsNGh
zX>9ZyKxRN18@&zKf-V*NngpXua!r^fis1=gD^LJKdcBBx<o3zVD-!0?^{y~qF|4wI
z;JkwP;txkZMex<olw}cdLD0K%Jj<Z#oqT4M@rkAb!5NRNF!YFF`Fv*tVu(5{J|%|t
zTDf8vVUS_&GvMP|2y;XwcfN@Jm6V_8f%|$mqfx2~m5K9|Ao?6*j3cTzVGB@nv@wF^
zLEB1g5gs+ApK^Lr(}TmQ$*eEmTj$o)8xLCo=M6x+xUHIci#=wh;#m3ONxXCW-a1o|
zzKU$+;M|ddwJ%;9xQ#`_gFLT#G?|KTR2Y=JvdTDjO91bEt^shjJ88X2mkhY>G_Y+j
zmcQ=c8iG;ail{m+I64k?b+#JdVX$RAALmqr@rN(Mxbcye-OVuVi6zxj$7Pt|0cJs@
z2Y3pM%i#+mL91ttn^!V=Y+y3eEqxqv#NzapOnlnD=pxh7R-%9Zb_9}`o!(N~h9(zp
z12iIS^0@StwY{_)(z4Av+3BrNI&Df7Ukbd#T=f3!kbBJHlvS4?|E%crR?Lpe@{!m3
zI0(hjwc?u;xs$+`z~?Almx11yI`0sN`UjD}-;1n~(%*>j>33@J{{Co690h(=gw=UW
z5kOx{>4N;-Q+{SWs3lu)0A%RKqFvLQnTD!NFN93{nju;<?rB%EdI}5k(<joK6k=*e
z2Fxb-WMRxEbeD@6Uo2gh8<&u4@V*{YfGIJBF&nX{54xzg-IHFw5cMY)wZ0KAVXCk1
zij^K|(mK7i!K67Tx@&Kiw{fLkTPgHN%&kCKSNe54>Bn><Eenn4l3|$-w{eGn_t|QR
zrWJ`=tRNFaa;IhOvD0grij?7U!8;!!Pv$*OrdJPVj&(Duo0cha<M-+5;Y{th!GF3j
zp~@V2KD}}{bCWLZCbzPiOY1s)o?gM^!ja|yGXR(Cc`#@d!mUFSV)}_`Mq{`?HID6O
zrY}FN-y(&{-O}dGiZW)pXpus%xYI?Q7n5(ZmD7}crsUvl70HN<>1QS1#`Cll<_?Y6
zII!c|C08<d!-ZFg!5<q*V{%p}SE@(2cm!9KoK3F6Mo(;{8N}QPVel6UKgHm?IH?AQ
zFlEc&W5yPj9<@wJj_2vFJN2#DAr9gh8!L8b=@VNMj01^DrX91zEniOIGdxKtHE5V_
zwy5!3QVM)<7Xg@Y$w`T7u`pLw3LRS&ksjQg6tA78K1ym~K1`AnF9DhY+vX*eD9r8U
z=9W+|nB3=IPl_ze9pmOky17#sXrH~3G0N07ok+qD8NA5u%YDgw$7*fq46R#WL?VnH
zk<lt%^?wJ$#h(tny_&P}6(Ta&806WHGA=L#diBew3uDDPNIjx2&(YB+w9Hu*7xR=g
zCyG&k@u*-~9r`xXj@GLB5L-CDQTwXeK_FbRW25%+#LYDwkyRVD5>jUusTJkiPZiv8
zccUiC2=;e#nxutuCge5JCe^BOZiajLo_e(IphnfzqpKFXIn~+iH8ti`ZB(7&O#W~@
z|CzamJcVAhD`wbWYwn@?mW7?fJ?Q<3&mJlXtkT-1TNPru8O~Z4D_4M+?8Z-eDWhQp
zpWQty^VKO}7yXbF<T7}LS)=&u9&kY;LEd-TXX`#v)8DJ_^pNi-rx4lf1kM)n&Z|DV
zixDY&tRAk1J|f-aX6$=NMC2qbnc}lM2%CrO&g!>3<PJ9@n@z!=)Vz<=e0EzkZ}q1h
zV%zfSEw6QLWk35E#0@^%Xu|3<;rd(MjM)kuM)e?>{Eg3UCX#DXJ(A6CMr<a;bryH%
zSZ}=Svm3`N<V5)FhVc}xebQ&wGKKq4II}e|7`M9+srfk(wB&=}tHg#*BE|+6q#nfR
zyydei$74?NNih#o*68XDm6v7W8)0?~K2uDPMA4}XogYV#unbs8qR3Tt$=NY~lK5Zd
zt9$T;*K!=z{ZJL$ZOru9aq(IL<T)ODarAE?dvUCrf7H`Lk&B}M-0_?FqR);|qw*Sh
zrDAR_6@y1rVux2MrhzGS#_m5z>gAYj$JrT9vUxg|H%g6A%N$0AT6RkfART_AHt6_(
z_?2V#B_y7<E*T{wFS3xpCWam5FNKS@q<B*m@9@9HAGQ853Y~8iom*J^QqV2`54~!t
zXH(#o`zc?PmE(=-8GYl&_<mEf*XkkQ6Z?I?r9wmx0jd2r8ck`in!MyYWUyMhSch<o
z%tIWo4k1vm@af)Z?%PKP7o|YZ{YL%TneYMCeZptPyoLU}MW6Sg+&;IQealSJri!<z
zH}kg49y)la<=brvI%~I5@mo>8-E4)Ji9Ml-Z#V35tVf7+!!{4`npu(recKEsmzOJ#
zuH>R8U3BEzPA8i0+Ldqa+a6;Iq3s!$d<(*(cU_g3k(O_PVcFd4;agM$yr!B0ik0{2
zQ%bd;MP%z*mx%5Si({BVYd_2W1%ss4QeWqI=T)9HTF;I0F-ny9T(&PM-a#r;*4jNJ
z#&wfvP20wHk7^8+R|$Xiw%wztp+X%qUa-4`ZNs`n@M3pk_QZgZx8<O1EWak*bss42
zKIIvg>7JSPJw}tr3$FW7nfEBuOg7DX+1l$d24~$R<=tIKbmX0`F%r@BrIgp9km!hh
zcDpdq^|h7P&ZUVP(S4$=^RU)W`Bnp|O}yOJ^-t9TDcIVjZr{QR`IdL_A{yWTZ^*QZ
z^q=7$FvA~M;4Df;5ANi_%UZjIs4y3;pQZ|06juJ9@9n0AmA|h%JrAKl6nndZ-Plx4
zu|3La?A8chug$W94Gl@EMY=9y8<Kj0)zA>P2ULU`wmHb=5R^fRwHwK=-S7(xe*%1z
zM&yKXb>@6+-yY^;L#8Ub-Q|PIKH6hfHGH7JvD9UjO&jd}q57L5ZVjpqlKo^v+qXtT
zabdU)7Ld1muaePTMY!1py^{8(@X4wdvU3X5lR{1MP^Ai!hucX?Q?G5fY_#4c-&OA6
zN9<J00{0jSwM{R(l;IK7jY%$QDRd8=q6IA`+Hr;utdeHMsv9>p@2SbtjuYBCoK?uI
zdD*^2i1L3n_H@bIqWsxbBW(<@pq4keOXW9-ttG)bEIZZ*_m>r8pDPxZIku7__Y=4a
zXsrl)W3hvPJ~+<N>|rcn`*Gt=tfYUK)uFO?NLYE@yu9D>q1~OWz%Z-mQBI(lbHqYn
z7e>W5MS>FgX*1t>9qFZ14_(_FksK90$%}UimEXd?dUUQAAM!7v7jGuI*h885FO-5X
z3i=(rM<`^=wTJTni=U?K`{;34Up85=Je%{ak~pcHWRQTqpN4<7{S($kCUDU1FDdE+
zl?|Br+)Lp%bFGLzMrp_90#g-<Bd`@%i@F%(Y>+MgPS1=h`!_(}HdnzCej?Y9OM?lr
zu9ma;9(d$d=l(?t;I6+jB6!5os;$97(R1?#xR((W1FLRIv=woEriM4%y>|%2WrWTC
z^ycGK^4{-Mk_MzIf~J;e2-JnUrXPZwXSh4y+@@uEQ}#PbbOq!o`46xS()4>a;Yu(o
zlo%`?4&C6PKRl=`wYEvhw;FaM{Fnr{<-bsB!!ARK>A)04Y7=0yuEZimnh;<srNkCk
zFeOJC7Ebdq!*KR7vVZXk#<h(?%S{$Ec~or2m0`oC&2s8w8sI*>;^jGc<80yJzSD;7
zkGR``Og0MJY}W=|!<nvJx2y||*%nc$NW(m}A+&f~M7dz=-Q;fxGrn~R6j~poG_!e}
zw&Gf|cM{hFxF22(@?P;8Naa(G;p}J09v&_@n+OkkT<-Q7?rN968}7C~4vOIpdmE>U
z;I5P%w~knzVe`1l=GN(<?%N|OF+VwZqv-93Vb*Y~LdAYmi=<o6<5QVwgpGf;El2gf
z4+*wc;<hWo4u9PDz(FxAWT~nZXvs$^!`Y}n+zGE>Ne;!9^m`10D{($t{(+*L#NAdG
z9C6Hd`s|XW71>T89jGFP8)dl+Z+k>?tsEQ(!<%6EhEnEwO4;#6KH0eoHjMAJox}T1
z$GMQH2h_fci1IILA4I<vpE-L_>kWg`0i3p+bAFFg)Z~i4U<I44WoO&(oJ)O=o!^p=
z06l{or*=9n&DV)dru4u|!V;A&<YFgFvYbbPzAk0*EpwjG9DUfnm+J>iQo8DI!mkxy
z(XL>_R*T6df$7I2M_07d)#)wXhS&sPoFa61Nz}aLlpu>%4R>&Pf@DfWM(UvS_FV8}
z6-vGfEK-DFUy>&tCD&RNy+TNyLh37jWNFo63NT7a?hF_Bn#h+R&<Oitd9a%i?w|p;
zqiQM>x=HJ0TEVZC6jwBo<=l=q#)z(@YtqY9p)4z|XmqUg71qsU&=%yiA+BgltY~jo
z3-ZfgjTG$<7<l#u)T`tl0IMN;12!T)1}MTbyA6BOWTC}=TabTnpJ3l!G{Ga{j+I>r
z9KwZ>qv5idl&$4ajlYk`-Sk`@kK~#h5_5t533kJxv^uXkdDIb~tw>n{3xGEjDM0`M
z#;=K@)I}0D**dU2Lgg`2P4>V6SNn%eJr-W)9_%_scpDzex9-q{Z`ARFv0`N?#J&MO
z_S$qulG?;Ce+l+Irb#N6rG&r_3AR2$^1)MH(Ne{bf2jy+zN4R4vko5j)0QPW!gn+f
zhmvhhJz|;<%*NzSp0wCGZ7jPK=DAc^6i6>bl8-JJtjLsUw@?jl9qWZpyA%Q`RSlKm
zg-^TGe}IN;{kcRZU@+k9Xv(W4G2H>~yKpIsdaH^a<q3xJ1Q7ixxwnL=b^+z?FjdA<
zsh%PQw~xODADT>zpmq*r8nhpO&mI7`k8jwkh!8Y^^sqk*M%Ps?^*+7<8jQG7j5r3|
zk*WDsQwh>++kbc$qxQ&ra@n3NHA0d12r!IG@!F>E2)$a05nF0yOCroqO=bAvEobM4
zymoSA7X!v6n4|t_nnPxG^pjW%Uw2dVABz4ZIuPYtyPcpcRmXQn?1UuVS29FRIo>5W
zvWo`-*s`X~y?WXGL!S9~ubtZ&dVbv$*W>jsLTMjyo9*E5h@Yj#nHm_oSSQ$n|As2P
zl2B2Riv+TO4ji+yvjY}#%8ui4oqCmms9fM|ihYLJ;KMDR@DrW^|7rD@j!mgw6D9)_
zE$c1_Qem?i8qxX<T0K(i6PPr&A`DLguLHO&a4;=liK+|GW^VJc6ZQe0(12z+I?+h0
zaCZh&)G~>V%}yg@5@BOLcI}5ub{z^F0W`$3n_6}vUSUFkXm)@VN(8NDjBpC_Yo(>w
zKZzBC2~uK;M<Wr3GO>ZUz;Y*c1MZgu&QK1u;Gmn6VxyeSF1eq)P;4hY20W?=LQBjB
z21)Q>8@{zUts@G~f*}5v;eON=vcI-?f}wu+sJ+xOC(<6!l7Fmjn@iVPkr4$KImr+l
z3yeW?Y?W-Dt48S8YL&96IBe%I2PRGhrr??6R0(IQbX8J${FC?^*g-iuJThs~jYv0D
zy}Jf%x1qlhnSv9|oIZ=dE?|dp-XicL@U0vjm6Y09MH=$a<#6^Dvd_s?(KAhvN=gJu
zdJ{4QnDB~pDPI+xN%`oY5I-w)Y+B$Z%VFH@*92TXh#t3Kg}xp?cQ+3=%%NROQVU#T
zv!mcIadd1i7?2xrGT&-Bmaut{vHL8Qx4urrwE$iXciI#q&>CniH$uo$LAHua;LFsi
zzgW0H4{*A<+-3+#?7mi>6H?CZcMP{8wjHD)z+kxzEe$*5e=V-d1cx2L8j-vb8_CY|
z?qf3B!;WHfNZg_2s_FE;JMyj8hb)WJUP%7qeEO~Lm(UysJc|PM{aHW9AL0khHf;^N
zAC|VuXqXzz<zT+UNGqaiANu}G>?<I+PqE{K@`1n3qDy@*@DSzJ`j*`<mcZ@QHV&MA
zr7Sx+0ti^jVtE;X>_7feS@=ZBOu@<V@X)Uwt!Z;sVk3LA`e6homcuWh+!?8y8>s`H
zhEw#eU(0;!&S=8CC1&?)3$f-v6Ey=H8k3Q4wZ(q8n>Kr1!l=cxARqB3^R;JROb_fB
zuX3?_ZYKwUXSx%)Tepg|Wko8}wx?aF{HGD6*!%IZpX}@z9BTS$M43Qa4YSZApJLz8
z{I&zB!&v)IFq}4T-P*}-05i)FxyRID7d%YDC%}i@No;Maj<M<zi2kC6O^a-<%I!89
z$8C36zPRoryAvX_VqZeODIKt{(!{PfOYQbjYfexd`-wc-uBc%$wkY|h?nElY>o-A4
z((VT{kvg9=6G0Bjl7!o=Yo<Qo75e^Ok{kjh4HP$#OO;`ad3*WPa#6jy_1&)a(v-QX
zI{0ZCbw6;}(p~R%a)BaP^c3u6N+uTTK|g`6z`csZ66g=~g}Dcg>w@3*a)4FsuZB5w
zIsS+;hO1gK_<oY{QIy8KqO?z=ls3$VsDf5|jRCFjBrA8nl)m@#l<=<OmSvlM`Rr5r
z-j9ByJPQm}<URuUq$zV1d6d8hz-C35BvXC`zDGs;lU)_@W1_f_+b*rw5jhlWm!@w^
z<KDOPabnpnoeostZIguJ`BsN5nq~QA&mk`GCWideKcTA`uXID8z9Qua;ANC<MQ?Z5
zW7KKu-iX9TDv!@<eoc9u)c8!V`<e1Q;4IxGT)r2PhgJTtDIc>BbzG5eb!<k>Nt7BW
zURQ$jB=7`?9a~wxVjU$rb4pOB!jNi*&X#>P7W^sXxK5wukABP_USD+RMFnfXSbn3d
zJT=ZCW=mZ=CRx6eRON*h?u#hdxfMyW_eZ25dz-*-)cvr4U`s!RP@}S`U;nv6fDfVj
zqF(e(LsxuJArJ(!7>7~4MY$6__~hA8#OHeUlW*O<AF8>A>I6nwKGSdMcYyhdFo%|=
z6H9Mqgypxlm^wOlyU`-^G6stA=>^jJL8h}IgO}*z3kG&+MowvFao=YZ30w!bbIA8u
zhGnPH)2YebdAIYk1Z{P9W=G-1RpboDwdL6Tp9@8^y4?31Ltt$U%D`MI9=o#^dyslJ
z(7K|Bj76phzgDcb0WB0%Gj({l@Ju2cd31@x8%u>Q*nG?H`<ZJs_VJ#kOZQFibim5g
zh_OyxCb4xvBh0(L;qDx+va%d)+VgOMez&sK{Lde!Xd8xS>SkcQBE1QqfT^D=f@-Ip
z297hK1x?Y%L?`0a@-@t4Onw>0beSlxWEpHwnRJh48NBQ=ZQN<jy5}*?auF-b*JhUc
zyo^vjBfBT?P~qHsPmb6ozdijHKg^0ONWqVZx_&*SL8bDcLE9sW>-6+J%fQmJ5v`f)
zn2nt9nz?lr*^GMEMf?01)wF(uDzbroiZBw&FqF%@qR8_EHUPTGr1ew+2Z8;Vrq<7B
zT-?iYx%F<i;ee3$TBa|0xLGRQn*smrL)-R8Bn8XoTUisRvY!O{#a=XV!)=yb7R4=d
zUXjK`lu%ibI|(ool+9utX_kQ$m0Y$b*bkZIlBg{<GX5;Vd_3ffRpD~@Ic3L(DJ~-N
zmLk<e8;etR!#GH8$b#7SOokh<Z)Lv)zCdDGJ4pB`H0A)CH(7fvd*gjdM5{Kebq9!9
zbMU$rCq5v+!i1*mua8(ltiH=JJjw;oMUzic!BT@`^(vRMzjB(;P`aK|bwpXRiflsf
z=pe{*h)X#mIR>C9#EA+<QW8C!#d^8tO2W-dU7yh(vvyKXc_3Ml&j}!{a?KU_p1|Wk
zPxR1~+(Ahz@-VOag$q7M_ULfITp}~W1y>Mx4;Lo#Fs%;uJXFZ##W0sL2QX!?L;3?@
z&`uLmUj~pb-^;MeA+mDpDA?=h%W~HMTt9nVJMgd%X;l=#zNI}1bVK&*dJ{mO(q2p;
zBAU%C{-Sm!*h_+}fDcSn2?(dH1ePfR;k1u|4;2yNpMdWb5#e*dDOwP<GmVtqG-Kdn
zUMn!c?|aR7W~!xgj=qkM<y%kU^MQXL!Cprn9axKD>xeU1o(JM~d0p;n4b0?R35U!N
zd}4Zx%RETScD<ehM?>4c;_k|UWA(n8@`v%7nr@!doDexy!t!+*K{e@?Wt)B9FHccL
zr*TlH2g{dK<YfZAf$qHR-6>Z;3o)skwv+Takjp(HhQ>(Pwxa$ln}%q<+z=+S&9b|e
zH!;yc0m>g#7Cl@3GC&VN&$26|011-KpJ^hFY@Wnd_Vlo#Cz?^2s)DQ^cr7g<wDfB}
z1N2_LHK+z+YNfvZ>Js!iVhk$O2dXQwi@-EsJe+srsHd;v55$fGti*gBk6L!c;y?s9
z4RkyW_4819PB|Ay#ST`iq}DPfD^3K)Q~O}Nx=tgEI62Byr0)!WzZrgKQJ|`YbL{KH
zQ@dgj5W%<had_RX$jnypZADm)RXhNEMjvJ4Wpw%!G)^3v#R`P8`zg(ftDS>(kT4>&
z{hNrY&1q+LHqB2}JHPJXwX>2KyW+L860S+5%BG!ZYNvjVBFXGY^vJ1D)q|{)?mABV
zW$2i7{5Pd2dRGC(@JK4L58~?(PXO~;sjnhw1SSBi0el^55I~ZZUQvWGU1<UE7IS<D
zqlwuI31z`s;T`8{Cc|`j8xnt3vxf8JQHlBLSrQABXl_H5l^K<$$$m(z5=WR-!!V<$
z7$2FM(zD1E=Q)zVLG4hNej5%}1Irj4rI|J>?FaTMvWWnevC?7p3VCbDUQND3f_otl
zS#1o*X}@8as=G(*O6P&I6^T3t#$KI|=hwRV>Jj3&>RxK$)gx}4+PHeeu1rr<x=t~j
z#x}hEph&UgYELmB4r=9C`t6czR25536SMl+MCS})we-eRBM9AQBteWVpdfM@!U)J4
zMPVHml;fi`t{GbrOPV%ooT!rKy^$e1gy<n@P=CiUhGBc4Vr2F0N?Q6IX038;kRN7w
z-*<xupxu?3<$d2hOP~YLhMxUyI)Q#bpAGDhe)qy?t0n*5hu%f#RkECKb?N+f2)i=f
zQ+bFdUv9)fzWgHI;<qB+Z*dNccq@+qEvKR@-XIvr*WlfBwF`0N>!lXT*Nune%e+~c
zts!Foh856Y%|yl>gatKtc&g?!{c^gBR|K7J-(W0!_o#jbdCd$~#v`k&n<Tz_fxuh9
zn+%ihrZ?e-M!KbyvYhcZoaTCc!^un2H$j;>vWDfWA50&NCIy-A$<4P$VMyKAat>{x
zjy+4EzXo_8k?mPeAc#*^S=U7G!7f!k4*Z27(B(LzvL!%%E!|ssClWlQK`sTYj47&o
zuA(bJFc6@@yGek=5ule^C_p#v39w2L%dQgiLtmF{7;cRdFv>Uq#hpe->=64nhU+RN
zK)wYz>{+j$U9@=A%bqZtD2IdKt~6R1VT@wfyWQcAReSV<`PMk;!dQ*f@0qvk(N93J
z0{T}aRk5cDGzb2p$an$|0}m?lDuJhfp-jP}=MZ=q;2tA;G={Va6GxTVOgW3$R2!FW
z@hrO7S1E1TDE<zw!3X<xl|{f??Okbs5&-4*m|hL=Io4GPno<!aDI*$J%UM@nk+6&~
z8&x()L@lZB1CTotW~hFDhZxvN?nl6fcv0HdB$vK0IR2Eo;$ec_M6+961w&MYem1+B
zRsKulJ4+oHq^HOAQcv^CP)X^`CY<TyDt~}<L^#ixOc55!O`S}fPWDm@JK2qg8*mCL
zCn;u8o!bp)6osT$u_-Nr(Gsz`;u>&S5qg3n0(R9Bb%`)b(gSKMlCN4GD90Qy`W-o?
zqd!1Wrxe|ZI*h{^^u|UPPaB?Tpn4lw_E27f822(^Gs*lAg5J<ipmiIMQ>#{o!q9K@
z!>3y8oJj^%{dhISp1>jH|2_;?IYMs%G*e_NfxCf@imW2g1CX-hEFv%fU{zq}ycUj#
zy~XhPAmfuyiI3gSs|ef!J0imlHTp54L{RMQGGgIZJIiA@<p7J~^BahuepQDX4pY63
zX3BTV@bJK%ToNvEBu!6OeGcTH*V9#*AFIBqH$k-NJB|s+{4%6d>=~?>{(F&9Yl1Og
z%>`ap49Ql-PE=i7SPaubv3yvIOtEKC><6tswO?En{j7>N<(Aq*WVb0LUF7+o`8B0p
zQ>n*5)T5KChk%1&7LTeE{$PupgMj(g_(<`{uPHV+Rz<LkRnGvY$`F}RWZ(?{lQaAv
z(6c%B=35h%5jGRcPpy$y&SRF%w}$L=8;Ru%*3YQY2%kMgFzMLnrYVEz*B>+KqtP8f
ztXGAfN{TfnP#CF41oca=t(<BES^~}K%Lz1e^n;<RKk;N(^&e5!>6cCH{?TC;P>}SF
ziVP-zf~3ob&lyDk%bGsO8?qEbOs23uWdtv6{rHY2rF5Zk*O?iz=`RtPtf^e%e8NS`
zrX8J9Mg{5mAAby&m<<v)aFP=)_6{ivExl_c1$aJQ!sVA?oHCIv`6-T~>d17oIDLg8
zbbmVfoxYg?>lR`chC)dcicOhZG+baGIG^bQUZ%u<iG2qKeo@S?`PQV)gd51#{#*lA
zVy=+=H*k!|EfEB8@zO6VQqr=kl>qbrEaoJER3OEh#3%KVJ>%E1BBQv0#QEu}XPv6m
z0PWU_?4HOxfq@}1csH3R;t_?Zh33h{qG~xw)#?NFATL*DQV-Xa`8m!^qqs7-LzBi9
znw3eOSsB~Uv@@|Uxxq=4HG6@Fo6~~CXQ0;>z)U!a&l4C5^rN;!+?Z-_0wHgHowQhe
z!7pvAX0N4jKOYJ=?j!I%^h_@pl7aAUZrfth;>CK<=#RP4ID-~$95%n&=OAcE8g7|M
zAf@>vwwk@1$>wm)Fw;MR`(2pnvqbWlWfG^O?UQyC&a?Kqun6{;d3MrK`rq8{CO5Ig
zOfw|&=H^?kPo<8p)&IW~MeFnM&TeH$-Ws9EW&)*wM22SGZu;Alz{jMVJk4eaKJAel
z{#*I@rIcW=EN?fvd-T#Azp5l#UvvnRq~2CL)O&Lvw4prd--h1*l^x5Bn>cIrwdvs3
z@o_fZ2g-Gd%2P|B#=~+I<S*5FHQ!naqN}&RJgIX=wdVPzbz>{B)_N+ZcWPl6Z><H?
zpvI-gT~2;szA<mHv@@GzOAEBx#di*GhiXgH7kR4@&Lg|?E!;ZGor!);#I!u}74(=|
zZf&f{VFJB@hwdT*@^S{N`)l<m?Q6yMn2R$GoH60jjQd-s!_jhN(3kG|<>&AdcqMk=
z<>eKY^Q+HevpvVM{(W2C@_|ALXG;c{*2||UJAv>n_2X}4sO*ZLiqw}}PG?^!>zkHF
ze_p9h!k55ay6Q@U?);Rnb!E39AYxW*<+zBZsM~Lv?XNK0Z#@REd+kzWAL7<Cn622#
zqEObOS-l9!*Hlphgilv3-y$y6A{KEU=hGss?8pm0;UH@TCluq@YWvl`5c=Q<ySp`R
zYS~>K;029dK9^@D=6S@lG*@MD4_CHANAlFvV+GQ=zWULmn-|0_$P>m$)0WHx-=HF3
zofgNL(#*cjw5hf<8{e2$pX};sO4YX=C5F7OOi}htVtXX`o@Q|VQAI_22<aET^k<6x
zL$NI29;IHPDF4?+I@4w=cWo(hm`18|W2(Ito~pBrQGGSWYi&&^jo<~vuEMV)Mv%gq
z9@>K=HKH^UQlfgChg-_SUw`Wj@@j^z{vMI~_?k)V{V;Bh+}OZ3t6i==HUnhMRA@b>
z$82kxQP+4dPpYow;kvM6rY_85VO7t#RqgkxS{xelM?^xkHAlUwIIHLlj&LPRXd51*
zYw}W6B((L9h_V?gsac%;UJ7&>n7fA444Vu2`{|iXU-tpi%4Hr_<500bd4#!ghZlb|
zTxzaLHT|DbUsIuIn|lxF1L3f}=v_&^l3Dq#TghH{gGhK|C1Y__$#IqC)gvV|+$|H0
z(7S&|lqgCU8P5L<eeh>QNgnf=%KnH9{rD$ayZscUlzNvkKK5>?nDa1_avpwa>}x2=
zKxx7&Xabexi2@z^$9)tdNu`DxUC!&Es!S@YKl5aT%{qH+XE@v<FCq5b1mE*0-O<~m
zbnikmxb|UB>()Mj8vO+vZAp=l6p?9aOg%@{#m`Wa6z&BuaL=n>RI>{_PIRK@1}6;9
z)l6(1-?MPTn=vKlb<_05FPe~GUyn7JB;cI2H~)C4F~P?>2hN|EF?PZ%yGA0Q4Iu52
z)u;%RS7ZYL<Wi#^3qNlUNs8j`AvHM`Q8Ty-Z&*7$f6js@bwxXU7Rp+6*cJPq%v$;!
zrey6zjddh!bCuz0=7<(p#y`y-S7dh;T21RsnrUBT50lo`OFOMLM?PfI#=^~eh&9Cy
z9Xp2Jt)6+)gu@P$*)wfllmQoQx?x=cpX$VHWYMPf^iT~v&l>F%sX%}ot{VN-LF}vg
z+B3t{comq;!m_=@#YiCUlX5fY$YU*4s4Llwyc&3mzV?`gU=7KMa~!_*y$MKyJ4KH*
zgs=T5Vh4bI(9<?<p1C|U_Lp)Kr5L|cNV~W-egl5dq__sbm=9g#(J1Za9@E^x=aSU&
zybbPd?y(9=8)i1fM&QG1lA9{?nz!d)+q>$J4m>e4UjVR#uqIYiDXk+}BDrdz+f&DM
zy_sjO>~=T$X})Fp_t=YM8*-+9S2NSe6F9b*<k0xPSxBw+hV`-CB)QtDkGpDcsc(;a
zbbbue>1NomlpId#2TO=xWj3R4uKa>F2WZkoQq5z>zlS5OHoqdN^T2UME?aiZbRZ3H
z*mozhR?T~W_6YvYI09n;_6~e^rV>~IEKx)S{s4|>SF6oGwp?`Gr?3{0xWATF;!gGv
z{(1$kj5`(Vnp9Zxtih{fFmMZnZTU;wSqnTiHJY0H6>9k`yOxpb+H|B-K;C~Pj^XMm
zBfhcBm~H+Ee?eqzH`h%69T7TkJfflwfNO&IyRM>%rRM9Z1oz?j+Ld0`gQ03C(D}9d
z6&G!(K|e!#zGhV42cPF#2lHU=xMtMjcOa(^et<0$zZOn_?*klwT5SQ7L(6JC3uKeS
zI@Yd*O|SJf`(!&~k=4#7#J&f<W^Z?A8TI7Bqio}jtp}5TP`llhFAZ7Wrb=n4jAsh$
zL^|(ytqqzn{Oxd8S&nChE}w{~68tt7S`W(4nTj8Or7@Sgm?v!o7qHz^hx2s3WfRh8
z>Ul@%kVOCcjNRjNsrm}-(Zj^!QbvEXyDF8FS<%56H2cazyvc^DUkNhAhPnh{r3MrI
zi*SMpeq&sAOl65qJ+z9cuNI#>wddh)U12vB%nOPBm5j_2t-wsZ0OA`=Hn-sf+*Sg+
z{6=v!Tb%5$%p`RpIduFVPUc@ZL>?=|6LlmLW=L}tJzQPI=)Qp`;9gBHt`<C*Zx#4e
zSD8SfU(a$*{7zkE0yKWXsE7F3W)L`{27<4)9$78eOZ`=W%8Gm!j=%^fQxFMDffMFI
zK7*K75lYM-%cW;zwsPflVh>#LkVk9`Yan42bXE?jf#~4%>(|I|h8>oq#Noo%^6khB
zE!WGGNc3aHoRb^GAvf>Z3*V*kra*1xg@p*WOcTrbCs<8c8%Z7s426iVZ9%?Ww32LR
znRbb0jrGr5RID8q`L;PgNEF+lV(pTMy$`&{6BAu4S%zC}{$Z2P*RC?D8-R6u=&C3q
zrS&|uK(3$?XnAXFjhrhj#b&d5&hJX`>_mHWF-ZJcmxR8mh9ih}KEvd;Pl4U2bpABT
zA5wFbGn-WAtJ{7c-ja5FOlDictaeVy1zafUUjWYNEY?*-w;+bkYZb-T$_Ab+FOOdX
zu<InGu4`i4^gAS9B{w#Lmszl*qV<TLLJzx~%Rts`uIJNshRMeQ7@{N9WyWmCPgBWB
zUdh)~@+l2^OoLmL6&DhT$`yuk=>>A1_Hr|53*9;!#k-ngdSpzZpSR1Li*-<^+4#vB
zF@WB)Ei;Dp&VHE~U6-LH#_ZP!FjO;cM>MnFfy5-p(TaS|blbDvBc~HHP(}wiP@&?G
z*hpSI@<LeP4D>mpyUD6c*2k7}mh+u<D3fI7-3*>A*&);^V<Ld7WQRHsm<3Ez<N*RK
z`!W_Q(uV-rkddbdy_vBO;PV1@Xsnv>Bk-+wc!i3vMQ8GrHHB3Cr;PK8pm(*K0U3%g
zgV#o5Yp-G4h1M!%C$V3EpB4Fnz;WO&Bp14pZ`+G$wpF%LqO*aWqEkJQTy6^amw<CY
z#fn>Y9YIm#Se7S+b}l2fPC1|q-Dfiwv`L~QzJ7n-v!;V0b&tI5iwtWvujUy)G=wIW
zWdNSOU7XOcI(Q{@(iOpDtb^^Y(+ZNlwiG-G$@yl*i>Co)4sj~0hnHm@jCeWG%JExX
z&eu{fFDKUIz?~uY&rLb;CMVs^IgRsMSSHEjG&VUw=d|%iJaVaOmj7m_?7j^~1?Te7
zYey?VtLz<#&Iu|!qfOnppU|Ry0K1g-+${u{xa&Nt$SMLefvFOzHs0qRB(@BAN0HwM
zd~Dgh>wG}Zv-x3_y&thHR~9SVIzItFXiU%J+k62T4q9@0AKBbPVAuH@IA)r$#cQDX
z%Eve(Nb_wQ+y6D)mII$fLqDF4Nb2ur&q6{v!*l2Xd<#<|2UG23*tf~KIaOm@V^96T
zNS>QYG5I<^%$3q;*Bp`VcT-w{JN(b&h8{i_Q6<V@yyh+fXMbqQxrkap{0__m__8ba
zr`zF$k$K__{gu7)Z3|6xf4O18S;A84td3uBZ<JjJD^};6j6rTaRMIbFQ1;P8C$Ahx
zA0hADEX%G-a$T&yoqHz%biA$}#+Q8*sReT%A&N5A)v_RW5Xsq;l)Q6sgzGj0>MH`<
zbz1=~6q!tbkzBW{BC`oFc<T;9WH$4YYr>ylI#j|T%W1_rt3Q`wW58I-8cA8ll}ts!
z-y|xdWp*=Hyp*yoTK3!82qMRfpV=E>49Q+BLyfbyQQHK72iNxO&j?Hhrnthgu3>NT
z^-D#G&I?s7=UgjKSash4Z=p4gd1dxN2+rbT0QT%}Nn8!!B-pc$5ZDUv@lAX7DFRF|
zb@}LuJsX=-_bBiOvYuCk8kT83ExRhwnZb7Bg`W}cJT$&8T3VNL7WTaEmYoT1CcDD+
zyiNoVa3*ga+4Gtc=mxNQ3EJ~A2_fptC)6jasA}E_VlMz{-#j!j^G)D2MP4PqXv*B6
z$Xo*70beMx#Iozf06s<55oiHuc+LBe0F2e^L;dsiQ^!8bIj_UL^A1>cqk7Mf^|WFP
zt$Ikc-Z=b>>y_L=ao#+428BW4?s!~p;0~Yjb3#KdvNNa-XY`z3tKKR^#38xfEj)U{
zsZs!qScI~I2SW&ur*~!lo9O!l&-{WO|EyR<{nG&4bbG~X1l|P}NHG7!sIOR6(JgxY
zto(ZY2CbyT4%!GaMK^=JF<cZYQtu-gwqg~5F9F)lDCGkoF3T7C-e4IuQ_c~$Z5Jlq
zoFle*3atE#Udgu#^Y4;|N?^>NvMLuoD9kci-Ora}#)0+$TwCHwLmJ;tX2W>8*Y`4x
z7KIL6if9nLI^iaRaNj~#UQ=f?P4AJ5S@u|>|3e(O%bc{ar!J&fC}q80C8A?Ab}Eg%
zy(nNK<=J&jDJF<=MH2mk<RAP>soAZ`zYWl*0?QSl)a-kRDYbc^8nK>)nC5TqO2e+g
znrzy|?P}OC)0hBqSP&Chb(vMm)NRm+ho81(sQp83%+!C~MkQ{3gbMw6yB<1DWv09R
zZD7747YM8cr0~=H1ik?duvWarI9~8P*0e|~%YL2Vd+B~tbF_4Dnwh<dboO$x&Ccww
zB$H*P$s&xaSv)tnG{Iw6gjjv5372w}=8+idrLoVXwJm*U7n$ms^h-N#!kh1<naS0|
z+u|-2E?v+yYQ}EwEwtO((Bc!~MfP*Pzcxf8c1c#qClR6s_lW9>*iW-7kX&1JVLsi)
zVf!L}P|i)Mk;Ve@sYI(B(zwiN1AAIYgmnox#j6o^<Uo&>nX6n{!=;rrcd)s&ur(I0
zg>x6w68ZAKYZ;zx3KXg2al0$b?Lc7{sUfMlG+c#T_!pe=P!bI;S2xkmICBcxNS*4!
z-a^bbm#o<J6EQi9806(}YOlz<Togqrs#m|JtiYoGz(}s9ta2R_?Pcg^K{fPqQ9BUs
z0Q8c5IX(4TbU(2UKwCw66F^1lKST?IkqcdpuRJaGu$%}IEmh<57_IZDc$#vUu3Z~8
zp3e+N(mPk)_Sz%V9~hlUq;0u@iltJ{QTJQ1SG3Dvd~}h=fP3GH4cd_m2KoO5S}A+g
zxX$1+h2A<MEXo*>D<4K-KE(ixDnzmLs>Grs5R;HFC)n*p45a#WZT)^qV1;T%9ThzU
z6=~9aZOz9V3oOe%l?+0`SXUGUqr(W?txfV=ciXAJlY^G`1qJT%zCh0@oGAZhgd>vA
zOi+odBi&7@g3raTQ7El|!=KB#YE;^-Bk1cYH(IOpsj59(bGmsH&_9(mj7(T#ZCqS!
zQIY#bm9$I#jDD^7(p!ro=BT~yW0kA*Jpx_#YZOHtG8dF;W8unI`F1IqYAqJ2YeUhK
zE5GBv)PD&H$y>j2n!pZV19B^fb`4NL5(!5D-nX!?T(?tQLJ2*@fPSrJaYgVqoNGF8
zaOFCf1;AyG9+xxN4fK>qRW&FDlt>eCdPkHS+-kMA8>F)v%O|Gn1csFP<r!pLL=l{V
zYe}q+m&^jO9#9u8NZ>sp^MxrV3JV|wOW=+WJ!84na8^uYV*7+it{|>;_5|_3Q3)bp
zF0an)(@;!E)#Dm6X<+zK4G#w`3yWhF*}a8OrC$ZJ21nM6QU-_bt<rO6y%U)hEc-_4
zu*V;HwEy5?HTz{}KT`9l+iTXY*|&D@K94?L|MotX3eSE(pwNgPU9hb3|Bt)xkE^oE
z_I{q{Z18L$JqXHC4tkVhprRt8qN1XbqETX^qES*(qEb;(GRAo5LPbS|>9na(nPTQL
zH=1aMii&PjOxeVg6_qo?6csa3QN!HVcdmDancnYO`*{x7%zZ!i^LhV!pThln?X}ll
zd+oK?{&9>jT4i`%hvJm6YRGIdP9gYS1^(^;3FlTKcPP_uk!b}w`Nz4{-^~PJ;eh%h
z<r)|=uW#<cr1sB2MY)h^<-ZJ>&4uS+JNa)i#Uj(HCx*-$hMH%5H<S5=#yn~cgy?&J
z2*zU{6<qh;9Yf}Ae&AeSn5#2QH%<&a^`;bId#{I-5EOdf#0WI-ATwq$%r$tw7A4zF
z6JYlK)ii<4KB04-=Fr~1nNYlpdwr&b;=4YCX87L6mE%#xT=IT&+a!3?E`q<Os+ywL
zkoRA1r|1h!LC_yCu_tQu+^y?+(Zpd5qvt1MQTlziWqt*Z@ip?zov$9l+3oa0mWksg
zh{FQi95;@7+_XH@5p_=E%m#Y%#`0k1Ffg^HZ^qvx%Ik73p752mYu7=;ib4J6IAA>g
zD^=)n2c{l3InKBprV^v4-U$f<FnS(Uk0MWS4gBxNk0vD;Asi!R_3wlxWwa)x(4-Wa
zltPnIXi^GIN})-qbDrkV-oFV=N})*!>>N^(_oIt7E#Y@aNnV?jLX%QxQtG;16q=MV
z=aEt}DeHuLMKDClSfU2R@6Eq6!}wAEM?gw$9Au6mQpaC!0EqDj=y(`^H;pecrrBXE
z6VhLsOqo!m29d`6znft(V<QlS6<9iSpY%QoU=~}771+`V6o7`a^vWRq*@*Wh=KmcW
zB(N!Ih+_KZ06J5ko~0<e^aBdq1$`ZA{jwAa9D@fM^0M0~aMCcBM<MVv1^x|zqxhru
zf5g-9{1ktWQlJx_Z}9ge1+Z|UP4eZzZz=RXLJ(;g6R7IGNc{5^TGEP!WWb`ojADlj
zu)p{lUf@`csK-zWKW}bkEX3bj3Sjw>u?2sZPylVr0QY6=r@)2q0L6@lD3A)zi}-t*
z0+{C0GCo4+Hx$|k&;Q2X*DyyJ;qgOeRkDr1^FSbc21SQ$M|6ui9FG0qT$ny)BPHw<
z{X@botPgS}0e_PzFbK~j_*+kbbMWlP-);oLp>eK&yk3F(%tp8ep2zU_2sJPacX3k+
z0r)5tx*pN6O09tCGr};fulNFgpHTn{wBSlKd8I|62jE$Yzois70nd&2+d~2L#!7I^
z${$eR8F-$<-&2MM_0C64)rbyHLDU)iQ7?xthv!rL^#Pgib;xoIRG&sE7b6z4+)C=c
z@a=|KxM~_?9|WKgz8fBl?^PF30ISJWKyOtA1#X3>4S)Yefji*=wO5^?0C;58-|=^r
zk!eItSXLV0gCMzq!%;@hu=<ZN?iV+`E~Y>lKqf%!g>8qpe%~uD<QVctkMfTj<(DJ=
zp8p)>{}1(dw>us{Q%8Wls)1gN78|!~pd<cqV#F^;`~Vt?@A(h4PrBn*ct!3gyhi-v
zM#ak!KR|@?0L0fGw>Nw~RsXt*h;k>aY1C*nj6!R~KTeGJ<%l0JL-BxF8s+w>-DBPH
z5Uqlq$^;o9dLUZukT6J+KB`WPb<Yld{aw*|XEjKU1zy(B|0kmL!5wB8eqRSdbjZ|=
zW6`<;GnFk`GcPjC%thmGaYSq8PZ0jm<b#G8=7!89>6`fr{JjK`DRux#9U_gCx6QDz
zEN#K>nHVIQUm|l*9Kf`cjK3KqZZY~-SK_Z2%$)+Oi6N@#A1qD{@i34QKf()O5Q1xH
z9u=+dKtQiaqreOBJd8gYQsOnkTssSY&`<D`5IjG_A5MT7q8FZ5@%J(XK8JN@?Yju!
zK?y?ur?r2=-&YiXl9`1CP!=>vBWw)VB5VR$(uszUw8fIg2#aN56c{pVNCqOwdLAWd
zeV(-(e=KMg!2^?C)>=wg4bSEH+fD&Uy{u9r&CDvH&<=#|!XM2QVb{R(B>wOd%|;l+
zR8|-M{+((I&l)oC@~X-U+!KR$HKW!{)H*=ORI%j!5@h=;B;#f(`A3xc41b?c;IHtY
zaamC7jPNmr2~Ee$qIo4e8Uc{>q8JK5TwR3K-$k=1FbAFu_+ycUh2lk5;xC^os)Jo;
z0i=zKoBRXBe;<FhqEy%q;eiyp=ynP`0T1TEi|Qx<xq8u0@b@DMfI}|AY<Cd@Ko?!~
z8~l-Y4f`ED!2O~xSn6#vj0Ju~lQ><6d0<^61+GTVtxG^?8YZ0Z>yRe}owkmWZbIy0
z{H0RhFgy^->$nMb!-E-b-Cjz05FSYWb&V8&(PJIN`?|L%@KeKFk7;w=Fa@4Rz>hyK
zBl9{c+5vKpi6$9g;G`kR;JESMmBEL#T>5{M!Ctk>;|>d+Cy2k)kVAqM(tX7LKN7@t
ze%G#D*BQ2-=8f<y4LKxl0h#@?S>FGT1$4a0vN;K&J|t!VYQ+CP7RyWjdx<=iB=WPb
zN4ZN}v(pUMxMdN`BbG*Nh+Z{011cUY91CEWNSkLmDT$N)5qS3Kiiz%}A`6y~PyvgS
zNkDJ|LKs1yh+D87PB}QjFb>*q5KNrBA=(7!a`nk%48iY><%$kvo8LG81&<$a+N~2!
zCtC$2;D>^26dB&C$yCMRX#5<4u7cnN2~ZTWR+?iS?4~1ln;9@7B34GYuzdIz{L<cn
z=&ewJt4xAxMyu<mxNlf69ej9?iN&mY+4Q#z&|$jV5Pd<!e#p~WbGoqs;P1r&38&48
zlb;<I=f2++3|l%qhA3tjFPo!j=tIF*5VJm-@tf`=d|x$z@bpTtZ2AhWfspPpW6g*#
zWCH0a{0j|+bAXb*=~zv^HUfJ3B*bAs^tw6G0D%%w;*?VjkQRjK8xEp2t?|^iN}1-4
zS@$LqR!v45rpHsa5P_rcFk7bg5b*Cd<3Sk;=TDE@5w;x-_?3;z6y%=nCS*XRx76L!
z+*5*>h(K*0c>c5*58q{G`<k$=vH1}@BB<y)P8Xo0NqzFJ2?hXhEo$iKnyJz6eFp^B
z-ow~tOul{`VSL<NPPM-eU^B->N6c}JiyOB!Hp=v%D?e~L7{dKSb38hmy7~<J4CB}8
zQonmr`fqga+6-A^Mx+DH-=arc<08Tk9O0wh^Kw4>Q@{HU;S*u~K=lUcU1XG}&)uL}
z6WtgmcrmG24J5iR3*K8|7!j32W<6<_X+!2iez=)%3*mMTnGe$>=Z2eR7&3Xte2n4|
zeykWS%p{MYJiDcEvk`8Gn}t8;BQ#v!{>(-LCJIbl*-j!IC(s!_bTa%n7a4Rw=hEpo
z$3Y(%CV+jGPU3$lT^Q4y^yWfLPv!rRzRpR%0i=jZa?<nQ(E#>48E*3<t^j||$LUsn
zD7^ww)9oa}<#dU+I_M+qN!8AB&yY7>bKTAJZ@S^S1J6D&%l*lrXMfP-?i??#zTt+l
zU02<-=fJahZSHSoi_*QjQ=iTG*!>Idvy;xbZ^z-JZ{5Y}jc?uQ>WOdN@juumePL5g
zBXa5wo|LgaxKF0zZ;Z=KU-9&5d4qdJevFlJ5(IGL2PyMo!g1^7mBU!jakwnfS}@`d
zkE-D`;Aomg_>eKDM^#8UIfw&~;Ze0Z%>tY`(1A*95N@}Lg(E|AM}|jLYv`0KIp+LQ
z$<QTGijx9J(pe1-Cs7jB3c?MUkp%+R{r8FDHq+cHx>U?qIl(MYiDTs|Gobd2m9Lo@
z&(4dGels>h;1^Y3{e0y^;R~3>B2dU7bxow)Z<eZeBIPV=e6<>mlyk|QbAeoEjjvS)
zE|AkN&J%{f0UZ&EA1`wE%}OvenapwiNQvh`E2rQsNl*s}n&bL%Mnw_M=D6V$b2qo#
z9G|T|zCcd2#vfCEzCg|ijz1=Fcz(A?&$Oydk(uM<iz+OHmj_2wX@PmIE*({x!#KZc
zr&Q*c*TBn^h^iBKhPFt=WY`2Zqv|ruBEupKBD>Bbu!*-skxSqO`XSSkRB47c8fIb<
z^d=3<gGoD+YuYX{^N};0MyV$^pW}8oReB24$K&KA(EHEh<gB2lI)M79gH3pCL<I%M
zpG$FSAnr0fMv@cebcBh!LVj?e<9G5!*yS`<&>uAz8zG{6w0VL5JYF#`2&kvVgV<Y7
zsZ-<SiYYJ~rJH#ot4Wx!)({8b1M_YZYMMtb3~uWvpaDQsH_rE8KBmgZ3}jvyO1vB`
zb@BlieFUge7%Aap#vR6tlOkoi-EGG9w6qXh@}sF-c6-{w@G65@hr&T*TsWqBbVZ05
z50-8C^D&F6uQGh0qUV7eL1B9qDCeNyP5=tJs;&ZaJ7Gy^ZtoI!MR>0WTrL6p>8|hv
z40bx2y}j#lBI(ne$jQM1B9&e2jJh#OP7H28vz~?^KAVKL5HPPOCKklV+Jt}FBDx~b
zYS9%j7-?=1$6{M!;k3p+8;iteW7}h02ZAR>du*i_Qh_QnuP*chE;GpW-XfsOtVCXi
zz~+_N!hnWUBBJxS6k|bhpkP4Y6(op&CbMk{oPjCzad3_$bS9WvZ9w@x2j(u}wa8S(
zvdi2BzHp1N*~UrX_QLg?G+cxaav>B+6n8$<RG5nFNf>BJ&DOXoW7CCW$A3Ge%9xRH
z;YrbK4I<8E$GJFe(5iK*?g`T8>K)srBBJH&U}2HKW6jryNUwRF@FoLRa*IV|Z)g|8
zvS+OJI(4Et9^i!#V1DHFCtrZ9&!?c*QUl;Lk(>@N>6u8%?9pI4MAO(|4W`2eLzqK~
zrJ&kiN{7zYDr(2}>ugvC>(8!>Fr?m#^nzQ3H_1vpDUw<&YvD=85UwU_VPs@D&geYj
zCxOUlUR46-qPSMj^X!;zx9tZ_=>s17uPOy}CrhN?yg>|&IpsEQa57N3A3~91NpR{9
zMY$y71y(_NjT=sf8-;0-(e<Nnp@^t<pQQ5YM2wsg99^sk(PzhiSi@AhNYuEG5s)T#
zGlg2*9U+h;%R&>)HRYHBsAdre%e)igPy~{~R<kE5O~;J1aCCjwh@l|04x5L>R9Drd
zI0UhU?NxQc@X9-I`VJ(6-0&u#f6dlRooxmYnm)AtYQHc%<`qQM3*hv6YbKjlu*~Kh
z=Vc>QiTdOQyWMpXgRf3DOA0s3fw2fSM|4~Ohr!Sgqz|=R+eo$Kqq|M~+dIAn0jCeZ
zi^#F35aXQqA|~5?*f?bPFdvHIiV=TBuZ2}J5>AR<tJ0MiO3{^YEnt%@vp^IKoA|fR
z)8WB1a`7bTi@BClc8UW0e8NsqV|7^OmFm_>GCp{v7_v?a*I~$w)8ec!uSB^f4>C1*
z+B~j9h;Ab|I~`Wob4nPM_`wZPX&tlZP>Ri>yTRSLAg}d&49TZz;zjcRW4dQlx+kb5
z0SK_Wnnn_sCZazAoM(3=gQc<iL>WWXUI*yjOk$wg7$_00TGVB;>+T*57oz2{i1r9Q
zGiV}FHAwTLhmJ+mN5Ba-Ml_Mz64450gp|Acsl(8{5yvRGA)=9zZTLloFtVxBYa?1n
z9&<6k=6Fz$qRlHqu^#XuVyhz>DAv*fvIsqrEXMBlU_^J0?H((}!gpRG5%AGJ>r~tC
zObSI6gk6bf9osRMXf+BX6DW^CYA=r<Ah)+gReCYg>}?l#l6$MDH*pdgV%)?4+S@+t
zCZ%Bh0M#%$;ytv&3=LQqCJY+N#pU>?{Ft5_&JY;NM&<f?+-4p;*QXib-!pE(*mKBm
zT^SKRKPXbbgZZIYhyb5?xk#?YFS;;&dAwZ5(c49GuDM<0?sAo#0}?1h?Lg0@1OF15
zni!1z4-aW%*ykpC?-X9*rW95Lv*F7wM_hRgj)(3RZC1Ypr{BUa=ay(0vUk`s!dn1E
zfMSG^p(8~}h3#p!hFQ=*Q3iz2(EWLl;_yRYV|yIzLo<bSh*|OwSdt_(VC~277FJb^
z2!d6sMux?HaQ$cw=C<hWEQutce;4aABCra&MRv9m%-(PAwW*~$$1n-ua{%T#0x2zg
zXkNXEeb?RMoO#Yf`_GxfrmNP(fF3q6{7WE3df{+|C|lBivWOJ{I@99<REkW2P~w5?
zg={A2X+7_yrjDeN%99CXh;gU{CRE}OZyG>{kIHA0FA&8#FsSDeEcZ%^)buzxX^LMM
z<FV!#pCj-lnxh^-ue#B%Hpj`yo)nM9m1$$#n5hoMNuQaiRGge<jqOwIaq>cP`{LwO
zxDWbdq8X!-eA1T)e&{p7M*}7}j}$g^TSQ%cXt;9+MRlwFKCD*YqU<VbLaqAHCs$H9
zHeSx#KLJB75)CUYBRoj|pHRrFCYRmAJG!9X(^U)%t2}Ya><rT_vDtPfnp<w}5amI$
zSffyYVHhI+P6&y10VE-WRcpMAw{}*mx8voCY4|bEJkjf_B>kFrjQ;coa_?+VbEe8!
zv+%1qH)FE1x^gkub-4yc1)bc)g*(&K_ovDWgU7^_gGOrLpfMv2|FFlmFo5!}Qu!7j
z@qbBo2I9^%VH^_|95lvS`BO)iJwM7A<BS2KP_cW#$>VCqG#O_KwQ`!A5xlrx7-gVa
z*)g<G91{(K=?1qW3=th+gPM?HFswl$qCxgZoufzgQbez;AFCtk$M(h9dM&jY4JP2X
zf<<pVWg*Mnlj0OH{a)~XUmQmmdf_!Xcd?zj*v?(-<SusDaun!2cIG{H<~>g4Jtx&y
z4VGW!`(;8fNf>n|rjcsvlm+LM)n|zVm6+iBtR@%DG6KsdOhTfMoYP_F!r;_|H;;kS
zKBj}5jxpV1T(#Co(dce+v*(n%8;gI@?fzJY>*O&~NRG)TC8zhuGZa1}2ZB1HW^CP9
zPHBj2#e4}^t&v^hk)>yRbrhWHsQM_5u8-=Wa8J}(9Uh847tIO16F;BGo|Z{1wDM@d
zl0!G7!Q1ZDzO&we$+mAwT^voCc-@L+Gm|X`v;a$Q7iV1Oh~JyThN9pMMW2m^(>t*t
zju#X<FT{@z)eM`M9rWakKF#SM`CcrBC)Z5DShC00CC5m8$P+c*Chy4F=8}5MvSx6v
zsP;B`Ln0GEbV3Q@YrGiMHQqX}RThK!*Jhkcz^iEhmyv~ka>_JBO4PFXl2f$W+bseq
zR+*R93A-Vj>7QK)Ba;KAo2oClMx?=jAhIsUct?4BgaM~*p`<MWn@!q`W9GM`Mm;6L
zOVCgN|D(jE>9iEg6TV{nQ*U-c&JZkol$h~g0<?07Uk@fntnaW;GjS--UZ`DKG=_e=
z&;|tEgM_pvh6NC0*`@t4<~G`Gurm-CG1i2N<1NxI0b?JkqXG;Mxw&r4J4wJP{fv4j
zLB?8_4y&IfK!(EoUkNg>a8n<+pKwLNP5reP2~-c2+~f>?MCz{O=-g7ZF(9V}b4!5-
zQP`6NB4uQwpuKRTlq9qfanwRxs*)HZkJfIX#cghl)|3J%BeFJkbUvQMcX&`gQ5_$5
z5K!CU5o#bHXKbOg5W>0bM7liT&SH_{h&GNUMBUVT+|b;POs7wC&jeiZ+mL#iJFKpl
zDZO~}%~%gv)MB>bPJ~x<S!W=coW^WMY7@zf78B7S=HCpV8x3h$UWtQjj4o)pxhB@!
zOKuwu{ps2_XH(yD<2E-6tBlN{$Z?rB**ZYQ;J+9Fr~fbWgPV2s%kry3opo6Osv(r9
zDEX<6$X_Sm)iV)Db=ja=b)ocGaId&f`mM``RPaI>8@B~~Rs>>|qGTT0qdyebQlg%^
zP)<wSf?g~HBbHP+$mVr&=TRp(9g)|i{_{dPJ(zcj`jAZ-c}+eB2vp#uLBcJ{YxaUD
zoMX#yj*|mk%ApHplkFvp+K`vMaHL=vjSg;FUM<WP=GjnZ<$<@`X$n><QBJb*hSiga
zavr%KCxX?tma21!n60-Ksn{er-Sn!ZaDtwI)1d8nxu}sow0nELFczZAGjc}DB8o+C
ziI`-FAWE}4ZhKEDirVVM_8wtOBQ}{<%G`h!Y(Ilhu3NsnH<sCfV$UX-UK>JwL8e_f
zSD#;~{*(m9ySNdsz(mt*CbqGoXg9E9-rgHh+;#3^o!g!R(H0%OM@R3W+^GEG_5d+G
zEd|J{8}5Mj3S&NMov&(UK~f>amDQMfB0euyv6#>CqpIW5d+d0s4=h4xKvd<J+eBUw
z1egOO6YDb!o!mkmfjS@JG9fS!$27xE%Eh@5f;O_nk$Q}9-i>GVAd3#@L2iTHcvd|%
zTTWcBlZyo>k6@^y_vmOQhz550p94G1z$S0x<bMQqT75iQPPR7ms=v&Z0doCwpeAqV
zB_e`6XNhbhl_NcOj*P`cG@~Aa4JJDruLSuukv0kyMCoL~sar&&*-bKyyKG|&QNa@E
zvW+lHLdj%rlX`iM^qOw<n>liQp<5VRz!_V5NEaJnjrAN~Y{!paqvQA3@guZYkIuqk
zWSgk98pB5VYkiKoEm=<T<_KJFhZZnw)`hX6&IH`xQ%@#Cx~xB=ew8c}C*&AZQqQB{
z03*Lxh0m1%GfB;vE2mrOz3S4rGA<BF6Zkff1`*2*HI^n}eM4Qz9}3PMRQFN|xUF-g
zZ(5*$*QGGg&PmGFS_s+ikR6%lB&o0FLY2!PAjIItoP6jnK!m&nycD3Uly^3o*=U-Z
z(F@JwG@GqhfuU=3Du_m#LLvr@rL6`4m|d9<fg19XWVd6BsHv94VC#jU?wu#&HqU}~
zqD_fOkQ?dgcDqpZtO{CX?-Twc&AL3LQQ=wHG?k)Oj}JxsX(3V|Ew@ko7r?H_?MotS
zhF-}cmZsCaFjR`WjA;}Nl#s=ilt%7wB<2kI0Agmj+B_dheYv`BzMKi?sCJ&4Fa1d~
zA-hCmt>I3gbwZ288bhp&A+P(G2~)ijugnw~4G}sqMb0OkIU5bh&eshgnQh#jBqHv{
zdWDLvz@bLkLivYCCf)7r)9i`MxV?R3n+^W(s7^e5XE*2eu4rZt-3IVqB&v+0VISm0
zD8SDwbZZlm_M`PKtp1GEeV*{BUWUYbXsd^C^-^!It)~6DGozBQUuP$+5l9*sNm}FP
zq%Z(n6Jvx&_3I?`d62gN??6ZMvbYT5tgK?BPeF1@E2bVTF2kLalzE{&595v=u!Ux!
zJH6CEn%Rsyy^$_AY|2gmE#WS`GvKx|ZF<}p7=!G@G(oB%7t=G<P+0Qa8VWa|28MJ;
z;U+itYIuTM1H7X!*Ci`$i2p2^%HqS&LM7EH!ocJuVxeS*nrIj*GZnv8m7+GJ%4u-+
zrpoxu)iomg_L03EqdJ?60<=$MRF?@?Ep01spd3Ge!<%$Qbu|xqj;+C_I@QY`YQ8g5
zeV8iez=+^l2x~#6nzK;)yqP$=jX?lim_K{?Bk!(-GBuc==d}CI{Boz=ks*kugs~eN
z2jw-Ud7Vw&{L)d`NLbtn8~7fSAaAb-J784PFF4ylZUncehRiX#JvD;41cmdB8jk>I
zmO3>t6s_5PFx2CBq{KNren$#=99^sXDFwW3cTmQ7WPvzxBumwRDo&IBZ3fX7`z{V0
zQLm$U8dZK+!_ZF|r)cKE=pfTOV!N1J%t=)(G?jqx&gTM^t18q-X>wj#p}_eVh?8m)
z#DPerE~zRO)FtdiM`B|YSn2<C$;?GE)vQnl7RmHrRihg_CP=1&jb!|%ZCInKc?3oa
zi($@iN;jRUQ*|oT^r{{YlSJd&Lv-LQO9C(_+G2M}ppP*`3b0sGKuT<p2o|-Nsl@1G
zS!QLj5R&ZA4os(n2oB&ae+oo$V7k_ej3t#&s&{LWtx4u10ZcylY1^OV5k5U2eo@Ps
z|31tf1JXKDAO_@+wC+<sSu7*0U(~8+7RzaCUuz)Yyj^&YjUjs-x8b#vE*Jz@yEOpB
zqTj0}TD;aa93H;?sL01_m5vz|_fV8~iJS*3%=#r5VIH+-iOfjyR$Ad(kBV*lt|d4B
zjdq$xw~B&t)|>1&_2v>e!+N7#{c(xBZYJePz$O^-*z?&Nr%3s8OjV#Fvfh?1*9Ix8
z$H~fk`O6rewb&*T{M4<4G`#NHy&z%`hX6R{jk7VX1CU?brZ>)MdmwVY!SfKa#V_4-
zdx;6jh$euPJR26f4wOMqwx_!^?*a%u;FZuMpgv-WpNm;B_ZSp?!~<wTOC1a|POgAZ
zw=R`4%t&=&sa%YM4eu|Nv*3KIomtCd(%hFZ_G1AgHVdLU3rf7m!NoROumaqxF|9B-
z+q%5*YL+^@O!`w^ZAGGWARyd4lag?FwKdY&1%I_224luRqdKEby|qlnO_(u^1u4co
zlmc$TjAr#$#P6MPs*AJ?=BpXae(P>q94Az|9WjxRPtZ9Bd3S5%$ZJzQp@^&`Om6Z*
z`Cwuc$8ZL&ZhDsrE|=3Uojxp#O0qB4n%D@~t=VpRSGO6ect(lGs`6{;Grh3LRaIzr
z9s-P!ZX9~y(PZ__a!@o`c{Ai}>(O?Vl_3+;G5rulvv-kH;SYHq>!8@ZqKB8u;*9l~
zW5uQ%$j~IzV;M35^8ED-s3Jw`YrxuDf*o$8gTzgh3*jX#*LbwqV1>u_+Z@hN9x0+l
z***~iqUMP%v)7h-b|sHs{Lz{%pqJ1TtBajd-(Ml)78@jlx$CDVM@HUl9J3bA+@w#m
zaLv<`4eM@QO8*PQf0U!%S|R6~IqL5#<fPaiRSW#)3g*PKtjTNmKWb8QR$|-kM_s!9
zG{_absc-zKJ(4#S(JpxPeiB3qtn$W>OG#S5Dv#B;?vEcAMM8__0SK?i%nYyuBKob(
zum{a~t3!_VfbJfO&Y(2_EZ@k!226})xA4}UPa%qrME*#Q53L!D_5EtWDjXnzyUTVt
zoL{fw;c~nk&bzG5?uhh}p^IuMn!!^vpfk@RlBufo<;FhRDcUE}yUF-V`kWK5K3)Y~
z)vNxx3PvU$wlnoI+W29a5M#w@n@tg-tNY9}KdgpXK)mCmRJ-XFHLmlAJ+zS@@{c`1
zQWsw)sv~wox*hlTcRCU84BG}USQ@Zfl!i4z9@Yr$4*fKiI(@H5<9M_Xs{me(pz#g$
z>a9$yTpAkGpEBjNE34j|!PAY6UPCV->ofx)T))K!WEuv+7@=k$M9rX&fM$YUfsmWj
zUwaFNqt*4R<rGlsuGP?zyy~gd(hmjy-PJM!&iFNQ#<U8Q46BV@6`<1|VYQRsVW<o@
zt4-x1lLfbIjZ6+^oyHUpj@1B;cZsyMwomh7R&P?c>yJZgPuT<=71jWO&{_!E0Pv()
zI#2YOgAUy|hn*oAoR?eyNnF9nn*Dfwbs1R!HDj$@h_h_l)=GbDc2PJEpwU?~nt<s8
zj6AFj*UBUd?z6W0$yzxZGeBgPoMQP0R8p3VFYyl$F4zK_V;zYUb7*Lca5^Q<!CIZ8
zLyKc04;>!|{Nwy1bmlsn!LPKoKjnJc1!vH877lR{A@r{~>ZvR_DTt9=j%Kx3?Q9ja
z6D#S&-d53IHHUclU&*kICZX4x1s`m369@e3fKMDbWt_yV1t-*dUZ`(WD7?`yJF>tz
zPTtIk8_~6zWdK{#sySU<evw>lrmN!@L5Sz8*DsQDFDUWRu;97oCnd^UC!;5q`0SDJ
z?J(2XrnNsq&0Pl_q*Pt9PVSjguJx_rQl5TT#`rPV{g`U}NticKEB*&b{FUnCb+D1t
zSF69EJh^e}$sJZ1>!mk8hDfzdG?)<K+qAM+UtMmc5pNk50MtXmW}x>nNVgdkSBl;#
zEhklg6wG=)Zs{UqsnA1y)v{hrSqEJ33=3s=2wpqyL)oN(vRHkn)nhHfsHF~gs8q1c
zg1lv{qv|nU?@^K2aw@d1IoWb9*#W0PO8aR}VaWBKY+8FdsCh_YKq8PGoK$RT0^)er
zG20PwgmJ#sgPBSXd(@NJ7{4C%%WUZn=3z!fmWL~yEZnGveUPTEBOV-1S_0Nvl1_e7
zSE!DMQ3sDFXf~tccs1Zm5=4lHF}Z-{!u8q-C7)}e11bANRzF#?`!Q72-VHLwdTu}k
zH((Bc```wdXgzmMy|h7IJvoz?Jj86zH|Y7AoA7*(TDB2QC{bHCg27T$aHCANUg%d(
zY=j1zuX;Dim2l!NmJ8rqa<N<$?C9~j<R5K$h=92RR0Q0P(fU6EJpJ1V$iuz$e2$?0
zq>g(&*I9WP&tq>6n}r<PA6j_5kdAtOXxD=PCS$56XuOa<YN3HZs3Q2C8T-X@k4p~P
z>oWu}ee-yE5i3htw>beS>-g=X6VCVnk#A$R*eBA?5RuQAA7de-?#_|P=<;WC<TA5R
z{YQ?RnU>3&kXuEg*}~gG)RNmO1kHWy1xG-u41ItcJf<$bL@u`AR$U^O2LXZfF_>D3
z$GK}N0|K`NFv@z-xirc~qG4j(s-tOk)w!XMCjrUK9B>kklFC|4NESqn69PIRFBx>%
zMo<ZrBw(g*5!tz+g8A5>8Y!6XanzYgcu}DY&1;7X)y<cJZ3@-NOJ!jH;W}Xe)qHW5
zb`_n2D8}Iif#dzacz}*e*!n=QAd(nbBmdokc2lV!4ocJU0u)5|bIqXM;RZEtlbkZy
z&Jco(bvH>bBww{jPEGZY9?piW!wtIIod9*a<7bSx+^sF@sZDZH+N~|ZfbvHR>bCQ&
zvIeElk<l2AADMVi@~@jP5myYVX}NMiumWqb7)aF~+7l<a3WliYaz|Df?oXz;GiTWb
zC7=sI0E{cL$dZj^(jNS?rwp{}aCN$XndM^pB*8P>w<Ks)gu%*NUd0pRBbKRK`*Flf
z8=j3_w+_&TC_YkAZymHv!^gxa7M6s~twUQd2{2-}4)yb>WF#w3VFy_c*26I&E9_yf
zBhvuS?^p9S>vJX8tHOa8QB#S7_qg$nPp4nGS<c_#H)tno3@Y=(3!ObIEIix}Vk5{n
zsZ-o{8A}2Qm6jchpkR$LgJLipavm?NIw7V*^#C8QT$jlS%l))1#rl^&O*pn6@`iZJ
z@3ysB@A(>pTjgHHR(J+>2Y@Yt#n3?*-q8r-DIN!5OxU9lcB@~F0^`~uCuF#>xFJ%I
zfcJZ0a|y3C?xLfTcv0YPcQ|?V^yl|ERHf|5{dlC>yak$Ir25_#nXm>!llNMn#o8VF
zcs|K)?zP98MR+4_mn70a29*$Yxt}L-sXqeOuRhu${nq3C59Z0(v`B&V_!f~zyIfqP
zC0T=5X@fx6<vzh6Sf4Ytq^pbbWWrb=l1wL*p2$<>d2*4Nr+%7;c_B}Iod+Xdo|?Rs
zBR6e@EXY&e+lre4FV)is*dj`?Swf=o%&0YgC&Vfio}#eNGVuy0@CCA+t+d$LCVWe{
z@6e*o#`TWTqjP}GU)0W*VYRhM@G|aUK-ncT2Fux((*jOXVrQin!-tzm-kqp~KvrXA
zIYOYc618!gjK}O(tercyL0QUFKi-ChWUABJ`HOY}+htPJ!nRU?C1VdGy)aW<u^k<j
zt8U*e7g$p}Rr_|Fbeh_wKHDxASyNA|Dfw7+Pwi3b@-Z1t?Nc}8%M_@`jrrJlnp&q`
z%Lg3;Dr|?GJ#H%AVIh^o4MdT&Vuzd(hqwt<Y2j7=@Wd)N{*3U%1pyi<$Z*pRoXdjy
z@D7=MVZb1jh|5k380KZT!8?WkArN+xv53n|3n=$a=tKdPxKl1&kZo9(V)m1i3(D2C
zxY^^j17UX<m+B%&xB^3)^Qa>`WsI4neheTJiXHh)<iu{_!)fY+opQ#;htuf%CQqt}
z!#)Fdg84|T$7W*lkp@0P4<V0Yk3j$IqD|m_SDThXHoQmL)SAm7QsG{EIcN#@_~mlS
zf(DEz@Xc1y;=*AUJ)4*fS+!)Ku`t`34JEZ&Q)l=MC2HVuxp>j>fl&R&&#{*^UGoIQ
z1C-c2(PP$Gq?_0uP&?sPTME!?a4XoYP(Lb=J2OtSv27eQF;Aw2pq|X)R>2C0q9+T4
z(Mzp5=c;pB#nEc{6;P{B7N~7k$O|`9wntnrMIqlXx%dcb{l}I=w;z^q4K76gu$pYf
zq^-dFk|__kk6H8+r$lUS>kq5duda}R;G+c?c|0V{M@umcg}m~BaEj2#FdwbQf=Ac+
zm?zzJ0EZ{(1E!B*h{lB17`4W9?50hl#S#^G%rnh8pjY8`CNJdK?Ucz&yF#2P>9G`A
zACa<VK9=p#YPR-sZMq6$Q;n*>Qu^j@s-Z>OUJ*y9buviV=5-!8Zd2=c7U@)gure-f
zQJ-81riUwcVL1YK_AV?X;pXkaF!ZU4UD6w$OglRzB5l>E(l&&R{pzV*IC}{9PrKxj
z_0X|$P<Kunt#ru};8b-nQu3f*=k0dgRen<J<_ylp)x|Bi1;IHPtyHhNp-|#%fT}N)
zX{PttUlq!^Cd^}hy-LoEN*&5&F=k_sSfLhNjq{Zi>e8#_WH`lFOFx{uu9k5V6VEvt
zf5@$6aD0<`?rJ&P8{b+FkgNrA&30;=`s>x$(u?ne>0fWbfKKse$UJj{C@9gl6i5k;
zA5J!R!=0K%$|z}AtQ<_mte`InB$?OJeka}C;#LumfCGdyt5B>P16;W29Bctw8%<mv
zwUd)-)z5dMhv5EpH+l%}u<gbd$(dGCkIE{Nb0=xDESJ*%0PD1Vb!U-WYQcS_2)zn-
zun4OWxKpmdeWzTHxl3y%i{Qn@d}<bXX*#p(U(`Y^-y_l+sY7veu-QCECMs-{+s&dJ
zjV5l(PznJ=NmOn}U#X)3d^AJ|mn}kdUjy^RqAoRXjr2|OlSStWkp@Ngicr>WHRW2I
zSXtDgmR<|x9`23TVtXC#{nyI4g^*k@+gc){5dWeEpuf0Qc&dyH+Ptm$*s(N)h`qR0
z{SE+wi!nE*n^%c~GV>~@G99;z;&z=McO}I+XXFi?FQ4M<HPGT#>OgcqH+*p!&Aa)c
z#sq&+j#2TtqrK{Tdsyz@w@1ds?x>}fUn`0ROz?`Wsqe^AoqJ>~=7uwSU?0v>!+Yes
z%{v-B?j!#2)Ib6*Z1Ea#M`N!0h;abg9c&#o<#$xuWGSgJi7uGLhK!vlN#XZu(-8?b
z)}?l)s9TGre<4H@UBbay=?0d3+>D)w9pOu)LF(~`zFm-|-YUktm!-Zg##Td?^6bTs
z%Tf#W%DCJGHD$cMVJHhAi`=rx!0Gy0x(<RHX+^rD7Su=EAPFG)gY9H<Tz6M!nMrja
zB|b(q?3DqWkA8WtjNkoOdlHcvY86CbJKZ95eT$xPakz)h8K4-YHAg_;hjDc2s3N7h
z2zDiPky^V5w~XX;Os-nJPbOR*Qvt-Wflo(`U3)8_Y`QC5kuWxfB6LL)132}`rBQfd
zx?Xk0VwXXygyzKjC3Kwpsn@7Rs$gQNdTF1Wv~Oa2OjwzbhHhiIKCv{Lkazrgy=aG~
zMKA<=al#YL#5x!shpZhfc6%rGX*AIE=(g<9Dp^arTD2d70`9f@<r1r<Tb<l5r%!#N
zGa$xRIIGzwBGak*@G)bE=udR2k5FbZ7Eu+5=4Ch~6X#HJmhzRz>CjA9mdHid`G&m_
zwIhVGiD6`%wa)`MHd>M{D}>fN8BRuuFqUIVSl$&fiy})#Sqb=O3@J_-HGF=CB{!FN
zr$zOZ$QkkPK<3clw1qf}DoTQ(X$i<7%e3p{<ivOSu>RM)|E`<Q8qzQzucMP7^Dpw%
zuIr$$=Bw{(=MfaeFN@R6OWA)>raG_Vq5A%HG94T~?s|6CUyrRd?2KJ6XQh-1BN3Bh
z5{55bBVatc+R1K=4tfGxc^*i|%?|ClPOA^Em+|YmU_f<SwK#?8K_c<2(bebSNszn)
z!n%<ON%TI3iK7HnG`O1S4hT;*9Di0Vy8$zwTW!AqLZU?7dV|a}%hc%`<i;rvc9IlW
zc2Z>K;$M~xjM{^pDy<Ys*bn;E6{RxA`oW-jyj0GK&1u(*BCZv4A!k-)>g!TDdrA>t
z(SZy)9?1tYC>JnOMQXu~GG<DyT~}GPd0u5ISM9nHmmHpHQ^6ZC1Ht{tjhM}zIj7#a
zQF=Yt+#j`ic(Pml*NxJ*<;iX`F7FldOR;<@Ew>dI2PaBR!ZJCDtjNWbs?7$(Uad&M
zl^&xt$vF+cX!^=j@l7&*MYb(v_*7a6O4?fooaq^)CZX1(BJdQhJcZ2TcB(pZKu%6A
zPT_?sYsSVi#VOz>^aoi5o+(C;qP#l=W1ss-$EphsfWwN_92CFgnM!^5(Wc+iz5h3i
zDD}U`=;>a<$h+|A;n64|G=kF8!~YDWr-un8p9Pn2TJTKFc{m;Ipp)$Tgbyb=Md_$>
zJT}fp2UJ!WByyhGTLv91PaVG*TbFsNy^NiY%H-6A?cJoXx~NOqkBvqTAu__)2_u-c
zA5-&h#u-((gi~}o&g}D=pDHCzd$x_LOSIskz5uzXkX>D4a;U~<&yKDUA*V+2hPvz7
zv${sOy2i-w)Oa*a1#giF(}?#;2zrviZyEW#LIO@&UG$}?mv52NbJA!ulM?5F66ee0
zB?6lR<3P=PP&2<g)E=~kVtGd}h1BZO(Su+?q?&gS3=^qx4$8RnNa~DY;Y$Qa)Pboo
zNw1KYDjP82@czuPkOZ~k)yac$>aslQ{}SPbly$U&4Fv?TMEDlE?yja`4wxJ2V9O^$
zJ7X;SjQY=ma+){$9O*K7bZv^P%(hg>KBwlDgMqS#RZcn1=wg~kLle`S`%suBFws5K
zEQ|sgO0fLdYodp63q+e5OzovQDeGxrB!F-kTey{UrpTOhmX4ml6WfkwX$om-#3ztD
zb`VP`Yblmduuh0TanJ)n`|8CJ!^V`cXj|q?l6ENQ&5WUK9mntNc9LrS-8cfxldYHR
znjhHnFa>0%Hf);SI=8iAl;4@Gz4bw8BfoKq)RXRS!@}hkch5+G5?DF$_TqFeRY`64
z_T%6hNZfxx=QtuVVLojT;?M3dlk9EL){&_q`g9n~E;I+@!=?;<1i<W9pMDQkj}$fi
zkc_ji)wJ>uhGLp3IwaR)mTEbK_1TO{HF!uS24~dk=_-+X)PdoL04H-fj+~c>f?~4T
z5gz{TMvG>#oo#k2ID&L8JX>;pjt-m9{%&6N^P<}Jb0zk6u*>xKs2|*lsQ~Uvw@Pn<
z|6G9fDyX{YDI?x;Kkis^6_ZQUUv8CgOUu(IKwp{(1MRY@WyUHxpa8p{&QcvSp~^|C
z3Z*g7$+haz3b|$7i~-vDq9u+w1BYFRo#9P@vzzC7b22y+y+XV<8He(afxWO1=#ghm
zu6Adt+zPq8aI9-!s@76zjGGCdDIKur3PTT-h+0`E`3?m&9LZBMX|R`w(@`Hzutz$@
z=IgQ98e2t@3riGxc$o=}>R-MulhP6zVXh?dw@BRB!t0kK{@QT%FJ&a4vk^xF=1iaZ
z==(5_1=`fu!!j-yXv;-AxGw^2oBqiuRuGWZMpQII7~N#H84RloM<J3m=1iPS1yvlx
zW_A+FTZKE@b@TX>Vn7TF@(`nvjb`R4k^@^spBSQ@ns9L?fyk&JJ6bp$)Fwa1K**my
z;&-_#Pa0u%CZautI+dsg;TVz8hFwPZ!Y*Y6<*bDl_G#mUhp4DO;F5^Rm>61LtS!Pi
z%rSSHi8boVAXd_FgF!r5lUVc5&i9f@nMjaSylPaRL8K)_79SPpl;=B+T1PF>>U+U=
zUd#v%Q_5)%;yMwHbs(tXJLel2^>OHZD2%w;tYRzWxTy#ZxvlJzqCT#5J6s<81PX15
zD^qJL<;+B1HA!x422Jjrfd-Kc(exGQTffBFoOxEAy1!CR^v$Z*8z9lx`W0zCv`s`8
z#sF?slj^LLF*&nZ>>M%J5c0RV?VUdSsA|&~_?c^LKT~3MZrvD+N$oFev!JBg2+l51
z{@dil`LjVDV)W$3aJCO~b+f@0IK(6}GC@bJ7BR2RsZ&L_Nq<&yyD(q^#*QnW2hdZD
znOshL#oI-z*+lnXZ6>AIXq?F7SUOWldpY<eId$qbIWw4_g^@~o(TGWjxZQ)hqTcWs
z2?9OIk=SY0J4fc+Vwi3~V#->ad|p<LOvag+EPZ?v<cP8FyHobrxzK}=#A1g7;9DIC
z7UCFZD2W0{!iQZ8b9NJqLLh>`DIHt@B6MaqYnCQ&yIvI8URxf`J}rQx&f8<qs|F;n
zW@Bp?e9qo}mR*F_92_PLI@1dRu3ERvzjI&&wmS`8`{e<YNY17)s#}{aTvfO#%{`lp
zn*yknfReY!_7;W?mYd0iZc)`~P_wy%bq8)2o_@1Z-&xkt9qLdO>^sRF>cJ|kKa<a@
z7pvrID|z_AYMhWw9yUbPX@WxI93k{Fw`y*4h!}HEx$S)hlf1SCbna;nor_>4VOArW
zL`@}%&T697A|4QhchCqw7!yu?@3O-vu8W*SAH)RhBIl?Ru%tl|$ozbV(Plx?39B6a
z73nGm5c<%KzBU?x+eFKZx+Geo5|w<7Nqk>CGy><Iqaz60aFolrHo|4+0X7*?$Kw?m
zk)jsgF30cj=<yO61OE57h0z!#kn@@wsB>5Z+kWnldF>b?AQR{5suT`!=AFjr8`>SF
zvS*r2>;a7$X!Gk;%k4NjmJXwv{ie=5=gb}Ve~N(A)-|W3({2m{N-3VhjAjqWloFEt
zyK!d9sx^e4)KOg+=5(@tqUsd(GQCsE3|AG7xH|y=#dDgJr#_?s&MS(hvtA5kUQrgI
zK&&vgk9yG_@bdzy@(ww1r*D8vRJe1S*f|f4(1bsoaz5cxdg)s2c9GE?&QwA>sMAuQ
zU@_tS=#(^AW>{`%S(tKG{qYVNySS)}h|dIHp#4mP1*Pp_Yzzcm3(Bz?9ZlB-eJbNl
z&^5IV$kKcdGfBNGq~tBEX(aO>#4_ousY2i-MHorj%oaA1o)^7UM}q<`8|l<Y-Z2NO
z(dDRZ;<S0j6t@_Du%gC1)hBQjJzq2g>7@YYXn>gtjej}joFY^XBNuf`>X|fW=%l9k
zX?e~)k($BshXzin8>0wAibqjuB->m#-h+7Jeh$RY_|OpjV#EvWm-8SOwKE9=haxa^
z!f)0ikja{w3}qPFxCW3vB2H5CaU~o>m{};b7@PEkc7;U%<c#gqVgvCk0aHtzTLorn
z87`mDtWS;TV9nd{yK0G6oX|BYp$jmRoP=)SbZ%-l;vEr~3iZ&T9W<OOq6`6A7#WI(
zSIa;=<I3$`7^AMdOM2r1A<8TaFda}-XGm5@kRg~t3rGvx0Aejn2j`%34gZ*1jEFz;
zu|6X8!Zaaj>D(I=eqlOy2xE}p7MU3V2OorLNrY<bvLnOrVjo*i2}X9LsO?6gEu|NN
zF~pc#f=2dC>~{*m=23#V07q(RD_(PdDg;|-X_DG#%O|f@MFUdz@UegFVa*`*p$RRu
zi6<$heiJCDB`EQSy0%8fY~eTQ7S`0UR>BRdgN}r8$*u1wpp6&y*4i}WKpoM6#l^x#
zJWQg2;-_GVlAUVYJ-Dd35Xy!hLe`&b;l~Z=Cc73Y3r`uYT8};1Ab>V9AP|}ctmAjx
z;m{U)`=OBxzpE<QCUaVhbK=8<*T#a#n2WXI4qTk(&Y%#zoT38-ND8GOK$4N?oRlt_
z_H0?V07D*A6VEvZ(KvnlgGE@p_rY4}E6DbV2%30#K*eY4*9<SwmBd%aI!v3EOFQ-S
zfih`W?nBYsChA4c2<Fh_h{N?qx$0GUtxUDjI#f%oTyLfIsQ+DyeRqWY_hM5mpqAY$
zee>d*1g$$@)O5tqA}kyWF?;pl<ufK~2;`zxRedjRAE&pgwtMAPSSQEcC%<Pc?ohYi
zC#TO^TE_&oxicNJOQng8O;KajhuP-{3H>Fd>h1gR#9*oV!+kOZPVD{ic5Crzb>e=k
zbCx!%U*0bh$o=E}azD8Rb@EUwkm5I$l1dqrmYB<O)z@`0mQF5W4iXvL@lSp+ID|Fb
zW#vBV@Q@$p2DtN<RXPVm%w;vaS-{Lfe$GPe1)hs@)#XQ|-^^AON94=`(Q47Ehc9n0
zrvO0H@hEdS_KPVXX{uW;^!+V>;9xoI85G^XC;hql<!525p*rZJMOH?(`r8qh-SX9i
z56BDY2;l>A)&%@qOl^=l#h$HK_*BgU;FvNpAQp)d+-53b5Cj1O*bS3X!EP+`?fe<Y
z=%<Vo$j3vS8bz_xOG036r7ymNK=_ch!uQ}&oJ-GEzN0dJ(#j69L&2zo79ib4n6AiH
zn~uUxn61i=V)r&%J$h6oOkUZnS9B{o^z>shz>0kJ(NSzAWh?U-9)3a}`Ke+*-mBB1
zU{QhLI)Wdpq51)QF_bL(bskag`B&#XB&Km%hgJ;AoRPJ-iP~{9zjJi6Gb&dl)6Ou@
zI^?z4fV@RUF8A@OOs~W3P8cPaLq;VzVI*;PBMHF5h)mocKz6F3et(RfR%zqDM?7_R
zrqJD;nWVd$)T33Piaxk$uIe;kw4?J{W@b{YN$U|h+ROpRV3Jvs<RG5e2EEU=qpVKT
zOoQB0GkF&TRfZ20m{ZZAbkX?SMLnA!OBwa4`3|*gURYBJO91pwF%VWi24k9Ox~8&u
z3=!iMn827Z*VHtQ;WY_&$C`Te*$*%f*PK=E2jxC%&9EwaP(FkkTjP|x4;vK66&_iQ
zRI*<F9L|gNvNE`)p6r8LMXlLQqQho{HQ=Oa_=PV~tV}rkfrM+JSIn_)_KP`qCuEny
zws!0cj>U6j+)O8LK+M4ebA@i@+9Z_5&!vv!P#q7+r9dK}WhHU!nqF<kiNU*!=sS=v
z%R_UK&2w2T0zaOFm$?S<t`^$P<jZRD+j0*8vfB83<rR3X>nv?!+X&gwSL*01?SgGN
z=B|sK_GO{j9_!{A!b1{?J_6T?`Ij0Uc@W&?L}H2qGY5pY!5-5(?^*TI!`Rtg-3YDP
zt!Fg$hvTFjTC%z^Kyrt1w&TMhN8;_iUwxWp{H-D~&bmd|K+YwTq~j5=`dqThz1o3t
z&QJRHE0^fBH8}yKt+W#nvJ-9Mtw|@eZ{aa`3&tSBTbD${!-wk8UYzcF=n)73p*kLs
z3$I#NjWHfkW@OW5{uA}sg3a87!;B-rP5BXJ!B7xj(4KV-OTtTzitG4RAcY%geWH^F
zoUuT)87U1aw*gjcxYyfmZ37JN$#!(I9i6NYJz0I*An}tHD*QN3vKcBxJ3Ei#xSpZz
zKxq8@T2k$ZY5+dpQ2%~h`sdF-?Q^a(LQ%vz(}=ClwKD0z+2kxe?y)UQ9}0P~F>^vL
zx8QC(A=i?7{|UJUv+uhna5g$kU2qatOfyvGNx2So-8)a>R!f%ZIw==TnLJn#e$7#F
zt$i7iAri<b`6{|mZVtu{84g+aP8Y(~TCEQmqtXPOCPmog#yEEZPC<hby>7$)@mkib
zD9m##B--dSE=y^!@xdQFKXIIHz5^J?<TN?JJ&xZ=b4S=|Yast@zmpbW!*RK1oiv<)
zlQ=HQuH^Egq96#mgd%nv6+1_VZFVskIt&N9kBTCs>)HlEi$tgDkwjY98j}YND+dg3
z`<;Se+#D(hBccwhA1SHvM0n3p0ZXEdH^Q5bipxfaZ8QwGb3DwLTc?s9h3OpbWwu+v
z?pgKYN3j<+_pIuER8EPXdsY~&WLz9D`Q#o0U|X4iEUw37!kj=QZOVk9gTN$|pLkJZ
zqZAnyNg9wYfwYNjYV%_<WqOvtxvqSX0|9uA=rDWii;T>?$TkVn`(w~Y^3)rT;p$Po
zI{O$7ZWXCnO^7U3x#X0ogH1>)SC2N~JnN)W=`86$$4O_K_?9T~*F?NcfJ0ftPVia~
zHjbY(6FUd7uHz>m$k8w%!6e89hYf3qQ;?%|W<-OFv_Hu4+~@eYJ^<lfq+jmC1z*RH
zXzo9XUT*iL&dtn0(Hm^u(9ztv<h@q+D|t7Mc#8~OAr>G(Oe@4UlTI0Y_sI663A#o^
zV+cBaMC%$6z0Ro-P_D6I!+XPs_qq`;v?u<kCu>Ny<H-nqC_`=hv5btGXs_8Q53)p;
zsXafI@$rz=9^`~c9ZzaxjO>$B7N7dzk7dkCm;m&`+lUUt(AFlVOC#D(N*(X+Mq?%H
z#3t#5VF;6NI@R9CaS8zLk;kz__~wjy`Ek69{LO%Ud<Hw{BE8?)HZ=ZtES<LmP{SV^
zp=JUQdFiEIUGE=L$b!WvkXP^R806JPMfPHONjOrhKCq+l;f8;OnbxPy{;OPOebuQ_
zn&sk+KKn>@|HzA0#@CfZLOkHpX<NTB!Gk7W_X}f;RVKw4KZZzhFAXAmPNHgUmXl*C
zlOK;NQZn?kP-0&*^xdxqiQ;(W3`br?0M>fFVQPF+L#q#N?l*XC4z#t)A-|VKYyfwd
zF|CstYkZRl6AR?66VS_gnrMx|T9~bo<OHaU<40Y*H-d&dkfpx=6KM5W>Y<-tn#)qJ
zl2fd{{)r4^KhTZM539@)>3BE}XyBtFU377<1gA`Z9UmZk0P9S<UmiH4E!3P@=l`-z
z?f5sDV!^%V-_ZA8cBvQs4NJK%d)3#E%h+HUy@kaM{_0q$tG{aHuGSE~3ecGe+LLw|
z6Ak<dJJh5}*j{ZU<yf-z*|8(t4#dA`CS?zorgI@Ea|;=kC{*8nTu!jQXx5DRMW<%W
zFQ69DZc^-b81u`D5MzE>6T<e(rVwL(iMK^<#w4%JnB=t?le{)#k{1|K590%dA2t%l
z;C-B>W#9_?MHNvothpnUh0mM}+sAF4;ySfcJ=Ox+e%PtrZjsYBeTW`Rr`F=A&sNb%
zmPOXSxH94>P&EUF7~X!falq6-jESd-umZfFjyT!aok>!wp1=vk6t(>c%t`N7tJ|Ky
z+0u8r)RRx(%qiS2pO6c!cTcHlKb1?Sz6%m!GZ7Eu+8`K?uH@Z*RrXVv3x4~>PqDNu
zR^R+o&X`b2i!yxnn$~!)P0e@`YmA;jwf;$*O?a<Et8?hw_j;T~y769@I{YM#jK0^a
zjz1~)kQ?4A*QCD(*@A9??*6}c>f%jJ5c&NA9q-1Frq?d{0Xus4n9uaQ-=`{DWn5G)
zb0vw756Y5o6x5|QyT?X{q5OLds;gCQx8TM<g)_D9wP<+x+)h1*_C(rsVCdTeyC=I`
z9yaK(`6B2p%%MHUaD(3Vc2Xrgj^7<h!Z@y@Jo-bO`zvhL%|eG|<!aW=g?Ty8P;Wma
zBXRh-_bD0Jy1&6@Te`=Vl!Df$@Y{_v*X%!MxNpW)e|IGvcmIbN#%RJoitFx1SlC87
zVZwmg`ZFx*3)P{YNk5!NwA1l3=<T`c<DWrZ<SO}dXd~s7YW~mVR8O)qc9|y+HmWOr
zj@?(dhi&)d&*kKq2fK^dXb;p5a&NM*KG;_bS*jN&#=$=IyPxBL!@;xaFDM#q7a7r?
zZ^={1Z9pJTZPQL=8&=(UxMvUjhIH>+TEWXqMo{q<$b8f(D*AX|#L;9Z+OTQ`j_tS(
z9X?6P<Ps5RoKSKxrT{8ME9g*U0c1Nx(()ZVi{r=|ZI^M&pqlx#Tr^7~!o7M+FWxI>
zpoCQ~-Lk}|x#eJns(Kn%zBAObPs@yzWv%uxN@pG>E-dThhUfxi7`iEt6Db4E+W`cO
zkS!Zj3!cF_0OYXlPH`%@*-J~YyVHcoB-umK@n&B$U-1CSD2Bx)kCkc*>SKsrH|Nph
zmnS0erlV8A&G}UIHasDGhV8c;&oI6>Y$G*jn(EDG<m3r{Eg*Fk)N&}G{``!b?n~lT
z^;XeM+lOSA9m$cT7CwswR-xMUEWJUAHwBSK?LSnR1CsG{bEqYBsqRoKO*cHR9m?eg
zc-Vg{W>qcc2r`kSh|FU9L{cWkMdo_=*4syyXnBm}^wC3(3S?ox#Uo!#91Lfn%kU$j
z`q%v`x*bvw?h4!8(~dEK@V(^zrcV95U1oWIGlUbhctX4l4_wo>tfu#G&Z_axN#E4p
z)#>Aqz~Q$A<keFF<J@~rZFo+ujOuO7Max5TL~o<2e-1-0N4@YIhGmZGdk(_yx2M&&
z&*3y3T<`OEd*MujTK+uHgL{qb-v7KzOgjSsQG(^0D6yvk)cos0lDkZ}U+43+7t0F6
ztL>&qFC_iCUVTXr;KsZlv!LkjcmelB^3`oG0E>Lp^a8HSym>~y22$AKTmVAJZV(+(
zn(ot5!%$OqNje61$ZOxB>rPLGkYpVaaGWXg&EC;Eq}`7L7#g^)D7=u)BBxZ#!P0iM
zz5~~s23pnr4k#J}o$7c8l*@rWTNtKOr=JQ*;x8&f6ZaRqISJsjDEb0Qa0=k2;MP52
zfbSRS8N^497em(ZLfvz`q}theX>5f+CF0diF$Ons*z#|Dk;xn00<tFbq0$pQ>be(Y
zhIL|CJ^mtW5h?187xBtUsrs)M<(0t`7*n}GsQ}BRJke_Q(-T14Qz!HBgU^1_>F5KX
zlNgvDeqP-Zi`yHqUh;?XYV|La5${Q+2|oU)fwlX1={f?e9qjKqqCWU{8FS%DO0CpY
zQAJ3@v$yHOgL8;nKO!5w%JY((n&2fZ^?-q&w7>~%hTZ6em1v|iGH!ke=c{u$|N7j2
z%%96<D?)|fQU+I9CquNEw6Xa+*fut+H(!#I=W)WQs-W+UAZm=FJOCf}sR^AjWjV$<
zZQW<WzQ?^sl^!p!4|or1Zbt7OZ*E|5$<$^=;rO8Xey5yDM<GW5aEp)kdaO+$avkp_
zX}(8{=g!eIp&X7r4nJxpL$Yza7q98D^%Y)*VIMC44h+6_ZNr#h2dE?utmDHzT1STD
z#c{kh@iGoQA)foe$%INB=wLFBbxVrwP`;>W0}0(nK8`GSfguquFvOuPaX#|%ro7?6
zrMyJD^MLVGb0Pz$9TqX=kl{oIKoN^zR@s9{wEILx=o!EhFl2`&*%KK`z9Og2qw)rg
zn|~;dS<5LNN>^K7fzEi}usZY#v{SgvufW0v_xG>hLJ{2fS7BNUsQg#)AVaRY`&AsI
z%vEo^ij$MMDyj>YTyj-P7Zxh_*Q&xUY>D09pzi6CSytVkdZ$ZHj;X`kir&*kJVxsN
zNcHzFoJRt)Vv9jUrj4yJ?lkCUf^chxd7>^Cwh^|)8g&(J_HxO(3eX-D#lhA+PBJzL
zc;eO>Dk;NmyoOCXk0Qoz+cu55Y9GMR9Vng8hvzpR{RJ4Z?i?A;54uJ9{U#jE6-R1_
zt~`AnG5EX>O{zy=yDZZ4>yel|TElXzHy1jM&I_-8k=Qs=NUspHls=M;TgK=Rg21uV
zx9FSu(U?fJ>NVU6uTc4~K@+102(F@XKmkYE3X;x<&8H%Ix~{0yRgIS6NfV%A145(m
zgq|oYa|}FnJ%)88M;m+KXQi5RQ@v3=bVvv1*E=BNVXErVN2BrMaDRDCMp;ok>VnrX
zgTY<$I+VpUb=B(-u_fxr>rgc^)Qhj<HHr-N<?A>?>sFpqa@LY!eZ++y4mgku<q17d
zP#7}F8wWt`wV2wn8tnBE%^wGnROu<{-I>ff2~qMudT3#MAcJD@an2$Q5_{1Hyn6aL
zP^{CbRC(x0H1aZ4xKuU6zp7>g{;?7Gu<H<fD&H>b8yj}OKCQu|Dxn_1yH~}SJ8@Z)
zJ29%Hn4U$m#X(ewy8I0}H!iA?fU|yNXTT6AJdoirWC%tz>KPifL^UN7(^Bp5MgepJ
z4&&jbeu8rz4~Zxm4Ux=OLV5K%@{AM3^DiMdt6Ihju^KOcg@4>#=fPB)ekmiZXk2Rf
zrJO#_&dbs(x>+55Q%)Km-OrS=s~%KO{Zhux^0Au8Q+7;Fh-NW3AE@<S<R(mGn$(|u
zDQ5*@nrP*<m!88NMKQ#NFhkB&1egl-k)dL@C@jK1#V5(c$@H_cGjhmI$SscP3spW*
zIENFBiP<SA#4>s!y|cpSX9y)ms@71yd=ngOsI%Ic+RdSCa+1_d-H>Q$s;L_iElqva
zEjLZY?DV*a`^Mt5`I$xcj&Xw0S@+atsoY<|Je#F%{S^vUs3(4f0|B))>XTpLme74Y
zYW`bt;tp^+o;?)4By7agmW7WNYWMn*_;M_|=iXZ9qzrlW@g6eF-V1}NGj8Fx$1O;8
zZ@oJHmh@Zq)~T1?lCg>RHXlR>u+X_rgt+=XHw!4I{hmJcx3{pAggf<ZXuWV(yv@3B
z;oBI>ISS4+_4wOZ5W7|T+aQWtefqYXS%e`B*+46fUb2AD<Om#YYSgk7X99R=(vZEW
z^m2ZJ=%#ay`binTQ=S?9rj&GS>o}<0l%n>ZW|Q{=r)9$Kn=m%8Fky&Tu8=?{;JjR+
zA^_?^?K~7SU3Zn(Bhk~CNqogjWBa)-PjedX2bzvefJ!$j?>lnIhC-5*xPmkqNFf7Z
z!?*`x!5+jO9nGAtqZxONOwCzU{|*dCaJ$}ttc3f`JMzNiHLwQVV`753$7~M6&qVcx
z)rQl>Sj;*=;_et>Ku5|Kr(J_|9?{+drz8N_^e&`qkqW*mC(SArMkkJ?;skkp7%hWH
zW4^0AiI;R*>tuj;m8*Y$7ZY*03V#nLNAIds8{WgC5O+1GiuZ8oUt>9K5>KgjHAAoG
zuGB@FRrh;15R_EHOFzKB8;U%sj2hJpqISNB%;)Rbl$@P2wh}i7(gL_lYg=UQZlPDC
zxUcTU`DiR#h>7p29ARSkX)YuD?;fr&3qoF38P3R9)+!|2Bg%jScm6$*0(ltVJsz8*
zNQT}6j*7O*B1JUb6JZ=#wBD1fntJ4nr63nCb5eMP!~KLpTM(`9n~f4hhzyCMEye2F
z9_d}Lqo^2_s<(mZ<x&V3qWP*BMLRPA@{RzjS69AIzmw1l+pA_tJJ|-D=T>#^%Skib
zq%H3ii3Oto<+(=yAs+yF=cEupnYHay?#8^Fe-LxOYgQ2-U@{hJ!3TI$4iZS8Ny&ok
zrr_8_FpZ7DN0s&pua%aq4DO@0;b{1|8rzRYbBGQfwLwKB#nV8Jty<&e91PB7LZ3sf
zkHOMd4h#H9A%4xrY%pEwwGU*>q#T+C@<fcjS&aITx6h-7KESomOqKYde8}pnR<C?0
zbMVsK_%m{Y^+~1Lc?JR%?tN!4v_7d;&!3UA;*C~%$Au@je)7`^H@iLk$q)V-ucss{
z|F5wW%u*|VEo14t6%POC7e({&qG%skXl$<TKShV;cZm{+wOxSez&WMv{<VzDp=5oN
zEfZsxGT~M}#6NKF$H3NSSn2(DKCOn^0<_@oKSL59zsA>vlMhh%>`3*eU(4vAPQ+Ds
zBw{7+BvOeT97zXKfE@$s)9e4}81rh82l;z7k}y1eUlLk>|DJa{=wzJn`%FFvLmB#y
z&4H@PgQmZem<F~rUeAP!A>;Fay7M=<`x;P>{|5HR4AqU$Wl5EM^p;8wkl!}C4pfs-
zg&AX@h|U*j3<iqu0}~DnKQE*sGWjBlw?b{geqN|n|5iq?{~Qzq2EvV}5;dI9@p!ER
z=ksO_2ep3Q<9E5I+wec{q4*1k6gHnc@>}U!>cJ08KrHAuP`MBb&vG2%2`xN7iPQ&|
z^Gbj<KArUwpBnnDoH*r^KA6)Hi`vK=YQU%IYFaNY1(&OgUOCf~L6`CMhu-`&L*0l(
zPlj_LkZb=GCX!z1z5G)&j~;<6Ds!6mDNwg5MqX4xqVBVdB-+<^{KT_%G+P;1oPUPB
zPAbV2d{(YJzr!`)&w5nK@9^U6XK1e9EEKKbII3Mp*y*<YzLnyy;=9yW;rGB{jK69m
zP2Ki8IdL-O!GXpdI+?AlMAhH7swa^gw3D~#WHcSdSWf0rg@`_Fag}JtAF}E3B3{J&
z!N{b3bo^*i$V-e(nK88RFrVY4v0%qK(+*YSLO!+bBRQ=gQXiM*_J7n(@&dakyyZ>h
zKI+989uKf1f1f55d51jw>X0VK$B=dOk^mMlXPJrZ=zx0pBN@Bq<3{^ny9d<3!F{aK
zh#NjmbL%_U<UgbJTZ;F@WK(O2+W0_|@r`QA$8z@E@eqX>;r1h^8JX_8!kuT(2)prT
zwPvb|_|=UcOYa^(X|{OQG=N6oSz*#qb$SvSif3(w*XKMLjEWu*bOmUiSeQ97fpK<9
zNXBH5ybxT+shE27$Hmmp$B=vlYFr;X$$c`8F4N(nu88%02iE>fbyc6lF9NoyJNt0q
z5$@}@JLVG|UjGS9YrBTj?Vrd^<bLpptRc7XQz#jEs`*p798UkIas`|jpW%=~VJFEl
zXf$E?VKe)+kKJ`JX@>^sZcLnH){MqgSH>KO@9v^GcB=@`J{uxI#Ug(Jh|glaFb^vT
z-BpGBW*>UhDOrdS2w6&xCk??--JfB<qwtja;xjod-cH<x#8V?zOPG*_y=rDZez&~v
ztjg<`Gp4xt_P`Et%&Z9mUtluB2h6U*B#nHT>9p|LDT-iVrH8z98m5*EObj_t%|efz
zTvb3;&?`h{Hyx#Oa(1h~^<y|+)u-ZrkE=abomE-Chm{5H-rviG*D&;JMIVjdYqh=e
zDy%i^)BncRC4Q}86GpoO^d=jAjjUwMf=v~M4+pS`9!M#wfSQi0h@v|jM-9o)iH{G%
zaH2B*AXBI4Jll01tqJJDjp~v=;5b|<LEk3wTbwTA)IH^Pr@_=La!2*to+cWoTSN*y
z<20&Y_F#U*r7Apt5J|7}`26hmC!rnOr$rT^J}s(-!r-*w;-Y5!P7J+UHRwX0=|&Lx
zI(oZ~-p;D>Nc1)x?Z|E2pbnMxIeNILNA3O`zuHvPFATf}u~W3VYUx@qeSmNc=8Q@g
zbbuOHzrNj|qdm}bXoIub)u$gd)X~ZO^w$+)!0Hks{YxE)13q{W(`u)SNOp%@LsgPE
zYBg(>YXEPeUNfMk4B!x2vf4f%v*UnMsFSZPz<#5H)gG^Uen3uHyQdP$o2#}|-#-u$
zcqG3xw6jKu_%&U`GVL*FihWIV71il@G_TmFV!yzTLQ+CV?<>ya2Z(TqM&Rly*#=Q|
zUl}+yG)nh@Pj~|#JE1^|(wiDWdcnTIJZEqg`$8RA92nJ+#n~89)Q`0;EZ|hf7jmpu
zM{U<pp*}3mRv&$V2Ve`-e|;h6dCTxrC;g6bpH(?(tQA+QRbR@98;YAiQu>ABR_nBj
zmInB!ne7n#)Lji$$Eauiicg~#F%CsF{S>1fjyivzI{qb=yrt@mFXfWp-Wqz!_6AV~
zL3IPjN2ILguF?Lc7?-=iHboXw09JA~G8DIaF*iD1`}a7whP^$QnO#+xIFg+tsw(NM
zIZgR{tI?fwqM8FRMbU3~PoRWOI$doyXP;Xg`3hG7_f@MWzQUl~S8Y#RIPGHh7G1js
zO1kSP0F>;~<AxCniO;V<as$Q-cX-rLWo5SA285xS*x8o{?9IJu-M{BW<8_Z?rrIzl
zqZi;cS*$;3<9j)DIeS}Xc`bQ)nYTPZ=dbmLE?HKl?j3|RxJ<QZ=gmPZFP9C`L<mWr
z?7A7hR{MV%dmp&CigR!LoZSg5hXob_WPwexNjAxvtPu?=QDWAJii(CLXwjmg(ux+9
z7__L=B?(cqXo!*wQLLzFsiGw<D(#!wOI!MupQ6P!zn0#Y_Q&m|y|kCsqeY8~=KVg;
z%z=&e{yuk=ocYe5XP$ZHnP>i-nK=>O?SV9u098w4#Ryggc`=QB-+&_0K?4!UCo{7J
zVZ09XMk60Tn0Mopmg7!HZ|eK8^RD;}yrQD<2H1vk6Ls_s!08{m%7Mr7g_UY(fxe+O
z#ABx}{lHslw|wfam_euFdd0uuqerR3m>KYX-QNg&4i4XnjA(=s%~xY;)8W4*1+CO3
z^llt1*ZnPN?M{W8jk9q@x<6>qmf*2=69{>M&D0LM7(;1cYO6P)%Wzjt(y)xe=tf=N
zUsY8zbHv?fzwG{7Qe@-kl#(FtTqsBXDLTyWsufnGeW%k0N#M8e7WOS6-R~xy7OX@w
zabrx>DaI1e`ynrSAJ0FKf2&{aco&xRtqHm3U1;Uo5XQSnp`~y4z{a}{uERH#P-b47
zc9Q%eB!7=27*l&~tYcSjU2zHC3Kz_qJh&Hz;ctbViY}mm87&;VRZMdl$4SY!>fSCd
z!47TI6%zy^WhCjmUC(zsZJW?RznBX1?&~c)odwc6tmjMiW<ZaP3ZPpB&VB(R^(J5B
z$)n9T!}6~-Hs(B1D_6dk^or{dTmJIBq)V=peyrU%UA!sLGhkjO@=9S)DL)gp2Ei6n
zm6{S?DM+|?;p0Z8EE;y<6WR-x@FHFU;zecM`$?x1$|&~7fmk9oA90xxGBlrngrGb$
zNi~+F)bG5Xl$}X&!I-YV1-dJDC}zs~)yq0i=?L)R8WHR$z{^{fquJ4bv)CkU3}?*_
zEGN>efSev@ib4_uzior^j=v|ZENvU4Js#zvW;b?@h<eObHKl_^M3lvGum}q_`E0OE
zxZU;nv|tXZ2l-2Vx(o*!<?sHUwB*YNyYxCjKlPu-=>BQGo}6+$2))Dbq#T<9CMhRH
zrB`ikV!jR@<8R?zCA#=9C{Nlo%Lk9iZ8LZ~br7GioWVWGk3sEthU&xeT0t=u*GQGj
z$NWC`U9cezfC!Ycb%Z(+KH~9ME0{y}B$~(Cg9&#z^+~v+*-U6~JeaA+z%~zjF`sh!
zS=04czdZeer0n&N*_c1yhD<o_<0yUwN?0*q@(j@}u-w3#SIoz|<eeX2-xNi`S{e_W
z6%Xw=AEQRkW;-sPCc!YVcE8$577D|7aw*#Ly*z80k5Pe6m-@*GvjxQy{T_U6SY5hm
zwpW0$1zJ_;EE4WEJTmlQ(qeymbu{7Y3#D{2te4w9#4xwLN#6Y-WZm8`U-%H8jBTHg
z|M_9k&YVNT)Q_F?!=j#f$R~IHBk9c8p^|#1Ru5H_@z5F)CFeXFhrlpCW+oELblW#O
z`gD;f>cl`?%RDrrioYBeBj~1iXb!KVi5MauHaZqIteS_tqMWv-7K+4HIy#Q~qDkcr
zqXRam7s70tri7Hvi%wT>9worDVI2UboYu!R@aUxc@@&#6fdifBW3~3M8+m~XWPq2X
zU9(A<u>*s8+*QRALOyMNsHdYB2Zr@P0G*+#$^*msPN@zI`{r+!HvxzvZhCNQ#W3v3
z08+9&w4)wAtyNBDm6$N>+8C`B?iO^4e>YB4(vSSdsoYnJ0atet2w@h^zC&u#=2yp|
z(Bh%Ii2XiV6!v|H67(e)3S%k-&%eXcvH;s%T{J*rL;ijbSsz;Ureqka`OYI5`}%0I
zhGt2geT!%_0DhWyR0|+Pqk%3xV$oq`(*7vPzy19=Vhr~Qu$@ya%21y8j4?bNH8TE=
zW`%uWBEOeZfTc2%-%3OmQG-LCU~DE|Ui~qStrx4cFm#`^J~C5E6J797gnx=K_pBl&
zk%Yp~D!HX+V#$WCxvPRd)A|6ifel6QqE_R4taoweHiMgt^|)@Poxb7X^ldZUezhkV
z;=+lLnPd9oF|QuI-{o<xbui#orJ}|0_q%!0ppKN+<0T^1B#k%U?;-n5T5r7HOIqbP
ziH_se?ZSA!&*>V->E3q@sPMY|`~6DSnIcyCS(=<L2H{8p?cvX@a`-XsG1xiiaTTG!
z+8vi{NREDjjm+;4Q(O`|m7$t6@h;ZHyB0L@J(x18`6*AY1(BswQQq^;-zP!vgAVi!
zx-zvJB#Gt+UAkJj$)M4DJo1Fvv0}z>JHY%l3G&7MXi@eBzjE>`ci2?%FeR=>mWj0b
z^TB97wL8ZRlJib9b{&Hv6H`iEh=|86|2UVl0?V@Frj;XupC&DeebD+(TjP7sJd(j|
zQhPE8rLYW&c>MXY>UNC}D|sx>3a#Cg8H)QM<jShqs6{}dLGo|cV!&egl_Fe((K&|a
z_+0V4NGQg9m>ws8*j~i4K)K1OMet!ee~|_yq{c9xu7F1TN(6|3bSw>Wo+J&5@1agl
zPR%8yR?!Gio2L)U{<%CFsk!4mFbn&C%C$V|_^da}gUkJoDn4jfj-kXXZ32T;qGJD}
zN*??S`z@;Ei=Uyx`bV>T=QEse`$w;QS3gruU~3%k=_is3T>qGoH=jU<1}sk`tqoTc
zxety*eW+SzD+B``GtO3WOLM!aU3}z`e>wpJ;sg6=_NQamFHi?;zm1RZLcMt20{^3k
zidfHTUmvITy|mhm4+EujWI$S}T;=Wac2||<qZZtlL37{^*D+<zxQO%KhnlT)Qye;M
zZHRr;rmbi*jG<_Au}vf?bBd3nG_Hps_Lf5zs-Q~fHpw0;8}`u@oYZslb)rA?B;94O
zn=X9yX+TF0eSw7#W$r(k3PAG6CPt$F7-~#Sth@o_bqy=Oa`NMd3-R#L09s*MM3Vlv
zl$)62M)G+lHrwbJ6qyUeN=SrRse}hRz2sl#lKifZyQ!@ON<YG<)hIVmhLakv<JR+e
z3K*w2G<G5<op^HGZVygKX>IzrT^=m7GHEMA%5jqLts<=&6;jRbBZ#q-Nm?S&a!#@3
z9+#EvO6inGT-HW<zU{Kkaiw%g%WW07BDRdWt*hwS;kGu@^EYnmJl7kua*43=U2n|E
zON4bgJsX9!AqVXs6U)MxLA;E>k0x;>z!aQH5!M-aANC<Vyz-Pq{HR=H6#yMvWStuI
z&Oq<LuAp7gZq=QZ!JPBkFZI$6FRO?e`(oskiI<;HeC;PcTZDp?4a)2UYni`n5Yk3R
zfR})(upDbwt=yAf<>u|G)wit&)eBD+2a&$MfFk5!@5NJixCUnA4->2iJ*N_^)mSr2
zO|){;f6zwnAm$T&w?uAAw1PMXe@&tl!XuVw<y3sPha!Os+whKJ;e8=~FQmj<nfbod
z`6(Yo01MY0`~M65cuv}hR={;lt4#G+OX+#42Ni<nZ651iUDr&@4M|qfqB=C0a=Fc8
z1?7Px>sD+n`8dgX2#;pVx+0?*lPf40RS@U-<rX<<Sz*_gyJTvzRb7*B&^7$5U)KhF
zj@ps)N+UT1CAv0X(7tXq{O~4?op<Blv393f_4sz<+3K@|PB=)=4<)^}MgCi|mFvRu
z!({8!$hG+VE)G!QNbEukTFJgr6xZqoiU2a`NU_apov{olV5_hfTF`x)#l>3dSm&<u
z%cs4TKjx(gEEnavGMb#Ap{V}mI@of4Aslemqoct!2x>TPT!-(AVEZtB$SQe)-i_ZX
z)<zcIU1)DUX@_fsPmWrnqSo+;5hEH+M#%G0thIO{{?!zVKJ#`k#aih~Zj-O3SSv0`
zZo>&Rhm3_B`E7}F2eYD}yl)Xp$Q!R*xMziD+&i0V>gDoOD|>xCb+EUH#rk6}tb^Co
z>q5~G8B$~!Z7-8msn(g;E_pcBI`!H*eIW!*(&&eBZl^&IXbBn~Y7@B~g5$jnc)`vZ
zq+&MEba^KqH4uw46_d_2gvRy;8BDY2oo{iPb!vWr8Ukbn;&Sqm->r)4`8$3UX<I&n
z#IEhO{NHKTCVHAatN2osGlCQmy7zZsCz|E?r`}1OU-Z_6Oe&BEeAY6w`d55bc0~Yo
zGvSuU#jTGEk(Qb8ocsA4Y?Vdf$$S=iaLSUNemztq&m<pCrO^}Xj}RSu<s0g{7M3?8
z>GjG$IyAs5i_>8&yz(pQ7Jc!xCEcP=j(sm3rXyeeCLLy`PJT*J>g2KvD|b_2FPSo|
zrN(U~VX;sEe=(C^>rrU@o4CS$xhum8Y%hd8;aGXJ^mG(^EQ1T$y{ST1W%WrSB=17h
zdLenw6Xi@d;nI%`EA(a5Ha>_UmZNov!YyELOEKbVtw(Wb0}O9YDPJI=y}2;tjXL9H
z+f5C8dAHKIO~>T5i>)O^o4_}}XN*Frq9-vzbVg|IbBkV*Ej&4o5xFPFS{&OnLS$7A
zaL%tbpA*!D);wq}An$yT%s-jqbMk5Cd5Z{A`Lry+0C{sk$lEE%IjD4<<2m^$aao=_
zB)4T+S+R3xsWNa%w?L<&?%~{75CRi$78#z@hw+`HWj&{z({oy04`yLJ64)G8qXG<p
zkoV>=jg+@w=;L)K9Z*-+z;k|qowuR`bD&C}kMF|2*R+(D-yIJ!+Wb@IaC7V7ENhKx
zbE^zzSs~Zv5qU+HwVa-JWLYa*o5$p1S=K4po5!f!J4FDm;W#z%GbZ23vX;WQy_;p7
ziNjm4UoceqZ7=6{UIR_#c=C2$9T@Ff_(uJCsC~7dVVu{p5UUv+x5ve5;ig4GI&Y{<
zn+;+B`ET*-rp*&!`CPV@h0l=uAlnMy@#}2s^qU*$HC2sBrkzp?I=ThkwHSTYk~dc^
zsBdYk(<O7L&ycF2-KZWwMCt+R<1cTXk0|e1Vy%j8neip04=u1B74(7vKkB-o5n+@<
zI;C-1HXp!WJlyGi_}-_*&XbihT0uHn!|&*Ek1zj-T1)(3K^=&ad49`^Q3!uIl<!Ta
z5T_l}d?4CQwTMlJi$QZSRn+H0`P4c0B2G2ZtU21fu#6rZ;0xinYlS-@eT0k5`23i^
z7~^yIEu>>)4$tp^rB<^PI5{Y&)DPTj<-*}iPz4xSFy!RTOp>?5AJsPnsNDx-8YtB1
zZ8;RRnkHA}SpJJ(gSd@4AFqViko<xs-TuGm&DqU=eMiM^V{5Ybf;Oi;lkh?2!ZG>n
z9BVzsd%w!DR$X>cml{r#V&Z^hD$IY>8V^_QMa`r`H;MdW{8K}lRk>AM)S5{~8FNJH
zkTu<lX65<0Rw&^8;yg^pC=qf`uC+2)s3+2R`AV;`oFS<bt5*Ir*E+>j(k%a$Yvs5u
z8IehO=z>e+sd?7vcwC=n1wsuZB3uH6PZ1y;YU<KXYJ<)X<-BZKKAi{4falNiFyzGZ
zPkFEmcqRs{P^=WDxDpdcQLk=1Vk(yhXmN*i;j-yzSHj1z!*^iHLb_0T%;(<ii35Dh
zi9_)9%!LpD3Q_b*h@Sd^r^}%M+*s;O`C`CI_j&X6*#oYcZKLwd0E&#~p90p(81$eJ
zjkXZ4Y3LJ=afHec#9Mf`xF5RoX|bhDtC|`gl|fU~nrqxJZ+j<o2sq*$*FxtRqd@Mp
zXjp#>mM@}cW%9wLn3`-KlTR<T{HJUmqnBVTn(dQfQTlXKm7dE1E*RAv#c~4CF=zT{
zDQs)8T(ZnsdIN@Ie4MeEM#aQzyyowK<>fZd?~<x?QNSA{Mq%6*$lK|!c2rY;<@_kt
zv^=y7BP~3CxC~Yw&)*?ieChL(Wtbn7H_O$_tyAe)uAlpsL&eH_<SWaq+??_r8ZBb^
zEzY8VDuVxgIjRHCx#dv3M!6vffn47wFAAco!Lv4qISrl<2d&)8uOHN``W35sl0x1*
z6eVw%gE;RcuwqNddtMrPfLrU4?*);gN3L4Ik1N&V!4=l2F*F~XA;A$`EY{)L72D*t
z*y<3jjZ!`1n&t3GY>>Af()W}10vqIwwFT_5S8QnR$Q!4_gpa&$)}8Nd@Y-p}jVrAT
z%*ZZUX`PQp%S!94^F5(#)XplC|2aLhl0IDHdbtUko9E5LZQNop91J73upUR~+-_@-
zCsta^@y>JkDt>HPg+4GMD_2=p<MA3EuG^bsddONHyB#KpZtE8qgzpp$*!>NqRPSY#
z^4~s(@lf*axVxM33zK&*+}$J!>rV=8GTY3PJlf3T@K{K|dIoj4BNGNgem7+0o_fb9
zPDh@UsH*EEB3d_*s?LxfhAcW)xn?y+%yqJCwY4Tz*QzH=C-=t`pSw8h`@{|2BGgFJ
zPU^wxMoP6|ra0sJRYx(mI|T3Y(ei`(A;K<@=c!J$dp9~|Y;RH>6y!~zeRx?x3rMgj
z^RwDr$H)TUQidqaj>xL*8ks*5yKB_hn8yTm4{P$6-{P)5O`JOekf+e~Fdyr&9aLQ<
z5#I@NsH|UOExCO6Eak;^vYx(cqq4=;bn+z*>V1?gGgBYHdzE{%@dXgpH!#SYFYtX~
zIkv_MZVO{vLCO)PAyu^25zl=UG-G2z_tgos7x%4UmBoGaG(J-y&0cpsvY02j*DEhx
zYb}eRN8>p&PuiNC+b<9eh24w5JJ5{pV1M0?=lyTi{!R<p8?K-mthmT~%hqG2rPsgq
zf^i;T>(<G|--}^6Mwl_`-u9ML_vR*5*jpxOqXauqRhs*~RnAql#$K35_+pneF;Yik
z$eTp6S5*^ldEQ$`h^zo@fZp54_iBMH+B&e8-fz%zh^Sz?j@Ku9TZ8VTCOvs)(6#`C
zbr*(9Jg-L(4bORyuy;6!^gMLlJA^@T+|YS1zpvn~WbdR`L^p@XP*9$eUMHfWVdE0o
z(k%#f;CwI_e-^{HiG>j>E&f1XC}^JtK~pM7RVdX~^N8GVij@~@?u{!CK!Vpu-qoiI
z0j%a2Ak#b>rb4K?Zl2QJgwNfI6EQqpp$NDNin45;L@ArTHF`HHnDG=>18w_ho;4iC
zX&X?CJdljbyg!o<bvkY*9v67OALXAfKF~>_EftB09~<t}cUSq9_~DVPJrY(mk#R-d
zEmbr|V)89zg&5JeQ`fwUqEZ8EfzrTiuoFrHt<pcps-;EVwho;qo^qYF-qq42ht^@-
z)Ph%!)jCZt%Nu~=50G@Q5b7w}f_Ji6t@Mxk9pwAOa6K)97Y~rgxg9+Lqv4~L>!Wu>
z%<YTEiCfo(7vq}b%Qj3`7`fn@O0@7+tkca~A4TY8TYu201uKc7MMcmC2wc7bBc2T7
zlw8TChw~;s=Dd>ag%Sb9MOVX(vKW+{yHDhw)>~<3z0#$|pV%md?Js18ndMiG(-j9G
zfHK0(c8sb)Wiu|<N3eQ!v`21>SmC98Q+Y4|&@I(_L0pKcCbdTkWqZWB0tY(&BVw(O
z)#N!hxPg-D<&MsfQQ9f|5%+G|4OZx|&|e*<?LN#7+|HM1j3`nPTMK?CJ{d%QSnEbn
zzYjAOqADq^cv>{MC*9i3;j#G$YI~T9ptp(<M~Vcbh^1rdm&?Vhi@u<$CQkirRSVRJ
zgSIMu`$}2|x2gwXqQ65J&{eUj0)^o>L;X{<1uYGE=pV(Jm3bSmhL7jv8=#+fetm<r
zj-JoKAFE-<H&|z#URXZAtArZks|5yK@yV^~)dIX9btuvkRDazs&pi!P@w`nxpVrTJ
zPQz0AuczgS(=gbZ>yk_Jt-Q!5BcuR3>7~eRYWv)rXi#Qjfif*tnw}zAoo^M!u<)Ya
ztYOWT_6Xoh>+NpdEC2yg%%l*FgK-T+33tob!H`tM?GyE8CRK_AwQrv36X9~j!mO*6
z_XY4<Su<&j#{SrdfVVcZ5ka*tGbvUAC69YQMrw(2f7(d<H+PCIvzG>U^dn!?L=b0Z
znoWFV=Eiy79@4pM#o(eQANFD(2gGdg>Zu@$_QbTuwO61xijZm4&=Hq%>=28&>%*8=
z3|d^@D3H-VlZ1Wl%C_RpVB|>czuz3;&&5-jjj6#T{-OjiWg1X<ydJn3AEch;yKg9p
zDX_6ZZD!?2Ob0p?tZ^L-qxlbc@FZp|hb6OFt~$ety37Ijl{2ibyIh^}_h(pZYbw-S
z2{hff@kI@$kgJJ8<IWsWTr$54So>W~est=H*syVMiF05s@D>u<fk7ONp@SWYTMltm
z$=fzs%P%aY2w%c2t>b*943Z)*H~Ze8d~a|VR=(FO-|OQt8I<pAv~p=aKzZT%*jiCj
z2hOQ0#-}N|Ojmu7HQro=8>d@?&<g|@JqB;pQsM%mRS@a0iP;1l>WK3#SH5b5W}4&3
z1i@6;617`dIWzG=M!H<8V9gfn!z3+01bKe}-X)cI6A@+_&i>5LDqCr6r}qzh*6z$w
zkGuJJ7}V*rQp2@ZH`5c1)i{#F;|g-l?>j%yDBmqWCvKb=r9m$pDu&8_)+>xrGXYyZ
zKfvcchOwDhyT2IW!=!}>aDOqv2k$OKfcxYKIJQ94%?e!26`wVl3;WMEm(MVw9>mo<
zVwAQ}(-)?wF%qi?NJBA28iKDza4&X{a=lXEi2V06@eU8q&(6fFO*}WAWu4*r?6|!7
zEDK+r@g?F$(Su=r+XRW7$j4ooTrb9nvIv@j-V{Xgz=w9h(}WAsJ;|3ih3}21Z=x{c
zr`NLFX~7L|)s$!ap1pn?&!JDWQ!8cOU7rril(Vsnk~k$doNa~jKOI&EWFoDf3<!26
z(n8(md^t50{nK%|_iXEoH3^NAu7oQe7gy<Gm<g@NUC!;bDl0RgQ~ul8)-qQ@zx?=Y
zECAKWWrfy?9UdA0>=bP#Hlk5}(6_|dg%|pOo{lEk$3i@lnM4ClqtlmZb&l!r4A728
zR0f47`RUd3QdicT>??%8@%&?<wQ5IDH(|EO^jeaoWoB1Koi3i-WU0AF2B4WVR+yvC
zhy<);*U^bX60@1z`ua7StU=Ej>s15$_-)cpLGBjOo9wuUlBcx$_2^b>Z9?q-U_TX0
zZxOw&feFXnbc5XJZSl@IK<?x=<Se2k<W38t7shfcxqYyyh+jbNbeI-cY{BkYa(mf7
zqX^;@l~5aXM}i?Ti`YGl1t#H(<ujNiLZJw`=~@COQdS8^;y798jhr}H7=w9)*WrU8
zF+$0+=E&_2;JWn%7{qt(7lO#0jUrJ86T=mv3s{lRVO$jD_OVEmJH&LehdI4ZWUAy0
zb#fJ?lC#_E<1E<i1JlgS5-{x(F@I2m3n`c|=0_YAqjI>z5m68oB~=u<;KPv>ER0eR
zec2X8iHJfLtcENM<yJJ6+aFv=Qq^J_F(PoBB<uAFzhC$ZMNu(FVNdwvb2a8na2zk*
zl5r?%4|xh*{2YeCkcgB~=+YjJ+-$1xbEny5E_mZL5{;_KV_BPsfsCr1<sl-eM7TUk
z1aLkIk%BA>f-D*Zg$LKhaA;67qC*){C|66c38Mp1UQRJrL{v<64`DC>eG>&S7U#+e
z(zDEb3R?-yAjJY(x@K0f<_XSzou4?X8D##~hq;_w3+o{Q5+ad^c**VYvKypPtx$F5
zH&P!L1To2p%d9`ePKC}>0ujj<Wlb(DlOK0cV*2j*unPv<R&bouzNl0*w7W!?YfyPk
zP})&^IY;zjb)AyYSGz$DwHd?+rGt4btfL}BrSiGNh5gi|1FVUK*;5oB3J?m5a2fW*
z5D~o4{PN{i?%CkqgKE~bL~kD<UDA7`7GbstCwa1doD-D2NE}0T%*W<{bF0Y5Q-q-n
zWkT=$0NI)p86>GpHUdROS|CNG6s@R|AT^zUh}4kJ<_1dWWf5;4p&AQw?eS|kU9R)W
zF_&{x;k;&w6bw`1Ei;r8v_w@`bby&)TIWNWaY0*EO?oKR*2qaU$!}p;4A7(^SVz3N
z;%JV*LSdtZl0niCU>${Bpo*oWmyaW~LN#G}^P=QbfL5$q;DRSa&B7}l<$B^uyU<VE
zsHSsKiHvOHR~Of9vkJZnVnP&@QHB?_YB?(Hy9m0?dREzp9(sh8<>E;$F?ixyD6u(8
zriidw^PVE?TOwlHmCRX>u?j!C%?i>TVR70~4j~&_(`n5cWy;iaKL@YsqinofmtR6r
zP`fB4^Zca&4q|~-bezQ8)wL9a73OA~IuNsF(`qilH6HTzpqr^CKCglL6GjKYutOdz
zvo70SIU<Zw+>T3rl`P3pR<24eaU??i*Jd&$uJ3Cr$Ux^;i26=$LA?A<twh<Ds&aY%
zb}J{PDN(c}c5w>jwGL~r-`Q^ECDswGiVE4g-SP+KNE%+R?rv_(r!XHYOm(9?ff!i*
z_wTR*o2ntVNjFYSjten~Ph}EY<cHSr1@Cd@mQCHw1M;>V*ffOaLpxA0B{Vj~0K3^u
zXZqZtA7}lD6dnEpsec~UxInL_lif}iThqtTM<i}3=d$?705rk8U~Z=jJe}1;r4}Pn
z%%By1u7B0$YTGERx<=I1iTVc7*u*mBMSD_`NC8pirFE>IgX{>0-@!7h>NCZl*~E3d
zi_45!Q0jW8hl-<`!JQB)+9KPxbLn18Vg^GP5oE8sS+8K#L!8&wyC_1KtNs2ea!2xs
zhx@DLA9i8|9qHNRs218(NKlO_n$W09vG7c>$?X*l?B2`DL##n+MHEV_u1LnpLF=Tb
zewN@~q#}Q8!=q^XAa__n(kwFBT$-4%Z<w-Fy~w^1b|ZnKe$Blnk!YT#2+AJr=UidS
z(VIj|wOQIf#PPuaH;M-!D~I?41)nGWK$XDPJVbsOardBqA?kwxc5@*fMEmdxnC99#
ziuTYPH5b3?Z5{?diC8SH^>X`_R@P;Yv@HmO+{k{2tMq`E0@Oh2Ks^U!irNMudI0fI
z=&-=PJu!ejjy&4}^5~U#e-n^zUui9&%gqg3h1}$(u!AMsdvlX$(?TQv_6CX-95Th6
zyNMe@J6Hq@AuJ`$G1)_v^0ce0oYcdER1h`VJv1h-y2@IEb+T_<g?B?mlq6gzI<&&e
zGK#7+p~FXkU^TylGVFjU1cW|vJ;170afyzguoyP6dK>}kLbRLRtm{uG0_dcv0U4cK
zqpJF!;xdL}VG4K({DE>NHeL|?ma4q~yN^>T(ec2)3)Kc&9AY>4bllI>QgTK2nMQV#
zT2ZuT+X(tuc+ax-d0~_b#E{u9#IP8XPkhNri#>}>Fb)ihHg^Y0^4T$}Bp8EEE!yV?
zs3At%xLD8I6k6YALTZ!j^TLecfI83o8B_GYK2i23`LhhZJw<$@VW{~=Pa(Y^3s+cy
zt9u}XD$#59nqmr{=%eH>p<sq6Vw?K1mrVgGqmY7LF2+^0FjGp<FC(o}<X8I1jU59~
z*44fS`Ba6qHr61FPM4Ti)SV!D6Iv2QTVh`#5jqMEyrN4?aE?c-s34hPF(kSci5`5_
znB(*i$(BVu3LO*1xG6gEIb{mubx_gd?sSW8+$_ajVTwQLnsVXjdXrnUxJP$zK>rw#
z_pyoiVI{do6I(r^-804p<$tvcW5A7rp*=zjh&CqwFOUI>#>$}G+}wXOCJ$YW7t(kR
zUTtkS^G8g2R5Wp_pMqnk1g9F}5D)9X&mdSsG$^V4tX;0U#@gz_^X6-;jm7`Z0FA9H
zS*gkG({4HyOw<;pXK%1tsR8;M5C^OySzr^VHGhANb&mhhS<1eoOmz8XGepzk*2NV1
z=&a2DvXv8)MHDLfUE-K)m>Q}np;6obGV3wC<*9@z=g5!8hGvIB?uKSkHnR<t9Tv6t
z+Li_goW}>jE51cJp$v;jFd`yxK999x2#FLUR3YZ$6Pz)ObR|R9<05MAIEv>`LRX6;
zdX68`Dspk&pi(9(Y*X~2IyoW)0E;ukJhn5as1)e+5O@)e%<)itfXjXu1WB}%?9oY*
zWp%aa!97RhaiEi#RRyQ>XwEG7&1(5brM2ejYUbZ3$}8|~IyHTGvw{2qL3FUwM8tT@
zLmoU~;aN~nH>r95q9Tg+iz$+$>OOy2EWOuSr_hbFNQwT>FUl)%pOftpgYIrtv0v6}
zs*OsUeuZ`y6<zLG4#maxb=O*%>weSC%v6bn3AAhMJfNI@%VGvYV6s9D#eO#+U%A$*
zb>SJf&bpbN`|*taZh)jS?43*#(`j}ZrB+@YsmD^qT<YXWUR|l8E8hS2nKE)ccAI9(
z?bpNDSCM`fvt*5lF)}x}(TGU?I{?bbR`w5tv?_>|c3kh+OikE!&2n$@he7Pb5w-P{
z;15tvyoIbG_kT2S^YF6!IM(CExVvc)%*D_mF|uelf&Bl3O7_Rd#G(f;h?1AOJ_ko+
zW|)OPhlvI1T?z!|O3_k^^A{iUMY9F!b@I8M{wv^kVs@TSvkTR;{k0r>e=yF%Y_kR5
zJEZjF6~Vd}Mq9_srdV7+4T*Ko95%5uKEVvU%M4(O8K2j?Bb*n_b*Ve3swS%BY3Lc*
zyIhq;jTpa!)(B1jQw%$b4HX#mvHKX4h@!LkYn7FkZYzxLh0UNnBy(=SJ{)^ko_7P5
z?(7kHoqpbrXKV%vMEXah-t!XK8BcQ(zGB~MiFT{ca{Nib+07#JhD1wJizV8uUKN9V
z{UI@!)bs^kw3MW=Br%a>QzJLtD<U;%u{tc#Wv%W^cKopZ#eM2~C>(~tVbN)IsK8<w
zz0t}FaAU~~icxFI61FvCiCL>z#i*0JZnVx^Tt|Y_e8Nq3UEY7A6}B`G$GmdSjn*>H
z7_0Sr^)me?Ys>cc+NoxT(wZ|wYer87GXyVESw}K}K&T|hC#~t^cqAGOLB(;OtqL$G
zpSj7(&V3IGEksj#OS))H?@kxJ>BrJR+dNVu-?<5!nDCs&GxkIQ<pmQEE)gZ9m*$h5
zj#^N?m``?Tm{}}J$J}Dp4a)HUmWS>O!i7LnCT_Okp`Q7)GAYm~PWp6-lhnqvMxe5h
z?wMxFu-6<QWiqP?VpK4IyK)IXTS;w?r@!X2&|?&j`Z@F24oan3L_Kw4=Cjj+rVnJ=
zjZXyW5lu<Cm45<(1u@2);db&#znrSJ?hbs?uWVR9_ttYrQY~tTl<{e)y!R{C`mOnj
zU83%RSXi_mitb{5{l@eZQ`NS)y4k+-J2wnTo0;aPjq*RgVr}w$iu{Eb!+%V@SLS~e
zFC;(hm6cz$PK%j6#B4FOHhe&bcp7n|EI{s3Dm*^m=f<%2xDXvlo!m1mf~e68=TjUL
zd{^<C7)A)evKR~DvjA+HTa3B8h3FL+0v^La2a$}=8i^hMqzjA=xutcpmFoJeQRd!^
z6(1GWsb_2al7L?ZP&!()FBcPOo#~=Gy)#pEW%l8ptl=ytuo!{;taYDdl2p2Vqdqa_
z8|49kr-nN;st_#5la6<pN@#>&4Jl!!nK;KyB_eReA&b;oDSv)5-gQ^X>>8_#mZXGe
zb#<t)7K+?S!^l3fpB2W-vgTD!(|epEA5S=*D2^wN(Fjm`ji2O&Y7wF<VU&!w>1EWT
z5iNhCIhCQ0R^(&k!-^0JQS`<A!YCm-%$aAQj0h~FkgNgHP%f33HNtj{E9^Nme~N^;
z21R?0qs_zYZVD|Ka*JU#zBIFEh=t7KrWl9u-iUscJ9={oYJ-Ln!r#hy`wJM8oi+WH
zl*Y%yG=Ghhw^-}8F>5?GG5zc=pbp0Lw<&fUH<gXuy>ye2=tQTB&bZkpT77eiMRR61
zk6rx3(s!%1G{(wrr%z^x=?pdQqjhSJIF=FT74+fC1q}7Nn9tyZ7N8ev)zmqfE2=4p
zr;yw^Q29w3JWONtdGQcy4*6v+pjws?mV(MfjK*2qaB>>RH^N2AX(l(1flYFI@IeNm
zor}hW;^m8p^claH^Y<)`^9{gvima`f%h?@U(#AGx70ey2wk&F5^&nU*O0*BI$G6Q;
zy)fF{7{m7^ivGl5R<jVY#nMf8;(&tC5;B5niOgIL9Rh{vMRPQKGIOiw8+l?j(83Jm
z`Q)CjS&KtaVW4;K%j*h=o<LuKV&);M5zK*er}GE~qH^GC*13xia~Kyvea$)>tt7wJ
z3iwd}C@QT8bG%wvS<4$I8*5?e1C3Gw()MA2VL>l9rFG!RF|_MSSWvnrHrG`!<ceRX
z)s@Ju_pqE<T_Pw0377mMh*Kvfl?^dZ9bO0_HzKiMPbr;bz)1pK)Y%WNY*{7RR!xS)
zbf{Bt4u8EOX$HEvA)sqp*|bWuu9^smsZfWC)+6`aX62l{p-(Z+g&rjvGqZLuEQZ5F
zr-+eLdN+vv4PzUeK)q&R29C>jZo^<CFecx-4d)yJ<3t1lqn>sB>&5u`;}K5b_>Qfc
zUB@01I@)NY=T!38sHDc?I2{#$f|5xyH?|0)UNp9`_EUf(r=@;ch$>}ku@s51ppVvz
z?qzA6l($=7b1fZ|;tuO>oG!cX4xBj*N&60~6pzhy))`yRLiv2625qz(=AAOy)I&5d
zbgyc2;iz(l3wL($ylb3m_?$8tu7+!{en+v-GUU-Z>&#VNY9N^b9D46!*3Vk-Xru9r
zc~)2^?ZU>Husmm%bq*eP?Xp&+Kof&%d~6m@%jb4kt6g}$u?sKWi-w7_CbPxFXmr37
zqvj0Hzc!<c7)upG=O$Sg%3}~$UsFB>$5>|6P8beqhyyD9*l|RDTY^M^U-_9^3OStZ
z-O>?Zv|&hb!N3J#P*&e*m7GRiHQMKbu8S#kG)!H5tumL<Rw5PVA*{KqK>nXQt>Tml
zCdo~0S*48Zwl<(aeR;Qas*k@Aj5l9HEXoTeWyfwS5G(Gb>${zig*gwWUGshy7PHoJ
z<DpO5Vm+FtA?EqBTpg@jTT98!FHp^8sKsK@we9#e;(6IL=}5=6fo)=F+Z1~(_i$$t
z6mxQ8y_FGzMg>LFwr&o**r%lyfpukTcxgHLsD9}3c4}tB)|e$){GBZ3%ZF$HT!gV)
zE#-GPxWZf^YmPc~^9slq!%VDc;f+rXR)EwX?FvK+i^5XUwQBihy_LQi72`u6468P1
zcDY24p6i#@QA}m#%Q~ca7nZim=6H<KLxVhiPiF3@pvhKot*CEiP1u1#7l{%qHmh!R
zCn`>eVw!hA-Fv9J@7LqQoyVy?P1A_1)1?LsJCWK4+9OP>9K2#ggvQY2!g9-?TXx-L
zc`-?R`7R81(0>?sH^$x2)sO@hpxAx=BziwLFKvlAYb04rdYe*6B2~>wn$T=)E$lW?
ziYYY-Yjuh7q+Ux5B~Ng(xdAbut6T>+vUp|^dpu&u(~>0GlKNA`v6P`$iWv7d<q+YU
zYbko=D7`M6VkNt&nid*}oR~_UW18ee>-Lo3CX_rR+LJqyMOSinGByeHsW_8VXKl&t
z$)Yp4i@mB1s)hNel)4&v;uo>z<d$TP%YLAaez*V%GC~t6^OgZLD_ZzNwGNy77J>(q
zHjVn*Fdh}Xi$wpT$wV=oIN`z7A=r*P>zQMVehb(@rJ=n+PCP;zQ>$a$+>&oWB?%G3
zJOkQQjW^kp9TWpbldaILnQ`s{a(B5@M|Eo#7WdQ?1H<kf^pF_DV#o|{(5TI)($ln>
z>ye;C@^(KJk2+y|R~9=YjGi}T|JSYJ^B<{gT9Sx6xTXv6?~!1X{;e7@@pvNQp??c{
zGw^t>iokO<g8sz~V)(bNg#I0PeN%(=ths{rVbBdeUUJZO3_L>k3*wJ(ft<Ss`#Y05
zW$<3?SMjJvJw5VPWU5Hk1fHP_7T2Y_?js*2fW*l{cHe8Q$xfbtU*voh8lVV#1b5<I
zYuSz7Q9#O2GvJ+p8(;Boa0>Ys#^K`6VLE{qj0^A7;hMLU<Fe{LYe_5$@5n;5)LI=)
zXPep$Ok0kq{9rG24v&y#S;t8W!Y__SS}AZj{+#eGxN8=$&jUBnMEDva>Z<~XDi6k8
z8f%&00}O#iYk5{JyorwXPCpL!lngea?PnZ=JB&Y_XT~Jl1q*mFiB7~}qCtPUT#HGR
zMY>#$Up@Q^wyNsMgd40b?!jYjD_7}0@>2fmu~i0OGOn&QBUvr*kLW)Tz;}-`zhP}~
zE$NWO->}Y#<q_iz_|x$N#B>yYI>SIc+=XAH8|a09oG_MB{947>eq(F1xsSF);in6;
zv<dFf3sqtADFAyu$_)9@H>@*a9zYV1<{=n_n}p-wBDg6(%~Nm+?&7VBs~o-7@m551
z8V8e5TeTnZTQLOp$O2y32KO9o*9^mf2&-CU|NYkb(~E(KCrxK{DcqqrT&Kgy56M>J
z8t|C4c2gtJ@CD4)<;_W3_t7>`Di)$(u4EV`Ds1aMx>656C#+T0#jL#TCGaZ1pU(9Z
zB1eolxEt<Z93Fz3$m;NQ#PKBlLij_L>!#&+%vzJXz6G$fctK@?Dt!HM8EAs(sF2Yn
z>$MFL8{Xxr0x5!1ai>xirCJM#9gxO{x<h+#tkaNXdvM$+BAfQ$bu&IV-?_)i%OQTW
z#;}S8Rie|2<>(%3)l!t&3~ycB6hrM@*nIQ88U$;)8>7;<7j$c7(OwWNn3NTJt#i+$
z0#U(qK?^-_lPdV|2W|=jgikhOh52%LueB_@uoq$ZIxGk`#UGb*d%57jeHg0aFnx3%
z?lTF>N_y1GhJ6SO$xZ}joI8XhwfG|*khUmaj_kA6oKrMIesR*$yltjBrP4S!3U?{~
zh)1Ny(eX$#W=}$vHp5VpA{F6J$3CwY?pplm*jxOvrP*4RyM=OVSB)^P)#GTh9Bj6-
z*F}#*rbL6Jf?Up@z@s#-(Q5y#k;D6~C7UV`T5%yOM6<DVp9$#b;?_R6Ta~gj8|SMq
zo%(_zS+*ame-|_%PKin%U%?j)%clL-%EaP+gja8sH|(>rTo?M~AUs_-2|S5s_Qh0@
zL0uub0pP4|-~lV|YAQKQ2sP{T_faL|rzKG`26xpzF)y0LC4~rY*J+!@)_t@GRr8HQ
zy=@OzOR!P6=K-t>UkVOP&(_6d$fme?@ji~Fv$<><VPK(+lymF8s*>jG_g@D}4yns4
z;GQgAusk}8E2t9d;@X&2=qq~RKd$Lr&~n|@2d|eGK1io-TV&OPR_<4~jUqxvTtZE-
ztOovNasE`hsM)dsJmU1LYyvofKiw9#Q#`*Gucoy<BqtuUmYh+Bpb{m*`D)i>w|5{+
zP*VIMo9&%=lozWi#8o2E7Hid}V))gmYTs{MxM1ORHaq$eUKq!+mMPB1cD7)Jpb)|N
zalxA7om5h%h3f2g5<7Jct0!w=xd&mDDvY&H(<!fp|K}8|ycvEqDy}@|A<O3~pO&Q$
z!L(dCENdRZX%`Y@^otFvf|>eaCKbfk=Q61nfX*D-y14It)|sDhbJ9#*Q;+ygbwuHY
zY_DmBsPmQn$&81s!i%muhJYfK8^v+7?Ydd=k88%7>h%Ti{~Q<Bm&>+?t=#PE`w$k@
z3Xl&sa>S<q1|POIo)QHL=paq%YnAYGNa+guTB8hn6E?~ti@pg<7?xGvgiVgf)^A#8
zXVt~g(DCb9<rv~$9z;;-7iG4q_KR8Uf((pC6?Z?(j0*z>_<$Aq2cMAg$l_LORSwnl
zU>r%E<8D}*Rvc^~jdYmTT3AnN5Z~K5{v?-p8Ha$86Fwz8*@`P?%BA-a?0m=Po1>2a
zmdTn&Q1&X>`Utv+d*);>!LS^C1h(wHUO7XNs$}3%9Qu#7%i>27>XS8(^5r#ck6PIm
z?WH1Wn@w3cEp%TH?%|VL=)NiVmBh6TKQNeU&X?1VTDe=BdjT82s0jN>eJf6`(fv*E
zt2~+h{&87#0H?_xz+Fao<~}e)^y1{I^LsEV+YVTHr<WnPPzA#^ua7M)aMvme!2U(_
zFHYml$ngW#77PahZIA~(K3Uvmt=n+0AE9L@bMlygpKfrJ*fBVd70b>xzEo_W4HAC*
zm>h4jmgf{w>^QmTN^5VBnFk?ipDa3v#@x{?D-K#40b2nxo**_o_zU6>>^;#Y2M(fs
zs^$1W(2T+}eo_<!My$?infVxE1!Uo4sB(O<wt}8r6S9H4BeL@`6tPr}KL-9@m^u77
zhE^{gM^X%R<_Dsh)=OR)eH=aEOOpui*eZ{9TK+tvw-G2_1+~<B2W02tR&L_UHp1JB
z<-a^`<(%_MGr*A3p`ARK{B8-tnw^eP4<>cf`0j}GwWIMC%lvlK1rDlJw4)fWj>`t}
zE|DDsU+b3x?I_3V{c@bV%hh8>1`Z+g2i>yhkad>pN5^FSA!{4<Fb*Apc(Kj%khLnS
z0+~Cr60HC~YnAzj>B_rCS$EjV&Uj-Maj32e@MmCmN3HBQj0NR@96gLmu8`A*t#dI3
z3QIIOT#H^Q!OJ_nvPpuMe2I(ouAswlwnPbj(<S{KU}~&W7IpyR)6-QQNQTd6wRhke
zK70>(l>GnPBU_JHc}YRe()dfi3>*Q~{~DChBi5y^zYS9GO4qw1vhRp>R&K{M;uXYI
zow5^{vLAi|E#*j+^gm&($#^1yXrxO@yqLbrvL~!%XFOM>{k?digwNIBA@JwmT8$N1
z<KrRO1-iK(&%r+$*R+&`j8BT>=o4Ve>PC3H$qxd9zBM6(Pr@MjfZ_*s`6?LiwJM*4
zP|`8f!83O;Y0pSp!_n+#mdWuaiTyf+V>&XwGN4QU+yMNG<NS3xoKuN(q7t&ZWoaiW
z(j%KYA@fVdWiPzXxO5cB;@gxacj?UM{584D{BjQI5-;nb?26^~hpfzv=4F$(EpI}p
z_12a}TOUZ=+MIOJ!|sQ~g9-aRJe$Hu0VyDltA}v*2dlGBS!)ZF2+c~AIRi{YsT+Q9
z%>!$<HlK3E!9d&61Ir#={z$NO#Wz<zyy~G)%j*5%ed``iH?!o(Q<!_QZKd-$f+@Q?
zD(MN#_fp!f4ysAQ+|Ga-HRh{ffm<~uEir&QHO65t#=RQzp+MVpgj+r6C3E-=*O9P}
z;AIcjk*LNg3V)C4gcwNGcu-?Ls%pEwH>|Nwg}?gxFTQ2@%oxiWUevLkWrGz8#*grY
z0Mth5N4VTJ%qRi;2uJb9<uQyC@4<bYZFsnxa8q~<{`e<U_?@4_57<VG%kRS~043;f
zmasH_hL*74U!(C0z$Ca@jbF44d^=zPzXDvpfD`@#JOLci@xMo_TEKWa!TJ3VyN;77
zLPUG~oR+qLvF6SZ-Uc28b_o0in6%Ze!+(z(IVpaj#($(6I^*y(Flj<ihyNXz3gE>5
z1UDI^9EXQ4k(q+Ut0=H$$P5D4E+jBd0qzE_Py|g>nOf}9cni*31>@3}0ha=o>u^+2
zS{JaEs2RHr3tJ>Yhv0qALYGePO<+n8)%a=P3E)<ZA@X!$&>{E}U@8z6lu3f-JGP-#
zy)=fz)T)=lG4p*aSCO&{<>5*MCZ!B$ycoC;xJct%V5;K+jaLBo0MBWhPY1$)ClyY-
z602D)z*?fND6MXRF%=#&T$kIfZwwN%U>EJj^(EU_(gA*Sox7@S*L_j=H|g-(Z9^@G
z=?w3+4YeGmaWgP6sO#9(2HXp*CFJU`-M3J<0KIgaW^z3Tj|RsBxEHuC4!;geO4LOO
z5dOb#UMdq<>x^pzxCwYvGw?^muLkA}5dS0Kng#66uwDDcfvZ3-h7!A1@*<mI4k!Zd
zQ*GD1O^D!AC3c@}<4hH>Ux!}|90b-?<gNfN0`Aq})xcB0#TwshyM7n~)(p8@>1-9S
z*M-}IDUWC2L3P}!6MWxUh0_>HrB>lI{tsG&LzQWU1@;a0k_0^<274${fScklbY^ui
zVU=EN04@a%;U*JeK%5H?61fxMa$2r~=!8yC34$a6oU7yv>VU~|kq9ZnM%!3RRWz*Q
zA9U98G=|{{gJI*C#;>AEYKdM91W>2q$F^}w2|Tn`i(dj0!LUv+1x#A44T(4bJOr#o
zyeQdrJ#~!ID~1+jVP%gPo>b`<Z9q7z`64PU7+$oQR{jtk>(mjhunn~YsPRtQHQ<8;
zC;=E;bR)u#BSEtczY~YnDu6pQZnDkq31HMI5*dpQ*yi^qQ9xpt@DYTA9=(2J++&-4
zgUH{c5>SNKZS&Q50zU)xgCHpth5r&51h|R_|2r^AAf&_J2cC)xKViFy27!eNPk>!f
zi<iJCQ$iXRD2t(gMydA5qZLbp)oF}YaT?N_5si^LKLQUYd?RpY96rZ3PWJ*A>iCxe
z7Xwp?DMPf9Gf*H?S82jmY-3}T^v}rvrnrEVqCqEshzlS>S5)JDwsCd{;gcG-*{;3a
zz&=n%GfsFOxC7X$G3<m|1l94;xt)Z61<d__rjGFc!6P388a18-?gh@*_+8-fh44g^
z&inyatMEja>P@7C4i4GIIYHoZ9eyS-S-w7vFG2s04^6?cX^$N^-!}wYt8o=Ar2-FW
zyc>81IHd6&ER~XuXptr!MzaER3{4{J%H}AruHwXggjdCdzm5KXb1OWw$P>pAp(rlG
zH15b0zz#zn1J?l;DF!^Lz$76Z?paD#XabMx@bz?b5V&3ALeS3y)|Sw7e$2-5EIc%a
zo+}U`5EtRgz(mkVa1-Jmht7C4!8(MKgs9HZOg&A&L15Ae!UvpXUL7AJtgR7*M>LK-
zLzh6pqe6RpAGi;=RpXz)(zOA*KoEw*^9wqY2wbegC+HSP;1Z4B10DvRRyfIPyMB5p
zFj-D8l(ZE1k_8;|{M|OxQm{^dW_BT!cu->uLN6Rc{<_3TSEySaSt4L4>1x~6*@gJH
z)PWdGLg#bwBydotzuU%cIp7+NVFpWTfomDZjHDmJ0~r`qI>OJ90qF#ZoCyBPHq^SY
z4oBy6$q2%AD@pncH$9dBcdBq}IWQP7JsPj0iywhihK6+!UAl<)lN65jZ{1=WYGqg_
zxCgiw5wsFn?Y6OvbVQ5TdJcFLxI@SPS1kC}0GDa}J7)n{<39mUAUvY+40OZ?Oa+Xg
zPOML{l<S3uUqwj94GbsYC7;8qKZj5M9Nr8ZTF5ZD1h@=X7a$o!GPRVf`~T#d;n9f*
z+E66d0^4yImT*TgaGhqb8Mq&~P~*qxzD3|tjr;JW??T{wjekbp3y;IUr7wX4*XjO0
z8QrT|G1duYfvXWgE0GrxQLDr%+#3L<40RQGPqU3HhoPiehrETh>ot<7ZnoZH+r^!g
zgD(Rfq;TE;dv`#Ksl-J}>Acq?0@^vQFXCq7y#wKtK#y>|F@%q3j4Je^FX#jV-0q>Y
z-lq{h6&L<pgp-mx>3?J!6=C35RF~-2@Th@@7Mb^tz$79^0%)dc30uWa$)r=W2-iB3
z5_FcVbvPy}YQb9LjhKQ`mFZTM0v(}+>zHFoQ!YjC)rbfIlo-8P3M8_ZINYIeC4Ex>
zSTmIJHQ;jKN}a(sY}X!QC_~487~y@ux_~L|2&V#)ogn%!eAlD@F_Lw&N%@}bY8pj^
zEFIxrfv4gKjsR1JP6ofVT`>}=6aP=ZRE17BB=)r^a6mDb>H@9=)&)rQ0XL%kJEk^u
z83<4bQxyZLFdVfW*a#=Vxwh+`HiW0^a16t5gM>_>Gr*ATK1#3q|5Oz3_6U?xo9fg%
za7|+!!X1VhfMc!j(7jXYArJ@xI~hPky9n!Mm5Kp{TBg?-z5z_>8#Nw-gyw*q0zilE
zqyiW^d<NkS2v1W5NHZb--H71W`m{7e5DNs-(9CuZ1M3XZ&VYo7fUd)|3$Zd!c0o%h
z?L1&=wwmFzoxpv-MT&v68)zjT4C%fg?N;>vccV^CC&7KT@%1hw=+g;WZKI(K;XaL@
zu#J1F5Z<YAFEC2%4B^sV1B0~)cNqMMZQO?{az@Q*W9phm$1bG(0qr<OCCJty`5O}S
zqR#qt2A^OmMs=E^!hIOU-d}|b3skso6-3w$tR>{bRBewB@#l2-#n2h55<N!rK_Yv-
zz)d<lb}b?l!b5ZHLuaJkN$3c>ZDU^$;lmm?0Z##ITkbnT?;n621~Ai6?;&)2m}2$*
zL1Rc{e-q+YDjf5Tz+)U9^*RC!(E||qJcen0U<laB;A5OGjxJP5dLjxyBGwX0UyL^m
zlwS7@>6pwm)c|XyOh1S25d^N~{9;D>Rzw(v2bo3~hV*Upssc{0VkrGOgdan=mQXqj
zPb(mu0fuTD>6qO%Q59;fPJa-%D2^Vw??+Jut^pnYIaE32$MMnr)BE5t01u}G|AIrw
z{lMBVrN2qv5C@KG0+Ya$p{?-;w(I^`VBKsp(5xOOooP|w89pdo2v~PM87ncsAqfzU
zp|i+9@AWv9P>VQY6A}dD5|ki8v&Ix3!}NC28O>0}SJ1gYX&u|1f$qA!0TS%c3^XEr
zQ(X8rfe}veV>HCdI0BExxCq|{0|AZEyJftJRxk;y>oDWTz@xxUiQmHMX&<oGp$rU4
zJHW8nsu}njbc96iq=ybYLGc@O|Gzj19wZWvO0YPG-Uk66*Z33+nWDg2go`ngd9oUK
zT!&wSH$xO2(s&oWDFW7Yz8E^OZv>dqL&p|lP3S2U&>V>A1W)5w_HihQR=UNn;5haK
zB9!XzpW>`_1ZjgBqw~3^76i53SPWD9d@17h=y2%7J;eyu?LHGa@d7FJgbH6dg#wi!
zJf=&OnF@~*cu*^V$TMMj)q5+IAhQt1rM(Cr(-__Ly_A9O?J}=I_$08d^URwOUIDDD
zC?#U+H(NUWZj1-|sQ)JhpaYrrBf<bmP^crc;1ISA0__?frrR%phcy17ZKyX~8bd<g
z9YJ`5#=o?UJ}`)5z#t0x6X@JL2-gzJoCbq4$bY^B81wbdBEqCfkOf2X>Ns$%#;4lG
zYa}5DV;uh)nyJ&fWmVY5>%h)rHVc+>pgayg0*oqf`j)K27?8A3|DU9kBI`NZ_(3;T
zHvBrn@1qW<5w7bn>tAi-N5>ZWhOBo`f?9;@D#-esZTz?n;aX|4NC$`kzoMTF9T<W{
z%uGc;8@=tlu|Y)8%_2Jw&9EL=S4norHhxBRSfCT+1Gger8=mZoq1B@Z*8`4hNZ^e|
zU~NYh!}7feEqA)#?5_ZWp4qGEK|-;&1hleGdq4+9`;lN);{*86aW8PQ#!uSDFZ02G
zgVEXin&MCE@SkARI}EIqI{Qsn)=FS4!R+7I#&5cSwdu~DLjOP3366AcmW}Q<){F>?
zmB^N0-2dB2FsPMo3GBjDAHp?*OIG8!a1UP6XuGjwBMcW9bQoB20qAuD>nd7OhB_x5
z(h^^CE&BgvFyL^w<aR_TSV)kII(j*(!_i8X+y{akz*^)>&`SOc2AuVPC9tHiAi{OC
zTk<>(`9ebT;WR+;#)ZewAOF`NN@yq%F8MV&6O@=I9<WqP{s4R&Sc`B81}J|+{CR>W
z5Dx5Q=uf8eyXY*ng#1ge_FD+E!d)eFaRmxoh4?hl0sWYt7MqD9oq>N7v~~<wi_Cu^
z!bypAyY+9UZ`A>lRzo8Gn{baEM4Vr(3gEBBf<+6$wG#X9#y95XfTKFR5oa}v(EHXf
zjv4NQNKhM>-~r$|U_Djx9|A+oz`FnUKZA)0iBvZ$e;?kvQXLoR41R_Z6T?~w{qN9w
zS;WuR;s0T~UZesBsQ_sI{*P=|g9jeE#5qZ}>si~0U>G^*ufJ0fhYN9Juo8BnP7%yO
zGo-hBu3-@LA^w+u2N9nNfVY1+=$`rQAYr^6%-L<5>8K)JJ*W9+&iy!4NF^N61Y2w~
zvkVb*JI%r5@?MnKkw8u-a8De@T5cAJSa&`-KgSx+Wx#sPC+FWFL6VT3DdqeLeN8zq
zB!ux77<doOCZaqTe~KYgCa@k-<y!dM5|oH_1a+R9g;qj3<Ag&(dr0J3M{-X?`u4c+
zBBU>gOAm?N+XgIX{RLW>TLA_N;GsFrtpY(3xs$<dw(ILNz%(7F`1hcMrE&40Gxr<=
z*3B~aF=RjtXgiYoEie=Ub{KpK3=w@F$)8GucG*NCaw7Z`xCJ;_XE=&xQv|$HV-hLq
z+7W5)U!Zh;V6Akyu>B3Qz)Mv8yhXqhz?yy@B-k(n9Lv!WR>Pw=F2R|=R01c#g|_Ri
zDkxdIj*n*8(1dVpX!35r3x*Eh5W-QQyqghT2dpKSS8uzXBZi4V3U9)gF--k`gZ6k7
z32G35v=k!FgUDX=0GH|TSFxl50?rGGJSbTwiPRzZ8>A<ZYSWtcpTJZ_x=Ql?VY{YA
zb$sYtAQ2LaQ2(z*7RW{kh=F{SVITxt7>7?sf?ynh&A_BHPWnrL^W!iUFd8UaOE7Sw
zZN3%+rgo2p7Pu1y=tKUFRtN6GD-l4P(^L`A3|}McBsdHlg^uDsCeVf6&PF(ukV=Gk
zMCSxBNf06qU;*Q)NF06}N=-UJ1%!kH7!mE^nTX@@9tZ>xL5p;$3nj|b7#S=jTkea)
zr+@&}xlX_IY}@r@74V>9VCh!uV*utV14BzMheYC<=~B!+V?TrvI3iqntL=((K_EU5
zfQXi2;;_64g>mqsw)qbb3_JK4+k8E07*PlJqX1LJyabj)M_!!+rf@0%7ARh70WQ-F
zzH7%^FOf({gy3))n#oIJz(I{MB6`WQkYE`WAYN*Si;tPnOBHePF;{#sE`w!v0mswF
z%;&}U^v|IGe=(lG>#+6l1W;$+i6<}#JQkPX$G~w6E>8!J%V7Ch+tm|CZ~1w^arBnQ
z%Ha`5a5<`=C!XLQ;CO-(xMG2U<uBW=Z^vga1RS3M4Ar;e>D$0@^kYG^!*9oB5L^lz
zmq8E<hcCos5WEyPE`uOU^$T$s1n&lp%OLm&a6ElXzh79OA2WhKuwBo`X8=?Ce0&C2
z*LyxbgE`>13|1@#j>}*LTE+7V85k?J*skt4`YWyio~MuYzXBtc?zjwA>;;a`;0SPh
z2Hypa&){b;t??O*1J7pw`tJkB(O>BS_M-}^70~>D<#P1L0v_6stc2}<u4bW*S5jZj
zKedl%<<1i)PE0Ew+V``v5||7TevH5Jx$xUn7}~iCk4qo>9}&3wzbEiNN`L=<n;uto
z|4&Nr&Ht9b|1ACEpG!ZFaaj~IFz=!9Q#LjOB2i%m8GK{qGm!595rO?BjNb6&3P5uO
z8?KdDoIctShhgbnE&~=YdsM}Lz@V0@*ul1Key0vNW-Mj%yb^}wXv0E;RhZ<xOc8|2
zU=<9@(I<g*hO1WC=4D;L#frgIXWQmW-N2gOs;F)DP`HE9J07LpP&2UVOSXB*IORX1
z31H@Pv@tHi9@`{(t`f!Is)uNUC<a7LI=-~^UOtUq1_LB9C&Sl)CkQKvt@;s4944&k
z{oJPQnAHDk0@z@H6>=jztRwsu6AconmOvWD`Cia6N_BjU<6o`>&eRh6D-t(BKu(4q
zU^YC9@Q{u_N9R3(3lt6|pumIF|LY7we%tkvLf}QHGyES~kL`42z@^9)bsjnk30?$t
zsSHEtUVFQMZ&Gy}+DV5<fk$)(*Q1IiQT-Dd*C9Q1=czh=0Qto>gSJ;^_y9yM5J8J5
z^aveC1@veF9jMc`xbSCTCwP3I3BF`wfeB*^TQmH9+kCJY<(bN09Si-7ZNAtUmmXCR
z+k-k!@aPEdfJ3Syk1ioB*-;YNpvr*W5#3b`900}$CIqcMN`^`+RS0`Pdg_3k0$@6S
zbO>;<qPN<_F#k*nR|Q_3Xvf^QP#qEh{J%O2N>NK#m3Va!I?zv86Icf&LgAbYR&Ruo
zRm9;UWQY<Qx|OUhwp~#QCY>OLziJzaqku)gCh{wdK_pZH&GBk<4oANO=n%LGcnVmT
zaP=<WCc>Jby?V?@8DPY;`XH1NO6#W5pxv*267jnb-=i_A<fS@bC%@P+jM1XNK@gw>
z|J!!`8L-I_(XTLs8ia>~$LMe})~q60Lg>$rQk`ms*I<#!;|DHOC0vsMi4Fj3JFzBU
zn=h1sSD{*2Y|ScYaXTXD60SKN1jm4Vs)TDc+vdd{Bsi`zT!Uft(H?|58KVC``a~SA
zgG8xHbqRACYy$XchVIn`Hb5^0?VnyW)>E7v5E1HV%|4XC3+&Yi9!CZ(lwLFR1Tr8c
z)ETVlhK~FY@ERrJHRzs??gw@l9I#zcKxP0{v<4fS)Q)E=5ZeEm-y^{;gqxbcU!lcS
zlt77StqT%r1=JE+n+cKD0hcI=tX-z!yBl<TjQM_AhN^4=J^a7606KxP7-2<!EhO4A
z0!;L2{<-!dFmMdm$>2&vnA8y{e1ju0P=SuD#VGga5rpd!uDul!A&EH**Q1qG#Nlrs
z{+$$GGw>*IEijar*Z<dIQ2BBjdFTkwLPVp$+H|fR07Ff{P6j_lhNM&uegi8Uy?{;z
zzeWaxb(O7!o!}J^(g7;KpXty&!lN0GKb4TQxE>x319QN2z?xt<86vL&)|N1w>+CI8
zRS;fdn|p!?uT+LCj0K3^4q#0$jG58PR|9K_g)e}F`hks@s<ZIrC{aFnX#6E?wQhpe
zmxE(482*ZF-VUudi*<M{+VNmq{JUZ6{lG1np+_*Js{kej@PC->0MU0CdI9SRB%u@%
z3A8>8t?e6-qi<QKy?(*l);W2y`OnsSa_?WPO!?ejtQ=3>op;=H{hfE*_WJ98vCd3N
zy77)X>aV}y&YO3?{$GE`?Q-(!S)Ag0X+qY`;!s9$uN<7UmRZQbwLb#$+b4Y=S<4cz
zY2MW_F1;UFD-$~K4YQ7E?Z(&MI_9*y)o>m0YIi5x0olv(LF-6F9w+w^KinM@XVs!G
zoINu1v9;2I9djKS#Bx%DEc+PQp~_v~FO>BNOZeU(+)>%d?qRq~<Pf=G+pw%4r$5Fy
z1w1o9vDPHKR*wbY^)mX2wZiTG>}gs3iM2Y>{n?*!E6_gK_6bs@)netPR}R4KTJ4wP
zlxi)+|Np)vJ#+Az`=gA^f#RnDSw4rvp3lk*^WtLJgusLgVeL+@mObRYdlpJA<S5*!
tPs|y{X%ncE<*4_sAO6(JO?YD*HS+@*{1iuG|9%M7za7EO4{Bi;{}(UI*ggON

diff --git a/roms/seabios-hppa b/roms/seabios-hppa
index 1cfbe76ff6..673d2595d4 160000
--- a/roms/seabios-hppa
+++ b/roms/seabios-hppa
@@ -1 +1 @@
-Subproject commit 1cfbe76ff625fce9ed5991f7e13d80ffec900f40
+Subproject commit 673d2595d4f773cc266cbf8dbaf2f475a6adb949

From 981562ed2baaa28067b7ba77fb579d0878782000 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 31 May 2023 11:23:09 +1000
Subject: [PATCH 0103/1353] target/ppc: gdbstub init spr gdb_id for all CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make sure each CPU gets its state set up for gdb, not just the ones
before PowerPCCPUClass has had its gdb state set up.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/gdbstub.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/target/ppc/gdbstub.c b/target/ppc/gdbstub.c
index 63c9abe4f1..ca39efdc35 100644
--- a/target/ppc/gdbstub.c
+++ b/target/ppc/gdbstub.c
@@ -327,6 +327,25 @@ void ppc_gdb_gen_spr_xml(PowerPCCPU *cpu)
     unsigned int num_regs = 0;
     int i;
 
+    for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
+        ppc_spr_t *spr = &env->spr_cb[i];
+
+        if (!spr->name) {
+            continue;
+        }
+
+        /*
+         * GDB identifies registers based on the order they are
+         * presented in the XML. These ids will not match QEMU's
+         * representation (which follows the PowerISA).
+         *
+         * Store the position of the current register description so
+         * we can make the correspondence later.
+         */
+        spr->gdb_id = num_regs;
+        num_regs++;
+    }
+
     if (pcc->gdb_spr_xml) {
         return;
     }
@@ -348,17 +367,6 @@ void ppc_gdb_gen_spr_xml(PowerPCCPU *cpu)
 
         g_string_append_printf(xml, " bitsize=\"%d\"", TARGET_LONG_BITS);
         g_string_append(xml, " group=\"spr\"/>");
-
-        /*
-         * GDB identifies registers based on the order they are
-         * presented in the XML. These ids will not match QEMU's
-         * representation (which follows the PowerISA).
-         *
-         * Store the position of the current register description so
-         * we can make the correspondence later.
-         */
-        spr->gdb_id = num_regs;
-        num_regs++;
     }
 
     g_string_append(xml, "</feature>");

From b08e8a837ec91fc8dd84aa487876b9f244fc2677 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 20 Jun 2023 09:06:36 +0930
Subject: [PATCH 0104/1353] ppc/pnv/pci: Clean up error messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The phb error macros add a newline for you, so remove the second one to
avoid double whitespace.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/pci-host/pnv_phb4.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 542f9e2932..6232cbeee1 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -133,13 +133,13 @@ static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
     PCIDevice *pdev;
 
     if (size != 4) {
-        phb_error(phb, "rc_config_write invalid size %d\n", size);
+        phb_error(phb, "rc_config_write invalid size %d", size);
         return;
     }
 
     pdev = pci_find_device(pci->bus, 0, 0);
     if (!pdev) {
-        phb_error(phb, "rc_config_write device not found\n");
+        phb_error(phb, "rc_config_write device not found");
         return;
     }
 
@@ -155,13 +155,13 @@ static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
     uint64_t val;
 
     if (size != 4) {
-        phb_error(phb, "rc_config_read invalid size %d\n", size);
+        phb_error(phb, "rc_config_read invalid size %d", size);
         return ~0ull;
     }
 
     pdev = pci_find_device(pci->bus, 0, 0);
     if (!pdev) {
-        phb_error(phb, "rc_config_read device not found\n");
+        phb_error(phb, "rc_config_read device not found");
         return ~0ull;
     }
 
@@ -1039,19 +1039,19 @@ static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] &
             (PEC_NEST_STK_BAR_EN_MMIO0 |
              PEC_NEST_STK_BAR_EN_MMIO1)) {
-            phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+            phb_pec_error(pec, "Changing enabled BAR unsupported");
         }
         phb->nest_regs[reg] = val & 0xffffffffff000000ull;
         break;
     case PEC_NEST_STK_PHB_REGS_BAR:
         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
-            phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+            phb_pec_error(pec, "Changing enabled BAR unsupported");
         }
         phb->nest_regs[reg] = val & 0xffffffffffc00000ull;
         break;
     case PEC_NEST_STK_INT_BAR:
         if (phb->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
-            phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+            phb_pec_error(pec, "Changing enabled BAR unsupported");
         }
         phb->nest_regs[reg] = val & 0xfffffff000000000ull;
         break;

From 602b88ec8a204cc44821217c0ceff5a395cf820b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:03 +0200
Subject: [PATCH 0105/1353] MAINTAINERS: Add reviewers for PowerNV baremetal
 emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fred and Nick have been hacking baremetal POWER systems (OPAL) for
many years. They use and modify the QEMU models regularly. Add them as
PowerNV reviewers.

Cc: Frédéric Barrat <fbarrat@linux.ibm.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 7f323cd2eb..06c746370c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1451,6 +1451,8 @@ F: tests/avocado/ppc_pseries.py
 
 PowerNV (Non-Virtualized)
 M: Cédric Le Goater <clg@kaod.org>
+R: Frédéric Barrat <fbarrat@linux.ibm.com>
+R: Nicholas Piggin <npiggin@gmail.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: docs/system/ppc/powernv.rst

From 58fc20f0e384177e78346630cdf8c72f538d167e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:04 +0200
Subject: [PATCH 0106/1353] MAINTAINERS: Add reviewer for PowerPC TCG CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nick has great knowledge of the PowerPC CPUs, software and hardware.
Add him as a reviewer on CPU TCG modeling.

Cc: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 06c746370c..eeb071efdb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -302,6 +302,7 @@ M: Daniel Henrique Barboza <danielhb413@gmail.com>
 R: Cédric Le Goater <clg@kaod.org>
 R: David Gibson <david@gibson.dropbear.id.au>
 R: Greg Kurz <groug@kaod.org>
+R: Nicholas Piggin <npiggin@gmail.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: target/ppc/

From 4901a34d26a686d41647d34b04a4e0c6ea81bd6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:05 +0200
Subject: [PATCH 0107/1353] MAINTAINERS: Add reviewer for XIVE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fred discusses frequently with the IBM HW designers, he is fluent in
XIVE logic, add him as a reviewer.

Cc: Frédéric Barrat <fbarrat@linux.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index eeb071efdb..e07746ac7d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2448,6 +2448,7 @@ T: git https://github.com/philmd/qemu.git fw_cfg-next
 
 XIVE
 M: Cédric Le Goater <clg@kaod.org>
+R: Frédéric Barrat <fbarrat@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/*/*xive*

From 9df480db3bb89152821a74b28c8fb385956702a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:06 +0200
Subject: [PATCH 0108/1353] ppc/prep: Report an error when run with KVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'prep' machine never supported KVM. This piece of code was
probably inherited from another model.

Cc: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/prep.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 33bf232f8b..d9231c7317 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -45,7 +45,6 @@
 #include "trace.h"
 #include "elf.h"
 #include "qemu/units.h"
-#include "kvm_ppc.h"
 
 /* SMP is not enabled, for now */
 #define MAX_CPUS 1
@@ -245,6 +244,12 @@ static void ibm_40p_init(MachineState *machine)
     long kernel_size = 0, initrd_size = 0;
     char boot_device;
 
+    if (kvm_enabled()) {
+        error_report("machine %s does not support the KVM accelerator",
+                     MACHINE_GET_CLASS(machine)->name);
+        exit(EXIT_FAILURE);
+    }
+
     /* init CPU */
     cpu = POWERPC_CPU(cpu_create(machine->cpu_type));
     env = &cpu->env;
@@ -392,18 +397,7 @@ static void ibm_40p_init(MachineState *machine)
     fw_cfg_add_i16(fw_cfg, FW_CFG_PPC_HEIGHT, graphic_height);
     fw_cfg_add_i16(fw_cfg, FW_CFG_PPC_DEPTH, graphic_depth);
 
-    fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_IS_KVM, kvm_enabled());
-    if (kvm_enabled()) {
-        uint8_t *hypercall;
-
-        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, kvmppc_get_tbfreq());
-        hypercall = g_malloc(16);
-        kvmppc_get_hypercall(env, hypercall, 16);
-        fw_cfg_add_bytes(fw_cfg, FW_CFG_PPC_KVM_HC, hypercall, 16);
-        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_KVM_PID, getpid());
-    } else {
-        fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, NANOSECONDS_PER_SECOND);
-    }
+    fw_cfg_add_i32(fw_cfg, FW_CFG_PPC_TBFREQ, NANOSECONDS_PER_SECOND);
     fw_cfg_add_i16(fw_cfg, FW_CFG_BOOT_DEVICE, boot_device);
     qemu_register_boot_set(fw_cfg_boot_set, fw_cfg);
 

From 74b2fd630761b3e3fe39a5314fcec04829060502 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:09 +0200
Subject: [PATCH 0109/1353] ppc/bamboo: Report an error when run with KVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'bamboo' machine was used as a KVM platform in the early days (~2008).
It clearly doesn't support it anymore.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/ppc440_bamboo.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index f969fa3c29..f061b8cf3b 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -19,7 +19,6 @@
 #include "hw/pci/pci.h"
 #include "hw/boards.h"
 #include "sysemu/kvm.h"
-#include "kvm_ppc.h"
 #include "sysemu/device_tree.h"
 #include "hw/loader.h"
 #include "elf.h"
@@ -97,16 +96,6 @@ static int bamboo_load_device_tree(MachineState *machine,
         fprintf(stderr, "couldn't set /chosen/bootargs\n");
     }
 
-    /*
-     * Copy data from the host device tree into the guest. Since the guest can
-     * directly access the timebase without host involvement, we must expose
-     * the correct frequencies.
-     */
-    if (kvm_enabled()) {
-        tb_freq = kvmppc_get_tbfreq();
-        clock_freq = kvmppc_get_clockfreq();
-    }
-
     qemu_fdt_setprop_cell(fdt, "/cpus/cpu@0", "clock-frequency",
                           clock_freq);
     qemu_fdt_setprop_cell(fdt, "/cpus/cpu@0", "timebase-frequency",
@@ -175,6 +164,12 @@ static void bamboo_init(MachineState *machine)
     int success;
     int i;
 
+    if (kvm_enabled()) {
+        error_report("machine %s does not support the KVM accelerator",
+                     MACHINE_GET_CLASS(machine)->name);
+        exit(EXIT_FAILURE);
+    }
+
     cpu = POWERPC_CPU(cpu_create(machine->cpu_type));
     env = &cpu->env;
 

From 518f72ec4bb395647921d5091d85c7335c3968ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:10 +0200
Subject: [PATCH 0110/1353] ppc/pnv: Rephrase error when run with KVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/pnv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 590fc64b32..fc083173f3 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -799,7 +799,8 @@ static void pnv_init(MachineState *machine)
     DeviceState *dev;
 
     if (kvm_enabled()) {
-        error_report("The powernv machine does not work with KVM acceleration");
+        error_report("machine %s does not support the KVM accelerator",
+                     mc->name);
         exit(EXIT_FAILURE);
     }
 

From c4550e6e9824c3fb5ee980cc8c9b175b8baf3d1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Tue, 20 Jun 2023 07:59:11 +0200
Subject: [PATCH 0111/1353] target/ppc: Fix timer register accessors when !KVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the Timer Control and Timer Status registers are modified, avoid
calling the KVM backend when not available

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/kvm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index a7f2de9d10..a8a935e267 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1728,6 +1728,10 @@ int kvmppc_or_tsr_bits(PowerPCCPU *cpu, uint32_t tsr_bits)
         .addr = (uintptr_t) &bits,
     };
 
+    if (!kvm_enabled()) {
+        return 0;
+    }
+
     return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 }
 
@@ -1741,6 +1745,10 @@ int kvmppc_clear_tsr_bits(PowerPCCPU *cpu, uint32_t tsr_bits)
         .addr = (uintptr_t) &bits,
     };
 
+    if (!kvm_enabled()) {
+        return 0;
+    }
+
     return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 }
 
@@ -1755,6 +1763,10 @@ int kvmppc_set_tcr(PowerPCCPU *cpu)
         .addr = (uintptr_t) &tcr,
     };
 
+    if (!kvm_enabled()) {
+        return 0;
+    }
+
     return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 }
 

From cb2f6c3d69ea5b5bdc37c8330266ab67db629fc5 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 20:57:34 +1000
Subject: [PATCH 0112/1353] ppc/spapr: H_ENTER_NESTED should restore host XER
 ca field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix missing env->ca restore when going from L2 back to the host.

Fixes: 120f738a467 ("spapr: implement nested-hv capability for the virtual hypervisor")
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/spapr_hcall.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index b904755575..0582b524d1 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1773,6 +1773,7 @@ out_restore_l1:
     env->cfar = spapr_cpu->nested_host_state->cfar;
     env->xer = spapr_cpu->nested_host_state->xer;
     env->so = spapr_cpu->nested_host_state->so;
+    env->ca = spapr_cpu->nested_host_state->ca;
     env->ov = spapr_cpu->nested_host_state->ov;
     env->ov32 = spapr_cpu->nested_host_state->ov32;
     env->ca32 = spapr_cpu->nested_host_state->ca32;

From c709e8eacd5578f84c0dffbfe65a743a281d1d46 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 20:57:35 +1000
Subject: [PATCH 0113/1353] ppc/spapr: Add a nested state struct
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than use a copy of CPUPPCState to store the host state while
the environment has been switched to the L2, use a new struct for
this purpose.

Have helper functions to save and load this host state.

Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/spapr_hcall.c            | 150 ++++++++++++++++++++++++--------
 include/hw/ppc/spapr_cpu_core.h |   5 +-
 2 files changed, 115 insertions(+), 40 deletions(-)

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 0582b524d1..d5b8d54692 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1546,6 +1546,112 @@ static target_ulong h_copy_tofrom_guest(PowerPCCPU *cpu,
     return H_FUNCTION;
 }
 
+struct nested_ppc_state {
+    uint64_t gpr[32];
+    uint64_t lr;
+    uint64_t ctr;
+    uint64_t cfar;
+    uint64_t msr;
+    uint64_t nip;
+    uint32_t cr;
+
+    uint64_t xer;
+
+    uint64_t lpcr;
+    uint64_t lpidr;
+    uint64_t pidr;
+    uint64_t pcr;
+    uint64_t dpdes;
+    uint64_t hfscr;
+    uint64_t srr0;
+    uint64_t srr1;
+    uint64_t sprg0;
+    uint64_t sprg1;
+    uint64_t sprg2;
+    uint64_t sprg3;
+    uint64_t ppr;
+
+    int64_t tb_offset;
+};
+
+static void nested_save_state(struct nested_ppc_state *save, PowerPCCPU *cpu)
+{
+    CPUPPCState *env = &cpu->env;
+
+    memcpy(save->gpr, env->gpr, sizeof(save->gpr));
+
+    save->lr = env->lr;
+    save->ctr = env->ctr;
+    save->cfar = env->cfar;
+    save->msr = env->msr;
+    save->nip = env->nip;
+
+    save->cr = ppc_get_cr(env);
+    save->xer = cpu_read_xer(env);
+
+    save->lpcr = env->spr[SPR_LPCR];
+    save->lpidr = env->spr[SPR_LPIDR];
+    save->pcr = env->spr[SPR_PCR];
+    save->dpdes = env->spr[SPR_DPDES];
+    save->hfscr = env->spr[SPR_HFSCR];
+    save->srr0 = env->spr[SPR_SRR0];
+    save->srr1 = env->spr[SPR_SRR1];
+    save->sprg0 = env->spr[SPR_SPRG0];
+    save->sprg1 = env->spr[SPR_SPRG1];
+    save->sprg2 = env->spr[SPR_SPRG2];
+    save->sprg3 = env->spr[SPR_SPRG3];
+    save->pidr = env->spr[SPR_BOOKS_PID];
+    save->ppr = env->spr[SPR_PPR];
+
+    save->tb_offset = env->tb_env->tb_offset;
+}
+
+static void nested_load_state(PowerPCCPU *cpu, struct nested_ppc_state *load)
+{
+    CPUState *cs = CPU(cpu);
+    CPUPPCState *env = &cpu->env;
+
+    memcpy(env->gpr, load->gpr, sizeof(env->gpr));
+
+    env->lr = load->lr;
+    env->ctr = load->ctr;
+    env->cfar = load->cfar;
+    env->msr = load->msr;
+    env->nip = load->nip;
+
+    ppc_set_cr(env, load->cr);
+    cpu_write_xer(env, load->xer);
+
+    env->spr[SPR_LPCR] = load->lpcr;
+    env->spr[SPR_LPIDR] = load->lpidr;
+    env->spr[SPR_PCR] = load->pcr;
+    env->spr[SPR_DPDES] = load->dpdes;
+    env->spr[SPR_HFSCR] = load->hfscr;
+    env->spr[SPR_SRR0] = load->srr0;
+    env->spr[SPR_SRR1] = load->srr1;
+    env->spr[SPR_SPRG0] = load->sprg0;
+    env->spr[SPR_SPRG1] = load->sprg1;
+    env->spr[SPR_SPRG2] = load->sprg2;
+    env->spr[SPR_SPRG3] = load->sprg3;
+    env->spr[SPR_BOOKS_PID] = load->pidr;
+    env->spr[SPR_PPR] = load->ppr;
+
+    env->tb_env->tb_offset = load->tb_offset;
+
+    /*
+     * MSR updated, compute hflags and possible interrupts.
+     */
+    hreg_compute_hflags(env);
+    ppc_maybe_interrupt(env);
+
+    /*
+     * Nested HV does not tag TLB entries between L1 and L2, so must
+     * flush on transition.
+     */
+    tlb_flush(cs);
+    env->reserve_addr = -1; /* Reset the reservation */
+}
+
 /*
  * When this handler returns, the environment is switched to the L2 guest
  * and TCG begins running that. spapr_exit_nested() performs the switch from
@@ -1593,12 +1699,14 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
         return H_PARAMETER;
     }
 
-    spapr_cpu->nested_host_state = g_try_new(CPUPPCState, 1);
+    spapr_cpu->nested_host_state = g_try_new(struct nested_ppc_state, 1);
     if (!spapr_cpu->nested_host_state) {
         return H_NO_MEM;
     }
 
-    memcpy(spapr_cpu->nested_host_state, env, sizeof(CPUPPCState));
+    assert(env->spr[SPR_LPIDR] == 0);
+    assert(env->spr[SPR_DPDES] == 0);
+    nested_save_state(spapr_cpu->nested_host_state, cpu);
 
     len = sizeof(*regs);
     regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, false,
@@ -1639,7 +1747,6 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
     env->spr[SPR_DPDES] = hv_state.dpdes;
     env->spr[SPR_HFSCR] = hv_state.hfscr;
     hdec = hv_state.hdec_expiry - now;
-    spapr_cpu->nested_tb_offset = hv_state.tb_offset;
     /* TCG does not implement DAWR*, CIABR, PURR, SPURR, IC, VTB, HEIR SPRs*/
     env->spr[SPR_SRR0] = hv_state.srr0;
     env->spr[SPR_SRR1] = hv_state.srr1;
@@ -1665,7 +1772,7 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
      * and it's not obviously worth a new data structure to do it.
      */
 
-    env->tb_env->tb_offset += spapr_cpu->nested_tb_offset;
+    env->tb_env->tb_offset += hv_state.tb_offset;
     spapr_cpu->in_nested = true;
 
     hreg_compute_hflags(env);
@@ -1684,7 +1791,6 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
 
 void spapr_exit_nested(PowerPCCPU *cpu, int excp)
 {
-    CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
     target_ulong r3_return = env->excp_vectors[excp]; /* hcall return value */
@@ -1766,34 +1872,8 @@ void spapr_exit_nested(PowerPCCPU *cpu, int excp)
     address_space_unmap(CPU(cpu)->as, regs, len, len, true);
 
 out_restore_l1:
-    memcpy(env->gpr, spapr_cpu->nested_host_state->gpr, sizeof(env->gpr));
-    env->lr = spapr_cpu->nested_host_state->lr;
-    env->ctr = spapr_cpu->nested_host_state->ctr;
-    memcpy(env->crf, spapr_cpu->nested_host_state->crf, sizeof(env->crf));
-    env->cfar = spapr_cpu->nested_host_state->cfar;
-    env->xer = spapr_cpu->nested_host_state->xer;
-    env->so = spapr_cpu->nested_host_state->so;
-    env->ca = spapr_cpu->nested_host_state->ca;
-    env->ov = spapr_cpu->nested_host_state->ov;
-    env->ov32 = spapr_cpu->nested_host_state->ov32;
-    env->ca32 = spapr_cpu->nested_host_state->ca32;
-    env->msr = spapr_cpu->nested_host_state->msr;
-    env->nip = spapr_cpu->nested_host_state->nip;
-
     assert(env->spr[SPR_LPIDR] != 0);
-    env->spr[SPR_LPCR] = spapr_cpu->nested_host_state->spr[SPR_LPCR];
-    env->spr[SPR_LPIDR] = spapr_cpu->nested_host_state->spr[SPR_LPIDR];
-    env->spr[SPR_PCR] = spapr_cpu->nested_host_state->spr[SPR_PCR];
-    env->spr[SPR_DPDES] = 0;
-    env->spr[SPR_HFSCR] = spapr_cpu->nested_host_state->spr[SPR_HFSCR];
-    env->spr[SPR_SRR0] = spapr_cpu->nested_host_state->spr[SPR_SRR0];
-    env->spr[SPR_SRR1] = spapr_cpu->nested_host_state->spr[SPR_SRR1];
-    env->spr[SPR_SPRG0] = spapr_cpu->nested_host_state->spr[SPR_SPRG0];
-    env->spr[SPR_SPRG1] = spapr_cpu->nested_host_state->spr[SPR_SPRG1];
-    env->spr[SPR_SPRG2] = spapr_cpu->nested_host_state->spr[SPR_SPRG2];
-    env->spr[SPR_SPRG3] = spapr_cpu->nested_host_state->spr[SPR_SPRG3];
-    env->spr[SPR_BOOKS_PID] = spapr_cpu->nested_host_state->spr[SPR_BOOKS_PID];
-    env->spr[SPR_PPR] = spapr_cpu->nested_host_state->spr[SPR_PPR];
+    nested_load_state(cpu, spapr_cpu->nested_host_state);
 
     /*
      * Return the interrupt vector address from H_ENTER_NESTED to the L1
@@ -1801,14 +1881,8 @@ out_restore_l1:
      */
     env->gpr[3] = r3_return;
 
-    env->tb_env->tb_offset -= spapr_cpu->nested_tb_offset;
     spapr_cpu->in_nested = false;
 
-    hreg_compute_hflags(env);
-    ppc_maybe_interrupt(env);
-    tlb_flush(cs);
-    env->reserve_addr = -1; /* Reset the reservation */
-
     g_free(spapr_cpu->nested_host_state);
     spapr_cpu->nested_host_state = NULL;
 }
diff --git a/include/hw/ppc/spapr_cpu_core.h b/include/hw/ppc/spapr_cpu_core.h
index b560514560..69a52e39b8 100644
--- a/include/hw/ppc/spapr_cpu_core.h
+++ b/include/hw/ppc/spapr_cpu_core.h
@@ -41,6 +41,8 @@ void spapr_cpu_set_entry_state(PowerPCCPU *cpu, target_ulong nip,
                                target_ulong r1, target_ulong r3,
                                target_ulong r4);
 
+struct nested_ppc_state;
+
 typedef struct SpaprCpuState {
     uint64_t vpa_addr;
     uint64_t slb_shadow_addr, slb_shadow_size;
@@ -51,8 +53,7 @@ typedef struct SpaprCpuState {
 
     /* Fields for nested-HV support */
     bool in_nested; /* true while the L2 is executing */
-    CPUPPCState *nested_host_state; /* holds the L1 state while L2 executes */
-    int64_t nested_tb_offset; /* L1->L2 TB offset */
+    struct nested_ppc_state *nested_host_state; /* holds the L1 state while L2 executes */
 } SpaprCpuState;
 
 static inline SpaprCpuState *spapr_cpu_state(PowerPCCPU *cpu)

From cb4e61a33b7585642a8a7ff9e5b3b78599bcc582 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 20:57:36 +1000
Subject: [PATCH 0114/1353] ppc/spapr: load and store l2 state with helper
 functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Arguably this is just shuffling around register accesses, but one nice
thing it does is allow the exit to save away the L2 state then switch
the environment to the L1 before copying L2 data back to the L1, which
logically flows more naturally and simplifies the error paths.

Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/spapr_hcall.c | 164 ++++++++++++++++++++++---------------------
 1 file changed, 85 insertions(+), 79 deletions(-)

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index d5b8d54692..54ad83a3e6 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1663,9 +1663,9 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
                                    target_ulong *args)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
-    CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
+    struct nested_ppc_state l2_state;
     target_ulong hv_ptr = args[0];
     target_ulong regs_ptr = args[1];
     target_ulong hdec, now = cpu_ppc_load_tbl(env);
@@ -1699,6 +1699,10 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
         return H_PARAMETER;
     }
 
+    if (hv_state.lpid == 0) {
+        return H_PARAMETER;
+    }
+
     spapr_cpu->nested_host_state = g_try_new(struct nested_ppc_state, 1);
     if (!spapr_cpu->nested_host_state) {
         return H_NO_MEM;
@@ -1717,46 +1721,49 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
         return H_P2;
     }
 
-    len = sizeof(env->gpr);
+    len = sizeof(l2_state.gpr);
     assert(len == sizeof(regs->gpr));
-    memcpy(env->gpr, regs->gpr, len);
+    memcpy(l2_state.gpr, regs->gpr, len);
 
-    env->lr = regs->link;
-    env->ctr = regs->ctr;
-    cpu_write_xer(env, regs->xer);
-    ppc_set_cr(env, regs->ccr);
-
-    env->msr = regs->msr;
-    env->nip = regs->nip;
+    l2_state.lr = regs->link;
+    l2_state.ctr = regs->ctr;
+    l2_state.xer = regs->xer;
+    l2_state.cr = regs->ccr;
+    l2_state.msr = regs->msr;
+    l2_state.nip = regs->nip;
 
     address_space_unmap(CPU(cpu)->as, regs, len, len, false);
 
-    env->cfar = hv_state.cfar;
-
-    assert(env->spr[SPR_LPIDR] == 0);
-    env->spr[SPR_LPIDR] = hv_state.lpid;
+    l2_state.cfar = hv_state.cfar;
+    l2_state.lpidr = hv_state.lpid;
 
     lpcr_mask = LPCR_DPFD | LPCR_ILE | LPCR_AIL | LPCR_LD | LPCR_MER;
     lpcr = (env->spr[SPR_LPCR] & ~lpcr_mask) | (hv_state.lpcr & lpcr_mask);
     lpcr |= LPCR_HR | LPCR_UPRT | LPCR_GTSE | LPCR_HVICE | LPCR_HDICE;
     lpcr &= ~LPCR_LPES0;
-    env->spr[SPR_LPCR] = lpcr & pcc->lpcr_mask;
+    l2_state.lpcr = lpcr & pcc->lpcr_mask;
 
-    env->spr[SPR_PCR] = hv_state.pcr;
+    l2_state.pcr = hv_state.pcr;
     /* hv_state.amor is not used */
-    env->spr[SPR_DPDES] = hv_state.dpdes;
-    env->spr[SPR_HFSCR] = hv_state.hfscr;
-    hdec = hv_state.hdec_expiry - now;
+    l2_state.dpdes = hv_state.dpdes;
+    l2_state.hfscr = hv_state.hfscr;
     /* TCG does not implement DAWR*, CIABR, PURR, SPURR, IC, VTB, HEIR SPRs*/
-    env->spr[SPR_SRR0] = hv_state.srr0;
-    env->spr[SPR_SRR1] = hv_state.srr1;
-    env->spr[SPR_SPRG0] = hv_state.sprg[0];
-    env->spr[SPR_SPRG1] = hv_state.sprg[1];
-    env->spr[SPR_SPRG2] = hv_state.sprg[2];
-    env->spr[SPR_SPRG3] = hv_state.sprg[3];
-    env->spr[SPR_BOOKS_PID] = hv_state.pidr;
-    env->spr[SPR_PPR] = hv_state.ppr;
+    l2_state.srr0 = hv_state.srr0;
+    l2_state.srr1 = hv_state.srr1;
+    l2_state.sprg0 = hv_state.sprg[0];
+    l2_state.sprg1 = hv_state.sprg[1];
+    l2_state.sprg2 = hv_state.sprg[2];
+    l2_state.sprg3 = hv_state.sprg[3];
+    l2_state.pidr = hv_state.pidr;
+    l2_state.ppr = hv_state.ppr;
+    l2_state.tb_offset = env->tb_env->tb_offset + hv_state.tb_offset;
 
+    /*
+     * Switch to the nested guest environment and start the "hdec" timer.
+     */
+    nested_load_state(cpu, &l2_state);
+
+    hdec = hv_state.hdec_expiry - now;
     cpu_ppc_hdecr_init(env);
     cpu_ppc_store_hdecr(env, hdec);
 
@@ -1772,14 +1779,8 @@ static target_ulong h_enter_nested(PowerPCCPU *cpu,
      * and it's not obviously worth a new data structure to do it.
      */
 
-    env->tb_env->tb_offset += hv_state.tb_offset;
     spapr_cpu->in_nested = true;
 
-    hreg_compute_hflags(env);
-    ppc_maybe_interrupt(env);
-    tlb_flush(cs);
-    env->reserve_addr = -1; /* Reset the reservation */
-
     /*
      * The spapr hcall helper sets env->gpr[3] to the return value, but at
      * this point the L1 is not returning from the hcall but rather we
@@ -1793,49 +1794,69 @@ void spapr_exit_nested(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
-    target_ulong r3_return = env->excp_vectors[excp]; /* hcall return value */
+    struct nested_ppc_state l2_state;
     target_ulong hv_ptr = spapr_cpu->nested_host_state->gpr[4];
     target_ulong regs_ptr = spapr_cpu->nested_host_state->gpr[5];
+    target_ulong hsrr0, hsrr1, hdar, asdr, hdsisr;
     struct kvmppc_hv_guest_state *hvstate;
     struct kvmppc_pt_regs *regs;
     hwaddr len;
 
     assert(spapr_cpu->in_nested);
 
+    nested_save_state(&l2_state, cpu);
+    hsrr0 = env->spr[SPR_HSRR0];
+    hsrr1 = env->spr[SPR_HSRR1];
+    hdar = env->spr[SPR_HDAR];
+    hdsisr = env->spr[SPR_HDSISR];
+    asdr = env->spr[SPR_ASDR];
+
+    /*
+     * Switch back to the host environment (including for any error).
+     */
+    assert(env->spr[SPR_LPIDR] != 0);
+    nested_load_state(cpu, spapr_cpu->nested_host_state);
+    env->gpr[3] = env->excp_vectors[excp]; /* hcall return value */
+
     cpu_ppc_hdecr_exit(env);
 
+    spapr_cpu->in_nested = false;
+
+    g_free(spapr_cpu->nested_host_state);
+    spapr_cpu->nested_host_state = NULL;
+
     len = sizeof(*hvstate);
     hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, true,
                                 MEMTXATTRS_UNSPECIFIED);
     if (len != sizeof(*hvstate)) {
         address_space_unmap(CPU(cpu)->as, hvstate, len, 0, true);
-        r3_return = H_PARAMETER;
-        goto out_restore_l1;
+        env->gpr[3] = H_PARAMETER;
+        return;
     }
 
-    hvstate->cfar = env->cfar;
-    hvstate->lpcr = env->spr[SPR_LPCR];
-    hvstate->pcr = env->spr[SPR_PCR];
-    hvstate->dpdes = env->spr[SPR_DPDES];
-    hvstate->hfscr = env->spr[SPR_HFSCR];
+    hvstate->cfar = l2_state.cfar;
+    hvstate->lpcr = l2_state.lpcr;
+    hvstate->pcr = l2_state.pcr;
+    hvstate->dpdes = l2_state.dpdes;
+    hvstate->hfscr = l2_state.hfscr;
 
     if (excp == POWERPC_EXCP_HDSI) {
-        hvstate->hdar = env->spr[SPR_HDAR];
-        hvstate->hdsisr = env->spr[SPR_HDSISR];
-        hvstate->asdr = env->spr[SPR_ASDR];
+        hvstate->hdar = hdar;
+        hvstate->hdsisr = hdsisr;
+        hvstate->asdr = asdr;
     } else if (excp == POWERPC_EXCP_HISI) {
-        hvstate->asdr = env->spr[SPR_ASDR];
+        hvstate->asdr = asdr;
     }
 
     /* HEIR should be implemented for HV mode and saved here. */
-    hvstate->srr0 = env->spr[SPR_SRR0];
-    hvstate->srr1 = env->spr[SPR_SRR1];
-    hvstate->sprg[0] = env->spr[SPR_SPRG0];
-    hvstate->sprg[1] = env->spr[SPR_SPRG1];
-    hvstate->sprg[2] = env->spr[SPR_SPRG2];
-    hvstate->sprg[3] = env->spr[SPR_SPRG3];
-    hvstate->pidr = env->spr[SPR_BOOKS_PID];
-    hvstate->ppr = env->spr[SPR_PPR];
+    hvstate->srr0 = l2_state.srr0;
+    hvstate->srr1 = l2_state.srr1;
+    hvstate->sprg[0] = l2_state.sprg0;
+    hvstate->sprg[1] = l2_state.sprg1;
+    hvstate->sprg[2] = l2_state.sprg2;
+    hvstate->sprg[3] = l2_state.sprg3;
+    hvstate->pidr = l2_state.pidr;
+    hvstate->ppr = l2_state.ppr;
 
     /* Is it okay to specify write length larger than actual data written? */
     address_space_unmap(CPU(cpu)->as, hvstate, len, len, true);
@@ -1845,46 +1866,31 @@ void spapr_exit_nested(PowerPCCPU *cpu, int excp)
                                 MEMTXATTRS_UNSPECIFIED);
     if (!regs || len != sizeof(*regs)) {
         address_space_unmap(CPU(cpu)->as, regs, len, 0, true);
-        r3_return = H_P2;
-        goto out_restore_l1;
+        env->gpr[3] = H_P2;
+        return;
     }
 
     len = sizeof(env->gpr);
     assert(len == sizeof(regs->gpr));
-    memcpy(regs->gpr, env->gpr, len);
+    memcpy(regs->gpr, l2_state.gpr, len);
 
-    regs->link = env->lr;
-    regs->ctr = env->ctr;
-    regs->xer = cpu_read_xer(env);
-    regs->ccr = ppc_get_cr(env);
+    regs->link = l2_state.lr;
+    regs->ctr = l2_state.ctr;
+    regs->xer = l2_state.xer;
+    regs->ccr = l2_state.cr;
 
     if (excp == POWERPC_EXCP_MCHECK ||
         excp == POWERPC_EXCP_RESET ||
         excp == POWERPC_EXCP_SYSCALL) {
-        regs->nip = env->spr[SPR_SRR0];
-        regs->msr = env->spr[SPR_SRR1] & env->msr_mask;
+        regs->nip = l2_state.srr0;
+        regs->msr = l2_state.srr1 & env->msr_mask;
     } else {
-        regs->nip = env->spr[SPR_HSRR0];
-        regs->msr = env->spr[SPR_HSRR1] & env->msr_mask;
+        regs->nip = hsrr0;
+        regs->msr = hsrr1 & env->msr_mask;
     }
 
     /* Is it okay to specify write length larger than actual data written? */
     address_space_unmap(CPU(cpu)->as, regs, len, len, true);
-
-out_restore_l1:
-    assert(env->spr[SPR_LPIDR] != 0);
-    nested_load_state(cpu, spapr_cpu->nested_host_state);
-
-    /*
-     * Return the interrupt vector address from H_ENTER_NESTED to the L1
-     * (or error code).
-     */
-    env->gpr[3] = r3_return;
-
-    spapr_cpu->in_nested = false;
-
-    g_free(spapr_cpu->nested_host_state);
-    spapr_cpu->nested_host_state = NULL;
 }
 
 static void hypercall_register_nested(void)

From 6b8a05373bf142fe5fd3839c3675da005bfc9b49 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 20:57:37 +1000
Subject: [PATCH 0115/1353] ppc/spapr: Move spapr nested HV to a new file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create spapr_nested.c for most of the nested HV implementation.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/meson.build            |   1 +
 hw/ppc/spapr.c                |   1 +
 hw/ppc/spapr_hcall.c          | 416 +---------------------------------
 hw/ppc/spapr_nested.c         | 395 ++++++++++++++++++++++++++++++++
 include/hw/ppc/spapr.h        |  62 -----
 include/hw/ppc/spapr_nested.h | 102 +++++++++
 6 files changed, 501 insertions(+), 476 deletions(-)
 create mode 100644 hw/ppc/spapr_nested.c
 create mode 100644 include/hw/ppc/spapr_nested.h

diff --git a/hw/ppc/meson.build b/hw/ppc/meson.build
index c927337da0..a313d4b964 100644
--- a/hw/ppc/meson.build
+++ b/hw/ppc/meson.build
@@ -15,6 +15,7 @@ ppc_ss.add(when: 'CONFIG_PSERIES', if_true: files(
   'spapr_vio.c',
   'spapr_events.c',
   'spapr_hcall.c',
+  'spapr_nested.c',
   'spapr_iommu.c',
   'spapr_rtas.c',
   'spapr_pci.c',
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index dcb7f1c70a..e55905a1f0 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -61,6 +61,7 @@
 
 #include "hw/ppc/fdt.h"
 #include "hw/ppc/spapr.h"
+#include "hw/ppc/spapr_nested.h"
 #include "hw/ppc/spapr_vio.h"
 #include "hw/ppc/vof.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 54ad83a3e6..002ea0b7c1 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -13,6 +13,7 @@
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/spapr.h"
 #include "hw/ppc/spapr_cpu_core.h"
+#include "hw/ppc/spapr_nested.h"
 #include "mmu-hash64.h"
 #include "cpu-models.h"
 #include "trace.h"
@@ -1498,430 +1499,17 @@ target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
 }
 
 #ifdef CONFIG_TCG
-#define PRTS_MASK      0x1f
-
-static target_ulong h_set_ptbl(PowerPCCPU *cpu,
-                               SpaprMachineState *spapr,
-                               target_ulong opcode,
-                               target_ulong *args)
-{
-    target_ulong ptcr = args[0];
-
-    if (!spapr_get_cap(spapr, SPAPR_CAP_NESTED_KVM_HV)) {
-        return H_FUNCTION;
-    }
-
-    if ((ptcr & PRTS_MASK) + 12 - 4 > 12) {
-        return H_PARAMETER;
-    }
-
-    spapr->nested_ptcr = ptcr; /* Save new partition table */
-
-    return H_SUCCESS;
-}
-
-static target_ulong h_tlb_invalidate(PowerPCCPU *cpu,
-                                     SpaprMachineState *spapr,
-                                     target_ulong opcode,
-                                     target_ulong *args)
-{
-    /*
-     * The spapr virtual hypervisor nested HV implementation retains no L2
-     * translation state except for TLB. And the TLB is always invalidated
-     * across L1<->L2 transitions, so nothing is required here.
-     */
-
-    return H_SUCCESS;
-}
-
-static target_ulong h_copy_tofrom_guest(PowerPCCPU *cpu,
-                                        SpaprMachineState *spapr,
-                                        target_ulong opcode,
-                                        target_ulong *args)
-{
-    /*
-     * This HCALL is not required, L1 KVM will take a slow path and walk the
-     * page tables manually to do the data copy.
-     */
-    return H_FUNCTION;
-}
-
-struct nested_ppc_state {
-    uint64_t gpr[32];
-    uint64_t lr;
-    uint64_t ctr;
-    uint64_t cfar;
-    uint64_t msr;
-    uint64_t nip;
-    uint32_t cr;
-
-    uint64_t xer;
-
-    uint64_t lpcr;
-    uint64_t lpidr;
-    uint64_t pidr;
-    uint64_t pcr;
-    uint64_t dpdes;
-    uint64_t hfscr;
-    uint64_t srr0;
-    uint64_t srr1;
-    uint64_t sprg0;
-    uint64_t sprg1;
-    uint64_t sprg2;
-    uint64_t sprg3;
-    uint64_t ppr;
-
-    int64_t tb_offset;
-};
-
-static void nested_save_state(struct nested_ppc_state *save, PowerPCCPU *cpu)
-{
-    CPUPPCState *env = &cpu->env;
-
-    memcpy(save->gpr, env->gpr, sizeof(save->gpr));
-
-    save->lr = env->lr;
-    save->ctr = env->ctr;
-    save->cfar = env->cfar;
-    save->msr = env->msr;
-    save->nip = env->nip;
-
-    save->cr = ppc_get_cr(env);
-    save->xer = cpu_read_xer(env);
-
-    save->lpcr = env->spr[SPR_LPCR];
-    save->lpidr = env->spr[SPR_LPIDR];
-    save->pcr = env->spr[SPR_PCR];
-    save->dpdes = env->spr[SPR_DPDES];
-    save->hfscr = env->spr[SPR_HFSCR];
-    save->srr0 = env->spr[SPR_SRR0];
-    save->srr1 = env->spr[SPR_SRR1];
-    save->sprg0 = env->spr[SPR_SPRG0];
-    save->sprg1 = env->spr[SPR_SPRG1];
-    save->sprg2 = env->spr[SPR_SPRG2];
-    save->sprg3 = env->spr[SPR_SPRG3];
-    save->pidr = env->spr[SPR_BOOKS_PID];
-    save->ppr = env->spr[SPR_PPR];
-
-    save->tb_offset = env->tb_env->tb_offset;
-}
-
-static void nested_load_state(PowerPCCPU *cpu, struct nested_ppc_state *load)
-{
-    CPUState *cs = CPU(cpu);
-    CPUPPCState *env = &cpu->env;
-
-    memcpy(env->gpr, load->gpr, sizeof(env->gpr));
-
-    env->lr = load->lr;
-    env->ctr = load->ctr;
-    env->cfar = load->cfar;
-    env->msr = load->msr;
-    env->nip = load->nip;
-
-    ppc_set_cr(env, load->cr);
-    cpu_write_xer(env, load->xer);
-
-    env->spr[SPR_LPCR] = load->lpcr;
-    env->spr[SPR_LPIDR] = load->lpidr;
-    env->spr[SPR_PCR] = load->pcr;
-    env->spr[SPR_DPDES] = load->dpdes;
-    env->spr[SPR_HFSCR] = load->hfscr;
-    env->spr[SPR_SRR0] = load->srr0;
-    env->spr[SPR_SRR1] = load->srr1;
-    env->spr[SPR_SPRG0] = load->sprg0;
-    env->spr[SPR_SPRG1] = load->sprg1;
-    env->spr[SPR_SPRG2] = load->sprg2;
-    env->spr[SPR_SPRG3] = load->sprg3;
-    env->spr[SPR_BOOKS_PID] = load->pidr;
-    env->spr[SPR_PPR] = load->ppr;
-
-    env->tb_env->tb_offset = load->tb_offset;
-
-    /*
-     * MSR updated, compute hflags and possible interrupts.
-     */
-    hreg_compute_hflags(env);
-    ppc_maybe_interrupt(env);
-
-    /*
-     * Nested HV does not tag TLB entries between L1 and L2, so must
-     * flush on transition.
-     */
-    tlb_flush(cs);
-    env->reserve_addr = -1; /* Reset the reservation */
-}
-
-/*
- * When this handler returns, the environment is switched to the L2 guest
- * and TCG begins running that. spapr_exit_nested() performs the switch from
- * L2 back to L1 and returns from the H_ENTER_NESTED hcall.
- */
-static target_ulong h_enter_nested(PowerPCCPU *cpu,
-                                   SpaprMachineState *spapr,
-                                   target_ulong opcode,
-                                   target_ulong *args)
-{
-    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
-    CPUPPCState *env = &cpu->env;
-    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
-    struct nested_ppc_state l2_state;
-    target_ulong hv_ptr = args[0];
-    target_ulong regs_ptr = args[1];
-    target_ulong hdec, now = cpu_ppc_load_tbl(env);
-    target_ulong lpcr, lpcr_mask;
-    struct kvmppc_hv_guest_state *hvstate;
-    struct kvmppc_hv_guest_state hv_state;
-    struct kvmppc_pt_regs *regs;
-    hwaddr len;
-
-    if (spapr->nested_ptcr == 0) {
-        return H_NOT_AVAILABLE;
-    }
-
-    len = sizeof(*hvstate);
-    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, false,
-                                MEMTXATTRS_UNSPECIFIED);
-    if (len != sizeof(*hvstate)) {
-        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, false);
-        return H_PARAMETER;
-    }
-
-    memcpy(&hv_state, hvstate, len);
-
-    address_space_unmap(CPU(cpu)->as, hvstate, len, len, false);
-
-    /*
-     * We accept versions 1 and 2. Version 2 fields are unused because TCG
-     * does not implement DAWR*.
-     */
-    if (hv_state.version > HV_GUEST_STATE_VERSION) {
-        return H_PARAMETER;
-    }
-
-    if (hv_state.lpid == 0) {
-        return H_PARAMETER;
-    }
-
-    spapr_cpu->nested_host_state = g_try_new(struct nested_ppc_state, 1);
-    if (!spapr_cpu->nested_host_state) {
-        return H_NO_MEM;
-    }
-
-    assert(env->spr[SPR_LPIDR] == 0);
-    assert(env->spr[SPR_DPDES] == 0);
-    nested_save_state(spapr_cpu->nested_host_state, cpu);
-
-    len = sizeof(*regs);
-    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, false,
-                                MEMTXATTRS_UNSPECIFIED);
-    if (!regs || len != sizeof(*regs)) {
-        address_space_unmap(CPU(cpu)->as, regs, len, 0, false);
-        g_free(spapr_cpu->nested_host_state);
-        return H_P2;
-    }
-
-    len = sizeof(l2_state.gpr);
-    assert(len == sizeof(regs->gpr));
-    memcpy(l2_state.gpr, regs->gpr, len);
-
-    l2_state.lr = regs->link;
-    l2_state.ctr = regs->ctr;
-    l2_state.xer = regs->xer;
-    l2_state.cr = regs->ccr;
-    l2_state.msr = regs->msr;
-    l2_state.nip = regs->nip;
-
-    address_space_unmap(CPU(cpu)->as, regs, len, len, false);
-
-    l2_state.cfar = hv_state.cfar;
-    l2_state.lpidr = hv_state.lpid;
-
-    lpcr_mask = LPCR_DPFD | LPCR_ILE | LPCR_AIL | LPCR_LD | LPCR_MER;
-    lpcr = (env->spr[SPR_LPCR] & ~lpcr_mask) | (hv_state.lpcr & lpcr_mask);
-    lpcr |= LPCR_HR | LPCR_UPRT | LPCR_GTSE | LPCR_HVICE | LPCR_HDICE;
-    lpcr &= ~LPCR_LPES0;
-    l2_state.lpcr = lpcr & pcc->lpcr_mask;
-
-    l2_state.pcr = hv_state.pcr;
-    /* hv_state.amor is not used */
-    l2_state.dpdes = hv_state.dpdes;
-    l2_state.hfscr = hv_state.hfscr;
-    /* TCG does not implement DAWR*, CIABR, PURR, SPURR, IC, VTB, HEIR SPRs*/
-    l2_state.srr0 = hv_state.srr0;
-    l2_state.srr1 = hv_state.srr1;
-    l2_state.sprg0 = hv_state.sprg[0];
-    l2_state.sprg1 = hv_state.sprg[1];
-    l2_state.sprg2 = hv_state.sprg[2];
-    l2_state.sprg3 = hv_state.sprg[3];
-    l2_state.pidr = hv_state.pidr;
-    l2_state.ppr = hv_state.ppr;
-    l2_state.tb_offset = env->tb_env->tb_offset + hv_state.tb_offset;
-
-    /*
-     * Switch to the nested guest environment and start the "hdec" timer.
-     */
-    nested_load_state(cpu, &l2_state);
-
-    hdec = hv_state.hdec_expiry - now;
-    cpu_ppc_hdecr_init(env);
-    cpu_ppc_store_hdecr(env, hdec);
-
-    /*
-     * The hv_state.vcpu_token is not needed. It is used by the KVM
-     * implementation to remember which L2 vCPU last ran on which physical
-     * CPU so as to invalidate process scope translations if it is moved
-     * between physical CPUs. For now TLBs are always flushed on L1<->L2
-     * transitions so this is not a problem.
-     *
-     * Could validate that the same vcpu_token does not attempt to run on
-     * different L1 vCPUs at the same time, but that would be a L1 KVM bug
-     * and it's not obviously worth a new data structure to do it.
-     */
-
-    spapr_cpu->in_nested = true;
-
-    /*
-     * The spapr hcall helper sets env->gpr[3] to the return value, but at
-     * this point the L1 is not returning from the hcall but rather we
-     * start running the L2, so r3 must not be clobbered, so return env->gpr[3]
-     * to leave it unchanged.
-     */
-    return env->gpr[3];
-}
-
-void spapr_exit_nested(PowerPCCPU *cpu, int excp)
-{
-    CPUPPCState *env = &cpu->env;
-    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
-    struct nested_ppc_state l2_state;
-    target_ulong hv_ptr = spapr_cpu->nested_host_state->gpr[4];
-    target_ulong regs_ptr = spapr_cpu->nested_host_state->gpr[5];
-    target_ulong hsrr0, hsrr1, hdar, asdr, hdsisr;
-    struct kvmppc_hv_guest_state *hvstate;
-    struct kvmppc_pt_regs *regs;
-    hwaddr len;
-
-    assert(spapr_cpu->in_nested);
-
-    nested_save_state(&l2_state, cpu);
-    hsrr0 = env->spr[SPR_HSRR0];
-    hsrr1 = env->spr[SPR_HSRR1];
-    hdar = env->spr[SPR_HDAR];
-    hdsisr = env->spr[SPR_HDSISR];
-    asdr = env->spr[SPR_ASDR];
-
-    /*
-     * Switch back to the host environment (including for any error).
-     */
-    assert(env->spr[SPR_LPIDR] != 0);
-    nested_load_state(cpu, spapr_cpu->nested_host_state);
-    env->gpr[3] = env->excp_vectors[excp]; /* hcall return value */
-
-    cpu_ppc_hdecr_exit(env);
-
-    spapr_cpu->in_nested = false;
-
-    g_free(spapr_cpu->nested_host_state);
-    spapr_cpu->nested_host_state = NULL;
-
-    len = sizeof(*hvstate);
-    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, true,
-                                MEMTXATTRS_UNSPECIFIED);
-    if (len != sizeof(*hvstate)) {
-        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, true);
-        env->gpr[3] = H_PARAMETER;
-        return;
-    }
-
-    hvstate->cfar = l2_state.cfar;
-    hvstate->lpcr = l2_state.lpcr;
-    hvstate->pcr = l2_state.pcr;
-    hvstate->dpdes = l2_state.dpdes;
-    hvstate->hfscr = l2_state.hfscr;
-
-    if (excp == POWERPC_EXCP_HDSI) {
-        hvstate->hdar = hdar;
-        hvstate->hdsisr = hdsisr;
-        hvstate->asdr = asdr;
-    } else if (excp == POWERPC_EXCP_HISI) {
-        hvstate->asdr = asdr;
-    }
-
-    /* HEIR should be implemented for HV mode and saved here. */
-    hvstate->srr0 = l2_state.srr0;
-    hvstate->srr1 = l2_state.srr1;
-    hvstate->sprg[0] = l2_state.sprg0;
-    hvstate->sprg[1] = l2_state.sprg1;
-    hvstate->sprg[2] = l2_state.sprg2;
-    hvstate->sprg[3] = l2_state.sprg3;
-    hvstate->pidr = l2_state.pidr;
-    hvstate->ppr = l2_state.ppr;
-
-    /* Is it okay to specify write length larger than actual data written? */
-    address_space_unmap(CPU(cpu)->as, hvstate, len, len, true);
-
-    len = sizeof(*regs);
-    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, true,
-                                MEMTXATTRS_UNSPECIFIED);
-    if (!regs || len != sizeof(*regs)) {
-        address_space_unmap(CPU(cpu)->as, regs, len, 0, true);
-        env->gpr[3] = H_P2;
-        return;
-    }
-
-    len = sizeof(env->gpr);
-    assert(len == sizeof(regs->gpr));
-    memcpy(regs->gpr, l2_state.gpr, len);
-
-    regs->link = l2_state.lr;
-    regs->ctr = l2_state.ctr;
-    regs->xer = l2_state.xer;
-    regs->ccr = l2_state.cr;
-
-    if (excp == POWERPC_EXCP_MCHECK ||
-        excp == POWERPC_EXCP_RESET ||
-        excp == POWERPC_EXCP_SYSCALL) {
-        regs->nip = l2_state.srr0;
-        regs->msr = l2_state.srr1 & env->msr_mask;
-    } else {
-        regs->nip = hsrr0;
-        regs->msr = hsrr1 & env->msr_mask;
-    }
-
-    /* Is it okay to specify write length larger than actual data written? */
-    address_space_unmap(CPU(cpu)->as, regs, len, len, true);
-}
-
-static void hypercall_register_nested(void)
-{
-    spapr_register_hypercall(KVMPPC_H_SET_PARTITION_TABLE, h_set_ptbl);
-    spapr_register_hypercall(KVMPPC_H_ENTER_NESTED, h_enter_nested);
-    spapr_register_hypercall(KVMPPC_H_TLB_INVALIDATE, h_tlb_invalidate);
-    spapr_register_hypercall(KVMPPC_H_COPY_TOFROM_GUEST, h_copy_tofrom_guest);
-}
-
 static void hypercall_register_softmmu(void)
 {
     /* DO NOTHING */
 }
 #else
-void spapr_exit_nested(PowerPCCPU *cpu, int excp)
-{
-    g_assert_not_reached();
-}
-
 static target_ulong h_softmmu(PowerPCCPU *cpu, SpaprMachineState *spapr,
                             target_ulong opcode, target_ulong *args)
 {
     g_assert_not_reached();
 }
 
-static void hypercall_register_nested(void)
-{
-    /* DO NOTHING */
-}
-
 static void hypercall_register_softmmu(void)
 {
     /* hcall-pft */
@@ -1991,7 +1579,7 @@ static void hypercall_register_types(void)
 
     spapr_register_hypercall(KVMPPC_H_UPDATE_DT, h_update_dt);
 
-    hypercall_register_nested();
+    spapr_register_nested();
 }
 
 type_init(hypercall_register_types)
diff --git a/hw/ppc/spapr_nested.c b/hw/ppc/spapr_nested.c
new file mode 100644
index 0000000000..121aa96ddc
--- /dev/null
+++ b/hw/ppc/spapr_nested.c
@@ -0,0 +1,395 @@
+#include "qemu/osdep.h"
+#include "qemu/cutils.h"
+#include "exec/exec-all.h"
+#include "helper_regs.h"
+#include "hw/ppc/ppc.h"
+#include "hw/ppc/spapr.h"
+#include "hw/ppc/spapr_cpu_core.h"
+#include "hw/ppc/spapr_nested.h"
+
+#ifdef CONFIG_TCG
+#define PRTS_MASK      0x1f
+
+static target_ulong h_set_ptbl(PowerPCCPU *cpu,
+                               SpaprMachineState *spapr,
+                               target_ulong opcode,
+                               target_ulong *args)
+{
+    target_ulong ptcr = args[0];
+
+    if (!spapr_get_cap(spapr, SPAPR_CAP_NESTED_KVM_HV)) {
+        return H_FUNCTION;
+    }
+
+    if ((ptcr & PRTS_MASK) + 12 - 4 > 12) {
+        return H_PARAMETER;
+    }
+
+    spapr->nested_ptcr = ptcr; /* Save new partition table */
+
+    return H_SUCCESS;
+}
+
+static target_ulong h_tlb_invalidate(PowerPCCPU *cpu,
+                                     SpaprMachineState *spapr,
+                                     target_ulong opcode,
+                                     target_ulong *args)
+{
+    /*
+     * The spapr virtual hypervisor nested HV implementation retains no L2
+     * translation state except for TLB. And the TLB is always invalidated
+     * across L1<->L2 transitions, so nothing is required here.
+     */
+
+    return H_SUCCESS;
+}
+
+static target_ulong h_copy_tofrom_guest(PowerPCCPU *cpu,
+                                        SpaprMachineState *spapr,
+                                        target_ulong opcode,
+                                        target_ulong *args)
+{
+    /*
+     * This HCALL is not required, L1 KVM will take a slow path and walk the
+     * page tables manually to do the data copy.
+     */
+    return H_FUNCTION;
+}
+
+static void nested_save_state(struct nested_ppc_state *save, PowerPCCPU *cpu)
+{
+    CPUPPCState *env = &cpu->env;
+
+    memcpy(save->gpr, env->gpr, sizeof(save->gpr));
+
+    save->lr = env->lr;
+    save->ctr = env->ctr;
+    save->cfar = env->cfar;
+    save->msr = env->msr;
+    save->nip = env->nip;
+
+    save->cr = ppc_get_cr(env);
+    save->xer = cpu_read_xer(env);
+
+    save->lpcr = env->spr[SPR_LPCR];
+    save->lpidr = env->spr[SPR_LPIDR];
+    save->pcr = env->spr[SPR_PCR];
+    save->dpdes = env->spr[SPR_DPDES];
+    save->hfscr = env->spr[SPR_HFSCR];
+    save->srr0 = env->spr[SPR_SRR0];
+    save->srr1 = env->spr[SPR_SRR1];
+    save->sprg0 = env->spr[SPR_SPRG0];
+    save->sprg1 = env->spr[SPR_SPRG1];
+    save->sprg2 = env->spr[SPR_SPRG2];
+    save->sprg3 = env->spr[SPR_SPRG3];
+    save->pidr = env->spr[SPR_BOOKS_PID];
+    save->ppr = env->spr[SPR_PPR];
+
+    save->tb_offset = env->tb_env->tb_offset;
+}
+
+static void nested_load_state(PowerPCCPU *cpu, struct nested_ppc_state *load)
+{
+    CPUState *cs = CPU(cpu);
+    CPUPPCState *env = &cpu->env;
+
+    memcpy(env->gpr, load->gpr, sizeof(env->gpr));
+
+    env->lr = load->lr;
+    env->ctr = load->ctr;
+    env->cfar = load->cfar;
+    env->msr = load->msr;
+    env->nip = load->nip;
+
+    ppc_set_cr(env, load->cr);
+    cpu_write_xer(env, load->xer);
+
+    env->spr[SPR_LPCR] = load->lpcr;
+    env->spr[SPR_LPIDR] = load->lpidr;
+    env->spr[SPR_PCR] = load->pcr;
+    env->spr[SPR_DPDES] = load->dpdes;
+    env->spr[SPR_HFSCR] = load->hfscr;
+    env->spr[SPR_SRR0] = load->srr0;
+    env->spr[SPR_SRR1] = load->srr1;
+    env->spr[SPR_SPRG0] = load->sprg0;
+    env->spr[SPR_SPRG1] = load->sprg1;
+    env->spr[SPR_SPRG2] = load->sprg2;
+    env->spr[SPR_SPRG3] = load->sprg3;
+    env->spr[SPR_BOOKS_PID] = load->pidr;
+    env->spr[SPR_PPR] = load->ppr;
+
+    env->tb_env->tb_offset = load->tb_offset;
+
+    /*
+     * MSR updated, compute hflags and possible interrupts.
+     */
+    hreg_compute_hflags(env);
+    ppc_maybe_interrupt(env);
+
+    /*
+     * Nested HV does not tag TLB entries between L1 and L2, so must
+     * flush on transition.
+     */
+    tlb_flush(cs);
+    env->reserve_addr = -1; /* Reset the reservation */
+}
+
+/*
+ * When this handler returns, the environment is switched to the L2 guest
+ * and TCG begins running that. spapr_exit_nested() performs the switch from
+ * L2 back to L1 and returns from the H_ENTER_NESTED hcall.
+ */
+static target_ulong h_enter_nested(PowerPCCPU *cpu,
+                                   SpaprMachineState *spapr,
+                                   target_ulong opcode,
+                                   target_ulong *args)
+{
+    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
+    CPUPPCState *env = &cpu->env;
+    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
+    struct nested_ppc_state l2_state;
+    target_ulong hv_ptr = args[0];
+    target_ulong regs_ptr = args[1];
+    target_ulong hdec, now = cpu_ppc_load_tbl(env);
+    target_ulong lpcr, lpcr_mask;
+    struct kvmppc_hv_guest_state *hvstate;
+    struct kvmppc_hv_guest_state hv_state;
+    struct kvmppc_pt_regs *regs;
+    hwaddr len;
+
+    if (spapr->nested_ptcr == 0) {
+        return H_NOT_AVAILABLE;
+    }
+
+    len = sizeof(*hvstate);
+    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, false,
+                                MEMTXATTRS_UNSPECIFIED);
+    if (len != sizeof(*hvstate)) {
+        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, false);
+        return H_PARAMETER;
+    }
+
+    memcpy(&hv_state, hvstate, len);
+
+    address_space_unmap(CPU(cpu)->as, hvstate, len, len, false);
+
+    /*
+     * We accept versions 1 and 2. Version 2 fields are unused because TCG
+     * does not implement DAWR*.
+     */
+    if (hv_state.version > HV_GUEST_STATE_VERSION) {
+        return H_PARAMETER;
+    }
+
+    if (hv_state.lpid == 0) {
+        return H_PARAMETER;
+    }
+
+    spapr_cpu->nested_host_state = g_try_new(struct nested_ppc_state, 1);
+    if (!spapr_cpu->nested_host_state) {
+        return H_NO_MEM;
+    }
+
+    assert(env->spr[SPR_LPIDR] == 0);
+    assert(env->spr[SPR_DPDES] == 0);
+    nested_save_state(spapr_cpu->nested_host_state, cpu);
+
+    len = sizeof(*regs);
+    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, false,
+                                MEMTXATTRS_UNSPECIFIED);
+    if (!regs || len != sizeof(*regs)) {
+        address_space_unmap(CPU(cpu)->as, regs, len, 0, false);
+        g_free(spapr_cpu->nested_host_state);
+        return H_P2;
+    }
+
+    len = sizeof(l2_state.gpr);
+    assert(len == sizeof(regs->gpr));
+    memcpy(l2_state.gpr, regs->gpr, len);
+
+    l2_state.lr = regs->link;
+    l2_state.ctr = regs->ctr;
+    l2_state.xer = regs->xer;
+    l2_state.cr = regs->ccr;
+    l2_state.msr = regs->msr;
+    l2_state.nip = regs->nip;
+
+    address_space_unmap(CPU(cpu)->as, regs, len, len, false);
+
+    l2_state.cfar = hv_state.cfar;
+    l2_state.lpidr = hv_state.lpid;
+
+    lpcr_mask = LPCR_DPFD | LPCR_ILE | LPCR_AIL | LPCR_LD | LPCR_MER;
+    lpcr = (env->spr[SPR_LPCR] & ~lpcr_mask) | (hv_state.lpcr & lpcr_mask);
+    lpcr |= LPCR_HR | LPCR_UPRT | LPCR_GTSE | LPCR_HVICE | LPCR_HDICE;
+    lpcr &= ~LPCR_LPES0;
+    l2_state.lpcr = lpcr & pcc->lpcr_mask;
+
+    l2_state.pcr = hv_state.pcr;
+    /* hv_state.amor is not used */
+    l2_state.dpdes = hv_state.dpdes;
+    l2_state.hfscr = hv_state.hfscr;
+    /* TCG does not implement DAWR*, CIABR, PURR, SPURR, IC, VTB, HEIR SPRs*/
+    l2_state.srr0 = hv_state.srr0;
+    l2_state.srr1 = hv_state.srr1;
+    l2_state.sprg0 = hv_state.sprg[0];
+    l2_state.sprg1 = hv_state.sprg[1];
+    l2_state.sprg2 = hv_state.sprg[2];
+    l2_state.sprg3 = hv_state.sprg[3];
+    l2_state.pidr = hv_state.pidr;
+    l2_state.ppr = hv_state.ppr;
+    l2_state.tb_offset = env->tb_env->tb_offset + hv_state.tb_offset;
+
+    /*
+     * Switch to the nested guest environment and start the "hdec" timer.
+     */
+    nested_load_state(cpu, &l2_state);
+
+    hdec = hv_state.hdec_expiry - now;
+    cpu_ppc_hdecr_init(env);
+    cpu_ppc_store_hdecr(env, hdec);
+
+    /*
+     * The hv_state.vcpu_token is not needed. It is used by the KVM
+     * implementation to remember which L2 vCPU last ran on which physical
+     * CPU so as to invalidate process scope translations if it is moved
+     * between physical CPUs. For now TLBs are always flushed on L1<->L2
+     * transitions so this is not a problem.
+     *
+     * Could validate that the same vcpu_token does not attempt to run on
+     * different L1 vCPUs at the same time, but that would be a L1 KVM bug
+     * and it's not obviously worth a new data structure to do it.
+     */
+
+    spapr_cpu->in_nested = true;
+
+    /*
+     * The spapr hcall helper sets env->gpr[3] to the return value, but at
+     * this point the L1 is not returning from the hcall but rather we
+     * start running the L2, so r3 must not be clobbered, so return env->gpr[3]
+     * to leave it unchanged.
+     */
+    return env->gpr[3];
+}
+
+void spapr_exit_nested(PowerPCCPU *cpu, int excp)
+{
+    CPUPPCState *env = &cpu->env;
+    SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
+    struct nested_ppc_state l2_state;
+    target_ulong hv_ptr = spapr_cpu->nested_host_state->gpr[4];
+    target_ulong regs_ptr = spapr_cpu->nested_host_state->gpr[5];
+    target_ulong hsrr0, hsrr1, hdar, asdr, hdsisr;
+    struct kvmppc_hv_guest_state *hvstate;
+    struct kvmppc_pt_regs *regs;
+    hwaddr len;
+
+    assert(spapr_cpu->in_nested);
+
+    nested_save_state(&l2_state, cpu);
+    hsrr0 = env->spr[SPR_HSRR0];
+    hsrr1 = env->spr[SPR_HSRR1];
+    hdar = env->spr[SPR_HDAR];
+    hdsisr = env->spr[SPR_HDSISR];
+    asdr = env->spr[SPR_ASDR];
+
+    /*
+     * Switch back to the host environment (including for any error).
+     */
+    assert(env->spr[SPR_LPIDR] != 0);
+    nested_load_state(cpu, spapr_cpu->nested_host_state);
+    env->gpr[3] = env->excp_vectors[excp]; /* hcall return value */
+
+    cpu_ppc_hdecr_exit(env);
+
+    spapr_cpu->in_nested = false;
+
+    g_free(spapr_cpu->nested_host_state);
+    spapr_cpu->nested_host_state = NULL;
+
+    len = sizeof(*hvstate);
+    hvstate = address_space_map(CPU(cpu)->as, hv_ptr, &len, true,
+                                MEMTXATTRS_UNSPECIFIED);
+    if (len != sizeof(*hvstate)) {
+        address_space_unmap(CPU(cpu)->as, hvstate, len, 0, true);
+        env->gpr[3] = H_PARAMETER;
+        return;
+    }
+
+    hvstate->cfar = l2_state.cfar;
+    hvstate->lpcr = l2_state.lpcr;
+    hvstate->pcr = l2_state.pcr;
+    hvstate->dpdes = l2_state.dpdes;
+    hvstate->hfscr = l2_state.hfscr;
+
+    if (excp == POWERPC_EXCP_HDSI) {
+        hvstate->hdar = hdar;
+        hvstate->hdsisr = hdsisr;
+        hvstate->asdr = asdr;
+    } else if (excp == POWERPC_EXCP_HISI) {
+        hvstate->asdr = asdr;
+    }
+
+    /* HEIR should be implemented for HV mode and saved here. */
+    hvstate->srr0 = l2_state.srr0;
+    hvstate->srr1 = l2_state.srr1;
+    hvstate->sprg[0] = l2_state.sprg0;
+    hvstate->sprg[1] = l2_state.sprg1;
+    hvstate->sprg[2] = l2_state.sprg2;
+    hvstate->sprg[3] = l2_state.sprg3;
+    hvstate->pidr = l2_state.pidr;
+    hvstate->ppr = l2_state.ppr;
+
+    /* Is it okay to specify write length larger than actual data written? */
+    address_space_unmap(CPU(cpu)->as, hvstate, len, len, true);
+
+    len = sizeof(*regs);
+    regs = address_space_map(CPU(cpu)->as, regs_ptr, &len, true,
+                                MEMTXATTRS_UNSPECIFIED);
+    if (!regs || len != sizeof(*regs)) {
+        address_space_unmap(CPU(cpu)->as, regs, len, 0, true);
+        env->gpr[3] = H_P2;
+        return;
+    }
+
+    len = sizeof(env->gpr);
+    assert(len == sizeof(regs->gpr));
+    memcpy(regs->gpr, l2_state.gpr, len);
+
+    regs->link = l2_state.lr;
+    regs->ctr = l2_state.ctr;
+    regs->xer = l2_state.xer;
+    regs->ccr = l2_state.cr;
+
+    if (excp == POWERPC_EXCP_MCHECK ||
+        excp == POWERPC_EXCP_RESET ||
+        excp == POWERPC_EXCP_SYSCALL) {
+        regs->nip = l2_state.srr0;
+        regs->msr = l2_state.srr1 & env->msr_mask;
+    } else {
+        regs->nip = hsrr0;
+        regs->msr = hsrr1 & env->msr_mask;
+    }
+
+    /* Is it okay to specify write length larger than actual data written? */
+    address_space_unmap(CPU(cpu)->as, regs, len, len, true);
+}
+
+void spapr_register_nested(void)
+{
+    spapr_register_hypercall(KVMPPC_H_SET_PARTITION_TABLE, h_set_ptbl);
+    spapr_register_hypercall(KVMPPC_H_ENTER_NESTED, h_enter_nested);
+    spapr_register_hypercall(KVMPPC_H_TLB_INVALIDATE, h_tlb_invalidate);
+    spapr_register_hypercall(KVMPPC_H_COPY_TOFROM_GUEST, h_copy_tofrom_guest);
+}
+#else
+void spapr_exit_nested(PowerPCCPU *cpu, int excp)
+{
+    g_assert_not_reached();
+}
+
+void spapr_register_nested(void)
+{
+    /* DO NOTHING */
+}
+#endif
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index bd5a6c4780..538b2dfb89 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -621,66 +621,6 @@ struct SpaprMachineState {
 #define SVM_H_TPM_COMM              0xEF10
 #define SVM_HCALL_MAX               SVM_H_TPM_COMM
 
-/*
- * Register state for entering a nested guest with H_ENTER_NESTED.
- * New member must be added at the end.
- */
-struct kvmppc_hv_guest_state {
-    uint64_t version;      /* version of this structure layout, must be first */
-    uint32_t lpid;
-    uint32_t vcpu_token;
-    /* These registers are hypervisor privileged (at least for writing) */
-    uint64_t lpcr;
-    uint64_t pcr;
-    uint64_t amor;
-    uint64_t dpdes;
-    uint64_t hfscr;
-    int64_t tb_offset;
-    uint64_t dawr0;
-    uint64_t dawrx0;
-    uint64_t ciabr;
-    uint64_t hdec_expiry;
-    uint64_t purr;
-    uint64_t spurr;
-    uint64_t ic;
-    uint64_t vtb;
-    uint64_t hdar;
-    uint64_t hdsisr;
-    uint64_t heir;
-    uint64_t asdr;
-    /* These are OS privileged but need to be set late in guest entry */
-    uint64_t srr0;
-    uint64_t srr1;
-    uint64_t sprg[4];
-    uint64_t pidr;
-    uint64_t cfar;
-    uint64_t ppr;
-    /* Version 1 ends here */
-    uint64_t dawr1;
-    uint64_t dawrx1;
-    /* Version 2 ends here */
-};
-
-/* Latest version of hv_guest_state structure */
-#define HV_GUEST_STATE_VERSION  2
-
-/* Linux 64-bit powerpc pt_regs struct, used by nested HV */
-struct kvmppc_pt_regs {
-    uint64_t gpr[32];
-    uint64_t nip;
-    uint64_t msr;
-    uint64_t orig_gpr3;    /* Used for restarting system calls */
-    uint64_t ctr;
-    uint64_t link;
-    uint64_t xer;
-    uint64_t ccr;
-    uint64_t softe;        /* Soft enabled/disabled */
-    uint64_t trap;         /* Reason for being here */
-    uint64_t dar;          /* Fault registers */
-    uint64_t dsisr;        /* on 4xx/Book-E used for ESR */
-    uint64_t result;       /* Result of a system call */
-};
-
 typedef struct SpaprDeviceTreeUpdateHeader {
     uint32_t version_id;
 } SpaprDeviceTreeUpdateHeader;
@@ -698,8 +638,6 @@ void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn);
 target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
                              target_ulong *args);
 
-void spapr_exit_nested(PowerPCCPU *cpu, int excp);
-
 target_ulong softmmu_resize_hpt_prepare(PowerPCCPU *cpu, SpaprMachineState *spapr,
                                          target_ulong shift);
 target_ulong softmmu_resize_hpt_commit(PowerPCCPU *cpu, SpaprMachineState *spapr,
diff --git a/include/hw/ppc/spapr_nested.h b/include/hw/ppc/spapr_nested.h
new file mode 100644
index 0000000000..d383486476
--- /dev/null
+++ b/include/hw/ppc/spapr_nested.h
@@ -0,0 +1,102 @@
+#ifndef HW_SPAPR_NESTED_H
+#define HW_SPAPR_NESTED_H
+
+#include "qemu/osdep.h"
+#include "target/ppc/cpu.h"
+
+/*
+ * Register state for entering a nested guest with H_ENTER_NESTED.
+ * New member must be added at the end.
+ */
+struct kvmppc_hv_guest_state {
+    uint64_t version;      /* version of this structure layout, must be first */
+    uint32_t lpid;
+    uint32_t vcpu_token;
+    /* These registers are hypervisor privileged (at least for writing) */
+    uint64_t lpcr;
+    uint64_t pcr;
+    uint64_t amor;
+    uint64_t dpdes;
+    uint64_t hfscr;
+    int64_t tb_offset;
+    uint64_t dawr0;
+    uint64_t dawrx0;
+    uint64_t ciabr;
+    uint64_t hdec_expiry;
+    uint64_t purr;
+    uint64_t spurr;
+    uint64_t ic;
+    uint64_t vtb;
+    uint64_t hdar;
+    uint64_t hdsisr;
+    uint64_t heir;
+    uint64_t asdr;
+    /* These are OS privileged but need to be set late in guest entry */
+    uint64_t srr0;
+    uint64_t srr1;
+    uint64_t sprg[4];
+    uint64_t pidr;
+    uint64_t cfar;
+    uint64_t ppr;
+    /* Version 1 ends here */
+    uint64_t dawr1;
+    uint64_t dawrx1;
+    /* Version 2 ends here */
+};
+
+/* Latest version of hv_guest_state structure */
+#define HV_GUEST_STATE_VERSION  2
+
+/* Linux 64-bit powerpc pt_regs struct, used by nested HV */
+struct kvmppc_pt_regs {
+    uint64_t gpr[32];
+    uint64_t nip;
+    uint64_t msr;
+    uint64_t orig_gpr3;    /* Used for restarting system calls */
+    uint64_t ctr;
+    uint64_t link;
+    uint64_t xer;
+    uint64_t ccr;
+    uint64_t softe;        /* Soft enabled/disabled */
+    uint64_t trap;         /* Reason for being here */
+    uint64_t dar;          /* Fault registers */
+    uint64_t dsisr;        /* on 4xx/Book-E used for ESR */
+    uint64_t result;       /* Result of a system call */
+};
+
+/*
+ * nested_ppc_state is used to save the host CPU state before switching it to
+ * the guest CPU state, to be restored on H_ENTER_NESTED exit.
+ */
+struct nested_ppc_state {
+    uint64_t gpr[32];
+    uint64_t lr;
+    uint64_t ctr;
+    uint64_t cfar;
+    uint64_t msr;
+    uint64_t nip;
+    uint32_t cr;
+
+    uint64_t xer;
+
+    uint64_t lpcr;
+    uint64_t lpidr;
+    uint64_t pidr;
+    uint64_t pcr;
+    uint64_t dpdes;
+    uint64_t hfscr;
+    uint64_t srr0;
+    uint64_t srr1;
+    uint64_t sprg0;
+    uint64_t sprg1;
+    uint64_t sprg2;
+    uint64_t sprg3;
+    uint64_t ppr;
+
+    int64_t tb_offset;
+};
+
+void spapr_register_nested(void);
+void spapr_exit_nested(PowerPCCPU *cpu, int excp);
+
+#endif /* HW_SPAPR_NESTED_H */

From 888050cf519eb5995424cf415f4f8f269de96824 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 23:10:41 +1000
Subject: [PATCH 0116/1353] target/ppc: Fix instruction loading endianness in
 alignment interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

powerpc ifetch endianness depends on MSR[LE] so it has to byteswap
after cpu_ldl_code(). This corrects DSISR bits in alignment
interrupts when running in little endian mode.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/excp_helper.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 12d8a7257b..a2801f6e6b 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -133,6 +133,26 @@ static void dump_hcall(CPUPPCState *env)
                   env->nip);
 }
 
+#ifdef CONFIG_TCG
+/* Return true iff byteswap is needed to load instruction */
+static inline bool insn_need_byteswap(CPUArchState *env)
+{
+    /* SYSTEM builds TARGET_BIG_ENDIAN. Need to swap when MSR[LE] is set */
+    return !!(env->msr & ((target_ulong)1 << MSR_LE));
+}
+
+static uint32_t ppc_ldl_code(CPUArchState *env, hwaddr addr)
+{
+    uint32_t insn = cpu_ldl_code(env, addr);
+
+    if (insn_need_byteswap(env)) {
+        insn = bswap32(insn);
+    }
+
+    return insn;
+}
+#endif
+
 static void ppc_excp_debug_sw_tlb(CPUPPCState *env, int excp)
 {
     const char *es;
@@ -3104,7 +3124,7 @@ void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
 
     /* Restore state and reload the insn we executed, for filling in DSISR.  */
     cpu_restore_state(cs, retaddr);
-    insn = cpu_ldl_code(env, env->nip);
+    insn = ppc_ldl_code(env, env->nip);
 
     switch (env->mmu_model) {
     case POWERPC_MMU_SOFT_4xx:

From 74574c3845a046174993092cdc3c03f481dc2cf3 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 23:10:42 +1000
Subject: [PATCH 0117/1353] target/ppc: Change partition-scope translate
 interface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than always performing partition scope page table translation
with access type of 0 (MMU_DATA_LOAD), pass through the processor
access type which first initiated the translation sequence. Process-
scoped page table loads are then set to MMU_DATA_LOAD access type in
the xlate function.

This will allow more information to be passed to the exception
handler in the next patch.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/mmu-radix64.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 031efda0df..1fc1ba3ecf 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -380,6 +380,14 @@ static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu,
     hwaddr pte_addr;
     uint64_t pte;
 
+    if (pde_addr) {
+        /*
+         * Translation of process-scoped tables/directories is performed as
+         * a read-access.
+         */
+        access_type = MMU_DATA_LOAD;
+    }
+
     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx
                   " mmu_idx %u 0x%"HWADDR_PRIx"\n",
                   __func__, access_str(access_type),
@@ -477,10 +485,10 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
          * is only used to translate the effective addresses of the
          * process table entries.
          */
-        ret = ppc_radix64_partition_scoped_xlate(cpu, 0, eaddr, prtbe_addr,
-                                                 pate, &h_raddr, &h_prot,
-                                                 &h_page_size, true,
-            /* mmu_idx is 5 because we're translating from hypervisor scope */
+        /* mmu_idx is 5 because we're translating from hypervisor scope */
+        ret = ppc_radix64_partition_scoped_xlate(cpu, access_type, eaddr,
+                                                 prtbe_addr, pate, &h_raddr,
+                                                 &h_prot, &h_page_size, true,
                                                  5, guest_visible);
         if (ret) {
             return ret;
@@ -519,11 +527,11 @@ static int ppc_radix64_process_scoped_xlate(PowerPCCPU *cpu,
          * translation
          */
         do {
-            ret = ppc_radix64_partition_scoped_xlate(cpu, 0, eaddr, pte_addr,
-                                                     pate, &h_raddr, &h_prot,
-                                                     &h_page_size, true,
             /* mmu_idx is 5 because we're translating from hypervisor scope */
-                                                     5, guest_visible);
+            ret = ppc_radix64_partition_scoped_xlate(cpu, access_type, eaddr,
+                                                     pte_addr, pate, &h_raddr,
+                                                     &h_prot, &h_page_size,
+                                                     true, 5, guest_visible);
             if (ret) {
                 return ret;
             }

From 5a5d3b23cb281d99ee6dd74afa41864428e35241 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 23:10:43 +1000
Subject: [PATCH 0118/1353] target/ppc: Add SRR1 prefix indication to interrupt
 handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ISA v3.1 introduced prefix instructions. Among the changes, various
synchronous interrupts report whether they were caused by a prefix
instruction in (H)SRR1.

The case of instruction fetch that causes an HDSI due to access of a
process-scoped table faulting on the partition scoped translation is the
tricky one. As with ISIs and HISIs, this does not try to set the prefix
bit because there is no instruction image to be loaded. The HDSI needs
the originating access type to be passed through to the handler to
distinguish this from HDSIs that fault translating process scoped tables
originating from a load or store instruction (in that case the prefix
bit should be provided).

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
[ clg: checkpatch issues ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/excp_helper.c | 73 +++++++++++++++++++++++++++++++++++++++-
 target/ppc/mmu-radix64.c | 14 ++++++--
 2 files changed, 83 insertions(+), 4 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index a2801f6e6b..847f8a33be 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -28,6 +28,7 @@
 #include "trace.h"
 
 #ifdef CONFIG_TCG
+#include "sysemu/tcg.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
 #endif
@@ -141,7 +142,7 @@ static inline bool insn_need_byteswap(CPUArchState *env)
     return !!(env->msr & ((target_ulong)1 << MSR_LE));
 }
 
-static uint32_t ppc_ldl_code(CPUArchState *env, hwaddr addr)
+static uint32_t ppc_ldl_code(CPUArchState *env, abi_ptr addr)
 {
     uint32_t insn = cpu_ldl_code(env, addr);
 
@@ -1348,6 +1349,72 @@ static bool books_vhyp_handles_hv_excp(PowerPCCPU *cpu)
     return false;
 }
 
+#ifdef CONFIG_TCG
+static bool is_prefix_insn(CPUPPCState *env, uint32_t insn)
+{
+    if (!(env->insns_flags2 & PPC2_ISA310)) {
+        return false;
+    }
+    return ((insn & 0xfc000000) == 0x04000000);
+}
+
+static bool is_prefix_insn_excp(PowerPCCPU *cpu, int excp)
+{
+    CPUPPCState *env = &cpu->env;
+
+    if (!tcg_enabled()) {
+        /*
+         * This does not load instructions and set the prefix bit correctly
+         * for injected interrupts with KVM. That may have to be discovered
+         * and set by the KVM layer before injecting.
+         */
+        return false;
+    }
+
+    switch (excp) {
+    case POWERPC_EXCP_HDSI:
+        /* HDSI PRTABLE_FAULT has the originating access type in error_code */
+        if ((env->spr[SPR_HDSISR] & DSISR_PRTABLE_FAULT) &&
+            (env->error_code == MMU_INST_FETCH)) {
+            /*
+             * Fetch failed due to partition scope translation, so prefix
+             * indication is not relevant (and attempting to load the
+             * instruction at NIP would cause recursive faults with the same
+             * translation).
+             */
+            break;
+        }
+        /* fall through */
+    case POWERPC_EXCP_MCHECK:
+    case POWERPC_EXCP_DSI:
+    case POWERPC_EXCP_DSEG:
+    case POWERPC_EXCP_ALIGN:
+    case POWERPC_EXCP_PROGRAM:
+    case POWERPC_EXCP_FPU:
+    case POWERPC_EXCP_TRACE:
+    case POWERPC_EXCP_HV_EMU:
+    case POWERPC_EXCP_VPU:
+    case POWERPC_EXCP_VSXU:
+    case POWERPC_EXCP_FU:
+    case POWERPC_EXCP_HV_FU: {
+        uint32_t insn = ppc_ldl_code(env, env->nip);
+        if (is_prefix_insn(env, insn)) {
+            return true;
+        }
+        break;
+    }
+    default:
+        break;
+    }
+    return false;
+}
+#else
+static bool is_prefix_insn_excp(PowerPCCPU *cpu, int excp)
+{
+    return false;
+}
+#endif
+
 static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
 {
     CPUState *cs = CPU(cpu);
@@ -1395,6 +1462,10 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
 
     vector |= env->excp_prefix;
 
+    if (is_prefix_insn_excp(cpu, excp)) {
+        msr |= PPC_BIT(34);
+    }
+
     switch (excp) {
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
         if (!FIELD_EX64(env->msr, MSR, ME)) {
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 1fc1ba3ecf..920084bd8f 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -145,6 +145,13 @@ static void ppc_radix64_raise_hsi(PowerPCCPU *cpu, MMUAccessType access_type,
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
 
+    env->error_code = 0;
+    if (cause & DSISR_PRTABLE_FAULT) {
+        /* HDSI PRTABLE_FAULT gets the originating access type in error_code */
+        env->error_code = access_type;
+        access_type = MMU_DATA_LOAD;
+    }
+
     qemu_log_mask(CPU_LOG_MMU, "%s for %s @0x%"VADDR_PRIx" 0x%"
                   HWADDR_PRIx" cause %08x\n",
                   __func__, access_str(access_type),
@@ -166,7 +173,6 @@ static void ppc_radix64_raise_hsi(PowerPCCPU *cpu, MMUAccessType access_type,
         env->spr[SPR_HDSISR] = cause;
         env->spr[SPR_HDAR] = eaddr;
         env->spr[SPR_ASDR] = g_raddr;
-        env->error_code = 0;
         break;
     default:
         g_assert_not_reached();
@@ -369,13 +375,14 @@ static bool validate_pate(PowerPCCPU *cpu, uint64_t lpid, ppc_v3_pate_t *pate)
 }
 
 static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu,
-                                              MMUAccessType access_type,
+                                              MMUAccessType orig_access_type,
                                               vaddr eaddr, hwaddr g_raddr,
                                               ppc_v3_pate_t pate,
                                               hwaddr *h_raddr, int *h_prot,
                                               int *h_page_size, bool pde_addr,
                                               int mmu_idx, bool guest_visible)
 {
+    MMUAccessType access_type = orig_access_type;
     int fault_cause = 0;
     hwaddr pte_addr;
     uint64_t pte;
@@ -404,7 +411,8 @@ static int ppc_radix64_partition_scoped_xlate(PowerPCCPU *cpu,
             fault_cause |= DSISR_PRTABLE_FAULT;
         }
         if (guest_visible) {
-            ppc_radix64_raise_hsi(cpu, access_type, eaddr, g_raddr, fault_cause);
+            ppc_radix64_raise_hsi(cpu, orig_access_type,
+                                  eaddr, g_raddr, fault_cause);
         }
         return 1;
     }

From a3c020d85ea721fc2a57b28f305a532b2c388f7c Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 23:10:44 +1000
Subject: [PATCH 0119/1353] target/ppc: Implement HEIR SPR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hypervisor emulation assistance interrupt modifies HEIR to
contain the value of the instruction which caused the exception.

Only TCG raises HEAI interrupts so this can be made TCG-only.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/cpu.h         |  1 +
 target/ppc/cpu_init.c    | 23 +++++++++++++++++++++++
 target/ppc/excp_helper.c | 17 ++++++++++++++++-
 3 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 0ee2adc105..054edf3c80 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1647,6 +1647,7 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_HMER              (0x150)
 #define SPR_HMEER             (0x151)
 #define SPR_PCR               (0x152)
+#define SPR_HEIR              (0x153)
 #define SPR_BOOKE_LPIDR       (0x152)
 #define SPR_BOOKE_TCR         (0x154)
 #define SPR_BOOKE_TLB0PS      (0x158)
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 7bce421a7c..dccc064053 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1630,6 +1630,7 @@ static void register_8xx_sprs(CPUPPCState *env)
  * HSRR0   => SPR 314 (Power 2.04 hypv)
  * HSRR1   => SPR 315 (Power 2.04 hypv)
  * LPIDR   => SPR 317 (970)
+ * HEIR    => SPR 339 (Power 2.05 hypv) (64-bit reg from 3.1)
  * EPR     => SPR 702 (Power 2.04 emb)
  * perf    => 768-783 (Power 2.04)
  * perf    => 784-799 (Power 2.04)
@@ -5523,6 +5524,24 @@ static void register_power6_common_sprs(CPUPPCState *env)
                  0x00000000);
 }
 
+static void register_HEIR32_spr(CPUPPCState *env)
+{
+    spr_register_hv(env, SPR_HEIR, "HEIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic32,
+                 0x00000000);
+}
+
+static void register_HEIR64_spr(CPUPPCState *env)
+{
+    spr_register_hv(env, SPR_HEIR, "HEIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+}
+
 static void register_power8_tce_address_control_sprs(CPUPPCState *env)
 {
     spr_register_kvm(env, SPR_TAR, "TAR",
@@ -5951,6 +5970,7 @@ static void init_proc_POWER7(CPUPPCState *env)
     register_power5p_ear_sprs(env);
     register_power5p_tb_sprs(env);
     register_power6_common_sprs(env);
+    register_HEIR32_spr(env);
     register_power6_dbg_sprs(env);
     register_power7_book4_sprs(env);
 
@@ -6073,6 +6093,7 @@ static void init_proc_POWER8(CPUPPCState *env)
     register_power5p_ear_sprs(env);
     register_power5p_tb_sprs(env);
     register_power6_common_sprs(env);
+    register_HEIR32_spr(env);
     register_power6_dbg_sprs(env);
     register_power8_tce_address_control_sprs(env);
     register_power8_ids_sprs(env);
@@ -6235,6 +6256,7 @@ static void init_proc_POWER9(CPUPPCState *env)
     register_power5p_ear_sprs(env);
     register_power5p_tb_sprs(env);
     register_power6_common_sprs(env);
+    register_HEIR32_spr(env);
     register_power6_dbg_sprs(env);
     register_power8_tce_address_control_sprs(env);
     register_power8_ids_sprs(env);
@@ -6427,6 +6449,7 @@ static void init_proc_POWER10(CPUPPCState *env)
     register_power5p_ear_sprs(env);
     register_power5p_tb_sprs(env);
     register_power6_common_sprs(env);
+    register_HEIR64_spr(env);
     register_power6_dbg_sprs(env);
     register_power8_tce_address_control_sprs(env);
     register_power8_ids_sprs(env);
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 847f8a33be..2a0070cf43 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1642,13 +1642,28 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
     case POWERPC_EXCP_HDECR:     /* Hypervisor decrementer exception         */
     case POWERPC_EXCP_HDSI:      /* Hypervisor data storage exception        */
     case POWERPC_EXCP_SDOOR_HV:  /* Hypervisor Doorbell interrupt            */
-    case POWERPC_EXCP_HV_EMU:
     case POWERPC_EXCP_HVIRT:     /* Hypervisor virtualization                */
         srr0 = SPR_HSRR0;
         srr1 = SPR_HSRR1;
         new_msr |= (target_ulong)MSR_HVB;
         new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
         break;
+#ifdef CONFIG_TCG
+    case POWERPC_EXCP_HV_EMU: {
+        uint32_t insn = ppc_ldl_code(env, env->nip);
+        env->spr[SPR_HEIR] = insn;
+        if (is_prefix_insn(env, insn)) {
+            uint32_t insn2 = ppc_ldl_code(env, env->nip + 4);
+            env->spr[SPR_HEIR] <<= 32;
+            env->spr[SPR_HEIR] |= insn2;
+        }
+        srr0 = SPR_HSRR0;
+        srr1 = SPR_HSRR1;
+        new_msr |= (target_ulong)MSR_HVB;
+        new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
+        break;
+    }
+#endif
     case POWERPC_EXCP_VPU:       /* Vector unavailable exception             */
     case POWERPC_EXCP_VSXU:       /* VSX unavailable exception               */
     case POWERPC_EXCP_FU:         /* Facility unavailable exception          */

From eb701f30120d899bdaa202c3cbd9219055fccae0 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 23:13:21 +1000
Subject: [PATCH 0120/1353] target/ppc: Add ISA v3.1 LEV indication in SRR1 for
 system call interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

System call interrupts in ISA v3.1 CPUs add a LEV indication in SRR1
that corresponds with the LEV field of the instruction that caused the
interrupt.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/excp_helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 2a0070cf43..8e2fec3551 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1591,6 +1591,10 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
             vhc->hypercall(cpu->vhyp, cpu);
             return;
         }
+        if (env->insns_flags2 & PPC2_ISA310) {
+            /* ISAv3.1 puts LEV into SRR1 */
+            msr |= lev << 20;
+        }
         if (lev == 1) {
             new_msr |= (target_ulong)MSR_HVB;
         }

From 488aad116651f9838767fd53d5660e6702925c14 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 20 Jun 2023 23:15:23 +1000
Subject: [PATCH 0121/1353] target/ppc: Better CTRL SPR implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CTRL register is able to write the bit in the RUN field, which gets
reflected into the TS field which is read-only and contains the state of
the RUN field for all threads in the core.

TCG does not implement SMT, so the correct implementation just requires
mirroring the RUN bit into the first bit of the TS field.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/translate.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index b591f2e496..1ade063616 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -418,7 +418,14 @@ void spr_write_generic32(DisasContext *ctx, int sprn, int gprn)
 
 void spr_write_CTRL(DisasContext *ctx, int sprn, int gprn)
 {
-    spr_write_generic32(ctx, sprn, gprn);
+    /* This does not implement >1 thread */
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    tcg_gen_extract_tl(t0, cpu_gpr[gprn], 0, 1); /* Extract RUN field */
+    tcg_gen_shli_tl(t1, t0, 8); /* Duplicate the bit in TS */
+    tcg_gen_or_tl(t1, t1, t0);
+    gen_store_spr(sprn, t1);
+    spr_store_dump_spr(sprn);
 
     /*
      * SPR_CTRL writes must force a new translation block,

From 984eda58f20763ffb56b7aff34ad60bdeb118eb1 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 21 Jun 2023 21:09:38 +1000
Subject: [PATCH 0122/1353] target/ppc: Fix sc instruction handling of LEV
 field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The top bits of the LEV field of the sc instruction are to be treated as
as a reserved field rather than a reserved value, meaning LEV is
effectively the bottom bit. LEV=0xF should be treated as LEV=1 and be
a hypercall, for example.

This changes the instruction execution to just set lev from the low bit
of the field. Processors which don't support the LEV field will continue
to ignore it.

ISA v3.1 defines LEV to be 2 bits, in order to add the 'sc 2' ultracall
instruction. TCG does not support Ultravisor, so don't worry about
that bit.

Suggested-by: "Harsh Prateek Bora" <harshpb@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/translate.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 1ade063616..8f74a864e4 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -4429,7 +4429,12 @@ static void gen_sc(DisasContext *ctx)
 {
     uint32_t lev;
 
-    lev = (ctx->opcode >> 5) & 0x7F;
+    /*
+     * LEV is a 7-bit field, but the top 6 bits are treated as a reserved
+     * field (i.e., ignored). ISA v3.1 changes that to 5 bits, but that is
+     * for Ultravisor which TCG does not support, so just ignore the top 6.
+     */
+    lev = (ctx->opcode >> 5) & 0x1;
     gen_exception_err(ctx, POWERPC_SYSCALL, lev);
 }
 

From b769d4c8f4c67e794444a6376b849db2caeeff3e Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 22 Jun 2023 19:33:51 +1000
Subject: [PATCH 0123/1353] target/ppc: Add initial flags and helpers for SMT
 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TGC SMT emulation needs to know whether it is running with SMT siblings,
to be able to iterate over siblings in a core, and to serialise
threads to access per-core shared SPRs. Add infrastructure to do these
things.

For now the sibling iteration and serialisation are implemented in a
simple but inefficient way. SMT shared state and sibling access is not
too common, and SMT configurations are mainly useful to test system
code, so performance is not to critical.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: fix build breakage with clang ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/cpu.h       |  9 +++++++++
 target/ppc/cpu_init.c  |  5 +++++
 target/ppc/translate.c | 22 ++++++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 054edf3c80..4138a25801 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -672,6 +672,8 @@ enum {
     POWERPC_FLAG_TM       = 0x00100000,
     /* Has SCV (ISA 3.00)                                                    */
     POWERPC_FLAG_SCV      = 0x00200000,
+    /* Has >1 thread per core                                                */
+    POWERPC_FLAG_SMT      = 0x00400000,
 };
 
 /*
@@ -1268,6 +1270,13 @@ struct CPUArchState {
     uint64_t pmu_base_time;
 };
 
+#define _CORE_ID(cs)                                            \
+    (POWERPC_CPU(cs)->env.spr_cb[SPR_PIR].default_value & ~(cs->nr_threads - 1))
+
+#define THREAD_SIBLING_FOREACH(cs, cs_sibling)                  \
+    CPU_FOREACH(cs_sibling)                                     \
+        if (_CORE_ID(cs) == _CORE_ID(cs_sibling))
+
 #define SET_FIT_PERIOD(a_, b_, c_, d_)          \
 do {                                            \
     env->fit_period[0] = (a_);                  \
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index dccc064053..aeff71d063 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -6755,6 +6755,7 @@ static void ppc_cpu_realize(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
     PowerPCCPU *cpu = POWERPC_CPU(dev);
+    CPUPPCState *env = &cpu->env;
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     Error *local_err = NULL;
 
@@ -6786,6 +6787,10 @@ static void ppc_cpu_realize(DeviceState *dev, Error **errp)
 
     pcc->parent_realize(dev, errp);
 
+    if (env_cpu(env)->nr_threads > 1) {
+        env->flags |= POWERPC_FLAG_SMT;
+    }
+
     return;
 
 unrealize:
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 8f74a864e4..7d8877b3dc 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -234,6 +234,28 @@ struct opc_handler_t {
     void (*handler)(DisasContext *ctx);
 };
 
+static inline bool gen_serialize(DisasContext *ctx)
+{
+    if (tb_cflags(ctx->base.tb) & CF_PARALLEL) {
+        /* Restart with exclusive lock.  */
+        gen_helper_exit_atomic(cpu_env);
+        ctx->base.is_jmp = DISAS_NORETURN;
+        return false;
+    }
+    return true;
+}
+
+#if defined(TARGET_PPC64) && !defined(CONFIG_USER_ONLY)
+static inline bool gen_serialize_core(DisasContext *ctx)
+{
+    if (ctx->flags & POWERPC_FLAG_SMT) {
+        return gen_serialize(ctx);
+    }
+
+    return true;
+}
+#endif
+
 /* SPR load/store helpers */
 static inline void gen_load_spr(TCGv t, int reg)
 {

From c5d98a7b3d455204e24212cb769dec8f490e4e1c Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 22 Jun 2023 19:33:52 +1000
Subject: [PATCH 0124/1353] target/ppc: Add support for SMT CTRL register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A relatively simple case to begin with, CTRL is a SMT shared register
where reads and writes need to synchronise against state changes by
other threads in the core.

Atomic serialisation operations are used to achieve this.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 target/ppc/helper.h      |  2 ++
 target/ppc/misc_helper.c | 25 +++++++++++++++++++++++++
 target/ppc/translate.c   | 18 +++++++++++++++++-
 3 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index 38efbc351c..fda40b8a60 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -704,6 +704,8 @@ DEF_HELPER_3(store_dcr, void, env, tl, tl)
 
 DEF_HELPER_2(load_dump_spr, void, env, i32)
 DEF_HELPER_2(store_dump_spr, void, env, i32)
+DEF_HELPER_3(spr_write_CTRL, void, env, i32, tl)
+
 DEF_HELPER_4(fscr_facility_check, void, env, i32, i32, i32)
 DEF_HELPER_4(msr_facility_check, void, env, i32, i32, i32)
 DEF_HELPER_FLAGS_1(load_tbl, TCG_CALL_NO_RWG, tl, env)
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 40ddc5c08c..a058eb24cd 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -43,6 +43,31 @@ void helper_store_dump_spr(CPUPPCState *env, uint32_t sprn)
              env->spr[sprn]);
 }
 
+void helper_spr_write_CTRL(CPUPPCState *env, uint32_t sprn,
+                           target_ulong val)
+{
+    CPUState *cs = env_cpu(env);
+    CPUState *ccs;
+    uint32_t run = val & 1;
+    uint32_t ts, ts_mask;
+
+    assert(sprn == SPR_CTRL);
+
+    env->spr[sprn] &= ~1U;
+    env->spr[sprn] |= run;
+
+    ts_mask = ~(1U << (8 + env->spr[SPR_TIR]));
+    ts = run << (8 + env->spr[SPR_TIR]);
+
+    THREAD_SIBLING_FOREACH(cs, ccs) {
+        CPUPPCState *cenv = &POWERPC_CPU(ccs)->env;
+
+        cenv->spr[sprn] &= ts_mask;
+        cenv->spr[sprn] |= ts;
+    }
+}
+
+
 #ifdef TARGET_PPC64
 static void raise_hv_fu_exception(CPUPPCState *env, uint32_t bit,
                                   const char *caller, uint32_t cause,
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 7d8877b3dc..c321a39027 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -438,7 +438,7 @@ void spr_write_generic32(DisasContext *ctx, int sprn, int gprn)
 #endif
 }
 
-void spr_write_CTRL(DisasContext *ctx, int sprn, int gprn)
+static void spr_write_CTRL_ST(DisasContext *ctx, int sprn, int gprn)
 {
     /* This does not implement >1 thread */
     TCGv t0 = tcg_temp_new();
@@ -447,6 +447,22 @@ void spr_write_CTRL(DisasContext *ctx, int sprn, int gprn)
     tcg_gen_shli_tl(t1, t0, 8); /* Duplicate the bit in TS */
     tcg_gen_or_tl(t1, t1, t0);
     gen_store_spr(sprn, t1);
+}
+
+void spr_write_CTRL(DisasContext *ctx, int sprn, int gprn)
+{
+    if (!(ctx->flags & POWERPC_FLAG_SMT)) {
+        spr_write_CTRL_ST(ctx, sprn, gprn);
+        goto out;
+    }
+
+    if (!gen_serialize(ctx)) {
+        return;
+    }
+
+    gen_helper_spr_write_CTRL(cpu_env, tcg_constant_i32(sprn),
+                              cpu_gpr[gprn]);
+out:
     spr_store_dump_spr(sprn);
 
     /*

From d24e80b2ae3e061a200178d679711b5538479a72 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 22 Jun 2023 19:33:53 +1000
Subject: [PATCH 0125/1353] target/ppc: Add msgsnd/p and DPDES SMT support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Doorbells in SMT need to coordinate msgsnd/msgclr and DPDES access from
multiple threads that affect the same state.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/ppc.c             |  6 ++++++
 include/hw/ppc/ppc.h     |  1 +
 target/ppc/excp_helper.c | 30 ++++++++++++++++++++++-----
 target/ppc/misc_helper.c | 44 ++++++++++++++++++++++++++++++++++------
 target/ppc/translate.c   |  8 ++++++++
 5 files changed, 78 insertions(+), 11 deletions(-)

diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 1b1220c423..82e4408c5c 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -1436,6 +1436,12 @@ int ppc_cpu_pir(PowerPCCPU *cpu)
     return env->spr_cb[SPR_PIR].default_value;
 }
 
+int ppc_cpu_tir(PowerPCCPU *cpu)
+{
+    CPUPPCState *env = &cpu->env;
+    return env->spr_cb[SPR_TIR].default_value;
+}
+
 PowerPCCPU *ppc_get_vcpu_by_pir(int pir)
 {
     CPUState *cs;
diff --git a/include/hw/ppc/ppc.h b/include/hw/ppc/ppc.h
index 02af03ada2..e095c002dc 100644
--- a/include/hw/ppc/ppc.h
+++ b/include/hw/ppc/ppc.h
@@ -6,6 +6,7 @@
 void ppc_set_irq(PowerPCCPU *cpu, int n_IRQ, int level);
 PowerPCCPU *ppc_get_vcpu_by_pir(int pir);
 int ppc_cpu_pir(PowerPCCPU *cpu);
+int ppc_cpu_tir(PowerPCCPU *cpu);
 
 /* PowerPC hardware exceptions management helpers */
 typedef void (*clk_setup_cb)(void *opaque, uint32_t freq);
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 8e2fec3551..2158390e27 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -3186,22 +3186,42 @@ void helper_book3s_msgclrp(CPUPPCState *env, target_ulong rb)
 }
 
 /*
- * sends a message to other threads that are on the same
+ * sends a message to another thread  on the same
  * multi-threaded processor
  */
 void helper_book3s_msgsndp(CPUPPCState *env, target_ulong rb)
 {
-    int pir = env->spr_cb[SPR_PIR].default_value;
+    CPUState *cs = env_cpu(env);
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    CPUState *ccs;
+    uint32_t nr_threads = cs->nr_threads;
+    int ttir = rb & PPC_BITMASK(57, 63);
 
     helper_hfscr_facility_check(env, HFSCR_MSGP, "msgsndp", HFSCR_IC_MSGP);
 
-    if (!dbell_type_server(rb)) {
+    if (!dbell_type_server(rb) || ttir >= nr_threads) {
         return;
     }
 
-    /* TODO: TCG supports only one thread */
+    if (nr_threads == 1) {
+        ppc_set_irq(cpu, PPC_INTERRUPT_DOORBELL, 1);
+        return;
+    }
 
-    book3s_msgsnd_common(pir, PPC_INTERRUPT_DOORBELL);
+    /* Does iothread need to be locked for walking CPU list? */
+    qemu_mutex_lock_iothread();
+    THREAD_SIBLING_FOREACH(cs, ccs) {
+        PowerPCCPU *ccpu = POWERPC_CPU(ccs);
+        uint32_t thread_id = ppc_cpu_tir(ccpu);
+
+        if (ttir == thread_id) {
+            ppc_set_irq(ccpu, PPC_INTERRUPT_DOORBELL, 1);
+            qemu_mutex_unlock_iothread();
+            return;
+        }
+    }
+
+    g_assert_not_reached();
 }
 #endif /* TARGET_PPC64 */
 
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index a058eb24cd..1f1af21f33 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -184,32 +184,64 @@ void helper_store_pcr(CPUPPCState *env, target_ulong value)
  */
 target_ulong helper_load_dpdes(CPUPPCState *env)
 {
+    CPUState *cs = env_cpu(env);
+    CPUState *ccs;
+    uint32_t nr_threads = cs->nr_threads;
     target_ulong dpdes = 0;
 
     helper_hfscr_facility_check(env, HFSCR_MSGP, "load DPDES", HFSCR_IC_MSGP);
 
-    /* TODO: TCG supports only one thread */
-    if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
-        dpdes = 1;
+    if (nr_threads == 1) {
+        if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
+            dpdes = 1;
+        }
+        return dpdes;
     }
 
+    qemu_mutex_lock_iothread();
+    THREAD_SIBLING_FOREACH(cs, ccs) {
+        PowerPCCPU *ccpu = POWERPC_CPU(ccs);
+        CPUPPCState *cenv = &ccpu->env;
+        uint32_t thread_id = ppc_cpu_tir(ccpu);
+
+        if (cenv->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
+            dpdes |= (0x1 << thread_id);
+        }
+    }
+    qemu_mutex_unlock_iothread();
+
     return dpdes;
 }
 
 void helper_store_dpdes(CPUPPCState *env, target_ulong val)
 {
     PowerPCCPU *cpu = env_archcpu(env);
+    CPUState *cs = env_cpu(env);
+    CPUState *ccs;
+    uint32_t nr_threads = cs->nr_threads;
 
     helper_hfscr_facility_check(env, HFSCR_MSGP, "store DPDES", HFSCR_IC_MSGP);
 
-    /* TODO: TCG supports only one thread */
-    if (val & ~0x1) {
+    if (val & ~(nr_threads - 1)) {
         qemu_log_mask(LOG_GUEST_ERROR, "Invalid DPDES register value "
                       TARGET_FMT_lx"\n", val);
+        val &= (nr_threads - 1); /* Ignore the invalid bits */
+    }
+
+    if (nr_threads == 1) {
+        ppc_set_irq(cpu, PPC_INTERRUPT_DOORBELL, val & 0x1);
         return;
     }
 
-    ppc_set_irq(cpu, PPC_INTERRUPT_DOORBELL, val & 0x1);
+    /* Does iothread need to be locked for walking CPU list? */
+    qemu_mutex_lock_iothread();
+    THREAD_SIBLING_FOREACH(cs, ccs) {
+        PowerPCCPU *ccpu = POWERPC_CPU(ccs);
+        uint32_t thread_id = ppc_cpu_tir(ccpu);
+
+        ppc_set_irq(cpu, PPC_INTERRUPT_DOORBELL, val & (0x1 << thread_id));
+    }
+    qemu_mutex_unlock_iothread();
 }
 #endif /* defined(TARGET_PPC64) */
 
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index c321a39027..372ee600b2 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -815,11 +815,19 @@ void spr_write_pcr(DisasContext *ctx, int sprn, int gprn)
 /* DPDES */
 void spr_read_dpdes(DisasContext *ctx, int gprn, int sprn)
 {
+    if (!gen_serialize_core(ctx)) {
+        return;
+    }
+
     gen_helper_load_dpdes(cpu_gpr[gprn], cpu_env);
 }
 
 void spr_write_dpdes(DisasContext *ctx, int sprn, int gprn)
 {
+    if (!gen_serialize_core(ctx)) {
+        return;
+    }
+
     gen_helper_store_dpdes(cpu_env, cpu_gpr[gprn]);
 }
 #endif

From 516cd737330a9b4d90a66136ebf738c4653b4e78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 22 Jun 2023 19:33:54 +1000
Subject: [PATCH 0126/1353] hw/ppc/spapr: Test whether TCG is enabled with
 tcg_enabled()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although the PPC target only supports the TCG and KVM
accelerators, QEMU supports more. We can not assume that
'!kvm == tcg', so test for the correct accelerator. This
also eases code review, because here we don't care about
KVM, we really want to test for TCG.

Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[np: Fix changelog typo noticed by Zoltan]
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/spapr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index e55905a1f0..8e7d497f25 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2525,7 +2525,7 @@ static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
     int ret;
     unsigned int smp_threads = ms->smp.threads;
 
-    if (!kvm_enabled() && (smp_threads > 1)) {
+    if (tcg_enabled() && (smp_threads > 1)) {
         error_setg(errp, "TCG cannot support more than 1 thread/core "
                    "on a pseries machine");
         return;

From dc5e072188ea622071bab47c4f899817d6ef1295 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 22 Jun 2023 19:33:55 +1000
Subject: [PATCH 0127/1353] spapr: TCG allow up to 8-thread SMT on POWER8 and
 newer CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PPC TCG supports SMT CPU configurations for non-hypervisor state, so
permit POWER8-10 pseries machines to enable SMT.

This requires PIR and TIR be set, because that's how sibling thread
matching is done by TCG.

spapr's nested-HV capability does not currently coexist with SMT, so
that combination is prohibited (interestingly somewhat analogous to
LPAR-per-core mode on real hardware which also does not support KVM).

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: Also test smp_threads when checking for POWER8 CPU and above ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ppc/spapr.c          | 17 +++++++++++++----
 hw/ppc/spapr_caps.c     | 14 ++++++++++++++
 hw/ppc/spapr_cpu_core.c |  7 +++++--
 3 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 8e7d497f25..54dbfd7fe9 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2525,10 +2525,19 @@ static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
     int ret;
     unsigned int smp_threads = ms->smp.threads;
 
-    if (tcg_enabled() && (smp_threads > 1)) {
-        error_setg(errp, "TCG cannot support more than 1 thread/core "
-                   "on a pseries machine");
-        return;
+    if (tcg_enabled()) {
+        if (smp_threads > 1 &&
+            !ppc_type_check_compat(ms->cpu_type, CPU_POWERPC_LOGICAL_2_07, 0,
+                                   spapr->max_compat_pvr)) {
+            error_setg(errp, "TCG only supports SMT on POWER8 or newer CPUs");
+            return;
+        }
+
+        if (smp_threads > 8) {
+            error_setg(errp, "TCG cannot support more than 8 threads/core "
+                       "on a pseries machine");
+            return;
+        }
     }
     if (!is_power_of_2(smp_threads)) {
         error_setg(errp, "Cannot support %d threads/core on a pseries "
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index 3fd45a6dec..5a0755d34f 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -473,6 +473,20 @@ static void cap_nested_kvm_hv_apply(SpaprMachineState *spapr,
                 error_append_hint(errp,
                                   "Try appending -machine cap-nested-hv=off\n");
         }
+    } else if (tcg_enabled()) {
+        MachineState *ms = MACHINE(spapr);
+        unsigned int smp_threads = ms->smp.threads;
+
+        /*
+         * Nested-HV vCPU env state to L2, so SMT-shared SPR updates, for
+         * example, do not necessarily update the correct SPR value on sibling
+         * threads that are in a different guest/host context.
+         */
+        if (smp_threads > 1) {
+            error_setg(errp, "TCG does not support nested-HV with SMT");
+            error_append_hint(errp, "Try appending -machine cap-nested-hv=off "
+                                    "or use threads=1 with -smp\n");
+        }
     }
 }
 
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
index 9b88dd549a..a4e3c2fadd 100644
--- a/hw/ppc/spapr_cpu_core.c
+++ b/hw/ppc/spapr_cpu_core.c
@@ -255,7 +255,7 @@ static void spapr_cpu_core_unrealize(DeviceState *dev)
 }
 
 static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
-                               SpaprCpuCore *sc, Error **errp)
+                               SpaprCpuCore *sc, int thread_index, Error **errp)
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
@@ -267,6 +267,9 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
     kvmppc_set_papr(cpu);
 
+    env->spr_cb[SPR_PIR].default_value = cs->cpu_index;
+    env->spr_cb[SPR_TIR].default_value = thread_index;
+
     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
 
@@ -337,7 +340,7 @@ static void spapr_cpu_core_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < cc->nr_threads; i++) {
         sc->threads[i] = spapr_create_vcpu(sc, i, errp);
         if (!sc->threads[i] ||
-            !spapr_realize_vcpu(sc->threads[i], spapr, sc, errp)) {
+            !spapr_realize_vcpu(sc->threads[i], spapr, sc, i, errp)) {
             spapr_cpu_core_unrealize(dev);
             return;
         }

From 8f4c627b2f1479c15822ab2123ff4bdd63c24417 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 22 Jun 2023 19:33:56 +1000
Subject: [PATCH 0128/1353] tests/avocado: boot ppc64 pseries to Linux VFS
 mount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine can boot Linux to VFS mount, so don't stop in early boot.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/avocado/ppc_pseries.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/avocado/ppc_pseries.py b/tests/avocado/ppc_pseries.py
index d8b04dc3ea..a152cf222e 100644
--- a/tests/avocado/ppc_pseries.py
+++ b/tests/avocado/ppc_pseries.py
@@ -31,5 +31,5 @@ class pseriesMachine(QemuSystemTest):
         self.vm.add_args('-kernel', kernel_path,
                          '-append', kernel_command_line)
         self.vm.launch()
-        console_pattern = 'Kernel command line: %s' % kernel_command_line
+        console_pattern = 'VFS: Cannot open root device'
         wait_for_console_pattern(self, console_pattern, self.panic_message)

From 242e8b4dca60574a81c92ba4b8bcb538550c6cfc Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 22 Jun 2023 19:33:57 +1000
Subject: [PATCH 0129/1353] tests/avocado: Add ppc64 pseries multiprocessor
 boot tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add mult-thread/core/socket Linux boot tests that ensure the right
topology comes up. Of particular note is a SMT test, which is a new
capability for TCG.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/avocado/ppc_pseries.py | 60 +++++++++++++++++++++++++++++++++---
 1 file changed, 55 insertions(+), 5 deletions(-)

diff --git a/tests/avocado/ppc_pseries.py b/tests/avocado/ppc_pseries.py
index a152cf222e..ff42c770f2 100644
--- a/tests/avocado/ppc_pseries.py
+++ b/tests/avocado/ppc_pseries.py
@@ -14,12 +14,9 @@ class pseriesMachine(QemuSystemTest):
     timeout = 90
     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
     panic_message = 'Kernel panic - not syncing'
+    good_message = 'VFS: Cannot open root device'
 
-    def test_ppc64_pseries(self):
-        """
-        :avocado: tags=arch:ppc64
-        :avocado: tags=machine:pseries
-        """
+    def do_test_ppc64_linux_boot(self):
         kernel_url = ('https://archives.fedoraproject.org/pub/archive'
                       '/fedora-secondary/releases/29/Everything/ppc64le/os'
                       '/ppc/ppc64/vmlinuz')
@@ -31,5 +28,58 @@ class pseriesMachine(QemuSystemTest):
         self.vm.add_args('-kernel', kernel_path,
                          '-append', kernel_command_line)
         self.vm.launch()
+
+    def test_ppc64_linux_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:pseries
+        """
+
+        self.do_test_ppc64_linux_boot()
         console_pattern = 'VFS: Cannot open root device'
         wait_for_console_pattern(self, console_pattern, self.panic_message)
+
+    def test_ppc64_linux_smp_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:pseries
+        """
+
+        self.vm.add_args('-smp', '4')
+        self.do_test_ppc64_linux_boot()
+        console_pattern = 'smp: Brought up 1 node, 4 CPUs'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        wait_for_console_pattern(self, self.good_message, self.panic_message)
+
+    def test_ppc64_linux_smt_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:pseries
+        """
+
+        self.vm.add_args('-smp', '4,threads=4')
+        self.do_test_ppc64_linux_boot()
+        console_pattern = 'CPU maps initialized for 4 threads per core'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        console_pattern = 'smp: Brought up 1 node, 4 CPUs'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        wait_for_console_pattern(self, self.good_message, self.panic_message)
+
+    def test_ppc64_linux_big_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:pseries
+        """
+
+        self.vm.add_args('-smp', '16,threads=4,cores=2,sockets=2')
+        self.vm.add_args('-m', '512M',
+                         '-object', 'memory-backend-ram,size=256M,id=m0',
+                         '-object', 'memory-backend-ram,size=256M,id=m1')
+        self.vm.add_args('-numa', 'node,nodeid=0,memdev=m0')
+        self.vm.add_args('-numa', 'node,nodeid=1,memdev=m1')
+        self.do_test_ppc64_linux_boot()
+        console_pattern = 'CPU maps initialized for 4 threads per core'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        console_pattern = 'smp: Brought up 2 nodes, 16 CPUs'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        wait_for_console_pattern(self, self.good_message, self.panic_message)

From 2a24e6e394c0badefd1c6b1ecf571f3663236300 Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Thu, 22 Jun 2023 18:25:26 +0200
Subject: [PATCH 0130/1353] pnv/xive2: Add a get_config() method on the
 presenter class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The presenters for xive on P9 and P10 are mostly similar but the
behavior can be tuned through a few CQ registers. This patch adds a
"get_config" method, which will allow to access that config from the
presenter in a later patch.
For now, just define the config for the TIMA version.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/intc/pnv_xive.c    | 11 +++++++++++
 hw/intc/pnv_xive2.c   | 12 ++++++++++++
 hw/intc/spapr_xive.c  | 16 ++++++++++++++++
 hw/intc/xive.c        |  7 +++++++
 include/hw/ppc/xive.h |  3 +++
 5 files changed, 49 insertions(+)

diff --git a/hw/intc/pnv_xive.c b/hw/intc/pnv_xive.c
index 622f9d28b7..e536b3ec26 100644
--- a/hw/intc/pnv_xive.c
+++ b/hw/intc/pnv_xive.c
@@ -479,6 +479,16 @@ static int pnv_xive_match_nvt(XivePresenter *xptr, uint8_t format,
     return count;
 }
 
+static uint32_t pnv_xive_presenter_get_config(XivePresenter *xptr)
+{
+    uint32_t cfg = 0;
+
+    /* TIMA GEN1 is all P9 knows */
+    cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
+
+    return cfg;
+}
+
 static uint8_t pnv_xive_get_block_id(XiveRouter *xrtr)
 {
     return pnv_xive_block_id(PNV_XIVE(xrtr));
@@ -1991,6 +2001,7 @@ static void pnv_xive_class_init(ObjectClass *klass, void *data)
 
     xnc->notify = pnv_xive_notify;
     xpc->match_nvt  = pnv_xive_match_nvt;
+    xpc->get_config = pnv_xive_presenter_get_config;
 };
 
 static const TypeInfo pnv_xive_info = {
diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index ec1edeb385..59534f6843 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -501,6 +501,17 @@ static int pnv_xive2_match_nvt(XivePresenter *xptr, uint8_t format,
     return count;
 }
 
+static uint32_t pnv_xive2_presenter_get_config(XivePresenter *xptr)
+{
+    PnvXive2 *xive = PNV_XIVE2(xptr);
+    uint32_t cfg = 0;
+
+    if (xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS) {
+        cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
+    }
+    return cfg;
+}
+
 static uint8_t pnv_xive2_get_block_id(Xive2Router *xrtr)
 {
     return pnv_xive2_block_id(PNV_XIVE2(xrtr));
@@ -1987,6 +1998,7 @@ static void pnv_xive2_class_init(ObjectClass *klass, void *data)
     xnc->notify    = pnv_xive2_notify;
 
     xpc->match_nvt  = pnv_xive2_match_nvt;
+    xpc->get_config = pnv_xive2_presenter_get_config;
 };
 
 static const TypeInfo pnv_xive2_info = {
diff --git a/hw/intc/spapr_xive.c b/hw/intc/spapr_xive.c
index dc641cc604..8bcab2846c 100644
--- a/hw/intc/spapr_xive.c
+++ b/hw/intc/spapr_xive.c
@@ -475,6 +475,21 @@ static int spapr_xive_match_nvt(XivePresenter *xptr, uint8_t format,
     return count;
 }
 
+static uint32_t spapr_xive_presenter_get_config(XivePresenter *xptr)
+{
+    uint32_t cfg = 0;
+
+    /*
+     * Let's claim GEN1 TIMA format. If running with KVM on P10, the
+     * correct answer is deep in the hardware and not accessible to
+     * us.  But it shouldn't matter as it only affects the presenter
+     * as seen by a guest OS.
+     */
+    cfg |= XIVE_PRESENTER_GEN1_TIMA_OS;
+
+    return cfg;
+}
+
 static uint8_t spapr_xive_get_block_id(XiveRouter *xrtr)
 {
     return SPAPR_XIVE_BLOCK_ID;
@@ -832,6 +847,7 @@ static void spapr_xive_class_init(ObjectClass *klass, void *data)
     sicc->post_load = spapr_xive_post_load;
 
     xpc->match_nvt  = spapr_xive_match_nvt;
+    xpc->get_config = spapr_xive_presenter_get_config;
     xpc->in_kernel  = spapr_xive_in_kernel_xptr;
 }
 
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 5204c14b87..34a868b185 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -461,6 +461,13 @@ static void xive_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     }
 }
 
+static __attribute__((unused)) uint32_t xive_presenter_get_config(XivePresenter *xptr)
+{
+    XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
+
+    return xpc->get_config(xptr);
+}
+
 /*
  * Define a mapping of "special" operations depending on the TIMA page
  * offset and the size of the operation.
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index f7eea4ca81..3dfb06e002 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -430,6 +430,8 @@ typedef struct XivePresenterClass XivePresenterClass;
 DECLARE_CLASS_CHECKERS(XivePresenterClass, XIVE_PRESENTER,
                        TYPE_XIVE_PRESENTER)
 
+#define XIVE_PRESENTER_GEN1_TIMA_OS     0x1
+
 struct XivePresenterClass {
     InterfaceClass parent;
     int (*match_nvt)(XivePresenter *xptr, uint8_t format,
@@ -437,6 +439,7 @@ struct XivePresenterClass {
                      bool cam_ignore, uint8_t priority,
                      uint32_t logic_serv, XiveTCTXMatch *match);
     bool (*in_kernel)(const XivePresenter *xptr);
+    uint32_t (*get_config)(XivePresenter *xptr);
 };
 
 int xive_presenter_tctx_match(XivePresenter *xptr, XiveTCTX *tctx,

From 177835304b39b6ed6a7c51fd19263ac10995dbec Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Thu, 22 Jun 2023 18:25:27 +0200
Subject: [PATCH 0131/1353] pnv/xive2: Check TIMA special ops against a
 dedicated array for P10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Accessing the TIMA from some specific ring/offset combination can
trigger a special operation, with or without side effects. It is
implemented in qemu with an array of special operations to compare
accesses against. Since the presenter on P10 is pretty similar to P9,
we had the full array defined for P9 and we just had a special case
for P10 to treat one access differently. With a recent change,
6f2cbd133d4 ("pnv/xive2: Handle TIMA access through all ports"), we
now ignore some of the bits of the TIMA address, but that patch
managed to botch the detection of the special case for P10.

To clean that up, this patch introduces a full array of special ops to
be used for P10. The code to detect a special access is common with
P9, only the array of operations differs. The presenter can pick the
correct array of special ops based on its configuration introduced in
a previous patch.

Fixes: Coverity CID 1512997, 1512998
Fixes: 6f2cbd133d4 ("pnv/xive2: Handle TIMA access through all ports")
Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/intc/pnv_xive2.c | 32 ----------------------------
 hw/intc/xive.c      | 52 +++++++++++++++++++++++++++++++++++++--------
 2 files changed, 43 insertions(+), 41 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 59534f6843..ed438a20ed 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1656,17 +1656,6 @@ static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
 /*
  * TIMA ops
  */
-
-/*
- * Special TIMA offsets to handle accesses in a POWER10 way.
- *
- * Only the CAM line updates done by the hypervisor should be handled
- * specifically.
- */
-#define HV_PAGE_OFFSET         (XIVE_TM_HV_PAGE << TM_SHIFT)
-#define HV_PUSH_OS_CTX_OFFSET  (HV_PAGE_OFFSET | (TM_QW1_OS + TM_WORD2))
-#define HV_PULL_OS_CTX_OFFSET  (HV_PAGE_OFFSET | TM_SPC_PULL_OS_CTX)
-
 static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
                                uint64_t value, unsigned size)
 {
@@ -1674,18 +1663,7 @@ static void pnv_xive2_tm_write(void *opaque, hwaddr offset,
     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
     XivePresenter *xptr = XIVE_PRESENTER(xive);
-    bool gen1_tima_os =
-        xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
 
-    offset &= TM_ADDRESS_MASK;
-
-    /* TODO: should we switch the TM ops table instead ? */
-    if (!gen1_tima_os && offset == HV_PUSH_OS_CTX_OFFSET) {
-        xive2_tm_push_os_ctx(xptr, tctx, offset, value, size);
-        return;
-    }
-
-    /* Other TM ops are the same as XIVE1 */
     xive_tctx_tm_write(xptr, tctx, offset, value, size);
 }
 
@@ -1695,17 +1673,7 @@ static uint64_t pnv_xive2_tm_read(void *opaque, hwaddr offset, unsigned size)
     PnvXive2 *xive = pnv_xive2_tm_get_xive(cpu);
     XiveTCTX *tctx = XIVE_TCTX(pnv_cpu_state(cpu)->intc);
     XivePresenter *xptr = XIVE_PRESENTER(xive);
-    bool gen1_tima_os =
-        xive->cq_regs[CQ_XIVE_CFG >> 3] & CQ_XIVE_CFG_GEN1_TIMA_OS;
 
-    offset &= TM_ADDRESS_MASK;
-
-    /* TODO: should we switch the TM ops table instead ? */
-    if (!gen1_tima_os && offset == HV_PULL_OS_CTX_OFFSET) {
-        return xive2_tm_pull_os_ctx(xptr, tctx, offset, size);
-    }
-
-    /* Other TM ops are the same as XIVE1 */
     return xive_tctx_tm_read(xptr, tctx, offset, size);
 }
 
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 34a868b185..84c079b034 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -20,6 +20,7 @@
 #include "monitor/monitor.h"
 #include "hw/irq.h"
 #include "hw/ppc/xive.h"
+#include "hw/ppc/xive2.h"
 #include "hw/ppc/xive_regs.h"
 #include "trace.h"
 
@@ -461,7 +462,7 @@ static void xive_tm_push_os_ctx(XivePresenter *xptr, XiveTCTX *tctx,
     }
 }
 
-static __attribute__((unused)) uint32_t xive_presenter_get_config(XivePresenter *xptr)
+static uint32_t xive_presenter_get_config(XivePresenter *xptr)
 {
     XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
 
@@ -504,14 +505,47 @@ static const XiveTmOp xive_tm_operations[] = {
     { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  8, NULL, xive_tm_pull_pool_ctx },
 };
 
-static const XiveTmOp *xive_tm_find_op(hwaddr offset, unsigned size, bool write)
+static const XiveTmOp xive2_tm_operations[] = {
+    /*
+     * MMIOs below 2K : raw values and special operations without side
+     * effects
+     */
+    { XIVE_TM_OS_PAGE, TM_QW1_OS + TM_CPPR,   1, xive_tm_set_os_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW1_OS + TM_WORD2,  4, xive2_tm_push_os_ctx, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_CPPR, 1, xive_tm_set_hv_cppr, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, xive_tm_vt_push, NULL },
+    { XIVE_TM_HV_PAGE, TM_QW3_HV_PHYS + TM_WORD2, 1, NULL, xive_tm_vt_poll },
+
+    /* MMIOs above 2K : special operations with side effects */
+    { XIVE_TM_OS_PAGE, TM_SPC_ACK_OS_REG,     2, NULL, xive_tm_ack_os_reg },
+    { XIVE_TM_OS_PAGE, TM_SPC_SET_OS_PENDING, 1, xive_tm_set_os_pending, NULL },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,    4, NULL, xive2_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_OS_CTX,    8, NULL, xive2_tm_pull_os_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_ACK_HV_REG,     2, NULL, xive_tm_ack_hv_reg },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  4, NULL, xive_tm_pull_pool_ctx },
+    { XIVE_TM_HV_PAGE, TM_SPC_PULL_POOL_CTX,  8, NULL, xive_tm_pull_pool_ctx },
+};
+
+static const XiveTmOp *xive_tm_find_op(XivePresenter *xptr, hwaddr offset,
+                                       unsigned size, bool write)
 {
     uint8_t page_offset = (offset >> TM_SHIFT) & 0x3;
     uint32_t op_offset = offset & TM_ADDRESS_MASK;
-    int i;
+    const XiveTmOp *tm_ops;
+    int i, tm_ops_count;
+    uint32_t cfg;
 
-    for (i = 0; i < ARRAY_SIZE(xive_tm_operations); i++) {
-        const XiveTmOp *xto = &xive_tm_operations[i];
+    cfg = xive_presenter_get_config(xptr);
+    if (cfg & XIVE_PRESENTER_GEN1_TIMA_OS) {
+        tm_ops = xive_tm_operations;
+        tm_ops_count = ARRAY_SIZE(xive_tm_operations);
+    } else {
+        tm_ops = xive2_tm_operations;
+        tm_ops_count = ARRAY_SIZE(xive2_tm_operations);
+    }
+
+    for (i = 0; i < tm_ops_count; i++) {
+        const XiveTmOp *xto = &tm_ops[i];
 
         /* Accesses done from a more privileged TIMA page is allowed */
         if (xto->page_offset >= page_offset &&
@@ -542,7 +576,7 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
      * First, check for special operations in the 2K region
      */
     if (offset & TM_SPECIAL_OP) {
-        xto = xive_tm_find_op(offset, size, true);
+        xto = xive_tm_find_op(tctx->xptr, offset, size, true);
         if (!xto) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid write access at TIMA "
                           "@%"HWADDR_PRIx"\n", offset);
@@ -555,7 +589,7 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
     /*
      * Then, for special operations in the region below 2K.
      */
-    xto = xive_tm_find_op(offset, size, true);
+    xto = xive_tm_find_op(tctx->xptr, offset, size, true);
     if (xto) {
         xto->write_handler(xptr, tctx, offset, value, size);
         return;
@@ -581,7 +615,7 @@ uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
      * First, check for special operations in the 2K region
      */
     if (offset & TM_SPECIAL_OP) {
-        xto = xive_tm_find_op(offset, size, false);
+        xto = xive_tm_find_op(tctx->xptr, offset, size, false);
         if (!xto) {
             qemu_log_mask(LOG_GUEST_ERROR, "XIVE: invalid read access to TIMA"
                           "@%"HWADDR_PRIx"\n", offset);
@@ -594,7 +628,7 @@ uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
     /*
      * Then, for special operations in the region below 2K.
      */
-    xto = xive_tm_find_op(offset, size, false);
+    xto = xive_tm_find_op(tctx->xptr, offset, size, false);
     if (xto) {
         ret = xto->read_handler(xptr, tctx, offset, size);
         goto out;

From 5eb63b88d0ac259c2f49e62b6dcc6527a5caf255 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Fri, 23 Jun 2023 22:21:35 +1000
Subject: [PATCH 0132/1353] tests/avocado: ppc test VOF bios Linux boot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VOF is the new lightweight fast pseries bios. Add a Linux boot test
using VOF.

More tests could be moved to use VOF becasue it's much faster, but
just dip one toe in the water first here. SLOF should continue to be
tested too.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/avocado/ppc_pseries.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/avocado/ppc_pseries.py b/tests/avocado/ppc_pseries.py
index ff42c770f2..a8311e6555 100644
--- a/tests/avocado/ppc_pseries.py
+++ b/tests/avocado/ppc_pseries.py
@@ -29,6 +29,17 @@ class pseriesMachine(QemuSystemTest):
                          '-append', kernel_command_line)
         self.vm.launch()
 
+    def test_ppc64_vof_linux_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:pseries
+        """
+
+        self.vm.add_args('-machine', 'x-vof=on')
+        self.do_test_ppc64_linux_boot()
+        console_pattern = 'VFS: Cannot open root device'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+
     def test_ppc64_linux_boot(self):
         """
         :avocado: tags=arch:ppc64

From ac9fd9b6981cdcc0da9d7de1409cb435a0fd2abf Mon Sep 17 00:00:00 2001
From: Milan Zamazal <mzamazal@redhat.com>
Date: Wed, 21 Jun 2023 12:17:09 +0200
Subject: [PATCH 0133/1353] tests/qtest: Fix a comment typo in
 vhost-user-test.c

Signed-off-by: Milan Zamazal <mzamazal@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230621101710.297975-4-mzamazal@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/vhost-user-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index e4f95b2858..dfb8003597 100644
--- a/tests/qtest/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -281,7 +281,7 @@ static void read_guest_mem_server(QTestState *qts, TestServer *s)
     /* iterate all regions */
     for (i = 0; i < s->fds_num; i++) {
 
-        /* We'll check only the region statring at 0x0*/
+        /* We'll check only the region starting at 0x0 */
         if (s->memory.regions[i].guest_phys_addr != 0x0) {
             continue;
         }

From d4c7a56539d0bdb6fccf60af94d528613cbc7c4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 Jun 2023 17:40:14 +0100
Subject: [PATCH 0134/1353] gitlab: centralize the container tag name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We use a fixed container tag of 'latest' so that contributors' forks
don't end up with an ever growing number of containers as they work
on throwaway feature branches.

This fixed tag causes problems running CI upstream in stable staging
branches, however, because the stable staging branch will publish old
container content that clashes with that needed by primary staging
branch. This makes it impossible to reliably run CI pipelines in
parallel in upstream for different staging branches.

This introduces $QEMU_CI_CONTAINER_TAG global variable as a way to
change which tag container publishing uses. Initially it can be set
by contributors as a git push option if they want to override the
default use of 'latest' eg

  git push gitlab <branch> -o ci.variable=QEMU_CONTAINER_TAG=fish

this is useful if contributors need to run pipelines for different
branches concurrently in their forks.

Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230608164018.2520330-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/base.yml                | 6 ++++++
 .gitlab-ci.d/buildtest-template.yml  | 4 ++--
 .gitlab-ci.d/buildtest.yml           | 4 ++--
 .gitlab-ci.d/container-template.yml  | 3 ++-
 .gitlab-ci.d/crossbuild-template.yml | 6 +++---
 .gitlab-ci.d/static_checks.yml       | 4 ++--
 docs/devel/ci-jobs.rst.inc           | 5 +++++
 7 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index 2fbb58d2a3..fba9d31cc6 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -1,4 +1,10 @@
 
+variables:
+  # On stable branches this needs changing. Should also be
+  # overridden per pipeline if running pipelines concurrently
+  # for different branches in contributor forks.
+  QEMU_CI_CONTAINER_TAG: latest
+
 # The order of rules defined here is critically important.
 # They are evaluated in order and first match wins.
 #
diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 76ff1dfcb6..5da61f4277 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -1,7 +1,7 @@
 .native_build_job_template:
   extends: .base_job_template
   stage: build
-  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
+  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   before_script:
     - JOBS=$(expr $(nproc) + 1)
   script:
@@ -40,7 +40,7 @@
 .common_test_job_template:
   extends: .base_job_template
   stage: test
-  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
+  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   script:
     - scripts/git-submodule.sh update roms/SLOF
     - meson subprojects download $(cd build/subprojects && echo *)
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 1922caf536..aa833b62ca 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -532,7 +532,7 @@ build-without-defaults:
 build-libvhost-user:
   extends: .base_job_template
   stage: build
-  image: $CI_REGISTRY_IMAGE/qemu/fedora:latest
+  image: $CI_REGISTRY_IMAGE/qemu/fedora:$QEMU_CI_CONTAINER_TAG
   needs:
     job: amd64-fedora-container
   script:
@@ -572,7 +572,7 @@ build-tools-and-docs-debian:
 # of what topic branch they're currently using
 pages:
   extends: .base_job_template
-  image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:latest
+  image: $CI_REGISTRY_IMAGE/qemu/debian-amd64:$QEMU_CI_CONTAINER_TAG
   stage: test
   needs:
     - job: build-tools-and-docs-debian
diff --git a/.gitlab-ci.d/container-template.yml b/.gitlab-ci.d/container-template.yml
index 77aa839e9e..4eec72f383 100644
--- a/.gitlab-ci.d/container-template.yml
+++ b/.gitlab-ci.d/container-template.yml
@@ -5,7 +5,8 @@
   services:
     - docker:dind
   before_script:
-    - export TAG="$CI_REGISTRY_IMAGE/qemu/$NAME:latest"
+    - export TAG="$CI_REGISTRY_IMAGE/qemu/$NAME:$QEMU_CI_CONTAINER_TAG"
+    # Always ':latest' because we always use upstream as a common cache source
     - export COMMON_TAG="$CI_REGISTRY/qemu-project/qemu/qemu/$NAME:latest"
     - docker login $CI_REGISTRY -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD"
     - until docker info; do sleep 1; done
diff --git a/.gitlab-ci.d/crossbuild-template.yml b/.gitlab-ci.d/crossbuild-template.yml
index 4f93b9e4e5..6efb0d2a54 100644
--- a/.gitlab-ci.d/crossbuild-template.yml
+++ b/.gitlab-ci.d/crossbuild-template.yml
@@ -1,7 +1,7 @@
 .cross_system_build_job:
   extends: .base_job_template
   stage: build
-  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
+  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   timeout: 80m
   script:
     - mkdir build
@@ -27,7 +27,7 @@
 .cross_accel_build_job:
   extends: .base_job_template
   stage: build
-  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
+  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   timeout: 30m
   script:
     - mkdir build
@@ -39,7 +39,7 @@
 .cross_user_build_job:
   extends: .base_job_template
   stage: build
-  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
+  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   script:
     - mkdir build
     - cd build
diff --git a/.gitlab-ci.d/static_checks.yml b/.gitlab-ci.d/static_checks.yml
index b4cbdbce2a..ad9f426a52 100644
--- a/.gitlab-ci.d/static_checks.yml
+++ b/.gitlab-ci.d/static_checks.yml
@@ -26,7 +26,7 @@ check-dco:
 check-python-minreqs:
   extends: .base_job_template
   stage: test
-  image: $CI_REGISTRY_IMAGE/qemu/python:latest
+  image: $CI_REGISTRY_IMAGE/qemu/python:$QEMU_CI_CONTAINER_TAG
   script:
     - make -C python check-minreqs
   variables:
@@ -37,7 +37,7 @@ check-python-minreqs:
 check-python-tox:
   extends: .base_job_template
   stage: test
-  image: $CI_REGISTRY_IMAGE/qemu/python:latest
+  image: $CI_REGISTRY_IMAGE/qemu/python:$QEMU_CI_CONTAINER_TAG
   script:
     - make -C python check-tox
   variables:
diff --git a/docs/devel/ci-jobs.rst.inc b/docs/devel/ci-jobs.rst.inc
index 1f28fec0d0..f72537853b 100644
--- a/docs/devel/ci-jobs.rst.inc
+++ b/docs/devel/ci-jobs.rst.inc
@@ -70,6 +70,11 @@ in a handful of namespaces
    repository CI settings, or as git push variables, to influence
    which jobs get run in a pipeline
 
+ * QEMU_CI_CONTAINER_TAG - the tag used to publish containers
+   in stage 1, for use by build jobs in stage 2. Defaults to
+   'latest', but if running pipelines for different branches
+   concurrently, it should be overridden per pipeline.
+
  * nnn - other misc variables not falling into the above
    categories, or using different names for historical reasons
    and not yet converted.

From 1ddd2ff9cd873dd7d634a0b6296e91c6583b47e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 Jun 2023 17:40:15 +0100
Subject: [PATCH 0135/1353] gitlab: allow overriding name of the upstream
 repository
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CI rules have special logic for what happens in upstream. To enable
contributors who modify CI rules to test this logic, however, they need
to be able to override which repo is considered upstream. This
introduces the 'QEMU_CI_UPSTREAM' variable

  git push gitlab <branch> -o ci.variable=QEMU_CI_UPSTREAM=berrange

to make it look as if my namespace is the actual upstream. Namespace in
this context refers to the path fragment in gitlab URLs that is above
the repository. Typically this will be the contributor's gitlab login
name.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230608164018.2520330-3-berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/base.yml      | 19 ++++++++++++-------
 docs/devel/ci-jobs.rst.inc |  6 ++++++
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index fba9d31cc6..a1d734267a 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -5,6 +5,11 @@ variables:
   # for different branches in contributor forks.
   QEMU_CI_CONTAINER_TAG: latest
 
+  # For purposes of CI rules, upstream is the gitlab.com/qemu-project
+  # namespace. When testing CI, it might be usefult to override this
+  # to point to a fork repo
+  QEMU_CI_UPSTREAM: qemu-project
+
 # The order of rules defined here is critically important.
 # They are evaluated in order and first match wins.
 #
@@ -30,23 +35,23 @@ variables:
       when: never
 
     # Publishing jobs should only run on the default branch in upstream
-    - if: '$QEMU_JOB_PUBLISH == "1" && $CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
+    - if: '$QEMU_JOB_PUBLISH == "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
       when: never
 
     # Non-publishing jobs should only run on staging branches in upstream
-    - if: '$QEMU_JOB_PUBLISH != "1" && $CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH !~ /staging/'
+    - if: '$QEMU_JOB_PUBLISH != "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH !~ /staging/'
       when: never
 
     # Jobs only intended for forks should always be skipped on upstream
-    - if: '$QEMU_JOB_ONLY_FORKS == "1" && $CI_PROJECT_NAMESPACE == "qemu-project"'
+    - if: '$QEMU_JOB_ONLY_FORKS == "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM'
       when: never
 
     # Forks don't get pipelines unless QEMU_CI=1 or QEMU_CI=2 is set
-    - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != "qemu-project"'
+    - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: never
 
     # Avocado jobs don't run in forks unless $QEMU_CI_AVOCADO_TESTING is set
-    - if: '$QEMU_JOB_AVOCADO && $QEMU_CI_AVOCADO_TESTING != "1" && $CI_PROJECT_NAMESPACE != "qemu-project"'
+    - if: '$QEMU_JOB_AVOCADO && $QEMU_CI_AVOCADO_TESTING != "1" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: never
 
 
@@ -66,7 +71,7 @@ variables:
       allow_failure: true
 
     # Avocado jobs can be manually start in forks if $QEMU_CI_AVOCADO_TESTING is unset
-    - if: '$QEMU_JOB_AVOCADO && $CI_PROJECT_NAMESPACE != "qemu-project"'
+    - if: '$QEMU_JOB_AVOCADO && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: manual
       allow_failure: true
 
@@ -78,7 +83,7 @@ variables:
 
     # Forks pipeline jobs don't start automatically unless
     # QEMU_CI=2 is set
-    - if: '$QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != "qemu-project"'
+    - if: '$QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: manual
 
     # Jobs can run if any jobs they depend on were successful
diff --git a/docs/devel/ci-jobs.rst.inc b/docs/devel/ci-jobs.rst.inc
index f72537853b..3f6802d51e 100644
--- a/docs/devel/ci-jobs.rst.inc
+++ b/docs/devel/ci-jobs.rst.inc
@@ -75,6 +75,12 @@ in a handful of namespaces
    'latest', but if running pipelines for different branches
    concurrently, it should be overridden per pipeline.
 
+ * QEMU_CI_UPSTREAM - gitlab namespace that is considered to be
+   the 'upstream'. This defaults to 'qemu-project'. Contributors
+   may choose to override this if they are modifying rules in
+   base.yml and need to validate how they will operate when in
+   an upstream context, as opposed to their fork context.
+
  * nnn - other misc variables not falling into the above
    categories, or using different names for historical reasons
    and not yet converted.

From e28112d00703abd136e2411d23931f4f891c9244 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 Jun 2023 17:40:16 +0100
Subject: [PATCH 0136/1353] gitlab: stable staging branches publish containers
 in a separate tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the stable staging branches publish containers under the 'latest' tag
they will clash with containers published on the primary staging branch,
as well  as with each other. This introduces logic that overrides the
container tag when jobs run against the stable staging branches.

The CI_COMMIT_REF_SLUG variable we use expands to the git branch name,
but with most special characters removed, such that it is valid as a
docker tag name. eg 'staging-8.0' will get a slug of 'staging-8-0'

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230608164018.2520330-4-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/base.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index a1d734267a..f379c182a7 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -1,7 +1,7 @@
 
 variables:
-  # On stable branches this needs changing. Should also be
-  # overridden per pipeline if running pipelines concurrently
+  # On stable branches this is changed by later rules. Should also
+  # be overridden per pipeline if running pipelines concurrently
   # for different branches in contributor forks.
   QEMU_CI_CONTAINER_TAG: latest
 
@@ -16,6 +16,9 @@ variables:
 # Thus we group them into a number of stages, ordered from
 # most restrictive to least restrictive
 #
+# For pipelines running for stable "staging-X.Y" branches
+# we must override QEMU_CI_CONTAINER_TAG
+#
 .base_job_template:
   variables:
     # Each script line from will be in a collapsible section in the job output
@@ -61,11 +64,23 @@ variables:
     #############################################################
 
     # Optional jobs should not be run unless manually triggered
+    - if: '$QEMU_JOB_OPTIONAL && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /staging-[[:digit:]]+\.[[:digit:]]/'
+      when: manual
+      allow_failure: true
+      variables:
+        QEMU_CI_CONTAINER_TAG: $CI_COMMIT_REF_SLUG
+
     - if: '$QEMU_JOB_OPTIONAL'
       when: manual
       allow_failure: true
 
     # Skipped jobs should not be run unless manually triggered
+    - if: '$QEMU_JOB_SKIPPED && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /staging-[[:digit:]]+\.[[:digit:]]/'
+      when: manual
+      allow_failure: true
+      variables:
+        QEMU_CI_CONTAINER_TAG: $CI_COMMIT_REF_SLUG
+
     - if: '$QEMU_JOB_SKIPPED'
       when: manual
       allow_failure: true
@@ -87,4 +102,9 @@ variables:
       when: manual
 
     # Jobs can run if any jobs they depend on were successful
+    - if: '$QEMU_JOB_SKIPPED && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /staging-[[:digit:]]+\.[[:digit:]]/'
+      when: on_success
+      variables:
+        QEMU_CI_CONTAINER_TAG: $CI_COMMIT_REF_SLUG
+
     - when: on_success

From a77ef83cf8f2a7deeb23357fc6f005695a56a81c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 Jun 2023 17:40:17 +0100
Subject: [PATCH 0137/1353] gitlab: avoid extra pipelines for tags and stable
 branches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In upstream context we only run pipelines on staging branches, and
limited publishing jobs on the default branch.

We don't want to run pipelines on stable branches, or tags, because
the content will have already been tested on a staging branch before
getting pushed.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230608164018.2520330-5-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/base.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index f379c182a7..999149852e 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -33,6 +33,14 @@ variables:
     # want jobs to run
     #############################################################
 
+    # Never run jobs upstream on stable branch, staging branch jobs already ran
+    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^stable-/'
+      when: never
+
+    # Never run jobs upstream on tags, staging branch jobs already ran
+    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_TAG'
+      when: never
+
     # Cirrus jobs can't run unless the creds / target repo are set
     - if: '$QEMU_JOB_CIRRUS && ($CIRRUS_GITHUB_REPO == null || $CIRRUS_API_TOKEN == null)'
       when: never

From 49ac76c2a0ef4a49a4d259fff28829c0a7ce8458 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 8 Jun 2023 17:40:18 +0100
Subject: [PATCH 0138/1353] gitlab: support disabling job auto-run in upstream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In forks QEMU_CI=1 can be used to create a pipeline but not auto-run any
jobs. In upstream jobs always auto-run, which is equiv of QEMU_CI=2.

This supports setting QEMU_CI=1 in upstream, to disable job auto-run.
This can be used to preserve CI minutes if repushing a branch to staging
with a specific fix that only needs testing in limited scenarios.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230608164018.2520330-6-berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/base.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index 999149852e..188a770799 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -109,6 +109,16 @@ variables:
     - if: '$QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
       when: manual
 
+    # Upstream pipeline jobs start automatically unless told not to
+    # by setting QEMU_CI=1
+    - if: '$QEMU_CI == "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /staging-[[:digit:]]+\.[[:digit:]]/'
+      when: manual
+      variables:
+        QEMU_CI_CONTAINER_TAG: $CI_COMMIT_REF_SLUG
+
+    - if: '$QEMU_CI == "1" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM'
+      when: manual
+
     # Jobs can run if any jobs they depend on were successful
     - if: '$QEMU_JOB_SKIPPED && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /staging-[[:digit:]]+\.[[:digit:]]/'
       when: on_success

From a3fcbb47901cbf6e99ad68539867ae69ec3b605a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 20 Jun 2023 17:37:19 +0200
Subject: [PATCH 0139/1353] gitlab-ci: grab msys2 meson-logs as artifacts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename build directory to "build", like most other CI builds.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230620153720.514882-2-marcandre.lureau@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 472bacd2e2..d45794463a 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -11,6 +11,11 @@
   needs: []
   stage: build
   timeout: 80m
+  artifacts:
+    name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
+    expire_in: 7 days
+    paths:
+      - build/meson-logs/testlog.txt
   before_script:
   - If ( !(Test-Path -Path msys64\var\cache ) ) {
       mkdir msys64\var\cache
@@ -65,8 +70,8 @@ msys2-64bit:
   - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
   - $env:MSYSTEM = 'MINGW64'     # Start a 64-bit MinGW environment
   - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
-  - mkdir output
-  - cd output
+  - mkdir build
+  - cd build
   # Note: do not remove "--without-default-devices"!
   # commit 9f8e6cad65a6 ("gitlab-ci: Speed up the msys2-64bit job by using --without-default-devices"
   # changed to compile QEMU with the --without-default-devices switch
@@ -115,8 +120,8 @@ msys2-32bit:
   - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
   - $env:MSYSTEM = 'MINGW32'     # Start a 32-bit MinGW environment
   - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
-  - mkdir output
-  - cd output
+  - mkdir build
+  - cd build
   - ..\msys64\usr\bin\bash -lc '../configure --target-list=ppc64-softmmu
                                 --enable-fdt=system'
   - ..\msys64\usr\bin\bash -lc 'make'

From 81a12315ade028ae356e8f2e264344b537a9715b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 20 Jun 2023 17:37:20 +0200
Subject: [PATCH 0140/1353] gitlab-ci: add msys2 meson test to junit report
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230620153720.514882-3-marcandre.lureau@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index d45794463a..f889a468b5 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -16,6 +16,8 @@
     expire_in: 7 days
     paths:
       - build/meson-logs/testlog.txt
+    reports:
+      junit: "build/meson-logs/testlog.junit.xml"
   before_script:
   - If ( !(Test-Path -Path msys64\var\cache ) ) {
       mkdir msys64\var\cache

From b197ea8636a18b0e2968b00c3a392bfc641b51a0 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 22 Jun 2023 13:41:32 +0200
Subject: [PATCH 0141/1353] tests/qtest/cxl-test: Clean up temporary
 directories after testing

It's good style to clean up temporary directories when they
are not needed anymore.

Message-Id: <20230622114132.372898-1-thuth@redhat.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/cxl-test.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/qtest/cxl-test.c b/tests/qtest/cxl-test.c
index edcad4a0ce..a600331843 100644
--- a/tests/qtest/cxl-test.c
+++ b/tests/qtest/cxl-test.c
@@ -124,6 +124,7 @@ static void cxl_t3d_deprecated(void)
 
     qtest_start(cmdline->str);
     qtest_end();
+    rmdir(tmpfs);
 }
 
 static void cxl_t3d_persistent(void)
@@ -138,6 +139,7 @@ static void cxl_t3d_persistent(void)
 
     qtest_start(cmdline->str);
     qtest_end();
+    rmdir(tmpfs);
 }
 
 static void cxl_t3d_volatile(void)

From 6c5f893d1771edc49fe6d3f8580be19a42b3b118 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 23 May 2023 17:56:33 +0200
Subject: [PATCH 0142/1353] build: further refine build.ninja rules

In commit b0fcc6fc7fc1 ("build: rebuild build.ninja using
"meson setup --reconfigure"", 2023-05-19) I changed the build.ninja
rule in the Makefile to use "meson setup" so that the Makefile would
pick up a changed path to the meson binary.

However, there was a reason why build.ninja was rebuilt using $(NINJA)
itself.  Namely, ninja has its own cache of file modification times,
and if it does not know about the modification that was done outside
its control, it will *also* try to regenerate build.ninja.  This can be
simply by running "make" on a fresh tree immediately after "configure";
that will trigger an unnecessary meson run.

So, apply a refinement to the rule in order to cover both cases:

- track the meson binary that was used (and that is embedded in
  build.ninja's reconfigure rules); to do this, write build.ninja.stamp
  right after executing meson successfully

- if it changed, force usage of "$(MESON) setup --reconfigure" to
  update the path in the reconfigure rule

- if it didn't change, use "$(NINJA) build.ninja" just like before
  commit b0fcc6fc7fc1.

Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 Makefile  | 17 +++++++++++++----
 configure |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index b22bf6fba1..804a5681e0 100644
--- a/Makefile
+++ b/Makefile
@@ -83,16 +83,17 @@ config-host.mak: $(SRC_PATH)/configure $(SRC_PATH)/scripts/meson-buildoptions.sh
 	@if test -f meson-private/coredata.dat; then \
 	  ./config.status --skip-meson; \
 	else \
-	  ./config.status && touch build.ninja.stamp; \
+	  ./config.status; \
 	fi
 
 # 2. meson.stamp exists if meson has run at least once (so ninja reconfigure
 # works), but otherwise never needs to be updated
+
 meson-private/coredata.dat: meson.stamp
 meson.stamp: config-host.mak
 	@touch meson.stamp
 
-# 3. ensure generated build files are up-to-date
+# 3. ensure meson-generated build files are up-to-date
 
 ifneq ($(NINJA),)
 Makefile.ninja: build.ninja
@@ -106,11 +107,19 @@ Makefile.ninja: build.ninja
 endif
 
 ifneq ($(MESON),)
-# A separate rule is needed for Makefile dependencies to avoid -n
+# The path to meson always points to pyvenv/bin/meson, but the absolute
+# paths could change.  In that case, force a regeneration of build.ninja.
+# Note that this invocation of $(NINJA), just like when Make rebuilds
+# Makefiles, does not include -n.
 build.ninja: build.ninja.stamp
 $(build-files):
 build.ninja.stamp: meson.stamp $(build-files)
-	$(MESON) setup --reconfigure $(SRC_PATH) && touch $@
+	@if test "$$(cat build.ninja.stamp)" = "$(MESON)" && test -n "$(NINJA)"; then \
+	  $(NINJA) build.ninja; \
+	else \
+	  echo "$(MESON) setup --reconfigure $(SRC_PATH)"; \
+	  $(MESON) setup --reconfigure $(SRC_PATH); \
+	fi && echo "$(MESON)" > $@
 
 Makefile.mtest: build.ninja scripts/mtest2make.py
 	$(MESON) introspect --targets --tests --benchmarks | $(PYTHON) scripts/mtest2make.py > $@
diff --git a/configure b/configure
index 01a53576a7..86363a7e50 100755
--- a/configure
+++ b/configure
@@ -1895,6 +1895,7 @@ if test "$skip_meson" = no; then
   if test "$?" -ne 0 ; then
       error_exit "meson setup failed"
   fi
+  echo "$meson" > build.ninja.stamp
 else
   if test -f meson-private/cmd_line.txt; then
     # Adjust old command line options that were removed

From a0488cd0444101765744b8ea848fa4af7a2e850c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 6 Jun 2023 15:49:13 +0200
Subject: [PATCH 0143/1353] hw/remote/proxy: Remove dubious
 'event_notifier-posix.c' include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

event_notifier-posix.c is registered in meson's util_ss[] source
set, which is built as libqemuutil.a.p library. Both tools and
system emulation binaries are linked with qemuutil, so there is
no point in including this source file.

Introduced in commit bd36adb8df ("multi-process: create IOHUB
object to handle irq").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230606134913.93724-1-philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/remote/proxy.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/remote/proxy.c b/hw/remote/proxy.c
index 1c7786b52c..2052d721e5 100644
--- a/hw/remote/proxy.c
+++ b/hw/remote/proxy.c
@@ -22,7 +22,6 @@
 #include "qom/object.h"
 #include "qemu/event_notifier.h"
 #include "sysemu/kvm.h"
-#include "util/event_notifier-posix.c"
 
 static void probe_pci_info(PCIDevice *dev, Error **errp);
 static void proxy_device_reset(DeviceState *dev);

From a494fdb715832000ee9047a549a35aacfea8175e Mon Sep 17 00:00:00 2001
From: Gavin Shan <gshan@redhat.com>
Date: Tue, 9 May 2023 10:27:37 +1000
Subject: [PATCH 0144/1353] numa: Validate cluster and NUMA node boundary if
 required
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For some architectures like ARM64, multiple CPUs in one cluster can be
associated with different NUMA nodes, which is irregular configuration
because we shouldn't have this in baremetal environment. The irregular
configuration causes Linux guest to misbehave, as the following warning
messages indicate.

  -smp 6,maxcpus=6,sockets=2,clusters=1,cores=3,threads=1 \
  -numa node,nodeid=0,cpus=0-1,memdev=ram0                \
  -numa node,nodeid=1,cpus=2-3,memdev=ram1                \
  -numa node,nodeid=2,cpus=4-5,memdev=ram2                \

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 1 at kernel/sched/topology.c:2271 build_sched_domains+0x284/0x910
  Modules linked in:
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.14.0-268.el9.aarch64 #1
  pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  pc : build_sched_domains+0x284/0x910
  lr : build_sched_domains+0x184/0x910
  sp : ffff80000804bd50
  x29: ffff80000804bd50 x28: 0000000000000002 x27: 0000000000000000
  x26: ffff800009cf9a80 x25: 0000000000000000 x24: ffff800009cbf840
  x23: ffff000080325000 x22: ffff0000005df800 x21: ffff80000a4ce508
  x20: 0000000000000000 x19: ffff000080324440 x18: 0000000000000014
  x17: 00000000388925c0 x16: 000000005386a066 x15: 000000009c10cc2e
  x14: 00000000000001c0 x13: 0000000000000001 x12: ffff00007fffb1a0
  x11: ffff00007fffb180 x10: ffff80000a4ce508 x9 : 0000000000000041
  x8 : ffff80000a4ce500 x7 : ffff80000a4cf920 x6 : 0000000000000001
  x5 : 0000000000000001 x4 : 0000000000000007 x3 : 0000000000000002
  x2 : 0000000000001000 x1 : ffff80000a4cf928 x0 : 0000000000000001
  Call trace:
   build_sched_domains+0x284/0x910
   sched_init_domains+0xac/0xe0
   sched_init_smp+0x48/0xc8
   kernel_init_freeable+0x140/0x1ac
   kernel_init+0x28/0x140
   ret_from_fork+0x10/0x20

Improve the situation to warn when multiple CPUs in one cluster have
been associated with different NUMA nodes. However, one NUMA node is
allowed to be associated with different clusters.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230509002739.18388-2-gshan@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/core/machine.c   | 42 ++++++++++++++++++++++++++++++++++++++++++
 include/hw/boards.h |  1 +
 2 files changed, 43 insertions(+)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 1000406211..46f8f9a2b0 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1262,6 +1262,45 @@ static void machine_numa_finish_cpu_init(MachineState *machine)
     g_string_free(s, true);
 }
 
+static void validate_cpu_cluster_to_numa_boundary(MachineState *ms)
+{
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+    NumaState *state = ms->numa_state;
+    const CPUArchIdList *possible_cpus = mc->possible_cpu_arch_ids(ms);
+    const CPUArchId *cpus = possible_cpus->cpus;
+    int i, j;
+
+    if (state->num_nodes <= 1 || possible_cpus->len <= 1) {
+        return;
+    }
+
+    /*
+     * The Linux scheduling domain can't be parsed when the multiple CPUs
+     * in one cluster have been associated with different NUMA nodes. However,
+     * it's fine to associate one NUMA node with CPUs in different clusters.
+     */
+    for (i = 0; i < possible_cpus->len; i++) {
+        for (j = i + 1; j < possible_cpus->len; j++) {
+            if (cpus[i].props.has_socket_id &&
+                cpus[i].props.has_cluster_id &&
+                cpus[i].props.has_node_id &&
+                cpus[j].props.has_socket_id &&
+                cpus[j].props.has_cluster_id &&
+                cpus[j].props.has_node_id &&
+                cpus[i].props.socket_id == cpus[j].props.socket_id &&
+                cpus[i].props.cluster_id == cpus[j].props.cluster_id &&
+                cpus[i].props.node_id != cpus[j].props.node_id) {
+                warn_report("CPU-%d and CPU-%d in socket-%" PRId64 "-cluster-%" PRId64
+                             " have been associated with node-%" PRId64 " and node-%" PRId64
+                             " respectively. It can cause OSes like Linux to"
+                             " misbehave", i, j, cpus[i].props.socket_id,
+                             cpus[i].props.cluster_id, cpus[i].props.node_id,
+                             cpus[j].props.node_id);
+            }
+        }
+    }
+}
+
 MemoryRegion *machine_consume_memdev(MachineState *machine,
                                      HostMemoryBackend *backend)
 {
@@ -1355,6 +1394,9 @@ void machine_run_board_init(MachineState *machine, const char *mem_path, Error *
         numa_complete_configuration(machine);
         if (machine->numa_state->num_nodes) {
             machine_numa_finish_cpu_init(machine);
+            if (machine_class->cpu_cluster_has_numa_boundary) {
+                validate_cpu_cluster_to_numa_boundary(machine);
+            }
         }
     }
 
diff --git a/include/hw/boards.h b/include/hw/boards.h
index a385010909..6b267c21ce 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -274,6 +274,7 @@ struct MachineClass {
     bool nvdimm_supported;
     bool numa_mem_supported;
     bool auto_enable_numa;
+    bool cpu_cluster_has_numa_boundary;
     SMPCompatProps smp_props;
     const char *default_ram_id;
 

From fecff672351ace5e39adf7dbcf7a8ee748b201cb Mon Sep 17 00:00:00 2001
From: Gavin Shan <gshan@redhat.com>
Date: Tue, 9 May 2023 10:27:38 +1000
Subject: [PATCH 0145/1353] hw/arm: Validate cluster and NUMA node boundary

There are two ARM machines where NUMA is aware: 'virt' and 'sbsa-ref'.
Both of them are required to follow cluster-NUMA-node boundary. To
enable the validation to warn about the irregular configuration where
multiple CPUs in one cluster have been associated with different NUMA
nodes.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230509002739.18388-3-gshan@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/arm/sbsa-ref.c | 2 ++
 hw/arm/virt.c     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 0639f97dd5..b774d80291 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -910,6 +910,8 @@ static void sbsa_ref_class_init(ObjectClass *oc, void *data)
     mc->possible_cpu_arch_ids = sbsa_ref_possible_cpu_arch_ids;
     mc->cpu_index_to_instance_props = sbsa_ref_cpu_index_to_props;
     mc->get_default_cpu_node_id = sbsa_ref_get_default_cpu_node_id;
+    /* platform instead of architectural choice */
+    mc->cpu_cluster_has_numa_boundary = true;
 }
 
 static const TypeInfo sbsa_ref_info = {
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 9b9f7d9c68..3937e30477 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3033,6 +3033,8 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->smp_props.clusters_supported = true;
     mc->auto_enable_numa_with_memhp = true;
     mc->auto_enable_numa_with_memdev = true;
+    /* platform instead of architectural choice */
+    mc->cpu_cluster_has_numa_boundary = true;
     mc->default_ram_id = "mach-virt.ram";
     mc->default_nic = "virtio-net-pci";
 

From 3d9981cde964ea80f9c58072ddbb4df8b5a7183a Mon Sep 17 00:00:00 2001
From: Gavin Shan <gshan@redhat.com>
Date: Tue, 9 May 2023 10:27:39 +1000
Subject: [PATCH 0146/1353] hw/riscv: Validate cluster and NUMA node boundary

There are two RISCV machines where NUMA is aware: 'virt' and 'spike'.
Both of them are required to follow cluster-NUMA-node boundary. To
enable the validation to warn about the irregular configuration where
multiple CPUs in one cluster has been associated with multiple NUMA
nodes.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230509002739.18388-4-gshan@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/riscv/spike.c | 2 ++
 hw/riscv/virt.c  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 2c5546560a..81f7e53aed 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -354,6 +354,8 @@ static void spike_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
+    /* platform instead of architectural choice */
+    mc->cpu_cluster_has_numa_boundary = true;
     mc->default_ram_id = "riscv.spike.ram";
     object_class_property_add_str(oc, "signature", NULL, spike_set_signature);
     object_class_property_set_description(oc, "signature",
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 95708d890e..ed4c27487e 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1669,6 +1669,8 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
+    /* platform instead of architectural choice */
+    mc->cpu_cluster_has_numa_boundary = true;
     mc->default_ram_id = "riscv_virt_board.ram";
     assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = virt_machine_get_hotplug_handler;

From 3b6f485275ae95a81eec589d2773b86ca9ddec4d Mon Sep 17 00:00:00 2001
From: Marcelo Tosatti <mtosatti@redhat.com>
Date: Sun, 18 Jun 2023 23:24:40 +0200
Subject: [PATCH 0147/1353] kvm: reuse per-vcpu stats fd to avoid vcpu
 interruption

A regression has been detected in latency testing of KVM guests.
More specifically, it was observed that the cyclictest
numbers inside of an isolated vcpu (running on isolated pcpu) are:

Where a maximum of 50us is acceptable.

The implementation of KVM_GET_STATS_FD uses run_on_cpu to query
per vcpu statistics, which interrupts the vcpu (and is unnecessary).

To fix this, open the per vcpu stats fd on vcpu initialization,
and read from that fd from QEMU's main thread.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c   | 30 +++++++++++++++---------------
 include/hw/core/cpu.h |  1 +
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 7679f397ae..9aa898db14 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -450,6 +450,8 @@ int kvm_init_vcpu(CPUState *cpu, Error **errp)
                          "kvm_init_vcpu: kvm_arch_init_vcpu failed (%lu)",
                          kvm_arch_vcpu_id(cpu));
     }
+    cpu->kvm_vcpu_stats_fd = kvm_vcpu_ioctl(cpu, KVM_GET_STATS_FD, NULL);
+
 err:
     return ret;
 }
@@ -4007,7 +4009,7 @@ static StatsDescriptors *find_stats_descriptors(StatsTarget target, int stats_fd
 
     /* Read stats header */
     kvm_stats_header = &descriptors->kvm_stats_header;
-    ret = read(stats_fd, kvm_stats_header, sizeof(*kvm_stats_header));
+    ret = pread(stats_fd, kvm_stats_header, sizeof(*kvm_stats_header), 0);
     if (ret != sizeof(*kvm_stats_header)) {
         error_setg(errp, "KVM stats: failed to read stats header: "
                    "expected %zu actual %zu",
@@ -4038,7 +4040,8 @@ static StatsDescriptors *find_stats_descriptors(StatsTarget target, int stats_fd
 }
 
 static void query_stats(StatsResultList **result, StatsTarget target,
-                        strList *names, int stats_fd, Error **errp)
+                        strList *names, int stats_fd, CPUState *cpu,
+                        Error **errp)
 {
     struct kvm_stats_desc *kvm_stats_desc;
     struct kvm_stats_header *kvm_stats_header;
@@ -4096,7 +4099,7 @@ static void query_stats(StatsResultList **result, StatsTarget target,
         break;
     case STATS_TARGET_VCPU:
         add_stats_entry(result, STATS_PROVIDER_KVM,
-                        current_cpu->parent_obj.canonical_path,
+                        cpu->parent_obj.canonical_path,
                         stats_list);
         break;
     default:
@@ -4133,10 +4136,9 @@ static void query_stats_schema(StatsSchemaList **result, StatsTarget target,
     add_stats_schema(result, STATS_PROVIDER_KVM, target, stats_list);
 }
 
-static void query_stats_vcpu(CPUState *cpu, run_on_cpu_data data)
+static void query_stats_vcpu(CPUState *cpu, StatsArgs *kvm_stats_args)
 {
-    StatsArgs *kvm_stats_args = (StatsArgs *) data.host_ptr;
-    int stats_fd = kvm_vcpu_ioctl(cpu, KVM_GET_STATS_FD, NULL);
+    int stats_fd = cpu->kvm_vcpu_stats_fd;
     Error *local_err = NULL;
 
     if (stats_fd == -1) {
@@ -4145,14 +4147,13 @@ static void query_stats_vcpu(CPUState *cpu, run_on_cpu_data data)
         return;
     }
     query_stats(kvm_stats_args->result.stats, STATS_TARGET_VCPU,
-                kvm_stats_args->names, stats_fd, kvm_stats_args->errp);
-    close(stats_fd);
+                kvm_stats_args->names, stats_fd, cpu,
+                kvm_stats_args->errp);
 }
 
-static void query_stats_schema_vcpu(CPUState *cpu, run_on_cpu_data data)
+static void query_stats_schema_vcpu(CPUState *cpu, StatsArgs *kvm_stats_args)
 {
-    StatsArgs *kvm_stats_args = (StatsArgs *) data.host_ptr;
-    int stats_fd = kvm_vcpu_ioctl(cpu, KVM_GET_STATS_FD, NULL);
+    int stats_fd = cpu->kvm_vcpu_stats_fd;
     Error *local_err = NULL;
 
     if (stats_fd == -1) {
@@ -4162,7 +4163,6 @@ static void query_stats_schema_vcpu(CPUState *cpu, run_on_cpu_data data)
     }
     query_stats_schema(kvm_stats_args->result.schema, STATS_TARGET_VCPU, stats_fd,
                        kvm_stats_args->errp);
-    close(stats_fd);
 }
 
 static void query_stats_cb(StatsResultList **result, StatsTarget target,
@@ -4180,7 +4180,7 @@ static void query_stats_cb(StatsResultList **result, StatsTarget target,
             error_setg_errno(errp, errno, "KVM stats: ioctl failed");
             return;
         }
-        query_stats(result, target, names, stats_fd, errp);
+        query_stats(result, target, names, stats_fd, NULL, errp);
         close(stats_fd);
         break;
     }
@@ -4194,7 +4194,7 @@ static void query_stats_cb(StatsResultList **result, StatsTarget target,
             if (!apply_str_list_filter(cpu->parent_obj.canonical_path, targets)) {
                 continue;
             }
-            run_on_cpu(cpu, query_stats_vcpu, RUN_ON_CPU_HOST_PTR(&stats_args));
+            query_stats_vcpu(cpu, &stats_args);
         }
         break;
     }
@@ -4220,6 +4220,6 @@ void query_stats_schemas_cb(StatsSchemaList **result, Error **errp)
     if (first_cpu) {
         stats_args.result.schema = result;
         stats_args.errp = errp;
-        run_on_cpu(first_cpu, query_stats_schema_vcpu, RUN_ON_CPU_HOST_PTR(&stats_args));
+        query_stats_schema_vcpu(first_cpu, &stats_args);
     }
 }
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 4871ad85f0..3b765beb9b 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -402,6 +402,7 @@ struct CPUState {
     struct kvm_dirty_gfn *kvm_dirty_gfns;
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
+    int kvm_vcpu_stats_fd;
 
     /* Use by accel-block: CPU is executing an ioctl() */
     QemuLockCnt in_ioctl_lock;

From 4d714d1a0bf1fca9576ee53a1a5dfa3fd5ddae99 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 16 Jun 2023 23:57:30 +0200
Subject: [PATCH 0148/1353] target/i386: fix INVD vmexit

Due to a typo or perhaps a brain fart, the INVD vmexit was never generated.
Fix it (but not that fixing just the typo would break both INVD and WBINVD,
due to a case of two wrongs making a right).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 08c4cab73f..0de068d4b7 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -6119,7 +6119,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
     case 0x108: /* invd */
     case 0x109: /* wbinvd */
         if (check_cpl0(s)) {
-            gen_svm_check_intercept(s, (b & 2) ? SVM_EXIT_INVD : SVM_EXIT_WBINVD);
+            gen_svm_check_intercept(s, (b & 1) ? SVM_EXIT_WBINVD : SVM_EXIT_INVD);
             /* nothing to do */
         }
         break;

From 8afce497e42bb279bcbc1637ecd30b70fc001947 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 17 Jun 2023 00:01:58 +0200
Subject: [PATCH 0149/1353] target/i386: TCG supports 3DNow! prefetch(w)

The AMD prefetch(w) instructions have not been deprecated together with the rest
of 3DNow!, and in fact are even supported by newer Intel processor.  Mark them
as supported by TCG, as it supports all of 3DNow!.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 1242bd541a..ff3dcd02dc 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -647,7 +647,8 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT | CPUID_EXT2_PDPE1GB | \
           TCG_EXT2_X86_64_FEATURES)
 #define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
-          CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A)
+          CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A | \
+          CPUID_EXT3_3DNOWPREFETCH)
 #define TCG_EXT4_FEATURES 0
 #define TCG_SVM_FEATURES (CPUID_SVM_NPT | CPUID_SVM_VGIF | \
           CPUID_SVM_SVME_ADDR_CHK)

From 691925e5a3215caa6096f56070734b95054f800b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 17 Jun 2023 00:05:38 +0200
Subject: [PATCH 0150/1353] target/i386: TCG supports RDSEED

TCG implements RDSEED, and in fact uses qcrypto_random_bytes which is
secure enough to match hardware behavior.  Expose it to guests.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ff3dcd02dc..fc4246223d 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -657,11 +657,10 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ADX | \
           CPUID_7_0_EBX_PCOMMIT | CPUID_7_0_EBX_CLFLUSHOPT |            \
           CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_FSGSBASE | \
-          CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_AVX2)
+          CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_RDSEED)
           /* missing:
           CPUID_7_0_EBX_HLE
-          CPUID_7_0_EBX_INVPCID, CPUID_7_0_EBX_RTM,
-          CPUID_7_0_EBX_RDSEED */
+          CPUID_7_0_EBX_INVPCID, CPUID_7_0_EBX_RTM */
 #define TCG_7_0_ECX_FEATURES (CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU | \
           /* CPUID_7_0_ECX_OSPKE is dynamic */ \
           CPUID_7_0_ECX_LA57 | CPUID_7_0_ECX_PKS | CPUID_7_0_ECX_VAES)

From f9e0dbae7844738f2b7d8bdead7be506a8c7646d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 21 Jun 2023 00:43:22 +0200
Subject: [PATCH 0151/1353] target/i386: do not accept RDSEED if CPUID bit
 absent

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 0de068d4b7..4ef45bbd71 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -3925,12 +3925,20 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             break;
 
         case 7: /* RDSEED */
+            if (mod != 3 ||
+                (s->prefix & (PREFIX_LOCK | PREFIX_REPZ | PREFIX_REPNZ)) ||
+                !(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_RDSEED)) {
+                goto illegal_op;
+            }
+            goto do_rdrand;
+
         case 6: /* RDRAND */
             if (mod != 3 ||
                 (s->prefix & (PREFIX_LOCK | PREFIX_REPZ | PREFIX_REPNZ)) ||
                 !(s->cpuid_ext_features & CPUID_EXT_RDRAND)) {
                 goto illegal_op;
             }
+        do_rdrand:
             translator_io_start(&s->base);
             gen_helper_rdrand(s->T0, cpu_env);
             rm = (modrm & 7) | REX_B(s);

From 1420dd6a19cfbdf444af5622797d5d95a24d9461 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 17 Jun 2023 01:59:35 +0200
Subject: [PATCH 0152/1353] target/i386: TCG supports XSAVEERPTR

XSAVEERPTR is actually a fix for an errata; TCG does not have the issue.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index fc4246223d..bce0cb73e8 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -678,6 +678,8 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_SGX_12_0_EBX_FEATURES 0
 #define TCG_SGX_12_1_EAX_FEATURES 0
 
+#define TCG_8000_0008_EBX  CPUID_8000_0008_EBX_XSAVEERPTR
+
 FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     [FEAT_1_EDX] = {
         .type = CPUID_FEATURE_WORD,
@@ -939,7 +941,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "amd-psfd", NULL, NULL, NULL,
         },
         .cpuid = { .eax = 0x80000008, .reg = R_EBX, },
-        .tcg_features = 0,
+        .tcg_features = TCG_8000_0008_EBX,
         .unmigratable_flags = 0,
     },
     [FEAT_8000_0021_EAX] = {

From 431c51e9d48faecbd2dd3ffc49b1636f280bfe8d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 16 Jun 2023 23:58:25 +0200
Subject: [PATCH 0153/1353] target/i386: TCG supports WBNOINVD

WBNOINVD is the same as INVD or WBINVD as far as TCG is concerned,
since there is no cache in TCG and therefore no invalidation side effect
in WBNOINVD.

With respect to SVM emulation, processors that do not support WBNOINVD
will ignore the prefix and treat it as WBINVD, while those that support
it will generate exactly the same vmexit.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c           | 3 ++-
 target/i386/tcg/translate.c | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index bce0cb73e8..695e01582b 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -678,7 +678,8 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_SGX_12_0_EBX_FEATURES 0
 #define TCG_SGX_12_1_EAX_FEATURES 0
 
-#define TCG_8000_0008_EBX  CPUID_8000_0008_EBX_XSAVEERPTR
+#define TCG_8000_0008_EBX  (CPUID_8000_0008_EBX_XSAVEERPTR | \
+          CPUID_8000_0008_EBX_WBNOINVD)
 
 FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     [FEAT_1_EDX] = {
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 4ef45bbd71..b2e2dccb84 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -6125,7 +6125,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         break;
 
     case 0x108: /* invd */
-    case 0x109: /* wbinvd */
+    case 0x109: /* wbinvd; wbnoinvd with REPZ prefix */
         if (check_cpl0(s)) {
             gen_svm_check_intercept(s, (b & 1) ? SVM_EXIT_WBINVD : SVM_EXIT_INVD);
             /* nothing to do */

From fd5dcb1ccd660e47fb9f74043a16539631f53386 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 19 Jun 2023 15:41:42 +0200
Subject: [PATCH 0154/1353] target/i386: Intel only supports SYSCALL/SYSRET in
 long mode

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c           | 4 ++++
 target/i386/tcg/translate.c | 9 ++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 695e01582b..978d24b5ec 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6238,6 +6238,10 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                 *ecx |= 1 << 1;    /* CmpLegacy bit */
             }
         }
+        if (tcg_enabled() && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1 &&
+            !(env->hflags & HF_LMA_MASK)) {
+            *edx &= ~CPUID_EXT2_SYSCALL;
+        }
         break;
     case 0x80000002:
     case 0x80000003:
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index b2e2dccb84..ed4016f554 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -5692,7 +5692,10 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         break;
 #ifdef TARGET_X86_64
     case 0x105: /* syscall */
-        /* XXX: is it usable in real mode ? */
+        /* For Intel SYSCALL is only valid in long mode */
+        if (!LMA(s) && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1) {
+            goto illegal_op;
+        }
         gen_update_cc_op(s);
         gen_update_eip_cur(s);
         gen_helper_syscall(cpu_env, cur_insn_len_i32(s));
@@ -5702,6 +5705,10 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         gen_eob_worker(s, false, true);
         break;
     case 0x107: /* sysret */
+        /* For Intel SYSRET is only valid in long mode */
+        if (!LMA(s) && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1) {
+            goto illegal_op;
+        }
         if (!PE(s)) {
             gen_exception_gpf(s);
         } else {

From 75a02adf81911c14ec51b11a8ecd6c8aabcbd049 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 19 Jun 2023 15:41:42 +0200
Subject: [PATCH 0155/1353] target/i386: AMD only supports SYSENTER/SYSEXIT in
 32-bit mode

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index ed4016f554..a20b5af71e 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -5669,9 +5669,10 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         s->base.is_jmp = DISAS_NORETURN;
         break;
     case 0x134: /* sysenter */
-        /* For Intel SYSENTER is valid on 64-bit */
-        if (CODE64(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1)
+        /* For AMD SYSENTER is not valid in long mode */
+        if (LMA(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1) {
             goto illegal_op;
+        }
         if (!PE(s)) {
             gen_exception_gpf(s);
         } else {
@@ -5680,9 +5681,10 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         }
         break;
     case 0x135: /* sysexit */
-        /* For Intel SYSEXIT is valid on 64-bit */
-        if (CODE64(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1)
+        /* For AMD SYSEXIT is not valid in long mode */
+        if (LMA(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1) {
             goto illegal_op;
+        }
         if (!PE(s)) {
             gen_exception_gpf(s);
         } else {

From 53b9b4cc9fb956279c6494bfa7d7ea61f07bb214 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 19 Jun 2023 15:29:12 +0200
Subject: [PATCH 0156/1353] target/i386: sysret and sysexit are privileged

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index a20b5af71e..66800392bb 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -5685,7 +5685,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         if (LMA(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1) {
             goto illegal_op;
         }
-        if (!PE(s)) {
+        if (!PE(s) || CPL(s) != 0) {
             gen_exception_gpf(s);
         } else {
             gen_helper_sysexit(cpu_env, tcg_constant_i32(dflag - 1));
@@ -5711,7 +5711,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
         if (!LMA(s) && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1) {
             goto illegal_op;
         }
-        if (!PE(s)) {
+        if (!PE(s) || CPL(s) != 0) {
             gen_exception_gpf(s);
         } else {
             gen_helper_sysret(cpu_env, tcg_constant_i32(dflag - 1));

From 6750485bf42a9917a29487aec899687669104e07 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 21 Jun 2023 00:47:31 +0200
Subject: [PATCH 0157/1353] target/i386: implement RDPID in TCG

RDPID corresponds to a RDMSR(TSC_AUX); however, it is unprivileged
so for user-mode emulation we must provide the value that the kernel
places in the MSR.  For Linux, it is a combination of the current CPU
and the current NUMA node, both of which can be retrieved with getcpu(2).
Also try sched_getcpu(), which might be there on the BSDs.  If there is
no portable way to retrieve the current CPU id from userspace, return 0.

RDTSCP is reimplemented as RDTSC + RDPID ECX; the differences in terms
of serializability are not relevant to QEMU.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build                   |  2 ++
 target/i386/cpu.c             | 10 +++++++++-
 target/i386/helper.h          |  2 +-
 target/i386/tcg/misc_helper.c | 21 +++++++++++++++------
 target/i386/tcg/translate.c   | 24 +++++++++++++++++++-----
 5 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/meson.build b/meson.build
index 6ef78ea278..3e3d38badb 100644
--- a/meson.build
+++ b/meson.build
@@ -2232,6 +2232,8 @@ config_host_data.set('CONFIG_CLOCK_ADJTIME', cc.has_function('clock_adjtime'))
 config_host_data.set('CONFIG_DUP3', cc.has_function('dup3'))
 config_host_data.set('CONFIG_FALLOCATE', cc.has_function('fallocate'))
 config_host_data.set('CONFIG_POSIX_FALLOCATE', cc.has_function('posix_fallocate'))
+config_host_data.set('CONFIG_GETCPU', cc.has_function('getcpu', prefix: gnu_source_prefix))
+config_host_data.set('CONFIG_SCHED_GETCPU', cc.has_function('sched_getcpu', prefix: '#include <sched.h>'))
 # Note that we need to specify prefix: here to avoid incorrectly
 # thinking that Windows has posix_memalign()
 config_host_data.set('CONFIG_POSIX_MEMALIGN', cc.has_function('posix_memalign', prefix: '#include <stdlib.h>'))
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 978d24b5ec..4d52e612ac 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -661,9 +661,17 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           /* missing:
           CPUID_7_0_EBX_HLE
           CPUID_7_0_EBX_INVPCID, CPUID_7_0_EBX_RTM */
+
+#if defined CONFIG_SOFTMMU || defined CONFIG_LINUX
+#define TCG_7_0_ECX_RDPID CPUID_7_0_ECX_RDPID
+#else
+#define TCG_7_0_ECX_RDPID 0
+#endif
 #define TCG_7_0_ECX_FEATURES (CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU | \
           /* CPUID_7_0_ECX_OSPKE is dynamic */ \
-          CPUID_7_0_ECX_LA57 | CPUID_7_0_ECX_PKS | CPUID_7_0_ECX_VAES)
+          CPUID_7_0_ECX_LA57 | CPUID_7_0_ECX_PKS | CPUID_7_0_ECX_VAES | \
+          TCG_7_0_ECX_RDPID)
+
 #define TCG_7_0_EDX_FEATURES CPUID_7_0_EDX_FSRM
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
           CPUID_7_1_EAX_FSRC)
diff --git a/target/i386/helper.h b/target/i386/helper.h
index 48609c210b..c93c1d6c8f 100644
--- a/target/i386/helper.h
+++ b/target/i386/helper.h
@@ -69,8 +69,8 @@ DEF_HELPER_2(into, void, env, int)
 DEF_HELPER_FLAGS_1(single_step, TCG_CALL_NO_WG, noreturn, env)
 DEF_HELPER_1(rechecking_single_step, void, env)
 DEF_HELPER_1(cpuid, void, env)
+DEF_HELPER_FLAGS_1(rdpid, TCG_CALL_NO_WG, tl, env)
 DEF_HELPER_1(rdtsc, void, env)
-DEF_HELPER_1(rdtscp, void, env)
 DEF_HELPER_FLAGS_1(rdpmc, TCG_CALL_NO_WG, noreturn, env)
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/tcg/misc_helper.c b/target/i386/tcg/misc_helper.c
index 5f7a3061ca..868f36ab7f 100644
--- a/target/i386/tcg/misc_helper.c
+++ b/target/i386/tcg/misc_helper.c
@@ -75,12 +75,6 @@ void helper_rdtsc(CPUX86State *env)
     env->regs[R_EDX] = (uint32_t)(val >> 32);
 }
 
-void helper_rdtscp(CPUX86State *env)
-{
-    helper_rdtsc(env);
-    env->regs[R_ECX] = (uint32_t)(env->tsc_aux);
-}
-
 G_NORETURN void helper_rdpmc(CPUX86State *env)
 {
     if (((env->cr[4] & CR4_PCE_MASK) == 0 ) &&
@@ -137,3 +131,18 @@ void helper_wrpkru(CPUX86State *env, uint32_t ecx, uint64_t val)
     env->pkru = val;
     tlb_flush(cs);
 }
+
+target_ulong HELPER(rdpid)(CPUX86State *env)
+{
+#if defined CONFIG_SOFTMMU
+    return env->tsc_aux;
+#elif defined CONFIG_LINUX && defined CONFIG_GETCPU
+    unsigned cpu, node;
+    getcpu(&cpu, &node);
+    return (node << 12) | (cpu & 0xfff);
+#elif defined CONFIG_SCHED_GETCPU
+    return sched_getcpu();
+#else
+    return 0;
+#endif
+}
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 66800392bb..a6c2424133 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -3924,13 +3924,25 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             gen_cmpxchg8b(s, env, modrm);
             break;
 
-        case 7: /* RDSEED */
+        case 7: /* RDSEED, RDPID with f3 prefix */
             if (mod != 3 ||
-                (s->prefix & (PREFIX_LOCK | PREFIX_REPZ | PREFIX_REPNZ)) ||
-                !(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_RDSEED)) {
+                (s->prefix & (PREFIX_LOCK | PREFIX_REPNZ))) {
                 goto illegal_op;
             }
-            goto do_rdrand;
+            if (s->prefix & PREFIX_REPZ) {
+                if (!(s->cpuid_ext_features & CPUID_7_0_ECX_RDPID)) {
+                    goto illegal_op;
+                }
+                gen_helper_rdpid(s->T0, cpu_env);
+                rm = (modrm & 7) | REX_B(s);
+                gen_op_mov_reg_v(s, dflag, rm, s->T0);
+                break;
+            } else {
+                if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_RDSEED)) {
+                    goto illegal_op;
+                }
+                goto do_rdrand;
+            }
 
         case 6: /* RDRAND */
             if (mod != 3 ||
@@ -6125,7 +6137,9 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             gen_update_cc_op(s);
             gen_update_eip_cur(s);
             translator_io_start(&s->base);
-            gen_helper_rdtscp(cpu_env);
+            gen_helper_rdtsc(cpu_env);
+            gen_helper_rdpid(s->T0, cpu_env);
+            gen_op_mov_reg_v(s, dflag, R_ECX, s->T0);
             break;
 
         default:

From 63fd8ef080351357c0cb0644ed63fd3e2a8833a8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 17 Jun 2023 01:01:29 +0200
Subject: [PATCH 0158/1353] target/i386: implement SYSCALL/SYSRET in 32-bit
 emulators

AMD supports both 32-bit and 64-bit SYSCALL/SYSRET, but the TCG only
exposes it for 64-bit targets.  For system emulation just reuse the
helper; for user-mode emulation the ABI is the same as "int $80".

The BSDs does not support any fast system call mechanism in 32-bit
mode so add to bsd-user the same stub that FreeBSD has for 64-bit
compatibility mode.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 bsd-user/i386/target_arch_cpu.h     | 4 ++++
 linux-user/i386/cpu_loop.c          | 9 +++++----
 target/i386/cpu.c                   | 4 ++--
 target/i386/helper.h                | 2 --
 target/i386/tcg/seg_helper.c        | 7 +++++--
 target/i386/tcg/sysemu/seg_helper.c | 7 ++++---
 target/i386/tcg/translate.c         | 2 --
 target/i386/tcg/user/seg_helper.c   | 2 --
 8 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/bsd-user/i386/target_arch_cpu.h b/bsd-user/i386/target_arch_cpu.h
index d792dc720f..9bf2c4244b 100644
--- a/bsd-user/i386/target_arch_cpu.h
+++ b/bsd-user/i386/target_arch_cpu.h
@@ -164,6 +164,10 @@ static inline void target_cpu_loop(CPUX86State *env)
             }
             break;
 
+        case EXCP_SYSCALL:
+            /* doesn't do anything */
+            break;
+
         case EXCP_INTERRUPT:
             /* just indicate that signals should be handled asap */
             break;
diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c
index 2d0918a93f..9eeda551ea 100644
--- a/linux-user/i386/cpu_loop.c
+++ b/linux-user/i386/cpu_loop.c
@@ -211,6 +211,9 @@ void cpu_loop(CPUX86State *env)
 
         switch(trapnr) {
         case 0x80:
+#ifndef TARGET_X86_64
+        case EXCP_SYSCALL:
+#endif
             /* linux syscall from int $0x80 */
             ret = do_syscall(env,
                              env->regs[R_EAX],
@@ -227,9 +230,9 @@ void cpu_loop(CPUX86State *env)
                 env->regs[R_EAX] = ret;
             }
             break;
-#ifndef TARGET_ABI32
+#ifdef TARGET_X86_64
         case EXCP_SYSCALL:
-            /* linux syscall from syscall instruction */
+            /* linux syscall from syscall instruction.  */
             ret = do_syscall(env,
                              env->regs[R_EAX],
                              env->regs[R_EDI],
@@ -245,8 +248,6 @@ void cpu_loop(CPUX86State *env)
                 env->regs[R_EAX] = ret;
             }
             break;
-#endif
-#ifdef TARGET_X86_64
         case EXCP_VSYSCALL:
             emulate_vsyscall(env);
             break;
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4d52e612ac..c0fb6b3ad9 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -637,7 +637,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_EXT_X2APIC, CPUID_EXT_TSC_DEADLINE_TIMER */
 
 #ifdef TARGET_X86_64
-#define TCG_EXT2_X86_64_FEATURES (CPUID_EXT2_SYSCALL | CPUID_EXT2_LM)
+#define TCG_EXT2_X86_64_FEATURES CPUID_EXT2_LM
 #else
 #define TCG_EXT2_X86_64_FEATURES 0
 #endif
@@ -645,7 +645,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_EXT2_FEATURES ((TCG_FEATURES & CPUID_EXT2_AMD_ALIASES) | \
           CPUID_EXT2_NX | CPUID_EXT2_MMXEXT | CPUID_EXT2_RDTSCP | \
           CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT | CPUID_EXT2_PDPE1GB | \
-          TCG_EXT2_X86_64_FEATURES)
+          CPUID_EXT2_SYSCALL | TCG_EXT2_X86_64_FEATURES)
 #define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
           CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A | \
           CPUID_EXT3_3DNOWPREFETCH)
diff --git a/target/i386/helper.h b/target/i386/helper.h
index c93c1d6c8f..ac2b04abd6 100644
--- a/target/i386/helper.h
+++ b/target/i386/helper.h
@@ -51,10 +51,8 @@ DEF_HELPER_FLAGS_2(get_dr, TCG_CALL_NO_WG, tl, env, int)
 
 DEF_HELPER_1(sysenter, void, env)
 DEF_HELPER_2(sysexit, void, env, int)
-#ifdef TARGET_X86_64
 DEF_HELPER_2(syscall, void, env, int)
 DEF_HELPER_2(sysret, void, env, int)
-#endif
 DEF_HELPER_FLAGS_2(pause, TCG_CALL_NO_WG, noreturn, env, int)
 DEF_HELPER_FLAGS_3(raise_interrupt, TCG_CALL_NO_WG, noreturn, env, int, int)
 DEF_HELPER_FLAGS_2(raise_exception, TCG_CALL_NO_WG, noreturn, env, int)
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 03b58e94a2..e8d19c65fd 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -977,6 +977,7 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int,
                    e2);
     env->eip = offset;
 }
+#endif /* TARGET_X86_64 */
 
 void helper_sysret(CPUX86State *env, int dflag)
 {
@@ -990,6 +991,7 @@ void helper_sysret(CPUX86State *env, int dflag)
         raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());
     }
     selector = (env->star >> 48) & 0xffff;
+#ifdef TARGET_X86_64
     if (env->hflags & HF_LMA_MASK) {
         cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK
                         | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK |
@@ -1015,7 +1017,9 @@ void helper_sysret(CPUX86State *env, int dflag)
                                DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
                                DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
                                DESC_W_MASK | DESC_A_MASK);
-    } else {
+    } else
+#endif
+    {
         env->eflags |= IF_MASK;
         cpu_x86_load_seg_cache(env, R_CS, selector | 3,
                                0, 0xffffffff,
@@ -1030,7 +1034,6 @@ void helper_sysret(CPUX86State *env, int dflag)
                                DESC_W_MASK | DESC_A_MASK);
     }
 }
-#endif /* TARGET_X86_64 */
 
 /* real mode interrupt */
 static void do_interrupt_real(CPUX86State *env, int intno, int is_int,
diff --git a/target/i386/tcg/sysemu/seg_helper.c b/target/i386/tcg/sysemu/seg_helper.c
index 2c9bd007ad..1cb5a0db45 100644
--- a/target/i386/tcg/sysemu/seg_helper.c
+++ b/target/i386/tcg/sysemu/seg_helper.c
@@ -26,7 +26,6 @@
 #include "tcg/helper-tcg.h"
 #include "../seg_helper.h"
 
-#ifdef TARGET_X86_64
 void helper_syscall(CPUX86State *env, int next_eip_addend)
 {
     int selector;
@@ -35,6 +34,7 @@ void helper_syscall(CPUX86State *env, int next_eip_addend)
         raise_exception_err_ra(env, EXCP06_ILLOP, 0, GETPC());
     }
     selector = (env->star >> 32) & 0xffff;
+#ifdef TARGET_X86_64
     if (env->hflags & HF_LMA_MASK) {
         int code64;
 
@@ -61,7 +61,9 @@ void helper_syscall(CPUX86State *env, int next_eip_addend)
         } else {
             env->eip = env->cstar;
         }
-    } else {
+    } else
+#endif
+    {
         env->regs[R_ECX] = (uint32_t)(env->eip + next_eip_addend);
 
         env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
@@ -78,7 +80,6 @@ void helper_syscall(CPUX86State *env, int next_eip_addend)
         env->eip = (uint32_t)env->star;
     }
 }
-#endif /* TARGET_X86_64 */
 
 void handle_even_inj(CPUX86State *env, int intno, int is_int,
                      int error_code, int is_hw, int rm)
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index a6c2424133..28cb3fb7f4 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -5704,7 +5704,6 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             s->base.is_jmp = DISAS_EOB_ONLY;
         }
         break;
-#ifdef TARGET_X86_64
     case 0x105: /* syscall */
         /* For Intel SYSCALL is only valid in long mode */
         if (!LMA(s) && env->cpuid_vendor1 == CPUID_VENDOR_INTEL_1) {
@@ -5738,7 +5737,6 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
             gen_eob_worker(s, false, true);
         }
         break;
-#endif
     case 0x1a2: /* cpuid */
         gen_update_cc_op(s);
         gen_update_eip_cur(s);
diff --git a/target/i386/tcg/user/seg_helper.c b/target/i386/tcg/user/seg_helper.c
index 67481b0aa8..c45f2ac2ba 100644
--- a/target/i386/tcg/user/seg_helper.c
+++ b/target/i386/tcg/user/seg_helper.c
@@ -26,7 +26,6 @@
 #include "tcg/helper-tcg.h"
 #include "tcg/seg_helper.h"
 
-#ifdef TARGET_X86_64
 void helper_syscall(CPUX86State *env, int next_eip_addend)
 {
     CPUState *cs = env_cpu(env);
@@ -36,7 +35,6 @@ void helper_syscall(CPUX86State *env, int next_eip_addend)
     env->exception_next_eip = env->eip + next_eip_addend;
     cpu_loop_exit(cs);
 }
-#endif /* TARGET_X86_64 */
 
 /*
  * fake user mode interrupt. is_int is TRUE if coming from the int

From 8edddaa23d75c57e093d99bf098a39f8cbd227c7 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sun, 18 Jun 2023 23:10:39 +0200
Subject: [PATCH 0159/1353] git-submodule.sh: allow running in validate mode
 without previous update

The call to git-submodule.sh done in configure may happen without a
previous checkout of the roms/SLOF submodule, or even without a
previous run of the script.

So, handle creating a .git-submodule-status file even in validate
mode.  If git is absent, ensure that all passed directories exists
(because you should be in a fresh untar and will not have stale
arguments to git-submodule.sh) but do no other checks.  If git
is present, ensure that .git-submodule-status contains an entry
for all submodules passed on the command line.

With this change, "ignore" mode is not needed anymore.

Reported-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Fixes: b11f9bd96f4 ("configure: move SLOF submodule handling to pc-bios/s390-ccw", 2023-06-06)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure                |  2 +-
 scripts/git-submodule.sh | 73 ++++++++++++++++++++++------------------
 2 files changed, 42 insertions(+), 33 deletions(-)

diff --git a/configure b/configure
index 86363a7e50..2b41c49c0d 100755
--- a/configure
+++ b/configure
@@ -758,7 +758,7 @@ done
 
 if ! test -e "$source_path/.git"
 then
-    git_submodules_action="ignore"
+    git_submodules_action="validate"
 fi
 
 # test for any invalid configuration combinations
diff --git a/scripts/git-submodule.sh b/scripts/git-submodule.sh
index 11fad2137c..335f7f5fdf 100755
--- a/scripts/git-submodule.sh
+++ b/scripts/git-submodule.sh
@@ -9,13 +9,22 @@ command=$1
 shift
 maybe_modules="$@"
 
-# if not running in a git checkout, do nothing
-test "$command" = "ignore" && exit 0
-
+test -z "$maybe_modules" && exit 0
 test -z "$GIT" && GIT=$(command -v git)
 
 cd "$(dirname "$0")/.."
 
+no_git_error=
+if ! test -e ".git"; then
+    no_git_error='no git checkout exists'
+elif test -z "$GIT"; then
+    no_git_error='git binary not found'
+fi
+
+is_git() {
+    test -z "$no_git_error"
+}
+
 update_error() {
     echo "$0: $*"
     echo
@@ -34,7 +43,7 @@ update_error() {
 }
 
 validate_error() {
-    if test "$1" = "validate"; then
+    if is_git && test "$1" = "validate"; then
         echo "GIT submodules checkout is out of date, and submodules"
         echo "configured for validate only. Please run"
         echo "  scripts/git-submodule.sh update $maybe_modules"
@@ -51,42 +60,42 @@ check_updated() {
     test "$CURSTATUS" = "$OLDSTATUS"
 }
 
-if test -n "$maybe_modules" && ! test -e ".git"
-then
-    echo "$0: unexpectedly called with submodules but no git checkout exists"
-    exit 1
+if is_git; then
+    test -e $substat || touch $substat
+    modules=""
+    for m in $maybe_modules
+    do
+        $GIT submodule status $m 1> /dev/null 2>&1
+        if test $? = 0
+        then
+            modules="$modules $m"
+            grep $m $substat > /dev/null 2>&1 || $GIT submodule status $module >> $substat
+        else
+            echo "warn: ignoring non-existent submodule $m"
+        fi
+    done
+else
+    modules=$maybe_modules
 fi
 
-if test -n "$maybe_modules" && test -z "$GIT"
-then
-    echo "$0: unexpectedly called with submodules but git binary not found"
-    exit 1
-fi
-
-modules=""
-for m in $maybe_modules
-do
-    $GIT submodule status $m 1> /dev/null 2>&1
-    if test $? = 0
-    then
-        modules="$modules $m"
-    else
-        echo "warn: ignoring non-existent submodule $m"
-    fi
-done
-
 case "$command" in
 status|validate)
-    test -f "$substat" || validate_error "$command"
-    test -z "$maybe_modules" && exit 0
     for module in $modules; do
-        check_updated $module || validate_error "$command"
+        if is_git; then
+            check_updated $module || validate_error "$command"
+        elif ! (set xyz "$module"/* && test -e "$2"); then
+            # The directory does not exist or it contains no files
+            echo "$0: sources not available for $module and $no_git_error"
+            validate_error "$command"
+        fi
     done
-    exit 0
     ;;
+
 update)
-    test -e $substat || touch $substat
-    test -z "$maybe_modules" && exit 0
+    is_git || {
+        echo "$0: unexpectedly called with submodules but $no_git_error"
+        exit 1
+    }
 
     $GIT submodule update --init $modules 1>/dev/null
     test $? -ne 0 && update_error "failed to update modules"

From 42b1b9d7db48e72b10760869de20070b4afb6c2c Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 7 Jun 2023 22:01:25 +0200
Subject: [PATCH 0160/1353] hw/acpi: Fix PM control register access

On pegasos2 which has ACPI as part of VT8231 south bridge the board
firmware writes PM control register by accessing the second byte so
addr will be 1. This wasn't handled correctly and the write went to
addr 0 instead. Remove the acpi_pm1_cnt_write() function which is used
only once and does not take addr into account and handle non-zero
address in acpi_pm_cnt_{read|write}. This fixes ACPI shutdown with
pegasos2 firmware.

The issue below is possibly related to the same memory core bug.

Link: https://gitlab.com/qemu-project/qemu/-/issues/360
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-Id: <20230607200125.A9988746377@zero.eik.bme.hu>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/core.c | 56 +++++++++++++++++++++++++-------------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 6da275c599..00b1e79a30 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -551,8 +551,35 @@ void acpi_pm_tmr_reset(ACPIREGS *ar)
 }
 
 /* ACPI PM1aCNT */
-static void acpi_pm1_cnt_write(ACPIREGS *ar, uint16_t val)
+void acpi_pm1_cnt_update(ACPIREGS *ar,
+                         bool sci_enable, bool sci_disable)
 {
+    /* ACPI specs 3.0, 4.7.2.5 */
+    if (ar->pm1.cnt.acpi_only) {
+        return;
+    }
+
+    if (sci_enable) {
+        ar->pm1.cnt.cnt |= ACPI_BITMASK_SCI_ENABLE;
+    } else if (sci_disable) {
+        ar->pm1.cnt.cnt &= ~ACPI_BITMASK_SCI_ENABLE;
+    }
+}
+
+static uint64_t acpi_pm_cnt_read(void *opaque, hwaddr addr, unsigned width)
+{
+    ACPIREGS *ar = opaque;
+    return ar->pm1.cnt.cnt >> addr * 8;
+}
+
+static void acpi_pm_cnt_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned width)
+{
+    ACPIREGS *ar = opaque;
+
+    if (addr == 1) {
+        val = val << 8 | (ar->pm1.cnt.cnt & 0xff);
+    }
     ar->pm1.cnt.cnt = val & ~(ACPI_BITMASK_SLEEP_ENABLE);
 
     if (val & ACPI_BITMASK_SLEEP_ENABLE) {
@@ -575,33 +602,6 @@ static void acpi_pm1_cnt_write(ACPIREGS *ar, uint16_t val)
     }
 }
 
-void acpi_pm1_cnt_update(ACPIREGS *ar,
-                         bool sci_enable, bool sci_disable)
-{
-    /* ACPI specs 3.0, 4.7.2.5 */
-    if (ar->pm1.cnt.acpi_only) {
-        return;
-    }
-
-    if (sci_enable) {
-        ar->pm1.cnt.cnt |= ACPI_BITMASK_SCI_ENABLE;
-    } else if (sci_disable) {
-        ar->pm1.cnt.cnt &= ~ACPI_BITMASK_SCI_ENABLE;
-    }
-}
-
-static uint64_t acpi_pm_cnt_read(void *opaque, hwaddr addr, unsigned width)
-{
-    ACPIREGS *ar = opaque;
-    return ar->pm1.cnt.cnt;
-}
-
-static void acpi_pm_cnt_write(void *opaque, hwaddr addr, uint64_t val,
-                              unsigned width)
-{
-    acpi_pm1_cnt_write(opaque, val);
-}
-
 static const MemoryRegionOps acpi_pm_cnt_ops = {
     .read = acpi_pm_cnt_read,
     .write = acpi_pm_cnt_write,

From bf376f3020dfd7bcb2c4158b4ffa85c04d44f56d Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Wed, 7 Jun 2023 15:57:16 -0500
Subject: [PATCH 0161/1353] hw/i386/pc: Default to use SMBIOS 3.0 for newer
 machine models
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, pc-q35 and pc-i44fx machine models are default to use SMBIOS 2.8
(32-bit entry point). Since SMBIOS 3.0 (64-bit entry point) is now fully
supported since QEMU 7.0, default to use SMBIOS 3.0 for newer machine
models. This is necessary to avoid the following message when launching
a VM with large number of vcpus.

   "SMBIOS 2.1 table length 66822 exceeds 65535"

Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20230607205717.737749-2-suravee.suthikulpanit@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
---
 hw/i386/pc.c                                | 4 +++-
 hw/i386/pc_piix.c                           | 5 +++++
 hw/i386/pc_q35.c                            | 5 +++++
 include/hw/i386/pc.h                        | 1 +
 tests/qtest/bios-tables-test-allowed-diff.h | 1 +
 5 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index fc52772fdd..8d37567e08 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1856,6 +1856,7 @@ static void pc_machine_set_max_fw_size(Object *obj, Visitor *v,
 static void pc_machine_initfn(Object *obj)
 {
     PCMachineState *pcms = PC_MACHINE(obj);
+    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
 
 #ifdef CONFIG_VMPORT
     pcms->vmport = ON_OFF_AUTO_AUTO;
@@ -1863,7 +1864,7 @@ static void pc_machine_initfn(Object *obj)
     pcms->vmport = ON_OFF_AUTO_OFF;
 #endif /* CONFIG_VMPORT */
     pcms->max_ram_below_4g = 0; /* use default */
-    pcms->smbios_entry_point_type = SMBIOS_ENTRY_POINT_TYPE_32;
+    pcms->smbios_entry_point_type = pcmc->default_smbios_ep_type;
 
     /* acpi build is enabled by default if machine supports it */
     pcms->acpi_build_enabled = PC_MACHINE_GET_CLASS(pcms)->has_acpi_build;
@@ -1975,6 +1976,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->nvdimm_supported = true;
     mc->smp_props.dies_supported = true;
     mc->default_ram_id = "pc.ram";
+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
 
     object_class_property_add(oc, PC_MACHINE_MAX_RAM_BELOW_4G, "size",
         pc_machine_get_max_ram_below_4g, pc_machine_set_max_ram_below_4g,
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 44146e6ff5..f9947fbc10 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -506,11 +506,16 @@ DEFINE_I440FX_MACHINE(v8_1, "pc-i440fx-8.1", NULL,
 
 static void pc_i440fx_8_0_machine_options(MachineClass *m)
 {
+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+
     pc_i440fx_8_1_machine_options(m);
     m->alias = NULL;
     m->is_default = false;
     compat_props_add(m->compat_props, hw_compat_8_0, hw_compat_8_0_len);
     compat_props_add(m->compat_props, pc_compat_8_0, pc_compat_8_0_len);
+
+    /* For pc-i44fx-8.0 and older, use SMBIOS 2.8 by default */
+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 }
 
 DEFINE_I440FX_MACHINE(v8_0, "pc-i440fx-8.0", NULL,
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index a9a59ed42b..cf68b80974 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -387,10 +387,15 @@ DEFINE_Q35_MACHINE(v8_1, "pc-q35-8.1", NULL,
 
 static void pc_q35_8_0_machine_options(MachineClass *m)
 {
+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+
     pc_q35_8_1_machine_options(m);
     m->alias = NULL;
     compat_props_add(m->compat_props, hw_compat_8_0, hw_compat_8_0_len);
     compat_props_add(m->compat_props, pc_compat_8_0, pc_compat_8_0_len);
+
+    /* For pc-q35-8.0 and older, use SMBIOS 2.8 by default */
+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 }
 
 DEFINE_Q35_MACHINE(v8_0, "pc-q35-8.0", NULL,
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index c661e9cc80..6eec0fc51d 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -110,6 +110,7 @@ struct PCMachineClass {
     bool smbios_defaults;
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
+    SmbiosEntryPointType default_smbios_ep_type;
 
     /* RAM / address space compat: */
     bool gigabyte_align;
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..81148a604f 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,2 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/q35/SSDT.dimmpxm",

From c85cad8105e647e6aae1b0d8405c49d91994b158 Mon Sep 17 00:00:00 2001
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Mon, 26 Jun 2023 05:54:41 -0400
Subject: [PATCH 0162/1353] tests/data/acpi: update after SMBIOS 2.0 change

Switching to SMBIOS3.0 by default shifts some addresses, so we get this
change in tests/data/acpi/q35/SSDT.dimmpxm :

@@ -389,6 +389,6 @@
         }
     }

-    Name (MEMA, 0x07FFE000)
+    Name (MEMA, 0x07FFF000)
 }

update the expected file to match.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/q35/SSDT.dimmpxm            | Bin 1815 -> 1815 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 2 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/q35/SSDT.dimmpxm b/tests/data/acpi/q35/SSDT.dimmpxm
index 9ea4e0d0ceaa8a5cbd706afb6d49de853fafe654..70f133412f5e0aa128ab210245a8de7304eeb843 100644
GIT binary patch
delta 23
ecmbQvH=U0wIM^jboSlJzanD9BE_UVz|JeaVy9Ofw

delta 23
ecmbQvH=U0wIM^jboSlJzam_|9E_UV*|JeaVTLvQl

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 81148a604f..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/q35/SSDT.dimmpxm",

From e0001297eb2f8569e950e55dbda8ad686e4155fb Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Wed, 7 Jun 2023 15:57:17 -0500
Subject: [PATCH 0163/1353] pc: q35: Bump max_cpus to 1024
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since KVM_MAX_VCPUS is currently defined to 1024 for x86 as shown in
arch/x86/include/asm/kvm_host.h, update QEMU limits to the same number.

In case KVM could not support the specified number of vcpus, QEMU would
return the following error message:

  qemu-system-x86_64: kvm_init_vcpu: kvm_get_vcpu failed (xxx): Invalid argument

Also, keep max_cpus at 288 for machine version 8.0 and older.

Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Daniel P. Berrangé <berrange@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Julia Suvorova <jusual@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20230607205717.737749-3-suravee.suthikulpanit@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 hw/i386/pc_q35.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index cf68b80974..11a7084ea1 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -368,12 +368,12 @@ static void pc_q35_machine_options(MachineClass *m)
     m->default_nic = "e1000e";
     m->default_kernel_irqchip_split = false;
     m->no_floppy = 1;
+    m->max_cpus = 1024;
     m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_VMBUS_BRIDGE);
-    m->max_cpus = 288;
 }
 
 static void pc_q35_8_1_machine_options(MachineClass *m)
@@ -396,6 +396,7 @@ static void pc_q35_8_0_machine_options(MachineClass *m)
 
     /* For pc-q35-8.0 and older, use SMBIOS 2.8 by default */
     pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
+    m->max_cpus = 288;
 }
 
 DEFINE_Q35_MACHINE(v8_0, "pc-q35-8.0", NULL,

From 8bc0049eadafb984d305c847cedff550b58e5fc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 2 Jun 2023 16:38:52 +0200
Subject: [PATCH 0164/1353] vdpa: do not block migration if device has cvq and
 x-svq=on
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was a mistake to forbid in all cases, as SVQ is already able to send
all the CVQ messages before start forwarding data vqs.  It actually
caused a regression, making impossible to migrate device previously
migratable.

Fixes: 36e4647247f2 ("vdpa: add vhost_vdpa_net_valid_svq_features")
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230602143854.1879091-2-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
---
 net/vhost-vdpa.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 46778d5313..4345f1e6de 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -915,13 +915,16 @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
         s->cvq_isolated = cvq_isolated;
 
         /*
-         * TODO: We cannot migrate devices with CVQ as there is no way to set
-         * the device state (MAC, MQ, etc) before starting the datapath.
+         * TODO: We cannot migrate devices with CVQ and no x-svq enabled as
+         * there is no way to set the device state (MAC, MQ, etc) before
+         * starting the datapath.
          *
          * Migration blocker ownership now belongs to s->vhost_vdpa.
          */
-        error_setg(&s->vhost_vdpa.migration_blocker,
-                   "net vdpa cannot migrate with CVQ feature");
+        if (!svq) {
+            error_setg(&s->vhost_vdpa.migration_blocker,
+                       "net vdpa cannot migrate with CVQ feature");
+        }
     }
     ret = vhost_vdpa_add(nc, (void *)&s->vhost_vdpa, queue_pair_index, nvqs);
     if (ret) {

From 915bf6ccd7a5c9b6cbea7a72f153597d1b98834f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 2 Jun 2023 16:38:53 +0200
Subject: [PATCH 0165/1353] vdpa: reorder vhost_vdpa_net_cvq_cmd_page_len
 function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need to call it from resource cleanup context, as munmap needs the
size of the mappings.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230602143854.1879091-3-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 4345f1e6de..e425fabc34 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -120,6 +120,22 @@ VHostNetState *vhost_vdpa_get_vhost_net(NetClientState *nc)
     return s->vhost_net;
 }
 
+static size_t vhost_vdpa_net_cvq_cmd_len(void)
+{
+    /*
+     * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
+     * In buffer is always 1 byte, so it should fit here
+     */
+    return sizeof(struct virtio_net_ctrl_hdr) +
+           2 * sizeof(struct virtio_net_ctrl_mac) +
+           MAC_TABLE_ENTRIES * ETH_ALEN;
+}
+
+static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
+{
+    return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
+}
+
 static bool vhost_vdpa_net_valid_svq_features(uint64_t features, Error **errp)
 {
     uint64_t invalid_dev_features =
@@ -427,22 +443,6 @@ static void vhost_vdpa_cvq_unmap_buf(struct vhost_vdpa *v, void *addr)
     vhost_iova_tree_remove(tree, *map);
 }
 
-static size_t vhost_vdpa_net_cvq_cmd_len(void)
-{
-    /*
-     * MAC_TABLE_SET is the ctrl command that produces the longer out buffer.
-     * In buffer is always 1 byte, so it should fit here
-     */
-    return sizeof(struct virtio_net_ctrl_hdr) +
-           2 * sizeof(struct virtio_net_ctrl_mac) +
-           MAC_TABLE_ENTRIES * ETH_ALEN;
-}
-
-static size_t vhost_vdpa_net_cvq_cmd_page_len(void)
-{
-    return ROUND_UP(vhost_vdpa_net_cvq_cmd_len(), qemu_real_host_page_size());
-}
-
 /** Map CVQ buffer. */
 static int vhost_vdpa_cvq_map_buf(struct vhost_vdpa *v, void *buf, size_t size,
                                   bool write)

From babf8b87127ae809b31b3c0a117dcbc91aaf9aba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 2 Jun 2023 16:38:54 +0200
Subject: [PATCH 0166/1353] vdpa: map shadow vrings with MAP_SHARED
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The vdpa devices that use va addresses neeeds these maps shared.
Otherwise, vhost_vdpa checks will refuse to accept the maps.

The mmap call will always return a page aligned address, so removing the
qemu_memalign call.  Keeping the ROUND_UP for the size as we still need
to DMA-map them in full.

Not applying fixes tag as it never worked with va devices.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230602143854.1879091-4-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 18 +++++++++---------
 net/vhost-vdpa.c                   | 16 ++++++++--------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index bd7c12b6d3..1b1d85306c 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -649,7 +649,7 @@ void vhost_svq_set_svq_kick_fd(VhostShadowVirtqueue *svq, int svq_kick_fd)
 void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
                      VirtQueue *vq, VhostIOVATree *iova_tree)
 {
-    size_t desc_size, driver_size, device_size;
+    size_t desc_size;
 
     event_notifier_set_handler(&svq->hdev_call, vhost_svq_handle_call);
     svq->next_guest_avail_elem = NULL;
@@ -662,14 +662,14 @@ void vhost_svq_start(VhostShadowVirtqueue *svq, VirtIODevice *vdev,
 
     svq->vring.num = virtio_queue_get_num(vdev, virtio_get_queue_index(vq));
     svq->num_free = svq->vring.num;
-    driver_size = vhost_svq_driver_area_size(svq);
-    device_size = vhost_svq_device_area_size(svq);
-    svq->vring.desc = qemu_memalign(qemu_real_host_page_size(), driver_size);
+    svq->vring.desc = mmap(NULL, vhost_svq_driver_area_size(svq),
+                           PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
+                           -1, 0);
     desc_size = sizeof(vring_desc_t) * svq->vring.num;
     svq->vring.avail = (void *)((char *)svq->vring.desc + desc_size);
-    memset(svq->vring.desc, 0, driver_size);
-    svq->vring.used = qemu_memalign(qemu_real_host_page_size(), device_size);
-    memset(svq->vring.used, 0, device_size);
+    svq->vring.used = mmap(NULL, vhost_svq_device_area_size(svq),
+                           PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
+                           -1, 0);
     svq->desc_state = g_new0(SVQDescState, svq->vring.num);
     svq->desc_next = g_new0(uint16_t, svq->vring.num);
     for (unsigned i = 0; i < svq->vring.num - 1; i++) {
@@ -712,8 +712,8 @@ void vhost_svq_stop(VhostShadowVirtqueue *svq)
     svq->vq = NULL;
     g_free(svq->desc_next);
     g_free(svq->desc_state);
-    qemu_vfree(svq->vring.desc);
-    qemu_vfree(svq->vring.used);
+    munmap(svq->vring.desc, vhost_svq_driver_area_size(svq));
+    munmap(svq->vring.used, vhost_svq_device_area_size(svq));
     event_notifier_set_handler(&svq->hdev_call, NULL);
 }
 
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index e425fabc34..8840ca2ea4 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -205,8 +205,8 @@ static void vhost_vdpa_cleanup(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
 
-    qemu_vfree(s->cvq_cmd_out_buffer);
-    qemu_vfree(s->status);
+    munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
+    munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
     if (s->vhost_net) {
         vhost_net_cleanup(s->vhost_net);
         g_free(s->vhost_net);
@@ -903,12 +903,12 @@ static NetClientState *net_vhost_vdpa_init(NetClientState *peer,
         vhost_vdpa_net_valid_svq_features(features,
                                           &s->vhost_vdpa.migration_blocker);
     } else if (!is_datapath) {
-        s->cvq_cmd_out_buffer = qemu_memalign(qemu_real_host_page_size(),
-                                            vhost_vdpa_net_cvq_cmd_page_len());
-        memset(s->cvq_cmd_out_buffer, 0, vhost_vdpa_net_cvq_cmd_page_len());
-        s->status = qemu_memalign(qemu_real_host_page_size(),
-                                  vhost_vdpa_net_cvq_cmd_page_len());
-        memset(s->status, 0, vhost_vdpa_net_cvq_cmd_page_len());
+        s->cvq_cmd_out_buffer = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
+                                     PROT_READ | PROT_WRITE,
+                                     MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+        s->status = mmap(NULL, vhost_vdpa_net_cvq_cmd_page_len(),
+                         PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS,
+                         -1, 0);
 
         s->vhost_vdpa.shadow_vq_ops = &vhost_vdpa_net_svq_ops;
         s->vhost_vdpa.shadow_vq_ops_opaque = s;

From 0a47810b09909a432b705e89e0cb5f9c1109465f Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 2 Jun 2023 19:52:13 +0800
Subject: [PATCH 0167/1353] include/hw/virtio: make some VirtIODevice const
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtIODevice structure is not modified in
virtio_vdev_has_feature(). Therefore, make it const
to allow this function to accept const variables.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Reviewed-by: Eugenio Pérez Martin <eperezma@redhat.com>
Message-Id: <16c0561b921310a32c240a4fb6e8cee3ffee16fe.1685704856.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Tested-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/virtio/virtio.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index af86ed7249..0492d26900 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -402,7 +402,7 @@ static inline bool virtio_has_feature(uint64_t features, unsigned int fbit)
     return !!(features & (1ULL << fbit));
 }
 
-static inline bool virtio_vdev_has_feature(VirtIODevice *vdev,
+static inline bool virtio_vdev_has_feature(const VirtIODevice *vdev,
                                            unsigned int fbit)
 {
     return virtio_has_feature(vdev->guest_features, fbit);

From 02d3bf099ba071f37145cfcc34d088e8f839072f Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 2 Jun 2023 19:52:14 +0800
Subject: [PATCH 0168/1353] vdpa: reuse virtio_vdev_has_feature()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can use virtio_vdev_has_feature() instead of manually
accessing the features.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <ff838d30206209fd865511b16ffb34cc0d5e8d8f.1685704856.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Tested-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 8840ca2ea4..c3ef0139a6 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -629,8 +629,7 @@ static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s, uint8_t class,
 
 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
 {
-    uint64_t features = n->parent_obj.guest_features;
-    if (features & BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR)) {
+    if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
         ssize_t dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MAC,
                                                   VIRTIO_NET_CTRL_MAC_ADDR_SET,
                                                   n->mac, sizeof(n->mac));
@@ -648,10 +647,9 @@ static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
                                   const VirtIONet *n)
 {
     struct virtio_net_ctrl_mq mq;
-    uint64_t features = n->parent_obj.guest_features;
     ssize_t dev_written;
 
-    if (!(features & BIT_ULL(VIRTIO_NET_F_MQ))) {
+    if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_MQ)) {
         return 0;
     }
 

From 705e89cfaafc54491482742a756cf661b48608d2 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 2 Jun 2023 19:52:15 +0800
Subject: [PATCH 0169/1353] hw/net/virtio-net: make some VirtIONet const
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtIONet structure is not modified in
virtio_net_supported_guest_offloads().
Therefore, make it const to allow this function to
accept const variables.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <489b09c3998ac09b9135e57a7dd8c56a4be8cdf9.1685704856.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Tested-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 6df6b7329d..7b27dad6c4 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -874,7 +874,7 @@ static uint64_t virtio_net_guest_offloads_by_features(uint32_t features)
     return guest_offloads_mask & features;
 }
 
-static inline uint64_t virtio_net_supported_guest_offloads(VirtIONet *n)
+static inline uint64_t virtio_net_supported_guest_offloads(const VirtIONet *n)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     return virtio_net_guest_offloads_by_features(vdev->guest_features);

From 0b545b1e42fc61f64071c7dd6f3ce1650f328007 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 2 Jun 2023 19:52:16 +0800
Subject: [PATCH 0170/1353] virtio-net: expose
 virtio_net_supported_guest_offloads()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To support restoring offloads state in vdpa, it is necessary to
expose the function virtio_net_supported_guest_offloads().

According to VirtIO standard, "Upon feature negotiation
corresponding offload gets enabled to preserve backward compatibility.".
Therefore, QEMU uses this function to get the device supported offloads.
This allows QEMU to know the device's defaults and skip the control
message sending if these defaults align with the driver's configuration.

Note that the device's defaults can mismatch the driver's configuration
only at live migration.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <43679506f3f039a7aa2bdd5b49785107b5dfd7d4.1685704856.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Tested-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c            | 2 +-
 include/hw/virtio/virtio-net.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7b27dad6c4..7e8897a8bc 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -874,7 +874,7 @@ static uint64_t virtio_net_guest_offloads_by_features(uint32_t features)
     return guest_offloads_mask & features;
 }
 
-static inline uint64_t virtio_net_supported_guest_offloads(const VirtIONet *n)
+uint64_t virtio_net_supported_guest_offloads(const VirtIONet *n)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     return virtio_net_guest_offloads_by_features(vdev->guest_features);
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index ef234ffe7e..5f5dcb4572 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -227,5 +227,6 @@ size_t virtio_net_handle_ctrl_iov(VirtIODevice *vdev,
                                   unsigned out_num);
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
                                    const char *type);
+uint64_t virtio_net_supported_guest_offloads(const VirtIONet *n);
 
 #endif

From 0b58d3686a07f505d02edc28cfaf272a4768481c Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 2 Jun 2023 19:52:17 +0800
Subject: [PATCH 0171/1353] vdpa: Add vhost_vdpa_net_load_offloads()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch introduces vhost_vdpa_net_load_offloads() to
restore offloads state at device's startup.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <7e2b5cad9c48c917df53d80dec27dbfeb513e1a3.1685704856.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Tested-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index c3ef0139a6..99d0445d90 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -664,6 +664,44 @@ static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
     return *s->status != VIRTIO_NET_OK;
 }
 
+static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
+                                        const VirtIONet *n)
+{
+    uint64_t offloads;
+    ssize_t dev_written;
+
+    if (!virtio_vdev_has_feature(&n->parent_obj,
+                                 VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) {
+        return 0;
+    }
+
+    if (n->curr_guest_offloads == virtio_net_supported_guest_offloads(n)) {
+        /*
+         * According to VirtIO standard, "Upon feature negotiation
+         * corresponding offload gets enabled to preserve
+         * backward compatibility.".
+         *
+         * Therefore, there is no need to send this CVQ command if the
+         * driver also enables all supported offloads, which aligns with
+         * the device's defaults.
+         *
+         * Note that the device's defaults can mismatch the driver's
+         * configuration only at live migration.
+         */
+        return 0;
+    }
+
+    offloads = cpu_to_le64(n->curr_guest_offloads);
+    dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
+                                          VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET,
+                                          &offloads, sizeof(offloads));
+    if (unlikely(dev_written < 0)) {
+        return dev_written;
+    }
+
+    return *s->status != VIRTIO_NET_OK;
+}
+
 static int vhost_vdpa_net_load(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
@@ -686,6 +724,10 @@ static int vhost_vdpa_net_load(NetClientState *nc)
     if (unlikely(r)) {
         return r;
     }
+    r = vhost_vdpa_net_load_offloads(s, n);
+    if (unlikely(r)) {
+        return r;
+    }
 
     return 0;
 }

From 4b4a1378b951930628398b3c67ccb036bdf6f012 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 2 Jun 2023 19:52:18 +0800
Subject: [PATCH 0172/1353] vdpa: Allow VIRTIO_NET_F_CTRL_GUEST_OFFLOADS in SVQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable SVQ with VIRTIO_NET_F_CTRL_GUEST_OFFLOADS feature.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <778d642ecae6deed8a218b0e6232e4d7bb96b439.1685704856.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Tested-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 99d0445d90..49221937a1 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -89,6 +89,7 @@ const int vdpa_feature_bits[] = {
 static const uint64_t vdpa_svq_device_features =
     BIT_ULL(VIRTIO_NET_F_CSUM) |
     BIT_ULL(VIRTIO_NET_F_GUEST_CSUM) |
+    BIT_ULL(VIRTIO_NET_F_CTRL_GUEST_OFFLOADS) |
     BIT_ULL(VIRTIO_NET_F_MTU) |
     BIT_ULL(VIRTIO_NET_F_MAC) |
     BIT_ULL(VIRTIO_NET_F_GUEST_TSO4) |

From 92099aa4e9a3bb6856c290afaf41c76f9e3dd9fd Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Fri, 2 Jun 2023 18:27:35 +0200
Subject: [PATCH 0173/1353] vhost: fix vhost_dev_enable_notifiers() error case
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

in vhost_dev_enable_notifiers(), if virtio_bus_set_host_notifier(true)
fails, we call vhost_dev_disable_notifiers() that executes
virtio_bus_set_host_notifier(false) on all queues, even on queues that
have failed to be initialized.

This triggers a core dump in memory_region_del_eventfd():

 virtio_bus_set_host_notifier: unable to init event notifier: Too many open files (-24)
 vhost VQ 1 notifier binding failed: 24
 .../softmmu/memory.c:2611: memory_region_del_eventfd: Assertion `i != mr->ioeventfd_nb' failed.

Fix the problem by providing to vhost_dev_disable_notifiers() the
number of queues to disable.

Fixes: 8771589b6f81 ("vhost: simplify vhost_dev_enable_notifiers")
Cc: longpeng2@huawei.com
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Message-Id: <20230602162735.3670785-1-lvivier@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/virtio/vhost.c | 65 ++++++++++++++++++++++++++---------------------
 1 file changed, 36 insertions(+), 29 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index fb7abc9769..d116c2d6a1 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1530,6 +1530,40 @@ void vhost_dev_cleanup(struct vhost_dev *hdev)
     memset(hdev, 0, sizeof(struct vhost_dev));
 }
 
+static void vhost_dev_disable_notifiers_nvqs(struct vhost_dev *hdev,
+                                             VirtIODevice *vdev,
+                                             unsigned int nvqs)
+{
+    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
+    int i, r;
+
+    /*
+     * Batch all the host notifiers in a single transaction to avoid
+     * quadratic time complexity in address_space_update_ioeventfds().
+     */
+    memory_region_transaction_begin();
+
+    for (i = 0; i < nvqs; ++i) {
+        r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i,
+                                         false);
+        if (r < 0) {
+            error_report("vhost VQ %d notifier cleanup failed: %d", i, -r);
+        }
+        assert(r >= 0);
+    }
+
+    /*
+     * The transaction expects the ioeventfds to be open when it
+     * commits. Do it now, before the cleanup loop.
+     */
+    memory_region_transaction_commit();
+
+    for (i = 0; i < nvqs; ++i) {
+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i);
+    }
+    virtio_device_release_ioeventfd(vdev);
+}
+
 /* Stop processing guest IO notifications in qemu.
  * Start processing them in vhost in kernel.
  */
@@ -1559,7 +1593,7 @@ int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)
         if (r < 0) {
             error_report("vhost VQ %d notifier binding failed: %d", i, -r);
             memory_region_transaction_commit();
-            vhost_dev_disable_notifiers(hdev, vdev);
+            vhost_dev_disable_notifiers_nvqs(hdev, vdev, i);
             return r;
         }
     }
@@ -1576,34 +1610,7 @@ int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)
  */
 void vhost_dev_disable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev)
 {
-    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
-    int i, r;
-
-    /*
-     * Batch all the host notifiers in a single transaction to avoid
-     * quadratic time complexity in address_space_update_ioeventfds().
-     */
-    memory_region_transaction_begin();
-
-    for (i = 0; i < hdev->nvqs; ++i) {
-        r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i,
-                                         false);
-        if (r < 0) {
-            error_report("vhost VQ %d notifier cleanup failed: %d", i, -r);
-        }
-        assert (r >= 0);
-    }
-
-    /*
-     * The transaction expects the ioeventfds to be open when it
-     * commits. Do it now, before the cleanup loop.
-     */
-    memory_region_transaction_commit();
-
-    for (i = 0; i < hdev->nvqs; ++i) {
-        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i);
-    }
-    virtio_device_release_ioeventfd(vdev);
+    vhost_dev_disable_notifiers_nvqs(hdev, vdev, hdev->nvqs);
 }
 
 /* Test and clear event pending status.

From 51e84244a7799172f4239482199e9b4bdcd23172 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 2 Jun 2023 19:33:28 +0200
Subject: [PATCH 0174/1353] vdpa: mask _F_CTRL_GUEST_OFFLOADS for vhost vdpa
 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU does not emulate it so it must be disabled as long as the backend
does not support it.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230602173328.1917385-1-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
---
 net/vhost-vdpa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 49221937a1..75352efa39 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -58,6 +58,7 @@ const int vdpa_feature_bits[] = {
     VIRTIO_F_VERSION_1,
     VIRTIO_NET_F_CSUM,
     VIRTIO_NET_F_GUEST_CSUM,
+    VIRTIO_NET_F_CTRL_GUEST_OFFLOADS,
     VIRTIO_NET_F_GSO,
     VIRTIO_NET_F_GUEST_TSO4,
     VIRTIO_NET_F_GUEST_TSO6,

From d45243bcfc61a3c34f96a4fc34bffcb9929daba0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 2 Jun 2023 19:34:51 +0200
Subject: [PATCH 0175/1353] vdpa: fix not using CVQ buffer in case of error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bug introducing when refactoring.  Otherway, the guest never received
the used buffer.

Fixes: be4278b65fc1 ("vdpa: extract vhost_vdpa_net_cvq_add from vhost_vdpa_net_handle_ctrl_avail")
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230602173451.1917999-1-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
---
 net/vhost-vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 75352efa39..9e92b3558c 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -794,7 +794,7 @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
     }
 
     if (*s->status != VIRTIO_NET_OK) {
-        return VIRTIO_NET_ERR;
+        goto out;
     }
 
     status = VIRTIO_NET_ERR;

From abe10037b129615f3da80f6d7c4acc3a0ec48afa Mon Sep 17 00:00:00 2001
From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Date: Fri, 9 Jun 2023 11:41:07 -0500
Subject: [PATCH 0176/1353] hw/i386/pc: Clean up pc_machine_initfn

To use the newly introduced PC machine class local variable.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Message-Id: <20230609164107.23404-1-suravee.suthikulpanit@amd.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 8d37567e08..f01d7de5ad 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1867,7 +1867,7 @@ static void pc_machine_initfn(Object *obj)
     pcms->smbios_entry_point_type = pcmc->default_smbios_ep_type;
 
     /* acpi build is enabled by default if machine supports it */
-    pcms->acpi_build_enabled = PC_MACHINE_GET_CLASS(pcms)->has_acpi_build;
+    pcms->acpi_build_enabled = pcmc->has_acpi_build;
     pcms->smbus_enabled = true;
     pcms->sata_enabled = true;
     pcms->i8042_enabled = true;

From 535a3d9a32a9e37487984c16af0167bb3c3a2025 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Sun, 11 Jun 2023 15:39:24 -0400
Subject: [PATCH 0177/1353] virtio-scsi: avoid dangling host notifier in
 ->ioeventfd_stop()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

virtio_scsi_dataplane_stop() calls blk_drain_all(), which invokes
->drained_begin()/->drained_end() after we've already detached the host
notifier. virtio_scsi_drained_end() currently attaches the host notifier
again and leaves it dangling after dataplane has stopped.

This results in the following assertion failure because
virtio_scsi_defer_to_dataplane() is called from the IOThread instead of
the main loop thread:

  qemu-system-x86_64: ../softmmu/memory.c:1111: memory_region_transaction_commit: Assertion `qemu_mutex_iothread_locked()' failed.

Buglink: https://gitlab.com/qemu-project/qemu/-/issues/1680
Reported-by: Jean-Louis Dupond <jean-louis@dupond.be>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20230611193924.2444914-1-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/scsi/virtio-scsi.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 9c8ef0aaa6..45b95ea070 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1125,7 +1125,16 @@ static void virtio_scsi_drained_begin(SCSIBus *bus)
     uint32_t total_queues = VIRTIO_SCSI_VQ_NUM_FIXED +
                             s->parent_obj.conf.num_queues;
 
-    if (!s->dataplane_started) {
+    /*
+     * Drain is called when stopping dataplane but the host notifier has
+     * already been detached. Detaching multiple times is a no-op if nothing
+     * else is using the monitoring same file descriptor, but avoid it just in
+     * case.
+     *
+     * Also, don't detach if dataplane has not even been started yet because
+     * the host notifier isn't attached.
+     */
+    if (s->dataplane_stopping || !s->dataplane_started) {
         return;
     }
 
@@ -1143,7 +1152,14 @@ static void virtio_scsi_drained_end(SCSIBus *bus)
     uint32_t total_queues = VIRTIO_SCSI_VQ_NUM_FIXED +
                             s->parent_obj.conf.num_queues;
 
-    if (!s->dataplane_started) {
+    /*
+     * Drain is called when stopping dataplane. Keep the host notifier detached
+     * so it's not left dangling after dataplane is stopped.
+     *
+     * Also, don't attach if dataplane has not even been started yet. We're not
+     * ready.
+     */
+    if (s->dataplane_stopping || !s->dataplane_started) {
         return;
     }
 

From f8ed3648b5b9c0cd77397ae4404f3e9e4be8a426 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Tue, 13 Jun 2023 11:08:48 +0300
Subject: [PATCH 0178/1353] vhost-user: fully use new backend/frontend naming
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Slave/master nomenclature was replaced with backend/frontend in commit
1fc19b65279a ("vhost-user: Adopt new backend naming")

This patch replaces all remaining uses of master and slave in the
codebase.

Signed-off-by: Emmanouil Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20230613080849.2115347-1-manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 block/export/vhost-user-blk-server.c      |  2 +-
 contrib/vhost-user-blk/vhost-user-blk.c   |  2 +-
 hw/block/vhost-user-blk.c                 |  2 +-
 hw/display/vhost-user-gpu.c               |  2 +-
 hw/input/vhost-user-input.c               |  2 +-
 hw/net/virtio-net.c                       |  4 +-
 hw/virtio/vdpa-dev.c                      |  2 +-
 hw/virtio/vhost-user.c                    | 52 +++++++++++-----------
 hw/virtio/virtio-qmp.c                    |  2 +-
 include/hw/virtio/vhost-backend.h         |  2 +-
 subprojects/libvhost-user/libvhost-user.c | 54 +++++++++++------------
 subprojects/libvhost-user/libvhost-user.h | 20 +++++----
 12 files changed, 74 insertions(+), 72 deletions(-)

diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index 81b59761e3..f7b5073605 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -167,7 +167,7 @@ vu_blk_set_config(VuDev *vu_dev, const uint8_t *data,
     uint8_t wce;
 
     /* don't support live migration */
-    if (flags != VHOST_SET_CONFIG_TYPE_MASTER) {
+    if (flags != VHOST_SET_CONFIG_TYPE_FRONTEND) {
         return -EINVAL;
     }
 
diff --git a/contrib/vhost-user-blk/vhost-user-blk.c b/contrib/vhost-user-blk/vhost-user-blk.c
index 7941694e53..89e5f11a64 100644
--- a/contrib/vhost-user-blk/vhost-user-blk.c
+++ b/contrib/vhost-user-blk/vhost-user-blk.c
@@ -421,7 +421,7 @@ vub_set_config(VuDev *vu_dev, const uint8_t *data,
     int fd;
 
     /* don't support live migration */
-    if (flags != VHOST_SET_CONFIG_TYPE_MASTER) {
+    if (flags != VHOST_SET_CONFIG_TYPE_FRONTEND) {
         return -1;
     }
 
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index aff4d2b8cb..eecf3f7a81 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -81,7 +81,7 @@ static void vhost_user_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
     ret = vhost_dev_set_config(&s->dev, &blkcfg->wce,
                                offsetof(struct virtio_blk_config, wce),
                                sizeof(blkcfg->wce),
-                               VHOST_SET_CONFIG_TYPE_MASTER);
+                               VHOST_SET_CONFIG_TYPE_FRONTEND);
     if (ret) {
         error_report("set device config space failed");
         return;
diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index 1386e869e5..15f9d99d09 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -452,7 +452,7 @@ vhost_user_gpu_set_config(VirtIODevice *vdev,
 
     ret = vhost_dev_set_config(&g->vhost->dev, config_data,
                                0, sizeof(struct virtio_gpu_config),
-                               VHOST_SET_CONFIG_TYPE_MASTER);
+                               VHOST_SET_CONFIG_TYPE_FRONTEND);
     if (ret) {
         error_report("vhost-user-gpu: set device config space failed");
         return;
diff --git a/hw/input/vhost-user-input.c b/hw/input/vhost-user-input.c
index 1352e372ff..4ee3542106 100644
--- a/hw/input/vhost-user-input.c
+++ b/hw/input/vhost-user-input.c
@@ -69,7 +69,7 @@ static void vhost_input_set_config(VirtIODevice *vdev,
 
     ret = vhost_dev_set_config(&vhi->vhost->dev, config_data,
                                0, sizeof(virtio_input_config),
-                               VHOST_SET_CONFIG_TYPE_MASTER);
+                               VHOST_SET_CONFIG_TYPE_FRONTEND);
     if (ret) {
         error_report("vhost-user-input: set device config space failed");
         return;
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7e8897a8bc..aa421a908a 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -211,7 +211,7 @@ static void virtio_net_set_config(VirtIODevice *vdev, const uint8_t *config)
     if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) {
         vhost_net_set_config(get_vhost_net(nc->peer),
                              (uint8_t *)&netcfg, 0, n->config_size,
-                             VHOST_SET_CONFIG_TYPE_MASTER);
+                             VHOST_SET_CONFIG_TYPE_FRONTEND);
       }
 }
 
@@ -3733,7 +3733,7 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
         struct virtio_net_config netcfg = {};
         memcpy(&netcfg.mac, &n->nic_conf.macaddr, ETH_ALEN);
         vhost_net_set_config(get_vhost_net(nc->peer),
-            (uint8_t *)&netcfg, 0, ETH_ALEN, VHOST_SET_CONFIG_TYPE_MASTER);
+            (uint8_t *)&netcfg, 0, ETH_ALEN, VHOST_SET_CONFIG_TYPE_FRONTEND);
     }
     QTAILQ_INIT(&n->rsc_chains);
     n->qdev = dev;
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index e08e830006..363b625243 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -203,7 +203,7 @@ vhost_vdpa_device_set_config(VirtIODevice *vdev, const uint8_t *config)
     int ret;
 
     ret = vhost_dev_set_config(&s->dev, s->config, 0, s->config_size,
-                               VHOST_SET_CONFIG_TYPE_MASTER);
+                               VHOST_SET_CONFIG_TYPE_FRONTEND);
     if (ret) {
         error_report("set device config space failed");
         return;
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 2ad75a7964..c4e0cbd702 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -124,13 +124,13 @@ typedef enum VhostUserRequest {
     VHOST_USER_MAX
 } VhostUserRequest;
 
-typedef enum VhostUserSlaveRequest {
+typedef enum VhostUserBackendRequest {
     VHOST_USER_BACKEND_NONE = 0,
     VHOST_USER_BACKEND_IOTLB_MSG = 1,
     VHOST_USER_BACKEND_CONFIG_CHANGE_MSG = 2,
     VHOST_USER_BACKEND_VRING_HOST_NOTIFIER_MSG = 3,
     VHOST_USER_BACKEND_MAX
-}  VhostUserSlaveRequest;
+}  VhostUserBackendRequest;
 
 typedef struct VhostUserMemoryRegion {
     uint64_t guest_phys_addr;
@@ -245,8 +245,8 @@ struct vhost_user {
     struct vhost_dev *dev;
     /* Shared between vhost devs of the same virtio device */
     VhostUserState *user;
-    QIOChannel *slave_ioc;
-    GSource *slave_src;
+    QIOChannel *backend_ioc;
+    GSource *backend_src;
     NotifierWithReturn postcopy_notifier;
     struct PostCopyFD  postcopy_fd;
     uint64_t           postcopy_client_bases[VHOST_USER_MAX_RAM_SLOTS];
@@ -1495,7 +1495,7 @@ static int vhost_user_reset_device(struct vhost_dev *dev)
     return vhost_user_write(dev, &msg, NULL, 0);
 }
 
-static int vhost_user_slave_handle_config_change(struct vhost_dev *dev)
+static int vhost_user_backend_handle_config_change(struct vhost_dev *dev)
 {
     if (!dev->config_ops || !dev->config_ops->vhost_dev_config_notifier) {
         return -ENOSYS;
@@ -1532,7 +1532,7 @@ static VhostUserHostNotifier *fetch_or_create_notifier(VhostUserState *u,
     return n;
 }
 
-static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+static int vhost_user_backend_handle_vring_host_notifier(struct vhost_dev *dev,
                                                        VhostUserVringArea *area,
                                                        int fd)
 {
@@ -1594,16 +1594,16 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
     return 0;
 }
 
-static void close_slave_channel(struct vhost_user *u)
+static void close_backend_channel(struct vhost_user *u)
 {
-    g_source_destroy(u->slave_src);
-    g_source_unref(u->slave_src);
-    u->slave_src = NULL;
-    object_unref(OBJECT(u->slave_ioc));
-    u->slave_ioc = NULL;
+    g_source_destroy(u->backend_src);
+    g_source_unref(u->backend_src);
+    u->backend_src = NULL;
+    object_unref(OBJECT(u->backend_ioc));
+    u->backend_ioc = NULL;
 }
 
-static gboolean slave_read(QIOChannel *ioc, GIOCondition condition,
+static gboolean backend_read(QIOChannel *ioc, GIOCondition condition,
                            gpointer opaque)
 {
     struct vhost_dev *dev = opaque;
@@ -1645,10 +1645,10 @@ static gboolean slave_read(QIOChannel *ioc, GIOCondition condition,
         ret = vhost_backend_handle_iotlb_msg(dev, &payload.iotlb);
         break;
     case VHOST_USER_BACKEND_CONFIG_CHANGE_MSG:
-        ret = vhost_user_slave_handle_config_change(dev);
+        ret = vhost_user_backend_handle_config_change(dev);
         break;
     case VHOST_USER_BACKEND_VRING_HOST_NOTIFIER_MSG:
-        ret = vhost_user_slave_handle_vring_host_notifier(dev, &payload.area,
+        ret = vhost_user_backend_handle_vring_host_notifier(dev, &payload.area,
                                                           fd ? fd[0] : -1);
         break;
     default:
@@ -1684,7 +1684,7 @@ static gboolean slave_read(QIOChannel *ioc, GIOCondition condition,
     goto fdcleanup;
 
 err:
-    close_slave_channel(u);
+    close_backend_channel(u);
     rc = G_SOURCE_REMOVE;
 
 fdcleanup:
@@ -1696,7 +1696,7 @@ fdcleanup:
     return rc;
 }
 
-static int vhost_setup_slave_channel(struct vhost_dev *dev)
+static int vhost_setup_backend_channel(struct vhost_dev *dev)
 {
     VhostUserMsg msg = {
         .hdr.request = VHOST_USER_SET_BACKEND_REQ_FD,
@@ -1725,10 +1725,10 @@ static int vhost_setup_slave_channel(struct vhost_dev *dev)
         error_report_err(local_err);
         return -ECONNREFUSED;
     }
-    u->slave_ioc = ioc;
-    u->slave_src = qio_channel_add_watch_source(u->slave_ioc,
+    u->backend_ioc = ioc;
+    u->backend_src = qio_channel_add_watch_source(u->backend_ioc,
                                                 G_IO_IN | G_IO_HUP,
-                                                slave_read, dev, NULL, NULL);
+                                                backend_read, dev, NULL, NULL);
 
     if (reply_supported) {
         msg.hdr.flags |= VHOST_USER_NEED_REPLY_MASK;
@@ -1746,7 +1746,7 @@ static int vhost_setup_slave_channel(struct vhost_dev *dev)
 out:
     close(sv[1]);
     if (ret) {
-        close_slave_channel(u);
+        close_backend_channel(u);
     }
 
     return ret;
@@ -2072,7 +2072,7 @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque,
                  virtio_has_feature(dev->protocol_features,
                     VHOST_USER_PROTOCOL_F_REPLY_ACK))) {
             error_setg(errp, "IOMMU support requires reply-ack and "
-                       "slave-req protocol features.");
+                       "backend-req protocol features.");
             return -EINVAL;
         }
 
@@ -2108,7 +2108,7 @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque,
     }
 
     if (dev->vq_index == 0) {
-        err = vhost_setup_slave_channel(dev);
+        err = vhost_setup_backend_channel(dev);
         if (err < 0) {
             error_setg_errno(errp, EPROTO, "vhost_backend_init failed");
             return -EPROTO;
@@ -2138,8 +2138,8 @@ static int vhost_user_backend_cleanup(struct vhost_dev *dev)
         close(u->postcopy_fd.fd);
         u->postcopy_fd.handler = NULL;
     }
-    if (u->slave_ioc) {
-        close_slave_channel(u);
+    if (u->backend_ioc) {
+        close_backend_channel(u);
     }
     g_free(u->region_rb);
     u->region_rb = NULL;
@@ -2235,7 +2235,7 @@ static int vhost_user_net_set_mtu(struct vhost_dev *dev, uint16_t mtu)
         return ret;
     }
 
-    /* If reply_ack supported, slave has to ack specified MTU is valid */
+    /* If reply_ack supported, backend has to ack specified MTU is valid */
     if (reply_supported) {
         return process_message_reply(dev, &msg);
     }
diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
index 3528fc628d..3d32dbec8d 100644
--- a/hw/virtio/virtio-qmp.c
+++ b/hw/virtio/virtio-qmp.c
@@ -117,7 +117,7 @@ static const qmp_virtio_feature_map_t vhost_user_protocol_map[] = {
             "VHOST_USER_PROTOCOL_F_CONFIG: Vhost-user messaging for virtio "
             "device configuration space supported"),
     FEATURE_ENTRY(VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD, \
-            "VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD: Slave fd communication "
+            "VHOST_USER_PROTOCOL_F_BACKEND_SEND_FD: Backend fd communication "
             "channel supported"),
     FEATURE_ENTRY(VHOST_USER_PROTOCOL_F_HOST_NOTIFIER, \
             "VHOST_USER_PROTOCOL_F_HOST_NOTIFIER: Host notifiers for specified "
diff --git a/include/hw/virtio/vhost-backend.h b/include/hw/virtio/vhost-backend.h
index ec3fbae58d..31a251a9f5 100644
--- a/include/hw/virtio/vhost-backend.h
+++ b/include/hw/virtio/vhost-backend.h
@@ -22,7 +22,7 @@ typedef enum VhostBackendType {
 } VhostBackendType;
 
 typedef enum VhostSetConfigType {
-    VHOST_SET_CONFIG_TYPE_MASTER = 0,
+    VHOST_SET_CONFIG_TYPE_FRONTEND = 0,
     VHOST_SET_CONFIG_TYPE_MIGRATION = 1,
 } VhostSetConfigType;
 
diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c
index 8fb61e2df2..0469a50101 100644
--- a/subprojects/libvhost-user/libvhost-user.c
+++ b/subprojects/libvhost-user/libvhost-user.c
@@ -421,8 +421,8 @@ vu_send_reply(VuDev *dev, int conn_fd, VhostUserMsg *vmsg)
 }
 
 /*
- * Processes a reply on the slave channel.
- * Entered with slave_mutex held and releases it before exit.
+ * Processes a reply on the backend channel.
+ * Entered with backend_mutex held and releases it before exit.
  * Returns true on success.
  */
 static bool
@@ -436,7 +436,7 @@ vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg)
         goto out;
     }
 
-    if (!vu_message_read_default(dev, dev->slave_fd, &msg_reply)) {
+    if (!vu_message_read_default(dev, dev->backend_fd, &msg_reply)) {
         goto out;
     }
 
@@ -449,7 +449,7 @@ vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg)
     result = msg_reply.payload.u64 == 0;
 
 out:
-    pthread_mutex_unlock(&dev->slave_mutex);
+    pthread_mutex_unlock(&dev->backend_mutex);
     return result;
 }
 
@@ -1393,13 +1393,13 @@ bool vu_set_queue_host_notifier(VuDev *dev, VuVirtq *vq, int fd,
         return false;
     }
 
-    pthread_mutex_lock(&dev->slave_mutex);
-    if (!vu_message_write(dev, dev->slave_fd, &vmsg)) {
-        pthread_mutex_unlock(&dev->slave_mutex);
+    pthread_mutex_lock(&dev->backend_mutex);
+    if (!vu_message_write(dev, dev->backend_fd, &vmsg)) {
+        pthread_mutex_unlock(&dev->backend_mutex);
         return false;
     }
 
-    /* Also unlocks the slave_mutex */
+    /* Also unlocks the backend_mutex */
     return vu_process_message_reply(dev, &vmsg);
 }
 
@@ -1463,7 +1463,7 @@ vu_get_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg)
      * a device implementation can return it in its callback
      * (get_protocol_features) if it wants to use this for
      * simulation, but it is otherwise not desirable (if even
-     * implemented by the master.)
+     * implemented by the frontend.)
      */
     uint64_t features = 1ULL << VHOST_USER_PROTOCOL_F_MQ |
                         1ULL << VHOST_USER_PROTOCOL_F_LOG_SHMFD |
@@ -1508,7 +1508,7 @@ vu_set_protocol_features_exec(VuDev *dev, VhostUserMsg *vmsg)
          * of the other features are required.
          * Theoretically, one could use only kick messages, or do them without
          * having F_REPLY_ACK, but too many (possibly pending) messages on the
-         * socket will eventually cause the master to hang, to avoid this in
+         * socket will eventually cause the frontend to hang, to avoid this in
          * scenarios where not desired enforce that the settings are in a way
          * that actually enables the simulation case.
          */
@@ -1550,18 +1550,18 @@ vu_set_vring_enable_exec(VuDev *dev, VhostUserMsg *vmsg)
 }
 
 static bool
-vu_set_slave_req_fd(VuDev *dev, VhostUserMsg *vmsg)
+vu_set_backend_req_fd(VuDev *dev, VhostUserMsg *vmsg)
 {
     if (vmsg->fd_num != 1) {
-        vu_panic(dev, "Invalid slave_req_fd message (%d fd's)", vmsg->fd_num);
+        vu_panic(dev, "Invalid backend_req_fd message (%d fd's)", vmsg->fd_num);
         return false;
     }
 
-    if (dev->slave_fd != -1) {
-        close(dev->slave_fd);
+    if (dev->backend_fd != -1) {
+        close(dev->backend_fd);
     }
-    dev->slave_fd = vmsg->fds[0];
-    DPRINT("Got slave_fd: %d\n", vmsg->fds[0]);
+    dev->backend_fd = vmsg->fds[0];
+    DPRINT("Got backend_fd: %d\n", vmsg->fds[0]);
 
     return false;
 }
@@ -1577,7 +1577,7 @@ vu_get_config(VuDev *dev, VhostUserMsg *vmsg)
     }
 
     if (ret) {
-        /* resize to zero to indicate an error to master */
+        /* resize to zero to indicate an error to frontend */
         vmsg->size = 0;
     }
 
@@ -1917,7 +1917,7 @@ vu_process_message(VuDev *dev, VhostUserMsg *vmsg)
     case VHOST_USER_SET_VRING_ENABLE:
         return vu_set_vring_enable_exec(dev, vmsg);
     case VHOST_USER_SET_BACKEND_REQ_FD:
-        return vu_set_slave_req_fd(dev, vmsg);
+        return vu_set_backend_req_fd(dev, vmsg);
     case VHOST_USER_GET_CONFIG:
         return vu_get_config(dev, vmsg);
     case VHOST_USER_SET_CONFIG:
@@ -2038,11 +2038,11 @@ vu_deinit(VuDev *dev)
     }
 
     vu_close_log(dev);
-    if (dev->slave_fd != -1) {
-        close(dev->slave_fd);
-        dev->slave_fd = -1;
+    if (dev->backend_fd != -1) {
+        close(dev->backend_fd);
+        dev->backend_fd = -1;
     }
-    pthread_mutex_destroy(&dev->slave_mutex);
+    pthread_mutex_destroy(&dev->backend_mutex);
 
     if (dev->sock != -1) {
         close(dev->sock);
@@ -2080,8 +2080,8 @@ vu_init(VuDev *dev,
     dev->remove_watch = remove_watch;
     dev->iface = iface;
     dev->log_call_fd = -1;
-    pthread_mutex_init(&dev->slave_mutex, NULL);
-    dev->slave_fd = -1;
+    pthread_mutex_init(&dev->backend_mutex, NULL);
+    dev->backend_fd = -1;
     dev->max_queues = max_queues;
 
     dev->vq = malloc(max_queues * sizeof(dev->vq[0]));
@@ -2439,9 +2439,9 @@ static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync)
             vmsg.flags |= VHOST_USER_NEED_REPLY_MASK;
         }
 
-        vu_message_write(dev, dev->slave_fd, &vmsg);
+        vu_message_write(dev, dev->backend_fd, &vmsg);
         if (ack) {
-            vu_message_read_default(dev, dev->slave_fd, &vmsg);
+            vu_message_read_default(dev, dev->backend_fd, &vmsg);
         }
         return;
     }
@@ -2468,7 +2468,7 @@ void vu_config_change_msg(VuDev *dev)
         .flags = VHOST_USER_VERSION,
     };
 
-    vu_message_write(dev, dev->slave_fd, &vmsg);
+    vu_message_write(dev, dev->backend_fd, &vmsg);
 }
 
 static inline void
diff --git a/subprojects/libvhost-user/libvhost-user.h b/subprojects/libvhost-user/libvhost-user.h
index 49208cceaa..708370c5f5 100644
--- a/subprojects/libvhost-user/libvhost-user.h
+++ b/subprojects/libvhost-user/libvhost-user.h
@@ -39,7 +39,7 @@
 #define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64)
 
 typedef enum VhostSetConfigType {
-    VHOST_SET_CONFIG_TYPE_MASTER = 0,
+    VHOST_SET_CONFIG_TYPE_FRONTEND = 0,
     VHOST_SET_CONFIG_TYPE_MIGRATION = 1,
 } VhostSetConfigType;
 
@@ -112,7 +112,7 @@ typedef enum VhostUserRequest {
     VHOST_USER_MAX
 } VhostUserRequest;
 
-typedef enum VhostUserSlaveRequest {
+typedef enum VhostUserBackendRequest {
     VHOST_USER_BACKEND_NONE = 0,
     VHOST_USER_BACKEND_IOTLB_MSG = 1,
     VHOST_USER_BACKEND_CONFIG_CHANGE_MSG = 2,
@@ -120,7 +120,7 @@ typedef enum VhostUserSlaveRequest {
     VHOST_USER_BACKEND_VRING_CALL = 4,
     VHOST_USER_BACKEND_VRING_ERR = 5,
     VHOST_USER_BACKEND_MAX
-}  VhostUserSlaveRequest;
+}  VhostUserBackendRequest;
 
 typedef struct VhostUserMemoryRegion {
     uint64_t guest_phys_addr;
@@ -296,8 +296,10 @@ typedef struct VuVirtqInflight {
      * Zero value indicates a vm reset happened. */
     uint16_t version;
 
-    /* The size of VuDescStateSplit array. It's equal to the virtqueue
-     * size. Slave could get it from queue size field of VhostUserInflight. */
+    /*
+     * The size of VuDescStateSplit array. It's equal to the virtqueue size.
+     * Backend could get it from queue size field of VhostUserInflight.
+     */
     uint16_t desc_num;
 
     /* The head of list that track the last batch of used descriptors. */
@@ -384,9 +386,9 @@ struct VuDev {
     VuVirtq *vq;
     VuDevInflightInfo inflight_info;
     int log_call_fd;
-    /* Must be held while using slave_fd */
-    pthread_mutex_t slave_mutex;
-    int slave_fd;
+    /* Must be held while using backend_fd */
+    pthread_mutex_t backend_mutex;
+    int backend_fd;
     uint64_t log_size;
     uint8_t *log_table;
     uint64_t features;
@@ -445,7 +447,7 @@ typedef struct VuVirtqElement {
  * vu_init:
  * @dev: a VuDev context
  * @max_queues: maximum number of virtqueues
- * @socket: the socket connected to vhost-user master
+ * @socket: the socket connected to vhost-user frontend
  * @panic: a panic callback
  * @set_watch: a set_watch callback
  * @remove_watch: a remove_watch callback

From e80c1e4c7d057fe5c96db588e651b934757a912e Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 15 Jun 2023 11:26:24 +0800
Subject: [PATCH 0179/1353] intel_iommu: Fix a potential issue in VFIO dirty
 page sync

Peter Xu found a potential issue:

"The other thing is when I am looking at the new code I found that we
actually extended the replay() to be used also in dirty tracking of vfio,
in vfio_sync_dirty_bitmap().  For that maybe it's already broken if
unmap_all() because afaiu log_sync() can be called in migration thread
anytime during DMA so I think it means the device is prone to DMA with the
IOMMU pgtable quickly erased and rebuilt here, which means the DMA could
fail unexpectedly.  Copy Alex, Kirti and Neo."

Fix it by replacing the unmap_all() to only evacuate the iova tree
(keeping all host mappings untouched, IOW, don't notify UNMAP), and
do a full resync in page walk which will notify all existing mappings
as MAP. This way we don't interrupt with any existing mapping if there
is (e.g. for the dirty sync case), meanwhile we keep sync too to latest
(for moving a vfio device into an existing iommu group).

Suggested-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20230615032626.314476-2-zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 94d52f4205..34af12f392 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3825,13 +3825,10 @@ static void vtd_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n)
     IntelIOMMUState *s = vtd_as->iommu_state;
     uint8_t bus_n = pci_bus_num(vtd_as->bus);
     VTDContextEntry ce;
+    DMAMap map = { .iova = 0, .size = HWADDR_MAX };
 
-    /*
-     * The replay can be triggered by either a invalidation or a newly
-     * created entry. No matter what, we release existing mappings
-     * (it means flushing caches for UNMAP-only registers).
-     */
-    vtd_address_space_unmap(vtd_as, n);
+    /* replay is protected by BQL, page walk will re-setup it safely */
+    iova_tree_remove(vtd_as->iova_tree, map);
 
     if (vtd_dev_to_context_entry(s, bus_n, vtd_as->devfn, &ce) == 0) {
         trace_vtd_replay_ce_valid(s->root_scalable ? "scalable mode" :

From ce735ff03349eeac9efe59c118d78f088a151ec4 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 15 Jun 2023 11:26:25 +0800
Subject: [PATCH 0180/1353] intel_iommu: Fix flag check in replay

Replay doesn't notify registered notifiers but the one passed
to it. So it's meaningless to check the registered notifier's
synthetic flag.

There is no issue currently as all replay use cases have MAP
flag set, but let's be robust.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20230615032626.314476-3-zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 34af12f392..f046f85913 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3837,7 +3837,7 @@ static void vtd_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n)
                                   PCI_FUNC(vtd_as->devfn),
                                   vtd_get_domain_id(s, &ce, vtd_as->pasid),
                                   ce.hi, ce.lo);
-        if (vtd_as_has_map_notifier(vtd_as)) {
+        if (n->notifier_flags & IOMMU_NOTIFIER_MAP) {
             /* This is required only for MAP typed notifiers */
             vtd_page_walk_info info = {
                 .hook_fn = vtd_replay_hook,

From ebe1504e10f771f4fc5d005a6d1ed3f30e3ad428 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 15 Jun 2023 11:26:26 +0800
Subject: [PATCH 0181/1353] intel_iommu: Fix address space unmap

During address space unmap, corresponding IOVA tree entries are
also removed. But DMAMap is set beyond notifier's scope by 1, so
in theory there is possibility to remove a continuous entry above
the notifier's scope but falling in adjacent notifier's scope.

There is no issue currently as no use cases allocate notifiers
continuously, but let's be robust.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20230615032626.314476-4-zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index f046f85913..dcc334060c 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3791,7 +3791,7 @@ static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n)
                              n->start, size);
 
     map.iova = n->start;
-    map.size = size;
+    map.size = size - 1; /* Inclusive */
     iova_tree_remove(as->iova_tree, map);
 }
 

From 0e994668d00c9ca760817a4ae802a7bed0e29596 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Mon, 19 Jun 2023 09:45:01 +0530
Subject: [PATCH 0182/1353] vhost_net: add an assertion for TAP client backends

An assertion was missing for tap vhost backends that enforces a non-null
reference from get_vhost_net(). Both vhost-net-user and vhost-net-vdpa
enforces this. Enforce the same for tap. Unit tests pass with this change.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-Id: <20230619041501.111655-1-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
---
 hw/net/vhost_net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index c4eecc6f36..6db23ca323 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -507,6 +507,7 @@ VHostNetState *get_vhost_net(NetClientState *nc)
     switch (nc->info->type) {
     case NET_CLIENT_DRIVER_TAP:
         vhost_net = tap_get_vhost_net(nc);
+        assert(vhost_net);
         break;
 #ifdef CONFIG_VHOST_NET_USER
     case NET_CLIENT_DRIVER_VHOST_USER:

From a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Mon, 19 Jun 2023 12:22:09 +0530
Subject: [PATCH 0183/1353] vhost-vdpa: do not cleanup the vdpa/vhost-net
 structures if peer nic is present

When a peer nic is still attached to the vdpa backend, it is too early to free
up the vhost-net and vdpa structures. If these structures are freed here, then
QEMU crashes when the guest is being shut down. The following call chain
would result in an assertion failure since the pointer returned from
vhost_vdpa_get_vhost_net() would be NULL:

do_vm_stop() -> vm_state_notify() -> virtio_set_status() ->
virtio_net_vhost_status() -> get_vhost_net().

Therefore, we defer freeing up the structures until at guest shutdown
time when qemu_cleanup() calls net_cleanup() which then calls
qemu_del_net_client() which would eventually call vhost_vdpa_cleanup()
again to free up the structures. This time, the loop in net_cleanup()
ensures that vhost_vdpa_cleanup() will be called one last time when
all the peer nics are detached and freed.

All unit tests pass with this change.

CC: imammedo@redhat.com
CC: jusual@redhat.com
CC: mst@redhat.com
Fixes: CVE-2023-3301
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2128929
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-Id: <20230619065209.442185-1-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 9e92b3558c..e19ab063fa 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -207,6 +207,14 @@ static void vhost_vdpa_cleanup(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
 
+    /*
+     * If a peer NIC is attached, do not cleanup anything.
+     * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup()
+     * when the guest is shutting down.
+     */
+    if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
+        return;
+    }
     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
     if (s->vhost_net) {

From 732d548732edda90f3cfe0f7dceee64861f07b25 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:22 +0200
Subject: [PATCH 0184/1353] accel: Replace target_ulong in tlb_*()

Replaces target_ulong with vaddr for guest virtual addresses in tlb_*()
functions and auxilliary structs.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-2-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/stubs/tcg-stub.c       |   2 +-
 accel/tcg/cputlb.c           | 177 +++++++++++++++++------------------
 accel/tcg/tb-maint.c         |   2 +-
 include/exec/cpu-defs.h      |   4 +-
 include/exec/exec-all.h      |  79 ++++++++--------
 include/qemu/plugin-memory.h |   2 +-
 6 files changed, 131 insertions(+), 135 deletions(-)

diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index 813695b402..0998e601ad 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -18,7 +18,7 @@ void tb_flush(CPUState *cpu)
 {
 }
 
-void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
+void tlb_set_dirty(CPUState *cpu, vaddr vaddr)
 {
 }
 
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 14ce97c33b..5caeccb52d 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -427,7 +427,7 @@ void tlb_flush_all_cpus_synced(CPUState *src_cpu)
 }
 
 static bool tlb_hit_page_mask_anyprot(CPUTLBEntry *tlb_entry,
-                                      target_ulong page, target_ulong mask)
+                                      vaddr page, vaddr mask)
 {
     page &= mask;
     mask &= TARGET_PAGE_MASK | TLB_INVALID_MASK;
@@ -437,8 +437,7 @@ static bool tlb_hit_page_mask_anyprot(CPUTLBEntry *tlb_entry,
             page == (tlb_entry->addr_code & mask));
 }
 
-static inline bool tlb_hit_page_anyprot(CPUTLBEntry *tlb_entry,
-                                        target_ulong page)
+static inline bool tlb_hit_page_anyprot(CPUTLBEntry *tlb_entry, vaddr page)
 {
     return tlb_hit_page_mask_anyprot(tlb_entry, page, -1);
 }
@@ -454,8 +453,8 @@ static inline bool tlb_entry_is_empty(const CPUTLBEntry *te)
 
 /* Called with tlb_c.lock held */
 static bool tlb_flush_entry_mask_locked(CPUTLBEntry *tlb_entry,
-                                        target_ulong page,
-                                        target_ulong mask)
+                                        vaddr page,
+                                        vaddr mask)
 {
     if (tlb_hit_page_mask_anyprot(tlb_entry, page, mask)) {
         memset(tlb_entry, -1, sizeof(*tlb_entry));
@@ -464,16 +463,15 @@ static bool tlb_flush_entry_mask_locked(CPUTLBEntry *tlb_entry,
     return false;
 }
 
-static inline bool tlb_flush_entry_locked(CPUTLBEntry *tlb_entry,
-                                          target_ulong page)
+static inline bool tlb_flush_entry_locked(CPUTLBEntry *tlb_entry, vaddr page)
 {
     return tlb_flush_entry_mask_locked(tlb_entry, page, -1);
 }
 
 /* Called with tlb_c.lock held */
 static void tlb_flush_vtlb_page_mask_locked(CPUArchState *env, int mmu_idx,
-                                            target_ulong page,
-                                            target_ulong mask)
+                                            vaddr page,
+                                            vaddr mask)
 {
     CPUTLBDesc *d = &env_tlb(env)->d[mmu_idx];
     int k;
@@ -487,21 +485,20 @@ static void tlb_flush_vtlb_page_mask_locked(CPUArchState *env, int mmu_idx,
 }
 
 static inline void tlb_flush_vtlb_page_locked(CPUArchState *env, int mmu_idx,
-                                              target_ulong page)
+                                              vaddr page)
 {
     tlb_flush_vtlb_page_mask_locked(env, mmu_idx, page, -1);
 }
 
-static void tlb_flush_page_locked(CPUArchState *env, int midx,
-                                  target_ulong page)
+static void tlb_flush_page_locked(CPUArchState *env, int midx, vaddr page)
 {
-    target_ulong lp_addr = env_tlb(env)->d[midx].large_page_addr;
-    target_ulong lp_mask = env_tlb(env)->d[midx].large_page_mask;
+    vaddr lp_addr = env_tlb(env)->d[midx].large_page_addr;
+    vaddr lp_mask = env_tlb(env)->d[midx].large_page_mask;
 
     /* Check if we need to flush due to large pages.  */
     if ((page & lp_mask) == lp_addr) {
-        tlb_debug("forcing full flush midx %d ("
-                  TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
+        tlb_debug("forcing full flush midx %d (%"
+                  VADDR_PRIx "/%" VADDR_PRIx ")\n",
                   midx, lp_addr, lp_mask);
         tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
     } else {
@@ -522,7 +519,7 @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
  * at @addr from the tlbs indicated by @idxmap from @cpu.
  */
 static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
-                                             target_ulong addr,
+                                             vaddr addr,
                                              uint16_t idxmap)
 {
     CPUArchState *env = cpu->env_ptr;
@@ -530,7 +527,7 @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
 
     assert_cpu_is_self(cpu);
 
-    tlb_debug("page addr:" TARGET_FMT_lx " mmu_map:0x%x\n", addr, idxmap);
+    tlb_debug("page addr: %" VADDR_PRIx " mmu_map:0x%x\n", addr, idxmap);
 
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
@@ -561,15 +558,15 @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
 static void tlb_flush_page_by_mmuidx_async_1(CPUState *cpu,
                                              run_on_cpu_data data)
 {
-    target_ulong addr_and_idxmap = (target_ulong) data.target_ptr;
-    target_ulong addr = addr_and_idxmap & TARGET_PAGE_MASK;
+    vaddr addr_and_idxmap = data.target_ptr;
+    vaddr addr = addr_and_idxmap & TARGET_PAGE_MASK;
     uint16_t idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
 
     tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
 }
 
 typedef struct {
-    target_ulong addr;
+    vaddr addr;
     uint16_t idxmap;
 } TLBFlushPageByMMUIdxData;
 
@@ -592,9 +589,9 @@ static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
     g_free(d);
 }
 
-void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, uint16_t idxmap)
+void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr, uint16_t idxmap)
 {
-    tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%" PRIx16 "\n", addr, idxmap);
+    tlb_debug("addr: %" VADDR_PRIx " mmu_idx:%" PRIx16 "\n", addr, idxmap);
 
     /* This should already be page aligned */
     addr &= TARGET_PAGE_MASK;
@@ -620,15 +617,15 @@ void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr, uint16_t idxmap)
     }
 }
 
-void tlb_flush_page(CPUState *cpu, target_ulong addr)
+void tlb_flush_page(CPUState *cpu, vaddr addr)
 {
     tlb_flush_page_by_mmuidx(cpu, addr, ALL_MMUIDX_BITS);
 }
 
-void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, target_ulong addr,
+void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, vaddr addr,
                                        uint16_t idxmap)
 {
-    tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
+    tlb_debug("addr: %" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
     addr &= TARGET_PAGE_MASK;
@@ -660,16 +657,16 @@ void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, target_ulong addr,
     tlb_flush_page_by_mmuidx_async_0(src_cpu, addr, idxmap);
 }
 
-void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr)
+void tlb_flush_page_all_cpus(CPUState *src, vaddr addr)
 {
     tlb_flush_page_by_mmuidx_all_cpus(src, addr, ALL_MMUIDX_BITS);
 }
 
 void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
-                                              target_ulong addr,
+                                              vaddr addr,
                                               uint16_t idxmap)
 {
-    tlb_debug("addr: "TARGET_FMT_lx" mmu_idx:%"PRIx16"\n", addr, idxmap);
+    tlb_debug("addr: %" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
     addr &= TARGET_PAGE_MASK;
@@ -706,18 +703,18 @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
     }
 }
 
-void tlb_flush_page_all_cpus_synced(CPUState *src, target_ulong addr)
+void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr)
 {
     tlb_flush_page_by_mmuidx_all_cpus_synced(src, addr, ALL_MMUIDX_BITS);
 }
 
 static void tlb_flush_range_locked(CPUArchState *env, int midx,
-                                   target_ulong addr, target_ulong len,
+                                   vaddr addr, vaddr len,
                                    unsigned bits)
 {
     CPUTLBDesc *d = &env_tlb(env)->d[midx];
     CPUTLBDescFast *f = &env_tlb(env)->f[midx];
-    target_ulong mask = MAKE_64BIT_MASK(0, bits);
+    vaddr mask = MAKE_64BIT_MASK(0, bits);
 
     /*
      * If @bits is smaller than the tlb size, there may be multiple entries
@@ -731,7 +728,7 @@ static void tlb_flush_range_locked(CPUArchState *env, int midx,
      */
     if (mask < f->mask || len > f->mask) {
         tlb_debug("forcing full flush midx %d ("
-                  TARGET_FMT_lx "/" TARGET_FMT_lx "+" TARGET_FMT_lx ")\n",
+                  "%" VADDR_PRIx "/%" VADDR_PRIx "+%" VADDR_PRIx ")\n",
                   midx, addr, mask, len);
         tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
         return;
@@ -744,14 +741,14 @@ static void tlb_flush_range_locked(CPUArchState *env, int midx,
      */
     if (((addr + len - 1) & d->large_page_mask) == d->large_page_addr) {
         tlb_debug("forcing full flush midx %d ("
-                  TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
+                  "%" VADDR_PRIx "/%" VADDR_PRIx ")\n",
                   midx, d->large_page_addr, d->large_page_mask);
         tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
         return;
     }
 
-    for (target_ulong i = 0; i < len; i += TARGET_PAGE_SIZE) {
-        target_ulong page = addr + i;
+    for (vaddr i = 0; i < len; i += TARGET_PAGE_SIZE) {
+        vaddr page = addr + i;
         CPUTLBEntry *entry = tlb_entry(env, midx, page);
 
         if (tlb_flush_entry_mask_locked(entry, page, mask)) {
@@ -762,8 +759,8 @@ static void tlb_flush_range_locked(CPUArchState *env, int midx,
 }
 
 typedef struct {
-    target_ulong addr;
-    target_ulong len;
+    vaddr addr;
+    vaddr len;
     uint16_t idxmap;
     uint16_t bits;
 } TLBFlushRangeData;
@@ -776,7 +773,7 @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
 
     assert_cpu_is_self(cpu);
 
-    tlb_debug("range:" TARGET_FMT_lx "/%u+" TARGET_FMT_lx " mmu_map:0x%x\n",
+    tlb_debug("range: %" VADDR_PRIx "/%u+%" VADDR_PRIx " mmu_map:0x%x\n",
               d.addr, d.bits, d.len, d.idxmap);
 
     qemu_spin_lock(&env_tlb(env)->c.lock);
@@ -801,7 +798,7 @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
      * overlap the flushed pages, which includes the previous.
      */
     d.addr -= TARGET_PAGE_SIZE;
-    for (target_ulong i = 0, n = d.len / TARGET_PAGE_SIZE + 1; i < n; i++) {
+    for (vaddr i = 0, n = d.len / TARGET_PAGE_SIZE + 1; i < n; i++) {
         tb_jmp_cache_clear_page(cpu, d.addr);
         d.addr += TARGET_PAGE_SIZE;
     }
@@ -815,8 +812,8 @@ static void tlb_flush_range_by_mmuidx_async_1(CPUState *cpu,
     g_free(d);
 }
 
-void tlb_flush_range_by_mmuidx(CPUState *cpu, target_ulong addr,
-                               target_ulong len, uint16_t idxmap,
+void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
+                               vaddr len, uint16_t idxmap,
                                unsigned bits)
 {
     TLBFlushRangeData d;
@@ -851,14 +848,14 @@ void tlb_flush_range_by_mmuidx(CPUState *cpu, target_ulong addr,
     }
 }
 
-void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, target_ulong addr,
+void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
                                    uint16_t idxmap, unsigned bits)
 {
     tlb_flush_range_by_mmuidx(cpu, addr, TARGET_PAGE_SIZE, idxmap, bits);
 }
 
 void tlb_flush_range_by_mmuidx_all_cpus(CPUState *src_cpu,
-                                        target_ulong addr, target_ulong len,
+                                        vaddr addr, vaddr len,
                                         uint16_t idxmap, unsigned bits)
 {
     TLBFlushRangeData d;
@@ -898,16 +895,16 @@ void tlb_flush_range_by_mmuidx_all_cpus(CPUState *src_cpu,
 }
 
 void tlb_flush_page_bits_by_mmuidx_all_cpus(CPUState *src_cpu,
-                                            target_ulong addr,
-                                            uint16_t idxmap, unsigned bits)
+                                            vaddr addr, uint16_t idxmap,
+                                            unsigned bits)
 {
     tlb_flush_range_by_mmuidx_all_cpus(src_cpu, addr, TARGET_PAGE_SIZE,
                                        idxmap, bits);
 }
 
 void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
-                                               target_ulong addr,
-                                               target_ulong len,
+                                               vaddr addr,
+                                               vaddr len,
                                                uint16_t idxmap,
                                                unsigned bits)
 {
@@ -949,7 +946,7 @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
 }
 
 void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
-                                                   target_ulong addr,
+                                                   vaddr addr,
                                                    uint16_t idxmap,
                                                    unsigned bits)
 {
@@ -1055,32 +1052,32 @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
 
 /* Called with tlb_c.lock held */
 static inline void tlb_set_dirty1_locked(CPUTLBEntry *tlb_entry,
-                                         target_ulong vaddr)
+                                         vaddr addr)
 {
-    if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY)) {
-        tlb_entry->addr_write = vaddr;
+    if (tlb_entry->addr_write == (addr | TLB_NOTDIRTY)) {
+        tlb_entry->addr_write = addr;
     }
 }
 
 /* update the TLB corresponding to virtual page vaddr
    so that it is no longer dirty */
-void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
+void tlb_set_dirty(CPUState *cpu, vaddr addr)
 {
     CPUArchState *env = cpu->env_ptr;
     int mmu_idx;
 
     assert_cpu_is_self(cpu);
 
-    vaddr &= TARGET_PAGE_MASK;
+    addr &= TARGET_PAGE_MASK;
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-        tlb_set_dirty1_locked(tlb_entry(env, mmu_idx, vaddr), vaddr);
+        tlb_set_dirty1_locked(tlb_entry(env, mmu_idx, addr), addr);
     }
 
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
         int k;
         for (k = 0; k < CPU_VTLB_SIZE; k++) {
-            tlb_set_dirty1_locked(&env_tlb(env)->d[mmu_idx].vtable[k], vaddr);
+            tlb_set_dirty1_locked(&env_tlb(env)->d[mmu_idx].vtable[k], addr);
         }
     }
     qemu_spin_unlock(&env_tlb(env)->c.lock);
@@ -1089,20 +1086,20 @@ void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
 /* Our TLB does not support large pages, so remember the area covered by
    large pages and trigger a full TLB flush if these are invalidated.  */
 static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
-                               target_ulong vaddr, target_ulong size)
+                               vaddr addr, uint64_t size)
 {
-    target_ulong lp_addr = env_tlb(env)->d[mmu_idx].large_page_addr;
-    target_ulong lp_mask = ~(size - 1);
+    vaddr lp_addr = env_tlb(env)->d[mmu_idx].large_page_addr;
+    vaddr lp_mask = ~(size - 1);
 
-    if (lp_addr == (target_ulong)-1) {
+    if (lp_addr == (vaddr)-1) {
         /* No previous large page.  */
-        lp_addr = vaddr;
+        lp_addr = addr;
     } else {
         /* Extend the existing region to include the new page.
            This is a compromise between unnecessary flushes and
            the cost of maintaining a full variable size TLB.  */
         lp_mask &= env_tlb(env)->d[mmu_idx].large_page_mask;
-        while (((lp_addr ^ vaddr) & lp_mask) != 0) {
+        while (((lp_addr ^ addr) & lp_mask) != 0) {
             lp_mask <<= 1;
         }
     }
@@ -1119,19 +1116,19 @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
  * critical section.
  */
 void tlb_set_page_full(CPUState *cpu, int mmu_idx,
-                       target_ulong vaddr, CPUTLBEntryFull *full)
+                       vaddr addr, CPUTLBEntryFull *full)
 {
     CPUArchState *env = cpu->env_ptr;
     CPUTLB *tlb = env_tlb(env);
     CPUTLBDesc *desc = &tlb->d[mmu_idx];
     MemoryRegionSection *section;
     unsigned int index;
-    target_ulong address;
-    target_ulong write_address;
+    vaddr address;
+    vaddr write_address;
     uintptr_t addend;
     CPUTLBEntry *te, tn;
     hwaddr iotlb, xlat, sz, paddr_page;
-    target_ulong vaddr_page;
+    vaddr addr_page;
     int asidx, wp_flags, prot;
     bool is_ram, is_romd;
 
@@ -1141,9 +1138,9 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
         sz = TARGET_PAGE_SIZE;
     } else {
         sz = (hwaddr)1 << full->lg_page_size;
-        tlb_add_large_page(env, mmu_idx, vaddr, sz);
+        tlb_add_large_page(env, mmu_idx, addr, sz);
     }
-    vaddr_page = vaddr & TARGET_PAGE_MASK;
+    addr_page = addr & TARGET_PAGE_MASK;
     paddr_page = full->phys_addr & TARGET_PAGE_MASK;
 
     prot = full->prot;
@@ -1152,11 +1149,11 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
                                                 &xlat, &sz, full->attrs, &prot);
     assert(sz >= TARGET_PAGE_SIZE);
 
-    tlb_debug("vaddr=" TARGET_FMT_lx " paddr=0x" HWADDR_FMT_plx
+    tlb_debug("vaddr=%" VADDR_PRIx " paddr=0x" HWADDR_FMT_plx
               " prot=%x idx=%d\n",
-              vaddr, full->phys_addr, prot, mmu_idx);
+              addr, full->phys_addr, prot, mmu_idx);
 
-    address = vaddr_page;
+    address = addr_page;
     if (full->lg_page_size < TARGET_PAGE_BITS) {
         /* Repeat the MMU check and TLB fill on every access.  */
         address |= TLB_INVALID_MASK;
@@ -1204,11 +1201,11 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
         }
     }
 
-    wp_flags = cpu_watchpoint_address_matches(cpu, vaddr_page,
+    wp_flags = cpu_watchpoint_address_matches(cpu, addr_page,
                                               TARGET_PAGE_SIZE);
 
-    index = tlb_index(env, mmu_idx, vaddr_page);
-    te = tlb_entry(env, mmu_idx, vaddr_page);
+    index = tlb_index(env, mmu_idx, addr_page);
+    te = tlb_entry(env, mmu_idx, addr_page);
 
     /*
      * Hold the TLB lock for the rest of the function. We could acquire/release
@@ -1223,13 +1220,13 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
     tlb->c.dirty |= 1 << mmu_idx;
 
     /* Make sure there's no cached translation for the new page.  */
-    tlb_flush_vtlb_page_locked(env, mmu_idx, vaddr_page);
+    tlb_flush_vtlb_page_locked(env, mmu_idx, addr_page);
 
     /*
      * Only evict the old entry to the victim tlb if it's for a
      * different page; otherwise just overwrite the stale data.
      */
-    if (!tlb_hit_page_anyprot(te, vaddr_page) && !tlb_entry_is_empty(te)) {
+    if (!tlb_hit_page_anyprot(te, addr_page) && !tlb_entry_is_empty(te)) {
         unsigned vidx = desc->vindex++ % CPU_VTLB_SIZE;
         CPUTLBEntry *tv = &desc->vtable[vidx];
 
@@ -1253,11 +1250,11 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
      */
     desc->fulltlb[index] = *full;
-    desc->fulltlb[index].xlat_section = iotlb - vaddr_page;
+    desc->fulltlb[index].xlat_section = iotlb - addr_page;
     desc->fulltlb[index].phys_addr = paddr_page;
 
     /* Now calculate the new entry */
-    tn.addend = addend - vaddr_page;
+    tn.addend = addend - addr_page;
     if (prot & PAGE_READ) {
         tn.addr_read = address;
         if (wp_flags & BP_MEM_READ) {
@@ -1289,9 +1286,9 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
     qemu_spin_unlock(&tlb->c.lock);
 }
 
-void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
                              hwaddr paddr, MemTxAttrs attrs, int prot,
-                             int mmu_idx, target_ulong size)
+                             int mmu_idx, uint64_t size)
 {
     CPUTLBEntryFull full = {
         .phys_addr = paddr,
@@ -1301,14 +1298,14 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     };
 
     assert(is_power_of_2(size));
-    tlb_set_page_full(cpu, mmu_idx, vaddr, &full);
+    tlb_set_page_full(cpu, mmu_idx, addr, &full);
 }
 
-void tlb_set_page(CPUState *cpu, target_ulong vaddr,
+void tlb_set_page(CPUState *cpu, vaddr addr,
                   hwaddr paddr, int prot,
-                  int mmu_idx, target_ulong size)
+                  int mmu_idx, uint64_t size)
 {
-    tlb_set_page_with_attrs(cpu, vaddr, paddr, MEMTXATTRS_UNSPECIFIED,
+    tlb_set_page_with_attrs(cpu, addr, paddr, MEMTXATTRS_UNSPECIFIED,
                             prot, mmu_idx, size);
 }
 
@@ -1317,7 +1314,7 @@ void tlb_set_page(CPUState *cpu, target_ulong vaddr,
  * caller's prior references to the TLB table (e.g. CPUTLBEntry pointers) must
  * be discarded and looked up again (e.g. via tlb_entry()).
  */
-static void tlb_fill(CPUState *cpu, target_ulong addr, int size,
+static void tlb_fill(CPUState *cpu, vaddr addr, int size,
                      MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
     bool ok;
@@ -1357,7 +1354,7 @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
 }
 
 static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
-                         int mmu_idx, target_ulong addr, uintptr_t retaddr,
+                         int mmu_idx, vaddr addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
 {
     CPUState *cpu = env_cpu(env);
@@ -1407,7 +1404,7 @@ static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
 }
 
 static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
-                      int mmu_idx, uint64_t val, target_ulong addr,
+                      int mmu_idx, uint64_t val, vaddr addr,
                       uintptr_t retaddr, MemOp op)
 {
     CPUState *cpu = env_cpu(env);
@@ -1449,7 +1446,7 @@ static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
 /* Return true if ADDR is present in the victim tlb, and has been copied
    back to the main tlb.  */
 static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
-                           MMUAccessType access_type, target_ulong page)
+                           MMUAccessType access_type, vaddr page)
 {
     size_t vidx;
 
@@ -1691,13 +1688,13 @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
  * from the same thread (which a mem callback will be) this is safe.
  */
 
-bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
+bool tlb_plugin_lookup(CPUState *cpu, vaddr addr, int mmu_idx,
                        bool is_store, struct qemu_plugin_hwaddr *data)
 {
     CPUArchState *env = cpu->env_ptr;
     CPUTLBEntry *tlbe = tlb_entry(env, mmu_idx, addr);
     uintptr_t index = tlb_index(env, mmu_idx, addr);
-    target_ulong tlb_addr = is_store ? tlb_addr_write(tlbe) : tlbe->addr_read;
+    vaddr tlb_addr = is_store ? tlb_addr_write(tlbe) : tlbe->addr_read;
 
     if (likely(tlb_hit(tlb_addr, addr))) {
         /* We must have an iotlb entry for MMIO */
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 892eecda2d..3541419845 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -98,7 +98,7 @@ static void tb_remove_all(void)
 /* Call with mmap_lock held. */
 static void tb_record(TranslationBlock *tb, PageDesc *p1, PageDesc *p2)
 {
-    target_ulong addr;
+    vaddr addr;
     int flags;
 
     assert_memory_lock();
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 4cb77c8dec..e6a079402e 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -147,8 +147,8 @@ typedef struct CPUTLBDesc {
      * we must flush the entire tlb.  The region is matched if
      * (addr & large_page_mask) == large_page_addr.
      */
-    target_ulong large_page_addr;
-    target_ulong large_page_mask;
+    vaddr large_page_addr;
+    vaddr large_page_mask;
     /* host time (in ns) at the beginning of the time window */
     int64_t window_begin_ns;
     /* maximum number of entries observed in the window */
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 698943d58f..f5508e242b 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -94,7 +94,7 @@ void tlb_destroy(CPUState *cpu);
  * Flush one page from the TLB of the specified CPU, for all
  * MMU indexes.
  */
-void tlb_flush_page(CPUState *cpu, target_ulong addr);
+void tlb_flush_page(CPUState *cpu, vaddr addr);
 /**
  * tlb_flush_page_all_cpus:
  * @cpu: src CPU of the flush
@@ -103,7 +103,7 @@ void tlb_flush_page(CPUState *cpu, target_ulong addr);
  * Flush one page from the TLB of the specified CPU, for all
  * MMU indexes.
  */
-void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr);
+void tlb_flush_page_all_cpus(CPUState *src, vaddr addr);
 /**
  * tlb_flush_page_all_cpus_synced:
  * @cpu: src CPU of the flush
@@ -115,7 +115,7 @@ void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr);
  * the source vCPUs safe work is complete. This will depend on when
  * the guests translation ends the TB.
  */
-void tlb_flush_page_all_cpus_synced(CPUState *src, target_ulong addr);
+void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr);
 /**
  * tlb_flush:
  * @cpu: CPU whose TLB should be flushed
@@ -150,7 +150,7 @@ void tlb_flush_all_cpus_synced(CPUState *src_cpu);
  * Flush one page from the TLB of the specified CPU, for the specified
  * MMU indexes.
  */
-void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr,
+void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
                               uint16_t idxmap);
 /**
  * tlb_flush_page_by_mmuidx_all_cpus:
@@ -161,7 +161,7 @@ void tlb_flush_page_by_mmuidx(CPUState *cpu, target_ulong addr,
  * Flush one page from the TLB of all CPUs, for the specified
  * MMU indexes.
  */
-void tlb_flush_page_by_mmuidx_all_cpus(CPUState *cpu, target_ulong addr,
+void tlb_flush_page_by_mmuidx_all_cpus(CPUState *cpu, vaddr addr,
                                        uint16_t idxmap);
 /**
  * tlb_flush_page_by_mmuidx_all_cpus_synced:
@@ -175,7 +175,7 @@ void tlb_flush_page_by_mmuidx_all_cpus(CPUState *cpu, target_ulong addr,
  * complete once  the source vCPUs safe work is complete. This will
  * depend on when the guests translation ends the TB.
  */
-void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, target_ulong addr,
+void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
                                               uint16_t idxmap);
 /**
  * tlb_flush_by_mmuidx:
@@ -218,14 +218,14 @@ void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
  *
  * Similar to tlb_flush_page_mask, but with a bitmap of indexes.
  */
-void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, target_ulong addr,
+void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
                                    uint16_t idxmap, unsigned bits);
 
 /* Similarly, with broadcast and syncing. */
-void tlb_flush_page_bits_by_mmuidx_all_cpus(CPUState *cpu, target_ulong addr,
+void tlb_flush_page_bits_by_mmuidx_all_cpus(CPUState *cpu, vaddr addr,
                                             uint16_t idxmap, unsigned bits);
 void tlb_flush_page_bits_by_mmuidx_all_cpus_synced
-    (CPUState *cpu, target_ulong addr, uint16_t idxmap, unsigned bits);
+    (CPUState *cpu, vaddr addr, uint16_t idxmap, unsigned bits);
 
 /**
  * tlb_flush_range_by_mmuidx
@@ -238,17 +238,17 @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced
  * For each mmuidx in @idxmap, flush all pages within [@addr,@addr+@len),
  * comparing only the low @bits worth of each virtual page.
  */
-void tlb_flush_range_by_mmuidx(CPUState *cpu, target_ulong addr,
-                               target_ulong len, uint16_t idxmap,
+void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
+                               vaddr len, uint16_t idxmap,
                                unsigned bits);
 
 /* Similarly, with broadcast and syncing. */
-void tlb_flush_range_by_mmuidx_all_cpus(CPUState *cpu, target_ulong addr,
-                                        target_ulong len, uint16_t idxmap,
+void tlb_flush_range_by_mmuidx_all_cpus(CPUState *cpu, vaddr addr,
+                                        vaddr len, uint16_t idxmap,
                                         unsigned bits);
 void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                               target_ulong addr,
-                                               target_ulong len,
+                                               vaddr addr,
+                                               vaddr len,
                                                uint16_t idxmap,
                                                unsigned bits);
 
@@ -256,7 +256,7 @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
  * tlb_set_page_full:
  * @cpu: CPU context
  * @mmu_idx: mmu index of the tlb to modify
- * @vaddr: virtual address of the entry to add
+ * @addr: virtual address of the entry to add
  * @full: the details of the tlb entry
  *
  * Add an entry to @cpu tlb index @mmu_idx.  All of the fields of
@@ -271,13 +271,13 @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
  * single TARGET_PAGE_SIZE region is mapped; @full->lg_page_size is only
  * used by tlb_flush_page.
  */
-void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
+void tlb_set_page_full(CPUState *cpu, int mmu_idx, vaddr addr,
                        CPUTLBEntryFull *full);
 
 /**
  * tlb_set_page_with_attrs:
  * @cpu: CPU to add this TLB entry for
- * @vaddr: virtual address of page to add entry for
+ * @addr: virtual address of page to add entry for
  * @paddr: physical address of the page
  * @attrs: memory transaction attributes
  * @prot: access permissions (PAGE_READ/PAGE_WRITE/PAGE_EXEC bits)
@@ -285,7 +285,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
  * @size: size of the page in bytes
  *
  * Add an entry to this CPU's TLB (a mapping from virtual address
- * @vaddr to physical address @paddr) with the specified memory
+ * @addr to physical address @paddr) with the specified memory
  * transaction attributes. This is generally called by the target CPU
  * specific code after it has been called through the tlb_fill()
  * entry point and performed a successful page table walk to find
@@ -296,18 +296,18 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx, target_ulong vaddr,
  * single TARGET_PAGE_SIZE region is mapped; the supplied @size is only
  * used by tlb_flush_page.
  */
-void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
+void tlb_set_page_with_attrs(CPUState *cpu, vaddr addr,
                              hwaddr paddr, MemTxAttrs attrs,
-                             int prot, int mmu_idx, target_ulong size);
+                             int prot, int mmu_idx, vaddr size);
 /* tlb_set_page:
  *
  * This function is equivalent to calling tlb_set_page_with_attrs()
  * with an @attrs argument of MEMTXATTRS_UNSPECIFIED. It's provided
  * as a convenience for CPUs which don't use memory transaction attributes.
  */
-void tlb_set_page(CPUState *cpu, target_ulong vaddr,
+void tlb_set_page(CPUState *cpu, vaddr addr,
                   hwaddr paddr, int prot,
-                  int mmu_idx, target_ulong size);
+                  int mmu_idx, vaddr size);
 #else
 static inline void tlb_init(CPUState *cpu)
 {
@@ -315,14 +315,13 @@ static inline void tlb_init(CPUState *cpu)
 static inline void tlb_destroy(CPUState *cpu)
 {
 }
-static inline void tlb_flush_page(CPUState *cpu, target_ulong addr)
+static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
 {
 }
-static inline void tlb_flush_page_all_cpus(CPUState *src, target_ulong addr)
+static inline void tlb_flush_page_all_cpus(CPUState *src, vaddr addr)
 {
 }
-static inline void tlb_flush_page_all_cpus_synced(CPUState *src,
-                                                  target_ulong addr)
+static inline void tlb_flush_page_all_cpus_synced(CPUState *src, vaddr addr)
 {
 }
 static inline void tlb_flush(CPUState *cpu)
@@ -335,7 +334,7 @@ static inline void tlb_flush_all_cpus_synced(CPUState *src_cpu)
 {
 }
 static inline void tlb_flush_page_by_mmuidx(CPUState *cpu,
-                                            target_ulong addr, uint16_t idxmap)
+                                            vaddr addr, uint16_t idxmap)
 {
 }
 
@@ -343,12 +342,12 @@ static inline void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
 {
 }
 static inline void tlb_flush_page_by_mmuidx_all_cpus(CPUState *cpu,
-                                                     target_ulong addr,
+                                                     vaddr addr,
                                                      uint16_t idxmap)
 {
 }
 static inline void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                                            target_ulong addr,
+                                                            vaddr addr,
                                                             uint16_t idxmap)
 {
 }
@@ -361,37 +360,37 @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
 {
 }
 static inline void tlb_flush_page_bits_by_mmuidx(CPUState *cpu,
-                                                 target_ulong addr,
+                                                 vaddr addr,
                                                  uint16_t idxmap,
                                                  unsigned bits)
 {
 }
 static inline void tlb_flush_page_bits_by_mmuidx_all_cpus(CPUState *cpu,
-                                                          target_ulong addr,
+                                                          vaddr addr,
                                                           uint16_t idxmap,
                                                           unsigned bits)
 {
 }
 static inline void
-tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, target_ulong addr,
+tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
                                               uint16_t idxmap, unsigned bits)
 {
 }
-static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, target_ulong addr,
-                                             target_ulong len, uint16_t idxmap,
+static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
+                                             vaddr len, uint16_t idxmap,
                                              unsigned bits)
 {
 }
 static inline void tlb_flush_range_by_mmuidx_all_cpus(CPUState *cpu,
-                                                      target_ulong addr,
-                                                      target_ulong len,
+                                                      vaddr addr,
+                                                      vaddr len,
                                                       uint16_t idxmap,
                                                       unsigned bits)
 {
 }
 static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                                             target_ulong addr,
-                                                             target_long len,
+                                                             vaddr addr,
+                                                             vaddr len,
                                                              uint16_t idxmap,
                                                              unsigned bits)
 {
@@ -663,7 +662,7 @@ static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
 
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
-void tlb_set_dirty(CPUState *cpu, target_ulong vaddr);
+void tlb_set_dirty(CPUState *cpu, vaddr addr);
 
 MemoryRegionSection *
 address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr addr,
diff --git a/include/qemu/plugin-memory.h b/include/qemu/plugin-memory.h
index 6fd539022a..43165f2452 100644
--- a/include/qemu/plugin-memory.h
+++ b/include/qemu/plugin-memory.h
@@ -37,7 +37,7 @@ struct qemu_plugin_hwaddr {
  * It would only fail if not called from an instrumented memory access
  * which would be an abuse of the API.
  */
-bool tlb_plugin_lookup(CPUState *cpu, target_ulong addr, int mmu_idx,
+bool tlb_plugin_lookup(CPUState *cpu, vaddr addr, int mmu_idx,
                        bool is_store, struct qemu_plugin_hwaddr *data);
 
 #endif /* PLUGIN_MEMORY_H */

From 256d11f9ba23c74db75d50b24e3357d583d7885b Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:23 +0200
Subject: [PATCH 0185/1353] accel/tcg/translate-all.c: Widen pc and cs_base

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-3-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/internal.h      |  6 +++---
 accel/tcg/translate-all.c | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index 65380ccb42..91f308bdfa 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -42,8 +42,8 @@ void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
 G_NORETURN void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr);
 #endif /* CONFIG_SOFTMMU */
 
-TranslationBlock *tb_gen_code(CPUState *cpu, target_ulong pc,
-                              target_ulong cs_base, uint32_t flags,
+TranslationBlock *tb_gen_code(CPUState *cpu, vaddr pc,
+                              uint64_t cs_base, uint32_t flags,
                               int cflags);
 void page_init(void);
 void tb_htable_init(void);
@@ -55,7 +55,7 @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                uintptr_t host_pc);
 
 /* Return the current PC from CPU, which may be cached in TB. */
-static inline target_ulong log_pc(CPUState *cpu, const TranslationBlock *tb)
+static inline vaddr log_pc(CPUState *cpu, const TranslationBlock *tb)
 {
     if (tb_cflags(tb) & CF_PCREL) {
         return cpu->cc->get_pc(cpu);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index c4d081f5ad..03caf62459 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -274,7 +274,7 @@ void page_init(void)
  * Return the size of the generated code, or negative on error.
  */
 static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
-                           target_ulong pc, void *host_pc,
+                           vaddr pc, void *host_pc,
                            int *max_insns, int64_t *ti)
 {
     int ret = sigsetjmp(tcg_ctx->jmp_trans, 0);
@@ -302,7 +302,7 @@ static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
 
 /* Called with mmap_lock held for user mode emulation.  */
 TranslationBlock *tb_gen_code(CPUState *cpu,
-                              target_ulong pc, target_ulong cs_base,
+                              vaddr pc, uint64_t cs_base,
                               uint32_t flags, int cflags)
 {
     CPUArchState *env = cpu->env_ptr;
@@ -634,10 +634,10 @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     cpu->cflags_next_tb = curr_cflags(cpu) | CF_MEMI_ONLY | CF_LAST_IO | n;
 
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
-        target_ulong pc = log_pc(cpu, tb);
+        vaddr pc = log_pc(cpu, tb);
         if (qemu_log_in_addr_range(pc)) {
-            qemu_log("cpu_io_recompile: rewound execution of TB to "
-                     TARGET_FMT_lx "\n", pc);
+            qemu_log("cpu_io_recompile: rewound execution of TB to %"
+                     VADDR_PRIx "\n", pc);
         }
     }
 

From bb5de52524c6c4b7da5623c5b19d9d6dc8405aa0 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:24 +0200
Subject: [PATCH 0186/1353] target: Widen pc/cs_base in cpu_get_tb_cpu_state

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-4-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c      | 9 ++++++---
 accel/tcg/translate-all.c | 3 ++-
 target/alpha/cpu.h        | 4 ++--
 target/arm/cpu.h          | 4 ++--
 target/arm/helper.c       | 4 ++--
 target/avr/cpu.h          | 4 ++--
 target/cris/cpu.h         | 4 ++--
 target/hexagon/cpu.h      | 4 ++--
 target/hppa/cpu.h         | 5 ++---
 target/i386/cpu.h         | 4 ++--
 target/loongarch/cpu.h    | 6 ++----
 target/m68k/cpu.h         | 4 ++--
 target/microblaze/cpu.h   | 4 ++--
 target/mips/cpu.h         | 4 ++--
 target/nios2/cpu.h        | 4 ++--
 target/openrisc/cpu.h     | 5 ++---
 target/ppc/cpu.h          | 8 ++++----
 target/ppc/helper_regs.c  | 4 ++--
 target/riscv/cpu.h        | 4 ++--
 target/riscv/cpu_helper.c | 4 ++--
 target/rx/cpu.h           | 4 ++--
 target/s390x/cpu.h        | 4 ++--
 target/sh4/cpu.h          | 4 ++--
 target/sparc/cpu.h        | 4 ++--
 target/tricore/cpu.h      | 4 ++--
 target/xtensa/cpu.h       | 4 ++--
 26 files changed, 58 insertions(+), 58 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 179847b294..4d952a6cc2 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -408,7 +408,8 @@ const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
 {
     CPUState *cpu = env_cpu(env);
     TranslationBlock *tb;
-    target_ulong cs_base, pc;
+    vaddr pc;
+    uint64_t cs_base;
     uint32_t flags, cflags;
 
     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
@@ -529,7 +530,8 @@ void cpu_exec_step_atomic(CPUState *cpu)
 {
     CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb;
-    target_ulong cs_base, pc;
+    vaddr pc;
+    uint64_t cs_base;
     uint32_t flags, cflags;
     int tb_exit;
 
@@ -942,7 +944,8 @@ cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
 
         while (!cpu_handle_interrupt(cpu, &last_tb)) {
             TranslationBlock *tb;
-            target_ulong cs_base, pc;
+            vaddr pc;
+            uint64_t cs_base;
             uint32_t flags, cflags;
 
             cpu_get_tb_cpu_state(cpu->env_ptr, &pc, &cs_base, &flags);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 03caf62459..03c49baf1c 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -580,7 +580,8 @@ void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr)
         /* The exception probably happened in a helper.  The CPU state should
            have been saved before calling it. Fetch the PC from there.  */
         CPUArchState *env = cpu->env_ptr;
-        target_ulong pc, cs_base;
+        vaddr pc;
+        uint64_t cs_base;
         tb_page_addr_t addr;
         uint32_t flags;
 
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index 5e67304d81..fcd20bfd3a 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -462,8 +462,8 @@ void alpha_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
                                      MemTxResult response, uintptr_t retaddr);
 #endif
 
-static inline void cpu_get_tb_cpu_state(CPUAlphaState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *pflags)
+static inline void cpu_get_tb_cpu_state(CPUAlphaState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *pflags)
 {
     *pc = env->pc;
     *cs_base = 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 11c3850ad9..00e675f58f 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3220,8 +3220,8 @@ static inline bool arm_cpu_bswap_data(CPUARMState *env)
 }
 #endif
 
-void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *flags);
+void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags);
 
 enum {
     QEMU_PSCI_CONDUIT_DISABLED = 0,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 323cadd3c8..d08c058e42 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -11945,8 +11945,8 @@ static bool mve_no_pred(CPUARMState *env)
     return true;
 }
 
-void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *pflags)
+void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags)
 {
     CPUARMTBFlags flags;
 
diff --git a/target/avr/cpu.h b/target/avr/cpu.h
index f19dd72926..7225174668 100644
--- a/target/avr/cpu.h
+++ b/target/avr/cpu.h
@@ -190,8 +190,8 @@ enum {
     TB_FLAGS_SKIP = 2,
 };
 
-static inline void cpu_get_tb_cpu_state(CPUAVRState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *pflags)
+static inline void cpu_get_tb_cpu_state(CPUAVRState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *pflags)
 {
     uint32_t flags = 0;
 
diff --git a/target/cris/cpu.h b/target/cris/cpu.h
index 71fa1f96e0..8e37c6e50d 100644
--- a/target/cris/cpu.h
+++ b/target/cris/cpu.h
@@ -266,8 +266,8 @@ static inline int cpu_mmu_index (CPUCRISState *env, bool ifetch)
 
 #include "exec/cpu-all.h"
 
-static inline void cpu_get_tb_cpu_state(CPUCRISState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUCRISState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *cs_base = 0;
diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index bfcb1057dd..daef5c3f00 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -153,8 +153,8 @@ struct ArchCPU {
 
 FIELD(TB_FLAGS, IS_TIGHT_LOOP, 0, 1)
 
-static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUHexagonState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     uint32_t hex_flags = 0;
     *pc = env->gpr[HEX_REG_PC];
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index b595ef25a9..7373177b55 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -268,9 +268,8 @@ static inline target_ulong hppa_form_gva(CPUHPPAState *env, uint64_t spc,
 #define TB_FLAG_PRIV_SHIFT  8
 #define TB_FLAG_UNALIGN     0x400
 
-static inline void cpu_get_tb_cpu_state(CPUHPPAState *env, target_ulong *pc,
-                                        target_ulong *cs_base,
-                                        uint32_t *pflags)
+static inline void cpu_get_tb_cpu_state(CPUHPPAState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *pflags)
 {
     uint32_t flags = env->psw_n * PSW_N;
 
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index cd047e0410..2c9b0d2ebc 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2275,8 +2275,8 @@ static inline int cpu_mmu_index_kernel(CPUX86State *env)
 #include "hw/i386/apic.h"
 #endif
 
-static inline void cpu_get_tb_cpu_state(CPUX86State *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUX86State *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *cs_base = env->segs[R_CS].base;
     *pc = *cs_base + env->eip;
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index b23f38c3d5..ed04027af1 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -427,10 +427,8 @@ static inline int cpu_mmu_index(CPULoongArchState *env, bool ifetch)
 #define HW_FLAGS_EUEN_FPE   0x04
 #define HW_FLAGS_EUEN_SXE   0x08
 
-static inline void cpu_get_tb_cpu_state(CPULoongArchState *env,
-                                        target_ulong *pc,
-                                        target_ulong *cs_base,
-                                        uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *cs_base = 0;
diff --git a/target/m68k/cpu.h b/target/m68k/cpu.h
index 048d5aae2b..cf70282717 100644
--- a/target/m68k/cpu.h
+++ b/target/m68k/cpu.h
@@ -601,8 +601,8 @@ void m68k_cpu_transaction_failed(CPUState *cs, hwaddr physaddr, vaddr addr,
 #define TB_FLAGS_TRACE          16
 #define TB_FLAGS_TRACE_BIT      (1 << TB_FLAGS_TRACE)
 
-static inline void cpu_get_tb_cpu_state(CPUM68KState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUM68KState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *cs_base = 0;
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 88324d0bc1..3525de144c 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -401,8 +401,8 @@ void mb_tcg_init(void);
 /* Ensure there is no overlap between the two masks. */
 QEMU_BUILD_BUG_ON(MSR_TB_MASK & IFLAGS_TB_MASK);
 
-static inline void cpu_get_tb_cpu_state(CPUMBState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUMBState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *flags = (env->iflags & IFLAGS_TB_MASK) | (env->msr & MSR_TB_MASK);
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index 142c55af47..a3bc646976 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1313,8 +1313,8 @@ void itc_reconfigure(struct MIPSITUState *tag);
 /* helper.c */
 target_ulong exception_resume_pc(CPUMIPSState *env);
 
-static inline void cpu_get_tb_cpu_state(CPUMIPSState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUMIPSState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->active_tc.PC;
     *cs_base = 0;
diff --git a/target/nios2/cpu.h b/target/nios2/cpu.h
index 20042c4332..477a3161fd 100644
--- a/target/nios2/cpu.h
+++ b/target/nios2/cpu.h
@@ -302,8 +302,8 @@ FIELD(TBFLAGS, CRS0, 0, 1)  /* Set if CRS == 0. */
 FIELD(TBFLAGS, U, 1, 1)     /* Overlaps CR_STATUS_U */
 FIELD(TBFLAGS, R0_0, 2, 1)  /* Set if R0 == 0. */
 
-static inline void cpu_get_tb_cpu_state(CPUNios2State *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUNios2State *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     unsigned crs = FIELD_EX32(env->ctrl[CR_STATUS], CR_STATUS, CRS);
 
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index f16e8b3274..92c38f54c2 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -367,9 +367,8 @@ static inline void cpu_set_gpr(CPUOpenRISCState *env, int i, uint32_t val)
     env->shadow_gpr[0][i] = val;
 }
 
-static inline void cpu_get_tb_cpu_state(CPUOpenRISCState *env,
-                                        target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUOpenRISCState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *cs_base = 0;
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 4138a25801..94497aa115 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -2508,11 +2508,11 @@ void cpu_write_xer(CPUPPCState *env, target_ulong xer);
 #define is_book3s_arch2x(ctx) (!!((ctx)->insns_flags & PPC_SEGMENT_64B))
 
 #ifdef CONFIG_DEBUG_TCG
-void cpu_get_tb_cpu_state(CPUPPCState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *flags);
+void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags);
 #else
-static inline void cpu_get_tb_cpu_state(CPUPPCState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->nip;
     *cs_base = 0;
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index e27f4a75a4..f380342d4d 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -218,8 +218,8 @@ void hreg_update_pmu_hflags(CPUPPCState *env)
 }
 
 #ifdef CONFIG_DEBUG_TCG
-void cpu_get_tb_cpu_state(CPUPPCState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *flags)
+void cpu_get_tb_cpu_state(CPUPPCState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *flags)
 {
     uint32_t hflags_current = env->hflags;
     uint32_t hflags_rebuilt;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index e3e08d315f..7bff1d47f6 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -587,8 +587,8 @@ static inline uint32_t vext_get_vlmax(RISCVCPU *cpu, target_ulong vtype)
     return cpu->cfg.vlen >> (sew + 3 - lmul);
 }
 
-void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *pflags);
+void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags);
 
 void riscv_cpu_update_mask(CPURISCVState *env);
 
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 90cef9856d..a944f25694 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -61,8 +61,8 @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 #endif
 }
 
-void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *pflags)
+void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
+                          uint64_t *cs_base, uint32_t *pflags)
 {
     CPUState *cs = env_cpu(env);
     RISCVCPU *cpu = RISCV_CPU(cs);
diff --git a/target/rx/cpu.h b/target/rx/cpu.h
index 555d230f24..7f03ffcfed 100644
--- a/target/rx/cpu.h
+++ b/target/rx/cpu.h
@@ -143,8 +143,8 @@ void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte);
 #define RX_CPU_IRQ 0
 #define RX_CPU_FIR 1
 
-static inline void cpu_get_tb_cpu_state(CPURXState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPURXState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *cs_base = 0;
diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
index f130c29f83..eb5b65b7d3 100644
--- a/target/s390x/cpu.h
+++ b/target/s390x/cpu.h
@@ -378,8 +378,8 @@ static inline int cpu_mmu_index(CPUS390XState *env, bool ifetch)
 #endif
 }
 
-static inline void cpu_get_tb_cpu_state(CPUS390XState* env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUS390XState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     if (env->psw.addr & 1) {
         /*
diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index 02bfd612ea..1399d3840f 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -368,8 +368,8 @@ static inline void cpu_write_sr(CPUSH4State *env, target_ulong sr)
     env->sr = sr & ~((1u << SR_M) | (1u << SR_Q) | (1u << SR_T));
 }
 
-static inline void cpu_get_tb_cpu_state(CPUSH4State *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUSH4State *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     /* For a gUSA region, notice the end of the region.  */
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 3d090e8278..95d2d0da71 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -762,8 +762,8 @@ trap_state* cpu_tsptr(CPUSPARCState* env);
 #define TB_FLAG_HYPER        (1 << 7)
 #define TB_FLAG_ASI_SHIFT    24
 
-static inline void cpu_get_tb_cpu_state(CPUSPARCState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *pflags)
+static inline void cpu_get_tb_cpu_state(CPUSPARCState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *pflags)
 {
     uint32_t flags;
     *pc = env->pc;
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index 257fcf3cee..a50b91cc36 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -384,8 +384,8 @@ FIELD(TB_FLAGS, PRIV, 0, 2)
 void cpu_state_reset(CPUTriCoreState *s);
 void tricore_tcg_init(void);
 
-static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUTriCoreState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     uint32_t new_flags = 0;
     *pc = env->PC;
diff --git a/target/xtensa/cpu.h b/target/xtensa/cpu.h
index b7a54711a6..87fe992ba6 100644
--- a/target/xtensa/cpu.h
+++ b/target/xtensa/cpu.h
@@ -727,8 +727,8 @@ static inline int cpu_mmu_index(CPUXtensaState *env, bool ifetch)
 
 #include "exec/cpu-all.h"
 
-static inline void cpu_get_tb_cpu_state(CPUXtensaState *env, target_ulong *pc,
-        target_ulong *cs_base, uint32_t *flags)
+static inline void cpu_get_tb_cpu_state(CPUXtensaState *env, vaddr *pc,
+                                        uint64_t *cs_base, uint32_t *flags)
 {
     *pc = env->pc;
     *cs_base = 0;

From 9e39de980fdf0dbb083a5c78b71bf2c1bdfa0499 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:25 +0200
Subject: [PATCH 0187/1353] accel/tcg/cputlb.c: Widen CPUTLBEntry access
 functions

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-5-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c      |  8 ++++----
 include/exec/cpu_ldst.h | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5caeccb52d..ac990a1526 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1453,7 +1453,7 @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
     assert_cpu_is_self(env_cpu(env));
     for (vidx = 0; vidx < CPU_VTLB_SIZE; ++vidx) {
         CPUTLBEntry *vtlb = &env_tlb(env)->d[mmu_idx].vtable[vidx];
-        target_ulong cmp = tlb_read_idx(vtlb, access_type);
+        uint64_t cmp = tlb_read_idx(vtlb, access_type);
 
         if (cmp == page) {
             /* Found entry in victim tlb, swap tlb and iotlb.  */
@@ -1507,7 +1507,7 @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
 {
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    target_ulong tlb_addr = tlb_read_idx(entry, access_type);
+    uint64_t tlb_addr = tlb_read_idx(entry, access_type);
     target_ulong page_addr = addr & TARGET_PAGE_MASK;
     int flags = TLB_FLAGS_MASK;
 
@@ -1694,7 +1694,7 @@ bool tlb_plugin_lookup(CPUState *cpu, vaddr addr, int mmu_idx,
     CPUArchState *env = cpu->env_ptr;
     CPUTLBEntry *tlbe = tlb_entry(env, mmu_idx, addr);
     uintptr_t index = tlb_index(env, mmu_idx, addr);
-    vaddr tlb_addr = is_store ? tlb_addr_write(tlbe) : tlbe->addr_read;
+    uint64_t tlb_addr = is_store ? tlb_addr_write(tlbe) : tlbe->addr_read;
 
     if (likely(tlb_hit(tlb_addr, addr))) {
         /* We must have an iotlb entry for MMIO */
@@ -1759,7 +1759,7 @@ static bool mmu_lookup1(CPUArchState *env, MMULookupPageData *data,
     target_ulong addr = data->addr;
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
-    target_ulong tlb_addr = tlb_read_idx(entry, access_type);
+    uint64_t tlb_addr = tlb_read_idx(entry, access_type);
     bool maybe_resized = false;
 
     /* If the TLB entry is for a different page, reload and try again.  */
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 896f305ff3..645476f0e5 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -328,8 +328,8 @@ static inline void clear_helper_retaddr(void)
 
 #include "tcg/oversized-guest.h"
 
-static inline target_ulong tlb_read_idx(const CPUTLBEntry *entry,
-                                        MMUAccessType access_type)
+static inline uint64_t tlb_read_idx(const CPUTLBEntry *entry,
+                                    MMUAccessType access_type)
 {
     /* Do not rearrange the CPUTLBEntry structure members. */
     QEMU_BUILD_BUG_ON(offsetof(CPUTLBEntry, addr_read) !=
@@ -355,14 +355,14 @@ static inline target_ulong tlb_read_idx(const CPUTLBEntry *entry,
 #endif
 }
 
-static inline target_ulong tlb_addr_write(const CPUTLBEntry *entry)
+static inline uint64_t tlb_addr_write(const CPUTLBEntry *entry)
 {
     return tlb_read_idx(entry, MMU_DATA_STORE);
 }
 
 /* Find the TLB index corresponding to the mmu_idx + address pair.  */
 static inline uintptr_t tlb_index(CPUArchState *env, uintptr_t mmu_idx,
-                                  target_ulong addr)
+                                  vaddr addr)
 {
     uintptr_t size_mask = env_tlb(env)->f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS;
 
@@ -371,7 +371,7 @@ static inline uintptr_t tlb_index(CPUArchState *env, uintptr_t mmu_idx,
 
 /* Find the TLB entry corresponding to the mmu_idx + address pair.  */
 static inline CPUTLBEntry *tlb_entry(CPUArchState *env, uintptr_t mmu_idx,
-                                     target_ulong addr)
+                                     vaddr addr)
 {
     return &env_tlb(env)->f[mmu_idx].table[tlb_index(env, mmu_idx, addr)];
 }

From fb2c53cb710e3f3a4c6d4bb6f2465295e216b835 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:26 +0200
Subject: [PATCH 0188/1353] accel/tcg/cputlb.c: Widen addr in MMULookupPageData

Functions accessing MMULookupPageData are also updated.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-6-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index ac990a1526..cc53d0fb64 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1729,7 +1729,7 @@ bool tlb_plugin_lookup(CPUState *cpu, vaddr addr, int mmu_idx,
 typedef struct MMULookupPageData {
     CPUTLBEntryFull *full;
     void *haddr;
-    target_ulong addr;
+    vaddr addr;
     int flags;
     int size;
 } MMULookupPageData;
@@ -1756,7 +1756,7 @@ typedef struct MMULookupLocals {
 static bool mmu_lookup1(CPUArchState *env, MMULookupPageData *data,
                         int mmu_idx, MMUAccessType access_type, uintptr_t ra)
 {
-    target_ulong addr = data->addr;
+    vaddr addr = data->addr;
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     uint64_t tlb_addr = tlb_read_idx(entry, access_type);
@@ -1796,7 +1796,7 @@ static void mmu_watch_or_dirty(CPUArchState *env, MMULookupPageData *data,
                                MMUAccessType access_type, uintptr_t ra)
 {
     CPUTLBEntryFull *full = data->full;
-    target_ulong addr = data->addr;
+    vaddr addr = data->addr;
     int flags = data->flags;
     int size = data->size;
 
@@ -1827,7 +1827,7 @@ static void mmu_watch_or_dirty(CPUArchState *env, MMULookupPageData *data,
  * Resolve the translation for the page(s) beginning at @addr, for MemOp.size
  * bytes.  Return true if the lookup crosses a page boundary.
  */
-static bool mmu_lookup(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+static bool mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
                        uintptr_t ra, MMUAccessType type, MMULookupLocals *l)
 {
     unsigned a_bits;
@@ -2024,7 +2024,7 @@ static uint64_t do_ld_mmio_beN(CPUArchState *env, MMULookupPageData *p,
                                MMUAccessType type, uintptr_t ra)
 {
     CPUTLBEntryFull *full = p->full;
-    target_ulong addr = p->addr;
+    vaddr addr = p->addr;
     int i, size = p->size;
 
     QEMU_IOTHREAD_LOCK_GUARD();
@@ -2333,7 +2333,7 @@ static uint64_t do_ld_8(CPUArchState *env, MMULookupPageData *p, int mmu_idx,
     return ret;
 }
 
-static uint8_t do_ld1_mmu(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+static uint8_t do_ld1_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
                           uintptr_t ra, MMUAccessType access_type)
 {
     MMULookupLocals l;
@@ -2352,7 +2352,7 @@ tcg_target_ulong helper_ldub_mmu(CPUArchState *env, uint64_t addr,
     return do_ld1_mmu(env, addr, oi, retaddr, MMU_DATA_LOAD);
 }
 
-static uint16_t do_ld2_mmu(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+static uint16_t do_ld2_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
                            uintptr_t ra, MMUAccessType access_type)
 {
     MMULookupLocals l;
@@ -2383,7 +2383,7 @@ tcg_target_ulong helper_lduw_mmu(CPUArchState *env, uint64_t addr,
     return do_ld2_mmu(env, addr, oi, retaddr, MMU_DATA_LOAD);
 }
 
-static uint32_t do_ld4_mmu(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+static uint32_t do_ld4_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
                            uintptr_t ra, MMUAccessType access_type)
 {
     MMULookupLocals l;
@@ -2410,7 +2410,7 @@ tcg_target_ulong helper_ldul_mmu(CPUArchState *env, uint64_t addr,
     return do_ld4_mmu(env, addr, oi, retaddr, MMU_DATA_LOAD);
 }
 
-static uint64_t do_ld8_mmu(CPUArchState *env, target_ulong addr, MemOpIdx oi,
+static uint64_t do_ld8_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
                            uintptr_t ra, MMUAccessType access_type)
 {
     MMULookupLocals l;
@@ -2460,7 +2460,7 @@ tcg_target_ulong helper_ldsl_mmu(CPUArchState *env, uint64_t addr,
     return (int32_t)helper_ldul_mmu(env, addr, oi, retaddr);
 }
 
-static Int128 do_ld16_mmu(CPUArchState *env, target_ulong addr,
+static Int128 do_ld16_mmu(CPUArchState *env, vaddr addr,
                           MemOpIdx oi, uintptr_t ra)
 {
     MMULookupLocals l;
@@ -2617,7 +2617,7 @@ static uint64_t do_st_mmio_leN(CPUArchState *env, MMULookupPageData *p,
                                uint64_t val_le, int mmu_idx, uintptr_t ra)
 {
     CPUTLBEntryFull *full = p->full;
-    target_ulong addr = p->addr;
+    vaddr addr = p->addr;
     int i, size = p->size;
 
     QEMU_IOTHREAD_LOCK_GUARD();
@@ -2808,7 +2808,7 @@ void helper_stb_mmu(CPUArchState *env, uint64_t addr, uint32_t val,
     do_st_1(env, &l.page[0], val, l.mmu_idx, ra);
 }
 
-static void do_st2_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
+static void do_st2_mmu(CPUArchState *env, vaddr addr, uint16_t val,
                        MemOpIdx oi, uintptr_t ra)
 {
     MMULookupLocals l;
@@ -2837,7 +2837,7 @@ void helper_stw_mmu(CPUArchState *env, uint64_t addr, uint32_t val,
     do_st2_mmu(env, addr, val, oi, retaddr);
 }
 
-static void do_st4_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
+static void do_st4_mmu(CPUArchState *env, vaddr addr, uint32_t val,
                        MemOpIdx oi, uintptr_t ra)
 {
     MMULookupLocals l;
@@ -2864,7 +2864,7 @@ void helper_stl_mmu(CPUArchState *env, uint64_t addr, uint32_t val,
     do_st4_mmu(env, addr, val, oi, retaddr);
 }
 
-static void do_st8_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
+static void do_st8_mmu(CPUArchState *env, vaddr addr, uint64_t val,
                        MemOpIdx oi, uintptr_t ra)
 {
     MMULookupLocals l;
@@ -2891,7 +2891,7 @@ void helper_stq_mmu(CPUArchState *env, uint64_t addr, uint64_t val,
     do_st8_mmu(env, addr, val, oi, retaddr);
 }
 
-static void do_st16_mmu(CPUArchState *env, target_ulong addr, Int128 val,
+static void do_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
                         MemOpIdx oi, uintptr_t ra)
 {
     MMULookupLocals l;

From f0a08b0913befbd400c16fb444612b6d034a2c53 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:27 +0200
Subject: [PATCH 0189/1353] accel/tcg/cpu-exec.c: Widen pc to vaddr

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-7-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 4d952a6cc2..ba1890a373 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -169,8 +169,8 @@ uint32_t curr_cflags(CPUState *cpu)
 }
 
 struct tb_desc {
-    target_ulong pc;
-    target_ulong cs_base;
+    vaddr pc;
+    uint64_t cs_base;
     CPUArchState *env;
     tb_page_addr_t page_addr0;
     uint32_t flags;
@@ -193,7 +193,7 @@ static bool tb_lookup_cmp(const void *p, const void *d)
             return true;
         } else {
             tb_page_addr_t phys_page1;
-            target_ulong virt_page1;
+            vaddr virt_page1;
 
             /*
              * We know that the first page matched, and an otherwise valid TB
@@ -214,8 +214,8 @@ static bool tb_lookup_cmp(const void *p, const void *d)
     return false;
 }
 
-static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                          target_ulong cs_base, uint32_t flags,
+static TranslationBlock *tb_htable_lookup(CPUState *cpu, vaddr pc,
+                                          uint64_t cs_base, uint32_t flags,
                                           uint32_t cflags)
 {
     tb_page_addr_t phys_pc;
@@ -238,9 +238,9 @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
 }
 
 /* Might cause an exception, so have a longjmp destination ready */
-static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
-                                          target_ulong cs_base,
-                                          uint32_t flags, uint32_t cflags)
+static inline TranslationBlock *tb_lookup(CPUState *cpu, vaddr pc,
+                                          uint64_t cs_base, uint32_t flags,
+                                          uint32_t cflags)
 {
     TranslationBlock *tb;
     CPUJumpCache *jc;
@@ -292,13 +292,13 @@ static inline TranslationBlock *tb_lookup(CPUState *cpu, target_ulong pc,
     return tb;
 }
 
-static void log_cpu_exec(target_ulong pc, CPUState *cpu,
+static void log_cpu_exec(vaddr pc, CPUState *cpu,
                          const TranslationBlock *tb)
 {
     if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [%08" PRIx64
-                      "/" TARGET_FMT_lx "/%08x/%08x] %s\n",
+                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
                       tb->flags, tb->cflags, lookup_symbol(pc));
 
@@ -323,7 +323,7 @@ static void log_cpu_exec(target_ulong pc, CPUState *cpu,
     }
 }
 
-static bool check_for_breakpoints_slow(CPUState *cpu, target_ulong pc,
+static bool check_for_breakpoints_slow(CPUState *cpu, vaddr pc,
                                        uint32_t *cflags)
 {
     CPUBreakpoint *bp;
@@ -389,7 +389,7 @@ static bool check_for_breakpoints_slow(CPUState *cpu, target_ulong pc,
     return false;
 }
 
-static inline bool check_for_breakpoints(CPUState *cpu, target_ulong pc,
+static inline bool check_for_breakpoints(CPUState *cpu, vaddr pc,
                                          uint32_t *cflags)
 {
     return unlikely(!QTAILQ_EMPTY(&cpu->breakpoints)) &&
@@ -485,10 +485,10 @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
             cc->set_pc(cpu, last_tb->pc);
         }
         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
-            target_ulong pc = log_pc(cpu, last_tb);
+            vaddr pc = log_pc(cpu, last_tb);
             if (qemu_log_in_addr_range(pc)) {
-                qemu_log("Stopped execution of TB chain before %p ["
-                         TARGET_FMT_lx "] %s\n",
+                qemu_log("Stopped execution of TB chain before %p [%"
+                         VADDR_PRIx "] %s\n",
                          last_tb->tc.ptr, pc, lookup_symbol(pc));
             }
         }
@@ -882,8 +882,8 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
 }
 
 static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
-                                    target_ulong pc,
-                                    TranslationBlock **last_tb, int *tb_exit)
+                                    vaddr pc, TranslationBlock **last_tb,
+                                    int *tb_exit)
 {
     int32_t insns_left;
 

From 06f3831c08ac0d36ce3d0b1f2deaa8ec1e1d8d7e Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:28 +0200
Subject: [PATCH 0190/1353] accel/tcg: Widen pc to vaddr in CPUJumpCache

Related functions dealing with the jump cache are also updated.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-8-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c       |  2 +-
 accel/tcg/tb-hash.h      | 12 ++++++------
 accel/tcg/tb-jmp-cache.h |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index cc53d0fb64..bdf400f6e6 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -99,7 +99,7 @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
     desc->window_max_entries = max_entries;
 }
 
-static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
+static void tb_jmp_cache_clear_page(CPUState *cpu, vaddr page_addr)
 {
     CPUJumpCache *jc = cpu->tb_jmp_cache;
     int i, i0;
diff --git a/accel/tcg/tb-hash.h b/accel/tcg/tb-hash.h
index 2ba2193731..a0c61f25cd 100644
--- a/accel/tcg/tb-hash.h
+++ b/accel/tcg/tb-hash.h
@@ -35,16 +35,16 @@
 #define TB_JMP_ADDR_MASK (TB_JMP_PAGE_SIZE - 1)
 #define TB_JMP_PAGE_MASK (TB_JMP_CACHE_SIZE - TB_JMP_PAGE_SIZE)
 
-static inline unsigned int tb_jmp_cache_hash_page(target_ulong pc)
+static inline unsigned int tb_jmp_cache_hash_page(vaddr pc)
 {
-    target_ulong tmp;
+    vaddr tmp;
     tmp = pc ^ (pc >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS));
     return (tmp >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS)) & TB_JMP_PAGE_MASK;
 }
 
-static inline unsigned int tb_jmp_cache_hash_func(target_ulong pc)
+static inline unsigned int tb_jmp_cache_hash_func(vaddr pc)
 {
-    target_ulong tmp;
+    vaddr tmp;
     tmp = pc ^ (pc >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS));
     return (((tmp >> (TARGET_PAGE_BITS - TB_JMP_PAGE_BITS)) & TB_JMP_PAGE_MASK)
            | (tmp & TB_JMP_ADDR_MASK));
@@ -53,7 +53,7 @@ static inline unsigned int tb_jmp_cache_hash_func(target_ulong pc)
 #else
 
 /* In user-mode we can get better hashing because we do not have a TLB */
-static inline unsigned int tb_jmp_cache_hash_func(target_ulong pc)
+static inline unsigned int tb_jmp_cache_hash_func(vaddr pc)
 {
     return (pc ^ (pc >> TB_JMP_CACHE_BITS)) & (TB_JMP_CACHE_SIZE - 1);
 }
@@ -61,7 +61,7 @@ static inline unsigned int tb_jmp_cache_hash_func(target_ulong pc)
 #endif /* CONFIG_SOFTMMU */
 
 static inline
-uint32_t tb_hash_func(tb_page_addr_t phys_pc, target_ulong pc,
+uint32_t tb_hash_func(tb_page_addr_t phys_pc, vaddr pc,
                       uint32_t flags, uint64_t flags2, uint32_t cf_mask)
 {
     return qemu_xxhash8(phys_pc, pc, flags2, flags, cf_mask);
diff --git a/accel/tcg/tb-jmp-cache.h b/accel/tcg/tb-jmp-cache.h
index bee87eb840..bb424c8a05 100644
--- a/accel/tcg/tb-jmp-cache.h
+++ b/accel/tcg/tb-jmp-cache.h
@@ -21,7 +21,7 @@ struct CPUJumpCache {
     struct rcu_head rcu;
     struct {
         TranslationBlock *tb;
-        target_ulong pc;
+        vaddr pc;
     } array[TB_JMP_CACHE_SIZE];
 };
 

From 4f8f41272eec57105e82dbb5761354ef0da9f7b0 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:29 +0200
Subject: [PATCH 0191/1353] accel: Replace target_ulong with vaddr in probe_*()

Functions for probing memory accesses (and functions that call these)
are updated to take a vaddr for guest virtual addresses over
target_ulong.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-9-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/stubs/tcg-stub.c  |  4 ++--
 accel/tcg/cputlb.c      | 12 ++++++------
 accel/tcg/user-exec.c   |  8 ++++----
 include/exec/exec-all.h | 14 +++++++-------
 4 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index 0998e601ad..a9e7a2d5b4 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -26,14 +26,14 @@ void tcg_flush_jmp_cache(CPUState *cpu)
 {
 }
 
-int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
+int probe_access_flags(CPUArchState *env, vaddr addr, int size,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr)
 {
      g_assert_not_reached();
 }
 
-void *probe_access(CPUArchState *env, target_ulong addr, int size,
+void *probe_access(CPUArchState *env, vaddr addr, int size,
                    MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
      /* Handled by hardware accelerator. */
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index bdf400f6e6..d873e58a5d 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1499,7 +1499,7 @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
     }
 }
 
-static int probe_access_internal(CPUArchState *env, target_ulong addr,
+static int probe_access_internal(CPUArchState *env, vaddr addr,
                                  int fault_size, MMUAccessType access_type,
                                  int mmu_idx, bool nonfault,
                                  void **phost, CPUTLBEntryFull **pfull,
@@ -1508,7 +1508,7 @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     uint64_t tlb_addr = tlb_read_idx(entry, access_type);
-    target_ulong page_addr = addr & TARGET_PAGE_MASK;
+    vaddr page_addr = addr & TARGET_PAGE_MASK;
     int flags = TLB_FLAGS_MASK;
 
     if (!tlb_hit_page(tlb_addr, page_addr)) {
@@ -1551,7 +1551,7 @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     return flags;
 }
 
-int probe_access_full(CPUArchState *env, target_ulong addr, int size,
+int probe_access_full(CPUArchState *env, vaddr addr, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool nonfault, void **phost, CPUTLBEntryFull **pfull,
                       uintptr_t retaddr)
@@ -1568,7 +1568,7 @@ int probe_access_full(CPUArchState *env, target_ulong addr, int size,
     return flags;
 }
 
-int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
+int probe_access_flags(CPUArchState *env, vaddr addr, int size,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr)
 {
@@ -1589,7 +1589,7 @@ int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
     return flags;
 }
 
-void *probe_access(CPUArchState *env, target_ulong addr, int size,
+void *probe_access(CPUArchState *env, vaddr addr, int size,
                    MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
     CPUTLBEntryFull *full;
@@ -1648,7 +1648,7 @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
  * NOTE: This function will trigger an exception if the page is
  * not executable.
  */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
                                         void **hostp)
 {
     CPUTLBEntryFull *full;
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index dc8d6b5d40..d71e26a7b5 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -721,7 +721,7 @@ int page_unprotect(target_ulong address, uintptr_t pc)
     return current_tb_invalidated ? 2 : 1;
 }
 
-static int probe_access_internal(CPUArchState *env, target_ulong addr,
+static int probe_access_internal(CPUArchState *env, vaddr addr,
                                  int fault_size, MMUAccessType access_type,
                                  bool nonfault, uintptr_t ra)
 {
@@ -759,7 +759,7 @@ static int probe_access_internal(CPUArchState *env, target_ulong addr,
     cpu_loop_exit_sigsegv(env_cpu(env), addr, access_type, maperr, ra);
 }
 
-int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
+int probe_access_flags(CPUArchState *env, vaddr addr, int size,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t ra)
 {
@@ -771,7 +771,7 @@ int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
     return flags;
 }
 
-void *probe_access(CPUArchState *env, target_ulong addr, int size,
+void *probe_access(CPUArchState *env, vaddr addr, int size,
                    MMUAccessType access_type, int mmu_idx, uintptr_t ra)
 {
     int flags;
@@ -783,7 +783,7 @@ void *probe_access(CPUArchState *env, target_ulong addr, int size,
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
 
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
                                         void **hostp)
 {
     int flags;
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index f5508e242b..cc1c3556f6 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -413,16 +413,16 @@ static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
  * Finally, return the host address for a page that is backed by RAM,
  * or NULL if the page requires I/O.
  */
-void *probe_access(CPUArchState *env, target_ulong addr, int size,
+void *probe_access(CPUArchState *env, vaddr addr, int size,
                    MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);
 
-static inline void *probe_write(CPUArchState *env, target_ulong addr, int size,
+static inline void *probe_write(CPUArchState *env, vaddr addr, int size,
                                 int mmu_idx, uintptr_t retaddr)
 {
     return probe_access(env, addr, size, MMU_DATA_STORE, mmu_idx, retaddr);
 }
 
-static inline void *probe_read(CPUArchState *env, target_ulong addr, int size,
+static inline void *probe_read(CPUArchState *env, vaddr addr, int size,
                                int mmu_idx, uintptr_t retaddr)
 {
     return probe_access(env, addr, size, MMU_DATA_LOAD, mmu_idx, retaddr);
@@ -447,7 +447,7 @@ static inline void *probe_read(CPUArchState *env, target_ulong addr, int size,
  * Do handle clean pages, so exclude TLB_NOTDIRY from the returned flags.
  * For simplicity, all "mmio-like" flags are folded to TLB_MMIO.
  */
-int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
+int probe_access_flags(CPUArchState *env, vaddr addr, int size,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr);
 
@@ -460,7 +460,7 @@ int probe_access_flags(CPUArchState *env, target_ulong addr, int size,
  * and must be consumed or copied immediately, before any further
  * access or changes to TLB @mmu_idx.
  */
-int probe_access_full(CPUArchState *env, target_ulong addr, int size,
+int probe_access_full(CPUArchState *env, vaddr addr, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool nonfault, void **phost,
                       CPUTLBEntryFull **pfull, uintptr_t retaddr);
@@ -581,7 +581,7 @@ struct MemoryRegionSection *iotlb_to_section(CPUState *cpu,
  *
  * Note: this function can trigger an exception.
  */
-tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
+tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
                                         void **hostp);
 
 /**
@@ -596,7 +596,7 @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, target_ulong addr,
  * Note: this function can trigger an exception.
  */
 static inline tb_page_addr_t get_page_addr_code(CPUArchState *env,
-                                                target_ulong addr)
+                                                vaddr addr)
 {
     return get_page_addr_code_hostp(env, addr, NULL);
 }

From b0326eb99917d99a37c8cd9d479a2e9b04659076 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:30 +0200
Subject: [PATCH 0192/1353] accel/tcg: Replace target_ulong with vaddr in
 *_mmu_lookup()

Update atomic_mmu_lookup() and cpu_mmu_lookup() to take the guest
virtual address as a vaddr instead of a target_ulong.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-10-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 6 +++---
 accel/tcg/user-exec.c | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index d873e58a5d..e02cfc550e 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1898,15 +1898,15 @@ static bool mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
  * Probe for an atomic operation.  Do not allow unaligned operations,
  * or io operations to proceed.  Return the host address.
  */
-static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-                               MemOpIdx oi, int size, uintptr_t retaddr)
+static void *atomic_mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
+                               int size, uintptr_t retaddr)
 {
     uintptr_t mmu_idx = get_mmuidx(oi);
     MemOp mop = get_memop(oi);
     int a_bits = get_alignment_bits(mop);
     uintptr_t index;
     CPUTLBEntry *tlbe;
-    target_ulong tlb_addr;
+    vaddr tlb_addr;
     void *hostaddr;
     CPUTLBEntryFull *full;
 
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index d71e26a7b5..f8b16d6ab8 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -889,7 +889,7 @@ void page_reset_target_data(target_ulong start, target_ulong last) { }
 
 /* The softmmu versions of these helpers are in cputlb.c.  */
 
-static void *cpu_mmu_lookup(CPUArchState *env, abi_ptr addr,
+static void *cpu_mmu_lookup(CPUArchState *env, vaddr addr,
                             MemOp mop, uintptr_t ra, MMUAccessType type)
 {
     int a_bits = get_alignment_bits(mop);
@@ -1324,8 +1324,8 @@ uint64_t cpu_ldq_code_mmu(CPUArchState *env, abi_ptr addr,
 /*
  * Do not allow unaligned operations to proceed.  Return the host address.
  */
-static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-                               MemOpIdx oi, int size, uintptr_t retaddr)
+static void *atomic_mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
+                               int size, uintptr_t retaddr)
 {
     MemOp mop = get_memop(oi);
     int a_bits = get_alignment_bits(mop);

From b1c09220b4cef17632495bfbb9a1355ce3eb301c Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:31 +0200
Subject: [PATCH 0193/1353] accel/tcg: Replace target_ulong with vaddr in
 translator_*()

Use vaddr for guest virtual address in translator_use_goto_tb() and
translator_loop().

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-11-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translator.c    | 10 +++++-----
 include/exec/translator.h |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index 918a455e73..0fd9efceba 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -117,7 +117,7 @@ static void gen_tb_end(const TranslationBlock *tb, uint32_t cflags,
     }
 }
 
-bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
+bool translator_use_goto_tb(DisasContextBase *db, vaddr dest)
 {
     /* Suppress goto_tb if requested. */
     if (tb_cflags(db->tb) & CF_NO_GOTO_TB) {
@@ -129,8 +129,8 @@ bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest)
 }
 
 void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                     target_ulong pc, void *host_pc,
-                     const TranslatorOps *ops, DisasContextBase *db)
+                     vaddr pc, void *host_pc, const TranslatorOps *ops,
+                     DisasContextBase *db)
 {
     uint32_t cflags = tb_cflags(tb);
     TCGOp *icount_start_insn;
@@ -235,10 +235,10 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
 }
 
 static void *translator_access(CPUArchState *env, DisasContextBase *db,
-                               target_ulong pc, size_t len)
+                               vaddr pc, size_t len)
 {
     void *host;
-    target_ulong base, end;
+    vaddr base, end;
     TranslationBlock *tb;
 
     tb = db->tb;
diff --git a/include/exec/translator.h b/include/exec/translator.h
index 224ae14aa7..a53d3243d4 100644
--- a/include/exec/translator.h
+++ b/include/exec/translator.h
@@ -142,8 +142,8 @@ typedef struct TranslatorOps {
  * - When too many instructions have been translated.
  */
 void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
-                     target_ulong pc, void *host_pc,
-                     const TranslatorOps *ops, DisasContextBase *db);
+                     vaddr pc, void *host_pc, const TranslatorOps *ops,
+                     DisasContextBase *db);
 
 /**
  * translator_use_goto_tb
@@ -153,7 +153,7 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
  * Return true if goto_tb is allowed between the current TB
  * and the destination PC.
  */
-bool translator_use_goto_tb(DisasContextBase *db, target_ulong dest);
+bool translator_use_goto_tb(DisasContextBase *db, vaddr dest);
 
 /**
  * translator_io_start

From c814c892e5e7f55eb5184e4aaf3bfa918070fbb1 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 21 Jun 2023 15:56:33 +0200
Subject: [PATCH 0194/1353] cpu: Replace target_ulong with hwaddr in
 tb_invalidate_phys_addr()

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621135633.1649-13-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 cpu.c                   | 2 +-
 include/exec/exec-all.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cpu.c b/cpu.c
index 65ebaf8159..1c948d1161 100644
--- a/cpu.c
+++ b/cpu.c
@@ -293,7 +293,7 @@ void list_cpus(void)
 }
 
 #if defined(CONFIG_USER_ONLY)
-void tb_invalidate_phys_addr(target_ulong addr)
+void tb_invalidate_phys_addr(hwaddr addr)
 {
     mmap_lock();
     tb_invalidate_phys_page(addr);
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index cc1c3556f6..200c27eadf 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -526,7 +526,7 @@ uint32_t curr_cflags(CPUState *cpu);
 
 /* TranslationBlock invalidate API */
 #if defined(CONFIG_USER_ONLY)
-void tb_invalidate_phys_addr(target_ulong addr);
+void tb_invalidate_phys_addr(hwaddr addr);
 #else
 void tb_invalidate_phys_addr(AddressSpace *as, hwaddr addr, MemTxAttrs attrs);
 #endif

From 1d3daf95254d998b91445c48de875796df3b0998 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 23 May 2023 14:11:07 +0100
Subject: [PATCH 0195/1353] softfloat: use QEMU_FLATTEN to avoid mistaken isra
 inlining
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Balton discovered that asserts for the extract/deposit calls had a
significant impact on a lame benchmark on qemu-ppc. Replicating with:

  ./qemu-ppc64 ~/lsrc/tests/lame.git-svn/builds/ppc64/frontend/lame \
    -h pts-trondheim-3.wav pts-trondheim-3.mp3

showed up the pack/unpack routines not eliding the assert checks as it
should have done causing them to prominently figure in the profile:

  11.44%  qemu-ppc64  qemu-ppc64               [.] unpack_raw64.isra.0
  11.03%  qemu-ppc64  qemu-ppc64               [.] parts64_uncanon_normal
   8.26%  qemu-ppc64  qemu-ppc64               [.] helper_compute_fprf_float64
   6.75%  qemu-ppc64  qemu-ppc64               [.] do_float_check_status
   5.34%  qemu-ppc64  qemu-ppc64               [.] parts64_muladd
   4.75%  qemu-ppc64  qemu-ppc64               [.] pack_raw64.isra.0
   4.38%  qemu-ppc64  qemu-ppc64               [.] parts64_canonicalize
   3.62%  qemu-ppc64  qemu-ppc64               [.] float64r32_round_pack_canonical

After this patch the same test runs 31 seconds faster with a profile
where the generated code dominates more:

+   14.12%     0.00%  qemu-ppc64  [unknown]                [.] 0x0000004000619420
+   13.30%     0.00%  qemu-ppc64  [unknown]                [.] 0x0000004000616850
+   12.58%    12.19%  qemu-ppc64  qemu-ppc64               [.] parts64_uncanon_normal
+   10.62%     0.00%  qemu-ppc64  [unknown]                [.] 0x000000400061bf70
+    9.91%     9.73%  qemu-ppc64  qemu-ppc64               [.] helper_compute_fprf_float64
+    7.84%     7.82%  qemu-ppc64  qemu-ppc64               [.] do_float_check_status
+    6.47%     5.78%  qemu-ppc64  qemu-ppc64               [.] parts64_canonicalize.constprop.0
+    6.46%     0.00%  qemu-ppc64  [unknown]                [.] 0x0000004000620130
+    6.42%     0.00%  qemu-ppc64  [unknown]                [.] 0x0000004000619400
+    6.17%     6.04%  qemu-ppc64  qemu-ppc64               [.] parts64_muladd
+    5.85%     0.00%  qemu-ppc64  [unknown]                [.] 0x00000040006167e0
+    5.74%     0.00%  qemu-ppc64  [unknown]                [.] 0x0000b693fcffffd3
+    5.45%     4.78%  qemu-ppc64  qemu-ppc64               [.] float64r32_round_pack_canonical

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <ec9cfe5a-d5f2-466d-34dc-c35817e7e010@linaro.org>
[AJB: Patchified rth's suggestion]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Cc: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-Id: <20230523131107.3680641-1-alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 fpu/softfloat.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 108f9cb224..42e6c188b4 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -593,27 +593,27 @@ static void unpack_raw64(FloatParts64 *r, const FloatFmt *fmt, uint64_t raw)
     };
 }
 
-static inline void float16_unpack_raw(FloatParts64 *p, float16 f)
+static void QEMU_FLATTEN float16_unpack_raw(FloatParts64 *p, float16 f)
 {
     unpack_raw64(p, &float16_params, f);
 }
 
-static inline void bfloat16_unpack_raw(FloatParts64 *p, bfloat16 f)
+static void QEMU_FLATTEN bfloat16_unpack_raw(FloatParts64 *p, bfloat16 f)
 {
     unpack_raw64(p, &bfloat16_params, f);
 }
 
-static inline void float32_unpack_raw(FloatParts64 *p, float32 f)
+static void QEMU_FLATTEN float32_unpack_raw(FloatParts64 *p, float32 f)
 {
     unpack_raw64(p, &float32_params, f);
 }
 
-static inline void float64_unpack_raw(FloatParts64 *p, float64 f)
+static void QEMU_FLATTEN float64_unpack_raw(FloatParts64 *p, float64 f)
 {
     unpack_raw64(p, &float64_params, f);
 }
 
-static void floatx80_unpack_raw(FloatParts128 *p, floatx80 f)
+static void QEMU_FLATTEN floatx80_unpack_raw(FloatParts128 *p, floatx80 f)
 {
     *p = (FloatParts128) {
         .cls = float_class_unclassified,
@@ -623,7 +623,7 @@ static void floatx80_unpack_raw(FloatParts128 *p, floatx80 f)
     };
 }
 
-static void float128_unpack_raw(FloatParts128 *p, float128 f)
+static void QEMU_FLATTEN float128_unpack_raw(FloatParts128 *p, float128 f)
 {
     const int f_size = float128_params.frac_size - 64;
     const int e_size = float128_params.exp_size;
@@ -650,27 +650,27 @@ static uint64_t pack_raw64(const FloatParts64 *p, const FloatFmt *fmt)
     return ret;
 }
 
-static inline float16 float16_pack_raw(const FloatParts64 *p)
+static float16 QEMU_FLATTEN float16_pack_raw(const FloatParts64 *p)
 {
     return make_float16(pack_raw64(p, &float16_params));
 }
 
-static inline bfloat16 bfloat16_pack_raw(const FloatParts64 *p)
+static bfloat16 QEMU_FLATTEN bfloat16_pack_raw(const FloatParts64 *p)
 {
     return pack_raw64(p, &bfloat16_params);
 }
 
-static inline float32 float32_pack_raw(const FloatParts64 *p)
+static float32 QEMU_FLATTEN float32_pack_raw(const FloatParts64 *p)
 {
     return make_float32(pack_raw64(p, &float32_params));
 }
 
-static inline float64 float64_pack_raw(const FloatParts64 *p)
+static float64 QEMU_FLATTEN float64_pack_raw(const FloatParts64 *p)
 {
     return make_float64(pack_raw64(p, &float64_params));
 }
 
-static float128 float128_pack_raw(const FloatParts128 *p)
+static float128 QEMU_FLATTEN float128_pack_raw(const FloatParts128 *p)
 {
     const int f_size = float128_params.frac_size - 64;
     const int e_size = float128_params.exp_size;

From ea185a557bc97868f3729060ea1cd003dbd971d1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 10 Jun 2023 10:19:59 -0700
Subject: [PATCH 0196/1353] tests/plugin: Remove duplicate insn log from
 libinsn.so

This is a perfectly natural occurrence for x86 "rep movb",
where the "rep" prefix forms a counted loop of the one insn.

During the tests/tcg/multiarch/memory test, this logging is
triggered over 350000 times.  Within the context of cross-i386-tci
build, which is already slow by nature, the logging is sufficient
to push the test into timeout.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/plugin/insn.c                      | 9 +--------
 tests/tcg/i386/Makefile.softmmu-target   | 9 ---------
 tests/tcg/i386/Makefile.target           | 6 ------
 tests/tcg/x86_64/Makefile.softmmu-target | 9 ---------
 4 files changed, 1 insertion(+), 32 deletions(-)

diff --git a/tests/plugin/insn.c b/tests/plugin/insn.c
index cd5ea5d4ae..9bd6e44f73 100644
--- a/tests/plugin/insn.c
+++ b/tests/plugin/insn.c
@@ -19,7 +19,6 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
 #define MAX_CPUS 8 /* lets not go nuts */
 
 typedef struct {
-    uint64_t last_pc;
     uint64_t insn_count;
 } InstructionCount;
 
@@ -51,13 +50,7 @@ static void vcpu_insn_exec_before(unsigned int cpu_index, void *udata)
 {
     unsigned int i = cpu_index % MAX_CPUS;
     InstructionCount *c = &counts[i];
-    uint64_t this_pc = GPOINTER_TO_UINT(udata);
-    if (this_pc == c->last_pc) {
-        g_autofree gchar *out = g_strdup_printf("detected repeat execution @ 0x%"
-                                                PRIx64 "\n", this_pc);
-        qemu_plugin_outs(out);
-    }
-    c->last_pc = this_pc;
+
     c->insn_count++;
 }
 
diff --git a/tests/tcg/i386/Makefile.softmmu-target b/tests/tcg/i386/Makefile.softmmu-target
index ed922d59c8..5266f2335a 100644
--- a/tests/tcg/i386/Makefile.softmmu-target
+++ b/tests/tcg/i386/Makefile.softmmu-target
@@ -33,14 +33,5 @@ EXTRA_RUNS+=$(MULTIARCH_RUNS)
 
 memory: CFLAGS+=-DCHECK_UNALIGNED=1
 
-# non-inline runs will trigger the duplicate instruction heuristics in libinsn.so
-run-plugin-%-with-libinsn.so:
-	$(call run-test, $@, \
-	  $(QEMU) -monitor none -display none \
-		  -chardev file$(COMMA)path=$@.out$(COMMA)id=output \
-                  -plugin ../../plugin/libinsn.so$(COMMA)inline=on \
-	    	  -d plugin -D $*-with-libinsn.so.pout \
-		  $(QEMU_OPTS) $*)
-
 # Running
 QEMU_OPTS+=-device isa-debugcon,chardev=output -device isa-debug-exit,iobase=0xf4,iosize=0x4 -kernel
diff --git a/tests/tcg/i386/Makefile.target b/tests/tcg/i386/Makefile.target
index 821822ed0c..f2ee7a4db7 100644
--- a/tests/tcg/i386/Makefile.target
+++ b/tests/tcg/i386/Makefile.target
@@ -63,12 +63,6 @@ else
 SKIP_I386_TESTS+=test-i386-fprem
 endif
 
-# non-inline runs will trigger the duplicate instruction heuristics in libinsn.so
-run-plugin-%-with-libinsn.so:
-	$(call run-test, $@, $(QEMU) $(QEMU_OPTS) \
-	       -plugin ../../plugin/libinsn.so$(COMMA)inline=on \
-	       -d plugin -D $*-with-libinsn.so.pout $*)
-
 # Update TESTS
 I386_TESTS:=$(filter-out $(SKIP_I386_TESTS), $(ALL_X86_TESTS))
 TESTS=$(MULTIARCH_TESTS) $(I386_TESTS)
diff --git a/tests/tcg/x86_64/Makefile.softmmu-target b/tests/tcg/x86_64/Makefile.softmmu-target
index 7207fee94c..1bd763f2e6 100644
--- a/tests/tcg/x86_64/Makefile.softmmu-target
+++ b/tests/tcg/x86_64/Makefile.softmmu-target
@@ -33,14 +33,5 @@ EXTRA_RUNS+=$(MULTIARCH_RUNS)
 
 memory: CFLAGS+=-DCHECK_UNALIGNED=1
 
-# non-inline runs will trigger the duplicate instruction heuristics in libinsn.so
-run-plugin-%-with-libinsn.so:
-	$(call run-test, $@, \
-	  $(QEMU) -monitor none -display none \
-		  -chardev file$(COMMA)path=$@.out$(COMMA)id=output \
-                  -plugin ../../plugin/libinsn.so$(COMMA)inline=on \
-	    	  -d plugin -D $*-with-libinsn.so.pout \
-		  $(QEMU_OPTS) $*)
-
 # Running
 QEMU_OPTS+=-device isa-debugcon,chardev=output -device isa-debug-exit,iobase=0xf4,iosize=0x4 -kernel

From 1b65b4f54c7f7d07b5d35fac5f7de3e75f5f21a0 Mon Sep 17 00:00:00 2001
From: Fei Wu <fei2.wu@intel.com>
Date: Wed, 7 Jun 2023 20:24:02 +0800
Subject: [PATCH 0197/1353] accel/tcg: remove CONFIG_PROFILER
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TBStats will be introduced to replace CONFIG_PROFILER totally, here
remove all CONFIG_PROFILER related stuffs first.

Signed-off-by: Vanderson M. do Rosario <vandersonmr2@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Fei Wu <fei2.wu@intel.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230607122411.3394702-2-fei2.wu@intel.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/monitor.c           |  31 -----
 accel/tcg/tcg-accel-ops.c     |  10 --
 accel/tcg/translate-all.c     |  33 ------
 hmp-commands-info.hx          |  15 ---
 include/qemu/timer.h          |   9 --
 include/tcg/tcg.h             |  26 -----
 meson.build                   |   2 -
 meson_options.txt             |   2 -
 qapi/machine.json             |  18 ---
 scripts/meson-buildoptions.sh |   3 -
 softmmu/runstate.c            |   9 --
 tcg/tcg.c                     | 214 ----------------------------------
 tests/qtest/qmp-cmd-test.c    |   3 -
 13 files changed, 375 deletions(-)

diff --git a/accel/tcg/monitor.c b/accel/tcg/monitor.c
index f171bc6f5e..d48de23999 100644
--- a/accel/tcg/monitor.c
+++ b/accel/tcg/monitor.c
@@ -81,37 +81,6 @@ HumanReadableText *qmp_x_query_opcount(Error **errp)
     return human_readable_text_from_str(buf);
 }
 
-#ifdef CONFIG_PROFILER
-
-int64_t dev_time;
-
-HumanReadableText *qmp_x_query_profile(Error **errp)
-{
-    g_autoptr(GString) buf = g_string_new("");
-    static int64_t last_cpu_exec_time;
-    int64_t cpu_exec_time;
-    int64_t delta;
-
-    cpu_exec_time = tcg_cpu_exec_time();
-    delta = cpu_exec_time - last_cpu_exec_time;
-
-    g_string_append_printf(buf, "async time  %" PRId64 " (%0.3f)\n",
-                           dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
-    g_string_append_printf(buf, "qemu time   %" PRId64 " (%0.3f)\n",
-                           delta, delta / (double)NANOSECONDS_PER_SECOND);
-    last_cpu_exec_time = cpu_exec_time;
-    dev_time = 0;
-
-    return human_readable_text_from_str(buf);
-}
-#else
-HumanReadableText *qmp_x_query_profile(Error **errp)
-{
-    error_setg(errp, "Internal profiler not compiled");
-    return NULL;
-}
-#endif
-
 static void hmp_tcg_register(void)
 {
     monitor_register_hmp_info_hrt("jit", qmp_x_query_jit);
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 58c8e64096..3973591508 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -70,20 +70,10 @@ void tcg_cpus_destroy(CPUState *cpu)
 int tcg_cpus_exec(CPUState *cpu)
 {
     int ret;
-#ifdef CONFIG_PROFILER
-    int64_t ti;
-#endif
     assert(tcg_enabled());
-#ifdef CONFIG_PROFILER
-    ti = profile_getclock();
-#endif
     cpu_exec_start(cpu);
     ret = cpu_exec(cpu);
     cpu_exec_end(cpu);
-#ifdef CONFIG_PROFILER
-    qatomic_set(&tcg_ctx->prof.cpu_exec_time,
-                tcg_ctx->prof.cpu_exec_time + profile_getclock() - ti);
-#endif
     return ret;
 }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 03c49baf1c..d3d4fbc1a4 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -202,10 +202,6 @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                uintptr_t host_pc)
 {
     uint64_t data[TARGET_INSN_START_WORDS];
-#ifdef CONFIG_PROFILER
-    TCGProfile *prof = &tcg_ctx->prof;
-    int64_t ti = profile_getclock();
-#endif
     int insns_left = cpu_unwind_data_from_tb(tb, host_pc, data);
 
     if (insns_left < 0) {
@@ -222,12 +218,6 @@ void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
     }
 
     cpu->cc->tcg_ops->restore_state_to_opc(cpu, tb, data);
-
-#ifdef CONFIG_PROFILER
-    qatomic_set(&prof->restore_time,
-                prof->restore_time + profile_getclock() - ti);
-    qatomic_set(&prof->restore_count, prof->restore_count + 1);
-#endif
 }
 
 bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
@@ -290,13 +280,6 @@ static int setjmp_gen_code(CPUArchState *env, TranslationBlock *tb,
     tcg_ctx->cpu = NULL;
     *max_insns = tb->icount;
 
-#ifdef CONFIG_PROFILER
-    qatomic_set(&tcg_ctx->prof.tb_count, tcg_ctx->prof.tb_count + 1);
-    qatomic_set(&tcg_ctx->prof.interm_time,
-                tcg_ctx->prof.interm_time + profile_getclock() - *ti);
-    *ti = profile_getclock();
-#endif
-
     return tcg_gen_code(tcg_ctx, tb, pc);
 }
 
@@ -310,9 +293,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb_page_addr_t phys_pc;
     tcg_insn_unit *gen_code_buf;
     int gen_code_size, search_size, max_insns;
-#ifdef CONFIG_PROFILER
-    TCGProfile *prof = &tcg_ctx->prof;
-#endif
     int64_t ti;
     void *host_pc;
 
@@ -371,12 +351,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 
  tb_overflow:
 
-#ifdef CONFIG_PROFILER
-    /* includes aborted translations because of exceptions */
-    qatomic_set(&prof->tb_count1, prof->tb_count1 + 1);
-    ti = profile_getclock();
-#endif
-
     trace_translate_block(tb, pc, tb->tc.ptr);
 
     gen_code_size = setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
@@ -431,13 +405,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      */
     perf_report_code(pc, tb, tcg_splitwx_to_rx(gen_code_buf));
 
-#ifdef CONFIG_PROFILER
-    qatomic_set(&prof->code_time, prof->code_time + profile_getclock() - ti);
-    qatomic_set(&prof->code_in_len, prof->code_in_len + tb->size);
-    qatomic_set(&prof->code_out_len, prof->code_out_len + gen_code_size);
-    qatomic_set(&prof->search_out_len, prof->search_out_len + search_size);
-#endif
-
     if (qemu_loglevel_mask(CPU_LOG_TB_OUT_ASM) &&
         qemu_log_in_addr_range(pc)) {
         FILE *logfile = qemu_log_trylock();
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 47d63d26db..f5b37eb74a 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -360,21 +360,6 @@ SRST
     Show host USB devices.
 ERST
 
-#if defined(CONFIG_TCG)
-    {
-        .name       = "profile",
-        .args_type  = "",
-        .params     = "",
-        .help       = "show profiling information",
-        .cmd_info_hrt = qmp_x_query_profile,
-    },
-#endif
-
-SRST
-  ``info profile``
-    Show profiling information.
-ERST
-
     {
         .name       = "capture",
         .args_type  = "",
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index ee071e07d1..9a91cb1248 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -989,13 +989,4 @@ static inline int64_t cpu_get_host_ticks(void)
 }
 #endif
 
-#ifdef CONFIG_PROFILER
-static inline int64_t profile_getclock(void)
-{
-    return get_clock();
-}
-
-extern int64_t dev_time;
-#endif
-
 #endif
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index a498f31967..95541e9474 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -478,27 +478,6 @@ static inline TCGRegSet output_pref(const TCGOp *op, unsigned i)
     return i < ARRAY_SIZE(op->output_pref) ? op->output_pref[i] : 0;
 }
 
-typedef struct TCGProfile {
-    int64_t cpu_exec_time;
-    int64_t tb_count1;
-    int64_t tb_count;
-    int64_t op_count; /* total insn count */
-    int op_count_max; /* max insn per TB */
-    int temp_count_max;
-    int64_t temp_count;
-    int64_t del_op_count;
-    int64_t code_in_len;
-    int64_t code_out_len;
-    int64_t search_out_len;
-    int64_t interm_time;
-    int64_t code_time;
-    int64_t la_time;
-    int64_t opt_time;
-    int64_t restore_count;
-    int64_t restore_time;
-    int64_t table_op_count[NB_OPS];
-} TCGProfile;
-
 struct TCGContext {
     uint8_t *pool_cur, *pool_end;
     TCGPool *pool_first, *pool_current, *pool_first_large;
@@ -528,10 +507,6 @@ struct TCGContext {
     tcg_insn_unit *code_buf;      /* pointer for start of tb */
     tcg_insn_unit *code_ptr;      /* pointer for running end of tb */
 
-#ifdef CONFIG_PROFILER
-    TCGProfile prof;
-#endif
-
 #ifdef CONFIG_DEBUG_TCG
     int goto_tb_issue_mask;
     const TCGOpcode *vecop_list;
@@ -871,7 +846,6 @@ static inline TCGv_ptr tcg_temp_new_ptr(void)
     return temp_tcgv_ptr(t);
 }
 
-int64_t tcg_cpu_exec_time(void);
 void tcg_dump_info(GString *buf);
 void tcg_dump_op_count(GString *buf);
 
diff --git a/meson.build b/meson.build
index 3e3d38badb..b409788832 100644
--- a/meson.build
+++ b/meson.build
@@ -2121,7 +2121,6 @@ if numa.found()
                                        dependencies: numa))
 endif
 config_host_data.set('CONFIG_OPENGL', opengl.found())
-config_host_data.set('CONFIG_PROFILER', get_option('profiler'))
 config_host_data.set('CONFIG_RBD', rbd.found())
 config_host_data.set('CONFIG_RDMA', rdma.found())
 config_host_data.set('CONFIG_SAFESTACK', get_option('safe_stack'))
@@ -4087,7 +4086,6 @@ if 'objc' in all_languages
   summary_info += {'QEMU_OBJCFLAGS':    ' '.join(qemu_common_flags)}
 endif
 summary_info += {'QEMU_LDFLAGS':      ' '.join(qemu_ldflags)}
-summary_info += {'profiler':          get_option('profiler')}
 summary_info += {'link-time optimization (LTO)': get_option('b_lto')}
 summary_info += {'PIE':               get_option('b_pie')}
 summary_info += {'static build':      get_option('prefer_static')}
diff --git a/meson_options.txt b/meson_options.txt
index 90237389e2..bbb5c7e886 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -345,8 +345,6 @@ option('qom_cast_debug', type: 'boolean', value: true,
 option('gprof', type: 'boolean', value: false,
        description: 'QEMU profiling with gprof',
        deprecated: true)
-option('profiler', type: 'boolean', value: false,
-       description: 'profiler support')
 option('slirp_smbd', type : 'feature', value : 'auto',
        description: 'use smbd (at path --smbd=*) in slirp networking')
 
diff --git a/qapi/machine.json b/qapi/machine.json
index 37660d8f2a..a08b6576ca 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1575,24 +1575,6 @@
   'if': 'CONFIG_TCG',
   'features': [ 'unstable' ] }
 
-##
-# @x-query-profile:
-#
-# Query TCG profiling information
-#
-# Features:
-#
-# @unstable: This command is meant for debugging.
-#
-# Returns: profile information
-#
-# Since: 6.2
-##
-{ 'command': 'x-query-profile',
-  'returns': 'HumanReadableText',
-  'if': 'CONFIG_TCG',
-  'features': [ 'unstable' ] }
-
 ##
 # @x-query-ramblock:
 #
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 5714fd93d9..7dd5709ef4 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -39,7 +39,6 @@ meson_options_help() {
   printf "%s\n" '                           jemalloc/system/tcmalloc)'
   printf "%s\n" '  --enable-module-upgrades try to load modules from alternate paths for'
   printf "%s\n" '                           upgrades'
-  printf "%s\n" '  --enable-profiler        profiler support'
   printf "%s\n" '  --enable-rng-none        dummy RNG, avoid using /dev/(u)random and'
   printf "%s\n" '                           getrandom()'
   printf "%s\n" '  --enable-safe-stack      SafeStack Stack Smash Protection (requires'
@@ -401,8 +400,6 @@ _meson_option_parse() {
     --with-pkgversion=*) quote_sh "-Dpkgversion=$2" ;;
     --enable-png) printf "%s" -Dpng=enabled ;;
     --disable-png) printf "%s" -Dpng=disabled ;;
-    --enable-profiler) printf "%s" -Dprofiler=true ;;
-    --disable-profiler) printf "%s" -Dprofiler=false ;;
     --enable-pvrdma) printf "%s" -Dpvrdma=enabled ;;
     --disable-pvrdma) printf "%s" -Dpvrdma=disabled ;;
     --enable-qcow1) printf "%s" -Dqcow1=enabled ;;
diff --git a/softmmu/runstate.c b/softmmu/runstate.c
index 1957caf73f..a9fbcf4862 100644
--- a/softmmu/runstate.c
+++ b/softmmu/runstate.c
@@ -727,18 +727,9 @@ static bool main_loop_should_exit(int *status)
 int qemu_main_loop(void)
 {
     int status = EXIT_SUCCESS;
-#ifdef CONFIG_PROFILER
-    int64_t ti;
-#endif
 
     while (!main_loop_should_exit(&status)) {
-#ifdef CONFIG_PROFILER
-        ti = profile_getclock();
-#endif
         main_loop_wait(false);
-#ifdef CONFIG_PROFILER
-        dev_time += profile_getclock() - ti;
-#endif
     }
 
     return status;
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 3fcd0d9f32..a0628fe424 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3033,10 +3033,6 @@ void tcg_op_remove(TCGContext *s, TCGOp *op)
     QTAILQ_REMOVE(&s->ops, op, link);
     QTAILQ_INSERT_TAIL(&s->free_ops, op, link);
     s->nb_ops--;
-
-#ifdef CONFIG_PROFILER
-    qatomic_set(&s->prof.del_op_count, s->prof.del_op_count + 1);
-#endif
 }
 
 void tcg_remove_ops_after(TCGOp *op)
@@ -5906,143 +5902,16 @@ static void tcg_out_st_helper_args(TCGContext *s, const TCGLabelQemuLdst *ldst,
     tcg_out_helper_load_common_args(s, ldst, parm, info, next_arg);
 }
 
-#ifdef CONFIG_PROFILER
-
-/* avoid copy/paste errors */
-#define PROF_ADD(to, from, field)                       \
-    do {                                                \
-        (to)->field += qatomic_read(&((from)->field));  \
-    } while (0)
-
-#define PROF_MAX(to, from, field)                                       \
-    do {                                                                \
-        typeof((from)->field) val__ = qatomic_read(&((from)->field));   \
-        if (val__ > (to)->field) {                                      \
-            (to)->field = val__;                                        \
-        }                                                               \
-    } while (0)
-
-/* Pass in a zero'ed @prof */
-static inline
-void tcg_profile_snapshot(TCGProfile *prof, bool counters, bool table)
-{
-    unsigned int n_ctxs = qatomic_read(&tcg_cur_ctxs);
-    unsigned int i;
-
-    for (i = 0; i < n_ctxs; i++) {
-        TCGContext *s = qatomic_read(&tcg_ctxs[i]);
-        const TCGProfile *orig = &s->prof;
-
-        if (counters) {
-            PROF_ADD(prof, orig, cpu_exec_time);
-            PROF_ADD(prof, orig, tb_count1);
-            PROF_ADD(prof, orig, tb_count);
-            PROF_ADD(prof, orig, op_count);
-            PROF_MAX(prof, orig, op_count_max);
-            PROF_ADD(prof, orig, temp_count);
-            PROF_MAX(prof, orig, temp_count_max);
-            PROF_ADD(prof, orig, del_op_count);
-            PROF_ADD(prof, orig, code_in_len);
-            PROF_ADD(prof, orig, code_out_len);
-            PROF_ADD(prof, orig, search_out_len);
-            PROF_ADD(prof, orig, interm_time);
-            PROF_ADD(prof, orig, code_time);
-            PROF_ADD(prof, orig, la_time);
-            PROF_ADD(prof, orig, opt_time);
-            PROF_ADD(prof, orig, restore_count);
-            PROF_ADD(prof, orig, restore_time);
-        }
-        if (table) {
-            int i;
-
-            for (i = 0; i < NB_OPS; i++) {
-                PROF_ADD(prof, orig, table_op_count[i]);
-            }
-        }
-    }
-}
-
-#undef PROF_ADD
-#undef PROF_MAX
-
-static void tcg_profile_snapshot_counters(TCGProfile *prof)
-{
-    tcg_profile_snapshot(prof, true, false);
-}
-
-static void tcg_profile_snapshot_table(TCGProfile *prof)
-{
-    tcg_profile_snapshot(prof, false, true);
-}
-
-void tcg_dump_op_count(GString *buf)
-{
-    TCGProfile prof = {};
-    int i;
-
-    tcg_profile_snapshot_table(&prof);
-    for (i = 0; i < NB_OPS; i++) {
-        g_string_append_printf(buf, "%s %" PRId64 "\n", tcg_op_defs[i].name,
-                               prof.table_op_count[i]);
-    }
-}
-
-int64_t tcg_cpu_exec_time(void)
-{
-    unsigned int n_ctxs = qatomic_read(&tcg_cur_ctxs);
-    unsigned int i;
-    int64_t ret = 0;
-
-    for (i = 0; i < n_ctxs; i++) {
-        const TCGContext *s = qatomic_read(&tcg_ctxs[i]);
-        const TCGProfile *prof = &s->prof;
-
-        ret += qatomic_read(&prof->cpu_exec_time);
-    }
-    return ret;
-}
-#else
 void tcg_dump_op_count(GString *buf)
 {
     g_string_append_printf(buf, "[TCG profiler not compiled]\n");
 }
 
-int64_t tcg_cpu_exec_time(void)
-{
-    error_report("%s: TCG profiler not compiled", __func__);
-    exit(EXIT_FAILURE);
-}
-#endif
-
-
 int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
 {
-#ifdef CONFIG_PROFILER
-    TCGProfile *prof = &s->prof;
-#endif
     int i, start_words, num_insns;
     TCGOp *op;
 
-#ifdef CONFIG_PROFILER
-    {
-        int n = 0;
-
-        QTAILQ_FOREACH(op, &s->ops, link) {
-            n++;
-        }
-        qatomic_set(&prof->op_count, prof->op_count + n);
-        if (n > prof->op_count_max) {
-            qatomic_set(&prof->op_count_max, n);
-        }
-
-        n = s->nb_temps;
-        qatomic_set(&prof->temp_count, prof->temp_count + n);
-        if (n > prof->temp_count_max) {
-            qatomic_set(&prof->temp_count_max, n);
-        }
-    }
-#endif
-
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP)
                  && qemu_log_in_addr_range(pc_start))) {
         FILE *logfile = qemu_log_trylock();
@@ -6071,17 +5940,8 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     }
 #endif
 
-#ifdef CONFIG_PROFILER
-    qatomic_set(&prof->opt_time, prof->opt_time - profile_getclock());
-#endif
-
     tcg_optimize(s);
 
-#ifdef CONFIG_PROFILER
-    qatomic_set(&prof->opt_time, prof->opt_time + profile_getclock());
-    qatomic_set(&prof->la_time, prof->la_time - profile_getclock());
-#endif
-
     reachable_code_pass(s);
     liveness_pass_0(s);
     liveness_pass_1(s);
@@ -6105,10 +5965,6 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
         }
     }
 
-#ifdef CONFIG_PROFILER
-    qatomic_set(&prof->la_time, prof->la_time + profile_getclock());
-#endif
-
     if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP_OPT)
                  && qemu_log_in_addr_range(pc_start))) {
         FILE *logfile = qemu_log_trylock();
@@ -6151,10 +6007,6 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     QTAILQ_FOREACH(op, &s->ops, link) {
         TCGOpcode opc = op->opc;
 
-#ifdef CONFIG_PROFILER
-        qatomic_set(&prof->table_op_count[opc], prof->table_op_count[opc] + 1);
-#endif
-
         switch (opc) {
         case INDEX_op_mov_i32:
         case INDEX_op_mov_i64:
@@ -6249,76 +6101,10 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb, uint64_t pc_start)
     return tcg_current_code_size(s);
 }
 
-#ifdef CONFIG_PROFILER
-void tcg_dump_info(GString *buf)
-{
-    TCGProfile prof = {};
-    const TCGProfile *s;
-    int64_t tb_count;
-    int64_t tb_div_count;
-    int64_t tot;
-
-    tcg_profile_snapshot_counters(&prof);
-    s = &prof;
-    tb_count = s->tb_count;
-    tb_div_count = tb_count ? tb_count : 1;
-    tot = s->interm_time + s->code_time;
-
-    g_string_append_printf(buf, "JIT cycles          %" PRId64
-                           " (%0.3f s at 2.4 GHz)\n",
-                           tot, tot / 2.4e9);
-    g_string_append_printf(buf, "translated TBs      %" PRId64
-                           " (aborted=%" PRId64 " %0.1f%%)\n",
-                           tb_count, s->tb_count1 - tb_count,
-                           (double)(s->tb_count1 - s->tb_count)
-                           / (s->tb_count1 ? s->tb_count1 : 1) * 100.0);
-    g_string_append_printf(buf, "avg ops/TB          %0.1f max=%d\n",
-                           (double)s->op_count / tb_div_count, s->op_count_max);
-    g_string_append_printf(buf, "deleted ops/TB      %0.2f\n",
-                           (double)s->del_op_count / tb_div_count);
-    g_string_append_printf(buf, "avg temps/TB        %0.2f max=%d\n",
-                           (double)s->temp_count / tb_div_count,
-                           s->temp_count_max);
-    g_string_append_printf(buf, "avg host code/TB    %0.1f\n",
-                           (double)s->code_out_len / tb_div_count);
-    g_string_append_printf(buf, "avg search data/TB  %0.1f\n",
-                           (double)s->search_out_len / tb_div_count);
-
-    g_string_append_printf(buf, "cycles/op           %0.1f\n",
-                           s->op_count ? (double)tot / s->op_count : 0);
-    g_string_append_printf(buf, "cycles/in byte      %0.1f\n",
-                           s->code_in_len ? (double)tot / s->code_in_len : 0);
-    g_string_append_printf(buf, "cycles/out byte     %0.1f\n",
-                           s->code_out_len ? (double)tot / s->code_out_len : 0);
-    g_string_append_printf(buf, "cycles/search byte     %0.1f\n",
-                           s->search_out_len ?
-                           (double)tot / s->search_out_len : 0);
-    if (tot == 0) {
-        tot = 1;
-    }
-    g_string_append_printf(buf, "  gen_interm time   %0.1f%%\n",
-                           (double)s->interm_time / tot * 100.0);
-    g_string_append_printf(buf, "  gen_code time     %0.1f%%\n",
-                           (double)s->code_time / tot * 100.0);
-    g_string_append_printf(buf, "optim./code time    %0.1f%%\n",
-                           (double)s->opt_time / (s->code_time ?
-                                                  s->code_time : 1)
-                           * 100.0);
-    g_string_append_printf(buf, "liveness/code time  %0.1f%%\n",
-                           (double)s->la_time / (s->code_time ?
-                                                 s->code_time : 1) * 100.0);
-    g_string_append_printf(buf, "cpu_restore count   %" PRId64 "\n",
-                           s->restore_count);
-    g_string_append_printf(buf, "  avg cycles        %0.1f\n",
-                           s->restore_count ?
-                           (double)s->restore_time / s->restore_count : 0);
-}
-#else
 void tcg_dump_info(GString *buf)
 {
     g_string_append_printf(buf, "[TCG profiler not compiled]\n");
 }
-#endif
 
 #ifdef ELF_HOST_MACHINE
 /* In order to use this feature, the backend needs to do three things:
diff --git a/tests/qtest/qmp-cmd-test.c b/tests/qtest/qmp-cmd-test.c
index a58de48d2a..73a670e8fa 100644
--- a/tests/qtest/qmp-cmd-test.c
+++ b/tests/qtest/qmp-cmd-test.c
@@ -46,9 +46,6 @@ static int query_error_class(const char *cmd)
         { "query-balloon", ERROR_CLASS_DEVICE_NOT_ACTIVE },
         { "query-hotpluggable-cpus", ERROR_CLASS_GENERIC_ERROR },
         { "query-vm-generation-id", ERROR_CLASS_GENERIC_ERROR },
-#ifndef CONFIG_PROFILER
-        { "x-query-profile", ERROR_CLASS_GENERIC_ERROR },
-#endif
         /* Only valid with a USB bus added */
         { "x-query-usb", ERROR_CLASS_GENERIC_ERROR },
         /* Only valid with accel=tcg */

From 70bfde9a7de7fa3495d9e2bd7142cb1bc656484e Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Fri, 23 Jun 2023 00:16:24 +0800
Subject: [PATCH 0198/1353] tcg: Fix temporary variable in tcg_gen_gvec_andcs

The 5th parameter of tcg_gen_gvec_2s should be replaced by the
temporary tmp variable in the tcg_gen_gvec_andcs function.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-Id: <20230622161646.32005-9-max.chou@sifive.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-gvec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index 95a588d6d2..a062239804 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -2774,7 +2774,7 @@ void tcg_gen_gvec_andcs(unsigned vece, uint32_t dofs, uint32_t aofs,
 
     TCGv_i64 tmp = tcg_temp_ebb_new_i64();
     tcg_gen_dup_i64(vece, tmp, c);
-    tcg_gen_gvec_2s(dofs, aofs, oprsz, maxsz, c, &g);
+    tcg_gen_gvec_2s(dofs, aofs, oprsz, maxsz, tmp, &g);
     tcg_temp_free_i64(tmp);
 }
 

From f6ff4923b92ceefbe5650c3e90ccdcc57dc60fb7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 19 Jun 2023 11:08:41 +0200
Subject: [PATCH 0199/1353] target/microblaze: Define TCG_GUEST_DEFAULT_MO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The microblaze architecture does not reorder instructions.
While there is an MBAR wait-for-data-access instruction,
this concerns synchronizing with DMA.

This should have been defined when enabling MTTCG.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Fixes: d449561b130 ("configure: microblaze: Enable mttcg")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 3525de144c..a7b040abd4 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -24,6 +24,9 @@
 #include "exec/cpu-defs.h"
 #include "qemu/cpu-float.h"
 
+/* MicroBlaze is always in-order. */
+#define TCG_GUEST_DEFAULT_MO  TCG_MO_ALL
+
 typedef struct CPUArchState CPUMBState;
 #if !defined(CONFIG_USER_ONLY)
 #include "mmu.h"

From c914d46d0a645e7c633292146f4e38c945d4f847 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 18 Feb 2021 16:47:35 +0000
Subject: [PATCH 0200/1353] tcg: Do not elide memory barriers for !CF_PARALLEL
 in system mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The virtio devices require proper memory ordering between
the vcpus and the iothreads.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index c07de5d9f8..7aadb37756 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -102,7 +102,19 @@ void tcg_gen_br(TCGLabel *l)
 
 void tcg_gen_mb(TCGBar mb_type)
 {
-    if (tcg_ctx->gen_tb->cflags & CF_PARALLEL) {
+#ifdef CONFIG_USER_ONLY
+    bool parallel = tcg_ctx->gen_tb->cflags & CF_PARALLEL;
+#else
+    /*
+     * It is tempting to elide the barrier in a uniprocessor context.
+     * However, even with a single cpu we have i/o threads running in
+     * parallel, and lack of memory order can result in e.g. virtio
+     * queue entries being read incorrectly.
+     */
+    bool parallel = true;
+#endif
+
+    if (parallel) {
         tcg_gen_op1(INDEX_op_mb, mb_type);
     }
 }

From f86e8f3d138de112d66ec28792e0fd303bf129ca Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Mar 2022 15:57:10 +0000
Subject: [PATCH 0201/1353] tcg: Add host memory barriers to cpu_ldst.h
 interfaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bring the helpers into line with the rest of tcg in respecting
guest memory ordering.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 10 ++++++++++
 accel/tcg/internal.h  | 34 ++++++++++++++++++++++++++++++++++
 accel/tcg/user-exec.c | 10 ++++++++++
 3 files changed, 54 insertions(+)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index e02cfc550e..5666a8e23a 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2339,6 +2339,7 @@ static uint8_t do_ld1_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
     MMULookupLocals l;
     bool crosspage;
 
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(env, addr, oi, ra, access_type, &l);
     tcg_debug_assert(!crosspage);
 
@@ -2360,6 +2361,7 @@ static uint16_t do_ld2_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
     uint16_t ret;
     uint8_t a, b;
 
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(env, addr, oi, ra, access_type, &l);
     if (likely(!crosspage)) {
         return do_ld_2(env, &l.page[0], l.mmu_idx, access_type, l.memop, ra);
@@ -2390,6 +2392,7 @@ static uint32_t do_ld4_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
     bool crosspage;
     uint32_t ret;
 
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(env, addr, oi, ra, access_type, &l);
     if (likely(!crosspage)) {
         return do_ld_4(env, &l.page[0], l.mmu_idx, access_type, l.memop, ra);
@@ -2417,6 +2420,7 @@ static uint64_t do_ld8_mmu(CPUArchState *env, vaddr addr, MemOpIdx oi,
     bool crosspage;
     uint64_t ret;
 
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(env, addr, oi, ra, access_type, &l);
     if (likely(!crosspage)) {
         return do_ld_8(env, &l.page[0], l.mmu_idx, access_type, l.memop, ra);
@@ -2469,6 +2473,7 @@ static Int128 do_ld16_mmu(CPUArchState *env, vaddr addr,
     Int128 ret;
     int first;
 
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_LOAD, &l);
     if (likely(!crosspage)) {
         /* Perform the load host endian. */
@@ -2802,6 +2807,7 @@ void helper_stb_mmu(CPUArchState *env, uint64_t addr, uint32_t val,
     bool crosspage;
 
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_8);
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_STORE, &l);
     tcg_debug_assert(!crosspage);
 
@@ -2815,6 +2821,7 @@ static void do_st2_mmu(CPUArchState *env, vaddr addr, uint16_t val,
     bool crosspage;
     uint8_t a, b;
 
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         do_st_2(env, &l.page[0], val, l.mmu_idx, l.memop, ra);
@@ -2843,6 +2850,7 @@ static void do_st4_mmu(CPUArchState *env, vaddr addr, uint32_t val,
     MMULookupLocals l;
     bool crosspage;
 
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         do_st_4(env, &l.page[0], val, l.mmu_idx, l.memop, ra);
@@ -2870,6 +2878,7 @@ static void do_st8_mmu(CPUArchState *env, vaddr addr, uint64_t val,
     MMULookupLocals l;
     bool crosspage;
 
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         do_st_8(env, &l.page[0], val, l.mmu_idx, l.memop, ra);
@@ -2899,6 +2908,7 @@ static void do_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
     uint64_t a, b;
     int first;
 
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
         /* Swap to host endian if necessary, then store. */
diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index 91f308bdfa..650c3ac53f 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -78,4 +78,38 @@ extern int64_t max_advance;
 
 extern bool one_insn_per_tb;
 
+/**
+ * tcg_req_mo:
+ * @type: TCGBar
+ *
+ * Filter @type to the barrier that is required for the guest
+ * memory ordering vs the host memory ordering.  A non-zero
+ * result indicates that some barrier is required.
+ *
+ * If TCG_GUEST_DEFAULT_MO is not defined, assume that the
+ * guest requires strict ordering.
+ *
+ * This is a macro so that it's constant even without optimization.
+ */
+#ifdef TCG_GUEST_DEFAULT_MO
+# define tcg_req_mo(type) \
+    ((type) & TCG_GUEST_DEFAULT_MO & ~TCG_TARGET_DEFAULT_MO)
+#else
+# define tcg_req_mo(type) ((type) & ~TCG_TARGET_DEFAULT_MO)
+#endif
+
+/**
+ * cpu_req_mo:
+ * @type: TCGBar
+ *
+ * If tcg_req_mo indicates a barrier for @type is required
+ * for the guest memory model, issue a host memory barrier.
+ */
+#define cpu_req_mo(type)          \
+    do {                          \
+        if (tcg_req_mo(type)) {   \
+            smp_mb();             \
+        }                         \
+    } while (0)
+
 #endif /* ACCEL_TCG_INTERNAL_H */
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index f8b16d6ab8..8fbcbf9771 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -914,6 +914,7 @@ static uint8_t do_ld1_mmu(CPUArchState *env, abi_ptr addr,
     uint8_t ret;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_8);
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_LOAD);
     ret = ldub_p(haddr);
     clear_helper_retaddr();
@@ -947,6 +948,7 @@ static uint16_t do_ld2_mmu(CPUArchState *env, abi_ptr addr,
     uint16_t ret;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_16);
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_LOAD);
     ret = load_atom_2(env, ra, haddr, mop);
     clear_helper_retaddr();
@@ -984,6 +986,7 @@ static uint32_t do_ld4_mmu(CPUArchState *env, abi_ptr addr,
     uint32_t ret;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_32);
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_LOAD);
     ret = load_atom_4(env, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1021,6 +1024,7 @@ static uint64_t do_ld8_mmu(CPUArchState *env, abi_ptr addr,
     uint64_t ret;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_64);
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_LOAD);
     ret = load_atom_8(env, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1052,6 +1056,7 @@ static Int128 do_ld16_mmu(CPUArchState *env, abi_ptr addr,
     Int128 ret;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_128);
+    cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_LOAD);
     ret = load_atom_16(env, ra, haddr, mop);
     clear_helper_retaddr();
@@ -1087,6 +1092,7 @@ static void do_st1_mmu(CPUArchState *env, abi_ptr addr, uint8_t val,
     void *haddr;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_8);
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_STORE);
     stb_p(haddr, val);
     clear_helper_retaddr();
@@ -1111,6 +1117,7 @@ static void do_st2_mmu(CPUArchState *env, abi_ptr addr, uint16_t val,
     void *haddr;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_16);
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {
@@ -1139,6 +1146,7 @@ static void do_st4_mmu(CPUArchState *env, abi_ptr addr, uint32_t val,
     void *haddr;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_32);
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {
@@ -1167,6 +1175,7 @@ static void do_st8_mmu(CPUArchState *env, abi_ptr addr, uint64_t val,
     void *haddr;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_64);
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {
@@ -1195,6 +1204,7 @@ static void do_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
     void *haddr;
 
     tcg_debug_assert((mop & MO_SIZE) == MO_128);
+    cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     haddr = cpu_mmu_lookup(env, addr, mop, ra, MMU_DATA_STORE);
 
     if (mop & MO_BSWAP) {

From 97e1576957c28a5fbcc810f92643e52069cc49b7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Mar 2022 15:57:27 +0000
Subject: [PATCH 0202/1353] accel/tcg: Remove
 check_tcg_memory_orders_compatible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We now issue host memory barriers to match the guest memory order.
Continue to disable MTTCG only if the guest has not been ported.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c | 39 ++++++++++-----------------------------
 1 file changed, 10 insertions(+), 29 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 02af6a2891..03dfd67e9e 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -64,37 +64,23 @@ DECLARE_INSTANCE_CHECKER(TCGState, TCG_STATE,
  * they can set the appropriate CONFIG flags in ${target}-softmmu.mak
  *
  * Once a guest architecture has been converted to the new primitives
- * there are two remaining limitations to check.
- *
- * - The guest can't be oversized (e.g. 64 bit guest on 32 bit host)
- * - The host must have a stronger memory order than the guest
- *
- * It may be possible in future to support strong guests on weak hosts
- * but that will require tagging all load/stores in a guest with their
- * implicit memory order requirements which would likely slow things
- * down a lot.
+ * there is one remaining limitation to check:
+ *   - The guest can't be oversized (e.g. 64 bit guest on 32 bit host)
  */
 
-static bool check_tcg_memory_orders_compatible(void)
-{
-#if defined(TCG_GUEST_DEFAULT_MO) && defined(TCG_TARGET_DEFAULT_MO)
-    return (TCG_GUEST_DEFAULT_MO & ~TCG_TARGET_DEFAULT_MO) == 0;
-#else
-    return false;
-#endif
-}
-
 static bool default_mttcg_enabled(void)
 {
     if (icount_enabled() || TCG_OVERSIZED_GUEST) {
         return false;
-    } else {
-#ifdef TARGET_SUPPORTS_MTTCG
-        return check_tcg_memory_orders_compatible();
-#else
-        return false;
-#endif
     }
+#ifdef TARGET_SUPPORTS_MTTCG
+# ifndef TCG_GUEST_DEFAULT_MO
+#  error "TARGET_SUPPORTS_MTTCG without TCG_GUEST_DEFAULT_MO"
+# endif
+    return true;
+#else
+    return false;
+#endif
 }
 
 static void tcg_accel_instance_init(Object *obj)
@@ -162,11 +148,6 @@ static void tcg_set_thread(Object *obj, const char *value, Error **errp)
             warn_report("Guest not yet converted to MTTCG - "
                         "you may get unexpected results");
 #endif
-            if (!check_tcg_memory_orders_compatible()) {
-                warn_report("Guest expects a stronger memory ordering "
-                            "than the host provides");
-                error_printf("This may cause strange/hard to debug errors\n");
-            }
             s->mttcg_enabled = true;
         }
     } else if (strcmp(value, "single") == 0) {

From 58e8f1f616d117aed6283690419dc16f53b7a202 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 22 Feb 2023 19:17:52 -1000
Subject: [PATCH 0203/1353] accel/tcg: Store some tlb flags in CPUTLBEntryFull
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have run out of bits we can use within the CPUTLBEntry comparators,
as TLB_FLAGS_MASK cannot overlap alignment.

Store slow_flags[] in CPUTLBEntryFull, and merge with the flags from
the comparator.  A new TLB_FORCE_SLOW bit is set within the comparator
as an indication that the slow path must be used.

Move TLB_BSWAP to TLB_SLOW_FLAGS_MASK.  Since we are out of bits,
we cannot create a new bit without moving an old one.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c      | 98 ++++++++++++++++++++++++-----------------
 include/exec/cpu-all.h  | 21 +++++++--
 include/exec/cpu-defs.h |  6 +++
 include/hw/core/cpu.h   |  1 +
 4 files changed, 82 insertions(+), 44 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5666a8e23a..3671846744 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1107,6 +1107,24 @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
     env_tlb(env)->d[mmu_idx].large_page_mask = lp_mask;
 }
 
+static inline void tlb_set_compare(CPUTLBEntryFull *full, CPUTLBEntry *ent,
+                                   target_ulong address, int flags,
+                                   MMUAccessType access_type, bool enable)
+{
+    if (enable) {
+        address |= flags & TLB_FLAGS_MASK;
+        flags &= TLB_SLOW_FLAGS_MASK;
+        if (flags) {
+            address |= TLB_FORCE_SLOW;
+        }
+    } else {
+        address = -1;
+        flags = 0;
+    }
+    ent->addr_idx[access_type] = address;
+    full->slow_flags[access_type] = flags;
+}
+
 /*
  * Add a new TLB entry. At most one entry for a given virtual address
  * is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
@@ -1122,9 +1140,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
     CPUTLB *tlb = env_tlb(env);
     CPUTLBDesc *desc = &tlb->d[mmu_idx];
     MemoryRegionSection *section;
-    unsigned int index;
-    vaddr address;
-    vaddr write_address;
+    unsigned int index, read_flags, write_flags;
     uintptr_t addend;
     CPUTLBEntry *te, tn;
     hwaddr iotlb, xlat, sz, paddr_page;
@@ -1153,13 +1169,13 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
               " prot=%x idx=%d\n",
               addr, full->phys_addr, prot, mmu_idx);
 
-    address = addr_page;
+    read_flags = 0;
     if (full->lg_page_size < TARGET_PAGE_BITS) {
         /* Repeat the MMU check and TLB fill on every access.  */
-        address |= TLB_INVALID_MASK;
+        read_flags |= TLB_INVALID_MASK;
     }
     if (full->attrs.byte_swap) {
-        address |= TLB_BSWAP;
+        read_flags |= TLB_BSWAP;
     }
 
     is_ram = memory_region_is_ram(section->mr);
@@ -1173,7 +1189,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
         addend = 0;
     }
 
-    write_address = address;
+    write_flags = read_flags;
     if (is_ram) {
         iotlb = memory_region_get_ram_addr(section->mr) + xlat;
         /*
@@ -1182,9 +1198,9 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
          */
         if (prot & PAGE_WRITE) {
             if (section->readonly) {
-                write_address |= TLB_DISCARD_WRITE;
+                write_flags |= TLB_DISCARD_WRITE;
             } else if (cpu_physical_memory_is_clean(iotlb)) {
-                write_address |= TLB_NOTDIRTY;
+                write_flags |= TLB_NOTDIRTY;
             }
         }
     } else {
@@ -1195,9 +1211,9 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
          * Reads to romd devices go through the ram_ptr found above,
          * but of course reads to I/O must go through MMIO.
          */
-        write_address |= TLB_MMIO;
+        write_flags |= TLB_MMIO;
         if (!is_romd) {
-            address = write_address;
+            read_flags = write_flags;
         }
     }
 
@@ -1242,7 +1258,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
      * TARGET_PAGE_BITS, and either
      *  + the ram_addr_t of the page base of the target RAM (RAM)
      *  + the offset within section->mr of the page base (I/O, ROMD)
-     * We subtract the vaddr_page (which is page aligned and thus won't
+     * We subtract addr_page (which is page aligned and thus won't
      * disturb the low bits) to give an offset which can be added to the
      * (non-page-aligned) vaddr of the eventual memory access to get
      * the MemoryRegion offset for the access. Note that the vaddr we
@@ -1250,36 +1266,30 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
      * vaddr we add back in io_readx()/io_writex()/get_page_addr_code().
      */
     desc->fulltlb[index] = *full;
-    desc->fulltlb[index].xlat_section = iotlb - addr_page;
-    desc->fulltlb[index].phys_addr = paddr_page;
+    full = &desc->fulltlb[index];
+    full->xlat_section = iotlb - addr_page;
+    full->phys_addr = paddr_page;
 
     /* Now calculate the new entry */
     tn.addend = addend - addr_page;
-    if (prot & PAGE_READ) {
-        tn.addr_read = address;
-        if (wp_flags & BP_MEM_READ) {
-            tn.addr_read |= TLB_WATCHPOINT;
-        }
-    } else {
-        tn.addr_read = -1;
-    }
 
-    if (prot & PAGE_EXEC) {
-        tn.addr_code = address;
-    } else {
-        tn.addr_code = -1;
-    }
+    tlb_set_compare(full, &tn, addr_page, read_flags,
+                    MMU_INST_FETCH, prot & PAGE_EXEC);
 
-    tn.addr_write = -1;
-    if (prot & PAGE_WRITE) {
-        tn.addr_write = write_address;
-        if (prot & PAGE_WRITE_INV) {
-            tn.addr_write |= TLB_INVALID_MASK;
-        }
-        if (wp_flags & BP_MEM_WRITE) {
-            tn.addr_write |= TLB_WATCHPOINT;
-        }
+    if (wp_flags & BP_MEM_READ) {
+        read_flags |= TLB_WATCHPOINT;
     }
+    tlb_set_compare(full, &tn, addr_page, read_flags,
+                    MMU_DATA_LOAD, prot & PAGE_READ);
+
+    if (prot & PAGE_WRITE_INV) {
+        write_flags |= TLB_INVALID_MASK;
+    }
+    if (wp_flags & BP_MEM_WRITE) {
+        write_flags |= TLB_WATCHPOINT;
+    }
+    tlb_set_compare(full, &tn, addr_page, write_flags,
+                    MMU_DATA_STORE, prot & PAGE_WRITE);
 
     copy_tlb_helper_locked(te, &tn);
     tlb_n_used_entries_inc(env, mmu_idx);
@@ -1509,7 +1519,8 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     uint64_t tlb_addr = tlb_read_idx(entry, access_type);
     vaddr page_addr = addr & TARGET_PAGE_MASK;
-    int flags = TLB_FLAGS_MASK;
+    int flags = TLB_FLAGS_MASK & ~TLB_FORCE_SLOW;
+    CPUTLBEntryFull *full;
 
     if (!tlb_hit_page(tlb_addr, page_addr)) {
         if (!victim_tlb_hit(env, mmu_idx, index, access_type, page_addr)) {
@@ -1538,7 +1549,8 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
     }
     flags &= tlb_addr;
 
-    *pfull = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+    *pfull = full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+    flags |= full->slow_flags[access_type];
 
     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
     if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
@@ -1761,6 +1773,8 @@ static bool mmu_lookup1(CPUArchState *env, MMULookupPageData *data,
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     uint64_t tlb_addr = tlb_read_idx(entry, access_type);
     bool maybe_resized = false;
+    CPUTLBEntryFull *full;
+    int flags;
 
     /* If the TLB entry is for a different page, reload and try again.  */
     if (!tlb_hit(tlb_addr, addr)) {
@@ -1774,8 +1788,12 @@ static bool mmu_lookup1(CPUArchState *env, MMULookupPageData *data,
         tlb_addr = tlb_read_idx(entry, access_type) & ~TLB_INVALID_MASK;
     }
 
-    data->flags = tlb_addr & TLB_FLAGS_MASK;
-    data->full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+    full = &env_tlb(env)->d[mmu_idx].fulltlb[index];
+    flags = tlb_addr & (TLB_FLAGS_MASK & ~TLB_FORCE_SLOW);
+    flags |= full->slow_flags[access_type];
+
+    data->full = full;
+    data->flags = flags;
     /* Compute haddr speculatively; depending on flags it might be invalid. */
     data->haddr = (void *)((uintptr_t)addr + entry->addend);
 
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 09bf4c0cc6..4422f4bb07 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -327,17 +327,30 @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
 /* Set if TLB entry contains a watchpoint.  */
 #define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
-/* Set if TLB entry requires byte swap.  */
-#define TLB_BSWAP           (1 << (TARGET_PAGE_BITS_MIN - 5))
+/* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
+#define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 5))
 /* Set if TLB entry writes ignored.  */
 #define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 6))
 
-/* Use this mask to check interception with an alignment mask
+/*
+ * Use this mask to check interception with an alignment mask
  * in a TCG backend.
  */
 #define TLB_FLAGS_MASK \
     (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
-    | TLB_WATCHPOINT | TLB_BSWAP | TLB_DISCARD_WRITE)
+    | TLB_WATCHPOINT | TLB_FORCE_SLOW | TLB_DISCARD_WRITE)
+
+/*
+ * Flags stored in CPUTLBEntryFull.slow_flags[x].
+ * TLB_FORCE_SLOW must be set in CPUTLBEntry.addr_idx[x].
+ */
+/* Set if TLB entry requires byte swap.  */
+#define TLB_BSWAP            (1 << 0)
+
+#define TLB_SLOW_FLAGS_MASK  TLB_BSWAP
+
+/* The two sets of flags must not overlap. */
+QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
 
 /**
  * tlb_hit_page: return true if page aligned @addr is a hit against the
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index e6a079402e..fb4c8d480f 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -124,6 +124,12 @@ typedef struct CPUTLBEntryFull {
     /* @lg_page_size contains the log2 of the page size. */
     uint8_t lg_page_size;
 
+    /*
+     * Additional tlb flags for use by the slow path. If non-zero,
+     * the corresponding CPUTLBEntry comparator must have TLB_FORCE_SLOW.
+     */
+    uint8_t slow_flags[MMU_ACCESS_COUNT];
+
     /*
      * Allow target-specific additions to this structure.
      * This may be used to cache items from the guest cpu
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 3b765beb9b..eda0230a02 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -84,6 +84,7 @@ typedef enum MMUAccessType {
     MMU_DATA_LOAD  = 0,
     MMU_DATA_STORE = 1,
     MMU_INST_FETCH = 2
+#define MMU_ACCESS_COUNT 3
 } MMUAccessType;
 
 typedef struct CPUWatchpoint CPUWatchpoint;

From 187ba6945345cedf2f343fcc33e5616186aebe9d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 22 Feb 2023 23:09:43 -1000
Subject: [PATCH 0204/1353] accel/tcg: Move TLB_WATCHPOINT to
 TLB_SLOW_FLAGS_MASK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This frees up one bit of the primary tlb flags without
impacting the TLB_NOTDIRTY logic.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c     | 18 ++++++++++++++----
 include/exec/cpu-all.h |  8 ++++----
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 3671846744..5b51eff5a4 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1981,7 +1981,7 @@ static void *atomic_mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
          */
         goto stop_the_world;
     }
-    /* Collect TLB_WATCHPOINT for read. */
+    /* Collect tlb flags for read. */
     tlb_addr |= tlbe->addr_read;
 
     /* Notice an IO access or a needs-MMU-lookup access */
@@ -1998,9 +1998,19 @@ static void *atomic_mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
         notdirty_write(env_cpu(env), addr, size, full, retaddr);
     }
 
-    if (unlikely(tlb_addr & TLB_WATCHPOINT)) {
-        cpu_check_watchpoint(env_cpu(env), addr, size, full->attrs,
-                             BP_MEM_READ | BP_MEM_WRITE, retaddr);
+    if (unlikely(tlb_addr & TLB_FORCE_SLOW)) {
+        int wp_flags = 0;
+
+        if (full->slow_flags[MMU_DATA_STORE] & TLB_WATCHPOINT) {
+            wp_flags |= BP_MEM_WRITE;
+        }
+        if (full->slow_flags[MMU_DATA_LOAD] & TLB_WATCHPOINT) {
+            wp_flags |= BP_MEM_READ;
+        }
+        if (wp_flags) {
+            cpu_check_watchpoint(env_cpu(env), addr, size,
+                                 full->attrs, wp_flags, retaddr);
+        }
     }
 
     return hostaddr;
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 4422f4bb07..b5618613cc 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -325,8 +325,6 @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
 /* Set if TLB entry is an IO callback.  */
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
-/* Set if TLB entry contains a watchpoint.  */
-#define TLB_WATCHPOINT      (1 << (TARGET_PAGE_BITS_MIN - 4))
 /* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
 #define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 5))
 /* Set if TLB entry writes ignored.  */
@@ -338,7 +336,7 @@ CPUArchState *cpu_copy(CPUArchState *env);
  */
 #define TLB_FLAGS_MASK \
     (TLB_INVALID_MASK | TLB_NOTDIRTY | TLB_MMIO \
-    | TLB_WATCHPOINT | TLB_FORCE_SLOW | TLB_DISCARD_WRITE)
+    | TLB_FORCE_SLOW | TLB_DISCARD_WRITE)
 
 /*
  * Flags stored in CPUTLBEntryFull.slow_flags[x].
@@ -346,8 +344,10 @@ CPUArchState *cpu_copy(CPUArchState *env);
  */
 /* Set if TLB entry requires byte swap.  */
 #define TLB_BSWAP            (1 << 0)
+/* Set if TLB entry contains a watchpoint.  */
+#define TLB_WATCHPOINT       (1 << 1)
 
-#define TLB_SLOW_FLAGS_MASK  TLB_BSWAP
+#define TLB_SLOW_FLAGS_MASK  (TLB_BSWAP | TLB_WATCHPOINT)
 
 /* The two sets of flags must not overlap. */
 QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);

From a0eaae08c7c6a59c185cf646b02f4167b2ac6ec0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 21 Jun 2023 12:27:27 +0200
Subject: [PATCH 0205/1353] accel/tcg: Renumber TLB_DISCARD_WRITE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move to fill a hole in the set of bits.
Reduce the total number of tlb bits by 1.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 4 ++--
 tcg/tcg-op-ldst.c      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index b5618613cc..8018ce783e 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -325,10 +325,10 @@ CPUArchState *cpu_copy(CPUArchState *env);
 #define TLB_NOTDIRTY        (1 << (TARGET_PAGE_BITS_MIN - 2))
 /* Set if TLB entry is an IO callback.  */
 #define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 3))
+/* Set if TLB entry writes ignored.  */
+#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 4))
 /* Set if the slow path must be used; more flags in CPUTLBEntryFull. */
 #define TLB_FORCE_SLOW      (1 << (TARGET_PAGE_BITS_MIN - 5))
-/* Set if TLB entry writes ignored.  */
-#define TLB_DISCARD_WRITE   (1 << (TARGET_PAGE_BITS_MIN - 6))
 
 /*
  * Use this mask to check interception with an alignment mask
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index a4f51bfb6e..0fcc1618e5 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -39,7 +39,7 @@ static void check_max_alignment(unsigned a_bits)
      * The requested alignment cannot overlap the TLB flags.
      * FIXME: Must keep the count up-to-date with "exec/cpu-all.h".
      */
-    tcg_debug_assert(a_bits + 6 <= tcg_ctx->page_bits);
+    tcg_debug_assert(a_bits + 5 <= tcg_ctx->page_bits);
 #endif
 }
 

From 67f85346ca9305d9fb3254ceff735ceaadeb0911 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 27 Jun 2023 16:14:06 +1000
Subject: [PATCH 0206/1353] icount: don't adjust virtual time backwards after
 warp

The icount-based QEMU_CLOCK_VIRTUAL runs ahead of the RT clock at times.
When warping, it is possible it is still ahead at the end of the warp,
which causes icount adaptive mode to adjust it backward. This can result
in the machine observing time going backwards.

Prevent this by clamping adaptive adjustment to 0 at minimum.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230627061406.241847-1-npiggin@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 softmmu/icount.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/softmmu/icount.c b/softmmu/icount.c
index 4504433e16..a5cef9c60a 100644
--- a/softmmu/icount.c
+++ b/softmmu/icount.c
@@ -259,11 +259,16 @@ static void icount_warp_rt(void)
         warp_delta = clock - timers_state.vm_clock_warp_start;
         if (icount_enabled() == 2) {
             /*
-             * In adaptive mode, do not let QEMU_CLOCK_VIRTUAL run too
-             * far ahead of real time.
+             * In adaptive mode, do not let QEMU_CLOCK_VIRTUAL run too far
+             * ahead of real time (it might already be ahead so careful not
+             * to go backwards).
              */
             int64_t cur_icount = icount_get_locked();
             int64_t delta = clock - cur_icount;
+
+            if (delta < 0) {
+                delta = 0;
+            }
             warp_delta = MIN(warp_delta, delta);
         }
         qatomic_set_i64(&timers_state.qemu_icount_bias,

From 333e7599a0d723801235f675719008ce43db93e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sun, 19 Mar 2023 15:10:17 +0400
Subject: [PATCH 0207/1353] ui: return NULL when getting cursor without a
 console
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VNC may try to get the current cursor even when there are no consoles
and crashes. Simple reproducer is qemu with -nodefaults.

Fixes: (again)
https://gitlab.com/qemu-project/qemu/-/issues/1548

Fixes: commit 385ac97f8 ("ui: keep current cursor with QemuConsole")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230428154807.2143652-1-marcandre.lureau@redhat.com>
---
 ui/console.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/console.c b/ui/console.c
index e173731e20..7461446e71 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -2306,7 +2306,7 @@ QEMUCursor *qemu_console_get_cursor(QemuConsole *con)
     if (con == NULL) {
         con = active_console;
     }
-    return con->cursor;
+    return con ? con->cursor : NULL;
 }
 
 bool qemu_console_is_visible(QemuConsole *con)

From 72cbcead969de5b34709ac706a3881636010b6f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 18 Apr 2023 11:32:37 +0400
Subject: [PATCH 0208/1353] egl: no need to lookup EGL functions manually
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

libepoxy handles loading the function pointer and dispatching the call,
so you don't have to worry about it.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230515132455.1025608-1-marcandre.lureau@redhat.com>
---
 ui/egl-helpers.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 4203163ace..60385c1f48 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -439,10 +439,8 @@ static EGLDisplay qemu_egl_get_display(EGLNativeDisplayType native,
 
     /* In practise any EGL 1.5 implementation would support the EXT extension */
     if (epoxy_has_egl_extension(NULL, "EGL_EXT_platform_base")) {
-        PFNEGLGETPLATFORMDISPLAYEXTPROC getPlatformDisplayEXT =
-            (void *) eglGetProcAddress("eglGetPlatformDisplayEXT");
-        if (getPlatformDisplayEXT && platform != 0) {
-            dpy = getPlatformDisplayEXT(platform, native, NULL);
+        if (platform != 0) {
+            dpy = eglGetPlatformDisplayEXT(platform, native, NULL);
         }
     }
 

From 176e3783f2ab1476cdfd18a12bd2cfbe42e6b573 Mon Sep 17 00:00:00 2001
From: Antonio Caggiano <quic_acaggian@quicinc.com>
Date: Mon, 12 Jun 2023 11:19:59 +0200
Subject: [PATCH 0209/1353] ui/sdl2: OpenGL window context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When OpenGL is enabled, create only the OpenGL context, ignoring the SDL
renderer as it is unused anyway.

Signed-off-by: Antonio Caggiano <quic_acaggian@quicinc.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230612091959.2983-1-quic_acaggian@quicinc.com>
---
 ui/sdl2.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/ui/sdl2.c b/ui/sdl2.c
index 9d703200bf..0d91b555e3 100644
--- a/ui/sdl2.c
+++ b/ui/sdl2.c
@@ -113,11 +113,11 @@ void sdl2_window_create(struct sdl2_console *scon)
 
         SDL_SetHint(SDL_HINT_RENDER_DRIVER, driver);
         SDL_SetHint(SDL_HINT_RENDER_BATCHING, "1");
-    }
-    scon->real_renderer = SDL_CreateRenderer(scon->real_window, -1, 0);
 
-    if (scon->opengl) {
         scon->winctx = SDL_GL_CreateContext(scon->real_window);
+    } else {
+        /* The SDL renderer is only used by sdl2-2D, when OpenGL is disabled */
+        scon->real_renderer = SDL_CreateRenderer(scon->real_window, -1, 0);
     }
     sdl_update_caption(scon);
 }
@@ -128,10 +128,14 @@ void sdl2_window_destroy(struct sdl2_console *scon)
         return;
     }
 
-    SDL_GL_DeleteContext(scon->winctx);
-    scon->winctx = NULL;
-    SDL_DestroyRenderer(scon->real_renderer);
-    scon->real_renderer = NULL;
+    if (scon->winctx) {
+        SDL_GL_DeleteContext(scon->winctx);
+        scon->winctx = NULL;
+    }
+    if (scon->real_renderer) {
+        SDL_DestroyRenderer(scon->real_renderer);
+        scon->real_renderer = NULL;
+    }
     SDL_DestroyWindow(scon->real_window);
     scon->real_window = NULL;
 }

From b097b80bc919fca5f45663c20722e57792a093ea Mon Sep 17 00:00:00 2001
From: Keqian Zhu <zhukeqian1@huawei.com>
Date: Mon, 12 Jun 2023 10:13:58 +0800
Subject: [PATCH 0210/1353] virtio-gpu: Optimize 2D resource data transfer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The following points sometimes can reduce much data
to copy:
1. When width matches, we can transfer data with one
call of iov_to_buf().
2. Only the required height need to transfer, not
whole image.

Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230612021358.25068-1-zhukeqian1@huawei.com>
---
 hw/display/virtio-gpu.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 66cddd94d9..af31018ab0 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -438,11 +438,11 @@ static void virtio_gpu_transfer_to_host_2d(VirtIOGPU *g,
                                            struct virtio_gpu_ctrl_command *cmd)
 {
     struct virtio_gpu_simple_resource *res;
-    int h;
+    int h, bpp;
     uint32_t src_offset, dst_offset, stride;
-    int bpp;
     pixman_format_code_t format;
     struct virtio_gpu_transfer_to_host_2d t2d;
+    void *img_data;
 
     VIRTIO_GPU_FILL_CMD(t2d);
     virtio_gpu_t2d_bswap(&t2d);
@@ -471,23 +471,23 @@ static void virtio_gpu_transfer_to_host_2d(VirtIOGPU *g,
     format = pixman_image_get_format(res->image);
     bpp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(format), 8);
     stride = pixman_image_get_stride(res->image);
+    img_data = pixman_image_get_data(res->image);
 
-    if (t2d.offset || t2d.r.x || t2d.r.y ||
-        t2d.r.width != pixman_image_get_width(res->image)) {
-        void *img_data = pixman_image_get_data(res->image);
+    if (t2d.r.x || t2d.r.width != pixman_image_get_width(res->image)) {
         for (h = 0; h < t2d.r.height; h++) {
             src_offset = t2d.offset + stride * h;
             dst_offset = (t2d.r.y + h) * stride + (t2d.r.x * bpp);
 
             iov_to_buf(res->iov, res->iov_cnt, src_offset,
-                       (uint8_t *)img_data
-                       + dst_offset, t2d.r.width * bpp);
+                       (uint8_t *)img_data + dst_offset,
+                       t2d.r.width * bpp);
         }
     } else {
-        iov_to_buf(res->iov, res->iov_cnt, 0,
-                   pixman_image_get_data(res->image),
-                   pixman_image_get_stride(res->image)
-                   * pixman_image_get_height(res->image));
+        src_offset = t2d.offset;
+        dst_offset = t2d.r.y * stride + t2d.r.x * bpp;
+        iov_to_buf(res->iov, res->iov_cnt, src_offset,
+                   (uint8_t *)img_data + dst_offset,
+                   stride * t2d.r.height);
     }
 }
 

From 1e0c544673f43cb7ed97020cb9b3b1a915811bac Mon Sep 17 00:00:00 2001
From: Zhang Huasen <huasenzhang@foxmail.com>
Date: Thu, 15 Jun 2023 18:35:00 +0800
Subject: [PATCH 0211/1353] chardev/char-win-stdio: Support VT sequences on
 Windows 11 host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the monitor or the serial port use STDIO as backend on Windows 11 host,
e.g. -nographic options is used, the monitor or the guest Linux do not
response to arrow keys.

When Windows creates a console, ENABLE_VIRTUAL_PROCESS_INPUT is disabled
by default. Arrow keys cannot be retrieved by ReadFile or ReadConsoleInput
functions.

Add ENABLE_VIRTUAL_PROCESS_INPUT to the flag which is passed to SetConsoleMode,
when opening stdio console.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1674

Signed-off-by: Zhang Huasen <huasenzhang@foxmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <tencent_8DA57B405D427A560FD40F8FB0C0B1ADDE09@qq.com>
---
 chardev/char-win-stdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char-win-stdio.c b/chardev/char-win-stdio.c
index eb830eabd9..1a18999e78 100644
--- a/chardev/char-win-stdio.c
+++ b/chardev/char-win-stdio.c
@@ -190,7 +190,7 @@ static void qemu_chr_open_stdio(Chardev *chr,
         }
     }
 
-    dwMode |= ENABLE_LINE_INPUT;
+    dwMode |= ENABLE_LINE_INPUT | ENABLE_VIRTUAL_TERMINAL_INPUT;
 
     if (is_console) {
         /* set the terminal in raw mode */

From b6596785987d0174d6f413b7a5b695de6aa14483 Mon Sep 17 00:00:00 2001
From: Bilal Elmoussaoui <belmouss@redhat.com>
Date: Mon, 19 Jun 2023 11:53:36 +0200
Subject: [PATCH 0212/1353] ui/touch: Move event handling to a common helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To share code between the GTK and DBus UI bakcends
see the next commit for details

Signed-off-by: Bilal Elmoussaoui <belmouss@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230619095337.9899-2-belmouss@redhat.com>
---
 include/ui/console.h | 15 ++++++++++
 ui/console.c         | 65 ++++++++++++++++++++++++++++++++++++++++++++
 ui/gtk.c             | 61 ++++-------------------------------------
 3 files changed, 85 insertions(+), 56 deletions(-)

diff --git a/include/ui/console.h b/include/ui/console.h
index ae5ec466c1..2093e2a3ba 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -5,6 +5,7 @@
 #include "qom/object.h"
 #include "qemu/notify.h"
 #include "qapi/qapi-types-ui.h"
+#include "ui/input.h"
 
 #ifdef CONFIG_OPENGL
 # include <epoxy/gl.h>
@@ -95,6 +96,20 @@ bool kbd_put_qcode_console(QemuConsole *s, int qcode, bool ctrl);
 void kbd_put_string_console(QemuConsole *s, const char *str, int len);
 void kbd_put_keysym(int keysym);
 
+/* Touch devices */
+typedef struct touch_slot {
+    int x;
+    int y;
+    int tracking_id;
+} touch_slot;
+
+void console_handle_touch_event(QemuConsole *con,
+                                struct touch_slot touch_slots[INPUT_EVENT_SLOTS_MAX],
+                                uint64_t num_slot,
+                                int width, int height,
+                                double x, double y,
+                                InputMultiTouchType type,
+                                Error **errp);
 /* consoles */
 
 #define TYPE_QEMU_CONSOLE "qemu-console"
diff --git a/ui/console.c b/ui/console.c
index 7461446e71..cfaa43e970 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1635,6 +1635,71 @@ static bool console_compatible_with(QemuConsole *con,
     return true;
 }
 
+void console_handle_touch_event(QemuConsole *con,
+                                struct touch_slot touch_slots[INPUT_EVENT_SLOTS_MAX],
+                                uint64_t num_slot,
+                                int width, int height,
+                                double x, double y,
+                                InputMultiTouchType type,
+                                Error **errp)
+{
+    struct touch_slot *slot;
+    bool needs_sync = false;
+    int update;
+    int i;
+
+    if (num_slot >= INPUT_EVENT_SLOTS_MAX) {
+        error_setg(errp,
+                   "Unexpected touch slot number: % " PRId64" >= %d",
+                   num_slot, INPUT_EVENT_SLOTS_MAX);
+        return;
+    }
+
+    slot = &touch_slots[num_slot];
+    slot->x = x;
+    slot->y = y;
+
+    if (type == INPUT_MULTI_TOUCH_TYPE_BEGIN) {
+        slot->tracking_id = num_slot;
+    }
+
+    for (i = 0; i < INPUT_EVENT_SLOTS_MAX; ++i) {
+        if (i == num_slot) {
+            update = type;
+        } else {
+            update = INPUT_MULTI_TOUCH_TYPE_UPDATE;
+        }
+
+        slot = &touch_slots[i];
+
+        if (slot->tracking_id == -1) {
+            continue;
+        }
+
+        if (update == INPUT_MULTI_TOUCH_TYPE_END) {
+            slot->tracking_id = -1;
+            qemu_input_queue_mtt(con, update, i, slot->tracking_id);
+            needs_sync = true;
+        } else {
+            qemu_input_queue_mtt(con, update, i, slot->tracking_id);
+            qemu_input_queue_btn(con, INPUT_BUTTON_TOUCH, true);
+            qemu_input_queue_mtt_abs(con,
+                                    INPUT_AXIS_X, (int) slot->x,
+                                    0, width,
+                                    i, slot->tracking_id);
+            qemu_input_queue_mtt_abs(con,
+                                    INPUT_AXIS_Y, (int) slot->y,
+                                    0, height,
+                                    i, slot->tracking_id);
+            needs_sync = true;
+        }
+    }
+
+    if (needs_sync) {
+        qemu_input_event_sync();
+    }
+}
+
 void qemu_console_set_display_gl_ctx(QemuConsole *con, DisplayGLCtx *gl)
 {
     /* display has opengl support */
diff --git a/ui/gtk.c b/ui/gtk.c
index e50f950f2b..e09e164482 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -130,11 +130,6 @@ typedef struct VCChardev VCChardev;
 DECLARE_INSTANCE_CHECKER(VCChardev, VC_CHARDEV,
                          TYPE_CHARDEV_VC)
 
-struct touch_slot {
-    int x;
-    int y;
-    int tracking_id;
-};
 static struct touch_slot touch_slots[INPUT_EVENT_SLOTS_MAX];
 
 bool gtk_use_gl_area;
@@ -1068,27 +1063,12 @@ static gboolean gd_touch_event(GtkWidget *widget, GdkEventTouch *touch,
                                void *opaque)
 {
     VirtualConsole *vc = opaque;
-    struct touch_slot *slot;
     uint64_t num_slot = GPOINTER_TO_UINT(touch->sequence);
-    bool needs_sync = false;
-    int update;
     int type = -1;
-    int i;
-
-    if (num_slot >= INPUT_EVENT_SLOTS_MAX) {
-        warn_report("gtk: unexpected touch slot number: % " PRId64" >= %d\n",
-                    num_slot, INPUT_EVENT_SLOTS_MAX);
-        return FALSE;
-    }
-
-    slot = &touch_slots[num_slot];
-    slot->x = touch->x;
-    slot->y = touch->y;
 
     switch (touch->type) {
     case GDK_TOUCH_BEGIN:
         type = INPUT_MULTI_TOUCH_TYPE_BEGIN;
-        slot->tracking_id = num_slot;
         break;
     case GDK_TOUCH_UPDATE:
         type = INPUT_MULTI_TOUCH_TYPE_UPDATE;
@@ -1099,44 +1079,13 @@ static gboolean gd_touch_event(GtkWidget *widget, GdkEventTouch *touch,
         break;
     default:
         warn_report("gtk: unexpected touch event type\n");
+        return FALSE;
     }
 
-    for (i = 0; i < INPUT_EVENT_SLOTS_MAX; ++i) {
-        if (i == num_slot) {
-            update = type;
-        } else {
-            update = INPUT_MULTI_TOUCH_TYPE_UPDATE;
-        }
-
-        slot = &touch_slots[i];
-
-        if (slot->tracking_id == -1) {
-            continue;
-        }
-
-        if (update == INPUT_MULTI_TOUCH_TYPE_END) {
-            slot->tracking_id = -1;
-            qemu_input_queue_mtt(vc->gfx.dcl.con, update, i, slot->tracking_id);
-            needs_sync = true;
-        } else {
-            qemu_input_queue_mtt(vc->gfx.dcl.con, update, i, slot->tracking_id);
-            qemu_input_queue_btn(vc->gfx.dcl.con, INPUT_BUTTON_TOUCH, true);
-            qemu_input_queue_mtt_abs(vc->gfx.dcl.con,
-                                     INPUT_AXIS_X, (int) slot->x,
-                                     0, surface_width(vc->gfx.ds),
-                                     i, slot->tracking_id);
-            qemu_input_queue_mtt_abs(vc->gfx.dcl.con,
-                                     INPUT_AXIS_Y, (int) slot->y,
-                                     0, surface_height(vc->gfx.ds),
-                                     i, slot->tracking_id);
-            needs_sync = true;
-        }
-    }
-
-    if (needs_sync) {
-        qemu_input_event_sync();
-    }
-
+    console_handle_touch_event(vc->gfx.dcl.con, touch_slots,
+                               num_slot, surface_width(vc->gfx.ds),
+                               surface_height(vc->gfx.ds), touch->x,
+                               touch->y, type, &error_warn);
     return TRUE;
 }
 

From de9f844ce27ef8540bb9e8b4dd2c159b676d78a5 Mon Sep 17 00:00:00 2001
From: Bilal Elmoussaoui <belmouss@redhat.com>
Date: Mon, 19 Jun 2023 11:53:37 +0200
Subject: [PATCH 0213/1353] ui/dbus: Expose a touch device interface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

So that clients making use of the DBus backend could
send touch events through the new org.qemu.Display1.Touch
interface

Signed-off-by: Bilal Elmoussaoui <belmouss@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230619095337.9899-3-belmouss@redhat.com>
---
 ui/dbus-console.c    | 59 +++++++++++++++++++++++++++++++++++++++++++-
 ui/dbus-display1.xml | 45 +++++++++++++++++++++++++++++++--
 ui/trace-events      |  1 +
 3 files changed, 102 insertions(+), 3 deletions(-)

diff --git a/ui/dbus-console.c b/ui/dbus-console.c
index f77bc49d2e..bc97614fec 100644
--- a/ui/dbus-console.c
+++ b/ui/dbus-console.c
@@ -32,6 +32,8 @@
 
 #include "dbus.h"
 
+static struct touch_slot touch_slots[INPUT_EVENT_SLOTS_MAX];
+
 struct _DBusDisplayConsole {
     GDBusObjectSkeleton parent_instance;
     DisplayChangeListener dcl;
@@ -44,6 +46,7 @@ struct _DBusDisplayConsole {
     QKbdState *kbd;
 
     QemuDBusDisplay1Mouse *iface_mouse;
+    QemuDBusDisplay1MultiTouch *iface_touch;
     gboolean last_set;
     guint last_x;
     guint last_y;
@@ -345,6 +348,46 @@ dbus_mouse_rel_motion(DBusDisplayConsole *ddc,
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
 
+static gboolean
+dbus_touch_send_event(DBusDisplayConsole *ddc,
+                      GDBusMethodInvocation *invocation,
+                      guint kind, uint64_t num_slot,
+                      double x, double y)
+{
+    Error *error = NULL;
+    int width, height;
+    trace_dbus_touch_send_event(kind, num_slot, x, y);
+
+    if (kind != INPUT_MULTI_TOUCH_TYPE_BEGIN &&
+        kind != INPUT_MULTI_TOUCH_TYPE_UPDATE &&
+        kind != INPUT_MULTI_TOUCH_TYPE_CANCEL &&
+        kind != INPUT_MULTI_TOUCH_TYPE_END)
+    {
+        g_dbus_method_invocation_return_error(
+            invocation, DBUS_DISPLAY_ERROR,
+            DBUS_DISPLAY_ERROR_INVALID,
+            "Invalid touch event kind");
+        return DBUS_METHOD_INVOCATION_HANDLED;
+    }
+    width = qemu_console_get_width(ddc->dcl.con, 0);
+    height = qemu_console_get_height(ddc->dcl.con, 0);
+
+    console_handle_touch_event(ddc->dcl.con, touch_slots,
+                               num_slot, width, height,
+                               x, y, kind, &error);
+    if (error != NULL) {
+        g_dbus_method_invocation_return_error(
+            invocation, DBUS_DISPLAY_ERROR,
+            DBUS_DISPLAY_ERROR_INVALID,
+            error_get_pretty(error), NULL);
+        error_free(error);
+    } else {
+        qemu_dbus_display1_multi_touch_complete_send_event(ddc->iface_touch,
+                                                           invocation);
+    }
+    return DBUS_METHOD_INVOCATION_HANDLED;
+}
+
 static gboolean
 dbus_mouse_set_pos(DBusDisplayConsole *ddc,
                    GDBusMethodInvocation *invocation,
@@ -440,7 +483,7 @@ dbus_display_console_new(DBusDisplay *display, QemuConsole *con)
     g_autofree char *label = NULL;
     char device_addr[256] = "";
     DBusDisplayConsole *ddc;
-    int idx;
+    int idx, i;
 
     assert(display);
     assert(con);
@@ -495,6 +538,20 @@ dbus_display_console_new(DBusDisplay *display, QemuConsole *con)
     g_dbus_object_skeleton_add_interface(G_DBUS_OBJECT_SKELETON(ddc),
         G_DBUS_INTERFACE_SKELETON(ddc->iface_mouse));
 
+    ddc->iface_touch = qemu_dbus_display1_multi_touch_skeleton_new();
+    g_object_connect(ddc->iface_touch,
+        "swapped-signal::handle-send-event", dbus_touch_send_event, ddc,
+        NULL);
+    qemu_dbus_display1_multi_touch_set_max_slots(ddc->iface_touch,
+                                                 INPUT_EVENT_SLOTS_MAX);
+    g_dbus_object_skeleton_add_interface(G_DBUS_OBJECT_SKELETON(ddc),
+        G_DBUS_INTERFACE_SKELETON(ddc->iface_touch));
+
+    for (i = 0; i < INPUT_EVENT_SLOTS_MAX; i++) {
+        struct touch_slot *slot = &touch_slots[i];
+        slot->tracking_id = -1;
+    }
+
     register_displaychangelistener(&ddc->dcl);
     ddc->mouse_mode_notifier.notify = dbus_mouse_mode_change;
     qemu_add_mouse_mode_change_notifier(&ddc->mouse_mode_notifier);
diff --git a/ui/dbus-display1.xml b/ui/dbus-display1.xml
index c3b2293376..cc0c9b68bf 100644
--- a/ui/dbus-display1.xml
+++ b/ui/dbus-display1.xml
@@ -39,8 +39,9 @@
       "Text" (see :dbus:prop:`Type` and other properties).
 
       Interactions with a console may be done with
-      :dbus:iface:`org.qemu.Display1.Keyboard` and
-      :dbus:iface:`org.qemu.Display1.Mouse` interfaces when available.
+      :dbus:iface:`org.qemu.Display1.Keyboard`,
+      :dbus:iface:`org.qemu.Display1.Mouse` and
+      :dbus:iface:`org.qemu.Display1.MultiTouch` interfaces when available.
   -->
   <interface name="org.qemu.Display1.Console">
     <!--
@@ -236,6 +237,46 @@
     <property name="IsAbsolute" type="b" access="read"/>
   </interface>
 
+  <!--
+      org.qemu.Display1.MultiTouch:
+
+      This interface in implemented on ``/org/qemu/Display1/Console_$id`` (see
+      :dbus:iface:`~org.qemu.Display1.Console` documentation).
+
+      .. _dbus-kind-values:
+
+      **Kind values**::
+
+        Begin       = 0
+        Update      = 1
+        End         = 2
+        Cancel      = 3
+  -->
+  <interface name="org.qemu.Display1.MultiTouch">
+    <!--
+        SendEvent:
+        @kind: The touch event kind
+        @num_slot: The slot number.
+        @x: The x coordinates.
+        @y: The y coordinates.
+
+        Send a touch gesture event.
+    -->
+    <method name="SendEvent">
+      <arg type="u" name="kind" direction="in"/>
+      <arg type="t" name="num_slot" direction="in"/>
+      <arg type="d" name="x" direction="in"/>
+      <arg type="d" name="y" direction="in"/>
+    </method>
+
+    <!--
+        MaxSlots:
+
+        The maximum number of slots.
+    -->
+    <property name="MaxSlots" type="i" access="read"/>
+  </interface>
+
   <!--
       org.qemu.Display1.Listener:
 
diff --git a/ui/trace-events b/ui/trace-events
index 6747361745..138a09cc03 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -154,6 +154,7 @@ dbus_mouse_press(unsigned int button) "button %u"
 dbus_mouse_release(unsigned int button) "button %u"
 dbus_mouse_set_pos(unsigned int x, unsigned int y) "x=%u, y=%u"
 dbus_mouse_rel_motion(int dx, int dy) "dx=%d, dy=%d"
+dbus_touch_send_event(unsigned int kind, uint32_t num_slot, uint32_t x, uint32_t y) "kind=%u, num_slot=%u, x=%d, y=%d"
 dbus_update(int x, int y, int w, int h) "x=%d, y=%d, w=%d, h=%d"
 dbus_clipboard_grab_failed(void) ""
 dbus_clipboard_register(const char *bus_name) "peer %s"

From 34e29d85a7734802317c4cac9ad52b10d461c1dc Mon Sep 17 00:00:00 2001
From: Vivek Kasireddy <vivek.kasireddy@intel.com>
Date: Thu, 22 Jun 2023 23:04:54 -0700
Subject: [PATCH 0214/1353] virtio-gpu: Make non-gl display updates work again
 when blob=true
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the case where the console does not have gl capability, and
if blob is set to true, make sure that the display updates still
work. Commit e86a93f55463 accidentally broke this by misplacing
the return statement (in resource_flush) causing the updates to
be silently ignored.

Fixes: e86a93f55463 ("virtio-gpu: splitting one extended mode guest fb into n-scanouts")
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Dongwon Kim <dongwon.kim@intel.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230623060454.3749910-1-vivek.kasireddy@intel.com>
---
 hw/display/virtio-gpu.c | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index af31018ab0..506cda944d 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -498,6 +498,8 @@ static void virtio_gpu_resource_flush(VirtIOGPU *g,
     struct virtio_gpu_resource_flush rf;
     struct virtio_gpu_scanout *scanout;
     pixman_region16_t flush_region;
+    bool within_bounds = false;
+    bool update_submitted = false;
     int i;
 
     VIRTIO_GPU_FILL_CMD(rf);
@@ -518,13 +520,28 @@ static void virtio_gpu_resource_flush(VirtIOGPU *g,
                 rf.r.x < scanout->x + scanout->width &&
                 rf.r.x + rf.r.width >= scanout->x &&
                 rf.r.y < scanout->y + scanout->height &&
-                rf.r.y + rf.r.height >= scanout->y &&
-                console_has_gl(scanout->con)) {
-                dpy_gl_update(scanout->con, 0, 0, scanout->width,
-                              scanout->height);
+                rf.r.y + rf.r.height >= scanout->y) {
+                within_bounds = true;
+
+                if (console_has_gl(scanout->con)) {
+                    dpy_gl_update(scanout->con, 0, 0, scanout->width,
+                                  scanout->height);
+                    update_submitted = true;
+                }
             }
         }
-        return;
+
+        if (update_submitted) {
+            return;
+        }
+        if (!within_bounds) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: flush bounds outside scanouts"
+                          " bounds for flush %d: %d %d %d %d\n",
+                          __func__, rf.resource_id, rf.r.x, rf.r.y,
+                          rf.r.width, rf.r.height);
+            cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
+            return;
+        }
     }
 
     if (!res->blob &&

From ec4d71e8f21c90033cb3c77101a434cb9ea708e9 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Wed, 21 Jun 2023 15:27:04 -0700
Subject: [PATCH 0215/1353] virtio-gpu-udmabuf: create udmabuf for blob even
 when iov_cnt == 1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There were often cases where a scanout blob sometimes has just 1 entry
that is linked to many pages in it. So just checking whether iov_cnt is 1
is not enough for screening small, non-scanout blobs. Therefore adding
iov_len check as well to make sure it creates an udmabuf only for a scanout
blob, which is at least bigger than one page size.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230621222704.29932-1-dongwon.kim@intel.com>
---
 hw/display/virtio-gpu-udmabuf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index 69e2cf0bd6..ef1a740de5 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -132,7 +132,8 @@ void virtio_gpu_init_udmabuf(struct virtio_gpu_simple_resource *res)
     void *pdata = NULL;
 
     res->dmabuf_fd = -1;
-    if (res->iov_cnt == 1) {
+    if (res->iov_cnt == 1 &&
+        res->iov[0].iov_len < 4096) {
         pdata = res->iov[0].iov_base;
     } else {
         virtio_gpu_create_udmabuf(res);

From 37802a24eb4e535d96d6fe0273505d2b5c6528c2 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Wed, 21 Jun 2023 14:31:50 -0700
Subject: [PATCH 0216/1353] ui/gtk: set the area of the scanout texture
 correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

x and y offsets and width and height of the scanout texture
is not correctly configured in case guest scanout frame is
dmabuf.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Message-ID: <20230621213150.29573-1-dongwon.kim@intel.com>
---
 ui/gtk-egl.c     | 3 ++-
 ui/gtk-gl-area.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 19130041bc..e99e3b0d8c 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -257,7 +257,8 @@ void gd_egl_scanout_dmabuf(DisplayChangeListener *dcl,
 
     gd_egl_scanout_texture(dcl, dmabuf->texture,
                            dmabuf->y0_top, dmabuf->width, dmabuf->height,
-                           0, 0, dmabuf->width, dmabuf->height);
+                           dmabuf->x, dmabuf->y, dmabuf->scanout_width,
+                           dmabuf->scanout_height);
 
     if (dmabuf->allow_fences) {
         vc->gfx.guest_fb.dmabuf = dmabuf;
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index c384a1516b..1605818bd1 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -299,7 +299,8 @@ void gd_gl_area_scanout_dmabuf(DisplayChangeListener *dcl,
 
     gd_gl_area_scanout_texture(dcl, dmabuf->texture,
                                dmabuf->y0_top, dmabuf->width, dmabuf->height,
-                               0, 0, dmabuf->width, dmabuf->height);
+                               dmabuf->x, dmabuf->y, dmabuf->scanout_width,
+                               dmabuf->scanout_height);
 
     if (dmabuf->allow_fences) {
         vc->gfx.guest_fb.dmabuf = dmabuf;

From 7b41ca8d913cdd91d33d74d906dd5d7bd9f41045 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Mon, 26 Jun 2023 17:34:53 -0700
Subject: [PATCH 0217/1353] virtio-gpu: OUT_OF_MEMORY if failing to create
 udmabuf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Respond with VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY if it fails to create
an udmabuf for the blob resource.

v2: consolidated return statments and removed an unnecessary style change

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230627003453.5321-1-dongwon.kim@intel.com>
---
 hw/display/virtio-gpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 506cda944d..1f8a5b16c6 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -651,8 +651,10 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
         if (console_has_gl(scanout->con)) {
             if (!virtio_gpu_update_dmabuf(g, scanout_id, res, fb, r)) {
                 virtio_gpu_update_scanout(g, scanout_id, res, r);
-                return;
+            } else {
+                *error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
             }
+            return;
         }
 
         data = res->blob;

From 2fc280734a6e7ab9263114214f06b6e69e54fabe Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Mon, 26 Jun 2023 17:53:16 -0700
Subject: [PATCH 0218/1353] ui/gtk: making dmabuf NULL when it's released.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set vc->gfx.guest_fb.dmabuf to NULL to prevent any further access
to it after the dmabuf is released.

v2: move declaration of vc inside ifdef

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230627005316.5627-1-dongwon.kim@intel.com>
---
 ui/gtk.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ui/gtk.c b/ui/gtk.c
index e09e164482..8ba41c8f13 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -583,7 +583,12 @@ static void gd_gl_release_dmabuf(DisplayChangeListener *dcl,
                                  QemuDmaBuf *dmabuf)
 {
 #ifdef CONFIG_GBM
+    VirtualConsole *vc = container_of(dcl, VirtualConsole, gfx.dcl);
+
     egl_dmabuf_release_texture(dmabuf);
+    if (vc->gfx.guest_fb.dmabuf == dmabuf) {
+        vc->gfx.guest_fb.dmabuf = NULL;
+    }
 #endif
 }
 

From 044ca4bf45b5bc232a2d699a9e63f359b1b85df6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:38 +0400
Subject: [PATCH 0219/1353] ui/egl: export qemu_egl_get_error_string()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It will be used from other units.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-2-marcandre.lureau@redhat.com>
---
 include/ui/egl-helpers.h |  2 ++
 ui/egl-helpers.c         | 12 +++++-------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 53d953ddf4..2cf6633ad2 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -67,4 +67,6 @@ bool qemu_egl_has_dmabuf(void);
 
 bool egl_init(const char *rendernode, DisplayGLMode mode, Error **errp);
 
+const char *qemu_egl_get_error_string(void);
+
 #endif /* EGL_HELPERS_H */
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 60385c1f48..26d43e0213 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -28,8 +28,7 @@ DisplayGLMode qemu_egl_mode;
 
 /* ------------------------------------------------------------------ */
 
-#if defined(CONFIG_X11) || defined(CONFIG_GBM)
-static const char *egl_get_error_string(void)
+const char *qemu_egl_get_error_string(void)
 {
     EGLint error = eglGetError();
 
@@ -68,7 +67,6 @@ static const char *egl_get_error_string(void)
         return "Unknown EGL error";
     }
 }
-#endif
 
 static void egl_fb_delete_texture(egl_fb *fb)
 {
@@ -480,20 +478,20 @@ static int qemu_egl_init_dpy(EGLNativeDisplayType dpy,
 
     qemu_egl_display = qemu_egl_get_display(dpy, platform);
     if (qemu_egl_display == EGL_NO_DISPLAY) {
-        error_report("egl: eglGetDisplay failed: %s", egl_get_error_string());
+        error_report("egl: eglGetDisplay failed: %s", qemu_egl_get_error_string());
         return -1;
     }
 
     b = eglInitialize(qemu_egl_display, &major, &minor);
     if (b == EGL_FALSE) {
-        error_report("egl: eglInitialize failed: %s", egl_get_error_string());
+        error_report("egl: eglInitialize failed: %s", qemu_egl_get_error_string());
         return -1;
     }
 
     b = eglBindAPI(gles ?  EGL_OPENGL_ES_API : EGL_OPENGL_API);
     if (b == EGL_FALSE) {
         error_report("egl: eglBindAPI failed (%s mode): %s",
-                     gles ? "gles" : "core", egl_get_error_string());
+                     gles ? "gles" : "core", qemu_egl_get_error_string());
         return -1;
     }
 
@@ -502,7 +500,7 @@ static int qemu_egl_init_dpy(EGLNativeDisplayType dpy,
                         &qemu_egl_config, 1, &n);
     if (b == EGL_FALSE || n != 1) {
         error_report("egl: eglChooseConfig failed (%s mode): %s",
-                     gles ? "gles" : "core", egl_get_error_string());
+                     gles ? "gles" : "core", qemu_egl_get_error_string());
         return -1;
     }
 

From 1d48c9fd8e4ab55662d8daec4af1d63cd2b54699 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:39 +0400
Subject: [PATCH 0220/1353] ui/egl: fix make_context_current() callback return
 value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

eglMakeCurrent() returns 1/EGL_TRUE on success. This is not what the
callback expects, where 0 indicates success.

While at it, print the EGL error to ease debugging.

As with virgl_renderer_callbacks, the return value is now checked since
version >= 4:
https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/7f09e6bf0c6ceea6727bd0049781256a28cab0e5

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-3-marcandre.lureau@redhat.com>
---
 ui/egl-context.c | 10 ++++++++--
 ui/gtk-egl.c     | 10 ++++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/ui/egl-context.c b/ui/egl-context.c
index eb5f520fc4..9e0df466f3 100644
--- a/ui/egl-context.c
+++ b/ui/egl-context.c
@@ -1,4 +1,5 @@
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "ui/egl-context.h"
 
 QEMUGLContext qemu_egl_create_context(DisplayGLCtx *dgc,
@@ -32,6 +33,11 @@ void qemu_egl_destroy_context(DisplayGLCtx *dgc, QEMUGLContext ctx)
 int qemu_egl_make_context_current(DisplayGLCtx *dgc,
                                   QEMUGLContext ctx)
 {
-   return eglMakeCurrent(qemu_egl_display,
-                         EGL_NO_SURFACE, EGL_NO_SURFACE, ctx);
+   if (!eglMakeCurrent(qemu_egl_display,
+                       EGL_NO_SURFACE, EGL_NO_SURFACE, ctx)) {
+        error_report("egl: eglMakeCurrent failed: %s", qemu_egl_get_error_string());
+        return -1;
+   }
+
+   return 0;
 }
diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index e99e3b0d8c..64dc0eeec8 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -13,6 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
+#include "qemu/error-report.h"
 
 #include "trace.h"
 
@@ -369,6 +370,11 @@ int gd_egl_make_current(DisplayGLCtx *dgc,
 {
     VirtualConsole *vc = container_of(dgc, VirtualConsole, gfx.dgc);
 
-    return eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
-                          vc->gfx.esurface, ctx);
+    if (!eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
+                        vc->gfx.esurface, ctx)) {
+        error_report("egl: eglMakeCurrent failed: %s", qemu_egl_get_error_string());
+        return -1;
+    }
+
+    return 0;
 }

From 29c5c7e5f65977a77eddf6580fdc31ea4a263a6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:40 +0400
Subject: [PATCH 0221/1353] ui/dbus: compile without gio/gunixfdlist.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

D-Bus on windows doesn't support fd-passing. Let's isolate the
fdlist-related code as a first step, before adding Windows support,
using another mechanism.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-4-marcandre.lureau@redhat.com>
---
 audio/dbusaudio.c  | 7 +++++++
 ui/dbus-chardev.c  | 6 ++++++
 ui/dbus-console.c  | 8 ++++++++
 ui/dbus-listener.c | 2 ++
 4 files changed, 23 insertions(+)

diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index fece74f78c..de59467d9e 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -29,7 +29,10 @@
 #include "qemu/timer.h"
 #include "qemu/dbus.h"
 
+#ifdef G_OS_UNIX
 #include <gio/gunixfdlist.h>
+#endif
+
 #include "ui/dbus-display1.h"
 
 #define AUDIO_CAP "dbus"
@@ -419,6 +422,7 @@ dbus_audio_fini(void *opaque)
     g_free(da);
 }
 
+#ifdef G_OS_UNIX
 static void
 listener_out_vanished_cb(GDBusConnection *connection,
                          gboolean remote_peer_vanished,
@@ -591,6 +595,7 @@ dbus_audio_register_in_listener(AudioState *s,
     return dbus_audio_register_listener(s, invocation,
                                         fd_list, arg_listener, false);
 }
+#endif
 
 static void
 dbus_audio_set_server(AudioState *s, GDBusObjectManagerServer *server, bool p2p)
@@ -605,12 +610,14 @@ dbus_audio_set_server(AudioState *s, GDBusObjectManagerServer *server, bool p2p)
 
     da->audio = g_dbus_object_skeleton_new(DBUS_DISPLAY1_AUDIO_PATH);
     da->iface = qemu_dbus_display1_audio_skeleton_new();
+#ifdef G_OS_UNIX
     g_object_connect(da->iface,
                      "swapped-signal::handle-register-in-listener",
                      dbus_audio_register_in_listener, s,
                      "swapped-signal::handle-register-out-listener",
                      dbus_audio_register_out_listener, s,
                      NULL);
+#endif
 
     g_dbus_object_skeleton_add_interface(G_DBUS_OBJECT_SKELETON(da->audio),
                                          G_DBUS_INTERFACE_SKELETON(da->iface));
diff --git a/ui/dbus-chardev.c b/ui/dbus-chardev.c
index 940ef937cd..7154d81a9a 100644
--- a/ui/dbus-chardev.c
+++ b/ui/dbus-chardev.c
@@ -27,7 +27,9 @@
 #include "qemu/config-file.h"
 #include "qemu/option.h"
 
+#ifdef G_OS_UNIX
 #include <gio/gunixfdlist.h>
+#endif
 
 #include "dbus.h"
 
@@ -108,6 +110,7 @@ dbus_chardev_init(DBusDisplay *dpy)
                          dbus_display_chardev_foreach, dpy);
 }
 
+#ifdef G_OS_UNIX
 static gboolean
 dbus_chr_register(
     DBusChardev *dc,
@@ -145,6 +148,7 @@ dbus_chr_register(
     qemu_dbus_display1_chardev_complete_register(object, invocation, NULL);
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
+#endif
 
 static gboolean
 dbus_chr_send_break(
@@ -175,8 +179,10 @@ dbus_chr_open(Chardev *chr, ChardevBackend *backend,
     dc->iface = qemu_dbus_display1_chardev_skeleton_new();
     g_object_set(dc->iface, "name", backend->u.dbus.data->name, NULL);
     g_object_connect(dc->iface,
+#ifdef G_OS_UNIX
                      "swapped-signal::handle-register",
                      dbus_chr_register, dc,
+#endif
                      "swapped-signal::handle-send-break",
                      dbus_chr_send_break, dc,
                      NULL);
diff --git a/ui/dbus-console.c b/ui/dbus-console.c
index bc97614fec..d5f6c93637 100644
--- a/ui/dbus-console.c
+++ b/ui/dbus-console.c
@@ -28,7 +28,9 @@
 #include "ui/kbd-state.h"
 #include "trace.h"
 
+#ifdef G_OS_UNIX
 #include <gio/gunixfdlist.h>
+#endif
 
 #include "dbus.h"
 
@@ -163,6 +165,7 @@ dbus_display_console_class_init(DBusDisplayConsoleClass *klass)
     gobject_class->dispose = dbus_display_console_dispose;
 }
 
+#ifdef G_OS_UNIX
 static void
 listener_vanished_cb(DBusDisplayListener *listener)
 {
@@ -174,6 +177,7 @@ listener_vanished_cb(DBusDisplayListener *listener)
     g_hash_table_remove(ddc->listeners, name);
     qkbd_state_lift_all_keys(ddc->kbd);
 }
+#endif
 
 static gboolean
 dbus_console_set_ui_info(DBusDisplayConsole *ddc,
@@ -207,6 +211,7 @@ dbus_console_set_ui_info(DBusDisplayConsole *ddc,
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
 
+#ifdef G_OS_UNIX
 static gboolean
 dbus_console_register_listener(DBusDisplayConsole *ddc,
                                GDBusMethodInvocation *invocation,
@@ -282,6 +287,7 @@ dbus_console_register_listener(DBusDisplayConsole *ddc,
     trace_dbus_registered_listener(sender);
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
+#endif
 
 static gboolean
 dbus_kbd_press(DBusDisplayConsole *ddc,
@@ -510,8 +516,10 @@ dbus_display_console_new(DBusDisplay *display, QemuConsole *con)
         "device-address", device_addr,
         NULL);
     g_object_connect(ddc->iface,
+#ifdef G_OS_UNIX
         "swapped-signal::handle-register-listener",
         dbus_console_register_listener, ddc,
+#endif
         "swapped-signal::handle-set-uiinfo",
         dbus_console_set_ui_info, ddc,
         NULL);
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 23034eebf9..41597a0078 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -25,7 +25,9 @@
 #include "qemu/error-report.h"
 #include "sysemu/sysemu.h"
 #include "dbus.h"
+#ifdef G_OS_UNIX
 #include <gio/gunixfdlist.h>
+#endif
 
 #ifdef CONFIG_OPENGL
 #include "ui/shader.h"

From 9b286e76c858bb015c70261cc85f34952ba1d155 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:41 +0400
Subject: [PATCH 0222/1353] scripts: add a XML preprocessor script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gdbus-codegen doesn't support conditions or pre-processing.

Rather than duplicating D-Bus interfaces for win32 adaptation, let's
have a preprocess step, so we can have platform-specific interfaces.

The python script is based on
https://github.com/peitaosu/XML-Preprocessor, with bug fixes, some
testing and replacing lxml dependency with the built-in xml module.

This preprocessing syntax style is not very common, but is similar to
the one provided by WiX (https://wixtoolset.org/docs/v3/overview/preprocessor/)
or wixl, that we adopted in QEMU for packaging the guest agent.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-5-marcandre.lureau@redhat.com>
---
 MAINTAINERS                    |   1 +
 scripts/meson.build            |   2 +
 scripts/xml-preprocess-test.py | 136 +++++++++++++++
 scripts/xml-preprocess.py      | 293 +++++++++++++++++++++++++++++++++
 4 files changed, 432 insertions(+)
 create mode 100644 scripts/xml-preprocess-test.py
 create mode 100755 scripts/xml-preprocess.py

diff --git a/MAINTAINERS b/MAINTAINERS
index e07746ac7d..21a587ce4b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3202,6 +3202,7 @@ F: docs/interop/dbus*
 F: docs/sphinx/dbus*
 F: docs/sphinx/fakedbusdoc.py
 F: tests/qtest/dbus*
+F: scripts/xml-preprocess*
 
 Seccomp
 M: Daniel P. Berrange <berrange@redhat.com>
diff --git a/scripts/meson.build b/scripts/meson.build
index 1c89e10a76..532277f5a2 100644
--- a/scripts/meson.build
+++ b/scripts/meson.build
@@ -1,3 +1,5 @@
 if stap.found()
   install_data('qemu-trace-stap', install_dir: get_option('bindir'))
 endif
+
+test('xml-preprocess', files('xml-preprocess-test.py'), suite: ['unit'])
diff --git a/scripts/xml-preprocess-test.py b/scripts/xml-preprocess-test.py
new file mode 100644
index 0000000000..dd92579969
--- /dev/null
+++ b/scripts/xml-preprocess-test.py
@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+#
+# Copyright (c) 2023 Red Hat, Inc.
+#
+# SPDX-License-Identifier: MIT
+"""Unit tests for xml-preprocess"""
+
+import contextlib
+import importlib
+import os
+import platform
+import subprocess
+import tempfile
+import unittest
+from io import StringIO
+
+xmlpp = importlib.import_module("xml-preprocess")
+
+
+class TestXmlPreprocess(unittest.TestCase):
+    """Tests for xml-preprocess.Preprocessor"""
+
+    def test_preprocess_xml(self):
+        with tempfile.NamedTemporaryFile(mode="w", delete=False) as temp_file:
+            temp_file.write("<root></root>")
+            temp_file_name = temp_file.name
+        result = xmlpp.preprocess_xml(temp_file_name)
+        self.assertEqual(result, "<root></root>")
+        os.remove(temp_file_name)
+
+    def test_save_xml(self):
+        with tempfile.NamedTemporaryFile(mode="w", delete=False) as temp_file:
+            temp_file_name = temp_file.name
+            xmlpp.save_xml("<root></root>", temp_file_name)
+        self.assertTrue(os.path.isfile(temp_file_name))
+        os.remove(temp_file_name)
+
+    def test_include(self):
+        with tempfile.NamedTemporaryFile(mode="w", delete=False) as inc_file:
+            inc_file.write("<included>Content from included file</included>")
+            inc_file_name = inc_file.name
+        xml_str = f"<?include {inc_file_name} ?>"
+        expected = "<included>Content from included file</included>"
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess(xml_str)
+        self.assertEqual(result, expected)
+        os.remove(inc_file_name)
+        self.assertRaises(FileNotFoundError, xpp.preprocess, xml_str)
+
+    def test_envvar(self):
+        os.environ["TEST_ENV_VAR"] = "TestValue"
+        xml_str = "<root>$(env.TEST_ENV_VAR)</root>"
+        expected = "<root>TestValue</root>"
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess(xml_str)
+        self.assertEqual(result, expected)
+        self.assertRaises(KeyError, xpp.preprocess, "$(env.UNKNOWN)")
+
+    def test_sys_var(self):
+        xml_str = "<root>$(sys.ARCH)</root>"
+        expected = f"<root>{platform.architecture()[0]}</root>"
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess(xml_str)
+        self.assertEqual(result, expected)
+        self.assertRaises(KeyError, xpp.preprocess, "$(sys.UNKNOWN)")
+
+    def test_cus_var(self):
+        xml_str = "<root>$(var.USER)</root>"
+        expected = "<root></root>"
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess(xml_str)
+        self.assertEqual(result, expected)
+        xml_str = "<?define USER=FOO?><root>$(var.USER)</root>"
+        expected = "<root>FOO</root>"
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess(xml_str)
+        self.assertEqual(result, expected)
+
+    def test_error_warning(self):
+        xml_str = "<root><?warning \"test warn\"?></root>"
+        expected = "<root></root>"
+        xpp = xmlpp.Preprocessor()
+        out = StringIO()
+        with contextlib.redirect_stdout(out):
+            result = xpp.preprocess(xml_str)
+        self.assertEqual(result, expected)
+        self.assertEqual(out.getvalue(), "[Warning]: test warn\n")
+        self.assertRaises(RuntimeError, xpp.preprocess, "<?error \"test\"?>")
+
+    def test_cmd(self):
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess('<root><?cmd "echo hello world"?></root>')
+        self.assertEqual(result, "<root>hello world</root>")
+        self.assertRaises(
+            subprocess.CalledProcessError,
+            xpp.preprocess, '<?cmd "test-unknown-cmd"?>'
+        )
+
+    def test_foreach(self):
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess(
+            '<root><?foreach x in a;b;c?>$(var.x)<?endforeach?></root>'
+        )
+        self.assertEqual(result, "<root>abc</root>")
+
+    def test_if_elseif(self):
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess('<root><?if True?>ok<?endif?></root>')
+        self.assertEqual(result, "<root>ok</root>")
+        result = xpp.preprocess('<root><?if False?>ok<?endif?></root>')
+        self.assertEqual(result, "<root></root>")
+        result = xpp.preprocess('<root><?if True?>ok<?else?>ko<?endif?></root>')
+        self.assertEqual(result, "<root>ok</root>")
+        result = xpp.preprocess('<root><?if False?>ok<?else?>ko<?endif?></root>')
+        self.assertEqual(result, "<root>ko</root>")
+        result = xpp.preprocess(
+            '<root><?if False?>ok<?elseif True?>ok2<?else?>ko<?endif?></root>'
+        )
+        self.assertEqual(result, "<root>ok2</root>")
+        result = xpp.preprocess(
+            '<root><?if False?>ok<?elseif False?>ok<?else?>ko<?endif?></root>'
+        )
+        self.assertEqual(result, "<root>ko</root>")
+
+    def test_ifdef(self):
+        xpp = xmlpp.Preprocessor()
+        result = xpp.preprocess('<root><?ifdef USER?>ok<?else?>ko<?endif?></root>')
+        self.assertEqual(result, "<root>ko</root>")
+        result = xpp.preprocess(
+            '<?define USER=FOO?><root><?ifdef USER?>ok<?else?>ko<?endif?></root>'
+        )
+        self.assertEqual(result, "<root>ok</root>")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/xml-preprocess.py b/scripts/xml-preprocess.py
new file mode 100755
index 0000000000..57f1d28912
--- /dev/null
+++ b/scripts/xml-preprocess.py
@@ -0,0 +1,293 @@
+#!/usr/bin/env python3
+#
+# Copyright (c) 2017-2019 Tony Su
+# Copyright (c) 2023 Red Hat, Inc.
+#
+# SPDX-License-Identifier: MIT
+#
+# Adapted from https://github.com/peitaosu/XML-Preprocessor
+#
+"""This is a XML Preprocessor which can be used to process your XML file before
+you use it, to process conditional statements, variables, iteration
+statements, error/warning, execute command, etc.
+
+## XML Schema
+
+### Include Files
+```
+<?include path/to/file ?>
+```
+
+### Variables
+```
+$(env.EnvironmentVariable)
+
+$(sys.SystemVariable)
+
+$(var.CustomVariable)
+```
+
+### Conditional Statements
+```
+<?if ?>
+
+<?ifdef ?>
+
+<?ifndef ?>
+
+<?else?>
+
+<?elseif ?>
+
+<?endif?>
+```
+
+### Iteration Statements
+```
+<?foreach VARNAME in 1;2;3?>
+    $(var.VARNAME)
+<?endforeach?>
+```
+
+### Errors and Warnings
+```
+<?error "This is error message!" ?>
+
+<?warning "This is warning message!" ?>
+```
+
+### Commands
+```
+<? cmd "echo hello world" ?>
+```
+"""
+
+import os
+import platform
+import re
+import subprocess
+import sys
+from typing import Optional
+from xml.dom import minidom
+
+
+class Preprocessor():
+    """This class holds the XML preprocessing state"""
+
+    def __init__(self):
+        self.sys_vars = {
+            "ARCH": platform.architecture()[0],
+            "SOURCE": os.path.abspath(__file__),
+            "CURRENT": os.getcwd(),
+        }
+        self.cus_vars = {}
+
+    def _pp_include(self, xml_str: str) -> str:
+        include_regex = r"(<\?include([\w\s\\/.:_-]+)\s*\?>)"
+        matches = re.findall(include_regex, xml_str)
+        for group_inc, group_xml in matches:
+            inc_file_path = group_xml.strip()
+            with open(inc_file_path, "r", encoding="utf-8") as inc_file:
+                inc_file_content = inc_file.read()
+                xml_str = xml_str.replace(group_inc, inc_file_content)
+        return xml_str
+
+    def _pp_env_var(self, xml_str: str) -> str:
+        envvar_regex = r"(\$\(env\.(\w+)\))"
+        matches = re.findall(envvar_regex, xml_str)
+        for group_env, group_var in matches:
+            xml_str = xml_str.replace(group_env, os.environ[group_var])
+        return xml_str
+
+    def _pp_sys_var(self, xml_str: str) -> str:
+        sysvar_regex = r"(\$\(sys\.(\w+)\))"
+        matches = re.findall(sysvar_regex, xml_str)
+        for group_sys, group_var in matches:
+            xml_str = xml_str.replace(group_sys, self.sys_vars[group_var])
+        return xml_str
+
+    def _pp_cus_var(self, xml_str: str) -> str:
+        define_regex = r"(<\?define\s*(\w+)\s*=\s*([\w\s\"]+)\s*\?>)"
+        matches = re.findall(define_regex, xml_str)
+        for group_def, group_name, group_var in matches:
+            group_name = group_name.strip()
+            group_var = group_var.strip().strip("\"")
+            self.cus_vars[group_name] = group_var
+            xml_str = xml_str.replace(group_def, "")
+        cusvar_regex = r"(\$\(var\.(\w+)\))"
+        matches = re.findall(cusvar_regex, xml_str)
+        for group_cus, group_var in matches:
+            xml_str = xml_str.replace(
+                group_cus,
+                self.cus_vars.get(group_var, "")
+            )
+        return xml_str
+
+    def _pp_foreach(self, xml_str: str) -> str:
+        foreach_regex = r"(<\?foreach\s+(\w+)\s+in\s+([\w;]+)\s*\?>(.*)<\?endforeach\?>)"
+        matches = re.findall(foreach_regex, xml_str)
+        for group_for, group_name, group_vars, group_text in matches:
+            group_texts = ""
+            for var in group_vars.split(";"):
+                self.cus_vars[group_name] = var
+                group_texts += self._pp_cus_var(group_text)
+            xml_str = xml_str.replace(group_for, group_texts)
+        return xml_str
+
+    def _pp_error_warning(self, xml_str: str) -> str:
+        error_regex = r"<\?error\s*\"([^\"]+)\"\s*\?>"
+        matches = re.findall(error_regex, xml_str)
+        for group_var in matches:
+            raise RuntimeError("[Error]: " + group_var)
+        warning_regex = r"(<\?warning\s*\"([^\"]+)\"\s*\?>)"
+        matches = re.findall(warning_regex, xml_str)
+        for group_wrn, group_var in matches:
+            print("[Warning]: " + group_var)
+            xml_str = xml_str.replace(group_wrn, "")
+        return xml_str
+
+    def _pp_if_eval(self, xml_str: str) -> str:
+        ifelif_regex = (
+            r"(<\?(if|elseif)\s*([^\"\s=<>!]+)\s*([!=<>]+)\s*\"*([^\"=<>!]+)\"*\s*\?>)"
+        )
+        matches = re.findall(ifelif_regex, xml_str)
+        for ifelif, tag, left, operator, right in matches:
+            if "<" in operator or ">" in operator:
+                result = eval(f"{left} {operator} {right}")
+            else:
+                result = eval(f'"{left}" {operator} "{right}"')
+            xml_str = xml_str.replace(ifelif, f"<?{tag} {result}?>")
+        return xml_str
+
+    def _pp_ifdef_ifndef(self, xml_str: str) -> str:
+        ifndef_regex = r"(<\?(ifdef|ifndef)\s*([\w]+)\s*\?>)"
+        matches = re.findall(ifndef_regex, xml_str)
+        for group_ifndef, group_tag, group_var in matches:
+            if group_tag == "ifdef":
+                result = group_var in self.cus_vars
+            else:
+                result = group_var not in self.cus_vars
+            xml_str = xml_str.replace(group_ifndef, f"<?if {result}?>")
+        return xml_str
+
+    def _pp_if_elseif(self, xml_str: str) -> str:
+        if_elif_else_regex = (
+            r"(<\?if\s(True|False)\?>"
+            r"(.*?)"
+            r"<\?elseif\s(True|False)\?>"
+            r"(.*?)"
+            r"<\?else\?>"
+            r"(.*?)"
+            r"<\?endif\?>)"
+        )
+        if_else_regex = (
+            r"(<\?if\s(True|False)\?>"
+            r"(.*?)"
+            r"<\?else\?>"
+            r"(.*?)"
+            r"<\?endif\?>)"
+        )
+        if_regex = r"(<\?if\s(True|False)\?>(.*?)<\?endif\?>)"
+        matches = re.findall(if_elif_else_regex, xml_str, re.DOTALL)
+        for (group_full, group_if, group_if_elif, group_elif,
+             group_elif_else, group_else) in matches:
+            result = ""
+            if group_if == "True":
+                result = group_if_elif
+            elif group_elif == "True":
+                result = group_elif_else
+            else:
+                result = group_else
+            xml_str = xml_str.replace(group_full, result)
+        matches = re.findall(if_else_regex, xml_str, re.DOTALL)
+        for group_full, group_if, group_if_else, group_else in matches:
+            result = ""
+            if group_if == "True":
+                result = group_if_else
+            else:
+                result = group_else
+            xml_str = xml_str.replace(group_full, result)
+        matches = re.findall(if_regex, xml_str, re.DOTALL)
+        for group_full, group_if, group_text in matches:
+            result = ""
+            if group_if == "True":
+                result = group_text
+            xml_str = xml_str.replace(group_full, result)
+        return xml_str
+
+    def _pp_command(self, xml_str: str) -> str:
+        cmd_regex = r"(<\?cmd\s*\"([^\"]+)\"\s*\?>)"
+        matches = re.findall(cmd_regex, xml_str)
+        for group_cmd, group_exec in matches:
+            output = subprocess.check_output(
+                group_exec, shell=True,
+                text=True, stderr=subprocess.STDOUT
+            )
+            xml_str = xml_str.replace(group_cmd, output)
+        return xml_str
+
+    def _pp_blanks(self, xml_str: str) -> str:
+        right_blank_regex = r">[\n\s\t\r]*"
+        left_blank_regex = r"[\n\s\t\r]*<"
+        xml_str = re.sub(right_blank_regex, ">", xml_str)
+        xml_str = re.sub(left_blank_regex, "<", xml_str)
+        return xml_str
+
+    def preprocess(self, xml_str: str) -> str:
+        fns = [
+            self._pp_blanks,
+            self._pp_include,
+            self._pp_foreach,
+            self._pp_env_var,
+            self._pp_sys_var,
+            self._pp_cus_var,
+            self._pp_if_eval,
+            self._pp_ifdef_ifndef,
+            self._pp_if_elseif,
+            self._pp_command,
+            self._pp_error_warning,
+        ]
+
+        while True:
+            changed = False
+            for func in fns:
+                out_xml = func(xml_str)
+                if not changed and out_xml != xml_str:
+                    changed = True
+                xml_str = out_xml
+            if not changed:
+                break
+
+        return xml_str
+
+
+def preprocess_xml(path: str) -> str:
+    with open(path, "r", encoding="utf-8") as original_file:
+        input_xml = original_file.read()
+
+        proc = Preprocessor()
+        return proc.preprocess(input_xml)
+
+
+def save_xml(xml_str: str, path: Optional[str]):
+    xml = minidom.parseString(xml_str)
+    with open(path, "w", encoding="utf-8") if path else sys.stdout as output_file:
+        output_file.write(xml.toprettyxml())
+
+
+def main():
+    if len(sys.argv) < 2:
+        print("Usage: xml-preprocessor input.xml [output.xml]")
+        sys.exit(1)
+
+    output_file = None
+    if len(sys.argv) == 3:
+        output_file = sys.argv[2]
+
+    input_file = sys.argv[1]
+    output_xml = preprocess_xml(input_file)
+    save_xml(output_xml, output_file)
+
+
+if __name__ == "__main__":
+    main()

From 6cc5a6159a0067fefbe0b7912c187018aa4b460a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:42 +0400
Subject: [PATCH 0223/1353] ui/dbus: win32 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

D-Bus doesn't support fd-passing on Windows (AF_UNIX doesn't have
SCM_RIGHTS yet, but there are other means to share objects. I have
proposed various solutions upstream, but none seem fitting enough atm).

To make the "-display dbus" work on Windows, implement an alternative
D-Bus interface where all the 'h' (FDs) arguments are replaced with
'ay' (WSASocketW data), and sockets are passed to the other end via
WSADuplicateSocket().

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-6-marcandre.lureau@redhat.com>
---
 audio/dbusaudio.c    | 44 +++++++++++++++++++++++++++------
 meson.build          |  4 +--
 ui/dbus-chardev.c    | 22 +++++++++++++----
 ui/dbus-console.c    | 59 ++++++++++++++++++++++++++++++++++++++------
 ui/dbus-display1.xml | 28 +++++++++++++++++++++
 ui/dbus.h            |  6 +++++
 ui/meson.build       |  9 ++++++-
 7 files changed, 149 insertions(+), 23 deletions(-)

diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index de59467d9e..7a11fbfb42 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -33,6 +33,7 @@
 #include <gio/gunixfdlist.h>
 #endif
 
+#include "ui/dbus.h"
 #include "ui/dbus-display1.h"
 
 #define AUDIO_CAP "dbus"
@@ -422,7 +423,6 @@ dbus_audio_fini(void *opaque)
     g_free(da);
 }
 
-#ifdef G_OS_UNIX
 static void
 listener_out_vanished_cb(GDBusConnection *connection,
                          gboolean remote_peer_vanished,
@@ -448,7 +448,9 @@ listener_in_vanished_cb(GDBusConnection *connection,
 static gboolean
 dbus_audio_register_listener(AudioState *s,
                              GDBusMethodInvocation *invocation,
+#ifdef G_OS_UNIX
                              GUnixFDList *fd_list,
+#endif
                              GVariant *arg_listener,
                              bool out)
 {
@@ -475,6 +477,11 @@ dbus_audio_register_listener(AudioState *s,
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
 
+#ifdef G_OS_WIN32
+    if (!dbus_win32_import_socket(invocation, arg_listener, &fd)) {
+        return DBUS_METHOD_INVOCATION_HANDLED;
+    }
+#else
     fd = g_unix_fd_list_get(fd_list, g_variant_get_handle(arg_listener), &err);
     if (err) {
         g_dbus_method_invocation_return_error(invocation,
@@ -484,6 +491,7 @@ dbus_audio_register_listener(AudioState *s,
                                               err->message);
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
+#endif
 
     socket = g_socket_new_from_fd(fd, &err);
     if (err) {
@@ -492,15 +500,28 @@ dbus_audio_register_listener(AudioState *s,
                                               DBUS_DISPLAY_ERROR_FAILED,
                                               "Couldn't make a socket: %s",
                                               err->message);
+#ifdef G_OS_WIN32
+        closesocket(fd);
+#else
+        close(fd);
+#endif
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
     socket_conn = g_socket_connection_factory_create_connection(socket);
     if (out) {
         qemu_dbus_display1_audio_complete_register_out_listener(
-            da->iface, invocation, NULL);
+            da->iface, invocation
+#ifdef G_OS_UNIX
+            , NULL
+#endif
+            );
     } else {
         qemu_dbus_display1_audio_complete_register_in_listener(
-            da->iface, invocation, NULL);
+            da->iface, invocation
+#ifdef G_OS_UNIX
+            , NULL
+#endif
+            );
     }
 
     listener_conn =
@@ -578,24 +599,33 @@ dbus_audio_register_listener(AudioState *s,
 static gboolean
 dbus_audio_register_out_listener(AudioState *s,
                                  GDBusMethodInvocation *invocation,
+#ifdef G_OS_UNIX
                                  GUnixFDList *fd_list,
+#endif
                                  GVariant *arg_listener)
 {
     return dbus_audio_register_listener(s, invocation,
-                                        fd_list, arg_listener, true);
+#ifdef G_OS_UNIX
+                                        fd_list,
+#endif
+                                        arg_listener, true);
 
 }
 
 static gboolean
 dbus_audio_register_in_listener(AudioState *s,
                                 GDBusMethodInvocation *invocation,
+#ifdef G_OS_UNIX
                                 GUnixFDList *fd_list,
+#endif
                                 GVariant *arg_listener)
 {
     return dbus_audio_register_listener(s, invocation,
-                                        fd_list, arg_listener, false);
-}
+#ifdef G_OS_UNIX
+                                        fd_list,
 #endif
+                                        arg_listener, false);
+}
 
 static void
 dbus_audio_set_server(AudioState *s, GDBusObjectManagerServer *server, bool p2p)
@@ -610,14 +640,12 @@ dbus_audio_set_server(AudioState *s, GDBusObjectManagerServer *server, bool p2p)
 
     da->audio = g_dbus_object_skeleton_new(DBUS_DISPLAY1_AUDIO_PATH);
     da->iface = qemu_dbus_display1_audio_skeleton_new();
-#ifdef G_OS_UNIX
     g_object_connect(da->iface,
                      "swapped-signal::handle-register-in-listener",
                      dbus_audio_register_in_listener, s,
                      "swapped-signal::handle-register-out-listener",
                      dbus_audio_register_out_listener, s,
                      NULL);
-#endif
 
     g_dbus_object_skeleton_add_interface(G_DBUS_OBJECT_SKELETON(da->audio),
                                          G_DBUS_INTERFACE_SKELETON(da->iface));
diff --git a/meson.build b/meson.build
index b409788832..9a1ce43471 100644
--- a/meson.build
+++ b/meson.build
@@ -838,6 +838,8 @@ if gdbus_codegen.found() and get_option('cfi')
   gdbus_codegen_error = '@0@ uses gdbus-codegen, which does not support control flow integrity'
 endif
 
+xml_pp = find_program('scripts/xml-preprocess.py')
+
 lttng = not_found
 if 'ust' in get_option('trace_backends')
   lttng = dependency('lttng-ust', required: true, version: '>= 2.1',
@@ -1985,8 +1987,6 @@ dbus_display = get_option('dbus_display') \
            error_message: '-display dbus requires glib>=2.64') \
   .require(gdbus_codegen.found(),
            error_message: gdbus_codegen_error.format('-display dbus')) \
-  .require(targetos != 'windows',
-           error_message: '-display dbus is not available on Windows') \
   .allowed()
 
 have_virtfs = get_option('virtfs') \
diff --git a/ui/dbus-chardev.c b/ui/dbus-chardev.c
index 7154d81a9a..1d3a7122a1 100644
--- a/ui/dbus-chardev.c
+++ b/ui/dbus-chardev.c
@@ -110,18 +110,24 @@ dbus_chardev_init(DBusDisplay *dpy)
                          dbus_display_chardev_foreach, dpy);
 }
 
-#ifdef G_OS_UNIX
 static gboolean
 dbus_chr_register(
     DBusChardev *dc,
     GDBusMethodInvocation *invocation,
+#ifdef G_OS_UNIX
     GUnixFDList *fd_list,
+#endif
     GVariant *arg_stream,
     QemuDBusDisplay1Chardev *object)
 {
     g_autoptr(GError) err = NULL;
     int fd;
 
+#ifdef G_OS_WIN32
+    if (!dbus_win32_import_socket(invocation, arg_stream, &fd)) {
+        return DBUS_METHOD_INVOCATION_HANDLED;
+    }
+#else
     fd = g_unix_fd_list_get(fd_list, g_variant_get_handle(arg_stream), &err);
     if (err) {
         g_dbus_method_invocation_return_error(
@@ -131,13 +137,18 @@ dbus_chr_register(
             "Couldn't get peer FD: %s", err->message);
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
+#endif
 
     if (qemu_chr_add_client(CHARDEV(dc), fd) < 0) {
         g_dbus_method_invocation_return_error(invocation,
                                               DBUS_DISPLAY_ERROR,
                                               DBUS_DISPLAY_ERROR_FAILED,
                                               "Couldn't register FD!");
+#ifdef G_OS_WIN32
+        closesocket(fd);
+#else
         close(fd);
+#endif
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
 
@@ -145,10 +156,13 @@ dbus_chr_register(
                  "owner", g_dbus_method_invocation_get_sender(invocation),
                  NULL);
 
-    qemu_dbus_display1_chardev_complete_register(object, invocation, NULL);
+    qemu_dbus_display1_chardev_complete_register(object, invocation
+#ifndef G_OS_WIN32
+                                                 , NULL
+#endif
+        );
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
-#endif
 
 static gboolean
 dbus_chr_send_break(
@@ -179,10 +193,8 @@ dbus_chr_open(Chardev *chr, ChardevBackend *backend,
     dc->iface = qemu_dbus_display1_chardev_skeleton_new();
     g_object_set(dc->iface, "name", backend->u.dbus.data->name, NULL);
     g_object_connect(dc->iface,
-#ifdef G_OS_UNIX
                      "swapped-signal::handle-register",
                      dbus_chr_register, dc,
-#endif
                      "swapped-signal::handle-send-break",
                      dbus_chr_send_break, dc,
                      NULL);
diff --git a/ui/dbus-console.c b/ui/dbus-console.c
index d5f6c93637..4a1c1fb55e 100644
--- a/ui/dbus-console.c
+++ b/ui/dbus-console.c
@@ -165,7 +165,6 @@ dbus_display_console_class_init(DBusDisplayConsoleClass *klass)
     gobject_class->dispose = dbus_display_console_dispose;
 }
 
-#ifdef G_OS_UNIX
 static void
 listener_vanished_cb(DBusDisplayListener *listener)
 {
@@ -177,7 +176,6 @@ listener_vanished_cb(DBusDisplayListener *listener)
     g_hash_table_remove(ddc->listeners, name);
     qkbd_state_lift_all_keys(ddc->kbd);
 }
-#endif
 
 static gboolean
 dbus_console_set_ui_info(DBusDisplayConsole *ddc,
@@ -211,11 +209,47 @@ dbus_console_set_ui_info(DBusDisplayConsole *ddc,
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
 
-#ifdef G_OS_UNIX
+#ifdef G_OS_WIN32
+bool
+dbus_win32_import_socket(GDBusMethodInvocation *invocation,
+                         GVariant *arg_listener, int *socket)
+{
+    gsize n;
+    WSAPROTOCOL_INFOW *info = (void *)g_variant_get_fixed_array(arg_listener, &n, 1);
+
+    if (!info || n != sizeof(*info)) {
+        g_dbus_method_invocation_return_error(
+            invocation,
+            DBUS_DISPLAY_ERROR,
+            DBUS_DISPLAY_ERROR_FAILED,
+            "Failed to get socket infos");
+        return false;
+    }
+
+    *socket = WSASocketW(FROM_PROTOCOL_INFO,
+                         FROM_PROTOCOL_INFO,
+                         FROM_PROTOCOL_INFO,
+                         info, 0, 0);
+    if (*socket == INVALID_SOCKET) {
+        g_autofree gchar *emsg = g_win32_error_message(WSAGetLastError());
+        g_dbus_method_invocation_return_error(
+            invocation,
+            DBUS_DISPLAY_ERROR,
+            DBUS_DISPLAY_ERROR_FAILED,
+            "Couldn't create socket: %s", emsg);
+        return false;
+    }
+
+    return true;
+}
+#endif
+
 static gboolean
 dbus_console_register_listener(DBusDisplayConsole *ddc,
                                GDBusMethodInvocation *invocation,
+#ifdef G_OS_UNIX
                                GUnixFDList *fd_list,
+#endif
                                GVariant *arg_listener)
 {
     const char *sender = g_dbus_method_invocation_get_sender(invocation);
@@ -237,6 +271,11 @@ dbus_console_register_listener(DBusDisplayConsole *ddc,
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
 
+#ifdef G_OS_WIN32
+    if (!dbus_win32_import_socket(invocation, arg_listener, &fd)) {
+        return DBUS_METHOD_INVOCATION_HANDLED;
+    }
+#else
     fd = g_unix_fd_list_get(fd_list, g_variant_get_handle(arg_listener), &err);
     if (err) {
         g_dbus_method_invocation_return_error(
@@ -246,6 +285,7 @@ dbus_console_register_listener(DBusDisplayConsole *ddc,
             "Couldn't get peer fd: %s", err->message);
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
+#endif
 
     socket = g_socket_new_from_fd(fd, &err);
     if (err) {
@@ -254,13 +294,21 @@ dbus_console_register_listener(DBusDisplayConsole *ddc,
             DBUS_DISPLAY_ERROR,
             DBUS_DISPLAY_ERROR_FAILED,
             "Couldn't make a socket: %s", err->message);
+#ifdef G_OS_WIN32
+        closesocket(fd);
+#else
         close(fd);
+#endif
         return DBUS_METHOD_INVOCATION_HANDLED;
     }
     socket_conn = g_socket_connection_factory_create_connection(socket);
 
     qemu_dbus_display1_console_complete_register_listener(
-        ddc->iface, invocation, NULL);
+        ddc->iface, invocation
+#ifdef G_OS_UNIX
+        , NULL
+#endif
+    );
 
     listener_conn = g_dbus_connection_new_sync(
         G_IO_STREAM(socket_conn),
@@ -287,7 +335,6 @@ dbus_console_register_listener(DBusDisplayConsole *ddc,
     trace_dbus_registered_listener(sender);
     return DBUS_METHOD_INVOCATION_HANDLED;
 }
-#endif
 
 static gboolean
 dbus_kbd_press(DBusDisplayConsole *ddc,
@@ -516,10 +563,8 @@ dbus_display_console_new(DBusDisplay *display, QemuConsole *con)
         "device-address", device_addr,
         NULL);
     g_object_connect(ddc->iface,
-#ifdef G_OS_UNIX
         "swapped-signal::handle-register-listener",
         dbus_console_register_listener, ddc,
-#endif
         "swapped-signal::handle-set-uiinfo",
         dbus_console_set_ui_info, ddc,
         NULL);
diff --git a/ui/dbus-display1.xml b/ui/dbus-display1.xml
index cc0c9b68bf..cd596f774e 100644
--- a/ui/dbus-display1.xml
+++ b/ui/dbus-display1.xml
@@ -57,7 +57,13 @@
         :dbus:iface:`org.qemu.Display1.Listener` interface.
     -->
     <method name="RegisterListener">
+      <?if $(env.TARGETOS) == windows?>
+      <arg type="ay" name="listener" direction="in">
+        <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
+      </arg>
+      <?else?>
       <arg type="h" name="listener" direction="in"/>
+      <?endif?>
     </method>
 
     <!--
@@ -334,6 +340,9 @@
       </arg>
     </method>
 
+    <?if $(env.TARGETOS) == windows?>
+    <!-- Add shared memory/texture support -->
+    <?else?>
     <!--
         ScanoutDMABUF:
         @dmabuf: the DMABUF file descriptor.
@@ -372,6 +381,7 @@
       <arg type="i" name="width" direction="in"/>
       <arg type="i" name="height" direction="in"/>
     </method>
+    <?endif?>
 
     <!--
         Disable:
@@ -532,7 +542,13 @@
         :dbus:iface:`org.qemu.Display1.AudioOutListener` interface.
     -->
     <method name="RegisterOutListener">
+      <?if $(env.TARGETOS) == windows?>
+      <arg type="ay" name="listener" direction="in">
+        <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
+      </arg>
+      <?else?>
       <arg type="h" name="listener" direction="in"/>
+      <?endif?>
     </method>
 
     <!--
@@ -547,7 +563,13 @@
         :dbus:iface:`org.qemu.Display1.AudioInListener` interface.
     -->
     <method name="RegisterInListener">
+      <?if $(env.TARGETOS) == windows?>
+      <arg type="ay" name="listener" direction="in">
+        <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
+      </arg>
+      <?else?>
       <arg type="h" name="listener" direction="in"/>
+      <?endif?>
     </method>
   </interface>
 
@@ -760,7 +782,13 @@
         The current handler, if any, will be replaced.
     -->
     <method name="Register">
+      <?if $(env.TARGETOS) == windows?>
+      <arg type="ay" name="listener" direction="in">
+        <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
+      </arg>
+      <?else?>
       <arg type="h" name="stream" direction="in"/>
+      <?endif?>
     </method>
 
     <!--
diff --git a/ui/dbus.h b/ui/dbus.h
index 9c149e7b41..1e8c24a48e 100644
--- a/ui/dbus.h
+++ b/ui/dbus.h
@@ -62,6 +62,12 @@ struct DBusDisplay {
     Notifier notifier;
 };
 
+#ifdef WIN32
+bool
+dbus_win32_import_socket(GDBusMethodInvocation *invocation,
+                         GVariant *arg_listener, int *socket);
+#endif
+
 #define TYPE_DBUS_DISPLAY "dbus-display"
 OBJECT_DECLARE_SIMPLE_TYPE(DBusDisplay, DBUS_DISPLAY)
 
diff --git a/ui/meson.build b/ui/meson.build
index a5506ac8ad..d84650676d 100644
--- a/ui/meson.build
+++ b/ui/meson.build
@@ -74,9 +74,16 @@ endif
 
 if dbus_display
   dbus_ss = ss.source_set()
+  env = environment()
+  env.set('TARGETOS', targetos)
+  xml = custom_target('dbus-display preprocess',
+                      input: 'dbus-display1.xml',
+                      output: 'dbus-display1.xml',
+                      env: env,
+                      command: [xml_pp, '@INPUT@', '@OUTPUT@'])
   dbus_display1 = custom_target('dbus-display gdbus-codegen',
                                 output: ['dbus-display1.h', 'dbus-display1.c'],
-                                input: files('dbus-display1.xml'),
+                                input: xml,
                                 command: [gdbus_codegen, '@INPUT@',
                                           '--glib-min-required', '2.64',
                                           '--output-directory', meson.current_build_dir(),

From ed097649b55065b3b7da0ca54596e876b29c2561 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:43 +0400
Subject: [PATCH 0224/1353] qtest: add qtest_pid()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Used in the following test on win32, to share sockets with the QEMU
process.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230606115658.677673-7-marcandre.lureau@redhat.com>
---
 tests/qtest/libqtest.c | 5 +++++
 tests/qtest/libqtest.h | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index de03ef5f60..79152f0ec3 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -142,6 +142,11 @@ static int socket_accept(int sock)
     return ret;
 }
 
+pid_t qtest_pid(QTestState *s)
+{
+    return s->qemu_pid;
+}
+
 bool qtest_probe_child(QTestState *s)
 {
     pid_t pid = s->qemu_pid;
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index a12acf7fa9..913acc3d5c 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -985,4 +985,13 @@ void qtest_qom_set_bool(QTestState *s, const char *path, const char *property,
  * Returns: Value retrieved from property.
  */
 bool qtest_qom_get_bool(QTestState *s, const char *path, const char *property);
+
+/**
+ * qtest_pid:
+ * @s: QTestState instance to operate on.
+ *
+ * Returns: the PID of the QEMU process, or <= 0
+ */
+pid_t qtest_pid(QTestState *s);
+
 #endif

From 306d75815c57c8449bed8d0964b97c3f1acf2134 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:44 +0400
Subject: [PATCH 0225/1353] tests: make dbus-display-test work on win32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230606115658.677673-8-marcandre.lureau@redhat.com>
---
 tests/qtest/dbus-display-test.c | 43 ++++++++++++++++++++++++++++++---
 tests/qtest/meson.build         |  2 +-
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/dbus-display-test.c b/tests/qtest/dbus-display-test.c
index fef025ac6f..21edaa1e32 100644
--- a/tests/qtest/dbus-display-test.c
+++ b/tests/qtest/dbus-display-test.c
@@ -1,4 +1,5 @@
 #include "qemu/osdep.h"
+#include "qemu/sockets.h"
 #include "qemu/dbus.h"
 #include "qemu/sockets.h"
 #include <gio/gio.h>
@@ -14,7 +15,11 @@ test_dbus_p2p_from_fd(int fd)
     g_autoptr(GSocketConnection) socketc = NULL;
     GDBusConnection *conn;
 
+#ifdef WIN32
+    socket = g_socket_new_from_fd(_get_osfhandle(fd), &err);
+#else
     socket = g_socket_new_from_fd(fd, &err);
+#endif
     g_assert_no_error(err);
 
     socketc = g_socket_connection_factory_create_connection(socket);
@@ -126,7 +131,10 @@ test_dbus_console_registered(GObject *source_object,
 
     qemu_dbus_display1_console_call_register_listener_finish(
         QEMU_DBUS_DISPLAY1_CONSOLE(source_object),
-        NULL, res, &err);
+#ifndef WIN32
+        NULL,
+#endif
+        res, &err);
     g_assert_no_error(err);
 
     test->listener_conn = g_thread_join(test->thread);
@@ -145,17 +153,25 @@ test_dbus_display_console(void)
     g_autoptr(GError) err = NULL;
     g_autoptr(GDBusConnection) conn = NULL;
     g_autoptr(QemuDBusDisplay1ConsoleProxy) console = NULL;
-    g_autoptr(GUnixFDList) fd_list = NULL;
     g_autoptr(GMainLoop) loop = NULL;
     QTestState *qts = NULL;
-    int pair[2], idx;
+    int pair[2];
     TestDBusConsoleRegister test;
+#ifdef WIN32
+    WSAPROTOCOL_INFOW info;
+    g_autoptr(GVariant) listener = NULL;
+#else
+    g_autoptr(GUnixFDList) fd_list = NULL;
+    int idx;
+#endif
 
     test_setup(&qts, &conn);
 
     g_assert_cmpint(qemu_socketpair(AF_UNIX, SOCK_STREAM, 0, pair), ==, 0);
+#ifndef WIN32
     fd_list = g_unix_fd_list_new();
     idx = g_unix_fd_list_append(fd_list, pair[1], NULL);
+#endif
 
     console = QEMU_DBUS_DISPLAY1_CONSOLE_PROXY(
         qemu_dbus_display1_console_proxy_new_sync(
@@ -171,12 +187,33 @@ test_dbus_display_console(void)
     test.thread = g_thread_new(NULL, test_dbus_p2p_server_setup_thread,
                                GINT_TO_POINTER(pair[0]));
 
+#ifdef WIN32
+    if (WSADuplicateSocketW(_get_osfhandle(pair[1]),
+                            GetProcessId((HANDLE) qtest_pid(qts)),
+                            &info) == SOCKET_ERROR)
+    {
+        g_autofree char *emsg = g_win32_error_message(WSAGetLastError());
+        g_error("WSADuplicateSocket failed: %s", emsg);
+    }
+    close(pair[1]);
+    listener = g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE,
+                                         &info,
+                                         sizeof(info),
+                                         1);
+#endif
+
     qemu_dbus_display1_console_call_register_listener(
         QEMU_DBUS_DISPLAY1_CONSOLE(console),
+#ifdef WIN32
+        listener,
+#else
         g_variant_new_handle(idx),
+#endif
         G_DBUS_CALL_FLAGS_NONE,
         -1,
+#ifndef WIN32
         fd_list,
+#endif
         NULL,
         test_dbus_console_registered,
         &test);
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 5fa6833ad7..74630f6672 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -104,7 +104,7 @@ qtests_i386 = \
    'numa-test'
   ]
 
-if dbus_display and targetos != 'windows'
+if dbus_display
   qtests_i386 += ['dbus-display-test']
 endif
 

From 439e0164cd83bf50095e6f66bb036b43a65a68b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:45 +0400
Subject: [PATCH 0226/1353] ui/dbus: introduce "Interfaces" properties
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This property is similar to ``org.freedesktop.DBus.Interfaces`` property
on the bus interface: it's an array of strings listing the extra
interfaces and capabilities available, in a convenient way.

Most interfaces are implicit, as they are required. For
``org/qemu/Display1_$id``, we can list the Keyboard And Mouse
interfaces. Those could be optional.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-9-marcandre.lureau@redhat.com>
---
 ui/dbus-console.c    |   7 +++
 ui/dbus-display1.xml | 118 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 123 insertions(+), 2 deletions(-)

diff --git a/ui/dbus-console.c b/ui/dbus-console.c
index 4a1c1fb55e..aaa9d3b0b3 100644
--- a/ui/dbus-console.c
+++ b/ui/dbus-console.c
@@ -537,6 +537,12 @@ dbus_display_console_new(DBusDisplay *display, QemuConsole *con)
     char device_addr[256] = "";
     DBusDisplayConsole *ddc;
     int idx, i;
+    const char *interfaces[] = {
+        "org.qemu.Display1.Keyboard",
+        "org.qemu.Display1.Mouse",
+        "org.qemu.Display1.MultiTouch",
+        NULL
+    };
 
     assert(display);
     assert(con);
@@ -561,6 +567,7 @@ dbus_display_console_new(DBusDisplay *display, QemuConsole *con)
         "width", qemu_console_get_width(con, 0),
         "height", qemu_console_get_height(con, 0),
         "device-address", device_addr,
+        "interfaces", interfaces,
         NULL);
     g_object_connect(ddc->iface,
         "swapped-signal::handle-register-listener",
diff --git a/ui/dbus-display1.xml b/ui/dbus-display1.xml
index cd596f774e..06e8779c04 100644
--- a/ui/dbus-display1.xml
+++ b/ui/dbus-display1.xml
@@ -26,6 +26,20 @@
         The list of consoles available on ``/org/qemu/Display1/Console_$id``.
     -->
     <property name="ConsoleIDs" type="au" access="read"/>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        /org/qemu/Display1/VM object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
@@ -127,12 +141,27 @@
         The device address (ex: "pci/0000/02.0").
     -->
     <property name="DeviceAddress" type="s" access="read"/>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        ``/org/qemu/Display1/Console_$id`` object, and can be used to detect the
+        capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
       org.qemu.Display1.Keyboard:
 
-      This interface in implemented on ``/org/qemu/Display1/Console_$id`` (see
+      This interface is optionally implemented on
+      ``/org/qemu/Display1/Console_$id`` (see
       :dbus:iface:`~org.qemu.Display1.Console`).
   -->
   <interface name="org.qemu.Display1.Keyboard">
@@ -171,7 +200,8 @@
   <!--
       org.qemu.Display1.Mouse:
 
-      This interface in implemented on ``/org/qemu/Display1/Console_$id`` (see
+      This interface is optionally implemented on
+      ``/org/qemu/Display1/Console_$id`` (see
       :dbus:iface:`~org.qemu.Display1.Console` documentation).
 
       .. _dbus-button-values:
@@ -425,6 +455,20 @@
         <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
       </arg>
     </method>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        /org/qemu/Display1/Listener object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
@@ -522,6 +566,20 @@
         <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
       </arg>
     </method>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        /org/qemu/Display1/Clipboard object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
@@ -571,6 +629,20 @@
       <arg type="h" name="listener" direction="in"/>
       <?endif?>
     </method>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        /org/qemu/Display1/Audio object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
@@ -657,6 +729,20 @@
         <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
       </arg>
     </method>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        /org/qemu/Display1/AudioOutListener object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
@@ -745,6 +831,20 @@
         <annotation name="org.gtk.GDBus.C.ForceGVariant" value="true"/>
       </arg>
     </method>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        /org/qemu/Display1/AudioInListener object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 
   <!--
@@ -826,5 +926,19 @@
         The D-Bus unique name of the registered handler.
     -->
     <property name="Owner" type="s" access="read"/>
+
+    <!--
+        Interfaces:
+
+        This property lists extra interfaces provided by the
+        ``/org/qemu/Display1/Chardev_$i`` object, and can be used to detect
+        the capabilities with which they are communicating.
+
+        Unlike the standard D-Bus Introspectable interface, querying this
+        property does not require parsing XML.
+
+        (earlier version of the display interface do not provide this property)
+    -->
+    <property name="Interfaces" type="as" access="read"/>
   </interface>
 </node>

From 09b4c198b80c3f5c9c051bc8d8935668cdd206e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:46 +0400
Subject: [PATCH 0227/1353] console/win32: allocate shareable display surface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce qemu_win32_map_alloc() and qemu_win32_map_free() to allocate
shared memory mapping. The handle can be used to share the mapping with
another process.

Teach qemu_create_displaysurface() to allocate shared memory. Following
patches will introduce other places for shared memory allocation.

Other patches for -display dbus will share the memory when possible with
the client, to avoid expensive memory copy between the processes.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-10-marcandre.lureau@redhat.com>
---
 include/sysemu/os-win32.h |  3 ++
 include/ui/console.h      |  8 ++++++
 ui/console.c              | 59 ++++++++++++++++++++++++++++++++++-----
 ui/qemu-pixman.c          |  1 +
 ui/trace-events           |  2 +-
 util/oslib-win32.c        | 33 ++++++++++++++++++++++
 util/trace-events         |  4 +++
 7 files changed, 102 insertions(+), 8 deletions(-)

diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index 65f6c9ea57..91aa0d7ec0 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -263,6 +263,9 @@ EXCEPTION_DISPOSITION
 win32_close_exception_handler(struct _EXCEPTION_RECORD*, void*,
                               struct _CONTEXT*, void*);
 
+void *qemu_win32_map_alloc(size_t size, HANDLE *h, Error **errp);
+void qemu_win32_map_free(void *ptr, HANDLE h, Error **errp);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/ui/console.h b/include/ui/console.h
index 2093e2a3ba..2ab0c7112a 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -143,6 +143,10 @@ typedef struct DisplaySurface {
     GLenum gltype;
     GLuint texture;
 #endif
+#ifdef WIN32
+    HANDLE handle;
+    uint32_t handle_offset;
+#endif
 } DisplaySurface;
 
 typedef struct QemuUIInfo {
@@ -329,6 +333,10 @@ DisplaySurface *qemu_create_displaysurface_from(int width, int height,
 DisplaySurface *qemu_create_displaysurface_pixman(pixman_image_t *image);
 DisplaySurface *qemu_create_placeholder_surface(int w, int h,
                                                 const char *msg);
+#ifdef WIN32
+void qemu_displaysurface_win32_set_handle(DisplaySurface *surface,
+                                          HANDLE h, uint32_t offset);
+#endif
 PixelFormat qemu_default_pixelformat(int bpp);
 
 DisplaySurface *qemu_create_displaysurface(int width, int height);
diff --git a/ui/console.c b/ui/console.c
index cfaa43e970..4957110723 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1513,18 +1513,59 @@ static QemuConsole *new_console(DisplayState *ds, console_type_t console_type,
     return s;
 }
 
+#ifdef WIN32
+void qemu_displaysurface_win32_set_handle(DisplaySurface *surface,
+                                          HANDLE h, uint32_t offset)
+{
+    assert(!surface->handle);
+
+    surface->handle = h;
+    surface->handle_offset = offset;
+}
+
+static void
+win32_pixman_image_destroy(pixman_image_t *image, void *data)
+{
+    DisplaySurface *surface = data;
+
+    if (!surface->handle) {
+        return;
+    }
+
+    assert(surface->handle_offset == 0);
+
+    qemu_win32_map_free(
+        pixman_image_get_data(surface->image),
+        surface->handle,
+        &error_warn
+    );
+}
+#endif
+
 DisplaySurface *qemu_create_displaysurface(int width, int height)
 {
-    DisplaySurface *surface = g_new0(DisplaySurface, 1);
+    DisplaySurface *surface;
+    void *bits = NULL;
+#ifdef WIN32
+    HANDLE handle = NULL;
+#endif
 
-    trace_displaysurface_create(surface, width, height);
-    surface->format = PIXMAN_x8r8g8b8;
-    surface->image = pixman_image_create_bits(surface->format,
-                                              width, height,
-                                              NULL, width * 4);
-    assert(surface->image != NULL);
+    trace_displaysurface_create(width, height);
+
+#ifdef WIN32
+    bits = qemu_win32_map_alloc(width * height * 4, &handle, &error_abort);
+#endif
+
+    surface = qemu_create_displaysurface_from(
+        width, height,
+        PIXMAN_x8r8g8b8,
+        width * 4, bits
+    );
     surface->flags = QEMU_ALLOCATED_FLAG;
 
+#ifdef WIN32
+    qemu_displaysurface_win32_set_handle(surface, handle, 0);
+#endif
     return surface;
 }
 
@@ -1540,6 +1581,10 @@ DisplaySurface *qemu_create_displaysurface_from(int width, int height,
                                               width, height,
                                               (void *)data, linesize);
     assert(surface->image != NULL);
+#ifdef WIN32
+    pixman_image_set_destroy_function(surface->image,
+                                      win32_pixman_image_destroy, surface);
+#endif
 
     return surface;
 }
diff --git a/ui/qemu-pixman.c b/ui/qemu-pixman.c
index 3ab7e2e958..e4f024a85e 100644
--- a/ui/qemu-pixman.c
+++ b/ui/qemu-pixman.c
@@ -6,6 +6,7 @@
 #include "qemu/osdep.h"
 #include "ui/console.h"
 #include "standard-headers/drm/drm_fourcc.h"
+#include "trace.h"
 
 PixelFormat qemu_pixelformat_from_pixman(pixman_format_code_t format)
 {
diff --git a/ui/trace-events b/ui/trace-events
index 138a09cc03..a71895c479 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -9,7 +9,7 @@ console_putchar_unhandled(int ch) "unhandled escape character '%c'"
 console_txt_new(int w, int h) "%dx%d"
 console_select(int nr) "%d"
 console_refresh(int interval) "interval %d ms"
-displaysurface_create(void *display_surface, int w, int h) "surface=%p, %dx%d"
+displaysurface_create(int w, int h) "%dx%d"
 displaysurface_create_from(void *display_surface, int w, int h, uint32_t format) "surface=%p, %dx%d, format 0x%x"
 displaysurface_create_pixman(void *display_surface) "surface=%p"
 displaysurface_free(void *display_surface) "surface=%p"
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index fafbab80b4..429542face 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -835,3 +835,36 @@ int qemu_msync(void *addr, size_t length, int fd)
      */
     return qemu_fdatasync(fd);
 }
+
+void *qemu_win32_map_alloc(size_t size, HANDLE *h, Error **errp)
+{
+    void *bits;
+
+    trace_win32_map_alloc(size);
+
+    *h = CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0,
+                          size, NULL);
+    if (*h == NULL) {
+        error_setg_win32(errp, GetLastError(), "Failed to CreateFileMapping");
+        return NULL;
+    }
+
+    bits = MapViewOfFile(*h, FILE_MAP_ALL_ACCESS, 0, 0, size);
+    if (bits == NULL) {
+        error_setg_win32(errp, GetLastError(), "Failed to MapViewOfFile");
+        CloseHandle(*h);
+        return NULL;
+    }
+
+    return bits;
+}
+
+void qemu_win32_map_free(void *ptr, HANDLE h, Error **errp)
+{
+    trace_win32_map_free(ptr, h);
+
+    if (UnmapViewOfFile(ptr) == 0) {
+        error_setg_win32(errp, GetLastError(), "Failed to UnmapViewOfFile");
+    }
+    CloseHandle(h);
+}
diff --git a/util/trace-events b/util/trace-events
index 3f7e766683..49a4962e18 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -52,6 +52,10 @@ qemu_anon_ram_alloc(size_t size, void *ptr) "size %zu ptr %p"
 qemu_vfree(void *ptr) "ptr %p"
 qemu_anon_ram_free(void *ptr, size_t size) "ptr %p size %zu"
 
+# oslib-win32.c
+win32_map_alloc(size_t size) "size:%zd"
+win32_map_free(void *ptr, void *h) "ptr:%p handle:%p"
+
 # hbitmap.c
 hbitmap_iter_skip_words(const void *hb, void *hbi, uint64_t pos, unsigned long cur) "hb %p hbi %p pos %"PRId64" cur 0x%lx"
 hbitmap_reset(void *hb, uint64_t start, uint64_t count, uint64_t sbit, uint64_t ebit) "hb %p items %"PRIu64",%"PRIu64" bits %"PRIu64"..%"PRIu64

From 9462ff4695aa0d086fd63f7f2efafe5a05f2a243 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:47 +0400
Subject: [PATCH 0228/1353] virtio-gpu/win32: allocate shareable 2d
 resources/images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allocate pixman bits for scanouts with qemu_win32_map_alloc() so we can
set a shareable handle on the associated display surface.

Note: when bits are provided to pixman_image_create_bits(), you must also give
the rowstride (the argument is ignored when bits is NULL)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-11-marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu.c        | 46 +++++++++++++++++++++++++++++++---
 include/hw/virtio/virtio-gpu.h |  3 +++
 2 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 1f8a5b16c6..347e17d490 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -258,6 +258,16 @@ static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
     return height * stride;
 }
 
+#ifdef WIN32
+static void
+win32_pixman_image_destroy(pixman_image_t *image, void *data)
+{
+    HANDLE handle = data;
+
+    qemu_win32_map_free(pixman_image_get_data(image), handle, &error_warn);
+}
+#endif
+
 static void virtio_gpu_resource_create_2d(VirtIOGPU *g,
                                           struct virtio_gpu_ctrl_command *cmd)
 {
@@ -304,12 +314,27 @@ static void virtio_gpu_resource_create_2d(VirtIOGPU *g,
 
     res->hostmem = calc_image_hostmem(pformat, c2d.width, c2d.height);
     if (res->hostmem + g->hostmem < g->conf_max_hostmem) {
+        void *bits = NULL;
+#ifdef WIN32
+        bits = qemu_win32_map_alloc(res->hostmem, &res->handle, &error_warn);
+        if (!bits) {
+            goto end;
+        }
+#endif
         res->image = pixman_image_create_bits(pformat,
                                               c2d.width,
                                               c2d.height,
-                                              NULL, 0);
+                                              bits, res->hostmem / c2d.height);
+#ifdef WIN32
+        if (res->image) {
+            pixman_image_set_destroy_function(res->image, win32_pixman_image_destroy, res->handle);
+        }
+#endif
     }
 
+#ifdef WIN32
+end:
+#endif
     if (!res->image) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: resource creation failed %d %d %d\n",
@@ -685,6 +710,9 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
             *error = VIRTIO_GPU_RESP_ERR_UNSPEC;
             return;
         }
+#ifdef WIN32
+        qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, fb->offset);
+#endif
 
         pixman_image_unref(rect);
         dpy_gfx_replace_surface(g->parent_obj.scanout[scanout_id].con,
@@ -1228,6 +1256,7 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
     struct virtio_gpu_simple_resource *res;
     struct virtio_gpu_scanout *scanout;
     uint32_t resource_id, pformat;
+    void *bits = NULL;
     int i;
 
     g->hostmem = 0;
@@ -1252,15 +1281,23 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
             g_free(res);
             return -EINVAL;
         }
+
+        res->hostmem = calc_image_hostmem(pformat, res->width, res->height);
+#ifdef WIN32
+        bits = qemu_win32_map_alloc(res->hostmem, &res->handle, &error_warn);
+        if (!bits) {
+            g_free(res);
+            return -EINVAL;
+        }
+#endif
         res->image = pixman_image_create_bits(pformat,
                                               res->width, res->height,
-                                              NULL, 0);
+                                              bits, res->hostmem / res->height);
         if (!res->image) {
             g_free(res);
             return -EINVAL;
         }
 
-        res->hostmem = calc_image_hostmem(pformat, res->width, res->height);
 
         res->addrs = g_new(uint64_t, res->iov_cnt);
         res->iov = g_new(struct iovec, res->iov_cnt);
@@ -1321,6 +1358,9 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
         if (!scanout->ds) {
             return -EINVAL;
         }
+#ifdef WIN32
+        qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, 0);
+#endif
 
         dpy_gfx_replace_surface(scanout->con, scanout->ds);
         dpy_gfx_update_full(scanout->con);
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 2e28507efe..7a5f8056ea 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -48,6 +48,9 @@ struct virtio_gpu_simple_resource {
     unsigned int iov_cnt;
     uint32_t scanout_bitmask;
     pixman_image_t *image;
+#ifdef WIN32
+    HANDLE handle;
+#endif
     uint64_t hostmem;
 
     uint64_t blob_size;

From 48dddba1763b2134e81ae6765b19184fd907f142 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:48 +0400
Subject: [PATCH 0229/1353] ui/dbus: use shared memory when possible on win32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the display surface has an associated HANDLE, we can duplicate it
to the client process and let it map the memory to avoid expensive copies.

Introduce two new win32-specific methods ScanoutMap and UpdateMap. The
first is used to inform the listener about the a shared map
availability, and the second for display updates.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-12-marcandre.lureau@redhat.com>
---
 ui/dbus-display1.xml |  48 ++++++++++++-
 ui/dbus-listener.c   | 165 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 208 insertions(+), 5 deletions(-)

diff --git a/ui/dbus-display1.xml b/ui/dbus-display1.xml
index 06e8779c04..7233286b28 100644
--- a/ui/dbus-display1.xml
+++ b/ui/dbus-display1.xml
@@ -370,9 +370,7 @@
       </arg>
     </method>
 
-    <?if $(env.TARGETOS) == windows?>
-    <!-- Add shared memory/texture support -->
-    <?else?>
+    <?if $(env.TARGETOS) != windows?>
     <!--
         ScanoutDMABUF:
         @dmabuf: the DMABUF file descriptor.
@@ -471,6 +469,50 @@
     <property name="Interfaces" type="as" access="read"/>
   </interface>
 
+  <!--
+      org.qemu.Display1.Listener.Win32.Map:
+
+      This client-side interface can complement org.qemu.Display1.Listener on
+      ``/org/qemu/Display1/Listener`` for Windows specific methods.
+  -->
+  <interface name="org.qemu.Display1.Listener.Win32.Map">
+    <!--
+        ScanoutMap:
+        @handle: the shared map handle value.
+        @offset: mapping offset.
+        @width: display width, in pixels.
+        @height: display height, in pixels.
+        @stride: stride, in bytes.
+        @pixman_format: image format (ex: ``PIXMAN_X8R8G8B8``).
+
+        Resize and update the display content with a shared map.
+    -->
+    <method name="ScanoutMap">
+      <arg type="t" name="handle" direction="in"/>
+      <arg type="u" name="offset" direction="in"/>
+      <arg type="u" name="width" direction="in"/>
+      <arg type="u" name="height" direction="in"/>
+      <arg type="u" name="stride" direction="in"/>
+      <arg type="u" name="pixman_format" direction="in"/>
+    </method>
+
+    <!--
+        UpdateMap:
+        @x: the X update position, in pixels.
+        @y: the Y update position, in pixels.
+        @width: the update width, in pixels.
+        @height: the update height, in pixels.
+
+        Update the display content with the current shared map and the given region.
+    -->
+    <method name="UpdateMap">
+      <arg type="i" name="x" direction="in"/>
+      <arg type="i" name="y" direction="in"/>
+      <arg type="i" name="width" direction="in"/>
+      <arg type="i" name="height" direction="in"/>
+    </method>
+  </interface>
+
   <!--
       org.qemu.Display1.Clipboard:
 
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 41597a0078..f6b1cd11be 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -48,6 +48,14 @@ struct _DBusDisplayListener {
     DisplayChangeListener dcl;
     DisplaySurface *ds;
     int gl_updates;
+
+    bool ds_mapped;
+    bool can_share_map;
+
+#ifdef WIN32
+    QemuDBusDisplay1ListenerWin32Map *map_proxy;
+    HANDLE peer_process;
+#endif
 };
 
 G_DEFINE_TYPE(DBusDisplayListener, dbus_display_listener, G_TYPE_OBJECT)
@@ -119,7 +127,61 @@ static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
         fd_list,
         NULL, NULL, NULL);
 }
+#endif /* OPENGL & GBM */
 
+#ifdef WIN32
+static bool dbus_scanout_map(DBusDisplayListener *ddl)
+{
+    g_autoptr(GError) err = NULL;
+    BOOL success;
+    HANDLE target_handle;
+
+    if (ddl->ds_mapped) {
+        return true;
+    }
+
+    if (!ddl->can_share_map || !ddl->ds->handle) {
+        return false;
+    }
+
+    success = DuplicateHandle(
+        GetCurrentProcess(),
+        ddl->ds->handle,
+        ddl->peer_process,
+        &target_handle,
+        FILE_MAP_READ | SECTION_QUERY,
+        FALSE, 0);
+    if (!success) {
+        g_autofree char *msg = g_win32_error_message(GetLastError());
+        g_debug("Failed to DuplicateHandle: %s", msg);
+        ddl->can_share_map = false;
+        return false;
+    }
+
+    if (!qemu_dbus_display1_listener_win32_map_call_scanout_map_sync(
+            ddl->map_proxy,
+            GPOINTER_TO_UINT(target_handle),
+            ddl->ds->handle_offset,
+            surface_width(ddl->ds),
+            surface_height(ddl->ds),
+            surface_stride(ddl->ds),
+            surface_format(ddl->ds),
+            G_DBUS_CALL_FLAGS_NONE,
+            DBUS_DEFAULT_TIMEOUT,
+            NULL,
+            &err)) {
+        g_debug("Failed to call ScanoutMap: %s", err->message);
+        ddl->can_share_map = false;
+        return false;
+    }
+
+    ddl->ds_mapped = true;
+
+    return true;
+}
+#endif
+
+#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
 static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                  uint32_t tex_id,
                                  bool backing_y_0_top,
@@ -239,7 +301,7 @@ static void dbus_gl_refresh(DisplayChangeListener *dcl)
         ddl->gl_updates = 0;
     }
 }
-#endif
+#endif /* OPENGL & GBM */
 
 static void dbus_refresh(DisplayChangeListener *dcl)
 {
@@ -265,10 +327,20 @@ static void dbus_gfx_update(DisplayChangeListener *dcl,
     size_t stride;
 
     assert(ddl->ds);
-    stride = w * DIV_ROUND_UP(PIXMAN_FORMAT_BPP(surface_format(ddl->ds)), 8);
 
     trace_dbus_update(x, y, w, h);
 
+#ifdef WIN32
+    if (dbus_scanout_map(ddl)) {
+        qemu_dbus_display1_listener_win32_map_call_update_map(
+            ddl->map_proxy,
+            x, y, w, h,
+            G_DBUS_CALL_FLAGS_NONE,
+            DBUS_DEFAULT_TIMEOUT, NULL, NULL, NULL);
+        return;
+    }
+#endif
+
     if (x == 0 && y == 0 && w == surface_width(ddl->ds) && h == surface_height(ddl->ds)) {
         v_data = g_variant_new_from_data(
             G_VARIANT_TYPE("ay"),
@@ -290,6 +362,7 @@ static void dbus_gfx_update(DisplayChangeListener *dcl,
     }
 
     /* make a copy, since gvariant only handles linear data */
+    stride = w * DIV_ROUND_UP(PIXMAN_FORMAT_BPP(surface_format(ddl->ds)), 8);
     img = pixman_image_create_bits(surface_format(ddl->ds),
                                    w, h, NULL, stride);
     pixman_image_composite(PIXMAN_OP_SRC, ddl->ds->image, NULL, img,
@@ -333,6 +406,9 @@ static void dbus_gfx_switch(DisplayChangeListener *dcl,
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
 
     ddl->ds = new_surface;
+#ifdef WIN32
+    ddl->ds_mapped = false;
+#endif
     if (!ddl->ds) {
         /* why not call disable instead? */
         return;
@@ -414,6 +490,10 @@ dbus_display_listener_dispose(GObject *object)
     g_clear_object(&ddl->conn);
     g_clear_pointer(&ddl->bus_name, g_free);
     g_clear_object(&ddl->proxy);
+#ifdef WIN32
+    g_clear_object(&ddl->map_proxy);
+    g_clear_pointer(&ddl->peer_process, CloseHandle);
+#endif
 
     G_OBJECT_CLASS(dbus_display_listener_parent_class)->dispose(object);
 }
@@ -459,6 +539,85 @@ dbus_display_listener_get_console(DBusDisplayListener *ddl)
     return ddl->console;
 }
 
+#ifdef WIN32
+static bool
+dbus_display_listener_implements(DBusDisplayListener *ddl, const char *iface)
+{
+    QemuDBusDisplay1Listener *l = QEMU_DBUS_DISPLAY1_LISTENER(ddl->proxy);
+    bool implements;
+
+    implements = g_strv_contains(qemu_dbus_display1_listener_get_interfaces(l), iface);
+    if (!implements) {
+        g_debug("Display listener does not implement: `%s`", iface);
+    }
+
+    return implements;
+}
+#endif
+
+static void
+dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
+{
+#ifdef WIN32
+    g_autoptr(GError) err = NULL;
+    GDBusConnection *conn;
+    GIOStream *stream;
+    GSocket *sock;
+    g_autoptr(GCredentials) creds = NULL;
+    DWORD *pid;
+
+    if (!dbus_display_listener_implements(ddl, "org.qemu.Display1.Listener.Win32.Map")) {
+        return;
+    }
+
+    conn = g_dbus_proxy_get_connection(G_DBUS_PROXY(ddl->proxy));
+    stream = g_dbus_connection_get_stream(conn);
+
+    if (!G_IS_UNIX_CONNECTION(stream)) {
+        return;
+    }
+
+    sock = g_socket_connection_get_socket(G_SOCKET_CONNECTION(stream));
+    creds = g_socket_get_credentials(sock, &err);
+
+    if (!creds) {
+        g_debug("Failed to get peer credentials: %s", err->message);
+        return;
+    }
+
+    pid = g_credentials_get_native(creds, G_CREDENTIALS_TYPE_WIN32_PID);
+
+    if (pid == NULL) {
+        g_debug("Failed to get peer PID");
+        return;
+    }
+
+    ddl->peer_process = OpenProcess(
+        PROCESS_DUP_HANDLE | PROCESS_QUERY_INFORMATION,
+        false, *pid);
+
+    if (!ddl->peer_process) {
+        g_autofree char *msg = g_win32_error_message(GetLastError());
+        g_debug("Failed to OpenProcess: %s", msg);
+        return;
+    }
+
+    ddl->map_proxy =
+        qemu_dbus_display1_listener_win32_map_proxy_new_sync(conn,
+            G_DBUS_PROXY_FLAGS_DO_NOT_AUTO_START,
+            NULL,
+            "/org/qemu/Display1/Listener",
+            NULL,
+            &err);
+    if (!ddl->map_proxy) {
+        g_debug("Failed to setup win32 map proxy: %s", err->message);
+        return;
+    }
+
+    ddl->can_share_map = true;
+#endif
+}
+
 DBusDisplayListener *
 dbus_display_listener_new(const char *bus_name,
                           GDBusConnection *conn,
@@ -487,6 +646,8 @@ dbus_display_listener_new(const char *bus_name,
     ddl->conn = conn;
     ddl->console = console;
 
+    dbus_display_listener_setup_shared_map(ddl);
+
     con = qemu_console_lookup_by_index(dbus_display_console_get_index(console));
     assert(con);
     ddl->dcl.con = con;

From 39324b49669c72b00cf3adc93d9dc7cf702bf11f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:49 +0400
Subject: [PATCH 0230/1353] ui: add egl-headless support on win32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make GBM optional for EGL code, and enable the build for win32.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-13-marcandre.lureau@redhat.com>
---
 include/ui/egl-helpers.h |  7 ++++++-
 qapi/ui.json             |  5 ++---
 ui/egl-headless.c        | 20 +++++++++++++-------
 ui/egl-helpers.c         | 38 +++++++++++++++++++++++++++++++-------
 ui/meson.build           |  6 +++---
 5 files changed, 55 insertions(+), 21 deletions(-)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 2cf6633ad2..6c4eb5dd70 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -36,11 +36,12 @@ void egl_texture_blit(QemuGLShader *gls, egl_fb *dst, egl_fb *src, bool flip);
 void egl_texture_blend(QemuGLShader *gls, egl_fb *dst, egl_fb *src, bool flip,
                        int x, int y, double scale_x, double scale_y);
 
+extern EGLContext qemu_egl_rn_ctx;
+
 #ifdef CONFIG_GBM
 
 extern int qemu_egl_rn_fd;
 extern struct gbm_device *qemu_egl_rn_gbm_dev;
-extern EGLContext qemu_egl_rn_ctx;
 
 int egl_rendernode_init(const char *rendernode, DisplayGLMode mode);
 int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc,
@@ -62,6 +63,10 @@ int qemu_egl_init_dpy_mesa(EGLNativeDisplayType dpy, DisplayGLMode mode);
 
 #endif
 
+#ifdef WIN32
+int qemu_egl_init_dpy_win32(EGLNativeDisplayType dpy, DisplayGLMode mode);
+#endif
+
 EGLContext qemu_egl_init_ctx(void);
 bool qemu_egl_has_dmabuf(void);
 
diff --git a/qapi/ui.json b/qapi/ui.json
index 2755395483..bb06fb6039 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1484,8 +1484,7 @@
     { 'name': 'none' },
     { 'name': 'gtk', 'if': 'CONFIG_GTK' },
     { 'name': 'sdl', 'if': 'CONFIG_SDL' },
-    { 'name': 'egl-headless',
-              'if': { 'all': ['CONFIG_OPENGL', 'CONFIG_GBM'] } },
+    { 'name': 'egl-headless', 'if': 'CONFIG_OPENGL' },
     { 'name': 'curses', 'if': 'CONFIG_CURSES' },
     { 'name': 'cocoa', 'if': 'CONFIG_COCOA' },
     { 'name': 'spice-app', 'if': 'CONFIG_SPICE' },
@@ -1525,7 +1524,7 @@
       'cocoa': { 'type': 'DisplayCocoa', 'if': 'CONFIG_COCOA' },
       'curses': { 'type': 'DisplayCurses', 'if': 'CONFIG_CURSES' },
       'egl-headless': { 'type': 'DisplayEGLHeadless',
-                        'if': { 'all': ['CONFIG_OPENGL', 'CONFIG_GBM'] } },
+                        'if': 'CONFIG_OPENGL' },
       'dbus': { 'type': 'DisplayDBus', 'if': 'CONFIG_DBUS_DISPLAY' },
       'sdl': { 'type': 'DisplaySDL', 'if': 'CONFIG_SDL' }
   }
diff --git a/ui/egl-headless.c b/ui/egl-headless.c
index ef70e6a18e..e4177206f2 100644
--- a/ui/egl-headless.c
+++ b/ui/egl-headless.c
@@ -79,6 +79,8 @@ static void egl_scanout_texture(DisplayChangeListener *dcl,
     }
 }
 
+#ifdef CONFIG_GBM
+
 static void egl_scanout_dmabuf(DisplayChangeListener *dcl,
                                QemuDmaBuf *dmabuf)
 {
@@ -110,6 +112,14 @@ static void egl_cursor_dmabuf(DisplayChangeListener *dcl,
     }
 }
 
+static void egl_release_dmabuf(DisplayChangeListener *dcl,
+                               QemuDmaBuf *dmabuf)
+{
+    egl_dmabuf_release_texture(dmabuf);
+}
+
+#endif
+
 static void egl_cursor_position(DisplayChangeListener *dcl,
                                 uint32_t pos_x, uint32_t pos_y)
 {
@@ -119,12 +129,6 @@ static void egl_cursor_position(DisplayChangeListener *dcl,
     edpy->pos_y = pos_y;
 }
 
-static void egl_release_dmabuf(DisplayChangeListener *dcl,
-                               QemuDmaBuf *dmabuf)
-{
-    egl_dmabuf_release_texture(dmabuf);
-}
-
 static void egl_scanout_flush(DisplayChangeListener *dcl,
                               uint32_t x, uint32_t y,
                               uint32_t w, uint32_t h)
@@ -160,10 +164,12 @@ static const DisplayChangeListenerOps egl_ops = {
 
     .dpy_gl_scanout_disable  = egl_scanout_disable,
     .dpy_gl_scanout_texture  = egl_scanout_texture,
+#ifdef CONFIG_GBM
     .dpy_gl_scanout_dmabuf   = egl_scanout_dmabuf,
     .dpy_gl_cursor_dmabuf    = egl_cursor_dmabuf,
-    .dpy_gl_cursor_position  = egl_cursor_position,
     .dpy_gl_release_dmabuf   = egl_release_dmabuf,
+#endif
+    .dpy_gl_cursor_position  = egl_cursor_position,
     .dpy_gl_update           = egl_scanout_flush,
 };
 
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 26d43e0213..d1ef3c07dd 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -199,11 +199,12 @@ void egl_texture_blend(QemuGLShader *gls, egl_fb *dst, egl_fb *src, bool flip,
 
 /* ---------------------------------------------------------------------- */
 
+EGLContext qemu_egl_rn_ctx;
+
 #ifdef CONFIG_GBM
 
 int qemu_egl_rn_fd;
 struct gbm_device *qemu_egl_rn_gbm_dev;
-EGLContext qemu_egl_rn_ctx;
 
 int egl_rendernode_init(const char *rendernode, DisplayGLMode mode)
 {
@@ -400,7 +401,7 @@ EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, EGLNativeWindowType win)
 
 /* ---------------------------------------------------------------------- */
 
-#if defined(CONFIG_X11) || defined(CONFIG_GBM)
+#if defined(CONFIG_X11) || defined(CONFIG_GBM) || defined(WIN32)
 
 /*
  * Taken from glamor_egl.h from the Xorg xserver, which is MIT licensed
@@ -508,6 +509,9 @@ static int qemu_egl_init_dpy(EGLNativeDisplayType dpy,
     return 0;
 }
 
+#endif
+
+#if defined(CONFIG_X11) || defined(CONFIG_GBM)
 int qemu_egl_init_dpy_x11(EGLNativeDisplayType dpy, DisplayGLMode mode)
 {
 #ifdef EGL_KHR_platform_x11
@@ -525,7 +529,14 @@ int qemu_egl_init_dpy_mesa(EGLNativeDisplayType dpy, DisplayGLMode mode)
     return qemu_egl_init_dpy(dpy, 0, mode);
 #endif
 }
+#endif
 
+
+#ifdef WIN32
+int qemu_egl_init_dpy_win32(EGLNativeDisplayType dpy, DisplayGLMode mode)
+{
+    return qemu_egl_init_dpy(dpy, 0, mode);
+}
 #endif
 
 bool qemu_egl_has_dmabuf(void)
@@ -577,15 +588,28 @@ bool egl_init(const char *rendernode, DisplayGLMode mode, Error **errp)
         return false;
     }
 
-#ifdef CONFIG_GBM
+#ifdef WIN32
+    if (qemu_egl_init_dpy_win32(EGL_DEFAULT_DISPLAY, mode) < 0) {
+        error_setg(errp, "egl: init failed");
+        return false;
+    }
+    qemu_egl_rn_ctx = qemu_egl_init_ctx();
+    if (!qemu_egl_rn_ctx) {
+        error_setg(errp, "egl: egl_init_ctx failed");
+        return false;
+    }
+#elif defined(CONFIG_GBM)
     if (egl_rendernode_init(rendernode, mode) < 0) {
         error_setg(errp, "egl: render node init failed");
         return false;
     }
+#endif
+
+    if (!qemu_egl_rn_ctx) {
+        error_setg(errp, "egl: not available on this platform");
+        return false;
+    }
+
     display_opengl = 1;
     return true;
-#else
-    error_setg(errp, "egl: not available on this platform");
-    return false;
-#endif
 }
diff --git a/ui/meson.build b/ui/meson.build
index d84650676d..d81609fb0e 100644
--- a/ui/meson.build
+++ b/ui/meson.build
@@ -65,10 +65,10 @@ if opengl.found()
   ui_modules += {'opengl' : opengl_ss}
 endif
 
-if opengl.found() and gbm.found()
+if opengl.found()
   egl_headless_ss = ss.source_set()
-  egl_headless_ss.add(when: [opengl, gbm, pixman],
-                      if_true: files('egl-headless.c'))
+  egl_headless_ss.add(when: [opengl, pixman],
+                      if_true: [files('egl-headless.c'), gbm])
   ui_modules += {'egl-headless' : egl_headless_ss}
 endif
 

From afe8e0b6db2debeaf35f5bd43efa1ada90ba0847 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:50 +0400
Subject: [PATCH 0231/1353] ui/egl: default to GLES on windows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Windows GL drivers are notoriously not very good. Otoh, ANGLE provides
rock solid GLES implementation on top of direct3d. We should recommend
it and default to ES when using EGL (users can easily override this if
necessary)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-14-marcandre.lureau@redhat.com>
---
 ui/egl-helpers.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index d1ef3c07dd..c2a3ace743 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -535,6 +535,10 @@ int qemu_egl_init_dpy_mesa(EGLNativeDisplayType dpy, DisplayGLMode mode)
 #ifdef WIN32
 int qemu_egl_init_dpy_win32(EGLNativeDisplayType dpy, DisplayGLMode mode)
 {
+    /* prefer GL ES, as that's what ANGLE supports */
+    if (mode == DISPLAYGL_MODE_ON) {
+        mode = DISPLAYGL_MODE_ES;
+    }
     return qemu_egl_init_dpy(dpy, 0, mode);
 }
 #endif

From da9eb580b7e28d70d344bb03e0fe5703c8d1892c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:51 +0400
Subject: [PATCH 0232/1353] ui: add egl_fb_read_rect()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Similar to egl_fb_read(), same limitations, but with extra arguments to
read a subset of the framebuffer. Used in following commits.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-15-marcandre.lureau@redhat.com>
---
 include/ui/egl-helpers.h |  1 +
 ui/egl-helpers.c         | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 6c4eb5dd70..6e2f0c49a6 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -31,6 +31,7 @@ void egl_fb_setup_for_tex(egl_fb *fb, int width, int height,
 void egl_fb_setup_new_tex(egl_fb *fb, int width, int height);
 void egl_fb_blit(egl_fb *dst, egl_fb *src, bool flip);
 void egl_fb_read(DisplaySurface *dst, egl_fb *src);
+void egl_fb_read_rect(DisplaySurface *dst, egl_fb *src, int x, int y, int w, int h);
 
 void egl_texture_blit(QemuGLShader *gls, egl_fb *dst, egl_fb *src, bool flip);
 void egl_texture_blend(QemuGLShader *gls, egl_fb *dst, egl_fb *src, bool flip,
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index c2a3ace743..f38800e920 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -169,6 +169,20 @@ void egl_fb_read(DisplaySurface *dst, egl_fb *src)
                  GL_BGRA, GL_UNSIGNED_BYTE, surface_data(dst));
 }
 
+void egl_fb_read_rect(DisplaySurface *dst, egl_fb *src, int x, int y, int w, int h)
+{
+    assert(surface_width(dst) == src->width);
+    assert(surface_height(dst) == src->height);
+    assert(surface_format(dst) == PIXMAN_x8r8g8b8);
+
+    glBindFramebuffer(GL_READ_FRAMEBUFFER, src->framebuffer);
+    glReadBuffer(GL_COLOR_ATTACHMENT0_EXT);
+    glPixelStorei(GL_PACK_ROW_LENGTH, surface_stride(dst) / 4);
+    glReadPixels(x, y, w, h,
+                 GL_BGRA, GL_UNSIGNED_BYTE, surface_data(dst) + x * 4);
+    glPixelStorei(GL_PACK_ROW_LENGTH, 0);
+}
+
 void egl_texture_blit(QemuGLShader *gls, egl_fb *dst, egl_fb *src, bool flip)
 {
     glBindFramebuffer(GL_FRAMEBUFFER_EXT, dst->framebuffer);

From f43bf0a73b3903770e2bc919b12f9dad5407773d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:52 +0400
Subject: [PATCH 0233/1353] ui/dbus: add GL support on win32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable usage of dbus,gl= on win32. At this point, the scanout texture is
read on the DisplaySurface memory, and the client is then updated with
the "2D" API (with shared memory if possible).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-16-marcandre.lureau@redhat.com>
---
 ui/dbus-listener.c | 100 +++++++++++++++++++++++++++++++--------------
 ui/dbus.c          |   4 --
 2 files changed, 69 insertions(+), 35 deletions(-)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index f6b1cd11be..e92eff66e3 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -36,6 +36,9 @@
 #endif
 #include "trace.h"
 
+static void dbus_gfx_switch(DisplayChangeListener *dcl,
+                            struct DisplaySurface *new_surface);
+
 struct _DBusDisplayListener {
     GObject parent;
 
@@ -55,12 +58,28 @@ struct _DBusDisplayListener {
 #ifdef WIN32
     QemuDBusDisplay1ListenerWin32Map *map_proxy;
     HANDLE peer_process;
+#ifdef CONFIG_OPENGL
+    egl_fb fb;
+#endif
 #endif
 };
 
 G_DEFINE_TYPE(DBusDisplayListener, dbus_display_listener, G_TYPE_OBJECT)
 
-#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
+static void dbus_gfx_update(DisplayChangeListener *dcl,
+                            int x, int y, int w, int h);
+
+#ifdef CONFIG_OPENGL
+static void dbus_scanout_disable(DisplayChangeListener *dcl)
+{
+    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
+
+    ddl->ds = NULL;
+    qemu_dbus_display1_listener_call_disable(
+        ddl->proxy, G_DBUS_CALL_FLAGS_NONE, -1, NULL, NULL, NULL);
+}
+
+#ifdef CONFIG_GBM
 static void dbus_update_gl_cb(GObject *source_object,
                            GAsyncResult *res,
                            gpointer user_data)
@@ -76,29 +95,31 @@ static void dbus_update_gl_cb(GObject *source_object,
     graphic_hw_gl_block(ddl->dcl.con, false);
     g_object_unref(ddl);
 }
+#endif
 
-static void dbus_call_update_gl(DBusDisplayListener *ddl,
+static void dbus_call_update_gl(DisplayChangeListener *dcl,
                                 int x, int y, int w, int h)
 {
-    graphic_hw_gl_block(ddl->dcl.con, true);
+    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
+
     glFlush();
+#ifdef CONFIG_GBM
+    graphic_hw_gl_block(ddl->dcl.con, true);
     qemu_dbus_display1_listener_call_update_dmabuf(ddl->proxy,
         x, y, w, h,
         G_DBUS_CALL_FLAGS_NONE,
         DBUS_DEFAULT_TIMEOUT, NULL,
         dbus_update_gl_cb,
         g_object_ref(ddl));
+#endif
+
+#ifdef WIN32
+    egl_fb_read_rect(ddl->ds, &ddl->fb, x, y, w, h);
+    dbus_gfx_update(dcl, x, y, w, h);
+#endif
 }
 
-static void dbus_scanout_disable(DisplayChangeListener *dcl)
-{
-    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
-
-    ddl->ds = NULL;
-    qemu_dbus_display1_listener_call_disable(
-        ddl->proxy, G_DBUS_CALL_FLAGS_NONE, -1, NULL, NULL, NULL);
-}
-
+#ifdef CONFIG_GBM
 static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
                                 QemuDmaBuf *dmabuf)
 {
@@ -127,7 +148,8 @@ static void dbus_scanout_dmabuf(DisplayChangeListener *dcl,
         fd_list,
         NULL, NULL, NULL);
 }
-#endif /* OPENGL & GBM */
+#endif /* GBM */
+#endif /* OPENGL */
 
 #ifdef WIN32
 static bool dbus_scanout_map(DBusDisplayListener *ddl)
@@ -181,7 +203,7 @@ static bool dbus_scanout_map(DBusDisplayListener *ddl)
 }
 #endif
 
-#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
+#ifdef CONFIG_OPENGL
 static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                  uint32_t tex_id,
                                  bool backing_y_0_top,
@@ -190,6 +212,7 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                  uint32_t x, uint32_t y,
                                  uint32_t w, uint32_t h)
 {
+#ifdef CONFIG_GBM
     QemuDmaBuf dmabuf = {
         .width = backing_width,
         .height = backing_height,
@@ -212,8 +235,19 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
 
     dbus_scanout_dmabuf(dcl, &dmabuf);
     close(dmabuf.fd);
+#endif
+
+#ifdef WIN32
+    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
+
+    /* there must be a matching gfx_switch before */
+    assert(surface_width(ddl->ds) == w);
+    assert(surface_height(ddl->ds) == h);
+    egl_fb_setup_for_tex(&ddl->fb, backing_width, backing_height, tex_id, false);
+#endif
 }
 
+#ifdef CONFIG_GBM
 static void dbus_cursor_dmabuf(DisplayChangeListener *dcl,
                                QemuDmaBuf *dmabuf, bool have_hot,
                                uint32_t hot_x, uint32_t hot_y)
@@ -260,7 +294,14 @@ static void dbus_cursor_dmabuf(DisplayChangeListener *dcl,
         NULL);
 }
 
-static void dbus_cursor_position(DisplayChangeListener *dcl,
+static void dbus_release_dmabuf(DisplayChangeListener *dcl,
+                                QemuDmaBuf *dmabuf)
+{
+    dbus_scanout_disable(dcl);
+}
+#endif /* GBM */
+
+static void dbus_gl_cursor_position(DisplayChangeListener *dcl,
                                  uint32_t pos_x, uint32_t pos_y)
 {
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
@@ -270,19 +311,11 @@ static void dbus_cursor_position(DisplayChangeListener *dcl,
         G_DBUS_CALL_FLAGS_NONE, -1, NULL, NULL, NULL);
 }
 
-static void dbus_release_dmabuf(DisplayChangeListener *dcl,
-                                QemuDmaBuf *dmabuf)
-{
-    dbus_scanout_disable(dcl);
-}
-
 static void dbus_scanout_update(DisplayChangeListener *dcl,
                                 uint32_t x, uint32_t y,
                                 uint32_t w, uint32_t h)
 {
-    DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
-
-    dbus_call_update_gl(ddl, x, y, w, h);
+    dbus_call_update_gl(dcl, x, y, w, h);
 }
 
 static void dbus_gl_refresh(DisplayChangeListener *dcl)
@@ -296,19 +329,19 @@ static void dbus_gl_refresh(DisplayChangeListener *dcl)
     }
 
     if (ddl->gl_updates) {
-        dbus_call_update_gl(ddl, 0, 0,
+        dbus_call_update_gl(dcl, 0, 0,
                             surface_width(ddl->ds), surface_height(ddl->ds));
         ddl->gl_updates = 0;
     }
 }
-#endif /* OPENGL & GBM */
+#endif /* OPENGL */
 
 static void dbus_refresh(DisplayChangeListener *dcl)
 {
     graphic_hw_update(dcl->con);
 }
 
-#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
+#ifdef CONFIG_OPENGL
 static void dbus_gl_gfx_update(DisplayChangeListener *dcl,
                                int x, int y, int w, int h)
 {
@@ -382,7 +415,7 @@ static void dbus_gfx_update(DisplayChangeListener *dcl,
         DBUS_DEFAULT_TIMEOUT, NULL, NULL, NULL);
 }
 
-#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
+#ifdef CONFIG_OPENGL
 static void dbus_gl_gfx_switch(DisplayChangeListener *dcl,
                                struct DisplaySurface *new_surface)
 {
@@ -452,7 +485,7 @@ static void dbus_cursor_define(DisplayChangeListener *dcl,
         NULL);
 }
 
-#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
+#ifdef CONFIG_OPENGL
 const DisplayChangeListenerOps dbus_gl_dcl_ops = {
     .dpy_name                = "dbus-gl",
     .dpy_gfx_update          = dbus_gl_gfx_update,
@@ -464,10 +497,12 @@ const DisplayChangeListenerOps dbus_gl_dcl_ops = {
 
     .dpy_gl_scanout_disable  = dbus_scanout_disable,
     .dpy_gl_scanout_texture  = dbus_scanout_texture,
+#ifdef CONFIG_GBM
     .dpy_gl_scanout_dmabuf   = dbus_scanout_dmabuf,
     .dpy_gl_cursor_dmabuf    = dbus_cursor_dmabuf,
-    .dpy_gl_cursor_position  = dbus_cursor_position,
     .dpy_gl_release_dmabuf   = dbus_release_dmabuf,
+#endif
+    .dpy_gl_cursor_position  = dbus_gl_cursor_position,
     .dpy_gl_update           = dbus_scanout_update,
 };
 #endif
@@ -493,6 +528,9 @@ dbus_display_listener_dispose(GObject *object)
 #ifdef WIN32
     g_clear_object(&ddl->map_proxy);
     g_clear_pointer(&ddl->peer_process, CloseHandle);
+#ifdef CONFIG_OPENGL
+    egl_fb_destroy(&ddl->fb);
+#endif
 #endif
 
     G_OBJECT_CLASS(dbus_display_listener_parent_class)->dispose(object);
@@ -504,7 +542,7 @@ dbus_display_listener_constructed(GObject *object)
     DBusDisplayListener *ddl = DBUS_DISPLAY_LISTENER(object);
 
     ddl->dcl.ops = &dbus_dcl_ops;
-#if defined(CONFIG_OPENGL) && defined(CONFIG_GBM)
+#ifdef CONFIG_OPENGL
     if (display_opengl) {
         ddl->dcl.ops = &dbus_gl_dcl_ops;
     }
diff --git a/ui/dbus.c b/ui/dbus.c
index b9e9698503..32f1bbe81a 100644
--- a/ui/dbus.c
+++ b/ui/dbus.c
@@ -47,10 +47,8 @@ static DBusDisplay *dbus_display;
 static QEMUGLContext dbus_create_context(DisplayGLCtx *dgc,
                                          QEMUGLParams *params)
 {
-#ifdef CONFIG_GBM
     eglMakeCurrent(qemu_egl_display, EGL_NO_SURFACE, EGL_NO_SURFACE,
                    qemu_egl_rn_ctx);
-#endif
     return qemu_egl_create_context(dgc, params);
 }
 
@@ -59,9 +57,7 @@ dbus_is_compatible_dcl(DisplayGLCtx *dgc,
                        DisplayChangeListener *dcl)
 {
     return
-#ifdef CONFIG_GBM
         dcl->ops == &dbus_gl_dcl_ops ||
-#endif
         dcl->ops == &dbus_console_dcl_ops;
 }
 

From cf283fb44769b0a2de647193bb31d55d5d25595b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:53 +0400
Subject: [PATCH 0234/1353] ui/dbus: add some GL traces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-17-marcandre.lureau@redhat.com>
---
 ui/dbus-listener.c | 6 ++++++
 ui/trace-events    | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index e92eff66e3..8605dffd8a 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -102,6 +102,8 @@ static void dbus_call_update_gl(DisplayChangeListener *dcl,
 {
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
 
+    trace_dbus_update_gl(x, y, w, h);
+
     glFlush();
 #ifdef CONFIG_GBM
     graphic_hw_gl_block(ddl->dcl.con, true);
@@ -212,6 +214,8 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                  uint32_t x, uint32_t y,
                                  uint32_t w, uint32_t h)
 {
+    trace_dbus_scanout_texture(tex_id, backing_y_0_top,
+                               backing_width, backing_height, x, y, w, h);
 #ifdef CONFIG_GBM
     QemuDmaBuf dmabuf = {
         .width = backing_width,
@@ -421,6 +425,8 @@ static void dbus_gl_gfx_switch(DisplayChangeListener *dcl,
 {
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
 
+    trace_dbus_gl_gfx_switch(new_surface);
+
     ddl->ds = new_surface;
     if (ddl->ds) {
         int width = surface_width(ddl->ds);
diff --git a/ui/trace-events b/ui/trace-events
index a71895c479..fe58675163 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -156,6 +156,9 @@ dbus_mouse_set_pos(unsigned int x, unsigned int y) "x=%u, y=%u"
 dbus_mouse_rel_motion(int dx, int dy) "dx=%d, dy=%d"
 dbus_touch_send_event(unsigned int kind, uint32_t num_slot, uint32_t x, uint32_t y) "kind=%u, num_slot=%u, x=%d, y=%d"
 dbus_update(int x, int y, int w, int h) "x=%d, y=%d, w=%d, h=%d"
+dbus_update_gl(int x, int y, int w, int h) "x=%d, y=%d, w=%d, h=%d"
 dbus_clipboard_grab_failed(void) ""
 dbus_clipboard_register(const char *bus_name) "peer %s"
 dbus_clipboard_unregister(const char *bus_name) "peer %s"
+dbus_scanout_texture(uint32_t tex_id, bool backing_y_0_top, uint32_t backing_width, uint32_t backing_height, uint32_t x, uint32_t y, uint32_t w, uint32_t h) "tex_id:%u y0top:%d back:%ux%u %u+%u-%ux%u"
+dbus_gl_gfx_switch(void *p) "surf: %p"

From e8a2db94792ca036adbdf3656125587c3097bd83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:54 +0400
Subject: [PATCH 0235/1353] virtio-gpu-virgl: teach it to get the QEMU EGL
 display
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

virgl offers a few features that require to have access to the
underlying EGLDisplay. This is the case for the D3D texture sharing support.

The API callback is merged for virgl 1.0:
https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/1113

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-18-marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu-virgl.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 1c47603d40..9831c482e5 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -18,9 +18,17 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-gpu.h"
 
+#include "ui/egl-helpers.h"
+
 #include <virglrenderer.h>
 
-static struct virgl_renderer_callbacks virtio_gpu_3d_cbs;
+#if VIRGL_RENDERER_CALLBACKS_VERSION >= 4
+static void *
+virgl_get_egl_display(G_GNUC_UNUSED void *cookie)
+{
+    return qemu_egl_display;
+}
+#endif
 
 static void virgl_cmd_create_resource_2d(VirtIOGPU *g,
                                          struct virtio_gpu_ctrl_command *cmd)
@@ -608,6 +616,13 @@ int virtio_gpu_virgl_init(VirtIOGPU *g)
 {
     int ret;
 
+#if VIRGL_RENDERER_CALLBACKS_VERSION >= 4
+    if (qemu_egl_display) {
+        virtio_gpu_3d_cbs.version = 4;
+        virtio_gpu_3d_cbs.get_egl_display = virgl_get_egl_display;
+    }
+#endif
+
     ret = virgl_renderer_init(g, 0, &virtio_gpu_3d_cbs);
     if (ret != 0) {
         error_report("virgl could not be initialized: %d", ret);

From 06c63a34e633601caea8fe88abfeff0911809da3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:55 +0400
Subject: [PATCH 0236/1353] ui/egl: query ANGLE d3d device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check if ANGLE is being used with D3D backend.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-19-marcandre.lureau@redhat.com>
---
 include/ui/egl-helpers.h |  1 +
 ui/egl-helpers.c         | 32 +++++++++++++++++++++++++++++++-
 ui/trace-events          |  3 +++
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 6e2f0c49a6..4b8c0d2281 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -12,6 +12,7 @@
 extern EGLDisplay *qemu_egl_display;
 extern EGLConfig qemu_egl_config;
 extern DisplayGLMode qemu_egl_mode;
+extern bool qemu_egl_angle_d3d;
 
 typedef struct egl_fb {
     int width;
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index f38800e920..8f9fbf583e 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -15,16 +15,19 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 #include "qemu/osdep.h"
+
 #include "qemu/drm.h"
 #include "qemu/error-report.h"
 #include "ui/console.h"
 #include "ui/egl-helpers.h"
 #include "sysemu/sysemu.h"
 #include "qapi/error.h"
+#include "trace.h"
 
 EGLDisplay *qemu_egl_display;
 EGLConfig qemu_egl_config;
 DisplayGLMode qemu_egl_mode;
+bool qemu_egl_angle_d3d;
 
 /* ------------------------------------------------------------------ */
 
@@ -553,7 +556,34 @@ int qemu_egl_init_dpy_win32(EGLNativeDisplayType dpy, DisplayGLMode mode)
     if (mode == DISPLAYGL_MODE_ON) {
         mode = DISPLAYGL_MODE_ES;
     }
-    return qemu_egl_init_dpy(dpy, 0, mode);
+
+    if (qemu_egl_init_dpy(dpy, 0, mode) < 0) {
+        return -1;
+    }
+
+#ifdef EGL_D3D11_DEVICE_ANGLE
+    if (epoxy_has_egl_extension(qemu_egl_display, "EGL_EXT_device_query")) {
+        EGLDeviceEXT device;
+        void *d3d11_device;
+
+        if (!eglQueryDisplayAttribEXT(qemu_egl_display,
+                                      EGL_DEVICE_EXT,
+                                      (EGLAttrib *)&device)) {
+            return 0;
+        }
+
+        if (!eglQueryDeviceAttribEXT(device,
+                                     EGL_D3D11_DEVICE_ANGLE,
+                                     (EGLAttrib *)&d3d11_device)) {
+            return 0;
+        }
+
+        trace_egl_init_d3d11_device(device);
+        qemu_egl_angle_d3d = device != NULL;
+    }
+#endif
+
+    return 0;
 }
 #endif
 
diff --git a/ui/trace-events b/ui/trace-events
index fe58675163..76b19a2995 100644
--- a/ui/trace-events
+++ b/ui/trace-events
@@ -162,3 +162,6 @@ dbus_clipboard_register(const char *bus_name) "peer %s"
 dbus_clipboard_unregister(const char *bus_name) "peer %s"
 dbus_scanout_texture(uint32_t tex_id, bool backing_y_0_top, uint32_t backing_width, uint32_t backing_height, uint32_t x, uint32_t y, uint32_t w, uint32_t h) "tex_id:%u y0top:%d back:%ux%u %u+%u-%ux%u"
 dbus_gl_gfx_switch(void *p) "surf: %p"
+
+# egl-helpers.c
+egl_init_d3d11_device(void *p) "d3d device: %p"

From bf41ab61908b340e5745c334586349bc8a3a0349 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:56 +0400
Subject: [PATCH 0237/1353] ui: add optional d3d texture pointer to scanout
 texture
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The following patch will get the underlying D3D11 Texture2D from the
virgl renderer scanout. Pass it along to the texture scanout callbacks
as a priliminary step, to simplify review.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-20-marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu-virgl.c |  4 +++-
 include/ui/console.h          |  7 +++++--
 include/ui/gtk.h              |  6 ++++--
 include/ui/sdl2.h             |  3 ++-
 ui/console.c                  | 11 +++++++----
 ui/dbus-console.c             |  3 ++-
 ui/dbus-listener.c            |  5 +++--
 ui/egl-headless.c             |  5 +++--
 ui/gtk-egl.c                  |  5 +++--
 ui/gtk-gl-area.c              |  5 +++--
 ui/sdl2-gl.c                  |  3 ++-
 ui/spice-display.c            |  3 ++-
 12 files changed, 39 insertions(+), 21 deletions(-)

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 9831c482e5..8fa9809371 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -154,6 +154,7 @@ static void virgl_cmd_set_scanout(VirtIOGPU *g,
 {
     struct virtio_gpu_set_scanout ss;
     struct virgl_renderer_resource_info info;
+    void *d3d_tex2d = NULL;
     int ret;
 
     VIRTIO_GPU_FILL_CMD(ss);
@@ -186,7 +187,8 @@ static void virgl_cmd_set_scanout(VirtIOGPU *g,
             g->parent_obj.scanout[ss.scanout_id].con, info.tex_id,
             info.flags & VIRTIO_GPU_RESOURCE_FLAG_Y_0_TOP,
             info.width, info.height,
-            ss.r.x, ss.r.y, ss.r.width, ss.r.height);
+            ss.r.x, ss.r.y, ss.r.width, ss.r.height,
+            d3d_tex2d);
     } else {
         dpy_gfx_replace_surface(
             g->parent_obj.scanout[ss.scanout_id].con, NULL);
diff --git a/include/ui/console.h b/include/ui/console.h
index 2ab0c7112a..f27b2aad4f 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -132,6 +132,7 @@ typedef struct ScanoutTexture {
     uint32_t y;
     uint32_t width;
     uint32_t height;
+    void *d3d_tex2d;
 } ScanoutTexture;
 
 typedef struct DisplaySurface {
@@ -270,7 +271,8 @@ typedef struct DisplayChangeListenerOps {
                                    uint32_t backing_width,
                                    uint32_t backing_height,
                                    uint32_t x, uint32_t y,
-                                   uint32_t w, uint32_t h);
+                                   uint32_t w, uint32_t h,
+                                   void *d3d_tex2d);
     /* optional (default to true if has dpy_gl_scanout_dmabuf) */
     bool (*dpy_has_dmabuf)(DisplayChangeListener *dcl);
     /* optional */
@@ -378,7 +380,8 @@ void dpy_gl_scanout_disable(QemuConsole *con);
 void dpy_gl_scanout_texture(QemuConsole *con,
                             uint32_t backing_id, bool backing_y_0_top,
                             uint32_t backing_width, uint32_t backing_height,
-                            uint32_t x, uint32_t y, uint32_t w, uint32_t h);
+                            uint32_t x, uint32_t y, uint32_t w, uint32_t h,
+                            void *d3d_tex2d);
 void dpy_gl_scanout_dmabuf(QemuConsole *con,
                            QemuDmaBuf *dmabuf);
 void dpy_gl_cursor_dmabuf(QemuConsole *con, QemuDmaBuf *dmabuf,
diff --git a/include/ui/gtk.h b/include/ui/gtk.h
index ae0f53740d..aa3d637029 100644
--- a/include/ui/gtk.h
+++ b/include/ui/gtk.h
@@ -175,7 +175,8 @@ void gd_egl_scanout_texture(DisplayChangeListener *dcl,
                             uint32_t backing_width,
                             uint32_t backing_height,
                             uint32_t x, uint32_t y,
-                            uint32_t w, uint32_t h);
+                            uint32_t w, uint32_t h,
+                            void *d3d_tex2d);
 void gd_egl_scanout_dmabuf(DisplayChangeListener *dcl,
                            QemuDmaBuf *dmabuf);
 void gd_egl_cursor_dmabuf(DisplayChangeListener *dcl,
@@ -211,7 +212,8 @@ void gd_gl_area_scanout_texture(DisplayChangeListener *dcl,
                                 uint32_t backing_width,
                                 uint32_t backing_height,
                                 uint32_t x, uint32_t y,
-                                uint32_t w, uint32_t h);
+                                uint32_t w, uint32_t h,
+                                void *d3d_tex2d);
 void gd_gl_area_scanout_disable(DisplayChangeListener *dcl);
 void gd_gl_area_scanout_flush(DisplayChangeListener *dcl,
                               uint32_t x, uint32_t y, uint32_t w, uint32_t h);
diff --git a/include/ui/sdl2.h b/include/ui/sdl2.h
index 8fb7e08262..e3acc7c82a 100644
--- a/include/ui/sdl2.h
+++ b/include/ui/sdl2.h
@@ -90,7 +90,8 @@ void sdl2_gl_scanout_texture(DisplayChangeListener *dcl,
                              uint32_t backing_width,
                              uint32_t backing_height,
                              uint32_t x, uint32_t y,
-                             uint32_t w, uint32_t h);
+                             uint32_t w, uint32_t h,
+                             void *d3d_tex2d);
 void sdl2_gl_scanout_flush(DisplayChangeListener *dcl,
                            uint32_t x, uint32_t y, uint32_t w, uint32_t h);
 
diff --git a/ui/console.c b/ui/console.c
index 4957110723..c1544e0fb8 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1223,7 +1223,8 @@ static void displaychangelistener_display_console(DisplayChangeListener *dcl,
                                          con->scanout.texture.x,
                                          con->scanout.texture.y,
                                          con->scanout.texture.width,
-                                         con->scanout.texture.height);
+                                         con->scanout.texture.height,
+                                         con->scanout.texture.d3d_tex2d);
     }
 }
 
@@ -2115,7 +2116,8 @@ void dpy_gl_scanout_texture(QemuConsole *con,
                             uint32_t backing_width,
                             uint32_t backing_height,
                             uint32_t x, uint32_t y,
-                            uint32_t width, uint32_t height)
+                            uint32_t width, uint32_t height,
+                            void *d3d_tex2d)
 {
     DisplayState *s = con->ds;
     DisplayChangeListener *dcl;
@@ -2123,7 +2125,7 @@ void dpy_gl_scanout_texture(QemuConsole *con,
     con->scanout.kind = SCANOUT_TEXTURE;
     con->scanout.texture = (ScanoutTexture) {
         backing_id, backing_y_0_top, backing_width, backing_height,
-        x, y, width, height
+        x, y, width, height, d3d_tex2d,
     };
     QLIST_FOREACH(dcl, &s->listeners, next) {
         if (con != (dcl->con ? dcl->con : active_console)) {
@@ -2133,7 +2135,8 @@ void dpy_gl_scanout_texture(QemuConsole *con,
             dcl->ops->dpy_gl_scanout_texture(dcl, backing_id,
                                              backing_y_0_top,
                                              backing_width, backing_height,
-                                             x, y, width, height);
+                                             x, y, width, height,
+                                             d3d_tex2d);
         }
     }
 }
diff --git a/ui/dbus-console.c b/ui/dbus-console.c
index aaa9d3b0b3..e19774f985 100644
--- a/ui/dbus-console.c
+++ b/ui/dbus-console.c
@@ -98,7 +98,8 @@ dbus_gl_scanout_texture(DisplayChangeListener *dcl,
                         uint32_t backing_width,
                         uint32_t backing_height,
                         uint32_t x, uint32_t y,
-                        uint32_t w, uint32_t h)
+                        uint32_t w, uint32_t h,
+                        void *d3d_tex2d)
 {
     DBusDisplayConsole *ddc = container_of(dcl, DBusDisplayConsole, dcl);
 
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 8605dffd8a..80c0fca9df 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -212,7 +212,8 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                  uint32_t backing_width,
                                  uint32_t backing_height,
                                  uint32_t x, uint32_t y,
-                                 uint32_t w, uint32_t h)
+                                 uint32_t w, uint32_t h,
+                                 void *d3d_tex2d)
 {
     trace_dbus_scanout_texture(tex_id, backing_y_0_top,
                                backing_width, backing_height, x, y, w, h);
@@ -434,7 +435,7 @@ static void dbus_gl_gfx_switch(DisplayChangeListener *dcl,
 
         /* TODO: lazy send dmabuf (there are unnecessary sent otherwise) */
         dbus_scanout_texture(&ddl->dcl, ddl->ds->texture, false,
-                             width, height, 0, 0, width, height);
+                             width, height, 0, 0, width, height, NULL);
     }
 }
 #endif
diff --git a/ui/egl-headless.c b/ui/egl-headless.c
index e4177206f2..d5637dadb2 100644
--- a/ui/egl-headless.c
+++ b/ui/egl-headless.c
@@ -61,7 +61,8 @@ static void egl_scanout_texture(DisplayChangeListener *dcl,
                                 uint32_t backing_width,
                                 uint32_t backing_height,
                                 uint32_t x, uint32_t y,
-                                uint32_t w, uint32_t h)
+                                uint32_t w, uint32_t h,
+                                void *d3d_tex2d)
 {
     egl_dpy *edpy = container_of(dcl, egl_dpy, dcl);
 
@@ -91,7 +92,7 @@ static void egl_scanout_dmabuf(DisplayChangeListener *dcl,
 
     egl_scanout_texture(dcl, dmabuf->texture,
                         false, dmabuf->width, dmabuf->height,
-                        0, 0, dmabuf->width, dmabuf->height);
+                        0, 0, dmabuf->width, dmabuf->height, NULL);
 }
 
 static void egl_cursor_dmabuf(DisplayChangeListener *dcl,
diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 64dc0eeec8..d59b8cd7d7 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -224,7 +224,8 @@ void gd_egl_scanout_texture(DisplayChangeListener *dcl,
                             uint32_t backing_id, bool backing_y_0_top,
                             uint32_t backing_width, uint32_t backing_height,
                             uint32_t x, uint32_t y,
-                            uint32_t w, uint32_t h)
+                            uint32_t w, uint32_t h,
+                            void *d3d_tex2d)
 {
     VirtualConsole *vc = container_of(dcl, VirtualConsole, gfx.dcl);
 
@@ -259,7 +260,7 @@ void gd_egl_scanout_dmabuf(DisplayChangeListener *dcl,
     gd_egl_scanout_texture(dcl, dmabuf->texture,
                            dmabuf->y0_top, dmabuf->width, dmabuf->height,
                            dmabuf->x, dmabuf->y, dmabuf->scanout_width,
-                           dmabuf->scanout_height);
+                           dmabuf->scanout_height, NULL);
 
     if (dmabuf->allow_fences) {
         vc->gfx.guest_fb.dmabuf = dmabuf;
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 1605818bd1..7367dfd793 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -244,7 +244,8 @@ void gd_gl_area_scanout_texture(DisplayChangeListener *dcl,
                                 uint32_t backing_width,
                                 uint32_t backing_height,
                                 uint32_t x, uint32_t y,
-                                uint32_t w, uint32_t h)
+                                uint32_t w, uint32_t h,
+                                void *d3d_tex2d)
 {
     VirtualConsole *vc = container_of(dcl, VirtualConsole, gfx.dcl);
 
@@ -300,7 +301,7 @@ void gd_gl_area_scanout_dmabuf(DisplayChangeListener *dcl,
     gd_gl_area_scanout_texture(dcl, dmabuf->texture,
                                dmabuf->y0_top, dmabuf->width, dmabuf->height,
                                dmabuf->x, dmabuf->y, dmabuf->scanout_width,
-                               dmabuf->scanout_height);
+                               dmabuf->scanout_height, NULL);
 
     if (dmabuf->allow_fences) {
         vc->gfx.guest_fb.dmabuf = dmabuf;
diff --git a/ui/sdl2-gl.c b/ui/sdl2-gl.c
index bbfa70eac3..28d796607c 100644
--- a/ui/sdl2-gl.c
+++ b/ui/sdl2-gl.c
@@ -205,7 +205,8 @@ void sdl2_gl_scanout_texture(DisplayChangeListener *dcl,
                              uint32_t backing_width,
                              uint32_t backing_height,
                              uint32_t x, uint32_t y,
-                             uint32_t w, uint32_t h)
+                             uint32_t w, uint32_t h,
+                             void *d3d_tex2d)
 {
     struct sdl2_console *scon = container_of(dcl, struct sdl2_console, dcl);
 
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 5bee19a7f9..3f3f8013d8 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -935,7 +935,8 @@ static void qemu_spice_gl_scanout_texture(DisplayChangeListener *dcl,
                                           uint32_t backing_width,
                                           uint32_t backing_height,
                                           uint32_t x, uint32_t y,
-                                          uint32_t w, uint32_t h)
+                                          uint32_t w, uint32_t h,
+                                          void *d3d_tex2d)
 {
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
     EGLint stride = 0, fourcc = 0;

From c1600f84ce011a056c9c432c8ad8d77f7f8b9e6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:57 +0400
Subject: [PATCH 0238/1353] virtio-gpu-virgl: use D3D11_SHARE_TEXTURE when
 available
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable D3D texture sharing when possible, and pass it to the texture
display callbacks.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-21-marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu-virgl.c | 24 +++++++++++++++++++-----
 meson.build                   |  6 ++++++
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 8fa9809371..8bb7a2c21f 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -153,8 +153,6 @@ static void virgl_cmd_set_scanout(VirtIOGPU *g,
                                   struct virtio_gpu_ctrl_command *cmd)
 {
     struct virtio_gpu_set_scanout ss;
-    struct virgl_renderer_resource_info info;
-    void *d3d_tex2d = NULL;
     int ret;
 
     VIRTIO_GPU_FILL_CMD(ss);
@@ -169,10 +167,20 @@ static void virgl_cmd_set_scanout(VirtIOGPU *g,
     }
     g->parent_obj.enable = 1;
 
-    memset(&info, 0, sizeof(info));
-
     if (ss.resource_id && ss.r.width && ss.r.height) {
+        struct virgl_renderer_resource_info info;
+        void *d3d_tex2d = NULL;
+
+#ifdef HAVE_VIRGL_D3D_INFO_EXT
+        struct virgl_renderer_resource_info_ext ext;
+        memset(&ext, 0, sizeof(ext));
+        ret = virgl_renderer_resource_get_info_ext(ss.resource_id, &ext);
+        info = ext.base;
+        d3d_tex2d = ext.d3d_tex2d;
+#else
+        memset(&info, 0, sizeof(info));
         ret = virgl_renderer_resource_get_info(ss.resource_id, &info);
+#endif
         if (ret == -1) {
             qemu_log_mask(LOG_GUEST_ERROR,
                           "%s: illegal resource specified %d\n",
@@ -617,6 +625,7 @@ void virtio_gpu_virgl_reset(VirtIOGPU *g)
 int virtio_gpu_virgl_init(VirtIOGPU *g)
 {
     int ret;
+    uint32_t flags = 0;
 
 #if VIRGL_RENDERER_CALLBACKS_VERSION >= 4
     if (qemu_egl_display) {
@@ -624,8 +633,13 @@ int virtio_gpu_virgl_init(VirtIOGPU *g)
         virtio_gpu_3d_cbs.get_egl_display = virgl_get_egl_display;
     }
 #endif
+#ifdef VIRGL_RENDERER_D3D11_SHARE_TEXTURE
+    if (qemu_egl_angle_d3d) {
+        flags |= VIRGL_RENDERER_D3D11_SHARE_TEXTURE;
+    }
+#endif
 
-    ret = virgl_renderer_init(g, 0, &virtio_gpu_3d_cbs);
+    ret = virgl_renderer_init(g, flags, &virtio_gpu_3d_cbs);
     if (ret != 0) {
         error_report("virgl could not be initialized: %d", ret);
         return ret;
diff --git a/meson.build b/meson.build
index 9a1ce43471..1631e60a3b 100644
--- a/meson.build
+++ b/meson.build
@@ -1072,6 +1072,12 @@ if not get_option('virglrenderer').auto() or have_system or have_vhost_user_gpu
   virgl = dependency('virglrenderer',
                      method: 'pkg-config',
                      required: get_option('virglrenderer'))
+  if virgl.found()
+    config_host_data.set('HAVE_VIRGL_D3D_INFO_EXT',
+                         cc.has_member('struct virgl_renderer_resource_info_ext', 'd3d_tex2d',
+                                       prefix: '#include <virglrenderer.h>',
+                                       dependencies: virgl))
+  endif
 endif
 blkio = not_found
 if not get_option('blkio').auto() or have_block

From de1f8ce0abb8c43d1e6a00c31c6d24dfe0505b92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 6 Jun 2023 15:56:58 +0400
Subject: [PATCH 0239/1353] ui/dbus: use shared D3D11 Texture2D when possible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the client implements "org.qemu.Display1.Listener.Win32.D3d11" and
we are running on ANGLE/win32, share the scanout texture with the peer
process, and draw with ScanoutTexture2d/UpdateTexture2d methods.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230606115658.677673-22-marcandre.lureau@redhat.com>
---
 ui/dbus-display1.xml |  56 +++++++-
 ui/dbus-listener.c   | 299 ++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 324 insertions(+), 31 deletions(-)

diff --git a/ui/dbus-display1.xml b/ui/dbus-display1.xml
index 7233286b28..f0e2fac212 100644
--- a/ui/dbus-display1.xml
+++ b/ui/dbus-display1.xml
@@ -472,8 +472,9 @@
   <!--
       org.qemu.Display1.Listener.Win32.Map:
 
-      This client-side interface can complement org.qemu.Display1.Listener on
-      ``/org/qemu/Display1/Listener`` for Windows specific methods.
+      This optional client-side interface can complement
+      org.qemu.Display1.Listener on ``/org/qemu/Display1/Listener`` for Windows
+      specific shared memory scanouts.
   -->
   <interface name="org.qemu.Display1.Listener.Win32.Map">
     <!--
@@ -513,6 +514,57 @@
     </method>
   </interface>
 
+  <!--
+      org.qemu.Display1.Listener.Win32.D3d11:
+
+      This optional client-side interface can complement
+      org.qemu.Display1.Listener on ``/org/qemu/Display1/Listener`` for Windows
+      specific Direct3D texture sharing of the scanouts.
+  -->
+  <interface name="org.qemu.Display1.Listener.Win32.D3d11">
+    <!--
+        ScanoutTexture2d:
+        @handle: the NT handle for the shared texture (to be opened back with ID3D11Device1::OpenSharedResource1).
+        @texture_width: texture width, in pixels.
+        @texture_height: texture height, in pixels.
+        @y0_top: whether Y position 0 is the top or not.
+        @x: the X scanout position, in pixels.
+        @y: the Y scanout position, in pixels.
+        @width: the scanout width, in pixels.
+        @height: the scanout height, in pixels.
+
+        Resize and update the display content with a Direct3D 11 2D texture.
+        You must acquire and release the associated KeyedMutex 0 during rendering.
+    -->
+    <method name="ScanoutTexture2d">
+      <arg type="t" name="handle" direction="in"/>
+      <arg type="u" name="texture_width" direction="in"/>
+      <arg type="u" name="texture_height" direction="in"/>
+      <arg type="b" name="y0_top" direction="in"/>
+      <arg type="u" name="x" direction="in"/>
+      <arg type="u" name="y" direction="in"/>
+      <arg type="u" name="width" direction="in"/>
+      <arg type="u" name="height" direction="in"/>
+    </method>
+
+    <!--
+        UpdateTexture2d:
+        @x: the X update position, in pixels.
+        @y: the Y update position, in pixels.
+        @width: the update width, in pixels.
+        @height: the update height, in pixels.
+
+        Update the display content with the current Direct3D 2D texture and the given region.
+        You must acquire and release the associated KeyedMutex 0 during rendering.
+    -->
+    <method name="UpdateTexture2d">
+      <arg type="i" name="x" direction="in"/>
+      <arg type="i" name="y" direction="in"/>
+      <arg type="i" name="width" direction="in"/>
+      <arg type="i" name="height" direction="in"/>
+    </method>
+  </interface>
+
   <!--
       org.qemu.Display1.Clipboard:
 
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 80c0fca9df..e10162b279 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -23,11 +23,16 @@
  */
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
 #include "sysemu/sysemu.h"
 #include "dbus.h"
 #ifdef G_OS_UNIX
 #include <gio/gunixfdlist.h>
 #endif
+#ifdef WIN32
+#include <d3d11.h>
+#include <dxgi1_2.h>
+#endif
 
 #ifdef CONFIG_OPENGL
 #include "ui/shader.h"
@@ -39,6 +44,12 @@
 static void dbus_gfx_switch(DisplayChangeListener *dcl,
                             struct DisplaySurface *new_surface);
 
+enum share_kind {
+    SHARE_KIND_NONE,
+    SHARE_KIND_MAPPED,
+    SHARE_KIND_D3DTEX,
+};
+
 struct _DBusDisplayListener {
     GObject parent;
 
@@ -50,6 +61,8 @@ struct _DBusDisplayListener {
 
     DisplayChangeListener dcl;
     DisplaySurface *ds;
+    enum share_kind ds_share;
+
     int gl_updates;
 
     bool ds_mapped;
@@ -57,7 +70,9 @@ struct _DBusDisplayListener {
 
 #ifdef WIN32
     QemuDBusDisplay1ListenerWin32Map *map_proxy;
+    QemuDBusDisplay1ListenerWin32D3d11 *d3d11_proxy;
     HANDLE peer_process;
+    ID3D11Texture2D *d3d_texture;
 #ifdef CONFIG_OPENGL
     egl_fb fb;
 #endif
@@ -74,28 +89,120 @@ static void dbus_scanout_disable(DisplayChangeListener *dcl)
 {
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
 
-    ddl->ds = NULL;
     qemu_dbus_display1_listener_call_disable(
         ddl->proxy, G_DBUS_CALL_FLAGS_NONE, -1, NULL, NULL, NULL);
 }
 
-#ifdef CONFIG_GBM
+#ifdef WIN32
+static bool d3d_texture2d_share(ID3D11Texture2D *d3d_texture,
+                                HANDLE *handle, Error **errp)
+{
+    IDXGIResource1 *dxgiResource = NULL;
+    HRESULT hr;
+
+    hr = d3d_texture->lpVtbl->QueryInterface(d3d_texture,
+                                             &IID_IDXGIResource1,
+                                             (void **)&dxgiResource);
+    if (FAILED(hr)) {
+        goto fail;
+    }
+
+    hr = dxgiResource->lpVtbl->CreateSharedHandle(
+        dxgiResource,
+        NULL,
+        DXGI_SHARED_RESOURCE_READ | DXGI_SHARED_RESOURCE_WRITE,
+        NULL,
+        handle
+        );
+
+    dxgiResource->lpVtbl->Release(dxgiResource);
+
+    if (SUCCEEDED(hr)) {
+        return true;
+    }
+
+fail:
+    error_setg_win32(errp, GetLastError(), "failed to create shared handle");
+    return false;
+}
+
+static bool d3d_texture2d_acquire0(ID3D11Texture2D *d3d_texture, Error **errp)
+{
+    IDXGIKeyedMutex *dxgiMutex = NULL;
+    HRESULT hr;
+
+    hr = d3d_texture->lpVtbl->QueryInterface(d3d_texture,
+                                             &IID_IDXGIKeyedMutex,
+                                             (void **)&dxgiMutex);
+    if (FAILED(hr)) {
+        goto fail;
+    }
+
+    hr = dxgiMutex->lpVtbl->AcquireSync(dxgiMutex, 0, INFINITE);
+
+    dxgiMutex->lpVtbl->Release(dxgiMutex);
+
+    if (SUCCEEDED(hr)) {
+        return true;
+    }
+
+fail:
+    error_setg_win32(errp, GetLastError(), "failed to acquire texture mutex");
+    return false;
+}
+
+static bool d3d_texture2d_release0(ID3D11Texture2D *d3d_texture, Error **errp)
+{
+    IDXGIKeyedMutex *dxgiMutex = NULL;
+    HRESULT hr;
+
+    hr = d3d_texture->lpVtbl->QueryInterface(d3d_texture,
+                                             &IID_IDXGIKeyedMutex,
+                                             (void **)&dxgiMutex);
+    if (FAILED(hr)) {
+        goto fail;
+    }
+
+    hr = dxgiMutex->lpVtbl->ReleaseSync(dxgiMutex, 0);
+
+    dxgiMutex->lpVtbl->Release(dxgiMutex);
+
+    if (SUCCEEDED(hr)) {
+        return true;
+    }
+
+fail:
+    error_setg_win32(errp, GetLastError(), "failed to release texture mutex");
+    return false;
+}
+#endif /* WIN32 */
+
 static void dbus_update_gl_cb(GObject *source_object,
-                           GAsyncResult *res,
-                           gpointer user_data)
+                              GAsyncResult *res,
+                              gpointer user_data)
 {
     g_autoptr(GError) err = NULL;
     DBusDisplayListener *ddl = user_data;
+    bool success;
 
-    if (!qemu_dbus_display1_listener_call_update_dmabuf_finish(ddl->proxy,
-                                                               res, &err)) {
+#ifdef CONFIG_GBM
+    success = qemu_dbus_display1_listener_call_update_dmabuf_finish(
+        ddl->proxy, res, &err);
+#endif
+
+#ifdef WIN32
+    success = qemu_dbus_display1_listener_win32_d3d11_call_update_texture2d_finish(
+        ddl->d3d11_proxy, res, &err);
+    d3d_texture2d_acquire0(ddl->d3d_texture, &error_warn);
+#endif
+
+    if (!success) {
         error_report("Failed to call update: %s", err->message);
     }
 
     graphic_hw_gl_block(ddl->dcl.con, false);
     g_object_unref(ddl);
 }
-#endif
 
 static void dbus_call_update_gl(DisplayChangeListener *dcl,
                                 int x, int y, int w, int h)
@@ -116,8 +223,31 @@ static void dbus_call_update_gl(DisplayChangeListener *dcl,
 #endif
 
 #ifdef WIN32
-    egl_fb_read_rect(ddl->ds, &ddl->fb, x, y, w, h);
-    dbus_gfx_update(dcl, x, y, w, h);
+    switch (ddl->ds_share) {
+    case SHARE_KIND_MAPPED:
+        egl_fb_read_rect(ddl->ds, &ddl->fb, x, y, w, h);
+        dbus_gfx_update(dcl, x, y, w, h);
+        break;
+    case SHARE_KIND_D3DTEX:
+        Error *err = NULL;
+        assert(ddl->d3d_texture);
+
+        graphic_hw_gl_block(ddl->dcl.con, true);
+        if (!d3d_texture2d_release0(ddl->d3d_texture, &err)) {
+            error_report_err(err);
+            return;
+        }
+        qemu_dbus_display1_listener_win32_d3d11_call_update_texture2d(
+            ddl->d3d11_proxy,
+            x, y, w, h,
+            G_DBUS_CALL_FLAGS_NONE,
+            DBUS_DEFAULT_TIMEOUT, NULL,
+            dbus_update_gl_cb,
+            g_object_ref(ddl));
+        break;
+    default:
+        g_warn_if_reached();
+    }
 #endif
 }
 
@@ -160,7 +290,7 @@ static bool dbus_scanout_map(DBusDisplayListener *ddl)
     BOOL success;
     HANDLE target_handle;
 
-    if (ddl->ds_mapped) {
+    if (ddl->ds_share == SHARE_KIND_MAPPED) {
         return true;
     }
 
@@ -199,7 +329,69 @@ static bool dbus_scanout_map(DBusDisplayListener *ddl)
         return false;
     }
 
-    ddl->ds_mapped = true;
+    ddl->ds_share = SHARE_KIND_MAPPED;
+
+    return true;
+}
+
+static bool
+dbus_scanout_share_d3d_texture(
+    DBusDisplayListener *ddl,
+    ID3D11Texture2D *tex,
+    bool backing_y_0_top,
+    uint32_t backing_width,
+    uint32_t backing_height,
+    uint32_t x, uint32_t y,
+    uint32_t w, uint32_t h)
+{
+    Error *err = NULL;
+    BOOL success;
+    HANDLE share_handle, target_handle;
+
+    if (!d3d_texture2d_release0(tex, &err)) {
+        error_report_err(err);
+        return false;
+    }
+
+    if (!d3d_texture2d_share(tex, &share_handle, &err)) {
+        error_report_err(err);
+        return false;
+    }
+
+    success = DuplicateHandle(
+        GetCurrentProcess(),
+        share_handle,
+        ddl->peer_process,
+        &target_handle,
+        0,
+        FALSE, DUPLICATE_SAME_ACCESS);
+    if (!success) {
+        g_autofree char *msg = g_win32_error_message(GetLastError());
+        g_debug("Failed to DuplicateHandle: %s", msg);
+        CloseHandle(share_handle);
+        return false;
+    }
+
+    qemu_dbus_display1_listener_win32_d3d11_call_scanout_texture2d(
+        ddl->d3d11_proxy,
+        GPOINTER_TO_INT(target_handle),
+        backing_width,
+        backing_height,
+        backing_y_0_top,
+        x, y, w, h,
+        G_DBUS_CALL_FLAGS_NONE,
+        -1,
+        NULL, NULL, NULL);
+
+    CloseHandle(share_handle);
+
+    if (!d3d_texture2d_acquire0(tex, &err)) {
+        error_report_err(err);
+        return false;
+    }
+
+    ddl->d3d_texture = tex;
+    ddl->ds_share = SHARE_KIND_D3DTEX;
 
     return true;
 }
@@ -248,7 +440,14 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
     /* there must be a matching gfx_switch before */
     assert(surface_width(ddl->ds) == w);
     assert(surface_height(ddl->ds) == h);
-    egl_fb_setup_for_tex(&ddl->fb, backing_width, backing_height, tex_id, false);
+
+    if (d3d_tex2d) {
+        dbus_scanout_share_d3d_texture(ddl, d3d_tex2d, backing_y_0_top,
+                                       backing_width, backing_height, x, y, w, h);
+    } else {
+        dbus_scanout_map(ddl);
+        egl_fb_setup_for_tex(&ddl->fb, backing_width, backing_height, tex_id, false);
+    }
 #endif
 }
 
@@ -429,6 +628,7 @@ static void dbus_gl_gfx_switch(DisplayChangeListener *dcl,
     trace_dbus_gl_gfx_switch(new_surface);
 
     ddl->ds = new_surface;
+    ddl->ds_share = SHARE_KIND_NONE;
     if (ddl->ds) {
         int width = surface_width(ddl->ds);
         int height = surface_height(ddl->ds);
@@ -446,13 +646,7 @@ static void dbus_gfx_switch(DisplayChangeListener *dcl,
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
 
     ddl->ds = new_surface;
-#ifdef WIN32
-    ddl->ds_mapped = false;
-#endif
-    if (!ddl->ds) {
-        /* why not call disable instead? */
-        return;
-    }
+    ddl->ds_share = SHARE_KIND_NONE;
 }
 
 static void dbus_mouse_set(DisplayChangeListener *dcl,
@@ -534,6 +728,7 @@ dbus_display_listener_dispose(GObject *object)
     g_clear_object(&ddl->proxy);
 #ifdef WIN32
     g_clear_object(&ddl->map_proxy);
+    g_clear_object(&ddl->d3d11_proxy);
     g_clear_pointer(&ddl->peer_process, CloseHandle);
 #ifdef CONFIG_OPENGL
     egl_fb_destroy(&ddl->fb);
@@ -598,12 +793,10 @@ dbus_display_listener_implements(DBusDisplayListener *ddl, const char *iface)
 
     return implements;
 }
-#endif
 
-static void
-dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
+static bool
+dbus_display_listener_setup_peer_process(DBusDisplayListener *ddl)
 {
-#ifdef WIN32
     g_autoptr(GError) err = NULL;
     GDBusConnection *conn;
     GIOStream *stream;
@@ -611,15 +804,15 @@ dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
     g_autoptr(GCredentials) creds = NULL;
     DWORD *pid;
 
-    if (!dbus_display_listener_implements(ddl, "org.qemu.Display1.Listener.Win32.Map")) {
-        return;
+    if (ddl->peer_process) {
+        return true;
     }
 
     conn = g_dbus_proxy_get_connection(G_DBUS_PROXY(ddl->proxy));
     stream = g_dbus_connection_get_stream(conn);
 
     if (!G_IS_UNIX_CONNECTION(stream)) {
-        return;
+        return false;
     }
 
     sock = g_socket_connection_get_socket(G_SOCKET_CONNECTION(stream));
@@ -627,14 +820,14 @@ dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
 
     if (!creds) {
         g_debug("Failed to get peer credentials: %s", err->message);
-        return;
+        return false;
     }
 
     pid = g_credentials_get_native(creds, G_CREDENTIALS_TYPE_WIN32_PID);
 
     if (pid == NULL) {
         g_debug("Failed to get peer PID");
-        return;
+        return false;
     }
 
     ddl->peer_process = OpenProcess(
@@ -644,11 +837,58 @@ dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
     if (!ddl->peer_process) {
         g_autofree char *msg = g_win32_error_message(GetLastError());
         g_debug("Failed to OpenProcess: %s", msg);
+        return false;
+    }
+
+    return true;
+}
+#endif
+
+static void
+dbus_display_listener_setup_d3d11(DBusDisplayListener *ddl)
+{
+#ifdef WIN32
+    g_autoptr(GError) err = NULL;
+
+    if (!dbus_display_listener_implements(ddl,
+            "org.qemu.Display1.Listener.Win32.D3d11")) {
+        return;
+    }
+
+    if (!dbus_display_listener_setup_peer_process(ddl)) {
+        return;
+    }
+
+    ddl->d3d11_proxy =
+        qemu_dbus_display1_listener_win32_d3d11_proxy_new_sync(ddl->conn,
+            G_DBUS_PROXY_FLAGS_DO_NOT_AUTO_START,
+            NULL,
+            "/org/qemu/Display1/Listener",
+            NULL,
+            &err);
+    if (!ddl->d3d11_proxy) {
+        g_debug("Failed to setup win32 d3d11 proxy: %s", err->message);
+        return;
+    }
+#endif
+}
+
+static void
+dbus_display_listener_setup_shared_map(DBusDisplayListener *ddl)
+{
+#ifdef WIN32
+    g_autoptr(GError) err = NULL;
+
+    if (!dbus_display_listener_implements(ddl, "org.qemu.Display1.Listener.Win32.Map")) {
+        return;
+    }
+
+    if (!dbus_display_listener_setup_peer_process(ddl)) {
         return;
     }
 
     ddl->map_proxy =
-        qemu_dbus_display1_listener_win32_map_proxy_new_sync(conn,
+        qemu_dbus_display1_listener_win32_map_proxy_new_sync(ddl->conn,
             G_DBUS_PROXY_FLAGS_DO_NOT_AUTO_START,
             NULL,
             "/org/qemu/Display1/Listener",
@@ -692,6 +932,7 @@ dbus_display_listener_new(const char *bus_name,
     ddl->console = console;
 
     dbus_display_listener_setup_shared_map(ddl);
+    dbus_display_listener_setup_d3d11(ddl);
 
     con = qemu_console_lookup_by_index(dbus_display_console_get_index(console));
     assert(con);

From 23e6c3c41b4f44d2e42a21846981bb70b9ff6d8a Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:01 +0200
Subject: [PATCH 0240/1353] iotests: Test active commit with iothread and
 background I/O

This is a better regression test for the bugs hidden by commit 80fc5d26
('graph-lock: Disable locking for now'). With that commit reverted, it
hangs instantaneously and reliably for me.

It is important to have a reliable test like this, because the following
commits will set out to fix the actual root cause of the deadlocks and
then finally revert commit 80fc5d26, which was only a stopgap solution.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-2-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 .../tests/iothreads-commit-active             | 85 +++++++++++++++++++
 .../tests/iothreads-commit-active.out         | 23 +++++
 2 files changed, 108 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/iothreads-commit-active
 create mode 100644 tests/qemu-iotests/tests/iothreads-commit-active.out

diff --git a/tests/qemu-iotests/tests/iothreads-commit-active b/tests/qemu-iotests/tests/iothreads-commit-active
new file mode 100755
index 0000000000..4010a4871f
--- /dev/null
+++ b/tests/qemu-iotests/tests/iothreads-commit-active
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+# group: rw quick auto
+#
+# Copyright (C) 2023 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Creator/Owner: Kevin Wolf <kwolf@redhat.com>
+
+import asyncio
+import iotests
+
+iotests.script_initialize(supported_fmts=['qcow2'],
+                          supported_platforms=['linux'])
+iotests.verify_virtio_scsi_pci_or_ccw()
+
+with iotests.FilePath('disk0.img') as img_path, \
+     iotests.FilePath('disk0-snap.img') as snap_path, \
+     iotests.FilePath('mirror-src.img') as src_path, \
+     iotests.FilePath('mirror-dst.img') as dst_path, \
+     iotests.VM() as vm:
+
+    img_size = '10M'
+    iotests.qemu_img_create('-f', iotests.imgfmt, img_path, img_size)
+    iotests.qemu_img_create('-f', iotests.imgfmt, '-b', img_path,
+                            '-F', iotests.imgfmt, snap_path)
+    iotests.qemu_img_create('-f', iotests.imgfmt, src_path, img_size)
+    iotests.qemu_img_create('-f', iotests.imgfmt, dst_path, img_size)
+
+    iotests.qemu_io_log('-c', 'write 0 64k', img_path)
+    iotests.qemu_io_log('-c', 'write 1M 64k', snap_path)
+    iotests.qemu_io_log('-c', 'write 3M 64k', snap_path)
+
+    iotests.qemu_io_log('-c', f'write 0 {img_size}', src_path)
+
+    iotests.log('Launching VM...')
+    vm.add_object('iothread,id=iothread0')
+    vm.add_object('throttle-group,x-bps-write=1048576,id=tg0')
+    vm.add_blockdev(f'file,node-name=disk0-file,filename={img_path}')
+    vm.add_blockdev('qcow2,node-name=disk0-fmt,file=disk0-file')
+    vm.add_drive(snap_path, 'backing=disk0-fmt,node-name=disk0',
+                 interface='none')
+    vm.add_device('virtio-scsi,iothread=iothread0')
+    vm.add_device('scsi-hd,drive=drive0')
+
+    vm.add_blockdev(f'file,filename={src_path},node-name=mirror-src-file')
+    vm.add_blockdev('qcow2,file=mirror-src-file,node-name=mirror-src')
+    vm.add_blockdev(f'file,filename={dst_path},node-name=mirror-dst-file')
+    vm.add_blockdev('qcow2,file=mirror-dst-file,node-name=mirror-dst-fmt')
+    vm.add_blockdev('throttle,throttle-group=tg0,file=mirror-dst-fmt,'
+                    'node-name=mirror-dst')
+    vm.add_device('scsi-hd,drive=mirror-src')
+
+    vm.launch()
+
+    # The background I/O is created on unrelated nodes (so that they won't be
+    # drained together with the other ones), but on the same iothread
+    iotests.log('Creating some background I/O...')
+    iotests.log(vm.qmp('blockdev-mirror', job_id='job0', sync='full',
+                       device='mirror-src', target='mirror-dst',
+                       auto_dismiss=False))
+
+    iotests.log('Starting active commit...')
+    iotests.log(vm.qmp('block-commit', device='disk0', job_id='job1',
+                       auto_dismiss=False))
+
+    # Should succeed and not time out
+    try:
+        vm.run_job('job1', wait=5.0)
+        vm.shutdown()
+    except asyncio.TimeoutError:
+        # VM may be stuck, kill it
+        vm.kill()
+        raise
diff --git a/tests/qemu-iotests/tests/iothreads-commit-active.out b/tests/qemu-iotests/tests/iothreads-commit-active.out
new file mode 100644
index 0000000000..4afd50b8d3
--- /dev/null
+++ b/tests/qemu-iotests/tests/iothreads-commit-active.out
@@ -0,0 +1,23 @@
+wrote 65536/65536 bytes at offset 0
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+wrote 65536/65536 bytes at offset 1048576
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+wrote 65536/65536 bytes at offset 3145728
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+wrote 10485760/10485760 bytes at offset 0
+10 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Launching VM...
+Creating some background I/O...
+{"return": {}}
+Starting active commit...
+{"return": {}}
+{"execute": "job-complete", "arguments": {"id": "job1"}}
+{"return": {}}
+{"data": {"device": "job1", "len": 131072, "offset": 131072, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"data": {"device": "job1", "len": 131072, "offset": 131072, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"execute": "job-dismiss", "arguments": {"id": "job1"}}
+{"return": {}}

From 415275aed959cd5c766a98b9f0eba54278a7adf5 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:02 +0200
Subject: [PATCH 0241/1353] qdev-properties-system: Lock AioContext for
 blk_insert_bs()

blk_insert_bs() requires that callers hold the AioContext lock for the
node that should be inserted. Take it.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-3-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/core/qdev-properties-system.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index d42493f630..6d5d43eda2 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -143,11 +143,15 @@ static void set_drive_helper(Object *obj, Visitor *v, const char *name,
              * aware of iothreads require their BlockBackends to be in the main
              * AioContext.
              */
-            ctx = iothread ? bdrv_get_aio_context(bs) : qemu_get_aio_context();
-            blk = blk_new(ctx, 0, BLK_PERM_ALL);
+            ctx = bdrv_get_aio_context(bs);
+            blk = blk_new(iothread ? ctx : qemu_get_aio_context(),
+                          0, BLK_PERM_ALL);
             blk_created = true;
 
+            aio_context_acquire(ctx);
             ret = blk_insert_bs(blk, bs, errp);
+            aio_context_release(ctx);
+
             if (ret < 0) {
                 goto fail;
             }

From 2065cf6b2354265b2870d01e561bd374b67280d0 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:03 +0200
Subject: [PATCH 0242/1353] test-block-iothread: Lock AioContext for
 blk_insert_bs()

blk_insert_bs() requires that callers hold the AioContext lock for the
node that should be inserted. Take it.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-4-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/unit/test-block-iothread.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
index f081c09729..d727a5fee8 100644
--- a/tests/unit/test-block-iothread.c
+++ b/tests/unit/test-block-iothread.c
@@ -825,6 +825,7 @@ static void test_attach_second_node(void)
     BlockDriverState *bs, *filter;
     QDict *options;
 
+    aio_context_acquire(main_ctx);
     blk = blk_new(ctx, BLK_PERM_ALL, BLK_PERM_ALL);
     bs = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
     blk_insert_bs(blk, bs, &error_abort);
@@ -833,7 +834,6 @@ static void test_attach_second_node(void)
     qdict_put_str(options, "driver", "raw");
     qdict_put_str(options, "file", "base");
 
-    aio_context_acquire(main_ctx);
     filter = bdrv_open(NULL, NULL, options, BDRV_O_RDWR, &error_abort);
     aio_context_release(main_ctx);
 
@@ -857,9 +857,11 @@ static void test_attach_preserve_blk_ctx(void)
 {
     IOThread *iothread = iothread_new();
     AioContext *ctx = iothread_get_aio_context(iothread);
+    AioContext *main_ctx = qemu_get_aio_context();
     BlockBackend *blk;
     BlockDriverState *bs;
 
+    aio_context_acquire(main_ctx);
     blk = blk_new(ctx, BLK_PERM_ALL, BLK_PERM_ALL);
     bs = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
     bs->total_sectors = 65536 / BDRV_SECTOR_SIZE;
@@ -868,6 +870,7 @@ static void test_attach_preserve_blk_ctx(void)
     blk_insert_bs(blk, bs, &error_abort);
     g_assert(blk_get_aio_context(blk) == ctx);
     g_assert(bdrv_get_aio_context(bs) == ctx);
+    aio_context_release(main_ctx);
 
     /* Remove the node again */
     aio_context_acquire(ctx);
@@ -877,7 +880,9 @@ static void test_attach_preserve_blk_ctx(void)
     g_assert(bdrv_get_aio_context(bs) == qemu_get_aio_context());
 
     /* Re-attach the node */
+    aio_context_acquire(main_ctx);
     blk_insert_bs(blk, bs, &error_abort);
+    aio_context_release(main_ctx);
     g_assert(blk_get_aio_context(blk) == ctx);
     g_assert(bdrv_get_aio_context(bs) == ctx);
 

From 8394c35ee14861e2dd2afb20b03036b86388e375 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:04 +0200
Subject: [PATCH 0243/1353] block: Fix AioContext locking in bdrv_open_child()

bdrv_attach_child() requires that the caller holds the AioContext lock
for the new child node. Take it in bdrv_open_child() and document that
the caller must not hold any AioContext apart from the main AioContext.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-5-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index 0637265c26..213a09643d 100644
--- a/block.c
+++ b/block.c
@@ -3654,6 +3654,7 @@ done:
  *
  * The BlockdevRef will be removed from the options QDict.
  *
+ * The caller must hold the lock of the main AioContext and no other AioContext.
  * @parent can move to a different AioContext in this function. Callers must
  * make sure that their AioContext locking is still correct after this.
  */
@@ -3665,6 +3666,8 @@ BdrvChild *bdrv_open_child(const char *filename,
                            bool allow_none, Error **errp)
 {
     BlockDriverState *bs;
+    BdrvChild *child;
+    AioContext *ctx;
 
     GLOBAL_STATE_CODE();
 
@@ -3674,13 +3677,19 @@ BdrvChild *bdrv_open_child(const char *filename,
         return NULL;
     }
 
-    return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
-                             errp);
+    ctx = bdrv_get_aio_context(bs);
+    aio_context_acquire(ctx);
+    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
+                              errp);
+    aio_context_release(ctx);
+
+    return child;
 }
 
 /*
  * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
  *
+ * The caller must hold the lock of the main AioContext and no other AioContext.
  * @parent can move to a different AioContext in this function. Callers must
  * make sure that their AioContext locking is still correct after this.
  */

From c066e808e11a5c181b625537b6c78e0de27a4801 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:05 +0200
Subject: [PATCH 0244/1353] block: Fix AioContext locking in
 bdrv_attach_child_common()

The function can move the child node to a different AioContext. In this
case, it also must take the AioContext lock for the new context before
calling functions that require the caller to hold the AioContext for the
child node.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-6-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 213a09643d..2c8a3ffe19 100644
--- a/block.c
+++ b/block.c
@@ -2989,6 +2989,10 @@ static TransactionActionDrv bdrv_attach_child_common_drv = {
  * Function doesn't update permissions, caller is responsible for this.
  *
  * Returns new created child.
+ *
+ * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
+ * @child_bs can move to a different AioContext in this function. Callers must
+ * make sure that their AioContext locking is still correct after this.
  */
 static BdrvChild *bdrv_attach_child_common(BlockDriverState *child_bs,
                                            const char *child_name,
@@ -2999,7 +3003,7 @@ static BdrvChild *bdrv_attach_child_common(BlockDriverState *child_bs,
                                            Transaction *tran, Error **errp)
 {
     BdrvChild *new_child;
-    AioContext *parent_ctx;
+    AioContext *parent_ctx, *new_child_ctx;
     AioContext *child_ctx = bdrv_get_aio_context(child_bs);
 
     assert(child_class->get_parent_desc);
@@ -3050,6 +3054,12 @@ static BdrvChild *bdrv_attach_child_common(BlockDriverState *child_bs,
         }
     }
 
+    new_child_ctx = bdrv_get_aio_context(child_bs);
+    if (new_child_ctx != child_ctx) {
+        aio_context_release(child_ctx);
+        aio_context_acquire(new_child_ctx);
+    }
+
     bdrv_ref(child_bs);
     /*
      * Let every new BdrvChild start with a drained parent. Inserting the child
@@ -3079,11 +3089,20 @@ static BdrvChild *bdrv_attach_child_common(BlockDriverState *child_bs,
     };
     tran_add(tran, &bdrv_attach_child_common_drv, s);
 
+    if (new_child_ctx != child_ctx) {
+        aio_context_release(new_child_ctx);
+        aio_context_acquire(child_ctx);
+    }
+
     return new_child;
 }
 
 /*
  * Function doesn't update permissions, caller is responsible for this.
+ *
+ * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
+ * @child_bs can move to a different AioContext in this function. Callers must
+ * make sure that their AioContext locking is still correct after this.
  */
 static BdrvChild *bdrv_attach_child_noperm(BlockDriverState *parent_bs,
                                            BlockDriverState *child_bs,

From 4b408668d0bd8fbac7b558bf9bc7acfce5aa0728 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:06 +0200
Subject: [PATCH 0245/1353] block: Fix AioContext locking in
 bdrv_reopen_parse_file_or_backing()

bdrv_set_file_or_backing_noperm() requires the caller to hold the
AioContext lock for the child node, but we hold the one for the parent
node in bdrv_reopen_parse_file_or_backing(). Take the other one
temporarily.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-7-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index 2c8a3ffe19..9800273d0b 100644
--- a/block.c
+++ b/block.c
@@ -3366,6 +3366,10 @@ static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
  * callers which don't need their own reference any more must call bdrv_unref().
  *
  * Function doesn't update permissions, caller is responsible for this.
+ *
+ * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
+ * @child_bs can move to a different AioContext in this function. Callers must
+ * make sure that their AioContext locking is still correct after this.
  */
 static int bdrv_set_file_or_backing_noperm(BlockDriverState *parent_bs,
                                            BlockDriverState *child_bs,
@@ -3454,6 +3458,11 @@ out:
     return 0;
 }
 
+/*
+ * The caller must hold the AioContext lock for @backing_hd. Both @bs and
+ * @backing_hd can move to a different AioContext in this function. Callers must
+ * make sure that their AioContext locking is still correct after this.
+ */
 static int bdrv_set_backing_noperm(BlockDriverState *bs,
                                    BlockDriverState *backing_hd,
                                    Transaction *tran, Error **errp)
@@ -4606,6 +4615,11 @@ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
  * backing BlockDriverState (or NULL).
  *
  * Return 0 on success, otherwise return < 0 and set @errp.
+ *
+ * The caller must hold the AioContext lock of @reopen_state->bs.
+ * @reopen_state->bs can move to a different AioContext in this function.
+ * Callers must make sure that their AioContext locking is still correct after
+ * this.
  */
 static int bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
                                              bool is_backing, Transaction *tran,
@@ -4618,6 +4632,8 @@ static int bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
     const char *child_name = is_backing ? "backing" : "file";
     QObject *value;
     const char *str;
+    AioContext *ctx, *old_ctx;
+    int ret;
 
     GLOBAL_STATE_CODE();
 
@@ -4682,8 +4698,22 @@ static int bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
         reopen_state->old_file_bs = old_child_bs;
     }
 
-    return bdrv_set_file_or_backing_noperm(bs, new_child_bs, is_backing,
-                                           tran, errp);
+    old_ctx = bdrv_get_aio_context(bs);
+    ctx = bdrv_get_aio_context(new_child_bs);
+    if (old_ctx != ctx) {
+        aio_context_release(old_ctx);
+        aio_context_acquire(ctx);
+    }
+
+    ret = bdrv_set_file_or_backing_noperm(bs, new_child_bs, is_backing,
+                                          tran, errp);
+
+    if (old_ctx != ctx) {
+        aio_context_release(ctx);
+        aio_context_acquire(old_ctx);
+    }
+
+    return ret;
 }
 
 /*
@@ -4702,6 +4732,7 @@ static int bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
  * It is the responsibility of the caller to then call the abort() or
  * commit() for any other BDS that have been left in a prepare() state
  *
+ * The caller must hold the AioContext lock of @reopen_state->bs.
  */
 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
                                BlockReopenQueue *queue,

From f665f01f729680077fc0ff2e5489618d9ecc380e Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:07 +0200
Subject: [PATCH 0246/1353] block: Fix AioContext locking in
 bdrv_open_inherit()

bdrv_open_inherit() calls several functions for which it needs to hold
the AioContext lock, but currently doesn't. This includes calls in
bdrv_append_temp_snapshot(), for which bdrv_open_inherit() is the only
caller. Fix the locking in these places.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-8-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 9800273d0b..9815a6b6dc 100644
--- a/block.c
+++ b/block.c
@@ -3794,6 +3794,7 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
     int64_t total_size;
     QemuOpts *opts = NULL;
     BlockDriverState *bs_snapshot = NULL;
+    AioContext *ctx = bdrv_get_aio_context(bs);
     int ret;
 
     GLOBAL_STATE_CODE();
@@ -3802,7 +3803,10 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
        instead of opening 'filename' directly */
 
     /* Get the required size from the image */
+    aio_context_acquire(ctx);
     total_size = bdrv_getlength(bs);
+    aio_context_release(ctx);
+
     if (total_size < 0) {
         error_setg_errno(errp, -total_size, "Could not get image size");
         goto out;
@@ -3836,7 +3840,10 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
         goto out;
     }
 
+    aio_context_acquire(ctx);
     ret = bdrv_append(bs_snapshot, bs, errp);
+    aio_context_release(ctx);
+
     if (ret < 0) {
         bs_snapshot = NULL;
         goto out;
@@ -3880,6 +3887,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
     Error *local_err = NULL;
     QDict *snapshot_options = NULL;
     int snapshot_flags = 0;
+    AioContext *ctx = qemu_get_aio_context();
 
     assert(!child_class || !flags);
     assert(!child_class == !parent);
@@ -4017,9 +4025,13 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
             /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
              * looking at the header to guess the image format. This works even
              * in cases where a guest would not see a consistent state. */
-            file = blk_new(bdrv_get_aio_context(file_bs), 0, BLK_PERM_ALL);
+            ctx = bdrv_get_aio_context(file_bs);
+            aio_context_acquire(ctx);
+            file = blk_new(ctx, 0, BLK_PERM_ALL);
             blk_insert_bs(file, file_bs, &local_err);
             bdrv_unref(file_bs);
+            aio_context_release(ctx);
+
             if (local_err) {
                 goto fail;
             }
@@ -4065,8 +4077,13 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
         goto fail;
     }
 
+    /* The AioContext could have changed during bdrv_open_common() */
+    ctx = bdrv_get_aio_context(bs);
+
     if (file) {
+        aio_context_acquire(ctx);
         blk_unref(file);
+        aio_context_release(ctx);
         file = NULL;
     }
 
@@ -4124,13 +4141,16 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
          * (snapshot_bs); thus, we have to drop the strong reference to bs
          * (which we obtained by calling bdrv_new()). bs will not be deleted,
          * though, because the overlay still has a reference to it. */
+        aio_context_acquire(ctx);
         bdrv_unref(bs);
+        aio_context_release(ctx);
         bs = snapshot_bs;
     }
 
     return bs;
 
 fail:
+    aio_context_acquire(ctx);
     blk_unref(file);
     qobject_unref(snapshot_options);
     qobject_unref(bs->explicit_options);
@@ -4139,11 +4159,14 @@ fail:
     bs->options = NULL;
     bs->explicit_options = NULL;
     bdrv_unref(bs);
+    aio_context_release(ctx);
     error_propagate(errp, local_err);
     return NULL;
 
 close_and_fail:
+    aio_context_acquire(ctx);
     bdrv_unref(bs);
+    aio_context_release(ctx);
     qobject_unref(snapshot_options);
     qobject_unref(options);
     error_propagate(errp, local_err);

From 8aa045421979e59fa27cae6056471d33406a1eba Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:08 +0200
Subject: [PATCH 0247/1353] block: Fix AioContext locking in
 bdrv_open_backing_file()

bdrv_set_backing() requires the caller to hold the AioContext lock for
@backing_hd. Take it in bdrv_open_backing_file() before calling the
function.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-9-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/block.c b/block.c
index 9815a6b6dc..dc691b9832 100644
--- a/block.c
+++ b/block.c
@@ -3526,6 +3526,7 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     int ret = 0;
     bool implicit_backing = false;
     BlockDriverState *backing_hd;
+    AioContext *backing_hd_ctx;
     QDict *options;
     QDict *tmp_parent_options = NULL;
     Error *local_err = NULL;
@@ -3610,8 +3611,12 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
 
     /* Hook up the backing file link; drop our reference, bs owns the
      * backing_hd reference now */
+    backing_hd_ctx = bdrv_get_aio_context(backing_hd);
+    aio_context_acquire(backing_hd_ctx);
     ret = bdrv_set_backing_hd(bs, backing_hd, errp);
     bdrv_unref(backing_hd);
+    aio_context_release(backing_hd_ctx);
+
     if (ret < 0) {
         goto free_exit;
     }

From 22dd9405446f5301f32be4f9e88db6d9b582fd03 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:09 +0200
Subject: [PATCH 0248/1353] blockjob: Fix AioContext locking in
 block_job_add_bdrv()

bdrv_root_attach_child() requires callers to hold the AioContext lock
for child_bs. Take it in block_job_add_bdrv() before calling the
function.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-10-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockjob.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/blockjob.c b/blockjob.c
index 913da3cbf7..25fe8e625d 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -230,20 +230,27 @@ int block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
                        uint64_t perm, uint64_t shared_perm, Error **errp)
 {
     BdrvChild *c;
+    AioContext *ctx = bdrv_get_aio_context(bs);
     bool need_context_ops;
     GLOBAL_STATE_CODE();
 
     bdrv_ref(bs);
 
-    need_context_ops = bdrv_get_aio_context(bs) != job->job.aio_context;
+    need_context_ops = ctx != job->job.aio_context;
 
-    if (need_context_ops && job->job.aio_context != qemu_get_aio_context()) {
-        aio_context_release(job->job.aio_context);
+    if (need_context_ops) {
+        if (job->job.aio_context != qemu_get_aio_context()) {
+            aio_context_release(job->job.aio_context);
+        }
+        aio_context_acquire(ctx);
     }
     c = bdrv_root_attach_child(bs, name, &child_job, 0, perm, shared_perm, job,
                                errp);
-    if (need_context_ops && job->job.aio_context != qemu_get_aio_context()) {
-        aio_context_acquire(job->job.aio_context);
+    if (need_context_ops) {
+        aio_context_release(ctx);
+        if (job->job.aio_context != qemu_get_aio_context()) {
+            aio_context_acquire(job->job.aio_context);
+        }
     }
     if (c == NULL) {
         return -EPERM;

From 31b2ddfea304afc498aca8cac171020ef33eb89b Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:10 +0200
Subject: [PATCH 0249/1353] graph-lock: Unlock the AioContext while polling

If the caller keeps the AioContext lock for a block node in an iothread,
polling in bdrv_graph_wrlock() deadlocks if the condition isn't
fulfilled immediately.

Now that all callers make sure to actually have the AioContext locked
when they call bdrv_replace_child_noperm() like they should, we can
change bdrv_graph_wrlock() to take a BlockDriverState whose AioContext
lock the caller holds (NULL if it doesn't) and unlock it temporarily
while polling.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-11-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                    |  4 ++--
 block/graph-lock.c         | 23 ++++++++++++++++++++++-
 include/block/graph-lock.h |  6 ++++--
 3 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/block.c b/block.c
index dc691b9832..0cd1a12344 100644
--- a/block.c
+++ b/block.c
@@ -2854,7 +2854,7 @@ uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
  * Replaces the node that a BdrvChild points to without updating permissions.
  *
  * If @new_bs is non-NULL, the parent of @child must already be drained through
- * @child.
+ * @child and the caller must hold the AioContext lock for @new_bs.
  */
 static void bdrv_replace_child_noperm(BdrvChild *child,
                                       BlockDriverState *new_bs)
@@ -2893,7 +2893,7 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
     }
 
     /* TODO Pull this up into the callers to avoid polling here */
-    bdrv_graph_wrlock();
+    bdrv_graph_wrlock(new_bs);
     if (old_bs) {
         if (child->klass->detach) {
             child->klass->detach(child);
diff --git a/block/graph-lock.c b/block/graph-lock.c
index a92c6ae219..3bf2591dc4 100644
--- a/block/graph-lock.c
+++ b/block/graph-lock.c
@@ -110,8 +110,10 @@ static uint32_t reader_count(void)
 }
 #endif
 
-void bdrv_graph_wrlock(void)
+void bdrv_graph_wrlock(BlockDriverState *bs)
 {
+    AioContext *ctx = NULL;
+
     GLOBAL_STATE_CODE();
     /*
      * TODO Some callers hold an AioContext lock when this is called, which
@@ -120,7 +122,22 @@ void bdrv_graph_wrlock(void)
      */
 #if 0
     assert(!qatomic_read(&has_writer));
+#endif
 
+    /*
+     * Release only non-mainloop AioContext. The mainloop often relies on the
+     * BQL and doesn't lock the main AioContext before doing things.
+     */
+    if (bs) {
+        ctx = bdrv_get_aio_context(bs);
+        if (ctx != qemu_get_aio_context()) {
+            aio_context_release(ctx);
+        } else {
+            ctx = NULL;
+        }
+    }
+
+#if 0
     /* Make sure that constantly arriving new I/O doesn't cause starvation */
     bdrv_drain_all_begin_nopoll();
 
@@ -150,6 +167,10 @@ void bdrv_graph_wrlock(void)
 
     bdrv_drain_all_end();
 #endif
+
+    if (ctx) {
+        aio_context_acquire(bdrv_get_aio_context(bs));
+    }
 }
 
 void bdrv_graph_wrunlock(void)
diff --git a/include/block/graph-lock.h b/include/block/graph-lock.h
index 7574a2de5b..7e04f98ff0 100644
--- a/include/block/graph-lock.h
+++ b/include/block/graph-lock.h
@@ -111,10 +111,12 @@ void unregister_aiocontext(AioContext *ctx);
  * The wrlock can only be taken from the main loop, with BQL held, as only the
  * main loop is allowed to modify the graph.
  *
+ * If @bs is non-NULL, its AioContext is temporarily released.
+ *
  * This function polls. Callers must not hold the lock of any AioContext other
- * than the current one.
+ * than the current one and the one of @bs.
  */
-void bdrv_graph_wrlock(void) TSA_ACQUIRE(graph_lock) TSA_NO_TSA;
+void bdrv_graph_wrlock(BlockDriverState *bs) TSA_ACQUIRE(graph_lock) TSA_NO_TSA;
 
 /*
  * bdrv_graph_wrunlock:

From 3cce22defb4b0e47cf135444e30cc673cff5ebad Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 5 Jun 2023 10:57:11 +0200
Subject: [PATCH 0250/1353] Revert "graph-lock: Disable locking for now"

Now that bdrv_graph_wrlock() temporarily drops the AioContext lock that
its caller holds, it can poll without causing deadlocks. We can now
re-enable graph locking.

This reverts commit ad128dff0bf4b6f971d05eb4335a627883a19c1d.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20230605085711.21261-12-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/graph-lock.c | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/block/graph-lock.c b/block/graph-lock.c
index 3bf2591dc4..5e66f01ae8 100644
--- a/block/graph-lock.c
+++ b/block/graph-lock.c
@@ -30,10 +30,8 @@ BdrvGraphLock graph_lock;
 /* Protects the list of aiocontext and orphaned_reader_count */
 static QemuMutex aio_context_list_lock;
 
-#if 0
 /* Written and read with atomic operations. */
 static int has_writer;
-#endif
 
 /*
  * A reader coroutine could move from an AioContext to another.
@@ -90,7 +88,6 @@ void unregister_aiocontext(AioContext *ctx)
     g_free(ctx->bdrv_graph);
 }
 
-#if 0
 static uint32_t reader_count(void)
 {
     BdrvGraphRWlock *brdv_graph;
@@ -108,21 +105,13 @@ static uint32_t reader_count(void)
     assert((int32_t)rd >= 0);
     return rd;
 }
-#endif
 
 void bdrv_graph_wrlock(BlockDriverState *bs)
 {
     AioContext *ctx = NULL;
 
     GLOBAL_STATE_CODE();
-    /*
-     * TODO Some callers hold an AioContext lock when this is called, which
-     * causes deadlocks. Reenable once the AioContext locking is cleaned up (or
-     * AioContext locks are gone).
-     */
-#if 0
     assert(!qatomic_read(&has_writer));
-#endif
 
     /*
      * Release only non-mainloop AioContext. The mainloop often relies on the
@@ -137,7 +126,6 @@ void bdrv_graph_wrlock(BlockDriverState *bs)
         }
     }
 
-#if 0
     /* Make sure that constantly arriving new I/O doesn't cause starvation */
     bdrv_drain_all_begin_nopoll();
 
@@ -166,7 +154,6 @@ void bdrv_graph_wrlock(BlockDriverState *bs)
     } while (reader_count() >= 1);
 
     bdrv_drain_all_end();
-#endif
 
     if (ctx) {
         aio_context_acquire(bdrv_get_aio_context(bs));
@@ -176,7 +163,6 @@ void bdrv_graph_wrlock(BlockDriverState *bs)
 void bdrv_graph_wrunlock(void)
 {
     GLOBAL_STATE_CODE();
-#if 0
     QEMU_LOCK_GUARD(&aio_context_list_lock);
     assert(qatomic_read(&has_writer));
 
@@ -188,13 +174,10 @@ void bdrv_graph_wrunlock(void)
 
     /* Wake up all coroutine that are waiting to read the graph */
     qemu_co_enter_all(&reader_queue, &aio_context_list_lock);
-#endif
 }
 
 void coroutine_fn bdrv_graph_co_rdlock(void)
 {
-    /* TODO Reenable when wrlock is reenabled */
-#if 0
     BdrvGraphRWlock *bdrv_graph;
     bdrv_graph = qemu_get_current_aio_context()->bdrv_graph;
 
@@ -254,12 +237,10 @@ void coroutine_fn bdrv_graph_co_rdlock(void)
             qemu_co_queue_wait(&reader_queue, &aio_context_list_lock);
         }
     }
-#endif
 }
 
 void coroutine_fn bdrv_graph_co_rdunlock(void)
 {
-#if 0
     BdrvGraphRWlock *bdrv_graph;
     bdrv_graph = qemu_get_current_aio_context()->bdrv_graph;
 
@@ -277,7 +258,6 @@ void coroutine_fn bdrv_graph_co_rdunlock(void)
     if (qatomic_read(&has_writer)) {
         aio_wait_kick();
     }
-#endif
 }
 
 void bdrv_graph_rdlock_main_loop(void)
@@ -295,19 +275,13 @@ void bdrv_graph_rdunlock_main_loop(void)
 void assert_bdrv_graph_readable(void)
 {
     /* reader_count() is slow due to aio_context_list_lock lock contention */
-    /* TODO Reenable when wrlock is reenabled */
-#if 0
 #ifdef CONFIG_DEBUG_GRAPH_LOCK
     assert(qemu_in_main_thread() || reader_count());
 #endif
-#endif
 }
 
 void assert_bdrv_graph_writable(void)
 {
     assert(qemu_in_main_thread());
-    /* TODO Reenable when wrlock is reenabled */
-#if 0
     assert(qatomic_read(&has_writer));
-#endif
 }

From 36c6c8773a20e0205046f95c5688b3f17a4d552d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:34 +0200
Subject: [PATCH 0251/1353] file-posix: remove incorrect coroutine_fn calls

raw_co_getlength is called by handle_aiocb_write_zeroes, which is not a coroutine
function.  This is harmless because raw_co_getlength does not actually suspend,
but in the interest of clarity make it a non-coroutine_fn that is just wrapped
by the coroutine_fn raw_co_getlength.  Likewise, check_cache_dropped was only
a coroutine_fn because it called raw_co_getlength, so it can be made non-coroutine
as well.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-2-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index ac1ed54811..9e8e3d8ca5 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -193,7 +193,7 @@ static int fd_open(BlockDriverState *bs)
     return -EIO;
 }
 
-static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs);
+static int64_t raw_getlength(BlockDriverState *bs);
 
 typedef struct RawPosixAIOData {
     BlockDriverState *bs;
@@ -1974,7 +1974,7 @@ static int handle_aiocb_write_zeroes(void *opaque)
 #ifdef CONFIG_FALLOCATE
     /* Last resort: we are trying to extend the file with zeroed data. This
      * can be done via fallocate(fd, 0) */
-    len = raw_co_getlength(aiocb->bs);
+    len = raw_getlength(aiocb->bs);
     if (s->has_fallocate && len >= 0 && aiocb->aio_offset >= len) {
         int ret = do_fallocate(s->fd, 0, aiocb->aio_offset, aiocb->aio_nbytes);
         if (ret == 0 || ret != -ENOTSUP) {
@@ -2666,7 +2666,7 @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
     }
 
     if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
-        int64_t cur_length = raw_co_getlength(bs);
+        int64_t cur_length = raw_getlength(bs);
 
         if (offset != cur_length && exact) {
             error_setg(errp, "Cannot resize device files");
@@ -2684,7 +2684,7 @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
 }
 
 #ifdef __OpenBSD__
-static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
+static int64_t raw_getlength(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
     int fd = s->fd;
@@ -2703,7 +2703,7 @@ static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
         return st.st_size;
 }
 #elif defined(__NetBSD__)
-static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
+static int64_t raw_getlength(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
     int fd = s->fd;
@@ -2728,7 +2728,7 @@ static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
         return st.st_size;
 }
 #elif defined(__sun__)
-static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
+static int64_t raw_getlength(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
     struct dk_minfo minfo;
@@ -2759,7 +2759,7 @@ static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
     return size;
 }
 #elif defined(CONFIG_BSD)
-static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
+static int64_t raw_getlength(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
     int fd = s->fd;
@@ -2831,7 +2831,7 @@ again:
     return size;
 }
 #else
-static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
+static int64_t raw_getlength(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
     int ret;
@@ -2850,6 +2850,11 @@ static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
 }
 #endif
 
+static int64_t coroutine_fn raw_co_getlength(BlockDriverState *bs)
+{
+    return raw_getlength(bs);
+}
+
 static int64_t coroutine_fn raw_co_get_allocated_file_size(BlockDriverState *bs)
 {
     struct stat st;
@@ -3215,7 +3220,7 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
          * round up if necessary.
          */
         if (!QEMU_IS_ALIGNED(*pnum, bs->bl.request_alignment)) {
-            int64_t file_length = raw_co_getlength(bs);
+            int64_t file_length = raw_getlength(bs);
             if (file_length > 0) {
                 /* Ignore errors, this is just a safeguard */
                 assert(hole == file_length);
@@ -3237,7 +3242,7 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
 
 #if defined(__linux__)
 /* Verify that the file is not in the page cache */
-static void coroutine_fn check_cache_dropped(BlockDriverState *bs, Error **errp)
+static void check_cache_dropped(BlockDriverState *bs, Error **errp)
 {
     const size_t window_size = 128 * 1024 * 1024;
     BDRVRawState *s = bs->opaque;
@@ -3252,7 +3257,7 @@ static void coroutine_fn check_cache_dropped(BlockDriverState *bs, Error **errp)
     page_size = sysconf(_SC_PAGESIZE);
     vec = g_malloc(DIV_ROUND_UP(window_size, page_size));
 
-    end = raw_co_getlength(bs);
+    end = raw_getlength(bs);
 
     for (offset = 0; offset < end; offset += window_size) {
         void *new_window;
@@ -4468,7 +4473,7 @@ static int cdrom_reopen(BlockDriverState *bs)
 
 static bool coroutine_fn cdrom_co_is_inserted(BlockDriverState *bs)
 {
-    return raw_co_getlength(bs) > 0;
+    return raw_getlength(bs) > 0;
 }
 
 static void coroutine_fn cdrom_co_eject(BlockDriverState *bs, bool eject_flag)

From bba667da7f19e3dc68a418d0b87e5978a16f89e9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:35 +0200
Subject: [PATCH 0252/1353] qed: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-3-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qed-check.c | 5 +++--
 block/qed.c       | 7 ++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/block/qed-check.c b/block/qed-check.c
index 8fd94f405e..6a01b94f9c 100644
--- a/block/qed-check.c
+++ b/block/qed-check.c
@@ -200,7 +200,8 @@ static void qed_check_for_leaks(QEDCheck *check)
 /**
  * Mark an image clean once it passes check or has been repaired
  */
-static void qed_check_mark_clean(BDRVQEDState *s, BdrvCheckResult *result)
+static void coroutine_fn GRAPH_RDLOCK
+qed_check_mark_clean(BDRVQEDState *s, BdrvCheckResult *result)
 {
     /* Skip if there were unfixable corruptions or I/O errors */
     if (result->corruptions > 0 || result->check_errors > 0) {
@@ -213,7 +214,7 @@ static void qed_check_mark_clean(BDRVQEDState *s, BdrvCheckResult *result)
     }
 
     /* Ensure fixes reach storage before clearing check bit */
-    bdrv_flush(s->bs);
+    bdrv_co_flush(s->bs);
 
     s->header.features &= ~QED_F_NEED_CHECK;
     qed_write_header_sync(s);
diff --git a/block/qed.c b/block/qed.c
index 9a0350b534..2cab3540a9 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -195,14 +195,15 @@ static bool qed_is_image_size_valid(uint64_t image_size, uint32_t cluster_size,
  *
  * The string is NUL-terminated.
  */
-static int qed_read_string(BdrvChild *file, uint64_t offset, size_t n,
-                           char *buf, size_t buflen)
+static int coroutine_fn GRAPH_RDLOCK
+qed_read_string(BdrvChild *file, uint64_t offset,
+                size_t n, char *buf, size_t buflen)
 {
     int ret;
     if (n >= buflen) {
         return -EINVAL;
     }
-    ret = bdrv_pread(file, offset, n, buf, 0);
+    ret = bdrv_co_pread(file, offset, n, buf, 0);
     if (ret < 0) {
         return ret;
     }

From 517b5dfffdbddd34c0ab126a00421483d80d4318 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:36 +0200
Subject: [PATCH 0253/1353] vpc: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-4-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 52 ++++++++++++++++++++++++++--------------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index 7ee7c7b4e0..3810a601a3 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -486,8 +486,8 @@ static int vpc_reopen_prepare(BDRVReopenState *state,
  * operation (the block bitmaps is updated then), 0 otherwise.
  * If write is true then err must not be NULL.
  */
-static inline int64_t get_image_offset(BlockDriverState *bs, uint64_t offset,
-                                       bool write, int *err)
+static int64_t coroutine_fn GRAPH_RDLOCK
+get_image_offset(BlockDriverState *bs, uint64_t offset, bool write, int *err)
 {
     BDRVVPCState *s = bs->opaque;
     uint64_t bitmap_offset, block_offset;
@@ -515,8 +515,7 @@ static inline int64_t get_image_offset(BlockDriverState *bs, uint64_t offset,
 
         s->last_bitmap_offset = bitmap_offset;
         memset(bitmap, 0xff, s->bitmap_size);
-        r = bdrv_pwrite_sync(bs->file, bitmap_offset, s->bitmap_size, bitmap,
-                             0);
+        r = bdrv_co_pwrite_sync(bs->file, bitmap_offset, s->bitmap_size, bitmap, 0);
         if (r < 0) {
             *err = r;
             return -2;
@@ -532,13 +531,13 @@ static inline int64_t get_image_offset(BlockDriverState *bs, uint64_t offset,
  *
  * Returns 0 on success and < 0 on error
  */
-static int rewrite_footer(BlockDriverState *bs)
+static int coroutine_fn GRAPH_RDLOCK rewrite_footer(BlockDriverState *bs)
 {
     int ret;
     BDRVVPCState *s = bs->opaque;
     int64_t offset = s->free_data_block_offset;
 
-    ret = bdrv_pwrite_sync(bs->file, offset, sizeof(s->footer), &s->footer, 0);
+    ret = bdrv_co_pwrite_sync(bs->file, offset, sizeof(s->footer), &s->footer, 0);
     if (ret < 0)
         return ret;
 
@@ -552,7 +551,8 @@ static int rewrite_footer(BlockDriverState *bs)
  *
  * Returns the sectors' offset in the image file on success and < 0 on error
  */
-static int64_t alloc_block(BlockDriverState *bs, int64_t offset)
+static int64_t coroutine_fn GRAPH_RDLOCK
+alloc_block(BlockDriverState *bs, int64_t offset)
 {
     BDRVVPCState *s = bs->opaque;
     int64_t bat_offset;
@@ -572,8 +572,8 @@ static int64_t alloc_block(BlockDriverState *bs, int64_t offset)
 
     /* Initialize the block's bitmap */
     memset(bitmap, 0xff, s->bitmap_size);
-    ret = bdrv_pwrite_sync(bs->file, s->free_data_block_offset,
-                           s->bitmap_size, bitmap, 0);
+    ret = bdrv_co_pwrite_sync(bs->file, s->free_data_block_offset,
+                              s->bitmap_size, bitmap, 0);
     if (ret < 0) {
         return ret;
     }
@@ -587,7 +587,7 @@ static int64_t alloc_block(BlockDriverState *bs, int64_t offset)
     /* Write BAT entry to disk */
     bat_offset = s->bat_offset + (4 * index);
     bat_value = cpu_to_be32(s->pagetable[index]);
-    ret = bdrv_pwrite_sync(bs->file, bat_offset, 4, &bat_value, 0);
+    ret = bdrv_co_pwrite_sync(bs->file, bat_offset, 4, &bat_value, 0);
     if (ret < 0)
         goto fail;
 
@@ -718,11 +718,11 @@ fail:
     return ret;
 }
 
-static int coroutine_fn vpc_co_block_status(BlockDriverState *bs,
-                                            bool want_zero,
-                                            int64_t offset, int64_t bytes,
-                                            int64_t *pnum, int64_t *map,
-                                            BlockDriverState **file)
+static int coroutine_fn GRAPH_RDLOCK
+vpc_co_block_status(BlockDriverState *bs, bool want_zero,
+                    int64_t offset, int64_t bytes,
+                    int64_t *pnum, int64_t *map,
+                    BlockDriverState **file)
 {
     BDRVVPCState *s = bs->opaque;
     int64_t image_offset;
@@ -820,8 +820,8 @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
     return 0;
 }
 
-static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
-                               int64_t total_sectors)
+static int coroutine_fn create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
+                                            int64_t total_sectors)
 {
     VHDDynDiskHeader dyndisk_header;
     uint8_t bat_sector[512];
@@ -834,13 +834,13 @@ static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
     block_size = 0x200000;
     num_bat_entries = DIV_ROUND_UP(total_sectors, block_size / 512);
 
-    ret = blk_pwrite(blk, offset, sizeof(*footer), footer, 0);
+    ret = blk_co_pwrite(blk, offset, sizeof(*footer), footer, 0);
     if (ret < 0) {
         goto fail;
     }
 
     offset = 1536 + ((num_bat_entries * 4 + 511) & ~511);
-    ret = blk_pwrite(blk, offset, sizeof(*footer), footer, 0);
+    ret = blk_co_pwrite(blk, offset, sizeof(*footer), footer, 0);
     if (ret < 0) {
         goto fail;
     }
@@ -850,7 +850,7 @@ static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
 
     memset(bat_sector, 0xFF, 512);
     for (i = 0; i < DIV_ROUND_UP(num_bat_entries * 4, 512); i++) {
-        ret = blk_pwrite(blk, offset, 512, bat_sector, 0);
+        ret = blk_co_pwrite(blk, offset, 512, bat_sector, 0);
         if (ret < 0) {
             goto fail;
         }
@@ -878,7 +878,7 @@ static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
     /* Write the header */
     offset = 512;
 
-    ret = blk_pwrite(blk, offset, sizeof(dyndisk_header), &dyndisk_header, 0);
+    ret = blk_co_pwrite(blk, offset, sizeof(dyndisk_header), &dyndisk_header, 0);
     if (ret < 0) {
         goto fail;
     }
@@ -888,21 +888,21 @@ static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
     return ret;
 }
 
-static int create_fixed_disk(BlockBackend *blk, VHDFooter *footer,
-                             int64_t total_size, Error **errp)
+static int coroutine_fn create_fixed_disk(BlockBackend *blk, VHDFooter *footer,
+                                          int64_t total_size, Error **errp)
 {
     int ret;
 
     /* Add footer to total size */
     total_size += sizeof(*footer);
 
-    ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, 0, errp);
+    ret = blk_co_truncate(blk, total_size, false, PREALLOC_MODE_OFF, 0, errp);
     if (ret < 0) {
         return ret;
     }
 
-    ret = blk_pwrite(blk, total_size - sizeof(*footer), sizeof(*footer),
-                     footer, 0);
+    ret = blk_co_pwrite(blk, total_size - sizeof(*footer), sizeof(*footer),
+                        footer, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Unable to write VHD header");
         return ret;

From e7918e96193dbaf334c480ddde58ebc1370a84f6 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:37 +0200
Subject: [PATCH 0254/1353] bochs: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-5-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/bochs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/block/bochs.c b/block/bochs.c
index 2f5ae52c90..66e7a58e5e 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -203,7 +203,8 @@ static void bochs_refresh_limits(BlockDriverState *bs, Error **errp)
     bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
 }
 
-static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
+static int64_t coroutine_fn GRAPH_RDLOCK
+seek_to_sector(BlockDriverState *bs, int64_t sector_num)
 {
     BDRVBochsState *s = bs->opaque;
     uint64_t offset = sector_num * 512;
@@ -224,8 +225,8 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
         (s->extent_blocks + s->bitmap_blocks));
 
     /* read in bitmap for current extent */
-    ret = bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8), 1,
-                     &bitmap_entry, 0);
+    ret = bdrv_co_pread(bs->file, bitmap_offset + (extent_offset / 8), 1,
+                        &bitmap_entry, 0);
     if (ret < 0) {
         return ret;
     }

From 84569a7df34c37aeb6b7cfa52bd803f66aa4ca0d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:38 +0200
Subject: [PATCH 0255/1353] block: mark another function as coroutine_fns and
 GRAPH_UNLOCKED

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Because this function operates on a BlockBackend, mark it
GRAPH_UNLOCKED.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-6-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/block.c b/block.c
index 0cd1a12344..a307c151a8 100644
--- a/block.c
+++ b/block.c
@@ -555,8 +555,9 @@ int coroutine_fn bdrv_co_create(BlockDriver *drv, const char *filename,
  * On success, return @blk's actual length.
  * Otherwise, return -errno.
  */
-static int64_t create_file_fallback_truncate(BlockBackend *blk,
-                                             int64_t minimum_size, Error **errp)
+static int64_t coroutine_fn GRAPH_UNLOCKED
+create_file_fallback_truncate(BlockBackend *blk, int64_t minimum_size,
+                              Error **errp)
 {
     Error *local_err = NULL;
     int64_t size;
@@ -564,14 +565,14 @@ static int64_t create_file_fallback_truncate(BlockBackend *blk,
 
     GLOBAL_STATE_CODE();
 
-    ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
-                       &local_err);
+    ret = blk_co_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
+                          &local_err);
     if (ret < 0 && ret != -ENOTSUP) {
         error_propagate(errp, local_err);
         return ret;
     }
 
-    size = blk_getlength(blk);
+    size = blk_co_getlength(blk);
     if (size < 0) {
         error_free(local_err);
         error_setg_errno(errp, -size,

From cf8d4c582b58f4f83f3b5b9bd7937de98cfb496a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:39 +0200
Subject: [PATCH 0256/1353] cloop: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-7-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/cloop.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/block/cloop.c b/block/cloop.c
index 1e5a52d6b2..835a0fe3da 100644
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -212,7 +212,8 @@ static void cloop_refresh_limits(BlockDriverState *bs, Error **errp)
     bs->bl.request_alignment = BDRV_SECTOR_SIZE; /* No sub-sector I/O */
 }
 
-static inline int cloop_read_block(BlockDriverState *bs, int block_num)
+static int coroutine_fn GRAPH_RDLOCK
+cloop_read_block(BlockDriverState *bs, int block_num)
 {
     BDRVCloopState *s = bs->opaque;
 
@@ -220,8 +221,8 @@ static inline int cloop_read_block(BlockDriverState *bs, int block_num)
         int ret;
         uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
 
-        ret = bdrv_pread(bs->file, s->offsets[block_num], bytes,
-                         s->compressed_block, 0);
+        ret = bdrv_co_pread(bs->file, s->offsets[block_num], bytes,
+                            s->compressed_block, 0);
         if (ret < 0) {
             return -1;
         }
@@ -244,7 +245,7 @@ static inline int cloop_read_block(BlockDriverState *bs, int block_num)
     return 0;
 }
 
-static int coroutine_fn
+static int coroutine_fn GRAPH_RDLOCK
 cloop_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
                 QEMUIOVector *qiov, BdrvRequestFlags flags)
 {

From 688dc49da5af749c54def041b8e1594adf048f96 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:40 +0200
Subject: [PATCH 0257/1353] dmg: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-8-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/dmg.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/block/dmg.c b/block/dmg.c
index 2769900359..06a0244a9c 100644
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -616,7 +616,8 @@ err:
     return s->n_chunks; /* error */
 }
 
-static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
+static int coroutine_fn GRAPH_RDLOCK
+dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
 {
     BDRVDMGState *s = bs->opaque;
 
@@ -633,8 +634,8 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
         case UDZO: { /* zlib compressed */
             /* we need to buffer, because only the chunk as whole can be
              * inflated. */
-            ret = bdrv_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
-                             s->compressed_chunk, 0);
+            ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
+                                s->compressed_chunk, 0);
             if (ret < 0) {
                 return -1;
             }
@@ -659,8 +660,8 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
             }
             /* we need to buffer, because only the chunk as whole can be
              * inflated. */
-            ret = bdrv_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
-                             s->compressed_chunk, 0);
+            ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
+                                s->compressed_chunk, 0);
             if (ret < 0) {
                 return -1;
             }
@@ -680,8 +681,8 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
             }
             /* we need to buffer, because only the chunk as whole can be
              * inflated. */
-            ret = bdrv_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
-                             s->compressed_chunk, 0);
+            ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
+                                s->compressed_chunk, 0);
             if (ret < 0) {
                 return -1;
             }
@@ -696,8 +697,8 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
             }
             break;
         case UDRW: /* copy */
-            ret = bdrv_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
-                             s->uncompressed_chunk, 0);
+            ret = bdrv_co_pread(bs->file, s->offsets[chunk], s->lengths[chunk],
+                                s->uncompressed_chunk, 0);
             if (ret < 0) {
                 return -1;
             }
@@ -713,7 +714,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
     return 0;
 }
 
-static int coroutine_fn
+static int coroutine_fn GRAPH_RDLOCK
 dmg_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
               QEMUIOVector *qiov, BdrvRequestFlags flags)
 {

From 28944f99c473f55b6b5a4210f697f7eec9a9bc23 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:41 +0200
Subject: [PATCH 0258/1353] vmdk: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-9-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vmdk.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index e3e86608ec..0410b895dc 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -339,7 +339,8 @@ out:
     return ret;
 }
 
-static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
+static int coroutine_fn GRAPH_RDLOCK
+vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
 {
     char *desc, *tmp_desc;
     char *p_name, *tmp_str;
@@ -348,7 +349,7 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
 
     desc = g_malloc0(DESC_SIZE);
     tmp_desc = g_malloc0(DESC_SIZE);
-    ret = bdrv_pread(bs->file, s->desc_offset, DESC_SIZE, desc, 0);
+    ret = bdrv_co_pread(bs->file, s->desc_offset, DESC_SIZE, desc, 0);
     if (ret < 0) {
         goto out;
     }
@@ -368,7 +369,7 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
         pstrcat(desc, DESC_SIZE, tmp_desc);
     }
 
-    ret = bdrv_pwrite_sync(bs->file, s->desc_offset, DESC_SIZE, desc, 0);
+    ret = bdrv_co_pwrite_sync(bs->file, s->desc_offset, DESC_SIZE, desc, 0);
 
 out:
     g_free(desc);
@@ -2165,7 +2166,7 @@ vmdk_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes,
     return ret;
 }
 
-static int GRAPH_UNLOCKED
+static int coroutine_fn GRAPH_UNLOCKED
 vmdk_init_extent(BlockBackend *blk, int64_t filesize, bool flat, bool compress,
                  bool zeroed_grain, Error **errp)
 {
@@ -2176,7 +2177,7 @@ vmdk_init_extent(BlockBackend *blk, int64_t filesize, bool flat, bool compress,
     int gd_buf_size;
 
     if (flat) {
-        ret = blk_truncate(blk, filesize, false, PREALLOC_MODE_OFF, 0, errp);
+        ret = blk_co_truncate(blk, filesize, false, PREALLOC_MODE_OFF, 0, errp);
         goto exit;
     }
     magic = cpu_to_be32(VMDK4_MAGIC);
@@ -2228,19 +2229,19 @@ vmdk_init_extent(BlockBackend *blk, int64_t filesize, bool flat, bool compress,
     header.check_bytes[3] = 0xa;
 
     /* write all the data */
-    ret = blk_pwrite(blk, 0, sizeof(magic), &magic, 0);
+    ret = blk_co_pwrite(blk, 0, sizeof(magic), &magic, 0);
     if (ret < 0) {
         error_setg(errp, QERR_IO_ERROR);
         goto exit;
     }
-    ret = blk_pwrite(blk, sizeof(magic), sizeof(header), &header, 0);
+    ret = blk_co_pwrite(blk, sizeof(magic), sizeof(header), &header, 0);
     if (ret < 0) {
         error_setg(errp, QERR_IO_ERROR);
         goto exit;
     }
 
-    ret = blk_truncate(blk, le64_to_cpu(header.grain_offset) << 9, false,
-                       PREALLOC_MODE_OFF, 0, errp);
+    ret = blk_co_truncate(blk, le64_to_cpu(header.grain_offset) << 9, false,
+                          PREALLOC_MODE_OFF, 0, errp);
     if (ret < 0) {
         goto exit;
     }
@@ -2252,8 +2253,8 @@ vmdk_init_extent(BlockBackend *blk, int64_t filesize, bool flat, bool compress,
          i < gt_count; i++, tmp += gt_size) {
         gd_buf[i] = cpu_to_le32(tmp);
     }
-    ret = blk_pwrite(blk, le64_to_cpu(header.rgd_offset) * BDRV_SECTOR_SIZE,
-                     gd_buf_size, gd_buf, 0);
+    ret = blk_co_pwrite(blk, le64_to_cpu(header.rgd_offset) * BDRV_SECTOR_SIZE,
+                        gd_buf_size, gd_buf, 0);
     if (ret < 0) {
         error_setg(errp, QERR_IO_ERROR);
         goto exit;
@@ -2264,8 +2265,8 @@ vmdk_init_extent(BlockBackend *blk, int64_t filesize, bool flat, bool compress,
          i < gt_count; i++, tmp += gt_size) {
         gd_buf[i] = cpu_to_le32(tmp);
     }
-    ret = blk_pwrite(blk, le64_to_cpu(header.gd_offset) * BDRV_SECTOR_SIZE,
-                     gd_buf_size, gd_buf, 0);
+    ret = blk_co_pwrite(blk, le64_to_cpu(header.gd_offset) * BDRV_SECTOR_SIZE,
+                        gd_buf_size, gd_buf, 0);
     if (ret < 0) {
         error_setg(errp, QERR_IO_ERROR);
     }

From f6b08994934f89866b510d335c6273bf998e857b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:42 +0200
Subject: [PATCH 0259/1353] vhdx: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-10-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vhdx-log.c | 36 +++++++++++++-----------
 block/vhdx.c     | 73 +++++++++++++++++++++++-------------------------
 block/vhdx.h     |  5 ++--
 3 files changed, 57 insertions(+), 57 deletions(-)

diff --git a/block/vhdx-log.c b/block/vhdx-log.c
index 38148f107a..d8ed651b70 100644
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -169,9 +169,10 @@ exit:
  * It is assumed that 'buffer' is at least 4096*num_sectors large.
  *
  * 0 is returned on success, -errno otherwise */
-static int vhdx_log_write_sectors(BlockDriverState *bs, VHDXLogEntries *log,
-                                  uint32_t *sectors_written, void *buffer,
-                                  uint32_t num_sectors)
+static int coroutine_fn GRAPH_RDLOCK
+vhdx_log_write_sectors(BlockDriverState *bs, VHDXLogEntries *log,
+                       uint32_t *sectors_written, void *buffer,
+                       uint32_t num_sectors)
 {
     int ret = 0;
     uint64_t offset;
@@ -195,8 +196,7 @@ static int vhdx_log_write_sectors(BlockDriverState *bs, VHDXLogEntries *log,
             /* full */
             break;
         }
-        ret = bdrv_pwrite(bs->file, offset, VHDX_LOG_SECTOR_SIZE, buffer_tmp,
-                          0);
+        ret = bdrv_co_pwrite(bs->file, offset, VHDX_LOG_SECTOR_SIZE, buffer_tmp, 0);
         if (ret < 0) {
             goto exit;
         }
@@ -853,8 +853,9 @@ static void vhdx_log_raw_to_le_sector(VHDXLogDescriptor *desc,
 }
 
 
-static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
-                          void *data, uint32_t length, uint64_t offset)
+static int coroutine_fn GRAPH_RDLOCK
+vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
+               void *data, uint32_t length, uint64_t offset)
 {
     int ret = 0;
     void *buffer = NULL;
@@ -924,7 +925,7 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
 
     sectors += partial_sectors;
 
-    file_length = bdrv_getlength(bs->file->bs);
+    file_length = bdrv_co_getlength(bs->file->bs);
     if (file_length < 0) {
         ret = file_length;
         goto exit;
@@ -971,8 +972,8 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
 
         if (i == 0 && leading_length) {
             /* partial sector at the front of the buffer */
-            ret = bdrv_pread(bs->file, file_offset, VHDX_LOG_SECTOR_SIZE,
-                             merged_sector, 0);
+            ret = bdrv_co_pread(bs->file, file_offset, VHDX_LOG_SECTOR_SIZE,
+                                merged_sector, 0);
             if (ret < 0) {
                 goto exit;
             }
@@ -981,9 +982,9 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
             sector_write = merged_sector;
         } else if (i == sectors - 1 && trailing_length) {
             /* partial sector at the end of the buffer */
-            ret = bdrv_pread(bs->file, file_offset + trailing_length,
-                             VHDX_LOG_SECTOR_SIZE - trailing_length,
-                             merged_sector + trailing_length, 0);
+            ret = bdrv_co_pread(bs->file, file_offset + trailing_length,
+                                VHDX_LOG_SECTOR_SIZE - trailing_length,
+                                merged_sector + trailing_length, 0);
             if (ret < 0) {
                 goto exit;
             }
@@ -1036,8 +1037,9 @@ exit:
 }
 
 /* Perform a log write, and then immediately flush the entire log */
-int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
-                             void *data, uint32_t length, uint64_t offset)
+int coroutine_fn
+vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
+                         void *data, uint32_t length, uint64_t offset)
 {
     int ret = 0;
     VHDXLogSequence logs = { .valid = true,
@@ -1047,7 +1049,7 @@ int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
 
     /* Make sure data written (new and/or changed blocks) is stable
      * on disk, before creating log entry */
-    ret = bdrv_flush(bs);
+    ret = bdrv_co_flush(bs);
     if (ret < 0) {
         goto exit;
     }
@@ -1059,7 +1061,7 @@ int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
     logs.log = s->log;
 
     /* Make sure log is stable on disk */
-    ret = bdrv_flush(bs);
+    ret = bdrv_co_flush(bs);
     if (ret < 0) {
         goto exit;
     }
diff --git a/block/vhdx.c b/block/vhdx.c
index 89913cba87..f2c3a80190 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -1250,12 +1250,13 @@ exit:
  *
  * Returns the file offset start of the new payload block
  */
-static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
-                               uint64_t *new_offset, bool *need_zero)
+static int coroutine_fn GRAPH_RDLOCK
+vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
+                    uint64_t *new_offset, bool *need_zero)
 {
     int64_t current_len;
 
-    current_len = bdrv_getlength(bs->file->bs);
+    current_len = bdrv_co_getlength(bs->file->bs);
     if (current_len < 0) {
         return current_len;
     }
@@ -1271,16 +1272,16 @@ static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
     if (*need_zero) {
         int ret;
 
-        ret = bdrv_truncate(bs->file, *new_offset + s->block_size, false,
-                            PREALLOC_MODE_OFF, BDRV_REQ_ZERO_WRITE, NULL);
+        ret = bdrv_co_truncate(bs->file, *new_offset + s->block_size, false,
+                               PREALLOC_MODE_OFF, BDRV_REQ_ZERO_WRITE, NULL);
         if (ret != -ENOTSUP) {
             *need_zero = false;
             return ret;
         }
     }
 
-    return bdrv_truncate(bs->file, *new_offset + s->block_size, false,
-                         PREALLOC_MODE_OFF, 0, NULL);
+    return bdrv_co_truncate(bs->file, *new_offset + s->block_size, false,
+                            PREALLOC_MODE_OFF, 0, NULL);
 }
 
 /*
@@ -1572,12 +1573,10 @@ exit:
  * The first 64KB of the Metadata section is reserved for the metadata
  * header and entries; beyond that, the metadata items themselves reside.
  */
-static int vhdx_create_new_metadata(BlockBackend *blk,
-                                    uint64_t image_size,
-                                    uint32_t block_size,
-                                    uint32_t sector_size,
-                                    uint64_t metadata_offset,
-                                    VHDXImageType type)
+static int coroutine_fn
+vhdx_create_new_metadata(BlockBackend *blk, uint64_t image_size,
+                         uint32_t block_size, uint32_t sector_size,
+                         uint64_t metadata_offset, VHDXImageType type)
 {
     int ret = 0;
     uint32_t offset = 0;
@@ -1668,13 +1667,13 @@ static int vhdx_create_new_metadata(BlockBackend *blk,
                                    VHDX_META_FLAGS_IS_VIRTUAL_DISK;
     vhdx_metadata_entry_le_export(&md_table_entry[4]);
 
-    ret = blk_pwrite(blk, metadata_offset, VHDX_HEADER_BLOCK_SIZE, buffer, 0);
+    ret = blk_co_pwrite(blk, metadata_offset, VHDX_HEADER_BLOCK_SIZE, buffer, 0);
     if (ret < 0) {
         goto exit;
     }
 
-    ret = blk_pwrite(blk, metadata_offset + (64 * KiB),
-                     VHDX_METADATA_ENTRY_BUFFER_SIZE, entry_buffer, 0);
+    ret = blk_co_pwrite(blk, metadata_offset + (64 * KiB),
+                        VHDX_METADATA_ENTRY_BUFFER_SIZE, entry_buffer, 0);
     if (ret < 0) {
         goto exit;
     }
@@ -1694,10 +1693,11 @@ exit:
  *  Fixed images: default state of the BAT is fully populated, with
  *                file offsets and state PAYLOAD_BLOCK_FULLY_PRESENT.
  */
-static int vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
-                           uint64_t image_size, VHDXImageType type,
-                           bool use_zero_blocks, uint64_t file_offset,
-                           uint32_t length, Error **errp)
+static int coroutine_fn
+vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
+                uint64_t image_size, VHDXImageType type,
+                bool use_zero_blocks, uint64_t file_offset,
+                uint32_t length, Error **errp)
 {
     int ret = 0;
     uint64_t data_file_offset;
@@ -1718,14 +1718,14 @@ static int vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
     if (type == VHDX_TYPE_DYNAMIC) {
         /* All zeroes, so we can just extend the file - the end of the BAT
          * is the furthest thing we have written yet */
-        ret = blk_truncate(blk, data_file_offset, false, PREALLOC_MODE_OFF,
-                           0, errp);
+        ret = blk_co_truncate(blk, data_file_offset, false, PREALLOC_MODE_OFF,
+                              0, errp);
         if (ret < 0) {
             goto exit;
         }
     } else if (type == VHDX_TYPE_FIXED) {
-        ret = blk_truncate(blk, data_file_offset + image_size, false,
-                           PREALLOC_MODE_OFF, 0, errp);
+        ret = blk_co_truncate(blk, data_file_offset + image_size, false,
+                              PREALLOC_MODE_OFF, 0, errp);
         if (ret < 0) {
             goto exit;
         }
@@ -1759,7 +1759,7 @@ static int vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
             s->bat[sinfo.bat_idx] = cpu_to_le64(s->bat[sinfo.bat_idx]);
             sector_num += s->sectors_per_block;
         }
-        ret = blk_pwrite(blk, file_offset, length, s->bat, 0);
+        ret = blk_co_pwrite(blk, file_offset, length, s->bat, 0);
         if (ret < 0) {
             error_setg_errno(errp, -ret, "Failed to write the BAT");
             goto exit;
@@ -1780,15 +1780,12 @@ exit:
  * to create the BAT itself, we will also cause the BAT to be
  * created.
  */
-static int vhdx_create_new_region_table(BlockBackend *blk,
-                                        uint64_t image_size,
-                                        uint32_t block_size,
-                                        uint32_t sector_size,
-                                        uint32_t log_size,
-                                        bool use_zero_blocks,
-                                        VHDXImageType type,
-                                        uint64_t *metadata_offset,
-                                        Error **errp)
+static int coroutine_fn
+vhdx_create_new_region_table(BlockBackend *blk, uint64_t image_size,
+                             uint32_t block_size, uint32_t sector_size,
+                             uint32_t log_size, bool use_zero_blocks,
+                             VHDXImageType type, uint64_t *metadata_offset,
+                             Error **errp)
 {
     int ret = 0;
     uint32_t offset = 0;
@@ -1863,15 +1860,15 @@ static int vhdx_create_new_region_table(BlockBackend *blk,
     }
 
     /* Now write out the region headers to disk */
-    ret = blk_pwrite(blk, VHDX_REGION_TABLE_OFFSET, VHDX_HEADER_BLOCK_SIZE,
-                     buffer, 0);
+    ret = blk_co_pwrite(blk, VHDX_REGION_TABLE_OFFSET, VHDX_HEADER_BLOCK_SIZE,
+                        buffer, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Failed to write first region table");
         goto exit;
     }
 
-    ret = blk_pwrite(blk, VHDX_REGION_TABLE2_OFFSET, VHDX_HEADER_BLOCK_SIZE,
-                     buffer, 0);
+    ret = blk_co_pwrite(blk, VHDX_REGION_TABLE2_OFFSET, VHDX_HEADER_BLOCK_SIZE,
+                        buffer, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Failed to write second region table");
         goto exit;
diff --git a/block/vhdx.h b/block/vhdx.h
index 0b74924cee..7db746cd18 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -413,8 +413,9 @@ bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset);
 int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s, bool *flushed,
                    Error **errp);
 
-int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
-                             void *data, uint32_t length, uint64_t offset);
+int coroutine_fn GRAPH_RDLOCK
+vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
+                         void *data, uint32_t length, uint64_t offset);
 
 static inline void leguid_to_cpus(MSGUID *guid)
 {

From 70bacc44532f6324473b8d701705cd003e2fe678 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:43 +0200
Subject: [PATCH 0260/1353] qcow2: mark more functions as coroutine_fns and
 GRAPH_RDLOCK

Mark functions as coroutine_fn when they are only called by other coroutine_fns
and they can suspend.  Change calls to co_wrappers to use the non-wrapped
functions, which in turn requires adding GRAPH_RDLOCK annotations.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-11-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2-bitmap.c   |  26 +++++----
 block/qcow2-cluster.c  |  12 ++--
 block/qcow2-refcount.c | 130 +++++++++++++++++++++--------------------
 block/qcow2.c          |   2 +-
 block/qcow2.h          |  33 +++++------
 5 files changed, 105 insertions(+), 98 deletions(-)

diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
index a952fd58d8..037fa2d435 100644
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -283,10 +283,9 @@ static int free_bitmap_clusters(BlockDriverState *bs, Qcow2BitmapTable *tb)
 /* load_bitmap_data
  * @bitmap_table entries must satisfy specification constraints.
  * @bitmap must be cleared */
-static int load_bitmap_data(BlockDriverState *bs,
-                            const uint64_t *bitmap_table,
-                            uint32_t bitmap_table_size,
-                            BdrvDirtyBitmap *bitmap)
+static int coroutine_fn GRAPH_RDLOCK
+load_bitmap_data(BlockDriverState *bs, const uint64_t *bitmap_table,
+                 uint32_t bitmap_table_size, BdrvDirtyBitmap *bitmap)
 {
     int ret = 0;
     BDRVQcow2State *s = bs->opaque;
@@ -319,7 +318,7 @@ static int load_bitmap_data(BlockDriverState *bs,
                  * already cleared */
             }
         } else {
-            ret = bdrv_pread(bs->file, data_offset, s->cluster_size, buf, 0);
+            ret = bdrv_co_pread(bs->file, data_offset, s->cluster_size, buf, 0);
             if (ret < 0) {
                 goto finish;
             }
@@ -337,8 +336,9 @@ finish:
     return ret;
 }
 
-static BdrvDirtyBitmap *load_bitmap(BlockDriverState *bs,
-                                    Qcow2Bitmap *bm, Error **errp)
+static coroutine_fn GRAPH_RDLOCK
+BdrvDirtyBitmap *load_bitmap(BlockDriverState *bs,
+                             Qcow2Bitmap *bm, Error **errp)
 {
     int ret;
     uint64_t *bitmap_table = NULL;
@@ -649,9 +649,10 @@ fail:
     return NULL;
 }
 
-int qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                                  void **refcount_table,
-                                  int64_t *refcount_table_size)
+int coroutine_fn
+qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
+                              void **refcount_table,
+                              int64_t *refcount_table_size)
 {
     int ret;
     BDRVQcow2State *s = bs->opaque;
@@ -957,8 +958,9 @@ static void set_readonly_helper(gpointer bitmap, gpointer value)
  * If header_updated is not NULL then it is set appropriately regardless of
  * the return value.
  */
-bool coroutine_fn qcow2_load_dirty_bitmaps(BlockDriverState *bs,
-                                           bool *header_updated, Error **errp)
+bool coroutine_fn GRAPH_RDLOCK
+qcow2_load_dirty_bitmaps(BlockDriverState *bs,
+                         bool *header_updated, Error **errp)
 {
     BDRVQcow2State *s = bs->opaque;
     Qcow2BitmapList *bm_list;
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 2e76de027c..6172b2df40 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -823,10 +823,9 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
  *
  * Return 0 on success and -errno in error cases
  */
-int coroutine_fn qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
-                                                       uint64_t offset,
-                                                       int compressed_size,
-                                                       uint64_t *host_offset)
+int coroutine_fn GRAPH_RDLOCK
+qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs, uint64_t offset,
+                                      int compressed_size, uint64_t *host_offset)
 {
     BDRVQcow2State *s = bs->opaque;
     int l2_index, ret;
@@ -2038,8 +2037,9 @@ fail:
  * all clusters in the same L2 slice) and returns the number of zeroed
  * clusters.
  */
-static int zero_in_l2_slice(BlockDriverState *bs, uint64_t offset,
-                            uint64_t nb_clusters, int flags)
+static int coroutine_fn
+zero_in_l2_slice(BlockDriverState *bs, uint64_t offset,
+                 uint64_t nb_clusters, int flags)
 {
     BDRVQcow2State *s = bs->opaque;
     uint64_t *l2_slice;
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 4cf91bd955..de527c3ee4 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -1069,7 +1069,7 @@ int64_t coroutine_fn qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offs
 
 /* only used to allocate compressed sectors. We try to allocate
    contiguous sectors. size must be <= cluster_size */
-int64_t coroutine_fn qcow2_alloc_bytes(BlockDriverState *bs, int size)
+int64_t coroutine_fn GRAPH_RDLOCK qcow2_alloc_bytes(BlockDriverState *bs, int size)
 {
     BDRVQcow2State *s = bs->opaque;
     int64_t offset;
@@ -1524,10 +1524,11 @@ static int realloc_refcount_array(BDRVQcow2State *s, void **array,
  *
  * Modifies the number of errors in res.
  */
-int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
-                             void **refcount_table,
-                             int64_t *refcount_table_size,
-                             int64_t offset, int64_t size)
+int coroutine_fn GRAPH_RDLOCK
+qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
+                         void **refcount_table,
+                         int64_t *refcount_table_size,
+                         int64_t offset, int64_t size)
 {
     BDRVQcow2State *s = bs->opaque;
     uint64_t start, last, cluster_offset, k, refcount;
@@ -1538,7 +1539,7 @@ int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
         return 0;
     }
 
-    file_len = bdrv_getlength(bs->file->bs);
+    file_len = bdrv_co_getlength(bs->file->bs);
     if (file_len < 0) {
         return file_len;
     }
@@ -1600,10 +1601,11 @@ enum {
  *
  * On failure in-memory @l2_table may be modified.
  */
-static int fix_l2_entry_by_zero(BlockDriverState *bs, BdrvCheckResult *res,
-                                uint64_t l2_offset,
-                                uint64_t *l2_table, int l2_index, bool active,
-                                bool *metadata_overlap)
+static int coroutine_fn GRAPH_RDLOCK
+fix_l2_entry_by_zero(BlockDriverState *bs, BdrvCheckResult *res,
+                     uint64_t l2_offset, uint64_t *l2_table,
+                     int l2_index, bool active,
+                     bool *metadata_overlap)
 {
     BDRVQcow2State *s = bs->opaque;
     int ret;
@@ -1634,8 +1636,8 @@ static int fix_l2_entry_by_zero(BlockDriverState *bs, BdrvCheckResult *res,
         goto fail;
     }
 
-    ret = bdrv_pwrite_sync(bs->file, l2e_offset, l2_entry_size(s),
-                           &l2_table[idx], 0);
+    ret = bdrv_co_pwrite_sync(bs->file, l2e_offset, l2_entry_size(s),
+                              &l2_table[idx], 0);
     if (ret < 0) {
         fprintf(stderr, "ERROR: Failed to overwrite L2 "
                 "table entry: %s\n", strerror(-ret));
@@ -1659,10 +1661,11 @@ fail:
  * Returns the number of errors found by the checks or -errno if an internal
  * error occurred.
  */
-static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
-                              void **refcount_table,
-                              int64_t *refcount_table_size, int64_t l2_offset,
-                              int flags, BdrvCheckMode fix, bool active)
+static int coroutine_fn GRAPH_RDLOCK
+check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
+                   void **refcount_table,
+                   int64_t *refcount_table_size, int64_t l2_offset,
+                   int flags, BdrvCheckMode fix, bool active)
 {
     BDRVQcow2State *s = bs->opaque;
     uint64_t l2_entry, l2_bitmap;
@@ -1673,7 +1676,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
     bool metadata_overlap;
 
     /* Read L2 table from disk */
-    ret = bdrv_pread(bs->file, l2_offset, l2_size_bytes, l2_table, 0);
+    ret = bdrv_co_pread(bs->file, l2_offset, l2_size_bytes, l2_table, 0);
     if (ret < 0) {
         fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
         res->check_errors++;
@@ -1858,12 +1861,11 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
  * Returns the number of errors found by the checks or -errno if an internal
  * error occurred.
  */
-static int check_refcounts_l1(BlockDriverState *bs,
-                              BdrvCheckResult *res,
-                              void **refcount_table,
-                              int64_t *refcount_table_size,
-                              int64_t l1_table_offset, int l1_size,
-                              int flags, BdrvCheckMode fix, bool active)
+static int coroutine_fn GRAPH_RDLOCK
+check_refcounts_l1(BlockDriverState *bs, BdrvCheckResult *res,
+                   void **refcount_table, int64_t *refcount_table_size,
+                   int64_t l1_table_offset, int l1_size,
+                   int flags, BdrvCheckMode fix, bool active)
 {
     BDRVQcow2State *s = bs->opaque;
     size_t l1_size_bytes = l1_size * L1E_SIZE;
@@ -1889,7 +1891,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
     }
 
     /* Read L1 table entries from disk */
-    ret = bdrv_pread(bs->file, l1_table_offset, l1_size_bytes, l1_table, 0);
+    ret = bdrv_co_pread(bs->file, l1_table_offset, l1_size_bytes, l1_table, 0);
     if (ret < 0) {
         fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
         res->check_errors++;
@@ -1949,8 +1951,8 @@ static int check_refcounts_l1(BlockDriverState *bs,
  * have been already detected and sufficiently signaled by the calling function
  * (qcow2_check_refcounts) by the time this function is called).
  */
-static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
-                              BdrvCheckMode fix)
+static int coroutine_fn GRAPH_RDLOCK
+check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res, BdrvCheckMode fix)
 {
     BDRVQcow2State *s = bs->opaque;
     uint64_t *l2_table = qemu_blockalign(bs, s->cluster_size);
@@ -2005,8 +2007,8 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
             }
         }
 
-        ret = bdrv_pread(bs->file, l2_offset, s->l2_size * l2_entry_size(s),
-                         l2_table, 0);
+        ret = bdrv_co_pread(bs->file, l2_offset, s->l2_size * l2_entry_size(s),
+                            l2_table, 0);
         if (ret < 0) {
             fprintf(stderr, "ERROR: Could not read L2 table: %s\n",
                     strerror(-ret));
@@ -2059,8 +2061,7 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
                 goto fail;
             }
 
-            ret = bdrv_pwrite(bs->file, l2_offset, s->cluster_size, l2_table,
-                              0);
+            ret = bdrv_co_pwrite(bs->file, l2_offset, s->cluster_size, l2_table, 0);
             if (ret < 0) {
                 fprintf(stderr, "ERROR: Could not write L2 table: %s\n",
                         strerror(-ret));
@@ -2083,9 +2084,10 @@ fail:
  * Checks consistency of refblocks and accounts for each refblock in
  * *refcount_table.
  */
-static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
-                           BdrvCheckMode fix, bool *rebuild,
-                           void **refcount_table, int64_t *nb_clusters)
+static int coroutine_fn GRAPH_RDLOCK
+check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
+                BdrvCheckMode fix, bool *rebuild,
+                void **refcount_table, int64_t *nb_clusters)
 {
     BDRVQcow2State *s = bs->opaque;
     int64_t i, size;
@@ -2127,13 +2129,13 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                     goto resize_fail;
                 }
 
-                ret = bdrv_truncate(bs->file, offset + s->cluster_size, false,
-                                    PREALLOC_MODE_OFF, 0, &local_err);
+                ret = bdrv_co_truncate(bs->file, offset + s->cluster_size, false,
+                                       PREALLOC_MODE_OFF, 0, &local_err);
                 if (ret < 0) {
                     error_report_err(local_err);
                     goto resize_fail;
                 }
-                size = bdrv_getlength(bs->file->bs);
+                size = bdrv_co_getlength(bs->file->bs);
                 if (size < 0) {
                     ret = size;
                     goto resize_fail;
@@ -2197,9 +2199,10 @@ resize_fail:
 /*
  * Calculates an in-memory refcount table.
  */
-static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                               BdrvCheckMode fix, bool *rebuild,
-                               void **refcount_table, int64_t *nb_clusters)
+static int coroutine_fn GRAPH_RDLOCK
+calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
+                    BdrvCheckMode fix, bool *rebuild,
+                    void **refcount_table, int64_t *nb_clusters)
 {
     BDRVQcow2State *s = bs->opaque;
     int64_t i;
@@ -2299,10 +2302,11 @@ static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
  * Compares the actual reference count for each cluster in the image against the
  * refcount as reported by the refcount structures on-disk.
  */
-static void compare_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                              BdrvCheckMode fix, bool *rebuild,
-                              int64_t *highest_cluster,
-                              void *refcount_table, int64_t nb_clusters)
+static void coroutine_fn
+compare_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
+                  BdrvCheckMode fix, bool *rebuild,
+                  int64_t *highest_cluster,
+                  void *refcount_table, int64_t nb_clusters)
 {
     BDRVQcow2State *s = bs->opaque;
     int64_t i;
@@ -2463,7 +2467,8 @@ static int64_t alloc_clusters_imrt(BlockDriverState *bs,
  * Return whether the on-disk reftable array was resized (true/false),
  * or -errno on error.
  */
-static int rebuild_refcounts_write_refblocks(
+static int coroutine_fn GRAPH_RDLOCK
+rebuild_refcounts_write_refblocks(
         BlockDriverState *bs, void **refcount_table, int64_t *nb_clusters,
         int64_t first_cluster, int64_t end_cluster,
         uint64_t **on_disk_reftable_ptr, uint32_t *on_disk_reftable_entries_ptr,
@@ -2578,8 +2583,8 @@ static int rebuild_refcounts_write_refblocks(
         on_disk_refblock = (void *)((char *) *refcount_table +
                                     refblock_index * s->cluster_size);
 
-        ret = bdrv_pwrite(bs->file, refblock_offset, s->cluster_size,
-                          on_disk_refblock, 0);
+        ret = bdrv_co_pwrite(bs->file, refblock_offset, s->cluster_size,
+                             on_disk_refblock, 0);
         if (ret < 0) {
             error_setg_errno(errp, -ret, "ERROR writing refblock");
             return ret;
@@ -2601,11 +2606,10 @@ static int rebuild_refcounts_write_refblocks(
  * On success, the old refcount structure is leaked (it will be covered by the
  * new refcount structure).
  */
-static int rebuild_refcount_structure(BlockDriverState *bs,
-                                      BdrvCheckResult *res,
-                                      void **refcount_table,
-                                      int64_t *nb_clusters,
-                                      Error **errp)
+static int coroutine_fn GRAPH_RDLOCK
+rebuild_refcount_structure(BlockDriverState *bs, BdrvCheckResult *res,
+                           void **refcount_table, int64_t *nb_clusters,
+                           Error **errp)
 {
     BDRVQcow2State *s = bs->opaque;
     int64_t reftable_offset = -1;
@@ -2734,8 +2738,8 @@ static int rebuild_refcount_structure(BlockDriverState *bs,
     }
 
     assert(reftable_length < INT_MAX);
-    ret = bdrv_pwrite(bs->file, reftable_offset, reftable_length,
-                      on_disk_reftable, 0);
+    ret = bdrv_co_pwrite(bs->file, reftable_offset, reftable_length,
+                         on_disk_reftable, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "ERROR writing reftable");
         goto fail;
@@ -2745,10 +2749,10 @@ static int rebuild_refcount_structure(BlockDriverState *bs,
     reftable_offset_and_clusters.reftable_offset = cpu_to_be64(reftable_offset);
     reftable_offset_and_clusters.reftable_clusters =
         cpu_to_be32(reftable_clusters);
-    ret = bdrv_pwrite_sync(bs->file,
-                           offsetof(QCowHeader, refcount_table_offset),
-                           sizeof(reftable_offset_and_clusters),
-                           &reftable_offset_and_clusters, 0);
+    ret = bdrv_co_pwrite_sync(bs->file,
+                              offsetof(QCowHeader, refcount_table_offset),
+                              sizeof(reftable_offset_and_clusters),
+                              &reftable_offset_and_clusters, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "ERROR setting reftable");
         goto fail;
@@ -2777,8 +2781,8 @@ fail:
  * Returns 0 if no errors are found, the number of errors in case the image is
  * detected as corrupted, and -errno when an internal error occurred.
  */
-int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                          BdrvCheckMode fix)
+int coroutine_fn GRAPH_RDLOCK
+qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res, BdrvCheckMode fix)
 {
     BDRVQcow2State *s = bs->opaque;
     BdrvCheckResult pre_compare_res;
@@ -2787,7 +2791,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
     bool rebuild = false;
     int ret;
 
-    size = bdrv_getlength(bs->file->bs);
+    size = bdrv_co_getlength(bs->file->bs);
     if (size < 0) {
         res->check_errors++;
         return size;
@@ -3541,7 +3545,8 @@ done:
     return ret;
 }
 
-static int64_t get_refblock_offset(BlockDriverState *bs, uint64_t offset)
+static int64_t coroutine_fn get_refblock_offset(BlockDriverState *bs,
+                                                uint64_t offset)
 {
     BDRVQcow2State *s = bs->opaque;
     uint32_t index = offset_to_reftable_index(s, offset);
@@ -3707,7 +3712,8 @@ int64_t coroutine_fn qcow2_get_last_cluster(BlockDriverState *bs, int64_t size)
     return -EIO;
 }
 
-int coroutine_fn qcow2_detect_metadata_preallocation(BlockDriverState *bs)
+int coroutine_fn GRAPH_RDLOCK
+qcow2_detect_metadata_preallocation(BlockDriverState *bs)
 {
     BDRVQcow2State *s = bs->opaque;
     int64_t i, end_cluster, cluster_count = 0, threshold;
diff --git a/block/qcow2.c b/block/qcow2.c
index e23edd48c2..267a644aad 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -570,7 +570,7 @@ int qcow2_mark_corrupt(BlockDriverState *bs)
  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
  * before if necessary.
  */
-int qcow2_mark_consistent(BlockDriverState *bs)
+static int coroutine_fn qcow2_mark_consistent(BlockDriverState *bs)
 {
     BDRVQcow2State *s = bs->opaque;
 
diff --git a/block/qcow2.h b/block/qcow2.h
index ea9adb5706..f789ce3ae0 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -836,7 +836,6 @@ int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
 
 int qcow2_mark_dirty(BlockDriverState *bs);
 int qcow2_mark_corrupt(BlockDriverState *bs);
-int qcow2_mark_consistent(BlockDriverState *bs);
 int qcow2_update_header(BlockDriverState *bs);
 
 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
@@ -867,7 +866,7 @@ int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t offset,
 int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size);
 int64_t coroutine_fn qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
                                              int64_t nb_clusters);
-int64_t coroutine_fn qcow2_alloc_bytes(BlockDriverState *bs, int size);
+int64_t coroutine_fn GRAPH_RDLOCK qcow2_alloc_bytes(BlockDriverState *bs, int size);
 void qcow2_free_clusters(BlockDriverState *bs,
                           int64_t offset, int64_t size,
                           enum qcow2_discard_type type);
@@ -879,8 +878,8 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
 
 int qcow2_flush_caches(BlockDriverState *bs);
 int qcow2_write_caches(BlockDriverState *bs);
-int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                          BdrvCheckMode fix);
+int coroutine_fn qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
+                                       BdrvCheckMode fix);
 
 void qcow2_process_discards(BlockDriverState *bs, int ret);
 
@@ -888,10 +887,10 @@ int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
                                  int64_t size);
 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
                                   int64_t size, bool data_file);
-int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
-                             void **refcount_table,
-                             int64_t *refcount_table_size,
-                             int64_t offset, int64_t size);
+int coroutine_fn qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
+                                          void **refcount_table,
+                                          int64_t *refcount_table_size,
+                                          int64_t offset, int64_t size);
 
 int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,
                                 BlockDriverAmendStatusCB *status_cb,
@@ -919,10 +918,9 @@ int qcow2_get_host_offset(BlockDriverState *bs, uint64_t offset,
 int coroutine_fn qcow2_alloc_host_offset(BlockDriverState *bs, uint64_t offset,
                                          unsigned int *bytes,
                                          uint64_t *host_offset, QCowL2Meta **m);
-int coroutine_fn qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
-                                                       uint64_t offset,
-                                                       int compressed_size,
-                                                       uint64_t *host_offset);
+int coroutine_fn GRAPH_RDLOCK
+qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs, uint64_t offset,
+                                      int compressed_size, uint64_t *host_offset);
 void qcow2_parse_compressed_l2_entry(BlockDriverState *bs, uint64_t l2_entry,
                                      uint64_t *coffset, int *csize);
 
@@ -992,11 +990,12 @@ void *qcow2_cache_is_table_offset(Qcow2Cache *c, uint64_t offset);
 void qcow2_cache_discard(Qcow2Cache *c, void *table);
 
 /* qcow2-bitmap.c functions */
-int qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                                  void **refcount_table,
-                                  int64_t *refcount_table_size);
-bool coroutine_fn qcow2_load_dirty_bitmaps(BlockDriverState *bs,
-                                           bool *header_updated, Error **errp);
+int coroutine_fn
+qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
+                              void **refcount_table,
+                              int64_t *refcount_table_size);
+bool coroutine_fn GRAPH_RDLOCK
+qcow2_load_dirty_bitmaps(BlockDriverState *bs, bool *header_updated, Error **errp);
 bool qcow2_get_bitmap_info_list(BlockDriverState *bs,
                                 Qcow2BitmapInfoList **info_list, Error **errp);
 int qcow2_reopen_bitmaps_rw(BlockDriverState *bs, Error **errp);

From 0af02bd10783e08220a784eb8d7e2f821a64f0fa Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:44 +0200
Subject: [PATCH 0261/1353] block: use bdrv_co_getlength in coroutine context

bdrv_co_getlength was recently introduced, with bdrv_getlength becoming
a wrapper for use in unknown context.  Switch to bdrv_co_getlength when
possible.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-12-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c        | 10 +++++-----
 block/parallels.c |  4 ++--
 block/qcow.c      |  6 +++---
 block/vmdk.c      |  4 ++--
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/block/io.c b/block/io.c
index 30748f0b59..b53253c7a7 100644
--- a/block/io.c
+++ b/block/io.c
@@ -1379,7 +1379,7 @@ bdrv_aligned_preadv(BdrvChild *child, BdrvTrackedRequest *req,
     }
 
     /* Forward the request to the BlockDriver, possibly fragmenting it */
-    total_bytes = bdrv_getlength(bs);
+    total_bytes = bdrv_co_getlength(bs);
     if (total_bytes < 0) {
         ret = total_bytes;
         goto out;
@@ -2388,7 +2388,7 @@ bdrv_co_block_status(BlockDriverState *bs, bool want_zero,
     assert(pnum);
     assert_bdrv_graph_readable();
     *pnum = 0;
-    total_size = bdrv_getlength(bs);
+    total_size = bdrv_co_getlength(bs);
     if (total_size < 0) {
         ret = total_size;
         goto early_out;
@@ -2408,7 +2408,7 @@ bdrv_co_block_status(BlockDriverState *bs, bool want_zero,
         bytes = n;
     }
 
-    /* Must be non-NULL or bdrv_getlength() would have failed */
+    /* Must be non-NULL or bdrv_co_getlength() would have failed */
     assert(bs->drv);
     has_filtered_child = bdrv_filter_child(bs);
     if (!bs->drv->bdrv_co_block_status && !has_filtered_child) {
@@ -2546,7 +2546,7 @@ bdrv_co_block_status(BlockDriverState *bs, bool want_zero,
         if (!cow_bs) {
             ret |= BDRV_BLOCK_ZERO;
         } else if (want_zero) {
-            int64_t size2 = bdrv_getlength(cow_bs);
+            int64_t size2 = bdrv_co_getlength(cow_bs);
 
             if (size2 >= 0 && offset >= size2) {
                 ret |= BDRV_BLOCK_ZERO;
@@ -3592,7 +3592,7 @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
         return ret;
     }
 
-    old_size = bdrv_getlength(bs);
+    old_size = bdrv_co_getlength(bs);
     if (old_size < 0) {
         error_setg_errno(errp, -old_size, "Failed to get old image size");
         return old_size;
diff --git a/block/parallels.c b/block/parallels.c
index 7c263d5085..18e34aef28 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -200,7 +200,7 @@ allocate_clusters(BlockDriverState *bs, int64_t sector_num,
     assert(idx < s->bat_size && idx + to_allocate <= s->bat_size);
 
     space = to_allocate * s->tracks;
-    len = bdrv_getlength(bs->file->bs);
+    len = bdrv_co_getlength(bs->file->bs);
     if (len < 0) {
         return len;
     }
@@ -448,7 +448,7 @@ parallels_check_outside_image(BlockDriverState *bs, BdrvCheckResult *res,
     uint32_t i;
     int64_t off, high_off, size;
 
-    size = bdrv_getlength(bs->file->bs);
+    size = bdrv_co_getlength(bs->file->bs);
     if (size < 0) {
         res->check_errors++;
         return size;
diff --git a/block/qcow.c b/block/qcow.c
index 3644bbf5cb..cb240a5369 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -370,7 +370,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
         if (!allocate)
             return 0;
         /* allocate a new l2 entry */
-        l2_offset = bdrv_getlength(bs->file->bs);
+        l2_offset = bdrv_co_getlength(bs->file->bs);
         if (l2_offset < 0) {
             return l2_offset;
         }
@@ -445,7 +445,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
             if (decompress_cluster(bs, cluster_offset) < 0) {
                 return -EIO;
             }
-            cluster_offset = bdrv_getlength(bs->file->bs);
+            cluster_offset = bdrv_co_getlength(bs->file->bs);
             if ((int64_t) cluster_offset < 0) {
                 return cluster_offset;
             }
@@ -458,7 +458,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
                 return ret;
             }
         } else {
-            cluster_offset = bdrv_getlength(bs->file->bs);
+            cluster_offset = bdrv_co_getlength(bs->file->bs);
             if ((int64_t) cluster_offset < 0) {
                 return cluster_offset;
             }
diff --git a/block/vmdk.c b/block/vmdk.c
index 0410b895dc..234e671786 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -2132,7 +2132,7 @@ vmdk_co_pwritev_compressed(BlockDriverState *bs, int64_t offset, int64_t bytes,
         int64_t length;
 
         for (i = 0; i < s->num_extents; i++) {
-            length = bdrv_getlength(s->extents[i].file->bs);
+            length = bdrv_co_getlength(s->extents[i].file->bs);
             if (length < 0) {
                 return length;
             }
@@ -2939,7 +2939,7 @@ vmdk_co_check(BlockDriverState *bs, BdrvCheckResult *result, BdrvCheckMode fix)
             break;
         }
         if (ret == VMDK_OK) {
-            int64_t extent_len = bdrv_getlength(extent->file->bs);
+            int64_t extent_len = bdrv_co_getlength(extent->file->bs);
             if (extent_len < 0) {
                 fprintf(stderr,
                         "ERROR: could not get extent file length for sector %"

From 17362398ee1a7f04e8006a46333145d8b707fd35 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 1 Jun 2023 13:51:45 +0200
Subject: [PATCH 0262/1353] block: use bdrv_co_debug_event in coroutine context

bdrv_co_debug_event was recently introduced, with bdrv_debug_event
becoming a wrapper for use in unknown context.  Because most of the
time bdrv_debug_event is used on a BdrvChild via the wrapper macro
BLKDBG_EVENT, introduce a similar macro BLKDBG_CO_EVENT that calls
bdrv_co_debug_event, and switch whenever possible.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20230601115145.196465-13-pbonzini@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c               |  4 ++--
 block/qcow.c             | 24 ++++++++++++------------
 block/qcow2-cluster.c    | 12 ++++++------
 block/qcow2-refcount.c   |  4 ++--
 block/qcow2.c            | 18 +++++++++---------
 block/qed-table.c        |  6 +++---
 block/qed.c              |  8 ++++----
 block/raw-format.c       |  4 ++--
 block/vmdk.c             | 24 ++++++++++++------------
 include/block/block-io.h |  7 +++++++
 10 files changed, 59 insertions(+), 52 deletions(-)

diff --git a/block/io.c b/block/io.c
index b53253c7a7..e8293d6b26 100644
--- a/block/io.c
+++ b/block/io.c
@@ -3011,7 +3011,7 @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
     }
 
     /* Write back cached data to the OS even with cache=unsafe */
-    BLKDBG_EVENT(primary_child, BLKDBG_FLUSH_TO_OS);
+    BLKDBG_CO_EVENT(primary_child, BLKDBG_FLUSH_TO_OS);
     if (bs->drv->bdrv_co_flush_to_os) {
         ret = bs->drv->bdrv_co_flush_to_os(bs);
         if (ret < 0) {
@@ -3029,7 +3029,7 @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
         goto flush_children;
     }
 
-    BLKDBG_EVENT(primary_child, BLKDBG_FLUSH_TO_DISK);
+    BLKDBG_CO_EVENT(primary_child, BLKDBG_FLUSH_TO_DISK);
     if (!bs->drv) {
         /* bs->drv->bdrv_co_flush() might have ejected the BDS
          * (even in case of apparent success) */
diff --git a/block/qcow.c b/block/qcow.c
index cb240a5369..577bd70324 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -379,7 +379,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
         /* update the L1 entry */
         s->l1_table[l1_index] = l2_offset;
         tmp = cpu_to_be64(l2_offset);
-        BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_L1_UPDATE);
         ret = bdrv_co_pwrite_sync(bs->file,
                                   s->l1_table_offset + l1_index * sizeof(tmp),
                                   sizeof(tmp), &tmp, 0);
@@ -410,7 +410,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
         }
     }
     l2_table = s->l2_cache + (min_index << s->l2_bits);
-    BLKDBG_EVENT(bs->file, BLKDBG_L2_LOAD);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_L2_LOAD);
     if (new_l2_table) {
         memset(l2_table, 0, s->l2_size * sizeof(uint64_t));
         ret = bdrv_co_pwrite_sync(bs->file, l2_offset,
@@ -434,7 +434,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
         ((cluster_offset & QCOW_OFLAG_COMPRESSED) && allocate == 1)) {
         if (!allocate)
             return 0;
-        BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC);
         assert(QEMU_IS_ALIGNED(n_start | n_end, BDRV_SECTOR_SIZE));
         /* allocate a new cluster */
         if ((cluster_offset & QCOW_OFLAG_COMPRESSED) &&
@@ -451,7 +451,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
             }
             cluster_offset = QEMU_ALIGN_UP(cluster_offset, s->cluster_size);
             /* write the cluster content */
-            BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+            BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
             ret = bdrv_co_pwrite(bs->file, cluster_offset, s->cluster_size,
                                  s->cluster_cache, 0);
             if (ret < 0) {
@@ -491,7 +491,7 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
                                                       NULL) < 0) {
                                 return -EIO;
                             }
-                            BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+                            BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
                             ret = bdrv_co_pwrite(bs->file, cluster_offset + i,
                                                  BDRV_SECTOR_SIZE,
                                                  s->cluster_data, 0);
@@ -510,9 +510,9 @@ get_cluster_offset(BlockDriverState *bs, uint64_t offset, int allocate,
         tmp = cpu_to_be64(cluster_offset);
         l2_table[l2_index] = tmp;
         if (allocate == 2) {
-            BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE_COMPRESSED);
+            BLKDBG_CO_EVENT(bs->file, BLKDBG_L2_UPDATE_COMPRESSED);
         } else {
-            BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE);
+            BLKDBG_CO_EVENT(bs->file, BLKDBG_L2_UPDATE);
         }
         ret = bdrv_co_pwrite_sync(bs->file, l2_offset + l2_index * sizeof(tmp),
                                   sizeof(tmp), &tmp, 0);
@@ -595,7 +595,7 @@ decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
     if (s->cluster_cache_offset != coffset) {
         csize = cluster_offset >> (63 - s->cluster_bits);
         csize &= (s->cluster_size - 1);
-        BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
         ret = bdrv_co_pread(bs->file, coffset, csize, s->cluster_data, 0);
         if (ret < 0)
             return -1;
@@ -657,7 +657,7 @@ qcow_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
                 /* read from the base image */
                 qemu_co_mutex_unlock(&s->lock);
                 /* qcow2 emits this on bs->file instead of bs->backing */
-                BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
+                BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
                 ret = bdrv_co_pread(bs->backing, offset, n, buf, 0);
                 qemu_co_mutex_lock(&s->lock);
                 if (ret < 0) {
@@ -680,7 +680,7 @@ qcow_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
                 break;
             }
             qemu_co_mutex_unlock(&s->lock);
-            BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+            BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
             ret = bdrv_co_pread(bs->file, cluster_offset + offset_in_cluster,
                                 n, buf, 0);
             qemu_co_mutex_lock(&s->lock);
@@ -765,7 +765,7 @@ qcow_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
         }
 
         qemu_co_mutex_unlock(&s->lock);
-        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
         ret = bdrv_co_pwrite(bs->file, cluster_offset + offset_in_cluster,
                              n, buf, 0);
         qemu_co_mutex_lock(&s->lock);
@@ -1114,7 +1114,7 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, int64_t offset, int64_t bytes,
     }
     cluster_offset &= s->cluster_offset_mask;
 
-    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
     ret = bdrv_co_pwrite(bs->file, cluster_offset, out_len, out_buf, 0);
     if (ret < 0) {
         goto fail;
diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 6172b2df40..f4f6cd6ad0 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -48,7 +48,7 @@ int coroutine_fn qcow2_shrink_l1_table(BlockDriverState *bs,
     fprintf(stderr, "shrink l1_table from %d to %d\n", s->l1_size, new_l1_size);
 #endif
 
-    BLKDBG_EVENT(bs->file, BLKDBG_L1_SHRINK_WRITE_TABLE);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_L1_SHRINK_WRITE_TABLE);
     ret = bdrv_co_pwrite_zeroes(bs->file,
                                 s->l1_table_offset + new_l1_size * L1E_SIZE,
                                 (s->l1_size - new_l1_size) * L1E_SIZE, 0);
@@ -61,7 +61,7 @@ int coroutine_fn qcow2_shrink_l1_table(BlockDriverState *bs,
         goto fail;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_L1_SHRINK_FREE_L2_CLUSTERS);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_L1_SHRINK_FREE_L2_CLUSTERS);
     for (i = s->l1_size - 1; i > new_l1_size - 1; i--) {
         if ((s->l1_table[i] & L1E_OFFSET_MASK) == 0) {
             continue;
@@ -501,7 +501,7 @@ do_perform_cow_read(BlockDriverState *bs, uint64_t src_cluster_offset,
         return 0;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_COW_READ);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_COW_READ);
 
     if (!bs->drv) {
         return -ENOMEDIUM;
@@ -551,7 +551,7 @@ do_perform_cow_write(BlockDriverState *bs, uint64_t cluster_offset,
         return ret;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_COW_WRITE);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_COW_WRITE);
     ret = bdrv_co_pwritev(s->data_file, cluster_offset + offset_in_cluster,
                           qiov->size, qiov, 0);
     if (ret < 0) {
@@ -871,7 +871,7 @@ qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs, uint64_t offset,
 
     /* compressed clusters never have the copied flag */
 
-    BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE_COMPRESSED);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_L2_UPDATE_COMPRESSED);
     qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_slice);
     set_l2_entry(s, l2_slice, l2_index, cluster_offset);
     if (has_subclusters(s)) {
@@ -991,7 +991,7 @@ perform_cow(BlockDriverState *bs, QCowL2Meta *m)
         /* NOTE: we have a write_aio blkdebug event here followed by
          * a cow_write one in do_perform_cow_write(), but there's only
          * one single I/O operation */
-        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
         ret = do_perform_cow_write(bs, m->alloc_offset, start->offset, &qiov);
     } else {
         /* If there's no guest data then write both COW regions separately */
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index de527c3ee4..5095e99a37 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -118,7 +118,7 @@ int coroutine_fn qcow2_refcount_init(BlockDriverState *bs)
             ret = -ENOMEM;
             goto fail;
         }
-        BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
         ret = bdrv_co_pread(bs->file, s->refcount_table_offset,
                             refcount_table_size2, s->refcount_table, 0);
         if (ret < 0) {
@@ -1076,7 +1076,7 @@ int64_t coroutine_fn GRAPH_RDLOCK qcow2_alloc_bytes(BlockDriverState *bs, int si
     size_t free_in_cluster;
     int ret;
 
-    BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
     assert(size > 0 && size <= s->cluster_size);
     assert(!s->free_byte_offset || offset_into_cluster(s, s->free_byte_offset));
 
diff --git a/block/qcow2.c b/block/qcow2.c
index 267a644aad..c51388e99d 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -2225,7 +2225,7 @@ qcow2_co_preadv_encrypted(BlockDriverState *bs,
         return -ENOMEM;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
     ret = bdrv_co_pread(s->data_file, host_offset, bytes, buf, 0);
     if (ret < 0) {
         goto fail;
@@ -2315,7 +2315,7 @@ qcow2_co_preadv_task(BlockDriverState *bs, QCow2SubclusterType subc_type,
     case QCOW2_SUBCLUSTER_UNALLOCATED_ALLOC:
         assert(bs->backing); /* otherwise handled in qcow2_co_preadv_part */
 
-        BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
         return bdrv_co_preadv_part(bs->backing, offset, bytes,
                                    qiov, qiov_offset, 0);
 
@@ -2329,7 +2329,7 @@ qcow2_co_preadv_task(BlockDriverState *bs, QCow2SubclusterType subc_type,
                                              offset, bytes, qiov, qiov_offset);
         }
 
-        BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
         return bdrv_co_preadv_part(s->data_file, host_offset,
                                    bytes, qiov, qiov_offset, 0);
 
@@ -2539,7 +2539,7 @@ handle_alloc_space(BlockDriverState *bs, QCowL2Meta *l2meta)
             return ret;
         }
 
-        BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_SPACE);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_SPACE);
         ret = bdrv_co_pwrite_zeroes(s->data_file, start_offset, nb_bytes,
                                     BDRV_REQ_NO_FALLBACK);
         if (ret < 0) {
@@ -2604,7 +2604,7 @@ int qcow2_co_pwritev_task(BlockDriverState *bs, uint64_t host_offset,
      * guest data now.
      */
     if (!merge_cow(offset, bytes, qiov, qiov_offset, l2meta)) {
-        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
         trace_qcow2_writev_data(qemu_coroutine_self(), host_offset);
         ret = bdrv_co_pwritev_part(s->data_file, host_offset,
                                    bytes, qiov, qiov_offset, 0);
@@ -4678,7 +4678,7 @@ qcow2_co_pwritev_compressed_task(BlockDriverState *bs,
         goto fail;
     }
 
-    BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
+    BLKDBG_CO_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
     ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
     if (ret < 0) {
         goto fail;
@@ -4797,7 +4797,7 @@ qcow2_co_preadv_compressed(BlockDriverState *bs,
 
     out_buf = qemu_blockalign(bs, s->cluster_size);
 
-    BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
     ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
     if (ret < 0) {
         goto fail;
@@ -5344,7 +5344,7 @@ qcow2_co_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
         return offset;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
     return bs->drv->bdrv_co_pwritev_part(bs, offset, qiov->size, qiov, 0, 0);
 }
 
@@ -5356,7 +5356,7 @@ qcow2_co_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
         return offset;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
     return bs->drv->bdrv_co_preadv_part(bs, offset, qiov->size, qiov, 0, 0);
 }
 
diff --git a/block/qed-table.c b/block/qed-table.c
index 3b331ce709..f04520d4c8 100644
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -122,7 +122,7 @@ int coroutine_fn qed_read_l1_table_sync(BDRVQEDState *s)
 int coroutine_fn qed_write_l1_table(BDRVQEDState *s, unsigned int index,
                                     unsigned int n)
 {
-    BLKDBG_EVENT(s->bs->file, BLKDBG_L1_UPDATE);
+    BLKDBG_CO_EVENT(s->bs->file, BLKDBG_L1_UPDATE);
     return qed_write_table(s, s->header.l1_table_offset,
                            s->l1_table, index, n, false);
 }
@@ -150,7 +150,7 @@ int coroutine_fn qed_read_l2_table(BDRVQEDState *s, QEDRequest *request,
     request->l2_table = qed_alloc_l2_cache_entry(&s->l2_cache);
     request->l2_table->table = qed_alloc_table(s);
 
-    BLKDBG_EVENT(s->bs->file, BLKDBG_L2_LOAD);
+    BLKDBG_CO_EVENT(s->bs->file, BLKDBG_L2_LOAD);
     ret = qed_read_table(s, offset, request->l2_table->table);
 
     if (ret) {
@@ -183,7 +183,7 @@ int coroutine_fn qed_write_l2_table(BDRVQEDState *s, QEDRequest *request,
                                     unsigned int index, unsigned int n,
                                     bool flush)
 {
-    BLKDBG_EVENT(s->bs->file, BLKDBG_L2_UPDATE);
+    BLKDBG_CO_EVENT(s->bs->file, BLKDBG_L2_UPDATE);
     return qed_write_table(s, request->l2_table->offset,
                            request->l2_table->table, index, n, flush);
 }
diff --git a/block/qed.c b/block/qed.c
index 2cab3540a9..b2604d9dad 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -883,7 +883,7 @@ static int coroutine_fn GRAPH_RDLOCK
 qed_read_backing_file(BDRVQEDState *s, uint64_t pos, QEMUIOVector *qiov)
 {
     if (s->bs->backing) {
-        BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);
+        BLKDBG_CO_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);
         return bdrv_co_preadv(s->bs->backing, pos, qiov->size, qiov, 0);
     }
     qemu_iovec_memset(qiov, 0, 0, qiov->size);
@@ -918,7 +918,7 @@ qed_copy_from_backing_file(BDRVQEDState *s, uint64_t pos, uint64_t len,
         goto out;
     }
 
-    BLKDBG_EVENT(s->bs->file, BLKDBG_COW_WRITE);
+    BLKDBG_CO_EVENT(s->bs->file, BLKDBG_COW_WRITE);
     ret = bdrv_co_pwritev(s->bs->file, offset, qiov.size, &qiov, 0);
     if (ret < 0) {
         goto out;
@@ -1070,7 +1070,7 @@ static int coroutine_fn GRAPH_RDLOCK qed_aio_write_main(QEDAIOCB *acb)
 
     trace_qed_aio_write_main(s, acb, 0, offset, acb->cur_qiov.size);
 
-    BLKDBG_EVENT(s->bs->file, BLKDBG_WRITE_AIO);
+    BLKDBG_CO_EVENT(s->bs->file, BLKDBG_WRITE_AIO);
     return bdrv_co_pwritev(s->bs->file, offset, acb->cur_qiov.size,
                            &acb->cur_qiov, 0);
 }
@@ -1324,7 +1324,7 @@ qed_aio_read_data(void *opaque, int ret, uint64_t offset, size_t len)
     } else if (ret != QED_CLUSTER_FOUND) {
         r = qed_read_backing_file(s, acb->cur_pos, &acb->cur_qiov);
     } else {
-        BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+        BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
         r = bdrv_co_preadv(bs->file, offset, acb->cur_qiov.size,
                            &acb->cur_qiov, 0);
     }
diff --git a/block/raw-format.c b/block/raw-format.c
index e4f35268e6..a8bdee5279 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -214,7 +214,7 @@ raw_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
         return ret;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_AIO);
     return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 }
 
@@ -268,7 +268,7 @@ raw_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
         goto fail;
     }
 
-    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+    BLKDBG_CO_EVENT(bs->file, BLKDBG_WRITE_AIO);
     ret = bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
 
 fail:
diff --git a/block/vmdk.c b/block/vmdk.c
index 234e671786..70066c2b01 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1438,7 +1438,7 @@ get_whole_cluster(BlockDriverState *bs, VmdkExtent *extent,
     if (skip_start_bytes > 0) {
         if (copy_from_backing) {
             /* qcow2 emits this on bs->file instead of bs->backing */
-            BLKDBG_EVENT(extent->file, BLKDBG_COW_READ);
+            BLKDBG_CO_EVENT(extent->file, BLKDBG_COW_READ);
             ret = bdrv_co_pread(bs->backing, offset, skip_start_bytes,
                                 whole_grain, 0);
             if (ret < 0) {
@@ -1446,7 +1446,7 @@ get_whole_cluster(BlockDriverState *bs, VmdkExtent *extent,
                 goto exit;
             }
         }
-        BLKDBG_EVENT(extent->file, BLKDBG_COW_WRITE);
+        BLKDBG_CO_EVENT(extent->file, BLKDBG_COW_WRITE);
         ret = bdrv_co_pwrite(extent->file, cluster_offset, skip_start_bytes,
                              whole_grain, 0);
         if (ret < 0) {
@@ -1458,7 +1458,7 @@ get_whole_cluster(BlockDriverState *bs, VmdkExtent *extent,
     if (skip_end_bytes < cluster_bytes) {
         if (copy_from_backing) {
             /* qcow2 emits this on bs->file instead of bs->backing */
-            BLKDBG_EVENT(extent->file, BLKDBG_COW_READ);
+            BLKDBG_CO_EVENT(extent->file, BLKDBG_COW_READ);
             ret = bdrv_co_pread(bs->backing, offset + skip_end_bytes,
                                 cluster_bytes - skip_end_bytes,
                                 whole_grain + skip_end_bytes, 0);
@@ -1467,7 +1467,7 @@ get_whole_cluster(BlockDriverState *bs, VmdkExtent *extent,
                 goto exit;
             }
         }
-        BLKDBG_EVENT(extent->file, BLKDBG_COW_WRITE);
+        BLKDBG_CO_EVENT(extent->file, BLKDBG_COW_WRITE);
         ret = bdrv_co_pwrite(extent->file, cluster_offset + skip_end_bytes,
                              cluster_bytes - skip_end_bytes,
                              whole_grain + skip_end_bytes, 0);
@@ -1488,7 +1488,7 @@ vmdk_L2update(VmdkExtent *extent, VmdkMetaData *m_data, uint32_t offset)
 {
     offset = cpu_to_le32(offset);
     /* update L2 table */
-    BLKDBG_EVENT(extent->file, BLKDBG_L2_UPDATE);
+    BLKDBG_CO_EVENT(extent->file, BLKDBG_L2_UPDATE);
     if (bdrv_co_pwrite(extent->file,
                        ((int64_t)m_data->l2_offset * 512)
                            + (m_data->l2_index * sizeof(offset)),
@@ -1618,7 +1618,7 @@ get_cluster_offset(BlockDriverState *bs, VmdkExtent *extent,
         }
     }
     l2_table = (char *)extent->l2_cache + (min_index * l2_size_bytes);
-    BLKDBG_EVENT(extent->file, BLKDBG_L2_LOAD);
+    BLKDBG_CO_EVENT(extent->file, BLKDBG_L2_LOAD);
     if (bdrv_co_pread(extent->file,
                 (int64_t)l2_offset * 512,
                 l2_size_bytes,
@@ -1829,12 +1829,12 @@ vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
         n_bytes = buf_len + sizeof(VmdkGrainMarker);
         qemu_iovec_init_buf(&local_qiov, data, n_bytes);
 
-        BLKDBG_EVENT(extent->file, BLKDBG_WRITE_COMPRESSED);
+        BLKDBG_CO_EVENT(extent->file, BLKDBG_WRITE_COMPRESSED);
     } else {
         qemu_iovec_init(&local_qiov, qiov->niov);
         qemu_iovec_concat(&local_qiov, qiov, qiov_offset, n_bytes);
 
-        BLKDBG_EVENT(extent->file, BLKDBG_WRITE_AIO);
+        BLKDBG_CO_EVENT(extent->file, BLKDBG_WRITE_AIO);
     }
 
     write_offset = cluster_offset + offset_in_cluster;
@@ -1876,7 +1876,7 @@ vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset,
 
 
     if (!extent->compressed) {
-        BLKDBG_EVENT(extent->file, BLKDBG_READ_AIO);
+        BLKDBG_CO_EVENT(extent->file, BLKDBG_READ_AIO);
         ret = bdrv_co_preadv(extent->file,
                              cluster_offset + offset_in_cluster, bytes,
                              qiov, 0);
@@ -1890,7 +1890,7 @@ vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset,
     buf_bytes = cluster_bytes * 2;
     cluster_buf = g_malloc(buf_bytes);
     uncomp_buf = g_malloc(cluster_bytes);
-    BLKDBG_EVENT(extent->file, BLKDBG_READ_COMPRESSED);
+    BLKDBG_CO_EVENT(extent->file, BLKDBG_READ_COMPRESSED);
     ret = bdrv_co_pread(extent->file, cluster_offset, buf_bytes, cluster_buf,
                         0);
     if (ret < 0) {
@@ -1968,7 +1968,7 @@ vmdk_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
                 qemu_iovec_concat(&local_qiov, qiov, bytes_done, n_bytes);
 
                 /* qcow2 emits this on bs->file instead of bs->backing */
-                BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
+                BLKDBG_CO_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
                 ret = bdrv_co_preadv(bs->backing, offset, n_bytes,
                                      &local_qiov, 0);
                 if (ret < 0) {
@@ -2909,7 +2909,7 @@ vmdk_co_check(BlockDriverState *bs, BdrvCheckResult *result, BdrvCheckMode fix)
     BDRVVmdkState *s = bs->opaque;
     VmdkExtent *extent = NULL;
     int64_t sector_num = 0;
-    int64_t total_sectors = bdrv_nb_sectors(bs);
+    int64_t total_sectors = bdrv_co_nb_sectors(bs);
     int ret;
     uint64_t cluster_offset;
 
diff --git a/include/block/block-io.h b/include/block/block-io.h
index 43af816d75..4415506e40 100644
--- a/include/block/block-io.h
+++ b/include/block/block-io.h
@@ -224,6 +224,13 @@ bdrv_co_debug_event(BlockDriverState *bs, BlkdebugEvent event);
 void co_wrapper_mixed_bdrv_rdlock
 bdrv_debug_event(BlockDriverState *bs, BlkdebugEvent event);
 
+#define BLKDBG_CO_EVENT(child, evt) \
+    do { \
+        if (child) { \
+            bdrv_co_debug_event(child->bs, evt); \
+        } \
+    } while (0)
+
 #define BLKDBG_EVENT(child, evt) \
     do { \
         if (child) { \

From 7491e0e4096f426de4a47fa241442c84e63c5a64 Mon Sep 17 00:00:00 2001
From: Minwoo Im <minwoo.im@samsung.com>
Date: Tue, 18 Apr 2023 09:20:25 +0900
Subject: [PATCH 0263/1353] hw/nvme: add comment for nvme-ns properties

Add more comments of existing properties for nvme-ns device.

Signed-off-by: Minwoo Im <minwoo.im@samsung.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index fd917fcda1..020f37a780 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -43,7 +43,14 @@
  *              subsys=<subsys_id>
  *      -device nvme-ns,drive=<drive_id>,bus=<bus_name>,nsid=<nsid>,\
  *              zoned=<true|false[optional]>, \
- *              subsys=<subsys_id>,detached=<true|false[optional]>
+ *              subsys=<subsys_id>,shared=<true|false[optional]>, \
+ *              detached=<true|false[optional]>, \
+ *              zoned.zone_size=<N[optional]>, \
+ *              zoned.zone_capacity=<N[optional]>, \
+ *              zoned.descr_ext_size=<N[optional]>, \
+ *              zoned.max_active=<N[optional]>, \
+ *              zoned.max_open=<N[optional]>, \
+ *              zoned.cross_read=<true|false[optional]>
  *
  * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
  * offset 0 in BAR2 and supports only WDS, RDS and SQS for now. By default, the

From cab1da59c2ff3bf08d0a7becf9b51e43a724a85c Mon Sep 17 00:00:00 2001
From: Minwoo Im <minwoo.im@samsung.com>
Date: Tue, 18 Apr 2023 09:26:21 +0900
Subject: [PATCH 0264/1353] hw/nvme: consider COPY command in nvme_aio_err

If we don't have NVME_CMD_COPY consideration in the switch statement in
nvme_aio_err(), it will go to have NVME_INTERNAL_DEV_ERROR and
`req->status` will be ovewritten to it.  During the aio context, it
might set the NVMe status field like NVME_CMD_SIZE_LIMIT, but it's
overwritten in the nvme_aio_err().

Add consideration for the NVME_CMD_COPY not to overwrite the status at
the end of the function.

Signed-off-by: Minwoo Im <minwoo.im@samsung.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 020f37a780..e031c2250a 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1755,6 +1755,7 @@ static void nvme_aio_err(NvmeRequest *req, int ret)
     case NVME_CMD_WRITE:
     case NVME_CMD_WRITE_ZEROES:
     case NVME_CMD_ZONE_APPEND:
+    case NVME_CMD_COPY:
         status = NVME_WRITE_FAULT;
         break;
     default:

From 381ab99d858709eab34b65d123a6356b8b1e87bd Mon Sep 17 00:00:00 2001
From: Minwoo Im <minwoo.im@samsung.com>
Date: Tue, 18 Apr 2023 09:26:22 +0900
Subject: [PATCH 0265/1353] hw/nvme: check maximum copy length (MCL) for COPY

MCL(Maximum Copy Length) in the Identify Namespace data structure limits
the number of LBAs to be copied inside of the controller.  We've not
checked it at all, so added the check with returning the proper error
status.

Signed-off-by: Minwoo Im <minwoo.im@samsung.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e031c2250a..355668bdf8 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -2855,6 +2855,25 @@ static void nvme_copy_source_range_parse(void *ranges, int idx, uint8_t format,
     }
 }
 
+static inline uint16_t nvme_check_copy_mcl(NvmeNamespace *ns,
+                                           NvmeCopyAIOCB *iocb, uint16_t nr)
+{
+    uint32_t copy_len = 0;
+
+    for (int idx = 0; idx < nr; idx++) {
+        uint32_t nlb;
+        nvme_copy_source_range_parse(iocb->ranges, idx, iocb->format, NULL,
+                                     &nlb, NULL, NULL, NULL);
+        copy_len += nlb + 1;
+    }
+
+    if (copy_len > ns->id_ns.mcl) {
+        return NVME_CMD_SIZE_LIMIT | NVME_DNR;
+    }
+
+    return NVME_SUCCESS;
+}
+
 static void nvme_copy_out_completed_cb(void *opaque, int ret)
 {
     NvmeCopyAIOCB *iocb = opaque;
@@ -3167,6 +3186,11 @@ static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req)
         }
     }
 
+    status = nvme_check_copy_mcl(ns, iocb, nr);
+    if (status) {
+        goto invalid;
+    }
+
     iocb->req = req;
     iocb->ret = 0;
     iocb->nr = nr;

From 3ae8a54a087d54cfd109ab3d844ff4cba54a28d8 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Wed, 24 May 2023 11:28:34 +0200
Subject: [PATCH 0266/1353] hw/nvme: fix verification of number of ruhis

Fix a off-by-one error when verifying the number of reclaim unit handle
identifiers specified in fdp.ruhs. To make the fix nicer, move the
verification of the fdp.nruh parameter to an earlier point.

Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ns.c     | 4 +---
 hw/nvme/subsys.c | 6 ++++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 547c0b1543..050fdaf50f 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -438,9 +438,7 @@ static bool nvme_ns_init_fdp(NvmeNamespace *ns, Error **errp)
 
     /* parse the placement handle identifiers */
     while ((token = qemu_strsep(&p, ";")) != NULL) {
-        ns->fdp.nphs += 1;
-        if (ns->fdp.nphs > NVME_FDP_MAXPIDS ||
-            ns->fdp.nphs == endgrp->fdp.nruh) {
+        if (ns->fdp.nphs++ == endgrp->fdp.nruh) {
             error_setg(errp, "too many placement handles");
             free(r);
             return false;
diff --git a/hw/nvme/subsys.c b/hw/nvme/subsys.c
index 24ddec860e..d30bb8bfd5 100644
--- a/hw/nvme/subsys.c
+++ b/hw/nvme/subsys.c
@@ -158,8 +158,10 @@ static bool nvme_subsys_setup_fdp(NvmeSubsystem *subsys, Error **errp)
 
     endgrp->fdp.nrg = subsys->params.fdp.nrg;
 
-    if (!subsys->params.fdp.nruh) {
-        error_setg(errp, "fdp.nruh must be non-zero");
+    if (!subsys->params.fdp.nruh ||
+        subsys->params.fdp.nruh > NVME_FDP_MAXPIDS) {
+        error_setg(errp, "fdp.nruh must be non-zero and less than %u",
+                   NVME_FDP_MAXPIDS);
         return false;
     }
 

From 94fa8ca7ee9b6215a5c078f5d424377e5fa61b9c Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Wed, 24 May 2023 11:45:04 +0200
Subject: [PATCH 0267/1353] hw/nvme: verify uniqueness of reclaim unit handle
 identifiers

Verify that a reclaim unit handle identifier is only specified once in
fdp.ruhs.

Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ns.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 050fdaf50f..c4ea2033bb 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -453,6 +453,17 @@ static bool nvme_ns_init_fdp(NvmeNamespace *ns, Error **errp)
 
     free(r);
 
+    /* verify that the ruhids are unique */
+    for (unsigned int i = 0; i < ns->fdp.nphs; i++) {
+        for (unsigned int j = i + 1; j < ns->fdp.nphs; j++) {
+            if (ruhids[i] == ruhids[j]) {
+                error_setg(errp, "duplicate reclaim unit handle identifier: %u",
+                           ruhids[i]);
+                return false;
+            }
+        }
+    }
+
     ph = ns->fdp.phs = g_new(uint16_t, ns->fdp.nphs);
 
     ruhid = ruhids;

From ce8017736cc82e0250c1bc8e383335822f995510 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 14 Feb 2023 10:16:56 +0100
Subject: [PATCH 0268/1353] hw/nvme: add placement handle list ranges

Allow the placement handles to be specified as ranges, i.e.
`fdp.ruhs=1:3-5` will attempt to assign ruh 1, 3, 4 and 5 to the
namespace.

Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ns.c | 40 ++++++++++++++++++++++++++++++++--------
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index c4ea2033bb..44aba8f4d9 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -400,8 +400,9 @@ static bool nvme_ns_init_fdp(NvmeNamespace *ns, Error **errp)
     NvmeRuHandle *ruh;
     uint8_t lbafi = NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas);
     g_autofree unsigned int *ruhids = NULL;
-    unsigned int *ruhid;
-    char *r, *p, *token;
+    unsigned int n, m, *ruhid;
+    const char *endptr, *token;
+    char *r, *p;
     uint16_t *ph;
 
     if (!ns->params.fdp.ruhs) {
@@ -438,16 +439,39 @@ static bool nvme_ns_init_fdp(NvmeNamespace *ns, Error **errp)
 
     /* parse the placement handle identifiers */
     while ((token = qemu_strsep(&p, ";")) != NULL) {
-        if (ns->fdp.nphs++ == endgrp->fdp.nruh) {
-            error_setg(errp, "too many placement handles");
+        if (qemu_strtoui(token, &endptr, 0, &n) < 0) {
+            error_setg(errp, "cannot parse reclaim unit handle identifier");
             free(r);
             return false;
         }
 
-        if (qemu_strtoui(token, NULL, 0, ruhid++) < 0) {
-            error_setg(errp, "cannot parse reclaim unit handle identifier");
-            free(r);
-            return false;
+        m = n;
+
+        /* parse range */
+        if (*endptr == '-') {
+            token = endptr + 1;
+
+            if (qemu_strtoui(token, NULL, 0, &m) < 0) {
+                error_setg(errp, "cannot parse reclaim unit handle identifier");
+                free(r);
+                return false;
+            }
+
+            if (m < n) {
+                error_setg(errp, "invalid reclaim unit handle identifier range");
+                free(r);
+                return false;
+            }
+        }
+
+        for (; n <= m; n++) {
+            if (ns->fdp.nphs++ == endgrp->fdp.nruh) {
+                error_setg(errp, "too many placement handles");
+                free(r);
+                return false;
+            }
+
+            *ruhid++ = n;
         }
     }
 

From e409c9057b55e890a6e5f70386a36932a5137bcf Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Wed, 24 May 2023 13:06:37 +0200
Subject: [PATCH 0269/1353] docs: update hw/nvme documentation for TP4146

Update documentation for TP4146 ("Flexible Data Placement") emulation.

Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 docs/system/devices/nvme.rst | 37 +++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/docs/system/devices/nvme.rst b/docs/system/devices/nvme.rst
index 30f841ef62..a8bb8d729c 100644
--- a/docs/system/devices/nvme.rst
+++ b/docs/system/devices/nvme.rst
@@ -212,6 +212,41 @@ The namespace may be configured with additional parameters
   the minimum memory page size (CAP.MPSMIN). The default value (``0``)
   has this property inherit the ``mdts`` value.
 
+Flexible Data Placement
+-----------------------
+
+The device may be configured to support TP4146 ("Flexible Data Placement") by
+configuring it (``fdp=on``) on the subsystem::
+
+    -device nvme-subsys,id=nvme-subsys-0,nqn=subsys0,fdp=on,fdp.nruh=16
+
+The subsystem emulates a single Endurance Group, on which Flexible Data
+Placement will be supported. Also note that the device emulation deviates
+slightly from the specification, by always enabling the "FDP Mode" feature on
+the controller if the subsystems is configured for Flexible Data Placement.
+
+Enabling Flexible Data Placement on the subsyste enables the following
+parameters:
+
+``fdp.nrg`` (default: ``1``)
+  Set the number of Reclaim Groups.
+
+``fdp.nruh`` (default: ``0``)
+  Set the number of Reclaim Unit Handles. This is a mandatory paramater and
+  must be non-zero.
+
+``fdp.runs`` (default: ``96M``)
+  Set the Reclaim Unit Nominal Size. Defaults to 96 MiB.
+
+Namespaces within this subsystem may requests Reclaim Unit Handles::
+
+    -device nvme-ns,drive=nvm-1,fdp.ruhs=RUHLIST
+
+The ``RUHLIST`` is a semicolon separated list (i.e. ``0;1;2;3``) and may
+include ranges (i.e. ``0;8-15``). If no reclaim unit handle list is specified,
+the controller will assign the controller-specified reclaim unit handle to
+placement handle identifier 0.
+
 Metadata
 --------
 
@@ -320,4 +355,4 @@ controller are:
 
 .. code-block:: console
 
-   echo 0000:01:00.1 > /sys/bus/pci/drivers/nvme/bind
\ No newline at end of file
+   echo 0000:01:00.1 > /sys/bus/pci/drivers/nvme/bind

From ac5e8c1dec246950d73e22dceab5cb36e82aac0b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 15 May 2023 17:11:04 +0200
Subject: [PATCH 0270/1353] Revert "hw/sparc64/niagara: Use blk_name() instead
 of open-coding it"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 1881f336a33a8a99cb17ab1c57ed953682e8e107.

This commit breaks "-drive if=pflash,readonly=on,file=image.iso".  It
claims to merely replace an open-coded version of blk_name() by a
call, but that's not the case.  Sorry for the inconvenience!

Reported-by: Jakub Jermář <jakub@jermar.eu>
Cc: qemu-stable@nongnu.org
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20230515151104.1350155-1-armbru@redhat.com>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 hw/sparc64/niagara.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/sparc64/niagara.c b/hw/sparc64/niagara.c
index 6725cc61fd..ab3c4ec346 100644
--- a/hw/sparc64/niagara.c
+++ b/hw/sparc64/niagara.c
@@ -23,6 +23,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "block/block_int-common.h"
 #include "qemu/units.h"
 #include "cpu.h"
 #include "hw/boards.h"
@@ -143,9 +144,10 @@ static void niagara_init(MachineState *machine)
             memory_region_add_subregion(get_system_memory(),
                                         NIAGARA_VDISK_BASE, &s->vdisk_ram);
             dinfo->is_default = 1;
-            rom_add_file_fixed(blk_name(blk), NIAGARA_VDISK_BASE, -1);
+            rom_add_file_fixed(blk_bs(blk)->filename, NIAGARA_VDISK_BASE, -1);
         } else {
-            error_report("could not load ram disk '%s'", blk_name(blk));
+            error_report("could not load ram disk '%s'",
+                         blk_bs(blk)->filename);
             exit(1);
         }
     }

From f67ccb2f77190e597562b2041b36ee7d9f6f302b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:11:55 +0200
Subject: [PATCH 0271/1353] target/sparc: Use tcg_gen_lookup_and_goto_ptr in
 gen_goto_tb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-2-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index bad2ec90a0..28d4cdb8b4 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -318,10 +318,10 @@ static void gen_goto_tb(DisasContext *s, int tb_num,
         tcg_gen_movi_tl(cpu_npc, npc);
         tcg_gen_exit_tb(s->base.tb, tb_num);
     } else {
-        /* jump to another page: currently not optimized */
+        /* jump to another page: we can use an indirect jump */
         tcg_gen_movi_tl(cpu_pc, pc);
         tcg_gen_movi_tl(cpu_npc, npc);
-        tcg_gen_exit_tb(NULL, 0);
+        tcg_gen_lookup_and_goto_ptr();
     }
 }
 

From 611a1684d0b46bae8fb1cfa15db28c0a5cb64cf5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:11:56 +0200
Subject: [PATCH 0272/1353] target/sparc: Fix npc comparison in
 sparc_tr_insn_start
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

During translation, npc == address, DYNAMIC_PC, or JUMP_PC.
It is only the encoding between here and sparc_restore_state_to_opc
that considers JUMP_PC to be a bit within a larger value.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-3-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 28d4cdb8b4..eec6f9ca67 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -5594,7 +5594,7 @@ static void sparc_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    if (dc->npc & JUMP_PC) {
+    if (dc->npc == JUMP_PC) {
         assert(dc->jump_pc[1] == dc->pc + 4);
         tcg_gen_insn_start(dc->pc, dc->jump_pc[0] | JUMP_PC);
     } else {

From 0c2e96c1703041badf675993247351f629b4ab20 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:11:57 +0200
Subject: [PATCH 0273/1353] target/sparc: Drop inline markers from translate.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let the compiler decide about inlining.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-4-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 237 ++++++++++++++++++---------------------
 1 file changed, 111 insertions(+), 126 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index eec6f9ca67..1312c3e94d 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -125,7 +125,7 @@ static int sign_extend(int x, int len)
 
 #define IS_IMM (insn & (1<<13))
 
-static inline void gen_update_fprs_dirty(DisasContext *dc, int rd)
+static void gen_update_fprs_dirty(DisasContext *dc, int rd)
 {
 #if defined(TARGET_SPARC64)
     int bit = (rd < 32) ? 1 : 2;
@@ -264,7 +264,7 @@ static void gen_move_Q(DisasContext *dc, unsigned int rd, unsigned int rs)
 #endif
 #endif
 
-static inline void gen_address_mask(DisasContext *dc, TCGv addr)
+static void gen_address_mask(DisasContext *dc, TCGv addr)
 {
 #ifdef TARGET_SPARC64
     if (AM_CHECK(dc))
@@ -272,7 +272,7 @@ static inline void gen_address_mask(DisasContext *dc, TCGv addr)
 #endif
 }
 
-static inline TCGv gen_load_gpr(DisasContext *dc, int reg)
+static TCGv gen_load_gpr(DisasContext *dc, int reg)
 {
     if (reg > 0) {
         assert(reg < 32);
@@ -284,7 +284,7 @@ static inline TCGv gen_load_gpr(DisasContext *dc, int reg)
     }
 }
 
-static inline void gen_store_gpr(DisasContext *dc, int reg, TCGv v)
+static void gen_store_gpr(DisasContext *dc, int reg, TCGv v)
 {
     if (reg > 0) {
         assert(reg < 32);
@@ -292,7 +292,7 @@ static inline void gen_store_gpr(DisasContext *dc, int reg, TCGv v)
     }
 }
 
-static inline TCGv gen_dest_gpr(DisasContext *dc, int reg)
+static TCGv gen_dest_gpr(DisasContext *dc, int reg)
 {
     if (reg > 0) {
         assert(reg < 32);
@@ -326,31 +326,31 @@ static void gen_goto_tb(DisasContext *s, int tb_num,
 }
 
 // XXX suboptimal
-static inline void gen_mov_reg_N(TCGv reg, TCGv_i32 src)
+static void gen_mov_reg_N(TCGv reg, TCGv_i32 src)
 {
     tcg_gen_extu_i32_tl(reg, src);
     tcg_gen_extract_tl(reg, reg, PSR_NEG_SHIFT, 1);
 }
 
-static inline void gen_mov_reg_Z(TCGv reg, TCGv_i32 src)
+static void gen_mov_reg_Z(TCGv reg, TCGv_i32 src)
 {
     tcg_gen_extu_i32_tl(reg, src);
     tcg_gen_extract_tl(reg, reg, PSR_ZERO_SHIFT, 1);
 }
 
-static inline void gen_mov_reg_V(TCGv reg, TCGv_i32 src)
+static void gen_mov_reg_V(TCGv reg, TCGv_i32 src)
 {
     tcg_gen_extu_i32_tl(reg, src);
     tcg_gen_extract_tl(reg, reg, PSR_OVF_SHIFT, 1);
 }
 
-static inline void gen_mov_reg_C(TCGv reg, TCGv_i32 src)
+static void gen_mov_reg_C(TCGv reg, TCGv_i32 src)
 {
     tcg_gen_extu_i32_tl(reg, src);
     tcg_gen_extract_tl(reg, reg, PSR_CARRY_SHIFT, 1);
 }
 
-static inline void gen_op_add_cc(TCGv dst, TCGv src1, TCGv src2)
+static void gen_op_add_cc(TCGv dst, TCGv src1, TCGv src2)
 {
     tcg_gen_mov_tl(cpu_cc_src, src1);
     tcg_gen_mov_tl(cpu_cc_src2, src2);
@@ -465,7 +465,7 @@ static void gen_op_addx_int(DisasContext *dc, TCGv dst, TCGv src1,
     }
 }
 
-static inline void gen_op_sub_cc(TCGv dst, TCGv src1, TCGv src2)
+static void gen_op_sub_cc(TCGv dst, TCGv src1, TCGv src2)
 {
     tcg_gen_mov_tl(cpu_cc_src, src1);
     tcg_gen_mov_tl(cpu_cc_src2, src2);
@@ -538,7 +538,7 @@ static void gen_op_subx_int(DisasContext *dc, TCGv dst, TCGv src1,
     }
 }
 
-static inline void gen_op_mulscc(TCGv dst, TCGv src1, TCGv src2)
+static void gen_op_mulscc(TCGv dst, TCGv src1, TCGv src2)
 {
     TCGv r_temp, zero, t0;
 
@@ -577,7 +577,7 @@ static inline void gen_op_mulscc(TCGv dst, TCGv src1, TCGv src2)
     tcg_gen_mov_tl(dst, cpu_cc_dst);
 }
 
-static inline void gen_op_multiply(TCGv dst, TCGv src1, TCGv src2, int sign_ext)
+static void gen_op_multiply(TCGv dst, TCGv src1, TCGv src2, int sign_ext)
 {
 #if TARGET_LONG_BITS == 32
     if (sign_ext) {
@@ -602,32 +602,32 @@ static inline void gen_op_multiply(TCGv dst, TCGv src1, TCGv src2, int sign_ext)
 #endif
 }
 
-static inline void gen_op_umul(TCGv dst, TCGv src1, TCGv src2)
+static void gen_op_umul(TCGv dst, TCGv src1, TCGv src2)
 {
     /* zero-extend truncated operands before multiplication */
     gen_op_multiply(dst, src1, src2, 0);
 }
 
-static inline void gen_op_smul(TCGv dst, TCGv src1, TCGv src2)
+static void gen_op_smul(TCGv dst, TCGv src1, TCGv src2)
 {
     /* sign-extend truncated operands before multiplication */
     gen_op_multiply(dst, src1, src2, 1);
 }
 
 // 1
-static inline void gen_op_eval_ba(TCGv dst)
+static void gen_op_eval_ba(TCGv dst)
 {
     tcg_gen_movi_tl(dst, 1);
 }
 
 // Z
-static inline void gen_op_eval_be(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_be(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_Z(dst, src);
 }
 
 // Z | (N ^ V)
-static inline void gen_op_eval_ble(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_ble(TCGv dst, TCGv_i32 src)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_N(t0, src);
@@ -638,7 +638,7 @@ static inline void gen_op_eval_ble(TCGv dst, TCGv_i32 src)
 }
 
 // N ^ V
-static inline void gen_op_eval_bl(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bl(TCGv dst, TCGv_i32 src)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_V(t0, src);
@@ -647,7 +647,7 @@ static inline void gen_op_eval_bl(TCGv dst, TCGv_i32 src)
 }
 
 // C | Z
-static inline void gen_op_eval_bleu(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bleu(TCGv dst, TCGv_i32 src)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_Z(t0, src);
@@ -656,73 +656,73 @@ static inline void gen_op_eval_bleu(TCGv dst, TCGv_i32 src)
 }
 
 // C
-static inline void gen_op_eval_bcs(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bcs(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_C(dst, src);
 }
 
 // V
-static inline void gen_op_eval_bvs(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bvs(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_V(dst, src);
 }
 
 // 0
-static inline void gen_op_eval_bn(TCGv dst)
+static void gen_op_eval_bn(TCGv dst)
 {
     tcg_gen_movi_tl(dst, 0);
 }
 
 // N
-static inline void gen_op_eval_bneg(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bneg(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_N(dst, src);
 }
 
 // !Z
-static inline void gen_op_eval_bne(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bne(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_Z(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !(Z | (N ^ V))
-static inline void gen_op_eval_bg(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bg(TCGv dst, TCGv_i32 src)
 {
     gen_op_eval_ble(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !(N ^ V)
-static inline void gen_op_eval_bge(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bge(TCGv dst, TCGv_i32 src)
 {
     gen_op_eval_bl(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !(C | Z)
-static inline void gen_op_eval_bgu(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bgu(TCGv dst, TCGv_i32 src)
 {
     gen_op_eval_bleu(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !C
-static inline void gen_op_eval_bcc(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bcc(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_C(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !N
-static inline void gen_op_eval_bpos(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bpos(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_N(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !V
-static inline void gen_op_eval_bvc(TCGv dst, TCGv_i32 src)
+static void gen_op_eval_bvc(TCGv dst, TCGv_i32 src)
 {
     gen_mov_reg_V(dst, src);
     tcg_gen_xori_tl(dst, dst, 0x1);
@@ -735,23 +735,21 @@ static inline void gen_op_eval_bvc(TCGv dst, TCGv_i32 src)
    2 >
    3 unordered
 */
-static inline void gen_mov_reg_FCC0(TCGv reg, TCGv src,
+static void gen_mov_reg_FCC0(TCGv reg, TCGv src,
                                     unsigned int fcc_offset)
 {
     tcg_gen_shri_tl(reg, src, FSR_FCC0_SHIFT + fcc_offset);
     tcg_gen_andi_tl(reg, reg, 0x1);
 }
 
-static inline void gen_mov_reg_FCC1(TCGv reg, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_mov_reg_FCC1(TCGv reg, TCGv src, unsigned int fcc_offset)
 {
     tcg_gen_shri_tl(reg, src, FSR_FCC1_SHIFT + fcc_offset);
     tcg_gen_andi_tl(reg, reg, 0x1);
 }
 
 // !0: FCC0 | FCC1
-static inline void gen_op_eval_fbne(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbne(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -760,8 +758,7 @@ static inline void gen_op_eval_fbne(TCGv dst, TCGv src,
 }
 
 // 1 or 2: FCC0 ^ FCC1
-static inline void gen_op_eval_fblg(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fblg(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -770,15 +767,13 @@ static inline void gen_op_eval_fblg(TCGv dst, TCGv src,
 }
 
 // 1 or 3: FCC0
-static inline void gen_op_eval_fbul(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbul(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     gen_mov_reg_FCC0(dst, src, fcc_offset);
 }
 
 // 1: FCC0 & !FCC1
-static inline void gen_op_eval_fbl(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbl(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -787,15 +782,13 @@ static inline void gen_op_eval_fbl(TCGv dst, TCGv src,
 }
 
 // 2 or 3: FCC1
-static inline void gen_op_eval_fbug(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbug(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     gen_mov_reg_FCC1(dst, src, fcc_offset);
 }
 
 // 2: !FCC0 & FCC1
-static inline void gen_op_eval_fbg(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbg(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -804,8 +797,7 @@ static inline void gen_op_eval_fbg(TCGv dst, TCGv src,
 }
 
 // 3: FCC0 & FCC1
-static inline void gen_op_eval_fbu(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbu(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -814,8 +806,7 @@ static inline void gen_op_eval_fbu(TCGv dst, TCGv src,
 }
 
 // 0: !(FCC0 | FCC1)
-static inline void gen_op_eval_fbe(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbe(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -825,8 +816,7 @@ static inline void gen_op_eval_fbe(TCGv dst, TCGv src,
 }
 
 // 0 or 3: !(FCC0 ^ FCC1)
-static inline void gen_op_eval_fbue(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbue(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -836,16 +826,14 @@ static inline void gen_op_eval_fbue(TCGv dst, TCGv src,
 }
 
 // 0 or 2: !FCC0
-static inline void gen_op_eval_fbge(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbge(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     gen_mov_reg_FCC0(dst, src, fcc_offset);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !1: !(FCC0 & !FCC1)
-static inline void gen_op_eval_fbuge(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbuge(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -855,16 +843,14 @@ static inline void gen_op_eval_fbuge(TCGv dst, TCGv src,
 }
 
 // 0 or 1: !FCC1
-static inline void gen_op_eval_fble(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fble(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     gen_mov_reg_FCC1(dst, src, fcc_offset);
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
 // !2: !(!FCC0 & FCC1)
-static inline void gen_op_eval_fbule(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbule(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -874,8 +860,7 @@ static inline void gen_op_eval_fbule(TCGv dst, TCGv src,
 }
 
 // !3: !(FCC0 & FCC1)
-static inline void gen_op_eval_fbo(TCGv dst, TCGv src,
-                                    unsigned int fcc_offset)
+static void gen_op_eval_fbo(TCGv dst, TCGv src, unsigned int fcc_offset)
 {
     TCGv t0 = tcg_temp_new();
     gen_mov_reg_FCC0(dst, src, fcc_offset);
@@ -884,8 +869,8 @@ static inline void gen_op_eval_fbo(TCGv dst, TCGv src,
     tcg_gen_xori_tl(dst, dst, 0x1);
 }
 
-static inline void gen_branch2(DisasContext *dc, target_ulong pc1,
-                               target_ulong pc2, TCGv r_cond)
+static void gen_branch2(DisasContext *dc, target_ulong pc1,
+                        target_ulong pc2, TCGv r_cond)
 {
     TCGLabel *l1 = gen_new_label();
 
@@ -935,7 +920,7 @@ static void gen_branch_n(DisasContext *dc, target_ulong pc1)
     }
 }
 
-static inline void gen_generic_branch(DisasContext *dc)
+static void gen_generic_branch(DisasContext *dc)
 {
     TCGv npc0 = tcg_constant_tl(dc->jump_pc[0]);
     TCGv npc1 = tcg_constant_tl(dc->jump_pc[1]);
@@ -946,7 +931,7 @@ static inline void gen_generic_branch(DisasContext *dc)
 
 /* call this function before using the condition register as it may
    have been set for a jump */
-static inline void flush_cond(DisasContext *dc)
+static void flush_cond(DisasContext *dc)
 {
     if (dc->npc == JUMP_PC) {
         gen_generic_branch(dc);
@@ -954,7 +939,7 @@ static inline void flush_cond(DisasContext *dc)
     }
 }
 
-static inline void save_npc(DisasContext *dc)
+static void save_npc(DisasContext *dc)
 {
     if (dc->npc == JUMP_PC) {
         gen_generic_branch(dc);
@@ -964,7 +949,7 @@ static inline void save_npc(DisasContext *dc)
     }
 }
 
-static inline void update_psr(DisasContext *dc)
+static void update_psr(DisasContext *dc)
 {
     if (dc->cc_op != CC_OP_FLAGS) {
         dc->cc_op = CC_OP_FLAGS;
@@ -972,7 +957,7 @@ static inline void update_psr(DisasContext *dc)
     }
 }
 
-static inline void save_state(DisasContext *dc)
+static void save_state(DisasContext *dc)
 {
     tcg_gen_movi_tl(cpu_pc, dc->pc);
     save_npc(dc);
@@ -990,7 +975,7 @@ static void gen_check_align(TCGv addr, int mask)
     gen_helper_check_align(cpu_env, addr, tcg_constant_i32(mask));
 }
 
-static inline void gen_mov_pc_npc(DisasContext *dc)
+static void gen_mov_pc_npc(DisasContext *dc)
 {
     if (dc->npc == JUMP_PC) {
         gen_generic_branch(dc);
@@ -1004,7 +989,7 @@ static inline void gen_mov_pc_npc(DisasContext *dc)
     }
 }
 
-static inline void gen_op_next_insn(void)
+static void gen_op_next_insn(void)
 {
     tcg_gen_mov_tl(cpu_pc, cpu_npc);
     tcg_gen_addi_tl(cpu_npc, cpu_npc, 4);
@@ -1305,7 +1290,7 @@ static void gen_compare_reg(DisasCompare *cmp, int cond, TCGv r_src)
     cmp->c2 = tcg_constant_tl(0);
 }
 
-static inline void gen_cond_reg(TCGv r_dst, int cond, TCGv r_src)
+static void gen_cond_reg(TCGv r_dst, int cond, TCGv r_src)
 {
     DisasCompare cmp;
     gen_compare_reg(&cmp, cond, r_src);
@@ -1414,7 +1399,7 @@ static void do_branch_reg(DisasContext *dc, int32_t offset, uint32_t insn,
     }
 }
 
-static inline void gen_op_fcmps(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)
+static void gen_op_fcmps(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)
 {
     switch (fccno) {
     case 0:
@@ -1432,7 +1417,7 @@ static inline void gen_op_fcmps(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)
     }
 }
 
-static inline void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
+static void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
 {
     switch (fccno) {
     case 0:
@@ -1450,7 +1435,7 @@ static inline void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
     }
 }
 
-static inline void gen_op_fcmpq(int fccno)
+static void gen_op_fcmpq(int fccno)
 {
     switch (fccno) {
     case 0:
@@ -1468,7 +1453,7 @@ static inline void gen_op_fcmpq(int fccno)
     }
 }
 
-static inline void gen_op_fcmpes(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)
+static void gen_op_fcmpes(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)
 {
     switch (fccno) {
     case 0:
@@ -1486,7 +1471,7 @@ static inline void gen_op_fcmpes(int fccno, TCGv_i32 r_rs1, TCGv_i32 r_rs2)
     }
 }
 
-static inline void gen_op_fcmped(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
+static void gen_op_fcmped(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
 {
     switch (fccno) {
     case 0:
@@ -1504,7 +1489,7 @@ static inline void gen_op_fcmped(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
     }
 }
 
-static inline void gen_op_fcmpeq(int fccno)
+static void gen_op_fcmpeq(int fccno)
 {
     switch (fccno) {
     case 0:
@@ -1524,32 +1509,32 @@ static inline void gen_op_fcmpeq(int fccno)
 
 #else
 
-static inline void gen_op_fcmps(int fccno, TCGv r_rs1, TCGv r_rs2)
+static void gen_op_fcmps(int fccno, TCGv r_rs1, TCGv r_rs2)
 {
     gen_helper_fcmps(cpu_fsr, cpu_env, r_rs1, r_rs2);
 }
 
-static inline void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
+static void gen_op_fcmpd(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
 {
     gen_helper_fcmpd(cpu_fsr, cpu_env, r_rs1, r_rs2);
 }
 
-static inline void gen_op_fcmpq(int fccno)
+static void gen_op_fcmpq(int fccno)
 {
     gen_helper_fcmpq(cpu_fsr, cpu_env);
 }
 
-static inline void gen_op_fcmpes(int fccno, TCGv r_rs1, TCGv r_rs2)
+static void gen_op_fcmpes(int fccno, TCGv r_rs1, TCGv r_rs2)
 {
     gen_helper_fcmpes(cpu_fsr, cpu_env, r_rs1, r_rs2);
 }
 
-static inline void gen_op_fcmped(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
+static void gen_op_fcmped(int fccno, TCGv_i64 r_rs1, TCGv_i64 r_rs2)
 {
     gen_helper_fcmped(cpu_fsr, cpu_env, r_rs1, r_rs2);
 }
 
-static inline void gen_op_fcmpeq(int fccno)
+static void gen_op_fcmpeq(int fccno)
 {
     gen_helper_fcmpeq(cpu_fsr, cpu_env);
 }
@@ -1573,12 +1558,12 @@ static int gen_trap_ifnofpu(DisasContext *dc)
     return 0;
 }
 
-static inline void gen_op_clear_ieee_excp_and_FTT(void)
+static void gen_op_clear_ieee_excp_and_FTT(void)
 {
     tcg_gen_andi_tl(cpu_fsr, cpu_fsr, FSR_FTT_CEXC_NMASK);
 }
 
-static inline void gen_fop_FF(DisasContext *dc, int rd, int rs,
+static void gen_fop_FF(DisasContext *dc, int rd, int rs,
                               void (*gen)(TCGv_i32, TCGv_ptr, TCGv_i32))
 {
     TCGv_i32 dst, src;
@@ -1592,8 +1577,8 @@ static inline void gen_fop_FF(DisasContext *dc, int rd, int rs,
     gen_store_fpr_F(dc, rd, dst);
 }
 
-static inline void gen_ne_fop_FF(DisasContext *dc, int rd, int rs,
-                                 void (*gen)(TCGv_i32, TCGv_i32))
+static void gen_ne_fop_FF(DisasContext *dc, int rd, int rs,
+                          void (*gen)(TCGv_i32, TCGv_i32))
 {
     TCGv_i32 dst, src;
 
@@ -1605,7 +1590,7 @@ static inline void gen_ne_fop_FF(DisasContext *dc, int rd, int rs,
     gen_store_fpr_F(dc, rd, dst);
 }
 
-static inline void gen_fop_FFF(DisasContext *dc, int rd, int rs1, int rs2,
+static void gen_fop_FFF(DisasContext *dc, int rd, int rs1, int rs2,
                         void (*gen)(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32))
 {
     TCGv_i32 dst, src1, src2;
@@ -1621,8 +1606,8 @@ static inline void gen_fop_FFF(DisasContext *dc, int rd, int rs1, int rs2,
 }
 
 #ifdef TARGET_SPARC64
-static inline void gen_ne_fop_FFF(DisasContext *dc, int rd, int rs1, int rs2,
-                                  void (*gen)(TCGv_i32, TCGv_i32, TCGv_i32))
+static void gen_ne_fop_FFF(DisasContext *dc, int rd, int rs1, int rs2,
+                           void (*gen)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
     TCGv_i32 dst, src1, src2;
 
@@ -1636,8 +1621,8 @@ static inline void gen_ne_fop_FFF(DisasContext *dc, int rd, int rs1, int rs2,
 }
 #endif
 
-static inline void gen_fop_DD(DisasContext *dc, int rd, int rs,
-                              void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i64))
+static void gen_fop_DD(DisasContext *dc, int rd, int rs,
+                       void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i64))
 {
     TCGv_i64 dst, src;
 
@@ -1651,8 +1636,8 @@ static inline void gen_fop_DD(DisasContext *dc, int rd, int rs,
 }
 
 #ifdef TARGET_SPARC64
-static inline void gen_ne_fop_DD(DisasContext *dc, int rd, int rs,
-                                 void (*gen)(TCGv_i64, TCGv_i64))
+static void gen_ne_fop_DD(DisasContext *dc, int rd, int rs,
+                          void (*gen)(TCGv_i64, TCGv_i64))
 {
     TCGv_i64 dst, src;
 
@@ -1665,7 +1650,7 @@ static inline void gen_ne_fop_DD(DisasContext *dc, int rd, int rs,
 }
 #endif
 
-static inline void gen_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
+static void gen_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
                         void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 dst, src1, src2;
@@ -1681,8 +1666,8 @@ static inline void gen_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
 }
 
 #ifdef TARGET_SPARC64
-static inline void gen_ne_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
-                                  void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64))
+static void gen_ne_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
+                           void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 dst, src1, src2;
 
@@ -1695,8 +1680,8 @@ static inline void gen_ne_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
     gen_store_fpr_D(dc, rd, dst);
 }
 
-static inline void gen_gsr_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
-                           void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_i64))
+static void gen_gsr_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
+                            void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 dst, src1, src2;
 
@@ -1709,8 +1694,8 @@ static inline void gen_gsr_fop_DDD(DisasContext *dc, int rd, int rs1, int rs2,
     gen_store_fpr_D(dc, rd, dst);
 }
 
-static inline void gen_ne_fop_DDDD(DisasContext *dc, int rd, int rs1, int rs2,
-                           void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_i64))
+static void gen_ne_fop_DDDD(DisasContext *dc, int rd, int rs1, int rs2,
+                            void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 dst, src0, src1, src2;
 
@@ -1725,8 +1710,8 @@ static inline void gen_ne_fop_DDDD(DisasContext *dc, int rd, int rs1, int rs2,
 }
 #endif
 
-static inline void gen_fop_QQ(DisasContext *dc, int rd, int rs,
-                              void (*gen)(TCGv_ptr))
+static void gen_fop_QQ(DisasContext *dc, int rd, int rs,
+                       void (*gen)(TCGv_ptr))
 {
     gen_op_load_fpr_QT1(QFPREG(rs));
 
@@ -1738,8 +1723,8 @@ static inline void gen_fop_QQ(DisasContext *dc, int rd, int rs,
 }
 
 #ifdef TARGET_SPARC64
-static inline void gen_ne_fop_QQ(DisasContext *dc, int rd, int rs,
-                                 void (*gen)(TCGv_ptr))
+static void gen_ne_fop_QQ(DisasContext *dc, int rd, int rs,
+                          void (*gen)(TCGv_ptr))
 {
     gen_op_load_fpr_QT1(QFPREG(rs));
 
@@ -1750,8 +1735,8 @@ static inline void gen_ne_fop_QQ(DisasContext *dc, int rd, int rs,
 }
 #endif
 
-static inline void gen_fop_QQQ(DisasContext *dc, int rd, int rs1, int rs2,
-                               void (*gen)(TCGv_ptr))
+static void gen_fop_QQQ(DisasContext *dc, int rd, int rs1, int rs2,
+                        void (*gen)(TCGv_ptr))
 {
     gen_op_load_fpr_QT0(QFPREG(rs1));
     gen_op_load_fpr_QT1(QFPREG(rs2));
@@ -1763,7 +1748,7 @@ static inline void gen_fop_QQQ(DisasContext *dc, int rd, int rs1, int rs2,
     gen_update_fprs_dirty(dc, QFPREG(rd));
 }
 
-static inline void gen_fop_DFF(DisasContext *dc, int rd, int rs1, int rs2,
+static void gen_fop_DFF(DisasContext *dc, int rd, int rs1, int rs2,
                         void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i32, TCGv_i32))
 {
     TCGv_i64 dst;
@@ -1779,8 +1764,8 @@ static inline void gen_fop_DFF(DisasContext *dc, int rd, int rs1, int rs2,
     gen_store_fpr_D(dc, rd, dst);
 }
 
-static inline void gen_fop_QDD(DisasContext *dc, int rd, int rs1, int rs2,
-                               void (*gen)(TCGv_ptr, TCGv_i64, TCGv_i64))
+static void gen_fop_QDD(DisasContext *dc, int rd, int rs1, int rs2,
+                        void (*gen)(TCGv_ptr, TCGv_i64, TCGv_i64))
 {
     TCGv_i64 src1, src2;
 
@@ -1795,8 +1780,8 @@ static inline void gen_fop_QDD(DisasContext *dc, int rd, int rs1, int rs2,
 }
 
 #ifdef TARGET_SPARC64
-static inline void gen_fop_DF(DisasContext *dc, int rd, int rs,
-                              void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i32))
+static void gen_fop_DF(DisasContext *dc, int rd, int rs,
+                       void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i32))
 {
     TCGv_i64 dst;
     TCGv_i32 src;
@@ -1811,8 +1796,8 @@ static inline void gen_fop_DF(DisasContext *dc, int rd, int rs,
 }
 #endif
 
-static inline void gen_ne_fop_DF(DisasContext *dc, int rd, int rs,
-                                 void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i32))
+static void gen_ne_fop_DF(DisasContext *dc, int rd, int rs,
+                          void (*gen)(TCGv_i64, TCGv_ptr, TCGv_i32))
 {
     TCGv_i64 dst;
     TCGv_i32 src;
@@ -1825,8 +1810,8 @@ static inline void gen_ne_fop_DF(DisasContext *dc, int rd, int rs,
     gen_store_fpr_D(dc, rd, dst);
 }
 
-static inline void gen_fop_FD(DisasContext *dc, int rd, int rs,
-                              void (*gen)(TCGv_i32, TCGv_ptr, TCGv_i64))
+static void gen_fop_FD(DisasContext *dc, int rd, int rs,
+                       void (*gen)(TCGv_i32, TCGv_ptr, TCGv_i64))
 {
     TCGv_i32 dst;
     TCGv_i64 src;
@@ -1840,8 +1825,8 @@ static inline void gen_fop_FD(DisasContext *dc, int rd, int rs,
     gen_store_fpr_F(dc, rd, dst);
 }
 
-static inline void gen_fop_FQ(DisasContext *dc, int rd, int rs,
-                              void (*gen)(TCGv_i32, TCGv_ptr))
+static void gen_fop_FQ(DisasContext *dc, int rd, int rs,
+                       void (*gen)(TCGv_i32, TCGv_ptr))
 {
     TCGv_i32 dst;
 
@@ -1854,8 +1839,8 @@ static inline void gen_fop_FQ(DisasContext *dc, int rd, int rs,
     gen_store_fpr_F(dc, rd, dst);
 }
 
-static inline void gen_fop_DQ(DisasContext *dc, int rd, int rs,
-                              void (*gen)(TCGv_i64, TCGv_ptr))
+static void gen_fop_DQ(DisasContext *dc, int rd, int rs,
+                       void (*gen)(TCGv_i64, TCGv_ptr))
 {
     TCGv_i64 dst;
 
@@ -1868,8 +1853,8 @@ static inline void gen_fop_DQ(DisasContext *dc, int rd, int rs,
     gen_store_fpr_D(dc, rd, dst);
 }
 
-static inline void gen_ne_fop_QF(DisasContext *dc, int rd, int rs,
-                                 void (*gen)(TCGv_ptr, TCGv_i32))
+static void gen_ne_fop_QF(DisasContext *dc, int rd, int rs,
+                          void (*gen)(TCGv_ptr, TCGv_i32))
 {
     TCGv_i32 src;
 
@@ -1881,8 +1866,8 @@ static inline void gen_ne_fop_QF(DisasContext *dc, int rd, int rs,
     gen_update_fprs_dirty(dc, QFPREG(rd));
 }
 
-static inline void gen_ne_fop_QD(DisasContext *dc, int rd, int rs,
-                                 void (*gen)(TCGv_ptr, TCGv_i64))
+static void gen_ne_fop_QD(DisasContext *dc, int rd, int rs,
+                          void (*gen)(TCGv_ptr, TCGv_i64))
 {
     TCGv_i64 src;
 
@@ -2813,7 +2798,7 @@ static void gen_fmovq(DisasContext *dc, DisasCompare *cmp, int rd, int rs)
 }
 
 #ifndef CONFIG_USER_ONLY
-static inline void gen_load_trap_state_at_tl(TCGv_ptr r_tsptr, TCGv_env cpu_env)
+static void gen_load_trap_state_at_tl(TCGv_ptr r_tsptr, TCGv_env cpu_env)
 {
     TCGv_i32 r_tl = tcg_temp_new_i32();
 

From 633c42834c7bbd528fdb0971c3d2f994a5137072 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:11:58 +0200
Subject: [PATCH 0274/1353] target/sparc: Introduce DYNAMIC_PC_LOOKUP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create a new artificial "next pc" which also indicates
that nothing has changed within the cpu state which
requires returning to the main loop.

Pipe this new value though all pc/npc checks.
Do not produce this new value yet.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230628071202.230991-5-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 147 +++++++++++++++++++++++++++------------
 1 file changed, 103 insertions(+), 44 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 1312c3e94d..75aa1a138e 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -37,9 +37,12 @@
 #include "exec/helper-info.c.inc"
 #undef  HELPER_H
 
-#define DYNAMIC_PC  1 /* dynamic pc value */
-#define JUMP_PC     2 /* dynamic pc value which takes only two values
-                         according to jump_pc[T2] */
+/* Dynamic PC, must exit to main loop. */
+#define DYNAMIC_PC         1
+/* Dynamic PC, one of two values according to jump_pc[T2]. */
+#define JUMP_PC            2
+/* Dynamic PC, may lookup next TB. */
+#define DYNAMIC_PC_LOOKUP  3
 
 #define DISAS_EXIT  DISAS_TARGET_0
 
@@ -901,22 +904,25 @@ static void gen_branch_n(DisasContext *dc, target_ulong pc1)
 {
     target_ulong npc = dc->npc;
 
-    if (likely(npc != DYNAMIC_PC)) {
+    if (npc & 3) {
+        switch (npc) {
+        case DYNAMIC_PC:
+        case DYNAMIC_PC_LOOKUP:
+            tcg_gen_mov_tl(cpu_pc, cpu_npc);
+            tcg_gen_addi_tl(cpu_npc, cpu_npc, 4);
+            tcg_gen_movcond_tl(TCG_COND_NE, cpu_npc,
+                               cpu_cond, tcg_constant_tl(0),
+                               tcg_constant_tl(pc1), cpu_npc);
+            dc->pc = npc;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    } else {
         dc->pc = npc;
         dc->jump_pc[0] = pc1;
         dc->jump_pc[1] = npc + 4;
         dc->npc = JUMP_PC;
-    } else {
-        TCGv t, z;
-
-        tcg_gen_mov_tl(cpu_pc, cpu_npc);
-
-        tcg_gen_addi_tl(cpu_npc, cpu_npc, 4);
-        t = tcg_constant_tl(pc1);
-        z = tcg_constant_tl(0);
-        tcg_gen_movcond_tl(TCG_COND_NE, cpu_npc, cpu_cond, z, t, cpu_npc);
-
-        dc->pc = DYNAMIC_PC;
     }
 }
 
@@ -941,10 +947,19 @@ static void flush_cond(DisasContext *dc)
 
 static void save_npc(DisasContext *dc)
 {
-    if (dc->npc == JUMP_PC) {
-        gen_generic_branch(dc);
-        dc->npc = DYNAMIC_PC;
-    } else if (dc->npc != DYNAMIC_PC) {
+    if (dc->npc & 3) {
+        switch (dc->npc) {
+        case JUMP_PC:
+            gen_generic_branch(dc);
+            dc->npc = DYNAMIC_PC;
+            break;
+        case DYNAMIC_PC:
+        case DYNAMIC_PC_LOOKUP:
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    } else {
         tcg_gen_movi_tl(cpu_npc, dc->npc);
     }
 }
@@ -977,13 +992,21 @@ static void gen_check_align(TCGv addr, int mask)
 
 static void gen_mov_pc_npc(DisasContext *dc)
 {
-    if (dc->npc == JUMP_PC) {
-        gen_generic_branch(dc);
-        tcg_gen_mov_tl(cpu_pc, cpu_npc);
-        dc->pc = DYNAMIC_PC;
-    } else if (dc->npc == DYNAMIC_PC) {
-        tcg_gen_mov_tl(cpu_pc, cpu_npc);
-        dc->pc = DYNAMIC_PC;
+    if (dc->npc & 3) {
+        switch (dc->npc) {
+        case JUMP_PC:
+            gen_generic_branch(dc);
+            tcg_gen_mov_tl(cpu_pc, cpu_npc);
+            dc->pc = DYNAMIC_PC;
+            break;
+        case DYNAMIC_PC:
+        case DYNAMIC_PC_LOOKUP:
+            tcg_gen_mov_tl(cpu_pc, cpu_npc);
+            dc->pc = dc->npc;
+            break;
+        default:
+            g_assert_not_reached();
+        }
     } else {
         dc->pc = dc->npc;
     }
@@ -5501,13 +5524,21 @@ static void disas_sparc_insn(DisasContext * dc, unsigned int insn)
         break;
     }
     /* default case for non jump instructions */
-    if (dc->npc == DYNAMIC_PC) {
-        dc->pc = DYNAMIC_PC;
-        gen_op_next_insn();
-    } else if (dc->npc == JUMP_PC) {
-        /* we can do a static jump */
-        gen_branch2(dc, dc->jump_pc[0], dc->jump_pc[1], cpu_cond);
-        dc->base.is_jmp = DISAS_NORETURN;
+    if (dc->npc & 3) {
+        switch (dc->npc) {
+        case DYNAMIC_PC:
+        case DYNAMIC_PC_LOOKUP:
+            dc->pc = dc->npc;
+            gen_op_next_insn();
+            break;
+        case JUMP_PC:
+            /* we can do a static jump */
+            gen_branch2(dc, dc->jump_pc[0], dc->jump_pc[1], cpu_cond);
+            dc->base.is_jmp = DISAS_NORETURN;
+            break;
+        default:
+            g_assert_not_reached();
+        }
     } else {
         dc->pc = dc->npc;
         dc->npc = dc->npc + 4;
@@ -5578,13 +5609,23 @@ static void sparc_tr_tb_start(DisasContextBase *db, CPUState *cs)
 static void sparc_tr_insn_start(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
+    target_ulong npc = dc->npc;
 
-    if (dc->npc == JUMP_PC) {
-        assert(dc->jump_pc[1] == dc->pc + 4);
-        tcg_gen_insn_start(dc->pc, dc->jump_pc[0] | JUMP_PC);
-    } else {
-        tcg_gen_insn_start(dc->pc, dc->npc);
+    if (npc & 3) {
+        switch (npc) {
+        case JUMP_PC:
+            assert(dc->jump_pc[1] == dc->pc + 4);
+            npc = dc->jump_pc[0] | JUMP_PC;
+            break;
+        case DYNAMIC_PC:
+        case DYNAMIC_PC_LOOKUP:
+            npc = DYNAMIC_PC;
+            break;
+        default:
+            g_assert_not_reached();
+        }
     }
+    tcg_gen_insn_start(dc->pc, npc);
 }
 
 static void sparc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
@@ -5608,19 +5649,37 @@ static void sparc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 static void sparc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
+    bool may_lookup;
 
     switch (dc->base.is_jmp) {
     case DISAS_NEXT:
     case DISAS_TOO_MANY:
-        if (dc->pc != DYNAMIC_PC &&
-            (dc->npc != DYNAMIC_PC && dc->npc != JUMP_PC)) {
+        if (((dc->pc | dc->npc) & 3) == 0) {
             /* static PC and NPC: we can use direct chaining */
             gen_goto_tb(dc, 0, dc->pc, dc->npc);
-        } else {
-            if (dc->pc != DYNAMIC_PC) {
-                tcg_gen_movi_tl(cpu_pc, dc->pc);
+            break;
+        }
+
+        if (dc->pc & 3) {
+            switch (dc->pc) {
+            case DYNAMIC_PC_LOOKUP:
+                may_lookup = true;
+                break;
+            case DYNAMIC_PC:
+                may_lookup = false;
+                break;
+            default:
+                g_assert_not_reached();
             }
-            save_npc(dc);
+        } else {
+            tcg_gen_movi_tl(cpu_pc, dc->pc);
+            may_lookup = true;
+        }
+
+        save_npc(dc);
+        if (may_lookup) {
+            tcg_gen_lookup_and_goto_ptr();
+        } else {
             tcg_gen_exit_tb(NULL, 0);
         }
         break;

From 99c82c479b26ce18e124b86d0dab9fd3bfa3ec4f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:11:59 +0200
Subject: [PATCH 0275/1353] target/sparc: Use DYNAMIC_PC_LOOKUP for conditional
 branches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When resolving JUMP_PC, we know this is for a plain branch
with no other side effects.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-6-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 75aa1a138e..d7b569d910 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -941,7 +941,7 @@ static void flush_cond(DisasContext *dc)
 {
     if (dc->npc == JUMP_PC) {
         gen_generic_branch(dc);
-        dc->npc = DYNAMIC_PC;
+        dc->npc = DYNAMIC_PC_LOOKUP;
     }
 }
 
@@ -951,7 +951,7 @@ static void save_npc(DisasContext *dc)
         switch (dc->npc) {
         case JUMP_PC:
             gen_generic_branch(dc);
-            dc->npc = DYNAMIC_PC;
+            dc->npc = DYNAMIC_PC_LOOKUP;
             break;
         case DYNAMIC_PC:
         case DYNAMIC_PC_LOOKUP:
@@ -997,7 +997,7 @@ static void gen_mov_pc_npc(DisasContext *dc)
         case JUMP_PC:
             gen_generic_branch(dc);
             tcg_gen_mov_tl(cpu_pc, cpu_npc);
-            dc->pc = DYNAMIC_PC;
+            dc->pc = DYNAMIC_PC_LOOKUP;
             break;
         case DYNAMIC_PC:
         case DYNAMIC_PC_LOOKUP:

From 831543fc7678c169cb2190a14be3b8d097617776 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:12:00 +0200
Subject: [PATCH 0276/1353] target/sparc: Use DYNAMIC_PC_LOOKUP for JMPL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is for a plain indirect branch with no other side effects.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-7-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index d7b569d910..17afe98523 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -5058,7 +5058,7 @@ static void disas_sparc_insn(DisasContext * dc, unsigned int insn)
                         gen_check_align(cpu_tmp0, 3);
                         gen_address_mask(dc, cpu_tmp0);
                         tcg_gen_mov_tl(cpu_npc, cpu_tmp0);
-                        dc->npc = DYNAMIC_PC;
+                        dc->npc = DYNAMIC_PC_LOOKUP;
                     }
                     goto jmp_insn;
 #if !defined(CONFIG_USER_ONLY) && !defined(TARGET_SPARC64)

From 553338dc32c97209a01e0717ec624505b66e7948 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:12:01 +0200
Subject: [PATCH 0277/1353] target/sparc: Use DYNAMIC_PC_LOOKUP for v9 RETURN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After the register window unwind, this is for a plain indirect
branch with no further side effects.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-8-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 17afe98523..9148e33283 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -5029,7 +5029,7 @@ static void disas_sparc_insn(DisasContext * dc, unsigned int insn)
                 gen_mov_pc_npc(dc);
                 gen_check_align(cpu_tmp0, 3);
                 tcg_gen_mov_tl(cpu_npc, cpu_tmp0);
-                dc->npc = DYNAMIC_PC;
+                dc->npc = DYNAMIC_PC_LOOKUP;
                 goto jmp_insn;
 #endif
             } else {

From 44a7c2ecd4fcdb9963824cf897a3e69364c187bb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 28 Jun 2023 09:12:02 +0200
Subject: [PATCH 0278/1353] target/sparc: Use tcg_gen_lookup_and_goto_ptr for
 v9 WRASI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We incorporate %asi into tb->flags so that we may generate
inline code for the many ASIs for which it is easy to do so.
Setting %asi is common for e.g. memcpy and memset performing
block copy and clear, so it is worth noticing this case.

We must end the TB but do not need to return to the main loop.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230628071202.230991-9-richard.henderson@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/translate.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 9148e33283..bd877a5e4a 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -4147,10 +4147,14 @@ static void disas_sparc_insn(DisasContext * dc, unsigned int insn)
                                 tcg_gen_andi_tl(cpu_tmp0, cpu_tmp0, 0xff);
                                 tcg_gen_st32_tl(cpu_tmp0, cpu_env,
                                                 offsetof(CPUSPARCState, asi));
-                                /* End TB to notice changed ASI.  */
+                                /*
+                                 * End TB to notice changed ASI.
+                                 * TODO: Could notice src1 = %g0 and IS_IMM,
+                                 * update DisasContext and not exit the TB.
+                                 */
                                 save_state(dc);
                                 gen_op_next_insn();
-                                tcg_gen_exit_tb(NULL, 0);
+                                tcg_gen_lookup_and_goto_ptr();
                                 dc->base.is_jmp = DISAS_NORETURN;
                                 break;
                             case 0x6: /* V9 wrfprs */

From 6b90a4cdc04ec7ca94c3f664d63ee43c2046a875 Mon Sep 17 00:00:00 2001
From: Henrik Carlqvist <hc981@poolhem.se>
Date: Fri, 23 Jun 2023 20:30:07 +0200
Subject: [PATCH 0279/1353] escc: emulate dip switch language layout settings
 on SUN keyboard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SUN Type 4, 5 and 5c keyboards have dip switches to choose the language layout
of the keyboard. Solaris makes an ioctl to query the value of the dipswitches
and uses that value to select keyboard layout.  Also the SUN bios like the one
in the file ss5.bin uses this value to support at least some keyboard layouts.
However, the OpenBIOS provided with qemu is hardcoded to always use an US
keyboard layout.

Before this patch, qemu allways gave dip switch value 0x21 (US keyboard),
this patch uses a command line switch like
"-global escc.chnA-sunkbd-layout=de" to select dip switch value. A table is
used to lookup values from arguments like:

-global escc.chnA-sunkbd-layout=fr
-global escc.chnA-sunkbd-layout=es

But the patch also accepts numeric dip switch values directly:

-global escc.chnA-sunkbd-layout=0x2b
-global escc.chnA-sunkbd-layout=43

Both values above are the same and select swedish keyboard as explained in
table 3-15 at
https://docs.oracle.com/cd/E19683-01/806-6642/new-43/index.html

Unless you want to do a full Solaris installation but happen to have
access to a Sun bios file, the easiest way to test that the patch works
is to:

qemu-system-sparc -global escc.chnA-sunkbd-layout=sv -bios /path/to/ss5.bin

If you already happen to have a Solaris installation in a qemu disk image
file you can easily try different keyboard layouts after this patch is
applied.

Signed-off-by: Henrik Carlqvist <hc1245@poolhem.se>
Message-Id: <20230623203007.56d3d182.hc981@poolhem.se>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
[MCA edit: update unsigned char to uint8_t, fix spacing issues]
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 docs/system/device-emulation.rst |   1 +
 docs/system/devices/keyboard.rst | 129 +++++++++++++++++++++++++++++++
 docs/system/target-sparc.rst     |   2 +-
 hw/char/escc.c                   |  79 ++++++++++++++++++-
 include/hw/char/escc.h           |   1 +
 5 files changed, 210 insertions(+), 2 deletions(-)
 create mode 100644 docs/system/devices/keyboard.rst

diff --git a/docs/system/device-emulation.rst b/docs/system/device-emulation.rst
index 8d4a1821fa..4491c4cbf7 100644
--- a/docs/system/device-emulation.rst
+++ b/docs/system/device-emulation.rst
@@ -86,6 +86,7 @@ Emulated Devices
    devices/ccid.rst
    devices/cxl.rst
    devices/ivshmem.rst
+   devices/keyboard.rst
    devices/net.rst
    devices/nvme.rst
    devices/usb.rst
diff --git a/docs/system/devices/keyboard.rst b/docs/system/devices/keyboard.rst
new file mode 100644
index 0000000000..a8f9fbebae
--- /dev/null
+++ b/docs/system/devices/keyboard.rst
@@ -0,0 +1,129 @@
+.. _keyboard:
+
+Sparc32 keyboard
+----------------
+SUN Type 4, 5 and 5c keyboards have dip switches to choose the language layout
+of the keyboard. Solaris makes an ioctl to query the value of the dipswitches
+and uses that value to select keyboard layout. Also the SUN bios like the one
+in the file ss5.bin uses this value to support at least some keyboard layouts.
+However, the OpenBIOS provided with qemu is hardcoded to always use an
+US keyboard layout.
+
+With the escc.chnA-sunkbd-layout driver property it is possible to select
+keyboard layout. Example:
+
+-global escc.chnA-sunkbd-layout=de
+
+Depending on type of keyboard, the keyboard can have 6 or 5 dip-switches to
+select keyboard layout, giving up to 64 different layouts. Not all
+combinations are supported by Solaris and even less by Sun OpenBoot BIOS.
+
+The dip switch settings can be given as hexadecimal number, decimal number
+or in some cases as a language string. Examples:
+
+-global escc.chnA-sunkbd-layout=0x2b
+
+-global escc.chnA-sunkbd-layout=43
+
+-global escc.chnA-sunkbd-layout=sv
+
+The above 3 examples all select a swedish keyboard layout. Table 3-15 at
+https://docs.oracle.com/cd/E19683-01/806-6642/new-43/index.html explains which
+keytable file is used for different dip switch settings. The information
+in that table can be summarized in this table:
+
+.. list-table:: Language selection values for escc.chnA-sunkbd-layout
+   :widths: 10 10 10
+   :header-rows: 1
+
+   * - Hexadecimal value
+     - Decimal value
+     - Language code
+   * - 0x21
+     - 33
+     - en-us
+   * - 0x23
+     - 35
+     - fr
+   * - 0x24
+     - 36
+     - da
+   * - 0x25
+     - 37
+     - de
+   * - 0x26
+     - 38
+     - it
+   * - 0x27
+     - 39
+     - nl
+   * - 0x28
+     - 40
+     - no
+   * - 0x29
+     - 41
+     - pt
+   * - 0x2a
+     - 42
+     - es
+   * - 0x2b
+     - 43
+     - sv
+   * - 0x2c
+     - 44
+     - fr-ch
+   * - 0x2d
+     - 45
+     - de-ch
+   * - 0x2e
+     - 46
+     - en-gb
+   * - 0x2f
+     - 47
+     - ko
+   * - 0x30
+     - 48
+     - tw
+   * - 0x31
+     - 49
+     - ja
+   * - 0x32
+     - 50
+     - fr-ca
+   * - 0x33
+     - 51
+     - hu
+   * - 0x34
+     - 52
+     - pl
+   * - 0x35
+     - 53
+     - cz
+   * - 0x36
+     - 54
+     - ru
+   * - 0x37
+     - 55
+     - lv
+   * - 0x38
+     - 56
+     - tr
+   * - 0x39
+     - 57
+     - gr
+   * - 0x3a
+     - 58
+     - ar
+   * - 0x3b
+     - 59
+     - lt
+   * - 0x3c
+     - 60
+     - nl-be
+   * - 0x3c
+     - 60
+     - be
+
+Not all dip switch values have a corresponding language code and both "be" and
+"nl-be" correspond to the same dip switch value. By default, if no value is
+given to escc.chnA-sunkbd-layout 0x21 (en-us) will be used.
diff --git a/docs/system/target-sparc.rst b/docs/system/target-sparc.rst
index b55f8d09e9..9ec8c90c14 100644
--- a/docs/system/target-sparc.rst
+++ b/docs/system/target-sparc.rst
@@ -38,7 +38,7 @@ QEMU emulates the following sun4m peripherals:
 -  Non Volatile RAM M48T02/M48T08
 
 -  Slave I/O: timers, interrupt controllers, Zilog serial ports,
-   keyboard and power/reset logic
+   :ref:`keyboard` and power/reset logic
 
 -  ESP SCSI controller with hard disk and CD-ROM support
 
diff --git a/hw/char/escc.c b/hw/char/escc.c
index 17a908c59b..4f3872bfe9 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -31,6 +31,8 @@
 #include "qemu/module.h"
 #include "hw/char/escc.h"
 #include "ui/console.h"
+
+#include "qemu/cutils.h"
 #include "trace.h"
 
 /*
@@ -190,6 +192,7 @@
 #define R_MISC1I 14
 #define R_EXTINT 15
 
+static uint8_t sunkbd_layout_dip_switch(const char *sunkbd_layout);
 static void handle_kbd_command(ESCCChannelState *s, int val);
 static int serial_can_receive(void *opaque);
 static void serial_receive_byte(ESCCChannelState *s, int ch);
@@ -846,6 +849,79 @@ static QemuInputHandler sunkbd_handler = {
     .event = sunkbd_handle_event,
 };
 
+static uint8_t sunkbd_layout_dip_switch(const char *kbd_layout)
+{
+    /* Return the value of the dip-switches in a SUN Type 5 keyboard */
+    static uint8_t ret = 0xff;
+
+    if ((ret == 0xff) && kbd_layout) {
+        int i;
+        struct layout_values {
+            const char *lang;
+            uint8_t dip;
+        } languages[] =
+            /*
+             * Dip values from table 3-16 Layouts for Type 4, 5 and 5c Keyboards
+             */
+            {
+                {"en-us", 0x21}, /* U.S.A. (US5.kt) */
+                                 /* 0x22 is some other US (US_UNIX5.kt) */
+                {"fr",    0x23}, /* France (France5.kt) */
+                {"da",    0x24}, /* Denmark (Denmark5.kt) */
+                {"de",    0x25}, /* Germany (Germany5.kt) */
+                {"it",    0x26}, /* Italy (Italy5.kt) */
+                {"nl",    0x27}, /* The Netherlands (Netherland5.kt) */
+                {"no",    0x28}, /* Norway (Norway.kt) */
+                {"pt",    0x29}, /* Portugal (Portugal5.kt) */
+                {"es",    0x2a}, /* Spain (Spain5.kt) */
+                {"sv",    0x2b}, /* Sweden (Sweden5.kt) */
+                {"fr-ch", 0x2c}, /* Switzerland/French (Switzer_Fr5.kt) */
+                {"de-ch", 0x2d}, /* Switzerland/German (Switzer_Ge5.kt) */
+                {"en-gb", 0x2e}, /* Great Britain (UK5.kt) */
+                {"ko",    0x2f}, /* Korea (Korea5.kt) */
+                {"tw",    0x30}, /* Taiwan (Taiwan5.kt) */
+                {"ja",    0x31}, /* Japan (Japan5.kt) */
+                {"fr-ca", 0x32}, /* Canada/French (Canada_Fr5.kt) */
+                {"hu",    0x33}, /* Hungary (Hungary5.kt) */
+                {"pl",    0x34}, /* Poland (Poland5.kt) */
+                {"cz",    0x35}, /* Czech (Czech5.kt) */
+                {"ru",    0x36}, /* Russia (Russia5.kt) */
+                {"lv",    0x37}, /* Latvia (Latvia5.kt) */
+                {"tr",    0x38}, /* Turkey-Q5 (TurkeyQ5.kt) */
+                {"gr",    0x39}, /* Greece (Greece5.kt) */
+                {"ar",    0x3a}, /* Arabic (Arabic5.kt) */
+                {"lt",    0x3b}, /* Lithuania (Lithuania5.kt) */
+                {"nl-be", 0x3c}, /* Belgium (Belgian5.kt) */
+                {"be",    0x3c}, /* Belgium (Belgian5.kt) */
+            };
+
+        for (i = 0;
+             i < sizeof(languages) / sizeof(struct layout_values);
+             i++) {
+            if (!strcmp(kbd_layout, languages[i].lang)) {
+                ret = languages[i].dip;
+                return ret;
+            }
+        }
+
+        /* Found no known language code */
+        if ((kbd_layout[0] >= '0') && (kbd_layout[0] <= '9')) {
+            unsigned int tmp;
+
+            /* As a fallback we also accept numeric dip switch value */
+            if (!qemu_strtoui(kbd_layout, NULL, 0, &tmp)) {
+                ret = tmp;
+            }
+        }
+    }
+
+    if (ret == 0xff) {
+        /* Final fallback if keyboard_layout was not set or recognized */
+        ret = 0x21; /* en-us layout */
+    }
+    return ret;
+}
+
 static void handle_kbd_command(ESCCChannelState *s, int val)
 {
     trace_escc_kbd_command(val);
@@ -867,7 +943,7 @@ static void handle_kbd_command(ESCCChannelState *s, int val)
     case 0xf:
         clear_queue(s);
         put_queue(s, 0xfe);
-        put_queue(s, 0x21); /*  en-us layout */
+        put_queue(s, sunkbd_layout_dip_switch(s->sunkbd_layout));
         break;
     default:
         break;
@@ -976,6 +1052,7 @@ static Property escc_properties[] = {
     DEFINE_PROP_UINT32("chnAtype",  ESCCState, chn[1].type, 0),
     DEFINE_PROP_CHR("chrB", ESCCState, chn[0].chr),
     DEFINE_PROP_CHR("chrA", ESCCState, chn[1].chr),
+    DEFINE_PROP_STRING("chnA-sunkbd-layout", ESCCState, chn[1].sunkbd_layout),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/char/escc.h b/include/hw/char/escc.h
index 7e9482dee2..5669a5b811 100644
--- a/include/hw/char/escc.h
+++ b/include/hw/char/escc.h
@@ -45,6 +45,7 @@ typedef struct ESCCChannelState {
     ESCCChnType type;
     uint8_t rx, tx;
     QemuInputHandlerState *hs;
+    char *sunkbd_layout;
 } ESCCChannelState;
 
 struct ESCCState {

From ca3fcdeeeef56f46a7ac7b2408eda608d59be6f1 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Wed, 28 Jun 2023 16:58:04 +0530
Subject: [PATCH 0280/1353] net/vhost-net: do not assert on null pointer return
 from tap_get_vhost_net()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When 'vhost=off' or no vhost specific options at all are passed for the tap
net-device backend, tap_get_vhost_net() can return NULL. The function
net_init_tap_one() does not call vhost_net_init() on such cases and therefore
vhost_net pointer within the tap device state structure remains NULL. Hence,
assertion here on a NULL pointer return from tap_get_vhost_net() would not be
correct. Remove it and fix the crash generated by qemu upon initialization in
the following call chain :

qdev_realize() -> pci_qdev_realize() -> virtio_device_realize() ->
virtio_bus_device_plugged() -> virtio_net_get_features() -> get_vhost_net()

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Fixes: 0e994668d00c9c ("vhost_net: add an assertion for TAP client backends")
Reported-by: Cédric Le Goater <clg@redhat.com>
Report: <abab7a71-216d-b103-fa47-70bdf9dc0080@redhat.com>
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-Id: <20230628112804.36676-1-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/vhost_net.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 6db23ca323..6b958d6363 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -507,7 +507,12 @@ VHostNetState *get_vhost_net(NetClientState *nc)
     switch (nc->info->type) {
     case NET_CLIENT_DRIVER_TAP:
         vhost_net = tap_get_vhost_net(nc);
-        assert(vhost_net);
+        /*
+         * tap_get_vhost_net() can return NULL if a tap net-device backend is
+         * created with 'vhost=off' option, 'vhostforce=off' or no vhost or
+         * vhostforce or vhostfd options at all. Please see net_init_tap_one().
+         * Hence, we omit the assertion here.
+         */
         break;
 #ifdef CONFIG_VHOST_NET_USER
     case NET_CLIENT_DRIVER_VHOST_USER:

From 3b4a0253e6feed3951e7506d63acd4094be7b7b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 21 Jun 2023 13:32:23 +0200
Subject: [PATCH 0281/1353] MAINTAINERS: Update Roman Bolshakov email address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

r.bolshakov@yadro.com is bouncing: Update Roman's email address
using one found somewhere on the Internet; this way he can Ack-by.

(Reorder Taylor's line to keep the section sorted alphabetically).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Roman Bolshakov <rbolshakov@ddn.com>
Message-Id: <20230624174121.11508-2-philmd@linaro.org>
---
 .mailmap    | 3 ++-
 MAINTAINERS | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.mailmap b/.mailmap
index b57da4827e..64ef9f4de6 100644
--- a/.mailmap
+++ b/.mailmap
@@ -76,9 +76,10 @@ Paul Burton <paulburton@kernel.org> <pburton@wavecomp.com>
 Philippe Mathieu-Daudé <philmd@linaro.org> <f4bug@amsat.org>
 Philippe Mathieu-Daudé <philmd@linaro.org> <philmd@redhat.com>
 Philippe Mathieu-Daudé <philmd@linaro.org> <philmd@fungible.com>
+Roman Bolshakov <rbolshakov@ddn.com> <r.bolshakov@yadro.com>
 Stefan Brankovic <stefan.brankovic@syrmia.com> <stefan.brankovic@rt-rk.com.com>
-Yongbok Kim <yongbok.kim@mips.com> <yongbok.kim@imgtec.com>
 Taylor Simpson <ltaylorsimpson@gmail.com> <tsimpson@quicinc.com>
+Yongbok Kim <yongbok.kim@mips.com> <yongbok.kim@imgtec.com>
 
 # Also list preferred name forms where people have changed their
 # git author config, or had utf8/latin1 encoding issues.
diff --git a/MAINTAINERS b/MAINTAINERS
index 21a587ce4b..aba07722f6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -498,14 +498,14 @@ F: target/arm/hvf/
 
 X86 HVF CPUs
 M: Cameron Esfahani <dirty@apple.com>
-M: Roman Bolshakov <r.bolshakov@yadro.com>
+M: Roman Bolshakov <rbolshakov@ddn.com>
 W: https://wiki.qemu.org/Features/HVF
 S: Maintained
 F: target/i386/hvf/
 
 HVF
 M: Cameron Esfahani <dirty@apple.com>
-M: Roman Bolshakov <r.bolshakov@yadro.com>
+M: Roman Bolshakov <rbolshakov@ddn.com>
 W: https://wiki.qemu.org/Features/HVF
 S: Maintained
 F: accel/hvf/

From 098bfc01df5ba4c1cb62803b173b2101ae39b0f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 24 Jun 2023 14:58:24 +0200
Subject: [PATCH 0282/1353] docs/devel/testing: Update the 'Docker Debugging'
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 93cc0506f6 ("tests/docker: Use Fedora containers
for MinGW cross-builds in the gitlab-CI") the MinGW toolchain
is packaged inside the fedora-win[32/64]-cross images.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230624142211.8888-2-philmd@linaro.org>
---
 docs/devel/testing.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/testing.rst b/docs/devel/testing.rst
index 203facb417..e85e26c4ca 100644
--- a/docs/devel/testing.rst
+++ b/docs/devel/testing.rst
@@ -558,7 +558,7 @@ When CI tasks, maintainers or yourself report a Docker test failure, follow the
 below steps to debug it:
 
 1. Locally reproduce the failure with the reported command line. E.g. run
-   ``make docker-test-mingw@fedora J=8``.
+   ``make docker-test-mingw@fedora-win64-cross J=8``.
 2. Add "V=1" to the command line, try again, to see the verbose output.
 3. Further add "DEBUG=1" to the command line. This will pause in a shell prompt
    in the container right before testing starts. You could either manually

From 641b841722836cd08d39701f6e4932543afcf41a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 24 Jun 2023 15:31:44 +0200
Subject: [PATCH 0283/1353] accel: Re-enable WHPX cross-build on case sensitive
 filesystems
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since MinGW commit 395dcfdea ("rename hyper-v headers and def
files to lower case") [*], WinHvPlatform.h and WinHvEmulation.h
got respectively renamed as winhvplatform.h / winhvemulation.h.

The mingw64-headers package included in the Fedora version we
use for CI does include this commit; and meson fails to detect
these present-but-renamed headers while cross-building (on
case-sensitive filesystems).

Use the renamed header in order to detect and successfully
cross-build with the WHPX accelerator.

Note, on Windows hosts, the libraries are still named as
WinHvPlatform.dll and WinHvEmulation.dll, so we don't bother
renaming the definitions used by load_whp_dispatch_fns() in
target/i386/whpx/whpx-all.c.

[*] https://sourceforge.net/p/mingw-w64/mingw-w64/ci/395dcfdea

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230624142211.8888-3-philmd@linaro.org>
---
 meson.build                      | 4 ++--
 target/i386/whpx/whpx-all.c      | 4 ++--
 target/i386/whpx/whpx-internal.h | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/meson.build b/meson.build
index 1631e60a3b..a9ba0bfab3 100644
--- a/meson.build
+++ b/meson.build
@@ -661,8 +661,8 @@ endif
 if get_option('whpx').allowed() and targetos == 'windows'
   if get_option('whpx').enabled() and host_machine.cpu() != 'x86_64'
     error('WHPX requires 64-bit host')
-  elif cc.has_header('WinHvPlatform.h', required: get_option('whpx')) and \
-       cc.has_header('WinHvEmulation.h', required: get_option('whpx'))
+  elif cc.has_header('winhvplatform.h', required: get_option('whpx')) and \
+       cc.has_header('winhvemulation.h', required: get_option('whpx'))
     accelerators += 'CONFIG_WHPX'
   endif
 endif
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 52af81683c..7fa68d49e5 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -31,8 +31,8 @@
 #include "whpx-internal.h"
 #include "whpx-accel-ops.h"
 
-#include <WinHvPlatform.h>
-#include <WinHvEmulation.h>
+#include <winhvplatform.h>
+#include <winhvemulation.h>
 
 #define HYPERV_APIC_BUS_FREQUENCY      (200000000ULL)
 
diff --git a/target/i386/whpx/whpx-internal.h b/target/i386/whpx/whpx-internal.h
index 06429d8ccd..6633e9c4ca 100644
--- a/target/i386/whpx/whpx-internal.h
+++ b/target/i386/whpx/whpx-internal.h
@@ -2,8 +2,8 @@
 #define TARGET_I386_WHPX_INTERNAL_H
 
 #include <windows.h>
-#include <WinHvPlatform.h>
-#include <WinHvEmulation.h>
+#include <winhvplatform.h>
+#include <winhvemulation.h>
 
 typedef enum WhpxBreakpointState {
     WHPX_BP_CLEARED = 0,

From 6970030177ae846327af435ad0e3f6e1045a0c86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 3 Apr 2023 14:53:17 +0200
Subject: [PATCH 0284/1353] accel: Document generic accelerator headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These headers are meant to be include by any file to check
the availability of accelerators, thus are not accelerator
specific.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-3-philmd@linaro.org>
---
 include/sysemu/hax.h  | 2 ++
 include/sysemu/kvm.h  | 2 ++
 include/sysemu/nvmm.h | 2 ++
 include/sysemu/tcg.h  | 2 ++
 include/sysemu/whpx.h | 2 ++
 include/sysemu/xen.h  | 2 ++
 6 files changed, 12 insertions(+)

diff --git a/include/sysemu/hax.h b/include/sysemu/hax.h
index bf8f99a824..80fc716f80 100644
--- a/include/sysemu/hax.h
+++ b/include/sysemu/hax.h
@@ -19,6 +19,8 @@
  *
  */
 
+/* header to be included in non-HAX-specific code */
+
 #ifndef QEMU_HAX_H
 #define QEMU_HAX_H
 
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 88f5ccfbce..7902acdfd9 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -11,6 +11,8 @@
  *
  */
 
+/* header to be included in non-KVM-specific code */
+
 #ifndef QEMU_KVM_H
 #define QEMU_KVM_H
 
diff --git a/include/sysemu/nvmm.h b/include/sysemu/nvmm.h
index 833670fccb..be7bc9a62d 100644
--- a/include/sysemu/nvmm.h
+++ b/include/sysemu/nvmm.h
@@ -7,6 +7,8 @@
  * See the COPYING file in the top-level directory.
  */
 
+/* header to be included in non-NVMM-specific code */
+
 #ifndef QEMU_NVMM_H
 #define QEMU_NVMM_H
 
diff --git a/include/sysemu/tcg.h b/include/sysemu/tcg.h
index 53352450ff..5e2ca9aab3 100644
--- a/include/sysemu/tcg.h
+++ b/include/sysemu/tcg.h
@@ -5,6 +5,8 @@
  * See the COPYING file in the top-level directory.
  */
 
+/* header to be included in non-TCG-specific code */
+
 #ifndef SYSEMU_TCG_H
 #define SYSEMU_TCG_H
 
diff --git a/include/sysemu/whpx.h b/include/sysemu/whpx.h
index 2889fa2278..781ca5b2b6 100644
--- a/include/sysemu/whpx.h
+++ b/include/sysemu/whpx.h
@@ -10,6 +10,8 @@
  *
  */
 
+/* header to be included in non-WHPX-specific code */
+
 #ifndef QEMU_WHPX_H
 #define QEMU_WHPX_H
 
diff --git a/include/sysemu/xen.h b/include/sysemu/xen.h
index 0ca25697e4..bc13ad5692 100644
--- a/include/sysemu/xen.h
+++ b/include/sysemu/xen.h
@@ -5,6 +5,8 @@
  * See the COPYING file in the top-level directory.
  */
 
+/* header to be included in non-Xen-specific code */
+
 #ifndef SYSEMU_XEN_H
 #define SYSEMU_XEN_H
 

From af03d22a0a2aec52f8e6959e8bc5e318ecc72e6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 29 Mar 2023 18:46:12 +0200
Subject: [PATCH 0285/1353] accel: Remove unused hThread variable on TCG/WHPX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Windows hosts, cpu->hThread is assigned but never accessed:
remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-4-philmd@linaro.org>
---
 accel/tcg/tcg-accel-ops-mttcg.c   | 4 ----
 accel/tcg/tcg-accel-ops-rr.c      | 3 ---
 target/i386/whpx/whpx-accel-ops.c | 3 ---
 3 files changed, 10 deletions(-)

diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index b320ff0037..b276262007 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -152,8 +152,4 @@ void mttcg_start_vcpu_thread(CPUState *cpu)
 
     qemu_thread_create(cpu->thread, thread_name, mttcg_cpu_thread_fn,
                        cpu, QEMU_THREAD_JOINABLE);
-
-#ifdef _WIN32
-    cpu->hThread = qemu_thread_get_handle(cpu->thread);
-#endif
 }
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 23e4d0f452..2d523289a8 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -329,9 +329,6 @@ void rr_start_vcpu_thread(CPUState *cpu)
 
         single_tcg_halt_cond = cpu->halt_cond;
         single_tcg_cpu_thread = cpu->thread;
-#ifdef _WIN32
-        cpu->hThread = qemu_thread_get_handle(cpu->thread);
-#endif
     } else {
         /* we share the thread */
         cpu->thread = single_tcg_cpu_thread;
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index e8dc4b3a47..67cad86720 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -71,9 +71,6 @@ static void whpx_start_vcpu_thread(CPUState *cpu)
              cpu->cpu_index);
     qemu_thread_create(cpu->thread, thread_name, whpx_cpu_thread_fn,
                        cpu, QEMU_THREAD_JOINABLE);
-#ifdef _WIN32
-    cpu->hThread = qemu_thread_get_handle(cpu->thread);
-#endif
 }
 
 static void whpx_kick_vcpu_thread(CPUState *cpu)

From 43477340c38c7980d4f4d5bfedf1bd0146ccb577 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 09:29:59 +0200
Subject: [PATCH 0286/1353] accel: Fix a leak on Windows HAX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hThread is only used on the error path in hax_kick_vcpu_thread().

Fixes: b0cb0a66d6 ("Plumb the HAXM-based hardware acceleration support")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-5-philmd@linaro.org>
---
 target/i386/hax/hax-all.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index 3e5992a63b..a2321a1eff 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -205,6 +205,9 @@ int hax_vcpu_destroy(CPUState *cpu)
      */
     hax_close_fd(vcpu->fd);
     hax_global.vm->vcpus[vcpu->vcpu_id] = NULL;
+#ifdef _WIN32
+    CloseHandle(cpu->hThread);
+#endif
     g_free(vcpu);
     return 0;
 }

From 83d0f7f95cc88bbf31ba000d1d2f05e8563f9d97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 09:15:26 +0200
Subject: [PATCH 0287/1353] accel: Destroy HAX vCPU threads once done
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the vCPU thread finished its processing, destroy
it and signal its destruction to generic vCPU management
layer.

Add a sanity check for the vCPU accelerator context.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-6-philmd@linaro.org>
---
 target/i386/hax/hax-accel-ops.c | 3 +++
 target/i386/hax/hax-all.c       | 1 +
 2 files changed, 4 insertions(+)

diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
index 18114fe34d..0157a628a3 100644
--- a/target/i386/hax/hax-accel-ops.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -53,6 +53,8 @@ static void *hax_cpu_thread_fn(void *arg)
 
         qemu_wait_io_event(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
+    hax_vcpu_destroy(cpu);
+    cpu_thread_signal_destroyed(cpu);
     rcu_unregister_thread();
     return NULL;
 }
@@ -69,6 +71,7 @@ static void hax_start_vcpu_thread(CPUState *cpu)
              cpu->cpu_index);
     qemu_thread_create(cpu->thread, thread_name, hax_cpu_thread_fn,
                        cpu, QEMU_THREAD_JOINABLE);
+    assert(cpu->hax_vcpu);
 #ifdef _WIN32
     cpu->hThread = qemu_thread_get_handle(cpu->thread);
 #endif
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index a2321a1eff..38a4323a3c 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -209,6 +209,7 @@ int hax_vcpu_destroy(CPUState *cpu)
     CloseHandle(cpu->hThread);
 #endif
     g_free(vcpu);
+    cpu->hax_vcpu = NULL;
     return 0;
 }
 

From 6ecd2cd0dcfa733bdad7e97ee913ff44fc7681aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 29 Mar 2023 18:56:35 +0200
Subject: [PATCH 0288/1353] accel: Rename 'hax_vcpu' as 'accel' in CPUState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All accelerators will share a single opaque context
in CPUState. Start by renaming 'hax_vcpu' as 'accel'.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230624174121.11508-7-philmd@linaro.org>
---
 include/hw/core/cpu.h           |  2 +-
 target/i386/hax/hax-accel-ops.c |  2 +-
 target/i386/hax/hax-all.c       | 18 +++++++++---------
 target/i386/nvmm/nvmm-all.c     |  6 +++---
 target/i386/whpx/whpx-all.c     |  6 +++---
 5 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index eda0230a02..63c25ce106 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -443,7 +443,7 @@ struct CPUState {
     /* Used for user-only emulation of prctl(PR_SET_UNALIGN). */
     bool prctl_unalign_sigbus;
 
-    struct hax_vcpu_state *hax_vcpu;
+    struct hax_vcpu_state *accel;
 
     struct hvf_vcpu_state *hvf;
 
diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
index 0157a628a3..a8512efcd5 100644
--- a/target/i386/hax/hax-accel-ops.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -71,7 +71,7 @@ static void hax_start_vcpu_thread(CPUState *cpu)
              cpu->cpu_index);
     qemu_thread_create(cpu->thread, thread_name, hax_cpu_thread_fn,
                        cpu, QEMU_THREAD_JOINABLE);
-    assert(cpu->hax_vcpu);
+    assert(cpu->accel);
 #ifdef _WIN32
     cpu->hThread = qemu_thread_get_handle(cpu->thread);
 #endif
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index 38a4323a3c..3865ff9419 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -62,7 +62,7 @@ int valid_hax_tunnel_size(uint16_t size)
 
 hax_fd hax_vcpu_get_fd(CPUArchState *env)
 {
-    struct hax_vcpu_state *vcpu = env_cpu(env)->hax_vcpu;
+    struct hax_vcpu_state *vcpu = env_cpu(env)->accel;
     if (!vcpu) {
         return HAX_INVALID_FD;
     }
@@ -188,7 +188,7 @@ int hax_vcpu_create(int id)
 
 int hax_vcpu_destroy(CPUState *cpu)
 {
-    struct hax_vcpu_state *vcpu = cpu->hax_vcpu;
+    struct hax_vcpu_state *vcpu = cpu->accel;
 
     if (!hax_global.vm) {
         fprintf(stderr, "vcpu %x destroy failed, vm is null\n", vcpu->vcpu_id);
@@ -209,7 +209,7 @@ int hax_vcpu_destroy(CPUState *cpu)
     CloseHandle(cpu->hThread);
 #endif
     g_free(vcpu);
-    cpu->hax_vcpu = NULL;
+    cpu->accel = NULL;
     return 0;
 }
 
@@ -223,7 +223,7 @@ int hax_init_vcpu(CPUState *cpu)
         exit(-1);
     }
 
-    cpu->hax_vcpu = hax_global.vm->vcpus[cpu->cpu_index];
+    cpu->accel = hax_global.vm->vcpus[cpu->cpu_index];
     cpu->vcpu_dirty = true;
     qemu_register_reset(hax_reset_vcpu_state, cpu->env_ptr);
 
@@ -415,7 +415,7 @@ static int hax_handle_io(CPUArchState *env, uint32_t df, uint16_t port,
 static int hax_vcpu_interrupt(CPUArchState *env)
 {
     CPUState *cpu = env_cpu(env);
-    struct hax_vcpu_state *vcpu = cpu->hax_vcpu;
+    struct hax_vcpu_state *vcpu = cpu->accel;
     struct hax_tunnel *ht = vcpu->tunnel;
 
     /*
@@ -447,7 +447,7 @@ static int hax_vcpu_interrupt(CPUArchState *env)
 
 void hax_raise_event(CPUState *cpu)
 {
-    struct hax_vcpu_state *vcpu = cpu->hax_vcpu;
+    struct hax_vcpu_state *vcpu = cpu->accel;
 
     if (!vcpu) {
         return;
@@ -468,7 +468,7 @@ static int hax_vcpu_hax_exec(CPUArchState *env)
     int ret = 0;
     CPUState *cpu = env_cpu(env);
     X86CPU *x86_cpu = X86_CPU(cpu);
-    struct hax_vcpu_state *vcpu = cpu->hax_vcpu;
+    struct hax_vcpu_state *vcpu = cpu->accel;
     struct hax_tunnel *ht = vcpu->tunnel;
 
     if (!hax_enabled()) {
@@ -1114,8 +1114,8 @@ void hax_reset_vcpu_state(void *opaque)
 {
     CPUState *cpu;
     for (cpu = first_cpu; cpu != NULL; cpu = CPU_NEXT(cpu)) {
-        cpu->hax_vcpu->tunnel->user_event_pending = 0;
-        cpu->hax_vcpu->tunnel->ready_for_interrupt_injection = 0;
+        cpu->accel->tunnel->user_event_pending = 0;
+        cpu->accel->tunnel->ready_for_interrupt_injection = 0;
     }
 }
 
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index b75738ee9c..cf4f0af24b 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -52,7 +52,7 @@ static struct qemu_machine qemu_mach;
 static struct qemu_vcpu *
 get_qemu_vcpu(CPUState *cpu)
 {
-    return (struct qemu_vcpu *)cpu->hax_vcpu;
+    return (struct qemu_vcpu *)cpu->accel;
 }
 
 static struct nvmm_machine *
@@ -995,7 +995,7 @@ nvmm_init_vcpu(CPUState *cpu)
     }
 
     cpu->vcpu_dirty = true;
-    cpu->hax_vcpu = (struct hax_vcpu_state *)qcpu;
+    cpu->accel = (struct hax_vcpu_state *)qcpu;
 
     return 0;
 }
@@ -1030,7 +1030,7 @@ nvmm_destroy_vcpu(CPUState *cpu)
     struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
 
     nvmm_vcpu_destroy(mach, &qcpu->vcpu);
-    g_free(cpu->hax_vcpu);
+    g_free(cpu->accel);
 }
 
 /* -------------------------------------------------------------------------- */
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 7fa68d49e5..98dfa5cfc2 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -262,7 +262,7 @@ static bool whpx_has_xsave(void)
 
 static struct whpx_vcpu *get_whpx_vcpu(CPUState *cpu)
 {
-    return (struct whpx_vcpu *)cpu->hax_vcpu;
+    return (struct whpx_vcpu *)cpu->accel;
 }
 
 static WHV_X64_SEGMENT_REGISTER whpx_seg_q2h(const SegmentCache *qs, int v86,
@@ -2258,7 +2258,7 @@ int whpx_init_vcpu(CPUState *cpu)
 
     vcpu->interruptable = true;
     cpu->vcpu_dirty = true;
-    cpu->hax_vcpu = (struct hax_vcpu_state *)vcpu;
+    cpu->accel = (struct hax_vcpu_state *)vcpu;
     max_vcpu_index = max(max_vcpu_index, cpu->cpu_index);
     qemu_add_vm_change_state_handler(whpx_cpu_update_state, cpu->env_ptr);
 
@@ -2300,7 +2300,7 @@ void whpx_destroy_vcpu(CPUState *cpu)
 
     whp_dispatch.WHvDeleteVirtualProcessor(whpx->partition, cpu->cpu_index);
     whp_dispatch.WHvEmulatorDestroyEmulator(vcpu->emulator);
-    g_free(cpu->hax_vcpu);
+    g_free(cpu->accel);
     return;
 }
 

From f861b3f39063619b2d169cbacf455a00c22a1584 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 29 Mar 2023 19:01:49 +0200
Subject: [PATCH 0289/1353] accel: Rename HAX 'struct hax_vcpu_state' ->
 AccelCPUState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want all accelerators to share the same opaque pointer in
CPUState. Start with the HAX context, renaming its forward
declarated structure 'hax_vcpu_state' as 'AccelCPUState'.
Document the CPUState field. Directly use the typedef.

Remove the amusing but now unnecessary casts in NVMM / WHPX.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-8-philmd@linaro.org>
---
 include/hw/core/cpu.h         |  5 ++---
 include/qemu/typedefs.h       |  1 +
 target/i386/hax/hax-all.c     | 16 ++++++++--------
 target/i386/hax/hax-i386.h    |  9 +++++----
 target/i386/hax/hax-posix.c   |  4 ++--
 target/i386/hax/hax-windows.c |  4 ++--
 target/i386/nvmm/nvmm-all.c   |  2 +-
 target/i386/whpx/whpx-all.c   |  2 +-
 8 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 63c25ce106..45e30911e7 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -241,7 +241,6 @@ typedef struct SavedIOTLB {
 struct KVMState;
 struct kvm_run;
 
-struct hax_vcpu_state;
 struct hvf_vcpu_state;
 
 /* work queue */
@@ -309,6 +308,7 @@ struct qemu_work_item;
  * @next_cpu: Next CPU sharing TB cache.
  * @opaque: User data.
  * @mem_io_pc: Host Program Counter at which the memory was accessed.
+ * @accel: Pointer to accelerator specific state.
  * @kvm_fd: vCPU file descriptor for KVM.
  * @work_mutex: Lock to prevent multiple access to @work_list.
  * @work_list: List of pending asynchronous work.
@@ -424,6 +424,7 @@ struct CPUState {
     uint32_t can_do_io;
     int32_t exception_index;
 
+    AccelCPUState *accel;
     /* shared by kvm, hax and hvf */
     bool vcpu_dirty;
 
@@ -443,8 +444,6 @@ struct CPUState {
     /* Used for user-only emulation of prctl(PR_SET_UNALIGN). */
     bool prctl_unalign_sigbus;
 
-    struct hax_vcpu_state *accel;
-
     struct hvf_vcpu_state *hvf;
 
     /* track IOMMUs whose translations we've cached in the TCG TLB */
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index 8c1840bfc1..834b0e47a0 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -21,6 +21,7 @@
  * Incomplete struct types
  * Please keep this list in case-insensitive alphabetical order.
  */
+typedef struct AccelCPUState AccelCPUState;
 typedef struct AccelState AccelState;
 typedef struct AdapterInfo AdapterInfo;
 typedef struct AddressSpace AddressSpace;
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index 3865ff9419..9d9011cc38 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -62,7 +62,7 @@ int valid_hax_tunnel_size(uint16_t size)
 
 hax_fd hax_vcpu_get_fd(CPUArchState *env)
 {
-    struct hax_vcpu_state *vcpu = env_cpu(env)->accel;
+    AccelCPUState *vcpu = env_cpu(env)->accel;
     if (!vcpu) {
         return HAX_INVALID_FD;
     }
@@ -136,7 +136,7 @@ static int hax_version_support(struct hax_state *hax)
 
 int hax_vcpu_create(int id)
 {
-    struct hax_vcpu_state *vcpu = NULL;
+    AccelCPUState *vcpu = NULL;
     int ret;
 
     if (!hax_global.vm) {
@@ -149,7 +149,7 @@ int hax_vcpu_create(int id)
         return 0;
     }
 
-    vcpu = g_new0(struct hax_vcpu_state, 1);
+    vcpu = g_new0(AccelCPUState, 1);
 
     ret = hax_host_create_vcpu(hax_global.vm->fd, id);
     if (ret) {
@@ -188,7 +188,7 @@ int hax_vcpu_create(int id)
 
 int hax_vcpu_destroy(CPUState *cpu)
 {
-    struct hax_vcpu_state *vcpu = cpu->accel;
+    AccelCPUState *vcpu = cpu->accel;
 
     if (!hax_global.vm) {
         fprintf(stderr, "vcpu %x destroy failed, vm is null\n", vcpu->vcpu_id);
@@ -263,7 +263,7 @@ struct hax_vm *hax_vm_create(struct hax_state *hax, int max_cpus)
     }
 
     vm->numvcpus = max_cpus;
-    vm->vcpus = g_new0(struct hax_vcpu_state *, vm->numvcpus);
+    vm->vcpus = g_new0(AccelCPUState *, vm->numvcpus);
     for (i = 0; i < vm->numvcpus; i++) {
         vm->vcpus[i] = NULL;
     }
@@ -415,7 +415,7 @@ static int hax_handle_io(CPUArchState *env, uint32_t df, uint16_t port,
 static int hax_vcpu_interrupt(CPUArchState *env)
 {
     CPUState *cpu = env_cpu(env);
-    struct hax_vcpu_state *vcpu = cpu->accel;
+    AccelCPUState *vcpu = cpu->accel;
     struct hax_tunnel *ht = vcpu->tunnel;
 
     /*
@@ -447,7 +447,7 @@ static int hax_vcpu_interrupt(CPUArchState *env)
 
 void hax_raise_event(CPUState *cpu)
 {
-    struct hax_vcpu_state *vcpu = cpu->accel;
+    AccelCPUState *vcpu = cpu->accel;
 
     if (!vcpu) {
         return;
@@ -468,7 +468,7 @@ static int hax_vcpu_hax_exec(CPUArchState *env)
     int ret = 0;
     CPUState *cpu = env_cpu(env);
     X86CPU *x86_cpu = X86_CPU(cpu);
-    struct hax_vcpu_state *vcpu = cpu->accel;
+    AccelCPUState *vcpu = cpu->accel;
     struct hax_tunnel *ht = vcpu->tunnel;
 
     if (!hax_enabled()) {
diff --git a/target/i386/hax/hax-i386.h b/target/i386/hax/hax-i386.h
index 409ebdb4af..4372ee596d 100644
--- a/target/i386/hax/hax-i386.h
+++ b/target/i386/hax/hax-i386.h
@@ -25,7 +25,8 @@ typedef HANDLE hax_fd;
 #endif
 
 extern struct hax_state hax_global;
-struct hax_vcpu_state {
+
+struct AccelCPUState {
     hax_fd fd;
     int vcpu_id;
     struct hax_tunnel *tunnel;
@@ -46,7 +47,7 @@ struct hax_vm {
     hax_fd fd;
     int id;
     int numvcpus;
-    struct hax_vcpu_state **vcpus;
+    AccelCPUState **vcpus;
 };
 
 /* Functions exported to host specific mode */
@@ -57,7 +58,7 @@ int valid_hax_tunnel_size(uint16_t size);
 int hax_mod_version(struct hax_state *hax, struct hax_module_version *version);
 int hax_inject_interrupt(CPUArchState *env, int vector);
 struct hax_vm *hax_vm_create(struct hax_state *hax, int max_cpus);
-int hax_vcpu_run(struct hax_vcpu_state *vcpu);
+int hax_vcpu_run(AccelCPUState *vcpu);
 int hax_vcpu_create(int id);
 void hax_kick_vcpu_thread(CPUState *cpu);
 
@@ -76,7 +77,7 @@ int hax_host_create_vm(struct hax_state *hax, int *vm_id);
 hax_fd hax_host_open_vm(struct hax_state *hax, int vm_id);
 int hax_host_create_vcpu(hax_fd vm_fd, int vcpuid);
 hax_fd hax_host_open_vcpu(int vmid, int vcpuid);
-int hax_host_setup_vcpu_channel(struct hax_vcpu_state *vcpu);
+int hax_host_setup_vcpu_channel(AccelCPUState *vcpu);
 hax_fd hax_mod_open(void);
 void hax_memory_init(void);
 
diff --git a/target/i386/hax/hax-posix.c b/target/i386/hax/hax-posix.c
index ac1a51096e..a057a5bd94 100644
--- a/target/i386/hax/hax-posix.c
+++ b/target/i386/hax/hax-posix.c
@@ -205,7 +205,7 @@ hax_fd hax_host_open_vcpu(int vmid, int vcpuid)
     return fd;
 }
 
-int hax_host_setup_vcpu_channel(struct hax_vcpu_state *vcpu)
+int hax_host_setup_vcpu_channel(AccelCPUState *vcpu)
 {
     int ret;
     struct hax_tunnel_info info;
@@ -227,7 +227,7 @@ int hax_host_setup_vcpu_channel(struct hax_vcpu_state *vcpu)
     return 0;
 }
 
-int hax_vcpu_run(struct hax_vcpu_state *vcpu)
+int hax_vcpu_run(AccelCPUState *vcpu)
 {
     return ioctl(vcpu->fd, HAX_VCPU_IOCTL_RUN, NULL);
 }
diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
index 59afa213a6..bf4b0ad941 100644
--- a/target/i386/hax/hax-windows.c
+++ b/target/i386/hax/hax-windows.c
@@ -301,7 +301,7 @@ hax_fd hax_host_open_vcpu(int vmid, int vcpuid)
     return hDeviceVCPU;
 }
 
-int hax_host_setup_vcpu_channel(struct hax_vcpu_state *vcpu)
+int hax_host_setup_vcpu_channel(AccelCPUState *vcpu)
 {
     hax_fd hDeviceVCPU = vcpu->fd;
     int ret;
@@ -327,7 +327,7 @@ int hax_host_setup_vcpu_channel(struct hax_vcpu_state *vcpu)
     return 0;
 }
 
-int hax_vcpu_run(struct hax_vcpu_state *vcpu)
+int hax_vcpu_run(AccelCPUState *vcpu)
 {
     int ret;
     HANDLE hDeviceVCPU = vcpu->fd;
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index cf4f0af24b..b3c3adc59a 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -995,7 +995,7 @@ nvmm_init_vcpu(CPUState *cpu)
     }
 
     cpu->vcpu_dirty = true;
-    cpu->accel = (struct hax_vcpu_state *)qcpu;
+    cpu->accel = qcpu;
 
     return 0;
 }
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 98dfa5cfc2..7fc8d4ffe5 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2258,7 +2258,7 @@ int whpx_init_vcpu(CPUState *cpu)
 
     vcpu->interruptable = true;
     cpu->vcpu_dirty = true;
-    cpu->accel = (struct hax_vcpu_state *)vcpu;
+    cpu->accel = vcpu;
     max_vcpu_index = max(max_vcpu_index, cpu->cpu_index);
     qemu_add_vm_change_state_handler(whpx_cpu_update_state, cpu->env_ptr);
 

From 642ce52d8ea9e1f80aa6013ad55bb66e51f1c76e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 29 Mar 2023 19:13:09 +0200
Subject: [PATCH 0290/1353] accel: Move HAX hThread to accelerator context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hThread variable is only used by the HAX accelerator,
so move it to the accelerator specific context.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-9-philmd@linaro.org>
---
 include/hw/core/cpu.h           | 1 -
 target/i386/hax/hax-accel-ops.c | 2 +-
 target/i386/hax/hax-all.c       | 2 +-
 target/i386/hax/hax-i386.h      | 3 +++
 target/i386/hax/hax-windows.c   | 2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 45e30911e7..476b39e42e 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -338,7 +338,6 @@ struct CPUState {
 
     struct QemuThread *thread;
 #ifdef _WIN32
-    HANDLE hThread;
     QemuSemaphore sem;
 #endif
     int thread_id;
diff --git a/target/i386/hax/hax-accel-ops.c b/target/i386/hax/hax-accel-ops.c
index a8512efcd5..5031096760 100644
--- a/target/i386/hax/hax-accel-ops.c
+++ b/target/i386/hax/hax-accel-ops.c
@@ -73,7 +73,7 @@ static void hax_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
     assert(cpu->accel);
 #ifdef _WIN32
-    cpu->hThread = qemu_thread_get_handle(cpu->thread);
+    cpu->accel->hThread = qemu_thread_get_handle(cpu->thread);
 #endif
 }
 
diff --git a/target/i386/hax/hax-all.c b/target/i386/hax/hax-all.c
index 9d9011cc38..18d78e5b6b 100644
--- a/target/i386/hax/hax-all.c
+++ b/target/i386/hax/hax-all.c
@@ -206,7 +206,7 @@ int hax_vcpu_destroy(CPUState *cpu)
     hax_close_fd(vcpu->fd);
     hax_global.vm->vcpus[vcpu->vcpu_id] = NULL;
 #ifdef _WIN32
-    CloseHandle(cpu->hThread);
+    CloseHandle(vcpu->hThread);
 #endif
     g_free(vcpu);
     cpu->accel = NULL;
diff --git a/target/i386/hax/hax-i386.h b/target/i386/hax/hax-i386.h
index 4372ee596d..87153f40ab 100644
--- a/target/i386/hax/hax-i386.h
+++ b/target/i386/hax/hax-i386.h
@@ -27,6 +27,9 @@ typedef HANDLE hax_fd;
 extern struct hax_state hax_global;
 
 struct AccelCPUState {
+#ifdef _WIN32
+    HANDLE hThread;
+#endif
     hax_fd fd;
     int vcpu_id;
     struct hax_tunnel *tunnel;
diff --git a/target/i386/hax/hax-windows.c b/target/i386/hax/hax-windows.c
index bf4b0ad941..4bf6cc08d2 100644
--- a/target/i386/hax/hax-windows.c
+++ b/target/i386/hax/hax-windows.c
@@ -476,7 +476,7 @@ void hax_kick_vcpu_thread(CPUState *cpu)
      */
     cpu->exit_request = 1;
     if (!qemu_cpu_is_self(cpu)) {
-        if (!QueueUserAPC(dummy_apc_func, cpu->hThread, 0)) {
+        if (!QueueUserAPC(dummy_apc_func, cpu->accel->hThread, 0)) {
             fprintf(stderr, "%s: QueueUserAPC failed with error %lu\n",
                     __func__, GetLastError());
             exit(1);

From 8c12c76df2373b61764c2cacb4a6c505f874fa5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 10:04:07 +0200
Subject: [PATCH 0291/1353] accel: Remove NVMM unreachable error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

g_malloc0() can not fail. Remove the unreachable error path.

https://developer-old.gnome.org/glib/stable/glib-Memory-Allocation.html#glib-Memory-Allocation.description

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-10-philmd@linaro.org>
---
 target/i386/nvmm/nvmm-all.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index b3c3adc59a..90e9e0a5b2 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -943,10 +943,6 @@ nvmm_init_vcpu(CPUState *cpu)
     }
 
     qcpu = g_malloc0(sizeof(*qcpu));
-    if (qcpu == NULL) {
-        error_report("NVMM: Failed to allocate VCPU context.");
-        return -ENOMEM;
-    }
 
     ret = nvmm_vcpu_create(mach, cpu->cpu_index, &qcpu->vcpu);
     if (ret == -1) {

From c5beb26a2f5a641a3c4ef9556f48ae05ea86e30d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 23 Mar 2023 13:38:34 +0100
Subject: [PATCH 0292/1353] accel: Rename NVMM 'struct qemu_vcpu' ->
 AccelCPUState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want all accelerators to share the same opaque pointer in
CPUState. Rename NVMM 'qemu_vcpu' as 'AccelCPUState'; directly
use the typedef, remove unnecessary casts.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230624174121.11508-11-philmd@linaro.org>
---
 target/i386/nvmm/nvmm-all.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 90e9e0a5b2..e5ee4af084 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -26,7 +26,7 @@
 
 #include <nvmm.h>
 
-struct qemu_vcpu {
+struct AccelCPUState {
     struct nvmm_vcpu vcpu;
     uint8_t tpr;
     bool stop;
@@ -49,10 +49,10 @@ struct qemu_machine {
 static bool nvmm_allowed;
 static struct qemu_machine qemu_mach;
 
-static struct qemu_vcpu *
+static AccelCPUState *
 get_qemu_vcpu(CPUState *cpu)
 {
-    return (struct qemu_vcpu *)cpu->accel;
+    return cpu->accel;
 }
 
 static struct nvmm_machine *
@@ -86,7 +86,7 @@ nvmm_set_registers(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     struct nvmm_x64_state *state = vcpu->state;
     uint64_t bitmap;
@@ -223,7 +223,7 @@ nvmm_get_registers(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -347,7 +347,7 @@ static bool
 nvmm_can_take_int(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     struct nvmm_machine *mach = get_nvmm_mach();
 
@@ -372,7 +372,7 @@ nvmm_can_take_int(CPUState *cpu)
 static bool
 nvmm_can_take_nmi(CPUState *cpu)
 {
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
 
     /*
      * Contrary to INTs, NMIs always schedule an exit when they are
@@ -395,7 +395,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -478,7 +478,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 static void
 nvmm_vcpu_post_run(CPUState *cpu, struct nvmm_vcpu_exit *exit)
 {
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     uint64_t tpr;
@@ -565,7 +565,7 @@ static int
 nvmm_handle_rdmsr(struct nvmm_machine *mach, CPUState *cpu,
     struct nvmm_vcpu_exit *exit)
 {
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -610,7 +610,7 @@ static int
 nvmm_handle_wrmsr(struct nvmm_machine *mach, CPUState *cpu,
     struct nvmm_vcpu_exit *exit)
 {
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -686,7 +686,7 @@ nvmm_vcpu_loop(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_vcpu_exit *exit = vcpu->exit;
@@ -892,7 +892,7 @@ static void
 nvmm_ipi_signal(int sigcpu)
 {
     if (current_cpu) {
-        struct qemu_vcpu *qcpu = get_qemu_vcpu(current_cpu);
+        AccelCPUState *qcpu = get_qemu_vcpu(current_cpu);
 #if NVMM_USER_VERSION >= 2
         struct nvmm_vcpu *vcpu = &qcpu->vcpu;
         nvmm_vcpu_stop(vcpu);
@@ -926,7 +926,7 @@ nvmm_init_vcpu(CPUState *cpu)
     struct nvmm_vcpu_conf_cpuid cpuid;
     struct nvmm_vcpu_conf_tpr tpr;
     Error *local_error = NULL;
-    struct qemu_vcpu *qcpu;
+    AccelCPUState *qcpu;
     int ret, err;
 
     nvmm_init_cpu_signals();
@@ -942,7 +942,7 @@ nvmm_init_vcpu(CPUState *cpu)
         }
     }
 
-    qcpu = g_malloc0(sizeof(*qcpu));
+    qcpu = g_new0(AccelCPUState, 1);
 
     ret = nvmm_vcpu_create(mach, cpu->cpu_index, &qcpu->vcpu);
     if (ret == -1) {
@@ -1023,7 +1023,7 @@ void
 nvmm_destroy_vcpu(CPUState *cpu)
 {
     struct nvmm_machine *mach = get_nvmm_mach();
-    struct qemu_vcpu *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
 
     nvmm_vcpu_destroy(mach, &qcpu->vcpu);
     g_free(cpu->accel);

From 2f642b1c2cfa32a1d5af6cbe66c16b5d1c5fd69c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 23 Mar 2023 13:39:26 +0100
Subject: [PATCH 0293/1353] accel: Inline NVMM get_qemu_vcpu()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for this helper to access the CPUState::accel field.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230624174121.11508-12-philmd@linaro.org>
---
 target/i386/nvmm/nvmm-all.c | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index e5ee4af084..72a3a9e3ae 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -49,12 +49,6 @@ struct qemu_machine {
 static bool nvmm_allowed;
 static struct qemu_machine qemu_mach;
 
-static AccelCPUState *
-get_qemu_vcpu(CPUState *cpu)
-{
-    return cpu->accel;
-}
-
 static struct nvmm_machine *
 get_nvmm_mach(void)
 {
@@ -86,7 +80,7 @@ nvmm_set_registers(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     struct nvmm_x64_state *state = vcpu->state;
     uint64_t bitmap;
@@ -223,7 +217,7 @@ nvmm_get_registers(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -347,7 +341,7 @@ static bool
 nvmm_can_take_int(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     struct nvmm_machine *mach = get_nvmm_mach();
 
@@ -372,7 +366,7 @@ nvmm_can_take_int(CPUState *cpu)
 static bool
 nvmm_can_take_nmi(CPUState *cpu)
 {
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
 
     /*
      * Contrary to INTs, NMIs always schedule an exit when they are
@@ -395,7 +389,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -478,7 +472,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 static void
 nvmm_vcpu_post_run(CPUState *cpu, struct nvmm_vcpu_exit *exit)
 {
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     uint64_t tpr;
@@ -565,7 +559,7 @@ static int
 nvmm_handle_rdmsr(struct nvmm_machine *mach, CPUState *cpu,
     struct nvmm_vcpu_exit *exit)
 {
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -610,7 +604,7 @@ static int
 nvmm_handle_wrmsr(struct nvmm_machine *mach, CPUState *cpu,
     struct nvmm_vcpu_exit *exit)
 {
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_x64_state *state = vcpu->state;
@@ -686,7 +680,7 @@ nvmm_vcpu_loop(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     struct nvmm_machine *mach = get_nvmm_mach();
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
     struct nvmm_vcpu *vcpu = &qcpu->vcpu;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct nvmm_vcpu_exit *exit = vcpu->exit;
@@ -892,7 +886,7 @@ static void
 nvmm_ipi_signal(int sigcpu)
 {
     if (current_cpu) {
-        AccelCPUState *qcpu = get_qemu_vcpu(current_cpu);
+        AccelCPUState *qcpu = current_cpu->accel;
 #if NVMM_USER_VERSION >= 2
         struct nvmm_vcpu *vcpu = &qcpu->vcpu;
         nvmm_vcpu_stop(vcpu);
@@ -1023,7 +1017,7 @@ void
 nvmm_destroy_vcpu(CPUState *cpu)
 {
     struct nvmm_machine *mach = get_nvmm_mach();
-    AccelCPUState *qcpu = get_qemu_vcpu(cpu);
+    AccelCPUState *qcpu = cpu->accel;
 
     nvmm_vcpu_destroy(mach, &qcpu->vcpu);
     g_free(cpu->accel);

From 50830fea89ceefefd455d2489c4f8914df2d68ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 21 Jun 2023 15:52:51 +0200
Subject: [PATCH 0294/1353] accel: Remove WHPX unreachable error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

g_new0() can not fail. Remove the unreachable error path.

https://developer-old.gnome.org/glib/stable/glib-Memory-Allocation.html#glib-Memory-Allocation.description

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-13-philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 7fc8d4ffe5..63be5fbdad 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2179,12 +2179,6 @@ int whpx_init_vcpu(CPUState *cpu)
 
     vcpu = g_new0(struct whpx_vcpu, 1);
 
-    if (!vcpu) {
-        error_report("WHPX: Failed to allocte VCPU context.");
-        ret = -ENOMEM;
-        goto error;
-    }
-
     hr = whp_dispatch.WHvEmulatorCreateEmulator(
         &whpx_emu_callbacks,
         &vcpu->emulator);

From b4f879a4ed039f73f61ee9ae7142abd84cdc0f27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 23 Mar 2023 13:43:54 +0100
Subject: [PATCH 0295/1353] accel: Rename WHPX 'struct whpx_vcpu' ->
 AccelCPUState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want all accelerators to share the same opaque pointer in
CPUState. Rename WHPX 'whpx_vcpu' as 'AccelCPUState'; use
the typedef.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230624174121.11508-14-philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 63be5fbdad..185f2a2820 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -229,7 +229,7 @@ typedef enum WhpxStepMode {
     WHPX_STEP_EXCLUSIVE,
 } WhpxStepMode;
 
-struct whpx_vcpu {
+struct AccelCPUState {
     WHV_EMULATOR_HANDLE emulator;
     bool window_registered;
     bool interruptable;
@@ -260,9 +260,9 @@ static bool whpx_has_xsave(void)
  * VP support
  */
 
-static struct whpx_vcpu *get_whpx_vcpu(CPUState *cpu)
+static AccelCPUState *get_whpx_vcpu(CPUState *cpu)
 {
-    return (struct whpx_vcpu *)cpu->accel;
+    return (AccelCPUState *)cpu->accel;
 }
 
 static WHV_X64_SEGMENT_REGISTER whpx_seg_q2h(const SegmentCache *qs, int v86,
@@ -390,7 +390,7 @@ static uint64_t whpx_cr8_to_apic_tpr(uint64_t cr8)
 static void whpx_set_registers(CPUState *cpu, int level)
 {
     struct whpx_state *whpx = &whpx_global;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct whpx_register_set vcxt;
@@ -609,7 +609,7 @@ static void whpx_get_xcrs(CPUState *cpu)
 static void whpx_get_registers(CPUState *cpu)
 {
     struct whpx_state *whpx = &whpx_global;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct whpx_register_set vcxt;
@@ -892,7 +892,7 @@ static const WHV_EMULATOR_CALLBACKS whpx_emu_callbacks = {
 static int whpx_handle_mmio(CPUState *cpu, WHV_MEMORY_ACCESS_CONTEXT *ctx)
 {
     HRESULT hr;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     WHV_EMULATOR_STATUS emu_status;
 
     hr = whp_dispatch.WHvEmulatorTryMmioEmulation(
@@ -917,7 +917,7 @@ static int whpx_handle_portio(CPUState *cpu,
                               WHV_X64_IO_PORT_ACCESS_CONTEXT *ctx)
 {
     HRESULT hr;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     WHV_EMULATOR_STATUS emu_status;
 
     hr = whp_dispatch.WHvEmulatorTryIoEmulation(
@@ -1417,7 +1417,7 @@ static vaddr whpx_vcpu_get_pc(CPUState *cpu, bool exit_context_valid)
          * of QEMU, nor this port by calling WHvSetVirtualProcessorRegisters().
          * This is the most common case.
          */
-        struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+        AccelCPUState *vcpu = get_whpx_vcpu(cpu);
         return vcpu->exit_ctx.VpContext.Rip;
     } else {
         /*
@@ -1468,7 +1468,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
 {
     HRESULT hr;
     struct whpx_state *whpx = &whpx_global;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     int irq;
@@ -1590,7 +1590,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
 
 static void whpx_vcpu_post_run(CPUState *cpu)
 {
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
 
@@ -1617,7 +1617,7 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
 
     if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
         !(env->hflags & HF_SMM_MASK)) {
@@ -1656,7 +1656,7 @@ static int whpx_vcpu_run(CPUState *cpu)
 {
     HRESULT hr;
     struct whpx_state *whpx = &whpx_global;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
     struct whpx_breakpoint *stepped_over_bp = NULL;
     WhpxStepMode exclusive_step_mode = WHPX_STEP_NONE;
     int ret;
@@ -2154,7 +2154,7 @@ int whpx_init_vcpu(CPUState *cpu)
 {
     HRESULT hr;
     struct whpx_state *whpx = &whpx_global;
-    struct whpx_vcpu *vcpu = NULL;
+    AccelCPUState *vcpu = NULL;
     Error *local_error = NULL;
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
@@ -2177,7 +2177,7 @@ int whpx_init_vcpu(CPUState *cpu)
         }
     }
 
-    vcpu = g_new0(struct whpx_vcpu, 1);
+    vcpu = g_new0(AccelCPUState, 1);
 
     hr = whp_dispatch.WHvEmulatorCreateEmulator(
         &whpx_emu_callbacks,
@@ -2290,7 +2290,7 @@ int whpx_vcpu_exec(CPUState *cpu)
 void whpx_destroy_vcpu(CPUState *cpu)
 {
     struct whpx_state *whpx = &whpx_global;
-    struct whpx_vcpu *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
 
     whp_dispatch.WHvDeleteVirtualProcessor(whpx->partition, cpu->cpu_index);
     whp_dispatch.WHvEmulatorDestroyEmulator(vcpu->emulator);

From 441f2449111b276df7fad81dcaa2f3f93ac7cce8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 21 Jun 2023 16:03:17 +0200
Subject: [PATCH 0296/1353] accel: Inline WHPX get_whpx_vcpu()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need for this helper to access the CPUState::accel field.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230624174121.11508-15-philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 185f2a2820..9ee04ee650 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -256,15 +256,6 @@ static bool whpx_has_xsave(void)
     return whpx_xsave_cap.XsaveSupport;
 }
 
-/*
- * VP support
- */
-
-static AccelCPUState *get_whpx_vcpu(CPUState *cpu)
-{
-    return (AccelCPUState *)cpu->accel;
-}
-
 static WHV_X64_SEGMENT_REGISTER whpx_seg_q2h(const SegmentCache *qs, int v86,
                                              int r86)
 {
@@ -390,7 +381,7 @@ static uint64_t whpx_cr8_to_apic_tpr(uint64_t cr8)
 static void whpx_set_registers(CPUState *cpu, int level)
 {
     struct whpx_state *whpx = &whpx_global;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct whpx_register_set vcxt;
@@ -609,7 +600,7 @@ static void whpx_get_xcrs(CPUState *cpu)
 static void whpx_get_registers(CPUState *cpu)
 {
     struct whpx_state *whpx = &whpx_global;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     struct whpx_register_set vcxt;
@@ -892,7 +883,7 @@ static const WHV_EMULATOR_CALLBACKS whpx_emu_callbacks = {
 static int whpx_handle_mmio(CPUState *cpu, WHV_MEMORY_ACCESS_CONTEXT *ctx)
 {
     HRESULT hr;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     WHV_EMULATOR_STATUS emu_status;
 
     hr = whp_dispatch.WHvEmulatorTryMmioEmulation(
@@ -917,7 +908,7 @@ static int whpx_handle_portio(CPUState *cpu,
                               WHV_X64_IO_PORT_ACCESS_CONTEXT *ctx)
 {
     HRESULT hr;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     WHV_EMULATOR_STATUS emu_status;
 
     hr = whp_dispatch.WHvEmulatorTryIoEmulation(
@@ -1417,7 +1408,7 @@ static vaddr whpx_vcpu_get_pc(CPUState *cpu, bool exit_context_valid)
          * of QEMU, nor this port by calling WHvSetVirtualProcessorRegisters().
          * This is the most common case.
          */
-        AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+        AccelCPUState *vcpu = cpu->accel;
         return vcpu->exit_ctx.VpContext.Rip;
     } else {
         /*
@@ -1468,7 +1459,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
 {
     HRESULT hr;
     struct whpx_state *whpx = &whpx_global;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
     int irq;
@@ -1590,7 +1581,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
 
 static void whpx_vcpu_post_run(CPUState *cpu)
 {
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
 
@@ -1617,7 +1608,7 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
 {
     CPUX86State *env = cpu->env_ptr;
     X86CPU *x86_cpu = X86_CPU(cpu);
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
 
     if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
         !(env->hflags & HF_SMM_MASK)) {
@@ -1656,7 +1647,7 @@ static int whpx_vcpu_run(CPUState *cpu)
 {
     HRESULT hr;
     struct whpx_state *whpx = &whpx_global;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
     struct whpx_breakpoint *stepped_over_bp = NULL;
     WhpxStepMode exclusive_step_mode = WHPX_STEP_NONE;
     int ret;
@@ -2290,7 +2281,7 @@ int whpx_vcpu_exec(CPUState *cpu)
 void whpx_destroy_vcpu(CPUState *cpu)
 {
     struct whpx_state *whpx = &whpx_global;
-    AccelCPUState *vcpu = get_whpx_vcpu(cpu);
+    AccelCPUState *vcpu = cpu->accel;
 
     whp_dispatch.WHvDeleteVirtualProcessor(whpx->partition, cpu->cpu_index);
     whp_dispatch.WHvEmulatorDestroyEmulator(vcpu->emulator);

From a7159244285058c049ad53a42b3dc7b24809faaa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 21 Jun 2023 13:14:06 +0200
Subject: [PATCH 0297/1353] accel: Rename 'cpu_state' -> 'cs'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most of the codebase uses 'CPUState *cpu' or 'CPUState *cs'.
While 'cpu_state' is kind of explicit, it makes the code
harder to review. Simply rename as 'cs'.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230624174121.11508-16-philmd@linaro.org>
---
 target/i386/hvf/x86hvf.c | 372 +++++++++++++++++++--------------------
 target/i386/hvf/x86hvf.h |  18 +-
 2 files changed, 195 insertions(+), 195 deletions(-)

diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 69d4fb8cf5..92dfd26a01 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -32,14 +32,14 @@
 #include <Hypervisor/hv.h>
 #include <Hypervisor/hv_vmx.h>
 
-void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
+void hvf_set_segment(CPUState *cs, struct vmx_segment *vmx_seg,
                      SegmentCache *qseg, bool is_tr)
 {
     vmx_seg->sel = qseg->selector;
     vmx_seg->base = qseg->base;
     vmx_seg->limit = qseg->limit;
 
-    if (!qseg->selector && !x86_is_real(cpu) && !is_tr) {
+    if (!qseg->selector && !x86_is_real(cs) && !is_tr) {
         /* the TR register is usable after processor reset despite
          * having a null selector */
         vmx_seg->ar = 1 << 16;
@@ -70,279 +70,279 @@ void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg)
                   (((vmx_seg->ar >> 15) & 1) << DESC_G_SHIFT);
 }
 
-void hvf_put_xsave(CPUState *cpu_state)
+void hvf_put_xsave(CPUState *cs)
 {
-    void *xsave = X86_CPU(cpu_state)->env.xsave_buf;
-    uint32_t xsave_len = X86_CPU(cpu_state)->env.xsave_buf_len;
+    void *xsave = X86_CPU(cs)->env.xsave_buf;
+    uint32_t xsave_len = X86_CPU(cs)->env.xsave_buf_len;
 
-    x86_cpu_xsave_all_areas(X86_CPU(cpu_state), xsave, xsave_len);
+    x86_cpu_xsave_all_areas(X86_CPU(cs), xsave, xsave_len);
 
-    if (hv_vcpu_write_fpstate(cpu_state->hvf->fd, xsave, xsave_len)) {
+    if (hv_vcpu_write_fpstate(cs->hvf->fd, xsave, xsave_len)) {
         abort();
     }
 }
 
-static void hvf_put_segments(CPUState *cpu_state)
+static void hvf_put_segments(CPUState *cs)
 {
-    CPUX86State *env = &X86_CPU(cpu_state)->env;
+    CPUX86State *env = &X86_CPU(cs)->env;
     struct vmx_segment seg;
     
-    wvmcs(cpu_state->hvf->fd, VMCS_GUEST_IDTR_LIMIT, env->idt.limit);
-    wvmcs(cpu_state->hvf->fd, VMCS_GUEST_IDTR_BASE, env->idt.base);
+    wvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_LIMIT, env->idt.limit);
+    wvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_BASE, env->idt.base);
 
-    wvmcs(cpu_state->hvf->fd, VMCS_GUEST_GDTR_LIMIT, env->gdt.limit);
-    wvmcs(cpu_state->hvf->fd, VMCS_GUEST_GDTR_BASE, env->gdt.base);
+    wvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_LIMIT, env->gdt.limit);
+    wvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_BASE, env->gdt.base);
 
-    /* wvmcs(cpu_state->hvf->fd, VMCS_GUEST_CR2, env->cr[2]); */
-    wvmcs(cpu_state->hvf->fd, VMCS_GUEST_CR3, env->cr[3]);
-    vmx_update_tpr(cpu_state);
-    wvmcs(cpu_state->hvf->fd, VMCS_GUEST_IA32_EFER, env->efer);
+    /* wvmcs(cs->hvf->fd, VMCS_GUEST_CR2, env->cr[2]); */
+    wvmcs(cs->hvf->fd, VMCS_GUEST_CR3, env->cr[3]);
+    vmx_update_tpr(cs);
+    wvmcs(cs->hvf->fd, VMCS_GUEST_IA32_EFER, env->efer);
 
-    macvm_set_cr4(cpu_state->hvf->fd, env->cr[4]);
-    macvm_set_cr0(cpu_state->hvf->fd, env->cr[0]);
+    macvm_set_cr4(cs->hvf->fd, env->cr[4]);
+    macvm_set_cr0(cs->hvf->fd, env->cr[0]);
 
-    hvf_set_segment(cpu_state, &seg, &env->segs[R_CS], false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_CS);
+    hvf_set_segment(cs, &seg, &env->segs[R_CS], false);
+    vmx_write_segment_descriptor(cs, &seg, R_CS);
     
-    hvf_set_segment(cpu_state, &seg, &env->segs[R_DS], false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_DS);
+    hvf_set_segment(cs, &seg, &env->segs[R_DS], false);
+    vmx_write_segment_descriptor(cs, &seg, R_DS);
 
-    hvf_set_segment(cpu_state, &seg, &env->segs[R_ES], false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_ES);
+    hvf_set_segment(cs, &seg, &env->segs[R_ES], false);
+    vmx_write_segment_descriptor(cs, &seg, R_ES);
 
-    hvf_set_segment(cpu_state, &seg, &env->segs[R_SS], false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_SS);
+    hvf_set_segment(cs, &seg, &env->segs[R_SS], false);
+    vmx_write_segment_descriptor(cs, &seg, R_SS);
 
-    hvf_set_segment(cpu_state, &seg, &env->segs[R_FS], false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_FS);
+    hvf_set_segment(cs, &seg, &env->segs[R_FS], false);
+    vmx_write_segment_descriptor(cs, &seg, R_FS);
 
-    hvf_set_segment(cpu_state, &seg, &env->segs[R_GS], false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_GS);
+    hvf_set_segment(cs, &seg, &env->segs[R_GS], false);
+    vmx_write_segment_descriptor(cs, &seg, R_GS);
 
-    hvf_set_segment(cpu_state, &seg, &env->tr, true);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_TR);
+    hvf_set_segment(cs, &seg, &env->tr, true);
+    vmx_write_segment_descriptor(cs, &seg, R_TR);
 
-    hvf_set_segment(cpu_state, &seg, &env->ldt, false);
-    vmx_write_segment_descriptor(cpu_state, &seg, R_LDTR);
+    hvf_set_segment(cs, &seg, &env->ldt, false);
+    vmx_write_segment_descriptor(cs, &seg, R_LDTR);
 }
     
-void hvf_put_msrs(CPUState *cpu_state)
+void hvf_put_msrs(CPUState *cs)
 {
-    CPUX86State *env = &X86_CPU(cpu_state)->env;
+    CPUX86State *env = &X86_CPU(cs)->env;
 
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_IA32_SYSENTER_CS,
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_IA32_SYSENTER_CS,
                       env->sysenter_cs);
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_IA32_SYSENTER_ESP,
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_IA32_SYSENTER_ESP,
                       env->sysenter_esp);
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_IA32_SYSENTER_EIP,
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_IA32_SYSENTER_EIP,
                       env->sysenter_eip);
 
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_STAR, env->star);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_STAR, env->star);
 
 #ifdef TARGET_X86_64
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_CSTAR, env->cstar);
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_KERNELGSBASE, env->kernelgsbase);
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_FMASK, env->fmask);
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_LSTAR, env->lstar);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_CSTAR, env->cstar);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_KERNELGSBASE, env->kernelgsbase);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_FMASK, env->fmask);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_LSTAR, env->lstar);
 #endif
 
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_GSBASE, env->segs[R_GS].base);
-    hv_vcpu_write_msr(cpu_state->hvf->fd, MSR_FSBASE, env->segs[R_FS].base);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_GSBASE, env->segs[R_GS].base);
+    hv_vcpu_write_msr(cs->hvf->fd, MSR_FSBASE, env->segs[R_FS].base);
 }
 
 
-void hvf_get_xsave(CPUState *cpu_state)
+void hvf_get_xsave(CPUState *cs)
 {
-    void *xsave = X86_CPU(cpu_state)->env.xsave_buf;
-    uint32_t xsave_len = X86_CPU(cpu_state)->env.xsave_buf_len;
+    void *xsave = X86_CPU(cs)->env.xsave_buf;
+    uint32_t xsave_len = X86_CPU(cs)->env.xsave_buf_len;
 
-    if (hv_vcpu_read_fpstate(cpu_state->hvf->fd, xsave, xsave_len)) {
+    if (hv_vcpu_read_fpstate(cs->hvf->fd, xsave, xsave_len)) {
         abort();
     }
 
-    x86_cpu_xrstor_all_areas(X86_CPU(cpu_state), xsave, xsave_len);
+    x86_cpu_xrstor_all_areas(X86_CPU(cs), xsave, xsave_len);
 }
 
-static void hvf_get_segments(CPUState *cpu_state)
+static void hvf_get_segments(CPUState *cs)
 {
-    CPUX86State *env = &X86_CPU(cpu_state)->env;
+    CPUX86State *env = &X86_CPU(cs)->env;
 
     struct vmx_segment seg;
 
     env->interrupt_injected = -1;
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_CS);
+    vmx_read_segment_descriptor(cs, &seg, R_CS);
     hvf_get_segment(&env->segs[R_CS], &seg);
     
-    vmx_read_segment_descriptor(cpu_state, &seg, R_DS);
+    vmx_read_segment_descriptor(cs, &seg, R_DS);
     hvf_get_segment(&env->segs[R_DS], &seg);
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_ES);
+    vmx_read_segment_descriptor(cs, &seg, R_ES);
     hvf_get_segment(&env->segs[R_ES], &seg);
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_FS);
+    vmx_read_segment_descriptor(cs, &seg, R_FS);
     hvf_get_segment(&env->segs[R_FS], &seg);
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_GS);
+    vmx_read_segment_descriptor(cs, &seg, R_GS);
     hvf_get_segment(&env->segs[R_GS], &seg);
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_SS);
+    vmx_read_segment_descriptor(cs, &seg, R_SS);
     hvf_get_segment(&env->segs[R_SS], &seg);
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_TR);
+    vmx_read_segment_descriptor(cs, &seg, R_TR);
     hvf_get_segment(&env->tr, &seg);
 
-    vmx_read_segment_descriptor(cpu_state, &seg, R_LDTR);
+    vmx_read_segment_descriptor(cs, &seg, R_LDTR);
     hvf_get_segment(&env->ldt, &seg);
 
-    env->idt.limit = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_IDTR_LIMIT);
-    env->idt.base = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_IDTR_BASE);
-    env->gdt.limit = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_GDTR_LIMIT);
-    env->gdt.base = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_GDTR_BASE);
+    env->idt.limit = rvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_LIMIT);
+    env->idt.base = rvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_BASE);
+    env->gdt.limit = rvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_LIMIT);
+    env->gdt.base = rvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_BASE);
 
-    env->cr[0] = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_CR0);
+    env->cr[0] = rvmcs(cs->hvf->fd, VMCS_GUEST_CR0);
     env->cr[2] = 0;
-    env->cr[3] = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_CR3);
-    env->cr[4] = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_CR4);
+    env->cr[3] = rvmcs(cs->hvf->fd, VMCS_GUEST_CR3);
+    env->cr[4] = rvmcs(cs->hvf->fd, VMCS_GUEST_CR4);
     
-    env->efer = rvmcs(cpu_state->hvf->fd, VMCS_GUEST_IA32_EFER);
+    env->efer = rvmcs(cs->hvf->fd, VMCS_GUEST_IA32_EFER);
 }
 
-void hvf_get_msrs(CPUState *cpu_state)
+void hvf_get_msrs(CPUState *cs)
 {
-    CPUX86State *env = &X86_CPU(cpu_state)->env;
+    CPUX86State *env = &X86_CPU(cs)->env;
     uint64_t tmp;
     
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_IA32_SYSENTER_CS, &tmp);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_SYSENTER_CS, &tmp);
     env->sysenter_cs = tmp;
     
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_IA32_SYSENTER_ESP, &tmp);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_SYSENTER_ESP, &tmp);
     env->sysenter_esp = tmp;
 
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_IA32_SYSENTER_EIP, &tmp);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_SYSENTER_EIP, &tmp);
     env->sysenter_eip = tmp;
 
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_STAR, &env->star);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_STAR, &env->star);
 
 #ifdef TARGET_X86_64
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_CSTAR, &env->cstar);
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_KERNELGSBASE, &env->kernelgsbase);
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_FMASK, &env->fmask);
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_LSTAR, &env->lstar);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_CSTAR, &env->cstar);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_KERNELGSBASE, &env->kernelgsbase);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_FMASK, &env->fmask);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_LSTAR, &env->lstar);
 #endif
 
-    hv_vcpu_read_msr(cpu_state->hvf->fd, MSR_IA32_APICBASE, &tmp);
+    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_APICBASE, &tmp);
     
-    env->tsc = rdtscp() + rvmcs(cpu_state->hvf->fd, VMCS_TSC_OFFSET);
+    env->tsc = rdtscp() + rvmcs(cs->hvf->fd, VMCS_TSC_OFFSET);
 }
 
-int hvf_put_registers(CPUState *cpu_state)
+int hvf_put_registers(CPUState *cs)
 {
-    X86CPU *x86cpu = X86_CPU(cpu_state);
+    X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;
 
-    wreg(cpu_state->hvf->fd, HV_X86_RAX, env->regs[R_EAX]);
-    wreg(cpu_state->hvf->fd, HV_X86_RBX, env->regs[R_EBX]);
-    wreg(cpu_state->hvf->fd, HV_X86_RCX, env->regs[R_ECX]);
-    wreg(cpu_state->hvf->fd, HV_X86_RDX, env->regs[R_EDX]);
-    wreg(cpu_state->hvf->fd, HV_X86_RBP, env->regs[R_EBP]);
-    wreg(cpu_state->hvf->fd, HV_X86_RSP, env->regs[R_ESP]);
-    wreg(cpu_state->hvf->fd, HV_X86_RSI, env->regs[R_ESI]);
-    wreg(cpu_state->hvf->fd, HV_X86_RDI, env->regs[R_EDI]);
-    wreg(cpu_state->hvf->fd, HV_X86_R8, env->regs[8]);
-    wreg(cpu_state->hvf->fd, HV_X86_R9, env->regs[9]);
-    wreg(cpu_state->hvf->fd, HV_X86_R10, env->regs[10]);
-    wreg(cpu_state->hvf->fd, HV_X86_R11, env->regs[11]);
-    wreg(cpu_state->hvf->fd, HV_X86_R12, env->regs[12]);
-    wreg(cpu_state->hvf->fd, HV_X86_R13, env->regs[13]);
-    wreg(cpu_state->hvf->fd, HV_X86_R14, env->regs[14]);
-    wreg(cpu_state->hvf->fd, HV_X86_R15, env->regs[15]);
-    wreg(cpu_state->hvf->fd, HV_X86_RFLAGS, env->eflags);
-    wreg(cpu_state->hvf->fd, HV_X86_RIP, env->eip);
+    wreg(cs->hvf->fd, HV_X86_RAX, env->regs[R_EAX]);
+    wreg(cs->hvf->fd, HV_X86_RBX, env->regs[R_EBX]);
+    wreg(cs->hvf->fd, HV_X86_RCX, env->regs[R_ECX]);
+    wreg(cs->hvf->fd, HV_X86_RDX, env->regs[R_EDX]);
+    wreg(cs->hvf->fd, HV_X86_RBP, env->regs[R_EBP]);
+    wreg(cs->hvf->fd, HV_X86_RSP, env->regs[R_ESP]);
+    wreg(cs->hvf->fd, HV_X86_RSI, env->regs[R_ESI]);
+    wreg(cs->hvf->fd, HV_X86_RDI, env->regs[R_EDI]);
+    wreg(cs->hvf->fd, HV_X86_R8, env->regs[8]);
+    wreg(cs->hvf->fd, HV_X86_R9, env->regs[9]);
+    wreg(cs->hvf->fd, HV_X86_R10, env->regs[10]);
+    wreg(cs->hvf->fd, HV_X86_R11, env->regs[11]);
+    wreg(cs->hvf->fd, HV_X86_R12, env->regs[12]);
+    wreg(cs->hvf->fd, HV_X86_R13, env->regs[13]);
+    wreg(cs->hvf->fd, HV_X86_R14, env->regs[14]);
+    wreg(cs->hvf->fd, HV_X86_R15, env->regs[15]);
+    wreg(cs->hvf->fd, HV_X86_RFLAGS, env->eflags);
+    wreg(cs->hvf->fd, HV_X86_RIP, env->eip);
    
-    wreg(cpu_state->hvf->fd, HV_X86_XCR0, env->xcr0);
+    wreg(cs->hvf->fd, HV_X86_XCR0, env->xcr0);
     
-    hvf_put_xsave(cpu_state);
+    hvf_put_xsave(cs);
     
-    hvf_put_segments(cpu_state);
+    hvf_put_segments(cs);
     
-    hvf_put_msrs(cpu_state);
+    hvf_put_msrs(cs);
     
-    wreg(cpu_state->hvf->fd, HV_X86_DR0, env->dr[0]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR1, env->dr[1]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR2, env->dr[2]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR3, env->dr[3]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR4, env->dr[4]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR5, env->dr[5]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR6, env->dr[6]);
-    wreg(cpu_state->hvf->fd, HV_X86_DR7, env->dr[7]);
+    wreg(cs->hvf->fd, HV_X86_DR0, env->dr[0]);
+    wreg(cs->hvf->fd, HV_X86_DR1, env->dr[1]);
+    wreg(cs->hvf->fd, HV_X86_DR2, env->dr[2]);
+    wreg(cs->hvf->fd, HV_X86_DR3, env->dr[3]);
+    wreg(cs->hvf->fd, HV_X86_DR4, env->dr[4]);
+    wreg(cs->hvf->fd, HV_X86_DR5, env->dr[5]);
+    wreg(cs->hvf->fd, HV_X86_DR6, env->dr[6]);
+    wreg(cs->hvf->fd, HV_X86_DR7, env->dr[7]);
     
     return 0;
 }
 
-int hvf_get_registers(CPUState *cpu_state)
+int hvf_get_registers(CPUState *cs)
 {
-    X86CPU *x86cpu = X86_CPU(cpu_state);
+    X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;
 
-    env->regs[R_EAX] = rreg(cpu_state->hvf->fd, HV_X86_RAX);
-    env->regs[R_EBX] = rreg(cpu_state->hvf->fd, HV_X86_RBX);
-    env->regs[R_ECX] = rreg(cpu_state->hvf->fd, HV_X86_RCX);
-    env->regs[R_EDX] = rreg(cpu_state->hvf->fd, HV_X86_RDX);
-    env->regs[R_EBP] = rreg(cpu_state->hvf->fd, HV_X86_RBP);
-    env->regs[R_ESP] = rreg(cpu_state->hvf->fd, HV_X86_RSP);
-    env->regs[R_ESI] = rreg(cpu_state->hvf->fd, HV_X86_RSI);
-    env->regs[R_EDI] = rreg(cpu_state->hvf->fd, HV_X86_RDI);
-    env->regs[8] = rreg(cpu_state->hvf->fd, HV_X86_R8);
-    env->regs[9] = rreg(cpu_state->hvf->fd, HV_X86_R9);
-    env->regs[10] = rreg(cpu_state->hvf->fd, HV_X86_R10);
-    env->regs[11] = rreg(cpu_state->hvf->fd, HV_X86_R11);
-    env->regs[12] = rreg(cpu_state->hvf->fd, HV_X86_R12);
-    env->regs[13] = rreg(cpu_state->hvf->fd, HV_X86_R13);
-    env->regs[14] = rreg(cpu_state->hvf->fd, HV_X86_R14);
-    env->regs[15] = rreg(cpu_state->hvf->fd, HV_X86_R15);
+    env->regs[R_EAX] = rreg(cs->hvf->fd, HV_X86_RAX);
+    env->regs[R_EBX] = rreg(cs->hvf->fd, HV_X86_RBX);
+    env->regs[R_ECX] = rreg(cs->hvf->fd, HV_X86_RCX);
+    env->regs[R_EDX] = rreg(cs->hvf->fd, HV_X86_RDX);
+    env->regs[R_EBP] = rreg(cs->hvf->fd, HV_X86_RBP);
+    env->regs[R_ESP] = rreg(cs->hvf->fd, HV_X86_RSP);
+    env->regs[R_ESI] = rreg(cs->hvf->fd, HV_X86_RSI);
+    env->regs[R_EDI] = rreg(cs->hvf->fd, HV_X86_RDI);
+    env->regs[8] = rreg(cs->hvf->fd, HV_X86_R8);
+    env->regs[9] = rreg(cs->hvf->fd, HV_X86_R9);
+    env->regs[10] = rreg(cs->hvf->fd, HV_X86_R10);
+    env->regs[11] = rreg(cs->hvf->fd, HV_X86_R11);
+    env->regs[12] = rreg(cs->hvf->fd, HV_X86_R12);
+    env->regs[13] = rreg(cs->hvf->fd, HV_X86_R13);
+    env->regs[14] = rreg(cs->hvf->fd, HV_X86_R14);
+    env->regs[15] = rreg(cs->hvf->fd, HV_X86_R15);
     
-    env->eflags = rreg(cpu_state->hvf->fd, HV_X86_RFLAGS);
-    env->eip = rreg(cpu_state->hvf->fd, HV_X86_RIP);
+    env->eflags = rreg(cs->hvf->fd, HV_X86_RFLAGS);
+    env->eip = rreg(cs->hvf->fd, HV_X86_RIP);
    
-    hvf_get_xsave(cpu_state);
-    env->xcr0 = rreg(cpu_state->hvf->fd, HV_X86_XCR0);
+    hvf_get_xsave(cs);
+    env->xcr0 = rreg(cs->hvf->fd, HV_X86_XCR0);
     
-    hvf_get_segments(cpu_state);
-    hvf_get_msrs(cpu_state);
+    hvf_get_segments(cs);
+    hvf_get_msrs(cs);
     
-    env->dr[0] = rreg(cpu_state->hvf->fd, HV_X86_DR0);
-    env->dr[1] = rreg(cpu_state->hvf->fd, HV_X86_DR1);
-    env->dr[2] = rreg(cpu_state->hvf->fd, HV_X86_DR2);
-    env->dr[3] = rreg(cpu_state->hvf->fd, HV_X86_DR3);
-    env->dr[4] = rreg(cpu_state->hvf->fd, HV_X86_DR4);
-    env->dr[5] = rreg(cpu_state->hvf->fd, HV_X86_DR5);
-    env->dr[6] = rreg(cpu_state->hvf->fd, HV_X86_DR6);
-    env->dr[7] = rreg(cpu_state->hvf->fd, HV_X86_DR7);
+    env->dr[0] = rreg(cs->hvf->fd, HV_X86_DR0);
+    env->dr[1] = rreg(cs->hvf->fd, HV_X86_DR1);
+    env->dr[2] = rreg(cs->hvf->fd, HV_X86_DR2);
+    env->dr[3] = rreg(cs->hvf->fd, HV_X86_DR3);
+    env->dr[4] = rreg(cs->hvf->fd, HV_X86_DR4);
+    env->dr[5] = rreg(cs->hvf->fd, HV_X86_DR5);
+    env->dr[6] = rreg(cs->hvf->fd, HV_X86_DR6);
+    env->dr[7] = rreg(cs->hvf->fd, HV_X86_DR7);
     
     x86_update_hflags(env);
     return 0;
 }
 
-static void vmx_set_int_window_exiting(CPUState *cpu)
+static void vmx_set_int_window_exiting(CPUState *cs)
 {
      uint64_t val;
-     val = rvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
-     wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val |
+     val = rvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
+     wvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val |
              VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING);
 }
 
-void vmx_clear_int_window_exiting(CPUState *cpu)
+void vmx_clear_int_window_exiting(CPUState *cs)
 {
      uint64_t val;
-     val = rvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
-     wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val &
+     val = rvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
+     wvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val &
              ~VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING);
 }
 
-bool hvf_inject_interrupts(CPUState *cpu_state)
+bool hvf_inject_interrupts(CPUState *cs)
 {
-    X86CPU *x86cpu = X86_CPU(cpu_state);
+    X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;
 
     uint8_t vector;
@@ -372,89 +372,89 @@ bool hvf_inject_interrupts(CPUState *cpu_state)
     uint64_t info = 0;
     if (have_event) {
         info = vector | intr_type | VMCS_INTR_VALID;
-        uint64_t reason = rvmcs(cpu_state->hvf->fd, VMCS_EXIT_REASON);
+        uint64_t reason = rvmcs(cs->hvf->fd, VMCS_EXIT_REASON);
         if (env->nmi_injected && reason != EXIT_REASON_TASK_SWITCH) {
-            vmx_clear_nmi_blocking(cpu_state);
+            vmx_clear_nmi_blocking(cs);
         }
 
         if (!(env->hflags2 & HF2_NMI_MASK) || intr_type != VMCS_INTR_T_NMI) {
             info &= ~(1 << 12); /* clear undefined bit */
             if (intr_type == VMCS_INTR_T_SWINTR ||
                 intr_type == VMCS_INTR_T_SWEXCEPTION) {
-                wvmcs(cpu_state->hvf->fd, VMCS_ENTRY_INST_LENGTH, env->ins_len);
+                wvmcs(cs->hvf->fd, VMCS_ENTRY_INST_LENGTH, env->ins_len);
             }
             
             if (env->has_error_code) {
-                wvmcs(cpu_state->hvf->fd, VMCS_ENTRY_EXCEPTION_ERROR,
+                wvmcs(cs->hvf->fd, VMCS_ENTRY_EXCEPTION_ERROR,
                       env->error_code);
                 /* Indicate that VMCS_ENTRY_EXCEPTION_ERROR is valid */
                 info |= VMCS_INTR_DEL_ERRCODE;
             }
             /*printf("reinject  %lx err %d\n", info, err);*/
-            wvmcs(cpu_state->hvf->fd, VMCS_ENTRY_INTR_INFO, info);
+            wvmcs(cs->hvf->fd, VMCS_ENTRY_INTR_INFO, info);
         };
     }
 
-    if (cpu_state->interrupt_request & CPU_INTERRUPT_NMI) {
+    if (cs->interrupt_request & CPU_INTERRUPT_NMI) {
         if (!(env->hflags2 & HF2_NMI_MASK) && !(info & VMCS_INTR_VALID)) {
-            cpu_state->interrupt_request &= ~CPU_INTERRUPT_NMI;
+            cs->interrupt_request &= ~CPU_INTERRUPT_NMI;
             info = VMCS_INTR_VALID | VMCS_INTR_T_NMI | EXCP02_NMI;
-            wvmcs(cpu_state->hvf->fd, VMCS_ENTRY_INTR_INFO, info);
+            wvmcs(cs->hvf->fd, VMCS_ENTRY_INTR_INFO, info);
         } else {
-            vmx_set_nmi_window_exiting(cpu_state);
+            vmx_set_nmi_window_exiting(cs);
         }
     }
 
     if (!(env->hflags & HF_INHIBIT_IRQ_MASK) &&
-        (cpu_state->interrupt_request & CPU_INTERRUPT_HARD) &&
+        (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
         (env->eflags & IF_MASK) && !(info & VMCS_INTR_VALID)) {
         int line = cpu_get_pic_interrupt(&x86cpu->env);
-        cpu_state->interrupt_request &= ~CPU_INTERRUPT_HARD;
+        cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
         if (line >= 0) {
-            wvmcs(cpu_state->hvf->fd, VMCS_ENTRY_INTR_INFO, line |
+            wvmcs(cs->hvf->fd, VMCS_ENTRY_INTR_INFO, line |
                   VMCS_INTR_VALID | VMCS_INTR_T_HWINTR);
         }
     }
-    if (cpu_state->interrupt_request & CPU_INTERRUPT_HARD) {
-        vmx_set_int_window_exiting(cpu_state);
+    if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
+        vmx_set_int_window_exiting(cs);
     }
-    return (cpu_state->interrupt_request
+    return (cs->interrupt_request
             & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR));
 }
 
-int hvf_process_events(CPUState *cpu_state)
+int hvf_process_events(CPUState *cs)
 {
-    X86CPU *cpu = X86_CPU(cpu_state);
+    X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    if (!cpu_state->vcpu_dirty) {
+    if (!cs->vcpu_dirty) {
         /* light weight sync for CPU_INTERRUPT_HARD and IF_MASK */
-        env->eflags = rreg(cpu_state->hvf->fd, HV_X86_RFLAGS);
+        env->eflags = rreg(cs->hvf->fd, HV_X86_RFLAGS);
     }
 
-    if (cpu_state->interrupt_request & CPU_INTERRUPT_INIT) {
-        cpu_synchronize_state(cpu_state);
+    if (cs->interrupt_request & CPU_INTERRUPT_INIT) {
+        cpu_synchronize_state(cs);
         do_cpu_init(cpu);
     }
 
-    if (cpu_state->interrupt_request & CPU_INTERRUPT_POLL) {
-        cpu_state->interrupt_request &= ~CPU_INTERRUPT_POLL;
+    if (cs->interrupt_request & CPU_INTERRUPT_POLL) {
+        cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
         apic_poll_irq(cpu->apic_state);
     }
-    if (((cpu_state->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
         (env->eflags & IF_MASK)) ||
-        (cpu_state->interrupt_request & CPU_INTERRUPT_NMI)) {
-        cpu_state->halted = 0;
+        (cs->interrupt_request & CPU_INTERRUPT_NMI)) {
+        cs->halted = 0;
     }
-    if (cpu_state->interrupt_request & CPU_INTERRUPT_SIPI) {
-        cpu_synchronize_state(cpu_state);
+    if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
+        cpu_synchronize_state(cs);
         do_cpu_sipi(cpu);
     }
-    if (cpu_state->interrupt_request & CPU_INTERRUPT_TPR) {
-        cpu_state->interrupt_request &= ~CPU_INTERRUPT_TPR;
-        cpu_synchronize_state(cpu_state);
+    if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
+        cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
+        cpu_synchronize_state(cs);
         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
                                       env->tpr_access_type);
     }
-    return cpu_state->halted;
+    return cs->halted;
 }
diff --git a/target/i386/hvf/x86hvf.h b/target/i386/hvf/x86hvf.h
index db6003d6bd..423a89b6ad 100644
--- a/target/i386/hvf/x86hvf.h
+++ b/target/i386/hvf/x86hvf.h
@@ -20,15 +20,15 @@
 #include "cpu.h"
 #include "x86_descr.h"
 
-int hvf_process_events(CPUState *);
-bool hvf_inject_interrupts(CPUState *);
-void hvf_set_segment(struct CPUState *cpu, struct vmx_segment *vmx_seg,
+int hvf_process_events(CPUState *cs);
+bool hvf_inject_interrupts(CPUState *cs);
+void hvf_set_segment(CPUState *cs, struct vmx_segment *vmx_seg,
                      SegmentCache *qseg, bool is_tr);
 void hvf_get_segment(SegmentCache *qseg, struct vmx_segment *vmx_seg);
-void hvf_put_xsave(CPUState *cpu_state);
-void hvf_put_msrs(CPUState *cpu_state);
-void hvf_get_xsave(CPUState *cpu_state);
-void hvf_get_msrs(CPUState *cpu_state);
-void vmx_clear_int_window_exiting(CPUState *cpu);
-void vmx_update_tpr(CPUState *cpu);
+void hvf_put_xsave(CPUState *cs);
+void hvf_put_msrs(CPUState *cs);
+void hvf_get_xsave(CPUState *cs);
+void hvf_get_msrs(CPUState *cs);
+void vmx_clear_int_window_exiting(CPUState *cs);
+void vmx_update_tpr(CPUState *cs);
 #endif

From 3b295bcb3289afec09508786032f4ba5d657a934 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 21 Jun 2023 13:15:27 +0200
Subject: [PATCH 0298/1353] accel: Rename HVF 'struct hvf_vcpu_state' ->
 AccelCPUState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want all accelerators to share the same opaque pointer in
CPUState.

Rename the 'hvf_vcpu_state' structure as 'AccelCPUState'.

Use the generic 'accel' field of CPUState instead of 'hvf'.

Replace g_malloc0() by g_new0() for readability.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230624174121.11508-17-philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c   |  19 ++--
 include/hw/core/cpu.h       |   4 -
 include/sysemu/hvf_int.h    |   2 +-
 target/arm/hvf/hvf.c        | 108 +++++++++----------
 target/i386/hvf/hvf.c       | 106 +++++++++---------
 target/i386/hvf/vmx.h       |  22 ++--
 target/i386/hvf/x86.c       |  28 ++---
 target/i386/hvf/x86_descr.c |  26 ++---
 target/i386/hvf/x86_emu.c   |  62 +++++------
 target/i386/hvf/x86_mmu.c   |   4 +-
 target/i386/hvf/x86_task.c  |  10 +-
 target/i386/hvf/x86hvf.c    | 208 ++++++++++++++++++------------------
 12 files changed, 298 insertions(+), 301 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 9c3da03c94..7db9d3099e 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -372,19 +372,19 @@ type_init(hvf_type_init);
 
 static void hvf_vcpu_destroy(CPUState *cpu)
 {
-    hv_return_t ret = hv_vcpu_destroy(cpu->hvf->fd);
+    hv_return_t ret = hv_vcpu_destroy(cpu->accel->fd);
     assert_hvf_ok(ret);
 
     hvf_arch_vcpu_destroy(cpu);
-    g_free(cpu->hvf);
-    cpu->hvf = NULL;
+    g_free(cpu->accel);
+    cpu->accel = NULL;
 }
 
 static int hvf_init_vcpu(CPUState *cpu)
 {
     int r;
 
-    cpu->hvf = g_malloc0(sizeof(*cpu->hvf));
+    cpu->accel = g_new0(AccelCPUState, 1);
 
     /* init cpu signals */
     struct sigaction sigact;
@@ -393,18 +393,19 @@ static int hvf_init_vcpu(CPUState *cpu)
     sigact.sa_handler = dummy_signal;
     sigaction(SIG_IPI, &sigact, NULL);
 
-    pthread_sigmask(SIG_BLOCK, NULL, &cpu->hvf->unblock_ipi_mask);
-    sigdelset(&cpu->hvf->unblock_ipi_mask, SIG_IPI);
+    pthread_sigmask(SIG_BLOCK, NULL, &cpu->accel->unblock_ipi_mask);
+    sigdelset(&cpu->accel->unblock_ipi_mask, SIG_IPI);
 
 #ifdef __aarch64__
-    r = hv_vcpu_create(&cpu->hvf->fd, (hv_vcpu_exit_t **)&cpu->hvf->exit, NULL);
+    r = hv_vcpu_create(&cpu->accel->fd,
+                       (hv_vcpu_exit_t **)&cpu->accel->exit, NULL);
 #else
-    r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf->fd, HV_VCPU_DEFAULT);
+    r = hv_vcpu_create((hv_vcpuid_t *)&cpu->accel->fd, HV_VCPU_DEFAULT);
 #endif
     cpu->vcpu_dirty = 1;
     assert_hvf_ok(r);
 
-    cpu->hvf->guest_debug_enabled = false;
+    cpu->accel->guest_debug_enabled = false;
 
     return hvf_arch_init_vcpu(cpu);
 }
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 476b39e42e..b08f8b7079 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -241,8 +241,6 @@ typedef struct SavedIOTLB {
 struct KVMState;
 struct kvm_run;
 
-struct hvf_vcpu_state;
-
 /* work queue */
 
 /* The union type allows passing of 64 bit target pointers on 32 bit
@@ -443,8 +441,6 @@ struct CPUState {
     /* Used for user-only emulation of prctl(PR_SET_UNALIGN). */
     bool prctl_unalign_sigbus;
 
-    struct hvf_vcpu_state *hvf;
-
     /* track IOMMUs whose translations we've cached in the TCG TLB */
     GArray *iommu_notifiers;
 };
diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
index 6ab119e49f..718beddcdd 100644
--- a/include/sysemu/hvf_int.h
+++ b/include/sysemu/hvf_int.h
@@ -49,7 +49,7 @@ struct HVFState {
 };
 extern HVFState *hvf_state;
 
-struct hvf_vcpu_state {
+struct AccelCPUState {
     uint64_t fd;
     void *exit;
     bool vtimer_masked;
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8f72624586..8fce64bbf6 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -544,29 +544,29 @@ int hvf_get_registers(CPUState *cpu)
     int i;
 
     for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
-        ret = hv_vcpu_get_reg(cpu->hvf->fd, hvf_reg_match[i].reg, &val);
+        ret = hv_vcpu_get_reg(cpu->accel->fd, hvf_reg_match[i].reg, &val);
         *(uint64_t *)((void *)env + hvf_reg_match[i].offset) = val;
         assert_hvf_ok(ret);
     }
 
     for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) {
-        ret = hv_vcpu_get_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg,
+        ret = hv_vcpu_get_simd_fp_reg(cpu->accel->fd, hvf_fpreg_match[i].reg,
                                       &fpval);
         memcpy((void *)env + hvf_fpreg_match[i].offset, &fpval, sizeof(fpval));
         assert_hvf_ok(ret);
     }
 
     val = 0;
-    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPCR, &val);
+    ret = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_FPCR, &val);
     assert_hvf_ok(ret);
     vfp_set_fpcr(env, val);
 
     val = 0;
-    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPSR, &val);
+    ret = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_FPSR, &val);
     assert_hvf_ok(ret);
     vfp_set_fpsr(env, val);
 
-    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_CPSR, &val);
+    ret = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_CPSR, &val);
     assert_hvf_ok(ret);
     pstate_write(env, val);
 
@@ -575,7 +575,7 @@ int hvf_get_registers(CPUState *cpu)
             continue;
         }
 
-        if (cpu->hvf->guest_debug_enabled) {
+        if (cpu->accel->guest_debug_enabled) {
             /* Handle debug registers */
             switch (hvf_sreg_match[i].reg) {
             case HV_SYS_REG_DBGBVR0_EL1:
@@ -661,7 +661,7 @@ int hvf_get_registers(CPUState *cpu)
             }
         }
 
-        ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, &val);
+        ret = hv_vcpu_get_sys_reg(cpu->accel->fd, hvf_sreg_match[i].reg, &val);
         assert_hvf_ok(ret);
 
         arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
@@ -684,24 +684,24 @@ int hvf_put_registers(CPUState *cpu)
 
     for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
         val = *(uint64_t *)((void *)env + hvf_reg_match[i].offset);
-        ret = hv_vcpu_set_reg(cpu->hvf->fd, hvf_reg_match[i].reg, val);
+        ret = hv_vcpu_set_reg(cpu->accel->fd, hvf_reg_match[i].reg, val);
         assert_hvf_ok(ret);
     }
 
     for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) {
         memcpy(&fpval, (void *)env + hvf_fpreg_match[i].offset, sizeof(fpval));
-        ret = hv_vcpu_set_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg,
+        ret = hv_vcpu_set_simd_fp_reg(cpu->accel->fd, hvf_fpreg_match[i].reg,
                                       fpval);
         assert_hvf_ok(ret);
     }
 
-    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPCR, vfp_get_fpcr(env));
+    ret = hv_vcpu_set_reg(cpu->accel->fd, HV_REG_FPCR, vfp_get_fpcr(env));
     assert_hvf_ok(ret);
 
-    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPSR, vfp_get_fpsr(env));
+    ret = hv_vcpu_set_reg(cpu->accel->fd, HV_REG_FPSR, vfp_get_fpsr(env));
     assert_hvf_ok(ret);
 
-    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_CPSR, pstate_read(env));
+    ret = hv_vcpu_set_reg(cpu->accel->fd, HV_REG_CPSR, pstate_read(env));
     assert_hvf_ok(ret);
 
     aarch64_save_sp(env, arm_current_el(env));
@@ -712,7 +712,7 @@ int hvf_put_registers(CPUState *cpu)
             continue;
         }
 
-        if (cpu->hvf->guest_debug_enabled) {
+        if (cpu->accel->guest_debug_enabled) {
             /* Handle debug registers */
             switch (hvf_sreg_match[i].reg) {
             case HV_SYS_REG_DBGBVR0_EL1:
@@ -789,11 +789,11 @@ int hvf_put_registers(CPUState *cpu)
         }
 
         val = arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx];
-        ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, val);
+        ret = hv_vcpu_set_sys_reg(cpu->accel->fd, hvf_sreg_match[i].reg, val);
         assert_hvf_ok(ret);
     }
 
-    ret = hv_vcpu_set_vtimer_offset(cpu->hvf->fd, hvf_state->vtimer_offset);
+    ret = hv_vcpu_set_vtimer_offset(cpu->accel->fd, hvf_state->vtimer_offset);
     assert_hvf_ok(ret);
 
     return 0;
@@ -814,7 +814,7 @@ static void hvf_set_reg(CPUState *cpu, int rt, uint64_t val)
     flush_cpu_state(cpu);
 
     if (rt < 31) {
-        r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_X0 + rt, val);
+        r = hv_vcpu_set_reg(cpu->accel->fd, HV_REG_X0 + rt, val);
         assert_hvf_ok(r);
     }
 }
@@ -827,7 +827,7 @@ static uint64_t hvf_get_reg(CPUState *cpu, int rt)
     flush_cpu_state(cpu);
 
     if (rt < 31) {
-        r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_X0 + rt, &val);
+        r = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_X0 + rt, &val);
         assert_hvf_ok(r);
     }
 
@@ -969,22 +969,22 @@ int hvf_arch_init_vcpu(CPUState *cpu)
     assert(write_cpustate_to_list(arm_cpu, false));
 
     /* Set CP_NO_RAW system registers on init */
-    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MIDR_EL1,
+    ret = hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_MIDR_EL1,
                               arm_cpu->midr);
     assert_hvf_ok(ret);
 
-    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MPIDR_EL1,
+    ret = hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_MPIDR_EL1,
                               arm_cpu->mp_affinity);
     assert_hvf_ok(ret);
 
-    ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, &pfr);
+    ret = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64PFR0_EL1, &pfr);
     assert_hvf_ok(ret);
     pfr |= env->gicv3state ? (1 << 24) : 0;
-    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, pfr);
+    ret = hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64PFR0_EL1, pfr);
     assert_hvf_ok(ret);
 
     /* We're limited to underlying hardware caps, override internal versions */
-    ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64MMFR0_EL1,
+    ret = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_ID_AA64MMFR0_EL1,
                               &arm_cpu->isar.id_aa64mmfr0);
     assert_hvf_ok(ret);
 
@@ -994,7 +994,7 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 void hvf_kick_vcpu_thread(CPUState *cpu)
 {
     cpus_kick_thread(cpu);
-    hv_vcpus_exit(&cpu->hvf->fd, 1);
+    hv_vcpus_exit(&cpu->accel->fd, 1);
 }
 
 static void hvf_raise_exception(CPUState *cpu, uint32_t excp,
@@ -1678,13 +1678,13 @@ static int hvf_inject_interrupts(CPUState *cpu)
 {
     if (cpu->interrupt_request & CPU_INTERRUPT_FIQ) {
         trace_hvf_inject_fiq();
-        hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_FIQ,
+        hv_vcpu_set_pending_interrupt(cpu->accel->fd, HV_INTERRUPT_TYPE_FIQ,
                                       true);
     }
 
     if (cpu->interrupt_request & CPU_INTERRUPT_HARD) {
         trace_hvf_inject_irq();
-        hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_IRQ,
+        hv_vcpu_set_pending_interrupt(cpu->accel->fd, HV_INTERRUPT_TYPE_IRQ,
                                       true);
     }
 
@@ -1718,7 +1718,7 @@ static void hvf_wait_for_ipi(CPUState *cpu, struct timespec *ts)
      */
     qatomic_set_mb(&cpu->thread_kicked, false);
     qemu_mutex_unlock_iothread();
-    pselect(0, 0, 0, 0, ts, &cpu->hvf->unblock_ipi_mask);
+    pselect(0, 0, 0, 0, ts, &cpu->accel->unblock_ipi_mask);
     qemu_mutex_lock_iothread();
 }
 
@@ -1739,7 +1739,7 @@ static void hvf_wfi(CPUState *cpu)
         return;
     }
 
-    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
+    r = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
     assert_hvf_ok(r);
 
     if (!(ctl & 1) || (ctl & 2)) {
@@ -1748,7 +1748,7 @@ static void hvf_wfi(CPUState *cpu)
         return;
     }
 
-    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CVAL_EL0, &cval);
+    r = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_CNTV_CVAL_EL0, &cval);
     assert_hvf_ok(r);
 
     ticks_to_sleep = cval - hvf_vtimer_val();
@@ -1781,12 +1781,12 @@ static void hvf_sync_vtimer(CPUState *cpu)
     uint64_t ctl;
     bool irq_state;
 
-    if (!cpu->hvf->vtimer_masked) {
+    if (!cpu->accel->vtimer_masked) {
         /* We will get notified on vtimer changes by hvf, nothing to do */
         return;
     }
 
-    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
+    r = hv_vcpu_get_sys_reg(cpu->accel->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
     assert_hvf_ok(r);
 
     irq_state = (ctl & (TMR_CTL_ENABLE | TMR_CTL_IMASK | TMR_CTL_ISTATUS)) ==
@@ -1795,8 +1795,8 @@ static void hvf_sync_vtimer(CPUState *cpu)
 
     if (!irq_state) {
         /* Timer no longer asserting, we can unmask it */
-        hv_vcpu_set_vtimer_mask(cpu->hvf->fd, false);
-        cpu->hvf->vtimer_masked = false;
+        hv_vcpu_set_vtimer_mask(cpu->accel->fd, false);
+        cpu->accel->vtimer_masked = false;
     }
 }
 
@@ -1805,7 +1805,7 @@ int hvf_vcpu_exec(CPUState *cpu)
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
     int ret;
-    hv_vcpu_exit_t *hvf_exit = cpu->hvf->exit;
+    hv_vcpu_exit_t *hvf_exit = cpu->accel->exit;
     hv_return_t r;
     bool advance_pc = false;
 
@@ -1821,7 +1821,7 @@ int hvf_vcpu_exec(CPUState *cpu)
     flush_cpu_state(cpu);
 
     qemu_mutex_unlock_iothread();
-    assert_hvf_ok(hv_vcpu_run(cpu->hvf->fd));
+    assert_hvf_ok(hv_vcpu_run(cpu->accel->fd));
 
     /* handle VMEXIT */
     uint64_t exit_reason = hvf_exit->reason;
@@ -1836,7 +1836,7 @@ int hvf_vcpu_exec(CPUState *cpu)
         break;
     case HV_EXIT_REASON_VTIMER_ACTIVATED:
         qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
-        cpu->hvf->vtimer_masked = true;
+        cpu->accel->vtimer_masked = true;
         return 0;
     case HV_EXIT_REASON_CANCELED:
         /* we got kicked, no exit to process */
@@ -1990,10 +1990,10 @@ int hvf_vcpu_exec(CPUState *cpu)
 
         flush_cpu_state(cpu);
 
-        r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_PC, &pc);
+        r = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_PC, &pc);
         assert_hvf_ok(r);
         pc += 4;
-        r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_PC, pc);
+        r = hv_vcpu_set_reg(cpu->accel->fd, HV_REG_PC, pc);
         assert_hvf_ok(r);
 
         /* Handle single-stepping over instructions which trigger a VM exit */
@@ -2113,29 +2113,29 @@ static void hvf_put_gdbstub_debug_registers(CPUState *cpu)
 
     for (i = 0; i < cur_hw_bps; i++) {
         HWBreakpoint *bp = get_hw_bp(i);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgbcr_regs[i], bp->bcr);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgbcr_regs[i], bp->bcr);
         assert_hvf_ok(r);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgbvr_regs[i], bp->bvr);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgbvr_regs[i], bp->bvr);
         assert_hvf_ok(r);
     }
     for (i = cur_hw_bps; i < max_hw_bps; i++) {
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgbcr_regs[i], 0);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgbcr_regs[i], 0);
         assert_hvf_ok(r);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgbvr_regs[i], 0);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgbvr_regs[i], 0);
         assert_hvf_ok(r);
     }
 
     for (i = 0; i < cur_hw_wps; i++) {
         HWWatchpoint *wp = get_hw_wp(i);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgwcr_regs[i], wp->wcr);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgwcr_regs[i], wp->wcr);
         assert_hvf_ok(r);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgwvr_regs[i], wp->wvr);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgwvr_regs[i], wp->wvr);
         assert_hvf_ok(r);
     }
     for (i = cur_hw_wps; i < max_hw_wps; i++) {
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgwcr_regs[i], 0);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgwcr_regs[i], 0);
         assert_hvf_ok(r);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgwvr_regs[i], 0);
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgwvr_regs[i], 0);
         assert_hvf_ok(r);
     }
 }
@@ -2152,19 +2152,19 @@ static void hvf_put_guest_debug_registers(CPUState *cpu)
     int i;
 
     for (i = 0; i < max_hw_bps; i++) {
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgbcr_regs[i],
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgbcr_regs[i],
                                 env->cp15.dbgbcr[i]);
         assert_hvf_ok(r);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgbvr_regs[i],
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgbvr_regs[i],
                                 env->cp15.dbgbvr[i]);
         assert_hvf_ok(r);
     }
 
     for (i = 0; i < max_hw_wps; i++) {
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgwcr_regs[i],
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgwcr_regs[i],
                                 env->cp15.dbgwcr[i]);
         assert_hvf_ok(r);
-        r = hv_vcpu_set_sys_reg(cpu->hvf->fd, dbgwvr_regs[i],
+        r = hv_vcpu_set_sys_reg(cpu->accel->fd, dbgwvr_regs[i],
                                 env->cp15.dbgwvr[i]);
         assert_hvf_ok(r);
     }
@@ -2184,16 +2184,16 @@ static void hvf_arch_set_traps(void)
     /* Check whether guest debugging is enabled for at least one vCPU; if it
      * is, enable exiting the guest on all vCPUs */
     CPU_FOREACH(cpu) {
-        should_enable_traps |= cpu->hvf->guest_debug_enabled;
+        should_enable_traps |= cpu->accel->guest_debug_enabled;
     }
     CPU_FOREACH(cpu) {
         /* Set whether debug exceptions exit the guest */
-        r = hv_vcpu_set_trap_debug_exceptions(cpu->hvf->fd,
+        r = hv_vcpu_set_trap_debug_exceptions(cpu->accel->fd,
                                               should_enable_traps);
         assert_hvf_ok(r);
 
         /* Set whether accesses to debug registers exit the guest */
-        r = hv_vcpu_set_trap_debug_reg_accesses(cpu->hvf->fd,
+        r = hv_vcpu_set_trap_debug_reg_accesses(cpu->accel->fd,
                                                 should_enable_traps);
         assert_hvf_ok(r);
     }
@@ -2205,12 +2205,12 @@ void hvf_arch_update_guest_debug(CPUState *cpu)
     CPUARMState *env = &arm_cpu->env;
 
     /* Check whether guest debugging is enabled */
-    cpu->hvf->guest_debug_enabled = cpu->singlestep_enabled ||
+    cpu->accel->guest_debug_enabled = cpu->singlestep_enabled ||
                                     hvf_sw_breakpoints_active(cpu) ||
                                     hvf_arm_hw_debug_active(cpu);
 
     /* Update debug registers */
-    if (cpu->hvf->guest_debug_enabled) {
+    if (cpu->accel->guest_debug_enabled) {
         hvf_put_gdbstub_debug_registers(cpu);
     } else {
         hvf_put_guest_debug_registers(cpu);
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index f6775c942a..b9cbcc02a8 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -81,11 +81,11 @@ void vmx_update_tpr(CPUState *cpu)
     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 
-    wreg(cpu->hvf->fd, HV_X86_TPR, tpr);
+    wreg(cpu->accel->fd, HV_X86_TPR, tpr);
     if (irr == -1) {
-        wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, 0);
+        wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
     } else {
-        wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
+        wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
               irr >> 4);
     }
 }
@@ -93,7 +93,7 @@ void vmx_update_tpr(CPUState *cpu)
 static void update_apic_tpr(CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
-    int tpr = rreg(cpu->hvf->fd, HV_X86_TPR) >> 4;
+    int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4;
     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 }
 
@@ -256,12 +256,12 @@ int hvf_arch_init_vcpu(CPUState *cpu)
     }
 
     /* set VMCS control fields */
-    wvmcs(cpu->hvf->fd, VMCS_PIN_BASED_CTLS,
+    wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS,
           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
                    VMCS_PIN_BASED_CTLS_EXTINT |
                    VMCS_PIN_BASED_CTLS_NMI |
                    VMCS_PIN_BASED_CTLS_VNMI));
-    wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS,
+    wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS,
           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
                    VMCS_PRI_PROC_BASED_CTLS_HLT |
                    VMCS_PRI_PROC_BASED_CTLS_MWAIT |
@@ -276,14 +276,14 @@ int hvf_arch_init_vcpu(CPUState *cpu)
         reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP;
     }
 
-    wvmcs(cpu->hvf->fd, VMCS_SEC_PROC_BASED_CTLS,
+    wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS,
           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap));
 
-    wvmcs(cpu->hvf->fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
-          0));
-    wvmcs(cpu->hvf->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
+    wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS,
+          cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0));
+    wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 
-    wvmcs(cpu->hvf->fd, VMCS_TPR_THRESHOLD, 0);
+    wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
 
     x86cpu = X86_CPU(cpu);
     x86cpu->env.xsave_buf_len = 4096;
@@ -295,18 +295,18 @@ int hvf_arch_init_vcpu(CPUState *cpu)
      */
     assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
 
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_STAR, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_LSTAR, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_CSTAR, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_FMASK, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_FSBASE, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_GSBASE, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_KERNELGSBASE, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_TSC_AUX, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_TSC, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_CS, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_EIP, 1);
-    hv_vcpu_enable_native_msr(cpu->hvf->fd, MSR_IA32_SYSENTER_ESP, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1);
+    hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1);
 
     return 0;
 }
@@ -347,16 +347,16 @@ static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_in
         }
         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
             env->has_error_code = true;
-            env->error_code = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_ERROR);
+            env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR);
         }
     }
-    if ((rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY) &
+    if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
         env->hflags2 |= HF2_NMI_MASK;
     } else {
         env->hflags2 &= ~HF2_NMI_MASK;
     }
-    if (rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY) &
+    if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
         env->hflags |= HF_INHIBIT_IRQ_MASK;
@@ -435,20 +435,20 @@ int hvf_vcpu_exec(CPUState *cpu)
             return EXCP_HLT;
         }
 
-        hv_return_t r  = hv_vcpu_run(cpu->hvf->fd);
+        hv_return_t r  = hv_vcpu_run(cpu->accel->fd);
         assert_hvf_ok(r);
 
         /* handle VMEXIT */
-        uint64_t exit_reason = rvmcs(cpu->hvf->fd, VMCS_EXIT_REASON);
-        uint64_t exit_qual = rvmcs(cpu->hvf->fd, VMCS_EXIT_QUALIFICATION);
-        uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf->fd,
+        uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
+        uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
+        uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 
-        uint64_t idtvec_info = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_INFO);
+        uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
 
         hvf_store_events(cpu, ins_len, idtvec_info);
-        rip = rreg(cpu->hvf->fd, HV_X86_RIP);
-        env->eflags = rreg(cpu->hvf->fd, HV_X86_RFLAGS);
+        rip = rreg(cpu->accel->fd, HV_X86_RIP);
+        env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
 
         qemu_mutex_lock_iothread();
 
@@ -478,7 +478,7 @@ int hvf_vcpu_exec(CPUState *cpu)
         case EXIT_REASON_EPT_FAULT:
         {
             hvf_slot *slot;
-            uint64_t gpa = rvmcs(cpu->hvf->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
+            uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 
             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
@@ -523,7 +523,7 @@ int hvf_vcpu_exec(CPUState *cpu)
                 store_regs(cpu);
                 break;
             } else if (!string && !in) {
-                RAX(env) = rreg(cpu->hvf->fd, HV_X86_RAX);
+                RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
                 macvm_set_rip(cpu, rip + ins_len);
                 break;
@@ -539,21 +539,21 @@ int hvf_vcpu_exec(CPUState *cpu)
             break;
         }
         case EXIT_REASON_CPUID: {
-            uint32_t rax = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RAX);
-            uint32_t rbx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RBX);
-            uint32_t rcx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RCX);
-            uint32_t rdx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RDX);
+            uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
+            uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
+            uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
+            uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
 
             if (rax == 1) {
                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
-                env->cr[4] = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR4);
+                env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
             }
             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 
-            wreg(cpu->hvf->fd, HV_X86_RAX, rax);
-            wreg(cpu->hvf->fd, HV_X86_RBX, rbx);
-            wreg(cpu->hvf->fd, HV_X86_RCX, rcx);
-            wreg(cpu->hvf->fd, HV_X86_RDX, rdx);
+            wreg(cpu->accel->fd, HV_X86_RAX, rax);
+            wreg(cpu->accel->fd, HV_X86_RBX, rbx);
+            wreg(cpu->accel->fd, HV_X86_RCX, rcx);
+            wreg(cpu->accel->fd, HV_X86_RDX, rdx);
 
             macvm_set_rip(cpu, rip + ins_len);
             break;
@@ -561,16 +561,16 @@ int hvf_vcpu_exec(CPUState *cpu)
         case EXIT_REASON_XSETBV: {
             X86CPU *x86_cpu = X86_CPU(cpu);
             CPUX86State *env = &x86_cpu->env;
-            uint32_t eax = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RAX);
-            uint32_t ecx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RCX);
-            uint32_t edx = (uint32_t)rreg(cpu->hvf->fd, HV_X86_RDX);
+            uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
+            uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
+            uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
 
             if (ecx) {
                 macvm_set_rip(cpu, rip + ins_len);
                 break;
             }
             env->xcr0 = ((uint64_t)edx << 32) | eax;
-            wreg(cpu->hvf->fd, HV_X86_XCR0, env->xcr0 | 1);
+            wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
             macvm_set_rip(cpu, rip + ins_len);
             break;
         }
@@ -609,11 +609,11 @@ int hvf_vcpu_exec(CPUState *cpu)
 
             switch (cr) {
             case 0x0: {
-                macvm_set_cr0(cpu->hvf->fd, RRX(env, reg));
+                macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
                 break;
             }
             case 4: {
-                macvm_set_cr4(cpu->hvf->fd, RRX(env, reg));
+                macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
                 break;
             }
             case 8: {
@@ -649,7 +649,7 @@ int hvf_vcpu_exec(CPUState *cpu)
             break;
         }
         case EXIT_REASON_TASK_SWITCH: {
-            uint64_t vinfo = rvmcs(cpu->hvf->fd, VMCS_IDT_VECTORING_INFO);
+            uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
@@ -662,8 +662,8 @@ int hvf_vcpu_exec(CPUState *cpu)
             break;
         }
         case EXIT_REASON_RDPMC:
-            wreg(cpu->hvf->fd, HV_X86_RAX, 0);
-            wreg(cpu->hvf->fd, HV_X86_RDX, 0);
+            wreg(cpu->accel->fd, HV_X86_RAX, 0);
+            wreg(cpu->accel->fd, HV_X86_RDX, 0);
             macvm_set_rip(cpu, rip + ins_len);
             break;
         case VMX_REASON_VMCALL:
diff --git a/target/i386/hvf/vmx.h b/target/i386/hvf/vmx.h
index fcd9a95e5b..0fffcfa46c 100644
--- a/target/i386/hvf/vmx.h
+++ b/target/i386/hvf/vmx.h
@@ -180,15 +180,15 @@ static inline void macvm_set_rip(CPUState *cpu, uint64_t rip)
     uint64_t val;
 
     /* BUG, should take considering overlap.. */
-    wreg(cpu->hvf->fd, HV_X86_RIP, rip);
+    wreg(cpu->accel->fd, HV_X86_RIP, rip);
     env->eip = rip;
 
     /* after moving forward in rip, we need to clean INTERRUPTABILITY */
-   val = rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY);
+   val = rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY);
    if (val & (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
                VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
-        wvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY,
+        wvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY,
                val & ~(VMCS_INTERRUPTIBILITY_STI_BLOCKING |
                VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING));
    }
@@ -200,9 +200,9 @@ static inline void vmx_clear_nmi_blocking(CPUState *cpu)
     CPUX86State *env = &x86_cpu->env;
 
     env->hflags2 &= ~HF2_NMI_MASK;
-    uint32_t gi = (uint32_t) rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY);
+    uint32_t gi = (uint32_t) rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY);
     gi &= ~VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
-    wvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
+    wvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
 }
 
 static inline void vmx_set_nmi_blocking(CPUState *cpu)
@@ -211,16 +211,16 @@ static inline void vmx_set_nmi_blocking(CPUState *cpu)
     CPUX86State *env = &x86_cpu->env;
 
     env->hflags2 |= HF2_NMI_MASK;
-    uint32_t gi = (uint32_t)rvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY);
+    uint32_t gi = (uint32_t)rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY);
     gi |= VMCS_INTERRUPTIBILITY_NMI_BLOCKING;
-    wvmcs(cpu->hvf->fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
+    wvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY, gi);
 }
 
 static inline void vmx_set_nmi_window_exiting(CPUState *cpu)
 {
     uint64_t val;
-    val = rvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
-    wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val |
+    val = rvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS);
+    wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS, val |
           VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING);
 
 }
@@ -229,8 +229,8 @@ static inline void vmx_clear_nmi_window_exiting(CPUState *cpu)
 {
 
     uint64_t val;
-    val = rvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
-    wvmcs(cpu->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val &
+    val = rvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS);
+    wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS, val &
           ~VMCS_PRI_PROC_BASED_CTLS_NMI_WINDOW_EXITING);
 }
 
diff --git a/target/i386/hvf/x86.c b/target/i386/hvf/x86.c
index d086584f26..8ceea6398e 100644
--- a/target/i386/hvf/x86.c
+++ b/target/i386/hvf/x86.c
@@ -61,11 +61,11 @@ bool x86_read_segment_descriptor(struct CPUState *cpu,
     }
 
     if (GDT_SEL == sel.ti) {
-        base  = rvmcs(cpu->hvf->fd, VMCS_GUEST_GDTR_BASE);
-        limit = rvmcs(cpu->hvf->fd, VMCS_GUEST_GDTR_LIMIT);
+        base  = rvmcs(cpu->accel->fd, VMCS_GUEST_GDTR_BASE);
+        limit = rvmcs(cpu->accel->fd, VMCS_GUEST_GDTR_LIMIT);
     } else {
-        base  = rvmcs(cpu->hvf->fd, VMCS_GUEST_LDTR_BASE);
-        limit = rvmcs(cpu->hvf->fd, VMCS_GUEST_LDTR_LIMIT);
+        base  = rvmcs(cpu->accel->fd, VMCS_GUEST_LDTR_BASE);
+        limit = rvmcs(cpu->accel->fd, VMCS_GUEST_LDTR_LIMIT);
     }
 
     if (sel.index * 8 >= limit) {
@@ -84,11 +84,11 @@ bool x86_write_segment_descriptor(struct CPUState *cpu,
     uint32_t limit;
     
     if (GDT_SEL == sel.ti) {
-        base  = rvmcs(cpu->hvf->fd, VMCS_GUEST_GDTR_BASE);
-        limit = rvmcs(cpu->hvf->fd, VMCS_GUEST_GDTR_LIMIT);
+        base  = rvmcs(cpu->accel->fd, VMCS_GUEST_GDTR_BASE);
+        limit = rvmcs(cpu->accel->fd, VMCS_GUEST_GDTR_LIMIT);
     } else {
-        base  = rvmcs(cpu->hvf->fd, VMCS_GUEST_LDTR_BASE);
-        limit = rvmcs(cpu->hvf->fd, VMCS_GUEST_LDTR_LIMIT);
+        base  = rvmcs(cpu->accel->fd, VMCS_GUEST_LDTR_BASE);
+        limit = rvmcs(cpu->accel->fd, VMCS_GUEST_LDTR_LIMIT);
     }
     
     if (sel.index * 8 >= limit) {
@@ -102,8 +102,8 @@ bool x86_write_segment_descriptor(struct CPUState *cpu,
 bool x86_read_call_gate(struct CPUState *cpu, struct x86_call_gate *idt_desc,
                         int gate)
 {
-    target_ulong base  = rvmcs(cpu->hvf->fd, VMCS_GUEST_IDTR_BASE);
-    uint32_t limit = rvmcs(cpu->hvf->fd, VMCS_GUEST_IDTR_LIMIT);
+    target_ulong base  = rvmcs(cpu->accel->fd, VMCS_GUEST_IDTR_BASE);
+    uint32_t limit = rvmcs(cpu->accel->fd, VMCS_GUEST_IDTR_LIMIT);
 
     memset(idt_desc, 0, sizeof(*idt_desc));
     if (gate * 8 >= limit) {
@@ -117,7 +117,7 @@ bool x86_read_call_gate(struct CPUState *cpu, struct x86_call_gate *idt_desc,
 
 bool x86_is_protected(struct CPUState *cpu)
 {
-    uint64_t cr0 = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR0);
+    uint64_t cr0 = rvmcs(cpu->accel->fd, VMCS_GUEST_CR0);
     return cr0 & CR0_PE_MASK;
 }
 
@@ -135,7 +135,7 @@ bool x86_is_v8086(struct CPUState *cpu)
 
 bool x86_is_long_mode(struct CPUState *cpu)
 {
-    return rvmcs(cpu->hvf->fd, VMCS_GUEST_IA32_EFER) & MSR_EFER_LMA;
+    return rvmcs(cpu->accel->fd, VMCS_GUEST_IA32_EFER) & MSR_EFER_LMA;
 }
 
 bool x86_is_long64_mode(struct CPUState *cpu)
@@ -148,13 +148,13 @@ bool x86_is_long64_mode(struct CPUState *cpu)
 
 bool x86_is_paging_mode(struct CPUState *cpu)
 {
-    uint64_t cr0 = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR0);
+    uint64_t cr0 = rvmcs(cpu->accel->fd, VMCS_GUEST_CR0);
     return cr0 & CR0_PG_MASK;
 }
 
 bool x86_is_pae_enabled(struct CPUState *cpu)
 {
-    uint64_t cr4 = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR4);
+    uint64_t cr4 = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
     return cr4 & CR4_PAE_MASK;
 }
 
diff --git a/target/i386/hvf/x86_descr.c b/target/i386/hvf/x86_descr.c
index a484942cfc..c2d2e9ee84 100644
--- a/target/i386/hvf/x86_descr.c
+++ b/target/i386/hvf/x86_descr.c
@@ -47,47 +47,47 @@ static const struct vmx_segment_field {
 
 uint32_t vmx_read_segment_limit(CPUState *cpu, X86Seg seg)
 {
-    return (uint32_t)rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].limit);
+    return (uint32_t)rvmcs(cpu->accel->fd, vmx_segment_fields[seg].limit);
 }
 
 uint32_t vmx_read_segment_ar(CPUState *cpu, X86Seg seg)
 {
-    return (uint32_t)rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].ar_bytes);
+    return (uint32_t)rvmcs(cpu->accel->fd, vmx_segment_fields[seg].ar_bytes);
 }
 
 uint64_t vmx_read_segment_base(CPUState *cpu, X86Seg seg)
 {
-    return rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].base);
+    return rvmcs(cpu->accel->fd, vmx_segment_fields[seg].base);
 }
 
 x68_segment_selector vmx_read_segment_selector(CPUState *cpu, X86Seg seg)
 {
     x68_segment_selector sel;
-    sel.sel = rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].selector);
+    sel.sel = rvmcs(cpu->accel->fd, vmx_segment_fields[seg].selector);
     return sel;
 }
 
 void vmx_write_segment_selector(struct CPUState *cpu, x68_segment_selector selector, X86Seg seg)
 {
-    wvmcs(cpu->hvf->fd, vmx_segment_fields[seg].selector, selector.sel);
+    wvmcs(cpu->accel->fd, vmx_segment_fields[seg].selector, selector.sel);
 }
 
 void vmx_read_segment_descriptor(struct CPUState *cpu, struct vmx_segment *desc, X86Seg seg)
 {
-    desc->sel = rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].selector);
-    desc->base = rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].base);
-    desc->limit = rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].limit);
-    desc->ar = rvmcs(cpu->hvf->fd, vmx_segment_fields[seg].ar_bytes);
+    desc->sel = rvmcs(cpu->accel->fd, vmx_segment_fields[seg].selector);
+    desc->base = rvmcs(cpu->accel->fd, vmx_segment_fields[seg].base);
+    desc->limit = rvmcs(cpu->accel->fd, vmx_segment_fields[seg].limit);
+    desc->ar = rvmcs(cpu->accel->fd, vmx_segment_fields[seg].ar_bytes);
 }
 
 void vmx_write_segment_descriptor(CPUState *cpu, struct vmx_segment *desc, X86Seg seg)
 {
     const struct vmx_segment_field *sf = &vmx_segment_fields[seg];
 
-    wvmcs(cpu->hvf->fd, sf->base, desc->base);
-    wvmcs(cpu->hvf->fd, sf->limit, desc->limit);
-    wvmcs(cpu->hvf->fd, sf->selector, desc->sel);
-    wvmcs(cpu->hvf->fd, sf->ar_bytes, desc->ar);
+    wvmcs(cpu->accel->fd, sf->base, desc->base);
+    wvmcs(cpu->accel->fd, sf->limit, desc->limit);
+    wvmcs(cpu->accel->fd, sf->selector, desc->sel);
+    wvmcs(cpu->accel->fd, sf->ar_bytes, desc->ar);
 }
 
 void x86_segment_descriptor_to_vmx(struct CPUState *cpu, x68_segment_selector selector, struct x86_segment_descriptor *desc, struct vmx_segment *vmx_desc)
diff --git a/target/i386/hvf/x86_emu.c b/target/i386/hvf/x86_emu.c
index f5704f63e8..ccda568478 100644
--- a/target/i386/hvf/x86_emu.c
+++ b/target/i386/hvf/x86_emu.c
@@ -673,7 +673,7 @@ void simulate_rdmsr(struct CPUState *cpu)
 
     switch (msr) {
     case MSR_IA32_TSC:
-        val = rdtscp() + rvmcs(cpu->hvf->fd, VMCS_TSC_OFFSET);
+        val = rdtscp() + rvmcs(cpu->accel->fd, VMCS_TSC_OFFSET);
         break;
     case MSR_IA32_APICBASE:
         val = cpu_get_apic_base(X86_CPU(cpu)->apic_state);
@@ -682,16 +682,16 @@ void simulate_rdmsr(struct CPUState *cpu)
         val = x86_cpu->ucode_rev;
         break;
     case MSR_EFER:
-        val = rvmcs(cpu->hvf->fd, VMCS_GUEST_IA32_EFER);
+        val = rvmcs(cpu->accel->fd, VMCS_GUEST_IA32_EFER);
         break;
     case MSR_FSBASE:
-        val = rvmcs(cpu->hvf->fd, VMCS_GUEST_FS_BASE);
+        val = rvmcs(cpu->accel->fd, VMCS_GUEST_FS_BASE);
         break;
     case MSR_GSBASE:
-        val = rvmcs(cpu->hvf->fd, VMCS_GUEST_GS_BASE);
+        val = rvmcs(cpu->accel->fd, VMCS_GUEST_GS_BASE);
         break;
     case MSR_KERNELGSBASE:
-        val = rvmcs(cpu->hvf->fd, VMCS_HOST_FS_BASE);
+        val = rvmcs(cpu->accel->fd, VMCS_HOST_FS_BASE);
         break;
     case MSR_STAR:
         abort();
@@ -779,13 +779,13 @@ void simulate_wrmsr(struct CPUState *cpu)
         cpu_set_apic_base(X86_CPU(cpu)->apic_state, data);
         break;
     case MSR_FSBASE:
-        wvmcs(cpu->hvf->fd, VMCS_GUEST_FS_BASE, data);
+        wvmcs(cpu->accel->fd, VMCS_GUEST_FS_BASE, data);
         break;
     case MSR_GSBASE:
-        wvmcs(cpu->hvf->fd, VMCS_GUEST_GS_BASE, data);
+        wvmcs(cpu->accel->fd, VMCS_GUEST_GS_BASE, data);
         break;
     case MSR_KERNELGSBASE:
-        wvmcs(cpu->hvf->fd, VMCS_HOST_FS_BASE, data);
+        wvmcs(cpu->accel->fd, VMCS_HOST_FS_BASE, data);
         break;
     case MSR_STAR:
         abort();
@@ -798,9 +798,9 @@ void simulate_wrmsr(struct CPUState *cpu)
         break;
     case MSR_EFER:
         /*printf("new efer %llx\n", EFER(cpu));*/
-        wvmcs(cpu->hvf->fd, VMCS_GUEST_IA32_EFER, data);
+        wvmcs(cpu->accel->fd, VMCS_GUEST_IA32_EFER, data);
         if (data & MSR_EFER_NXE) {
-            hv_vcpu_invalidate_tlb(cpu->hvf->fd);
+            hv_vcpu_invalidate_tlb(cpu->accel->fd);
         }
         break;
     case MSR_MTRRphysBase(0):
@@ -1424,21 +1424,21 @@ void load_regs(struct CPUState *cpu)
     CPUX86State *env = &x86_cpu->env;
 
     int i = 0;
-    RRX(env, R_EAX) = rreg(cpu->hvf->fd, HV_X86_RAX);
-    RRX(env, R_EBX) = rreg(cpu->hvf->fd, HV_X86_RBX);
-    RRX(env, R_ECX) = rreg(cpu->hvf->fd, HV_X86_RCX);
-    RRX(env, R_EDX) = rreg(cpu->hvf->fd, HV_X86_RDX);
-    RRX(env, R_ESI) = rreg(cpu->hvf->fd, HV_X86_RSI);
-    RRX(env, R_EDI) = rreg(cpu->hvf->fd, HV_X86_RDI);
-    RRX(env, R_ESP) = rreg(cpu->hvf->fd, HV_X86_RSP);
-    RRX(env, R_EBP) = rreg(cpu->hvf->fd, HV_X86_RBP);
+    RRX(env, R_EAX) = rreg(cpu->accel->fd, HV_X86_RAX);
+    RRX(env, R_EBX) = rreg(cpu->accel->fd, HV_X86_RBX);
+    RRX(env, R_ECX) = rreg(cpu->accel->fd, HV_X86_RCX);
+    RRX(env, R_EDX) = rreg(cpu->accel->fd, HV_X86_RDX);
+    RRX(env, R_ESI) = rreg(cpu->accel->fd, HV_X86_RSI);
+    RRX(env, R_EDI) = rreg(cpu->accel->fd, HV_X86_RDI);
+    RRX(env, R_ESP) = rreg(cpu->accel->fd, HV_X86_RSP);
+    RRX(env, R_EBP) = rreg(cpu->accel->fd, HV_X86_RBP);
     for (i = 8; i < 16; i++) {
-        RRX(env, i) = rreg(cpu->hvf->fd, HV_X86_RAX + i);
+        RRX(env, i) = rreg(cpu->accel->fd, HV_X86_RAX + i);
     }
 
-    env->eflags = rreg(cpu->hvf->fd, HV_X86_RFLAGS);
+    env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
     rflags_to_lflags(env);
-    env->eip = rreg(cpu->hvf->fd, HV_X86_RIP);
+    env->eip = rreg(cpu->accel->fd, HV_X86_RIP);
 }
 
 void store_regs(struct CPUState *cpu)
@@ -1447,20 +1447,20 @@ void store_regs(struct CPUState *cpu)
     CPUX86State *env = &x86_cpu->env;
 
     int i = 0;
-    wreg(cpu->hvf->fd, HV_X86_RAX, RAX(env));
-    wreg(cpu->hvf->fd, HV_X86_RBX, RBX(env));
-    wreg(cpu->hvf->fd, HV_X86_RCX, RCX(env));
-    wreg(cpu->hvf->fd, HV_X86_RDX, RDX(env));
-    wreg(cpu->hvf->fd, HV_X86_RSI, RSI(env));
-    wreg(cpu->hvf->fd, HV_X86_RDI, RDI(env));
-    wreg(cpu->hvf->fd, HV_X86_RBP, RBP(env));
-    wreg(cpu->hvf->fd, HV_X86_RSP, RSP(env));
+    wreg(cpu->accel->fd, HV_X86_RAX, RAX(env));
+    wreg(cpu->accel->fd, HV_X86_RBX, RBX(env));
+    wreg(cpu->accel->fd, HV_X86_RCX, RCX(env));
+    wreg(cpu->accel->fd, HV_X86_RDX, RDX(env));
+    wreg(cpu->accel->fd, HV_X86_RSI, RSI(env));
+    wreg(cpu->accel->fd, HV_X86_RDI, RDI(env));
+    wreg(cpu->accel->fd, HV_X86_RBP, RBP(env));
+    wreg(cpu->accel->fd, HV_X86_RSP, RSP(env));
     for (i = 8; i < 16; i++) {
-        wreg(cpu->hvf->fd, HV_X86_RAX + i, RRX(env, i));
+        wreg(cpu->accel->fd, HV_X86_RAX + i, RRX(env, i));
     }
 
     lflags_to_rflags(env);
-    wreg(cpu->hvf->fd, HV_X86_RFLAGS, env->eflags);
+    wreg(cpu->accel->fd, HV_X86_RFLAGS, env->eflags);
     macvm_set_rip(cpu, env->eip);
 }
 
diff --git a/target/i386/hvf/x86_mmu.c b/target/i386/hvf/x86_mmu.c
index 96d117567e..8cd08622a1 100644
--- a/target/i386/hvf/x86_mmu.c
+++ b/target/i386/hvf/x86_mmu.c
@@ -126,7 +126,7 @@ static bool test_pt_entry(struct CPUState *cpu, struct gpt_translation *pt,
         pt->err_code |= MMU_PAGE_PT;
     }
 
-    uint32_t cr0 = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR0);
+    uint32_t cr0 = rvmcs(cpu->accel->fd, VMCS_GUEST_CR0);
     /* check protection */
     if (cr0 & CR0_WP_MASK) {
         if (pt->write_access && !pte_write_access(pte)) {
@@ -171,7 +171,7 @@ static bool walk_gpt(struct CPUState *cpu, target_ulong addr, int err_code,
 {
     int top_level, level;
     bool is_large = false;
-    target_ulong cr3 = rvmcs(cpu->hvf->fd, VMCS_GUEST_CR3);
+    target_ulong cr3 = rvmcs(cpu->accel->fd, VMCS_GUEST_CR3);
     uint64_t page_mask = pae ? PAE_PTE_PAGE_MASK : LEGACY_PTE_PAGE_MASK;
     
     memset(pt, 0, sizeof(*pt));
diff --git a/target/i386/hvf/x86_task.c b/target/i386/hvf/x86_task.c
index beaeec0687..f09bfbdda5 100644
--- a/target/i386/hvf/x86_task.c
+++ b/target/i386/hvf/x86_task.c
@@ -61,7 +61,7 @@ static void load_state_from_tss32(CPUState *cpu, struct x86_tss_segment32 *tss)
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
 
-    wvmcs(cpu->hvf->fd, VMCS_GUEST_CR3, tss->cr3);
+    wvmcs(cpu->accel->fd, VMCS_GUEST_CR3, tss->cr3);
 
     env->eip = tss->eip;
     env->eflags = tss->eflags | 2;
@@ -110,11 +110,11 @@ static int task_switch_32(CPUState *cpu, x68_segment_selector tss_sel, x68_segme
 
 void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel, int reason, bool gate_valid, uint8_t gate, uint64_t gate_type)
 {
-    uint64_t rip = rreg(cpu->hvf->fd, HV_X86_RIP);
+    uint64_t rip = rreg(cpu->accel->fd, HV_X86_RIP);
     if (!gate_valid || (gate_type != VMCS_INTR_T_HWEXCEPTION &&
                         gate_type != VMCS_INTR_T_HWINTR &&
                         gate_type != VMCS_INTR_T_NMI)) {
-        int ins_len = rvmcs(cpu->hvf->fd, VMCS_EXIT_INSTRUCTION_LENGTH);
+        int ins_len = rvmcs(cpu->accel->fd, VMCS_EXIT_INSTRUCTION_LENGTH);
         macvm_set_rip(cpu, rip + ins_len);
         return;
     }
@@ -173,12 +173,12 @@ void vmx_handle_task_switch(CPUState *cpu, x68_segment_selector tss_sel, int rea
         //ret = task_switch_16(cpu, tss_sel, old_tss_sel, old_tss_base, &next_tss_desc);
         VM_PANIC("task_switch_16");
 
-    macvm_set_cr0(cpu->hvf->fd, rvmcs(cpu->hvf->fd, VMCS_GUEST_CR0) |
+    macvm_set_cr0(cpu->accel->fd, rvmcs(cpu->accel->fd, VMCS_GUEST_CR0) |
                                 CR0_TS_MASK);
     x86_segment_descriptor_to_vmx(cpu, tss_sel, &next_tss_desc, &vmx_seg);
     vmx_write_segment_descriptor(cpu, &vmx_seg, R_TR);
 
     store_regs(cpu);
 
-    hv_vcpu_invalidate_tlb(cpu->hvf->fd);
+    hv_vcpu_invalidate_tlb(cpu->accel->fd);
 }
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 92dfd26a01..3b1ef5f49a 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -77,7 +77,7 @@ void hvf_put_xsave(CPUState *cs)
 
     x86_cpu_xsave_all_areas(X86_CPU(cs), xsave, xsave_len);
 
-    if (hv_vcpu_write_fpstate(cs->hvf->fd, xsave, xsave_len)) {
+    if (hv_vcpu_write_fpstate(cs->accel->fd, xsave, xsave_len)) {
         abort();
     }
 }
@@ -87,19 +87,19 @@ static void hvf_put_segments(CPUState *cs)
     CPUX86State *env = &X86_CPU(cs)->env;
     struct vmx_segment seg;
     
-    wvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_LIMIT, env->idt.limit);
-    wvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_BASE, env->idt.base);
+    wvmcs(cs->accel->fd, VMCS_GUEST_IDTR_LIMIT, env->idt.limit);
+    wvmcs(cs->accel->fd, VMCS_GUEST_IDTR_BASE, env->idt.base);
 
-    wvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_LIMIT, env->gdt.limit);
-    wvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_BASE, env->gdt.base);
+    wvmcs(cs->accel->fd, VMCS_GUEST_GDTR_LIMIT, env->gdt.limit);
+    wvmcs(cs->accel->fd, VMCS_GUEST_GDTR_BASE, env->gdt.base);
 
-    /* wvmcs(cs->hvf->fd, VMCS_GUEST_CR2, env->cr[2]); */
-    wvmcs(cs->hvf->fd, VMCS_GUEST_CR3, env->cr[3]);
+    /* wvmcs(cs->accel->fd, VMCS_GUEST_CR2, env->cr[2]); */
+    wvmcs(cs->accel->fd, VMCS_GUEST_CR3, env->cr[3]);
     vmx_update_tpr(cs);
-    wvmcs(cs->hvf->fd, VMCS_GUEST_IA32_EFER, env->efer);
+    wvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER, env->efer);
 
-    macvm_set_cr4(cs->hvf->fd, env->cr[4]);
-    macvm_set_cr0(cs->hvf->fd, env->cr[0]);
+    macvm_set_cr4(cs->accel->fd, env->cr[4]);
+    macvm_set_cr0(cs->accel->fd, env->cr[0]);
 
     hvf_set_segment(cs, &seg, &env->segs[R_CS], false);
     vmx_write_segment_descriptor(cs, &seg, R_CS);
@@ -130,24 +130,24 @@ void hvf_put_msrs(CPUState *cs)
 {
     CPUX86State *env = &X86_CPU(cs)->env;
 
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_IA32_SYSENTER_CS,
+    hv_vcpu_write_msr(cs->accel->fd, MSR_IA32_SYSENTER_CS,
                       env->sysenter_cs);
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_IA32_SYSENTER_ESP,
+    hv_vcpu_write_msr(cs->accel->fd, MSR_IA32_SYSENTER_ESP,
                       env->sysenter_esp);
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_IA32_SYSENTER_EIP,
+    hv_vcpu_write_msr(cs->accel->fd, MSR_IA32_SYSENTER_EIP,
                       env->sysenter_eip);
 
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_STAR, env->star);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_STAR, env->star);
 
 #ifdef TARGET_X86_64
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_CSTAR, env->cstar);
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_KERNELGSBASE, env->kernelgsbase);
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_FMASK, env->fmask);
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_LSTAR, env->lstar);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_CSTAR, env->cstar);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_KERNELGSBASE, env->kernelgsbase);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_FMASK, env->fmask);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_LSTAR, env->lstar);
 #endif
 
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_GSBASE, env->segs[R_GS].base);
-    hv_vcpu_write_msr(cs->hvf->fd, MSR_FSBASE, env->segs[R_FS].base);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_GSBASE, env->segs[R_GS].base);
+    hv_vcpu_write_msr(cs->accel->fd, MSR_FSBASE, env->segs[R_FS].base);
 }
 
 
@@ -156,7 +156,7 @@ void hvf_get_xsave(CPUState *cs)
     void *xsave = X86_CPU(cs)->env.xsave_buf;
     uint32_t xsave_len = X86_CPU(cs)->env.xsave_buf_len;
 
-    if (hv_vcpu_read_fpstate(cs->hvf->fd, xsave, xsave_len)) {
+    if (hv_vcpu_read_fpstate(cs->accel->fd, xsave, xsave_len)) {
         abort();
     }
 
@@ -195,17 +195,17 @@ static void hvf_get_segments(CPUState *cs)
     vmx_read_segment_descriptor(cs, &seg, R_LDTR);
     hvf_get_segment(&env->ldt, &seg);
 
-    env->idt.limit = rvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_LIMIT);
-    env->idt.base = rvmcs(cs->hvf->fd, VMCS_GUEST_IDTR_BASE);
-    env->gdt.limit = rvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_LIMIT);
-    env->gdt.base = rvmcs(cs->hvf->fd, VMCS_GUEST_GDTR_BASE);
+    env->idt.limit = rvmcs(cs->accel->fd, VMCS_GUEST_IDTR_LIMIT);
+    env->idt.base = rvmcs(cs->accel->fd, VMCS_GUEST_IDTR_BASE);
+    env->gdt.limit = rvmcs(cs->accel->fd, VMCS_GUEST_GDTR_LIMIT);
+    env->gdt.base = rvmcs(cs->accel->fd, VMCS_GUEST_GDTR_BASE);
 
-    env->cr[0] = rvmcs(cs->hvf->fd, VMCS_GUEST_CR0);
+    env->cr[0] = rvmcs(cs->accel->fd, VMCS_GUEST_CR0);
     env->cr[2] = 0;
-    env->cr[3] = rvmcs(cs->hvf->fd, VMCS_GUEST_CR3);
-    env->cr[4] = rvmcs(cs->hvf->fd, VMCS_GUEST_CR4);
+    env->cr[3] = rvmcs(cs->accel->fd, VMCS_GUEST_CR3);
+    env->cr[4] = rvmcs(cs->accel->fd, VMCS_GUEST_CR4);
     
-    env->efer = rvmcs(cs->hvf->fd, VMCS_GUEST_IA32_EFER);
+    env->efer = rvmcs(cs->accel->fd, VMCS_GUEST_IA32_EFER);
 }
 
 void hvf_get_msrs(CPUState *cs)
@@ -213,27 +213,27 @@ void hvf_get_msrs(CPUState *cs)
     CPUX86State *env = &X86_CPU(cs)->env;
     uint64_t tmp;
     
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_SYSENTER_CS, &tmp);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_IA32_SYSENTER_CS, &tmp);
     env->sysenter_cs = tmp;
     
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_SYSENTER_ESP, &tmp);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_IA32_SYSENTER_ESP, &tmp);
     env->sysenter_esp = tmp;
 
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_SYSENTER_EIP, &tmp);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_IA32_SYSENTER_EIP, &tmp);
     env->sysenter_eip = tmp;
 
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_STAR, &env->star);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_STAR, &env->star);
 
 #ifdef TARGET_X86_64
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_CSTAR, &env->cstar);
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_KERNELGSBASE, &env->kernelgsbase);
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_FMASK, &env->fmask);
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_LSTAR, &env->lstar);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_CSTAR, &env->cstar);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_KERNELGSBASE, &env->kernelgsbase);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_FMASK, &env->fmask);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_LSTAR, &env->lstar);
 #endif
 
-    hv_vcpu_read_msr(cs->hvf->fd, MSR_IA32_APICBASE, &tmp);
+    hv_vcpu_read_msr(cs->accel->fd, MSR_IA32_APICBASE, &tmp);
     
-    env->tsc = rdtscp() + rvmcs(cs->hvf->fd, VMCS_TSC_OFFSET);
+    env->tsc = rdtscp() + rvmcs(cs->accel->fd, VMCS_TSC_OFFSET);
 }
 
 int hvf_put_registers(CPUState *cs)
@@ -241,26 +241,26 @@ int hvf_put_registers(CPUState *cs)
     X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;
 
-    wreg(cs->hvf->fd, HV_X86_RAX, env->regs[R_EAX]);
-    wreg(cs->hvf->fd, HV_X86_RBX, env->regs[R_EBX]);
-    wreg(cs->hvf->fd, HV_X86_RCX, env->regs[R_ECX]);
-    wreg(cs->hvf->fd, HV_X86_RDX, env->regs[R_EDX]);
-    wreg(cs->hvf->fd, HV_X86_RBP, env->regs[R_EBP]);
-    wreg(cs->hvf->fd, HV_X86_RSP, env->regs[R_ESP]);
-    wreg(cs->hvf->fd, HV_X86_RSI, env->regs[R_ESI]);
-    wreg(cs->hvf->fd, HV_X86_RDI, env->regs[R_EDI]);
-    wreg(cs->hvf->fd, HV_X86_R8, env->regs[8]);
-    wreg(cs->hvf->fd, HV_X86_R9, env->regs[9]);
-    wreg(cs->hvf->fd, HV_X86_R10, env->regs[10]);
-    wreg(cs->hvf->fd, HV_X86_R11, env->regs[11]);
-    wreg(cs->hvf->fd, HV_X86_R12, env->regs[12]);
-    wreg(cs->hvf->fd, HV_X86_R13, env->regs[13]);
-    wreg(cs->hvf->fd, HV_X86_R14, env->regs[14]);
-    wreg(cs->hvf->fd, HV_X86_R15, env->regs[15]);
-    wreg(cs->hvf->fd, HV_X86_RFLAGS, env->eflags);
-    wreg(cs->hvf->fd, HV_X86_RIP, env->eip);
+    wreg(cs->accel->fd, HV_X86_RAX, env->regs[R_EAX]);
+    wreg(cs->accel->fd, HV_X86_RBX, env->regs[R_EBX]);
+    wreg(cs->accel->fd, HV_X86_RCX, env->regs[R_ECX]);
+    wreg(cs->accel->fd, HV_X86_RDX, env->regs[R_EDX]);
+    wreg(cs->accel->fd, HV_X86_RBP, env->regs[R_EBP]);
+    wreg(cs->accel->fd, HV_X86_RSP, env->regs[R_ESP]);
+    wreg(cs->accel->fd, HV_X86_RSI, env->regs[R_ESI]);
+    wreg(cs->accel->fd, HV_X86_RDI, env->regs[R_EDI]);
+    wreg(cs->accel->fd, HV_X86_R8, env->regs[8]);
+    wreg(cs->accel->fd, HV_X86_R9, env->regs[9]);
+    wreg(cs->accel->fd, HV_X86_R10, env->regs[10]);
+    wreg(cs->accel->fd, HV_X86_R11, env->regs[11]);
+    wreg(cs->accel->fd, HV_X86_R12, env->regs[12]);
+    wreg(cs->accel->fd, HV_X86_R13, env->regs[13]);
+    wreg(cs->accel->fd, HV_X86_R14, env->regs[14]);
+    wreg(cs->accel->fd, HV_X86_R15, env->regs[15]);
+    wreg(cs->accel->fd, HV_X86_RFLAGS, env->eflags);
+    wreg(cs->accel->fd, HV_X86_RIP, env->eip);
    
-    wreg(cs->hvf->fd, HV_X86_XCR0, env->xcr0);
+    wreg(cs->accel->fd, HV_X86_XCR0, env->xcr0);
     
     hvf_put_xsave(cs);
     
@@ -268,14 +268,14 @@ int hvf_put_registers(CPUState *cs)
     
     hvf_put_msrs(cs);
     
-    wreg(cs->hvf->fd, HV_X86_DR0, env->dr[0]);
-    wreg(cs->hvf->fd, HV_X86_DR1, env->dr[1]);
-    wreg(cs->hvf->fd, HV_X86_DR2, env->dr[2]);
-    wreg(cs->hvf->fd, HV_X86_DR3, env->dr[3]);
-    wreg(cs->hvf->fd, HV_X86_DR4, env->dr[4]);
-    wreg(cs->hvf->fd, HV_X86_DR5, env->dr[5]);
-    wreg(cs->hvf->fd, HV_X86_DR6, env->dr[6]);
-    wreg(cs->hvf->fd, HV_X86_DR7, env->dr[7]);
+    wreg(cs->accel->fd, HV_X86_DR0, env->dr[0]);
+    wreg(cs->accel->fd, HV_X86_DR1, env->dr[1]);
+    wreg(cs->accel->fd, HV_X86_DR2, env->dr[2]);
+    wreg(cs->accel->fd, HV_X86_DR3, env->dr[3]);
+    wreg(cs->accel->fd, HV_X86_DR4, env->dr[4]);
+    wreg(cs->accel->fd, HV_X86_DR5, env->dr[5]);
+    wreg(cs->accel->fd, HV_X86_DR6, env->dr[6]);
+    wreg(cs->accel->fd, HV_X86_DR7, env->dr[7]);
     
     return 0;
 }
@@ -285,40 +285,40 @@ int hvf_get_registers(CPUState *cs)
     X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;
 
-    env->regs[R_EAX] = rreg(cs->hvf->fd, HV_X86_RAX);
-    env->regs[R_EBX] = rreg(cs->hvf->fd, HV_X86_RBX);
-    env->regs[R_ECX] = rreg(cs->hvf->fd, HV_X86_RCX);
-    env->regs[R_EDX] = rreg(cs->hvf->fd, HV_X86_RDX);
-    env->regs[R_EBP] = rreg(cs->hvf->fd, HV_X86_RBP);
-    env->regs[R_ESP] = rreg(cs->hvf->fd, HV_X86_RSP);
-    env->regs[R_ESI] = rreg(cs->hvf->fd, HV_X86_RSI);
-    env->regs[R_EDI] = rreg(cs->hvf->fd, HV_X86_RDI);
-    env->regs[8] = rreg(cs->hvf->fd, HV_X86_R8);
-    env->regs[9] = rreg(cs->hvf->fd, HV_X86_R9);
-    env->regs[10] = rreg(cs->hvf->fd, HV_X86_R10);
-    env->regs[11] = rreg(cs->hvf->fd, HV_X86_R11);
-    env->regs[12] = rreg(cs->hvf->fd, HV_X86_R12);
-    env->regs[13] = rreg(cs->hvf->fd, HV_X86_R13);
-    env->regs[14] = rreg(cs->hvf->fd, HV_X86_R14);
-    env->regs[15] = rreg(cs->hvf->fd, HV_X86_R15);
+    env->regs[R_EAX] = rreg(cs->accel->fd, HV_X86_RAX);
+    env->regs[R_EBX] = rreg(cs->accel->fd, HV_X86_RBX);
+    env->regs[R_ECX] = rreg(cs->accel->fd, HV_X86_RCX);
+    env->regs[R_EDX] = rreg(cs->accel->fd, HV_X86_RDX);
+    env->regs[R_EBP] = rreg(cs->accel->fd, HV_X86_RBP);
+    env->regs[R_ESP] = rreg(cs->accel->fd, HV_X86_RSP);
+    env->regs[R_ESI] = rreg(cs->accel->fd, HV_X86_RSI);
+    env->regs[R_EDI] = rreg(cs->accel->fd, HV_X86_RDI);
+    env->regs[8] = rreg(cs->accel->fd, HV_X86_R8);
+    env->regs[9] = rreg(cs->accel->fd, HV_X86_R9);
+    env->regs[10] = rreg(cs->accel->fd, HV_X86_R10);
+    env->regs[11] = rreg(cs->accel->fd, HV_X86_R11);
+    env->regs[12] = rreg(cs->accel->fd, HV_X86_R12);
+    env->regs[13] = rreg(cs->accel->fd, HV_X86_R13);
+    env->regs[14] = rreg(cs->accel->fd, HV_X86_R14);
+    env->regs[15] = rreg(cs->accel->fd, HV_X86_R15);
     
-    env->eflags = rreg(cs->hvf->fd, HV_X86_RFLAGS);
-    env->eip = rreg(cs->hvf->fd, HV_X86_RIP);
+    env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS);
+    env->eip = rreg(cs->accel->fd, HV_X86_RIP);
    
     hvf_get_xsave(cs);
-    env->xcr0 = rreg(cs->hvf->fd, HV_X86_XCR0);
+    env->xcr0 = rreg(cs->accel->fd, HV_X86_XCR0);
     
     hvf_get_segments(cs);
     hvf_get_msrs(cs);
     
-    env->dr[0] = rreg(cs->hvf->fd, HV_X86_DR0);
-    env->dr[1] = rreg(cs->hvf->fd, HV_X86_DR1);
-    env->dr[2] = rreg(cs->hvf->fd, HV_X86_DR2);
-    env->dr[3] = rreg(cs->hvf->fd, HV_X86_DR3);
-    env->dr[4] = rreg(cs->hvf->fd, HV_X86_DR4);
-    env->dr[5] = rreg(cs->hvf->fd, HV_X86_DR5);
-    env->dr[6] = rreg(cs->hvf->fd, HV_X86_DR6);
-    env->dr[7] = rreg(cs->hvf->fd, HV_X86_DR7);
+    env->dr[0] = rreg(cs->accel->fd, HV_X86_DR0);
+    env->dr[1] = rreg(cs->accel->fd, HV_X86_DR1);
+    env->dr[2] = rreg(cs->accel->fd, HV_X86_DR2);
+    env->dr[3] = rreg(cs->accel->fd, HV_X86_DR3);
+    env->dr[4] = rreg(cs->accel->fd, HV_X86_DR4);
+    env->dr[5] = rreg(cs->accel->fd, HV_X86_DR5);
+    env->dr[6] = rreg(cs->accel->fd, HV_X86_DR6);
+    env->dr[7] = rreg(cs->accel->fd, HV_X86_DR7);
     
     x86_update_hflags(env);
     return 0;
@@ -327,16 +327,16 @@ int hvf_get_registers(CPUState *cs)
 static void vmx_set_int_window_exiting(CPUState *cs)
 {
      uint64_t val;
-     val = rvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
-     wvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val |
+     val = rvmcs(cs->accel->fd, VMCS_PRI_PROC_BASED_CTLS);
+     wvmcs(cs->accel->fd, VMCS_PRI_PROC_BASED_CTLS, val |
              VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING);
 }
 
 void vmx_clear_int_window_exiting(CPUState *cs)
 {
      uint64_t val;
-     val = rvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS);
-     wvmcs(cs->hvf->fd, VMCS_PRI_PROC_BASED_CTLS, val &
+     val = rvmcs(cs->accel->fd, VMCS_PRI_PROC_BASED_CTLS);
+     wvmcs(cs->accel->fd, VMCS_PRI_PROC_BASED_CTLS, val &
              ~VMCS_PRI_PROC_BASED_CTLS_INT_WINDOW_EXITING);
 }
 
@@ -372,7 +372,7 @@ bool hvf_inject_interrupts(CPUState *cs)
     uint64_t info = 0;
     if (have_event) {
         info = vector | intr_type | VMCS_INTR_VALID;
-        uint64_t reason = rvmcs(cs->hvf->fd, VMCS_EXIT_REASON);
+        uint64_t reason = rvmcs(cs->accel->fd, VMCS_EXIT_REASON);
         if (env->nmi_injected && reason != EXIT_REASON_TASK_SWITCH) {
             vmx_clear_nmi_blocking(cs);
         }
@@ -381,17 +381,17 @@ bool hvf_inject_interrupts(CPUState *cs)
             info &= ~(1 << 12); /* clear undefined bit */
             if (intr_type == VMCS_INTR_T_SWINTR ||
                 intr_type == VMCS_INTR_T_SWEXCEPTION) {
-                wvmcs(cs->hvf->fd, VMCS_ENTRY_INST_LENGTH, env->ins_len);
+                wvmcs(cs->accel->fd, VMCS_ENTRY_INST_LENGTH, env->ins_len);
             }
             
             if (env->has_error_code) {
-                wvmcs(cs->hvf->fd, VMCS_ENTRY_EXCEPTION_ERROR,
+                wvmcs(cs->accel->fd, VMCS_ENTRY_EXCEPTION_ERROR,
                       env->error_code);
                 /* Indicate that VMCS_ENTRY_EXCEPTION_ERROR is valid */
                 info |= VMCS_INTR_DEL_ERRCODE;
             }
             /*printf("reinject  %lx err %d\n", info, err);*/
-            wvmcs(cs->hvf->fd, VMCS_ENTRY_INTR_INFO, info);
+            wvmcs(cs->accel->fd, VMCS_ENTRY_INTR_INFO, info);
         };
     }
 
@@ -399,7 +399,7 @@ bool hvf_inject_interrupts(CPUState *cs)
         if (!(env->hflags2 & HF2_NMI_MASK) && !(info & VMCS_INTR_VALID)) {
             cs->interrupt_request &= ~CPU_INTERRUPT_NMI;
             info = VMCS_INTR_VALID | VMCS_INTR_T_NMI | EXCP02_NMI;
-            wvmcs(cs->hvf->fd, VMCS_ENTRY_INTR_INFO, info);
+            wvmcs(cs->accel->fd, VMCS_ENTRY_INTR_INFO, info);
         } else {
             vmx_set_nmi_window_exiting(cs);
         }
@@ -411,7 +411,7 @@ bool hvf_inject_interrupts(CPUState *cs)
         int line = cpu_get_pic_interrupt(&x86cpu->env);
         cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
         if (line >= 0) {
-            wvmcs(cs->hvf->fd, VMCS_ENTRY_INTR_INFO, line |
+            wvmcs(cs->accel->fd, VMCS_ENTRY_INTR_INFO, line |
                   VMCS_INTR_VALID | VMCS_INTR_T_HWINTR);
         }
     }
@@ -429,7 +429,7 @@ int hvf_process_events(CPUState *cs)
 
     if (!cs->vcpu_dirty) {
         /* light weight sync for CPU_INTERRUPT_HARD and IF_MASK */
-        env->eflags = rreg(cs->hvf->fd, HV_X86_RFLAGS);
+        env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS);
     }
 
     if (cs->interrupt_request & CPU_INTERRUPT_INIT) {

From 217a190eece1a13297b7b075bce50226e5e78048 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 6 Jun 2023 07:32:17 +0200
Subject: [PATCH 0299/1353] accel/kvm: Re-include "exec/memattrs.h" header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 1e05888ab5 ("sysemu/kvm: Remove unused headers") was
a bit overzealous while cleaning "sysemu/kvm.h" headers:
kvm_arch_post_run() returns a MemTxAttrs type, so depends on
"exec/memattrs.h" for its definition.

Fixes: 1e05888ab5 ("sysemu/kvm: Remove unused headers")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230619074153.44268-5-philmd@linaro.org>
---
 include/sysemu/kvm.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 7902acdfd9..115f0cca79 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -16,6 +16,7 @@
 #ifndef QEMU_KVM_H
 #define QEMU_KVM_H
 
+#include "exec/memattrs.h"
 #include "qemu/accel.h"
 #include "qom/object.h"
 

From dec68f7042aba11ae706842a9616587ce3685685 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 14:08:40 +0200
Subject: [PATCH 0300/1353] accel/kvm: Declare kvm_direct_msi_allowed in stubs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid when calling kvm_direct_msi_enabled() from
arm_gicv3_its_common.c the next commit:

  Undefined symbols for architecture arm64:
    "_kvm_direct_msi_allowed", referenced from:
        _its_class_name in hw_intc_arm_gicv3_its_common.c.o
  ld: symbol(s) not found for architecture arm64

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230405160454.97436-3-philmd@linaro.org>
---
 accel/stubs/kvm-stub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index 5d2dd8f351..235dc661bc 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -27,6 +27,7 @@ bool kvm_allowed;
 bool kvm_readonly_mem_allowed;
 bool kvm_ioeventfd_any_length_allowed;
 bool kvm_msi_use_devid;
+bool kvm_direct_msi_allowed;
 
 void kvm_flush_coalesced_mmio_buffer(void)
 {

From 0c40daf03810ed56535c40f6debdcc62ce4c5e6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 13:48:26 +0200
Subject: [PATCH 0301/1353] hw/intc/arm_gic: Un-inline GIC*/ITS class_name()
 helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"kvm_arm.h" contains external and internal prototype declarations.
Files under the hw/ directory should only access the KVM external
API.

In order to avoid machine / device models to include "kvm_arm.h"
simply to get the QOM GIC/ITS class name, un-inline each class
name getter to the proper device model file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230405160454.97436-4-philmd@linaro.org>
---
 hw/arm/sbsa-ref.c                      |  1 +
 hw/arm/virt-acpi-build.c               |  2 +-
 hw/arm/virt.c                          |  1 +
 hw/intc/arm_gic_common.c               |  7 ++++
 hw/intc/arm_gicv3_common.c             | 14 ++++++++
 hw/intc/arm_gicv3_its_common.c         | 12 +++++++
 include/hw/intc/arm_gic.h              |  2 ++
 include/hw/intc/arm_gicv3_common.h     | 10 ++++++
 include/hw/intc/arm_gicv3_its_common.h |  9 ++++++
 target/arm/kvm_arm.h                   | 45 --------------------------
 10 files changed, 57 insertions(+), 46 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index b774d80291..66500a5b08 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -36,6 +36,7 @@
 #include "hw/ide/internal.h"
 #include "hw/ide/ahci_internal.h"
 #include "hw/intc/arm_gicv3_common.h"
+#include "hw/intc/arm_gicv3_its_common.h"
 #include "hw/loader.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 4af0de8b24..55f2706bc9 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -48,12 +48,12 @@
 #include "hw/pci/pci_bus.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/arm/virt.h"
+#include "hw/intc/arm_gicv3_its_common.h"
 #include "hw/mem/nvdimm.h"
 #include "hw/platform-bus.h"
 #include "sysemu/numa.h"
 #include "sysemu/reset.h"
 #include "sysemu/tpm.h"
-#include "kvm_arm.h"
 #include "migration/vmstate.h"
 #include "hw/acpi/ghes.h"
 #include "hw/acpi/viot.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 3937e30477..3196db556e 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -63,6 +63,7 @@
 #include "hw/arm/fdt.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/intc/arm_gicv3_common.h"
+#include "hw/intc/arm_gicv3_its_common.h"
 #include "hw/irq.h"
 #include "kvm_arm.h"
 #include "hw/firmware/smbios.h"
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index a379cea395..9702197856 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -21,10 +21,12 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "qemu/error-report.h"
 #include "gic_internal.h"
 #include "hw/arm/linux-boot-if.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
+#include "sysemu/kvm.h"
 
 static int gic_pre_save(void *opaque)
 {
@@ -393,3 +395,8 @@ static void register_types(void)
 }
 
 type_init(register_types)
+
+const char *gic_class_name(void)
+{
+    return kvm_irqchip_in_kernel() ? "kvm-arm-gic" : "arm_gic";
+}
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index 642a8243ed..2ebf880ead 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -24,6 +24,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "qemu/error-report.h"
 #include "hw/core/cpu.h"
 #include "hw/intc/arm_gicv3_common.h"
 #include "hw/qdev-properties.h"
@@ -608,3 +609,16 @@ static void register_types(void)
 }
 
 type_init(register_types)
+
+const char *gicv3_class_name(void)
+{
+    if (kvm_irqchip_in_kernel()) {
+        return "kvm-arm-gicv3";
+    } else {
+        if (kvm_enabled()) {
+            error_report("Userspace GICv3 is not supported with KVM");
+            exit(1);
+        }
+        return "arm-gicv3";
+    }
+}
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index d7532a7a89..abaf77057e 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -24,6 +24,7 @@
 #include "hw/intc/arm_gicv3_its_common.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "sysemu/kvm.h"
 
 static int gicv3_its_pre_save(void *opaque)
 {
@@ -158,3 +159,14 @@ static void gicv3_its_common_register_types(void)
 }
 
 type_init(gicv3_its_common_register_types)
+
+const char *its_class_name(void)
+{
+    if (kvm_irqchip_in_kernel()) {
+        /* KVM implementation requires this capability */
+        return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
+    } else {
+        /* Software emulation based model */
+        return "arm-gicv3-its";
+    }
+}
diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
index 116ccbb5a9..48f6a51a70 100644
--- a/include/hw/intc/arm_gic.h
+++ b/include/hw/intc/arm_gic.h
@@ -86,4 +86,6 @@ struct ARMGICClass {
     DeviceRealize parent_realize;
 };
 
+const char *gic_class_name(void);
+
 #endif
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index ab5182a28a..4e2fb518e7 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -329,4 +329,14 @@ struct ARMGICv3CommonClass {
 void gicv3_init_irqs_and_mmio(GICv3State *s, qemu_irq_handler handler,
                               const MemoryRegionOps *ops);
 
+/**
+ * gicv3_class_name
+ *
+ * Return name of GICv3 class to use depending on whether KVM acceleration is
+ * in use. May throw an error if the chosen implementation is not available.
+ *
+ * Returns: class name to use
+ */
+const char *gicv3_class_name(void);
+
 #endif
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index a11a0f6654..7dc712b38d 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -122,5 +122,14 @@ struct GICv3ITSCommonClass {
     void (*post_load)(GICv3ITSState *s);
 };
 
+/**
+ * its_class_name:
+ *
+ * Return the ITS class name to use depending on whether KVM acceleration
+ * and KVM CAP_SIGNAL_MSI are supported
+ *
+ * Returns: class name to use or NULL
+ */
+const char *its_class_name(void);
 
 #endif
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index 330fbe5c72..051a0da41c 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -453,32 +453,6 @@ static inline uint32_t kvm_arm_sve_get_vls(CPUState *cs)
 
 #endif
 
-static inline const char *gic_class_name(void)
-{
-    return kvm_irqchip_in_kernel() ? "kvm-arm-gic" : "arm_gic";
-}
-
-/**
- * gicv3_class_name
- *
- * Return name of GICv3 class to use depending on whether KVM acceleration is
- * in use. May throw an error if the chosen implementation is not available.
- *
- * Returns: class name to use
- */
-static inline const char *gicv3_class_name(void)
-{
-    if (kvm_irqchip_in_kernel()) {
-        return "kvm-arm-gicv3";
-    } else {
-        if (kvm_enabled()) {
-            error_report("Userspace GICv3 is not supported with KVM");
-            exit(1);
-        }
-        return "arm-gicv3";
-    }
-}
-
 /**
  * kvm_arm_handle_debug:
  * @cs: CPUState
@@ -516,23 +490,4 @@ void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr);
  */
 bool kvm_arm_verify_ext_dabt_pending(CPUState *cs);
 
-/**
- * its_class_name:
- *
- * Return the ITS class name to use depending on whether KVM acceleration
- * and KVM CAP_SIGNAL_MSI are supported
- *
- * Returns: class name to use or NULL
- */
-static inline const char *its_class_name(void)
-{
-    if (kvm_irqchip_in_kernel()) {
-        /* KVM implementation requires this capability */
-        return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
-    } else {
-        /* Software emulation based model */
-        return "arm-gicv3-its";
-    }
-}
-
 #endif

From 674e44c99a204c2796c99cf8be65dea487718975 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 13:37:41 +0200
Subject: [PATCH 0302/1353] hw/intc/arm_gic: Rename 'first_cpu' argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"hw/core/cpu.h" defines 'first_cpu' as QTAILQ_FIRST_RCU(&cpus).

arm_gic_common_reset_irq_state() calls its second argument
'first_cpu', producing a build failure when "hw/core/cpu.h"
is included:

  hw/intc/arm_gic_common.c:238:68: warning: omitting the parameter name in a function definition is a C2x extension [-Wc2x-extensions]
    static inline void arm_gic_common_reset_irq_state(GICState *s, int first_cpu,
                                                                       ^
  include/hw/core/cpu.h:451:26: note: expanded from macro 'first_cpu'
    #define first_cpu        QTAILQ_FIRST_RCU(&cpus)
                             ^

KISS, rename the function argument.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230405160454.97436-5-philmd@linaro.org>
---
 hw/intc/arm_gic_common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index 9702197856..7c28504ace 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -235,12 +235,12 @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static inline void arm_gic_common_reset_irq_state(GICState *s, int first_cpu,
+static inline void arm_gic_common_reset_irq_state(GICState *s, int cidx,
                                                   int resetprio)
 {
     int i, j;
 
-    for (i = first_cpu; i < first_cpu + s->num_cpu; i++) {
+    for (i = cidx; i < cidx + s->num_cpu; i++) {
         if (s->revision == REV_11MPCORE) {
             s->priority_mask[i] = 0xf0;
         } else {

From 94522562f68043c0420795c9b4ec8f1d6b40e2fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 5 Apr 2023 13:39:29 +0200
Subject: [PATCH 0303/1353] hw/arm/sbsa-ref: Include missing 'sysemu/kvm.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"sysemu/kvm.h" is indirectly pulled in. Explicit its
inclusion to avoid when refactoring include/:

  hw/arm/sbsa-ref.c:693:9: error: implicit declaration of function 'kvm_enabled' is invalid in C99 [-Werror,-Wimplicit-function-declaration]
    if (kvm_enabled()) {
        ^

Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230405160454.97436-6-philmd@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 66500a5b08..82a28b2e0b 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -23,6 +23,7 @@
 #include "qemu/error-report.h"
 #include "qemu/units.h"
 #include "sysemu/device_tree.h"
+#include "sysemu/kvm.h"
 #include "sysemu/numa.h"
 #include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"

From cf43b5b69c0f4acee52e3648b88f4a0bf3de770b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 4 Apr 2023 11:12:38 +0200
Subject: [PATCH 0304/1353] target/arm: Restrict KVM-specific fields from
 ArchCPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These fields shouldn't be accessed when KVM is not available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230405160454.97436-8-philmd@linaro.org>
---
 target/arm/cpu.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 00e675f58f..4d6c0f95d5 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -961,6 +961,7 @@ struct ArchCPU {
      */
     uint32_t kvm_target;
 
+#ifdef CONFIG_KVM
     /* KVM init features for this CPU */
     uint32_t kvm_init_features[7];
 
@@ -973,6 +974,7 @@ struct ArchCPU {
 
     /* KVM steal time */
     OnOffAuto kvm_steal_time;
+#endif /* CONFIG_KVM */
 
     /* Uniprocessor system with MP extensions */
     bool mp_is_up;

From 0573997713eb0a37ab98b545794e18b868b471ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 4 Apr 2023 11:14:58 +0200
Subject: [PATCH 0305/1353] target/ppc: Restrict KVM-specific fields from
 ArchCPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'kvm_sw_tlb' and 'tlb_dirty' fields introduced in commit
93dd5e852c ("kvm: ppc: booke206: use MMU API") are specific
to KVM and shouldn't be accessed when it is not available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Message-Id: <20230624192645.13680-1-philmd@linaro.org>
---
 hw/ppc/e500.c           | 2 ++
 hw/ppc/ppce500_spin.c   | 2 ++
 target/ppc/cpu.h        | 2 ++
 target/ppc/mmu_common.c | 4 ++++
 4 files changed, 10 insertions(+)

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index b6eb599751..67793a86f1 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -765,7 +765,9 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env)
     tlb->mas7_3 = 0;
     tlb->mas7_3 |= MAS3_UR | MAS3_UW | MAS3_UX | MAS3_SR | MAS3_SW | MAS3_SX;
 
+#ifdef CONFIG_KVM
     env->tlb_dirty = true;
+#endif
 }
 
 static void ppce500_cpu_reset_sec(void *opaque)
diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index d57b199797..bbce63e8a4 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -83,7 +83,9 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
     tlb->mas2 = (va & TARGET_PAGE_MASK) | MAS2_M;
     tlb->mas7_3 = pa & TARGET_PAGE_MASK;
     tlb->mas7_3 |= MAS3_UR | MAS3_UW | MAS3_UX | MAS3_SR | MAS3_SW | MAS3_SX;
+#ifdef CONFIG_KVM
     env->tlb_dirty = true;
+#endif
 }
 
 static void spin_kick(CPUState *cs, run_on_cpu_data data)
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 94497aa115..af12c93ebc 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1149,8 +1149,10 @@ struct CPUArchState {
     int nb_pids;     /* Number of available PID registers */
     int tlb_type;    /* Type of TLB we're dealing with */
     ppc_tlb_t tlb;   /* TLB is optional. Allocate them only if needed */
+#ifdef CONFIG_KVM
     bool tlb_dirty;  /* Set to non-zero when modifying TLB */
     bool kvm_sw_tlb; /* non-zero if KVM SW TLB API is active */
+#endif /* CONFIG_KVM */
     uint32_t tlb_need_flush; /* Delayed flush needed */
 #define TLB_NEED_LOCAL_FLUSH   0x1
 #define TLB_NEED_GLOBAL_FLUSH  0x2
diff --git a/target/ppc/mmu_common.c b/target/ppc/mmu_common.c
index ae1db6e348..8c000e250d 100644
--- a/target/ppc/mmu_common.c
+++ b/target/ppc/mmu_common.c
@@ -930,10 +930,12 @@ static void mmubooke_dump_mmu(CPUPPCState *env)
     ppcemb_tlb_t *entry;
     int i;
 
+#ifdef CONFIG_KVM
     if (kvm_enabled() && !env->kvm_sw_tlb) {
         qemu_printf("Cannot access KVM TLB\n");
         return;
     }
+#endif
 
     qemu_printf("\nTLB:\n");
     qemu_printf("Effective          Physical           Size PID   Prot     "
@@ -1021,10 +1023,12 @@ static void mmubooke206_dump_mmu(CPUPPCState *env)
     int offset = 0;
     int i;
 
+#ifdef CONFIG_KVM
     if (kvm_enabled() && !env->kvm_sw_tlb) {
         qemu_printf("Cannot access KVM TLB\n");
         return;
     }
+#endif
 
     for (i = 0; i < BOOKE206_MAX_TLBN; i++) {
         int size = booke206_tlb_size(env, i);

From 9638cbde6c4f433b157672c0fdee783c10be45fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 4 Apr 2023 11:15:05 +0200
Subject: [PATCH 0306/1353] target/riscv: Restrict KVM-specific fields from
 ArchCPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These fields shouldn't be accessed when KVM is not available.

Restrict the KVM timer migration state. Rename the KVM timer
post_load() handler accordingly, because cpu_post_load() is
too generic.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230626232007.8933-3-philmd@linaro.org>
---
 target/riscv/cpu.c     | 2 +-
 target/riscv/cpu.h     | 2 ++
 target/riscv/machine.c | 8 ++++++--
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 881bddf393..4035fe0e62 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -584,7 +584,7 @@ static void riscv_host_cpu_init(Object *obj)
 #endif
     riscv_cpu_add_user_properties(obj);
 }
-#endif
+#endif /* CONFIG_KVM */
 
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
 {
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 7bff1d47f6..7adb8706ac 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -363,12 +363,14 @@ struct CPUArchState {
     hwaddr kernel_addr;
     hwaddr fdt_addr;
 
+#ifdef CONFIG_KVM
     /* kvm timer */
     bool kvm_timer_dirty;
     uint64_t kvm_timer_time;
     uint64_t kvm_timer_compare;
     uint64_t kvm_timer_state;
     uint64_t kvm_timer_frequency;
+#endif /* CONFIG_KVM */
 };
 
 /*
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index 3ce2970785..c7c862cdd3 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -194,12 +194,13 @@ static const VMStateDescription vmstate_rv128 = {
     }
 };
 
+#ifdef CONFIG_KVM
 static bool kvmtimer_needed(void *opaque)
 {
     return kvm_enabled();
 }
 
-static int cpu_post_load(void *opaque, int version_id)
+static int cpu_kvmtimer_post_load(void *opaque, int version_id)
 {
     RISCVCPU *cpu = opaque;
     CPURISCVState *env = &cpu->env;
@@ -213,7 +214,7 @@ static const VMStateDescription vmstate_kvmtimer = {
     .version_id = 1,
     .minimum_version_id = 1,
     .needed = kvmtimer_needed,
-    .post_load = cpu_post_load,
+    .post_load = cpu_kvmtimer_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT64(env.kvm_timer_time, RISCVCPU),
         VMSTATE_UINT64(env.kvm_timer_compare, RISCVCPU),
@@ -221,6 +222,7 @@ static const VMStateDescription vmstate_kvmtimer = {
         VMSTATE_END_OF_LIST()
     }
 };
+#endif
 
 static bool debug_needed(void *opaque)
 {
@@ -409,7 +411,9 @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_vector,
         &vmstate_pointermasking,
         &vmstate_rv128,
+#ifdef CONFIG_KVM
         &vmstate_kvmtimer,
+#endif
         &vmstate_envcfg,
         &vmstate_debug,
         &vmstate_smstateen,

From db5a06b3a21239ffa9424f89f98ee9afa14e955b Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 29 May 2023 20:43:31 +0800
Subject: [PATCH 0307/1353] target/i386/WHPX: Fix error message when fail to
 set ProcessorCount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

003f230e37d7 ("machine: Tweak the order of topology members in struct
CpuTopology") changes the meaning of MachineState.smp.cores from "the
number of cores in one package" to "the number of cores in one die"
and doesn't fix other uses of MachineState.smp.cores. And because of
the introduction of cluster, now smp.cores just means "the number of
cores in one cluster". This clearly does not fit the semantics here.

And before this error message, WHvSetPartitionProperty() is called to
set prop.ProcessorCount.

So the error message should show the prop.ProcessorCount other than
"cores per cluster" or "cores per package".

Cc: Sunil Muthuswamy <sunilmut@microsoft.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230529124331.412822-1-zhao1.liu@linux.intel.com>
[PMD: Use '%u' format for ProcessorCount]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 9ee04ee650..57580ca383 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2598,8 +2598,8 @@ static int whpx_accel_init(MachineState *ms)
         sizeof(WHV_PARTITION_PROPERTY));
 
     if (FAILED(hr)) {
-        error_report("WHPX: Failed to set partition core count to %d,"
-                     " hr=%08lx", ms->smp.cores, hr);
+        error_report("WHPX: Failed to set partition processor count to %u,"
+                     " hr=%08lx", prop.ProcessorCount, hr);
         ret = -EINVAL;
         goto error;
     }

From 5369a36c4fe5a70e8831059bcd2a2eef834aae21 Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Tue, 20 Jun 2023 09:50:47 -0700
Subject: [PATCH 0308/1353] exec/memory: Add symbolic value for memory listener
 priority for accel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MEMORY_LISTNER_PRIORITY_ACCEL for the symbolic value for the memory
listener to replace the hard-coded value 10 for accel.

No functional change intended.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <feebe423becc6e2aa375f59f6abce9a85bc15abb.1687279702.git.isaku.yamahata@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/hvf/hvf-accel-ops.c   | 2 +-
 accel/kvm/kvm-all.c         | 2 +-
 hw/arm/xen_arm.c            | 2 +-
 hw/i386/xen/xen-hvm.c       | 2 +-
 hw/xen/xen-hvm-common.c     | 2 +-
 hw/xen/xen_pt.c             | 4 ++--
 include/exec/memory.h       | 2 ++
 target/i386/hax/hax-mem.c   | 2 +-
 target/i386/nvmm/nvmm-all.c | 2 +-
 target/i386/whpx/whpx-all.c | 2 +-
 10 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 7db9d3099e..a44cf1c144 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -304,7 +304,7 @@ static void hvf_region_del(MemoryListener *listener,
 
 static MemoryListener hvf_memory_listener = {
     .name = "hvf",
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
     .region_add = hvf_region_add,
     .region_del = hvf_region_del,
     .log_start = hvf_log_start,
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 9aa898db14..964f61feee 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -1777,7 +1777,7 @@ void kvm_memory_listener_register(KVMState *s, KVMMemoryListener *kml,
     kml->listener.commit = kvm_region_commit;
     kml->listener.log_start = kvm_log_start;
     kml->listener.log_stop = kvm_log_stop;
-    kml->listener.priority = 10;
+    kml->listener.priority = MEMORY_LISTENER_PRIORITY_ACCEL;
     kml->listener.name = name;
 
     if (s->kvm_dirty_ring_size) {
diff --git a/hw/arm/xen_arm.c b/hw/arm/xen_arm.c
index 19b1cb81ad..044093fec7 100644
--- a/hw/arm/xen_arm.c
+++ b/hw/arm/xen_arm.c
@@ -45,7 +45,7 @@ static MemoryListener xen_memory_listener = {
     .log_sync = NULL,
     .log_global_start = NULL,
     .log_global_stop = NULL,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 struct XenArmState {
diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index 5dc5e80535..3da5a2b23f 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -467,7 +467,7 @@ static MemoryListener xen_memory_listener = {
     .log_sync = xen_log_sync,
     .log_global_start = xen_log_global_start,
     .log_global_stop = xen_log_global_stop,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 static void regs_to_cpu(vmware_regs_t *vmport_regs, ioreq_t *req)
diff --git a/hw/xen/xen-hvm-common.c b/hw/xen/xen-hvm-common.c
index 42339c96bd..886c3ee944 100644
--- a/hw/xen/xen-hvm-common.c
+++ b/hw/xen/xen-hvm-common.c
@@ -155,7 +155,7 @@ MemoryListener xen_io_listener = {
     .name = "xen-io",
     .region_add = xen_io_add,
     .region_del = xen_io_del,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 DeviceListener xen_device_listener = {
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index a540149639..36e6f93c37 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -691,14 +691,14 @@ static const MemoryListener xen_pt_memory_listener = {
     .name = "xen-pt-mem",
     .region_add = xen_pt_region_add,
     .region_del = xen_pt_region_del,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 static const MemoryListener xen_pt_io_listener = {
     .name = "xen-pt-io",
     .region_add = xen_pt_io_region_add,
     .region_del = xen_pt_io_region_del,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 /* destroy. */
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 47c2e0221c..6d95d59175 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -811,6 +811,8 @@ struct IOMMUMemoryRegion {
 #define IOMMU_NOTIFIER_FOREACH(n, mr) \
     QLIST_FOREACH((n), &(mr)->iommu_notify, node)
 
+#define MEMORY_LISTENER_PRIORITY_ACCEL          10
+
 /**
  * struct MemoryListener: callbacks structure for updates to the physical memory map
  *
diff --git a/target/i386/hax/hax-mem.c b/target/i386/hax/hax-mem.c
index 05dbe8cce3..bb5ffbc9ac 100644
--- a/target/i386/hax/hax-mem.c
+++ b/target/i386/hax/hax-mem.c
@@ -291,7 +291,7 @@ static MemoryListener hax_memory_listener = {
     .region_add = hax_region_add,
     .region_del = hax_region_del,
     .log_sync = hax_log_sync,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 static void hax_ram_block_added(RAMBlockNotifier *n, void *host, size_t size,
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 72a3a9e3ae..066a173d26 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -1128,7 +1128,7 @@ static MemoryListener nvmm_memory_listener = {
     .region_add = nvmm_region_add,
     .region_del = nvmm_region_del,
     .log_sync = nvmm_log_sync,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 static void
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 57580ca383..3de0dc1d46 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2412,7 +2412,7 @@ static MemoryListener whpx_memory_listener = {
     .region_add = whpx_region_add,
     .region_del = whpx_region_del,
     .log_sync = whpx_log_sync,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
 };
 
 static void whpx_memory_init(void)

From 8be0461d37705ae0a0c4e76b3ce5e4b558d51aba Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Tue, 20 Jun 2023 09:50:48 -0700
Subject: [PATCH 0309/1353] exec/memory: Add symbol for memory listener
 priority for device backend
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MEMORY_LISTENER_PRIORITY_DEV_BACKEND for the symbolic value
for memory listener to replace the hard-coded value 10 for the
device backend.

No functional change intended.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <8314d91688030d7004e96958f12e2c83fb889245.1687279702.git.isaku.yamahata@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/kvm/kvm-all.c               | 2 +-
 hw/remote/proxy-memory-listener.c | 2 +-
 hw/virtio/vhost.c                 | 2 +-
 include/exec/memory.h             | 1 +
 4 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 964f61feee..9d0837a39c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -1802,7 +1802,7 @@ static MemoryListener kvm_io_listener = {
     .name = "kvm-io",
     .eventfd_add = kvm_io_ioeventfd_add,
     .eventfd_del = kvm_io_ioeventfd_del,
-    .priority = 10,
+    .priority = MEMORY_LISTENER_PRIORITY_DEV_BACKEND,
 };
 
 int kvm_set_irq(KVMState *s, int irq, int level)
diff --git a/hw/remote/proxy-memory-listener.c b/hw/remote/proxy-memory-listener.c
index 18d96a1d04..a926f61ebe 100644
--- a/hw/remote/proxy-memory-listener.c
+++ b/hw/remote/proxy-memory-listener.c
@@ -217,7 +217,7 @@ void proxy_memory_listener_configure(ProxyMemoryListener *proxy_listener,
     proxy_listener->listener.commit = proxy_memory_listener_commit;
     proxy_listener->listener.region_add = proxy_memory_listener_region_addnop;
     proxy_listener->listener.region_nop = proxy_memory_listener_region_addnop;
-    proxy_listener->listener.priority = 10;
+    proxy_listener->listener.priority = MEMORY_LISTENER_PRIORITY_DEV_BACKEND;
     proxy_listener->listener.name = "proxy";
 
     memory_listener_register(&proxy_listener->listener,
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index d116c2d6a1..82394331bf 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1444,7 +1444,7 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
         .log_sync = vhost_log_sync,
         .log_global_start = vhost_log_global_start,
         .log_global_stop = vhost_log_global_stop,
-        .priority = 10
+        .priority = MEMORY_LISTENER_PRIORITY_DEV_BACKEND
     };
 
     hdev->iommu_listener = (MemoryListener) {
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 6d95d59175..4d789461a2 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -812,6 +812,7 @@ struct IOMMUMemoryRegion {
     QLIST_FOREACH((n), &(mr)->iommu_notify, node)
 
 #define MEMORY_LISTENER_PRIORITY_ACCEL          10
+#define MEMORY_LISTENER_PRIORITY_DEV_BACKEND    10
 
 /**
  * struct MemoryListener: callbacks structure for updates to the physical memory map

From 14a868c626e99eea063ecbf6ef86002f6a314f0a Mon Sep 17 00:00:00 2001
From: Isaku Yamahata <isaku.yamahata@intel.com>
Date: Tue, 20 Jun 2023 09:50:49 -0700
Subject: [PATCH 0310/1353] exec/memory: Add symbol for the min value of memory
 listener priority
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MEMORY_LISTNER_PRIORITY_MIN for the symbolic value for the min value of
the memory listener instead of the hard-coded magic value 0.  Add explicit
initialization.

No functional change intended.

Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <29f88477fe82eb774bcfcae7f65ea21995f865f2.1687279702.git.isaku.yamahata@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/kvm/kvm-all.c   | 1 +
 include/exec/memory.h | 1 +
 target/arm/kvm.c      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 9d0837a39c..373d876c05 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -1105,6 +1105,7 @@ static MemoryListener kvm_coalesced_pio_listener = {
     .name = "kvm-coalesced-pio",
     .coalesced_io_add = kvm_coalesce_pio_add,
     .coalesced_io_del = kvm_coalesce_pio_del,
+    .priority = MEMORY_LISTENER_PRIORITY_MIN,
 };
 
 int kvm_check_extension(KVMState *s, unsigned int extension)
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 4d789461a2..7f5c11a0cc 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -811,6 +811,7 @@ struct IOMMUMemoryRegion {
 #define IOMMU_NOTIFIER_FOREACH(n, mr) \
     QLIST_FOREACH((n), &(mr)->iommu_notify, node)
 
+#define MEMORY_LISTENER_PRIORITY_MIN            0
 #define MEMORY_LISTENER_PRIORITY_ACCEL          10
 #define MEMORY_LISTENER_PRIORITY_DEV_BACKEND    10
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 84da49332c..b4c7654f49 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -341,6 +341,7 @@ static MemoryListener devlistener = {
     .name = "kvm-arm",
     .region_add = kvm_arm_devlistener_add,
     .region_del = kvm_arm_devlistener_del,
+    .priority = MEMORY_LISTENER_PRIORITY_MIN,
 };
 
 static void kvm_arm_set_device_addr(KVMDevice *kd)

From 5bef742cc4f0e21c80a31611af7881ba811e507f Mon Sep 17 00:00:00 2001
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: Fri, 23 Jun 2023 13:26:25 -0700
Subject: [PATCH 0311/1353] target/i386: Export MSR_ARCH_CAPABILITIES bits to
 guests

On Intel CPUs there are certain bits in MSR_ARCH_CAPABILITIES that
indicates if the CPU is not affected by a vulnerability. Without these
bits guests may try to deploy the mitigation even if the CPU is not
affected.

Export the bits to guests that indicate immunity to hardware
vulnerabilities.

Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Message-ID: <63d85cc76d4cdc51e6c732478b81d8f13be11e5a.1687551881.git.pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c0fb6b3ad9..b96a609d96 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1060,10 +1060,10 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry",
             "ssb-no", "mds-no", "pschange-mc-no", "tsx-ctrl",
             "taa-no", NULL, NULL, NULL,
-            NULL, NULL, NULL, NULL,
+            NULL, "sbdr-ssdp-no", "fbsdp-no", "psdp-no",
             NULL, "fb-clear", NULL, NULL,
             NULL, NULL, NULL, NULL,
-            NULL, NULL, NULL, NULL,
+            "pbrsb-no", NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
         },
         .msr = {

From 9fb4f5f5a1fd7619e221fd5068003c5b491b2bf0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 17 Jun 2023 01:13:34 +0200
Subject: [PATCH 0312/1353] target/i386: ignore ARCH_CAPABILITIES features in
 user mode emulation

ARCH_CAPABILITIES is only accessible through a read-only MSR, so it has
no impact on any user-mode operation (user-mode cannot read the MSR).
So do not bother printing warnings about it in user mode emulation.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b96a609d96..328779874f 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1069,6 +1069,13 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .msr = {
             .index = MSR_IA32_ARCH_CAPABILITIES,
         },
+        /*
+         * FEAT_ARCH_CAPABILITIES only affects a read-only MSR, which
+         * cannot be read from user mode.  Therefore, it has no impact
+         > on any user-mode operation, and warnings about unsupported
+         * features do not matter.
+         */
+        .tcg_features = ~0U,
     },
     [FEAT_CORE_CAPABILITY] = {
         .type = MSR_FEATURE_WORD,

From d903259dd2dbe40e007db1724dd072c5e210b3f4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 21 Jun 2023 01:17:28 +0200
Subject: [PATCH 0313/1353] target/i386: ignore CPL0-specific features in user
 mode emulation

Features such as PCID are only accessible through privileged operations,
and therefore have no impact on any user-mode operation.  Allow reporting
them to programs running under user mode emulation, so that "-cpu" can be
used with more named CPU models.

XSAVES would be similar, but it doesn't make sense to provide it until
XSAVEC is implemented.

With this change, all CPUs up to Broadwell-v4 can be emulate.  Skylake-Client
requires XSAVEC, while EPYC also requires SHA-NI, MISALIGNSSE and TOPOEXT.
MISALIGNSSE is not hard to implement, but I am not sure it is worth using
a precious hflags bit for it.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1534
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 83 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 76 insertions(+), 7 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 328779874f..a3ddd1b613 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -623,13 +623,25 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_MTRR, CPUID_MCA, CPUID_CLFLUSH (needed for Win64) */
           /* missing:
           CPUID_VME, CPUID_DTS, CPUID_SS, CPUID_HT, CPUID_TM, CPUID_PBE */
+
+/*
+ * Kernel-only features that can be shown to usermode programs even if
+ * they aren't actually supported by TCG, because qemu-user only runs
+ * in CPL=3; remove them if they are ever implemented for system emulation.
+ */
+#if defined CONFIG_USER_ONLY
+#define CPUID_EXT_KERNEL_FEATURES (CPUID_EXT_PCID | CPUID_EXT_TSC_DEADLINE_TIMER | \
+                                 CPUID_EXT_X2APIC)
+#else
+#define CPUID_EXT_KERNEL_FEATURES 0
+#endif
 #define TCG_EXT_FEATURES (CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | \
           CPUID_EXT_MONITOR | CPUID_EXT_SSSE3 | CPUID_EXT_CX16 | \
           CPUID_EXT_SSE41 | CPUID_EXT_SSE42 | CPUID_EXT_POPCNT | \
           CPUID_EXT_XSAVE | /* CPUID_EXT_OSXSAVE is dynamic */   \
           CPUID_EXT_MOVBE | CPUID_EXT_AES | CPUID_EXT_HYPERVISOR | \
           CPUID_EXT_RDRAND | CPUID_EXT_AVX | CPUID_EXT_F16C | \
-          CPUID_EXT_FMA)
+          CPUID_EXT_FMA | CPUID_EXT_KERNEL_FEATURES)
           /* missing:
           CPUID_EXT_DTES64, CPUID_EXT_DSCPL, CPUID_EXT_VMX, CPUID_EXT_SMX,
           CPUID_EXT_EST, CPUID_EXT_TM2, CPUID_EXT_CID,
@@ -642,22 +654,63 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_EXT2_X86_64_FEATURES 0
 #endif
 
+/*
+ * CPUID_*_KERNEL_FEATURES denotes bits and features that are not usable
+ * in usermode or by 32-bit programs.  Those are added to supported
+ * TCG features unconditionally in user-mode emulation mode.  This may
+ * indeed seem strange or incorrect, but it works because code running
+ * under usermode emulation cannot access them.
+ *
+ * Even for long mode, qemu-i386 is not running "a userspace program on a
+ * 32-bit CPU"; it's running "a userspace program with a 32-bit code segment"
+ * and therefore using the 32-bit ABI; the CPU itself might be 64-bit
+ * but again the difference is only visible in kernel mode.
+ */
+#if defined CONFIG_USER_ONLY
+#define CPUID_EXT2_KERNEL_FEATURES CPUID_EXT2_FFXSR
+#else
+#define CPUID_EXT2_KERNEL_FEATURES 0
+#endif
+
 #define TCG_EXT2_FEATURES ((TCG_FEATURES & CPUID_EXT2_AMD_ALIASES) | \
           CPUID_EXT2_NX | CPUID_EXT2_MMXEXT | CPUID_EXT2_RDTSCP | \
           CPUID_EXT2_3DNOW | CPUID_EXT2_3DNOWEXT | CPUID_EXT2_PDPE1GB | \
-          CPUID_EXT2_SYSCALL | TCG_EXT2_X86_64_FEATURES)
+          CPUID_EXT2_SYSCALL | TCG_EXT2_X86_64_FEATURES | \
+          CPUID_EXT2_KERNEL_FEATURES)
+
+#if defined CONFIG_USER_ONLY
+#define CPUID_EXT3_KERNEL_FEATURES CPUID_EXT3_OSVW
+#else
+#define CPUID_EXT3_KERNEL_FEATURES 0
+#endif
+
 #define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
           CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A | \
-          CPUID_EXT3_3DNOWPREFETCH)
+          CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_KERNEL_FEATURES)
+
 #define TCG_EXT4_FEATURES 0
+
+#if defined CONFIG_USER_ONLY
+#define CPUID_SVM_KERNEL_FEATURES (CPUID_SVM_NRIPSAVE | CPUID_SVM_VNMI)
+#else
+#define CPUID_SVM_KERNEL_FEATURES 0
+#endif
 #define TCG_SVM_FEATURES (CPUID_SVM_NPT | CPUID_SVM_VGIF | \
-          CPUID_SVM_SVME_ADDR_CHK)
+          CPUID_SVM_SVME_ADDR_CHK | CPUID_SVM_KERNEL_FEATURES)
+
 #define TCG_KVM_FEATURES 0
+
+#if defined CONFIG_USER_ONLY
+#define CPUID_7_0_EBX_KERNEL_FEATURES CPUID_7_0_EBX_INVPCID
+#else
+#define CPUID_7_0_EBX_KERNEL_FEATURES 0
+#endif
 #define TCG_7_0_EBX_FEATURES (CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_SMAP | \
           CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ADX | \
           CPUID_7_0_EBX_PCOMMIT | CPUID_7_0_EBX_CLFLUSHOPT |            \
           CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_MPX | CPUID_7_0_EBX_FSGSBASE | \
-          CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_RDSEED)
+          CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_RDSEED | \
+          CPUID_7_0_EBX_KERNEL_FEATURES)
           /* missing:
           CPUID_7_0_EBX_HLE
           CPUID_7_0_EBX_INVPCID, CPUID_7_0_EBX_RTM */
@@ -672,7 +725,14 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
           CPUID_7_0_ECX_LA57 | CPUID_7_0_ECX_PKS | CPUID_7_0_ECX_VAES | \
           TCG_7_0_ECX_RDPID)
 
-#define TCG_7_0_EDX_FEATURES CPUID_7_0_EDX_FSRM
+#if defined CONFIG_USER_ONLY
+#define CPUID_7_0_EDX_KERNEL_FEATURES (CPUID_7_0_EDX_SPEC_CTRL | \
+          CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD)
+#else
+#define CPUID_7_0_EDX_KERNEL_FEATURES 0
+#endif
+#define TCG_7_0_EDX_FEATURES (CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_KERNEL_FEATURES)
+
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
           CPUID_7_1_EAX_FSRC)
 #define TCG_7_1_EDX_FEATURES 0
@@ -686,8 +746,17 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_SGX_12_0_EBX_FEATURES 0
 #define TCG_SGX_12_1_EAX_FEATURES 0
 
+#if defined CONFIG_USER_ONLY
+#define CPUID_8000_0008_EBX_KERNEL_FEATURES (CPUID_8000_0008_EBX_IBPB | \
+          CPUID_8000_0008_EBX_IBRS | CPUID_8000_0008_EBX_STIBP | \
+          CPUID_8000_0008_EBX_STIBP_ALWAYS_ON | CPUID_8000_0008_EBX_AMD_SSBD | \
+          CPUID_8000_0008_EBX_AMD_PSFD)
+#else
+#define CPUID_8000_0008_EBX_KERNEL_FEATURES 0
+#endif
+
 #define TCG_8000_0008_EBX  (CPUID_8000_0008_EBX_XSAVEERPTR | \
-          CPUID_8000_0008_EBX_WBNOINVD)
+          CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_KERNEL_FEATURES)
 
 FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
     [FEAT_1_EDX] = {

From 40a205da415e9c10ff02505078700e14ead77092 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 20 Jun 2023 16:49:35 +0200
Subject: [PATCH 0314/1353] target/i386: emulate 64-bit ring 0 for linux-user
 if LM feature is set

32-bit binaries can run on a long mode processor even if the kernel
is 64-bit, of course, and this can have slightly different behavior;
for example, SYSCALL is allowed on Intel processors.

Allow reporting LM to programs running under user mode emulation,
so that "-cpu" can be used with named CPU models even for qemu-i386
and even without disabling LM by hand.

Fortunately, most of the runtime code in QEMU has to depend on HF_LMA_MASK
or on HF_CS64_MASK (which is anyway false for qemu-i386's 32-bit code
segment) rather than TARGET_X86_64, therefore all that is needed is an
update of linux-user's ring 0 setup.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1534
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-user/i386/cpu_loop.c  | 57 ++++++++++++++++++-------------------
 target/i386/cpu.c           | 15 ++++++++--
 target/i386/tcg/translate.c |  6 ++--
 3 files changed, 44 insertions(+), 34 deletions(-)

diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c
index 9eeda551ea..ef2dcb3d76 100644
--- a/linux-user/i386/cpu_loop.c
+++ b/linux-user/i386/cpu_loop.c
@@ -47,7 +47,7 @@ static void write_dt(void *ptr, unsigned long addr, unsigned long limit,
 }
 
 static uint64_t *idt_table;
-#ifdef TARGET_X86_64
+
 static void set_gate64(void *ptr, unsigned int type, unsigned int dpl,
                        uint64_t addr, unsigned int sel)
 {
@@ -60,8 +60,10 @@ static void set_gate64(void *ptr, unsigned int type, unsigned int dpl,
     p[2] = tswap32(addr >> 32);
     p[3] = 0;
 }
+
+#ifdef TARGET_X86_64
 /* only dpl matters as we do only user space emulation */
-static void set_idt(int n, unsigned int dpl)
+static void set_idt(int n, unsigned int dpl, bool is64)
 {
     set_gate64(idt_table + n * 2, 0, dpl, 0, 0);
 }
@@ -78,9 +80,13 @@ static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
 }
 
 /* only dpl matters as we do only user space emulation */
-static void set_idt(int n, unsigned int dpl)
+static void set_idt(int n, unsigned int dpl, bool is64)
 {
-    set_gate(idt_table + n, 0, dpl, 0, 0);
+    if (is64) {
+        set_gate64(idt_table + n * 2, 0, dpl, 0, 0);
+    } else {
+        set_gate(idt_table + n, 0, dpl, 0, 0);
+    }
 }
 #endif
 
@@ -325,6 +331,9 @@ static void target_cpu_free(void *obj)
 void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
 {
     CPUState *cpu = env_cpu(env);
+    bool is64 = (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) != 0;
+    int i;
+
     OBJECT(cpu)->free = target_cpu_free;
     env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
     env->hflags |= HF_PE_MASK | HF_CPL_MASK;
@@ -332,15 +341,18 @@ void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
         env->cr[4] |= CR4_OSFXSR_MASK;
         env->hflags |= HF_OSFXSR_MASK;
     }
-#ifndef TARGET_ABI32
+
     /* enable 64 bit mode if possible */
-    if (!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM)) {
+    if (is64) {
+        env->cr[4] |= CR4_PAE_MASK;
+        env->efer |= MSR_EFER_LMA | MSR_EFER_LME;
+        env->hflags |= HF_LMA_MASK;
+    }
+#ifndef TARGET_ABI32
+    else {
         fprintf(stderr, "The selected x86 CPU does not support 64 bit mode\n");
         exit(EXIT_FAILURE);
     }
-    env->cr[4] |= CR4_PAE_MASK;
-    env->efer |= MSR_EFER_LMA | MSR_EFER_LME;
-    env->hflags |= HF_LMA_MASK;
 #endif
 
     /* flags setup : we activate the IRQs by default as in user mode */
@@ -379,27 +391,12 @@ void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
                                 PROT_READ|PROT_WRITE,
                                 MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
     idt_table = g2h_untagged(env->idt.base);
-    set_idt(0, 0);
-    set_idt(1, 0);
-    set_idt(2, 0);
-    set_idt(3, 3);
-    set_idt(4, 3);
-    set_idt(5, 0);
-    set_idt(6, 0);
-    set_idt(7, 0);
-    set_idt(8, 0);
-    set_idt(9, 0);
-    set_idt(10, 0);
-    set_idt(11, 0);
-    set_idt(12, 0);
-    set_idt(13, 0);
-    set_idt(14, 0);
-    set_idt(15, 0);
-    set_idt(16, 0);
-    set_idt(17, 0);
-    set_idt(18, 0);
-    set_idt(19, 0);
-    set_idt(0x80, 3);
+    for (i = 0; i < 20; i++) {
+        set_idt(i, 0, is64);
+    }
+    set_idt(3, 3, is64);
+    set_idt(4, 3, is64);
+    set_idt(0x80, 3, is64);
 
     /* linux segment setup */
     {
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index a3ddd1b613..b5688cabb4 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -666,7 +666,10 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
  * and therefore using the 32-bit ABI; the CPU itself might be 64-bit
  * but again the difference is only visible in kernel mode.
  */
-#if defined CONFIG_USER_ONLY
+#if defined CONFIG_LINUX_USER
+#define CPUID_EXT2_KERNEL_FEATURES (CPUID_EXT2_LM | CPUID_EXT2_FFXSR)
+#elif defined CONFIG_USER_ONLY
+/* FIXME: Long mode not yet supported for i386 bsd-user */
 #define CPUID_EXT2_KERNEL_FEATURES CPUID_EXT2_FFXSR
 #else
 #define CPUID_EXT2_KERNEL_FEATURES 0
@@ -5539,7 +5542,15 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
     }
 #ifndef TARGET_X86_64
     if (w == FEAT_8000_0001_EDX) {
-        r &= ~CPUID_EXT2_LM;
+        /*
+         * 32-bit TCG can emulate 64-bit compatibility mode.  If there is no
+         * way for userspace to get out of its 32-bit jail, we can leave
+         * the LM bit set.
+         */
+        uint32_t unavail = tcg_enabled()
+            ? CPUID_EXT2_LM & ~CPUID_EXT2_KERNEL_FEATURES
+            : CPUID_EXT2_LM;
+        r &= ~unavail;
     }
 #endif
     if (migratable_only) {
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index 28cb3fb7f4..90c7b32f36 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -173,12 +173,14 @@ typedef struct DisasContext {
 #endif
 #if !defined(TARGET_X86_64)
 #define CODE64(S) false
-#define LMA(S)    false
 #elif defined(CONFIG_USER_ONLY)
 #define CODE64(S) true
-#define LMA(S)    true
 #else
 #define CODE64(S) (((S)->flags & HF_CS64_MASK) != 0)
+#endif
+#if defined(CONFIG_SOFTMMU) && !defined(TARGET_X86_64)
+#define LMA(S)    false
+#else
 #define LMA(S)    (((S)->flags & HF_LMA_MASK) != 0)
 #endif
 

From 3b746a43ebf3eb4f5be74dbc36c6c15661472d9e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 29 Jun 2023 15:08:44 +0200
Subject: [PATCH 0315/1353] gitlab: Disable plugins for cross-i386-tci

There are timeouts in the cross-i386-tci job that are related to plugins.
Restrict this job to basic TCI testing.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230629130844.151453-1-richard.henderson@linaro.org>
---
 .gitlab-ci.d/crossbuilds.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index 1e0e6c7f2c..b6ec99ecd1 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -57,7 +57,7 @@ cross-i386-tci:
   variables:
     IMAGE: fedora-i386-cross
     ACCEL: tcg-interpreter
-    EXTRA_CONFIGURE_OPTS: --target-list=i386-softmmu,i386-linux-user,aarch64-softmmu,aarch64-linux-user,ppc-softmmu,ppc-linux-user
+    EXTRA_CONFIGURE_OPTS: --target-list=i386-softmmu,i386-linux-user,aarch64-softmmu,aarch64-linux-user,ppc-softmmu,ppc-linux-user --disable-plugins
     MAKE_CHECK_ARGS: check check-tcg
 
 cross-mipsel-system:

From f7f2f96f33774a32dae2c3d183c6f02aa97639fb Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Wed, 10 May 2023 16:39:25 +0200
Subject: [PATCH 0316/1353] s390-ccw: Getting rid of ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Any good reason why this still exist?
I can understand u* and __u* to be linux kernel like, but ulong?

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20230629104821.194859-2-thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/helper.h        |  2 +-
 pc-bios/s390-ccw/s390-ccw.h      |  7 +++----
 pc-bios/s390-ccw/virtio-blkdev.c | 12 ++++++------
 pc-bios/s390-ccw/virtio-scsi.c   |  4 ++--
 pc-bios/s390-ccw/virtio-scsi.h   |  2 +-
 pc-bios/s390-ccw/virtio.c        | 12 ++++++------
 pc-bios/s390-ccw/virtio.h        |  4 ++--
 7 files changed, 21 insertions(+), 22 deletions(-)

diff --git a/pc-bios/s390-ccw/helper.h b/pc-bios/s390-ccw/helper.h
index 3d0731c4c6..8e3dfcb6d6 100644
--- a/pc-bios/s390-ccw/helper.h
+++ b/pc-bios/s390-ccw/helper.h
@@ -38,7 +38,7 @@ static inline void yield(void)
 
 static inline void sleep(unsigned int seconds)
 {
-    ulong target = get_time_seconds() + seconds;
+    unsigned long target = get_time_seconds() + seconds;
 
     while (get_time_seconds() < target) {
         yield();
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index b88e0550ab..f849fba74b 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -17,7 +17,6 @@ typedef unsigned char      u8;
 typedef unsigned short     u16;
 typedef unsigned int       u32;
 typedef unsigned long long u64;
-typedef unsigned long      ulong;
 typedef unsigned char      __u8;
 typedef unsigned short     __u16;
 typedef unsigned int       __u32;
@@ -67,11 +66,11 @@ void sclp_get_loadparm_ascii(char *loadparm);
 int sclp_read(char *str, size_t count);
 
 /* virtio.c */
-unsigned long virtio_load_direct(ulong rec_list1, ulong rec_list2,
-                                 ulong subchan_id, void *load_addr);
+unsigned long virtio_load_direct(unsigned long rec_list1, unsigned long rec_list2,
+                                 unsigned long subchan_id, void *load_addr);
 bool virtio_is_supported(SubChannelId schid);
 int virtio_blk_setup_device(SubChannelId schid);
-int virtio_read(ulong sector, void *load_addr);
+int virtio_read(unsigned long sector, void *load_addr);
 
 /* bootmap.c */
 void zipl_load(void);
diff --git a/pc-bios/s390-ccw/virtio-blkdev.c b/pc-bios/s390-ccw/virtio-blkdev.c
index 794f99b42c..a81207b52e 100644
--- a/pc-bios/s390-ccw/virtio-blkdev.c
+++ b/pc-bios/s390-ccw/virtio-blkdev.c
@@ -16,7 +16,7 @@
 #define VIRTIO_BLK_F_GEOMETRY   (1 << 4)
 #define VIRTIO_BLK_F_BLK_SIZE   (1 << 6)
 
-static int virtio_blk_read_many(VDev *vdev, ulong sector, void *load_addr,
+static int virtio_blk_read_many(VDev *vdev, unsigned long sector, void *load_addr,
                                 int sec_num)
 {
     VirtioBlkOuthdr out_hdr;
@@ -49,7 +49,7 @@ static int virtio_blk_read_many(VDev *vdev, ulong sector, void *load_addr,
     return status;
 }
 
-int virtio_read_many(ulong sector, void *load_addr, int sec_num)
+int virtio_read_many(unsigned long sector, void *load_addr, int sec_num)
 {
     VDev *vdev = virtio_get_device();
 
@@ -63,14 +63,14 @@ int virtio_read_many(ulong sector, void *load_addr, int sec_num)
     return -1;
 }
 
-unsigned long virtio_load_direct(ulong rec_list1, ulong rec_list2,
-                                 ulong subchan_id, void *load_addr)
+unsigned long virtio_load_direct(unsigned long rec_list1, unsigned long rec_list2,
+                                 unsigned long subchan_id, void *load_addr)
 {
     u8 status;
     int sec = rec_list1;
     int sec_num = ((rec_list2 >> 32) & 0xffff) + 1;
     int sec_len = rec_list2 >> 48;
-    ulong addr = (ulong)load_addr;
+    unsigned long addr = (unsigned long)load_addr;
 
     if (sec_len != virtio_get_block_size()) {
         return -1;
@@ -86,7 +86,7 @@ unsigned long virtio_load_direct(ulong rec_list1, ulong rec_list2,
     return addr;
 }
 
-int virtio_read(ulong sector, void *load_addr)
+int virtio_read(unsigned long sector, void *load_addr)
 {
     return virtio_read_many(sector, load_addr, 1);
 }
diff --git a/pc-bios/s390-ccw/virtio-scsi.c b/pc-bios/s390-ccw/virtio-scsi.c
index dcce696a33..d1a84b937c 100644
--- a/pc-bios/s390-ccw/virtio-scsi.c
+++ b/pc-bios/s390-ccw/virtio-scsi.c
@@ -150,7 +150,7 @@ static bool scsi_report_luns(VDev *vdev, void *data, uint32_t data_size)
 }
 
 static bool scsi_read_10(VDev *vdev,
-                         ulong sector, int sectors, void *data,
+                         unsigned long sector, int sectors, void *data,
                          unsigned int data_size)
 {
     ScsiCdbRead10 cdb = {
@@ -269,7 +269,7 @@ static int virtio_scsi_locate_device(VDev *vdev)
 }
 
 int virtio_scsi_read_many(VDev *vdev,
-                          ulong sector, void *load_addr, int sec_num)
+                          unsigned long sector, void *load_addr, int sec_num)
 {
     int sector_count;
     int f = vdev->blk_factor;
diff --git a/pc-bios/s390-ccw/virtio-scsi.h b/pc-bios/s390-ccw/virtio-scsi.h
index e6b6cd4815..c5612e16a2 100644
--- a/pc-bios/s390-ccw/virtio-scsi.h
+++ b/pc-bios/s390-ccw/virtio-scsi.h
@@ -68,7 +68,7 @@ static inline bool virtio_scsi_response_ok(const VirtioScsiCmdResp *r)
 }
 
 int virtio_scsi_read_many(VDev *vdev,
-                          ulong sector, void *load_addr, int sec_num);
+                          unsigned long sector, void *load_addr, int sec_num);
 int virtio_scsi_setup_device(SubChannelId schid);
 
 #endif /* VIRTIO_SCSI_H */
diff --git a/pc-bios/s390-ccw/virtio.c b/pc-bios/s390-ccw/virtio.c
index f37510f312..5edd058d88 100644
--- a/pc-bios/s390-ccw/virtio.c
+++ b/pc-bios/s390-ccw/virtio.c
@@ -48,10 +48,10 @@ VirtioDevType virtio_get_device_type(void)
 static long kvm_hypercall(unsigned long nr, unsigned long param1,
                           unsigned long param2, unsigned long param3)
 {
-    register ulong r_nr asm("1") = nr;
-    register ulong r_param1 asm("2") = param1;
-    register ulong r_param2 asm("3") = param2;
-    register ulong r_param3 asm("4") = param3;
+    register unsigned long r_nr asm("1") = nr;
+    register unsigned long r_param1 asm("2") = param1;
+    register unsigned long r_param2 asm("3") = param2;
+    register unsigned long r_param3 asm("4") = param3;
     register long retval asm("2");
 
     asm volatile ("diag %%r2,%%r4,0x500"
@@ -145,7 +145,7 @@ void vring_send_buf(VRing *vr, void *p, int len, int flags)
         vr->avail->ring[vr->avail->idx % vr->num] = vr->next_idx;
     }
 
-    vr->desc[vr->next_idx].addr = (ulong)p;
+    vr->desc[vr->next_idx].addr = (unsigned long)p;
     vr->desc[vr->next_idx].len = len;
     vr->desc[vr->next_idx].flags = flags & ~VRING_HIDDEN_IS_CHAIN;
     vr->desc[vr->next_idx].next = vr->next_idx;
@@ -182,7 +182,7 @@ int vr_poll(VRing *vr)
  */
 int vring_wait_reply(void)
 {
-    ulong target_second = get_time_seconds() + vdev.wait_reply_timeout;
+    unsigned long target_second = get_time_seconds() + vdev.wait_reply_timeout;
 
     /* Wait for any queue to be updated by the host */
     do {
diff --git a/pc-bios/s390-ccw/virtio.h b/pc-bios/s390-ccw/virtio.h
index e657d381ec..85bd9d1695 100644
--- a/pc-bios/s390-ccw/virtio.h
+++ b/pc-bios/s390-ccw/virtio.h
@@ -190,14 +190,14 @@ int virtio_get_block_size(void);
 uint8_t virtio_get_heads(void);
 uint8_t virtio_get_sectors(void);
 uint64_t virtio_get_blocks(void);
-int virtio_read_many(ulong sector, void *load_addr, int sec_num);
+int virtio_read_many(unsigned long sector, void *load_addr, int sec_num);
 
 #define VIRTIO_SECTOR_SIZE 512
 #define VIRTIO_ISO_BLOCK_SIZE 2048
 #define VIRTIO_SCSI_BLOCK_SIZE 512
 #define VIRTIO_DASD_DEFAULT_BLOCK_SIZE 4096
 
-static inline ulong virtio_sector_adjust(ulong sector)
+static inline unsigned long virtio_sector_adjust(unsigned long sector)
 {
     return sector * (virtio_get_block_size() / VIRTIO_SECTOR_SIZE);
 }

From 0c2a6e124228caf776647050cfbba4faedf950fb Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 27 Jun 2023 13:41:01 +0200
Subject: [PATCH 0317/1353] pc-bios/s390-ccw: Get rid of the the __u* types

The types starting with double underscores have likely been
introduced into the s390-ccw bios to be able to re-use structs
from the Linux kernel in the past, but the corresponding structs
in cio.h have been changed there a long time ago already to not
use the variants with the double underscores anymore:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/diff/drivers/s390/cio/cio.h?id=cd6b4f27b9bb2a

So it would be good to replace these in the s390-ccw bios now, too.

Message-Id: <20230627114101.122231-1-thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/cio.h      | 232 ++++++++++++++++++------------------
 pc-bios/s390-ccw/s390-ccw.h |   4 -
 2 files changed, 116 insertions(+), 120 deletions(-)

diff --git a/pc-bios/s390-ccw/cio.h b/pc-bios/s390-ccw/cio.h
index 88a88adfd2..8b18153deb 100644
--- a/pc-bios/s390-ccw/cio.h
+++ b/pc-bios/s390-ccw/cio.h
@@ -17,32 +17,32 @@
  * path management control word
  */
 struct pmcw {
-    __u32 intparm;      /* interruption parameter */
-    __u32 qf:1;         /* qdio facility */
-    __u32 w:1;
-    __u32 isc:3;        /* interruption subclass */
-    __u32 res5:3;       /* reserved zeros */
-    __u32 ena:1;        /* enabled */
-    __u32 lm:2;         /* limit mode */
-    __u32 mme:2;        /* measurement-mode enable */
-    __u32 mp:1;         /* multipath mode */
-    __u32 tf:1;         /* timing facility */
-    __u32 dnv:1;        /* device number valid */
-    __u32 dev:16;       /* device number */
-    __u8  lpm;          /* logical path mask */
-    __u8  pnom;         /* path not operational mask */
-    __u8  lpum;         /* last path used mask */
-    __u8  pim;          /* path installed mask */
-    __u16 mbi;          /* measurement-block index */
-    __u8  pom;          /* path operational mask */
-    __u8  pam;          /* path available mask */
-    __u8  chpid[8];     /* CHPID 0-7 (if available) */
-    __u32 unused1:8;    /* reserved zeros */
-    __u32 st:3;         /* subchannel type */
-    __u32 unused2:18;   /* reserved zeros */
-    __u32 mbfc:1;       /* measurement block format control */
-    __u32 xmwme:1;      /* extended measurement word mode enable */
-    __u32 csense:1;     /* concurrent sense; can be enabled ...*/
+    u32 intparm;        /* interruption parameter */
+    u32 qf:1;           /* qdio facility */
+    u32 w:1;
+    u32 isc:3;          /* interruption subclass */
+    u32 res5:3;         /* reserved zeros */
+    u32 ena:1;          /* enabled */
+    u32 lm:2;           /* limit mode */
+    u32 mme:2;          /* measurement-mode enable */
+    u32 mp:1;           /* multipath mode */
+    u32 tf:1;           /* timing facility */
+    u32 dnv:1;          /* device number valid */
+    u32 dev:16;         /* device number */
+    u8  lpm;            /* logical path mask */
+    u8  pnom;           /* path not operational mask */
+    u8  lpum;           /* last path used mask */
+    u8  pim;            /* path installed mask */
+    u16 mbi;            /* measurement-block index */
+    u8  pom;            /* path operational mask */
+    u8  pam;            /* path available mask */
+    u8  chpid[8];       /* CHPID 0-7 (if available) */
+    u32 unused1:8;      /* reserved zeros */
+    u32 st:3;           /* subchannel type */
+    u32 unused2:18;     /* reserved zeros */
+    u32 mbfc:1;         /* measurement block format control */
+    u32 xmwme:1;        /* extended measurement word mode enable */
+    u32 csense:1;       /* concurrent sense; can be enabled ...*/
                         /*  ... per MSCH, however, if facility */
                         /*  ... is not installed, this results */
                         /*  ... in an operand exception.       */
@@ -50,24 +50,24 @@ struct pmcw {
 
 /* Target SCHIB configuration. */
 struct schib_config {
-    __u64 mba;
-    __u32 intparm;
-    __u16 mbi;
-    __u32 isc:3;
-    __u32 ena:1;
-    __u32 mme:2;
-    __u32 mp:1;
-    __u32 csense:1;
-    __u32 mbfc:1;
+    u64 mba;
+    u32 intparm;
+    u16 mbi;
+    u32 isc:3;
+    u32 ena:1;
+    u32 mme:2;
+    u32 mp:1;
+    u32 csense:1;
+    u32 mbfc:1;
 } __attribute__ ((packed));
 
 struct scsw {
-    __u16 flags;
-    __u16 ctrl;
-    __u32 cpa;
-    __u8 dstat;
-    __u8 cstat;
-    __u16 count;
+    u16 flags;
+    u16 ctrl;
+    u32 cpa;
+    u8 dstat;
+    u8 cstat;
+    u16 count;
 } __attribute__ ((packed));
 
 /* Function Control */
@@ -117,42 +117,42 @@ struct scsw {
 typedef struct schib {
     struct pmcw pmcw;     /* path management control word */
     struct scsw scsw;     /* subchannel status word */
-    __u64 mba;            /* measurement block address */
-    __u8 mda[4];          /* model dependent area */
+    u64 mba;              /* measurement block address */
+    u8 mda[4];            /* model dependent area */
 } __attribute__ ((packed, aligned(4))) Schib;
 
 typedef struct subchannel_id {
     union {
         struct {
-            __u16 cssid:8;
-            __u16 reserved:4;
-            __u16 m:1;
-            __u16 ssid:2;
-            __u16 one:1;
+            u16 cssid:8;
+            u16 reserved:4;
+            u16 m:1;
+            u16 ssid:2;
+            u16 one:1;
         };
-        __u16 sch_id;
+        u16 sch_id;
     };
-    __u16 sch_no;
+    u16 sch_no;
 } __attribute__ ((packed, aligned(4))) SubChannelId;
 
 struct chsc_header {
-    __u16 length;
-    __u16 code;
+    u16 length;
+    u16 code;
 } __attribute__((packed));
 
 typedef struct chsc_area_sda {
     struct chsc_header request;
-    __u8 reserved1:4;
-    __u8 format:4;
-    __u8 reserved2;
-    __u16 operation_code;
-    __u32 reserved3;
-    __u32 reserved4;
-    __u32 operation_data_area[252];
+    u8 reserved1:4;
+    u8 format:4;
+    u8 reserved2;
+    u16 operation_code;
+    u32 reserved3;
+    u32 reserved4;
+    u32 operation_data_area[252];
     struct chsc_header response;
-    __u32 reserved5:4;
-    __u32 format2:4;
-    __u32 reserved6:24;
+    u32 reserved5:4;
+    u32 format2:4;
+    u32 reserved6:24;
 } __attribute__((packed)) ChscAreaSda;
 
 /*
@@ -160,37 +160,37 @@ typedef struct chsc_area_sda {
  */
 struct tpi_info {
     struct subchannel_id schid;
-    __u32 intparm;      /* interruption parameter */
-    __u32 adapter_IO:1;
-    __u32 reserved2:1;
-    __u32 isc:3;
-    __u32 reserved3:12;
-    __u32 int_type:3;
-    __u32 reserved4:12;
+    u32 intparm;      /* interruption parameter */
+    u32 adapter_IO:1;
+    u32 reserved2:1;
+    u32 isc:3;
+    u32 reserved3:12;
+    u32 int_type:3;
+    u32 reserved4:12;
 } __attribute__ ((packed, aligned(4)));
 
 /* channel command word (format 0) */
 typedef struct ccw0 {
-    __u8 cmd_code;
-    __u32 cda:24;
-    __u32 chainData:1;
-    __u32 chain:1;
-    __u32 sli:1;
-    __u32 skip:1;
-    __u32 pci:1;
-    __u32 ida:1;
-    __u32 suspend:1;
-    __u32 mida:1;
-    __u8 reserved;
-    __u16 count;
+    u8 cmd_code;
+    u32 cda:24;
+    u32 chainData:1;
+    u32 chain:1;
+    u32 sli:1;
+    u32 skip:1;
+    u32 pci:1;
+    u32 ida:1;
+    u32 suspend:1;
+    u32 mida:1;
+    u8 reserved;
+    u16 count;
 } __attribute__ ((packed, aligned(8))) Ccw0;
 
 /* channel command word (format 1) */
 typedef struct ccw1 {
-    __u8 cmd_code;
-    __u8 flags;
-    __u16 count;
-    __u32 cda;
+    u8 cmd_code;
+    u8 flags;
+    u16 count;
+    u32 cda;
 } __attribute__ ((packed, aligned(8))) Ccw1;
 
 /* do_cio() CCW formats */
@@ -234,31 +234,31 @@ typedef struct ccw1 {
  * Command-mode operation request block
  */
 typedef struct cmd_orb {
-    __u32 intparm;    /* interruption parameter */
-    __u32 key:4;      /* flags, like key, suspend control, etc. */
-    __u32 spnd:1;     /* suspend control */
-    __u32 res1:1;     /* reserved */
-    __u32 mod:1;      /* modification control */
-    __u32 sync:1;     /* synchronize control */
-    __u32 fmt:1;      /* format control */
-    __u32 pfch:1;     /* prefetch control */
-    __u32 isic:1;     /* initial-status-interruption control */
-    __u32 alcc:1;     /* address-limit-checking control */
-    __u32 ssic:1;     /* suppress-suspended-interr. control */
-    __u32 res2:1;     /* reserved */
-    __u32 c64:1;      /* IDAW/QDIO 64 bit control  */
-    __u32 i2k:1;      /* IDAW 2/4kB block size control */
-    __u32 lpm:8;      /* logical path mask */
-    __u32 ils:1;      /* incorrect length */
-    __u32 zero:6;     /* reserved zeros */
-    __u32 orbx:1;     /* ORB extension control */
-    __u32 cpa;    /* channel program address */
+    u32 intparm;    /* interruption parameter */
+    u32 key:4;      /* flags, like key, suspend control, etc. */
+    u32 spnd:1;     /* suspend control */
+    u32 res1:1;     /* reserved */
+    u32 mod:1;      /* modification control */
+    u32 sync:1;     /* synchronize control */
+    u32 fmt:1;      /* format control */
+    u32 pfch:1;     /* prefetch control */
+    u32 isic:1;     /* initial-status-interruption control */
+    u32 alcc:1;     /* address-limit-checking control */
+    u32 ssic:1;     /* suppress-suspended-interr. control */
+    u32 res2:1;     /* reserved */
+    u32 c64:1;      /* IDAW/QDIO 64 bit control  */
+    u32 i2k:1;      /* IDAW 2/4kB block size control */
+    u32 lpm:8;      /* logical path mask */
+    u32 ils:1;      /* incorrect length */
+    u32 zero:6;     /* reserved zeros */
+    u32 orbx:1;     /* ORB extension control */
+    u32 cpa;        /* channel program address */
 }  __attribute__ ((packed, aligned(4))) CmdOrb;
 
 struct ciw {
-    __u8 type;
-    __u8 command;
-    __u16 count;
+    u8 type;
+    u8 command;
+    u16 count;
 };
 
 #define CU_TYPE_UNKNOWN         0x0000
@@ -271,12 +271,12 @@ struct ciw {
  */
 typedef struct senseid {
     /* common part */
-    __u8  reserved;   /* always 0x'FF' */
-    __u16 cu_type;    /* control unit type */
-    __u8  cu_model;   /* control unit model */
-    __u16 dev_type;   /* device type */
-    __u8  dev_model;  /* device model */
-    __u8  unused;     /* padding byte */
+    u8  reserved;   /* always 0x'FF' */
+    u16 cu_type;    /* control unit type */
+    u8  cu_model;   /* control unit model */
+    u16 dev_type;   /* device type */
+    u8  dev_model;  /* device model */
+    u8  unused;     /* padding byte */
     /* extended part */
     struct ciw ciw[62];
 }  __attribute__ ((packed, aligned(4))) SenseId;
@@ -342,9 +342,9 @@ typedef struct SenseDataEckdDasd {
 /* interruption response block */
 typedef struct irb {
     struct scsw scsw;
-    __u32 esw[5];
-    __u32 ecw[8];
-    __u32 emw[8];
+    u32 esw[5];
+    u32 ecw[8];
+    u32 emw[8];
 }  __attribute__ ((packed, aligned(4))) Irb;
 
 /* Used for SEEK ccw commands */
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index f849fba74b..f68a832718 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -17,10 +17,6 @@ typedef unsigned char      u8;
 typedef unsigned short     u16;
 typedef unsigned int       u32;
 typedef unsigned long long u64;
-typedef unsigned char      __u8;
-typedef unsigned short     __u16;
-typedef unsigned int       __u32;
-typedef unsigned long long __u64;
 
 #define true 1
 #define false 0

From 442ef32ee5b6059a8f247fb2def9d449578d0a89 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 22 Jun 2023 15:08:22 +0200
Subject: [PATCH 0318/1353] pc-bios/s390-ccw/Makefile: Use -z noexecstack to
 silence linker warning

Recent versions of ld complain when linking the s390-ccw bios:

 /usr/bin/ld: warning: start.o: missing .note.GNU-stack section implies
              executable stack
 /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in
              a future version of the linker

We can silence the warning by telling the linker to mark the stack
as not executable.

Message-Id: <20230622130822.396793-1-thuth@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/s390-ccw/Makefile b/pc-bios/s390-ccw/Makefile
index 2e8cc015aa..acfcd1e71a 100644
--- a/pc-bios/s390-ccw/Makefile
+++ b/pc-bios/s390-ccw/Makefile
@@ -55,7 +55,7 @@ config-cc.mak: Makefile
 	    $(call cc-option,-march=z900,-march=z10)) 3> config-cc.mak
 -include config-cc.mak
 
-LDFLAGS += -Wl,-pie -nostdlib
+LDFLAGS += -Wl,-pie -nostdlib -z noexecstack
 
 build-all: s390-ccw.img s390-netboot.img
 

From f52420fa4fd9f519dc42c20d2616aba4149adc25 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 27 Jun 2023 09:47:00 +0200
Subject: [PATCH 0319/1353] pc-bios/s390-ccw: Fix indentation in start.S
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

start.S is currently indented with a mixture of spaces and tabs, which
is quite ugly. QEMU coding style says indentation should be 4 spaces,
and this is also what we are using in the assembler files in the
tests/tcg/s390x/ folder already, so let's adjust start.S accordingly.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20230627074703.99608-2-thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/start.S | 136 +++++++++++++++++++--------------------
 1 file changed, 68 insertions(+), 68 deletions(-)

diff --git a/pc-bios/s390-ccw/start.S b/pc-bios/s390-ccw/start.S
index 6072906df4..d29de09cc6 100644
--- a/pc-bios/s390-ccw/start.S
+++ b/pc-bios/s390-ccw/start.S
@@ -10,37 +10,37 @@
  * directory.
  */
 
-        .globl _start
+    .globl _start
 _start:
 
-	larl   %r15, stack + 0x8000	/* Set up stack */
+    larl    %r15,stack + 0x8000     /* Set up stack */
 
-	/* clear bss */
-	larl %r2, __bss_start
-	larl %r3, _end
-	slgr %r3, %r2		/* get sizeof bss */
-	ltgr	%r3,%r3 	/* bss empty? */
-	jz	done
-	aghi	%r3,-1
-	srlg	%r4,%r3,8	/* how many 256 byte chunks? */
-	ltgr	%r4,%r4
-	lgr	%r1,%r2
-	jz	remainder
+    /* clear bss */
+    larl    %r2,__bss_start
+    larl    %r3,_end
+    slgr    %r3,%r2    /* get sizeof bss */
+    ltgr    %r3,%r3    /* bss empty? */
+    jz      done
+    aghi    %r3,-1
+    srlg    %r4,%r3,8  /* how many 256 byte chunks? */
+    ltgr    %r4,%r4
+    lgr     %r1,%r2
+    jz      remainder
 loop:
-	xc	0(256,%r1),0(%r1)
-	la	%r1,256(%r1)
-	brctg	%r4,loop
+    xc      0(256,%r1),0(%r1)
+    la      %r1,256(%r1)
+    brctg   %r4,loop
 remainder:
-	larl	%r2,memsetxc
-	ex	%r3,0(%r2)
+    larl    %r2,memsetxc
+    ex      %r3,0(%r2)
 done:
-        /* set up a pgm exception disabled wait psw */
-        larl	%r2, disabled_wait_psw
-        mvc	0x01d0(16), 0(%r2)
-        j      main		/* And call C */
+    /* set up a pgm exception disabled wait psw */
+    larl    %r2,disabled_wait_psw
+    mvc     0x01d0(16),0(%r2)
+    j       main       /* And call C */
 
 memsetxc:
-	xc	0(1,%r1),0(%r1)
+    xc      0(1,%r1),0(%r1)
 
 
 /*
@@ -48,11 +48,11 @@ memsetxc:
  *
  * stops the current guest cpu.
  */
-	.globl disabled_wait
+    .globl disabled_wait
 disabled_wait:
-	larl	%r1,disabled_wait_psw
-	lpswe	0(%r1)
-1:	j	1b
+    larl    %r1,disabled_wait_psw
+    lpswe   0(%r1)
+1:  j       1b
 
 
 /*
@@ -60,61 +60,61 @@ disabled_wait:
  *
  * eats one sclp interrupt
  */
-        .globl consume_sclp_int
+    .globl consume_sclp_int
 consume_sclp_int:
-        /* enable service interrupts in cr0 */
-        stctg   %c0,%c0,0(%r15)
-        oi      6(%r15),0x2
-        lctlg   %c0,%c0,0(%r15)
-        /* prepare external call handler */
-        larl %r1, external_new_code
-        stg %r1, 0x1b8
-        larl %r1, external_new_mask
-        mvc 0x1b0(8),0(%r1)
-        /* load enabled wait PSW */
-        larl %r1, enabled_wait_psw
-        lpswe 0(%r1)
+    /* enable service interrupts in cr0 */
+    stctg   %c0,%c0,0(%r15)
+    oi      6(%r15),0x2
+    lctlg   %c0,%c0,0(%r15)
+    /* prepare external call handler */
+    larl    %r1,external_new_code
+    stg     %r1,0x1b8
+    larl    %r1,external_new_mask
+    mvc     0x1b0(8),0(%r1)
+    /* load enabled wait PSW */
+    larl    %r1,enabled_wait_psw
+    lpswe   0(%r1)
 
 /*
  * void consume_io_int(void)
  *
  * eats one I/O interrupt
  */
-        .globl consume_io_int
+    .globl consume_io_int
 consume_io_int:
-        /* enable I/O interrupts in cr6 */
-        stctg %c6,%c6,0(%r15)
-        oi    4(%r15), 0xff
-        lctlg %c6,%c6,0(%r15)
-        /* prepare i/o call handler */
-        larl  %r1, io_new_code
-        stg   %r1, 0x1f8
-        larl  %r1, io_new_mask
-        mvc   0x1f0(8),0(%r1)
-        /* load enabled wait PSW */
-        larl  %r1, enabled_wait_psw
-        lpswe 0(%r1)
+    /* enable I/O interrupts in cr6 */
+    stctg   %c6,%c6,0(%r15)
+    oi      4(%r15), 0xff
+    lctlg   %c6,%c6,0(%r15)
+    /* prepare i/o call handler */
+    larl    %r1,io_new_code
+    stg     %r1,0x1f8
+    larl    %r1,io_new_mask
+    mvc     0x1f0(8),0(%r1)
+    /* load enabled wait PSW */
+    larl    %r1,enabled_wait_psw
+    lpswe   0(%r1)
 
 external_new_code:
-        /* disable service interrupts in cr0 */
-        stctg   %c0,%c0,0(%r15)
-        ni      6(%r15),0xfd
-        lctlg   %c0,%c0,0(%r15)
-        br      %r14
+    /* disable service interrupts in cr0 */
+    stctg   %c0,%c0,0(%r15)
+    ni      6(%r15),0xfd
+    lctlg   %c0,%c0,0(%r15)
+    br      %r14
 
 io_new_code:
-        /* disable I/O interrupts in cr6 */
-        stctg %c6,%c6,0(%r15)
-        ni    4(%r15), 0x00
-        lctlg %c6,%c6,0(%r15)
-        br    %r14
+    /* disable I/O interrupts in cr6 */
+    stctg   %c6,%c6,0(%r15)
+    ni      4(%r15),0x00
+    lctlg   %c6,%c6,0(%r15)
+    br      %r14
 
-        .align  8
+    .align  8
 disabled_wait_psw:
-        .quad   0x0002000180000000,0x0000000000000000
+    .quad   0x0002000180000000,0x0000000000000000
 enabled_wait_psw:
-        .quad   0x0302000180000000,0x0000000000000000
+    .quad   0x0302000180000000,0x0000000000000000
 external_new_mask:
-        .quad   0x0000000180000000
+    .quad   0x0000000180000000
 io_new_mask:
-        .quad   0x0000000180000000
+    .quad   0x0000000180000000

From 74fe98ee7fb3344dbd085d1fa32c0dc2fc2c831f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 27 Jun 2023 09:47:01 +0200
Subject: [PATCH 0320/1353] pc-bios/s390-ccw: Provide space for initial stack
 frame in start.S
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Providing the space of a stack frame is the duty of the caller,
so we should reserve 160 bytes before jumping into the main function.
Otherwise the main() function might write past the stack array.

While we're at it, add a proper STACK_SIZE macro for the stack size
instead of using magic numbers (this is also required for the following
patch).

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20230627074703.99608-3-thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/start.S | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pc-bios/s390-ccw/start.S b/pc-bios/s390-ccw/start.S
index d29de09cc6..abd6fe6639 100644
--- a/pc-bios/s390-ccw/start.S
+++ b/pc-bios/s390-ccw/start.S
@@ -10,10 +10,13 @@
  * directory.
  */
 
+#define STACK_SIZE        0x8000
+#define STACK_FRAME_SIZE  160
+
     .globl _start
 _start:
 
-    larl    %r15,stack + 0x8000     /* Set up stack */
+    larl    %r15,stack + STACK_SIZE - STACK_FRAME_SIZE   /* Set up stack */
 
     /* clear bss */
     larl    %r2,__bss_start

From e31f08dc748bad980f2092be165bd091f9cf3c48 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 27 Jun 2023 09:47:02 +0200
Subject: [PATCH 0321/1353] pc-bios/s390-ccw: Move the stack array into start.S

The stack array is only referenced from the start-up code (which is
shared between the s390-ccw.img and the s390-netboot.img), but it is
currently declared twice, once in main.c and once in netmain.c.
It makes more sense to declare this in start.S instead - which will
also be helpful in the next patch, since we need to mention the .bss
section in start.S in that patch.

While we're at it, let's also drop the huge alignment of the stack,
since there is no technical requirement for aligning it to page
boundaries.

Message-Id: <20230627074703.99608-4-thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/main.c     | 1 -
 pc-bios/s390-ccw/netmain.c  | 1 -
 pc-bios/s390-ccw/s390-ccw.h | 1 -
 pc-bios/s390-ccw/start.S    | 6 ++++++
 tests/tcg/s390x/head64.S    | 7 ++-----
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
index a2def83e82..5506798098 100644
--- a/pc-bios/s390-ccw/main.c
+++ b/pc-bios/s390-ccw/main.c
@@ -17,7 +17,6 @@
 #include "virtio-scsi.h"
 #include "dasd-ipl.h"
 
-char stack[PAGE_SIZE * 8] __attribute__((__aligned__(PAGE_SIZE)));
 static SubChannelId blk_schid = { .one = 1 };
 static char loadparm_str[LOADPARM_LEN + 1];
 QemuIplParameters qipl;
diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
index 056e93a818..5cd619b2d6 100644
--- a/pc-bios/s390-ccw/netmain.c
+++ b/pc-bios/s390-ccw/netmain.c
@@ -50,7 +50,6 @@ void write_iplb_location(void) {}
 /* STSI 3.2.2 offset of first vmdb + offset of uuid inside vmdb */
 #define STSI322_VMDB_UUID_OFFSET ((8 + 12) * 4)
 
-char stack[PAGE_SIZE * 8] __attribute__((aligned(PAGE_SIZE)));
 IplParameterBlock iplb __attribute__((aligned(PAGE_SIZE)));
 static char cfgbuf[2048];
 
diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
index f68a832718..c977a52b50 100644
--- a/pc-bios/s390-ccw/s390-ccw.h
+++ b/pc-bios/s390-ccw/s390-ccw.h
@@ -50,7 +50,6 @@ void consume_io_int(void);
 /* main.c */
 void write_subsystem_identification(void);
 void write_iplb_location(void);
-extern char stack[PAGE_SIZE * 8] __attribute__((__aligned__(PAGE_SIZE)));
 unsigned int get_loadparm_index(void);
 void main(void);
 
diff --git a/pc-bios/s390-ccw/start.S b/pc-bios/s390-ccw/start.S
index abd6fe6639..429a2b30a1 100644
--- a/pc-bios/s390-ccw/start.S
+++ b/pc-bios/s390-ccw/start.S
@@ -121,3 +121,9 @@ external_new_mask:
     .quad   0x0000000180000000
 io_new_mask:
     .quad   0x0000000180000000
+
+.bss
+    .align  8
+stack:
+    .space  STACK_SIZE
+    .size   stack,STACK_SIZE
diff --git a/tests/tcg/s390x/head64.S b/tests/tcg/s390x/head64.S
index c6f36dfea4..4fe288388a 100644
--- a/tests/tcg/s390x/head64.S
+++ b/tests/tcg/s390x/head64.S
@@ -8,6 +8,8 @@
 #include "../../../pc-bios/s390-ccw/start.S"
 #undef main
 
+.text
+
 main_pre:
     aghi %r15,-160                     /* reserve stack for C code */
     brasl %r14,sclp_setup
@@ -24,8 +26,3 @@ success_psw:
     .quad 0x2000180000000,0xfff        /* see is_special_wait_psw() */
 failure_psw:
     .quad 0x2000180000000,0            /* disabled wait */
-
-    .section .bss
-    .align 0x1000
-stack:
-    .skip 0x8000

From 7cd50cbe4ca3e2860b31b06ec92c17c54bd82d48 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 27 Jun 2023 09:47:03 +0200
Subject: [PATCH 0322/1353] pc-bios/s390-ccw: Don't use __bss_start with the
 "larl" instruction

start.S currently cannot be compiled with Clang 16 and binutils 2.40:

 ld: start.o(.text+0x8): misaligned symbol `__bss_start' (0xc1e5) for
     relocation R_390_PC32DBL

According to the built-in linker script of ld, the symbol __bss_start
can actually point *before* the .bss section and does not need to have
any alignment, so in certain situations (like when using the internal
assembler of Clang), the __bss_start symbol can indeed be unaligned
and thus it is not suitable for being used with the "larl" instruction
that needs an address that is at least aligned to halfwords.
The problem went unnoticed so far since binutils <= 2.39 did not
check the alignment, but starting with binutils 2.40, such unaligned
addresses are now refused.

Fix it by loading the address indirectly instead.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2216662
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Suggested-by:  Andreas Krebbel <andreas.krebbel@de.ibm.com>
Message-Id: <20230629104821.194859-8-thuth@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw/start.S | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pc-bios/s390-ccw/start.S b/pc-bios/s390-ccw/start.S
index 429a2b30a1..061b06591c 100644
--- a/pc-bios/s390-ccw/start.S
+++ b/pc-bios/s390-ccw/start.S
@@ -19,7 +19,8 @@ _start:
     larl    %r15,stack + STACK_SIZE - STACK_FRAME_SIZE   /* Set up stack */
 
     /* clear bss */
-    larl    %r2,__bss_start
+    larl    %r2,bss_start_literal   /* __bss_start might be unaligned ... */
+    lg      %r2,0(%r2)              /* ... so load it indirectly */
     larl    %r3,_end
     slgr    %r3,%r2    /* get sizeof bss */
     ltgr    %r3,%r3    /* bss empty? */
@@ -45,7 +46,6 @@ done:
 memsetxc:
     xc      0(1,%r1),0(%r1)
 
-
 /*
  * void disabled_wait(void)
  *
@@ -113,6 +113,8 @@ io_new_code:
     br      %r14
 
     .align  8
+bss_start_literal:
+    .quad   __bss_start
 disabled_wait_psw:
     .quad   0x0002000180000000,0x0000000000000000
 enabled_wait_psw:

From b806bc8d9cc16172f0cf2c9e42ca1d75b72f6555 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 29 Jun 2023 12:01:56 +0200
Subject: [PATCH 0323/1353] pc-bios: Update the s390 bios images with the
 recent changes

The startup code of the bios has slightly been changed, apart
from that, there should not be any functional changes this time.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 pc-bios/s390-ccw.img     | Bin 42608 -> 42608 bytes
 pc-bios/s390-netboot.img | Bin 67232 -> 67232 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/pc-bios/s390-ccw.img b/pc-bios/s390-ccw.img
index c9a5a21c50b9e78a7048d456d842ddbfdf9e6ba3..f0d9ef6d4d86eb8d8ace19cac3929b9c06ae826f 100644
GIT binary patch
delta 2507
zcmZ`*dr(tX8b9YtOu|FB;SmA`ykHQ5x<tfBQ6NE$Ryzpmim%-r$F;5N+DaX}vt3<^
z4r6DmRpirJse=fC+uDw%Ubn>^2ks_Tts@eZ@^IX)yJ=^wN;fFASd{EJH}nrXvnP}L
zo%8#C=bZ0+k8^ME3Iwk}?L?{^5I>E4-%Ql@zWKoIq}57zaPntTvslG7<&Lmk-~!lR
z7alh#VfpiUR3#EZ1uUbBs166~bMYb-(*Gad5nhKnaF}K%xDNj-C$#u8mu2rr`6vF0
z9q;_`@9mfmYiS$SLXvs&7@3O*BO%f1n9c0~6VNj3g{&N%qJlpu$!SA)eCp1#_}<MZ
zXcAMXV+=ku{EVKhR;)=%_KblZ@fj`Haf>GDO`kuEexf|1)%Z5t+aGigtHSif-%BH*
z#mYB?#3k@&R=>i0RNSkGgh(%6j}0~p<hnK}3xdj7A|(^z6obu*gXvdF&k@6X7KD;=
zF;bd9s5CqDqsq$&c>Fj{TL>**;sUKGN~U`mq?kmPiFP7QWW;S`J|~*Ae7lyvVvTk-
zJ%Z=7(<W5KWk@w-CD&3#8X~i#HbRtYLRP$v+HtwGAM?j$z4#BVH*V!-7Clt^oB5NJ
ztMjU)q0rad#1%7HuR&$CsI1j0t4KvosoWRzdL>B6Q9sAXUjiZ%TE$N2(<J=cxZ<R>
z*JG()B+}4mXD<=hk6TR2P|(@NFTJj(o-w2lUAoNivltQ_L#+5GU3R2i&*-e3HejQ!
zn7)a(bsM3jUS6V)rxD$3bMAm>e96$I-^lyR%W+=BtTeY#vJs2ZX(!i-g9t=*Z&v6r
zr?}t1+K5Rs5zj<CAFt(h&;6dCCDx>BZ74)0rrug5GCLTWv7GtfqBMt;@!)Z<xHGUM
za(!CU(SRUClUgZ_0CTyH$&j=yRLK`<_M<nlz)-Iae)$S&qwLV^##vE0hI-X|O>=Q$
zQ~@-<CcC4a2O5pvjW<ExebmJaL*JIVSUdDpU|#I2(3gfyu{qFZz^kz%v;i**S#%FR
z5Nz~yv>08M-a>XzHM=bDvCwZLlcZI|sCWqJwPTfWEA%|V2gWtfa|ui1W@i3<{&WWm
zM(EO^6P}68+QE)^4=_2vt-jfyG!oMD5q=OioxY1V<1*l8C630K;pWR|j(-Vya<Mu-
zC9c)EO7JvsZmUJ9WltM^9Pfqx&#*G#Fbk0(aRKx%#?r*y(67aw#4YqTx=j0^y9Rqq
zR_J~WpP1G|cQLL@s)@TXbXH610z$Bnl@yDGZwQa3m=k>e;m%LK&CdkM{5-y|<P5We
zM&Br8<PV6IO-skdj0DS#X{?*2(ye7;u#r!p&3vtoL~Ka5#&qvvGuqhl%vM>C{^Wc(
z&0L*w5WL6vX5c-DpQg;D@8JEE{d6Jjm|&xJY@M(k&fdjH%VhYl2lFgW`UP&Y*ytH-
zuxx^Bn=mrf0@v1Jc4{?TOTiPVhZDU#MFM4PXRXr{Y~;z}zl0TOdkp?6ZjXOEHyHfP
zscFM$T@M3-XPKHn4wgVmSpq#^vXocrqJB&e^P%esE)iG8*0G3vUY8eitE#urBW{JR
z->3$3m10TyF6fHJ3+Y!PueO+*dbbDNK{v*vn&B!tSH=an$}(ZnAE9#yA5F4C=eKCF
zcG7)#*E)&rz?e)|%)o+s{|#0$2eBj=D8coaOKAe0%*+=DXuwW*K?|W!NDkQ98LR=p
zPsmPwocrG)OrB1^#r(+!VQ3Ftp8O)+iuSBh(@-w6*r#VrDI+AWj4wQti3hW$#oIVK
zhUcsJIPA{Kr3TbyZ-j?!_-gjdiEYw}(5Pf4H1W7}o+PQ2#}=A?k-PL^J$kd(z{7Qz
zW=p4=&|&+XhKyLS)iy%UVpGnRsGVO@vfFQ9d3_nLPDzssrmUioe6Pn6OO*~hI(3SM
zJZ1(@T}CV9lxeGB1{t2i3B%J%L<b4jS=Xu`RgtLyk&SAZ4a(VSlCB>OUpm7gw&pJ4
zm7DukL|d3!d`7Oa7Xm#bpUZoL>igI|ND2pVUVeJiEq2*|&7D@*A#co2rR=@7d*)LO
zdGfKmdzO#VuW-p68_%#gzlG0V!R|SgaDEhB&z+^3x`Grqk7y~FO}+T5f<Mr=P$~E)
z)ys`@>nQm2m|rM@Zz@(49!oap_4l>}?JSgjLTm%l$kRKlcBuC*#uS-E?|D|V)cdxx
za?s3fG{VZ_60x!u(j9hEs&vW=iaZoLp5UY6{j>&mJGO%2#vdIPP!6HlIS-U7tZ){A
z;=*^GqCuI>@{uZe*zU}Rju75)TA(9{x{_U>)X95Fj!-&?)&+N<BL!m?{sP)}$wdq2
zQhEXZ>{<uyzsFlHE3}I;Ec!xAQ}N1Dnfm1F7dnCdS}tAo1EuTGRlc2;$lmfs3hjmR
zhUL9E^c$R4l}!8OimDZ0JfK#by^-grNa(2pc&>U4oa&IxJ8M$0yJ0(3u<Td@Cb$LM
zaBKq0vcdWaIH}-qYBKH(e{%fvmB79VLdTMf9`Z~ByPVaypBjD4p=1X8Q&p|;;l<;d
zAkQw(XtDy^WtBVE$X>O)X~txg1K)G!Mhu71ox|vN&o(OIQNx&I-%{q5c9spjEl2(b
D-K0M$

delta 2326
zcmZ`*4Nz3q6~5=}>Mr=h?g9(TuCj~E&k}@HK@kJ&5`?IXqK?K;Yb-&>A*~w5q0`zj
zkkB-faRPE2VxkqI;2L8#m^bOjB$Z7~aRX>JU;rB`AewQYNnR|Zc0laC59~}b)BEP#
z_wG68e&@UAoO|DsyHM`J+Gsd;)cWV(w`8WYx8$Qk5zhu@2Hu}MRq2Xc^`dh|uM-dC
z_uQHBsh`+Co)0r>28;?JA2eh;kwRBNXZwHlv-seo2api<^ZGd{FCQLvZTvndyMFun
zWAMV3qm+t2gGQ>wh{)U-bj3-Kp0W8eV;{Al5m|uxFrJJm{bRfL<ykiWv&&W)qu4AJ
z)}s57TIHhystA*7R(P@H$J!ohP(`foDH*GgUCi#|Alct|CLcZRyUUnizUbq>@NvZK
z&wW<Lyi2-6<TE<ft(GO7PO-`Hm>6?g<ug9+!W&wrHbE3csa?2dn0BhI_+B?vsEyk2
zDS@)*6FRA01<iCrz0_Q8i1AdjX9Nmd@{F^Uo=c4RDjC~WMV2`!@C6mjiGS`(q1TrR
z?^$EYdx_}TMrB^PXZ+C};dz^zznxO7{-juKR;<=25|3h=tI_ym#@<U3vh7QKPKFEO
zsDDm&#P;qG2w0hCd^*s_bo>%r*#=6U>sXN2tpOfVMUqY>b7L1Q;}UsR5>54U6UaX|
z8;G=;eRyG)RHg}qpqtzm$9OkDuWLWo{7SrU-9sfoE3qV&P6kEcyP0$;XbCuIAZVQ<
zNHAJ6Ay|eOg>6aZh)$<w>Ji<=T4v`f`@4{Ck!fRa6rTT@N`s5BxP`9s(erm`G&n<B
zRION4QPMmop5I5i<|S&2wg}wfO;kHC1J9>PUGvtVNw3k24a)mwa-G%cnfz|Im^sWS
zdEo;bdYKYJoH$fUMIrlfXgPI+B;t^Teh8U_Gjv}U4>c5}cffBcSD%N2o9T!?5(jhX
ztiB8fgDJ{TgtrE$+>i$CbirWJ-u}SX$k?qm3K*8b3Bu4A%k65hPV+UM{X@{|NoOc3
zNaXPLVRD7;O}_P%$H8=kI{AWP_^Kf$vW%PV6~*b@wnNu)T3~vezFOXA(v8r+;&3M&
z4|@Zu$r+xD!#k-w{1qIIr0MVjaF_NQU&n#tG;Orwz#qsSQH%py>D7p8!+^F`&FV&U
zawCrhk5reI7Dq;gbxsPurXfKPO}-Y!I`2#CBVB-B@%5S(<5zCFV2VU3mD)}Ag#)KK
z!X=Kt>3n3S2c}f~hzB$37<POp@UY_?-HJ+sItnw_z<O#jJ0Oj&n~U+2X<BZH!;7O-
zWO2iFI%#o0E45on@n!`T*erPS02MB(#GA>~z37ebUJ<8}LQYieZjl>B#QF!QV)1L*
z{yIUwzlL<tVc1_yanTR3Uqe=_8NQ(>t*O{IL}k`zLeBC^`di&{xk>D@{08c`mSNwE
zimSe2Dz&|YeOCI`)`h*T^l^+8dpYx%cI@T(T~dy{JUn(ge)*7c?bmp{8)BD06|IcT
zTR5>}>^u1&4}p%ciS6`S>;_1n-q=)}2&egR7Mwszj9UiZ($2VJICYBd$L)b%(~kI!
z#;K<`r7IfVe1(iHFBAw<tLfwTrJ>0}IxA0A<R+SmPk{xLl&}vcyQn@P4gNx12^O66
z(r7{vP9CB>hYb$UKF9MaP&w(kV-hY?N8$l^Map=h5`uZY+c*^PFn^l#gbILjN!kRZ
zQqIz6aRsmfp=4`wtS&a<<W%gMX+`21vGP$ZPk^trlG!xV%Jv49O4n2JK~F~KAA`CS
zTbAvY&N?#@-jVJs{|#vV$&VS91yqu1n<sl#vpXVFnLSc%>LP%(<V}010<}-_uDk*;
zLS^X=Q3vU}@LCm3r60s=2HL;6b&+<gL4KMa1e4RUz)Sp0M9ZElxOI6bH)9p_((f`}
z;5+PI#vqs_|C&0$PBZPyv|^`=Dl!{**cN9Q(>ta|T5LO*y)D{SDT?27NcEgR>FDQs
z3OX9x2fvTxTaxjT_A@&_*6#_ee^~luRtunCM~huGaGboZGOPcRXB}gFNsI$Ie0Lu`
zdiWo4qGJeOBKY4Sm-|Wd*HMK#3;jiO*=^POH}Jv(e;$49PC$Ps>2fUSS5tD%OXxo<
zeUS4ezz<ZAdk?QB)5^8U*j_K~UAqRLlTPRD#`fQnI^T}%sZwJ8XKIL{@eLCArE>+>
z5Pl(*Z~8aD9@@Y8Fyu?4n;QY!H%mvh_9dD}MH$T$DF3qU7EEvaOY~R%AyrgtLw&Qd
zv7C*3V+rbQ&2*=-2-|ujS5@^Qa-K-1Pfs0&bL46Wqml-*^7-G6-T=J~M*Wf5ueXoQ
zv;aM7h|oVC%?i;a#W&V~z9+y1EBFnHLe)c8-!8>vtE3gD?Z`dsXiCvHDk`R$eO5T>
icvDJ{n8;gIfC5dc^s}SKzbpK=B(nK3?54ivH~$OL01Kf2

diff --git a/pc-bios/s390-netboot.img b/pc-bios/s390-netboot.img
index 682da24a05d3b13d9530fe1123b242e38109e1c3..6908e49f06801808b826d3a01f88132cf1b2f57c 100644
GIT binary patch
delta 11001
zcmbVy30PEDvhY2Zmc|Vm1iIN9XaoVJ!3{SA1*3@CQKPL<gFCL^z5_OkOVlXkk{Bl<
zE?12)#5P78HAI;_$4Puf$!^?QjZtGjiP3=cUsc^O$(xz?f8WE;d+XG8>eQ)I=hV4f
zvO!g{LAB}Y=4BH9smeCrh)o{rXgqMfHPjUN-_?O{I6!Z8-k;x+<g$tBVHeJWNoYg<
z1D9ZRs89oI#7n{zcB^8+E;Rp<-|XmBn87GVdfk6hY+5;d>H0gLCp|TJ{h$j=8F&R|
z$vZ?2s9j=x=Os9}+1_{$NoqxHb-oFPy1eGuJkv>aU{}craKNQMivHpfE9OD4%EvF?
z#4PGnlG~qn^Nlc6rS&ayQsqBW3(iBXN-O_eXWgwbwJg@O3>~f1)#X*(k)&p0EA)~y
z=QP9X=&63S0*9|a2ThtG%QIA2AazzwBI1nXqAalAVfMF)(NIxgB*wQjNuoDg)%b^H
zAyFK-K}7veo}uL`$x}&jSyZtJv0t*_BJlI*-tq^ev?s3KCK&G#JWj*3R|zxiEIr$Q
zPtRT&rMuLEX%m=sOj#l|SKgFbC^|`nI(jPYCCQ|Dyn<zZP&(S}I*U>u;#g)J%j|&f
zJc8BB8D3rN8REOYT$XTDBH42dKD#uUGG+(#@QfCFVX9{c4r-0(ATa@|Jj>hmLS;f>
z1ryvWvJqYgC2fs9%2H*t<i#$Si%O!Yhhb*8+cr3Ni5YEDf+Ur09$J&^xmYm>54MT9
zT-Fe;{0ff36-Ox9^pBTFUXA1Edb4q4#MR@nXDE*;f<~t-XgE>sC3PcRv+9&(c02J*
zO;@%x>}>SatS2dq>`P3uRSeH!IGJFVG<wQf?4&zmqnIOFsck5?>1!e-A8IE>!+Edv
zYM#oeE#aA0i27^7Px%e>-m&6UFnLGj?%zkKS9?}yB(Z;&O;h708BlFpvX4em21+tp
z`D3x9k%({f+Zap*(q^QzAg}E&;_h1!ZOmW}v?%n5l$=pxK+kGWQ<~D<O+qfQKij0K
zF%aj_+sIkj5N|Wqz;E6@Vgb1O1m^zQ=y2>Hmes0>Szby{{V*KcJyh2tSzj}NFx|?j
zMSR)4s6FLnrS?UYlf%dy2O2qMMKDJaa#+ncQRx0q!bIky){_Kvx{!fmB75Vp0~R0i
z7g9d+E{let=z8buh<(2iZq!W-LX1?YoP4+M=VB>OBCnBO_Wek*v(nL@I$UF9o(wIt
z5rM~1#?#?tlvI&lvCl~2Fl%6lHoW~-<iLoNhARUF(GrTKY<lxrGrK11vjuUF`3ZJv
z{Y3<v(1zz;RhCK;T6mo;t|R*7GuZx`+B2ST`#26Yt;xj;8eGW{$`XvnT6-ePead{L
zDCdp+^~L`jTr-OpKNa!KS>I7=>u<5ldV&p;*C@61b!z^rsFtL2D~KqqwCVAsLWg)}
zEQe*fKH66=w-J~0XlmVGzQ&=Wvoy$Of=jygtp{CJi!vvsH@NzSx9*CVYA4133BHjn
z)M{jx)Ra{-e0z%Nu+uj{J{JTheW!>qp!XZ%bM_pL=Nws5VUnat_0+-HawzcY(AL9g
zAmMK?{w=8Vixt&S>-SpAx0E`22AV3JO^5ORU4l!LL-q!YW#PSBsg$&euOzX?`4vgX
z(-DsPcNZ_iLw~*eNiDbsgot5a444$Rs^X5_ZtsuI!!&_VGI=5s7YM>V>Dl0>RzKKP
zJpjYv5-$61p)z2$xDWAxomyj{AlC*mZBin*2ZhR$y1}-<q2f8*4U9lL-Gjo!PmC!6
zOHfbk99DR<akNvuA^Xp7hN>V%6vB$&(LxVj1;62coA_Rg!%XY)z(?|sT9xNXo@CgB
zk04LqLA(n`^h3pNXwYvK<6u+BY7qpw(8c0M*c9p=+=is<dz&>it#olp5BsxnAE^`m
z=WLkq6;y@}6rWh#!ww1&2`3DN;xQzK7m8C*iO(WPYgZ_6hVkhKBO?mMZMcfhBQP<t
zP%MFa`0NXF+82seP>av6U|G~k%;3+WUKj5`bxZ=BiY~;#IG|Qg6f+%Xx;o~+aJ#CG
z=?PCdGzb|UcU&vZ!irexPd1Lij55X;=Q2n67BpdAP-@(YdK2QZL@|{0N`uF7T|^>8
z#%JO3Dd`ps=i*bu*I-PDhEAPQ&@#g9L1+@(>y!^qI!D8{&g0NZ!UuOr!TyZhqF`f}
zRB@Q0281>+HLGiih+^n^R}(_UZdu|qw%-t|QGby<(#`_65>nAUq-0q4RMC~8vk1j9
z6yGBiH!q@=B6OJ{&z`9wjUfv{F{msG9wYP~Llb)q7Nt0}T=5DRd%rGTV-tStogwb<
zfQu6ci&=0ZF-xofQ=ieI91ivABrI^PPnJl6AxTSx7S1QF5+5QQ1q+f>MJAj~&cdmR
z>YF95zz%%A%(Tw^QpG}8)-Ox^#%-^ZRB;o=q%1}|cl3>h7b)pt2vVY9Vd`+%^n$@(
zQ%B&8GP1u({0-7xiiVp0W}Kz8mv)KInc_VlMT9a`h|n&$Fkrg)06GtRZ36CicKc6@
zC|pf=9I)H(RnYUt4HWhdKCU)P23oqf;*Jte`cKSrq;Un_J4o1<7ch1YOJ<|o_3BK=
z3Pc-g2Tu3BN)-D+UP{P6u~OYY>u_R)by1qPj2>H`9wByHkELe`j~Y%DWs;O}n-*Ng
zbLc!Iq~$%_9&S@#8UL_m4Dk@HkCVzfxaHdIxA#KM&<6RVQ`Q{QE|GhRajV$e!wfGc
zcyND)7t+(lTmJxsF}(GsA7OYZbH*{8!JHjfkDlPVT@1g*@LLQ|V;C6bG*q`Ch#N6X
zSj}*Eh8+eK!pUK84GkfT?JiRt2HjxzUB-V$&sz#%2C!1w7fkKT)PFF%jp4sBXEBrx
zKdAPm&7yx13>#sTSC(4~MnnsB7U5E>;P@+v?kiOfeyPsJX~F$;r3~`OIRC*-Q;Tf!
z7-AN6G%;f@!H|)ib60#~!x_LmMuW3wwHeVMgH3Zul4vYq#St5_BBqS+WYr)ywx=tm
zbCK`i;zqc%r;KBN+<4AW)f63R&&dEKK^l%)-LRh|yZwR<6RGRzI6NSM7&S(Oz}QjW
zs^^hyDHEWVIXrw2!-H%|HAX(;MnA}^u9j5lTJEj~Q+q*?x!d4Gh6Dc%Ck`vE8SZ6|
zP}b-O)j^*-y|D*_yVzz#78Pp@BQ5=YhZduwMLKjH{nuBy7U-9+Wb*$0%fBv@luu~T
zH;NjU$qk<Tf$5CJgR<RzeE_<mf!u-1<^5_C+JGGnY7gmSqT~WCEEyBlvKbm=rs*n>
zVE>q*VubbSm|tXZ4epK$lGoIO>-cZvH2^opca+yGw`yMN>EhePIfhcwHfk@Px@Zhy
z%><Y{ae%z~1RR<8yS(}w9GbMbeKJ-!188C6S!e*AvWc^ZPh_1wBDnAy>b&R&m^`_i
zTyzK4Pafu8bdbE^agQn6;o)SRPtkfp>FC55O{%bKQDgzXDG74nI2bV{b|3}1D6BMT
zs`r{pJ}?ox@d{a(_AOJoG3Em4EDXcr;~`s~hC(V^5^LL0ZB!Ugk%!Mf_-snHT=)nQ
zr|J?5eqgCQN3kMJX6Y**$70|VNNY{{>b;D)XwsMI%o+_=L1j|1zATB%E9?VXrcO2#
zuHPz^C7CpMW-72BNH!vo3>B={i{OIg5HQV8E|?7o(+oZZyhNIfRzf5!H0+PK0~5@f
zmf%^~ojgf`@ot1JXb-2RMY$L9(BkSVN>FcGsGSxn7uZ3U8P&CbkGYzzHdBct`Peeb
z@QKsqp>#(NQqMd*Z3|S}zR{}%S71qInDB<3nVp03-}%y|OqDHR`MD^0Q`tiYBhEMa
zb;KBWl-XZiJrlZ4k8&#*%NC7-%;}b(0<BqJrZMUH<R=Q;&7DqPMe!K2u%H>Z&4_om
zJfLxO+)q-LJ1}5IkX&>bGH0~Y<p0gADbpn9IoR`0!aFlk+={jkWBxX{KO;c4EVjDM
zj1uvdCuUQbhBZ8Fj4zW(FPTk`PtfozcT6TU0sDzP##|U>v)akn-TGMuKg+RX{nM&q
zm#28PLJr_K#(A^shYPdP{VW>@-TE^uf~bsY@|k5Z7-##LEYpdsIaDl{NJ=EK)HZZO
z@AO30JnDPZ6{2@=r+!y`j#WY)a?B?xa#7JER&k9T^MW}}!H(Hs+AC~zgxOf;MG<Lf
z$5w|x)$AyF)!O1Yq4KK5V3?EPp2sKsm{mm2s{o|<t?Eb}#v~WJph2|_{>jG27fD@S
zDO{Z6<DQ4f9LX=U#3pz==Vx&OZe;Zn`@oPr%)Rg?o4dCn17qlWD9Fx{3paymuHI0{
z*AcGYqM$T%7%rSaHVkx0Wz$z5;6M<COJTs=5prQVyfZgQE=+_obA9xMMw))Q8BjMk
z_5>WehB5~kRp<+~b0a2wfNc}{!&)pQQPm}-Y{phGapcdmC1D3t$#Q)gwH%>n;z=6K
zBgx`5Ss=ML;`_uiev%R`$%s2jynUh|XP&=z08<7bMKn^9V&KR;ZLFT9$uphGn@iC;
z3rQu|ny`_MUPJ)nzlPd*Y3Y_9NnI3ga+aG!=x0yXVW5%O-%>$H^!5*_ZTW)Xr?^|$
z%R{6P#UMScC`0_;DB0wng?00DatnN@^87fMv&uu|2;N5&h*mUH`F4seUP#3Lh&x-)
zitmvOD_@Q^P7vj>{ChNg`By0iGS62II*kEGl!iGg6Ez6S1#Dq8iWSA@_=MF97PaK%
z*yV+CLXzOpLO%#y7#eT6-NZKy_pu$+d*3?NjAtS&zG;Y3?=u8<`Ls!N(?WlL)Qh<N
zDD|!*P-yn4@BDE1bYc6JYnfiqC==7fM5#qs_(CP>8j=O7n9ZT%+&nDzAZd}m*a~A8
zEeOqfr_sWCZye=OOqlnTNZv6&C;wSC!sA7q<-GY2xmfSEiYi`__ZpZM_X=8-#EsrO
zkVLu^vERVHerB;=aA<LWkA>_0s8){kjoV}ru3BHXx;Ro^lLD?w_KCUH!%Jd>ygCiO
zTRK)=9SsS~#>z!M!nS2W9rJIH>gH?F!a?|-*L*%F+{oAQD$kvk65=D-D;MC_vP50c
zZnkC@U)pV>q)Wu2ZIG}$KrUJhBbTp`i(Y}M<wN8mz16V7O_mEItsQgT5pqF>^<r+g
z!1AFs&*GE+x=pXaMXJPNW-5?6a4fBa^{d9n`9tB}szf<I8X_%m;b*vawPQ)s(Wq`K
zxh40SEeYj0#B;Agj%AB%Ic@dI#{zKyoGH+X8P=}~0!746IDjY|$Vhxsc%`E{sS5{3
z#6OgeC3kAarhs2jFjjXxih7GZu%xJ)$c3_^4q`G~D~c7P!F_dDhk>MtMz5bumr(Zo
z+$L=u@c48IGfk}|1wSEu9ZO;S>Oj%nx?;75z_MiHnp7+=tJcKGxfeiQYm{@pgwAX8
z<lHTAd~FvGI^l5A$;~D=<PL`VwQ*RybzJvm*W8xe<!5~Fm9te{MmwDv*`$6GIe#6p
z*C&^isqp?_5Z<)Z)1uA!8S2;7kH}f%u&D7+lQW0g-;?`tGBN4#flC?K>=E{F#?h2E
zagL=<gFmGaI(C<4w6H~v3DVbx_?~ACy_n}I8>T0_b2>rM`aWUvn5tpw1&-RUaCNw{
zJYDsP92xGd50F<r0oM(Y^2$44++cKD`5CSDXER~P20t)u(8w#Tuw_G@&M@A2F4Rl1
zVWctu&u1EhhC<B70NFJO(l&OL^E!fMV|%Pq4{tQc1~<68G21WfoJ~X7S=nf}n~jvW
z#5*Jzb{fXMq0@yO8=Xf;c?Bci*A2jn7ddP<tbZdxZf1c`-*|%6=E+SI6yI%n5=-l#
zuk)5s7P*|6o+9og{NED?C5sg_;DBeOPRxe-&ErEu`%xn_(QGo|#Ty>IOvY9wjZuSp
zUuRsXa%d-5Q5@Au<&pdrA48<rudGLlbwVGq)?u7Pd!Zb%3`bHS8At{76tV>FL#XUB
z9^ALAXyp>zD4n<-wrz>PO8U%}&YAK9yh?i;6HNnV3>QbjX|R(z{e4c>wRqi<%k5jd
z5Pj$vZoAZ2v38uhFGw%>dA@>m4(<p+y1vLOCC0Bw!Y$G)<$9&!e9HQ>FlMVk*1r#V
zTfL{ZVsTyu{+^CAJ$LZtKRe*|#wG(IxLx!==qsA&TBa}f1Kos+O9KsCKlCl9MT6e|
z826U8-pLsMbC|n1e74Of2S0{}ZB_E}wNSO)A_w;d^P8FSa!)w>X1cuWfmQQXPa%GV
z^d0Twpl+~WhsiBSMbd$G_-seGi?Ba{+8yiM0{2n8+DoD6?FV>4Hg9Kgw5a!_iPmmK
zc2Q5~(kM<ue8FF@;vk++s_=&D+Rnh12bH>pYHA1E1=qivi3<3`XmLOA#FRvNR}NUi
zg{4aAgAtCd4Ojt>{&H6iXa#3VI)KZr39^4BOx-oo)4$};jQ(5T;;u)szaAMkhWcG1
zVZXoAswK64mu#jaOp~|*dExj~!kpb5Qp3@zXB8z#|3=r=oKzzDdyU4K#v`57&5o`N
z$221QeTJj6ejJ=f2|DgUPpO6DBTFQI83=v@ZtR{Qe4uY>w7M;?_EcC<+RoiCj~ZUZ
zG-$smaG<oCSPnNz4Y_`U9C=b*!=!Ms(UI2CIy}8fdRvA@C;715UC5Kq_uxrH_Un$H
zbMzR;Tu%Nxm!)0NwqeLmTgXhLIyAImSuM%_{2|MRqikoC-J^#5JzmiZP;4Ha#3g5{
zlYO6GZdP6DI1qWc(Xf5LpbmV$fwOy3JrZav9(2innN<6p2HoC$xx7bu40fK@`l8FF
zc2|%mnz-8*BB#{uA1v83`DmG7Nv`)iI{iUL_U+#!GZXuix@6!+HPGP_q(snE`gV7;
zTi?X`9lvIw3%`M0`@%f9+|<+~-$d5$0onTudS4g3cJ1!S*?4)%Db=RWqar>-l64Jm
zY+pp1A!M57j2|6iWnC5A-xoDfcMb*P$c-fQaGXO(*&%gh!Sl&_eG(?F@3>NLx-E$K
znYIq(kh&bRY4D{|g7Iuqz;&psD~1{S<7HhYytBWvteXT?`+Lc{DDYH_vd#li6r^cj
ziSl{}zOHC<=nu}3!i|m2@eIXJTcx<;ULwba8^CxVK-TVqAqV0O+SlpmlcdL7{)b7`
zTG;tik;&R=u=hY8u@r6}Fa&4^w!X>8cua}UD9<Pd?3}Z;9l&rfUe>k&^T7Z&pJ(J6
zZF5+0Fx1nh#?LUCSSzI%685n{*})*$=L%dp7%GS3-QK|@H=n~yIs&~8CG_%H!$;)>
z4Wk&j6g&IP+1YOxi!U*D4q~4>vCk3Pi?NfS?2uQAj~R(|PGTJr+c9x4V(XpQdc^uO
zwl88|II%AftD&vTrw_Qjo6y6@lUaOidUT!2Y}89i4@sElUHgJv;nNyDC>-K=6svu4
zjU>Du!?Je+(tKo!hF`O3Dfzf6Yp^`1ZNSLG%hE(<qp1JaW!Rd$=gnUPezK4(s=M*7
zUkmTkx)2sS4XVST?%w-oy?GyDlmeX(x6Ae3fC^0<N(P%m8#slZ_ZGzsiwyinL-Ssl
zBxOigPRQQ#n(!sqnnb&*_jtu@w<nphIgNV1LM@xV1aqJXGa+|1j?K%!eN4jdBeM5v
zxWS$vx-r(lFqUmj!gMHm4@5SBhomjE$_?|VdRNRcCs*%OaC<Mz|2+ye-@BAil=k$c
z)o%Yinm)Y5_p<hXuZ>WLGQ-O-_Q-H`3x*AF{K#tc#{}zsfRy(KigN45_eTpgSBN?{
zcvPm%<&2?y?z~?+hK`|=hNS<M#I!#*Esq!{#~!9~-qBuj;`n}6U&9jg;gU0yXIm$A
zU8Bwrcjh?P#33u0K3t?MZDi3uVwR(@;{$*7F@|@;sSiGS^|qojHZ$SkCkKVFZ$0}E
z9aEG>l07kjmC+6qY2S{)`7Lt05I45pLb{|sZ_}8Nj;SwHjUU5|8rDUWJ8<!+zjy@q
z@jF<RgA1jKQA-K(wQb_N-bCAkv|^;`nrIIo(dsWggE7{?+*fS|RI7UFF{b+@)bEen
zix>(*Xf8vc2+d+B5}|1f#UM11p>7C`L;cN@F&$DL=$&CqG2`@`D6TxV@Yua+>>eAN
z#=b?Vb+dP5<XLF2YPBIv0`o~gQ_Hm35OYlL<uR6gso%<k{Y)4R8ARZ{Mn91W>|T%V
zu;o}gFOP7RSj2=ZmI#20$8rZ9AdL5y&dXmfsp*;+E$^Fb+?2#Yvyi#Y{wo(#7c<pr
zee=V%LbQd$#|McTcy@fLZwV2+C~C^lF?3_h5gPn1toz8n1DA?!HC!Oj4XcB;gJj(9
zHnsWI$7>s0{-}${2DcM^#0VI0qMz`E^(P9|{2AUW40Po;MIHQJ-c$WL4K!#F^g1~(
zumm@{-}rQhm*!Zo=$KYXJ+yU&(v#Erl;U1AEV-nFZdLs7{=^sWdoJQNhbJCtM=*D1
zq;Og1O1~6wKy8vsOE48S+y>KMI|v=*{59<5{kRFC6qfokabYaBKg1E!{(TVNC&^8L
zN2p)Vi;9jH4h4f0c${&SPF#P+@j~)EX}$kff7$mpRKbhV6&x2iQVyA=dtePZ6CsQ9
z(7&Qv+r5Me=-?bF_M&M6n<~6?E$bQOMQ8VaUf~D40;ejhq7!6)(yeV967_%YpQ3G+
zSx<g4Nr<r!bZ%*21YU#UJ=mrI$0-9_ow21Sp?1D->|Cwf{CDf2%2d(z0pWai{Zmov
zkyiQBY_;tD!n)w|uZ8forvG<ySxpCFN#6y=ei0`EVB;4_9bM)-4ik>?iH;SRt6e4}
zch}?TuLRd4PDh+lDf&~?x{S8gfAP9-F({R=?#k$J1A4p)PxyAPx%lgt1r1LyP2jx{
z{)p=yCv`nm!zaP5DzNu>RMS`4Yrn&XpISQ(nXmtd_ft|WcT!?$E6`9f!fy$f^h@wq
zgvQ9BFuuxPoPlLkbJbgu^%|A37amuwgS;<iiox*k%Qr-!b;VZ~RDKvWR<p6X62DBh
zb!?>7mA0}PjiiE%?}v&fQ1<->G1i)Rb)Ud;^!5)akZ~<Y782xL^T&c<Cq8?^iE9(Y
zRPehVEY?7e>-|J$$hoeU8w8YGj}`C3rR)82>DD4pnJx+Z8HYw{j;%qqjOuTsJRF=G
z2Ig?(4QZC6V;qVR9pt8q#Gk&<{(TT>nN2hwq{&URxBKa9f{KmRza$%LFz3A(#`;wl
z!tMI$jWY6zWTR20JI(n{brvVVjR=3hFM^^Q5h4MO+?Xz=f$rwuZb^<x-Fc*URA;5;
zGCEt^?T>3vwg>+2i!+D;Z@2F}fwLlM!(r#m;Nkl)^`IAthFbVLmRgOGB<jwijHgYH
zL8Wpo5YJ=}Jtc6Dx-&TEUN|SNHVx7ZxP9RMiyu|7Xsas&_giry3zBYW#VD)!R;EYD
zoGA<R3+K$6GGS8Ygo(4JNSRsl|BQgIpNvz#GGx$@p`(UaQ)@pEGd@(|H$VJ4_Q>(J
z&TzbsedBze{U7+lQZvb|8Ay@?e|o+1ZE?PrINx)e@5#>h7;DDUM3>w<PQ5n|IPm}1
z_pL?$C;43a|F6S4^BjtAzxls+aCgoB&Ubg#zmp$}AG4hvus!{E47h;Jf5!hOLvH2#
zna`GDefIld7dX|hEL7lWlK+}J-#X{p$N83EfIV2W#2<BzP|+_$H-F*<Rd&zrIroS`
zy-GaecfR9yn)tg+Y6^PLpE@6-@ehCMRb?Lri(iB|zrBqtg2msr$I2pJjyG<fB#YZ(
y$wvcRM2?V!+xGJ+5!-x;L-f{?ZOueCj{}aD<5#NKiDvtNX5x$}->!BQZ~Z@9a`l-2

delta 11064
zcmbt42Ut{Bv-ez97Zu4;gau@|EK3(ztk_uvMQj^OM56{fDk}DtCy1bQk+DSMuf%rM
zs6p2xY7#^8o4owS<QZcUTa3EupTveG##q=lGrN%FFYkTdd-!?poM~rf&N*|=oV!(J
znyNBQ#dl3!llV{b+Um>kmZ8qZP1jpTO@aR#JMndg>8;KE^IMYKa+w}>{xDdDf9SvA
zB1QBkBq$Vpgcc5H;=v(w|CT@1#h(ghIm-9Kiy!YgRQYrH+TAN7;^U@-mJc@iK$g5w
zl!MkSJ|HjA$<6k*@scDDYHRaO!63I+;8V9G;?vagX>%QqUHrfEY5W57su`<YCh7k~
zUS@_Ijep?T&j_nsCP)2=ntx7jJD?fV3@(d+N?kMKF!kxv+?wl>)M#jpB1tojFq}tE
z?T{Lbz+{NirI{vs8`Zf|JN2j})MJvHI@fWX+1C@J>2Qsi7+=>ViS}?&7Zf%biQ=tI
zL{zSL8;@utZ#CI%eoX~pSF_-32=waI>>N^}iK|;GjPVK??as8}gqeJdp3z^^v#Yz>
zNovZp(M+pW7fMak*QBPZUechBE^4$SS#|ecWtnf()((e0Pt6wzEHi>-*1>tN5bXkn
zmsfg+25deeOX!ubco*WceZ46oE1|P@tk?vTyhFtnDD>_pM!*^GBR+|!OziJO3dT0B
z$ws&>RQZ_w_P19@NWK(;{c)%ymKX+G;f7C0PIfxlq#7iRel}WT@m`>sgcsWsNnCCm
zd3i8;(HK3H?8^Oxl5f2q9Vj~N8S!>L;caA}BFQ^-Zr$M{zEVfhmG!H-*x?|aNvZ0(
zx=r=5%DS7($nL~6U1B(s;cf)G^`xili=A|0Yy@*est@aq*p+)xk{`8`!r(LCXzfL&
zY2mSNsFsIh;sa1x#ET(dZ4s5TZ!D2tZd;?1#J-p9x_j=D3DqW8{B)AqSCZLEd!?jf
zBSrvDrhI8NQkqiK_VwiM-ATvD6rN}?7!k>manFR2)uE;|wUfJqTw-4<tL~nOI0s!s
z&f|4$?B;v$YYRV-1)hGvIk)Qrjvd6aS~p^rXVFthL*ITxb)7BBy;Q<<JU}ht%TA>B
z!~yEV=Vx3TX6C4>=g10Uj;_dIOUHr2@EZvewFI>uC8+Jk8R!$)+Xg#e@sVpu`LwGn
z8iJywuF(;DZG;<s4ksbbROtxCZtw0&DOaMXQC#+JBiXD}jHg~=pC{BoQ~$`|{V3z@
zj511UD6ZIN6zNNMhk^d#(PhYiGfo<!_7y}+tdz3p&1-FVokhtO#69u~Z1N8hA#m6~
zJm-wMNRrUPAK2nwi9X>dw!fqH)Vth1h_0qJgm`XUV+w@25a;7V2T!wUA2Z)(lxu<g
z^~C=?xu)eYejMVPu)h7&R?c%@g#;TW<f{*#J=OAGO|2x}JW0e?uVW~@GnYcHzK8!y
zr(Y1K6g2W_)pzJLhKbUCKloN3-Msf{t*CZk62T)Nym<m*YF(HR=pGOS*#TX|bl4lv
zQeGYbCjuslSHK)N&@b<EH2<&Eag7z7X03T2!J5E0A3v8ph#!BAddqtQ&IHDbUqBP|
zO0&PHPaPR(pOiNgW(2hl*`e-n)Zx?>E#6R%Oa5wrB$3AP3u=;(rvrQ()JY73XF-a*
z>=_tZhKk{k)N*`6LCtlC!_gaKg}DPE3pt*tW4H@F>zZq|H@DQL;w(6YtNeR7({j4F
z3q6C|Hpfv%i83;6d`~bKjPm#{urqj&cn*((BgI2Rg^AmY*$$P4F8;Gw;gx!CCtf7`
z3pc<ugDQ%kG-QM@!HtkrK|d1T^U;`C-ER6xUXsU=T*;dZ8~YwqC~@K~IHn8|JHRt^
zwHOOkp(}+EqKpf~O{g-q2=O85XWi0u_dN6oYG=peBYsj_{LjfR<2;-(_7$Jl3}L&4
zXa%2{3dAEA7+xT1;0!*CVPr&s7z&s1X@E(Q1>#4zh0lX9JE}mu3Xk#G8<s{F2pwo*
z3dDIRj`<I<3*2K%#Ma8VL^v5+Ac~xT2drx~MU1J8`%hu1jOzk!t?NW%kmHNQr%)PC
zeR-RQi-j=NoZvQFJqJpdFB~+lMV+Y$GsQZn>6!*|oA#n7B(|9;VxhWYEPUN2SzLgm
z#8~LnHW{rVoDHGL@VM=Akp@W}V_;{y(XgalEVOQ)g8dO@GeXr2d3Hz<t63_iL$YYi
z(A^GJgpxYW6dz%Gl_){|E9BvBEO0+D1w%th#&t>&of$ffP+Nw2c1{s*GIS83Zy7Rn
zNf84Xszk_)%3?t7nj#J`G`s5nu@ha(!JRFsTZtIYCj8nhL;S=JZ|y!nWJ7KDnIac5
zdW;Ysz|kIU#R|C7W2Q)kF-eO=5S&d~CXOH+1NoK|%)TcqGjW(Y_naxdgFW~h#<b*K
zDPj>6_nIl5a@&-gBCf;K<OOKwo}RJLJf*)FjFea?NEsr(C>U(idnk@3BYRuL-(X~)
zSP*^Eag;{(*&@DTN_c9rh+t?fLfhbc>J;%dB=>z~Yzj@ipXSq4wc@_yaQs+9&%amF
zl)w35ZMtNlWs9rrAo29S%{=?-SKp7j3H#zg#%^QDc_{ZoZKiYep^cifDFK&>;@Hj0
z2>HjI)Yj1&9QT=RMOq6PBeto3q}Xjc-hZa>`i0X(wIpTSqQy2=K=Q!QX0^BzT%*1+
zzP4o#^b*Z+4{<oIe@D-2yP<qgoxI?<t=zgr<gf$Rma)0jOkYCqfHa2Z(bL|CFsW}c
zCW|=_GCYYn+cTWOoNbtj8;Zm6bPL1d8Q#F~G=_m;PC-x04BWu|3<Xv)j0XsWody-b
ziNPBNg%iepgQ<%czRd7j44<dx)xCsCWu^A7nA)4EpEJCX;ZK-zJscdeTN^<8LhoW2
zH`FY5`^dItXspoAAzaE?_;grz&u$(!@78AHu;A9&ttoiFlo0e{!_Xp|Jd&8jQyQ32
zXJO1s?Q**Q&5k1=X=-#hdN#Wm4KmqvrzDAd5nbQ0BP(L62~Sq_^I&^AU@8~Oz1;YG
zn)ZZot>}5Vj%QWF>_~e~2B?YB5Y+09{UkXYC;pB}wDAWCcoqV$;Uh&fWDP&3olmwU
zPlW#I;o*ZA9%N6tXXfK<?9G|AwUS2rkW5JH&eSAWm)>zePliMP1t+?d)&%#lJ1A>*
zPSt*2xuUTRCwHaYj4T?~$cN8fbr3ir7Sn9+5%0bH5$Wx<QqAP8{O&(5lVl#4%PZ=a
z$z>k=zE%#x5_<kH07Jpyz~%B*trcy+4*SKysF5*p@dYRx8P==`8kA1MReT)Y897Ld
zvNeABt}JfAqtOO=wFdmgoRuqHhuSf%<%;Dt<&`dO0i9evY$a{O_u>JId=M2=VD7k7
zc~uP@8}~$B^*J0JzdAYvi<wkf*m&$or2{o_mfs=Y+P+J0*=6dy{5s5?5FwY}hD{R&
zdzK#{y4R0P*#gfd=>5vq5K4c9oF!G*wJ0x!n2CvU*+iHyF~0B5tnH*#SGzsE>HtPT
zlFVO|g=yb2r3Yh9kj}DLJSpz6=jv!mWlLgpYbt}vOf|Xq42O#ov*j|}{U+(VmtJS7
zTxVS(O<?H@AI9Uv$(M?(O6_*Wd}~#z_31ht7ChCGMX63A^UC_b_DK^=Woy<-)k#(z
z9+L7MyDVlTlG{yKu`j`;%c0feK)G}tq)s;Zm5w7yqY-MTgf)fZ4tJ0ad6N^p%PbU0
zBDZlTbZG*doE+m>#;zqitEoc0L7>Sr%4J%J%8cny$~B0tgWXysNq+W>YJB2wd8wT+
zg48p+=ie07M%PER6z4@|m<WKqne7ZEJHK(O)?`aqY0kG)RNrzk;&@|RhmM1~%--^<
zInaAbjC(1^rt}q9I3>?e8j`M5>#PbN^+c&(dfN{!qIfH^u(Ubor?&Aden5V--bsEG
z--h(52D$t^ESwslEBPW_SFN+;I@wD;hW%5M-OD!-W65TCGPR{#oMY2ZixF*#pQc-@
zb*$lG{rs|86)D|%|1h~%eA{Y86R@B7L(GM<EGt6B?lxta0*l|bD38umx;?ta9KiD!
z$E|ojoX_eXSiF|d%}-*zLlsj)%!+d$X?mcwnClnao=Uk&Qn8@Nb?%1I>4L1e)OXPZ
z5|8twev7`rf*=<U>T`&STvXqPq7%f?>N#^9hdtB7{IzU#e7d>Xmu6&fYqmNXu1$}T
zi&lefhEXocfp#-8JPW^M;bp{7_!(@SVGJzlz$i<l8(Q?RF34iO|0U@w+yj?p_<0s?
zX7Y<H@fyf8Z;SV#c4jZJ8`@<L_AL8}$Z^|iGH?>vVNLc@xoiXY&QeTel|*TL4h5w_
zBXQ;Qv*S#cG<KzS7taJywhYo|4VBA=!v0wXxvV#QIm=HeOQi9qTL5jHb5lU)b(A{D
zsIpMd%#IxYHny!85L=~`L=~2lycS!P#8EQGo`fAx)w+WWh*^SAEb%1qjYF%MyeRV}
z&w6|hX8^{lv676qgT&jTHI&Z|YN4?2{g5K+DM@BHHrqd*^z;2dtF}j)NU{1nl1lu0
z12)Rpi)hLC3!s^k*1wobuNV`BviK(=B)eJkIMc}NEA>Tn^et)^pQEm$AK`Z8I1(y_
zswU}CO*P`bplnle0yfTBnp0|^D)Yk-PAj+6{do6~FFZ(nsg@=euOwoBM4k1jV8yj0
z!^)Rnfn%UVR#HpDS8|P#AoE;u(#Z$(C=HWVCTbAHr?G{VCzcam;1kx*o!^Xo>LAp^
zk_4CM1wxy7#x}*g;F)hSPVkM?drt>z{(&?{k&99{t}xr5Xb`QM7Zmgr(cAAqsW+Vy
zg+`zHE{TJ0=S4RwV|rn|OsfVa$}OTqOXQeKNEWDKI!_(f?onI|*7-qV17yvgYb@MZ
z@5!?k=;cAom_Msgyk&mD!?O<L1?}X*C6Ks4aWCRcqHr=~Ea++|;uKhz!j5#O3lPU;
z?CUm*CBxALE&Yn|M1f{_xE6Ri7LB4P6mBhuk}LXy-@+YYp6&gGt%SU4F#Nn|l)S1f
zq%IyMm*0h*iw&(yuwav<CPiprKm5;&zJxPwR0&?&dD2osd=xu;8tyOdt}oxs)@<Pm
zx^<LwiCDfFQkS%p%U8jqC9lfmqv6_;fpU42t=+5cvRr1ibziz!$fcRKOF7{J>j%xU
zJiijKD>_`HYCNW<d?}8cDk*?X%SOs2!{PC=?s7?6NX$zJ|CD=w!MUXAZ1j}wN5sk-
z_9T?&DZcU=l;^FHi$AfMmSc6e5WdX!7c*=(@`FX>ZFC?89eD}gG`;$xI;lP9zR1tj
z4<%1($EQNfiV!UC(pGd6Dip5hD3(Lbia3!8cUHuU(O_5^7B_%2k@w1Ux^QyPz{aq)
z1Ux^T!c6l}l0qI3ru9yku`*c1*-BS>39L&t7p7pLe66sRyz(@77n$Xi-$QayuDo&+
zd|K4ri;g&)bXG2;FsvK~9>odbICL+5t;0$zi?Pd-e8;tPt+txBIxVtEy{2;h+T(a;
zsjk-G<v~BZRe45>cEvB?QSxl)ilt7A>Q6N*=5zZ3g>OYRCOtlJseK#W!T!_Ho2?C;
z6R6XWPsu~)_R{DM`XyGR!>H2GfRn5tnRy<uVG7y3q6@4m?Gd(^sd}d31tiYeZ*g@r
zW_h}h6)T#;<I<LL!Bg-ni;@d&LsFU9z2FS3;>XiqPgx*jl<DMx_h5TjuD;bI*TGPc
z<W^(UR6L;R5E>3$%UjBxsW7s<gIw4FD$Ap>P<_ALB)8JR)$;7X*w5`c%Fb%J!;x;L
zyd^f1Wb7x9wMws#eSbtQA>~&Y`K~?{Z(Zcr-LPp@qTIX~zFqYI%gqxNG%0?rco07b
zL($W9qbN67$r<Mn;`-qKF6flpB%d5^`Iyu-nFk(~V~jEVs1egU-D;Ki>}553SaoI{
z?tSfWp~^8`ptLf^!y~}5!FlBrf8O?SrCun}tDVM4v=_?JdFV-vWFi&RQ*<so0i)b(
z5*XIJ>d`E+Ub_1l*tsSWOX)Ayw99Pz0I$tn$3#<y8N<z)aOxbSF6urf>xX#PlEdwv
zc_I4IIoy7#zGQ7ZZ-+sV0=<V}p@TbuLEjU3rS6>zlW>bnmvVela6ILx6EJnHNsf9K
zD%Q4`;>+T^41&C=#?jI|m7}VD?||Fu8Vrc!cKJWh^Bd^?On>zcbSo|{U+`S_cEAU;
zXfXO8;@;xZ!h-XE26KDC#dT&m@(FmZKO-++4cFG^$&o3L`C6vDJP=O5)?dzhU{f}9
z5#l!(wJ}1D=mGf~t?m)Do5>McxVSOgP1ZgD&FjVP;rl4y+C8xD^_zG*mbb|gD{BI2
zp#9epyT%(0h~Y#;m-(`WOTWi+h}Pr@+}RY|Y@hnHu9n)SJK*=1V=<;bc#HdiH>M=Y
zyRxZ*D@%>q17|p@GUY?vUv9`IU-+^r4t%zZmBUWL{4Fnehwb_^W7sCRwB?Q*7KM!E
zM&nr$Hhx8`med;0+O0{LCUFJw!ZDtNrEkQgM59%YYpRfbS?`mcR3!!Zj=+(|Go6&E
z#ZZQ08j+23t8M!*B$pC&!p$yHQ|AYjsDZq;0czhED*|Eg)>y4SWBNk=)(B4{-_80~
zlGDcNaCj>v)7q`39ODpYp48rBQXJXnOzUVJ9$zKJo}trAerz{i7yPyjPa?9>f}d^_
zoX1#kIvlrWu{0g31|vUhA=8lR)ZoFgA<XwS%f_K>JCxm~1=!{ryAZ`@<5664r8?Ot
zPB*IEiYp5T)z_We4yA*n9C{f}Z%gs&N_ekbD0P}thkgQ4+jrz#VeA0cX{{%QT#EP(
zdH9^>Q-GXO#D6hQ7t6tF!IJ6RZu<urIdouy%rxv%YM+T4RbOXFkP=Bl8ESF1n_s~K
z9=}{+2+u<Q9bsM-q)+z@`NpyS0La~8QbL>Ioogp&&c>TlPN{Y!m#X*-RMr@d?}&V1
zFpC}wq+_hCT!be(VqQ`{N5KRNBMIFa?G#csN*zd0Ib~6lBurfAX;uGzT@ZPXwhrWw
z+P`nt;Y*{2;Mpdh3sG6w2#a^Nk(F%Nzq6gJOoMAXyUI!%Fsf!*34oz0()3WMmc;RW
z#S44>5F9DIU43x8jrbXBEAF_bD6rvCkhH6%9I_9_>}q2Q0Xq65DVWRuFsLEL9PBkT
zkRdbS(5@b089dx&Y8mok^DB((j4AOk<r#ICgL8IBduX@2jU3_+nY&xMhw$PF@q*Ib
zMsLG!fu<3}dR%Hn!iJkrv)dpWF2Lp8MmYj6_x2>Y8>oPj4evnzJ&9cn6?{~lTQ{7M
z%doRwU7h`kbFmL&=Ogwv7xp*Ac4h1|sM+J2Y{)?3Qy1|m5+j&646)B#*k_0hVr&{>
zpS!Tn5v!xE%+Lq)Zzgs&1TssgUBS?4(#?vbc9w*d-VdL1C=4wyg2E{-5%v;E1V4e|
zH(RC|n$m3eC7YI#!BZ{7^59`zDdB$V&TJQOkp6iYHm8Xde2e+=NEX%Az8Tmw_!E67
zi+uvVdySsK`)Iudzr(1vAbD>@PB4{MR-Q^GyF?o}O~2qxsyh}L_>Wu*E=ZCxBrGT7
z;KdF2Dr`-oT{U=;n(lBUS+hBf29KteU8%wxXvIv(T}@>3GI1Z1@Z*RaJQ+9G!$dd7
zI~gXh&8e6U<=_{QP2eGE4Xtw1d@A47beZQz@Bq;73ky0xlP%z9$|!0yeN}Zhp2X5u
zmo~|^m-f9NwEUGcU>IcWAENbS<|z1d|4Qv&3D#eMp>OpSAJ{g(H9}~)LezUeUA2GC
zP$K(3cU`a@!obi;LsEWY{Jn<d(aOca-~JTNJN{Q)IKH4&eqo8T4H7;sYH_{JP;ch=
z&jt=z&Gh3UWl=qga-Uh=fjtL;w1*kq0VfZ<`|@s8Z*FA8#ZLhW9ZRtd>_c>~Qi^sU
zCa`MSfubDiadMtRZa3n__6DTm(blfBA{|qoQHx)~%sSRZl%L?z!60!To*WG7bk@m*
zQkAHs3i*5*`0Nd|3ZzvcP2WJf3j=LI;uK7^1?RkCH=$ZhpZl2ZlTd#ca?fXIC_=Ls
z!U^ukVhF!#J0>#}i_kcRIv_L}^*6C#I;1`@I)j-q3WwiHz6bD67`$4L?*Z!?d|#tJ
zba&8oi5zeOJP-N%hc^h|RVZfihfJFXT@NX~0TU>e$_6IvWWvjkO@uTiOkx6uH^2hh
z4@LL}#4%wp6K1l62`(MV>9?0KEzY@ae|@Efdt$V_r^Q^6#8YY!bA9^HTufyHTfA%A
z^|p@?{_y@g{qSR^`@4$*wv(7I&6*<^7`ig%85;5yY<xE;j&DWW?{R@ZSFBDN-}1QM
zXlQR_9UI~5yY0nX&>!w0(jonDFA)rz4i{+qGc^*Tj$9EAXnM4Zb`?2l7zF)~_6^>J
z8{MybI>cLZELivs#PAu(_%wxsM<@58TZP@YAL($w=w^iuY+LajB>?YzzQpSeZ#>*u
zStD&XT;4UNL3KjSEL*EECDvVr^!MU~FRXYktnXIbj8MukMV*EVWP#%rdd|N_2tG*t
zdY@MHyl`kTNWn)L_n8aVn{m95ypP$QycZ+~JjKrV*w7f97dg^WGDm;c*7{haj1%{z
znvOnu3Dq*e<tg@}^MR@wU%fBhap`ab=<NRcrrdG_oUE~lE|B|CM<0I@4Lb0<=nG42
zCq5c4!~|&l*G0kccn@l}DitlArwnYh!<Irq5utGWuMcH!*>?1JitypWHelQDikgqK
zd4HO%mHmV*|BLU02(XR%uO_lqPqIok$oeV)KMQaEDyem|CC<Zy(?3C%ta7s{mQD(u
z{;F_2;xHtr$3-&D+Gb;I9;Zu$TTgX6Z2WpecuzIiaRyKL4&Pb$OPINJ4=_#Oy%1ja
z-QuLKU^RRg^k;&HjY2iVor>dOcV5;o-$_#2w3`}F+W-d3gtGxK;aB022n}i4iVU%M
zp)qt!!Y?~$l8H?+)zv`xnOWKq7Db2kH8lRFSVPAjsQ6}@coCj`vq}`%O20j!3A9(=
z)8Wy_Bri)h*B-}j);`W%w)Qw=Ul=5Qg_;XxBEvTD;tqjT>cj7o6V+8xmP;yM1fzrQ
z`Y8OF3QaaZT4n>y4QX-%tpE})89GbX(iLRI?@L7rerorMcSy~73(G~{zQrHn;4OM(
zT(xx5D7g`ZjH6NU41<bGW5d&M$_1-aB*By>*h;f!)Si`caWyr?=w;E55Mbl?259#~
zsL;bpKPd9^>tMLpT5i4`cKy&xd;zz92np@jOSxyLG}qp>nC}_z;4s+P6Rih*6t+uX
z%w_+eoL-7qCI>BMGu?X5ak}|@4hFLPa->^3eAj%_8SY<>6VpJsG5|jp&$tpigf4D6
z<NuyG;<!K@j!ksJlKi6)cd(&skjXEPuX$vBnd=QqV(2eP;mtuUeG<bu)GWzvC*jhS
zfDmuDk8yN;aosnz>rmK)n-1>U_$?Nbx7#7`yP6O%&DHlo>ff$Z;1XlqLu?sWGrjzW
z4eU2?(C~rMjEQrVc{65D96LU9?6|Cn@Y93QUYRrJ{0S-920T0<at=MikB9ho=!Wxc
z8|Qo<I^}vF{RjMZsgdN~2qejg{~+J>#-DA`-v`;Q_axVQl<PgXxuOj1J=EG+89Z_P
z#3}P9PEf+<D7OE26z!IC!`;brrRx9pzB=RoB%kB>-#Wg&)v5T}Xa92t*Y^I;eAg=e
zl{|*1J_7bT|B3-Kg!Rw(e`m<m`G4lKcRl!YuN(eAQV)CU7JEyzlJl>L>#c`WM~G;O
zzX=_xp&yv8{>T^3IJ`TR|40nlW#Tcvm**w&JMR>|1U=|an^)}wTu<#X^V=cft`KL}
zzaWbcac+IQEZWEkZP$;N#Wj)rZmOGDDrBj4{bw2x-z3{9b~SrlBhk_8u(Rd-kt=nw
QKDCiJCjPcw+gNP)Z{f56JOBUy


From 6574232fff6a810e1882c98aa7dcf23d6afe9a31 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:11:54 +0300
Subject: [PATCH 0324/1353] migration: Add switchover ack capability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Migration downtime estimation is calculated based on bandwidth and
remaining migration data. This assumes that loading of migration data in
the destination takes a negligible amount of time and that downtime
depends only on network speed.

While this may be true for RAM, it's not necessarily true for other
migrated devices. For example, loading the data of a VFIO device in the
destination might require from the device to allocate resources, prepare
internal data structures and so on. These operations can take a
significant amount of time which can increase migration downtime.

This patch adds a new capability "switchover ack" that prevents the
source from stopping the VM and completing the migration until an ACK
is received from the destination that it's OK to do so.

This can be used by migrated devices in various ways to reduce downtime.
For example, a device can send initial precopy metadata to pre-allocate
resources in the destination and use this capability to make sure that
the pre-allocation is completed before the source VM is stopped, so it
will have full effect.

This new capability relies on the return path capability to communicate
from the destination back to the source.

The actual implementation of the capability will be added in the
following patches.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/options.c | 21 +++++++++++++++++++++
 migration/options.h |  1 +
 qapi/migration.json | 12 +++++++++++-
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/migration/options.c b/migration/options.c
index b62ab30cd5..16007afca6 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -185,6 +185,8 @@ Property migration_properties[] = {
     DEFINE_PROP_MIG_CAP("x-zero-copy-send",
             MIGRATION_CAPABILITY_ZERO_COPY_SEND),
 #endif
+    DEFINE_PROP_MIG_CAP("x-switchover-ack",
+                        MIGRATION_CAPABILITY_SWITCHOVER_ACK),
 
     DEFINE_PROP_END_OF_LIST(),
 };
@@ -308,6 +310,13 @@ bool migrate_return_path(void)
     return s->capabilities[MIGRATION_CAPABILITY_RETURN_PATH];
 }
 
+bool migrate_switchover_ack(void)
+{
+    MigrationState *s = migrate_get_current();
+
+    return s->capabilities[MIGRATION_CAPABILITY_SWITCHOVER_ACK];
+}
+
 bool migrate_validate_uuid(void)
 {
     MigrationState *s = migrate_get_current();
@@ -547,6 +556,18 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
         }
     }
 
+    if (new_caps[MIGRATION_CAPABILITY_SWITCHOVER_ACK]) {
+        if (!new_caps[MIGRATION_CAPABILITY_RETURN_PATH]) {
+            error_setg(errp, "Capability 'switchover-ack' requires capability "
+                             "'return-path'");
+            return false;
+        }
+
+        /* Disable this capability until it's implemented */
+        error_setg(errp, "'switchover-ack' is not implemented yet");
+        return false;
+    }
+
     return true;
 }
 
diff --git a/migration/options.h b/migration/options.h
index 45991af3c2..9aaf363322 100644
--- a/migration/options.h
+++ b/migration/options.h
@@ -40,6 +40,7 @@ bool migrate_postcopy_ram(void);
 bool migrate_rdma_pin_all(void);
 bool migrate_release_ram(void);
 bool migrate_return_path(void);
+bool migrate_switchover_ack(void);
 bool migrate_validate_uuid(void);
 bool migrate_xbzrle(void);
 bool migrate_zero_blocks(void);
diff --git a/qapi/migration.json b/qapi/migration.json
index 5bb5ab82a0..47dfef0278 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -487,6 +487,16 @@
 #     and should not affect the correctness of postcopy migration.
 #     (since 7.1)
 #
+# @switchover-ack: If enabled, migration will not stop the source VM
+#     and complete the migration until an ACK is received from the
+#     destination that it's OK to do so.  Exactly when this ACK is
+#     sent depends on the migrated devices that use this feature.
+#     For example, a device can use it to make sure some of its data
+#     is sent and loaded in the destination before doing switchover.
+#     This can reduce downtime if devices that support this capability
+#     are present.  'return-path' capability must be enabled to use
+#     it.  (since 8.1)
+#
 # Features:
 #
 # @unstable: Members @x-colo and @x-ignore-shared are experimental.
@@ -502,7 +512,7 @@
            'dirty-bitmaps', 'postcopy-blocktime', 'late-block-activate',
            { 'name': 'x-ignore-shared', 'features': [ 'unstable' ] },
            'validate-uuid', 'background-snapshot',
-           'zero-copy-send', 'postcopy-preempt'] }
+           'zero-copy-send', 'postcopy-preempt', 'switchover-ack'] }
 
 ##
 # @MigrationCapabilityStatus:

From 1b4adb10f89802e41f730b3d2b5d85a551c6bce5 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:11:55 +0300
Subject: [PATCH 0325/1353] migration: Implement switchover ack logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement switchover ack logic. This prevents the source from stopping
the VM and completing the migration until an ACK is received from the
destination that it's OK to do so.

To achieve this, a new SaveVMHandlers handler switchover_ack_needed()
and a new return path message MIG_RP_MSG_SWITCHOVER_ACK are added.

The switchover_ack_needed() handler is called during migration setup in
the destination to check if switchover ack is used by the migrated
device.

When switchover is approved by all migrated devices in the destination
that support this capability, the MIG_RP_MSG_SWITCHOVER_ACK return path
message is sent to the source to notify it that it's OK to do
switchover.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/register.h |  2 ++
 migration/migration.c        | 32 +++++++++++++++++++--
 migration/migration.h        | 14 ++++++++++
 migration/savevm.c           | 54 ++++++++++++++++++++++++++++++++++++
 migration/savevm.h           |  1 +
 migration/trace-events       |  3 ++
 6 files changed, 104 insertions(+), 2 deletions(-)

diff --git a/include/migration/register.h b/include/migration/register.h
index a8dfd8fefd..90914f32f5 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -71,6 +71,8 @@ typedef struct SaveVMHandlers {
     int (*load_cleanup)(void *opaque);
     /* Called when postcopy migration wants to resume from failure */
     int (*resume_prepare)(MigrationState *s, void *opaque);
+    /* Checks if switchover ack should be used. Called only in dest */
+    bool (*switchover_ack_needed)(void *opaque);
 } SaveVMHandlers;
 
 int register_savevm_live(const char *idstr,
diff --git a/migration/migration.c b/migration/migration.c
index dc05c6f6ea..7653787f74 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -78,6 +78,7 @@ enum mig_rp_message_type {
     MIG_RP_MSG_REQ_PAGES,    /* data (start: be64, len: be32) */
     MIG_RP_MSG_RECV_BITMAP,  /* send recved_bitmap back to source */
     MIG_RP_MSG_RESUME_ACK,   /* tell source that we are ready to resume */
+    MIG_RP_MSG_SWITCHOVER_ACK, /* Tell source it's OK to do switchover */
 
     MIG_RP_MSG_MAX
 };
@@ -760,6 +761,11 @@ bool migration_has_all_channels(void)
     return true;
 }
 
+int migrate_send_rp_switchover_ack(MigrationIncomingState *mis)
+{
+    return migrate_send_rp_message(mis, MIG_RP_MSG_SWITCHOVER_ACK, 0, NULL);
+}
+
 /*
  * Send a 'SHUT' message on the return channel with the given value
  * to indicate that we've finished with the RP.  Non-0 value indicates
@@ -1405,6 +1411,7 @@ void migrate_init(MigrationState *s)
     s->vm_old_state = -1;
     s->iteration_initial_bytes = 0;
     s->threshold_size = 0;
+    s->switchover_acked = false;
 }
 
 int migrate_add_blocker_internal(Error *reason, Error **errp)
@@ -1721,6 +1728,7 @@ static struct rp_cmd_args {
     [MIG_RP_MSG_REQ_PAGES_ID]   = { .len = -1, .name = "REQ_PAGES_ID" },
     [MIG_RP_MSG_RECV_BITMAP]    = { .len = -1, .name = "RECV_BITMAP" },
     [MIG_RP_MSG_RESUME_ACK]     = { .len =  4, .name = "RESUME_ACK" },
+    [MIG_RP_MSG_SWITCHOVER_ACK] = { .len =  0, .name = "SWITCHOVER_ACK" },
     [MIG_RP_MSG_MAX]            = { .len = -1, .name = "MAX" },
 };
 
@@ -1959,6 +1967,11 @@ retry:
             }
             break;
 
+        case MIG_RP_MSG_SWITCHOVER_ACK:
+            ms->switchover_acked = true;
+            trace_source_return_path_thread_switchover_acked();
+            break;
+
         default:
             break;
         }
@@ -2693,6 +2706,20 @@ static void migration_update_counters(MigrationState *s,
                               bandwidth, s->threshold_size);
 }
 
+static bool migration_can_switchover(MigrationState *s)
+{
+    if (!migrate_switchover_ack()) {
+        return true;
+    }
+
+    /* No reason to wait for switchover ACK if VM is stopped */
+    if (!runstate_is_running()) {
+        return true;
+    }
+
+    return s->switchover_acked;
+}
+
 /* Migration thread iteration status */
 typedef enum {
     MIG_ITERATE_RESUME,         /* Resume current iteration */
@@ -2708,6 +2735,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
 {
     uint64_t must_precopy, can_postcopy;
     bool in_postcopy = s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE;
+    bool can_switchover = migration_can_switchover(s);
 
     qemu_savevm_state_pending_estimate(&must_precopy, &can_postcopy);
     uint64_t pending_size = must_precopy + can_postcopy;
@@ -2720,14 +2748,14 @@ static MigIterateState migration_iteration_run(MigrationState *s)
         trace_migrate_pending_exact(pending_size, must_precopy, can_postcopy);
     }
 
-    if (!pending_size || pending_size < s->threshold_size) {
+    if ((!pending_size || pending_size < s->threshold_size) && can_switchover) {
         trace_migration_thread_low_pending(pending_size);
         migration_completion(s);
         return MIG_ITERATE_BREAK;
     }
 
     /* Still a significant amount to transfer */
-    if (!in_postcopy && must_precopy <= s->threshold_size &&
+    if (!in_postcopy && must_precopy <= s->threshold_size && can_switchover &&
         qatomic_read(&s->start_postcopy)) {
         if (postcopy_start(s)) {
             error_report("%s: postcopy failed to start", __func__);
diff --git a/migration/migration.h b/migration/migration.h
index 30c3e97635..c859a0d35e 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -210,6 +210,13 @@ struct MigrationIncomingState {
      * contains valid information.
      */
     QemuMutex page_request_mutex;
+
+    /*
+     * Number of devices that have yet to approve switchover. When this reaches
+     * zero an ACK that it's OK to do switchover is sent to the source. No lock
+     * is needed as this field is updated serially.
+     */
+    unsigned int switchover_ack_pending_num;
 };
 
 MigrationIncomingState *migration_incoming_get_current(void);
@@ -440,6 +447,12 @@ struct MigrationState {
 
     /* QEMU_VM_VMDESCRIPTION content filled for all non-iterable devices. */
     JSONWriter *vmdesc;
+
+    /*
+     * Indicates whether an ACK from the destination that it's OK to do
+     * switchover has been received.
+     */
+    bool switchover_acked;
 };
 
 void migrate_set_state(int *state, int old_state, int new_state);
@@ -480,6 +493,7 @@ int migrate_send_rp_message_req_pages(MigrationIncomingState *mis,
 void migrate_send_rp_recv_bitmap(MigrationIncomingState *mis,
                                  char *block_name);
 void migrate_send_rp_resume_ack(MigrationIncomingState *mis, uint32_t value);
+int migrate_send_rp_switchover_ack(MigrationIncomingState *mis);
 
 void dirty_bitmap_mig_before_vm_start(void);
 void dirty_bitmap_mig_cancel_outgoing(void);
diff --git a/migration/savevm.c b/migration/savevm.c
index bc284087f9..cdf4793924 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2360,6 +2360,21 @@ static int loadvm_process_command(QEMUFile *f)
             error_report("CMD_OPEN_RETURN_PATH failed");
             return -1;
         }
+
+        /*
+         * Switchover ack is enabled but no device uses it, so send an ACK to
+         * source that it's OK to switchover. Do it here, after return path has
+         * been created.
+         */
+        if (migrate_switchover_ack() && !mis->switchover_ack_pending_num) {
+            int ret = migrate_send_rp_switchover_ack(mis);
+            if (ret) {
+                error_report(
+                    "Could not send switchover ack RP MSG, err %d (%s)", ret,
+                    strerror(-ret));
+                return ret;
+            }
+        }
         break;
 
     case MIG_CMD_PING:
@@ -2586,6 +2601,23 @@ static int qemu_loadvm_state_header(QEMUFile *f)
     return 0;
 }
 
+static void qemu_loadvm_state_switchover_ack_needed(MigrationIncomingState *mis)
+{
+    SaveStateEntry *se;
+
+    QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
+        if (!se->ops || !se->ops->switchover_ack_needed) {
+            continue;
+        }
+
+        if (se->ops->switchover_ack_needed(se->opaque)) {
+            mis->switchover_ack_pending_num++;
+        }
+    }
+
+    trace_loadvm_state_switchover_ack_needed(mis->switchover_ack_pending_num);
+}
+
 static int qemu_loadvm_state_setup(QEMUFile *f)
 {
     SaveStateEntry *se;
@@ -2789,6 +2821,10 @@ int qemu_loadvm_state(QEMUFile *f)
         return -EINVAL;
     }
 
+    if (migrate_switchover_ack()) {
+        qemu_loadvm_state_switchover_ack_needed(mis);
+    }
+
     cpu_synchronize_all_pre_loadvm();
 
     ret = qemu_loadvm_state_main(f, mis);
@@ -2862,6 +2898,24 @@ int qemu_load_device_state(QEMUFile *f)
     return 0;
 }
 
+int qemu_loadvm_approve_switchover(void)
+{
+    MigrationIncomingState *mis = migration_incoming_get_current();
+
+    if (!mis->switchover_ack_pending_num) {
+        return -EINVAL;
+    }
+
+    mis->switchover_ack_pending_num--;
+    trace_loadvm_approve_switchover(mis->switchover_ack_pending_num);
+
+    if (mis->switchover_ack_pending_num) {
+        return 0;
+    }
+
+    return migrate_send_rp_switchover_ack(mis);
+}
+
 bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
                   bool has_devices, strList *devices, Error **errp)
 {
diff --git a/migration/savevm.h b/migration/savevm.h
index fb636735f0..e894bbc143 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -65,6 +65,7 @@ int qemu_loadvm_state(QEMUFile *f);
 void qemu_loadvm_state_cleanup(void);
 int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
 int qemu_load_device_state(QEMUFile *f);
+int qemu_loadvm_approve_switchover(void);
 int qemu_savevm_state_complete_precopy_non_iterable(QEMUFile *f,
         bool in_postcopy, bool inactivate_disks);
 
diff --git a/migration/trace-events b/migration/trace-events
index cdaef7a1ea..5259c1044b 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -7,6 +7,7 @@ qemu_loadvm_state_section_partend(uint32_t section_id) "%u"
 qemu_loadvm_state_post_main(int ret) "%d"
 qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
 qemu_savevm_send_packaged(void) ""
+loadvm_state_switchover_ack_needed(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
 loadvm_state_setup(void) ""
 loadvm_state_cleanup(void) ""
 loadvm_handle_cmd_packaged(unsigned int length) "%u"
@@ -23,6 +24,7 @@ loadvm_postcopy_ram_handle_discard_end(void) ""
 loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s: %ud"
 loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
 loadvm_process_command_ping(uint32_t val) "0x%x"
+loadvm_approve_switchover(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
 postcopy_ram_listen_thread_exit(void) ""
 postcopy_ram_listen_thread_start(void) ""
 qemu_savevm_send_postcopy_advise(void) ""
@@ -180,6 +182,7 @@ source_return_path_thread_loop_top(void) ""
 source_return_path_thread_pong(uint32_t val) "0x%x"
 source_return_path_thread_shut(uint32_t val) "0x%x"
 source_return_path_thread_resume_ack(uint32_t v) "%"PRIu32
+source_return_path_thread_switchover_acked(void) ""
 migration_thread_low_pending(uint64_t pending) "%" PRIu64
 migrate_transferred(uint64_t tranferred, uint64_t time_spent, uint64_t bandwidth, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " max_size %" PRId64
 process_incoming_migration_co_end(int ret, int ps) "ret=%d postcopy-state=%d"

From 538ef4fe2f724f230834b72898138618637761f1 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:11:56 +0300
Subject: [PATCH 0326/1353] migration: Enable switchover ack capability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that switchover ack logic has been implemented, enable the
capability.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/options.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/migration/options.c b/migration/options.c
index 16007afca6..5a9505adf7 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -562,10 +562,6 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
                              "'return-path'");
             return false;
         }
-
-        /* Disable this capability until it's implemented */
-        error_setg(errp, "'switchover-ack' is not implemented yet");
-        return false;
     }
 
     return true;

From 7e6a5c730be49bd113a552cd2c4e4b91abfdd4fb Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:11:57 +0300
Subject: [PATCH 0327/1353] tests: Add migration switchover ack capability test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add migration switchover ack capability test. The test runs without
devices that support this capability, but is still useful to make sure
it didn't break anything.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/migration-test.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index b0c355bbd9..b9cc194100 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -1693,6 +1693,33 @@ static void test_precopy_tcp_plain(void)
     test_precopy_common(&args);
 }
 
+static void *test_migrate_switchover_ack_start(QTestState *from, QTestState *to)
+{
+
+    migrate_set_capability(from, "return-path", true);
+    migrate_set_capability(to, "return-path", true);
+
+    migrate_set_capability(from, "switchover-ack", true);
+    migrate_set_capability(to, "switchover-ack", true);
+
+    return NULL;
+}
+
+static void test_precopy_tcp_switchover_ack(void)
+{
+    MigrateCommon args = {
+        .listen_uri = "tcp:127.0.0.1:0",
+        .start_hook = test_migrate_switchover_ack_start,
+        /*
+         * Source VM must be running in order to consider the switchover ACK
+         * when deciding to do switchover or not.
+         */
+        .live = true,
+    };
+
+    test_precopy_common(&args);
+}
+
 #ifdef CONFIG_GNUTLS
 static void test_precopy_tcp_tls_psk_match(void)
 {
@@ -2737,6 +2764,10 @@ int main(int argc, char **argv)
 #endif /* CONFIG_GNUTLS */
 
     qtest_add_func("/migration/precopy/tcp/plain", test_precopy_tcp_plain);
+
+    qtest_add_func("/migration/precopy/tcp/plain/switchover-ack",
+                   test_precopy_tcp_switchover_ack);
+
 #ifdef CONFIG_GNUTLS
     qtest_add_func("/migration/precopy/tcp/tls/psk/match",
                    test_precopy_tcp_tls_psk_match);

From cf53efbbda2e45aad2f54b797f2ebfa001aad629 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:11:58 +0300
Subject: [PATCH 0328/1353] vfio/migration: Refactor vfio_save_block() to
 return saved data size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor vfio_save_block() to return the size of saved data on success
and -errno on error.

This will be used in next patch to implement VFIO migration pre-copy
support.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 6b58dddb88..235978fd68 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -241,8 +241,8 @@ static int vfio_query_stop_copy_size(VFIODevice *vbasedev,
     return 0;
 }
 
-/* Returns 1 if end-of-stream is reached, 0 if more data and -errno if error */
-static int vfio_save_block(QEMUFile *f, VFIOMigration *migration)
+/* Returns the size of saved data on success and -errno on error */
+static ssize_t vfio_save_block(QEMUFile *f, VFIOMigration *migration)
 {
     ssize_t data_size;
 
@@ -252,7 +252,7 @@ static int vfio_save_block(QEMUFile *f, VFIOMigration *migration)
         return -errno;
     }
     if (data_size == 0) {
-        return 1;
+        return 0;
     }
 
     qemu_put_be64(f, VFIO_MIG_FLAG_DEV_DATA_STATE);
@@ -262,7 +262,7 @@ static int vfio_save_block(QEMUFile *f, VFIOMigration *migration)
 
     trace_vfio_save_block(migration->vbasedev->name, data_size);
 
-    return qemu_file_get_error(f);
+    return qemu_file_get_error(f) ?: data_size;
 }
 
 /* ---------------------------------------------------------------------- */
@@ -335,6 +335,7 @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
 static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
 {
     VFIODevice *vbasedev = opaque;
+    ssize_t data_size;
     int ret;
 
     /* We reach here with device state STOP only */
@@ -345,11 +346,11 @@ static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
     }
 
     do {
-        ret = vfio_save_block(f, vbasedev->migration);
-        if (ret < 0) {
-            return ret;
+        data_size = vfio_save_block(f, vbasedev->migration);
+        if (data_size < 0) {
+            return data_size;
         }
-    } while (!ret);
+    } while (data_size);
 
     qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
     ret = qemu_file_get_error(f);

From 6cd1fe11598a304b8d22203365f4fc39172ec9b2 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:11:59 +0300
Subject: [PATCH 0329/1353] vfio/migration: Store VFIO migration flags in
 VFIOMigration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFIO migration flags are queried once in vfio_migration_init(). Store
them in VFIOMigration so they can be used later to check the device's
migration capabilities without re-querying them.

This will be used in the next patch to check if the device supports
precopy migration.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c           | 1 +
 include/hw/vfio/vfio-common.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 235978fd68..8d33414379 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -603,6 +603,7 @@ static int vfio_migration_init(VFIODevice *vbasedev)
     migration->vbasedev = vbasedev;
     migration->device_state = VFIO_DEVICE_STATE_RUNNING;
     migration->data_fd = -1;
+    migration->mig_flags = mig_flags;
 
     vbasedev->dirty_pages_supported = vfio_dma_logging_supported(vbasedev);
 
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index eed244f25f..5f29dab839 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -66,6 +66,7 @@ typedef struct VFIOMigration {
     int data_fd;
     void *data_buffer;
     size_t data_buffer_size;
+    uint64_t mig_flags;
 } VFIOMigration;
 
 typedef struct VFIOAddressSpace {

From eda7362af9595a9c6b1f1fefdd94b5ef711c250c Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:12:00 +0300
Subject: [PATCH 0330/1353] vfio/migration: Add VFIO migration pre-copy support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pre-copy support allows the VFIO device data to be transferred while the
VM is running. This helps to accommodate VFIO devices that have a large
amount of data that needs to be transferred, and it can reduce migration
downtime.

Pre-copy support is optional in VFIO migration protocol v2.
Implement pre-copy of VFIO migration protocol v2 and use it for devices
that support it. Full description of it can be found in the following
Linux commit: 4db52602a607 ("vfio: Extend the device migration protocol
with PRE_COPY").

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/vfio-migration.rst |  35 +++++---
 hw/vfio/common.c              |   6 +-
 hw/vfio/migration.c           | 165 ++++++++++++++++++++++++++++++++--
 hw/vfio/trace-events          |   4 +-
 include/hw/vfio/vfio-common.h |   2 +
 5 files changed, 190 insertions(+), 22 deletions(-)

diff --git a/docs/devel/vfio-migration.rst b/docs/devel/vfio-migration.rst
index 1b68ccf115..e896b2a673 100644
--- a/docs/devel/vfio-migration.rst
+++ b/docs/devel/vfio-migration.rst
@@ -7,12 +7,14 @@ the guest is running on source host and restoring this saved state on the
 destination host. This document details how saving and restoring of VFIO
 devices is done in QEMU.
 
-Migration of VFIO devices currently consists of a single stop-and-copy phase.
-During the stop-and-copy phase the guest is stopped and the entire VFIO device
-data is transferred to the destination.
-
-The pre-copy phase of migration is currently not supported for VFIO devices.
-Support for VFIO pre-copy will be added later on.
+Migration of VFIO devices consists of two phases: the optional pre-copy phase,
+and the stop-and-copy phase. The pre-copy phase is iterative and allows to
+accommodate VFIO devices that have a large amount of data that needs to be
+transferred. The iterative pre-copy phase of migration allows for the guest to
+continue whilst the VFIO device state is transferred to the destination, this
+helps to reduce the total downtime of the VM. VFIO devices opt-in to pre-copy
+support by reporting the VFIO_MIGRATION_PRE_COPY flag in the
+VFIO_DEVICE_FEATURE_MIGRATION ioctl.
 
 Note that currently VFIO migration is supported only for a single device. This
 is due to VFIO migration's lack of P2P support. However, P2P support is planned
@@ -29,10 +31,20 @@ VFIO implements the device hooks for the iterative approach as follows:
 * A ``load_setup`` function that sets the VFIO device on the destination in
   _RESUMING state.
 
+* A ``state_pending_estimate`` function that reports an estimate of the
+  remaining pre-copy data that the vendor driver has yet to save for the VFIO
+  device.
+
 * A ``state_pending_exact`` function that reads pending_bytes from the vendor
   driver, which indicates the amount of data that the vendor driver has yet to
   save for the VFIO device.
 
+* An ``is_active_iterate`` function that indicates ``save_live_iterate`` is
+  active only when the VFIO device is in pre-copy states.
+
+* A ``save_live_iterate`` function that reads the VFIO device's data from the
+  vendor driver during iterative pre-copy phase.
+
 * A ``save_state`` function to save the device config space if it is present.
 
 * A ``save_live_complete_precopy`` function that sets the VFIO device in
@@ -111,8 +123,10 @@ Flow of state changes during Live migration
 ===========================================
 
 Below is the flow of state change during live migration.
-The values in the brackets represent the VM state, the migration state, and
+The values in the parentheses represent the VM state, the migration state, and
 the VFIO device state, respectively.
+The text in the square brackets represents the flow if the VFIO device supports
+pre-copy.
 
 Live migration save path
 ------------------------
@@ -124,11 +138,12 @@ Live migration save path
                                   |
                      migrate_init spawns migration_thread
                 Migration thread then calls each device's .save_setup()
-                       (RUNNING, _SETUP, _RUNNING)
+                  (RUNNING, _SETUP, _RUNNING [_PRE_COPY])
                                   |
-                      (RUNNING, _ACTIVE, _RUNNING)
-             If device is active, get pending_bytes by .state_pending_exact()
+                  (RUNNING, _ACTIVE, _RUNNING [_PRE_COPY])
+      If device is active, get pending_bytes by .state_pending_{estimate,exact}()
           If total pending_bytes >= threshold_size, call .save_live_iterate()
+                  [Data of VFIO device for pre-copy phase is copied]
         Iterate till total pending bytes converge and are less than threshold
                                   |
   On migration completion, vCPU stops and calls .save_live_complete_precopy for
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index fa8fd949b1..25801de173 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -492,7 +492,8 @@ static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
             }
 
             if (vbasedev->pre_copy_dirty_page_tracking == ON_OFF_AUTO_OFF &&
-                migration->device_state == VFIO_DEVICE_STATE_RUNNING) {
+                (migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
+                 migration->device_state == VFIO_DEVICE_STATE_PRE_COPY)) {
                 return false;
             }
         }
@@ -537,7 +538,8 @@ static bool vfio_devices_all_running_and_mig_active(VFIOContainer *container)
                 return false;
             }
 
-            if (migration->device_state == VFIO_DEVICE_STATE_RUNNING) {
+            if (migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
+                migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
                 continue;
             } else {
                 return false;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 8d33414379..d8f6a22ae1 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -68,6 +68,8 @@ static const char *mig_state_to_str(enum vfio_device_mig_state state)
         return "STOP_COPY";
     case VFIO_DEVICE_STATE_RESUMING:
         return "RESUMING";
+    case VFIO_DEVICE_STATE_PRE_COPY:
+        return "PRE_COPY";
     default:
         return "UNKNOWN STATE";
     }
@@ -241,6 +243,25 @@ static int vfio_query_stop_copy_size(VFIODevice *vbasedev,
     return 0;
 }
 
+static int vfio_query_precopy_size(VFIOMigration *migration)
+{
+    struct vfio_precopy_info precopy = {
+        .argsz = sizeof(precopy),
+    };
+
+    migration->precopy_init_size = 0;
+    migration->precopy_dirty_size = 0;
+
+    if (ioctl(migration->data_fd, VFIO_MIG_GET_PRECOPY_INFO, &precopy)) {
+        return -errno;
+    }
+
+    migration->precopy_init_size = precopy.initial_bytes;
+    migration->precopy_dirty_size = precopy.dirty_bytes;
+
+    return 0;
+}
+
 /* Returns the size of saved data on success and -errno on error */
 static ssize_t vfio_save_block(QEMUFile *f, VFIOMigration *migration)
 {
@@ -249,6 +270,14 @@ static ssize_t vfio_save_block(QEMUFile *f, VFIOMigration *migration)
     data_size = read(migration->data_fd, migration->data_buffer,
                      migration->data_buffer_size);
     if (data_size < 0) {
+        /*
+         * Pre-copy emptied all the device state for now. For more information,
+         * please refer to the Linux kernel VFIO uAPI.
+         */
+        if (errno == ENOMSG) {
+            return 0;
+        }
+
         return -errno;
     }
     if (data_size == 0) {
@@ -265,6 +294,38 @@ static ssize_t vfio_save_block(QEMUFile *f, VFIOMigration *migration)
     return qemu_file_get_error(f) ?: data_size;
 }
 
+static void vfio_update_estimated_pending_data(VFIOMigration *migration,
+                                               uint64_t data_size)
+{
+    if (!data_size) {
+        /*
+         * Pre-copy emptied all the device state for now, update estimated sizes
+         * accordingly.
+         */
+        migration->precopy_init_size = 0;
+        migration->precopy_dirty_size = 0;
+
+        return;
+    }
+
+    if (migration->precopy_init_size) {
+        uint64_t init_size = MIN(migration->precopy_init_size, data_size);
+
+        migration->precopy_init_size -= init_size;
+        data_size -= init_size;
+    }
+
+    migration->precopy_dirty_size -= MIN(migration->precopy_dirty_size,
+                                         data_size);
+}
+
+static bool vfio_precopy_supported(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+
+    return migration->mig_flags & VFIO_MIGRATION_PRE_COPY;
+}
+
 /* ---------------------------------------------------------------------- */
 
 static int vfio_save_setup(QEMUFile *f, void *opaque)
@@ -285,6 +346,28 @@ static int vfio_save_setup(QEMUFile *f, void *opaque)
         return -ENOMEM;
     }
 
+    if (vfio_precopy_supported(vbasedev)) {
+        int ret;
+
+        switch (migration->device_state) {
+        case VFIO_DEVICE_STATE_RUNNING:
+            ret = vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_PRE_COPY,
+                                           VFIO_DEVICE_STATE_RUNNING);
+            if (ret) {
+                return ret;
+            }
+
+            vfio_query_precopy_size(migration);
+
+            break;
+        case VFIO_DEVICE_STATE_STOP:
+            /* vfio_save_complete_precopy() will go to STOP_COPY */
+            break;
+        default:
+            return -EINVAL;
+        }
+    }
+
     trace_vfio_save_setup(vbasedev->name, migration->data_buffer_size);
 
     qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
@@ -299,26 +382,42 @@ static void vfio_save_cleanup(void *opaque)
 
     g_free(migration->data_buffer);
     migration->data_buffer = NULL;
+    migration->precopy_init_size = 0;
+    migration->precopy_dirty_size = 0;
     vfio_migration_cleanup(vbasedev);
     trace_vfio_save_cleanup(vbasedev->name);
 }
 
+static void vfio_state_pending_estimate(void *opaque, uint64_t *must_precopy,
+                                        uint64_t *can_postcopy)
+{
+    VFIODevice *vbasedev = opaque;
+    VFIOMigration *migration = vbasedev->migration;
+
+    if (migration->device_state != VFIO_DEVICE_STATE_PRE_COPY) {
+        return;
+    }
+
+    *must_precopy +=
+        migration->precopy_init_size + migration->precopy_dirty_size;
+
+    trace_vfio_state_pending_estimate(vbasedev->name, *must_precopy,
+                                      *can_postcopy,
+                                      migration->precopy_init_size,
+                                      migration->precopy_dirty_size);
+}
+
 /*
  * Migration size of VFIO devices can be as little as a few KBs or as big as
  * many GBs. This value should be big enough to cover the worst case.
  */
 #define VFIO_MIG_STOP_COPY_SIZE (100 * GiB)
 
-/*
- * Only exact function is implemented and not estimate function. The reason is
- * that during pre-copy phase of migration the estimate function is called
- * repeatedly while pending RAM size is over the threshold, thus migration
- * can't converge and querying the VFIO device pending data size is useless.
- */
 static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
                                      uint64_t *can_postcopy)
 {
     VFIODevice *vbasedev = opaque;
+    VFIOMigration *migration = vbasedev->migration;
     uint64_t stop_copy_size = VFIO_MIG_STOP_COPY_SIZE;
 
     /*
@@ -328,8 +427,48 @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
     vfio_query_stop_copy_size(vbasedev, &stop_copy_size);
     *must_precopy += stop_copy_size;
 
+    if (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
+        vfio_query_precopy_size(migration);
+
+        *must_precopy +=
+            migration->precopy_init_size + migration->precopy_dirty_size;
+    }
+
     trace_vfio_state_pending_exact(vbasedev->name, *must_precopy, *can_postcopy,
-                                   stop_copy_size);
+                                   stop_copy_size, migration->precopy_init_size,
+                                   migration->precopy_dirty_size);
+}
+
+static bool vfio_is_active_iterate(void *opaque)
+{
+    VFIODevice *vbasedev = opaque;
+    VFIOMigration *migration = vbasedev->migration;
+
+    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
+}
+
+static int vfio_save_iterate(QEMUFile *f, void *opaque)
+{
+    VFIODevice *vbasedev = opaque;
+    VFIOMigration *migration = vbasedev->migration;
+    ssize_t data_size;
+
+    data_size = vfio_save_block(f, migration);
+    if (data_size < 0) {
+        return data_size;
+    }
+    qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
+
+    vfio_update_estimated_pending_data(migration, data_size);
+
+    trace_vfio_save_iterate(vbasedev->name, migration->precopy_init_size,
+                            migration->precopy_dirty_size);
+
+    /*
+     * A VFIO device's pre-copy dirty_bytes is not guaranteed to reach zero.
+     * Return 1 so following handlers will not be potentially blocked.
+     */
+    return 1;
 }
 
 static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
@@ -338,7 +477,7 @@ static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
     ssize_t data_size;
     int ret;
 
-    /* We reach here with device state STOP only */
+    /* We reach here with device state STOP or STOP_COPY only */
     ret = vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_STOP_COPY,
                                    VFIO_DEVICE_STATE_STOP);
     if (ret) {
@@ -457,7 +596,10 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
 static const SaveVMHandlers savevm_vfio_handlers = {
     .save_setup = vfio_save_setup,
     .save_cleanup = vfio_save_cleanup,
+    .state_pending_estimate = vfio_state_pending_estimate,
     .state_pending_exact = vfio_state_pending_exact,
+    .is_active_iterate = vfio_is_active_iterate,
+    .save_live_iterate = vfio_save_iterate,
     .save_live_complete_precopy = vfio_save_complete_precopy,
     .save_state = vfio_save_state,
     .load_setup = vfio_load_setup,
@@ -470,13 +612,18 @@ static const SaveVMHandlers savevm_vfio_handlers = {
 static void vfio_vmstate_change(void *opaque, bool running, RunState state)
 {
     VFIODevice *vbasedev = opaque;
+    VFIOMigration *migration = vbasedev->migration;
     enum vfio_device_mig_state new_state;
     int ret;
 
     if (running) {
         new_state = VFIO_DEVICE_STATE_RUNNING;
     } else {
-        new_state = VFIO_DEVICE_STATE_STOP;
+        new_state =
+            (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY &&
+             (state == RUN_STATE_FINISH_MIGRATE || state == RUN_STATE_PAUSED)) ?
+                VFIO_DEVICE_STATE_STOP_COPY :
+                VFIO_DEVICE_STATE_STOP;
     }
 
     /*
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index cfb60c354d..e328d644d2 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -162,6 +162,8 @@ vfio_save_block(const char *name, int data_size) " (%s) data_size %d"
 vfio_save_cleanup(const char *name) " (%s)"
 vfio_save_complete_precopy(const char *name, int ret) " (%s) ret %d"
 vfio_save_device_config_state(const char *name) " (%s)"
+vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
 vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size 0x%"PRIx64
-vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" stopcopy size 0x%"PRIx64
+vfio_state_pending_estimate(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
+vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" stopcopy size 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
 vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 5f29dab839..1db901c194 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -67,6 +67,8 @@ typedef struct VFIOMigration {
     void *data_buffer;
     size_t data_buffer_size;
     uint64_t mig_flags;
+    uint64_t precopy_init_size;
+    uint64_t precopy_dirty_size;
 } VFIOMigration;
 
 typedef struct VFIOAddressSpace {

From 745c42912a04306e8c7765dd4cc1574a92de4446 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 21 Jun 2023 14:12:01 +0300
Subject: [PATCH 0331/1353] vfio/migration: Add support for switchover ack
 capability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Loading of a VFIO device's data can take a substantial amount of time as
the device may need to allocate resources, prepare internal data
structures, etc. This can increase migration downtime, especially for
VFIO devices with a lot of resources.

To solve this, VFIO migration uAPI defines "initial bytes" as part of
its precopy data stream. Initial bytes can be used in various ways to
improve VFIO migration performance. For example, it can be used to
transfer device metadata to pre-allocate resources in the destination.
However, for this to work we need to make sure that all initial bytes
are sent and loaded in the destination before the source VM is stopped.

Use migration switchover ack capability to make sure a VFIO device's
initial bytes are sent and loaded in the destination before the source
stops the VM and attempts to complete the migration.
This can significantly reduce migration downtime for some devices.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/vfio-migration.rst | 10 +++++++++
 hw/vfio/migration.c           | 39 ++++++++++++++++++++++++++++++++++-
 include/hw/vfio/vfio-common.h |  1 +
 3 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/docs/devel/vfio-migration.rst b/docs/devel/vfio-migration.rst
index e896b2a673..b433cb5bb2 100644
--- a/docs/devel/vfio-migration.rst
+++ b/docs/devel/vfio-migration.rst
@@ -16,6 +16,13 @@ helps to reduce the total downtime of the VM. VFIO devices opt-in to pre-copy
 support by reporting the VFIO_MIGRATION_PRE_COPY flag in the
 VFIO_DEVICE_FEATURE_MIGRATION ioctl.
 
+When pre-copy is supported, it's possible to further reduce downtime by
+enabling "switchover-ack" migration capability.
+VFIO migration uAPI defines "initial bytes" as part of its pre-copy data stream
+and recommends that the initial bytes are sent and loaded in the destination
+before stopping the source VM. Enabling this migration capability will
+guarantee that and thus, can potentially reduce downtime even further.
+
 Note that currently VFIO migration is supported only for a single device. This
 is due to VFIO migration's lack of P2P support. However, P2P support is planned
 to be added later on.
@@ -45,6 +52,9 @@ VFIO implements the device hooks for the iterative approach as follows:
 * A ``save_live_iterate`` function that reads the VFIO device's data from the
   vendor driver during iterative pre-copy phase.
 
+* A ``switchover_ack_needed`` function that checks if the VFIO device uses
+  "switchover-ack" migration capability when this capability is enabled.
+
 * A ``save_state`` function to save the device config space if it is present.
 
 * A ``save_live_complete_precopy`` function that sets the VFIO device in
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index d8f6a22ae1..acbf0bb7ab 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -18,6 +18,8 @@
 #include "sysemu/runstate.h"
 #include "hw/vfio/vfio-common.h"
 #include "migration/migration.h"
+#include "migration/options.h"
+#include "migration/savevm.h"
 #include "migration/vmstate.h"
 #include "migration/qemu-file.h"
 #include "migration/register.h"
@@ -45,6 +47,7 @@
 #define VFIO_MIG_FLAG_DEV_CONFIG_STATE  (0xffffffffef100002ULL)
 #define VFIO_MIG_FLAG_DEV_SETUP_STATE   (0xffffffffef100003ULL)
 #define VFIO_MIG_FLAG_DEV_DATA_STATE    (0xffffffffef100004ULL)
+#define VFIO_MIG_FLAG_DEV_INIT_DATA_SENT (0xffffffffef100005ULL)
 
 /*
  * This is an arbitrary size based on migration of mlx5 devices, where typically
@@ -384,6 +387,7 @@ static void vfio_save_cleanup(void *opaque)
     migration->data_buffer = NULL;
     migration->precopy_init_size = 0;
     migration->precopy_dirty_size = 0;
+    migration->initial_data_sent = false;
     vfio_migration_cleanup(vbasedev);
     trace_vfio_save_cleanup(vbasedev->name);
 }
@@ -457,10 +461,17 @@ static int vfio_save_iterate(QEMUFile *f, void *opaque)
     if (data_size < 0) {
         return data_size;
     }
-    qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
 
     vfio_update_estimated_pending_data(migration, data_size);
 
+    if (migrate_switchover_ack() && !migration->precopy_init_size &&
+        !migration->initial_data_sent) {
+        qemu_put_be64(f, VFIO_MIG_FLAG_DEV_INIT_DATA_SENT);
+        migration->initial_data_sent = true;
+    } else {
+        qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
+    }
+
     trace_vfio_save_iterate(vbasedev->name, migration->precopy_init_size,
                             migration->precopy_dirty_size);
 
@@ -579,6 +590,24 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
             }
             break;
         }
+        case VFIO_MIG_FLAG_DEV_INIT_DATA_SENT:
+        {
+            if (!vfio_precopy_supported(vbasedev) ||
+                !migrate_switchover_ack()) {
+                error_report("%s: Received INIT_DATA_SENT but switchover ack "
+                             "is not used", vbasedev->name);
+                return -EINVAL;
+            }
+
+            ret = qemu_loadvm_approve_switchover();
+            if (ret) {
+                error_report(
+                    "%s: qemu_loadvm_approve_switchover failed, err=%d (%s)",
+                    vbasedev->name, ret, strerror(-ret));
+            }
+
+            return ret;
+        }
         default:
             error_report("%s: Unknown tag 0x%"PRIx64, vbasedev->name, data);
             return -EINVAL;
@@ -593,6 +622,13 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
     return ret;
 }
 
+static bool vfio_switchover_ack_needed(void *opaque)
+{
+    VFIODevice *vbasedev = opaque;
+
+    return vfio_precopy_supported(vbasedev);
+}
+
 static const SaveVMHandlers savevm_vfio_handlers = {
     .save_setup = vfio_save_setup,
     .save_cleanup = vfio_save_cleanup,
@@ -605,6 +641,7 @@ static const SaveVMHandlers savevm_vfio_handlers = {
     .load_setup = vfio_load_setup,
     .load_cleanup = vfio_load_cleanup,
     .load_state = vfio_load_state,
+    .switchover_ack_needed = vfio_switchover_ack_needed,
 };
 
 /* ---------------------------------------------------------------------- */
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 1db901c194..3dc5f2104c 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -69,6 +69,7 @@ typedef struct VFIOMigration {
     uint64_t mig_flags;
     uint64_t precopy_init_size;
     uint64_t precopy_dirty_size;
+    bool initial_data_sent;
 } VFIOMigration;
 
 typedef struct VFIOAddressSpace {

From 634f38f0f73f12b86a53195782b26506c107a418 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Thu, 1 Jun 2023 08:45:06 -0600
Subject: [PATCH 0332/1353] vfio: Implement a common device info helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A common helper implementing the realloc algorithm for handling
capabilities.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Robin Voetter <robin@streamhpc.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/s390x/s390-pci-vfio.c      | 37 ++++------------------------
 hw/vfio/common.c              | 46 ++++++++++++++++++++++++++---------
 include/hw/vfio/vfio-common.h |  1 +
 3 files changed, 41 insertions(+), 43 deletions(-)

diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index f51190d466..59a2e03873 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -289,38 +289,11 @@ static void s390_pci_read_pfip(S390PCIBusDevice *pbdev,
     memcpy(pbdev->zpci_fn.pfip, cap->pfip, CLP_PFIP_NR_SEGMENTS);
 }
 
-static struct vfio_device_info *get_device_info(S390PCIBusDevice *pbdev,
-                                                uint32_t argsz)
+static struct vfio_device_info *get_device_info(S390PCIBusDevice *pbdev)
 {
-    struct vfio_device_info *info = g_malloc0(argsz);
-    VFIOPCIDevice *vfio_pci;
-    int fd;
+    VFIOPCIDevice *vfio_pci = container_of(pbdev->pdev, VFIOPCIDevice, pdev);
 
-    vfio_pci = container_of(pbdev->pdev, VFIOPCIDevice, pdev);
-    fd = vfio_pci->vbasedev.fd;
-
-    /*
-     * If the specified argsz is not large enough to contain all capabilities
-     * it will be updated upon return from the ioctl.  Retry until we have
-     * a big enough buffer to hold the entire capability chain.  On error,
-     * just exit and rely on CLP defaults.
-     */
-retry:
-    info->argsz = argsz;
-
-    if (ioctl(fd, VFIO_DEVICE_GET_INFO, info)) {
-        trace_s390_pci_clp_dev_info(vfio_pci->vbasedev.name);
-        g_free(info);
-        return NULL;
-    }
-
-    if (info->argsz > argsz) {
-        argsz = info->argsz;
-        info = g_realloc(info, argsz);
-        goto retry;
-    }
-
-    return info;
+    return vfio_get_device_info(vfio_pci->vbasedev.fd);
 }
 
 /*
@@ -335,7 +308,7 @@ bool s390_pci_get_host_fh(S390PCIBusDevice *pbdev, uint32_t *fh)
 
     assert(fh);
 
-    info = get_device_info(pbdev, sizeof(*info));
+    info = get_device_info(pbdev);
     if (!info) {
         return false;
     }
@@ -356,7 +329,7 @@ void s390_pci_get_clp_info(S390PCIBusDevice *pbdev)
 {
     g_autofree struct vfio_device_info *info = NULL;
 
-    info = get_device_info(pbdev, sizeof(*info));
+    info = get_device_info(pbdev);
     if (!info) {
         return;
     }
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 25801de173..28ec9e999c 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -2846,11 +2846,35 @@ void vfio_put_group(VFIOGroup *group)
     }
 }
 
+struct vfio_device_info *vfio_get_device_info(int fd)
+{
+    struct vfio_device_info *info;
+    uint32_t argsz = sizeof(*info);
+
+    info = g_malloc0(argsz);
+
+retry:
+    info->argsz = argsz;
+
+    if (ioctl(fd, VFIO_DEVICE_GET_INFO, info)) {
+        g_free(info);
+        return NULL;
+    }
+
+    if (info->argsz > argsz) {
+        argsz = info->argsz;
+        info = g_realloc(info, argsz);
+        goto retry;
+    }
+
+    return info;
+}
+
 int vfio_get_device(VFIOGroup *group, const char *name,
                     VFIODevice *vbasedev, Error **errp)
 {
-    struct vfio_device_info dev_info = { .argsz = sizeof(dev_info) };
-    int ret, fd;
+    g_autofree struct vfio_device_info *info = NULL;
+    int fd;
 
     fd = ioctl(group->fd, VFIO_GROUP_GET_DEVICE_FD, name);
     if (fd < 0) {
@@ -2862,11 +2886,11 @@ int vfio_get_device(VFIOGroup *group, const char *name,
         return fd;
     }
 
-    ret = ioctl(fd, VFIO_DEVICE_GET_INFO, &dev_info);
-    if (ret) {
+    info = vfio_get_device_info(fd);
+    if (!info) {
         error_setg_errno(errp, errno, "error getting device info");
         close(fd);
-        return ret;
+        return -1;
     }
 
     /*
@@ -2894,14 +2918,14 @@ int vfio_get_device(VFIOGroup *group, const char *name,
     vbasedev->group = group;
     QLIST_INSERT_HEAD(&group->device_list, vbasedev, next);
 
-    vbasedev->num_irqs = dev_info.num_irqs;
-    vbasedev->num_regions = dev_info.num_regions;
-    vbasedev->flags = dev_info.flags;
+    vbasedev->num_irqs = info->num_irqs;
+    vbasedev->num_regions = info->num_regions;
+    vbasedev->flags = info->flags;
 
-    trace_vfio_get_device(name, dev_info.flags, dev_info.num_regions,
-                          dev_info.num_irqs);
+    trace_vfio_get_device(name, info->flags, info->num_regions, info->num_irqs);
+
+    vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
 
-    vbasedev->reset_works = !!(dev_info.flags & VFIO_DEVICE_FLAGS_RESET);
     return 0;
 }
 
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 3dc5f2104c..6d1b8487c3 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -216,6 +216,7 @@ void vfio_region_finalize(VFIORegion *region);
 void vfio_reset_handler(void *opaque);
 VFIOGroup *vfio_get_group(int groupid, AddressSpace *as, Error **errp);
 void vfio_put_group(VFIOGroup *group);
+struct vfio_device_info *vfio_get_device_info(int fd);
 int vfio_get_device(VFIOGroup *group, const char *name,
                     VFIODevice *vbasedev, Error **errp);
 

From f6b30c1984f7db16aa971d7f300e2191e5b730b6 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Thu, 8 Jun 2023 12:05:07 -0600
Subject: [PATCH 0333/1353] hw/vfio/pci-quirks: Support alternate offset for
 GPUDirect Cliques
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NVIDIA Turing and newer GPUs implement the MSI-X capability at the offset
previously reserved for use by hypervisors to implement the GPUDirect
Cliques capability.  A revised specification provides an alternate
location.  Add a config space walk to the quirk to check for conflicts,
allowing us to fall back to the new location or generate an error at the
quirk setup rather than when the real conflicting capability is added
should there be no available location.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci-quirks.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index f0147a050a..0ed2fcd531 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -1490,6 +1490,9 @@ void vfio_setup_resetfn_quirk(VFIOPCIDevice *vdev)
  * +---------------------------------+---------------------------------+
  *
  * https://lists.gnu.org/archive/html/qemu-devel/2017-08/pdfUda5iEpgOS.pdf
+ *
+ * Specification for Turning and later GPU architectures:
+ * https://lists.gnu.org/archive/html/qemu-devel/2023-06/pdf142OR4O4c2.pdf
  */
 static void get_nv_gpudirect_clique_id(Object *obj, Visitor *v,
                                        const char *name, void *opaque,
@@ -1530,7 +1533,9 @@ const PropertyInfo qdev_prop_nv_gpudirect_clique = {
 static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
-    int ret, pos = 0xC8;
+    int ret, pos;
+    bool c8_conflict = false, d4_conflict = false;
+    uint8_t tmp;
 
     if (vdev->nv_gpudirect_clique == 0xFF) {
         return 0;
@@ -1547,6 +1552,40 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
         return -EINVAL;
     }
 
+    /*
+     * Per the updated specification above, it's recommended to use offset
+     * D4h for Turing and later GPU architectures due to a conflict of the
+     * MSI-X capability at C8h.  We don't know how to determine the GPU
+     * architecture, instead we walk the capability chain to mark conflicts
+     * and choose one or error based on the result.
+     *
+     * NB. Cap list head in pdev->config is already cleared, read from device.
+     */
+    ret = pread(vdev->vbasedev.fd, &tmp, 1,
+                vdev->config_offset + PCI_CAPABILITY_LIST);
+    if (ret != 1 || !tmp) {
+        error_setg(errp, "NVIDIA GPUDirect Clique ID: error getting cap list");
+        return -EINVAL;
+    }
+
+    do {
+        if (tmp == 0xC8) {
+            c8_conflict = true;
+        } else if (tmp == 0xD4) {
+            d4_conflict = true;
+        }
+        tmp = pdev->config[tmp + PCI_CAP_LIST_NEXT];
+    } while (tmp);
+
+    if (!c8_conflict) {
+        pos = 0xC8;
+    } else if (!d4_conflict) {
+        pos = 0xD4;
+    } else {
+        error_setg(errp, "NVIDIA GPUDirect Clique ID: invalid config space");
+        return -EINVAL;
+    }
+
     ret = pci_add_capability(pdev, PCI_CAP_ID_VNDR, pos, 8, errp);
     if (ret < 0) {
         error_prepend(errp, "Failed to add NVIDIA GPUDirect cap: ");

From c17408892319712c12357e5d1c6b305499c58c2a Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Date: Tue, 13 Jun 2023 15:09:43 +0100
Subject: [PATCH 0334/1353] vfio/pci: Call vfio_prepare_kvm_msi_virq_batch() in
 MSI retry path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When vfio_enable_vectors() returns with less than requested nr_vectors
we retry with what kernel reported back. But the retry path doesn't
call vfio_prepare_kvm_msi_virq_batch() and this results in,

qemu-system-aarch64: vfio: Error: Failed to enable 4 MSI vectors, retry with 1
qemu-system-aarch64: ../hw/vfio/pci.c:602: vfio_commit_kvm_msi_virq_batch: Assertion `vdev->defer_kvm_irq_routing' failed

Fixes: dc580d51f7dd ("vfio: defer to commit kvm irq routing when enable msi/msix")
Reviewed-by: Longpeng <longpeng2@huawei.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 73874a94de..8fb2c53a63 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -663,6 +663,8 @@ static void vfio_msi_enable(VFIOPCIDevice *vdev)
 
     vfio_disable_interrupts(vdev);
 
+    vdev->nr_vectors = msi_nr_vectors_allocated(&vdev->pdev);
+retry:
     /*
      * Setting vector notifiers needs to enable route for each vector.
      * Deferring to commit the KVM routes once rather than per vector
@@ -670,8 +672,6 @@ static void vfio_msi_enable(VFIOPCIDevice *vdev)
      */
     vfio_prepare_kvm_msi_virq_batch(vdev);
 
-    vdev->nr_vectors = msi_nr_vectors_allocated(&vdev->pdev);
-retry:
     vdev->msi_vectors = g_new0(VFIOMSIVector, vdev->nr_vectors);
 
     for (i = 0; i < vdev->nr_vectors; i++) {

From 808642a2f6407157f8cfb48ba6c2d28efd038d62 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 28 Jun 2023 10:31:11 +0300
Subject: [PATCH 0335/1353] vfio/migration: Reset bytes_transferred properly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, VFIO bytes_transferred is not reset properly:
1. bytes_transferred is not reset after a VM snapshot (so a migration
   following a snapshot will report incorrect value).
2. bytes_transferred is a single counter for all VFIO devices, however
   upon migration failure it is reset multiple times, by each VFIO
   device.

Fix it by introducing a new function vfio_reset_bytes_transferred() and
calling it during migration and snapshot start.

Remove existing bytes_transferred reset in VFIO migration state
notifier, which is not needed anymore.

Fixes: 3710586caa5d ("qapi: Add VFIO devices migration stats in Migration stats")
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c           |  6 +++++-
 include/hw/vfio/vfio-common.h |  1 +
 migration/migration.c         |  1 +
 migration/migration.h         |  1 +
 migration/savevm.c            |  1 +
 migration/target.c            | 17 +++++++++++++++--
 6 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index acbf0bb7ab..7cf143926c 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -697,7 +697,6 @@ static void vfio_migration_state_notifier(Notifier *notifier, void *data)
     case MIGRATION_STATUS_CANCELLING:
     case MIGRATION_STATUS_CANCELLED:
     case MIGRATION_STATUS_FAILED:
-        bytes_transferred = 0;
         /*
          * If setting the device in RUNNING state fails, the device should
          * be reset. To do so, use ERROR state as a recover state.
@@ -818,6 +817,11 @@ int64_t vfio_mig_bytes_transferred(void)
     return bytes_transferred;
 }
 
+void vfio_reset_bytes_transferred(void)
+{
+    bytes_transferred = 0;
+}
+
 int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
 {
     int ret = -ENOTSUP;
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 6d1b8487c3..1d19c6f251 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -229,6 +229,7 @@ int vfio_block_multiple_devices_migration(Error **errp);
 void vfio_unblock_multiple_devices_migration(void);
 int vfio_block_giommu_migration(Error **errp);
 int64_t vfio_mig_bytes_transferred(void);
+void vfio_reset_bytes_transferred(void);
 
 #ifdef CONFIG_LINUX
 int vfio_get_region_info(VFIODevice *vbasedev, int index,
diff --git a/migration/migration.c b/migration/migration.c
index 7653787f74..096e8191d1 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1628,6 +1628,7 @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
      */
     memset(&mig_stats, 0, sizeof(mig_stats));
     memset(&compression_counters, 0, sizeof(compression_counters));
+    reset_vfio_bytes_transferred();
 
     return true;
 }
diff --git a/migration/migration.h b/migration/migration.h
index c859a0d35e..a80b22b703 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -514,6 +514,7 @@ bool migration_rate_limit(void);
 void migration_cancel(const Error *error);
 
 void populate_vfio_info(MigrationInfo *info);
+void reset_vfio_bytes_transferred(void);
 void postcopy_temp_page_reset(PostcopyTmpPage *tmp_page);
 
 #endif
diff --git a/migration/savevm.c b/migration/savevm.c
index cdf4793924..95c2abf47c 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1622,6 +1622,7 @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
     migrate_init(ms);
     memset(&mig_stats, 0, sizeof(mig_stats));
     memset(&compression_counters, 0, sizeof(compression_counters));
+    reset_vfio_bytes_transferred();
     ms->to_dst_file = f;
 
     qemu_mutex_unlock_iothread();
diff --git a/migration/target.c b/migration/target.c
index 00ca007f97..f39c9a8d88 100644
--- a/migration/target.c
+++ b/migration/target.c
@@ -14,12 +14,25 @@
 #include "hw/vfio/vfio-common.h"
 #endif
 
+#ifdef CONFIG_VFIO
 void populate_vfio_info(MigrationInfo *info)
 {
-#ifdef CONFIG_VFIO
     if (vfio_mig_active()) {
         info->vfio = g_malloc0(sizeof(*info->vfio));
         info->vfio->transferred = vfio_mig_bytes_transferred();
     }
-#endif
 }
+
+void reset_vfio_bytes_transferred(void)
+{
+    vfio_reset_bytes_transferred();
+}
+#else
+void populate_vfio_info(MigrationInfo *info)
+{
+}
+
+void reset_vfio_bytes_transferred(void)
+{
+}
+#endif

From 8bbcb64a71d84627b0171a205a5f3586eaa1e081 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Wed, 28 Jun 2023 10:31:12 +0300
Subject: [PATCH 0336/1353] vfio/migration: Make VFIO migration
 non-experimental
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The major parts of VFIO migration are supported today in QEMU. This
includes basic VFIO migration, device dirty page tracking and precopy
support.

Thus, at this point in time, it seems appropriate to make VFIO migration
non-experimental: remove the x prefix from enable_migration property,
change it to ON_OFF_AUTO and let the default value be AUTO.

In addition, make the following adjustments:
1. When enable_migration is ON and migration is not supported, fail VFIO
   device realization.
2. When enable_migration is AUTO (i.e., not explicitly enabled), require
   device dirty tracking support. This is because device dirty tracking
   is currently the only method to do dirty page tracking, which is
   essential for migrating in a reasonable downtime. Setting
   enable_migration to ON will not require device dirty tracking.
3. Make migration error and blocker messages more elaborate.
4. Remove error prints in vfio_migration_query_flags().
5. Rename trace_vfio_migration_probe() to
   trace_vfio_migration_realize().

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 16 ++++++-
 hw/vfio/migration.c           | 79 +++++++++++++++++++++++------------
 hw/vfio/pci.c                 |  4 +-
 hw/vfio/trace-events          |  2 +-
 include/hw/vfio/vfio-common.h |  6 +--
 5 files changed, 73 insertions(+), 34 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 28ec9e999c..77e2ee0e5c 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -381,7 +381,7 @@ static unsigned int vfio_migratable_device_num(void)
     return device_num;
 }
 
-int vfio_block_multiple_devices_migration(Error **errp)
+int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
 {
     int ret;
 
@@ -390,6 +390,12 @@ int vfio_block_multiple_devices_migration(Error **errp)
         return 0;
     }
 
+    if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
+        error_setg(errp, "Migration is currently not supported with multiple "
+                         "VFIO devices");
+        return -EINVAL;
+    }
+
     error_setg(&multiple_devices_migration_blocker,
                "Migration is currently not supported with multiple "
                "VFIO devices");
@@ -427,7 +433,7 @@ static bool vfio_viommu_preset(void)
     return false;
 }
 
-int vfio_block_giommu_migration(Error **errp)
+int vfio_block_giommu_migration(VFIODevice *vbasedev, Error **errp)
 {
     int ret;
 
@@ -436,6 +442,12 @@ int vfio_block_giommu_migration(Error **errp)
         return 0;
     }
 
+    if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
+        error_setg(errp,
+                   "Migration is currently not supported with vIOMMU enabled");
+        return -EINVAL;
+    }
+
     error_setg(&giommu_migration_blocker,
                "Migration is currently not supported with vIOMMU enabled");
     ret = migrate_add_blocker(giommu_migration_blocker, errp);
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 7cf143926c..1db7d52ab2 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -724,14 +724,6 @@ static int vfio_migration_query_flags(VFIODevice *vbasedev, uint64_t *mig_flags)
     feature->argsz = sizeof(buf);
     feature->flags = VFIO_DEVICE_FEATURE_GET | VFIO_DEVICE_FEATURE_MIGRATION;
     if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
-        if (errno == ENOTTY) {
-            error_report("%s: VFIO migration is not supported in kernel",
-                         vbasedev->name);
-        } else {
-            error_report("%s: Failed to query VFIO migration support, err: %s",
-                         vbasedev->name, strerror(errno));
-        }
-
         return -errno;
     }
 
@@ -810,6 +802,27 @@ static int vfio_migration_init(VFIODevice *vbasedev)
     return 0;
 }
 
+static int vfio_block_migration(VFIODevice *vbasedev, Error *err, Error **errp)
+{
+    int ret;
+
+    if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
+        error_propagate(errp, err);
+        return -EINVAL;
+    }
+
+    vbasedev->migration_blocker = error_copy(err);
+    error_free(err);
+
+    ret = migrate_add_blocker(vbasedev->migration_blocker, errp);
+    if (ret < 0) {
+        error_free(vbasedev->migration_blocker);
+        vbasedev->migration_blocker = NULL;
+    }
+
+    return ret;
+}
+
 /* ---------------------------------------------------------------------- */
 
 int64_t vfio_mig_bytes_transferred(void)
@@ -824,40 +837,54 @@ void vfio_reset_bytes_transferred(void)
 
 int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
 {
-    int ret = -ENOTSUP;
+    Error *err = NULL;
+    int ret;
 
-    if (!vbasedev->enable_migration) {
-        goto add_blocker;
+    if (vbasedev->enable_migration == ON_OFF_AUTO_OFF) {
+        error_setg(&err, "%s: Migration is disabled for VFIO device",
+                   vbasedev->name);
+        return vfio_block_migration(vbasedev, err, errp);
     }
 
     ret = vfio_migration_init(vbasedev);
     if (ret) {
-        goto add_blocker;
+        if (ret == -ENOTTY) {
+            error_setg(&err, "%s: VFIO migration is not supported in kernel",
+                       vbasedev->name);
+        } else {
+            error_setg(&err,
+                       "%s: Migration couldn't be initialized for VFIO device, "
+                       "err: %d (%s)",
+                       vbasedev->name, ret, strerror(-ret));
+        }
+
+        return vfio_block_migration(vbasedev, err, errp);
     }
 
-    ret = vfio_block_multiple_devices_migration(errp);
+    if (!vbasedev->dirty_pages_supported) {
+        if (vbasedev->enable_migration == ON_OFF_AUTO_AUTO) {
+            error_setg(&err,
+                       "%s: VFIO device doesn't support device dirty tracking",
+                       vbasedev->name);
+            return vfio_block_migration(vbasedev, err, errp);
+        }
+
+        warn_report("%s: VFIO device doesn't support device dirty tracking",
+                    vbasedev->name);
+    }
+
+    ret = vfio_block_multiple_devices_migration(vbasedev, errp);
     if (ret) {
         return ret;
     }
 
-    ret = vfio_block_giommu_migration(errp);
+    ret = vfio_block_giommu_migration(vbasedev, errp);
     if (ret) {
         return ret;
     }
 
-    trace_vfio_migration_probe(vbasedev->name);
+    trace_vfio_migration_realize(vbasedev->name);
     return 0;
-
-add_blocker:
-    error_setg(&vbasedev->migration_blocker,
-               "VFIO device doesn't support migration");
-
-    ret = migrate_add_blocker(vbasedev->migration_blocker, errp);
-    if (ret < 0) {
-        error_free(vbasedev->migration_blocker);
-        vbasedev->migration_blocker = NULL;
-    }
-    return ret;
 }
 
 void vfio_migration_exit(VFIODevice *vbasedev)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 8fb2c53a63..73e19a04b2 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3347,8 +3347,8 @@ static Property vfio_pci_dev_properties[] = {
                     VFIO_FEATURE_ENABLE_REQ_BIT, true),
     DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
                     VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
-    DEFINE_PROP_BOOL("x-enable-migration", VFIOPCIDevice,
-                     vbasedev.enable_migration, false),
+    DEFINE_PROP_ON_OFF_AUTO("enable-migration", VFIOPCIDevice,
+                            vbasedev.enable_migration, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_BOOL("x-no-mmap", VFIOPCIDevice, vbasedev.no_mmap, false),
     DEFINE_PROP_BOOL("x-balloon-allowed", VFIOPCIDevice,
                      vbasedev.ram_block_discard_allowed, false),
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index e328d644d2..ee7509e68e 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -155,7 +155,7 @@ vfio_load_cleanup(const char *name) " (%s)"
 vfio_load_device_config_state(const char *name) " (%s)"
 vfio_load_state(const char *name, uint64_t data) " (%s) data 0x%"PRIx64
 vfio_load_state_device_data(const char *name, uint64_t data_size, int ret) " (%s) size 0x%"PRIx64" ret %d"
-vfio_migration_probe(const char *name) " (%s)"
+vfio_migration_realize(const char *name) " (%s)"
 vfio_migration_set_state(const char *name, const char *state) " (%s) state %s"
 vfio_migration_state_notifier(const char *name, const char *state) " (%s) state %s"
 vfio_save_block(const char *name, int data_size) " (%s) data_size %d"
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 1d19c6f251..93429b9abb 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -139,7 +139,7 @@ typedef struct VFIODevice {
     bool needs_reset;
     bool no_mmap;
     bool ram_block_discard_allowed;
-    bool enable_migration;
+    OnOffAuto enable_migration;
     VFIODeviceOps *ops;
     unsigned int num_irqs;
     unsigned int num_regions;
@@ -225,9 +225,9 @@ typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
 extern VFIOGroupList vfio_group_list;
 
 bool vfio_mig_active(void);
-int vfio_block_multiple_devices_migration(Error **errp);
+int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp);
 void vfio_unblock_multiple_devices_migration(void);
-int vfio_block_giommu_migration(Error **errp);
+int vfio_block_giommu_migration(VFIODevice *vbasedev, Error **errp);
 int64_t vfio_mig_bytes_transferred(void);
 void vfio_reset_bytes_transferred(void);
 

From 2696da621e237b3ecfbf63085ea0603f439fb863 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Wed, 28 Jun 2023 11:29:32 -0600
Subject: [PATCH 0337/1353] =?UTF-8?q?MAINTAINERS:=20Promote=20C=C3=A9dric?=
 =?UTF-8?q?=20to=20VFIO=20co-maintainer?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cédric has stepped up involvement in vfio, reviewing and managing
patches, as well as pull requests.  This work deserves gratitude and
punishment with a promotion to co-maintainer ;)

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index aba07722f6..4feea49a6e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2051,7 +2051,7 @@ F: hw/usb/dev-serial.c
 
 VFIO
 M: Alex Williamson <alex.williamson@redhat.com>
-R: Cédric Le Goater <clg@redhat.com>
+M: Cédric Le Goater <clg@redhat.com>
 S: Supported
 F: hw/vfio/*
 F: include/hw/vfio/

From 357bd7932a136613d700ee8bc83e9165f059d1f7 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 29 Jun 2023 16:40:38 +0800
Subject: [PATCH 0338/1353] vfio/pci: Fix a segfault in vfio_realize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The kvm irqchip notifier is only registered if the device supports
INTx, however it's unconditionally removed in vfio realize error
path. If the assigned device does not support INTx, this will cause
QEMU to crash when vfio realize fails. Change it to conditionally
remove the notifier only if the notify hook is setup.

Before fix:
(qemu) device_add vfio-pci,host=81:11.1,id=vfio1,bus=root1,xres=1
Connection closed by foreign host.

After fix:
(qemu) device_add vfio-pci,host=81:11.1,id=vfio1,bus=root1,xres=1
Error: vfio 0000:81:11.1: xres and yres properties require display=on
(qemu)

Fixes: c5478fea27ac ("vfio/pci: Respond to KVM irqchip change notifier")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 73e19a04b2..48df517f79 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3221,7 +3221,9 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
 
 out_deregister:
     pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
-    kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
+    if (vdev->irqchip_change_notifier.notify) {
+        kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
+    }
 out_teardown:
     vfio_teardown_msi(vdev);
     vfio_bars_exit(vdev);

From 0cc889c8826cefa5b80110d31a62273b56aa1832 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 29 Jun 2023 16:40:39 +0800
Subject: [PATCH 0339/1353] vfio/pci: Free leaked timer in vfio_realize error
 path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When vfio_realize fails, the mmap_timer used for INTx optimization
isn't freed. As this timer isn't activated yet, the potential impact
is just a piece of leaked memory.

Fixes: ea486926b07d ("vfio-pci: Update slow path INTx algorithm timer related")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 48df517f79..ab6645ba60 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3224,6 +3224,9 @@ out_deregister:
     if (vdev->irqchip_change_notifier.notify) {
         kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
     }
+    if (vdev->intx.mmap_timer) {
+        timer_free(vdev->intx.mmap_timer);
+    }
 out_teardown:
     vfio_teardown_msi(vdev);
     vfio_bars_exit(vdev);

From d39a84b7348faa5cd6b09921b57969482ca4c543 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 30 Jun 2023 19:38:06 +0200
Subject: [PATCH 0340/1353] ui/dbus: fix build errors in dbus_update_gl_cb and
 dbus_call_update_gl

Add some ifdefs to avoid an unused function and unused variable.

Fixes: de1f8ce0abb8 ("ui/dbus: use shared D3D11 Texture2D when possible")
Co-developed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-Id: <336f7697-bcfa-1f5f-e411-6859815aa26c@eik.bme.hu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 ui/dbus-listener.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index e10162b279..0240c39510 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -177,6 +177,7 @@ fail:
 }
 #endif /* WIN32 */
 
+#if defined(CONFIG_GBM) || defined(WIN32)
 static void dbus_update_gl_cb(GObject *source_object,
                               GAsyncResult *res,
                               gpointer user_data)
@@ -203,11 +204,14 @@ static void dbus_update_gl_cb(GObject *source_object,
     graphic_hw_gl_block(ddl->dcl.con, false);
     g_object_unref(ddl);
 }
+#endif
 
 static void dbus_call_update_gl(DisplayChangeListener *dcl,
                                 int x, int y, int w, int h)
 {
+#if defined(CONFIG_GBM) || defined(WIN32)
     DBusDisplayListener *ddl = container_of(dcl, DBusDisplayListener, dcl);
+#endif
 
     trace_dbus_update_gl(x, y, w, h);
 

From a95a464777f74fc28665fae6bb8412d831264111 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Fri, 30 Jun 2023 23:41:56 +0200
Subject: [PATCH 0341/1353] audio: dbus requires pixman
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit commit 6cc5a615 ("ui/dbus: win32 support") has broken audio/dbus
compilation when pixman is not included.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1739

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230630214156.2181558-1-marcandre.lureau@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 audio/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/audio/meson.build b/audio/meson.build
index e7e95cf751..df4d968c0f 100644
--- a/audio/meson.build
+++ b/audio/meson.build
@@ -31,7 +31,7 @@ endforeach
 
 if dbus_display
     module_ss = ss.source_set()
-    module_ss.add(when: gio, if_true: files('dbusaudio.c'))
+    module_ss.add(when: [gio, pixman], if_true: files('dbusaudio.c'))
     audio_modules += {'dbus': module_ss}
 endif
 

From 3307e08c6f142bb3d2406cfbc0ee19359748b51a Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Thu, 29 Jun 2023 09:25:21 +0100
Subject: [PATCH 0342/1353] accel/tcg: Fix start page passed to
 tb_invalidate_phys_page_range__locked

Due to a copy-paste error in tb_invalidate_phys_range, the wrong
start address was passed to tb_invalidate_phys_page_range__locked.
Correct is to use the start of each page in turn.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: e506ad6a05 ("accel/tcg: Pass last not end to tb_invalidate_phys_range")
Message-Id: <20230629082522.606219-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 3541419845..33ea1aadd1 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1182,15 +1182,17 @@ void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t last)
     index_last = last >> TARGET_PAGE_BITS;
     for (index = start >> TARGET_PAGE_BITS; index <= index_last; index++) {
         PageDesc *pd = page_find(index);
-        tb_page_addr_t bound;
+        tb_page_addr_t page_start, page_last;
 
         if (pd == NULL) {
             continue;
         }
         assert_page_locked(pd);
-        bound = (index << TARGET_PAGE_BITS) | ~TARGET_PAGE_MASK;
-        bound = MIN(bound, last);
-        tb_invalidate_phys_page_range__locked(pages, pd, start, bound, 0);
+        page_start = index << TARGET_PAGE_BITS;
+        page_last = page_start | ~TARGET_PAGE_MASK;
+        page_last = MIN(page_last, last);
+        tb_invalidate_phys_page_range__locked(pages, pd,
+                                              page_start, page_last, 0);
     }
     page_collection_unlock(pages);
 }

From e665cf72fe6357945fdbecf747dac58c0c7c7c66 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Thu, 29 Jun 2023 09:25:22 +0100
Subject: [PATCH 0343/1353] accel/tcg: Assert one page in
 tb_invalidate_phys_page_range__locked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ensure that that both the start and last addresses are within
the same guest page.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230629082522.606219-3-mark.cave-ayland@ilande.co.uk>
[rth: Use tcg_debug_assert, simplify the expression]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 33ea1aadd1..9566224d18 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1092,6 +1092,9 @@ tb_invalidate_phys_page_range__locked(struct page_collection *pages,
     TranslationBlock *current_tb = retaddr ? tcg_tb_lookup(retaddr) : NULL;
 #endif /* TARGET_HAS_PRECISE_SMC */
 
+    /* Range may not cross a page. */
+    tcg_debug_assert(((start ^ last) & TARGET_PAGE_MASK) == 0);
+
     /*
      * We remove all the TBs in the range [start, last].
      * XXX: see if in some cases it could be faster to invalidate all the code

From e2041f4d5de01cb03b52908d36e9602b8c4a2479 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 27 May 2023 07:19:07 -0700
Subject: [PATCH 0344/1353] fpu: Add float64_to_int{32,64}_modulo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add versions of float64_to_int* which do not saturate the result.

Reviewed-by: Christoph Muellner <christoph.muellner@vrull.eu>
Tested-by: Christoph Muellner <christoph.muellner@vrull.eu>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230527141910.1885950-2-richard.henderson@linaro.org>
---
 fpu/softfloat-parts.c.inc | 78 +++++++++++++++++++++++++++++++++++++++
 fpu/softfloat.c           | 31 ++++++++++++++++
 include/fpu/softfloat.h   |  3 ++
 3 files changed, 112 insertions(+)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index 247400031c..527e15e6ab 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -1181,6 +1181,84 @@ static uint64_t partsN(float_to_uint)(FloatPartsN *p, FloatRoundMode rmode,
     return r;
 }
 
+/*
+ * Like partsN(float_to_sint), except do not saturate the result.
+ * Instead, return the rounded unbounded precision two's compliment result,
+ * modulo 2**(bitsm1 + 1).
+ */
+static int64_t partsN(float_to_sint_modulo)(FloatPartsN *p,
+                                            FloatRoundMode rmode,
+                                            int bitsm1, float_status *s)
+{
+    int flags = 0;
+    uint64_t r;
+    bool overflow = false;
+
+    switch (p->cls) {
+    case float_class_snan:
+        flags |= float_flag_invalid_snan;
+        /* fall through */
+    case float_class_qnan:
+        flags |= float_flag_invalid;
+        r = 0;
+        break;
+
+    case float_class_inf:
+        overflow = true;
+        r = 0;
+        break;
+
+    case float_class_zero:
+        return 0;
+
+    case float_class_normal:
+        /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
+        if (parts_round_to_int_normal(p, rmode, 0, N - 2)) {
+            flags = float_flag_inexact;
+        }
+
+        if (p->exp <= DECOMPOSED_BINARY_POINT) {
+            /*
+             * Because we rounded to integral, and exp < 64,
+             * we know frac_low is zero.
+             */
+            r = p->frac_hi >> (DECOMPOSED_BINARY_POINT - p->exp);
+            if (p->exp < bitsm1) {
+                /* Result in range. */
+            } else if (p->exp == bitsm1) {
+                /* The only in-range value is INT_MIN. */
+                overflow = !p->sign || p->frac_hi != DECOMPOSED_IMPLICIT_BIT;
+            } else {
+                overflow = true;
+            }
+        } else {
+            /* Overflow, but there might still be bits to return. */
+            int shl = p->exp - DECOMPOSED_BINARY_POINT;
+            if (shl < N) {
+                frac_shl(p, shl);
+                r = p->frac_hi;
+            } else {
+                r = 0;
+            }
+            overflow = true;
+        }
+
+        if (p->sign) {
+            r = -r;
+        }
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
+
+    if (overflow) {
+        flags = float_flag_invalid | float_flag_invalid_cvti;
+    }
+    float_raise(flags, s);
+    return r;
+}
+
 /*
  * Integer to float conversions
  *
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 42e6c188b4..0cc130ae9b 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -852,11 +852,24 @@ static uint64_t parts128_float_to_uint(FloatParts128 *p, FloatRoundMode rmode,
 #define parts_float_to_uint(P, R, Z, M, S) \
     PARTS_GENERIC_64_128(float_to_uint, P)(P, R, Z, M, S)
 
+static int64_t parts64_float_to_sint_modulo(FloatParts64 *p,
+                                            FloatRoundMode rmode,
+                                            int bitsm1, float_status *s);
+static int64_t parts128_float_to_sint_modulo(FloatParts128 *p,
+                                             FloatRoundMode rmode,
+                                             int bitsm1, float_status *s);
+
+#define parts_float_to_sint_modulo(P, R, M, S) \
+    PARTS_GENERIC_64_128(float_to_sint_modulo, P)(P, R, M, S)
+
 static void parts64_sint_to_float(FloatParts64 *p, int64_t a,
                                   int scale, float_status *s);
 static void parts128_sint_to_float(FloatParts128 *p, int64_t a,
                                    int scale, float_status *s);
 
+#define parts_float_to_sint(P, R, Z, MN, MX, S) \
+    PARTS_GENERIC_64_128(float_to_sint, P)(P, R, Z, MN, MX, S)
+
 #define parts_sint_to_float(P, I, Z, S) \
     PARTS_GENERIC_64_128(sint_to_float, P)(P, I, Z, S)
 
@@ -3409,6 +3422,24 @@ int64_t bfloat16_to_int64_round_to_zero(bfloat16 a, float_status *s)
     return bfloat16_to_int64_scalbn(a, float_round_to_zero, 0, s);
 }
 
+int32_t float64_to_int32_modulo(float64 a, FloatRoundMode rmode,
+                                float_status *s)
+{
+    FloatParts64 p;
+
+    float64_unpack_canonical(&p, a, s);
+    return parts_float_to_sint_modulo(&p, rmode, 31, s);
+}
+
+int64_t float64_to_int64_modulo(float64 a, FloatRoundMode rmode,
+                                float_status *s)
+{
+    FloatParts64 p;
+
+    float64_unpack_canonical(&p, a, s);
+    return parts_float_to_sint_modulo(&p, rmode, 63, s);
+}
+
 /*
  * Floating-point to unsigned integer conversions
  */
diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
index 3dcf20e3a2..cd130564d8 100644
--- a/include/fpu/softfloat.h
+++ b/include/fpu/softfloat.h
@@ -751,6 +751,9 @@ int16_t float64_to_int16_round_to_zero(float64, float_status *status);
 int32_t float64_to_int32_round_to_zero(float64, float_status *status);
 int64_t float64_to_int64_round_to_zero(float64, float_status *status);
 
+int32_t float64_to_int32_modulo(float64, FloatRoundMode, float_status *status);
+int64_t float64_to_int64_modulo(float64, FloatRoundMode, float_status *status);
+
 uint16_t float64_to_uint16_scalbn(float64, FloatRoundMode, int, float_status *);
 uint32_t float64_to_uint32_scalbn(float64, FloatRoundMode, int, float_status *);
 uint64_t float64_to_uint64_scalbn(float64, FloatRoundMode, int, float_status *);

From 7012b691848d36c7ddaf487f31a01d2f10890e35 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 27 May 2023 07:19:08 -0700
Subject: [PATCH 0345/1353] tests/tcg/alpha: Add test for cvttq
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test for invalid, integer overflow, and inexact.
Test for proper result, modulo 2**64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230527141910.1885950-3-richard.henderson@linaro.org>
---
 tests/tcg/alpha/Makefile.target |  2 +-
 tests/tcg/alpha/test-cvttq.c    | 78 +++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/alpha/test-cvttq.c

diff --git a/tests/tcg/alpha/Makefile.target b/tests/tcg/alpha/Makefile.target
index a585080328..b94500a7d9 100644
--- a/tests/tcg/alpha/Makefile.target
+++ b/tests/tcg/alpha/Makefile.target
@@ -5,7 +5,7 @@
 ALPHA_SRC=$(SRC_PATH)/tests/tcg/alpha
 VPATH+=$(ALPHA_SRC)
 
-ALPHA_TESTS=hello-alpha test-cond test-cmov test-ovf
+ALPHA_TESTS=hello-alpha test-cond test-cmov test-ovf test-cvttq
 TESTS+=$(ALPHA_TESTS)
 
 test-cmov: EXTRA_CFLAGS=-DTEST_CMOV
diff --git a/tests/tcg/alpha/test-cvttq.c b/tests/tcg/alpha/test-cvttq.c
new file mode 100644
index 0000000000..d1ad995312
--- /dev/null
+++ b/tests/tcg/alpha/test-cvttq.c
@@ -0,0 +1,78 @@
+#include <stdio.h>
+
+#define FPCR_SUM                (1UL << 63)
+#define FPCR_INED               (1UL << 62)
+#define FPCR_UNFD               (1UL << 61)
+#define FPCR_UNDZ               (1UL << 60)
+#define FPCR_DYN_SHIFT          58
+#define FPCR_DYN_CHOPPED        (0UL << FPCR_DYN_SHIFT)
+#define FPCR_DYN_MINUS          (1UL << FPCR_DYN_SHIFT)
+#define FPCR_DYN_NORMAL         (2UL << FPCR_DYN_SHIFT)
+#define FPCR_DYN_PLUS           (3UL << FPCR_DYN_SHIFT)
+#define FPCR_DYN_MASK           (3UL << FPCR_DYN_SHIFT)
+#define FPCR_IOV                (1UL << 57)
+#define FPCR_INE                (1UL << 56)
+#define FPCR_UNF                (1UL << 55)
+#define FPCR_OVF                (1UL << 54)
+#define FPCR_DZE                (1UL << 53)
+#define FPCR_INV                (1UL << 52)
+#define FPCR_OVFD               (1UL << 51)
+#define FPCR_DZED               (1UL << 50)
+#define FPCR_INVD               (1UL << 49)
+#define FPCR_DNZ                (1UL << 48)
+#define FPCR_DNOD               (1UL << 47)
+#define FPCR_STATUS_MASK        (FPCR_IOV | FPCR_INE | FPCR_UNF \
+                                 | FPCR_OVF | FPCR_DZE | FPCR_INV)
+
+static long test_cvttq(long *ret_e, double d)
+{
+    unsigned long reset = (FPCR_INED | FPCR_UNFD | FPCR_OVFD | FPCR_DZED |
+                           FPCR_INVD | FPCR_DYN_NORMAL);
+    long r, e;
+
+    asm("excb\n\t"
+        "mt_fpcr %3\n\t"
+        "excb\n\t"
+        "cvttq/svic %2, %0\n\t"
+        "excb\n\t"
+        "mf_fpcr %1\n\t"
+        "excb\n\t"
+        : "=f"(r), "=f"(e)
+        : "f"(d), "f"(reset));
+
+    *ret_e = e & FPCR_STATUS_MASK;
+    return r;
+}
+
+int main (void)
+{
+    static const struct {
+        double d;
+        long r;
+        long e;
+    } T[] = {
+        {  1.0,  1, 0 },
+        { -1.0, -1, 0 },
+        {  1.5,  1, FPCR_INE },
+        {  0x1.0p32,   0x0000000100000000ul, 0 },
+        { -0x1.0p63,   0x8000000000000000ul, 0 },
+        {  0x1.0p63,   0x8000000000000000ul, FPCR_IOV | FPCR_INE },
+        {  0x1.0p64,   0x0000000000000000ul, FPCR_IOV | FPCR_INE },
+        {  0x1.cccp64, 0xccc0000000000000ul, FPCR_IOV | FPCR_INE },
+        { __builtin_inf(), 0, FPCR_INV },
+        { __builtin_nan(""), 0, FPCR_INV },
+    };
+
+    int i, err = 0;
+
+    for (i = 0; i < sizeof(T)/sizeof(T[0]); i++) {
+        long e, r = test_cvttq(&e, T[i].d);
+
+        if (r != T[i].r || e != T[i].e) {
+            printf("Fail %a: expect (%016lx : %04lx) got (%016lx : %04lx)\n",
+                   T[i].d, T[i].r, T[i].e >> 48, r, e >> 48);
+            err = 1;
+        }
+    }
+    return err;
+}

From aa3bad5b59e773dd107d4c84309be638d17fb867 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 27 May 2023 07:19:09 -0700
Subject: [PATCH 0346/1353] target/alpha: Use float64_to_int64_modulo for CVTTQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For the most part we can use the new generic routine,
though exceptions need some post-processing to sort
invalid from integer overflow.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230527141910.1885950-4-richard.henderson@linaro.org>
---
 target/alpha/fpu_helper.c | 85 +++++++++------------------------------
 1 file changed, 18 insertions(+), 67 deletions(-)

diff --git a/target/alpha/fpu_helper.c b/target/alpha/fpu_helper.c
index 3ff8bb456d..63d9e9ce39 100644
--- a/target/alpha/fpu_helper.c
+++ b/target/alpha/fpu_helper.c
@@ -453,78 +453,29 @@ uint64_t helper_cvtqs(CPUAlphaState *env, uint64_t a)
 
 static uint64_t do_cvttq(CPUAlphaState *env, uint64_t a, int roundmode)
 {
-    uint64_t frac, ret = 0;
-    uint32_t exp, sign, exc = 0;
-    int shift;
+    float64 fa;
+    int64_t ret;
+    uint32_t exc;
 
-    sign = (a >> 63);
-    exp = (uint32_t)(a >> 52) & 0x7ff;
-    frac = a & 0xfffffffffffffull;
+    fa = t_to_float64(a);
+    ret = float64_to_int64_modulo(fa, roundmode, &FP_STATUS);
 
-    if (exp == 0) {
-        if (unlikely(frac != 0) && !env->fp_status.flush_inputs_to_zero) {
-            goto do_underflow;
-        }
-    } else if (exp == 0x7ff) {
-        exc = FPCR_INV;
-    } else {
-        /* Restore implicit bit.  */
-        frac |= 0x10000000000000ull;
+    exc = get_float_exception_flags(&FP_STATUS);
+    if (unlikely(exc)) {
+        set_float_exception_flags(0, &FP_STATUS);
 
-        shift = exp - 1023 - 52;
-        if (shift >= 0) {
-            /* In this case the number is so large that we must shift
-               the fraction left.  There is no rounding to do.  */
-            if (shift < 64) {
-                ret = frac << shift;
-            }
-            /* Check for overflow.  Note the special case of -0x1p63.  */
-            if (shift >= 11 && a != 0xC3E0000000000000ull) {
+        /* We need to massage the resulting exceptions. */
+        if (exc & float_flag_invalid_cvti) {
+            /* Overflow, either normal or infinity. */
+            if (float64_is_infinity(fa)) {
+                exc = FPCR_INV;
+            } else {
                 exc = FPCR_IOV | FPCR_INE;
             }
-        } else {
-            uint64_t round;
-
-            /* In this case the number is smaller than the fraction as
-               represented by the 52 bit number.  Here we must think
-               about rounding the result.  Handle this by shifting the
-               fractional part of the number into the high bits of ROUND.
-               This will let us efficiently handle round-to-nearest.  */
-            shift = -shift;
-            if (shift < 63) {
-                ret = frac >> shift;
-                round = frac << (64 - shift);
-            } else {
-                /* The exponent is so small we shift out everything.
-                   Leave a sticky bit for proper rounding below.  */
-            do_underflow:
-                round = 1;
-            }
-
-            if (round) {
-                exc = FPCR_INE;
-                switch (roundmode) {
-                case float_round_nearest_even:
-                    if (round == (1ull << 63)) {
-                        /* Fraction is exactly 0.5; round to even.  */
-                        ret += (ret & 1);
-                    } else if (round > (1ull << 63)) {
-                        ret += 1;
-                    }
-                    break;
-                case float_round_to_zero:
-                    break;
-                case float_round_up:
-                    ret += 1 - sign;
-                    break;
-                case float_round_down:
-                    ret += sign;
-                    break;
-                }
-            }
-        }
-        if (sign) {
-            ret = -ret;
+        } else if (exc & float_flag_invalid) {
+            exc = FPCR_INV;
+        } else if (exc & float_flag_inexact) {
+            exc = FPCR_INE;
         }
     }
     env->error_code = exc;

From 34d03ad9630e377c5d6fffbc74367a55f04c044c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 27 May 2023 07:19:10 -0700
Subject: [PATCH 0347/1353] target/arm: Use float64_to_int32_modulo for FJCVTZS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The standard floating point results are provided by the generic routine.
We only need handle the extra Z flag result afterward.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230527141910.1885950-5-richard.henderson@linaro.org>
---
 target/arm/vfp_helper.c | 71 +++++++----------------------------------
 1 file changed, 12 insertions(+), 59 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index 36906db8e0..789bba36cc 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -1120,68 +1120,21 @@ const FloatRoundMode arm_rmode_to_sf_map[] = {
 uint64_t HELPER(fjcvtzs)(float64 value, void *vstatus)
 {
     float_status *status = vstatus;
-    uint32_t exp, sign;
-    uint64_t frac;
-    uint32_t inexact = 1; /* !Z */
+    uint32_t inexact, frac;
+    uint32_t e_old, e_new;
 
-    sign = extract64(value, 63, 1);
-    exp = extract64(value, 52, 11);
-    frac = extract64(value, 0, 52);
+    e_old = get_float_exception_flags(status);
+    set_float_exception_flags(0, status);
+    frac = float64_to_int32_modulo(value, float_round_to_zero, status);
+    e_new = get_float_exception_flags(status);
+    set_float_exception_flags(e_old | e_new, status);
 
-    if (exp == 0) {
-        /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript.  */
-        inexact = sign;
-        if (frac != 0) {
-            if (status->flush_inputs_to_zero) {
-                float_raise(float_flag_input_denormal, status);
-            } else {
-                float_raise(float_flag_inexact, status);
-                inexact = 1;
-            }
-        }
-        frac = 0;
-    } else if (exp == 0x7ff) {
-        /* This operation raises Invalid for both NaN and overflow (Inf).  */
-        float_raise(float_flag_invalid, status);
-        frac = 0;
+    if (value == float64_chs(float64_zero)) {
+        /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
+        inexact = 1;
     } else {
-        int true_exp = exp - 1023;
-        int shift = true_exp - 52;
-
-        /* Restore implicit bit.  */
-        frac |= 1ull << 52;
-
-        /* Shift the fraction into place.  */
-        if (shift >= 0) {
-            /* The number is so large we must shift the fraction left.  */
-            if (shift >= 64) {
-                /* The fraction is shifted out entirely.  */
-                frac = 0;
-            } else {
-                frac <<= shift;
-            }
-        } else if (shift > -64) {
-            /* Normal case -- shift right and notice if bits shift out.  */
-            inexact = (frac << (64 + shift)) != 0;
-            frac >>= -shift;
-        } else {
-            /* The fraction is shifted out entirely.  */
-            frac = 0;
-        }
-
-        /* Notice overflow or inexact exceptions.  */
-        if (true_exp > 31 || frac > (sign ? 0x80000000ull : 0x7fffffff)) {
-            /* Overflow, for which this operation raises invalid.  */
-            float_raise(float_flag_invalid, status);
-            inexact = 1;
-        } else if (inexact) {
-            float_raise(float_flag_inexact, status);
-        }
-
-        /* Honor the sign.  */
-        if (sign) {
-            frac = -frac;
-        }
+        /* Normal inexact or overflow or NaN */
+        inexact = e_new & (float_flag_inexact | float_flag_invalid);
     }
 
     /* Pack the result and the env->ZF representation of Z together.  */

From ec2297bda2640ce2222a232abf6d0f92b8639b57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 Jun 2023 11:11:07 +0200
Subject: [PATCH 0348/1353] tcg: Reduce tcg_assert_listed_vecop() scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tcg_assert_listed_vecop() is only used in tcg-op-vec.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230629091107.74384-1-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/tcg.h | 6 ------
 tcg/tcg-op-vec.c  | 6 +++---
 2 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index 95541e9474..0875971719 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -1135,12 +1135,6 @@ uint64_t dup_const(unsigned vece, uint64_t c);
         : (qemu_build_not_reached_always(), 0))                    \
      : dup_const(VECE, C))
 
-#ifdef CONFIG_DEBUG_TCG
-void tcg_assert_listed_vecop(TCGOpcode);
-#else
-static inline void tcg_assert_listed_vecop(TCGOpcode op) { }
-#endif
-
 static inline const TCGOpcode *tcg_swap_vecop_list(const TCGOpcode *n)
 {
 #ifdef CONFIG_DEBUG_TCG
diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index 64bc8a2156..ad8ee08a7e 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -42,9 +42,9 @@
  * tcg_ctx->vec_opt_opc is non-NULL, the tcg_gen_*_vec expanders
  * will validate that their opcode is present in the list.
  */
-#ifdef CONFIG_DEBUG_TCG
-void tcg_assert_listed_vecop(TCGOpcode op)
+static void tcg_assert_listed_vecop(TCGOpcode op)
 {
+#ifdef CONFIG_DEBUG_TCG
     const TCGOpcode *p = tcg_ctx->vecop_list;
     if (p) {
         for (; *p; ++p) {
@@ -54,8 +54,8 @@ void tcg_assert_listed_vecop(TCGOpcode op)
         }
         g_assert_not_reached();
     }
-}
 #endif
+}
 
 bool tcg_can_emit_vecop_list(const TCGOpcode *list,
                              TCGType type, unsigned vece)

From 6ab1790226bcf55e6b3cdff1d0253c90d63de69f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 23 Jun 2023 18:25:56 +0100
Subject: [PATCH 0349/1353] target/nios2 : Explicitly ask for target-endian
 loads and stores
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we generate code for guest loads and stores, at the moment they
end up being requests for a host-endian access. So for target-system-nios2
(little endian) a load like
   ldw        r3,0(r4)
results on an x86 host in the TCG IR
   qemu_ld_a32_i32 r3,loc2,al+leul,0
but on s390 it is
   qemu_ld_a32_i32 r3,loc2,al+beul,0

The result is that guests don't work on big-endian hosts.

Use the MO_TE* memops rather than the plain ones.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1693
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230623172556.1951974-1-peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/nios2/translate.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/nios2/translate.c b/target/nios2/translate.c
index a365ad8293..4264c7ec6b 100644
--- a/target/nios2/translate.c
+++ b/target/nios2/translate.c
@@ -436,19 +436,19 @@ static const Nios2Instruction i_type_instructions[] = {
     INSTRUCTION_FLG(gen_cmpxxsi, TCG_COND_GE),        /* cmpgei */
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_ILLEGAL(),
-    INSTRUCTION_FLG(gen_ldx, MO_UW),                  /* ldhu */
+    INSTRUCTION_FLG(gen_ldx, MO_TEUW),                /* ldhu */
     INSTRUCTION(andi),                                /* andi */
-    INSTRUCTION_FLG(gen_stx, MO_UW),                  /* sth */
+    INSTRUCTION_FLG(gen_stx, MO_TEUW),                /* sth */
     INSTRUCTION_FLG(gen_bxx, TCG_COND_GE),            /* bge */
-    INSTRUCTION_FLG(gen_ldx, MO_SW),                  /* ldh */
+    INSTRUCTION_FLG(gen_ldx, MO_TESW),                /* ldh */
     INSTRUCTION_FLG(gen_cmpxxsi, TCG_COND_LT),        /* cmplti */
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_NOP(),                                /* initda */
     INSTRUCTION(ori),                                 /* ori */
-    INSTRUCTION_FLG(gen_stx, MO_UL),                  /* stw */
+    INSTRUCTION_FLG(gen_stx, MO_TEUL),                /* stw */
     INSTRUCTION_FLG(gen_bxx, TCG_COND_LT),            /* blt */
-    INSTRUCTION_FLG(gen_ldx, MO_UL),                  /* ldw */
+    INSTRUCTION_FLG(gen_ldx, MO_TEUL),                /* ldw */
     INSTRUCTION_FLG(gen_cmpxxsi, TCG_COND_NE),        /* cmpnei */
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_ILLEGAL(),
@@ -468,19 +468,19 @@ static const Nios2Instruction i_type_instructions[] = {
     INSTRUCTION_FLG(gen_cmpxxui, TCG_COND_GEU),       /* cmpgeui */
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_ILLEGAL(),
-    INSTRUCTION_FLG(gen_ldx, MO_UW),                  /* ldhuio */
+    INSTRUCTION_FLG(gen_ldx, MO_TEUW),                /* ldhuio */
     INSTRUCTION(andhi),                               /* andhi */
-    INSTRUCTION_FLG(gen_stx, MO_UW),                  /* sthio */
+    INSTRUCTION_FLG(gen_stx, MO_TEUW),                /* sthio */
     INSTRUCTION_FLG(gen_bxx, TCG_COND_GEU),           /* bgeu */
-    INSTRUCTION_FLG(gen_ldx, MO_SW),                  /* ldhio */
+    INSTRUCTION_FLG(gen_ldx, MO_TESW),                /* ldhio */
     INSTRUCTION_FLG(gen_cmpxxui, TCG_COND_LTU),       /* cmpltui */
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_UNIMPLEMENTED(),                      /* custom */
     INSTRUCTION_NOP(),                                /* initd */
     INSTRUCTION(orhi),                                /* orhi */
-    INSTRUCTION_FLG(gen_stx, MO_SL),                  /* stwio */
+    INSTRUCTION_FLG(gen_stx, MO_TESL),                /* stwio */
     INSTRUCTION_FLG(gen_bxx, TCG_COND_LTU),           /* bltu */
-    INSTRUCTION_FLG(gen_ldx, MO_UL),                  /* ldwio */
+    INSTRUCTION_FLG(gen_ldx, MO_TEUL),                /* ldwio */
     INSTRUCTION(rdprs),                               /* rdprs */
     INSTRUCTION_ILLEGAL(),
     INSTRUCTION_FLG(handle_r_type_instr, 0),          /* R-Type */

From 605a8b5491a119a2a6efbf61e5a38f9374645990 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 29 Jun 2023 10:08:35 +0200
Subject: [PATCH 0350/1353] linux-user: Avoid mmap of the last byte of the
 reserved_va

There is an overflow problem in mmap_find_vma_reserved:
when reserved_va == UINT32_MAX, end may overflow to 0.
Rather than a larger rewrite at this time, simply avoid
the final byte of the VA, which avoids searching the
final page, which avoids the overflow.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1741
Fixes: 95059f9c ("include/exec: Change reserved_va semantics to last byte")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20230629080835.71371-1-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 0aa8ae7356..2692936773 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -281,9 +281,15 @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
     /* Note that start and size have already been aligned by mmap_find_vma. */
 
     end_addr = start + size;
+    /*
+     * Start at the top of the address space, ignoring the last page.
+     * If reserved_va == UINT32_MAX, then end_addr wraps to 0,
+     * throwing the rest of the calculations off.
+     * TODO: rewrite using last_addr instead.
+     * TODO: use the interval tree instead of probing every page.
+     */
     if (start > reserved_va - size) {
-        /* Start at the top of the address space.  */
-        end_addr = ((reserved_va + 1 - size) & -align) + size;
+        end_addr = ((reserved_va - size) & -align) + size;
         looped = true;
     }
 
@@ -296,8 +302,8 @@ static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
                 /* Failure.  The entire address space has been searched.  */
                 return (abi_ulong)-1;
             }
-            /* Re-start at the top of the address space.  */
-            addr = end_addr = ((reserved_va + 1 - size) & -align) + size;
+            /* Re-start at the top of the address space (see above). */
+            addr = end_addr = ((reserved_va - size) & -align) + size;
             looped = true;
         } else {
             prot = page_get_flags(addr);

From cef63308e6df3b4ab61f4ebdc1d4674c9083eb8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 30 Jun 2023 19:03:46 +0100
Subject: [PATCH 0351/1353] gitlab: explicit set artifacts publishing criteria
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If not set explicitly, gitlab assumes 'when: on_success" as the
publishing criteria for artifacts. This is reasonable if the
artifact is an output deliverable of the job. This is useless
if the artifact is a log file to be used for debugging job
failures.

This change makes the desired criteria explicit for every job
that publishes artifacts.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230503145535.91325-2-berrange@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-2-alex.bennee@linaro.org>
---
 .gitlab-ci.d/buildtest-template.yml  | 4 +++-
 .gitlab-ci.d/buildtest.yml           | 2 ++
 .gitlab-ci.d/crossbuild-template.yml | 1 +
 .gitlab-ci.d/crossbuilds.yml         | 2 ++
 .gitlab-ci.d/opensbi.yml             | 1 +
 5 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 5da61f4277..f3e39b7eb1 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -25,6 +25,7 @@
 # rebuilding all the object files we skip in the artifacts
 .native_build_artifact_template:
   artifacts:
+    when: on_success
     expire_in: 2 days
     paths:
       - build
@@ -53,6 +54,7 @@
   extends: .common_test_job_template
   artifacts:
     name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
+    when: always
     expire_in: 7 days
     paths:
       - build/meson-logs/testlog.txt
@@ -68,7 +70,7 @@
     policy: pull-push
   artifacts:
     name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
-    when: on_failure
+    when: always
     expire_in: 7 days
     paths:
       - build/tests/results/latest/results.xml
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index aa833b62ca..24bba061cd 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -462,6 +462,7 @@ gcov:
   coverage: /^\s*lines:\s*\d+.\d+\%/
   artifacts:
     name: ${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}
+    when: on_success
     expire_in: 2 days
     reports:
       coverage_report:
@@ -587,6 +588,7 @@ pages:
     - make -C build install DESTDIR=$(pwd)/temp-install
     - mv temp-install/usr/local/share/doc/qemu/* public/
   artifacts:
+    when: on_success
     paths:
       - public
   variables:
diff --git a/.gitlab-ci.d/crossbuild-template.yml b/.gitlab-ci.d/crossbuild-template.yml
index 6efb0d2a54..d97611053b 100644
--- a/.gitlab-ci.d/crossbuild-template.yml
+++ b/.gitlab-ci.d/crossbuild-template.yml
@@ -55,6 +55,7 @@
 .cross_test_artifacts:
   artifacts:
     name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
+    when: always
     expire_in: 7 days
     paths:
       - build/meson-logs/testlog.txt
diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index b6ec99ecd1..84ff2f6d2b 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -169,6 +169,7 @@ cross-win32-system:
     CROSS_SKIP_TARGETS: alpha-softmmu avr-softmmu hppa-softmmu m68k-softmmu
                         microblazeel-softmmu mips64el-softmmu nios2-softmmu
   artifacts:
+    when: on_success
     paths:
       - build/qemu-setup*.exe
 
@@ -184,6 +185,7 @@ cross-win64-system:
                         or1k-softmmu rx-softmmu sh4eb-softmmu sparc64-softmmu
                         tricore-softmmu xtensaeb-softmmu
   artifacts:
+    when: on_success
     paths:
       - build/qemu-setup*.exe
 
diff --git a/.gitlab-ci.d/opensbi.yml b/.gitlab-ci.d/opensbi.yml
index b4d7eef688..fd293e6c31 100644
--- a/.gitlab-ci.d/opensbi.yml
+++ b/.gitlab-ci.d/opensbi.yml
@@ -63,6 +63,7 @@ build-opensbi:
   stage: build
   needs: ['docker-opensbi']
   artifacts:
+    when: on_success
     paths: # 'artifacts.zip' will contains the following files:
       - pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
       - pc-bios/opensbi-riscv64-generic-fw_dynamic.bin

From dcb242c8495c04599a6405ed8fbd03d82bc33365 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 30 Jun 2023 19:03:47 +0100
Subject: [PATCH 0352/1353] gitlab: ensure coverage job also publishes meson
 log
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The coverage job wants to publish a coverage report on success, but the
tests might fail and in that case we need the meson logs for debugging.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230503145535.91325-3-berrange@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-3-alex.bennee@linaro.org>
---
 .gitlab-ci.d/buildtest.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 24bba061cd..a8fd9a0c1f 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -462,9 +462,12 @@ gcov:
   coverage: /^\s*lines:\s*\d+.\d+\%/
   artifacts:
     name: ${CI_JOB_NAME}-${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}
-    when: on_success
+    when: always
     expire_in: 2 days
+    paths:
+      - build/meson-logs/testlog.txt
     reports:
+      junit: build/meson-logs/testlog.junit.xml
       coverage_report:
         coverage_format: cobertura
         path: build/coverage.xml

From dc389ce1b30c7ca9305c849e02e349ff8296a831 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:48 +0100
Subject: [PATCH 0353/1353] gitlab: reduce testing scope of check-gcov
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This keeps timing out on gitlab due to some qtests taking a long time.
As this is just ensuring the gcov machinery is working and not
attempting to be comprehensive lets skip qtest in this run.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-4-alex.bennee@linaro.org>
---
 .gitlab-ci.d/buildtest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index a8fd9a0c1f..77dc83a6be 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -454,7 +454,7 @@ gcov:
     IMAGE: ubuntu2204
     CONFIGURE_ARGS: --enable-gcov
     TARGETS: aarch64-softmmu ppc64-softmmu s390x-softmmu x86_64-softmmu
-    MAKE_CHECK_ARGS: check
+    MAKE_CHECK_ARGS: check-unit check-softfloat
   after_script:
     - cd build
     - gcovr --xml-pretty --exclude-unreachable-branches --print-summary

From d2ab529ec559df57dc142d24ea3ec0a629a23657 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Fri, 30 Jun 2023 19:03:49 +0100
Subject: [PATCH 0354/1353] docs/devel: remind developers to run CI container
 pipeline when updating images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When new dependencies and packages are added to containers, its important to
run CI container generation pipelines on gitlab to make sure that there are no
obvious conflicts between packages that are being added and those that are
already present. Running CI container pipelines will make sure that there are
no such breakages before we commit the change updating the containers. Add a
line in the documentation reminding developers to run the pipeline before
submitting the change. It will also ease the life of the maintainers.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230506072012.10350-1-anisinha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-5-alex.bennee@linaro.org>
---
 docs/devel/testing.rst | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/devel/testing.rst b/docs/devel/testing.rst
index e85e26c4ca..fb651eae11 100644
--- a/docs/devel/testing.rst
+++ b/docs/devel/testing.rst
@@ -485,6 +485,12 @@ first to contribute the mapping to the ``libvirt-ci`` project:
    `CI <https://www.qemu.org/docs/master/devel/ci.html>`__ documentation
    page on how to trigger gitlab CI pipelines on your change.
 
+ * Please also trigger gitlab container generation pipelines on your change
+   for as many OS distros as practical to make sure that there are no
+   obvious breakages when adding the new pre-requisite. Please see
+   `CI <https://www.qemu.org/docs/master/devel/ci.html>`__ documentation
+   page on how to trigger gitlab CI pipelines on your change.
+
 For enterprise distros that default to old, end-of-life versions of the
 Python runtime, QEMU uses a separate set of mappings that work with more
 recent versions.  These can be found in ``tests/lcitool/mappings.yml``.

From af323aabe2a7152b1e857baa840485b79c06bbf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:50 +0100
Subject: [PATCH 0355/1353] tests/tcg: add mechanism to handle plugin arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently missed a regression that should have been picked up by
check-tcg. This was because the libmem plugin is effectively a NOP if
the user doesn't specify the type to use.

Rather than changing the default behaviour add an additional expansion
so we can take this into account in future.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-6-alex.bennee@linaro.org>
---
 tests/tcg/Makefile.target | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 72876cc84e..2462c26000 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -169,13 +169,17 @@ extract-plugin = $(wordlist 2, 2, $(subst -with-, ,$1))
 
 RUN_TESTS+=$(EXTRA_RUNS)
 
+# Some plugins need additional arguments above the default to fully
+# exercise things. We can define them on a per-test basis here.
+run-plugin-%-with-libmem.so: PLUGIN_ARGS=$(COMMA)inline=true$(COMMA)callback=true
+
 ifeq ($(filter %-softmmu, $(TARGET)),)
 run-%: %
 	$(call run-test, $<, $(QEMU) $(QEMU_OPTS) $<)
 
 run-plugin-%:
 	$(call run-test, $@, $(QEMU) $(QEMU_OPTS) \
-		-plugin $(PLUGIN_LIB)/$(call extract-plugin,$@) \
+		-plugin $(PLUGIN_LIB)/$(call extract-plugin,$@)$(PLUGIN_ARGS) \
 		-d plugin -D $*.pout \
 		 $(call strip-plugin,$<))
 else
@@ -189,7 +193,7 @@ run-plugin-%:
 	$(call run-test, $@, \
 	  $(QEMU) -monitor none -display none \
 		  -chardev file$(COMMA)path=$@.out$(COMMA)id=output \
-	   	  -plugin $(PLUGIN_LIB)/$(call extract-plugin,$@) \
+	   	  -plugin $(PLUGIN_LIB)/$(call extract-plugin,$@)$(PLUGIN_ARGS) \
 	    	  -d plugin -D $*.pout \
 		  $(QEMU_OPTS) $(call strip-plugin,$<))
 endif

From 58127176589c22d9fb8d60b67ce2c9bbec3dca67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:51 +0100
Subject: [PATCH 0356/1353] qemu-keymap: properly check return from
 xkb_keymap_mod_get_index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can return XKB_MOD_INVALID for AltGr which rightly gets flagged by
sanitisers as an overly wide shift attempt. Properly check the return
type and leave the bitmap as zero in that case. Tested output before
and after is unchanged with the gb and ara keymaps.

Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-7-alex.bennee@linaro.org>
---
 qemu-keymap.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/qemu-keymap.c b/qemu-keymap.c
index 229866e004..8c80f7a4ed 100644
--- a/qemu-keymap.c
+++ b/qemu-keymap.c
@@ -140,6 +140,18 @@ static void usage(FILE *out)
             names.options ?: "-");
 }
 
+static xkb_mod_mask_t get_mod(struct xkb_keymap *map, const char *name)
+{
+    xkb_mod_index_t mod;
+    xkb_mod_mask_t mask = 0;
+
+    mod = xkb_keymap_mod_get_index(map, name);
+    if (mod != XKB_MOD_INVALID) {
+        mask = (1 << mod);
+    }
+    return mask;
+}
+
 int main(int argc, char *argv[])
 {
     struct xkb_context *ctx;
@@ -215,14 +227,10 @@ int main(int argc, char *argv[])
                 mod, xkb_keymap_mod_get_name(map, mod));
     }
 
-    mod = xkb_keymap_mod_get_index(map, "Shift");
-    shift = (1 << mod);
-    mod = xkb_keymap_mod_get_index(map, "Control");
-    ctrl = (1 << mod);
-    mod = xkb_keymap_mod_get_index(map, "AltGr");
-    altgr = (1 << mod);
-    mod = xkb_keymap_mod_get_index(map, "NumLock");
-    numlock = (1 << mod);
+    shift = get_mod(map, "Shift");
+    ctrl = get_mod(map, "Control");
+    altgr = get_mod(map, "AltGr");
+    numlock = get_mod(map, "NumLock");
 
     state = xkb_state_new(map);
     xkb_keymap_key_for_each(map, walk_map, state);

From 9ea2e69fb2df969332badd403f35b0e355f8a741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:52 +0100
Subject: [PATCH 0357/1353] scripts/oss-fuzz: add a suppression for keymap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When updating to the latest fedora the santizer found more leaks
inside xkbmap:

  FAILED: pc-bios/keymaps/ar
  /builds/stsquad/qemu/build-oss-fuzz/qemu-keymap -f pc-bios/keymaps/ar -l ara
  =================================================================
  ==3604==ERROR: LeakSanitizer: detected memory leaks
  Direct leak of 1424 byte(s) in 1 object(s) allocated from:
      #0 0x56316418ebec in __interceptor_calloc (/builds/stsquad/qemu/build-oss-fuzz/qemu-keymap+0x127bec) (BuildId: a2ad9da3190962acaa010fa8f44a9269f9081e1c)
      #1 0x7f60d4dc067e  (/lib64/libxkbcommon.so.0+0x1c67e) (BuildId: b243a34e4e58e6a30b93771c256268b114d34b80)
      #2 0x7f60d4dc2137 in xkb_keymap_new_from_names (/lib64/libxkbcommon.so.0+0x1e137) (BuildId: b243a34e4e58e6a30b93771c256268b114d34b80)
      #3 0x5631641ca50f in main /builds/stsquad/qemu/build-oss-fuzz/../qemu-keymap.c:215:11

and many more. As we can't do anything about the library add a
suppression to keep the CI going with what its meant to be doing.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-8-alex.bennee@linaro.org>
---
 scripts/oss-fuzz/lsan_suppressions.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/oss-fuzz/lsan_suppressions.txt b/scripts/oss-fuzz/lsan_suppressions.txt
index 02ec0a6ed5..7d90c280d0 100644
--- a/scripts/oss-fuzz/lsan_suppressions.txt
+++ b/scripts/oss-fuzz/lsan_suppressions.txt
@@ -1,2 +1,5 @@
 # The tcmalloc on Fedora37 confuses things
 leak:/lib64/libtcmalloc_minimal.so.4
+
+# libxkbcommon also leaks in qemu-keymap
+leak:/lib64/libxkbcommon.so.0

From 3176990fb0307233ae5619e36b2c63241134e326 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:53 +0100
Subject: [PATCH 0358/1353] tests/qtests: clean-up and fix leak in generic_fuzz
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An update to the clang tooling detects more issues with the code
including a memory leak from the g_string_new() allocation. Clean up
the code to avoid the allocation and use ARRAY_SIZE while we are at
it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-9-alex.bennee@linaro.org>
---
 tests/qtest/fuzz/generic_fuzz.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index c525d22951..11256abf6c 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -954,17 +954,10 @@ static void register_generic_fuzz_targets(void)
             .crossover = generic_fuzz_crossover
     });
 
-    GString *name;
-    const generic_fuzz_config *config;
-
-    for (int i = 0;
-         i < sizeof(predefined_configs) / sizeof(generic_fuzz_config);
-         i++) {
-        config = predefined_configs + i;
-        name = g_string_new("generic-fuzz");
-        g_string_append_printf(name, "-%s", config->name);
+    for (int i = 0; i < ARRAY_SIZE(predefined_configs); i++) {
+        const generic_fuzz_config *config = predefined_configs + i;
         fuzz_add_target(&(FuzzTarget){
-                .name = name->str,
+                .name = g_strconcat("generic-fuzz-", config->name, NULL),
                 .description = "Predefined generic-fuzz config.",
                 .get_init_cmdline = generic_fuzz_predefined_config_cmdline,
                 .pre_fuzz = generic_pre_fuzz,

From 4ab20b513e7279c5441db2bba7d326484668d2cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:54 +0100
Subject: [PATCH 0359/1353] tests/docker: add test-fuzz
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Running the fuzzer requires some hoop jumping and some problems only
show up in containers. This basically replicates the build-oss-fuzz
job from our CI so we can run in the same containers we use in CI.

Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-10-alex.bennee@linaro.org>
---
 MAINTAINERS            |  1 +
 tests/docker/test-fuzz | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100755 tests/docker/test-fuzz

diff --git a/MAINTAINERS b/MAINTAINERS
index 4feea49a6e..7164cf55a1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3106,6 +3106,7 @@ R: Qiuhao Li <Qiuhao.Li@outlook.com>
 S: Maintained
 F: tests/qtest/fuzz/
 F: tests/qtest/fuzz-*test.c
+F: tests/docker/test-fuzz
 F: scripts/oss-fuzz/
 F: hw/mem/sparse-mem.c
 F: docs/devel/fuzzing.rst
diff --git a/tests/docker/test-fuzz b/tests/docker/test-fuzz
new file mode 100755
index 0000000000..7e506ae1f6
--- /dev/null
+++ b/tests/docker/test-fuzz
@@ -0,0 +1,28 @@
+#!/bin/bash -e
+#
+# Compile and check with oss-fuzz.
+#
+# Copyright (c) 2023 Linaro Ltd.
+#
+# Authors:
+#  Alex Bennée <alex.bennee@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+. common.rc
+
+requires_binary clang
+
+# the build script runs out of $src so we need to copy across
+cd "$BUILD_DIR"
+cp -a $QEMU_SRC .
+cd src
+mkdir build-oss-fuzz
+export LSAN_OPTIONS=suppressions=scripts/oss-fuzz/lsan_suppressions.txt
+env CC="clang" CXX="clang++" CFLAGS="-fsanitize=address" ./scripts/oss-fuzz/build.sh
+export ASAN_OPTIONS="fast_unwind_on_malloc=0"
+for fuzzer in $(find ./build-oss-fuzz/DEST_DIR/ -executable -type f | grep -v slirp); do
+        grep "LLVMFuzzerTestOneInput" ${fuzzer} > /dev/null 2>&1 || continue ;
+        echo Testing ${fuzzer} ... ;
+        "${fuzzer}" -runs=1 -seed=1 || exit 1 ;
+done

From 369dbbe091e2e1b9e603167cd4d9da5e9edaca8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:55 +0100
Subject: [PATCH 0360/1353] Makefile: add lcitool-refresh to UNCHECKED_GOALS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is yet another make target you usually run in the top level of
the source directory.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-11-alex.bennee@linaro.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 804a5681e0..5d48dfac18 100644
--- a/Makefile
+++ b/Makefile
@@ -28,7 +28,7 @@ quiet-command = $(quiet-@)$(call quiet-command-run,$1,$2,$3)
 
 UNCHECKED_GOALS := TAGS gtags cscope ctags dist \
     help check-help print-% \
-    docker docker-% vm-help vm-test vm-build-%
+    docker docker-% lcitool-refresh vm-help vm-test vm-build-%
 
 all:
 .PHONY: all clean distclean recurse-all dist msi FORCE

From c7374742d83a692fefcd64dc1030645c0fe931f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:56 +0100
Subject: [PATCH 0361/1353] tests/lcitool: update to latest version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need this for the riscv64 and gcc-native mappings. As the older
alpine release has been dropped from the mappings we also need to bump
the version of alpine we use.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-12-alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/alpine.docker | 4 ++--
 tests/lcitool/libvirt-ci               | 2 +-
 tests/lcitool/refresh                  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index 0097637dca..43370f7b36 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all alpine-316 qemu
+#  $ lcitool dockerfile --layers all alpine-318 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/alpine:3.16
+FROM docker.io/library/alpine:3.18
 
 RUN apk update && \
     apk upgrade && \
diff --git a/tests/lcitool/libvirt-ci b/tests/lcitool/libvirt-ci
index c8971e90ac..b0f44f929a 160000
--- a/tests/lcitool/libvirt-ci
+++ b/tests/lcitool/libvirt-ci
@@ -1 +1 @@
-Subproject commit c8971e90ac169ee2b539c747f74d96c876debdf9
+Subproject commit b0f44f929a81c0a604fb7fbf8afc34d37ab0eae9
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index f1570b54df..5d36a62b10 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -115,7 +115,7 @@ try:
     #
     # Standard native builds
     #
-    generate_dockerfile("alpine", "alpine-316")
+    generate_dockerfile("alpine", "alpine-318")
     generate_dockerfile("centos8", "centos-stream-8")
     generate_dockerfile("debian-amd64", "debian-11",
                         trailer="".join(debian11_extras))

From 76eb439c0f2c53b461b9d2e62850068aee2dd70c Mon Sep 17 00:00:00 2001
From: Erik Skultety <eskultet@redhat.com>
Date: Fri, 30 Jun 2023 19:03:57 +0100
Subject: [PATCH 0362/1353] tests/lcitool: Bump fedora container versions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fedora 37 -> 38

Signed-off-by: Erik Skultety <eskultet@redhat.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <c9b00e573a7a80fc6ce5c68595382f5c916a9195.1685528076.git.eskultet@redhat.com>
[AJB: Dropped alpine (in prev commit), reflow commit msg]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-13-alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/fedora-win32-cross.docker | 4 ++--
 tests/docker/dockerfiles/fedora-win64-cross.docker | 4 ++--
 tests/docker/dockerfiles/fedora.docker             | 4 ++--
 tests/lcitool/refresh                              | 6 +++---
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/tests/docker/dockerfiles/fedora-win32-cross.docker b/tests/docker/dockerfiles/fedora-win32-cross.docker
index dc72ae9cc9..a0a3cd9e5b 100644
--- a/tests/docker/dockerfiles/fedora-win32-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win32-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross mingw32 fedora-37 qemu
+#  $ lcitool dockerfile --layers all --cross mingw32 fedora-38 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:37
+FROM registry.fedoraproject.org/fedora:38
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index 7eb4a5dba2..b6c1a6a339 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross mingw64 fedora-37 qemu
+#  $ lcitool dockerfile --layers all --cross mingw64 fedora-38 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:37
+FROM registry.fedoraproject.org/fedora:38
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index 3a69eefdda..8a35a17617 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all fedora-37 qemu
+#  $ lcitool dockerfile --layers all fedora-38 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:37
+FROM registry.fedoraproject.org/fedora:38
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 5d36a62b10..5e06fb2cf5 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -119,7 +119,7 @@ try:
     generate_dockerfile("centos8", "centos-stream-8")
     generate_dockerfile("debian-amd64", "debian-11",
                         trailer="".join(debian11_extras))
-    generate_dockerfile("fedora", "fedora-37")
+    generate_dockerfile("fedora", "fedora-38")
     generate_dockerfile("opensuse-leap", "opensuse-leap-15")
     generate_dockerfile("ubuntu2004", "ubuntu-2004")
     generate_dockerfile("ubuntu2204", "ubuntu-2204")
@@ -169,12 +169,12 @@ try:
                         trailer=cross_build("s390x-linux-gnu-",
                                             "s390x-softmmu,s390x-linux-user"))
 
-    generate_dockerfile("fedora-win32-cross", "fedora-37",
+    generate_dockerfile("fedora-win32-cross", "fedora-38",
                         cross="mingw32",
                         trailer=cross_build("i686-w64-mingw32-",
                                             "i386-softmmu"))
 
-    generate_dockerfile("fedora-win64-cross", "fedora-37",
+    generate_dockerfile("fedora-win64-cross", "fedora-38",
                         cross="mingw64",
                         trailer=cross_build("x86_64-w64-mingw32-",
                                             "x86_64-softmmu"))

From 690be80412dc5ae761112dbe679efbe231edcacd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:58 +0100
Subject: [PATCH 0363/1353] tests/lcitool: add an explicit gcc-native package
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need a native compiler to build the hexagon codegen tools. In our
current images we already have a gcc as a side effect of a broken
dependency between gcovr and lcov but this will be fixed when we move
to bookworm. See
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987818 for details.

Update the packages while we are at it.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-14-alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/debian-amd64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-arm64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armel-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armhf-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-mips64el-cross.docker | 1 +
 tests/docker/dockerfiles/debian-mipsel-cross.docker   | 1 +
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  | 1 +
 tests/docker/dockerfiles/debian-s390x-cross.docker    | 1 +
 tests/docker/dockerfiles/fedora-win32-cross.docker    | 1 +
 tests/docker/dockerfiles/fedora-win64-cross.docker    | 1 +
 tests/lcitool/projects/qemu.yml                       | 1 +
 11 files changed, 11 insertions(+)

diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 40a2b6acc4..016c2321f1 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index c99300bbfa..3c114efa11 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-armel-cross.docker b/tests/docker/dockerfiles/debian-armel-cross.docker
index 5db5c78b31..dfbd47db89 100644
--- a/tests/docker/dockerfiles/debian-armel-cross.docker
+++ b/tests/docker/dockerfiles/debian-armel-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index ae6600b25f..4e0084e896 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index daa2d48e36..88adf333e9 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 5af04e2054..256e8b5dfe 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 1eeba7fcab..4d19cd2bd7 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 52e89a6dab..642bbde3d1 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -24,6 +24,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       exuberant-ctags \
                       findutils \
                       flex \
+                      gcc \
                       gcovr \
                       gettext \
                       git \
diff --git a/tests/docker/dockerfiles/fedora-win32-cross.docker b/tests/docker/dockerfiles/fedora-win32-cross.docker
index a0a3cd9e5b..e3dfd68bed 100644
--- a/tests/docker/dockerfiles/fedora-win32-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win32-cross.docker
@@ -29,6 +29,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                diffutils \
                findutils \
                flex \
+               gcc \
                gcovr \
                git \
                glib2-devel \
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index b6c1a6a339..0e15c9643a 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -29,6 +29,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                diffutils \
                findutils \
                flex \
+               gcc \
                gcovr \
                git \
                glib2-devel \
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index 566db8313b..21fd3d2cf9 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -24,6 +24,7 @@ packages:
  - fuse3
  - g++
  - gcc
+ - gcc-native
  - gcovr
  - gettext
  - glib2

From b911b9001e0ad77dc123230873e3b598ff8c819b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:03:59 +0100
Subject: [PATCH 0364/1353] tests/lcitool: introduce qemu-minimal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a very bare bones set of dependencies for a minimal build of
QEMU. This will be useful for minimal cross-compile sanity check based
on things like Debian Sid where stuff isn't always in sync.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-15-alex.bennee@linaro.org>
---
 tests/lcitool/projects/qemu-minimal.yml | 27 +++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 tests/lcitool/projects/qemu-minimal.yml

diff --git a/tests/lcitool/projects/qemu-minimal.yml b/tests/lcitool/projects/qemu-minimal.yml
new file mode 100644
index 0000000000..d44737dc1d
--- /dev/null
+++ b/tests/lcitool/projects/qemu-minimal.yml
@@ -0,0 +1,27 @@
+# Very minimal set of qemu packages, used for minimal cross-compile sanity checks
+---
+packages:
+ - bash
+ - bc
+ - bison
+ - ccache
+ - findutils
+ - flex
+ - g++
+ - gcc
+ - gcc-native
+ - glib2
+ - glib2-native
+ - glib2-static
+ - libc-static
+ - libfdt
+ - libffi
+ - make
+ - meson
+ - ninja
+ - pixman
+ - pkg-config
+ - python3
+ - python3-venv
+ - sed
+ - tar

From 0101dd71b061c0369931214b1a4b82258ef7a1fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:00 +0100
Subject: [PATCH 0365/1353] tests/docker: convert riscv64-cross to lcitool
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We still need to base this on Debian Sid until riscv64 is promoted to
a release architecture (or another distro provides a full cross
compile target). We use the new qemu-minimal project description to
avoid bringing in all the extra dependencies because every extra
package is another chance for sid to fail.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-16-alex.bennee@linaro.org>
---
 .../dockerfiles/debian-riscv64-cross.docker   | 119 +++++++++++-------
 tests/lcitool/refresh                         |  10 +-
 2 files changed, 83 insertions(+), 46 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index 081404e014..a2d879ee1f 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -1,54 +1,85 @@
+# THIS FILE WAS AUTO-GENERATED
 #
-# Docker cross-compiler target for riscv64
-#
-# Currently the only distro that gets close to cross compiling riscv64
-# images is Debian Sid (with unofficial ports). As this is a moving
-# target we keep the library list minimal and are aiming to migrate
-# from this hack as soon as we are able.
+#  $ lcitool dockerfile --layers all --cross riscv64 debian-sid qemu-minimal
 #
+# https://gitlab.com/libvirt/libvirt-ci
+
 FROM docker.io/library/debian:sid-slim
 
-# Add ports
-RUN apt update && \
-    DEBIAN_FRONTEND=noninteractive apt install -yy eatmydata && \
-    DEBIAN_FRONTEND=noninteractive eatmydata apt update -yy && \
-    DEBIAN_FRONTEND=noninteractive eatmydata apt upgrade -yy
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y eatmydata && \
+    eatmydata apt-get dist-upgrade -y && \
+    eatmydata apt-get install --no-install-recommends -y \
+                      bash \
+                      bc \
+                      bison \
+                      ca-certificates \
+                      ccache \
+                      findutils \
+                      flex \
+                      gcc \
+                      git \
+                      libglib2.0-dev \
+                      locales \
+                      make \
+                      meson \
+                      ninja-build \
+                      pkgconf \
+                      python3 \
+                      python3-venv \
+                      sed \
+                      tar && \
+    eatmydata apt-get autoremove -y && \
+    eatmydata apt-get autoclean -y && \
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
+    dpkg-reconfigure locales
 
-# Install common build utilities
-RUN DEBIAN_FRONTEND=noninteractive eatmydata apt install -yy \
-    bison \
-    bc \
-    build-essential \
-    ca-certificates \
-    debian-ports-archive-keyring \
-    dpkg-dev \
-    flex \
-    gettext \
-    git \
-    libglib2.0-dev \
-    ninja-build \
-    pkg-config \
-    python3 \
-    python3-venv
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
+ENV LANG "en_US.UTF-8"
+ENV MAKE "/usr/bin/make"
+ENV NINJA "/usr/bin/ninja"
+ENV PYTHON "/usr/bin/python3"
 
-# Add ports and riscv64 architecture
-RUN echo "deb http://ftp.ports.debian.org/debian-ports/ sid main" >> /etc/apt/sources.list
-RUN dpkg --add-architecture riscv64
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    dpkg --add-architecture riscv64 && \
+    eatmydata apt-get install debian-ports-archive-keyring && \
+    eatmydata echo 'deb http://ftp.ports.debian.org/debian-ports/ sid main' > /etc/apt/sources.list.d/ports.list && \
+    eatmydata echo 'deb http://ftp.ports.debian.org/debian-ports/ unreleased main' >> /etc/apt/sources.list.d/ports.list && \
+    eatmydata apt-get update && \
+    eatmydata apt-get dist-upgrade -y && \
+    eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
+    eatmydata apt-get install --no-install-recommends -y \
+                      g++-riscv64-linux-gnu \
+                      gcc-riscv64-linux-gnu \
+                      libc6-dev:riscv64 \
+                      libfdt-dev:riscv64 \
+                      libffi-dev:riscv64 \
+                      libglib2.0-dev:riscv64 \
+                      libpixman-1-dev:riscv64 && \
+    eatmydata apt-get autoremove -y && \
+    eatmydata apt-get autoclean -y && \
+    mkdir -p /usr/local/share/meson/cross && \
+    printf "[binaries]\n\
+c = '/usr/bin/riscv64-linux-gnu-gcc'\n\
+ar = '/usr/bin/riscv64-linux-gnu-gcc-ar'\n\
+strip = '/usr/bin/riscv64-linux-gnu-strip'\n\
+pkgconfig = '/usr/bin/riscv64-linux-gnu-pkg-config'\n\
+\n\
+[host_machine]\n\
+system = 'linux'\n\
+cpu_family = 'riscv64'\n\
+cpu = 'riscv64'\n\
+endian = 'little'\n" > /usr/local/share/meson/cross/riscv64-linux-gnu && \
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
+    mkdir -p /usr/libexec/ccache-wrappers && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/riscv64-linux-gnu-c++ && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/riscv64-linux-gnu-cc && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/riscv64-linux-gnu-g++ && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/riscv64-linux-gnu-gcc
 
-# Duplicate deb line as deb-src
-RUN cat /etc/apt/sources.list | sed "s/^deb\ /deb-src /" >> /etc/apt/sources.list
-
-RUN apt update && \
-    DEBIAN_FRONTEND=noninteractive eatmydata \
-    apt install -y --no-install-recommends \
-         gcc-riscv64-linux-gnu \
-         libc6-dev-riscv64-cross \
-         libfdt-dev:riscv64 \
-         libffi-dev:riscv64 \
-         libglib2.0-dev:riscv64 \
-         libpixman-1-dev:riscv64
-
-# Specify the cross prefix for this image (see tests/docker/common.rc)
+ENV ABI "riscv64-linux-gnu"
+ENV MESON_OPTS "--cross-file=riscv64-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=riscv64-linux-gnu-
 ENV DEF_TARGET_LIST riscv64-softmmu,riscv64-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 5e06fb2cf5..b54566edcc 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -63,12 +63,12 @@ add_user_mapping = [
     "  id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi\n"
 ]
 
-def generate_dockerfile(host, target, cross=None, trailer=None):
+def generate_dockerfile(host, target, project="qemu", cross=None, trailer=None):
     filename = Path(src_dir, "tests", "docker", "dockerfiles", host + ".docker")
     cmd = lcitool_cmd + ["dockerfile"]
     if cross is not None:
         cmd.extend(["--cross", cross])
-    cmd.extend([target, "qemu"])
+    cmd.extend([target, project])
 
     if trailer is not None:
         trailer += "\n".join(add_user_mapping)
@@ -164,6 +164,12 @@ try:
                         trailer=cross_build("powerpc64le-linux-gnu-",
                                             "ppc64-softmmu,ppc64-linux-user"))
 
+    generate_dockerfile("debian-riscv64-cross", "debian-sid",
+                        project="qemu-minimal",
+                        cross="riscv64",
+                        trailer=cross_build("riscv64-linux-gnu-",
+                                            "riscv64-softmmu,riscv64-linux-user"))
+
     generate_dockerfile("debian-s390x-cross", "debian-11",
                         cross="s390x",
                         trailer=cross_build("s390x-linux-gnu-",

From 9fe8fa02cda26a203b1844433c62df64eab41244 Mon Sep 17 00:00:00 2001
From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Date: Fri, 30 Jun 2023 19:04:01 +0100
Subject: [PATCH 0366/1353] tests/avocado: update firmware to enable
 sbsa-ref/max
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update prebuilt firmware images to have TF-A with FEAT_FGT support
enabled. This allowed us to enable test for "max" cpu in sbsa-ref
machine.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-Id: <20230530152240.79160-1-marcin.juszkiewicz@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-17-alex.bennee@linaro.org>
---
 tests/avocado/machine_aarch64_sbsaref.py | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/tests/avocado/machine_aarch64_sbsaref.py b/tests/avocado/machine_aarch64_sbsaref.py
index 0a79fa7ab6..cce6ef9f65 100644
--- a/tests/avocado/machine_aarch64_sbsaref.py
+++ b/tests/avocado/machine_aarch64_sbsaref.py
@@ -29,23 +29,23 @@ class Aarch64SbsarefMachine(QemuSystemTest):
         """
         Flash volumes generated using:
 
-        - Fedora GNU Toolchain version 12.2.1 20220819 (Red Hat Cross 12.2.1-2)
+        - Fedora GNU Toolchain version 13.1.1 20230511 (Red Hat 13.1.1-2)
 
         - Trusted Firmware-A
-          https://github.com/ARM-software/arm-trusted-firmware/tree/5fdb2e54
+          https://github.com/ARM-software/arm-trusted-firmware/tree/c0d8ee38
 
         - Tianocore EDK II
-          https://github.com/tianocore/edk2/tree/494127613b
-          https://github.com/tianocore/edk2-non-osi/tree/41876073
-          https://github.com/tianocore/edk2-platforms/tree/8efa4f42
+          https://github.com/tianocore/edk2/tree/0f9283429dd4
+          https://github.com/tianocore/edk2-non-osi/tree/f0bb00937ad6
+          https://github.com/tianocore/edk2-platforms/tree/7880b92e2a04
         """
 
         # Secure BootRom (TF-A code)
         fs0_xz_url = (
-            "https://fileserver.linaro.org/s/ATnSmq6k8SoXgbH/"
+            "https://fileserver.linaro.org/s/HrYMCjP7MEccjRP/"
             "download/SBSA_FLASH0.fd.xz"
         )
-        fs0_xz_hash = "a210a09692bcbe0a3743ffd0df44e80e0c7ad8ab"
+        fs0_xz_hash = "447eff64a90b84ce47703c6ec41fbfc25befaaea"
         tar_xz_path = self.fetch_asset(fs0_xz_url, asset_hash=fs0_xz_hash)
         archive.extract(tar_xz_path, self.workdir)
         fs0_path = os.path.join(self.workdir, "SBSA_FLASH0.fd")
@@ -93,15 +93,15 @@ class Aarch64SbsarefMachine(QemuSystemTest):
 
         # AP Trusted ROM
         wait_for_console_pattern(self, "Booting Trusted Firmware")
-        wait_for_console_pattern(self, "BL1: v2.8(release):v2.8")
+        wait_for_console_pattern(self, "BL1: v2.9(release):v2.9")
         wait_for_console_pattern(self, "BL1: Booting BL2")
 
         # Trusted Boot Firmware
-        wait_for_console_pattern(self, "BL2: v2.8(release)")
+        wait_for_console_pattern(self, "BL2: v2.9(release)")
         wait_for_console_pattern(self, "Booting BL31")
 
         # EL3 Runtime Software
-        wait_for_console_pattern(self, "BL31: v2.8(release)")
+        wait_for_console_pattern(self, "BL31: v2.9(release)")
 
         # Non-trusted Firmware
         wait_for_console_pattern(self, "UEFI firmware (version 1.0")
@@ -136,21 +136,18 @@ class Aarch64SbsarefMachine(QemuSystemTest):
         self.vm.launch()
         wait_for_console_pattern(self, "Welcome to Alpine Linux 3.17")
 
-    @skipUnless(os.getenv("AVOCADO_TIMEOUT_EXPECTED"), "Test might timeout")
     def test_sbsaref_alpine_linux_cortex_a57(self):
         """
         :avocado: tags=cpu:cortex-a57
         """
         self.boot_alpine_linux("cortex-a57")
 
-    @skipUnless(os.getenv("AVOCADO_TIMEOUT_EXPECTED"), "Test might timeout")
     def test_sbsaref_alpine_linux_neoverse_n1(self):
         """
         :avocado: tags=cpu:max
         """
         self.boot_alpine_linux("neoverse-n1")
 
-    @skip("requires TF-A update to handle FEAT_FGT")
     def test_sbsaref_alpine_linux_max(self):
         """
         :avocado: tags=cpu:max

From 7ea47af3905d37565d34beb4a35bc1b7bdc8a885 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 30 Jun 2023 19:04:02 +0100
Subject: [PATCH 0367/1353] tests/avocado: Make the test_arm_bpim2u_gmac test
 more reliable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test_arm_bpim2u_gmac test sometimes fails (ca. 1 out of 20 runs
here) since the disk shows up as /dev/mmcblk1 instead of /dev/mmcblk0
in some runs. No matter of the name in /dev, the major:minor encoding
seems always to be the same, so we can fix this issue by using the
correct major:minor hex number in the "root=" parameter instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230630161604.446394-1-thuth@redhat.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-18-alex.bennee@linaro.org>
---
 tests/avocado/boot_linux_console.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py
index 6ed660611f..6eab515718 100644
--- a/tests/avocado/boot_linux_console.py
+++ b/tests/avocado/boot_linux_console.py
@@ -869,7 +869,7 @@ class BootLinuxConsole(LinuxKernelTest):
         self.vm.set_console()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
                                'console=ttyS0,115200 '
-                               'root=/dev/mmcblk0 rootwait rw '
+                               'root=b300 rootwait rw '
                                'panic=-1 noreboot')
         self.vm.add_args('-kernel', kernel_path,
                          '-dtb', dtb_path,
@@ -885,7 +885,7 @@ class BootLinuxConsole(LinuxKernelTest):
         exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
                                                 'Allwinner sun8i Family')
         exec_command_and_wait_for_pattern(self, 'cat /proc/partitions',
-                                                'mmcblk0')
+                                                'mmcblk')
         exec_command_and_wait_for_pattern(self, 'ifconfig eth0 up',
                                                  'eth0: Link is Up')
         exec_command_and_wait_for_pattern(self, 'udhcpc eth0',

From 465af4db965322630b253691b569b40cf84a2dbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:03 +0100
Subject: [PATCH 0368/1353] target/arm: make arm_casq_ptw CONFIG_TCG only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ptw code is accessed by non-TCG code (specifically arm_pamax and
arm_cpu_get_phys_page_attrs_debug) but most of it is really only for
TCG emulation. Seeing as we already assert for a non TARGET_AARCH64
build lets extend the test rather than further messing with the ifdef
ladder.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-19-alex.bennee@linaro.org>
---
 target/arm/ptw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 6015121b99..42355caa9b 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -628,7 +628,7 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
                              uint64_t new_val, S1Translate *ptw,
                              ARMMMUFaultInfo *fi)
 {
-#ifdef TARGET_AARCH64
+#if defined(TARGET_AARCH64) && defined(CONFIG_TCG)
     uint64_t cur_val;
     void *host = ptw->out_host;
 
@@ -709,7 +709,7 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
 
     return cur_val;
 #else
-    /* AArch32 does not have FEAT_HADFS. */
+    /* AArch32 does not have FEAT_HADFS; non-TCG guests only use debug-mode. */
     g_assert_not_reached();
 #endif
 }

From 6d03226b42247b68ab2f0b3663e0f624335a4055 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:04 +0100
Subject: [PATCH 0369/1353] plugins: force slow path when plugins instrument
 memory ops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The lack of SVE memory instrumentation has been an omission in plugin
handling since it was introduced. Fortunately we can utilise the
probe_* functions to force all all memory access to follow the slow
path. We do this by checking the access type and presence of plugin
memory callbacks and if set return the TLB_MMIO flag.

We have to jump through a few hoops in user mode to re-use the flag
but it was the desired effect:

 ./qemu-system-aarch64 -display none -serial mon:stdio \
   -M virt -cpu max -semihosting-config enable=on \
   -kernel ./tests/tcg/aarch64-softmmu/memory-sve \
   -plugin ./contrib/plugins/libexeclog.so,ifilter=st1w,afilter=0x40001808 -d plugin

gives (disas doesn't currently understand st1w):

  0, 0x40001808, 0xe54342a0, ".byte 0xa0, 0x42, 0x43, 0xe5", store, 0x40213010, RAM, store, 0x40213014, RAM, store, 0x40213018, RAM

And for user-mode:

  ./qemu-aarch64 \
    -plugin contrib/plugins/libexeclog.so,afilter=0x4007c0 \
    -d plugin \
    ./tests/tcg/aarch64-linux-user/sha512-sve

gives:

  1..10
  ok 1 - do_test(&tests[i])
  0, 0x4007c0, 0xa4004b80, ".byte 0x80, 0x4b, 0x00, 0xa4", load, 0x5500800370, load, 0x5500800371, load, 0x5500800372, load, 0x5500800373, load, 0x5500800374, load, 0x5500800375, load, 0x5500800376, load, 0x5500800377, load, 0x5500800378, load, 0x5500800379, load, 0x550080037a, load, 0x550080037b, load, 0x550080037c, load, 0x550080037d, load, 0x550080037e, load, 0x550080037f, load, 0x5500800380, load, 0x5500800381, load, 0x5500800382, load, 0x5500800383, load, 0x5500800384, load, 0x5500800385, load, 0x5500800386, lo
  ad, 0x5500800387, load, 0x5500800388, load, 0x5500800389, load, 0x550080038a, load, 0x550080038b, load, 0x550080038c, load, 0x550080038d, load, 0x550080038e, load, 0x550080038f, load, 0x5500800390, load, 0x5500800391, load, 0x5500800392, load, 0x5500800393, load, 0x5500800394, load, 0x5500800395, load, 0x5500800396, load, 0x5500800397, load, 0x5500800398, load, 0x5500800399, load, 0x550080039a, load, 0x550080039b, load, 0x550080039c, load, 0x550080039d, load, 0x550080039e, load, 0x550080039f, load, 0x55008003a0, load, 0x55008003a1, load, 0x55008003a2, load, 0x55008003a3, load, 0x55008003a4, load, 0x55008003a5, load, 0x55008003a6, load, 0x55008003a7, load, 0x55008003a8, load, 0x55008003a9, load, 0x55008003aa, load, 0x55008003ab, load, 0x55008003ac, load, 0x55008003ad, load, 0x55008003ae, load, 0x55008003af

(4007c0 is the ld1b in the sha512-sve)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: Robert Henry <robhenry@microsoft.com>
Cc: Aaron Lindsay <aaron@os.amperecomputing.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-20-alex.bennee@linaro.org>
---
 accel/tcg/cputlb.c                | 41 +++++++++++++++++++++++++------
 accel/tcg/user-exec.c             |  8 ++++--
 include/exec/cpu-all.h            |  2 +-
 include/exec/exec-all.h           | 23 +++++++++++++++++
 include/hw/core/cpu.h             | 17 +++++++++++++
 target/arm/ptw.c                  | 14 +++++------
 target/arm/tcg/sve_helper.c       |  4 ---
 tests/tcg/aarch64/Makefile.target |  8 ++++++
 8 files changed, 96 insertions(+), 21 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 5b51eff5a4..c2b81ec569 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1513,13 +1513,14 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
                                  int fault_size, MMUAccessType access_type,
                                  int mmu_idx, bool nonfault,
                                  void **phost, CPUTLBEntryFull **pfull,
-                                 uintptr_t retaddr)
+                                 uintptr_t retaddr, bool check_mem_cbs)
 {
     uintptr_t index = tlb_index(env, mmu_idx, addr);
     CPUTLBEntry *entry = tlb_entry(env, mmu_idx, addr);
     uint64_t tlb_addr = tlb_read_idx(entry, access_type);
     vaddr page_addr = addr & TARGET_PAGE_MASK;
     int flags = TLB_FLAGS_MASK & ~TLB_FORCE_SLOW;
+    bool force_mmio = check_mem_cbs && cpu_plugin_mem_cbs_enabled(env_cpu(env));
     CPUTLBEntryFull *full;
 
     if (!tlb_hit_page(tlb_addr, page_addr)) {
@@ -1553,7 +1554,9 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
     flags |= full->slow_flags[access_type];
 
     /* Fold all "mmio-like" bits into TLB_MMIO.  This is not RAM.  */
-    if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))) {
+    if (unlikely(flags & ~(TLB_WATCHPOINT | TLB_NOTDIRTY))
+        ||
+        (access_type != MMU_INST_FETCH && force_mmio)) {
         *phost = NULL;
         return TLB_MMIO;
     }
@@ -1569,7 +1572,7 @@ int probe_access_full(CPUArchState *env, vaddr addr, int size,
                       uintptr_t retaddr)
 {
     int flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
-                                      nonfault, phost, pfull, retaddr);
+                                      nonfault, phost, pfull, retaddr, true);
 
     /* Handle clean RAM pages.  */
     if (unlikely(flags & TLB_NOTDIRTY)) {
@@ -1580,6 +1583,29 @@ int probe_access_full(CPUArchState *env, vaddr addr, int size,
     return flags;
 }
 
+int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
+                          MMUAccessType access_type, int mmu_idx,
+                          void **phost, CPUTLBEntryFull **pfull)
+{
+    void *discard_phost;
+    CPUTLBEntryFull *discard_tlb;
+
+    /* privately handle users that don't need full results */
+    phost = phost ? phost : &discard_phost;
+    pfull = pfull ? pfull : &discard_tlb;
+
+    int flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
+                                      true, phost, pfull, 0, false);
+
+    /* Handle clean RAM pages.  */
+    if (unlikely(flags & TLB_NOTDIRTY)) {
+        notdirty_write(env_cpu(env), addr, 1, *pfull, 0);
+        flags &= ~TLB_NOTDIRTY;
+    }
+
+    return flags;
+}
+
 int probe_access_flags(CPUArchState *env, vaddr addr, int size,
                        MMUAccessType access_type, int mmu_idx,
                        bool nonfault, void **phost, uintptr_t retaddr)
@@ -1590,7 +1616,7 @@ int probe_access_flags(CPUArchState *env, vaddr addr, int size,
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 
     flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
-                                  nonfault, phost, &full, retaddr);
+                                  nonfault, phost, &full, retaddr, true);
 
     /* Handle clean RAM pages. */
     if (unlikely(flags & TLB_NOTDIRTY)) {
@@ -1611,7 +1637,7 @@ void *probe_access(CPUArchState *env, vaddr addr, int size,
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
 
     flags = probe_access_internal(env, addr, size, access_type, mmu_idx,
-                                  false, &host, &full, retaddr);
+                                  false, &host, &full, retaddr, true);
 
     /* Per the interface, size == 0 merely faults the access. */
     if (size == 0) {
@@ -1644,7 +1670,7 @@ void *tlb_vaddr_to_host(CPUArchState *env, abi_ptr addr,
     int flags;
 
     flags = probe_access_internal(env, addr, 0, access_type,
-                                  mmu_idx, true, &host, &full, 0);
+                                  mmu_idx, true, &host, &full, 0, false);
 
     /* No combination of flags are expected by the caller. */
     return flags ? NULL : host;
@@ -1667,7 +1693,8 @@ tb_page_addr_t get_page_addr_code_hostp(CPUArchState *env, vaddr addr,
     void *p;
 
     (void)probe_access_internal(env, addr, 1, MMU_INST_FETCH,
-                                cpu_mmu_index(env, true), false, &p, &full, 0);
+                                cpu_mmu_index(env, true), false,
+                                &p, &full, 0, false);
     if (p == NULL) {
         return -1;
     }
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 8fbcbf9771..d95b875a6a 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -745,6 +745,10 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
     if (guest_addr_valid_untagged(addr)) {
         int page_flags = page_get_flags(addr);
         if (page_flags & acc_flag) {
+            if ((acc_flag == PAGE_READ || acc_flag == PAGE_WRITE)
+                && cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
+                return TLB_MMIO;
+            }
             return 0; /* success */
         }
         maperr = !(page_flags & PAGE_VALID);
@@ -767,7 +771,7 @@ int probe_access_flags(CPUArchState *env, vaddr addr, int size,
 
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
     flags = probe_access_internal(env, addr, size, access_type, nonfault, ra);
-    *phost = flags ? NULL : g2h(env_cpu(env), addr);
+    *phost = (flags & TLB_INVALID_MASK) ? NULL : g2h(env_cpu(env), addr);
     return flags;
 }
 
@@ -778,7 +782,7 @@ void *probe_access(CPUArchState *env, vaddr addr, int size,
 
     g_assert(-(addr | TARGET_PAGE_MASK) >= size);
     flags = probe_access_internal(env, addr, size, access_type, false, ra);
-    g_assert(flags == 0);
+    g_assert((flags & ~TLB_MMIO) == 0);
 
     return size ? g2h(env_cpu(env), addr) : NULL;
 }
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 8018ce783e..472fe9ad9c 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -301,7 +301,7 @@ CPUArchState *cpu_copy(CPUArchState *env);
  * be signaled by probe_access_flags().
  */
 #define TLB_INVALID_MASK    (1 << (TARGET_PAGE_BITS_MIN - 1))
-#define TLB_MMIO            0
+#define TLB_MMIO            (1 << (TARGET_PAGE_BITS_MIN - 2))
 #define TLB_WATCHPOINT      0
 
 #else
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 200c27eadf..5fa0687cd2 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -464,6 +464,29 @@ int probe_access_full(CPUArchState *env, vaddr addr, int size,
                       MMUAccessType access_type, int mmu_idx,
                       bool nonfault, void **phost,
                       CPUTLBEntryFull **pfull, uintptr_t retaddr);
+
+/**
+ * probe_access_mmu() - Like probe_access_full except cannot fault and
+ * doesn't trigger instrumentation.
+ *
+ * @env: CPUArchState
+ * @vaddr: virtual address to probe
+ * @size: size of the probe
+ * @access_type: read, write or execute permission
+ * @mmu_idx: softmmu index
+ * @phost: ptr to return value host address or NULL
+ * @pfull: ptr to return value CPUTLBEntryFull structure or NULL
+ *
+ * The CPUTLBEntryFull structure returned via @pfull is transient
+ * and must be consumed or copied immediately, before any further
+ * access or changes to TLB @mmu_idx.
+ *
+ * Returns: TLB flags as per probe_access_flags()
+ */
+int probe_access_full_mmu(CPUArchState *env, vaddr addr, int size,
+                          MMUAccessType access_type, int mmu_idx,
+                          void **phost, CPUTLBEntryFull **pfull);
+
 #endif
 
 /* Hide the qatomic_read to make code a little easier on the eyes */
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index b08f8b7079..fdcbe87352 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -976,6 +976,23 @@ void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);
 void cpu_watchpoint_remove_all(CPUState *cpu, int mask);
 #endif
 
+/**
+ * cpu_plugin_mem_cbs_enabled() - are plugin memory callbacks enabled?
+ * @cs: CPUState pointer
+ *
+ * The memory callbacks are installed if a plugin has instrumented an
+ * instruction for memory. This can be useful to know if you want to
+ * force a slow path for a series of memory accesses.
+ */
+static inline bool cpu_plugin_mem_cbs_enabled(const CPUState *cpu)
+{
+#ifdef CONFIG_PLUGIN
+    return !!cpu->plugin_mem_cbs;
+#else
+    return false;
+#endif
+}
+
 /**
  * cpu_get_address_space:
  * @cpu: CPU to get address space from
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 42355caa9b..9aaff1546a 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -489,9 +489,9 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         int flags;
 
         env->tlb_fi = fi;
-        flags = probe_access_full(env, addr, 0, MMU_DATA_LOAD,
-                                  arm_to_core_mmu_idx(s2_mmu_idx),
-                                  true, &ptw->out_host, &full, 0);
+        flags = probe_access_full_mmu(env, addr, 0, MMU_DATA_LOAD,
+                                      arm_to_core_mmu_idx(s2_mmu_idx),
+                                      &ptw->out_host, &full);
         env->tlb_fi = NULL;
 
         if (unlikely(flags & TLB_INVALID_MASK)) {
@@ -644,12 +644,12 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
      */
     if (unlikely(!ptw->out_rw)) {
         int flags;
-        void *discard;
 
         env->tlb_fi = fi;
-        flags = probe_access_flags(env, ptw->out_virt, 0, MMU_DATA_STORE,
-                                   arm_to_core_mmu_idx(ptw->in_ptw_idx),
-                                   true, &discard, 0);
+        flags = probe_access_full_mmu(env, ptw->out_virt, 0,
+                                      MMU_DATA_STORE,
+                                      arm_to_core_mmu_idx(ptw->in_ptw_idx),
+                                      NULL, NULL);
         env->tlb_fi = NULL;
 
         if (unlikely(flags & TLB_INVALID_MASK)) {
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index 0097522470..7c103fc9f7 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -5688,9 +5688,6 @@ void sve_ldN_r(CPUARMState *env, uint64_t *vg, const target_ulong addr,
 
     flags = info.page[0].flags | info.page[1].flags;
     if (unlikely(flags != 0)) {
-#ifdef CONFIG_USER_ONLY
-        g_assert_not_reached();
-#else
         /*
          * At least one page includes MMIO.
          * Any bus operation can fail with cpu_transaction_failed,
@@ -5727,7 +5724,6 @@ void sve_ldN_r(CPUARMState *env, uint64_t *vg, const target_ulong addr,
             memcpy(&env->vfp.zregs[(rd + i) & 31], &scratch[i], reg_max);
         }
         return;
-#endif
     }
 
     /* The entire operation is in RAM, on valid pages. */
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 3430fd3cd8..cec1d4b287 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -91,6 +91,14 @@ sha512-vector: sha512.c
 
 TESTS += sha512-vector
 
+ifneq ($(CROSS_CC_HAS_SVE),)
+sha512-sve: CFLAGS=-O3 -march=armv8.1-a+sve
+sha512-sve: sha512.c
+	$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $< -o $@ $(LDFLAGS)
+
+TESTS += sha512-sve
+endif
+
 ifeq ($(HOST_GDB_SUPPORTS_ARCH),y)
 GDB_SCRIPT=$(SRC_PATH)/tests/guest-debug/run-test.py
 

From 402587419993d86638f1f81fc4e55625a320ad2f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:05 +0100
Subject: [PATCH 0370/1353] plugins: fix memory leak while parsing options
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was hard to track down this leak as it was an internal allocation
by glib and the backtraces did not give much away. The autofree was
freeing the allocation with g_free() but not taking care of the
individual strings. They should have been freed with g_strfreev()
instead.

Searching the glib source code for the correct string free function
led to:

  G_DEFINE_AUTO_CLEANUP_FREE_FUNC(GStrv, g_strfreev, NULL)

and indeed if you read to the bottom of the documentation page you
will find:

  typedef gchar** GStrv;

  A typedef alias for gchar**. This is mostly useful when used together with g_auto().

So fix up all the g_autofree g_strsplit case that smugly thought they
had de-allocation covered.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-21-alex.bennee@linaro.org>
---
 contrib/plugins/cache.c     | 2 +-
 contrib/plugins/drcov.c     | 2 +-
 contrib/plugins/execlog.c   | 2 +-
 contrib/plugins/hotblocks.c | 2 +-
 contrib/plugins/hotpages.c  | 2 +-
 contrib/plugins/howvec.c    | 2 +-
 contrib/plugins/hwprofile.c | 2 +-
 contrib/plugins/lockstep.c  | 2 +-
 tests/plugin/bb.c           | 2 +-
 tests/plugin/insn.c         | 2 +-
 tests/plugin/mem.c          | 2 +-
 tests/plugin/syscall.c      | 2 +-
 12 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/contrib/plugins/cache.c b/contrib/plugins/cache.c
index 2e25184a7f..5036213f1b 100644
--- a/contrib/plugins/cache.c
+++ b/contrib/plugins/cache.c
@@ -772,7 +772,7 @@ int qemu_plugin_install(qemu_plugin_id_t id, const qemu_info_t *info,
 
     for (i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
 
         if (g_strcmp0(tokens[0], "iblksize") == 0) {
             l1_iblksize = STRTOLL(tokens[1]);
diff --git a/contrib/plugins/drcov.c b/contrib/plugins/drcov.c
index b4a855adaf..686ae0a537 100644
--- a/contrib/plugins/drcov.c
+++ b/contrib/plugins/drcov.c
@@ -148,7 +148,7 @@ int qemu_plugin_install(qemu_plugin_id_t id, const qemu_info_t *info,
                         int argc, char **argv)
 {
     for (int i = 0; i < argc; i++) {
-        g_autofree char **tokens = g_strsplit(argv[i], "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(argv[i], "=", 2);
         if (g_strcmp0(tokens[0], "filename") == 0) {
             file_name = g_strdup(tokens[1]);
         }
diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
index e255bd21fd..7129d526f8 100644
--- a/contrib/plugins/execlog.c
+++ b/contrib/plugins/execlog.c
@@ -227,7 +227,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     for (int i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
         if (g_strcmp0(tokens[0], "ifilter") == 0) {
             parse_insn_match(tokens[1]);
         } else if (g_strcmp0(tokens[0], "afilter") == 0) {
diff --git a/contrib/plugins/hotblocks.c b/contrib/plugins/hotblocks.c
index 062200a7a4..6b74d25fea 100644
--- a/contrib/plugins/hotblocks.c
+++ b/contrib/plugins/hotblocks.c
@@ -135,7 +135,7 @@ int qemu_plugin_install(qemu_plugin_id_t id, const qemu_info_t *info,
 {
     for (int i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
         if (g_strcmp0(tokens[0], "inline") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &do_inline)) {
                 fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
diff --git a/contrib/plugins/hotpages.c b/contrib/plugins/hotpages.c
index 0d12910af6..8316ae50c7 100644
--- a/contrib/plugins/hotpages.c
+++ b/contrib/plugins/hotpages.c
@@ -169,7 +169,7 @@ int qemu_plugin_install(qemu_plugin_id_t id, const qemu_info_t *info,
 
     for (i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", -1);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", -1);
 
         if (g_strcmp0(tokens[0], "sortby") == 0) {
             if (g_strcmp0(tokens[1], "reads") == 0) {
diff --git a/contrib/plugins/howvec.c b/contrib/plugins/howvec.c
index 4a5ec3d936..0ed01ea931 100644
--- a/contrib/plugins/howvec.c
+++ b/contrib/plugins/howvec.c
@@ -333,7 +333,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     for (i = 0; i < argc; i++) {
         char *p = argv[i];
-        g_autofree char **tokens = g_strsplit(p, "=", -1);
+        g_auto(GStrv) tokens = g_strsplit(p, "=", -1);
         if (g_strcmp0(tokens[0], "inline") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &do_inline)) {
                 fprintf(stderr, "boolean argument parsing failed: %s\n", p);
diff --git a/contrib/plugins/hwprofile.c b/contrib/plugins/hwprofile.c
index 691d4edb0c..739ac0c66b 100644
--- a/contrib/plugins/hwprofile.c
+++ b/contrib/plugins/hwprofile.c
@@ -263,7 +263,7 @@ int qemu_plugin_install(qemu_plugin_id_t id, const qemu_info_t *info,
 
     for (i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
 
         if (g_strcmp0(tokens[0], "track") == 0) {
             if (g_strcmp0(tokens[1], "read") == 0) {
diff --git a/contrib/plugins/lockstep.c b/contrib/plugins/lockstep.c
index a41ffe83fa..e36f0b9562 100644
--- a/contrib/plugins/lockstep.c
+++ b/contrib/plugins/lockstep.c
@@ -323,7 +323,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     for (i = 0; i < argc; i++) {
         char *p = argv[i];
-        g_autofree char **tokens = g_strsplit(p, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(p, "=", 2);
 
         if (g_strcmp0(tokens[0], "verbose") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &verbose)) {
diff --git a/tests/plugin/bb.c b/tests/plugin/bb.c
index 7d470a1011..df50d1fd3b 100644
--- a/tests/plugin/bb.c
+++ b/tests/plugin/bb.c
@@ -104,7 +104,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     for (i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
         if (g_strcmp0(tokens[0], "inline") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &do_inline)) {
                 fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
diff --git a/tests/plugin/insn.c b/tests/plugin/insn.c
index 9bd6e44f73..5fd3017c2b 100644
--- a/tests/plugin/insn.c
+++ b/tests/plugin/insn.c
@@ -189,7 +189,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 {
     for (int i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
         if (g_strcmp0(tokens[0], "inline") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &do_inline)) {
                 fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
diff --git a/tests/plugin/mem.c b/tests/plugin/mem.c
index 4570f7d815..f3b9f696a0 100644
--- a/tests/plugin/mem.c
+++ b/tests/plugin/mem.c
@@ -83,7 +83,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     for (int i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
 
         if (g_strcmp0(tokens[0], "haddr") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &do_haddr)) {
diff --git a/tests/plugin/syscall.c b/tests/plugin/syscall.c
index 96040c578f..72e1a5bf90 100644
--- a/tests/plugin/syscall.c
+++ b/tests/plugin/syscall.c
@@ -121,7 +121,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     for (int i = 0; i < argc; i++) {
         char *opt = argv[i];
-        g_autofree char **tokens = g_strsplit(opt, "=", 2);
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
 
         if (g_strcmp0(tokens[0], "print") == 0) {
             if (!qemu_plugin_bool_parse(tokens[0], tokens[1], &do_print)) {

From ee293103b061b39c84334a29eb596e1e07a308da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:06 +0100
Subject: [PATCH 0371/1353] plugins: update lockstep to use g_memdup2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The old g_memdup is deprecated, use the replacement.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-22-alex.bennee@linaro.org>
---
 contrib/plugins/lockstep.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/plugins/lockstep.c b/contrib/plugins/lockstep.c
index e36f0b9562..3614c3564c 100644
--- a/contrib/plugins/lockstep.c
+++ b/contrib/plugins/lockstep.c
@@ -130,7 +130,7 @@ static void report_divergance(ExecState *us, ExecState *them)
         }
     }
     divergence_log = g_slist_prepend(divergence_log,
-                                     g_memdup(&divrec, sizeof(divrec)));
+                                     g_memdup2(&divrec, sizeof(divrec)));
 
     /* Output short log entry of going out of sync... */
     if (verbose || divrec.distance == 1 || diverged) {

From 8b4528c829a787533359de5550796e87070c9bba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:07 +0100
Subject: [PATCH 0372/1353] docs/devel: add some front matter to the devel
 index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Give an overview of the most useful bits of the devel documentation to
read depending on what the developer wants to do.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-23-alex.bennee@linaro.org>
---
 docs/devel/index-process.rst |  2 ++
 docs/devel/index-tcg.rst     |  2 ++
 docs/devel/index.rst         | 24 ++++++++++++++++++++++--
 docs/devel/tcg.rst           |  2 ++
 4 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/docs/devel/index-process.rst b/docs/devel/index-process.rst
index d50dd74c3e..362f97ee30 100644
--- a/docs/devel/index-process.rst
+++ b/docs/devel/index-process.rst
@@ -1,3 +1,5 @@
+.. _development_process:
+
 QEMU Community Processes
 ------------------------
 
diff --git a/docs/devel/index-tcg.rst b/docs/devel/index-tcg.rst
index b44ff8b5a4..a992844e5c 100644
--- a/docs/devel/index-tcg.rst
+++ b/docs/devel/index-tcg.rst
@@ -1,3 +1,5 @@
+.. _tcg:
+
 TCG Emulation
 -------------
 
diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index 09cfb322be..abf60457c2 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -2,10 +2,30 @@
 Developer Information
 ---------------------
 
-This section of the manual documents various parts of the internals of QEMU.
-You only need to read it if you are interested in reading or
+This section of the manual documents various parts of the internals of
+QEMU. You only need to read it if you are interested in reading or
 modifying QEMU's source code.
 
+QEMU is a large and mature project with a number of complex subsystems
+that can be overwhelming to understand. The development documentation
+is not comprehensive but hopefully presents enough to get you started.
+If there are areas that are unclear please reach out either via the
+IRC channel or mailing list and hopefully we can improve the
+documentation for future developers.
+
+All developers will want to familiarise themselves with
+:ref:`development_process` and how the community interacts. Please pay
+particular attention to the :ref:`coding-style` and
+:ref:`submitting-a-patch` sections to avoid common pitfalls.
+
+If you wish to implement a new hardware model you will want to read
+through the :ref:`qom` documentation to understand how QEMU's object
+model works.
+
+Those wishing to enhance or add new CPU emulation capabilities will
+want to read our :ref:`tcg` documentation, especially the overview of
+the :ref:`tcg_internals`.
+
 .. toctree::
    :maxdepth: 1
 
diff --git a/docs/devel/tcg.rst b/docs/devel/tcg.rst
index b4096a17df..2786f2f679 100644
--- a/docs/devel/tcg.rst
+++ b/docs/devel/tcg.rst
@@ -1,3 +1,5 @@
+.. _tcg_internals:
+
 ====================
 Translator Internals
 ====================

From 6caf1571a97f38b2c14eca855941a0455b461041 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:08 +0100
Subject: [PATCH 0373/1353] include/migration: mark vmstate_register() as a
 legacy function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mention that QOM-ified devices already have support for registering
the description.

Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-24-alex.bennee@linaro.org>
---
 include/migration/vmstate.h | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 084f5e784a..d1b8abe08d 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -1209,7 +1209,15 @@ int vmstate_register_with_alias_id(VMStateIf *obj, uint32_t instance_id,
                                    int required_for_version,
                                    Error **errp);
 
-/* Returns: 0 on success, -1 on failure */
+/**
+ * vmstate_register() - legacy function to register state
+ * serialisation description
+ *
+ * New code shouldn't be using this function as QOM-ified devices have
+ * dc->vmsd to store the serialisation description.
+ *
+ * Returns: 0 on success, -1 on failure
+ */
 static inline int vmstate_register(VMStateIf *obj, int instance_id,
                                    const VMStateDescription *vmsd,
                                    void *opaque)

From 6aebb1f62b2c249cae175cdaf0611b9feaf50788 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:09 +0100
Subject: [PATCH 0374/1353] include/hw/qdev-core: fixup kerneldoc annotations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix up the kerneldoc markup and start documenting the various fields
in QDEV related structures. This involved:

 - moving overall description to a DOC: comment at top
 - fixing various markup issues for types and structures
 - adding missing Return: statements
 - adding some typedefs to hide QLIST macros in headers

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-25-alex.bennee@linaro.org>
---
 include/hw/qdev-core.h | 368 ++++++++++++++++++++++++++++-------------
 1 file changed, 254 insertions(+), 114 deletions(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index f1070d6dc7..06cadfc492 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -10,6 +10,65 @@
 #include "hw/hotplug.h"
 #include "hw/resettable.h"
 
+/**
+ * DOC: The QEMU Device API
+ *
+ * All modern devices should represented as a derived QOM class of
+ * TYPE_DEVICE. The device API introduces the additional methods of
+ * @realize and @unrealize to represent additional stages in a device
+ * objects life cycle.
+ *
+ * Realization
+ * -----------
+ *
+ * Devices are constructed in two stages:
+ *
+ * 1) object instantiation via object_initialize() and
+ * 2) device realization via the #DeviceState.realized property
+ *
+ * The former may not fail (and must not abort or exit, since it is called
+ * during device introspection already), and the latter may return error
+ * information to the caller and must be re-entrant.
+ * Trivial field initializations should go into #TypeInfo.instance_init.
+ * Operations depending on @props static properties should go into @realize.
+ * After successful realization, setting static properties will fail.
+ *
+ * As an interim step, the #DeviceState.realized property can also be
+ * set with qdev_realize(). In the future, devices will propagate this
+ * state change to their children and along busses they expose. The
+ * point in time will be deferred to machine creation, so that values
+ * set in @realize will not be introspectable beforehand. Therefore
+ * devices must not create children during @realize; they should
+ * initialize them via object_initialize() in their own
+ * #TypeInfo.instance_init and forward the realization events
+ * appropriately.
+ *
+ * Any type may override the @realize and/or @unrealize callbacks but needs
+ * to call the parent type's implementation if keeping their functionality
+ * is desired. Refer to QOM documentation for further discussion and examples.
+ *
+ * .. note::
+ *   Since TYPE_DEVICE doesn't implement @realize and @unrealize, types
+ *   derived directly from it need not call their parent's @realize and
+ *   @unrealize. For other types consult the documentation and
+ *   implementation of the respective parent types.
+ *
+ * Hiding a device
+ * ---------------
+ *
+ * To hide a device, a DeviceListener function hide_device() needs to
+ * be registered. It can be used to defer adding a device and
+ * therefore hide it from the guest. The handler registering to this
+ * DeviceListener can save the QOpts passed to it for re-using it
+ * later. It must return if it wants the device to be hidden or
+ * visible. When the handler function decides the device shall be
+ * visible it will be added with qdev_device_add() and realized as any
+ * other device. Otherwise qdev_device_add() will return early without
+ * adding the device. The guest will not see a "hidden" device until
+ * it was marked visible and qdev_device_add called again.
+ *
+ */
+
 enum {
     DEV_NVECTORS_UNSPECIFIED = -1,
 };
@@ -38,7 +97,7 @@ typedef void (*BusRealize)(BusState *bus, Error **errp);
 typedef void (*BusUnrealize)(BusState *bus);
 
 /**
- * DeviceClass:
+ * struct DeviceClass - The base class for all devices.
  * @props: Properties accessing state fields.
  * @realize: Callback function invoked when the #DeviceState:realized
  * property is changed to %true.
@@ -47,72 +106,37 @@ typedef void (*BusUnrealize)(BusState *bus);
  * @hotpluggable: indicates if #DeviceClass is hotpluggable, available
  * as readonly "hotpluggable" property of #DeviceState instance
  *
- * # Realization #
- * Devices are constructed in two stages,
- * 1) object instantiation via object_initialize() and
- * 2) device realization via #DeviceState:realized property.
- * The former may not fail (and must not abort or exit, since it is called
- * during device introspection already), and the latter may return error
- * information to the caller and must be re-entrant.
- * Trivial field initializations should go into #TypeInfo.instance_init.
- * Operations depending on @props static properties should go into @realize.
- * After successful realization, setting static properties will fail.
- *
- * As an interim step, the #DeviceState:realized property can also be
- * set with qdev_realize().
- * In the future, devices will propagate this state change to their children
- * and along busses they expose.
- * The point in time will be deferred to machine creation, so that values
- * set in @realize will not be introspectable beforehand. Therefore devices
- * must not create children during @realize; they should initialize them via
- * object_initialize() in their own #TypeInfo.instance_init and forward the
- * realization events appropriately.
- *
- * Any type may override the @realize and/or @unrealize callbacks but needs
- * to call the parent type's implementation if keeping their functionality
- * is desired. Refer to QOM documentation for further discussion and examples.
- *
- * <note>
- *   <para>
- * Since TYPE_DEVICE doesn't implement @realize and @unrealize, types
- * derived directly from it need not call their parent's @realize and
- * @unrealize.
- * For other types consult the documentation and implementation of the
- * respective parent types.
- *   </para>
- * </note>
- *
- * # Hiding a device #
- * To hide a device, a DeviceListener function hide_device() needs to
- * be registered.
- * It can be used to defer adding a device and therefore hide it from
- * the guest. The handler registering to this DeviceListener can save
- * the QOpts passed to it for re-using it later. It must return if it
- * wants the device to be hidden or visible. When the handler function
- * decides the device shall be visible it will be added with
- * qdev_device_add() and realized as any other device. Otherwise
- * qdev_device_add() will return early without adding the device. The
- * guest will not see a "hidden" device until it was marked visible
- * and qdev_device_add called again.
- *
  */
 struct DeviceClass {
-    /*< private >*/
+    /* private: */
     ObjectClass parent_class;
-    /*< public >*/
 
+    /* public: */
+
+    /**
+     * @categories: device categories device belongs to
+     */
     DECLARE_BITMAP(categories, DEVICE_CATEGORY_MAX);
+    /**
+     * @fw_name: name used to identify device to firmware interfaces
+     */
     const char *fw_name;
+    /**
+     * @desc: human readable description of device
+     */
     const char *desc;
 
-    /*
-     * The underscore at the end ensures a compile-time error if someone
-     * assigns to dc->props instead of using device_class_set_props.
+    /**
+     * @props_: properties associated with device, should only be
+     * assigned by using device_class_set_props(). The underscore
+     * ensures a compile-time error if someone attempts to assign
+     * dc->props directly.
      */
     Property *props_;
 
-    /*
-     * Can this device be instantiated with -device / device_add?
+    /**
+     * @user_creatable: Can user instantiate with -device / device_add?
+     *
      * All devices should support instantiation with device_add, and
      * this flag should not exist.  But we're not there, yet.  Some
      * devices fail to instantiate with cryptic error messages.
@@ -120,25 +144,35 @@ struct DeviceClass {
      * behavior would be cruel; clearing this flag will protect them.
      * It should never be cleared without a comment explaining why it
      * is cleared.
+     *
      * TODO remove once we're there
      */
     bool user_creatable;
     bool hotpluggable;
 
     /* callbacks */
-    /*
-     * Reset method here is deprecated and replaced by methods in the
-     * resettable class interface to implement a multi-phase reset.
+    /**
+     * @reset: deprecated device reset method pointer
+     *
+     * Modern code should use the ResettableClass interface to
+     * implement a multi-phase reset.
+     *
      * TODO: remove once every reset callback is unused
      */
     DeviceReset reset;
     DeviceRealize realize;
     DeviceUnrealize unrealize;
 
-    /* device state */
+    /**
+     * @vmsd: device state serialisation description for
+     * migration/save/restore
+     */
     const VMStateDescription *vmsd;
 
-    /* Private to qdev / bus.  */
+    /**
+     * @bus_type: bus type
+     * private: to qdev / bus.
+     */
     const char *bus_type;
 };
 
@@ -167,37 +201,96 @@ typedef struct {
     bool engaged_in_io;
 } MemReentrancyGuard;
 
+
+typedef QLIST_HEAD(, NamedGPIOList) NamedGPIOListHead;
+typedef QLIST_HEAD(, NamedClockList) NamedClockListHead;
+typedef QLIST_HEAD(, BusState) BusStateHead;
+
 /**
- * DeviceState:
- * @reset: ResettableState for the device; handled by Resettable interface.
+ * struct DeviceState - common device state, accessed with qdev helpers
  *
  * This structure should not be accessed directly.  We declare it here
  * so that it can be embedded in individual device state structures.
  */
 struct DeviceState {
-    /*< private >*/
+    /* private: */
     Object parent_obj;
-    /*< public >*/
+    /* public: */
 
+    /**
+     * @id: global device id
+     */
     char *id;
+    /**
+     * @canonical_path: canonical path of realized device in the QOM tree
+     */
     char *canonical_path;
+    /**
+     * @realized: has device been realized?
+     */
     bool realized;
+    /**
+     * @pending_deleted_event: track pending deletion events during unplug
+     */
     bool pending_deleted_event;
+    /**
+     * @pending_deleted_expires_ms: optional timeout for deletion events
+     */
     int64_t pending_deleted_expires_ms;
+    /**
+     * @opts: QDict of options for the device
+     */
     QDict *opts;
+    /**
+     * @hotplugged: was device added after PHASE_MACHINE_READY?
+     */
     int hotplugged;
+    /**
+     * @allow_unplug_during_migration: can device be unplugged during migration
+     */
     bool allow_unplug_during_migration;
+    /**
+     * @parent_bus: bus this device belongs to
+     */
     BusState *parent_bus;
-    QLIST_HEAD(, NamedGPIOList) gpios;
-    QLIST_HEAD(, NamedClockList) clocks;
-    QLIST_HEAD(, BusState) child_bus;
+    /**
+     * @gpios: QLIST of named GPIOs the device provides.
+     */
+    NamedGPIOListHead gpios;
+    /**
+     * @clocks: QLIST of named clocks the device provides.
+     */
+    NamedClockListHead clocks;
+    /**
+     * @child_bus: QLIST of child buses
+     */
+    BusStateHead child_bus;
+    /**
+     * @num_child_bus: number of @child_bus entries
+     */
     int num_child_bus;
+    /**
+     * @instance_id_alias: device alias for handling legacy migration setups
+     */
     int instance_id_alias;
+    /**
+     * @alias_required_for_version: indicates @instance_id_alias is
+     * needed for migration
+     */
     int alias_required_for_version;
+    /**
+     * @reset: ResettableState for the device; handled by Resettable interface.
+     */
     ResettableState reset;
+    /**
+     * @unplug_blockers: list of reasons to block unplugging of device
+     */
     GSList *unplug_blockers;
-
-    /* Is the device currently in mmio/pio/dma? Used to prevent re-entrancy */
+    /**
+     * @mem_reentrancy_guard: Is the device currently in mmio/pio/dma?
+     *
+     * Used to prevent re-entrancy confusing things.
+     */
     MemReentrancyGuard mem_reentrancy_guard;
 };
 
@@ -264,13 +357,24 @@ typedef struct BusChild {
 
 #define QDEV_HOTPLUG_HANDLER_PROPERTY "hotplug-handler"
 
+typedef QTAILQ_HEAD(, BusChild) BusChildHead;
+typedef QLIST_ENTRY(BusState) BusStateEntry;
+
 /**
- * BusState:
+ * struct BusState:
+ * @obj: parent object
+ * @parent: parent Device
+ * @name: name of bus
  * @hotplug_handler: link to a hotplug handler associated with bus.
- * @reset: ResettableState for the bus; handled by Resettable interface.
+ * @max_index: max number of child buses
+ * @realized: is the bus itself realized?
+ * @full: is the bus full?
+ * @num_children: current number of child buses
  */
 struct BusState {
+    /* private: */
     Object obj;
+    /* public: */
     DeviceState *parent;
     char *name;
     HotplugHandler *hotplug_handler;
@@ -279,18 +383,24 @@ struct BusState {
     bool full;
     int num_children;
 
-    /*
-     * children is a RCU QTAILQ, thus readers must use RCU to access it,
-     * and writers must hold the big qemu lock
+    /**
+     * @children: an RCU protected QTAILQ, thus readers must use RCU
+     * to access it, and writers must hold the big qemu lock
+     */
+    BusChildHead children;
+    /**
+     * @sibling: next bus
+     */
+    BusStateEntry sibling;
+    /**
+     * @reset: ResettableState for the bus; handled by Resettable interface.
      */
-
-    QTAILQ_HEAD(, BusChild) children;
-    QLIST_ENTRY(BusState) sibling;
     ResettableState reset;
 };
 
 /**
- * GlobalProperty:
+ * typedef GlobalProperty - a global property type
+ *
  * @used: Set to true if property was used when initializing a device.
  * @optional: If set to true, GlobalProperty will be skipped without errors
  *            if the property doesn't exist.
@@ -324,7 +434,8 @@ compat_props_add(GPtrArray *arr,
  * This only allocates the memory and initializes the device state
  * structure, ready for the caller to set properties if they wish.
  * The device still needs to be realized.
- * The returned object has a reference count of 1.
+ *
+ * Return: a derived DeviceState object with a reference count of 1.
  */
 DeviceState *qdev_new(const char *name);
 
@@ -334,16 +445,18 @@ DeviceState *qdev_new(const char *name);
  *
  * This is like qdev_new(), except it returns %NULL when type @name
  * does not exist, rather than asserting.
+ *
+ * Return: a derived DeviceState object with a reference count of 1 or
+ * NULL if type @name does not exist.
  */
 DeviceState *qdev_try_new(const char *name);
 
 /**
- * qdev_is_realized:
+ * qdev_is_realized() - check if device is realized
  * @dev: The device to check.
  *
- * May be called outside big qemu lock.
- *
- * Returns: %true% if the device has been fully constructed, %false% otherwise.
+ * Context: May be called outside big qemu lock.
+ * Return: true if the device has been fully constructed, false otherwise.
  */
 static inline bool qdev_is_realized(DeviceState *dev)
 {
@@ -361,11 +474,11 @@ static inline bool qdev_is_realized(DeviceState *dev)
  * @dev must not be plugged into a bus already.
  * If @bus, plug @dev into @bus.  This takes a reference to @dev.
  * If @dev has no QOM parent, make one up, taking another reference.
- * On success, return true.
- * On failure, store an error through @errp and return false.
  *
  * If you created @dev using qdev_new(), you probably want to use
  * qdev_realize_and_unref() instead.
+ *
+ * Return: true on success, else false setting @errp with error
  */
 bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp);
 
@@ -392,6 +505,8 @@ bool qdev_realize(DeviceState *dev, BusState *bus, Error **errp);
  * for the only reference to the child device to be held by the parent
  * via the child<> property, and so the reference-count-drop done here
  * would be incorrect. For that use case you want qdev_realize().
+ *
+ * Return: true on success, else false setting @errp with error
  */
 bool qdev_realize_and_unref(DeviceState *dev, BusState *bus, Error **errp);
 
@@ -420,16 +535,16 @@ void qdev_set_legacy_instance_id(DeviceState *dev, int alias_id,
 HotplugHandler *qdev_get_bus_hotplug_handler(DeviceState *dev);
 HotplugHandler *qdev_get_machine_hotplug_handler(DeviceState *dev);
 bool qdev_hotplug_allowed(DeviceState *dev, Error **errp);
+
 /**
- * qdev_get_hotplug_handler: Get handler responsible for device wiring
- *
- * Find HOTPLUG_HANDLER for @dev that provides [pre|un]plug callbacks for it.
+ * qdev_get_hotplug_handler() - Get handler responsible for device wiring
+ * @dev: the device we want the HOTPLUG_HANDLER for.
  *
  * Note: in case @dev has a parent bus, it will be returned as handler unless
  * machine handler overrides it.
  *
- * Returns: pointer to object that implements TYPE_HOTPLUG_HANDLER interface
- *          or NULL if there aren't any.
+ * Return: pointer to object that implements TYPE_HOTPLUG_HANDLER interface
+ * or NULL if there aren't any.
  */
 HotplugHandler *qdev_get_hotplug_handler(DeviceState *dev);
 void qdev_unplug(DeviceState *dev, Error **errp);
@@ -459,15 +574,15 @@ void qdev_del_unplug_blocker(DeviceState *dev, Error *reason);
  * qdev_unplug_blocked: Confirm if a device is blocked from unplug
  *
  * @dev: Device to be tested
- * @reason: Returns one of the reasons why the device is blocked,
- *          if any
+ * @errp: The reasons why the device is blocked, if any
  *
- * Returns: true if device is blocked from unplug, false otherwise
+ * Returns: true (also setting @errp) if device is blocked from unplug,
+ * false otherwise
  */
 bool qdev_unplug_blocked(DeviceState *dev, Error **errp);
 
 /**
- * GpioPolarity: Polarity of a GPIO line
+ * typedef GpioPolarity - Polarity of a GPIO line
  *
  * GPIO lines use either positive (active-high) logic,
  * or negative (active-low) logic.
@@ -499,6 +614,8 @@ typedef enum {
  * connect another device's output GPIO line to this input.
  *
  * For named input GPIO lines, use qdev_get_gpio_in_named().
+ *
+ * Return: qemu_irq corresponding to anonymous input GPIO line
  */
 qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
 
@@ -516,6 +633,8 @@ qemu_irq qdev_get_gpio_in(DeviceState *dev, int n);
  * array); this function will assert() if passed an invalid name or index.
  *
  * For anonymous input GPIO lines, use qdev_get_gpio_in().
+ *
+ * Return: qemu_irq corresponding to named input GPIO line
  */
 qemu_irq qdev_get_gpio_in_named(DeviceState *dev, const char *name, int n);
 
@@ -523,7 +642,7 @@ qemu_irq qdev_get_gpio_in_named(DeviceState *dev, const char *name, int n);
  * qdev_connect_gpio_out: Connect one of a device's anonymous output GPIO lines
  * @dev: Device whose GPIO to connect
  * @n: Number of the anonymous output GPIO line (which must be in range)
- * @input_pin: qemu_irq to connect the output line to
+ * @pin: qemu_irq to connect the output line to
  *
  * This function connects an anonymous output GPIO line on a device
  * up to an arbitrary qemu_irq, so that when the device asserts that
@@ -594,6 +713,8 @@ void qdev_connect_gpio_out_named(DeviceState *dev, const char *name, int n,
  *
  * You probably don't need to use this function -- it is used only
  * by the platform-bus subsystem.
+ *
+ * Return: qemu_irq associated with GPIO or NULL if un-wired.
  */
 qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int n);
 
@@ -604,14 +725,17 @@ qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int n);
  * @name: Name of the output GPIO array
  * @n: Number of the GPIO line in the array
  *
- * This function is provided only for use by the qtest testing framework
- * and is not suitable for use in non-testing parts of QEMU.
+ * .. note::
+ *   This function is provided only for use by the qtest testing framework
+ *   and is not suitable for use in non-testing parts of QEMU.
  *
  * This function breaks an existing connection of an outbound GPIO
  * line from @dev, and replaces it with the new qemu_irq @icpt, as if
  * ``qdev_connect_gpio_out_named(dev, icpt, name, n)`` had been called.
  * The previously connected qemu_irq is returned, so it can be restored
  * by a second call to qdev_intercept_gpio_out() if desired.
+ *
+ * Return: old disconnected qemu_irq if one existed
  */
 qemu_irq qdev_intercept_gpio_out(DeviceState *dev, qemu_irq icpt,
                                  const char *name, int n);
@@ -683,9 +807,7 @@ void qdev_init_gpio_out_named(DeviceState *dev, qemu_irq *pins,
                               const char *name, int n);
 
 /**
- * qdev_init_gpio_in_named_with_opaque: create an array of input GPIO lines
- *   for the specified device
- *
+ * qdev_init_gpio_in_named_with_opaque() - create an array of input GPIO lines
  * @dev: Device to create input GPIOs for
  * @handler: Function to call when GPIO line value is set
  * @opaque: Opaque data pointer to pass to @handler
@@ -698,8 +820,11 @@ void qdev_init_gpio_in_named_with_opaque(DeviceState *dev,
                                          const char *name, int n);
 
 /**
- * qdev_init_gpio_in_named: create an array of input GPIO lines
- *   for the specified device
+ * qdev_init_gpio_in_named() - create an array of input GPIO lines
+ * @dev: device to add array to
+ * @handler: a &typedef qemu_irq_handler function to call when GPIO is set
+ * @name: Name of the GPIO input (must be unique for this device)
+ * @n: Number of GPIO lines in this input set
  *
  * Like qdev_init_gpio_in_named_with_opaque(), but the opaque pointer
  * passed to the handler is @dev (which is the most commonly desired behaviour).
@@ -762,14 +887,17 @@ int qdev_walk_children(DeviceState *dev,
                        void *opaque);
 
 /**
- * device_cold_reset:
+ * device_cold_reset() - perform a recursive cold reset on a device
+ * @dev: device to reset.
+ *
  * Reset device @dev and perform a recursive processing using the resettable
  * interface. It triggers a RESET_TYPE_COLD.
  */
 void device_cold_reset(DeviceState *dev);
 
 /**
- * bus_cold_reset:
+ * bus_cold_reset() - perform a recursive cold reset on a bus
+ * @bus: bus to reset
  *
  * Reset bus @bus and perform a recursive processing using the resettable
  * interface. It triggers a RESET_TYPE_COLD.
@@ -777,14 +905,18 @@ void device_cold_reset(DeviceState *dev);
 void bus_cold_reset(BusState *bus);
 
 /**
- * device_is_in_reset:
- * Return true if the device @dev is currently being reset.
+ * device_is_in_reset() - check device reset state
+ * @dev: device to check
+ *
+ * Return: true if the device @dev is currently being reset.
  */
 bool device_is_in_reset(DeviceState *dev);
 
 /**
- * bus_is_in_reset:
- * Return true if the bus @bus is currently being reset.
+ * bus_is_in_reset() - check bus reset state
+ * @bus: bus to check
+ *
+ * Return: true if the bus @bus is currently being reset.
  */
 bool bus_is_in_reset(BusState *bus);
 
@@ -797,7 +929,14 @@ char *qdev_get_own_fw_dev_path_from_handler(BusState *bus, DeviceState *dev);
 void device_class_set_props(DeviceClass *dc, Property *props);
 
 /**
- * device_class_set_parent_reset:
+ * device_class_set_parent_reset() - legacy set device reset handlers
+ * @dc: device class
+ * @dev_reset: function pointer to reset handler
+ * @parent_reset: function pointer to parents reset handler
+ *
+ * Modern code should use the ResettableClass interface to
+ * implement a multi-phase reset instead.
+ *
  * TODO: remove the function when DeviceClass's reset method
  * is not used anymore.
  */
@@ -871,14 +1010,15 @@ void device_listener_register(DeviceListener *listener);
 void device_listener_unregister(DeviceListener *listener);
 
 /**
- * @qdev_should_hide_device:
+ * qdev_should_hide_device() - check if device should be hidden
+ *
  * @opts: options QDict
  * @from_json: true if @opts entries are typed, false for all strings
  * @errp: pointer to error object
  *
- * Check if a device should be added.
- * When a device is added via qdev_device_add() this will be called,
- * and return if the device should be added now or not.
+ * When a device is added via qdev_device_add() this will be called.
+ *
+ * Return: if the device should be added now or not.
  */
 bool qdev_should_hide_device(const QDict *opts, bool from_json, Error **errp);
 

From 307c0a4ac9c7acb7937ef663b2369f081ba94cd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 30 Jun 2023 19:04:10 +0100
Subject: [PATCH 0375/1353] docs/devel/qom.rst: Correct code style
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per commit 067109a11c ("docs/devel: mention the spacing requirement
for QOM"):

  For a storage structure the first declaration should always be
  called “parent_obj” and for a class structure the first member
  should always be called “parent_class”

Adapt the QOM rST document accordingly.

Reported-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230622101717.70468-1-philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-26-alex.bennee@linaro.org>
---
 docs/devel/qom.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/qom.rst b/docs/devel/qom.rst
index c9237950d0..2828843058 100644
--- a/docs/devel/qom.rst
+++ b/docs/devel/qom.rst
@@ -26,7 +26,7 @@ features:
    typedef DeviceClass MyDeviceClass;
    typedef struct MyDevice
    {
-       DeviceState parent;
+       DeviceState parent_obj;
 
        int reg0, reg1, reg2;
    } MyDevice;
@@ -147,7 +147,7 @@ will also have a wrapper function to call it easily:
 
    typedef struct MyDeviceClass
    {
-       DeviceClass parent;
+       DeviceClass parent_class;
 
        void (*frobnicate) (MyDevice *obj);
    } MyDeviceClass;

From da966a8a7ccb3811546bf141e17e928ea291256e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:11 +0100
Subject: [PATCH 0376/1353] docs/devel: split qom-api reference into new file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lets try and keep the overview of the sub-system digestible by
splitting the core API stuff into a separate file. As QOM and QDEV
work together we should also try and enumerate the qdev_ functions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-27-alex.bennee@linaro.org>
---
 docs/devel/index-api.rst | 2 ++
 docs/devel/qdev-api.rst  | 7 +++++++
 docs/devel/qom-api.rst   | 9 +++++++++
 docs/devel/qom.rst       | 3 ++-
 4 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 docs/devel/qdev-api.rst
 create mode 100644 docs/devel/qom-api.rst

diff --git a/docs/devel/index-api.rst b/docs/devel/index-api.rst
index 7108821746..539ad29c21 100644
--- a/docs/devel/index-api.rst
+++ b/docs/devel/index-api.rst
@@ -11,5 +11,7 @@ generated from in-code annotations to function prototypes.
    loads-stores
    memory
    modules
+   qom-api
+   qdev-api
    ui
    zoned-storage
diff --git a/docs/devel/qdev-api.rst b/docs/devel/qdev-api.rst
new file mode 100644
index 0000000000..3f35eea025
--- /dev/null
+++ b/docs/devel/qdev-api.rst
@@ -0,0 +1,7 @@
+.. _qdev-api:
+
+================================
+QEMU Device (qdev) API Reference
+================================
+
+.. kernel-doc:: include/hw/qdev-core.h
diff --git a/docs/devel/qom-api.rst b/docs/devel/qom-api.rst
new file mode 100644
index 0000000000..ed1f17e797
--- /dev/null
+++ b/docs/devel/qom-api.rst
@@ -0,0 +1,9 @@
+.. _qom-api:
+
+=====================================
+QEMU Object Model (QOM) API Reference
+=====================================
+
+This is the complete API documentation for :ref:`qom`.
+
+.. kernel-doc:: include/qom/object.h
diff --git a/docs/devel/qom.rst b/docs/devel/qom.rst
index 2828843058..c342ce18e3 100644
--- a/docs/devel/qom.rst
+++ b/docs/devel/qom.rst
@@ -387,4 +387,5 @@ OBJECT_DEFINE_ABSTRACT_TYPE() macro can be used instead:
 API Reference
 -------------
 
-.. kernel-doc:: include/qom/object.h
+See the :ref:`QOM API<qom-api>` and :ref:`QDEV API<qdev-api>`
+documents for the complete API description.

From 43398409ce1a7fa83856f6141204aa103f0fe72c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:12 +0100
Subject: [PATCH 0377/1353] docs/devel: introduce some key concepts for QOM
 development
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Using QOM correctly is increasingly important to maintaining a modern
code base. However the current documentation skips some important
concepts before launching into a simple example. Lets:

  - at least mention properties
  - mention TYPE_OBJECT and TYPE_DEVICE
  - talk about why we have realize/unrealize
  - mention the QOM tree
  - lightly re-arrange the order we mention things

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-28-alex.bennee@linaro.org>
---
 docs/devel/qom.rst | 58 +++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 52 insertions(+), 6 deletions(-)

diff --git a/docs/devel/qom.rst b/docs/devel/qom.rst
index c342ce18e3..0b506426d7 100644
--- a/docs/devel/qom.rst
+++ b/docs/devel/qom.rst
@@ -13,6 +13,24 @@ features:
 - System for dynamically registering types
 - Support for single-inheritance of types
 - Multiple inheritance of stateless interfaces
+- Mapping internal members to publicly exposed properties
+
+The root object class is TYPE_OBJECT which provides for the basic
+object methods.
+
+The QOM tree
+============
+
+The QOM tree is a composition tree which represents all of the objects
+that make up a QEMU "machine". You can view this tree by running
+``info qom-tree`` in the :ref:`QEMU monitor`. It will contain both
+objects created by the machine itself as well those created due to
+user configuration.
+
+Creating a QOM class
+====================
+
+A simple minimal device implementation may look something like bellow:
 
 .. code-block:: c
    :caption: Creating a minimal type
@@ -48,6 +66,12 @@ In the above example, we create a simple type that is described by #TypeInfo.
 #TypeInfo describes information about the type including what it inherits
 from, the instance and class size, and constructor/destructor hooks.
 
+The TYPE_DEVICE class is the parent class for all modern devices
+implemented in QEMU and adds some specific methods to handle QEMU
+device model. This includes managing the lifetime of devices from
+creation through to when they become visible to the guest and
+eventually unrealized.
+
 Alternatively several static types could be registered using helper macro
 DEFINE_TYPES()
 
@@ -98,7 +122,7 @@ when the object is needed.
    module_obj(TYPE_MY_DEVICE);
 
 Class Initialization
-====================
+--------------------
 
 Before an object is initialized, the class for the object must be
 initialized.  There is only one class object for all instance objects
@@ -168,7 +192,7 @@ will also have a wrapper function to call it easily:
    }
 
 Interfaces
-==========
+----------
 
 Interfaces allow a limited form of multiple inheritance.  Instances are
 similar to normal types except for the fact that are only defined by
@@ -182,7 +206,7 @@ an argument to a method on its corresponding SomethingIfClass, or to
 dynamically cast it to an object that implements the interface.
 
 Methods
-=======
+-------
 
 A *method* is a function within the namespace scope of
 a class. It usually operates on the object instance by passing it as a
@@ -275,8 +299,8 @@ Alternatively, object_class_by_name() can be used to obtain the class and
 its non-overridden methods for a specific type. This would correspond to
 ``MyClass::method(...)`` in C++.
 
-The first example of such a QOM method was #CPUClass.reset,
-another example is #DeviceClass.realize.
+One example of such methods is ``DeviceClass.reset``. More examples
+can be found at :ref:`device-life-cycle`.
 
 Standard type declaration and definition macros
 ===============================================
@@ -382,10 +406,32 @@ OBJECT_DEFINE_ABSTRACT_TYPE() macro can be used instead:
    OBJECT_DEFINE_ABSTRACT_TYPE(MyDevice, my_device,
                                MY_DEVICE, DEVICE)
 
+.. _device-life-cycle:
 
+Device Life-cycle
+=================
+
+As class initialisation cannot fail devices have an two additional
+methods to handle the creation of dynamic devices. The ``realize``
+function is called with ``Error **`` pointer which should be set if
+the device cannot complete its setup. Otherwise on successful
+completion of the ``realize`` method the device object is added to the
+QOM tree and made visible to the guest.
+
+The reverse function is ``unrealize`` and should be were clean-up
+code lives to tidy up after the system is done with the device.
+
+All devices can be instantiated by C code, however only some can
+created dynamically via the command line or monitor.
+
+Likewise only some can be unplugged after creation and need an
+explicit ``unrealize`` implementation. This is determined by the
+``user_creatable`` variable in the root ``DeviceClass`` structure.
+Devices can only be unplugged if their ``parent_bus`` has a registered
+``HotplugHandler``.
 
 API Reference
--------------
+=============
 
 See the :ref:`QOM API<qom-api>` and :ref:`QDEV API<qdev-api>`
 documents for the complete API description.

From d2fe226467995c6843bba98da2e51dd5e85cef58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:13 +0100
Subject: [PATCH 0378/1353] gdbstub: lightly refactor connection to avoid
 snprintf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This may be a bit too much to avoid an snprintf and the slightly dodgy
assign to a const variable. But hopefully not.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-29-alex.bennee@linaro.org>
---
 gdbstub/softmmu.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/gdbstub/softmmu.c b/gdbstub/softmmu.c
index 99d994e6bf..f509b7285d 100644
--- a/gdbstub/softmmu.c
+++ b/gdbstub/softmmu.c
@@ -332,11 +332,9 @@ static void create_processes(GDBState *s)
 
 int gdbserver_start(const char *device)
 {
-    trace_gdbstub_op_start(device);
-
-    char gdbstub_device_name[128];
     Chardev *chr = NULL;
     Chardev *mon_chr;
+    g_autoptr(GString) cs = g_string_new(device);
 
     if (!first_cpu) {
         error_report("gdbstub: meaningless to attach gdb to a "
@@ -350,15 +348,16 @@ int gdbserver_start(const char *device)
         return -1;
     }
 
-    if (!device) {
+    if (cs->len == 0) {
         return -1;
     }
-    if (strcmp(device, "none") != 0) {
-        if (strstart(device, "tcp:", NULL)) {
+
+    trace_gdbstub_op_start(cs->str);
+
+    if (g_strcmp0(cs->str, "none") != 0) {
+        if (g_str_has_prefix(cs->str, "tcp:")) {
             /* enforce required TCP attributes */
-            snprintf(gdbstub_device_name, sizeof(gdbstub_device_name),
-                     "%s,wait=off,nodelay=on,server=on", device);
-            device = gdbstub_device_name;
+            g_string_append_printf(cs, ",wait=off,nodelay=on,server=on");
         }
 #ifndef _WIN32
         else if (strcmp(device, "stdio") == 0) {
@@ -373,7 +372,7 @@ int gdbserver_start(const char *device)
          * FIXME: it's a bit weird to allow using a mux chardev here
          * and implicitly setup a monitor. We may want to break this.
          */
-        chr = qemu_chr_new_noreplay("gdb", device, true, NULL);
+        chr = qemu_chr_new_noreplay("gdb", cs->str, true, NULL);
         if (!chr) {
             return -1;
         }

From 3b72d68162f63ae4abc78edaa40775b045128ff6 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Fri, 30 Jun 2023 19:04:14 +0100
Subject: [PATCH 0379/1353] gdbstub: Permit reverse step/break to provide stop
 response
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The final part of the reverse step and break handling is to bring
the machine back to a debug stop state. gdb expects a response.

A gdb 'rsi' command hangs forever because the gdbstub filters out
the response (also observable with reverse_debugging.py avocado
tests).

Fix by setting allow_stop_reply for the gdb backward packets.

Fixes: 758370052fb ("gdbstub: only send stop-reply packets when allowed to")
Cc: qemu-stable@nongnu.org
Cc: Matheus Tavares Bernardino <quic_mathbern@quicinc.com>
Cc: Alex Bennée <alex.bennee@linaro.org>
Cc: Taylor Simpson <tsimpson@quicinc.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Acked-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com>
Message-Id: <20230623035304.279833-1-npiggin@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-30-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index be18568d0a..9496d7b175 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -1814,6 +1814,7 @@ static int gdb_handle_packet(const char *line_buf)
                 .handler = handle_backward,
                 .cmd = "b",
                 .cmd_startswith = 1,
+                .allow_stop_reply = true,
                 .schema = "o0"
             };
             cmd_parser = &backward_cmd_desc;

From 2261b73c2802ed976903cdd4e22e3e4efb299a26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Fri, 30 Jun 2023 19:04:15 +0100
Subject: [PATCH 0380/1353] gdbstub: clean-up vcont handling to avoid goto
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can handle all the error exit cases by using g_autofree() for the
one thing that needs cleaning up on the exit.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-31-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c | 28 +++++++++-------------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 9496d7b175..49143c7d83 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -573,7 +573,6 @@ static int gdb_handle_vcont(const char *p)
 {
     int res, signal = 0;
     char cur_action;
-    char *newstates;
     unsigned long tmp;
     uint32_t pid, tid;
     GDBProcess *process;
@@ -581,7 +580,7 @@ static int gdb_handle_vcont(const char *p)
     GDBThreadIdKind kind;
     unsigned int max_cpus = gdb_get_max_cpus();
     /* uninitialised CPUs stay 0 */
-    newstates = g_new0(char, max_cpus);
+    g_autofree char *newstates = g_new0(char, max_cpus);
 
     /* mark valid CPUs with 1 */
     CPU_FOREACH(cpu) {
@@ -597,8 +596,7 @@ static int gdb_handle_vcont(const char *p)
     res = 0;
     while (*p) {
         if (*p++ != ';') {
-            res = -ENOTSUP;
-            goto out;
+            return -ENOTSUP;
         }
 
         cur_action = *p++;
@@ -606,13 +604,12 @@ static int gdb_handle_vcont(const char *p)
             cur_action = qemu_tolower(cur_action);
             res = qemu_strtoul(p, &p, 16, &tmp);
             if (res) {
-                goto out;
+                return res;
             }
             signal = gdb_signal_to_target(tmp);
         } else if (cur_action != 'c' && cur_action != 's') {
             /* unknown/invalid/unsupported command */
-            res = -ENOTSUP;
-            goto out;
+            return -ENOTSUP;
         }
 
         if (*p == '\0' || *p == ';') {
@@ -625,14 +622,12 @@ static int gdb_handle_vcont(const char *p)
         } else if (*p++ == ':') {
             kind = read_thread_id(p, &p, &pid, &tid);
         } else {
-            res = -ENOTSUP;
-            goto out;
+            return -ENOTSUP;
         }
 
         switch (kind) {
         case GDB_READ_THREAD_ERR:
-            res = -EINVAL;
-            goto out;
+            return -EINVAL;
 
         case GDB_ALL_PROCESSES:
             cpu = gdb_first_attached_cpu();
@@ -649,8 +644,7 @@ static int gdb_handle_vcont(const char *p)
             process = gdb_get_process(pid);
 
             if (!process->attached) {
-                res = -EINVAL;
-                goto out;
+                return -EINVAL;
             }
 
             cpu = get_first_cpu_in_process(process);
@@ -668,8 +662,7 @@ static int gdb_handle_vcont(const char *p)
 
             /* invalid CPU/thread specified */
             if (!cpu) {
-                res = -EINVAL;
-                goto out;
+                return -EINVAL;
             }
 
             /* only use if no previous match occourred */
@@ -679,12 +672,9 @@ static int gdb_handle_vcont(const char *p)
             break;
         }
     }
+
     gdbserver_state.signal = signal;
     gdb_continue_partial(newstates);
-
-out:
-    g_free(newstates);
-
     return res;
 }
 

From a4dab0a0d3a40079b439dcab94d347d33184c166 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:16 +0100
Subject: [PATCH 0381/1353] linux-user: Expose do_guest_openat() and
 do_guest_readlink()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These functions will be required by the GDB stub in order to provide
the guest view of /proc to GDB.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621203627.1808446-2-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-32-alex.bennee@linaro.org>
---
 linux-user/qemu.h    |  3 +++
 linux-user/syscall.c | 54 ++++++++++++++++++++++++++++----------------
 2 files changed, 38 insertions(+), 19 deletions(-)

diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 92f9f5af41..a5830ec239 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -165,6 +165,9 @@ typedef struct TaskState {
 } TaskState;
 
 abi_long do_brk(abi_ulong new_brk);
+int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
+                    int flags, mode_t mode);
+ssize_t do_guest_readlink(const char *pathname, char *buf, size_t bufsiz);
 
 /* user access */
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index f2cb101d83..fa83737192 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8448,7 +8448,8 @@ static int open_hardware(CPUArchState *cpu_env, int fd)
 }
 #endif
 
-static int do_openat(CPUArchState *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
+int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
+                    int flags, mode_t mode)
 {
     struct fake_open {
         const char *filename;
@@ -8520,6 +8521,36 @@ static int do_openat(CPUArchState *cpu_env, int dirfd, const char *pathname, int
     return safe_openat(dirfd, path(pathname), flags, mode);
 }
 
+ssize_t do_guest_readlink(const char *pathname, char *buf, size_t bufsiz)
+{
+    ssize_t ret;
+
+    if (!pathname || !buf) {
+        errno = EFAULT;
+        return -1;
+    }
+
+    if (!bufsiz) {
+        /* Short circuit this for the magic exe check. */
+        errno = EINVAL;
+        return -1;
+    }
+
+    if (is_proc_myself((const char *)pathname, "exe")) {
+        /*
+         * Don't worry about sign mismatch as earlier mapping
+         * logic would have thrown a bad address error.
+         */
+        ret = MIN(strlen(exec_path), bufsiz);
+        /* We cannot NUL terminate the string. */
+        memcpy(buf, exec_path, ret);
+    } else {
+        ret = readlink(path(pathname), buf, bufsiz);
+    }
+
+    return ret;
+}
+
 static int do_execveat(CPUArchState *cpu_env, int dirfd,
                        abi_long pathname, abi_long guest_argp,
                        abi_long guest_envp, int flags)
@@ -8994,7 +9025,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
     case TARGET_NR_open:
         if (!(p = lock_user_string(arg1)))
             return -TARGET_EFAULT;
-        ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
+        ret = get_errno(do_guest_openat(cpu_env, AT_FDCWD, p,
                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
                                   arg3));
         fd_trans_unregister(ret);
@@ -9004,7 +9035,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
     case TARGET_NR_openat:
         if (!(p = lock_user_string(arg2)))
             return -TARGET_EFAULT;
-        ret = get_errno(do_openat(cpu_env, arg1, p,
+        ret = get_errno(do_guest_openat(cpu_env, arg1, p,
                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
                                   arg4));
         fd_trans_unregister(ret);
@@ -10229,22 +10260,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
             void *p2;
             p = lock_user_string(arg1);
             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
-            if (!p || !p2) {
-                ret = -TARGET_EFAULT;
-            } else if (!arg3) {
-                /* Short circuit this for the magic exe check. */
-                ret = -TARGET_EINVAL;
-            } else if (is_proc_myself((const char *)p, "exe")) {
-                /*
-                 * Don't worry about sign mismatch as earlier mapping
-                 * logic would have thrown a bad address error.
-                 */
-                ret = MIN(strlen(exec_path), arg3);
-                /* We cannot NUL terminate the string. */
-                memcpy(p2, exec_path, ret);
-            } else {
-                ret = get_errno(readlink(path(p), p2, arg3));
-            }
+            ret = get_errno(do_guest_readlink(p, p2, arg3));
             unlock_user(p2, arg2, ret);
             unlock_user(p, arg1, 0);
         }

From 35be898e2f019bc63bffd02ab7fbd19287fd3cf4 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:17 +0100
Subject: [PATCH 0382/1353] linux-user: Add "safe" parameter to
 do_guest_openat()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gdbstub cannot meaningfully handle QEMU_ERESTARTSYS, and it doesn't
need to. Add a parameter to do_guest_openat() that makes it use
openat() instead of safe_openat(), so that it becomes usable from
gdbstub.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621203627.1808446-3-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-33-alex.bennee@linaro.org>
---
 linux-user/qemu.h    |  2 +-
 linux-user/syscall.c | 18 +++++++++++++-----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index a5830ec239..9b8e0860d7 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -166,7 +166,7 @@ typedef struct TaskState {
 
 abi_long do_brk(abi_ulong new_brk);
 int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
-                    int flags, mode_t mode);
+                    int flags, mode_t mode, bool safe);
 ssize_t do_guest_readlink(const char *pathname, char *buf, size_t bufsiz);
 
 /* user access */
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index fa83737192..ecd9f5e23d 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8449,7 +8449,7 @@ static int open_hardware(CPUArchState *cpu_env, int fd)
 #endif
 
 int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
-                    int flags, mode_t mode)
+                    int flags, mode_t mode, bool safe)
 {
     struct fake_open {
         const char *filename;
@@ -8476,7 +8476,11 @@ int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
     };
 
     if (is_proc_myself(pathname, "exe")) {
-        return safe_openat(dirfd, exec_path, flags, mode);
+        if (safe) {
+            return safe_openat(dirfd, exec_path, flags, mode);
+        } else {
+            return openat(dirfd, exec_path, flags, mode);
+        }
     }
 
     for (fake_open = fakes; fake_open->filename; fake_open++) {
@@ -8518,7 +8522,11 @@ int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
         return fd;
     }
 
-    return safe_openat(dirfd, path(pathname), flags, mode);
+    if (safe) {
+        return safe_openat(dirfd, path(pathname), flags, mode);
+    } else {
+        return openat(dirfd, path(pathname), flags, mode);
+    }
 }
 
 ssize_t do_guest_readlink(const char *pathname, char *buf, size_t bufsiz)
@@ -9027,7 +9035,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
             return -TARGET_EFAULT;
         ret = get_errno(do_guest_openat(cpu_env, AT_FDCWD, p,
                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
-                                  arg3));
+                                  arg3, true));
         fd_trans_unregister(ret);
         unlock_user(p, arg1, 0);
         return ret;
@@ -9037,7 +9045,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
             return -TARGET_EFAULT;
         ret = get_errno(do_guest_openat(cpu_env, arg1, p,
                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
-                                  arg4));
+                                  arg4, true));
         fd_trans_unregister(ret);
         unlock_user(p, arg2, 0);
         return ret;

From 77ae5761f3c9e6b68f8545cff06704f823c3d387 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:18 +0100
Subject: [PATCH 0383/1353] linux-user: Emulate /proc/self/smaps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

/proc/self/smaps is an extension of /proc/self/maps: it provides the
same lines, plus additional information about each range.

GDB uses /proc/self/smaps when available, which means that
generate-core-file tries it first before falling back to
/proc/self/maps. This, in turn, causes it to dump the host mappings,
since /proc/self/smaps is not emulated and is just passed through.

Fix by emulating /proc/self/smaps. Provide true values only for
Size, KernelPageSize, MMUPageSize and VmFlags. Leave all other values
at 0, which is a valid conservative estimate.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230621203627.1808446-4-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-34-alex.bennee@linaro.org>
---
 linux-user/syscall.c | 58 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 57 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ecd9f5e23d..08162cc966 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8042,7 +8042,36 @@ static int open_self_cmdline(CPUArchState *cpu_env, int fd)
     return 0;
 }
 
-static int open_self_maps(CPUArchState *cpu_env, int fd)
+static void show_smaps(int fd, unsigned long size)
+{
+    unsigned long page_size_kb = TARGET_PAGE_SIZE >> 10;
+    unsigned long size_kb = size >> 10;
+
+    dprintf(fd, "Size:                  %lu kB\n"
+                "KernelPageSize:        %lu kB\n"
+                "MMUPageSize:           %lu kB\n"
+                "Rss:                   0 kB\n"
+                "Pss:                   0 kB\n"
+                "Pss_Dirty:             0 kB\n"
+                "Shared_Clean:          0 kB\n"
+                "Shared_Dirty:          0 kB\n"
+                "Private_Clean:         0 kB\n"
+                "Private_Dirty:         0 kB\n"
+                "Referenced:            0 kB\n"
+                "Anonymous:             0 kB\n"
+                "LazyFree:              0 kB\n"
+                "AnonHugePages:         0 kB\n"
+                "ShmemPmdMapped:        0 kB\n"
+                "FilePmdMapped:         0 kB\n"
+                "Shared_Hugetlb:        0 kB\n"
+                "Private_Hugetlb:       0 kB\n"
+                "Swap:                  0 kB\n"
+                "SwapPss:               0 kB\n"
+                "Locked:                0 kB\n"
+                "THPeligible:    0\n", size_kb, page_size_kb, page_size_kb);
+}
+
+static int open_self_maps_1(CPUArchState *cpu_env, int fd, bool smaps)
 {
     CPUState *cpu = env_cpu(cpu_env);
     TaskState *ts = cpu->opaque;
@@ -8089,6 +8118,18 @@ static int open_self_maps(CPUArchState *cpu_env, int fd)
             } else {
                 dprintf(fd, "\n");
             }
+            if (smaps) {
+                show_smaps(fd, max - min);
+                dprintf(fd, "VmFlags:%s%s%s%s%s%s%s%s\n",
+                        (flags & PAGE_READ) ? " rd" : "",
+                        (flags & PAGE_WRITE_ORG) ? " wr" : "",
+                        (flags & PAGE_EXEC) ? " ex" : "",
+                        e->is_priv ? "" : " sh",
+                        (flags & PAGE_READ) ? " mr" : "",
+                        (flags & PAGE_WRITE_ORG) ? " mw" : "",
+                        (flags & PAGE_EXEC) ? " me" : "",
+                        e->is_priv ? "" : " ms");
+            }
         }
     }
 
@@ -8103,11 +8144,25 @@ static int open_self_maps(CPUArchState *cpu_env, int fd)
                     " --xp 00000000 00:00 0",
                     TARGET_VSYSCALL_PAGE, TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE);
     dprintf(fd, "%*s%s\n", 73 - count, "",  "[vsyscall]");
+    if (smaps) {
+        show_smaps(fd, TARGET_PAGE_SIZE);
+        dprintf(fd, "VmFlags: ex\n");
+    }
 #endif
 
     return 0;
 }
 
+static int open_self_maps(CPUArchState *cpu_env, int fd)
+{
+    return open_self_maps_1(cpu_env, fd, false);
+}
+
+static int open_self_smaps(CPUArchState *cpu_env, int fd)
+{
+    return open_self_maps_1(cpu_env, fd, true);
+}
+
 static int open_self_stat(CPUArchState *cpu_env, int fd)
 {
     CPUState *cpu = env_cpu(cpu_env);
@@ -8459,6 +8514,7 @@ int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
     const struct fake_open *fake_open;
     static const struct fake_open fakes[] = {
         { "maps", open_self_maps, is_proc_myself },
+        { "smaps", open_self_smaps, is_proc_myself },
         { "stat", open_self_stat, is_proc_myself },
         { "auxv", open_self_auxv, is_proc_myself },
         { "cmdline", open_self_cmdline, is_proc_myself },

From a3fcc111fa2bd8333f53883efb41d539d95b3cd0 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:19 +0100
Subject: [PATCH 0384/1353] gdbstub: Expose gdb_get_process() and
 gdb_get_first_cpu_in_process()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These functions will be needed by user-target.c in order to retrieve
the name of the executable.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230621203627.1808446-5-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-35-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c   | 16 ++++++++--------
 gdbstub/internals.h |  2 ++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 49143c7d83..ce3e4a2671 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -211,7 +211,7 @@ static uint32_t gdb_get_cpu_pid(CPUState *cpu)
     return cpu->cluster_index + 1;
 }
 
-static GDBProcess *gdb_get_process(uint32_t pid)
+GDBProcess *gdb_get_process(uint32_t pid)
 {
     int i;
 
@@ -247,7 +247,7 @@ static CPUState *find_cpu(uint32_t thread_id)
     return NULL;
 }
 
-static CPUState *get_first_cpu_in_process(GDBProcess *process)
+CPUState *gdb_get_first_cpu_in_process(GDBProcess *process)
 {
     CPUState *cpu;
 
@@ -325,7 +325,7 @@ static CPUState *gdb_get_cpu(uint32_t pid, uint32_t tid)
             return NULL;
         }
 
-        return get_first_cpu_in_process(process);
+        return gdb_get_first_cpu_in_process(process);
     } else {
         /* a specific thread */
         cpu = find_cpu(tid);
@@ -354,7 +354,7 @@ static const char *get_feature_xml(const char *p, const char **newp,
     size_t len;
     int i;
     const char *name;
-    CPUState *cpu = get_first_cpu_in_process(process);
+    CPUState *cpu = gdb_get_first_cpu_in_process(process);
     CPUClass *cc = CPU_GET_CLASS(cpu);
 
     len = 0;
@@ -490,7 +490,7 @@ void gdb_register_coprocessor(CPUState *cpu,
 
 static void gdb_process_breakpoint_remove_all(GDBProcess *p)
 {
-    CPUState *cpu = get_first_cpu_in_process(p);
+    CPUState *cpu = gdb_get_first_cpu_in_process(p);
 
     while (cpu) {
         gdb_breakpoint_remove_all(cpu);
@@ -647,7 +647,7 @@ static int gdb_handle_vcont(const char *p)
                 return -EINVAL;
             }
 
-            cpu = get_first_cpu_in_process(process);
+            cpu = gdb_get_first_cpu_in_process(process);
             while (cpu) {
                 if (newstates[cpu->cpu_index] == 1) {
                     newstates[cpu->cpu_index] = cur_action;
@@ -1270,7 +1270,7 @@ static void handle_v_attach(GArray *params, void *user_ctx)
         goto cleanup;
     }
 
-    cpu = get_first_cpu_in_process(process);
+    cpu = gdb_get_first_cpu_in_process(process);
     if (!cpu) {
         goto cleanup;
     }
@@ -1393,7 +1393,7 @@ static void handle_query_curr_tid(GArray *params, void *user_ctx)
      * first thread).
      */
     process = gdb_get_cpu_process(gdbserver_state.g_cpu);
-    cpu = get_first_cpu_in_process(process);
+    cpu = gdb_get_first_cpu_in_process(process);
     g_string_assign(gdbserver_state.str_buf, "QC");
     gdb_append_thread_id(cpu, gdbserver_state.str_buf);
     gdb_put_strbuf();
diff --git a/gdbstub/internals.h b/gdbstub/internals.h
index 33d21d6488..25e4d5eeaa 100644
--- a/gdbstub/internals.h
+++ b/gdbstub/internals.h
@@ -129,6 +129,8 @@ void gdb_read_byte(uint8_t ch);
  */
 bool gdb_got_immediate_ack(void);
 /* utility helpers */
+GDBProcess *gdb_get_process(uint32_t pid);
+CPUState *gdb_get_first_cpu_in_process(GDBProcess *process);
 CPUState *gdb_first_attached_cpu(void);
 void gdb_append_thread_id(CPUState *cpu, GString *buf);
 int gdb_get_cpu_index(CPUState *cpu);

From dc14a7a6e95571122ec2428abb355fe2c43e05c6 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:20 +0100
Subject: [PATCH 0385/1353] gdbstub: Report the actual qemu-user pid
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently qemu-user reports pid 1 to GDB. Resolve the TODO and report
the actual PID. Using getpid() relies on the assumption that there is
only one GDBProcess. Add an assertion to make sure that future changes
don't break it.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230621203627.1808446-6-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-36-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index ce3e4a2671..697dd4bbad 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -202,13 +202,16 @@ void gdb_memtox(GString *buf, const char *mem, int len)
 
 static uint32_t gdb_get_cpu_pid(CPUState *cpu)
 {
-    /* TODO: In user mode, we should use the task state PID */
+#ifdef CONFIG_USER_ONLY
+    return getpid();
+#else
     if (cpu->cluster_index == UNASSIGNED_CLUSTER_INDEX) {
         /* Return the default process' PID */
         int index = gdbserver_state.process_num - 1;
         return gdbserver_state.processes[index].pid;
     }
     return cpu->cluster_index + 1;
+#endif
 }
 
 GDBProcess *gdb_get_process(uint32_t pid)
@@ -2137,19 +2140,25 @@ void gdb_read_byte(uint8_t ch)
 void gdb_create_default_process(GDBState *s)
 {
     GDBProcess *process;
-    int max_pid = 0;
+    int pid;
 
+#ifdef CONFIG_USER_ONLY
+    assert(gdbserver_state.process_num == 0);
+    pid = getpid();
+#else
     if (gdbserver_state.process_num) {
-        max_pid = s->processes[s->process_num - 1].pid;
+        pid = s->processes[s->process_num - 1].pid;
+    } else {
+        pid = 0;
     }
+    /* We need an available PID slot for this process */
+    assert(pid < UINT32_MAX);
+    pid++;
+#endif
 
     s->processes = g_renew(GDBProcess, s->processes, ++s->process_num);
     process = &s->processes[s->process_num - 1];
-
-    /* We need an available PID slot for this process */
-    assert(max_pid < UINT32_MAX);
-
-    process->pid = max_pid + 1;
+    process->pid = pid;
     process->attached = false;
     process->target_xml[0] = '\0';
 }

From e282010b2e1e34e1579c933cadf278833d527812 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:21 +0100
Subject: [PATCH 0386/1353] gdbstub: Add support for info proc mappings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the GDB's generate-core-file command doesn't work well with
qemu-user: the resulting dumps are huge [1] and at the same time
incomplete (argv and envp are missing). The reason is that GDB has no
access to proc mappings and therefore has to fall back to using
heuristics for discovering them. This is, in turn, because qemu-user
does not implement the Host I/O feature of the GDB Remote Serial
Protocol.

Implement vFile:{open,close,pread,readlink} and also
qXfer:exec-file:read+. With that, generate-core-file begins to work on
aarch64 and s390x.

[1] https://sourceware.org/pipermail/gdb-patches/2023-May/199432.html

Co-developed-by: Dominik 'Disconnect3d' Czarnota <dominik.b.czarnota@gmail.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230621203627.1808446-7-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-37-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c     |  45 +++++++++++++-
 gdbstub/internals.h   |   5 ++
 gdbstub/user-target.c | 137 ++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 185 insertions(+), 2 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 697dd4bbad..6911b73c07 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -1327,6 +1327,36 @@ static const GdbCmdParseEntry gdb_v_commands_table[] = {
         .cmd = "Kill;",
         .cmd_startswith = 1
     },
+#ifdef CONFIG_USER_ONLY
+    /*
+     * Host I/O Packets. See [1] for details.
+     * [1] https://sourceware.org/gdb/onlinedocs/gdb/Host-I_002fO-Packets.html
+     */
+    {
+        .handler = gdb_handle_v_file_open,
+        .cmd = "File:open:",
+        .cmd_startswith = 1,
+        .schema = "s,L,L0"
+    },
+    {
+        .handler = gdb_handle_v_file_close,
+        .cmd = "File:close:",
+        .cmd_startswith = 1,
+        .schema = "l0"
+    },
+    {
+        .handler = gdb_handle_v_file_pread,
+        .cmd = "File:pread:",
+        .cmd_startswith = 1,
+        .schema = "l,L,L0"
+    },
+    {
+        .handler = gdb_handle_v_file_readlink,
+        .cmd = "File:readlink:",
+        .cmd_startswith = 1,
+        .schema = "s0"
+    },
+#endif
 };
 
 static void handle_v_commands(GArray *params, void *user_ctx)
@@ -1472,11 +1502,14 @@ static void handle_query_supported(GArray *params, void *user_ctx)
             ";ReverseStep+;ReverseContinue+");
     }
 
-#if defined(CONFIG_USER_ONLY) && defined(CONFIG_LINUX)
+#if defined(CONFIG_USER_ONLY)
+#if defined(CONFIG_LINUX)
     if (gdbserver_state.c_cpu->opaque) {
         g_string_append(gdbserver_state.str_buf, ";qXfer:auxv:read+");
     }
 #endif
+    g_string_append(gdbserver_state.str_buf, ";qXfer:exec-file:read+");
+#endif
 
     if (params->len &&
         strstr(get_param(params, 0)->data, "multiprocess+")) {
@@ -1615,13 +1648,21 @@ static const GdbCmdParseEntry gdb_gen_query_table[] = {
         .cmd_startswith = 1,
         .schema = "s:l,l0"
     },
-#if defined(CONFIG_USER_ONLY) && defined(CONFIG_LINUX)
+#if defined(CONFIG_USER_ONLY)
+#if defined(CONFIG_LINUX)
     {
         .handler = gdb_handle_query_xfer_auxv,
         .cmd = "Xfer:auxv:read::",
         .cmd_startswith = 1,
         .schema = "l,l0"
     },
+#endif
+    {
+        .handler = gdb_handle_query_xfer_exec_file,
+        .cmd = "Xfer:exec-file:read:",
+        .cmd_startswith = 1,
+        .schema = "l:l,l0"
+    },
 #endif
     {
         .handler = gdb_handle_query_attached,
diff --git a/gdbstub/internals.h b/gdbstub/internals.h
index 25e4d5eeaa..f2b46cce41 100644
--- a/gdbstub/internals.h
+++ b/gdbstub/internals.h
@@ -189,6 +189,11 @@ typedef union GdbCmdVariant {
 void gdb_handle_query_rcmd(GArray *params, void *user_ctx); /* softmmu */
 void gdb_handle_query_offsets(GArray *params, void *user_ctx); /* user */
 void gdb_handle_query_xfer_auxv(GArray *params, void *user_ctx); /*user */
+void gdb_handle_v_file_open(GArray *params, void *user_ctx); /* user */
+void gdb_handle_v_file_close(GArray *params, void *user_ctx); /* user */
+void gdb_handle_v_file_pread(GArray *params, void *user_ctx); /* user */
+void gdb_handle_v_file_readlink(GArray *params, void *user_ctx); /* user */
+void gdb_handle_query_xfer_exec_file(GArray *params, void *user_ctx); /* user */
 
 void gdb_handle_query_attached(GArray *params, void *user_ctx); /* both */
 
diff --git a/gdbstub/user-target.c b/gdbstub/user-target.c
index fa0e59ec9a..6e21c3161c 100644
--- a/gdbstub/user-target.c
+++ b/gdbstub/user-target.c
@@ -11,6 +11,10 @@
 #include "exec/gdbstub.h"
 #include "qemu.h"
 #include "internals.h"
+#ifdef CONFIG_LINUX
+#include "linux-user/loader.h"
+#include "linux-user/qemu.h"
+#endif
 
 /*
  * Map target signal numbers to GDB protocol signal numbers and vice
@@ -281,3 +285,136 @@ void gdb_handle_query_xfer_auxv(GArray *params, void *user_ctx)
                       gdbserver_state.str_buf->len, true);
 }
 #endif
+
+static const char *get_filename_param(GArray *params, int i)
+{
+    const char *hex_filename = get_param(params, i)->data;
+    gdb_hextomem(gdbserver_state.mem_buf, hex_filename,
+                 strlen(hex_filename) / 2);
+    g_byte_array_append(gdbserver_state.mem_buf, (const guint8 *)"", 1);
+    return (const char *)gdbserver_state.mem_buf->data;
+}
+
+static void hostio_reply_with_data(const void *buf, size_t n)
+{
+    g_string_printf(gdbserver_state.str_buf, "F%zx;", n);
+    gdb_memtox(gdbserver_state.str_buf, buf, n);
+    gdb_put_packet_binary(gdbserver_state.str_buf->str,
+                          gdbserver_state.str_buf->len, true);
+}
+
+void gdb_handle_v_file_open(GArray *params, void *user_ctx)
+{
+    const char *filename = get_filename_param(params, 0);
+    uint64_t flags = get_param(params, 1)->val_ull;
+    uint64_t mode = get_param(params, 2)->val_ull;
+
+#ifdef CONFIG_LINUX
+    int fd = do_guest_openat(gdbserver_state.g_cpu->env_ptr, 0, filename,
+                             flags, mode, false);
+#else
+    int fd = open(filename, flags, mode);
+#endif
+    if (fd < 0) {
+        g_string_printf(gdbserver_state.str_buf, "F-1,%d", errno);
+    } else {
+        g_string_printf(gdbserver_state.str_buf, "F%d", fd);
+    }
+    gdb_put_strbuf();
+}
+
+void gdb_handle_v_file_close(GArray *params, void *user_ctx)
+{
+    int fd = get_param(params, 0)->val_ul;
+
+    if (close(fd) == -1) {
+        g_string_printf(gdbserver_state.str_buf, "F-1,%d", errno);
+        gdb_put_strbuf();
+        return;
+    }
+
+    gdb_put_packet("F00");
+}
+
+void gdb_handle_v_file_pread(GArray *params, void *user_ctx)
+{
+    int fd = get_param(params, 0)->val_ul;
+    size_t count = get_param(params, 1)->val_ull;
+    off_t offset = get_param(params, 2)->val_ull;
+
+    size_t bufsiz = MIN(count, BUFSIZ);
+    g_autofree char *buf = g_try_malloc(bufsiz);
+    if (buf == NULL) {
+        gdb_put_packet("E12");
+        return;
+    }
+
+    ssize_t n = pread(fd, buf, bufsiz, offset);
+    if (n < 0) {
+        g_string_printf(gdbserver_state.str_buf, "F-1,%d", errno);
+        gdb_put_strbuf();
+        return;
+    }
+    hostio_reply_with_data(buf, n);
+}
+
+void gdb_handle_v_file_readlink(GArray *params, void *user_ctx)
+{
+    const char *filename = get_filename_param(params, 0);
+
+    g_autofree char *buf = g_try_malloc(BUFSIZ);
+    if (buf == NULL) {
+        gdb_put_packet("E12");
+        return;
+    }
+
+#ifdef CONFIG_LINUX
+    ssize_t n = do_guest_readlink(filename, buf, BUFSIZ);
+#else
+    ssize_t n = readlink(filename, buf, BUFSIZ);
+#endif
+    if (n < 0) {
+        g_string_printf(gdbserver_state.str_buf, "F-1,%d", errno);
+        gdb_put_strbuf();
+        return;
+    }
+    hostio_reply_with_data(buf, n);
+}
+
+void gdb_handle_query_xfer_exec_file(GArray *params, void *user_ctx)
+{
+    uint32_t pid = get_param(params, 0)->val_ul;
+    uint32_t offset = get_param(params, 1)->val_ul;
+    uint32_t length = get_param(params, 2)->val_ul;
+
+    GDBProcess *process = gdb_get_process(pid);
+    if (!process) {
+        gdb_put_packet("E00");
+        return;
+    }
+
+    CPUState *cpu = gdb_get_first_cpu_in_process(process);
+    if (!cpu) {
+        gdb_put_packet("E00");
+        return;
+    }
+
+    TaskState *ts = cpu->opaque;
+    if (!ts || !ts->bprm || !ts->bprm->filename) {
+        gdb_put_packet("E00");
+        return;
+    }
+
+    size_t total_length = strlen(ts->bprm->filename);
+    if (offset > total_length) {
+        gdb_put_packet("E00");
+        return;
+    }
+    if (offset + length > total_length) {
+        length = total_length - offset;
+    }
+
+    g_string_printf(gdbserver_state.str_buf, "l%.*s", length,
+                    ts->bprm->filename + offset);
+    gdb_put_strbuf();
+}

From abf7ba310b7b0c13b4fe936621bbb8e416754c0c Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:22 +0100
Subject: [PATCH 0387/1353] docs: Document security implications of debugging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the GDB stub explicitly implements reading host files (note
that it was already possible by changing the emulated code to open and
read those files), concerns may arise that it undermines security.

Document the status quo, which is that the users are already
responsible for securing the GDB connection themselves.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230621203627.1808446-8-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-38-alex.bennee@linaro.org>
---
 docs/system/gdb.rst | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/docs/system/gdb.rst b/docs/system/gdb.rst
index 7d3718deef..9906991b84 100644
--- a/docs/system/gdb.rst
+++ b/docs/system/gdb.rst
@@ -214,3 +214,18 @@ The memory mode can be checked by sending the following command:
 
 ``maintenance packet Qqemu.PhyMemMode:0``
     This will change it back to normal memory mode.
+
+Security considerations
+=======================
+
+Connecting to the GDB socket allows running arbitrary code inside the guest;
+in case of the TCG emulation, which is not considered a security boundary, this
+also means running arbitrary code on the host. Additionally, when debugging
+qemu-user, it allows directly downloading any file readable by QEMU from the
+host.
+
+The GDB socket is not protected by authentication, authorization or encryption.
+It is therefore a responsibility of the user to make sure that only authorized
+clients can connect to it, e.g., by using a unix socket with proper
+permissions, or by opening a TCP socket only on interfaces that are not
+reachable by potential attackers.

From a6341482695e1d15f11915f12dba98724efb0697 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 30 Jun 2023 19:04:23 +0100
Subject: [PATCH 0388/1353] tests/tcg: Add a test for info proc mappings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230621203627.1808446-9-iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230630180423.558337-39-alex.bennee@linaro.org>
---
 tests/tcg/multiarch/Makefile.target           |  9 ++-
 .../multiarch/gdbstub/test-proc-mappings.py   | 65 +++++++++++++++++++
 2 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/multiarch/gdbstub/test-proc-mappings.py

diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index 373db69648..43bddeaf21 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -81,6 +81,13 @@ run-gdbstub-qxfer-auxv-read: sha1
 		--bin $< --test $(MULTIARCH_SRC)/gdbstub/test-qxfer-auxv-read.py, \
 	basic gdbstub qXfer:auxv:read support)
 
+run-gdbstub-proc-mappings: sha1
+	$(call run-test, $@, $(GDB_SCRIPT) \
+		--gdb $(HAVE_GDB_BIN) \
+		--qemu $(QEMU) --qargs "$(QEMU_OPTS)" \
+		--bin $< --test $(MULTIARCH_SRC)/gdbstub/test-proc-mappings.py, \
+	proc mappings support)
+
 run-gdbstub-thread-breakpoint: testthread
 	$(call run-test, $@, $(GDB_SCRIPT) \
 		--gdb $(HAVE_GDB_BIN) \
@@ -97,7 +104,7 @@ run-gdbstub-%:
 	$(call skip-test, "gdbstub test $*", "need working gdb")
 endif
 EXTRA_RUNS += run-gdbstub-sha1 run-gdbstub-qxfer-auxv-read \
-	      run-gdbstub-thread-breakpoint
+	      run-gdbstub-proc-mappings run-gdbstub-thread-breakpoint
 
 # ARM Compatible Semi Hosting Tests
 #
diff --git a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
new file mode 100644
index 0000000000..7b596ac21b
--- /dev/null
+++ b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
@@ -0,0 +1,65 @@
+"""Test that gdbstub has access to proc mappings.
+
+This runs as a sourced script (via -x, via run-test.py)."""
+from __future__ import print_function
+import gdb
+import sys
+
+
+n_failures = 0
+
+
+def report(cond, msg):
+    """Report success/fail of a test"""
+    if cond:
+        print("PASS: {}".format(msg))
+    else:
+        print("FAIL: {}".format(msg))
+        global n_failures
+        n_failures += 1
+
+
+def run_test():
+    """Run through the tests one by one"""
+    try:
+        mappings = gdb.execute("info proc mappings", False, True)
+    except gdb.error as exc:
+        exc_str = str(exc)
+        if "Not supported on this target." in exc_str:
+            # Detect failures due to an outstanding issue with how GDB handles
+            # the x86_64 QEMU's target.xml, which does not contain the
+            # definition of orig_rax. Skip the test in this case.
+            print("SKIP: {}".format(exc_str))
+            return
+        raise
+    report(isinstance(mappings, str), "Fetched the mappings from the inferior")
+    report("/sha1" in mappings, "Found the test binary name in the mappings")
+
+
+def main():
+    """Prepare the environment and run through the tests"""
+    try:
+        inferior = gdb.selected_inferior()
+        print("ATTACHED: {}".format(inferior.architecture().name()))
+    except (gdb.error, AttributeError):
+        print("SKIPPING (not connected)")
+        exit(0)
+
+    if gdb.parse_and_eval('$pc') == 0:
+        print("SKIP: PC not set")
+        exit(0)
+
+    try:
+        # These are not very useful in scripts
+        gdb.execute("set pagination off")
+        gdb.execute("set confirm off")
+
+        # Run the actual tests
+        run_test()
+    except gdb.error:
+        report(False, "GDB Exception: {}".format(sys.exc_info()[0]))
+    print("All tests complete: %d failures" % n_failures)
+    exit(n_failures)
+
+
+main()

From 587f8b333c8c66e8f3e54fe30ea8e88cc7d29d21 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 4 Jul 2023 14:08:47 +0100
Subject: [PATCH 0389/1353] target/arm: Add raw_writes ops for register whose
 write induce TLB maintenance

Some registers whose 'cooked' writefns induce TLB maintenance do
not have raw_writefn ops defined. If only the writefn ops is set
(ie. no raw_writefn is provided), it is assumed the cooked also
work as the raw one. For those registers it is not obvious the
tlb_flush works on KVM mode so better/safer setting the raw write.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index d08c058e42..a0b84efab5 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4189,14 +4189,14 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_TTBR0_EL1,
-      .writefn = vmsa_ttbr_write, .resetvalue = 0,
+      .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
                              offsetof(CPUARMState, cp15.ttbr0_ns) } },
     { .name = "TTBR1_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 1,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_TTBR1_EL1,
-      .writefn = vmsa_ttbr_write, .resetvalue = 0,
+      .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
                              offsetof(CPUARMState, cp15.ttbr1_ns) } },
     { .name = "TCR_EL1", .state = ARM_CP_STATE_AA64,
@@ -4456,13 +4456,13 @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
                              offsetof(CPUARMState, cp15.ttbr0_ns) },
-      .writefn = vmsa_ttbr_write, },
+      .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
     { .name = "TTBR1", .cp = 15, .crm = 2, .opc1 = 1,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
                              offsetof(CPUARMState, cp15.ttbr1_ns) },
-      .writefn = vmsa_ttbr_write, },
+      .writefn = vmsa_ttbr_write, .raw_writefn = raw_write },
 };
 
 static uint64_t aa64_fpcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -5911,7 +5911,7 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .type = ARM_CP_IO,
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
-      .writefn = hcr_write },
+      .writefn = hcr_write, .raw_writefn = raw_write },
     { .name = "HCR", .state = ARM_CP_STATE_AA32,
       .type = ARM_CP_ALIAS | ARM_CP_IO,
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
@@ -5983,6 +5983,7 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
       .access = PL2_RW, .writefn = vmsa_tcr_el12_write,
+      .raw_writefn = raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.tcr_el[2]) },
     { .name = "VTCR", .state = ARM_CP_STATE_AA32,
       .cp = 15, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
@@ -5999,10 +6000,10 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .type = ARM_CP_64BIT | ARM_CP_ALIAS,
       .access = PL2_RW, .accessfn = access_el3_aa32ns,
       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2),
-      .writefn = vttbr_write },
+      .writefn = vttbr_write, .raw_writefn = raw_write },
     { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
-      .access = PL2_RW, .writefn = vttbr_write,
+      .access = PL2_RW, .writefn = vttbr_write, .raw_writefn = raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.vttbr_el2) },
     { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
@@ -6014,7 +6015,8 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.tpidr_el[2]) },
     { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
-      .access = PL2_RW, .resetvalue = 0, .writefn = vmsa_tcr_ttbr_el2_write,
+      .access = PL2_RW, .resetvalue = 0,
+      .writefn = vmsa_tcr_ttbr_el2_write, .raw_writefn = raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el[2]) },
     { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
       .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_ALIAS,
@@ -6201,12 +6203,12 @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
     { .name = "SCR_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
-      .resetfn = scr_reset, .writefn = scr_write },
+      .resetfn = scr_reset, .writefn = scr_write, .raw_writefn = raw_write },
     { .name = "SCR",  .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
       .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
-      .writefn = scr_write },
+      .writefn = scr_write, .raw_writefn = raw_write },
     { .name = "SDER32_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 1,
       .access = PL3_RW, .resetvalue = 0,
@@ -7927,6 +7929,7 @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1,
       .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write,
+      .raw_writefn = raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.ttbr1_el[2]) },
 #ifndef CONFIG_USER_ONLY
     { .name = "CNTHV_CVAL_EL2", .state = ARM_CP_STATE_AA64,

From 62c2b8760b8ec9316ea4f5f4c2ce2fdaed1359ee Mon Sep 17 00:00:00 2001
From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
Date: Tue, 4 Jul 2023 14:08:47 +0100
Subject: [PATCH 0390/1353] hw/arm/sbsa-ref: use XHCI to replace EHCI

The current sbsa-ref cannot use EHCI controller which is only
able to do 32-bit DMA, since sbsa-ref doesn't have RAM below 4GB.
Hence, this uses XHCI to provide a usb controller with 64-bit
DMA capablity instead of EHCI.

We bump the platform version to 0.3 with this change.  Although the
hardware at the USB controller address changes, the firmware and
Linux can both cope with this -- on an older non-XHCI-aware
firmware/kernel setup the probe routine simply fails and the guest
proceeds without any USB.  (This isn't a loss of functionality,
because the old USB controller never worked in the first place.) So
we can call this a backwards-compatible change and only bump the
minor version.

Signed-off-by: Yuquan Wang <wangyuquan1236@phytium.com.cn>
Message-id: 20230621103847.447508-2-wangyuquan1236@phytium.com.cn
[PMM: tweaked commit message; add line to docs about what
 changes in platform version 0.3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst |  5 ++++-
 hw/arm/Kconfig           |  2 +-
 hw/arm/sbsa-ref.c        | 23 +++++++++++++----------
 3 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
index a8e0b530a2..bca61608ff 100644
--- a/docs/system/arm/sbsa.rst
+++ b/docs/system/arm/sbsa.rst
@@ -19,7 +19,7 @@ The ``sbsa-ref`` board supports:
   - A configurable number of AArch64 CPUs
   - GIC version 3
   - System bus AHCI controller
-  - System bus EHCI controller
+  - System bus XHCI controller
   - CDROM and hard disc on AHCI bus
   - E1000E ethernet card on PCIe bus
   - Bochs display adapter on PCIe bus
@@ -68,3 +68,6 @@ Platform version changes:
 
 0.2
   GIC ITS information is present in devicetree.
+
+0.3
+  The USB controller is an XHCI device, not EHCI
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 7de17d1e8c..7e68348440 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -266,7 +266,7 @@ config SBSA_REF
     select PL011 # UART
     select PL031 # RTC
     select PL061 # GPIO
-    select USB_EHCI_SYSBUS
+    select USB_XHCI_SYSBUS
     select WDT_SBSA
     select BOCHS_DISPLAY
 
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 82a28b2e0b..1a8519b868 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -42,6 +42,7 @@
 #include "hw/pci-host/gpex.h"
 #include "hw/qdev-properties.h"
 #include "hw/usb.h"
+#include "hw/usb/xhci.h"
 #include "hw/char/pl011.h"
 #include "hw/watchdog/sbsa_gwdt.h"
 #include "net/net.h"
@@ -85,7 +86,7 @@ enum {
     SBSA_SECURE_UART_MM,
     SBSA_SECURE_MEM,
     SBSA_AHCI,
-    SBSA_EHCI,
+    SBSA_XHCI,
 };
 
 struct SBSAMachineState {
@@ -123,7 +124,7 @@ static const MemMapEntry sbsa_ref_memmap[] = {
     [SBSA_SMMU] =               { 0x60050000, 0x00020000 },
     /* Space here reserved for more SMMUs */
     [SBSA_AHCI] =               { 0x60100000, 0x00010000 },
-    [SBSA_EHCI] =               { 0x60110000, 0x00010000 },
+    [SBSA_XHCI] =               { 0x60110000, 0x00010000 },
     /* Space here reserved for other devices */
     [SBSA_PCIE_PIO] =           { 0x7fff0000, 0x00010000 },
     /* 32-bit address PCIE MMIO space */
@@ -143,7 +144,7 @@ static const int sbsa_ref_irqmap[] = {
     [SBSA_SECURE_UART] = 8,
     [SBSA_SECURE_UART_MM] = 9,
     [SBSA_AHCI] = 10,
-    [SBSA_EHCI] = 11,
+    [SBSA_XHCI] = 11,
     [SBSA_SMMU] = 12, /* ... to 15 */
     [SBSA_GWDT_WS0] = 16,
 };
@@ -230,7 +231,7 @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 2);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 3);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -604,13 +605,15 @@ static void create_ahci(const SBSAMachineState *sms)
     }
 }
 
-static void create_ehci(const SBSAMachineState *sms)
+static void create_xhci(const SBSAMachineState *sms)
 {
-    hwaddr base = sbsa_ref_memmap[SBSA_EHCI].base;
-    int irq = sbsa_ref_irqmap[SBSA_EHCI];
+    hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
+    int irq = sbsa_ref_irqmap[SBSA_XHCI];
+    DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
 
-    sysbus_create_simple("platform-ehci-usb", base,
-                         qdev_get_gpio_in(sms->gic, irq));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(sms->gic, irq));
 }
 
 static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
@@ -832,7 +835,7 @@ static void sbsa_ref_init(MachineState *machine)
 
     create_ahci(sms);
 
-    create_ehci(sms);
+    create_xhci(sms);
 
     create_pcie(sms);
 

From c21eae1ccc782440f320accb6f90c66cb8f45ee9 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 4 Jul 2023 14:34:36 +0200
Subject: [PATCH 0391/1353] block/blkio: fix module_block.py parsing

When QEMU is built with --enable-modules, the module_block.py script
parses block/*.c to find block drivers that are built as modules. The
script generates a table of block drivers called block_driver_modules[].
This table is used for block driver module loading.

The blkio.c driver uses macros to define its BlockDriver structs. This
was done to avoid code duplication but the module_block.py script is
unable to parse the macro. The result is that libblkio-based block
drivers can be built as modules but will not be found at runtime.

One fix is to make the module_block.py script or build system fancier so
it can parse C macros (e.g. by parsing the preprocessed source code). I
chose not to do this because it raises the complexity of the build,
making future issues harder to debug.

Keep things simple: use the macro to avoid duplicating BlockDriver
function pointers but define .format_name and .protocol_name manually
for each BlockDriver. This way the module_block.py is able to parse the
code.

Also get rid of the block driver name macros (e.g. DRIVER_IO_URING)
because module_block.py cannot parse them either.

Fixes: fd66dbd424f5 ("blkio: add libblkio block driver")
Reported-by: Qing Wang <qinwang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230704123436.187761-1-stefanha@redhat.com
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 108 ++++++++++++++++++++++++++------------------------
 1 file changed, 56 insertions(+), 52 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index 527323d625..1798648134 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -22,16 +22,6 @@
 
 #include "block/block-io.h"
 
-/*
- * Keep the QEMU BlockDriver names identical to the libblkio driver names.
- * Using macros instead of typing out the string literals avoids typos.
- */
-#define DRIVER_IO_URING "io_uring"
-#define DRIVER_NVME_IO_URING "nvme-io_uring"
-#define DRIVER_VIRTIO_BLK_VFIO_PCI "virtio-blk-vfio-pci"
-#define DRIVER_VIRTIO_BLK_VHOST_USER "virtio-blk-vhost-user"
-#define DRIVER_VIRTIO_BLK_VHOST_VDPA "virtio-blk-vhost-vdpa"
-
 /*
  * Allocated bounce buffers are kept in a list sorted by buffer address.
  */
@@ -744,15 +734,15 @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 
-    if (strcmp(blkio_driver, DRIVER_IO_URING) == 0) {
+    if (strcmp(blkio_driver, "io_uring") == 0) {
         ret = blkio_io_uring_open(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, DRIVER_NVME_IO_URING) == 0) {
+    } else if (strcmp(blkio_driver, "nvme-io_uring") == 0) {
         ret = blkio_nvme_io_uring(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VFIO_PCI) == 0) {
+    } else if (strcmp(blkio_driver, "virtio-blk-vfio-pci") == 0) {
         ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_USER) == 0) {
+    } else if (strcmp(blkio_driver, "virtio-blk-vhost-user") == 0) {
         ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_VDPA) == 0) {
+    } else if (strcmp(blkio_driver, "virtio-blk-vhost-vdpa") == 0) {
         ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
     } else {
         g_assert_not_reached();
@@ -1028,49 +1018,63 @@ static void blkio_refresh_limits(BlockDriverState *bs, Error **errp)
  * - truncate
  */
 
-#define BLKIO_DRIVER(name, ...) \
-    { \
-        .format_name             = name, \
-        .protocol_name           = name, \
-        .instance_size           = sizeof(BDRVBlkioState), \
-        .bdrv_file_open          = blkio_file_open, \
-        .bdrv_close              = blkio_close, \
-        .bdrv_co_getlength       = blkio_co_getlength, \
-        .bdrv_co_truncate        = blkio_truncate, \
-        .bdrv_co_get_info        = blkio_co_get_info, \
-        .bdrv_attach_aio_context = blkio_attach_aio_context, \
-        .bdrv_detach_aio_context = blkio_detach_aio_context, \
-        .bdrv_co_pdiscard        = blkio_co_pdiscard, \
-        .bdrv_co_preadv          = blkio_co_preadv, \
-        .bdrv_co_pwritev         = blkio_co_pwritev, \
-        .bdrv_co_flush_to_disk   = blkio_co_flush, \
-        .bdrv_co_pwrite_zeroes   = blkio_co_pwrite_zeroes, \
-        .bdrv_refresh_limits     = blkio_refresh_limits, \
-        .bdrv_register_buf       = blkio_register_buf, \
-        .bdrv_unregister_buf     = blkio_unregister_buf, \
-        __VA_ARGS__ \
-    }
+/*
+ * Do not include .format_name and .protocol_name because module_block.py
+ * does not parse macros in the source code.
+ */
+#define BLKIO_DRIVER_COMMON \
+    .instance_size           = sizeof(BDRVBlkioState), \
+    .bdrv_file_open          = blkio_file_open, \
+    .bdrv_close              = blkio_close, \
+    .bdrv_co_getlength       = blkio_co_getlength, \
+    .bdrv_co_truncate        = blkio_truncate, \
+    .bdrv_co_get_info        = blkio_co_get_info, \
+    .bdrv_attach_aio_context = blkio_attach_aio_context, \
+    .bdrv_detach_aio_context = blkio_detach_aio_context, \
+    .bdrv_co_pdiscard        = blkio_co_pdiscard, \
+    .bdrv_co_preadv          = blkio_co_preadv, \
+    .bdrv_co_pwritev         = blkio_co_pwritev, \
+    .bdrv_co_flush_to_disk   = blkio_co_flush, \
+    .bdrv_co_pwrite_zeroes   = blkio_co_pwrite_zeroes, \
+    .bdrv_refresh_limits     = blkio_refresh_limits, \
+    .bdrv_register_buf       = blkio_register_buf, \
+    .bdrv_unregister_buf     = blkio_unregister_buf,
 
-static BlockDriver bdrv_io_uring = BLKIO_DRIVER(
-    DRIVER_IO_URING,
+/*
+ * Use the same .format_name and .protocol_name as the libblkio driver name for
+ * consistency.
+ */
+
+static BlockDriver bdrv_io_uring = {
+    .format_name         = "io_uring",
+    .protocol_name       = "io_uring",
     .bdrv_needs_filename = true,
-);
+    BLKIO_DRIVER_COMMON
+};
 
-static BlockDriver bdrv_nvme_io_uring = BLKIO_DRIVER(
-    DRIVER_NVME_IO_URING,
-);
+static BlockDriver bdrv_nvme_io_uring = {
+    .format_name         = "nvme-io_uring",
+    .protocol_name       = "nvme-io_uring",
+    BLKIO_DRIVER_COMMON
+};
 
-static BlockDriver bdrv_virtio_blk_vfio_pci = BLKIO_DRIVER(
-    DRIVER_VIRTIO_BLK_VFIO_PCI
-);
+static BlockDriver bdrv_virtio_blk_vfio_pci = {
+    .format_name         = "virtio-blk-vfio-pci",
+    .protocol_name       = "virtio-blk-vfio-pci",
+    BLKIO_DRIVER_COMMON
+};
 
-static BlockDriver bdrv_virtio_blk_vhost_user = BLKIO_DRIVER(
-    DRIVER_VIRTIO_BLK_VHOST_USER
-);
+static BlockDriver bdrv_virtio_blk_vhost_user = {
+    .format_name         = "virtio-blk-vhost-user",
+    .protocol_name       = "virtio-blk-vhost-user",
+    BLKIO_DRIVER_COMMON
+};
 
-static BlockDriver bdrv_virtio_blk_vhost_vdpa = BLKIO_DRIVER(
-    DRIVER_VIRTIO_BLK_VHOST_VDPA
-);
+static BlockDriver bdrv_virtio_blk_vhost_vdpa = {
+    .format_name         = "virtio-blk-vhost-vdpa",
+    .protocol_name       = "virtio-blk-vhost-vdpa",
+    BLKIO_DRIVER_COMMON
+};
 
 static void bdrv_blkio_init(void)
 {

From 71d72ececa086114df80fe4cc04d701b59002eb2 Mon Sep 17 00:00:00 2001
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Mon, 26 Jun 2023 13:49:06 +0200
Subject: [PATCH 0392/1353] 9pfs: deprecate 'proxy' backend

As recent CVE-2023-2861 (fixed by f6b0de53fb) once again showed, the 9p
'proxy' fs driver is in bad shape. Using the 'proxy' backend was already
discouraged for safety reasons before and we recommended to use the
'local' backend (preferably in conjunction with its 'mapped' security
model) instead, but now it is time to officially deprecate the 'proxy'
backend.

Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <E1qDkmw-0007M1-8f@lizzy.crudebyte.com>
---
 MAINTAINERS                        |  9 ++++++++-
 docs/about/deprecated.rst          | 23 +++++++++++++++++++++++
 docs/tools/virtfs-proxy-helper.rst |  3 +++
 fsdev/qemu-fsdev.c                 |  8 ++++++++
 fsdev/virtfs-proxy-helper.c        |  9 +++++++++
 hw/9pfs/9p-proxy.c                 |  5 +++++
 hw/9pfs/9p-proxy.h                 |  5 +++++
 meson.build                        |  2 +-
 qemu-options.hx                    |  6 +++++-
 9 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 7164cf55a1..80934ad2c3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2124,13 +2124,20 @@ S: Odd Fixes
 W: https://wiki.qemu.org/Documentation/9p
 F: hw/9pfs/
 X: hw/9pfs/xen-9p*
+X: hw/9pfs/9p-proxy*
 F: fsdev/
-F: docs/tools/virtfs-proxy-helper.rst
+X: fsdev/virtfs-proxy-helper.c
 F: tests/qtest/virtio-9p-test.c
 F: tests/qtest/libqos/virtio-9p*
 T: git https://gitlab.com/gkurz/qemu.git 9p-next
 T: git https://github.com/cschoenebeck/qemu.git 9p.next
 
+virtio-9p-proxy
+F: hw/9pfs/9p-proxy*
+F: fsdev/virtfs-proxy-helper.c
+F: docs/tools/virtfs-proxy-helper.rst
+S: Obsolete
+
 virtio-blk
 M: Stefan Hajnoczi <stefanha@redhat.com>
 L: qemu-block@nongnu.org
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 0743459862..ddc1e48460 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -343,6 +343,29 @@ the addition of volatile memory support, it is now necessary to distinguish
 between persistent and volatile memory backends.  As such, memdev is deprecated
 in favor of persistent-memdev.
 
+``-fsdev proxy`` and ``-virtfs proxy`` (since 8.1)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The 9p ``proxy`` filesystem backend driver has been deprecated and will be
+removed (along with its proxy helper daemon) in a future version of QEMU. Please
+use ``-fsdev local`` or ``-virtfs local`` for using the 9p ``local`` filesystem
+backend, or alternatively consider deploying virtiofsd instead.
+
+The 9p ``proxy`` backend was originally developed as an alternative to the 9p
+``local`` backend. The idea was to enhance security by dispatching actual low
+level filesystem operations from 9p server (QEMU process) over to a separate
+process (the virtfs-proxy-helper binary). However this alternative never gained
+momentum. The proxy backend is much slower than the local backend, hasn't seen
+any development in years, and showed to be less secure, especially due to the
+fact that its helper daemon must be run as root, whereas with the local backend
+QEMU is typically run as unprivileged user and allows to tighten behaviour by
+mapping permissions et al by using its 'mapped' security model option.
+
+Nowadays it would make sense to reimplement the ``proxy`` backend by using
+QEMU's ``vhost`` feature, which would eliminate the high latency costs under
+which the 9p ``proxy`` backend currently suffers. However as of to date nobody
+has indicated plans for such kind of reimplemention unfortunately.
+
 
 Block device options
 ''''''''''''''''''''
diff --git a/docs/tools/virtfs-proxy-helper.rst b/docs/tools/virtfs-proxy-helper.rst
index 6cdeedf8e9..bd310ebb07 100644
--- a/docs/tools/virtfs-proxy-helper.rst
+++ b/docs/tools/virtfs-proxy-helper.rst
@@ -9,6 +9,9 @@ Synopsis
 Description
 -----------
 
+NOTE: The 9p 'proxy' backend is deprecated (since QEMU 8.1) and will be
+removed, along with this daemon, in a future version of QEMU!
+
 Pass-through security model in QEMU 9p server needs root privilege to do
 few file operations (like chown, chmod to any mode/uid:gid).  There are two
 issues in pass-through security model:
diff --git a/fsdev/qemu-fsdev.c b/fsdev/qemu-fsdev.c
index 3da64e9f72..f5c953a710 100644
--- a/fsdev/qemu-fsdev.c
+++ b/fsdev/qemu-fsdev.c
@@ -133,6 +133,14 @@ int qemu_fsdev_add(QemuOpts *opts, Error **errp)
     }
 
     if (fsdriver) {
+        if (strncmp(fsdriver, "proxy", 5) == 0) {
+            warn_report(
+                "'-fsdev proxy' and '-virtfs proxy' are deprecated, use "
+                "'local' instead of 'proxy, or consider deploying virtiofsd "
+                "as alternative to 9p"
+            );
+        }
+
         for (i = 0; i < ARRAY_SIZE(FsDrivers); i++) {
             if (strcmp(FsDrivers[i].name, fsdriver) == 0) {
                 break;
diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
index d9511f429c..144aaf585a 100644
--- a/fsdev/virtfs-proxy-helper.c
+++ b/fsdev/virtfs-proxy-helper.c
@@ -9,6 +9,11 @@
  * the COPYING file in the top-level directory.
  */
 
+/*
+ * NOTE: The 9p 'proxy' backend is deprecated (since QEMU 8.1) and will be
+ * removed in a future version of QEMU!
+ */
+
 #include "qemu/osdep.h"
 #include <glib/gstdio.h>
 #include <sys/resource.h>
@@ -1057,6 +1062,10 @@ int main(int argc, char **argv)
     struct statfs st_fs;
 #endif
 
+    fprintf(stderr, "NOTE: The 9p 'proxy' backend is deprecated (since "
+                    "QEMU 8.1) and will be removed in a future version of "
+                    "QEMU!\n");
+
     prog_name = g_path_get_basename(argv[0]);
 
     is_daemon = true;
diff --git a/hw/9pfs/9p-proxy.c b/hw/9pfs/9p-proxy.c
index 99d115ff0d..905cae6992 100644
--- a/hw/9pfs/9p-proxy.c
+++ b/hw/9pfs/9p-proxy.c
@@ -15,6 +15,11 @@
  * https://wiki.qemu.org/Documentation/9p
  */
 
+/*
+ * NOTE: The 9p 'proxy' backend is deprecated (since QEMU 8.1) and will be
+ * removed in a future version of QEMU!
+ */
+
 #include "qemu/osdep.h"
 #include <sys/socket.h>
 #include <sys/un.h>
diff --git a/hw/9pfs/9p-proxy.h b/hw/9pfs/9p-proxy.h
index b84301d001..9be4718d3e 100644
--- a/hw/9pfs/9p-proxy.h
+++ b/hw/9pfs/9p-proxy.h
@@ -10,6 +10,11 @@
  * the COPYING file in the top-level directory.
  */
 
+/*
+ * NOTE: The 9p 'proxy' backend is deprecated (since QEMU 8.1) and will be
+ * removed in a future version of QEMU!
+ */
+
 #ifndef QEMU_9P_PROXY_H
 #define QEMU_9P_PROXY_H
 
diff --git a/meson.build b/meson.build
index a9ba0bfab3..b82d5b7cd0 100644
--- a/meson.build
+++ b/meson.build
@@ -4179,7 +4179,7 @@ if have_block
   summary_info += {'Block whitelist (ro)': get_option('block_drv_ro_whitelist')}
   summary_info += {'Use block whitelist in tools': get_option('block_drv_whitelist_in_tools')}
   summary_info += {'VirtFS (9P) support':    have_virtfs}
-  summary_info += {'VirtFS (9P) Proxy Helper support': have_virtfs_proxy_helper}
+  summary_info += {'VirtFS (9P) Proxy Helper support (deprecated)': have_virtfs_proxy_helper}
   summary_info += {'Live block migration': config_host_data.get('CONFIG_LIVE_BLOCK_MIGRATION')}
   summary_info += {'replication support': config_host_data.get('CONFIG_REPLICATION')}
   summary_info += {'bochs support':     get_option('bochs').allowed()}
diff --git a/qemu-options.hx b/qemu-options.hx
index b57489d7ca..3a6c7d3ef9 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1735,7 +1735,9 @@ SRST
         Accesses to the filesystem are done by QEMU.
 
     ``proxy``
-        Accesses to the filesystem are done by virtfs-proxy-helper(1).
+        Accesses to the filesystem are done by virtfs-proxy-helper(1). This
+        option is deprecated (since QEMU 8.1) and will be removed in a future
+        version of QEMU. Use ``local`` instead.
 
     ``synth``
         Synthetic filesystem, only used by QTests.
@@ -1867,6 +1869,8 @@ SRST
 
     ``proxy``
         Accesses to the filesystem are done by virtfs-proxy-helper(1).
+        This option is deprecated (since QEMU 8.1) and will be removed in a
+        future version of QEMU. Use ``local`` instead.
 
     ``synth``
         Synthetic filesystem, only used by QTests.

From 3548fa01511b4d8d19d4b187d3989b7033b733d8 Mon Sep 17 00:00:00 2001
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Mon, 3 Jul 2023 16:34:17 +0200
Subject: [PATCH 0393/1353] MAINTAINERS: raise status of 9p to 'Maintained'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change status of 9p from 'Odd Fixes' to 'Maintained', as this better
reflects current situation. I already take care of 9p patches for a
while, which included new features as well.

Based-on: <E1qDkmw-0007M1-8f@lizzy.crudebyte.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <E1qGKgV-0003Hj-01@lizzy.crudebyte.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 80934ad2c3..d422ce50e3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2120,7 +2120,7 @@ F: include/sysemu/balloon.h
 virtio-9p
 M: Greg Kurz <groug@kaod.org>
 M: Christian Schoenebeck <qemu_oss@crudebyte.com>
-S: Odd Fixes
+S: Maintained
 W: https://wiki.qemu.org/Documentation/9p
 F: hw/9pfs/
 X: hw/9pfs/xen-9p*

From 3dc2afeab2964b54848715b913b6c605f36be3e1 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 6 Jul 2023 12:38:19 +0100
Subject: [PATCH 0394/1353] tests/tcg/aarch64/sysregs.c: Use S syntax for
 id_aa64zfr0_el1 and id_aa64smfr0_el1

Some assemblers will complain about attempts to access
id_aa64zfr0_el1 and id_aa64smfr0_el1 by name if the test
binary isn't built for the right processor type:

 /tmp/ccASXpLo.s:782: Error: selected processor does not support system register name 'id_aa64zfr0_el1'
 /tmp/ccASXpLo.s:829: Error: selected processor does not support system register name 'id_aa64smfr0_el1'

However, these registers are in the ID space and are guaranteed to
read-as-zero on older CPUs, so the access is both safe and sensible.
Switch to using the S syntax, as we already do for ID_AA64ISAR2_EL1
and ID_AA64MMFR2_EL1.  This allows us to drop the HAS_ARMV9_SME check
and the makefile machinery to adjust the CFLAGS for this test, so we
don't rely on having a sufficiently new compiler to be able to check
these registers.

This means we're actually testing the SME ID register: no released
GCC yet recognizes -march=armv9-a+sme, so that was always skipped.
It also avoids a future problem if we try to switch the "do we have
SME support in the toolchain" check from "in the compiler" to "in the
assembler" (at which point we would otherwise run into the above
errors).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target |  7 +------
 tests/tcg/aarch64/sysregs.c       | 11 +++++++----
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index cec1d4b287..ea9ceb31e6 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -61,15 +61,10 @@ AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7
 mte-%: CFLAGS += -march=armv8.5-a+memtag
 endif
 
-ifneq ($(CROSS_CC_HAS_SVE),)
 # System Registers Tests
 AARCH64_TESTS += sysregs
-ifneq ($(CROSS_CC_HAS_ARMV9_SME),)
-sysregs: CFLAGS+=-march=armv9-a+sme -DHAS_ARMV9_SME
-else
-sysregs: CFLAGS+=-march=armv8.1-a+sve
-endif
 
+ifneq ($(CROSS_CC_HAS_SVE),)
 # SVE ioctl test
 AARCH64_TESTS += sve-ioctls
 sve-ioctls: CFLAGS+=-march=armv8.1-a+sve
diff --git a/tests/tcg/aarch64/sysregs.c b/tests/tcg/aarch64/sysregs.c
index 46b931f781..d8eb06abcf 100644
--- a/tests/tcg/aarch64/sysregs.c
+++ b/tests/tcg/aarch64/sysregs.c
@@ -25,9 +25,14 @@
 /*
  * Older assemblers don't recognize newer system register names,
  * but we can still access them by the Sn_n_Cn_Cn_n syntax.
+ * This also means we don't need to specifically request that the
+ * assembler enables whatever architectural features the ID registers
+ * syntax might be gated behind.
  */
 #define SYS_ID_AA64ISAR2_EL1 S3_0_C0_C6_2
 #define SYS_ID_AA64MMFR2_EL1 S3_0_C0_C7_2
+#define SYS_ID_AA64ZFR0_EL1 S3_0_C0_C4_4
+#define SYS_ID_AA64SMFR0_EL1 S3_0_C0_C4_5
 
 int failed_bit_count;
 
@@ -132,10 +137,8 @@ int main(void)
     /* all hidden, DebugVer fixed to 0x6 (ARMv8 debug architecture) */
     get_cpu_reg_check_mask(id_aa64dfr0_el1,  _m(0000,0000,0000,0006));
     get_cpu_reg_check_zero(id_aa64dfr1_el1);
-    get_cpu_reg_check_mask(id_aa64zfr0_el1,  _m(0ff0,ff0f,00ff,00ff));
-#ifdef HAS_ARMV9_SME
-    get_cpu_reg_check_mask(id_aa64smfr0_el1, _m(80f1,00fd,0000,0000));
-#endif
+    get_cpu_reg_check_mask(SYS_ID_AA64ZFR0_EL1,  _m(0ff0,ff0f,00ff,00ff));
+    get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(80f1,00fd,0000,0000));
 
     get_cpu_reg_check_zero(id_aa64afr0_el1);
     get_cpu_reg_check_zero(id_aa64afr1_el1);

From a9d8407016ab9d2423a00d767cad90968ba21f99 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 4 Jul 2023 14:08:47 +0100
Subject: [PATCH 0395/1353] target/arm: Avoid splitting Zregs across lines in
 dump

Allow the line length to extend to 548 columns.  While annoyingly wide,
it's still less confusing than the continuations we print.  Also, the
default VL used by Linux (and max for A64FX) uses only 140 columns.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230622151201.1578522-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 36 ++++++++++++++----------------------
 1 file changed, 14 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index a1e77698ba..f12c714bc4 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -955,7 +955,7 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     uint32_t psr = pstate_read(env);
-    int i;
+    int i, j;
     int el = arm_current_el(env);
     const char *ns_status;
     bool sve;
@@ -1014,7 +1014,7 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     }
 
     if (sve) {
-        int j, zcr_len = sve_vqm1_for_el(env, el);
+        int zcr_len = sve_vqm1_for_el(env, el);
 
         for (i = 0; i <= FFR_PRED_NUM; i++) {
             bool eol;
@@ -1054,32 +1054,24 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             }
         }
 
-        for (i = 0; i < 32; i++) {
-            if (zcr_len == 0) {
+        if (zcr_len == 0) {
+            /*
+             * With vl=16, there are only 37 columns per register,
+             * so output two registers per line.
+             */
+            for (i = 0; i < 32; i++) {
                 qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64 "%s",
                              i, env->vfp.zregs[i].d[1],
                              env->vfp.zregs[i].d[0], i & 1 ? "\n" : " ");
-            } else if (zcr_len == 1) {
-                qemu_fprintf(f, "Z%02d=%016" PRIx64 ":%016" PRIx64
-                             ":%016" PRIx64 ":%016" PRIx64 "\n",
-                             i, env->vfp.zregs[i].d[3], env->vfp.zregs[i].d[2],
-                             env->vfp.zregs[i].d[1], env->vfp.zregs[i].d[0]);
-            } else {
+            }
+        } else {
+            for (i = 0; i < 32; i++) {
+                qemu_fprintf(f, "Z%02d=", i);
                 for (j = zcr_len; j >= 0; j--) {
-                    bool odd = (zcr_len - j) % 2 != 0;
-                    if (j == zcr_len) {
-                        qemu_fprintf(f, "Z%02d[%x-%x]=", i, j, j - 1);
-                    } else if (!odd) {
-                        if (j > 0) {
-                            qemu_fprintf(f, "   [%x-%x]=", j, j - 1);
-                        } else {
-                            qemu_fprintf(f, "     [%x]=", j);
-                        }
-                    }
                     qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%s",
                                  env->vfp.zregs[i].d[j * 2 + 1],
-                                 env->vfp.zregs[i].d[j * 2],
-                                 odd || j == 0 ? "\n" : ":");
+                                 env->vfp.zregs[i].d[j * 2 + 0],
+                                 j ? ":" : "\n");
                 }
             }
         }

From 270bea47a23b286c2ab3a76f720991c59680b8e6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 4 Jul 2023 14:08:48 +0100
Subject: [PATCH 0396/1353] target/arm: Dump ZA[] when active

Always print each matrix row whole, one per line, so that we
get the entire matrix in the proper shape.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230622151201.1578522-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index f12c714bc4..adf84f9686 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1082,6 +1082,24 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
                          i, q[1], q[0], (i & 1 ? "\n" : " "));
         }
     }
+
+    if (cpu_isar_feature(aa64_sme, cpu) &&
+        FIELD_EX64(env->svcr, SVCR, ZA) &&
+        sme_exception_el(env, el) == 0) {
+        int zcr_len = sve_vqm1_for_el_sm(env, el, true);
+        int svl = (zcr_len + 1) * 16;
+        int svl_lg10 = svl < 100 ? 2 : 3;
+
+        for (i = 0; i < svl; i++) {
+            qemu_fprintf(f, "ZA[%0*d]=", svl_lg10, i);
+            for (j = zcr_len; j >= 0; --j) {
+                qemu_fprintf(f, "%016" PRIx64 ":%016" PRIx64 "%c",
+                             env->zarray[i].d[2 * j + 1],
+                             env->zarray[i].d[2 * j],
+                             j ? ':' : '\n');
+            }
+        }
+    }
 }
 
 #else

From 1f51573f7925b80e79a29f87c7d9d6ead60960c0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 4 Jul 2023 14:08:48 +0100
Subject: [PATCH 0397/1353] target/arm: Fix SME full tile indexing

For the outer product set of insns, which take an entire matrix
tile as output, the argument is not a combined tile+column.
Therefore using get_tile_rowcol was incorrect, as we extracted
the tile number from itself.

The test case relies only on assembler support for SME, since
no release of GCC recognizes -march=armv9-a+sme yet.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1620
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230622151201.1578522-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: dropped now-unneeded changes to sysregs CFLAGS]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sme.c    | 24 ++++++---
 tests/tcg/aarch64/Makefile.target |  7 ++-
 tests/tcg/aarch64/sme-outprod1.c  | 83 +++++++++++++++++++++++++++++++
 3 files changed, 107 insertions(+), 7 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-outprod1.c

diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index d0054e3f77..6038b0a06f 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -95,6 +95,21 @@ static TCGv_ptr get_tile_rowcol(DisasContext *s, int esz, int rs,
     return addr;
 }
 
+/*
+ * Resolve tile.size[0] to a host pointer.
+ * Used by e.g. outer product insns where we require the entire tile.
+ */
+static TCGv_ptr get_tile(DisasContext *s, int esz, int tile)
+{
+    TCGv_ptr addr = tcg_temp_new_ptr();
+    int offset;
+
+    offset = tile * sizeof(ARMVectorReg) + offsetof(CPUARMState, zarray);
+
+    tcg_gen_addi_ptr(addr, cpu_env, offset);
+    return addr;
+}
+
 static bool trans_ZERO(DisasContext *s, arg_ZERO *a)
 {
     if (!dc_isar_feature(aa64_sme, s)) {
@@ -260,8 +275,7 @@ static bool do_adda(DisasContext *s, arg_adda *a, MemOp esz,
         return true;
     }
 
-    /* Sum XZR+zad to find ZAd. */
-    za = get_tile_rowcol(s, esz, 31, a->zad, false);
+    za = get_tile(s, esz, a->zad);
     zn = vec_full_reg_ptr(s, a->zn);
     pn = pred_full_reg_ptr(s, a->pn);
     pm = pred_full_reg_ptr(s, a->pm);
@@ -286,8 +300,7 @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz,
         return true;
     }
 
-    /* Sum XZR+zad to find ZAd. */
-    za = get_tile_rowcol(s, esz, 31, a->zad, false);
+    za = get_tile(s, esz, a->zad);
     zn = vec_full_reg_ptr(s, a->zn);
     zm = vec_full_reg_ptr(s, a->zm);
     pn = pred_full_reg_ptr(s, a->pn);
@@ -308,8 +321,7 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,
         return true;
     }
 
-    /* Sum XZR+zad to find ZAd. */
-    za = get_tile_rowcol(s, esz, 31, a->zad, false);
+    za = get_tile(s, esz, a->zad);
     zn = vec_full_reg_ptr(s, a->zn);
     zm = vec_full_reg_ptr(s, a->zm);
     pn = pred_full_reg_ptr(s, a->pn);
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index ea9ceb31e6..0606dec118 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -26,7 +26,7 @@ config-cc.mak: Makefile
 	    $(call cc-option,-march=armv8.5-a,              CROSS_CC_HAS_ARMV8_5); \
 	    $(call cc-option,-mbranch-protection=standard,  CROSS_CC_HAS_ARMV8_BTI); \
 	    $(call cc-option,-march=armv8.5-a+memtag,       CROSS_CC_HAS_ARMV8_MTE); \
-	    $(call cc-option,-march=armv9-a+sme,            CROSS_CC_HAS_ARMV9_SME)) 3> config-cc.mak
+	    $(call cc-option,-Wa$(COMMA)-march=armv9-a+sme, CROSS_AS_HAS_ARMV9_SME)) 3> config-cc.mak
 -include config-cc.mak
 
 ifneq ($(CROSS_CC_HAS_ARMV8_2),)
@@ -61,6 +61,11 @@ AARCH64_TESTS += mte-1 mte-2 mte-3 mte-4 mte-5 mte-6 mte-7
 mte-%: CFLAGS += -march=armv8.5-a+memtag
 endif
 
+# SME Tests
+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
+AARCH64_TESTS += sme-outprod1
+endif
+
 # System Registers Tests
 AARCH64_TESTS += sysregs
 
diff --git a/tests/tcg/aarch64/sme-outprod1.c b/tests/tcg/aarch64/sme-outprod1.c
new file mode 100644
index 0000000000..6e5972d75e
--- /dev/null
+++ b/tests/tcg/aarch64/sme-outprod1.c
@@ -0,0 +1,83 @@
+/*
+ * SME outer product, 1 x 1.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <stdio.h>
+
+extern void foo(float *dst);
+
+asm(
+"	.arch_extension sme\n"
+"	.type foo, @function\n"
+"foo:\n"
+"	stp x29, x30, [sp, -80]!\n"
+"	mov x29, sp\n"
+"	stp d8, d9, [sp, 16]\n"
+"	stp d10, d11, [sp, 32]\n"
+"	stp d12, d13, [sp, 48]\n"
+"	stp d14, d15, [sp, 64]\n"
+"	smstart\n"
+"	ptrue p0.s, vl4\n"
+"	fmov z0.s, #1.0\n"
+/*
+ * An outer product of a vector of 1.0 by itself should be a matrix of 1.0.
+ * Note that we are using tile 1 here (za1.s) rather than tile 0.
+ */
+"	zero {za}\n"
+"	fmopa za1.s, p0/m, p0/m, z0.s, z0.s\n"
+/*
+ * Read the first 4x4 sub-matrix of elements from tile 1:
+ * Note that za1h should be interchangable here.
+ */
+"	mov w12, #0\n"
+"	mova z0.s, p0/m, za1v.s[w12, #0]\n"
+"	mova z1.s, p0/m, za1v.s[w12, #1]\n"
+"	mova z2.s, p0/m, za1v.s[w12, #2]\n"
+"	mova z3.s, p0/m, za1v.s[w12, #3]\n"
+/*
+ * And store them to the input pointer (dst in the C code):
+ */
+"	st1w {z0.s}, p0, [x0]\n"
+"	add x0, x0, #16\n"
+"	st1w {z1.s}, p0, [x0]\n"
+"	add x0, x0, #16\n"
+"	st1w {z2.s}, p0, [x0]\n"
+"	add x0, x0, #16\n"
+"	st1w {z3.s}, p0, [x0]\n"
+"	smstop\n"
+"	ldp d8, d9, [sp, 16]\n"
+"	ldp d10, d11, [sp, 32]\n"
+"	ldp d12, d13, [sp, 48]\n"
+"	ldp d14, d15, [sp, 64]\n"
+"	ldp x29, x30, [sp], 80\n"
+"	ret\n"
+"	.size foo, . - foo"
+);
+
+int main()
+{
+    float dst[16];
+    int i, j;
+
+    foo(dst);
+
+    for (i = 0; i < 16; i++) {
+        if (dst[i] != 1.0f) {
+            break;
+        }
+    }
+
+    if (i == 16) {
+        return 0; /* success */
+    }
+
+    /* failure */
+    for (i = 0; i < 4; ++i) {
+        for (j = 0; j < 4; ++j) {
+            printf("%f ", (double)dst[i * 4 + j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}

From 9719f125b803f4e0fda834cd74a60dfa4ca398e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?John=20H=C3=B6gberg?= <john.hogberg@ericsson.com>
Date: Tue, 4 Jul 2023 14:08:48 +0100
Subject: [PATCH 0398/1353] target/arm: Handle IC IVAU to improve compatibility
 with JITs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unlike architectures with precise self-modifying code semantics
(e.g. x86) ARM processors do not maintain coherency for instruction
execution and memory, requiring an instruction synchronization
barrier on every core that will execute the new code, and on many
models also the explicit use of cache management instructions.

While this is required to make JITs work on actual hardware, QEMU
has gotten away with not handling this since it does not emulate
caches, and unconditionally invalidates code whenever the softmmu
or the user-mode page protection logic detects that code has been
modified.

Unfortunately the latter does not work in the face of dual-mapped
code (a common W^X workaround), where one page is executable and
the other is writable: user-mode has no way to connect one with the
other as that is only known to the kernel and the emulated
application.

This commit works around the issue by telling software that
instruction cache invalidation is required by clearing the
CPR_EL0.DIC flag (regardless of whether the emulated processor
needs it), and then invalidating code in IC IVAU instructions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1034

Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: John Högberg <john.hogberg@ericsson.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 168778890374.24232.3402138851538068785-1@git.sr.ht
[PMM: removed unnecessary AArch64 feature check; moved
 "clear CTR_EL1.DIC" code up a bit so it's not in the middle
 of the vfp/neon related tests]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c    | 11 +++++++++++
 target/arm/helper.c | 47 ++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index adf84f9686..822efa5b2c 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1694,6 +1694,17 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+#ifdef CONFIG_USER_ONLY
+    /*
+     * User mode relies on IC IVAU instructions to catch modification of
+     * dual-mapped code.
+     *
+     * Clear CTR_EL0.DIC to ensure that software that honors these flags uses
+     * IC IVAU even if the emulated processor does not normally require it.
+     */
+    cpu->ctr = FIELD_DP64(cpu->ctr, CTR_EL0, DIC, 0);
+#endif
+
     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
         cpu->has_vfp != cpu->has_neon) {
         /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index a0b84efab5..8e836aaee1 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5234,6 +5234,36 @@ static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 }
 
+#ifdef CONFIG_USER_ONLY
+/*
+ * `IC IVAU` is handled to improve compatibility with JITs that dual-map their
+ * code to get around W^X restrictions, where one region is writable and the
+ * other is executable.
+ *
+ * Since the executable region is never written to we cannot detect code
+ * changes when running in user mode, and rely on the emulated JIT telling us
+ * that the code has changed by executing this instruction.
+ */
+static void ic_ivau_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                          uint64_t value)
+{
+    uint64_t icache_line_mask, start_address, end_address;
+    const ARMCPU *cpu;
+
+    cpu = env_archcpu(env);
+
+    icache_line_mask = (4 << extract32(cpu->ctr, 0, 4)) - 1;
+    start_address = value & ~icache_line_mask;
+    end_address = value | icache_line_mask;
+
+    mmap_lock();
+
+    tb_invalidate_phys_range(start_address, end_address);
+
+    mmap_unlock();
+}
+#endif
+
 static const ARMCPRegInfo v8_cp_reginfo[] = {
     /*
      * Minimal set of EL0-visible registers. This will need to be expanded
@@ -5273,7 +5303,10 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
     { .name = "CURRENTEL", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 4, .crm = 2,
       .access = PL1_R, .type = ARM_CP_CURRENTEL },
-    /* Cache ops: all NOPs since we don't emulate caches */
+    /*
+     * Instruction cache ops. All of these except `IC IVAU` NOP because we
+     * don't emulate caches.
+     */
     { .name = "IC_IALLUIS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
       .access = PL1_W, .type = ARM_CP_NOP,
@@ -5286,9 +5319,17 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .accessfn = access_tocu },
     { .name = "IC_IVAU", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 5, .opc2 = 1,
-      .access = PL0_W, .type = ARM_CP_NOP,
+      .access = PL0_W,
       .fgt = FGT_ICIVAU,
-      .accessfn = access_tocu },
+      .accessfn = access_tocu,
+#ifdef CONFIG_USER_ONLY
+      .type = ARM_CP_NO_RAW,
+      .writefn = ic_ivau_write
+#else
+      .type = ARM_CP_NOP
+#endif
+    },
+    /* Cache ops: all NOPs since we don't emulate caches */
     { .name = "DC_IVAC", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 6, .opc2 = 1,
       .access = PL1_W, .accessfn = aa64_cacheop_poc_access,

From b52aa865259f8e26125333a178c0a9364d8ae4da Mon Sep 17 00:00:00 2001
From: Vikram Garhwal <vikram.garhwal@amd.com>
Date: Wed, 28 Jun 2023 13:27:58 -0700
Subject: [PATCH 0399/1353] tests/qtest: xlnx-canfd-test: Fix code coverity
 issues

Following are done to fix the coverity issues:
1. Change read_data to fix the CID 1512899: Out-of-bounds access (OVERRUN)
2. Fix match_rx_tx_data to fix CID 1512900: Logically dead code (DEADCODE)
3. Replace rand() in generate_random_data() with g_rand_int()

Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com>
Message-id: 20230628202758.16398-1-vikram.garhwal@amd.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/xlnx-canfd-test.c | 33 +++++++++++----------------------
 1 file changed, 11 insertions(+), 22 deletions(-)

diff --git a/tests/qtest/xlnx-canfd-test.c b/tests/qtest/xlnx-canfd-test.c
index 76ee106d4f..78ec9ef2a7 100644
--- a/tests/qtest/xlnx-canfd-test.c
+++ b/tests/qtest/xlnx-canfd-test.c
@@ -170,23 +170,23 @@ static void generate_random_data(uint32_t *buf_tx, bool is_canfd_frame)
     /* Generate random TX data for CANFD frame. */
     if (is_canfd_frame) {
         for (int i = 0; i < CANFD_FRAME_SIZE - 2; i++) {
-            buf_tx[2 + i] = rand();
+            buf_tx[2 + i] = g_random_int();
         }
     } else {
         /* Generate random TX data for CAN frame. */
         for (int i = 0; i < CAN_FRAME_SIZE - 2; i++) {
-            buf_tx[2 + i] = rand();
+            buf_tx[2 + i] = g_random_int();
         }
     }
 }
 
-static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
+static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx,
+                      uint32_t frame_size)
 {
     uint32_t int_status;
     uint32_t fifo_status_reg_value;
     /* At which RX FIFO the received data is stored. */
     uint8_t store_ind = 0;
-    bool is_canfd_frame = false;
 
     /* Read the interrupt on CANFD rx. */
     int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_RXOK;
@@ -207,16 +207,9 @@ static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
     buf_rx[0] = qtest_readl(qts, can_base_addr + R_RX0_ID_OFFSET);
     buf_rx[1] = qtest_readl(qts, can_base_addr + R_RX0_DLC_OFFSET);
 
-    is_canfd_frame = (buf_rx[1] >> DLC_FD_BIT_SHIFT) & 1;
-
-    if (is_canfd_frame) {
-        for (int i = 0; i < CANFD_FRAME_SIZE - 2; i++) {
-            buf_rx[i + 2] = qtest_readl(qts,
-                                    can_base_addr + R_RX0_DATA1_OFFSET + 4 * i);
-        }
-    } else {
-        buf_rx[2] = qtest_readl(qts, can_base_addr + R_RX0_DATA1_OFFSET);
-        buf_rx[3] = qtest_readl(qts, can_base_addr + R_RX0_DATA2_OFFSET);
+    for (int i = 0; i < frame_size - 2; i++) {
+        buf_rx[i + 2] = qtest_readl(qts,
+                                can_base_addr + R_RX0_DATA1_OFFSET + 4 * i);
     }
 
     /* Clear the RX interrupt. */
@@ -272,10 +265,6 @@ static void match_rx_tx_data(const uint32_t *buf_tx, const uint32_t *buf_rx,
             g_assert_cmpint((buf_rx[size] & DLC_FD_BIT_MASK), ==,
                             (buf_tx[size] & DLC_FD_BIT_MASK));
         } else {
-            if (!is_canfd_frame && size == 4) {
-                break;
-            }
-
             g_assert_cmpint(buf_rx[size], ==, buf_tx[size]);
         }
 
@@ -318,7 +307,7 @@ static void test_can_data_transfer(void)
     write_data(qts, CANFD0_BASE_ADDR, buf_tx, false);
 
     send_data(qts, CANFD0_BASE_ADDR);
-    read_data(qts, CANFD1_BASE_ADDR, buf_rx);
+    read_data(qts, CANFD1_BASE_ADDR, buf_rx, CAN_FRAME_SIZE);
     match_rx_tx_data(buf_tx, buf_rx, false);
 
     qtest_quit(qts);
@@ -358,7 +347,7 @@ static void test_canfd_data_transfer(void)
     write_data(qts, CANFD0_BASE_ADDR, buf_tx, true);
 
     send_data(qts, CANFD0_BASE_ADDR);
-    read_data(qts, CANFD1_BASE_ADDR, buf_rx);
+    read_data(qts, CANFD1_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
     match_rx_tx_data(buf_tx, buf_rx, true);
 
     qtest_quit(qts);
@@ -397,7 +386,7 @@ static void test_can_loopback(void)
     write_data(qts, CANFD0_BASE_ADDR, buf_tx, true);
 
     send_data(qts, CANFD0_BASE_ADDR);
-    read_data(qts, CANFD0_BASE_ADDR, buf_rx);
+    read_data(qts, CANFD0_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
     match_rx_tx_data(buf_tx, buf_rx, true);
 
     generate_random_data(buf_tx, true);
@@ -405,7 +394,7 @@ static void test_can_loopback(void)
     write_data(qts, CANFD1_BASE_ADDR, buf_tx, true);
 
     send_data(qts, CANFD1_BASE_ADDR);
-    read_data(qts, CANFD1_BASE_ADDR, buf_rx);
+    read_data(qts, CANFD1_BASE_ADDR, buf_rx, CANFD_FRAME_SIZE);
     match_rx_tx_data(buf_tx, buf_rx, true);
 
     qtest_quit(qts);

From 893ca916c0b9432d46fc16f84c8d3b605a58c843 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Wed, 28 Jun 2023 13:48:21 -0300
Subject: [PATCH 0400/1353] target/arm: gdbstub: Guard M-profile code with
 CONFIG_TCG

This code is only relevant when TCG is present in the build. Building
with --disable-tcg --enable-xen on an x86 host we get:

$ ../configure --target-list=x86_64-softmmu,aarch64-softmmu --disable-tcg --enable-xen
$ make -j$(nproc)
...
libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `m_sysreg_ptr':
 ../target/arm/gdbstub.c:358: undefined reference to `arm_v7m_get_sp_ptr'
 ../target/arm/gdbstub.c:361: undefined reference to `arm_v7m_get_sp_ptr'

libqemu-aarch64-softmmu.fa.p/target_arm_gdbstub.c.o: in function `arm_gdb_get_m_systemreg':
../target/arm/gdbstub.c:405: undefined reference to `arm_v7m_mrs_control'

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230628164821.16771-1-farosas@suse.de
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 03b17c814f..f421c5d041 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -324,6 +324,7 @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
     return cpu->dyn_sysreg_xml.num;
 }
 
+#ifdef CONFIG_TCG
 typedef enum {
     M_SYSREG_MSP,
     M_SYSREG_PSP,
@@ -481,6 +482,7 @@ static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
     return cpu->dyn_m_secextreg_xml.num;
 }
 #endif
+#endif /* CONFIG_TCG */
 
 const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
 {
@@ -561,6 +563,7 @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                              arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
                              "system-registers.xml", 0);
 
+#ifdef CONFIG_TCG
     if (arm_feature(env, ARM_FEATURE_M) && tcg_enabled()) {
         gdb_register_coprocessor(cs,
             arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
@@ -575,4 +578,5 @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
         }
 #endif
     }
+#endif /* CONFIG_TCG */
 }

From 9057e5f7c9550d1ea419ce838ae6d0df96fb062e Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 28 Jun 2023 20:09:03 +0900
Subject: [PATCH 0401/1353] hw: arm: allwinner-sramc: Set class_size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AwSRAMCClass is larger than SysBusDeviceClass so the class size must be
advertised accordingly.

Fixes: 05def917e1 ("hw: arm: allwinner-sramc: Add SRAM Controller support for R40")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230628110905.38125-1-akihiko.odaki@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/allwinner-sramc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/misc/allwinner-sramc.c b/hw/misc/allwinner-sramc.c
index a8b731f8f2..d76c24d081 100644
--- a/hw/misc/allwinner-sramc.c
+++ b/hw/misc/allwinner-sramc.c
@@ -159,6 +159,7 @@ static const TypeInfo allwinner_sramc_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_init = allwinner_sramc_init,
     .instance_size = sizeof(AwSRAMCState),
+    .class_size    = sizeof(AwSRAMCClass),
     .class_init    = allwinner_sramc_class_init,
 };
 

From ad18376b90c8101b8eed2fd571bdbb94636ccc2e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 23 Jun 2023 16:41:35 +0100
Subject: [PATCH 0402/1353] target/xtensa: Assert that interrupt level is
 within bounds

In handle_interrupt() we use level as an index into the interrupt_vector[]
array. This is safe because we have checked it against env->config->nlevel,
but Coverity can't see that (and it is only true because each CPU config
sets its XCHAL_NUM_INTLEVELS to something less than MAX_NLEVELS), so it
complains about a possible array overrun (CID 1507131)

Add an assert() which will make Coverity happy and catch the unlikely
case of a mis-set XCHAL_NUM_INTLEVELS in future.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Max Filippov <jcmvbkbc@gmail.com>
Message-id: 20230623154135.1930261-1-peter.maydell@linaro.org
---
 target/xtensa/exc_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/xtensa/exc_helper.c b/target/xtensa/exc_helper.c
index d4823a65cd..43f6a862de 100644
--- a/target/xtensa/exc_helper.c
+++ b/target/xtensa/exc_helper.c
@@ -169,6 +169,9 @@ static void handle_interrupt(CPUXtensaState *env)
         CPUState *cs = env_cpu(env);
 
         if (level > 1) {
+            /* env->config->nlevel check should have ensured this */
+            assert(level < sizeof(env->config->interrupt_vector));
+
             env->sregs[EPC1 + level - 1] = env->pc;
             env->sregs[EPS2 + level - 2] = env->sregs[PS];
             env->sregs[PS] =

From 7d8c283e10dd818457e7c6a0f729fb03857253ac Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 4 Jul 2023 14:06:46 +0100
Subject: [PATCH 0403/1353] target/arm: Suppress more TCG unimplemented
 features in ID registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We already squash the ID register field for FEAT_SPE (the Statistical
Profiling Extension) because TCG does not implement it and if we
advertise it to the guest the guest will crash trying to look at
non-existent system registers.  Do the same for some other features
which a real hardware Neoverse-V1 implements but which TCG doesn't:
 * FEAT_TRF (Self-hosted Trace Extension)
 * Trace Macrocell system register access
 * Memory mapped trace
 * FEAT_AMU (Activity Monitors Extension)
 * FEAT_MPAM (Memory Partitioning and Monitoring Extension)
 * FEAT_NV (Nested Virtualization)

Most of these, like FEAT_SPE, are "introspection/trace" type features
which QEMU is unlikely to ever implement.  The odd-one-out here is
FEAT_NV -- we could implement that and at some point we probably
will.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230704130647.2842917-2-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.c | 33 +++++++++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 822efa5b2c..69e2bde3c2 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2069,13 +2069,38 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
     if (tcg_enabled()) {
         /*
-         * Don't report the Statistical Profiling Extension in the ID
-         * registers, because TCG doesn't implement it yet (not even a
-         * minimal stub version) and guests will fall over when they
-         * try to access the non-existent system registers for it.
+         * Don't report some architectural features in the ID registers
+         * where TCG does not yet implement it (not even a minimal
+         * stub version). This avoids guests falling over when they
+         * try to access the non-existent system registers for them.
          */
+        /* FEAT_SPE (Statistical Profiling Extension) */
         cpu->isar.id_aa64dfr0 =
             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
+        /* FEAT_TRF (Self-hosted Trace Extension) */
+        cpu->isar.id_aa64dfr0 =
+            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEFILT, 0);
+        cpu->isar.id_dfr0 =
+            FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, TRACEFILT, 0);
+        /* Trace Macrocell system register access */
+        cpu->isar.id_aa64dfr0 =
+            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEVER, 0);
+        cpu->isar.id_dfr0 =
+            FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPTRC, 0);
+        /* Memory mapped trace */
+        cpu->isar.id_dfr0 =
+            FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, MMAPTRC, 0);
+        /* FEAT_AMU (Activity Monitors Extension) */
+        cpu->isar.id_aa64pfr0 =
+            FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, AMU, 0);
+        cpu->isar.id_pfr0 =
+            FIELD_DP32(cpu->isar.id_pfr0, ID_PFR0, AMU, 0);
+        /* FEAT_MPAM (Memory Partitioning and Monitoring Extension) */
+        cpu->isar.id_aa64pfr0 =
+            FIELD_DP64(cpu->isar.id_aa64pfr0, ID_AA64PFR0, MPAM, 0);
+        /* FEAT_NV (Nested Virtualization) */
+        cpu->isar.id_aa64mmfr2 =
+            FIELD_DP64(cpu->isar.id_aa64mmfr2, ID_AA64MMFR2, NV, 0);
     }
 
     /* MPU can be configured out of a PMSA CPU either by setting has-mpu

From c74138c6c040b62e941326a4fbb25a93fdd35b72 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 4 Jul 2023 14:06:47 +0100
Subject: [PATCH 0404/1353] target/arm: Define neoverse-v1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we have implemented support for FEAT_LSE2, we can define
a CPU model for the Neoverse-V1, and enable it for the virt and
sbsa-ref boards.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230704130647.2842917-3-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/system/arm/virt.rst |   1 +
 hw/arm/sbsa-ref.c        |   1 +
 hw/arm/virt.c            |   1 +
 target/arm/tcg/cpu64.c   | 128 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 131 insertions(+)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index 1cab33f02e..51cdac6841 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -61,6 +61,7 @@ Supported guest CPU types:
 - ``a64fx`` (64-bit)
 - ``host`` (with KVM only)
 - ``neoverse-n1`` (64-bit)
+- ``neoverse-v1`` (64-bit)
 - ``max`` (same as ``host`` for KVM; best possible emulation with TCG)
 
 Note that the default is ``cortex-a15``, so for an AArch64 guest you must
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 1a8519b868..c2e0a9fa1a 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -153,6 +153,7 @@ static const char * const valid_cpus[] = {
     ARM_CPU_TYPE_NAME("cortex-a57"),
     ARM_CPU_TYPE_NAME("cortex-a72"),
     ARM_CPU_TYPE_NAME("neoverse-n1"),
+    ARM_CPU_TYPE_NAME("neoverse-v1"),
     ARM_CPU_TYPE_NAME("max"),
 };
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 3196db556e..796181e169 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -214,6 +214,7 @@ static const char *valid_cpus[] = {
     ARM_CPU_TYPE_NAME("cortex-a76"),
     ARM_CPU_TYPE_NAME("a64fx"),
     ARM_CPU_TYPE_NAME("neoverse-n1"),
+    ARM_CPU_TYPE_NAME("neoverse-v1"),
 #endif
     ARM_CPU_TYPE_NAME("cortex-a53"),
     ARM_CPU_TYPE_NAME("cortex-a57"),
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 6fec2d8a57..8019f00bc3 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -502,6 +502,31 @@ static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
     define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
 }
 
+static const ARMCPRegInfo neoverse_v1_cp_reginfo[] = {
+    { .name = "CPUECTLR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 5,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPPMCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPPMCR2_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 1,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPPMCR3_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 6,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+};
+
+static void define_neoverse_v1_cp_reginfo(ARMCPU *cpu)
+{
+    /*
+     * The Neoverse V1 has all of the Neoverse N1's IMPDEF
+     * registers and a few more of its own.
+     */
+    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
+    define_arm_cp_regs(cpu, neoverse_v1_cp_reginfo);
+}
+
 static void aarch64_neoverse_n1_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -573,6 +598,108 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
     define_neoverse_n1_cp_reginfo(cpu);
 }
 
+static void aarch64_neoverse_v1_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    cpu->dtb_compatible = "arm,neoverse-v1";
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+
+    /* Ordered by 3.2.4 AArch64 registers by functional group */
+    cpu->clidr = 0x82000023;
+    cpu->ctr = 0xb444c004; /* With DIC and IDC set */
+    cpu->dcz_blocksize = 4;
+    cpu->id_aa64afr0 = 0x00000000;
+    cpu->id_aa64afr1 = 0x00000000;
+    cpu->isar.id_aa64dfr0  = 0x000001f210305519ull;
+    cpu->isar.id_aa64dfr1 = 0x00000000;
+    cpu->isar.id_aa64isar0 = 0x1011111110212120ull; /* with FEAT_RNG */
+    cpu->isar.id_aa64isar1 = 0x0111000001211032ull;
+    cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
+    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
+    cpu->isar.id_aa64mmfr2 = 0x0220011102101011ull;
+    cpu->isar.id_aa64pfr0  = 0x1101110120111112ull; /* GIC filled in later */
+    cpu->isar.id_aa64pfr1  = 0x0000000000000020ull;
+    cpu->id_afr0       = 0x00000000;
+    cpu->isar.id_dfr0  = 0x15011099;
+    cpu->isar.id_isar0 = 0x02101110;
+    cpu->isar.id_isar1 = 0x13112111;
+    cpu->isar.id_isar2 = 0x21232042;
+    cpu->isar.id_isar3 = 0x01112131;
+    cpu->isar.id_isar4 = 0x00010142;
+    cpu->isar.id_isar5 = 0x11011121;
+    cpu->isar.id_isar6 = 0x01100111;
+    cpu->isar.id_mmfr0 = 0x10201105;
+    cpu->isar.id_mmfr1 = 0x40000000;
+    cpu->isar.id_mmfr2 = 0x01260000;
+    cpu->isar.id_mmfr3 = 0x02122211;
+    cpu->isar.id_mmfr4 = 0x01021110;
+    cpu->isar.id_pfr0  = 0x21110131;
+    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
+    cpu->isar.id_pfr2  = 0x00000011;
+    cpu->midr = 0x411FD402;          /* r1p2 */
+    cpu->revidr = 0;
+
+    /*
+     * The Neoverse-V1 r1p2 TRM lists 32-bit format CCSIDR_EL1 values,
+     * but also says it implements CCIDX, which means they should be
+     * 64-bit format. So we here use values which are based on the textual
+     * information in chapter 2 of the TRM (and on the fact that
+     * sets * associativity * linesize == cachesize).
+     *
+     * The 64-bit CCSIDR_EL1 format is:
+     *   [55:32] number of sets - 1
+     *   [23:3]  associativity - 1
+     *   [2:0]   log2(linesize) - 4
+     *           so 0 == 16 bytes, 1 == 32 bytes, 2 == 64 bytes, etc
+     *
+     * L1: 4-way set associative 64-byte line size, total size 64K,
+     * so sets is 256.
+     *
+     * L2: 8-way set associative, 64 byte line size, either 512K or 1MB.
+     * We pick 1MB, so this has 2048 sets.
+     *
+     * L3: No L3 (this matches the CLIDR_EL1 value).
+     */
+    cpu->ccsidr[0] = 0x000000ff0000001aull; /* 64KB L1 dcache */
+    cpu->ccsidr[1] = 0x000000ff0000001aull; /* 64KB L1 icache */
+    cpu->ccsidr[2] = 0x000007ff0000003aull; /* 1MB L2 cache */
+
+    /* From 3.2.115 SCTLR_EL3 */
+    cpu->reset_sctlr = 0x30c50838;
+
+    /* From 3.4.8 ICC_CTLR_EL3 and 3.4.23 ICH_VTR_EL2 */
+    cpu->gic_num_lrs = 4;
+    cpu->gic_vpribits = 5;
+    cpu->gic_vprebits = 5;
+    cpu->gic_pribits = 5;
+
+    /* From 3.5.1 AdvSIMD AArch64 register summary */
+    cpu->isar.mvfr0 = 0x10110222;
+    cpu->isar.mvfr1 = 0x13211111;
+    cpu->isar.mvfr2 = 0x00000043;
+
+    /* From 3.7.5 ID_AA64ZFR0_EL1 */
+    cpu->isar.id_aa64zfr0 = 0x0000100000100000;
+    cpu->sve_vq.supported = (1 << 0)  /* 128bit */
+                            | (1 << 1);  /* 256bit */
+
+    /* From 5.5.1 AArch64 PMU register summary */
+    cpu->isar.reset_pmcr_el0 = 0x41213000;
+
+    define_neoverse_v1_cp_reginfo(cpu);
+
+    aarch64_add_pauth_properties(obj);
+    aarch64_add_sve_properties(obj);
+}
+
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu32.c;
@@ -763,6 +890,7 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
     { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
     { .name = "neoverse-n1",        .initfn = aarch64_neoverse_n1_initfn },
+    { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
 };
 
 static void aarch64_cpu_register_types(void)

From c41077235168140cdd4a34fce9bd95c3d30efe9c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 4 Jul 2023 16:43:32 +0100
Subject: [PATCH 0405/1353] target/arm: Avoid over-length shift in
 arm_cpu_sve_finalize() error case
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If you build QEMU with the clang sanitizer enabled, you can see it
fire when running the arm-cpu-features test:

$ QTEST_QEMU_BINARY=./build/arm-clang/qemu-system-aarch64 ./build/arm-clang/tests/qtest/arm-cpu-features
[...]
../../target/arm/cpu64.c:125:19: runtime error: shift exponent 64 is too large for 64-bit type 'unsigned long long'
[...]

This happens because the user can specify some incorrect SVE
properties that result in our calculating a max_vq of 0.  We catch
this and error out, but before we do that we calculate

 vq_mask = MAKE_64BIT_MASK(0, max_vq);$

and the MAKE_64BIT_MASK() call is only valid for lengths that are
greater than zero, so we hit the undefined behaviour.

Change the logic so that if max_vq is 0 we specifically set vq_mask
to 0 without going via MAKE_64BIT_MASK().  This lets us drop the
max_vq check from the error-exit logic, because if max_vq is 0 then
vq_map must now be 0.

The UB only happens in the case where the user passed us an incorrect
set of SVE properties, so it's not a big problem in practice.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230704154332.3014896-1-peter.maydell@linaro.org
---
 target/arm/cpu64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 6eaf8e32cf..6012e4ef54 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -122,10 +122,10 @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
         vq = ctz32(tmp) + 1;
 
         max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
-        vq_mask = MAKE_64BIT_MASK(0, max_vq);
+        vq_mask = max_vq > 0 ? MAKE_64BIT_MASK(0, max_vq) : 0;
         vq_map = vq_supported & ~vq_init & vq_mask;
 
-        if (max_vq == 0 || vq_map == 0) {
+        if (vq_map == 0) {
             error_setg(errp, "cannot disable sve%d", vq * 128);
             error_append_hint(errp, "Disabling sve%d results in all "
                               "vector lengths being disabled.\n",

From b5ea6754e8f913c82197dc26973d7d7ee4aef91f Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Fri, 30 Jun 2023 12:26:09 +0200
Subject: [PATCH 0406/1353] pnv/psi: Allow access to PSI registers through
 xscom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

skiboot only uses mmio to access the PSI registers (once the BAR is
set) but we don't have any reason to block the accesses through
xscom. This patch enables xscom access to the PSI registers. It
converts the xscom addresses to mmio addresses, which requires a bit
of care for the PSIHB, then reuse the existing mmio ops.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230630102609.193214-1-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_psi.c | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index 8aa09ab26b..46da58dff8 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -121,8 +121,12 @@
 #define PSIHB9_BAR_MASK                 0x00fffffffff00000ull
 #define PSIHB9_FSPBAR_MASK              0x00ffffff00000000ull
 
+/* mmio address to xscom address */
 #define PSIHB_REG(addr) (((addr) >> 3) + PSIHB_XSCOM_BAR)
 
+/* xscom address to mmio address */
+#define PSIHB_MMIO(reg) ((reg - PSIHB_XSCOM_BAR) << 3)
+
 static void pnv_psi_set_bar(PnvPsi *psi, uint64_t bar)
 {
     PnvPsiClass *ppc = PNV_PSI_GET_CLASS(psi);
@@ -769,24 +773,31 @@ static const MemoryRegionOps pnv_psi_p9_mmio_ops = {
 
 static uint64_t pnv_psi_p9_xscom_read(void *opaque, hwaddr addr, unsigned size)
 {
-    /* No read are expected */
-    qemu_log_mask(LOG_GUEST_ERROR, "PSI: xscom read at 0x%" PRIx64 "\n", addr);
-    return -1;
+    uint32_t reg = addr >> 3;
+    uint64_t val = -1;
+
+    if (reg < PSIHB_XSCOM_BAR) {
+        /* FIR, not modeled */
+        qemu_log_mask(LOG_UNIMP, "PSI: xscom read at 0x%08x\n", reg);
+    } else {
+        val = pnv_psi_p9_mmio_read(opaque, PSIHB_MMIO(reg), size);
+    }
+    return val;
 }
 
 static void pnv_psi_p9_xscom_write(void *opaque, hwaddr addr,
                                 uint64_t val, unsigned size)
 {
     PnvPsi *psi = PNV_PSI(opaque);
+    uint32_t reg = addr >> 3;
 
-    /* XSCOM is only used to set the PSIHB MMIO region */
-    switch (addr >> 3) {
-    case PSIHB_XSCOM_BAR:
+    if (reg < PSIHB_XSCOM_BAR) {
+        /* FIR, not modeled */
+        qemu_log_mask(LOG_UNIMP, "PSI: xscom write at 0x%08x\n", reg);
+    } else if (reg == PSIHB_XSCOM_BAR) {
         pnv_psi_set_bar(psi, val);
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR, "PSI: xscom write at 0x%" PRIx64 "\n",
-                      addr);
+    } else {
+        pnv_psi_p9_mmio_write(opaque, PSIHB_MMIO(reg), val, size);
     }
 }
 

From a5ff7875a9e50180c354471f931f863a26283ce1 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Sun, 25 Jun 2023 22:20:45 +1000
Subject: [PATCH 0407/1353] target/ppc: Make HDECR underflow edge triggered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HDEC interrupts are edge-triggered on HDECR underflow (notably different
from DEC which is level-triggered).

HDEC interrupts already clear the irq on delivery so that does not need
to be changed.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230625122045.15544-1-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 82e4408c5c..0fc82bb175 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -788,8 +788,8 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
                                  QEMUTimer *timer,
                                  void (*raise_excp)(void *),
                                  void (*lower_excp)(PowerPCCPU *),
-                                 target_ulong decr, target_ulong value,
-                                 int nr_bits)
+                                 uint32_t flags, target_ulong decr,
+                                 target_ulong value, int nr_bits)
 {
     CPUPPCState *env = &cpu->env;
     ppc_tb_t *tb_env = env->tb_env;
@@ -819,15 +819,15 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
      * On MSB edge based DEC implementations the MSB going from 0 -> 1 triggers
      * an edge interrupt, so raise it here too.
      */
-    if (((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && signed_value < 0) ||
-        ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && signed_value < 0
+    if (((flags & PPC_DECR_UNDERFLOW_LEVEL) && signed_value < 0) ||
+        ((flags & PPC_DECR_UNDERFLOW_TRIGGERED) && signed_value < 0
           && signed_decr >= 0)) {
         (*raise_excp)(cpu);
         return;
     }
 
     /* On MSB level based systems a 0 for the MSB stops interrupt delivery */
-    if (signed_value >= 0 && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
+    if (signed_value >= 0 && (flags & PPC_DECR_UNDERFLOW_LEVEL)) {
         (*lower_excp)(cpu);
     }
 
@@ -846,8 +846,8 @@ static inline void _cpu_ppc_store_decr(PowerPCCPU *cpu, target_ulong decr,
     ppc_tb_t *tb_env = cpu->env.tb_env;
 
     __cpu_ppc_store_decr(cpu, &tb_env->decr_next, tb_env->decr_timer,
-                         tb_env->decr_timer->cb, &cpu_ppc_decr_lower, decr,
-                         value, nr_bits);
+                         tb_env->decr_timer->cb, &cpu_ppc_decr_lower,
+                         tb_env->flags, decr, value, nr_bits);
 }
 
 void cpu_ppc_store_decr(CPUPPCState *env, target_ulong value)
@@ -876,8 +876,10 @@ static inline void _cpu_ppc_store_hdecr(PowerPCCPU *cpu, target_ulong hdecr,
     ppc_tb_t *tb_env = cpu->env.tb_env;
 
     if (tb_env->hdecr_timer != NULL) {
+        /* HDECR (Book3S 64bit) is edge-based, not level like DECR */
         __cpu_ppc_store_decr(cpu, &tb_env->hdecr_next, tb_env->hdecr_timer,
                              tb_env->hdecr_timer->cb, &cpu_ppc_hdecr_lower,
+                             PPC_DECR_UNDERFLOW_TRIGGERED,
                              hdecr, value, nr_bits);
     }
 }

From 2ad2e113deb5663e69a05dd6922cbfc6d7ea34d3 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 29 Jun 2023 12:07:13 +1000
Subject: [PATCH 0408/1353] hw/ppc: Fix clock update drift
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The clock update logic reads the clock twice to compute the new clock
value, with a value derived from the later time subtracted from a value
derived from the earlier time. The delta causes time to be lost.

This can ultimately result in time becoming unsynchronized between CPUs
and that can cause OS lockups, timeouts, watchdogs, etc. This can be
seen running a KVM guest (that causes lots of TB updates) on a powernv
SMP machine.

Fix this by reading the clock once.

Cc: qemu-stable@nongnu.org
Fixes: dbdd25065e90 ("Implement time-base start/stop helpers.")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
Message-ID: <20230629020713.327745-1-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 0fc82bb175..0e0a3d93c3 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -535,23 +535,24 @@ static inline void cpu_ppc_store_tb(ppc_tb_t *tb_env, uint64_t vmclk,
 void cpu_ppc_store_tbl (CPUPPCState *env, uint32_t value)
 {
     ppc_tb_t *tb_env = env->tb_env;
+    int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, clock, tb_env->tb_offset);
     tb &= 0xFFFFFFFF00000000ULL;
-    cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                     &tb_env->tb_offset, tb | (uint64_t)value);
+    cpu_ppc_store_tb(tb_env, clock, &tb_env->tb_offset, tb | (uint64_t)value);
 }
 
 static inline void _cpu_ppc_store_tbu(CPUPPCState *env, uint32_t value)
 {
     ppc_tb_t *tb_env = env->tb_env;
+    int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, clock, tb_env->tb_offset);
     tb &= 0x00000000FFFFFFFFULL;
-    cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                     &tb_env->tb_offset, ((uint64_t)value << 32) | tb);
+    cpu_ppc_store_tb(tb_env, clock, &tb_env->tb_offset,
+                     ((uint64_t)value << 32) | tb);
 }
 
 void cpu_ppc_store_tbu (CPUPPCState *env, uint32_t value)
@@ -584,23 +585,24 @@ uint32_t cpu_ppc_load_atbu (CPUPPCState *env)
 void cpu_ppc_store_atbl (CPUPPCState *env, uint32_t value)
 {
     ppc_tb_t *tb_env = env->tb_env;
+    int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->atb_offset);
+    tb = cpu_ppc_get_tb(tb_env, clock, tb_env->atb_offset);
     tb &= 0xFFFFFFFF00000000ULL;
-    cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                     &tb_env->atb_offset, tb | (uint64_t)value);
+    cpu_ppc_store_tb(tb_env, clock, &tb_env->atb_offset, tb | (uint64_t)value);
 }
 
 void cpu_ppc_store_atbu (CPUPPCState *env, uint32_t value)
 {
     ppc_tb_t *tb_env = env->tb_env;
+    int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL), tb_env->atb_offset);
+    tb = cpu_ppc_get_tb(tb_env, clock, tb_env->atb_offset);
     tb &= 0x00000000FFFFFFFFULL;
-    cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                     &tb_env->atb_offset, ((uint64_t)value << 32) | tb);
+    cpu_ppc_store_tb(tb_env, clock, &tb_env->atb_offset,
+                     ((uint64_t)value << 32) | tb);
 }
 
 uint64_t cpu_ppc_load_vtb(CPUPPCState *env)
@@ -622,14 +624,13 @@ void cpu_ppc_store_vtb(CPUPPCState *env, uint64_t value)
 void cpu_ppc_store_tbu40(CPUPPCState *env, uint64_t value)
 {
     ppc_tb_t *tb_env = env->tb_env;
+    int64_t clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     uint64_t tb;
 
-    tb = cpu_ppc_get_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                        tb_env->tb_offset);
+    tb = cpu_ppc_get_tb(tb_env, clock, tb_env->tb_offset);
     tb &= 0xFFFFFFUL;
     tb |= (value & ~0xFFFFFFUL);
-    cpu_ppc_store_tb(tb_env, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-                     &tb_env->tb_offset, tb);
+    cpu_ppc_store_tb(tb_env, clock, &tb_env->tb_offset, tb);
 }
 
 static void cpu_ppc_tb_stop (CPUPPCState *env)

From 28eafc1270c5878a2f2538b8050443f88c5c9282 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 26 Jun 2023 16:01:00 +0200
Subject: [PATCH 0409/1353] target/ppc: Only generate decodetree files when TCG
 is enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No need to generate TCG-specific decodetree files
when TCG is disabled.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230626140100.67941-1-philmd@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/meson.build b/target/ppc/meson.build
index a69f174f41..4c2635039e 100644
--- a/target/ppc/meson.build
+++ b/target/ppc/meson.build
@@ -28,7 +28,7 @@ gen = [
                      extra_args: ['--static-decode=decode_insn64',
                                   '--insnwidth=64']),
 ]
-ppc_ss.add(gen)
+ppc_ss.add(when: 'CONFIG_TCG', if_true: gen)
 
 ppc_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 ppc_ss.add(when: 'CONFIG_USER_ONLY', if_true: files('user_only_helper.c'))

From 32be62a3d811fa9f389ff791ac6c5cecf69b2109 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Mon, 5 Jun 2023 23:51:45 +0200
Subject: [PATCH 0410/1353] mv64361: Add dummy gigabit ethernet PHY access
 registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't emulate the gigabit ethernet part of the chip but the MorphOS
driver accesses these and expects to get some valid looking result
otherwise it hangs. Add some minimal dummy implementation to avoid rhis.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230605215145.29458746335@zero.eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/pci-host/mv64361.c | 6 ++++++
 hw/pci-host/mv643xx.h | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/hw/pci-host/mv64361.c b/hw/pci-host/mv64361.c
index 19e8031a3f..01bd8c887f 100644
--- a/hw/pci-host/mv64361.c
+++ b/hw/pci-host/mv64361.c
@@ -541,6 +541,12 @@ static uint64_t mv64361_read(void *opaque, hwaddr addr, unsigned int size)
             }
         }
         break;
+    case MV64340_ETH_PHY_ADDR:
+        ret = 0x98;
+        break;
+    case MV64340_ETH_SMI:
+        ret = BIT(27);
+        break;
     case MV64340_CUNIT_ARBITER_CONTROL_REG:
         ret = 0x11ff0000 | (s->gpp_int_level << 10);
         break;
diff --git a/hw/pci-host/mv643xx.h b/hw/pci-host/mv643xx.h
index cd26a43f18..f2e1baea88 100644
--- a/hw/pci-host/mv643xx.h
+++ b/hw/pci-host/mv643xx.h
@@ -656,6 +656,9 @@
 /*        Ethernet Unit Registers       */
 /****************************************/
 
+#define MV64340_ETH_PHY_ADDR                                        0x2000
+#define MV64340_ETH_SMI                                             0x2004
+
 /*******************************************/
 /*          CUNIT  Registers               */
 /*******************************************/

From 6f967f4f7869cd393585946ed43427c626a15d40 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Sun, 25 Jun 2023 22:03:16 +1000
Subject: [PATCH 0411/1353] target/ppc: Tidy POWER book4 SPR registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

POWER book4 (implementation-specific) SPRs are sometimes in their own
functions, but in other cases are mixed with architected SPRs. Do some
spring cleaning on these.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230625120317.13877-2-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu_init.c | 82 +++++++++++++++++++++++++++++--------------
 1 file changed, 55 insertions(+), 27 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index aeff71d063..dc93581dd3 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -5370,31 +5370,6 @@ static void register_book3s_ids_sprs(CPUPPCState *env)
                  &spr_read_generic, SPR_NOACCESS,
                  &spr_read_generic, NULL,
                  0x00000000);
-    spr_register_hv(env, SPR_HID0, "HID0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    spr_register_hv(env, SPR_TSCR, "TSCR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic32,
-                 0x00000000);
-    spr_register_hv(env, SPR_HMER, "HMER",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_hmer,
-                 0x00000000);
-    spr_register_hv(env, SPR_HMEER, "HMEER",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-    spr_register_hv(env, SPR_TFMR, "TFMR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
     spr_register_hv(env, SPR_LPIDR, "LPIDR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  SPR_NOACCESS, SPR_NOACCESS,
@@ -5656,14 +5631,60 @@ static void register_power8_ic_sprs(CPUPPCState *env)
 #endif
 }
 
+/* SPRs specific to IBM POWER CPUs */
+static void register_power_common_book4_sprs(CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    spr_register_hv(env, SPR_HID0, "HID0",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register_hv(env, SPR_TSCR, "TSCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic32,
+                 0x00000000);
+    spr_register_hv(env, SPR_HMER, "HMER",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_hmer,
+                 0x00000000);
+    spr_register_hv(env, SPR_HMEER, "HMEER",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register_hv(env, SPR_TFMR, "TFMR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+#endif
+}
+
+static void register_power9_book4_sprs(CPUPPCState *env)
+{
+    /* Add a number of P9 book4 registers */
+    register_power_common_book4_sprs(env);
+#if !defined(CONFIG_USER_ONLY)
+    spr_register_kvm(env, SPR_WORT, "WORT",
+                     SPR_NOACCESS, SPR_NOACCESS,
+                     &spr_read_generic, &spr_write_generic,
+                     KVM_REG_PPC_WORT, 0);
+#endif
+}
+
 static void register_power8_book4_sprs(CPUPPCState *env)
 {
     /* Add a number of P8 book4 registers */
+    register_power_common_book4_sprs(env);
 #if !defined(CONFIG_USER_ONLY)
     spr_register_kvm(env, SPR_ACOP, "ACOP",
                      SPR_NOACCESS, SPR_NOACCESS,
                      &spr_read_generic, &spr_write_generic,
                      KVM_REG_PPC_ACOP, 0);
+    /* PID is only in BookE in ISA v2.07 */
     spr_register_kvm(env, SPR_BOOKS_PID, "PID",
                      SPR_NOACCESS, SPR_NOACCESS,
                      &spr_read_generic, &spr_write_pidr,
@@ -5679,10 +5700,12 @@ static void register_power7_book4_sprs(CPUPPCState *env)
 {
     /* Add a number of P7 book4 registers */
 #if !defined(CONFIG_USER_ONLY)
+    register_power_common_book4_sprs(env);
     spr_register_kvm(env, SPR_ACOP, "ACOP",
                      SPR_NOACCESS, SPR_NOACCESS,
                      &spr_read_generic, &spr_write_generic,
                      KVM_REG_PPC_ACOP, 0);
+    /* PID is only in BookE in ISA v2.06 */
     spr_register_kvm(env, SPR_BOOKS_PID, "PID",
                      SPR_NOACCESS, SPR_NOACCESS,
                      &spr_read_generic, &spr_write_generic32,
@@ -5716,6 +5739,11 @@ static void register_power9_mmu_sprs(CPUPPCState *env)
                     SPR_NOACCESS, SPR_NOACCESS,
                     &spr_read_generic, &spr_write_generic,
                     0x0000000000000000);
+    /* PID is part of the BookS ISA from v3.0 */
+    spr_register_kvm(env, SPR_BOOKS_PID, "PID",
+                     SPR_NOACCESS, SPR_NOACCESS,
+                     &spr_read_generic, &spr_write_pidr,
+                     KVM_REG_PPC_PID, 0);
 #endif
 }
 
@@ -6269,7 +6297,7 @@ static void init_proc_POWER9(CPUPPCState *env)
     register_power8_dpdes_sprs(env);
     register_vtb_sprs(env);
     register_power8_ic_sprs(env);
-    register_power8_book4_sprs(env);
+    register_power9_book4_sprs(env);
     register_power8_rpr_sprs(env);
     register_power9_mmu_sprs(env);
 
@@ -6462,7 +6490,7 @@ static void init_proc_POWER10(CPUPPCState *env)
     register_power8_dpdes_sprs(env);
     register_vtb_sprs(env);
     register_power8_ic_sprs(env);
-    register_power8_book4_sprs(env);
+    register_power9_book4_sprs(env);
     register_power8_rpr_sprs(env);
     register_power9_mmu_sprs(env);
     register_power10_hash_sprs(env);

From b25f2ffa19c0f4a79de0315d4eade36ce76b031c Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Sun, 25 Jun 2023 22:03:17 +1000
Subject: [PATCH 0412/1353] target/ppc: Add TFMR SPR implementation with read
 and write helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TFMR is the Time Facility Management Register which is specific to
POWER CPUs, and used for the purpose of timebase management (generally
by firmware, not the OS).

Add helpers for the TFMR register, which will form part of the core
timebase facility model in future but for now behaviour is unchanged.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230625120317.13877-3-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu_init.c        |  2 +-
 target/ppc/helper.h          |  2 ++
 target/ppc/spr_common.h      |  2 ++
 target/ppc/timebase_helper.c | 13 +++++++++++++
 target/ppc/translate.c       | 10 ++++++++++
 5 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index dc93581dd3..5f4969664e 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -5658,7 +5658,7 @@ static void register_power_common_book4_sprs(CPUPPCState *env)
     spr_register_hv(env, SPR_TFMR, "TFMR",
                  SPR_NOACCESS, SPR_NOACCESS,
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_tfmr, &spr_write_tfmr,
                  0x00000000);
 #endif
 }
diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index fda40b8a60..828f7844c8 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -722,6 +722,8 @@ DEF_HELPER_FLAGS_1(load_dpdes, TCG_CALL_NO_RWG, tl, env)
 DEF_HELPER_FLAGS_2(store_dpdes, TCG_CALL_NO_RWG, void, env, tl)
 DEF_HELPER_2(book3s_msgsndp, void, env, tl)
 DEF_HELPER_2(book3s_msgclrp, void, env, tl)
+DEF_HELPER_1(load_tfmr, tl, env)
+DEF_HELPER_2(store_tfmr, void, env, tl)
 #endif
 DEF_HELPER_2(store_sdr1, void, env, tl)
 DEF_HELPER_2(store_pidr, void, env, tl)
diff --git a/target/ppc/spr_common.h b/target/ppc/spr_common.h
index 4c0f2bed77..fbf52123b5 100644
--- a/target/ppc/spr_common.h
+++ b/target/ppc/spr_common.h
@@ -194,6 +194,8 @@ void spr_write_ebb(DisasContext *ctx, int sprn, int gprn);
 void spr_read_ebb_upper32(DisasContext *ctx, int gprn, int sprn);
 void spr_write_ebb_upper32(DisasContext *ctx, int sprn, int gprn);
 void spr_write_hmer(DisasContext *ctx, int sprn, int gprn);
+void spr_read_tfmr(DisasContext *ctx, int gprn, int sprn);
+void spr_write_tfmr(DisasContext *ctx, int sprn, int gprn);
 void spr_write_lpcr(DisasContext *ctx, int sprn, int gprn);
 void spr_read_dexcr_ureg(DisasContext *ctx, int gprn, int sprn);
 #endif
diff --git a/target/ppc/timebase_helper.c b/target/ppc/timebase_helper.c
index b80f56af7e..08a6b47ee0 100644
--- a/target/ppc/timebase_helper.c
+++ b/target/ppc/timebase_helper.c
@@ -144,6 +144,19 @@ void helper_store_booke_tsr(CPUPPCState *env, target_ulong val)
     store_booke_tsr(env, val);
 }
 
+#if defined(TARGET_PPC64)
+/* POWER processor Timebase Facility */
+target_ulong helper_load_tfmr(CPUPPCState *env)
+{
+    return env->spr[SPR_TFMR];
+}
+
+void helper_store_tfmr(CPUPPCState *env, target_ulong val)
+{
+    env->spr[SPR_TFMR] = val;
+}
+#endif
+
 /*****************************************************************************/
 /* Embedded PowerPC specific helpers */
 
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 372ee600b2..599bd4b4f9 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -1175,6 +1175,16 @@ void spr_write_hmer(DisasContext *ctx, int sprn, int gprn)
     spr_store_dump_spr(sprn);
 }
 
+void spr_read_tfmr(DisasContext *ctx, int gprn, int sprn)
+{
+    gen_helper_load_tfmr(cpu_gpr[gprn], cpu_env);
+}
+
+void spr_write_tfmr(DisasContext *ctx, int sprn, int gprn)
+{
+    gen_helper_store_tfmr(cpu_env, cpu_gpr[gprn]);
+}
+
 void spr_write_lpcr(DisasContext *ctx, int sprn, int gprn)
 {
     gen_helper_store_lpcr(cpu_env, cpu_gpr[gprn]);

From bc65beb3a412b3d6d7e16d9f11a9712a086aae02 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 26 Jun 2023 06:16:28 +1000
Subject: [PATCH 0413/1353] sungem: Add WOL MMIO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apple sungem devices are expected to have WOL MMIO registers.
Add a region to prevent transaction failures, and implement the
WOL-disable CSR write because the Linux driver reset writes
this.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20230625201628.65231-1-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/net/sungem.c     | 52 +++++++++++++++++++++++++++++++++++++++++++++
 hw/net/trace-events |  2 ++
 2 files changed, 54 insertions(+)

diff --git a/hw/net/sungem.c b/hw/net/sungem.c
index eb01520790..e0e8e5ae41 100644
--- a/hw/net/sungem.c
+++ b/hw/net/sungem.c
@@ -107,6 +107,15 @@ OBJECT_DECLARE_SIMPLE_TYPE(SunGEMState, SUNGEM)
 #define RXDMA_FTAG        0x0110UL    /* RX FIFO Tag */
 #define RXDMA_FSZ         0x0120UL    /* RX FIFO Size */
 
+/* WOL Registers */
+#define SUNGEM_MMIO_WOL_SIZE   0x14
+
+#define WOL_MATCH0        0x0000UL
+#define WOL_MATCH1        0x0004UL
+#define WOL_MATCH2        0x0008UL
+#define WOL_MCOUNT        0x000CUL
+#define WOL_WAKECSR       0x0010UL
+
 /* MAC Registers */
 #define SUNGEM_MMIO_MAC_SIZE   0x200
 
@@ -168,6 +177,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(SunGEMState, SUNGEM)
 #define SUNGEM_MMIO_PCS_SIZE   0x60
 #define PCS_MIISTAT       0x0004UL    /* PCS MII Status Register */
 #define PCS_ISTAT         0x0018UL    /* PCS Interrupt Status Reg */
+
 #define PCS_SSTATE        0x005CUL    /* Serialink State Register */
 
 /* Descriptors */
@@ -200,6 +210,7 @@ struct SunGEMState {
     MemoryRegion greg;
     MemoryRegion txdma;
     MemoryRegion rxdma;
+    MemoryRegion wol;
     MemoryRegion mac;
     MemoryRegion mif;
     MemoryRegion pcs;
@@ -1076,6 +1087,43 @@ static const MemoryRegionOps sungem_mmio_rxdma_ops = {
     },
 };
 
+static void sungem_mmio_wol_write(void *opaque, hwaddr addr, uint64_t val,
+                                    unsigned size)
+{
+    trace_sungem_mmio_wol_write(addr, val);
+
+    switch (addr) {
+    case WOL_WAKECSR:
+        if (val != 0) {
+            qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n");
+        }
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n");
+    }
+}
+
+static uint64_t sungem_mmio_wol_read(void *opaque, hwaddr addr, unsigned size)
+{
+    uint32_t val = -1;
+
+    qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n");
+
+    trace_sungem_mmio_wol_read(addr, val);
+
+    return val;
+}
+
+static const MemoryRegionOps sungem_mmio_wol_ops = {
+    .read = sungem_mmio_wol_read,
+    .write = sungem_mmio_wol_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
 static void sungem_mmio_mac_write(void *opaque, hwaddr addr, uint64_t val,
                                   unsigned size)
 {
@@ -1344,6 +1392,10 @@ static void sungem_realize(PCIDevice *pci_dev, Error **errp)
                           "sungem.rxdma", SUNGEM_MMIO_RXDMA_SIZE);
     memory_region_add_subregion(&s->sungem, 0x4000, &s->rxdma);
 
+    memory_region_init_io(&s->wol, OBJECT(s), &sungem_mmio_wol_ops, s,
+                          "sungem.wol", SUNGEM_MMIO_WOL_SIZE);
+    memory_region_add_subregion(&s->sungem, 0x3000, &s->wol);
+
     memory_region_init_io(&s->mac, OBJECT(s), &sungem_mmio_mac_ops, s,
                           "sungem.mac", SUNGEM_MMIO_MAC_SIZE);
     memory_region_add_subregion(&s->sungem, 0x6000, &s->mac);
diff --git a/hw/net/trace-events b/hw/net/trace-events
index e4a98b2c7d..930e5b4293 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -350,6 +350,8 @@ sungem_mmio_txdma_write(uint64_t addr, uint64_t val) "MMIO txdma write to 0x%"PR
 sungem_mmio_txdma_read(uint64_t addr, uint64_t val) "MMIO txdma read from 0x%"PRIx64" val=0x%"PRIx64
 sungem_mmio_rxdma_write(uint64_t addr, uint64_t val) "MMIO rxdma write to 0x%"PRIx64" val=0x%"PRIx64
 sungem_mmio_rxdma_read(uint64_t addr, uint64_t val) "MMIO rxdma read from 0x%"PRIx64" val=0x%"PRIx64
+sungem_mmio_wol_write(uint64_t addr, uint64_t val) "MMIO wol write to 0x%"PRIx64" val=0x%"PRIx64
+sungem_mmio_wol_read(uint64_t addr, uint64_t val) "MMIO wol read from 0x%"PRIx64" val=0x%"PRIx64
 sungem_mmio_mac_write(uint64_t addr, uint64_t val) "MMIO mac write to 0x%"PRIx64" val=0x%"PRIx64
 sungem_mmio_mac_read(uint64_t addr, uint64_t val) "MMIO mac read from 0x%"PRIx64" val=0x%"PRIx64
 sungem_mmio_mif_write(uint64_t addr, uint64_t val) "MMIO mif write to 0x%"PRIx64" val=0x%"PRIx64

From c32654af150191e376d2d89dba4afbb31c8e9958 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Sun, 25 Jun 2023 20:36:59 +1000
Subject: [PATCH 0414/1353] target/ppc: Fix icount access for some hypervisor
 instructions

Several instructions and register access require icount reads and are
missing translator_io_start().

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230625103700.8992-1-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/translate.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 599bd4b4f9..4766240927 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -1187,6 +1187,7 @@ void spr_write_tfmr(DisasContext *ctx, int sprn, int gprn)
 
 void spr_write_lpcr(DisasContext *ctx, int sprn, int gprn)
 {
+    translator_io_start(&ctx->base);
     gen_helper_store_lpcr(cpu_env, cpu_gpr[gprn]);
 }
 #endif /* !defined(CONFIG_USER_ONLY) */
@@ -4012,6 +4013,7 @@ static void gen_doze(DisasContext *ctx)
     TCGv_i32 t;
 
     CHK_HV(ctx);
+    translator_io_start(&ctx->base);
     t = tcg_constant_i32(PPC_PM_DOZE);
     gen_helper_pminsn(cpu_env, t);
     /* Stop translation, as the CPU is supposed to sleep from now */
@@ -4027,6 +4029,7 @@ static void gen_nap(DisasContext *ctx)
     TCGv_i32 t;
 
     CHK_HV(ctx);
+    translator_io_start(&ctx->base);
     t = tcg_constant_i32(PPC_PM_NAP);
     gen_helper_pminsn(cpu_env, t);
     /* Stop translation, as the CPU is supposed to sleep from now */
@@ -4042,6 +4045,7 @@ static void gen_stop(DisasContext *ctx)
     TCGv_i32 t;
 
     CHK_HV(ctx);
+    translator_io_start(&ctx->base);
     t = tcg_constant_i32(PPC_PM_STOP);
     gen_helper_pminsn(cpu_env, t);
     /* Stop translation, as the CPU is supposed to sleep from now */
@@ -4057,6 +4061,7 @@ static void gen_sleep(DisasContext *ctx)
     TCGv_i32 t;
 
     CHK_HV(ctx);
+    translator_io_start(&ctx->base);
     t = tcg_constant_i32(PPC_PM_SLEEP);
     gen_helper_pminsn(cpu_env, t);
     /* Stop translation, as the CPU is supposed to sleep from now */
@@ -4072,6 +4077,7 @@ static void gen_rvwinkle(DisasContext *ctx)
     TCGv_i32 t;
 
     CHK_HV(ctx);
+    translator_io_start(&ctx->base);
     t = tcg_constant_i32(PPC_PM_RVWINKLE);
     gen_helper_pminsn(cpu_env, t);
     /* Stop translation, as the CPU is supposed to sleep from now */
@@ -4468,6 +4474,7 @@ static void gen_hrfid(DisasContext *ctx)
 #else
     /* Restore CPU state */
     CHK_HV(ctx);
+    translator_io_start(&ctx->base);
     gen_helper_hrfid(cpu_env);
     ctx->base.is_jmp = DISAS_EXIT;
 #endif

From d2b4e29768d783a85a3756bf349ca33f63688ba1 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Sun, 25 Jun 2023 20:37:00 +1000
Subject: [PATCH 0415/1353] tests/avocado: record_replay test for ppc powernv
 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The powernv machine can boot Linux to VFS mount with icount enabled.
Add a test case for it.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230625103700.8992-2-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 tests/avocado/replay_kernel.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
index fe1e901f4b..79c607b0e7 100644
--- a/tests/avocado/replay_kernel.py
+++ b/tests/avocado/replay_kernel.py
@@ -259,6 +259,23 @@ class ReplayKernelNormal(ReplayKernelBase):
         console_pattern = 'Kernel command line: %s' % kernel_command_line
         self.run_rr(kernel_path, kernel_command_line, console_pattern)
 
+    def test_ppc64_powernv(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:powernv
+        :avocado: tags=accel:tcg
+        """
+        kernel_url = ('https://archives.fedoraproject.org/pub/archive'
+                      '/fedora-secondary/releases/29/Everything/ppc64le/os'
+                      '/ppc/ppc64/vmlinuz')
+        kernel_hash = '3fe04abfc852b66653b8c3c897a59a689270bc77'
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
+
+        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + \
+                              'console=tty0 console=hvc0'
+        console_pattern = 'VFS: Cannot open root device'
+        self.run_rr(kernel_path, kernel_command_line, console_pattern)
+
     def test_m68k_q800(self):
         """
         :avocado: tags=arch:m68k

From d73a17515035a006eb09272b8d554833e11140bb Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Mon, 26 Jun 2023 11:40:57 +0200
Subject: [PATCH 0416/1353] pnv/xive2: Allow indirect TIMA accesses of all
 sizes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Booting linux on the powernv10 machine logs a few errors like:

Invalid read at addr 0x38, size 1, region 'xive-ic-tm-indirect', reason: invalid size (min:8 max:8)
Invalid write at addr 0x38, size 1, region 'xive-ic-tm-indirect', reason: invalid size (min:8 max:8)
Invalid read at addr 0x38, size 1, region 'xive-ic-tm-indirect', reason: invalid size (min:8 max:8)

Those errors happen when linux is resetting XIVE. We're trying to
read/write the enablement bit for the hardware context and qemu
doesn't allow indirect TIMA accesses of less than 8 bytes. Direct TIMA
access can go through though, as well as indirect TIMA accesses on P9.
So even though there are some restrictions regarding the address/size
combinations for TIMA access, the example above is perfectly valid.

This patch lets indirect TIMA accesses of all sizes go through. The
special operations will be intercepted and the default "raw" handlers
will pick up all other requests and complain about invalid sizes as
appropriate.

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230626094057.1192473-1-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/intc/pnv_xive2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index ed438a20ed..e8ab176de6 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1644,11 +1644,11 @@ static const MemoryRegionOps pnv_xive2_ic_tm_indirect_ops = {
     .write = pnv_xive2_ic_tm_indirect_write,
     .endianness = DEVICE_BIG_ENDIAN,
     .valid = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
 };

From 2306c60633f8f2811e5f42666b8155a8d2065154 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 16 Jun 2023 01:03:10 +0200
Subject: [PATCH 0417/1353] target/ppc: Remove some superfluous parentheses

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <8384ed0f7335093012bbd3d28fb2a543a2e7346c.1686868895.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/excp_helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 2158390e27..f51a8db075 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1030,7 +1030,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
     {
         int lev = env->error_code;
 
-        if ((lev == 1) && cpu->vhyp) {
+        if (lev == 1 && cpu->vhyp) {
             dump_hcall(env);
         } else {
             dump_syscall(env);
@@ -1048,7 +1048,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
          * uses VOF and the 74xx CPUs, so although the 74xx don't have
          * HV mode, we need to keep hypercall support.
          */
-        if ((lev == 1) && cpu->vhyp) {
+        if (lev == 1 && cpu->vhyp) {
             PPCVirtualHypervisorClass *vhc =
                 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
             vhc->hypercall(cpu->vhyp, cpu);
@@ -1572,7 +1572,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
     case POWERPC_EXCP_SYSCALL:   /* System call exception                    */
         lev = env->error_code;
 
-        if ((lev == 1) && cpu->vhyp) {
+        if (lev == 1 && cpu->vhyp) {
             dump_hcall(env);
         } else {
             dump_syscall(env);
@@ -1585,7 +1585,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
         env->nip += 4;
 
         /* "PAPR mode" built-in hypercall emulation */
-        if ((lev == 1) && books_vhyp_handles_hcall(cpu)) {
+        if (lev == 1 && books_vhyp_handles_hcall(cpu)) {
             PPCVirtualHypervisorClass *vhc =
                 PPC_VIRTUAL_HYPERVISOR_GET_CLASS(cpu->vhyp);
             vhc->hypercall(cpu->vhyp, cpu);

From 3f88a89d10b2391a6cce1d3e1c77bafc586f215d Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 16 Jun 2023 01:03:11 +0200
Subject: [PATCH 0418/1353] target/ppc: Remove unneeded parameter from
 powerpc_reset_wakeup()

CPUState is rarely needed by this function (only for logging a fatal
error) and it's easy to get from the env parameter so passing it
separately is not necessary.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <f42761401c708fd6e02f7523d9f709b1972e5863.1686868895.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/excp_helper.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index f51a8db075..3ddec06f65 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -187,8 +187,7 @@ static void ppc_excp_debug_sw_tlb(CPUPPCState *env, int excp)
 }
 
 #if defined(TARGET_PPC64)
-static int powerpc_reset_wakeup(CPUState *cs, CPUPPCState *env, int excp,
-                                target_ulong *msr)
+static int powerpc_reset_wakeup(CPUPPCState *env, int excp, target_ulong *msr)
 {
     /* We no longer are in a PM state */
     env->resume_as_sreset = false;
@@ -223,8 +222,8 @@ static int powerpc_reset_wakeup(CPUState *cs, CPUPPCState *env, int excp,
         *msr |= SRR1_WAKEHVI;
         break;
     default:
-        cpu_abort(cs, "Unsupported exception %d in Power Save mode\n",
-                  excp);
+        cpu_abort(env_cpu(env),
+                  "Unsupported exception %d in Power Save mode\n", excp);
     }
     return POWERPC_EXCP_RESET;
 }
@@ -1440,7 +1439,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
      * P7/P8/P9
      */
     if (env->resume_as_sreset) {
-        excp = powerpc_reset_wakeup(cs, env, excp, &msr);
+        excp = powerpc_reset_wakeup(env, excp, &msr);
     }
 
     /*

From 819b31b0b43813a32c91bebf8c8dce82a9bff389 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 16 Jun 2023 01:03:12 +0200
Subject: [PATCH 0419/1353] target/ppc: Move common check in exception handlers
 to a function

All powerpc exception handlers share some code when handling machine
check exceptions. Move this to a common function.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <9cfffaa35aa894086dd092af6b0b26f2d62ff3de.1686868895.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/excp_helper.c | 114 +++++++++------------------------------
 1 file changed, 25 insertions(+), 89 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 3ddec06f65..d1d3d089a6 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -424,6 +424,25 @@ static void powerpc_set_excp_state(PowerPCCPU *cpu, target_ulong vector,
     env->reserve_addr = -1;
 }
 
+static void powerpc_mcheck_checkstop(CPUPPCState *env)
+{
+    CPUState *cs = env_cpu(env);
+
+    if (FIELD_EX64(env->msr, MSR, ME)) {
+        return;
+    }
+
+    /* Machine check exception is not enabled. Enter checkstop state. */
+    fprintf(stderr, "Machine check while not allowed. "
+            "Entering checkstop state\n");
+    if (qemu_log_separate()) {
+        qemu_log("Machine check while not allowed. "
+                 "Entering checkstop state\n");
+    }
+    cs->halted = 1;
+    cpu_interrupt_exittb(cs);
+}
+
 static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
 {
     CPUState *cs = CPU(cpu);
@@ -466,21 +485,7 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
         srr1 = SPR_40x_SRR3;
         break;
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
-        if (!FIELD_EX64(env->msr, MSR, ME)) {
-            /*
-             * Machine check exception is not enabled.  Enter
-             * checkstop state.
-             */
-            fprintf(stderr, "Machine check while not allowed. "
-                    "Entering checkstop state\n");
-            if (qemu_log_separate()) {
-                qemu_log("Machine check while not allowed. "
-                        "Entering checkstop state\n");
-            }
-            cs->halted = 1;
-            cpu_interrupt_exittb(cs);
-        }
-
+        powerpc_mcheck_checkstop(env);
         /* machine check exceptions don't have ME set */
         new_msr &= ~((target_ulong)1 << MSR_ME);
 
@@ -597,21 +602,7 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
     case POWERPC_EXCP_CRITICAL:    /* Critical input                         */
         break;
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
-        if (!FIELD_EX64(env->msr, MSR, ME)) {
-            /*
-             * Machine check exception is not enabled.  Enter
-             * checkstop state.
-             */
-            fprintf(stderr, "Machine check while not allowed. "
-                    "Entering checkstop state\n");
-            if (qemu_log_separate()) {
-                qemu_log("Machine check while not allowed. "
-                        "Entering checkstop state\n");
-            }
-            cs->halted = 1;
-            cpu_interrupt_exittb(cs);
-        }
-
+        powerpc_mcheck_checkstop(env);
         /* machine check exceptions don't have ME set */
         new_msr &= ~((target_ulong)1 << MSR_ME);
 
@@ -770,21 +761,7 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
 
     switch (excp) {
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
-        if (!FIELD_EX64(env->msr, MSR, ME)) {
-            /*
-             * Machine check exception is not enabled.  Enter
-             * checkstop state.
-             */
-            fprintf(stderr, "Machine check while not allowed. "
-                    "Entering checkstop state\n");
-            if (qemu_log_separate()) {
-                qemu_log("Machine check while not allowed. "
-                        "Entering checkstop state\n");
-            }
-            cs->halted = 1;
-            cpu_interrupt_exittb(cs);
-        }
-
+        powerpc_mcheck_checkstop(env);
         /* machine check exceptions don't have ME set */
         new_msr &= ~((target_ulong)1 << MSR_ME);
 
@@ -955,21 +932,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
 
     switch (excp) {
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
-        if (!FIELD_EX64(env->msr, MSR, ME)) {
-            /*
-             * Machine check exception is not enabled.  Enter
-             * checkstop state.
-             */
-            fprintf(stderr, "Machine check while not allowed. "
-                    "Entering checkstop state\n");
-            if (qemu_log_separate()) {
-                qemu_log("Machine check while not allowed. "
-                        "Entering checkstop state\n");
-            }
-            cs->halted = 1;
-            cpu_interrupt_exittb(cs);
-        }
-
+        powerpc_mcheck_checkstop(env);
         /* machine check exceptions don't have ME set */
         new_msr &= ~((target_ulong)1 << MSR_ME);
 
@@ -1150,21 +1113,7 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
         srr1 = SPR_BOOKE_CSRR1;
         break;
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
-        if (!FIELD_EX64(env->msr, MSR, ME)) {
-            /*
-             * Machine check exception is not enabled.  Enter
-             * checkstop state.
-             */
-            fprintf(stderr, "Machine check while not allowed. "
-                    "Entering checkstop state\n");
-            if (qemu_log_separate()) {
-                qemu_log("Machine check while not allowed. "
-                        "Entering checkstop state\n");
-            }
-            cs->halted = 1;
-            cpu_interrupt_exittb(cs);
-        }
-
+        powerpc_mcheck_checkstop(env);
         /* machine check exceptions don't have ME set */
         new_msr &= ~((target_ulong)1 << MSR_ME);
 
@@ -1467,20 +1416,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
 
     switch (excp) {
     case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
-        if (!FIELD_EX64(env->msr, MSR, ME)) {
-            /*
-             * Machine check exception is not enabled.  Enter
-             * checkstop state.
-             */
-            fprintf(stderr, "Machine check while not allowed. "
-                    "Entering checkstop state\n");
-            if (qemu_log_separate()) {
-                qemu_log("Machine check while not allowed. "
-                        "Entering checkstop state\n");
-            }
-            cs->halted = 1;
-            cpu_interrupt_exittb(cs);
-        }
+        powerpc_mcheck_checkstop(env);
         if (env->msr_mask & MSR_HVB) {
             /*
              * ISA specifies HV, but can be delivered to guest with HV

From 0661329a356c17bb1fabef99a45b21b52a43fb08 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 16 Jun 2023 01:03:14 +0200
Subject: [PATCH 0420/1353] target/ppc: Remove some more local CPUState
 variables only used once

Some helpers only have a CPUState local to call cpu_interrupt_exittb()
but we can use env_cpu for that and remove the local.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <aa34e449552c6ab52d48938ccbe762fc06adac01.1686868895.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/excp_helper.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index d1d3d089a6..b2cff4e7eb 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -2653,8 +2653,7 @@ void helper_store_msr(CPUPPCState *env, target_ulong val)
     uint32_t excp = hreg_store_msr(env, val, 0);
 
     if (excp != 0) {
-        CPUState *cs = env_cpu(env);
-        cpu_interrupt_exittb(cs);
+        cpu_interrupt_exittb(env_cpu(env));
         raise_exception(env, excp);
     }
 }
@@ -2691,8 +2690,6 @@ void helper_pminsn(CPUPPCState *env, uint32_t insn)
 
 static void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr)
 {
-    CPUState *cs = env_cpu(env);
-
     /* MSR:POW cannot be set by any form of rfi */
     msr &= ~(1ULL << MSR_POW);
 
@@ -2716,7 +2713,7 @@ static void do_rfi(CPUPPCState *env, target_ulong nip, target_ulong msr)
      * No need to raise an exception here, as rfi is always the last
      * insn of a TB
      */
-    cpu_interrupt_exittb(cs);
+    cpu_interrupt_exittb(env_cpu(env));
     /* Reset the reservation */
     env->reserve_addr = -1;
 

From 08d7cfd04c3e90b0e904918cd785352e50bc17e1 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 16 Jun 2023 01:03:16 +0200
Subject: [PATCH 0421/1353] target/ppd: Remove unused define
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 7a3fe174b12d removed usage of POWERPC_SYSCALL_VECTORED, drop
the unused define as well.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <50adc24f9d408882128e896d8a81a1a059c41836.1686868895.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/translate.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 4766240927..db0ba49bdc 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -4486,7 +4486,6 @@ static void gen_hrfid(DisasContext *ctx)
 #define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL_USER
 #else
 #define POWERPC_SYSCALL POWERPC_EXCP_SYSCALL
-#define POWERPC_SYSCALL_VECTORED POWERPC_EXCP_SYSCALL_VECTORED
 #endif
 static void gen_sc(DisasContext *ctx)
 {

From 4e6b7db2c3331ccc2cae24443950a501181a9a0c Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 16 Jun 2023 01:03:21 +0200
Subject: [PATCH 0422/1353] target/ppc: Get CPUState in one step

We can get CPUState from env with env_cpu without going through
PowerPCCPU and casting that.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Acked-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <28424220f37f51ce97f24cadc7538a9c0d16cb45.1686868895.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/excp_helper.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index b2cff4e7eb..354392668e 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1770,8 +1770,8 @@ static int p7_interrupt_powersave(CPUPPCState *env)
 
 static int p7_next_unmasked_interrupt(CPUPPCState *env)
 {
-    PowerPCCPU *cpu = env_archcpu(env);
-    CPUState *cs = CPU(cpu);
+    CPUState *cs = env_cpu(env);
+
     /* Ignore MSR[EE] when coming out of some power management states */
     bool msr_ee = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
 
@@ -1860,8 +1860,8 @@ static int p8_interrupt_powersave(CPUPPCState *env)
 
 static int p8_next_unmasked_interrupt(CPUPPCState *env)
 {
-    PowerPCCPU *cpu = env_archcpu(env);
-    CPUState *cs = CPU(cpu);
+    CPUState *cs = env_cpu(env);
+
     /* Ignore MSR[EE] when coming out of some power management states */
     bool msr_ee = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
 
@@ -1981,8 +1981,8 @@ static int p9_interrupt_powersave(CPUPPCState *env)
 
 static int p9_next_unmasked_interrupt(CPUPPCState *env)
 {
-    PowerPCCPU *cpu = env_archcpu(env);
-    CPUState *cs = CPU(cpu);
+    CPUState *cs = env_cpu(env);
+
     /* Ignore MSR[EE] when coming out of some power management states */
     bool msr_ee = FIELD_EX64(env->msr, MSR, EE) || env->resume_as_sreset;
 
@@ -2675,9 +2675,8 @@ void helper_scv(CPUPPCState *env, uint32_t lev)
 
 void helper_pminsn(CPUPPCState *env, uint32_t insn)
 {
-    CPUState *cs;
+    CPUState *cs = env_cpu(env);
 
-    cs = env_cpu(env);
     cs->halted = 1;
 
     /* Condition for waking up at 0x100 */

From 93c691a003193a8bc4db54f4e544e19d6b1016fc Mon Sep 17 00:00:00 2001
From: Narayana Murty N <nnmlinux@linux.ibm.com>
Date: Fri, 23 Jun 2023 03:25:06 -0400
Subject: [PATCH 0423/1353] target: ppc: Use MSR_HVB bit to get the target
 endianness for memory dump

Currently on PPC64 qemu always dumps the guest memory in
Big Endian (BE) format even though the guest running in Little Endian
(LE) mode. So crash tool fails to load the dump as illustrated below:

Log :
$ virsh dump DOMAIN --memory-only dump.file

Domain 'DOMAIN' dumped to dump.file

$ crash vmlinux dump.file

<snip>
crash 8.0.2-1.el9

WARNING: endian mismatch:
          crash utility: little-endian
          dump.file: big-endian

WARNING: machine type mismatch:
          crash utility: PPC64
          dump.file: (unknown)

crash: dump.file: not a supported file format
<snip>

This happens because cpu_get_dump_info() passes cpu->env->has_hv_mode
to function ppc_interrupts_little_endian(), the cpu->env->has_hv_mode
always set for powerNV even though the guest is not running in hv mode.
The hv mode should be taken from msr_mask MSR_HVB bit
(cpu->env.msr_mask & MSR_HVB). This patch fixes the issue by passing
MSR_HVB value to ppc_interrupts_little_endian() in order to determine
the guest endianness.

The crash tool also expects guest kernel endianness should match the
endianness of the dump.

The patch was tested on POWER9 box booted with Linux as host in
following cases:

Host-Endianess Qemu-Target-Machine                Qemu-Generated-Guest
                                                  Memory-Dump-Format
BE             powernv(OPAL/PowerNV)                   LE
BE             powernv(OPAL/PowerNV)                   BE
LE             powernv(OPAL/PowerNV)                   LE
LE             powernv(OPAL/PowerNV)                   BE
LE             pseries(OPAL/PowerNV/pSeries) KVMHV     LE
LE             pseries TCG                             LE

Fixes: 5609400a4228 ("target/ppc: Set the correct endianness for powernv memory
dumps")
Signed-off-by: Narayana Murty N <nnmlinux@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Message-ID: <20230623072506.34713-1-nnmlinux@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/arch_dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/arch_dump.c b/target/ppc/arch_dump.c
index f58e6359d5..a8315659d9 100644
--- a/target/ppc/arch_dump.c
+++ b/target/ppc/arch_dump.c
@@ -237,7 +237,7 @@ int cpu_get_dump_info(ArchDumpInfo *info,
     info->d_machine = PPC_ELF_MACHINE;
     info->d_class = ELFCLASS;
 
-    if (ppc_interrupts_little_endian(cpu, cpu->env.has_hv_mode)) {
+    if (ppc_interrupts_little_endian(cpu, !!(cpu->env.msr_mask & MSR_HVB))) {
         info->d_endian = ELFDATA2LSB;
     } else {
         info->d_endian = ELFDATA2MSB;

From 694d3cb2ef2d7355ddaf413614f325f17da9716b Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Mon, 3 Jul 2023 10:08:58 +0200
Subject: [PATCH 0424/1353] pnv/xive2: Fix TIMA offset for indirect access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Direct TIMA operations can be done through 4 pages, each with a
different privilege level dictating what fields can be accessed. On
the other hand, indirect TIMA accesses on P10 are done through a
single page, which is the equivalent of the most privileged page of
direct TIMA accesses.

The offset in the IC bar of an indirect access specifies what hw
thread is targeted (page shift bits) and the offset in the
TIMA being accessed (the page offset bits). When the indirect
access is calling the underlying direct access functions, it is
therefore important to clearly separate the 2, as the direct functions
assume any page shift bits define the privilege ring level. For
indirect accesses, those bits must be 0. This patch fixes the offset
passed to direct TIMA functions.

It didn't matter for SMT1, as the 2 least significant bits of the page
shift are part of the hw thread ID and always 0, so the direct TIMA
functions were accessing the privilege ring 0 page. With SMT4/8, it is
no longer true.

The fix is specific to P10, as indirect TIMA access on P9 was handled
differently.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230703080858.54060-1-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/intc/pnv_xive2.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index e8ab176de6..82fcd3ea22 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1590,6 +1590,18 @@ static uint32_t pnv_xive2_ic_tm_get_pir(PnvXive2 *xive, hwaddr offset)
     return xive->chip->chip_id << 8 | offset >> xive->ic_shift;
 }
 
+static uint32_t pnv_xive2_ic_tm_get_hw_page_offset(PnvXive2 *xive,
+                                                   hwaddr offset)
+{
+    /*
+     * Indirect TIMA accesses are similar to direct accesses for
+     * privilege ring 0. So remove any traces of the hw thread ID from
+     * the offset in the IC BAR as it could be interpreted as the ring
+     * privilege when calling the underlying direct access functions.
+     */
+    return offset & ((1ull << xive->ic_shift) - 1);
+}
+
 static XiveTCTX *pnv_xive2_get_indirect_tctx(PnvXive2 *xive, uint32_t pir)
 {
     PnvChip *chip = xive->chip;
@@ -1612,14 +1624,16 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
                                               unsigned size)
 {
     PnvXive2 *xive = PNV_XIVE2(opaque);
+    hwaddr hw_page_offset;
     uint32_t pir;
     XiveTCTX *tctx;
     uint64_t val = -1;
 
     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
+    hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
     if (tctx) {
-        val = xive_tctx_tm_read(NULL, tctx, offset, size);
+        val = xive_tctx_tm_read(NULL, tctx, hw_page_offset, size);
     }
 
     return val;
@@ -1629,13 +1643,15 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
                                            uint64_t val, unsigned size)
 {
     PnvXive2 *xive = PNV_XIVE2(opaque);
+    hwaddr hw_page_offset;
     uint32_t pir;
     XiveTCTX *tctx;
 
     pir = pnv_xive2_ic_tm_get_pir(xive, offset);
+    hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
     if (tctx) {
-        xive_tctx_tm_write(NULL, tctx, offset, val, size);
+        xive_tctx_tm_write(NULL, tctx, hw_page_offset, val, size);
     }
 }
 

From a8da2e1424c2f716222582a4706117d2ca845fe1 Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Mon, 3 Jul 2023 10:12:14 +0200
Subject: [PATCH 0425/1353] pnv/xive: Add property on xive sources to define PQ
 state on reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PQ state of a xive interrupt is always initialized to Q=1, which
means the interrupt is disabled. Since a xive source can be embedded
in many objects, this patch adds a property to allow that behavior to
be refined if needed.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230703081215.55252-2-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/intc/xive.c        | 8 ++++++--
 include/hw/ppc/xive.h | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index 84c079b034..f60c878345 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -1232,8 +1232,7 @@ static void xive_source_reset(void *dev)
 
     /* Do not clear the LSI bitmap */
 
-    /* PQs are initialized to 0b01 (Q=1) which corresponds to "ints off" */
-    memset(xsrc->status, XIVE_ESB_OFF, xsrc->nr_irqs);
+    memset(xsrc->status, xsrc->reset_pq, xsrc->nr_irqs);
 }
 
 static void xive_source_realize(DeviceState *dev, Error **errp)
@@ -1287,6 +1286,11 @@ static Property xive_source_properties[] = {
     DEFINE_PROP_UINT64("flags", XiveSource, esb_flags, 0),
     DEFINE_PROP_UINT32("nr-irqs", XiveSource, nr_irqs, 0),
     DEFINE_PROP_UINT32("shift", XiveSource, esb_shift, XIVE_ESB_64K_2PAGE),
+    /*
+     * By default, PQs are initialized to 0b01 (Q=1) which corresponds
+     * to "ints off"
+     */
+    DEFINE_PROP_UINT8("reset-pq", XiveSource, reset_pq, XIVE_ESB_OFF),
     DEFINE_PROP_LINK("xive", XiveSource, xive, TYPE_XIVE_NOTIFIER,
                      XiveNotifier *),
     DEFINE_PROP_END_OF_LIST(),
diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h
index 3dfb06e002..9f580a2699 100644
--- a/include/hw/ppc/xive.h
+++ b/include/hw/ppc/xive.h
@@ -187,6 +187,7 @@ struct XiveSource {
 
     /* PQ bits and LSI assertion bit */
     uint8_t         *status;
+    uint8_t         reset_pq; /* PQ state on reset */
 
     /* ESB memory region */
     uint64_t        esb_flags;

From 4a1e9449e8d55c173f3eddd94ae363c2c2938fda Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Mon, 3 Jul 2023 10:12:15 +0200
Subject: [PATCH 0426/1353] pnv/psi: Initialize the PSIHB interrupts to match
 hardware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On the powernv9 and powernv10 machines, the PSIHB interrupts are
currently initialized with a PQ state of 0b01, i.e. interrupts are
disabled. However real hardware initializes them to 0b00 for the
PSIHB. This patch updates it, in case an hypervisor is in the mood of
checking it.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230703081215.55252-3-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_psi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/ppc/pnv_psi.c b/hw/ppc/pnv_psi.c
index 46da58dff8..daaa2f0575 100644
--- a/hw/ppc/pnv_psi.c
+++ b/hw/ppc/pnv_psi.c
@@ -863,6 +863,8 @@ static void pnv_psi_power9_realize(DeviceState *dev, Error **errp)
     object_property_set_int(OBJECT(xsrc), "nr-irqs", PSIHB9_NUM_IRQS,
                             &error_fatal);
     object_property_set_link(OBJECT(xsrc), "xive", OBJECT(psi), &error_abort);
+    object_property_set_int(OBJECT(xsrc), "reset-pq", XIVE_ESB_RESET,
+                            &error_abort);
     if (!qdev_realize(DEVICE(xsrc), NULL, errp)) {
         return;
     }

From 19d197f5d1e12717310110389267f16986763e9a Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 4 Jul 2023 15:12:00 +0930
Subject: [PATCH 0427/1353] ppc/pnv: quad xscom callbacks are P9 specific
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the functions to include P9 in the name in preparation for adding
P10 versions.

Correct the unimp read message while we're changing the function.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
Message-ID: <20230704054204.168547-2-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_core.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 0bc3ad41c8..0f451b3b6e 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -360,8 +360,8 @@ DEFINE_TYPES(pnv_core_infos)
 
 #define P9X_EX_NCU_SPEC_BAR                     0x11010
 
-static uint64_t pnv_quad_xscom_read(void *opaque, hwaddr addr,
-                                    unsigned int width)
+static uint64_t pnv_quad_power9_xscom_read(void *opaque, hwaddr addr,
+                                           unsigned int width)
 {
     uint32_t offset = addr >> 3;
     uint64_t val = -1;
@@ -372,15 +372,15 @@ static uint64_t pnv_quad_xscom_read(void *opaque, hwaddr addr,
         val = 0;
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "%s: writing @0x%08x\n", __func__,
+        qemu_log_mask(LOG_UNIMP, "%s: reading @0x%08x\n", __func__,
                       offset);
     }
 
     return val;
 }
 
-static void pnv_quad_xscom_write(void *opaque, hwaddr addr, uint64_t val,
-                                 unsigned int width)
+static void pnv_quad_power9_xscom_write(void *opaque, hwaddr addr, uint64_t val,
+                                        unsigned int width)
 {
     uint32_t offset = addr >> 3;
 
@@ -394,9 +394,9 @@ static void pnv_quad_xscom_write(void *opaque, hwaddr addr, uint64_t val,
     }
 }
 
-static const MemoryRegionOps pnv_quad_xscom_ops = {
-    .read = pnv_quad_xscom_read,
-    .write = pnv_quad_xscom_write,
+static const MemoryRegionOps pnv_quad_power9_xscom_ops = {
+    .read = pnv_quad_power9_xscom_read,
+    .write = pnv_quad_power9_xscom_write,
     .valid.min_access_size = 8,
     .valid.max_access_size = 8,
     .impl.min_access_size = 8,
@@ -410,7 +410,8 @@ static void pnv_quad_realize(DeviceState *dev, Error **errp)
     char name[32];
 
     snprintf(name, sizeof(name), "xscom-quad.%d", eq->quad_id);
-    pnv_xscom_region_init(&eq->xscom_regs, OBJECT(dev), &pnv_quad_xscom_ops,
+    pnv_xscom_region_init(&eq->xscom_regs, OBJECT(dev),
+                          &pnv_quad_power9_xscom_ops,
                           eq, name, PNV9_XSCOM_EQ_SIZE);
 }
 

From fdc2b46abaa81415a8e6d8439bdd0c3d1b930373 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 4 Jul 2023 15:12:01 +0930
Subject: [PATCH 0428/1353] ppc/pnv: Subclass quad xscom callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make the existing pnv_quad_xscom_read/write be P9 specific, in
preparation for a different P10 callback.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
Message-ID: <20230704054204.168547-3-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv.c              | 11 +++++++----
 hw/ppc/pnv_core.c         | 40 ++++++++++++++++++++++++++-------------
 include/hw/ppc/pnv_core.h | 13 ++++++++++++-
 3 files changed, 46 insertions(+), 18 deletions(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index fc083173f3..c77fdb6747 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1429,14 +1429,15 @@ static void pnv_chip_power9_instance_init(Object *obj)
 }
 
 static void pnv_chip_quad_realize_one(PnvChip *chip, PnvQuad *eq,
-                                      PnvCore *pnv_core)
+                                      PnvCore *pnv_core,
+                                      const char *type)
 {
     char eq_name[32];
     int core_id = CPU_CORE(pnv_core)->core_id;
 
     snprintf(eq_name, sizeof(eq_name), "eq[%d]", core_id);
     object_initialize_child_with_props(OBJECT(chip), eq_name, eq,
-                                       sizeof(*eq), TYPE_PNV_QUAD,
+                                       sizeof(*eq), type,
                                        &error_fatal, NULL);
 
     object_property_set_int(OBJECT(eq), "quad-id", core_id, &error_fatal);
@@ -1454,7 +1455,8 @@ static void pnv_chip_quad_realize(Pnv9Chip *chip9, Error **errp)
     for (i = 0; i < chip9->nr_quads; i++) {
         PnvQuad *eq = &chip9->quads[i];
 
-        pnv_chip_quad_realize_one(chip, eq, chip->cores[i * 4]);
+        pnv_chip_quad_realize_one(chip, eq, chip->cores[i * 4],
+                                  PNV_QUAD_TYPE_NAME("power9"));
 
         pnv_xscom_add_subregion(chip, PNV9_XSCOM_EQ_BASE(eq->quad_id),
                                 &eq->xscom_regs);
@@ -1666,7 +1668,8 @@ static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
     for (i = 0; i < chip10->nr_quads; i++) {
         PnvQuad *eq = &chip10->quads[i];
 
-        pnv_chip_quad_realize_one(chip, eq, chip->cores[i * 4]);
+        pnv_chip_quad_realize_one(chip, eq, chip->cores[i * 4],
+                                  PNV_QUAD_TYPE_NAME("power9"));
 
         pnv_xscom_add_subregion(chip, PNV10_XSCOM_EQ_BASE(eq->quad_id),
                                 &eq->xscom_regs);
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 0f451b3b6e..73d25409c9 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -407,12 +407,14 @@ static const MemoryRegionOps pnv_quad_power9_xscom_ops = {
 static void pnv_quad_realize(DeviceState *dev, Error **errp)
 {
     PnvQuad *eq = PNV_QUAD(dev);
+    PnvQuadClass *pqc = PNV_QUAD_GET_CLASS(eq);
     char name[32];
 
     snprintf(name, sizeof(name), "xscom-quad.%d", eq->quad_id);
     pnv_xscom_region_init(&eq->xscom_regs, OBJECT(dev),
-                          &pnv_quad_power9_xscom_ops,
-                          eq, name, PNV9_XSCOM_EQ_SIZE);
+                          pqc->xscom_ops,
+                          eq, name,
+                          pqc->xscom_size);
 }
 
 static Property pnv_quad_properties[] = {
@@ -420,6 +422,14 @@ static Property pnv_quad_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static void pnv_quad_power9_class_init(ObjectClass *oc, void *data)
+{
+    PnvQuadClass *pqc = PNV_QUAD_CLASS(oc);
+
+    pqc->xscom_ops = &pnv_quad_power9_xscom_ops;
+    pqc->xscom_size = PNV9_XSCOM_EQ_SIZE;
+}
+
 static void pnv_quad_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -429,16 +439,20 @@ static void pnv_quad_class_init(ObjectClass *oc, void *data)
     dc->user_creatable = false;
 }
 
-static const TypeInfo pnv_quad_info = {
-    .name          = TYPE_PNV_QUAD,
-    .parent        = TYPE_DEVICE,
-    .instance_size = sizeof(PnvQuad),
-    .class_init    = pnv_quad_class_init,
+static const TypeInfo pnv_quad_infos[] = {
+    {
+        .name          = TYPE_PNV_QUAD,
+        .parent        = TYPE_DEVICE,
+        .instance_size = sizeof(PnvQuad),
+        .class_size    = sizeof(PnvQuadClass),
+        .class_init    = pnv_quad_class_init,
+        .abstract      = true,
+    },
+    {
+        .parent = TYPE_PNV_QUAD,
+        .name = PNV_QUAD_TYPE_NAME("power9"),
+        .class_init = pnv_quad_power9_class_init,
+    },
 };
 
-static void pnv_core_register_types(void)
-{
-    type_register_static(&pnv_quad_info);
-}
-
-type_init(pnv_core_register_types)
+DEFINE_TYPES(pnv_quad_infos);
diff --git a/include/hw/ppc/pnv_core.h b/include/hw/ppc/pnv_core.h
index 3d75706e95..77ef00f47a 100644
--- a/include/hw/ppc/pnv_core.h
+++ b/include/hw/ppc/pnv_core.h
@@ -60,8 +60,19 @@ static inline PnvCPUState *pnv_cpu_state(PowerPCCPU *cpu)
     return (PnvCPUState *)cpu->machine_data;
 }
 
+struct PnvQuadClass {
+    DeviceClass parent_class;
+
+    const MemoryRegionOps *xscom_ops;
+    uint64_t xscom_size;
+};
+
 #define TYPE_PNV_QUAD "powernv-cpu-quad"
-OBJECT_DECLARE_SIMPLE_TYPE(PnvQuad, PNV_QUAD)
+
+#define PNV_QUAD_TYPE_SUFFIX "-" TYPE_PNV_QUAD
+#define PNV_QUAD_TYPE_NAME(cpu_model) cpu_model PNV_QUAD_TYPE_SUFFIX
+
+OBJECT_DECLARE_TYPE(PnvQuad, PnvQuadClass, PNV_QUAD)
 
 struct PnvQuad {
     DeviceState parent_obj;

From a1d64b9efc8173e4e90aef5f48e89364c43118a5 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 4 Jul 2023 15:12:02 +0930
Subject: [PATCH 0429/1353] ppc/pnv: Add P10 quad xscom model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a PnvQuad class for the P10 powernv machine. No xscoms are
implemented yet, but this allows them to be added.

The size is reduced to avoid the quad region from overlapping with the
core region.

  address-space: xscom-0
    0000000000000000-00000003ffffffff (prio 0, i/o): xscom-0
      0000000100000000-00000001000fffff (prio 0, i/o): xscom-quad.0
      0000000100108000-0000000100907fff (prio 0, i/o): xscom-core.3
      0000000100110000-000000010090ffff (prio 0, i/o): xscom-core.2
      0000000100120000-000000010091ffff (prio 0, i/o): xscom-core.1
      0000000100140000-000000010093ffff (prio 0, i/o): xscom-core.0

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
Message-ID: <20230704054204.168547-4-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv.c               |  2 +-
 hw/ppc/pnv_core.c          | 54 ++++++++++++++++++++++++++++++++++++++
 include/hw/ppc/pnv_xscom.h |  2 +-
 3 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index c77fdb6747..5f25fe985a 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1669,7 +1669,7 @@ static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
         PnvQuad *eq = &chip10->quads[i];
 
         pnv_chip_quad_realize_one(chip, eq, chip->cores[i * 4],
-                                  PNV_QUAD_TYPE_NAME("power9"));
+                                  PNV_QUAD_TYPE_NAME("power10"));
 
         pnv_xscom_add_subregion(chip, PNV10_XSCOM_EQ_BASE(eq->quad_id),
                                 &eq->xscom_regs);
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 73d25409c9..e4df435b15 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -404,6 +404,47 @@ static const MemoryRegionOps pnv_quad_power9_xscom_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
+/*
+ * POWER10 Quads
+ */
+
+static uint64_t pnv_quad_power10_xscom_read(void *opaque, hwaddr addr,
+                                            unsigned int width)
+{
+    uint32_t offset = addr >> 3;
+    uint64_t val = -1;
+
+    switch (offset) {
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: reading @0x%08x\n", __func__,
+                      offset);
+    }
+
+    return val;
+}
+
+static void pnv_quad_power10_xscom_write(void *opaque, hwaddr addr,
+                                         uint64_t val, unsigned int width)
+{
+    uint32_t offset = addr >> 3;
+
+    switch (offset) {
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: writing @0x%08x\n", __func__,
+                      offset);
+    }
+}
+
+static const MemoryRegionOps pnv_quad_power10_xscom_ops = {
+    .read = pnv_quad_power10_xscom_read,
+    .write = pnv_quad_power10_xscom_write,
+    .valid.min_access_size = 8,
+    .valid.max_access_size = 8,
+    .impl.min_access_size = 8,
+    .impl.max_access_size = 8,
+    .endianness = DEVICE_BIG_ENDIAN,
+};
+
 static void pnv_quad_realize(DeviceState *dev, Error **errp)
 {
     PnvQuad *eq = PNV_QUAD(dev);
@@ -430,6 +471,14 @@ static void pnv_quad_power9_class_init(ObjectClass *oc, void *data)
     pqc->xscom_size = PNV9_XSCOM_EQ_SIZE;
 }
 
+static void pnv_quad_power10_class_init(ObjectClass *oc, void *data)
+{
+    PnvQuadClass *pqc = PNV_QUAD_CLASS(oc);
+
+    pqc->xscom_ops = &pnv_quad_power10_xscom_ops;
+    pqc->xscom_size = PNV10_XSCOM_EQ_SIZE;
+}
+
 static void pnv_quad_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -453,6 +502,11 @@ static const TypeInfo pnv_quad_infos[] = {
         .name = PNV_QUAD_TYPE_NAME("power9"),
         .class_init = pnv_quad_power9_class_init,
     },
+    {
+        .parent = TYPE_PNV_QUAD,
+        .name = PNV_QUAD_TYPE_NAME("power10"),
+        .class_init = pnv_quad_power10_class_init,
+    },
 };
 
 DEFINE_TYPES(pnv_quad_infos);
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index cbe848d27b..f7da9a1dc6 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -129,7 +129,7 @@ struct PnvXScomInterfaceClass {
 
 #define PNV10_XSCOM_EQ_BASE(core)     \
     ((uint64_t) PNV10_XSCOM_EQ(PNV10_XSCOM_EQ_CHIPLET(core)))
-#define PNV10_XSCOM_EQ_SIZE        0x100000
+#define PNV10_XSCOM_EQ_SIZE        0x20000
 
 #define PNV10_XSCOM_EC_BASE(core) \
     ((uint64_t) PNV10_XSCOM_EQ_BASE(core) | PNV10_XSCOM_EC(core & 0x3))

From 9a3942179d395d223531530d6ff71df25b00d064 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 4 Jul 2023 15:12:03 +0930
Subject: [PATCH 0430/1353] ppc/pnv: Add P10 core xscom model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Like the quad xscoms, add a core model for P10 to allow future
differentiation from P9.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
Message-ID: <20230704054204.168547-5-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_core.c | 44 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index e4df435b15..1eec28c88c 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -167,6 +167,47 @@ static const MemoryRegionOps pnv_core_power9_xscom_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
+/*
+ * POWER10 core controls
+ */
+
+static uint64_t pnv_core_power10_xscom_read(void *opaque, hwaddr addr,
+                                           unsigned int width)
+{
+    uint32_t offset = addr >> 3;
+    uint64_t val = 0;
+
+    switch (offset) {
+    default:
+        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
+                  addr);
+    }
+
+    return val;
+}
+
+static void pnv_core_power10_xscom_write(void *opaque, hwaddr addr,
+                                         uint64_t val, unsigned int width)
+{
+    uint32_t offset = addr >> 3;
+
+    switch (offset) {
+    default:
+        qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx "\n",
+                      addr);
+    }
+}
+
+static const MemoryRegionOps pnv_core_power10_xscom_ops = {
+    .read = pnv_core_power10_xscom_read,
+    .write = pnv_core_power10_xscom_write,
+    .valid.min_access_size = 8,
+    .valid.max_access_size = 8,
+    .impl.min_access_size = 8,
+    .impl.max_access_size = 8,
+    .endianness = DEVICE_BIG_ENDIAN,
+};
+
 static void pnv_core_cpu_realize(PnvCore *pc, PowerPCCPU *cpu, Error **errp)
 {
     CPUPPCState *env = &cpu->env;
@@ -315,8 +356,7 @@ static void pnv_core_power10_class_init(ObjectClass *oc, void *data)
 {
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
-    /* TODO: Use the P9 XSCOMs for now on P10 */
-    pcc->xscom_ops = &pnv_core_power9_xscom_ops;
+    pcc->xscom_ops = &pnv_core_power10_xscom_ops;
 }
 
 static void pnv_core_class_init(ObjectClass *oc, void *data)

From 53658074955efc7b4329999577464bd763ef4cbd Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 4 Jul 2023 15:12:04 +0930
Subject: [PATCH 0431/1353] ppc/pnv: Return zero for core thread state xscom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Firmware now warns if booting in LPAR per core mode (PPC bit 62). So
this warning doesn't trigger, report the core thread state is 0.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
Message-ID: <20230704054204.168547-6-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 1eec28c88c..b7223bb445 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -116,6 +116,8 @@ static const MemoryRegionOps pnv_core_power8_xscom_ops = {
 #define PNV9_XSCOM_EC_PPM_SPECIAL_WKUP_HYP 0xf010d
 #define PNV9_XSCOM_EC_PPM_SPECIAL_WKUP_OTR 0xf010a
 
+#define PNV9_XSCOM_EC_CORE_THREAD_STATE    0x10ab3
+
 static uint64_t pnv_core_power9_xscom_read(void *opaque, hwaddr addr,
                                            unsigned int width)
 {
@@ -134,6 +136,9 @@ static uint64_t pnv_core_power9_xscom_read(void *opaque, hwaddr addr,
     case PNV9_XSCOM_EC_PPM_SPECIAL_WKUP_OTR:
         val = 0x0;
         break;
+    case PNV9_XSCOM_EC_CORE_THREAD_STATE:
+        val = 0;
+        break;
     default:
         qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
                   addr);
@@ -171,6 +176,8 @@ static const MemoryRegionOps pnv_core_power9_xscom_ops = {
  * POWER10 core controls
  */
 
+#define PNV10_XSCOM_EC_CORE_THREAD_STATE    0x412
+
 static uint64_t pnv_core_power10_xscom_read(void *opaque, hwaddr addr,
                                            unsigned int width)
 {
@@ -178,6 +185,9 @@ static uint64_t pnv_core_power10_xscom_read(void *opaque, hwaddr addr,
     uint64_t val = 0;
 
     switch (offset) {
+    case PNV10_XSCOM_EC_CORE_THREAD_STATE:
+        val = 0;
+        break;
     default:
         qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
                   addr);

From 053075097a053f7f9d8ce01f40ae1b1ad1845fea Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Tue, 4 Jul 2023 16:48:48 +0200
Subject: [PATCH 0432/1353] pnv/xive: Allow mmio operations of any size on the
 ESB CI pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We currently only allow 64-bit operations on the ESB CI pages. There's
no real reason for that limitation, skiboot/linux didn't need
more. However the hardware supports any size, so this patch relaxes
that restriction. It impacts both the ESB pages for "normal"
interrupts as well as the ESB pages for escalation interrupts defined
for the ENDs.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230704144848.164287-1-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/intc/xive.c  | 8 ++++----
 hw/intc/xive2.c | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index f60c878345..c014e961a4 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -1175,11 +1175,11 @@ static const MemoryRegionOps xive_source_esb_ops = {
     .write = xive_source_esb_write,
     .endianness = DEVICE_BIG_ENDIAN,
     .valid = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
 };
@@ -2006,11 +2006,11 @@ static const MemoryRegionOps xive_end_source_ops = {
     .write = xive_end_source_write,
     .endianness = DEVICE_BIG_ENDIAN,
     .valid = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
 };
diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index 4d9ff41956..c37ef25d44 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -954,11 +954,11 @@ static const MemoryRegionOps xive2_end_source_ops = {
     .write = xive2_end_source_write,
     .endianness = DEVICE_BIG_ENDIAN,
     .valid = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
     .impl = {
-        .min_access_size = 8,
+        .min_access_size = 1,
         .max_access_size = 8,
     },
 };

From ebe0e9bbcbe432cd9fbcfbb4e2e9be86761ee606 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Tue, 4 Jul 2023 20:19:20 +0200
Subject: [PATCH 0433/1353] ppc/pegasos2: Add support for -initrd command line
 option

This also changes type of sz local variable to ssize_t because it is
used to store return value of load_elf() and load_image_targphys() that
return ssize_t.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <20230704181920.27B58746335@zero.eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pegasos2.c | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index af5489de26..9c9944188b 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -44,6 +44,8 @@
 #define PROM_ADDR     0xfff00000
 #define PROM_SIZE     0x80000
 
+#define INITRD_MIN_ADDR 0x600000
+
 #define KVMPPC_HCALL_BASE    0xf000
 #define KVMPPC_H_RTAS        (KVMPPC_HCALL_BASE + 0x0)
 #define KVMPPC_H_VOF_CLIENT  (KVMPPC_HCALL_BASE + 0x5)
@@ -80,6 +82,8 @@ struct Pegasos2MachineState {
     uint64_t kernel_addr;
     uint64_t kernel_entry;
     uint64_t kernel_size;
+    uint64_t initrd_addr;
+    uint64_t initrd_size;
 };
 
 static void *build_fdt(MachineState *machine, int *fdt_size);
@@ -117,7 +121,8 @@ static void pegasos2_init(MachineState *machine)
     I2CBus *i2c_bus;
     const char *fwname = machine->firmware ?: PROM_FILENAME;
     char *filename;
-    int i, sz;
+    int i;
+    ssize_t sz;
     uint8_t *spd_data;
 
     /* init CPU */
@@ -213,6 +218,20 @@ static void pegasos2_init(MachineState *machine)
         warn_report("Using Virtual OpenFirmware but no -kernel option.");
     }
 
+    if (machine->initrd_filename) {
+        pm->initrd_addr = pm->kernel_addr + pm->kernel_size + 64 * KiB;
+        pm->initrd_addr = ROUND_UP(pm->initrd_addr, 4);
+        pm->initrd_addr = MAX(pm->initrd_addr, INITRD_MIN_ADDR);
+        sz = load_image_targphys(machine->initrd_filename, pm->initrd_addr,
+                                 machine->ram_size - pm->initrd_addr);
+        if (sz <= 0) {
+            error_report("Could not load initrd '%s'",
+                         machine->initrd_filename);
+            exit(1);
+        }
+        pm->initrd_size = sz;
+    }
+
     if (!pm->vof && machine->kernel_cmdline && machine->kernel_cmdline[0]) {
         warn_report("Option -append may be ineffective with -bios.");
     }
@@ -335,6 +354,11 @@ static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
         error_report("Memory for kernel is in use");
         exit(1);
     }
+    if (pm->initrd_size &&
+        vof_claim(pm->vof, pm->initrd_addr, pm->initrd_size, 0) == -1) {
+        error_report("Memory for initrd is in use");
+        exit(1);
+    }
     fdt = build_fdt(machine, &sz);
     /* FIXME: VOF assumes entry is same as load address */
     d[0] = cpu_to_be64(pm->kernel_entry);
@@ -966,6 +990,12 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     qemu_fdt_setprop_string(fdt, "/memory@0", "name", "memory");
 
     qemu_fdt_add_subnode(fdt, "/chosen");
+    if (pm->initrd_addr && pm->initrd_size) {
+        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end",
+                              pm->initrd_addr + pm->initrd_size);
+        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start",
+                              pm->initrd_addr);
+    }
     qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
                             machine->kernel_cmdline ?: "");
     qemu_fdt_setprop_string(fdt, "/chosen", "name", "chosen");

From ff349cce8923d3c1713a6d58eb98ff692e6637f6 Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Wed, 5 Jul 2023 13:00:39 +0200
Subject: [PATCH 0434/1353] pnv/xive: Print CPU target in all TIMA traces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the CPU target in the trace when reading/writing the TIMA
space. It was already done for other TIMA ops (notify, accept, ...),
only missing for those 2. Useful for debug and even more now that we
experiment with SMT.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230705110039.231148-1-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/intc/trace-events | 4 ++--
 hw/intc/xive.c       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index 5c6094c457..36ff71f947 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -265,8 +265,8 @@ xive_source_esb_read(uint64_t addr, uint32_t srcno, uint64_t value) "@0x%"PRIx64
 xive_source_esb_write(uint64_t addr, uint32_t srcno, uint64_t value) "@0x%"PRIx64" IRQ 0x%x val=0x%"PRIx64
 xive_router_end_notify(uint8_t end_blk, uint32_t end_idx, uint32_t end_data) "END 0x%02x/0x%04x -> enqueue 0x%08x"
 xive_router_end_escalate(uint8_t end_blk, uint32_t end_idx, uint8_t esc_blk, uint32_t esc_idx, uint32_t end_data) "END 0x%02x/0x%04x -> escalate END 0x%02x/0x%04x data 0x%08x"
-xive_tctx_tm_write(uint64_t offset, unsigned int size, uint64_t value) "@0x%"PRIx64" sz=%d val=0x%" PRIx64
-xive_tctx_tm_read(uint64_t offset, unsigned int size, uint64_t value) "@0x%"PRIx64" sz=%d val=0x%" PRIx64
+xive_tctx_tm_write(uint32_t index, uint64_t offset, unsigned int size, uint64_t value) "target=%d @0x%"PRIx64" sz=%d val=0x%" PRIx64
+xive_tctx_tm_read(uint32_t index, uint64_t offset, unsigned int size, uint64_t value) "target=%d @0x%"PRIx64" sz=%d val=0x%" PRIx64
 xive_presenter_notify(uint8_t nvt_blk, uint32_t nvt_idx, uint8_t ring) "found NVT 0x%x/0x%x ring=0x%x"
 xive_end_source_read(uint8_t end_blk, uint32_t end_idx, uint64_t addr) "END 0x%x/0x%x @0x%"PRIx64
 
diff --git a/hw/intc/xive.c b/hw/intc/xive.c
index c014e961a4..56670b2cac 100644
--- a/hw/intc/xive.c
+++ b/hw/intc/xive.c
@@ -566,7 +566,7 @@ void xive_tctx_tm_write(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
 {
     const XiveTmOp *xto;
 
-    trace_xive_tctx_tm_write(offset, size, value);
+    trace_xive_tctx_tm_write(tctx->cs->cpu_index, offset, size, value);
 
     /*
      * TODO: check V bit in Q[0-3]W2
@@ -639,7 +639,7 @@ uint64_t xive_tctx_tm_read(XivePresenter *xptr, XiveTCTX *tctx, hwaddr offset,
      */
     ret = xive_tm_raw_read(tctx, offset, size);
 out:
-    trace_xive_tctx_tm_read(offset, size, ret);
+    trace_xive_tctx_tm_read(tctx->cs->cpu_index, offset, size, ret);
     return ret;
 }
 

From ed75a123579d56b5523f74868bb2c5877dc2c119 Mon Sep 17 00:00:00 2001
From: Frederic Barrat <fbarrat@linux.ibm.com>
Date: Wed, 5 Jul 2023 10:14:00 +0200
Subject: [PATCH 0435/1353] pnv/xive2: Always pass a presenter object when
 accessing the TIMA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The low-level functions to access the TIMA take a presenter object as
a first argument. When accessing the TIMA from the IC BAR,
i.e. indirect calls, we currently pass a NULL pointer for the
presenter argument. While it appears ok with the current usage, it's
dangerous. And it's pretty easy to figure out the presenter in that
context, so this patch fixes it.

Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230705081400.218408-1-fbarrat@linux.ibm.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/intc/pnv_xive2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index 82fcd3ea22..bbb44a533c 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -1624,6 +1624,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
                                               unsigned size)
 {
     PnvXive2 *xive = PNV_XIVE2(opaque);
+    XivePresenter *xptr = XIVE_PRESENTER(xive);
     hwaddr hw_page_offset;
     uint32_t pir;
     XiveTCTX *tctx;
@@ -1633,7 +1634,7 @@ static uint64_t pnv_xive2_ic_tm_indirect_read(void *opaque, hwaddr offset,
     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
     if (tctx) {
-        val = xive_tctx_tm_read(NULL, tctx, hw_page_offset, size);
+        val = xive_tctx_tm_read(xptr, tctx, hw_page_offset, size);
     }
 
     return val;
@@ -1643,6 +1644,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
                                            uint64_t val, unsigned size)
 {
     PnvXive2 *xive = PNV_XIVE2(opaque);
+    XivePresenter *xptr = XIVE_PRESENTER(xive);
     hwaddr hw_page_offset;
     uint32_t pir;
     XiveTCTX *tctx;
@@ -1651,7 +1653,7 @@ static void pnv_xive2_ic_tm_indirect_write(void *opaque, hwaddr offset,
     hw_page_offset = pnv_xive2_ic_tm_get_hw_page_offset(xive, offset);
     tctx = pnv_xive2_get_indirect_tctx(xive, pir);
     if (tctx) {
-        xive_tctx_tm_write(NULL, tctx, hw_page_offset, val, size);
+        xive_tctx_tm_write(xptr, tctx, hw_page_offset, val, size);
     }
 }
 

From 3401ea3cfe06ab5ab059ae19b662270e1357545e Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 5 Jul 2023 22:06:28 +1000
Subject: [PATCH 0436/1353] target/ppc: Add LPAR-per-core vs per-thread mode
 flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Power ISA has the concept of sub-processors:

  Hardware is allowed to sub-divide a multi-threaded processor into
  "sub-processors" that appear to privileged programs as multi-threaded
  processors with fewer threads.

POWER9 and POWER10 have two modes, either every thread is a
sub-processor or all threads appear as one multi-threaded processor. In
the user manuals these are known as "LPAR per thread" / "Thread LPAR",
and "LPAR per core" / "1 LPAR", respectively.

The practical difference is: in thread LPAR mode, non-hypervisor SPRs
are not shared between threads and msgsndp can not be used to message
siblings. In 1 LPAR mode, some SPRs are shared and msgsndp is usable.
Thrad LPAR allows multiple partitions to run concurrently on the same
core, and is a requirement for KVM to run on POWER9/10 (which does not
gang-schedule an LPAR on all threads of a core like POWER8 KVM).

Traditionally, SMT in PAPR environments including PowerVM and the
pseries QEMU machine with KVM acceleration behaves as in 1 LPAR mode.
In OPAL systems, Thread LPAR is used. When adding SMT to the powernv
machine, it is therefore preferable to emulate Thread LPAR.

To account for this difference between pseries and powernv, an LPAR mode
flag is added such that SPRs can be implemented as per-LPAR shared, and
that becomes either per-thread or per-core depending on the flag.

Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230705120631.27670-2-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/spapr_cpu_core.c  |  2 ++
 target/ppc/cpu.h         |  3 +++
 target/ppc/cpu_init.c    | 12 ++++++++++++
 target/ppc/excp_helper.c |  4 ++++
 target/ppc/misc_helper.c |  8 ++++++++
 target/ppc/translate.c   | 11 ++++++-----
 6 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
index a4e3c2fadd..b482d9754a 100644
--- a/hw/ppc/spapr_cpu_core.c
+++ b/hw/ppc/spapr_cpu_core.c
@@ -270,6 +270,8 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     env->spr_cb[SPR_PIR].default_value = cs->cpu_index;
     env->spr_cb[SPR_TIR].default_value = thread_index;
 
+    cpu_ppc_set_1lpar(cpu);
+
     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
 
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index af12c93ebc..b269b0d090 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -674,6 +674,8 @@ enum {
     POWERPC_FLAG_SCV      = 0x00200000,
     /* Has >1 thread per core                                                */
     POWERPC_FLAG_SMT      = 0x00400000,
+    /* Using "LPAR per core" mode  (as opposed to per-thread)                */
+    POWERPC_FLAG_SMT_1LPAR = 0x00800000,
 };
 
 /*
@@ -1437,6 +1439,7 @@ void store_booke_tsr(CPUPPCState *env, target_ulong val);
 void ppc_tlb_invalidate_all(CPUPPCState *env);
 void ppc_tlb_invalidate_one(CPUPPCState *env, target_ulong addr);
 void cpu_ppc_set_vhyp(PowerPCCPU *cpu, PPCVirtualHypervisor *vhyp);
+void cpu_ppc_set_1lpar(PowerPCCPU *cpu);
 int ppcmas_tlb_check(CPUPPCState *env, ppcmas_tlb_t *tlb, hwaddr *raddrp,
                      target_ulong address, uint32_t pid);
 int ppcemb_tlb_search(CPUPPCState *env, target_ulong address, uint32_t pid);
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 5f4969664e..905a59aea9 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -6629,6 +6629,18 @@ void cpu_ppc_set_vhyp(PowerPCCPU *cpu, PPCVirtualHypervisor *vhyp)
     env->msr_mask &= ~MSR_HVB;
 }
 
+void cpu_ppc_set_1lpar(PowerPCCPU *cpu)
+{
+    CPUPPCState *env = &cpu->env;
+
+    /*
+     * pseries SMT means "LPAR per core" mode, e.g., msgsndp is usable
+     * between threads.
+     */
+    if (env->flags & POWERPC_FLAG_SMT) {
+        env->flags |= POWERPC_FLAG_SMT_1LPAR;
+    }
+}
 #endif /* !defined(CONFIG_USER_ONLY) */
 
 #endif /* defined(TARGET_PPC64) */
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 354392668e..7683ea0fc9 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -3130,6 +3130,10 @@ void helper_book3s_msgsndp(CPUPPCState *env, target_ulong rb)
 
     helper_hfscr_facility_check(env, HFSCR_MSGP, "msgsndp", HFSCR_IC_MSGP);
 
+    if (!(env->flags & POWERPC_FLAG_SMT_1LPAR)) {
+        nr_threads = 1; /* msgsndp behaves as 1-thread in LPAR-per-thread mode*/
+    }
+
     if (!dbell_type_server(rb) || ttir >= nr_threads) {
         return;
     }
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 1f1af21f33..26e546cc9c 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -191,6 +191,10 @@ target_ulong helper_load_dpdes(CPUPPCState *env)
 
     helper_hfscr_facility_check(env, HFSCR_MSGP, "load DPDES", HFSCR_IC_MSGP);
 
+    if (!(env->flags & POWERPC_FLAG_SMT_1LPAR)) {
+        nr_threads = 1; /* DPDES behaves as 1-thread in LPAR-per-thread mode */
+    }
+
     if (nr_threads == 1) {
         if (env->pending_interrupts & PPC_INTERRUPT_DOORBELL) {
             dpdes = 1;
@@ -222,6 +226,10 @@ void helper_store_dpdes(CPUPPCState *env, target_ulong val)
 
     helper_hfscr_facility_check(env, HFSCR_MSGP, "store DPDES", HFSCR_IC_MSGP);
 
+    if (!(env->flags & POWERPC_FLAG_SMT_1LPAR)) {
+        nr_threads = 1; /* DPDES behaves as 1-thread in LPAR-per-thread mode */
+    }
+
     if (val & ~(nr_threads - 1)) {
         qemu_log_mask(LOG_GUEST_ERROR, "Invalid DPDES register value "
                       TARGET_FMT_lx"\n", val);
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index db0ba49bdc..4556297ab5 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -246,9 +246,9 @@ static inline bool gen_serialize(DisasContext *ctx)
 }
 
 #if defined(TARGET_PPC64) && !defined(CONFIG_USER_ONLY)
-static inline bool gen_serialize_core(DisasContext *ctx)
+static inline bool gen_serialize_core_lpar(DisasContext *ctx)
 {
-    if (ctx->flags & POWERPC_FLAG_SMT) {
+    if (ctx->flags & POWERPC_FLAG_SMT_1LPAR) {
         return gen_serialize(ctx);
     }
 
@@ -451,7 +451,8 @@ static void spr_write_CTRL_ST(DisasContext *ctx, int sprn, int gprn)
 
 void spr_write_CTRL(DisasContext *ctx, int sprn, int gprn)
 {
-    if (!(ctx->flags & POWERPC_FLAG_SMT)) {
+    if (!(ctx->flags & POWERPC_FLAG_SMT_1LPAR)) {
+        /* CTRL behaves as 1-thread in LPAR-per-thread mode */
         spr_write_CTRL_ST(ctx, sprn, gprn);
         goto out;
     }
@@ -815,7 +816,7 @@ void spr_write_pcr(DisasContext *ctx, int sprn, int gprn)
 /* DPDES */
 void spr_read_dpdes(DisasContext *ctx, int gprn, int sprn)
 {
-    if (!gen_serialize_core(ctx)) {
+    if (!gen_serialize_core_lpar(ctx)) {
         return;
     }
 
@@ -824,7 +825,7 @@ void spr_read_dpdes(DisasContext *ctx, int gprn, int sprn)
 
 void spr_write_dpdes(DisasContext *ctx, int sprn, int gprn)
 {
-    if (!gen_serialize_core(ctx)) {
+    if (!gen_serialize_core_lpar(ctx)) {
         return;
     }
 

From 9cdfd1b9f7eb5ecd1267bbd68330a11dcb8aa8f2 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 5 Jul 2023 22:06:29 +1000
Subject: [PATCH 0437/1353] target/ppc: SMT support for the HID SPR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HID is a per-core shared register, skiboot sets this (e.g., setting
HILE) on one thread and that must affect all threads of the core.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230705120631.27670-3-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu_init.c    |  2 +-
 target/ppc/helper.h      |  1 +
 target/ppc/misc_helper.c | 21 +++++++++++++++++++++
 target/ppc/spr_common.h  |  1 +
 target/ppc/translate.c   | 16 ++++++++++++++++
 5 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 905a59aea9..720aad9e05 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -5638,7 +5638,7 @@ static void register_power_common_book4_sprs(CPUPPCState *env)
     spr_register_hv(env, SPR_HID0, "HID0",
                  SPR_NOACCESS, SPR_NOACCESS,
                  SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
+                 &spr_read_generic, &spr_core_write_generic,
                  0x00000000);
     spr_register_hv(env, SPR_TSCR, "TSCR",
                  SPR_NOACCESS, SPR_NOACCESS,
diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index 828f7844c8..abec6fe341 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -704,6 +704,7 @@ DEF_HELPER_3(store_dcr, void, env, tl, tl)
 
 DEF_HELPER_2(load_dump_spr, void, env, i32)
 DEF_HELPER_2(store_dump_spr, void, env, i32)
+DEF_HELPER_3(spr_core_write_generic, void, env, i32, tl)
 DEF_HELPER_3(spr_write_CTRL, void, env, i32, tl)
 
 DEF_HELPER_4(fscr_facility_check, void, env, i32, i32, i32)
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 26e546cc9c..692d058665 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -43,6 +43,27 @@ void helper_store_dump_spr(CPUPPCState *env, uint32_t sprn)
              env->spr[sprn]);
 }
 
+void helper_spr_core_write_generic(CPUPPCState *env, uint32_t sprn,
+                                   target_ulong val)
+{
+    CPUState *cs = env_cpu(env);
+    CPUState *ccs;
+    uint32_t nr_threads = cs->nr_threads;
+    uint32_t core_id = env->spr[SPR_PIR] & ~(nr_threads - 1);
+
+    assert(core_id == env->spr[SPR_PIR] - env->spr[SPR_TIR]);
+
+    if (nr_threads == 1) {
+        env->spr[sprn] = val;
+        return;
+    }
+
+    THREAD_SIBLING_FOREACH(cs, ccs) {
+        CPUPPCState *cenv = &POWERPC_CPU(ccs)->env;
+        cenv->spr[sprn] = val;
+    }
+}
+
 void helper_spr_write_CTRL(CPUPPCState *env, uint32_t sprn,
                            target_ulong val)
 {
diff --git a/target/ppc/spr_common.h b/target/ppc/spr_common.h
index fbf52123b5..5995070eaf 100644
--- a/target/ppc/spr_common.h
+++ b/target/ppc/spr_common.h
@@ -82,6 +82,7 @@ void spr_noaccess(DisasContext *ctx, int gprn, int sprn);
 void spr_read_generic(DisasContext *ctx, int gprn, int sprn);
 void spr_write_generic(DisasContext *ctx, int sprn, int gprn);
 void spr_write_generic32(DisasContext *ctx, int sprn, int gprn);
+void spr_core_write_generic(DisasContext *ctx, int sprn, int gprn);
 void spr_write_MMCR0(DisasContext *ctx, int sprn, int gprn);
 void spr_write_MMCR1(DisasContext *ctx, int sprn, int gprn);
 void spr_write_PMC(DisasContext *ctx, int sprn, int gprn);
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 4556297ab5..e6a0709066 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -438,6 +438,22 @@ void spr_write_generic32(DisasContext *ctx, int sprn, int gprn)
 #endif
 }
 
+void spr_core_write_generic(DisasContext *ctx, int sprn, int gprn)
+{
+    if (!(ctx->flags & POWERPC_FLAG_SMT)) {
+        spr_write_generic(ctx, sprn, gprn);
+        return;
+    }
+
+    if (!gen_serialize(ctx)) {
+        return;
+    }
+
+    gen_helper_spr_core_write_generic(cpu_env, tcg_constant_i32(sprn),
+                                      cpu_gpr[gprn]);
+    spr_store_dump_spr(sprn);
+}
+
 static void spr_write_CTRL_ST(DisasContext *ctx, int sprn, int gprn)
 {
     /* This does not implement >1 thread */

From 934676c7b726fe9cccac02a7a4fa23c1e6a4c91e Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 5 Jul 2023 22:06:30 +1000
Subject: [PATCH 0438/1353] ppc/pnv: SMT support for powernv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set the TIR default value with the SMT thread index, and place some
standard limits on SMT configurations. Now powernv is able to boot
skiboot and Linux with a SMT topology, including booting a KVM guest.

There are several SPRs and other features (e.g., broadcast msgsnd)
that are not implemented, but not used by OPAL or Linux and can be
added incrementally.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230705120631.27670-4-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 docs/system/ppc/powernv.rst |  5 -----
 hw/ppc/pnv.c                | 12 ++++++++++++
 hw/ppc/pnv_core.c           | 13 +++++--------
 3 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/docs/system/ppc/powernv.rst b/docs/system/ppc/powernv.rst
index c8f9762342..09f3965858 100644
--- a/docs/system/ppc/powernv.rst
+++ b/docs/system/ppc/powernv.rst
@@ -195,11 +195,6 @@ Use a MTD drive to add a PNOR to the machine, and get a NVRAM :
 
   -drive file=./witherspoon.pnor,format=raw,if=mtd
 
-CAVEATS
--------
-
- * No support for multiple HW threads (SMT=1). Same as pseries.
-
 Maintainer contact information
 ------------------------------
 
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 5f25fe985a..23740f9d07 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -887,6 +887,18 @@ static void pnv_init(MachineState *machine)
 
     pnv->num_chips =
         machine->smp.max_cpus / (machine->smp.cores * machine->smp.threads);
+
+    if (machine->smp.threads > 8) {
+        error_report("Cannot support more than 8 threads/core "
+                     "on a powernv machine");
+        exit(1);
+    }
+    if (!is_power_of_2(machine->smp.threads)) {
+        error_report("Cannot support %d threads/core on a powernv"
+                     "machine because it must be a power of 2",
+                     machine->smp.threads);
+        exit(1);
+    }
     /*
      * TODO: should we decide on how many chips we can create based
      * on #cores and Venice vs. Murano vs. Naples chip type etc...,
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index b7223bb445..8a72171ce0 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -218,12 +218,13 @@ static const MemoryRegionOps pnv_core_power10_xscom_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
-static void pnv_core_cpu_realize(PnvCore *pc, PowerPCCPU *cpu, Error **errp)
+static void pnv_core_cpu_realize(PnvCore *pc, PowerPCCPU *cpu, Error **errp,
+                                 int thread_index)
 {
     CPUPPCState *env = &cpu->env;
     int core_pir;
-    int thread_index = 0; /* TODO: TCG supports only one thread */
     ppc_spr_t *pir = &env->spr_cb[SPR_PIR];
+    ppc_spr_t *tir = &env->spr_cb[SPR_TIR];
     Error *local_err = NULL;
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(pc->chip);
 
@@ -239,11 +240,7 @@ static void pnv_core_cpu_realize(PnvCore *pc, PowerPCCPU *cpu, Error **errp)
 
     core_pir = object_property_get_uint(OBJECT(pc), "pir", &error_abort);
 
-    /*
-     * The PIR of a thread is the core PIR + the thread index. We will
-     * need to find a way to get the thread index when TCG supports
-     * more than 1. We could use the object name ?
-     */
+    tir->default_value = thread_index;
     pir->default_value = core_pir + thread_index;
 
     /* Set time-base frequency to 512 MHz */
@@ -292,7 +289,7 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
     }
 
     for (j = 0; j < cc->nr_threads; j++) {
-        pnv_core_cpu_realize(pc, pc->threads[j], &local_err);
+        pnv_core_cpu_realize(pc, pc->threads[j], &local_err, j);
         if (local_err) {
             goto err;
         }

From 2bef5b9452b2c6239c1e8512461ae900d5e8ebe6 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 5 Jul 2023 22:06:31 +1000
Subject: [PATCH 0439/1353] tests/avocado: Add powernv machine test script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This copies ppc_pseries.py to start a set of powernv tests, including
a Linux boot test for the newly added SMT mode.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Message-ID: <20230705120631.27670-5-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 tests/avocado/ppc_powernv.py | 87 ++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 tests/avocado/ppc_powernv.py

diff --git a/tests/avocado/ppc_powernv.py b/tests/avocado/ppc_powernv.py
new file mode 100644
index 0000000000..d0e5c07bde
--- /dev/null
+++ b/tests/avocado/ppc_powernv.py
@@ -0,0 +1,87 @@
+# Test that Linux kernel boots on ppc powernv machines and check the console
+#
+# Copyright (c) 2018, 2020 Red Hat, Inc.
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+from avocado.utils import archive
+from avocado_qemu import QemuSystemTest
+from avocado_qemu import wait_for_console_pattern
+
+class powernvMachine(QemuSystemTest):
+
+    timeout = 90
+    KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
+    panic_message = 'Kernel panic - not syncing'
+    good_message = 'VFS: Cannot open root device'
+
+    def do_test_linux_boot(self):
+        self.require_accelerator("tcg")
+        kernel_url = ('https://archives.fedoraproject.org/pub/archive'
+                      '/fedora-secondary/releases/29/Everything/ppc64le/os'
+                      '/ppc/ppc64/vmlinuz')
+        kernel_hash = '3fe04abfc852b66653b8c3c897a59a689270bc77'
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
+
+        self.vm.set_console()
+        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=hvc0'
+        self.vm.add_args('-kernel', kernel_path,
+                         '-append', kernel_command_line)
+        self.vm.launch()
+
+    def test_linux_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:powernv
+        :avocado: tags=accel:tcg
+        """
+
+        self.do_test_linux_boot()
+        console_pattern = 'VFS: Cannot open root device'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+
+    def test_linux_smp_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:powernv
+        :avocado: tags=accel:tcg
+        """
+
+        self.vm.add_args('-smp', '4')
+        self.do_test_linux_boot()
+        console_pattern = 'smp: Brought up 1 node, 4 CPUs'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        wait_for_console_pattern(self, self.good_message, self.panic_message)
+
+    def test_linux_smt_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:powernv
+        :avocado: tags=accel:tcg
+        """
+
+        self.vm.add_args('-smp', '4,threads=4')
+        self.do_test_linux_boot()
+        console_pattern = 'CPU maps initialized for 4 threads per core'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        console_pattern = 'smp: Brought up 1 node, 4 CPUs'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        wait_for_console_pattern(self, self.good_message, self.panic_message)
+
+    def test_linux_big_boot(self):
+        """
+        :avocado: tags=arch:ppc64
+        :avocado: tags=machine:powernv
+        :avocado: tags=accel:tcg
+        """
+
+        self.vm.add_args('-smp', '16,threads=4,cores=2,sockets=2')
+
+        # powernv does not support NUMA
+        self.do_test_linux_boot()
+        console_pattern = 'CPU maps initialized for 4 threads per core'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        console_pattern = 'smp: Brought up 2 nodes, 16 CPUs'
+        wait_for_console_pattern(self, console_pattern, self.panic_message)
+        wait_for_console_pattern(self, self.good_message, self.panic_message)

From 339d13ce57a33d1536b0bae15ee633af11e6b116 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:45 +0200
Subject: [PATCH 0440/1353] ppc440: Change ppc460ex_pcie_init() parameter type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change parameter of ppc460ex_pcie_init() from env to cpu to allow
further refactoring.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <1695d7cc1a9f1070ab498c078916e2389d6e9469.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440.h    | 2 +-
 hw/ppc/ppc440_uc.c | 7 ++++---
 hw/ppc/sam460ex.c  | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/ppc/ppc440.h b/hw/ppc/ppc440.h
index 7c24db8504..ae42bcf0c8 100644
--- a/hw/ppc/ppc440.h
+++ b/hw/ppc/ppc440.h
@@ -18,6 +18,6 @@ void ppc4xx_cpr_init(CPUPPCState *env);
 void ppc4xx_sdr_init(CPUPPCState *env);
 void ppc4xx_ahb_init(CPUPPCState *env);
 void ppc4xx_dma_init(CPUPPCState *env, int dcr_base);
-void ppc460ex_pcie_init(CPUPPCState *env);
+void ppc460ex_pcie_init(PowerPCCPU *cpu);
 
 #endif /* PPC440_H */
diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index 651263926e..8eb985d714 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -17,6 +17,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/pci/pci.h"
 #include "sysemu/reset.h"
+#include "cpu.h"
 #include "ppc440.h"
 
 /*****************************************************************************/
@@ -1108,17 +1109,17 @@ static void ppc460ex_pcie_register_dcrs(PPC460EXPCIEState *s, CPUPPCState *env)
                      &dcr_read_pcie, &dcr_write_pcie);
 }
 
-void ppc460ex_pcie_init(CPUPPCState *env)
+void ppc460ex_pcie_init(PowerPCCPU *cpu)
 {
     DeviceState *dev;
 
     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE0_BASE);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), env);
+    ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), &cpu->env);
 
     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE1_BASE);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), env);
+    ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), &cpu->env);
 }
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index cf065aae0e..aaa8d2f4a5 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -422,7 +422,7 @@ static void sam460ex_init(MachineState *machine)
     usb_create_simple(usb_bus_find(-1), "usb-mouse");
 
     /* PCI bus */
-    ppc460ex_pcie_init(env);
+    ppc460ex_pcie_init(cpu);
     /* All PCI irqs are connected to the same UIC pin (cf. UBoot source) */
     dev = sysbus_create_simple("ppc440-pcix-host", 0xc0ec00000,
                                qdev_get_gpio_in(uic[1], 0));

From 256f06668a7764a3bab581cd3b548964e3861189 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:46 +0200
Subject: [PATCH 0441/1353] ppc440: Add cpu link property to PCIe controller
 model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PCIe controller model uses PPC DCRs but cannot be modeled with
TYPE_PPC4xx_DCR_DEVICE as it derives from TYPE_PCIE_HOST_BRIDGE. Add a
cpu link property to it similar to other DCR devices to allow
registering DCRs from the device model.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <a79796654deaa81a6a1c71efc874e4d88c4cafd4.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 130 ++++++++++++++++++++++++---------------------
 1 file changed, 70 insertions(+), 60 deletions(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index 8eb985d714..b26c0cee1b 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -779,6 +779,7 @@ struct PPC460EXPCIEState {
     MemoryRegion iomem;
     qemu_irq irq[4];
     int32_t dcrn_base;
+    PowerPCCPU *cpu;
 
     uint64_t cfg_base;
     uint32_t cfg_mask;
@@ -1001,66 +1002,10 @@ static void ppc460ex_set_irq(void *opaque, int irq_num, int level)
        qemu_set_irq(s->irq[irq_num], level);
 }
 
-static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)
+static void ppc460ex_pcie_register_dcrs(PPC460EXPCIEState *s)
 {
-    PPC460EXPCIEState *s = PPC460EX_PCIE_HOST(dev);
-    PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-    int i, id;
-    char buf[16];
+    CPUPPCState *env = &s->cpu->env;
 
-    switch (s->dcrn_base) {
-    case DCRN_PCIE0_BASE:
-        id = 0;
-        break;
-    case DCRN_PCIE1_BASE:
-        id = 1;
-        break;
-    default:
-        error_setg(errp, "invalid PCIe DCRN base");
-        return;
-    }
-    snprintf(buf, sizeof(buf), "pcie%d-io", id);
-    memory_region_init(&s->iomem, OBJECT(s), buf, UINT64_MAX);
-    for (i = 0; i < 4; i++) {
-        sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
-    }
-    snprintf(buf, sizeof(buf), "pcie.%d", id);
-    pci->bus = pci_register_root_bus(DEVICE(s), buf, ppc460ex_set_irq,
-                                pci_swizzle_map_irq_fn, s, &s->iomem,
-                                get_system_io(), 0, 4, TYPE_PCIE_BUS);
-}
-
-static Property ppc460ex_pcie_props[] = {
-    DEFINE_PROP_INT32("dcrn-base", PPC460EXPCIEState, dcrn_base, -1),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void ppc460ex_pcie_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
-    dc->realize = ppc460ex_pcie_realize;
-    device_class_set_props(dc, ppc460ex_pcie_props);
-    dc->hotpluggable = false;
-}
-
-static const TypeInfo ppc460ex_pcie_host_info = {
-    .name = TYPE_PPC460EX_PCIE_HOST,
-    .parent = TYPE_PCIE_HOST_BRIDGE,
-    .instance_size = sizeof(PPC460EXPCIEState),
-    .class_init = ppc460ex_pcie_class_init,
-};
-
-static void ppc460ex_pcie_register(void)
-{
-    type_register_static(&ppc460ex_pcie_host_info);
-}
-
-type_init(ppc460ex_pcie_register)
-
-static void ppc460ex_pcie_register_dcrs(PPC460EXPCIEState *s, CPUPPCState *env)
-{
     ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGBAH, s,
                      &dcr_read_pcie, &dcr_write_pcie);
     ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGBAL, s,
@@ -1109,17 +1054,82 @@ static void ppc460ex_pcie_register_dcrs(PPC460EXPCIEState *s, CPUPPCState *env)
                      &dcr_read_pcie, &dcr_write_pcie);
 }
 
+static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)
+{
+    PPC460EXPCIEState *s = PPC460EX_PCIE_HOST(dev);
+    PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+    int i, id;
+    char buf[16];
+
+    if (!s->cpu) {
+        error_setg(errp, "cpu link property must be set");
+        return;
+    }
+    switch (s->dcrn_base) {
+    case DCRN_PCIE0_BASE:
+        id = 0;
+        break;
+    case DCRN_PCIE1_BASE:
+        id = 1;
+        break;
+    default:
+        error_setg(errp, "invalid PCIe DCRN base");
+        return;
+    }
+    snprintf(buf, sizeof(buf), "pcie%d-io", id);
+    memory_region_init(&s->iomem, OBJECT(s), buf, UINT64_MAX);
+    for (i = 0; i < 4; i++) {
+        sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
+    }
+    snprintf(buf, sizeof(buf), "pcie.%d", id);
+    pci->bus = pci_register_root_bus(DEVICE(s), buf, ppc460ex_set_irq,
+                                pci_swizzle_map_irq_fn, s, &s->iomem,
+                                get_system_io(), 0, 4, TYPE_PCIE_BUS);
+    ppc460ex_pcie_register_dcrs(s);
+}
+
+static Property ppc460ex_pcie_props[] = {
+    DEFINE_PROP_INT32("dcrn-base", PPC460EXPCIEState, dcrn_base, -1),
+    DEFINE_PROP_LINK("cpu", PPC460EXPCIEState, cpu, TYPE_POWERPC_CPU,
+                     PowerPCCPU *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void ppc460ex_pcie_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+    dc->realize = ppc460ex_pcie_realize;
+    device_class_set_props(dc, ppc460ex_pcie_props);
+    dc->hotpluggable = false;
+}
+
+static const TypeInfo ppc460ex_pcie_host_info = {
+    .name = TYPE_PPC460EX_PCIE_HOST,
+    .parent = TYPE_PCIE_HOST_BRIDGE,
+    .instance_size = sizeof(PPC460EXPCIEState),
+    .class_init = ppc460ex_pcie_class_init,
+};
+
+static void ppc460ex_pcie_register(void)
+{
+    type_register_static(&ppc460ex_pcie_host_info);
+}
+
+type_init(ppc460ex_pcie_register)
+
 void ppc460ex_pcie_init(PowerPCCPU *cpu)
 {
     DeviceState *dev;
 
     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE0_BASE);
+    object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), &cpu->env);
 
     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE1_BASE);
+    object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    ppc460ex_pcie_register_dcrs(PPC460EX_PCIE_HOST(dev), &cpu->env);
 }

From ca1ae3432f22c33401a0c8cbf4f7cd4cf13e8e6f Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:47 +0200
Subject: [PATCH 0442/1353] ppc440: Add a macro to shorten PCIe controller DCR
 registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is shorter and more readable to wrap the complex call to
ppc_dcr_register() in a macro than to repeat it several times.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <4dec5ef8115791dc67253afdff9a703eb816a2a8.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 76 +++++++++++++++++-----------------------------
 1 file changed, 28 insertions(+), 48 deletions(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index b26c0cee1b..b36dc409d7 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -1002,56 +1002,36 @@ static void ppc460ex_set_irq(void *opaque, int irq_num, int level)
        qemu_set_irq(s->irq[irq_num], level);
 }
 
+#define PPC440_PCIE_DCR(s, dcrn) \
+    ppc_dcr_register(&(s)->cpu->env, (s)->dcrn_base + (dcrn), (s), \
+                     &dcr_read_pcie, &dcr_write_pcie)
+
+
 static void ppc460ex_pcie_register_dcrs(PPC460EXPCIEState *s)
 {
-    CPUPPCState *env = &s->cpu->env;
-
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGBAH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGBAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_CFGMSK, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_MSGBAH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_MSGBAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_MSGMSK, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1BAH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1BAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1MSKH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR1MSKL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2BAH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2BAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2MSKH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR2MSKL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3BAH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3BAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3MSKH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_OMR3MSKL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_REGBAH, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_REGBAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_REGMSK, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_SPECIAL, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
-    ppc_dcr_register(env, s->dcrn_base + PEGPL_CFG, s,
-                     &dcr_read_pcie, &dcr_write_pcie);
+    PPC440_PCIE_DCR(s, PEGPL_CFGBAH);
+    PPC440_PCIE_DCR(s, PEGPL_CFGBAL);
+    PPC440_PCIE_DCR(s, PEGPL_CFGMSK);
+    PPC440_PCIE_DCR(s, PEGPL_MSGBAH);
+    PPC440_PCIE_DCR(s, PEGPL_MSGBAL);
+    PPC440_PCIE_DCR(s, PEGPL_MSGMSK);
+    PPC440_PCIE_DCR(s, PEGPL_OMR1BAH);
+    PPC440_PCIE_DCR(s, PEGPL_OMR1BAL);
+    PPC440_PCIE_DCR(s, PEGPL_OMR1MSKH);
+    PPC440_PCIE_DCR(s, PEGPL_OMR1MSKL);
+    PPC440_PCIE_DCR(s, PEGPL_OMR2BAH);
+    PPC440_PCIE_DCR(s, PEGPL_OMR2BAL);
+    PPC440_PCIE_DCR(s, PEGPL_OMR2MSKH);
+    PPC440_PCIE_DCR(s, PEGPL_OMR2MSKL);
+    PPC440_PCIE_DCR(s, PEGPL_OMR3BAH);
+    PPC440_PCIE_DCR(s, PEGPL_OMR3BAL);
+    PPC440_PCIE_DCR(s, PEGPL_OMR3MSKH);
+    PPC440_PCIE_DCR(s, PEGPL_OMR3MSKL);
+    PPC440_PCIE_DCR(s, PEGPL_REGBAH);
+    PPC440_PCIE_DCR(s, PEGPL_REGBAL);
+    PPC440_PCIE_DCR(s, PEGPL_REGMSK);
+    PPC440_PCIE_DCR(s, PEGPL_SPECIAL);
+    PPC440_PCIE_DCR(s, PEGPL_CFG);
 }
 
 static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)

From 48bb07fbb1d9223448a4c11c6b711db0cf1fdc57 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:48 +0200
Subject: [PATCH 0443/1353] ppc440: Rename parent field of PPC460EXPCIEState to
 match code style
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QOM prefers to call the parent field parent_obj, change
PPC460EXPCIEState ro match that convention.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <6995f28215d2a489a661b7d91a1783048829d467.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index b36dc409d7..22c74839ae 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -774,7 +774,7 @@ void ppc4xx_dma_init(CPUPPCState *env, int dcr_base)
 OBJECT_DECLARE_SIMPLE_TYPE(PPC460EXPCIEState, PPC460EX_PCIE_HOST)
 
 struct PPC460EXPCIEState {
-    PCIExpressHost host;
+    PCIExpressHost parent_obj;
 
     MemoryRegion iomem;
     qemu_irq irq[4];

From b5d2ad84a14c1305efd9739d98a6adec0bf42e4d Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:49 +0200
Subject: [PATCH 0444/1353] ppc440: Rename local variable in dcr_read_pcie()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename local variable storing state struct in dcr_read_pcie() for
brevity and consistency with other functions.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <7b6f0033ada74075fc094b1397deb406e1a05741.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 50 +++++++++++++++++++++++-----------------------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index 22c74839ae..5724db2702 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -828,78 +828,78 @@ enum {
 
 static uint32_t dcr_read_pcie(void *opaque, int dcrn)
 {
-    PPC460EXPCIEState *state = opaque;
+    PPC460EXPCIEState *s = opaque;
     uint32_t ret = 0;
 
-    switch (dcrn - state->dcrn_base) {
+    switch (dcrn - s->dcrn_base) {
     case PEGPL_CFGBAH:
-        ret = state->cfg_base >> 32;
+        ret = s->cfg_base >> 32;
         break;
     case PEGPL_CFGBAL:
-        ret = state->cfg_base;
+        ret = s->cfg_base;
         break;
     case PEGPL_CFGMSK:
-        ret = state->cfg_mask;
+        ret = s->cfg_mask;
         break;
     case PEGPL_MSGBAH:
-        ret = state->msg_base >> 32;
+        ret = s->msg_base >> 32;
         break;
     case PEGPL_MSGBAL:
-        ret = state->msg_base;
+        ret = s->msg_base;
         break;
     case PEGPL_MSGMSK:
-        ret = state->msg_mask;
+        ret = s->msg_mask;
         break;
     case PEGPL_OMR1BAH:
-        ret = state->omr1_base >> 32;
+        ret = s->omr1_base >> 32;
         break;
     case PEGPL_OMR1BAL:
-        ret = state->omr1_base;
+        ret = s->omr1_base;
         break;
     case PEGPL_OMR1MSKH:
-        ret = state->omr1_mask >> 32;
+        ret = s->omr1_mask >> 32;
         break;
     case PEGPL_OMR1MSKL:
-        ret = state->omr1_mask;
+        ret = s->omr1_mask;
         break;
     case PEGPL_OMR2BAH:
-        ret = state->omr2_base >> 32;
+        ret = s->omr2_base >> 32;
         break;
     case PEGPL_OMR2BAL:
-        ret = state->omr2_base;
+        ret = s->omr2_base;
         break;
     case PEGPL_OMR2MSKH:
-        ret = state->omr2_mask >> 32;
+        ret = s->omr2_mask >> 32;
         break;
     case PEGPL_OMR2MSKL:
-        ret = state->omr3_mask;
+        ret = s->omr3_mask;
         break;
     case PEGPL_OMR3BAH:
-        ret = state->omr3_base >> 32;
+        ret = s->omr3_base >> 32;
         break;
     case PEGPL_OMR3BAL:
-        ret = state->omr3_base;
+        ret = s->omr3_base;
         break;
     case PEGPL_OMR3MSKH:
-        ret = state->omr3_mask >> 32;
+        ret = s->omr3_mask >> 32;
         break;
     case PEGPL_OMR3MSKL:
-        ret = state->omr3_mask;
+        ret = s->omr3_mask;
         break;
     case PEGPL_REGBAH:
-        ret = state->reg_base >> 32;
+        ret = s->reg_base >> 32;
         break;
     case PEGPL_REGBAL:
-        ret = state->reg_base;
+        ret = s->reg_base;
         break;
     case PEGPL_REGMSK:
-        ret = state->reg_mask;
+        ret = s->reg_mask;
         break;
     case PEGPL_SPECIAL:
-        ret = state->special;
+        ret = s->special;
         break;
     case PEGPL_CFG:
-        ret = state->cfg;
+        ret = s->cfg;
         break;
     }
 

From 088b61bc49fab767d73d79d49cb828d866346e6d Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:51 +0200
Subject: [PATCH 0445/1353] ppc440: Stop using system io region for PCIe buses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add separate memory regions for the mem and io spaces of the PCIe bus
to avoid different buses using the same system io region.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <b631c3a61729eee2166d899b8888164ebeb71574.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index 5724db2702..663abf3449 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -776,6 +776,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(PPC460EXPCIEState, PPC460EX_PCIE_HOST)
 struct PPC460EXPCIEState {
     PCIExpressHost parent_obj;
 
+    MemoryRegion busmem;
     MemoryRegion iomem;
     qemu_irq irq[4];
     int32_t dcrn_base;
@@ -1056,15 +1057,17 @@ static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)
         error_setg(errp, "invalid PCIe DCRN base");
         return;
     }
+    snprintf(buf, sizeof(buf), "pcie%d-mem", id);
+    memory_region_init(&s->busmem, OBJECT(s), buf, UINT64_MAX);
     snprintf(buf, sizeof(buf), "pcie%d-io", id);
-    memory_region_init(&s->iomem, OBJECT(s), buf, UINT64_MAX);
+    memory_region_init(&s->iomem, OBJECT(s), buf, 64 * KiB);
     for (i = 0; i < 4; i++) {
         sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
     }
     snprintf(buf, sizeof(buf), "pcie.%d", id);
     pci->bus = pci_register_root_bus(DEVICE(s), buf, ppc460ex_set_irq,
-                                pci_swizzle_map_irq_fn, s, &s->iomem,
-                                get_system_io(), 0, 4, TYPE_PCIE_BUS);
+                                pci_swizzle_map_irq_fn, s, &s->busmem,
+                                &s->iomem, 0, 4, TYPE_PCIE_BUS);
     ppc460ex_pcie_register_dcrs(s);
 }
 

From 6ef62c5945316c265189e301b5fadf9285850221 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:53 +0200
Subject: [PATCH 0446/1353] ppc440: Add busnum property to PCIe controller
 model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of guessing controller number from dcrn_base add a property so
the device does not need knowledge about where it is used.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <fdb84344025e00fadf74d0be95665fcb0ac1e039.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_uc.c | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index 663abf3449..b74b2212fa 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -779,6 +779,7 @@ struct PPC460EXPCIEState {
     MemoryRegion busmem;
     MemoryRegion iomem;
     qemu_irq irq[4];
+    int32_t num;
     int32_t dcrn_base;
     PowerPCCPU *cpu;
 
@@ -1039,32 +1040,25 @@ static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)
 {
     PPC460EXPCIEState *s = PPC460EX_PCIE_HOST(dev);
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-    int i, id;
-    char buf[16];
+    int i;
+    char buf[20];
 
     if (!s->cpu) {
         error_setg(errp, "cpu link property must be set");
         return;
     }
-    switch (s->dcrn_base) {
-    case DCRN_PCIE0_BASE:
-        id = 0;
-        break;
-    case DCRN_PCIE1_BASE:
-        id = 1;
-        break;
-    default:
-        error_setg(errp, "invalid PCIe DCRN base");
+    if (s->num < 0 || s->dcrn_base < 0) {
+        error_setg(errp, "busnum and dcrn-base properties must be set");
         return;
     }
-    snprintf(buf, sizeof(buf), "pcie%d-mem", id);
+    snprintf(buf, sizeof(buf), "pcie%d-mem", s->num);
     memory_region_init(&s->busmem, OBJECT(s), buf, UINT64_MAX);
-    snprintf(buf, sizeof(buf), "pcie%d-io", id);
+    snprintf(buf, sizeof(buf), "pcie%d-io", s->num);
     memory_region_init(&s->iomem, OBJECT(s), buf, 64 * KiB);
     for (i = 0; i < 4; i++) {
         sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
     }
-    snprintf(buf, sizeof(buf), "pcie.%d", id);
+    snprintf(buf, sizeof(buf), "pcie.%d", s->num);
     pci->bus = pci_register_root_bus(DEVICE(s), buf, ppc460ex_set_irq,
                                 pci_swizzle_map_irq_fn, s, &s->busmem,
                                 &s->iomem, 0, 4, TYPE_PCIE_BUS);
@@ -1072,6 +1066,7 @@ static void ppc460ex_pcie_realize(DeviceState *dev, Error **errp)
 }
 
 static Property ppc460ex_pcie_props[] = {
+    DEFINE_PROP_INT32("busnum", PPC460EXPCIEState, num, -1),
     DEFINE_PROP_INT32("dcrn-base", PPC460EXPCIEState, dcrn_base, -1),
     DEFINE_PROP_LINK("cpu", PPC460EXPCIEState, cpu, TYPE_POWERPC_CPU,
                      PowerPCCPU *),
@@ -1107,11 +1102,13 @@ void ppc460ex_pcie_init(PowerPCCPU *cpu)
     DeviceState *dev;
 
     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
+    qdev_prop_set_int32(dev, "busnum", 0);
     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE0_BASE);
     object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
+    qdev_prop_set_int32(dev, "busnum", 1);
     qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE1_BASE);
     object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);

From 340dc03c798d07fda7fd7f608dc224caa2909849 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:54 +0200
Subject: [PATCH 0447/1353] ppc440: Remove ppc460ex_pcie_init legacy init
 function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After previous changes we can now remove the legacy init function and
move the device creation to board code.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <29aafeea9f1c871c739600a7b093c5456e8a1dc8.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440.h         |  1 -
 hw/ppc/ppc440_uc.c      | 21 ---------------------
 hw/ppc/sam460ex.c       | 17 ++++++++++++++++-
 include/hw/ppc/ppc4xx.h |  1 +
 4 files changed, 17 insertions(+), 23 deletions(-)

diff --git a/hw/ppc/ppc440.h b/hw/ppc/ppc440.h
index ae42bcf0c8..909373fb38 100644
--- a/hw/ppc/ppc440.h
+++ b/hw/ppc/ppc440.h
@@ -18,6 +18,5 @@ void ppc4xx_cpr_init(CPUPPCState *env);
 void ppc4xx_sdr_init(CPUPPCState *env);
 void ppc4xx_ahb_init(CPUPPCState *env);
 void ppc4xx_dma_init(CPUPPCState *env, int dcr_base);
-void ppc460ex_pcie_init(PowerPCCPU *cpu);
 
 #endif /* PPC440_H */
diff --git a/hw/ppc/ppc440_uc.c b/hw/ppc/ppc440_uc.c
index b74b2212fa..4181c843a8 100644
--- a/hw/ppc/ppc440_uc.c
+++ b/hw/ppc/ppc440_uc.c
@@ -770,7 +770,6 @@ void ppc4xx_dma_init(CPUPPCState *env, int dcr_base)
  */
 #include "hw/pci/pcie_host.h"
 
-#define TYPE_PPC460EX_PCIE_HOST "ppc460ex-pcie-host"
 OBJECT_DECLARE_SIMPLE_TYPE(PPC460EXPCIEState, PPC460EX_PCIE_HOST)
 
 struct PPC460EXPCIEState {
@@ -799,9 +798,6 @@ struct PPC460EXPCIEState {
     uint32_t cfg;
 };
 
-#define DCRN_PCIE0_BASE 0x100
-#define DCRN_PCIE1_BASE 0x120
-
 enum {
     PEGPL_CFGBAH = 0x0,
     PEGPL_CFGBAL,
@@ -1096,20 +1092,3 @@ static void ppc460ex_pcie_register(void)
 }
 
 type_init(ppc460ex_pcie_register)
-
-void ppc460ex_pcie_init(PowerPCCPU *cpu)
-{
-    DeviceState *dev;
-
-    dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
-    qdev_prop_set_int32(dev, "busnum", 0);
-    qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE0_BASE);
-    object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-
-    dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
-    qdev_prop_set_int32(dev, "busnum", 1);
-    qdev_prop_set_int32(dev, "dcrn-base", DCRN_PCIE1_BASE);
-    object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-}
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index aaa8d2f4a5..1bb23bb18b 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -45,6 +45,9 @@
 /* dd bs=1 skip=$(($(stat -c '%s' updater/updater-460) - 0x80000)) \
      if=updater/updater-460 of=u-boot-sam460-20100605.bin */
 
+#define PCIE0_DCRN_BASE 0x100
+#define PCIE1_DCRN_BASE 0x120
+
 /* from Sam460 U-Boot include/configs/Sam460ex.h */
 #define FLASH_BASE             0xfff00000
 #define FLASH_BASE_H           0x4
@@ -421,8 +424,20 @@ static void sam460ex_init(MachineState *machine)
     usb_create_simple(usb_bus_find(-1), "usb-kbd");
     usb_create_simple(usb_bus_find(-1), "usb-mouse");
 
+    /* PCIe buses */
+    dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
+    qdev_prop_set_int32(dev, "busnum", 0);
+    qdev_prop_set_int32(dev, "dcrn-base", PCIE0_DCRN_BASE);
+    object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
+    dev = qdev_new(TYPE_PPC460EX_PCIE_HOST);
+    qdev_prop_set_int32(dev, "busnum", 1);
+    qdev_prop_set_int32(dev, "dcrn-base", PCIE1_DCRN_BASE);
+    object_property_set_link(OBJECT(dev), "cpu", OBJECT(cpu), &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
     /* PCI bus */
-    ppc460ex_pcie_init(cpu);
     /* All PCI irqs are connected to the same UIC pin (cf. UBoot source) */
     dev = sysbus_create_simple("ppc440-pcix-host", 0xc0ec00000,
                                qdev_get_gpio_in(uic[1], 0));
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index f8c86e09ec..39ca602442 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -30,6 +30,7 @@
 #include "hw/sysbus.h"
 
 #define TYPE_PPC4xx_PCI_HOST_BRIDGE "ppc4xx-pcihost"
+#define TYPE_PPC460EX_PCIE_HOST "ppc460ex-pcie-host"
 
 /*
  * Generic DCR device

From 41cd3e649be9f8f12aa2028623af916dd81d3403 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:52 +0200
Subject: [PATCH 0448/1353] ppc/sam460ex: Remove address_space_mem local
 variable

Some places already use  get_system_memory() directly so replace the
remaining uses and drop the local variable.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <d134d64f13258d1f157b445fedb1e86cf3abb606.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/sam460ex.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 1bb23bb18b..d446cfc37b 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -269,7 +269,6 @@ static void main_cpu_reset(void *opaque)
 
 static void sam460ex_init(MachineState *machine)
 {
-    MemoryRegion *address_space_mem = get_system_memory();
     MemoryRegion *isa = g_new(MemoryRegion, 1);
     MemoryRegion *l2cache_ram = g_new(MemoryRegion, 1);
     DeviceState *uic[4];
@@ -409,7 +408,8 @@ static void sam460ex_init(MachineState *machine)
     /* FIXME: remove this after fixing l2sram mapping in ppc440_uc.c? */
     memory_region_init_ram(l2cache_ram, NULL, "ppc440.l2cache_ram", 256 * KiB,
                            &error_abort);
-    memory_region_add_subregion(address_space_mem, 0x400000000LL, l2cache_ram);
+    memory_region_add_subregion(get_system_memory(), 0x400000000LL,
+                                l2cache_ram);
 
     /* USB */
     sysbus_create_simple(TYPE_PPC4xx_EHCI, 0x4bffd0400,
@@ -459,13 +459,13 @@ static void sam460ex_init(MachineState *machine)
     /* SoC has 4 UARTs
      * but board has only one wired and two are present in fdt */
     if (serial_hd(0) != NULL) {
-        serial_mm_init(address_space_mem, 0x4ef600300, 0,
+        serial_mm_init(get_system_memory(), 0x4ef600300, 0,
                        qdev_get_gpio_in(uic[1], 1),
                        PPC_SERIAL_MM_BAUDBASE, serial_hd(0),
                        DEVICE_BIG_ENDIAN);
     }
     if (serial_hd(1) != NULL) {
-        serial_mm_init(address_space_mem, 0x4ef600400, 0,
+        serial_mm_init(get_system_memory(), 0x4ef600400, 0,
                        qdev_get_gpio_in(uic[0], 1),
                        PPC_SERIAL_MM_BAUDBASE, serial_hd(1),
                        DEVICE_BIG_ENDIAN);

From 97784278880b58952400cafcfd1c12fc1c0b5124 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 5 Jul 2023 22:12:58 +0200
Subject: [PATCH 0449/1353] ppc440_pcix: Don't use iomem for regs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The iomem memory region is better used for the PCI IO space but
currently used for registers. Stop using it for that to allow this to
be cleaned up in the next patch.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <3def68f200edd4540393d6b3b03baabe15d649f2.1688586835.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_pcix.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/ppc440_pcix.c b/hw/ppc/ppc440_pcix.c
index f10f93c533..899558b055 100644
--- a/hw/ppc/ppc440_pcix.c
+++ b/hw/ppc/ppc440_pcix.c
@@ -64,6 +64,7 @@ struct PPC440PCIXState {
     MemoryRegion container;
     MemoryRegion iomem;
     MemoryRegion busmem;
+    MemoryRegion regs;
 };
 
 #define PPC440_REG_BASE     0x80000
@@ -507,11 +508,11 @@ static void ppc440_pcix_realize(DeviceState *dev, Error **errp)
                           h, "pci-conf-idx", 4);
     memory_region_init_io(&h->data_mem, OBJECT(s), &pci_host_data_le_ops,
                           h, "pci-conf-data", 4);
-    memory_region_init_io(&s->iomem, OBJECT(s), &pci_reg_ops, s,
-                          "pci.reg", PPC440_REG_SIZE);
+    memory_region_init_io(&s->regs, OBJECT(s), &pci_reg_ops, s, "pci-reg",
+                          PPC440_REG_SIZE);
     memory_region_add_subregion(&s->container, PCIC0_CFGADDR, &h->conf_mem);
     memory_region_add_subregion(&s->container, PCIC0_CFGDATA, &h->data_mem);
-    memory_region_add_subregion(&s->container, PPC440_REG_BASE, &s->iomem);
+    memory_region_add_subregion(&s->container, PPC440_REG_BASE, &s->regs);
     sysbus_init_mmio(sbd, &s->container);
 }
 

From dd0f356dfe363d51b0cc0e1925db902b97338e18 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 6 Jul 2023 13:16:42 +0200
Subject: [PATCH 0450/1353] ppc440_pcix: Stop using system io region for PCI
 bus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reduce the iomem region to 64K and use it for the PCI io space and map
it directly from the board without an intermediate alias that is not
really needed.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <f4ad9af42197a92dd1d0b56c21316dbdad240ee4.1688641673.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_pcix.c | 9 ++++++---
 hw/ppc/sam460ex.c    | 6 +-----
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/hw/ppc/ppc440_pcix.c b/hw/ppc/ppc440_pcix.c
index 899558b055..54286cfef4 100644
--- a/hw/ppc/ppc440_pcix.c
+++ b/hw/ppc/ppc440_pcix.c
@@ -23,6 +23,7 @@
 #include "qemu/error-report.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "qemu/units.h"
 #include "hw/irq.h"
 #include "hw/ppc/ppc.h"
 #include "hw/ppc/ppc4xx.h"
@@ -491,10 +492,11 @@ static void ppc440_pcix_realize(DeviceState *dev, Error **errp)
     s = PPC440_PCIX_HOST_BRIDGE(dev);
 
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init(&s->busmem, OBJECT(dev), "pci bus memory", UINT64_MAX);
+    memory_region_init(&s->busmem, OBJECT(dev), "pci-mem", UINT64_MAX);
+    memory_region_init(&s->iomem, OBJECT(dev), "pci-io", 64 * KiB);
     h->bus = pci_register_root_bus(dev, NULL, ppc440_pcix_set_irq,
-                         ppc440_pcix_map_irq, &s->irq, &s->busmem,
-                         get_system_io(), PCI_DEVFN(0, 0), 1, TYPE_PCI_BUS);
+                         ppc440_pcix_map_irq, &s->irq, &s->busmem, &s->iomem,
+                         PCI_DEVFN(0, 0), 1, TYPE_PCI_BUS);
 
     s->dev = pci_create_simple(h->bus, PCI_DEVFN(0, 0), "ppc4xx-host-bridge");
 
@@ -514,6 +516,7 @@ static void ppc440_pcix_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(&s->container, PCIC0_CFGDATA, &h->data_mem);
     memory_region_add_subregion(&s->container, PPC440_REG_BASE, &s->regs);
     sysbus_init_mmio(sbd, &s->container);
+    sysbus_init_mmio(sbd, &s->iomem);
 }
 
 static void ppc440_pcix_class_init(ObjectClass *klass, void *data)
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index d446cfc37b..7da38bd58e 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -269,7 +269,6 @@ static void main_cpu_reset(void *opaque)
 
 static void sam460ex_init(MachineState *machine)
 {
-    MemoryRegion *isa = g_new(MemoryRegion, 1);
     MemoryRegion *l2cache_ram = g_new(MemoryRegion, 1);
     DeviceState *uic[4];
     int i;
@@ -441,12 +440,9 @@ static void sam460ex_init(MachineState *machine)
     /* All PCI irqs are connected to the same UIC pin (cf. UBoot source) */
     dev = sysbus_create_simple("ppc440-pcix-host", 0xc0ec00000,
                                qdev_get_gpio_in(uic[1], 0));
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, 0xc08000000);
     pci_bus = PCI_BUS(qdev_get_child_bus(dev, "pci.0"));
 
-    memory_region_init_alias(isa, NULL, "isa_mmio", get_system_io(),
-                             0, 0x10000);
-    memory_region_add_subregion(get_system_memory(), 0xc08000000, isa);
-
     /* PCI devices */
     pci_create_simple(pci_bus, PCI_DEVFN(6, 0), "sm501");
     /* SoC has a single SATA port but we don't emulate that yet

From e75a951b89382c77cc2bf63db5996cafa54adc3d Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 6 Jul 2023 13:16:43 +0200
Subject: [PATCH 0451/1353] ppc4xx_pci: Rename QOM type name define

Rename the TYPE_PPC4xx_PCI_HOST_BRIDGE define and its string value to
match each other and other similar types and to avoid confusion with
"ppc4xx-host-bridge" type defined in same file.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <c59c28ef440633dbd1de0bda0a93b7862ef91104.1688641673.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_bamboo.c  | 3 +--
 hw/ppc/ppc4xx_pci.c     | 6 +++---
 include/hw/ppc/ppc4xx.h | 2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index f061b8cf3b..45f409c838 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -205,8 +205,7 @@ static void bamboo_init(MachineState *machine)
     ppc4xx_sdram_ddr_enable(PPC4xx_SDRAM_DDR(dev));
 
     /* PCI */
-    dev = sysbus_create_varargs(TYPE_PPC4xx_PCI_HOST_BRIDGE,
-                                PPC440EP_PCI_CONFIG,
+    dev = sysbus_create_varargs(TYPE_PPC4xx_PCI_HOST, PPC440EP_PCI_CONFIG,
                                 qdev_get_gpio_in(uicdev, pci_irq_nrs[0]),
                                 qdev_get_gpio_in(uicdev, pci_irq_nrs[1]),
                                 qdev_get_gpio_in(uicdev, pci_irq_nrs[2]),
diff --git a/hw/ppc/ppc4xx_pci.c b/hw/ppc/ppc4xx_pci.c
index 1d4a50fa7c..fbdf8266d8 100644
--- a/hw/ppc/ppc4xx_pci.c
+++ b/hw/ppc/ppc4xx_pci.c
@@ -46,7 +46,7 @@ struct PCITargetMap {
     uint32_t la;
 };
 
-OBJECT_DECLARE_SIMPLE_TYPE(PPC4xxPCIState, PPC4xx_PCI_HOST_BRIDGE)
+OBJECT_DECLARE_SIMPLE_TYPE(PPC4xxPCIState, PPC4xx_PCI_HOST)
 
 #define PPC4xx_PCI_NR_PMMS 3
 #define PPC4xx_PCI_NR_PTMS 2
@@ -321,7 +321,7 @@ static void ppc4xx_pcihost_realize(DeviceState *dev, Error **errp)
     int i;
 
     h = PCI_HOST_BRIDGE(dev);
-    s = PPC4xx_PCI_HOST_BRIDGE(dev);
+    s = PPC4xx_PCI_HOST(dev);
 
     for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
         sysbus_init_irq(sbd, &s->irq[i]);
@@ -386,7 +386,7 @@ static void ppc4xx_pcihost_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ppc4xx_pcihost_info = {
-    .name          = TYPE_PPC4xx_PCI_HOST_BRIDGE,
+    .name          = TYPE_PPC4xx_PCI_HOST,
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(PPC4xxPCIState),
     .class_init    = ppc4xx_pcihost_class_init,
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index 39ca602442..e053b9751b 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -29,7 +29,7 @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 
-#define TYPE_PPC4xx_PCI_HOST_BRIDGE "ppc4xx-pcihost"
+#define TYPE_PPC4xx_PCI_HOST "ppc4xx-pci-host"
 #define TYPE_PPC460EX_PCIE_HOST "ppc460ex-pcie-host"
 
 /*

From 2460bdff8ed704e1e922d327d15b535594893144 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 6 Jul 2023 13:16:44 +0200
Subject: [PATCH 0452/1353] ppc4xx_pci: Add define for ppc4xx-host-bridge type
 name

Add a QOM type name define for ppc4xx-host-bridge in the common header
and replace direct use of the string name with the constant.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <f6e2956b3a09ee481b970ef7873b374c846ba0a8.1688641673.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_pcix.c    | 3 ++-
 hw/ppc/ppc4xx_pci.c     | 4 ++--
 include/hw/ppc/ppc4xx.h | 1 +
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/ppc440_pcix.c b/hw/ppc/ppc440_pcix.c
index 54286cfef4..9321ca0abd 100644
--- a/hw/ppc/ppc440_pcix.c
+++ b/hw/ppc/ppc440_pcix.c
@@ -498,7 +498,8 @@ static void ppc440_pcix_realize(DeviceState *dev, Error **errp)
                          ppc440_pcix_map_irq, &s->irq, &s->busmem, &s->iomem,
                          PCI_DEVFN(0, 0), 1, TYPE_PCI_BUS);
 
-    s->dev = pci_create_simple(h->bus, PCI_DEVFN(0, 0), "ppc4xx-host-bridge");
+    s->dev = pci_create_simple(h->bus, PCI_DEVFN(0, 0),
+                               TYPE_PPC4xx_HOST_BRIDGE);
 
     memory_region_init(&s->bm, OBJECT(s), "bm-ppc440-pcix", UINT64_MAX);
     memory_region_add_subregion(&s->bm, 0x0, &s->busmem);
diff --git a/hw/ppc/ppc4xx_pci.c b/hw/ppc/ppc4xx_pci.c
index fbdf8266d8..6652119008 100644
--- a/hw/ppc/ppc4xx_pci.c
+++ b/hw/ppc/ppc4xx_pci.c
@@ -333,7 +333,7 @@ static void ppc4xx_pcihost_realize(DeviceState *dev, Error **errp)
                               TYPE_PCI_BUS);
     h->bus = b;
 
-    pci_create_simple(b, 0, "ppc4xx-host-bridge");
+    pci_create_simple(b, 0, TYPE_PPC4xx_HOST_BRIDGE);
 
     /* XXX split into 2 memory regions, one for config space, one for regs */
     memory_region_init(&s->container, OBJECT(s), "pci-container", PCI_ALL_SIZE);
@@ -367,7 +367,7 @@ static void ppc4xx_host_bridge_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ppc4xx_host_bridge_info = {
-    .name          = "ppc4xx-host-bridge",
+    .name          = TYPE_PPC4xx_HOST_BRIDGE,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = ppc4xx_host_bridge_class_init,
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index e053b9751b..766d575e86 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -29,6 +29,7 @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 
+#define TYPE_PPC4xx_HOST_BRIDGE "ppc4xx-host-bridge"
 #define TYPE_PPC4xx_PCI_HOST "ppc4xx-pci-host"
 #define TYPE_PPC460EX_PCIE_HOST "ppc460ex-pcie-host"
 

From 5efa7545205e8e9617afd8dc3cf0180943f975b7 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 6 Jul 2023 13:16:45 +0200
Subject: [PATCH 0453/1353] ppc440_pcix: Rename QOM type define abd move it to
 common header

Rename TYPE_PPC440_PCIX_HOST_BRIDGE to better match its string value,
move it to common header and use it also in sam460ex to replace hard
coded type name.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <1a1c3fe4b120f345d1005ad7ceca4500783691f7.1688641673.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/ppc440_pcix.c    | 9 ++++-----
 hw/ppc/sam460ex.c       | 2 +-
 include/hw/ppc/ppc4xx.h | 1 +
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/ppc/ppc440_pcix.c b/hw/ppc/ppc440_pcix.c
index 9321ca0abd..672090de94 100644
--- a/hw/ppc/ppc440_pcix.c
+++ b/hw/ppc/ppc440_pcix.c
@@ -45,8 +45,7 @@ struct PLBInMap {
     MemoryRegion mr;
 };
 
-#define TYPE_PPC440_PCIX_HOST_BRIDGE "ppc440-pcix-host"
-OBJECT_DECLARE_SIMPLE_TYPE(PPC440PCIXState, PPC440_PCIX_HOST_BRIDGE)
+OBJECT_DECLARE_SIMPLE_TYPE(PPC440PCIXState, PPC440_PCIX_HOST)
 
 #define PPC440_PCIX_NR_POMS 3
 #define PPC440_PCIX_NR_PIMS 3
@@ -399,7 +398,7 @@ static const MemoryRegionOps pci_reg_ops = {
 
 static void ppc440_pcix_reset(DeviceState *dev)
 {
-    struct PPC440PCIXState *s = PPC440_PCIX_HOST_BRIDGE(dev);
+    struct PPC440PCIXState *s = PPC440_PCIX_HOST(dev);
     int i;
 
     for (i = 0; i < PPC440_PCIX_NR_POMS; i++) {
@@ -489,7 +488,7 @@ static void ppc440_pcix_realize(DeviceState *dev, Error **errp)
     PCIHostState *h;
 
     h = PCI_HOST_BRIDGE(dev);
-    s = PPC440_PCIX_HOST_BRIDGE(dev);
+    s = PPC440_PCIX_HOST(dev);
 
     sysbus_init_irq(sbd, &s->irq);
     memory_region_init(&s->busmem, OBJECT(dev), "pci-mem", UINT64_MAX);
@@ -529,7 +528,7 @@ static void ppc440_pcix_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo ppc440_pcix_info = {
-    .name          = TYPE_PPC440_PCIX_HOST_BRIDGE,
+    .name          = TYPE_PPC440_PCIX_HOST,
     .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(PPC440PCIXState),
     .class_init    = ppc440_pcix_class_init,
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 7da38bd58e..1e615b8d35 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -438,7 +438,7 @@ static void sam460ex_init(MachineState *machine)
 
     /* PCI bus */
     /* All PCI irqs are connected to the same UIC pin (cf. UBoot source) */
-    dev = sysbus_create_simple("ppc440-pcix-host", 0xc0ec00000,
+    dev = sysbus_create_simple(TYPE_PPC440_PCIX_HOST, 0xc0ec00000,
                                qdev_get_gpio_in(uic[1], 0));
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, 0xc08000000);
     pci_bus = PCI_BUS(qdev_get_child_bus(dev, "pci.0"));
diff --git a/include/hw/ppc/ppc4xx.h b/include/hw/ppc/ppc4xx.h
index 766d575e86..ea7740239b 100644
--- a/include/hw/ppc/ppc4xx.h
+++ b/include/hw/ppc/ppc4xx.h
@@ -31,6 +31,7 @@
 
 #define TYPE_PPC4xx_HOST_BRIDGE "ppc4xx-host-bridge"
 #define TYPE_PPC4xx_PCI_HOST "ppc4xx-pci-host"
+#define TYPE_PPC440_PCIX_HOST "ppc440-pcix-host"
 #define TYPE_PPC460EX_PCIE_HOST "ppc460ex-pcie-host"
 
 /*

From b0afb574bad3c3a27acd2c3e7a17306a3648b0ac Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Thu, 6 Jul 2023 12:15:28 +0930
Subject: [PATCH 0454/1353] ppc/pnv: Log all unimp warnings with similar
 message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the function name so there's an indication as to where the message
is coming from. Change all prints to use the offset instead of the
address.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230706024528.40065-1-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_core.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 8a72171ce0..a59f3f303d 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -85,8 +85,8 @@ static uint64_t pnv_core_power8_xscom_read(void *opaque, hwaddr addr,
         val = 0x24f000000000000ull;
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
-                  addr);
+        qemu_log_mask(LOG_UNIMP, "%s: unimp read 0x%08x\n", __func__,
+                      offset);
     }
 
     return val;
@@ -95,8 +95,10 @@ static uint64_t pnv_core_power8_xscom_read(void *opaque, hwaddr addr,
 static void pnv_core_power8_xscom_write(void *opaque, hwaddr addr, uint64_t val,
                                         unsigned int width)
 {
-    qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx "\n",
-                  addr);
+    uint32_t offset = addr >> 3;
+
+    qemu_log_mask(LOG_UNIMP, "%s: unimp write 0x%08x\n", __func__,
+                  offset);
 }
 
 static const MemoryRegionOps pnv_core_power8_xscom_ops = {
@@ -140,8 +142,8 @@ static uint64_t pnv_core_power9_xscom_read(void *opaque, hwaddr addr,
         val = 0;
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
-                  addr);
+        qemu_log_mask(LOG_UNIMP, "%s: unimp read 0x%08x\n", __func__,
+                      offset);
     }
 
     return val;
@@ -157,8 +159,8 @@ static void pnv_core_power9_xscom_write(void *opaque, hwaddr addr, uint64_t val,
     case PNV9_XSCOM_EC_PPM_SPECIAL_WKUP_OTR:
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx "\n",
-                      addr);
+        qemu_log_mask(LOG_UNIMP, "%s: unimp write 0x%08x\n", __func__,
+                      offset);
     }
 }
 
@@ -189,8 +191,8 @@ static uint64_t pnv_core_power10_xscom_read(void *opaque, hwaddr addr,
         val = 0;
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
-                  addr);
+        qemu_log_mask(LOG_UNIMP, "%s: unimp read 0x%08x\n", __func__,
+                      offset);
     }
 
     return val;
@@ -203,8 +205,8 @@ static void pnv_core_power10_xscom_write(void *opaque, hwaddr addr,
 
     switch (offset) {
     default:
-        qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx "\n",
-                      addr);
+        qemu_log_mask(LOG_UNIMP, "%s: unimp write 0x%08x\n", __func__,
+                      offset);
     }
 }
 
@@ -419,7 +421,7 @@ static uint64_t pnv_quad_power9_xscom_read(void *opaque, hwaddr addr,
         val = 0;
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "%s: reading @0x%08x\n", __func__,
+        qemu_log_mask(LOG_UNIMP, "%s: unimp read 0x%08x\n", __func__,
                       offset);
     }
 
@@ -436,7 +438,7 @@ static void pnv_quad_power9_xscom_write(void *opaque, hwaddr addr, uint64_t val,
     case P9X_EX_NCU_SPEC_BAR + 0x400: /* Second EX */
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "%s: writing @0x%08x\n", __func__,
+        qemu_log_mask(LOG_UNIMP, "%s: unimp write 0x%08x\n", __func__,
                   offset);
     }
 }
@@ -463,7 +465,7 @@ static uint64_t pnv_quad_power10_xscom_read(void *opaque, hwaddr addr,
 
     switch (offset) {
     default:
-        qemu_log_mask(LOG_UNIMP, "%s: reading @0x%08x\n", __func__,
+        qemu_log_mask(LOG_UNIMP, "%s: unimp read 0x%08x\n", __func__,
                       offset);
     }
 
@@ -477,7 +479,7 @@ static void pnv_quad_power10_xscom_write(void *opaque, hwaddr addr,
 
     switch (offset) {
     default:
-        qemu_log_mask(LOG_UNIMP, "%s: writing @0x%08x\n", __func__,
+        qemu_log_mask(LOG_UNIMP, "%s: unimp write 0x%08x\n", __func__,
                       offset);
     }
 }

From aa2addf96f2629101ef0aa0c9226d38867c72d76 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 6 Jul 2023 15:39:22 +1000
Subject: [PATCH 0455/1353] ppc/pnv: Set P10 core xscom region size to match
 hardware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The P10 core xscom memory regions overlap because the size is wrong.
The P10 core+L2 xscom region size is allocated as 0x1000 (with some
unused ranges). "EC" is used as a closer match, as "EX" includes L3
which has a disjoint xscom range that would require a different
region if it were implemented.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230706053923.115003-2-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv_core.c          | 6 ++++--
 include/hw/ppc/pnv_core.h  | 1 +
 include/hw/ppc/pnv_xscom.h | 2 +-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index a59f3f303d..9e7cf341dc 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -298,9 +298,8 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
     }
 
     snprintf(name, sizeof(name), "xscom-core.%d", cc->core_id);
-    /* TODO: check PNV_XSCOM_EX_SIZE for p10 */
     pnv_xscom_region_init(&pc->xscom_regs, OBJECT(dev), pcc->xscom_ops,
-                          pc, name, PNV_XSCOM_EX_SIZE);
+                          pc, name, pcc->xscom_size);
 
     qemu_register_reset(pnv_core_reset, pc);
     return;
@@ -352,6 +351,7 @@ static void pnv_core_power8_class_init(ObjectClass *oc, void *data)
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
     pcc->xscom_ops = &pnv_core_power8_xscom_ops;
+    pcc->xscom_size = PNV_XSCOM_EX_SIZE;
 }
 
 static void pnv_core_power9_class_init(ObjectClass *oc, void *data)
@@ -359,6 +359,7 @@ static void pnv_core_power9_class_init(ObjectClass *oc, void *data)
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
     pcc->xscom_ops = &pnv_core_power9_xscom_ops;
+    pcc->xscom_size = PNV_XSCOM_EX_SIZE;
 }
 
 static void pnv_core_power10_class_init(ObjectClass *oc, void *data)
@@ -366,6 +367,7 @@ static void pnv_core_power10_class_init(ObjectClass *oc, void *data)
     PnvCoreClass *pcc = PNV_CORE_CLASS(oc);
 
     pcc->xscom_ops = &pnv_core_power10_xscom_ops;
+    pcc->xscom_size = PNV10_XSCOM_EC_SIZE;
 }
 
 static void pnv_core_class_init(ObjectClass *oc, void *data)
diff --git a/include/hw/ppc/pnv_core.h b/include/hw/ppc/pnv_core.h
index 77ef00f47a..aa5ca281fc 100644
--- a/include/hw/ppc/pnv_core.h
+++ b/include/hw/ppc/pnv_core.h
@@ -46,6 +46,7 @@ struct PnvCoreClass {
     DeviceClass parent_class;
 
     const MemoryRegionOps *xscom_ops;
+    uint64_t xscom_size;
 };
 
 #define PNV_CORE_TYPE_SUFFIX "-" TYPE_PNV_CORE
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index f7da9a1dc6..a4c9d95dc5 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -133,7 +133,7 @@ struct PnvXScomInterfaceClass {
 
 #define PNV10_XSCOM_EC_BASE(core) \
     ((uint64_t) PNV10_XSCOM_EQ_BASE(core) | PNV10_XSCOM_EC(core & 0x3))
-#define PNV10_XSCOM_EC_SIZE        0x100000
+#define PNV10_XSCOM_EC_SIZE        0x1000
 
 #define PNV10_XSCOM_PSIHB_BASE     0x3011D00
 #define PNV10_XSCOM_PSIHB_SIZE     0x100

From e1a821d47167a46e4386e763cd7e7901c856c4b2 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 6 Jul 2023 15:39:23 +1000
Subject: [PATCH 0456/1353] tests/qtest: Add xscom tests for powernv10 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add basic chip and core xscom tests for powernv10 machine, equivalent
to tests for powernv8 and 9.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230706053923.115003-3-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 tests/qtest/pnv-xscom-test.c | 47 ++++++++++++++++++++++++++++--------
 1 file changed, 37 insertions(+), 10 deletions(-)

diff --git a/tests/qtest/pnv-xscom-test.c b/tests/qtest/pnv-xscom-test.c
index 2c46d5cf6d..8a5ac11037 100644
--- a/tests/qtest/pnv-xscom-test.c
+++ b/tests/qtest/pnv-xscom-test.c
@@ -15,6 +15,7 @@ typedef enum PnvChipType {
     PNV_CHIP_POWER8,      /* AKA Venice */
     PNV_CHIP_POWER8NVL,   /* AKA Naples */
     PNV_CHIP_POWER9,      /* AKA Nimbus */
+    PNV_CHIP_POWER10,
 } PnvChipType;
 
 typedef struct PnvChip {
@@ -46,13 +47,22 @@ static const PnvChip pnv_chips[] = {
         .cfam_id    = 0x220d104900008000ull,
         .first_core = 0x0,
     },
+    {
+        .chip_type  = PNV_CHIP_POWER10,
+        .cpu_model  = "POWER10",
+        .xscom_base = 0x000603fc00000000ull,
+        .cfam_id    = 0x120da04900008000ull,
+        .first_core = 0x0,
+    },
 };
 
 static uint64_t pnv_xscom_addr(const PnvChip *chip, uint32_t pcba)
 {
     uint64_t addr = chip->xscom_base;
 
-    if (chip->chip_type == PNV_CHIP_POWER9) {
+    if (chip->chip_type == PNV_CHIP_POWER10) {
+        addr |= ((uint64_t) pcba << 3);
+    } else if (chip->chip_type == PNV_CHIP_POWER9) {
         addr |= ((uint64_t) pcba << 3);
     } else {
         addr |= (((uint64_t) pcba << 4) & ~0xffull) |
@@ -82,6 +92,8 @@ static void test_cfam_id(const void *data)
 
     if (chip->chip_type == PNV_CHIP_POWER9) {
         machine = "powernv9";
+    } else if (chip->chip_type == PNV_CHIP_POWER10) {
+        machine = "powernv10";
     }
 
     qts = qtest_initf("-M %s -accel tcg -cpu %s",
@@ -96,23 +108,36 @@ static void test_cfam_id(const void *data)
     (PNV_XSCOM_EX_CORE_BASE | ((uint64_t)(core) << 24))
 #define PNV_XSCOM_P9_EC_BASE(core) \
     ((uint64_t)(((core) & 0x1F) + 0x20) << 24)
+#define PNV_XSCOM_P10_EC_BASE(core) \
+    ((uint64_t)((((core) & ~0x3) + 0x20) << 24) + 0x20000 + \
+     (0x1000 << (3 - (core & 0x3))))
 
 #define PNV_XSCOM_EX_DTS_RESULT0     0x50000
 
 static void test_xscom_core(QTestState *qts, const PnvChip *chip)
 {
-    uint32_t first_core_dts0 = PNV_XSCOM_EX_DTS_RESULT0;
-    uint64_t dts0;
+    if (chip->chip_type == PNV_CHIP_POWER10) {
+        uint32_t first_core_thread_state =
+                 PNV_XSCOM_P10_EC_BASE(chip->first_core) + 0x412;
+        uint64_t thread_state;
 
-    if (chip->chip_type != PNV_CHIP_POWER9) {
-        first_core_dts0 |= PNV_XSCOM_EX_BASE(chip->first_core);
+        thread_state = pnv_xscom_read(qts, chip, first_core_thread_state);
+
+        g_assert_cmphex(thread_state, ==, 0);
     } else {
-        first_core_dts0 |= PNV_XSCOM_P9_EC_BASE(chip->first_core);
+        uint32_t first_core_dts0 = PNV_XSCOM_EX_DTS_RESULT0;
+        uint64_t dts0;
+
+        if (chip->chip_type == PNV_CHIP_POWER9) {
+            first_core_dts0 |= PNV_XSCOM_P9_EC_BASE(chip->first_core);
+        } else { /* POWER8 */
+            first_core_dts0 |= PNV_XSCOM_EX_BASE(chip->first_core);
+        }
+
+        dts0 = pnv_xscom_read(qts, chip, first_core_dts0);
+
+        g_assert_cmphex(dts0, ==, 0x26f024f023f0000ull);
     }
-
-    dts0 = pnv_xscom_read(qts, chip, first_core_dts0);
-
-    g_assert_cmphex(dts0, ==, 0x26f024f023f0000ull);
 }
 
 static void test_core(const void *data)
@@ -123,6 +148,8 @@ static void test_core(const void *data)
 
     if (chip->chip_type == PNV_CHIP_POWER9) {
         machine = "powernv9";
+    } else if (chip->chip_type == PNV_CHIP_POWER10) {
+        machine = "powernv10";
     }
 
     qts = qtest_initf("-M %s -accel tcg -cpu %s",

From 55a7fa34f8982f22497b2453787336acc7f79a7c Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Mon, 3 Jul 2023 22:03:01 +1000
Subject: [PATCH 0457/1353] target/ppc: Machine check on invalid real address
 access on POWER9/10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ppc currently silently accepts invalid real address access. Catch
these and turn them into machine checks on POWER9/10 machines.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230703120301.45313-1-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu_init.c    |  1 +
 target/ppc/excp_helper.c | 49 ++++++++++++++++++++++++++++++++++++++++
 target/ppc/internal.h    |  5 ++++
 3 files changed, 55 insertions(+)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 720aad9e05..6ac1765a8d 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7335,6 +7335,7 @@ static const struct TCGCPUOps ppc_tcg_ops = {
   .cpu_exec_enter = ppc_cpu_exec_enter,
   .cpu_exec_exit = ppc_cpu_exec_exit,
   .do_unaligned_access = ppc_cpu_do_unaligned_access,
+  .do_transaction_failed = ppc_cpu_do_transaction_failed,
 #endif /* !CONFIG_USER_ONLY */
 };
 #endif /* CONFIG_TCG */
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 7683ea0fc9..003805b202 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -1428,7 +1428,9 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
         /* machine check exceptions don't have ME set */
         new_msr &= ~((target_ulong)1 << MSR_ME);
 
+        msr |= env->error_code;
         break;
+
     case POWERPC_EXCP_DSI:       /* Data storage exception                   */
         trace_ppc_excp_dsi(env->spr[SPR_DSISR], env->spr[SPR_DAR]);
         break;
@@ -3188,5 +3190,52 @@ void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     env->error_code = insn & 0x03FF0000;
     cpu_loop_exit(cs);
 }
+
+void ppc_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+                                   vaddr vaddr, unsigned size,
+                                   MMUAccessType access_type,
+                                   int mmu_idx, MemTxAttrs attrs,
+                                   MemTxResult response, uintptr_t retaddr)
+{
+    CPUPPCState *env = cs->env_ptr;
+
+    switch (env->excp_model) {
+#if defined(TARGET_PPC64)
+    case POWERPC_EXCP_POWER9:
+    case POWERPC_EXCP_POWER10:
+        /*
+         * Machine check codes can be found in processor User Manual or
+         * Linux or skiboot source.
+         */
+        if (access_type == MMU_DATA_LOAD) {
+            env->spr[SPR_DAR] = vaddr;
+            env->spr[SPR_DSISR] = PPC_BIT(57);
+            env->error_code = PPC_BIT(42);
+
+        } else if (access_type == MMU_DATA_STORE) {
+            /*
+             * MCE for stores in POWER is asynchronous so hardware does
+             * not set DAR, but QEMU can do better.
+             */
+            env->spr[SPR_DAR] = vaddr;
+            env->error_code = PPC_BIT(36) | PPC_BIT(43) | PPC_BIT(45);
+            env->error_code |= PPC_BIT(42);
+
+        } else { /* Fetch */
+            env->error_code = PPC_BIT(36) | PPC_BIT(44) | PPC_BIT(45);
+        }
+        break;
+#endif
+    default:
+        /*
+         * TODO: Check behaviour for other CPUs, for now do nothing.
+         * Could add a basic MCE even if real hardware ignores.
+         */
+        return;
+    }
+
+    cs->exception_index = POWERPC_EXCP_MCHECK;
+    cpu_loop_exit_restore(cs, retaddr);
+}
 #endif /* CONFIG_TCG */
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target/ppc/internal.h b/target/ppc/internal.h
index 901bae6d39..57acb3212c 100644
--- a/target/ppc/internal.h
+++ b/target/ppc/internal.h
@@ -296,6 +296,11 @@ bool ppc_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 G_NORETURN void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
                                             MMUAccessType access_type, int mmu_idx,
                                             uintptr_t retaddr);
+void ppc_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+                                   vaddr addr, unsigned size,
+                                   MMUAccessType access_type,
+                                   int mmu_idx, MemTxAttrs attrs,
+                                   MemTxResult response, uintptr_t retaddr);
 #endif
 
 FIELD(GER_MSK, XMSK, 0, 4)

From 597645ccb570e3288f6937c7710be110b6c8f254 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 13:51:19 +0200
Subject: [PATCH 0458/1353] target/ppc: Have 'kvm_ppc.h' include 'sysemu/kvm.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"kvm_ppc.h" declares:

  int kvm_handle_nmi(PowerPCCPU *cpu, struct kvm_run *run);

'struct kvm_run' is declared in "sysemu/kvm.h", include it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230627115124.19632-2-philmd@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/kvm_ppc.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index 611debc3ce..2e395416f0 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -9,6 +9,7 @@
 #ifndef KVM_PPC_H
 #define KVM_PPC_H
 
+#include "sysemu/kvm.h"
 #include "exec/hwaddr.h"
 #include "cpu.h"
 

From 1b4b1bb5064dc08df6fd4ce9813b5f3370eda085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 13:51:20 +0200
Subject: [PATCH 0459/1353] target/ppc: Reorder #ifdef'ry in kvm_ppc.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keep a single if/else/endif block checking CONFIG_KVM.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230627115124.19632-3-philmd@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/kvm_ppc.h | 62 ++++++++++++++++++++------------------------
 1 file changed, 28 insertions(+), 34 deletions(-)

diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index 2e395416f0..49954a300b 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -93,7 +93,34 @@ void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset);
 
 int kvm_handle_nmi(PowerPCCPU *cpu, struct kvm_run *run);
 
-#else
+#define kvmppc_eieio() \
+    do {                                          \
+        if (kvm_enabled()) {                          \
+            asm volatile("eieio" : : : "memory"); \
+        } \
+    } while (0)
+
+/* Store data cache blocks back to memory */
+static inline void kvmppc_dcbst_range(PowerPCCPU *cpu, uint8_t *addr, int len)
+{
+    uint8_t *p;
+
+    for (p = addr; p < addr + len; p += cpu->env.dcache_line_size) {
+        asm volatile("dcbst 0,%0" : : "r"(p) : "memory");
+    }
+}
+
+/* Invalidate instruction cache blocks */
+static inline void kvmppc_icbi_range(PowerPCCPU *cpu, uint8_t *addr, int len)
+{
+    uint8_t *p;
+
+    for (p = addr; p < addr + len; p += cpu->env.icache_line_size) {
+        asm volatile("icbi 0,%0" : : "r"(p));
+    }
+}
+
+#else /* !CONFIG_KVM */
 
 static inline uint32_t kvmppc_get_tbfreq(void)
 {
@@ -440,10 +467,6 @@ static inline bool kvmppc_pvr_workaround_required(PowerPCCPU *cpu)
     return false;
 }
 
-#endif
-
-#ifndef CONFIG_KVM
-
 #define kvmppc_eieio() do { } while (0)
 
 static inline void kvmppc_dcbst_range(PowerPCCPU *cpu, uint8_t *addr, int len)
@@ -454,35 +477,6 @@ static inline void kvmppc_icbi_range(PowerPCCPU *cpu, uint8_t *addr, int len)
 {
 }
 
-#else   /* CONFIG_KVM */
-
-#define kvmppc_eieio() \
-    do {                                          \
-        if (kvm_enabled()) {                          \
-            asm volatile("eieio" : : : "memory"); \
-        } \
-    } while (0)
-
-/* Store data cache blocks back to memory */
-static inline void kvmppc_dcbst_range(PowerPCCPU *cpu, uint8_t *addr, int len)
-{
-    uint8_t *p;
-
-    for (p = addr; p < addr + len; p += cpu->env.dcache_line_size) {
-        asm volatile("dcbst 0,%0" : : "r"(p) : "memory");
-    }
-}
-
-/* Invalidate instruction cache blocks */
-static inline void kvmppc_icbi_range(PowerPCCPU *cpu, uint8_t *addr, int len)
-{
-    uint8_t *p;
-
-    for (p = addr; p < addr + len; p += cpu->env.icache_line_size) {
-        asm volatile("icbi 0,%0" : : "r"(p));
-    }
-}
-
 #endif  /* CONFIG_KVM */
 
 #endif /* KVM_PPC_H */

From 66453c0f0cbfcc64be3af1f738dd057a2be560da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 13:51:21 +0200
Subject: [PATCH 0460/1353] target/ppc: Move CPU QOM definitions to cpu-qom.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230627115124.19632-4-philmd@linaro.org>
[dhb: keep cpu_list define in target/ppc/cpu.h]
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu-qom.h | 4 ++++
 target/ppc/cpu.h     | 4 ----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
index 9666f54f65..c2a66a90f7 100644
--- a/target/ppc/cpu-qom.h
+++ b/target/ppc/cpu-qom.h
@@ -31,6 +31,10 @@
 
 OBJECT_DECLARE_CPU_TYPE(PowerPCCPU, PowerPCCPUClass, POWERPC_CPU)
 
+#define POWERPC_CPU_TYPE_SUFFIX "-" TYPE_POWERPC_CPU
+#define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
+#define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
+
 ObjectClass *ppc_cpu_class_by_name(const char *name);
 
 typedef struct CPUArchState CPUPPCState;
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index b269b0d090..25fac9577a 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1471,10 +1471,6 @@ static inline uint64_t ppc_dump_gpr(CPUPPCState *env, int gprn)
 int ppc_dcr_read(ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp);
 int ppc_dcr_write(ppc_dcr_t *dcr_env, int dcrn, uint32_t val);
 
-#define POWERPC_CPU_TYPE_SUFFIX "-" TYPE_POWERPC_CPU
-#define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
-#define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
-
 #define cpu_list ppc_cpu_list
 
 /* MMU modes definitions */

From be67dd4afea13b3a18fab142082a40a59df439ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 13:51:22 +0200
Subject: [PATCH 0461/1353] target/ppc: Define TYPE_HOST_POWERPC_CPU in
 cpu-qom.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TYPE_HOST_POWERPC_CPU is used in various places of cpu_init.c,
in order to restrict "kvm_ppc.h" to sysemu, move this QOM-related
definition to cpu-qom.h.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-ID: <20230627115124.19632-5-philmd@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu-qom.h | 2 ++
 target/ppc/kvm_ppc.h | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/ppc/cpu-qom.h b/target/ppc/cpu-qom.h
index c2a66a90f7..be33786bd8 100644
--- a/target/ppc/cpu-qom.h
+++ b/target/ppc/cpu-qom.h
@@ -35,6 +35,8 @@ OBJECT_DECLARE_CPU_TYPE(PowerPCCPU, PowerPCCPUClass, POWERPC_CPU)
 #define POWERPC_CPU_TYPE_NAME(model) model POWERPC_CPU_TYPE_SUFFIX
 #define CPU_RESOLVING_TYPE TYPE_POWERPC_CPU
 
+#define TYPE_HOST_POWERPC_CPU POWERPC_CPU_TYPE_NAME("host")
+
 ObjectClass *ppc_cpu_class_by_name(const char *name);
 
 typedef struct CPUArchState CPUPPCState;
diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index 49954a300b..901e188c9a 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -13,8 +13,6 @@
 #include "exec/hwaddr.h"
 #include "cpu.h"
 
-#define TYPE_HOST_POWERPC_CPU POWERPC_CPU_TYPE_NAME("host")
-
 #ifdef CONFIG_KVM
 
 uint32_t kvmppc_get_tbfreq(void);

From d0815cb808fe0cebe04aba5339e3f5cfe08cb4d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 13:51:23 +0200
Subject: [PATCH 0462/1353] target/ppc: Restrict 'kvm_ppc.h' to sysemu in
 cpu_init.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

User emulation shouldn't need any of the KVM prototypes
declared in "kvm_ppc.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-ID: <20230627115124.19632-6-philmd@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/cpu_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 6ac1765a8d..02b7aad9b0 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -21,7 +21,6 @@
 #include "qemu/osdep.h"
 #include "disas/dis-asm.h"
 #include "gdbstub/helpers.h"
-#include "kvm_ppc.h"
 #include "sysemu/cpus.h"
 #include "sysemu/hw_accel.h"
 #include "sysemu/tcg.h"
@@ -49,6 +48,7 @@
 #ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
 #include "hw/intc/intc.h"
+#include "kvm_ppc.h"
 #endif
 
 /* #define PPC_DEBUG_SPR */

From 9c1ce7723bbe18680f57ac318947fe7c7214d474 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 13:51:24 +0200
Subject: [PATCH 0463/1353] target/ppc: Remove pointless checks of
 CONFIG_USER_ONLY in 'kvm_ppc.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-ID: <20230627115124.19632-7-philmd@linaro.org>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/kvm_ppc.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index 901e188c9a..6a4dd9c560 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -42,7 +42,6 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
-#ifndef CONFIG_USER_ONLY
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
 void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t page_shift,
@@ -52,7 +51,6 @@ int kvmppc_remove_spapr_tce(void *table, int pfd, uint32_t window_size);
 int kvmppc_reset_htab(int shift_hint);
 uint64_t kvmppc_vrma_limit(unsigned int hash_shift);
 bool kvmppc_has_cap_spapr_vfio(void);
-#endif /* !CONFIG_USER_ONLY */
 bool kvmppc_has_cap_epr(void);
 int kvmppc_define_rtas_kernel_token(uint32_t token, const char *function);
 int kvmppc_get_htab_fd(bool write, uint64_t index, Error **errp);
@@ -262,7 +260,6 @@ static inline void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset)
 {
 }
 
-#ifndef CONFIG_USER_ONLY
 static inline bool kvmppc_spapr_use_multitce(void)
 {
     return false;
@@ -322,8 +319,6 @@ static inline void kvmppc_write_hpte(hwaddr ptex, uint64_t pte0, uint64_t pte1)
     abort();
 }
 
-#endif /* !CONFIG_USER_ONLY */
-
 static inline bool kvmppc_has_cap_epr(void)
 {
     return false;

From 4271f4038372f174dbafffacca1a748d058a03ba Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Mon, 5 Jun 2023 16:21:25 +0200
Subject: [PATCH 0464/1353] virtio-net: correctly report maximum tx_queue_size
 value

Maximum value for tx_queue_size depends on the backend type.
1024 for vDPA/vhost-user, 256 for all the others.

The value is returned by virtio_net_max_tx_queue_size() to set the
parameter:

    n->net_conf.tx_queue_size = MIN(virtio_net_max_tx_queue_size(n),
                                    n->net_conf.tx_queue_size);

But the parameter checking uses VIRTQUEUE_MAX_SIZE (1024).

So the parameter is silently ignored and ethtool reports a different
value than the one provided by the user.

   ... -netdev tap,... -device virtio-net,tx_queue_size=1024

    # ethtool -g enp0s2
    Ring parameters for enp0s2:
    Pre-set maximums:
    RX:		256
    RX Mini:	n/a
    RX Jumbo:	n/a
    TX:		256
    Current hardware settings:
    RX:		256
    RX Mini:	n/a
    RX Jumbo:	n/a
    TX:		256

   ... -netdev vhost-user,... -device virtio-net,tx_queue_size=2048

    Invalid tx_queue_size (= 2048), must be a power of 2 between 256 and 1024

With this patch the correct maximum value is checked and displayed.

For vDPA/vhost-user:

    Invalid tx_queue_size (= 2048), must be a power of 2 between 256 and 1024

For all the others:

    Invalid tx_queue_size (= 512), must be a power of 2 between 256 and 256

Fixes: 2eef278b9e63 ("virtio-net: fix tx queue size for !vhost-user")
Cc: mst@redhat.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index aa421a908a..04783f5b94 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3630,12 +3630,12 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     }
 
     if (n->net_conf.tx_queue_size < VIRTIO_NET_TX_QUEUE_MIN_SIZE ||
-        n->net_conf.tx_queue_size > VIRTQUEUE_MAX_SIZE ||
+        n->net_conf.tx_queue_size > virtio_net_max_tx_queue_size(n) ||
         !is_power_of_2(n->net_conf.tx_queue_size)) {
         error_setg(errp, "Invalid tx_queue_size (= %" PRIu16 "), "
                    "must be a power of 2 between %d and %d",
                    n->net_conf.tx_queue_size, VIRTIO_NET_TX_QUEUE_MIN_SIZE,
-                   VIRTQUEUE_MAX_SIZE);
+                   virtio_net_max_tx_queue_size(n));
         virtio_cleanup(vdev);
         return;
     }

From 140eae9c8f760e9260356fe9b56b802a02f0a9d2 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:13 +0800
Subject: [PATCH 0465/1353] hw/net: e1000: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

This actually reverts commit 78aeb23eded2d0b765bf9145c71f80025b568acd.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index aae5f0bdc0..093c2d4531 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -888,7 +888,6 @@ e1000_receive_iov(NetClientState *nc, const struct iovec *iov, int iovcnt)
     uint16_t vlan_special = 0;
     uint8_t vlan_status = 0;
     uint8_t min_buf[ETH_ZLEN];
-    struct iovec min_iov;
     uint8_t *filter_buf = iov->iov_base;
     size_t size = iov_size(iov, iovcnt);
     size_t iov_ofs = 0;
@@ -905,15 +904,7 @@ e1000_receive_iov(NetClientState *nc, const struct iovec *iov, int iovcnt)
         return 0;
     }
 
-    /* Pad to minimum Ethernet frame length */
-    if (size < sizeof(min_buf)) {
-        iov_to_buf(iov, iovcnt, 0, min_buf, size);
-        memset(&min_buf[size], 0, sizeof(min_buf) - size);
-        min_iov.iov_base = filter_buf = min_buf;
-        min_iov.iov_len = size = sizeof(min_buf);
-        iovcnt = 1;
-        iov = &min_iov;
-    } else if (iov->iov_len < MAXIMUM_ETHERNET_HDR_LEN) {
+    if (iov->iov_len < MAXIMUM_ETHERNET_HDR_LEN) {
         /* This is very unlikely, but may happen. */
         iov_to_buf(iov, iovcnt, 0, min_buf, MAXIMUM_ETHERNET_HDR_LEN);
         filter_buf = min_buf;

From c445f200ad241b443aa7a61a5381b26f56a18f0e Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:14 +0800
Subject: [PATCH 0466/1353] hw/net: vmxnet3: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

This actually reverts commit 40a87c6c9b11ef9c14e0301f76abf0eb2582f08e.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vmxnet3.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 18b9edfdb2..5dfacb1098 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -40,7 +40,6 @@
 
 #define PCI_DEVICE_ID_VMWARE_VMXNET3_REVISION 0x1
 #define VMXNET3_MSIX_BAR_SIZE 0x2000
-#define MIN_BUF_SIZE 60
 
 /* Compatibility flags for migration */
 #define VMXNET3_COMPAT_FLAG_OLD_MSI_OFFSETS_BIT 0
@@ -1977,7 +1976,6 @@ vmxnet3_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
     VMXNET3State *s = qemu_get_nic_opaque(nc);
     size_t bytes_indicated;
-    uint8_t min_buf[MIN_BUF_SIZE];
 
     if (!vmxnet3_can_receive(nc)) {
         VMW_PKPRN("Cannot receive now");
@@ -1990,14 +1988,6 @@ vmxnet3_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         size -= sizeof(struct virtio_net_hdr);
     }
 
-    /* Pad to minimum Ethernet frame length */
-    if (size < sizeof(min_buf)) {
-        memcpy(min_buf, buf, size);
-        memset(&min_buf[size], 0, sizeof(min_buf) - size);
-        buf = min_buf;
-        size = sizeof(min_buf);
-    }
-
     net_rx_pkt_set_packet_type(s->rx_pkt,
         get_eth_packet_type(PKT_GET_ETH_HDR(buf)));
 

From c58da33f2f8410b6f22cd1d33377dadf3a4d8867 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:15 +0800
Subject: [PATCH 0467/1353] hw/net: i82596: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/i82596.c | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index ec21e2699a..ab26f8bea1 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -72,10 +72,6 @@ enum commands {
 #define I596_EOF        0x8000
 #define SIZE_MASK       0x3fff
 
-#define ETHER_TYPE_LEN 2
-#define VLAN_TCI_LEN 2
-#define VLAN_HLEN (ETHER_TYPE_LEN + VLAN_TCI_LEN)
-
 /* various flags in the chip config registers */
 #define I596_PREFETCH   (s->config[0] & 0x80)
 #define I596_PROMISC    (s->config[8] & 0x01)
@@ -488,8 +484,6 @@ bool i82596_can_receive(NetClientState *nc)
     return true;
 }
 
-#define MIN_BUF_SIZE 60
-
 ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
 {
     I82596State *s = qemu_get_nic_opaque(nc);
@@ -500,7 +494,6 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
     size_t bufsz = sz; /* length of data in buf */
     uint32_t crc;
     uint8_t *crc_ptr;
-    uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];
     static const uint8_t broadcast_macaddr[6] = {
                 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
@@ -583,17 +576,6 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
         }
     }
 
-    /* if too small buffer, then expand it */
-    if (len < MIN_BUF_SIZE + VLAN_HLEN) {
-        memcpy(buf1, buf, len);
-        memset(buf1 + len, 0, MIN_BUF_SIZE + VLAN_HLEN - len);
-        buf = buf1;
-        if (len < MIN_BUF_SIZE) {
-            len = MIN_BUF_SIZE;
-        }
-        bufsz = len;
-    }
-
     /* Calculate the ethernet checksum (4 bytes) */
     len += 4;
     crc = cpu_to_be32(crc32(~0, buf, sz));

From 05db4476c5d25e437d807175de9f862bf5bf732c Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:16 +0800
Subject: [PATCH 0468/1353] hw/net: ne2000: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/ne2000.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
index 3f31d04efb..d79c884d50 100644
--- a/hw/net/ne2000.c
+++ b/hw/net/ne2000.c
@@ -167,15 +167,12 @@ static int ne2000_buffer_full(NE2000State *s)
     return 0;
 }
 
-#define MIN_BUF_SIZE 60
-
 ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
 {
     NE2000State *s = qemu_get_nic_opaque(nc);
     size_t size = size_;
     uint8_t *p;
     unsigned int total_len, next, avail, len, index, mcast_idx;
-    uint8_t buf1[60];
     static const uint8_t broadcast_macaddr[6] =
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
@@ -213,15 +210,6 @@ ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
         }
     }
 
-
-    /* if too small buffer, then expand it */
-    if (size < MIN_BUF_SIZE) {
-        memcpy(buf1, buf, size);
-        memset(buf1 + size, 0, MIN_BUF_SIZE - size);
-        buf = buf1;
-        size = MIN_BUF_SIZE;
-    }
-
     index = s->curpag << 8;
     if (index >= NE2000_PMEM_END) {
         index = s->start;

From 6d0d261dbfa6122e9b3bdcab7d934ca49f069c21 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:17 +0800
Subject: [PATCH 0469/1353] hw/net: pcnet: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/pcnet.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index d456094575..02828ae716 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -987,7 +987,6 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
 {
     PCNetState *s = qemu_get_nic_opaque(nc);
     int is_padr = 0, is_bcast = 0, is_ladr = 0;
-    uint8_t buf1[60];
     int remaining;
     int crc_err = 0;
     size_t size = size_;
@@ -1000,14 +999,6 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
     printf("pcnet_receive size=%zu\n", size);
 #endif
 
-    /* if too small buffer, then expand it */
-    if (size < MIN_BUF_SIZE) {
-        memcpy(buf1, buf, size);
-        memset(buf1 + size, 0, MIN_BUF_SIZE - size);
-        buf = buf1;
-        size = MIN_BUF_SIZE;
-    }
-
     if (CSR_PROM(s)
         || (is_padr=padr_match(s, buf, size))
         || (is_bcast=padr_bcast(s, buf, size))

From 63b901bfd30a0975bc326ba8527880fabac2e66d Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:18 +0800
Subject: [PATCH 0470/1353] hw/net: rtl8139: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/rtl8139.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 5f1a4d359b..b4df75b2c9 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -826,7 +826,6 @@ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t
 
     uint32_t packet_header = 0;
 
-    uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];
     static const uint8_t broadcast_macaddr[6] =
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
@@ -938,17 +937,6 @@ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t
         }
     }
 
-    /* if too small buffer, then expand it
-     * Include some tailroom in case a vlan tag is later removed. */
-    if (size < MIN_BUF_SIZE + VLAN_HLEN) {
-        memcpy(buf1, buf, size);
-        memset(buf1 + size, 0, MIN_BUF_SIZE + VLAN_HLEN - size);
-        buf = buf1;
-        if (size < MIN_BUF_SIZE) {
-            size = MIN_BUF_SIZE;
-        }
-    }
-
     if (rtl8139_cp_receiver_enabled(s))
     {
         if (!rtl8139_cp_rx_valid(s)) {

From aee87b43fe2206acb8f5e334b42790df33a1cbad Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:19 +0800
Subject: [PATCH 0471/1353] hw/net: sungem: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/sungem.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/hw/net/sungem.c b/hw/net/sungem.c
index eb01520790..103376c133 100644
--- a/hw/net/sungem.c
+++ b/hw/net/sungem.c
@@ -550,7 +550,6 @@ static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf,
     PCIDevice *d = PCI_DEVICE(s);
     uint32_t mac_crc, done, kick, max_fsize;
     uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff;
-    uint8_t smallbuf[60];
     struct gem_rxd desc;
     uint64_t dbase, baddr;
     unsigned int rx_cond;
@@ -584,19 +583,6 @@ static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf,
         return size;
     }
 
-    /* We don't drop too small frames since we get them in qemu, we pad
-     * them instead. We should probably use the min frame size register
-     * but I don't want to use a variable size staging buffer and I
-     * know both MacOS and Linux use the default 64 anyway. We use 60
-     * here to account for the non-existent FCS.
-     */
-    if (size < 60) {
-        memcpy(smallbuf, buf, size);
-        memset(&smallbuf[size], 0, 60 - size);
-        buf = smallbuf;
-        size = 60;
-    }
-
     /* Get MAC crc */
     mac_crc = net_crc32_le(buf, ETH_ALEN);
 

From 0fe0efc9cd594eb0ce36cc7722f0ce1d038df8d7 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:20 +0800
Subject: [PATCH 0472/1353] hw/net: sunhme: Remove the logic of padding short
 frames in the receive path

Now that we have implemented unified short frames padding in the
QEMU networking codes, remove the same logic in the NIC codes.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/sunhme.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/net/sunhme.c b/hw/net/sunhme.c
index 1f3d8011ae..391d26fb82 100644
--- a/hw/net/sunhme.c
+++ b/hw/net/sunhme.c
@@ -714,8 +714,6 @@ static inline void sunhme_set_rx_ring_nr(SunHMEState *s, int i)
     s->erxregs[HME_ERXI_RING >> 2] = ring;
 }
 
-#define MIN_BUF_SIZE 60
-
 static ssize_t sunhme_receive(NetClientState *nc, const uint8_t *buf,
                               size_t size)
 {
@@ -724,7 +722,6 @@ static ssize_t sunhme_receive(NetClientState *nc, const uint8_t *buf,
     dma_addr_t rb, addr;
     uint32_t intstatus, status, buffer, buffersize, sum;
     uint16_t csum;
-    uint8_t buf1[60];
     int nr, cr, len, rxoffset, csum_offset;
 
     trace_sunhme_rx_incoming(size);
@@ -775,14 +772,6 @@ static ssize_t sunhme_receive(NetClientState *nc, const uint8_t *buf,
 
     trace_sunhme_rx_filter_accept();
 
-    /* If too small buffer, then expand it */
-    if (size < MIN_BUF_SIZE) {
-        memcpy(buf1, buf, size);
-        memset(buf1 + size, 0, MIN_BUF_SIZE - size);
-        buf = buf1;
-        size = MIN_BUF_SIZE;
-    }
-
     rb = s->erxregs[HME_ERXI_RING >> 2] & HME_ERXI_RING_ADDR;
     nr = sunhme_get_rx_ring_count(s);
     cr = sunhme_get_rx_ring_nr(s);

From 71e11da1facdf08c91b3763bd9a72c2121f2bbb6 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Sun, 25 Jun 2023 09:53:21 +0800
Subject: [PATCH 0473/1353] hw/net: ftgmac100: Drop the small packet check in
 the receive path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we have implemented unified short frames padding in the
QEMU networking codes, the small packet check logic in the receive
path is no longer needed.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/ftgmac100.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index d3bf14be53..702b001be2 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -968,14 +968,6 @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
-    /* TODO : Pad to minimum Ethernet frame length */
-    /* handle small packets.  */
-    if (size < 10) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: dropped frame of %zd bytes\n",
-                      __func__, size);
-        return size;
-    }
-
     if (!ftgmac100_filter(s, buf, size)) {
         return size;
     }

From 006c3fa74c3edb978ff46d2851699e9a95609da5 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Fri, 9 Jun 2023 09:27:46 +0200
Subject: [PATCH 0474/1353] net: socket: prepare to cleanup net_init_socket()

Use directly net_socket_fd_init_stream() and net_socket_fd_init_dgram()
when the socket type is already known.

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/socket.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index ba6e5b0b00..24dcaa55bc 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -587,7 +587,7 @@ static int net_socket_connect_init(NetClientState *peer,
             break;
         }
     }
-    s = net_socket_fd_init(peer, model, name, fd, connected, NULL, errp);
+    s = net_socket_fd_init_stream(peer, model, name, fd, connected);
     if (!s) {
         return -1;
     }
@@ -629,7 +629,7 @@ static int net_socket_mcast_init(NetClientState *peer,
         return -1;
     }
 
-    s = net_socket_fd_init(peer, model, name, fd, 0, NULL, errp);
+    s = net_socket_fd_init_dgram(peer, model, name, fd, 0, NULL, errp);
     if (!s) {
         return -1;
     }
@@ -683,7 +683,7 @@ static int net_socket_udp_init(NetClientState *peer,
     }
     qemu_socket_set_nonblock(fd);
 
-    s = net_socket_fd_init(peer, model, name, fd, 0, NULL, errp);
+    s = net_socket_fd_init_dgram(peer, model, name, fd, 0, NULL, errp);
     if (!s) {
         return -1;
     }

From 23455ae341656ca867ee4a171826b9d280d6acb5 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Fri, 9 Jun 2023 09:27:47 +0200
Subject: [PATCH 0475/1353] net: socket: move fd type checking to its own
 function

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/socket.c | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index 24dcaa55bc..6b1f0fec3a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -446,16 +446,32 @@ static NetSocketState *net_socket_fd_init_stream(NetClientState *peer,
     return s;
 }
 
+static int net_socket_fd_check(int fd, Error **errp)
+{
+    int so_type, optlen = sizeof(so_type);
+
+    if (getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
+        (socklen_t *)&optlen) < 0) {
+        error_setg(errp, "can't get socket option SO_TYPE");
+        return -1;
+    }
+    if (so_type != SOCK_DGRAM && so_type != SOCK_STREAM) {
+        error_setg(errp, "socket type=%d for fd=%d must be either"
+                   " SOCK_DGRAM or SOCK_STREAM", so_type, fd);
+        return -1;
+    }
+    return so_type;
+}
+
 static NetSocketState *net_socket_fd_init(NetClientState *peer,
                                           const char *model, const char *name,
                                           int fd, int is_connected,
                                           const char *mc, Error **errp)
 {
-    int so_type = -1, optlen=sizeof(so_type);
+    int so_type;
 
-    if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
-        (socklen_t *)&optlen)< 0) {
-        error_setg(errp, "can't get socket option SO_TYPE");
+    so_type = net_socket_fd_check(fd, errp);
+    if (so_type < 0) {
         close(fd);
         return NULL;
     }
@@ -465,10 +481,6 @@ static NetSocketState *net_socket_fd_init(NetClientState *peer,
                                         mc, errp);
     case SOCK_STREAM:
         return net_socket_fd_init_stream(peer, model, name, fd, is_connected);
-    default:
-        error_setg(errp, "socket type=%d for fd=%d must be either"
-                   " SOCK_DGRAM or SOCK_STREAM", so_type, fd);
-        close(fd);
     }
     return NULL;
 }

From b6aeee02980e193f744f74c48fd900940feb2799 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Fri, 9 Jun 2023 09:27:48 +0200
Subject: [PATCH 0476/1353] net: socket: remove net_init_socket()

Move the file descriptor type checking before doing anything with it.
If it's not usable, don't close it as it could be in use by another
part of QEMU, only fail and report an error.

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/socket.c | 43 +++++++++++++++++--------------------------
 1 file changed, 17 insertions(+), 26 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index 6b1f0fec3a..8e3702e1f3 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -463,28 +463,6 @@ static int net_socket_fd_check(int fd, Error **errp)
     return so_type;
 }
 
-static NetSocketState *net_socket_fd_init(NetClientState *peer,
-                                          const char *model, const char *name,
-                                          int fd, int is_connected,
-                                          const char *mc, Error **errp)
-{
-    int so_type;
-
-    so_type = net_socket_fd_check(fd, errp);
-    if (so_type < 0) {
-        close(fd);
-        return NULL;
-    }
-    switch(so_type) {
-    case SOCK_DGRAM:
-        return net_socket_fd_init_dgram(peer, model, name, fd, is_connected,
-                                        mc, errp);
-    case SOCK_STREAM:
-        return net_socket_fd_init_stream(peer, model, name, fd, is_connected);
-    }
-    return NULL;
-}
-
 static void net_socket_accept(void *opaque)
 {
     NetSocketState *s = opaque;
@@ -728,21 +706,34 @@ int net_init_socket(const Netdev *netdev, const char *name,
     }
 
     if (sock->fd) {
-        int fd, ret;
+        int fd, ret, so_type;
 
         fd = monitor_fd_param(monitor_cur(), sock->fd, errp);
         if (fd == -1) {
             return -1;
         }
+        so_type = net_socket_fd_check(fd, errp);
+        if (so_type < 0) {
+            return -1;
+        }
         ret = qemu_socket_try_set_nonblock(fd);
         if (ret < 0) {
             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
                              name, fd);
             return -1;
         }
-        if (!net_socket_fd_init(peer, "socket", name, fd, 1, sock->mcast,
-                                errp)) {
-            return -1;
+        switch (so_type) {
+        case SOCK_DGRAM:
+            if (!net_socket_fd_init_dgram(peer, "socket", name, fd, 1,
+                                          sock->mcast, errp)) {
+                return -1;
+            }
+            break;
+        case SOCK_STREAM:
+            if (!net_socket_fd_init_stream(peer, "socket", name, fd, 1)) {
+                return -1;
+            }
+            break;
         }
         return 0;
     }

From e414270000e9f7fe2a56d314ab85259aeaf1bd91 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Fri, 2 Jun 2023 16:25:16 +0900
Subject: [PATCH 0477/1353] e1000e: Add ICR clearing by corresponding IMS bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The datasheet does not say what happens when interrupt was asserted
(ICR.INT_ASSERT=1) and auto mask is *not* active.
However, section of 13.3.27 the PCIe* GbE Controllers Open Source
Software Developer’s Manual, which were written for older devices,
namely 631xESB/632xESB, 82563EB/82564EB, 82571EB/82572EI &
82573E/82573V/82573L, does say:
> If IMS = 0b, then the ICR register is always clear-on-read. If IMS is
> not 0b, but some ICR bit is set where the corresponding IMS bit is not
> set, then a read does not clear the ICR register. For example, if
> IMS = 10101010b and ICR = 01010101b, then a read to the ICR register
> does not clear it. If IMS = 10101010b and ICR = 0101011b, then a read
> to the ICR register clears it entirely (ICR.INT_ASSERTED = 1b).

Linux does no longer activate auto mask since commit
0a8047ac68e50e4ccbadcfc6b6b070805b976885 and the real hardware clears
ICR even in such a case so we also should do so.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1707441
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 38 ++++++++++++++++++++++++++++++++------
 hw/net/trace-events  |  1 +
 2 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index 9f185d099c..f8aeafa16b 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -2604,12 +2604,38 @@ e1000e_mac_icr_read(E1000ECore *core, int index)
         e1000e_lower_interrupts(core, ICR, 0xffffffff);
     }
 
-    if ((core->mac[ICR] & E1000_ICR_ASSERTED) &&
-        (core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) {
-        trace_e1000e_irq_icr_clear_iame();
-        e1000e_lower_interrupts(core, ICR, 0xffffffff);
-        trace_e1000e_irq_icr_process_iame();
-        e1000e_lower_interrupts(core, IMS, core->mac[IAM]);
+    if (core->mac[ICR] & E1000_ICR_ASSERTED) {
+        if (core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME) {
+            trace_e1000e_irq_icr_clear_iame();
+            e1000e_lower_interrupts(core, ICR, 0xffffffff);
+            trace_e1000e_irq_icr_process_iame();
+            e1000e_lower_interrupts(core, IMS, core->mac[IAM]);
+        }
+
+        /*
+         * The datasheet does not say what happens when interrupt was asserted
+         * (ICR.INT_ASSERT=1) and auto mask is *not* active.
+         * However, section of 13.3.27 the PCIe* GbE Controllers Open Source
+         * Software Developer’s Manual, which were written for older devices,
+         * namely 631xESB/632xESB, 82563EB/82564EB, 82571EB/82572EI &
+         * 82573E/82573V/82573L, does say:
+         * > If IMS = 0b, then the ICR register is always clear-on-read. If IMS
+         * > is not 0b, but some ICR bit is set where the corresponding IMS bit
+         * > is not set, then a read does not clear the ICR register. For
+         * > example, if IMS = 10101010b and ICR = 01010101b, then a read to the
+         * > ICR register does not clear it. If IMS = 10101010b and
+         * > ICR = 0101011b, then a read to the ICR register clears it entirely
+         * > (ICR.INT_ASSERTED = 1b).
+         *
+         * Linux does no longer activate auto mask since commit
+         * 0a8047ac68e50e4ccbadcfc6b6b070805b976885 and the real hardware
+         * clears ICR even in such a case so we also should do so.
+         */
+        if (core->mac[ICR] & core->mac[IMS]) {
+            trace_e1000e_irq_icr_clear_icr_bit_ims(core->mac[ICR],
+                                                   core->mac[IMS]);
+            e1000e_lower_interrupts(core, ICR, 0xffffffff);
+        }
     }
 
     return ret;
diff --git a/hw/net/trace-events b/hw/net/trace-events
index e4a98b2c7d..3eeacc530c 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -217,6 +217,7 @@ e1000e_irq_read_ims(uint32_t ims) "Current IMS: 0x%x"
 e1000e_irq_icr_clear_nonmsix_icr_read(void) "Clearing ICR on read due to non MSI-X int"
 e1000e_irq_icr_clear_zero_ims(void) "Clearing ICR on read due to zero IMS"
 e1000e_irq_icr_clear_iame(void) "Clearing ICR on read due to IAME"
+e1000e_irq_icr_clear_icr_bit_ims(uint32_t icr, uint32_t ims) "Clearing ICR on read due corresponding IMS bit: 0x%x & 0x%x"
 e1000e_irq_iam_clear_eiame(uint32_t iam, uint32_t cause) "Clearing IMS due to EIAME, IAM: 0x%X, cause: 0x%X"
 e1000e_irq_icr_clear_eiac(uint32_t icr, uint32_t eiac) "Clearing ICR bits due to EIAC, ICR: 0x%X, EIAC: 0x%X"
 e1000e_irq_ims_clear_set_imc(uint32_t val) "Clearing IMS bits due to IMC write 0x%x"

From da9f7f7769e8e65f6423095e978f9a375e33515c Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 29 May 2023 11:37:04 +0900
Subject: [PATCH 0478/1353] igb: Remove obsolete workaround for Windows

I confirmed it works with Windows even without this workaround. It is
likely to be a mistake so remove it.

Fixes: 3a977deebe ("Intrdocue igb device emulation")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/igb_core.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/hw/net/igb_core.c b/hw/net/igb_core.c
index d00b1caa6a..8b6b75c522 100644
--- a/hw/net/igb_core.c
+++ b/hw/net/igb_core.c
@@ -2678,12 +2678,7 @@ static uint32_t igb_get_status(IGBCore *core, int index)
         res |= E1000_STATUS_IOV_MODE;
     }
 
-    /*
-     * Windows driver 12.18.9.23 resets if E1000_STATUS_GIO_MASTER_ENABLE is
-     * left set after E1000_CTRL_LRST is set.
-     */
-    if (!(core->mac[CTRL] & E1000_CTRL_GIO_MASTER_DISABLE) &&
-        !(core->mac[CTRL] & E1000_CTRL_LRST)) {
+    if (!(core->mac[CTRL] & E1000_CTRL_GIO_MASTER_DISABLE)) {
         res |= E1000_STATUS_GIO_MASTER_ENABLE;
     }
 

From bdb97596f663e9af9741353417c651f0d581de29 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Fri, 7 Jul 2023 16:42:13 +0930
Subject: [PATCH 0479/1353] ppc/pnv: Add QME region for P10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Quad Management Engine (QME) manages power related settings for its
quad. The xscom region is separate from the quad xscoms, therefore a new
region is added. The xscoms in a QME select a given core by selecting
the forth nibble.

Implement dummy reads for the stop state history (SSH) and special
wakeup (SPWU) registers. This quietens some sxcom errors when skiboot
boots on p10.

Power9 does not have a QME.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20230707071213.9924-1-joel@jms.id.au>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pnv.c               |  3 ++
 hw/ppc/pnv_core.c          | 78 +++++++++++++++++++++++++++++++++++++-
 include/hw/ppc/pnv_core.h  |  4 ++
 include/hw/ppc/pnv_xscom.h | 11 ++++++
 4 files changed, 94 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 23740f9d07..eb54f93986 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1685,6 +1685,9 @@ static void pnv_chip_power10_quad_realize(Pnv10Chip *chip10, Error **errp)
 
         pnv_xscom_add_subregion(chip, PNV10_XSCOM_EQ_BASE(eq->quad_id),
                                 &eq->xscom_regs);
+
+        pnv_xscom_add_subregion(chip, PNV10_XSCOM_QME_BASE(eq->quad_id),
+                                &eq->xscom_qme_regs);
     }
 }
 
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 9e7cf341dc..9b39d527de 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -496,7 +496,54 @@ static const MemoryRegionOps pnv_quad_power10_xscom_ops = {
     .endianness = DEVICE_BIG_ENDIAN,
 };
 
-static void pnv_quad_realize(DeviceState *dev, Error **errp)
+#define P10_QME_SPWU_HYP 0x83c
+#define P10_QME_SSH_HYP  0x82c
+
+static uint64_t pnv_qme_power10_xscom_read(void *opaque, hwaddr addr,
+                                            unsigned int width)
+{
+    uint32_t offset = addr >> 3;
+    uint64_t val = -1;
+
+    /*
+     * Forth nibble selects the core within a quad, mask it to process read
+     * for any core.
+     */
+    switch (offset & ~0xf000) {
+    case P10_QME_SPWU_HYP:
+    case P10_QME_SSH_HYP:
+        return 0;
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: unimp read 0x%08x\n", __func__,
+                      offset);
+    }
+
+    return val;
+}
+
+static void pnv_qme_power10_xscom_write(void *opaque, hwaddr addr,
+                                         uint64_t val, unsigned int width)
+{
+    uint32_t offset = addr >> 3;
+
+    switch (offset) {
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: unimp write 0x%08x\n", __func__,
+                      offset);
+    }
+}
+
+static const MemoryRegionOps pnv_qme_power10_xscom_ops = {
+    .read = pnv_qme_power10_xscom_read,
+    .write = pnv_qme_power10_xscom_write,
+    .valid.min_access_size = 8,
+    .valid.max_access_size = 8,
+    .impl.min_access_size = 8,
+    .impl.max_access_size = 8,
+    .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void pnv_quad_power9_realize(DeviceState *dev, Error **errp)
 {
     PnvQuad *eq = PNV_QUAD(dev);
     PnvQuadClass *pqc = PNV_QUAD_GET_CLASS(eq);
@@ -509,6 +556,25 @@ static void pnv_quad_realize(DeviceState *dev, Error **errp)
                           pqc->xscom_size);
 }
 
+static void pnv_quad_power10_realize(DeviceState *dev, Error **errp)
+{
+    PnvQuad *eq = PNV_QUAD(dev);
+    PnvQuadClass *pqc = PNV_QUAD_GET_CLASS(eq);
+    char name[32];
+
+    snprintf(name, sizeof(name), "xscom-quad.%d", eq->quad_id);
+    pnv_xscom_region_init(&eq->xscom_regs, OBJECT(dev),
+                          pqc->xscom_ops,
+                          eq, name,
+                          pqc->xscom_size);
+
+    snprintf(name, sizeof(name), "xscom-qme.%d", eq->quad_id);
+    pnv_xscom_region_init(&eq->xscom_qme_regs, OBJECT(dev),
+                          pqc->xscom_qme_ops,
+                          eq, name,
+                          pqc->xscom_qme_size);
+}
+
 static Property pnv_quad_properties[] = {
     DEFINE_PROP_UINT32("quad-id", PnvQuad, quad_id, 0),
     DEFINE_PROP_END_OF_LIST(),
@@ -517,6 +583,9 @@ static Property pnv_quad_properties[] = {
 static void pnv_quad_power9_class_init(ObjectClass *oc, void *data)
 {
     PnvQuadClass *pqc = PNV_QUAD_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = pnv_quad_power9_realize;
 
     pqc->xscom_ops = &pnv_quad_power9_xscom_ops;
     pqc->xscom_size = PNV9_XSCOM_EQ_SIZE;
@@ -525,16 +594,21 @@ static void pnv_quad_power9_class_init(ObjectClass *oc, void *data)
 static void pnv_quad_power10_class_init(ObjectClass *oc, void *data)
 {
     PnvQuadClass *pqc = PNV_QUAD_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = pnv_quad_power10_realize;
 
     pqc->xscom_ops = &pnv_quad_power10_xscom_ops;
     pqc->xscom_size = PNV10_XSCOM_EQ_SIZE;
+
+    pqc->xscom_qme_ops = &pnv_qme_power10_xscom_ops;
+    pqc->xscom_qme_size = PNV10_XSCOM_QME_SIZE;
 }
 
 static void pnv_quad_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
-    dc->realize = pnv_quad_realize;
     device_class_set_props(dc, pnv_quad_properties);
     dc->user_creatable = false;
 }
diff --git a/include/hw/ppc/pnv_core.h b/include/hw/ppc/pnv_core.h
index aa5ca281fc..4db21229a6 100644
--- a/include/hw/ppc/pnv_core.h
+++ b/include/hw/ppc/pnv_core.h
@@ -66,6 +66,9 @@ struct PnvQuadClass {
 
     const MemoryRegionOps *xscom_ops;
     uint64_t xscom_size;
+
+    const MemoryRegionOps *xscom_qme_ops;
+    uint64_t xscom_qme_size;
 };
 
 #define TYPE_PNV_QUAD "powernv-cpu-quad"
@@ -80,5 +83,6 @@ struct PnvQuad {
 
     uint32_t quad_id;
     MemoryRegion xscom_regs;
+    MemoryRegion xscom_qme_regs;
 };
 #endif /* PPC_PNV_CORE_H */
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index a4c9d95dc5..9bc6463547 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -127,6 +127,17 @@ struct PnvXScomInterfaceClass {
 #define PNV10_XSCOM_EC(proc)                    \
     ((0x2 << 16) | ((1 << (3 - (proc))) << 12))
 
+#define PNV10_XSCOM_QME(chiplet) \
+        (PNV10_XSCOM_EQ(chiplet) | (0xE << 16))
+
+/*
+ * Make the region larger by 0x1000 (instead of starting at an offset) so the
+ * modelled addresses start from 0
+ */
+#define PNV10_XSCOM_QME_BASE(core)     \
+    ((uint64_t) PNV10_XSCOM_QME(PNV10_XSCOM_EQ_CHIPLET(core)))
+#define PNV10_XSCOM_QME_SIZE        (0x8000 + 0x1000)
+
 #define PNV10_XSCOM_EQ_BASE(core)     \
     ((uint64_t) PNV10_XSCOM_EQ(PNV10_XSCOM_EQ_CHIPLET(core)))
 #define PNV10_XSCOM_EQ_SIZE        0x20000

From 3d7b89748afe9791a8568dfdb7d51fb2029bf8c2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 5 Jul 2023 12:40:46 +0200
Subject: [PATCH 0480/1353] python: bump minimum requirements so they are
 compatible with 3.12

There are many Python 3.12 issues right now, but a particularly
problematic one when debugging them is that one cannot even use
minreqs.txt in a Python 3.12 virtual environment to test with
locked package versions.

Bump the mypy and wrapt versions to fix this, while remaining
within the realm of versions compatible with Python 3.7.

This requires a workaround for a mypy false positive

    qemu/qmp/qmp_tui.py:350: error: Non-overlapping equality check (left operand type: "Literal[Runstate.DISCONNECTING]", right operand type: "Literal[Runstate.IDLE]")  [comparison-overlap]

where mypy does not realize that self.disconnect() could change
the value of self.runstate.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 python/qemu/qmp/qmp_tui.py | 5 ++++-
 python/setup.cfg           | 2 +-
 python/tests/minreqs.txt   | 9 ++++-----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py
index 8369144723..2d9ebbd20b 100644
--- a/python/qemu/qmp/qmp_tui.py
+++ b/python/qemu/qmp/qmp_tui.py
@@ -346,7 +346,10 @@ class App(QMPClient):
                 self._set_status('[Disconnected]')
                 await self.disconnect()
                 # check if a retry is needed
-                if self.runstate == Runstate.IDLE:
+                # mypy 1.4.0 doesn't believe runstate can change after
+                # disconnect(), hence the cast.
+                state = cast(Runstate, self.runstate)
+                if state == Runstate.IDLE:
                     continue
             await self.runstate_changed()
 
diff --git a/python/setup.cfg b/python/setup.cfg
index 42f0b0be07..5d7e95f5d2 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -39,7 +39,7 @@ devel =
     flake8 >= 5.0.4
     fusepy >= 2.0.4
     isort >= 5.1.2
-    mypy >= 0.780
+    mypy >= 1.4.0
     pylint >= 2.17.3
     tox >= 3.18.0
     urwid >= 2.1.2
diff --git a/python/tests/minreqs.txt b/python/tests/minreqs.txt
index 1ce72cef6d..979461be6b 100644
--- a/python/tests/minreqs.txt
+++ b/python/tests/minreqs.txt
@@ -28,7 +28,7 @@ avocado-framework==90.0
 # Linters
 flake8==5.0.4
 isort==5.1.2
-mypy==0.780
+mypy==1.4.0
 pylint==2.17.3
 
 # Transitive flake8 dependencies
@@ -37,12 +37,11 @@ pycodestyle==2.9.1
 pyflakes==2.5.0
 
 # Transitive mypy dependencies
-mypy-extensions==0.4.3
-typed-ast==1.4.0
-typing-extensions==4.5.0
+mypy-extensions==1.0.0
+typing-extensions==4.7.1
 
 # Transitive pylint dependencies
 astroid==2.15.4
 lazy-object-proxy==1.4.0
 toml==0.10.0
-wrapt==1.12.1
+wrapt==1.14.0

From 785abf0dcff0e229aae901485e930f36a8d2ebb2 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 6 Jul 2023 08:47:36 +0200
Subject: [PATCH 0481/1353] meson.build: Remove the logic to link C code with
 the C++ linker

We are not mixing C++ with C code anymore, the only remaining
C++ code in qga/vss-win32/ is used for a plain C++ executable.
Thus we can remove the hacks for linking C code with the C++ linker
now to simplify meson.build a little bit, and also to avoid that
some C++ code sneaks in by accident again.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230706064736.178962-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build     | 22 ++++++----------------
 qga/meson.build |  2 +-
 scripts/main.c  |  1 -
 3 files changed, 7 insertions(+), 18 deletions(-)
 delete mode 100644 scripts/main.c

diff --git a/meson.build b/meson.build
index b82d5b7cd0..c77faa0b6e 100644
--- a/meson.build
+++ b/meson.build
@@ -473,19 +473,10 @@ if targetos != 'darwin'
   warn_flags += ['-Wthread-safety']
 endif
 
-# Check that the C++ compiler exists and works with the C compiler.
-link_language = 'c'
-linker = cc
+# Set up C++ compiler flags
 qemu_cxxflags = []
 if 'cpp' in all_languages
   qemu_cxxflags = ['-D__STDC_LIMIT_MACROS', '-D__STDC_CONSTANT_MACROS', '-D__STDC_FORMAT_MACROS'] + qemu_cflags
-  if cxx.links(files('scripts/main.c'), args: qemu_cflags)
-    link_language = 'cpp'
-    linker = cxx
-  else
-    message('C++ compiler does not work with C compiler')
-    message('Disabling C++-specific optional code')
-  endif
 endif
 
 # clang does not support glibc + FORTIFY_SOURCE (is it still true?)
@@ -1600,7 +1591,7 @@ if not get_option('snappy').auto() or have_system
   snappy = cc.find_library('snappy', has_headers: ['snappy-c.h'],
                            required: get_option('snappy'))
 endif
-if snappy.found() and not linker.links('''
+if snappy.found() and not cc.links('''
    #include <snappy-c.h>
    int main(void) { snappy_max_compressed_length(4096); return 0; }''', dependencies: snappy)
   snappy = not_found
@@ -2746,7 +2737,7 @@ config_host_data.set('CONFIG_AF_VSOCK', cc.has_header_symbol(
 
 have_vss = false
 have_vss_sdk = false # old xp/2003 SDK
-if targetos == 'windows' and link_language == 'cpp'
+if targetos == 'windows' and 'cpp' in all_languages
   have_vss = cxx.compiles('''
     #define __MIDL_user_allocate_free_DEFINED__
     #include <vss.h>
@@ -3827,7 +3818,6 @@ foreach target : target_dirs
                c_args: c_args,
                dependencies: arch_deps + deps + exe['dependencies'],
                objects: lib.extract_all_objects(recursive: true),
-               link_language: link_language,
                link_depends: [block_syms, qemu_syms] + exe.get('link_depends', []),
                link_args: link_args,
                win_subsystem: exe['win_subsystem'])
@@ -4061,7 +4051,7 @@ summary_info += {'host CPU':          cpu}
 summary_info += {'host endianness':   build_machine.endian()}
 summary_info += {'C compiler':        ' '.join(meson.get_compiler('c').cmd_array())}
 summary_info += {'Host C compiler':   ' '.join(meson.get_compiler('c', native: true).cmd_array())}
-if link_language == 'cpp'
+if 'cpp' in all_languages
   summary_info += {'C++ compiler':    ' '.join(meson.get_compiler('cpp').cmd_array())}
 else
   summary_info += {'C++ compiler':      false}
@@ -4074,13 +4064,13 @@ if get_option('optimization') != 'plain'
   option_cflags += ['-O' + get_option('optimization')]
 endif
 summary_info += {'CFLAGS':            ' '.join(get_option('c_args') + option_cflags)}
-if link_language == 'cpp'
+if 'cpp' in all_languages
   summary_info += {'CXXFLAGS':        ' '.join(get_option('cpp_args') + option_cflags)}
 endif
 if targetos == 'darwin'
   summary_info += {'OBJCFLAGS':       ' '.join(get_option('objc_args') + option_cflags)}
 endif
-link_args = get_option(link_language + '_link_args')
+link_args = get_option('c_link_args')
 if link_args.length() > 0
   summary_info += {'LDFLAGS':         ' '.join(link_args)}
 endif
diff --git a/qga/meson.build b/qga/meson.build
index d3291b4376..dd18092f56 100644
--- a/qga/meson.build
+++ b/qga/meson.build
@@ -9,7 +9,7 @@ endif
 have_qga_vss = get_option('qga_vss') \
   .require(targetos == 'windows',
            error_message: 'VSS support requires Windows') \
-  .require(link_language == 'cpp',
+  .require('cpp' in all_languages,
            error_message: 'VSS support requires a C++ compiler') \
   .require(have_vss, error_message: '''VSS support requires VSS headers.
     If your Visual Studio installation doesn't have the VSS headers,
diff --git a/scripts/main.c b/scripts/main.c
deleted file mode 100644
index b552c8e4ed..0000000000
--- a/scripts/main.c
+++ /dev/null
@@ -1 +0,0 @@
-int main(void) {}

From ca2a5e630dc1f569266fb663bf0b65e4eb433fb2 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Thu, 6 Jul 2023 15:14:18 +0200
Subject: [PATCH 0482/1353] qemu_cleanup: begin drained section after
 vm_shutdown()

in order to avoid requests being stuck in a BlockBackend's request
queue during cleanup. Having such requests can lead to a deadlock [0]
with a virtio-scsi-pci device using iothread that's busy with IO when
initiating a shutdown with QMP 'quit'.

There is a race where such a queued request can continue sometime
(maybe after bdrv_child_free()?) during bdrv_root_unref_child() [1].
The completion will hold the AioContext lock and wait for the BQL
during SCSI completion, but the main thread will hold the BQL and
wait for the AioContext as part of bdrv_root_unref_child(), leading to
the deadlock [0].

[0]:

> Thread 3 (Thread 0x7f3bbd87b700 (LWP 135952) "qemu-system-x86"):
> #0  __lll_lock_wait (futex=futex@entry=0x564183365f00 <qemu_global_mutex>, private=0) at lowlevellock.c:52
> #1  0x00007f3bc1c0d843 in __GI___pthread_mutex_lock (mutex=0x564183365f00 <qemu_global_mutex>) at ../nptl/pthread_mutex_lock.c:80
> #2  0x0000564182939f2e in qemu_mutex_lock_impl (mutex=0x564183365f00 <qemu_global_mutex>, file=0x564182b7f774 "../softmmu/physmem.c", line=2593) at ../util/qemu-thread-posix.c:94
> #3  0x000056418247cc2a in qemu_mutex_lock_iothread_impl (file=0x564182b7f774 "../softmmu/physmem.c", line=2593) at ../softmmu/cpus.c:504
> #4  0x00005641826d5325 in prepare_mmio_access (mr=0x5641856148a0) at ../softmmu/physmem.c:2593
> #5  0x00005641826d6fe7 in address_space_stl_internal (as=0x56418679b310, addr=4276113408, val=16418, attrs=..., result=0x0, endian=DEVICE_LITTLE_ENDIAN) at /home/febner/repos/qemu/memory_ldst.c.inc:318
> #6  0x00005641826d7154 in address_space_stl_le (as=0x56418679b310, addr=4276113408, val=16418, attrs=..., result=0x0) at /home/febner/repos/qemu/memory_ldst.c.inc:357
> #7  0x0000564182374b07 in pci_msi_trigger (dev=0x56418679b0d0, msg=...) at ../hw/pci/pci.c:359
> #8  0x000056418237118b in msi_send_message (dev=0x56418679b0d0, msg=...) at ../hw/pci/msi.c:379
> #9  0x0000564182372c10 in msix_notify (dev=0x56418679b0d0, vector=8) at ../hw/pci/msix.c:542
> #10 0x000056418243719c in virtio_pci_notify (d=0x56418679b0d0, vector=8) at ../hw/virtio/virtio-pci.c:77
> #11 0x00005641826933b0 in virtio_notify_vector (vdev=0x5641867a34a0, vector=8) at ../hw/virtio/virtio.c:1985
> #12 0x00005641826948d6 in virtio_irq (vq=0x5641867ac078) at ../hw/virtio/virtio.c:2461
> #13 0x0000564182694978 in virtio_notify (vdev=0x5641867a34a0, vq=0x5641867ac078) at ../hw/virtio/virtio.c:2473
> #14 0x0000564182665b83 in virtio_scsi_complete_req (req=0x7f3bb000e5d0) at ../hw/scsi/virtio-scsi.c:115
> #15 0x00005641826670ce in virtio_scsi_complete_cmd_req (req=0x7f3bb000e5d0) at ../hw/scsi/virtio-scsi.c:641
> #16 0x000056418266736b in virtio_scsi_command_complete (r=0x7f3bb0010560, resid=0) at ../hw/scsi/virtio-scsi.c:712
> #17 0x000056418239aac6 in scsi_req_complete (req=0x7f3bb0010560, status=2) at ../hw/scsi/scsi-bus.c:1526
> #18 0x000056418239e090 in scsi_handle_rw_error (r=0x7f3bb0010560, ret=-123, acct_failed=false) at ../hw/scsi/scsi-disk.c:242
> #19 0x000056418239e13f in scsi_disk_req_check_error (r=0x7f3bb0010560, ret=-123, acct_failed=false) at ../hw/scsi/scsi-disk.c:265
> #20 0x000056418239e482 in scsi_dma_complete_noio (r=0x7f3bb0010560, ret=-123) at ../hw/scsi/scsi-disk.c:340
> #21 0x000056418239e5d9 in scsi_dma_complete (opaque=0x7f3bb0010560, ret=-123) at ../hw/scsi/scsi-disk.c:371
> #22 0x00005641824809ad in dma_complete (dbs=0x7f3bb000d9d0, ret=-123) at ../softmmu/dma-helpers.c:107
> #23 0x0000564182480a72 in dma_blk_cb (opaque=0x7f3bb000d9d0, ret=-123) at ../softmmu/dma-helpers.c:127
> #24 0x00005641827bf78a in blk_aio_complete (acb=0x7f3bb00021a0) at ../block/block-backend.c:1563
> #25 0x00005641827bfa5e in blk_aio_write_entry (opaque=0x7f3bb00021a0) at ../block/block-backend.c:1630
> #26 0x000056418295638a in coroutine_trampoline (i0=-1342102448, i1=32571) at ../util/coroutine-ucontext.c:177
> #27 0x00007f3bc0caed40 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #28 0x00007f3bbd8757f0 in ?? ()
> #29 0x0000000000000000 in ?? ()
>
> Thread 1 (Thread 0x7f3bbe3e9280 (LWP 135944) "qemu-system-x86"):
> #0  __lll_lock_wait (futex=futex@entry=0x5641856f2a00, private=0) at lowlevellock.c:52
> #1  0x00007f3bc1c0d8d1 in __GI___pthread_mutex_lock (mutex=0x5641856f2a00) at ../nptl/pthread_mutex_lock.c:115
> #2  0x0000564182939f2e in qemu_mutex_lock_impl (mutex=0x5641856f2a00, file=0x564182c0e319 "../util/async.c", line=728) at ../util/qemu-thread-posix.c:94
> #3  0x000056418293a140 in qemu_rec_mutex_lock_impl (mutex=0x5641856f2a00, file=0x564182c0e319 "../util/async.c", line=728) at ../util/qemu-thread-posix.c:149
> #4  0x00005641829532d5 in aio_context_acquire (ctx=0x5641856f29a0) at ../util/async.c:728
> #5  0x000056418279d5df in bdrv_set_aio_context_commit (opaque=0x5641856e6e50) at ../block.c:7493
> #6  0x000056418294e288 in tran_commit (tran=0x56418630bfe0) at ../util/transactions.c:87
> #7  0x000056418279d880 in bdrv_try_change_aio_context (bs=0x5641856f7130, ctx=0x56418548f810, ignore_child=0x0, errp=0x0) at ../block.c:7626
> #8  0x0000564182793f39 in bdrv_root_unref_child (child=0x5641856f47d0) at ../block.c:3242
> #9  0x00005641827be137 in blk_remove_bs (blk=0x564185709880) at ../block/block-backend.c:914
> #10 0x00005641827bd689 in blk_remove_all_bs () at ../block/block-backend.c:583
> #11 0x0000564182798699 in bdrv_close_all () at ../block.c:5117
> #12 0x000056418248a5b2 in qemu_cleanup () at ../softmmu/runstate.c:821
> #13 0x0000564182738603 in qemu_default_main () at ../softmmu/main.c:38
> #14 0x0000564182738631 in main (argc=30, argv=0x7ffd675a8a48) at ../softmmu/main.c:48
>
> (gdb) p *((QemuMutex*)0x5641856f2a00)
> $1 = {lock = {__data = {__lock = 2, __count = 2, __owner = 135952, ...
> (gdb) p *((QemuMutex*)0x564183365f00)
> $2 = {lock = {__data = {__lock = 2, __count = 0, __owner = 135944, ...

[1]:

> Thread 1 "qemu-system-x86" hit Breakpoint 5, bdrv_drain_all_end () at ../block/io.c:551
> #0  bdrv_drain_all_end () at ../block/io.c:551
> #1  0x00005569810f0376 in bdrv_graph_wrlock (bs=0x0) at ../block/graph-lock.c:156
> #2  0x00005569810bd3e0 in bdrv_replace_child_noperm (child=0x556982e2d7d0, new_bs=0x0) at ../block.c:2897
> #3  0x00005569810bdef2 in bdrv_root_unref_child (child=0x556982e2d7d0) at ../block.c:3227
> #4  0x00005569810e8137 in blk_remove_bs (blk=0x556982e42880) at ../block/block-backend.c:914
> #5  0x00005569810e7689 in blk_remove_all_bs () at ../block/block-backend.c:583
> #6  0x00005569810c2699 in bdrv_close_all () at ../block.c:5117
> #7  0x0000556980db45b2 in qemu_cleanup () at ../softmmu/runstate.c:821
> #8  0x0000556981062603 in qemu_default_main () at ../softmmu/main.c:38
> #9  0x0000556981062631 in main (argc=30, argv=0x7ffd7a82a418) at ../softmmu/main.c:48
> [Switching to Thread 0x7fe76dab2700 (LWP 103649)]
>
> Thread 3 "qemu-system-x86" hit Breakpoint 4, blk_inc_in_flight (blk=0x556982e42880) at ../block/block-backend.c:1505
> #0  blk_inc_in_flight (blk=0x556982e42880) at ../block/block-backend.c:1505
> #1  0x00005569810e8f36 in blk_wait_while_drained (blk=0x556982e42880) at ../block/block-backend.c:1312
> #2  0x00005569810e9231 in blk_co_do_pwritev_part (blk=0x556982e42880, offset=3422961664, bytes=4096, qiov=0x556983028060, qiov_offset=0, flags=0) at ../block/block-backend.c:1402
> #3  0x00005569810e9a4b in blk_aio_write_entry (opaque=0x556982e2cfa0) at ../block/block-backend.c:1628
> #4  0x000055698128038a in coroutine_trampoline (i0=-2090057872, i1=21865) at ../util/coroutine-ucontext.c:177
> #5  0x00007fe770f50d40 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #6  0x00007ffd7a829570 in ?? ()
> #7  0x0000000000000000 in ?? ()

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20230706131418.423713-1-f.ebner@proxmox.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 softmmu/runstate.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/softmmu/runstate.c b/softmmu/runstate.c
index a9fbcf4862..f3bd862818 100644
--- a/softmmu/runstate.c
+++ b/softmmu/runstate.c
@@ -802,21 +802,21 @@ void qemu_cleanup(void)
      */
     blk_exp_close_all();
 
-    /*
-     * We must cancel all block jobs while the block layer is drained,
-     * or cancelling will be affected by throttling and thus may block
-     * for an extended period of time.
-     * vm_shutdown() will bdrv_drain_all(), so we may as well include
-     * it in the drained section.
-     * We do not need to end this section, because we do not want any
-     * requests happening from here on anyway.
-     */
-    bdrv_drain_all_begin();
 
     /* No more vcpu or device emulation activity beyond this point */
     vm_shutdown();
     replay_finish();
 
+    /*
+     * We must cancel all block jobs while the block layer is drained,
+     * or cancelling will be affected by throttling and thus may block
+     * for an extended period of time.
+     * Begin the drained section after vm_shutdown() to avoid requests being
+     * stuck in the BlockBackend's request queue.
+     * We do not need to end this section, because we do not want any
+     * requests happening from here on anyway.
+     */
+    bdrv_drain_all_begin();
     job_cancel_sync_all();
     bdrv_close_all();
 

From 8731336e90dea3dd04948127e775c9f087f97a4c Mon Sep 17 00:00:00 2001
From: Tao Su <tao1.su@linux.intel.com>
Date: Thu, 6 Jul 2023 13:49:44 +0800
Subject: [PATCH 0483/1353] target/i386: Adjust feature level according to
 FEAT_7_1_EDX

If FEAT_7_1_EAX is 0 and FEAT_7_1_EDX is non-zero, as is the case
with a Granite Rapids host and
'-cpu host,-avx-vnni,-avx512-bf16,-fzrm,-fsrs,-fsrc,-amx-fp16', we can't
get CPUID_7_1 leaf even though CPUID_7_1_EDX has non-zero value.

Update cpuid_level_func7 according to CPUID_7_1_EDX, otherwise
guest may report wrong maximum number sub-leaves in leaf 07H.

Fixes: eaaa197d5b11 ("target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration")
Cc: qemu-stable@nongnu.org
Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20230706054949.66556-2-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index b5688cabb4..952744af97 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -6880,6 +6880,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
+        x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);

From 9dd8b71091f47bac395f543779269c14d8d93c60 Mon Sep 17 00:00:00 2001
From: Tao Su <tao1.su@linux.intel.com>
Date: Thu, 6 Jul 2023 13:49:45 +0800
Subject: [PATCH 0484/1353] target/i386: Add support for MCDT_NO in CPUID
 enumeration

CPUID.(EAX=7,ECX=2):EDX[bit 5] enumerates MCDT_NO. Processors enumerate
this bit as 1 do not exhibit MXCSR Configuration Dependent Timing (MCDT)
behavior and do not need to be mitigated to avoid data-dependent behavior
for certain instructions.

Since MCDT_NO is in a new sub-leaf, add a new CPUID feature word
FEAT_7_2_EDX. Also update cpuid_level_func7 by FEAT_7_2_EDX.

Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20230706054949.66556-3-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 26 ++++++++++++++++++++++++++
 target/i386/cpu.h |  4 ++++
 2 files changed, 30 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 952744af97..852c45b965 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -739,6 +739,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
 #define TCG_7_1_EAX_FEATURES (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | \
           CPUID_7_1_EAX_FSRC)
 #define TCG_7_1_EDX_FEATURES 0
+#define TCG_7_2_EDX_FEATURES 0
 #define TCG_APM_FEATURES 0
 #define TCG_6_EAX_FEATURES CPUID_6_EAX_ARAT
 #define TCG_XSAVE_FEATURES (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XGETBV1)
@@ -993,6 +994,25 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         },
         .tcg_features = TCG_7_1_EDX_FEATURES,
     },
+    [FEAT_7_2_EDX] = {
+        .type = CPUID_FEATURE_WORD,
+        .feat_names = {
+            NULL, NULL, NULL, NULL,
+            NULL, "mcdt-no", NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+        },
+        .cpuid = {
+            .eax = 7,
+            .needs_ecx = true, .ecx = 2,
+            .reg = R_EDX,
+        },
+        .tcg_features = TCG_7_2_EDX_FEATURES,
+    },
     [FEAT_8000_0007_EDX] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
@@ -6017,6 +6037,11 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             *edx = env->features[FEAT_7_1_EDX];
             *ebx = 0;
             *ecx = 0;
+        } else if (count == 2) {
+            *edx = env->features[FEAT_7_2_EDX];
+            *eax = 0;
+            *ebx = 0;
+            *ecx = 0;
         } else {
             *eax = 0;
             *ebx = 0;
@@ -6881,6 +6906,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
         x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EDX);
+        x86_cpu_adjust_feat_level(cpu, FEAT_7_2_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_EDX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0001_ECX);
         x86_cpu_adjust_feat_level(cpu, FEAT_8000_0007_EDX);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 2c9b0d2ebc..c196b0a482 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -628,6 +628,7 @@ typedef enum FeatureWord {
     FEAT_XSAVE_XSS_LO,     /* CPUID[EAX=0xd,ECX=1].ECX */
     FEAT_XSAVE_XSS_HI,     /* CPUID[EAX=0xd,ECX=1].EDX */
     FEAT_7_1_EDX,       /* CPUID[EAX=7,ECX=1].EDX */
+    FEAT_7_2_EDX,       /* CPUID[EAX=7,ECX=2].EDX */
     FEATURE_WORDS,
 } FeatureWord;
 
@@ -932,6 +933,9 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 /* PREFETCHIT0/1 Instructions */
 #define CPUID_7_1_EDX_PREFETCHITI       (1U << 14)
 
+/* Do not exhibit MXCSR Configuration Dependent Timing (MCDT) behavior */
+#define CPUID_7_2_EDX_MCDT_NO           (1U << 5)
+
 /* XFD Extend Feature Disabled */
 #define CPUID_D_1_EAX_XFD               (1U << 4)
 

From ba3709feaab44631315e02cd793cfccae4c6bd2a Mon Sep 17 00:00:00 2001
From: Tao Su <tao1.su@linux.intel.com>
Date: Thu, 6 Jul 2023 13:49:46 +0800
Subject: [PATCH 0485/1353] target/i386: Allow MCDT_NO if host supports

MCDT_NO bit indicates HW contains the security fix and doesn't need to
be mitigated to avoid data-dependent behaviour for certain instructions.
It needs no hypervisor support. Treat it as supported regardless of what
KVM reports.

Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20230706054949.66556-4-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index de531842f6..ebfaf3d24c 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -432,6 +432,10 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
         uint32_t eax;
         host_cpuid(7, 1, &eax, &unused, &unused, &unused);
         ret |= eax & (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_FSRC);
+    } else if (function == 7 && index == 2 && reg == R_EDX) {
+        uint32_t edx;
+        host_cpuid(7, 2, &unused, &unused, &unused, &edx);
+        ret |= edx & CPUID_7_2_EDX_MCDT_NO;
     } else if (function == 0xd && index == 0 &&
                (reg == R_EAX || reg == R_EDX)) {
         /*

From 6c43ec3b206956a8a3008accafe9eb2dfd885190 Mon Sep 17 00:00:00 2001
From: Tao Su <tao1.su@linux.intel.com>
Date: Thu, 6 Jul 2023 13:49:47 +0800
Subject: [PATCH 0486/1353] target/i386: Add new bit definitions of
 MSR_IA32_ARCH_CAPABILITIES

Currently, bit 13, 14, 15 and 24 of MSR_IA32_ARCH_CAPABILITIES are
disclosed for fixing security issues, so add those bit definitions.

Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-ID: <20230706054949.66556-5-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index c196b0a482..e0771a1043 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1022,7 +1022,11 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define MSR_ARCH_CAP_PSCHANGE_MC_NO     (1U << 6)
 #define MSR_ARCH_CAP_TSX_CTRL_MSR       (1U << 7)
 #define MSR_ARCH_CAP_TAA_NO             (1U << 8)
+#define MSR_ARCH_CAP_SBDR_SSDP_NO       (1U << 13)
+#define MSR_ARCH_CAP_FBSDP_NO           (1U << 14)
+#define MSR_ARCH_CAP_PSDP_NO            (1U << 15)
 #define MSR_ARCH_CAP_FB_CLEAR           (1U << 17)
+#define MSR_ARCH_CAP_PBRSB_NO           (1U << 24)
 
 #define MSR_CORE_CAP_SPLIT_LOCK_DETECT  (1U << 5)
 

From 3baf7ae63505eb1652d1e52d65798307fead8539 Mon Sep 17 00:00:00 2001
From: Lei Wang <lei4.wang@intel.com>
Date: Thu, 6 Jul 2023 13:49:48 +0800
Subject: [PATCH 0487/1353] target/i386: Add few security fix bits in
 ARCH_CAPABILITIES into SapphireRapids CPU model

SapphireRapids has bit 13, 14 and 15 of MSR_IA32_ARCH_CAPABILITIES
enabled, which are related to some security fixes.

Add version 2 of SapphireRapids CPU model with those bits enabled also.

Signed-off-by: Lei Wang <lei4.wang@intel.com>
Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Message-ID: <20230706054949.66556-6-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 852c45b965..ec229072e7 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3944,8 +3944,17 @@ static const X86CPUDefinition builtin_x86_defs[] = {
         .model_id = "Intel Xeon Processor (SapphireRapids)",
         .versions = (X86CPUVersionDefinition[]) {
             { .version = 1 },
-            { /* end of list */ },
-        },
+            {
+                .version = 2,
+                .props = (PropValue[]) {
+                    { "sbdr-ssdp-no", "on" },
+                    { "fbsdp-no", "on" },
+                    { "psdp-no", "on" },
+                    { /* end of list */ }
+                }
+            },
+            { /* end of list */ }
+        }
     },
     {
         .name = "Denverton",

From 6d5e9694ef374159072984c0958c3eaab6dd1d52 Mon Sep 17 00:00:00 2001
From: Tao Su <tao1.su@linux.intel.com>
Date: Thu, 6 Jul 2023 13:49:49 +0800
Subject: [PATCH 0488/1353] target/i386: Add new CPU model GraniteRapids

The GraniteRapids CPU model mainly adds the following new features
based on SapphireRapids:
- PREFETCHITI CPUID.(EAX=7,ECX=1):EDX[bit 14]
- AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]

And adds the following security fix for corresponding vulnerabilities:
- MCDT_NO CPUID.(EAX=7,ECX=2):EDX[bit 5]
- SBDR_SSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 13]
- FBSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 14]
- PSDP_NO MSR_IA32_ARCH_CAPABILITIES[bit 15]
- PBRSB_NO MSR_IA32_ARCH_CAPABILITIES[bit 24]

Signed-off-by: Tao Su <tao1.su@linux.intel.com>
Tested-by: Xuelian Guo <xuelian.guo@intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Message-ID: <20230706054949.66556-7-tao1.su@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 136 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 136 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ec229072e7..97ad229d8b 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -3956,6 +3956,142 @@ static const X86CPUDefinition builtin_x86_defs[] = {
             { /* end of list */ }
         }
     },
+    {
+        .name = "GraniteRapids",
+        .level = 0x20,
+        .vendor = CPUID_VENDOR_INTEL,
+        .family = 6,
+        .model = 173,
+        .stepping = 0,
+        /*
+         * please keep the ascending order so that we can have a clear view of
+         * bit position of each feature.
+         */
+        .features[FEAT_1_EDX] =
+            CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
+            CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
+            CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
+            CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
+            CPUID_SSE | CPUID_SSE2,
+        .features[FEAT_1_ECX] =
+            CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
+            CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
+            CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
+            CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
+            CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
+        .features[FEAT_8000_0001_EDX] =
+            CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
+            CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
+        .features[FEAT_8000_0001_ECX] =
+            CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
+        .features[FEAT_8000_0008_EBX] =
+            CPUID_8000_0008_EBX_WBNOINVD,
+        .features[FEAT_7_0_EBX] =
+            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_HLE |
+            CPUID_7_0_EBX_AVX2 | CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 |
+            CPUID_7_0_EBX_ERMS | CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RTM |
+            CPUID_7_0_EBX_AVX512F | CPUID_7_0_EBX_AVX512DQ |
+            CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP |
+            CPUID_7_0_EBX_AVX512IFMA | CPUID_7_0_EBX_CLFLUSHOPT |
+            CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_AVX512CD | CPUID_7_0_EBX_SHA_NI |
+            CPUID_7_0_EBX_AVX512BW | CPUID_7_0_EBX_AVX512VL,
+        .features[FEAT_7_0_ECX] =
+            CPUID_7_0_ECX_AVX512_VBMI | CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU |
+            CPUID_7_0_ECX_AVX512_VBMI2 | CPUID_7_0_ECX_GFNI |
+            CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
+            CPUID_7_0_ECX_AVX512VNNI | CPUID_7_0_ECX_AVX512BITALG |
+            CPUID_7_0_ECX_AVX512_VPOPCNTDQ | CPUID_7_0_ECX_LA57 |
+            CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
+        .features[FEAT_7_0_EDX] =
+            CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_SERIALIZE |
+            CPUID_7_0_EDX_TSX_LDTRK | CPUID_7_0_EDX_AMX_BF16 |
+            CPUID_7_0_EDX_AVX512_FP16 | CPUID_7_0_EDX_AMX_TILE |
+            CPUID_7_0_EDX_AMX_INT8 | CPUID_7_0_EDX_SPEC_CTRL |
+            CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_SPEC_CTRL_SSBD,
+        .features[FEAT_ARCH_CAPABILITIES] =
+            MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
+            MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
+            MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_TAA_NO |
+            MSR_ARCH_CAP_SBDR_SSDP_NO | MSR_ARCH_CAP_FBSDP_NO |
+            MSR_ARCH_CAP_PSDP_NO | MSR_ARCH_CAP_PBRSB_NO,
+        .features[FEAT_XSAVE] =
+            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES | CPUID_D_1_EAX_XFD,
+        .features[FEAT_6_EAX] =
+            CPUID_6_EAX_ARAT,
+        .features[FEAT_7_1_EAX] =
+            CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_AVX512_BF16 |
+            CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_FSRC |
+            CPUID_7_1_EAX_AMX_FP16,
+        .features[FEAT_7_1_EDX] =
+            CPUID_7_1_EDX_PREFETCHITI,
+        .features[FEAT_7_2_EDX] =
+            CPUID_7_2_EDX_MCDT_NO,
+        .features[FEAT_VMX_BASIC] =
+            MSR_VMX_BASIC_INS_OUTS | MSR_VMX_BASIC_TRUE_CTLS,
+        .features[FEAT_VMX_ENTRY_CTLS] =
+            VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_IA32E_MODE |
+            VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL |
+            VMX_VM_ENTRY_LOAD_IA32_PAT | VMX_VM_ENTRY_LOAD_IA32_EFER,
+        .features[FEAT_VMX_EPT_VPID_CAPS] =
+            MSR_VMX_EPT_EXECONLY |
+            MSR_VMX_EPT_PAGE_WALK_LENGTH_4 | MSR_VMX_EPT_PAGE_WALK_LENGTH_5 |
+            MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB | MSR_VMX_EPT_1GB |
+            MSR_VMX_EPT_INVEPT | MSR_VMX_EPT_AD_BITS |
+            MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
+            MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
+            MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT |
+            MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
+            MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS,
+        .features[FEAT_VMX_EXIT_CTLS] =
+            VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
+            VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
+            VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_IA32_PAT |
+            VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
+            VMX_VM_EXIT_LOAD_IA32_EFER | VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
+        .features[FEAT_VMX_MISC] =
+            MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_ACTIVITY_HLT |
+            MSR_VMX_MISC_VMWRITE_VMEXIT,
+        .features[FEAT_VMX_PINBASED_CTLS] =
+            VMX_PIN_BASED_EXT_INTR_MASK | VMX_PIN_BASED_NMI_EXITING |
+            VMX_PIN_BASED_VIRTUAL_NMIS | VMX_PIN_BASED_VMX_PREEMPTION_TIMER |
+            VMX_PIN_BASED_POSTED_INTR,
+        .features[FEAT_VMX_PROCBASED_CTLS] =
+            VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
+            VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
+            VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
+            VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
+            VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
+            VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
+            VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_VIRTUAL_NMI_PENDING |
+            VMX_CPU_BASED_MOV_DR_EXITING | VMX_CPU_BASED_UNCOND_IO_EXITING |
+            VMX_CPU_BASED_USE_IO_BITMAPS | VMX_CPU_BASED_MONITOR_TRAP_FLAG |
+            VMX_CPU_BASED_USE_MSR_BITMAPS | VMX_CPU_BASED_MONITOR_EXITING |
+            VMX_CPU_BASED_PAUSE_EXITING |
+            VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
+        .features[FEAT_VMX_SECONDARY_CTLS] =
+            VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
+            VMX_SECONDARY_EXEC_ENABLE_EPT | VMX_SECONDARY_EXEC_DESC |
+            VMX_SECONDARY_EXEC_RDTSCP |
+            VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
+            VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_WBINVD_EXITING |
+            VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
+            VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
+            VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
+            VMX_SECONDARY_EXEC_RDRAND_EXITING |
+            VMX_SECONDARY_EXEC_ENABLE_INVPCID |
+            VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
+            VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML |
+            VMX_SECONDARY_EXEC_XSAVES,
+        .features[FEAT_VMX_VMFUNC] =
+            MSR_VMX_VMFUNC_EPT_SWITCHING,
+        .xlevel = 0x80000008,
+        .model_id = "Intel Xeon Processor (GraniteRapids)",
+        .versions = (X86CPUVersionDefinition[]) {
+            { .version = 1 },
+            { /* end of list */ },
+        },
+    },
     {
         .name = "Denverton",
         .level = 21,

From c92ac07c4a4991c1e1e3d0c8c9b2516b2592c7da Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 15 Jun 2023 06:21:48 -0300
Subject: [PATCH 0489/1353] hw/riscv/virt.c: fix typo in 'aia' description
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cc: qemu-trivial@nongnu.org
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index ed4c27487e..68ccd0bde1 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1692,7 +1692,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                   virt_set_aia);
     object_class_property_set_description(oc, "aia",
                                           "Set type of AIA interrupt "
-                                          "conttoller. Valid values are "
+                                          "controller. Valid values are "
                                           "none, aplic, and aplic-imsic.");
 
     object_class_property_add_str(oc, "aia-guests",

From fc97167f1fc716b2f4d57adcd34f9bb4544976c9 Mon Sep 17 00:00:00 2001
From: Lucas Dietrich <ld.adecy@gmail.com>
Date: Wed, 14 Jun 2023 16:07:49 +0200
Subject: [PATCH 0490/1353] target/avr: Fix handling of interrupts above 33.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit addresses a bug in the AVR interrupt handling code.
The modification involves replacing the usage of the ctz32 function
with ctz64 to ensure proper handling of interrupts above 33 in the AVR
target.

Previously, timers 3, 4, and 5 interrupts were not functioning correctly
because most of their interrupt vectors are numbered above 33.

Signed-off-by: Lucas Dietrich <ld.adecy@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Rolnik <mrolnik@gmail.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: updated subject line to have subsytem prefix)
---
 target/avr/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index 2bad242a66..e6e7d51487 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -52,7 +52,7 @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
     }
     if (interrupt_request & CPU_INTERRUPT_HARD) {
         if (cpu_interrupts_enabled(env) && env->intsrc != 0) {
-            int index = ctz32(env->intsrc);
+            int index = ctz64(env->intsrc);
             cs->exception_index = EXCP_INT(index);
             avr_cpu_do_interrupt(cs);
 
@@ -79,7 +79,7 @@ void avr_cpu_do_interrupt(CPUState *cs)
     if (cs->exception_index == EXCP_RESET) {
         vector = 0;
     } else if (env->intsrc != 0) {
-        vector = ctz32(env->intsrc) + 1;
+        vector = ctz64(env->intsrc) + 1;
     }
 
     if (avr_feature(env, AVR_FEATURE_3_BYTE_PC)) {

From c35d9373be7b60a442b9bbb6cfd2ad5f5bde581d Mon Sep 17 00:00:00 2001
From: Jan Kratochvil <jan@jankratochvil.net>
Date: Wed, 28 Jun 2023 18:23:36 +0800
Subject: [PATCH 0491/1353] trivial: man page: document
 display::gtk::zoom-to-fit

Document display::gtk::zoom-to-fit.

info from: https://superuser.com/questions/1752209/qemu-zoom-to-fit-shortcut-or-cli-switch

Signed-off-by: Jan Kratochvil <jan@jankratochvil.net>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qemu-options.hx | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/qemu-options.hx b/qemu-options.hx
index 3a6c7d3ef9..80bd0252d9 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2143,6 +2143,9 @@ SRST
 
         ``show-menubar=on|off`` : Display the main window menubar, defaults to "on"
 
+        ``zoom-to-fit=on|off`` : Expand video output to the window size,
+                                 defaults to "off"
+
     ``curses[,charset=<encoding>]``
         Display video output via curses. For graphics device models
         which support a text mode, QEMU can display this output using a

From b697a48924fc1b6ea3b6077f824a2753cfa1b210 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 29 Jun 2023 14:54:49 +0200
Subject: [PATCH 0492/1353] hw: Simplify calls to pci_nic_init_nofail()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pci_nic_init_nofail() calls qemu_find_nic_model(), and this function
sets nd->model = g_strdup(default_model) if it has not been initialized
yet. So we don't have to set nd->model to the default_nic in the
calling sites.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/arm/sbsa-ref.c        | 8 +-------
 hw/arm/virt.c            | 8 +-------
 hw/loongarch/virt.c      | 8 +-------
 hw/mips/loongson3_virt.c | 8 +-------
 hw/xtensa/virt.c         | 8 +-------
 5 files changed, 5 insertions(+), 35 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index c2e0a9fa1a..64e1cbce17 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -689,13 +689,7 @@ static void create_pcie(SBSAMachineState *sms)
     pci = PCI_HOST_BRIDGE(dev);
     if (pci->bus) {
         for (i = 0; i < nb_nics; i++) {
-            NICInfo *nd = &nd_table[i];
-
-            if (!nd->model) {
-                nd->model = g_strdup(mc->default_nic);
-            }
-
-            pci_nic_init_nofail(nd, pci->bus, nd->model, NULL);
+            pci_nic_init_nofail(&nd_table[i], pci->bus, mc->default_nic, NULL);
         }
     }
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 796181e169..8a4c663735 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1479,13 +1479,7 @@ static void create_pcie(VirtMachineState *vms)
     vms->bus = pci->bus;
     if (vms->bus) {
         for (i = 0; i < nb_nics; i++) {
-            NICInfo *nd = &nd_table[i];
-
-            if (!nd->model) {
-                nd->model = g_strdup(mc->default_nic);
-            }
-
-            pci_nic_init_nofail(nd, pci->bus, nd->model, NULL);
+            pci_nic_init_nofail(&nd_table[i], pci->bus, mc->default_nic, NULL);
         }
     }
 
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index ca8824b6ef..51a453fa9a 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -547,13 +547,7 @@ static void loongarch_devices_init(DeviceState *pch_pic, LoongArchMachineState *
 
     /* Network init */
     for (i = 0; i < nb_nics; i++) {
-        NICInfo *nd = &nd_table[i];
-
-        if (!nd->model) {
-            nd->model = g_strdup(mc->default_nic);
-        }
-
-        pci_nic_init_nofail(nd, pci_bus, nd->model, NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus, mc->default_nic, NULL);
     }
 
     /*
diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index 216812f660..3dd91da7a6 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -454,13 +454,7 @@ static inline void loongson3_virt_devices_init(MachineState *machine,
     }
 
     for (i = 0; i < nb_nics; i++) {
-        NICInfo *nd = &nd_table[i];
-
-        if (!nd->model) {
-            nd->model = g_strdup(mc->default_nic);
-        }
-
-        pci_nic_init_nofail(nd, pci_bus, nd->model, NULL);
+        pci_nic_init_nofail(&nd_table[i], pci_bus, mc->default_nic, NULL);
     }
 }
 
diff --git a/hw/xtensa/virt.c b/hw/xtensa/virt.c
index b87f842e74..a6cf646e99 100644
--- a/hw/xtensa/virt.c
+++ b/hw/xtensa/virt.c
@@ -103,13 +103,7 @@ static void create_pcie(MachineState *ms, CPUXtensaState *env, int irq_base,
     pci = PCI_HOST_BRIDGE(dev);
     if (pci->bus) {
         for (i = 0; i < nb_nics; i++) {
-            NICInfo *nd = &nd_table[i];
-
-            if (!nd->model) {
-                nd->model = g_strdup(mc->default_nic);
-            }
-
-            pci_nic_init_nofail(nd, pci->bus, nd->model, NULL);
+            pci_nic_init_nofail(&nd_table[i], pci->bus, mc->default_nic, NULL);
         }
     }
 }

From aee9701729db62c01aa5927c1b690e9bc2b84460 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 30 Jun 2023 21:21:47 +0800
Subject: [PATCH 0493/1353] vdpa: Delete duplicated VIRTIO_NET_F_RSS in
 vdpa_feature_bits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This entry was duplicated on referenced commit. Removing it.

Fixes: 402378407dbd ("vhost-vdpa: multiqueue support")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 net/vhost-vdpa.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index e19ab063fa..0479988a79 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -74,7 +74,6 @@ const int vdpa_feature_bits[] = {
     VIRTIO_NET_F_CTRL_RX_EXTRA,
     VIRTIO_NET_F_CTRL_VLAN,
     VIRTIO_NET_F_CTRL_MAC_ADDR,
-    VIRTIO_NET_F_RSS,
     VIRTIO_NET_F_MQ,
     VIRTIO_NET_F_CTRL_VQ,
     VIRTIO_F_IOMMU_PLATFORM,

From 2875a0ca021817b7006e6b9215ce31daa33c06f7 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 30 Jun 2023 21:21:48 +0800
Subject: [PATCH 0494/1353] vdpa: Sort vdpa_feature_bits array alphabetically

This patch sorts the vdpa_feature_bits array
alphabetically in ascending order to avoid future duplicates.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 net/vhost-vdpa.c | 49 +++++++++++++++++++++++++++---------------------
 1 file changed, 28 insertions(+), 21 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 0479988a79..c0e93ce568 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -50,38 +50,45 @@ typedef struct VhostVDPAState {
     bool started;
 } VhostVDPAState;
 
+/*
+ * The array is sorted alphabetically in ascending order,
+ * with the exception of VHOST_INVALID_FEATURE_BIT,
+ * which should always be the last entry.
+ */
 const int vdpa_feature_bits[] = {
-    VIRTIO_F_NOTIFY_ON_EMPTY,
-    VIRTIO_RING_F_INDIRECT_DESC,
-    VIRTIO_RING_F_EVENT_IDX,
     VIRTIO_F_ANY_LAYOUT,
+    VIRTIO_F_IOMMU_PLATFORM,
+    VIRTIO_F_NOTIFY_ON_EMPTY,
+    VIRTIO_F_RING_PACKED,
+    VIRTIO_F_RING_RESET,
     VIRTIO_F_VERSION_1,
     VIRTIO_NET_F_CSUM,
-    VIRTIO_NET_F_GUEST_CSUM,
     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS,
-    VIRTIO_NET_F_GSO,
-    VIRTIO_NET_F_GUEST_TSO4,
-    VIRTIO_NET_F_GUEST_TSO6,
-    VIRTIO_NET_F_GUEST_ECN,
-    VIRTIO_NET_F_GUEST_UFO,
-    VIRTIO_NET_F_HOST_TSO4,
-    VIRTIO_NET_F_HOST_TSO6,
-    VIRTIO_NET_F_HOST_ECN,
-    VIRTIO_NET_F_HOST_UFO,
-    VIRTIO_NET_F_MRG_RXBUF,
-    VIRTIO_NET_F_MTU,
+    VIRTIO_NET_F_CTRL_MAC_ADDR,
     VIRTIO_NET_F_CTRL_RX,
     VIRTIO_NET_F_CTRL_RX_EXTRA,
     VIRTIO_NET_F_CTRL_VLAN,
-    VIRTIO_NET_F_CTRL_MAC_ADDR,
-    VIRTIO_NET_F_MQ,
     VIRTIO_NET_F_CTRL_VQ,
-    VIRTIO_F_IOMMU_PLATFORM,
-    VIRTIO_F_RING_PACKED,
-    VIRTIO_F_RING_RESET,
-    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_GSO,
+    VIRTIO_NET_F_GUEST_CSUM,
+    VIRTIO_NET_F_GUEST_ECN,
+    VIRTIO_NET_F_GUEST_TSO4,
+    VIRTIO_NET_F_GUEST_TSO6,
+    VIRTIO_NET_F_GUEST_UFO,
     VIRTIO_NET_F_HASH_REPORT,
+    VIRTIO_NET_F_HOST_ECN,
+    VIRTIO_NET_F_HOST_TSO4,
+    VIRTIO_NET_F_HOST_TSO6,
+    VIRTIO_NET_F_HOST_UFO,
+    VIRTIO_NET_F_MQ,
+    VIRTIO_NET_F_MRG_RXBUF,
+    VIRTIO_NET_F_MTU,
+    VIRTIO_NET_F_RSS,
     VIRTIO_NET_F_STATUS,
+    VIRTIO_RING_F_EVENT_IDX,
+    VIRTIO_RING_F_INDIRECT_DESC,
+
+    /* VHOST_INVALID_FEATURE_BIT should always be the last entry */
     VHOST_INVALID_FEATURE_BIT
 };
 

From a635bcfc7a4c8d8589cff3e1cd22487ae561665e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 3 Jul 2023 09:56:46 +0200
Subject: [PATCH 0495/1353] qemu-options.hx: Fix indentation of some option
 descriptions

The description of the options starts at column 16, so fix
this in some runaway lines for a more uniform output.

While we're at it, replace the capital "NOTE" with "Note"
since this seems to be the more common capitalization in
qemu-options.hx.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qemu-options.hx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index 80bd0252d9..96087505b2 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -652,7 +652,7 @@ DEF("m", HAS_ARG, QEMU_OPTION_m,
     "                size: initial amount of guest memory\n"
     "                slots: number of hotplug slots (default: none)\n"
     "                maxmem: maximum amount of guest memory (default: none)\n"
-    "NOTE: Some architectures might enforce a specific granularity\n",
+    "                Note: Some architectures might enforce a specific granularity\n",
     QEMU_ARCH_ALL)
 SRST
 ``-m [size=]megs[,slots=n,maxmem=size]``
@@ -2217,8 +2217,8 @@ DEF("spice", HAS_ARG, QEMU_OPTION_spice,
     "       [,disable-agent-file-xfer=on|off][,agent-mouse=[on|off]]\n"
     "       [,playback-compression=[on|off]][,seamless-migration=[on|off]]\n"
     "       [,gl=[on|off]][,rendernode=<file>]\n"
-    "   enable spice\n"
-    "   at least one of {port, tls-port} is mandatory\n",
+    "                enable spice\n"
+    "                at least one of {port, tls-port} is mandatory\n",
     QEMU_ARCH_ALL)
 #endif
 SRST

From 8c69ae9eff3c4c3432a3846c2444a1c36044b61b Mon Sep 17 00:00:00 2001
From: Laszlo Ersek <lersek@redhat.com>
Date: Thu, 6 Jul 2023 12:29:36 +0200
Subject: [PATCH 0496/1353] migration: factor out "resume_requested" in
 qmp_migrate()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It cuts back on those awkward, duplicated !(has_resume && resume)
expressions.

Cc: Juan Quintela <quintela@redhat.com> (maintainer:Migration)
Cc: Leonardo Bras <leobras@redhat.com> (reviewer:Migration)
Cc: Peter Xu <peterx@redhat.com> (reviewer:Migration)
Cc: qemu-trivial@nongnu.org
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2018404
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 migration/migration.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 096e8191d1..a60a5acee5 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1637,6 +1637,7 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
                  bool has_inc, bool inc, bool has_detach, bool detach,
                  bool has_resume, bool resume, Error **errp)
 {
+    bool resume_requested;
     Error *local_err = NULL;
     MigrationState *s = migrate_get_current();
     const char *p = NULL;
@@ -1646,13 +1647,14 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
         return;
     }
 
+    resume_requested = has_resume && resume;
     if (!migrate_prepare(s, has_blk && blk, has_inc && inc,
-                         has_resume && resume, errp)) {
+                         resume_requested, errp)) {
         /* Error detected, put into errp */
         return;
     }
 
-    if (!(has_resume && resume)) {
+    if (!resume_requested) {
         if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
             return;
         }
@@ -1671,7 +1673,7 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
     } else if (strstart(uri, "fd:", &p)) {
         fd_start_outgoing_migration(s, p, &local_err);
     } else {
-        if (!(has_resume && resume)) {
+        if (!resume_requested) {
             yank_unregister_instance(MIGRATION_YANK_INSTANCE);
         }
         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "uri",
@@ -1683,7 +1685,7 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
     }
 
     if (local_err) {
-        if (!(has_resume && resume)) {
+        if (!resume_requested) {
             yank_unregister_instance(MIGRATION_YANK_INSTANCE);
         }
         migrate_fd_error(s, local_err);

From aaf26bd382b84c6d34390d092ff24bc8fa575f78 Mon Sep 17 00:00:00 2001
From: Laszlo Ersek <lersek@redhat.com>
Date: Thu, 6 Jul 2023 12:29:37 +0200
Subject: [PATCH 0497/1353] migration: unexport migrate_fd_error()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only migrate_fd_error() call sites are in "migration/migration.c",
which is also where we define migrate_fd_error(). Make the function
static, and remove its declaration from "migration/migration.h".

Cc: Juan Quintela <quintela@redhat.com> (maintainer:Migration)
Cc: Leonardo Bras <leobras@redhat.com> (reviewer:Migration)
Cc: Peter Xu <peterx@redhat.com> (reviewer:Migration)
Cc: qemu-trivial@nongnu.org
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2018404
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 migration/migration.c | 2 +-
 migration/migration.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index a60a5acee5..91bba630a8 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1220,7 +1220,7 @@ static void migrate_error_free(MigrationState *s)
     }
 }
 
-void migrate_fd_error(MigrationState *s, const Error *error)
+static void migrate_fd_error(MigrationState *s, const Error *error)
 {
     trace_migrate_fd_error(error_get_pretty(error));
     assert(s->to_dst_file == NULL);
diff --git a/migration/migration.h b/migration/migration.h
index a80b22b703..b7c8b67542 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -466,7 +466,6 @@ bool  migration_has_all_channels(void);
 uint64_t migrate_max_downtime(void);
 
 void migrate_set_error(MigrationState *s, const Error *error);
-void migrate_fd_error(MigrationState *s, const Error *error);
 
 void migrate_fd_connect(MigrationState *s, Error *error_in);
 

From 13a637430be13bda3e6726752936321a1955bc93 Mon Sep 17 00:00:00 2001
From: Peng Liang <tcx4c70@gmail.com>
Date: Thu, 6 Jul 2023 20:06:10 +0300
Subject: [PATCH 0498/1353] hw/arm/virt-acpi-build.c: Add missing header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

virt-acpi-build.c uses warn_report. However, it doesn't include
qemu/error-report.h directly, it include qemu/error-report.h via trace.h
if we enable log trace backend. But if we disable the log trace backend
(e.g., --enable-trace-backends=nop), then virt-acpi-build.c will not
include qemu/error-report.h any more and it will lead to build errors.
Include qemu/error-report.h directly in virt-acpi-build.c to avoid the
errors.

Fixes: 451b157041 ("acpi: Align the size to 128k")
Signed-off-by: Peng Liang <tcx4c70@gmail.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(mjt: move the #include higher as suggested by Ani Sinha)
---
 hw/arm/virt-acpi-build.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 55f2706bc9..6b674231c2 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -29,6 +29,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/bitmap.h"
+#include "qemu/error-report.h"
 #include "trace.h"
 #include "hw/core/cpu.h"
 #include "target/arm/cpu.h"

From 623d7e3551a6fc5693c06ea938c60fe281b52e27 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 5 Jun 2023 18:29:04 +0300
Subject: [PATCH 0499/1353] util: Add cpuinfo-ppc.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the code from tcg/.  Fix a bug in that PPC_FEATURE2_ARCH_3_10
is actually spelled PPC_FEATURE2_ARCH_3_1.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/ppc/host/cpuinfo.h   | 29 ++++++++++++++++
 host/include/ppc64/host/cpuinfo.h |  1 +
 tcg/ppc/tcg-target.c.inc          | 44 +-----------------------
 tcg/ppc/tcg-target.h              | 16 ++++-----
 util/cpuinfo-ppc.c                | 56 +++++++++++++++++++++++++++++++
 util/meson.build                  |  2 ++
 6 files changed, 97 insertions(+), 51 deletions(-)
 create mode 100644 host/include/ppc/host/cpuinfo.h
 create mode 100644 host/include/ppc64/host/cpuinfo.h
 create mode 100644 util/cpuinfo-ppc.c

diff --git a/host/include/ppc/host/cpuinfo.h b/host/include/ppc/host/cpuinfo.h
new file mode 100644
index 0000000000..df11e8d417
--- /dev/null
+++ b/host/include/ppc/host/cpuinfo.h
@@ -0,0 +1,29 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Host specific cpu indentification for ppc.
+ */
+
+#ifndef HOST_CPUINFO_H
+#define HOST_CPUINFO_H
+
+/* Digested version of <cpuid.h> */
+
+#define CPUINFO_ALWAYS          (1u << 0)  /* so cpuinfo is nonzero */
+#define CPUINFO_V2_06           (1u << 1)
+#define CPUINFO_V2_07           (1u << 2)
+#define CPUINFO_V3_0            (1u << 3)
+#define CPUINFO_V3_1            (1u << 4)
+#define CPUINFO_ISEL            (1u << 5)
+#define CPUINFO_ALTIVEC         (1u << 6)
+#define CPUINFO_VSX             (1u << 7)
+
+/* Initialized with a constructor. */
+extern unsigned cpuinfo;
+
+/*
+ * We cannot rely on constructor ordering, so other constructors must
+ * use the function interface rather than the variable above.
+ */
+unsigned cpuinfo_init(void);
+
+#endif /* HOST_CPUINFO_H */
diff --git a/host/include/ppc64/host/cpuinfo.h b/host/include/ppc64/host/cpuinfo.h
new file mode 100644
index 0000000000..2f036a0627
--- /dev/null
+++ b/host/include/ppc64/host/cpuinfo.h
@@ -0,0 +1 @@
+#include "host/include/ppc/host/cpuinfo.h"
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 5c8378f8f6..c866f2c997 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -101,10 +101,7 @@
 #define ALL_GENERAL_REGS  0xffffffffu
 #define ALL_VECTOR_REGS   0xffffffff00000000ull
 
-TCGPowerISA have_isa;
-static bool have_isel;
-bool have_altivec;
-bool have_vsx;
+#define have_isel  (cpuinfo & CPUINFO_ISEL)
 
 #ifndef CONFIG_SOFTMMU
 #define TCG_GUEST_BASE_REG 30
@@ -3879,45 +3876,6 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
 static void tcg_target_init(TCGContext *s)
 {
-    unsigned long hwcap = qemu_getauxval(AT_HWCAP);
-    unsigned long hwcap2 = qemu_getauxval(AT_HWCAP2);
-
-    have_isa = tcg_isa_base;
-    if (hwcap & PPC_FEATURE_ARCH_2_06) {
-        have_isa = tcg_isa_2_06;
-    }
-#ifdef PPC_FEATURE2_ARCH_2_07
-    if (hwcap2 & PPC_FEATURE2_ARCH_2_07) {
-        have_isa = tcg_isa_2_07;
-    }
-#endif
-#ifdef PPC_FEATURE2_ARCH_3_00
-    if (hwcap2 & PPC_FEATURE2_ARCH_3_00) {
-        have_isa = tcg_isa_3_00;
-    }
-#endif
-#ifdef PPC_FEATURE2_ARCH_3_10
-    if (hwcap2 & PPC_FEATURE2_ARCH_3_10) {
-        have_isa = tcg_isa_3_10;
-    }
-#endif
-
-#ifdef PPC_FEATURE2_HAS_ISEL
-    /* Prefer explicit instruction from the kernel. */
-    have_isel = (hwcap2 & PPC_FEATURE2_HAS_ISEL) != 0;
-#else
-    /* Fall back to knowing Power7 (2.06) has ISEL. */
-    have_isel = have_isa_2_06;
-#endif
-
-    if (hwcap & PPC_FEATURE_HAS_ALTIVEC) {
-        have_altivec = true;
-        /* We only care about the portion of VSX that overlaps Altivec. */
-        if (hwcap & PPC_FEATURE_HAS_VSX) {
-            have_vsx = true;
-        }
-    }
-
     tcg_target_available_regs[TCG_TYPE_I32] = 0xffffffff;
     tcg_target_available_regs[TCG_TYPE_I64] = 0xffffffff;
     if (have_altivec) {
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index c7552b6391..9a41fab8cc 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -25,6 +25,8 @@
 #ifndef PPC_TCG_TARGET_H
 #define PPC_TCG_TARGET_H
 
+#include "host/cpuinfo.h"
+
 #define MAX_CODE_GEN_BUFFER_SIZE  ((size_t)-1)
 
 #define TCG_TARGET_NB_REGS 64
@@ -61,14 +63,12 @@ typedef enum {
     tcg_isa_3_10,
 } TCGPowerISA;
 
-extern TCGPowerISA have_isa;
-extern bool have_altivec;
-extern bool have_vsx;
-
-#define have_isa_2_06  (have_isa >= tcg_isa_2_06)
-#define have_isa_2_07  (have_isa >= tcg_isa_2_07)
-#define have_isa_3_00  (have_isa >= tcg_isa_3_00)
-#define have_isa_3_10  (have_isa >= tcg_isa_3_10)
+#define have_isa_2_06  (cpuinfo & CPUINFO_V2_06)
+#define have_isa_2_07  (cpuinfo & CPUINFO_V2_07)
+#define have_isa_3_00  (cpuinfo & CPUINFO_V3_0)
+#define have_isa_3_10  (cpuinfo & CPUINFO_V3_1)
+#define have_altivec   (cpuinfo & CPUINFO_ALTIVEC)
+#define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions automatically implemented */
 #define TCG_TARGET_HAS_ext8u_i32        0 /* andi */
diff --git a/util/cpuinfo-ppc.c b/util/cpuinfo-ppc.c
new file mode 100644
index 0000000000..d95adc8ccd
--- /dev/null
+++ b/util/cpuinfo-ppc.c
@@ -0,0 +1,56 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Host specific cpu indentification for ppc.
+ */
+
+#include "qemu/osdep.h"
+#include "host/cpuinfo.h"
+
+#ifdef CONFIG_GETAUXVAL
+# include <sys/auxv.h>
+#else
+# include <asm/cputable.h>
+# include "elf.h"
+#endif
+
+unsigned cpuinfo;
+
+/* Called both as constructor and (possibly) via other constructors. */
+unsigned __attribute__((constructor)) cpuinfo_init(void)
+{
+    unsigned info = cpuinfo;
+    unsigned long hwcap, hwcap2;
+
+    if (info) {
+        return info;
+    }
+
+    hwcap = qemu_getauxval(AT_HWCAP);
+    hwcap2 = qemu_getauxval(AT_HWCAP2);
+    info = CPUINFO_ALWAYS;
+
+    /* Version numbers are monotonic, and so imply all lower versions. */
+    if (hwcap2 & PPC_FEATURE2_ARCH_3_1) {
+        info |= CPUINFO_V3_1 | CPUINFO_V3_0 | CPUINFO_V2_07 | CPUINFO_V2_06;
+    } else if (hwcap2 & PPC_FEATURE2_ARCH_3_00) {
+        info |= CPUINFO_V3_0 | CPUINFO_V2_07 | CPUINFO_V2_06;
+    } else if (hwcap2 & PPC_FEATURE2_ARCH_2_07) {
+        info |= CPUINFO_V2_07 | CPUINFO_V2_06;
+    } else if (hwcap & PPC_FEATURE_ARCH_2_06) {
+        info |= CPUINFO_V2_06;
+    }
+
+    if (hwcap2 & PPC_FEATURE2_HAS_ISEL) {
+        info |= CPUINFO_ISEL;
+    }
+    if (hwcap & PPC_FEATURE_HAS_ALTIVEC) {
+        info |= CPUINFO_ALTIVEC;
+        /* We only care about the portion of VSX that overlaps Altivec. */
+        if (hwcap & PPC_FEATURE_HAS_VSX) {
+            info |= CPUINFO_VSX;
+        }
+    }
+
+    cpuinfo = info;
+    return info;
+}
diff --git a/util/meson.build b/util/meson.build
index 3a93071d27..a375160286 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -113,4 +113,6 @@ if cpu == 'aarch64'
   util_ss.add(files('cpuinfo-aarch64.c'))
 elif cpu in ['x86', 'x86_64']
   util_ss.add(files('cpuinfo-i386.c'))
+elif cpu in ['ppc', 'ppc64']
+  util_ss.add(files('cpuinfo-ppc.c'))
 endif

From ca1e9c3ba1f7b8f20154e164c5b7b6c026e24cda Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 11:28:17 -0700
Subject: [PATCH 0500/1353] tests/multiarch: Add test-aes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use a shared driver and backends for i386, aarch64, ppc64, riscv64.

Acked-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/aarch64/Makefile.target       |   4 +
 tests/tcg/aarch64/test-aes.c            |  58 ++++++++
 tests/tcg/i386/Makefile.target          |   4 +
 tests/tcg/i386/test-aes.c               |  68 +++++++++
 tests/tcg/multiarch/test-aes-main.c.inc | 183 ++++++++++++++++++++++++
 tests/tcg/ppc64/Makefile.target         |   1 +
 tests/tcg/ppc64/test-aes.c              | 116 +++++++++++++++
 tests/tcg/riscv64/Makefile.target       |   3 +
 tests/tcg/riscv64/test-aes.c            |  81 +++++++++++
 9 files changed, 518 insertions(+)
 create mode 100644 tests/tcg/aarch64/test-aes.c
 create mode 100644 tests/tcg/i386/test-aes.c
 create mode 100644 tests/tcg/multiarch/test-aes-main.c.inc
 create mode 100644 tests/tcg/ppc64/test-aes.c
 create mode 100644 tests/tcg/riscv64/test-aes.c

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 0606dec118..617f821613 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -74,6 +74,10 @@ ifneq ($(CROSS_CC_HAS_SVE),)
 AARCH64_TESTS += sve-ioctls
 sve-ioctls: CFLAGS+=-march=armv8.1-a+sve
 
+AARCH64_TESTS += test-aes
+test-aes: CFLAGS += -O -march=armv8-a+aes
+test-aes: test-aes-main.c.inc
+
 # Vector SHA1
 sha1-vector: CFLAGS=-O3
 sha1-vector: sha1.c
diff --git a/tests/tcg/aarch64/test-aes.c b/tests/tcg/aarch64/test-aes.c
new file mode 100644
index 0000000000..2cd324f09b
--- /dev/null
+++ b/tests/tcg/aarch64/test-aes.c
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "../multiarch/test-aes-main.c.inc"
+
+bool test_SB_SR(uint8_t *o, const uint8_t *i)
+{
+    /* aese also adds round key, so supply zero. */
+    asm("ld1 { v0.16b }, [%1]\n\t"
+        "movi v1.16b, #0\n\t"
+        "aese v0.16b, v1.16b\n\t"
+        "st1 { v0.16b }, [%0]"
+        : : "r"(o), "r"(i) : "v0", "v1", "memory");
+    return true;
+}
+
+bool test_MC(uint8_t *o, const uint8_t *i)
+{
+    asm("ld1 { v0.16b }, [%1]\n\t"
+        "aesmc v0.16b, v0.16b\n\t"
+        "st1 { v0.16b }, [%0]"
+        : : "r"(o), "r"(i) : "v0", "memory");
+    return true;
+}
+
+bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    return false;
+}
+
+bool test_ISB_ISR(uint8_t *o, const uint8_t *i)
+{
+    /* aesd also adds round key, so supply zero. */
+    asm("ld1 { v0.16b }, [%1]\n\t"
+        "movi v1.16b, #0\n\t"
+        "aesd v0.16b, v1.16b\n\t"
+        "st1 { v0.16b }, [%0]"
+        : : "r"(o), "r"(i) : "v0", "v1", "memory");
+    return true;
+}
+
+bool test_IMC(uint8_t *o, const uint8_t *i)
+{
+    asm("ld1 { v0.16b }, [%1]\n\t"
+        "aesimc v0.16b, v0.16b\n\t"
+        "st1 { v0.16b }, [%0]"
+        : : "r"(o), "r"(i) : "v0", "memory");
+    return true;
+}
+
+bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    return false;
+}
+
+bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    return false;
+}
diff --git a/tests/tcg/i386/Makefile.target b/tests/tcg/i386/Makefile.target
index f2ee7a4db7..fdf757c6ce 100644
--- a/tests/tcg/i386/Makefile.target
+++ b/tests/tcg/i386/Makefile.target
@@ -28,6 +28,10 @@ run-test-i386-bmi2: QEMU_OPTS += -cpu max
 test-i386-adcox: CFLAGS=-O2
 run-test-i386-adcox: QEMU_OPTS += -cpu max
 
+test-aes: CFLAGS += -O -msse2 -maes
+test-aes: test-aes-main.c.inc
+run-test-aes: QEMU_OPTS += -cpu max
+
 #
 # hello-i386 is a barebones app
 #
diff --git a/tests/tcg/i386/test-aes.c b/tests/tcg/i386/test-aes.c
new file mode 100644
index 0000000000..199395e6cc
--- /dev/null
+++ b/tests/tcg/i386/test-aes.c
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "../multiarch/test-aes-main.c.inc"
+#include <immintrin.h>
+
+static bool test_SB_SR(uint8_t *o, const uint8_t *i)
+{
+    __m128i vi = _mm_loadu_si128((const __m128i_u *)i);
+
+    /* aesenclast also adds round key, so supply zero. */
+    vi = _mm_aesenclast_si128(vi, _mm_setzero_si128());
+
+    _mm_storeu_si128((__m128i_u *)o, vi);
+    return true;
+}
+
+static bool test_MC(uint8_t *o, const uint8_t *i)
+{
+    return false;
+}
+
+static bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    __m128i vi = _mm_loadu_si128((const __m128i_u *)i);
+    __m128i vk = _mm_loadu_si128((const __m128i_u *)k);
+
+    vi = _mm_aesenc_si128(vi, vk);
+
+    _mm_storeu_si128((__m128i_u *)o, vi);
+    return true;
+}
+
+static bool test_ISB_ISR(uint8_t *o, const uint8_t *i)
+{
+    __m128i vi = _mm_loadu_si128((const __m128i_u *)i);
+
+    /* aesdeclast also adds round key, so supply zero. */
+    vi = _mm_aesdeclast_si128(vi, _mm_setzero_si128());
+
+    _mm_storeu_si128((__m128i_u *)o, vi);
+    return true;
+}
+
+static bool test_IMC(uint8_t *o, const uint8_t *i)
+{
+    __m128i vi = _mm_loadu_si128((const __m128i_u *)i);
+
+    vi = _mm_aesimc_si128(vi);
+
+    _mm_storeu_si128((__m128i_u *)o, vi);
+    return true;
+}
+
+static bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    return false;
+}
+
+static bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    __m128i vi = _mm_loadu_si128((const __m128i_u *)i);
+    __m128i vk = _mm_loadu_si128((const __m128i_u *)k);
+
+    vi = _mm_aesdec_si128(vi, vk);
+
+    _mm_storeu_si128((__m128i_u *)o, vi);
+    return true;
+}
diff --git a/tests/tcg/multiarch/test-aes-main.c.inc b/tests/tcg/multiarch/test-aes-main.c.inc
new file mode 100644
index 0000000000..4b5f7f98aa
--- /dev/null
+++ b/tests/tcg/multiarch/test-aes-main.c.inc
@@ -0,0 +1,183 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+static bool test_SB_SR(uint8_t *o, const uint8_t *i);
+static bool test_MC(uint8_t *o, const uint8_t *i);
+static bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k);
+
+static bool test_ISB_ISR(uint8_t *o, const uint8_t *i);
+static bool test_IMC(uint8_t *o, const uint8_t *i);
+static bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k);
+static bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k);
+
+/*
+ * From https://doi.org/10.6028/NIST.FIPS.197-upd1,
+ * Appendix B -- Cipher Example
+ *
+ * Note that the formatting of the 4x4 matrices in the document is
+ * column-major, whereas C is row-major.  Therefore to get the bytes
+ * in the same order as the text, the matrices are transposed.
+ *
+ * Note that we are not going to test SubBytes or ShiftRows separately,
+ * so the "After SubBytes" column is omitted, using only the combined
+ * result "After ShiftRows" column.
+ */
+
+/* Ease the inline assembly by aligning everything. */
+typedef struct {
+    uint8_t b[16] __attribute__((aligned(16)));
+} State;
+
+typedef struct {
+    State start, after_sr, after_mc, round_key;
+} Round;
+
+static const Round rounds[] = {
+    /* Round 1 */
+    { { { 0x19, 0x3d, 0xe3, 0xbe,       /* start */
+          0xa0, 0xf4, 0xe2, 0x2b,
+          0x9a, 0xc6, 0x8d, 0x2a,
+          0xe9, 0xf8, 0x48, 0x08, } },
+
+      { { 0xd4, 0xbf, 0x5d, 0x30,       /* after shiftrows */
+          0xe0, 0xb4, 0x52, 0xae,
+          0xb8, 0x41, 0x11, 0xf1,
+          0x1e, 0x27, 0x98, 0xe5, } },
+
+      { { 0x04, 0x66, 0x81, 0xe5,       /* after mixcolumns */
+          0xe0, 0xcb, 0x19, 0x9a,
+          0x48, 0xf8, 0xd3, 0x7a,
+          0x28, 0x06, 0x26, 0x4c, } },
+
+      { { 0xa0, 0xfa, 0xfe, 0x17,       /* round key */
+          0x88, 0x54, 0x2c, 0xb1,
+          0x23, 0xa3, 0x39, 0x39,
+          0x2a, 0x6c, 0x76, 0x05, } } },
+
+    /* Round 2 */
+    { { { 0xa4, 0x9c, 0x7f, 0xf2,       /* start */
+          0x68, 0x9f, 0x35, 0x2b,
+          0x6b, 0x5b, 0xea, 0x43,
+          0x02, 0x6a, 0x50, 0x49, } },
+
+      { { 0x49, 0xdb, 0x87, 0x3b,       /* after shiftrows */
+          0x45, 0x39, 0x53, 0x89,
+          0x7f, 0x02, 0xd2, 0xf1,
+          0x77, 0xde, 0x96, 0x1a, } },
+
+      { { 0x58, 0x4d, 0xca, 0xf1,       /* after mixcolumns */
+          0x1b, 0x4b, 0x5a, 0xac,
+          0xdb, 0xe7, 0xca, 0xa8,
+          0x1b, 0x6b, 0xb0, 0xe5, } },
+
+      { { 0xf2, 0xc2, 0x95, 0xf2,       /* round key */
+          0x7a, 0x96, 0xb9, 0x43,
+          0x59, 0x35, 0x80, 0x7a,
+          0x73, 0x59, 0xf6, 0x7f, } } },
+
+    /* Round 3 */
+    { { { 0xaa, 0x8f, 0x5f, 0x03,       /* start */
+          0x61, 0xdd, 0xe3, 0xef,
+          0x82, 0xd2, 0x4a, 0xd2,
+          0x68, 0x32, 0x46, 0x9a, } },
+
+      { { 0xac, 0xc1, 0xd6, 0xb8,       /* after shiftrows */
+          0xef, 0xb5, 0x5a, 0x7b,
+          0x13, 0x23, 0xcf, 0xdf,
+          0x45, 0x73, 0x11, 0xb5, } },
+
+      { { 0x75, 0xec, 0x09, 0x93,       /* after mixcolumns */
+          0x20, 0x0b, 0x63, 0x33,
+          0x53, 0xc0, 0xcf, 0x7c,
+          0xbb, 0x25, 0xd0, 0xdc, } },
+
+      { { 0x3d, 0x80, 0x47, 0x7d,       /* round key */
+          0x47, 0x16, 0xfe, 0x3e,
+          0x1e, 0x23, 0x7e, 0x44,
+          0x6d, 0x7a, 0x88, 0x3b, } } },
+};
+
+static void verify_log(const char *prefix, const State *s)
+{
+    printf("%s:", prefix);
+    for (int i = 0; i < sizeof(State); ++i) {
+        printf(" %02x", s->b[i]);
+    }
+    printf("\n");
+}
+
+static void verify(const State *ref, const State *tst, const char *which)
+{
+    if (!memcmp(ref, tst, sizeof(State))) {
+        return;
+    }
+
+    printf("Mismatch on %s\n", which);
+    verify_log("ref", ref);
+    verify_log("tst", tst);
+    exit(EXIT_FAILURE);
+}
+
+int main()
+{
+    int i, n = sizeof(rounds) / sizeof(Round);
+    State t;
+
+    for (i = 0; i < n; ++i) {
+        if (test_SB_SR(t.b, rounds[i].start.b)) {
+            verify(&rounds[i].after_sr, &t, "SB+SR");
+        }
+    }
+
+    for (i = 0; i < n; ++i) {
+        if (test_MC(t.b, rounds[i].after_sr.b)) {
+            verify(&rounds[i].after_mc, &t, "MC");
+        }
+    }
+
+    /* The kernel of Cipher(). */
+    for (i = 0; i < n - 1; ++i) {
+        if (test_SB_SR_MC_AK(t.b, rounds[i].start.b, rounds[i].round_key.b)) {
+            verify(&rounds[i + 1].start, &t, "SB+SR+MC+AK");
+        }
+    }
+
+    for (i = 0; i < n; ++i) {
+        if (test_ISB_ISR(t.b, rounds[i].after_sr.b)) {
+            verify(&rounds[i].start, &t, "ISB+ISR");
+        }
+    }
+
+    for (i = 0; i < n; ++i) {
+        if (test_IMC(t.b, rounds[i].after_mc.b)) {
+            verify(&rounds[i].after_sr, &t, "IMC");
+        }
+    }
+
+    /* The kernel of InvCipher(). */
+    for (i = n - 1; i > 0; --i) {
+        if (test_ISB_ISR_AK_IMC(t.b, rounds[i].after_sr.b,
+                                rounds[i - 1].round_key.b)) {
+            verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+AK+IMC");
+        }
+    }
+
+    /*
+     * The kernel of EqInvCipher().
+     * We must compute a different round key: apply InvMixColumns to
+     * the standard round key, per KeyExpansion vs KeyExpansionEIC.
+     */
+    for (i = 1; i < n; ++i) {
+        if (test_IMC(t.b, rounds[i - 1].round_key.b) &&
+            test_ISB_ISR_IMC_AK(t.b, rounds[i].after_sr.b, t.b)) {
+            verify(&rounds[i - 1].after_sr, &t, "ISB+ISR+IMC+AK");
+        }
+    }
+
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/ppc64/Makefile.target b/tests/tcg/ppc64/Makefile.target
index b084963b9a..5721c159f2 100644
--- a/tests/tcg/ppc64/Makefile.target
+++ b/tests/tcg/ppc64/Makefile.target
@@ -36,5 +36,6 @@ run-vector: QEMU_OPTS += -cpu POWER10
 
 PPC64_TESTS += signal_save_restore_xer
 PPC64_TESTS += xxspltw
+PPC64_TESTS += test-aes
 
 TESTS += $(PPC64_TESTS)
diff --git a/tests/tcg/ppc64/test-aes.c b/tests/tcg/ppc64/test-aes.c
new file mode 100644
index 0000000000..1d2be488e9
--- /dev/null
+++ b/tests/tcg/ppc64/test-aes.c
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "../multiarch/test-aes-main.c.inc"
+
+#undef BIG_ENDIAN
+#define BIG_ENDIAN  (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
+
+static unsigned char bswap_le[16] __attribute__((aligned(16))) = {
+    8,9,10,11,12,13,14,15,
+    0,1,2,3,4,5,6,7
+};
+
+bool test_SB_SR(uint8_t *o, const uint8_t *i)
+{
+    /* vcipherlast also adds round key, so supply zero. */
+    if (BIG_ENDIAN) {
+        asm("lxvd2x 32,0,%1\n\t"
+            "vspltisb 1,0\n\t"
+            "vcipherlast 0,0,1\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i) : "memory", "v0", "v1");
+    } else {
+        asm("lxvd2x 32,0,%1\n\t"
+            "lxvd2x 34,0,%2\n\t"
+            "vspltisb 1,0\n\t"
+            "vperm 0,0,0,2\n\t"
+            "vcipherlast 0,0,1\n\t"
+            "vperm 0,0,0,2\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i), "r"(bswap_le) : "memory", "v0", "v1", "v2");
+    }
+    return true;
+}
+
+bool test_MC(uint8_t *o, const uint8_t *i)
+{
+    return false;
+}
+
+bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    if (BIG_ENDIAN) {
+        asm("lxvd2x 32,0,%1\n\t"
+            "lxvd2x 33,0,%2\n\t"
+            "vcipher 0,0,1\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i), "r"(k) : "memory", "v0", "v1");
+    } else {
+        asm("lxvd2x 32,0,%1\n\t"
+            "lxvd2x 33,0,%2\n\t"
+            "lxvd2x 34,0,%3\n\t"
+            "vperm 0,0,0,2\n\t"
+            "vperm 1,1,1,2\n\t"
+            "vcipher 0,0,1\n\t"
+            "vperm 0,0,0,2\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i), "r"(k), "r"(bswap_le)
+              : "memory", "v0", "v1", "v2");
+    }
+    return true;
+}
+
+bool test_ISB_ISR(uint8_t *o, const uint8_t *i)
+{
+    /* vcipherlast also adds round key, so supply zero. */
+    if (BIG_ENDIAN) {
+        asm("lxvd2x 32,0,%1\n\t"
+            "vspltisb 1,0\n\t"
+            "vncipherlast 0,0,1\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i) : "memory", "v0", "v1");
+    } else {
+        asm("lxvd2x 32,0,%1\n\t"
+            "lxvd2x 34,0,%2\n\t"
+            "vspltisb 1,0\n\t"
+            "vperm 0,0,0,2\n\t"
+            "vncipherlast 0,0,1\n\t"
+            "vperm 0,0,0,2\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i), "r"(bswap_le) : "memory", "v0", "v1", "v2");
+    }
+    return true;
+}
+
+bool test_IMC(uint8_t *o, const uint8_t *i)
+{
+    return false;
+}
+
+bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    if (BIG_ENDIAN) {
+        asm("lxvd2x 32,0,%1\n\t"
+            "lxvd2x 33,0,%2\n\t"
+            "vncipher 0,0,1\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i), "r"(k) : "memory", "v0", "v1");
+    } else {
+        asm("lxvd2x 32,0,%1\n\t"
+            "lxvd2x 33,0,%2\n\t"
+            "lxvd2x 34,0,%3\n\t"
+            "vperm 0,0,0,2\n\t"
+            "vperm 1,1,1,2\n\t"
+            "vncipher 0,0,1\n\t"
+            "vperm 0,0,0,2\n\t"
+            "stxvd2x 32,0,%0"
+            : : "r"(o), "r"(i), "r"(k), "r"(bswap_le)
+              : "memory", "v0", "v1", "v2");
+    }
+    return true;
+}
+
+bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    return false;
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index 9973ba3b5f..42993549cb 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -9,3 +9,6 @@ TESTS += noexec
 TESTS += test-noc
 test-noc: LDFLAGS = -nostdlib -static
 run-test-noc: QEMU_OPTS += -cpu rv64,c=false
+
+TESTS += test-aes
+run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
diff --git a/tests/tcg/riscv64/test-aes.c b/tests/tcg/riscv64/test-aes.c
new file mode 100644
index 0000000000..6a0ef77e7b
--- /dev/null
+++ b/tests/tcg/riscv64/test-aes.c
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "../multiarch/test-aes-main.c.inc"
+
+bool test_SB_SR(uint8_t *o, const uint8_t *i)
+{
+    uint64_t *o8 = (uint64_t *)o;
+    const uint64_t *i8 = (const uint64_t *)i;
+
+    /* aes64es rd, rs1, rs2 = 0011001 rs2 rs1 000 rd 0110011 */
+    asm(".insn r 0x33, 0x0, 0x19, %0, %2, %3\n\t"
+        ".insn r 0x33, 0x0, 0x19, %1, %3, %2"
+        : "=&r"(o8[0]), "=&r"(o8[1]) : "r"(i8[0]), "r"(i8[1]));
+    return true;
+}
+
+bool test_MC(uint8_t *o, const uint8_t *i)
+{
+    return false;
+}
+
+bool test_SB_SR_MC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    uint64_t *o8 = (uint64_t *)o;
+    const uint64_t *i8 = (const uint64_t *)i;
+    const uint64_t *k8 = (const uint64_t *)k;
+
+    /* aesesm rd, rs1, rs2 = 0011011 rs2 rs1 000 rd 0110011 */
+    asm(".insn r 0x33, 0x0, 0x1b, %0, %2, %3\n\t"
+        ".insn r 0x33, 0x0, 0x1b, %1, %3, %2\n\t"
+        "xor %0,%0,%4\n\t"
+        "xor %1,%1,%5"
+        : "=&r"(o8[0]), "=&r"(o8[1])
+        : "r"(i8[0]), "r"(i8[1]), "r"(k8[0]), "r"(k8[1]));
+    return true;
+}
+
+bool test_ISB_ISR(uint8_t *o, const uint8_t *i)
+{
+    uint64_t *o8 = (uint64_t *)o;
+    const uint64_t *i8 = (const uint64_t *)i;
+
+    /* aes64ds rd, rs1, rs2 = 0011101 rs2 rs1 000 rd 0110011 */
+    asm(".insn r 0x33, 0x0, 0x1d, %0, %2, %3\n\t"
+        ".insn r 0x33, 0x0, 0x1d, %1, %3, %2"
+        : "=&r"(o8[0]), "=&r"(o8[1]) : "r"(i8[0]), "r"(i8[1]));
+    return true;
+}
+
+bool test_IMC(uint8_t *o, const uint8_t *i)
+{
+    uint64_t *o8 = (uint64_t *)o;
+    const uint64_t *i8 = (const uint64_t *)i;
+
+    /* aes64im rd, rs1 = 0011000 00000 rs1 001 rd 0010011 */
+    asm(".insn r 0x13, 0x1, 0x18, %0, %0, x0\n\t"
+        ".insn r 0x13, 0x1, 0x18, %1, %1, x0"
+        : "=r"(o8[0]), "=r"(o8[1]) : "0"(i8[0]), "1"(i8[1]));
+    return true;
+}
+
+bool test_ISB_ISR_AK_IMC(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    return false;
+}
+
+bool test_ISB_ISR_IMC_AK(uint8_t *o, const uint8_t *i, const uint8_t *k)
+{
+    uint64_t *o8 = (uint64_t *)o;
+    const uint64_t *i8 = (const uint64_t *)i;
+    const uint64_t *k8 = (const uint64_t *)k;
+
+    /* aes64dsm rd, rs1, rs2 = 0011111 rs2 rs1 000 rd 0110011 */
+    asm(".insn r 0x33, 0x0, 0x1f, %0, %2, %3\n\t"
+        ".insn r 0x33, 0x0, 0x1f, %1, %3, %2\n\t"
+        "xor %0,%0,%4\n\t"
+        "xor %1,%1,%5"
+        : "=&r"(o8[0]), "=&r"(o8[1])
+        : "r"(i8[0]), "r"(i8[1]), "r"(k8[0]), "r"(k8[1]));
+    return true;
+}

From fb250c59aa7f595d65b73a5d87076d047970ba1d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 15:46:26 -0700
Subject: [PATCH 0501/1353] target/arm: Move aesmc and aesimc tables to
 crypto/aes.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We do not currently have a table in crypto/ for just MixColumns.
Move both tables for consistency.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                   | 140 ++++++++++++++++++++++++++++++++
 include/crypto/aes.h           |   6 ++
 target/arm/tcg/crypto_helper.c | 143 ++-------------------------------
 3 files changed, 151 insertions(+), 138 deletions(-)

diff --git a/crypto/aes.c b/crypto/aes.c
index af72ff7779..67bb74b8e3 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -116,6 +116,146 @@ const uint8_t AES_ishifts[16] = {
     0, 13, 10, 7, 4, 1, 14, 11, 8, 5, 2, 15, 12, 9, 6, 3
 };
 
+/*
+ * MixColumns lookup table, for use with rot32.
+ */
+const uint32_t AES_mc_rot[256] = {
+    0x00000000, 0x03010102, 0x06020204, 0x05030306,
+    0x0c040408, 0x0f05050a, 0x0a06060c, 0x0907070e,
+    0x18080810, 0x1b090912, 0x1e0a0a14, 0x1d0b0b16,
+    0x140c0c18, 0x170d0d1a, 0x120e0e1c, 0x110f0f1e,
+    0x30101020, 0x33111122, 0x36121224, 0x35131326,
+    0x3c141428, 0x3f15152a, 0x3a16162c, 0x3917172e,
+    0x28181830, 0x2b191932, 0x2e1a1a34, 0x2d1b1b36,
+    0x241c1c38, 0x271d1d3a, 0x221e1e3c, 0x211f1f3e,
+    0x60202040, 0x63212142, 0x66222244, 0x65232346,
+    0x6c242448, 0x6f25254a, 0x6a26264c, 0x6927274e,
+    0x78282850, 0x7b292952, 0x7e2a2a54, 0x7d2b2b56,
+    0x742c2c58, 0x772d2d5a, 0x722e2e5c, 0x712f2f5e,
+    0x50303060, 0x53313162, 0x56323264, 0x55333366,
+    0x5c343468, 0x5f35356a, 0x5a36366c, 0x5937376e,
+    0x48383870, 0x4b393972, 0x4e3a3a74, 0x4d3b3b76,
+    0x443c3c78, 0x473d3d7a, 0x423e3e7c, 0x413f3f7e,
+    0xc0404080, 0xc3414182, 0xc6424284, 0xc5434386,
+    0xcc444488, 0xcf45458a, 0xca46468c, 0xc947478e,
+    0xd8484890, 0xdb494992, 0xde4a4a94, 0xdd4b4b96,
+    0xd44c4c98, 0xd74d4d9a, 0xd24e4e9c, 0xd14f4f9e,
+    0xf05050a0, 0xf35151a2, 0xf65252a4, 0xf55353a6,
+    0xfc5454a8, 0xff5555aa, 0xfa5656ac, 0xf95757ae,
+    0xe85858b0, 0xeb5959b2, 0xee5a5ab4, 0xed5b5bb6,
+    0xe45c5cb8, 0xe75d5dba, 0xe25e5ebc, 0xe15f5fbe,
+    0xa06060c0, 0xa36161c2, 0xa66262c4, 0xa56363c6,
+    0xac6464c8, 0xaf6565ca, 0xaa6666cc, 0xa96767ce,
+    0xb86868d0, 0xbb6969d2, 0xbe6a6ad4, 0xbd6b6bd6,
+    0xb46c6cd8, 0xb76d6dda, 0xb26e6edc, 0xb16f6fde,
+    0x907070e0, 0x937171e2, 0x967272e4, 0x957373e6,
+    0x9c7474e8, 0x9f7575ea, 0x9a7676ec, 0x997777ee,
+    0x887878f0, 0x8b7979f2, 0x8e7a7af4, 0x8d7b7bf6,
+    0x847c7cf8, 0x877d7dfa, 0x827e7efc, 0x817f7ffe,
+    0x9b80801b, 0x98818119, 0x9d82821f, 0x9e83831d,
+    0x97848413, 0x94858511, 0x91868617, 0x92878715,
+    0x8388880b, 0x80898909, 0x858a8a0f, 0x868b8b0d,
+    0x8f8c8c03, 0x8c8d8d01, 0x898e8e07, 0x8a8f8f05,
+    0xab90903b, 0xa8919139, 0xad92923f, 0xae93933d,
+    0xa7949433, 0xa4959531, 0xa1969637, 0xa2979735,
+    0xb398982b, 0xb0999929, 0xb59a9a2f, 0xb69b9b2d,
+    0xbf9c9c23, 0xbc9d9d21, 0xb99e9e27, 0xba9f9f25,
+    0xfba0a05b, 0xf8a1a159, 0xfda2a25f, 0xfea3a35d,
+    0xf7a4a453, 0xf4a5a551, 0xf1a6a657, 0xf2a7a755,
+    0xe3a8a84b, 0xe0a9a949, 0xe5aaaa4f, 0xe6abab4d,
+    0xefacac43, 0xecadad41, 0xe9aeae47, 0xeaafaf45,
+    0xcbb0b07b, 0xc8b1b179, 0xcdb2b27f, 0xceb3b37d,
+    0xc7b4b473, 0xc4b5b571, 0xc1b6b677, 0xc2b7b775,
+    0xd3b8b86b, 0xd0b9b969, 0xd5baba6f, 0xd6bbbb6d,
+    0xdfbcbc63, 0xdcbdbd61, 0xd9bebe67, 0xdabfbf65,
+    0x5bc0c09b, 0x58c1c199, 0x5dc2c29f, 0x5ec3c39d,
+    0x57c4c493, 0x54c5c591, 0x51c6c697, 0x52c7c795,
+    0x43c8c88b, 0x40c9c989, 0x45caca8f, 0x46cbcb8d,
+    0x4fcccc83, 0x4ccdcd81, 0x49cece87, 0x4acfcf85,
+    0x6bd0d0bb, 0x68d1d1b9, 0x6dd2d2bf, 0x6ed3d3bd,
+    0x67d4d4b3, 0x64d5d5b1, 0x61d6d6b7, 0x62d7d7b5,
+    0x73d8d8ab, 0x70d9d9a9, 0x75dadaaf, 0x76dbdbad,
+    0x7fdcdca3, 0x7cdddda1, 0x79dedea7, 0x7adfdfa5,
+    0x3be0e0db, 0x38e1e1d9, 0x3de2e2df, 0x3ee3e3dd,
+    0x37e4e4d3, 0x34e5e5d1, 0x31e6e6d7, 0x32e7e7d5,
+    0x23e8e8cb, 0x20e9e9c9, 0x25eaeacf, 0x26ebebcd,
+    0x2fececc3, 0x2cededc1, 0x29eeeec7, 0x2aefefc5,
+    0x0bf0f0fb, 0x08f1f1f9, 0x0df2f2ff, 0x0ef3f3fd,
+    0x07f4f4f3, 0x04f5f5f1, 0x01f6f6f7, 0x02f7f7f5,
+    0x13f8f8eb, 0x10f9f9e9, 0x15fafaef, 0x16fbfbed,
+    0x1ffcfce3, 0x1cfdfde1, 0x19fefee7, 0x1affffe5,
+};
+
+/*
+ * Inverse MixColumns lookup table, for use with rot32.
+ */
+const uint32_t AES_imc_rot[256] = {
+    0x00000000, 0x0b0d090e, 0x161a121c, 0x1d171b12,
+    0x2c342438, 0x27392d36, 0x3a2e3624, 0x31233f2a,
+    0x58684870, 0x5365417e, 0x4e725a6c, 0x457f5362,
+    0x745c6c48, 0x7f516546, 0x62467e54, 0x694b775a,
+    0xb0d090e0, 0xbbdd99ee, 0xa6ca82fc, 0xadc78bf2,
+    0x9ce4b4d8, 0x97e9bdd6, 0x8afea6c4, 0x81f3afca,
+    0xe8b8d890, 0xe3b5d19e, 0xfea2ca8c, 0xf5afc382,
+    0xc48cfca8, 0xcf81f5a6, 0xd296eeb4, 0xd99be7ba,
+    0x7bbb3bdb, 0x70b632d5, 0x6da129c7, 0x66ac20c9,
+    0x578f1fe3, 0x5c8216ed, 0x41950dff, 0x4a9804f1,
+    0x23d373ab, 0x28de7aa5, 0x35c961b7, 0x3ec468b9,
+    0x0fe75793, 0x04ea5e9d, 0x19fd458f, 0x12f04c81,
+    0xcb6bab3b, 0xc066a235, 0xdd71b927, 0xd67cb029,
+    0xe75f8f03, 0xec52860d, 0xf1459d1f, 0xfa489411,
+    0x9303e34b, 0x980eea45, 0x8519f157, 0x8e14f859,
+    0xbf37c773, 0xb43ace7d, 0xa92dd56f, 0xa220dc61,
+    0xf66d76ad, 0xfd607fa3, 0xe07764b1, 0xeb7a6dbf,
+    0xda595295, 0xd1545b9b, 0xcc434089, 0xc74e4987,
+    0xae053edd, 0xa50837d3, 0xb81f2cc1, 0xb31225cf,
+    0x82311ae5, 0x893c13eb, 0x942b08f9, 0x9f2601f7,
+    0x46bde64d, 0x4db0ef43, 0x50a7f451, 0x5baafd5f,
+    0x6a89c275, 0x6184cb7b, 0x7c93d069, 0x779ed967,
+    0x1ed5ae3d, 0x15d8a733, 0x08cfbc21, 0x03c2b52f,
+    0x32e18a05, 0x39ec830b, 0x24fb9819, 0x2ff69117,
+    0x8dd64d76, 0x86db4478, 0x9bcc5f6a, 0x90c15664,
+    0xa1e2694e, 0xaaef6040, 0xb7f87b52, 0xbcf5725c,
+    0xd5be0506, 0xdeb30c08, 0xc3a4171a, 0xc8a91e14,
+    0xf98a213e, 0xf2872830, 0xef903322, 0xe49d3a2c,
+    0x3d06dd96, 0x360bd498, 0x2b1ccf8a, 0x2011c684,
+    0x1132f9ae, 0x1a3ff0a0, 0x0728ebb2, 0x0c25e2bc,
+    0x656e95e6, 0x6e639ce8, 0x737487fa, 0x78798ef4,
+    0x495ab1de, 0x4257b8d0, 0x5f40a3c2, 0x544daacc,
+    0xf7daec41, 0xfcd7e54f, 0xe1c0fe5d, 0xeacdf753,
+    0xdbeec879, 0xd0e3c177, 0xcdf4da65, 0xc6f9d36b,
+    0xafb2a431, 0xa4bfad3f, 0xb9a8b62d, 0xb2a5bf23,
+    0x83868009, 0x888b8907, 0x959c9215, 0x9e919b1b,
+    0x470a7ca1, 0x4c0775af, 0x51106ebd, 0x5a1d67b3,
+    0x6b3e5899, 0x60335197, 0x7d244a85, 0x7629438b,
+    0x1f6234d1, 0x146f3ddf, 0x097826cd, 0x02752fc3,
+    0x335610e9, 0x385b19e7, 0x254c02f5, 0x2e410bfb,
+    0x8c61d79a, 0x876cde94, 0x9a7bc586, 0x9176cc88,
+    0xa055f3a2, 0xab58faac, 0xb64fe1be, 0xbd42e8b0,
+    0xd4099fea, 0xdf0496e4, 0xc2138df6, 0xc91e84f8,
+    0xf83dbbd2, 0xf330b2dc, 0xee27a9ce, 0xe52aa0c0,
+    0x3cb1477a, 0x37bc4e74, 0x2aab5566, 0x21a65c68,
+    0x10856342, 0x1b886a4c, 0x069f715e, 0x0d927850,
+    0x64d90f0a, 0x6fd40604, 0x72c31d16, 0x79ce1418,
+    0x48ed2b32, 0x43e0223c, 0x5ef7392e, 0x55fa3020,
+    0x01b79aec, 0x0aba93e2, 0x17ad88f0, 0x1ca081fe,
+    0x2d83bed4, 0x268eb7da, 0x3b99acc8, 0x3094a5c6,
+    0x59dfd29c, 0x52d2db92, 0x4fc5c080, 0x44c8c98e,
+    0x75ebf6a4, 0x7ee6ffaa, 0x63f1e4b8, 0x68fcedb6,
+    0xb1670a0c, 0xba6a0302, 0xa77d1810, 0xac70111e,
+    0x9d532e34, 0x965e273a, 0x8b493c28, 0x80443526,
+    0xe90f427c, 0xe2024b72, 0xff155060, 0xf418596e,
+    0xc53b6644, 0xce366f4a, 0xd3217458, 0xd82c7d56,
+    0x7a0ca137, 0x7101a839, 0x6c16b32b, 0x671bba25,
+    0x5638850f, 0x5d358c01, 0x40229713, 0x4b2f9e1d,
+    0x2264e947, 0x2969e049, 0x347efb5b, 0x3f73f255,
+    0x0e50cd7f, 0x055dc471, 0x184adf63, 0x1347d66d,
+    0xcadc31d7, 0xc1d138d9, 0xdcc623cb, 0xd7cb2ac5,
+    0xe6e815ef, 0xede51ce1, 0xf0f207f3, 0xfbff0efd,
+    0x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
+    0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
+};
+
 /* AES_imc[x][0] = [x].[0e, 09, 0d, 0b]; */
 /* AES_imc[x][1] = [x].[0b, 0e, 09, 0d]; */
 /* AES_imc[x][2] = [x].[0d, 0b, 0e, 09]; */
diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index 822d64588c..24b073d569 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -34,6 +34,12 @@ extern const uint8_t AES_isbox[256];
 extern const uint8_t AES_shifts[16];
 extern const uint8_t AES_ishifts[16];
 
+/* AES MixColumns, for use with rot32. */
+extern const uint32_t AES_mc_rot[256];
+
+/* AES InvMixColumns, for use with rot32. */
+extern const uint32_t AES_imc_rot[256];
+
 /* AES InvMixColumns */
 /* AES_imc[x][0] = [x].[0e, 09, 0d, 0b]; */
 /* AES_imc[x][1] = [x].[0b, 0e, 09, 0d]; */
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index d28690321f..06254939d2 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -80,149 +80,16 @@ void HELPER(crypto_aese)(void *vd, void *vn, void *vm, uint32_t desc)
 
 static void do_crypto_aesmc(uint64_t *rd, uint64_t *rm, bool decrypt)
 {
-    static uint32_t const mc[][256] = { {
-        /* MixColumns lookup table */
-        0x00000000, 0x03010102, 0x06020204, 0x05030306,
-        0x0c040408, 0x0f05050a, 0x0a06060c, 0x0907070e,
-        0x18080810, 0x1b090912, 0x1e0a0a14, 0x1d0b0b16,
-        0x140c0c18, 0x170d0d1a, 0x120e0e1c, 0x110f0f1e,
-        0x30101020, 0x33111122, 0x36121224, 0x35131326,
-        0x3c141428, 0x3f15152a, 0x3a16162c, 0x3917172e,
-        0x28181830, 0x2b191932, 0x2e1a1a34, 0x2d1b1b36,
-        0x241c1c38, 0x271d1d3a, 0x221e1e3c, 0x211f1f3e,
-        0x60202040, 0x63212142, 0x66222244, 0x65232346,
-        0x6c242448, 0x6f25254a, 0x6a26264c, 0x6927274e,
-        0x78282850, 0x7b292952, 0x7e2a2a54, 0x7d2b2b56,
-        0x742c2c58, 0x772d2d5a, 0x722e2e5c, 0x712f2f5e,
-        0x50303060, 0x53313162, 0x56323264, 0x55333366,
-        0x5c343468, 0x5f35356a, 0x5a36366c, 0x5937376e,
-        0x48383870, 0x4b393972, 0x4e3a3a74, 0x4d3b3b76,
-        0x443c3c78, 0x473d3d7a, 0x423e3e7c, 0x413f3f7e,
-        0xc0404080, 0xc3414182, 0xc6424284, 0xc5434386,
-        0xcc444488, 0xcf45458a, 0xca46468c, 0xc947478e,
-        0xd8484890, 0xdb494992, 0xde4a4a94, 0xdd4b4b96,
-        0xd44c4c98, 0xd74d4d9a, 0xd24e4e9c, 0xd14f4f9e,
-        0xf05050a0, 0xf35151a2, 0xf65252a4, 0xf55353a6,
-        0xfc5454a8, 0xff5555aa, 0xfa5656ac, 0xf95757ae,
-        0xe85858b0, 0xeb5959b2, 0xee5a5ab4, 0xed5b5bb6,
-        0xe45c5cb8, 0xe75d5dba, 0xe25e5ebc, 0xe15f5fbe,
-        0xa06060c0, 0xa36161c2, 0xa66262c4, 0xa56363c6,
-        0xac6464c8, 0xaf6565ca, 0xaa6666cc, 0xa96767ce,
-        0xb86868d0, 0xbb6969d2, 0xbe6a6ad4, 0xbd6b6bd6,
-        0xb46c6cd8, 0xb76d6dda, 0xb26e6edc, 0xb16f6fde,
-        0x907070e0, 0x937171e2, 0x967272e4, 0x957373e6,
-        0x9c7474e8, 0x9f7575ea, 0x9a7676ec, 0x997777ee,
-        0x887878f0, 0x8b7979f2, 0x8e7a7af4, 0x8d7b7bf6,
-        0x847c7cf8, 0x877d7dfa, 0x827e7efc, 0x817f7ffe,
-        0x9b80801b, 0x98818119, 0x9d82821f, 0x9e83831d,
-        0x97848413, 0x94858511, 0x91868617, 0x92878715,
-        0x8388880b, 0x80898909, 0x858a8a0f, 0x868b8b0d,
-        0x8f8c8c03, 0x8c8d8d01, 0x898e8e07, 0x8a8f8f05,
-        0xab90903b, 0xa8919139, 0xad92923f, 0xae93933d,
-        0xa7949433, 0xa4959531, 0xa1969637, 0xa2979735,
-        0xb398982b, 0xb0999929, 0xb59a9a2f, 0xb69b9b2d,
-        0xbf9c9c23, 0xbc9d9d21, 0xb99e9e27, 0xba9f9f25,
-        0xfba0a05b, 0xf8a1a159, 0xfda2a25f, 0xfea3a35d,
-        0xf7a4a453, 0xf4a5a551, 0xf1a6a657, 0xf2a7a755,
-        0xe3a8a84b, 0xe0a9a949, 0xe5aaaa4f, 0xe6abab4d,
-        0xefacac43, 0xecadad41, 0xe9aeae47, 0xeaafaf45,
-        0xcbb0b07b, 0xc8b1b179, 0xcdb2b27f, 0xceb3b37d,
-        0xc7b4b473, 0xc4b5b571, 0xc1b6b677, 0xc2b7b775,
-        0xd3b8b86b, 0xd0b9b969, 0xd5baba6f, 0xd6bbbb6d,
-        0xdfbcbc63, 0xdcbdbd61, 0xd9bebe67, 0xdabfbf65,
-        0x5bc0c09b, 0x58c1c199, 0x5dc2c29f, 0x5ec3c39d,
-        0x57c4c493, 0x54c5c591, 0x51c6c697, 0x52c7c795,
-        0x43c8c88b, 0x40c9c989, 0x45caca8f, 0x46cbcb8d,
-        0x4fcccc83, 0x4ccdcd81, 0x49cece87, 0x4acfcf85,
-        0x6bd0d0bb, 0x68d1d1b9, 0x6dd2d2bf, 0x6ed3d3bd,
-        0x67d4d4b3, 0x64d5d5b1, 0x61d6d6b7, 0x62d7d7b5,
-        0x73d8d8ab, 0x70d9d9a9, 0x75dadaaf, 0x76dbdbad,
-        0x7fdcdca3, 0x7cdddda1, 0x79dedea7, 0x7adfdfa5,
-        0x3be0e0db, 0x38e1e1d9, 0x3de2e2df, 0x3ee3e3dd,
-        0x37e4e4d3, 0x34e5e5d1, 0x31e6e6d7, 0x32e7e7d5,
-        0x23e8e8cb, 0x20e9e9c9, 0x25eaeacf, 0x26ebebcd,
-        0x2fececc3, 0x2cededc1, 0x29eeeec7, 0x2aefefc5,
-        0x0bf0f0fb, 0x08f1f1f9, 0x0df2f2ff, 0x0ef3f3fd,
-        0x07f4f4f3, 0x04f5f5f1, 0x01f6f6f7, 0x02f7f7f5,
-        0x13f8f8eb, 0x10f9f9e9, 0x15fafaef, 0x16fbfbed,
-        0x1ffcfce3, 0x1cfdfde1, 0x19fefee7, 0x1affffe5,
-    }, {
-        /* Inverse MixColumns lookup table */
-        0x00000000, 0x0b0d090e, 0x161a121c, 0x1d171b12,
-        0x2c342438, 0x27392d36, 0x3a2e3624, 0x31233f2a,
-        0x58684870, 0x5365417e, 0x4e725a6c, 0x457f5362,
-        0x745c6c48, 0x7f516546, 0x62467e54, 0x694b775a,
-        0xb0d090e0, 0xbbdd99ee, 0xa6ca82fc, 0xadc78bf2,
-        0x9ce4b4d8, 0x97e9bdd6, 0x8afea6c4, 0x81f3afca,
-        0xe8b8d890, 0xe3b5d19e, 0xfea2ca8c, 0xf5afc382,
-        0xc48cfca8, 0xcf81f5a6, 0xd296eeb4, 0xd99be7ba,
-        0x7bbb3bdb, 0x70b632d5, 0x6da129c7, 0x66ac20c9,
-        0x578f1fe3, 0x5c8216ed, 0x41950dff, 0x4a9804f1,
-        0x23d373ab, 0x28de7aa5, 0x35c961b7, 0x3ec468b9,
-        0x0fe75793, 0x04ea5e9d, 0x19fd458f, 0x12f04c81,
-        0xcb6bab3b, 0xc066a235, 0xdd71b927, 0xd67cb029,
-        0xe75f8f03, 0xec52860d, 0xf1459d1f, 0xfa489411,
-        0x9303e34b, 0x980eea45, 0x8519f157, 0x8e14f859,
-        0xbf37c773, 0xb43ace7d, 0xa92dd56f, 0xa220dc61,
-        0xf66d76ad, 0xfd607fa3, 0xe07764b1, 0xeb7a6dbf,
-        0xda595295, 0xd1545b9b, 0xcc434089, 0xc74e4987,
-        0xae053edd, 0xa50837d3, 0xb81f2cc1, 0xb31225cf,
-        0x82311ae5, 0x893c13eb, 0x942b08f9, 0x9f2601f7,
-        0x46bde64d, 0x4db0ef43, 0x50a7f451, 0x5baafd5f,
-        0x6a89c275, 0x6184cb7b, 0x7c93d069, 0x779ed967,
-        0x1ed5ae3d, 0x15d8a733, 0x08cfbc21, 0x03c2b52f,
-        0x32e18a05, 0x39ec830b, 0x24fb9819, 0x2ff69117,
-        0x8dd64d76, 0x86db4478, 0x9bcc5f6a, 0x90c15664,
-        0xa1e2694e, 0xaaef6040, 0xb7f87b52, 0xbcf5725c,
-        0xd5be0506, 0xdeb30c08, 0xc3a4171a, 0xc8a91e14,
-        0xf98a213e, 0xf2872830, 0xef903322, 0xe49d3a2c,
-        0x3d06dd96, 0x360bd498, 0x2b1ccf8a, 0x2011c684,
-        0x1132f9ae, 0x1a3ff0a0, 0x0728ebb2, 0x0c25e2bc,
-        0x656e95e6, 0x6e639ce8, 0x737487fa, 0x78798ef4,
-        0x495ab1de, 0x4257b8d0, 0x5f40a3c2, 0x544daacc,
-        0xf7daec41, 0xfcd7e54f, 0xe1c0fe5d, 0xeacdf753,
-        0xdbeec879, 0xd0e3c177, 0xcdf4da65, 0xc6f9d36b,
-        0xafb2a431, 0xa4bfad3f, 0xb9a8b62d, 0xb2a5bf23,
-        0x83868009, 0x888b8907, 0x959c9215, 0x9e919b1b,
-        0x470a7ca1, 0x4c0775af, 0x51106ebd, 0x5a1d67b3,
-        0x6b3e5899, 0x60335197, 0x7d244a85, 0x7629438b,
-        0x1f6234d1, 0x146f3ddf, 0x097826cd, 0x02752fc3,
-        0x335610e9, 0x385b19e7, 0x254c02f5, 0x2e410bfb,
-        0x8c61d79a, 0x876cde94, 0x9a7bc586, 0x9176cc88,
-        0xa055f3a2, 0xab58faac, 0xb64fe1be, 0xbd42e8b0,
-        0xd4099fea, 0xdf0496e4, 0xc2138df6, 0xc91e84f8,
-        0xf83dbbd2, 0xf330b2dc, 0xee27a9ce, 0xe52aa0c0,
-        0x3cb1477a, 0x37bc4e74, 0x2aab5566, 0x21a65c68,
-        0x10856342, 0x1b886a4c, 0x069f715e, 0x0d927850,
-        0x64d90f0a, 0x6fd40604, 0x72c31d16, 0x79ce1418,
-        0x48ed2b32, 0x43e0223c, 0x5ef7392e, 0x55fa3020,
-        0x01b79aec, 0x0aba93e2, 0x17ad88f0, 0x1ca081fe,
-        0x2d83bed4, 0x268eb7da, 0x3b99acc8, 0x3094a5c6,
-        0x59dfd29c, 0x52d2db92, 0x4fc5c080, 0x44c8c98e,
-        0x75ebf6a4, 0x7ee6ffaa, 0x63f1e4b8, 0x68fcedb6,
-        0xb1670a0c, 0xba6a0302, 0xa77d1810, 0xac70111e,
-        0x9d532e34, 0x965e273a, 0x8b493c28, 0x80443526,
-        0xe90f427c, 0xe2024b72, 0xff155060, 0xf418596e,
-        0xc53b6644, 0xce366f4a, 0xd3217458, 0xd82c7d56,
-        0x7a0ca137, 0x7101a839, 0x6c16b32b, 0x671bba25,
-        0x5638850f, 0x5d358c01, 0x40229713, 0x4b2f9e1d,
-        0x2264e947, 0x2969e049, 0x347efb5b, 0x3f73f255,
-        0x0e50cd7f, 0x055dc471, 0x184adf63, 0x1347d66d,
-        0xcadc31d7, 0xc1d138d9, 0xdcc623cb, 0xd7cb2ac5,
-        0xe6e815ef, 0xede51ce1, 0xf0f207f3, 0xfbff0efd,
-        0x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
-        0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
-    } };
-
     union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
+    const uint32_t *mc = decrypt ? AES_imc_rot : AES_mc_rot;
     int i;
 
     for (i = 0; i < 16; i += 4) {
         CR_ST_WORD(st, i >> 2) =
-            mc[decrypt][CR_ST_BYTE(st, i)] ^
-            rol32(mc[decrypt][CR_ST_BYTE(st, i + 1)], 8) ^
-            rol32(mc[decrypt][CR_ST_BYTE(st, i + 2)], 16) ^
-            rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
+            mc[CR_ST_BYTE(st, i)] ^
+            rol32(mc[CR_ST_BYTE(st, i + 1)], 8) ^
+            rol32(mc[CR_ST_BYTE(st, i + 2)], 16) ^
+            rol32(mc[CR_ST_BYTE(st, i + 3)], 24);
     }
 
     rd[0] = st.l[0];

From e20e14d2b15d5ad4fb0a640c95d7c1bc534d9fd7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 16:05:29 -0700
Subject: [PATCH 0502/1353] crypto/aes: Add AES_SH, AES_ISH macros
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These macros will constant fold and avoid the indirection through
memory when fully unrolling some new primitives.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/crypto/aes.c b/crypto/aes.c
index 67bb74b8e3..e65c97e0c1 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -108,12 +108,24 @@ const uint8_t AES_isbox[256] = {
     0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D,
 };
 
+/* AES ShiftRows, for complete unrolling. */
+#define AES_SH(X)   (((X) * 5) & 15)
+
 const uint8_t AES_shifts[16] = {
-    0, 5, 10, 15, 4, 9, 14, 3, 8, 13, 2, 7, 12, 1, 6, 11
+    AES_SH(0x0), AES_SH(0x1), AES_SH(0x2), AES_SH(0x3),
+    AES_SH(0x4), AES_SH(0x5), AES_SH(0x6), AES_SH(0x7),
+    AES_SH(0x8), AES_SH(0x9), AES_SH(0xA), AES_SH(0xB),
+    AES_SH(0xC), AES_SH(0xD), AES_SH(0xE), AES_SH(0xF),
 };
 
+/* AES InvShiftRows, for complete unrolling. */
+#define AES_ISH(X)  (((X) * 13) & 15)
+
 const uint8_t AES_ishifts[16] = {
-    0, 13, 10, 7, 4, 1, 14, 11, 8, 5, 2, 15, 12, 9, 6, 3
+    AES_ISH(0x0), AES_ISH(0x1), AES_ISH(0x2), AES_ISH(0x3),
+    AES_ISH(0x4), AES_ISH(0x5), AES_ISH(0x6), AES_ISH(0x7),
+    AES_ISH(0x8), AES_ISH(0x9), AES_ISH(0xA), AES_ISH(0xB),
+    AES_ISH(0xC), AES_ISH(0xD), AES_ISH(0xE), AES_ISH(0xF),
 };
 
 /*

From 6b0a96ce3a405ef4676e1fa853f2c649dc25c2b4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 21:57:10 -0700
Subject: [PATCH 0503/1353] crypto: Add aesenc_SB_SR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Start adding infrastructure for accelerating guest AES.
Begin with a SubBytes + ShiftRows + AddRoundKey primitive.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 MAINTAINERS                                  |  1 +
 crypto/aes.c                                 | 46 ++++++++++++++++++++
 host/include/generic/host/crypto/aes-round.h | 16 +++++++
 include/crypto/aes-round.h                   | 44 +++++++++++++++++++
 4 files changed, 107 insertions(+)
 create mode 100644 host/include/generic/host/crypto/aes-round.h
 create mode 100644 include/crypto/aes-round.h

diff --git a/MAINTAINERS b/MAINTAINERS
index d422ce50e3..1817cfc62f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3224,6 +3224,7 @@ M: Daniel P. Berrange <berrange@redhat.com>
 S: Maintained
 F: crypto/
 F: include/crypto/
+F: host/include/*/host/crypto/
 F: qapi/crypto.json
 F: tests/unit/test-crypto-*
 F: tests/bench/benchmark-crypto-*
diff --git a/crypto/aes.c b/crypto/aes.c
index e65c97e0c1..408d92b81f 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -29,6 +29,7 @@
  */
 #include "qemu/osdep.h"
 #include "crypto/aes.h"
+#include "crypto/aes-round.h"
 
 typedef uint32_t u32;
 typedef uint8_t u8;
@@ -1215,6 +1216,51 @@ static const u32 rcon[] = {
         0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
 };
 
+/*
+ * Perform SubBytes + ShiftRows + AddRoundKey.
+ */
+static inline void
+aesenc_SB_SR_AK_swap(AESState *ret, const AESState *st,
+                     const AESState *rk, bool swap)
+{
+    const int swap_b = swap ? 15 : 0;
+    AESState t;
+
+    t.b[swap_b ^ 0x0] = AES_sbox[st->b[swap_b ^ AES_SH(0x0)]];
+    t.b[swap_b ^ 0x1] = AES_sbox[st->b[swap_b ^ AES_SH(0x1)]];
+    t.b[swap_b ^ 0x2] = AES_sbox[st->b[swap_b ^ AES_SH(0x2)]];
+    t.b[swap_b ^ 0x3] = AES_sbox[st->b[swap_b ^ AES_SH(0x3)]];
+    t.b[swap_b ^ 0x4] = AES_sbox[st->b[swap_b ^ AES_SH(0x4)]];
+    t.b[swap_b ^ 0x5] = AES_sbox[st->b[swap_b ^ AES_SH(0x5)]];
+    t.b[swap_b ^ 0x6] = AES_sbox[st->b[swap_b ^ AES_SH(0x6)]];
+    t.b[swap_b ^ 0x7] = AES_sbox[st->b[swap_b ^ AES_SH(0x7)]];
+    t.b[swap_b ^ 0x8] = AES_sbox[st->b[swap_b ^ AES_SH(0x8)]];
+    t.b[swap_b ^ 0x9] = AES_sbox[st->b[swap_b ^ AES_SH(0x9)]];
+    t.b[swap_b ^ 0xa] = AES_sbox[st->b[swap_b ^ AES_SH(0xA)]];
+    t.b[swap_b ^ 0xb] = AES_sbox[st->b[swap_b ^ AES_SH(0xB)]];
+    t.b[swap_b ^ 0xc] = AES_sbox[st->b[swap_b ^ AES_SH(0xC)]];
+    t.b[swap_b ^ 0xd] = AES_sbox[st->b[swap_b ^ AES_SH(0xD)]];
+    t.b[swap_b ^ 0xe] = AES_sbox[st->b[swap_b ^ AES_SH(0xE)]];
+    t.b[swap_b ^ 0xf] = AES_sbox[st->b[swap_b ^ AES_SH(0xF)]];
+
+    /*
+     * Perform the AddRoundKey with generic vectors.
+     * This may be expanded to either host integer or host vector code.
+     * The key and output endianness match, so no bswap required.
+     */
+    ret->v = t.v ^ rk->v;
+}
+
+void aesenc_SB_SR_AK_gen(AESState *r, const AESState *s, const AESState *k)
+{
+    aesenc_SB_SR_AK_swap(r, s, k, false);
+}
+
+void aesenc_SB_SR_AK_genrev(AESState *r, const AESState *s, const AESState *k)
+{
+    aesenc_SB_SR_AK_swap(r, s, k, true);
+}
+
 /**
  * Expand the cipher key into the encryption key schedule.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
new file mode 100644
index 0000000000..c5d8066179
--- /dev/null
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -0,0 +1,16 @@
+/*
+ * No host specific aes acceleration.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef GENERIC_HOST_CRYPTO_AES_ROUND_H
+#define GENERIC_HOST_CRYPTO_AES_ROUND_H
+
+#define HAVE_AES_ACCEL  false
+#define ATTR_AES_ACCEL
+
+void aesenc_SB_SR_AK_accel(AESState *, const AESState *,
+                           const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
+
+#endif /* GENERIC_HOST_CRYPTO_AES_ROUND_H */
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
new file mode 100644
index 0000000000..b85db1a30e
--- /dev/null
+++ b/include/crypto/aes-round.h
@@ -0,0 +1,44 @@
+/*
+ * AES round fragments, generic version
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Copyright (C) 2023 Linaro, Ltd.
+ */
+
+#ifndef CRYPTO_AES_ROUND_H
+#define CRYPTO_AES_ROUND_H
+
+/* Hosts with acceleration will usually need a 16-byte vector type. */
+typedef uint8_t AESStateVec __attribute__((vector_size(16)));
+
+typedef union {
+    uint8_t b[16];
+    uint32_t w[4];
+    uint64_t d[2];
+    AESStateVec v;
+} AESState;
+
+#include "host/crypto/aes-round.h"
+
+/*
+ * Perform SubBytes + ShiftRows + AddRoundKey.
+ */
+
+void aesenc_SB_SR_AK_gen(AESState *ret, const AESState *st,
+                         const AESState *rk);
+void aesenc_SB_SR_AK_genrev(AESState *ret, const AESState *st,
+                            const AESState *rk);
+
+static inline void aesenc_SB_SR_AK(AESState *r, const AESState *st,
+                                   const AESState *rk, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesenc_SB_SR_AK_accel(r, st, rk, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesenc_SB_SR_AK_gen(r, st, rk);
+    } else {
+        aesenc_SB_SR_AK_genrev(r, st, rk);
+    }
+}
+
+#endif /* CRYPTO_AES_ROUND_H */

From 192fa84986a6e060f353ed491fe635ccd960876e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 00:57:02 -0700
Subject: [PATCH 0504/1353] crypto: Add aesdec_ISB_ISR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a primitive for InvSubBytes + InvShiftRows + AddRoundKey.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                                 | 45 ++++++++++++++++++++
 host/include/generic/host/crypto/aes-round.h |  4 ++
 include/crypto/aes-round.h                   | 21 +++++++++
 3 files changed, 70 insertions(+)

diff --git a/crypto/aes.c b/crypto/aes.c
index 408d92b81f..90274c3706 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -1261,6 +1261,51 @@ void aesenc_SB_SR_AK_genrev(AESState *r, const AESState *s, const AESState *k)
     aesenc_SB_SR_AK_swap(r, s, k, true);
 }
 
+/*
+ * Perform InvSubBytes + InvShiftRows + AddRoundKey.
+ */
+static inline void
+aesdec_ISB_ISR_AK_swap(AESState *ret, const AESState *st,
+                       const AESState *rk, bool swap)
+{
+    const int swap_b = swap ? 15 : 0;
+    AESState t;
+
+    t.b[swap_b ^ 0x0] = AES_isbox[st->b[swap_b ^ AES_ISH(0x0)]];
+    t.b[swap_b ^ 0x1] = AES_isbox[st->b[swap_b ^ AES_ISH(0x1)]];
+    t.b[swap_b ^ 0x2] = AES_isbox[st->b[swap_b ^ AES_ISH(0x2)]];
+    t.b[swap_b ^ 0x3] = AES_isbox[st->b[swap_b ^ AES_ISH(0x3)]];
+    t.b[swap_b ^ 0x4] = AES_isbox[st->b[swap_b ^ AES_ISH(0x4)]];
+    t.b[swap_b ^ 0x5] = AES_isbox[st->b[swap_b ^ AES_ISH(0x5)]];
+    t.b[swap_b ^ 0x6] = AES_isbox[st->b[swap_b ^ AES_ISH(0x6)]];
+    t.b[swap_b ^ 0x7] = AES_isbox[st->b[swap_b ^ AES_ISH(0x7)]];
+    t.b[swap_b ^ 0x8] = AES_isbox[st->b[swap_b ^ AES_ISH(0x8)]];
+    t.b[swap_b ^ 0x9] = AES_isbox[st->b[swap_b ^ AES_ISH(0x9)]];
+    t.b[swap_b ^ 0xa] = AES_isbox[st->b[swap_b ^ AES_ISH(0xA)]];
+    t.b[swap_b ^ 0xb] = AES_isbox[st->b[swap_b ^ AES_ISH(0xB)]];
+    t.b[swap_b ^ 0xc] = AES_isbox[st->b[swap_b ^ AES_ISH(0xC)]];
+    t.b[swap_b ^ 0xd] = AES_isbox[st->b[swap_b ^ AES_ISH(0xD)]];
+    t.b[swap_b ^ 0xe] = AES_isbox[st->b[swap_b ^ AES_ISH(0xE)]];
+    t.b[swap_b ^ 0xf] = AES_isbox[st->b[swap_b ^ AES_ISH(0xF)]];
+
+    /*
+     * Perform the AddRoundKey with generic vectors.
+     * This may be expanded to either host integer or host vector code.
+     * The key and output endianness match, so no bswap required.
+     */
+    ret->v = t.v ^ rk->v;
+}
+
+void aesdec_ISB_ISR_AK_gen(AESState *r, const AESState *s, const AESState *k)
+{
+    aesdec_ISB_ISR_AK_swap(r, s, k, false);
+}
+
+void aesdec_ISB_ISR_AK_genrev(AESState *r, const AESState *s, const AESState *k)
+{
+    aesdec_ISB_ISR_AK_swap(r, s, k, true);
+}
+
 /**
  * Expand the cipher key into the encryption key schedule.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
index c5d8066179..c9b9d732f0 100644
--- a/host/include/generic/host/crypto/aes-round.h
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -13,4 +13,8 @@ void aesenc_SB_SR_AK_accel(AESState *, const AESState *,
                            const AESState *, bool)
     QEMU_ERROR("unsupported accel");
 
+void aesdec_ISB_ISR_AK_accel(AESState *, const AESState *,
+                             const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
+
 #endif /* GENERIC_HOST_CRYPTO_AES_ROUND_H */
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
index b85db1a30e..dcf098b97b 100644
--- a/include/crypto/aes-round.h
+++ b/include/crypto/aes-round.h
@@ -41,4 +41,25 @@ static inline void aesenc_SB_SR_AK(AESState *r, const AESState *st,
     }
 }
 
+/*
+ * Perform InvSubBytes + InvShiftRows + AddRoundKey.
+ */
+
+void aesdec_ISB_ISR_AK_gen(AESState *ret, const AESState *st,
+                           const AESState *rk);
+void aesdec_ISB_ISR_AK_genrev(AESState *ret, const AESState *st,
+                              const AESState *rk);
+
+static inline void aesdec_ISB_ISR_AK(AESState *r, const AESState *st,
+                                     const AESState *rk, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesdec_ISB_ISR_AK_accel(r, st, rk, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesdec_ISB_ISR_AK_gen(r, st, rk);
+    } else {
+        aesdec_ISB_ISR_AK_genrev(r, st, rk);
+    }
+}
+
 #endif /* CRYPTO_AES_ROUND_H */

From 04e1f30eedfe581c0c3b6bc6b6f5f76c65dc2c71 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 01:49:21 -0700
Subject: [PATCH 0505/1353] crypto: Add aesenc_MC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a primitive for MixColumns.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                                 | 61 ++++++++++++++++++++
 host/include/generic/host/crypto/aes-round.h |  2 +
 include/crypto/aes-round.h                   | 18 ++++++
 3 files changed, 81 insertions(+)

diff --git a/crypto/aes.c b/crypto/aes.c
index 90274c3706..ec300cda0c 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -28,6 +28,8 @@
  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "qemu/osdep.h"
+#include "qemu/bswap.h"
+#include "qemu/bitops.h"
 #include "crypto/aes.h"
 #include "crypto/aes-round.h"
 
@@ -1216,6 +1218,65 @@ static const u32 rcon[] = {
         0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
 };
 
+/*
+ * Perform MixColumns.
+ */
+static inline void
+aesenc_MC_swap(AESState *r, const AESState *st, bool swap)
+{
+    int swap_b = swap * 0xf;
+    int swap_w = swap * 0x3;
+    bool be = HOST_BIG_ENDIAN ^ swap;
+    uint32_t t;
+
+    /* Note that AES_mc_rot is encoded for little-endian. */
+    t = (      AES_mc_rot[st->b[swap_b ^ 0x0]] ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x1]], 8) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x2]], 16) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x3]], 24));
+    if (be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 0] = t;
+
+    t = (      AES_mc_rot[st->b[swap_b ^ 0x4]] ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x5]], 8) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x6]], 16) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x7]], 24));
+    if (be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 1] = t;
+
+    t = (      AES_mc_rot[st->b[swap_b ^ 0x8]] ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0x9]], 8) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0xA]], 16) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0xB]], 24));
+    if (be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 2] = t;
+
+    t = (      AES_mc_rot[st->b[swap_b ^ 0xC]] ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0xD]], 8) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0xE]], 16) ^
+         rol32(AES_mc_rot[st->b[swap_b ^ 0xF]], 24));
+    if (be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 3] = t;
+}
+
+void aesenc_MC_gen(AESState *r, const AESState *st)
+{
+    aesenc_MC_swap(r, st, false);
+}
+
+void aesenc_MC_genrev(AESState *r, const AESState *st)
+{
+    aesenc_MC_swap(r, st, true);
+}
+
 /*
  * Perform SubBytes + ShiftRows + AddRoundKey.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
index c9b9d732f0..1b82afc629 100644
--- a/host/include/generic/host/crypto/aes-round.h
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -9,6 +9,8 @@
 #define HAVE_AES_ACCEL  false
 #define ATTR_AES_ACCEL
 
+void aesenc_MC_accel(AESState *, const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
 void aesenc_SB_SR_AK_accel(AESState *, const AESState *,
                            const AESState *, bool)
     QEMU_ERROR("unsupported accel");
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
index dcf098b97b..7d2be40a67 100644
--- a/include/crypto/aes-round.h
+++ b/include/crypto/aes-round.h
@@ -20,6 +20,24 @@ typedef union {
 
 #include "host/crypto/aes-round.h"
 
+/*
+ * Perform MixColumns.
+ */
+
+void aesenc_MC_gen(AESState *ret, const AESState *st);
+void aesenc_MC_genrev(AESState *ret, const AESState *st);
+
+static inline void aesenc_MC(AESState *r, const AESState *st, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesenc_MC_accel(r, st, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesenc_MC_gen(r, st);
+    } else {
+        aesenc_MC_genrev(r, st);
+    }
+}
+
 /*
  * Perform SubBytes + ShiftRows + AddRoundKey.
  */

From 5b41deb3108c48143d6697cd2dcde3f0b9a57c80 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 02:01:23 -0700
Subject: [PATCH 0506/1353] crypto: Add aesdec_IMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a primitive for InvMixColumns.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                                 | 59 ++++++++++++++++++++
 host/include/generic/host/crypto/aes-round.h |  2 +
 include/crypto/aes-round.h                   | 18 ++++++
 3 files changed, 79 insertions(+)

diff --git a/crypto/aes.c b/crypto/aes.c
index ec300cda0c..6c05d731f4 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -1322,6 +1322,65 @@ void aesenc_SB_SR_AK_genrev(AESState *r, const AESState *s, const AESState *k)
     aesenc_SB_SR_AK_swap(r, s, k, true);
 }
 
+/*
+ * Perform InvMixColumns.
+ */
+static inline void
+aesdec_IMC_swap(AESState *r, const AESState *st, bool swap)
+{
+    int swap_b = swap * 0xf;
+    int swap_w = swap * 0x3;
+    bool be = HOST_BIG_ENDIAN ^ swap;
+    uint32_t t;
+
+    /* Note that AES_imc is encoded for big-endian. */
+    t = (AES_imc[st->b[swap_b ^ 0x0]][0] ^
+         AES_imc[st->b[swap_b ^ 0x1]][1] ^
+         AES_imc[st->b[swap_b ^ 0x2]][2] ^
+         AES_imc[st->b[swap_b ^ 0x3]][3]);
+    if (!be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 0] = t;
+
+    t = (AES_imc[st->b[swap_b ^ 0x4]][0] ^
+         AES_imc[st->b[swap_b ^ 0x5]][1] ^
+         AES_imc[st->b[swap_b ^ 0x6]][2] ^
+         AES_imc[st->b[swap_b ^ 0x7]][3]);
+    if (!be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 1] = t;
+
+    t = (AES_imc[st->b[swap_b ^ 0x8]][0] ^
+         AES_imc[st->b[swap_b ^ 0x9]][1] ^
+         AES_imc[st->b[swap_b ^ 0xA]][2] ^
+         AES_imc[st->b[swap_b ^ 0xB]][3]);
+    if (!be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 2] = t;
+
+    t = (AES_imc[st->b[swap_b ^ 0xC]][0] ^
+         AES_imc[st->b[swap_b ^ 0xD]][1] ^
+         AES_imc[st->b[swap_b ^ 0xE]][2] ^
+         AES_imc[st->b[swap_b ^ 0xF]][3]);
+    if (!be) {
+        t = bswap32(t);
+    }
+    r->w[swap_w ^ 3] = t;
+}
+
+void aesdec_IMC_gen(AESState *r, const AESState *st)
+{
+    aesdec_IMC_swap(r, st, false);
+}
+
+void aesdec_IMC_genrev(AESState *r, const AESState *st)
+{
+    aesdec_IMC_swap(r, st, true);
+}
+
 /*
  * Perform InvSubBytes + InvShiftRows + AddRoundKey.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
index 1b82afc629..335ec3f11e 100644
--- a/host/include/generic/host/crypto/aes-round.h
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -15,6 +15,8 @@ void aesenc_SB_SR_AK_accel(AESState *, const AESState *,
                            const AESState *, bool)
     QEMU_ERROR("unsupported accel");
 
+void aesdec_IMC_accel(AESState *, const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
 void aesdec_ISB_ISR_AK_accel(AESState *, const AESState *,
                              const AESState *, bool)
     QEMU_ERROR("unsupported accel");
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
index 7d2be40a67..7be2cc0d8e 100644
--- a/include/crypto/aes-round.h
+++ b/include/crypto/aes-round.h
@@ -59,6 +59,24 @@ static inline void aesenc_SB_SR_AK(AESState *r, const AESState *st,
     }
 }
 
+/*
+ * Perform InvMixColumns.
+ */
+
+void aesdec_IMC_gen(AESState *ret, const AESState *st);
+void aesdec_IMC_genrev(AESState *ret, const AESState *st);
+
+static inline void aesdec_IMC(AESState *r, const AESState *st, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesdec_IMC_accel(r, st, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesdec_IMC_gen(r, st);
+    } else {
+        aesdec_IMC_genrev(r, st);
+    }
+}
+
 /*
  * Perform InvSubBytes + InvShiftRows + AddRoundKey.
  */

From 7c58cb972e851c2e96ad5abd98b9c00b3f1c8a95 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 03:54:39 -0700
Subject: [PATCH 0507/1353] crypto: Add aesenc_SB_SR_MC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a primitive for SubBytes + ShiftRows + MixColumns + AddRoundKey.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                                 | 58 ++++++++++++++++++++
 host/include/generic/host/crypto/aes-round.h |  3 +
 include/crypto/aes-round.h                   | 21 +++++++
 3 files changed, 82 insertions(+)

diff --git a/crypto/aes.c b/crypto/aes.c
index 6c05d731f4..a193d98d54 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -1322,6 +1322,64 @@ void aesenc_SB_SR_AK_genrev(AESState *r, const AESState *s, const AESState *k)
     aesenc_SB_SR_AK_swap(r, s, k, true);
 }
 
+/*
+ * Perform SubBytes + ShiftRows + MixColumns + AddRoundKey.
+ */
+static inline void
+aesenc_SB_SR_MC_AK_swap(AESState *r, const AESState *st,
+                        const AESState *rk, bool swap)
+{
+    int swap_b = swap * 0xf;
+    int swap_w = swap * 0x3;
+    bool be = HOST_BIG_ENDIAN ^ swap;
+    uint32_t w0, w1, w2, w3;
+
+    w0 = (AES_Te0[st->b[swap_b ^ AES_SH(0x0)]] ^
+          AES_Te1[st->b[swap_b ^ AES_SH(0x1)]] ^
+          AES_Te2[st->b[swap_b ^ AES_SH(0x2)]] ^
+          AES_Te3[st->b[swap_b ^ AES_SH(0x3)]]);
+
+    w1 = (AES_Te0[st->b[swap_b ^ AES_SH(0x4)]] ^
+          AES_Te1[st->b[swap_b ^ AES_SH(0x5)]] ^
+          AES_Te2[st->b[swap_b ^ AES_SH(0x6)]] ^
+          AES_Te3[st->b[swap_b ^ AES_SH(0x7)]]);
+
+    w2 = (AES_Te0[st->b[swap_b ^ AES_SH(0x8)]] ^
+          AES_Te1[st->b[swap_b ^ AES_SH(0x9)]] ^
+          AES_Te2[st->b[swap_b ^ AES_SH(0xA)]] ^
+          AES_Te3[st->b[swap_b ^ AES_SH(0xB)]]);
+
+    w3 = (AES_Te0[st->b[swap_b ^ AES_SH(0xC)]] ^
+          AES_Te1[st->b[swap_b ^ AES_SH(0xD)]] ^
+          AES_Te2[st->b[swap_b ^ AES_SH(0xE)]] ^
+          AES_Te3[st->b[swap_b ^ AES_SH(0xF)]]);
+
+    /* Note that AES_TeX is encoded for big-endian. */
+    if (!be) {
+        w0 = bswap32(w0);
+        w1 = bswap32(w1);
+        w2 = bswap32(w2);
+        w3 = bswap32(w3);
+    }
+
+    r->w[swap_w ^ 0] = rk->w[swap_w ^ 0] ^ w0;
+    r->w[swap_w ^ 1] = rk->w[swap_w ^ 1] ^ w1;
+    r->w[swap_w ^ 2] = rk->w[swap_w ^ 2] ^ w2;
+    r->w[swap_w ^ 3] = rk->w[swap_w ^ 3] ^ w3;
+}
+
+void aesenc_SB_SR_MC_AK_gen(AESState *r, const AESState *st,
+                            const AESState *rk)
+{
+    aesenc_SB_SR_MC_AK_swap(r, st, rk, false);
+}
+
+void aesenc_SB_SR_MC_AK_genrev(AESState *r, const AESState *st,
+                               const AESState *rk)
+{
+    aesenc_SB_SR_MC_AK_swap(r, st, rk, true);
+}
+
 /*
  * Perform InvMixColumns.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
index 335ec3f11e..9886e81e50 100644
--- a/host/include/generic/host/crypto/aes-round.h
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -14,6 +14,9 @@ void aesenc_MC_accel(AESState *, const AESState *, bool)
 void aesenc_SB_SR_AK_accel(AESState *, const AESState *,
                            const AESState *, bool)
     QEMU_ERROR("unsupported accel");
+void aesenc_SB_SR_MC_AK_accel(AESState *, const AESState *,
+                              const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
 
 void aesdec_IMC_accel(AESState *, const AESState *, bool)
     QEMU_ERROR("unsupported accel");
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
index 7be2cc0d8e..03688c8640 100644
--- a/include/crypto/aes-round.h
+++ b/include/crypto/aes-round.h
@@ -59,6 +59,27 @@ static inline void aesenc_SB_SR_AK(AESState *r, const AESState *st,
     }
 }
 
+/*
+ * Perform SubBytes + ShiftRows + MixColumns + AddRoundKey.
+ */
+
+void aesenc_SB_SR_MC_AK_gen(AESState *ret, const AESState *st,
+                            const AESState *rk);
+void aesenc_SB_SR_MC_AK_genrev(AESState *ret, const AESState *st,
+                               const AESState *rk);
+
+static inline void aesenc_SB_SR_MC_AK(AESState *r, const AESState *st,
+                                      const AESState *rk, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesenc_SB_SR_MC_AK_accel(r, st, rk, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesenc_SB_SR_MC_AK_gen(r, st, rk);
+    } else {
+        aesenc_SB_SR_MC_AK_genrev(r, st, rk);
+    }
+}
+
 /*
  * Perform InvMixColumns.
  */

From 15ff15982a13ddf3e03b38ff46277ed90c1f36f9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 15:23:18 -0700
Subject: [PATCH 0508/1353] crypto: Add aesdec_ISB_ISR_IMC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a primitive for InvSubBytes + InvShiftRows +
InvMixColumns + AddRoundKey.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                                 | 58 ++++++++++++++++++++
 host/include/generic/host/crypto/aes-round.h |  3 +
 include/crypto/aes-round.h                   | 21 +++++++
 3 files changed, 82 insertions(+)

diff --git a/crypto/aes.c b/crypto/aes.c
index a193d98d54..c2546ef12e 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -1484,6 +1484,64 @@ void aesdec_ISB_ISR_AK_genrev(AESState *r, const AESState *s, const AESState *k)
     aesdec_ISB_ISR_AK_swap(r, s, k, true);
 }
 
+/*
+ * Perform InvSubBytes + InvShiftRows + InvMixColumns + AddRoundKey.
+ */
+static inline void
+aesdec_ISB_ISR_IMC_AK_swap(AESState *r, const AESState *st,
+                           const AESState *rk, bool swap)
+{
+    int swap_b = swap * 0xf;
+    int swap_w = swap * 0x3;
+    bool be = HOST_BIG_ENDIAN ^ swap;
+    uint32_t w0, w1, w2, w3;
+
+    w0 = (AES_Td0[st->b[swap_b ^ AES_ISH(0x0)]] ^
+          AES_Td1[st->b[swap_b ^ AES_ISH(0x1)]] ^
+          AES_Td2[st->b[swap_b ^ AES_ISH(0x2)]] ^
+          AES_Td3[st->b[swap_b ^ AES_ISH(0x3)]]);
+
+    w1 = (AES_Td0[st->b[swap_b ^ AES_ISH(0x4)]] ^
+          AES_Td1[st->b[swap_b ^ AES_ISH(0x5)]] ^
+          AES_Td2[st->b[swap_b ^ AES_ISH(0x6)]] ^
+          AES_Td3[st->b[swap_b ^ AES_ISH(0x7)]]);
+
+    w2 = (AES_Td0[st->b[swap_b ^ AES_ISH(0x8)]] ^
+          AES_Td1[st->b[swap_b ^ AES_ISH(0x9)]] ^
+          AES_Td2[st->b[swap_b ^ AES_ISH(0xA)]] ^
+          AES_Td3[st->b[swap_b ^ AES_ISH(0xB)]]);
+
+    w3 = (AES_Td0[st->b[swap_b ^ AES_ISH(0xC)]] ^
+          AES_Td1[st->b[swap_b ^ AES_ISH(0xD)]] ^
+          AES_Td2[st->b[swap_b ^ AES_ISH(0xE)]] ^
+          AES_Td3[st->b[swap_b ^ AES_ISH(0xF)]]);
+
+    /* Note that AES_TdX is encoded for big-endian. */
+    if (!be) {
+        w0 = bswap32(w0);
+        w1 = bswap32(w1);
+        w2 = bswap32(w2);
+        w3 = bswap32(w3);
+    }
+
+    r->w[swap_w ^ 0] = rk->w[swap_w ^ 0] ^ w0;
+    r->w[swap_w ^ 1] = rk->w[swap_w ^ 1] ^ w1;
+    r->w[swap_w ^ 2] = rk->w[swap_w ^ 2] ^ w2;
+    r->w[swap_w ^ 3] = rk->w[swap_w ^ 3] ^ w3;
+}
+
+void aesdec_ISB_ISR_IMC_AK_gen(AESState *r, const AESState *st,
+                               const AESState *rk)
+{
+    aesdec_ISB_ISR_IMC_AK_swap(r, st, rk, false);
+}
+
+void aesdec_ISB_ISR_IMC_AK_genrev(AESState *r, const AESState *st,
+                                  const AESState *rk)
+{
+    aesdec_ISB_ISR_IMC_AK_swap(r, st, rk, true);
+}
+
 /**
  * Expand the cipher key into the encryption key schedule.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
index 9886e81e50..db8cfe17eb 100644
--- a/host/include/generic/host/crypto/aes-round.h
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -23,5 +23,8 @@ void aesdec_IMC_accel(AESState *, const AESState *, bool)
 void aesdec_ISB_ISR_AK_accel(AESState *, const AESState *,
                              const AESState *, bool)
     QEMU_ERROR("unsupported accel");
+void aesdec_ISB_ISR_IMC_AK_accel(AESState *, const AESState *,
+                                 const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
 
 #endif /* GENERIC_HOST_CRYPTO_AES_ROUND_H */
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
index 03688c8640..9996f1c219 100644
--- a/include/crypto/aes-round.h
+++ b/include/crypto/aes-round.h
@@ -119,4 +119,25 @@ static inline void aesdec_ISB_ISR_AK(AESState *r, const AESState *st,
     }
 }
 
+/*
+ * Perform InvSubBytes + InvShiftRows + InvMixColumns + AddRoundKey.
+ */
+
+void aesdec_ISB_ISR_IMC_AK_gen(AESState *ret, const AESState *st,
+                               const AESState *rk);
+void aesdec_ISB_ISR_IMC_AK_genrev(AESState *ret, const AESState *st,
+                                  const AESState *rk);
+
+static inline void aesdec_ISB_ISR_IMC_AK(AESState *r, const AESState *st,
+                                         const AESState *rk, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesdec_ISB_ISR_IMC_AK_accel(r, st, rk, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesdec_ISB_ISR_IMC_AK_gen(r, st, rk);
+    } else {
+        aesdec_ISB_ISR_IMC_AK_genrev(r, st, rk);
+    }
+}
+
 #endif /* CRYPTO_AES_ROUND_H */

From 28e91474ce558bca55c800e7977bab7c66a44abb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 15:40:04 -0700
Subject: [PATCH 0509/1353] crypto: Add aesdec_ISB_ISR_AK_IMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a primitive for InvSubBytes + InvShiftRows +
AddRoundKey + InvMixColumns.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c                                 | 14 +++++++++++++
 host/include/generic/host/crypto/aes-round.h |  3 +++
 include/crypto/aes-round.h                   | 21 ++++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/crypto/aes.c b/crypto/aes.c
index c2546ef12e..c765f11c1e 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -1542,6 +1542,20 @@ void aesdec_ISB_ISR_IMC_AK_genrev(AESState *r, const AESState *st,
     aesdec_ISB_ISR_IMC_AK_swap(r, st, rk, true);
 }
 
+void aesdec_ISB_ISR_AK_IMC_gen(AESState *ret, const AESState *st,
+                               const AESState *rk)
+{
+    aesdec_ISB_ISR_AK_gen(ret, st, rk);
+    aesdec_IMC_gen(ret, ret);
+}
+
+void aesdec_ISB_ISR_AK_IMC_genrev(AESState *ret, const AESState *st,
+                                  const AESState *rk)
+{
+    aesdec_ISB_ISR_AK_genrev(ret, st, rk);
+    aesdec_IMC_genrev(ret, ret);
+}
+
 /**
  * Expand the cipher key into the encryption key schedule.
  */
diff --git a/host/include/generic/host/crypto/aes-round.h b/host/include/generic/host/crypto/aes-round.h
index db8cfe17eb..1b9720f917 100644
--- a/host/include/generic/host/crypto/aes-round.h
+++ b/host/include/generic/host/crypto/aes-round.h
@@ -23,6 +23,9 @@ void aesdec_IMC_accel(AESState *, const AESState *, bool)
 void aesdec_ISB_ISR_AK_accel(AESState *, const AESState *,
                              const AESState *, bool)
     QEMU_ERROR("unsupported accel");
+void aesdec_ISB_ISR_AK_IMC_accel(AESState *, const AESState *,
+                                 const AESState *, bool)
+    QEMU_ERROR("unsupported accel");
 void aesdec_ISB_ISR_IMC_AK_accel(AESState *, const AESState *,
                                  const AESState *, bool)
     QEMU_ERROR("unsupported accel");
diff --git a/include/crypto/aes-round.h b/include/crypto/aes-round.h
index 9996f1c219..854fb0966a 100644
--- a/include/crypto/aes-round.h
+++ b/include/crypto/aes-round.h
@@ -119,6 +119,27 @@ static inline void aesdec_ISB_ISR_AK(AESState *r, const AESState *st,
     }
 }
 
+/*
+ * Perform InvSubBytes + InvShiftRows + AddRoundKey + InvMixColumns.
+ */
+
+void aesdec_ISB_ISR_AK_IMC_gen(AESState *ret, const AESState *st,
+                               const AESState *rk);
+void aesdec_ISB_ISR_AK_IMC_genrev(AESState *ret, const AESState *st,
+                                  const AESState *rk);
+
+static inline void aesdec_ISB_ISR_AK_IMC(AESState *r, const AESState *st,
+                                         const AESState *rk, bool be)
+{
+    if (HAVE_AES_ACCEL) {
+        aesdec_ISB_ISR_AK_IMC_accel(r, st, rk, be);
+    } else if (HOST_BIG_ENDIAN == be) {
+        aesdec_ISB_ISR_AK_IMC_gen(r, st, rk);
+    } else {
+        aesdec_ISB_ISR_AK_IMC_genrev(r, st, rk);
+    }
+}
+
 /*
  * Perform InvSubBytes + InvShiftRows + InvMixColumns + AddRoundKey.
  */

From d6a2443696c5b34fb20879e899bf823d6168b068 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 23:58:52 -0700
Subject: [PATCH 0510/1353] host/include/i386: Implement aes-round.h

Detect AES in cpuinfo; implement the accel hooks.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/i386/host/cpuinfo.h            |   1 +
 host/include/i386/host/crypto/aes-round.h   | 152 ++++++++++++++++++++
 host/include/x86_64/host/crypto/aes-round.h |   1 +
 util/cpuinfo-i386.c                         |   3 +
 4 files changed, 157 insertions(+)
 create mode 100644 host/include/i386/host/crypto/aes-round.h
 create mode 100644 host/include/x86_64/host/crypto/aes-round.h

diff --git a/host/include/i386/host/cpuinfo.h b/host/include/i386/host/cpuinfo.h
index a6537123cf..073d0a426f 100644
--- a/host/include/i386/host/cpuinfo.h
+++ b/host/include/i386/host/cpuinfo.h
@@ -26,6 +26,7 @@
 #define CPUINFO_AVX512VBMI2     (1u << 15)
 #define CPUINFO_ATOMIC_VMOVDQA  (1u << 16)
 #define CPUINFO_ATOMIC_VMOVDQU  (1u << 17)
+#define CPUINFO_AES             (1u << 18)
 
 /* Initialized with a constructor. */
 extern unsigned cpuinfo;
diff --git a/host/include/i386/host/crypto/aes-round.h b/host/include/i386/host/crypto/aes-round.h
new file mode 100644
index 0000000000..59a64130f7
--- /dev/null
+++ b/host/include/i386/host/crypto/aes-round.h
@@ -0,0 +1,152 @@
+/*
+ * x86 specific aes acceleration.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef X86_HOST_CRYPTO_AES_ROUND_H
+#define X86_HOST_CRYPTO_AES_ROUND_H
+
+#include "host/cpuinfo.h"
+#include <immintrin.h>
+
+#if defined(__AES__) && defined(__SSSE3__)
+# define HAVE_AES_ACCEL  true
+# define ATTR_AES_ACCEL
+#else
+# define HAVE_AES_ACCEL  likely(cpuinfo & CPUINFO_AES)
+# define ATTR_AES_ACCEL  __attribute__((target("aes,ssse3")))
+#endif
+
+static inline __m128i ATTR_AES_ACCEL
+aes_accel_bswap(__m128i x)
+{
+    return _mm_shuffle_epi8(x, _mm_set_epi8(0, 1, 2, 3, 4, 5, 6, 7, 8,
+                                            9, 10, 11, 12, 13, 14, 15));
+}
+
+static inline void ATTR_AES_ACCEL
+aesenc_MC_accel(AESState *ret, const AESState *st, bool be)
+{
+    __m128i t = (__m128i)st->v;
+    __m128i z = _mm_setzero_si128();
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = _mm_aesdeclast_si128(t, z);
+        t = _mm_aesenc_si128(t, z);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesdeclast_si128(t, z);
+        t = _mm_aesenc_si128(t, z);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesenc_SB_SR_AK_accel(AESState *ret, const AESState *st,
+                      const AESState *rk, bool be)
+{
+    __m128i t = (__m128i)st->v;
+    __m128i k = (__m128i)rk->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        k = aes_accel_bswap(k);
+        t = _mm_aesenclast_si128(t, k);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesenclast_si128(t, k);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesenc_SB_SR_MC_AK_accel(AESState *ret, const AESState *st,
+                         const AESState *rk, bool be)
+{
+    __m128i t = (__m128i)st->v;
+    __m128i k = (__m128i)rk->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        k = aes_accel_bswap(k);
+        t = _mm_aesenc_si128(t, k);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesenc_si128(t, k);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_IMC_accel(AESState *ret, const AESState *st, bool be)
+{
+    __m128i t = (__m128i)st->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = _mm_aesimc_si128(t);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesimc_si128(t);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_ISB_ISR_AK_accel(AESState *ret, const AESState *st,
+                        const AESState *rk, bool be)
+{
+    __m128i t = (__m128i)st->v;
+    __m128i k = (__m128i)rk->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        k = aes_accel_bswap(k);
+        t = _mm_aesdeclast_si128(t, k);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesdeclast_si128(t, k);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_ISB_ISR_AK_IMC_accel(AESState *ret, const AESState *st,
+                            const AESState *rk, bool be)
+{
+    __m128i t = (__m128i)st->v;
+    __m128i k = (__m128i)rk->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        k = aes_accel_bswap(k);
+        t = _mm_aesdeclast_si128(t, k);
+        t = _mm_aesimc_si128(t);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesdeclast_si128(t, k);
+        t = _mm_aesimc_si128(t);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_ISB_ISR_IMC_AK_accel(AESState *ret, const AESState *st,
+                            const AESState *rk, bool be)
+{
+    __m128i t = (__m128i)st->v;
+    __m128i k = (__m128i)rk->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        k = aes_accel_bswap(k);
+        t = _mm_aesdec_si128(t, k);
+        t = aes_accel_bswap(t);
+    } else {
+        t = _mm_aesdec_si128(t, k);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+#endif /* X86_HOST_CRYPTO_AES_ROUND_H */
diff --git a/host/include/x86_64/host/crypto/aes-round.h b/host/include/x86_64/host/crypto/aes-round.h
new file mode 100644
index 0000000000..2773cc9f10
--- /dev/null
+++ b/host/include/x86_64/host/crypto/aes-round.h
@@ -0,0 +1 @@
+#include "host/include/i386/host/crypto/aes-round.h"
diff --git a/util/cpuinfo-i386.c b/util/cpuinfo-i386.c
index ab6143d9e7..3a7b7e0ad1 100644
--- a/util/cpuinfo-i386.c
+++ b/util/cpuinfo-i386.c
@@ -40,6 +40,9 @@ unsigned __attribute__((constructor)) cpuinfo_init(void)
         info |= (c & bit_MOVBE ? CPUINFO_MOVBE : 0);
         info |= (c & bit_POPCNT ? CPUINFO_POPCNT : 0);
 
+        /* Our AES support requires PSHUFB as well. */
+        info |= ((c & bit_AES) && (c & bit_SSSE3) ? CPUINFO_AES : 0);
+
         /* For AVX features, we must check available and usable. */
         if ((c & bit_AVX) && (c & bit_OSXSAVE)) {
             unsigned bv = xgetbv_low(0);

From 8d97f28e368be8b6248a363792a2cd0f9e9ddf6a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 07:43:40 +0000
Subject: [PATCH 0511/1353] host/include/aarch64: Implement aes-round.h

Detect AES in cpuinfo; implement the accel hooks.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/aarch64/host/cpuinfo.h          |   1 +
 host/include/aarch64/host/crypto/aes-round.h | 205 +++++++++++++++++++
 meson.build                                  |   9 +
 util/cpuinfo-aarch64.c                       |   2 +
 4 files changed, 217 insertions(+)
 create mode 100644 host/include/aarch64/host/crypto/aes-round.h

diff --git a/host/include/aarch64/host/cpuinfo.h b/host/include/aarch64/host/cpuinfo.h
index 82227890b4..05feeb4f43 100644
--- a/host/include/aarch64/host/cpuinfo.h
+++ b/host/include/aarch64/host/cpuinfo.h
@@ -9,6 +9,7 @@
 #define CPUINFO_ALWAYS          (1u << 0)  /* so cpuinfo is nonzero */
 #define CPUINFO_LSE             (1u << 1)
 #define CPUINFO_LSE2            (1u << 2)
+#define CPUINFO_AES             (1u << 3)
 
 /* Initialized with a constructor. */
 extern unsigned cpuinfo;
diff --git a/host/include/aarch64/host/crypto/aes-round.h b/host/include/aarch64/host/crypto/aes-round.h
new file mode 100644
index 0000000000..8b5f88d50c
--- /dev/null
+++ b/host/include/aarch64/host/crypto/aes-round.h
@@ -0,0 +1,205 @@
+/*
+ * AArch64 specific aes acceleration.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef AARCH64_HOST_CRYPTO_AES_ROUND_H
+#define AARCH64_HOST_CRYPTO_AES_ROUND_H
+
+#include "host/cpuinfo.h"
+#include <arm_neon.h>
+
+#ifdef __ARM_FEATURE_AES
+# define HAVE_AES_ACCEL  true
+#else
+# define HAVE_AES_ACCEL  likely(cpuinfo & CPUINFO_AES)
+#endif
+#if !defined(__ARM_FEATURE_AES) && defined(CONFIG_ARM_AES_BUILTIN)
+# define ATTR_AES_ACCEL  __attribute__((target("+crypto")))
+#else
+# define ATTR_AES_ACCEL
+#endif
+
+static inline uint8x16_t aes_accel_bswap(uint8x16_t x)
+{
+    return vqtbl1q_u8(x, (uint8x16_t){ 15, 14, 13, 12, 11, 10, 9, 8,
+                                        7,  6,  5,  4,  3,  2, 1, 0, });
+}
+
+#ifdef CONFIG_ARM_AES_BUILTIN
+# define aes_accel_aesd            vaesdq_u8
+# define aes_accel_aese            vaeseq_u8
+# define aes_accel_aesmc           vaesmcq_u8
+# define aes_accel_aesimc          vaesimcq_u8
+# define aes_accel_aesd_imc(S, K)  vaesimcq_u8(vaesdq_u8(S, K))
+# define aes_accel_aese_mc(S, K)   vaesmcq_u8(vaeseq_u8(S, K))
+#else
+static inline uint8x16_t aes_accel_aesd(uint8x16_t d, uint8x16_t k)
+{
+    asm(".arch_extension aes\n\t"
+        "aesd %0.16b, %1.16b" : "+w"(d) : "w"(k));
+    return d;
+}
+
+static inline uint8x16_t aes_accel_aese(uint8x16_t d, uint8x16_t k)
+{
+    asm(".arch_extension aes\n\t"
+        "aese %0.16b, %1.16b" : "+w"(d) : "w"(k));
+    return d;
+}
+
+static inline uint8x16_t aes_accel_aesmc(uint8x16_t d)
+{
+    asm(".arch_extension aes\n\t"
+        "aesmc %0.16b, %1.16b" : "=w"(d) : "w"(d));
+    return d;
+}
+
+static inline uint8x16_t aes_accel_aesimc(uint8x16_t d)
+{
+    asm(".arch_extension aes\n\t"
+        "aesimc %0.16b, %1.16b" : "=w"(d) : "w"(d));
+    return d;
+}
+
+/* Most CPUs fuse AESD+AESIMC in the execution pipeline. */
+static inline uint8x16_t aes_accel_aesd_imc(uint8x16_t d, uint8x16_t k)
+{
+    asm(".arch_extension aes\n\t"
+        "aesd %0.16b, %1.16b\n\t"
+        "aesimc %0.16b, %0.16b" : "+w"(d) : "w"(k));
+    return d;
+}
+
+/* Most CPUs fuse AESE+AESMC in the execution pipeline. */
+static inline uint8x16_t aes_accel_aese_mc(uint8x16_t d, uint8x16_t k)
+{
+    asm(".arch_extension aes\n\t"
+        "aese %0.16b, %1.16b\n\t"
+        "aesmc %0.16b, %0.16b" : "+w"(d) : "w"(k));
+    return d;
+}
+#endif /* CONFIG_ARM_AES_BUILTIN */
+
+static inline void ATTR_AES_ACCEL
+aesenc_MC_accel(AESState *ret, const AESState *st, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = aes_accel_aesmc(t);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aesmc(t);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesenc_SB_SR_AK_accel(AESState *ret, const AESState *st,
+                      const AESState *rk, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+    uint8x16_t z = { };
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = aes_accel_aese(t, z);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aese(t, z);
+    }
+    ret->v = (AESStateVec)t ^ rk->v;
+}
+
+static inline void ATTR_AES_ACCEL
+aesenc_SB_SR_MC_AK_accel(AESState *ret, const AESState *st,
+                         const AESState *rk, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+    uint8x16_t z = { };
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = aes_accel_aese_mc(t, z);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aese_mc(t, z);
+    }
+    ret->v = (AESStateVec)t ^ rk->v;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_IMC_accel(AESState *ret, const AESState *st, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = aes_accel_aesimc(t);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aesimc(t);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_ISB_ISR_AK_accel(AESState *ret, const AESState *st,
+                        const AESState *rk, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+    uint8x16_t z = { };
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = aes_accel_aesd(t, z);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aesd(t, z);
+    }
+    ret->v = (AESStateVec)t ^ rk->v;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_ISB_ISR_AK_IMC_accel(AESState *ret, const AESState *st,
+                            const AESState *rk, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+    uint8x16_t k = (uint8x16_t)rk->v;
+    uint8x16_t z = { };
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        k = aes_accel_bswap(k);
+        t = aes_accel_aesd(t, z);
+        t ^= k;
+        t = aes_accel_aesimc(t);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aesd(t, z);
+        t ^= k;
+        t = aes_accel_aesimc(t);
+    }
+    ret->v = (AESStateVec)t;
+}
+
+static inline void ATTR_AES_ACCEL
+aesdec_ISB_ISR_IMC_AK_accel(AESState *ret, const AESState *st,
+                            const AESState *rk, bool be)
+{
+    uint8x16_t t = (uint8x16_t)st->v;
+    uint8x16_t z = { };
+
+    if (be) {
+        t = aes_accel_bswap(t);
+        t = aes_accel_aesd_imc(t, z);
+        t = aes_accel_bswap(t);
+    } else {
+        t = aes_accel_aesd_imc(t, z);
+    }
+    ret->v = (AESStateVec)t ^ rk->v;
+}
+
+#endif /* AARCH64_HOST_CRYPTO_AES_ROUND_H */
diff --git a/meson.build b/meson.build
index c77faa0b6e..58413d44a5 100644
--- a/meson.build
+++ b/meson.build
@@ -2665,6 +2665,15 @@ config_host_data.set('CONFIG_AVX512BW_OPT', get_option('avx512bw') \
     int main(int argc, char *argv[]) { return bar(argv[0]); }
   '''), error_message: 'AVX512BW not available').allowed())
 
+# For both AArch64 and AArch32, detect if builtins are available.
+config_host_data.set('CONFIG_ARM_AES_BUILTIN', cc.compiles('''
+    #include <arm_neon.h>
+    #ifndef __ARM_FEATURE_AES
+    __attribute__((target("+crypto")))
+    #endif
+    void foo(uint8x16_t *p) { *p = vaesmcq_u8(*p); }
+  '''))
+
 have_pvrdma = get_option('pvrdma') \
   .require(rdma.found(), error_message: 'PVRDMA requires OpenFabrics libraries') \
   .require(cc.compiles(gnu_source_prefix + '''
diff --git a/util/cpuinfo-aarch64.c b/util/cpuinfo-aarch64.c
index f99acb7884..ababc39550 100644
--- a/util/cpuinfo-aarch64.c
+++ b/util/cpuinfo-aarch64.c
@@ -56,10 +56,12 @@ unsigned __attribute__((constructor)) cpuinfo_init(void)
     unsigned long hwcap = qemu_getauxval(AT_HWCAP);
     info |= (hwcap & HWCAP_ATOMICS ? CPUINFO_LSE : 0);
     info |= (hwcap & HWCAP_USCAT ? CPUINFO_LSE2 : 0);
+    info |= (hwcap & HWCAP_AES ? CPUINFO_AES: 0);
 #endif
 #ifdef CONFIG_DARWIN
     info |= sysctl_for_bool("hw.optional.arm.FEAT_LSE") * CPUINFO_LSE;
     info |= sysctl_for_bool("hw.optional.arm.FEAT_LSE2") * CPUINFO_LSE2;
+    info |= sysctl_for_bool("hw.optional.arm.FEAT_AES") * CPUINFO_AES;
 #endif
 
     cpuinfo = info;

From 57357322e4bd35c42816c769e36f39af11fc3ddc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 5 Jun 2023 21:57:55 +0300
Subject: [PATCH 0512/1353] host/include/ppc: Implement aes-round.h

Detect CRYPTO in cpuinfo; implement the accel hooks.

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/ppc/host/cpuinfo.h            |   1 +
 host/include/ppc/host/crypto/aes-round.h   | 182 +++++++++++++++++++++
 host/include/ppc64/host/crypto/aes-round.h |   1 +
 util/cpuinfo-ppc.c                         |   8 +
 4 files changed, 192 insertions(+)
 create mode 100644 host/include/ppc/host/crypto/aes-round.h
 create mode 100644 host/include/ppc64/host/crypto/aes-round.h

diff --git a/host/include/ppc/host/cpuinfo.h b/host/include/ppc/host/cpuinfo.h
index df11e8d417..29ee7f9ef8 100644
--- a/host/include/ppc/host/cpuinfo.h
+++ b/host/include/ppc/host/cpuinfo.h
@@ -16,6 +16,7 @@
 #define CPUINFO_ISEL            (1u << 5)
 #define CPUINFO_ALTIVEC         (1u << 6)
 #define CPUINFO_VSX             (1u << 7)
+#define CPUINFO_CRYPTO          (1u << 8)
 
 /* Initialized with a constructor. */
 extern unsigned cpuinfo;
diff --git a/host/include/ppc/host/crypto/aes-round.h b/host/include/ppc/host/crypto/aes-round.h
new file mode 100644
index 0000000000..8062d2a537
--- /dev/null
+++ b/host/include/ppc/host/crypto/aes-round.h
@@ -0,0 +1,182 @@
+/*
+ * Power v2.07 specific aes acceleration.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef PPC_HOST_CRYPTO_AES_ROUND_H
+#define PPC_HOST_CRYPTO_AES_ROUND_H
+
+#ifdef __ALTIVEC__
+#include "host/cpuinfo.h"
+
+#ifdef __CRYPTO__
+# define HAVE_AES_ACCEL  true
+#else
+# define HAVE_AES_ACCEL  likely(cpuinfo & CPUINFO_CRYPTO)
+#endif
+#define ATTR_AES_ACCEL
+
+/*
+ * While there is <altivec.h>, both gcc and clang "aid" with the
+ * endianness issues in different ways. Just use inline asm instead.
+ */
+
+/* Bytes in memory are host-endian; bytes in register are @be. */
+static inline AESStateVec aes_accel_ld(const AESState *p, bool be)
+{
+    AESStateVec r;
+
+    if (be) {
+        asm("lvx %0, 0, %1" : "=v"(r) : "r"(p), "m"(*p));
+    } else if (HOST_BIG_ENDIAN) {
+        AESStateVec rev = {
+            15, 14, 13, 12, 11, 10, 9, 8, 7,  6,  5,  4,  3,  2,  1,  0,
+        };
+        asm("lvx %0, 0, %1\n\t"
+            "vperm %0, %0, %0, %2"
+            : "=v"(r) : "r"(p), "v"(rev), "m"(*p));
+    } else {
+#ifdef __POWER9_VECTOR__
+        asm("lxvb16x %x0, 0, %1" : "=v"(r) : "r"(p), "m"(*p));
+#else
+        asm("lxvd2x %x0, 0, %1\n\t"
+            "xxpermdi %x0, %x0, %x0, 2"
+            : "=v"(r) : "r"(p), "m"(*p));
+#endif
+    }
+    return r;
+}
+
+static void aes_accel_st(AESState *p, AESStateVec r, bool be)
+{
+    if (be) {
+        asm("stvx %1, 0, %2" : "=m"(*p) : "v"(r), "r"(p));
+    } else if (HOST_BIG_ENDIAN) {
+        AESStateVec rev = {
+            15, 14, 13, 12, 11, 10, 9, 8, 7,  6,  5,  4,  3,  2,  1,  0,
+        };
+        asm("vperm %1, %1, %1, %2\n\t"
+            "stvx %1, 0, %3"
+            : "=m"(*p), "+v"(r) : "v"(rev), "r"(p));
+    } else {
+#ifdef __POWER9_VECTOR__
+        asm("stxvb16x %x1, 0, %2" : "=m"(*p) : "v"(r), "r"(p));
+#else
+        asm("xxpermdi %x1, %x1, %x1, 2\n\t"
+            "stxvd2x %x1, 0, %2"
+            : "=m"(*p), "+v"(r) : "r"(p));
+#endif
+    }
+}
+
+static inline AESStateVec aes_accel_vcipher(AESStateVec d, AESStateVec k)
+{
+    asm("vcipher %0, %0, %1" : "+v"(d) : "v"(k));
+    return d;
+}
+
+static inline AESStateVec aes_accel_vncipher(AESStateVec d, AESStateVec k)
+{
+    asm("vncipher %0, %0, %1" : "+v"(d) : "v"(k));
+    return d;
+}
+
+static inline AESStateVec aes_accel_vcipherlast(AESStateVec d, AESStateVec k)
+{
+    asm("vcipherlast %0, %0, %1" : "+v"(d) : "v"(k));
+    return d;
+}
+
+static inline AESStateVec aes_accel_vncipherlast(AESStateVec d, AESStateVec k)
+{
+    asm("vncipherlast %0, %0, %1" : "+v"(d) : "v"(k));
+    return d;
+}
+
+static inline void
+aesenc_MC_accel(AESState *ret, const AESState *st, bool be)
+{
+    AESStateVec t, z = { };
+
+    t = aes_accel_ld(st, be);
+    t = aes_accel_vncipherlast(t, z);
+    t = aes_accel_vcipher(t, z);
+    aes_accel_st(ret, t, be);
+}
+
+static inline void
+aesenc_SB_SR_AK_accel(AESState *ret, const AESState *st,
+                      const AESState *rk, bool be)
+{
+    AESStateVec t, k;
+
+    t = aes_accel_ld(st, be);
+    k = aes_accel_ld(rk, be);
+    t = aes_accel_vcipherlast(t, k);
+    aes_accel_st(ret, t, be);
+}
+
+static inline void
+aesenc_SB_SR_MC_AK_accel(AESState *ret, const AESState *st,
+                         const AESState *rk, bool be)
+{
+    AESStateVec t, k;
+
+    t = aes_accel_ld(st, be);
+    k = aes_accel_ld(rk, be);
+    t = aes_accel_vcipher(t, k);
+    aes_accel_st(ret, t, be);
+}
+
+static inline void
+aesdec_IMC_accel(AESState *ret, const AESState *st, bool be)
+{
+    AESStateVec t, z = { };
+
+    t = aes_accel_ld(st, be);
+    t = aes_accel_vcipherlast(t, z);
+    t = aes_accel_vncipher(t, z);
+    aes_accel_st(ret, t, be);
+}
+
+static inline void
+aesdec_ISB_ISR_AK_accel(AESState *ret, const AESState *st,
+                        const AESState *rk, bool be)
+{
+    AESStateVec t, k;
+
+    t = aes_accel_ld(st, be);
+    k = aes_accel_ld(rk, be);
+    t = aes_accel_vncipherlast(t, k);
+    aes_accel_st(ret, t, be);
+}
+
+static inline void
+aesdec_ISB_ISR_AK_IMC_accel(AESState *ret, const AESState *st,
+                            const AESState *rk, bool be)
+{
+    AESStateVec t, k;
+
+    t = aes_accel_ld(st, be);
+    k = aes_accel_ld(rk, be);
+    t = aes_accel_vncipher(t, k);
+    aes_accel_st(ret, t, be);
+}
+
+static inline void
+aesdec_ISB_ISR_IMC_AK_accel(AESState *ret, const AESState *st,
+                            const AESState *rk, bool be)
+{
+    AESStateVec t, k, z = { };
+
+    t = aes_accel_ld(st, be);
+    k = aes_accel_ld(rk, be);
+    t = aes_accel_vncipher(t, z);
+    aes_accel_st(ret, t ^ k, be);
+}
+#else
+/* Without ALTIVEC, we can't even write inline assembly. */
+#include "host/include/generic/host/crypto/aes-round.h"
+#endif
+
+#endif /* PPC_HOST_CRYPTO_AES_ROUND_H */
diff --git a/host/include/ppc64/host/crypto/aes-round.h b/host/include/ppc64/host/crypto/aes-round.h
new file mode 100644
index 0000000000..5eeba6dcb7
--- /dev/null
+++ b/host/include/ppc64/host/crypto/aes-round.h
@@ -0,0 +1 @@
+#include "host/include/ppc/host/crypto/aes-round.h"
diff --git a/util/cpuinfo-ppc.c b/util/cpuinfo-ppc.c
index d95adc8ccd..7212afa45d 100644
--- a/util/cpuinfo-ppc.c
+++ b/util/cpuinfo-ppc.c
@@ -48,6 +48,14 @@ unsigned __attribute__((constructor)) cpuinfo_init(void)
         /* We only care about the portion of VSX that overlaps Altivec. */
         if (hwcap & PPC_FEATURE_HAS_VSX) {
             info |= CPUINFO_VSX;
+            /*
+             * We use VSX especially for little-endian, but we should
+             * always have both anyway, since VSX came with Power7
+             * and crypto came with Power8.
+             */
+            if (hwcap2 & PPC_FEATURE2_HAS_VEC_CRYPTO) {
+                info |= CPUINFO_CRYPTO;
+            }
         }
     }
 

From 7df34e48537294b436e056ec15ff6e0f9e449353 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 23:04:48 -0700
Subject: [PATCH 0513/1353] target/ppc: Use aesenc_SB_SR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the VCIPHERLAST instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/int_helper.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/target/ppc/int_helper.c b/target/ppc/int_helper.c
index d97a7f1f28..34257e9d76 100644
--- a/target/ppc/int_helper.c
+++ b/target/ppc/int_helper.c
@@ -25,6 +25,7 @@
 #include "qemu/log.h"
 #include "exec/helper-proto.h"
 #include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "fpu/softfloat.h"
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
@@ -2947,13 +2948,7 @@ void helper_vcipher(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 
 void helper_vcipherlast(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 {
-    ppc_avr_t result;
-    int i;
-
-    VECTOR_FOR_INORDER_I(i, u8) {
-        result.VsrB(i) = b->VsrB(i) ^ (AES_sbox[a->VsrB(AES_shifts[i])]);
-    }
-    *r = result;
+    aesenc_SB_SR_AK((AESState *)r, (AESState *)a, (AESState *)b, true);
 }
 
 void helper_vncipher(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)

From 2cf44f3b8c5106acf90edd7463b4d0dfd9441697 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 15:43:42 -0700
Subject: [PATCH 0514/1353] target/ppc: Use aesdec_ISB_ISR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the VNCIPHERLAST instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/int_helper.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/target/ppc/int_helper.c b/target/ppc/int_helper.c
index 34257e9d76..15f07fca2b 100644
--- a/target/ppc/int_helper.c
+++ b/target/ppc/int_helper.c
@@ -2973,13 +2973,7 @@ void helper_vncipher(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 
 void helper_vncipherlast(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 {
-    ppc_avr_t result;
-    int i;
-
-    VECTOR_FOR_INORDER_I(i, u8) {
-        result.VsrB(i) = b->VsrB(i) ^ (AES_isbox[a->VsrB(AES_ishifts[i])]);
-    }
-    *r = result;
+    aesdec_ISB_ISR_AK((AESState *)r, (AESState *)a, (AESState *)b, true);
 }
 
 void helper_vshasigmaw(ppc_avr_t *r,  ppc_avr_t *a, uint32_t st_six)

From ce9f5b371ddd82b51569a2c24216501182caaadf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 14:28:15 -0700
Subject: [PATCH 0515/1353] target/ppc: Use aesenc_SB_SR_MC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the VCIPHER instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/int_helper.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/target/ppc/int_helper.c b/target/ppc/int_helper.c
index 15f07fca2b..1e477924b7 100644
--- a/target/ppc/int_helper.c
+++ b/target/ppc/int_helper.c
@@ -2933,17 +2933,11 @@ void helper_vsbox(ppc_avr_t *r, ppc_avr_t *a)
 
 void helper_vcipher(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 {
-    ppc_avr_t result;
-    int i;
+    AESState *ad = (AESState *)r;
+    AESState *st = (AESState *)a;
+    AESState *rk = (AESState *)b;
 
-    VECTOR_FOR_INORDER_I(i, u32) {
-        result.VsrW(i) = b->VsrW(i) ^
-            (AES_Te0[a->VsrB(AES_shifts[4 * i + 0])] ^
-             AES_Te1[a->VsrB(AES_shifts[4 * i + 1])] ^
-             AES_Te2[a->VsrB(AES_shifts[4 * i + 2])] ^
-             AES_Te3[a->VsrB(AES_shifts[4 * i + 3])]);
-    }
-    *r = result;
+    aesenc_SB_SR_MC_AK(ad, st, rk, true);
 }
 
 void helper_vcipherlast(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)

From af4cb945555f68827eced7eb607c501fb2752bfc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 15:42:06 -0700
Subject: [PATCH 0516/1353] target/ppc: Use aesdec_ISB_ISR_AK_IMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the VNCIPHER instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/int_helper.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/target/ppc/int_helper.c b/target/ppc/int_helper.c
index 1e477924b7..834da80fe3 100644
--- a/target/ppc/int_helper.c
+++ b/target/ppc/int_helper.c
@@ -2947,22 +2947,11 @@ void helper_vcipherlast(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 
 void helper_vncipher(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)
 {
-    /* This differs from what is written in ISA V2.07.  The RTL is */
-    /* incorrect and will be fixed in V2.07B.                      */
-    int i;
-    ppc_avr_t tmp;
+    AESState *ad = (AESState *)r;
+    AESState *st = (AESState *)a;
+    AESState *rk = (AESState *)b;
 
-    VECTOR_FOR_INORDER_I(i, u8) {
-        tmp.VsrB(i) = b->VsrB(i) ^ AES_isbox[a->VsrB(AES_ishifts[i])];
-    }
-
-    VECTOR_FOR_INORDER_I(i, u32) {
-        r->VsrW(i) =
-            AES_imc[tmp.VsrB(4 * i + 0)][0] ^
-            AES_imc[tmp.VsrB(4 * i + 1)][1] ^
-            AES_imc[tmp.VsrB(4 * i + 2)][2] ^
-            AES_imc[tmp.VsrB(4 * i + 3)][3];
-    }
+    aesdec_ISB_ISR_AK_IMC(ad, st, rk, true);
 }
 
 void helper_vncipherlast(ppc_avr_t *r, ppc_avr_t *a, ppc_avr_t *b)

From cc648f5024f6b71277b72270e3242804dd3bd4a2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 22:20:12 -0700
Subject: [PATCH 0517/1353] target/i386: Use aesenc_SB_SR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESENCLAST instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/ops_sse.h | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index fb63af7afa..63fdecbe03 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -19,6 +19,7 @@
  */
 
 #include "crypto/aes.h"
+#include "crypto/aes-round.h"
 
 #if SHIFT == 0
 #define Reg MMXReg
@@ -2202,12 +2203,12 @@ void glue(helper_aesenc, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 
 void glue(helper_aesenclast, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 {
-    int i;
-    Reg st = *v;
-    Reg rk = *s;
+    for (int i = 0; i < SHIFT; i++) {
+        AESState *ad = (AESState *)&d->ZMM_X(i);
+        AESState *st = (AESState *)&v->ZMM_X(i);
+        AESState *rk = (AESState *)&s->ZMM_X(i);
 
-    for (i = 0; i < 8 << SHIFT; i++) {
-        d->B(i) = rk.B(i) ^ (AES_sbox[st.B(AES_shifts[i & 15] + (i & ~15))]);
+        aesenc_SB_SR_AK(ad, st, rk, false);
     }
 }
 

From 00b5c7bde930363db862beb70f60cd9787f18e75 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 01:12:36 -0700
Subject: [PATCH 0518/1353] target/i386: Use aesdec_ISB_ISR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESDECLAST instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/ops_sse.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index 63fdecbe03..0a37bde595 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -2177,12 +2177,12 @@ void glue(helper_aesdec, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 
 void glue(helper_aesdeclast, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 {
-    int i;
-    Reg st = *v;
-    Reg rk = *s;
+    for (int i = 0; i < SHIFT; i++) {
+        AESState *ad = (AESState *)&d->ZMM_X(i);
+        AESState *st = (AESState *)&v->ZMM_X(i);
+        AESState *rk = (AESState *)&s->ZMM_X(i);
 
-    for (i = 0; i < 8 << SHIFT; i++) {
-        d->B(i) = rk.B(i) ^ (AES_isbox[st.B(AES_ishifts[i & 15] + (i & ~15))]);
+        aesdec_ISB_ISR_AK(ad, st, rk, false);
     }
 }
 

From 5f40edb71e7da2d050c40766c9681dd0c672f92e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 02:05:37 -0700
Subject: [PATCH 0519/1353] target/i386: Use aesdec_IMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESIMC instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/ops_sse.h | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index 0a37bde595..893913ebf8 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -2215,15 +2215,10 @@ void glue(helper_aesenclast, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 #if SHIFT == 1
 void glue(helper_aesimc, SUFFIX)(CPUX86State *env, Reg *d, Reg *s)
 {
-    int i;
-    Reg tmp = *s;
+    AESState *ad = (AESState *)&d->ZMM_X(0);
+    AESState *st = (AESState *)&s->ZMM_X(0);
 
-    for (i = 0 ; i < 4 ; i++) {
-        d->L(i) = bswap32(AES_imc[tmp.B(4 * i + 0)][0] ^
-                          AES_imc[tmp.B(4 * i + 1)][1] ^
-                          AES_imc[tmp.B(4 * i + 2)][2] ^
-                          AES_imc[tmp.B(4 * i + 3)][3]);
-    }
+    aesdec_IMC(ad, st, false);
 }
 
 void glue(helper_aeskeygenassist, SUFFIX)(CPUX86State *env, Reg *d, Reg *s,

From 03cf414ec3c6bf016d1b5c73719b67ad614e07c5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 14:09:00 -0700
Subject: [PATCH 0520/1353] target/i386: Use aesenc_SB_SR_MC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESENC instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/ops_sse.h | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index 893913ebf8..93a4e0cf16 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -2188,16 +2188,12 @@ void glue(helper_aesdeclast, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 
 void glue(helper_aesenc, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 {
-    int i;
-    Reg st = *v;
-    Reg rk = *s;
+    for (int i = 0; i < SHIFT; i++) {
+        AESState *ad = (AESState *)&d->ZMM_X(i);
+        AESState *st = (AESState *)&v->ZMM_X(i);
+        AESState *rk = (AESState *)&s->ZMM_X(i);
 
-    for (i = 0 ; i < 2 << SHIFT ; i++) {
-        int j = i & 3;
-        d->L(i) = rk.L(i) ^ bswap32(AES_Te0[st.B(AES_shifts[4 * j + 0])] ^
-                                    AES_Te1[st.B(AES_shifts[4 * j + 1])] ^
-                                    AES_Te2[st.B(AES_shifts[4 * j + 2])] ^
-                                    AES_Te3[st.B(AES_shifts[4 * j + 3])]);
+        aesenc_SB_SR_MC_AK(ad, st, rk, false);
     }
 }
 

From 44a0c4a8ccb4c2d7688f4afd901620de6e3f2765 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 15:29:28 -0700
Subject: [PATCH 0521/1353] target/i386: Use aesdec_ISB_ISR_IMC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESDEC instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/ops_sse.h | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index 93a4e0cf16..a0e425733f 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -2162,16 +2162,12 @@ void glue(helper_pclmulqdq, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s,
 
 void glue(helper_aesdec, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 {
-    int i;
-    Reg st = *v;
-    Reg rk = *s;
+    for (int i = 0; i < SHIFT; i++) {
+        AESState *ad = (AESState *)&d->ZMM_X(i);
+        AESState *st = (AESState *)&v->ZMM_X(i);
+        AESState *rk = (AESState *)&s->ZMM_X(i);
 
-    for (i = 0 ; i < 2 << SHIFT ; i++) {
-        int j = i & 3;
-        d->L(i) = rk.L(i) ^ bswap32(AES_Td0[st.B(AES_ishifts[4 * j + 0])] ^
-                                    AES_Td1[st.B(AES_ishifts[4 * j + 1])] ^
-                                    AES_Td2[st.B(AES_ishifts[4 * j + 2])] ^
-                                    AES_Td3[st.B(AES_ishifts[4 * j + 3])]);
+        aesdec_ISB_ISR_IMC_AK(ad, st, rk, false);
     }
 }
 

From 0f23908c5c9809f59ebe23e7ec49b5c774bc3ab5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 22:42:43 -0700
Subject: [PATCH 0522/1353] target/arm: Demultiplex AESE and AESMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split these helpers so that we are not passing 'decrypt'
within the simd descriptor.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.h             |  2 ++
 target/arm/tcg/crypto_helper.c  | 37 +++++++++++++++++++++++----------
 target/arm/tcg/sve.decode       |  4 ++--
 target/arm/tcg/translate-a64.c  | 13 ++++--------
 target/arm/tcg/translate-neon.c |  4 ++--
 target/arm/tcg/translate-sve.c  |  8 ++++---
 6 files changed, 41 insertions(+), 27 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index 3335c2b10b..95e32a697a 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -552,7 +552,9 @@ DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
 
 DEF_HELPER_FLAGS_4(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(crypto_aesd, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_aesimc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_4(crypto_sha1su0, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(crypto_sha1c, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index 06254939d2..75882d9ea3 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -45,11 +45,9 @@ static void clear_tail_16(void *vd, uint32_t desc)
     clear_tail(vd, opr_sz, max_sz);
 }
 
-static void do_crypto_aese(uint64_t *rd, uint64_t *rn,
-                           uint64_t *rm, bool decrypt)
+static void do_crypto_aese(uint64_t *rd, uint64_t *rn, uint64_t *rm,
+                           const uint8_t *sbox, const uint8_t *shift)
 {
-    static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
-    static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
     union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
     union CRYPTO_STATE st = { .l = { rn[0], rn[1] } };
     int i;
@@ -60,7 +58,7 @@ static void do_crypto_aese(uint64_t *rd, uint64_t *rn,
 
     /* combine ShiftRows operation and sbox substitution */
     for (i = 0; i < 16; i++) {
-        CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
+        CR_ST_BYTE(st, i) = sbox[CR_ST_BYTE(rk, shift[i])];
     }
 
     rd[0] = st.l[0];
@@ -70,18 +68,26 @@ static void do_crypto_aese(uint64_t *rd, uint64_t *rn,
 void HELPER(crypto_aese)(void *vd, void *vn, void *vm, uint32_t desc)
 {
     intptr_t i, opr_sz = simd_oprsz(desc);
-    bool decrypt = simd_data(desc);
 
     for (i = 0; i < opr_sz; i += 16) {
-        do_crypto_aese(vd + i, vn + i, vm + i, decrypt);
+        do_crypto_aese(vd + i, vn + i, vm + i, AES_sbox, AES_shifts);
     }
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }
 
-static void do_crypto_aesmc(uint64_t *rd, uint64_t *rm, bool decrypt)
+void HELPER(crypto_aesd)(void *vd, void *vn, void *vm, uint32_t desc)
+{
+    intptr_t i, opr_sz = simd_oprsz(desc);
+
+    for (i = 0; i < opr_sz; i += 16) {
+        do_crypto_aese(vd + i, vn + i, vm + i, AES_isbox, AES_ishifts);
+    }
+    clear_tail(vd, opr_sz, simd_maxsz(desc));
+}
+
+static void do_crypto_aesmc(uint64_t *rd, uint64_t *rm, const uint32_t *mc)
 {
     union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
-    const uint32_t *mc = decrypt ? AES_imc_rot : AES_mc_rot;
     int i;
 
     for (i = 0; i < 16; i += 4) {
@@ -99,10 +105,19 @@ static void do_crypto_aesmc(uint64_t *rd, uint64_t *rm, bool decrypt)
 void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t desc)
 {
     intptr_t i, opr_sz = simd_oprsz(desc);
-    bool decrypt = simd_data(desc);
 
     for (i = 0; i < opr_sz; i += 16) {
-        do_crypto_aesmc(vd + i, vm + i, decrypt);
+        do_crypto_aesmc(vd + i, vm + i, AES_mc_rot);
+    }
+    clear_tail(vd, opr_sz, simd_maxsz(desc));
+}
+
+void HELPER(crypto_aesimc)(void *vd, void *vm, uint32_t desc)
+{
+    intptr_t i, opr_sz = simd_oprsz(desc);
+
+    for (i = 0; i < opr_sz; i += 16) {
+        do_crypto_aesmc(vd + i, vm + i, AES_imc_rot);
     }
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }
diff --git a/target/arm/tcg/sve.decode b/target/arm/tcg/sve.decode
index 14b3a69c36..04b6fcc0cf 100644
--- a/target/arm/tcg/sve.decode
+++ b/target/arm/tcg/sve.decode
@@ -1629,8 +1629,8 @@ STNT1_zprz      1110010 .. 10 ..... 001 ... ..... ..... \
 ### SVE2 Crypto Extensions
 
 # SVE2 crypto unary operations
-# AESMC and AESIMC
-AESMC           01000101 00 10000011100 decrypt:1 00000 rd:5
+AESMC           01000101 00 10000011100 0 00000 rd:5
+AESIMC          01000101 00 10000011100 1 00000 rd:5
 
 # SVE2 crypto destructive binary operations
 AESE            01000101 00 10001 0 11100 0 ..... .....  @rdn_rm_e0
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 3baab6aa60..7d0c8f79a7 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -13210,7 +13210,6 @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
     int opcode = extract32(insn, 12, 5);
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
-    int decrypt;
     gen_helper_gvec_2 *genfn2 = NULL;
     gen_helper_gvec_3 *genfn3 = NULL;
 
@@ -13221,20 +13220,16 @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
 
     switch (opcode) {
     case 0x4: /* AESE */
-        decrypt = 0;
         genfn3 = gen_helper_crypto_aese;
         break;
     case 0x6: /* AESMC */
-        decrypt = 0;
         genfn2 = gen_helper_crypto_aesmc;
         break;
     case 0x5: /* AESD */
-        decrypt = 1;
-        genfn3 = gen_helper_crypto_aese;
+        genfn3 = gen_helper_crypto_aesd;
         break;
     case 0x7: /* AESIMC */
-        decrypt = 1;
-        genfn2 = gen_helper_crypto_aesmc;
+        genfn2 = gen_helper_crypto_aesimc;
         break;
     default:
         unallocated_encoding(s);
@@ -13245,9 +13240,9 @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
         return;
     }
     if (genfn2) {
-        gen_gvec_op2_ool(s, true, rd, rn, decrypt, genfn2);
+        gen_gvec_op2_ool(s, true, rd, rn, 0, genfn2);
     } else {
-        gen_gvec_op3_ool(s, true, rd, rd, rn, decrypt, genfn3);
+        gen_gvec_op3_ool(s, true, rd, rd, rn, 0, genfn3);
     }
 }
 
diff --git a/target/arm/tcg/translate-neon.c b/target/arm/tcg/translate-neon.c
index 03913de047..8de4ceb203 100644
--- a/target/arm/tcg/translate-neon.c
+++ b/target/arm/tcg/translate-neon.c
@@ -3451,9 +3451,9 @@ static bool trans_VMVN(DisasContext *s, arg_2misc *a)
     }
 
 WRAP_2M_3_OOL_FN(gen_AESE, gen_helper_crypto_aese, 0)
-WRAP_2M_3_OOL_FN(gen_AESD, gen_helper_crypto_aese, 1)
+WRAP_2M_3_OOL_FN(gen_AESD, gen_helper_crypto_aesd, 0)
 WRAP_2M_2_OOL_FN(gen_AESMC, gen_helper_crypto_aesmc, 0)
-WRAP_2M_2_OOL_FN(gen_AESIMC, gen_helper_crypto_aesmc, 1)
+WRAP_2M_2_OOL_FN(gen_AESIMC, gen_helper_crypto_aesimc, 0)
 WRAP_2M_2_OOL_FN(gen_SHA1H, gen_helper_crypto_sha1h, 0)
 WRAP_2M_2_OOL_FN(gen_SHA1SU1, gen_helper_crypto_sha1su1, 0)
 WRAP_2M_2_OOL_FN(gen_SHA256SU0, gen_helper_crypto_sha256su0, 0)
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 225d358922..8350a65f31 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -7151,12 +7151,14 @@ TRANS_FEAT(USDOT_zzzz, aa64_sve_i8mm, gen_gvec_ool_arg_zzzz,
            a->esz == 2 ? gen_helper_gvec_usdot_b : NULL, a, 0)
 
 TRANS_FEAT_NONSTREAMING(AESMC, aa64_sve2_aes, gen_gvec_ool_zz,
-                        gen_helper_crypto_aesmc, a->rd, a->rd, a->decrypt)
+                        gen_helper_crypto_aesmc, a->rd, a->rd, 0)
+TRANS_FEAT_NONSTREAMING(AESIMC, aa64_sve2_aes, gen_gvec_ool_zz,
+                        gen_helper_crypto_aesimc, a->rd, a->rd, 0)
 
 TRANS_FEAT_NONSTREAMING(AESE, aa64_sve2_aes, gen_gvec_ool_arg_zzz,
-                        gen_helper_crypto_aese, a, false)
+                        gen_helper_crypto_aese, a, 0)
 TRANS_FEAT_NONSTREAMING(AESD, aa64_sve2_aes, gen_gvec_ool_arg_zzz,
-                        gen_helper_crypto_aese, a, true)
+                        gen_helper_crypto_aesd, a, 0)
 
 TRANS_FEAT_NONSTREAMING(SM4E, aa64_sve2_sm4, gen_gvec_ool_arg_zzz,
                         gen_helper_crypto_sm4e, a, 0)

From e0ddf8eac9f83c0bc5a3d39605d873ee0fe53421 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 8 Jul 2023 07:00:25 +0200
Subject: [PATCH 0523/1353] linux-user: Fix fcntl() and fcntl64() to return
 O_LARGEFILE for 32-bit targets

When running a 32-bit guest on a 64-bit host, fcntl[64](F_GETFL) should
return with the TARGET_O_LARGEFILE flag set, because all 64-bit hosts
support large files unconditionally.

But on 64-bit hosts, O_LARGEFILE has the value 0, so the flag
translation can't be done with the fcntl_flags_tbl[]. Instead add the
TARGET_O_LARGEFILE flag afterwards.

Note that for 64-bit guests the compiler will optimize away this code,
since TARGET_O_LARGEFILE is zero.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 08162cc966..10f05b1e55 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -7132,6 +7132,10 @@ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
         if (ret >= 0) {
             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
+            /* tell 32-bit guests it uses largefile on 64-bit hosts: */
+            if (O_LARGEFILE == 0 && HOST_LONG_BITS == 64) {
+                ret |= TARGET_O_LARGEFILE;
+            }
         }
         break;
 

From dca4c8384d68bbf5d67f50a5446865d92d61f032 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 8 Jul 2023 07:24:00 +0200
Subject: [PATCH 0524/1353] linux-user: Fix accept4(SOCK_NONBLOCK) syscall

The Linux accept4() syscall allows two flags only: SOCK_NONBLOCK and
SOCK_CLOEXEC, and returns -EINVAL if any other bits have been set.

Change the qemu implementation accordingly, which means we can not use
the fcntl_flags_tbl[] translation table which allows too many other
values.

Beside the correction in behaviour, this actually fixes the accept4()
emulation for hppa, mips and alpha targets for which SOCK_NONBLOCK is
different than TARGET_SOCK_NONBLOCK (aka O_NONBLOCK).

The fix can be verified with the testcase of the debian lwt package,
which hangs forever in a read() syscall without this patch.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 10f05b1e55..9b9e3bd5e3 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3440,7 +3440,17 @@ static abi_long do_accept4(int fd, abi_ulong target_addr,
     abi_long ret;
     int host_flags;
 
-    host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
+    if (flags & ~(TARGET_SOCK_CLOEXEC | TARGET_SOCK_NONBLOCK)) {
+        return -TARGET_EINVAL;
+    }
+
+    host_flags = 0;
+    if (flags & TARGET_SOCK_NONBLOCK) {
+        host_flags |= SOCK_NONBLOCK;
+    }
+    if (flags & TARGET_SOCK_CLOEXEC) {
+        host_flags |= SOCK_CLOEXEC;
+    }
 
     if (target_addr == 0) {
         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));

From 036cf169a3484eeca5e17cfbee1f6988043ddd0e Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sun, 12 Mar 2023 23:17:13 +0100
Subject: [PATCH 0525/1353] linux-user: Improve strace output of pread64() and
 pwrite64()

Make the strace look nicer for those two syscalls.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/strace.c    | 19 +++++++++++++++++++
 linux-user/strace.list |  4 ++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index aad2b62ca4..669200c4a4 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -3999,6 +3999,25 @@ print_tgkill(CPUArchState *cpu_env, const struct syscallname *name,
 }
 #endif
 
+#if defined(TARGET_NR_pread64) || defined(TARGET_NR_pwrite64)
+static void
+print_pread64(CPUArchState *cpu_env, const struct syscallname *name,
+        abi_long arg0, abi_long arg1, abi_long arg2,
+        abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    if (regpairs_aligned(cpu_env, TARGET_NR_pread64)) {
+        arg3 = arg4;
+        arg4 = arg5;
+    }
+    print_syscall_prologue(name);
+    print_raw_param("%d", arg0, 0);
+    print_pointer(arg1, 0);
+    print_raw_param("%d", arg2, 0);
+    print_raw_param("%" PRIu64, target_offset64(arg3, arg4), 1);
+    print_syscall_epilogue(name);
+}
+#endif
+
 #ifdef TARGET_NR_statx
 static void
 print_statx(CPUArchState *cpu_env, const struct syscallname *name,
diff --git a/linux-user/strace.list b/linux-user/strace.list
index c7808ea118..6655d4f26d 100644
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -1068,7 +1068,7 @@
 { TARGET_NR_prctl, "prctl" , NULL, NULL, NULL },
 #endif
 #ifdef TARGET_NR_pread64
-{ TARGET_NR_pread64, "pread64" , NULL, NULL, NULL },
+{ TARGET_NR_pread64, "pread64" , NULL, print_pread64, NULL },
 #endif
 #ifdef TARGET_NR_preadv
 { TARGET_NR_preadv, "preadv" , NULL, NULL, NULL },
@@ -1099,7 +1099,7 @@
 { TARGET_NR_putpmsg, "putpmsg" , NULL, NULL, NULL },
 #endif
 #ifdef TARGET_NR_pwrite64
-{ TARGET_NR_pwrite64, "pwrite64" , NULL, NULL, NULL },
+{ TARGET_NR_pwrite64, "pwrite64" , NULL, print_pread64, NULL },
 #endif
 #ifdef TARGET_NR_pwritev
 { TARGET_NR_pwritev, "pwritev" , NULL, NULL, NULL },

From 552d892494d36d37451dc7538daae03060011b8b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 22:50:47 -0700
Subject: [PATCH 0526/1353] target/arm: Use aesenc_SB_SR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESE instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/crypto_helper.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index 75882d9ea3..00f3b21507 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -15,6 +15,7 @@
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 #include "vec_internal.h"
 
@@ -45,6 +46,8 @@ static void clear_tail_16(void *vd, uint32_t desc)
     clear_tail(vd, opr_sz, max_sz);
 }
 
+static const AESState aes_zero = { };
+
 static void do_crypto_aese(uint64_t *rd, uint64_t *rn, uint64_t *rm,
                            const uint8_t *sbox, const uint8_t *shift)
 {
@@ -70,7 +73,26 @@ void HELPER(crypto_aese)(void *vd, void *vn, void *vm, uint32_t desc)
     intptr_t i, opr_sz = simd_oprsz(desc);
 
     for (i = 0; i < opr_sz; i += 16) {
-        do_crypto_aese(vd + i, vn + i, vm + i, AES_sbox, AES_shifts);
+        AESState *ad = (AESState *)(vd + i);
+        AESState *st = (AESState *)(vn + i);
+        AESState *rk = (AESState *)(vm + i);
+        AESState t;
+
+        /*
+         * Our uint64_t are in the wrong order for big-endian.
+         * The Arm AddRoundKey comes first, while the API AddRoundKey
+         * comes last: perform the xor here, and provide zero to API.
+         */
+        if (HOST_BIG_ENDIAN) {
+            t.d[0] = st->d[1] ^ rk->d[1];
+            t.d[1] = st->d[0] ^ rk->d[0];
+            aesenc_SB_SR_AK(&t, &t, &aes_zero, false);
+            ad->d[0] = t.d[1];
+            ad->d[1] = t.d[0];
+        } else {
+            t.v = st->v ^ rk->v;
+            aesenc_SB_SR_AK(ad, &t, &aes_zero, false);
+        }
     }
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }

From 2a8b545ffdb08fb2d5f37cbcc84d19629c419b3b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 01:15:31 -0700
Subject: [PATCH 0527/1353] target/arm: Use aesdec_ISB_ISR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESD instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/crypto_helper.c | 37 +++++++++++++++-------------------
 1 file changed, 16 insertions(+), 21 deletions(-)

diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index 00f3b21507..d2cb74e7fc 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -48,26 +48,6 @@ static void clear_tail_16(void *vd, uint32_t desc)
 
 static const AESState aes_zero = { };
 
-static void do_crypto_aese(uint64_t *rd, uint64_t *rn, uint64_t *rm,
-                           const uint8_t *sbox, const uint8_t *shift)
-{
-    union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
-    union CRYPTO_STATE st = { .l = { rn[0], rn[1] } };
-    int i;
-
-    /* xor state vector with round key */
-    rk.l[0] ^= st.l[0];
-    rk.l[1] ^= st.l[1];
-
-    /* combine ShiftRows operation and sbox substitution */
-    for (i = 0; i < 16; i++) {
-        CR_ST_BYTE(st, i) = sbox[CR_ST_BYTE(rk, shift[i])];
-    }
-
-    rd[0] = st.l[0];
-    rd[1] = st.l[1];
-}
-
 void HELPER(crypto_aese)(void *vd, void *vn, void *vm, uint32_t desc)
 {
     intptr_t i, opr_sz = simd_oprsz(desc);
@@ -102,7 +82,22 @@ void HELPER(crypto_aesd)(void *vd, void *vn, void *vm, uint32_t desc)
     intptr_t i, opr_sz = simd_oprsz(desc);
 
     for (i = 0; i < opr_sz; i += 16) {
-        do_crypto_aese(vd + i, vn + i, vm + i, AES_isbox, AES_ishifts);
+        AESState *ad = (AESState *)(vd + i);
+        AESState *st = (AESState *)(vn + i);
+        AESState *rk = (AESState *)(vm + i);
+        AESState t;
+
+        /* Our uint64_t are in the wrong order for big-endian. */
+        if (HOST_BIG_ENDIAN) {
+            t.d[0] = st->d[1] ^ rk->d[1];
+            t.d[1] = st->d[0] ^ rk->d[0];
+            aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false);
+            ad->d[0] = t.d[1];
+            ad->d[1] = t.d[0];
+        } else {
+            t.v = st->v ^ rk->v;
+            aesdec_ISB_ISR_AK(ad, &t, &aes_zero, false);
+        }
     }
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }

From 8b103ed70e74baab2803a46ca1ccf52853eadf68 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 01:52:09 -0700
Subject: [PATCH 0528/1353] target/arm: Use aesenc_MC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESMC instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/crypto_helper.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index d2cb74e7fc..1952aaac58 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -124,7 +124,20 @@ void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t desc)
     intptr_t i, opr_sz = simd_oprsz(desc);
 
     for (i = 0; i < opr_sz; i += 16) {
-        do_crypto_aesmc(vd + i, vm + i, AES_mc_rot);
+        AESState *ad = (AESState *)(vd + i);
+        AESState *st = (AESState *)(vm + i);
+        AESState t;
+
+        /* Our uint64_t are in the wrong order for big-endian. */
+        if (HOST_BIG_ENDIAN) {
+            t.d[0] = st->d[1];
+            t.d[1] = st->d[0];
+            aesenc_MC(&t, &t, false);
+            ad->d[0] = t.d[1];
+            ad->d[1] = t.d[0];
+        } else {
+            aesenc_MC(ad, st, false);
+        }
     }
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }

From bdb01515ed9b3e3b3359298242127924cdb7c702 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 02:07:44 -0700
Subject: [PATCH 0529/1353] target/arm: Use aesdec_IMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AESIMC instruction.  We have converted everything
to crypto/aes-round.h; crypto/aes.h is no longer needed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/crypto_helper.c | 33 ++++++++++++++-------------------
 1 file changed, 14 insertions(+), 19 deletions(-)

diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index 1952aaac58..fdd70abbfd 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -14,7 +14,6 @@
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
-#include "crypto/aes.h"
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 #include "vec_internal.h"
@@ -102,23 +101,6 @@ void HELPER(crypto_aesd)(void *vd, void *vn, void *vm, uint32_t desc)
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }
 
-static void do_crypto_aesmc(uint64_t *rd, uint64_t *rm, const uint32_t *mc)
-{
-    union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
-    int i;
-
-    for (i = 0; i < 16; i += 4) {
-        CR_ST_WORD(st, i >> 2) =
-            mc[CR_ST_BYTE(st, i)] ^
-            rol32(mc[CR_ST_BYTE(st, i + 1)], 8) ^
-            rol32(mc[CR_ST_BYTE(st, i + 2)], 16) ^
-            rol32(mc[CR_ST_BYTE(st, i + 3)], 24);
-    }
-
-    rd[0] = st.l[0];
-    rd[1] = st.l[1];
-}
-
 void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t desc)
 {
     intptr_t i, opr_sz = simd_oprsz(desc);
@@ -147,7 +129,20 @@ void HELPER(crypto_aesimc)(void *vd, void *vm, uint32_t desc)
     intptr_t i, opr_sz = simd_oprsz(desc);
 
     for (i = 0; i < opr_sz; i += 16) {
-        do_crypto_aesmc(vd + i, vm + i, AES_imc_rot);
+        AESState *ad = (AESState *)(vd + i);
+        AESState *st = (AESState *)(vm + i);
+        AESState t;
+
+        /* Our uint64_t are in the wrong order for big-endian. */
+        if (HOST_BIG_ENDIAN) {
+            t.d[0] = st->d[1];
+            t.d[1] = st->d[0];
+            aesdec_IMC(&t, &t, false);
+            ad->d[0] = t.d[1];
+            ad->d[1] = t.d[0];
+        } else {
+            aesdec_IMC(ad, st, false);
+        }
     }
     clear_tail(vd, opr_sz, simd_maxsz(desc));
 }

From cad26538e8579bb7f4bc6374e4b4155151bc2598 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 1 Jun 2023 23:22:20 -0700
Subject: [PATCH 0530/1353] target/riscv: Use aesenc_SB_SR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AES64ES instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/crypto_helper.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index 2ef30281b1..b072fed3e2 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -22,6 +22,7 @@
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 #include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 
 #define AES_XTIME(a) \
@@ -136,6 +137,8 @@ target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
     AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \
     AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0)
 
+static const AESState aes_zero = { };
+
 static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2,
                                            bool enc, bool mix)
 {
@@ -200,7 +203,12 @@ target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
 
 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
 {
-    return aes64_operation(rs1, rs2, true, false);
+    AESState t;
+
+    t.d[HOST_BIG_ENDIAN] = rs1;
+    t.d[!HOST_BIG_ENDIAN] = rs2;
+    aesenc_SB_SR_AK(&t, &t, &aes_zero, false);
+    return t.d[HOST_BIG_ENDIAN];
 }
 
 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)

From 7a70583a4109a177468beab378177b2285344b7a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 01:33:15 -0700
Subject: [PATCH 0531/1353] target/riscv: Use aesdec_ISB_ISR_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AES64DS instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/crypto_helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index b072fed3e2..e61f7fe1e5 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -213,7 +213,12 @@ target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
 
 target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
 {
-    return aes64_operation(rs1, rs2, false, false);
+    AESState t;
+
+    t.d[HOST_BIG_ENDIAN] = rs1;
+    t.d[!HOST_BIG_ENDIAN] = rs2;
+    aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false);
+    return t.d[HOST_BIG_ENDIAN];
 }
 
 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)

From 607a5f9d624fdd63d0b7f0e640f7a8d21213b8df Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 02:29:40 -0700
Subject: [PATCH 0532/1353] target/riscv: Use aesdec_IMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AES64IM instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/crypto_helper.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index e61f7fe1e5..505166ce5a 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -272,17 +272,12 @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 
 target_ulong HELPER(aes64im)(target_ulong rs1)
 {
-    uint64_t RS1 = rs1;
-    uint32_t col_0 = RS1 & 0xFFFFFFFF;
-    uint32_t col_1 = RS1 >> 32;
-    target_ulong result;
+    AESState t;
 
-    col_0 = AES_INVMIXCOLUMN(col_0);
-    col_1 = AES_INVMIXCOLUMN(col_1);
-
-    result = ((uint64_t)col_1 << 32) | col_0;
-
-    return result;
+    t.d[HOST_BIG_ENDIAN] = rs1;
+    t.d[!HOST_BIG_ENDIAN] = 0;
+    aesdec_IMC(&t, &t, false);
+    return t.d[HOST_BIG_ENDIAN];
 }
 
 target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2,

From 274f33765af36b5c7447adec18b61125f05b7b83 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 14:14:04 -0700
Subject: [PATCH 0533/1353] target/riscv: Use aesenc_SB_SR_MC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AES64ESM instruction.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/crypto_helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index 505166ce5a..c036fe8632 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -198,7 +198,12 @@ static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2,
 
 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
 {
-    return aes64_operation(rs1, rs2, true, true);
+    AESState t;
+
+    t.d[HOST_BIG_ENDIAN] = rs1;
+    t.d[!HOST_BIG_ENDIAN] = rs2;
+    aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false);
+    return t.d[HOST_BIG_ENDIAN];
 }
 
 target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)

From 4ad6f9bfa0757934078c00994c6ade3fb944b124 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 2 Jun 2023 15:31:24 -0700
Subject: [PATCH 0534/1353] target/riscv: Use aesdec_ISB_ISR_IMC_AK
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This implements the AES64DSM instruction.  This was the last use
of aes64_operation and its support macros, so remove them all.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/crypto_helper.c | 101 ++++-------------------------------
 1 file changed, 10 insertions(+), 91 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index c036fe8632..99d85a6188 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -104,98 +104,8 @@ target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
     return aes32_operation(shamt, rs1, rs2, false, false);
 }
 
-#define BY(X, I) ((X >> (8 * I)) & 0xFF)
-
-#define AES_SHIFROWS_LO(RS1, RS2) ( \
-    (((RS1 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \
-    (((RS2 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \
-    (((RS2 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \
-    (((RS1 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0))
-
-#define AES_INVSHIFROWS_LO(RS1, RS2) ( \
-    (((RS2 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \
-    (((RS1 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \
-    (((RS1 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \
-    (((RS2 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0))
-
-#define AES_MIXBYTE(COL, B0, B1, B2, B3) ( \
-    BY(COL, B3) ^ BY(COL, B2) ^ AES_GFMUL(BY(COL, B1), 3) ^ \
-    AES_GFMUL(BY(COL, B0), 2))
-
-#define AES_MIXCOLUMN(COL) ( \
-    AES_MIXBYTE(COL, 3, 0, 1, 2) << 24 | \
-    AES_MIXBYTE(COL, 2, 3, 0, 1) << 16 | \
-    AES_MIXBYTE(COL, 1, 2, 3, 0) << 8 | AES_MIXBYTE(COL, 0, 1, 2, 3) << 0)
-
-#define AES_INVMIXBYTE(COL, B0, B1, B2, B3) ( \
-    AES_GFMUL(BY(COL, B3), 0x9) ^ AES_GFMUL(BY(COL, B2), 0xd) ^ \
-    AES_GFMUL(BY(COL, B1), 0xb) ^ AES_GFMUL(BY(COL, B0), 0xe))
-
-#define AES_INVMIXCOLUMN(COL) ( \
-    AES_INVMIXBYTE(COL, 3, 0, 1, 2) << 24 | \
-    AES_INVMIXBYTE(COL, 2, 3, 0, 1) << 16 | \
-    AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \
-    AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0)
-
 static const AESState aes_zero = { };
 
-static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2,
-                                           bool enc, bool mix)
-{
-    uint64_t RS1 = rs1;
-    uint64_t RS2 = rs2;
-    uint64_t result;
-    uint64_t temp;
-    uint32_t col_0;
-    uint32_t col_1;
-
-    if (enc) {
-        temp = AES_SHIFROWS_LO(RS1, RS2);
-        temp = (((uint64_t)AES_sbox[(temp >> 0) & 0xFF] << 0) |
-                ((uint64_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-                ((uint64_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-                ((uint64_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-                ((uint64_t)AES_sbox[(temp >> 32) & 0xFF] << 32) |
-                ((uint64_t)AES_sbox[(temp >> 40) & 0xFF] << 40) |
-                ((uint64_t)AES_sbox[(temp >> 48) & 0xFF] << 48) |
-                ((uint64_t)AES_sbox[(temp >> 56) & 0xFF] << 56));
-        if (mix) {
-            col_0 = temp & 0xFFFFFFFF;
-            col_1 = temp >> 32;
-
-            col_0 = AES_MIXCOLUMN(col_0);
-            col_1 = AES_MIXCOLUMN(col_1);
-
-            result = ((uint64_t)col_1 << 32) | col_0;
-        } else {
-            result = temp;
-        }
-    } else {
-        temp = AES_INVSHIFROWS_LO(RS1, RS2);
-        temp = (((uint64_t)AES_isbox[(temp >> 0) & 0xFF] << 0) |
-                ((uint64_t)AES_isbox[(temp >> 8) & 0xFF] << 8) |
-                ((uint64_t)AES_isbox[(temp >> 16) & 0xFF] << 16) |
-                ((uint64_t)AES_isbox[(temp >> 24) & 0xFF] << 24) |
-                ((uint64_t)AES_isbox[(temp >> 32) & 0xFF] << 32) |
-                ((uint64_t)AES_isbox[(temp >> 40) & 0xFF] << 40) |
-                ((uint64_t)AES_isbox[(temp >> 48) & 0xFF] << 48) |
-                ((uint64_t)AES_isbox[(temp >> 56) & 0xFF] << 56));
-        if (mix) {
-            col_0 = temp & 0xFFFFFFFF;
-            col_1 = temp >> 32;
-
-            col_0 = AES_INVMIXCOLUMN(col_0);
-            col_1 = AES_INVMIXCOLUMN(col_1);
-
-            result = ((uint64_t)col_1 << 32) | col_0;
-        } else {
-            result = temp;
-        }
-    }
-
-    return result;
-}
-
 target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
 {
     AESState t;
@@ -228,7 +138,16 @@ target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
 
 target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)
 {
-    return aes64_operation(rs1, rs2, false, true);
+    AESState t, z = { };
+
+    /*
+     * This instruction does not include a round key,
+     * so supply a zero to our primitive.
+     */
+    t.d[HOST_BIG_ENDIAN] = rs1;
+    t.d[!HOST_BIG_ENDIAN] = rs2;
+    aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false);
+    return t.d[HOST_BIG_ENDIAN];
 }
 
 target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2)

From 66d940e9e7a8b2f5745724f2caa9b675affe1757 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 01:14:22 +0000
Subject: [PATCH 0535/1353] crypto: Remove AES_shifts, AES_ishifts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These arrays are no longer used, replaced by AES_SH_*, AES_ISH_*.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c         | 14 --------------
 include/crypto/aes.h |  4 ----
 2 files changed, 18 deletions(-)

diff --git a/crypto/aes.c b/crypto/aes.c
index c765f11c1e..00e16d3f92 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -114,23 +114,9 @@ const uint8_t AES_isbox[256] = {
 /* AES ShiftRows, for complete unrolling. */
 #define AES_SH(X)   (((X) * 5) & 15)
 
-const uint8_t AES_shifts[16] = {
-    AES_SH(0x0), AES_SH(0x1), AES_SH(0x2), AES_SH(0x3),
-    AES_SH(0x4), AES_SH(0x5), AES_SH(0x6), AES_SH(0x7),
-    AES_SH(0x8), AES_SH(0x9), AES_SH(0xA), AES_SH(0xB),
-    AES_SH(0xC), AES_SH(0xD), AES_SH(0xE), AES_SH(0xF),
-};
-
 /* AES InvShiftRows, for complete unrolling. */
 #define AES_ISH(X)  (((X) * 13) & 15)
 
-const uint8_t AES_ishifts[16] = {
-    AES_ISH(0x0), AES_ISH(0x1), AES_ISH(0x2), AES_ISH(0x3),
-    AES_ISH(0x4), AES_ISH(0x5), AES_ISH(0x6), AES_ISH(0x7),
-    AES_ISH(0x8), AES_ISH(0x9), AES_ISH(0xA), AES_ISH(0xB),
-    AES_ISH(0xC), AES_ISH(0xD), AES_ISH(0xE), AES_ISH(0xF),
-};
-
 /*
  * MixColumns lookup table, for use with rot32.
  */
diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index 24b073d569..aa8b54065d 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -30,10 +30,6 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
-/* AES ShiftRows and InvShiftRows */
-extern const uint8_t AES_shifts[16];
-extern const uint8_t AES_ishifts[16];
-
 /* AES MixColumns, for use with rot32. */
 extern const uint32_t AES_mc_rot[256];
 

From c10c559bdf31cac58e77b81ac69d579ee92a8c06 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 01:26:20 +0000
Subject: [PATCH 0536/1353] crypto: Implement aesdec_IMC with AES_imc_rot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This method uses one uint32_t * 256 table instead of 4,
which means its data cache overhead is less.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/crypto/aes.c b/crypto/aes.c
index 00e16d3f92..d93883eb18 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -1377,39 +1377,39 @@ aesdec_IMC_swap(AESState *r, const AESState *st, bool swap)
     bool be = HOST_BIG_ENDIAN ^ swap;
     uint32_t t;
 
-    /* Note that AES_imc is encoded for big-endian. */
-    t = (AES_imc[st->b[swap_b ^ 0x0]][0] ^
-         AES_imc[st->b[swap_b ^ 0x1]][1] ^
-         AES_imc[st->b[swap_b ^ 0x2]][2] ^
-         AES_imc[st->b[swap_b ^ 0x3]][3]);
-    if (!be) {
+    /* Note that AES_imc_rot is encoded for little-endian. */
+    t = (      AES_imc_rot[st->b[swap_b ^ 0x0]] ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x1]], 8) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x2]], 16) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x3]], 24));
+    if (be) {
         t = bswap32(t);
     }
     r->w[swap_w ^ 0] = t;
 
-    t = (AES_imc[st->b[swap_b ^ 0x4]][0] ^
-         AES_imc[st->b[swap_b ^ 0x5]][1] ^
-         AES_imc[st->b[swap_b ^ 0x6]][2] ^
-         AES_imc[st->b[swap_b ^ 0x7]][3]);
-    if (!be) {
+    t = (      AES_imc_rot[st->b[swap_b ^ 0x4]] ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x5]], 8) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x6]], 16) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x7]], 24));
+    if (be) {
         t = bswap32(t);
     }
     r->w[swap_w ^ 1] = t;
 
-    t = (AES_imc[st->b[swap_b ^ 0x8]][0] ^
-         AES_imc[st->b[swap_b ^ 0x9]][1] ^
-         AES_imc[st->b[swap_b ^ 0xA]][2] ^
-         AES_imc[st->b[swap_b ^ 0xB]][3]);
-    if (!be) {
+    t = (      AES_imc_rot[st->b[swap_b ^ 0x8]] ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0x9]], 8) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0xA]], 16) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0xB]], 24));
+    if (be) {
         t = bswap32(t);
     }
     r->w[swap_w ^ 2] = t;
 
-    t = (AES_imc[st->b[swap_b ^ 0xC]][0] ^
-         AES_imc[st->b[swap_b ^ 0xD]][1] ^
-         AES_imc[st->b[swap_b ^ 0xE]][2] ^
-         AES_imc[st->b[swap_b ^ 0xF]][3]);
-    if (!be) {
+    t = (      AES_imc_rot[st->b[swap_b ^ 0xC]] ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0xD]], 8) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0xE]], 16) ^
+         rol32(AES_imc_rot[st->b[swap_b ^ 0xF]], 24));
+    if (be) {
         t = bswap32(t);
     }
     r->w[swap_w ^ 3] = t;

From 105453544a3b1e7b0f5af23ebeaf2a5cee7a5c34 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 01:30:12 +0000
Subject: [PATCH 0537/1353] crypto: Remove AES_imc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This array is no longer used.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c         | 264 -------------------------------------------
 include/crypto/aes.h |   7 --
 2 files changed, 271 deletions(-)

diff --git a/crypto/aes.c b/crypto/aes.c
index d93883eb18..685efbd583 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -257,270 +257,6 @@ const uint32_t AES_imc_rot[256] = {
     0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
 };
 
-/* AES_imc[x][0] = [x].[0e, 09, 0d, 0b]; */
-/* AES_imc[x][1] = [x].[0b, 0e, 09, 0d]; */
-/* AES_imc[x][2] = [x].[0d, 0b, 0e, 09]; */
-/* AES_imc[x][3] = [x].[09, 0d, 0b, 0e]; */
-const uint32_t AES_imc[256][4] = {
-    { 0x00000000, 0x00000000, 0x00000000, 0x00000000, }, /* x=00 */
-    { 0x0E090D0B, 0x0B0E090D, 0x0D0B0E09, 0x090D0B0E, }, /* x=01 */
-    { 0x1C121A16, 0x161C121A, 0x1A161C12, 0x121A161C, }, /* x=02 */
-    { 0x121B171D, 0x1D121B17, 0x171D121B, 0x1B171D12, }, /* x=03 */
-    { 0x3824342C, 0x2C382434, 0x342C3824, 0x24342C38, }, /* x=04 */
-    { 0x362D3927, 0x27362D39, 0x3927362D, 0x2D392736, }, /* x=05 */
-    { 0x24362E3A, 0x3A24362E, 0x2E3A2436, 0x362E3A24, }, /* x=06 */
-    { 0x2A3F2331, 0x312A3F23, 0x23312A3F, 0x3F23312A, }, /* x=07 */
-    { 0x70486858, 0x58704868, 0x68587048, 0x48685870, }, /* x=08 */
-    { 0x7E416553, 0x537E4165, 0x65537E41, 0x4165537E, }, /* x=09 */
-    { 0x6C5A724E, 0x4E6C5A72, 0x724E6C5A, 0x5A724E6C, }, /* x=0A */
-    { 0x62537F45, 0x4562537F, 0x7F456253, 0x537F4562, }, /* x=0B */
-    { 0x486C5C74, 0x74486C5C, 0x5C74486C, 0x6C5C7448, }, /* x=0C */
-    { 0x4665517F, 0x7F466551, 0x517F4665, 0x65517F46, }, /* x=0D */
-    { 0x547E4662, 0x62547E46, 0x4662547E, 0x7E466254, }, /* x=0E */
-    { 0x5A774B69, 0x695A774B, 0x4B695A77, 0x774B695A, }, /* x=0F */
-    { 0xE090D0B0, 0xB0E090D0, 0xD0B0E090, 0x90D0B0E0, }, /* x=10 */
-    { 0xEE99DDBB, 0xBBEE99DD, 0xDDBBEE99, 0x99DDBBEE, }, /* x=11 */
-    { 0xFC82CAA6, 0xA6FC82CA, 0xCAA6FC82, 0x82CAA6FC, }, /* x=12 */
-    { 0xF28BC7AD, 0xADF28BC7, 0xC7ADF28B, 0x8BC7ADF2, }, /* x=13 */
-    { 0xD8B4E49C, 0x9CD8B4E4, 0xE49CD8B4, 0xB4E49CD8, }, /* x=14 */
-    { 0xD6BDE997, 0x97D6BDE9, 0xE997D6BD, 0xBDE997D6, }, /* x=15 */
-    { 0xC4A6FE8A, 0x8AC4A6FE, 0xFE8AC4A6, 0xA6FE8AC4, }, /* x=16 */
-    { 0xCAAFF381, 0x81CAAFF3, 0xF381CAAF, 0xAFF381CA, }, /* x=17 */
-    { 0x90D8B8E8, 0xE890D8B8, 0xB8E890D8, 0xD8B8E890, }, /* x=18 */
-    { 0x9ED1B5E3, 0xE39ED1B5, 0xB5E39ED1, 0xD1B5E39E, }, /* x=19 */
-    { 0x8CCAA2FE, 0xFE8CCAA2, 0xA2FE8CCA, 0xCAA2FE8C, }, /* x=1A */
-    { 0x82C3AFF5, 0xF582C3AF, 0xAFF582C3, 0xC3AFF582, }, /* x=1B */
-    { 0xA8FC8CC4, 0xC4A8FC8C, 0x8CC4A8FC, 0xFC8CC4A8, }, /* x=1C */
-    { 0xA6F581CF, 0xCFA6F581, 0x81CFA6F5, 0xF581CFA6, }, /* x=1D */
-    { 0xB4EE96D2, 0xD2B4EE96, 0x96D2B4EE, 0xEE96D2B4, }, /* x=1E */
-    { 0xBAE79BD9, 0xD9BAE79B, 0x9BD9BAE7, 0xE79BD9BA, }, /* x=1F */
-    { 0xDB3BBB7B, 0x7BDB3BBB, 0xBB7BDB3B, 0x3BBB7BDB, }, /* x=20 */
-    { 0xD532B670, 0x70D532B6, 0xB670D532, 0x32B670D5, }, /* x=21 */
-    { 0xC729A16D, 0x6DC729A1, 0xA16DC729, 0x29A16DC7, }, /* x=22 */
-    { 0xC920AC66, 0x66C920AC, 0xAC66C920, 0x20AC66C9, }, /* x=23 */
-    { 0xE31F8F57, 0x57E31F8F, 0x8F57E31F, 0x1F8F57E3, }, /* x=24 */
-    { 0xED16825C, 0x5CED1682, 0x825CED16, 0x16825CED, }, /* x=25 */
-    { 0xFF0D9541, 0x41FF0D95, 0x9541FF0D, 0x0D9541FF, }, /* x=26 */
-    { 0xF104984A, 0x4AF10498, 0x984AF104, 0x04984AF1, }, /* x=27 */
-    { 0xAB73D323, 0x23AB73D3, 0xD323AB73, 0x73D323AB, }, /* x=28 */
-    { 0xA57ADE28, 0x28A57ADE, 0xDE28A57A, 0x7ADE28A5, }, /* x=29 */
-    { 0xB761C935, 0x35B761C9, 0xC935B761, 0x61C935B7, }, /* x=2A */
-    { 0xB968C43E, 0x3EB968C4, 0xC43EB968, 0x68C43EB9, }, /* x=2B */
-    { 0x9357E70F, 0x0F9357E7, 0xE70F9357, 0x57E70F93, }, /* x=2C */
-    { 0x9D5EEA04, 0x049D5EEA, 0xEA049D5E, 0x5EEA049D, }, /* x=2D */
-    { 0x8F45FD19, 0x198F45FD, 0xFD198F45, 0x45FD198F, }, /* x=2E */
-    { 0x814CF012, 0x12814CF0, 0xF012814C, 0x4CF01281, }, /* x=2F */
-    { 0x3BAB6BCB, 0xCB3BAB6B, 0x6BCB3BAB, 0xAB6BCB3B, }, /* x=30 */
-    { 0x35A266C0, 0xC035A266, 0x66C035A2, 0xA266C035, }, /* x=31 */
-    { 0x27B971DD, 0xDD27B971, 0x71DD27B9, 0xB971DD27, }, /* x=32 */
-    { 0x29B07CD6, 0xD629B07C, 0x7CD629B0, 0xB07CD629, }, /* x=33 */
-    { 0x038F5FE7, 0xE7038F5F, 0x5FE7038F, 0x8F5FE703, }, /* x=34 */
-    { 0x0D8652EC, 0xEC0D8652, 0x52EC0D86, 0x8652EC0D, }, /* x=35 */
-    { 0x1F9D45F1, 0xF11F9D45, 0x45F11F9D, 0x9D45F11F, }, /* x=36 */
-    { 0x119448FA, 0xFA119448, 0x48FA1194, 0x9448FA11, }, /* x=37 */
-    { 0x4BE30393, 0x934BE303, 0x03934BE3, 0xE303934B, }, /* x=38 */
-    { 0x45EA0E98, 0x9845EA0E, 0x0E9845EA, 0xEA0E9845, }, /* x=39 */
-    { 0x57F11985, 0x8557F119, 0x198557F1, 0xF1198557, }, /* x=3A */
-    { 0x59F8148E, 0x8E59F814, 0x148E59F8, 0xF8148E59, }, /* x=3B */
-    { 0x73C737BF, 0xBF73C737, 0x37BF73C7, 0xC737BF73, }, /* x=3C */
-    { 0x7DCE3AB4, 0xB47DCE3A, 0x3AB47DCE, 0xCE3AB47D, }, /* x=3D */
-    { 0x6FD52DA9, 0xA96FD52D, 0x2DA96FD5, 0xD52DA96F, }, /* x=3E */
-    { 0x61DC20A2, 0xA261DC20, 0x20A261DC, 0xDC20A261, }, /* x=3F */
-    { 0xAD766DF6, 0xF6AD766D, 0x6DF6AD76, 0x766DF6AD, }, /* x=40 */
-    { 0xA37F60FD, 0xFDA37F60, 0x60FDA37F, 0x7F60FDA3, }, /* x=41 */
-    { 0xB16477E0, 0xE0B16477, 0x77E0B164, 0x6477E0B1, }, /* x=42 */
-    { 0xBF6D7AEB, 0xEBBF6D7A, 0x7AEBBF6D, 0x6D7AEBBF, }, /* x=43 */
-    { 0x955259DA, 0xDA955259, 0x59DA9552, 0x5259DA95, }, /* x=44 */
-    { 0x9B5B54D1, 0xD19B5B54, 0x54D19B5B, 0x5B54D19B, }, /* x=45 */
-    { 0x894043CC, 0xCC894043, 0x43CC8940, 0x4043CC89, }, /* x=46 */
-    { 0x87494EC7, 0xC787494E, 0x4EC78749, 0x494EC787, }, /* x=47 */
-    { 0xDD3E05AE, 0xAEDD3E05, 0x05AEDD3E, 0x3E05AEDD, }, /* x=48 */
-    { 0xD33708A5, 0xA5D33708, 0x08A5D337, 0x3708A5D3, }, /* x=49 */
-    { 0xC12C1FB8, 0xB8C12C1F, 0x1FB8C12C, 0x2C1FB8C1, }, /* x=4A */
-    { 0xCF2512B3, 0xB3CF2512, 0x12B3CF25, 0x2512B3CF, }, /* x=4B */
-    { 0xE51A3182, 0x82E51A31, 0x3182E51A, 0x1A3182E5, }, /* x=4C */
-    { 0xEB133C89, 0x89EB133C, 0x3C89EB13, 0x133C89EB, }, /* x=4D */
-    { 0xF9082B94, 0x94F9082B, 0x2B94F908, 0x082B94F9, }, /* x=4E */
-    { 0xF701269F, 0x9FF70126, 0x269FF701, 0x01269FF7, }, /* x=4F */
-    { 0x4DE6BD46, 0x464DE6BD, 0xBD464DE6, 0xE6BD464D, }, /* x=50 */
-    { 0x43EFB04D, 0x4D43EFB0, 0xB04D43EF, 0xEFB04D43, }, /* x=51 */
-    { 0x51F4A750, 0x5051F4A7, 0xA75051F4, 0xF4A75051, }, /* x=52 */
-    { 0x5FFDAA5B, 0x5B5FFDAA, 0xAA5B5FFD, 0xFDAA5B5F, }, /* x=53 */
-    { 0x75C2896A, 0x6A75C289, 0x896A75C2, 0xC2896A75, }, /* x=54 */
-    { 0x7BCB8461, 0x617BCB84, 0x84617BCB, 0xCB84617B, }, /* x=55 */
-    { 0x69D0937C, 0x7C69D093, 0x937C69D0, 0xD0937C69, }, /* x=56 */
-    { 0x67D99E77, 0x7767D99E, 0x9E7767D9, 0xD99E7767, }, /* x=57 */
-    { 0x3DAED51E, 0x1E3DAED5, 0xD51E3DAE, 0xAED51E3D, }, /* x=58 */
-    { 0x33A7D815, 0x1533A7D8, 0xD81533A7, 0xA7D81533, }, /* x=59 */
-    { 0x21BCCF08, 0x0821BCCF, 0xCF0821BC, 0xBCCF0821, }, /* x=5A */
-    { 0x2FB5C203, 0x032FB5C2, 0xC2032FB5, 0xB5C2032F, }, /* x=5B */
-    { 0x058AE132, 0x32058AE1, 0xE132058A, 0x8AE13205, }, /* x=5C */
-    { 0x0B83EC39, 0x390B83EC, 0xEC390B83, 0x83EC390B, }, /* x=5D */
-    { 0x1998FB24, 0x241998FB, 0xFB241998, 0x98FB2419, }, /* x=5E */
-    { 0x1791F62F, 0x2F1791F6, 0xF62F1791, 0x91F62F17, }, /* x=5F */
-    { 0x764DD68D, 0x8D764DD6, 0xD68D764D, 0x4DD68D76, }, /* x=60 */
-    { 0x7844DB86, 0x867844DB, 0xDB867844, 0x44DB8678, }, /* x=61 */
-    { 0x6A5FCC9B, 0x9B6A5FCC, 0xCC9B6A5F, 0x5FCC9B6A, }, /* x=62 */
-    { 0x6456C190, 0x906456C1, 0xC1906456, 0x56C19064, }, /* x=63 */
-    { 0x4E69E2A1, 0xA14E69E2, 0xE2A14E69, 0x69E2A14E, }, /* x=64 */
-    { 0x4060EFAA, 0xAA4060EF, 0xEFAA4060, 0x60EFAA40, }, /* x=65 */
-    { 0x527BF8B7, 0xB7527BF8, 0xF8B7527B, 0x7BF8B752, }, /* x=66 */
-    { 0x5C72F5BC, 0xBC5C72F5, 0xF5BC5C72, 0x72F5BC5C, }, /* x=67 */
-    { 0x0605BED5, 0xD50605BE, 0xBED50605, 0x05BED506, }, /* x=68 */
-    { 0x080CB3DE, 0xDE080CB3, 0xB3DE080C, 0x0CB3DE08, }, /* x=69 */
-    { 0x1A17A4C3, 0xC31A17A4, 0xA4C31A17, 0x17A4C31A, }, /* x=6A */
-    { 0x141EA9C8, 0xC8141EA9, 0xA9C8141E, 0x1EA9C814, }, /* x=6B */
-    { 0x3E218AF9, 0xF93E218A, 0x8AF93E21, 0x218AF93E, }, /* x=6C */
-    { 0x302887F2, 0xF2302887, 0x87F23028, 0x2887F230, }, /* x=6D */
-    { 0x223390EF, 0xEF223390, 0x90EF2233, 0x3390EF22, }, /* x=6E */
-    { 0x2C3A9DE4, 0xE42C3A9D, 0x9DE42C3A, 0x3A9DE42C, }, /* x=6F */
-    { 0x96DD063D, 0x3D96DD06, 0x063D96DD, 0xDD063D96, }, /* x=70 */
-    { 0x98D40B36, 0x3698D40B, 0x0B3698D4, 0xD40B3698, }, /* x=71 */
-    { 0x8ACF1C2B, 0x2B8ACF1C, 0x1C2B8ACF, 0xCF1C2B8A, }, /* x=72 */
-    { 0x84C61120, 0x2084C611, 0x112084C6, 0xC6112084, }, /* x=73 */
-    { 0xAEF93211, 0x11AEF932, 0x3211AEF9, 0xF93211AE, }, /* x=74 */
-    { 0xA0F03F1A, 0x1AA0F03F, 0x3F1AA0F0, 0xF03F1AA0, }, /* x=75 */
-    { 0xB2EB2807, 0x07B2EB28, 0x2807B2EB, 0xEB2807B2, }, /* x=76 */
-    { 0xBCE2250C, 0x0CBCE225, 0x250CBCE2, 0xE2250CBC, }, /* x=77 */
-    { 0xE6956E65, 0x65E6956E, 0x6E65E695, 0x956E65E6, }, /* x=78 */
-    { 0xE89C636E, 0x6EE89C63, 0x636EE89C, 0x9C636EE8, }, /* x=79 */
-    { 0xFA877473, 0x73FA8774, 0x7473FA87, 0x877473FA, }, /* x=7A */
-    { 0xF48E7978, 0x78F48E79, 0x7978F48E, 0x8E7978F4, }, /* x=7B */
-    { 0xDEB15A49, 0x49DEB15A, 0x5A49DEB1, 0xB15A49DE, }, /* x=7C */
-    { 0xD0B85742, 0x42D0B857, 0x5742D0B8, 0xB85742D0, }, /* x=7D */
-    { 0xC2A3405F, 0x5FC2A340, 0x405FC2A3, 0xA3405FC2, }, /* x=7E */
-    { 0xCCAA4D54, 0x54CCAA4D, 0x4D54CCAA, 0xAA4D54CC, }, /* x=7F */
-    { 0x41ECDAF7, 0xF741ECDA, 0xDAF741EC, 0xECDAF741, }, /* x=80 */
-    { 0x4FE5D7FC, 0xFC4FE5D7, 0xD7FC4FE5, 0xE5D7FC4F, }, /* x=81 */
-    { 0x5DFEC0E1, 0xE15DFEC0, 0xC0E15DFE, 0xFEC0E15D, }, /* x=82 */
-    { 0x53F7CDEA, 0xEA53F7CD, 0xCDEA53F7, 0xF7CDEA53, }, /* x=83 */
-    { 0x79C8EEDB, 0xDB79C8EE, 0xEEDB79C8, 0xC8EEDB79, }, /* x=84 */
-    { 0x77C1E3D0, 0xD077C1E3, 0xE3D077C1, 0xC1E3D077, }, /* x=85 */
-    { 0x65DAF4CD, 0xCD65DAF4, 0xF4CD65DA, 0xDAF4CD65, }, /* x=86 */
-    { 0x6BD3F9C6, 0xC66BD3F9, 0xF9C66BD3, 0xD3F9C66B, }, /* x=87 */
-    { 0x31A4B2AF, 0xAF31A4B2, 0xB2AF31A4, 0xA4B2AF31, }, /* x=88 */
-    { 0x3FADBFA4, 0xA43FADBF, 0xBFA43FAD, 0xADBFA43F, }, /* x=89 */
-    { 0x2DB6A8B9, 0xB92DB6A8, 0xA8B92DB6, 0xB6A8B92D, }, /* x=8A */
-    { 0x23BFA5B2, 0xB223BFA5, 0xA5B223BF, 0xBFA5B223, }, /* x=8B */
-    { 0x09808683, 0x83098086, 0x86830980, 0x80868309, }, /* x=8C */
-    { 0x07898B88, 0x8807898B, 0x8B880789, 0x898B8807, }, /* x=8D */
-    { 0x15929C95, 0x9515929C, 0x9C951592, 0x929C9515, }, /* x=8E */
-    { 0x1B9B919E, 0x9E1B9B91, 0x919E1B9B, 0x9B919E1B, }, /* x=8F */
-    { 0xA17C0A47, 0x47A17C0A, 0x0A47A17C, 0x7C0A47A1, }, /* x=90 */
-    { 0xAF75074C, 0x4CAF7507, 0x074CAF75, 0x75074CAF, }, /* x=91 */
-    { 0xBD6E1051, 0x51BD6E10, 0x1051BD6E, 0x6E1051BD, }, /* x=92 */
-    { 0xB3671D5A, 0x5AB3671D, 0x1D5AB367, 0x671D5AB3, }, /* x=93 */
-    { 0x99583E6B, 0x6B99583E, 0x3E6B9958, 0x583E6B99, }, /* x=94 */
-    { 0x97513360, 0x60975133, 0x33609751, 0x51336097, }, /* x=95 */
-    { 0x854A247D, 0x7D854A24, 0x247D854A, 0x4A247D85, }, /* x=96 */
-    { 0x8B432976, 0x768B4329, 0x29768B43, 0x4329768B, }, /* x=97 */
-    { 0xD134621F, 0x1FD13462, 0x621FD134, 0x34621FD1, }, /* x=98 */
-    { 0xDF3D6F14, 0x14DF3D6F, 0x6F14DF3D, 0x3D6F14DF, }, /* x=99 */
-    { 0xCD267809, 0x09CD2678, 0x7809CD26, 0x267809CD, }, /* x=9A */
-    { 0xC32F7502, 0x02C32F75, 0x7502C32F, 0x2F7502C3, }, /* x=9B */
-    { 0xE9105633, 0x33E91056, 0x5633E910, 0x105633E9, }, /* x=9C */
-    { 0xE7195B38, 0x38E7195B, 0x5B38E719, 0x195B38E7, }, /* x=9D */
-    { 0xF5024C25, 0x25F5024C, 0x4C25F502, 0x024C25F5, }, /* x=9E */
-    { 0xFB0B412E, 0x2EFB0B41, 0x412EFB0B, 0x0B412EFB, }, /* x=9F */
-    { 0x9AD7618C, 0x8C9AD761, 0x618C9AD7, 0xD7618C9A, }, /* x=A0 */
-    { 0x94DE6C87, 0x8794DE6C, 0x6C8794DE, 0xDE6C8794, }, /* x=A1 */
-    { 0x86C57B9A, 0x9A86C57B, 0x7B9A86C5, 0xC57B9A86, }, /* x=A2 */
-    { 0x88CC7691, 0x9188CC76, 0x769188CC, 0xCC769188, }, /* x=A3 */
-    { 0xA2F355A0, 0xA0A2F355, 0x55A0A2F3, 0xF355A0A2, }, /* x=A4 */
-    { 0xACFA58AB, 0xABACFA58, 0x58ABACFA, 0xFA58ABAC, }, /* x=A5 */
-    { 0xBEE14FB6, 0xB6BEE14F, 0x4FB6BEE1, 0xE14FB6BE, }, /* x=A6 */
-    { 0xB0E842BD, 0xBDB0E842, 0x42BDB0E8, 0xE842BDB0, }, /* x=A7 */
-    { 0xEA9F09D4, 0xD4EA9F09, 0x09D4EA9F, 0x9F09D4EA, }, /* x=A8 */
-    { 0xE49604DF, 0xDFE49604, 0x04DFE496, 0x9604DFE4, }, /* x=A9 */
-    { 0xF68D13C2, 0xC2F68D13, 0x13C2F68D, 0x8D13C2F6, }, /* x=AA */
-    { 0xF8841EC9, 0xC9F8841E, 0x1EC9F884, 0x841EC9F8, }, /* x=AB */
-    { 0xD2BB3DF8, 0xF8D2BB3D, 0x3DF8D2BB, 0xBB3DF8D2, }, /* x=AC */
-    { 0xDCB230F3, 0xF3DCB230, 0x30F3DCB2, 0xB230F3DC, }, /* x=AD */
-    { 0xCEA927EE, 0xEECEA927, 0x27EECEA9, 0xA927EECE, }, /* x=AE */
-    { 0xC0A02AE5, 0xE5C0A02A, 0x2AE5C0A0, 0xA02AE5C0, }, /* x=AF */
-    { 0x7A47B13C, 0x3C7A47B1, 0xB13C7A47, 0x47B13C7A, }, /* x=B0 */
-    { 0x744EBC37, 0x37744EBC, 0xBC37744E, 0x4EBC3774, }, /* x=B1 */
-    { 0x6655AB2A, 0x2A6655AB, 0xAB2A6655, 0x55AB2A66, }, /* x=B2 */
-    { 0x685CA621, 0x21685CA6, 0xA621685C, 0x5CA62168, }, /* x=B3 */
-    { 0x42638510, 0x10426385, 0x85104263, 0x63851042, }, /* x=B4 */
-    { 0x4C6A881B, 0x1B4C6A88, 0x881B4C6A, 0x6A881B4C, }, /* x=B5 */
-    { 0x5E719F06, 0x065E719F, 0x9F065E71, 0x719F065E, }, /* x=B6 */
-    { 0x5078920D, 0x0D507892, 0x920D5078, 0x78920D50, }, /* x=B7 */
-    { 0x0A0FD964, 0x640A0FD9, 0xD9640A0F, 0x0FD9640A, }, /* x=B8 */
-    { 0x0406D46F, 0x6F0406D4, 0xD46F0406, 0x06D46F04, }, /* x=B9 */
-    { 0x161DC372, 0x72161DC3, 0xC372161D, 0x1DC37216, }, /* x=BA */
-    { 0x1814CE79, 0x791814CE, 0xCE791814, 0x14CE7918, }, /* x=BB */
-    { 0x322BED48, 0x48322BED, 0xED48322B, 0x2BED4832, }, /* x=BC */
-    { 0x3C22E043, 0x433C22E0, 0xE0433C22, 0x22E0433C, }, /* x=BD */
-    { 0x2E39F75E, 0x5E2E39F7, 0xF75E2E39, 0x39F75E2E, }, /* x=BE */
-    { 0x2030FA55, 0x552030FA, 0xFA552030, 0x30FA5520, }, /* x=BF */
-    { 0xEC9AB701, 0x01EC9AB7, 0xB701EC9A, 0x9AB701EC, }, /* x=C0 */
-    { 0xE293BA0A, 0x0AE293BA, 0xBA0AE293, 0x93BA0AE2, }, /* x=C1 */
-    { 0xF088AD17, 0x17F088AD, 0xAD17F088, 0x88AD17F0, }, /* x=C2 */
-    { 0xFE81A01C, 0x1CFE81A0, 0xA01CFE81, 0x81A01CFE, }, /* x=C3 */
-    { 0xD4BE832D, 0x2DD4BE83, 0x832DD4BE, 0xBE832DD4, }, /* x=C4 */
-    { 0xDAB78E26, 0x26DAB78E, 0x8E26DAB7, 0xB78E26DA, }, /* x=C5 */
-    { 0xC8AC993B, 0x3BC8AC99, 0x993BC8AC, 0xAC993BC8, }, /* x=C6 */
-    { 0xC6A59430, 0x30C6A594, 0x9430C6A5, 0xA59430C6, }, /* x=C7 */
-    { 0x9CD2DF59, 0x599CD2DF, 0xDF599CD2, 0xD2DF599C, }, /* x=C8 */
-    { 0x92DBD252, 0x5292DBD2, 0xD25292DB, 0xDBD25292, }, /* x=C9 */
-    { 0x80C0C54F, 0x4F80C0C5, 0xC54F80C0, 0xC0C54F80, }, /* x=CA */
-    { 0x8EC9C844, 0x448EC9C8, 0xC8448EC9, 0xC9C8448E, }, /* x=CB */
-    { 0xA4F6EB75, 0x75A4F6EB, 0xEB75A4F6, 0xF6EB75A4, }, /* x=CC */
-    { 0xAAFFE67E, 0x7EAAFFE6, 0xE67EAAFF, 0xFFE67EAA, }, /* x=CD */
-    { 0xB8E4F163, 0x63B8E4F1, 0xF163B8E4, 0xE4F163B8, }, /* x=CE */
-    { 0xB6EDFC68, 0x68B6EDFC, 0xFC68B6ED, 0xEDFC68B6, }, /* x=CF */
-    { 0x0C0A67B1, 0xB10C0A67, 0x67B10C0A, 0x0A67B10C, }, /* x=D0 */
-    { 0x02036ABA, 0xBA02036A, 0x6ABA0203, 0x036ABA02, }, /* x=D1 */
-    { 0x10187DA7, 0xA710187D, 0x7DA71018, 0x187DA710, }, /* x=D2 */
-    { 0x1E1170AC, 0xAC1E1170, 0x70AC1E11, 0x1170AC1E, }, /* x=D3 */
-    { 0x342E539D, 0x9D342E53, 0x539D342E, 0x2E539D34, }, /* x=D4 */
-    { 0x3A275E96, 0x963A275E, 0x5E963A27, 0x275E963A, }, /* x=D5 */
-    { 0x283C498B, 0x8B283C49, 0x498B283C, 0x3C498B28, }, /* x=D6 */
-    { 0x26354480, 0x80263544, 0x44802635, 0x35448026, }, /* x=D7 */
-    { 0x7C420FE9, 0xE97C420F, 0x0FE97C42, 0x420FE97C, }, /* x=D8 */
-    { 0x724B02E2, 0xE2724B02, 0x02E2724B, 0x4B02E272, }, /* x=D9 */
-    { 0x605015FF, 0xFF605015, 0x15FF6050, 0x5015FF60, }, /* x=DA */
-    { 0x6E5918F4, 0xF46E5918, 0x18F46E59, 0x5918F46E, }, /* x=DB */
-    { 0x44663BC5, 0xC544663B, 0x3BC54466, 0x663BC544, }, /* x=DC */
-    { 0x4A6F36CE, 0xCE4A6F36, 0x36CE4A6F, 0x6F36CE4A, }, /* x=DD */
-    { 0x587421D3, 0xD3587421, 0x21D35874, 0x7421D358, }, /* x=DE */
-    { 0x567D2CD8, 0xD8567D2C, 0x2CD8567D, 0x7D2CD856, }, /* x=DF */
-    { 0x37A10C7A, 0x7A37A10C, 0x0C7A37A1, 0xA10C7A37, }, /* x=E0 */
-    { 0x39A80171, 0x7139A801, 0x017139A8, 0xA8017139, }, /* x=E1 */
-    { 0x2BB3166C, 0x6C2BB316, 0x166C2BB3, 0xB3166C2B, }, /* x=E2 */
-    { 0x25BA1B67, 0x6725BA1B, 0x1B6725BA, 0xBA1B6725, }, /* x=E3 */
-    { 0x0F853856, 0x560F8538, 0x38560F85, 0x8538560F, }, /* x=E4 */
-    { 0x018C355D, 0x5D018C35, 0x355D018C, 0x8C355D01, }, /* x=E5 */
-    { 0x13972240, 0x40139722, 0x22401397, 0x97224013, }, /* x=E6 */
-    { 0x1D9E2F4B, 0x4B1D9E2F, 0x2F4B1D9E, 0x9E2F4B1D, }, /* x=E7 */
-    { 0x47E96422, 0x2247E964, 0x642247E9, 0xE9642247, }, /* x=E8 */
-    { 0x49E06929, 0x2949E069, 0x692949E0, 0xE0692949, }, /* x=E9 */
-    { 0x5BFB7E34, 0x345BFB7E, 0x7E345BFB, 0xFB7E345B, }, /* x=EA */
-    { 0x55F2733F, 0x3F55F273, 0x733F55F2, 0xF2733F55, }, /* x=EB */
-    { 0x7FCD500E, 0x0E7FCD50, 0x500E7FCD, 0xCD500E7F, }, /* x=EC */
-    { 0x71C45D05, 0x0571C45D, 0x5D0571C4, 0xC45D0571, }, /* x=ED */
-    { 0x63DF4A18, 0x1863DF4A, 0x4A1863DF, 0xDF4A1863, }, /* x=EE */
-    { 0x6DD64713, 0x136DD647, 0x47136DD6, 0xD647136D, }, /* x=EF */
-    { 0xD731DCCA, 0xCAD731DC, 0xDCCAD731, 0x31DCCAD7, }, /* x=F0 */
-    { 0xD938D1C1, 0xC1D938D1, 0xD1C1D938, 0x38D1C1D9, }, /* x=F1 */
-    { 0xCB23C6DC, 0xDCCB23C6, 0xC6DCCB23, 0x23C6DCCB, }, /* x=F2 */
-    { 0xC52ACBD7, 0xD7C52ACB, 0xCBD7C52A, 0x2ACBD7C5, }, /* x=F3 */
-    { 0xEF15E8E6, 0xE6EF15E8, 0xE8E6EF15, 0x15E8E6EF, }, /* x=F4 */
-    { 0xE11CE5ED, 0xEDE11CE5, 0xE5EDE11C, 0x1CE5EDE1, }, /* x=F5 */
-    { 0xF307F2F0, 0xF0F307F2, 0xF2F0F307, 0x07F2F0F3, }, /* x=F6 */
-    { 0xFD0EFFFB, 0xFBFD0EFF, 0xFFFBFD0E, 0x0EFFFBFD, }, /* x=F7 */
-    { 0xA779B492, 0x92A779B4, 0xB492A779, 0x79B492A7, }, /* x=F8 */
-    { 0xA970B999, 0x99A970B9, 0xB999A970, 0x70B999A9, }, /* x=F9 */
-    { 0xBB6BAE84, 0x84BB6BAE, 0xAE84BB6B, 0x6BAE84BB, }, /* x=FA */
-    { 0xB562A38F, 0x8FB562A3, 0xA38FB562, 0x62A38FB5, }, /* x=FB */
-    { 0x9F5D80BE, 0xBE9F5D80, 0x80BE9F5D, 0x5D80BE9F, }, /* x=FC */
-    { 0x91548DB5, 0xB591548D, 0x8DB59154, 0x548DB591, }, /* x=FD */
-    { 0x834F9AA8, 0xA8834F9A, 0x9AA8834F, 0x4F9AA883, }, /* x=FE */
-    { 0x8D4697A3, 0xA38D4697, 0x97A38D46, 0x4697A38D, }, /* x=FF */
-};
-
-
 
 /*
 AES_Te0[x] = S [x].[02, 01, 01, 03];
diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index aa8b54065d..99209f51b9 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -36,13 +36,6 @@ extern const uint32_t AES_mc_rot[256];
 /* AES InvMixColumns, for use with rot32. */
 extern const uint32_t AES_imc_rot[256];
 
-/* AES InvMixColumns */
-/* AES_imc[x][0] = [x].[0e, 09, 0d, 0b]; */
-/* AES_imc[x][1] = [x].[0b, 0e, 09, 0d]; */
-/* AES_imc[x][2] = [x].[0d, 0b, 0e, 09]; */
-/* AES_imc[x][3] = [x].[09, 0d, 0b, 0e]; */
-extern const uint32_t AES_imc[256][4];
-
 /*
 AES_Te0[x] = S [x].[02, 01, 01, 03];
 AES_Te1[x] = S [x].[03, 02, 01, 01];

From ff494c8e2a4c857dd37fb908d8ac8158f5e4f89b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 01:39:00 +0000
Subject: [PATCH 0538/1353] crypto: Unexport AES_*_rot, AES_TeN, AES_TdN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These arrays are no longer used outside of aes.c.

Acked-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 crypto/aes.c         | 33 +++++++++++++++++++++------------
 include/crypto/aes.h | 25 -------------------------
 2 files changed, 21 insertions(+), 37 deletions(-)

diff --git a/crypto/aes.c b/crypto/aes.c
index 685efbd583..836d7d5c0b 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -120,7 +120,7 @@ const uint8_t AES_isbox[256] = {
 /*
  * MixColumns lookup table, for use with rot32.
  */
-const uint32_t AES_mc_rot[256] = {
+static const uint32_t AES_mc_rot[256] = {
     0x00000000, 0x03010102, 0x06020204, 0x05030306,
     0x0c040408, 0x0f05050a, 0x0a06060c, 0x0907070e,
     0x18080810, 0x1b090912, 0x1e0a0a14, 0x1d0b0b16,
@@ -190,7 +190,7 @@ const uint32_t AES_mc_rot[256] = {
 /*
  * Inverse MixColumns lookup table, for use with rot32.
  */
-const uint32_t AES_imc_rot[256] = {
+static const uint32_t AES_imc_rot[256] = {
     0x00000000, 0x0b0d090e, 0x161a121c, 0x1d171b12,
     0x2c342438, 0x27392d36, 0x3a2e3624, 0x31233f2a,
     0x58684870, 0x5365417e, 0x4e725a6c, 0x457f5362,
@@ -272,7 +272,7 @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
 AES_Td4[x] = Si[x].[01, 01, 01, 01];
 */
 
-const uint32_t AES_Te0[256] = {
+static const uint32_t AES_Te0[256] = {
     0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
     0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
     0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -338,7 +338,8 @@ const uint32_t AES_Te0[256] = {
     0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
     0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
 };
-const uint32_t AES_Te1[256] = {
+
+static const uint32_t AES_Te1[256] = {
     0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
     0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
     0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
@@ -404,7 +405,8 @@ const uint32_t AES_Te1[256] = {
     0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
     0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
 };
-const uint32_t AES_Te2[256] = {
+
+static const uint32_t AES_Te2[256] = {
     0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
     0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
     0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
@@ -470,8 +472,8 @@ const uint32_t AES_Te2[256] = {
     0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
     0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
 };
-const uint32_t AES_Te3[256] = {
 
+static const uint32_t AES_Te3[256] = {
     0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
     0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
     0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
@@ -537,7 +539,8 @@ const uint32_t AES_Te3[256] = {
     0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
     0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
 };
-const uint32_t AES_Te4[256] = {
+
+static const uint32_t AES_Te4[256] = {
     0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
     0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
     0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
@@ -603,7 +606,8 @@ const uint32_t AES_Te4[256] = {
     0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
     0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
-const uint32_t AES_Td0[256] = {
+
+static const uint32_t AES_Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
     0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
@@ -669,7 +673,8 @@ const uint32_t AES_Td0[256] = {
     0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
     0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
 };
-const uint32_t AES_Td1[256] = {
+
+static const uint32_t AES_Td1[256] = {
     0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
     0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
     0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
@@ -735,7 +740,8 @@ const uint32_t AES_Td1[256] = {
     0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
     0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
 };
-const uint32_t AES_Td2[256] = {
+
+static const uint32_t AES_Td2[256] = {
     0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
     0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
     0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
@@ -802,7 +808,8 @@ const uint32_t AES_Td2[256] = {
     0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
     0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
 };
-const uint32_t AES_Td3[256] = {
+
+static const uint32_t AES_Td3[256] = {
     0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
     0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
     0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
@@ -868,7 +875,8 @@ const uint32_t AES_Td3[256] = {
     0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
     0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
 };
-const uint32_t AES_Td4[256] = {
+
+static const uint32_t AES_Td4[256] = {
     0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
     0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
     0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
@@ -934,6 +942,7 @@ const uint32_t AES_Td4[256] = {
     0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
     0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU,
 };
+
 static const u32 rcon[] = {
         0x01000000, 0x02000000, 0x04000000, 0x08000000,
         0x10000000, 0x20000000, 0x40000000, 0x80000000,
diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index 99209f51b9..709d4d226b 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -30,29 +30,4 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
-/* AES MixColumns, for use with rot32. */
-extern const uint32_t AES_mc_rot[256];
-
-/* AES InvMixColumns, for use with rot32. */
-extern const uint32_t AES_imc_rot[256];
-
-/*
-AES_Te0[x] = S [x].[02, 01, 01, 03];
-AES_Te1[x] = S [x].[03, 02, 01, 01];
-AES_Te2[x] = S [x].[01, 03, 02, 01];
-AES_Te3[x] = S [x].[01, 01, 03, 02];
-AES_Te4[x] = S [x].[01, 01, 01, 01];
-
-AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
-AES_Td1[x] = Si[x].[0b, 0e, 09, 0d];
-AES_Td2[x] = Si[x].[0d, 0b, 0e, 09];
-AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
-AES_Td4[x] = Si[x].[01, 01, 01, 01];
-*/
-
-extern const uint32_t AES_Te0[256], AES_Te1[256], AES_Te2[256],
-                      AES_Te3[256], AES_Te4[256];
-extern const uint32_t AES_Td0[256], AES_Td1[256], AES_Td2[256],
-                      AES_Td3[256], AES_Td4[256];
-
 #endif

From 5034e3d4e8324691581f269d49fc28f20c8a62de Mon Sep 17 00:00:00 2001
From: Andrei Gudkov <gudkov.andrei@huawei.com>
Date: Tue, 23 May 2023 18:19:56 +0300
Subject: [PATCH 0539/1353] qapi: better docs for calc-dirty-rate and friends

Rewrote calc-dirty-rate documentation. Briefly described
different modes of dirty page rate measurement. Added some
examples. Fixed obvious grammar errors.

Signed-off-by: Andrei Gudkov <gudkov.andrei@huawei.com>
Message-Id: <fe7d32a621ebd69ef6974beb2499c0b5dccb9e19.1684854849.git.gudkov.andrei@huawei.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
[Prose tweaked and spacing corrected, as per review]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/migration.json | 97 +++++++++++++++++++++++++++++++++------------
 1 file changed, 71 insertions(+), 26 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 47dfef0278..52ff5bee98 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -1745,14 +1745,13 @@
 ##
 # @DirtyRateStatus:
 #
-# An enumeration of dirtyrate status.
+# Dirty page rate measurement status.
 #
-# @unstarted: the dirtyrate thread has not been started.
+# @unstarted: measuring thread has not been started yet
 #
-# @measuring: the dirtyrate thread is measuring.
+# @measuring: measuring thread is running
 #
-# @measured: the dirtyrate thread has measured and results are
-#     available.
+# @measured: dirty page rate is measured and the results are available
 #
 # Since: 5.2
 ##
@@ -1762,13 +1761,14 @@
 ##
 # @DirtyRateMeasureMode:
 #
-# An enumeration of mode of measuring dirtyrate.
+# Method used to measure dirty page rate.  Differences between
+# available methods are explained in @calc-dirty-rate.
 #
-# @page-sampling: calculate dirtyrate by sampling pages.
+# @page-sampling: use page sampling
 #
-# @dirty-ring: calculate dirtyrate by dirty ring.
+# @dirty-ring: use dirty ring
 #
-# @dirty-bitmap: calculate dirtyrate by dirty bitmap.
+# @dirty-bitmap: use dirty bitmap
 #
 # Since: 6.2
 ##
@@ -1778,25 +1778,24 @@
 ##
 # @DirtyRateInfo:
 #
-# Information about current dirty page rate of vm.
+# Information about measured dirty page rate.
 #
 # @dirty-rate: an estimate of the dirty page rate of the VM in units
-#     of MB/s, present only when estimating the rate has completed.
+#     of MiB/s.  Value is present only when @status is 'measured'.
 #
-# @status: status containing dirtyrate query status includes
-#     'unstarted' or 'measuring' or 'measured'
+# @status: current status of dirty page rate measurements
 #
 # @start-time: start time in units of second for calculation
 #
-# @calc-time: time in units of second for sample dirty pages
+# @calc-time: time period for which dirty page rate was measured
+#     (in seconds)
 #
-# @sample-pages: page count per GB for sample dirty pages the default
-#     value is 512 (since 6.1)
+# @sample-pages: number of sampled pages per GiB of guest memory.
+#     Valid only in page-sampling mode (Since 6.1)
 #
-# @mode: mode containing method of calculate dirtyrate includes
-#     'page-sampling' and 'dirty-ring' (Since 6.2)
+# @mode: mode that was used to measure dirty page rate (Since 6.2)
 #
-# @vcpu-dirty-rate: dirtyrate for each vcpu if dirty-ring mode
+# @vcpu-dirty-rate: dirty rate for each vCPU if dirty-ring mode was
 #     specified (Since 6.2)
 #
 # Since: 5.2
@@ -1813,15 +1812,49 @@
 ##
 # @calc-dirty-rate:
 #
-# start calculating dirty page rate for vm
+# Start measuring dirty page rate of the VM.  Results can be retrieved
+# with @query-dirty-rate after measurements are completed.
 #
-# @calc-time: time in units of second for sample dirty pages
+# Dirty page rate is the number of pages changed in a given time
+# period expressed in MiB/s.  The following methods of calculation are
+# available:
 #
-# @sample-pages: page count per GB for sample dirty pages the default
-#     value is 512 (since 6.1)
+# 1. In page sampling mode, a random subset of pages are selected and
+#    hashed twice: once at the beginning of measurement time period,
+#    and once again at the end.  If two hashes for some page are
+#    different, the page is counted as changed.  Since this method
+#    relies on sampling and hashing, calculated dirty page rate is
+#    only an estimate of its true value.  Increasing @sample-pages
+#    improves estimation quality at the cost of higher computational
+#    overhead.
 #
-# @mode: mechanism of calculating dirtyrate includes 'page-sampling'
-#     and 'dirty-ring' (Since 6.1)
+# 2. Dirty bitmap mode captures writes to memory (for example by
+#    temporarily revoking write access to all pages) and counting page
+#    faults.  Information about modified pages is collected into a
+#    bitmap, where each bit corresponds to one guest page.  This mode
+#    requires that KVM accelerator property "dirty-ring-size" is *not*
+#    set.
+#
+# 3. Dirty ring mode is similar to dirty bitmap mode, but the
+#    information about modified pages is collected into ring buffer.
+#    This mode tracks page modification per each vCPU separately.  It
+#    requires that KVM accelerator property "dirty-ring-size" is set.
+#
+# @calc-time: time period in units of second for which dirty page rate
+#     is calculated.  Note that larger @calc-time values will
+#     typically result in smaller dirty page rates because page
+#     dirtying is a one-time event.  Once some page is counted as
+#     dirty during @calc-time period, further writes to this page will
+#     not increase dirty page rate anymore.
+#
+# @sample-pages: number of sampled pages per each GiB of guest memory.
+#     Default value is 512.  For 4KiB guest pages this corresponds to
+#     sampling ratio of 0.2%.  This argument is used only in page
+#     sampling mode.  (Since 6.1)
+#
+# @mode: mechanism for tracking dirty pages.  Default value is
+#     'page-sampling'.  Others are 'dirty-bitmap' and 'dirty-ring'.
+#     (Since 6.1)
 #
 # Since: 5.2
 #
@@ -1838,9 +1871,21 @@
 ##
 # @query-dirty-rate:
 #
-# query dirty page rate in units of MB/s for vm
+# Query results of the most recent invocation of @calc-dirty-rate.
 #
 # Since: 5.2
+#
+# Examples:
+#
+# 1. Measurement is in progress:
+#
+# <- {"status": "measuring", "sample-pages": 512,
+#     "mode": "page-sampling", "start-time": 3665220, "calc-time": 10}
+#
+# 2. Measurement has been completed:
+#
+# <- {"status": "measured", "sample-pages": 512, "dirty-rate": 108,
+#     "mode": "page-sampling", "start-time": 3665220, "calc-time": 10}
 ##
 { 'command': 'query-dirty-rate', 'returns': 'DirtyRateInfo' }
 

From fd658a7b8cf1091ae2914655add4511865d7edc0 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Mon, 12 Jun 2023 21:16:04 +0200
Subject: [PATCH 0540/1353] migration.json: Don't use space before colon

So all the file is consistent.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20230612191604.2219-1-quintela@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/migration.json | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 52ff5bee98..2a6565a0f8 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -67,13 +67,13 @@
 { 'struct': 'MigrationStats',
   'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' ,
            'duplicate': 'int', 'skipped': 'int', 'normal': 'int',
-           'normal-bytes': 'int', 'dirty-pages-rate' : 'int',
-           'mbps' : 'number', 'dirty-sync-count' : 'int',
-           'postcopy-requests' : 'int', 'page-size' : 'int',
-           'multifd-bytes' : 'uint64', 'pages-per-second' : 'uint64',
-           'precopy-bytes' : 'uint64', 'downtime-bytes' : 'uint64',
-           'postcopy-bytes' : 'uint64',
-           'dirty-sync-missed-zero-copy' : 'uint64' } }
+           'normal-bytes': 'int', 'dirty-pages-rate': 'int',
+           'mbps': 'number', 'dirty-sync-count': 'int',
+           'postcopy-requests': 'int', 'page-size': 'int',
+           'multifd-bytes': 'uint64', 'pages-per-second': 'uint64',
+           'precopy-bytes': 'uint64', 'downtime-bytes': 'uint64',
+           'postcopy-bytes': 'uint64',
+           'dirty-sync-missed-zero-copy': 'uint64' } }
 
 ##
 # @XBZRLECacheStats:
@@ -264,7 +264,7 @@
            '*cpu-throttle-percentage': 'int',
            '*error-desc': 'str',
            '*blocked-reasons': ['str'],
-           '*postcopy-blocktime' : 'uint32',
+           '*postcopy-blocktime': 'uint32',
            '*postcopy-vcpu-blocktime': ['uint32'],
            '*compression': 'CompressionStats',
            '*socket-address': ['SocketAddress'] } }
@@ -526,7 +526,7 @@
 # Since: 1.2
 ##
 { 'struct': 'MigrationCapabilityStatus',
-  'data': { 'capability' : 'MigrationCapability', 'state' : 'bool' } }
+  'data': { 'capability': 'MigrationCapability', 'state': 'bool' } }
 
 ##
 # @migrate-set-capabilities:
@@ -1577,7 +1577,7 @@
 # Since: 2.9
 ##
 { 'command': 'xen-set-replication',
-  'data': { 'enable': 'bool', 'primary': 'bool', '*failover' : 'bool' },
+  'data': { 'enable': 'bool', 'primary': 'bool', '*failover': 'bool' },
   'if': 'CONFIG_REPLICATION' }
 
 ##

From 0ddcb39c93571da4fdcc39fc770500d2d275376d Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Fri, 30 Jun 2023 16:36:08 -0600
Subject: [PATCH 0541/1353] hw/vfio/pci-quirks: Sanitize capability pointer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity reports a tained scalar when traversing the capabilities
chain (CID 1516589).  In practice I've never seen a device with a
chain so broken as to cause an issue, but it's also pretty easy to
sanitize.

Fixes: f6b30c1984f7 ("hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci-quirks.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index 0ed2fcd531..f4ff836805 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -1530,6 +1530,12 @@ const PropertyInfo qdev_prop_nv_gpudirect_clique = {
     .set = set_nv_gpudirect_clique_id,
 };
 
+static bool is_valid_std_cap_offset(uint8_t pos)
+{
+    return (pos >= PCI_STD_HEADER_SIZEOF &&
+            pos <= (PCI_CFG_SPACE_SIZE - PCI_CAP_SIZEOF));
+}
+
 static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = &vdev->pdev;
@@ -1563,7 +1569,7 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
      */
     ret = pread(vdev->vbasedev.fd, &tmp, 1,
                 vdev->config_offset + PCI_CAPABILITY_LIST);
-    if (ret != 1 || !tmp) {
+    if (ret != 1 || !is_valid_std_cap_offset(tmp)) {
         error_setg(errp, "NVIDIA GPUDirect Clique ID: error getting cap list");
         return -EINVAL;
     }
@@ -1575,7 +1581,7 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
             d4_conflict = true;
         }
         tmp = pdev->config[tmp + PCI_CAP_LIST_NEXT];
-    } while (tmp);
+    } while (is_valid_std_cap_offset(tmp));
 
     if (!c8_conflict) {
         pos = 0xC8;

From adee0da0368f50b3ee934cdeeb6076466dabb268 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 3 Jul 2023 15:15:06 +0800
Subject: [PATCH 0542/1353] vfio/pci: Disable INTx in vfio_realize error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When vfio realize fails, INTx isn't disabled if it has been enabled.
This may confuse host side with unhandled interrupt report.

Fixes: c5478fea27ac ("vfio/pci: Respond to KVM irqchip change notifier")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index ab6645ba60..31c4ab250f 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3220,6 +3220,9 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     return;
 
 out_deregister:
+    if (vdev->interrupt == VFIO_INT_INTx) {
+        vfio_intx_disable(vdev);
+    }
     pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
     if (vdev->irqchip_change_notifier.notify) {
         kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);

From 3c26c80a0a269ce7870d1475e756607e939226cd Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 3 Jul 2023 15:15:07 +0800
Subject: [PATCH 0543/1353] vfio/migration: Change vIOMMU blocker from global
 to per device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Contrary to multiple device blocker which needs to consider already-attached
devices to unblock/block dynamically, the vIOMMU migration blocker is a device
specific config. Meaning it only needs to know whether the device is bypassing
or not the vIOMMU (via machine property, or per pxb-pcie::bypass_iommu), and
does not need the state of currently present devices. For this reason, the
vIOMMU global migration blocker can be consolidated into the per-device
migration blocker, allowing us to remove some unnecessary code.

This change also makes vfio_mig_active() more accurate as it doesn't check for
global blocker.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c              | 51 ++---------------------------------
 hw/vfio/migration.c           |  7 ++---
 hw/vfio/pci.c                 |  1 -
 include/hw/vfio/vfio-common.h |  3 +--
 4 files changed, 7 insertions(+), 55 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 77e2ee0e5c..9aac21abb7 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -362,7 +362,6 @@ bool vfio_mig_active(void)
 }
 
 static Error *multiple_devices_migration_blocker;
-static Error *giommu_migration_blocker;
 
 static unsigned int vfio_migratable_device_num(void)
 {
@@ -420,55 +419,9 @@ void vfio_unblock_multiple_devices_migration(void)
     multiple_devices_migration_blocker = NULL;
 }
 
-static bool vfio_viommu_preset(void)
+bool vfio_viommu_preset(VFIODevice *vbasedev)
 {
-    VFIOAddressSpace *space;
-
-    QLIST_FOREACH(space, &vfio_address_spaces, list) {
-        if (space->as != &address_space_memory) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-int vfio_block_giommu_migration(VFIODevice *vbasedev, Error **errp)
-{
-    int ret;
-
-    if (giommu_migration_blocker ||
-        !vfio_viommu_preset()) {
-        return 0;
-    }
-
-    if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
-        error_setg(errp,
-                   "Migration is currently not supported with vIOMMU enabled");
-        return -EINVAL;
-    }
-
-    error_setg(&giommu_migration_blocker,
-               "Migration is currently not supported with vIOMMU enabled");
-    ret = migrate_add_blocker(giommu_migration_blocker, errp);
-    if (ret < 0) {
-        error_free(giommu_migration_blocker);
-        giommu_migration_blocker = NULL;
-    }
-
-    return ret;
-}
-
-void vfio_migration_finalize(void)
-{
-    if (!giommu_migration_blocker ||
-        vfio_viommu_preset()) {
-        return;
-    }
-
-    migrate_del_blocker(giommu_migration_blocker);
-    error_free(giommu_migration_blocker);
-    giommu_migration_blocker = NULL;
+    return vbasedev->group->container->space->as != &address_space_memory;
 }
 
 static void vfio_set_migration_error(int err)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 1db7d52ab2..e6e5e85f75 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -878,9 +878,10 @@ int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
         return ret;
     }
 
-    ret = vfio_block_giommu_migration(vbasedev, errp);
-    if (ret) {
-        return ret;
+    if (vfio_viommu_preset(vbasedev)) {
+        error_setg(&err, "%s: Migration is currently not supported "
+                   "with vIOMMU enabled", vbasedev->name);
+        return vfio_block_migration(vbasedev, err, errp);
     }
 
     trace_vfio_migration_realize(vbasedev->name);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 31c4ab250f..c2cf7454ec 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3255,7 +3255,6 @@ static void vfio_instance_finalize(Object *obj)
      */
     vfio_put_device(vdev);
     vfio_put_group(group);
-    vfio_migration_finalize();
 }
 
 static void vfio_exitfn(PCIDevice *pdev)
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 93429b9abb..45167c8a8a 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -227,7 +227,7 @@ extern VFIOGroupList vfio_group_list;
 bool vfio_mig_active(void);
 int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp);
 void vfio_unblock_multiple_devices_migration(void);
-int vfio_block_giommu_migration(VFIODevice *vbasedev, Error **errp);
+bool vfio_viommu_preset(VFIODevice *vbasedev);
 int64_t vfio_mig_bytes_transferred(void);
 void vfio_reset_bytes_transferred(void);
 
@@ -254,6 +254,5 @@ int vfio_spapr_remove_window(VFIOContainer *container,
 
 int vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
 void vfio_migration_exit(VFIODevice *vbasedev);
-void vfio_migration_finalize(void);
 
 #endif /* HW_VFIO_VFIO_COMMON_H */

From 2b43b2995b02e73b70d10b5be2f2b29b68c7e2fa Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 3 Jul 2023 15:15:08 +0800
Subject: [PATCH 0544/1353] vfio/migration: Free resources when
 vfio_migration_realize fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When vfio_realize() succeeds, hot unplug will call vfio_exitfn()
to free resources allocated in vfio_realize(); when vfio_realize()
fails, vfio_exitfn() is never called and we need to free resources
in vfio_realize().

In the case that vfio_migration_realize() fails,
e.g: with -only-migratable & enable-migration=off, we see below:

(qemu) device_add vfio-pci,host=81:11.1,id=vfio1,bus=root1,enable-migration=off
0000:81:11.1: Migration disabled
Error: disallowing migration blocker (--only-migratable) for: 0000:81:11.1: Migration is disabled for VFIO device

If we hotplug again we should see same log as above, but we see:
(qemu) device_add vfio-pci,host=81:11.1,id=vfio1,bus=root1,enable-migration=off
Error: vfio 0000:81:11.1: device is already attached

That's because some references to VFIO device isn't released.
For resources allocated in vfio_migration_realize(), free them by
jumping to out_deinit path with calling a new function
vfio_migration_deinit(). For resources allocated in vfio_realize(),
free them by jumping to de-register path in vfio_realize().

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Fixes: a22651053b59 ("vfio: Make vfio-pci device migration capable")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 33 +++++++++++++++++++++++----------
 hw/vfio/pci.c       |  1 +
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index e6e5e85f75..e3954570c8 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -802,6 +802,17 @@ static int vfio_migration_init(VFIODevice *vbasedev)
     return 0;
 }
 
+static void vfio_migration_deinit(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+
+    remove_migration_state_change_notifier(&migration->migration_state);
+    qemu_del_vm_change_state_handler(migration->vm_state);
+    unregister_savevm(VMSTATE_IF(vbasedev->dev), "vfio", vbasedev);
+    vfio_migration_free(vbasedev);
+    vfio_unblock_multiple_devices_migration();
+}
+
 static int vfio_block_migration(VFIODevice *vbasedev, Error *err, Error **errp)
 {
     int ret;
@@ -866,7 +877,7 @@ int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
             error_setg(&err,
                        "%s: VFIO device doesn't support device dirty tracking",
                        vbasedev->name);
-            return vfio_block_migration(vbasedev, err, errp);
+            goto add_blocker;
         }
 
         warn_report("%s: VFIO device doesn't support device dirty tracking",
@@ -875,29 +886,31 @@ int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
 
     ret = vfio_block_multiple_devices_migration(vbasedev, errp);
     if (ret) {
-        return ret;
+        goto out_deinit;
     }
 
     if (vfio_viommu_preset(vbasedev)) {
         error_setg(&err, "%s: Migration is currently not supported "
                    "with vIOMMU enabled", vbasedev->name);
-        return vfio_block_migration(vbasedev, err, errp);
+        goto add_blocker;
     }
 
     trace_vfio_migration_realize(vbasedev->name);
     return 0;
+
+add_blocker:
+    ret = vfio_block_migration(vbasedev, err, errp);
+out_deinit:
+    if (ret) {
+        vfio_migration_deinit(vbasedev);
+    }
+    return ret;
 }
 
 void vfio_migration_exit(VFIODevice *vbasedev)
 {
     if (vbasedev->migration) {
-        VFIOMigration *migration = vbasedev->migration;
-
-        remove_migration_state_change_notifier(&migration->migration_state);
-        qemu_del_vm_change_state_handler(migration->vm_state);
-        unregister_savevm(VMSTATE_IF(vbasedev->dev), "vfio", vbasedev);
-        vfio_migration_free(vbasedev);
-        vfio_unblock_multiple_devices_migration();
+        vfio_migration_deinit(vbasedev);
     }
 
     if (vbasedev->migration_blocker) {
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index c2cf7454ec..9154dd929d 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3210,6 +3210,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         ret = vfio_migration_realize(vbasedev, errp);
         if (ret) {
             error_report("%s: Migration disabled", vbasedev->name);
+            goto out_deregister;
         }
     }
 

From 0520d63c7701b76560eca7d4a484f3e3f57ccb00 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 3 Jul 2023 15:15:09 +0800
Subject: [PATCH 0545/1353] vfio/migration: Remove print of "Migration
 disabled"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Property enable_migration supports [on/off/auto].
In ON mode, error pointer is passed to errp and logged.
In OFF mode, we doesn't need to log "Migration disabled" as it's intentional.
In AUTO mode, we should only ever see errors or warnings if the device
supports migration and an error or incompatibility occurs while further
probing or configuring it. Lack of support for migration shoundn't
generate an error or warning.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 9154dd929d..eefd4ec330 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3209,7 +3209,6 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     if (!pdev->failover_pair_id) {
         ret = vfio_migration_realize(vbasedev, errp);
         if (ret) {
-            error_report("%s: Migration disabled", vbasedev->name);
             goto out_deregister;
         }
     }

From d4a2af747d5a4b58c685a14d0bde7c4f65679bb5 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Mon, 3 Jul 2023 15:15:10 +0800
Subject: [PATCH 0546/1353] vfio/migration: Return bool type for
 vfio_migration_realize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make vfio_migration_realize() adhere to the convention of other realize()
callbacks(like qdev_realize) by returning bool instead of int.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Suggested-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c           | 15 ++++++++++-----
 hw/vfio/pci.c                 |  3 +--
 include/hw/vfio/vfio-common.h |  2 +-
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index e3954570c8..2674f4bc47 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -846,7 +846,12 @@ void vfio_reset_bytes_transferred(void)
     bytes_transferred = 0;
 }
 
-int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
+/*
+ * Return true when either migration initialized or blocker registered.
+ * Currently only return false when adding blocker fails which will
+ * de-register vfio device.
+ */
+bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
 {
     Error *err = NULL;
     int ret;
@@ -854,7 +859,7 @@ int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
     if (vbasedev->enable_migration == ON_OFF_AUTO_OFF) {
         error_setg(&err, "%s: Migration is disabled for VFIO device",
                    vbasedev->name);
-        return vfio_block_migration(vbasedev, err, errp);
+        return !vfio_block_migration(vbasedev, err, errp);
     }
 
     ret = vfio_migration_init(vbasedev);
@@ -869,7 +874,7 @@ int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
                        vbasedev->name, ret, strerror(-ret));
         }
 
-        return vfio_block_migration(vbasedev, err, errp);
+        return !vfio_block_migration(vbasedev, err, errp);
     }
 
     if (!vbasedev->dirty_pages_supported) {
@@ -896,7 +901,7 @@ int vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
     }
 
     trace_vfio_migration_realize(vbasedev->name);
-    return 0;
+    return true;
 
 add_blocker:
     ret = vfio_block_migration(vbasedev, err, errp);
@@ -904,7 +909,7 @@ out_deinit:
     if (ret) {
         vfio_migration_deinit(vbasedev);
     }
-    return ret;
+    return !ret;
 }
 
 void vfio_migration_exit(VFIODevice *vbasedev)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index eefd4ec330..68dd992836 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3207,8 +3207,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     }
 
     if (!pdev->failover_pair_id) {
-        ret = vfio_migration_realize(vbasedev, errp);
-        if (ret) {
+        if (!vfio_migration_realize(vbasedev, errp)) {
             goto out_deregister;
         }
     }
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index 45167c8a8a..da43d27352 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -252,7 +252,7 @@ int vfio_spapr_create_window(VFIOContainer *container,
 int vfio_spapr_remove_window(VFIOContainer *container,
                              hwaddr offset_within_address_space);
 
-int vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
+bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
 void vfio_migration_exit(VFIODevice *vbasedev);
 
 #endif /* HW_VFIO_VFIO_COMMON_H */

From 8af87a3ec7e42ff1b9cf75ceee0451c31e34d153 Mon Sep 17 00:00:00 2001
From: Avihai Horon <avihaih@nvidia.com>
Date: Tue, 4 Jul 2023 16:39:27 +0300
Subject: [PATCH 0547/1353] vfio: Fix null pointer dereference bug in
 vfio_bars_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_realize() has the following flow:
1. vfio_bars_prepare() -- sets VFIOBAR->size.
2. msix_early_setup().
3. vfio_bars_register() -- allocates VFIOBAR->mr.

After vfio_bars_prepare() is called msix_early_setup() can fail. If it
does fail, vfio_bars_register() is never called and VFIOBAR->mr is not
allocated.

In this case, vfio_bars_finalize() is called as part of the error flow
to free the bars' resources. However, vfio_bars_finalize() calls
object_unparent() for VFIOBAR->mr after checking only VFIOBAR->size, and
thus we get a null pointer dereference.

Fix it by checking VFIOBAR->mr in vfio_bars_finalize().

Fixes: 89d5202edc50 ("vfio/pci: Allow relocating MSI-X MMIO")
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 68dd992836..c89fdf7ae6 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1752,9 +1752,11 @@ static void vfio_bars_finalize(VFIOPCIDevice *vdev)
 
         vfio_bar_quirk_finalize(vdev, i);
         vfio_region_finalize(&bar->region);
-        if (bar->size) {
+        if (bar->mr) {
+            assert(bar->size);
             object_unparent(OBJECT(bar->mr));
             g_free(bar->mr);
+            bar->mr = NULL;
         }
     }
 

From d0bf492f3877d4187d2f7d0c0abb3a2bf3104392 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Sun, 9 Jul 2023 23:23:08 +0200
Subject: [PATCH 0548/1353] linux-headers: update to v6.5-rc1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/standard-headers/drm/drm_fourcc.h     |  43 ++++++
 include/standard-headers/linux/const.h        |   2 +-
 include/standard-headers/linux/pci_regs.h     |   1 +
 include/standard-headers/linux/vhost_types.h  |  16 +++
 include/standard-headers/linux/virtio_blk.h   |  18 +--
 .../standard-headers/linux/virtio_config.h    |   6 +
 include/standard-headers/linux/virtio_net.h   |   1 +
 linux-headers/asm-arm64/bitsperlong.h         |  23 ---
 linux-headers/asm-arm64/kvm.h                 |  33 +++++
 linux-headers/asm-generic/bitsperlong.h       |  13 +-
 linux-headers/asm-generic/unistd.h            | 134 +++++-------------
 linux-headers/asm-mips/unistd_n32.h           |   1 +
 linux-headers/asm-mips/unistd_n64.h           |   1 +
 linux-headers/asm-mips/unistd_o32.h           |   1 +
 linux-headers/asm-powerpc/unistd_32.h         |   1 +
 linux-headers/asm-powerpc/unistd_64.h         |   1 +
 linux-headers/asm-riscv/bitsperlong.h         |  13 --
 linux-headers/asm-riscv/kvm.h                 | 134 +++++++++++++++++-
 linux-headers/asm-riscv/unistd.h              |   9 ++
 linux-headers/asm-s390/unistd_32.h            |   2 +
 linux-headers/asm-s390/unistd_64.h            |   2 +
 linux-headers/asm-x86/kvm.h                   |   3 +
 linux-headers/asm-x86/unistd_32.h             |   1 +
 linux-headers/asm-x86/unistd_64.h             |   1 +
 linux-headers/asm-x86/unistd_x32.h            |   1 +
 linux-headers/linux/const.h                   |   2 +-
 linux-headers/linux/kvm.h                     |  18 ++-
 linux-headers/linux/mman.h                    |  14 ++
 linux-headers/linux/psp-sev.h                 |   7 +
 linux-headers/linux/userfaultfd.h             |  17 ++-
 linux-headers/linux/vfio.h                    |  27 ++++
 linux-headers/linux/vhost.h                   |  31 ++++
 32 files changed, 423 insertions(+), 154 deletions(-)

diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index dc3e6112c1..72279f4d25 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -656,6 +656,49 @@ extern "C" {
  */
 #define I915_FORMAT_MOD_4_TILED_DG2_RC_CCS_CC fourcc_mod_code(INTEL, 12)
 
+/*
+ * Intel Color Control Surfaces (CCS) for display ver. 14 render compression.
+ *
+ * The main surface is tile4 and at plane index 0, the CCS is linear and
+ * at index 1. A 64B CCS cache line corresponds to an area of 4x1 tiles in
+ * main surface. In other words, 4 bits in CCS map to a main surface cache
+ * line pair. The main surface pitch is required to be a multiple of four
+ * tile4 widths.
+ */
+#define I915_FORMAT_MOD_4_TILED_MTL_RC_CCS fourcc_mod_code(INTEL, 13)
+
+/*
+ * Intel Color Control Surfaces (CCS) for display ver. 14 media compression
+ *
+ * The main surface is tile4 and at plane index 0, the CCS is linear and
+ * at index 1. A 64B CCS cache line corresponds to an area of 4x1 tiles in
+ * main surface. In other words, 4 bits in CCS map to a main surface cache
+ * line pair. The main surface pitch is required to be a multiple of four
+ * tile4 widths. For semi-planar formats like NV12, CCS planes follow the
+ * Y and UV planes i.e., planes 0 and 1 are used for Y and UV surfaces,
+ * planes 2 and 3 for the respective CCS.
+ */
+#define I915_FORMAT_MOD_4_TILED_MTL_MC_CCS fourcc_mod_code(INTEL, 14)
+
+/*
+ * Intel Color Control Surface with Clear Color (CCS) for display ver. 14 render
+ * compression.
+ *
+ * The main surface is tile4 and is at plane index 0 whereas CCS is linear
+ * and at index 1. The clear color is stored at index 2, and the pitch should
+ * be ignored. The clear color structure is 256 bits. The first 128 bits
+ * represents Raw Clear Color Red, Green, Blue and Alpha color each represented
+ * by 32 bits. The raw clear color is consumed by the 3d engine and generates
+ * the converted clear color of size 64 bits. The first 32 bits store the Lower
+ * Converted Clear Color value and the next 32 bits store the Higher Converted
+ * Clear Color value when applicable. The Converted Clear Color values are
+ * consumed by the DE. The last 64 bits are used to store Color Discard Enable
+ * and Depth Clear Value Valid which are ignored by the DE. A CCS cache line
+ * corresponds to an area of 4x1 tiles in the main surface. The main surface
+ * pitch is required to be a multiple of 4 tile widths.
+ */
+#define I915_FORMAT_MOD_4_TILED_MTL_RC_CCS_CC fourcc_mod_code(INTEL, 15)
+
 /*
  * Tiled, NV12MT, grouped in 64 (pixels) x 32 (lines) -sized macroblocks
  *
diff --git a/include/standard-headers/linux/const.h b/include/standard-headers/linux/const.h
index 5e48987251..1eb84b5087 100644
--- a/include/standard-headers/linux/const.h
+++ b/include/standard-headers/linux/const.h
@@ -28,7 +28,7 @@
 #define _BITUL(x)	(_UL(1) << (x))
 #define _BITULL(x)	(_ULL(1) << (x))
 
-#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
 #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
 
 #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index dc2000e0fe..e5f558d964 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -738,6 +738,7 @@
 #define PCI_EXT_CAP_ID_DVSEC	0x23	/* Designated Vendor-Specific */
 #define PCI_EXT_CAP_ID_DLF	0x25	/* Data Link Feature */
 #define PCI_EXT_CAP_ID_PL_16GT	0x26	/* Physical Layer 16.0 GT/s */
+#define PCI_EXT_CAP_ID_PL_32GT  0x2A    /* Physical Layer 32.0 GT/s */
 #define PCI_EXT_CAP_ID_DOE	0x2E	/* Data Object Exchange */
 #define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_DOE
 
diff --git a/include/standard-headers/linux/vhost_types.h b/include/standard-headers/linux/vhost_types.h
index 88600e2d9f..6691a3ce24 100644
--- a/include/standard-headers/linux/vhost_types.h
+++ b/include/standard-headers/linux/vhost_types.h
@@ -47,6 +47,22 @@ struct vhost_vring_addr {
 	uint64_t log_guest_addr;
 };
 
+struct vhost_worker_state {
+	/*
+	 * For VHOST_NEW_WORKER the kernel will return the new vhost_worker id.
+	 * For VHOST_FREE_WORKER this must be set to the id of the vhost_worker
+	 * to free.
+	 */
+	unsigned int worker_id;
+};
+
+struct vhost_vring_worker {
+	/* vring index */
+	unsigned int index;
+	/* The id of the vhost_worker returned from VHOST_NEW_WORKER */
+	unsigned int worker_id;
+};
+
 /* no alignment requirement */
 struct vhost_iotlb_msg {
 	uint64_t iova;
diff --git a/include/standard-headers/linux/virtio_blk.h b/include/standard-headers/linux/virtio_blk.h
index 7155b1a470..d7be3cf5e4 100644
--- a/include/standard-headers/linux/virtio_blk.h
+++ b/include/standard-headers/linux/virtio_blk.h
@@ -138,11 +138,11 @@ struct virtio_blk_config {
 
 	/* Zoned block device characteristics (if VIRTIO_BLK_F_ZONED) */
 	struct virtio_blk_zoned_characteristics {
-		uint32_t zone_sectors;
-		uint32_t max_open_zones;
-		uint32_t max_active_zones;
-		uint32_t max_append_sectors;
-		uint32_t write_granularity;
+		__virtio32 zone_sectors;
+		__virtio32 max_open_zones;
+		__virtio32 max_active_zones;
+		__virtio32 max_append_sectors;
+		__virtio32 write_granularity;
 		uint8_t model;
 		uint8_t unused2[3];
 	} zoned;
@@ -239,11 +239,11 @@ struct virtio_blk_outhdr {
  */
 struct virtio_blk_zone_descriptor {
 	/* Zone capacity */
-	uint64_t z_cap;
+	__virtio64 z_cap;
 	/* The starting sector of the zone */
-	uint64_t z_start;
+	__virtio64 z_start;
 	/* Zone write pointer position in sectors */
-	uint64_t z_wp;
+	__virtio64 z_wp;
 	/* Zone type */
 	uint8_t z_type;
 	/* Zone state */
@@ -252,7 +252,7 @@ struct virtio_blk_zone_descriptor {
 };
 
 struct virtio_blk_zone_report {
-	uint64_t nr_zones;
+	__virtio64 nr_zones;
 	uint8_t reserved[56];
 	struct virtio_blk_zone_descriptor zones[];
 };
diff --git a/include/standard-headers/linux/virtio_config.h b/include/standard-headers/linux/virtio_config.h
index 965ee6ae23..8a7d0dc8b0 100644
--- a/include/standard-headers/linux/virtio_config.h
+++ b/include/standard-headers/linux/virtio_config.h
@@ -97,6 +97,12 @@
  */
 #define VIRTIO_F_SR_IOV			37
 
+/*
+ * This feature indicates that the driver passes extra data (besides
+ * identifying the virtqueue) in its device notifications.
+ */
+#define VIRTIO_F_NOTIFICATION_DATA	38
+
 /*
  * This feature indicates that the driver can reset a queue individually.
  */
diff --git a/include/standard-headers/linux/virtio_net.h b/include/standard-headers/linux/virtio_net.h
index c0e797067a..2325485f2c 100644
--- a/include/standard-headers/linux/virtio_net.h
+++ b/include/standard-headers/linux/virtio_net.h
@@ -61,6 +61,7 @@
 #define VIRTIO_NET_F_GUEST_USO6	55	/* Guest can handle USOv6 in. */
 #define VIRTIO_NET_F_HOST_USO	56	/* Host can handle USO in. */
 #define VIRTIO_NET_F_HASH_REPORT  57	/* Supports hash report */
+#define VIRTIO_NET_F_GUEST_HDRLEN  59	/* Guest provides the exact hdr_len value. */
 #define VIRTIO_NET_F_RSS	  60	/* Supports RSS RX steering */
 #define VIRTIO_NET_F_RSC_EXT	  61	/* extended coalescing info */
 #define VIRTIO_NET_F_STANDBY	  62	/* Act as standby for another device
diff --git a/linux-headers/asm-arm64/bitsperlong.h b/linux-headers/asm-arm64/bitsperlong.h
index 485d60bee2..6dc0bb0c13 100644
--- a/linux-headers/asm-arm64/bitsperlong.h
+++ b/linux-headers/asm-arm64/bitsperlong.h
@@ -1,24 +1 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#ifndef __ASM_BITSPERLONG_H
-#define __ASM_BITSPERLONG_H
-
-#define __BITS_PER_LONG 64
-
 #include <asm-generic/bitsperlong.h>
-
-#endif	/* __ASM_BITSPERLONG_H */
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index d7e7bb885e..38e5957526 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -198,6 +198,15 @@ struct kvm_arm_copy_mte_tags {
 	__u64 reserved[2];
 };
 
+/*
+ * Counter/Timer offset structure. Describe the virtual/physical offset.
+ * To be used with KVM_ARM_SET_COUNTER_OFFSET.
+ */
+struct kvm_arm_counter_offset {
+	__u64 counter_offset;
+	__u64 reserved;
+};
+
 #define KVM_ARM_TAGS_TO_GUEST		0
 #define KVM_ARM_TAGS_FROM_GUEST		1
 
@@ -363,6 +372,10 @@ enum {
 	KVM_REG_ARM_VENDOR_HYP_BIT_PTP		= 1,
 };
 
+/* Device Control API on vm fd */
+#define KVM_ARM_VM_SMCCC_CTRL		0
+#define   KVM_ARM_VM_SMCCC_FILTER	0
+
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR	0
 #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS	1
@@ -402,6 +415,8 @@ enum {
 #define KVM_ARM_VCPU_TIMER_CTRL		1
 #define   KVM_ARM_VCPU_TIMER_IRQ_VTIMER		0
 #define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER		1
+#define   KVM_ARM_VCPU_TIMER_IRQ_HVTIMER	2
+#define   KVM_ARM_VCPU_TIMER_IRQ_HPTIMER	3
 #define KVM_ARM_VCPU_PVTIME_CTRL	2
 #define   KVM_ARM_VCPU_PVTIME_IPA	0
 
@@ -458,6 +473,24 @@ enum {
 /* run->fail_entry.hardware_entry_failure_reason codes. */
 #define KVM_EXIT_FAIL_ENTRY_CPU_UNSUPPORTED	(1ULL << 0)
 
+enum kvm_smccc_filter_action {
+	KVM_SMCCC_FILTER_HANDLE = 0,
+	KVM_SMCCC_FILTER_DENY,
+	KVM_SMCCC_FILTER_FWD_TO_USER,
+
+};
+
+struct kvm_smccc_filter {
+	__u32 base;
+	__u32 nr_functions;
+	__u8 action;
+	__u8 pad[15];
+};
+
+/* arm64-specific KVM_EXIT_HYPERCALL flags */
+#define KVM_HYPERCALL_EXIT_SMC		(1U << 0)
+#define KVM_HYPERCALL_EXIT_16BIT	(1U << 1)
+
 #endif
 
 #endif /* __ARM_KVM_H__ */
diff --git a/linux-headers/asm-generic/bitsperlong.h b/linux-headers/asm-generic/bitsperlong.h
index 0aac245b6b..75f320fa91 100644
--- a/linux-headers/asm-generic/bitsperlong.h
+++ b/linux-headers/asm-generic/bitsperlong.h
@@ -2,6 +2,17 @@
 #ifndef __ASM_GENERIC_BITS_PER_LONG
 #define __ASM_GENERIC_BITS_PER_LONG
 
+#ifndef __BITS_PER_LONG
+/*
+ * In order to keep safe and avoid regression, only unify uapi
+ * bitsperlong.h for some archs which are using newer toolchains
+ * that have the definitions of __CHAR_BIT__ and __SIZEOF_LONG__.
+ * See the following link for more info:
+ * https://lore.kernel.org/linux-arch/b9624545-2c80-49a1-ac3c-39264a591f7b@app.fastmail.com/
+ */
+#if defined(__CHAR_BIT__) && defined(__SIZEOF_LONG__)
+#define __BITS_PER_LONG (__CHAR_BIT__ * __SIZEOF_LONG__)
+#else
 /*
  * There seems to be no way of detecting this automatically from user
  * space, so 64 bit architectures should override this in their
@@ -9,8 +20,8 @@
  * both 32 and 64 bit user space must not rely on CONFIG_64BIT
  * to decide it, but rather check a compiler provided macro.
  */
-#ifndef __BITS_PER_LONG
 #define __BITS_PER_LONG 32
 #endif
+#endif
 
 #endif /* __ASM_GENERIC_BITS_PER_LONG */
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index 45fa180cc5..fd6c1cb585 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -38,12 +38,12 @@ __SYSCALL(__NR_io_destroy, sys_io_destroy)
 __SC_COMP(__NR_io_submit, sys_io_submit, compat_sys_io_submit)
 #define __NR_io_cancel 3
 __SYSCALL(__NR_io_cancel, sys_io_cancel)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_io_getevents 4
 __SC_3264(__NR_io_getevents, sys_io_getevents_time32, sys_io_getevents)
 #endif
 
-/* fs/xattr.c */
 #define __NR_setxattr 5
 __SYSCALL(__NR_setxattr, sys_setxattr)
 #define __NR_lsetxattr 6
@@ -68,58 +68,38 @@ __SYSCALL(__NR_removexattr, sys_removexattr)
 __SYSCALL(__NR_lremovexattr, sys_lremovexattr)
 #define __NR_fremovexattr 16
 __SYSCALL(__NR_fremovexattr, sys_fremovexattr)
-
-/* fs/dcache.c */
 #define __NR_getcwd 17
 __SYSCALL(__NR_getcwd, sys_getcwd)
-
-/* fs/cookies.c */
 #define __NR_lookup_dcookie 18
 __SC_COMP(__NR_lookup_dcookie, sys_lookup_dcookie, compat_sys_lookup_dcookie)
-
-/* fs/eventfd.c */
 #define __NR_eventfd2 19
 __SYSCALL(__NR_eventfd2, sys_eventfd2)
-
-/* fs/eventpoll.c */
 #define __NR_epoll_create1 20
 __SYSCALL(__NR_epoll_create1, sys_epoll_create1)
 #define __NR_epoll_ctl 21
 __SYSCALL(__NR_epoll_ctl, sys_epoll_ctl)
 #define __NR_epoll_pwait 22
 __SC_COMP(__NR_epoll_pwait, sys_epoll_pwait, compat_sys_epoll_pwait)
-
-/* fs/fcntl.c */
 #define __NR_dup 23
 __SYSCALL(__NR_dup, sys_dup)
 #define __NR_dup3 24
 __SYSCALL(__NR_dup3, sys_dup3)
 #define __NR3264_fcntl 25
 __SC_COMP_3264(__NR3264_fcntl, sys_fcntl64, sys_fcntl, compat_sys_fcntl64)
-
-/* fs/inotify_user.c */
 #define __NR_inotify_init1 26
 __SYSCALL(__NR_inotify_init1, sys_inotify_init1)
 #define __NR_inotify_add_watch 27
 __SYSCALL(__NR_inotify_add_watch, sys_inotify_add_watch)
 #define __NR_inotify_rm_watch 28
 __SYSCALL(__NR_inotify_rm_watch, sys_inotify_rm_watch)
-
-/* fs/ioctl.c */
 #define __NR_ioctl 29
 __SC_COMP(__NR_ioctl, sys_ioctl, compat_sys_ioctl)
-
-/* fs/ioprio.c */
 #define __NR_ioprio_set 30
 __SYSCALL(__NR_ioprio_set, sys_ioprio_set)
 #define __NR_ioprio_get 31
 __SYSCALL(__NR_ioprio_get, sys_ioprio_get)
-
-/* fs/locks.c */
 #define __NR_flock 32
 __SYSCALL(__NR_flock, sys_flock)
-
-/* fs/namei.c */
 #define __NR_mknodat 33
 __SYSCALL(__NR_mknodat, sys_mknodat)
 #define __NR_mkdirat 34
@@ -130,25 +110,21 @@ __SYSCALL(__NR_unlinkat, sys_unlinkat)
 __SYSCALL(__NR_symlinkat, sys_symlinkat)
 #define __NR_linkat 37
 __SYSCALL(__NR_linkat, sys_linkat)
+
 #ifdef __ARCH_WANT_RENAMEAT
 /* renameat is superseded with flags by renameat2 */
 #define __NR_renameat 38
 __SYSCALL(__NR_renameat, sys_renameat)
 #endif /* __ARCH_WANT_RENAMEAT */
 
-/* fs/namespace.c */
 #define __NR_umount2 39
 __SYSCALL(__NR_umount2, sys_umount)
 #define __NR_mount 40
 __SYSCALL(__NR_mount, sys_mount)
 #define __NR_pivot_root 41
 __SYSCALL(__NR_pivot_root, sys_pivot_root)
-
-/* fs/nfsctl.c */
 #define __NR_nfsservctl 42
 __SYSCALL(__NR_nfsservctl, sys_ni_syscall)
-
-/* fs/open.c */
 #define __NR3264_statfs 43
 __SC_COMP_3264(__NR3264_statfs, sys_statfs64, sys_statfs, \
 	       compat_sys_statfs64)
@@ -161,7 +137,6 @@ __SC_COMP_3264(__NR3264_truncate, sys_truncate64, sys_truncate, \
 #define __NR3264_ftruncate 46
 __SC_COMP_3264(__NR3264_ftruncate, sys_ftruncate64, sys_ftruncate, \
 	       compat_sys_ftruncate64)
-
 #define __NR_fallocate 47
 __SC_COMP(__NR_fallocate, sys_fallocate, compat_sys_fallocate)
 #define __NR_faccessat 48
@@ -186,20 +161,12 @@ __SYSCALL(__NR_openat, sys_openat)
 __SYSCALL(__NR_close, sys_close)
 #define __NR_vhangup 58
 __SYSCALL(__NR_vhangup, sys_vhangup)
-
-/* fs/pipe.c */
 #define __NR_pipe2 59
 __SYSCALL(__NR_pipe2, sys_pipe2)
-
-/* fs/quota.c */
 #define __NR_quotactl 60
 __SYSCALL(__NR_quotactl, sys_quotactl)
-
-/* fs/readdir.c */
 #define __NR_getdents64 61
 __SYSCALL(__NR_getdents64, sys_getdents64)
-
-/* fs/read_write.c */
 #define __NR3264_lseek 62
 __SC_3264(__NR3264_lseek, sys_llseek, sys_lseek)
 #define __NR_read 63
@@ -218,12 +185,9 @@ __SC_COMP(__NR_pwrite64, sys_pwrite64, compat_sys_pwrite64)
 __SC_COMP(__NR_preadv, sys_preadv, compat_sys_preadv)
 #define __NR_pwritev 70
 __SC_COMP(__NR_pwritev, sys_pwritev, compat_sys_pwritev)
-
-/* fs/sendfile.c */
 #define __NR3264_sendfile 71
 __SYSCALL(__NR3264_sendfile, sys_sendfile64)
 
-/* fs/select.c */
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_pselect6 72
 __SC_COMP_3264(__NR_pselect6, sys_pselect6_time32, sys_pselect6, compat_sys_pselect6_time32)
@@ -231,21 +195,17 @@ __SC_COMP_3264(__NR_pselect6, sys_pselect6_time32, sys_pselect6, compat_sys_psel
 __SC_COMP_3264(__NR_ppoll, sys_ppoll_time32, sys_ppoll, compat_sys_ppoll_time32)
 #endif
 
-/* fs/signalfd.c */
 #define __NR_signalfd4 74
 __SC_COMP(__NR_signalfd4, sys_signalfd4, compat_sys_signalfd4)
-
-/* fs/splice.c */
 #define __NR_vmsplice 75
 __SYSCALL(__NR_vmsplice, sys_vmsplice)
 #define __NR_splice 76
 __SYSCALL(__NR_splice, sys_splice)
 #define __NR_tee 77
 __SYSCALL(__NR_tee, sys_tee)
-
-/* fs/stat.c */
 #define __NR_readlinkat 78
 __SYSCALL(__NR_readlinkat, sys_readlinkat)
+
 #if defined(__ARCH_WANT_NEW_STAT) || defined(__ARCH_WANT_STAT64)
 #define __NR3264_fstatat 79
 __SC_3264(__NR3264_fstatat, sys_fstatat64, sys_newfstatat)
@@ -253,13 +213,13 @@ __SC_3264(__NR3264_fstatat, sys_fstatat64, sys_newfstatat)
 __SC_3264(__NR3264_fstat, sys_fstat64, sys_newfstat)
 #endif
 
-/* fs/sync.c */
 #define __NR_sync 81
 __SYSCALL(__NR_sync, sys_sync)
 #define __NR_fsync 82
 __SYSCALL(__NR_fsync, sys_fsync)
 #define __NR_fdatasync 83
 __SYSCALL(__NR_fdatasync, sys_fdatasync)
+
 #ifdef __ARCH_WANT_SYNC_FILE_RANGE2
 #define __NR_sync_file_range2 84
 __SC_COMP(__NR_sync_file_range2, sys_sync_file_range2, \
@@ -270,9 +230,9 @@ __SC_COMP(__NR_sync_file_range, sys_sync_file_range, \
 	  compat_sys_sync_file_range)
 #endif
 
-/* fs/timerfd.c */
 #define __NR_timerfd_create 85
 __SYSCALL(__NR_timerfd_create, sys_timerfd_create)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_timerfd_settime 86
 __SC_3264(__NR_timerfd_settime, sys_timerfd_settime32, \
@@ -282,45 +242,35 @@ __SC_3264(__NR_timerfd_gettime, sys_timerfd_gettime32, \
 	  sys_timerfd_gettime)
 #endif
 
-/* fs/utimes.c */
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_utimensat 88
 __SC_3264(__NR_utimensat, sys_utimensat_time32, sys_utimensat)
 #endif
 
-/* kernel/acct.c */
 #define __NR_acct 89
 __SYSCALL(__NR_acct, sys_acct)
-
-/* kernel/capability.c */
 #define __NR_capget 90
 __SYSCALL(__NR_capget, sys_capget)
 #define __NR_capset 91
 __SYSCALL(__NR_capset, sys_capset)
-
-/* kernel/exec_domain.c */
 #define __NR_personality 92
 __SYSCALL(__NR_personality, sys_personality)
-
-/* kernel/exit.c */
 #define __NR_exit 93
 __SYSCALL(__NR_exit, sys_exit)
 #define __NR_exit_group 94
 __SYSCALL(__NR_exit_group, sys_exit_group)
 #define __NR_waitid 95
 __SC_COMP(__NR_waitid, sys_waitid, compat_sys_waitid)
-
-/* kernel/fork.c */
 #define __NR_set_tid_address 96
 __SYSCALL(__NR_set_tid_address, sys_set_tid_address)
 #define __NR_unshare 97
 __SYSCALL(__NR_unshare, sys_unshare)
 
-/* kernel/futex.c */
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_futex 98
 __SC_3264(__NR_futex, sys_futex_time32, sys_futex)
 #endif
+
 #define __NR_set_robust_list 99
 __SC_COMP(__NR_set_robust_list, sys_set_robust_list, \
 	  compat_sys_set_robust_list)
@@ -328,43 +278,40 @@ __SC_COMP(__NR_set_robust_list, sys_set_robust_list, \
 __SC_COMP(__NR_get_robust_list, sys_get_robust_list, \
 	  compat_sys_get_robust_list)
 
-/* kernel/hrtimer.c */
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_nanosleep 101
 __SC_3264(__NR_nanosleep, sys_nanosleep_time32, sys_nanosleep)
 #endif
 
-/* kernel/itimer.c */
 #define __NR_getitimer 102
 __SC_COMP(__NR_getitimer, sys_getitimer, compat_sys_getitimer)
 #define __NR_setitimer 103
 __SC_COMP(__NR_setitimer, sys_setitimer, compat_sys_setitimer)
-
-/* kernel/kexec.c */
 #define __NR_kexec_load 104
 __SC_COMP(__NR_kexec_load, sys_kexec_load, compat_sys_kexec_load)
-
-/* kernel/module.c */
 #define __NR_init_module 105
 __SYSCALL(__NR_init_module, sys_init_module)
 #define __NR_delete_module 106
 __SYSCALL(__NR_delete_module, sys_delete_module)
-
-/* kernel/posix-timers.c */
 #define __NR_timer_create 107
 __SC_COMP(__NR_timer_create, sys_timer_create, compat_sys_timer_create)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_timer_gettime 108
 __SC_3264(__NR_timer_gettime, sys_timer_gettime32, sys_timer_gettime)
 #endif
+
 #define __NR_timer_getoverrun 109
 __SYSCALL(__NR_timer_getoverrun, sys_timer_getoverrun)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_timer_settime 110
 __SC_3264(__NR_timer_settime, sys_timer_settime32, sys_timer_settime)
 #endif
+
 #define __NR_timer_delete 111
 __SYSCALL(__NR_timer_delete, sys_timer_delete)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_clock_settime 112
 __SC_3264(__NR_clock_settime, sys_clock_settime32, sys_clock_settime)
@@ -377,15 +324,10 @@ __SC_3264(__NR_clock_nanosleep, sys_clock_nanosleep_time32, \
 	  sys_clock_nanosleep)
 #endif
 
-/* kernel/printk.c */
 #define __NR_syslog 116
 __SYSCALL(__NR_syslog, sys_syslog)
-
-/* kernel/ptrace.c */
 #define __NR_ptrace 117
 __SC_COMP(__NR_ptrace, sys_ptrace, compat_sys_ptrace)
-
-/* kernel/sched/core.c */
 #define __NR_sched_setparam 118
 __SYSCALL(__NR_sched_setparam, sys_sched_setparam)
 #define __NR_sched_setscheduler 119
@@ -406,13 +348,13 @@ __SYSCALL(__NR_sched_yield, sys_sched_yield)
 __SYSCALL(__NR_sched_get_priority_max, sys_sched_get_priority_max)
 #define __NR_sched_get_priority_min 126
 __SYSCALL(__NR_sched_get_priority_min, sys_sched_get_priority_min)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_sched_rr_get_interval 127
 __SC_3264(__NR_sched_rr_get_interval, sys_sched_rr_get_interval_time32, \
 	  sys_sched_rr_get_interval)
 #endif
 
-/* kernel/signal.c */
 #define __NR_restart_syscall 128
 __SYSCALL(__NR_restart_syscall, sys_restart_syscall)
 #define __NR_kill 129
@@ -431,18 +373,18 @@ __SC_COMP(__NR_rt_sigaction, sys_rt_sigaction, compat_sys_rt_sigaction)
 __SC_COMP(__NR_rt_sigprocmask, sys_rt_sigprocmask, compat_sys_rt_sigprocmask)
 #define __NR_rt_sigpending 136
 __SC_COMP(__NR_rt_sigpending, sys_rt_sigpending, compat_sys_rt_sigpending)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_rt_sigtimedwait 137
 __SC_COMP_3264(__NR_rt_sigtimedwait, sys_rt_sigtimedwait_time32, \
 	  sys_rt_sigtimedwait, compat_sys_rt_sigtimedwait_time32)
 #endif
+
 #define __NR_rt_sigqueueinfo 138
 __SC_COMP(__NR_rt_sigqueueinfo, sys_rt_sigqueueinfo, \
 	  compat_sys_rt_sigqueueinfo)
 #define __NR_rt_sigreturn 139
 __SC_COMP(__NR_rt_sigreturn, sys_rt_sigreturn, compat_sys_rt_sigreturn)
-
-/* kernel/sys.c */
 #define __NR_setpriority 140
 __SYSCALL(__NR_setpriority, sys_setpriority)
 #define __NR_getpriority 141
@@ -507,7 +449,6 @@ __SYSCALL(__NR_prctl, sys_prctl)
 #define __NR_getcpu 168
 __SYSCALL(__NR_getcpu, sys_getcpu)
 
-/* kernel/time.c */
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_gettimeofday 169
 __SC_COMP(__NR_gettimeofday, sys_gettimeofday, compat_sys_gettimeofday)
@@ -517,7 +458,6 @@ __SC_COMP(__NR_settimeofday, sys_settimeofday, compat_sys_settimeofday)
 __SC_3264(__NR_adjtimex, sys_adjtimex_time32, sys_adjtimex)
 #endif
 
-/* kernel/sys.c */
 #define __NR_getpid 172
 __SYSCALL(__NR_getpid, sys_getpid)
 #define __NR_getppid 173
@@ -534,12 +474,11 @@ __SYSCALL(__NR_getegid, sys_getegid)
 __SYSCALL(__NR_gettid, sys_gettid)
 #define __NR_sysinfo 179
 __SC_COMP(__NR_sysinfo, sys_sysinfo, compat_sys_sysinfo)
-
-/* ipc/mqueue.c */
 #define __NR_mq_open 180
 __SC_COMP(__NR_mq_open, sys_mq_open, compat_sys_mq_open)
 #define __NR_mq_unlink 181
 __SYSCALL(__NR_mq_unlink, sys_mq_unlink)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_mq_timedsend 182
 __SC_3264(__NR_mq_timedsend, sys_mq_timedsend_time32, sys_mq_timedsend)
@@ -547,12 +486,11 @@ __SC_3264(__NR_mq_timedsend, sys_mq_timedsend_time32, sys_mq_timedsend)
 __SC_3264(__NR_mq_timedreceive, sys_mq_timedreceive_time32, \
 	  sys_mq_timedreceive)
 #endif
+
 #define __NR_mq_notify 184
 __SC_COMP(__NR_mq_notify, sys_mq_notify, compat_sys_mq_notify)
 #define __NR_mq_getsetattr 185
 __SC_COMP(__NR_mq_getsetattr, sys_mq_getsetattr, compat_sys_mq_getsetattr)
-
-/* ipc/msg.c */
 #define __NR_msgget 186
 __SYSCALL(__NR_msgget, sys_msgget)
 #define __NR_msgctl 187
@@ -561,20 +499,18 @@ __SC_COMP(__NR_msgctl, sys_msgctl, compat_sys_msgctl)
 __SC_COMP(__NR_msgrcv, sys_msgrcv, compat_sys_msgrcv)
 #define __NR_msgsnd 189
 __SC_COMP(__NR_msgsnd, sys_msgsnd, compat_sys_msgsnd)
-
-/* ipc/sem.c */
 #define __NR_semget 190
 __SYSCALL(__NR_semget, sys_semget)
 #define __NR_semctl 191
 __SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_semtimedop 192
 __SC_3264(__NR_semtimedop, sys_semtimedop_time32, sys_semtimedop)
 #endif
+
 #define __NR_semop 193
 __SYSCALL(__NR_semop, sys_semop)
-
-/* ipc/shm.c */
 #define __NR_shmget 194
 __SYSCALL(__NR_shmget, sys_shmget)
 #define __NR_shmctl 195
@@ -583,8 +519,6 @@ __SC_COMP(__NR_shmctl, sys_shmctl, compat_sys_shmctl)
 __SC_COMP(__NR_shmat, sys_shmat, compat_sys_shmat)
 #define __NR_shmdt 197
 __SYSCALL(__NR_shmdt, sys_shmdt)
-
-/* net/socket.c */
 #define __NR_socket 198
 __SYSCALL(__NR_socket, sys_socket)
 #define __NR_socketpair 199
@@ -615,40 +549,30 @@ __SYSCALL(__NR_shutdown, sys_shutdown)
 __SC_COMP(__NR_sendmsg, sys_sendmsg, compat_sys_sendmsg)
 #define __NR_recvmsg 212
 __SC_COMP(__NR_recvmsg, sys_recvmsg, compat_sys_recvmsg)
-
-/* mm/filemap.c */
 #define __NR_readahead 213
 __SC_COMP(__NR_readahead, sys_readahead, compat_sys_readahead)
-
-/* mm/nommu.c, also with MMU */
 #define __NR_brk 214
 __SYSCALL(__NR_brk, sys_brk)
 #define __NR_munmap 215
 __SYSCALL(__NR_munmap, sys_munmap)
 #define __NR_mremap 216
 __SYSCALL(__NR_mremap, sys_mremap)
-
-/* security/keys/keyctl.c */
 #define __NR_add_key 217
 __SYSCALL(__NR_add_key, sys_add_key)
 #define __NR_request_key 218
 __SYSCALL(__NR_request_key, sys_request_key)
 #define __NR_keyctl 219
 __SC_COMP(__NR_keyctl, sys_keyctl, compat_sys_keyctl)
-
-/* arch/example/kernel/sys_example.c */
 #define __NR_clone 220
 __SYSCALL(__NR_clone, sys_clone)
 #define __NR_execve 221
 __SC_COMP(__NR_execve, sys_execve, compat_sys_execve)
-
 #define __NR3264_mmap 222
 __SC_3264(__NR3264_mmap, sys_mmap2, sys_mmap)
-/* mm/fadvise.c */
 #define __NR3264_fadvise64 223
 __SC_COMP(__NR3264_fadvise64, sys_fadvise64_64, compat_sys_fadvise64_64)
 
-/* mm/, CONFIG_MMU only */
+/* CONFIG_MMU only */
 #ifndef __ARCH_NOMMU
 #define __NR_swapon 224
 __SYSCALL(__NR_swapon, sys_swapon)
@@ -691,6 +615,7 @@ __SC_COMP(__NR_rt_tgsigqueueinfo, sys_rt_tgsigqueueinfo, \
 __SYSCALL(__NR_perf_event_open, sys_perf_event_open)
 #define __NR_accept4 242
 __SYSCALL(__NR_accept4, sys_accept4)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_recvmmsg 243
 __SC_COMP_3264(__NR_recvmmsg, sys_recvmmsg_time32, sys_recvmmsg, compat_sys_recvmmsg_time32)
@@ -706,6 +631,7 @@ __SC_COMP_3264(__NR_recvmmsg, sys_recvmmsg_time32, sys_recvmmsg, compat_sys_recv
 #define __NR_wait4 260
 __SC_COMP(__NR_wait4, sys_wait4, compat_sys_wait4)
 #endif
+
 #define __NR_prlimit64 261
 __SYSCALL(__NR_prlimit64, sys_prlimit64)
 #define __NR_fanotify_init 262
@@ -716,10 +642,12 @@ __SYSCALL(__NR_fanotify_mark, sys_fanotify_mark)
 __SYSCALL(__NR_name_to_handle_at, sys_name_to_handle_at)
 #define __NR_open_by_handle_at         265
 __SYSCALL(__NR_open_by_handle_at, sys_open_by_handle_at)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_clock_adjtime 266
 __SC_3264(__NR_clock_adjtime, sys_clock_adjtime32, sys_clock_adjtime)
 #endif
+
 #define __NR_syncfs 267
 __SYSCALL(__NR_syncfs, sys_syncfs)
 #define __NR_setns 268
@@ -770,15 +698,19 @@ __SYSCALL(__NR_pkey_alloc,    sys_pkey_alloc)
 __SYSCALL(__NR_pkey_free,     sys_pkey_free)
 #define __NR_statx 291
 __SYSCALL(__NR_statx,     sys_statx)
+
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_io_pgetevents 292
 __SC_COMP_3264(__NR_io_pgetevents, sys_io_pgetevents_time32, sys_io_pgetevents, compat_sys_io_pgetevents)
 #endif
+
 #define __NR_rseq 293
 __SYSCALL(__NR_rseq, sys_rseq)
 #define __NR_kexec_file_load 294
 __SYSCALL(__NR_kexec_file_load,     sys_kexec_file_load)
+
 /* 295 through 402 are unassigned to sync up with generic numbers, don't use */
+
 #if defined(__SYSCALL_COMPAT) || __BITS_PER_LONG == 32
 #define __NR_clock_gettime64 403
 __SYSCALL(__NR_clock_gettime64, sys_clock_gettime)
@@ -844,13 +776,14 @@ __SYSCALL(__NR_fsmount, sys_fsmount)
 __SYSCALL(__NR_fspick, sys_fspick)
 #define __NR_pidfd_open 434
 __SYSCALL(__NR_pidfd_open, sys_pidfd_open)
+
 #ifdef __ARCH_WANT_SYS_CLONE3
 #define __NR_clone3 435
 __SYSCALL(__NR_clone3, sys_clone3)
 #endif
+
 #define __NR_close_range 436
 __SYSCALL(__NR_close_range, sys_close_range)
-
 #define __NR_openat2 437
 __SYSCALL(__NR_openat2, sys_openat2)
 #define __NR_pidfd_getfd 438
@@ -865,7 +798,6 @@ __SC_COMP(__NR_epoll_pwait2, sys_epoll_pwait2, compat_sys_epoll_pwait2)
 __SYSCALL(__NR_mount_setattr, sys_mount_setattr)
 #define __NR_quotactl_fd 443
 __SYSCALL(__NR_quotactl_fd, sys_quotactl_fd)
-
 #define __NR_landlock_create_ruleset 444
 __SYSCALL(__NR_landlock_create_ruleset, sys_landlock_create_ruleset)
 #define __NR_landlock_add_rule 445
@@ -877,17 +809,19 @@ __SYSCALL(__NR_landlock_restrict_self, sys_landlock_restrict_self)
 #define __NR_memfd_secret 447
 __SYSCALL(__NR_memfd_secret, sys_memfd_secret)
 #endif
+
 #define __NR_process_mrelease 448
 __SYSCALL(__NR_process_mrelease, sys_process_mrelease)
-
 #define __NR_futex_waitv 449
 __SYSCALL(__NR_futex_waitv, sys_futex_waitv)
-
 #define __NR_set_mempolicy_home_node 450
 __SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node)
 
+#define __NR_cachestat 451
+__SYSCALL(__NR_cachestat, sys_cachestat)
+
 #undef __NR_syscalls
-#define __NR_syscalls 451
+#define __NR_syscalls 452
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index 1f14a6fad3..8233f061c4 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -379,5 +379,6 @@
 #define __NR_process_mrelease (__NR_Linux + 448)
 #define __NR_futex_waitv (__NR_Linux + 449)
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+#define __NR_cachestat (__NR_Linux + 451)
 
 #endif /* _ASM_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index e5a8ebec78..a174edc768 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -355,5 +355,6 @@
 #define __NR_process_mrelease (__NR_Linux + 448)
 #define __NR_futex_waitv (__NR_Linux + 449)
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+#define __NR_cachestat (__NR_Linux + 451)
 
 #endif /* _ASM_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index 871d57168f..c1a5351d9b 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -425,5 +425,6 @@
 #define __NR_process_mrelease (__NR_Linux + 448)
 #define __NR_futex_waitv (__NR_Linux + 449)
 #define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+#define __NR_cachestat (__NR_Linux + 451)
 
 #endif /* _ASM_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index 585c7fefbc..8206758691 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -432,6 +432,7 @@
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
 #define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index 350f7ec0ac..7be98c15f0 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -404,6 +404,7 @@
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
 #define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/bitsperlong.h b/linux-headers/asm-riscv/bitsperlong.h
index cc5c45a9ce..6dc0bb0c13 100644
--- a/linux-headers/asm-riscv/bitsperlong.h
+++ b/linux-headers/asm-riscv/bitsperlong.h
@@ -1,14 +1 @@
-/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
-/*
- * Copyright (C) 2012 ARM Ltd.
- * Copyright (C) 2015 Regents of the University of California
- */
-
-#ifndef _ASM_RISCV_BITSPERLONG_H
-#define _ASM_RISCV_BITSPERLONG_H
-
-#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
-
 #include <asm-generic/bitsperlong.h>
-
-#endif /* _ASM_RISCV_BITSPERLONG_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index 92af6f3f05..930fdc4101 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -12,8 +12,10 @@
 #ifndef __ASSEMBLY__
 
 #include <linux/types.h>
+#include <asm/bitsperlong.h>
 #include <asm/ptrace.h>
 
+#define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
@@ -52,6 +54,7 @@ struct kvm_riscv_config {
 	unsigned long mvendorid;
 	unsigned long marchid;
 	unsigned long mimpid;
+	unsigned long zicboz_block_size;
 };
 
 /* CORE registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
@@ -64,7 +67,7 @@ struct kvm_riscv_core {
 #define KVM_RISCV_MODE_S	1
 #define KVM_RISCV_MODE_U	0
 
-/* CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+/* General CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
 struct kvm_riscv_csr {
 	unsigned long sstatus;
 	unsigned long sie;
@@ -78,6 +81,17 @@ struct kvm_riscv_csr {
 	unsigned long scounteren;
 };
 
+/* AIA CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_aia_csr {
+	unsigned long siselect;
+	unsigned long iprio1;
+	unsigned long iprio2;
+	unsigned long sieh;
+	unsigned long siph;
+	unsigned long iprio1h;
+	unsigned long iprio2h;
+};
+
 /* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
 struct kvm_riscv_timer {
 	__u64 frequency;
@@ -105,9 +119,31 @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_SVINVAL,
 	KVM_RISCV_ISA_EXT_ZIHINTPAUSE,
 	KVM_RISCV_ISA_EXT_ZICBOM,
+	KVM_RISCV_ISA_EXT_ZICBOZ,
+	KVM_RISCV_ISA_EXT_ZBB,
+	KVM_RISCV_ISA_EXT_SSAIA,
+	KVM_RISCV_ISA_EXT_V,
+	KVM_RISCV_ISA_EXT_SVNAPOT,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
+/*
+ * SBI extension IDs specific to KVM. This is not the same as the SBI
+ * extension IDs defined by the RISC-V SBI specification.
+ */
+enum KVM_RISCV_SBI_EXT_ID {
+	KVM_RISCV_SBI_EXT_V01 = 0,
+	KVM_RISCV_SBI_EXT_TIME,
+	KVM_RISCV_SBI_EXT_IPI,
+	KVM_RISCV_SBI_EXT_RFENCE,
+	KVM_RISCV_SBI_EXT_SRST,
+	KVM_RISCV_SBI_EXT_HSM,
+	KVM_RISCV_SBI_EXT_PMU,
+	KVM_RISCV_SBI_EXT_EXPERIMENTAL,
+	KVM_RISCV_SBI_EXT_VENDOR,
+	KVM_RISCV_SBI_EXT_MAX,
+};
+
 /* Possible states for kvm_riscv_timer */
 #define KVM_RISCV_TIMER_STATE_OFF	0
 #define KVM_RISCV_TIMER_STATE_ON	1
@@ -118,6 +154,8 @@ enum KVM_RISCV_ISA_EXT_ID {
 /* If you need to interpret the index values, here is the key: */
 #define KVM_REG_RISCV_TYPE_MASK		0x00000000FF000000
 #define KVM_REG_RISCV_TYPE_SHIFT	24
+#define KVM_REG_RISCV_SUBTYPE_MASK	0x0000000000FF0000
+#define KVM_REG_RISCV_SUBTYPE_SHIFT	16
 
 /* Config registers are mapped as type 1 */
 #define KVM_REG_RISCV_CONFIG		(0x01 << KVM_REG_RISCV_TYPE_SHIFT)
@@ -131,8 +169,12 @@ enum KVM_RISCV_ISA_EXT_ID {
 
 /* Control and status registers are mapped as type 3 */
 #define KVM_REG_RISCV_CSR		(0x03 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_CSR_GENERAL	(0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_CSR_AIA		(0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 #define KVM_REG_RISCV_CSR_REG(name)	\
 		(offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
+#define KVM_REG_RISCV_CSR_AIA_REG(name)	\
+	(offsetof(struct kvm_riscv_aia_csr, name) / sizeof(unsigned long))
 
 /* Timer registers are mapped as type 4 */
 #define KVM_REG_RISCV_TIMER		(0x04 << KVM_REG_RISCV_TYPE_SHIFT)
@@ -152,6 +194,96 @@ enum KVM_RISCV_ISA_EXT_ID {
 /* ISA Extension registers are mapped as type 7 */
 #define KVM_REG_RISCV_ISA_EXT		(0x07 << KVM_REG_RISCV_TYPE_SHIFT)
 
+/* SBI extension registers are mapped as type 8 */
+#define KVM_REG_RISCV_SBI_EXT		(0x08 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_SINGLE	(0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_MULTI_EN	(0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_MULTI_DIS	(0x2 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_MULTI_REG(__ext_id)	\
+		((__ext_id) / __BITS_PER_LONG)
+#define KVM_REG_RISCV_SBI_MULTI_MASK(__ext_id)	\
+		(1UL << ((__ext_id) % __BITS_PER_LONG))
+#define KVM_REG_RISCV_SBI_MULTI_REG_LAST	\
+		KVM_REG_RISCV_SBI_MULTI_REG(KVM_RISCV_SBI_EXT_MAX - 1)
+
+/* V extension registers are mapped as type 9 */
+#define KVM_REG_RISCV_VECTOR		(0x09 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_VECTOR_CSR_REG(name)	\
+		(offsetof(struct __riscv_v_ext_state, name) / sizeof(unsigned long))
+#define KVM_REG_RISCV_VECTOR_REG(n)	\
+		((n) + sizeof(struct __riscv_v_ext_state) / sizeof(unsigned long))
+
+/* Device Control API: RISC-V AIA */
+#define KVM_DEV_RISCV_APLIC_ALIGN		0x1000
+#define KVM_DEV_RISCV_APLIC_SIZE		0x4000
+#define KVM_DEV_RISCV_APLIC_MAX_HARTS		0x4000
+#define KVM_DEV_RISCV_IMSIC_ALIGN		0x1000
+#define KVM_DEV_RISCV_IMSIC_SIZE		0x1000
+
+#define KVM_DEV_RISCV_AIA_GRP_CONFIG		0
+#define KVM_DEV_RISCV_AIA_CONFIG_MODE		0
+#define KVM_DEV_RISCV_AIA_CONFIG_IDS		1
+#define KVM_DEV_RISCV_AIA_CONFIG_SRCS		2
+#define KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS	3
+#define KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT	4
+#define KVM_DEV_RISCV_AIA_CONFIG_HART_BITS	5
+#define KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS	6
+
+/*
+ * Modes of RISC-V AIA device:
+ * 1) EMUL (aka Emulation): Trap-n-emulate IMSIC
+ * 2) HWACCEL (aka HW Acceleration): Virtualize IMSIC using IMSIC guest files
+ * 3) AUTO (aka Automatic): Virtualize IMSIC using IMSIC guest files whenever
+ *    available otherwise fallback to trap-n-emulation
+ */
+#define KVM_DEV_RISCV_AIA_MODE_EMUL		0
+#define KVM_DEV_RISCV_AIA_MODE_HWACCEL		1
+#define KVM_DEV_RISCV_AIA_MODE_AUTO		2
+
+#define KVM_DEV_RISCV_AIA_IDS_MIN		63
+#define KVM_DEV_RISCV_AIA_IDS_MAX		2048
+#define KVM_DEV_RISCV_AIA_SRCS_MAX		1024
+#define KVM_DEV_RISCV_AIA_GROUP_BITS_MAX	8
+#define KVM_DEV_RISCV_AIA_GROUP_SHIFT_MIN	24
+#define KVM_DEV_RISCV_AIA_GROUP_SHIFT_MAX	56
+#define KVM_DEV_RISCV_AIA_HART_BITS_MAX		16
+#define KVM_DEV_RISCV_AIA_GUEST_BITS_MAX	8
+
+#define KVM_DEV_RISCV_AIA_GRP_ADDR		1
+#define KVM_DEV_RISCV_AIA_ADDR_APLIC		0
+#define KVM_DEV_RISCV_AIA_ADDR_IMSIC(__vcpu)	(1 + (__vcpu))
+#define KVM_DEV_RISCV_AIA_ADDR_MAX		\
+		(1 + KVM_DEV_RISCV_APLIC_MAX_HARTS)
+
+#define KVM_DEV_RISCV_AIA_GRP_CTRL		2
+#define KVM_DEV_RISCV_AIA_CTRL_INIT		0
+
+/*
+ * The device attribute type contains the memory mapped offset of the
+ * APLIC register (range 0x0000-0x3FFF) and it must be 4-byte aligned.
+ */
+#define KVM_DEV_RISCV_AIA_GRP_APLIC		3
+
+/*
+ * The lower 12-bits of the device attribute type contains the iselect
+ * value of the IMSIC register (range 0x70-0xFF) whereas the higher order
+ * bits contains the VCPU id.
+ */
+#define KVM_DEV_RISCV_AIA_GRP_IMSIC		4
+#define KVM_DEV_RISCV_AIA_IMSIC_ISEL_BITS	12
+#define KVM_DEV_RISCV_AIA_IMSIC_ISEL_MASK	\
+		((1U << KVM_DEV_RISCV_AIA_IMSIC_ISEL_BITS) - 1)
+#define KVM_DEV_RISCV_AIA_IMSIC_MKATTR(__vcpu, __isel)	\
+		(((__vcpu) << KVM_DEV_RISCV_AIA_IMSIC_ISEL_BITS) | \
+		 ((__isel) & KVM_DEV_RISCV_AIA_IMSIC_ISEL_MASK))
+#define KVM_DEV_RISCV_AIA_IMSIC_GET_ISEL(__attr)	\
+		((__attr) & KVM_DEV_RISCV_AIA_IMSIC_ISEL_MASK)
+#define KVM_DEV_RISCV_AIA_IMSIC_GET_VCPU(__attr)	\
+		((__attr) >> KVM_DEV_RISCV_AIA_IMSIC_ISEL_BITS)
+
+/* One single KVM irqchip, ie. the AIA */
+#define KVM_NR_IRQCHIPS			1
+
 #endif
 
 #endif /* __LINUX_KVM_RISCV_H */
diff --git a/linux-headers/asm-riscv/unistd.h b/linux-headers/asm-riscv/unistd.h
index 73d7cdd2ec..950ab3fd44 100644
--- a/linux-headers/asm-riscv/unistd.h
+++ b/linux-headers/asm-riscv/unistd.h
@@ -43,3 +43,12 @@
 #define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
 #endif
 __SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
+
+/*
+ * Allows userspace to query the kernel for CPU architecture and
+ * microarchitecture details across a given set of CPUs.
+ */
+#ifndef __NR_riscv_hwprobe
+#define __NR_riscv_hwprobe (__NR_arch_specific_syscall + 14)
+#endif
+__SYSCALL(__NR_riscv_hwprobe, sys_riscv_hwprobe)
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index 8e644d65f5..ef772cc5f8 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -419,8 +419,10 @@
 #define __NR_landlock_create_ruleset 444
 #define __NR_landlock_add_rule 445
 #define __NR_landlock_restrict_self 446
+#define __NR_memfd_secret 447
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
 #define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index 51da542fec..32354a0459 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -367,8 +367,10 @@
 #define __NR_landlock_create_ruleset 444
 #define __NR_landlock_add_rule 445
 #define __NR_landlock_restrict_self 446
+#define __NR_memfd_secret 447
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
 #define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index 2937e7bf69..2b3a8f7bd2 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -557,4 +557,7 @@ struct kvm_pmu_event_filter {
 #define KVM_VCPU_TSC_CTRL 0 /* control group for the timestamp counter (TSC) */
 #define   KVM_VCPU_TSC_OFFSET 0 /* attribute for the TSC offset */
 
+/* x86-specific KVM_EXIT_HYPERCALL flags. */
+#define KVM_EXIT_HYPERCALL_LONG_MODE	BIT(0)
+
 #endif /* _ASM_X86_KVM_H */
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index 87e1e977af..37b32d8139 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -441,6 +441,7 @@
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
 #define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index 147a78d623..5b55d6729a 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -363,6 +363,7 @@
 #define __NR_process_mrelease 448
 #define __NR_futex_waitv 449
 #define __NR_set_mempolicy_home_node 450
+#define __NR_cachestat 451
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index 27098db7fb..e8a007543d 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -316,6 +316,7 @@
 #define __NR_process_mrelease (__X32_SYSCALL_BIT + 448)
 #define __NR_futex_waitv (__X32_SYSCALL_BIT + 449)
 #define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
+#define __NR_cachestat (__X32_SYSCALL_BIT + 451)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/const.h b/linux-headers/linux/const.h
index 5e48987251..1eb84b5087 100644
--- a/linux-headers/linux/const.h
+++ b/linux-headers/linux/const.h
@@ -28,7 +28,7 @@
 #define _BITUL(x)	(_UL(1) << (x))
 #define _BITULL(x)	(_ULL(1) << (x))
 
-#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+#define __ALIGN_KERNEL(x, a)		__ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
 #define __ALIGN_KERNEL_MASK(x, mask)	(((x) + (mask)) & ~(mask))
 
 #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index 599de3c6e3..1f3f3333a4 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -341,8 +341,11 @@ struct kvm_run {
 			__u64 nr;
 			__u64 args[6];
 			__u64 ret;
-			__u32 longmode;
-			__u32 pad;
+
+			union {
+				__u32 longmode;
+				__u64 flags;
+			};
 		} hypercall;
 		/* KVM_EXIT_TPR_ACCESS */
 		struct {
@@ -1182,6 +1185,9 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_S390_PROTECTED_ASYNC_DISABLE 224
 #define KVM_CAP_DIRTY_LOG_RING_WITH_BITMAP 225
 #define KVM_CAP_PMU_EVENT_MASKED_EVENTS 226
+#define KVM_CAP_COUNTER_OFFSET 227
+#define KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE 228
+#define KVM_CAP_ARM_SUPPORTED_BLOCK_SIZES 229
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -1434,6 +1440,8 @@ enum kvm_device_type {
 #define KVM_DEV_TYPE_XIVE		KVM_DEV_TYPE_XIVE
 	KVM_DEV_TYPE_ARM_PV_TIME,
 #define KVM_DEV_TYPE_ARM_PV_TIME	KVM_DEV_TYPE_ARM_PV_TIME
+	KVM_DEV_TYPE_RISCV_AIA,
+#define KVM_DEV_TYPE_RISCV_AIA		KVM_DEV_TYPE_RISCV_AIA
 	KVM_DEV_TYPE_MAX,
 };
 
@@ -1449,7 +1457,7 @@ struct kvm_vfio_spapr_tce {
 #define KVM_CREATE_VCPU           _IO(KVMIO,   0x41)
 #define KVM_GET_DIRTY_LOG         _IOW(KVMIO,  0x42, struct kvm_dirty_log)
 #define KVM_SET_NR_MMU_PAGES      _IO(KVMIO,   0x44)
-#define KVM_GET_NR_MMU_PAGES      _IO(KVMIO,   0x45)
+#define KVM_GET_NR_MMU_PAGES      _IO(KVMIO,   0x45)  /* deprecated */
 #define KVM_SET_USER_MEMORY_REGION _IOW(KVMIO, 0x46, \
 					struct kvm_userspace_memory_region)
 #define KVM_SET_TSS_ADDR          _IO(KVMIO,   0x47)
@@ -1541,6 +1549,8 @@ struct kvm_s390_ucas_mapping {
 #define KVM_SET_PMU_EVENT_FILTER  _IOW(KVMIO,  0xb2, struct kvm_pmu_event_filter)
 #define KVM_PPC_SVM_OFF		  _IO(KVMIO,  0xb3)
 #define KVM_ARM_MTE_COPY_TAGS	  _IOR(KVMIO,  0xb4, struct kvm_arm_copy_mte_tags)
+/* Available with KVM_CAP_COUNTER_OFFSET */
+#define KVM_ARM_SET_COUNTER_OFFSET _IOW(KVMIO,  0xb5, struct kvm_arm_counter_offset)
 
 /* ioctl for vm fd */
 #define KVM_CREATE_DEVICE	  _IOWR(KVMIO,  0xe0, struct kvm_create_device)
@@ -1603,7 +1613,7 @@ struct kvm_s390_ucas_mapping {
 #define KVM_GET_DEBUGREGS         _IOR(KVMIO,  0xa1, struct kvm_debugregs)
 #define KVM_SET_DEBUGREGS         _IOW(KVMIO,  0xa2, struct kvm_debugregs)
 /*
- * vcpu version available with KVM_ENABLE_CAP
+ * vcpu version available with KVM_CAP_ENABLE_CAP
  * vm version available with KVM_CAP_ENABLE_CAP_VM
  */
 #define KVM_ENABLE_CAP            _IOW(KVMIO,  0xa3, struct kvm_enable_cap)
diff --git a/linux-headers/linux/mman.h b/linux-headers/linux/mman.h
index 434986fbe3..4e8cb60780 100644
--- a/linux-headers/linux/mman.h
+++ b/linux-headers/linux/mman.h
@@ -4,6 +4,7 @@
 
 #include <asm/mman.h>
 #include <asm-generic/hugetlb_encode.h>
+#include <linux/types.h>
 
 #define MREMAP_MAYMOVE		1
 #define MREMAP_FIXED		2
@@ -41,4 +42,17 @@
 #define MAP_HUGE_2GB	HUGETLB_FLAG_ENCODE_2GB
 #define MAP_HUGE_16GB	HUGETLB_FLAG_ENCODE_16GB
 
+struct cachestat_range {
+	__u64 off;
+	__u64 len;
+};
+
+struct cachestat {
+	__u64 nr_cache;
+	__u64 nr_dirty;
+	__u64 nr_writeback;
+	__u64 nr_evicted;
+	__u64 nr_recently_evicted;
+};
+
 #endif /* _LINUX_MMAN_H */
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index 51d8b3940e..12ccb70099 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -36,6 +36,13 @@ enum {
  * SEV Firmware status code
  */
 typedef enum {
+	/*
+	 * This error code is not in the SEV spec. Its purpose is to convey that
+	 * there was an error that prevented the SEV firmware from being called.
+	 * The SEV API error codes are 16 bits, so the -1 value will not overlap
+	 * with possible values from the specification.
+	 */
+	SEV_RET_NO_FW_CALL = -1,
 	SEV_RET_SUCCESS = 0,
 	SEV_RET_INVALID_PLATFORM_STATE,
 	SEV_RET_INVALID_GUEST_STATE,
diff --git a/linux-headers/linux/userfaultfd.h b/linux-headers/linux/userfaultfd.h
index ba5d0df52f..14e402263a 100644
--- a/linux-headers/linux/userfaultfd.h
+++ b/linux-headers/linux/userfaultfd.h
@@ -38,7 +38,8 @@
 			   UFFD_FEATURE_MINOR_HUGETLBFS |	\
 			   UFFD_FEATURE_MINOR_SHMEM |		\
 			   UFFD_FEATURE_EXACT_ADDRESS |		\
-			   UFFD_FEATURE_WP_HUGETLBFS_SHMEM)
+			   UFFD_FEATURE_WP_HUGETLBFS_SHMEM |	\
+			   UFFD_FEATURE_WP_UNPOPULATED)
 #define UFFD_API_IOCTLS				\
 	((__u64)1 << _UFFDIO_REGISTER |		\
 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
@@ -203,6 +204,12 @@ struct uffdio_api {
 	 *
 	 * UFFD_FEATURE_WP_HUGETLBFS_SHMEM indicates that userfaultfd
 	 * write-protection mode is supported on both shmem and hugetlbfs.
+	 *
+	 * UFFD_FEATURE_WP_UNPOPULATED indicates that userfaultfd
+	 * write-protection mode will always apply to unpopulated pages
+	 * (i.e. empty ptes).  This will be the default behavior for shmem
+	 * & hugetlbfs, so this flag only affects anonymous memory behavior
+	 * when userfault write-protection mode is registered.
 	 */
 #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
 #define UFFD_FEATURE_EVENT_FORK			(1<<1)
@@ -217,6 +224,7 @@ struct uffdio_api {
 #define UFFD_FEATURE_MINOR_SHMEM		(1<<10)
 #define UFFD_FEATURE_EXACT_ADDRESS		(1<<11)
 #define UFFD_FEATURE_WP_HUGETLBFS_SHMEM		(1<<12)
+#define UFFD_FEATURE_WP_UNPOPULATED		(1<<13)
 	__u64 features;
 
 	__u64 ioctls;
@@ -297,6 +305,13 @@ struct uffdio_writeprotect {
 struct uffdio_continue {
 	struct uffdio_range range;
 #define UFFDIO_CONTINUE_MODE_DONTWAKE		((__u64)1<<0)
+	/*
+	 * UFFDIO_CONTINUE_MODE_WP will map the page write protected on
+	 * the fly.  UFFDIO_CONTINUE_MODE_WP is available only if the
+	 * write protected ioctl is implemented for the range
+	 * according to the uffdio_register.ioctls.
+	 */
+#define UFFDIO_CONTINUE_MODE_WP			((__u64)1<<1)
 	__u64 mode;
 
 	/*
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index 4a534edbdc..16db89071e 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -213,6 +213,7 @@ struct vfio_device_info {
 #define VFIO_DEVICE_FLAGS_AP	(1 << 5)	/* vfio-ap device */
 #define VFIO_DEVICE_FLAGS_FSL_MC (1 << 6)	/* vfio-fsl-mc device */
 #define VFIO_DEVICE_FLAGS_CAPS	(1 << 7)	/* Info supports caps */
+#define VFIO_DEVICE_FLAGS_CDX	(1 << 8)	/* vfio-cdx device */
 	__u32	num_regions;	/* Max region index + 1 */
 	__u32	num_irqs;	/* Max IRQ index + 1 */
 	__u32   cap_offset;	/* Offset within info struct of first cap */
@@ -240,6 +241,20 @@ struct vfio_device_info {
 #define VFIO_DEVICE_INFO_CAP_ZPCI_UTIL		3
 #define VFIO_DEVICE_INFO_CAP_ZPCI_PFIP		4
 
+/*
+ * The following VFIO_DEVICE_INFO capability reports support for PCIe AtomicOp
+ * completion to the root bus with supported widths provided via flags.
+ */
+#define VFIO_DEVICE_INFO_CAP_PCI_ATOMIC_COMP	5
+struct vfio_device_info_cap_pci_atomic_comp {
+	struct vfio_info_cap_header header;
+	__u32 flags;
+#define VFIO_PCI_ATOMIC_COMP32	(1 << 0)
+#define VFIO_PCI_ATOMIC_COMP64	(1 << 1)
+#define VFIO_PCI_ATOMIC_COMP128	(1 << 2)
+	__u32 reserved;
+};
+
 /**
  * VFIO_DEVICE_GET_REGION_INFO - _IOWR(VFIO_TYPE, VFIO_BASE + 8,
  *				       struct vfio_region_info)
@@ -511,6 +526,9 @@ struct vfio_region_info_cap_nvlink2_lnkspd {
  * then add and unmask vectors, it's up to userspace to make the decision
  * whether to allocate the maximum supported number of vectors or tear
  * down setup and incrementally increase the vectors as each is enabled.
+ * Absence of the NORESIZE flag indicates that vectors can be enabled
+ * and disabled dynamically without impacting other vectors within the
+ * index.
  */
 struct vfio_irq_info {
 	__u32	argsz;
@@ -646,6 +664,15 @@ enum {
 	VFIO_CCW_NUM_IRQS
 };
 
+/*
+ * The vfio-ap bus driver makes use of the following IRQ index mapping.
+ * Unimplemented IRQ types return a count of zero.
+ */
+enum {
+	VFIO_AP_REQ_IRQ_INDEX,
+	VFIO_AP_NUM_IRQS
+};
+
 /**
  * VFIO_DEVICE_GET_PCI_HOT_RESET_INFO - _IOWR(VFIO_TYPE, VFIO_BASE + 12,
  *					      struct vfio_pci_hot_reset_info)
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
index 92e1b700b5..f5c48b61ab 100644
--- a/linux-headers/linux/vhost.h
+++ b/linux-headers/linux/vhost.h
@@ -45,6 +45,25 @@
 #define VHOST_SET_LOG_BASE _IOW(VHOST_VIRTIO, 0x04, __u64)
 /* Specify an eventfd file descriptor to signal on log write. */
 #define VHOST_SET_LOG_FD _IOW(VHOST_VIRTIO, 0x07, int)
+/* By default, a device gets one vhost_worker that its virtqueues share. This
+ * command allows the owner of the device to create an additional vhost_worker
+ * for the device. It can later be bound to 1 or more of its virtqueues using
+ * the VHOST_ATTACH_VRING_WORKER command.
+ *
+ * This must be called after VHOST_SET_OWNER and the caller must be the owner
+ * of the device. The new thread will inherit caller's cgroups and namespaces,
+ * and will share the caller's memory space. The new thread will also be
+ * counted against the caller's RLIMIT_NPROC value.
+ *
+ * The worker's ID used in other commands will be returned in
+ * vhost_worker_state.
+ */
+#define VHOST_NEW_WORKER _IOR(VHOST_VIRTIO, 0x8, struct vhost_worker_state)
+/* Free a worker created with VHOST_NEW_WORKER if it's not attached to any
+ * virtqueue. If userspace is not able to call this for workers its created,
+ * the kernel will free all the device's workers when the device is closed.
+ */
+#define VHOST_FREE_WORKER _IOW(VHOST_VIRTIO, 0x9, struct vhost_worker_state)
 
 /* Ring setup. */
 /* Set number of descriptors in ring. This parameter can not
@@ -70,6 +89,18 @@
 #define VHOST_VRING_BIG_ENDIAN 1
 #define VHOST_SET_VRING_ENDIAN _IOW(VHOST_VIRTIO, 0x13, struct vhost_vring_state)
 #define VHOST_GET_VRING_ENDIAN _IOW(VHOST_VIRTIO, 0x14, struct vhost_vring_state)
+/* Attach a vhost_worker created with VHOST_NEW_WORKER to one of the device's
+ * virtqueues.
+ *
+ * This will replace the virtqueue's existing worker. If the replaced worker
+ * is no longer attached to any virtqueues, it can be freed with
+ * VHOST_FREE_WORKER.
+ */
+#define VHOST_ATTACH_VRING_WORKER _IOW(VHOST_VIRTIO, 0x15,		\
+				       struct vhost_vring_worker)
+/* Return the vring worker's ID */
+#define VHOST_GET_VRING_WORKER _IOWR(VHOST_VIRTIO, 0x16,		\
+				     struct vhost_vring_worker)
 
 /* The following ioctls use eventfd file descriptors to signal and poll
  * for events. */

From 1360b2ad1f673d32a09de5826cd71ecd0510164a Mon Sep 17 00:00:00 2001
From: Tony Krowiak <akrowiak@linux.ibm.com>
Date: Fri, 2 Jun 2023 10:11:25 -0400
Subject: [PATCH 0549/1353] s390x/ap: Wire up the device request notifier
 interface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's wire up the device request notifier interface to handle device unplug
requests for AP.

Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20230530225544.280031-1-akrowiak@linux.ibm.com/
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/ap.c | 113 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 113 insertions(+)

diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index e0dd561e85..6e21d1da5a 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -18,6 +18,8 @@
 #include "hw/vfio/vfio-common.h"
 #include "hw/s390x/ap-device.h"
 #include "qemu/error-report.h"
+#include "qemu/event_notifier.h"
+#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
@@ -33,6 +35,7 @@
 struct VFIOAPDevice {
     APDevice apdev;
     VFIODevice vdev;
+    EventNotifier req_notifier;
 };
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOAPDevice, VFIO_AP_DEVICE)
@@ -84,10 +87,110 @@ static VFIOGroup *vfio_ap_get_group(VFIOAPDevice *vapdev, Error **errp)
     return vfio_get_group(groupid, &address_space_memory, errp);
 }
 
+static void vfio_ap_req_notifier_handler(void *opaque)
+{
+    VFIOAPDevice *vapdev = opaque;
+    Error *err = NULL;
+
+    if (!event_notifier_test_and_clear(&vapdev->req_notifier)) {
+        return;
+    }
+
+    qdev_unplug(DEVICE(vapdev), &err);
+
+    if (err) {
+        warn_reportf_err(err, VFIO_MSG_PREFIX, vapdev->vdev.name);
+    }
+}
+
+static void vfio_ap_register_irq_notifier(VFIOAPDevice *vapdev,
+                                          unsigned int irq, Error **errp)
+{
+    int fd;
+    size_t argsz;
+    IOHandler *fd_read;
+    EventNotifier *notifier;
+    struct vfio_irq_info *irq_info;
+    VFIODevice *vdev = &vapdev->vdev;
+
+    switch (irq) {
+    case VFIO_AP_REQ_IRQ_INDEX:
+        notifier = &vapdev->req_notifier;
+        fd_read = vfio_ap_req_notifier_handler;
+        break;
+    default:
+        error_setg(errp, "vfio: Unsupported device irq(%d)", irq);
+        return;
+    }
+
+    if (vdev->num_irqs < irq + 1) {
+        error_setg(errp, "vfio: IRQ %u not available (number of irqs %u)",
+                   irq, vdev->num_irqs);
+        return;
+    }
+
+    argsz = sizeof(*irq_info);
+    irq_info = g_malloc0(argsz);
+    irq_info->index = irq;
+    irq_info->argsz = argsz;
+
+    if (ioctl(vdev->fd, VFIO_DEVICE_GET_IRQ_INFO,
+              irq_info) < 0 || irq_info->count < 1) {
+        error_setg_errno(errp, errno, "vfio: Error getting irq info");
+        goto out_free_info;
+    }
+
+    if (event_notifier_init(notifier, 0)) {
+        error_setg_errno(errp, errno,
+                         "vfio: Unable to init event notifier for irq (%d)",
+                         irq);
+        goto out_free_info;
+    }
+
+    fd = event_notifier_get_fd(notifier);
+    qemu_set_fd_handler(fd, fd_read, NULL, vapdev);
+
+    if (vfio_set_irq_signaling(vdev, irq, 0, VFIO_IRQ_SET_ACTION_TRIGGER, fd,
+                               errp)) {
+        qemu_set_fd_handler(fd, NULL, NULL, vapdev);
+        event_notifier_cleanup(notifier);
+    }
+
+out_free_info:
+    g_free(irq_info);
+
+}
+
+static void vfio_ap_unregister_irq_notifier(VFIOAPDevice *vapdev,
+                                            unsigned int irq)
+{
+    Error *err = NULL;
+    EventNotifier *notifier;
+
+    switch (irq) {
+    case VFIO_AP_REQ_IRQ_INDEX:
+        notifier = &vapdev->req_notifier;
+        break;
+    default:
+        error_report("vfio: Unsupported device irq(%d)", irq);
+        return;
+    }
+
+    if (vfio_set_irq_signaling(&vapdev->vdev, irq, 0,
+                               VFIO_IRQ_SET_ACTION_TRIGGER, -1, &err)) {
+        warn_reportf_err(err, VFIO_MSG_PREFIX, vapdev->vdev.name);
+    }
+
+    qemu_set_fd_handler(event_notifier_get_fd(notifier),
+                        NULL, NULL, vapdev);
+    event_notifier_cleanup(notifier);
+}
+
 static void vfio_ap_realize(DeviceState *dev, Error **errp)
 {
     int ret;
     char *mdevid;
+    Error *err = NULL;
     VFIOGroup *vfio_group;
     APDevice *apdev = AP_DEVICE(dev);
     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(apdev);
@@ -116,6 +219,15 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
         goto out_get_dev_err;
     }
 
+    vfio_ap_register_irq_notifier(vapdev, VFIO_AP_REQ_IRQ_INDEX, &err);
+    if (err) {
+        /*
+         * Report this error, but do not make it a failing condition.
+         * Lack of this IRQ in the host does not prevent normal operation.
+         */
+        error_report_err(err);
+    }
+
     return;
 
 out_get_dev_err:
@@ -129,6 +241,7 @@ static void vfio_ap_unrealize(DeviceState *dev)
     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(apdev);
     VFIOGroup *group = vapdev->vdev.group;
 
+    vfio_ap_unregister_irq_notifier(vapdev, VFIO_AP_REQ_IRQ_INDEX);
     vfio_ap_put_device(vapdev);
     vfio_put_group(group);
 }

From cf2916f6a1c3e4e9d9907f4c65f8a4634039de40 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Fri, 26 May 2023 17:15:57 -0600
Subject: [PATCH 0550/1353] pcie: Add a PCIe capability version helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Report the PCIe capability version for a device

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Robin Voetter <robin@streamhpc.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci/pcie.c         | 7 +++++++
 include/hw/pci/pcie.h | 1 +
 2 files changed, 8 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index b8c24cf45f..b7f107ed8d 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -274,6 +274,13 @@ uint8_t pcie_cap_get_type(const PCIDevice *dev)
             PCI_EXP_FLAGS_TYPE) >> PCI_EXP_FLAGS_TYPE_SHIFT;
 }
 
+uint8_t pcie_cap_get_version(const PCIDevice *dev)
+{
+    uint32_t pos = dev->exp.exp_cap;
+    assert(pos > 0);
+    return pci_get_word(dev->config + pos + PCI_EXP_FLAGS) & PCI_EXP_FLAGS_VERS;
+}
+
 /* MSI/MSI-X */
 /* pci express interrupt message number */
 /* 7.8.2 PCI Express Capabilities Register: Interrupt Message Number */
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index 3cc2b15957..51ab57bc3c 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -93,6 +93,7 @@ void pcie_cap_exit(PCIDevice *dev);
 int pcie_endpoint_cap_v1_init(PCIDevice *dev, uint8_t offset);
 void pcie_cap_v1_exit(PCIDevice *dev);
 uint8_t pcie_cap_get_type(const PCIDevice *dev);
+uint8_t pcie_cap_get_version(const PCIDevice *dev);
 void pcie_cap_flags_set_vector(PCIDevice *dev, uint8_t vector);
 uint8_t pcie_cap_flags_get_vector(PCIDevice *dev);
 

From c00aac6f1428d40a4ca2ab9b89070afc2a5bf979 Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Fri, 26 May 2023 17:15:58 -0600
Subject: [PATCH 0551/1353] vfio/pci: Enable AtomicOps completers on root ports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dynamically enable Atomic Ops completer support around realize/exit of
vfio-pci devices reporting host support for these accesses and adhering
to a minimal configuration standard.  While the Atomic Ops completer
bits in the root port device capabilities2 register are read-only, the
PCIe spec does allow RO bits to change to reflect hardware state.  We
take advantage of that here around the realize and exit functions of
the vfio-pci device.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Robin Voetter <robin@streamhpc.com>
Tested-by: Robin Voetter <robin@streamhpc.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++++++
 hw/vfio/pci.h |  1 +
 2 files changed, 79 insertions(+)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index c89fdf7ae6..a205c6b113 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1828,6 +1828,81 @@ static void vfio_add_emulated_long(VFIOPCIDevice *vdev, int pos,
     vfio_set_long_bits(vdev->emulated_config_bits + pos, mask, mask);
 }
 
+static void vfio_pci_enable_rp_atomics(VFIOPCIDevice *vdev)
+{
+    struct vfio_device_info_cap_pci_atomic_comp *cap;
+    g_autofree struct vfio_device_info *info = NULL;
+    PCIBus *bus = pci_get_bus(&vdev->pdev);
+    PCIDevice *parent = bus->parent_dev;
+    struct vfio_info_cap_header *hdr;
+    uint32_t mask = 0;
+    uint8_t *pos;
+
+    /*
+     * PCIe Atomic Ops completer support is only added automatically for single
+     * function devices downstream of a root port supporting DEVCAP2.  Support
+     * is added during realize and, if added, removed during device exit.  The
+     * single function requirement avoids conflicting requirements should a
+     * slot be composed of multiple devices with differing capabilities.
+     */
+    if (pci_bus_is_root(bus) || !parent || !parent->exp.exp_cap ||
+        pcie_cap_get_type(parent) != PCI_EXP_TYPE_ROOT_PORT ||
+        pcie_cap_get_version(parent) != PCI_EXP_FLAGS_VER2 ||
+        vdev->pdev.devfn ||
+        vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+        return;
+    }
+
+    pos = parent->config + parent->exp.exp_cap + PCI_EXP_DEVCAP2;
+
+    /* Abort if there'a already an Atomic Ops configuration on the root port */
+    if (pci_get_long(pos) & (PCI_EXP_DEVCAP2_ATOMIC_COMP32 |
+                             PCI_EXP_DEVCAP2_ATOMIC_COMP64 |
+                             PCI_EXP_DEVCAP2_ATOMIC_COMP128)) {
+        return;
+    }
+
+    info = vfio_get_device_info(vdev->vbasedev.fd);
+    if (!info) {
+        return;
+    }
+
+    hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_PCI_ATOMIC_COMP);
+    if (!hdr) {
+        return;
+    }
+
+    cap = (void *)hdr;
+    if (cap->flags & VFIO_PCI_ATOMIC_COMP32) {
+        mask |= PCI_EXP_DEVCAP2_ATOMIC_COMP32;
+    }
+    if (cap->flags & VFIO_PCI_ATOMIC_COMP64) {
+        mask |= PCI_EXP_DEVCAP2_ATOMIC_COMP64;
+    }
+    if (cap->flags & VFIO_PCI_ATOMIC_COMP128) {
+        mask |= PCI_EXP_DEVCAP2_ATOMIC_COMP128;
+    }
+
+    if (!mask) {
+        return;
+    }
+
+    pci_long_test_and_set_mask(pos, mask);
+    vdev->clear_parent_atomics_on_exit = true;
+}
+
+static void vfio_pci_disable_rp_atomics(VFIOPCIDevice *vdev)
+{
+    if (vdev->clear_parent_atomics_on_exit) {
+        PCIDevice *parent = pci_get_bus(&vdev->pdev)->parent_dev;
+        uint8_t *pos = parent->config + parent->exp.exp_cap + PCI_EXP_DEVCAP2;
+
+        pci_long_test_and_clear_mask(pos, PCI_EXP_DEVCAP2_ATOMIC_COMP32 |
+                                          PCI_EXP_DEVCAP2_ATOMIC_COMP64 |
+                                          PCI_EXP_DEVCAP2_ATOMIC_COMP128);
+    }
+}
+
 static int vfio_setup_pcie_cap(VFIOPCIDevice *vdev, int pos, uint8_t size,
                                Error **errp)
 {
@@ -1931,6 +2006,8 @@ static int vfio_setup_pcie_cap(VFIOPCIDevice *vdev, int pos, uint8_t size,
                            QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT), ~0);
             vfio_add_emulated_word(vdev, pos + PCI_EXP_LNKCTL, 0, ~0);
         }
+
+        vfio_pci_enable_rp_atomics(vdev);
     }
 
     /*
@@ -3273,6 +3350,7 @@ static void vfio_exitfn(PCIDevice *pdev)
         timer_free(vdev->intx.mmap_timer);
     }
     vfio_teardown_msi(vdev);
+    vfio_pci_disable_rp_atomics(vdev);
     vfio_bars_exit(vdev);
     vfio_migration_exit(&vdev->vbasedev);
 }
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 2674476d6c..a2771b9ff3 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -174,6 +174,7 @@ struct VFIOPCIDevice {
     bool no_vfio_ioeventfd;
     bool enable_ramfb;
     bool defer_kvm_irq_routing;
+    bool clear_parent_atomics_on_exit;
     VFIODisplay *dpy;
     Notifier irqchip_change_notifier;
 };

From 94692c3a34d9e2e149bd9db188425e9da6e578c6 Mon Sep 17 00:00:00 2001
From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Date: Mon, 12 Jun 2023 13:10:27 +0200
Subject: [PATCH 0552/1353] target/riscv: Use xl instead of mxl for disassemble
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Disassemble function(plugin_disas, target_disas, monitor_disas) will
always call set_disas_info before disassembling instructions.

plugin_disas  and target_disas will always be called under a TB, which
has the same XLEN.

We can't ensure that monitor_disas will always be called under a TB,
but current XLEN will still be a better choice, thus we can ensure at
least the disassemble of the nearest one TB is right.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 4035fe0e62..3faf703131 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -858,9 +858,10 @@ static void riscv_cpu_reset_hold(Object *obj)
 static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 {
     RISCVCPU *cpu = RISCV_CPU(s);
+    CPURISCVState *env = &cpu->env;
     info->target_info = &cpu->cfg;
 
-    switch (riscv_cpu_mxl(&cpu->env)) {
+    switch (env->xl) {
     case MXL_RV32:
         info->print_insn = print_insn_riscv32;
         break;

From 2e8c1e0215449eb0a88bbb3fae2f6277777611c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:28 +0200
Subject: [PATCH 0553/1353] target/riscv: Factor out extension tests to
 cpu_cfg.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch moves the extension test functions that are used
to gate vendor extension decoders, into cpu_cfg.h.
This allows to reuse them in the disassembler.

This patch does not introduce new functionality.
However, the patch includes a small change:
The parameter for the extension test functions has been changed
from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
the code in cpu_cfg.h self-contained.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
 target/riscv/translate.c | 27 ++-------------------------
 2 files changed, 28 insertions(+), 25 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index c4a627d335..0b4fe4b540 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -133,4 +133,30 @@ struct RISCVCPUConfig {
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
+
+/* Helper functions to test for extensions.  */
+
+static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
+{
+    return true;
+}
+
+static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
+{
+    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
+           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
+           cfg->ext_xtheadcondmov ||
+           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
+           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
+           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
+}
+
+#define MATERIALISE_EXT_PREDICATE(ext) \
+    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
+    { \
+        return cfg->ext_ ## ext ; \
+    }
+
+MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
+
 #endif
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 8a33da811e..0a5ab89c43 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -121,29 +121,6 @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
     return ctx->misa_ext & ext;
 }
 
-static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return true;
-}
-
-static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
-           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
-           ctx->cfg_ptr->ext_xtheadcondmov ||
-           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
-           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
-           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
-}
-
-#define MATERIALISE_EXT_PREDICATE(ext)  \
-    static bool has_ ## ext ## _p(DisasContext *ctx)    \
-    { \
-        return ctx->cfg_ptr->ext_ ## ext ; \
-    }
-
-MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
-
 #ifdef TARGET_RISCV32
 #define get_xl(ctx)    MXL_RV32
 #elif defined(CONFIG_USER_ONLY)
@@ -1134,7 +1111,7 @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
      * that are tested in-order until a decoder matches onto the opcode.
      */
     static const struct {
-        bool (*guard_func)(DisasContext *);
+        bool (*guard_func)(const RISCVCPUConfig *);
         bool (*decode_func)(DisasContext *, uint32_t);
     } decoders[] = {
         { always_true_p,  decode_insn32 },
@@ -1163,7 +1140,7 @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         ctx->opcode = opcode32;
 
         for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx) &&
+            if (decoders[i].guard_func(ctx->cfg_ptr) &&
                 decoders[i].decode_func(ctx, opcode32)) {
                 return;
             }

From 5d326db2f9d0f4c90a3298f12bcb803e7bf302dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:29 +0200
Subject: [PATCH 0554/1353] disas/riscv: Move types/constants to new header
 file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to enable vendor disassembler support, we need to
move types and constants into a header file so that other
compilation units can use them as well.

This patch does not introduce any functional changes.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 270 +----------------------------------------------
 disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 283 insertions(+), 269 deletions(-)
 create mode 100644 disas/riscv.h

diff --git a/disas/riscv.c b/disas/riscv.c
index 5005364aba..4a55348267 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -20,157 +20,7 @@
 #include "qemu/osdep.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
-
-/* types */
-
-typedef uint64_t rv_inst;
-typedef uint16_t rv_opcode;
-
-/* enums */
-
-typedef enum {
-    rv32,
-    rv64,
-    rv128
-} rv_isa;
-
-typedef enum {
-    rv_rm_rne = 0,
-    rv_rm_rtz = 1,
-    rv_rm_rdn = 2,
-    rv_rm_rup = 3,
-    rv_rm_rmm = 4,
-    rv_rm_dyn = 7,
-} rv_rm;
-
-typedef enum {
-    rv_fence_i = 8,
-    rv_fence_o = 4,
-    rv_fence_r = 2,
-    rv_fence_w = 1,
-} rv_fence;
-
-typedef enum {
-    rv_ireg_zero,
-    rv_ireg_ra,
-    rv_ireg_sp,
-    rv_ireg_gp,
-    rv_ireg_tp,
-    rv_ireg_t0,
-    rv_ireg_t1,
-    rv_ireg_t2,
-    rv_ireg_s0,
-    rv_ireg_s1,
-    rv_ireg_a0,
-    rv_ireg_a1,
-    rv_ireg_a2,
-    rv_ireg_a3,
-    rv_ireg_a4,
-    rv_ireg_a5,
-    rv_ireg_a6,
-    rv_ireg_a7,
-    rv_ireg_s2,
-    rv_ireg_s3,
-    rv_ireg_s4,
-    rv_ireg_s5,
-    rv_ireg_s6,
-    rv_ireg_s7,
-    rv_ireg_s8,
-    rv_ireg_s9,
-    rv_ireg_s10,
-    rv_ireg_s11,
-    rv_ireg_t3,
-    rv_ireg_t4,
-    rv_ireg_t5,
-    rv_ireg_t6,
-} rv_ireg;
-
-typedef enum {
-    rvc_end,
-    rvc_rd_eq_ra,
-    rvc_rd_eq_x0,
-    rvc_rs1_eq_x0,
-    rvc_rs2_eq_x0,
-    rvc_rs2_eq_rs1,
-    rvc_rs1_eq_ra,
-    rvc_imm_eq_zero,
-    rvc_imm_eq_n1,
-    rvc_imm_eq_p1,
-    rvc_csr_eq_0x001,
-    rvc_csr_eq_0x002,
-    rvc_csr_eq_0x003,
-    rvc_csr_eq_0xc00,
-    rvc_csr_eq_0xc01,
-    rvc_csr_eq_0xc02,
-    rvc_csr_eq_0xc80,
-    rvc_csr_eq_0xc81,
-    rvc_csr_eq_0xc82,
-} rvc_constraint;
-
-typedef enum {
-    rv_codec_illegal,
-    rv_codec_none,
-    rv_codec_u,
-    rv_codec_uj,
-    rv_codec_i,
-    rv_codec_i_sh5,
-    rv_codec_i_sh6,
-    rv_codec_i_sh7,
-    rv_codec_i_csr,
-    rv_codec_s,
-    rv_codec_sb,
-    rv_codec_r,
-    rv_codec_r_m,
-    rv_codec_r4_m,
-    rv_codec_r_a,
-    rv_codec_r_l,
-    rv_codec_r_f,
-    rv_codec_cb,
-    rv_codec_cb_imm,
-    rv_codec_cb_sh5,
-    rv_codec_cb_sh6,
-    rv_codec_ci,
-    rv_codec_ci_sh5,
-    rv_codec_ci_sh6,
-    rv_codec_ci_16sp,
-    rv_codec_ci_lwsp,
-    rv_codec_ci_ldsp,
-    rv_codec_ci_lqsp,
-    rv_codec_ci_li,
-    rv_codec_ci_lui,
-    rv_codec_ci_none,
-    rv_codec_ciw_4spn,
-    rv_codec_cj,
-    rv_codec_cj_jal,
-    rv_codec_cl_lw,
-    rv_codec_cl_ld,
-    rv_codec_cl_lq,
-    rv_codec_cr,
-    rv_codec_cr_mv,
-    rv_codec_cr_jalr,
-    rv_codec_cr_jr,
-    rv_codec_cs,
-    rv_codec_cs_sw,
-    rv_codec_cs_sd,
-    rv_codec_cs_sq,
-    rv_codec_css_swsp,
-    rv_codec_css_sdsp,
-    rv_codec_css_sqsp,
-    rv_codec_k_bs,
-    rv_codec_k_rnum,
-    rv_codec_v_r,
-    rv_codec_v_ldst,
-    rv_codec_v_i,
-    rv_codec_vsetvli,
-    rv_codec_vsetivli,
-    rv_codec_zcb_ext,
-    rv_codec_zcb_mul,
-    rv_codec_zcb_lb,
-    rv_codec_zcb_lh,
-    rv_codec_zcmp_cm_pushpop,
-    rv_codec_zcmp_cm_mv,
-    rv_codec_zcmt_jt,
-} rv_codec;
+#include "disas/riscv.h"
 
 typedef enum {
     rv_op_illegal = 0,
@@ -966,51 +816,6 @@ typedef enum {
     rv_op_czero_nez = 790,
 } rv_op;
 
-/* structures */
-
-typedef struct {
-    RISCVCPUConfig *cfg;
-    uint64_t  pc;
-    uint64_t  inst;
-    int32_t   imm;
-    uint16_t  op;
-    uint8_t   codec;
-    uint8_t   rd;
-    uint8_t   rs1;
-    uint8_t   rs2;
-    uint8_t   rs3;
-    uint8_t   rm;
-    uint8_t   pred;
-    uint8_t   succ;
-    uint8_t   aq;
-    uint8_t   rl;
-    uint8_t   bs;
-    uint8_t   rnum;
-    uint8_t   vm;
-    uint32_t  vzimm;
-    uint8_t   rlist;
-} rv_decode;
-
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
-enum {
-    rvcd_imm_nz = 0x1
-};
-
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* register names */
 
 static const char rv_ireg_name_sym[32][5] = {
@@ -1034,79 +839,6 @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
-/* instruction formats */
-
-#define rv_fmt_none                   "O\t"
-#define rv_fmt_rs1                    "O\t1"
-#define rv_fmt_offset                 "O\to"
-#define rv_fmt_pred_succ              "O\tp,s"
-#define rv_fmt_rs1_rs2                "O\t1,2"
-#define rv_fmt_rd_imm                 "O\t0,i"
-#define rv_fmt_rd_offset              "O\t0,o"
-#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
-#define rv_fmt_frd_rs1                "O\t3,1"
-#define rv_fmt_frd_frs1               "O\t3,4"
-#define rv_fmt_rd_frs1                "O\t0,4"
-#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
-#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
-#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
-#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
-#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
-#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
-#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
-#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
-#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
-#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
-#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
-#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
-#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
-#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
-#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
-#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
-#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
-#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
-#define rv_fmt_rd                     "O\t0"
-#define rv_fmt_rd_zimm                "O\t0,7"
-#define rv_fmt_rd_rs1                 "O\t0,1"
-#define rv_fmt_rd_rs2                 "O\t0,2"
-#define rv_fmt_rs1_offset             "O\t1,o"
-#define rv_fmt_rs2_offset             "O\t2,o"
-#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
-#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
-#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
-#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
-#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
-#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
-#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
-#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
-#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
-#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
-#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
-#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
-#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
-#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
-#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
-#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
-#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
-#define rv_fmt_vd_vs1                 "O\tD,E"
-#define rv_fmt_vd_rs1                 "O\tD,1"
-#define rv_fmt_vd_fs1                 "O\tD,4"
-#define rv_fmt_vd_imm                 "O\tD,i"
-#define rv_fmt_vd_vs2                 "O\tD,F"
-#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
-#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
-#define rv_fmt_rd_vs2                 "O\t0,F"
-#define rv_fmt_fd_vs2                 "O\t3,F"
-#define rv_fmt_vd_vm                  "O\tDm"
-#define rv_fmt_vsetvli                "O\t0,1,v"
-#define rv_fmt_vsetivli               "O\t0,u,v"
-#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-#define rv_fmt_push_rlist             "O\tx,-i"
-#define rv_fmt_pop_rlist              "O\tx,i"
-#define rv_fmt_zcmt_index             "O\ti"
-
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
diff --git a/disas/riscv.h b/disas/riscv.h
new file mode 100644
index 0000000000..9288255915
--- /dev/null
+++ b/disas/riscv.h
@@ -0,0 +1,282 @@
+/*
+ * QEMU disassembler -- RISC-V specific header.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_H
+#define DISAS_RISCV_H
+
+#include "qemu/osdep.h"
+#include "target/riscv/cpu_cfg.h"
+
+/* types */
+
+typedef uint64_t rv_inst;
+typedef uint16_t rv_opcode;
+
+/* enums */
+
+typedef enum {
+    rv32,
+    rv64,
+    rv128
+} rv_isa;
+
+typedef enum {
+    rv_rm_rne = 0,
+    rv_rm_rtz = 1,
+    rv_rm_rdn = 2,
+    rv_rm_rup = 3,
+    rv_rm_rmm = 4,
+    rv_rm_dyn = 7,
+} rv_rm;
+
+typedef enum {
+    rv_fence_i = 8,
+    rv_fence_o = 4,
+    rv_fence_r = 2,
+    rv_fence_w = 1,
+} rv_fence;
+
+typedef enum {
+    rv_ireg_zero,
+    rv_ireg_ra,
+    rv_ireg_sp,
+    rv_ireg_gp,
+    rv_ireg_tp,
+    rv_ireg_t0,
+    rv_ireg_t1,
+    rv_ireg_t2,
+    rv_ireg_s0,
+    rv_ireg_s1,
+    rv_ireg_a0,
+    rv_ireg_a1,
+    rv_ireg_a2,
+    rv_ireg_a3,
+    rv_ireg_a4,
+    rv_ireg_a5,
+    rv_ireg_a6,
+    rv_ireg_a7,
+    rv_ireg_s2,
+    rv_ireg_s3,
+    rv_ireg_s4,
+    rv_ireg_s5,
+    rv_ireg_s6,
+    rv_ireg_s7,
+    rv_ireg_s8,
+    rv_ireg_s9,
+    rv_ireg_s10,
+    rv_ireg_s11,
+    rv_ireg_t3,
+    rv_ireg_t4,
+    rv_ireg_t5,
+    rv_ireg_t6,
+} rv_ireg;
+
+typedef enum {
+    rvc_end,
+    rvc_rd_eq_ra,
+    rvc_rd_eq_x0,
+    rvc_rs1_eq_x0,
+    rvc_rs2_eq_x0,
+    rvc_rs2_eq_rs1,
+    rvc_rs1_eq_ra,
+    rvc_imm_eq_zero,
+    rvc_imm_eq_n1,
+    rvc_imm_eq_p1,
+    rvc_csr_eq_0x001,
+    rvc_csr_eq_0x002,
+    rvc_csr_eq_0x003,
+    rvc_csr_eq_0xc00,
+    rvc_csr_eq_0xc01,
+    rvc_csr_eq_0xc02,
+    rvc_csr_eq_0xc80,
+    rvc_csr_eq_0xc81,
+    rvc_csr_eq_0xc82,
+} rvc_constraint;
+
+typedef enum {
+    rv_codec_illegal,
+    rv_codec_none,
+    rv_codec_u,
+    rv_codec_uj,
+    rv_codec_i,
+    rv_codec_i_sh5,
+    rv_codec_i_sh6,
+    rv_codec_i_sh7,
+    rv_codec_i_csr,
+    rv_codec_s,
+    rv_codec_sb,
+    rv_codec_r,
+    rv_codec_r_m,
+    rv_codec_r4_m,
+    rv_codec_r_a,
+    rv_codec_r_l,
+    rv_codec_r_f,
+    rv_codec_cb,
+    rv_codec_cb_imm,
+    rv_codec_cb_sh5,
+    rv_codec_cb_sh6,
+    rv_codec_ci,
+    rv_codec_ci_sh5,
+    rv_codec_ci_sh6,
+    rv_codec_ci_16sp,
+    rv_codec_ci_lwsp,
+    rv_codec_ci_ldsp,
+    rv_codec_ci_lqsp,
+    rv_codec_ci_li,
+    rv_codec_ci_lui,
+    rv_codec_ci_none,
+    rv_codec_ciw_4spn,
+    rv_codec_cj,
+    rv_codec_cj_jal,
+    rv_codec_cl_lw,
+    rv_codec_cl_ld,
+    rv_codec_cl_lq,
+    rv_codec_cr,
+    rv_codec_cr_mv,
+    rv_codec_cr_jalr,
+    rv_codec_cr_jr,
+    rv_codec_cs,
+    rv_codec_cs_sw,
+    rv_codec_cs_sd,
+    rv_codec_cs_sq,
+    rv_codec_css_swsp,
+    rv_codec_css_sdsp,
+    rv_codec_css_sqsp,
+    rv_codec_k_bs,
+    rv_codec_k_rnum,
+    rv_codec_v_r,
+    rv_codec_v_ldst,
+    rv_codec_v_i,
+    rv_codec_vsetvli,
+    rv_codec_vsetivli,
+    rv_codec_zcb_ext,
+    rv_codec_zcb_mul,
+    rv_codec_zcb_lb,
+    rv_codec_zcb_lh,
+    rv_codec_zcmp_cm_pushpop,
+    rv_codec_zcmp_cm_mv,
+    rv_codec_zcmt_jt,
+} rv_codec;
+
+/* structures */
+
+typedef struct {
+    RISCVCPUConfig *cfg;
+    uint64_t  pc;
+    uint64_t  inst;
+    int32_t   imm;
+    uint16_t  op;
+    uint8_t   codec;
+    uint8_t   rd;
+    uint8_t   rs1;
+    uint8_t   rs2;
+    uint8_t   rs3;
+    uint8_t   rm;
+    uint8_t   pred;
+    uint8_t   succ;
+    uint8_t   aq;
+    uint8_t   rl;
+    uint8_t   bs;
+    uint8_t   rnum;
+    uint8_t   vm;
+    uint32_t  vzimm;
+    uint8_t   rlist;
+} rv_decode;
+
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+enum {
+    rvcd_imm_nz = 0x1
+};
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
+/* instruction formats */
+
+#define rv_fmt_none                   "O\t"
+#define rv_fmt_rs1                    "O\t1"
+#define rv_fmt_offset                 "O\to"
+#define rv_fmt_pred_succ              "O\tp,s"
+#define rv_fmt_rs1_rs2                "O\t1,2"
+#define rv_fmt_rd_imm                 "O\t0,i"
+#define rv_fmt_rd_offset              "O\t0,o"
+#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
+#define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_frs1               "O\t3,4"
+#define rv_fmt_rd_frs1                "O\t0,4"
+#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
+#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
+#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
+#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
+#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
+#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
+#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
+#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
+#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
+#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
+#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
+#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
+#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
+#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
+#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
+#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
+#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
+#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
+#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
+#define rv_fmt_rd                     "O\t0"
+#define rv_fmt_rd_zimm                "O\t0,7"
+#define rv_fmt_rd_rs1                 "O\t0,1"
+#define rv_fmt_rd_rs2                 "O\t0,2"
+#define rv_fmt_rs1_offset             "O\t1,o"
+#define rv_fmt_rs2_offset             "O\t2,o"
+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
+#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
+#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
+#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
+#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
+#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
+#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
+#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
+#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
+#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
+#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
+#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
+#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
+#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
+#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
+#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
+#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
+#define rv_fmt_vd_vs1                 "O\tD,E"
+#define rv_fmt_vd_rs1                 "O\tD,1"
+#define rv_fmt_vd_fs1                 "O\tD,4"
+#define rv_fmt_vd_imm                 "O\tD,i"
+#define rv_fmt_vd_vs2                 "O\tD,F"
+#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
+#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
+#define rv_fmt_rd_vs2                 "O\t0,F"
+#define rv_fmt_fd_vs2                 "O\t3,F"
+#define rv_fmt_vd_vm                  "O\tDm"
+#define rv_fmt_vsetvli                "O\t0,1,v"
+#define rv_fmt_vsetivli               "O\t0,u,v"
+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
+#define rv_fmt_push_rlist             "O\tx,-i"
+#define rv_fmt_pop_rlist              "O\tx,i"
+#define rv_fmt_zcmt_index             "O\ti"
+
+#endif /* DISAS_RISCV_H */

From 01b1361f84d55a86be486323836a29488b52e3a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:30 +0200
Subject: [PATCH 0555/1353] disas/riscv: Make rv_op_illegal a shared enum value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The enum value 'rv_op_illegal' does not represent an
instruction, but is a catch-all value in case we have
no match in the decoder. Let's make the value a shared
one, so that other compile units can reuse it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 2 +-
 disas/riscv.h | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index 4a55348267..b6ced2a26a 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -23,7 +23,7 @@
 #include "disas/riscv.h"
 
 typedef enum {
-    rv_op_illegal = 0,
+    /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
     rv_op_auipc = 2,
     rv_op_jal = 3,
diff --git a/disas/riscv.h b/disas/riscv.h
index 9288255915..debbe69239 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -191,6 +191,10 @@ typedef struct {
     const rvc_constraint *constraints;
 } rv_comp_data;
 
+enum {
+    rv_op_illegal = 0
+};
+
 enum {
     rvcd_imm_nz = 0x1
 };

From fd7c64f6bd863df28081576a6f5c7a44dd65721f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:31 +0200
Subject: [PATCH 0556/1353] disas/riscv: Encapsulate opcode_data into decode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds a reference to a struct rv_opcode_data object
into struct rv_decode. This further allows to remove all references
to the global variable opcode_data (which is renamed to rvi_opcode_data).

This patch does not introduce any functional change, but prepares
the code for more struct rv_opcode_data objects in the future.

This patch is based on previous work from Liu Zhiwei:
  https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c |  9 ++++++++-
 disas/riscv.h | 33 +++++++++++++++++----------------
 2 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index b6ced2a26a..b6789ab92a 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -1068,7 +1068,7 @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
 
 /* instruction metadata */
 
-const rv_opcode_data opcode_data[] = {
+const rv_opcode_data rvi_opcode_data[] = {
     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
     { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
@@ -3889,6 +3889,7 @@ static uint32_t operand_tbl_index(rv_inst inst)
 
 static void decode_inst_operands(rv_decode *dec, rv_isa isa)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     rv_inst inst = dec->inst;
     dec->codec = opcode_data[dec->op].codec;
     switch (dec->codec) {
@@ -4371,6 +4372,7 @@ static void append(char *s1, const char *s2, size_t n)
 
 static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     char tmp[64];
     const char *fmt;
 
@@ -4612,6 +4614,7 @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 
 static void decode_inst_lift_pseudo(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
     if (!comp_data) {
         return;
@@ -4630,6 +4633,7 @@ static void decode_inst_lift_pseudo(rv_decode *dec)
 
 static void decode_inst_decompress_rv32(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv32;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -4644,6 +4648,7 @@ static void decode_inst_decompress_rv32(rv_decode *dec)
 
 static void decode_inst_decompress_rv64(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv64;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -4658,6 +4663,7 @@ static void decode_inst_decompress_rv64(rv_decode *dec)
 
 static void decode_inst_decompress_rv128(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv128;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -4694,6 +4700,7 @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
+    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
     decode_inst_opcode(&dec, isa);
     decode_inst_operands(&dec, isa);
diff --git a/disas/riscv.h b/disas/riscv.h
index debbe69239..460196510c 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -163,10 +163,27 @@ typedef enum {
 
 /* structures */
 
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
 typedef struct {
     RISCVCPUConfig *cfg;
     uint64_t  pc;
     uint64_t  inst;
+    const rv_opcode_data *opcode_data;
     int32_t   imm;
     uint16_t  op;
     uint8_t   codec;
@@ -186,11 +203,6 @@ typedef struct {
     uint8_t   rlist;
 } rv_decode;
 
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
 enum {
     rv_op_illegal = 0
 };
@@ -199,17 +211,6 @@ enum {
     rvcd_imm_nz = 0x1
 };
 
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* instruction formats */
 
 #define rv_fmt_none                   "O\t"

From c859a2424dbbae8f5ea64c0f8445981402cd8552 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:32 +0200
Subject: [PATCH 0557/1353] disas/riscv: Provide infrastructure for vendor
 extensions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A previous patch provides a pointer to the RISCVCPUConfig data.
Let's use this to add the necessary code for vendor extensions.
This patch does not change the current behaviour, but clearly
defines how vendor extension support can be added to the disassembler.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index b6789ab92a..dc3bfb0123 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -4700,9 +4700,33 @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
-    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
-    decode_inst_opcode(&dec, isa);
+
+    static const struct {
+        bool (*guard_func)(const RISCVCPUConfig *);
+        const rv_opcode_data *opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa);
+    } decoders[] = {
+        { always_true_p, rvi_opcode_data, decode_inst_opcode },
+    };
+
+    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
+        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
+        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
+
+        if (guard_func(cfg)) {
+            dec.opcode_data = opcode_data;
+            decode_func(&dec, isa);
+            if (dec.op != rv_op_illegal)
+                break;
+        }
+    }
+
+    if (dec.op == rv_op_illegal) {
+        dec.opcode_data = rvi_opcode_data;
+    }
+
     decode_inst_operands(&dec, isa);
     decode_inst_decompress(&dec, isa);
     decode_inst_lift_pseudo(&dec);

From f6f72338d80ec6f15a6b18643797bc10901aadf3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:33 +0200
Subject: [PATCH 0558/1353] disas/riscv: Add support for XVentanaCondOps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch adds XVentanaCondOps support to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/meson.build      |  5 ++++-
 disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv-xventana.h | 18 ++++++++++++++++++
 disas/riscv.c          |  4 ++++
 4 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 disas/riscv-xventana.c
 create mode 100644 disas/riscv-xventana.h

diff --git a/disas/meson.build b/disas/meson.build
index 3a480eb9f8..f2b21e120f 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -6,7 +6,10 @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
 common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
 common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
-common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
+common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
+    'riscv.c',
+    'riscv-xventana.c'
+))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
 common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
 common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
new file mode 100644
index 0000000000..a0224d1fb3
--- /dev/null
+++ b/disas/riscv-xventana.c
@@ -0,0 +1,41 @@
+/*
+ * QEMU RISC-V Disassembler for xventana.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xventana.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    ventana_op_vt_maskc = 1,
+    ventana_op_vt_maskcn = 2,
+} rv_ventana_op;
+
+const rv_opcode_data ventana_opcode_data[] = {
+    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+};
+
+void decode_xventanacondops(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 30:
+            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
+            case 6: op = ventana_op_vt_maskc; break;
+            case 7: op = ventana_op_vt_maskcn; break;
+            }
+            break;
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
new file mode 100644
index 0000000000..72be9ffa16
--- /dev/null
+++ b/disas/riscv-xventana.h
@@ -0,0 +1,18 @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xventana*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XVENTANA_H
+#define DISAS_RISCV_XVENTANA_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data ventana_opcode_data[];
+
+void decode_xventanacondops(rv_decode*, rv_isa);
+
+#endif /* DISAS_RISCV_XVENTANA_H */
diff --git a/disas/riscv.c b/disas/riscv.c
index dc3bfb0123..c7bfd4ed32 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -22,6 +22,9 @@
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
+/* Vendor extensions */
+#include "disas/riscv-xventana.h"
+
 typedef enum {
     /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
@@ -4708,6 +4711,7 @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {

From 318df7238b9f842af96aad01ec183012c8fecab9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 12 Jun 2023 13:10:34 +0200
Subject: [PATCH 0559/1353] disas/riscv: Add support for XThead* instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Support for emulating XThead* instruction has been added recently.
This patch adds support for these instructions to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/meson.build      |   1 +
 disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv-xthead.h   |  28 ++
 disas/riscv.c          |  69 ++++
 disas/riscv.h          |  12 +
 target/riscv/cpu_cfg.h |  11 +
 6 files changed, 828 insertions(+)
 create mode 100644 disas/riscv-xthead.c
 create mode 100644 disas/riscv-xthead.h

diff --git a/disas/meson.build b/disas/meson.build
index f2b21e120f..815523ab85 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -8,6 +8,7 @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
 common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
     'riscv.c',
+    'riscv-xthead.c',
     'riscv-xventana.c'
 ))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
new file mode 100644
index 0000000000..99da679d16
--- /dev/null
+++ b/disas/riscv-xthead.c
@@ -0,0 +1,707 @@
+/*
+ * QEMU RISC-V Disassembler for xthead.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xthead.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    /* XTheadBa */
+    rv_op_th_addsl = 1,
+    /* XTheadBb */
+    rv_op_th_srri,
+    rv_op_th_srriw,
+    rv_op_th_ext,
+    rv_op_th_extu,
+    rv_op_th_ff0,
+    rv_op_th_ff1,
+    rv_op_th_rev,
+    rv_op_th_revw,
+    rv_op_th_tstnbz,
+    /* XTheadBs */
+    rv_op_th_tst,
+    /* XTheadCmo */
+    rv_op_th_dcache_call,
+    rv_op_th_dcache_ciall,
+    rv_op_th_dcache_iall,
+    rv_op_th_dcache_cpa,
+    rv_op_th_dcache_cipa,
+    rv_op_th_dcache_ipa,
+    rv_op_th_dcache_cva,
+    rv_op_th_dcache_civa,
+    rv_op_th_dcache_iva,
+    rv_op_th_dcache_csw,
+    rv_op_th_dcache_cisw,
+    rv_op_th_dcache_isw,
+    rv_op_th_dcache_cpal1,
+    rv_op_th_dcache_cval1,
+    rv_op_th_icache_iall,
+    rv_op_th_icache_ialls,
+    rv_op_th_icache_ipa,
+    rv_op_th_icache_iva,
+    rv_op_th_l2cache_call,
+    rv_op_th_l2cache_ciall,
+    rv_op_th_l2cache_iall,
+    /* XTheadCondMov */
+    rv_op_th_mveqz,
+    rv_op_th_mvnez,
+    /* XTheadFMemIdx */
+    rv_op_th_flrd,
+    rv_op_th_flrw,
+    rv_op_th_flurd,
+    rv_op_th_flurw,
+    rv_op_th_fsrd,
+    rv_op_th_fsrw,
+    rv_op_th_fsurd,
+    rv_op_th_fsurw,
+    /* XTheadFmv */
+    rv_op_th_fmv_hw_x,
+    rv_op_th_fmv_x_hw,
+    /* XTheadMac */
+    rv_op_th_mula,
+    rv_op_th_mulah,
+    rv_op_th_mulaw,
+    rv_op_th_muls,
+    rv_op_th_mulsw,
+    rv_op_th_mulsh,
+    /* XTheadMemIdx */
+    rv_op_th_lbia,
+    rv_op_th_lbib,
+    rv_op_th_lbuia,
+    rv_op_th_lbuib,
+    rv_op_th_lhia,
+    rv_op_th_lhib,
+    rv_op_th_lhuia,
+    rv_op_th_lhuib,
+    rv_op_th_lwia,
+    rv_op_th_lwib,
+    rv_op_th_lwuia,
+    rv_op_th_lwuib,
+    rv_op_th_ldia,
+    rv_op_th_ldib,
+    rv_op_th_sbia,
+    rv_op_th_sbib,
+    rv_op_th_shia,
+    rv_op_th_shib,
+    rv_op_th_swia,
+    rv_op_th_swib,
+    rv_op_th_sdia,
+    rv_op_th_sdib,
+    rv_op_th_lrb,
+    rv_op_th_lrbu,
+    rv_op_th_lrh,
+    rv_op_th_lrhu,
+    rv_op_th_lrw,
+    rv_op_th_lrwu,
+    rv_op_th_lrd,
+    rv_op_th_srb,
+    rv_op_th_srh,
+    rv_op_th_srw,
+    rv_op_th_srd,
+    rv_op_th_lurb,
+    rv_op_th_lurbu,
+    rv_op_th_lurh,
+    rv_op_th_lurhu,
+    rv_op_th_lurw,
+    rv_op_th_lurwu,
+    rv_op_th_lurd,
+    rv_op_th_surb,
+    rv_op_th_surh,
+    rv_op_th_surw,
+    rv_op_th_surd,
+    /* XTheadMemPair */
+    rv_op_th_ldd,
+    rv_op_th_lwd,
+    rv_op_th_lwud,
+    rv_op_th_sdd,
+    rv_op_th_swd,
+    /* XTheadSync */
+    rv_op_th_sfence_vmas,
+    rv_op_th_sync,
+    rv_op_th_sync_i,
+    rv_op_th_sync_is,
+    rv_op_th_sync_s,
+} rv_xthead_op;
+
+const rv_opcode_data xthead_opcode_data[] = {
+    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadBa */
+    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadBb */
+    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    /* XTheadBs */
+    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    /* XTheadCmo */
+    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadCondMov */
+    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadFMemIdx */
+    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadFmv */
+    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    /* XTheadMac */
+    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadMemIdx */
+    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadMemPair */
+    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    /* XTheadSync */
+    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+};
+
+void decode_xtheadba(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000000:
+                case 0b0000001:
+                case 0b0000010:
+                case 0b0000011: op = rv_op_th_addsl; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbb(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0001010: op = rv_op_th_srriw; break;
+                case 0b1000000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_tstnbz;
+                    }
+                    break;
+                case 0b1000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_rev;
+                    }
+                    break;
+                case 0b1000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff0;
+                    }
+                    break;
+                case 0b1000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff1;
+                    }
+                    break;
+                case 0b1000100:
+                case 0b1001000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_revw;
+                    }
+                    break;
+                case 0b0000100:
+                case 0b0000101: op = rv_op_th_srri; break;
+                }
+                break;
+            case 2: op = rv_op_th_ext; break;
+            case 3: op = rv_op_th_extu; break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbs(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 26) & 0b111111) {
+                case 0b100010: op = rv_op_th_tst; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 20 & 0b111111111111)) {
+                case 0b000000000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_call;
+                    }
+                    break;
+                case 0b000000000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_ciall;
+                    }
+                    break;
+                case 0b000000000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_iall;
+                    }
+                    break;
+                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
+                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
+                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
+                case 0b000000100101: op = rv_op_th_dcache_cva; break;
+                case 0b000000100111: op = rv_op_th_dcache_civa; break;
+                case 0b000000100110: op = rv_op_th_dcache_iva; break;
+                case 0b000000100001: op = rv_op_th_dcache_csw; break;
+                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
+                case 0b000000100010: op = rv_op_th_dcache_isw; break;
+                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
+                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
+                case 0b000000010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_iall;
+                    }
+                    break;
+                case 0b000000010001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_ialls;
+                    }
+                    break;
+                case 0b000000111000: op = rv_op_th_icache_ipa; break;
+                case 0b000000110000: op = rv_op_th_icache_iva; break;
+                case 0b000000010101:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_call;
+                    }
+                    break;
+                case 0b000000010111:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_ciall;
+                    }
+                    break;
+                case 0b000000010110:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_iall;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0100000: op = rv_op_th_mveqz; break;
+                case 0b0100001: op = rv_op_th_mvnez; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 6:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_flrw; break;
+                case 10: op = rv_op_th_flurw; break;
+                case 12: op = rv_op_th_flrd; break;
+                case 14: op = rv_op_th_flurd; break;
+                }
+                break;
+            case 7:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_fsrw; break;
+                case 10: op = rv_op_th_fsurw; break;
+                case 12: op = rv_op_th_fsrd; break;
+                case 14: op = rv_op_th_fsurd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b1010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_hw_x;
+                    }
+                    break;
+                case 0b1100000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_x_hw;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmac(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0010000: op = rv_op_th_mula; break;
+                case 0b0010001: op = rv_op_th_muls; break;
+                case 0b0010010: op = rv_op_th_mulaw; break;
+                case 0b0010011: op = rv_op_th_mulsw; break;
+                case 0b0010100: op = rv_op_th_mulah; break;
+                case 0b0010101: op = rv_op_th_mulsh; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_lrb; break;
+                case 1: op = rv_op_th_lbib; break;
+                case 2: op = rv_op_th_lurb; break;
+                case 3: op = rv_op_th_lbia; break;
+                case 4: op = rv_op_th_lrh; break;
+                case 5: op = rv_op_th_lhib; break;
+                case 6: op = rv_op_th_lurh; break;
+                case 7: op = rv_op_th_lhia; break;
+                case 8: op = rv_op_th_lrw; break;
+                case 9: op = rv_op_th_lwib; break;
+                case 10: op = rv_op_th_lurw; break;
+                case 11: op = rv_op_th_lwia; break;
+                case 12: op = rv_op_th_lrd; break;
+                case 13: op = rv_op_th_ldib; break;
+                case 14: op = rv_op_th_lurd; break;
+                case 15: op = rv_op_th_ldia; break;
+                case 16: op = rv_op_th_lrbu; break;
+                case 17: op = rv_op_th_lbuib; break;
+                case 18: op = rv_op_th_lurbu; break;
+                case 19: op = rv_op_th_lbuia; break;
+                case 20: op = rv_op_th_lrhu; break;
+                case 21: op = rv_op_th_lhuib; break;
+                case 22: op = rv_op_th_lurhu; break;
+                case 23: op = rv_op_th_lhuia; break;
+                case 24: op = rv_op_th_lrwu; break;
+                case 25: op = rv_op_th_lwuib; break;
+                case 26: op = rv_op_th_lurwu; break;
+                case 27: op = rv_op_th_lwuia; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_srb; break;
+                case 1: op = rv_op_th_sbib; break;
+                case 2: op = rv_op_th_surb; break;
+                case 3: op = rv_op_th_sbia; break;
+                case 4: op = rv_op_th_srh; break;
+                case 5: op = rv_op_th_shib; break;
+                case 6: op = rv_op_th_surh; break;
+                case 7: op = rv_op_th_shia; break;
+                case 8: op = rv_op_th_srw; break;
+                case 9: op = rv_op_th_swib; break;
+                case 10: op = rv_op_th_surw; break;
+                case 11: op = rv_op_th_swia; break;
+                case 12: op = rv_op_th_srd; break;
+                case 13: op = rv_op_th_sdib; break;
+                case 14: op = rv_op_th_surd; break;
+                case 15: op = rv_op_th_sdia; break;
+                }
+                break;
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_lwd; break;
+                case 30: op = rv_op_th_lwud; break;
+                case 31: op = rv_op_th_ldd; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_swd; break;
+                case 31: op = rv_op_th_sdd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadsync(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000010: op = rv_op_th_sfence_vmas; break;
+                case 0b0000000:
+                    switch ((inst >> 20) & 0b11111) {
+                    case 0b11000: op = rv_op_th_sync; break;
+                    case 0b11010: op = rv_op_th_sync_i; break;
+                    case 0b11011: op = rv_op_th_sync_is; break;
+                    case 0b11001: op = rv_op_th_sync_s; break;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
new file mode 100644
index 0000000000..fcd42746e7
--- /dev/null
+++ b/disas/riscv-xthead.h
@@ -0,0 +1,28 @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xthead*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XTHEAD_H
+#define DISAS_RISCV_XTHEAD_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data xthead_opcode_data[];
+
+void decode_xtheadba(rv_decode *, rv_isa);
+void decode_xtheadbb(rv_decode *, rv_isa);
+void decode_xtheadbs(rv_decode *, rv_isa);
+void decode_xtheadcmo(rv_decode *, rv_isa);
+void decode_xtheadcondmov(rv_decode *, rv_isa);
+void decode_xtheadfmemidx(rv_decode *, rv_isa);
+void decode_xtheadfmv(rv_decode *, rv_isa);
+void decode_xtheadmac(rv_decode *, rv_isa);
+void decode_xtheadmemidx(rv_decode *, rv_isa);
+void decode_xtheadmempair(rv_decode *, rv_isa);
+void decode_xtheadsync(rv_decode *, rv_isa);
+
+#endif /* DISAS_RISCV_XTHEAD_H */
diff --git a/disas/riscv.c b/disas/riscv.c
index c7bfd4ed32..94e568a7e9 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -18,11 +18,13 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
 /* Vendor extensions */
+#include "disas/riscv-xthead.h"
 #include "disas/riscv-xventana.h"
 
 typedef enum {
@@ -3869,6 +3871,26 @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
     return ((inst << 56) >> 60);
 }
 
+static uint32_t operand_imm6(rv_inst inst)
+{
+    return (inst << 38) >> 60;
+}
+
+static uint32_t operand_imm2(rv_inst inst)
+{
+    return (inst << 37) >> 62;
+}
+
+static uint32_t operand_immh(rv_inst inst)
+{
+    return (inst << 32) >> 58;
+}
+
+static uint32_t operand_imml(rv_inst inst)
+{
+    return (inst << 38) >> 58;
+}
+
 static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
 {
     int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
@@ -4233,6 +4255,38 @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
         break;
+    case rv_codec_r2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_rs2(inst);
+        break;
+    case rv_codec_r2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        break;
+    case rv_codec_r2_imm6:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_imm6(inst);
+        break;
+    case rv_codec_r_imm2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->rs2 = operand_rs2(inst);
+        dec->imm = operand_imm2(inst);
+        break;
+    case rv_codec_r2_immhl:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_immh(inst);
+        dec->imm1 = operand_imml(inst);
+        break;
+    case rv_codec_r2_imm2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = sextract32(operand_rs2(inst), 0, 5);
+        dec->imm1 = operand_imm2(inst);
+        break;
     };
 }
 
@@ -4446,6 +4500,10 @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
             append(buf, tmp, buflen);
             break;
+        case 'j':
+            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
+            append(buf, tmp, buflen);
+            break;
         case 'o':
             snprintf(tmp, sizeof(tmp), "%d", dec->imm);
             append(buf, tmp, buflen);
@@ -4711,6 +4769,17 @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
+        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
+        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
+        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
+        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
+        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
+        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
+        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
+        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
+        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
+        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
         { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
diff --git a/disas/riscv.h b/disas/riscv.h
index 460196510c..052a0c4281 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -159,6 +159,12 @@ typedef enum {
     rv_codec_zcmp_cm_pushpop,
     rv_codec_zcmp_cm_mv,
     rv_codec_zcmt_jt,
+    rv_codec_r2_imm5,
+    rv_codec_r2,
+    rv_codec_r2_imm6,
+    rv_codec_r_imm2,
+    rv_codec_r2_immhl,
+    rv_codec_r2_imm2_imm5,
 } rv_codec;
 
 /* structures */
@@ -185,6 +191,7 @@ typedef struct {
     uint64_t  inst;
     const rv_opcode_data *opcode_data;
     int32_t   imm;
+    int32_t   imm1;
     uint16_t  op;
     uint8_t   codec;
     uint8_t   rd;
@@ -283,5 +290,10 @@ enum {
 #define rv_fmt_push_rlist             "O\tx,-i"
 #define rv_fmt_pop_rlist              "O\tx,i"
 #define rv_fmt_zcmt_index             "O\ti"
+#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
+#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
+#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
+#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
+#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index 0b4fe4b540..6b7e736bc2 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -157,6 +157,17 @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
         return cfg->ext_ ## ext ; \
     }
 
+MATERIALISE_EXT_PREDICATE(xtheadba)
+MATERIALISE_EXT_PREDICATE(xtheadbb)
+MATERIALISE_EXT_PREDICATE(xtheadbs)
+MATERIALISE_EXT_PREDICATE(xtheadcmo)
+MATERIALISE_EXT_PREDICATE(xtheadcondmov)
+MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadfmv)
+MATERIALISE_EXT_PREDICATE(xtheadmac)
+MATERIALISE_EXT_PREDICATE(xtheadmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadmempair)
+MATERIALISE_EXT_PREDICATE(xtheadsync)
 MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
 
 #endif

From 869d76f2073f6ed28e26bb264d4c2c8841f06496 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Sat, 3 Jun 2023 21:42:34 +0800
Subject: [PATCH 0560/1353] target/riscv: Make MPV only work when MPP != PRV_M

Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
when MPP=PRV_M.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 3 ++-
 target/riscv/op_helper.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index a944f25694..8e3c73da52 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -47,7 +47,8 @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 
         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
-            virt = get_field(env->mstatus, MSTATUS_MPV);
+            virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                   (mode != PRV_M);
             if (virt) {
                 status = env->vsstatus;
             }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index f563dc3981..9cdb9cdd06 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -335,7 +335,8 @@ target_ulong helper_mret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
 
-    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
+    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                             (prev_priv != PRV_M);
     mstatus = set_field(mstatus, MSTATUS_MIE,
                         get_field(mstatus, MSTATUS_MPIE));
     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);

From 03dd405dd5da6e0df3023bf9394ad0490b8369ab Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Sat, 3 Jun 2023 21:42:35 +0800
Subject: [PATCH 0561/1353] target/riscv: Support MSTATUS.MPV/GVA only when RVH
 is enabled

MPV and GVA bits are added by hypervisor extension to mstatus
and mstatush (if MXLEN=32).

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 58499b5afc..6ac11d1f11 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1311,11 +1311,9 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     }
 
     if (xl != MXL_RV32 || env->debugger) {
-        /*
-         * RV32: MPV and GVA are not in mstatus. The current plan is to
-         * add them to mstatush. For now, we just don't support it.
-         */
-        mask |= MSTATUS_MPV | MSTATUS_GVA;
+        if (riscv_has_ext(env, RVH)) {
+            mask |= MSTATUS_MPV | MSTATUS_GVA;
+        }
         if ((val & MSTATUS64_UXL) != 0) {
             mask |= MSTATUS64_UXL;
         }
@@ -1351,7 +1349,7 @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t valh = (uint64_t)val << 32;
-    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
+    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
 
     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 

From 98fbdaaed50781e18d9a612590d1d47106de0aca Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Sat, 3 Jun 2023 21:42:36 +0800
Subject: [PATCH 0562/1353] target/riscv: Remove redundant assignment to SXL

SXL is initialized as env->misa_mxl which is also the mxl value.
So we can just remain it unchanged to keep it read-only.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 6ac11d1f11..25345f3153 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1321,10 +1321,6 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 
     mstatus = (mstatus & ~mask) | (val & mask);
 
-    if (xl > MXL_RV32) {
-        /* SXL field is for now read only */
-        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
-    }
     env->mstatus = mstatus;
 
     /*

From 029f5feed6e5b7173788b7414af3e8aa32746344 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 20 Jun 2023 12:24:43 -0300
Subject: [PATCH 0563/1353] target/riscv/cpu.c: fix veyron-v1 CPU properties

Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
and ext_icsr from riscv_cpu_init(), the init() function of
TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
CPUs to explictly enable all extensions and features it requires,
without any 'magic values' that were inherited by the parent type.

This commit failed to make appropriate changes in the 'veyron-v1' CPU,
added earlier by commit e1d084a8524a. The result is that the veyron-v1
CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
case.

The reason why it took this long to notice (thanks LIU Zhiwei for
reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
absent in the 'riscv,isa' DT, implying that they're both present if the
'i' extension is enabled. OpenSBI also doesn't error out or warns about
the lack of 'pmp', it'll just not protect memory pages.

Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
7f0bdfb5bfc2 already did with other CPUs.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 3faf703131..b9b3879281 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -444,6 +444,9 @@ static void rv64_veyron_v1_cpu_init(Object *obj)
 
     /* Enable ISA extensions */
     cpu->cfg.mmu = true;
+    cpu->cfg.ext_ifencei = true;
+    cpu->cfg.ext_icsr = true;
+    cpu->cfg.pmp = true;
     cpu->cfg.ext_icbom = true;
     cpu->cfg.cbom_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;

From 3a610f5430f61bd67f0ac78ef40c8d3bd2b4f8ee Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Wed, 14 Jun 2023 11:25:46 +0800
Subject: [PATCH 0564/1353] target/riscv: Add additional xlen for address when
 MPRV=1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As specified in privilege spec:"When MPRV=1, load and store memory
addresses are treated as though the current XLEN were set to MPP’s
XLEN". So the xlen for address may be different from current xlen.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
 target/riscv/cpu_helper.c |  1 +
 target/riscv/translate.c  | 13 ++++++++++-
 3 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 7adb8706ac..3081603464 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -500,6 +500,7 @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 FIELD(TB_FLAGS, PRIV, 24, 2)
+FIELD(TB_FLAGS, AXL, 26, 2)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
@@ -516,13 +517,20 @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
     return &env_archcpu(env)->cfg;
 }
 
-#if defined(TARGET_RISCV32)
-#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
-#else
-static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+#if !defined(CONFIG_USER_ONLY)
+static inline int cpu_address_mode(CPURISCVState *env)
+{
+    int mode = env->priv;
+
+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+    }
+    return mode;
+}
+
+static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
 {
     RISCVMXL xl = env->misa_mxl;
-#if !defined(CONFIG_USER_ONLY)
     /*
      * When emulating a 32-bit-only cpu, use RV32.
      * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
@@ -530,7 +538,7 @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
      * back to RV64 for lower privs.
      */
     if (xl != MXL_RV32) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             break;
         case PRV_U:
@@ -541,11 +549,38 @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
             break;
         }
     }
-#endif
     return xl;
 }
 #endif
 
+#if defined(TARGET_RISCV32)
+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    return cpu_get_xl(env, env->priv);
+#else
+    return env->misa_mxl;
+#endif
+}
+#endif
+
+#if defined(TARGET_RISCV32)
+#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
+{
+#ifdef CONFIG_USER_ONLY
+    return env->xl;
+#else
+    int mode = cpu_address_mode(env);
+
+    return cpu_get_xl(env, mode);
+#endif
+}
+#endif
+
 static inline int riscv_cpu_xlen(CPURISCVState *env)
 {
     return 16 << env->xl;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 8e3c73da52..2e771ddfc9 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -135,6 +135,7 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
     if (env->cur_pmmask != 0) {
         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 0a5ab89c43..98d54c5617 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -64,6 +64,7 @@ typedef struct DisasContext {
     target_ulong priv_ver;
     RISCVMXL misa_mxl_max;
     RISCVMXL xl;
+    RISCVMXL address_xl;
     uint32_t misa_ext;
     uint32_t opcode;
     RISCVExtStatus mstatus_fs;
@@ -129,6 +130,14 @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 #define get_xl(ctx)    ((ctx)->xl)
 #endif
 
+#ifdef TARGET_RISCV32
+#define get_address_xl(ctx)    MXL_RV32
+#elif defined(CONFIG_USER_ONLY)
+#define get_address_xl(ctx)    MXL_RV64
+#else
+#define get_address_xl(ctx)    ((ctx)->address_xl)
+#endif
+
 /* The word size for this machine mode. */
 static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
 {
@@ -575,12 +584,13 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     tcg_gen_addi_tl(addr, src1, imm);
     if (ctx->pm_mask_enabled) {
         tcg_gen_andc_tl(addr, addr, pm_mask);
-    } else if (get_xl(ctx) == MXL_RV32) {
+    } else if (get_address_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
     if (ctx->pm_base_enabled) {
         tcg_gen_or_tl(addr, addr, pm_base);
     }
+
     return addr;
 }
 
@@ -1177,6 +1187,7 @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
     ctx->misa_mxl_max = env->misa_mxl_max;
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
+    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);

From ef1ba32afff6b3d9be377804904b784da6594219 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Wed, 14 Jun 2023 11:25:47 +0800
Subject: [PATCH 0565/1353] target/riscv: update cur_pmbase/pmmask based on
 mode affected by MPRV

Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
should also take MPRV into consideration. As pointer mask for instruction
is not supported currently, so we can directly update cur_pmbase/pmmask
based on address related mode and xlen affected by MPRV now.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  7 +++++--
 target/riscv/csr.c        | 27 ++++++++++++++++++++-------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 2e771ddfc9..bb9d923818 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -149,13 +149,16 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env)
 {
     target_ulong mask = 0, base = 0;
+    RISCVMXL xl = env->xl;
     /*
      * TODO: Current RVJ spec does not specify
      * how the extension interacts with XLEN.
      */
 #ifndef CONFIG_USER_ONLY
+    int mode = cpu_address_mode(env);
+    xl = cpu_get_xl(env, mode);
     if (riscv_has_ext(env, RVJ)) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             if (env->mmte & M_PM_ENABLE) {
                 mask = env->mpmmask;
@@ -179,7 +182,7 @@ void riscv_cpu_update_mask(CPURISCVState *env)
         }
     }
 #endif
-    if (env->xl == MXL_RV32) {
+    if (xl == MXL_RV32) {
         env->cur_pmmask = mask & UINT32_MAX;
         env->cur_pmbase = base & UINT32_MAX;
     } else {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 25345f3153..ea7585329e 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -1329,8 +1329,9 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
      */
     if (env->debugger) {
         env->xl = cpu_recompute_xl(env);
-        riscv_cpu_update_mask(env);
     }
+
+    riscv_cpu_update_mask(env);
     return RISCV_EXCP_NONE;
 }
 
@@ -3633,7 +3634,7 @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmmask = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -3661,8 +3662,11 @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmmask = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -3689,8 +3693,11 @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmmask = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -3713,7 +3720,7 @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmbase = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -3741,8 +3748,11 @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmbase = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -3769,8 +3779,11 @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmbase = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 

From aa903cf31391dd505b399627158f1292a6d19896 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Fri, 30 Jun 2023 23:36:04 +0800
Subject: [PATCH 0566/1353] roms/opensbi: Upgrade from v1.2 to v1.3

Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.

The v1.3 release includes the following commits:

440fa81 treewide: Replace TRUE/FALSE with true/false
6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
65638f8 lib: utils/sys: Allow custom HTIF base address for RV32
f14595a lib: sbi: Allow platform to influence cold boot HART selection
6957ae0 platform: generic: Allow platform_override to select cold boot HART
cb7e7c3 platform: generic: Allow platform_override to perform firmware init
8020df8 generic/starfive: Add Starfive JH7110 platform implementation
6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
9e397e3 docs: domain_support: Use capital letter for privilege modes
9e0ba09 include: sbi: Fine grain the permissions for M and SU modes
aace1e1 lib: sbi: Use finer permission semantics for address validation
22dbdb3 lib: sbi: Add permissions for the firmware start till end
1ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
44f736c lib: sbi: Modify the boot time region flag prints
20646e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
3e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
59a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
001106d docs: Update domain's region permissions and requirements
da5594b platform: generic: allwinner: Fix PLIC array bounds
ce2a834 docs: generic.md: fix typo of andes-ae350
8ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
b1818ee include: types: add always inline compiler attribute
9c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
787296a platform: andes/ae350: Implement hart hotplug using HSM extension
7aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
a990309 lib: utils: Fix reserved memory node for firmware memory
fefa548 firmware: Split RO/RX and RW sections
2f40a99 firmware: Move dynsym and reladyn sections to RX section
c10e3fe firmware: Add RW section offset in scratch
b666760 lib: sbi: Print the RW section offset
230278d lib: sbi: Add separate entries for firmware RX and RW regions
dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
33bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
c45992c platform: generic: allwinner: Advertise nonretentive suspend
c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
8050081 firmware: Not to clear all the MIP
84d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
199189b lib: utils: Mark only the largest region as reserved in FDT
66b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
642f3de Makefile: Add missing .dep files for fw_*.elf.ld
09b34d8 include: Add support for byteorder/endianness conversion
680bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
b224ddb include: types: Add typedefs for endianness
aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
e3bf1af include: Add defines for SBI debug console extension
0ee3a86 lib: sbi: Add sbi_nputs() function
4e0572f lib: sbi: Add sbi_ngets() function
eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
5a41a38 lib: sbi: Implement SBI debug console extension
c43903c lib: sbi: Add console_puts() callback in the console device
29285ae lib: utils/serial: Implement console_puts() for semihosting
65c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
321293c lib: utils/fdt: Fix fdt_pmu.c header dependency
aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
745aaec platform: generic/andes: Fix ae350.c header dependency
99d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
6861ee9 lib: utils: fdt_fixup: Fix compile error
4f2be40 docs: fix typo in fw.md
30ea806 lib: sbi_hart: Enable hcontext and scontext
81adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
31b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
2491242 platform: generic: renesas: rzfive: Configure the PMA region
67b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
5a75f53 lib: sbi/sbi_domain: cosmetic style fixes
bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
17b3776 docs: domain_support: Update the DT example
1364d5a lib: sbi_hsm: Factor out invalid state detection
40f16a8 lib: sbi_hsm: Don't try to restore state on failed change
c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
b1ae6ef lib: sbi_hsm: Move misplaced comment
07673fc lib: sbi_hsm: Remove unnecessary include
8a40306 lib: sbi_hsm: Export some functions
73623a0 lib: sbi: Add system suspend skeleton
c9917b6 lib: sbi: Add system_suspend_allowed domain property
7c964e2 lib: sbi: Implement system suspend
37558dc docs: Correct opensbi-domain property name
5ccebf0 platform: generic: Add system suspend test
908be1b gpio/starfive: add gpio driver and support gpio reset
4b28afc make: Add a command line option for debugging OpenSBI
e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
568ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
506144f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
1fe8dc9 lib: sbi_pmu: add callback for counter width
51951d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
60c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
548e4b4 lib: sbi_pmu: Rename fw_counter_value
b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
641d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
57d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
73ab11d lib: sbi: Fix how to check whether the domain contains fw_region
f64dfcd lib: sbi: Introduce sbi_entry_count() function
30b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
8e90259 lib: sbi_hart: clear mip csr during hart init
45ba2b2 include: Add defines for SBI CPPC extension
33caae8 lib: sbi: Implement SBI CPPC extension
91767d0 lib: sbi: Print the CPPC device name
edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
2868f26 lib: utils: fdt_fixup: avoid buffer overrun
66fa925 lib: sbi: Optimize sbi_tlb
24dde46 lib: sbi: Optimize sbi_ipi
80078ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
f692289 firmware: Optimize loading relocation type
e41dbb5 firmware: Change to use positive offset to access relocation entries
bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
674e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
7919530 lib: sbi: Add debug print when sbi_pmu_init fails
4e33530 lib: sbi: Remove unnecessary semicolon
6bc02de lib: sbi: Simplify sbi_ipi_process remove goto
dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
f58c140 lib: sbi: Introduce register_extensions extension callback
e307ba7 lib: sbi: Narrow vendor extension range
042f0c3 lib: sbi: pmu: Remove unnecessary probe function
8b952d4 lib: sbi: Only register available extensions
767b5fc lib: sbi: Optimize probe of srst/susp
c3e31cb lib: sbi: Remove 0/1 probe implementations
33f1722 lib: sbi: Document sbi_ecall_extension members
d4c46e0 Makefile: Dereference symlinks on install
8b99a7f lib: sbi: Fix return of sbi_console_init
264d0be lib: utils: Improve fdt_serial_init
9a0bdd0 lib: utils: Improve fdt_ipi
122f226 lib: utils: Improve fdt_timer
df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
bdde2ec lib: sbi: Align system suspend errors with spec
aad7a37 include: sbi_scratch: Add helper macros to access data type
5cf9a54 platform: Allow platforms to specify heap size
40d36a6 lib: sbi: Introduce simple heap allocator
2a04f70 lib: sbi: Print scratch size and usage at boot time
bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
ef4542d lib: sbi: Use heap for root domain creation
66daafe lib: sbi: Use scratch space to save per-HART domain pointer
fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
903e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
5a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
7e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
3c1c972 lib: utils/fdt: Use heap in FDT domain parsing
acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
1df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
355796c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
524feec docs: Add OpenSBI logo and use it in the top-level README.md
932be2c README.md: Improve project copyright information
8153b26 platform/lib: Set no-map attribute on all PMP regions
d64942f firmware: Fix find hart index
27c957a lib: reset: Move fdt_reset_init into generic_early_init
8bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
2552799 include: Bump-up version to 1.3

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index 6a8425885c7dd0263391637b665c83d04684c68a..7b6c67e0ae299abb79dc0975ce8336e0185d4071 100644
GIT binary patch
literal 135344
zcmc${4O~-4);~TsH#avy6llb#t6L-zl(v)wU$$;*gAgL17GFT6)>3bgZFk$^Qr5?A
zX%oXu3`j*IMl9W;7Erde)D*LQQ9wXME20(ON?mM3R$Cja2IT#JW^N+bcAx+A`+c6z
z=huGx=H8ieXU?2C^LFOU5FuueEt^3RG6~8Iijcw+BStn}j3Oj5G_ZmbkEgha%qWFa
zgyhoW1N{8Qr$LCH)XORoA<M?V0R@eaoObjni`O7`SifP92-)bRYQ-4%YD{RaGT<#_
z{f+|qH4iK9P(aT`a=JAV`r~<M^djyzrz!e?2+<#JM8AFiw|`d#{741uv;GM5@4VV&
zd43C$zdhu`EaDzIO=G&qXKY)Xv@K_lGQbz~$8qSb_dVZzB61vC)9Y7U`GLU8cRw*v
zm@^*~M(fqFN<|28<mGkSnhf0M<ZM<3cp*P8$HL?xg%^~=>*eqa-{dd_#LB(Oe>A@w
zK_ycWBV=SVOHhOti&B*%<zzF;Pz39RevQ(p4wz;WJt$WXy^R+k1q*qxX=1}8EJHu4
zWeks+7{w9@6YaTfGv(5Aw<$&gXQNNGM~vPRxprFw$dr$wq9R0NP=sh(q>cTvC_?m;
znoq;1V1brp9X9qywKCv4qzwGYorBgfDM~r@C!|#Ep_J3MJy5FAN@d8N2Woy~N&FsB
zKKh?yCn%Mn55@{Sn0z6Bkx)8QmogAPW8SnAlv6#=X+cWWcOvC9k!WOoXQlu*qLK3b
zt;G?War;b-obB`(N%_%~2>L<Ea)_32V{BsEMg|%7&O;IJ&`7>|3>ER#k0@}A4c;tQ
z-a)p(AJNe<5nE^!@wOAK@v(euplo*>$mXb}Y>uztpM%<E;gT~D);DE9EwxqTM?2y&
z2F>#nG}H~vol*uYC0aFopC?TD6|JNZMgDi}STm?s%R)1J)nS4RwAV+}uq5LV^=&TC
z8&O(AnK$B$Y1CG4hIPcPABq^oBJR1r$pjr(b4<_ysAYP%mNR@sGa@LgJ6NK@(mTPv
zVec9ETyulF{>NwdE)VmB>Q4%x4G-T5Ml&v6$Ou9+5>=D;$q_<UD2>HnXf^DKVhnp}
z#%8doZHA>H#Zp{K!;#-wcrJp;P;b;hs|ETDl;G>CqEH0SARLzQkZ6W-+7i*7Kon*<
zdk|TE3P+Yb;b`EYh{#A}`za8S-+4=r@<3phTtBbd5GbO@oxtDS3G|&Yt_FWOu2xhp
zs+JrbbL^qx6TkXxQ(&{|Y{<FL^Whg~U7piA_sY@gV@FTaH61&9{QQZ_UtMYXuKD`e
zo9BK!|I@{;%e}3GS0We+Im3#dGX!W5J%vYxDfNgBWGGt6QwC){g%(FIUXbX!a@or9
z&#iinp2mm`(==jwIxjX%uNTuH3}Xn<F!UolV|b(<S|KAbJgSk<kMR=2WAzd`lwl2_
z8kT;XXAO_nvxY!Mnvws|3`3v>ennyMOGy(mP(axKo;*M*zZ>_zAd{2@|F2}iW7+&}
zq-?PM`1m43Md~A|dHQ)&ls<}z)<^4OD6L*g&DYPTV)e09oIZ|<*T+)}^b4qk`i0aY
z{UYia{WBQ}XvRjJNB``J^I|Q$Yld{5Ls2<s*36&hs4anCF1ixUkK3rrO5CW!`3ahD
zl6u#A+RE6NvF_(GcG>;sV0LWW*jkx(**xy}bx*sJEQ2t2It;Wlh7n66N4{(52j6+o
zgYWf}=N(uf|55JWA@~nJz7|ld!hF6KfTjw+)xpBA`q6dk0$U^(RA0xPS#)~Isic$1
zjjJ2bggevKw=HZZ8@-ropH074O_z(A5OWi+;+-gA9rrg4We9Gh7%gY&7&ltW<#k94
zYn{ab$#N!vajM(KM$9QjUnUeqaqqBW7x5ddFuITZGNCo9uy&*Mg#qZ7!uS_0+1a{`
z;^;7iKlB1j(A&<0fYFu<E7duybs`=&<K8;5%TVTp_;}m9f1qp~>nVYfe^Xi9ixfa3
z_d4;0GePHV2tI*(NfEb;9fRxcPOy4L`<8)k+U=MJeFNqo_6)Caf4|<Tu1Nnfp*&mQ
zXNs%jUL0?j8Y^=8hOHSr5XU=<(?^Z&Y2x82Jt2f~`DvWK=`RU6mS-pf%aOy2>BOPF
ze^gF|H=5}*1jivJrinjc-5C|fGwe=~M}^ukj`>l49JtV$8yL+-tK+xK54;A_)u|Ua
z#xp;_Q%dvi9ddW5Z`gtmBS$l1tpzYI;oHAa@X#YNC4UC037Sed6UI2heBZ{>U0CUm
zdfl997s{mhlT)3r0ZYqrvTsNTV_vp(ucxrAAnuI}-}tbMAoXo$O8Sf@C}G$n$9(46
zRxLNm<+TWEH7p31087EKnf;Cq&Or_-`yDO~1*O8}!E(uua7<>}3hQu*^bJs+aZH<D
zD9_UlU-z?b^V5!r%oP%jn&&vidY&t$Lit-sctFJ}D8Ku;`gO-cOe>al`YVwBWt@Ji
zC;iI?;04zO=0%Wea{%TgArVlQG9J>uh`+6P$?-6Ap43`##R@}kEY0WUIjkT-3(qGD
zlH`+}DPfH8To2FbVp1C@JuJj1J0(b+uM^^#KS8|6SzP_7K+`;am_~DSm?jK4i*+G{
zCLrONVH&2|ozKh8l(sBqv3i<7)0R3+Q-4^X;en?3Z_Z+*60{DzHcZ2RF-()P0r*kk
z(l#d#Q>1<-P_#oT>h;dz;we0lU|ucOxna8YL&J2{uS0u%*r`r`Yef8~LVO97y!tN?
zKiLoxOIvy;B5sG*Z?SH0?}+DE_-rK5r2?HgT|P?eQt@&Ll3vDoq`J%tu{^}4y!yfX
zQqMbRamp)BRDsHQj$vjAR6(yeQ_!EC0o4g4bcP{>5hWSj=|h|v%9KDuoQMf`r~4|%
z^N-L*SrQuNPUkgeiZ0FR+v!b0Lxs?K2n|@P*D%ml^V1*(F^{_G(}Dg)y@rCA&QypQ
z!%TCh4>4_PoW2!VBvj?5UkCIr!1(_N37zUrA3_6C3_&utMC$(n@6Q{8V%_h|>-+Uk
zzSV{xvpXax6W*UQ1e?(?RnTAG%focKXAMD(9=i4Lo@|&Zqd;>a%X6SM{;*#ck_$RA
zOTN4WmGYLPe<1n!ayNbIUx9u(lx13ZHk5T5zt;SY%E+e*d}`hR{Yr$|{sY9SJO2=3
z^wdiGo50U9fvV&WAn&C@%PH(|mpjXuQt_71b5y6}xbkd1m)pjUafXFGS)Ri!Eq<uU
zUBe}imiieBA5FQ_%d&{YE=Ye7){Z#76!g}2o+syeNI7Kzj!D8XVd;PH#00$s`WH9+
zO+~CHhKHDdSfc+^%iXzZ-iG?p;xOMJ2!oyz#!wxUHwK3#42OY)Q*d9Ep8v3it{%by
zq7^&f8;Qgqw115O)1;60LB2Gvb@#9SN>wk?M}zDFt)oQ9@Q?2&%13p&N2+o;mtBas
z_3w%dWup);cJx>Wh41S9oa+3*r;d1dt^XtB_mnd~Kh1Js8H{x2twm9`3s%JE_I$14
zpPN!+x03!!Gg@O4o=UtU-A{}+?|w=hHS-H0w%%)s`zgq){WBqqmtA!~wM(CKKWU_~
z?x&!?DuglRanP3;xb0phZ5P@BN_pAScIzRwIK1$aNWZ{iNUBi4x;a=YrcPTFLC7kB
z@|Rwh90J}88$O3#IXrp}A4zT0g-26b;c4V|EH(1Gwe)}Y9pxAJm83~^BJTL2W61Xo
zj92t@jffM;U=A%~%Cn(nkoqO=jhVC|SSBfo-wN{yn3MRnB>)Cgk5}=H)8PrBWE|h>
zi7!S=ocRd}0#_L+ku$=hF~9I$CxP<u8faC2Jg5#Np)1$zId`J@>{sVc7|)lUZECuF
z{K~QK>aHKXS^er2-T3mH(426yGW6U%<uq}xG6eoT3jadIy+Rw&&Asy|nlZ4P^XnZ~
zZq~=iz3O_G7|-*IcxVfK7SI_c9*+f6t{Q^tdXr3igQZJ>c!R#llC)f%BPrbx;r~72
z+P_En^J3r0KgzJ}ca$n|uO-JzB&6dkPMNyyjCBIck<7AN^50BHi{2G<@*lS>43a|m
z6Oaba-pcd1f0s#tzk36~M<>huJA|QwN1-VV7VBf^ik1ElR)J%@MU$4&AIYTplLl2?
z&#T7o__Z)!T71LCd`N-3)hVga5-3Aitkm34w6w7HRfwGcy=L(g%Z2Aahf6^N_!!%c
zLzLxM*HGq`owah~WaQx_C8<2m@p}0^LvVJ_M|TFa+>gPOm&^(pWibU`JpnpoZfJ#6
zah{asP=adNj%AXSU9oH9&d0^XABtBk*s(ye@TcceU)ZQKYaI&LJzlGP^zOZNRdPvP
z?^&1!=;SZCuq=sunNBvs)eH8A4|<sx#~9`Z%X)vr==G;9%aaMOwsA2O*RG*<MkNBL
zj92PyEZv2N1>Kl@YEoi|kw0yPIjMyYx^TcmX)F>Xno`U#oOcV_8MT$o>cg$zNI`y$
zphe-)FfXgY`jnYCU>DMXa^5UMUW`!Ava{t@Wig8$)H;2PqKiVbDyDfugh%(>8k+ud
z4fW6-JC%2zmKxDkmefIOnT}>CKr7_3{U>4EkTz}42vOgj3^j#V=(nNvu$-5GoK?JD
z1NEvY&-SkozAzuRbdN>64s;+`h8FSqhN9)TZTZRC@BXA-6MZ&%UhKixz&HkK0hh^8
zR(8sK8nodga7^0JMk_7@r4i)dq0*kzpKe{c^=DL=hO|Ctd*RWzr=){Qj=NhVgi(!d
z{iveLv{I@;kehN(8Bn{a>QqPLs&U&5HJ4}aZ&!?mG^S0f;~1&8q8oa1w&U|jQOlyT
zv@KgWuG>qsQyCydtqFw<UoLHZUf&RhwXHoPB|41KV7|9Si(+xgcurp(qL5>|M3h|_
zuvZ$g>8VDm3(p~$`l7^=le>(&OqA9lB|5=!jDpF>I?-!U1f$N_T~-Cq!uVs`TsyvI
z`cb_WMlsMHp5=56qMh@$O0xRo)?hTpB5-Lsstj<TRW-cb!-Yqe<V--#d-lx4JgiYr
zT3puh?2Pp2uqiWJ6U<PKFQae`3EvIN4r`;1XrrJ@vU)4XLs?RGWLS1MEgWhn(;gO5
zz~8T0TzDF!^Q``~r%ppbO8)gY2ON(%rh|h&w}L&$Vlwq`Y&YW5EG8CKaaxe0hl2g5
zK#|t{AO%iG&<`u<y`j`tDbRJ?U9p%mb$QaN(1yuQKe@E%`Cr$X*hUKUUUfp!B#aRU
zvI}btnyH(^T8ecv#H`ogaRJSQnU;8WtvR>gwABc;Xe?zF@GF;;vSc-z5Vn$wWJFCS
zZs|;_+*Ek-$o9Qk#Dfo}w#caB-D9iR>8qalV5~=zC)Yfg7-9<L^`~dVo0}*N=`&<P
zpW*n8eNd2pcyv}Gmga_af#+0b<C+&WE%_?>`08V8>ee2WoKHG|##?^_eNXQ9R>Qt{
zWGEkn%CmQXmLD|F%AK?M$mV%D$97@cnln8>Zq{-xE3$NNKs_CX(s*QH+kCid7rd2w
zb|K{lA=K_B!@g0-^7kZUXGG}O-#O!_QhM(uus6;}-0K#^{ZUDC*Xn5H9xtHxLYavN
z69SiQTP9lhQ|y|!vvKp{55@;B*tS3e5_P=QIAGZ%6*=;MJCLcBZ5dc@yU>Ab-LolP
zqWo|dr92Qv;kBl6-^-M;Jcm;5`36xMO_iZ+KE?gr1mnjhirZqPNE*6}19YjBa){Or
zk@xKvyEE;Evg4Fvt9B@_YF%PU6^tLg!c3+9mNTJqdRAhA{fTvft&%IM%W)SMonLY;
z>1=ZI>Lwk!^9b~NAT#->e`Fhia}l@BHHL{T&*nx4jb6<k$O+FmWOk;b3Eb-a;*4Mv
zZn<zbav-<VT42gym8xs~a<;C2u60tBrRy$byKn*KVlB0kq9P_-Lh{(2AzODarPr+H
zC)GOB)eld<We7frpeKF4uvP`F1IC^HjC?kn`@0NE`%}W2WoMVoTX}G0VDh$P(X&6r
zPXWm>FIi-=iqb;pRW;7AfJ{6WfOW*{az^&gv%IRn8P=9@#%?j48(ODzywKe%H;exQ
z<8GKb0NXKSX+2xcbW0dZqCdi+0qYJ|WhSnyN==Nd%1}Yc$)1TclMa?r2Gx8j-0B;}
zWwb~=y@njdD(GdcE20i$4<uTWSkQ90s|#^Hc5%&G%cicO!<vZo3W`%yisek%;O=qU
zPo-i`q@d~GO{j3oRrVcr?ha|pf|yO!UsZd0ORT|k@Np=!UXyxZ#q!Lr4MCfbbe@g3
zt3}pJz~NQ+w^7Hnmx$~zU*xD35x1oUd3qLNi35w=ttULa3#RtO9yHC`G{;zO3^mOL
zy~VoQc%RNggWCYeGaX4}x2&+cVJI`D>Kpp+_lcN8oVF|#KTTe@=c}`I#-`E}CyqBA
zJAd?Y_3A5YTGw8F`QoeRb-p1v%Fs_?9(NArbJu$BK*|bl&?oN?pQnSp!O~UNSF<+M
zN>67|mX^DF0Uc$Z(%L16!p|=#_OS5mi=Wpiw&7<re%_$SVJ!{aLjwjw&;n}mmL*m$
z)BcdftFAAJw`>>(HksxSgK7cPMtLsxUoE~hugG%;hFr@ARz0<F_vHQiY+Y+9PQO;R
ze;n8Qt*=3~85L~dHp`#~&hE1qP1HM*6FYVuql2USE*>+eV!auyP0@{7w&<gkfj!<h
zPr30oC<*3o33Ew4x#cD<v&HMI)$!AXLCcO{bYjQ3dGhlT>Zu%udB=c5TH0d>%I>38
z(S1$Ex%}cM%CldoG6Zdg8Om3%S7%pSj6BJe-fM(ik7H<N6CEm{mDBF_a<VZJ!?YNh
z<E0WVS0*w*8Z@klX;pTga_Wn{O4aMVqQ4s;9h{yaSlnmW7emv^>|TSit{10`sV5r$
zZrr%DJbSC%wX93MHaaHuP^>C$N1P=7r)Sr!I=gD#a|fSO@#mw1Uf8H}EqkI0*XfDl
zYg%!wg4MoGsMY&*YF4T~?G4{dYI8Ky=IB%N=-|<~HhUwXHpMVE;O;h%x|~hwvVqhk
zJVRYJkh+9tsLO^2>T)5}Wt^2uw~vRq>?QIYLkBO!^_a(HwvV&?brP!ivvTUWUW=rz
zPZ<cm#?6D7$pb47$IIfC0q1&c-aUvL{6QiwdK5*NvZ)nOmPD31Z05wXS#C?F3~RPC
z#di^};aW<>@D@%7=OJb22fbYP5564#rLX)#e`Hp!Avn5st<~S;#m==#qb&FOsfa{>
ziZN%lOQUQB{#0Y0cP$ONo8ilbQ*m74yHNJ*-jAGypoO3tlZkHRPa?eMm75%??Oj;v
z=ZV}Ol=>206^Er>lV&k?!wlbm*CWtZa6^YA0}4Y>9^$;a#WegHN}@p%Blr*15sES-
z*LDxRvPHS)nl}{}X^+^HO(_F^PsvTKL$@`KTkTzXjhy!mhyG8A%M7hKB`o%_GbHpc
z&M;kIVHF*G3TZBke?IZ+O==teCG;&JIg#J`S7jz|g?}^cFC+)qh4orf)0JbdUcoCi
zymGsITv)NedMyve&fG(w4cB^=Q}6cP!F{F|=!4gZDTZJ#Dl+Ym)ld%Wpf0F8D?|Ms
zwQN-!Xv3>k?(GW?SuV(^nzeEx^ryKpZNxw$0^9fu?xpTA*amJ{J{jfZ=EcaDKZUqW
z7kmq~TziMFrTaIqE5}B|iYD~#J&OWTFu+blhkPYGMO)VQ_~<)!i{&fL2%eF?V=Fwz
z!t)dGY=-CQNWNhLl0Pv4o!I{4c8hf?I&Zxg1#3^X+Y9u(=QghYp2J#hT({WL{Rq;Z
z#<o<v6Jj&nRpXxhymfoS#Rf}XJmRuPiE7etZRQ|OG@v%9a-dI*!~Kf!9Mt9obO~y*
z*Bh_Uer<iG;&&`d1s!=x%kAtCS=f*8NOGr3#Em|M<hY!ORUIbfoKkhbl%;*?Ft*xr
zJK0&TWia-`>hMT5SHu2ZD1~y*Y}`_N8v8Kc+~3(y%%fxDsC)Vtu-V1H+^+MPp@ORY
zTF2G00W3#Yf!}ky&)!r9z)Bo;AaO~Rf!BJu!GRE7%jtW<V79cYX9iw7(m~O^Slbc;
zIWhAneuMU=0IKt4=nl*flmT~pu{FGB85Mu{Ym0YXU)F-G=a_vvwcOPkqS-LoaF!cl
zLr`7s&S%a&lOO-e7DG^W@2z(@>2)dD2N=cutq-2OkX-RB`W))S;keQ7czyQ3POT$l
z_7G0Np}*0;Gs>p;jC$4Bv*qf$Fy9fa<v|a6VK1M9z9j2Ilvw3nNkfcNUHt;Aq+j^3
z7q8vVTU(<X+scLn-V;U{g2la1Qy1(M*yfg&p{o~u%sykk81L}804s0UnHc4GsjsVN
zxnuL)e`mma$q*bb;`Ho9nC~y=^4RgXEYMr`;++y(S|tkE9BPL6@xrWx`*Zg=y(Ss<
zD#CoI#(6TVpLP~iN8AX8S~>yqp)X-)2hWEr-MR1vabg^2=^jOqH>vwgMBaSeZ({Nm
zfZx93<-9oD8IZsU`BX?9-prK~IP@>hfX)|g*&LHcx0;1^0=4bf#eOB|wqtyE8`ieS
zKPyA0_Q~1JgIs2}w_H}&hb4;b7wQ=UT9^%1myNTq{X+w*l!149v*NLy%ZsKWo9R=^
zX3U|uHoJs|_RRG+h>y>sRdu}vkOv-{IC%ks`&w@NfC!hi5Z2M=2D-!xZM2TA$9e{w
z^bWVEoeebfvlkn<8nHOS1T*2l*;MQ&a^qNR6CoT0z{=Z^@Q-`Ay>Y)CfbVnAC2ipr
zoDOc2o)mhP#eVj{>@gr=F_}dMG$-KMBdl=>oB_TGEuR>sX7^nB<mbBY=p5)5`W8PM
zwgOGD6)km`+2fdZPmOQ1!pL&Zk;L3|E%X0mV40(tJ>Iiy`e(SLj(6B2t<O4g*(3Oi
zVVQiYhMgb894XH}b;PwCx2Vj|vL-o3=iTX9R(}X)Xt2H{{VeD?_+p%#6o1H?A7u!N
z@iw<p8etvOqUCOti6?34X<EwB#SY;aNzES*?ud}yQ&ZZ3@vwSg9bW(LZ-q6pty@7k
z3d;s<7usQV-hN>WJ7<R>*ywFg9rKo(6v#Ha8y&JLr(X9~s=B;4z|3=9mB0m97hv{C
z2l2I$44wyKuJCNpV(O^57|*@cE`>eJQSD^5jO_`kqe!|_3%dVuyQo!bzf0@%r@<0(
z608M{S^n}&7ah*n#Yoo(K0Sp9&o8m%Kv>n{9Zhj{`S!D7%lej~GrIR`XF-dpo@-%U
zLzeDt`XKx5uY6_irqQp3yXV6o$@^un;}Qtvnouv4!c=)t>#>g<ciTzu3|Zy27l4g7
z7W%ao=n<CVbqe&GDJk>0#9}l6?`dH|D#4#@k8h11tv$3oU(IE8BP>%d*1}3)H8GI1
zy>=_>_<P5og*AH1S>sqd=igNORqbxp@ovYUGEm|z$idAW<Skfc%Ci+RsDD}PKT58G
zRf#IKZjZWj0xVG!>=+N{Vv<m^tXWC<o?J|ji^(_^_wt)-n{h6`=^o^@tw#rz7afBh
zV2{MR^_XWJB3Nx?sZL$`L&|{tX!<EX&8-0CwEbvGy<jB~>{z(m0Ra|vCQ?rAff=Zb
zTF59v_9M*G;V!V4jCJY~#+1VzU`DX|HjW=(b7cFbYI7BynL2f0KG+_!&hA;YC!N4+
zcFB3XdPn08V51Jn6-s;KJ$<zGd$2U*##=02NXl)KiFmP}%u%##=$ET&SRuohS<2Jp
zG6q(KZSVJ$n@VAQ=;+oC&>^`ZXWQGo<-Cd)?ZTy-P@^n<7xot*HS4m0g;mr87Qm#V
zV5YrA#SL30w#6;s1)H5kJQG=O0#`XV&A3I#nN%CBCCAa_ap?9=Ce6m~LPB`^C(zrA
zV5A3Mm$q>ZnOCnBYSChTDW8fpl*teyQyKM|2wqEVt*sBiJI-5Wj=RA_FWG@!9_zM$
zdTdRSV^|l#+9ZZFvZsCs^$=D)2COO9zykEai+WfG`(o`;@!LF>J<xcAmO*p_gE(0?
z^4oX+t)K%j49~Rpg-1v59qQrM;CDT!xbP&7V~!f&I~u;v8s{)|4AL3~;gIm?$$6L_
zb|{F2QfNguW&P<8u<?Syjx7U977ak^zfQ^57M{Yi6N<S_CBTX2i(9|`1>|Zz8DdhR
zZb;W30dK6!O)2CqYYN#>Zkk@acT2}0XKElN=2@OeeSiw{Xg+CixqLX23mLRv&1MGr
zJiVy995D<EF=3kh$MjmBjbI>82pi~yHQ(AY^u#`xpQE`v4#T~XqwtX18fA!a4Mms^
zspYd3;9J<Hj&OB=tZ?}~q2(q|c)Po9BiMQ*JArd6H}UM=E%rgjdmZld1b!x*z$L>q
zh|7b^=h)To00rk$iMaGi(XUWW>~d4e*{&fQ+m1djNWE;4xQ1|g1BwCvy}Aw<|2<Sf
zj?{Igm}mT&Ji3xKj$s^|FjpQ;d9db3A1x>H3fTd*IjRd}&w_k-)-iF|PB&6hsCGdr
znThRHquU`*V)JHF!KWz3!szBwF>;3g{W=x)KEe7de2e>V3fkzBI?tX~($VB<<g2(0
z7D%rXsfMXuh|@)bXUzfFDWc*HW!Xb`|6dQ|jbA<2QjX-g*#qS{*=mO+dT6*^2gYrS
zOXfxK4D=mTyr*9LPEA^@KW)7Lt=z<>?2NKVc+sks@h#hHm(>c~|7Tvjo+G^I1zx~2
zD(=7MC1Pd@^&mfPZZx-ul@43xMq29De5FGnxd(DHz^^C+d!eX(z01uRuv4awh8?p0
zC9og8i09*+y5hf1Zl{Cl`nf+9A{$$%wpn`-wxeX_DODfzPreFcEbN0}YNxI(W5XrA
zW(_=rJ!&Xxlx+PTp4*&Xlmc$~0aIS8y22;(l~1L%tXhnpHd=dzX9i%Yr-OpH;eG^0
zRj_fx+~5W9dU21Yo7}P!^voUq{LU!94h2XW_8DS#x+w&Udhlw#cIQ&P*6+R*T|{j3
zmf8NGVK^_nb}qkB_uRTYb*s;>J!?Exdh|r~qAN>UlP)J;TyyT_=2x3^((>E`o0Xw;
z!k(g9y+N3>j}pOLs~5`<)-7Y6Tp5znUTYlyj`L0>8OlbZ8z(O=-2i)ZHyTz$Nz1br
zUIht<$ya>|YsN=W%l8&>9G-*X9m23qSfh2aA$i>OG7%qVk-_dDyPtX)WSO#@^G}q?
zCHMF6!onto<T-BdAC$lOB-$FY#(14y0`uxH@l!Q^uo{DPfiC5lCmIc4Ye<F_OfIDi
z=|jp#-=&<oit(5)L(nMEYQA+T=4o;x6|<Fm6R?13Jfv1dOJaXoxhDB+^1NpcJ{!1d
z+bYp>KP`mSWb_N5-2=;ds%|a2QDp$D*G4Ps@V_q9!<``C;~7D|)!==4+_B5`K;I(h
zIv%OxnkDB|XYm*<jMr=G(0D};)S65djrX|@!){kBDmhu6eK0q4^C9z`9Bk2*q4Jz7
z#-gQbjG?&^_Pe48{;ueA*h^>&gj&hww#(4geH#n$mm94SY+_`@%yw8sq(+*zEa4s3
ztb^S4yU3BU{#Qo(Kw?R^W<rhesk{Py!MAIpQ;nWHQ)QLGu8KMKZtDFx2IhNB9o`eb
za}D6U7xx-3{~oXB%Ckew;lOdpX^?47DA<BvM*j~M>Qpz^_D!G2X52vAKFg(Txw-VA
zLjPhKzR_#-nhCWcEA;55<&ic!Snv7NNSnz8Hm=z;?1*g-+5Ez{%z|IeQr7SS=MGEH
zpySW$2YRY-Z?(=YXuRq1U)!m{vqX<Y7ta9hOof>@X<gb!cWPUsKHpx5c{goRUsU5B
zb8dlcwhQ|DZP7;xgjS;0w75r{3|P;HM+>=iO#9rrDe9}J;Z}=d-E9vxr#96p_l($S
z#VZkrS3u6NcNO%x_4sgmzCTk9G5c!{WIH>ze2VQ*TQ$yvihv2HGJG$M&B#CJZ()%X
z?{EpTTw%s3<X85v>+7QB?O$Wh7FheTNR&~bo$+h*ptWSgAaSt6<;f>(qO6^KSFD|Z
z(;qGs%=$_HlsaKJ%+o&wk00)zE=Fyt&FWjR_?2%i)(+Tl50AYkBu$Hs;XPqIGsU`+
zcT3=y^)IPCvK_o&wMEs+Jz|Q|aGPXc=aEUi)E3s_UD1)fIv!u9Xq=rNUlMe$+*diZ
z98EaIYoG^7NFRgOz6&oYh<|v;F=gOQlxWBE<V@Vhy4N7?d`FjO>l<3hp7H~70$B+2
z^nUHupYLXZ#PC`IN$KefijI5?IC*WCEv*po4PfKicvl2-owfSo5o`~5jI$3NvO2!E
z4vws)41^vU`HrRI8HvHUhoo9=nyE4DHz6qHcARz|PJ8o%Y0s7mX%EW=O9rR@^N=w4
zgCU-J55iJ>2m2*^YI!6tOX~349lXR*xoM$>25Tg}Uke;<$+ff94_}tqdV0{ELfIc}
zX(3d>N#IY~Bhp9nFLN?D5yI?3=eL8u(qA3lPaVq0m;G^=13XW_oI<~u`7O~6Pw55S
zfSK}i4SEWAb7tE*rc*plTY}SOUgo?YZN3o6^k*UU{8t?}r#>(P5z@_nWn^wR?C0ge
z^BtjNiT6upC<l4BRSo>Ibo^=HU^L<2PlN+pI{q>)UmE7%m*o@Y9nSR5wJmnA#;2#J
z-u{(!kpb!&m$lra0WKOK_kX!?iHS5vxurQuDDheT{C1fhJjYf$Zai3Kk2J$p-?GC9
zm|n5!lpT-bcmy{d6UK0zR2X6QU%?}ZMO@cc%FiuuCKQKEXaxTj81Hu6AMx-A2cu@c
zinqwb1JHxO*o^lE17yT|CmXNW4CQeZ#CNBoOeEMwi=ueV)&@E#7D2iJx&XIjiF~Ph
z7%WR!<^7Ci<%l*|o~`0{Kb<)sv;}v6a=-V({L<5Jd|jR$Qs`IAJPkIpfMP|tNyR(j
zIv;3H!s-`~rjqk`=UNz-%5x5wV2?HX4xBbo^uZW4>ied1u-5`Rv46dQvX(20#pq%+
zXN+gD?~y_RKJJq1l2Sgx+<|vA69S}WZMm6aTp~Is9`PD|Y!Z~K+Rrl%d3K@~@ju0C
zKw_mZLk4+{cC2LjllaJ)ON>`|MJgFf{hVR>3$EIW=Bs!<cB3_`YG&g{jh;3*DOTvI
z*lO^x)^)f~3Uz!Y({KeHXlE=pru%;D+!-s=I3{)vj*ltQIL37kj-9t+9=(r2t&y{=
zN3Glo7e(B69U@1eWZ(=F%7cfHbg{%4P_dTMWL3#v+;jZU(fh4^d(Db@7L$gW%U`S!
zXpVqv6JBIAFH}v6yHShVis0)eX@XS&=|{DP4`$=_0GHDt5keY1<~DhrwV!fE&vRNW
zm)#+De|3g?$Mf9qIk(yKY-)gX#HB{Os!*JVdRDE?aW+4^ZMfCqHv5DI+C$xqD(LIm
zp08`HnvUOVZ`gl_-)kG~k@)@SD^;=h{piA~#rVDE74S|G+PlXa1NSO)2p(}hX~!cj
z*!~Wzin@AQ8nv!*f%a;n6*w@I#%zS0w?AF*DkVNq7KvIkC8o3hESc)&WmK%d8TK`b
z<LAX<?!YIf?fu(U&{CKm?N{#Ek5<-Tj-KyS7Vk%oHOd+E5ZFna%2NEMXu+DmSfG@9
zL(JTKMr3UO|Ch3|H#i?Ju-|$~n6!R!4k5$@K5d9Df$^`T5&R!+pu=_=o}6t%cW@}A
z3BR%U{il!YOj=`=TowkNIzm|0ZMiI<2JAyXiJySSP9f&u&Y3V@)kx`JUiy*2(iM!j
ze96S&y2h(P<O?%l1K6F!p=S9T3S{Y-jhwzI)XYXs<|UznW6^+?yVfDO6C99&->|O*
z_=tWFt1>D63has9$`9^J!Qc9=CmLaflOi|u4B=ILAPaFFm$t||SlEGxrR3|o`)sp2
z(JuDV7O()Oz_|^Skw5!I=$)vH{IVCP?E7V!o&S{z7CSSh8;g6fjC=+B#=>v#*o@!=
zUqe~6R9SpYx?#PX?S74q>Dj`happ@RI1{LYoV$a;C#8Ep=5)QQ+;dkttZRXBU}=FG
zwREte7CTVqU)s_L9wP2C0mnj_I>FDF<UZA%JN%N|r`}N|1mN6B&Tr#<g*=tT=cG6<
zkVF8Zh1{Lo_8SQD@%3;sp%&-rdKY96aM(^H1~PQ`c>Qpxas%kG(2pCB4X?#kpI>th
zR$|#1(*tJQ2??8l<qq;rW9sirub7b$Qapo;l8HWoJ)vM$k%qOs<9mx@I_&opMSX7F
zXo53Fv5v*EK|I$pYryyVZ;_`U-@eHUK8hb5|50s?fisyRxh?A>xtz2}In!BfT?;yH
zjA>rHPtJTc6fv_H$rxwb)45nebeULcVY2%Q;RK$FS3U~6nXuoX3|Kax44g5boEkl#
zRNd`=Awoz)Qak0wFV|L{RTa$Me4AeuD6cnMs<J31fCuViEobO>@-Z#+Ftflyo6|AJ
z%})d74WA{nLN5zvDcV9z$wr~a)il6pm7ZieVN5m(u_af8m{f?-y(-A8b1CP~%%Gv(
z45ebJhmvV^r*Q%-hkv5?WuuE~E65Sn-zSBfOHX=eHJ1e1dY}z>iQXrsE=K<+TK>F1
z%N%!xrL3j*MT>SO2()F5Lb_`kJ?Yke?dG8#ERh_&uTHdcnLwM?AkeBBJhaRiftEiC
z{H8#<^v)FmZE(Fnd%ey>t7&rcTLt{ChIHwjtK9q^b(ig^hn7F-=Jzo0`z)j@{-;|G
zWp0gFTkWB(KknxDbKrLcq$~cXTMlVQ-25K#&@#u|{9?;&BBaawbH1D3FWvlp;i1*k
zy7~PS_+1L=GXGrQ=Jzu<zn^(%`D!=62Z7%NNLTVtk9_R{?OMBs7S6Yjky-OG@VgMw
zmHg8q-%2;Xl^$B=3pc+X0>5#f57b2uzcx3&2R*c!f4ceI5B$ytePAzo_^ojBTj8PQ
zE8YB-0lykZm%Zn%x3U9neh+wP>kqp5{Q&r#cW;$Dtq<?VSGe>22gIvk*Z5DR#w9Si
z;+bbfqCkD@oyDIFhjzZ<&ST5rPf7`0=X@bVlJm)D&=Q+{Ivk^zI=@exou}W!{expW
zdt~b;&gRFDo~k18?XR@B`FQ7}&z6{)?zgq}GJ%^^3s}`>Yv3E_k?D}mGlhQGbDyj@
zA;lT3%Qsr#UD!)%hgm>S{mchel^wX%nPv>HDm_*&1;o(79pRH3yqD(HgFlQ;&Q=b}
z=a&w;lDN12jkrIT-uLO+Sm0UP3?$703l|>o@Jdv50_HY1pnsIT6pH)v{a~efqG9{e
zf~MIl(t(!_>?}c=F=d0WOZz%_46G>=ZQQ{<UyS!@@IK|Bir9`k;|Lx>HYARG%St>&
z=KK%lW)8;Re{^!^@~0rTPlVj2)(zgzaX!iMFZaY;N|_jPe6Cn@M!PPNyJ;2KgC~JR
zx@&~98F>y5C$L98ShO7PbdSvcm)v-yPietF-OnQzEKQgb{dQ8+*3;*-yjI`jp<58O
zafgSBC-y<1zO3+tp)B|}U`=T_z8sGTf_2OD9gYV-`U&(t7F~=o1Roa-`|}F9r70#w
zfv5H}!=BpnqlRg~XP5BA`eUlr{~xNdhbBewwXI9bc}nx2(j$JrB+UjNOkJd9QuY6l
z8pnC8L`dq)*F{gLcjl|(J+g4>0@it+@0a-kmPtq3zNOCQg!K=`lD#G&{>leSaqIC-
z<`yu>nutfP_Dl$=D1MS#!GPx?{&E|!xWMV0B&Zq5+ShS>{zAt*X0V(GpL-H&B%#F<
zH?+X4_x-EbCN;cvB6>X?ydc18m<^r*@#Y3Y5Vj0XxT^oRCl9yHi13xxLip-TNQS&n
z%?!+AI@t7N=*BliOM5Qhud#j!+zDS&#BPCnC)^ThE4X)3R9-_-{Cl;aH$)S0n*jUx
zAjoc^K-1AZDT;=+bAznfg?X2iXj4O1p##^FN1o2=wm;+CgguMduseRhbdcx9wu8M|
zpt`@C+?>BO0=z@YO%oiYCcRsNf>j&)=EhybHvf^nxuIr3^85?1W~)F!Ts-rT;v48w
z9{ESL0ak<M+15)?oBPd2^>N?{^$_fXBD}t%RdDXtYpaZtN_?GdZ7kTkeXSsC*oVBS
zERF^5;{DJ&<bXekp(GYoksGaW9!^r%FVxueWSpBWw49eU$|aq&q8@6OVW9rD95<A~
zS-q3+J}UR?ttVTf^e6GG9lRi>{zI%(eIXY3)hs9cPK2|5^B6d}24^bMpm&OAyr?*f
zS9ZSz&hbERZiJY&wv^E@Th8vsd~-ka!Fr*1g+&p9nyj*V8p0W`iw!sqPVlXT)p;V*
zZ(+Tt18f|xoEFb0AMF!6+tL-v5B4L$e|Xq?7*;?lr$Ei(T_yal9o7}2kmJYR9|T$K
zzl7!GnB?{2$kI#VG4I8{E$87>Z6{T=JB^B4Ts7h9$U4WnM251m5BDt<BzA1R6~+Y%
zuW>m$+tU1q&%dA#g6!&>;1nQfiT8KKh;<Izbzw&*IN&y%1R%bF7Sr-QoV*)tJ+3ms
ziEBtz&a^w7IutmeUC`+b#Qz<9SByd|^CRr!Oja2`a#J(6U>8WGGFo9JXDCViyFgX)
zy;G+PrrHYvuq42XAwy_~!np`%^}~h!jlaf6;a4i-Zg<M59l*yFfeWD=(E6&M{#ppZ
zBO)UIWhB(TnbEoX&DpdRWrXd0GecSYrhI7>CC`u}$3%J%#x`<K1&I&v#7B^L&WlD5
z(0kE?8Ew1Y#NX6B{aVG-^$3rc$9OH0+N@<LqoVB1`+YhYp=ZPX{IHD%mrtkz{xI06
zo1boTX^XxB8>+bVtC1z~v}P;lI@Dv8vomEij`yS___o+t7M)^Y9rq^Qfrk_L=Zn;^
zB6_nGQ1NC_bVmO2H|;DXp|r4vDB4+TS0L76f|Dz?&WegO3)AT()JFZ+@V=5Rts7Ms
zV<no?{w<ubtq4mQmL<28@s9Mn?*Sm>_f27p;yOrAQhK?R$6qurA5Jy33Emgiq|Ih2
zmS^Q`!^BCou%u=A7<d+qt(_f=V2#<(453m=BA3h;!MRYPVVVofI~OAj7lM#YatO_X
zwQkYTt&GE3GANfyMc@M!a1Uh!qc?F62;*hL&f1J%-#0G;CcL?`!NLZJuuL)%eBZ>{
zHBzp4ZHVg&Nnu5P3+gLaJ;M%tWY!j5i|fy?A*0w+gBca}H&6Ynr9o+cYf>8E8`~ma
zJkQt}g{5pUYSH+mJC9P@-R#a<p_YTnU{?7D%z>bxz-O5MNx8(;XUXjHX^-Is58*xh
z9(h-{57&N7#K+jIT?p^nZ`5Iq8r;u!@VsxS9?l8D*#AI(KRo*5yIahs;f9nj`Cbu{
z&_<C3?o^84*C78I@RcGdnDLpQXMSym2j6~ySIrOZU<#{d>vAmTG%xx9*s}L(kzt<+
z(fb<E_V|nOh6WSt5Z3i69|h0w(6O+F6~h|#T)%SawSJ}KZvXyMTeYE^!*jUy28llQ
zcgHN^=sx+Vy8iY!KAvtABiQ!~i><e?J$>?Skios1Adj9N^8EcxWV806tUSMZ8~Y@s
zgbst3ak6(Ma3<FgJMf_ORoHLDHdv^CR;hDAIw|a4_yteVF)m4-mXo{07S@+m>Tz5E
zy_fvzXyry1Du{KAoz<O%EeRm!GylSJzVr<qi5A-({johZ2ItS9b$0N-8tp<MMq%GC
zXq5uyBH(}1<qT++%God)r>vxYKzpfvv^7>%C1+D0OijD&U<J<L>cQ^IcK(h#TL!!^
zO>(v~5_{+<K*BJW?9O35_J)D=&}I|Ltw15;{?v^WX_z8-V3@+wN8IOSnZQfQZSW!l
zxpsaAV@*&S!DfQh1S<#@6U-;5BbZJwg<t|fHNh}~0R(*sB7&X&B<T}uCRk0df?zSh
ze1bZH=>$^<CJ<B;3?mpo5E1PBgrrQcnP4@+3WCK1^9kw*rV~sdm_SfXFpOXTL0^K1
zU}ptMpI|e=YJwF6iwWiv)DcW4m_jgtpqgM9!2p7YU~>jZnIH<s&(-9)f?zShe1bZH
z=>$^<CJ<B;3?mpo(3c=0*!dTdKEY;!)dVXD78A@Ts3Vw8Foj?OK{dfJf}L|oY6P1J
zRuilsSWGaVppIZV!4!fC1l0t?2nG=JC5Q-iK1I?e*i5jRU<JWqg82k>1k(wo5KJJb
zCKyIAfS@lyM6mNol0Ly^g4F~o2o@8}C#WNsPB4XF0zoywFoFRDeF-9hoqr(d6Kp0}
zO|XJsF~NL-I)dp0QwSyyR1*v%7(mdMAR^c~hon!inP4@+3WCK1^9kw*rV~sdm_SfX
zFpOXTL0^K1U}pqLpI|e=YJwF6iwWiv)DcW4m_jgtpqgM9!2p831QEf`aFRa3W`flO
zD+m@7%qOTLm`*T-U;;rk!7zfI8MyEMZ~92m1F|i{J>W0;$o067?6^Ek@$){iUF7bs
z--kV^$1?I=xF^eRC)h%;o?s=x5`qN;d4ib)Qwb&#)DWCWFo>W(L583U_h<R-1X~E!
z6RadyLa=}!PcV~UD#1j88iF$k1`%Wkx^PdH-%hZFU_HS~f+YkC2=W9o38oTEB&Z=c
zlVA`*e}W7_7w*sU+X=Q1tS4AWu!LX%L7reH!Bm2Y1T_R_5)2~95Nv^ZhLj01xaRZg
z$#W&a5`qN;d4ib)Qwb&#)DWCWFo>W(L585~FC=|}Ed=WcRuU{BSU`{`m`N~|U?M>c
z!I=bIxF^eRC)h%;o?s=x5`qN;d4ib)Qwb&#)DWCWFo>W(L583U_hk9)1X~E!6Rady
zLa=}!PcV~UD#1j88iF$k1`+fp$Pjelo-DteU<<)|f|UeI2o@0J31$*ZC74K1LvSX+
zAcFn`8G<g{ljXM)Y#~@ru##X2!2*Ij!Aydw1QQ8r2+kxJM9`lgL(qkLvix>}Ed=Wc
zRuU{BSU`{`m`N~|U?M>c!I=bu2>KIb2)ZIj`UG1D))TBGSVFLXAWtxpU@E~xf*OJ|
z2?i1LC&&<Vg_HCNwh*i*SV^#iU;#m%U?#y-f{6q*1ZNU-Wsp9S=Gx1=@&0|%3G7og
z^5i)hFW-E9s7HGUX56Mx^54uv^5h^S|648veXEa5d(aGbna+{Rm_JzVW)9lkO@ni(
z*CpWp(E0dzOM5nD+n!48-)y`4I?yB0{>=l4+?HP0$F~*ml#Q)WTP{sU1OC{Dh1c8K
zXTqH#pUhYS9#e%gz&`dX=gl=RBgd&f(`;!Mk4Sz0W=qR-)JS%nGZQbt{$VE#-p$?=
zSjQF}6Fgh6Ck^&EIbi;_K0IgPu|qlEf~T*tSc2s5&W1ZSCE(A3OQtMlutjK&McnBl
zH?x1RZGVx1@-*JqY&-WNCGXCruELE%aE?v{R`~`m#vG$8E`;yPk+S$Q*bY6`U%XGf
zEza$O()oBjc&~_EBDoe$e5_ZX0taJ||5bsG7<o49a@KNuLN_aKtHg_0SY?5GAt=o&
z_PiJ`CK1Y%Mam_tG^LR~sMu?yRlvK(2PH5gLp~0!lwj{>m&aBBD^x7)kAqz#+&;oT
zzT5;~`#fI4j^+F-(c@(elQP{t<{&%Ri&h4HItVA62H|`p{ALeA8e?ELagYZ4;a{S$
zZSjAb&a&JEXYk8mSE9facq|7z>=<o?e;M4W@_0!}j8M*D8b<4(5@_Ta*AURH{W+b7
z>i<41LH<4{Ok`Ldgy`k?<N)>{$Cmfu9g~{0$n_tqn6Z`u3DuJq(RCeh;|`%CJ3dym
zOl<Fh8#pS*-KVZeLsGe^d+1}8OM*{ZZ+OS%0(!7gjD=bb6P>CWS*!TYDFexsXO+Gq
z>oz=^8F6yqL2q{O6)eHKIzg`t^9cTuW#ISlaoNkmVb(*iDmO~@70u&vFCaM0nA(mm
zYPr9bp`s{9;e|oHHauFe<_dCnqNbeB*UZ;&uhol+7Q(GK!uKBt-@})w4LFtbc9HP?
z=9;f+TIX%Ap){>En`^&1DwHfdI+IxZgfwNR6m~r4DtmuY6r7MnoYaMLzkh;YMdYN&
zNwpWjOH*1izXtREpk-Ny1TIS7Et;pCD(;8dd-~xfrhd4IsUOa`^}{*Per2Gz|HVk~
z`4WQ%NbUu1;IaK0F6joVn^Um2OE)Z6PQ4-8$|?hTq<XDV)gu~te*@g#0eWBbOwTuR
zu=mCpmzXS)=ze@>$VTgKEqD;QtYC}st>HxN5;@BwIAMLQLqtQm(2~HGv0vl|Dc_K$
z!YUr9d|aZd%b7TCwM)FnRO;R<4|+k^zbknTZk_oX<_Wx|?(^iB;MIlGde4qy&VmIQ
z+GoGB`R&WQ!4Av-|KnRQ_b!s7-VRoaZ16metcJ6zGO2QEqq}U65zjwQ4~cxOpJ9vp
z4RV_2y_42Y;q3$QGgRyo#c;~)7PgOb={=$%H6z<9E{b<`!ybOkaDRt;gW)$}Ut#Ml
zs9UnzC{0?B<ZOQJ#IXI!Z9gNiib|+?hBr7npT3MK+?x5bxVJBQ;zs(`>7)m;!_9ZV
z_dQQ5H?<6LgB=J?QMXw|f}NvmVUGCo?L}(rc|p7m+TQ;v_4csEXG0>k^nkVIk8oQ8
zO$VE4S|y_|8NgSB#d5{o_Ha5Mbmv;X6*Ls?#+ijZDt@k8Feb8G&1~9op$B@fCb&gJ
z&WeeRMYsiP7KQJXG6Xe(H=9`mcU1L3jqM)h!@~u5_0Wc&aRB#E1Y9H9D{zn&ez*$s
z8A1h}#`-SAG(28_wF1f!OJi-v=Z49*_bGzI%|Ky>JaB1cKm}#N<qHMRk^58)(|-rL
z1hQ~*LnMKD2nAjsT_Lv))wgh3`@hSL4L)<&d|wL|BuSH;6(67R)Z+s>06mqQsbA~t
z9Qw=?5B2ziU4nHeu3D%~Q@CKSwpfFRKg}#NuGh%a(Tp-+|NXr?VRvjcZ06mvi<7{X
z-&ys^==xQ$d9^1<JH1f_w!+&zb_oCIsy!np;C3Tm*zL?JMw41aX%ee`$yxhqXXo=3
z9?mGThb^=n?A;b_K4i`aK{GOf5k618$t8ZwV0nEu;;z|6yTLCS<}C^7GzX{7l*O3O
z;g%wt!^_idNObIQ4USKS8zDsrN#G{{U*wO)zKmypTR0ixn?mB?4!3!Z)l6@eI~1+N
zHDFMIUa8C?I1^~XU#9%Yv5L9(67lsUI|W3#smq+54}ah(1D31jOr}11bgYWkYn;_@
zSMg%m4acsjLzvEU{}mob;4a=J@O|;f@WL7_DQObSZ)7eJmJ0S^Tactw)xp_J?y6k`
z()h6qIje_0gLA@zvRk<18xnDEfxQIrTPArUx=}rJxPY9Z5_T33n!Z}@o4jfHp=@V$
zRTCG@piR}Dy;IyrjI1RJcz?ffLcPGLCf3>c_I<wt(4!7JnGdQ?2zu1ugZa#1J})SW
z4CfDJV=a;<fgjbNv*P*9c&<}aEz}X_)Du&c175ig#5k)T{{rsFh-dnXfU_REH0coR
z96j^J@VDbvuUfq<8Sej1mL`HF8@vqeLLP6QcSJI93h#z}S@QVRp4f8`dktd$wPW~u
zAr8V04u_2_w@_Z@Nhq(;Q?s}pMtb|>9ul-O3~J;Ku8|FioYjSBjZx%8=`h<AQXam^
zZBp_l4$x<!btnSs74EkzNuQ(9+Poa6Z@?Q&Jq;mPR|~I!W{L!@POWnK>P89Anf9#2
zRG7Oal6`TkgK$IEv~oBnS=b=(%!k9wy6-`rajlrOhq5`HOAIIPMf)4wvTy!Z>(6Ti
zw;5axtT|MSv-$n2!xHj*_4cKo*BJCb&Cj31HMYrJ!@^jFTLa;;`Qg(exon>fGyP5v
zmmVsi1USye>50Qq_jsDX>|-$0%+ws@4`#zzYjLZ(phM`PJhH}mB}lk!5{w3e(Do8i
zq<Ch1wMx$T)?BT^^Bdu;oDSi$UAwiof9Ad`8z*@E#I$=cvkE3f9?U-E(cb<!#*dyR
z^9pa*L#->euei8O8G^?u=-=T+D?AT!j}s?hWPpBO4Cl1r-&FVq91CMuFl||m$FLK^
z7&eG)V8R%tB4ZdGl-&;;_XEex&s2KmMtD|4M)~T8zZ$;r3Ws7n%X);;xa^A`8A<Id
z{?|{G=28`@E8x6lrh7&t!8t(c#Sc42(tGG$c#6=Ca>2eljBq37ctY7sRsPTpp)Et2
zl|q`}L*BY<=L#|xBxCnTS+F%Nhsk}v)jn|I+qdQ^`-a5F-1|3qwO=mnkKcO#%w8ye
zke_Az+&H{fHry74(@eg%?~t7z{v_PQ7oXR#(K@+ikJ!#4*>2sD?SkF}NyYWi^{|pX
ziFIcinePZso?Uc{sf!9cCcoGn39E$vx<}33$vxkU<SSOd9SB8{W9KpKR>rkuQjMR)
zk8#XrhdgVA|H*eP|CirY{>pcF|1(Pqr-|RPOXNmoklKasx8vAS@hl#nG-Y6}`N}tz
zaV%A{QLiohF49n=wfwc)r|`So>=Xk$p~COBvVQP18<|fqx!6<rbL-p!p*&_*W^mbO
z@dbJ9m$pY?D?;9utmP5QyHVzr#P0CuP;w%S(wxG53~(}_4KZ<p!<=NT0A9Q>FK~++
z@Z!h9Ef+)h)Tm_#=7<80Y7CKD3+$N|em8~P4PM!pBR_U4JYkObT#H?S=33{tIg+vF
z`y7pp!Yg+>+^yxXcJzi8^uWyFmYWm#g+%amc2V+i!Km=GO;QiLoDziB_BK<OdLYSm
zz6;s9B$W9_8=RV+QoKDXOHp|Jwjvd3GL)PKtw|flW@)&)UFfLfDGlfk+$z?EUhv-|
zfoHghstc|2--e&n+|4dnjp9322R8cW%^@<`;GZLLxq0E%ACk(KCxLg47c0+{3})qg
zZZ+pk`4PPBq1FasrWb?7L&V)XB-t6I_y3>QSK)WKetuqO*y9Z9NYQ`>Vj|YF6yBHC
z^lfGJ{y3L)c2D_kT*CSRHTn*|F%Zs!Y>Dj-Eg&bvpeDJu4@oV+a|qnUC-6KMcn<mw
z_S(Db(t)Hb57%!Wl1u`wam~W*W&h)vE&LAG<j-rDp2os{E)s3s0yT7@3uVRFI-mq^
zA3_exg<d~*87g6AF4WPDmPuF##t|LZ)^RVi0A`Qwu@}z`Jys`cBdo8@jZJtBg-_k_
zwHKHAorXKB%))5ku@-qwHaHmBpe<)AH641MqNV!N^a(NI6faXVHE<3U(kNPrZ)=6U
zYyGkT{C<O+U6!-VAoLdNyL~K@HiqlG4(m|O5ZvkqA&ds@AVc3O<dtxZ5$SI{b_2ol
zfUOtqGl6zQM#16!4e#dTP|qzW3MdPllRXNvP9$(Q9p9p(Xh(!Q2rUBtx(EH#;Crak
zy!xU@M$5g~jV49nn?%OfD0L0+tkkinD6+72Kv7g9@b=4iA$(Z2Nk_4Cu|@9?oQg5T
zNYKHY17>-q0&y$zy*aaFtRCNYVC+RS#AWr$a=ALImwXfwz2pS{`{*Q|iQ)7zv9PM`
z65-Ndo|FMMkWzPnc$i|oa6Gos6xJ$>Z@}FN{-7WJDDT)@-eHmT|HrS~bT<ZVUdfTX
zS5g6&kS|slxm_{|{$^n8a9(M|M-b;V&>3DZWnV<jUG<dO#i!0@1Gh94S6D^e>iNzy
zYw&0ao;^@;xI8efp2ejZT_w=#qy6nOg|9_a+!Q!PAwzr&ckkzA9L^V06rLPVD2sc5
zv&vS-4_*C*wY+w~J}~z1xq-2_`b+Gx+{q0%{mC~}Ir#T%_Q2R=a(c*r=D<C}F)!q>
zN^UOUcVjL@r|hzJLMMW`47{t1l*Z34@Vl}yb6sG)sy43XZ0qHVl7^-$=PzG5|J^zG
zn>x)uHX)hv(GR+mA)j`^`nG#cPE0PWtg_7wM{@RSIj?Tty*}dJ#CM*!39Xb?`rPfc
zyb%vRL)ZGa94{29<(Qkkd&k`Eh1<0y=lTq)x^6>IbT`Z<x|2<3B0g7#MDL3BitSpt
zHaX_mL(i&K?N}vwu4`dZ!TID^kf%OwlG?JeH&X6>x6hK7)*rMGJh;J=uN3=miw~H}
zH)C%-9Cjqv*}SE;)EH-6YdQe>$K{U_aj(8d!I=|!ug?!KkLn-d+Gf#Q-X-ze&978N
zm>!IC+?_QfUmuTTrz5p<jTY$-L)@sFVmXw_0(V>N^|?OCZSsP1LUr9#gM9rXX!`eZ
zwpk<xKRSG8hCXhx-SI-qz}(He-EmR!qiuFIvWc73?`@8dRjaXtg5VssMS8Apyc%Xo
zVz}c&M4lv$hr92=NpSYDVvk(pl4ke|Sa-WVd%^&@fewV;1>2Iid#<su5-6FyK3#(`
z#`o-VjSCOs`}FV~dN-?$aGTzV=HVOAh5OIL^Je96UX041m7oLJa8p?hJB^C9egS=7
zZtmNl2flLeP9KXbK?Jom)}S4Yxc6rJ8MKqpw<qQFWW@2a{ct(;^Eqn=+-UL`+_n4|
z;^%`ej7SKPBg?<%BZkJ3;tDYh4w(iaj$F8h$jA=JySjXW;IH{`YZ^pBF*shXn1<$A
zC2Yi|>tN#qita8SpwGBI2<ft1F5I?fV&OKqZXY?T6A}Ly;z3jP#PHs)e6$?yj-jFL
zhe^QpKNY82FvM;4nkd{${>xj*<9Nx+RM07<>P5Ie4gUHH>noXC9SMJFNFP(mzskFw
zpp|vKeqJGkIBiYU2s-iAs)>1()jQSDYKN{P8tzH3NT6pb{uYrtW8fY47CY4wYO@qO
zt6w%SGG_E)JD&T3ul^qmA8L_foA*r{^KN7W|1QPPDKB!oQ8eU^U#r}cMkzyI?~APb
zPbp{FF~@#hoJ8UqV>)WY{9^uMXJDQMjt344rGi!nF>|Y@gV(wxsVmaoPGrtjOW>>_
z+zOSzVme$#NbjAFhd{<Gx3Ob9{4#J#ahx*n#a`T&=T<AHg2$Ii+{bIDlaz3-m*&#S
z=w8FL>|S~r&bjh1mZL{j)3tM}^;!*t!8rmby)w9a1=c+UXq<f1pH?VCU+lwHOiT8Q
z%Pphp`rvN3^Hl6-mBK0^I0^QNd>kp=*DNyRYcuz#_0htYCzsjyLUjc5F7p3<`F6+6
z8AH<#yZyj@>kk{WN;KI^{zlG_r*sBY9Gc?A<#l+G(&;+DdkadpvBOI!8I}z$4MSul
zn>8%O)GrKhKLeJrT$0^K<m`R7cds{C_CTt#IhYdbNaPoS{&-}h2N?-^l=$S!1}qya
zqmV*o^nN!b)-;@+j9!QB%;I7B>a~$txK$YBi2cZX#b>I7v>`?J7yI33CIssioJcf-
z&F;q#vtXrdU*c?g{4VD$gTH!VV?a)D796jTK~iukTA(ROaJGFs;(mBCTKP$uuvG&2
z;`_O=t=VFpzNkEV5g%%Hw)r@*We!$EKj08&+v!d`;$e$~ia+bwX>y;5#j`5mq~t-f
z;&Z5LuaGAqWR-}IqxRuDySabCZPU6B;65xYUHwV8=?hk2_|6!|*8PJ@ofthhnhM-`
z*6zan2%+YJdiX01(eCska7qPm_dSnOGQr>UP%|Q>t_=T84|$>cR`8K$Q&nac+;=lv
zVz|x`W=+$d9)En*aae^z3mi+8XD_IZ<9+Lv)j|3H1-l4HWmKxpfhB;_EPj&wO^dc?
z+5|aZDd4p<*aXN;1z=;V#$S$1kE}bNm9x=E305R?u0Fc31Ap!L7VcdmcJ}&Nkl#fZ
z9S8A^U6dwhh9@RyCe-bvk>C8X3^&3@<~gzqr_Tyy&}(ohC{4{A>;?b$Irw`p6Q6?}
zX32Rp9_|$E|2f}&r!10e6l#<+b#PV@mw)9Py#I?W;%*<COC?W_OhNhRr~MC>9j8$T
zci3bPcv3OnPh;SWkV^f9(N7CAQP>v)Nx<J0@OSSt!0Z(6&>%f%+Sp&7c3QQ#0PFxo
z&lcXd1K?XdbT!}y>b5!KbliUQ$GqUQKHg&kf8Imoa3=};)dEP_P-c2~Ys1_EX{2ZV
z?OE&Nxv^g(^hPYUJ8>KA_h;w=1*|32TUjr#!fc9yUB|>q#F&Tqo_va|H5I|A+<H7}
zz>MPyY8W;zhI3wrT{u`>S?%Peq@FD>Zi+^4vBBv2T;79R49~1Rr;tN={P#@YhV-zo
z1<;Sdx%M(KhrsXEbax1DRGV+(wUivzZ+^vddAZaz6k(N8Hn=IQeal=c_wT!KZ|*g)
ze!CFY(GGs9{>U-8zF!ZPaT!wX=^<8d<p<LrxGM^`!+E^t9;TV6EZr(39~y@WYvr#!
z4y)-H^pWHD3nxYGJ~?_(RusR;FwKPIEx$+d|H?$%*khFZ-hZL_QNLrkx9&jBC8E5I
ze2(SfJql#Hc^oa2*Jd3AIl=9k*GiD1(>^#U>J+TFGsnqi3Olp%*PcP^V0|Y@-nQO{
zvY9#}<&_FlW1kH7N;e%7?h5zZDm{Excz-OM&EL!hhM4hf4Rb;BpZ^it)BZp9-aRg=
zYW*MIduH|?2E0Hc7du$!2qcxEcsW)o2*U_oG7o5)nz}=(Q%5~yx06R`*n`7GzySsn
z6FZ7Hm8qmupN|1@6Z4+pB};8Wv>TWra{s>9-ZN}Qo%1>8pWk1<UN2*2*0Y{<d)Bj_
z^{nTDyHV3l)<m+bJglPpi{v|^7)0<e;P+oF$o{Beh*a5}wXWM9ufe)f+g)r>8=`1)
zEVv}ERf+V=9K_qmS8HOWXw3IU!S=@t%6AzVj#2p{(+3ruvPP>$MvCrO{<?l=lyXP2
zgtbvFVr_&+z}Ee5lyR8~d26PzIYKu^nQ^q#oJ*+<XL@78$(`Ez_nIDG9jP0TBKC=)
z#M;^~$lJ>Pvfut7^={lgl5$?hEA}ei=q2sdf5+=M{`Mde6^Nguc8%yXrGa|fLIy0L
z_qsNuFU;WH-R!!eK>wHuSvufzA2@(QOmax{cY8x}htbex^_J%TMg`^VHgjvwE4YqY
z7w*lw6qf*Rz#G>UT;_F_8Mt=<_tqAcjC*mpwY9c~MCP`7oQK7N5pfODDeLCCt|=AL
z$hEh{zSr!-eD2U5w63_@W$nJ+F(&c|iC?v6W$u{BAIX~RIgv9a@-)AkX9hO!8Jx3s
zfc0-%?s9AYL6f$gEVm|{zk9RH+IYRo`r-9E^=0y6Ba89=RLAPKN3q$FvvG6qe1`04
zt6BL|{}uKBRqR3B=glpbw@luzHfU+_7rxLetU2>D-a-pK4obalye>lQ*oyVq^xOaJ
zGl-CJO$0_Pi~9ul^4tH1XpZNevBy~x^C2uhy5h)dhyPZaNQI=<P+`Y*r*YlLD*7bP
zSd987A&ct=x*SM-I&JMte&+8fKPSs~MNr&7yA<3{k1H=4<{_5GY<|m_Co6w9{0t8-
zwM%<1$D3v6!?{0xk#S1{<yoO2c}J;fdE9&OG|0U~J)OJOlY4U)#l2muIHTLEywS1i
znEqoeW&LqRC!-xzQfls^jtD#PaoXDQcITyty^2$9lIB?Qc3M93^vr3q_RS*apRxXA
z7#ENA^{(s453}CB*6}qzt4#l~g0il7zq54n`}C2`)~hpG--Y&^{egI%B~r5+0xsIK
zLfB_vw{buib}Fl-XB%wuT7<VP9`9(3-XEE6Y`<!^fxh+qfARka^Z$X|KZ+sy95En1
zBfDJO<53hn3uoyfob>~q*yQ~%kxgD(W5#z=`s)Se7x6dkm#u2}h>2Og0t`#|2J??R
zryfY1<_p758<>HjXK8lTH3Qxjx=1^Az5tK^D)@;deB9;j3CxUkIpXuQ>qi<HIyxtm
zOJxVGoyp7+TbWVhjn?4H_K|rZT1|ERm)MJ$+2+Ogo-r`{d??=R;xAF9Uf)w+<&m96
zMtK}w%S#}Kt-OusZ7qXu7e;Wk%7@i$(5nnU)MqBqX7$Q%!Q0Irg%Ls&1*Sqqe<RMK
zwh-}*S_&hw(@gj^sSf_nEuS@C<Hgd(O^_6Sx6vv-5B{BCNTIlgNIV85P4IIMD-r)(
zDf^u-s3YGAhRk1pK^QY1zgL0pKj(xpu3LKWhRyb0n;ogZe;u#q4!`ng7*CS}TskDp
zYv2zoLvoZ3LR5qGP3~N#a*&M{Hlq9|ePF$S#~g_nGpzWhu}=JCSZk+_#w@f4A3v3n
zU>8fT{lgB&{=*Iz2e{`h+ut%COxe=h)})}nm&nX0X^(HnJc_;IK@rUt3nR$vSl26m
zCnd-BlNDfunL2n-!l8vN#Z%`23mCF`R!`+m*$1=Je&-Rj`5J-Svfs8QA7DPudX(GR
zz_-uN3@x+GLn6laZR0^A9f&VmB>S3p6OjAYZ1k+O-LE#9hhmP5qb42UmyMatXJd_?
zJ1O5$-5b{~$=c+6m)^7_Z&3T5M8+26rMiVk%<$^;!D*Vr_=xiN&xm7}>cSN$y-19^
zAY;Y}a^Hh}cIxmVePCU0MjiCOzU@7)zUVl|f6TD+4n)O#QFx0AJc3t(!*gMi<9>vn
z92}JP2G;KgB505ZOC$pmtbVAuX3YqA2q`rqAg$mW)db)l&M4&i!;U}EBA)B&0a29o
z`p&!FTOdn5`Gz+?(>#mpt&F#c7pOcC9O4|w<u}FbBjk_?nSYLA(neLO^F~sy<@ro2
z&AWt^ll!|;L1vF*1HzMzWiwyr=7*^d-{~cq^ZZJmX>?tXS>qQ-|A-ejVn4!VY{I!L
zL<}c!ovu9k0XRbE$9IRrrlX#*>gNl)c%I>J*fmdmp&7k^sV}$Sc4?O-c-~t}cn9)|
zwmfy9{-9LSs259i#Dg9_SGxsQ#vWYrqW0jsg5++u3$@2fTyco<A@>daE}e`U#Q2y$
z#>mtDx>~<8&4tTT`gj}BifR;V;pP62M+P!p^4)H#gF5bdowsiof8u0VP8iYb;C#<N
zPkoioga@U>AnN@sN{!4jh@`Z-VE}i>i-zAn#of9)U=gH?##<)uN2ou{m{FY2%|*S)
z0_>*J2N)T1Dq2sC?u9p<nY`AxDkqpVC7muBKfFb}$V3a7by}YKDJXqZBjJ}>p;1SY
zBG2Q*@r0jna<AIOiz@YYqlv8ZTV~QP`jQBIKSDw3(0i+%HW0{Vy<Z*|@qBhUD1FxV
z7K4~CDxlqr88z|#tHt?igpEaJ(ZCYx+jnkTTfJJj+lW!_(QsQ{!c)FFtMA=EZ18`x
z!OsKymRA?uZ}GZuW?y{8N9*pur?R&&!us%?I~t3kw>W(Tzjwfx$ZPN(UYAO;xHoo^
z*~kio4i6)@D%lo3a#H!4MR7vh)dxufkOW*wv|X(#?DZhy*t7$wCbv7iCRIe&T3>!<
zQc3CCMtX0vX+Ft0LA>aOTDK{->G6pgYRy(;<I_ZZGAiuvC|~E4<`lx``Z%No=uBIh
zznab0hYY+LP{92&iY{$?oc_M8R1p+rUAMXGV)E7UBPmG{ab?a<e6m{!?U4*vl3g;P
zKSFzpp0^+}=N8<`F8zhCLcGXy)iHRl2`hn|z9Nll(T5ami8p8yIiPg%Q8Os>F07UD
zRUL_(X5NHbndRs2I3E=iRV3eq_Y4&`5NF58dfU!bBlDB><xM@pUdFC%$Rm3>WPTm?
z@v`sor>#Dx4{)O<m~Z0d8wER0U)U=Kb{0-6Jy(aQOy8q4iY0gKB|K+JW;CCCN0Bop
zTcz3EiBBq4W9dXhzxrOQw~Ayh9NFoT^nfUvBWAAP#avsYjvN>eujENf`lPdn?Tnob
zk7!}s%nWhd%p^ppx*J#SZ0EjKLHW3A^^YTe=0Mihq`)40JCEYbN?+fwp!Du^E>H2W
zhjw&^IB$=SYc6`~e>8p{Q=F3VQ8N_-n*D+&Bfsll<{@)BW;6Y0U6@w$$sz`E&YnTM
zHU)#2P;M%X<r4+T>SN0D#!Y(wW+#>9l?{2Gk($RkU2ygzQmUIu9*8_bC`Dc(0aAo2
zz$<1$-as4V$~*$e=!nNY!Dh$Q9ZPF9mS0&Lz8pD$idL&A7n3)6MJ8EPNp?le?oW`X
zVJ2+5yYTvwju-*t?@?N_y^G}v-4KP{x@9EdD~nmh8o%26v?Y1?Z)88p?#Xv1L;Tr|
zF<MY&F~5YDf8xe8XEkpVx%_c+sn;gT`X1j2TL}f>)z%M3cH6P?`-hITB*&fw&-QD1
ze0+(xV*X>q6>AK@ZSi}P!mm>9??yEjt^72q%(kXai4Zk_nED-ofIQ@PGVp3S`MkGW
zgxc|h2({x;M4~v~8k23S?f<y=yZ@hn|6FU#__BQ|A#8&TS`gutPi-byzb<ST&8Ju8
z)M*eORa2~_h~>rLD!Ww+fhE>hB;ICH1bs}cLbODZZ}sGfQe;OzQ%xbd%zgqbgRX94
zKif?)M(4nKsm5n}^yjK6`MK@j5~ayap{CD=p!VQ>j<s83YHW6EHVicqhRjb$i_yGT
zbLH;)Yfh?^e9NONq?*ko`g6&YykR@FJ~T-i!rqZ-iWOw8KNrTbi(n$wZj4|}O>{XA
z+CP-f`1;YQJL*ktWEPh2`w%tnxqp#SB}FkavYV37N;Snbw9EA8eiBAHmp^WXuW=Qu
zQZwb~L3(H@ya&F{{a{m&(fZoQU68g<Hg6NTzm#1snwKpgbVf=C7pbCZ@TTV|g^f1u
zI%X2q0yK4U@Me93II~>xH3ez=fSK!TlF1vAG2SD5sq&5tQ6Y;y+e!L|h}ud`-fhhN
zbFkNNl+X$?Z^CM;wTxh0nNPA#)`%VmHTSmvX??%;O$6`WZ%BKj_4H7zFyaGzjW$;n
z+2?}vkyjp4R_a5_nkW)KzT2xkb2hKZJ40#ALVvRF?GNckbEX=R#v0L&vtnNaniR81
zpoa{xZ)>g?oH?-ORzPsDNb_;9&BiHo<?_y30e-gMcG!N~T5Ml!NslJl#p`#*{|+79
ztowg&`gKa~bO%d&QO6hm3w{@Jgkq;alV``%bOU%E@O%7qzzg^ZeUXTncG*hI_DCU<
zZ~`pvMDCl`h#Tft;D5;Mqu*6Waa&c?{gT3nnPR>OOY-3v>huVjjslNxC$+ZE3`+eP
za*`{Z6Kb9TZk_haZ{$6jL<DGp%+%If`f~^6jS}1yf9HS9DEbkc4d(|kejE*5$m6zk
zrQDPgx~rCZa}tC5M6NeQZfvGj#s!h{8a?q%Ns~|h6uFla;FFd*8EXA4vePs_fU>sF
z@5KJ9*!ty}2u8J6ajb`|7i=tV5B#3Q$yGCmowsM*Ezh%vf9X2RX0c+Q!<}a_S7Elb
z5IB}iuX<)m?xHZ2ZZvPZn>8UWO>&cLpw4y&yM|jG#n`^Fjfh-lyPefGdgC^yW@~ps
zcHT^=Kw4?rdLEyW%j<lQX1k2?s9l`tQzL2)iEOyG@0+;RVh!ClSZQRhku<ZMkr_1U
z-|Aox#o(n1o0eEtx7!$^Y6af~t!J(Kh3Ks=oIt*>=#1$e)5TRw`;MRGjoXEK;HQ_2
zGrecx(}48vhT`^PL<~qXq>bDYT;>qvk~D6;f_^QH<3FdDr*WHel%>qVu!{z7FEZ+D
zUxx4tXsm7;ZueR1PVugmO&-%Trt^wiopm$v^(DK?j&J%`rfZMmJ&I(kwBMwNTsGHW
z#%&xj?|#zb%V+A#p{W;X=u}v_`03*l3k3fH^4dduu*6u#qWm@L3u1E+WJF8?CRCw^
zimZ9h)NeUAW=O%yYGx^+kJCddO+P7?CS)msMT(hvN>xv49YKaGZhng_;UtH6leX_K
zwb=63kY5;`02A9riMegmsZWnJDT2pxysJ#KabEc~fkO_d&@zUqK(1-%Ecvv8s^*Fl
z|7(48Q<sQ0UpEleO`dhP0xE(N0xQOdzZU9<ynE~fEU$hbkuz(96SC@TW#_|T?cC5L
zO9(6q7Fvi`4kp;MQ6uS_TY*Jm$`C2-ENbl>li<EHIAKnxZFDbH4XsR=1CKk*2lm6E
zC=wAecqnpweqV=N!Fb`MwdPt1vQN_ohDF<y)`F&<ggL>u$ptg|kx??tU-_^b{duQ7
z#xv#<7+*SQRWm;)Ma<fde*e_%y*3kn4_(MiDr-*Mdh~xI)UW!FFe$R!kq@^?+>=wk
z@~A0Ow%|=!8Tx&Cg8L+lb7b(luuT>4ec^xe`La*3T8KHCoa2u6%T|A1i402z1-n%-
z;uCT^7%|3i{BP#%khQmO&p!gb0;^NOmw{Nb_P5}ibSRo{53y4op);{3TlcE!%_-ys
zWv9RQ+j!@Fstq|(DOqz?c{bUBnq50LT9OyvR3pN8eVG{$h)k29c1i9|57%s0K&HXJ
zPw>y~1$2+q>mfr(3QOI}jSWt4XP-{UiVeowShtB$bQK(0>Av*o_2GvM-7gTB1W&+Z
zxjd8LF2V@qf7Zj|&4wfY1rovinS`tt1RO&7grQegx>FNOJ`8O-??PJ)T&@dcn#a&#
zk*2$M26H(s)Npp&2lz~p&mL?xK2H!nt5_p>!#LnYO~_NRi0G16OPx7fxq^H7EVa`8
z<YJQ-@)Aatxe(hxFM635Yy(}0ZJ-yu+6%UUE+k8(7yYhRDr>V2+`zC|hj$yY!if)u
zFe0yc!M7emkKN~?#}UGaLm$ry-!05Z0!kCy8HduPqi*H9Ji{fIpa(^dos8IRAh;Oz
zWOY`!gwfrhj$eQyMo)**(2=+DeQX#LHO?^lIn<$sJ7V;ADD`{vR{mo)j7uMJhB4To
z&XqqAjQ!^&!F{{~M8(is`G2-yrG`4g8tPCd(aW))T8Gl2A-D3U+b~{HJHt4~q0Ukd
zM~tx!rHO-Y<-cIVSTV>M#-$E*LI*fvjB_Ym>Ut~x6&uDPl{1X19P0Qf9WkzPC=F$9
z<-cRYn5b}uG0~w8C3D2cJCyoSxANCNW8G5nPiNS&`rxgb*!LZA<w|9R?0dKJ^PjQi
zm%Qf;Q;`In%f91?X@^v1X5YG%U-FFARPvTHOnW5gEcQ)DO#7v>jqKlV<$v*v^}~`?
z&M;L-(3{!6Iby1j%C@kt-^xGyjJ2TTb!V7PO3-=iYXp<yjyT)D{FPhz=by1|EP2Hl
zwks0!R`zAbel<#E+3d@=@~@NiTkZ@~iv+!iUFwLbRVpiFm)y#~OV)3RGfdR8c3x-A
zWfwVOVx%%NyAXWtS*+heXPDe2=q&aHM@*hl*+zCA_}jBszZhqj{3Phj>|94o{!-Z%
zb`JR3vsk}5&M*Z_(0S}^M@-|TvV3+Xc-gbooRXQ&FojCc*=)2UCaqLvVyA<LJ!{=s
z66p-n90|IRjc~*iE0ul7P6O|H*1D-=nlnsGC1^7n>WC>$Dl1^8fM-2x%`KVY4AUwJ
zdL#QR!Q@EiYx<Wz4Sq$|@6XP#B}&kn*$IyQ;-#`J>^Sf#vVP;7Vak%A^VqSDm~y4E
zd^Q+-imYF-GfYJibT&KM5z`K-%)~wcK1J3q$Qh<R5_BQ^m?NhBQrU-W0QeMHzW`^L
zDkNw#JJJzTjZ{{^jsTw`>o>v~rjru%M%K>}(^;u3hkXP*>RD@6iBl=yiUhrdeb^CG
zqg1w)^#PB1*1EaG$623RB<Otho^!udD%-^3)W7?zHLqldGfdRvJ|1OaA9CyyBbDW{
z?%+|At=T2+&M>)4&>ynGIqyj4p8d;l()&!t`nfv8<|jd$Sr^BC`AcO5EDJt08SBS7
z!xSt*Z)6pYn8r(GIjjtPYBJVO<_uG4A2hdx{ih=)tyH#^eII;kGPk+peP@{FNYMH0
zdybf5rLs-zJK$53xxA8hoMBojL7UjO95Ka7Wx4E|;8T;i?2<Q~VOk|Yf5@(K#I!~#
z%VJl7M@{AmOaA5zQ=$Z2z`pK?iI>VYv#)_iP3FucuQ|h%B|+z~uQ+1LmCEwi72r{m
zxs4?&oM9@GptrKi9Wm{Y%Cgzz;8BygEhS5xVcH`>Z(^4aOpbKEzkm56@F}u>i=1Jr
zkf2TMLdSm9NM*U~3*b{^{a$c}>7)exAsgd}>8w<i#m0b7k@cJF4AT_}x`3VIh^bL3
z+sw`epCaow+Zm=72|9<J>4>RSD$8S|!KcXjMLWYpO|kPSZYvw<h>4NPve`)RsVP{$
z2xpkwCFo7;G)GLHQduDz3LZ6u%P$FahRIKY&Sj@KV)B>D%<Qw^QBycm$+ONd1xwIb
z?9+~z#!F=z**}9vP2oN)ncxgls06*49p{KiE0t|w$AU*q;R;H|I>R(ag3e=u2_{E6
zkL_PR8hmOB)^D^kY)d8Rt!$8Ezv85_Y&Hmdimad0`~E5kdJ}ukZGVkaR><P6{|;Hd
zk<R**C_(44BOLq0OJ!!(4}6NOpPw^KSrT*>`-mf^T&Zj$>kB?b*6(3wn2IFm&8&|j
zrX5n*7S;=VimacPGfaCV=sb3aBc}aQSw8y^c+?awr{p1Lm?|XbY}VZoQ%zr4_mALE
zQ@E@Wr@DZXeXz%Vcf@kGucQW8&Xe_ban_qFeX#p~cEr-ySF-DOaHc8TrV^)j{+2%2
zE!PMZN7`=fD^2<toM{S|TSA?Q;Mp_P_rl(KEO?KdGi~{ilrmboZVFnRzB1!A?A$$E
zYKb7NIke`#6q+xaPV7fM@=V3OZ9vaA)((+<?Mx^abCNPX5U!{X)5*}^fQ$RKR+jNV
zNa~^;WBZZ&+jFn5mm06-M3}AxP&xOF9KGsvgo*^z$xve?ccxa5vm8fxa)=#z*Kq;r
zR4pPQNi%=TJU=*r=)be(2kQ}YD5DN~X~Z=)!n?ijFWGg(({pI$$}5+*^T-^z^2(#z
zjgi)GYj1m&;jO4Cg(|GBEGK<s>6~h98TsUe{&<$<;M^hlSf0%}3QxcLA`u)itc|^Q
z#Sj~z+p1&+5#8_F@U`<qy(_6rAi?V}&lA4r)4l$F$UuCN1uQ-&3kd!q!ClnLZu>DT
zt~-)@vzVI39*iV$V#w#KUL#n1b|;^2dObuwhmz0jUaqV<@=ovC53)C?<RQ$rR95)m
zqtYA+TGGct`=|;Uri=H|oK`B`%$`s1nZC#BU2;BaricYv*`t#7G{Jw41f9b+5M0t+
zydah3v1g!>-eY};IqL+|V@oCIt?WrhOmR|KHhVI`=aoIyVI{|%VDeujL2qKwTU*bk
zOFer>f+%2*BzUgbWA$Xd$(l)40Xq<5?4vzlJrV&=)+3_Jn#~>-q54+KotH{Cvb70b
zhCS9timTV#XN*~YbiJr=COY}YvH(qV^1!v3J+$6FW2DSIPb%BORwVf3@39U&T#+@C
zKsoe^KnD~_(0T0Fj+jcMvV8V`6TFJ|@R3$^!~d?gj}g6c7^D9l)Ub_lEBnR0V>}?0
zX0cx+c<$e0^{qMJe8wsy_<Z*Bd$H9>r3LK11g~1mfAKzNGj<Ztwi(;V?r|JvgH)Eo
z?oRMIzsKr+c(*gkxB_UAQ(CvM7J>5nQN?ws^h35J!LxCX^<ie0^D(vn-Zo=-Z1KHg
zY?VsQ?Dhn&JA16^;_c4HNbT(#V;1|7;}}_~Y$IEg;N!B_`pDrAosH2Q(6%vdW(yxg
z{XP=JCU#STr{`X)7qi*<IQ;-`8|Owg|K4%>OQj|@FTpEdul3R59B1PU2DEK03)zj1
z<D4LseaL1d`22aV_2I)=&Zs|Bf;O`o95GFo$_m)@1h2@wp#C8Z>CUNt4r<uOn8l{v
zJH~lZX*RnaoNO<AgbdDSY^elaz$V{|Elw)k#D0+AwF2{B{DHF>TLoy_jG5R($8o;Z
zSH|VCJqbSV?BzTT_c)`BL_mv_!F|Yf+)MrIrP8hJ-2_j5FZU;=-T4@^058rMXJ+r*
zJH}k8G@rel;FY(R8&Z7R*%*reEsl}PX8&*;W3g0bVp|e?O7?P(9{%0g8213$HpW8s
z*9TGm7ZSu~_GfUiy_`4mi}P_-0NyrE6MOyMan?wsIqWrXvb~&p@ik}TJPByqIJdAr
zI*zkJD%;9l0Vl)!AHL#@`madP`Rosln667@o7hVUUe`eVoM*!&XT55X;5V`t9dX@}
z%5sP_a2Mk{d_HF;k%m^btUPBitc_fG<+G3UjxWmr!F%k|4er}_@D9ARL9uUrw<y8f
zE`bE|k&7U~;PXwdjpQ?4fJ-33q`Ii}cX}uAT!YK66ZC4{i(1+8)UPHVmOdDXJg$P}
zQbJ!gA!6wz=ARXPZAqLBUUwiF8Rg*<_?404@5qn^BmIsnyH={DX6C>ivityZwf}Fh
z_Q_he-=k6bE#Yx0xE(nu+SY~qqmwe3Kc_<e+6haBM1}evoo&roTlaa8%%x-0=67LJ
z)Yc~CCmoaE?iQTjK6D&BtWs`M*+=K`r}+fR55FyNhvmc&*cp(&K8?sUenruoHFfv9
z-=mDeZwi!Am4a8ZXp0hkm~u~w(pHLA>c&iyq7`}Wn~TbeVMR}y4X_|ET+1}wMzpQG
zbJVh;!f@_`b1vs~*4NEFT<cGW%m90O0gBB?isIOFiaFs!!iO9>d8n-RhYr;Jct}-Q
z?WaGO40nEysXD34(M8nl%i}i;sY7<R4QJ|LwIj3DPaRUVs4BloGxCN^KPrV1ZBXM3
z=u45^E^ju!Psn#GmhDJRibCY9508~0i|9~u*O~DAaIu8Z=O2oxnppQk2RtJ_&c~-u
ze?T7A-_KXcrS|kWh@t9>_F$n%vYQu8-Ly=wwzNkA3^HDwY)MwtM8j^mdDYgB94#zg
z6|yGVVZGmlRgud055XR^=<-H=V3f@K7MVT6`&_yZN%q=L)Jfe~Gk5hT5@9v}T#xq}
z)M2#mG#72%*xw3|jKlm6>aL&uj<a#VJByxR;MRLF>AJ(Z5d98nc*!&~XKYlE=t|rx
zWr}GAPUR!tXULC~m()_$hpav6wdZxy%;#${2ejC?+SRr>c%q%kfaQ`rP=)w)-n1|;
ze(ka^%ctcYuB|LTiI^`+y6})@#9e9^*&~7-tocp!F*)LO$|V34vsHg-rik_0>q!w@
z$~i=nMV8kb>lXV+cf1Nu1w9#Qf9u%3Xgb0Sz8Vk9ZW^8mux#Cu4ts0(F4oiDm`UWG
zLk8VCiq@S0-U(*wmb#vTba4)umz#^86Y_97Sl$XYhy+6J-?&_|ZW|KSdc@RrXKHuT
zBCU@W{x5^(goUKQ=49oy0kG+x`tC1+ZH>Qj$$&6*LnKAMA*a&f-DYpBirVG+5;0Fr
z<6^P(xFzbh*os9}L+TdQxqmbBn*k>@qm?u~F67g{bvYMxsIcl%6|pAPY=`mEb9`ia
z)tHhwI+Hn);@N#>$I|qwlU2Tl+-LZnFwKvotiRpqS~TNKczSsHp)-~C9hK9!qs~;h
z&xp|>4rE?Vo%@U-x@_#IA%7ujb*8HDkngvmz20ua?vzSciykA?jX43|xVcjnltO%#
zX)PbgFs0^Vic{23)?b=>#5%OLv799ON}%>Hhd(#|7TNwXw!f6^@BR_Ca@$|V_Lst6
zky1qKRAP+;Kk%7Ta*?B}=)_^fipkhca{h?+b8(_qTjNWx&=Rt+hwvlA)Z;xVd)!S|
z#vD&Dq@1!KdoW)`a0~G~h4tMLNo;yoer>m7BoQ_3bV?yEE+SEG@~koCj-*5^fyZ_O
zi}8d=9W~QP?aZ&lT}UVe_O(vD1}Gm9gYsB%IEj|dE4c1lm(tYFLrw4vA8p*1#{Dv1
z*<8__7nJI%5@B_<QwowI;Fa(`=x4yM&kQf}P;qH7^3tK3snWJ6npZS_2fC+zJ4ZYK
zNMBCueWPGCB3ijo9;(u&iLlu3q^t!o-Ol5|!>vNrT#=a>l!|y+VOFl-?kU)y)!!F|
z3lT!F)8wO!AwdO}<lRO((x@dI|Fh3vu{T)A!X&In%`9<6Y9e9L_7glkH^?m!wBC|T
zSI;CdxZ(NAsA%lF5?WUbKbO<+iiM|chDc+GD<G^(+>_G2LtFvDBCYB1^Wk)zNN0x;
z#hO6SIA_K9^u(`j)bZ!FShH2nZ6`G}#XBE+@)(Kqs4p(wOY6*W__TxBpEa#C<)=^*
zl@9T(T#6}1sj4Me%ruX=Ac|HtYi(&l>;?PTA)Xu}71n7=6|EE^B?t5Ih!m5UP^1f1
zMGY+?Co|z?%>~v!`S&JdMFm&l4E3uNVzKqv{)>Ds`O*APO9~U2p?x}6zDp?s{cMIL
z;Eni-p~i3W|1z`=x*^2KXrE7FBghJF5ld#wteV*|u6fU+C*axGZm0g5KZ_+yFf1OA
zT@Wa5_Hof3dhSul(~S75d}V~E=8B1fgVI22$p=!WWEhX_6MVF%{<^vzzSf2Y;oG{d
zS8LSfK6?M~D>HgYaVnLo8B}OWPglz=11KgkNgKUMJ;0S-j&ZNdjJkpG&smpeK?ZI7
z-H6NpLAz+p6AKWhV-l^3B=LKv7(t)uqw3KQmquA@j7SZnerC$Q_Z89aoJkeb<^M&6
zxheRDOMjdut-N&1l6<!7LfMTNc&+EV_2~WGV4W&6Tav$T(U!NytSS2~CeC*1h`c1o
zxH~z4#AMxb`GUBjJJ};<&-#HF%@neJAE<6*{6u!MbRO8}n$d`JtsUCDr~E*7%#CtT
z|D4OIBHh~PgPxLmD=;+Jw+8<oXKD+SEwb4@OFTuSf|0$2p+h6Hwb-*+TRXFLoNp_2
zDKx3>()?`rVoChO-g=y`*m|4?`o0^UhZhLtixMV@<YLC&M0~t<IjnL?d^|d`0Q3dR
z;#NfN?YBF33>EP-4gkNj5KmQNWm{~{*Cn{?f-mVvpF!2*&dki3d2~9BObwv7Z;73~
zXk#z>l8LlM`CvZ5w+<vfola)e{2uy{nu^)&t&&?@spw7cYjmIJMkShboxP=P?bJjZ
zWZmBHdUJ2KxpNm(<V5++JSaOd0KV}U*BQjV8l)MGY!E?4(9XNG2i67g1hUrMuq4ky
z{B&1JGvaCbh&cgsoL`6kkJA@NQ|h+^W#{YaYYXRHsG1FJDt6A`R`$t8a7N_pr7_C{
z$J9n)mR;_rG`mNVy;af!d&`%v4!^4387;JnSbg)8PKYfa_Jp#PioKZ>p)Io{uP*2E
zRXFSBxF<z~m2=6j((N(J%E<Tq<(6c4mkFG4hg_U{|JLR`TQ_#cYypjCl>ZiUu*|;7
zJS{>nx3HgyXY^O12My(;FJ@eJr@&hc@mZ$uMxEvf5^tQupZ&=p{%rHAslSsE63>@1
zHdud<-JQY>J}c{w=Rd)6`Gy?}GAYRAI~f<mpHpgz8eK#W<awv<u@UB;S$HxL=c^VG
zGS6Zy>Xe`AN1HR!G9u-VBNpUBEzNB>H^7ptUf2p*ETU^3iB^<#5`Jz^UNymw$=jPq
zNr886rjcxW>i0Tm5=ok9%0vFzL2<6G)I!4%lHI##X&7^Z{GOX=x?Qb2l2cfL6?PG`
z4A^a+M=ad9Q1&9^eIdImDJM~E#rXc1H6e0sjzdO+=2ee=XE9cm%}rZ|c<rQBoS1`M
z@4gCu;D|2ujLu$i$Fj1ncXtTo>KPs4F9TigY$=;(mqUKF?W=2ud2zdY0bg#9us{0;
zL+#v4i7u98cmx`om-gy2qD*b$C@y!RT-{c!6!SR-ZXu%=W2;LM?UyfHhIN$tt6bEs
ziq6x>YP?E;UUgcMbAK_tJ)W{APVD~A#(4SY8zic|nCsxN+a1lT%D-7wPU6uOpFV#4
zhuR;j4Gl+5lGt<?4_`a<bA=F(&IqX?ZFlm7^ya0RcTH`7qPPvphfHmcQ|e!yp(>k=
zGm*ccV@teo1#Y6s(zkH~O@Y;QMw83H_+d)KD)UmOyoEYVK1}>T;kzgKt8aSv%lHfd
z-Xoq%ZF*Rx<dT|vkxjzK$a4B~Lx#q4nN1H5jmPhaP4HJw$8B){dR_n@0L1_9Sk8N3
zB@t`?v2mT6pqviP6K{56FJMgTzTRJQZ-26dULwBio$P3OR?@5_#J1Bsar-V_J=)c(
z<o2Y9;YE<e^f4+DhwC(78K4iW?$A)XC`Q!?|I-1;0g>FPir0)h)4>^=K&wg_$2U=k
z#FOpjN@AM;8=21oVkA3u!Tqu9;)GQkfK^QHIL(LolNN%~>YK<K4%8WET0d<1IeX^f
zgIw-FnLIGL-8BD2+}rDvA>KRTw;nQoXBhGxU=C>QHTbf3xhyDGzc_>1rbE7+!JOf?
zOzxlDZZ=cYMRU^!b+a#&Z^KCWSwqXeR+KiqN$)K;Mu%bKLm`tWI_z+|*VmSj8R2Jj
z?<cs0k&GlGdDJotHOO3@I;egTtNo9EP{Z9GaTBpt?(hGbIHzm&o96$6>Q1w6RbEeW
zs3W$pdOwN$Q+(uj?Zt{EKNyZ5IZUGeEWeb9$Y_j6V`<GxpF2%xtn!3FVU5pF7py9>
zcJPAor^#$w#12u#o7jmm<Wd0L5vse93BAIQj1?xsTQV;39OA~kEd%wqGx2KWL>Y-m
z@g=Bp0(B#EOgz3l1e)5=G-MQ^JMuZF$;af4h@@>PgE2Rq-X@BgVrr7<qve5$PO{Us
z6?q7K*k2C6QnG&7g_Xmxew|l^9XL>@nrY2yy5li(SGhLH^fvE+M;>X%L+BRVr(+wu
zYm+-{G`C@sLa$X(gzn}Vwmd<wiZtg&Xs!!1_r!fPx7kg0nqMg9D_ONJ^Ffh}{6TH-
zTm!ZI2x{qcxoM+=t7XRMs4{JmdJR9AP=N*1()1_I$n723(Vv1lxPb<MS)k_2#>Hi(
zw`*w3`Cqc5$$W1s!#Yq~(zYo#DErS<)kOOk$CR7quK^Y8h5uC=_AJ3C?Aa%N>R8AR
z)d~4A{Kg?8EjaMVHxa1}IagLq)sHXdjOS!V)|z{+i)BdfvZMR@=Rx{+b3ghbtiRZo
zH3wBm!;Hh3L5u{c8%!W)?YGHe^MyO#t-^54M|hl!oaiE>N(~GpzQ(!)>!&jmd{u;3
zS!5Mzy*pUCZxD{G-&xn}v@UYoOLZgpX-rtsy|tTuaa!A@f9(gg9C+PnU7!ASg_ea#
z*Zs$=`^jnT#~f=*eMTfCalWo-MzF{kB+l1?^`!=vz8TX{`}>Xh{<?LS{!Lx?e_vO5
z;osEtdvIN`$MI+X`_bCg_tbx1)B7*D0c$kJ^?`E4U}LC>tc;?k_tDj35V(Xnb`j|6
zQdl-_tF$&r@OhO#CKo6$0WY_=0@+}>MoS?-IJB=X1YZifiWq8<{HA`Z>AeJPjs9Dm
z{INmQffUV0EL8>?ro&4ON{Zk}_?JttMwlD9fa84lKr4a$+VB-`hq<)_Fe7Tv4kN&b
zcjo@o5?@&u9%K;q$n-K7S80!wxCF~%k=qR?)EaM9lN_F?)09u=Cb-+jHeQFwuT-oK
zo}n^NXtJC7V(#tLU8>ZSFhZWLu@QW~Z-r6M>&{m~Bi*fvw;G$e#zxrT5(3@F<sV82
z^c!~`{|_FQU#lr*DGhXz8VkI}Q0k#faQ7ZZ^wnyjU%C%IA#l&Q^R@6B9G8D20lM#@
z@H{+^PyK6BHZ4wFVA6?8x(8+6b{=0Rk@7!AB0%Xsd3_Iw7UGQ^BM%JRtskXizdS)=
zM(IDEQ9|RisO~bkCRTd?6>_cH<HO~<+^FstIpW_G^QR5ab<A;p%aU9Stp|5pffyE1
z)ZRLIKy}v#X6vBX?qOFoevi}jh&hcr_JC|R>$0vcoBqldlvD>#NZb$Y(yn71B;xP4
z7XIDDZ#Mcoi4H_$bP~HPk+K*OcS1heI5ri&tGS$<@j}LHnI(Bjg~_FcK7#mz@YhpD
zbgPxg-6mGi%^>z#^QwwLi13w~Ohq+f6;HwwP$tB0SxPMmGERmp9*yX5itd}=Y+G^F
z>*V2_qxrh=Cp0CZzhHj&So8VAm%=Zdgk8%SaW>N2aYv^h%V%W;2N^wY6wWb63HR1J
z1voR@DDm5k*2)tEX3kJVz(btFarC8%<SNZa1&H#Gd;gV3)5Y=IM~|5Ag0v6Gsk@YE
zppI61X67Hx3E!P}raC8F{JbykjL?_y--&JPY9{wyG9s&fV%r(WfY7aPnAnOJ3g2@*
zUlQ5Bo8UWHed#dH<?j5$g-1`7$t|ek_ae=CKTUsGE)R00IJc*1L{^fucB+|Fs)3B`
z;l{GUIbYtIT&`C6RU-Dd?Ve7#v&Ti6*}2}t>TnmT?)eIluQAJi8d_u5HZj84UEO2i
zlcC90r=(Dqs`C#wFTE1+Za2oBwP$jFNO32tjt!<lY2Pp}R?V`5r{oPdM8lVwaOgF$
zjkY)tl*{mAL&8kTx2Qbj=#&HIeTbDdnDTR>Pe6~W<vh<(+tL_qMqkW|Y<z3&9LRbz
zMDtYh7-Hn?Bv~TtzxY4iT=Y^gB9xY!0RcbeF(PE61}`hyY2<*qzi*NE^)0GqpMms!
zpw2zaWDWp#<5rzhs8f`WK8;b368A7fU-Ua<E?o}|{&Y=|3q2O`V@S{4!=M8fK5<!%
zGVYOEh$9Mr*AyjVuZx<jd)O&K14J~wYQqHT05A4)#|ZR)6VbD*6*A}%y)W4}(ydmE
z`G=f%IwB41T)F)(=Cc$=s#Rhg{M=`AF%0V+4IU5_w35WO<x-S`%=oUiSl*zcOm4{V
z;+9yc-{nem$NpfD7ptfMo>4W=37&uqQ#|(#<4UOe`xEkjWbA!T9_M!dt|mL$!Xqwg
zmp6-bU?Y7=+k55(85f)aRd!W=YhsGz&2y&Sdh%EZ>mMdW0QPGcXEBOBON}Ev+xv~R
zT6IV4+s_<5!-Rgx(Jzv5kMJdA$qK|7FtS?6!8f#)@T4u^GFG28ZKOWqmhEbNrL$`i
z?!T@SKCfv118<F$N#$!}_m+umx=*$kSC`qf42Z?t?aWuWd1*x;eFJ<0`nu|FxqotZ
z<w(1(;XkXN=<8TNETDgVQBOtrunpv<N9zbTqa%q<3{l$2%^y9(-_eTh<~c1BlcI+H
zrVmtf!|th@k0Sf6bYdGKe`ucgNzktx!R#l48`3(={G66?SgmfozoHx5F)M2nX?LR#
z<A&&4{<GePKIGW@Eu;JQo<#Wl_p=x3?pXhz(2M_~{XvfPuMW4j&s8&uF_na05se~F
zf*#CW5As6IS>?}#Gq`19&5+BqJ~QbA?k9-pRNZqSGrKPLal(@b=OR>b7XIytmH+8%
zP)ZNXe>HF=BNkyqPk*}j{z-e!{<E1~>aA)d^wdl(ecxVF<U-zf0m6%J33AvVqKe2h
zD${=J6!<27Q_9!d-V+?)cl3uhre*))5{?Wka*{*V4^c`8hh1yquq3_@Vivy)UYPvy
zN9!vH=EBgm^Y<$AtH@`QGEtTv>RYwtnCEe^jL}_18Oc@<!k1C%iHM&zv6U+2n?j*o
zP$We*ugcu3R<`zv(54ifT*UOfj^Gi0MN|V>Hn7-Y7ZpI0-X!XdX+h?sb=GAyU9mP^
zEY3n*zHfN8Qk(<C8}YNx!h>c&iFjOgSUxTL8<%i#?CLeGgB{0DMsLHv(WNTs*w7=S
zhc4lR*kNqx*&4(zuA$PahBIP)@_M37UYkK+e8bgo<Ed@R^|nzkS$Mtuj*LPaL;n@g
zWgvF3Qg24I07SqctAG)(t>;8MCPO@;mKOt8e+W{B=z(o*?Zc7xwaq4_0;?De1(X4r
zNLeq;D6;oNLd)rXjv}@4!-pbDYaOL=FQJAj<=#sC>gOVssF@V}ewK>5=l7_7wfkct
zIG<O_l}bp|ZG-K2)`#QUpywG4)hM*+CCpWRxJudWsiDejy%^Jn6Z%m^`p;HsvYIIG
z@#JJ~T-RLm+~NCX3$m$Nx$`~W@V!cX3be3@JxAI!rggW8a|IlTz25&mKx7lOGXCv*
z>tv@Top1>s&d3?$b;i0AJom3Xxl`dqEMa|>N?7@agpuHel~rczDFb_j&kjDgr@B?X
z;UYy^k1Bh_9^ONbu{de{Yu@m%Q4psSd*j#>+b)bDyHN4h^%Z>mu-XUiFr%=;maglR
zb{N@>q~*d;T36ZknbB?Q`%Lz-IP1*c@Kz*bvfOB+QtY%hYC6`~?103%4CKh}=|BIC
zHjeY)xer__P<OxeDgej%kLG=mNWZwb>rP>1?bM-Nfwws!Qj^185>`58!4Tb|aKz&C
zJd5l$7Bi=S4knUwIY+Gzm)2OGtE7m2qu(z)XxM=c#2qS9KwwOkj%2zE@vNa>)k844
zio5AjxW$}q<FaI)$#+5>;tKZtl4$?MzC$g%c^=l&V3?gdotdr*p9D#r^oGPr;+yg#
zFHOsu7Gl1RXmy;Nm0KTL(bIqT6R4Y)Y3<&rgz^Z-?!O-PTv;~SpFRLH;vSxhC?N-s
zWgYRqTn;EOf<X<oGlNh2@`Nu&H=S5BDO4opE!F=tkb5%s%vS%t)R*;dJGT5mD=Wy&
z;7kFBz)xSmj&yOEig|+ljArC{+&!*S!>=W28SU!vCd6AEsC|BXhIXL#;ADh2*Y22{
zr1j8dO!m|cpN!WUd>f|C9WPRB+;qIX@?;L|6l)qXf!dveeR`%^Mle1(S;TlqQJFY-
z{IN5p*4u+=t><{t*<^~*j+rdjI1w%{@`(xe((1PVleYwh+*=0`gK(xiXda|{izUUj
z=cbaDH34m-@s`&v@eyKeBK=1TS=axi+}>kiZubn-s@+@Y1j?OK&si1vcR@xGA<Pqr
zRImGDw}CsURD`hmk=xD0MD(1hmDee$fm)61ryinb=wF{#S~u1qYrClqdE!z+TJKOq
z=FyDYj?9mr;}!09kEfR45bBY-_tfWRFx20X^Sn6Jge>;mDQh!G{aMft*=u0E9r{aa
z350D-w4z7sb>OF5l~O_4GbzUjndK4r5;;+a3atZ&z3qG3k7Q)bRk?PYE%W>^(sIA{
ztg%eb+E{Ux`g+x`oah#?D+vu?_Hb5gkJ0(+wjC$1Ns**gnp#PP%KEo|3;GwxF3>=E
zk1JIYyCA<{5@AeV%;w(8n-|=_{e-M}!R85A<4@QReW5uM^QB|-Le3NRc=TZexC3V&
zxhQ~#4!Ng!&dLH!0A?S#HyQib`}cP~vMSPztoJ1JR%I+8b-Y`#E)4U6W<)#gJu7pw
zF>?gNZ5xLE{aH)u%NrFU{nZR5ag9mLFZ&H#T%Ep|62{-ZJ{MagD^(VShLzc29M_k7
zp@<^oT4a%#Q@IOSWad;p59=v$#3WiY<(?I`I~n)Cp6*y^3PM-SMFwAFLfusbjZu#U
z_8N%Wnmnu$(q$#yqh&;rwiwJ9qlxEdWQB{Pjf;Yf!N;W6)B1A3m=uYX-45ByNe*T+
zW=g+n)cZs?;*EPR^jnGYASKIJkvWu)QoWZHq4!r&b9r8|Ybt^AP+70vwq<XTvfqkS
zGB#qZC$YpLT$f1jln=R^u?@42;|-*n)*UgBds%a6)=OM8qreRSZ<*EI7c#%B3gFEP
z!1Ik!E#8ROrDhF7j_{hI8x-!2As8>>O(%DYtJ0_-xiFgNe71u~{3P0_{WYJAuvHkL
zWFK@3o>y|jTTY4)@f&~U{-mNtl>`{d7%CBWx+{;idEOvdZ&Zx++HFA+5l^4uru=CI
zkXq+kmI+d%ASp~kt}P{z6`D^zRWS+LgMf?C=gE6G`@`&pd8d~g$Gdn?q+pNX-HCCy
zeKX!W2sGdtoj|g!*?tQVe><}3H0DFNO$Ud@S&XV<c71^Orv1kZ`>VFet-9+619=t4
zoz(qgtf~g~4Z(As2>a~^gZCXWU$sw(W$rPU(JpRYiwyYy8&YUBf`FOwQmE%MC$hcN
z%?+`cl`D|3)4;a0W?sldY;MYqq4)_AL(6mj6^6&~VxNYQ39{*q=H@w1r9WA2F%Byi
zf8lR7&l#NNZ{s2=*v5!*39P>S1^I4S$oL}a5r$BVNJDEqVIy*fNUDyIjf)*1Z71eH
z<Ov5w1+RMKa0HDzds3u{Nt}W<_a|vFSHXKmte;MP5zCtAWR~*6@4>?n|8qN96z&8`
zx}lX*_%|k+1IZbY@<Qu(<dZ3-X}*w~RDdzzX2!sRl1pf#!URZD%FdYe;cG5T;cEmt
ztp7p}5xVNB|4I)Ly6TC3dWgh1{)F}=Jp|z&gm)0#M>4s;hprkW+>Cpg6N5+F@9O>c
zsK2mB#b3xNi+%rPnbP8AVpCwf%PWT~eI4xW`s3cCfh<m5t)Uwr`T+0>VfAaiGn4ar
zd(-F5p_hLV?diyAMzjNGZ8y@f5n`-Zv1M77C<~IElt_`iB<isHXWuZXprx`=c`<A%
zU{T?|$6p>qs62FVT#b5R5M?5{c7E3dasyolh`AinJ~8<OQDLuG43_*K_=)mfB3HE(
zPTR(0vt&=G&*C5UMO0?UTPvt-`sXuC5t9=;;*-`M>z4CfgIvwef)+kG`ozS|a;nVL
zoeFy+d%%)S-uPAi#OtHgZqF#YA6`35KmQ3zKW_js&bi@+dNy;evb1eJ9TFc;m)_Y)
zYl?oQD)k!oOO(c=3wJx%)ev~Vk~-6rr<JkTg&}P_X#(|YAJkxXiqZyYKKhv2=7tO^
zkG$7zpMl7BahGO!den=u!Oq7Lvfh5bdwxPz{QGvOYi%M_uv!jofHUpID-Urh<{^7|
z@f}hww<w{z)KQpE#687)E^1-N*ZYQ*fm5i@3G+jna#N@U8^YpSGq&kr2hlQXLwn}p
z4U=lsxv7+TVJgb;?_4S!@|u=DmRWiyk~UpTrAj+~Muy+gruj6X47q>YBiNZ*!a>Db
zi^-s)(ho7pZAz<GU5~w2?C)Z)Pa+S1(Cax@T*e<Gzu6&*e<hZQ)#1(VS&Y!*ms%8~
zj;ZsKDbsu-tv;7bpUO1lCDRjKda1A#7dAjU-V*ZmUCM+Q!m*h*GZ$wL33Czd5~MGt
z^9I@kmjY9+fhukCrb}BHdfNxbGH-4;n^~XfYoqGMea)f0U)wpe{RP4v+Y_0aLE+66
zFI`UXr>OWuikc|LZAl(NC%9|gCo4`~5Y=+MUa!%Ma++LD|NozHX8nIW5BILiO26l}
zL4c#ciEL-d?v#D&C!_?eCt6Xio`wHFoS%4qBBv8F_l<X_OW7--85?L_2;Lc{@n7=`
z{Mx$+OzA{OcFdm8jS*WiLKsMZs8NcOtyI|(O1_u!WuZaqcc<_X)?;i3t^3mNhV4w`
z7VMFwGIG2kTT&{gkIt=(D_ws$wA-`P>oD?P>!{y0WGh4F`yh+FW_MGM)w8w7H>}iL
zC+Nd`ZMlC%t1biVxsD$fExL$(*R?~5KBe&u)K|$@>$u;}x^l(?u3@jN^--TgRL%ML
zcb=uye_;i>4_U*2W3hC|TPzKY`CVwkVK4RhU5(%E4$X+|uw)t1sd?;7hbHJ{SYK6l
zaQQCCS;6{ozH+~icj{!*TtZ&?f+~IMu<Q_voqwkef9p4t#@5L~&f?z-hh?SbYGv8g
znvWF7;aw}ssW`+;V-{zWHZt^st*GL#udMIZ+%BkCUvad8ys2L;7tiOq%iZ3@mV0QG
zOV!M(DOiQI<=HcnqB5ehXQ<thJGdcAU$rWt9Uene_fQX2<K+xp_RP|hiD9Mb&mvQ8
zb!Vy)b~1=^KPBa+x7GL8o^A1TG}m%hW^iF#t-s&xAsK5+`Df@aC(nhAw3?YgWlxrC
zW>EUkX_P7daVm8{Wn9Rhq4bKv==Jn-7xTM4<$*4E*`1Ep(e)H3w+@=71YbWJFDq?}
zmyw9^IA7SaaxVVdfZ7jg4S!Eb3eTG68@}2*gsqVs$h_&5omralc4)|*GMpELX696t
z-YTQ4k9>!G$u5*o)>bBH11j}rf6@4TLNS9qTs#JN46=TEqkY#=Zjh_2H02pORe8jm
z6P~IH)1rqsYC~Km(cPXQ4Ux3IxUTo6cL@A9-pG7D^L&-n>u%5N0*#*v{Z4L2^wxG*
z^>mOk3|je)Y066#h{s<c_fJL-s=M$4(nZz_uK`_$nC~<8?hlLGWDbj8>uJ5)^v9&~
z1M4$p@=?a<46HzP$H9Y})*ELUqxfhezAHKp?hjkB))S-Ft@RobuD8gj)!upfhP(r2
zPzn`ORjI%EkTqu=-UM8r)w!8TZ1cyIH>8kNOgc#Sd!J}-S$7J3A}>k89fZgiqAX!a
zk!!V-zIHw(uYH@6*TqwZ*yT)Y#`75?l%_jxQwuU~{77#4@>*|7Uo#Pqfz)#4H1_$-
zkJwq6v6*G;ppzy;!|$B@oT7~V<0+FNz=QKT=OVAu$>g>3W%`=8W%}B9naLX`BOd22
zWFE^@n+?>3%!74hN?1JCHT818?o@~p4QkP-MWYstT6F)G-~)N*noM4o0tho8$^fyG
zz8|kvXMMA+V?pfNvSqPvlr4^3TsA&-R#{x^yEa*h(Q$v@DYK-gbZSI*AeM?@I`WpK
z&JDzkS1S{HGB#qh@G>CIl3u5!^^vi(JaP>!*TvC4D#?Bwp*#gSgwd_ma{p|j{yjbs
zkNR!o5A;+%EZ2D=TR21Mwd0ZL+aEH`^802K@`vv^FS(Aiiq^Gj(1SR-KO|<P{n`+H
zB#+Wu%*sw$uH8@n$R1*jZ5RPQa%zJ%l6$4$A#TOFhm4UVJ0GVyM^)lesEoUP4YFM#
z)<%bQ#p>5!^=soPv35P`pW49v&JN~|vV-KcN?KmyP3sR&#JmU6)0pLK)P|51Ui3%I
ztPRUzxmQ^g*Hr5wuT7!!hs~6{sth=HQioiYvji$+#R}>prgHkM4P4W8mRrs$xhu7-
zysi#V=g@K+T5bYW9b#r>MrDq`OaSLfrJVZ>>s_mq$q#$W&^Bl(5Oidq)m|=;ScvSQ
z&f}?5Bn#v#ZB%L5HR0S)x2C{Gh@2$WH`re5FSR|OD%77ZlUIQjYvN^S$t5J-o5-8!
z*R0I3X6q|;UDj*Yy7reXh&=_GsRZq;DIXtef1TIsa<NW4C7-^ZlIwQh6!}qD|I#KR
z{q8o0l$B99|6HE8lJ|G6`7SHhX#pKe$-~#6W*pfwXj3V+$;M`KZ+J6+p#ekdr;BTA
zhxv#ly~CYTp!m^wT>JqUU}bu3tV}+AjSTq67|?Tq@gst5MICN_Q*z0u?KeQO|4D{f
zlEIevKTz&h=kGK69`c9`O5L66Kk>;*-!M~hG;*O}XI{WRa|#vm>II6(v1>9zUcEtu
z#f#EwJHEA3XXlfw?K^Z_W1!r-36h91Fv{dT3Y-UCh{O^dFAc}4ijg0FE`MV@uZU~+
zkMbz-h-~2J@^4IDb0I@<Ghb6wV9SWRFN#DBhee9uZ|V_Q45;TPzkAjvOs|Uu9WSI!
zFW?UDg@2wYROvM@x(w23X{#q@>^<y=*XUy#epF6lD&vOh>oZL}(=vj612mz;yg`~Z
z9HAyhmL^|=r{*1Mi;in;qPC=FAIesQ7-GT>+O!>%JJCmSm5j{PHl8vz6H62HT*vve
zLi(0C<?7h)1?v=YSG>Q*vdQpDdO!_wJ0mwUVku$I3781&w4%#m9BbqbF|MT58Y^1u
z%ASl?|J3TDhi!poWKI`%RG}c25y<@lODNTh9nnlQGnpF{M{{nm499Ba`jN?9q^y`9
zKH2IO*K2iA;a;htkdq18H|r^74}n0IVkJ4LRPf*;zY}?U+5$-$N50;e;W!HjEO$<U
zDE8K^x4W#vR9)RMr^=He_Ltv`x!E^cWPUWTM;JDdXlUiQ#iG|<ZNiF@6J;&tiRiDS
z8$GYHBoprowW=Cc1CxqyCU$cRTPV&rk&ZS5@HZ!0c<Vf(O}+nSZubf&vu;Tq3vUS6
zWCdS7YEpSpA*xAX$o2GA0X3|MS8&S;WC8qac*r#euWJ(Xz==9Gl8>15%&v(fR3~a9
zx!J6O>=4N_XsnTV>-`qYO=o2Kx(J+fG2lyY;!J#*68ZfpaQu*KO%(UHdWzVkH3x6~
z?q2`5HL*4D3bdcD*c0H|pxMarI5+%l=LW&Eks*A8Ybql<8)rc*&VoKp0S-6|=WA?c
zm^ZhAyu{wWv!#BMULz+-%cBj*NX_c&kQJpi2R;8BJ>TB1=NF*FnMjB5pX0qrC0q2L
z=(z~RKpT2m$c|0sky8-6u3fMoY80sA{$8BufR55tUssJ@oIx*cqZdCp^y0XgySo$e
zfdZvNZ~}}2<Vb27yIgs%OcBDihH}(7mp-||^W1<CCOC{cuTr2sc=-^V4dZZzjl7p1
z#_yDIuh+PIog?bA9<5(ck4&``lR<hfYIvo5->YNo<02(V4!OXshg3K};FnnwL(6O4
zgv{|Wq!Pk=KVqXG|5Qd=d#>H>>rGAn-b4v&XuWx(BSbkd%=%v4ou>`Nhw0O@S+Ulk
zs=HC;%VMpbDtOR{R{zA>|6+yV`0?6?LrZ>;^8E%GH38Kf6Vjeeh5o&xx#gwLEy-AG
zSLk>;Gr$`_iw5F<_UJaw6(`BaYT_rSj2&oIwDxqzRK8Z`)=Tnowq(ropP4<2t5&dc
z4aLxj$2}92vAD)pOKL-7L95S$+d{iTZWpC@-lDhZ&t?$4%=Z}{lT|g?yPX`}$&#Az
zL;VbWc#a|aKxq4=0;?joleEnZ<>lN-1<NU1K`Wb(r}RO#_oo-_Tl^Y7ZLvS7$~tI&
zXLpSCVb`ux<&aQ278;s^do5wmawm7({5H9&vdns1@yFSiVdckStlq92Ys=2YSk<l_
zi^*M3&@$4I8PAaWBsu@2U2V%RZ4|OgCnFEoDZB~{AbzwNW8SUt4SOMsXgo{}DU``4
zg)Y7BMNgDdz4%V6Kg4f1cfwW>UC7ytkbfSgOaG~+P4iN)hfAC4=+e7~sgQquK@HcJ
zUTdIBuhr5-9x=7H4qgoj7q?Eo8}Nl|r+l?9An$qqHU!*ggWwl26RaT#YG4j|2e&~R
zc7l0@pkX0cOA*&h#GGGosY2S7BcjQ^TpcUEQP_E=n6<w0W#pBQo~XhYlNBu!U8&wL
zi+r^)T4<>t?HcF>8R~p|5_DDu=&MTCSn$mt^g~6@5>C_7HT6_n#<maYGu3b189Xbq
zal<K$?m}ik9q&qPT!&9t+<J9k|NhM5Hwt|cPlDOU=N@GnqECuGwv>-Nil_85AWcQ@
zpyV^~nwUH~bsxCbb7h>Cfgc34&n+(*Kw02q*mbor^m5f9H}GK^e3%Y-^<DgXmHx<;
zaO99z7tllsFJ+=25AM#nkU3eGt>D(Q$+#3^Mc5qNd_z;TOUPnGUObjZpN^h3W8aLv
zmk*`|=SFkz;M*QGCI#|_n^mB|*jO$ZTn_b;A}$Cv!lH(iyjGBNe97_UM@hC3WP(aV
z&hnPeJ|=vZoa^v<>Effws{>c3P(Y#)cE)GDpyMv=7QEeXN0bU{&ivjb!v1TYJlk-Q
zU-mst(k^S%#O{y*<LTz$=Q`iLsn-oaUSPa4D;Dy()&TxNdNguwTfbG}>^xS6k#<0v
zt9ZUuj+$0=+g+Tk;Lz-G`w2&KsgC9M;jCy5&OC211Q?EE9}k=;tsJ2v`{_;Io`~-%
z@m$5){D$6ZAtkw1cMpu-5mn636Gk@pBIk;m$;j$%@SDNoX_4R9-<Qa2+h^KZtLQl!
z^SxmANTdTt{40NUf**da{~dn4{hkJin%vV4u|MKwPNc#S&@3E`<T~%zG*^_%8-KQQ
zjG>1v%=d*YFytUo9}+pFcF38i??QGvbev7`)Cd=X=iqd%>uw*8BwfL{J}gzhQbn-b
z$AKWdko@+eA-|lcAapGUUF&T$4Jno-62V#Qs>wQTb(_p$n4J<0X(oVA(tSTxS|M?-
zbG(YWAjsnVOZr~GZEwIPC0;m_<Hn9UX5UBlJtWF9;@uVPz1}7RXYbjo+>(}C_n$}w
z!*t}fHHHyeCsY&0h_M_3PK#7S_B+WiM)Hg8PR8!OvaUTSm79&XOPu;9Ws5AtIF5$y
z$fJ!lsaj;*wUPAX63B4_3m|zRzjoTh-cq-M&?VRbwjFvbDDC;0Qn%dD)BF#h-Ff_u
zF~F#0sEf(<Wp6B$q(^aw&*hg#Ytb{ZheQm`hlA24)s(7oL%m_0EZBnu4=#Z}v0$sr
zteeMAo(frX2GbE>pmoSA%Eux$&Eiwd!Jq92!fu_%PnsH(dNG;wH>o^2Z3q4>hDL#{
z9f7z7Bx7NaaWuahZ)%@?MBt<O?(u{&?9nyI&Wb*1pPzu!l+W1I35Ely#4{WxlT`~J
zeQtoO%vTF3yBp^*IU&fIj9b~+4Dn8OAw#;6eV>6^*C*F&{4A7S7X>ME0i?`#LG`bK
ze@og4tnlC3WP4Sn_IDw5s}MT@xu|G0u#@*3=Wm=?<(Huo;j8b-0Y_$)Gq~bTQQfU6
z>VPB&MNB_FLte)Tr<sr{@|qLb7Q@^Wk=ta1^rzVV{ATuXVuy@;=Hl9{7;S`X(+#ec
zLH2@o19_`8#F00RNzV+e(IaP)hYtFY#A^z%hW6#=;HT0g*hr4R9-CxInPh{;3#9Q{
zzp;>U6owPJ5zc$tOvl=0dO^RL7T*gOXOJ2aorziS?%nC2fz<ApBydPNl1NF-TZsot
zG>`Lu@|bFE-PL0;o-IQ*bQoxe^3l_DQUsY5$NS3vg?Hs93GbT8{qSzSO~I=_sa?h~
zt`x7*_&pf^!5HzyzrXx0&SczdM7=OJ`@M9>zBjbUL^^N`k@YNiQ6jfCTDNS9w31{U
zrEhjV)c@qc8BcuK{T{sudwXGpnd!}bQ(NpU_`_zra)M(E!~TyJh}Za$ig_0oo?p`N
z+DSug@uAs2%)PYy%!<>0JD%tgl(rku!w#e&C*$6r3=Wz$+*GUHmakdd-)H>v!f7w=
zdvU~~jf?)6^%^f*ybL3OHGT(o)YX;N(ZsVig6ww_bl>U$$(`H+9n(FeR9Qgjk)hAJ
zd1CL{hpj%k-k<pu1|f(2O$$G{ULH{0SvoL};%e5)xfBcYGrydaUYXj9p5O(TJ7!VH
z;VEsMq3g7U{@hbv7Qz%z&3@&#OO;>JrsQFiCUGLoxSk?(0$Y`v^Q~U3w__I<ltGT@
zv|iTTLPo`%W@=0NksM8;0`m3vGWnC$ox{pjFCN%;!isVik-ETziL7Fr0FS2LBJ3J)
zO>PM^1@k3p7A2!8JfU$C<(AgXdND~y&U>z2q4*l-J-o1FH)LGuZCUe`t$zT^EMWO&
zy9}~Rw^(j{=tj?!wD$6~h$_)Yt)6f7XzVyU9}ypfd%(|>b$Vd?#gx@$H|H-C?vCVM
zZ-PdFj@&zOXrsKJzQsC|5wz5^VhL^8_X6<?65+{f_VB3#uaY{rt%EnT_9h7yA*w!k
zhSao1i+ITWRm5eNZ$v)4@G$Wrz@AOpXFQPlG?||b;KI`x1s!>j+;Xn;TJb%UQ9wK2
zttzqY>ML7+6y+6Y0Q@djSquwPW(yoYD)`;+3174p>bl7bNVDJ8A6B=LS(c<vyF^4r
zCE44kQ(Ajl=X2I3#cm@ct}E*dXd!};(UIM;(Y!|qv0ys&tR+S40hclnnH8sAL_YQy
zafF0>*mWH@VjgrCAR3ghsbm+He_=72Ts<l7rCrp(672MIrHb58UJ;@y2pw2S<X~?0
zB$~*0u$J*#ciIA31d@ohy_3;;6!q74*z^8Lvr4#lpPcFU=sx6wS5|k6+#hn}o#B=8
zQPtfR#FYyw;8yt4OcC<c_Kc)UnSxMA;(lBAGK^;Q_AX0~_058wngw<Woz4FdMQBrx
z+V}n@wNB(!wqfp3dk+qzVtsZw_F?evPgYuz;Wg(swS@FVjhTQZsdXfi6ovQ(Dz0TD
zWA9CQiAm{65&cyF|8)-cN`cIprRx<}wzpz+yS*o5_t<;bz2LVp(#x}DH4ADScB9xk
zTi;R-7(s7-y<6?Q6JiP>Z~T)r;tXMaUh$_3in#SEMfXsycck3jtCzNtUKJZizrN0~
zt}5suyuN0>#;=1)inRAhyzNX7cC?jo?dcZEYs##YYY&kbu9jO}UCA3&H>r2EUr+m=
z#5K+0X|OI=?5B7VuMjN`TAsV$aZC^2q}hhBXQXzCB^y~Q?9RTm5?9Z@QshQB`?$!P
zgnJZr-gD=$&sh5oTlWd*U&km22QpuPm7Z}_)7lqDm5|mvLp*QT;d*xg4jwmTCr%~j
zzhNHs2swE(Ps}yE+D`hwMa0p|+5>p0ha$HleI&b3iqlA}`d~|!PVDu#zqH6~_K<0?
z<s%wYg@+1phXlV;0%5J~Z_h{g4LOs@Npz%woJHc<L{6mFPLeZe%nkF?z@HjzAn|$3
z<M27Tnx~_<B`s88D5J_&7~!>A0Dm%%Mgn1tY)5ph2cK86#ed8qr<M0G*oi#(=^cIG
zKp{SiJaA_l@w2_~owqNsxJhqMnhD<3Nj%v^>$%tdxn-7o)Bt$eCPj<Bwim(MoBcwk
z+I(&6p;rrxLKG=-juBtmHQnR8xk4iGxl(F#AT`%abjcmiZUoYN^cum}?R2WOw)+p#
z3x0sd0PB^mjxl|fOSI@=Bj{SmT$7gwM7d!?-68oFO}#w4GRP2QBtCY{!IT@qpB=;c
z6}@!DE*07NS~TzfxFvbb&3k`0Av^ggArmOMrxS}pyS9D#(G^EtI}D#*w3es>?<;!g
zJnVVggAA5b!DhxUD<&uv7GH?L#0_zkfh!bUJ}=$1Nrap~Y}sh%@*@_K8#iF6Ie!XD
zUEPkes7u@r*S;38wS0Dh=+m&Lx(4cC@8)XMhy9hrZb*tE8aTC^TMML!u1{wQdho9Q
zN87i@MR8vJ&#*f?EP|q|q6sGG3MfsCx<PB+s(>sjC|;^~Ni{J}#h5l4Uu&#sZ6wQr
z%T=@DqQwMF)VOJlx>ceHatFa1TE)w&MqPnuq6;b@$mRDvGqZxmwt0V_-|r8YojK1u
z^IXq!p7WgZJ!bVlFUO_khtz7YDjFJ1ny4-^zi!nkXy7hF1Gg9&IB55_+R#RhBCge0
zhjj{41@4Y>ElxjgoPwI6n}RKmj~Nz3^rmJmBKxN6RxiQcHIQZRIILF82KZW5^$)2s
z)%%aV5|qT|t$ck%j>f~UV1#T{;Tt-d_rodkVJm0I?DX^!b!_)x6Y3KHs~lDAyxw7R
z!rUW{Y#L`>ALa@Fgmn|v^lj_oWa@%kyJ4CO(oA^$0^$11y7Wd>=Unjl1@h_k!))MR
zkOl}6r;x_?HU>^&1QQP=n{M#M9H>Ws<=T?Qlm|%`oWq%*prrn{$QyKX(JWZ>QeSuv
z2}<%hK|MD<w{xy^N_I3;up1QdfqLqley<$R`h5vJDynrs9{TW+)Q3B_OMSS^E_iZe
z*YzkhLTGCAHX93mN0>P_ps$YhgeEPyTb%{6pfvMNAiA&Ed%L3<+EdYvjrLThQ|*lj
z=snV(t`d81d>r*2&Inc5x81ivV#M7EPU-aXTSUF5LGM}mnsJ&*Z&L4}A6Ksyd(Z2Z
zF(Cd?lIr%RjbU306#>bNzhTrSt=}vbeicgU(U%RJO4wA3IXVe(d)F6I`OWHWUXFt1
z#ybb7-e2v|4*rsHa9kawA^aJ7I`wnyAUy5IeJ{4h0YyMJSbg;mG4cC1Wp(Cqvbiqi
zz{=N`<c7-nR$Jn*gcTSMR*VPZ&YJ%kWp$r$#I!Ha)%(v*7du8u7x&6f(ybc?8zLHE
zR@k?~cX-rB{gF-U!h|$;W@G3<oG|WB2urY-nmWvnzj5}7=Py5g{`lKZ<;jisS9xxD
z{O*%^20wm|JYmf*&Hz}rDgw)1qEk<4uF&b{6SD;=eZ$D}MkwIj=Y%S>I4c`gf*lAj
zFIdG86Qe^sbo-{o%o-n9B*C5tnq;5F%m{b8sxqX_$KKeNwZryBV`%DFnNG35o6|)r
z>Vlb}llA>Vef9fQV;9{@E96FVJaa4cMB1<U9PT~Xr^KY+;1TutMY2(*H+&1Fb8w*t
z=O?Ybq?w_;_B_3YzXp!q<|8a?dZC|w!(!o2O)vOH9x9p_X)5X$z109&^o5zx&>k#1
z@7sI&8iVk=^S*PY3*XoJUY=<x%AA7~H)?&)&OwT$=bzg+4=LU`|J;RnLT&AH^zAs&
z`_jB<%^W(Lr6=n`ELF3aB$bXoz>EUk4$oGGn|Q~H#&*^K-}(x#SazaG-%};lHDm*S
zm~4$$=}kMlA`inW>T<YA)suI0oNu)xhATDe!oAtZwz(Gfy72?E_W`kp=Q1ZO`tIz6
zhD(*<j<;*t9kEsI>kSUa(RQJ!hIuW4(0E5B?oSZj8r?&9_oAnTYwAeiq;G6AXjFOz
z@k2s}ZR%Zkb^^z5;2igBpc!*);vZ#&vxa>|8y2w<8l#>uP1LM2iC%|UA(p<gnLXBn
z*7ZeF$+tZIy)MMg!%hqJ@L{vUIo|PhQ)|}5-DQ_2{=F8hSbIEVG-7mHl;LeV6TDQ;
z1)rY88u;ERXQ!k>GKzVzCZX(G_zZq)=YSr%3HlqwlK;w@xEZ#>jz>e=F2my6VGV3E
z85|p%Ti1oWn={JnpL5vk`0tDNuH@0%2E5HbemkDshqvqhxh~`YPAaEAKCSeCpA?22
z>}(e=x4{}}YlXz^Bien#4q7uO3@GxQkXkf3Y}$l*Q}=)qy~R_E=>4kAWx}mSW+1;c
zZQg{oN79I+mhhc$WD^iA<T1EnR(|l%3igQ;S5u@<IW#-!p);(-qQA=Y5!ucKA6h7F
z|BBF$h$B1tjp}eRd7J6kn#P~#8K7;I=4NVnR_N9;VAzT^Ff1Yr+s(&_KfxmDUS`<Y
zuyIz;BI>25Fds@g>s|X6tz<w^#T+;8D!V%_!#z~04}GIE-QqVX_YKE<L|%~i<6*od
zrPFYA`B!Ag$HM#Zz^w^hG0i&|x_Rk$rTE)Ze7>M(u=E!28SABTm(BISxX+q!`jnh^
z4c%QV%bXBdhBAoj@X<*o1IG#VyOi8S%Z1rMv3B>=G&Zq9>n^3m#Jg=sjf)tN)<0WF
zX>ijemVvi?&zSg&X^!uAwIiZ<@QS^CgB>?_wW3V!VmaRH8GL9oab!tS+mrY>)%9I1
zxANj59^c>E_3##Oj$LgYT`(;Yx%^qf_iYt^sC8Ei(KDwbgc_B)pWdFR3Kg!`y3f;x
zSvRK%KQ^j7BS-MU_th$ULJrf`w{4<u<AMrjN(ux8Pzb(N%9+u-D@+k~Ya?tJ?3-ZA
zW6fbqi|iRViv(XJJ_z2)YIqYY^E8}E-G=c-mVX<Lsqgwu7|7cV51EGa&9#m`yMVDQ
z)n#P(N)fe!xF4NoNQke*0fUl)$3wP&PrV0IaLhWGr18&BWrgfGb~$9<DIbn>#Qx`U
z)HFYnSSRzTMdOjAhGkt_s`_|H1$G*n%h!c$Q#u!nw?JNfZ`nV_Tz6~??~qV4N}NvS
zt4E#lcwrPU<VB4%R$cFoza7n=+h&0T(wryWf4MII-HVq)8vglKjxFg{PQ&XLWqFJ%
z<P1O~@d*Udg5=F<PpF1|2p)C3;}115mb5ejyb4VQvWK-N06!9Py0KKngjs1O_AZk6
zZ0A^J+~<X67)?BRWgJd4l~H<4=1OLyRp)**#Qe5zXsNZ(>cS0y&5+9BQ`X)O*dryt
za`I#LTWMTMzOGq?bm}UVp=+)gVy+f3SF+7j3%;R>Au48zwG=s1xro0b=RRey&84+;
zKX*9eNCr_h$`-m(u0zX(qc}Uj=(1R2FqSoQ<}kWZ`OLUXohm;>V_nI3xJzX|Eatnu
z2x~<D?~&_%?np)sa(3nV)Z7;}_vDcu1f*Y~68aWBX==Aduo1M2j1*^uOM_2OP2*Qz
zp_$@(CY6sXnG<R<z*pu}?@(&VQDP~)i|~|ptZKq8PHK5VnUQ!);_m-TTqRHPu6XHr
z5myPE4*R`+GOkiLP`>QeuM4h{Bx7&?39gd&+6D4n@8{wwiTu#;$<M`AqS+>$b<lhx
z4O^%lHY!QZ?5S&m3kczW(3DKDAk#DOG>K;?M&YE3jW~&YsNV-cW)8D5irIW@<AltR
z%OO2uM_DuTGt!0c%iJpSu|h7GHYdp3Q^Z~UcqZvNqD*dcX{7{h{dcX1$^bl}6FDpA
zHWMdCAFE2OO0>@BH&wv4NsPye5Y7Z7IQ@pd#8y*&!~a|AQyRxBmk%mYl?4<<6`Z_!
z=5p1gOBb$I-8frw=62=XlZ;y6xL)?!5@uwgkk9uz2!wT&H%@(<&Lmple`iT3z3qc5
zYzBUS&BicgBecnlPVZ||ZSh_OheLwGJt7<D#=c(ldc<!I{w84Frg^IQjnJ-d36DhS
zjsEdXQ6?Ysqv99IZO&`U?%I;Z4)cOOxf>H%(K}RHAp#r0**_|Fhwr#@1Mm22O?z&|
z<*>gWBkL#faa@uoYLc#vKWs~;b7?}w32%~06>tNb>e|%m-~!rV`Cu$5UV5n>8UnAi
z1*T)hmpz%Q81;&sUhr+X_DdTu$LT(!(6}p=*?bDvJKc7$bK7Q_77Y$=uqfXv7z;$-
zmvgj1pEpr{;?DnWYYS0&0<o8s*TD;z8^U+BOh0{=UU&pQ@WL!uM9eF^toJSLoEOqe
z@(wiymUe98CEhYKlrz}-o@cJ45l<kBW?dp|N-i+_9;eXxoM$%NAz4|Hk`+ibLiECt
zRscy7e)_5OHP{*kmUX!Dnih)H2NI3>j-|A*qd}CQA?eGx(bzcmjAuU`>%b3l6GuBd
zVEs!lx(ztZ12&F0zP&>x1eu3c8w2Cpw4aBw8dErvl}|kj`7Yyfeu3d~u@&CGmc+%*
ztmD$JT@6{42L}D?5ubO$HR4^hniopt9%o(tS6`7w&kV(xYmYS5^(4FXJkz_=lLu>R
z13Y$ItL2mLTQ-emt|!5+{I8H65zmjfy$1PEi&J|q7hA)gagMo|nj-58{#|Q)n*Z`o
zT4TY;AoGZ4w#MRw%lVKkl&<#Jb<fovd}CJSz9IjnJ-&UiJ*+B{0e2d+!YIPZ&@T{S
zB^g%7yA17)=Sfn~nD}<;-6vaNV1e{rz}l3sX`w>;Ic85HVV?;}u6JqmT_Q>s7M^pP
zdD`=IR^jD>uDo7q&;BQTr_Y)0i=9Uf;-$bl@=M>-If$2HNo=}1@3b@n`V{mF<%)na
z5h}EuXXY8=PT^fq+LJKOMa~pMK7sEQe6;q-)V`DcH>v0SuTuL?{r7nfK)Jo7a<`-0
zQ_WA6TbhF;F-j#L1Dn{Vk;BNE#?siR*nBc>Qm5{1kcdycaPk|bdy`1-wqHW`61i*5
z7P5#_wmPq+X9lG#IR|Y=tJz4JwkzL-z7rRo;{k1(hew?iy9<lioau86Jh|JkOrZAy
zE6${RTF*9H*0UK%Q*$l7#+E$A<T%z1oZGoW16}(`_z)8(1R`N9eG3}SV-H%)unF!w
z<)m}({qbzX9<#!xWSo_6?hP`p3vqg%+D6(doTPYvwUw>D9HPx0&35i$T-K=6E&-P$
z&86yU)P>h8B`YIKQ-T7qkg#?hPBPb8nt&2*<-HZVqOd<nVj#VF8+Upz79St%jupET
zIC$x_!b>MX=J!ct>o#t)^IDID)#VD5d>i5?G<nVoC4FS*@5GaDSOI9Dv5J95Ct3WF
zmU240Iv0~yC+yc;dDS2W67<B^mc>mkp`2jx)2qqdH?$!FHe@b)0){k?y0?!q+l;!m
zzenVa#jJhtLq?N$zC-w-MrnEQKtWc>+QFM~QX!SGX04cSWyf*0oIH<4^UPX&d2lmo
z7zOJB=$f~;h<3|op0HeAIGIMp%9ty_Y93xtk|T~F(T0Z=_n35AD2|zSpM$g_?_6~_
zo@|%VGY$Qz2JKlPY9pjr*_KW^x1L^3Z<F1ibTU4xkntXw^zz9)W~&Kf$;3T})49s;
zuGvgNB&YOApqwN6)2h1c9-d9*-0-{dmA~UuB9e2n9>zOKQ7dG7scX(#bb?3rlA9fF
zThutkpwvB(+VLjW`mB?+l`#$Ce(TxuM$&Ez?p*g_$wCR&{a|uK;m8!JzBRw2bHr0O
zmfRBc)M6V1{9ZiOtQ=nrJ$1PezQC4CuQ9OZ@JRD0SYq2U8uP|tR@Yg-MY&UsFEM93
zuYGmZ2J4N5iS*`0hcPgk8R%t^>_l0z9wf_r-5)1n<dB7;y=gRiCGDfX+Tyu8LXwRm
z-S*SAEV@+&dA=bn%{N$*#-dGjnj9CE51+PBUpV>9<S@uclAU^7cu7vf%=*0k%eP<N
zd8z8m)sqQVD=wU@I&=0?<&EPt6}OMxEoE3y-_P$!+Mn!P|H?(djf)B*R8LRm`l%PR
zFYQ*M#eP{}2-Rx`4Soc>JrQr(xjwxL7DXJ_orT8&q{7Nq9@tD86{FO^y3omtzw?<|
zt+en+?FYNoLHHYtzW@*5$ZCTkIjPkn=Fq#~L=Q1afPSlN0bhbI;PQf7MWMg9nb}D>
zUf@lho^=|p;^w$)r*{ZvORT{=!l(RjoGh&ID!|xmHbrPub-ZQv?2sh>jFoo7!lD``
za{_$JiYV6&YGLjp6`eu>E3w<t{47Uq-$bc>H``L)fws8@?d$mvoM?S|MgMGzr(c1>
z-^@AJe^riAxPEGR<FweBRWl>z9-JHS`li=aziFHlJ2@iyV05ghYO)%0&8otvNGLsk
z*aR(9%L6)FN^~<}GbnyBX_|3pGDqdvddj%V48+6{5x@#p>{B;DHjHmUomw;*K8U>I
z!C4Y~7@?)s53`*ktawEBU^;HnyUq8Zo91EN^H6Hd*l=x7v#QF}HXCg^jN0_mLp?Ef
zl`ZhND6Abq9^ry<cAyb0MsI0{H7lhz6GEjv{Pdud9@@&|wSEeu2O52!*(_;tFHaKR
z@oQE|@2JL0@4RV${LZP`=bn5gYbw2CiUenr--`W}*yF=qZFW}Xef79>6}7#^(wS!u
zpwfY#slf5XS*UtV`p&5~9XwrKPXq8&8?aj?j=WZ)Xou`pNnB?~6+QhB{pbkgZrV)R
zA<7oCND#&%tW~hjXmRFuRNGQvGu14Fah{>S*L17nt>2)(l7BJEE1Jd|`^8-v)%oLV
zY^gYD^_Y?%-ZRtYFKVC>M|X~8KeXaRB_=45YWaqkV##@D<@oJEi2)}6B4Yq-W9DB`
z_M4EyV-(NASw|oI^`-NUwzPpb?a-}CWG|+I$KFF(Cvg`Xn`{q}SF?s!KGIap3h_{l
zv~m%;zEzB4$^SI=o^U#?chQa<8jA<M`L(HGo^$=F?7!PBK$ypvT+kyPxo}+7KKqfB
zZT5bl;un47FUrUq=YY&HP(<cf39YyApjo9wUziN556t-)>AiA)PO9tQ+=qsaM&J_s
z!pNCQzk?6>h6emgJ3aFH-)3x12ZyWt@Vd?Hn8KZ<6Ckwjc!xW8R--Cz7SBAH;rci`
zwLs`TNeZC#Uy=mq<Z=Z?;hDDVdQg%y7OD@>SorE8tW?~^{PN!{#SW|$tB)RbDnNa(
z9zwsHclRZ$4RDn4;NK>*)94=#yvJ#yZLn3reVKSaZSO?7(zwVgmU02M5v&3{nB5Nf
zdp7ZVuxujxENR6Hpl8>n8pUsd13@mD{G{YYYqP~8z72DC?sN~*n)x(#bYQJ~m&PrS
z?OzIS(+(Tl7Wzy2zT+78P~tACcnwfUk!Fapb;L+Tpt9}d?_j?QPm!7M6!`;mTEAt&
zR5##vc>=x_=hFM~x`bNzAW#{YHE83;DwFi3ov}}TX~1ytOQqaBD@p=BHk*wIFfAHB
zG*4i;?yE(O1!*hDG6)gK#MR#aQ(Env*D+t*VLuV{pmjx12wDPTGrwaG*7!-VP#}aJ
zSO(Fv5BK6(D5sQtBAE4oiyCOB=h$HA5K}PIUR-?<>v5aR-{9Yc_bOlck@!Y&8@O6g
zt(y<{EL!SgAY{P~6gGs7UG<2h=kN`EdQI)L5A8bcIu22v>K|+PrRX{(A0b{_B8$@w
z#(Q8k#|vI%%*F`?&?W4|j;0rXIAfjuxOiqyJEFM9r}r+Ii1EHZlzG+vgj9!s`nDJ#
z$y9!L1M%iy!C^DWb*rO3@zYCp5%r|Y$9;H(Os}aI?<d6RAyqEu*q|=&D*uo*g`9u6
z^yb=-lAJX$&8W+*JVC_`ljh3P=lyFL>8;XQsZ=jsM5&^=AaF*^5a3}*vS1CqU3u#4
z`~vXi)&U0L%_jE|2K)J1H`+rK94mMyC@F5zXxVFqW`hFyC}RMyJFbHJya9RlQ=HM#
zSugmXrV76;3FJcp9cm(@i>-k-hrrsa&%sONZC1Ca1QOEQz{nVAgj^g8pN_^^p!Q*P
zt7d}={Wg4TV$v?A&c`YLlm=5bp&$1Gm28BEqwvu~SE*H3#FnU>TE4o(IHb50YuZ13
zy!ILF7apSAz1xHocMl&0p=M}*s~Dz0S^6;%nU=m&pdFPo41q#u?2%1DnK>M|H~d<B
zLkm<RIL&vc1K9$@=S8=;mbJGZA^CmrdA1%LRr^IF{0dDS+C8fFf0uGTFkotsvIHq>
z{%uM^i)n0k^!noAy-cm2hIQ4iv{J6$H)~3$_R$7m1~5OxehFOyJxWv#JXthqbshE6
z`iUE%8_Wz>d{NA3W+bqdX{f~~=!whtogwxHYtbY!mKSi}3-`~jV>Q27$68)o2j3Ue
z_7c*6nh1~5VDyar`+ki5zK(^@&E2Jp{oY6*JR~soj`6JSL;NjGV|6vZV>NTuF}g)D
zkgjw~k1+P{|A@B(So_^KfZz}aFXu+|s1|)a1ie~~Ud6N8yBH5D_y=8JfZDL=2;;2l
zeu?wwUrjYUt#m}U+{3tsSLU;JH}IzvrT?MguB6jWX^$EDaJT*OUZvh)L1uN0SN8hw
zZOWb}$)f`@(r52BKW!t^x#N`fIpn3_FCrKRRFFju`3ckhl{-l}?t!hSx+Yl6bwHt%
z>xZ8^BDr?pC5S#<o%u;V34~SjtY`npCTjT!*g$x$t~i){t72Sga~Yvb+(-c0dlKg7
zmY_uJQij5Mskywvwpmyi+^ygp*Q_j<JoXD`WqRiHa-2#)CJ<!<l0;xX5sQALxkVlo
zq>qoX3b$KTLiH_`FlW80t+(*rXkIad$5=7|p-nRzqoNP~eAYpeMSE82=PRkYKhD7{
z<ydFsGRRgp65fD4<Xw}a%IjgLoyo%2yIPtoHAz-k7O%Se`n-nu*YmV~xvX|j8xy){
zpcna?0a33mql~P{dV2L#!%~E`oI}|+B{C<{2t#C>@pRg)^mFOjVQuY>0fB9C(bMzD
zH!$Jk&WehoCrc?B5Jd*+^bOP^UJmv%0i=~CUkjm-4+u(v<zwYnu!Dq5Fvv#QhmZwo
z=!2(c2Z*|e5WgNlDey-c487zdpPjVc1iV8Y*r=;f=*|tYCnmE%{!l0=qLWd0SnHR>
z6T0Su79q}~U+AK7331_Zh!rE%$Tw`K*`%^;lxt%}ZBlfrc+}=%%B}RCsw*juPyYw!
zjm3{b7h~?WjHW$MH@;3R%kat%A(76??j@CMEoV!Cq~Q&zu|-}xHi(q`@0u48Uw9-;
zuj?L^9ycXUZw&0gyq{p|F190aF-sz&Tk#oYTO+<Lde5OZhZ%eJuva%Sj?GuvEFZtj
z^vw|8j-a<kr8NTi2<5KCAKu1p7JT3{@$L6T{YB3nSJF(~9nUqk_015{JiD_~*$A8~
zrExvbYpmrA{=h|av9rJ}zQTLN1!xTQ<mRV2vVLq6t}W><xa)cZY_gBu#GL%3(JHLC
z?`bz346z?P$mqH+4cVEY>wY!Fo|C~$`D9PL-CTxqu`P(2g7|%6kGuj+lJRrc-|dcK
z9J9F}AyKq!J0^7VQ~_0_C8=BJ+q&dcEFndahdkkRkv9Id1QSPGoe;ZFLm+mMUCB0M
zjELCPv)lZ1$AE7k>BYBXA|fsuDfws~j0}j{6s4MU?>7tQotYOlfB*a_Q$(acR%13I
zZc3j#7N<1zI9Vyr6E-eJ^xTqrK07daIMXViJz2Nn<YjFEVobLDqpmtf$mhIim8Lb?
zrQ4zi8zaq&3T;WtPaKRtY$nWkilo6t3`-jLU*w%hG9T&%bi)&boesQt*wUt7DT5Uw
zV))%+E+t6gHTJ*Hz$XVX*9GFFLQI|80Kzk<LTxb)MX#9@St?5D;x&_^9klsz9s$dw
zJjS0D^O#fT)(2jpVji2NJnXkzcnJ1eUGWg?w@8aMhW#n;Cdrq$A#~9AFIkw9rF%dH
z<i2)!u1$mdc-#wi$WrU=SnRBO<2!gmpe-$?5=gGjx~rG^S4$j~6R}O@c3$MHJ962T
za>s8e<+uw{I<mVZxrt<1*EzT3!#BSKD@F<Yg<(xQ(p)9Cpz1BiZTTM-2PMs=dDT`>
zCVfM{z*+Z~D%Up_y$P;R*M2%E$-mn5W^ACibIH%k9|4^md;$%^`%TK821Kl5dIFt5
z{qs;1p$Y7iY|liwe707;ekUigfNIehp_S>k$Gq=^Hk)H`*o!tYRYNk*fAb64^N8~J
z-i`*y-qD<!26dD?FRRCrwhg+r9}bLFi{(^6$AE~M4B=RalK0*>@s?vQ>E1d^B6*IH
z&N@<DAqihJpn~xpX5LXEeSOCjvE{PiSAws1_G`^#^hf@iU!hIfg=uxlJ|}!bS-l2h
z^56SfiO3AHpFQ;;MUo~<5=r;xItf_57_z-zT*RUgPg~C|Uz}6Zz!4P)mELbXi{9Ac
zCez(_JcBOfeCRQST3<qOAX{y+Tz7rlCVEr%8DWd>Uruf2@@#PVHP9Gyjgx?}qHZ^T
z{3i;G5@=pxu3?t`oPE4DpqX*yk}yWf<-5(43(gXMel9~ga|swF<?><1|GF$e%}oD1
zuanddbe2rMetY6G3UE$c&=vzZ<zw<MvY7&)!@T~4&mVDs5;@9)s~5qiBd)ya>cJ%i
z#33dB;;vT9YZ=v5l6m7MTWuKcNggd0@IRj~!E3v9d)RX_X=+Il{(EE%{4{7cvn&bg
z=0r|Kc&DUKbmo7Tu=2D5`vk{_o^6^rL!hfvB4UxAiPQJbcAVqdvck;Vwx6InMqrH~
z{eK|z|BkJr+qh>+r)Na%JF7pJLz1LW&J81bUy9&KHou*=?`z#5k?^XQFgKOlOPHIF
zD5Ccn7Z3jdHre@8TR{tgHkwciI%W^GTp|QY?Xa1T$R00F??R#c`$U|4Ux-ooqTB-?
zm)o_r5gMhmwo$o#FivQeyS}9I5%(7P=?!s)0kqeCB+R_#_OnJJP;*_m1OQ!^TK1KC
z=#={zDVI0u`u?n3KJUyWqNkM0sUQE>W!c%8OKf*3mu25y|KHZ=i_TmUx=Fe8xQQC|
zl56CRH82Sl$^V&e*_v^-V^&us!jcCP3(suh9nZtw1wQZ;)koPncJi+i-blQJ6EL(}
zUHU&c4{&TZtnrXM!dnp&<rFNN$qS|RTzcFwZT4;Ca*5gI;pmfu*zD!(#j<C6K)eMm
zX}R=VNWo&^3OJk9gUwMfY_36AL?~p8xA2GaOubJpvW5*2-ahXpOyFTv#u;=zz=?Wo
zHd|%QJ&?mQtdQU0hO0MSN8?&=IFZxr<G~l?Z8Z$y=jY8zyn^eRoLPx?4AIa%WQeml
zS6<tN<J`FE%eSAaIGu2Q=RZ%LI&-4x*roETWj9J{if$Jy{cdf4;Qa8aU)jtU;lCP|
zq)~-<BN{kb;^cj3MDIcRu4f}ezEpRrKnUYrQv}A>qc!TG$xP;d34JSkD#GubOBdq#
zUs^oE>$QU}V*hoklQ-5$T&>4Zq^tk=_{ClLqFu_tSp*%_knnoU!CQPE7w;|oLC(Lh
zCuD^1daudCqSk&EK2oXSBfVX{uKk>cMTVn)Q@iUu)otm$^dq*^)dh-QgxCKab9-^O
zg10FqDjUsC&Jk_tA*=3!-$U;Kj4ttWaW91V{CGdK3B2fZng_69SFusnbLoFBB1@F2
z1Z@DXl#yu3;+~02vo~ZQZFCx?Je~flGD*(bc}*(CD>wxZOK%X~ZBp9tCBpl|cvYh0
zO6^Ww>E$U*`@LeHS8CqvjY-OijSq{xJUK66*6-N@!#*#^3vCZr{gG+IW_~iW``q@(
zrBPR-rc63AY1rgXCU=i+ng1?EBhGn(9@LTT3=50Bo}9z8ss%QBlbYH?^N9NvybXPQ
zy~KY<cgH!~I`_JlClE*D6wl_wr7|b>5jpYVR&X?|XPP<vLbQX`?15a^%t1p{@H?~s
zOERk{^Fjl^81Ipn0_|nV_W=5}{He`2Ie1`E#^aPS0RBFQUiE@U6!wS?FVaxnqnsTk
z{sw2z2Hk?Ts~F=h{=W7l`mMaL9Y)vi``SUb+~ymEKQ?)9Ba|sOW1#YZtH*1~amL{$
zxA&)x9^7TTQSbQEkC%Nzr-<k>PnXeEK4<<irz4EJZ8N#@iY=xxpW5Q^<SqbJvEIwz
zSatq_m=Een^_A+{sr7W>ltJ5`pMD!B4>zTHZXN09!`-Bs_BiM8=5A759UJ(wsAs?}
z@FBULL+Cf^8AMmqbC_7q_nO>L&zGcnqQ1(3c2TnbMw0A_vNGn5omv7Cn;rWd4{0@*
zH27<o{qb`PZRW@VSFAwna^UO#ijmf7d{5rz{2eEHu6@p-W10DoCtKz5d$5Ae-1A>a
zA`VG=oS%bEemTGEuEez;X_I-@zm#M0fx7Zoj_D&t0dZM5c9mnW)(`quxT$h9?0B4_
z`i)8wK2rG|P7-?XFO()jH~GT26yFeG9sh#H3z3RFm5(fA`ZDh%)+A7?guzoguO8p`
zRlw5)wS9CtT}bDj!w7q1R}T**4Up(_mR%vf!$r`FvQ_Q8_U2ve8sRw<{|LSL2z)b@
z?<J@_;R&OJtkDXrE1*V$iuk^aFRU-%-=d0dA<pHqNz{7?;@Y&g<NhLOgX3G^_0!tu
ziP;RKB~yfuaNZNz;1ry*Q5@`tYv!|&E)5jC!dsx};mN85{#!wlf8qfYi<#&`P;%z?
zD8PBi1Wrj3gmXWBW4A(HK=23JF`!xjeTQ)K1n>=$SW684`X(`i3?0h?FPeOTK6o9z
zKn8gHG^?;?ws7i!o|f~C@GdYVI;J+m1F*PRaPDF?DZuFjGO0HEOIGLkw@~4BB2V>B
z#9sB;h_R~Zd-E58gT+blzUe#>n6<#K4N^Wrr0w7CRET+hUnb@Ydkn+`&xO|?zA+4E
zq0&8k(~Fx&raC&xTCe1cOIa<Bwot5?%S8<)Mon*$5G(RYLVVgg68`#TLBaKctjMT(
zy_PI^@!l9eNwBTt<6EI4XoX!(Jp9g2VU2`umJ-jPx03o#l=Dy;@hpYLh;#4w^FgWl
z6L|IrJJUasA0Eow!Wr1fh<NP|3!zAtg%G4_j7920vQsb){;3b%6ShJ5r#`otOzJ3;
zPzcYh{PayW;Pc_`80Q8Ypmi2&JUDSYxKq67g@<=x%VK{J&X%NCi`ct8t7()9jvtwE
zSqhX7wiL6Q*u&I^r<xnJe#z8JApzl=!c~#?=02%iB$)?%Mr_%7@l5CcO{<PS{L@w~
z9YNCbldbw)!T+yTU6$UpRbPqg(yG_qy#Mc7wc-Cmt4jO4sC=>u-xDv!6Uk5i2jLyq
zfPAqN{0b7>weNO9e+v7g&Ba~q!6i;9?Vg!_ohSoQm9%e;3)gf*)L0LtsG%Uv-h)uo
zA~+B6ly~@x#vt?Si8xM*zzHJ0@o6@Y5L%6hqG*Ih>_qyl^XL&oTg6Es$^Z@7cZvYB
z3Ydr%eY2u85=eV<aYDM9F_tZ12q$)K+IBuBZ9d_-yPc#QhgSw6N>B!A?EC{AC;3L_
zwW~Q~;kMIc#caZ<sJ}F;Q~{LQZxv}$sGRAaLr?Ms_n@nmgphXh7?Y%*mbB9eCx5D+
zRz&E5m<n{m2%sAp7Rlv`LCNN)?J=WdAvP1VDZ_^k1P=(uc`6tG2t0A`r#70uL1vM^
zv=DBFbrETPs!NEPw+^Yr9+Aph3JW3U-d9e8zq<WrU8eL-LX^n)hY$A#E=LqMgd&eF
zKU44yJK36rFQuf6w{FEXHMJv0J_&>l@)5fo`x2(7;ZnlW66i`<0-X&B^o&XRM#OmX
z9YxuOFIWf*7xw4AryA>e@7f#icm0p=QEKUnv9F03YQq=&26i}XeJ!=(&;4qw)AiN0
zv*|s>&T>}c;R}xo;-B?u{mEaa+@_t}@N0jDt<(h0BNn6dh=oQ_O~O(UvC26-e+GHz
z{-<wtmN+6vDsjj(vK(^6@wZ7wBGpDE)7DN|a-i#el+X#Mr%OBj*^rMfCG<2%Z|wX9
z<wm(<{7zEm1es5K<KR86ihZ5^sU4OWA>7phM5y8GECYfV>tE5w$&<Y0KKJ%PpKH8Q
zhtLW^XBF%hqOLPLZ$I9gz+H-qcq2i4viDTon$tC?|FE{zZLcTZO?XFoK78${AhTmC
zR}~jQZD`2|01mkUzN(N}AIHzoy+4bM1fDpp`rC~4bcO6PDsk8*-$Ikh(fh~NB`CT7
zHzZF!sXr&X(AWyXpObjTsXRplX1)P4KLRt~u!LEt3ghRdNiz)5tTFd1paq3*{qHcp
zJfvA<+JGl}r@|ryBi|jrvpcqd6NPi`(9vM$9^Y!+f_6#r=r6a=O&`n&jc3YD8P)FE
zcbg^c>LCYEQa0GI$DfrzI@PVmFb}^o`s2Jkg?NbbYg^(QrVV9+iDa_)*3CaSucg&V
zJm+e{!UQT=_Ha=foBd%HxXd)J<yq&UlE%rUMYDp3Sxh@h=l;s2NqdsQl^u9YVMTjT
z(!s~+<vDT`9B1#F=TUoL4vP9)QI?1;#Ms_D^`F4t2q<ocUI6Ii=R4FNX>q6FYdVBm
zwaS9Gdvef8J>J2!z2O@wpR~y6nS{v<tbT9<(nrzmO@Obj*6$okxmsp7viq^#59A!h
z4Xv_<pQJCjY&E%5hEGobi)<z*`#X|OSif95IL=o)XoIgdpr^0aZ{Ps!uo2H|UkZI*
z8#MiS?U1*g*9I(q9%-IOn&-8C+n(1B+t+_B@D!wRGIcBTF+Y;cN1Pt340w848DXPp
z{gmHp2jOop{sQnf1b;#JdkKHT@aLzz4f<`+Z-agt^xL4{2K_eZx1E0Zu;H+oQEI>Z
zNJS}Zb;@L09pL6lt5CGa?Sr8IP=$!LI>ST4aQ<lEo|F1<(S54(vM=#$A}k*Q%p4o7
zQPe5cg{iCOZa*5aPc^0_D}o|kl1*XtBVp=ifyOT)5HY~(xl4(#82X+y422~NeBeEH
z^-n=8NynBx9Y(#1aWw8g>^Htuhj_(WX4j9D*ZgKd?bQpGoHdx=HziJhlg*oWQVm;8
zT*IreKlwf`$`lPga)Vk)F%-Lqa!;T%U3(SnmqfL__L?nO;a_~SDj_OS9#?lP9ODKg
zl2-Ke%^M=848e+vy~NEfJncuI$v}eSJuoLlzki@Muvp=5lK;Oe;uIkOz$SZjGi)*f
zSy&oD>Q~bK^`=l2%^CxW9q5UhnS~l7+M#L<t1%`(ccx<Oo5w;11(rZ2G<a4stQ0QD
zh~D<^zo%XNP0K|yLwVVoZ-M$tR>yz9dhk*WO3g=zd%`Ni={Iea$)jgClc&Rbemy(c
z=vUyYzz8%B4)s+GWqpl93!Ya5#XWBf3VmMj3-)>AFAAPBz7+bL;$`+Z<I4s87n&3=
z#XYwgBiG{dGNa+W;IYlO4zg}1Z|HjJ3(jl60hwo?r8agBU+WW;0*U7#$yu%yAa)<M
z_4=h)ZQL!hlYnp`?Tu(nE_i1?c1Z6dDn}CWsydo)v>IqUlr=pK(AtW#y7UzF1bVi{
z>F50p*=SqNi*18*Q8OdwaGqLQdi%`dwWQ{F=bP`vVm?*{rBvriW7fY?lB0GU1A@{~
zjpy)!W}qWTXn^pe7VXD&{26?vZt8c^UCA2Mq;A>O08{QLSnZC%U1gq4k{-#w0~`zz
zXa90nG&qWXLh(Z--xN-?!;;ci%NX)c{tQT4=31ab>rA^sT=C;vk)k@e9$Y5DD;Etz
zS+d7B2(vk+lk3Q*S5i9_qeOd`8Q(n(39~)b;ApFD^$n%8T~}V$_<S-Vnh#2(^>5lD
zp>0d@ujBzpXhI{C#0XnB<t5t^XXT6cZSg(3oF2K(j*OzE6+j6*V8!GS)sHMsw1c1%
z9!$Hsukx@uL~yX<f(0^J#tk3d-4-7$%Emq=B-2*w#r@y4r8zM<J+IT*tII!w@rL6Q
zwVCPj8E|1md-zA7wrgK(ZHtlT?m?=3k4CHs5s)F}h+x!5<G&w!T@e@$+a{dfs!=la
z?(W(lK=;MDko0biy)A~`e&wD_hc=N@l9fkl+3^WvX9y&dbgu|$<d{6r6O~t62VOUp
zy$Vk+9tcd$@H~}zMZ&|U8Gt=5u+gXlFJ4<&?<xW5<Y4E_L}OpwEThwQT8z5<My&96
zMEpl(R*1RGWPtwp!7j$RVA;{EX_=Fg;9(ALvq71nM_12U@~wmJdu?V>)<jJ*@2>bo
zHy|6p*XvKmdI){GsZzqFk<RUMR{rHK+Pfs2Sr?*FKWOC;nNXwhQ$V_1G5?Oj@SxSQ
znD-Pmsu^6}rF5<|pYab`Asa4z`HIvE)nCf<X9wob#*7>)g(i__wSJ35%m?x`vm_dn
znMFhyYLKoPp7DSM{Fh4httF$Qde9lzJJ5BydrgMF&)~Qyvbm<RI}#Eb*7PSXf)oA(
zwcdGcX_=#!y8ZP8>FXt*OJCP#1K}*?$^q%=j_uOZ>dn9^OfDd_6U@j?D@f_S=Lw3n
zhgo-E7bDHlK6M)IS@X2>&CVGiA(TBe9}54~d~nSLkK58*pn330I_5!C*LjdVAAX-W
zH-MF`I1d(SrFn2SVWo()N2k}SlLzBDjHw6h;Inho)kedEcJ0~+U3h`SRd&tzc1Hi}
zbgGBiiXLe4d>J^7=1Y0cYT{U|$c>~{(`QSqX4(XlnWj!E)w!!30wEE~c8FJuh)0I_
zl8lg|cGIkG?xFE`&}NQ;*9f>a3*Fun(`P+q0{=6AlKO=7l|_G*zOv(Er{C0i=Yp^P
z>Pk6g{OUHvqz7#d-`}*I!Fcp`r}qbrehXO0585oex61KiQ_IC-jp;#$30NSzFm7G%
ze%1qCWWyKe2UJ^BH{0~$mz#sR>qf)PHcitirvI_)f2GtC<+C0%hS!Gu<o!_p<_!jV
z8ZDQd(lH@J@%6PTdOoJh^R?s5IZx*hGIl^i*Y|&mx--8TD*7*z9%5?*7n{SmF{3#J
z0}SEvr=?z#UTU3^<e_5hEm||kM<(Iw&P$SiOx2l7l~+%8`pDc5^lM#HFf8>>K`1a@
za@@fILYnE+DIBY3i!J4h$(G1Qa7(vN9W&MX2{>k2_v8x`Hck+hl<^j2Q-^Mal@T-w
zmEtp4y{^zPf|o+skh1T4q2-k7zSi$s<92%fKJ1Ycu-o}Vi%zkQvD~}IYnd7C3azpQ
zao)c5GMYa+yh+0&N^oCcvGX+#{(Wn|3GZ9ofI!ihdq1!)S4eMEHq3vPXG#@(Q<j<z
zMw4gC{XxvPR1U4*%ofdx`-tnkh>^ab_;z_-Ty#OsiuE<QD*~_OI=0lbaH@LV#5tZj
zaZlqjmeKLMLOu8(D;qISznrs=u4Be+BEQfjRq}iogxGni=TyMh#SRO*Ed6Tiww5r3
zDngb%0o>+`>EkwuJ1oDt-nLZC%m<;rxA2~1rTP%EBz!;Us%(yf*T{p1FK-u50KMNM
zIXoGwnD={q6@T+&b|y%+^|8wrBEB-?W=sCH$!MDliF4}tyAqPP-+E5W|E^+}CoA~y
zgB80bvw}B2M6oM{^*Scat=e6g6C6JLkC2~4@3h#ZcWL+Mx8QZiko`D=lqzvYW)UnY
zDi;SD{o^0vjO8Ju$%k0s9%^DzAY-LqcdF@|g7MbDEJ@SMNP%75eaNO1F(<RYWYDDP
zA$0;}EX@R|lY{0v2@)*cwm?F&CNVmp2sjZP%<^=KYp4?(h;7({>kLSne`4>NAa9DL
zE4_gg-ft;txnLUVHkrF-QkvBDo{q-dz`#4sAfl)!N$E$R4%t(0A<cB|N2vuv{_JYO
zX>PV8DL>V4k>+>pzmZbUU6v(D>06%E4%Z^F?{L>3_9B(lvMGrnNiuY)SVqW_8qe-^
zprWk*gg0X%OV34#P|QR13u;ZR-*17s7NUpVRH>Pr%xW~rtfg<VR8PudHvN9q`=x<h
z-Vb&BhP!G@^|G&6-xs6PJ2w@-0`SW(ciT5B){nxk;kk$KECRnmayQ`DEc}|5`!cAp
z__ZLH!>{-8>%H6opeEqg+T0O%wh6!1=c@5*Cw^t;4g~cee(lX|JG5ebDSqYWp2M#y
z{Hn~ov(E>utl@S<IV(>#(%#&P+QMf#QXWI6q%q_-3igK=Y^f%^sluB~uKtiHsf%rs
z@Pd>oU+0*^RoPN^?}O&P`Jm}td-MFUhcMduHK^_fGOdU-@0(gg{3mpAbNYs|`+?bi
z#xw5>N1Oq5hb@+GA?9?Tx0tfwyesAP4nmriBDQL{X`B|jX=mNiM(nlPDUKk$>sv@t
zlw{*f7F;tp=Gx-5Zp;jmeC1gAUcPc}^1XcJ6!N`%<&^TheC0U#UcPcF`Ch(qynHWT
zId}P9zH(~$UcPc3^1XcJy2<zQmGhME<tyhU-^*97yL>NSxgPSpd}X*gs{cRb>kL-D
zm#;J2<a_x#Lm}VG*BMIrUcSzN{j!*!e4U|^@8#<ZUcQ&FGu-8S`8q=_-^<q-9`e0>
zozYFcm#;HC<$L)$!%M!GuQR&K_wsc{5BXlc1`g*KDsSNMKJwLHz6Q%zy?l+4uZ!gC
zO8IJ%uNm@nhkQLCUrXfcIr&;GUmN5r$I9QAum18iSib7zYm9tdBwts`SCf3rkgq%B
z>jC*%B45wR*J}CNAYOU7{)zIHAHj*`N|dksNcmpA@;domzVffi_wtnwmha^&KT5ur
zul#8FUcU0bl<(y$KSsWnul#HBy?o{WOTL${{IBGD`O1%#@8v5$PQI6~{CN3Zz7oHX
z>^G%IXoO9FKZto1+^7R6RI_#Gb}^jUwe#99#v~(c+bkgY0|kA!Gnb7LUI%XpS}<Hl
zP&4-f7c9_y(86pe*1aCYYF0kSoX&w2^6+KfKw8o}=GC<zg*T;;c$Le$0*I#x`=N<L
zRP~*Dchh3UE|a?@<{+a<Xet+`R4E4-fd-LhX%1#ItKl8{&+~3=tFSW+f!3I>Q^RV-
z%_k8YnlF1uyEiG`nuVXX!0}Nd;wemfOUP;@g!9eKjNqdN`at`}6j%X__+mu>kj2Cm
z)PI1F$m18?b9#STxH_h@&QxE-1leTagPAo3$BL%*C}^_R=uZbPxpLpX?$G=^x@Yw<
zW0#z}@6UWaAJIm>vQX-k2FIV9T8O$*KX+^lsFjD_%8^pf4W5p-nY}ymAg`{c)bAP`
zE1Mn?^<Djr;IW|YJ+vECXBttL7##06H4=4+es{3{>HGfKhk`-vkxJA>umEX#K-5M0
z;NYR4u0J#e)K`*;y4v9QW79pNuGWtUcDQl(?)zUm)RqgnndtM0UPtu#`ZgWtb@%<>
zJJd|{M550n`dy;W)i)FU?tT9Sht?3?MD!S<|48&0{TibGc;A28q18k;5`8++ZxemG
zel^i=-}etWluPtDqDK?`d!k3{bBX@_egENy4&_2q*g^D2qSp{TQh$i(HTV7f4vi%`
zb`Zggp6EA;uGfzx`px_P-iO8z{SncZ6a5C!m+Qw6{l<O&{6lTufZj~>u|&T{^s)N3
z5ujf~zkc0J^d_Q@A^KIKkI^?1{VLk;>or7gAbK#-FB3gjzlP|S(bHeACi;D%k0AOb
zqL0w8Ci*3O|La_$*Ax9^qF*5T%lcfRUqIh~eTe8zq7Nl{714+44-vfzz5n%CqTeC9
zKhe(;-CsYJ=x5RYUymXB4@4hG^fN>ss2@Z0Gxz=1e%*Em^jkz9K=ewY574)b0=*Lb
z|8+CbYl+^U=qHKZU*Amhlj#4i*ATs$=zWNOoalY@Ylwav{r~l9qC1G*ljs#h@2Ou+
z^a}L<*SSQ$PIND#A0@h%K9}f6(f?l`Iz&&@`hDXZYOWML{`J0nf?6H!tn7ZyybpSb
zEA;ML2FC|Y#gy_bz1KL0k}F2t4tWv%e~6A5`$1D7(bwqJL@z|&?o$)}BGEB7K4{7(
z`fB}&UxA*FzTJ1?An50bjye26(-ESt)Rz<e2>NzkInmD%9b@Z*rf-S9TpvyJZ_&5=
zqKW=bqGMKn&~%vS@9HCoei(hbFOuk|iH>>wLDSbnU!qSX`q${&eW^r0MRd&U51I}V
zeUaWw^n>WzeP*JcAi7xpe-It@C;C57|9xIWKSp%S?GKvv6Mep3P4xZf+kI-HmlGXx
z`-7&vM4zia@fzrR(YO0f`~&ndqGN7<(6oo>G5T_%??K=0D<^sh(WevrZ$zK2k0$!x
z(6{@diC#o>%<T`FY($UNM-ttJzTFo|^a7$|Zhz491<@n*sYL$*J-siL=y^oP-2R|x
zC(-qKGtqZqZtpV_J(uXAME{)Vp?WW(e-5s?&x`2a5FK;-gQo37AFEdreLMPpubSwG
zh>p4aK~px-$LLS|67+2J|K4SF<3EAkEr(KIcCT*wgi-|S3x4TPaGziVAjOMW7{3Q7
zg*d;nD8&f<n&B9~Sr`LI(XknNGCQTf3}4l>g;Kn%Uq0Nya$7J8km5TlFz)wK3e55M
zn=&cIQ2pPBI~Xn#;{Yl0GJw&)hf-jcuWZ^xDg5=@hQoqzBSr#Jd}=|=g1=D;%=14q
zZKM<f^#g`Gx^o|6EFi^)8xT3bMkz4US2TT0DF)~fM{F%D2-jmgAkFx6)E9XE;%r~u
zw4T!RN17h(4i7F3V*+V9Qc$0rlm;{Y!=@BU(+6ozJ%Y!63dRM}<WWq4&nOLM{hFpE
zN&^hXy7Xp;ic7-Spz^FkdA3m+%=|w!t)nzvNHetw?Y|D=gUW+QDm44y-`#-upMX(;
zr{Bd33boQ%d3U4Dgz^|so~@J*M!~A4czPq0%5x9x7msmp2<3@085~=i*E*h8uXR=~
z&7k)_#IHR-2wzrrssr34ZCTya4wp91xJ&O&(uXbK??y-++_VKFO{vLTvhdMCrA7rw
zVrwbGMF?BU81@He<&=$``n(m7Wr^y|KJdc9e(_!48|6}p)glfS7vcD%to1E?^JLm}
z8Nt$)U;)Zs=7e=&DH9x9tKnhpI_n^e3&x!^sOt(Xi4n~Dq7)e`_C7EcV5p7LD#Kq%
z+Udlgx-k3b1UIWo`$gXAv{MYJ_sOBuwVY)Wp)dBE(B~LnM1f2lVWqnPMXuUUn>5qV
z?>8IL)A%Es+G5ts;`E)lb<N2D&A^j6?fm%3oQ5S#7V}C)UN+N_O;6_JJH6Q<>3k)`
zW%9$Kh*%4Y8Q?YQ-Eh{PsCGB$;W_7~*o`w&TO>S#(;oQWxjZupIDW7(aSMXK>3;K`
z<d3YEXWEjYOv6&>R}lS5j-T@p><J#RwnU(RGqW=6qZ^nT8FSMR7ae%SkJvp{%l|yj
zXl6gh=z>e=WGiu1s5#xv)r4q%^E|LK55gv4acD(?E}<+0y55aX+x6_9G-$FOa^d4s
zsgeyP0(XF!d|Er0b9>x}&<{(oukH_qoQXa#?%H)nV;u}Ms;miziYQ93B9Q-(u&H=P
za96uUnXUvY0uik$pd8i!YQ^T1G$p6sDfY!jR(N4`!PazHoz~^w$pJ<~Ka%AGDx?Sk
z<gMH<nj)X}FY=8nDar~z{ln$(t;rXEQ0zu@tJR2g)fer%7zkPJLYlh!#t_1nft0NB
zxs8$QQL&QFnhul+39qu+?XN1dpDW$0Jait3{JG0#rC)(nSr>+$QUKw{dXUDF>e|q3
zWl`2-VMVj@^27>j5>J?{oSHCptDDGQt5c>P6h%_?*^qPTTa$O3CzLAii2S7|DDsBB
zJah6}IVs^As;R|bh5mI)_~r1-iAO{1z_Ji}oKx9V2N>a_^QzH=KC2qTaIuitZ%5as
zOgtL?`2JR8b5@AY0h))^`+QG3^T*Y6{l26Fk!pK8mTGIdPh}WZLS^Vvk~x{pgLlN*
zR23I{I0O0LjJ_C`)A<D2e(yIObFT!$-q5dLfM~^uSp;3QwT4<_=R%sZ&zjeSla3jQ
zzSr=HZ}y%bIL<R}>-$Yg<J)HGR836p!VUa5YwynJ0?4!Tjm7i2zF|lDbz*wY&h+rY
zlC1M4huY#N>Z#1Rs0GS<0p9SpvcjcSF?~j@a`mh<rhpL|>Eb+$yHvVeG4l+m&_9LL
z<C`7lnV*)?h34nB{+wucc|yjt#2Kx~@uU`Uow-VP(x?xdPQ44Xzd|k|E`oKi`gKKd
z`r}3G%g&aalXJ16jc^h-1=!kUXD4KaT@KSB+HcR3ae6i)rLeM)Eat(BGfLeGjFzU_
z9wvu0^JqL;5+ZV4Z@kqaJ$G9#S!S>8S5bNL<eB4D6$w=uAXsVrid*6$w1dvJa1q+U
z;_ra7EgJqovv$bMmN?k_!`k<y;uc_ch_mAzy-zibt3`V4u(K_n_4vm_XWgD}jKI6n
zsFf{okut8?0W-W#Dli5vPne&sJ{COs&O-%I>5RK7aH{_9qw;*BYO@1b#n32>^U<t?
zOjEwk1d5tb42gulHP7C;BzoY_cE`zm+_5Xc4e$v8^@~X6L{3JrXqD^-Z`(m?Rw@<u
zD{#sKPuems!fcb<`%AR8fpFf-^Q0$bHtpwutaj&Uu^dtv%)1Zdc@@a*KPq!V|FR1c
zgnl`07k~~`=EfP07gd&JK3+BC@e~IXu$wfRq|-0bFS_zDjQn|daBE?AbK=Q7Tw_QR
zjCG!Maohm~bjm2)*(IXPZ(VFjT(wFXS&1)cy(uO%rQLjoPDe99ogE`lcLjA)iIxi5
zXq`l>9nwj|SH;sk*n{p6`+7B{!5Mx4_*7A630Ya=N>)-p4vXt^0=6gZ@Df_zsFb}C
zWPgn5sglOOYwW!Fsltyt#WP0Yhl(ySz9M7pJl5ul7Fh426spn#&b4no8sPed<!64w
zxsy?!Anxb-O3#wE*^Yh<?P@)IiNSrl*1|{pQtTe*+PnvkYqQ~Je(BDWwZT{VH?(v5
z27IMjJdJl@H%TY)u@&U|PBCcqCrjVmxeKxBQbwh`W<HWsXpTtI2Mb=@3u|zKEATr8
z;Ebl1T)xk1Os|_FgM$(UHJ(Ruz8DS34|<smLdFAM%>@ru6QgEB-`A)bdsuM#Vwnw_
zmOno1K^7zRX_j+I%pk5leULliiZD6uY)4za@^nJzqgcWe$+wUrJb*A2S*Sr-$FAvf
z0+D@h0e#|z$3nIJ_AFL+E0Eo$C+mBhtF>td4TevpIs9OT(7mZUO3|ySw`PV1qF104
zE9v}OGYh34%bFGUdsrSm?16KmIZ4cR_gm?M6q<8DcI?h}ta*W=sS*Z`tE^$}y7x=j
zFwWjo#^$&)Y+FCVODRuZ=%IVRFMC5x<<q?r!P;+)1}=ggt939NVD;b^0+AC|Y)mCQ
zk^enrpkVRvu#fg*?R;H`UF8=l{9sTEd<$AeO)+yAY7J_=K`LNK_9#Rw)^q7-0YuG#
z%~0zGu?0+qgBgy#O?AQm4|txb;Twtf(9%@jK^)}}rYcXrp$7U$?PxZu;832_i>h_h
ziz~;V7d<n8<^>y~o8~;u&?naxzdNUV=4PA(_sMlU8r4)X^JRHeuq7%CeOQGau|kfH
zMwHk<b|DwWQ!H_^ER0FFsNQqq^g?3|;+`imilbJ>cr=Gml<Z<|sKVT-j|Xvt%2=Lu
zI0NY#4$8bjQC5c3=aISzSX#BrLLP089CeF**zJgCK5CQW_hqe$65h>t)CYMRka{+w
zI5`?|)&t!XMXP|qwU}ARS*-5t{M0aai#35A8E)BxcqTwNqS&}GsT3#I(l>#5Edw4a
z2X?vm8CGn`ZyJ^_@8x9*6bZH*@zl%0#VEK&M0O5SFXVMgZZX^O|01JX(##YXgt|Zu
z=wEKIC`5Vw;HD`3t=kPg3@5IL`mCCtRsgH9`r!U|N(=(m%;fM)&&x-p)m~cb=faPE
zIwE5m4JC|X$~m0d!uNDyA2-F+21YTVnlVlZb~8@&r#!n;Yf$8EY7u*FEjvg-2uRz}
zLQ?eK!&Y75ju1hw0)m~euuLUft5pqKC*0Yg)Fn1DI2Bha40@an#~^1|x=&oh6mkps
zXz|3<ZYmAg?tUbL@)BZm++4iZ&LQ%Ps)6xJ({UGI*>R+*lkYCa>Ow0FajwoNo%_wB
z%pa?IsciAVqo?0el*OZuHp1S&7(IHHQ55|Hz54+D^f~+hZZcu+R0c#9N1aZHB^jim
z`G=9D9uwM2Jss^BWv#G^9@c%~SqEe*La`EkFoASMXjTP_D1M7Bwu-Q<#AxTGgl0tu
zQL%m5cSW9Z2bRp|(ld)M7k5ga#EDlgS5<Z52uM31?0*ax*%SM)ws_;jV2pErHcX7N
zOzrN2vAf4?uinM%%+Q$3ZU>Vz>I64L%G=vsjQ$;>h3~Sl1hp<htxHkcvd>{-dV{-|
zdM<T4e<c+*$Qe4*P!{P6=v-Hfss!#x7M7YmX2cHwkIF~__ATMu>Q=5~?F}noNq#P!
z_$2r!qkBIV*1NGd|2`qsO8YtNt+vAlu%sAYJ&UhCz*o_>kH0!=^Oe+JC(u`SW;pl$
z<uG^(u!QhE#Nr}6T;vT~PKv|@Um)Tt@ZvU>_Qq&dVq_0?gB6(DcGc;$FrMP~039p4
z+3lzMF+JMz$+2L=3B@RLAKmm@;v6|jbHp_c{(w15<KVaWf;0|p@Hf!+7zb%$ENc~U
zh(SD!gVX63(<-bLo5WGD2_t|o&d~E3%x}$A{ADIQH44!8i!oDZ6nu0ioyGx;usiTH
zu`fQ)R960U9MC9m?SZ8o@xtQR!gul!n>2oZ(x{}@lAZ5$>;ytl6xUr*{&Y((R1;?)
zzObF2Wg_0--1|m~v5eZUH){PVdS|fA83Hz+OW)4f%(D`%q~g5)y-&YcQeap6hsI47
zj;THV-PpOBVNtz?aaX@Z>-P<_PerzOtAkOdzT_F-jTy}|w2rZvMI`4~tmx%UW+rs8
z(Z3sZI(%JuI@Vp-)}BijEo*5VDAAB7pKP&8=_rlMpYJw9{(P4Up6=^GlRuv97X5~4
zzvx|aGPxv2aU3<ph@mlPEX6!8LEj#IRUSR)Usa)Mq2~=w_xt0B6|MWdCwjIV^FjCf
zAAw_~N$n5az-{s>$_Ox>gExBIWXE&dU1~pR97;J!7A+Ks{9^iT>%X%31i}b#Eh)lO
zR^>a0ajN6YG~3qQFq<Z?&UGYt-ots=-lg}Ro%<jlH(pF{^C62>%PbSx1`%CwFm*0n
z_T^0vT|6+3T61-3Ilgf20F8MGpKMm)>-iEA3q@HTnS9WEI4Ndi|ME_rL-9!6CK2bM
zo*(a282Youa5Z9Mk7135q3jJM){c~ODckv8+?5pD#)^%m2($_;I+pw@x=lk?#IOSv
ztvNE2SVFhb35#JP?E{MrNwyi?o$1iL2pm9IdssdJ$AJBa#3ARVT}jh@_&sa?a4GaI
zum?Gx#M=LIfz|!x1$Lpw4Ylr_+du`hGrA9tGMeAOKID%VVA<USx#l7`>(>m~$%yOE
zJMV}R2_f<6{`3uFztx{5xrFAfz2z{Yd#3{LEvEO7em0w#uiYNbW)*99zRF(7l{kb;
zM?x*ecq<|~)))neBFdjtObQ0y-D5s5{MqdWYt#4g{zo{w+pQ2%pl-=rR<~pcJIF(~
zB$EADZRf_YaS@z2j&_VJ03PGYyiUtT7g9_RqRis#v@UP$zru*AfCX=H8*qi*>$n0G
zm2&ur?41HlOR<PgVoU0&s^7AF3!z_)8HE_^ZJLDVfGCVU-MjRLKF>I~xb0op@-^y$
z3pIt}J`$2VzMi~43D{D}(8)eTlz<bGH_86F5~4iCbBr>D%^iqQf_+Eptb|L1vbEM3
zuN@2&Rr5gd{b<#AmSBhdD&r-V<OWhqe|6v;^6eyVM9IIibHr|2OCz>9r6e6I1$Mm2
z?D8D!by^X>xj$m@@bFEAcMN^!%CGtZHzqen@lt&22v16xiYU*H9u2KQ=51ZtlB`5u
zGaocl^xTSso`}@e|GMy;TEt5t#2uH#G``YCT4Cqjla<6ry3)qT$TD49h}vgQGGaj|
zA5KF1)Y#&&Zvy&Y*xb(cabay!>qJ4yrha<yzSKJY1=Kp0ZY78mqEpXeNgE}#(XUOZ
zBl{P?9y_n=`qy<{Q;SeLNvq*4j9#pTXfJA+H?VT<Dc+h#Z3TY{@vFB+MvD<Ei9Uh@
zy>N4v7NW?_QshYJ@Gr5VHMtb2omR>U6H1S`v^1XIthJdqDmQRt<08CN%eRbB&HrU5
z*QNB-j!!;$dR&Wfv@vr=CXK?_cAk;YkEAbl#*?i`_%(V%oJHTl2HXREJD{P}0!*Y?
z^7B(Wv5)K1;Lc3~vLT)Zn9zIgE!(lOkK>PDwi_#+lx=Q!gz@&<SSfB_!rEuQ-NKyQ
zqUjdN?A!wD><)`6nUT@T>z1|qH$y@~{BY=6vRjzf6GWeiy~F+<CHdv;-LvP?7Nl?^
zJpCyqbI$6Rv3b!kFFz5*fb1hin)aif&b`An*%GA4&F98;@>t@op&}BJq=TbAKzkJQ
zFX<|IlegW0fer)L{_j@YiVU5~Ka^IbxCoq%-0PZyYxEKlvg+!rGp_wK?WK*AAZbTI
z(w+o6&&eyXuNsyFj<ev!e+HT1LDWm^^>j!@*j-?kQThk$G=9t8;0u8mOe>JZvkzjU
zh8jNh6y9s<r6>=_N;*^AVPGfXwon}=?nEScgQSh91VU8O1`KXPO?L=D%29M#JB^Ux
z79#H$$cyl5P1krOy2Wmd+A37+_ObIeR%m~~6nfm~X21ObYrmbu4#KZ@*qvL1-@e}G
zOj1QcELKsJxNhnRT2C?C(DI@O4<roo;ORPtX#S9l;gT@4gIbu;KJ9nVuRXOvEhL9r
z!EbM^AG{`BY9VO>^)E*KZ?eX+2ax=`$eF`h7&h{!+>!A1T^v%_QtP2bq>VT|@akLr
zBl~9?F^dUJ9&yiF9MAc8D25idI;N;$1tOwO)j2JWUff-ZMnt`EYIl%%E<7}fTScr$
zQD(xv;-C1-z&_&wWT*_tP_gg~t0TNd-Aaxn=@NUc29Bkg)~83Om#5jA%Mk_0zIZfw
zDxjvQ-JnZuRQtFbd!miCt6pOrj~Z{UoXh3Sof}MNPmi_4<b&h12ASvI5=(T)SORJ4
zD5NRcS(c*Tk78$8Bui6}n8Vz|R5!RAJYj#*eja71UIg7#A7&80T@{^vC9RiA^kS=f
zWxo+SF9q$qXgri4Pf_Z=DN1L?Qc)(w4y=$XM=b`awu`$jl9gl9Pp2RLmogUcTOehT
zjCDC*niDSVbthM%72<F_tq(`cVP?p=*<1<QxlPA!W)P**jaG$#3}^Nm&aT*Y&*pXT
zB<aFge|?;I9ihIBN`enc8}wC(j`kY9kykLV#26IcCRl?wv}N`SXI;_DPm(U?y*D!l
zh-DCJXDeo51UR$*Qrq?GoqST^AKz9@Yh)YZbm8kHw~&V>xOO`vx0F5ws0$)*+N{DK
z8%Xk2_A3CU&eDc<;zZKf2HqC$h$Bhw(>@tvA5lJl#ey?7jk*}NOf*(M#2Ns<9-KK9
zw>!@B;(KSp!y<>7=xwQ0T_<%+KlnAa?ui$QIOVXUAhShHh=LTg131+;pr?Ztfm+&8
z#lt`649O)6zRR`8hlkoWV(ux0_cIt@v9uZOapA62d0~`m&BoX))%f`1?9*z+Ny@Io
z*XXn?qX=P@a9UP-lI}JiBk!CLHp?&|)q}J1uu_8ujHL7Z$@`<8c)#M=@3T+5FQ2&J
z`-;HCk*>2&uOe%ec(zkYXPrHdQKYC4wx3~hI-PY%Imo(i5uY*OjH}IN0U=N^lw(Yb
zHHq*ISbYmTS$IM1F-Jcw)Y3PQ5#FxySmV>|BiyX@km9*7$tNxU?jqw3H4u}?k4h0x
zGjwQneBtGA;V(^YS>cCq!bTAYIi4a$N+)ccYc!1|8qGM<%5H~G;cjL``Q`8vkB*1r
zcra@<9^q}KC8-{!61&Mi^bDjg;r<~+lUx@Pl>r21ih{vR-8^NpzWI2FW7(lr$$P>d
z5kjV1WA#gbt}$0c*r2no<?=~3d5~EW0}o^x1fd!yS}SmFMD4SFg2|xE*oC@V`i@3q
z#N~h0^*M(V&~;t<3w@22#hJ~%tO!A9z}s}{lo^32yZD_MHd^J!^n_-~l2OJCL)()N
z6Set;GWv=X|M9p%91&q7(JB-Rw{tWgjwez{UkLb;zR>jl=nGPBW5kIky@->T&@aM0
zbSNxu^yoE{o=TKb)H?#Pa(Tx)=MgD(oGGJXG|yt6py7SI)r)#&`-a(2ulErnmr_f9
zTpRezBHsv;O2s>_H@3TnO%9_|Je=V%J>Uc0zgqV7X+VFJ5eLNFd2Ba;w!~;bTQ+7r
z9nq`faYU~UIvx2*L@)8Z(t9b-is*%RpNQzi&MfyV|CbTHBIiUt5z(vsaYQfpZ_>Bf
z6TbRRyM<>(@nTQR`wuCi%b(;-oi+sEPUW2YNb~ek;EF(Y$h*rGX#I9GKjpTrlYAfG
z93V~$(7q7)55E11ps4yd;PkC6$T+5W$pZ)=Q%s5gPX<1}9?t9@hk_F5Nq@w!naspd
z>_3l{Yz$%c*LBp+ZKh~mbAbWWjd9#)X{Ecjz{jVHr^Hld^8F;=FN*!R9I+o^!E^29
z@~2|qWv8DBGLN}#42(xCyjNK{79MyK&O|R>&bRX7eDicgfJ+>Zb<|n+p@YtNB|dO3
zvP<MgzwuX|eoAp5FN$l6q(S|4@vK5xWrii?VC351l^PcT?dD*_bmkatbYu_4qFg)9
znSG=feuabMA_r!Jw-jX@HSY3Y3ivE>R@zrVYQlT)F-zd|ZM~a2Iz2Z#?T0nof&%G$
z>&Y+M%(ORs4O-2T4w?;wm!H7Vnan;urO5R}!+Wa>Fhk7xD3f_~=p9&tbhy5MgTJ0A
z6!4y6T0Gy!YqMvI9+Q+xZ*aXgbhQ8VpS)MXy92>pSrQenWyBXxQ%y>tgjWe^;R;AI
z;;AF0*oShszEvQ8i%PXJc**I`Jpt)mXdQK>L;00d4hzR9qfDW}aPXtLA~#Mf-$k6I
zPb(<M>6B(j=6Iu2LYlS3k4zqAKAf!C(uc8hX(!F97POLF8nm0mgIbAdZ`MyS4IL}^
za@~!)il1z$65d<-cCpw}l5Z)ca<$YHQ;BXqTKK8=%3Up7+@X2rIY#pVeOsGtkXxEk
zyS}W~jeXYp?!ww`N-heebklTO?<TC9#Jft;`EG`8D0+#?CXFsF)6BFz&#4`oyS2Jf
zcWuonCa?cuZ@DN^Yd*OqhE0<6hORX9t;Otg;8sq<T##Cv=4MnS?VqK&*|BrXi6Ap;
z2*9qHu(+`!%|4Zhn5DO9Zu($GYWUi1K>ve>T{AQ>h=|3U2Bxbt54-9dAPf2BeNH9n
z`qZMNc_@9Gw7}HU#35ck+C>YTd@$*?B(c=!TlmK&mZ>`XdPA4l0Wa47)86?2Nm<@`
z{_PPJ#)%n`7}l`dyULi+nuZ3^jNI(j2m=mgAd>+Nr>srW{q}T2|Fhq>hk--yjfZC9
zavo<WmvtvumLe|evX<qt7DrhwvCwdaHJob<@i^rSWsxn)!xWq248`2%_rAZk`<-zB
zleJ27)lGePzVGuq@AK#P{CS_Zd7kDG!d{xRRz@t}<KOR(*4r4Z)4!dZbVZX`l$|_k
z)Bo}(!FZjt@PRLV@J`q=>mtcXjh9I}4}bOQCf1)#Mr_hrKfUA?8>%gK^|vnPUjun-
z`P>!vOFrLwD0%7U`2V-U`TS)#pWpxBop7JJ-u=*c;M#{9e|}BlhvU!D@|~}&XM)oC
zIsR!xeo1ZB5B{%?6|vsx1A+DKdqvuC4!`z4Z}Y#_a)p0MUU`K#elBh~zif9z#BO&#
zdiCXJNA^7#Sncnwcr=nUnl8J#$+y(||2x^x)HvEwqgrIz2k%^RN28JaPj^<w)^{Gc
zJhJVjOB;VaeZ#M>+Eukk|K+A1GHH$1@{Nt5mM{E*nXTah`CR+KJL6kktS&bGiTBnh
zr)|H;ljrKo@A$>kmwolaH+p`s;$?o}?bosvk*B*+|I{r|w?N$jbqmxjP`AMEfCZw_
zsL^82GfVl3nJr`;Go8rhtd!YmmCMDl*^;`k(HNLL^Jb|^<JU@7VcGn}W{ce@*QRO4
z`QUuyBmQwe)RT>-Ig3kk<ws(A{_*%m(lS>{TJepI=0^U=Uy_7)Nm?Q|nysQG<VJHN
zPA#hWWl5b(_}h~!CFV*m-440Kiz*rMNA8wnXUPSZe8eY6HBNEm_V}!g=1hqt7aQeP
z{`UR7zdcRD`XRigsfHLyY@03LpUh-S=e4gFr<A>5xRYCb;qYwUDxWuoUyf8UpU4)>
zbhePlWj9#kHMLjX-X*<evRFuG`zz(~WBKWoatSA0Ea&|c&!4%}&q^k8x${RcdV{o<
zCh}HbP|uy`b+>BxA}irgEV~+KOnCS0eap=S#Y(}^7=%|EYw0iUU2Jw)1KDJd%b5F@
zdxi|fkZ`lpY{^x+H-yqzP%PNRoK;I}Ogi1mmej(eC}YBVm)v#1@IGsGvFL=NjJbbV
zrsAZE>k8EvW5X*pqcv3x9-IGy-rfbZz-svxWy|?>37UO=!VWCt8*-i*8*Ir9(y6O)
zmPs!Pe<(xB{ObI0oW5_EUrVQLD`*bN@sV_hGdihp(&@GmrBNx3la3cBoRX$vwmL;8
zk-M?YFP_;-|FOygR;uPxvBOvCvSl&x@u}4{Sxz{~Os$|^+Ve*x%~dTOE;N}wIwQTx
zl&SM>t88bB1vQ$aF|#E_PQHg>EYxY&?6({zTj)2JEM9iIxuR#`(ne#xbO^71FYXFk
z-RoQQ@mhG7Khmp_$cHJr7T#OV4up#`Hr#7`$yh&Q!zF0ppko!JE)2!7;WC4a8G}?Z
zlt1BjloN$YE>X@p>*f9&72q>E&h4obO=X+&vkr5J7^)V&q`P-XI1@iSD6u&zEyK90
zu(rTxG2|H+PZo2j)fkgFc`Ie*tbXRbHlt81Sa=x=5(Tq>sWXW}iV>bKG8`N(r1zAp
za@w>8tb*e|17&WLsf|bGx~!8aRvc5>x@@MrImWA#y*eBBJmch*SRc<7izUe?lPEha
zsd?lht|?P|I-4$<=}ImqH#%jyykCg2PS!@2tojo&liE(Xl60gmjfrC9vo;fae}OXP
ziiy;P!fi(?Hzompt{&q_c`60pPm-n1l)+(@P$`KW#STGzm@mW2hf!hqWP%~`hfD#n
z_S~SEcLox<;7aNoPR9$J6ND01Dji%Bc~o4hlnjE*yzTIiu!Cz!*T&-I#OQlksxi!(
zB(g)?ez0dl%rFwT32|8kCFZ~_Fc-c8w-N_`8-E*r8-E*rTl{Z>c9=aIVunLH4(T|=
zcZly0-yyz3+;CmOh1vd>=SGCg_kFhm_i?WK)RnMP8b@5OuhDPf-ulfjW+gL4+bS4E
z9tMQ9`D=hS|M4z%S#LX5K5F|<i>PDSjxh`We38D2J1beL*tiS@f~;hwjaksnSMUn^
zSvTJjGZ+TzvW0?GZnG<eIk9XsHQV6!DC4SZF<Cg-0dIUsU3EN~(pP6LS<z!!g=8@$
z6JAS7(#~4>L^^eUGPin-QyM5_))vd_2G?)sm$2~t3zqenE!Phk_dR!RWdE~1Lw|p6
z<RRDy15koBkb?VQ1@u7=EP_s$2XkR2w8C{T4X%M^XoLxHZqK=qGw@3|3Gcx%2=cDG
zpN=iwq7B}F*We($1TVnz@GLwHJK=k<4IYQh@CdlD0URhm23EsLxEp%mPUwO^f_9h#
zZEypaa4k%MD`6ruz}de$H}Weu1^*1k;cYkqufrjD1@^-}*aOeNF4zIX@C0muM`05@
z2!l|D9He0t+yl#DDRjep=zv=x1~<VBm=056GBm+uU_ia!)@@Ml1NA;o?*sKdQ11iv
zK2Yxi^*&JV1NA=eyVwUl<hy{=@IIV?ci||!35VfTH~=rgUU&|6!&9&wo`kLN7!1Kf
zun`8J1ZyA#eXs%^<9mTaeD~71o%cE1{jd-Az%#H5cEB(^0bAfv*aQ#4Ae12oX;=mK
zz;aj$-7p_I;8uviO)vwd!&H#G>wJ1Pn5=EkgnJnn@F8t-8s3K!@GcyMH{me63J2gt
z*bC3WZg>i|!;`QT9)lrx2sXk1lwb{{;68Y0C*LpZ@Y(%WqygLEN!SXH!4NzI8({!S
zum)0aAFO~r=z&Gh3G-ks%!F3B4yM61&<u?*0fM~i?x$mmb5HTTB>WOi!h3KG-hwya
zH8=<_!3*#_JPS|5PWT>dgU4YrJOVCk00#<?fz_}Q?uK5t6T0A!pdIEw8{7aUTnkg+
zN|*=@aF*|``47lOPQgFJad;b!!0T`bUV;6v5B9(_unTs;FgyWU;8EBF55gdnAqQz#
z1^2*mSPI=RALKjqTOkHF!3?PP+qw<veW2b4>V2Tz2kL#G-UsS^pxy`SeW2b4ei!?|
zblzvC!enTI%fNsS`HtW;ybmYfT{sGF!eMw74#11B7oLON@Dyx^Ct)i*2176a8{s+L
z|4)5~?-3s7eGd0HybVX-bvOjCz<$^Vd*B(^1v_9Eo`5azC~SfUVGzoYgEXvydtf;%
zg>IM+9Uytv`SfgXtF}Q5_a>MD(_t!1h9<ZS4ET_?It}l`33wNd!kcgyUWEhjBJ73d
zU^hGk+u=#r3Xj1MJOr|jEY6llc90oKyBsfDiB!B$$;*B*xn9RUQ%gN$|JdRJ8xON7
zGdSj8vXR}i2EFZt>`P2n3f^`?Z@;tbsq^+k#&u65X-*iXe$WYN*bIGtPM?Ry@A4f8
zoW`#i_Xd~)?a=oZe1`%KY=u2A9onIb@9*w`6qI2D?10xmzEeJj+sdBV+>PwpqfB;*
z>N@H0{!?@5T|GS}yHHDPMD@+l=*KO5tjH$&{HnLh?(VGZZH3)nm5Z{C(s*k(<MIMr
zEPU*}oB#Hs>4p7vjtPHmoV**Jsih&|(!T6LEfsA$yP6HW-j?Zn!d@%25d-Po(edMC
z5;i+q{oWxvTD@(@-kw9^m#uzp$8$9y%`1G9AIDtH271|nN^dHbQ&#y8+2U-bbBTU$
z*Qs<Yy*E{~d?RNP101&qHsJfoh|x8k?Agp^la9ICa@JW^p<0;Mi)D4A*Q^(hR<lcB
zfC59pl&#XTGm~Al{jwc8WmUKE2W1;4UPAY7`zA;x3SV{@U{<o?Sme`2y>0@!veC+4
z>n)r8*M{NmTxU0Q_#B9D05L@^ytWbCG`(=yMIQ>6Mh^~&NH}3Fc1x;-&8)RNq;|T;
zT;k}iWJzdDoO1tcc9vf-&JwYUA18c&pVwnrVslcmH9eF<G}r@eETMEQ$;HqI-+&dA
z)ijpPy2~r~lBn3c(O9PLU4iTGX&+thW$W!ePB(bREhINRt5vNJ;mh=Bh*ug7m#9mN
zX1Q48IFB6sVtc#z*$FnxuQ!t!E4kJVP7L`GMs4!0reAFr&L|Ks$tHBCSQ|rGo2gmG
z5S#F|J9}vdNo#M>Fq<BewY|>g1^8vEo;yl;#~kdqZ0c{lF-YPgd(ZVq8^xdpGoYnE
z`;!9wY@E7Cz0>RB<#q9*e{w}9!30yvI=1!~)8-tr)hm#9NJQiNiOU2!>Sj4fpxg0j
zDT!Msnt6*;1?#=cF}V{AWxsyogv&%EGnm)bUYjsE$Nl<y^SduS+p<l&Jj#y@;*7>P
znfkV;f6DVi?+MO>h5f{$ly%ACu7y1d?~p=kZ<PYzzi>SN;M|12xm?bUmGUL8j($!i
zgOAC}I{^?_z%P&)OcwrZY1;DW5v`Wz)EcKn`WXY9MPw(v;kj(5_guEpb2h<0-(lOy
zV!D)1<7L>klk{BgJODGM_;Cb|V*rMn$B;0o+QPoRdFJwroP(fukR{m#6QG<Vu*`dz
zyZ_j;y%%?pe@2qS6LLO-d+u$KV6kb&&a+A=bH;?VLchh5g!?7maG2Lq;@CZFXF_50
zbva5gHm-MAWYqnfiK*nhw99hCcws@}qr!BTzvLnH)@m>=63L_-v(e4;X1dHQ;Lkb|
z_rp`HKj5YhSf_wo-+;RZ_fA~@3_-kDVh6v)V6-uGIcp~e+LAdIDAHVpolUd*zvkg&
zSfI5fZ;QpEUL=X*-;?mJqn!5O7>!|cN{C@Z<gZS3k+t&(rCgpYTI|*v$Egt~72>Ic
zlknPZ*%IbcX&i=qYwv<(9BwtM4_~`dDivu;4$fp)I^`^@<UQ)R^JCqYk{d?dW{_2?
zmQ}cPrE;;qoXB&k$YSWrY&~ElIf^sWE2k7%ixc-!jLZCw4LR^vaiXP!lQEL1g56f3
zF46Mr5@$?CUC*9F+(g;4_?k@nY>X^X#f1HdEJ>Ez5~bCiS0%Z+E#qX<(nw{iVA%<~
z%}!?1(eiDH*jM^vbLDJHCb8DZdbx$$GF`c4F0B`<rmk%)>3Z>UEV&2U<ZnOsf<61z
zTR118t_(xNE|l!H)Ve6;sg`jtR~T#?EZLri+#a1hGZvfa#h>TMyyUI#WRB7~Uk>&)
z8tIh71c)``DbBZ9W$(E_9<{#0*_CxEXHG2Uorj6q#R?B7BU@m#Eb%x_HDE=(Lt4?i
zjsI95ITw^IM#)4TBvO9w+IuYUtl(O0Am?agdK&LcOq3!>5|$*uyGb-zEUlNg6`NI7
zRDAqUPRx|oqvg<xuagDuo+1IooEO4e>uJ`jhCimfd!u$DU&_&Ewti`3WC*swi|UGB
z7zvxjBZ>v99Q83u{%elG;H?a{1y_`{n5XZ_lDaxpODssSlb!>!qb#U6bZVt^ENAm}
zHtD5VYlA}4lDp`Xl9xZ`#UmEjPA;UyXG(<7JmKXfZC^Wwwz%)>-swrs3rS9K$-d0#
z<~T>L(=y$UnN#d_S@GmkD~}{=uM@xPy~a#hxt#5_s}$V#@{P>63Cbwm{#dAuv#-pa
z9g8v-MoZa3(kbU^V=!CHR|c!zhJQ5BHd4H^VodM6lRPKnpp`7;r7Yen18zQ_WmU}e
z=<{205-x!y8MEFC$=LAlquvN!grYL{NggZ+JWaZ?aE~Tf-c~is_CWj7PH;xd?^qo2
zViDw*dGy(_YKWFKs>_q0jlDx-etUZdD5Fj>n$MK-Nja>|u~>~aD$Ki}I2u+?tc#8c
zuiYz8Tj~}(w}S-*XDACcXUkb}dUI=%ql;^!9L&AH!ih8fKfFqrY0rsrSlX*pac#mI
zi^a8uwo}|$U$W#Jo400=_6glC_K(_`Y+A;pXl93X*%TABUi&M^p#1$6=7ngM5i%HE
z&6(D~Um9kVx7N46T&$Ev1^D(0`}?{3{(RvP&8A3J@0V+Tk`q6M2oDdbZV=AT6682x
zTYX-8XJNesi>60c4dP}w3mcVg>h(`QoYh73=pZR4@`iUZH0nLOiR_<q_2(`cK`b8i
zjuRTP)`^C^^4WsSdf8Mc&bq`}i|U7BF$Zy;uvQYA@llC-4MhEBNe`7{-BEvejTdb)
z+Ut5*T1Ndbe!X@Qz4V?d%Zn_|6NUAo*Qd6;!=$r=m6AN6^D-{vNi)!r>TDV0y)~Lo
zl#J^0M~WbeZC3a!^0<j|$OFTB9#;n+)d>5q$$0Yzzr#_BtA5Gc+J0#x+ex=221~PV
ziQO8L$)D5HtQq{Z9Piiiq9I><vFgqy^;Jct2YDax`o7Ga8qfPW?0gY<_q2mw7x3pQ
zO|50n|GtdWs`c^9Xh@!{0HvF;UhsdKfaA{cI}35|@ff_UNVvZi^wtkv{Lr;L>%!sQ
z`l9B?NRvl&rI51{c7~Qt@EDPL)!y+~`KHWN;<nhWH~a5b@}#ZR-}@mB|N9n=)VpNy
z0x!Ip?^ovfb9+!OuFqGFy!<GDmLrwxZ}Za(>JU#?xK~#C@=TI<DnC4~OJ?bv4t>;L
zcU6~M>6o{6pxP^7;^+BG*1us&`9!D(ip?3=sc0&nh?a`QoIbndGG(O`m7L5^&u$nQ
z*#`&UH8=wA!b$iQ82^4`q!FgTbZCXigCip^tsC*aQ<GUL%Zip?G|}(J<eOFI82Oru
z@3W?Vb7W-Y(8$OlxDL*JYh>gtcpe^y5-f!_XoM4wjEuYjJ7E)~pbKWe1UUXMWrdxv
z2~yAnGhhN7-$Xd<giY|YTj$fX!71#25ADzmtuPTz{Kt`zgRl#RAOqdd3KQYPLxjUF
zSVN!5;C4eROoS8kse`Z!Qlz&Aw+Cjz5aEWn@H%<RyRMa&S<#A1&y>lKZtuMxhyA_D
zPyGGyot-0VPwzd12T*@Oe*Pqi=h!*U^Q%ts!Apki`RLC(c&{D4k2kdSMZ}KFQ^zX@
zKk~ruKk(}b@l2XWofRJ#U?eAa@EO6^TJa+9E@hsC^4eF)S$cOoo{&@aajPJUM!r7F
zSWFzr^>NCZm#2zX5X#MWJ&6)?evrB6FALVHhZyQ31?iW94CE<@XGi%_3t3N(TXtK^
z9uz&U?_J(%-Lt*zR8~`?yd!VH%o=g07`OeOP>DNI0l&2VFCzs7^UZW#JB%@)Uxw@$
zUp1@L#tV_`sYi+TYo5yTlN#r<(?uG|kT2@|drN$GrcE7>*WNm-wJ&?oSa@V<=OCuO
zXGrwXA%4E%KdKkiytB3Ze9v6McD!$yuq*#)z*}QrTQB2qTl+V}<6fJFtq{-9xPEm;
zH^P|aA7kEH%Ny~yU*S?&zl!pDBID{RxB>nEro)wRHCzGL!586Dm<%&u0yM$zgFJ{E
zKt9uar~3C4RTHZ|zPJQu68sxz@x6>|)SZee&rkXMp6?i6Qa5leLwo_Q2Pylt5PUv|
zFoB;wt$vzO5>Lu0W%0{1p}9-^w*S?T_05JqyLZ!HKi|+`OrCwk{;yAX#g8HJrQY(9
zJS9!BiR2+=6njWHq|8!Av4_-2$|d!3FWL9{J$-k*`ip0-fBUDa{$Rm>j^91J<@bL2
z{iQ#Cb&q>P{OHw3U;g3UfB$d4@%1Hd|ILAi7yan^_r860_^7*j=?6bceK+#K<PHCj
z`>^y65A6T*|8wJk?JqQEcCG*J#{RPpFIctX+n2w)Y<S}jChlAQ{!L%}Zx7o)zN;|*
zrRBH(#ZUg`?LWEm@S|T?+cG#b>(72RyynP5!^_quzJK$MpJvYm%|XfPpa0J+;7WZi
zVZ|xqcFJW9uJqum=;{BCPQ1rxaAnNO^>(f&L~7R$ut@!Ij^WA}n#}zjxF>Hm+)aAD
z0e9jZhKpk~6TS!c<Q28_pC`RD2WsJ0Fu1qBQ@ehc@EM`}f6Vo<#s*jB4=K+X+#&Lp
z?=U2P8Kj#->B~4e6uSQ!qU;T&Un0H{s?WV##zOJu5dVPL;7YnzF>-Im-5Ux|627IO
z!Id#A<@q(&9fS|+_0NglJfXpr7YqqMj@ur(KT7<};s#d+m!$t4t{=gEX|AO{FXNWx
z8m{~{k6izf^yX6E<$C?Uh(Cq+LH(Nv-xjLhF!9<yU$gg}#6KI#|8Ke8a%rtS4{+TS
zvImz&+oT3p=4L7Xmq~vk{bPn+&*OS4<(GfomGVz$Zg6FO-u|ZHPE;-TH>sAs)vQ|D
zWr}L)GgDQI{imsxzGJGEddvvo)5fi;#XfC89PW*&mVPl;wX}J=YO!~RYH8a})nb<}
z)zYTjs-=JTsFt?r4dP(8<*LPID^yE+tW+(1VU=p>mnqfKMj6#&&zx$pWl6R4Ge@<I
z!9ms1UpK0jvEizgak)vgjHw~jGF~>TmcF<}we+K{s%6ZzQ)g+riMJbWhw7mPhTEyS
z6WyiywfTnIt$Kj?J*tP%D^$OPUa2}o{8g$Kp;M}NlV(P>iGMDLZ$#XZ>TA%B>Zh-a
zxPz*P&>K~sA}?2U-^<KDs$=LO)pLonIf#Sa^Eto1$8is+e!eH-9#s7%`j~3>>k;N0
zKRza6ysGYPaNDuF*lnnpda2%q&Ztg*fqJPHw-nM_RljhP;cip?8u|s*2X8Ul{i+{F
zA5cAjZq>R-yTw$WxsI_;8++}D+Z58hs*RPjk?LdjQa07o@OM<VqlZ*axX*C6sDAH{
z4R@#N@8Q2&wTa%ZdUf1z531gW|54Qs;(uKAOXxGIyH+vZGnS;xQ_xdXcO(pVn(7Sx
zG1c$k->!NEx<~cq)y#{ko6s56&!J1Irzhzfst=~<52}aJZHz-HgSfGf-mZEV?oQQ@
zy-FQbAI3eT`ZfHIsXl>wT=kVdqQ0t)%NyLYsyE}`%(dh@6?cm2L-@C<j^VbcZaT!c
zQ{9W(qq+zGRjM<%Db-KnKcspK?q=2R;lE$C`H$2^buap)>Kk4&+|#Q2&{HS+<$M?2
zrMmer_E+77E~(y!9t`56hgEO+@AMzl`_TtgzxBG|9#-A?PvomQ_lDt~RlOZ;@+=Ws
zHUGqLXQ-ZoZdH98ol*V75&E`j^JkPtwTrt^^)BK(tNN|Cm=jc&{s---`g#11tM0-7
zlxl-{^|b0oN&k%MX8g~F{7tT<%&oXHR6jvF?W#L*J5*0OiVaoILp!Q_(5~ts+)b)W
z`0rJ{7yW|jSI`GlAI3eT`VIU~sy>T*O0^q_xTjT@(QQ1dq|6<-G1a9@BJNz(^U#}A
zPoIQ;lOJE)_K;qwddH%OyGr$&-4QpZdJk?%b?%Oc+oAJq*PRi!Q+4^P5w}P6PTXGA
z4-#kUm43dv;}Lh7>KUsduBrMh{JT|mB}qs1HgvD*G}=-9UW#Xm>TdLQ)pw(Js!pK~
zt9~*aao<q=G}>T|B6fRpW5k`H`c-tR>W&Aot?CWvm}+t7hIFUuZrm=_YrYwASEycv
zyHfRK4@X>CuSmWQw%n@v0D7D1<=AXkwLJH>t3HCeQ}w}1Sexmb+=)9y^-A2Sst0kW
zsosifs(u!ChU!DOt*TGpwyB=LTpLquqUWmaK)0)2f$mW4pk-|;^*VTf=Yr0e({QJ%
zUWqH$5@#;1sd~yQ%nz#j5)oJ8Nt_(+D%CrF$n#qDL}_=`GT*zZWscvZ`WWtzYMIM7
ztCsnDi|SVNR@L3;ZK`E%9#$>$v8;)uJTfQ6RLlG^SGCMB?W$$|=uj<lMyG0-54u##
zSU(1mri}07s+$<2CsfOrmTQSK4YyhKF~<88)x(VuceCoPxLZ^o!j)^ecPH*P)w$0{
z++o#?4@6vvCvlGA9#;J;;=G~y2z~yf>eINVR5#OC<y!7F&}URTS4G^js#i>oxDwAR
zKkgLO5@)LF^wkkp-V-E_jG+$IGHwoPKfimC;T}@``a;8%F(C0L(*IAY-h{tgi+{(H
z5qG)j{oSmcR5$Z(vQqU8=vAs$5r4nxU*Ug1wTqT9CTX6*J*xVB(mbI$MVynWZ$(Qy
ziQhw-TXifP`>(7OLwY!*x2vAEkLPU2e^*HF4(Vq@dQV924e1v`dVfeC2<d|%eJG?4
zhx8jEeI%rhhV-$JJ|5C1Li%J#p9<;IA$=yK&xW+2V^C~3LA8UeCWic*Lb^GmWqy&i
zSn(=-O!aPbhw2QvGvwc;dJz9^)!WfMsyCx$K9V%|qIU)QM-lf~)d$ggRUbjiT2tbm
zLZ47=9OAjdoFe{BXjw;!o`IINqv*NlcGW#-Sv!jVN_0kb4qa01pa)gE=q;+ZqGkOg
z_Z~+ZI=96Bk+G?|6Wyv>%GRm67ylvEtI)D8k#r8BWi2AQ{WYHB!FWe^sLr6fRJ-UN
z)tk}FRc}YHP;Ih4k$Fnel=j-C`ZRHNtCse9HsrrYwY1mXkpBy+k8$r&)o0K$Pf7Z*
zA5&)4o#+{=SEA*4EOB<?x~gAUgdJ3$V$CxgX#6FfXNNZ;uB?qj@BXKVE6;M#r*RLd
zo_i;2Hq{RC&#K;po}g=_t>`AzyU?-@kaRZTu2fwhos8=1zRJ2zb<<CH7O0+v-l{r=
zmUWn<(}O;)dJ|gKE8>6l2<tu76Mshfs;8j|u7Bzls9T_Jfw~3i7N}dGZh^W5>K3S5
z;M1{y>u1|wm<ZuNK)Y($w<7-rEdSm<-pAV{HD18K(ogaf<ikHPd;5K+o*fwxg0S!&
z9f_AxL<gU+pS+hyTEYk)ary7z;>(tNt!p9rVjqdyeS44m)BA7q@i+fgH_m(i=gxQu
zNczir=8qTj5kJ|hA$GWfy~JhC<ovcDv4MPC`O5?sJ_8@`yiQ#I<Dt($d49tpxY9PQ
zumE}{`0j<$sQwR1(Gn+5KKq}AOBOE|#w+Q9rHlH6@xm7O+Kf5x*uY1EWuKie-e<|O
zZbKOFvwT_KGGV;1-eq?!6UGa>Ye}ymjQ3f(V1Ab{UYPt>io$qd;^*)F8#i<k(~fLi
ztbghj7}o;Hgq(=7;=%ddaU-dxp6&fuarMjz`-Zc!wd{f)|NQUAN>=yOf4sQf`QVQi
z)sXtP&*AX!$N0$k;p*Api^R9Be3t(qPkv(JA~7!<Tsv8O;dmDd_0F4eb|5%k{ITMP
z&L3Ya{&?Z?Z2F`=Jhuk3qfR*gb}9Q?%l-3Fzg-HSoxAwOiKurz`Lk1`PoyNJyd2r|
zj<J6t>HQ{&e3E_keEIrk^*+5ihRgLy)_2S=Y=pBJSNm&k?=a7};l{VVBd=1`kNloQ
z_2MGpH;F4r`DeD`=Y3}yn_W=X+R6X1G5qVGj=^sMj34Wh^W_!5Sbj9({>!<MV*CG$
zxR-Jr<KM#M{n|JdapfG$by!u-hsYXO&V|TF-f>sG8*yb#*~)<tSv<<S_^(Gs<aYut
Zu+$`UoX;Tt4mXbXr|u>1<Kq?L{{d<Hk+A>(

delta 61918
zcma&O4O~=3_c%Ux@7}#Epsud6ps2{ouAmW$+GD0J!m_gXf-gW)CV3wud!EW7Gb>wg
zxvUE+;HV2mNv5Dwrjk-V86Y5nifF!vZ*59iw)lbw^721(?{3)l`+PsYe|==<&YU@O
z=FFKhXU?3Ny`Q^PRI+_Sr3@-fXHckIhThKY<82zsc&Lt1Na=R0i=XlAC~t}z=;m%a
zLLt1yze`0Uq@?Xn)P+lsGq2OUU4lyK`8rht)ao1Dq4xV2+0GF7Ut}sf<k5C1XI>)v
zd>8%Anw~zhxgn=0de8J8`kNy?!?q3kOzrn4HDQ<SD%9A}aK%J`@ZxNwH1+gjW^)5h
z(F8bbPHDD-F3s$w%utQ~#)v-N=Bm6;VqY-7qkm!A4w0la_nB})U_TT>r|I^MR&@Xo
z?j<d@!8F2|K`*HN+);mb`>cc>l{<9D-902lkr1K^q9JX>L#ZKD6rMx{nL=V-DU|?c
z7%3{{r6^P;N2M8Z6w128w*;wb0WE83H;-l+dW?Zl`2zyUnp>roEPCq3(7qDHhg0F9
zlD?>v{kJ4ka$m<MlfNn!8fDpEOW8klYQJBQ+W$U!dK3cG>XF-_RoqwNB@G;{)?jzZ
zVAEK&dKAg+rA5SJQK*A{anh3fr+N&e1^mT6>R?y8HUQd@sQo39r`x$b0@{&0jd2*Z
zN2WYDU8!VS`aKQF2ZrKG$vdVhGMH7T)PC~?-UjZnPFD$e<_20#BTD$+zGX>wnr=jJ
zib4l`)r}X~)O^LoCi56pmNHs*kK5phD1*7!6LFSgD%X=??Z%ZotK&mGSi~**P%g4_
z$uW_gz(N{-MMnnb{ge`b#>Z-g?ouLzY|uP5(`U`w!x{4zG*fCW)s>p(OH@FPk~UXh
zKWPBvk0YhQlIarso-|H!Jrp-cExmaeOoF7)AM)NWO^}VE1}6?8c;E7?7$E+pdWpYi
z2rgiUndm^C;%+@hb5gm44w5q^=?%P*cOb=l?n6CQFoQ90)@Iblz^!XWTpHWgk+WB#
zWI`B6$lhSCALGgERjt59M!&|PTdp)~txS-$AUwZnjcrvs=Oy>l@bvC<%Ap8(dDXoJ
zUc);Qm;XDqtH0i%XyH_MC=(InkJbJqNPmur6aaE!M$PTw<Z?uiHHD|u0&ZJWE3b#j
z%M~c>9zk;5JD^L*QRK{+(ps>9&suM{B?0ev<^vV{DjDVjM@-8qF|CJm$SMIIwTunQ
z;1J_$TS1^r0jE@uP%=rGju^$tL1juN2KuHLVIRcYCj=A#0c&h_FQx^?ID}cIlv`6%
z{GvisH%YCU6o*bR7++YZ%VceL0Ac2xcYfSzE_O$Jbm=FPsnX_^ln5E{wz{wbL61p?
z-vVCwn6;Uxp9zIXtiPwA7{vpvZhUE*mTLX^W|>%pdDEeb8Ay=f<4<~=4gR~dZ6!re
zLD`@bMRZ7tR(H<^GuK?q8r|7Lwzc66yd$S@wS5-zYp#LwXmvMhjff0_J)QlPa`HH2
zfPE<Q3nw@AvKe|gkohG|U~|PX`!MFZkXGy+XZLodQOq#=09QK1&F;%w6=3|9j|UDp
z(-nHVg1Jftt3qWT!Zf*tvcMp4asbmr2qHsWWXm&!Gi+X!BPWF3G@~(MT?A#A4b)dG
zg6cVnAOT63-G{kIQr8Cnfh3ia^Gsd2IGWc@K^gLs;#lt7FOGJ=az{)~f+HvKMFGZd
zZ%{8x(q0kf=39=Km=_&6CciilDE0YXpnyFh&`tnS#5r=V&v)n=hdovPRWB070w|v=
zO7`9{y)ZX-_rf&Jg#no(bVk+-QBw>MApeXW=-oTVk&`-$lgTB5&>7ZO5vlJ5W_F6`
z7=Ue=2^=z-OVTB{V=&?h+y{`+<@(5jF=Is{9KpHVsPvGw8hND*xm_kxy3b`^EKMRD
znn4H38B@J8OaC@hFgQ?RatY7TOppk86LJ-i4nGti<c=~2F_O3pu`J*nU||IOTLfi@
z(Ks7U0RpExa?mm%ccc>!<mQAq6gf!9^%rybcO9mf5M7#{0d=5=hoZjBFlU8#p~BQO
zJq0DpW1+;8@pU$^0vdQ>olg8pdJhPE;e_+6X65cQ_@3<0r6vVg9Xhl$DC4gVz7HLo
zB-W~l29E!OXbn?-vzWE>eMe%VkxV9%&244-y0gw{HRzCy-pwLM$n~U>Om2SRfCeYe
zcCLipkH<_D<-(zqOIv|}P{MKzUk{3^@dFnDHH3h%q$G}%g!m;viAm5^0jnG_jnDp7
zX?dc=Rf&g^kYEs<#O1(du^FPxTE>vPy?^B~A3~2tlf0JRypNzkGKUgFUUb#1fxM7F
z)lyJHGTFzrBok4B`i}{aVs1aApm~E+(P-2oI}jD+&=t<K9S8OD<!HImqs6J^f&#eo
zK#E&Anl=}EAVzL)*E$uHUhUB7W)9u=SA!fh=nwMXhvSKsJZ~!qFTJ3p_^kGyjQly1
zrn1Z?>h0l!4v49wVU#mfGxXkn#Jqr^E1W6b_ibnD=8&(QDgBUqXDaC(kw-gqz|p}(
z{x1viPw6j>c1izDC{y^1Ee-4Mf7BbfshTN7Ym-&fDXa=WwxiJ3qKrqluOh?*OCu$h
znqi)lq?1MQ`eJU?1X@^^47sqx0oxRb3&`J=k2L&*Kn)+L7UplXvot3$9Oh~t(h_n@
zNeml5E+ULtlM3I}GRWcez?k{_b^bzbmw~%m>qhnWKcT6gS1oHWnvTsr8h0e20x86G
z!{~`s8g#~H25H=%&aIbAl{TPQQ2w>Q9kK;m*M;w^G;7`6=wi8~Br`Ot70GLj84??3
zU?i8x>Z`jx3`Us(4eVyEEtsEQW#re`d|;C4#+i$wB>7cw@O@vmB;riO^eEH*D1YNd
zqa>PnbxrD;)JbpqH_bjj@2u>q=Cbi(+?j;NR~k~$e(S`{-ZiNC8d-zrFIn^;2#xQG
z=ki)*V10U2cfJBMF#&Y9pV!zMW^Hw6eR_WLGljfat$EnVOZh5gn+m=0a}j?gV|GRy
ze`N~5m`H&D(E30rmrGnI(12G@Q~LWcOBS42Fn!_vh5iW}6C^L)j~)SJmZU3X)tw1^
zuoV<)zqh+cQ=x4Sky`U>=OGLA`;9UYBO{+`Id_f8dgJGMXOnX$5ZIGt;$RIu=^N`A
zl);~}!9tJunuqw%fG{nH3bq(pN^I&v7X5uJ(;`&|L69`J?yj1G{grCD@U`^!^;7U{
z<<LpDVaCa$ZktES-5NHf1nKS#1*W5cW^EJ<L=z0eJYc+rPt!X>Vm>TMA5^IlY6RZG
zJCvhYXxCh9_#K~D4jU=bH!gzAQ#v5&H>W^>I8k*rfxzag`1yf>V}673QNP(a#?4bz
z2F<g@mwm$*gs(Q7%jUQ?cTJw!&kYsK%&+}nP65syIDD|~d2xF~Ur_sf;TE)ZN}cV1
z(D^2OY+wKjX|Q<C;D-Z8umV2AW$Zg>ocl8q3T9dXNz-Ed;vj7>6sf-`KL2;_*dP}y
zlyhrrE@}6jm4Avf{Pm#01RJewK8+g&4H46|r*O-l5dpwLb5Z0;8*BiurTL-vEY9)>
z@yXc2rl#yQgvd|5FsJFIjRU>#Ot0XP6=5*-q@Pz=vo@cyfr7&sw-lnHyQL7;=a|Hq
z_%ko9hoEk1`T+aK;zlnYYA(LxHPIAT|H{!N)k}}a&L<p0-nKsg!Md-?=r27{NqVq#
zzx80|p{%Lvre~&rweCnvO|TlcRvW@?t5B<*F7iZ}z21*=)Oy-7B+#_%oYMOxRBDk?
z)m7>pT53{*Z7t-lJ@ykG7Ke_0R>nvWxAt2%`imKe-s6V2f$w6(EmPCn&1!mLp4#6H
zsYkluV%0Fy>bfqx)=gsHHtb2OA(SuHb;XxnC`L!Nl(s!bF*5a68I*cYBvo)ky(^AV
zm%Ino;R!_PSC^TK-6-y}m6W-72E}DtC;?0MuqX5v$B<nzzeo7qc(LsbfLu%2a}7O*
z%ifOtv>Y>_aDYilCg71HCPL@CI(B^-nf&6!Cn~@-`5%l%<5j-{s7KZpW^FX$-fr#7
zM3tm-eFFNt!tco(mwC|YNc3BbGrYt4Bqk;W-Zg8p5D5HB_^kIoOu8}Wd9e3FDn=_A
z`FCe{&1Odk8hyG9Th8{pZLq)E)}gdY-vQ0*w><s<*vInZ_UzMbG6u&ELXaDx8+EvR
zMeM@zq}Zr(qBms?ntCHB&3V;vN01^VP<M}LCQ*52ZZvD_5tq{Hj#Vmj$hMI!G1*jF
z3CxS;eVL%N3c|bMKzm$ZsVP}p>IJtW?BU2tGdJXdEY`5c%6-@drdcNXw6-9AeXTjj
zh)UgK!-%%Tswnj1R<epHS;N;G+z)M47nUIP_Csh=p_tqJC4n((j4&*l*A>||uv2X>
zhkJ()Q*Uoa>cZQ|rEo=kOSJ8Z*w!-K;p0cG#zO{cO$#TvrVY$~Vd)@Z2+AT+7bU+-
zW<98fw6xl$#bn`e!IEEj644Kf-rinaU$OK|#?hi9v#-u;io2X}@s;yS&c5FGW<#o*
zI{4d;%4GGJvmJ-l1zA@cxQDIi2s6b{#v+QOUp1+=Gw`7xA8)HRlC+MbSE(`?T+`a4
zYJ$#to_HT$Xr;^nC(zJrqpfuTx4KNBbgzCgkH@RLV84<$(X2gzg4UL-=a#oB!roAg
z2IhPGYfD$c;po*vpD8p4q(5oMSeh}NzdM#-fx*Zaisr$hWvZA-s+Oz|S_=c{Y0M+T
zN<i$(zw34l=Mh^bd)by3j^kPCaF(5p@3QBud{Vlim;%wc7i-`?DwELKb)Yk6qCvHE
zaIJ)+`$}j{`jb#*mu|M@R)%`i!wz+j^ois%dQ`*{vsU_~Bz?+lT03(A_(*=!aj9|%
z-eN$9wy17Fe`U8aH^}yHAqdplw@^7pGTC2jo1&S>P}MC&h>Ok6JMQX1g^qL}ErN8x
z{%Y&PgF20Eu7*<LkYINc0q$Qm^zH2@is~DVW;E0vJ5zoB$mNPxt}ba>dinK>Z=O$8
zl%%UQ-*)V`lD??@A9lc6)e)B570EqpMnqDd6UM3;-SFDZLK=pu8Qt^RNYXG=&8Xcg
zlf|`dJvJCByv}n`m)X4Y1p0JC(H741;Gj2*QwQO+-w<;#jL~`+qxW0A%-V>K%73*c
zC_ho5sh?m~G*bD%n8^b_!0kSupdNN8J*%H|4bgo1Km!8;2)X5l-LTCI9fbLH2L`0x
zwkdq|OZb8ehJ;(Qls&BHEM=ZVctI@;;3K)8iln9o0SK&*nTW_Cm(r!+m@5h#-xb!C
zb;q{ZLfD!Uj#qS1p>YQhllk_aIpL*S4x-Z=HdO%^o}}ck<I;@WHrP4=0WO9Yjv^fa
zcCWWDX?^raw>08>L}b*#D2-7TegCB;FQ0jN`l9`d;`lAb029nNvo^h>E6z!A6=tvW
z+>5l|e$<hsS2BIZIs8Hv5t_+_OY9$YMaX@};n(=ms<P5Y?@{LrT=xZ-g6mN3@q(Aq
zj?+75f@kY%-5Og-W<V?94P7)7Wy)@CS!WEDoz(G$Qd=z|!*Msepx%^bw5Q7-9xiW9
z*j;`j!M;I$e?6q_nezKzmvLKQhYtN}O$aEXVK~IJDDzu^z3T1B)TA<>x3@RdUu-y^
zakc33nX~85TyDJD@XLu?^>>c_c@$A4R<+-^9coQ=$3&}o%&(8tK@T6h<ft;4qq|#!
z@vdRPCe>vSYj^iaARC%`n8dSf+y@sz@B%rd93rO<ueBPKFL_Yh+K1D*Uu<4nwloIE
z4?*j*`au3<#HBX}=Nq^i$<Gqm6!uU->R_qR($sY+S~Q;Q`_&_V?ch4vgLwnYw#TrD
zdbiI66Ywz|kZuBQgJr%7_Ii=<*#Q>(8@z!#UyL4T(KvPR!^dFSBHIVBj%L=+X<v{Q
z&1JDKD2Mo>C7;-aLhkxEW)pcF;4xvBxi}MX|7@3(v9Qh#YM0X5^mfRj%tiGSUF1%+
zX9F|a+c$9RqfrDa?}0N-?h@|F6ObDtvcKBiX@8*YB53S4v^@lky<a=bI%$Ww$Q{kj
zD78IDwPxS=1jy=u1yiyFmZK0;m!ZUJzg^t1dQsO*pIyofALJ@qz8XsY`08;fJDJL4
z|Af`Xo?F}_c60e+;8;6jGL&9;4mL*I{9@GpQ$u=P*<l0s$wO}<UCH2DgC3=`-Uai)
z4d<Nz3y*r#j>lXy1G7|M_huFtEN$mD*`^XQ2`5P7gg`>v@|S?PbgrRTnANtygo~Mz
zS1-b!s!(ZG7ux7y>Y7Ohz`ADn1ZA?Jmhsei8}~->03r+AstW@O!Y}ioOtFr`#Y!Nl
zBN=uPnJ5>GSK`;<+!zH{Ass+e#-A|xi(vBq2rFR_Kvj2Gvp%h&Vf0C9T4bo@SKUTf
zaW}B43uM*Qh90s}hE1lbi)2D~;C2JJ8s+Zi45SM8IJpmL=teEQ3sg4c=1Gu*^1tfD
z%E`~dN)D(Ffs!~I&KNH9lDxSmOVas5!iCj_5v3x3>=yP<81oL-a?xN@smS7=Jen;2
zdEs60V>wxyq#@l}PQV({|0iJcC>J27Y(uRJ9>pxRRnDT6rh~II{P_iP&?3r=fqxBn
z<D!yu`%hopX<u-=j8IILf2B=}=Ghd{r5R@h9dH4i&h|Y{>@Oo_-*DlgOA_5B_S;X+
zx5smqhkaAP!~&y<s<{T%a{S4k%>n7{v?ijRY}`td51<lL)}GAM*PJHP>urzI^svo}
z35lTUj=1B??i4K66{UCLh0%gN-{Sl#4OAse`8>;73#C%Aw7R2G{C0DF<2F_zKq#Kd
zkqS9}B<Cux<fY?G4!;~XvC)<nM%0`qnV=hE*a^Gr-X4EAxu474`R~fWey{yctDp?J
z4g&1sAJe&7*8S;`BBCUY6{|P|J1;GCMcQuvguO*@TTNNH4w4{ZV^5RcN{a-yQ6%hj
zTTUId9tMxCyL_)^>pZfx@<Shszp1N<!3n<0%?`hckLt?IBdZ^;67=i;8g)0<sM{rN
z*Ga=LF)z^Yd)Q#_*Vb6`A5+%?`(^fF`+_T_t?@*ar5)UDu>X;KMeI3W`*dGiQfHz6
zLd&*YZb%O(|3A3%puLHxO6g;@M*7(9+5Xk-Z~q6R$*EQCx7$nF7pxcD8p!QI02sc)
z>}viQgO>oNN3{GFr5CqlFn@n5mc1NKkE%uXM{JMMHV6gV27p~^^8&??QPl3vR=zgT
z7V7p`mloOOJ))48+1JRre8c;*rEMz8o?qNu8h;+~SvN13uuTu^y>lu*A~P{ByfGZh
zR4BCU78+;U1oQgUGO*K~TWi?5o+De=ooB)rVw^tEpz$^!6?WFAFB-UaZpz@$q2EoZ
z%c4h$rf}}PRtf)4oGz^>*>pyVSDx!Rotk@UA`eE9soN2wdw=yHb3k>saz!g0SXd@S
zsY<4WE>m^(bg9NMUF+)BrB{kZHl-KMYrzQvduA6g0rkE6XrCI9oaAG92C7!%*jnc=
zvA>NKvZI<K$SuhFV5IJz37ml7Hsj6}qZ{$W7=fKhOo)VwEks@LogAV%PprkFss)kj
z4cwy(5^NiYifl@o0Zp`RWkrS`{be8P&K|T)v~|U8s>)^UpEY;mE$<?ckml<mcawi3
z5R^VmzqaZ`)#t2zNLzQNNvheR9wkG>+TR!<iE{P>b_tpz#tM)Gpt0_@>LL)~_S%2U
znqz3a0dF3NxQ+|%rIyX0lte;QF!D-S<Yhw0e%rYJN=WiWk&xzV0wLjPa4u;|hRx1O
z1k~g=cNcBm%9OHTrWx|8GNr5IFIH*t<RHIpD6iH<Af+cH`pycn3SNWxWXnQ$<`*Xt
zIcgtfCm<}FK&ky7gX89+lVJOu3lBviWsQf+R=w?iR&&PK7#C2VaO{<%vh%YW=AA&^
zW;o9Z%2MSMGj;dLv<TamAXr&hU*N}@aRZ0{QDP~A9jCp`&_xFwrySRN?%=7~F{Zhd
zc;y7xaHQ4ZcWZibrK-(PpGo@FRsyv%U*8HF&}npu5i!YPNzE^%>{i4jwMo_6;V8y0
zM#oX^QX902t@27L%3Lf5uc#&?O&`h|sNAZ$Aaab8E4M$?_VjM{HX7&g{zi~TMJiaB
zFHpuSt{GAqFv=$JB@=)+0>w?O(-XLr*l6|dV(-zhtc^?>_AUJG=s;G;cmFruG5TMD
zut%^JlRaVc1b3K@#9x>)2F%w8F!MX-We^tdM#u8Rf8*dWfkDd)m#w;#rUxToxk6<w
zu9M~d4(aQT{}jRBIX7X_NiLON1?Sy*oHj;@=LJt@1@>Au<4wWiBozbjv0#HT7HHuE
zK3BmnaPBilNMjiGe>Q;K3Y>JmW5u(d&0=j5povYx*Pjh!Ex;>F?P{zDc`g#t=HlcJ
z$l=wA@ZNbyY(|?<R{TDcRjIc><#dC&3ufVX6_nH3;`a{Oj@c?X*iaRQxQ%=EJh9eu
z^$uOg2R<iL6qg33<eVLZS@6LY8bVxhNE#B+Yv0C~L#ENXy(!pt?2sXF7ETA;e7%<t
zPzVCK#mn%#u|Y5M6mbcyzbjU@EZtf4<0fiGnxUXVy<JLCdTuS)?8R256V5@&GTl4k
z!f2<C&^ubbd7{cBoC#W@9$A8XP70?`x|U>oacsaSq0g3Ah&(pMlj#AZOTgnbUg!dN
zzC?%H4>(|4fTZ6Kc;>hS$()0D*SJ??bN2RAfVXV6(hGk)UWP}7DkRT-jh_z<GF|Uy
z|9xanN{;-sr|H>9<S*5+JhktYGMB;?T_{Ll4rCA=s7F(P-t3~%=0J)+4lZ3;yCf}w
zd7X2I&;dRl$<xkkax6z~_B$h=l5Mf4kk2|>!}ic|bjzG=*n9jK$#sMy#}9K)MCZ!l
zcsR587{56_fNpuqhPR9#Zc1!iX}|q<WKJ>@_pZEK2K&^+koQgkxv~cT6SI$!=|Ma`
z#8K`Wh2?q*7{(ws@GSW$p22Jj%l%p`4YHESY%Xy>qRIlsdmMj8>E6O(RUkTVOAogm
zGiyE2kDJIan82OCBB@I$6RdXu&EDxjR{Mt~oqy+?=olxSG2#$UMY5}+L?n+2mA4`+
zt?uk!xNlk!IZxMBd{|=9@OOW9d98`Bn(X)+j*5HzjE186`eVY5-*h=u5tJ32xgVTo
zDPv$N1HCxwcmIpi&Ba-Wd(;f;in>sSnvQVH%W`uu?8;>jfg#g?n{z4{I<SlXXOP8e
zVDy}Kn^Y;U?y${-$+>PO_&LlwqS56|<RGBpof3<Y&;5PHlzQP{pyF-e+rDDL;JA!m
z_@%IANQ`aZ1$3{~^Y#d)lhSXj7-%~4asbc{8jhL`vb{R?Ub*O9B3>oYzm)1`1KEa6
znwNREI||AK5}uUgr|Drp6w4Ra^L=iccNozbfsDjuq}kR7Lnnx2B)&$z?>+IE;)H*>
zo?mte+$9lPB4knb7cLo{a3<kZAYek>*L7quCg&)=Q7R!u#PB_w?WZ<N#4l|r{%oRA
z(unY#i6bS6A7jOHz9!4T{pmqg@aJVV%S14CH@DW6wtUTHxYETxz>Zcb!dU9L4X!l%
zEyO}N^J^;rkF+R*#7wBRfKj8lb->Zsv$t1H$n2V=cU&*OcDo$rebV)5*XqgxNygRN
zWn<xY+SR(UF!Funjq)h+ePvepT=L!Y2G~q%Qpu#$)Wd0z;Mar`x*(!{_T5y0l7Oh2
zcHi(Dr)Gq|T{qKkqs|5-n2U~njTQg!HYIAQD3K20Ry6X{qX;b!dC_ueoy{t&R1ejK
zyV1f*Xuc&oOTB$JdZtdvpaGzrGSx-oOSPG3bLLyprywgggOS)^%>nm*5!cV1_(K^c
z`3E7|BgjJ5JbEYiId|3}^^V(7=x`YgNkE-VvK=k`;8#w*H+)^jB-fQI<sp?kz>vH-
z>y>i9O4xb<BuP11o?R!Fe3OM+{_z}*Li9Lj(l|*=7=C5aJjvb{@cv03OZJY(<DTC-
ztR;x4c@VgFd`eK^crIKn`5N31T2^HM;@M^x{^xxqezURL<PoY!m<Sn>H|OqBGT--v
zPAEij#&Lak5!Ow9h84<W7xBB3{oHecZNlfRCj8mtAttd}6Bv~hB-F>ICyO258e~bx
zP(d2b@S9)-e=E*XpOKIumhOBYmLx$*&KpW5Rq8-{RoozEJY5{&W-gMtxgeQ)P8`=9
zel4%lyVB7`oegM*BaiDM6{e!=E@1tiB5(}=hrCAbl2R8V{tny=%l|IIGFQNUNuqZ}
zNb+Jt*y5`q;-yzzcx!%h5^>q#w|5D>t6Gw`K!i<hvWflIG`WD8TOu%j0VrM!i0Ql+
zMPTh^C*Ll)VD)w<!DopV4G`0LFFOgoAi@@1aKZA|odll&f)fC*^gDqQCTuA_=cM?Y
z3%KTrlj2iAaXcWFe&^&w@=qeH<|h{{^RtuS6F~3+K+JqM!%6UIC&7&_Sp7vO!F53J
zJiyC*XPW7xxWP$rgA15H=cKq6D4qj|W#742e8Nfa2^Vb587INjK=4dJEc?#I;(8~+
z^)6VZ(MfP65FBL!p`b3hC_d(-xYh-%Kk20SN1)gMGQnPS5nSUWxW)y`*E<RR0SJx&
zyzFD=&=prX39fR%*3>!)Hhm8ihdqATiLCN3fEs7R6;M76PQ|7aWy}L*D6Hx8Md+hn
z%-z?U8?wsT$d1GNiUhb2gP0@Rw(ombml{vqw|g+v{r7>suz`X1#J-9B(UiN-(b%u?
zWVry)@`h6uioW>z`+1gzzoy*HA4GDJc7bblq8{p;IuQtnvN!hM=UOU=%~&vhjm`B<
z86Y;tjhKYQ+*7S2O10SJ8*V+-WXM16gfh9!4DUTwq4X|5?P}lf+*4=gry0^3TnGVj
ziwj+vVJZ)>?*me|*FG?7-4I`8-er++>)ntG-mIO0*5tWrtOAWM5|O-8AR?L&;VUk4
zGoB*C1;(zxABPS16zP7)H=M63z^B6eSs|nLE&MoatSPlZ=TqZIO*Ob$0dsGKEA66#
zFlMd6Q4tdJf0g8f{=G!pUJkt>(rZ`>yr?aRPOBxn>VJdM6KJv_H4)C1q^ni|8|1e+
zN9y(2X005h9WRK^tu+TkA>xmEyPXh_Zh#TKp1PX+%^?v}70cm>T#nBD+%%^KTwfxr
z3$b9pLq}mxu{hsOhQ-wx$6miz36!wa#9xLFqbrt=$0x$angq?w<bp|7i2S%Yj6(GZ
zEZd{M1YeQ|YyfTfu!8Qk{ze(OOjcnokt1ThfyWpz?zwW#Q`Xl}5%W4YJNw$8JJ`B=
zp1N=$rQW_9;4lOps9>dlO>`E)uL~;S<#kF~3$5bG8gX-=<GSga9&@oAsj?u$<6p|$
z;}GBo#|2Rc+_@val&UrVk=g_jcY+n<D7-!hLZ4<aGDzp7E`|Mokqc*}O84|m46!&x
z{Jab(X++_DZomOXCn1&l;|X#!Ry>bwL8!qduK~w*C+~i-R<J^IQ2!+GO2#ssMqWMY
zCC1U{_W>TMAKmA5@YxFeSr*>E94icC`v?>>gZ8Au7O)i0Hu&NULqGOi=ySSs5iT$U
zY71LF1S{J^wE~8f(I+?xTb9#B)gJkgHpszz(mx@pt5ESC{=?uCDArq&AE|l|pk<m@
zi+EBR^Hwj0n+qI;jj!S08PBo;#+pU=pEI;XjzRg)!W(C-(t_z>E-o(13om0S8PJ1X
zjLthk89rz8szeSabwXs+YCJ9~(yd@l8VN~=#;H-yvjuakLaae$)HwDzVPTEM9Z|Oc
z=rnj$0q8g5aAgu%({~oDCJ18{2F}6=JUDtXsi0(Qr{mO^A<qgHMez*cyDJDkWLsl#
z30zQy7^k#zn^-?!io;JgxwI(yCn+mbviJ!I;t8^3&3{E8?4XloI|;Z0A#uw}>tpiW
zo>>7B8gTP05qD@$a9Y_`f*JO8@tNK{+j~HNhO7(cEFACI6a|4RVn#b|TsVydaL{WH
zu~)(*R>&`E!Ep(JP$f0tc~et#`_DwEj2ZJRSQgPq!X?P2Q&9=_biY=~jd*TxE1GR7
z%CHGU^52NteC8{M;`*f3aWF;Q)FbO8BMiB$+OOTsZnD8yO+;r@IVm{<VhLx3osR2o
z<<Av1nX`|IP7S26Sz%1IyX!ES6`$7H(&2N*$b2d)u#n_%AGf2mI!2x=&7YEV3CFY#
z!`EL@^c|k@*W^xJ6^kdn9Oxr3wsw1_^w6dP9T^$H;<`TVJbwS>NvwrPPI5Z_?&TSh
z#m!i<Xl%HUWl23u9Ip`KFYQ$O!@rTzPQqI7oUGmqZhJXRYolnP1ddVEe!q$kLR~{D
zes9rm!dVc?mAGKhaFdX(efP@Y|Ffn5p<QwMu=TD>bY{l6#X0txc9JfU;Ur4{oTL3w
zCL<8W3RS!yGgi^(DEe{>!Y5h<@k^33YQNnOS3qjxxK{?6h9B-z;~TZUifpIW*lw4n
z1SsycmpNL7e}AJaCBW}q9sCWsx1yZUCzVtB*mBYwX-IQ~?4<UuJ(x~>Cn;JK0*7;!
zR_QZl<@?Ve&QXTG2PXwY9naz-7__#+rQZq3;MXi@McxVKooh{!n7AVu4qeO3_QgzR
zdpV(NW5lXh0+vGjQX;>W5WkdX+}dzJ=w(k}I%3PoiKGfjX>Dy{CU~M3#Q7$8hAZNx
zTOe9`lKn;IahMR~A$r4zUkoYsSgEMAh(1OkaH=u;v(O3tg@~61<=gWjdO|1pQR>1#
zs&_NyZzS$tT(NjG-S}2M{&TU~)cDq?t~tdU3Mxh4<YohRr_7xac3vuB`fA@K&1Eu&
zHW!4A;}512=Ff~(B)G*oDo*8zEs*V%TO4N6yB&M4!FrP3T~N_m;;6V*RARA5Go1y%
zyY@1-xP!2~NqUO#<;3B1#ajn)XW~#(Yi|WIFvLS3dIlPfrYaslK+ER_?s~ER^Hz68
zB#h;r-|QQ<Um(aWj>s}BPQLZvPECCsg3A!Mg&hVFaZj3F-1Oqb1rRyVsrEbDsSf_N
zqgU41=_Cjb4jDRe#mnPNX?jQF@EyHJ=489?7B@4_(da0p^ncH%^%;`7(UksfS(5ti
zC62xQ9F)GU+)0#-=}U-8d_^E?GdloU+57D8f3G9JnmQKN5zva41kfB-LFoVQvov`^
zptAwyq|oOVNu7JmLXQ{Zz4*Uot{{DuiRTUop~V%~+InR&`B@^9Yr{>Xa+;nTmqQ%!
zQaYge2@UC4<-MS_V?@xWA+K{T$o!`uwLwoq0=`!XluubNE_T$@5YXy;Xx4AB3)!T@
zN=8xn>ETte>ks!%(>>{e9Xlt#_PaT0hW8CVRT5i?rJzEbZK4p15M<%|A$sG$ff7)Z
zvy(=ZPEFcEW8<>P9`VF*vV4?ws%bvXSr))9B<7iQ75-t_7}L;`d`(^$glBZ#Lf&EI
zC}&`$8r34-Fm)=6^1`Uv)vCNo5)}HsOM9)bas19{e`z(RyPkOIiMKuuy!K0~k@rOF
z{w#B(3{0;*R^<mO#4Ygi;7sW<uQUVChGslLG!(AxkY{lXT2|?SB-~(-9U~R>N+vUN
z^9e3P?k+48t2<GFPH9o0yb5*d1xOP@Nr}?Z){|eQF1(G*k%JLt2cz8jshKw(PUP=R
zapm0XD7AbL#<Nqmatr<F`b^W;zpnO4;8#qs50!VvZJo5M)V*D|s)|GIedDY^1f6D#
zD&zV?yufCeVt<VPf{hC#3-3prF;0)(AMHPL9>2t>he?wL0r*Hl8QZTCVsp#?H-U%C
zfX6v<Nr7&)kBj(Zs=y>rZ}%dN&ngr8_vjG-Jq7Yt|MGud?PKpJe+Ykl<sETb*Ozzw
z%p1B?>cVyec?0F0aa+GH7m22#?j7Lzx=VykNYad}56iRq94BSmFn39PCP~FvSNlv(
zfK8l+@0x5MBJVaI^+5JdWWU8_jv#0xHD#QaI}(5;r-hvQOv+e!SnTZq-1@JTR4jhu
z-!BYG%$c*tQnHSip0F#-_%X}TxY&k&{PziJ5YBo-YsxrZbf&(sq2bJl^YxdHT|N3s
z^{pd!D&D-B>P;JDi1TDe?zaSG?g2L_HA^XvktjVICD<cGf<3{}G)w6b!g9l4i9V`A
zi;m)SkR5l8JZ%Q&nZa_>_gKzn3q>D=1Nq-Z!IEJ2*wUk9!8}^o){mOO-RP3gCQ_&x
zg^t)V*ig4NFp$Jz0DjQb&GlQ_2V&%(DBpY353{Kf?pCc#RJoRe?y~2%_)aHlfY`tc
zXdtSbKB@)lSc~`>cIA8RSIX$4Ec!A1Jh)H?O=SAu4FeHfI}kmxjBPs@qgk+Jfl0RT
zQPfi7d1GYs!D!9QEi>;gdYzZeN&?9dfu$g>Au_vHTPG2LNXwB7qHqX8b>D{_U-SjL
zMRWE^;8b&Pbw{o|=+jwcbdenDC}dMB!VIt}jU=!&V@Vmo809LL){vA54x|>=6SM^E
z^a~=;_vIoIL{F^<H1Gx-_bBX*ax+k_WGiIgU3F8kF{}UsC}B^uuGwA5rn2BfRlqN!
z_CNas(tY8m0x+mY4txS9*H3supn!?Als3s69MNGOWlHa$M^$$OeLA9?&`eMU8m3mH
z8FrV6+bB(*i?{$MadijGwIk7|a@=l((G<xr7e%4Z<y@MR4DizuGQf}PCXzrpL7Kfi
z6$}G`4+joYv%(Hw6EsSw?WHmes1%vDdLp5bkY^s1-tj0s=u^J$`oq1fB?y;Iv^o(^
zH~=Nmr}2atlFA8gQsZVBDZN4d!oWZahC0CtHa%_0!2URvY@}*rj_cR<(RET}1BHyO
zRwmHMF%a7Z62ME-P8H10J<h43s0n(A;efn?`Q(I&z}tt*J4GD4#BqJ`Q$A?%EJieE
zT;Z``&h&wx!u?iN0yOI$)Ps%h_)1_Yc<mkk$VqRLlNE^jQ5cV@gmodX!~59F$JAq_
zlsb4I_@8H17<onYf@&c43)nFrO$LZ!H(6BgP8IG-Tpzv@k4y<R6~rsq2oinYZOuxH
z$Zsb0jfOuHA;#)E`+N`36qq&D-Q>iS(yyB6;zmFV9MOLIbe;cA+U>jl7irsU*hip^
ztmbFCDgDr?MsO_j<T*kL-@tcLf(Nv|K(seGP7rrpNy~81yW`@L{>tt;Ef&-y_nGFh
z6A96<AG_YW_k#05SWRJ{dMz*fuYiFnF>pYPbEou8@erskq4Zd?Vuz%V!@E|zYnpNr
zw`maW_Conp_|IU7CXYl1?EjeM8@{h<{fyP&%xrp;1#uEDW=1&o@dL#Dx>K@#4UT_I
z@tJVUn0`Sjwo$6;MkTf`6_g`;OIi2JhOun>gK-fnyp$8X5TR4KVl9g8BKcR^Kpy{`
zjh2;<8zlNiQcK(VQl*v)Vafw4q%X&N-c$EWV>Llma)>sSC+7wD`g?<4=(iK%$9^x7
zl53)ZJE3sfdS}FwoBb_)S5byCBZ?B;7dNw=42^NLEdFstEF2tR<4Op1-C<?8OzANC
zD=E@gR_K>lm2ODV70Y>hN_uPW%yibCPxdV<%HS3b)0&;{paW~sSe8R_X{jxMQpzs%
zEC?r2l=kH{-M$7=-)Irr=QBhMe6*vb=i9H#?%o&bnpm<Rii6d>hlHuDHKgf_ES#r>
zqQ9y|%0515AItUeM6X-z-j<%T;r7i(yEhr^8;iPmeS7)$SKv55nxBQ;Bc5=5x;z=r
z(9C~QV?8cs{j!dG|0|EHo6NhU2;9K1i*XkszLm1aJ)xV2QrPmSr*yOFE(+SR$Hskh
zQOdO+b>rTB3=!#%B;0SmNx2Qb$#~Cw9$f2JEaB3ka(nC1Ztfuj==8tXT@XQQAQZ8n
zwsUHQz$frhz{RcioxKcqw3HVuJYY|L+-dLrtz&GY;9K2W{>|7(h^prudxt{`be4(d
zJso=&@7d>JcYM{(tsX;>rY4lz-@W+wUYY&oZ=LpSzdfph)xj!*kd|L-W#%1GvfRko
zd=Wn)w8TQ`?Hk!&oC7V85U^Y%App*hwtd$BfHFf*i8=abYyt#aV{PdvxLZodHi=m`
z|1E+fg@AN?Qu&|#8Df6YzX*_61|F1_ZTYePS@pK;y#HBaBl4czpgA+|1Th@Nn;NfI
z?6G==ftbql)NJQ?*MvD*rfo56>KJo?9Ktl6?M!#HT-yXW(SK#>3Cl1Y5XBHFhhw)U
z;h?y=SccuB5H$-l&<n8d_MACc<qp5@nV~lL#_QHSZ<`FiSsr2d(FZ}MY3m6J*DL`4
zo&)@ADPMM~7^uVq3<LSiGLN(}lyQ@;u3>dFKhyR+RL{%|Q%wPgKI=oB%|wW3v%)XJ
z{SGeqXH>eS2_nsj*pQwyfL|TF>MheU3L=zkpc7PVU#^NZ4ItO1I5|52GpQ0M<EBAp
z%>+z~xFKxc+^pPM%v6vF)t1F;?(iaMOyE8#e5Y;FG47WhnKe<ezcFkqc+Gpv8u{OH
z_2b}JuKQ`YnMtAGr-w^cRuZ#iZte>g#jVYrH>yNZYW@KgAdtRJKx3N-J<o^?u-1yH
zr6XPA!#oE^j*o5YGALhDZ%1lCIvlM95rlZIhLw=6lC*sQ+d?{Lm$NP8`xWTeTMr5%
z<Ym2e_0K@d_X{HKl@UmizpN)Wi~NEB|7jBhvu1G30jGS7ffGoFwG6&qg<<1^0O6m5
z%EiI}_{zRJR9Lc&$B5%<_EDq=va0lC8DL%;RB4L<<)6MI*(Qe$T6cHV^Zh5!=5v9+
z{qE2^t9z2##a;dMsQqvTYg-;o4aCdM?$gONFcSR6xiemHB5h&3RI^|)?sGEHtUc+*
zZDYareG&y(`BN$b<g<pv5rt-LZ4Y1DpSAn8ci(==wskoLclfn^<Xwifv$@}!VUzvp
z^CelY-Zn!Xk?h$#2|5L*9D3cR*1)|>R_!l`C~Wwrfq$dOzb=sfo}EPg;mU<a6k=vN
zWqmk?5DBiU7=@L&L>$iWuTMJ+Lf%~R$gBm?zp%ihBRklFaJ*$CM7>`@_|ZeE^uh%Q
z4lHGUM>j6e8oj*Ks|hKOJ?g=1B!nW$kLHDku4JjaDs@nRyddmcc0r|Gu@%Cr>zH{N
zOL=>yp`C~sjLJ{y;3#HpSqYfFu(k-}c2g}5%uP6`o^$%j0sr12y}ww*C_tc2!Cs;A
z#(~zCP9MOpn7#22CO4A>Zget(ZP74bSy}K{!*Mq*pY>KPgt;h}yU}prA1<!Kz=F5_
zP0qL2i{9fg5u&i0YgG_u5y+ov45N23VBupKsPjBG>R=uNSL#Yt50G;0qn;x+&UD_L
zd*nrN?><7@y~mzp#l86etA?Tb5XCw*bo1Cq$6iMRUF<Q@mOvCiJzD(|17RrSN>V0!
z6~bG8pQtWjM=?g>YE(=16TCb%azVegpmnpZlw_#lfKpjehscS5eojtw0w?~{XP14|
zqlfl3uU76MglH<yKcsi@$k$*W_V~UN-qQ)+4e;M#_q54__I~ptd9vc>6S&AbF-J%C
zjZY@xgtT<ovu9@WD<<P#({v^=z>Y-Qk?nh2J=wTJ{9e``2<wKZ<oSFR+*MyEKM7uN
zVT5)*7Tei*7mSDPt9IFp!0*h=q4e&0WQ&5dwQeYhzTv#(Xy-0^x18)F+(6lktYh$n
z1#nGR2{L5==hki-L=5Av*YuC3izDUsLE0`Q8wIQ)mxyaY!fLJ&)kVz41fJXYE~D1`
z4E|)RELW}`^#oFKnR+Dn5O&w~!0z}lMA8;@xKa4)XNQ<b8H~3Kj!fqStqZ&o1fK6G
zO5<9I?ub1|`UNKcrZ>RxC|bng-LixV<1tVHS$nK*Vdj8nBr1S^_9@DsBI&>^3hI1k
zE|yMILBGMao>0UqH^U8@&F&1(j*XnRSzY+hG|{nlPCfw|8rc=Av_Y}Woh_B!K|D+8
z0bn8w(YFvLFj4gXYU|X&&oScF8i=glq%M)d#f2=mQY13>&g2(<GHZ_`#)##}?ITEg
zP%m5n21{T&`|0=|8wfRoEKCv|_xftx-EqB2srQyIvFqs35EPL!?Tk1Q=WV54Tao?a
zq$hddycF&<RoOoq-!-cozr$<ky^giGfcN+8*<s|(XRG1lX?QUP&$IWn&&?OA5q)6?
z+|w&fZ`R>&2SVYrFR)uikfQuk0&C>O%x&B7^o$_M@U8gG3@^9E9blq2_H4!LGM<;1
zHsNC#I>~U1-7UV7X}Nfm#a}XQ9iC~?glxM@T7W=CR=wpR;5KE!m0;(^Wuj)miJpBA
zB4}F6KxH*<v*PWRQIcut_=IJ!WbrNhn<dEGwB~<SA)v$4aM0S3rfI2tY944pLPR-W
zzBEGEB&fc#4>W$xJiRlo=Zxrf`z!QTJfQ)VZ7!~*r*3we)w@#|2O$b1-yoT~d4>=N
z>)KU_`L!S=Ge`*UGrdPWVuc<+<cjTmx`8gJFw6F4H01?riZlRuKY;5-qCiTY6zDQ#
zM1E+kMN<NCptTTkOpj*qSgW5Y^H{XfGn#@c{(glq1v>M{EG8&Zc)Wz#q;ncM1;l$s
zZYx0)O=eq9=^c2&1k4|$$Cm~CFZ*`=!o%8oeQ`yO?u0IZ2ZQ4Jw(?E7eMh*rCo!S{
zf?HL{rwZQ;K*~0QkkX^ivtYM#)5N$n>g?AeyKuY)**oK(ka5p0IUB*q_epQu7v7ku
zm~(T)=@f(pC>aQ!sd($xK9}HF%{ajoChKHo^Bv$pn3KsuK$ytP<l9p>zZ@nv1oNW7
zaclE_9%8yAeGKp&2DZr3&D{ECh*cJgGcY&}keH6#q|y*gEBhz(Pl#OZ9YYa$u^n&8
z9L)-YW4VrxWlowVrknOyN%)@-zE(JGA7~?V=~P-onsNP%{xh6>&E#i^_TMvE)|sLO
z=$VOiS)&I%5+eCN3gs6<baHtaT;(X7X2YpjlTED<*2yQW1Q9LVwzaMtwyeTPc%+7v
zt45PC8U67>r;#F_uZg!{MSZ*MByko5Sxan6Mkh6cCGV(swwm)`2Il`$$s{t4iaAw2
zmH1a_VoHuQL}dQ6N91*+R=o}4@8j|F>!$jez9AWK!9!QZpo)51fdOvl!*Igk#@Be$
zy3te<u2>hPubA_#Pi0CB@+OVJxRpko1aEYR4_x29Qk!N_!u>=_Z##(4k6W78$a+2(
zLdR2LLSWeqVZdA_#O=ki*AJOcF=vlm$=pecn026xMZb2bR%gR+#ii`DGDps0>kkpi
zWdZ(JnxlYQ-_4?wJo_d7Z2gcy6?1k6+?!kWHFPgkiqkhK0Ou~;u-?nW-zC!njv4pV
zZ_0ret9p<Az*8k0gTN)w&Phj%eBI=y!!<?pr?$)MY%rzZJn?7Z4^(U0o>#&>D@Wm5
zmx*MkcNXs|NndnN$@o>)mDvCS!kqu1bW87A7p~qRMe5Sz4RZ&<(X;h996iq|t@uLe
zt}1jCGdIX9K;+-ea)JMa-xT3HUyr5>Pkn*C_k<59d~4gPD=CVF2pB6(iP51-oV5R0
zoVPz>3^}=jllqFD%t1AH^GF1D(||rp{T^5+t*2B0#83_Rbn0eDq3Hq6DAk4u<;nHw
z;c7n_xRtoB&2FWc-|8@g8N*%oEbjMs)={wyoUiV35m#~5)O-l~jaH3;70q+z7W`+a
zzoh&Q9`NnNCDT%aGD|Z@hS|CN$EV>wc3n9+s30`iv_#igHcZ`2MOxv!f7@+1Q}k*T
zt}2lE1iPb)F8wD`$*k+0XW&(V`q*O0#D9M4_sXRDFg<iK)$tw4R)1NX0q+yQmI7V~
zD5VU<@G$S(c`#>sspVH4E>j@}oVrD@n))13`#nYlVYxE<{bq0i{e6)TNi1H2mme4=
zS$qNK92jaE2(707^W!{SiG_(=uYZ0sz1u)J3VSZXIj2u6YSQsldGq_jxk=ioHMR%j
zqK&ZIW1ayKI|h9^D#^bq+)tR@AUjX2CfBYNc^|UEK55Bw9uVJa-Jd=&^T$l<$^EeA
z!X&ZJt$~ep#u?s3KEHXeuu^Gr4W)Lw_y!Gl0%f)#KwehXyYx;EB#-3vMi|z`r^eR7
ze%-583Y-1J#l<8jSUnN~Q#4VOdekH;|9IYf`SGUtxe#v?O=)<EEwFI)B?3GA=ic*+
zB}U-{!&d$##Y|rjd$Vj=?76ZxVrz)Hed^MSaCRj~kReaB{8fX9geCpUxOwyOJ?VWS
z;cTyP+EE-+Hpm2=fj7B^iyW#M0vtNfwcvI+bTQGijo=l}ooxcoBbFBEd?Iu8L{g_!
z!s}JOgxjtlcyW~_@&R_HfVXC_h*$3g4EqNB1z(F8$psyF*u_VJOkmc(3Z@>MFHw<G
zH|GOk<^O@xb!96=ugW3dyC5PZ#}LvKf!nkaNR5AbDR(s!;3YP5vmdC*-LMHSc3nOZ
zZ=JYY639EqdN5sBf5i#LXPRViGs>6DnXg`?gFMmNaN|}^!VGxM1Epfa6S)6dCPRuY
zRXf=LK6<3s53fvcml!t~Ooy#+Zlnf$^NxysXJCuiS3N2p26Yt->O!hN@EAg~3w!pI
zq|b#%6+Ge9z2~WV8;ngzUM>6`Z`RC2%9R?e<YMiWBL#6Mt4OpqTq*3+>b4M~g`yxx
zo&r`AB;_S|%=aTqnmRy#8}@_w$c27!F^MdKo7sSzKUEOF`M8J$9Dz)$B=%lfgubjK
z9gJpiIB1biHBVreH{V+T+qU$uGA>V!h+0dF*j&z~FQeKQ94I5-d|B&)_2qXL94-_2
zJP=-4>2V@x0|dD+ld|#k@5j=qJq|qZP&l2s?RT7TXpu6taa@V@nHw0aOBD+%ADjFT
z*B=@|=Oq3E|9L2uPQBKIBmXnSAP|*wN5mO$)3JA3Yu7?v2v;vUQeQFqYR1udO{s1r
z>HYQaT+H%qh3lhm+jzunevVeQRkJoN(cQ@has7W54NBeC0QWRq(Jb&#fFsp(62I`n
zXnOgy&G_{nzMxa5Rba*8RdlN9JG}0&DcXY2Wn1%_TK%Q+&yCb9ewI)9kJ8fScd32l
zR%6(#v{^pz*qpS(=7clAa|yWuT-N~@Pl%dXLZW7%ooip>xF1*0%N>8>h9A@9W`w5V
zW{EirzgRxa^+iv?h2@KYhTM%6lSTl_5@@=4fO_PPj$Gr{K)44WOyJdH2*PbyIH6*M
zt7=s+POq4<IJGBzLOEx>AhF8qn=f?A808ASU#^jmC*XnrpB)|d4&aqF>}6P1a*c$z
z6^G?%L#-p2z7SF8f;7OEYe&bd1EOLlOoSz%3;R`0V1;yTJEVQ^ippW)cXO-oU0UfY
zerxXw-ws!~;ZNcFnIq0}%N-nZ#D(h?q=(?*BZI}dtX=rFAMqByldn1J`oLO52&w(~
zuMCwM>|(Y0B7Uzbi4BHy@SCUcFI5YjHIL)z)egBzpkCW#0O!4}q%Y+?;Pqpvh`DWp
z0`T{%3&O#p-%{ginm&u1Xrw?4qiqb-`D$hv*;bnaE$GTM8<=P2FTebTnn~_oDLqmv
zZG)kDrg4}GuB|Kk^no`LJy6#I8ay(>14t145HqPHo!ryn8l<p|jY9dg5QNYPZ}jy|
z>YCC;?p4>7({QKkyv438Zln7^V~l66hyCAwbmW)Y5}&08n&29S9F__zgbza;Bk^Jw
zhA8DaI#eD++uWff^Umu1SxUF+PRvGhDp?3Blu0|8$e=7GZKdKcc8j70SDep-cgA8$
z(&Z<~B@E#T2He1y{?h)JH2jtba&%I^l{d`JKTpKVuN_|HluIBIcxZ_!{nd6F)*&+(
zRj(fZJo$!7J?aut2el)GVQ#(PeF85OW_5Ha+aXbe@88m3+jRWJ@VuW~c@4IUhOp!2
zBJfddXC<4D<``@&kZq}b$ET3XK8whP6fTX@_QAE?t~!hXYW-y188zMn{?gQzAtmX7
zt**ibThpBUW^-}W`0r1V(ij;rXJH2kXXS&+Xia)&DgOwR;P>#t=_8$51EhurZ&8n|
zgWue2@@*|=3>SZbGkFNBRF8!2Kpu&7Q;#CQ)t#h!Rv3C9*|dG(gwxklFa!`*kxWHT
zDkRzP2o%kID7Yphj7L|Skp~5zy4?L-nG!e=>V8Kudn>K2rzW)VWmp<gx#|EVgdq`!
zgRDUXLQHG5>#@uLo0ID9LvWV`h9};q#%0xzjV}<=jd^^zwr~GJ>8dVR=2KfnIsx$A
z)kDUok{1;q*w!ZODR?zN_~pF7#WHR-9}rCIvd6?HV^a}kYd3KH+9ALU|9IcqL^c}q
z=qw)e3A%mF76fu#5|mCEm7X9xAlEe9_vwoLC4)$^hG*R2IR|+O96)d<7<ZQxr-Kx8
z(iI+aL5c&Zx#cBd;H<du8B9oNf!kISP7`*1e+@H*v}5_Htx=VsvH(*UiE4xEmLp26
zsv(4w-#;RxeEzcvCKMf%`C*!okik`gZzs@Qcw~~00vCio49ZZCtQI00eHsWUR`O_p
z`wGgZUF@^`H$u)`2;K8QygNLnd%dHx1~jn;%5}FVb=+?~P|uGPs2f#com(bWs{56O
zF%_lK@_~I&+aFyA@P_&TIwt0Qe6W5B9iw;yKdPT0QOL3Gc(4Laxi#rs<^X9IY~xZ}
zhT)Hohte^POYpbH0k$y_KNNmn!Q)Silcc_fUpo;`$K=H0BPXKh7`PnR_oNRCQ$WcU
z$Kc?TfzI?S{L0C(tQ1BoeWVd@IjN^pzbVF7PX<0S2v$dC=V7qCABcvH7#c*u+e$T^
zvBXX%c9MY6qQm1G0z{0pQ*dI#Gh*8EJl@nWNiATiDFwT%nP3v}JYAoifLj{ok~(0q
zKZ|FaDi!M_eF5g_+5cWA*&h#Ubhe`%j^{N#C)PI%!8whC#QOSAz(A?{@AX-4e5`Q<
z%Mk06AB0;P14J%V55T^sN6^c+-NU-mV?6}gnOv}ze!w4{9wPRu*&Tm&+R4FY7B`#@
zoh;C9kgl!jhjbKZcEf2_o!X34Vtp&@p7#HDIt&zk;mjP7_U0#e<C*!a4ET@{`3V1U
z<|VN`Z3~|LQ#R`cqvv+)7XJ08X&zvofS>twN8z<x9DG*qgu9AAIP2s|^JTo}>~li}
zIQ^?+oYW)R&chh+y>wvNxpAYuprqY4maJ8V+uR8jl<-5)h~v9qjqV1gr{-a|j~+7-
z-PrGZya&L60Nog9csU%eIUj2Bf_g<62On&S3sEXss1&3?%9!Q4l$^K_n+!I%J7i5S
z!(sMRo|xW58<9{*)lG0zFiD)+e@C|?G5fe$vjbX_b~8dd<cVS7-&6Qj$Cp?*>ZU|A
z$C#PKbW{7cop*zs^If8y@JAQap`dvSb(Ih+5mWg_Ibd=A=Td^C>71}V=@^t>S1fts
zGh`xexe%}f$N}%ji#g#UVfr{n;Wu>z>+~oRZa~x`mZnyA2_6#HmFjub@Jbk2vO(*a
zcSn6e6f_-Vfm<3X$e{ywf1Va$hI5E{JTLtoe|Ry<qzLDXjFi^GB-U1UUCRExO2dn*
z?6MMg_6d~o(pmMqy6`q~B%%Q&=|jPMPVaJdc@lZ=3z&6@Y`I9ln1<iDK<}iiRoG>b
zeGAde>*gG&{2^**m6Ama6)7qh!;Z3rZYY(SLB#WH_@OQ8LN7{8D;bt5fo~c0Z4@Je
z)1kM{caoA#;XcVqHooMBOr3KJ-nb@Wtz;Y7N(h+;r|3QraqVZP%W>wV;m`gK9q{l7
z7f(Em2e?dkq!RPO#Ju|bXTZfRDB+O8czp2^JSsj{UIUwm5JkVRyH_(r9>~NyrHbWq
zh!W@GS|r|K$~X%WVyRT{5?vfiO_#lDKAnvpJ?eKUTWQNcmtcMEKrRfoCJBuwVxs>a
z80P#P#i$O%WdYT~l-cR;NOb)8OnHfQXt|ifk8~uSIvn8iAIfXSITaba0s%GXfSNCG
z<7G7~q;GD+9hZGy455xiP>~eG1z{$2DvaI<;mPBW<;>a{Bu6ZBB=$QlT;UFBp&gCa
zHi2doJRoTXpUSEH8_$W8)3UYoXOe=Oefjv!pFx)kR^%4E;pcxy8vDZ%@l1bRW8bIN
zh~+J#v8>5&e4~f_CLI8g#mgJV6R9ThENb6z5vvC&Cj<yl9%7EF4Z5P$zJn8*Mrjl>
z^7bbPY&S5n`%*TDw!oX3zBT|;f7SeN=+b9+SJOXCac5*#=ba_5dM-J!wEp#DSPtu@
zb3|_qB3ItwO2P<p5RB;jn0{|m;>$r`zClFhFY#Is6;JV5`phI{UJwe(JHva2ea`e}
z{(p@7SFPRl!MhSWH@Mq8VIqF@@A+k)(C9f2c<lR)T+cIGRgg=MnHh_-CbO%DtR8BP
zAA`(s5CjM@7Dw1~+4JB{l4L40c_mf)sF+e0{(&mZYDE)L_wNLm520xSuXV>YSJb9e
zL2CaJG{SwKr~NZy`(NFYImNAi|2pST%}L2w`H}E|$44%x3`T@%=}UuHgEpIYeE__C
zJit{RDJA7}i2*qjd*PWPVAR4E*_0aJFnrzu$D)t=DfL?{6nSFsi0p<rc7qav5f^R1
zDhpb)VZ>1!mx=J8ObW-tKLQ-@PMyp?A|p`#(9KKPqLALy<AYa+n*?nW*(s6~0y;?`
z>E-LP33VFYMUw1EJzpIT&#!~K1ISs_BArx+&!;2hg>*`}C7r?-q(WPBp&i`T)-N`D
zJG&@*V3=EYKjh~|6b3$*fpBYUKWxjOjxfseGN9?k8s&R~AN4zzjlD9^x$L@ZU#C<h
zH9KOaJ-~l{<c&96W7Un>r&9tDN=`-SIhutB>_e#(h592hCaMRp3eoh`(#C7AQP}TB
zARY47ozj^%_EBsbBI}sCRBD&VOye?rkMxf$vF^zXc<z}>->}$twcj1|7eDiR*%`X*
z5;#2C`h_lQhp<iyBELHgI31plx~ZjA7eKeM&GF>Izw7dj*}$NaRd5vv;#+P{;H63J
z0a5*T^@l*2+58(*R$N*yy_b}y_S@=wpHY0B@vn>25Mwi&pF3sMxq)Hk+9--Xwou@e
z`PeFou31JAo`GJY2*-{vzp&HY2-hC<o0VPK%u=!NS49!_DZO}9dgt~PijL{W<NDu+
z(lOs`!*_oF7aem7;}`$<&i}>#r|!h#?jEOO=A>=>^D`5<j8D89<U0P6v*gLg*;mP9
zkK$90LDq5W4rV@|`Qtk9mVFCu90>n_dH!U5bU-xphg>IXS^PP%i_IgepMVFBN$O*l
zwsv<dAQ1g$amS=G@_>kuzZ6=sKDLe?#Y0F9yfGfXR$x9}IA|>hup2d<y|iBWBBVj6
zN^dgMcJ|8pz$x+?5W^>2T8E6F0200d66P?l>lK?W&$pu$Pe{|8PZG^tlS(<MJ47#R
zMQO9Pyg+$JzscX9MfRNbzB`}5yGw)JJ5QIB=L#IUa(h&lo%ifi7Z#wpGW-A6-kX3$
zacu45T{F`&fFS6gpg|$Bs00<oJuaXiin|d+<35U-&qR%y7;lmpgaO&aWW-i4Cd8}6
zOpF^wj4^@=D6YgPq8AN1?$-z^Dj>`MJ>89B;{C3<%Xk03=LygA(r-^yS6A0wr%s*9
zR+XO}+ac@3Sc|hwRZ!O1u@*<0s+mvwST^Vz)8$fkee#d6pk{L#Ir&Xz@7UodYy&0+
zupsSEM$S~kGi?$2tc4HkO{<M;fKpqC!uA<@uZjwL?UD-n15p{*Be)G#1FZZa@}v*F
z-ke>I^ovmAb0@9HxUm~i&&ME#ro0n_P2tGxa5YK^8UqT$DMrswl3}zYmL0UBAgRzC
zi1LFm>NZvs_(7i1Z-d5fmWEARc4EcF6&bS*bE~q8<&7nzQ6gz~E(om=KaMtK(jWrz
z&LMG|9fBqXnL?%4YU#C9k(;AXp2KIXiDiROqw!jpO~PwWtY~9JuO1-2bVzc>bv0hP
zL32LY??xW_=e37<Yie!cx(|OiZ9I)YKMf2q(yFIv{=Lq2dv!rPgiM$sl}(8=ZM_$)
z^zXmPRB_K;=|5$gsrCK7Y^!PF{nm=CWu_1BcToC&zT33rz8^g8HeI>jUg`g{$<+8k
zCst<a_rQr=G=)6~HuZhr%+8s1KbWZa#n<Fm9;jH~$26fF&)Qd;;>$ZKTJ$mPE$^ea
z+}l)9-m!gn!1|zn+}r4GJ~WMd=*y~2hKGF-wdJPlhy7pm?;q`*&?`5?I>q1VELsYF
z(<i0=BQ20j;tqnzl_s}GEtLMHC8j=)@cz<^rn!&&x?P`?kMi5dM&S~K*?0|BwB>f*
zlv3X=olUwNMXl1sq&BD#P)dRk=SN*S6!{~rMiqOB_+EWz>h^d*WB*Pk%-Eji1<m{r
zV~WZ6xXp-MifHbVj&Z2LHHdD$Ic7wxQyzX*N4!rt#rw6$g<5S*lVEgKhU+RP@d?lO
zO8t}bp854!On%Rr9zJf@O6sMa#vYwilGsTlQHyHoUC~Ej{}<DeiZDg;dQ(Bg8$M!y
zK~u><a;g8e9Y`<y0y{ucyo}8{Q_VJ`D+-D6GP2+~rX7{8rgtivb@ZRN1@m|D(QD%o
zm#^y|<Hvg$^SeL)m?s_!R@Ch>RaL&_-|3#&*f$@NuqPRIt2tfnM@n6+nZIqE9)pF_
zvXRTYlW4S~I{_utw$V>4LxZ1K{BPIhXZrDLVSv_tyJ=(9bcO3ilhu<zMb<;ph$ls3
zTt7t?4(3&C&;@FeN?dP<t)fcXD5u7HbGnfYqF=MF;nyHufoZ#M|2lKbgxC>cD>&Ns
zgNta=YAmV2HDgFt?_avsw4}Pb0tyG)tJ^51Tr{1j?xyv1EjP!RY?^VpDPM7Rn~_wX
znp|pLQTm@sGWD+M)znx23pAWGIW<!DLjBBStZ`HN*4;5}t{M5JZ~tr0J9oO<;ea_B
zA}rs}Ez0&eHChDiwO04ggO3~nTW!|5G7mn3U+a&`=<9mbq-h4*s^!&Q#{H{wv)3vt
zD}(FA$ofvHHjSwr*wlB*U+cp!6x-#IrY~#TD1Eaon2y)Z^bm7u6B9Gp_vZr1t5nVg
zapL#`@eQpTI(ps(^e1TAr8E;8_h4RSvdO6t@=+|}tSdiyv;F2M&zzcOe$8&x`*ZyU
zX**C#+s~<7#)QR6-NQE1y}GVW=Sd`WOSGw_d!tN2_b@>_B&81<qP+mO_}c@cAPE)D
zfJe_5n6ifTo3RjcD5qaIPT3*pRj9&=g4q0@o$lZlpF19r!;rgANKz!3JPqlyez>x|
zEkv-9AtWzKH(rQAPP=h!Wg%?73gahP2>XPDu#0N~?g{-EbJriK!8tK@oYA(4t)-;8
zikIgW^)m~}UfP%4T?YOzNcYPlML-j;gQiupu<{hI5(*LH7_V;9RAKijqsA-7<q+gw
z^IBZ?GG1#hHL*17#)9wx$pHWK<Ih{+)=xeean!&$-9e(*CU&JYCP;d(1#3+jgSDSc
zm4b{zLyG4|MsHvpC<dkxdZTl=7KOp{+EQBIZfHV(`moc(Fkc?~>NL!k)!5H2wk9#B
z#Y2J0=KW|+oI_oBHS|0eJhqLCa@S+$pb1-t>1>E^NX7|ASYfx-6_#6(1RQ!nUk!UY
zUZZvq16mA#f88#+er`s|vmD@|%2v11Yz)Jo!g7?aDs`JW$5a?6wo4}L7S^7#MhIt<
zsZ}zak7I)}ZuDSiT9cdIQhG*L>t=loOX=@F))qSYpEeHh>~P*3-75?8Q*J)GL`zG)
zjMmB^@pY@_T3`VRI-?M>KKwy&Qz9=(a|W{_2(Wf*h3+ue+fUdnj2dV=P`OFtU&{Hq
zQI1f4&>(9<5m`H;Wh5GEku~jz)6yWz=?OBU(a@a`9!~8Wtef|^xmM`G2~`L=-n+@(
zbw<t3xUd+SP`SH3nF{mg_TKS27rwC`l4<M&Afw`_+T6-k-tli=Rw59r2HHG!Kz=-t
z^5c4@RO?RdHYe$nJdCd9JVB0p{MZ3Gf{n^_;zINjt!<gcbNDyIqQ10)FgEI|;r}Qb
z^yr`JqRr?GblJQbs(X*j#>r^Ab@{vsdN(6qln;~#lo$2c&<YWbeqw6gmb<W8_x2sm
zJuNIim;9x&v1Wo`3TpxDu>x}>Gp|pqt-r9d46J<g%(jzoSIL^|O-?<qaHbvC!e2B8
zEBOnqyni{9Cbk&E|5eJPS%2;wQxoRyrr}l{Is;>fkb1OyRD17Rt&Q)21zC$HOna(^
zV2<q=L#wj#^Fq8DT2P)E|NX{~I@ITA{e<1Df6jB;l>g21*5%z}7q;`iXL54JBAJbq
z(?dj%zxGKyEYc20NgN3EVE>&lgJOpN<~1*VGH6A-rpxn>R(dvwA;xuB+O0363AFeQ
z+ZX=AST*~KH5O{s?3K~)JZ|kA^vNvU(#Ne`hJ1Hu;t=B@=i%#vbyse*9y=VR@tt!n
zj-x*c*1dJkC498*#toO^u~26ShmXrQT+W2U$J^&xu9^rRbI!Fany9-jyrp5A_^CbY
zb#nzrEB2n-7l(@nZ@N)DcD?1ezeyE{eIGs498AcS(#c%&KYt=@v0`o50^yVudnIgf
zX7{)bnS0|b3(w!bm=!lm8xy<_HVgM<@DH&SLTij>-@TqX_})*;{mGR7Xh0Hd*g$t#
z%ICwmW*8K0cF1v{@!+U|QRy1Di6ezE)-0&~cNpndxBnku7y6cHk2#&wO6Sk}eqmU4
zw-!eOmQf9{ICrlrb@;qM$hKx~dSh;CK*}Le&A;?Z&W4wQ58i7Q60tw@uv@)xRA@fP
zl5x@RoiB0HN4@V^nPzMerY4}iftO@1zYg`rE{b%M!)Q3%q&+%XVU`W+Z7nu0hqvKy
zp*=P%Lb0R2;MRy;(UV@Sq$|QXo8$WS_l|FWjiixZopR#E;pjP2G}NLTT#sQ(n6=hA
zu;#e`Q8C@u<}dgELWM8ii*d?)*PLdTEvBw@(jYd-x74A3#xn(v`i-gH@eeZ>Pq-#`
zRs2Cd^E+Esz^pMxhUJ5%zg_Kw12WD2MXQ~~cxH>whz6^jf5k6fCk$<{+Iazw$D6I4
zYEV7we);-0tDO!dBY)Rwryd>4v(-*g#t12()RRnrI#uE|)^X`kSYG@AJNX6mrz)xH
z$8Ivk=3x4tVU3eJVghj<M>N+ZzF+p<HEeKqAu{+Rgqx*qZnJr)&xdf4r;e^#h5Z<*
zflVU13q{!}$<PB=tjrl<90LQdbDN+G6&DYoTmLMHrJcXjUn7a3LPPBeskjJdkSZHh
zuX9$~*l6+PUg(NPIk9V~G*e5ILTd*$uoYC|V0@Q%!WHKW@ZNFm9aWF8>+TWG8S)oC
zc3`i)iqwU<n$9q$@z@;yiH99V!;QEhM;!wMG50jy!chm-cG4kpf-Znp)8bm-V<|i}
zCMdAxa<|(7TGetw#wmSlJuw!tGaN7;i|Sy@T|yVEOt*vhYHE9POjr!vryPv>GKpIY
zO($KWO>BHknDL`FnIoDo2d0;joO6~E+&Y#L99>n3V6`)j1)J2-HAqeegCEO(mOi4m
zTa&HGh%P6oWR28h=0;^`)^bIMWGT&=HHQO&*Bo=wAQ?1m?-res*sOA|6!-KVtmvmN
z+D&>G_1X)PpMs~v50GoHP$;J8kAlLHb=HVCUMDkqJF;O+co+LH^y}l}PDX}2i{EtY
z;SMvN7WZ%Oq?O4UDe>|SikSf;CZ~3ICwy=gJy?y{*;e2B2|CzlipcV-(_X~bCPYl&
z5G)!roDaTm+@mk)Z!pKhB5k%!MX6h9l@>#F+Up|@!$)Of(G;_{Mwa~YsvS>t(CaM$
z?u1Iy);OhEMQYbaz2lbqm%5#LL?@nMyyLd*KD$=z@1EA<H})^2fuuByG*y3Ot2dw^
zXvAS-Y?GbX1fEm9J5Kl;Mk@(J$6bh#zTazCp)qP>Bd&LxcYJ9{r!PJ@p~OfJ)+k<i
zY-`eF+h)X+E5ZXzjxOAlRi;o`(g0CE1Pl=NpGck-MZ&Lm)$Uag_dCUKmvEKC)~l~?
zrTw(2*iE|a&*KkJz>qw-K2|#iJbZ~6y*Bn-o$lr}m8r6lqf?lu?hG<hh{f6N>0KFg
z!*4XnEe`CV;SA@Ki*u;jvLG4*R&q4{6%INvXYcj#YY&nMDJCwr(_*`r{k2kf5nt@Z
z0UWAYRJ)aetuyQP<|gF0k=J1fs=&1xR+@(JD#@$*bE;;aC*ik|yaK#n-Z4yYhQM|r
zN(Z(<e1^?=7~Nv3X%x*7gRiwH)>&ghM7~EJ6H=X7PvpwX+>Y_OgM8!N@s%gLBuJsh
z2zX=3$l3+h#NoO4v3UZS*g@hMyc2`+quN8E<9shp7iDd;!rHu6_#SUfXta858p>`J
ztdL^zO8)b2kY?Abwk8O<NE~H?Xc|(eA`QzRF_s>7Un=Y`LMB9Vpk?cDCe<%Gn?5{^
zpPv_Wys%)GbizkZ#;2tlEoW5~zny2)&oUwd&te>&n>l{LhBLRbW1gA>&_A;YKo$X<
zexbf&cw4299k)K%-6y9)cQZD?<kAP{6(j~|*9LQJkjZHnCoMwQB=lR?F~J<|?(I>D
z<rvH-q|QF}6D>~b)2cZYR1Dqb<z#3&Fr;JEUlKI$x^D?yD5bHN5oe_hg*FRBk8J=C
zzzgVjrUHv*w^1jnQ1!jat0o;dd&oO3l1AHAacMYE%E}yj7vqjg@z_;_2}7CQ4y8G|
zO4!<xwf4`cYGSP`s8mz=^D-K(|6$`$lKibXi3Z?zjg~^Y3TTx%>mdN0G!u;+=3G@`
zz0*`H<fFp0T6MN9wmN&Ls`{-(d2kz<MQK9^u?T9Eftc&N!(!+ZIQOk>7p6dbJGw^h
zGgd31>H5PEni8fQqr(<X8#@nLpU~N+=5Z9FU%z<;<|p)ANQ&-8B@PF?imBPW@9B}t
zPatEetQqH&PBkxYp7;vVTr22*wn;8(a~1Sv58v=YP?f0zbxE^4DNUrP(UZ3Y>B;MJ
z#V6BlEJ7;(C_RZ`>A@Rr^dt+$vnl#nIL(Lax+eIykLS%1AKyTaXPwX~cn^9t0=Rgi
z&BOpLBy-dPX$43=3u*cBa@1&X?Ql{umNvLa$qhr~he%NxG*b+7<Bdh`9v)BdLHZ+D
z@NtvB>903hzs$O(Zc$}xdfXW77nc~&)cUQpXr;uo@|t=9$~TpZFa#*bGG+8g<AlZ3
ztXyk@Olnt&52@R3PO=Q+FPU+#s)B7|sHRt8Kv0E&0TOtg0oz}#%QQ}A>UWM#Od6`2
zz;kb>iPOV^k&&?3I+C{vLzjS8aNFOU`4CB2B@T^CE2}Xne#0C~SujTQaqAqua4*>@
zK955Sa;kJ^{$_=3eGO!q2lX$Syq9!}M=V45GnQswS5V%XG^!`2uyNRYvRg0?%2<7!
zv)sJ(Xw5)+G3_8K&CYrZgUX>iwh%%#gVQXWAf><t$55lj#H(;1(>X}aYq-*>KW{K6
z{qo(zNf*D9vQYoO=V46-&5ztsI45Pe1b96sk9}b?Rq%N&A~KXOG>a*;a)5>B3+vOX
zVDJtUaH;57OtXGQ$<uc&3ce@)h|-8-o+&x|e!D;Ei|?pdrVb^g$X-84CZW}rLW-or
z(hN{P7AJ0pX@ISnL=!hDr;RG5S%dyN>r==et;9%VPqDarZ=^0Ih$rjK)xuXO6LIbP
zlNj|ahz0sn4#ky5c?Q<tu7??-NZcP5@BO#GLs#T>cGhJn7&7-q)$}WiAof|C?u*4O
zLF}J6sUW7)5u+uY){8Gi<AhU<-xa31GOvy?Z=)!Bcdc>v39NDN=uz`+PYU01jIWT}
zlx14A3hyK9QP+A3yIffZy??>0mJ$4;LZj28x;l(wBc2b!S_&eMzc0Yu6r&zb$90VE
z***((tMRW#^HMr(`h_~$(kGBFTEY6YcX>5!o+XhHc0Ew{Iuvq7YYaFcu@&{_^*90s
z17MZBvcwg%70Z5&1;^Zp{VccA^@H=`_)e^f*FD5v3tVHwhNlKi)*%>@M!Si@#7gMS
z(BQdj+rx$<MH+0n1pKBmeC@a5t%ACrC^LpXo!&~PN?w~F*uKhw^-{yxq9)WFjloJa
zYAwX5*oZ3ru5Lm3!M!EjU2j2^2={Z2%I-0wGw09E7B?KtPyWI>|JQpQ<ZvEJPfneg
zoB2^_C8BaG3$3JYuLZ&t#+qWhA^D4OkmAw*0pbzD`(SYag%JzNVr(Mp@wS4}yFs~8
z7^bxf){S~>(-{XB-B6GXvHWA+@sS}^+UV$>D6e=<dkLe9$!L3j#wwJ)&fZj8Yp?wn
zSRKO#*lT~na#%BrI~tqx;TooecyK^t8iM#mTxXY;Wn4SUrbYS9%w<?ap>;S6Q)pBY
zx}uHpe9{K1Nl93-iiqGct~FzRGkI3ZWgRfuz{WCqjGXGuHkRX6kLn|y&WoR4Fw(Lh
zKgu(w8XZGnrtOa4jI$3B^<CBaizl3LVkQi=_KCuA724G}5oNVj7|hwIB@ybZ*ZT?H
zs~rOZG@W_vC43FOf)>RQVSGi#jl+mAMUqy<qp&LO-tKX2l$Wv2y`!e~CH(7?-F@hR
zTs-jjxd$lt0gaIwc*S!sfPYJi+(&sS?rwW9Yml?KQu@x)GuY|uK<O|%SU2%;<I!R!
z(Xt?A)S5t?|GZ6w-4(Dy%$Y)yIlU>2athxy8B4i8fzw(c)DWKL7-c|<7-n+7s;)Mf
zVQq4ZJu|tIMA!5tGVe`_rfGtel#NOgvhiT!3`+)Qx_{q3qx5G^J0X^3+&$04b>Z<b
z$g-K7-}P+D+$qUe3Vrm%Ui&^!TP5bSU#W$eQkHQUr6ciJKa>eIYtwiV@_mE4jmGcB
zU5?gWGp_&4`OR#`GG=CRrQFXOdFvL}=&OHJSw>ctp(?!anAndnH78M1`+OSj(|$Q2
z&x3g=T=xlgJlI%8-9BM}C+lt+liN~1?S$?aZ#(BGhT(br5^o)*3DSia@A$o_tjQVX
z*x}NUyE4DdyjHicTcZO*ze+<D*)ilq1H}(4w$|%?_{}bo6cuJyNQw&LwH@}^>25UA
z=&n?%b)hTOHIBNP9{ietT76tF6wt)nL2e+eQD5kc!?Q`#qG)v(6#;AOr3Ia8&50K<
zX&+;}ZnXSpD-OAzKOcAcun6PnVWMc?wk$h0^WnsMS?+GBIA+C`y=tp#WTlA0;ztwP
zCf4;zAEdzWs-(eidD-w}>U={*rH{~L_l|dJEo<A>L=KxKeCNen^$<jRW!%W+w!)~8
z?u5p}J03@-Cc*~uHE|T;W~OPWZ*~U=CMKnMh?7)bgP(VzZV>MQS-}&j_<E(lsx4ZW
z<Wy{VX_FC~z%pWczzS#d6YD75{Tps1TBV`4ZiP+r{l>^ZHYhb9J&sqK^!3A(RnJoT
zY@)dInn;V6pYRtGEq^{%ZL-UOP7FoG%@fOoZ>BYs?n=D96JXi0>0P-VdF>T{FR)*=
zI3MNdiEdn3WAk!`eK$B)mD{<3S5qaCv;)v;DfN`Sv}TXeOzXX(T2IHQPpmSoJ>o1*
zC#tos9k`__-YXD9u(EAqZvXO~$)+)=XQ&;BAS0!?gNkWU88^m>s~wVBT$9G<lX<me
zO>NE66rEk8#*rgfuwy{)6~@N(Evl?!qDOOjd70m=8|+ywHQ_^(EiM0Aqx)r!txn@-
z?<Hh(7q}6h-CwPn|C4QoG1EUIGn30$KHEP%C1ZJo|H(BOnJHXGoD<s`?Vh#{YWLVv
zBxc99eDAoZjWB8R6%NN6!{5=x+NyNcwwTN0RK+)9L4FB+-e>e(I7Gw9W6m#)w(GxZ
zz^|13nlw6(h;4zgMm1itj}uzAXYO5t*@zBVFk2RcecR*nvvjK>I7`X3awiO1a0o$K
z>8Nc#S=QJ-nuL=B3<rj1S)S}FJ1Z<`&pIpY{Dh6|nU6kw-Dxr^p6!Y?IjB2@mML06
zXXxn&_U{ypi;3=S)^d<WNIe{8(-g+f*j9xw!pjuR8fb8t8fYA4+>$hoGHyv4M;XFM
zZ`Lz(HH{e}mS6+rbvvxmO3}ZTT<S1#7Z$oDxj`~|QHN98T3nOV@_F%8D#>SVQmKQu
zk}mqZmPkH3eIpcmvo`vUak^Y6>|jB)OMIam-$8L0HDtS9GRKXlKDp+=VJRHr@=}L+
zw6rdUvndt}nhvGu<~Yx5cv6hx^)X^skv-)?XDZ?~cEP&$9;=#=As4O*uT$InT5Yov
zis-Mi5_+3%RZj(=w1sel@%|7R8a*5@Y<Z2fYB7_hG`U!SL@W=|pjH~TZTnQX@*49~
zX4`)%IQy_pZ;1Y`y+&Wte=k}E_`~?DR*I|FVx&WM9gb<qsnv}tQ#Cu`Oo}@HpqvTo
zeArpNlp!-o%Lmz-sl=y72J1pgP&i&@{)QPESD$2g)1*-J859bHoi7ne2x=&)w_=M(
zeJ~M|rC?mQ{l3TuJv*{Cig{avi5*#Qeb5PMqESE1kPc*5UxJ<Rp~704G~Dt;S*dnf
zN3+A*?oEbv7;*`kR^kY5Bii8*UR?-b<0TqVW>5KI@sCmMa;h!*S87Z}?I7}StkGHp
zVIzBsG|Sm$HOjVDTpa(Z)zdWZFE?7hEfLf&@PDW0WkJ_6NzSG_EKKgiTIqSU4@T+=
z-UoZ5p3rvW({kyIae~5W_UEhN<_)D&Qbwy8*IraQ<%1xM8T*6<br_7DKyQXB*92Je
zU;M*X2W`$e4Kj_k`_#V$Yraw?a9tT0+=`?XPjq8TeqHciT<)RGT_4OKN#i*?D*@4U
zj-pT|mo<Nh(uHB)#%IAq^p<O6?C*|D`m<1CdPt$vExY^=KS}@N^9t0Pp9PcNRSG7#
z7T+YUG2@#Y90N@8Sn`dHdpby<L2&&T;e<Fws8<YiH>1eMx~FMq0~ehT_h)Rt#tt1)
z7f@CA9X2Lrvhb(Q%vxc8R*31$PT>Iiur64KSE>7$<1l>f(=lGF_IHR3!rY6?%GYXC
z_c2nq$6(Y9Rk>{BAxJlRVr*~^34ZT<vTnJiCw7~m?GL<vHW|mH_Jo}_oR*AjT5h+V
z*1hx=Qr%0w0)O{jq@1pQVJp|56^Qv+3S!<ROcvV(-b2y6t!Y+Yxvx9QFDPz;208Ga
z-B8_(C(b6#5EX3KIMk<x`$i2+&C!{8_0M@}rRVJR=gmpea+R+I-uot4S2oK|`{rw~
zNESIXX;{FpsB|pjJGO$<bK_IhTp9sLs=32O)m$2+#cN2p^r#S;TyaR5o`kP=PuHll
zp%~vo*$)zU1~tD>H5-yVZ5fU9M<;7n8@bWRdk#CT9wv5R)>3Rn7Ld{=66#L1ie4Ho
z9y+X1A^s`~GO3a7=l@|l>^5cIhDyuPRTVi&jd(lVS^CY=GU=h<-<5UN+Z9&v8q3hf
zwL`MB;q73M3pLnVb&myoBi3O4chq1fs=;VWwc*bG?jAUo_y?DO5zk3_q=9xr4HIvu
z-epf&Wf{bmn^e*F%|<Wi_k7i-83{@XIz4Vy2|3Pv3e*xOcywcJ^&dQT_`->{Ge)&l
zmDgub%ma6iN`;gxo%ULk{3Rt4#-jgQ@js3MMWBDYC5XRmHr9ui_X~AM$=_NU^F<JX
z-Lng}d~mLa!U}vkWWkL1x1U3S>5Z0={8i~ojJ+)__^b3S^KM!k`K$CbmQ{jnch<92
zuM913IKaN8|H};SK9!2ap(nnlPg@-Ni!iM_Yp<|33W?pBdoQt{^eQ<j_LKITP^rWr
z)IV;;gqz)2Z$<wv1dkrfQ=h}Tk=^q2qcJ$iy#9Q%=g%^Spr>{BcwLg(1>4<iG%k7Z
zx>zfh{fRFAx+sl{$qvdZb`T-<YR<hAdmD?g9peThVol`%BswjzJK_m7us<g2;x%Y$
zRZlXkeFIFGe$hY#=TROLAL0j5>$Tn*Hhao+!>Ij=exk%<XeNxBrn(qx&c&lN0M)69
zN2Bwp=3KC1W`naQqpPT%%EP2&sU1AEVj6}?(N!2GEfRH~AnW6UaWI&TcS0npXU#+?
zq}k@^tF(4y8d_q-UI6c*T)pI(be{%@;?p0W*9px|E|!FS)C<o$Daz#()2Wv(D^15)
zX`Yb8M*N`AVtW7$?M+VcjJ5_0Q2&^$od7Os-vl#Kg3?7*syiwXN8b9?My7F(*<Qg2
zoAZ^Aba(#DjEyj+XBi294$%Gb5l>(GJ`<00Bg>pZn_gHAJ^!ulRtnQy{hl-0jn3Md
zV6^)nb8Did>igQWS$7j=V#B)O03Ay<Nt`_E@_0u{-8?3*UJr^?&8MHCP4(1ibcxs5
zs~z^n!Irbb?s#3C8YY6JZN`+RFs*Y2ISL_#3R{mc1JuV*%aivWWh7Es+}q%uh66UY
z*OkNm*$MncdQKlaw!!)fwzBiVI1t5f!v^V&!2_wF(dra*onCthm9y;9gJvTR=``Xq
zRIneh%WNDs2C1$)#Veqvn`A0XkhRVdPz4)_T4$!ef{W?>zL?(EoXFBhlWSD4bh^KB
z`>}U7`U%$5>XUv*<s%#rBh<Xkob=N$CSDwRQB1_#e^&x#J(qw|`b~R5`u*&!|Mw^0
zH_s&?H29vTUrGOpU#H*eq_+3#1bq0fC7`5TA!)pCjTScqW}iBZ6LX+<%!0`r8%7Q#
zu3IqD#ggyZ97&^6GSo$7IX6ohK^wSdV`%lI$tOu!GBVH!E2qlWUW*p>8*Nm29Izv9
zQ^?+S9K}1Bw|RiYhIp7m2#Y<9SCIfY>T5{zOI$b6IS)~uDhS>KtFd3^9F=AilIo;E
zla1$-bAMK*C#azXd}`7|<)9&)GI%_!(|^E41<&CIXr`;juh^goT`_3|>`y6<B2?I@
z!$OVT$%yK~2fblAp?OrwZCgpo0_jFfE@*9Uw3C?mUSr66fopwK?GKuxEtB~27mLB@
z>qCl26+l|3sNei$fT^g3_&DXDAVe&biwauIMd^cQa?{lZ)uAhfBYu-sK!@o|TF(f6
zcdtM(HDl`&zTR!+V8~HygivwX=ZxrVcl{ELS_p3io|g3(X&1;_kyu%ak)RL{fAR72
zg#=s^5`vr(@sYO2gX9k=`S~<0l7|?-vy6e2%A@93l5x=w>yP1>jU7=C<(d;A&han(
z${ah{_{m|NQEbku*Z!@v?6X=ajV{GZ$5J#-JZnr(Vgv1cq{=A1N*H0!TI#73(Vhtb
z=?mTU*Y3UEK<BQ3i}AJmr$=B(Y67$!H8My_`Rka+lx8CqM%@5>9?e|E9J%g=mVA5N
zCaB$b=G10F3Bh#uTwPowgwD0v*lTq<{q-BFCOjMb&ESvTa1P*~O|bs%{7SdliMhMY
z<S0PXxrb~kTKQLb%YX{`fKnbUO?|ZT+EBNWoMtv!#_^A2aRc02EZ9(-ej(=4(V_t-
z3s0XZJbj_y(#b2wuOGdA<Zd1Z6W^5oQU<quL)0|HDZ&r1$b}VV9CD5wZfzrjyyFnK
z!}bnB#6S$1+zLFQj~dK3l@jvWDEjdJ(fDmR`rj>aJhZF7vE_8UorBg^Rb?F7IZgS^
zac+mL&epE6^2<cdGDK6`Dq-<srDqN-5Dde<{Z8xfk_7Q3ts{fX((61zVljjg6E}T?
z3AVSq<6+#^SD#gV7drvq*{w{ATo}e%=^8a^4x<*8-B;*}UWX+lRfV>3U?u&c4ULmW
z!kEm2S+fEBkYw$6aP+W#v)ZyY>d_Ev+{GTX5uC1YDAOueKpCJh=O=v4w9s!6N72sc
z(J|}PFu&QGxoO=*6&JtRH@P-yzu8APzt|znMkB>@5R~uTp<@i~GM&*z`f7`_U0LLC
zVc&4*CQ80yaOf#Tf4<tBWC`Z6>_YoaB{#JPxui{kro5H7Q&18H%Yy+~Av!FcolT~J
zfYwG;)g&0RQ!$m)y+|v;-3@E<ZiewFo+?wAq*4uWvJ*a9Kh7EtQqM+d&_<JSqb)n1
zd^)B{uoOUEw*~=(;$)u^b5h?-caMz~&mtJpO^o0hQJ&EiIML_2(T2(9=<03eO2vZj
z2uaZPk(aS01^O|fEGSL?^A4Q77KiE=*S@nZoadTthSh)!v=oDQMY@;@V$186JzQ!H
zEI(>$rLs(0p!yl9#M6Cb@M-M$uKy*Vi8_ze@19oe+vez7U8HEt{F|5YquyRd>(01#
z>4mr#e11pjA4t6uZ30>ZQu2(fH`6G#1Tab@no?jw{}47&S+Z@P@L33ZMSmMhM>Zk7
zNKf9q4UJf^avg06p*+;8#l=H6ho$D|Ihd*j);MjVhJ2HS`svcL+8-B-2}Sny)hBmH
z^H7~DuSFqVWPL3vxV+ZgP%iI4q^~r`E<`1?3V!~;J0Af-!oKI_(v{mvnp~srkW4hl
zY3|`9^&KryO}-Ik4`r?zabLifKEjHjtZg5+`LnH0NPazCCBHM9WADh9Q0v`Dof}OG
z?0S4qqa0dZV{v)2=5&l!?O;W}b{6gpW!_EP9HzH|PSVwyAklArU%_V>#5-=jQ+Sj^
zDS*G&tEx-g9432KeiBT-4i~-t#U5vaxow}=z6N_1U`P6NOs@vN`@R{M`RfqM#<zOd
z@c9`vcs{&+)*C!mGRvUg-Z08nKGSLp>!4El>;EkD3}c>3|GG88)G#)S9Ttw@zFS%C
zn#61t)Oqtl(*2j(|2y*cA1L)5dHjRWXT^+?AN|Y&q0Kn<8aAQb6Gn-o(_P`?aSXe8
zM&1!pMKbTUuva9>H-(~ctd-I~`MOXck*k7pxcJKzp{GPjgm8&m5|&7$SXd*G3&I|W
z6bVHVDHJLsaz=0-FNSkk=qZr`AzUISg(VU>F07HrQDKinjtE5($rCChk|Q`z5W_hr
z^pr@p5H6AZ!jcKhPhZyfeB6#w|5JNSnr_^*V9V0SIU(4FHZ91mpGC#zJn%GpXGiXP
z$o(U7KS=H$1zD5(!3UmYJFLllH@Sa6?%Cx2LC}dlaL<0=S+e8AZn*Cv_r>JCpWGJ*
z<&*n<{R7W}9r@&8CwW*v9`=!k1wq5f!@dWe**k`l`*w1Fo80%3``bZ7$bIhv&+R*g
zko#70pF{3@$bC*w61ner;F-1~iQKo4`%H4*P3|*;;>caU`+?`m9dYErOdiA(*hL<Y
z0_0&AQecN2xo;--Nff|Na-S4rP3}7%c+THpP44OBKAzmSll%Cf6TRWS{ekDy9Vd3d
zeIvPtlKWP24-LwPyPn_rz;o1&eDbh?Jd7p}Tgb!cpy3q2mIt2xJBE{c8o3WAcQd&U
z4;n)5<_Dg>JBE<^XXHMF+&7c^kf0=T-~7PSZATKhr;>XRxu=tRP*7ZNi(bX2Kk#(e
z5l0@@k%s{Cu#r3j1ldsl8y|RbJM74P4Y~Iv_YLIUH^`dYH=qn`w<h=1<lc+i)5yJ7
z(21UKPeU2lKCi6*XBZQ&A|Kr#3VHk)`REoTcuivVs6n3!Jtr|&r9U(<Cx~R^3gJVM
zbV?LH6N!DikPXt-zciLYX%%c)`1n%_rBx7ir5Y@@{7U2ny(t-QG79R+>{SF9C3uUZ
zQ=~A0h;Lo3@a|;xx?S1bHD=?yvbrcVn^nTz$?P?!vUk?fPkI=y-1;f8Q+1_fjXxEt
zC$nC!myHlla+R81u}P8ixn?`ziWa|5soUp=sd1JL#N!89K091J4FR0|RG2@7^?5oJ
z6$fAEXe*MY9}T`z2NsPxGEgD>dSLnhgEVQ2S?uek)oo$k*Lh$~=tp77cEN0Hu=AT4
zv6_Gt8a`<M>fb)wF~)3c@O%$E|B4vE;Gy(rT=ELd{?&X?{e!~XsjP?6VP39~K9&8@
zLX6yDPqI-d+orU#R)iSO_7&o%v5tD3E$<-B&S+%qjPn$>#<V!(GUVQ&#K7ENM5TlG
zmv9&VhVwG8b$SVR_D1nw9F?lkO@Cy=N9gp2tv)%r+<)Z&UCUf6o$(BJrU1rM6_U<T
z%=t5CB$j?*RZ)vm8S2N_t0g5v+m`W2uI_pv`p_pDOY6tAUz|ANpP_MPI`u<!hUQx?
z6MI$gg5?@bsjt1I+2zE+M*^kaaDS!AtyF)f6w0far(Aw4E!qE|;W>xJ{wI>xC+zr%
ztV#<4$H7qhN%|D}h$H@qf%G0r>xUJY>M`_^yp#bLmYyn}boQgHyp&SkPQ{@=hCWpR
z!k`5E|Dw{bcQVBef-SS<0}=;X)?cfYwu?yPk7wC)*hg5RW3OqD>@eQbUNGxe*Pcc-
zA5rR?{G)fA^{v!EDc-pUDBi6t(oja)pItwkk&@^}8=?6O7HW^6lx=6VrVqge!4hHV
z4E73z4+Cqj2&p*ML<51KDJJHEaApP@qZh<|m|rz@I*Taqo0>u$w(2kTyD$@&w~EY#
z(U3DTL|BDqqN7ji8d+m%n2+x&9ylqP9qZ7;(!#oSO<-~0q~yg<aD)p?uVHI^S}+dJ
z9mi6kh7!nST-UIg3os=hS`av&9Cz$&-={9a*}Y2_Gb4j>dg5Ry3Pv0E4Jz!38JR4d
zr&WKP)=YHM?i&M{d-~W00iVA#Gt=&XAb#I0wJ<e;z3MJy^aiNSS3Mgsky=Q-$F>U5
zV<XYyCMZyEtrQX?Sg$!!+Eu$dJjUiA8ZWN>g^XpS%reD}3#DX+#qFwRuH=>kw;q0y
z+u@35Zd6Oe9s99T2J-934-7p$DlJ)2Ds-I1oV!kW)a(RyJ=bEP!QqkW*@`wPOiAM5
z=XYvPO2THXrL&k%&xmcMD_zT4)jzF$$*1QDmu9gpJ=L2_SL$y)eRq?WeEMx+@NDL<
z81#h@Kbv_e)SqSU#Feq_!udIDy&^p_bIDt*34=k;l|thGu=!2v&Fj~nPKASE<KJf8
zlqDw<g@bRi4g*V0#?g$;bQUsDtY6TI#Q+{_9yEEu?9C*=WJ)3AfXP^Z3XQ|c2;`z9
zE5#&fNOBwXiR2Axq3b&s%apvctbXo8Gao30N>d-2`iX))O#Lu_a>sI7)M1qZ=esGC
zhr24G@;np+)K@e=BB1lhm?{-&*ar1<O=$AvC=*^(uS5*XPl{&)MzX6<gT|=fTuwRS
zEaW_bdM;b9EZAQrq|aqOY`pN(Ts9<7`v%lN>TOMsj$3nNEA-(=CEs)wt5M2>lAaqB
z^QVb=`FN|iXoHwEU(T6U8#!U}+pM{e^A2-VCiNXJ{Pi8^6>6cOVk*LtPrdFO!XxcE
zS}-!5g}N5Py)2rWfaXX<1V_4c6z(L_`k!@94A*a#8dJlfg5sQK-$ma<dYZK3N-}<{
zE+i|*({myYzLkv~Y|&j3p!{Q<03)gEv644b*gTK9^_yTMn=GXTt-lwO_OK(86-k@x
zp}3+MfJFCNdp3CkjL=VrxtIhgjlp&2f&+dwo&k}=bi-_Hgrjfcc$kwZrkLJbddj_Z
z?rGn1JJh5)x}Y20;RF%GmyI}@8u!p}O3L{)hiG~$Nz0Y#ji8fPFE4MSF%`yh88?D4
z%O#&KdD?R}VktVPmVBBn)JxXKi3MWfK~eMb71-?}9S7;4$4`eThSzI5oQ@Or&SwG5
z>{@bHQfSR0J;lq|w-@vwhgn((4hxuj-=_-b1JtB~E~%eij;gnRm0Iu?)bss#?DH%5
zEOUCiaoB<%Eb+GYVcMXe^%uhY1<W%*l1SsUYwb8*lt@pDq+**dPWn>|E`H0P&Q@QG
zCS=pho6f4~n9zl^vEn}HA~-B$&DCP+UKPq0FmL_E?!#-elM|rx2lGSWjZpA#J&V-1
z1PKXgYEt284!Jjk3no_pbq&T)&Y{A59!DB~vQnmY0-izPA$>v9d247y&O(cx$2Oqo
zK4Jr`v`ee(H}Il@lBqGnW*vLlXQJ)&W`d;IXLBN%65VgsEN+9fU&J6%rovqh1T>DV
z%s!L7CZ{-uWeL~cW$hHkp7bFtVDR>|;Ioi<cvN;h0Ik-=SyHi-4l1EjMq!gVUNl@#
zR%Z}Kbzsgy;zDMvH@N=f9mnTm{jFeY9a`2J93sV;<D01Oty{2;RGwOOhY|N0ZA?oT
zkwj`0T>3O93wCL0-p-UH#?R!Xq~<;SI3%X=9TRrqtjfI!*g0JRqrxZt{-zf_#Dmqe
z83Te#gDZ~W-3X=M_PK~iwbnKloo+AAPK?SG_*l@V{Vy-G^_uL=xThtsIhl~3RpS&X
z*ea*xmXi>e(wlm9Zvl0rZ!?uX(LU9kZON-Kvu2#d{$aH_dToQ0<DAunz2kPrkwJ>1
zG1kHli&&fP1+62g1~fEVC#A&ml5?oK!&Xz5xb6wP<DoAtG+T`IeDNq7gX>NDPIE$M
z>WpACAeSpN`dJUc2Auk@9bw$mo8pMmMP&KZvo@N(2^IL)?evBx+!%aaSW0O@$A{l!
z(f6K)!4Z1n#V(U7m7dYnW7@z&XC59NeAVD9)rHhhNo8Z6aB(qnX>Rx&D{=e*Di2=9
z$U%1M1?xJi4+!?}vHpsYKMAAWW3HVIbvtyUcpIc!tB3fAoSHC9FCaZK*nbXnpk@!P
z_@Pm-$PorP<VpOxZM~589`pBbHF#ELYB)yrsAx%RLX0TtE7*E51Sa1}`qc4fLG?cC
zpe)#$Cv<(EdAA&Sutlykijx*BXcaQxRmcTv#ir2VXbMcC22e8-IS5OI4}^{Hv)+zd
z<GRF`&YyD3I}UO_M~YaT(NtC5Qm|dZ8nLB<^AhH(8kw%M6^1Q=%r?;6A|v)IrmHRI
z4%%F4lyQ40%eWoS+JL>q(%0$kj&F7{{%A}DQWRm8b=v)wn6{`klD#rCp47xrKWalF
zM0r7yM2OV5lEuRwPPM<_)0>bsh*qPy2o5cXTQEKcx2VH8IHmOrQywm7QF&Lfs`>Xj
z+4_dk9iy;jA7HjLzyCc;OV2uGduT0<u&xS;xh_W1-ehs+@8HN;x-*<g^Nt%|6Gc@k
zR2n^KsY^sxSKkeaeMA^mRILW^q(X^~7wuTS^fBn%VHAxgZ3_CNv&qBBWII0QJlETO
z!z~4UVPs}TteIuR3}Kdgk8Up>&u5Jv-%Z~7TW^jDhk;@1-lSU;rA`*XW+@9%oLVb{
zEoA|%o^}k<&ZN;as6fI>-z)4|%3f<__<R))J&c?hKWvoM-MpcoS*;gJ{ff_Ul!n85
z%uR6l6KmVe@cFl|=0<r(*XRUq9`7m`5mj&6<s>XLml~!dwi3h9-593~L(xM{t`?U3
z35s}z{sv*|pV&y{eEp@>AF`lV=GVb`2ITorg2<_{6l!Wo@dl0I{GWFTQ$J)Kn{zl~
z6;rlrUn;ato}6%)<_^K13FZ%(#|z!QTqoTAka;_5>8Tly6*OaY!c$t!;nhONk01yC
z;6Qx?E}7ORlloQx#t2jNqq<v(XG@fA^SLO`A<&z~;dXy}Xho;1h||WIkF0bH&sp(@
z<jJ5ED%4;w8N{JlZ5d{R>u=O*Z31hIb0TkbgB2Paj{anqLJ9kx#w4$l)3lp@yy4_3
z-GlEq<4ovau0Z4LFlEiOi@)CUAx-9UJC$zVAJfo{1qESXv^exY!#SRmC|?R8AG02|
zc}Ss{h`*!`(&-)wr6054=Feo!3u(PY^e||>aQkESLk9;vc3rl(Ccn<PbbH5Ns6Bwy
zP;ts3O%a9nXp$DuLO7$xj7_|`-b}DHu!o)gM9Y_7JBho!mx6o0rIqX>ryNuI*kI{!
zgi+}QYbdaGT)O>~AoxbIetNIdG?p82l5-YzA-2&Q-&202qHW!G+iL1Jb#H|Lf7|xo
zZ0mOF1+}EM0r48AZ)u8XT<8~Dj`NJ7u+7`us|TBSNO+&7n!!~rhXriyh80X3mtztO
zcA0n#5}M1CT0TtmH)?Q_`O{OiDNSih_h_Lql6A4q?spDnI(U$sqtfh;3p0B!W5*Sl
zpOmv@jWVY$XGfH)S2C6Az0MuGWVTz$au{sXPMbSdIPnP+GM9hK1~b876&sv6BZc)*
zjUJU<TSsutk*;?R)z%Hby#n`iCAYK&*M-yPOj-2qwE0tJzWeUHcR8*T%+tO-Z^q2I
zxOURbU%XK0wT`tF7Oi7r_30;S>#UATC@83{I|}3g`++^cPGAd=4x|C=fK|W>U^%c1
z_z-vxm=C-K%m5|>;lLPR7%&L%2YLftfsR1Cf?EC4m)A$)|MseX_Vxd_FP7h{my`a#
z@^ZXePcLqRyl?@U0}g-<paN=7)z(!2_klaWb)W>e0Gt6%0!M&@z&>C%upKZ18-dS&
zHNdApA`k-@fTh49;GI**|JfkZfr&sEFbW6(0)c)&PoN9n19$;$Kuf?8Xbe~Z3ZVLA
zZQUcF47d$k1ug+az-iz(kOyP~dx2fR)|1Hp%^(|qRA4o*5{L()fscVDz`MX)AOe^Q
zOaR6LBY?rcKb?L5zsUc8I`;p1;r*lj{|klZUr&Ci{{NBx|FsnOqyGQbl3uJmfAs(V
zhDPLH$ihF`|3BLQ|7HsOQUCv_|NqSt_<ySZAAp%oAD}zn3wQ$_Kx@DmXbRW@YJdZ(
zAX_L0?gBS~D?l+&2owNEPhkF+1F|331MCF00PBD>pb(Q##~&bQ_#SgTT&(~FP`wXx
zJ)jJ@4O|5-0Y$)R;5d*6WCMGFUBFggGq3?j1y%zq_o4pBgG2)#151E+fw@2gFcqMe
z|Hq*JPX_)HVe9{6U-l9&$Gi0}m9!J&Y#58{2w*TU0O$jB2Ydl<zyoLvI0H=qTR;tP
z0Coq}l>>Kyo4^&I_<Q7kAxHsm6vzSg1ABm-z!o4KIGP0k#C{3o2N4Kx6Sx8t1BE~V
za1_V^_5*u>oxm0#9Y_P#0jq!&z;a-j9{)ZB-UH?XZviua$v`+T1{em^zx>~Q)&IK#
z{GH+H|6^bFauGrPznn)%Fp&-ZKyRQc&=F_{v;kaz=70lW1E_%71CX8p_klaWb)W>e
z0Gt6%0!Q@tcM#YI>;|?2W?&=m8L$TU6i5VO00XcTSOmNS%m$_d6M-;b6c7Rg0{wuV
zKo`IV@B-X`mVhJB7|>hcp8}|c{P+=22HXa&0+)ay;52X?$OE#0y}&MDE3g^Z0Hgw|
zft5f!5Dk0`ECJpH<^nHB>HmlF{{^vs(HH%`-}G{$@*fHOCBoMKw_Ys2_mBL4VYT>u
zh3F;n`R`@(ANl`(meeoIf<Nm23zOwvDAB(!yx-CP|Gt1<vReO<|NoI>ed+S^NB+Nb
zQoUq}{(a&7(f|KPlJ%uKwLkj*mrkmeZKxtJ)0qlP0LB6%fWZK1>huA+1HOPa;GxIA
z)_^n66tD%<00&e-=ui&a1#SXYfMTE!C;;{YIY1RAn?1Kd(C`iBdbs)kUVt0W5^w|>
z16F_nsNRaH9#978Z{y!p;1W;-oCb~qc|bO>7uW@C1vUd4fK*^Luo8#|q5*pOKLPze
z^U%NX8T~&M>wjMa^#5G4y)XhF%h|95*LQ)rKm;%qm;j6gMgW6>0YD!hq&xok0^WcJ
z&>C<CngX_f8sLB`M6?{Z3)}>*0L4HdPyihLM##%%@9KB%M)?8m0*;xGmH-@h43G-G
zABX`q0DFKO;3yFB9fV-Oa$qyi6Bq`(wHHz{AQ4CfHUb5J3R1Z%aPN(4yLT4Po!g${
zp!X(xe}FC4hv(v@{|o++`>&t<@C9Kt{B7m)?(TIxpZ`IO%-sgR^~}vYeUR-`Xgzhq
zIZxdXU<@!02p9g6%Yrhk@|Z0Xb{%Hng3A$hRq)McF01odJLTd@Hi9Xied5}j)zuYq
zb#;Sq9ShL?0H6TBMX)+y;8AAObkfb9w{Ye=!q>-G%gnRKm<toStz%7v(&Ox&*Jkg!
zx>R5ba9Y07Zw;}<J5zm<^=87NQ*5AGH}9Q@IkSXKr=X@dwg87Q3E8LFu;y=*cHxwF
zXD)otbB4d?67HRO9p0WcKl9x)%$o`A3Ymw#V{~2J+=RNiFrW+27`Po@SC<ED01Uun
zpbyXzsEDhpD+G1{tAItoSfDH52$V0ct2+bi0#*TwfU!VVz!4~qg*&hdSQT5RuiG0{
z_g{qmzxi^!TmN7E`nozjB|nEU@D}nT9Owx+0~IlKbw$7)U=6SY2nTus&On6`?!X>k
zDay<eT*HB$fHP2mFpGdaz#@dV6xWGBKVS{q9q1Zer>wgYB^)hc{RH3h*j;e^Jo}{i
z>}l^Vnlod{qIpwh%zJy<oOh-ynl^pz%*=@w*kdM)EoL5eYUs;01v~&=Fcw2+7P`AC
zVM{S{#3i?w`PnJqR{y6F_>0V)aYB1sI)~wBMcS9kXGSX4z8SrFmqNic?c6APv?|X^
zd_aN!^alEao-sDsesq!fIl5i#qnt1%^ysav?w8I@eRW{+l(5vyoQv!Y1t|`1R(CMa
z18y?(xcbPP$CUxr00mChlx#&HPd_rjjwxmdsZ8M`egsnp`AiWmj9tzi2y2vzG-0qx
z;VjIce+K%OO8@rIzccjDmRGn4GkArQpyw5@ri@Zd6!zIFriyW5LYhX=PB>2gD(Ihw
z75<H)e;?An&GhdK{;jrF1ZEDlR+MAI>T>2QxY#L{3wvx8gN2gD3M--7PGJxXjTLA5
z+GaC@oU#VTdhVt)sPHA5zh#DpwRQ6ncQXTh^2(jeK<T*TBs19H>LjeUS2)=e6)*!O
z^i6wVzrA9B(*Fb#UR5Y!>CKIWH4gYDFekyOgxTrO<Vc>IAV(S@xx)7-43vgVI6H0x
zu00V4dN;YJ;6A#+{k!mgx)Wz;3HPSRfIhh9_;QA5`TkQ}4M(3n|23X>+sPU5Gv`1V
zrsVY8&7;qLSV|rmydVen^YfX(77tJa3UQr^7ecdJd?Ai=<lOKA`dV`L#C2GM=gV==
z9eWo3OoV4>;Ql7w&-pa?p)CU3v-4RBbjJgI8n}nUz4!n#ILa?9qx(b5Fkikeg8!0(
z%-|v4AH=n5gXi18zi(5e{Jb5vT#p|nBgrD*k&^H)xDM{j8AxHB?r$JKTYT|Y`5rsc
zxjPL~fTtHWOhNdwJ@G8b`@{c-4I;1s_rs9oD)^%m(|?B_mN)Q#TW;TBW^j=`xZnjn
zbDw=tC)|fSDh*WisEi!P%c#7LI>;FcWKPeYkvWyGBAHXx6w92-Ny!PO7ayi9xGFnP
z>~G4P3eO#xQ>v87oRYL$=2RXkWKMZqEpxFTqhe6xD9Kear|h+o`G?th6fXIO^3_4+
zRH_|iPTAuub4ofFnNzB{$(*vpL*`T-+R2;>r;p4jn|x(XDcY4dwPKW<J!J<fY<=oI
zf&0sxN^PLbsfG-eIaSAD^}nNPjgmRlnz1sc0vRrIDoYb(PBl-z9A8aIRMw9(B+C3!
zAI`8+<`MXPmCUF2<qT_Nz8rj`%(sGXmiaLF-y-ua;M-;H*q<}(lDRE@-y?B7xAbqE
zVV~^a1D-AO#+95QN9K1cIKvT{7vp8eWxfPoTp;ss@G~-3!%vaSyMXUPD$z%}*rU+N
z+z0$B<v%$@XgR}8*@3Qi8gK_WphaC!CS)GshcY4a-uQiq%qcYuGQYY@VJJe<Q}}c(
zZor*UM(Foi{a6$V`KEO!XBaH=<6)d(s?2YLFOm7|amXf_JA@;fWF7{-QRbV$H_Lo4
zc(%+JjYkT}e9N0iA#gp#;sS1bQL>4*`(9z_D)aEY3PXX+1L=2^TJn>+UtyRi^BK5K
zmAN95GkhrXXj~04AAsLi$vhR;H8Nk8$>|MS<eOc%ZkIW?2YD~^<G3D?xj%j{mibj&
zOJr`q@6|F_<uL;XP(-uwyQ9oqaCMe><L@{_ACaT}1%mj?4in(8Nam}+m&iN^JXPlF
z_Hu?andgD$$UN+O&TvQO(fiO?$$SsEBU(g?P{$uoZe$(?-bXLrsP=OPf0=g$pCR)R
zS)5_E%y)q&%Df~Sc`tLv11RA#H-PVv`3CR`nO{AG6q5NnIh?`jh!i2c1Bk7B^9Y{&
zW!^iFGX%=K0DQj8n}aWs`4(`4%va(XE%V!W!E%|W;hNas_w6#@gX^v%a{K=X0UePY
z3UECx^F@czccUevq+18BlKB>J2bnwL>L~L9{64t;_amHPn9RMv!(~1d*NHOkdPI*B
zE8isIYLNM-cQA^Pc{KPwnIFeBTjtB|BJX8B3fvKGJw^2D1J2+g^TAgYhBTSebz=kW
zat!{d{de<0M?yE?Asx_R$lQRdugoXFPnpaE`=Ixe`DXA6na>4xJ1&LOvp>3QnJ0p`
zllcVjVKTqqkNQ7KzUhOTMKTWoUn28x@QpH`F@PC1%X|^|8JSNHM;|ZqRPbt<UmB09
zD0jy$6ENtIIbE$JuIK2+L3VJ))lufQlh9<!P3dMNTZzoO;%l$Ud?olznU~>uN9L($
zYN^+w6jh;>yDD=R@S8I43V!FH-2M;4O_}U41H4@3AA(oNd=+@L%(sAZ0KFgwR~i=(
zFWZ48R^~8<U?`HgBN`{VCqH*^Es=SMJ_Egwe3R1`UoW>}9=JNoyv?^LP%^JZ{?Xup
z0-A_xADMrMtG~>tsST7lwXTC@PA%#%nHS?a3J}}>YLKzA12vc7GN&ez#&YyBYA~{8
zPIWs+=2ZWW$eil-ahX$fE|57@)iW}uYDj|<3KKO?Z&)PXq~f|n=2YG2o;+>AHBIK1
zP!%`IeDFigK*KBY(+*b;nNP))?&<fQxcbPvq!OK+%nMOS$sf%>xcMM6WQPx{(A>&=
zDN3wC=FzwkDA1L-E|+=L6Ew*(zf{c`Xz)sYs6bPJB<_MTLm<9<30^F7{{d*`_4NhH
zA1{{qLGV>Fe=h(-E}3)SRI(|cBe-sn`8x<`pUh9=S#l#kYw)sBa@n%_5_5<KJY42_
za+oOJ1cFa(;Aut!KDz;*+knq+z!x>(OB(PG8*oDd9-Sk%{}hSk4IC01@Rbetss?;b
z1D@J|r#0Xk8}Q8y_?D*}?f>?tH|Rzi@I4Lqz6Ly7=BbEuPJ`c%G~mY@@H;Y}@g>TH
z%=dto6Q}ln5pF6PI8@6#8ozULRonuulKC2NY9A<%bHHcF{3iHZnOA^E%iLizYLm>}
zz<0^q2V76XD+(wOH&<mo7W|IP=YrFaiu`;CPQxhTiQpbGUj^<X^E7Z8QIVfr;0{M5
z?)()qtd#i-a2glDkDgnE8yXDI0~9;z|A|NAck0`TuL7rjn>c62fI{YT!Kr<q-xI;9
zdnTR=en#fIz>8&`4SrSTXTWdf%k6)6^xxE2(8H8ZePrJ5Yc#7er)&yr@cUqyQ#K82
z@cSs4JK|YtTPRE)aB4Ti@WD6B{EQxCyL?mi8k$v^+xXxMWWIbWzCh+{z^}@DGx!~u
z?*pfvkzOzr*FG{2K{$ajuLUPJ^5eFR8D@hIrW;?}%$FSk!D-+j1_VxBEb)D~5{R$C
P@6=TjkA@5i7w-Q9a-9_0

diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index 80bdbf2170037541848cf96a6ff71bacea91baf7..1b831b412ca9ff7aac9b036db64b66caea1b2942 100644
GIT binary patch
literal 138304
zcmb@v4Ompw)&RWEoH=tC1VslO4J>p7l3O+jh??4<4ii{j@`l`e?=AFzq-J7BM#^o5
z;V=$pVn-Yhx}gOq@2yDEQPY6DMC$dYA0_Kn;P4}*&X^2;GVrav&x~O8-tT?B_p8S>
z=j^@C-fOSD_Rm^-txdR;K{YuH3YW`}9cdE7z2KRVq8eU`!ew&g`ZFh;NOAWuqm*6}
zr0}}t;-7frK}Z?v<!zBjkdXbUOGzW7pikXVRj)!~n#5&1BtbRwpESzR@YU$i{VMg}
zkmXAX@E6Wh-lhP5(JP#Om5i><M!rkAfD07;i3HKL66*f9@Bh0>eUl14VEF;?-&oo$
zJU>RFcztM$d?`2X0*&!j{;_7Kovz6nq>S(dU7Lsg_O|D{7K!b%RsCbj-us70%fj2t
zB23vBq^1oTJJK&!h5=39XB?IlK!4sDr%LUOrg+<)S}~;bhL(6&snh*dsFiCm*4mrq
zwc*qXDtrW=YRobe?#%+f>S9LnswP*C!dY+hySN(t_!`N*y!GJM@DikCp*EHsV_e5F
z^ou&i_@aqXu7Whl!uA?dKE2>gr7zItyS^>lcYpNiH^YIi{32>mxMVa6m%JHW!@ej9
zm;9pPQ!!MsfXh~1tzmC!RO+ip74eI^hSb(TPBr@%q?)&%QmNmhN74%Yzd#kSUox^y
zzsjGln*AU1=Rvvmd@oYc=m%6t#WpqqHTW4*$SPH{J<p*k)x4`xm0BXZw@x%0Xp)Vj
z>3+ecO}}-eUcoxX+>5K38BX8JV-C?WZgh>bCYwP<+d>rn28|TYji$o?b`wn<T?22z
z4{xBF!JFvQ(cwF36#lv$tr{bIWu$6u+fa?|6jfvU3jW!sy#lu)9bxHHsZUY+BvWWx
zT>7ASp^}DPqHX_DssBV|Z2AFD+B;|Ia2iqMf7_l_gIM~?0@M98YLOG6j=Q}*k7d*U
zpt;5E@IjQ$*x`e?+*E3p55wBxHV=i5ViEV}Ev#D}8bo=39;b(UJl#(c5l&$_!hAI`
z>3)go^k5VLGCF<y0SZ}wO2J5X8m}&5j5eC7G1h2mjDM0SIZQoWcfY`M;Y_+FTMuIs
zA(W2d{hYNF3g;Pw)6&ODB2?;SvfERUTKMu15`LM9g#9y-Yg~AAG^+V!Dk8rNmm$@O
zsW%md?3>1!64`_<{N3%Tei0L{;x8w(OMa3x%UVZYALqEQ_x^$X%@wUx*WSN=$Z@3W
zc<(0z3tM8^;yRb!Saxf<b4A~CuB$EWZ9jG1yz$GeZfAerpevlAkX@a$)TrhW{U}2j
zALS`}CL^K48QK`m(?Khzr98A=y)hzVcILb+dN$)_oXvaDa~QdC4lk$YGTz3yyf^(A
zGs^fFKZ>5m_!#H$KJ<LX*EpZ|r57-xjSKkE^yADJ<Kz4o<4ndcy<l8~aV8JH5;gov
z9$b@-g47fm<A)FxZHT588WvKE42!76hQ)>$N@vhfPZ*w{VhyoWoFR@{Vpu{wX?T))
z%J3Am)UcHLqv4O~@hBo&@8PdCVPR|u?~L$TWm6s=G;6(9+fJ3kFSqzG@_Hp(pOuiU
z$Nk~%S1%u%_>}79zt-RV9O~u&lIOXD^?%vlCfE6|=00zCe-+C5zv6Fmm&1U3FpSh|
z<;ZuQzW1H^)jKco<O3=9{72pMhR~4vKTq<8AoLKXe?w5xbn!RnVez-@(S(irTXNe%
zTycF%ozUYqR&+ksrkCHIuDK<!4mKc9j;5t>?K+zOr?E=PgqgqOLwGy7m`Me5TM{T^
zl$mC9oT+1iua4W%;Z=OfUWOi1F!79CQ|4bYw+x*~E9JO1SpQ{wwgpx&e|S$VK9y}*
z>4LGQ=97h-9DRD(Vzn|D#sJf>%dYWDDQQ}xd4sjU3L)f$?fPV|(dv!(B{d~WsG5$=
zl!zI;Q&ruMEYktUyk@&yla_3>nkiUcB-~zhH165kp_+)cov!cNte6HvBc>qs3tsE~
z-fY*z$DBy3$`R?A;w<lt<Bbt!sok$&wXZ9Vx0h+w`}Tdw!&BPDQH*nn*6vsRl2~Ib
zulnd9vUxKOoEpDgbrjxc#sM@SCgw~2jHQT+;~BQdW-q%q%{GC#Y4{wdSZ8izwAmKh
z{mgY<3+3w3Oxr}}Iy@!CkFhD-sebDCuv|{c_*)8L?d6$YlswD_4F5NKl4gVUu!2!D
zcJ;--VeUS4*tX64r%0=EJmy|omR+NM8golHduK>YE8kkvvzfxYg1lwveoJ6R(%hng
z?MWBCzl1iH{mrIhT6gKVQBLn=(6f$*a2qfmZ29a}+A61PEPEBVhk|zD7Gcg5C~bjE
zbMZfMn+%Q6qVY_#fwZW3n(YDR2lDJ!y~sAn{fsUyg!YN)DD5HJWai%lCrJGlo6_@K
z_p)s)^KZ=W_@|-#Z%O$Z+~t331X^%!U|K}Z7DzEI)pPL|)qjKXzrjxhPXT`~lYT4n
zTL2O&<MVgeEWks7*S;w7Qv0GkNx#C)S9q>_mh=Zon;n)bKPU2?|5nUrvLHXvUZ(dI
zaSDQlakSsK%L5#J0!Yj#f)jLc=`ap+dAJ<SpJ05*MVw}C7^mSY5vO6RJqbN+FRPP@
zau)=WaF?DhhRdm23iROCr&TW)#z?s!Vx#~yWl!46k|aFtp$$7uVW}I&Yx~zQUQnF9
z!0|fB#_|#QXWaQ9aY0W&eiq1sjNiunU3$N9u35_Ed(RX2JS1XaxvbMFMoDigWXNkd
z|1C&S{ETmTF}ECYn->|&y&3oW>+rtNjtac0cuvC1R)UNx7_A=o7i|w}UP@ADNjHY%
ziaF(w)BHI6dlqsK6CtKH7yy3(Nbfq5I#Wzd$p(7o!zlG5scJEmF#>&$8MF+HRKN9*
zGn#qGjSo3Na}8Pwa?)@~K1`Uqe8|zywg&}CN$P`c{2aiKva6dPBB>$n@?rGWMH(aJ
z$o-xR?-9mGv-_Pl9W)qVyy?RMhjN#{4c=!OqvX^u9+UUh4iU3i4XJL-;CyKNBgP21
z1SCgQm1i$&4h+jbs0SHQ8m1`{%aO4Bzmei{6{12bctZ%~rYbnko|N<u@Z#aB9GIaV
z=2x5l9*`?Ve2Pdx@EedHX4e#qgM5vjB0$EV63{o?^c4Vo54!vJNoY@~IF5=t#C+{8
zds6j(d1jKJ7@S*`!{>8_>}b2%@3E>pZh6_bFL@EW4N5Ch34D&bO>Mgbsq{9~KNU+%
z9A5!)tOn{uZ01d<FG!Rn$Wf=w_2i^LPS69x-&~yG$!UNb{bVv8*b;_uw<1LV{6L&~
zk*#u<9=sd)c^^*m^BTs~7Q*+FaH?7|oZ1GdK@*jGKtg3977Lk;%PknI`L!{~kLGpa
z9GeoNI?;y=i|rasrX@gvj31wEQH*l1mizDu<{ivQ_abg{iNshr3h~oyeU?G@d_C2!
zX?`{M2+&4m_!JoZL1SUO#RyHwumWDTlyWsq7R2ZGeT7%uy7;VGi#U%>e!50{Di17l
zKQV#3+)pV1jQgqKKIbtJFZjM&?k9dyhWn{);u`mpc4GN4cl+{0T7sjYf4l^5aa2><
z%TRxF+GRJTTFBMQ4BE&KqsLBdMP5oJ=#5dS{$no)6BvombeXbD06rXvIei4$P~3PN
z=Ip7-bNOg0TR%0K(uq$azYQJx>u+-#{?oUa8>c#CT_M-wt}Sgv6K}(sM$h4;93z(+
zr^}hD978bl6VhzJ`;<r;Mw+ZNeHZLIfRBD?8NeXqk9k^#pOOA~g0b0+Q5F<oFDRHH
z(wCkT9WgZ-Qx5O2Z$@6c7Div({v-)W-MDe;t+>u*Etdym&X5~R+rI7nq3f!n{rXSW
zZnmOHVR<vmhw@bFue()hX|F0m+UprLb>nV_q6k$)SGOyX8`pPVRSp%WkmvNo<>Eb-
zAeZ(EAVbU&sLSio7GqRS&oWbCqtLBH0WucxM#K4%<*AxCWasyUk3WmJwzH^URqPuD
zR~h!!kZPW^TjA|370ZHoQo8aB!Qw3uzH6eCAeEqB50sd^(U&F4K<K%7|9W3Fud7R7
zkk?Y)9*-vCy<b%hXRGv4&6ak7EYti`#Rurf9A^#x56Z4dnhWv|yT803b7N_G@u@i2
zTTOylG-+B1k=*mp-{Hj%Q;OKWq43S2RFO@Q>yJF;*UfO3-&`pRFiVkb^?$i&>nODG
zD`A41NY7P^@dS%(c|QGt>GXW>petV)XGy!E{_eQkcBpIq6|>G3;Oymf!{w@GcXa{n
z)5WrFU6uXDD5<ls2i|G!Y9dYA|7{ax0a+DHmDlm;+SORP+0cl~&9+e5sx<FSKPAVl
zsaoT`w*9r3Efrg2TiaiZSzodKDZEpc<@B84VRUX->B7B1dWdnb;Tip)$-mpp#Ms6#
z*M!aEQ2;APjKOfBBoXgp&s%CHv_t>2p&~9}XOWGOZ*<}Q;ZKV4HThg%W>_wN!2)|Y
zfe*I5Z=$q<3`wVyF~OYACHQI|n{`J}Mxsv&3tB`;oSF=~z<Ml`83`_{SPp6DjY=da
z8HwVOr=6icR9RHjEV@^M4Kd1Y3eh1k|F%0G|JozTZh24pwY+<<E3Vib&wt^;9ytP+
zHKU2?VJN~f3Gc@{FB?CS2YtCa9khtaAQgy)J!O!{>i|ZM@F+BB?HawJDra&%6{}D}
zuO~K9iXMM--oooAHI{PActd097CauA>1~evX_8G>lNYYpzeciF3w?q6&}i*&m@k0z
zodvqdxXiX-+9<8a7Y~-{rr|>A=3T$S!Z>6^!+4&WjOSxIvh8R0D2Fuav?wQ`XK1S_
zh-wu1r~0TeNPMEkPQ4b=8rLklj{Ihrt8zYUQ%;03W<S`$$-I1&J+Nl5sh<TddS;OV
z<nPi>j_dIbDN?Du(23;Y#uMo$UN<!2QA4$*CoNV}+N((mllLb})-cdItW%%|l?rSX
zP<^UWzY`R;ZT@MC6YpSyFPCPPpWU0g*F@<AFCrzO9HV3ku$1%*$|zKwvDcymTm_Tz
z$#&bs`stq<bg*WEJn^BNzEM)NYM(6Yj=~a!<_c~)zgDSj=r8rW)k6iAE=-An395g~
znvt->Dz+E5wkjt*ZLu2Urujs&8Cvph4)>DyCH@9_gYZ<r=!t}i@A3u<@I-a2@}kH;
zNF{xSQ;pWf3u514{?AJ(z5x8$Y`EaTnE`wn-{6ruOfwx-`7aAtSp<`*k7IifpDLJG
z&?9xg$!xudVLBsXr1sp4F)Sk%7z4&5vd=}lj;`4$oT=MWR<%wozc4TT#FpQeoM%sC
z`471+>k?O>_j8Kt51FZ-_TQCMET>^+gBGti&5yzkN&4X_bN;?lmR#t^+=}r^_*KX%
z#-GO;b-Z6Fw}_FHnB<6iCXy;)8B~1slily^ln&lo;?mp@UR=@naUdmA@6Gjae{%i2
z%rMgo-f$seiTOOGC3A@!=8{FbSX+Q~Q0#-L$yo`Q<C8b;zm|KwqV-Jk(t%~Y%ez)M
zp1ZF1yZr|k&twPl({W>^H{vp#K1?jE3QVx?bNr0FLuPxL#+zGqP?jEwW(rMRi%Oa*
zsq(i=nqXC8RS~WI3O1*IfhCX=y1VFre6VLXHNjryN@E}wKIsa=YeP*>C}q$-#|PT%
zX~+*&IcpvQnc7f%Dg^o*X4(Gq0(K_%cR8Z8?MX4o70I$SS2GvBw*NKBmaFT6fx`@J
zc9`lf`QW$g>bf<ZwI!ynhc@bLFZT2Yj2bm_1?(U7f54Uid1~LzbGK!TkT4$MRFwL3
zZAL<dH6<a%`qz#7n?nZTdY3ttUte+Uxz^m)rCoY2vF&01ZS2USjK{pGs+>LS4D-yq
zS^3BFKPe`5y`=c(%{tg&I4wxn{2IFSGhLBK32gHiuA|XgwZ9mt-knZOIS(2+rBKQw
zia%K?D<eS*1aA9BGWviC84u_Xx2Xtms~?0l%AZ#4m%}%5l#x)8Bul=!X<_F6Ov!6k
z*DhSQf89!Gtu1ZR5J<YjHtzO7hED#rEAiu|4ix@cKVo1Hnn|h3Vky<pHI(WfXMkfF
zwe(RFMeuV*-LZMy9-xo1lub5DEaU#$-5IqT6P~Swb=gnc^)=jp6?9EjLaepQgj=YD
zU7SMJzIWow{>#HG^lY$!{?g<{jTQE=5<LIOt}B|_Dde}%^5;eG=eQC|ma~+?*^M|~
ztF(T#u&sOOq&9rBlH$f6mIg4DgZn0MjtVI!QPL9^7Qd~quw>p}P((+1`EG0W%z}6p
znYfzLW;IQGeSMS9LOR$Beau@m63Z><GyE@G&$X6ItTGAW&?O1?#wFyLE5P~}V|P4Y
z^UM|)*OOP3JHr$O{KtJ@cl_Aw!SUqd7Q?!fl$I*LA+9iu`G&?5WLN0H#lP|tJZdsF
zPHp+p@k6VutzzIz@A<CF*T21XwR!cx+TNGCkUT6;74cE;k^I{sFpB(PRm{oBElLB4
z?ww_EEjPSroWsHj0Xvh{Zj`Oe(z%w`XXEGSs83nf@_poaWz>Fn-bJ1_M!gBoX7ZdF
zmB(_YSd<lIY|D`>vv4n4{RQuwUSabDw47I|yLw?a*A46ImZE1$d>QDo8{?waD@M77
zsIZJ@v;K1O$tjbI4}@<{r8wWzQPZQiO*j0CG_YIhEe0J?h74yF7MVm?-b9_>qdNME
zFKspZ@Vc5kjVNI!6|4HF(+AfZkUJS_vuhk<-L>@Gkba!|6cxbBkS(okP_YLjKCzuz
z3bGLZaxp*8#+Y0-W=|hIE2rlN-tMS9>M1A8j7y656-%<+xY1vg<el8UsUlPMTKn3V
zbrtJmFJ9fcFl&ES93PVz3-YmDQ;_^Ie?+4wgxyZ!C8&j-!}?A>PtTS~RbgLubKYK(
z*{dfv;#L_h(B*RUT&|?3D0#ca7_zu$b}IfBr^e+<EMaD*Hsje$YsRy|*2s-hJI@ca
zx5{pWw8gc2*?YO`TgMOAuU`A9`K19gw#uxU_fhwu?W9+wxL2pGA-&oo_A1cu|5L9n
zwQ!rQ6BMIzdSJHFG(T4=_N2?@FLVc@=v3A0ue+xx1zAq7VY+ig){6O0nwO{|u$Ix<
z{qgqsQ~;b}a2s7-LZJ`rsN1MBmVYlQxx`W@&0MaI<@Ee0aRyV*;I&*+xfI@JmTFWH
z@Ah(8uF>46lcP(T2BPtdPDkZ*e{8Z);=F#`vW-*p4$$EV48@q&bZ+Bn3K{D3j_o!q
z+jzD%#BrDY8*~F{&*7gv{fpa>v_Wixt;N;-Q&L=VRkHV*_RN^qWLw(T#k^SYqHO)u
ztmS;gYrfFC(W!#0XUMq|@A^yl%0ce-5m}aUyM{A#NVjRgIs)?e82=AVjRp3*jXgs*
zcB&%!d<=2VT7?M@qceL{`(vmQ)4zvq#n|lK-3Dy{?=utD2bQlbO>X(>#JWpA(!p|=
zQ%-2IEme7cy>!g#TyYrw6<b?Yn608lx3uktuA8k`r^CA4x4oiHhbC3+0F5sH2uMO}
zcRGx2r8m*1o-oexmSiPT!l6CJ<1)mpvrbf47>O$;Yk71wm)wr(XDwv2mQNwiEwiS=
z^H}nHYt}e;mXqhcS>7zSh()ehbZVaD<{r+`J^}9u6isp}dbPlGgJ##&H9y}R6YjDi
zZd6kk*V^vKN!W=2iIb6UzHdy)^7)8k8plo2ajTlfDS84BH=13@>tI&s#`|naFf5jL
zD4vBKw-iYrg^m`ej{0ekLMb-)jiEaB!Lu2`Gom_n!E-D;&w*z%JWof8%t?q-$ia?r
zbGKlbhAvyaSp@p4PmeeBc(-9%=LH&mPwKddJyN0P56E!A80w8aHg#z{v;Ad@>L}|Y
z+*tzWYojFfsV=24*c)Lzkn?iQqX8Rs0X~n(J2i|hTp3DT*{S-d-v{evzo(gn@INJE
z?d)U>cVCmFME2g`lnJv;+@{MCZuChcbVK{M$?iKz+D}<$m;{-FK6#jq%7a$05zc2)
ztU$N3BnMWuuYm8*;5Y6xI}N1X>2BXC+_L)HxHa5c>_eDxn|V|>6@%qU3M<JY*LPT_
z>uhT)?_hp|p5JW?V6TC$-;L)9I@KHD(aH_pxF60+_|AvqI<Bx&ZPsCpm5!A5;5A2$
zIF@-3zkz*f6W}ecM0j7NifHYoL-QzVN#8Sbz7u?Mdb6I)`s@5M<7yM)Zd^fDIJ4%2
zKB@l(7=Jx}>s)VeK9?oNkUWYR6~K-{Tt?GGI?9_8Cj1wgWihVSA)D>WfXz9}g-ftq
zpXI_O*bIFGbSjH#CLE()%B|Vlgjz~qS0Gu<gMFeG&T_)5c5qq$Kq*!Q%=%&uSi5Fc
z?Xa!;N3X*2Fj@|?ylq_Nkl2E{7l4}Xl3ZUDj`w^zCZGGN67>5cIrUcC1mA1Wb}Wy;
zE!zb4GUo4movo<jdI0<0VDyWsh-rO-Z2KVRZ1(|+NH5ffZQUCE=o0V%AggAqC9uTo
zi(G#Zd<TZGeFDpkqI4QaS_BoIn@4@Zb3b=T>EJvG*HbC|%fjNf@T$Y@vM`+TB-n%U
zP%-HK=0>{Q8)aL38-6XN(EmM`ExkW;r=(J7i?asG{P(BxYXU?&2BAkY71Lw;Q%NtD
zV(xwy!c_Dn4)1I{rSv^xsOd|z<#&B^dpe2$ZCL7R0v%^VTaz&|rw8m0PO#6L*L*MT
zUh!VpmfAC5(1JB4N&lSuv@223#8Tm#J5j$fd`%C+^kdzt_|yv6Cks9K@W$(Yg1kN?
z^o*kL+fC1#1i$^_d6VL|Zt`}92l<_84~m~9|5)5d8?>;G4vLR_^kZX$)ag9-YZ<l;
z-1tSDOCmqUmLYS^#B|$e_6+7CZi&RAQoq}6dxp8{eCF7Pm`d9=_R|xoHlF<y<KRB{
zm^lWsuFZ$3tIB!!LuVo$1ygFW0&S8VH~OBLatwB3pg-b~qZIuyZU?3xv25oYDe`to
zD{3y6blkN{Y2YIIL6gMR%?^>dWqAix|HAuw9`oweP&(H{(0M{_Ue^Zxy>OSTrbkKH
ziYo_e65BxoX=@UoXhl;Kb-Zw34bKjArhtz7SGOGntO2k;q=WgNqk|>msa<%lN7j3w
zMlgl`RFufQ+~y4<bW9uUgr{D^Hh_>;<X5z4hM9Y*O;Va_*#vs!N78w_E|hLDfMz@P
zbQT=Zft+SIX_s;)<Jx|DyGmV*JlZy;#XDX;xg<wgcd+zJe_`{bp)U&FIyDP=Kj?uH
z);T2f^w5Xc?|<hjYY&ZnFWtTG6|Eb%J(0|hxFsTYCpB0|YjocirFv`|+d4$v;x^%(
zJ=XN0{)c!ScexVws4Ysox`VEo)Eveolp$AQdO@mMET{3C-RY%?zPcm33zE2vJ(2)Z
z<B-VX4(e%EU}e-y*!Au{1={D|I|kw1SHa50W4qKo*7jD%pejP<Gi*T+DG+TdRXMO|
zA%*<lmxsXyDwkAPc5`2xH-?%eaN_*inoKfkmL+R>fu|-D)MUC_)8wAP9lC5KqjM=$
zAIW^a`Lq-y%F_$D59BF!ec1-p?1Sjhb6|x*Wn)z8gOVu?qNU@+x?Q3LIsW47C2S;8
z1@*y5luMopR!uudC@b$)FlfA8pR}$D&h64eHMem7#QINmZ)^V0O2hdN<h_WkDr@d)
zox?ikGRLZBy%%^%NW=2QR>yv3SZw(j>;?IM*e`e^FHVq4c<B_mt@N3p-)e}G7bz{)
z5(Dz2=u3VnPya*C*qa|1sxlcu@w@G|$wki_1!+IJgz=2Tuq%X@ltK&9q<U4^5{i`k
z<}<FpTIXz>+AA9f>56kKy}s<)@>V^fZcuSo(-v;pze$pLb<O^@%lL(Br$AkTGy_?F
z0t)lIi}1JszlJ;Zpo=fi$MaB25tCZO?nPoc-^Z=*k-%Dx>_G)<Y;x~@3-qjDmLH{J
z;cOQ%(?fC%+HhV+ffoU)yC2&e_Q`FxLx)yc?Lld)qwkJSEXUMX*>x<Z$j?Id;qTrC
z$qb5L3D%KTJo?_<X%A9!xNk%F{mHm*Maehn7(_RMP9*O^a}L~n+uMN{hG*LD!0Ci`
z(p$KOsmTF6i^ON~+p+DzWyNPP9`mUY%AldFtO+(##~`f*&n8HjnmpP4t!RZDuG4TK
z4D7lLQ^QsQChRnzCb5=ZWAdkp&tcq2W!$!Mpvv>bjo<$QYBiq?GpP`)3XS6t(8fC5
zm}2en^I?0cOw-HW+1WA3nHov!d6s8V?!m&GFrO8i&M}<HiHy4OP_yffXTEi}BZfg?
zCXDkT*c5p-oPjza&DCFJ;#OAzKVct;7VtPtfLY5{e8g>OGR8QExZESaAF;Iy_%^UG
z;Qa4v#j?ZM1|&a&%dRr<>^nQHgLqyLc_d;?I)mGR`wml&TVvbXcn=0Q<}l*Y4oiLq
z^S*93rh@Grs$tvE@xqjE1(|aQm*-Nt#=oQQK(@UeEH~%cCzpx6je8pRFZ8xo&;Ltr
z`+izQcoen=dT>-X@S6pm@T~2=VY}PNKBwBmR%Rr$)%vzU&BQLsq<|+=jKJs@fak|-
zID4CeeOj>fLHria?|76hyXG0E%Uf48>yh$Xuqt}TZ81iG#ZJE%Ja*nUV;?A^RXTJY
zyeAB2VLfW#E>$5#zSLEfmy=`@77q=N?1gLhuU)}Q*5R>DEopO)xv}R0HySQjnqZup
zOc_O-AY<r2*TlZvHh=f3@jug&_cEcyAkqTfSaJWEmhi|V>Rx)>)M#&5pWV3M@m$v`
zM{ZZe^)uJbw|?2Yd|*ZI>g)Q6RrxcvW3Q!vd^t)NJzO+pe+e_+eh6$jixu8Eec6+i
z<yHU(gex$I#=$)Nr^#)w^XlV%E=C`-C7?_86J0WE2b|{gPHqu$q*Cz<SQFwiuNbte
z!DA<W6s$d7yMBh}X1lcl;Ds9)^GfYi{yDH|47F!{5txCWv%y*=%8`3V5!rU|w<~bv
z0r0GGpDt{(jg)tBWv#3z;>LC;f%6Ks<GCU?2F`=?k9YY~Md=3J*t?c;2{{1~qQ-;7
z;kpdE1$?%C(#HM0&kd~Z${ncaI^#Hh{mW~YTfc2y)w|a5(se{t<-fmO74c8cxuixD
zn+}#=W7H_{1MTX)Jq<h}<=~SS+TazI$K|l2Exs^o?|AqvqtzF+TqxSS@oZ^&%URss
zFtfHT{UM}Q{N)7LLmxut><W1vIrW3xySi*ywm+Ovv0*z51$>+!cd%S*rG(q|E)~G|
zBIu8q-1r2!LPqop@CvZ2H7|zkusIG6Dz?r;yJA+s$sc$qX@U~w*N+9=3v3Gdq_8=s
zVRzoUf>+JUr&SSmB&yjZH276*#?%=jM@gUKOE+W6CZDEac9Cy_LYdR;X)&8BHnp#b
zSzEDIw(jbdg<JP;m1JFAAIHlw<skW4&-T@>f3~w0G?U(J3-}K_CH7=`uwUKCJ`$g?
z?8iCqI22b)G7ibEB{m<{e{>A2P-e8Ru_|Xq{vq?MJZ#yPqpG~p^qQP5NzK>EG`Cxh
z<{!u|#(3G58a5$%8E@;f4F29Yuw=j}<b#Wq@T*{g_keZCx24u1htm+VyeF#`Q!`A7
zY#`2|M{x8DEA-lIY+tW3gY7<tT7tds!t$}V7<~-vu&jPT__KYIaCxz0(g7Oq47y3D
zB$g^ujVU#n13NwV&lOkYWPQOe##G^50G=x(>tKD|gl7x!B&Txg@12+6QyB{OmEunM
z_B61G!YPhm(q$H{D@~=e$9LnMRcVsA7h6y`yk3J245#m6*{Pec^=Wtv;XE;?F#~e$
z89lclPf1RS*iFYRpPv$Y3e(`(+m6@T9UG2eE7&frJzniaol7tH8YC2X;d7+n-KbbY
z<x8%wO1InqKMc^fSR_fW)<ygl7o>#D-XsT3kUXWwOXO|jt1?}L$C4~c6wD29R!2vc
zzcAb`*qsyZq^1tf4MnNjY*}|EW~~3NsKaH=Bxg@?*JNEwTk+W|-ZO%9nF~AJ{761{
z;gj8}YAKuoaNFcCSIA}mUMHT@@4tIOC7z|iKG*R`i?W}r8%e6!RcO*V9-mspH@{*8
z%YpWL(c4vbQ5EqMT5rX>*Noa>PP+N?7x1}gEPWmK<30QVF1XJLH{iTszTy(FJj6AF
zE6p5G@lzfKO8!_@lUj`UMzASmcS&HEvD)x?INJxl(CoM)7TeD-CX$9vO4AV<H}W0x
zW!Ni3EVarMsWl#BDZ69mUR?GLT=w>R%Z^frWe@X43lfb>|8<I5ac@eryT^lp_MN-O
zfJd^YfAKi<tj*#cy2=FoL_MXYkFzl5Okg?Mu*=#rL}x1xO{(eZL${0NFVv)lQH5uL
zLa#oFVKKj!lS4cMvlm_74ZeOWY(GyMN-vPVaPPc;M<4i1KKnh93s3t+xqw~j93IUF
z>ORP;>6lLOxNI3Nn_0_wL)m;Wk{iB+(l0Kv{WNW8xOJj*K>E|aPWyGs@O&q>E#Yq4
zjK?v@HyD4fef$NW!I#jmj?jSH$A1en6fD6s{I-SS4gh?%mRz#JNkLjc>@70S-OFDi
zND*#rl}QV9m?(Sm>vwRQ2|q`<`8i5#^OyYP-ExCHEp4H#bK0-=KW=_5ykUj)Chel;
zoE5L2c<sy`5LZt`Df?i&$WPC}Gr1tm>8;=w6x!pH{3e}-lS;C>$TG$C1+OQtM)eb)
zo;xr)L@%45>Xq1fgjYnYKN*kby`u1jHSxMdq5zc!`$J$46<)gw{8P*bO82|C8C#zu
z6R0;mWvE{x7N}SE4lvp^_ngtg_;vi)wcd5_c=LEHVCv~PYgAP^Va1cm;4J?aSa1E}
zU#c>N@U~dTJ!4Ef9mQH|Zfjic(ynEW=UVk%VfpWy4&@!mNe|Q9vfP2WJb%>vyH|r3
z4@HG>uQZ{oL_GTxwQ}qV7W?)nW#IEJld%<ixVZyiYo24BSyyG|7^j3joR4^|A$A3{
zG5!UQUh6scT*~jyTnRkHdpGb@eA)IaGXQHp?6j7Hr<5`UuYwKJ?P|x=E7sDq5T1|C
zwq(=>pF4TlGd2S^iZht$6Y#6ncSyvy)T44OSJ;7yHgcnT?vC1`jdHE+zMjE}YfIPI
zCiD#YubQ};KFXldlv$QfEgbiaglp}P*otK?f#)SNc<|KmQpj>8prOvEwCii-u+rIn
z>gYdb-Q6;AwP4~U3;3co57sB3qdMj?+SuB_mpe~+X7Q!1vMw~yP1VPTa`2v=%j=Md
zDIM=|+dR*yhqzqNb7ei3(;*dcDlc$vc%D0sa@#%6jSWzav?3Sp{FRrX&qFHyZol|I
z;qZvY^V}RQSOh-rtc8`J`T5UJ*G|Xpjh)s<@q6QGYcziUY<+Dke*f&L+Nbe*!+Nlp
zW$VQ@h+YtQ#-Zopm1tk55>_w;+c*%I3f})dUR>sBpADU-EkJ{@V)Y(k!(G?pT|s=4
z1eu<m5>rtaQfSv)jG|&i>aed*9KUc4rVvv$)NKK&70l)y?0f%g{Ypryb*iclqK8j|
z)g=&U>QbG+Z^}zpCYTSPrBz{O?g>VMH5XN7<r~}>ZwahvGA8xkBnlzS1h!a2ABGk3
zuo+IyJJCri4Now0^x;&fwHMyu_x0ZQtW4_ZT7_H<ellX(<2?#_P`$YpW8x>UwRDR)
zZ#yGvF=uekVjo2^7f11a!WAo0^h`(GSQh;K-V(q^Mmoc+=vN}4Zw><gIqKnaoR7DR
zhJ7H+3^do?A-f$Kl!V`F;H00=zh$SbIexChzbjqJJ~$ca^2237L`K&1bFk-0QkeRN
z6j4evl?9t&$CaIm4%Q2Hl@i6~o;x*B4z!oOvJ>ohNsvaR7epmv`&4>CW%8r2=li{K
z<6li_100O&kLSAd0ww&K;WyMjJv83W2w$nHTm3ROE7+b5d`#a?CY9TEMFMeUdZ@i8
z6ztJGu1Tka4p!nU!SqtvVd)ds7{D#Kvh#~tTvk@%{YoY-3)-eoz9zwEKb{s=!wCnW
zW15=|_$72qyB!iAguf*;ypAalYgbi&?T5byz61dkc5Zhp1$6lRnkwK&(0f+Gy`G*P
zuuNTFe=;-SV68ao=MD_(OwSFh>IID{Cw+QQ#O*M3gvfip)l9?f>D3YGVPz5ABDv%}
z9oG`dDpT<YsPqw()6sED>7wJ7Y!k#I#oC^h58{2HSqsvh6pMT9&g3WGTjIOq@Tqzu
zXEsH1hRut(?WxfU#!+Wk4Kkk_)A8&91#@gDJQBhO7?8>xxV^Mh>L)O8YA^8lA#m>B
z3jU?j`c$)@=~K;%=u@c|-+|Mce!JuCCb5*&SEh90waK$GiJDIcU$F_VQLtk8RY!}M
zpZ##9R!~j?FVo37m}TZYjAMLefyFhyW3Gr1@&l$0$IDTF2s2q=78dw6v?5oWkF`I5
z-_7FXrZc%Ka>cyhAu*>Ma+(*4d@ESSjb|cgXo>NN)X#&-4~Uq|RnP!6^ie5QlxzWB
z3Z@R5Sa-Y4gWJ&OuFnSb%?Dgb(TgH(Wvhr=(dxlvdPH2l8BT)d(noWoN0Z#;UUipy
z)q|_;5^)>82T!5dfXf_xLBtJhaksz4gUjD?)B7FJ8wt3wqiG^;>W?Ds>K{G04L9BN
zegpK*1YGv$t8RL~chmd52ba0-ruP!i`v~BAedD3`J2$=Gd2qFzZhF52dLIT{`8OVV
zzjf35tp}HHchh?j=nVs0?{7Txe&eS18xL-S%}wt)pf?n7M}6a=_p+Pb%N|^&#ZB)S
zpm!SJ`t*9}{n}0M*B)H$4{mxJf!?Wr>)Y$0_bWHOUwLr(@7(k@0KE@DAJavf-2DB*
zP45>T+=g%5^nMET1_JKrqOETJUU1WU!GjBNIb`p^*8;th0C!BUyWEa*ZhFsoaJ65#
z={*7TDtouO>;2c={4d=3XCZ$)#8$;s<Sv6%7w=X5=84$3<*^?Qr>Z$IHKgM3hZQ2;
zBW}F1gU4VjUL121;>-R?eQ0-F*o)@~+neks<`3-`KluDyEy=&W{*s%H^73QLOy}>8
zwUp0AYTByo>L4F2e6yip3Y7E5J#y@?Pc&30G2+CAYzw@LXGBB`Z7}{;3pHgAYoQ(;
z8?WwkREOU8tWWw|4N)x83$nw53SH%3#&RyLNy6y<#&R!K-u24LF7#+cS<7dFMGCKt
zSbGh*4*Q-?m?!1ax8hm-*x91Z)6ecs-}k8%$^>7V0R?+_P-v_i1i!=X4hgRtWVx%A
zlI%U)^JVz#1)n;)LWqsWv#Q|zLT19qx2%M7WHr9GMtKJQ{$yj(mWLam#`C{Z<1Zaj
zQsYfh<A0S&zR+z<;I3ID*3dwhk9z9G=!|0f2uikqC#ze-{(VZ69b{ctAIR;xuzLfq
zGn|J$AbsMKn!U%vC!SdDAP0KK0$&)drnQvT(0E`2UIXshpvZSPAMCO(fOj7%N;O7p
zV}`wH#o8KI2Xf#my=B-}+ADP!2Rvp8O{vKQ>-GPP#jXnE_){lRt9VNLKVcFtTvBG}
z^MPFPh0=9Q%KwDRq>!^2(h_??(j$`^>;;-x9zNLh`b5vOhfi*PR36x3zj*OAPcC)W
zzU0m?e|HNWCux7>o@9`PtWXU&{-e6ipZhZdmXTrI2qJJ`omI$U_TYSoPh7|hR`KBX
zPEuFn)Uvd+%uBEjtY~rTS>pMmD7~lSu>@4*h&}~4rVHXBS`61bb%=i5B3*1Lq012u
zmNPqA`6R%L)pPOpo!_0{`oJT=jIfnyq+LU78}gfUL+q)>*g$RvL|(jg3S@?0G9dM;
zh<69=1<i9r9Fs1P1N-)1=MXMQJYyylRCdG^+i(wg_-U^TT8_CWo-A0ww#@lE5qMn_
zo1MpAX1`dF2z}lr6iVUbP^4}KkL$($!)KbY2k}V%;TdL;=S&XhZDj>n&<o>~aF$6w
zw$2FFW#E<tM!xZwd>eR-nb>jkaXG>|9z6@9eZBX|Il0Ww-kda=V;Db-330x2Rn_3%
z3cG*U!!zbaBkatv4}Aq_VgKw`F2_As0Um<(Y7Ime%1<l6*GJg^sf_j)d-ESJ;8RBB
zS$H3H)?qkXnhKgVl#p#vMf|tal7M$G+Sf3x7hi_>J}rZ7&}Ge!z|6Ch@uuRy!?It1
zh#Z)$b0Md>IdyW2F*K(i)6Ctx13E(4^9pbV6B0Y9^A>pn4S7sh(FLNnmT6{G<=Fnj
z43x0mREfn3bgLd*!l)j)BegeI2dNGmM52H5uy-@qqSpiick#Io{?`W9=uyaaqyM_d
z4fAx&F<XH5&3oDpHf(!Y{Hs+w#L_zESoft;aZlGyY8lzzSQ~=*B>lh^k!P#dS=w;x
z+rUbc^y*mRX)nrx$h{PZ)r%h?A;TjLpAHzNrH2OH0uTJ$o}rALf+=x7r|3buJ`c%-
zSZgR3;t(`2ie;19M48D<z%m1V@ws9yzX0s@l91f@+}Qklz#bKnYXL3JcsO{ah!s4~
zuCMcvw?Ryo408kgVxGZt+?CF{=S#+){yj>H{}qzE&s}yy6qLe<bciDYMql0Y--#)h
zE(nuH>G7wwraSg+jiS9!y84~1>8i4=ia#x)6zK|NyN@1(aY629Ao)R_{BV-bdDG|~
zd~bR%y?NhO{0;aeyEarm@D0N2Vk@shUf6#zy}EMi-T9oX#ZhpMj@RMg_KE$_*8YAD
z=(O<VUZs;Qb&PBWlqjwRAnzc@KieJpmwr1lT3HsIV?lS@iciUfoW-G~Nud2~Elmc!
zZfofa=>>^ftt=&@bl7XW=#*87SiuA_Bd6@uez5}M@D_VR8w|7LT)HC1r#Qw!WT*TQ
zh_9`Vj~?bE_YC7R;*?&j@8RMYWjk<B7V=O9kH4s%JzQ$r15oPB`qU_vV);<89^4mr
z3RGE^kAY{2|EZ`@@K|IUFG8vpB~!?rkU;z=kuYXD^Ts#P#-?CYBRhfulq`4+mVUa6
zvF#}zRCsy8zCjh#i~Z@g;u#QHq%5+fhx%<T>Hr;fYthdF8w6T#=+^XjzpYrhMshY&
z^dN_xap^dSuL7@*2s}q-?F64_=)bXz>1CcCOs}?XJ@>n#t#WoL7oBPiL6Q?36Ds6>
zcCqMFXs1k&=}_sX24M;tcuMSL{wwf6e_(h%z8&hP<}U=uoOgtb?lEmK+z_;ob@nM<
z>47+d&m?@zW0rOl?(9HRFvLUX9#b~neY=f!d8y#To(^mOJ#+r>>W|Ccbph@NQ7hh&
zAQ_!25%x>KF1!jsY!;L#mSKjN9I)>HP81cs9Rr`s-g_pCPigfNEs2=hsi2XtXm@JS
zI%A`W0>3fPPrvR3eYIaD?dpH8ewXh3yqS4iXQPaYee?{(2KNc0a{5!2Fi#p!OA)5;
z^w|JY-yH$B_|@+aJol034d0>1l-E(;PVA{cofg1p#vp)ysXmHgrgP>J885YMh`m#h
zCfn4W9J8ikjco1J*A{NszeTb&1;#q`I;+w<!P1h%z5~Bz9fzD=J9ON5r&M75Xq5ry
z1<~)2Up=kLcB1jIHouUbENm?R&VKPD=IoX4mcl9&ZMAKU?UPKxzO`res`TDyr4@Xq
ze4QxFtpleNDPfgSFm00{vix}ktEO@3D#K6c9Ya4F8#~FWV3QzCLp!Zt{aL`Bsf2Sm
z$D`bLl~RZZI$x4Yyvuz!u1Sg`FqFVuuyh0n5QE{dFt|3CnArG(Z)4mn9rscb8pce0
zawMi_#_&+b?-Z%y{p~@Tg!Ev?hp_epHxqb~z&Zk}2`nS9fIvNgX#^$_7*C*vKsA9u
z1o{z(2y|4F@(H|1U>$+g1eOt4K%kz$Gy;<dj3-b-pqjuS0uh1D^Ki*%CWaTua~*-z
z1eOt4K%kz$Gy;<dj3-b-pqjuS0{s?{G6{6dCzKO-k-$0vs|hS4uz)~4foTLL5g1RP
zhCnreK?M2{hzN9$8k<G>39KWqn!qvw3kcK`m_}d{f$;=t2vig3AT;}tG7*7}#|Zrd
zUL>%Nz-j`^2rM8_Phc8>Nd(3ds3A~IU=V?R1R??*b4mFGUL>%Nz-j`^2rM8_Phc8>
zNd(3ds3A~IU=V?R1R??*;iP;5FA`WsU^Rhd1QrmeCoqk`Bm(0J)DWm9Fo-}u0ug}@
z!nbC^w~GYU5m-%N8G!`^>IqCEFp0o;0yPAx2@C@GzaPz^_l+E*|7kRvmW;$4F`CIv
zw){`xXfAKE2PI8RFL2^9SI|b_B?21=JWOCYfrSL}1ZEJJLSO=cS^^^p3?^_qfee98
zJn{<K2)smK1A&JLEGMv#K%T%10#gV~AW%zSB!R&MG6c3^nJr*&pA=jo&kY0~Ca|2q
zLIQaLGYCu}Fo8fVfsq6T6F46COaVin6OXxqHUcjZ*g)W60?P?3B#<XCgTNF56A082
z7)f9-f#V5e2y~Jf+eG>aY#{J3f#n1i637#nL0}4j2?S~hj3m%WXdX|>WC(QPF;~z=
z;3WbZ2s}(+Ie~=)@&slOm_lFzfm#A12@EE1Jb?^>PCVuc+6cTvU;}}N2`neDkU*Zm
z3<6UKOdwE8U?hRT1db<=A<&7(TtORwmk4Yi@Gybp1Qrs=6PQ6@3V{g(Y6*-aFqpvc
z1Tq9V3E$cX-!2i@K;U5l%LyzbkS8#Mz!U-#2-Ff7NnkKQax(K%r4K$CU4A{c6~~U^
zb5R^Ss`nC1?L!K-nLd)ot?ltHc{Ui8nB{W=0wUpzr*lZLB_CFJ#~8V8W}absfSh?u
z=*k$ZDS=o#W4jFe{T*-Xg|-~3W_Jp8aC=SHCWt3R(u3Pw37o!P(l?ja))XdCHEgv;
zu_6q)#^cye-cZw~r9kg<)E--kZ&PtRevHz3&QbT@6G4h=*w8PuNk`OhaJ!HYhU&?A
zUPeL->_Xt=X-%ci9PnURdR;tY#~uv$od13ErPDL>v}cawUHYub6p#>%RMj#BF}QOB
zN}?e4MTRnqaT`_DU||Usq>eEGX7;g~-O1n$VE?6aJ9s-$ik=**MF(0l+am$5iCdt{
z$Ed0yT2@^JrG1MnGj~0WMIR$_BJZ%@1it~PQ=-s;NBm|bDzq_1#VbnmNiNT3eVdh7
zqwGOhJ9f#unWt(6h<JzdSnG}$Zzcg+mPJ|zvn1@}y;hDvW!@uoE}xb$D4rRa@<G&L
z+0^84-bpku@jJ}*52BnT-KrV3lvbJG>oJcUX8j?~6+L2Y49sx*)`FcAPIj>!6FdN1
z;7>OQ9%X}2#%MU18N}9^shhO06Q#yZ1%G?h)Q<*@p^FC%p{i+s8JYu6AA|yK2;c_)
zb8r>$WB%WkS(4}^@p}i~jvk9+_olYK0lrNTQ#HO4ZjyN9aCywsWGWc9Vk9P`8^#qe
z6<X&IV6Xl?>|xyhd$}Ty@eOXq#9%}xVsGkjzC(lUogQ9;H^~^}6`lGf`#}ifFBHls
z*N*URh&P^a1RdY=LCB^1+PbmdwhSpE$KU;`J{8XBO+7;&gg9l2%Q7nSjT$H1$N`$7
ze>AS|T<yr7$2a>JN$q^7%5P-<PfcdD9!l`75u%Mmq#OLW4ufqgvV4S(C-|*d;oP~V
z^1$#{mLs4M<;GB@tGN6oRJ4vufqOwVaIaLNQqES~G-%LGO%{DO#d7D=SMddFyw-CY
z8YHEea7&2zz03Xm1}>!$my!l?C*=F>E!*2lSMLUUPifnB+xB*`WmA(gNTk15ru>`|
z=mLMz-arn{^&sxfiEF>>Z#^+3aAhEbV@*x=YVm5rv}675%r&gxVV_&j>j)L?U8Soa
z+N~d=g!)0N>xWxS;Eq}80K5;tbMN95@W}Ck6ZrflAE2?V6}L3g;-(ZVo_?7S{nIJk
z#j4bOeg>UtUY~TNu10CGmR7o@?>mLJv_CF)8AR{p^x^vwvMu{`;LG6zUm4b~o|Cl6
z0$3hVao9J5hH_!F!8zzb=~yVa(=P?IDZm=zl(Zx=aolrG=~7cgu4wTKZgB6D>f!V~
z6Vn8qD|czKP4e!>WxWMaf^t86CmW36etYwV?0sO3V}SnIotSzjsnK8s4Kk+-*`n+E
zF}`Z{X?NQmCZ1UyZvZsWavEDc*F<8A<XdMg|Ae=Xax_%zoHDo(<OWXV()uK&NsN4-
zv^3q>qhR#)`|tYg;TdE2jnd+G^9|@*VgY(^Eu0bE8nz#}?H42u%P836n&BRoZ#~u_
z&v#;8@KsoWzVYPYe#f5Hxn1X5^%LLEnQ6v8);n|x)1@J9umctAxMqu64{iJ~PkMZJ
zsRo~O1HE9^e7h^<)^LAjCg9!#z4-;>EHijG$XR-pT(*}zEkFbq$j(2(BJefHQft4Z
zk=Q4LAl9|tFx?|juxhg0Kcnc9ram&SeQb&%G06&6I`9UIZ<yj^YWB>c@Eto~LuVk`
zhJibK`s^29KRrx^hXxvMEHmCyzuO`KvMkomPKmZ+DIO`|VovI0A`jS0Lq=qO9z@(@
zYX*z~5kog^7nT^--BQ4U7UI^;gERWOSRLc%fD{2A+_Vrr;Bv5a<Sreiacw67>p#@i
z;eX}iaQ{E_5=cPx+Xhb`{!aflLjNE4<U=1`x5_B6rN%Xj7KM&IqMxo{2_~Kkv&^_p
zqf>kt94mD1nMM>W^Ea&1)`A_?@xUS9hQN#+r_PWO+F1+U(zp7okp6y)H9a`!)@gw1
zTN$;CHl>!*Ce;3xGHpHVVX8fpiKm3(sKFjIGtEcL_?DscPz2Gl+%~85VWY4q3URGg
z$wBa01#i9h__1KQhg}4wb9ju1ekMC~nF+Q%&cWF)8-wMH`XxAxg)c5n#U5o}0JY>^
zOh3)DI2Z20c*^!yra$9udR-#!1?W+R4uKoS_z)BRTK}qT1=IU1_Vgby!n8+W5B9F7
z9hkQs&pX3n-`Eh|ptaXMaD$&F@3id&@52!ut>P$b0Ioe=HZr}q9&_u#wXQ^iz-@6#
zaG5wp@1d8#cYhG<Og5_oc+y-cF$BZyo^_9RK&<7U{01&Vw76q$E&P^2?C%dPeJ~EN
zelBbisl#O*GW}zN`sD*lj^x<uh6cFB47&GDj*<OEK?{EDnbaWCtE~ol@1F5O?D;yY
zH|{-rKMtCBBqxut#Nc&LmVTtLDEg3TmPKMR=t`SCeS~K)d)*_~s9=Z+N?-<WSRago
zeQeza*Y=ZH59iN*E#j4bY&ft^{W6TA0ejsA9&n#$`m<_rI?%li#?64ey7sf-Z`3d2
zFYMJnUL8(*Fiv1{T=wb*4&gmnY4dQ-$o9G0RRQv7^7NzFqG7LVJRgEQs)75rG50eQ
zIExd}S{Va3V0wAlHhgQ<yqAyJK!V+JRyPyoKL*cK!t&$DSGOb2?x%m9X`ms+2y<6)
ztKBaMZf?br{MTB$pT=8!UT@8USk;V#r*LczkvV)@R24*w6*r1hr~Dnx`Umc%8ux=)
zcO-|~>6CEIR>`sY2iFolG;c8dnh$uKaC@AH%p}b_w-0j&_nG)6t~z+Fc^%>lai4YG
z9Rv1@KSD&<Fg<NWK+kOtJszq>TFduh4ZxEpj(E{80OsC-8D^&b5Pt~bQ0wk5O@6CG
zoPR_LM9)AEH=8HJT<?N$72iA__SLQ{wF<_s{z@%An-uRh()*>u+O<!I=X0*3a)Kz4
z6-&ICS%rbohjNa<9EW)#?Vp<qYhVxAGa#q`iA^7+9eok6MG(bL)+f9oiSv9TL`ZiH
zP}5;f$2*<@ag7S4OA<Y6RH$c-at*IhA!Ln$Ncn!CxgTi0_{SeTw;Kh6qyty$-gXY(
zc!bkLscK$DK@^l71tpEdw^#3cm(rfD9j3k(PBdW0Lpi;0El@-C&a#nT3}ZgfNicn!
z(qHf5#1>Y*KW9X_kGB(S@Yy}_;?Xo{G4KQP1=g&)JTZObJWTFXt$V&4_rYXqW`eKV
zUcTcL+!wZa*WGxf8T=uBR_^iK;nN5_1}QSP;n>dG)BJATCYE;oEPR>1qcPhuxqiPt
z_-e@a6@0Q=Sx)TfnbJ<_4ZCB^IdR5hfM4R1c*Y0%kExrU+8XdpPc-rh`11h@V#E>m
z{6!S-=NBMWymY1iDkgLv<J=k8GDS9pu|2^Kc{GCm-ItgCKYw}ncfQ0rD%Qavsxrgs
zrO0Il6tBnz@GV}PZ-sOgPvY;S``Gp02@_a};Z1|i&`t?B>H^;B`ZtTO)`vzL@d-)s
z)qSB;@DnP&x+`=nJVn8iIaF?B^5u;S3dL6Pq2Jfe;tO}&xU!qW)`lH#XC;Ow_MnWN
z+S^l;XB1)$fYP3G#{z<k(_tpgIg+xhKLc&3LN<$s+rDIsbP8)TvqSi17JT|(coS}A
zYBvZ9OyM4p!syU?qtJ~hoD#YZKLK51LwCUwrcfSgHuCxA#<^|^nY$GFb6C%}qDwn%
zyE^)36gF7#h=4f-^Q<WayiJ|7Vgi(Lp+?q#=%X@(Edd{!x;3ulHJ7_lO}C6P->iXX
z(<x=Uxh!RIJGiYuZ_nUyEAi@jAFE*Sy-ZCgdqS4hl?XnW@EjfasmztQk36r8+z-#Y
z$n(a?H{sb#o--r!WZWqk%8G=$P6^jUy14Ws-ipN45SK8TRb<GZH@oTM7W0mW+i@>*
zuUftEtt8XS@SX77ts`F0zdSRrk4^bM_3v04AL{90eEtS~3MYfOrtr-yg-;Qmy1kFZ
zHQ{>S0v%Z7LEj}TUmyj4cO~K*+p=~(JT#*)#U0DYZ8_pCKwH90Z`^Im0^F9Luv~Bs
ztG8=8_PcPm=G7x!AQ4apNW``#@Z|cxNyIK26Y7x(d>a{-)?IHy&o*_#nX-ef>427{
z9g)~dn|h}Vx6OLDZC?ap`I$iEXKzRMjKTzWyc~{nmkoHVTv$JYdn^}WO$^6XL7e60
zu@@u|M<`mRJh5+ayd)Fbrr=V~!J52j)bu5A=R-Q&H+2SXvr(?4BDE0f2W6C|L-d>l
zP9qJ^xbQn!D_a9tW)P%ybI%w-*359fv`Ye5Ev%+Eh0$`G+tBw>;I}+RaX8fN@#V2V
zh;wtt9Jtx?ckd^}XR>$}_1sONg!U-powHyEi$n^i>%gx?*@g&(kXoAlYo8-gc6T(C
zMl(8YYYz%ssW2(g#1@sl5uR0g7L`U9pK?W&){C>qZ}Y|UIV2tt^LKeG<}kJ*9)TDK
zV~h+P%6s3e$WS8gF9kl_cA5Vnld(aG7Jxmk&Gp!*<<TW<0Fvi(|Fn23ypd#$9ioT9
ztC-hv2D#K&30ktlDZy=0<SM~>cp9nnP2d{@cjy6iIKKpZQi@Nh%C111I{4VLO0?s%
z1tyyy2YcNA@Rb{{bMP_dzoMDoId5_C1=5gQZZGWp;Tu;3=7LJy33ce;mMgI?m*dg5
zrW|-Ize_Xa)YIp_%>im@h_I}sZnU)jo-LDFg4;uBonPYC_|}T}hQ;Hp^Tn?v)RHN+
zxCML+*V`?&@ptOQ7{zB@QL3^&pzQF!ZP&X8icj%6m(>+<@@rSbje&BjJfAs>%V%zc
z<m2COb6gSFHx=89hgzJy#?QQwZIA4y6?`$KL(*WCw-HPU?4jU2B$v|4ts=!wAD#q}
zP&f{%q6<-T&9mNEX!;~~rV;L4MhA5qGwA)!80moTO&FK7YE0LFB2x$Bvekv7yrQ4r
zd`8RP84dfTScU9s7woZq5F@1?V}dC$?v{!bMt8Y_pD5Y+!ob+FiZ{YvIYr;MQ^*+{
z3jfn7noIv2{cTTxOh&)6^ZcM~;{~t+>)?i|dR<6v-~AjKgj0J&3)1ePcgA!Na!BrF
z_)ORwiVE!ldr_ju?HYP#XV)MV`>fUWS6Np$U8lj+W?FHrU%OyuBjxnHP==q(R@&PS
z5wYy}0}9ziiRf7mI{EC6;AXvdd+m<b&l_ju^uj)~&loA~qajMzH7g`{KG>P`46gf?
z+_!2&a_7|I+vM;aaz8bT_sN|f5O0%fZzZ?M<;~nND~}t+JZRL((EB-X$5K8UM#Wmd
zM-AesT#8Z1PvPSjBgo?=oZfpJt@DLjtD?rxy2(g;K|xQ38^EG`aoeaTIIw-wx`*M$
z*oP7Gguuez!5}FLq<G;8#K4&YqPa;J2d6v;DYj8PgK(3yOL(PwOu3G0ZwfN#%C$JZ
zWKSqM`S+4N6Cf`BGQMq^;J_EZTpAQ)YL=s#MhCF$9dYK;OSqrgk+_@A-RI5DvP@ir
z^*e>H0!AJDr5{!;<MP{~jS945h}-TRDBk{t?|!Se=k~Wa-g^zc{q4RTC+kWzAo)Yx
z;HTybdLxXu>hEF1b&z*5_h`u6Q@7R#zCXSRRy-quU(dBto$W35y5Y$hrX)I?FM(5s
z$M;v2+A>RrM2yOI)w`*bDq>ULQz!qYvNNpM2XTrwCzVaW@?F8d1o7p`-O%qfba+nB
zWAb1Mw{E_b4uQM9AO~*Zr5WA97>o&{>Kw+J;_bnkWTjVo@cg8du0E!v7S|wt=_hkp
zG1moIoy=XYq-mTWi)V2ioU~~o#7D7$m!FKIn?}Pk!}&J(jI2==k=zX$NDsO7(ec1%
zP<uBG@1WNaTHiZ4qJCNQNNT{->tM`5(q1<;Qr>FNO+N|p;->_js)BmH#?tBboBRsu
z>cjR*xX<!S!8fPZR?L1)#m+xWR-{VZ7qFulV@v9}D#(%F$L2mw_9T4Yf?=`y`wKOE
zu_l};0bjV<ZB@H%oe@LlK32|x)k&6{@$^Y(rPR|B%qKTLkFEueQMe}y+Jt$^_@>m*
zIu&p%p5>S(*gd)VBX0tKD&P+dzax5tq20ar5$+dHukarmAM{4Je-$z*#BV|$Bmcg4
z5Lo<3U)S!&*ti!DqFptZ|HG6WjCsq7Y4y-3r!#9Y2IeL%3Eqjt7vBvmYO_^ld-d~g
zhnd~}s2A+bJG(g_IsDat8U{E5QMjN7_h61p8xnDtbN1#jJ^Sym`etsFbz!Rtnutpl
zcPZvGRXI!f8D_9b-@=wR(1UK{6npa{xAE85{t&`nO~y8q;k6j=bYue%x0|Cp1Kjrx
zJABCen7JJBanu1Wnvrln!mZ}|cM&fIUt72l6!saQdwt9nYizp?4yyE0bnm)`cR|D2
zyBL)Y@#qazX6SoTgZBrxq(ZpWn}?EWOvQ-PFcOu%66&xiirx1dkBs^YF+1VLkKq=J
zyBPDw6CHtF&==6F{&ZE2Piq|Scg_Dgw7&(;2T({ZwgV9j)baR%D(rpSypz~}77{+B
z0Hx2m<HXTKpH}?s$P$UZ3DImhFg{xc%=w1J#T}TBn1}dV;28K=!k)PXe2Tw?b-;!1
zEdqO(<N1A_Jczky{^NHezxr)E<R6Tzb!0p2UyJQ9XmLw$$+ac86^~rDtJT4i3GMh)
z@!bKxX8+cS*8;DD_6@gR_|s$0&B)!Ks{s3!DgsUq;mZe#FcrZ-w=xn_UH&-CVm%|v
zxVHpV*hd4C&f)q6X0b~w>FYsQs|8OvB_;;7eI=IGFduS$i6+_?oPYse=t#Z*Yf@qw
z++;xJW!=u-#*oZQDFkZ(++lau8h~#O(ARScCj#49l7!rkB>FAmJME{o;#=(@8UoI)
zjMmC`s^BgNxTPJ+hx^0#?gDMrYo)m3y!T{o>}i;jSZt5tGOc&_(c;-1XpEYD>}WVW
z*v7$WW5Qv?n1`u<v|hNJf)tinC=Bkw@JdyHZW*4?hQ^*Ud?wbkdmZRVmJV`n%+zG(
zPOLXQW@?AKWIE7aci@sdwBWHJ{<Vr_&Da(PS_RypjV;>n_fisJwv}>il`>A|lnJJ;
zA%z#*<n%-h+=Zop633P;*cNU%fNI!gP20`|7VcUX;<{VG?(Ia}wKnh(oCvoy+3x>*
zzyMZp*pYtJ2kWIA;#sFtxYtJBoFBHWuQqI(LDy2NfZO8@x_Y->7hNy(gdkyP0xCWw
z*dGBsItHDz&E6QueR$S)se*RU%pZ-jSxRwfHd4Hr0TBY9QHtJIkyq+Umiyan#I==6
zc4YH;CExT?!08<mXpuuT${{3-c0%wj+}Mn4L)L*nt^xGzj0uX!3FL%Uu>TRQ1npDo
zk(!<{RE?=8T5(v3vTDVfSjE4qA>P6|@^5RLSPwVu?O>->nQ=V)0vI8$U-!h+b3a>T
z0*<FIft$tPFISiuutAz|E_ZXUv;yCbRs~l6vPa%?$J7UlQT4WUT2}?E2xiIx<3-@h
z)7|4H2*wRqUH|jnh=9M-BjetX-d~gylB@8#NW&^5%}N++H-^gP9M1+)Px58lXeI63
zX|_*%X{C(0Py;%cz%&i{ug1Eu?d79`fosK@nHMn?V(r?=FwQ=RwK{*nUv2EEFi}qy
zZD1a1Vb>3lvQ6xS|A)PIkBh2W|A6<NnZ1YMlF*1iSYikym2pBP^9ClMre^*`(^Glb
zBB^=QgC38SCunBRI9voAa6mB8lZtdIl@z-eq9Uos>q$|&h;9Kj3rz0U_q+C<Vb7S;
z@BH3B-oM^HA7js6&wBP+>v`6*)_T@+;bS><r)R#pvj_G9&CJU%2$^C=J`vnlHs`y#
zQQ_(1X|6Fvs|z{Sti`!%zUx=USy3POB%8mqXw5ivnJ=W7{llr+Y~4W>G$(p^cp-+)
z@N_DC)8n+3X+_j<#Lmk3g$mvDsfBy@vWjaz?!v8tChf1y3a;*!ip#jgUU%p8@2SZ+
z#Fq)p$Gf@4N=kV2a(BU7%HbZgu%)tdOtn0^6>muWtMEquwjrBYLTjhcbE|zmR#B{A
zdom8skGVtEv_17@^JC8NOZe;V^?RNx6EffH&>?Cl*WFH$Z!vBo%7nzrt=CHh;Z~>c
z;jQL%*kNg0FeW!EU68#>ofRYI8AARFA_=fZykSq}=s4>*`#@sm4L&sAbqXS#^48Ih
z@0KW1Gab80OVd|&?SIu;PmT8HoGy_|f~H9&L0H#&%-2iy86+G#rpi=}_W-_)t4qi&
z>&#BsetJ$Tv7TOZcgd~4;MTPyrGknsM?`>zIE`{N!-l5lM&le{^l%}O=y5(!@{@lx
z-q9<+(Bsy)ljZ6LtABzo;29DvsbTJs(dEAy?iiD!wJvRl!Ddn9CUEy}E4cX~%FKD;
zoBmCW+r+(FiIt(HrzH0WDkg_pwVUGpzEhRG{JQ#j``**KFL+9*p54Jj|EZ|N(uw_i
zThEu6&4X#7E26F7?dz&5_hD`H5F6_oZ;xBHeHmFZO(!zrxdd=RzsmO9`NI9$_HX#;
zQr#Dba~eOYqa<$>eKJq@b@u(0WwTcr8p)k=lJCh|7pl+PB=NoE(HN5A9u;abvphZB
zAdT-1SP<2B>4I^ai-^v)x6w-MraJB41gT*6)IsC`krjv)u)9}M+$NI3MA1`xMq!0?
zPiwaf#>_XFzPI4FInBM@G7^7N-4t4Q|45mcf(>u-mn=7UPU}IP;S0Dk2Ig7G7clE+
zEp89aHWH~qzGjQo0ohbWz9_87@AL^0_YW3Gq~8elCQr<s$8BIA!F&ZZrB?h)A$|2}
zMw{P7TV6y9QkJkjqfygi*}dF_u!O4nfhyVbBeWVVJqIkLuNMqc4GTc?`nx0&S;pOh
zx58UsSLUaFOxpq-OCPnbnMqPu#|?bB{7%7JqAxsiSV5n%zVAW(TLo`rrJC_Jxe^|%
z4fS<*c&W4kJApoR(ld|eS853cL?ZSkUiE64;O8D!dzxF+3X3Q|gX;1s$y<VFxzLM8
zah=fPM)o{@a85h!RMqyhs)6^)XVti!cX-P{!~e=Pd${;t5xM9m=wM*gg!mVp@K4v*
zdEyNHh}6P(oY<cGfy8SgwJbPgm<_?#OqJ3T`;(1ZY8vsqE4q*qc5pj?u)!I=x532&
z?zyTz=5%?4`8#OucVv9jwAU#zn$~f<4gR=L@D>>(M92M=l$_pA=)j00wd0VCqoM}m
zeGagIAv6>oRp0z#e^#nAw(;i?SGSfx?>;2quBauqAR|hpUo|(;-hb29Up#)ja_aOU
z`&~NaixbIyvTF-cKVEM693!MxsV#o^Ytk$`37U<qoXT$ltv-XVoW5sWlf0jZ#=Ity
zOO{)Xb2SMWfg<nSM;u?ymGQ+&ZDf2cUl7c<d!V=S;<l>$k?0%6>FH-Bd!&S(frYvV
zV^4Y|w8aHo-M8o1kM%gwZ$pwPGx;0u5V@k<HPNdpwrCM|r_S?NwDvhfG+bSy!&@@T
z5$g}P4_ag+3oPuSrozv!l!i^$=N?qxLHsLjgMZ;Gw{3F3oSIJ2p+cRd)$%XwDZftZ
zVkTSX+xKMVD@)TEY4(q?_=-7A!e>=cOzMcEBwmkpW);0?lkb9(em{VYBqB(t#p|>?
zmwb8~^G#0feC@Z*$b_Y)bFcd@pesWWC%KgV$s%Qh;;7BYrXWZ55l<|gqO|y1erwYq
z-L7<2NQ&*z?eKtvTY`R`{WS2SDe8Nr#Rjb*-MUj@?pXQjG|K;VWxre!e@iNfKZz0g
z*z6is9>2e7PTYR^ZdCT$TySgAP2_&Tof{%3sW>(Bn9o;`Ic^`{)P=Yan)zBxgocAh
z74zsNcC3uAa!9JzA;i3>^y@#LKbsk!J)fT-#@WohOnsTlycBBen^59&pVA^92x920
zz2wd{_oKO0u-ofsb??7?zPjeV;t6DgR+xRBpnkJ#P|uG+yraUh!^)6UFWmtRYe~U3
zQ|=69LbSN?!cNVnAGHr~2P}cl{EYY`h^P8zX5uAr#jF1zG;Kr;GElL(^Jbq)j>*Id
z#hiqHe@{O2za^FqakpNAS((qMsl2*^g(co!P)Bk&U6af6MgqOE{fjdauIDa?roC~c
z*dXQVSv15V%CwsAtn=#t#&eTLk??-=Z$ekU`&=WUO#5B>4e^5L{!4|vt-o2}&s)d;
z3&5KfzizvUm3=+8zrBDT_cl4D2?J`Ib(m=dZwZ^5ni+NA=Qq1|rY*w0XMRjAJUie2
zOjqho)pY1EGP(1h`F*CtQ&6cJ_?UrZt6zUZj8t{umMzjFiStNemMm&q(m>JSu85EN
zezdyl^{BT)P0yzuNHM!L_h66MYW~4pv93QerKII)`jfLIYx3xF!8}XK5fI*Dr2T~Q
zLFGCv?jrnzZG*OvC(2LA8kB{n2t1hvk^8zVfge=TcME)5&lqMJb`n0_gI!!h*%fG%
z^MnNx5l_}JHkKTFkwhRVQH4ecf6ec_s$W-j(wIDcb}8Y|H}5WZAUhG^&{6Ru;^!7}
zf=u9#B8x+s<}^H+B>H@9rO(d#>am@1MG^<69#oD<r6dV-;vk8&Whury|I)RL^VLwZ
z3zc7J5O0|413mvB6D!ShEixAg3paPeLW?1O&*n=PX)^mSZ3>@NiMhYBDtE#BD&255
z#MZxl!OWVdZ#MPk1pl`7f(0d2m5A4K8l@&R(Ga}Jb7nmgc<_6o&3D<R3H-W)Jb}U;
z3gs839>H6Ke0G6Pb$BLE{ym3`dwUVTUE~l_M+ppwS`k*9HuxeU^5UEjZ0&o{CsN;o
zHj~p(yq*2SgLB+-G4gM#;AQ=U88LCg*I+hk)lc}&4^3;!;5MrJ4~!mSl1A?5kLnBi
zTnh~QnBtVoV_GH&{%g}lBgdy3aulawW~NQ<h>8x}^ST<5pGP957sd1={2BQ5zf`(m
z?lg(cj{E6;KCsbM4s)kAuzbj+P2Mqtcd<{|Kwy;-?ldXWLSoY!b;Hsqb3e@SO$0VC
z{l%P1n>=jrsRW+f_I1VCV<wPH?4?a~bYRh47YX;-^~!`)FT}c=WcI<=Au-?`2x$@c
z(KBjYM4CdYp<DtFcH(BoT^aZ_`I`pI^-dSAz)isq61EIN%v@_eOzb}9W)<rP|3YYE
zpM`4N+uPqp44s8!_U=U7SLMGDVLS7)N{NH$Ad>%YGbOC$J7A$Wh*&2AZ<h`4jyl9?
zOD)z<xrmt(uqSj_k;KD68?AISBHGVcvnrrmIn0f!FRVWsRVqO+nGys8h-;?_1ol_~
znZeh~$n)+p32H~WwA<YAKKS8O(+rcfc2Ju1KImQGKhZSf+0uQ+aQ2b{dYft%cj^8X
zHC=4HvSA3HCVW>J_z}jeNKHYbRQO!YcAIWSv}<GUk_e8;<LT2{4Px&RecQRSMaZT7
zor<nMS6@slF%;0eZ5OTAX{&7qspD}%uJPFpU6qPfR^5d3DACtNnm_MLAqL7W$J$LZ
zD#XZ>wz!cV6*7j5ZRCqs^TnFW|M~lxBg$znTh#DL)pE`HExM{>l=9L|YW+M!AZMEu
zfknvcQJ8T_?8}FeEeT>cL^Gf<(MY`k&kxz}LyF*@<TCp7r>0L%Yu(5w%;BF;fn857
z=~eQ}{G_b9-9_Y?`yR8tY7kAnHkBV~Tto9ub1zj=URy~U(&l|-tW%IP`8PR=&G~A?
z+cpU`?IhmaxmPyr6mx>f{v3#oCPv01rOUH56Dvxi${lxiLrh<sHj7jNcb!|FL0X{0
zmpMa~N{Lo{v6btpQYbGSL(fn0U#XkLZ<DpR{#yb&mB)T5w-J<BzJa#0r;Nrp<ZQhT
zeMnO&!JLt%MaIAi(Z}M|3epDI*7;M@Av-!hXC!#Hoh9ES<B&FQD*qKc%%wip7cMUs
zM+bbMyQIQy?TAmgIlQ!v3Wx5iYj|4*EU<IGqXP3to1Q}i636|hNG~1iHxAdJEf>Z1
z5RS81U!s)^vD$<6V6jKV{opX<ohN6p=+`Ha^{RSq-u>VJ>pR~1Za{7?{n2a856li&
z_U|Hk$Jlsi9bc6-hPL;W9Ntg-{rlJjc)#rT?<?nx$(isl__=s5;wKz8y}`zF62~p5
zMjXbJM9H48`r0RCJwqJ+*GWv@3l`mO*g|YYOpV`VlC$LrDAuoEjwtzk2)ynq6+33L
zE@Tp|JKzQn>y{qk-Cjp&Q(Ah$m$XymXS9CEv<2U0dh&IZ&(ma2`18w_P;p;2#k+7P
z4=${p%PUb^hj@-N`Ri`@ttZ&_p5fMwVswZNX}*|1@g{Avk@B~!raoje$F&JQ6xoN7
zQ<C3Nb4?I5k7@;UkTubi@<1vj+zjq8&kCl5hS-h|ych7vS+H6y(j7>pq5X2JK)!`A
zrv7k!y5`43L~F&`q^dvMCtYBf2K0>evRVe&=n^{#;~8Zge^Jg!bgY~(Cg=4iP3#cf
z5{w=hVxsr)I7=eOg!KFPcrLw;VywSv#~}(MC6(-a$p<wMcjP5V;S`%>l(<B~t$t}t
z4j=0qUxKI~UdP|a@U_N!C;Gm1y}#^h)Qts~#M|qmxfJFRa@M*~Z98o}c-Dgd{ItWa
z(iiJSergKWG(lQpZWcb5qC=d#ilfQnlP9H5@S0!&?T}C6MShCUvuL?T`bg7cpJ(vo
z{`QN0IDe5ygBI*uww&dX`fA=x<<_g{C8-?$IlUm2E67%V#mtGiYVhetdVTzMI6oWF
z5})e;^)u(*<3qnnDW<$8q)*@n<-`h`8{0X(tK!V&e`dIL+n?obSiSIN4bgOi#T)J7
zgKE&`%&m<l%5Y;La+zD$+EOdOJ^QMdnL@g|lCo0}YZ8g?Q=TDw9GX&W(K3-L<;QA8
z{hs&lVvq7@-a;)ikAY46&wl0Ro2q$<nW`|6Z}z-@M{`1&EkC@(z1E;eJjWrTA(=h+
zJ*`0@<v3B|4Ieul8IHJ1b(Ad=%DUP4nvu_&RbkJ+<Hu>-5VPkb&kw3Uyu4h<&+C@3
z<R*B)($4#6V#whz=}kcb*(q0?Iy9@+heTqmw7$Rm60El`)F~1}3VR{50C@%RdfR;v
zjiV2N-W8TOEz;WdvY-6Q6OpT#^cEJ*KSrOxsV&S8c`olAMaEa$-_p^ROB8mbbsq%h
zZBq+*b=`^6!XWL!7~Rkm)Y*D<V9mpQ?J!=X{IZ~B?k0~vvA<^49WmY{GiwoAy&G{2
z?Ax@zv_7fl=dTx<7Y03<Jjj%))ns~ZsT1eop1I%oRg|h5a5t}xB-x1)GlzyHdJYbo
zk2uog8*?uVZaP%@>|z3~)#Q2B?-_f3<&SNU+&jdxjLp_0)P$Z7P5;I65#;XY$2?AE
zr$yq{OU$T^yFlF8;-A$QX<G%>frhO=+Rhr}Y$3Jg{ZpC~77LNwyIg#XxZNJzav3Fx
z`pf})$=nItyUV3mA9s($xIR&80R-Y|RheB>9hqF<=PK-h@UKvXDD$v<wfA<i+W#Jh
ztxUL)r4swiL@${a6Fp~!;fAn-+%V@IS?*aqYTaw=x#I@yYekd@=N$()mywB{aUvXn
zDMV~SHFew|mixX&Vu+*sHM#r+zw66ABVW+^LLR^7q9`_S{ah&XOypfh#x89xtHfI+
z*VlzA4=Vpa+uGcRJZ}ryMxJqR<3eQxW#M_a_-qO?;npVW1|MV!;$yzrbb!jfOY&24
zjXSC3o?&m0eC}P*>s|v+np=38Du*2;`L&)Rzpld)lKh$={<;TSNb>6`@mHJG8nSB`
zAN22U_ZiYSSQxjGUfs_@ub)D%GR0ntBNO>_8n;jEvsmiMIF!yCoapN^l2a9-O@&XT
zP1t83xcH#7Z__v#qo+fifM7?A-VUXagA#pxtr(L6onZ`cs6!2O#2DmI8ZaQy_bDsJ
zc~3aQ80Ju?+Mi%_7#GiB4iJa^5`AB=Vx|0?VU2XClhn_#ozV`Zg?$r!Cs;97Yn@@7
z=1^yzmm|hFhti}ziN3E{F&=)z8OC`Ibt2szF~&QT&T~!leanimP~!~a3WquYYDbK#
z9ZDmaMBl$#F(#>;VN7zULn$0F@(!f|RHE<tk;3Ce|8Ryavlm|2%)aM{D@QIXVBbmf
z%^fND7QN#PQ=tr<!~We7(+;`J!u~DMw`ioGE&7`?OnYSLOm>wcru}l+M)t3Xz6VDN
zPZX_ihUu^jozMQo5mSX+wuOB=(f8Ytf?v_w&M=*mp*OKh2qwoFanZi~twi6;BZWtc
z-g1VmT87@rE_7^Hja-(+E==^jMd-J{8KwpqdNVuE5mS>~R=~cQ=-W!@_og#U)F_**
z6LQ$s9WgO-nT4GLIX4RQo8t_VrwpCRzUGL@TQ1wk&V+m$1^Uf!hABXX&S$4PVhWPW
zwy@J6*G7SU)0|-nlc6`UQyno4lgo11$&h8EguX?SoneZUp|jXYj+mn5GBY~?GHjGE
zpeV)}rfD*C0XyCiQ=DA(Av+GTYn1R<(Ku(A=E=|&HqsGOyj+&Yj)BY?C3qK&afWGy
z484&ZMKC$?`D**}7a^|*{a$c}ElGyXXNNnsi<ir`utOoI2>pgS!;~pQZ(^T!#FQhK
z<+5RrQ-pqD&M+0q&{^ydM@&29GBf)O<P@P_s54A^Wat9+DMw8E<+2aiV8|&#zhGyW
z4$IIMc90{c3b`zgeG+nt(C<lSn9j-28`%IyOc&*{Z1xGrs8NDvk<(p3wG6$5easP4
zja;^s^@WTYCHNQlI%`vd44un9u<kd>Wt&;7`mLjcenowqVWLL&$|y7YsAHQLxh#kE
zgp3+3colg%!{jMLf5?jKyd$4`+m~ad_Z<!TxjMrZAVXVN7sqx5$z^#g3pq6!^kbc2
z3X`EXvMNVR!{oATRslIR8uU{*!xY&I&23@-;fN_(F5Ak!2RSvG^DlbO8K!A6bT0dj
zBc?dHY%}|J$f?m>zoNf8!!%EZHnV?o#1t==<*=(Dr$%#LMXQ`)S|LM!$gXh2v|299
zWLH2&jpq6n{lyukBpEu7ecKTeFPG)BOCY00b3R2&oMFn8p|jby95Lm{Wt-SVkWr(#
zM~fCY!&E3kZ)F!aV%i~>Ww8q&qegR&7tM2qX^#xOnSGOBa^&;<_T{fbP7(UO?hM;u
z8QRRwacozGT$aPW202CO_nI?I=Va&)*%^+QF3M$@><q{$Lci(GFjdRYdF(VtOf_;@
zK06h1iqLPWGfWLKbT&KL5mS>~wuzktIYsC<$r&bUj7?5)TiF;#OpIKX#l}ERjRF0}
zJHzBDLvLosIb!mb%L>>?$fz-#Z&9Q(OaU@<4m-vXQ;=L{VMjqmjp4LKqnu$1lc6)&
z7acJTlgl=;FF;0(;hrcO?hI3;44uyob;J}cmu+F6hm0D-`4v6y4AV3jdJ`K)Fgfyh
zoPGHa$f+@)-w<cm=E=}o*-*!J#mi+`Y$)Uup`X+9{t6j-GyA}4f3;jzz~Zd`cS65G
z&f1hDL+7whI<|?I%PedF<P@P_fHO>)GIS>Ugd?ULxojibA99M&?=feX3T5bg*4Gi!
z4!LX#+YfSz(665}OnYSLO>AFBO#9`sT=r4Os4-mMqDP%!IxItHv7U~YDtgPhZa_kf
z;XI3+>H^O7!k+%s5zEEik_uqCOz7|8tTolWu>0>gVyWpZ+5Iad(-`itBBy8mhF;h$
zwFHYJZ#VUpCf|W%8pC-PQP~st;B07~9)Nu+Y>!PcZMi{88BrG~>9dCQmYHfXbN6tr
zpx1*Kg64(UFy!6fW4=55dkE@z8$?#^cahwTbCl_!aD}~?{vG)XaB=@Rph$lxBz4t>
zvF+sVzvp?_R%)uvUTCfjrm}DT9*XL4go**wzavdC+;<1WeU`(R2A%6`gWi2cggSo!
zF`?{6(=sb8G59cgFe?mxKdtGN&}<{xt_d*!zUHzjiKnVx`SR+q+xggn!^^AZZZpLQ
z|2fd;U0SfvTxX;TZkCskwz72g&FE6{)DP|PF3rXYMl`pe-noZsZ`Z~3Y7;$sDb@k)
zjk}{x_I?m(4V|p=1${?y4Cn2lqO;7fNZ=Okr#|rRidh#Il}w(?haX|q#SIjnuMgjj
zXD{*j-tdih)`-t-!&4aUD6$X_=YzjH_q(xuDzcYzgk1IqQf|*z(Q;`Xdliy=4|c#;
z)22zI2@NSQ_Vy`gnhd>>y-aZRmU+G=mu0h;620U02%b!p6HHIdlcBe;7aTFg%Vk^H
zbCBYDaDqAK1XIuo89J9eW9vUNL2lXKWe5xV??ms_dvGstI&B)E$vy+=qm93?_JrLJ
zN)l;9JT!%^?6(pW!A43GJ$bn_ll}I74!=hz*l~Qlb;OvU_2<@$BZd)xmO2yAl9n1d
z-;S-fj+j`MnIo6wvqvD$_Xs`*kEBf_P!6pEru#vKGITb3*a4GgkzBTk{pNnojy-&g
zkah8!_0~R;R@wJ4F=!8Jh<5_5!WQ<+2l|+~UoQQSJ(%dde~<9k{)5g(?63^Ki9PTD
zHqQ#V)WUv#Kc`}kVBYb$vk^N7XzPe&viltRnR!tz+sN*LeBUEHaqv@ToKY>)J)ixT
z$oY0$aZ4^OV2cyIYxW4f%*W3A*dX^Jn=N{<k4<uE4!iSyPSYMCYsXG!eWdpG_VGh@
zyJH_2xh#|2jy>pJq5r``XMObCYm<fGuMZ!_{k}3pE?bc3?Y&p%%WQGp&j5Vi${CsL
z<_G&3B$sBfx%YE|_6l2eY;xAmFu5<A*=)yt4wK6Y*o|1z_6oiSH#+0~NEteZ&2+%z
zIYBP7up92@MDGRnZ@jp{IrmRP4Qn4iWK$mKV`iLOx|Lmzxw=>I-@o4Zh|QDXEv(@I
zY@YFQX)de3pA)}V$ljrMHexFPZRP$f_5+80X0DdY;HHW_>0WNY!ER@qk<?3fu7K@)
zko(umrCZqcL~njC=f`w7?_*|fFSs1G^}#;o$fcXu=KDE0d%2A}nw|Bru(uyLf&J##
z#~pH67W*4^rhB=^4>maK;~u#en^|!uNTi&->^~?&<gs@l$@U^=+%L}id06gA7JKKx
zepbk(8`)csWP7;}choxT=Q+7A`Rq-{eqNNzwy<QUit#^q!x{Hi%g~$HY6nc7x8$;1
z_NV(fHQ;{EeDNn|t!j|rGua;;a3RXKjr+KbWH->dmwV#i<?Lx>$FscQIao5A5!+^Y
z^>hCuyOre)ecB|ulf>Q}Gb4JVbx2kg#J+-$MZAubPgC}pUNmuhvjQ0s(wY@n$K_gD
zW*TfBw_aqf+rNWlPUhV2ylUik$Sfb$wg#EA-VcAb1C|I$DzoKtDtsxj=VX?hH?Qev
z@jF3sTLPkmK$v~jDoW}SkbP1emYC@`6#iVsMk?#y)A>t$A{Bslvpr!0(HFJ><gafH
ztO}}C^_e~YUi%};kjaHop^Peb$i_+eCQpnj_kkU|R<m1URy8SMFHpF33v6GM76Y;W
zIqqg|RCRKjs;HHP1stcZa>-pTylv^`T5h^1kxf&ATI7;Ek#nh1xg@xA5eG`gl>Y7G
z2>0u*Yzn)+M$6WIY&JCi>M8WC%UqtlR8_xk6ThMF&&c?-A)Dk2V<a5GY+s>&U9Lc4
zj_O9JY026&8rFw%d-I4*<+qDjP^B`yJ9#4Pz;jNQBA29}r86xdlPks7Bi4Kzk$F9Z
zbyd69nhmudBOm9l*@)r_TVd<B7WI(d{qe0fm4vIJP0Wm4xHa=tYesJ=t5v88esI4O
z>opaVV7XksqNl>qnsV(4+Rmy@8c9u)X!}_>z=UyBNxh3{<<i6`x3xE^%;nEpxa&7b
z^w->~ZtM5&)fZk{Z*O0hiNu$G)Eih+D=q6mqxI|W4L5M>`!Q)t*Dnv(?Vtu0jk9p3
z8WoB8#JyFj8fV}%zRG=u+$G9`23mMj=uW$nyL_A__g9RFmCiADdq+fZs1*Jr5gJwC
z9v@m9rLZ>D?y_+?>whgT%dCUdFkNsXaA+%)*PCbAqDMRQ`WnhJ82ppbR`8zG>)N{H
z@thI;US7a`nJsLw^|s~)>?+$xZ|$vNdt>xS{8$a%P{1n;maJRSV7=8yxY7q)sbv@4
z;7pYi9h(ij!!7Wo?9NNG^2?9)g|9R^(ny-w@XF>z|DGRZtHZu4YtEQkn#ca~bN^+&
zi;-jY5zqK=BWy$F*FFNv{;`YeMcbI?)R)}nYcIu6<QMXcRDEjk!N_Y}Ze6her<sqx
zEPcJ^3gVL;?qApU=l=Dc_uX6EI|4_km4RVu=Bc`;ex7}#Kq#mS{2CU-*spuO%g3Y%
ze=71^Znn&%cy^z~u{2G{tm}WnGqFFc{$?WERdZ+mHR}`7oX)RIA-m2qvF~y^df%q(
zpYgOb3-fCzN9dJZS8!vLAo(E=;XgI5E?bREfYP`?lHA*+2sLV15+|IGfjhrtC!%ds
zP{Pl3-BKMox~5Fb2Sx2)0J~r0pf9xkWvqWG>)-uPTFb3}8S7t){I#1Y#G*)7S_fZs
zWO6Ee<!i)7PXCDHhhfC={MHA5kssy=qF6Q%YKHTJqDUm`?XaLGw#UQ|o_N7q)(|`i
zCB?`Po_-WP5^WhJN;5}@{cgryVv8un_a>1)rB;wApZN0Oj13+q%p}WrFRopmehOS!
zXC)jJhX{^WKB0r8xk<had)hznCXiYbyAM{Uh>pZk{9q~a2iG%9Q)2oe(hLvx=hKFy
za5p0~7ZBOAPfBPi9f}P1FI(P0U%o8fDR~k+b09n~p9){In9et<5E;Tl5OVXn<yeTa
z&kV7<4??@XGRBG?2DXgp*S}ZpcPIJM3t!o0UbDX^IpoJ4*!NQ<bs=<MSSKZ9=Cwzc
znKhJZ2lydgv?!Ep38na7NfeQ1$`PhdLi39CpPJ|xQ#4s0mT!ZFULP@=k4P>4Gl^PE
z5v=bn!rm-Z`K4Z=`%<OUzei$-!{e6GDBwA<S(^i^+1Q=%iMhbjS?~uoNjzwqoAJBk
zxrvAgqSe{19k~f~rNoEp5s8~X5W8v;O@ze$pnQiNA(m^P=89LuI*2pAePX#phsr!9
zto7+w%W916{+dj)j~c!!RrIHuvKN#XZ$_F+eJEZXZrDjNA<4)4-vGrF!ar^y*2MPS
zcmc%5+sdy6C8{P0k)Ol(1lYqRB^JhpX(sv=l69R(zOyNUe^5_i=ESgatiJ)}tF3E^
z<QX7I$&Ye#=M@{7nDpoubCh4GRT$4S>?3@e6a@=Sr*aehDht+_5ErCv7K#6$$h!}#
zX6yLoBnM$Wl)+!L$u?6e@}#opOvG{h=Df(4Q#++NpVM1sHqL1vUPFs+E~!rP{L%#P
z&?OOlLQ{vB5alyvOuFgxJ`(+E&)A<<p3aJyYPcl+Dyv^C&IxT5=2wC^zt(+eL0b`J
zN#knub4gQv=}s{*$<dQGYu#NH@V3qD>6v{SqcCl5Nini8*H0VpS+Oy2=x$};3$qcS
zWQ0-^Ln0H8F<~#%MJ)PvpF(@q*D0E2NL)g2Tx)rlSBYYo&96jPnnvYS<|b+|N_nTa
zw5MtErEB%Y`iq@cN^j42qfE$k>(&i(Qw8%1OR@gPhUl`U8LLZwnGx@htrD5#^@)<b
z_?~MgC0<d#f70T8!UKIm1cl52_cgcEZ#u3dwo#AQ`7}{PKK&i^*x5DXb{R%-+SXkX
zH%r(;-Wii~KO{1&|84w#sJSIX(f=2#G!^9_kwBJJ;<~w}V4h!0Ry1a6X4%hKv0Q&d
zp<kF>i7aFA=aS_PzK*XVhTuBs>&!~bH$=G2_>Rm6X*Q6E8kV)dY8w1kWvLXikB-R$
zuYo=_h;S{<TM-Zcj)aGQ8`h_YKHKLUiO9FplDjm~Gd8SXIcYOEd}#K2nSW1PrS&Fr
zm(1FXGsFg8%Jnhx?wdCaH%Z11VuMd21nx^YVEQtZjIGamkm2tCT8t>nd$xYAe9@f>
z-pnbON0GcS$sF6!Q?jOwioinH6|vTb`+JKg_l6j!;Ch6Y#EanQO70Qnk-*PaDFYAA
zfM3#3r5C6JZ~n}&S5{spvP_FiXS6wR=pD2>5u=^^GyXqRH$08ft_e}()|a0wc;|d2
z$&J}I3;tM$1Iy)TsITWGPegoqj5)#e{&(V-yV(2#6z|+vGH&VirHZ$)-xU2y9@c^Z
z=LcUWUx%j@CAC0`LD>5(riq%}l{|5==v7A~MDoP7rJQOp-8Or6Df#_LnT?_~oRy#c
z2mF-WHG4~0)9m!JUuGXFwLw(Ommn%$MJxz-roXbEoKHyHBHaPT^HU>y-xyWr7~X`a
zzTYA5Kx1d%3pd3`ys!oC##yqvKIt<fiBv@56O~5jC@t(+x2x%mhtxxiT%Tq|FTPU7
zlbnta$2Y98^F@MD#0IR0>nmeB`+*G`GDj$Ns6|I31HhgpPpptDpS*si@#-zMW@qQg
z)(Z`n?*4R>(&$QgPxI^wcsQ8)e4-m-Nl#6W(T!A7{(p|9xumK`iuL9>P1xP(Tjr1`
zPMPOcho+3aZf;vkA%Gj%cg;-Ee3?fg{h8a_k>~9L60f<X<mYyZOL3*%G@K-!7ln}{
zJZ_WsSxM$beV>!r1!N!TDP>kDp69x-c2&&Uooj2C#4O#pbUM$zGZEuKAkgDh_|$|o
zwu(JQjJs?HTk851W%ol<)*(*4zQug1y{Dw3gAz8lw$4X<d(sO0GP<^YQg$hIixmbO
zPGHhpn{!H$A6uMr6)#J4jE<?_(??i0=TIpbD>6!F8rhl)4V0!>?*)Iu`gwB;(<ho+
zhEkj*LaDX%1wR}6NLd7ph&oZgkqB4t_U!GE)Dy(|_e73}7VIpj!|#)p73*_;Hm@0m
zwniXQh}h3|v7hZ?KM}Jy+rfgne#O|DW$2SN%fkze&Gjn=+?+2)pb7qEY7L1y!!}L2
zEk&WJy?f`@uQw^bViWeAsh{eHr`69Z%Qm<8Q=DGi*WB_nrTuv%bx|-)Myr~)Bxta1
zwx~<i;6%$JUcIi$HGPrR01Iq=rLW&2Gee$AAKSv>)ZqKLnoF&Fj7jiNb9`NYZ}Qhr
z*Z+%zbg@2{T=^Khu631ty%GS|-z!0*<~G+oW}fvf)s?!p4)f9zzLdySk!R*p1H*1M
zFW|kv%Qq1rZYUzeWj6<gt!e{rx1xWS_7^?awk)y5LRM9C)+7YCP$W+Q|2Jwi`ljUZ
ze=6ivWLL&roTVWV%gAUKj>Kp;2U5E!M)S*mbi>_|2}9NDk%0Nw%$eXnq*g1?4+@cq
zHoCc9;1`IzR=;BInLm!C17A==(Pr@*3&=M@Q_t5Cih9JFCJUCjJ6V(C_iO+BGGZ6#
zn~-s+50~meZHwhn+Etca6m`{7_d%tJE(-VFK`+P;kJ}MN{8u46F<)!pec$OBRVs~{
zU{v4THi@2+JjJi<8&yf&DtdRB2Jr{#?vS_q6uPt*-$&)8St4Z9euBx`8*s||<sN0E
zgr9QakoM1@{=4r|1Kpl*lkl!PWFlj!Or8>lC-SA$`!xx|hjpzF!tzrlI@Gt(VE-X$
zz7Xm1(@nNUk}fx@F>g$a#DS^x^D^!d4!m+!<iEO+)cHCMp=PT#&WF~n=KGYWKc)&e
z6X84si50j-<Vtw^CRMT?gbNj1da0|H{hNaOpwiWBz~8hgmS1EBJUj;7zgT284o9|4
zF1f0&iRDaHefKVc1bY<E8>?9JtTo_3?gQ{Yd~MAw#y(duU&(i}CPfu_i7nYu1}|1Z
z*H%K;fN0RQHPpCGq-%PNX0ni9)#x=jxy)jrsA5oX*Bf*Y;+z4)7lpeQaRpVL+PDzv
zannHN5yl3S@GgPaHfdNP@*{&LbF3VO*l%`HLXv#!+eGex8i<Qz$In%>7+ti6B0N3a
z0G=L5+9mO`8{y}6k)NT<u=4YIk)L@tO5zvmH`}2nDO?E|;szeO0Uqn{JXB_$6+&%E
z-KO54CZmxxiHyfYaGw3!ZQ|SgcuPib_s_bBRLo)07wa5uox}T)ISlDM6uDC&p~F^n
zU=HJp*YXCJ?OtSJg-unREFv-+`)r$J8=1<*WMsU`?CBwWi?;g3S@*f;L8s4=$Rj4g
zMM0Gq80x-w1M3o|o4`<sp0NAGP3)5kwN0&k<dce2ch_mBb&+FTt{cOT^Nz}Tuy*AM
zr?p+|Yd`GE>f=u9`r6lx;r+cC+CPr5`TfCvQ)+u%xl;^J*<<kMU3zm#Q7(w&B%Th`
z-vkb2F`uMSJFvdQ;L<y8fz*DxzRSI~)s6k~59)gUab4qqKd2k<@VeIi?sMATx19G^
zsvGi|)4DI%*NqY5s7ogTTW=FS{(}~W{ZWf6cm3bLYHjaF1ze~><mw5fF0L|H7rBHf
z<B%T=E6HjfO`Q_HrQ_5u=D-U}<nn^}VX;_Oskm6Ix(aV-y6bvl2JVe5s6k#k1)=AY
z3t@ZE`>SB(tFgH?=9ZQ&j|9O~*ZJf^8=R;=3h^A8dm}L<U}$b_Vo2D~+&h6^vxv~g
zDgr-;ttm>q)QO%xLy1OPOY)EZ4n8qt&(Pdo;Tt$K_qRmi<!5G6bDJG&Qk3;P_fPD|
zmp?31v-5a8NxsjXw!Doq@7K@dkoY1#;BaL`LKZaA>K#WdOHuMws)2?K*SDEnlgfSG
z#TmzKX@T+!H>zs}BCSz7c|@P$k*5QZ4N2@a?yL%{tqG@H<#2r)c5Ft$Bd&|72@HFh
zE-xeBVBEL43G+HTeW1%yM(naA$7(8lm--#W`PKMvU(qpqJfwHmtkZ}JO7fABTx7%_
zmiWRZ`4*d?4`GLx;CEmBzL{f~er9zA;)9N<HoNf3lf2eN-(gnk+mSD-!_2DMnHaQp
zMd6ExCzhh3qiXorud6Si<@NI--w!nf{i2IVp_Ic_?f1@ZTXel&W@C11ZtUo@fqUTn
z_ch|<)v2lHExC<9y!7>9KDP6)G$N-`aR!I)bA9Htr$bHNw|{uuGLf80Pb|uVRClAK
zU$^70oFy<Td`SGGz&%6hf}46F@bf(6B*3}8dTxr;e_OulNqo#=(sN~ms-uLtM5W#J
z&d6=h)v77zbMBJAw%^c!iY*#lC4Fh)TynMz+^$jyNf9mCZx6(6hL9T3gxie%Ro&aj
z9=@Gm&AeLxJ+r<ex1pf*e5vwF)Cv1D&H21YZ!1&2=n4(Ui!^-0RZSgQ#+AN=wl`>N
zN`H8L+x?(2ttOy6S-f8%XK~7xZ6sNwlo9I1X4Xi~HC<mK+I#(q$QZv0n|6ulmhinU
zGfyHmXpOMhxtrTiKd&%hZ5Ku$({qG9q$Ew4@;+1~?cZ-EqR%4+cpnm3ZOkV3BXqQ+
zUsxSi)0=^2#OZwX->AOx^DVO|5?Nq~@qlF?U+_{ND!_$43vF*S=Uqi@OJ$<dkJ@~;
zv+%2_!y{NasqBF6{ry~$^}_as$sl(!baZ){bf#f)BuL(fJB%FUs<UdA9orf6(00x~
zz0W{;lOF3i-+w)WT{6XR)m3c1C72q$RpCRMU)&TJz|sW9<0a4e=F7}D#Oq|arT<ZU
zWmMCoPvI`jh|cUwKaY6Zq+g!%p-UH^6h0pS!<7ug;mm8I;QQ)A1>8nfPijCkS@%U<
zu|G~92Y9ImHPA(unaDW6ZV9rD=!;3@9Z8=i$BjwyBquTGuV4A-UCTwHlc^X7Y6YAd
z%gta|pE;oVi^bDOlwZ!Me#C;`(Cbb`baiBN*SaN@>%MTMy5fE^C=Y1hEzM}^r!~YC
z<2=WmVqD2g`0*@cMf(R9P8sj^`v^Ee;F)6H%#LsOsl~aNHT;8od(XsB)9mxen%Q3d
zA2U;^te^Ls`PtJW*`O$LQmhYX2r4#7Epv?}E!%raIHqZq+ID9={jwSDQlecXt00kM
z$RLKyf`LPiwUak~$B7Kv0)3R=ySjzcXWX{A3U76ElFV(c6rLBg{RX*%8L%#HZ>jXn
zb3=+vD@DCB(Nw_qm*@|qtcX@W;a+{hyy^*>+sa^7mo7-(iCjIM^;A-*O~YW*P5dzi
zYV?B`0*2dTkaXKg6f(%fLhg0aF+^WwYY}KLJ9(mC4R*Pm{KRc)>?%7?VwClrObi{1
z5uDaA3smVuocm75#>{EK1o!q;inTWu6P?O`*T$rw54Le$gnb+T_i;*k{y_}Xg#ROk
zu-{>rV#C0lWfUH#X=o^keiE^t5$9gjO~=$v^PIp<WpKt+b$gwF#Oltg#JS})qMc;W
zdqVk($TXEy{@;#7^<ckWNM=`Mh^ku`tnYe&_J6gt=)WA-k(wHbYgW*<nv%36E4Wr2
z8`z&iRD6Xb7s^wA=^zq?yi+UJAC=^$1AKrzyeT#BXBQ5Uu9YsxlM2ZhB-L1FCuzxU
z3t#BJULcrrxvrUiQujSdp0(;EMK+gvgg^24ajA@tnU69ew?FVE@!^uQhFD-d`F^EB
zDo1;jQr$OVNlo&$070oJMV31Es82Mx8`}|pn*%X-r4%n1akv!uEJ+JXzAj-{XO+a#
z7#Owvxh%Cb0*EaVU>k#n^}o_nhDAKHQ!bp;bM5M;KELm~6~BjzU^-2oAuVv>{QC{3
z9uNNNVg;fyS5Rq32Qm@{a&w~A-_A%5A#jKvSQkMJRQI>`s-hq6iB5|*cG2=_LBg*_
z2AyqcokdNNSU7|Z=mpzUMeu-Hh6KcE-$^+_SijNI(l$^X=-Fc3!GhAF?3ZX}RM=>i
z9D_Wmo>dg7mCN}dQfws^=vjpJDSgy<8{i_9Xc;5kU!*2J@P49QZF@`v=c{U^8qr;l
z(Z+^nJ%?Y9yvhVpHR2b^icZEWm(!@bh6Pfk)^_}<7puqvO6W2(>nMo}qSY8LF@vSV
z1@=5_Y(mUxwa$p_K!{gIzG_PCYLP|@IFfeBqk)s4G{&*NJy<6z)pXW{8^|abtj?f5
z!Q-6&V}D&Qc%3BQ@b4ER_6Fyc%u;J>YkF{x|JlQ-8}f61PU6kv5aE=%TWaS6ycv&`
zbr^rk%gRgS7Ky9Gs6Lb{CF<^~SudoQGe>?m+Y&2P5;e(Ol%A4fqI#bZN6`9QfKkl0
z@@I4l#`~Xg4;*J5!Ssg1oQwU5%p-dm)L12tlkxvv<Z(NiCD*$k*xY|J_QooSk8u)@
zJrDZYc!aOV&7?(cvptVge%JTq{t3P>jr6`qDZJ?{KBm~hsjC#QSa+?W3SRQ(CBB#D
zyfQ~k5$y%x0mLZ}A~RG82peD6-br7uj{lkLmvgQ7`4~EjV{O>Um=`1zThgrZ*Y=z6
zi}bzTH%YcPwwYVZTNXjy8jgRPGl7|)d5JD6c!@|9Q6?z1)a6bpSd=+#q~#Vx_K=9u
z%&<yfz@koj>5&{lA}qCiPx1;3Xd>f7`eRS4<d7*=YD!<LEl-=|9b2$yB=W9hjw6`)
zXyA4`pwh&0RISR^20rzZqXpxb*!7E`@g-#`bx77t2ieaZr8m<%mUPfBrH(DbJ%c?D
zgsdxd<bh?_WyRxm`2!!aQU@bLV6xfgEvySJMWw}v@7hWQK6M$p;#<_fUz4L5^suKE
zQBhnx@HDqJJ(~QzR>MbY$nTouXfN{nrZ@TZ6B&=5ACsdW$KS1jBxfqlz^d)ObQejB
z(ckj>4yQgT5NG*!#}v{x%BrPr9O+x034GVee=s*S_7TVTn)#xhBJFtpr-@dbn<Q~U
zK7EkmxBahDs;>CKI(%v}q?F?r{eGP)HcGvTuOQzJ3~$+qo5WgqX3%2x`G2ZE>NYct
z-5$|e&jvb?@}#uWRzxlk_c?3DJoc6d?C5u?>pnGb=hUijc0V%OnUQPa{Bb3ukw<i(
z`^`?Gzp$^*tA&k~$Z~J4Z0_l@gf}%)<m?w1_7QI9KJSJ$w9`A9;1KJPx)0Q+gSeNG
z34T>LzcbPt+XNiz(g}ts(Xg+02>g?)=x9<dwfLWI$kZvey6$`Km|8`?XI8K3!hIKV
z=3=kg?I(U69Av}w`|n3Fs>g3DqgQo3xr$(Z9A9=0Ph>NZ9>P_1=ejtlhC^E)z`ri;
zo=tM1omzFs`5CeOV|Sk+b&_L9t7vLD6{)aq-+kzZ%*I&6Qt}yEqK3W*dLxp5Np~P-
z>HSSJ!|caDF>_`ZiFX~io&9(J%H$ARc6qYD3~nT+f=LaQn>fqqRbK`3fkU%9>!+Rl
zoa7dPr%We9MyJyr-?~}i>SL;7eMX?Yn!(3O9iJLdj;T2i_+%SSP-pjKA(uPB&}hZr
ze7vmqbag80{_exT0N}_R`!(6ml5+;~Uj6~S!5?vjim%j#k$hS2INR|r%3mu)9;?F0
z=u)$KTKR7A|F4R6T^L;PKk$lZM?kCyGUtD)$LXi5D-Jq~$cCldct%yQaQ9K1fx3!e
zCjw2D{_%1%$y1^xx##fKU_tL;pRhZVB-A70fcaIHy&aY`QpOp=HD*;(d6z>L`02=K
zO|&$~1OF<~()h#@tx3on<%?={`cWU0C`X)_nmiu4fT`&`j~Lu#O$2VBMyPAFX3LRt
z3rlOylMB~*6MHct(Fui<D02E^JEz{ojR($uCk^EES0B0O9WItpq4k|#91Z3zvx$z%
z6z_8!t!E9BPV#|!K!bUOv(VS;1WKY!O)AMOQa`Q!8$ug$0)!o-c(YD=*Ch7NW}ifQ
zcb`O&{sK{?S&f39m^{8)Lr&sa*ClgD6pGmis>|vbWWh!T3&!7oTmZF=;{L}nldN%u
z*K-%-CFC1t70(y<u;Qw?K&w8dF2`vAF(*GKI*Oe)PgWc5+UqEEp$5d?M7;42T@_GZ
z;d^&Jynud-XY;VaWtN{ot<<MC7Mnay+q4Yh-r4?+;@uldr}8(}27y}EdU<lafF)AB
zkJF1yi<`7=$J(zN$lW_m$et^rG!@hN`mkw3r_>-ao~WJJnI@I(8LJC9*3QjpQ1p-T
zzhtESVN#X9$w<AL5yAFQ_cp|3lrPG!GNQk1LsQ0;jKHVbDI1POCM*7t|3@65unjP|
zQc`?aehp^iKmE$2Upw9b{k9J*EjD?HmO;`g>VfR(;EOQNr<FB`R~kddn3<$8_0uvg
zBuAr%Vbh*d){H07{l}29`e}X6^Wyt+&mu-^fo*q^97|WghNz*eU6i?{3C3T(Cr>yZ
z8ftnqPx<Pm9wrvLsZ}i`H%5yD5u#hqExR&?@3O9vnhIM+7+A?6sx$V#AA}Dpr2M^C
z+ug;i8wNYhX0oG~&H;c8BCyf_u!ogo9mzoHR0|TBIq?s*Ad#7|c3P06u*YoDNz#H~
z1r;?1M8l#ddV|Q!@#JK#hy96XpiNuQJ4c6UhXvX7LeiHShm@*|`$1<)7aZY3$k|X@
z$$yXg+!#nDB73^|qY_o4mk}I+&$onvHi(L9`y$ayT(qt)PcCHa&X$Ty3A-QiIa2h_
z#*+<a?ixBT+_H}t{+GLE&9T-q1|LKb)Us>>nN{_knU8`STe-LfPi#Cqwcm#j?WMwG
z<o=TIT+=CkmyRB@kBdTkxssM<d&)qfHN@%n$?~_x<X$jDD3K9py-R~{R5|O#<ojSg
z#9?0aGg7BB!vD62@}Fg-&S!+L@u9C|5Itw$!RBt^vCEx4lR?>0&nQbbE2&ZsPbzAe
zmwWPL%gd0UU!78$Q(jbeJ-+U7UDeZw9P0*2>Pj6^U(E1_SS@KTrNa|u(IqWA>A--y
zRQU&inH^MM*7rDR!iEPm2sEj6L`~o?VjhOK>_X;lH657wGax%e$UdGF1^beLfkTTa
z-aX3oPws+Wep~PO%#>zpCgpX)0$C3GTvcM`n)k#QlJD7|cFvHX0{)@IC>9&JH>!OR
zqtdsx{C`Nf@=G;U?^*q>IMQ<(T%%7&(gTu%ND%7$1|mIHW<-gy1GH(lvf*CFj~kMM
zuN)y6_{`pFL;*}untf7~TJIFavUHLe*X*4_YkiH1k|u^ek)icPZUpZXGU}@t+8mcc
zEl@AZIDx+7nT}BRP;KejSt*K@8K?11Yhe{W*kdS%vn^)iIxxqv<G$HM2NS8BDd~H#
zBXK{vO)Xfex^2BV9xL@Wa=Ep)Gpk*rD}oUpUgD|akji=vx$T#UJ)PCyGO<Ez|3$r$
z<gzwf^h)g}y<+u-(;4PXdi21k_+`WS4D?Td_tdft7c&;9&6o7ZRgJfo^x&DOMPl1G
zkWtZA=@l0<R-*lVqt?Gf&LO0|{+A6HMFX9mW1zwl)O3VP4@Jf#|B`{4l0jth#0==0
zAa$T`8dD$HbJi9~vUYLIlATNBsP#9NAvY@4i~7T5r?3wTqNs!<ii%Lex=R^OCwd0L
z5;#oh^FP3(RNm8t!~P6A4m{KU|MUO%<M1F|mIu5d?gJ&ctc#6CzS1~K8M7K$Qsb$7
zaiwM<4g7tGM8X_cvzl62uZ)F0IL4dOMGpgf5QS1mFP45aBYzX&pSX-t_K|aRh}m%I
z*W?hK`&FgvZ_k+x!Cu@GRW8cdXoWH+PN9olt<c59E9BZ!#QJd=bjYx?un$er#@6+4
zTnkH16Oyb(T^e<1)TL3Emh0NSOozaCtff|=jO78D1IYb=-0@JziWs4*wsm$~T<QF{
z=+ZahR+bHmn_m_m_o{WhfR*xJcPWaEnpiF3iV|C{C_Ev*&%zeWi%5mkrY9G!v|Ckl
zXd%WB-(F2)4C&vGVR8r)yE2;lM+^1GcqN*U5$C+r0m@i!j5%XB=4y<&;h|#=ncBCi
zzcQAz0<GyCs|Ra{W7SpbtBc_Ql|w6!@1m6$FN`H514EzQfG<!dHk^l4jgH~oy3~(b
zRMpQEgWEI(r>UaK@f4}x8f&3_NK)vI$5OhAS(LJ34W&GuKoJZClZ?fj!zz-q{0;C<
zs%5m?c=l1<aW$>1@S%0zM$o#75SrMjkUA$e<md2INo_yWP7cmzT&VeRTn+2SahF_m
z$BmTkTMMN;T1qLu-GyAeXl<?wO`!dK*Q3@V{A1~;3CY3SUv9D7?E@^AaEVn`R-$cH
zsMA8}j@Mxy1)CUf?!*it0fB`goQLnsFI92NYtbLILiw$a0&P>EZHjy%FZ;P*Hk8!)
z0G_8VX5<^x6e7sqs-j9FnyC_XL!`FJh}?eU^dbCmpj%jasashY3mmf)%A;$5FG1vY
z(%$d{AF;jR2??SM_IFWJ!?p?w)Lp{7+D=p1Z0LF3h>I%&Z-OsZTX%)J*c{9`o>ETO
zk2$(S>OC?QkXC`dn5S1VMy@ZVN`@b#xD$-)kF{U1-y%;U>xQ{Q=_X)yPsQw>5HHSJ
zTRXxNDy?l%({u>8tcnFRt(<_FHo<PD`I1&kV?|m|#;ZIAGrSvl+jR^zl08as%NJqp
zVTMn@44+^(!>x5mJ=<7wiz_j&$qwh6oFO@6%xt?@vR|EgSB`Q`d@!%i+LzM*h*wOp
zX-EpRRrRAQ`bXufTq%FINf-qq?SBRTurml>e1$5--e7e`_~P4CR026$zy`CS4Zqu{
zi?ad?+bMeRj##cPMCnrn8LX~6XZ9J4+!zHfiMGX%Za<#A$`k7d=4tHZZ(Y@|ZVH+>
zu*fUs0<n&0*jl&jipSI1cTe>M7A_HQowl#Kv3T5)?MoC(C-I84<h1S;b5(@Bc606d
zzEQf$iQx0ubiTv7>qD1{>#jGg{B|v7-(ngP5Hgo=W_dhWi%(?WRNe54I1dSZ<FLl(
z8;(&UQ){W@kkK($^`O?`W@-!00Cm)sl)NKePhZuKG>nfz=5_0iJTUn4Zba8mm|KQX
zdG%WM7_yd)y+a4_#P@_!1|93R?Uh%?{rHEquGP{(qQ}bbYLRp3$!f{}#O8g1ZT}!u
zd$H+x6X8Sh^&ji-^>)zihWK^QCRg2{W9@;1vfH_G6-(~Okv)Xi&@_y#*1Svy?U=+&
z;;48f_edPWX`+?7LHc%5z7r4wexiefzVST*tLet+S&Y{o7;u{s-c)xIIOOnEYba8J
z{0-2jJm_80>sJC;u1W>&61FyW3Xf|#yJnm(OCFzIc5lW#>-iA(p%}HmVA#?(Y`sUc
zaoEd2d&c!^p=@Kf4rAwd%Hm^-^~ginsns0Az4C}c?C(0cKR3W;J%XNOz?rh)+TCJa
zh-13f#W|j(*7kaJ*fOO)54(6+^+djsny>Mu!ZjnJg7dh)<x!8r9+{h;rwHb!!n3MA
z^6W?PZQDhy3&|pE%Xv)R*fO9>x<M|QW#z9Bt<Uo&;^_q+j~?9iDs+|OAtPr%j<2GW
zl?&~50_VlOz!lu$ar4`-10}g?#7vcuePAmhe~D;(R>xJqzs!~~LKn+mWdyIs48zJ8
z1S!CZtK&uRv?RCuEz#6hYzrl>5b?DtBC#MxAhjT|VkC*>Zzo5{>hx*`(Z+w!FL`5>
z54W@mvw}#Jjm+<5ierCCZ;=I~VeEP6fmmIo9{tTme?LcmKYB=iiIghgBj|Aca|)cL
zc>TZAWq|V>$AnYCvM69T1<y)RTO@n$*jlu_j(df1*Hs=vi@rmP8quPgb}b@fMfPG}
z86#+a+!fG4`MieWR_$_CR>CUlcwek=Ls55--M-8wwWXce<6ES?nLjK{u{(3=-JSVW
zJu;FFi{gILsDKNrUSF(SL$MMLl2$FO=u@y-I!JH@_YUhO%J6JSQ_|Bj<pjqd=WIIZ
zr;QtJytp#XHUgw1dAxmYZsCXqtL1n|!Wq~RtfF<t7e26WlUE(C2YbBZXyb9Ijmk>2
zu^(1wa8=xf@I}}QV4P-epo4{$idK&g{nglYtX9+HHqcZ?d|>E}yGy6U3I3YqEm&g(
zA5F9DlX0Pe_^_O5B>pQmsuy)GY5hwhr3p0!jyl#nJoUvC=yj1<aX@jg9^B(fbOh-y
z@0f&nV1PeZ!`y7>TwSql4m#Ef4<q+D4?)?~-8G|pNvRu7{wb~v>63#dXHDTwsMzU-
zoy7O9VeX~S^fylQk0u!MbFc<nhE@PtvXUAGr}w|%ByOZGrkAwLqJK<>H(<m2KWHk%
z6XOR7Y6-*EkI)+A6SuXZClwO1Pfi<Y1?R^rxpOL(!+IGQuo;;?A7&YT<Gt<cmhj`&
z5esp_V}D224B;`?&huruVerf`)Q9!_G`kH}GA;N1qd!_+Dx6ULc5%kA($g~pAJ_JE
zr59%iTG#eBdbM280W}P`K<-$`$}Z17t4zZxj@-|B_%t5m#xd^JmG#j43g7vN%+LpW
zMWy*QBhK$erM90DQT+{yWgE!O%j|2UwPsdP(&|E=&p;V<gC*~Y=EVFaMy&fMima<B
zd(%iqEh4AjlDaB7{2x!y1I;CMl{7gG2Zps#zVUQ4!H-%>?Gr{t_&>gZk8Bk=W7Fg`
zOkklcAo_v7zeSnjj8v1PMVM)%PiK@MgWo{2bha+2mS?$Q36Xs(<GM<1-g0JDL!YUQ
z(;I9#YYaD&T*?=l^HoZ1zFuM8tWt!U=*c%!5w744lcr&Jp>Mo)rqp*c`hFhY`Wua&
zVwZ<r(s+m7l{C+!0fk*?{01{xMBc=REec-~0WCoCDdw3QB5#c?if)_#y3NZ?&YrY@
zSG+wRZMC(NWY?M6Xv^iKo5WMPmvboP%R4CDMBH@g3B^FKE!-5w<pOjx$cx$r{&&G@
zfw?+^&flCu=jXf8C3oJz99~6Z<)BMyX4C%uslD>6q$VD{_`sXY&g3j2$1dc2nvK0o
zY?g{!-J&3?Hqp116%gq`+B|Np++s+PRiwpcrU7eSeb}{~UKM7QH-*^?K8@>@Ey?4r
zh?(<<ZhUIzoCd>PvMV7Tu}Pl90~DG6(37*7;5?S>Qef5F&QCH!r_Ft<QtjlYi}U#G
zZ?IEp$E<ppQE{i#Dj|DT&zsiy+H-fR;VQrO3U&hR!i0#faQ9&}+ViiK_jIxD)KmlR
zLsfJ593hyuY1r-kwu8_I;Xi7u{HIGvEi-(>CpIZjQ+TwcHJHDLwSjH4`F4^VrO)&G
z$od>MHZ`ARs9@waCQ_s4p3HZI>ui)HbR_(S>_}uyzb48lh1vC3hsUHH6L<16rT(1|
zZ?aNiiKOcAisdpQXyJo8NGkhrw~e`QT-AMX#*e*R?f8w)et7sdGLHVg`G(GRipJ?f
zJVp2J735P+a>$_=uCtknvfA`O+I(P>HhxF0%<2!jSlsFpOgP6VUjn8H@#0C5?6HZ&
zKwK3{JTYQt4Qvy*uGU^`$+3{hTYK>x1-_#M-|ys@{&}9{u*aDsZ23Jh6U5ca%KhSQ
z9-0wpheNcggwwgi7R6K}q2na%+JbrVt*yB-B_#>MVO76^(~A8LLb0UxZWs4;#M0QT
zKGubMi-xV)qswjc&^GtT*U5S)>u<!b|D{ENm7{B~dP^#Q>a{3;$c}uRgY!kHBHhVc
z#GMS$LX$h0)ncn3kLBKKq5i~3tt7k_#at|t_)X$9!_7&pb8fu}*;btLseYdc*`Th5
zreH<F$y<dS%?*lh(@>h8#A#btv!+48)efRfWdGVH5Bp8reWgb9l(^+ZzKOXb&F)t^
zLQ|tom$>CbUf}Z$$S-7o&3HrE5nzpGD3T*{*&JD_Nxr+&dBr<KLXa6KVX1E}HjOyp
zQ-PBngFMG!eX9I1@)rCy^ELMg#%uSB`L7Ilk-|i#J=j3Ul6M2{AS2=V`mpD|BhZ*J
zcsKXn8AJghZO<y5l)At4q-hyW2vR;hlFcvFgcuvRL#jU~)gd!<z^~+lV2fTs#%ofm
zZM=dzlU$xp8E!a`0-1z)+UL^z3e2KMTowJJapLH}PT&&gLUscdvieJ>+AHbyXIg1D
zkn#P*^1!fSN*6m3d+gcRW8*v-iwF`A=YV-Fs=XTGU(2Ox6qh5lyo&y>xq#@t_+z4E
zzOl+Co5_fC2HYTo9P1Fz*U=RY5{%r15*ao;MUrA?znL!bzfF#f{m+BkKSI2nx7}D3
z>#g*=GQ@=4R%d<KXJ3-}Gu0^F*e<#(YS|mg&iGa6f{%52#X<-6L9I%v#Z&>l)E>U}
zq80vBv2pMTsRr)jOtqBbNvz-{@|#e>-%5ozD-~utP~nYq$sU*v8i<jQaY#4!zmpk|
z7F{!F$YGjzU^KjvX7w2PH*zjEY;B-}P8zwy-LNh3H>s)HWyo}HX+&fevUdxmlgE>>
zlJ322yXyb#3(pzszwkaz{}`XdAo`^Ih5SYektgUj1;@a~d$6-F9hxECa@(I<q)`qk
zLks|{P<^%$?zhgbL*hC25ZRX&<IaPedud3!v7gKICbC5SWs`6As~>hA#4kK-c|I)J
z#d#cmus$qfv;3X-Qu3X-rCb!FNFHqerLCXHxF7Z<;#Erg)UVzmyL`!S{Y)d-^^+Zc
zaSHZ4>BCd&s|Rc-PUB)23a9>~3CgC|AGUuUw{H8oMf{ET$o?6-idHVl)jc^Td1CV9
z<ndZa4XyjJR%kg|x$lQFX5-DCI~HO!)HSrrN9Z5Y(=|faG`y#lUm!}k`r2ZC*lA_(
zvDU9VHc?!~G9~A_nW=?-1d^zF>}|AW5~JWEi&<T;zEwCeyhAvArTau_IJ1Qc9P)V!
zq)-87W6PZ_fl1HO`Fcb<8N7~g5^Of^%@Vwt8ZW*+tPJ~`R^e*Iee~)-7PRC}c3_f<
zN}lXds(a>G>z~T*y*|(?<0YwOxJh=0knm&=Wf~4Yql`{)5~MNrriSX8B}-!|mckgG
zNQS^6s&+bd%Ab>C$qodk9@RJ4fxtsbaa+NqG%C=aAAn^Fu$=lxp@a;P%7sU7caKSJ
zD_b{<>r+FmM5}AsFV0$7Ce4I9lrSNr?W%EQ>AhL=do?v?XllsG<65I%jlFJ5n9PWJ
zt|@U0T4b9q;tI+h>ykVIaH_iJeI2#BxQVb~Vw-xBC7X$co_ZS>5grmIF}>C&Q{u=Q
z+rG=T%O^X0tOlw3Ob1e4#3((7)dciX(a;KFRj3|&8o$ReDp*l;Xo`p&AaAdolJ-!L
z2?1qyiM*O)w4LS#BrpDvNLOKVY}a(eYr#A-%x|*ar;S@`+o_S>*{o0~Uw>m$Ptz=}
zrcU*#3A@4S<=63*7@U7&y5c7B1B-}F4`$@<Vq<cM)DjMw1?0p%QmhxIOFgwerQe>>
zWfw6>($OX%ODpz4SoiA#23*f~WhkPj;;zl0J&NiBu61_}4c7!keWf21<x#FBC1+;P
zCvjSa%}Bu3wqj#2_M^$sZ5>RsSK)*C_=rRu;jkL??uG;AUL~WXRUhlLtt1)04lY*?
zKGs>RPo5Z>$1Mt?Jqr23T+bl7gvpD9ln5xhlCSorh-U7aY#}kPyJEIYUc>f9^ytu`
z{)6vi3X@$miF{&f#eo#`@VvDh9kzD#seQJ*SdY0HFyI{8)8X&xO+jbZG>A!_IFPic
zVGv_$(bjWfi-t6|2lL-#b8qD-gv{6;k;(yObt~I!vx>|qTV#^1*{~c1-ixIbvnzV{
z<hEVE;ik29h{*!}3%FJ(w@-}q)6nOKXDdj%iuD+!w}R-rLT<fA)inYmrL?tc0BU(t
zJB@)uzH2{_Ev(4vCTl~*tiXVFL^H6pN;;iMGhJX@ySv2lic*1c?G6kmrmmL>uCATp
z&H(kU+wl&uMZwCxpX|&k-Vj%hfU$>c6!kfP_iW7T(n{Uuyx(bE(6P>`2FUr#HtO71
zOl-XfhhWzB(oCYFjbietmdr`WEixbXV)n7Nc{ev(nw>;CS-!x&&~$sox<CJ^2;b{~
zOgR7eZ5w16@?UeXJRvi5>ps%bsfL-DqhtovAD?bm+k|#>aO30YwN214Kah8p$U-tV
z<;=hqSP;VQYygRE!u?N!Lb52-41mpB1T@!!25JxuXgP@nL?DFY_Ev91?hxA*Tc-O5
zEmv^KaoaK!`1N|ff=CJTVn4)de6s<5slYyXpvF{Lurv?YH8lm1!tpi|Wo$*vs-3IY
zwZFgTC%610U#fC+`VYDY56UM5&k?cLh=*+XHIhG7IqI&EJXwnsj`);G7Gx*AwoFlu
zaEFg<@+8Si_A1fv2h3Y!-I1Jt4i6q?d6lp(YK52CBdfcHb#Vn`FX>8YEfLgo3(?@W
zQ-MQ6XnxXatXarTsuwD|ej}~m-3Pi0)t&7ldTo3pJ19xQlaVGKnZ<hC;P%BHyRhf_
z;POyIsEPQt)rUpCP^_m<gL;Ky1tQ_?<s9Bpk+A<;CZ4hFOU$Z(@)Kpm19#`$leY|w
z#0%Fx8!bF>$@d<`o~5woD%Xec3^f#|h<qH7`F>~$?4pX{A=uYd0r^n4^?TXZ*FGyO
zV$>{&$Cv|#S`i$Yva$_pTbnd1YM+s2Mg57;^eLw?x7s{nxwS2>Cd}2wR^hdV_Nb-F
z6N$D_>*m&=b=S9jGFiNVXfq8S=pkHgYt@B#P_VKYJcV*RV}!3+BkCHjK-ZXH)isXI
zFUDvI<xD4br)kC5q2Sj^rX7BdA^8Xump{`4ZL0~IC{o*hwh4ET;cFM;d>w*wwdNNg
z+tQ{C(zj_Z`9)&oq5@Wrz7m?^Rl0f(U8;2rD7VF8=s!O~9YC%0`O?C~<{p)9QKPJ<
z`}?q@^nn$xmJPnwcY*IBmnGk98e_>^;La6W)^qEIcMZcRjqW|KV_rxWU016mo31xI
z7ql*FT+;BDyA<s+5_sG`z6*b3npkx0GjTd~Kg68C-3<AQe9fn#qQMho#VI3Bgi1D!
zVbq+^6u;ZVOEd52OjyAZx}1A4G{xgIq2kywdFD9U$4uvAmXNtKFuFeA>{Swj1=&^6
z>+&+tv(-w^K301Ei=!FQx-6aOHatPkV9@h_8rsX37N;jqjBtmBFx9QW?5=N>=Hirp
z>UN2g+&zUN)|KS6Nc6_%(@UD64X={4#%rvU%;+YR<SG~z@~Xa=Uj#~WXBZVSMY|D7
z`h$}B{Y;{E5f(zABxt&Jt(B69ue3<tx`Dle7<yZdD2KbzL9xR(1%}O}5zS5I59&S}
z%LH?q>L6cIk##ro1~{|TG<chbaHg%XVm}#y&rSxu@G&J&Oap=Wf7pBXxTwmtZ+xwp
zSu=nj*r=dTq9c%$rlFErCh9O@X&yq;Clgx=YMT0(xvkuS!we1wfj#12P*OXk=-CRA
zvOOT6BBEPGOHj*1hl6LZILqPpz1CVIc<6cR`MkgP{b&36;F`7WweItM-Pe5`zL)hg
z)pdIMX0c{Co~pU))H8E)kvEf4)@Pi-XZM!W&RkA5*DlUoJtrX7HY+lsh8S02W{`ci
zey_1)q{WUugmFpxt8FGc`OT_Rwl_o8KlbLvAsa_V(R{PO{t5AzPi$U%Xv@a;_;@>J
z^ZdOQiqkOOm||$`sA0+<l(Tu^!zts|{ZILBKl=OmPGxOhKbmh^*ZRVHOIR1MFa>@<
zKA}U2D+s8o53eD-=`o(Hzo57Km&(p<p<Dwk=2!!3(CJ^|Wb&6d)(^4Hv$upX>s+%f
zMXdS4amLRzj2ZT9wz6bgn=47XvtehT)-`slj;F}o&GCXgasl#s$-p|!@449BwFp)f
zcI+#Q{ML|7nTjF1x}f-!BrWUDtzd4%2^KzV4#)Jnv+0})+HCk}i~fKfhsE{ID>!d)
z=O%g5l)7*`k7a6A`KuX`ZLYAp8R)h+F^pf)IM8F-z9a8UGaPYS4c+(k>H$61Law%;
zY(UR->vVib*?^bk^LMH}558tN^3SDsqq^Gj`xSVDFZ2BVL%gxP?3sW5g}+_>47DLb
zmmK18#6C1a*A`6L0(!PF#Jy}5<Dkk`7BV9(jz<hW$xF@9c1HZoy0Q$q-~LCOLfO|0
z+8#=JJ2@o9*w~?leT#W!CEG(a(xUNH3BKzaL;T<c`A80H%394)3On^iMNc-UZMNC2
z_SODrSt{PKNtrxh;gugJ)L%+iN)~<*iPnXC+eNz>YslXA1fBKH@z&8szM+cQeB{EB
zkx{#iQ;ht4{~js!N=Os=B^SH9<CoY1@(NAR(bwkEO4u%I8Fi>~+|Dfthku;F`B>Yl
zTC-GEx2C4#MG?ADMTra9K($`W7+zCvGzd9t4si#10O?nEZrP8oDA&y)pFQ}!F(g~b
zvD8*q7X7nG>K|)WYwFajqMxU3uR;G;$1dOk&5FqTe^u@<Iw^q?mWQ2pMf~+n?uhsz
zQ<&OVbP(8@2eW~n=etF1h~%)_{Fpj5v4+)JTL!hIE|v9B&j#wB)~ar9HR!Af&8-_l
zCg+Saj>;Kr6x(n8&x^H%d6bt9d8s<{lHo*nCUxrNpEic<L1gV|_#?eEp~()YAUs(h
z;<%E<s%}b#WixL$E$%f{F&^*jwIuUgk;jCjBaWd{CwQy@;>38u^vd3HjM=T+TEyRg
z3|jU1CXcYT`{Ep?e)8ZCZ2>-tG^>A`l|N$NNs%WZ>{8OW8-iTHYr=nI9{|9?r47s(
zmIm~<2zu9ara<ow+alT(tXup+Y1Z$f=XV;3OA&SXqNIdm(x7oz--c7E0ZAtx;NuFd
z2@4>6+^r`q-k@Yg<@)6JHiwS2I9m5w608rSMm*jV>95ev3N%*mdFYo<#wOX#x9!P~
zzg;w%N=iH_a)s4@*>Bl6L3~@y)#hK8xHGfLQw1dR5v!)UjDXHV{9Pjab`+k6^cW$2
z1vJNdgxM-!kqT`|A5QeG@QB2B{wLiPpG=-GyU0f4H!e5mIFA1{UBSI(z7WP3?O<i?
zsBUPK^KI!0vq7aujEe|-`inkkd|bV3jH&???mAFlFK)74Pj6q9U^ik_X73SJYdSon
z7(1apD|(E;380RsvB+2MjC$~1O?uPSyokUD_tm(U<`s>Hw$No6^7&M)>fOrUt+tat
ztA!MNoSeU|vUk&(mE+_GqLcyr)oQzUv}07)nXO;&w;Gg=LBo9b>PqDSV-DisfHKJW
z@(W7!M-6h`qc_)c^|vPsf!US@1{8Tq6_ahrVGIkip_eBrO;j0_T&7kbVtFrktv}U<
zS?Sl1!z7-xzw5yVsIqlUOnv;;YHP1_AUxYV238B07f-{6hqPoi%nNABU}v@dH}F94
z*LPqFPFe=iY2xcSsUh1>rY^`jgBi@x+0AgS9T@TsvKnSvmfFGLDR|nn#M#F#I04$U
zwRmGlfdcb79Q^c(7rq^J)w+3NhifmgEH)%yUT^KHADe0T>SHgFS90lhd}GDzHZ%Bv
z<~;BSF8zu&mM^=Qx}g4t`8gTUH*)IdT$F6$oQ`q2p7T>&eFUTv?87#X(B4F^cW%*y
zHvr|=y1ojiM5K!r*9(1x-eO>7Eu(KE{<gt&=avYw{+N<EY!PVPk;lKnUdO24ew*Q*
zO;On~(Bv?qH`1>Nug}l8f3cd8Jwvwt>t?9m?G6usYL?ZRK2Xn)%RJ_1|0Rt1)zV-&
zCSjCh+f^}|v?iv9%KFsxb~hlk6bkj<Z=pS$tkGz{9<U(waA%!=zw|GUq@eT-V(IUi
zf3cNrznp4<(ove<sv@?*(qhqnW5;|Zv`~}girvcE<4NU<J<zqsyo&iE*vg;>{6^+O
z+GoD-HWTrzpI!dA2roXmN#<@w`_<H1R%ibKFlu`HFtXmiTG+pRX4x&3r(#o7fO_$<
zCN@!<lM0y}w01+U{g#Ntol>uNrA(}VnQO!3-yO-Hh2%;LEiLmo{BXpR_q>L#Iu?2k
zy-WS#%Uz#JV_xjBFcGL85n96$m-%K`^hcP*n#CS*S!h=IFp1ur%DSonCt<PWgsCG^
zK%eLTm#9)6pq~fds1;D9K*@j$bX!7|a!1O6?{0NLm3od&CNW-*p-Q=gtoqZaQo{MX
z$TQ+kph}UPjdU*4uPa;0H`3QMUkf{_Xkg{u9RZ&|ElXHZ9FQ#xOa^oc>}!zQ>Da*2
zIMEO7?Q7x$%&4s=fn5=jx}ZnsNK0~gQapdXNS086T|cBY#Mjj0hA6!ui%FZcB+?T4
z-9qdNASs>7Sv|X1utW5&P~NumL?3-$aS1kfQ3}><jD!{tm^M1LlJc9nUL0c%G-Kt;
z0r!;k-ghS5m{KWXloDbo;gm9ccop|lc6A~1VibQ^_0&icAFl)kV`TlgD9aA)y~Zl7
zE3Swy5J*^`8SwGRe=j4FD<Fi<NsBWUJ1nXCIPjAlpC~`AS{k^_+i-KiWR$4)imabv
zaK$Lf$GrYSO?l0aB>ALsAv2OYMQ50x(>>>ld__?qr|X{vM#64<R4lKya|K?7b?e^t
z?Wa>i_nag>F!@ym<O%p&<^5pGV;#>m31~m{V%@x7f!w70%!$DT0*;n2cizuu-!MCd
z7sQ>E=XQgZataW9oZvU(`FaMh*6BX(Fr*}G;u&BHIV7>O+o*P)&yTogR;(y+%F+04
zuBY4tB(mkLE%bC)PW@Z`CCYjs0Gfd-)y&)4R4soWzU<dhwXD|T*w5N`j&-gNac#NG
z*N-%Ie5u?loHN|C2HhB(D9A>bC<&#hHyQ=c^sEQ(9Kah}@6f(gFP#JA{>F}Bg6EgG
zJDvZX=VF;X=gV{GeF^^wWgf5;F^NKs&9*OvH*CISw)2Mgo$cx4^B(dWPMrBy4h@D@
zmeoxXFoA@*?vg*#*E9@>L6NPRZzi(fRhiUs9FE}QrSn7VJ>Ad8E$~W)*WcaLI`LOn
zeJYTR%3c4P`G3GR|HZa>%$JA30w*V`W2|LmiifZp^wdI+?wqn^By%<TfTfJ-`M{$`
z>_cjg*l%JUZu32~`jJr`Y76W%%_A)-kf*IoF*m@1N~Kb`2wzi<lo#c2PwKM+N#|kp
z^hbK9<G)5c);r}BeNCgD*gMq&Q!Bs|DIWCCy+`_o`)~T^+lTwdq9mR+aA4|t6s2a+
zH;7Ub1MB{D*w4EYccV5$wbIV{aF6sa5WhR-8T+1#mXANr?2IBzI6m6;Z4tg*EO10-
zl|erIs$*N~wbaV4`+?ZEP6b2f_gv?ngQz!%JJa);gDP5;P^DH?e+Q)FyKZeSUlmtK
zuL8IE+!6S+Yx%Y^#^e2nGx)w-2@Y|CfXzX5q|=C+TT!qf{E@ep|EafE{i(Ot{P%A^
zje0wY^=?PKKQTR0Z*iV=*4*6CAdff}p&M%uvD0=`Olb{wG2T8=ZnFq~@A_`6p`$G#
zJ=;;AVS-I{OHIi(Sg-_<6thK;cag8KUBMDI$X~LSbj<*5cJTep@*UPx%y++WX*Djp
z_Paxia}FNJ*T~L(>d;X79yVmNn-!_!V7Wi&QMqQAAPpl6%8PM=)kOKOQ@*j+qNW?H
zvmINya-pIp^!TM?4aAE^=*~Z8%dk6=4cuvx?}xs=WL~VVX=6x@OMDhd3Zc<*S^f{U
zGIfC_&7b}1!D-EAxkFqw^^C}ApC}jOG=#gD8vzOznSs4_f3&IE-1rg0n^isa=|Esi
zKf&-F)lcd7Itcuse4kROwzz^rgg&`tlj@pL>d$LrLpgRU`tv%^aV~Q72hgBh8eQHF
za10<>Fj@JyzYY0d?<gkVefKQ}_#+r#*#M3fQev_(6s)UeML}+}nrsbWMVoRS+}@fn
zHfU3J{X$q3PTsV^Rn|Mgd^TP)yqU3;9r}}Czgf~z9#Bl>!s@kWqn%rTT3I3&Y>R@$
zQpsxaBbF?SC{MD7a*rxQd=h?Hm4a-D&2@E%n$yf^UfRk;1WNl}shIb+Z&=`u*|VJP
zuPWGYzSImPj%e6XLp$(wi(ucsV}Ww<qgHmSgD)c@$Iybp9Gah71)DJO98S7lVLrA=
z{r9i^k<e7PqW^yEQ;1fyrH-@L@7tD|FOH&k-kw%Wdxgj!5vMe>BAj_KdhqF;CW`^H
z(@+=y9c#&zLm39>kQJ^*;wqE@IQx{pP=;r3ax(nR&m*hCAPzvE_$E5~xMY!6zWg+h
zKLsn|tybA*_Ru@o-nP!;5Sye^??v7wr1x4KTrZqCNy|VQi8)P#2Pz_i&TM_R?!DU3
z+e@y8yA6rq|HXCR8^fEF-Cv9qTdXV~eeerKYwrk}1%U$!ED$u*CG(DEL@qACnre10
z^M@?fp9wy>!PR`Jj4fE4@tMt1)$(7ce{Afb#I&07U57KG-iulStH?=)v(-P3`%;l2
z+Ay>3$*{_Wcb4B@UX#|KKfJY+EP3m0NXdxmb%&4r46F80dndm&x(Dyu*6i}X`NoAp
zTYS@SGs-&Csi{+UqFmBddm<vGM(7H2>Sx`{tDi+wi8w^>JJYZJQb#!UQz}baFExoA
zqJU%%olUs?km%hpH3{)~ygfJ7m+(~k)FkXWq#63HlDFetGU)#18lVMg3h<`~HrFIL
z=VnAhV%eRAXAt<&lK7Ju28ySo=1go2Gq36I-Ru>x&}-0S!gl9-2j-Ab^YUy?n%DoJ
zZ-B>AS5vb7AL!`@f%-KpF67^;bqrVvWc}B3oS?yRbgWf7MK(l$>gBs+L{;G{(1sUr
zXXjKP_layU1ge#_D)X$cahp`77Lp6_3#*u9J~%$vO8F+*^Z#*QNg708PCoZ2UCa^s
znDjkSqL!fK)z*yICD0618LVZFP2d<4-puNgW_I)}K$HPxO~Ud_%*q7k%qQX32QJ&O
zEYwi7l=x$d60^e?m<9Akpq-<CYOkEnh}AZ`b|a4YJ9qu4Zc4)Q$U1`m+0%ykfxt|c
zU$w7q)Wa?XR#{CV-=gm2%8X9x&bddqGJI2+C#V3db}O0?H-*`DmvXrJo8G6Jy?$h*
z#4Cp;Yo2X}jdI&8^zcB~>X*#3^q@7}0RN@J>LL2{Ziqpk8;o)q=qt^@W~DeP$CAX6
zoVQtgAF|`4)dS^tANc*fbS%l+Q`ZRJykz^vXcoWem-yhDGu3?``Q{V)#t@`=+4hxp
zqA>mghc{yU;~v!Rcr~a#Y8S23=)(|KU}&?QjS?#3#d2!O2;0H-)EiGV1HZMS`S)fi
zrD(jrwG*k)Lc)?Qsj1H}WW>S(<{EnAB}D_yI1M%V>vw0wne8JRpwGr^Q+KOXN&9Pz
z(`1@+>^FC5%<`|`J!s1vrWl2LCSlRSdYW}~XI*{^T<z2l-zaL`yTTib%g~;1-zaax
zh$9%o27caUh1-N2c+(3uhP}j{;A~vmCfWzi$N8;^!j24|hLXG=QOh9ig0*J`MnAFv
zIK_?X($I0;l`mSjK)>Flj5X}1hMxS{O+BqiIW!-)ADC&Ve+Tn3>ho;G@o2=noZ7D%
zxyZTFFS8HDCT6?+LHky|zS&WOu`uY??s+Q!p%LIgKpvm&Kj1IP$P_Gecg3%F@#kg)
zo#)_F5QcrSm*6u`{*!)xafAMheD>~aB7Yn5%%2AQ1{wCXi}CjVzvR08z;BR~M)=Si
z_rh<?&Gqz~_R@>l9s%CJYe7mLk)$1Lju&{Ll8%EJCiMMj(ht@!LnojIPXoEQLC}*k
zQ-dz<qy8S1CGs!C)rmYzxJ!mDp3>AadwiqCc~^O!=H2qs{A-+@kYoO~7>)PWE!Y9I
zoI-6svBk0#w83;^f#3<pOq~E5AcLt!?*;!rX6l%Xs41X7rXt~fYQi|W(p>BpE#?BR
zIari9FyC6Gd457DuSnQo8FAO$QB2RSToK9y<pYlEgon92;_l22iu<L8w%PL?)b`*^
z8#+3G|1%%!#C!OC%}Wyz$8R8PK(2&S4WRRGvfvG~amOd<8`Ow=2OuNeDEEnMdF3bA
zU&H_EEqFnH2>+`E4Ee;91@2kkN084e*<sIumuw?W>QtZb53H|o4W$OLRPQ;Dmb$!I
zDD@0iE0!8Ki4DYewd*4WA)XM|T|Bjtq=qCm;f&Z9UWbSS*|it#9>>|i8fQRVD<YTO
zBTnLl-(Vdn_%lHI(aOT|jGpeQ!!uxfNq!H^3g3nGdY{NvYodRL@CGw<z}k!85n5fh
z5I<uK5}uYg9~P)qD`@JGYMCpjJ+$-DW^Q6Da;=TO)0JBxUd01^(8Ie=r$zH)^U<ss
z@OA6z2l8|aB*w7Uu4C+WMzK2Vu`d17I3M1zh}k@$KxIwYfm7R4s{KhD7j`}K5vSK_
z3HRF|X1LcWu?>M^+k#;?UvecE5eQ+Uo?#H5AA5yH2DS!5ORL6`1_t+jCv54j3imHY
zXmRQYsj0Ise$?wx%I7KZ%a9iebJhhn!w>RC9#Bq(itFc5#3u0@<p{A(+rCGgCU8Sw
z>5LTvq!6Jl-osIH$(fAcV(jTHPwV)ZjSj<f*=5x-tbgyima}IHmiR_Tyly)+(fW}4
zOk(uj(Tw{qpt|sea^FVO48K8z-AnP?Y-Cd4;Y1voUuYHUw~B|y&UrSwX%XwUun;tD
zkwD*wQWLfC3x#hz{Eo6Kd$E3NX5k%Z9&n-x-gGf;ZXD|!;f0uAwVN6Y&+%@YC)IP9
zgY{qc8*FW;8YJ{e$?`Ae7t4nnZNcvPW06yq&hOoJS&FJVS>?4{KIz&IQc&kz=k>r%
z3|M4&1|z>|%K0(f4+(x<YCF4Hj{vm=dXAYzpwDOt)|lWc2OTwe(^E}@<Fgx8>_=NJ
z#(NxoJHX&Ij7yn^w_Ndu(@%DFBfRS1BZzj9)rtxy8={#WReJBjjt#B?Hp)5JPi!N6
zlvzx6M?Z<q(|7PN6ueH6ca=4zuu<cg$JknU>}j!uZzk|c&V_nlvW}nD=rT<hser|h
zBu&b(2UllrUrVi(e>0KMe{+;cm?;0df=PWXC21p@@)Q2HZG`{kM%Mj5@Yio6lk%=!
z+<kiK*%Y;&Ng-dyr;MoCtE}JpS1}^1ahltR+J@nbhwDO&;%|Q7vyZXazrKjk$4Fm7
zUv0tP7wCb?dW`b3=&x#w^0Tb_3_ZSC4IP07-^_#;-4J-pjTJ{4yP03;Oo31ITeuLs
zd@1gcZ=(;pp%<{$d(Yj(nq|Er5?Sx_akJxUYKL6pe1WKq)}K{a-)yOcU0F!rf``v%
zM16syEUfTB#k5j8?c#Qt_~V>xccjxXm-l>4_Ek=435yC8Jx&W=PbJQ+%N}?++brNa
zPuiV&QLh5Z)%!NtfK90&AB5eJ+-b^jCv2DPt40X9K7Cls^@TR<f9>$T0P_E5g5Rpm
zXIhJz;v`VeS%&DLL(ky%;K=plPvFl^*^}(?-fex@BCpf#Xm3pA;jwY|&X67WH6vmI
zM1#A!;~TZI0G6Ch=H}v#jII2qBf1qVv8~~PH?q=d^0(cZTmbZ=WXxSy_>eCMou2&`
zT@csgqU#K;LBB<Sv3gcOo+_(mCt3KLjw-(LhLV3fLD@E(U*WIvn4q@T0ZH#+8ccc7
zis>R5DRDlS5qAx;mFb4NhPzSLD^3la)=iJ%|BN+|brYnB`E<^@ny2y1Wi<nw*noxo
zorsHq9<r9VvxCo(J=4Rfhdov*qzb}JWKM1J`v@`ylzw*8jrjBNnjvlNu!V1n&;>|m
zHnPvRS>=m%`dvM8H7{2*@N&+ZWc#q=isetK24=wK8klTfVNV;+4agwr(9i@vBL*ml
z14$xYGqhx}Zw&Ukfj}y2lIZ+DV2zBOu;WKaP6ix^dY?TIWszf7Z?f0(zg2ri!w#e#
zQVB%#igxI&PJWIFSU5774YIW_dAzJoqS7Yma0i7UBrlP^oQ+=$IR{Y}zZ*WRHAUGL
z5T<rI+C;WoY6n%VSf>@U!DYXb<|5u@&VzlwmUFo&(f-g&!t?x&6KhFM*2KS4>!|)>
zFykjLWHVqrzBxeFJCPIk)hnP2Uw|%DSF_pen*^#wKCR>%3cpL#V(upE)`hKRi<8WJ
zxtjeT$@dH7FabHJ|7Z?=)-cAJT-f$O5+C8%-JJY9laU;u>lt89Qptd4MmQ<IU~ds>
zL4LQkS`>Au#i@9!Tdy`gtk~g%h5xX@!B2i<T;HvlOkY-LX^AtmOB9vBI*q#vIeX*2
zle`m7i|{^<?&i?VFM18;*YuPKoxe20<k;=V{-lS)qobe{sC?%roR7EmUD75;o*veS
ziR8yYaRHSdR|$~;l}oREN`4$T{eBpPc^#q4%8SqyBbMmJJl7;}IGoqvnsGH%h*br|
z$Ko75pL3x-opyAaTyIWoxXX*Cg@-euSDxA%x!(jN{rf=Fzt08|a!J1*u(vy+CHE2S
z0TD;EXW#|ULQ*fF9tu0X^3XZ*H_Pw$UqnIqw`*m+2<rrEKV`GH{?ErsoKx&WzF@H%
zdPXE@hHrh4Q|Nv%r}gPVPIGEyoP?uh+cTex!Z<hH+z0V;FWSpAFO6a!r`|-niTY8r
zd7^<LpT)R&-v*c1Ch;p<v7WX$!3tjNx9z)YYTvzrxR&Te$jP$6&D8#KsZXUyRXHtD
zS@BInW=-v(pKWh$-$ieZy&%3v_TKd7TzJwME5ul&qNl627`w(Xc;my0`$bc!)R%$(
z1uidty~Q^=fcU2S#YJKnh2PcG{<YLrMr8)%wzchNeWM3g;!8nlw_~Yr_Q}sPj}pFw
zh3%R~1-xYS)l3hLFd+UQo+U6KI&Gb<EwOnhuAXxzXLi9TNE4^rCLVrLE%ER>P1_4J
zY4D#~O}(^`1uvgp(+pldkW+xG&g_>1x&|qt+Tm!c%};rK4M`25iLHUfRJA?Twp9*k
z58+Fa|ER#NXU^LTo#L!VrHG;o5pj{a?3Ik$&d5E5Vhyy-RD(13aFSDyHqth_fys1o
z=!igBZT$3FMgIb~09N})ya<T~b^6QGSW--KvJw&{nE{e^WMvr61fCJl<#!a@tRXwo
za;oY%N{3aG3(jXnPk5uD1(q<v8+Py-Eqwfq2l*edrO~Xi%_;JA3b(V>f>4J9yb#Ri
zKE*ViHs42^*A2}(+pMdK5@go-H8pa~IY^G)F2@@FW3mY9A4rK9TVCFgVqP!YqP(Dw
z{j+%uZI;>c3Jn+YT3+?Ptk>{nS&y7vr&+-&LwTFLUUx=*4mq+@L0d59!*$>RFc}8&
z=YgNbt*#arL@5fTNFlayge3-z?{~KTUs-Iks(;v~KHSY%N4zu8E~Bw7qL+*{cY`f_
z4CryU=U(pd2Fas|qy9%w6+Fv8FY@P=V+Rf3?0zxMF_Od-XWz2bh>~-(*}A^9RbA#Y
zPBWyU$)vZwUEbQ}pHk+^Y*J;Z%t|fdruRv+I-PGx9{=TIJ9?nBm-wymA%q1VYpQ=6
zr+u;vdLd>ut397X7JA?hhf>Q<SBTR2PJe-LH&~zBDTiQHbKDTD>Sjbef?i9cL7_w7
zLy#YT5^2v<-9dd;G(K;>M74jb*`(*^OyxRjAFzn(Pw1j!ljxN6kJn)7X4)ZpQcF5f
zM(ONBEpcrF9yq9lt?V7|3MZNTT}L8xPNdao=4Y16{@5JGiS(<^oQ(e==H#4*cDPYH
z_-VCne>kVFJ97$sTg++s{{K~-c68<x7%b*=X3y3CP3ykt%*lJYm=k=85aU{C-Mh6e
zZUN?Kd)XhQhnj=Uj5^BxsnRG-rV5$@6$6=udt*BbObUt|rD%EOjp@dBqb`ZQ2(@QU
zbH3OG7;q6STTg<EXkkxkGT|fh{Y|F8!Rj8}20sPa*^}%O=O)ce_p%mtjA|C!Hp_jM
z>o{|%3jX+23bKV$m#SEPK`H%~f2rpy$`qgLzEZB6*<%BqGWY!dhTrzW?`HpKC4WT8
zwE4p(aZ3ZRm#i&S6$YPudvF?%8+^9z!S_{V%w=6cPOffU-W}apoc3}Bo?*MhIRG1M
z{QQ*zew%bl+2~y}rFy!xwEa@cFAdjzt-5>j=G`jB9r$4i<v5Dr&5aup4arZ>2rW^U
z)3?D>Re`svBJB&f_uA#T=#!VxCsllm>Sgpw6|Yjg47!Y%d(bHkzd<xr*xRf8CHkC%
z@v7u!*Z#qI-Gw#_`GnR<^c0eR$_eZ9y~f_QQj~sTYJ9wy>huP`w6(8UWpAfe+4r=K
zwC0~G=Bmotr?K7kopG4>opWqP+{$A4b4M%x0erVGC&bDf$4?J&Dp<r$X5YvWd_nAL
z_34utbI+$4zo@T;a}}MhaLO0XR$HXA73|m>*WgTu6P9PAojyGdJ)s$>vU3;DVdOQ!
zkcKx&cz^OHdK((v0gZMN9rBU-YlGAh9sfb2A{!+}t4>%nX(~I-SNQu{W#{xfKW(Wz
z%jq9EH#bKsPHfhEU4duZV1DLOwm_HVWbM;d$7=Vl==)*If;o%#FYddf;p3T~?ER$o
zrwvPIF5A0oF6O4-#Z+OPR@)-q;l!{wS@htnreiIz8ceBfUz}sUK=iL?CFtLOxI9Mx
z$bQ_vJN5%mz`+xU0-k?B0o{YqH#nUY<8*fH0WG&tz%W>q11nCJQr3j?A5gB!T*r}~
zdEXw706LKuyf1jyNM~@;T!<%U^2j0mndoIh=Sb({);GCYvqDjwfxVFCX1}x^@CbxV
z{E+o2_`diks;MMvwCWdm*wJcv=)`LH)>P}m6xR(}&CnYP&47I}&G2II-xp<bb^N+U
zmoHtx6~I?cal<xGl-;3&R|q4MIq!y5!CjJL4q8{-zT^=w#qi|1cGeSe-(2W~;Aj3I
zKReVkGq1wx%>4+>O{J60`f=HhLSA(CNRrMTzmG$aAOBD51n!!x%~ukv9$Y!K+Ig4N
zl`E%KTN70!PiXN=H<X%Z_aQn(u|hNSq7p4$(I`WUhd0xi?*?hju4WMjaWPvwaZt+Y
z;DraMPgVzO5AdfrJCS>{`Hk$33^<%&8gU9#q7_sEQQxqamcM!*=W5Ec^&dw-AzFu>
zNi7FgdtagpErJ{%bN!E4&G+f#^~ZK8fv2qiwSD06Nj?o!(>96D{XWmM>wH(9DNl;E
zB3sN!IoNon5i1AW@UEP6^>pjGrqa4gwZGiHc3pX=s^Vt(2dzvG@?#@k-$OBnqXT1}
zext`VP@9SN&+r=*&+y^6c6adL9lLpWgzzSn2lUBJW=BQSlBg=96c?a;+YKQ9_0=Qp
zGrZvXBJQV<s>v*dJgkM`0)<_!{MBkmReB0<ZBjkO1C<4R*`&$5&j|P*_?q@1j}VP#
zHwN;RM$iVEKITgyhs?Y~%V1X!*$5A}wgyM6_2=uL!RE^v90QhQ#A${r8X{g_Hy5%M
z;^`b5;Olm@QS@=sKf%XMlu8mZnoiVS=f9aCo|cH`+Z7>bK@{ZY29LMYUN<nW8?ie<
zGFApeS9rUfhu7N{lOV4_UKa)5x8@*N!uZ2?k!M?#&_p(J@L@|SYhd?mBbs0hYHr|b
zzGE?eAn863^<99*^E>uX48NpNiI%6WVOj0XkVy+N7C0=fS{wNBj*pd}RJ|X#bjMQV
zvTN&{Fs^7NEC>`$1$*{J@ry3Y+~ZWtFH!u>pO};w6?zo;`oPMdVOq}KsE41#<=u=D
z-?rZWsr6LO{+PAcQ-cJ)dL>CCdXvQLgn(pmy6$m_88i#_+*9B=mCC0^$MAAk!$$Mr
z%BQeOny^ZmVAm80B!c5O?+J12X$-}+u|tT7K_gG+NtzQinH^td#F3RqWFt<;>jeK(
zj3%dJ-{9YBbO=}iA5_~Yc0<2A)~cSKOk+98p#S=D&(m4L?n4wx8q3UWK;|(Fnq&Ze
zsiG$HN<{|nFL3uS4*opO;VG6#$hRUP5seh2`1t<ENcf&+*G*&#!PBxgKo1-F%G<D|
zN@uy}A<t{XIL>Nh_le_pvbjOy8H3S!5}Jo72O=5J>fl0Q72gohEdNjS@wVL$_3=lf
zJquk<aYr8R<Gh$Z+s96Ss*mSg?%K!OpaFi+$K_XU{J-gA@q8&-{qKwvBGKf(peKY7
z$SQR^K(oLBmaqQ;m>RGE+j{izbEdc#gxhr@a!hKXGdz%3x*-ZOw7w)g5%xP+AHoL0
zVU^dod(d7DU0&>KniB=(SfC(@Ebo_WeI4575sLfG=P@$(<52d!AK=Sw2Mn5@C%4Iu
z1p%RRHZ;C#8GX@WXl+yiGWYCF(ET#Oo91pptX|n^LGrx98Ih<U*->-aP;0)bsiu7F
zPO@X%VX$EQVTZoJRh$P4QL~}tZ`<k!FPup0RIZ_Oe-ZIjXqO?K!|z3}U<d&mIMKjR
z1*W@RM;NNM+64>so4aYJ3H2KX3lSh!t$_V4`a%I6E>P%dGUMwISGLL51Zp&(t_k~;
z%(9T=Qk7+ty1WE$3u7Wu2<1lMo6Y<L_-F))8iU7i1ST1jYe{1uese5R*cFC`tn!Tm
z_x>zJ#$9<1)}L=!Vo_4;zx0-MxW=6tlOtJ!V*Hx=d<APJwukPL@lg&IS}<r6h=ZL4
z4)&Zu+Sm24il7z^O`D)k5Bd{d9*eMj$&AydoBqI;^u9QX%JqW1&d`vT_36cIb2atl
z|6J!T-#;gP{}O$Po{@3Siz5M)NZI7mH%YEBG=H9ehvpE974fc#W>b~%0|8eKX~R)x
z=FgNF_<>la=P=ZnvBs&clZ-}ckCYbjLeL&}kqeget{)K&J^G!ruCT9-zhvy86Tb;u
zLHSXeFrS}mgSNdg+bVPXMHuxo;NqCDx_&l$ILZo^xc7aYam8q>o$gE(M}65e^Usbl
z+sL!u2ol+}T{rO6IPOwJ;1b{<(wtkqZ{69uXn*%#*S5`xf&@cYMam^Y>d<lUOo48%
zG$N4t(VXPX9Egev*t3mf;L`kI{66{!p32kW<v^jZX~TvH+GB&#n)Gw)>>OXyE7>H&
zA;gCrw;z>H`I;Wk4}&}q6hQ}y5D1E(14V$Yme$?uO|~_cL2FKS0{dvqP|qnueZ+OO
z@GCsYtoaOF%OuVYztfyA2-L}rBtw|_&6ba`8lsoXwS0nW%&q>epQ67Umky9*!R2|I
zL|O1YD|T^X1|$aL2Qta<`N^70=XAZ-(dLX;&=${a?HN(;8WM|mgCmeOBAd6~sww}V
zQlv${7~jJ#i}8Xsit4cIoIrhAeqYXIljn&tW7?fx{l+HKdpNBSY3p~`(ro%!#w|iC
z%@+meQ0Drt(F5Z-J3-zojO8)1WJAx40Jm|pjnfHdMBr&RDgqYu;MhQtdWkZxb?>?b
zaNag85NZ3#>R6O_*>wHj>^8e15>6ot4xz0-*M%n--_ZJ%V6{z>X<MzTnyK`Dz`=k7
zy`eK*&9Y}SLnDT2Uh4mXW_XXGnwJxYXoe4aK{GVq1<lLT25VlLKUgz-<zT!s7-`RG
zUi$Jm&G4+}nC=hei|6`lkndbnD;duSZARoAaIL5Jkc0!4dOyNa??>>7rQjD!abJr2
zQrus_{e>D&&))dLgc0&g^LQ}lw9=e=K<6h*blx|b=)5@R%DsJKL8S+X<7F5{qrB}m
zJkxUC->--W0@{I`^EABH4iDOma<#lx-al>Q2UnGY3R9P4H@dR*_xVYFFUbFCWcW??
zo|mH3O2v6rHwYFvoRa7K`^WNMs;r-J9eS;ju{LaPH>*_5eu#0eVbXu5d?vT?dV5Gh
z6hFZJwWNR|1J?pmxdczn;mK*UYT`Mylj3~DB*SDpKRx&>M3Oq|ja^xsB~>HMh{yq4
zBZ^9QRzSHOI?fq$<_)epA}f}3(yYJ{)IU=fU~h56yJxVEm+%)S%Tr2YVVe~T-Z2)u
zqohrXm-{Quru-a>7(a?L*{!#sMYUj-)Sc_f1^IIw%wp)OFN$x2<5b%PGR?7turvXG
zP?BwFWB3c}<mxijcz4*=U<R@&u)6nK{f%G+UA##?LUEQXPt<ls<P;qL_F<x?g4_li
zgDtYr#Z5wOKvl&y?>N$oQekI#W{m1%&=VhU(HhStrp9x{OoMO#Zk!Wun$78TP7KW+
z{qSy(c-58ExRk7dRS=%kxJ>=nT&9qje^!joh=~|zEt`DHYEa#zp4|}@`k-%j^b`BG
z-_GDY>>GN_ZuxL_sD60F3-VFy3;IzJL*%2`A^On~gXLq`!TK=~&+A`~cuxKb`<(uj
z2;cV%@|W4?u`Y(eCcrX^q?*kb-R1$7uPl&wU8Nad7!-U!Y*VOOsF`QND&JV_1Mqk2
z969e>G;*1*VV>Hh%!)>ffiB!TnxWmGV98v;lK{^JJZ;;)qjpgI&_idV|Hke#Gc?cE
zor8DcM9ct4c5vFGQy)%zQVwON2fNm}2fJ2Px6UsU#$nB$_Km%qE3TI9E+PlF-J!;F
zy;1ErwBTN@4F!~O5#OoI0u`&RDU;S$HmFCfGx1Ed{RF*d-a-5>nYX3Wdl6I;9zlJI
zGom=en5lIpEu+onXuv~p%i!P!&xfL~fr^KSGy@j+8PdnuA|Be_?4+xfVC)lyg}^zg
zNn5{%pT$X*EkxZUeV#yH13A<vt>fsjvqTZ&bk?@&R*wLpbX|A)Cu@r@#sm0+(LCSy
z*|i0fFX=Q%pD9`;DqCNS7NWvI0wds@mULXpi0n~J)`1j3aXjJ_h%prPh(RW&Sc?v@
z|8nsCi0pDS18>6ag3g*Xk=TU-xmL2USCEC_(C{_DXl)}|j_Y~isSQVkQ)zkk?ZG)c
zu98;Th9ZeLlZf<zcx1!B{=|ZJp?@w!d&Bce+JeQIc&q{UnKcJNLx5E&)EB6LG)nz0
z41!lH;78!!hxl?Ii0=p1w*}J|XZE?;qqg=z@AFeR1>tJN6~)3M7HMg_PB;Zh^I<6Z
zzoh*Z{9}uTGbvH3Hdvg)k6GMF#xE8}qid;oC9CgIsgPXDmf?hdG4E-?bEwnumOO{T
zT`US%$3-sSQ$tKeh&W;5>(Uw6CH^h-t>hIc7V?N!tD*)(AQE!&1oFi6wChn#{+RwM
zCOr8_>QZ&I%1-X<0K5-RJN3sWocUf3%GgEX3^!ayoqwL(tS^jYHioF}>smO(&r~Zt
z<=~^|2H%nE>RQZUDo1{^J%g*A_@3>ZzpLt6YKAhi2VWHXVEY|0SFh?C&zf^tc~lE^
z6ynQy>I9?|HAQWU(kYUUP|6@6KnZWC7>DE|`u&mY{KfvSJJV{ngQjmu-0SdJ8mLcq
zfYyQPZZ)o{UpI<kGhQ+vwsCp)9P3l|?bD4?|5u4+S6;30eBor_9`UK6LVRlY3CK*v
zH};5Y@L_*J_SA!DjY8C?TIT@*hJbCQJ^W4Q%qMKS>EN9qKY1|k*JuCUytmEyn?d57
z$9zxgIFI>0>7n`l8hmmvD;~`EUBY}Xd8T1CJk-e2jeMH+Msg^%uB~Qh$OQXJy{@iJ
z6JFP4)r%{kNPh5>K36655WyQ!To>A%h+i50>b4%0#G{EmeqwKVNxilGBF1lTXDXev
zyINupKBz_Tg;l+x-=|{a-$pTfti4RVw%J+jP<P)n37*xU(Ij`AV)(oBTlX=WM%tee
zOVM5t$E5Iljc0sj&D42Swl@jwd}W*b^}733_y1@+hk58?CrE2+*VnGRhq-v)ta4FW
zpKfd^IPPw!>i|N`)%4b`CBasEC^MA1VOCb$*9xV>F5otIRj;eKuWnq!^f`Goh29s_
z{_ZTy-@%XOQ2yND`a~T)oh-G0-V65~){L0AN_sx3%X4PXh`dL0$oJvuyMDg_JrM5Q
zgD_Hrk@!523(etVj6Wx5fIw}wam%)JgI1ciXAp~#v84`MIiOkD=3PJO-jqAjZ_KQm
zbM=?jYfV*kH*4?S4u{{0XY1<1ow1dL0Xm+~alrZ?*Bs9qR8zoxHu}cR(Pu=lfrbx0
zAHVNS*Y%*L&NU^;VVilxf>N2e#ty%~<}kc#ccuK0idFx0EW@+imGyC1clh?h%HK4e
z2kE(a^+%wrT(jn-4;#KpQvbCbvFHmsz;QLMO7J@9q&ICy;Tk&jZ*h;}n6}=0dCf$!
z;xz|Xvn@%<0Uujrz*cF<{mrK~myd5y)X%-SV$z2hA3ChPxp>l&j3o~5SA7!r>5fm8
z>pn14EgOV=X4MepVC?&vmmpcJuUBc9Y(^}LJ2)*bVsdfLs)VZCRX*jp)|9Fi&KuZ5
zGEQ#Y@~>aj7DsqPo54Ztw`@{nSk9`Z;RN9p(BlZ_ja@`$b+2!qe@<K{y0c$@;@&$H
zk{#ITO1Aw%M4T;3!M6WAZ2R3^DeBfMUkFzHo}Mc+;;a+6x(8e>Fxn?JfEUA6@V%*v
z2txGjx@j2^TI>=o`Ll^XqhI4f<fEJzPNyFo$Czhf#k^w=PK_PJzold0@%21-zxqj0
z(tedqTpCUbp7G|phB-!j@98-YB?of1^*(Vdzg6X{_c_J#e^U(s)}Jitq_`%F5Ubv5
zR^9BvXJy?r(AUh1kpFuabhOW@RXUl+5!jlX)eTOW2~OD+oU-d9oN~SUJF$#@q@vF6
z)7!Lf*JW2n5x3ls5)2ND(ByiPTs;T;@-jrM1W#R0h;r)gI>v8pF?eeqRw(1b8o9a5
zVf@3A9OANp7q$r_T2JS3b@wRd4k87;bHu$Ae4qvVAWT8d3NeH!o(Fj4`jku2%w0ov
z%T44x3)*dwOLh&#Y*rp~h7`iH9o%xbMi`$<*j?)(O@aTNVUXG>PG)V~3WVLsEF$&_
zGA^%0=#{h=zQWt@a24VRF|S5weWPit!nM98F=y{EA<c7~4sYtXA0-}ED79)V^=t^B
zcZi2YkDylwUyr2X1@99FI+G>sA<_gcbd61RB7ALpk46UkYXipCP2gX<@WJBO!~qlc
z`|y`l^E$r_?}_?f$cUS~Z&gBXtOu9eLj3Z^FVEb|S*sF8;@8mJdw3RzU*mF%@oOf2
zP0hWE)KL5i$z6wMAK}-E++h4N;#YX?GNf+7uY_DJe(k`owA|T9-HTtDxhwJP7=GpF
z2H{sJewE~I-$yg}1iVDWIjjUmzc7bg=2ee4Aks8#R87g<pGgj30bdI5L8CN&_r+P7
zrh@O!xs15;dsihWkt>tylqJk%p~pgJif@hMtTVZijJS1&pwnm=8I_yeJa_UT%x9N+
zLd<J5H>y11iijo#gf+(};#b<Ic;=E+&1&gsuGw7V%G`+exJEl9qRk6m)c;`n;_CgY
z0z!%MHgHL}shnmwMOE8*UOqCiojmX!&V#soR?C56k+=K|jwufdmoYO8(v@SSd+Ex_
zq<iVg$)$Vg$|<CK>B@1^y>#W2(!F%$RMNe4<?N(;>B`wl_tKSfknW``*G;;YuAHNE
zFI_n&>0Y{W-KBf!$~jB-(iPZ`)czl&>kL-9m##Bp(!F$@A(!r@>kNf-FI{KAzFf#p
zy3SBa_tJHSO1hV>Gwh^$={mz+x|gmq9He{cI-{F(FI{IiO83%rhLdzJU1xNc?xpJt
zXX#$LV*Ia3<1b!0R=St2oJ_ixuAE%Dm#&;bx|gmTC*4a|PAT0>S576}OIOZLx|gn;
zy>u^KIS1)px^ms5d+EwKO83&0bCT|*E7x7Rm#&<%bT3^Q?pJC2g)7EiyqB&RfAL<r
zV*JH>>5B0e@1-loU%Z#D7=Q6zx?=prd+Cbt7w@Gj#$UXbt{8vuUb<rZ#e3<B@fYu<
zE5={Em#!Fp@m{)O{Kb3eN@s*gwKlIk!VmB@{pQOI2X*QI=G!d4^XUv{>gqcudiu{q
zY!QmD@PZyOROX~Ht9(O-@<w~mnvf8`k6W0;qkeOIS@r6^%-I}Rj}P4y4vtQ1eW$hs
zZ@ADK6q92>?WF7E5jUj*sK~|_A+=_P>vIe)YSq*b^TizIbF;a56l1P~r}d_)acyf5
zVQ$=rZR-&IwQ6iiRO73;U${ppnPwedRXvXIvj7naZXs;AxwM+yza@1%MbNDA?6~aY
zRj=dkr@u^i=&QA`(5;2X;>)YNO0wWf56Q+?f{c|=mFesYN!}$VuX{RR_l>46R^p4i
zJMfo#X_Z%gR&x&0FF1Maqx6?3eH5kNLi)&6UgeqVD81ClYY(N5r1TM#ego;lQDWv=
zO8?QxD~r;HQ~EGUuSWWd$Uife($6`0!OH5_^cN|8Fr`-_edsE$%*=h1UgG5SEu{~o
z^g)zvMf#9cUTK-HQ2J>nukDmRgwnkz{VLL*U*(mMIf~N%<>d7xr9V&Uz_Y8(yMlDz
zRbJtlZF`V@!pRHXaKEPeQu@=Bei`Y{uJT%u*-YujoxHYE`m>bYhthvSy7wxtkj!<I
ze$2@$iPF6(y%(ilMEby0UQ;vIQu<LRuS7~8Na;N&y$tCCptZ=%rS!v26x;LH^Z}Ia
zMCs>|?zzfqXy(2>^bDu!+Vwxe3J=dbGY9ALn-redtIu({81F+)UYHZVr9VS&uEm>I
z&cZLs1EZ70Qu;wBuQp2ep!9W=eg^4%S9#TD6&^tPekZSsl-`%pXH)tqq`RSYSp}5-
zPbaVQl<r39!IXXy>AlgqEG?z)b@Dn(>Afj^8l@K_y(e0i6+r3VJ9(X=^q!PHnbM1p
z{uEl5WuWxkPF}^7{uHGLQF<ZLUC`332uja%@+zcs7fRPs`VpjeU*+YJ#ZmfBC$9oZ
z?@s9flwN>zN35<ameT*r$t#!A9Vz`4O3%}tLhCb6?L&ls@0`4D=peaqpwz`k?Z^#6
zYFgG=q`vyClUJpVuTQt5)P+dxcW?w!6SC$abzZuY*Hu^trYk9RK2l%ZKMJYgS@V&)
ze!G*`WgXv`uAtPpNS*i3{sov*S^q%lw!b@h-O=$)=`u=PhSc?YosgQDm9=k`_qcl^
zAH2Pt^>zhEjFZuCz}-2xHaIa0XX}LK_Itoexx0tkM_;q}dfV>RXVK!!QTu92KG@ZN
zA1g$l^{xPq1nQ#y-r$m9<a<`i%w^v*aWR~Z{{k^<6AT*@ufGU6TlZ|@lOPLRK%7!%
z`Cd&A%D;v3zi)o)s)Q!miAPGZQ^#wfWCo{X+>s@8>i7sB$AIMV?n)J7?b|?@P)VE&
zc(#d%-ouJGki@Mqc4N4-adwBzWrUp>$aoxawBfeGqu#ZV!Re-G7~zd}A}0MaY-5=0
z0e%y4iBw~=t5QTPB^hl_)D8M3?u?j2`e3?CdVp5Cc^2!Pyu8;J=H5!#!S~grrR?Y}
zZNZ$j6BX)7dFm><<{9?v|CDEjVf2=V^L%G^fmM`KDO*JuE$u<_Q3g3QjSlt-gBBip
z3jMxFMnBqwctlffJbmZjf+@hK15UrfH=3}|4=%`vrY8p%_?o5|zFxG!lFbFP>N$Ox
zY=bsHJ-ZL$B4iu90?;p;AK%Gr2%LQi6AO86590_aC#Mic@9|#rIZtiecg8lG$mc-p
z(I~h57C9tLe0O^pJj)eI)OOyldT*0V?r&lti{-``e;h~sOTEi!sed<EfTDwWW{b#0
zHhN@XSDOzjeJ9RMl%vreNjv1*@DU$k>T|?n<@qD2iwbH|mwp~oT$8%u^O&=@3}O6V
z8tr%|dzZ~2B=_YL8|*C2IJ21Soe7iVY!Po9$Z8G_lxs2-3K0usM``NY-&csgjTgSZ
z{_U+-PU`pA!^YM17-reX&|`zrBCq}Y7OWqYsc-GuMjmbEvQl<8dVurE1}5yC->9w+
z@1C0%oR9xJX3r16s?3ql=1w215PzkgK6rg4;iu+z|4ozmEu$^I@YeR6*hPtzq({)~
zRT*O!r7lfgv2j7Rv6|tX&nvT)dl-I0nUV|otG!t{is3?QTsm&fu8&=@ap{Bm8?Usb
zhKRA4yuv;1)s*av?5vaMfh+b!P&@SntUhb04ySKY9eNdBc&jki5ZJDaQ*xpElaPPK
z<clM6I-fuW>5^xieYrnI#<Re_OB7+(di2wX%9e-M{%=6RpgDn9-i<C3C@MQ|J;ulq
z+*a9oaKB~UtYm9f3eovZRNe1=vr+nj=AL(jXpiK$FeB0sXt%6gnTy)jxV(B19?CaT
z7m0C9w5!k?`M*e3oWQpf>^K7ink3dR{f@`-B%C<M-IGdfKgK*-Pn+gPmO$uL;RUB8
ziubV8*@719(|vAPFn7#G?_HcO!YYhvwrXc`l?`(lV8KW|b{*94Ome6PpID?Bs$xcc
z!}lwaiTy#}=yQC&yYrJP&57Zv40UOg9Q65_Dh66ixq3~b^WyvF#ztp@PwENr8(D%)
zyF%+^()H=(G%{+g(27uH&`2D;3LJocVkc|Vf2&~mbM`VR9nVkiv&|LR5_dy$hsXoU
zzg2+yO+D^<0{J*h`ii%=XHr*y=AOjP@*Cpxw(I?)8EBqW_Du2$gYKHEhjn!hU4>e|
z()h*NJlpCO5w;<r5$a^Pgfe%D^_qAgc3eadP{RUg#X&BVVkk~sk<9lmN?zc>xBWzY
zqb`e*^KNCJ<YL=7E44kv<jQc`d(9r9-xhhicjt;w>R8p5;ykN!SxcV+%{RkYS%P>~
zt6W^hyHfmlO{Nbk*23!?{NgigEf?D?z74sx%VE4tJ__D!ah_8FjV$Dqr;;c1DM}9G
z-Ew5ftN30;GENs;o$y=o5zHq+QY_9nZYr>*E_O=fNy=c$Ls$IA^3c9nlfUWS!+D6a
z7Q5z%5sYoWWbB?USU19;<L{&k81bKnr9`b+Lo*w=wuKs(Mrb7I-K}>>dy|CJS;1ne
z&ymhlN{d69zn_>ER?wMdYa1-(_Rx&l9z^eGMl~L)$^W3bvxcm|T`(@N5oxappVvI7
z0JgpD;Bn0j3du85vRI!M=dbKwR>nUXvyb)S@9aSQY}yZq=a73H6=H<Z@1Wp255*L7
zok_DL)E7F#Uq=<l#gbeb6m9`2!O-1HxDukY^A3=I9*v*L&u@^q8&r(xOxMzS6t>N>
zy4APaYwzR)0jaKQo5T_W2h@abyY--LoBu@H?mpT!l+~xcozvE%tV$t1u886zVi1!5
z^31w$m)$0@<Q?vaU=}+vdUVX880@Pz`0iZawmIMt?1KC7uXEj{`ni#&9O>1(1D;Rf
z+%Pvxb=^%meoLL3d1g1cdRB}K*n7@jDb;Vs$j!65$%vkeR}p>zt*dMJb)89>8N;e)
zbz?X5CL9BL!#pd78Q^Mr3+n@KQQCX%eqoE){(+F}!E3sr#h^1y9Jz&8)H|X~k9wDs
zq;9b4<{%$N)M20(ntzFrtA9Z~en34gp!5qdthuZkBAIKLQugo6F;>HdGJj`#vl^L_
z{kyDz(WtAKF{&ikO8PL<!P}yJ%uv|o5QfFW2!n|6w7?6qrEOM(nZFj+En5{5z~5bC
zpE9!>yh~yjYBwSOq|8F=&?Z6vB5xB!M23ZV7)i@pdI&8sAd-sJrM^zc>CPH1<$O05
zS`BCSGPD8+jVWbf4y0{Rv2){7EHTK(<M5Yx;y4`Z5Xa%lY2Gmjv6`(jxa$#loHi~u
zBl63f;<plW=y%~;Bcz?gH%hPT#mcoDqT>3q`amDny%+Exp(H34u!;x?lCXEp$`vwB
z%eOSh^np=~{51=se=UcRYttFD3s_io0+JuTm26ugymLRt`}KPzI-u7T;j1!y)yU|z
z)j}L-;Va}%F?gwMr%=v_FRa&#TIE`mO#hlI%F^MhS&V#&zf7<7k;x~lVdQ~`){8m{
z*euC*kfYlHhsAGUFBUcsz^b8~1oW5QMrLwcaQrKu6VkZfo^*kB(aIt`Y2qHCi(lb<
z57w+odGT9_QccmT5p5pPs@?n8Lq-o<9Z+tv-t}925r54HrG?X7y$>fpHc=)odJ9qK
zKSa#h1wzF6hb{Y9?*h{0)LyyK=T4!H=bC|U&h+^CcvqftHvFBZAwIZXSBMs#hpiwY
zu)NkwCV#V@kx!^(^ixKl7rfw~0Q<yex(hWD`>Y6fE!1z-tUEAZ{KCo*&zLY@Txm8j
z`?mQ-Z6C)^P};p{;X{h-)L+1x59sgwlDo<w8~N(($}v%8Oo~Ctq;yv@{PH4&TnFpm
z3Bio~O;`uNM%KY7Q7soxbO;%Saz9`=A3!DK3jN7f<;ZLlI-5Jr_$donr%is`1z2db
zH+E9zmDq!5A9{F4-fbFbO4$+!i^xFCQJiFJ=U$Z;MKbc^o1tMl3iPZW8Tpa#8U67(
zplE#!javmGG}}Rwq!fCAdW3r5Y`iei7;#|^VTFxRjtZb$C&NZ6Yum7GWDf{WF9G$4
z5RL@vs$bALARQGfB>XnN&{D!VV#pGUP;w~7J87B-^>kT0;Zxp$J?Q!P<fA_y{pulU
z)!dcFicUZA2l3K%w3d1yqLlu%5m;GX!s?(J(^{f>(kdwi1_!Lr&Dn-J>}}Dqz0vOW
zM%jK-P3AKdm?_U{o^3%-;Oup5GkW8DSeAc{y4!S(q-ms>>Ev(Z&e`L%RmaRUPEV@I
z99vFyQ9}GC=*LLU<lf7KISgG{QZ&$B3E`DcU9;;~!&Vn`XeLriqha?N3RI3z*uI_;
zS}WMw3~0gZK8iYEG>+Aw4i!(V!x(Nh8)3!?5NEwQhHCLk8N~t<bbqcUpwz4Z4I!N$
zMFWFh1~h&eZ?x}NPnrCf0xM}C${8;EN_lqEctiubM!2q?EwV?g+`oFC?A#xoNg0rZ
zjzrAlj+5F-=w@Z|<FqPK=R(x^2v#R%ko?#Jlp)Tb6vW7&u^_5N<8f+}5d9mpf{;n6
zU&q*w3P9g(IuPZ<9x!^d!VKDiFEDFTFl&hJxD&2Pvhk4_B+MEC0T45&)CfH#%^{kn
zcVPXW9ahGalsr0zM63PNx5cP^#?}+HT_cobAWGq0)Bfn16<74Ys(Bq~zQtG_ML(kN
zurjDk*ah7Cm;_2iR0?eavJcTJtix~gh19z}(Idmr!vkfYjcB8amG!w8M=^BH$I<)V
zTQA3D#7s9vcwvWIaV2?i@qun$0TGk=Bi$VJg;<qEn^E5PDDP{bJj&%_ocQhKxDCL2
zx|Eb+9L4NNy7!qTb3c>iE#lK{tMrYD7{q(PPb|lQ@mDc&_wzAq@)6>~Xx~cN62k<9
z>GvSMA5aL3<L_-s`6&ignA!JlVLh*5Qw!bUl_hv*Z80(Qp70KQv+z#y4ZP#e{#@`d
zBGI)^#((<Nr?Pd|md!CJ-zWcqcM&-jam8iwLi9tSNL%#B(I3YKVz!90+PxR}1ke^?
zW}tP&@rav7yAmi$b|um<FJS2zr~X_e+t5or*9j4sQexein@JHq<T<w^3Hn)}!9sHO
zci2=;Mg+6lLYbK1`a-cRTmGFWfWQ_4`Wk4FFdw6su2yvvah>K<Jyv;YNhs|2{kU&g
zP=_?bWc_oIO-XyKkxsQhE6MyKno1Ja(r{rdJx(Xu{KvpLFl8ooc2}AKhAy_Q0b%aJ
zKz_yutc@#1S=wA$VIoo%X$TOpI~oZ1SYzvB?Tb4ppoo2i8mxHroLtwJ)lYN)|1g@>
z>wJMv18*$Mvx~9kV`+w61|rQ<Ttq^~=5w13f#gwx?`k`~n2cD4wa)5frQCeMBv;SC
zpT#6MCz)hsSN!g6lBvHi%ChS@*6$-FR+6~CnUhVd+6{kZrEGG1cGGbdUw|I^{pC1|
zZ<uRJU{n)DlXgT{q+Ec#!P_PQ6M?<}$BCImUtD0+pi~8+)Zaq>_|kmQBqQ2DIjCpj
zcQbbXwHL9c(0=0&y5Yknm#0=d+83h)dq+ZXAq<z96?4iVPn(3@;Pqatev%g}4;q18
z0nsOG&ouTC>>kBv;e_EVd!G<kz%i_tm&^b3t<2pWoMYc;)^EuYtnDB+<ulOe#j~+;
zY2E(KKARiGMg(%g%mddQJvnb(@VbZMzlyjezR^NF)!JRPzlT?H0(O)~?+fFYkH{UT
z$QNo#r5=8-DUhAs`z+DtUP?xEgtr)nipH(qHyM$0o866l8G$FxJl(J`M?diB{mH^v
zVn>Ay6Le0k@%Fp7-@A?oLh!iSO)+S3f^fbL>$g+C&qJG)6I*6tz6-SIhGsa>LSu#%
z%e^PI5RFkg7BWuW_dZ+sS%f$1E%LhkwxvYbGsEuu-ddt{MB__qN%Pfx__4;Y0XcH7
zi7kkO-M1cdKeFXC{3C=iYx|}50k(@FNB(kT%P>cJHxco&t=;PpqxRcJqSlUvuPyl%
zpD<!|P!C__``Qb!<H@4cX3q-C>efj(Kh$InsjykQ+R{X8PFs(?d)s)MP@`ZU8w1K8
z4St~38TNnnkM)=B#6i6^-S~^pTOFm;TfQ-`;9NSf#oVos`Nc5CVI-TP9NneQ=#<tG
zLv380lQI*00qm(^Q~eM{puQoB;64Yl?qjl}(E-ctKBT#&hIg^Q?<_OqiM=M3U7Kgt
zHlv*_^u{o*CUevIeO>xW*%}T$Pn?O)$Js7(pJx3D!V^M7Uz+`SCo&99bgpjoHbewE
zd9VCzm^bPh-YGq%FK|NtohZNL=SMSNh)#~R_F^<~2WRp{te$Hh+R%E&3%tY$Bc1E0
z+$*2+vpENh^V9XMK#I6OQ+yuMuZi`-N%rY_JMMLgvrMQm7|D=r4Xa03|MFeC{=~!k
zBi5-v`Lb`K*KS@C_T%iEEzE|#=1UGT_ijPV>Ce=kob1@~S^wuQVdp5N(rase9efX5
zA8U@B1nEK$qe*LFFvIBtk$L(MMTMbXQ}Qo;hPPyzoh|K%Y>>A$ctp<RV6TUw5`bEp
zUNr0`DwBEl8;VR!S{WMies??Rl@@)-c9CV$*Z?<UXP?5Z=M%v<i}9QcTe9{)#s{28
z8l&_Ipxu!0eBvv+=GN(-c<#EfwY1_=c~?$H|Av;)zm5~g8w(lzq}4QAqM_vu>1XjZ
z!5*zAjnS@K;P7xp!&wdIG+5tBoSc%lOYG2R<K4UUf(4%Y)33uCI6$`~hF{s(Q(im~
zyW(5eAwLw)YT%Y=Z=$oEjbjqec9V?cNvH7!qI>O|n|OxnDetng690r!z!NBO-lSb^
zT0G9*swml*m@sxsx93>ahd;8oPqu0a%h%P(Qc@s)NR4H)Z>6x=H(`V35sMiS&5AQ&
z$7g)loL=XmPZ*bA#n2ph^S~VZ0)5TA`}dSmk?(<z!b9tl)+G6++qfUifELEzwfzoe
zMGuW{3+>{U@!Lh?32XW1iNpR8eRULlRe^JD9s3Z6J*0*CpS?5r)M^Jr=V*%1nt@g5
z71SpUzGF=v&{_?dcZ~J2_VMaK{O~608}=<?|J9UlYq9p^Zch<sZAb@@!-CqdpEMCh
zpXhY~p63VrCE+}F0WHPu9S}+pH?ym-XRii_4vH=A#`ul)-ix0cU%V;1xtO^OKH8tG
z*3n+Halj=R^}*o0?5HJ(eK(r5HZ|N_J$rD@?AcEXQZ$>io=%y|!+lL_Z_rF~E~1f@
z9|w1alf1qVv*Y-OGWikkPv8oL6Fp9wbXE{Y+$eDII4j_cKqF75PI&X7Hq+wW5gVQL
z!TyL-r(pS6yXy-&HOc7&Li30CPT>?%f%ENfln6c?9G}2*(tJWG#b_VpC-9r#JL$}T
zsHpM#w*8Sk?dN=Po!PVuA|FCJJ+eOEAE{OyZ9QZfZ$jL?wqAu8iPkZytqgy&T1Gg5
zv@>}p)ujEkrE6S?CsWzgKrj|PswpPx^je~_L~Tb#!@m8#Z_G~9?#R(7rz34pq24$0
zKA-H%p}*7KE$@swf7$?R)fMq|Pg70q^VPHDwDY3;U%TRFbow>Ry&~^dVz)ke9}&S&
zKG7|*w-e;OD|S`)B2U2fET0Su{}&*>AgYjC0dQhIs260oqP<;Li7s)sA{I2`MsYsi
z$1g*iZu_Hc0tR_VM>c#v0y%g?9&NLhsoHH+bBKYcrr5VOjcGW8wb8mWl5h!zMEjb|
z_Jqbag}f$1*6)Ih6cQce(`qeMwG%oKJ%2UwK;*=LjLlf53jU)c#zUxWQhUTi8*k9*
z3G*N_X;~SI$fW6{pGj8;n%^SVGLp3yO`*HQGs!&3(o<i5`g1YzXEmFxg8fjJ_}Nmd
z&MrBrD7qjYC*|Zb>A%Z~?UEDe)k$wfQ5noL%UD;`OYZM;f275YcPg@!qLzCDwRG3x
zOoUHQp=NHcZ`~%mKdYMEYY}r3y$TRdqx+*iE#WTmQ5<6kQ%Aw#eC-YF2E5wd@$DeQ
z=0h}Giek&ZU+S>Vzu6TLeH|<pp(Qa58cQ0+FN-8S>JHRtWYs-EkNO(+0Y&O-zpqCn
zZgj^3nJ!6kp`}dwYZ_@OhZX<)+WE%V1&EQ*VkkCDYIoq4#5s^wn|MZk)qX_Y+!!(`
z33{$`;GJv#dVl&>ZFB4b>+*fAuG>j-!5ywi_}~_+T@3x@Y(a-f+RT+wY&9B3=qq3J
zc%A3#p{t~xC0~|ttP4~aMID@OOs{liLvJpOqISJ#iTK-?UiD12s*KrqMAWea2wFwz
zci71eNuAW0Px7P)AKqGxT$A5RNh)Iem7Yuw<%V9!C2@#FjFv`dt>&^yjLL<RR5snK
zaX-@X#_M7|@U5i?9z^&G{zI`3l}cZTCGYU=ERCLa-u<5~Tbwl_74U{liLcRZlHL6N
zXUr-s^ydaG^<3<co|8DAM3r?(S-Z!3V-0bq{Z%Z^OKO#?i~YhLX&&!oSj<TuF*}7w
zlcI-FqAK}_BR~mKVAtmE>dIK}=Cs<q=NL-bXy|uq$KD5jU+F50Xk~g$!j#iQb!~Pk
z(imXY;iU0x>LanpqS|e-$W-m56?@pX2(ie7?~L1HpAd_TzU>-|jFa`Ocf9v|vB+Fj
z_gwkAvB>Uu)QdBQJ>{{u(}tzf(xfwr7v5O*-@h@rSlkJWLVRw*UY&FO-HP|h!|gy1
zi#fX&P1BA6X#*=_{avm=wDx;kq9<EAAFIt35xwMNy6vYJgszB%Bp-cZcLXr+!V8j4
z%3pTCzDf}d9T|f|e}|g1Gr7L-WuIc`b6W2o%R~q<4Og?l_lS$itDfCV5!7bqQC`+-
zEv<AnA3KK_>zU{`?Tog#me8up!7F=q<PR=>B)VT(%>~4-y9)mRME4ucO40p5>&#Kr
zv8j?>h0ZbcwnatHiu$G2g3Gp&6@YkJxwaTP@><$SQ8UkNxsN`jD3=$z=&GleQ#@$@
zAZLaoE)jud&VC?badQj@jN!4^MNh!vZD9YjnzTd3amUF^vOtwOfxO<b8=JxLlGob_
z1E*~p4qf^KNwqEFSl1_NE~KDyH?vv)h^I91+^M!VbkIuD`x`n^l6o<ugUV9H3ch&s
z44Q5G0<0L5Rya@o7JNgW6WKxa5&iIp!vPl;03>clAs?h>sWfS#j~~6O)phy4X2kD*
zZ^s+#l^gmH3UTRH?IfqPCzoV!;EPmBK7O=ZUPOM3sJl?6xVpt}sC==;SFTUK+<B(7
zMbWZ-h1Mykc4m$twB6c{%9YKwG)}1ZS=eJtEm+ru8xrTgv0{2{xSekdq#cp_W6WE7
z!6&q{C)JJ3=tZeU)Qb+(i=DMve}(T$cuO%)>dAc7Q$ih(N<BGC@Rp=^yY}R~pBCTv
z-S4~GzBk|K!<d_?E)<>4_OxqFu9OBLa^n;0@h_DfzoDDL5QN&x%nk`MK4y&SNqKBL
zN2`ZwYnv71f!H?2ps-rHwc5UTw69-1!``r^iGBSz)gYQ-dxvU0i(M;>$HhF6KNDqe
zBy)JMzBhOQotD*kL)Ji^m^j0y0be7s*A0tBSiRFJjvcM_(*{KCf{X|fbSC6^$X<li
z+*O`~8R3~HNF=&GH7jT}i<}I_#3AX|iSn6sBmoPpp!hg1#*BnSN36G@13sZqMas^(
zkl1B)!E@7yw8Qp`b0#@s2HCHKzw5wJSozOH!|uhAW;49$(XX`n6Ju!Qm%=i4-Kgd(
zLjFjnehFiFlfBZkglG!)y15%HFddnp$ZI8065g~}95=izdf={MOJk{&LwY{a5iz;C
zmhz=g$_bRx_Hy$TaXmd4SEhw&8^t+TE%rD?Jj_kWKDqY(_@!ShC9cX=H?g!Rmhj3#
z3JQc(B%UZ{-Zlcwn|2bcB9kC9jQ%q{W?CS42S+Mal3y^j<!%EXtLP4!#m9P#JcL0j
z#U4YtSgTnq@9dyVacJp~^;OStkcsE@?3f_d{(XOp2IM#0x~&8v-M~wc!zlmSf`2_J
z_j5w-l|RUfU=tWOT3ThOg;B*OA2!%q6W6x&_(p6S$_`U`iYcZAIT$T7S^x{efmFij
zo1cT)KVE;b#cms3`NQMqCQ(yHeS4X>OwmRNyA=4$8*VpT#b4(g3*GKO_9SR)i7R3L
z{qNsB@b4b@cMtr#2majy|L%c*_rU-49vD1$uu!Jgs?nY+maX<&{K4W6JwxX&Ub=9B
z=d%m{^FNpWr>EC~K@QAE!-n|Liw<wDSopz=@j;$ms~qUw6W9m%hs$IC==nS`Rru-P
z>G=X~J>PlkP2u^xdH-K~-vb=iQRewDAqWFuVnPrhmwPx-P$-Q(cAOx5ET{Ni<g8_c
zWCvX^89mLs(M&vl9`oMFW1q>Xa!F3hQJf1>SubmXHpfyb$Y!-%Hs{TzK$|l`o8^Ko
zn+t-<xpZ7ArK6~nHno@2u|Dg5U-$RTj6Q2*Of3a<=(&FC*T4Sy>#x7=*RQ+Z^PA()
z<sKqk$>ZzY<M>B^NCi=(i%yTb?Q~8lH@U|V)J5G7l6Dk=zvlE1NggtKKT0`_C>4Z%
zl$+FUrU;@qh!L$xm`mA{n~%GjNQxrIDJ%Y3-uyM^P|OF?>*uJ3aT5GQ{>_y?lgj3T
zramTr8o40XREE-{{Lt#@xq@GADnX^#a?+)Omn*uNT+z$tj`=G!yRoOYr`JuDikaMS
zrM$9~)feQwC{rpItj5(1pnCWzFP~ps%;^=K`@MoMPB!6o(*<kkdwef~d0|aPrFY-f
zcfj3QsuUxZKze0;UH{(Rz3wi5B$tv>RQ?0TsSOg8?smCt`AYY(20c4V#juq3>$;Sl
z?*5*78kwTfdwUM9n%?IRl}b^Ah|1retwib4kz!3kr&mH;!RcDEE`Mil@6LK+&AvUk
za^Z-F=HKCk;vwtE?QWvlmalS0ugUdOk7_(%N80_}9a^sMlkUeenb4PJfjukggWPhJ
zP4sp9Ua(AK6MaUmQ6uYf+oMwC<!|b+=DO|ZQ+|2GPuH1B*ci){eIElPANBgD%3hSp
z){Qp$cPvwnSX~z)4XXOkQPJaE8fx$K%VDlmWM`6|O>Jo|(UOj{n}=$5*pH%IaoFwI
z+kcxouy6N%E4YI?jkyN)?rLlm)BkWC)YEs_QK2S;@-Wob(|gOgkw%kry6GTPI3GHl
zl6F@kzesh$<*L(Zv{Bb7D%(&#(r+(&#Y)~Q=c1#OKaUFVv0U!9bQ;YUx;t_a#v5{4
zJ-w&9x2Lfnn=V$n7wEIZ!Q$Z}t}ch}lgU&mpB{o^kyP;0e%>F(c-dhDi=`s|=dR=I
z^oni~uFrbKG)9F&371fW2=%VOFK1kT#4kqnUTQKfyqSVg8XswR#BKOUF3OfFkxTud
z?552aRjY3}luMd~B+B=WCiA6IKnk*6IciI9N4XT5TSg|ADY=<SK2MpWGA<KqRG9~U
z%I4%y<giDhau}5>sfhaB3Sv$n7viQdT!el3l9#?frXf9ysM1P_9s3oD@+(Elky_Lr
zc0`zkR08rb9po3O8^+(pDar-ug_MWO>vu4mB(~g|ueyb3#LL&B)`gAwO#0TE0OZLF
zwYbT!Ox_PtwN$qdMz{loHNxr-O=~z#*)!%T`)k5(o5~n*zF`i-EjE9cu%X9sPvT~F
z<~ZI~PQQi2Z5)1>!&_|_vV6$$A<Ks>AF_NX@*m-Rog8kl283Iz0TJ61u{{y%k63@i
z`XkmKvED|1Y9CNZ4}JCg5@GP)+i)Ag2NA!6LrQy<WhgY)1NwH-%v~L4b1GX3{i0LC
zO%G`ucFxmbr!&wW9t|VE5D)ELF&_D$?P;5BHJw5U*A>n;r-Dj|5SKAT{8Y9BqkCAW
zuvjDS-+W8L!KHg7S1kJFj<8bPn#je|)<IAc$JkKzF#txn5i>@R4)Oz!EiPR<n|cQJ
zxqdNKO4DH8mX>mIe!<J6Ka<K2-4g{P#q8ly`AGHXv0+JX)U&g{&uzQDYLfDQdVc8(
zk6RQc&o5<xA>a^jC(sMr0qg=k26O^jfezs7e|COp9QZQu5by<H47d+C4vYW+a1W3M
z?gj>cK42fP2avMY!e5Usy3hvOfo;GhpdHu<Tnk(c#DMj{Wx#o~`6BQ-@H605U=H{(
z@FMU$FbzBdJPkYvOak8kz6Lx3oCLlId>(iZ7zK_2PoN(@4om=#0;hn7ffK;zfct@a
zfhtf2GQf?<=K|LNR{>W5Ex<b99Maza7J#1uuK;I(S>OfW`@pln6z~-A_o&}%z&!91
z;AP+?U<P;&I0JkeI1PLYcnpY8j{Dg8rTyQ84G6CSt^itqb-+3BZvYFxPk~o}v%oCy
z0`Ps{Szroy3U~r|9GCze1x^7E11Esb0rvy<0(jYVsSM<SW3c@cu3y4&*fRnIz&$`3
zxEmM%`hb1F9-s@@4m^Q6JPu3%j{>KFhk+Bo=Yacxdx0uY2J%1#7zFMD4gga2TKMbn
z#eTFwH?RZvC~zx~06qlV09*&O0vmvL0G9&}@N=~P-vh4!^T1Dlmw}gn8Q?kK4DfB>
zH1I9pG2rXKIPhiQA>a$Z81M}G;nTpAz$EYu;A_Amz)9eXz~_Mnfl(j=wjtjppdHu<
zTnk(c#DMj{Wx#pJEds9tKLcI`=71jqF9Od4)4;lK;d(>8-T)SWp8~G{XMtJZ1>pO@
zv%nPa6mTE(Z^CtY2-i_N!i~VSz|}wuSPxtVoJaa1@H+4_;8kD__%ZMz@H{XLJOexp
zJPAw!-vGV_JOZ2qz6g9Ccn}x`jsbK}Phv`qyScd^r^0fw?0e~Cu~Hy{;zzKa@tL6e
z_}(JstGTo*+i)&6S6shpW~7+TW-3K9{WNQDn)jGFb&}`Q(E05@hfjc?1MZU;6Mz`b
z9|F$c{8iv_;5lFp_!;mz;WYZrU!X4m9l##oF5oBN=l&A?32>f<E}#|I0R+HZ;2%Xu
z^=ZfYEPoT`SFkG#Q0*wwxSnzMAKbUk#i}O2!p6FV=gTBt{Dm^On2Xg^&~8I6G)t{x
zez|0nef@i=`*)k;@{6SFyl0=iP*)>&qte%^;-v4P2JS(eQ#)fF6O_U*H-rVES)v!b
z@G#YeoMhc%=7%fGWxWuqB->MHWn`AQB4750%__U5jLU1xWM$kTZ0yi_1U;)%PW$EG
z!Lr)T<h^0DGLa1)&Yv#%*4bHa1Y3f#Ib>Cl$t*|n?0ha2xkG+*#P^G?7}S2T;%+j{
zdvUSl{t-tMahbTZG^g1!7G}e=^iKQrttGZ^1v!uR46G|sUh#twE;>I|iF}l0SND$d
zA?oBf(8bNs&L>BGS|vD6v19_r?xtV`-nf5h3pbY6((4-&E;@wWjDU(-I&}=$+@y4?
z9)501x1q?I+<vM#?|YD(tbW-~O0GP-1v?%WmFpqjSvfAZrl-&Ju(rh3G;N(UYKlwI
zWNQyw+?LvFG_<AqIQ%4s12zm@6ZUUDXma$#somB){Tv>Y(C))<ts3gze>CjFj-A;~
zBy0FNMa^EM_wyF0v6j<GbbrY$mrB^ariUK9B}07ZVYBC`o67pB!=dbwTcHa!AZq2*
z+7tV2kWFEuBr4f!lPXAhb0Ka4bbVqYi7yjVh7`d)kkdl+!dz%Nv`Mg4Cq1=&_q5r%
z3zM`t)qazxS+++)^89!Q=HSY}fI-)Z9eB`Bo7BtXJCZCPNtWzxEf2OHhOQ&nmMUf3
zt!}$9%xs3Tye)tR>P%y1+7aXJBW^*GFP7Ybj~%k3#t1Y;B*Vpe<F6IcX~3h=vepkw
zTj6Gqw7xL+AA4$ijir0p^e?(E36Fx3xayNA+_ncK8q($Yh|Wh|hFv{-ckSM{`*x~;
zba+?;e)mee><8Kn2zs6p6arIUYmG}6GY$-xX7@@wVhwX;aI&Mc8`5o$&bc-4GzUAQ
z!?<4Xyw2>*P)Iuu6w+2qh4(MH7$*!<rA$!BP?>auVU#kV+0Md<ZCLPlR76`?wAV-!
zRd;t^-*)#vmiG40i(mqZmjReI!+iHsxQBe&w2hJ7W1lNxLy-0!k>^uwoNWA^4GWmP
zl(DahIn1z+=@N8E`Dm|Ny6II(v`a3`s&rf<W&?-XuR-2!ib8f7kG<ha!IV?ByFM$Y
zHx{%kKkpim3FHs19<D1dm7;BD-hgp4WsE9zBx7?O=j}^NXVxz*eGFkQK=FORX>c6~
z?Y>m96krF)#|0g7LzHu2YNR8T$Arr4w1v40c9H5tl*Od7BlVF)B5s7FJe$umTpSyl
z*h;oZT{d`=2qIoP2Up+k3i1UM*%r3nv_eg>6P8SSkypD8`+G2cQ)6OCY46?HkB7)^
zZPE}{f}n)v#|Cm1)4#m$2j=#S+`mx1G-X(p%|TJ=dQpuQ2IbOl*(+ez-N$f3cZLx^
zg)Qk###S<%%}E-KNxI*lAK)QcC5i`LWP4aDT?{)as877SCBPo&vN*0R>XN1<?#Xs;
zf%8d}TsrLKptjuM1w)3aq=q`OQ7*&Vq)yo{`k@zggsEI6UjB%e`0#LI+s!CH>m81A
zro_f}&QxyMhL%m#O5pY<-9|2tB}BD@{#px);g(x(!G0u%ybBHe#USiRABn@RnyqAS
zHD9cDRD;lvq$a*)QzEgcmT!AxuN3O<n2*vJ$oCU^V7A`Lq$3Qp@NzPZ=R|(l+>4;M
z-jA?vdL$ifO;``mzHB@!Rd9o(;+<R(D*}?oqlXbcZXRmH3n6&T7;$Gf$d%$KkZxqe
zn7Fwm;XZ{p`-k>*%?9iW`?7JELn?eyfOS|rRSJ%hE;=e9W{`1Wtps*$%SUl88?H8<
zDq61~e+dGmd`&{)n4cSc_WCrs;-Oav@~HN8H!m$+0c-^Jb4XkxD2)_s#%&W5b$gRQ
zJh00>2LnQ-+95Hrqkz6kOA1r0!`FX+$+#hE&sD-WCX9F>?AtA7E0-&Txs)lR-fqQ|
zPr1>#Nr9Ck!nPy(nF#7Jn=Fg_MSVOnWmCVYKjYck_X&QIX-Z6zDP_Ekki@GJ88hN7
zAGg9IIa{6D-@1LIK0G1`*PD)z^7DD?DvHvXrEMeOx|IGwv@yBiI{xsMEr~eB;dqcM
zrlPWKzgl{(RH#(zN%pZ^=%lgEhtq5O^^nIyA;+QR4%udwRtO7)oLM2L=Mwb5$%Cgc
zE|`Uzes0k?MIm*LEF9xB)>1i`%$ReNiggHF8uu{GUlzv_r!j7aJj2-gj_vGmTr8N}
znYu79&q-=2Y=4}mThcFT4@PYJnTMS5s1z?`gF=d4!oVYKQ{D>cMwrcGeP!=Rd}SSG
zx&u`*?~n-+o^KXIygP!~wHfDAc$|1RjtA_Yso<%~Q72U?W9W_Icp1V}uyoin*L>-)
zE!nnbGCCUA3kc6`Oak3GsVy5+*?RcH@i3dq$T)!Zi(_Oul1tkg2*vHp+3L6T9<E?q
zisx|kRpUc=MlIJBHRdv!{V-fERf1&+tfzsuR#+aJOYvNqJYA35!Pa^o{V>eoCP%Jl
zv<t5(<?-YkSD?*jo^6}S80&$1tb7hnwd2&uc}TM9b=FFW9?YI<kJ?bGS8&Wz-nf~M
zKuv9$=Gbu+4M?pOH;>+oDw^NL8|Xr=NS!s8R&qzY!#-TqAZab3=WliELR^QHc&(8k
zvYCcvdfg*#mm)R$6@5KTz2o)q<$CUTLeV&Ppo9gDS3J6W4j<AwFq5lR0-Avo=-Q(@
z=15z*tF7A6W*^sS9{UOLf)_Zo`zx793l^-FFcF3_HncWA)dm7o7il&Ao~#+y@UEZ9
zq4`w)@G!M|7-c%VYOv*&#H|Usnc-~<%$e*w7keVKfTQh8tX^^{UINmPMe8eby;1#H
z&TMNo6T}=MlsA^_HOJc8s&?PgXuH6Ehswq5Sh_LhOZK%Vyaqw<a3#$YKo)^ie>+b$
z^Czl!W1Q~gjd3%-A|V{i<I1M#NTrzfy)cX3;qm;1>RDe;W2KOG)80oCx87{mur#Zv
z`@_8aXZOumsJCbDPLp0M|HIqteMsy@d^LLt^pa77J?Z>#ht=I^e=<{n9$GQcy_MFj
zRwl{I3^N}w8Du_Mn~G)<a_g`gH27va3BC)UbwVSE4+`E2y;<>)!~C`kv(p7H9+XOX
zp1)8u?Pt77o`$369$s2{5jYFX1Fr+;fXjb>X(<L=1Ka>?0y=>mz*ApZTFL{|E;Nef
zuqwb#3-6E8E<46V+UDdJ)}DA|X=xl71qOjGzy%y&?kh`6Q@}Vd3Jd~WfD4@c>eAA;
zfk%LQfxCf^0oMWNk@wDV*aTbyoC6mjbiT5*^!zF0L;6`NgZzMXs$Zb1%TJPZbWyFu
zn~R9#ZNJEEm3fz$$728-F4F6HaU@Xo3$AzJYXgW(&_lzR0hp)kmN8vIm?VvM##X$0
zig%3gW==Aj!I0}GM@G=%9tL1XwxN<G%=^n2k!dMa$@`(rolJW4W<=62(gX=xURfWV
zEp;>ry9+d08AD(v_F}vM<A@Y)c$%Qq2y)s5h76M-BLx^@d`d4*(R`9iU!Emo+r{)G
zuUX7&)wDwxRfbTbLPRS|^rB=`N{058zGOrdu-4i)dc`nX(WZV-4zxDp6w7X<+L#n7
z9`y*YX2pn4uWdE+(?uG|p$#>gH^APPS)GMWGFe}-)oNchVz>|H(9R;s^J@}co?^=-
zepxT7)46(imdtx$WOjPsS3E$#3QK%z3T|v`n<1GrZQAICWEPEUtFycjRP!tM)>|G`
zw-pY`yai->qPcn;=SqY(0v`ab1Fitx4ZI!L2)q|~3$OvW0k{l!2k=h-8qn7PbX;qL
z+TW}A%nYJ67XSYq=Whf4DbU9J)f~1Wr16%H_u0UCKZg=rj+6HQ*8^nxHGmxN#EA>M
zRS1MJJ||hSmF%}RT^8Gg^UMF}fiZt{;~%{L{trC4W8K(>EpMCt#9N+40uGX=y3;}B
zl3wx)l|y!tPskRso9rZ?P`$`Ds@v$BpL*f0zJt&G&&RJn`@_Kx?EH7hJ5QZ>-w*$I
z{|}yfV)Vx3%kO^qyWhL>&;QvcKhbmcn`a)_^EcPO`g`Y2y*xU!|L=a3{>q#FZo{$f
z<bNJ~=d)9P_`h#DGyZfeJ8|?Y$A`~7uygRy-+Sv%`cEDItCpt@y!N5@{`CXl4-OW0
zJagc-um0C>p8dCX%zW-Whuf-SoB!ZPr|y}(?^OR$?~iYO^oP0g(j>5K?O5}`ng`ZA
zu;zg^53G4$%>!#5So6S|2i82W=7BX2{Pua^&Gt=@(Z-t79>|s0DQI24&hWC2@Gr0_
zKzz%aEHC>T<ID$&|136+H$eZ>TO6ZD_A5RL{lrghwfuvK({T)lfuG-Pc|+pQ69APv
z|L*1XJc)8iKK9IV`L|=Eh4`8Oww!-}?d)=_p3As^A27dgrR8Z)gN{Xj?7V~Rm*=Up
zIYRcdD|=|)!|=)vSHlmcUdo<;^<<U&r&!Mb+bMqD3O!e12d28w+G#d)AbT6@i77oP
zBj4hTzuC&0hYpbc2j&CTe-a!W|3ma#Zsi9J>o~6<q<UqQJ#n^Y>f=_vo#np--uR8%
zH^cmQ5fXpv&9+_a({{&s9pw`LM#Az3SpL7Wo|oAF5%V#~lRu}GKTjc@>>PZbwMY8x
z9bDf*<)1%cKK3>%FMdA5{HT%#ZQJ)<R=$(%`5^mkp0Af~=C>REosQePT)vh4Nc(|&
zj8fRH`9YiSG}|HaC*NiLw4iu=_RQ#6RQ&T-S>9P^^@$#dw>04sieJ3R>giPc`VU!t
zQ1Op!vwT+Z8Ri4UcQZe$_yvy7D}L@qTOUc6dcF3~ZMlm|{+=C{clde``HjrCD1P!b
zD<4z*p)Sj}D*is^6N;Z;zEkmgSbvw|+nMiH{1@2HUd69t`2odu{$Fe7pyGde&hlBs
zPrc(!rvC(re}ws};$Px=jVk^g9*@Tq-_869#b3jEPAa~W`EkY1US->TLh;r2SbkFT
zS6lwH;yd4K`6<Q6F0=f!;z!?N`31#y^8IR2@sqo_|FAykZvn?U6+guCk}mSye`wof
zUdcatyVbv-_}9fA#kcIS@($NS^ardzQ2a|QUse1d^WqQDGskihN`8jzoKpNQ)-$d6
zR^~;Y=pSG^9lk#aFY%Tpd`$5H$6FOY!Esmda~yA1eCu0ne@H04m-$Y`k1^k+_$lVQ
z6~D-Qui_Iew%h^5XPF;V{5bPj#m_Q-Lh(Zbwx5hEei!r8iocinS;c>ud57yE?KN~4
zUl)qs#eApY&oSSv_<NZT6o2MZR{yBtTbZ9w{2cSA6@SAat7lH}k1@ZX_~XpCvR|dX
zpZ~Pg)2{d#mhV-3=iOF*Q1KJ2XH4<aEPqn*cQZew_}7@9QT(B#Eq77zG0*ZXJWrB(
zy)tNdnLi0X_g9v0Rq`GG(eiE+zP$;bP<)p4bShr-cQxU=oAA9&_<<(;U=u#ugb$kV
z)h7IC6Mn1-f1(M0vI#%lgr8`_Pd4FCH{qw6@Y7BBnI`;f6Mn7<Ki`C3Xu>ZlewzE0
z!}ECQ&(g12n((nEysV!^Pdm%GN`8Xlk}mQC%qNum*8gO$qfW)IzuV3ex)m?+-X^@1
zBjry1iPbZx<YSLpKCAdCmJbv!@>Rvpu>7dv9o9dl_<5F}Q2aE<Cl!C@jP=iH#m@~|
z`z4>$*X45Om3-puJl|9NDD#VopJd+QQ1s7nyhZV`cUb)~#dk5^s`ydnUByo_->!J)
zojgBLd>6+%75~!rtluPE>~H^5>$hGd-^u)-;=7q2Rs0E#k14)&+LkNnQtlw@nN;#q
z96zo2yI7B;i=Ke>%qjT=j?XLpY1Sj@qGy!#NV^H|N_%lA{CU<R>B666J<`s?_j3Mj
zrKjt!t$!q4<R@6qppu_repK-%I6kKM`&hrEi~bqbGpXdKIDT63&$1p#7d>;VXGY1-
zGe4*JMdqddik=wv=N1lyzv?;bA4wNJHp%@~$?s?RLB-$8{FvhV{>JJ*srY-DpHlpW
z?_2pr#qapfmT$SjUYBC$2=fWWFEHPw_-mfGda{atmiemU-(Y@R@f&BXo=L?&#Qdz{
z=l_e9pI7{~FIYat`(jeBQRZ6}|0wgW;t%|-)zhx{agHYxKNz!q>{NU&^IeLcWWHPR
zbIkWDzL)od2NXZW{HWr0y=3hlQ~WgZQV;RZB+E@G`8!!&(nUVY{dqyjZ~KugcTw@L
z&RRaf^%Ff;uzaWDr&wP6C-MQy4Ji4}A6os=4kCYo<+4rWMW4t|alIs;@H5O$Dm_yi
zKdtydu9u{Xp4#}Y<QF(TulQ$JkEDy9IkqRk?JxYi_*3yeXI}b|$PY@tQu5dRnEk2v
z1ul17@q;Wsq4*;6(odz_8J3$?^2b?T(nUV_Gdq4RDEXER_PSeCd^htBhoWbU<C0JK
zcIIPBzVE#CL#yI<F)#T<&pg}Nt>m*D?^XO0tY<*+8(M6AC7<YzearG=N`8XlCluf7
zSoxERzlM3qC;DC1e_F|RGC!^OZsundKgj%?;_*K?%)V|bKd+K<@#Eiym*-f*cd}eU
z$xm=x(nWrN`7R|t_D-w6Tk&7}mzI}&qNld*Q1Yj_URlN0)*Xr$`Ksb;>kh?>{Fvg$
zxm>BY*g4H|lS+QW6}Dcd75~_0Eid^*&lKyQSMrM-Ur>C4_q`=u^u(BVI28Vi@3Q5#
zD1J0%dC4d8&VR7Hlp}mM=kHW{M1Pm!AGy-%k$j>j#`*`8e1iF^;w3)Xgr89Sy4!8J
zlZwA#ujQu|KfuomW)%NC>zP%2C(AD={zjH}I9=-7*KNyfS9~wai$0N`IBn&{F5z35
zuPQyW93NBsgLhaxk}i7YS<k$ZUu1q!@hyL0^|bKw6Vc-`->vwExZGaFKmEH_Pge1*
z{QM<Q{50#SDt?yZV~T%@<;NAD=W->V*gwYh&nx+p%r7c_l6kRL^vp0X&yj>b$@LoG
zQ25JxtRDsye<SlJ6rbs{@}f`l#GbPJoRU9z$nx`wZ~e687ZiVn<=xih>yaCHpQK&!
zMdlNV-_HDi;=6}zxmm?O;aUEK;x{sXQt=7qXB7W%%IcX_{MVU}@p}L@zwv#iRq=N*
z-=+B1j$8fRiocb|^IpYEe4q(0?<I&m0n25T{5Z!YUF1iZuPXVWQER89i~QtYT3+<k
zc+Nke^z69b%1<hOiuFt>ewO*gYnJz)#EW+R=DdG7FYCG%#kcZ4T1@fn{2oKA;^n;|
zSMl<`OuORe`FUtU@q=8SPQ}apxJ&W!-b%OP<-M3*#mjp`1B##L_f`fKFYnQ06)*4m
z1d5mUS*nVc=jEe{m-n#76o1E7+g>LWALIS;lZu!3V#XCO@99h^UfwgBRD3(nZ%!*-
z-s_oCyzI|TD_-8OnNhsF4>hZJd4FwA@$w$lyyE43u?5A;`)-Shuf30U?ehLF>!=pR
z$N0HvO!4wQRIB3kdu`6zvF3p_53G4$%>!#5So6S|2QJ+Mqsz14#bq2_jDJND9DxlC
zPp6l2oZgG3gT9Th+F?FUv6{d?avIqswvlREEBg%winpFyS|W&C<F^wiU5+$P2>K9S
z)>Wck!X+G(N8<STxnzIO$9L`4iY^kTeBHP0lh@)eB7N~>^_{oc@8LAdN#!5dx1(8d
zQ=a~B3HkPReE+h{-z01*yh?)jZ<J(QU=;W*KFs$JlMO#i^jqwUORV}R^+)=DDm#IF
zm)Y=QI%>b}6c6|dffviMmfq-r-93BF*d<|O+G^)J_wVVWbO~3JZA{zSYd;w$VPo2A
z=kouBBwS6lF|DWH{*NCC8`D-hKhWRTPw5h_Cfk_S+kepHldv&uwey2Ly(U@0)npsf
z_V3)Wi{cVCrmc2PKQl_{60Rn@QkwjKtd-K5aP)a42e(}lHj!DQ*F3Q1fi({_^+3v_
zFU|T%`M!HoL6yMYfxqN@{5?*5A1{|tDp!r#@5f(qar}MBOV4M%JAdif9P(r5R(zoT
z5)b-LeeE0dmykE~3pxBEDE*AeCFJ_$MVEi={+HMDi{>=nH^;X-<$L(QXg-lM`5V5U
zFZ@4tNOSGq!~^sBYHryt0{m*Nw4b1?e}DH^TiTj-@c@3!CT@OnK!~;Q*Xn_wV1IMq
z*J{MCpzz<+aqd#9YQGo$|7RPm=8NCd_FLhXoK~yG1!;Dl(0t(ff;2<?n=i@M^@{2A
z8%8T8T!j2(^NCvf{qy8S_oYQ%hvK&je@RA5+PL_s@wa7Gmi*0Rv5jet*6-N&xBl1p
zCG)#8&XkS6h0_=KeJy!z<ILD}^Wy}N*~q<tzVl2+s}0O|p83=S@|@(v-`f1LPt$#a
qm6FXD$^Q>aY!82a`u}kJU;m0Oyg7catI_7Q^X49)=TvkwllXsI(_M@J

delta 60084
zcmb5X3tSV&_Bg(q&1OjeL8Al&6^($RRa6w;1vNydT579Q+gfx*d{!-5i>*y!vc!N7
z?5GPuD|)Y>wAWIp#zzrRk&0E+R;iCF8Xju3!OFWJ|1-OZwD<A-{QmcTB(pPTX3m^B
zbIzGFXQro*x%^;dJV!`rqQFEGBjhr|PK3|e?y1uCqFq%7NJ8oIu$`MabbvR>c6U+m
z`$z(9JkzeC2trAn{ZpO4fDrQ}?Z(3rqJVlcTy+R)b?MTo4*87W&tUjT$5l4Sqb46=
zjSFOZ4^Tyt4)+<XZ#hYw+W3Mh+St*1Pwy|)A-|I&5Adg;#?~PlbQlP|?;%m@Iy~ev
z*ly(%2A=<V!8SWpkn(~wLN%%=h4^fbv+{k3?X5RkyJjE%r-;&nKj_IAK@TE?GKAX+
z|4FLHfQDje9Y2;LP|D*fb%=uKtFTR<+o4jxfE3X~5<TaJsGw9SQ7BMfvX>-o3JNC&
zQXw&KqUB^ST`n}h1d+yN3{5T9(yHMYv|mkuIhC6D`G_tOf}2cE9wF&M6fnyrBP4%>
za|!sbih<^tTw4M2d$>B}0ih24gZMkqvnQ%Y?;}RgQlfy95+h{te=nb)9>0&!{T~41
z)gk*Ne=Qd~E%j7~K9Hyc#B&?eqaiIIlb}+Mcc#s1KuW3(l}P`NRNQDlO8S>J{fOSk
zHYxG>&0-}}=ka&oY*a2;qx*+2(dFupHwC&6JYbom67s0a)Ch_oh5y@jEqH-vgy@y%
z86E=vLPh*atDJ;2jyKB^2ZcXlx4IFe)>!LCu;v7EyBp2eqStk7h#ld|5bWEZFyaJE
zDitT7fI;6=uk?ZbkkR<7@xf%;Xrt%?V?lU<@lA;e`d3oa8RQ}jph9O#QHXS~WTO<#
zlg^gt2NxWbeog8s`zZ;6Sm__`Fa8q!#b5n^S*!QmPp%GZk8YXKF!R~$r*j|8t6p$l
zFHZ~(e}<SkCR45;s4+Cf)`n3mEteRB<#e9uG8fI+iMqGR0QQqvWY#KL%UWs)cP+cQ
zmS7D`7kgUVQY9Ti+e6YuvL3X~jnk;AfrNAkvWNSxGKN{`U`rO8adso0)WUkn-2yr4
zxRkPcrY%l-c9{$0>~U$cXSMg$*gZp5^T6IHB{)s}T^^yiPDcvmY585>XlLbe0=Jcw
zU?`<E8~LaPP6KsUWiO9-2EQ?@)(5oX9G%@W|IG;v-!JA;x7hf#&>UBis)AoYC>6lw
zifMYYJtlvS&;+q6EI65^X+IIV+9pE8XW3)YVtZJXbPSBGF38q{{zE{3HI#1TZC-TU
z^FiSu^b)1qqEGaX3K0iQ>yqu^L{et#((tW}>Nn`tbs0A?(-`JT(9=fvjVB9g&7=q#
zZ&Zi;NjOGqu!qNeY_uv!Sn3kXZ;3>V=kuWO(1NBQvf*~MRji@W+rz^Xaa+o1Z5^uX
zcu=&ipvg?)mY{4+Vw&!?ki;OEPZc9kR#cF@l_ZST(&s1mP3&dPo)#W&i>9l#YgzXO
zh0&Tq;Hj_~m@3jiYX47cJ?RI3B{qz;EB(MA5Sy57^Q9|=wCAb`KoK!btWw+h(07G=
z9pUM2^KpFmuNr4lI@82!wqEodVa_O<H+|=2C(8ta_MvZKgz${#@aZhgq}%Li#PS`h
z(w1*ttn8tXkXmxPJ*{#Iw2+qH9k&xV#MYhu1yXTop8*0laEUI)yTvNbYnn7TS$;{J
z)spk#td<yn2gcgd^sfpq{;P&{!f@wA7!F`UMgy%Th%owBJ7F|uL>LXg)QtoL#{rXX
z_)EF&bZ19(BLHBG$m4ZAI)Ug@A`HC|m~faq?er)-hE*SSLR6m=A>sidZKyphJCv2d
zg2ep4Y|B~9|DCV_$3@rxfW0zU2P7H>vq~$Id<eF;yc=~=O0hE65JaaEBH(@ij0r}r
z(&tJU;WC%Ii`RG8yPQ~B0;Q`47z12s$F~u_gFyEz&*NBkI#|q&H`!x61MU9)!9wl;
zkQ<WdWGK@CPwt1pnEvo@A`~j<Ku1HcO6&RodT$81{T&S@!wCD@J?mVA+<sy%ZH6iE
zH)v>(3Uw@$xX}I%cqmEhZP1WV60-nGWOQ#w`%qHnr`sGSepYV+4E;7Q6u-EXg9bwY
z0Q9tnS56MLz;c`7E2D`_TJE4qbqc`ysN(UW+W#&f?~P?hMy;cMsy)tMSXnriO=CR&
zzQUMOCwS^OL)dj8r<Vn%va_?hU3L&O9vV(lBHBWVO~t1w<<jTSK{rhPK&}ktK7Ub}
z1DXRNmG3D|43vcUFLRbuLy4zHXPuZ2oFy6%W~<x<9-6Alq-p1fAlnnfEi8|zd5-4y
zZviGz;JhnSJ0VN9LIZM~TQ{jQH+~z`cTs%=6p`hm@q#Q3*p8v{$9WK*6sHwMP<)vB
zSSvwBf#3^P>AoikYW%dL$hD49-Ny3IbrfqFNU}|XC}WTtK@YUG1UY0^^$2@-_CWb@
zKu#cg^;+nVw5R#YQ0x+rpSSodwxA-2<WgIH!b+$zVnY!RkRZ~BkcDC@U`RuOnBrc!
z4=Eikt{xok$kYs;??~+*^o1iu53&@9qltHR{DwV7pQLoG2vTzkI`f}@%TY?tw8vzx
zGiZK29?`X572%?)fFXtj1$8Y)UbF;N+#va*AZ3rr_8jH2(7i4`DAc374)iE3ml_9R
z9cl=`=!dgdhmNF#WxR4bC`6#8=jpllZ@v!x64{aXul`K|BGCbnmK|)@U-?k%J25UI
zwBN!Aa-$x;D`kKUr@>NaUz|k91wBr&_e&LHbgPvrnWSHHVExR8vbN~D8Bb<c&8^fE
zs#`E8iacKwTR~pqjli;pP3$(g6!G+56h=_m34VxWGy83^F-+l4S>=+vlo6>7guFC5
zS;DhgT5=2IG^qTKfe}b!Sc<=;G%GRVY&5r#_koq^AEq-}Es~70vmxWbs!411t&t=>
zSTbqpzNM07edlk~Z`Ai%z3<_SwwcYzPjaftDreWvt(*5m?|IlVD&;@*mo^zz*GYzW
z9!!L`$FjQ{WMmX_HMP!5F5~8MK%Mn{tBql%)-qE@?SyR3s1B_UYvrUn&nlZ##ERRQ
zV2@r)o{>D8v)8@<I|k&W0#Ix9bERA^bvCo=qglW5m1@%a-8_?0W@??w4YAnub&0Fn
zah(xO^<ec@wVp7OzumWr^=bJ;^YwdlD)a$@#Mwtj4Tf(i5~r-!CBLNLWUibCeT_Jp
zLS4E=F~CB|%)CJJx~W`u0Xqc-w%P0UJVg3#YVkX{#a>rbjSh9|HS{LHS}rsizmxl4
z+mSdh{8=xcaJUKx?7zJ<Yn`Fg7y8D`WYE|{Lf%BJ-NxYdLG62@vC7{4MKt;?#H*DW
zS?%uN9^f7F0xuvE^aOpW960nBC?7pQ&dOZeR6MW=lkm`Q@>`R^P^PYLW7#G}V7fZQ
zg~<9iqxAcg-+zJ{mA!lVPg4B^pp+W6BLDCY-ZbF?zY~u$;CD2ndjJDzB^_Uh=63JP
zh)q608@q=p-hYtwu?4rHL#Mk3>7Yn`Jon+>Ih%)E7)0$x-pSp5Ng3r(C(%&u<o+SR
zUp-2k<rr%!EVqh>{Q)wYTUe%v;1Yn)`owH)2&vhq7a`0KM2LhY2gITt$^e)K<55|q
zSW;W>oy3|Oowf6|A@cI^E5BcdzU(nY9UcV>RQl~%OX}XU{2~}_a-hEoewDI7e?i;F
zR3h4Iu&W@d=w5cuxG`wFmk+rX&Gyptg#`#Zw>!pM1;HjYxY1F0CYBCxpT`YJIc%}V
zot}%n_lk0l)5i_Fj}0QAQUdCx8s)7Y^r$G){By@@t!;TztFNo;aA1A^m=!2a)m?IW
z0QyMPR|f(Yr4G7eJm^a1nTA+~ryNZgo0=Fvgxcfu!z@~mKMg#A)~zR={btN@B@t8U
z!PZu|DZi9Ul=HesRO=*olczwcdBh3++*$QMgUJ17l)GdS9!ii|D_6dGl$?mHw1i;w
z-?>l+w1n{h>|@rX6YSyvlm}bYo$~53_DglYE`+*&7u40er|vVKc9;Q)EiIvKZKV9m
z_E@hjCo4*c5BU-6TL~^uJwAa{`)f({=vY#H;5I>O;)|%GT2iP(Tx_)^C$v#VO9@+Y
z*$W|WcS2))(dt=IMTjOmMa5ClXb)etc*Cs1qA{!cHOtxp>#@L_`EYiXp3s3E{p@*Q
z_%l)R1)rb-qe*sEiJKvCqnF`xCGSOy;;|q%eBO;2#VZ)z3x=8;*m7dmj!C{2hG>uV
zy&)s>EE7^#uF>U;SE07}bJnxb<+}EeiS4KWt1N~1;$qe(TP_-d6~sx!tO#FD0qYT|
z<PrngsOyPtDI`i>OU&l^8<<&=pLc<dTx{e43?k-5{$W5=kb?M}AvNR7kHRG?5}n|;
zGN*QBEy$|;y9CAZbM34KD_gZ+VwJ&65Z5K_*6W0GO^{kcq`j`=j<_n&Tpz#SqFc@-
z;snA>0rDd5^f38TECh_!+*|`JNR;i<Q&-mfpi)+y({{Q3THTE&w;tZDTGY0*`Ga~w
zz9Ci}`du@Lf-R#q3%X{ZmDt#$UArMR!pK6pIP46)A-1oOz8|&^(p`o0v#`%0Ef>-)
zVJS3wmL}T6RKLQaai9LBF@8E(#<S0@-INMbGt#Z|B4%>xkox9RV5s?bGX_m3Gu>%|
zectX_yqp}^@RrIK7}fQ)JMD7|Uu*Y!CHnz4BiUZp=cF-UIxzmm9=^%F2*dW79GE17
zUe<1CcRT5Fob=^f2&`f-EE!~5f20i)8>v*l@=D%CLL%Mg%n3dP%#ZZRnXwF6m}+y0
z{nNH*T}#1Qp2X}lOKS*XKekG!uq^}?;7;^7>#d{Dj^hr5Urt_-tR7w8s2<Y2Nx~Zk
zoNF?MNt^Oa6RN2ocVeT;fKG0D7*2&rn=_ML2%qwe-sl$>fjc7kE{qEJLn*82dwDpo
z4l$Ekna6zkN;<N@>jp7v8^$-?ZkW=;+VB>?egNqoj&m9cN3QPoD6sl+o9t=y{cFuP
z>TlKEee&R8P1WPd588;Xc_#Jv?-~zV5(mSG!%R)Sj2qED8}wMC;d6A^calzZ2l{mT
zQE!Z&Mh5ciCsuEmgC-zdNX%Me&@?jB4G3S?=50(cH5M;3^jBu8h>4j<^%~JISLFlK
zAh(=CEj|Pub-VAlEjwVU+#Lj-1_WkX3tj#~V3j)%Sfp<m(07CG9g)N=lfV>eSd-Na
zb0%2F>%h_QcCPe!05KffjhOB5{IlFs&&=5Nh|G#y@}xPJ%&bTNOA)kn^Tb_#3((qj
zs-VJ3aH)@e^II@NWhHKI^Lqf}Zca>Nh8v>U?O>7xOd~Oe_z4`M0}~VsQ*oTO2W|C_
z<DwVlEmSP2Ns3%A`=n-B<no;5vK0?D%;s{|yTi)E^SN4k>WdWj_Smv7)Y<JsCi82D
zZBbLJLE}ri4+oK~Nh%t#ZXJ1D%f6@ur^RMs`^E2B!$m5<jTlG&D|{oLmlDv9SrGOR
zItdl%M&Pab0^V)qIN7CePFuj25~#GP<LNd(yCK?Uk=L)bHq6~`y+7Axl-EZ<+O|#p
z$NnOA7x+YAG!1jzizt{LF)ecPZl;V^?@J*27GbwfVEgQ+$<?CcM|Attv^{SAy<RWx
zpO*rpZB&mx*Lc*V9$i(BMdgOrOtXw2k$QZ6J-gW25B<_>yiQdHjG|DyLnTC$H+Hdg
zHT{$~rDUdAN}voWrA%re<XSMi>d{R(#kxQ0$1V<HSV}(Ax59^TPu&uUZjK>Xx}vv_
zmR%6m2lFDf&R7XE)wsyiAj;ux3<ya<{>pYKKuC6<ydl=t0*ca7qw9GnuFJy5Yx0s5
z>mM(TUY55^vApKf$PGCgqPgg#B``A+w5-=7?^#+lDXa$tLYehoyu1@xH^yrQCxHd^
z&w4hJ_IlZ|ikSp+S<j*%E#x(VJ=qKzMLLgzK{NyRPx6)1pbhJ&OcNjwsSD~sEjKkd
zB+upz@1dT4#Dm?RE09|qWeijh1?FHfg&D_W5Vv@CVTC8wGY__~y3#ILlP`1Q=!$SQ
zBi93%q9qJl%%Iq_)?u&M>PzfYc^9OD*7(n1)>0VkFEZ7u{r?2!F*R9Icb)~+pd%1J
zofyY->IM~vZP3=n6TCW~5kR-6+O{!Iu4}O-$&|_o_C=T+cXjom@tB!n%`PtE%vIsY
ziveYaTRRFGhCh#WQl#!EpT=_F1@fgCVq^L%#le=SLJHGGR!3bpX$;ee^JQ~mo)}k{
z8hB7VD7oenCEttqfXDOZoG+HEA@H1KSl7-m6#B}12$8Jz5YK2#QrqppPm|{KDl`I;
zN`3+{lkdLri!99bJaHX3epsPxhrA7s9P>xlQsC?c<fYOPzZR%Nq>XspjI}%uBtoeK
z1xTHr8*QzRTP<2p7xi*2ySr)tq{r9)L5-9)fr5*P8OsuMKl}xo%b_4tX6J%*B8IC&
zsv3b#Br9jUm7s@7r1Vu0V>9_BFfhxK50d5>UQ@c6nt6Bl-m+qauA8g-0jkzQu=Xk<
zi~+TqRwbpZ7MM$EgYl@G+^~%`*GO=a+#qC;OW4-mT&UV8!d6q&X8V|L!*y-*`4_mZ
z%~XX)*htmNiP^~oyJE?Lbrr<@OrVrxfs+BlHfZxwY>RVSH@w$A%|~}YncNeT5&*ET
z6^efQx_Jci4yj;1;Jqi?y5@F>qrBn|C^cp#D~J&l6$GcHQ`w(#i6uXcvTP`7iDe}%
zisu7~P@`2&*|st@U{5czr7$(dk<tcgq^TaHlgTEbYciReU}|P6<b-WmQ<XuZn*sit
z`~dPod#tj8A>+5TstOi10ow^C>N0Vwhi7eXs-cwAK34s@8GjWEU%xxPP!q5ol>X8A
zEydrB@SOv!CkOGV|Df*ysQDb*UhGc{v0)DWvgs}`cLY`t6g6HbDj=kiVctpsZB4;~
zNk5C%vu!(b3U_Qtwb=15tcgv`_hclN&T_(DSDs&dl#chM>3oA`934PHhY9zKs4=GJ
z)2;u5zuF%E%xQI)!Dbb7@_zEP|KxpJO3f9F1m^!E_b5meYHgCHbH|T1#A2o_Jo!Jm
zsCoQz(wu;!1GTm#VV5x4nD^aF{~{T6STqWYPNs1#HJh=f40k0j`X9~KJuahRWk~DQ
z<E4MtQmQUr|5n@$3fiX!OvZM{`hS7=ksuG!R?2Hgjkpg3QS~raW;`Gxr~{Ft&eq`4
zq2zmj7;=#e;SH!8GZ9<MFbT+9J8qndcSP~xiM%1Q-Meo#7iilm`_pf7SEiszMcOiQ
zUlhdN0IghIfo*QYYoIGtDHdPa(OY5qM1Svm>)Kg!tRjN2T`hslTtG>EM1Z6RxjjNh
zZq(yd&qFn2PI&&yYwU;BGFZ<Z)zYNZ{pw`(flmnUtjX+04H9l)rb&AGVAi$nXx;UW
zt7+TIM{!^VwSgb!oed+6BTenfwGGt3?Dn@_bXU@KlvUN%(XJX!w{O0%*>r#3D#@A$
z3rUSeu(JhE3+$D34va=>o^)=YeM&@h%#YI($WoDPn`*^hjMR)Oj8^nR!aL9MynpyJ
zdrVvcr}ec+3HC-Vu~Btjh3yi&vMS@*S=q4HNK8uzQGrNS$|9@Zj^3hW>uRNFmsDcV
z0olBOY?-psj*VV;KVkTM6u+Bs@I-$FbJW2f$?8#j`|O`fw==dcYhhlc67(}qisUvA
z6cJ|n=J0`n-q_37z5pnYfXbT{Wb`ieco`v5VA7I(OE3*Y>gw<~W>gX0*aLx;%cW`&
z&zf5Tp7phE$P0En|0kL?KHz4;-T@!X!iWBfrhtGG&7eLanz>$Oe6)zBPQ(*NV?bz^
zia51vL+n;&;;!8??1??Ji(|4LV975dvd(wnFV3Q0Ql3TdHY98Zg^S4@H&R4Cu-um!
zNxBEPoO!!!i`G_ITkk;7gDZM(^}fo$w&>>BPv$<HSJf}MYDWFcx&@Vb7b6^!1*fVk
z*!Vr@W|+dK;%&EU9tsQ`?bT70XEp>~<7RNS=jL{5d@5zHEV7|Bfgv;I6r*)(32+CN
zqBUH{Ua5+M7U=zx_!Ow05}a-K59vysNFnG1v4oB&V0IJiq9&>OyH>*P@7ax&D5N~}
zi!4zcp9ggxUg?M32z%wW=RqBvo5X!fXL6I4;%%bc|B5>q{p-s$6+sp(4B8<<=Yo4M
z>#;faScl#Up2e)gYbt0x$`2kW<_E7smBEW6@m%}5$^~=&rNbMXEJkbX)f0mE@cCfa
zM^1q)LyN>`W^xV;TRBHA;iB!U!XtZCgF<Oxmm&S2-s6GltMrqTZW=U;AO*)*xfYl0
zzd^e4n{RUP-`mI}mEJ6Rz|8|UU7wl_SN+!F^hW+!5&GvV!x)j=&(WP%-W)dz@a4F#
zRPd{$xdY(#Qr$1&<>2+P$eT6@UVy-Q(E~8I61zY31fK$AODTJdmJWH3F-u?wOf|YZ
zBnYRGIrlzl8xk}@$S=KzPs=(NIamv!yigK!7fNg|y;L9-o<o@m%BZk}J1A~w&%r}~
zNre5&c8xvUb3S<~G41E>h#_3C`{_a4q=owy(l9GxV@w6g89HuEc*r~QYJiadOz2;B
z>CiYx9N-XYBz?6L8IU*v!lmV?XGrjDn!<jbosS&&T{>8PYKJ;s3SJa;6KoEw7Wz(t
z=$7qV6OyHPRrl3^gVCr0s(?HA2lePY!sn83-W7i3b+kJqV4yH!rUbKVmJY8Q0m*!A
zs4yV#h>0G&JIm0+kp2>nBGhHrT*>Rl(b8e_B(E2svSA^Tq4}t7*dQt{?L!ni+?R?A
zS&gO+?=4w*5G@|w%Qr56sqJz9j(<lCju)1o?BQc2L-(OO!(XA|R<X!!L@(F4x&_y*
z;KGetH6MkJ2%zeQ?ndv9=tITD%tfD#Q0d}A=03H;zBMlY?Mv1%t7UEdnz0uMJHSQP
zx8G_c=Oi!=ns5Pb^v`#}<|ueE81`WhjTfQuL~w#C6)58R)efbij=^>zc9h@XO|0by
zeDHc|hd?7w&*|~)*tC^+k)Mn0>FoZi`~~~=qu}<=wb<$M#tv`n>ehQEKM|*^cIyav
z1A(NbR-bHO`Gy>P)E*u;KhGS<Ro||Oi(HtqP_`rhCJXQJFSlK5#(R6&)4=NJ`#0+G
z9v}AisY6nRryjLD*TE^iYBS*O=4MG>WDIj74Z&<<EvOWAKFGux*1Qz<0-Fhy3<5c1
zIi8ofiMz3b<n+{Fvqej5*q%*NrQFoWPlL6!dD^5N2aKVciMu<%%^x2AcAhyJjz#Tt
z_a2vF$A7qgEY8WW0S`Tzn|y;?#C5ZWgb%&U;U@j3mvOd9bQ^zVH0iAqHqBPKWCkqd
z4YQsV`K;d8Tvm7O;f<=~ww(IQPY9A<kC$f3r^e$7A~*$*XwJ(pXkdyw^GB9(y&f6A
zOChcah-A;e-8MY8*S&gQL_|Lw=REoo=m&?<xX!BKWn9wrnpKf&a@NR_YF=3qxin{~
z9EccjsqjLC<J81&wHQNUw!+!JzSbF0@-6y!<P1sNT=c`pKuKjRsvFr$_uXMru;q}2
zO{tZMb!v0iP0n<}S8TE~oqK{c)k;N}+#lGj&UEd!5G&!xFFghANOO{LR0Td+qXK1T
z>{mLz?py?TZI02{EB91BDuOjysq0gDp=cn^xcA6941W9EyI_sL-*;COMd9ze(~I7~
z-@mQ^`$<&Sflp-hSX<AmB)qAySV-)BBszD4=J~PgR>sXGA?bqK%10M?K*E@F{y5&~
zvdbzIIfAxDGCkEdGG}MtPCFG|sX$%ARJyvApYusr^*nl8oqv#+Q#>Ce$k6TT?+y~L
zTu{=4pS|w&H1+rR%W=?IV!yKIU%?i3Dh>W)@bK@;J<NJ2u)~z56YdBhA;D(YhY-{e
z3t>EBA=Sqo5rtOxBB8CFI2Y{o9n=wQw}-sG<6l-f;X;v89#YH!5YF^KO1Xcrr3i!K
zl)cWrT`XC-9sL|Ok|NTkAh*$@C3WE_a`bG;s&VMc(VHY!hNA&v(tC#tq)VO;%nwZr
zhV%8wa>>86?EN4{rNwqB<Bjf)@snf^M{Q&Jsv==cB<K7w=YWzv-Z5fiHX)}$tM5ml
zV}~+A+4(B8bgaMbij)^V10UZkLMk7EGxpK~Q;dH_%bIIPLC{QU?N|{a`4JeNr*VJ~
zIVjl7Yp_DoxXn#gK?-bwN1(YQXPe8C=O&9~oI)(2AA^;kQPO&;oyhOO_Mk&4tI5-N
zRO$(kI-!|rMg)z2YWGi@L>-fo=?i%n6!`D$V&{=|XR`scqr=~!!&d=TlD=GoW$Hv&
zS)CI$ULwL){|2VW1nQVcdMwV-?(ZV3F7kIL@cs@FH~>ZxGZuj9V~a&#^AiUJo;YEv
z+Z+hj0K#DaD?7GIge`q6!k&NZgbiqQAZ!DKLjjgK_OS!uN4!oTz6>N1FHj=BNd&I0
z1dN9Ru*)w_jBCY)BWs<o`|Cy6fV+V3P=J;H;zYRGfpE1Gw)&X}8-E)R9t^OGUj&48
z$Xsf3U~F>&2iQg6{l5Ul0|D6e7bnIKL|EAaCv5x^2g26@;UIu@Yjz@B=|H&B3A_K1
z1L2<l;r;;Y-mG(CeAj{TT_<pLjRWH=fN@`#XDWS-gT!|n2;XtS22?o^z61#O2G}m?
zpE^i<+kx<HCv5zE2f}55u%8ZqJ(?X2Yi~L*zUc(sf7gNW4}h^x^QVrED_)l0ag<j;
zxyl|F=a-W_6GSCe`XOUP=$ibfZ##2i;>6tKZ;yPN!_C%Vz`+i{uMQpuO?73Z-KL<=
zk>7$OL13-@Y5SZxW%<^AW$2HWiiGl~E3P{b$=`o`rup*AC0Fv3h>qqcsP--zsAK=3
zFSPUeHaXr!3#aec{`;QY$cw^tSZ=i+YbnoKnQ_qx;Fi#Nd?_423P)@~Ha~WI`F9Bh
z)c&e!ia|S(gQLlhL3z6@t~7?Z5ZqbgF@|QhxV${nF@|jdx17^HOaeJCcA4<2(BnFk
z7VhINw9VWWaz4R1UBv^vU;J3^?Dr5yLuw$`+pQCk((CAM_$xX+G0>;PuCE;G>;QtR
z-gc&)L&0O+w9J0mbI$)P8SgA1yY_o1dlFa`T}gQMx-X(?{t*TZVFHFyOq8zoNsVX{
zOP1)cRh(y1fqGHO2bS6O;bF!wIbpb%mAJjsIMPA{g6*)n1tVZu29s8K#TWmL`2_x+
zPV>dE*KcR(N^U!0oekr5d7yzYx3na~hKKDOj6J_H8Y4?;z_vzPCiSFFUzvdNCJlAS
z(1T!#rRA?-U#C4)u)U+ky|xM4e|aX}0t)l^qs?SAo5FY+Psj;uwoykF1g+RBXWe97
z?5AVaLBLWMQCmhGSLe?m)!!WiI3zpQssb6Mlr8!vw4bdf@;LbgC3slHb4)G>^nFJ%
zR*9-*0Osl%2sB98UW)bGMqVBIm6R6*8@(5!cV#KWKfO-NaQgHhFw~=24K0PeSSyac
z$>C-uL&=rXGke`P2ANthn(XfoCwN64t>hJ8*w&Jld3gy1Wn6H2xnO;!`F9Nl|KFQ*
zTQsL0@D6Ri;^~egQwF&&ZT(#wk36qy5&A<j%sn0}s`%lDO!msxkD!pq?kFy@2eSq&
z1e56;`ZRK2P`2lLU>m!t*21*X+!=dzS`3wAa?6P1AqS##euVI@?EKm2$4H-nV!g7A
zNYzIGEn9RUhr^|-UhixnpwOOOr$t?~Lm8n(&3QCMJCK3tg>&H}XpMGRSFkdS)`WMn
z*oXvcAR)<Ghw8LG_#7UhKYby_DGqg?8tszx2|nqB!bMZZ%d$SPKuiG|zo;iVGu4L)
z!+J7kC3-OR2EbjtC%~PKQY!_z2i#JP#EtEL$L=5A8#P8v#ub!I>ANUAT0Km#9D=r@
ziW>3+pEdaeztQaEw_t}#(p(i=(9E{`$8|5*5uHehP1L^A*@Sk>|J6kNPO*u29|)q2
zEm$xko_Pf}!Vuaa@7yQ$Tgb<P$#o>xr8AG8jm;QY6sn&!(seCFq=?@d6gvA=2B6_E
zAsnrrJ%$nTbH<|+vj;+rs@dbnb;v)qyACm)#b7UcG)V5pvhOz#Gt4>3JP-r|vgD3o
z$spQc+=kh(Bt6xmFG%}pw=?RH7EhawZw9w!OH>gqxdyBV?$lO$rN@~!tbccu@k{Xf
zikgQP0e6vK2w&e-Eg_=@W*e1|#p+s!O>wk*uhd?rtKM)Oz1!H^&+^ns<^fBw&G~X+
z>yu`o^tT842$RILr$|ri$O^~PA{bDWeO{njZ-+4nm}^R>Bkws{s<M0=S}<p*PRP^F
zh_Hg^v>808t?E$tH(J`t3njVHUsz!zGAhg>6H3O{160*tAk1%U#}JHhlm(#V096kc
z3Vv=?kFRR}OFNUsV2Uuf9pfl~8jYc<T9M~mxrmqcRpdX{cc##5(4?D%onsyR0gN_Z
zchM<xu~Nv;vQMlsEPbOZRl=xiZCDNyo`?^C1MaNJqbvej#>>&cxqWo+7rK}Dt=@7L
zZ>Bc#kBSllJfF2#Ax!G{eQRQX|FaA5H{{vcA{wGHNX@Jw+y`zwuuArX@I1Wfs0q6}
z5`%~k3z)bK(pQYikHg@I#7Z0~hRC$=m^then%Gq7l=WC3Z_%<@4aDdVjr(16bjSy1
zAYwXyiS2#5t))nm+ex!9nBbxY*Pal@EE4^d6a3)lO{_gUq>n9@Zrxyg4u?TXo)I?b
zDu4ku%%F*U=m+CJbYnxJCz%0qifty{EHats!JJtst0%k<S;!~@$hBx8Z0gF&AG!Wr
ziy=5MV@k(}G5(}Fe;~O}@B?EnsAMVl5mDcFhf`NPO400h)w(MlSi=iG8cv%9stm8P
z9$Gfus=(}w_g{qfQBw-dkHTv%u=ME8^oYaeQM|+)^5NGj4}coApAtLJz*q-FBiht%
zKfN*q7D;<nWoL=~bWu4OkY|Rl?Y1l+<1_1k=p0UJKiyG|{NC%Sv)_fXxpbSx8v4=K
zD?>g!uuMJv=QjK4*E2iYz>|h|-FUxUR)=@o&%v*^SIa)l?Kjq<phZRrDjd7hFXFHX
zv&Vp?nC)2!-Mb8*`oI|%oO>b0AI{lZzF+g*s$<I??A-O=`PmIt(O8{9W54qLk1zM&
zOYrs^FU^&=NzLDLDUFPV(8zdFQ*DLN#|3{cwdWV@AT=#k2R?3e7mQEbS^=N!On2xf
zzbNhRbpTce$iHz3gP#6S0L@|`q}J5(Kh`oFl8YVCLLL1|T&KY%40idkRsVf`Yne+&
zgfQeQ_Wl3Psu28G+k%~lxCw(s9eS=AoG2@?H<TJ>YF=yo_X+^t_#g1go$v?$8@v$G
zFSc(F*Dt}a*9#r(>i)855}y5g!>1QH8}52UNqZK5TbML!Zz1_|RUa~8Lo4f(jM8H(
z4cfO?`ka;Ud1i=05*(PM1}{z#0&C7YiQ8WqyG~PA3SNj=1@q?nOHqA1s21#P&6T1!
zrMLG6hX9GL6vdKi4z~FYl4$9o!P9zO;!4sZxJb6GhVY(`WGbTjeKk=^_{~@A86rJ`
zEZq>6UW}th|Fg8yv>Oio<2_BhelXcxH}_$3)$Awps<7LBlx29TF;WIL+#!o{J%k>-
z<L}CDm3bXD8%rRjC7ENY+fTYKipVtk67p2`OpqKY2npL2*z7ejYHkWWZRd|{id<pL
z1vRvxjmU~qnpH%4rCMJBX^bH*@ijMfWSmuJKO&5gJ>k%v=}BaiO-#98KMK%#|0!e&
zdF_oS&C4RVpm8Z$5)h%HQwys$jKLAAeSWj~$zP09EG5SrIO*CFzPgm96kX<702#{g
z+P{j}t_lg8A@j_MlP!F(W>V6=qz6kUE!($DvV0~dSw9~p$M70PoQ!U{tHW4-YyD45
zzpw(8x6372aT~@sM-fYkqp*32-D|AENShh~>fd2-iNU^MjLltM4}X2-tr+1#Yr}0$
z+a9LQZXqC7Dc7~(?7c-I?qt-4LhJw%#v(DirYV%C_PB`4*ggtLSt?G=vj7!f&j*%$
z-JZL)p7IyQNLRv!WDn=1khmR5OA+g(AOvX11tBLom5jc6L>%?Eg`$5E%Q}c)Ikq@l
zQgj=&E<Pr?SBAb@608&5r`VbL@1atZRz|Q=Ch)L1IOR~vQHx=kQXV5wx?PbV*ANME
zhttUEO4ksE?Gq%Y&Z~&&Wyl0v<Qga^r?T$J3`>8+us%mg>U?)Xxp)A<No}r2J2GXm
zcGT49!7gs^Y0y$SDD>rnhzWaq;UN2@xrV?1N&o=x51+nZ-50s~%4B~kKWg+)GI|M{
zP%7gCu@0&6P{>B@@}7ish}gwc=pv$sIv)fkcMw5OwRQWb<yR|po*_<|ZeUL=sBvzv
za%*>jD(z1EVeZ@XI8N6Y-IU{qZ^F?{i@2QS*inmtjpwCc3WmsRyK35u2js*g^QmMI
zG|jk4wX}Q7Kcrw0jX&1}zTaciL^$x5pWOU4kpxkjayW`gI*;MS?u(9|blXYdHY2Q5
zj+{U)gpQ)M2P4JeJwHQL2LO2V07oP{EfbqzsR{*>#W1)s>t5jo9!Z9kS9F748supc
ztEljV=3cf2CRG!hus4EdxEzpbq~IH$qvQ7JBB};=?kOX+y5h(;teu|+Bfk*vzV6JE
zwg}$<EWKJ}(C#c$0r8bGSzYI-bO)VCuRTJQ_6MY67?#B7>KWV#q-7XQ*0n<VR}_Jv
zOE{g>S(z&|OxszA$AT+4@h4wW=iV7S4m<`tmOo6wNV<G+1fxc3iybu7owmGeaZDjD
z>ujkw^1UKw`%kU77gD?EVB~$l;{K~K1Y7S}c#l@H(_Z<0K6OD#@F14qka5SrXyGOx
zw#B7}a@dYvWK~h*NX<qb+viz{IN%?{+xp1c#5TC?_R4#Q-~gvPzs5kq{gJuQvO=*H
zC4bNdwh=iW^y@xnwX7c7NQ8IvLs9+@w4jic-hS`zLoyQ)n2b#rLATbuT9jvkO>Cv^
zA86sqq4CR<jEMjXy3LYmn37S8O`JgP!NPdpT;~|}>+O}VW*SGC+5?ltHr_u5Wg0xb
z>d&Ao>#w!`hDwy6iay1t^uD)KL<O`rAVX?^*$-nx`tbG;{Tei6)zGfr;D!RAYgGW=
z6P6UC4_1Y}ljqFMG}A=&Phweh5lsFc5e|zHBSVec|3T-@3{Lg5cpICrBAtC1N8mVU
z6ocML4Qx`s?BOK=7tZX}d6MiUNb=!ET~sk@3M7;rUPQ)O<;tN1YKkQG*N$H8$L=lN
zGF3^{QQQn_G()nK7wwY3e)gPTtM^N`Y|M;pCb<+iCFClk;(2BP{{k*OH+1~LLtHUo
z>#(-@t(?z1d){y1S})~DF9IX0T)T;w-j4IHH&t7eD_{2^<`nf4eJJ{Zbsl7axi&(1
zL`7_{qMnIr4>L0$&w`J~CW0)or=V$xeqQDKGvTf_`}=MwJ}jp4z>}WcCm(&5=%WNO
z!Uc&ZBFVTMSjs0+UShzARH?u5xD@z8>2igdVTLs&-7pJ+A0<keh2(`=`)kBn`wzky
z)sYoe^n0ROCzJ$$9S2vhgej`t3+nYSXsJKEKbS9D-6Rs-JT9G0OW3r`pvf_l(^)qN
z&pU30DAr!YeTLm4CqCF>^A79Skzm_-{>6@Ew$F23aGI8)!mF@}orYs&+0E~H_@+X%
z)#gx=U2{@-l35XfBYi=!_QWy8NCnXW76_YHhpuTtJ|o~z&3H^ofX5d0D{h2w)MjGD
zE<aL9H+LX&V@JWxC+M3sy``?KDG6O&qtdyNwl7NCCRTQiR^wo+l62Sv@7q~uOK5Jh
zbv$gH9|=w$&Ys^<F+cJFR-yUtL+Tp0fV=N%&);*ymX`FVag3>v{p>5!7%G=>iZMmD
z#9x~4TWz+7ZMH8THf|`QM#)_`E&I4sW(>73+asfOTn^SGm-Eb|#<q*8%mHQKBzsAj
zNLbBo2sqDZC_rX7#0jl$TwSD0<{U()4dN8hKfoH|?-z8|u0Ai;hRcL?eRgdqIGij(
z#+P(X+5YW1=zK@i$zH3IpWp*jy=Pe^zBeS^7+UafQPtAQLl(D)U<;CQ<cwso$r2tA
zN;3w+t~x+YICJBHUV9*rx-&<U0TkRyjkM61P2mu&0&}NuCj5w(A%%q?b<<UYVST%O
zy-n2<eieCN^6-r|58lQPg5T6Zyb`=^sA3_+AqOVU<8JT|I9BOST;sCXYsvI01r<C*
zK5ai+0}<-?%)ZH>jiEc|!7&J=r?^Yos?0VOjpfMxC>St@r-zK*5qI;lj-Cb`P<$|S
zmhzZay#he)Pt76{Pco5j8=UXJt*C_CM1j{Gz`d#CD38Z@8Jy?XpxmR+TC8j`6ReWy
zHlk@A$;y~6h}KI)N@;f4>sG$N5WuGNX~}%MvMC6|cG;e~y%chEl10$S>urxY2WfZT
z2j9!<f9{B*gNqx%y}|sIpw%$SZ7tx+_**W$362Vz{|XmxfzvzC&~g_D;WE{BfwQrc
zTDM1M#Xh(+fNwAcSzL?(Iyu36!Pt`{*IP=(RA7>GM(J(#x^Mn)9+f{xnzVl3ddVjb
zmQ7l|Z@FXz7S4EFV_+Q4@m8AwK|3BVm`p$65sO`7#65n`T0G3!2^#>6S+0AMwHSk8
z(%HP3CyxqoRSYyAf(!94gdG0P_W%^RfR!zUVskW99s0;%6~EwaZr$q--HXJp5(ALD
zwuhjGqaWf3F&tMFY!UTB^|M~Z{1ngzrgP7DIZ5<~%U=UvFI%U(GK1R-q%XHoM@$_X
z8nB{yuuzQBLZ5kgp;daRZYjhU;0ygYR1N}P!Oy{Np}kboLAAMGdSndR(v{uGKoIm6
zGT6eEt3c~O4Bq3u*~Tz)2UpscvH7*Uc=XP{6I3MUJnq3VOj0W7QrC9vruFRoT2GAF
zy`6cfOP(4b7wLr93bYHmZEnE5o)%&$uO1IqID^!oa){Q2e?!_mL7!(k*O}54)>tq-
zjrRirZvJ{5g18H|j+Yb`;ickSCUCG{*>PN0D7M{=6kLQxH(<fZM)BS(j&M`ns31qs
zmk6D*v7Q<cTT0NW1@vv=J&3`iyN&Srkx));>_Che0_fzW>FkJg44H0IhXg3I=3m{G
zb>HT@yBWAmHZyq<XXCUjm{VcKepL65V*XW>CrUhVhCfxouaXW}3gu<M3s@EkCER)_
zQ9==&06h5v>=}yJ7B;*SUx@Tx-C=HIa1#lFmQOGg+==d~dJQP=da>LXl-ia3oaxDr
zf#F*&yhB;#GPn;bnk#+S9=YDskkn;`TDG#(2M!=+a^-39)G?airXm^WigXw9XgWQ)
zdqRQgIicLt*fBAkU3bHcZS(?FBqP}t7k8|#tDj4HD>ZP#3#ob&e?Zjt#GUga?fD+{
zR8Z<Nek^pI68u*CJ9LmUHXKJ9;tROy!M`n4=QA_uDA8npy%EK1h<<C^v*69|-ONi?
zfp-gnNv4Yw*uTg@n>T?r1?~rIt7Q$g4zK6z8gJ6(d*ctloAg^|^J@OX0ndu?`)2`s
zKKgybgdX`GHlx*zsQwe^vMfCgwvvPYT#CX!+s$~C0T0x@kM4gqW+{%$!!dcuRX9Em
zhvm(Ff_M0E(K7W=>KA7rrWp>r;FA1i`6Y0?3)53FL+ng585Up0^lUyFmRQQte^AF$
zNFFRdWI6ax9P`6^%ZVcgsN;Aq!z$2L-4GpRm36ZzgW8ph1-nq;PI4(o^y{~=?88Rp
zT#o&G4Xqx3o51pHuN+=ufFK7sqaOVyJg{KtfL&}er&WL5>Pb%P+_g*Ai~IHkoMbuP
zwTo_GxeJ_qz8<`J%*|jk0^SOQQ+)w{O}L1ENf<VzRzQp!j&O3`bemg=@45x24zak*
zH;zmtL;)g2Imu+CajYwa32e+YEfYs-vE^{sZ3;2(Js{?NXBV0anjbl1r~2!9@F<s`
zqyVy4Wcw_U8+2me=~kv7xrLyENR9gID$M;~8EZ_-MBky=N8LY&al#29XfuIZNy8Ks
zkXflnX&nEjF)WqjqLgyNWqb#eN#3=w843y4-}XiS4j%X&q-VW&h_JsqD6QQuW2i>`
z<=!wH@^aKy3fi95@kCU)WWY7PU{?lV`!xQ~be8KsYg@Vvnrz>IxQzp-{PH}Mzp<a&
zz4U0#__LIRSexDG?#4jxqMgPHDM?jS5z$<MsWu#a*BwsA`tZol80@)cJBE$s#7rGR
zvyH+29b1eQ=LqUX6`Vg9G$Uk<67>NoVb33$1^a?4_qL*J<5<c2o6sF&wB-F{G{EF1
z(V0-BNlkX3rKW+y^0#fpUC!V@7N*xjXDeTjn!n2MjryH??n4MqgB3Xa%C<Ii4(`o2
zq2EotsC*AI>cS0DHT-)G+;#bL6vOo&d~dgV$@4&ngcRfx-4UG(c3Y+Hhv$L*jy#Pc
z@6}S2&GlFTvLAvV3n%V$d82bD0_R3TzWF5NNBw6$a{}^L{Aa%T*u<Sv{~Np&@}Yf{
zZ}b|D*C@VUBy#7J@4&AF;mc@t1)0Yi4>F`mi(UAowoyDamLb?Zp!q9x;Kd^~c!A`l
zY+4D&Zqu^jjG+qIsolohXmUp!_P627Bek%an>q>}w-SYyl|FEp9l}t_Y4a7lFG#o4
zLBFfuSLr&aZp?veIKs5DqaZDA^TN3t7&Dcx7VL=Id!9`kPm6W|YEThAXHj(kp={C;
zJ~~Khh`p&9@JqX-EwohzwxifU!qyi1=f)ljIKy@bC&<{boF05%di{kGKZbMKql5l6
zks!J$aiq@ap)cGaqQhU)<7FhSNM-FmfI1NlY6<}bVt(n~i96qokZXr<*x-o)+vm|?
z4$LHpyH>P-&Oc<g)DpDgtEL8`&>U7$POS>6fKaZ5ah==;N8Fv0B{t4vp-S^0MwsT>
zbkuFrm{-O0jzbn4kSK)FW%s#?z2GHh4O0x!Tc&oM>Y(FYZn~-$wC}#<o@JT}bhgrM
z`CXK<X;2Rt?)CgXMsRaTu%o|%%gNcV9z$iDCg{Mdg~h!GxH?;R@<I`8n1#7;{W-}h
zrhdEn21IQ3YsQh9&fB~Au>w&>r*QBv4g?0~@k%;eN`1vh?5Dr^m35`NWh_+EaX{?y
zJ3hszN*b4#CJhnE|IKar1zhVIe`hjEwoH{29Y$9y{i$DLAEPGAMD1yNxleIo4B?HN
zgxM<BTmbDH;*-#_?b%s_R>{D#1{(e-0b%B~8w0g_8Cyo}i^P}^Q12l$upb4TUhG?q
zJm2)11~@<y<rm<on<s`T7mifNK327>TDEP7U9Y;i?Vy#@wyNNS+T-T7#I)RyBUXFb
zp1t2ML<<A@8Twn`F_1LRFKR_L*;az?ru6D@dfVB74TaWMmf&2aJi`+XhRz_*R4>Jr
zr+g@^+V7+ZC^WTS^u1r5M<4irMQp?Vz5D`>)`261FR*Y{k84VS5{W(A-pYqb2=&R_
zxIELWXG+??_=1%O2#5=_6lA9+_kaU$%SAZw))frdn;}<adz8}m@k>PbUv-f{*z9sZ
zF)xV99(oqJd==F#d*!L5UlY^j5I{?5VoW$uj8=Rz3}t^aB?KQ3LU6!ooyq-za0%f$
zJVz9S5o5L-0xi0|T-8JHgUp?{)1KW?i+1M^f``fQQ9&B|F@Hc$dq;388Elxsy@vNb
z#uEyT_X9Pt+3ii#<=bdU$89wC+x|1bsUj{Ml_1Vuo4AvVv_RxQpI^xUIFs~hAe?Ie
zEa)3AT`*$TQ#;oNxL}|KxXKcVybk;80?sJmsukd`|K<)ZP#5M-nsA9%Vf@UWQgG>=
z)MCTJcw~PfR+IP{kVE_qwg6wSv#LN(j!4cSIA;49zX!He5C22d<2E5wVPb)_fq>Jv
z5d2JmS$L*E9_5prr~{J2{yn=-naww#BQY&1q}YmQY;6(gIH$ppHGFr#*wlY)dR(5F
zj@+UdyOTO@hM6w9NCv<ut4{-wwQ$SX^hBTXtaX<1jr{Wfh!Jjp_+L66-XsC8It7aM
ztR$n_iY=-c^`bq6ttmJ-nOCKEIbng_*`hF4Y*-vNjY>I{V!3n}{2s6XZ@qD0d*qB{
ze3TFJ?a7=H!3>9ctRjsP7Kjhxu#8;B!)<MpdT}Uq#Fdaoa++wE?>)u73{4EX2(AXN
zCMgUxZqF&BH5Il95G*r3sxLfgHHON#n4T!Vn6(ZE0i{X;;TGq>><u>s;0C_Sa?(q;
zc2>1@$*k+v6|+jLm@>{|rC`h7j@X20)5c=sO=LPcFnZ?~7Y~`-BjE@!`<|5ykU!c|
zg-^I7O9DADOdl-AYPeCrm8@04uaee$2o%d}f9p{Z3^`7B6#COS4#LHWIOm@g=M%YI
zgZa7WFc|>PZ293Sa0bwe2WT`bRcF)tSBp*WUk(D~pWw1MC{8aP20U)y1GbZVi4fnE
zXCfmf?##f9{Vy^Aj`@`hU}M7G_|%T9#ffPUjlUc<1xX+kDt04T^4E?6R)`%1EP|uq
zFJUG8!+E<!yw)P#al!gI*mBf_bu_}78Fp3TbmmTm3tO=Ilx~~5QDfbRO>FdTkifcb
z5EG?G+CSm0vQ<WSwuiNN!H%<|(erT1iB$G3ja^9(dC%>Ufp8=MXWl=s6z!=F$&jc=
zC&4_=A-lo^fXgcT-X6TUyIuu>>u@U+U&mC3J|@a|n8uLw-{5a3_LC{s1xeEFC1qLb
zub1L@avi?U*r14b1iA_$`$-@^ZmdtHKzz>z1va<w5t-B2mMjN<@fvJRsK;LbW_v_n
zWSmIs;mH8H8h4K)<wX>@@~lsGUc{ZX#NwAa8YEHehADHvFAb)7tiT}L9Fe$O46KVy
z&)$L^qv?wxHXZKGz%n*W`InV7Eg@Up+G54u8AT0m{mc6FtuG+-oEPiQa@3y&^}%m&
z&w>V9hf!(UQc#@rH7e~J4jr<-uhge~9Go)YK59uKRJFj6OlcJIKc=SAi18@$SS+RA
z(}=Q<O;Cz$zACm!kG1E&`ViF}^X;{&<HVLI)D%jvd>EzV;gD*b*@I`W0w|@?faCA=
z(D!+`0tc;#0XlG@->&bdLA#F+qE@~C4f^5uH<Z5P7qtFF5~Y9jD*8IHH|l<Jf}AJd
z#&hjP^JX;nq*m?x$}P5Tk0z%ZrZ*gcIfWMCUTX+$@%?k?+({#~>Qys}{{Dj8Ob~fc
zJ0TAF75X~Af<8mxg*_;JpRaiRSh71>UicoRzxNOHW8um^`l76XMF$sI;C!m0O~xqK
znmzVL^NwcB%hB9ZeHmfB2c1NxPWhnBQ-0!if)&2Q#I(6UDC<$=C@cL&_<p0PpIDyz
zmGF&<dW+wsxhUkcFZ!vdr})kMQ~35c?fBMa!}kbB-7KN5@wB6Du(2>6Mb7V_okHFA
z)7~PydAp<B$3<LhwOi2a;$&1=yhIMO1Nz38g?;}jwCs$^d+9^HH~olj0?A~~)n&1y
zCTp2+J0~uxyY9jANh{)kxf8+Dz`H@+@7+Gd`)T7ChWzy&?+Q65e_KIfw{?rsRbR}v
zLNh7R>)}-f>>rAtj=K`=Z-EOKf)(L4BOLp|=9#dgp1mxE-K~YlD5XZ3THsN@F7fRX
z+SU2N<b@&%46Pexn=)6|L_ue?+g?}O@+Yks!c~uJ51nBrH>z$`&TCuHOpq!Cbf<Vc
zo*Jhhz_syPg0E7pr$@*KQLyx|8)V$!RHX}qF*1NABW*=8X$u`0yje+Ikjy~H#Uklh
zc{v^KlgaZ;T`yr92rhcSJrDHJSWjI+%0QCS-oX5JtW{!<tBlSwEoq@Zw-`rBTV`g=
zFW;MRU!@MYDN%>ENIbO>m(}CJEd{PA#OUb)=1&Q=2wuh7b&cQg{O!r<_nf)c;4O|h
z7pYNj>HH8Q>2-edGOz#`K-Zib;*-sKloC7O)k35*n`ztbqc5D*XzexrmwU#MDQ|->
zR-e`{&ol;J+Y~zj>-3$BTDTAK_P^kzEW19&6Q0`wqd^_gO3+qnl(e;gYXsDe!(*(C
z;p*`%1V(MhE{LoXQroxTyn|L+`^&u~h$F)hYPy?nK-L0t1>r6sEg;BD5W3bP841OJ
zdFb3Z#rIS|WTpI3e?!!mY@7>Ec+l*hP$wvg;^gg3(HzKX{S}YvRwW=h!u2=F%uFii
zH7cO#+ae?lDV}pgjB&#ET4nVr;87~fJRQl*umLd1+fTrK8JHVS^zdB2?s3DC+CgFK
z^IzHLa93*PV`pXPf`@ufFu5V1m%k27$nD<%VE%Qlu(N0vz6EkD^10XxBa*muCF{`w
zyFoPwgWrFb=~TeV)VO6)I41YeJzfEfeF7pWqT$9q1i$KwDY#11KI=g;X5~PRR=}%w
z!}H)og#D3Lykz6njXWz|>-q+;@j&v8qCAMtozkkh0isnF3FnG{&B$QO$g9SnDXquv
zAv&9~uPQ$kRXk1>po<W0ANkjH&9jK8Tnxvk?7gi5RH(6!CmNzL8f>v#MvYMjuUcYM
z;0c0&;AA+HZN(7|K9?~nmQp}Nv6l2{5r=&+3ZwJ15VyxE;Bnu|*0vImq0qX*7T@|u
z!;vzsKgKSmXP)H^t5|7CBsdNov<iCH)}!f3`w<j=Ay7gDq8Fv%691kk{D+B>RU?u9
zhu)s6M!+I&gB$;Cu*CJAL(rigLM7Q<QPmIOl57tYcmaOg(c%lCk~B5?^1=)W!JywS
zOp_2kXndIu156KZgN34Z%LY2q!_elkVK@!;^DF3F8S5%onI$7&$M+NszZfLK<@QH$
z7X!p}ZC|wc;wz5)-stqj32M<Y9SHin65H%zP+f%h=AO`JkPq_z@eQ$`TqXMW$0Lq9
zK2Yb<f3K4(Lot^e{UlJxbZJb4fM-I-CR^7s4<elO^@=1;UN4bkvFbD{A=<}WSJ=It
z`R^@i+t7<kYK9gzFD+=mWnpxnL>tlU%UW^d@h*VTQFP$4W3&l&^z&sWwVohp`N(ks
z7P${M*)R?u$F)}(wZ7KTe*gg{QQm*=zqT5!DSt<#Lg_tpqdb-oALF=*La!u<Y1vO`
z-<2;I7nmuRAAUfQS6>(Ls=f=RcQVSp`npJYZ4qj`>YxtuJqo@yCP<hC`nn46Q;%;t
zYR?|p(uoH=E$sLo(q9`e;2*BiHt@Va;8Uq5dx?=i1V$TT*0h7Be*qrP(E1lX8XVb(
z(tcX!D%dPROn2?OlTo*yN9Y=%-qFYpp6{9+qV%jI6A4d383Q+i(`JY8H3Xr~mPy_{
zYY6JMa3Y7dX;|jqs7e)x3oyoytH=Md%^v6RSRMM$7Z9NPf);vG0(#(x_)B~6m<{YS
zSOZ-06NVOW3R_R=SKOOg?b)y2!(vH@?!4~rPMl=2!;7tmi78%Dgg(07U$Sa0%DNt~
z5W0l>#)r~avGe$^?b+K-;F^<QxA0)022?JR>WkZjBOQF8<Gg$)C}NOi#^VRy!4VVS
z*CMx^RY49l#xln+#W+$9PhCMgXI%#xcq2*|vjiSjl!DN1JAO8hb7(`0D3i|rql{DM
zw-EL?|EYN<2<itYaY+0BrTz}*Z)?I%Q~c5*>|xgQbzs$iole3Y8Oz(vpByRvK5GA2
zaB<LNq(gxjtuBO~oa*r=u;Pw{6T8&eUhonzPAh4K%!6+k`CSwp*p;!ZywN6<us#XC
zOl;nLnL4co9?HfntYoe*#Z3BHaIzlco3LFO^x4%SG`d2qdkk}?czpXBxT6Kh8KRHp
zZv#<Nze>-uxL<OfH#v{*W^fOZ0swuLSnoz>Jz{}aZ_tiB%aR7A>$%oj$@u+75Qv_2
z6XYde{)b%geXsgfvPiT*gv;Pn=#cTopmVM4+jSD}2<2>0RS;m6sWOvjHUknsM*7B@
z$*bE?V<Y%!eEDQ}I7&UBm2ft5ew*0Em9YQctpvA1&^kQQAx@Ph-5$5{w!BFEiqC{e
zyVcd2XCZ~{s~8jM4i~ZWOz;FzH>z4n8Y0O^MC&I)z2Ai=mP69KsOl*s&ckK)IQtXf
zQgVoA4+wrwb56EFOP1ici=tM(_ATH*YtXr;xA9^HN5k3bmpqZlG<48fhy+>F1V>&S
zO(H~X(I$4q&52yQ!(k~eafW%orF7U}P$M-(Xu!<?Mo7~q(OWk|Bq3p-U3zs54;lFv
z^|Hz{6n%Ho-z{Xg96tx}!oI3*JgU6emjMO=U+){p<<<cIRf8c+9NQ`{xU(W<=&dRM
z00A`39{0`nDCX81y7Pi!UV$&X+dZ#zfr)5l->UOuCA25H6$C1YkXX#@(%7L-FZyn3
z?LaDcSnZcmQq>CbKv6bD<VdY%V)``>-YTKH(*JL4fI~Ud#~NM)*mlwFsx}z=_|0x%
znG|7l_aq`#bagXK<NpNup8Tq-(sdlt-tI#tpoH66U3On}Xdc12MJR^3*)n#wTuxRA
zLs;~#$V-)<cD;b@c%xO@B{6N?r^4eOpE{vr?}$+P^%M*=&&<xP^oCnS-Y?7N;&M1n
zB;Ya7j|F19U8k5;;uoR3A#k_OBXgIT#BcRr_Rg#T_TH*o*W~f*R$zPL*R6)Y;xo$G
zDZ)aS<b_lzlrmNUO8~<_K6Q0lKb7z76cWu+NN#RJ4GkXnMOi3;uLracpBSs4E^V76
z!!-b!xw#Fy^Hm_%sZoL8@xK!w&e@_FjsY)o3}sfO;=STP&N-Ata9`ZS+C3|m2*a3N
z=MqtZZkPzX7!hxx&Uh)|;N-f18RWxbr2SNxH%z4Rh7@oSFcF*;Ciq$)16T^zyt?g-
zY#K%lzyY=H5t}A^5dJP$RH5t11RfBqb24)$4Gqc2>Dw}IB$K$YS=%zblHtL<sBP(I
z#Z7ee`=Dqxp(met4}Y+N)L>_;{mM6|MNOC(KoALff(WA+!j~FBCVHwr#s9$u)pOuG
z%Gmwz-Nht|xd;CRh7M!Fr}vIYX9QgEi<lLw&VEcFm@15`Z-zKinY+Z98nNUi?9Q7!
zMl5L|@ND5<a^QY#rc^=rx<(UhZ4jj@h4sJ$RUmzppK{N`Tc))Q0a1MqbcJ{yu<Gh`
z=$ooRGm5H`u6B<wmPV1(4|9ZZ8-GY5sgfn6bNqPhm<E}=ne_E`A)Qp1zOA5^A!or~
z6^ZHL>%|dhK=o9z4_aM45<+ovtF`2-$X?wSa=O;^m2~`yLTjE=F>pg7xV9G+v#k<E
z*M^fTQEKgIDyIA=biUR~PDP(R95&EJE_wU^NeH7G4@Z$hk^7@l(B4UO`Oyg-4)4X+
z81MrE3z`?zC%0XGg7=k6>pp;s4Z)V-o8isVlvA4_dMpq8H5yuh<mZ~VycX~pY-90-
zIEW^KcTmCLHugW)3@$o(yt|ERc+vj<756P*QC8dE@19{8Ku~m4P$)?Rk-T7DyXjyG
z-Y+GHmP(D{rBX~S?NkH83>Q(*QC}2I@|e;bOH2#R6g2QwDtc1UOvzDDGiNm9j(orM
zUKHQ5)A@h@=lgh`#mua=_uBW{T5GR8p2D;oW%$7fW&pxvI7f$b)@7rP`wpRaQd1dP
zWUYR*t<Ef?mil>_Fshb8tP0ngu0=vmUNQl<@F>Z~&B%&gqmr{QFpUM++!xkR77XpC
zs|}Z(oD67Nf4_BH{3z;ZFV8Vud7C<#&EwO$hVi!cZuO_~Bh6QEB=3<G+F&!e*ZXI$
z=Z@ytesH>bX1quK@$oiqx7s23XU5xFyVXvAFu!AgaO9t+9h{|fUK?Wy+(kgb2P=}@
zh7lS!v9EO4Z#54&?)^G!3nS1WF)}P(N$P`bbXXgY3j+*z4E2s}eWI{pMrc*1(pBD=
zK2;R<iiUa$jhs-+qtgKnpj>8*Jk1i%0hnpPR9t95z$~+=ZB_(oG*YWNlfI;l1x$(6
zag1ad8KD*$$MP_??7!u0WP$`-6p=zKI&4Lb_w=S|{NE*UK0W?>O&4Lpav1+L`OfPT
zMS1FQlPFQ0Y>B9EY03D_xA~Y)45KtIr)lfqus2w~`E7z)Z@g$}ecNBH-&kgO?)D3+
z?W-({Zg*gnmdx8dfV^cncDomSuC#Yi>l=?*y4rg&n<d)bR<-@O<)Xc}Wt-iLl?sTt
zhk<yLnJq&dqg60}&2)5A>j&<z9C19S%3p7Bx--BjKQo|+_j{N5y@X76elgrIw@QV6
z*RVsoVd=8(qe3?fk*npeH#+g14cG5kw%+NX+IY!Qa_2>Fed9O5OGA(EY_?i|+LUE(
z2GdK3Cmb6s-R^b|)o=XTn)2*Xudiqu9?)pl=dU48`aFI^%XgmwUjE%`+G}2`w+++O
z2AWwo;TmsP6Gxr0>n~d@>+kkNC1hBN@Ae&NKR*vHX6ROc?+~4HVcmm)_BY1a+{@!E
zFa6$C|9X|v4p$P38q!=<C3+Ow<b)3OclLNF`qg`u&wn4J)AzXla#9uw5{TOeG-fZK
zCL`t<qJ>2q=UfjfVxi2}Y~52Zr_|f^Eov#k=p?VNX=@U5MeH?GPqZsa2rR5`8IDzZ
zNtu%vOY;lDS2Yb^c3BGly)~()<->}nIz3np6jMxuFvUz3rWi{>#efzk(<Q0g53oSM
zRPS-`l@{Amn&PHf=H46IOUSS0D3mvFq&uecVLKHare15@N0X8j3-NGspoxWJrr1dr
zDlMLsZTjlBUx08!;4tK%U4QcY!`MTxc%wzXHiW`$a+jv@J6K+=3|ARfST<MA89cYl
zYU*=b9avbs*JBN5D0&-~PwO;grYY2$O7m}7(+tBkDudqYoDi5;Z9Cex&Q@^#{?WW%
znhh`$+f`-P_qb?@teU2>H(I`}8m!8{Y*AHTicJ3v9cH-3iG^LDhAPc3#_vHICmaUq
zTywUVSQufao&*+->aiB;?f;^BpOhp|zZ>Ib{fvQ9XImHE@G>bT^ka%FeQWv#pS+4l
zVHy>K@yl@2Q#n?lCv^CXTzZL&4N3i=-Zmbxtf}eKMn5Jy%MFi6xVGU8m&Y@Y95nHM
zOKFXdT7Po4<$lext@Y_^DQTUyuwL$0Ei5By{nUDUre#j;xDNUjE2IE*a)9(}-40k2
zQAPSO>6S~i9l$JoWnDW&*<$gnd#R1Sh0ssI6H(3zIZXe_vY_rMwSJ7*l36#s^QSa4
zKb;{odx)`K&Vkn!>ZXBsYl50Dz1Y&Jeq==YF4Uc~Tx*x%{gLX{;#OG4e})mAa&*dv
zulCGI2q=V$9pkAdZpa}Au0}{~+EKqDm+w##aIlXWrlB*}QdHmD>pV_?DYL?aOGK|Y
zRP-BC#~~KahG8v#1TArze!X7A4%1s^Hw>6IALmoApRs*>@pEW&JOr`zsmop$g+2Ej
z+{Ymwtq`k;uDoyd-!Mx3EZiB7j~_0ItS^wr+K-Ep2EtJ%94RD`bv22s7dC|6v3TD1
zHy&-cOZ-jlPr2Jl>uWuvQ;vMb5k0FW_3<_A3p3oVRI!$US1qeLL)W&>i9d_1o5OmO
ze*@0*>s2P0fce_&A*I3W8mg6xj(n)*gUbBClDLWUHaXsKm@Bs2I(GfU)zhVs^~Oon
zQz~L^#d&+(LY=s$;liOiC(PfibnE(Y1J<>5<ICy%JYx==G?~f$5L|J*gT?MzLT7kZ
zwQq@aUJy2G%Pi;FSKc4=k4^tjeQ*Vetuo;v1e^@ih%IgIFV1A?-&@lbA4i9;ftBq)
zs@zkIN&ej{stuDIZWcii;Lv_P0-|69Na^&6yWvuWOTt!n7)B+0HuAw1m9{;!J*5N1
znPqgG_`|kmJq;JzaZN4uSj(-ZNbH(yhwuxYK`duegpF<%+$ZSHz2+*g5_j}j=Tq=1
zQa|Q{eJ-tIPux%kz-!#hf2nMl?^XGnZH+Yu)jGf1DQjXEa`454w1tZTPmP0WjfCa(
z-0^+)#zWu<+4QxqR<Vvo=nEe{frN7;%r6#w!xz7l_LBN5EuQU)?MoXXk}A=5@<OSs
zqM%JBsVHJ9#O<V4GYHU{jaUHbE4debtIC@kFT!~OnGXK`%{r6z%alknok(Hx7l+qc
zMhB-F+G~uS@Vtf_8T9%E#xdvF8|V(2=4!BkLe!}W*O&^crAG3VhU0eYGQ6MF3awC$
zW_rJ>RZ5b7U_~_>W_a1*PCZ}e?$GjeD9q9kZw8F|d}P8_56HF?J{$FiHZuN2BgI)U
z`r&@v85VqZt)@ws_#qT`LL-4q(?*iph}wsm`jIyJg=TDe7(h4SEStg`-n<A!>V#0k
zvaRZ@$aXqCjB;7)@2D)UT|V)!jjX9yUC8{5SrgjnUweptspf7?o+yG!T2JSF_+5Gp
zhfK^;=AYoDJXg!Lwtb>~N^A3}ydSYo=N58casI+dv*=|FL7-(#>TV`wwQNQv@;E#J
z24sD-`u(VSzeRFOBaZPeA|;J~7)jqWk`U*M<i1JsgY<W>>y2`O6|Favmd#yYkB5o&
z+SpXBl^?VkovV*V|D`$1jEl_gHA(gXhsejVC>r@k7W#iQVR02c1pm;dXAFZ6#yqW_
zAFgHxn3{KYVm{*xRh_(Nt(ajjR(13px97Xp#+knJUbrFLP+s1#^<wm4!?}*FKl~7T
z#dCiBUpL$;_xpCJ>AT%;Aw*fZ->z7Mc;lSkt_27&=iHOK7a4x#7df%R&7%9Y%);A>
z!_9_S{BR9R_WSJc#j*Q-{dVXETiP^Dn8hivZj1RNXM612GR%Up`S<t=4eP}6`F76i
zDbI+!zGjyHoLOXHo6iq-X6*+wo?Jin=bw_J_rd6KoZ!1m)h4thThZ|<j`MWm@l(#l
z;ze$0GYuYxeP7z}otwtGX6#D|Tb%X2@A0{~&ejcUl+N{N5x*I0Rbt_HJ+q;s+4lQ{
zf<7rH4<z`QwH%Eu+nRojcF%!jd?zhB;j*LaLpK~2?s#0?sv_sIViycwt3zULngP6(
zcenXxAJ)sBaA9R4J?0|BvTx-&PP2Hy#*j>!1UY`vYOCZkQeH#Q-Oy-%Or>16l9Cw!
z!*%vO%EPNaMGKzQvSE@$KaKD0!e*<c-s7`f*mdLR`p63LjhvUO<2<dnHevkTn%eUk
zEvtJ@dTD5>H~pv?Zb@`ip^TTHH){nKdbJ<9rA<4A8z5_sCPyD|vd7v#!^#{xaL*IJ
z*jDv!^ePgz2z%_F9S+IDSGqkBY1;HY30|$KzroEs9EavT>&9YKu8=jrMTX^%dT0=!
z^GW|JJ@gNV`|U{9L=XKvFngbFXrhNc1~#dwsiGd*W8)w6(4NsV|1b2=WLr4;mS|b{
z@^#o13R>pR){#UW9scbqXUi&hlwGyl$qTKi(<ZI8Bn^fOmtJl>x*-Hn$xiH<lmVsR
zWU`@s`S|eD5Mx6-*jz()CtUo=6RTDkGN-Md*)patpLun4`Xod7VO7R;tX0w3&01cg
zWUx*_bpODn879pno~I4MJ@ou*g7lZ1YVd`qn_W)7ah|#)Cq{_}nz8l|6gC&pTxb5d
z<}9?`8dR6rJl+eRxSJXQzXlcP8J?w4{Ho@xOJ~$Cl%v<|rRnEse@aVGc7W!%x^FXX
z*ooG!^FnLRILBXY&bmfl&cSLrNK-ASKktbw4~@V^s&wwjZU;#3$P4Y&>@*u`agRH&
z?0faTX0Q*y<-NWhBzz3Dnj;}F8Esm25SuEt0)}P=x7BQ71EpKwlNZ~9wPi-C{n5AZ
z0F|J89=0T*6DlR#VB=lBOkv@;Y*~*w_2fpeqYo>Is%S~;_zWH2i3{XgX~p^0WZbE}
z0jqU2^dJ7)`mxM%yz@Y<HYxMh(D0Izl9$F?nRVi~q~CYj>^-?`%@EuuLZY4NTFRq|
zP&>?$Hi0}2bJ*Zb<X>pTdTNCqha%R%3^^~k6?=ghH>AcN5<PZ_CRC#<;#|yEhgXx?
z+@$MYl9Q)8u@=qH4*Pd^f}0!rN^9b{qgW2>u&8&hsD<3xg$?sshito9Tk!bA1q@FO
zJOFpd@X@xxOHz^M3na!HThM`Gt#C5DTH~}{KiZ@j+eJPl{>L3z=@?t^(hEs1n`{xy
zYRM8xbQd7nLJcsH6;yoqHGX4j_C)LaPl8jDqwRkA=3r=3&~yDZF5!z?vnMTyZCe==
zp4O6~#+CQHo=GL0OWzc+gj?7JSO9*LXiecEWlykL$D`N88JcTasiACvhmm$wt#q02
zHKmPfM+;}`(2=3NT&i(h$IR(2nFQIh?xXvHAXbo4^Co5~fk1Y3GnLPi%^6#v`?oV2
zXB1?!S!YbxC>~~(>gpD{wrwDxJ)WMmCYjUC|Gh=<nltG>x&*G*j2T>W=Otc))~F!1
z7dL7*v%Xw+J{_7IakNyC%u8^nTzvW7u%nbwNCDea!GXC&Q>^|oxq<PI$|0YmbB*zx
z4L7ejk$!+)zlaZ$TK$fYKyEGPzdINg4mN(v$P}4r!asr-nx4vAkA=n5d3{0CiC4U~
zMpG}%1{+e>9wcvNqMZfj12YSuV>O6L#9aR-5gn@@*A8y*8EsjgS68D4nN0tL;YIP~
zf5R)-FpZNKG^~sc!|AsKPhl#2FHX1M;5G~{IfY(#>>93AV54p?J!!K_2jsOj)jC%k
z^u*A-pBM8tdT2bKfCF3ky*65v=*2d&;^>}=4P^7LQw=H3&7WB+Rl+4?rS#;*#lK-V
z)QY%6mjq+c;>+h@kaGaty4L4hKQ0Rp@%<7n3%rk8*Ya5?$kKmZ{45)Tro@^wDd`Qt
z#MF5H*Ngg3oGc{}Ponurvyp|nPr4E<+ga9D&~E4!RSUX}WI?yFWF3SmzZjPH)~we*
zDpUH)Lrm$(t-)ziP#;%JSCVW~-7BRwGR|sxw{U=o8Y({gOy0c-MF4W&M=pAAmj0P{
z33`Uds{uPjk5Nx1bn)OeKrvoeX}HyI$dYz=EJbBm|15W6y>2beTKq7Mg?V9*57%$L
z1G2tYYEASH=~QJeHrh+ACQ*Zx)KQ1GBz4Z56YNa=PX4e{+l^T~3akE^u66g%ozdd9
z)X~kyE@A8AAJPm~Kh1F6WaB|pd6h8#R1P_6nBZ^=P7w@ds#3D?VqZIJQW?TuNyX!q
z!!Z%J^f&;|a8;%-xTk|v(*$~E=K^lplyQdXWn89#?%5E-mac~JwazrL!p<i6@6Szh
zS6I{Dz~Q6JWIOF%-SpL+Kl4jr#6h(RMq=%HrF2n?_0V~e&N;3f?&o)PsvNKuebq1h
zkcCH8;uV#faD^|-;@cz5LM`m-+yV-LAFXMj4LlYL>}6iSgM!X44yW~P*-89o7fi2*
zZCLtxvxX{o%d2|ydX$e5o?eEpHcYDx_V0SN((cy+OC2nasv0K9)qQA}kWg2cI2L!<
z))H>@3aem)eXzVc)S8uemmulAZd9QUvna<5{8EUSQ{EiyoFm5E5N;?a??f?KIO480
zzQ=xta3u51KSmGRPSL9y?Zx?<p$qLw2_yQ?<-y}aJwtURP<2INw#Dcmb(iIgvoL`Q
zsva*Wydt3ff#QosQ?D6XQ7sf{mJ~mDCIMs3#GNvxN2HSm2y%a~C3r4ta{9xJXokrp
z*|JqANp88Pe^=_Y`B?@hO(&@)E|+)wyP9`QtP5*85)V_jZtb(&=(WaHuCv$5Gi=zV
zOD5Q~k%4@1`jwsivN?Vs&3{Gx(cgn=JmGt4iPdCHvklc;pb-FfCB2=h;YsTtE{VJ1
zT~cA)oxRaxgkh3~8<Ha&zzg!fgR9~}8n;N%nt+R)IUW0j#46zcVYJuOL+}7Q``g%4
z6Y9=6Ots6%RrmStsf328UtQL}^tbze@#SBH3>Mo~{;OK(7h0!kOC&~_^Vhs7jK-Pm
z+KtLg1Em#_Zp3TI1^Ih|Q{c_4G67GC!IrU7Ix$}{b+%}ns(We9L4VXhW+08$w8?w!
zy*6sk|5^_)qUDu6;Pbt7BxRjxL}>Q<h6c(yGC_3zm(y%<htnv^NX-c=N@wSahufSr
zC*+Fv99OeP?)i9i?L2jSW9Hm(dmjuWhR4XN?(N*4c62`x*U$IIu%mVO7q|%^CjsVL
zvXcNDnGzp4ISZqIM)fzm)MwfVD)i#Hm*J)wZxACp1;%Xuz|FN-G0B^z>)={Gg@Yrf
zl+QjODLHxp<obaoye<<^Sc_i+tx2PSPdP07)`u*nPh!*fvB<_2p{Xaa-Dfu5MBOwX
z2-M=aCBl--d6{VsUpAX?1MdilVkWigGd^g#J>VBS$=W~TJQ>|Nuy>t*|G{<sFLZ)L
z_GCS!W;>>-<|`W;E#^b-!2}bj`**^&(_u{H3!Y?sjQR|JjD^axCNBiS)vyR9o4NM{
zHYYU>k&PL4CCG$hZbO$mgGSSw4p74#;uc;wKndgRS_ADjwjV~O^%@sAn(tUqPoCv4
z7Z-F$hGHNQDn|GtHDYfMxjdmaLP-Iwfs^E%lpEV!7-aRf75y585S(Y=;`7)u)Qj~J
z_PV$Y8S`&pUaZHA`W+0pFu9}7Ocu>x_$h@b`^LlVym+wk4Q;aMKl`6Vm&F4=_3ya3
zUi6<%2Y2xi5Y0Y5*pIzr6k8~wAp%A@#T`y!n$T;UaY<Xi$DlItru0nlmpPKgD}K*7
zCetSfzhi`3b<rE|yB<~E;gotnH!-GuT2bDI5jFV>BW~myI8E=#^Niv%B=SX#I2S3x
zNGU^ykfGt45U8Z;NEIVeokt?s;vU~lCb@6j6XAwetK52q?>twoitkJ(ke|N`PKDSU
z-7+C?IHwMP9mo{ytuA4un2LS5v9X2a{{0rh-rU&M#C$rmV7gaeC9oPx#mCLDNyoC`
z1&aY}(sfZ<)+?rr`9zo)?ZtOqJ0mP9v{9q|I&Ge5`5CtS%rc)g2^{U&VPoZ$%n{~%
zItz>s@G-%Tg)@F-3O4v^I#QN<y4eoaR#I_{)YyTcLiH5)*go&LI;gM?E8GRG$Byt`
zQPrv}tqb%;6}9jlp~mrDZP<_ypyu#Q5f1J_8=iOB&0%YgCe@ui%&3%9ss|cT6o4{F
zx@O9(X#5qn2JZ$Qj0!ac^we04R57RwiXxO93hbTb=N?3p?Zs#U@-0gUENWchrMrxZ
zL?sGK?j=~4q5f!@?KPvE5ii)7tXYl|484qqq{?g=nks+4o$%QqHeXn8vAAQh4NgWu
zC|oxx+%UDubDYqIr1qu~t8)h90an~f-VW>hO^Mv9p_WTH5KRHRlFsSQE)g<L<+UI~
zS*w$U0_ZNdFrPNbLgQJ+Vi%1@Bb|GeS32|2shMSB3+BTw5$uL6|5h29(4rTTS+D6u
z%(AGqg{2WCo0QCS)ecnJ49;h2Ivbasb$SW2{Qi3jpEc+s8_{2Ibj!+2#_1)Qv((g}
zUqpbz5Y$~cvXO$b+62z$W1QJyDuucc`%W8#(Fpb1YsO&~v3yCJfmv-6I8~b^UMjDM
z<?$=n3Kn>N+2mz*ZsTfAmv+#I6xN+`f{6Jx8}jHOmkzieM%?4;{8=wmekvc*iH%oX
zUdo$0v3|{(X<8eO0<_MpSHA0QjPw3F^|ylq(rQlPd|PwD9Gv<M?k;Yuw<aw<kkF;D
z#!_>%(Yn^~VV`CPMy$xe<X$@&rdIND?~{ox4#fy9da`Py*US>G*UW0seg~f{NC%5F
z^16(tPH#2S8p>;&4U;mQ8+se=_8X$jd`XuQ4qH%5BzhY<qrj>SI_3n@w+LOds;UL7
zbhz`&ekL=M;`C$Iv<navyo^0`S(5FXd!;3MSZn?R59Trsa>oKXncT_u_gl~WJG!%{
z+zlQss)RsSuBCfR*QORw4=jMtKSv4H9<l|LfA?GWZG7j3`0#POE|3Knapfy;XL%6^
z&0?CNNE>KPfw4^*9HZxAS`XKBw35ssg!8m6HH^y+B$<#sB)V<zQp``CAmXVOJNK4D
z$B0spZ-b<uBm5xZB~M<h?wnYS2V!f>{Zh3%HTPiqx2w_+@8+#r{WRBoH5-;0sxr1)
z@n0D2^}5lS+17kouk$FZ=F_n9rggn5W{Go#u4R07D=CBS(9Vp~c-}O}m<3G1zzYjW
zSW}HdQgfZ98@JPCIv1SG!i))lE^tZG(nUw}B+Vkyj+&-H8s36<0wytMFuYB8&5)*q
z$;)kRyc;ZdN6_+fIh(UO*kVm)Lld@ullO}Mic>G+buF{4npr<*H6DU$uJa1!da18*
z@k6~smw30-$hJH3)J9fa$J6D>?L4w%ma??-Iv!<fJH6g8<EY!QOv8e<&3d^U(GOZn
z*Lj2*C~mRJnn-sjY!fxN49(n~4DQXG6Z(xztV(U>)~r|Rd+g;bI5WiRVOgzJwRHP4
zp$R4Ys6j2&#_@Dpo7u1rujlwhLCn9)P*Yw!UZ|_*PT^YI(R?rLkRZ=KYahFPgU#C=
z{;0^V`t5wfLH^qyJSMa7pfz>+fv*$4fww28I(UPtV`1G>;Xdj#Hf!#<0aJJ5J9WRr
zx(FJ^@T6Qr7QDhb9eDaQJtTllG+MUSFwvoUqR9ZxTJ`7vK9eSBH`7p;+|OwwgY@r>
zhdo0jW-%v3W{tZ9X0JL_9<b@tofS<^e0U67Nc3g9%W;BP@#J*$7LL#8!UjeNIdcBo
zUNH4@59s=(QXjH=w%8VI7I%rC7GVMROyAn>+9u)Rj7E5mP7FD{(C#_+GdZN`I|^yv
z%y$Zgc4HK*Jq(9o^#%?8GpT3g(idRwQgC^*HD#C}hCFpx<n(F2-LuC(Wllx=F)Tf|
ze{4<Zb4`xvoG7eB1sy(lO4v$3H@T?Fsb#n!p`2@}F}S!rYENxsWZ(4|gKEE8PM)Dj
z2szrcX)(>w_a^?9H}QZ{NdHC3rw9DAVOTU>*fhV0y=Fn98GFqzjT1I~xs8W0=ZwLs
z?p9bYZ6_U5?afGtCB9W;<VQTs+8GBT9K1!tho5qjNU!A#D<T=2=!J>%?w<1LQ87JD
zAF8mE_sJN7B;$n*VmET$hRQA&n2vUDfE3rM=K=3f_E&aRI?UxwcL>xc`MXcEu52pb
zp(}fe4dg@d@kECQuh?S)DrgMn&44=8FCO-LQ+Z=o_Oxna0l%#)>mcq&W3mL>y#jl^
z8Vg{2xM5-`di38tVbf5gYhrRMn|YC23!Fs@>mZl^3vRRjd}O0wDw*9Di^#6W@Bib>
z;m%saKK_etti5OcJ*+L9)f7l_N=M^O9xnR4c}F+a!YEvkAwB-QBJt!WpZiESNiS{T
zRfG}zV)UStSrHf#wO;RIf^iFerR9ij!!E%flv=a#H>_8KH7;jyv?l=uZsA^Ch-+Us
zSQ+c;b>}+k{R6MorX<*+O6wc?Wu5clmTPxtbuL4==Lf8Amu>UV)TukWa8J4Xy=gGM
zGp(r_{uh7d1=l9f{Xo)dIH3t4Ly;3#MMDuX6Co>+Hym-^U#8$$iSFp_uA1)X?KS>>
z&d?Bey-WLI^AK3W7i=#9tt)a|gMqoAsw?c__5R(**Q6vECXUrS%(F!^gzGkxGHqD)
zsVXz{6XV}pPm$+LZ3C|Kz_YKMbj&;A%wR8$4{t+q^cus2(nn{5znBbg4B1q}8D(aH
zb46x7en3gQsU(I7hxgy@&S19rVaCed6nV`({2w!B{F8ehV7BEUvn?}4X4?<`@;@tO
z&O=@?)1?~QhimX;=}}`eOm%p+4z;AhnPrk|D|uT+`--O9GSLVZyNb5*67K&k25%Bs
zNciv4atE}wtn&K|cMcP4b<Lb=UmW?ec}mg+QIh32`GY1HGbQeXI@PZI9?N4b``(}Q
z6T5EmBYLurnpc%wHFf^vD{LCorq1#Fxt`G6pXBR%LhkS8thc5Zv>JW)RGl*ihwB)E
z+~wU^dCRZ@modrOeC}SXzXOm!nIT>~07;Y?JhU%hz+I#H&cF8!nrVa%>pVi78qznR
z{MTTE^p`!xNL%4YrcZIw5?Gaq=F0{44K2yu`WpKF^s2TG5)!jk&|<wvg|zSOy7m^W
ztBX$S+FGtT|J_>d7s0!W9M3#h%3!8-*(~F6_0xsdKF6coGdy&!KCL%IM0?;;`-o*D
zLq{fTf#pr>C-Ct1=Kpx3AXQ6EcZ`on_s=eOQEyp>`taYZb<trfKtfg@h+=)(Xkc6I
z%!Z}=L_$!DZREK0Nj}&|j!XC7RPG{H-=Sy4+?`x5*qC24{8sNo8A!#0$o|<{7ynHF
zFkbewq4-Vp4v!uAH&>-P9b4tU`6_UlZiX{&vK<~a-LiZ9?Ov?2@nuJ?dW#2~nY0dV
zsj;OVs?~I+t~4)CS3*;W(>0nxIK>q5xj2P*d__~pe=&o2(G22OqayFKdy{ZnIyc@+
z@87?M+wqle=;%kphfPmYXOtH91>1kL4bt4TI60MDu_|EG;xKM>t-;J)Jom7z4S%~g
z>t%eWs?{f6SmR&==yXGFTxZ<Lsc{mjF!%C3o0H~(8Xd<L`|E}OE(7rPGeT2lHOYL<
z?U9Mxe21->=1186Uh@c#vb}rm$N!FLdZ8^;b44!E#&lbIO{q|(JX;%0X+meGa@%_C
z3I28;*4Oyq9-Sucz|o!bAI>a#*ElbXh}cWTT^O-&Csq>|Q9DhVY0^-CnK<mAHRZ+Q
z7`XKqxKOrZ-6%CyV>gA3y;J>Hv~8|`_T>6fL4PfbuP_hcoR&KkX&2VfmifVa{KP{6
zO4~o)o#XfSWdmBI|I&2X-pDuWhuzr1c^!Y*Qh%)aM8#>xh3l8DUMY>KcfNM^*6ivz
z6`U(s(tVxs+|vDNgVMrMH;ia`W!VVBNLOD&s*^7sH1#z&H}l0k318o6Of$X~57?l2
zI91O{x@nf~6_)0gp+xNy`XyEymT24K3cWz}&pitJv^q{>3=?MH(y3PsgEXy$V9T|w
z3}(1U=m#}HZarskrtgV(&8436jrRA$5yv^P3PXz%2VhK|z#-Ro>}}{U6RWTv{tzaW
zNhE^Sgc~MQxm#1?N3jtNud!h|_rfZjheJz`^pd6CaQLT`&IqKur(H7j^HYCjPFc_c
z=9G|0JJEh5eHp&P#F-Rku-nVh{04b#m0{LC$h7eCA<1q8!%A0y=c)8Rv)MDG*Ey-X
zBgdL9pSWdBsA79IVk@J!y;M_acsq+}p5Cj?3dIE!HejjYN`o`Xo;`#A<$3m$k+dhI
zMLF=*7fFWFZ&g`oTJA!UA!aY<vsBBOx`pO{ktBYbm{*o0Qf>41-v2Fc&QjRxMT~;$
zqPPR|@(l%=w&L|2b3MI7Le`d|ONbcw>c{>DF1@hVadB?-Tq;~Cw1P@`iE}HR5ndq3
z1BBRR2Oh?j9DWj<fP+9m=%`!PlW`4Nt%ll$mNpy@zObgv!m^M^)|B&v7V1<{tqEr%
z3{h2XY#7!i*b+OmPr#1SU1*)h*}58KiB6L{J_RS^tR_tt*iIgS?PP8TSW-r!Z43wS
ztMqc?-?yY>H!uNJ8?OC|_f?Y62qXph#Jx%L45~3!`uojhO&?C77fqetyz-AhA8h)7
z?g%Y}2PCRuk{V+x`9G`XM{2n-_hBs?<!X*G|FN3$Gyh&Sd;G_0{*zkH-FOqVY<y77
zmw#$n%^Pq0uU7M8Yq{kgs+n*00;aMS8IT&`Si-`|%O>_kr5o3y);Km~ZDCU%Ow=+(
z`Qq`UsrPF0ttq$2v>Q$`VfCPX{#O?$xodT9PI#(KxT#iPCv8c%#_f0L+2m)AF7S~_
zWPi5Bh+}TTUWm<02d;*8huk^T{&EI`pmtf<6w}X_)n7Mr!4-mK5jE<tVVpXAB9{=h
zm`ezs#rb&A3Ej*lE+=tf#PZ3@@#2K)82G`cZGbh&3ny*}VHVkrYw@1Klp3-~+G65k
zaEdYqzUPHc=#bv)O2NmvNO{ej+K6NJWKBg=t<^)L7CuMMo-m>q>aZcmM+BEJWFhi0
z9m)VKAIM9@@=-!=$d}sW<>Wk==Sfc=j(2e=cUJMLt6xShoYdU-2$BhyS|JO$V=iKD
z9IkP}_w1<~P+>U9K^Fr5Hi<PnPJ6H`T+6?S&!sb)&Gvc=nRic{E#<nj@t`O#*kglh
z|GidhnaPxGxM{=p_T25)G0E0g(_jo0GVq!;X^LsZVS@>)L+8YrwZGaOAC-v}bIJS$
z9ZdcF-ldpuWykZ`p|HXe<QAWff^h2RCYHRy(O#4>OdpM-{ZG6jl(jJmm0C6iLWkUe
z*jGSD<{}6k1boaeO#8X%7h#SEv4bXDFyg2;OoALn6F;Qe(1s{)s4D*M>C>=E3(w4L
z7$%;Er!?YJgE<aM!HIjdqOfTQCYAUhQcDk^#2Zn|wkS>ILwe779cu#bIX4WyGy1oe
zZ$w_3^vk9CE7fHcHyyWc#bGvoMC&TFWzt#c&3Nc+VYl%@MFs3m7RL_>P6=!cxl@5r
zeP}SADjClu6fNKq4o~C9y@X-5g-+ytjusHvj@GmnYi`J5p+a^8H(2AV{uaK{M<l>4
znIX;1+ceU$ww`Tp#m=CrCw#J|vDe)Vac<tYEx>kG^<xcHxQ2dD{cIX%*LS!~H+$$-
zJv>%WZstNOM&<P^Sm@t>bA@Gst5Icn)pZc-V)$_+Gi=oQ4M!glE5`Xf3tR-whAG14
zd-f3HE?j!AxGiM1;C-P5X_cxln6-Xby(&%NeNBdo;cCm-rP57^rP6(hX1Lm%_0v+x
z$o@U)B80zRMWs$NxY9_Gb&=94?*+@B3GyoMGf}k6_koadXL)Dnu6$vy>2yyMzSDaG
z(={K0CyuJ%h}&gQQ>~YvvJ+HThlRs0?H+K#f_MveshgX)*ADn3xo|pM1QiY@!*D9e
z;-Tw7l%s+)`Fy$>iBL2QT-XIXuf2&Wr86hi${`&p)9*fq@erzcTC9HCD!1$LqxiO?
zA)gdOg-sT!*)KcBy37`?si#>K<{d(BcZMZ_-7ouj8q`_Na8Gm=XCxst+AfjaF%^Pk
z61R)jLaF%3x|>r~OIYSg{G+HP{DWYP<Hz+QMShmED{(R^Sf%_4tJCI|;Ub%|@ekQ#
zKVuuGDX}ioz&{Ayn(19pF~Bq>>DYtr5cmpp2Xus$MLW?YDw-5%yilO-34IbPjCkno
zqUPxX`yPrN$@#n3txdxr<jg&pf_sAyYzmjpvbP_@o1?QZeWiRh#t^09+T_@?$NYe4
zE{v`dQzF7z;a3nO&SbVz+WX=lCC~5!Of;0~cYL_uD?Ua-v6jxa=ovpakrd{sYnZ-a
zA(bv=gdxYc#6$m$JL!Mpe*7;Uc=X}rrclAay@|QIFtgzb;a$vj{IcOJN?p2rBku@j
z-g-DH5xp=hq8my6ooIt*$F)5hUbVBDbU2UD1ey^8!@xV}!S$kW`r32k2n#FFHeNr1
zwRzny_I1~53E>qD{&5xD!->e6G#?X+%bSlr@XDKLi70y3o-t-a%WE_NGvSdwv4BM{
zc?pZ$kZ0{7_6sr<PKsN*#kolKWpD8%BUop>pJTl1ajB99h_R;kv4^DpXphc6Pb;x-
zNOBCkJFh`KqN2{`^J>Fsv(DMmMa1Xx14pvpR(@kgYi?MauhtEb!Z-5&7|EVA`i&g{
z4`C9Qf3|?thF{3=ZueG%6Lypk_Ma{AQl?+=(4I9gqje_yvrX`0!~5hbIe3O?FbO=2
zKdlb&2e-_BMZ=ZOh*NQ|n50il-u;(ZHz&2e#~Hr+1QwvyZ$HgPPGE1gEVrC3XWy(@
zKZu?K#6`><{OJj-hf&|+3y*+1;fA|gpQG!F^M;_kf5X1L|NMZ09e6lW-(s6bz#gLa
zCpsRocjW&Hdf)j0rMVvx-RcqW718?=y${iEfZlt4KymJ3qUU%7>>zq?qT{`LM}9fz
z&wzjKzC0rWZ1D(yJm&7!XDC273UCbpLgokL=I$W|n>_+PBYFtYyAa(5diVJO*|{$g
zeUnGPr$p~g^Z=s&0(#f^0U5c^5<S}^;1i;ECHhlDzYKct{D8RJ2IE%<@Uce#tPk#P
z4W<B3Pylj995g>5Hn)c8>pjRn=iRMAL~lp*pFj_s9}u1UA<@@)1gs`{Ako_p{XFQM
z<_C<;T}<>$5Aqy(cWWo2w<P*G&^yi#(C0euqX298#EG!#aWwxyvky(P(j%ZI-0=I>
zCn@}5gui^s;I8pSjqhMY&+rInAi6KnKP37|(A&=saO^1B3;J@8fb&FePxOgIKMuM#
z^1I^z(bGHv&Jf+3=n+K!9`v?GWO&CA3Xtj%aEb!7r2yk7z)=KfjSTMyC3><)z;U9t
zCi*C%9|pY@UKZV9BD&cl;3&~s5q%iZi$M3BAK<qmp6H1l0YyajB>E7de+T-o=6I}h
zhlT<y@d!9T0h&{QPzrDW0o>;Ya61^$<2(ZP5#62WFA_a}$Z?cE_xK)r$kh95US&RN
z+>_;>6uxY%<zEoK<X7{PgfEvX`9-g?fPOnzpf~~GaU#DCcno#L4pX=-qvrmddb^|f
zcFi8*Pj5wS{Bq$bq@Mfi9=l_C4*%n;tVb6|_iZ$J%HCz?lOJ?p>J9kU1GXQ7Z64qC
zHTISf)2lF{KC+Dxt}-6pM}BN~&q$u3;*}fA-{q4+<T>UgT&OGmhTh0%h|mmaJ;8Hs
z|2J1}q}MsfUGac5e~fQ6NgTQfZrMc^hrcEkf5m{GJ(=}Xd)mL?Kc39q>doMxfm|7p
zk76pP1$X*{XI#bn=SZ%Bo4cxpo3fmoF~tx3ogX=c^)^B--kM_5RTzq`4k}VXD3oMy
za^ZaE{qlX<%sam%>`r8sszuxln|h~{%JSZPuE@TAyai^;hU=AXrWnJ*61SG$XGFI)
z7(CCq8BABX%zFP^Cnw1y_(EpXE?h9f>R=AMxa<1l^5>naIlfZ3)oWaDXokH{rWW@a
zOITmt$!6+oYgc)H$MNK8JGDAyaJlEaQ~MQXNcM8o470SYVVW3wNRJC`eo2c>e(S;S
z^DS?zkM@F%92_Lf_q}6xoJf)%z!jZHte<u~eZx}I<%JQy<?-*q8`&Q1J5($ql_+^y
z+DuB!=6kQ&6n5WP6SHo07|tLk{~d8=VZL~$CH#loSEbu6KkU99pC^a2hs-@S@zg{?
z4uBqn8)$TA2Hu*AU0(0l#1lNVve>wtk9)q9g?n-a+aXTHFO6m%{IqD+mb|%Z%a8JL
z(X4NO6Y^jW8FM%|#r4MenNq=~qhO_%?ui=$**k`mrqJ`W-|@Gj+3+Y_4B47g0Npog
z+<BuWJl=*=C+GjA_T$X5pQU?sV*Lm1Uq2}RWM&M#6Yn3Q<(|zkbU3UM^G$JZ*)i+4
zpRnEI{CjEF@fokPzVHl=O5Vd)p#2g%<w1LmZA@cT!e>s*aM~3v-vm1Fb`$S-ojsvV
zMXR_4ujE_5!JdARIK5D{d~rVQ#ze1e<YEp_@rXA&x7)eKI+6G0&(rkr!*FpUOjHDK
zS;~L#274Ay%5eTKYR&w&Z?I1A{fKk(Ry#MflE3)|3qmF0a@;2VH3NIfU+50kLSd$U
zRo-uq<Yq~n#{pg#7h69T0yYx@eyX>ZPD#g|LiU^y4cKqSI)Be9TstIP=i1-MiP7pA
zSxFNjs1f0PGxH&pXv;wB*Gr@wUh|NK<`E_pobiQJG|y8Q|K3%r?4<)t53@x>kgm7m
z2zuZCd`A9HJrBT*!+k7Ett*|Hm_0#=*;G*9)KA6aWh}t(Hvj%K)_q{07VmZZ_*4<j
z)5Ih5p3?(C@?Xl4={mUKmwWuRX{^tHvitUo{NoQY(&oR)$Q(X$IvWrYSRI_wJ*{sl
zB+N_EO|Bc7YuYzV!e-hfq8)5in|no)Y~xVH6*|Z}8q4^?>FknIF+9lfH|MeTd_fFb
z;u>~QBpdTa%wT~`9hZKVUoev`Y5nMvERk1*CkzT_v+mwL&CIHurV8|qRMqpYKXG5D
zego<IiEQ5aP1b!9Q6kN~G_&DZqWK101P+L2V2=s4kl>_=4q&S_I2PiF7}*SmG5F*<
z3kfE!Kl!|hL*#{2!TAnp%5eROq$xNJPQc+3)+XjRS%@*-GTKaO^wQuyQt9Yb7Mvyp
z6EmD9N&Z47N?f0kPLp(!6pvK?fwee>!->M7)++U(-YPtHsS?c6VBc~k{S?lObnv3d
zLq4Jj$1_k#vi;zQ_7u#aB!+&qs-{L5n`W!tq&t3m<xF-`T|D4Ee`FSW#yIMR`fwtr
zKC%j_7eW~DBd7ju7ng9Pf>R&bjOR(O!lV$6s)Ra$NhZ>xn+wO&>GGFYdbq4Y>7RFf
zHgsG%5^pz*d)}op+iU6!BUTtAmcYUlHjiYW3NuvHD!9?jv$LpWoqB+D83N3rK*Y&Y
z@PUQfXJQp=g({}IXJ)A8&ZK7+UM$=s*yspvaq&;R#oDPiUYX3l_!iz9J(YfbIc4Pe
zWXeF`A2N_7XJ8GiXU_>45YiXyD&_R)iWAZoui;DSFQ+;s?iY)HY??mmQxvib;`IQy
z#uBCN54{>#6TeKQF<_5NzY5ETP)#eo<J*|MB2DCH%wGIa5kK~A_H<jgHi!?vK!{7P
zS$ur2Yd~oHD8o@#e#P6+8(vzS<@_ACW%ZqP{vmt09f6{~IK*U2eY9?zp^XM_j5XtY
z%&wdTD$YD-PECDz)pyitmPj1pp|4Q)X~v-sld=<i7yShlN<u97g+QhI7Lg?p9rk5w
zq6CDOEXs`Ou&hPryLdo;0fYQMlT@69wW<%Vyp6}o{z0<w6HD=;>km%oz^zpYMd(h4
z(4C6VmEiK0I&{KebSHFIK@jPihHhnIz25qPJF~3UTkgU@IJ%6)q`ls{#r?cY_k_D@
zNgLhdKo3>?imaq|+|AYdNf^62(6m1dGJ$IBEqAl7)|B{BHXqGR{)aixp__Rq^F<j3
zDfTHf8YmA2h%`PRKdL^TzP|XZsh8$6TpXOTH_H_cE=I-gv&DHhV7pd)>C^u_92@%W
zHE-27O|L&C_Q;5QFd)|#PZoSRi|$IvaVZwR)Gtz=!8P-NW<Gl^gA?|Fx%}?AP&r=S
zIjTlif~g|{!YJ5tQ-kXG6!jo)-C0*=@k)WmFiWJXG#C+5jgV?;N_pJCf7rhvvMO;^
z9VfS6Q7O=OyQ*jmL5+nCXNpRtBhE{_i8l@BH(Z4H=Uvr11L277iiTL>X&*I>_(9HO
zR(zcNgDtLUvB|ZgD_HTL#Io=w=iY7C<R0;$+44*SAx7N5^}O>u_Kd1SHvil_=BFC-
zEC1R&_LN7QaeZ)#<~S6&#Z%(>)OpO;IB=^qadM51xjj5MV;~e?S~)!rKHKU><;m7Y
z@<Wv7TchjgG9*16{mfDrC}MrtekC{s?#ZLWrfr$l^!ng%lk=<qbWL(MJqaFsAYhK`
za0oJ^T5Ad!*$uAEGWUj<y2!{a>wG8c&bs(O@?>y@0y;W;?33igJ^Pz1?G*+IpZH*q
zJZf@DHa7mbOW9ZX>VUzucqOv^J?!feYqyxCgdJ12v^x--vLj#pLSk)CTp(P^;`19O
z*qYy~$MwLq{3q`)ADF1^dxv$@72j^8*}JKKS-xN%Ywd|kHmTj0K9kaymNm!RlYHCx
zkn|156=w9>xW+GqqAd-8Hf}J?Q;N6?rsq@ou`K6jseJ2nm4_SS16d%#I`UK7!5$Lt
zxBkfzMJ2#wj$ZR%9uyWJ|4nu9J#^YMX|=t0^zZxNv^=pE9<ADo$vZBu98#n1lUPeZ
zdTQ*&-S6z+kI!dbea9SB-Zei)hJN*eQCQr@Emjk*K*En#pea7gBXHijo`Go6Mm}ya
z^W&dez@Bt!vA5mPHSe?5eCz_|+AD5*jbWn34R!a#y?SUD>!fGQV=td$0kEih;+~6U
z1Wd_+hwDrDVwifC-?o5_4BCFD+nqeTCu2z*j?Kp~&Of`Bo3~Doj~36lFdW$?(cA5x
zc)x|Lo4R;;AwPB@>#o|K!^bUTtyKkM`85k!f7O_)eDOl|LTilPR5-z?#I2ApjW>1p
z9>>T_Tu=4ls<!<2cUfQO^kjGvZOdl>={$P2&(5S-{NZ<5pz+GYb|+GgnP;O<BA%ng
zI_e}e9+u}@;3<^G9?i$%p23aw43n_;fNvODiguQVLjp}5uAdiFzgn)PzqJOPP5U#x
zd-`YJ;QY5iNqe}EVG710=@m?U_^QB*R&d%+^!l3{iU-q|{}(m<-1k_gCpMP5`3E{x
z#}C0p*y;d0po5)e^&C=`$9DK9pZgwOin)Bp=Bv5>G7jj3y?iz}Wmp3&HL7(H;#P|;
zN;bVDNd?tKx(Plp$udX0y`dHCav%q%f@5ZbrTl6Wm(`ZGT;V9hD0&731&0&<O*d3j
z8Ex`+Ce3C$pEeI;wuZ{Gg%jK4O`NEa{5{A{4B@V<DmZ1<Z$fKr;%6^nuc}Ks)bd9b
zvB6#G=G|Vr@6~ipf83PL_g>7N?hrTkOdGO@s()U)mNVQeSCIkpa4I^6$efk@M~m68
zepuDJ6eR>F))_K`HAuK%N_A6DWO%<T?&J?o5Suzf`2=+&`XM5x^7j|BUg|h|KHvL&
zHU`glWbo$q*$|)Dd|XzBvQkCq+Rke4lW7>{%-AudeA)Y~tM3DMC^xslfe!3;>8+r1
zbV54Zp8x0{%$Fbg59a<C!IIiiu$~>X4lRxav!L04?-hDHPIT8*-jbvgt|$2)|AEP8
z-T`@rrkR;$Y0S-d9MKeGNvv$Vkyccy?mUbo^ubaFjiY5k88ejMbHO!c+^mKm;q^)v
zgYlg6^UhVA=<qAXt=;zz<pTa8^rWfHyYjwixDHBN)2#b$@i+S95I;lRE|q!${Cb;~
z1+FGX4kuO_e&55HrrWvvA2EY_+HJFbepE|Ji-9Cq`rMv-+s=j*!70d{rl)vR6r8;d
z;_E-avPZItEidweKV*30lTOur`TZZVpSyYD4u4|1Ya**6i#@mdznhAj#KSocB@2A(
ztm2P+1pgMokC+wkZ&9Ozk`!)3Hq*w<Yc{?=XI;;`$6+&@+arw+ievhRPCP_kZXS{o
zk6(Bf*@Xu@mF4!>s+?G<|5^CnoGE>|*6WOLByZMBTf+@l4SjXJf7gD@x167Vd?j^$
z*Y{UmOW(qq`Tj0`JN%??6;5NN5gq>0fyd%Jz9Now@hI3|q;qxc^i;OJ;K`!A;CSY(
z&TDyqb!@&SgSj}p+q3&Kd0jJDG2=g2$vW}XD_C4!_DVLC@j<KD*u2cuteWLz^2|j&
z;L`s4jRe+%;^#;BEXMCu(kIbE@<keb&VOUp)CKRn9y@jVJMYYWhi{8#i1=5s*b{tm
z7K=8H{r-OAJI6$L`G@<BBLQImJ>WS&Z$NiI5TGN#7tj{q2}nJDzcCT;5nvJE9l%?F
z7(g^&5@0-FG+-!T5a0zsUqA>T`1pO}gT&=b{J;G)J}mwJ+k~ZbjZ)SBe@Pr^8!6#V
zXp1KS-hfsBcYrg11Jt6OD*(3v*8x`m7XfDh#eidgLco5&Zorp-ZGbI+Y`{9eD!_6;
zGGGbd1Hik0*dNgTv+-pbU<x1;opB`~4PXYu0p15J0L%f*1iS%w4G;+!4sb&}C%}Dt
zuLj%&+yayVN&y!DKLSnwjsOk<z6E>@$o(GeZ^f6*fR6zsDDi2)4}e2}0>C$bU4SnD
zIe<-o^?)^i3_uiR;K=>PXAUD1fNH>9z%4)-pcHTc@FU;^;0WL#;9J1gM*PbKSOJ>>
z9|JN0D*<T$GawG|K41Z04qztW4Zv%FNWfUY6l6XQO-T@q3{3)z2aE;`1q=eb0O$({
z0R#g&0gO-LUnWYi5|9Qk1L6Sh0~P@00A>Q-0K5i>1dIg?2Mh)b0Q3jQiT{_M#{X%=
z|D||n|Nk<_|GVL7{Qqxd;2AVSS3n@Z56~Xa8qgfz0#E_!(cF~)2jC{acoqLH0ZIU;
z0Y3l^0SW-$0CoYs0OSBR0oDW705SlnfJDGYfJK0J0B-@dpfhFz)&W)lmIIOjO8_4L
z-UY-0W`B?IKMh}^0N#k$3g8ZK25^8{;41*P0oMUn02cvg0mXo0fI`52z;3{ofNg*>
zl(ZCZ0q`T>1mFnZAmCfT*MMAr^*GvpGroKbh(Us_Fpl*YPVV@025^8{{H_4p23!YR
z0bB%}1r!600SW>80lNWT0=5CR0I~t=0ILAY0m*<RfDZug0%ASzZ#G~WV9H@W=AZ0c
zquVKrO+XmnEx<~^YsDxLpaS39o<@`5vlifq@4kSJfD`{l7{FbC`;SN*pSu7@@ck0t
zCZHaG=YShS0Mh_^{9cF8pg9ZQdaDb^VY9#+HnYXXIi*Pa^5bFJf1oSl9{LkrO>t$9
z()}B!{7C|1o8ShO=6&=jyQxwK7)J4L=3rBkox_IaxqQa_7+-8<(Y*d&teT&>4F}`?
z+gK1Ew~e*ouWe(NCkuTV8<PPl-^Rw)0Q&8T&kykF@Zr~d&emyr7-r6$KYb4GwVgeg
zH)J~tVf>3(tZm->T-K5W?jF?Gm;?A0a9#Q&TvPaVP@Z)Mi(&lGoh;nhFn3POtQq`=
zJK4Xs>US~KnmiW8$K|n*yz9G}p7AB$upndNKN}lk0b>Cn08fBpQ)6Q>AQzAUhy{!V
zgaAANj!zmJzu4T^xEwGCFdEPu&>V0Z@lOB(KW%Ju0o(-c2f$!_FGjqN0n0)E0)TfT
zc;j9c$~*S5_xZGM*^0I^Uw>!8tZ7ph%$+)I?%S`=nlp95>u<a@J<oR^t75!&KI`NG
zg(cSt&<UX7hvl=*d`1#;;$!n!YkZ{SvtAx*(BwZYe>9)@GmifaL3={4!8w0oN}e9q
zajj3H->yNb<W@ahkBrkC62q&AE=9%en{(lZ6tG^c{jR>Cp7e6Wu^V6bUpg24)Jy48
zBiHAp6|i#W0dZ1j;X{xA1aQ?L{6$Hhdg)UmeKP6Om1j)l<3T@Vl$MWAVqUzSsX|<3
z9OL7eDxKG>RQ;KXU#wC^<s~Mue3l2V<>-2G&Z-c8H~n+azaTCCMbkg%Z$o$&7gc|L
zw~Oj&{#O@OpVi5#1^fq|s#STYwKz2&;(;JD>0dVeE1`d$&GBz2{fnc2yXl{!xoT!!
zbPH9GhN?T74{ED&@X>8l8N9<=<-!+usdDmSy;VWX=$*~tsCZ2pLHHe{#D}N_yb}e+
z-w|Gnckh1VT>71xDgKu0EO(XoTW+4%-QsUI3XDH5F+sjZdsUZK+_xgpMWk^@I`FgG
ztGcURK~*NPNVVtJj6bDPHBw=^^M1Z6Kl<j&`xdkIMrY1DM~v<%MaL_9TuaV_JMx7p
zPC!YS#*1*kJ99IovdPJ<mhi<2{5#;&3QgU-2Pg1pFY$i?pM+P108gFAED=`XlM=|-
z@o0Jeg#<hiA$z;XND400I^m;_K8k-|%20nPLrzkJLJ6O-UF7c#ywG{i;tS<yeRq-3
zJ5mJbgM|zg=RR6P0iaVxlNBYd0G=|mNRgrGQo=_R;a{cniP2aEp|jKkQCl8ug1!=?
zSVefK+XX(mH;EYyk_zCE@Qb#H_zVeOBJqjaY!nGYCBi{`Qih@x33QY)G&ET3$8rM6
zzza1ewQ-EZ=b!i_d@{8${$PPE{FNhN!Vi^ddb~V&z`?pe2$C2rkRss0J)ugY6jcfv
zZy}>OUx@{fJL5p9#0821Y?AOUTOSQ?+#?Z66cK<H5;(F=jL=`o5Z*%;@TJnIk!!Ap
zfcN0CyNfj>hxhzMj4#g+A<e}a87kt952g;iL>Q}xu%(q4AxeRle@8zCpRB+i>?!ie
zcm$97|M(e^kogD!!%~V+t-yOqoy<l0luMRt6+5d;m+>P9i2S`3;Rn0`Jhi`{f^hIf
zF+z|MPZ97JqQGC5@Iw{&<`SQ=3Ve=)j{;uke{xQjON3}egjlHrGZpxmQutT}e&uyB
zql*;y!4f|1AztkN+p5F}$qxxsP%cfvXDIM5NC{^u@YT``nXSN=NcbEDKIR3Zm~gIw
zuu`hh-3mOc3*#tb1qyu0mm>a%0-v!{#1|{@rPA*bqk>TVPcecVKyI4;5?=n4@v)1=
z@Yxbw#;*w#3znn6tMpQVCA?9N;4KlZD<T||@D2rjyo8rCEb|$=S<H~P^eN*Dr403d
z6mR5$Bt~*XIRaEpLRH5;8iA94FM13<PJurn{Z3ZktA*d_e;Eow(5GU;nF@TAgwIys
zlO=qP0>4|r=PK~mCH!u}Q~#Gs>@BTQ1&RnmCA>p{FBvDcrJux5=2I!*$13pIuZZE}
zn&5@;w_hUUHX$Hi+zaEy2qg-<L&BFT@Vz6%@Geq@<qV}scuxiX;|R_uw6R`67#%4x
znyJ8NM~V1Y1^$GDFIM1Z?h>cu5(WOqmm=O}tF->hIgOPj3QuX7l<@_d#e}^dgZFz3
zK1hMDm-vLpcya#2gd!38%LJ-_{K<IzWAH;CgCF}Ce3SxjloN<n5M=z!$KYchgJ1L*
zeB7Voja>4d6S$1W;4>eC&wdO(=P~$P0gw7uw(;)AL@0O+{>WqS#gD<4G{sZ<%T-<4
zl+Xl!{V{ll0{_~lVkfOu;AQ@tv}J2rV4?rH{0V_NpQi$!Aq^+_#3VBclEV2Z!e>gq
zWx5=GsDuy6VdD6g3CD8967*Lv+WfpYCCd@z@Nuakeyk#Vsf3SG;4>tA^aH#!{^STV
z9}uYg9G5Lch*jW=CHx`<ez$~|OD<=0w-hd05q_KTOR>Z`3PP&^V#(x)G9!nSK#3x}
z{u^;dD^=iwJ`?#|SKwz#c%wr>$dm}x3j7fX&q<$hhN`9C5RAo9jmh{RtN7bffuAYi
zy+!=P{ePxJ@KZ#%F5%^p$O-h9!i6Zpr|pvZkOJ?$RLs!ONAPI>Ac-*Z5dz08l77c3
z@F%1MWV)Ooy~HO|5k5!yovpxoeua!u|C0mAjK)fgjwm9ONWY5}_;-jA{$#q$CtBiD
ztqAWT)hLHgq5sPfc1eun05X1&#3)FLDC7G}ze5!GN{Nq5m%}GZe1<*@FOI)#i7@ja
zfeOSel77c3@cq9QODxmn1YpP&NAWTh;d7+l*$VszUrYOcIe^TlKw`985#fl0Kcc{w
zNcigte6{r3p}-%L3Q%oS5F8St{{MP(I638sC5F&hD50Fu-V%PM0uTSMLbzB3zPE(W
zl<*Js|3@Uk5k-XRJtCuG1-|PyBEDLI-y-2TNp2u#v{=FiJ&HGSAM6zwg*-~&wn_LX
z1-|54F?_TFKYX8vPgdYR-Y?=a6!_Bu9{q2(f}qbABNQm`Z%BAqA|jVe|GC&C#ftFU
z7b3nyfp<vZO9@Z?UuHB`if~;KAx^?O6nKY(uU6orCHbD8l#tB-$N{lnK~3<&_#1gp
zB*-O^BaD>-4s8+v`Q<K1jAXhTJ~~Y-afTxNkwTGwrUL(dp|t-mRuDEx5lR&J@e<yl
zz<bIyp}-%J3MMy&oY4>|yvrAg{l6SRW++G4EtO1;DC3Vv_^}d086PeEj#A(&qyorv
zwK)HAoIK~tZ7nm(kQgK@7)2I|RVvfv@Fh})iWT8MkiwTJ@W$m5!J!~<QYWfb;J=i@
z%XB&6>r%pcDV~h4kirjD;8ll&0vI{Dx5^P>rGPUP5j@2RoJ^O)&s-*TIz{*#>360A
ze_i^WEqtQ>Wkx}glv|D{<Bv!YautknZir2=TY+CE;pKQTpHeBKas~uEwZDs$utUM9
zQesrC!0Ue(6PDx23Aij5YeFuFj2|lT50O4){1?A+;`-lTLHGa!8s~CEIfA#8K$IeU
zh=iZ1!0RRaA_YE5!pG$*_Wy543GY@!`0|dJp(6^s_g!(<D=R4EjFw8_N)+M8O5!`2
zt`_EBDyl@du88nawV1F&fsdIeR<#^YPFOyWxJdkDe6CbtPX#{1m?|>zRuJR}ehR#N
zAPG|7<?ta2e5RDJTyi->u~Il=lp+G235%l&iB{nIzA9!^jwmzQEhUhl2%jnamOth2
zxe`8G{Cv3ohXJ^daE^k}@;VVON0b>=O9>Y%!ppx)9)mA^1ds98Uy|KA9wBgC`|eWH
zNOU>jAPFzWlkv$b#qdKF;WH(ClmeeacpCpR6@&sQLXHAIKuS1Qfq$cinD7w=K2{b!
zEAa0~d`M_b=|7kOL!=1T6%nRM5vmpVwo<}!Jh>)<EMkWA5<eN=U&4=lh!@i5#!3V^
z$8v;N37_#W0_B&xF8!82<?y*u_>f&<24sBHbK>v*3j875GmRsLFqsfO<p^deLaYKG
z`JxzZkpiDB;o}tew<LUy0{{L%kx#BsK`4{X{Ur+gcnM#sz`r5ky(K-MT!15bF#$gX
zzC^-DN%#l*|4UI~glI*Cj?zq*tiUgtB!<sW;0q*trUEbj&VCec<Ya=Z$&^cwD+QE4
zWqg5z-~A{f?$%^6Lo!_spS?=N2jz*MGCrh$<`wk65CuWr-}hJGy(Ni=UV)dj;6oL7
zLBEf_HCBO_mEBQ<r~WVJNUnisMT87#Vw$PI%gW_g1zuKOFH+!T^*+pk9&~nL{K@+I
z<R%2<>wyJCh5|2Z!7~+jSzVv4z{|?$90eZQHBtVTt02fG6T21o^^$hHK!JCWB%VhU
zcv-1ktia1!_L4ls{$Dl}C{;v|HyGCycv&s)P~c@TT(tr(YsWdsp5?**|A9q=OrZM5
zpKNU6sldyo6y6HFZ1dr#z!yvE{U8N?rfgIaq99~Qo6i0UysTc+EAX;K!%ziYHct6J
DkE0-T

diff --git a/roms/opensbi b/roms/opensbi
index 6b5188ca14..2552799a1d 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
+Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc

From 11b937b65256537cff74fe731a96465f8d0c2d88 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Fri, 30 Jun 2023 23:39:23 +0800
Subject: [PATCH 0567/1353] tests/avocado: riscv: Enable 32-bit Spike OpenSBI
 boot testing

The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
Let's enable the 32-bit Spike OpenSBI boot testing.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/avocado/riscv_opensbi.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
index e02f0d404a..bfff9cc3c3 100644
--- a/tests/avocado/riscv_opensbi.py
+++ b/tests/avocado/riscv_opensbi.py
@@ -6,7 +6,6 @@
 # later.  See the COPYING file in the top-level directory.
 
 from avocado_qemu import QemuSystemTest
-from avocado import skip
 from avocado_qemu import wait_for_console_pattern
 
 class RiscvOpenSBI(QemuSystemTest):
@@ -21,7 +20,6 @@ class RiscvOpenSBI(QemuSystemTest):
         wait_for_console_pattern(self, 'Platform Name')
         wait_for_console_pattern(self, 'Boot HART MEDELEG')
 
-    @skip("requires OpenSBI fix to work")
     def test_riscv32_spike(self):
         """
         :avocado: tags=arch:riscv32

From bf01a04f5fbb4c22ac861a76fdc4c7a74247e44b Mon Sep 17 00:00:00 2001
From: Tommy Wu <tommy.wu@sifive.com>
Date: Tue, 27 Jun 2023 07:12:14 -0700
Subject: [PATCH 0568/1353] hw/misc: sifive_e_aon: Support the watchdog timer
 of HiFive 1 rev b.

The watchdog timer is in the always-on domain device of HiFive 1 rev b,
so this patch added the AON device to the sifive_e machine. This patch
only implemented the functionality of the watchdog timer.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/misc/Kconfig                |   3 +
 hw/misc/meson.build            |   1 +
 hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
 include/hw/misc/sifive_e_aon.h |  60 +++++++
 4 files changed, 383 insertions(+)
 create mode 100644 hw/misc/sifive_e_aon.c
 create mode 100644 include/hw/misc/sifive_e_aon.h

diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index e4c2149175..6996d265e4 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -158,6 +158,9 @@ config SIFIVE_TEST
 config SIFIVE_E_PRCI
     bool
 
+config SIFIVE_E_AON
+    bool
+
 config SIFIVE_U_OTP
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 05877f61cc..892f8b91c5 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -30,6 +30,7 @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
 system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 
diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
new file mode 100644
index 0000000000..4656457d0b
--- /dev/null
+++ b/hw/misc/sifive_e_aon.c
@@ -0,0 +1,319 @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) for QEMU.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "sysemu/watchdog.h"
+#include "hw/qdev-properties.h"
+
+REG32(AON_WDT_WDOGCFG, 0x0)
+    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+REG32(AON_WDT_WDOGCOUNT, 0x8)
+    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
+REG32(AON_WDT_WDOGS, 0x10)
+REG32(AON_WDT_WDOGFEED, 0x18)
+REG32(AON_WDT_WDOGKEY, 0x1c)
+REG32(AON_WDT_WDOGCMP0, 0x20)
+
+static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
+{
+    int64_t now;
+    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
+        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
+        return;
+    }
+
+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    r->wdogcount += muldiv64(now - r->wdog_restart_time,
+                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
+
+    /* Clean the most significant bit. */
+    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+    r->wdog_restart_time = now;
+}
+
+static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
+{
+    uint16_t wdogs;
+    bool cmp_signal = false;
+    sifive_e_aon_wdt_update_wdogcount(r);
+    wdogs = (uint16_t)(r->wdogcount >>
+                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
+
+    if (wdogs >= r->wdogcmp0) {
+        cmp_signal = true;
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
+            r->wdogcount = 0;
+            wdogs = 0;
+        }
+    }
+
+    if (cmp_signal) {
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
+            watchdog_perform_action();
+        }
+        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
+    }
+
+    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
+
+    if (wdogs < r->wdogcmp0 &&
+        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
+         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
+        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        next += muldiv64((r->wdogcmp0 - wdogs) <<
+                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
+                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
+        timer_mod(r->wdog_timer, next);
+    } else {
+        timer_mod(r->wdog_timer, INT64_MAX);
+    }
+}
+
+/*
+ * Callback used when the timer set using timer_mod expires.
+ */
+static void sifive_e_aon_wdt_expired_cb(void *opaque)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG:
+        return r->wdogcfg;
+    case A_AON_WDT_WDOGCOUNT:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount;
+    case A_AON_WDT_WDOGS:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount >>
+               FIELD_EX32(r->wdogcfg,
+                          AON_WDT_WDOGCFG,
+                          SCALE);
+    case A_AON_WDT_WDOGFEED:
+        return 0;
+    case A_AON_WDT_WDOGKEY:
+        return r->wdogunlock;
+    case A_AON_WDT_WDOGCMP0:
+        return r->wdogcmp0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+
+    return 0;
+}
+
+static void
+sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    uint32_t value = val64;
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG: {
+        uint8_t new_en_always;
+        uint8_t new_en_core_awake;
+        uint8_t old_en_always;
+        uint8_t old_en_core_awake;
+        if (r->wdogunlock == 0) {
+            return;
+        }
+
+        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
+        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
+        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
+        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
+                                       EN_CORE_AWAKE);
+
+        if ((old_en_always ||
+             old_en_core_awake) == 1 &&
+            (new_en_always ||
+             new_en_core_awake) == 0) {
+            sifive_e_aon_wdt_update_wdogcount(r);
+        } else if ((old_en_always ||
+                    old_en_core_awake) == 0 &&
+                   (new_en_always ||
+                    new_en_core_awake) == 1) {
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogcfg = value;
+        r->wdogunlock = 0;
+        break;
+    }
+    case A_AON_WDT_WDOGCOUNT:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGS:
+        return;
+    case A_AON_WDT_WDOGFEED:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        if (value == SIFIVE_E_AON_WDOGFEED) {
+            r->wdogcount = 0;
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGKEY:
+        if (value == SIFIVE_E_AON_WDOGKEY) {
+            r->wdogunlock = 1;
+        }
+        break;
+    case A_AON_WDT_WDOGCMP0:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcmp0 = (uint16_t) value;
+        r->wdogunlock = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
+                      __func__, (int)addr, (int)value);
+    }
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        return sifive_e_aon_wdt_read(opaque, addr, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+    return 0;
+}
+
+static void
+sifive_e_aon_write(void *opaque, hwaddr addr,
+                   uint64_t val64, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        sifive_e_aon_wdt_write(opaque, addr, val64, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+}
+
+static const MemoryRegionOps sifive_e_aon_ops = {
+    .read = sifive_e_aon_read,
+    .write = sifive_e_aon_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static void sifive_e_aon_reset(DeviceState *dev)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(dev);
+
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
+    r->wdogcmp0 = 0xbeef;
+
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static void sifive_e_aon_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    SiFiveEAONState *r = SIFIVE_E_AON(obj);
+
+    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
+                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
+    sysbus_init_mmio(sbd, &r->mmio);
+
+    /* watchdog timer */
+    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                 sifive_e_aon_wdt_expired_cb, r);
+    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
+    sysbus_init_irq(sbd, &r->wdog_irq);
+}
+
+static Property sifive_e_aon_properties[] = {
+    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
+                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->reset = sifive_e_aon_reset;
+    device_class_set_props(dc, sifive_e_aon_properties);
+}
+
+static const TypeInfo sifive_e_aon_info = {
+    .name          = TYPE_SIFIVE_E_AON,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SiFiveEAONState),
+    .instance_init = sifive_e_aon_init,
+    .class_init    = sifive_e_aon_class_init,
+};
+
+static void sifive_e_aon_register_types(void)
+{
+    type_register_static(&sifive_e_aon_info);
+}
+
+type_init(sifive_e_aon_register_types)
diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
new file mode 100644
index 0000000000..2ae1c4139c
--- /dev/null
+++ b/include/hw/misc/sifive_e_aon.h
@@ -0,0 +1,60 @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) interface.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_SIFIVE_AON_H
+#define HW_SIFIVE_AON_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
+OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+enum {
+    SIFIVE_E_AON_WDT    = 0x0,
+    SIFIVE_E_AON_RTC    = 0x40,
+    SIFIVE_E_AON_LFROSC = 0x70,
+    SIFIVE_E_AON_BACKUP = 0x80,
+    SIFIVE_E_AON_PMU    = 0x100,
+    SIFIVE_E_AON_MAX    = 0x150
+};
+
+struct SiFiveEAONState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion mmio;
+
+    /*< watchdog timer >*/
+    QEMUTimer *wdog_timer;
+    qemu_irq wdog_irq;
+    uint64_t wdog_restart_time;
+    uint64_t wdogclk_freq;
+
+    uint32_t wdogcfg;
+    uint16_t wdogcmp0;
+    uint32_t wdogcount;
+    uint8_t wdogunlock;
+};
+
+#endif

From 82193640c49ded26835fe90e60cdfd4385d4c0e2 Mon Sep 17 00:00:00 2001
From: Tommy Wu <tommy.wu@sifive.com>
Date: Tue, 27 Jun 2023 07:12:15 -0700
Subject: [PATCH 0569/1353] hw/riscv: sifive_e: Support the watchdog timer of
 HiFive 1 rev b.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create the AON device when we realize the sifive_e machine.
This patch only implemented the functionality of the watchdog timer,
not all the functionality of the AON device.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/Kconfig            |  1 +
 hw/riscv/sifive_e.c         | 17 +++++++++++++++--
 include/hw/riscv/sifive_e.h |  9 ++++++---
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index 6528ebfa3a..b6a5eb4452 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -60,6 +60,7 @@ config SIFIVE_E
     select SIFIVE_PLIC
     select SIFIVE_UART
     select SIFIVE_E_PRCI
+    select SIFIVE_E_AON
     select UNIMP
 
 config SIFIVE_U
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index 04939b60c3..0d37adc542 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -45,6 +45,7 @@
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "chardev/char.h"
 #include "sysemu/sysemu.h"
 
@@ -185,6 +186,8 @@ static void sifive_e_soc_init(Object *obj)
     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
                             TYPE_SIFIVE_GPIO);
+    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
+                            TYPE_SIFIVE_E_AON);
 }
 
 static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
@@ -223,10 +226,17 @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
-    create_unimplemented_device("riscv.sifive.e.aon",
-        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
 
+    /* AON */
+
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
+        return;
+    }
+
+    /* Map AON registers */
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
+
     /* GPIO */
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
@@ -245,6 +255,9 @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
                            qdev_get_gpio_in(DEVICE(s->plic),
                                             SIFIVE_E_GPIO0_IRQ0 + i));
     }
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
+                       qdev_get_gpio_in(DEVICE(s->plic),
+                                        SIFIVE_E_AON_WDT_IRQ));
 
     sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index b824a79e2d..31180a680e 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -22,6 +22,7 @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/gpio/sifive_gpio.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "hw/boards.h"
 
 #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
@@ -35,6 +36,7 @@ typedef struct SiFiveESoCState {
     /*< public >*/
     RISCVHartArrayState cpus;
     DeviceState *plic;
+    SiFiveEAONState aon;
     SIFIVEGPIOState gpio;
     MemoryRegion xip_mem;
     MemoryRegion mask_rom;
@@ -76,9 +78,10 @@ enum {
 };
 
 enum {
-    SIFIVE_E_UART0_IRQ  = 3,
-    SIFIVE_E_UART1_IRQ  = 4,
-    SIFIVE_E_GPIO0_IRQ0 = 8
+    SIFIVE_E_AON_WDT_IRQ  = 1,
+    SIFIVE_E_UART0_IRQ    = 3,
+    SIFIVE_E_UART1_IRQ    = 4,
+    SIFIVE_E_GPIO0_IRQ0   = 8
 };
 
 #define SIFIVE_E_PLIC_HART_CONFIG "M"

From 2f849e9d7aa4ee8782c524b4521ba36451cfd414 Mon Sep 17 00:00:00 2001
From: Tommy Wu <tommy.wu@sifive.com>
Date: Tue, 27 Jun 2023 07:12:16 -0700
Subject: [PATCH 0570/1353] tests/qtest: sifive-e-aon-watchdog-test.c: Add
 QTest of watchdog of sifive_e

Add some simple tests of the watchdog timer in the always-on domain device
of HiFive 1 rev b.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/meson.build                  |   3 +
 tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
 2 files changed, 453 insertions(+)
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 74630f6672..b071d400b3 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -234,6 +234,9 @@ qtests_s390x = \
    'cpu-plug-test',
    'migration-test']
 
+qtests_riscv32 = \
+  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
+
 qos_test_ss = ss.source_set()
 qos_test_ss.add(
   'ac97-test.c',
diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
new file mode 100644
index 0000000000..1f313d16ad
--- /dev/null
+++ b/tests/qtest/sifive-e-aon-watchdog-test.c
@@ -0,0 +1,450 @@
+/*
+ * QTest testcase for the watchdog timer of HiFive 1 rev b.
+ *
+ * Copyright (c) 2023 SiFive, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/bitops.h"
+#include "libqtest.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+
+FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+
+#define WDOG_BASE (0x10000000)
+#define WDOGCFG (0x0)
+#define WDOGCOUNT (0x8)
+#define WDOGS (0x10)
+#define WDOGFEED (0x18)
+#define WDOGKEY (0x1c)
+#define WDOGCMP0 (0x20)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+static void test_init(QTestState *qts)
+{
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+}
+
+static void test_wdogcount(void)
+{
+    uint64_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcfg(void)
+{
+    uint32_t tmp_cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcmp0(void)
+{
+    uint32_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogkey(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogfeed(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_wdogs(void)
+{
+    uint32_t cfg;
+    uint32_t fake_count = 0x12345678;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
+    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             (uint16_t)fake_count);
+
+    for (int i = 0; i < 16; i++) {
+        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
+        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+                 (uint16_t)(fake_count >>
+                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
+    }
+
+    qtest_quit(qts);
+}
+
+static void test_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_periodic_int(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_enable_disable(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char *argv[])
+{
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
+                   test_wdogcount);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
+                   test_wdogcfg);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
+                   test_wdogcmp0);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
+                   test_wdogkey);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
+                   test_wdogfeed);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
+                   test_scaled_wdogs);
+    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
+                   test_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
+                   test_scaled_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
+                   test_periodic_int);
+    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
+                   test_enable_disable);
+    return g_test_run();
+}

From 278c1bcef568f41e298792f9f437efd333305812 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 16:32:34 +0200
Subject: [PATCH 0571/1353] target/riscv: Only unify 'riscv32/64' -> 'riscv'
 for host cpu in meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to keep the ability to distinct between 32/64-bit host.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-2-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/meson.build b/meson.build
index 58413d44a5..657e01069b 100644
--- a/meson.build
+++ b/meson.build
@@ -55,16 +55,11 @@ qapi_trace_events = []
 
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
 supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
-supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
+supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
   'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
 
 cpu = host_machine.cpu_family()
 
-# Unify riscv* to a single family.
-if cpu in ['riscv32', 'riscv64']
-  cpu = 'riscv'
-endif
-
 target_dirs = config_host['TARGET_DIRS'].split()
 have_linux_user = false
 have_bsd_user = false
@@ -99,6 +94,8 @@ elif cpu == 'x86'
   host_arch = 'i386'
 elif cpu == 'mips64'
   host_arch = 'mips'
+elif cpu in ['riscv32', 'riscv64']
+  host_arch = 'riscv'
 else
   host_arch = cpu
 endif
@@ -113,7 +110,7 @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv']
+elif cpu in ['riscv32', 'riscv64']
   kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
 else
   kvm_targets = []

From 4de81093f894c42bce975e52fc7b470a76046301 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 27 Jun 2023 16:32:35 +0200
Subject: [PATCH 0572/1353] target/riscv: Only build KVM guest with same
 wordsize as host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per Anup Patel in [*]:

 > Currently, we only support running rv64 guest on rv64 host
 > and rv32 guest on rv32 host.
 >
 > In the future, we might support running rv32 guest on rv64
 > host but as of now we don't see a strong push for it.

Therefore, when only using the KVM accelerator it is pointless
to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
on a rv32 host). Restrict meson to only build the correct binary,
avoiding to waste ressources building unusable code.

[*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meson.build b/meson.build
index 657e01069b..1ed47c779d 100644
--- a/meson.build
+++ b/meson.build
@@ -110,8 +110,10 @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv32', 'riscv64']
-  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
+elif cpu in ['riscv32']
+  kvm_targets = ['riscv32-softmmu']
+elif cpu in ['riscv64']
+  kvm_targets = ['riscv64-softmmu']
 else
   kvm_targets = []
 endif

From b227f6a8a7db28f48b4f1120d521eacdc25e66ef Mon Sep 17 00:00:00 2001
From: Ivan Klokov <ivan.klokov@syntacore.com>
Date: Thu, 29 Jun 2023 11:37:30 +0300
Subject: [PATCH 0573/1353] target/riscv: Add RVV registers to log

Print RvV extension register to log if VPU option is enabled.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index b9b3879281..0c9faf4633 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -55,6 +55,17 @@ struct isa_ext_data {
 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
+/*
+ * From vector_helper.c
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing bytes needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define BYTE(x)   ((x) ^ 7)
+#else
+#define BYTE(x)   (x)
+#endif
+
 /*
  * Here are the ordering rules of extension naming defined by RISC-V
  * specification :
@@ -183,6 +194,14 @@ const char * const riscv_fpr_regnames[] = {
     "f30/ft10", "f31/ft11"
 };
 
+const char * const riscv_rvv_regnames[] = {
+  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
+  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
+  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
+  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
+  "v28", "v29", "v30", "v31"
+};
+
 static const char * const riscv_excp_names[] = {
     "misaligned_fetch",
     "fault_fetch",
@@ -611,7 +630,8 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    int i;
+    int i, j;
+    uint8_t *p;
 
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVH)) {
@@ -695,6 +715,41 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             }
         }
     }
+    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
+        static const int dump_rvv_csrs[] = {
+                    CSR_VSTART,
+                    CSR_VXSAT,
+                    CSR_VXRM,
+                    CSR_VCSR,
+                    CSR_VL,
+                    CSR_VTYPE,
+                    CSR_VLENB,
+                };
+        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
+            int csrno = dump_rvv_csrs[i];
+            target_ulong val = 0;
+            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
+
+            /*
+             * Rely on the smode, hmode, etc, predicates within csr.c
+             * to do the filtering of the registers that are present.
+             */
+            if (res == RISCV_EXCP_NONE) {
+                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
+                             csr_ops[csrno].name, val);
+            }
+        }
+        uint16_t vlenb = cpu->cfg.vlen >> 3;
+
+        for (i = 0; i < 32; i++) {
+            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
+            p = (uint8_t *)env->vreg;
+            for (j = vlenb - 1 ; j >= 0; j--) {
+                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
+            }
+            qemu_fprintf(f, "\n");
+        }
+    }
 }
 
 static void riscv_cpu_set_pc(CPUState *cs, vaddr value)

From c0716c81b2e436eb69975f1890dd2ae46bce5369 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 29 Jun 2023 14:11:03 +0200
Subject: [PATCH 0574/1353] hw/riscv/virt: Restrict ACLINT to TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Advanced Core Local Interruptor (ACLINT) device can
only be used with TCG. Check for TCG enabled instead of
KVM being not. Only add the property when TCG is used.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629121103.87733-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst |  1 +
 hw/riscv/virt.c            | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index b33f45e5b3..f9a2eac544 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -93,6 +93,7 @@ The following machine-specific options are supported:
 
   When this option is "on", ACLINT devices will be emulated instead of
   SiFive CLINT. When not specified, this option is assumed to be "off".
+  This option is restricted to the TCG accelerator.
 
 - aia=[none|aplic|aplic-imsic]
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 68ccd0bde1..cdb88a1529 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -44,6 +44,7 @@
 #include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/tcg.h"
 #include "sysemu/kvm.h"
 #include "sysemu/tpm.h"
 #include "hw/pci/pci.h"
@@ -776,7 +777,7 @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         g_free(clust_name);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 create_fdt_socket_aclint(s, memmap, socket,
                     &intc_phandles[phandle_pos]);
@@ -1370,7 +1371,7 @@ static void virt_machine_init(MachineState *machine)
                                 hart_count, &error_abort);
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
                     /* Per-socket ACLINT MTIMER */
@@ -1682,12 +1683,13 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
 
-    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
-                                   virt_set_aclint);
-    object_class_property_set_description(oc, "aclint",
-                                          "Set on/off to enable/disable "
-                                          "emulating ACLINT devices");
-
+    if (tcg_enabled()) {
+        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
+                                       virt_set_aclint);
+        object_class_property_set_description(oc, "aclint",
+                                              "Set on/off to enable/disable "
+                                              "emulating ACLINT devices");
+    }
     object_class_property_add_str(oc, "aia", virt_get_aia,
                                   virt_set_aia);
     object_class_property_set_description(oc, "aia",

From 9e1c7d982d7feb5b6547276ecc4c10468c0f5092 Mon Sep 17 00:00:00 2001
From: Robbin Ehn <rehn@rivosinc.com>
Date: Mon, 19 Jun 2023 10:24:03 +0200
Subject: [PATCH 0575/1353] linux-user/riscv: Add syscall riscv_hwprobe

This patch adds the new syscall for the
"RISC-V Hardware Probing Interface"
(https://docs.kernel.org/riscv/hwprobe.html).

Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/syscall32_nr.h |   1 +
 linux-user/riscv/syscall64_nr.h |   1 +
 linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
 3 files changed, 148 insertions(+)

diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
index 1327d7dffa..412e58e5b2 100644
--- a/linux-user/riscv/syscall32_nr.h
+++ b/linux-user/riscv/syscall32_nr.h
@@ -228,6 +228,7 @@
 #define TARGET_NR_accept4 242
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
 #define TARGET_NR_fanotify_mark 263
diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
index 6659751933..29e1eb2075 100644
--- a/linux-user/riscv/syscall64_nr.h
+++ b/linux-user/riscv/syscall64_nr.h
@@ -251,6 +251,7 @@
 #define TARGET_NR_recvmmsg 243
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_wait4 260
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 9b9e3bd5e3..420bab7c68 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8983,6 +8983,147 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 }
 #endif /* TARGET_NR_getdents64 */
 
+#if defined(TARGET_NR_riscv_hwprobe)
+
+#define RISCV_HWPROBE_KEY_MVENDORID     0
+#define RISCV_HWPROBE_KEY_MARCHID       1
+#define RISCV_HWPROBE_KEY_MIMPID        2
+
+#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
+#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+
+#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
+#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+#define     RISCV_HWPROBE_IMA_C        (1 << 1)
+
+#define RISCV_HWPROBE_KEY_CPUPERF_0     5
+#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
+
+struct riscv_hwprobe {
+    abi_llong  key;
+    abi_ullong value;
+};
+
+static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+                                    struct riscv_hwprobe *pair,
+                                    size_t pair_count)
+{
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
+
+    for (; pair_count > 0; pair_count--, pair++) {
+        abi_llong key;
+        abi_ullong value;
+        __put_user(0, &pair->value);
+        __get_user(key, &pair->key);
+        switch (key) {
+        case RISCV_HWPROBE_KEY_MVENDORID:
+            __put_user(cfg->mvendorid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MARCHID:
+            __put_user(cfg->marchid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MIMPID:
+            __put_user(cfg->mimpid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
+            value = riscv_has_ext(env, RVI) &&
+                    riscv_has_ext(env, RVM) &&
+                    riscv_has_ext(env, RVA) ?
+                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_IMA_EXT_0:
+            value = riscv_has_ext(env, RVF) &&
+                    riscv_has_ext(env, RVD) ?
+                    RISCV_HWPROBE_IMA_FD : 0;
+            value |= riscv_has_ext(env, RVC) ?
+                     RISCV_HWPROBE_IMA_C : pair->value;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_CPUPERF_0:
+            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
+            break;
+        default:
+            __put_user(-1, &pair->key);
+            break;
+        }
+    }
+}
+
+static int cpu_set_valid(abi_long arg3, abi_long arg4)
+{
+    int ret, i, tmp;
+    size_t host_mask_size, target_mask_size;
+    unsigned long *host_mask;
+
+    /*
+     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
+     * arg3 contains the cpu count.
+     */
+    tmp = (8 * sizeof(abi_ulong));
+    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
+    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
+                     ~(sizeof(*host_mask) - 1);
+
+    host_mask = alloca(host_mask_size);
+
+    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
+                                  arg4, target_mask_size);
+    if (ret != 0) {
+        return ret;
+    }
+
+    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
+        if (host_mask[i] != 0) {
+            return 0;
+        }
+    }
+    return -TARGET_EINVAL;
+}
+
+static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
+                                 abi_long arg2, abi_long arg3,
+                                 abi_long arg4, abi_long arg5)
+{
+    int ret;
+    struct riscv_hwprobe *host_pairs;
+
+    /* flags must be 0 */
+    if (arg5 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* check cpu_set */
+    if (arg3 != 0) {
+        ret = cpu_set_valid(arg3, arg4);
+        if (ret != 0) {
+            return ret;
+        }
+    } else if (arg4 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* no pairs */
+    if (arg2 == 0) {
+        return 0;
+    }
+
+    host_pairs = lock_user(VERIFY_WRITE, arg1,
+                           sizeof(*host_pairs) * (size_t)arg2, 0);
+    if (host_pairs == NULL) {
+        return -TARGET_EFAULT;
+    }
+    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
+    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
+    return 0;
+}
+#endif /* TARGET_NR_riscv_hwprobe */
+
 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
 #endif
@@ -13665,6 +13806,11 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return ret;
 #endif
 
+#if defined(TARGET_NR_riscv_hwprobe)
+    case TARGET_NR_riscv_hwprobe:
+        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
+#endif
+
     default:
         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
         return -TARGET_ENOSYS;

From 4556fdaa5cb7157b9adb3ee136f44d5952b94736 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Thu, 15 Jun 2023 14:32:57 +0800
Subject: [PATCH 0576/1353] target/riscv: Add properties for BF16 extensions

Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
Add require check for BF16 extensions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c     | 20 ++++++++++++++++++++
 target/riscv/cpu_cfg.h |  3 +++
 2 files changed, 23 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 0c9faf4633..0272b1d071 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1118,6 +1118,11 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zfbfmin && !riscv_has_ext(env, RVF)) {
+        error_setg(errp, "Zfbfmin extension depends on F extension");
+        return;
+    }
+
     if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
         error_setg(errp, "D extension requires F extension");
         return;
@@ -1168,6 +1173,21 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zfbfmin) {
+        error_setg(errp, "Zvfbfmin extension depends on Zfbfmin extension");
+        return;
+    }
+
+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zve32f) {
+        error_setg(errp, "Zvfbfmin extension depends on Zve32f extension");
+        return;
+    }
+
+    if (cpu->cfg.ext_zvfbfwma && !cpu->cfg.ext_zvfbfmin) {
+        error_setg(errp, "Zvfbfwma extension depends on Zvfbfmin extension");
+        return;
+    }
+
     /* Set the ISA extensions, checks should have happened above */
     if (cpu->cfg.ext_zhinx) {
         cpu->cfg.ext_zhinxmin = true;
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index 6b7e736bc2..e9ee39d7de 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -75,6 +75,7 @@ struct RISCVCPUConfig {
     bool ext_svpbmt;
     bool ext_zdinx;
     bool ext_zawrs;
+    bool ext_zfbfmin;
     bool ext_zfh;
     bool ext_zfhmin;
     bool ext_zfinx;
@@ -84,6 +85,8 @@ struct RISCVCPUConfig {
     bool ext_zve64f;
     bool ext_zve64d;
     bool ext_zmmul;
+    bool ext_zvfbfmin;
+    bool ext_zvfbfwma;
     bool ext_zvfh;
     bool ext_zvfhmin;
     bool ext_smaia;

From 5d1270caac2ef7b8c887d4cb5a2444ba6d237516 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Thu, 15 Jun 2023 14:32:58 +0800
Subject: [PATCH 0577/1353] target/riscv: Add support for Zfbfmin extension

Add trans_* and helper function for Zfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/fpu_helper.c                  | 12 +++++
 target/riscv/helper.h                      |  4 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
 target/riscv/translate.c                   |  1 +
 6 files changed, 80 insertions(+), 6 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc

diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index 5dd14d8390..eb5ee5c4c9 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -593,3 +593,15 @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
     float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_float64(frs1, true, &env->fp_status);
 }
+
+uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
+}
+
+uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
+}
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 98e97810fd..ef8487f1ee 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1153,3 +1153,7 @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 
 /* Zce helper */
 DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+
+/* BF16 functions */
+DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 73d5d1b045..45fdcad185 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -908,3 +908,7 @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
 # *** RV32 Zicond Standard Extension ***
 czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
 czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+
+# *** Zfbfmin Standard Extension ***
+fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
+fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
new file mode 100644
index 0000000000..8cafde505f
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -0,0 +1,53 @@
+/*
+ * RISC-V translation routines for the BF16 Standard Extensions.
+ *
+ * Copyright (c) 2020-2023 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
+static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index 74dde37ff7..8b1e2519bb 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -28,8 +28,8 @@
     }                                  \
 } while (0)
 
-#define REQUIRE_ZFHMIN(ctx) do {              \
-    if (!ctx->cfg_ptr->ext_zfhmin) {          \
+#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
         return false;                         \
     }                                         \
 } while (0)
@@ -46,7 +46,7 @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -69,7 +69,7 @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -574,7 +574,7 @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
 static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
 
@@ -594,7 +594,7 @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
 
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 98d54c5617..621dd99241 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1095,6 +1095,7 @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
 #include "insn_trans/trans_svinval.c.inc"
+#include "insn_trans/trans_rvbf16.c.inc"
 #include "decode-xthead.c.inc"
 #include "insn_trans/trans_xthead.c.inc"
 #include "insn_trans/trans_xventanacondops.c.inc"

From 87b27bfca432c69a2abfd7a9ebc1fa27876b31f5 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Thu, 15 Jun 2023 14:32:59 +0800
Subject: [PATCH 0578/1353] target/riscv: Add support for Zvfbfmin extension

Add trans_* and helper function for Zvfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 +
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
 target/riscv/vector_helper.c               |  6 ++
 4 files changed, 77 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index ef8487f1ee..fc48853e07 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1157,3 +1157,6 @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
 /* BF16 functions */
 DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+
+DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 45fdcad185..10d001f14d 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -912,3 +912,7 @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
 # *** Zfbfmin Standard Extension ***
 fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
 fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+
+# *** Zvfbfmin Standard Extension ***
+vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index 8cafde505f..f794a3f745 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -22,6 +22,12 @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -51,3 +57,61 @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
     mark_fs_dirty(ctx);
     return true;
 }
+
+static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfncvtbf16_f_f_w);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwcvtbf16_f_f_v);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 1e06e7447c..4d2bd42155 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -4535,6 +4535,9 @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
 
+RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
+GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
+
 /* Narrowing Floating-Point/Integer Type-Convert Instructions */
 /* (TD, T2, TX2) */
 #define NOP_UU_B uint8_t,  uint16_t, uint32_t
@@ -4581,6 +4584,9 @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
 
+RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
+GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
+
 /*
  * Vector Reduction Operations
  */

From adf772b0f788b80bea427c945a48343610d4af49 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Thu, 15 Jun 2023 14:33:00 +0800
Subject: [PATCH 0579/1353] target/riscv: Add support for Zvfbfwma extension

Add trans_* and helper function for Zvfbfwma instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
 target/riscv/vector_helper.c               | 11 ++++
 4 files changed, 76 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index fc48853e07..3170b8daa6 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1160,3 +1160,6 @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
 
 DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
 DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 10d001f14d..8c5d293f07 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -916,3 +916,7 @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
 # *** Zvfbfmin Standard Extension ***
 vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
 vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
+
+# *** Zvfbfwma Standard Extension ***
+vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
+vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index f794a3f745..911bc29908 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -28,6 +28,12 @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFWMA(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -115,3 +121,55 @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
     }
     return false;
 }
+
+static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
+        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs1),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwmaccbf16_vv);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
+        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
+        uint32_t data = 0;
+
+        gen_set_rm(ctx, RISCV_FRM_DYN);
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
+                           gen_helper_vfwmaccbf16_vf, ctx);
+    }
+
+    return false;
+}
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 4d2bd42155..71bb9b4457 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -3554,6 +3554,17 @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
 GEN_VEXT_VF(vfwmacc_vf_h, 4)
 GEN_VEXT_VF(vfwmacc_vf_w, 8)
 
+static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
+{
+    return float32_muladd(bfloat16_to_float32(a, s),
+                          bfloat16_to_float32(b, s), d, 0, s);
+}
+
+RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
+GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
+RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
+GEN_VEXT_VF(vfwmaccbf16_vf, 4)
+
 static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),

From 889caa44011d32a584c8e3a31bf91a7f9b73f2a3 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Thu, 15 Jun 2023 14:33:01 +0800
Subject: [PATCH 0580/1353] target/riscv: Expose properties for BF16 extensions

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 0272b1d071..fd647534cf 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -94,6 +94,7 @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -125,6 +126,8 @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
+    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
+    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
@@ -1762,6 +1765,10 @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
     DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
 
+    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
+
     DEFINE_PROP_END_OF_LIST(),
 };
 

From 60ef34a48cf1990c55f0ff86086f40d7dfbb4181 Mon Sep 17 00:00:00 2001
From: Jason Chien <jason.chien@sifive.com>
Date: Tue, 27 Jun 2023 07:48:52 +0000
Subject: [PATCH 0581/1353] target/riscv: Set the correct exception for implict
 G-stage translation fail

The privileged spec states:
For a memory access made to support VS-stage address translation (such as
to read/write a VS-level page table), permissions are checked as though
for a load or store, not for the original access type. However, any
exception is always reported for the original access type (instruction,
load, or store/AMO).

The current implementation converts the access type to LOAD if implicit
G-stage translation fails which results in only reporting "Load guest-page
fault". This commit removes the convertion of access type, so the reported
exception conforms to the spec.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index bb9d923818..9f611d89bb 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -1282,7 +1282,6 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_G_STAGE_FAIL) {
             first_stage_error = false;
             two_stage_indirect_error = true;
-            access_type = MMU_DATA_LOAD;
         }
 
         qemu_log_mask(CPU_LOG_MMU,

From 32b2d75bf7fab6fa82dd01b2413ca14753b90973 Mon Sep 17 00:00:00 2001
From: Weiwei Li <liweiwei@iscas.ac.cn>
Date: Mon, 3 Jul 2023 15:17:59 +0800
Subject: [PATCH 0582/1353] target/riscv: Add disas support for BF16 extensions

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/disas/riscv.c b/disas/riscv.c
index 94e568a7e9..9f0195be30 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -819,6 +819,16 @@ typedef enum {
     rv_op_cm_jalt = 788,
     rv_op_czero_eqz = 789,
     rv_op_czero_nez = 790,
+    rv_op_fcvt_bf16_s = 791,
+    rv_op_fcvt_s_bf16 = 792,
+    rv_op_vfncvtbf16_f_f_w = 793,
+    rv_op_vfwcvtbf16_f_f_v = 794,
+    rv_op_vfwmaccbf16_vv = 795,
+    rv_op_vfwmaccbf16_vf = 796,
+    rv_op_flh = 797,
+    rv_op_fsh = 798,
+    rv_op_fmv_h_x = 799,
+    rv_op_fmv_x_h = 800,
 } rv_op;
 
 /* register names */
@@ -1905,6 +1915,16 @@ const rv_opcode_data rvi_opcode_data[] = {
     { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
     { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
+    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
+    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
+    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
+    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -2380,6 +2400,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vloxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_flh; break;
             case 2: op = rv_op_flw; break;
             case 3: op = rv_op_fld; break;
             case 4: op = rv_op_flq; break;
@@ -2583,6 +2604,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vsoxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_fsh; break;
             case 2: op = rv_op_fsw; break;
             case 3: op = rv_op_fsd; break;
             case 4: op = rv_op_fsq; break;
@@ -2860,6 +2882,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
             case 33:
@@ -2868,6 +2891,11 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_fcvt_d_q; break;
                 }
                 break;
+            case 34:
+                switch (((inst >> 20) & 0b11111)) {
+                case 8: op = rv_op_fcvt_bf16_s; break;
+                }
+                break;
             case 35:
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
@@ -2972,6 +3000,12 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fclass_d; break;
                 }
                 break;
+            case 114:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_x_h; break;
+                }
+                break;
             case 115:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -2991,6 +3025,12 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fmv_d_x; break;
                 }
                 break;
+            case 122:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_h_x; break;
+                }
+                break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -3087,6 +3127,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 10: op = rv_op_vfwcvt_f_xu_v; break;
                     case 11: op = rv_op_vfwcvt_f_x_v; break;
                     case 12: op = rv_op_vfwcvt_f_f_v; break;
+                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
                     case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
                     case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
                     case 16: op = rv_op_vfncvt_xu_f_w; break;
@@ -3097,6 +3138,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 21: op = rv_op_vfncvt_rod_f_f_w; break;
                     case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
                     case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
+                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
                     }
                     break;
                 case 19:
@@ -3128,6 +3170,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wv; break;
                 case 54: op = rv_op_vfwsub_wv; break;
                 case 56: op = rv_op_vfwmul_vv; break;
+                case 59: op = rv_op_vfwmaccbf16_vv; break;
                 case 60: op = rv_op_vfwmacc_vv; break;
                 case 61: op = rv_op_vfwnmacc_vv; break;
                 case 62: op = rv_op_vfwmsac_vv; break;
@@ -3366,6 +3409,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wf; break;
                 case 54: op = rv_op_vfwsub_wf; break;
                 case 56: op = rv_op_vfwmul_vf; break;
+                case 59: op = rv_op_vfwmaccbf16_vf; break;
                 case 60: op = rv_op_vfwmacc_vf; break;
                 case 61: op = rv_op_vfwnmacc_vf; break;
                 case 62: op = rv_op_vfwmsac_vf; break;

From c5cc248b478bc21e50845ba6b2414c4a688e195f Mon Sep 17 00:00:00 2001
From: "yang.zhang" <yang.zhang@hexintek.com>
Date: Fri, 7 Jul 2023 11:23:06 +0800
Subject: [PATCH 0583/1353] target/riscv KVM_RISCV_SET_TIMER macro is not
 configured correctly

Should set/get riscv all reg timer,i.e, time/compare/frequency/state.

Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index 0f932a5b96..c3976a588d 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -99,7 +99,7 @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 
 #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
     do { \
-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
         if (ret) { \
             abort(); \
         } \

From 49554856f0b6f622ab6afdcc275d4ab2ecb3625c Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 5 Jul 2023 20:59:37 -0700
Subject: [PATCH 0584/1353] riscv: Generate devicetree only after machine
 initialization is complete
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the devicetree is created before machine initialization is complete,
it misses dynamic devices. Specifically, the tpm device is not added
to the devicetree file and is therefore not instantiated in Linux.
Load/create devicetree in virt_machine_done() to solve the problem.

Cc: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: Alistair Francis <alistair23@gmail.com>
Cc: Daniel Henrique Barboza <dbarboza@ventanamicro.c>
Fixes: 325b7c4e75 hw/riscv: Enable TPM backends
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706035937.1870483-1-linux@roeck-us.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index cdb88a1529..96b01703a9 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1249,6 +1249,17 @@ static void virt_machine_done(Notifier *notifier, void *data)
     uint64_t kernel_entry = 0;
     BlockBackend *pflash_blk0;
 
+    /* load/create device tree */
+    if (machine->dtb) {
+        machine->fdt = load_device_tree(machine->dtb, &s->fdt_size);
+        if (!machine->fdt) {
+            error_report("load_device_tree() failed");
+            exit(1);
+        }
+    } else {
+        create_fdt(s, memmap);
+    }
+
     /*
      * Only direct boot kernel is currently supported for KVM VM,
      * so the "-bios" parameter is not supported when KVM is enabled.
@@ -1509,17 +1520,6 @@ static void virt_machine_init(MachineState *machine)
     }
     virt_flash_map(s, system_memory);
 
-    /* load/create device tree */
-    if (machine->dtb) {
-        machine->fdt = load_device_tree(machine->dtb, &s->fdt_size);
-        if (!machine->fdt) {
-            error_report("load_device_tree() failed");
-            exit(1);
-        }
-    } else {
-        create_fdt(s, memmap);
-    }
-
     s->machine_done.notify = virt_machine_done;
     qemu_add_machine_init_done_notifier(&s->machine_done);
 }

From 1ad53688b9e15b179dbbfe44ee8b86d7e46715a8 Mon Sep 17 00:00:00 2001
From: Lakshmi Bai Raja Subramanian
 <lakshmi.bai.rajasubramanian@bodhicomputing.com>
Date: Tue, 20 Jun 2023 19:20:06 +0530
Subject: [PATCH 0585/1353] hw/riscv: virt: Convert fdt_load_addr to uint64_t

fdt_load_addr was previously declared as uint32_t which doe not match
with the return type of riscv_compute_fdt_addr().

This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
to match the riscv_compute_fdt_addr() return type.

This fixes calculating the fdt address when DRAM is mapped to higher
64-bit address.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
[ Change by AF:
 - Cleanup commit title and message
]
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 96b01703a9..2b380eff73 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1245,7 +1245,7 @@ static void virt_machine_done(Notifier *notifier, void *data)
     target_ulong start_addr = memmap[VIRT_DRAM].base;
     target_ulong firmware_end_addr, kernel_start_addr;
     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     uint64_t kernel_entry = 0;
     BlockBackend *pflash_blk0;
 

From eddabb6b888fa915ed679637983d8f39adfb725c Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:19 -0300
Subject: [PATCH 0586/1353] target/riscv: skip features setup for KVM CPUs

As it is today it's not possible to use '-cpu host' if the RISC-V host
has RVH enabled. This is the resulting error:

$ ./qemu/build/qemu-system-riscv64 \
    -machine virt,accel=kvm -m 2G -smp 1 \
    -nographic -snapshot -kernel ./guest_imgs/Image  \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
qemu-system-riscv64: H extension requires priv spec 1.12.0

This happens because we're checking for priv spec for all CPUs, and
since we're not setting  env->priv_ver for the 'host' CPU, it's being
default to zero (i.e. PRIV_SPEC_1_10_0).

In reality env->priv_ver does not make sense when running with the KVM
'host' CPU. It's used to gate certain CSRs/extensions during translation
to make them unavailable if the hart declares an older spec version. It
doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
are available [1].

'priv_ver' is just one example. We're doing a lot of feature validation
and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
Validating the feature set for those CPUs is a KVM problem that should
be handled in KVM specific code.

The new riscv_cpu_realize_tcg() helper contains all validation logic that
are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
running TCG and, if it's the case, proceed with the usual TCG realize()
logic.

[1] lib/sbi/sbi_hart.c, hart_detect_features()

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index fd647534cf..6232e6513b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -34,6 +34,7 @@
 #include "migration/vmstate.h"
 #include "fpu/softfloat-helpers.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "kvm_riscv.h"
 #include "tcg/tcg.h"
 
@@ -1386,20 +1387,12 @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
     }
 }
 
-static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
 {
-    CPUState *cs = CPU(dev);
     RISCVCPU *cpu = RISCV_CPU(dev);
     CPURISCVState *env = &cpu->env;
-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
     Error *local_err = NULL;
 
-    cpu_exec_realizefn(cs, &local_err);
-    if (local_err != NULL) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
@@ -1434,7 +1427,7 @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     }
 
 #ifndef CONFIG_USER_ONLY
-    cs->tcg_cflags |= CF_PCREL;
+    CPU(dev)->tcg_cflags |= CF_PCREL;
 
     if (cpu->cfg.ext_sstc) {
         riscv_timer_init(cpu);
@@ -1447,6 +1440,28 @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         }
      }
 #endif
+}
+
+static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+{
+    CPUState *cs = CPU(dev);
+    RISCVCPU *cpu = RISCV_CPU(dev);
+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+    Error *local_err = NULL;
+
+    cpu_exec_realizefn(cs, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (tcg_enabled()) {
+        riscv_cpu_realize_tcg(dev, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
 
     riscv_cpu_finalize_features(cpu, &local_err);
     if (local_err != NULL) {

From 43d1de32f8ef4502005e6b48e6602408fa711390 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:20 -0300
Subject: [PATCH 0587/1353] hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode
 not set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The absence of a satp mode in riscv_host_cpu_init() is causing the
following error:

$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
    -m 2G -smp 1  -nographic -snapshot \
    -kernel ./guest_imgs/Image \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
**
ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
reached
Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
not be reached
Aborted

The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.

For this KVM cpu we would need to inherit the satp supported modes
from the RISC-V host. At this moment this is not possible because the
KVM driver does not support it. And even when it does we can't just let
this broken for every other older kernel.

Since mmu-type is not a required node, according to [1], skip the
'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
logic when we can get satp information from KVM.

[1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 2b380eff73..d90286dc46 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -244,13 +244,13 @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
             s->soc[socket].hartid_base + cpu);
         qemu_fdt_add_subnode(ms->fdt, cpu_name);
 
-        satp_mode_max = satp_mode_max_from_map(
-            s->soc[socket].harts[cpu].cfg.satp_mode.map);
-        sv_name = g_strdup_printf("riscv,%s",
-                                  satp_mode_str(satp_mode_max, is_32_bit));
-        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
-        g_free(sv_name);
-
+        if (cpu_ptr->cfg.satp_mode.supported != 0) {
+            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
+            sv_name = g_strdup_printf("riscv,%s",
+                                      satp_mode_str(satp_mode_max, is_32_bit));
+            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+            g_free(sv_name);
+        }
 
         name = riscv_isa_string(cpu_ptr);
         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);

From 1e341500459e0900a07b0c3a86de4526ebe4496d Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:21 -0300
Subject: [PATCH 0588/1353] target/riscv/cpu.c: restrict 'mvendorid' value

We're going to change the handling of mvendorid/marchid/mimpid by the
KVM driver. Since these are always present in all CPUs let's put the
same validation for everyone.

It doesn't make sense to allow 'mvendorid' to be different than it
is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
any 'mvendorid' they want.

Change 'mvendorid' to be a class property created via
'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
macro. This allow us to define a custom setter for it that will verify,
for named CPUs, if mvendorid is different than it is already set by the
CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
set to an invalid value:

$ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
    Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 6232e6513b..a778241d9f 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1812,7 +1812,6 @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
@@ -1899,6 +1898,40 @@ static const struct TCGCPUOps riscv_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
+static bool riscv_cpu_is_dynamic(Object *cpu_obj)
+{
+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
+}
+
+static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint32_t prev_val = cpu->cfg.mvendorid;
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mvendorid = value;
+}
+
+static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mvendorid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -1930,6 +1963,9 @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops = &riscv_tcg_ops;
 
+    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
+                              cpu_set_mvendorid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 

From a1863ad368d32b53153bf417a83f01c85bb9d82c Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:22 -0300
Subject: [PATCH 0589/1353] target/riscv/cpu.c: restrict 'mimpid' value

Following the same logic used with 'mvendorid' let's also restrict
'mimpid' for named CPUs. Generic CPUs keep setting the value freely.

Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
reason is that this is not a good default since it's dynamic, changing
with with every QEMU version, regardless of whether the actual
implementation of the CPU changed from one QEMU version to the other.
Named CPU should set it to a meaningful value instead and generic CPUs
can set whatever they want.

This is the error thrown for an invalid 'mimpid' value for the veyron-v1
CPU:

$ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
    Unable to change veyron-v1-riscv-cpu mimpid (0x111)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index a778241d9f..477f8f8f97 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -43,7 +43,6 @@
 #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
                              (QEMU_VERSION_MINOR << 8)  | \
                              (QEMU_VERSION_MICRO))
-#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
 
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
@@ -1813,7 +1812,6 @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
@@ -1932,6 +1930,35 @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.mimpid;
+    uint64_t value;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mimpid = value;
+}
+
+static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mimpid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -1966,6 +1993,9 @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
                               cpu_set_mvendorid, NULL, NULL);
 
+    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
+                              cpu_set_mimpid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 

From d6a427e2c0b249bc8d3e0b4d7c5150f829d0907a Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:23 -0300
Subject: [PATCH 0590/1353] target/riscv/cpu.c: restrict 'marchid' value

'marchid' shouldn't be set to a different value as previously set for
named CPUs.

For all other CPUs it shouldn't be freely set either - the spec requires
that 'marchid' can't have the MSB (most significant bit) set and every
other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
32 bit CPUs.

As with 'mimpid', setting a default value based on the current QEMU
version is not a good idea because it implies that the CPU
implementation changes from one QEMU version to the other. Named CPUs
should set 'marchid' to a meaningful value instead, and generic CPUs can
set to any valid value.

For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
a different val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
    Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)

And, for generics CPUs, this is the error when trying to set to an
invalid val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
    Unable to set marchid with MSB (64) bit set and the remaining bits zero

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 477f8f8f97..9080d021fa 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -39,11 +39,6 @@
 #include "tcg/tcg.h"
 
 /* RISC-V CPU definitions */
-
-#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
-                             (QEMU_VERSION_MINOR << 8)  | \
-                             (QEMU_VERSION_MICRO))
-
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
@@ -1811,8 +1806,6 @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
 #endif
@@ -1959,6 +1952,56 @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.marchid;
+    uint64_t value, invalid_val;
+    uint32_t mxlen = 0;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    switch (riscv_cpu_mxl(&cpu->env)) {
+    case MXL_RV32:
+        mxlen = 32;
+        break;
+    case MXL_RV64:
+    case MXL_RV128:
+        mxlen = 64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    invalid_val = 1LL << (mxlen - 1);
+
+    if (value == invalid_val) {
+        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
+                         "and the remaining bits zero", mxlen);
+        return;
+    }
+
+    cpu->cfg.marchid = value;
+}
+
+static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.marchid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -1996,6 +2039,9 @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
                               cpu_set_mimpid, NULL, NULL);
 
+    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
+                              cpu_set_marchid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 

From 492265ae8be70537391c08390cb7c64580c902d9 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:24 -0300
Subject: [PATCH 0591/1353] target/riscv: use KVM scratch CPUs to init KVM
 properties

Certain validations, such as the validations done for the machine IDs
(mvendorid/marchid/mimpid), are done before starting the CPU.
Non-dynamic (named) CPUs tries to match user input with a preset
default. As it is today we can't prefetch a KVM default for these cases
because we're only able to read/write KVM regs after the vcpu is
spinning.

Our target/arm friends use a concept called "scratch CPU", which
consists of creating a vcpu for doing queries and validations and so on,
which is discarded shortly after use [1]. This is a suitable solution
for what we need so let's implement it in target/riscv as well.

kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
a KVM scratch CPU, fetch KVM regs that work as default values for user
properties, and then discard the scratch CPU afterwards.

We're starting by initializing 'mvendorid'. This concept will be used to
init other KVM specific properties in the next patches as well.

[1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c       |  6 +++
 target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
 target/riscv/kvm_riscv.h |  1 +
 3 files changed, 92 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 9080d021fa..0e1265bb17 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1792,6 +1792,12 @@ static void riscv_cpu_add_user_properties(Object *obj)
     Property *prop;
     DeviceState *dev = DEVICE(obj);
 
+#ifndef CONFIG_USER_ONLY
+    if (kvm_enabled()) {
+        kvm_riscv_init_user_properties(obj);
+    }
+#endif
+
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index c3976a588d..7402bfbfc5 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -309,6 +309,91 @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
+typedef struct KVMScratchCPU {
+    int kvmfd;
+    int vmfd;
+    int cpufd;
+} KVMScratchCPU;
+
+/*
+ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
+ * from target/arm/kvm.c.
+ */
+static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    int kvmfd = -1, vmfd = -1, cpufd = -1;
+
+    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+    if (kvmfd < 0) {
+        goto err;
+    }
+    do {
+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
+    } while (vmfd == -1 && errno == EINTR);
+    if (vmfd < 0) {
+        goto err;
+    }
+    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
+    if (cpufd < 0) {
+        goto err;
+    }
+
+    scratch->kvmfd =  kvmfd;
+    scratch->vmfd = vmfd;
+    scratch->cpufd = cpufd;
+
+    return true;
+
+ err:
+    if (cpufd >= 0) {
+        close(cpufd);
+    }
+    if (vmfd >= 0) {
+        close(vmfd);
+    }
+    if (kvmfd >= 0) {
+        close(kvmfd);
+    }
+
+    return false;
+}
+
+static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    close(scratch->cpufd);
+    close(scratch->vmfd);
+    close(scratch->kvmfd);
+}
+
+static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mvendorid from host, error %d", ret);
+    }
+}
+
+void kvm_riscv_init_user_properties(Object *cpu_obj)
+{
+    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+    KVMScratchCPU kvmcpu;
+
+    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
+        return;
+    }
+
+    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+
+    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+}
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index ed281bdce0..e3ba935808 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -19,6 +19,7 @@
 #ifndef QEMU_KVM_RISCV_H
 #define QEMU_KVM_RISCV_H
 
+void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
 

From d758f8849851dd4e97a575e52c11ec748ab1bbec Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:25 -0300
Subject: [PATCH 0592/1353] target/riscv: read marchid/mimpid in
 kvm_riscv_init_machine_ids()

Allow 'marchid' and 'mimpid' to also be initialized in
kvm_riscv_init_machine_ids().

After this change, the handling of mvendorid/marchid/mimpid for the
'host' CPU type will be equal to what we already have for TCG named
CPUs, i.e. the user is not able to set these values to a different val
than the one that is already preset.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index 7402bfbfc5..d8c1423b54 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -378,6 +378,22 @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(marchid));
+    reg.addr = (uint64_t)&cpu->cfg.marchid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve marchid from host, error %d", ret);
+    }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mimpid));
+    reg.addr = (uint64_t)&cpu->cfg.mimpid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mimpid from host, error %d", ret);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)

From 1fb5a622f7ef0cfd65b39decd768983e1d0ba1c2 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:26 -0300
Subject: [PATCH 0593/1353] target/riscv: handle mvendorid/marchid/mimpid for
 KVM CPUs

After changing user validation for mvendorid/marchid/mimpid to guarantee
that the value is validated on user input time, coupled with the work in
fetching KVM default values for them by using a scratch CPU, we're
certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
already good to be written back to KVM.

There's no need to write the values back for 'host' type CPUs since the
values can't be changed, so let's do that just for generic CPUs.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index d8c1423b54..f264286d51 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -495,6 +495,33 @@ void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
 
+static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id;
+    int ret;
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(marchid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mimpid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
+
+    return ret;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -513,6 +540,10 @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
     env->misa_ext = isa;
 
+    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+        ret = kvm_vcpu_set_machine_ids(cpu, cs);
+    }
+
     return ret;
 }
 

From e28b9c497428f9efccc7b7f5fc69e7c6524b41a0 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:28 -0300
Subject: [PATCH 0594/1353] target/riscv/kvm.c: init 'misa_ext_mask' with
 scratch CPU

At this moment we're retrieving env->misa_ext during
kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.

We want to set env->misa_ext_mask, and we want to set it as early as
possible. The reason is that we're going to use it in the validation
process of the KVM MISA properties we're going to add next. Setting it
during arch_init_cpu() is too late for user validation.

Move the code to a new helper that is going to be called during init()
time, via kvm_riscv_init_user_properties(), like we're already doing for
the machine ID properties. Set both misa_ext and misa_ext_mask to the
same value retrieved by the 'isa' config reg.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index f264286d51..0d19267010 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -396,6 +396,28 @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     }
 }
 
+static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
+                                         KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(isa));
+    reg.addr = (uint64_t)&env->misa_ext_mask;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+
+    if (ret) {
+        error_report("Unable to fetch ISA register from KVM, "
+                     "error %d", ret);
+        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+        exit(EXIT_FAILURE);
+    }
+
+    env->misa_ext = env->misa_ext_mask;
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -406,6 +428,7 @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     }
 
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
@@ -525,21 +548,10 @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
-    target_ulong isa;
     RISCVCPU *cpu = RISCV_CPU(cs);
-    CPURISCVState *env = &cpu->env;
-    uint64_t id;
 
     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(isa));
-    ret = kvm_get_one_reg(cs, id, &isa);
-    if (ret) {
-        return ret;
-    }
-    env->misa_ext = isa;
-
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
     }

From ed7e6182063ead28274751bd59f11f74a4cf3063 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:29 -0300
Subject: [PATCH 0595/1353] target/riscv/cpu: add misa_ext_info_arr[]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Next patch will add KVM specific user properties for both MISA and
multi-letter extensions. For MISA extensions we want to make use of what
is already available in misa_ext_cfgs[] to avoid code repetition.

misa_ext_info_arr[] array will hold name and description for each MISA
extension that misa_ext_cfgs[] is declaring. We'll then use this new
array in KVM code to avoid duplicating strings. Two getters were added
to allow KVM to retrieve the 'name' and 'description' for each MISA
property.

There's nothing holding us back from doing the same with multi-letter
extensions. For now doing just with MISA extensions is enough.

It is worth documenting that even using the __bultin_ctz() directive to
populate the misa_ext_info_arr[] we are forced to assign 'name' and
'description' during runtime in riscv_cpu_add_misa_properties(). The
reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
throw errors like this if we fetch 'name' and 'description' from the
array in the MISA_CFG() macro:

../target/riscv/cpu.c:1624:5: error: initializer element is not a
                              compile-time constant
    MISA_CFG(RVA, true),
    ^~~~~~~~~~~~~~~~~~~
../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
    {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~

gcc and others compilers/builders were fine with that change. We can't
ignore failures in the Gitlab pipeline though, so code was changed to
make every runner happy.

As a side effect, misa_ext_cfg[] is no longer a 'const' array because
it must be set during runtime.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
 target/riscv/cpu.h |   7 ++-
 2 files changed, 88 insertions(+), 29 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 0e1265bb17..35ba220c8f 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1636,33 +1636,83 @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
-static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-    {.name = "a", .description = "Atomic instructions",
-     .misa_bit = RVA, .enabled = true},
-    {.name = "c", .description = "Compressed instructions",
-     .misa_bit = RVC, .enabled = true},
-    {.name = "d", .description = "Double-precision float point",
-     .misa_bit = RVD, .enabled = true},
-    {.name = "f", .description = "Single-precision float point",
-     .misa_bit = RVF, .enabled = true},
-    {.name = "i", .description = "Base integer instruction set",
-     .misa_bit = RVI, .enabled = true},
-    {.name = "e", .description = "Base integer instruction set (embedded)",
-     .misa_bit = RVE, .enabled = false},
-    {.name = "m", .description = "Integer multiplication and division",
-     .misa_bit = RVM, .enabled = true},
-    {.name = "s", .description = "Supervisor-level instructions",
-     .misa_bit = RVS, .enabled = true},
-    {.name = "u", .description = "User-level instructions",
-     .misa_bit = RVU, .enabled = true},
-    {.name = "h", .description = "Hypervisor",
-     .misa_bit = RVH, .enabled = true},
-    {.name = "x-j", .description = "Dynamic translated languages",
-     .misa_bit = RVJ, .enabled = false},
-    {.name = "v", .description = "Vector operations",
-     .misa_bit = RVV, .enabled = false},
-    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
-     .misa_bit = RVG, .enabled = false},
+typedef struct misa_ext_info {
+    const char *name;
+    const char *description;
+} MISAExtInfo;
+
+#define MISA_INFO_IDX(_bit) \
+    __builtin_ctz(_bit)
+
+#define MISA_EXT_INFO(_bit, _propname, _descr) \
+    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
+
+static const MISAExtInfo misa_ext_info_arr[] = {
+    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
+    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
+    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
+    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
+    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
+    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
+    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
+    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
+    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
+    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
+    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
+    MISA_EXT_INFO(RVV, "v", "Vector operations"),
+    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
+};
+
+static int riscv_validate_misa_info_idx(uint32_t bit)
+{
+    int idx;
+
+    /*
+     * Our lowest valid input (RVA) is 1 and
+     * __builtin_ctz() is UB with zero.
+     */
+    g_assert(bit != 0);
+    idx = MISA_INFO_IDX(bit);
+
+    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
+    return idx;
+}
+
+const char *riscv_get_misa_ext_name(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].name;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+const char *riscv_get_misa_ext_description(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].description;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+#define MISA_CFG(_bit, _enabled) \
+    {.misa_bit = _bit, .enabled = _enabled}
+
+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+    MISA_CFG(RVA, true),
+    MISA_CFG(RVC, true),
+    MISA_CFG(RVD, true),
+    MISA_CFG(RVF, true),
+    MISA_CFG(RVI, true),
+    MISA_CFG(RVE, false),
+    MISA_CFG(RVM, true),
+    MISA_CFG(RVS, true),
+    MISA_CFG(RVU, true),
+    MISA_CFG(RVH, true),
+    MISA_CFG(RVJ, false),
+    MISA_CFG(RVV, false),
+    MISA_CFG(RVG, false),
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -1670,7 +1720,11 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
     int i;
 
     for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
-        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        int bit = misa_cfg->misa_bit;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
 
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 3081603464..6ea22e0eea 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -41,7 +41,10 @@
 
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
-/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
+/*
+ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
+ * when adding new MISA bits here.
+ */
 #define RVI RV('I')
 #define RVE RV('E') /* E and I are mutually exclusive */
 #define RVM RV('M')
@@ -56,6 +59,8 @@
 #define RVJ RV('J')
 #define RVG RV('G')
 
+const char *riscv_get_misa_ext_name(uint32_t bit);
+const char *riscv_get_misa_ext_description(uint32_t bit);
 
 /* Privileged specification version */
 enum {

From 92becce5e172357d9be047306d92b986242f0f0d Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:30 -0300
Subject: [PATCH 0596/1353] target/riscv: add KVM specific MISA properties

Using all TCG user properties in KVM is tricky. First because KVM
supports only a small subset of what TCG provides, so most of the
cpu->cfg flags do nothing for KVM.

Second, and more important, we don't have a way of telling if any given
value is an user input or not. For TCG this has a small impact since we
just validating everything and error out if needed. But for KVM it would
be good to know if a given value was set by the user or if it's a value
already provided by KVM. Otherwise we don't know how to handle failed
kvm_set_one_regs() when writing the configurations back.

These characteristics make it overly complicated to use the same user
facing flags for both KVM and TCG. A simpler approach is to create KVM
specific properties that have specialized logic, forking KVM and TCG use
cases for those cases only. Fully separating KVM/TCG properties is
unneeded at this point - in fact we want the user experience to be as
equal as possible, regardless of the acceleration chosen.

We'll start this fork with the MISA properties, adding the MISA bits
that the KVM driver currently supports. A new KVMCPUConfig type is
introduced. It'll hold general information about an extension. For MISA
extensions we're going to use the newly created getters of
misa_ext_infos[] to populate their name and description. 'offset' holds
the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
'misa_bit' because this same KVMCPUConfig struct will be used to
multi-letter extensions later on.

This new type also holds a 'user_set' flag. This flag will be set when
the user set an option that's different than what is already configured
in the host, requiring KVM intervention to write the regs back during
kvm_arch_init_vcpu(). Similar mechanics will be implemented for
multi-letter extensions as well.

There is no need to duplicate more code than necessary, so we're going
to use the existing kvm_riscv_init_user_properties() to add the KVM
specific properties. Any code that is adding a TCG user prop is then
changed slightly to verify first if there's a KVM prop with the same
name already added.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |  5 +++
 target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 35ba220c8f..5c8832a030 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1726,6 +1726,11 @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
         misa_cfg->name = riscv_get_misa_ext_name(bit);
         misa_cfg->description = riscv_get_misa_ext_description(bit);
 
+        /* Check if KVM already created the property */
+        if (object_property_find(cpu_obj, misa_cfg->name)) {
+            continue;
+        }
+
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
                             cpu_set_misa_ext_cfg,
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index 0d19267010..8cd08f4396 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -22,8 +22,10 @@
 #include <linux/kvm.h>
 
 #include "qemu/timer.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "qapi/visitor.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sysemu/kvm_int.h"
@@ -105,6 +107,81 @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
         } \
     } while (0)
 
+typedef struct KVMCPUConfig {
+    const char *name;
+    const char *description;
+    target_ulong offset;
+    int kvm_reg_id;
+    bool user_set;
+} KVMCPUConfig;
+
+#define KVM_MISA_CFG(_bit, _reg_id) \
+    {.offset = _bit, .kvm_reg_id = _reg_id}
+
+/* KVM ISA extensions */
+static KVMCPUConfig kvm_misa_ext_cfgs[] = {
+    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
+    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
+    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
+    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
+    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
+    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
+    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
+};
+
+static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
+                                     const char *name,
+                                     void *opaque, Error **errp)
+{
+    KVMCPUConfig *misa_ext_cfg = opaque;
+    target_ulong misa_bit = misa_ext_cfg->offset;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    CPURISCVState *env = &cpu->env;
+    bool value, host_bit;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_bit = env->misa_ext_mask & misa_bit;
+
+    if (value == host_bit) {
+        return;
+    }
+
+    if (!value) {
+        misa_ext_cfg->user_set = true;
+        return;
+    }
+
+    /*
+     * Forbid users to enable extensions that aren't
+     * available in the hart.
+     */
+    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
+               "enabled in the host", misa_ext_cfg->name);
+}
+
+static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        int bit = misa_cfg->offset;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
+
+        object_property_add(cpu_obj, misa_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_misa_ext_cfg,
+                            NULL, misa_cfg);
+        object_property_set_description(cpu_obj, misa_cfg->name,
+                                        misa_cfg->description);
+    }
+}
+
 static int kvm_riscv_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -427,6 +504,7 @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
         return;
     }
 
+    kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 

From 7313fffb40ea9775b38ff2ce73c4d6b0f43edc2f Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:31 -0300
Subject: [PATCH 0597/1353] target/riscv/kvm.c: update KVM MISA bits

Our design philosophy with KVM properties can be resumed in two main
decisions based on KVM interface availability and what the user wants to
do:

- if the user disables an extension that the host KVM module doesn't
know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
keep booting the CPU. This will avoid users having to deal with issues
with older KVM versions while disabling features they don't care;

- for any other case we're going to error out immediately. If the user
wants to enable a feature that KVM doesn't know about this a problem that
is worth aborting - the user must know that the feature wasn't enabled
in the hart. Likewise, if KVM knows about the extension, the user wants
to enable/disable it, and we fail to do it so, that's also a problem we
can't shrug it off.

In the case of MISA bits we won't even try enabling bits that aren't
already available in the host. The ioctl() is so likely to fail that
it's not worth trying. This check is already done in the previous patch,
in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.

In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
option and do as follows:

- if the user didn't set the property or set to the same value of the
host, do nothing;

- Disable the given extension in KVM. Error out if anything goes wrong.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index 8cd08f4396..f64019e87c 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -162,6 +162,41 @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
                "enabled in the host", misa_ext_cfg->name);
 }
 
+static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id, reg;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        target_ulong misa_bit = misa_cfg->offset;
+
+        if (!misa_cfg->user_set) {
+            continue;
+        }
+
+        /* If we're here we're going to disable the MISA bit */
+        reg = 0;
+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                              misa_cfg->kvm_reg_id);
+        ret = kvm_set_one_reg(cs, id, &reg);
+        if (ret != 0) {
+            /*
+             * We're not checking for -EINVAL because if the bit is about
+             * to be disabled, it means that it was already enabled by
+             * KVM. We determined that by fetching the 'isa' register
+             * during init() time. Any error at this point is worth
+             * aborting.
+             */
+            error_report("Unable to set KVM reg %s, error %d",
+                         misa_cfg->name, ret);
+            exit(EXIT_FAILURE);
+        }
+        env->misa_ext &= ~misa_bit;
+    }
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -632,8 +667,13 @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
+        if (ret != 0) {
+            return ret;
+        }
     }
 
+    kvm_riscv_update_cpu_misa_ext(cpu, cs);
+
     return ret;
 }
 

From f7a69fa6e6e21580b6e56dac87ad2ab0bf228065 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:32 -0300
Subject: [PATCH 0598/1353] target/riscv/kvm.c: add multi-letter extension KVM
 properties

Let's add KVM user properties for the multi-letter extensions that KVM
currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
svinval and svpbmt.

As with MISA extensions, we're using the KVMCPUConfig type to hold
information about the state of each extension. However, multi-letter
extensions have more cases to cover than MISA extensions, so we're
adding an extra 'supported' flag as well. This flag will reflect if a
given extension is supported by KVM, i.e. KVM knows how to handle it.
This is determined during KVM extension discovery in
kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
other error will cause an abort.

The use of the 'user_set' is similar to what we already do with MISA
extensions: the flag set only if the user is changing the extension
state.

The 'supported' flag will be used later on to make an exception for
users that are disabling multi-letter extensions that are unknown to
KVM.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |   8 +++
 target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 127 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 5c8832a030..31e591a938 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1860,6 +1860,14 @@ static void riscv_cpu_add_user_properties(Object *obj)
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+#ifndef CONFIG_USER_ONLY
+        if (kvm_enabled()) {
+            /* Check if KVM created the property already */
+            if (object_property_find(obj, prop->name)) {
+                continue;
+            }
+        }
+#endif
         qdev_property_add_static(dev, prop);
     }
 
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index f64019e87c..bd86d8748e 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -113,6 +113,7 @@ typedef struct KVMCPUConfig {
     target_ulong offset;
     int kvm_reg_id;
     bool user_set;
+    bool supported;
 } KVMCPUConfig;
 
 #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -197,6 +198,81 @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
     }
 }
 
+#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
+
+#define KVM_EXT_CFG(_name, _prop, _reg_id) \
+    {.name = _name, .offset = CPUCFG(_prop), \
+     .kvm_reg_id = _reg_id}
+
+static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
+    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
+    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
+    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
+    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
+    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
+    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
+    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+};
+
+static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
+                            uint32_t val)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    *ext_enabled = val;
+}
+
+static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
+                                KVMCPUConfig *multi_ext)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    return *ext_enabled;
+}
+
+static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *multi_ext_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    bool value, host_val;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
+
+    /*
+     * Ignore if the user is setting the same value
+     * as the host.
+     */
+    if (value == host_val) {
+        return;
+    }
+
+    if (!multi_ext_cfg->supported) {
+        /*
+         * Error out if the user is trying to enable an
+         * extension that KVM doesn't support. Ignore
+         * option otherwise.
+         */
+        if (value) {
+            error_setg(errp, "KVM does not support disabling extension %s",
+                       multi_ext_cfg->name);
+        }
+
+        return;
+    }
+
+    multi_ext_cfg->user_set = true;
+    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -215,6 +291,15 @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
         object_property_set_description(cpu_obj, misa_cfg->name,
                                         misa_cfg->description);
     }
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
+
+        object_property_add(cpu_obj, multi_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_multi_ext_cfg,
+                            NULL, multi_cfg);
+    }
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -530,6 +615,39 @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t val;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
+        struct kvm_one_reg reg;
+
+        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                                  multi_ext_cfg->kvm_reg_id);
+        reg.addr = (uint64_t)&val;
+        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+        if (ret != 0) {
+            if (errno == EINVAL) {
+                /* Silently default to 'false' if KVM does not support it. */
+                multi_ext_cfg->supported = false;
+                val = false;
+            } else {
+                error_report("Unable to read ISA_EXT KVM register %s, "
+                             "error %d", multi_ext_cfg->name, ret);
+                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+                exit(EXIT_FAILURE);
+            }
+        } else {
+            multi_ext_cfg->supported = true;
+        }
+
+        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
+    }
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -542,6 +660,7 @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }

From b71f9dcada2edacfa9baaf872de717c903fb333b Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:33 -0300
Subject: [PATCH 0599/1353] target/riscv/cpu.c: add satp_mode properties
 earlier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
CONFIG_USER_ONLY" blocks after changes that added KVM properties
handling.

KVM specific properties are required to be created earlier than their
TCG counterparts, but the remaining props can be created at any order.
Move riscv_add_satp_mode_properties() to the start of the function,
inside the !CONFIG_USER_ONLY block already present there, to remove the
last ifndef block.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 31e591a938..deb3c0f035 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1852,6 +1852,8 @@ static void riscv_cpu_add_user_properties(Object *obj)
     DeviceState *dev = DEVICE(obj);
 
 #ifndef CONFIG_USER_ONLY
+    riscv_add_satp_mode_properties(obj);
+
     if (kvm_enabled()) {
         kvm_riscv_init_user_properties(obj);
     }
@@ -1870,10 +1872,6 @@ static void riscv_cpu_add_user_properties(Object *obj)
 #endif
         qdev_property_add_static(dev, prop);
     }
-
-#ifndef CONFIG_USER_ONLY
-    riscv_add_satp_mode_properties(obj);
-#endif
 }
 
 static Property riscv_cpu_properties[] = {

From 63c7eedc28f25141a44e34534c6b5317caaf38cc Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:34 -0300
Subject: [PATCH 0600/1353] target/riscv/cpu.c: remove priv_ver check from
 riscv_isa_string_ext()

riscv_isa_string_ext() is being used by riscv_isa_string(), which is
then used by boards to retrieve the 'riscv,isa' string to be written in
the FDT. All this happens after riscv_cpu_realize(), meaning that we're
already past riscv_cpu_validate_set_extensions() and, more important,
riscv_cpu_disable_priv_spec_isa_exts().

This means that all extensions that needed to be disabled due to
priv_spec mismatch are already disabled. Checking this again during
riscv_isa_string_ext() is unneeded. Remove it.

As a bonus, riscv_isa_string_ext() can now be used with the 'host'
KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
would fail this check for no good reason.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index deb3c0f035..2acf77949f 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -2124,8 +2124,7 @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
     int i;
 
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
-            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
             g_free(old);
             old = new;

From 56f0e992ca01391f81a42b29883288fa1e4380c1 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:35 -0300
Subject: [PATCH 0601/1353] target/riscv/cpu.c: create KVM mock properties

KVM-specific properties are being created inside target/riscv/kvm.c. But
at this moment we're gathering all the remaining properties from TCG and
adding them as is when running KVM. This creates a situation where
non-KVM properties are setting flags to 'true' due to its default
settings (e.g.  Zawrs). Users can also freely enable them via command
line.

This doesn't impact runtime per se because KVM doesn't care about these
flags, but code such as riscv_isa_string_ext() take those flags into
account. The result is that, for a KVM guest, setting non-KVM properties
will make them appear in the riscv,isa DT.

We want to keep the same API for both TCG and KVM and at the same time,
when running KVM, forbid non-KVM extensions to be enabled internally. We
accomplish both by changing riscv_cpu_add_user_properties() to add a
mock boolean property for every non-KVM extension in
riscv_cpu_extensions[]. Then, when running KVM, users are still free to
set extensions at will, but we'll error out if a non-KVM extension is
enabled. Setting such extension to 'false' will be ignored.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 2acf77949f..b2883ca533 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1840,6 +1840,26 @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+
+#ifndef CONFIG_USER_ONLY
+static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+                                    const char *name,
+                                    void *opaque, Error **errp)
+{
+    const char *propname = opaque;
+    bool value;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    if (value) {
+        error_setg(errp, "extension %s is not available with KVM",
+                   propname);
+    }
+}
+#endif
+
 /*
  * Add CPU properties with user-facing flags.
  *
@@ -1868,6 +1888,22 @@ static void riscv_cpu_add_user_properties(Object *obj)
             if (object_property_find(obj, prop->name)) {
                 continue;
             }
+
+            /*
+             * Set the default to disabled for every extension
+             * unknown to KVM and error out if the user attempts
+             * to enable any of them.
+             *
+             * We're giving a pass for non-bool properties since they're
+             * not related to the availability of extensions and can be
+             * safely ignored as is.
+             */
+            if (prop->info == &qdev_prop_bool) {
+                object_property_add(obj, prop->name, "bool",
+                                    NULL, cpu_set_cfg_unavailable,
+                                    NULL, (void *)prop->name);
+                continue;
+            }
         }
 #endif
         qdev_property_add_static(dev, prop);

From df817297d7a5397a3383207b0e0174b464cf42ab Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:36 -0300
Subject: [PATCH 0602/1353] target/riscv: update multi-letter extension KVM
 properties

We're now ready to update the multi-letter extensions status for KVM.

kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
time to verify which user options changes host defaults (via the 'user_set'
flag) and tries to write them back to KVM.

Failure to commit a change to KVM is only ignored in case KVM doesn't
know about the extension (-EINVAL error code) and the user wanted to
disable the given extension. Otherwise we're going to abort the boot
process.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index bd86d8748e..4d7476cf15 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -273,6 +273,32 @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 }
 
+static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id, reg;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
+
+        if (!multi_ext_cfg->user_set) {
+            continue;
+        }
+
+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                              multi_ext_cfg->kvm_reg_id);
+        reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
+        ret = kvm_set_one_reg(cs, id, &reg);
+        if (ret != 0) {
+            error_report("Unable to %s extension %s in KVM, error %d",
+                         reg ? "enable" : "disable",
+                         multi_ext_cfg->name, ret);
+            exit(EXIT_FAILURE);
+        }
+    }
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -792,6 +818,7 @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
 
     kvm_riscv_update_cpu_misa_ext(cpu, cs);
+    kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
 
     return ret;
 }

From a1be1d9a77a8170822258663e5fb0580f5252536 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:37 -0300
Subject: [PATCH 0603/1353] target/riscv/kvm.c: add kvmconfig_get_cfg_addr()
 helper

There are 2 places in which we need to get a pointer to a certain
property of the cpu->cfg struct based on property offset. Next patch
will add a couple more.

Create a helper to avoid repeating this code over and over.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index 4d7476cf15..fd22ef4162 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -215,11 +215,15 @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 };
 
+static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
+{
+    return (void *)&cpu->cfg + kvmcfg->offset;
+}
+
 static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
                             uint32_t val)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     *ext_enabled = val;
 }
@@ -227,8 +231,7 @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
                                 KVMCPUConfig *multi_ext)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     return *ext_enabled;
 }

From b9f822215ee58b57863bc082c322bb88529bd958 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 6 Jul 2023 07:17:38 -0300
Subject: [PATCH 0604/1353] target/riscv/kvm.c: read/write
 (cbom|cboz)_blocksize in KVM

If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
Linux Kernel will fail to detect the availability of the CBOM/CBOZ
extensions, regardless of the contents of the 'riscv,isa' DT prop.

The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
so let's expose them as user properties like it is already done with
TCG.

This will also require us to determine proper blocksize values during
init() time since the FDT is already created during realize(). We'll
take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
don't need to fetch both cbom and cboz blocksizes every time: check for
their parent extensions (icbom and icboz) and only read the blocksizes
if needed.

In contrast with cbom|z_blocksize properties from TCG, the user is not
able to set any value that is different from the 'host' value when
running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
can be thrown for the mere attempt of executing kvm_set_one_reg() for
these 2 regs.

Hopefully we don't need to call kvm_set_one_reg() for these regs.
We'll check if the user input matches the host value in
kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
properties. We'll fail fast since it's already known to not be
supported.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index fd22ef4162..9d8a8982f9 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -276,6 +276,42 @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 }
 
+static KVMCPUConfig kvm_cbom_blocksize = {
+    .name = "cbom_blocksize",
+    .offset = CPUCFG(cbom_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
+};
+
+static KVMCPUConfig kvm_cboz_blocksize = {
+    .name = "cboz_blocksize",
+    .offset = CPUCFG(cboz_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
+};
+
+static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *cbomz_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint16_t value, *host_val;
+
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+
+    if (value != *host_val) {
+        error_report("Unable to set %s to a different value than "
+                     "the host (%u)",
+                     cbomz_cfg->name, *host_val);
+        exit(EXIT_FAILURE);
+    }
+
+    cbomz_cfg->user_set = true;
+}
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -329,6 +365,14 @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
                             kvm_cpu_set_multi_ext_cfg,
                             NULL, multi_cfg);
     }
+
+    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cbom_blocksize);
+
+    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cboz_blocksize);
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -644,6 +688,24 @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
+                                         KVMCPUConfig *cbomz_cfg)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              cbomz_cfg->kvm_reg_id);
+    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to read KVM reg %s, error %d",
+                     cbomz_cfg->name, ret);
+        exit(EXIT_FAILURE);
+    }
+}
+
 static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
     CPURISCVState *env = &cpu->env;
@@ -675,6 +737,14 @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
         kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
     }
+
+    if (cpu->cfg.ext_icbom) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
+    }
+
+    if (cpu->cfg.ext_icboz) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)

From a47842d16653b4f73b5d56ff0c252dd8a329481b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Mon, 10 Jul 2023 09:12:43 +0200
Subject: [PATCH 0605/1353] riscv: Add support for the Zfa extension
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch introduces the RISC-V Zfa extension, which introduces
additional floating-point instructions:
* fli (load-immediate) with pre-defined immediates
* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
* fround/froundmx (round to integer)
* fcvtmod.w.d (Modular Convert-to-Integer)
* fmv* to access high bits of float register bigger than XLEN
* Quiet comparison instructions (fleq/fltq)

Zfa defines its instructions in combination with the following extensions:
* single-precision floating-point (F)
* double-precision floating-point (D)
* quad-precision floating-point (Q)
* half-precision floating-point (Zfh)

Since QEMU does not support the RISC-V quad-precision floating-point
ISA extension (Q), this patch does not include the instructions that
depend on this extension. All other instructions are included in this
patch.

The Zfa specification can be found here:
  https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
The Zfa specifciation is frozen and is in public review since May 3, 2023:
  https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg

The patch also includes a TCG test for the fcvtmod.w.d instruction.
The test cases test for correct results and flag behaviour.
Note, that the Zfa specification requires fcvtmod's flag behaviour
to be identical to a fcvt with the same operands (which is also
tested).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c                             | 139 ++++++
 disas/riscv.h                             |   3 +
 target/riscv/cpu.c                        |   8 +
 target/riscv/cpu_cfg.h                    |   1 +
 target/riscv/fpu_helper.c                 | 154 +++++++
 target/riscv/helper.h                     |  19 +
 target/riscv/insn32.decode                |  26 ++
 target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
 target/riscv/translate.c                  |   1 +
 tests/tcg/riscv64/Makefile.target         |   6 +
 tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
 11 files changed, 1223 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c

diff --git a/disas/riscv.c b/disas/riscv.c
index 9f0195be30..cd7b6e86a7 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -829,6 +829,39 @@ typedef enum {
     rv_op_fsh = 798,
     rv_op_fmv_h_x = 799,
     rv_op_fmv_x_h = 800,
+    rv_op_fli_s = 801,
+    rv_op_fli_d = 802,
+    rv_op_fli_q = 803,
+    rv_op_fli_h = 804,
+    rv_op_fminm_s = 805,
+    rv_op_fmaxm_s = 806,
+    rv_op_fminm_d = 807,
+    rv_op_fmaxm_d = 808,
+    rv_op_fminm_q = 809,
+    rv_op_fmaxm_q = 810,
+    rv_op_fminm_h = 811,
+    rv_op_fmaxm_h = 812,
+    rv_op_fround_s = 813,
+    rv_op_froundnx_s = 814,
+    rv_op_fround_d = 815,
+    rv_op_froundnx_d = 816,
+    rv_op_fround_q = 817,
+    rv_op_froundnx_q = 818,
+    rv_op_fround_h = 819,
+    rv_op_froundnx_h = 820,
+    rv_op_fcvtmod_w_d = 821,
+    rv_op_fmvh_x_d = 822,
+    rv_op_fmvp_d_x = 823,
+    rv_op_fmvh_x_q = 824,
+    rv_op_fmvp_q_x = 825,
+    rv_op_fleq_s = 826,
+    rv_op_fltq_s = 827,
+    rv_op_fleq_d = 828,
+    rv_op_fltq_d = 829,
+    rv_op_fleq_q = 830,
+    rv_op_fltq_q = 831,
+    rv_op_fleq_h = 832,
+    rv_op_fltq_h = 833,
 } rv_op;
 
 /* register names */
@@ -854,6 +887,23 @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
+/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
+ * The constants use the hex floating-point literal representation
+ * that is printed when using the printf %a format specifier,
+ * which matches the output that is generated by the disassembler.
+ */
+static const char rv_fli_name_const[32][9] =
+{
+    "0x1p+0", "min", "0x1p-16", "0x1p-15",
+    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
+    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
+    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
+    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
+    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
+    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
+    "0x1p+15", "0x1p+16", "inf", "nan"
+};
+
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -1925,6 +1975,39 @@ const rv_opcode_data rvi_opcode_data[] = {
     { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
     { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
     { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -2864,24 +2947,38 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_s; break;
                 case 1: op = rv_op_fmax_s; break;
+                case 2: op = rv_op_fminm_s; break;
+                case 3: op = rv_op_fmaxm_s; break;
                 }
                 break;
             case 21:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_d; break;
                 case 1: op = rv_op_fmax_d; break;
+                case 2: op = rv_op_fminm_d; break;
+                case 3: op = rv_op_fmaxm_d; break;
+                }
+                break;
+            case 22:
+                switch (((inst >> 12) & 0b111)) {
+                case 2: op = rv_op_fminm_h; break;
+                case 3: op = rv_op_fmaxm_h; break;
                 }
                 break;
             case 23:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_q; break;
                 case 1: op = rv_op_fmax_q; break;
+                case 2: op = rv_op_fminm_q; break;
+                case 3: op = rv_op_fmaxm_q; break;
                 }
                 break;
             case 32:
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 4: op = rv_op_fround_s; break;
+                case 5: op = rv_op_froundnx_s; break;
                 case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
@@ -2889,10 +2986,14 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_d_s; break;
                 case 3: op = rv_op_fcvt_d_q; break;
+                case 4: op = rv_op_fround_d; break;
+                case 5: op = rv_op_froundnx_d; break;
                 }
                 break;
             case 34:
                 switch (((inst >> 20) & 0b11111)) {
+                case 4: op = rv_op_fround_h; break;
+                case 5: op = rv_op_froundnx_h; break;
                 case 8: op = rv_op_fcvt_bf16_s; break;
                 }
                 break;
@@ -2900,6 +3001,8 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
                 case 1: op = rv_op_fcvt_q_d; break;
+                case 4: op = rv_op_fround_q; break;
+                case 5: op = rv_op_froundnx_q; break;
                 }
                 break;
             case 44:
@@ -2922,6 +3025,8 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_s; break;
                 case 1: op = rv_op_flt_s; break;
                 case 2: op = rv_op_feq_s; break;
+                case 4: op = rv_op_fleq_s; break;
+                case 5: op = rv_op_fltq_s; break;
                 }
                 break;
             case 81:
@@ -2929,6 +3034,14 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_d; break;
                 case 1: op = rv_op_flt_d; break;
                 case 2: op = rv_op_feq_d; break;
+                case 4: op = rv_op_fleq_d; break;
+                case 5: op = rv_op_fltq_d; break;
+                }
+                break;
+            case 82:
+                switch (((inst >> 12) & 0b111)) {
+                case 4: op = rv_op_fleq_h; break;
+                case 5: op = rv_op_fltq_h; break;
                 }
                 break;
             case 83:
@@ -2936,6 +3049,18 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_q; break;
                 case 1: op = rv_op_flt_q; break;
                 case 2: op = rv_op_feq_q; break;
+                case 4: op = rv_op_fleq_q; break;
+                case 5: op = rv_op_fltq_q; break;
+                }
+                break;
+            case 89:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_d_x; break;
+                }
+                break;
+            case 91:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_q_x; break;
                 }
                 break;
             case 96:
@@ -2952,6 +3077,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fcvt_wu_d; break;
                 case 2: op = rv_op_fcvt_l_d; break;
                 case 3: op = rv_op_fcvt_lu_d; break;
+                case 8: op = rv_op_fcvtmod_w_d; break;
                 }
                 break;
             case 99:
@@ -2998,6 +3124,7 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_d; break;
                 case 1: op = rv_op_fclass_d; break;
+                case 8: op = rv_op_fmvh_x_d; break;
                 }
                 break;
             case 114:
@@ -3011,30 +3138,35 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_q; break;
                 case 1: op = rv_op_fclass_q; break;
+                case 8: op = rv_op_fmvh_x_q; break;
                 }
                 break;
             case 120:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_s_x; break;
+                case 8: op = rv_op_fli_s; break;
                 }
                 break;
             case 121:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_d_x; break;
+                case 8: op = rv_op_fli_d; break;
                 }
                 break;
             case 122:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_h_x; break;
+                case 8: op = rv_op_fli_h; break;
                 }
                 break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_q_x; break;
+                case 8: op = rv_op_fli_q; break;
                 }
                 break;
             }
@@ -4298,6 +4430,10 @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
         break;
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
+	break;
+    case rv_codec_fli:
+        dec->rd = operand_rd(inst);
+        dec->imm = operand_rs1(inst);
         break;
     case rv_codec_r2_imm5:
         dec->rd = operand_rd(inst);
@@ -4708,6 +4844,9 @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             append(buf, tmp, buflen);
             break;
         }
+        case 'h':
+            append(buf, rv_fli_name_const[dec->imm], buflen);
+            break;
         default:
             break;
         }
diff --git a/disas/riscv.h b/disas/riscv.h
index 052a0c4281..9cf901fc1e 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -165,6 +165,7 @@ typedef enum {
     rv_codec_r_imm2,
     rv_codec_r2_immhl,
     rv_codec_r2_imm2_imm5,
+    rv_codec_fli,
 } rv_codec;
 
 /* structures */
@@ -229,6 +230,7 @@ enum {
 #define rv_fmt_rd_offset              "O\t0,o"
 #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 #define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
 #define rv_fmt_frd_frs1               "O\t3,4"
 #define rv_fmt_rd_frs1                "O\t0,4"
 #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
@@ -295,5 +297,6 @@ enum {
 #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
 #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
 #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
+#define rv_fmt_fli                    "O\t3,h"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index b2883ca533..9339c0241d 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -89,6 +89,7 @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
@@ -429,6 +430,7 @@ static void rv64_thead_c906_cpu_init(Object *obj)
     set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
     env->priv_ver = PRIV_VERSION_1_11_0;
 
+    cpu->cfg.ext_zfa = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
     cpu->cfg.ext_xtheadba = true;
@@ -1107,6 +1109,11 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
+        error_setg(errp, "Zfa extension requires F extension");
+        return;
+    }
+
     if (cpu->cfg.ext_zfh) {
         cpu->cfg.ext_zfhmin = true;
     }
@@ -1750,6 +1757,7 @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index e9ee39d7de..2bd9510ba3 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -75,6 +75,7 @@ struct RISCVCPUConfig {
     bool ext_svpbmt;
     bool ext_zdinx;
     bool ext_zawrs;
+    bool ext_zfa;
     bool ext_zfbfmin;
     bool ext_zfh;
     bool ext_zfhmin;
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index eb5ee5c4c9..871a70a316 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -252,6 +252,14 @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_min(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -261,6 +269,14 @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_max(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -274,6 +290,13 @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -281,6 +304,13 @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -338,6 +368,30 @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
     return fclass_s(frs1);
 }
 
+uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float32 frs1 = check_nanbox_s(env, rs1);
+
+    frs1 = float32_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_s(env, frs1);
+}
+
+uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float32_round_to_int(frs1, &env->fp_status);
+    return nanbox_s(env, frs1);
+}
+
 uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_add(frs1, frs2, &env->fp_status);
@@ -365,6 +419,11 @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_minimum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_min(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -372,6 +431,11 @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_maximum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_max(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
 {
     return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -393,11 +457,21 @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
     return float64_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -408,6 +482,11 @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
     return float64_to_int32(frs1, &env->fp_status);
 }
 
+uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
+{
+    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
+}
+
 target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
 {
     return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -448,6 +527,27 @@ target_ulong helper_fclass_d(uint64_t frs1)
     return fclass_d(frs1);
 }
 
+uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+
+    frs1 = float64_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return frs1;
+}
+
+uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
+{
+    return float64_round_to_int(frs1, &env->fp_status);
+}
+
 uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -485,6 +585,14 @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_min(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -494,6 +602,14 @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_max(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -507,6 +623,13 @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -514,6 +637,13 @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -527,6 +657,30 @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
     return fclass_h(frs1);
 }
 
+uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float16 frs1 = check_nanbox_h(env, rs1);
+
+    frs1 = float16_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_h(env, frs1);
+}
+
+uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float16_round_to_int(frs1, &env->fp_status);
+    return nanbox_h(env, frs1);
+}
+
 target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 3170b8daa6..c95adaf08a 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -25,10 +25,14 @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
@@ -39,6 +43,8 @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Floating Point - Double Precision */
 DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -46,14 +52,19 @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
+DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -62,6 +73,8 @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
+DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Bitmanip */
 DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -78,10 +91,14 @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -96,6 +113,8 @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Cache-block operations */
 DEF_HELPER_2(cbo_clean_flush, void, env, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index 8c5d293f07..e341fa9213 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -821,6 +821,32 @@ binvi      01101. ........... 001 ..... 0010011 @sh
 bset       0010100 .......... 001 ..... 0110011 @r
 bseti      00101. ........... 001 ..... 0010011 @sh
 
+# *** Zfa Standard Extension ***
+fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
+fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
+fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
+fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
+fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
+fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
+fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
+fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
+fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
+fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
+fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
+fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
+fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
+fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
+fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
+fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
+fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
+fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
+fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
+fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
+fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
+
 # *** RV32 Zfh Extension ***
 flh        ............   ..... 001 ..... 0000111 @i
 fsh        .......  ..... ..... 001 ..... 0100111 @s
diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
new file mode 100644
index 0000000000..2c715af3e5
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -0,0 +1,521 @@
+/*
+ * RISC-V translation routines for the Zfa Standard Extension.
+ *
+ * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFA(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfa) { \
+        return false;             \
+    }                             \
+} while (0)
+
+#define REQUIRE_ZFH(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfh) { \
+        return false;             \
+    }                             \
+} while (0)
+
+static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
+    static const uint64_t fli_s_table[] = {
+        0xffffffffbf800000,  /* -1.0 */
+        0xffffffff00800000,  /* minimum positive normal */
+        0xffffffff37800000,  /* 1.0 * 2^-16 */
+        0xffffffff38000000,  /* 1.0 * 2^-15 */
+        0xffffffff3b800000,  /* 1.0 * 2^-8  */
+        0xffffffff3c000000,  /* 1.0 * 2^-7  */
+        0xffffffff3d800000,  /* 1.0 * 2^-4  */
+        0xffffffff3e000000,  /* 1.0 * 2^-3  */
+        0xffffffff3e800000,  /* 0.25 */
+        0xffffffff3ea00000,  /* 0.3125 */
+        0xffffffff3ec00000,  /* 0.375 */
+        0xffffffff3ee00000,  /* 0.4375 */
+        0xffffffff3f000000,  /* 0.5 */
+        0xffffffff3f200000,  /* 0.625 */
+        0xffffffff3f400000,  /* 0.75 */
+        0xffffffff3f600000,  /* 0.875 */
+        0xffffffff3f800000,  /* 1.0 */
+        0xffffffff3fa00000,  /* 1.25 */
+        0xffffffff3fc00000,  /* 1.5 */
+        0xffffffff3fe00000,  /* 1.75 */
+        0xffffffff40000000,  /* 2.0 */
+        0xffffffff40200000,  /* 2.5 */
+        0xffffffff40400000,  /* 3 */
+        0xffffffff40800000,  /* 4 */
+        0xffffffff41000000,  /* 8 */
+        0xffffffff41800000,  /* 16 */
+        0xffffffff43000000,  /* 2^7 */
+        0xffffffff43800000,  /* 2^8 */
+        0xffffffff47000000,  /* 2^15 */
+        0xffffffff47800000,  /* 2^16 */
+        0xffffffff7f800000,  /* +inf */
+        0xffffffff7fc00000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    static const uint64_t fli_d_table[] = {
+        0xbff0000000000000,  /* -1.0 */
+        0x0010000000000000,  /* minimum positive normal */
+        0x3ef0000000000000,  /* 1.0 * 2^-16 */
+        0x3f00000000000000,  /* 1.0 * 2^-15 */
+        0x3f70000000000000,  /* 1.0 * 2^-8  */
+        0x3f80000000000000,  /* 1.0 * 2^-7  */
+        0x3fb0000000000000,  /* 1.0 * 2^-4  */
+        0x3fc0000000000000,  /* 1.0 * 2^-3  */
+        0x3fd0000000000000,  /* 0.25 */
+        0x3fd4000000000000,  /* 0.3125 */
+        0x3fd8000000000000,  /* 0.375 */
+        0x3fdc000000000000,  /* 0.4375 */
+        0x3fe0000000000000,  /* 0.5 */
+        0x3fe4000000000000,  /* 0.625 */
+        0x3fe8000000000000,  /* 0.75 */
+        0x3fec000000000000,  /* 0.875 */
+        0x3ff0000000000000,  /* 1.0 */
+        0x3ff4000000000000,  /* 1.25 */
+        0x3ff8000000000000,  /* 1.5 */
+        0x3ffc000000000000,  /* 1.75 */
+        0x4000000000000000,  /* 2.0 */
+        0x4004000000000000,  /* 2.5 */
+        0x4008000000000000,  /* 3 */
+        0x4010000000000000,  /* 4 */
+        0x4020000000000000,  /* 8 */
+        0x4030000000000000,  /* 16 */
+        0x4060000000000000,  /* 2^7 */
+        0x4070000000000000,  /* 2^8 */
+        0x40e0000000000000,  /* 2^15 */
+        0x40f0000000000000,  /* 2^16 */
+        0x7ff0000000000000,  /* +inf */
+        0x7ff8000000000000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
+    static const uint64_t fli_h_table[] = {
+        0xffffffffffffbc00,  /* -1.0 */
+        0xffffffffffff0400,  /* minimum positive normal */
+        0xffffffffffff0100,  /* 1.0 * 2^-16 */
+        0xffffffffffff0200,  /* 1.0 * 2^-15 */
+        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
+        0xffffffffffff2000,  /* 1.0 * 2^-7  */
+        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
+        0xffffffffffff3000,  /* 1.0 * 2^-3  */
+        0xffffffffffff3400,  /* 0.25 */
+        0xffffffffffff3500,  /* 0.3125 */
+        0xffffffffffff3600,  /* 0.375 */
+        0xffffffffffff3700,  /* 0.4375 */
+        0xffffffffffff3800,  /* 0.5 */
+        0xffffffffffff3900,  /* 0.625 */
+        0xffffffffffff3a00,  /* 0.75 */
+        0xffffffffffff3b00,  /* 0.875 */
+        0xffffffffffff3c00,  /* 1.0 */
+        0xffffffffffff3d00,  /* 1.25 */
+        0xffffffffffff3e00,  /* 1.5 */
+        0xffffffffffff3f00,  /* 1.75 */
+        0xffffffffffff4000,  /* 2.0 */
+        0xffffffffffff4100,  /* 2.5 */
+        0xffffffffffff4200,  /* 3 */
+        0xffffffffffff4400,  /* 4 */
+        0xffffffffffff4800,  /* 8 */
+        0xffffffffffff4c00,  /* 16 */
+        0xffffffffffff5800,  /* 2^7 */
+        0xffffffffffff5c00,  /* 2^8 */
+        0xffffffffffff7800,  /* 2^15 */
+        0xffffffffffff7c00,  /* 2^16 */
+        0xffffffffffff7c00,  /* +inf */
+        0xffffffffffff7e00,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fminm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+
+    /* Rounding mode is RTZ. */
+    gen_set_rm(ctx, RISCV_FRM_RTZ);
+    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+
+    return true;
+}
+
+bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+    return true;
+}
+
+bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 621dd99241..697df1be9e 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1091,6 +1091,7 @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvzicond.c.inc"
 #include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzicbo.c.inc"
+#include "insn_trans/trans_rvzfa.c.inc"
 #include "insn_trans/trans_rvzfh.c.inc"
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index 42993549cb..a7e390c384 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -12,3 +12,9 @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
 
 TESTS += test-aes
 run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
+
+# Test for fcvtmod
+TESTS += test-fcvtmod
+test-fcvtmod: CFLAGS += -march=rv64imafdc
+test-fcvtmod: LDFLAGS += -static
+run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
new file mode 100644
index 0000000000..f050579974
--- /dev/null
+++ b/tests/tcg/riscv64/test-fcvtmod.c
@@ -0,0 +1,345 @@
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define FFLAG_NX_SHIFT 0 /* inexact */
+#define FFLAG_UF_SHIFT 1 /* underflow */
+#define FFLAG_OF_SHIFT 2 /* overflow */
+#define FFLAG_DZ_SHIFT 3 /* divide by zero */
+#define FFLAG_NV_SHIFT 4 /* invalid operation */
+
+#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
+#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
+#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
+#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
+#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
+
+typedef struct fp64_fcvt_fcvtmod_testcase {
+    const char* name;
+    union {
+        uint64_t inp_lu;
+        double inp_lf;
+    };
+    uint64_t exp_fcvt;
+    uint8_t exp_fcvt_fflags;
+    uint64_t exp_fcvtmod;
+    uint8_t exp_fcvtmod_fflags;
+} fp64_fcvt_fcvtmod_testcase_t;
+
+void print_fflags(uint8_t fflags)
+{
+    int set = 0;
+
+    if (fflags == 0) {
+        printf("-");
+        return;
+    }
+
+    if (fflags & FFLAG_NV) {
+        printf("%sFFLAG_NV", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_DZ) {
+        printf("%sFFLAG_DZ", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_OF) {
+        printf("%sFFLAG_OF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_UF) {
+        printf("%sFFLAG_UF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_NX) {
+        printf("%sFFLAG_NX", set ? " | " : "");
+        set = 1;
+    }
+}
+
+/* Clear all FP flags. */
+static inline void clear_fflags()
+{
+    __asm__ __volatile__("fsflags zero");
+}
+
+/* Read all FP flags. */
+static inline uint8_t get_fflags()
+{
+    uint64_t v;
+    __asm__ __volatile__("frflags %0" : "=r"(v));
+    return (uint8_t)v;
+}
+
+/* Move input value (without conversations) into an FP register. */
+static inline double do_fmv_d_x(uint64_t inp)
+{
+    double fpr;
+    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
+    return fpr;
+}
+
+static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
+    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
+    /* Zero (exp=0, frac=0) */
+    { .name = "+0.0",
+      .inp_lf = 0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-0.0",
+      .inp_lf = -0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+
+    /* Subnormal: exp=0 frac!=0 */
+    { .name = "Subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Subnormal frac=0xf..f",
+      .inp_lu = 0x0000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=0xf..f",
+      .inp_lu = 0x8000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    /* Infinity: exp=0x7ff, frac=0 */
+    { .name = "+INF",
+      .inp_lu = 0x7ff0000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-INF",
+      .inp_lu = 0xfff0000000000000,
+      .exp_fcvt = 0xffffffff80000000, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* NaN: exp=7ff, frac!=0 */
+    { .name = "canonical NaN",
+      .inp_lu = 0x7ff8000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "non-canonical NaN",
+      .inp_lu = 0x7ff8000000100000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* Normal numbers: exp!=0, exp!=7ff */
+    { .name = "+smallest normal value",
+      .inp_lu = 0x0010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-smallest normal value",
+      .inp_lu = 0x8010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+0.5",
+      .inp_lf = 0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-0.5",
+      .inp_lf = -0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+value just below 1.0",
+      .inp_lu = 0x3fefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-value just above -1.0",
+      .inp_lu = 0xbfefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+1.0",
+      .inp_lf = 0x1p0,
+      .exp_fcvt = 0x0000000000000001,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000001,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-1.0",
+      .inp_lf = -0x1p0,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = 0 },
+
+    { .name = "+1.5",
+      .inp_lu = 0x3ff8000000000000,
+      .exp_fcvt = 1,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 1,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-1.5",
+      .inp_lu = 0xbff8000000000000,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+max int32 (2147483647)",
+      .inp_lu = 0x41dfffffffc00000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x000000007fffffff,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "+max int32 +1 (2147483648)",
+      .inp_lf = 0x1p31,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "+max int32 +2 (2147483649)",
+      .inp_lu = 0x41e0000000200000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    { .name = "-max int32 (-2147483648)",
+      .inp_lf = -0x1p31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffff80000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-max int32 -1 (-2147483649)",
+      .inp_lf = -0x1.00000002p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483647, /* int32 max */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-max int32 -2 (-2147483650)",
+      .inp_lf = -0x1.00000004p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483646, /* int32 max -1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+};
+
+int run_fcvtmod_tests()
+{
+    uint64_t act_fcvt;
+    uint8_t act_fcvt_fflags;
+    uint64_t act_fcvtmod;
+    uint8_t act_fcvtmod_fflags;
+
+    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
+        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
+
+        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
+        int fcvt_correct = act_fcvt == t->exp_fcvt &&
+                    act_fcvt_fflags == t->exp_fcvt_fflags;
+        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
+        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
+                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
+
+        if (fcvt_correct && fcvtmod_correct) {
+            continue;
+        }
+
+        printf("Test %zu (%s) failed!\n", i, t->name);
+
+        double fpr = do_fmv_d_x(t->inp_lu);
+        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
+        printf("inp_lf: %lf\n", t->inp_lf);
+
+        uint32_t sign = (t->inp_lu >> 63);
+        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
+        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
+        int true_exp = exp - 1023;
+        int shift = true_exp - 52;
+        uint64_t true_frac = frac | 1ull << 52;
+
+        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
+        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
+
+        if (!fcvt_correct) {
+            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
+            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
+            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
+            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
+        }
+
+        if (!fcvtmod_correct) {
+            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
+            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
+            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
+            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
+        }
+
+        return 1;
+    }
+
+    return 0;
+}
+
+int main()
+{
+    return run_fcvtmod_tests();
+}

From 27076d03990feba9e2f0d1eb955c66f711411b80 Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:51:34 +0300
Subject: [PATCH 0606/1353] qga: Rename ga_disable_not_allowed ->
 ga_disable_not_allowed_freeze
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 qga/main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/qga/main.c b/qga/main.c
index 2b992a55b3..121ff7a748 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -395,7 +395,7 @@ static gint ga_strcmp(gconstpointer str1, gconstpointer str2)
 }
 
 /* disable commands that aren't safe for fsfreeze */
-static void ga_disable_not_allowed(const QmpCommand *cmd, void *opaque)
+static void ga_disable_not_allowed_freeze(const QmpCommand *cmd, void *opaque)
 {
     bool allowed = false;
     int i = 0;
@@ -459,7 +459,7 @@ void ga_set_frozen(GAState *s)
         return;
     }
     /* disable all forbidden (for frozen state) commands */
-    qmp_for_each_command(&ga_commands, ga_disable_not_allowed, NULL);
+    qmp_for_each_command(&ga_commands, ga_disable_not_allowed_freeze, NULL);
     g_warning("disabling logging due to filesystem freeze");
     ga_disable_logging(s);
     s->frozen = true;
@@ -1350,7 +1350,7 @@ static GAState *initialize_agent(GAConfig *config, int socket_activation)
             s->deferred_options.log_filepath = config->log_filepath;
         }
         ga_disable_logging(s);
-        qmp_for_each_command(&ga_commands, ga_disable_not_allowed, NULL);
+        qmp_for_each_command(&ga_commands, ga_disable_not_allowed_freeze, NULL);
     } else {
         if (config->daemonize) {
             become_daemon(config->pid_filepath);

From 133789e1bf369d592a67297f57e4adb2b7c64c3f Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:51:35 +0300
Subject: [PATCH 0607/1353] qga: Add new option --allow-rpcs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The allow-rpcs option accepts a comma-separated list of RPCs to
enable. This option is opposite to --block-rpcs. Using --block-rpcs
and --allow-rpcs at the same time is not allowed.

resolves: https://gitlab.com/qemu-project/qemu/-/issues/1505

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 docs/interop/qemu-ga.rst |  5 +++
 qga/main.c               | 85 +++++++++++++++++++++++++++++++++++++---
 2 files changed, 84 insertions(+), 6 deletions(-)

diff --git a/docs/interop/qemu-ga.rst b/docs/interop/qemu-ga.rst
index a9183802d1..461c5a35ee 100644
--- a/docs/interop/qemu-ga.rst
+++ b/docs/interop/qemu-ga.rst
@@ -84,6 +84,11 @@ Options
   Comma-separated list of RPCs to disable (no spaces, use ``help`` to
   list available RPCs).
 
+.. option:: -a, --allow-rpcs=LIST
+
+  Comma-separated list of RPCs to enable (no spaces, use ``help`` to
+  list available RPCs).
+
 .. option:: -D, --dump-conf
 
   Dump the configuration in a format compatible with ``qemu-ga.conf``
diff --git a/qga/main.c b/qga/main.c
index 121ff7a748..002161a0cc 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -87,6 +87,7 @@ struct GAState {
     bool delimit_response;
     bool frozen;
     GList *blockedrpcs;
+    GList *allowedrpcs;
     char *state_filepath_isfrozen;
     struct {
         const char *log_filepath;
@@ -261,6 +262,8 @@ QEMU_COPYRIGHT "\n"
 #endif
 "  -b, --block-rpcs  comma-separated list of RPCs to disable (no spaces,\n"
 "                    use \"help\" to list available RPCs)\n"
+"  -a, --allow-rpcs  comma-separated list of RPCs to enable (no spaces,\n"
+"                    use \"help\" to list available RPCs)\n"
 "  -D, --dump-conf   dump a qemu-ga config file based on current config\n"
 "                    options / command-line parameters to stdout\n"
 "  -r, --retry-path  attempt re-opening path if it's unavailable or closed\n"
@@ -416,16 +419,38 @@ static void ga_disable_not_allowed_freeze(const QmpCommand *cmd, void *opaque)
 /* [re-]enable all commands, except those explicitly blocked by user */
 static void ga_enable_non_blocked(const QmpCommand *cmd, void *opaque)
 {
-    GList *blockedrpcs = opaque;
+    GAState *s = opaque;
+    GList *blockedrpcs = s->blockedrpcs;
+    GList *allowedrpcs = s->allowedrpcs;
     const char *name = qmp_command_name(cmd);
 
-    if (g_list_find_custom(blockedrpcs, name, ga_strcmp) == NULL &&
-        !qmp_command_is_enabled(cmd)) {
+    if (g_list_find_custom(blockedrpcs, name, ga_strcmp) == NULL) {
+        if (qmp_command_is_enabled(cmd)) {
+            return;
+        }
+
+        if (allowedrpcs &&
+            g_list_find_custom(allowedrpcs, name, ga_strcmp) == NULL) {
+            return;
+        }
+
         g_debug("enabling command: %s", name);
         qmp_enable_command(&ga_commands, name);
     }
 }
 
+/* disable commands that aren't allowed */
+static void ga_disable_not_allowed(const QmpCommand *cmd, void *opaque)
+{
+    GList *allowedrpcs = opaque;
+    const char *name = qmp_command_name(cmd);
+
+    if (g_list_find_custom(allowedrpcs, name, ga_strcmp) == NULL) {
+        g_debug("disabling command: %s", name);
+        qmp_disable_command(&ga_commands, name, "the command is not allowed");
+    }
+}
+
 static bool ga_create_file(const char *path)
 {
     int fd = open(path, O_CREAT | O_WRONLY, S_IWUSR | S_IRUSR);
@@ -497,8 +522,8 @@ void ga_unset_frozen(GAState *s)
         s->deferred_options.pid_filepath = NULL;
     }
 
-    /* enable all disabled, non-blocked commands */
-    qmp_for_each_command(&ga_commands, ga_enable_non_blocked, s->blockedrpcs);
+    /* enable all disabled, non-blocked and allowed commands */
+    qmp_for_each_command(&ga_commands, ga_enable_non_blocked, s);
     s->frozen = false;
     if (!ga_delete_file(s->state_filepath_isfrozen)) {
         g_warning("unable to delete %s, fsfreeze may not function properly",
@@ -984,7 +1009,9 @@ struct GAConfig {
     const char *service;
 #endif
     gchar *bliststr; /* blockedrpcs may point to this string */
+    gchar *aliststr; /* allowedrpcs may point to this string */
     GList *blockedrpcs;
+    GList *allowedrpcs;
     int daemonize;
     GLogLevelFlags log_level;
     int dumpconf;
@@ -1055,6 +1082,19 @@ static void config_load(GAConfig *config)
         config->blockedrpcs = g_list_concat(config->blockedrpcs,
                                           split_list(config->bliststr, ","));
     }
+    if (g_key_file_has_key(keyfile, "general", "allow-rpcs", NULL)) {
+        config->aliststr =
+            g_key_file_get_string(keyfile, "general", "allow-rpcs", &gerr);
+        config->allowedrpcs = g_list_concat(config->allowedrpcs,
+                                          split_list(config->aliststr, ","));
+    }
+
+    if (g_key_file_has_key(keyfile, "general", blockrpcs_key, NULL) &&
+        g_key_file_has_key(keyfile, "general", "allow-rpcs", NULL)) {
+        g_critical("wrong config, using 'block-rpcs' and 'allow-rpcs' keys at"
+                   " the same time is not allowed");
+        exit(EXIT_FAILURE);
+    }
 
 end:
     g_key_file_free(keyfile);
@@ -1115,6 +1155,9 @@ static void config_dump(GAConfig *config)
     tmp = list_join(config->blockedrpcs, ',');
     g_key_file_set_string(keyfile, "general", "block-rpcs", tmp);
     g_free(tmp);
+    tmp = list_join(config->allowedrpcs, ',');
+    g_key_file_set_string(keyfile, "general", "allow-rpcs", tmp);
+    g_free(tmp);
 
     tmp = g_key_file_to_data(keyfile, NULL, &error);
     if (error) {
@@ -1130,8 +1173,9 @@ static void config_dump(GAConfig *config)
 
 static void config_parse(GAConfig *config, int argc, char **argv)
 {
-    const char *sopt = "hVvdm:p:l:f:F::b:s:t:Dr";
+    const char *sopt = "hVvdm:p:l:f:F::b:a:s:t:Dr";
     int opt_ind = 0, ch;
+    bool block_rpcs = false, allow_rpcs = false;
     const struct option lopt[] = {
         { "help", 0, NULL, 'h' },
         { "version", 0, NULL, 'V' },
@@ -1147,6 +1191,7 @@ static void config_parse(GAConfig *config, int argc, char **argv)
         { "daemonize", 0, NULL, 'd' },
         { "block-rpcs", 1, NULL, 'b' },
         { "blacklist", 1, NULL, 'b' },  /* deprecated alias for 'block-rpcs' */
+        { "allow-rpcs", 1, NULL, 'a' },
 #ifdef _WIN32
         { "service", 1, NULL, 's' },
 #endif
@@ -1206,6 +1251,17 @@ static void config_parse(GAConfig *config, int argc, char **argv)
             }
             config->blockedrpcs = g_list_concat(config->blockedrpcs,
                                                 split_list(optarg, ","));
+            block_rpcs = true;
+            break;
+        }
+        case 'a': {
+            if (is_help_option(optarg)) {
+                qmp_for_each_command(&ga_commands, ga_print_cmd, NULL);
+                exit(EXIT_SUCCESS);
+            }
+            config->allowedrpcs = g_list_concat(config->allowedrpcs,
+                                                split_list(optarg, ","));
+            allow_rpcs = true;
             break;
         }
 #ifdef _WIN32
@@ -1246,6 +1302,12 @@ static void config_parse(GAConfig *config, int argc, char **argv)
             exit(EXIT_FAILURE);
         }
     }
+
+    if (block_rpcs && allow_rpcs) {
+        g_critical("wrong commandline, using --block-rpcs and --allow-rpcs at the"
+                   " same time is not allowed");
+        exit(EXIT_FAILURE);
+    }
 }
 
 static void config_free(GAConfig *config)
@@ -1256,10 +1318,12 @@ static void config_free(GAConfig *config)
     g_free(config->state_dir);
     g_free(config->channel_path);
     g_free(config->bliststr);
+    g_free(config->aliststr);
 #ifdef CONFIG_FSFREEZE
     g_free(config->fsfreeze_hook);
 #endif
     g_list_free_full(config->blockedrpcs, g_free);
+    g_list_free_full(config->allowedrpcs, g_free);
     g_free(config);
 }
 
@@ -1374,6 +1438,15 @@ static GAState *initialize_agent(GAConfig *config, int socket_activation)
         return NULL;
     }
 
+    if (config->allowedrpcs) {
+        qmp_for_each_command(&ga_commands, ga_disable_not_allowed, config->allowedrpcs);
+        s->allowedrpcs = config->allowedrpcs;
+    }
+
+    /*
+     * Some commands can be blocked due to system limitation.
+     * Initialize blockedrpcs list even if allowedrpcs specified.
+     */
     config->blockedrpcs = ga_command_init_blockedrpcs(config->blockedrpcs);
     if (config->blockedrpcs) {
         GList *l = config->blockedrpcs;

From fcd1ab3add662316d6b5219edf40122e4d9c57d0 Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:51:36 +0300
Subject: [PATCH 0608/1353] qga: Add tests for --allow-rpcs option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 tests/unit/test-qga.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tests/unit/test-qga.c b/tests/unit/test-qga.c
index 360b4cab23..671e83cb86 100644
--- a/tests/unit/test-qga.c
+++ b/tests/unit/test-qga.c
@@ -665,6 +665,36 @@ static void test_qga_blockedrpcs(gconstpointer data)
     fixture_tear_down(&fix, NULL);
 }
 
+static void test_qga_allowedrpcs(gconstpointer data)
+{
+    TestFixture fix;
+    QDict *ret, *error;
+    const gchar *class, *desc;
+
+    fixture_setup(&fix, "-a guest-ping,guest-get-time", NULL);
+
+    /* check allowed RPCs */
+    ret = qmp_fd(fix.fd, "{'execute': 'guest-ping'}");
+    qmp_assert_no_error(ret);
+    qobject_unref(ret);
+
+    ret = qmp_fd(fix.fd, "{'execute': 'guest-get-time'}");
+    qmp_assert_no_error(ret);
+    qobject_unref(ret);
+
+    /* check something else */
+    ret = qmp_fd(fix.fd, "{'execute': 'guest-get-fsinfo'}");
+    g_assert_nonnull(ret);
+    error = qdict_get_qdict(ret, "error");
+    class = qdict_get_try_str(error, "class");
+    desc = qdict_get_try_str(error, "desc");
+    g_assert_cmpstr(class, ==, "CommandNotFound");
+    g_assert_nonnull(g_strstr_len(desc, -1, "has been disabled"));
+    qobject_unref(ret);
+
+    fixture_tear_down(&fix, NULL);
+}
+
 static void test_qga_config(gconstpointer data)
 {
     GError *error = NULL;
@@ -1090,6 +1120,7 @@ int main(int argc, char **argv)
                          test_qga_fsfreeze_status);
 
     g_test_add_data_func("/qga/blockedrpcs", NULL, test_qga_blockedrpcs);
+    g_test_add_data_func("/qga/allowedrpcs", NULL, test_qga_allowedrpcs);
     g_test_add_data_func("/qga/config", NULL, test_qga_config);
     g_test_add_data_func("/qga/guest-exec", &fix, test_qga_guest_exec);
     g_test_add_data_func("/qga/guest-exec-separated", &fix,

From 925d05d38a2bc76b5a49359370650a820bc891da Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:14:36 +0300
Subject: [PATCH 0609/1353] QGA VSS: Add wrapper to send log to debugger and
 stderr

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/meson.build   |  2 +-
 qga/vss-win32/vss-debug.cpp | 39 +++++++++++++++++++++++++++++++++++++
 qga/vss-win32/vss-debug.h   | 25 ++++++++++++++++++++++++
 3 files changed, 65 insertions(+), 1 deletion(-)
 create mode 100644 qga/vss-win32/vss-debug.cpp
 create mode 100644 qga/vss-win32/vss-debug.h

diff --git a/qga/vss-win32/meson.build b/qga/vss-win32/meson.build
index 9483ccd3b8..0ac918910b 100644
--- a/qga/vss-win32/meson.build
+++ b/qga/vss-win32/meson.build
@@ -7,7 +7,7 @@ link_args = cc.get_supported_link_arguments([
 
 qga_vss = shared_module(
   'qga-vss',
-  ['requester.cpp', 'provider.cpp', 'install.cpp', genh],
+  ['requester.cpp', 'provider.cpp', 'install.cpp', 'vss-debug.cpp', genh],
   name_prefix: '',
   cpp_args: ['-Wno-unknown-pragmas', '-Wno-delete-non-virtual-dtor', '-Wno-non-virtual-dtor'],
   link_args: link_args,
diff --git a/qga/vss-win32/vss-debug.cpp b/qga/vss-win32/vss-debug.cpp
new file mode 100644
index 0000000000..820b1c6667
--- /dev/null
+++ b/qga/vss-win32/vss-debug.cpp
@@ -0,0 +1,39 @@
+/*
+ * QEMU Guest Agent VSS debug declarations
+ *
+ * Copyright (C) 2023 Red Hat Inc
+ *
+ * Authors:
+ *  Konstantin Kostiuk <kkostiuk@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "vss-debug.h"
+#include "vss-common.h"
+
+void qga_debug_internal(const char *funcname, const char *fmt, ...)
+{
+    char user_string[512] = {0};
+    char full_string[640] = {0};
+
+    va_list args;
+    va_start(args, fmt);
+    if (vsnprintf(user_string, _countof(user_string), fmt, args) <= 0) {
+        va_end(args);
+        return;
+    }
+
+    va_end(args);
+
+    if (snprintf(full_string, _countof(full_string),
+                 QGA_PROVIDER_NAME "[%lu]: %s %s\n",
+                 GetCurrentThreadId(), funcname, user_string) <= 0) {
+        return;
+    }
+
+    OutputDebugString(full_string);
+    fputs(full_string, stderr);
+}
diff --git a/qga/vss-win32/vss-debug.h b/qga/vss-win32/vss-debug.h
new file mode 100644
index 0000000000..7800457392
--- /dev/null
+++ b/qga/vss-win32/vss-debug.h
@@ -0,0 +1,25 @@
+/*
+ * QEMU Guest Agent VSS debug declarations
+ *
+ * Copyright (C) 2023 Red Hat Inc
+ *
+ * Authors:
+ *  Konstantin Kostiuk <kkostiuk@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include <vss-handles.h>
+
+#ifndef VSS_DEBUG_H
+#define VSS_DEBUG_H
+
+void qga_debug_internal(const char *funcname, const char *fmt, ...) G_GNUC_PRINTF(2, 3);
+
+#define qga_debug(fmt, ...) qga_debug_internal(__func__, fmt, ## __VA_ARGS__)
+#define qga_debug_begin qga_debug("begin")
+#define qga_debug_end qga_debug("end")
+
+#endif

From 2f84cf699460f1182402b250064d12d4ab32ef4d Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:14:37 +0300
Subject: [PATCH 0610/1353] QGA VSS: Replace 'fprintf(stderr' with qga_debug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/install.cpp   | 12 ++++++------
 qga/vss-win32/requester.cpp |  9 +++++----
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index ff93b08a9e..e03473d1a8 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -13,6 +13,7 @@
 #include "qemu/osdep.h"
 
 #include "vss-common.h"
+#include "vss-debug.h"
 #ifdef HAVE_VSS_SDK
 #include <vscoordint.h>
 #else
@@ -54,7 +55,7 @@ void errmsg(DWORD err, const char *text)
                   FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
                   NULL, err, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
                   (char *)&msg, 0, NULL);
-    fprintf(stderr, "%.*s. (Error: %lx) %s\n", len, text, err, msg);
+    qga_debug("%.*s. (Error: %lx) %s", len, text, err, msg);
     LocalFree(msg);
 }
 
@@ -219,7 +220,7 @@ static HRESULT QGAProviderRemove(ICatalogCollection *coll, int i, void *arg)
 {
     HRESULT hr;
 
-    fprintf(stderr, "Removing COM+ Application: %s\n", QGA_PROVIDER_NAME);
+    qga_debug("Removing COM+ Application: %s", QGA_PROVIDER_NAME);
     chk(coll->Remove(i));
 out:
     return hr;
@@ -304,9 +305,8 @@ STDAPI COMRegister(void)
     }
     strcpy(tlbPath, dllPath);
     strcpy(tlbPath+n-3, "tlb");
-    fprintf(stderr, "Registering " QGA_PROVIDER_NAME ":\n");
-    fprintf(stderr, "  %s\n", dllPath);
-    fprintf(stderr, "  %s\n", tlbPath);
+    qga_debug("Registering " QGA_PROVIDER_NAME ": %s %s",
+              dllPath, tlbPath);
     if (!PathFileExists(tlbPath)) {
         hr = HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND);
         errmsg(hr, "Failed to lookup tlb");
@@ -517,7 +517,7 @@ namespace _com_util
         }
 
         if (mbstowcs(bstr, ascii, len) == (size_t)-1) {
-            fprintf(stderr, "Failed to convert string '%s' into BSTR", ascii);
+            qga_debug("Failed to convert string '%s' into BSTR", ascii);
             bstr[0] = 0;
         }
         return bstr;
diff --git a/qga/vss-win32/requester.cpp b/qga/vss-win32/requester.cpp
index 3e998af4a8..e85b9bc633 100644
--- a/qga/vss-win32/requester.cpp
+++ b/qga/vss-win32/requester.cpp
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "vss-common.h"
+#include "vss-debug.h"
 #include "requester.h"
 #include "install.h"
 #include <vswriter.h>
@@ -59,13 +60,13 @@ STDAPI requester_init(void)
         NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
         RPC_C_IMP_LEVEL_IDENTIFY, NULL, EOAC_NONE, NULL);
     if (FAILED(hr)) {
-        fprintf(stderr, "failed to CoInitializeSecurity (error %lx)\n", hr);
+        qga_debug("failed to CoInitializeSecurity (error %lx)", hr);
         return hr;
     }
 
     hLib = LoadLibraryA("VSSAPI.DLL");
     if (!hLib) {
-        fprintf(stderr, "failed to load VSSAPI.DLL\n");
+        qga_debug("failed to load VSSAPI.DLL");
         return HRESULT_FROM_WIN32(GetLastError());
     }
 
@@ -78,14 +79,14 @@ STDAPI requester_init(void)
 #endif
         );
     if (!pCreateVssBackupComponents) {
-        fprintf(stderr, "failed to get proc address from VSSAPI.DLL\n");
+        qga_debug("failed to get proc address from VSSAPI.DLL");
         return HRESULT_FROM_WIN32(GetLastError());
     }
 
     pVssFreeSnapshotProperties = (t_VssFreeSnapshotProperties)
         GetProcAddress(hLib, "VssFreeSnapshotProperties");
     if (!pVssFreeSnapshotProperties) {
-        fprintf(stderr, "failed to get proc address from VSSAPI.DLL\n");
+        qga_debug("failed to get proc address from VSSAPI.DLL");
         return HRESULT_FROM_WIN32(GetLastError());
     }
 

From 24eecad3ad47e5660c12aff9c3ab6b365f28a9bd Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:14:38 +0300
Subject: [PATCH 0611/1353] QGA VSS: Print error in err_set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/requester.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/qga/vss-win32/requester.cpp b/qga/vss-win32/requester.cpp
index e85b9bc633..f3eafacfc1 100644
--- a/qga/vss-win32/requester.cpp
+++ b/qga/vss-win32/requester.cpp
@@ -26,9 +26,11 @@
 
 #define DEFAULT_VSS_BACKUP_TYPE VSS_BT_FULL
 
-#define err_set(e, err, fmt, ...)                                           \
-    ((e)->error_setg_win32_wrapper((e)->errp, __FILE__, __LINE__, __func__, \
-                                   err, fmt, ## __VA_ARGS__))
+#define err_set(e, err, fmt, ...) {                                         \
+    (e)->error_setg_win32_wrapper((e)->errp, __FILE__, __LINE__, __func__,  \
+                                   err, fmt, ## __VA_ARGS__);               \
+    qga_debug(fmt, ## __VA_ARGS__);                                         \
+}
 /* Bad idea, works only when (e)->errp != NULL: */
 #define err_is_set(e) ((e)->errp && *(e)->errp)
 /* To lift this restriction, error_propagate(), like we do in QEMU code */

From 61df91b33caf646cd39f9879d4b190eab5b7201b Mon Sep 17 00:00:00 2001
From: Konstantin Kostiuk <kkostiuk@redhat.com>
Date: Mon, 10 Jul 2023 12:14:39 +0300
Subject: [PATCH 0612/1353] QGA VSS: Add log in functions begin/end

Add several qga_debug() statements in functions.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/install.cpp   | 35 +++++++++++++++++++++++++++++++++++
 qga/vss-win32/provider.cpp  |  3 +++
 qga/vss-win32/requester.cpp | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 72 insertions(+)

diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index e03473d1a8..ae38662a62 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -100,6 +100,8 @@ HRESULT put_Value(ICatalogObject *pObj, LPCWSTR name, T val)
 /* Lookup Administrators group name from winmgmt */
 static HRESULT GetAdminName(_bstr_t *name)
 {
+    qga_debug_begin;
+
     HRESULT hr;
     COMPointer<IWbemLocator> pLoc;
     COMPointer<IWbemServices> pSvc;
@@ -142,6 +144,7 @@ static HRESULT GetAdminName(_bstr_t *name)
     }
 
 out:
+    qga_debug_end;
     return hr;
 }
 
@@ -149,6 +152,8 @@ out:
 static HRESULT getNameByStringSID(
     const wchar_t *sid, LPWSTR buffer, LPDWORD bufferLen)
 {
+    qga_debug_begin;
+
     HRESULT hr = S_OK;
     PSID psid = NULL;
     SID_NAME_USE groupType;
@@ -168,6 +173,7 @@ static HRESULT getNameByStringSID(
     LocalFree(psid);
 
 out:
+    qga_debug_end;
     return hr;
 }
 
@@ -175,6 +181,8 @@ out:
 static HRESULT QGAProviderFind(
     HRESULT (*found)(ICatalogCollection *, int, void *), void *arg)
 {
+    qga_debug_begin;
+
     HRESULT hr;
     COMInitializer initializer;
     COMPointer<IUnknown> pUnknown;
@@ -205,41 +213,53 @@ static HRESULT QGAProviderFind(
     chk(pColl->SaveChanges(&n));
 
 out:
+    qga_debug_end;
     return hr;
 }
 
 /* Count QGA VSS provider in COM+ Application Catalog */
 static HRESULT QGAProviderCount(ICatalogCollection *coll, int i, void *arg)
 {
+    qga_debug_begin;
+
     (*(int *)arg)++;
+
+    qga_debug_end;
     return S_OK;
 }
 
 /* Remove QGA VSS provider from COM+ Application Catalog Collection */
 static HRESULT QGAProviderRemove(ICatalogCollection *coll, int i, void *arg)
 {
+    qga_debug_begin;
     HRESULT hr;
 
     qga_debug("Removing COM+ Application: %s", QGA_PROVIDER_NAME);
     chk(coll->Remove(i));
 out:
+    qga_debug_end;
     return hr;
 }
 
 /* Unregister this module from COM+ Applications Catalog */
 STDAPI COMUnregister(void)
 {
+    qga_debug_begin;
+
     HRESULT hr;
 
     DllUnregisterServer();
     chk(QGAProviderFind(QGAProviderRemove, NULL));
 out:
+    qga_debug_end;
     return hr;
 }
 
 /* Register this module to COM+ Applications Catalog */
 STDAPI COMRegister(void)
 {
+    qga_debug_begin;
+
     HRESULT hr;
     COMInitializer initializer;
     COMPointer<IUnknown> pUnknown;
@@ -259,12 +279,14 @@ STDAPI COMRegister(void)
 
     if (!g_hinstDll) {
         errmsg(E_FAIL, "Failed to initialize DLL");
+        qga_debug_end;
         return E_FAIL;
     }
 
     chk(QGAProviderFind(QGAProviderCount, (void *)&count));
     if (count) {
         errmsg(E_ABORT, "QGA VSS Provider is already installed");
+        qga_debug_end;
         return E_ABORT;
     }
 
@@ -354,6 +376,7 @@ out:
         COMUnregister();
     }
 
+    qga_debug_end;
     return hr;
 }
 
@@ -369,6 +392,8 @@ STDAPI_(void) CALLBACK DLLCOMUnregister(HWND, HINSTANCE, LPSTR, int)
 
 static BOOL CreateRegistryKey(LPCTSTR key, LPCTSTR value, LPCTSTR data)
 {
+    qga_debug_begin;
+
     HKEY  hKey;
     LONG  ret;
     DWORD size;
@@ -389,6 +414,7 @@ static BOOL CreateRegistryKey(LPCTSTR key, LPCTSTR value, LPCTSTR data)
     RegCloseKey(hKey);
 
 out:
+    qga_debug_end;
     if (ret != ERROR_SUCCESS) {
         /* As we cannot printf within DllRegisterServer(), show a dialog. */
         errmsg_dialog(ret, "Cannot add registry", key);
@@ -400,6 +426,8 @@ out:
 /* Register this dll as a VSS provider */
 STDAPI DllRegisterServer(void)
 {
+    qga_debug_begin;
+
     COMInitializer initializer;
     COMPointer<IVssAdmin> pVssAdmin;
     HRESULT hr = E_FAIL;
@@ -478,12 +506,15 @@ out:
         DllUnregisterServer();
     }
 
+    qga_debug_end;
     return hr;
 }
 
 /* Unregister this VSS hardware provider from the system */
 STDAPI DllUnregisterServer(void)
 {
+    qga_debug_begin;
+
     TCHAR key[256];
     COMInitializer initializer;
     COMPointer<IVssAdmin> pVssAdmin;
@@ -501,6 +532,7 @@ STDAPI DllUnregisterServer(void)
     SHDeleteKey(HKEY_CLASSES_ROOT, key);
     SHDeleteKey(HKEY_CLASSES_ROOT, g_szProgid);
 
+    qga_debug_end;
     return S_OK; /* Uninstall should never fail */
 }
 
@@ -527,6 +559,8 @@ namespace _com_util
 /* Stop QGA VSS provider service using Winsvc API  */
 STDAPI StopService(void)
 {
+    qga_debug_begin;
+
     HRESULT hr = S_OK;
     SC_HANDLE manager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
     SC_HANDLE service = NULL;
@@ -551,5 +585,6 @@ STDAPI StopService(void)
 out:
     CloseServiceHandle(service);
     CloseServiceHandle(manager);
+    qga_debug_end;
     return hr;
 }
diff --git a/qga/vss-win32/provider.cpp b/qga/vss-win32/provider.cpp
index 1b885e24ee..cc72e5ef1b 100644
--- a/qga/vss-win32/provider.cpp
+++ b/qga/vss-win32/provider.cpp
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "vss-common.h"
+#include "vss-debug.h"
 #ifdef HAVE_VSS_SDK
 #include <vscoordint.h>
 #else
@@ -529,9 +530,11 @@ STDAPI DllCanUnloadNow()
 EXTERN_C
 BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD dwReason, LPVOID lpReserved)
 {
+    qga_debug("begin, reason = %lu", dwReason);
     if (dwReason == DLL_PROCESS_ATTACH) {
         g_hinstDll = hinstDll;
         DisableThreadLibraryCalls(hinstDll);
     }
+    qga_debug_end;
     return TRUE;
 }
diff --git a/qga/vss-win32/requester.cpp b/qga/vss-win32/requester.cpp
index f3eafacfc1..9884c65e70 100644
--- a/qga/vss-win32/requester.cpp
+++ b/qga/vss-win32/requester.cpp
@@ -57,6 +57,8 @@ static struct QGAVSSContext {
 
 STDAPI requester_init(void)
 {
+    qga_debug_begin;
+
     COMInitializer initializer; /* to call CoInitializeSecurity */
     HRESULT hr = CoInitializeSecurity(
         NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
@@ -92,11 +94,14 @@ STDAPI requester_init(void)
         return HRESULT_FROM_WIN32(GetLastError());
     }
 
+    qga_debug_end;
     return S_OK;
 }
 
 static void requester_cleanup(void)
 {
+    qga_debug_begin;
+
     if (vss_ctx.hEventFrozen) {
         CloseHandle(vss_ctx.hEventFrozen);
         vss_ctx.hEventFrozen = NULL;
@@ -118,10 +123,13 @@ static void requester_cleanup(void)
         vss_ctx.pVssbc = NULL;
     }
     vss_ctx.cFrozenVols = 0;
+    qga_debug_end;
 }
 
 STDAPI requester_deinit(void)
 {
+    qga_debug_begin;
+
     requester_cleanup();
 
     pCreateVssBackupComponents = NULL;
@@ -131,11 +139,14 @@ STDAPI requester_deinit(void)
         hLib = NULL;
     }
 
+    qga_debug_end;
     return S_OK;
 }
 
 static HRESULT WaitForAsync(IVssAsync *pAsync)
 {
+    qga_debug_begin;
+
     HRESULT ret, hr;
 
     do {
@@ -151,11 +162,14 @@ static HRESULT WaitForAsync(IVssAsync *pAsync)
         }
     } while (ret == VSS_S_ASYNC_PENDING);
 
+    qga_debug_end;
     return ret;
 }
 
 static void AddComponents(ErrorSet *errset)
 {
+    qga_debug_begin;
+
     unsigned int cWriters, i;
     VSS_ID id, idInstance, idWriter;
     BSTR bstrWriterName = NULL;
@@ -237,17 +251,21 @@ out:
     if (pComponent && info) {
         pComponent->FreeComponentInfo(info);
     }
+    qga_debug_end;
 }
 
 DWORD get_reg_dword_value(HKEY baseKey, LPCSTR subKey, LPCSTR valueName,
                           DWORD defaultData)
 {
+    qga_debug_begin;
+
     DWORD regGetValueError;
     DWORD dwordData;
     DWORD dataSize = sizeof(DWORD);
 
     regGetValueError = RegGetValue(baseKey, subKey, valueName, RRF_RT_DWORD,
                                    NULL, &dwordData, &dataSize);
+    qga_debug_end;
     if (regGetValueError  != ERROR_SUCCESS) {
         return defaultData;
     }
@@ -262,6 +280,8 @@ bool is_valid_vss_backup_type(VSS_BACKUP_TYPE vssBT)
 VSS_BACKUP_TYPE get_vss_backup_type(
     VSS_BACKUP_TYPE defaultVssBT = DEFAULT_VSS_BACKUP_TYPE)
 {
+    qga_debug_begin;
+
     VSS_BACKUP_TYPE vssBackupType;
 
     vssBackupType = static_cast<VSS_BACKUP_TYPE>(
@@ -269,6 +289,7 @@ VSS_BACKUP_TYPE get_vss_backup_type(
                                                 QGA_PROVIDER_REGISTRY_ADDRESS,
                                                 "VssOption",
                                                 defaultVssBT));
+    qga_debug_end;
     if (!is_valid_vss_backup_type(vssBackupType)) {
         return defaultVssBT;
     }
@@ -277,6 +298,8 @@ VSS_BACKUP_TYPE get_vss_backup_type(
 
 void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
 {
+    qga_debug_begin;
+
     COMPointer<IVssAsync> pAsync;
     HANDLE volume;
     HRESULT hr;
@@ -292,6 +315,7 @@ void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
 
     if (vss_ctx.pVssbc) { /* already frozen */
         *num_vols = 0;
+        qga_debug("finished, already frozen");
         return;
     }
 
@@ -449,6 +473,7 @@ void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
         }
     }
 
+    qga_debug("preparing for backup");
     hr = vss_ctx.pVssbc->PrepareForBackup(pAsync.replace());
     if (SUCCEEDED(hr)) {
         hr = WaitForAsync(pAsync);
@@ -472,6 +497,7 @@ void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
      * CQGAVssProvider::CommitSnapshots will kick vss_ctx.hEventFrozen
      * after the applications and filesystems are frozen.
      */
+    qga_debug("do snapshot set");
     hr = vss_ctx.pVssbc->DoSnapshotSet(&vss_ctx.pAsyncSnapshot);
     if (FAILED(hr)) {
         err_set(errset, hr, "failed to do snapshot set");
@@ -518,6 +544,7 @@ void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
         *num_vols = vss_ctx.cFrozenVols = num_fixed_drives;
     }
 
+    qga_debug("end successful");
     return;
 
 out:
@@ -528,11 +555,14 @@ out:
 out1:
     requester_cleanup();
     CoUninitialize();
+
+    qga_debug_end;
 }
 
 
 void requester_thaw(int *num_vols, void *mountpints, ErrorSet *errset)
 {
+    qga_debug_begin;
     COMPointer<IVssAsync> pAsync;
 
     if (!vss_ctx.hEventThaw) {
@@ -541,6 +571,8 @@ void requester_thaw(int *num_vols, void *mountpints, ErrorSet *errset)
          * and no volumes must be frozen. We return without an error.
          */
         *num_vols = 0;
+        qga_debug("finished, no volumes were frozen");
+
         return;
     }
 
@@ -597,4 +629,6 @@ void requester_thaw(int *num_vols, void *mountpints, ErrorSet *errset)
 
     CoUninitialize();
     StopService();
+
+    qga_debug_end;
 }

From f5f9c6ea11bc807664fdeb9354915c2c9cdcbd89 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 24 Jun 2023 22:06:44 +0200
Subject: [PATCH 0613/1353] hw/s390x: Move KVM specific PV from hw/ to
 target/s390x/kvm/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Protected Virtualization (PV) is not a real hardware device:
it is a feature of the firmware on s390x that is exposed to
userspace via the KVM interface.

Move the pv.c/pv.h files to target/s390x/kvm/ to make this clearer.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230624200644.23931-1-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                                 | 2 --
 hw/s390x/ipl.c                              | 2 +-
 hw/s390x/meson.build                        | 1 -
 hw/s390x/s390-pci-kvm.c                     | 2 +-
 hw/s390x/s390-virtio-ccw.c                  | 2 +-
 hw/s390x/tod-kvm.c                          | 2 +-
 target/s390x/arch_dump.c                    | 2 +-
 target/s390x/cpu-sysemu.c                   | 2 +-
 target/s390x/cpu_features.c                 | 2 +-
 target/s390x/cpu_models.c                   | 2 +-
 target/s390x/diag.c                         | 2 +-
 target/s390x/helper.c                       | 2 +-
 target/s390x/ioinst.c                       | 2 +-
 target/s390x/kvm/kvm.c                      | 2 +-
 target/s390x/kvm/meson.build                | 1 +
 {hw/s390x => target/s390x/kvm}/pv.c         | 2 +-
 {include/hw/s390x => target/s390x/kvm}/pv.h | 0
 17 files changed, 14 insertions(+), 16 deletions(-)
 rename {hw/s390x => target/s390x/kvm}/pv.c (99%)
 rename {include/hw/s390x => target/s390x/kvm}/pv.h (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1817cfc62f..43bd9afc19 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -452,8 +452,6 @@ S: Supported
 F: target/s390x/kvm/
 F: target/s390x/machine.c
 F: target/s390x/sigp.c
-F: hw/s390x/pv.c
-F: include/hw/s390x/pv.h
 F: gdb-xml/s390*.xml
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 8612684d48..515dcf51b5 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -26,7 +26,7 @@
 #include "hw/s390x/vfio-ccw.h"
 #include "hw/s390x/css.h"
 #include "hw/s390x/ebcdic.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #include "hw/scsi/scsi.h"
 #include "hw/virtio/virtio-net.h"
 #include "ipl.h"
diff --git a/hw/s390x/meson.build b/hw/s390x/meson.build
index f291016fee..6fd096813a 100644
--- a/hw/s390x/meson.build
+++ b/hw/s390x/meson.build
@@ -22,7 +22,6 @@ s390x_ss.add(when: 'CONFIG_KVM', if_true: files(
   'tod-kvm.c',
   's390-skeys-kvm.c',
   's390-stattrib-kvm.c',
-  'pv.c',
   's390-pci-kvm.c',
 ))
 s390x_ss.add(when: 'CONFIG_TCG', if_true: files(
diff --git a/hw/s390x/s390-pci-kvm.c b/hw/s390x/s390-pci-kvm.c
index 9134fe185f..ff41e4106d 100644
--- a/hw/s390x/s390-pci-kvm.c
+++ b/hw/s390x/s390-pci-kvm.c
@@ -14,7 +14,7 @@
 #include <linux/kvm.h>
 
 #include "kvm/kvm_s390x.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #include "hw/s390x/s390-pci-bus.h"
 #include "hw/s390x/s390-pci-kvm.h"
 #include "hw/s390x/s390-pci-inst.h"
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 2dece8eab8..4516d73ff5 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -42,7 +42,7 @@
 #include "hw/s390x/tod.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/cpus.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #include "migration/blocker.h"
 #include "qapi/visitor.h"
 
diff --git a/hw/s390x/tod-kvm.c b/hw/s390x/tod-kvm.c
index e2202dae2d..9588b90f2b 100644
--- a/hw/s390x/tod-kvm.c
+++ b/hw/s390x/tod-kvm.c
@@ -13,7 +13,7 @@
 #include "qemu/module.h"
 #include "sysemu/runstate.h"
 #include "hw/s390x/tod.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #include "kvm/kvm_s390x.h"
 
 static void kvm_s390_get_tod_raw(S390TOD *tod, Error **errp)
diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c
index cb98f4894d..51a2116515 100644
--- a/target/s390x/arch_dump.c
+++ b/target/s390x/arch_dump.c
@@ -17,8 +17,8 @@
 #include "s390x-internal.h"
 #include "elf.h"
 #include "sysemu/dump.h"
-#include "hw/s390x/pv.h"
 #include "kvm/kvm_s390x.h"
+#include "target/s390x/kvm/pv.h"
 
 struct S390xUserRegsStruct {
     uint64_t psw[2];
diff --git a/target/s390x/cpu-sysemu.c b/target/s390x/cpu-sysemu.c
index 97d6c760a8..8112561e5e 100644
--- a/target/s390x/cpu-sysemu.c
+++ b/target/s390x/cpu-sysemu.c
@@ -33,7 +33,7 @@
 #include "qapi/qapi-visit-run-state.h"
 #include "sysemu/hw_accel.h"
 
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/tcg.h"
diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
index 2e4e11d264..ebb155ce1c 100644
--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
@@ -15,7 +15,7 @@
 #include "qemu/module.h"
 #include "cpu_features.h"
 #ifndef CONFIG_USER_ONLY
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #endif
 
 #define DEF_FEAT(_FEAT, _NAME, _TYPE, _BIT, _DESC) \
diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index ae8880e81d..42b52afdb4 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -24,7 +24,7 @@
 #include "qemu/qemu-print.h"
 #ifndef CONFIG_USER_ONLY
 #include "sysemu/sysemu.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #endif
 
 #define CPUDEF_INIT(_type, _gen, _ec_ga, _mha_pow, _hmfai, _name, _desc) \
diff --git a/target/s390x/diag.c b/target/s390x/diag.c
index e5f0df19e7..8ce18e08f3 100644
--- a/target/s390x/diag.c
+++ b/target/s390x/diag.c
@@ -19,9 +19,9 @@
 #include "sysemu/cpus.h"
 #include "hw/s390x/ipl.h"
 #include "hw/s390x/s390-virtio-ccw.h"
-#include "hw/s390x/pv.h"
 #include "sysemu/kvm.h"
 #include "kvm/kvm_s390x.h"
+#include "target/s390x/kvm/pv.h"
 #include "qemu/error-report.h"
 
 
diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index 2b363aa959..d76c06381b 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -24,7 +24,7 @@
 #include "gdbstub/helpers.h"
 #include "qemu/timer.h"
 #include "hw/s390x/ioinst.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 #include "sysemu/hw_accel.h"
 #include "sysemu/runstate.h"
 
diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c
index 053aaabb5a..bbe45a497a 100644
--- a/target/s390x/ioinst.c
+++ b/target/s390x/ioinst.c
@@ -16,7 +16,7 @@
 #include "hw/s390x/ioinst.h"
 #include "trace.h"
 #include "hw/s390x/s390-pci-bus.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 
 /* All I/O instructions but chsc use the s format */
 static uint64_t get_address_from_regs(CPUS390XState *env, uint32_t ipb,
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 3ac7ec9acf..a9e5880349 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -50,7 +50,7 @@
 #include "exec/memattrs.h"
 #include "hw/s390x/s390-virtio-ccw.h"
 #include "hw/s390x/s390-virtio-hcall.h"
-#include "hw/s390x/pv.h"
+#include "target/s390x/kvm/pv.h"
 
 #ifndef DEBUG_KVM
 #define DEBUG_KVM  0
diff --git a/target/s390x/kvm/meson.build b/target/s390x/kvm/meson.build
index 37253f75bf..d6aca590ae 100644
--- a/target/s390x/kvm/meson.build
+++ b/target/s390x/kvm/meson.build
@@ -1,5 +1,6 @@
 
 s390x_ss.add(when: 'CONFIG_KVM', if_true: files(
+  'pv.c',
   'kvm.c'
 ), if_false: files(
   'stubs.c'
diff --git a/hw/s390x/pv.c b/target/s390x/kvm/pv.c
similarity index 99%
rename from hw/s390x/pv.c
rename to target/s390x/kvm/pv.c
index b63f3784c6..6a69be7e5c 100644
--- a/hw/s390x/pv.c
+++ b/target/s390x/kvm/pv.c
@@ -21,9 +21,9 @@
 #include "qom/object_interfaces.h"
 #include "exec/confidential-guest-support.h"
 #include "hw/s390x/ipl.h"
-#include "hw/s390x/pv.h"
 #include "hw/s390x/sclp.h"
 #include "target/s390x/kvm/kvm_s390x.h"
+#include "target/s390x/kvm/pv.h"
 
 static bool info_valid;
 static struct kvm_s390_pv_info_vm info_vm;
diff --git a/include/hw/s390x/pv.h b/target/s390x/kvm/pv.h
similarity index 100%
rename from include/hw/s390x/pv.h
rename to target/s390x/kvm/pv.h

From 78a1e153f93e7bbec5d7efefa5f89fd011e9220f Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:25 +0200
Subject: [PATCH 0614/1353] linux-user: elfload: Add more initial s390x PSW
 bits

Make the PSW look more similar to the real s390x userspace PSW.
Except for being there, the newly added bits should not affect the
userspace code execution.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230704081506.276055-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 linux-user/elfload.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 9a2ec568b0..d3d1352c4e 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1635,7 +1635,9 @@ const char *elf_hwcap_str(uint32_t bit)
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
     regs->psw.addr = infop->entry;
-    regs->psw.mask = PSW_MASK_64 | PSW_MASK_32;
+    regs->psw.mask = PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT | \
+                     PSW_MASK_MCHECK | PSW_MASK_PSTATE | PSW_MASK_64 | \
+                     PSW_MASK_32;
     regs->gprs[15] = infop->start_stack;
 }
 

From 110b1bac2ecd94a78a1d38003e24e37367bf074e Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:26 +0200
Subject: [PATCH 0615/1353] target/s390x: Fix EPSW CC reporting

EPSW should explicitly calculate and insert CC, like IPM does.

Fixes: e30a9d3fea58 ("target-s390: Implement EPSW")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: qemu-stable@nongnu.org
Message-Id: <20230704081506.276055-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index a6ee2d4423..0cef6efbef 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -2383,10 +2383,14 @@ static DisasJumpType op_epsw(DisasContext *s, DisasOps *o)
     int r1 = get_field(s, r1);
     int r2 = get_field(s, r2);
     TCGv_i64 t = tcg_temp_new_i64();
+    TCGv_i64 t_cc = tcg_temp_new_i64();
 
     /* Note the "subsequently" in the PoO, which implies a defined result
        if r1 == r2.  Thus we cannot defer these writes to an output hook.  */
+    gen_op_calc_cc(s);
+    tcg_gen_extu_i32_i64(t_cc, cc_op);
     tcg_gen_shri_i64(t, psw_mask, 32);
+    tcg_gen_deposit_i64(t, t, t_cc, 12, 2);
     store_reg32_i64(r1, t);
     if (r2 != 0) {
         store_reg32_i64(r2, psw_mask);

From fed9a4fe0ce0ec917a6b3a2da0a7ecd3cb9eba56 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:27 +0200
Subject: [PATCH 0616/1353] target/s390x: Fix MDEB and MDEBR

These instructions multiply 32 bits by 32 bits, not 32 bits by 64 bits.

Fixes: 83b00736f3d8 ("target-s390: Convert FP MULTIPLY")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: qemu-stable@nongnu.org
Message-Id: <20230704081506.276055-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/fpu_helper.c    | 3 ++-
 target/s390x/tcg/insn-data.h.inc | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/s390x/tcg/fpu_helper.c b/target/s390x/tcg/fpu_helper.c
index 57e5829283..4b7fa58af3 100644
--- a/target/s390x/tcg/fpu_helper.c
+++ b/target/s390x/tcg/fpu_helper.c
@@ -306,8 +306,9 @@ uint64_t HELPER(mdb)(CPUS390XState *env, uint64_t f1, uint64_t f2)
 /* 64/32-bit FP multiplication */
 uint64_t HELPER(mdeb)(CPUS390XState *env, uint64_t f1, uint64_t f2)
 {
+    float64 f1_64 = float32_to_float64(f1, &env->fpu_status);
     float64 ret = float32_to_float64(f2, &env->fpu_status);
-    ret = float64_mul(f1, ret, &env->fpu_status);
+    ret = float64_mul(f1_64, ret, &env->fpu_status);
     handle_exceptions(env, false, GETPC());
     return ret;
 }
diff --git a/target/s390x/tcg/insn-data.h.inc b/target/s390x/tcg/insn-data.h.inc
index 0a45dbbcda..457ed25d2f 100644
--- a/target/s390x/tcg/insn-data.h.inc
+++ b/target/s390x/tcg/insn-data.h.inc
@@ -667,11 +667,11 @@
     F(0xb317, MEEBR,   RRE,   Z,   e1, e2, new, e1, meeb, 0, IF_BFP)
     F(0xb31c, MDBR,    RRE,   Z,   f1, f2, new, f1, mdb, 0, IF_BFP)
     F(0xb34c, MXBR,    RRE,   Z,   x1, x2, new_x, x1, mxb, 0, IF_BFP)
-    F(0xb30c, MDEBR,   RRE,   Z,   f1, e2, new, f1, mdeb, 0, IF_BFP)
+    F(0xb30c, MDEBR,   RRE,   Z,   e1, e2, new, f1, mdeb, 0, IF_BFP)
     F(0xb307, MXDBR,   RRE,   Z,   f1, f2, new_x, x1, mxdb, 0, IF_BFP)
     F(0xed17, MEEB,    RXE,   Z,   e1, m2_32u, new, e1, meeb, 0, IF_BFP)
     F(0xed1c, MDB,     RXE,   Z,   f1, m2_64, new, f1, mdb, 0, IF_BFP)
-    F(0xed0c, MDEB,    RXE,   Z,   f1, m2_32u, new, f1, mdeb, 0, IF_BFP)
+    F(0xed0c, MDEB,    RXE,   Z,   e1, m2_32u, new, f1, mdeb, 0, IF_BFP)
     F(0xed07, MXDB,    RXE,   Z,   f1, m2_64, new_x, x1, mxdb, 0, IF_BFP)
 /* MULTIPLY HALFWORD */
     C(0x4c00, MH,      RX_a,  Z,   r1_o, m2_16s, new, r1_32, mul, 0)

From 92a57534619a4058544ce8f9c0beae3e054f342b Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:28 +0200
Subject: [PATCH 0617/1353] target/s390x: Fix MVCRL with a large value in R0

Using a large R0 causes an assertion error:

    qemu-s390x: target/s390x/tcg/mem_helper.c:183: access_prepare_nf: Assertion `size > 0 && size <= 4096' failed.

Even though PoP explicitly advises against using more than 8 bits for the
size, an emulator crash is never a good thing.

Fix by truncating the size to 8 bits.

Fixes: ea0a1053e276 ("s390x/tcg: Implement Miscellaneous-Instruction-Extensions Facility 3 for the s390x")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: qemu-stable@nongnu.org
Message-Id: <20230704081506.276055-5-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/mem_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index d02ec861d8..84ad85212c 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -514,6 +514,7 @@ void HELPER(mvcrl)(CPUS390XState *env, uint64_t l, uint64_t dest, uint64_t src)
     int32_t i;
 
     /* MVCRL always copies one more byte than specified - maximum is 256 */
+    l &= 0xff;
     l++;
 
     access_prepare(&srca, env, src, l, MMU_DATA_LOAD, mmu_idx, ra);

From 6da311a60d58dba27f5f790217d5ebba944e34ab Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:29 +0200
Subject: [PATCH 0618/1353] target/s390x: Fix LRA overwriting the top 32 bits
 on DAT error

When a DAT error occurs, LRA is supposed to write the error information
to the bottom 32 bits of R1, and leave the top 32 bits of R1 alone.

Fix by passing the original value of R1 into helper and copying the
top 32 bits to the return value.

Fixes: d8fe4a9c284f ("target-s390: Convert LRA")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: qemu-stable@nongnu.org
Message-Id: <20230704081506.276055-6-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/helper.h         | 2 +-
 target/s390x/tcg/mem_helper.c | 4 ++--
 target/s390x/tcg/translate.c  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/s390x/helper.h b/target/s390x/helper.h
index 6bc01df73d..05102578fc 100644
--- a/target/s390x/helper.h
+++ b/target/s390x/helper.h
@@ -355,7 +355,7 @@ DEF_HELPER_FLAGS_4(idte, TCG_CALL_NO_RWG, void, env, i64, i64, i32)
 DEF_HELPER_FLAGS_4(ipte, TCG_CALL_NO_RWG, void, env, i64, i64, i32)
 DEF_HELPER_FLAGS_1(ptlb, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_1(purge, TCG_CALL_NO_RWG, void, env)
-DEF_HELPER_2(lra, i64, env, i64)
+DEF_HELPER_3(lra, i64, env, i64, i64)
 DEF_HELPER_1(per_check_exception, void, env)
 DEF_HELPER_FLAGS_3(per_branch, TCG_CALL_NO_RWG, void, env, i64, i64)
 DEF_HELPER_FLAGS_2(per_ifetch, TCG_CALL_NO_RWG, void, env, i64)
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 84ad85212c..f417fb1183 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -2356,7 +2356,7 @@ void HELPER(purge)(CPUS390XState *env)
 }
 
 /* load real address */
-uint64_t HELPER(lra)(CPUS390XState *env, uint64_t addr)
+uint64_t HELPER(lra)(CPUS390XState *env, uint64_t r1, uint64_t addr)
 {
     uint64_t asc = env->psw.mask & PSW_MASK_ASC;
     uint64_t ret, tec;
@@ -2370,7 +2370,7 @@ uint64_t HELPER(lra)(CPUS390XState *env, uint64_t addr)
     exc = mmu_translate(env, addr, MMU_S390_LRA, asc, &ret, &flags, &tec);
     if (exc) {
         cc = 3;
-        ret = exc | 0x80000000;
+        ret = (r1 & 0xFFFFFFFF00000000ULL) | exc | 0x80000000;
     } else {
         cc = 0;
         ret |= addr & ~TARGET_PAGE_MASK;
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 0cef6efbef..a6079ab7b4 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -2932,7 +2932,7 @@ static DisasJumpType op_lctlg(DisasContext *s, DisasOps *o)
 
 static DisasJumpType op_lra(DisasContext *s, DisasOps *o)
 {
-    gen_helper_lra(o->out, cpu_env, o->in2);
+    gen_helper_lra(o->out, cpu_env, o->out, o->in2);
     set_cc_static(s);
     return DISAS_NEXT;
 }

From b0ef81062d2404ccef0289b1cc6e70244901c9be Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:30 +0200
Subject: [PATCH 0619/1353] target/s390x: Fix LRA when DAT is off

LRA should perform DAT regardless of whether it's on or off.
Disable DAT check for MMU_S390_LRA.

Fixes: defb0e3157af ("s390x: Implement opcode helpers")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: qemu-stable@nongnu.org
Message-Id: <20230704081506.276055-7-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/mmu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index b04b57c235..fbb2f1b4d4 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -417,7 +417,7 @@ int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
 
     vaddr &= TARGET_PAGE_MASK;
 
-    if (!(env->psw.mask & PSW_MASK_DAT)) {
+    if (rw != MMU_S390_LRA && !(env->psw.mask & PSW_MASK_DAT)) {
         *raddr = vaddr;
         goto nodat;
     }

From 349372ff9e3e7c047e258383f061a8617f66adc3 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:31 +0200
Subject: [PATCH 0620/1353] target/s390x: Fix relative long instructions with
 large offsets

The expression "imm * 2" in gen_ri2() can wrap around if imm is large
enough.

Fix by casting imm to int64_t, like it's done in disas_jdest().

Fixes: e8ecdfeb30f0 ("Fix EXECUTE of relative branches")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230704081506.276055-8-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index a6079ab7b4..6661b27efa 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -5794,7 +5794,7 @@ static TCGv gen_ri2(DisasContext *s)
 
     disas_jdest(s, i2, is_imm, imm, ri2);
     if (is_imm) {
-        ri2 = tcg_constant_i64(s->base.pc_next + imm * 2);
+        ri2 = tcg_constant_i64(s->base.pc_next + (int64_t)imm * 2);
     }
 
     return ri2;

From f5c2ae7134e388cd543fa0383191a30ea07d272b Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:32 +0200
Subject: [PATCH 0621/1353] tests/tcg/s390x: Test EPSW

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230704081506.276055-9-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/epsw.c          | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 tests/tcg/s390x/epsw.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index 85abfbb98c..2ef22c88d9 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -36,6 +36,7 @@ TESTS+=rxsbg
 TESTS+=ex-relative-long
 TESTS+=ex-branch
 TESTS+=mxdb
+TESTS+=epsw
 
 cdsg: CFLAGS+=-pthread
 cdsg: LDFLAGS+=-pthread
diff --git a/tests/tcg/s390x/epsw.c b/tests/tcg/s390x/epsw.c
new file mode 100644
index 0000000000..affb1a5e3a
--- /dev/null
+++ b/tests/tcg/s390x/epsw.c
@@ -0,0 +1,23 @@
+/*
+ * Test the EPSW instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <stdlib.h>
+
+int main(void)
+{
+    unsigned long r1 = 0x1234567887654321UL, r2 = 0x8765432112345678UL;
+
+    asm("cr %[r1],%[r2]\n"  /* cc = 1 */
+        "epsw %[r1],%[r2]"
+        : [r1] "+r" (r1), [r2] "+r" (r2) : : "cc");
+
+    /* Do not check the R and RI bits. */
+    r1 &= ~0x40000008UL;
+    assert(r1 == 0x1234567807051001UL);
+    assert(r2 == 0x8765432180000000UL);
+
+    return EXIT_SUCCESS;
+}

From ad85ac6a8f8325b6a15058e99d76203b4cde6044 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:33 +0200
Subject: [PATCH 0622/1353] tests/tcg/s390x: Test LARL with a large offset

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230704081506.276055-10-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/larl.c          | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 tests/tcg/s390x/larl.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index 2ef22c88d9..dbf64c991e 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -37,6 +37,7 @@ TESTS+=ex-relative-long
 TESTS+=ex-branch
 TESTS+=mxdb
 TESTS+=epsw
+TESTS+=larl
 
 cdsg: CFLAGS+=-pthread
 cdsg: LDFLAGS+=-pthread
diff --git a/tests/tcg/s390x/larl.c b/tests/tcg/s390x/larl.c
new file mode 100644
index 0000000000..7c95f89be7
--- /dev/null
+++ b/tests/tcg/s390x/larl.c
@@ -0,0 +1,21 @@
+/*
+ * Test the LARL instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <stdlib.h>
+
+int main(void)
+{
+    long algfi = (long)main;
+    long larl;
+
+    /*
+     * The compiler may emit larl for the C addition, so compute the expected
+     * value using algfi.
+     */
+    asm("algfi %[r],0xd0000000" : [r] "+r" (algfi) : : "cc");
+    asm("larl %[r],main+0xd0000000" : [r] "=r" (larl));
+
+    return algfi == larl ? EXIT_SUCCESS : EXIT_FAILURE;
+}

From 028dc70e1826ab182a84fb4ed43241fef1320a02 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:34 +0200
Subject: [PATCH 0623/1353] tests/tcg/s390x: Test LRA

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230704081506.276055-11-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/lra.S                   | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 tests/tcg/s390x/lra.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index 44dfd71629..242c7b0f83 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -20,6 +20,7 @@ ASM_TESTS =                                                                    \
     sam                                                                        \
     lpsw                                                                       \
     lpswe-early                                                                \
+    lra                                                                        \
     ssm-early                                                                  \
     stosm-early                                                                \
     unaligned-lowcore
diff --git a/tests/tcg/s390x/lra.S b/tests/tcg/s390x/lra.S
new file mode 100644
index 0000000000..79ab86f36b
--- /dev/null
+++ b/tests/tcg/s390x/lra.S
@@ -0,0 +1,19 @@
+    .org 0x200                         /* lowcore padding */
+    .globl _start
+_start:
+    lgrl %r1,initial_r1
+    lra %r1,0(%r1)
+    cgrl %r1,expected_r1
+    jne 1f
+    lpswe success_psw
+1:
+    lpswe failure_psw
+    .align 8
+initial_r1:
+    .quad 0x8765432112345678
+expected_r1:
+    .quad 0x8765432180000038           /* ASCE type exception */
+success_psw:
+    .quad 0x2000000000000,0xfff        /* see is_special_wait_psw() */
+failure_psw:
+    .quad 0x2000000000000,0            /* disabled wait */

From 85411ac9b3e1164c4deb2e9eed6c152ef64f2c51 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:35 +0200
Subject: [PATCH 0624/1353] tests/tcg/s390x: Test MDEB and MDEBR

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230704081506.276055-12-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/mdeb.c          | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 tests/tcg/s390x/mdeb.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index dbf64c991e..19fbbc6e53 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -38,6 +38,7 @@ TESTS+=ex-branch
 TESTS+=mxdb
 TESTS+=epsw
 TESTS+=larl
+TESTS+=mdeb
 
 cdsg: CFLAGS+=-pthread
 cdsg: LDFLAGS+=-pthread
diff --git a/tests/tcg/s390x/mdeb.c b/tests/tcg/s390x/mdeb.c
new file mode 100644
index 0000000000..4897d28069
--- /dev/null
+++ b/tests/tcg/s390x/mdeb.c
@@ -0,0 +1,30 @@
+/*
+ * Test the MDEB and MDEBR instructions.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <stdlib.h>
+
+int main(void)
+{
+    union {
+        float f[2];
+        double d;
+    } a;
+    float b;
+
+    a.f[0] = 1.2345;
+    a.f[1] = 999;
+    b = 6.789;
+    asm("mdeb %[a],%[b]" : [a] "+f" (a.d) : [b] "R" (b));
+    assert(a.d > 8.38 && a.d < 8.39);
+
+    a.f[0] = 1.2345;
+    a.f[1] = 999;
+    b = 6.789;
+    asm("mdebr %[a],%[b]" : [a] "+f" (a.d) : [b] "f" (b));
+    assert(a.d > 8.38 && a.d < 8.39);
+
+    return EXIT_SUCCESS;
+}

From bfde1be8b3417bf9080175fefac0becb81814631 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 4 Jul 2023 10:12:36 +0200
Subject: [PATCH 0625/1353] tests/tcg/s390x: Test MVCRL with a large value in
 R0

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230704081506.276055-13-iii@linux.ibm.com>
[thuth: Apply fix for compiling with GCC 11]
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/mie3-mvcrl.c | 46 ++++++++++++++++++++++++++++--------
 1 file changed, 36 insertions(+), 10 deletions(-)

diff --git a/tests/tcg/s390x/mie3-mvcrl.c b/tests/tcg/s390x/mie3-mvcrl.c
index 93c7b0a290..6d3d049f2c 100644
--- a/tests/tcg/s390x/mie3-mvcrl.c
+++ b/tests/tcg/s390x/mie3-mvcrl.c
@@ -1,29 +1,55 @@
+#include <stdbool.h>
 #include <stdint.h>
+#include <stdlib.h>
 #include <string.h>
 
-
-static inline void mvcrl_8(const char *dst, const char *src)
+static void mvcrl(const char *dst, const char *src, size_t len)
 {
+    register long r0 asm("r0") = len;
+
     asm volatile (
-        "llill %%r0, 8\n"
         ".insn sse, 0xE50A00000000, 0(%[dst]), 0(%[src])"
-        : : [dst] "d" (dst), [src] "d" (src)
-        : "r0", "memory");
+        : : [dst] "d" (dst), [src] "d" (src), "r" (r0)
+        : "memory");
 }
 
-
-int main(int argc, char *argv[])
+static bool test(void)
 {
     const char *alpha = "abcdefghijklmnop";
 
     /* array missing 'i' */
-    char tstr[17] = "abcdefghjklmnop\0" ;
+    char tstr[17] = "abcdefghjklmnop\0";
 
     /* mvcrl reference use: 'open a hole in an array' */
-    mvcrl_8(tstr + 9, tstr + 8);
+    mvcrl(tstr + 9, tstr + 8, 8);
 
     /* place missing 'i' */
     tstr[8] = 'i';
 
-    return strncmp(alpha, tstr, 16ul);
+    return strncmp(alpha, tstr, 16ul) == 0;
+}
+
+static bool test_bad_r0(void)
+{
+    char src[256] = { 0 };
+
+    /*
+     * PoP says: Bits 32-55 of general register 0 should contain zeros;
+     * otherwise, the program may not operate compatibly in the future.
+     *
+     * Try it anyway in order to check whether this would crash QEMU itself.
+     */
+    mvcrl(src, src, (size_t)-1);
+
+    return true;
+}
+
+int main(void)
+{
+    bool ok = true;
+
+    ok &= test();
+    ok &= test_bad_r0();
+
+    return ok ? EXIT_SUCCESS : EXIT_FAILURE;
 }

From 5a7d4dc9f84b1531cfd741404f44f3ad9c30faa7 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 4 Jul 2023 09:16:53 +0200
Subject: [PATCH 0626/1353] tests/qtest/readconfig-test: Allow testing for
 arbitrary memory sizes

Make test_x86_memdev_resp() more flexible by allowing arbitrary
memory sizes as parameter here.

Message-Id: <20230704071655.75381-2-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/readconfig-test.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/readconfig-test.c b/tests/qtest/readconfig-test.c
index ac7242451b..74526f3af2 100644
--- a/tests/qtest/readconfig-test.c
+++ b/tests/qtest/readconfig-test.c
@@ -48,7 +48,7 @@ static QTestState *qtest_init_with_config(const char *cfgdata)
     return qts;
 }
 
-static void test_x86_memdev_resp(QObject *res)
+static void test_x86_memdev_resp(QObject *res, const char *mem_id, int size)
 {
     Visitor *v;
     g_autoptr(MemdevList) memdevs = NULL;
@@ -63,8 +63,8 @@ static void test_x86_memdev_resp(QObject *res)
     g_assert(!memdevs->next);
 
     memdev = memdevs->value;
-    g_assert_cmpstr(memdev->id, ==, "ram");
-    g_assert_cmpint(memdev->size, ==, 200 * MiB);
+    g_assert_cmpstr(memdev->id, ==, mem_id);
+    g_assert_cmpint(memdev->size, ==, size * MiB);
 
     visit_free(v);
 }
@@ -80,7 +80,7 @@ static void test_x86_memdev(void)
     qts = qtest_init_with_config(cfgdata);
     /* Test valid command */
     resp = qtest_qmp(qts, "{ 'execute': 'query-memdev' }");
-    test_x86_memdev_resp(qdict_get(resp, "return"));
+    test_x86_memdev_resp(qdict_get(resp, "return"), "ram", 200);
     qobject_unref(resp);
 
     qtest_quit(qts);

From 25919c4025313763c3c00035f439bd11579c2c38 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 4 Jul 2023 09:16:54 +0200
Subject: [PATCH 0627/1353] tests/qtest: Move mkimg() and have_qemu_img() from
 libqos to libqtest

These two functions can be useful for other qtests beside the
qos-test, too, so move them to libqtest instead.

Message-Id: <20230704071655.75381-3-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/libqos/libqos.c | 49 +---------------------------------
 tests/qtest/libqos/libqos.h |  2 --
 tests/qtest/libqtest.c      | 52 +++++++++++++++++++++++++++++++++++++
 tests/qtest/libqtest.h      | 20 ++++++++++++++
 4 files changed, 73 insertions(+), 50 deletions(-)

diff --git a/tests/qtest/libqos/libqos.c b/tests/qtest/libqos/libqos.c
index 5ffda080ec..5c0fa1f7c5 100644
--- a/tests/qtest/libqos/libqos.c
+++ b/tests/qtest/libqos/libqos.c
@@ -137,56 +137,9 @@ void migrate(QOSState *from, QOSState *to, const char *uri)
     migrate_allocator(&from->alloc, &to->alloc);
 }
 
-bool have_qemu_img(void)
-{
-    char *rpath;
-    const char *path = getenv("QTEST_QEMU_IMG");
-    if (!path) {
-        return false;
-    }
-
-    rpath = realpath(path, NULL);
-    if (!rpath) {
-        return false;
-    } else {
-        free(rpath);
-        return true;
-    }
-}
-
-void mkimg(const char *file, const char *fmt, unsigned size_mb)
-{
-    gchar *cli;
-    bool ret;
-    int rc;
-    GError *err = NULL;
-    char *qemu_img_path;
-    gchar *out, *out2;
-    char *qemu_img_abs_path;
-
-    qemu_img_path = getenv("QTEST_QEMU_IMG");
-    g_assert(qemu_img_path);
-    qemu_img_abs_path = realpath(qemu_img_path, NULL);
-    g_assert(qemu_img_abs_path);
-
-    cli = g_strdup_printf("%s create -f %s %s %uM", qemu_img_abs_path,
-                          fmt, file, size_mb);
-    ret = g_spawn_command_line_sync(cli, &out, &out2, &rc, &err);
-    if (err || !g_spawn_check_exit_status(rc, &err)) {
-        fprintf(stderr, "%s\n", err->message);
-        g_error_free(err);
-    }
-    g_assert(ret && !err);
-
-    g_free(out);
-    g_free(out2);
-    g_free(cli);
-    free(qemu_img_abs_path);
-}
-
 void mkqcow2(const char *file, unsigned size_mb)
 {
-    return mkimg(file, "qcow2", size_mb);
+    g_assert_true(mkimg(file, "qcow2", size_mb));
 }
 
 void prepare_blkdebug_script(const char *debug_fn, const char *event)
diff --git a/tests/qtest/libqos/libqos.h b/tests/qtest/libqos/libqos.h
index 12d05b2365..c04950e2b1 100644
--- a/tests/qtest/libqos/libqos.h
+++ b/tests/qtest/libqos/libqos.h
@@ -27,8 +27,6 @@ QOSState *qtest_boot(QOSOps *ops, const char *cmdline_fmt, ...)
     G_GNUC_PRINTF(2, 3);
 void qtest_common_shutdown(QOSState *qs);
 void qtest_shutdown(QOSState *qs);
-bool have_qemu_img(void);
-void mkimg(const char *file, const char *fmt, unsigned size_mb);
 void mkqcow2(const char *file, unsigned size_mb);
 void migrate(QOSState *from, QOSState *to, const char *uri);
 void prepare_blkdebug_script(const char *debug_fn, const char *event);
diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 79152f0ec3..c22dfc30d3 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -1742,3 +1742,55 @@ bool qtest_qom_get_bool(QTestState *s, const char *path, const char *property)
 
     return b;
 }
+
+bool have_qemu_img(void)
+{
+    char *rpath;
+    const char *path = getenv("QTEST_QEMU_IMG");
+    if (!path) {
+        return false;
+    }
+
+    rpath = realpath(path, NULL);
+    if (!rpath) {
+        return false;
+    } else {
+        free(rpath);
+        return true;
+    }
+}
+
+bool mkimg(const char *file, const char *fmt, unsigned size_mb)
+{
+    gchar *cli;
+    bool ret;
+    int rc;
+    GError *err = NULL;
+    char *qemu_img_path;
+    gchar *out, *out2;
+    char *qemu_img_abs_path;
+
+    qemu_img_path = getenv("QTEST_QEMU_IMG");
+    if (!qemu_img_path) {
+        return false;
+    }
+    qemu_img_abs_path = realpath(qemu_img_path, NULL);
+    if (!qemu_img_abs_path) {
+        return false;
+    }
+
+    cli = g_strdup_printf("%s create -f %s %s %uM", qemu_img_abs_path,
+                          fmt, file, size_mb);
+    ret = g_spawn_command_line_sync(cli, &out, &out2, &rc, &err);
+    if (err || !g_spawn_check_exit_status(rc, &err)) {
+        fprintf(stderr, "%s\n", err->message);
+        g_error_free(err);
+    }
+
+    g_free(out);
+    g_free(out2);
+    g_free(cli);
+    free(qemu_img_abs_path);
+
+    return ret && !err;
+}
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index 913acc3d5c..3a71bc45fc 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -994,4 +994,24 @@ bool qtest_qom_get_bool(QTestState *s, const char *path, const char *property);
  */
 pid_t qtest_pid(QTestState *s);
 
+/**
+ * have_qemu_img:
+ *
+ * Returns: true if "qemu-img" is available.
+ */
+bool have_qemu_img(void);
+
+/**
+ * mkimg:
+ * @file: File name of the image that should be created
+ * @fmt: Format, e.g. "qcow2" or "raw"
+ * @size_mb: Size of the image in megabytes
+ *
+ * Create a disk image with qemu-img. Note that the QTEST_QEMU_IMG
+ * environment variable must point to the qemu-img file.
+ *
+ * Returns: true if the image has been created successfully.
+ */
+bool mkimg(const char *file, const char *fmt, unsigned size_mb);
+
 #endif

From bc55e2eaa6d662f10a1f4cff0d285d77dbc9362a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 4 Jul 2023 09:16:55 +0200
Subject: [PATCH 0628/1353] tests/qtest/readconfig: Test the
 docs/config/q35-*.cfg files

Test that we can successfully parse the docs/config/q35-emulated.cfg,
docs/config/q35-virtio-graphical.cfg and docs/config/q35-virtio-serial.cfg
config files (the "...-serial.cfg" file is a subset of the graphical
config file, so we skip that in quick mode).

These config files use two hard-coded image names which we have to
replace with unique temporary files to avoid race conditions in case
the tests are run in parallel. So after creating the temporary image
files, we also have to create a copy of the config file where we
replaced the hard-coded image names.

If KVM is not available, we also have to disable the "accel" lines.
Once everything is in place, we can start QEMU with the modified
config file and check that everything is available in QEMU.

Message-Id: <20230704071655.75381-4-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/readconfig-test.c | 196 ++++++++++++++++++++++++++++++++++
 1 file changed, 196 insertions(+)

diff --git a/tests/qtest/readconfig-test.c b/tests/qtest/readconfig-test.c
index 74526f3af2..760f974e63 100644
--- a/tests/qtest/readconfig-test.c
+++ b/tests/qtest/readconfig-test.c
@@ -197,6 +197,189 @@ static void test_docs_config_ich9(void)
     qtest_quit(qts);
 }
 
+#if defined(CONFIG_POSIX) && defined(CONFIG_SLIRP)
+
+static char *make_temp_img(const char *template, const char *format, int size)
+{
+    GError *error = NULL;
+    char *temp_name;
+    int fd;
+
+    /* Create a temporary image names */
+    fd = g_file_open_tmp(template, &temp_name, &error);
+    if (fd == -1) {
+        fprintf(stderr, "unable to create file: %s\n", error->message);
+        g_error_free(error);
+        return NULL;
+    }
+    close(fd);
+
+    if (!mkimg(temp_name, format, size)) {
+        fprintf(stderr, "qemu-img failed to create %s\n", temp_name);
+        g_free(temp_name);
+        return NULL;
+    }
+
+    return temp_name;
+}
+
+struct device {
+    const char *name;
+    const char *type;
+};
+
+static void test_docs_q35(const char *input_file, struct device *devices)
+{
+    QTestState *qts;
+    QDict *resp;
+    QObject *qobj;
+    int ret, i;
+    g_autofree char *cfg_file = NULL, *sedcmd = NULL;
+    g_autofree char *hd_file = NULL, *cd_file = NULL;
+
+    /* Check that all the devices are available in the QEMU binary */
+    for (i = 0; devices[i].name; i++) {
+        if (!qtest_has_device(devices[i].type)) {
+            g_test_skip("one of the required devices is not available");
+            return;
+        }
+    }
+
+    hd_file = make_temp_img("qtest_disk_XXXXXX.qcow2", "qcow2", 1);
+    cd_file = make_temp_img("qtest_cdrom_XXXXXX.iso", "raw", 1);
+    if (!hd_file || !cd_file) {
+        g_test_skip("could not create disk images");
+        goto cleanup;
+    }
+
+    /* Create a temporary config file where we replace the disk image names */
+    ret = g_file_open_tmp("q35-emulated-XXXXXX.cfg", &cfg_file, NULL);
+    if (ret == -1) {
+        g_test_skip("could not create temporary config file");
+        goto cleanup;
+    }
+    close(ret);
+
+    sedcmd = g_strdup_printf("sed -e 's,guest.qcow2,%s,' -e 's,install.iso,%s,'"
+                             " %s %s > '%s'",
+                             hd_file, cd_file,
+                             !qtest_has_accel("kvm") ? "-e '/accel/d'" : "",
+                             input_file, cfg_file);
+    ret = system(sedcmd);
+    if (ret) {
+        g_test_skip("could not modify temporary config file");
+        goto cleanup;
+    }
+
+    qts = qtest_initf("-machine none -nodefaults -readconfig %s", cfg_file);
+
+    /* Check memory size */
+    resp = qtest_qmp(qts, "{ 'execute': 'query-memdev' }");
+    test_x86_memdev_resp(qdict_get(resp, "return"), "pc.ram", 1024);
+    qobject_unref(resp);
+
+    resp = qtest_qmp(qts, "{ 'execute': 'qom-list',"
+                          "  'arguments': {'path': '/machine/peripheral' }}");
+    qobj = qdict_get(resp, "return");
+
+    /* Check that all the devices have been created */
+    for (i = 0; devices[i].name; i++) {
+        test_object_available(qobj, devices[i].name, devices[i].type);
+    }
+
+    qobject_unref(resp);
+
+    qtest_quit(qts);
+
+cleanup:
+    if (hd_file) {
+        unlink(hd_file);
+    }
+    if (cd_file) {
+        unlink(cd_file);
+    }
+    if (cfg_file) {
+        unlink(cfg_file);
+    }
+}
+
+static void test_docs_q35_emulated(void)
+{
+    struct device devices[] = {
+        { "ich9-pcie-port-1", "ioh3420" },
+        { "ich9-pcie-port-2", "ioh3420" },
+        { "ich9-pcie-port-3", "ioh3420" },
+        { "ich9-pcie-port-4", "ioh3420" },
+        { "ich9-pci-bridge", "i82801b11-bridge" },
+        { "ich9-ehci-1", "ich9-usb-ehci1" },
+        { "ich9-ehci-2", "ich9-usb-ehci2" },
+        { "ich9-uhci-1", "ich9-usb-uhci1" },
+        { "ich9-uhci-2", "ich9-usb-uhci2" },
+        { "ich9-uhci-3", "ich9-usb-uhci3" },
+        { "ich9-uhci-4", "ich9-usb-uhci4" },
+        { "ich9-uhci-5", "ich9-usb-uhci5" },
+        { "ich9-uhci-6", "ich9-usb-uhci6" },
+        { "sata-disk", "ide-hd" },
+        { "sata-optical-disk", "ide-cd" },
+        { "net", "e1000" },
+        { "video", "VGA" },
+        { "ich9-hda-audio", "ich9-intel-hda" },
+        { "ich9-hda-duplex", "hda-duplex" },
+        { NULL, NULL }
+    };
+
+    test_docs_q35("docs/config/q35-emulated.cfg", devices);
+}
+
+static void test_docs_q35_virtio_graphical(void)
+{
+    struct device devices[] = {
+        { "pcie.1", "pcie-root-port" },
+        { "pcie.2", "pcie-root-port" },
+        { "pcie.3", "pcie-root-port" },
+        { "pcie.4", "pcie-root-port" },
+        { "pcie.5", "pcie-root-port" },
+        { "pcie.6", "pcie-root-port" },
+        { "pcie.7", "pcie-root-port" },
+        { "pcie.8", "pcie-root-port" },
+        { "scsi", "virtio-scsi-pci" },
+        { "scsi-disk", "scsi-hd" },
+        { "scsi-optical-disk", "scsi-cd" },
+        { "net", "virtio-net-pci" },
+        { "usb", "nec-usb-xhci" },
+        { "tablet", "usb-tablet" },
+        { "video", "qxl-vga" },
+        { "sound", "ich9-intel-hda" },
+        { "duplex", "hda-duplex" },
+        { NULL, NULL }
+    };
+
+    test_docs_q35("docs/config/q35-virtio-graphical.cfg", devices);
+}
+
+static void test_docs_q35_virtio_serial(void)
+{
+    struct device devices[] = {
+        { "pcie.1", "pcie-root-port" },
+        { "pcie.2", "pcie-root-port" },
+        { "pcie.3", "pcie-root-port" },
+        { "pcie.4", "pcie-root-port" },
+        { "pcie.5", "pcie-root-port" },
+        { "pcie.6", "pcie-root-port" },
+        { "pcie.7", "pcie-root-port" },
+        { "pcie.8", "pcie-root-port" },
+        { "scsi", "virtio-scsi-pci" },
+        { "scsi-disk", "scsi-hd" },
+        { "scsi-optical-disk", "scsi-cd" },
+        { "net", "virtio-net-pci" },
+        { NULL, NULL }
+    };
+
+    test_docs_q35("docs/config/q35-virtio-serial.cfg", devices);
+}
+
+#endif /* CONFIG_LINUX */
+
 int main(int argc, char *argv[])
 {
     const char *arch;
@@ -211,6 +394,19 @@ int main(int argc, char *argv[])
             qtest_has_device("ich9-usb-uhci1")) {
             qtest_add_func("readconfig/x86/ich9-ehci-uhci", test_docs_config_ich9);
         }
+#if defined(CONFIG_POSIX) && defined(CONFIG_SLIRP)
+        qtest_add_func("readconfig/x86/q35-emulated", test_docs_q35_emulated);
+        qtest_add_func("readconfig/x86/q35-virtio-graphical",
+                       test_docs_q35_virtio_graphical);
+        if (g_test_slow()) {
+            /*
+             * q35-virtio-serial.cfg is a subset of q35-virtio-graphical.cfg,
+             * so we can skip the test in quick mode
+             */
+            qtest_add_func("readconfig/x86/q35-virtio-serial",
+                           test_docs_q35_virtio_serial);
+        }
+#endif
     }
 #if defined(CONFIG_SPICE) && !defined(__FreeBSD__)
     qtest_add_func("readconfig/spice", test_spice);

From 9ffcbe2a60d24fc20b98f010dbca244df1fe82c5 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 3 Jul 2023 09:44:47 +0200
Subject: [PATCH 0629/1353] os-posix: Allow 'chroot' via '-run-with' and
 deprecate the old '-chroot' option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced "-run-with" for options that influence the
runtime behavior of QEMU. This option has the big advantage that it
can group related options (so that it is easier for the users to spot
them) and that the options become introspectable via QMP this way.
So let's start moving more switches into this option group, starting
with "-chroot" now.

Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Message-Id: <20230703074447.17044-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/about/deprecated.rst |  5 +++++
 os-posix.c                | 35 ++++++++++++++++++++++++++++++++++-
 qemu-options.hx           | 18 +++++++++++++-----
 util/async-teardown.c     | 21 ---------------------
 4 files changed, 52 insertions(+), 27 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index ddc1e48460..02ea5a839f 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -116,6 +116,11 @@ Use "whpx" (on Windows) or "hvf" (on macOS) instead.
 
 Use ``-run-with async-teardown=on`` instead.
 
+``-chroot`` (since 8.1)
+'''''''''''''''''''''''
+
+Use ``-run-with chroot=dir`` instead.
+
 ``-singlestep`` (since 8.1)
 '''''''''''''''''''''''''''
 
diff --git a/os-posix.c b/os-posix.c
index 90ea71725f..cfcb96533c 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -38,6 +38,7 @@
 #include "qemu/cutils.h"
 #include "qemu/config-file.h"
 #include "qemu/option.h"
+#include "qemu/module.h"
 
 #ifdef CONFIG_LINUX
 #include <sys/prctl.h>
@@ -148,6 +149,7 @@ int os_parse_cmd_args(int index, const char *optarg)
         }
         break;
     case QEMU_OPTION_chroot:
+        warn_report("option is deprecated, use '-run-with chroot=...' instead");
         chroot_dir = optarg;
         break;
     case QEMU_OPTION_daemonize:
@@ -158,18 +160,25 @@ int os_parse_cmd_args(int index, const char *optarg)
     case QEMU_OPTION_asyncteardown:
         init_async_teardown();
         break;
+#endif
     case QEMU_OPTION_run_with: {
+        const char *str;
         QemuOpts *opts = qemu_opts_parse_noisily(qemu_find_opts("run-with"),
                                                  optarg, false);
         if (!opts) {
             exit(1);
         }
+#if defined(CONFIG_LINUX)
         if (qemu_opt_get_bool(opts, "async-teardown", false)) {
             init_async_teardown();
         }
+#endif
+        str = qemu_opt_get(opts, "chroot");
+        if (str) {
+            chroot_dir = str;
+        }
         break;
     }
-#endif
     default:
         return -1;
     }
@@ -348,3 +357,27 @@ int os_mlock(void)
     return -ENOSYS;
 #endif
 }
+
+static QemuOptsList qemu_run_with_opts = {
+    .name = "run-with",
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_run_with_opts.head),
+    .desc = {
+#if defined(CONFIG_LINUX)
+        {
+            .name = "async-teardown",
+            .type = QEMU_OPT_BOOL,
+        },
+#endif
+        {
+            .name = "chroot",
+            .type = QEMU_OPT_STRING,
+        },
+        { /* end of list */ }
+    },
+};
+
+static void register_runwith(void)
+{
+    qemu_add_opts(&qemu_run_with_opts);
+}
+opts_init(register_runwith);
diff --git a/qemu-options.hx b/qemu-options.hx
index 96087505b2..f8f384e551 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4677,11 +4677,12 @@ ERST
 
 #ifndef _WIN32
 DEF("chroot", HAS_ARG, QEMU_OPTION_chroot, \
-    "-chroot dir     chroot to dir just before starting the VM\n",
+    "-chroot dir     chroot to dir just before starting the VM (deprecated)\n",
     QEMU_ARCH_ALL)
 #endif
 SRST
 ``-chroot dir``
+    Deprecated, use '-run-with chroot=...' instead.
     Immediately before starting guest execution, chroot to the specified
     directory. Especially useful in combination with -runas.
 ERST
@@ -4868,13 +4869,16 @@ SRST
     This option is deprecated and should no longer be used. The new option
     ``-run-with async-teardown=on`` is a replacement.
 ERST
+#endif
+#ifdef CONFIG_POSIX
 DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
-    "-run-with async-teardown[=on|off]\n"
-    "                misc QEMU process lifecycle options\n"
-    "                async-teardown=on enables asynchronous teardown\n",
+    "-run-with [async-teardown=on|off][,chroot=dir]\n"
+    "                Set miscellaneous QEMU process lifecycle options:\n"
+    "                async-teardown=on enables asynchronous teardown (Linux only)\n"
+    "                chroot=dir chroot to dir just before starting the VM\n",
     QEMU_ARCH_ALL)
 SRST
-``-run-with``
+``-run-with [async-teardown=on|off][,chroot=dir]``
     Set QEMU process lifecycle options.
 
     ``async-teardown=on`` enables asynchronous teardown. A new process called
@@ -4887,6 +4891,10 @@ SRST
     performed correctly. This only works if the cleanup process is not
     forcefully killed with SIGKILL before the main QEMU process has
     terminated completely.
+
+    ``chroot=dir`` can be used for doing a chroot to the specified directory
+    immediately before starting the guest execution. This is especially useful
+    in combination with -runas.
 ERST
 #endif
 
diff --git a/util/async-teardown.c b/util/async-teardown.c
index 3ab19c8740..62cdeb0f20 100644
--- a/util/async-teardown.c
+++ b/util/async-teardown.c
@@ -12,9 +12,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/config-file.h"
-#include "qemu/option.h"
-#include "qemu/module.h"
 #include <dirent.h>
 #include <sys/prctl.h>
 #include <sched.h>
@@ -147,21 +144,3 @@ void init_async_teardown(void)
     clone(async_teardown_fn, new_stack_for_clone(), CLONE_VM, NULL);
     sigprocmask(SIG_SETMASK, &old_signals, NULL);
 }
-
-static QemuOptsList qemu_run_with_opts = {
-    .name = "run-with",
-    .head = QTAILQ_HEAD_INITIALIZER(qemu_run_with_opts.head),
-    .desc = {
-        {
-            .name = "async-teardown",
-            .type = QEMU_OPT_BOOL,
-        },
-        { /* end of list */ }
-    },
-};
-
-static void register_teardown(void)
-{
-    qemu_add_opts(&qemu_run_with_opts);
-}
-opts_init(register_teardown);

From 6db77bb2c1aa1e59b4a04ba3c9b4b8bb17609d48 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 5 Jul 2023 15:36:39 +0200
Subject: [PATCH 0630/1353] meson.build: Skip C++ detection unless we're
 targeting Windows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only C++ code that we currently still have in the repository
is the code in qga/vss-win32/ - so we can skip the C++ detection
unless we are compiling binaries for Windows.

Message-Id: <20230705133639.146073-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index 58413d44a5..162e664c2b 100644
--- a/meson.build
+++ b/meson.build
@@ -20,7 +20,7 @@ config_host = keyval.load(meson.current_build_dir() / 'config-host.mak')
 
 cc = meson.get_compiler('c')
 all_languages = ['c']
-if add_languages('cpp', required: false, native: false)
+if targetos == 'windows' and add_languages('cpp', required: false, native: false)
   all_languages += ['cpp']
   cxx = meson.get_compiler('cpp')
 endif

From cb2d7e63d19794c5344d438d943a8680d6756bdc Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Fri, 7 Jul 2023 17:42:21 +0200
Subject: [PATCH 0631/1353] tests/tcg/s390x: Fix test-svc with clang

clang does not support expressions involving symbols in instructions
like lghi yet, so building hello-s390x-asm.S with it fails.

Move the expression to the literal pool and load it from there.

Fixes: be4a4cb42961 ("tests/tcg/s390x: Test single-stepping SVC")
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230707154242.457706-1-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/gdbstub/test-svc.py | 2 +-
 tests/tcg/s390x/hello-s390x-asm.S   | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/tcg/s390x/gdbstub/test-svc.py b/tests/tcg/s390x/gdbstub/test-svc.py
index 7851ca7284..18fad3f163 100644
--- a/tests/tcg/s390x/gdbstub/test-svc.py
+++ b/tests/tcg/s390x/gdbstub/test-svc.py
@@ -25,7 +25,7 @@ def run_test():
     gdb.execute("si")
     report("larl\t" in gdb.execute("x/i $pc", False, True), "insn #2")
     gdb.execute("si")
-    report("lghi\t" in gdb.execute("x/i $pc", False, True), "insn #3")
+    report("lgrl\t" in gdb.execute("x/i $pc", False, True), "insn #3")
     gdb.execute("si")
     report("svc\t" in gdb.execute("x/i $pc", False, True), "insn #4")
     gdb.execute("si")
diff --git a/tests/tcg/s390x/hello-s390x-asm.S b/tests/tcg/s390x/hello-s390x-asm.S
index 2e9faa1604..4dbda12d35 100644
--- a/tests/tcg/s390x/hello-s390x-asm.S
+++ b/tests/tcg/s390x/hello-s390x-asm.S
@@ -8,7 +8,7 @@ _start:
 /* puts("Hello, World!"); */
 lghi %r2,1
 larl %r3,foo
-lghi %r4,foo_end-foo
+lgrl %r4,foo_len
 svc 4
 
 /* exit(0); */
@@ -18,3 +18,5 @@ svc 1
 .align 2
 foo: .asciz "Hello, World!\n"
 foo_end:
+.align 8
+foo_len: .quad foo_end-foo

From e02f56e3dee8dffc194e74275439f1975552da78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 1 Jun 2023 17:13:47 +0100
Subject: [PATCH 0632/1353] tests/qtest: massively speed up migration-test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The migration test cases that actually exercise live migration want to
ensure there is a minimum of two iterations of pre-copy, in order to
exercise the dirty tracking code.

Historically we've queried the migration status, looking for the
'dirty-sync-count' value to increment to track iterations. This was
not entirely reliable because often all the data would get transferred
quickly enough that the migration would finish before we wanted it
to. So we massively dropped the bandwidth and max downtime to
guarantee non-convergance. This had the unfortunate side effect
that every migration took at least 30 seconds to run (100 MB of
dirty pages / 3 MB/sec).

This optimization takes a different approach to ensuring that a
mimimum of two iterations. Rather than waiting for dirty-sync-count
to increment, directly look for an indication that the source VM
has dirtied RAM that has already been transferred.

On the source VM a magic marker is written just after the 3 MB
offset. The destination VM is now montiored to detect when the
magic marker is transferred. This gives a guarantee that the
first 3 MB of memory have been transferred. Now the source VM
memory is monitored at exactly the 3MB offset until we observe
a flip in its value. This gives us a guaranteed that the guest
workload has dirtied a byte that has already been transferred.

Since we're looking at a place that is only 3 MB from the start
of memory, with the 3 MB/sec bandwidth, this test should complete
in 1 second, instead of 30 seconds.

Once we've proved there is some dirty memory, migration can be
set back to full speed for the remainder of the 1st iteration,
and the entire of the second iteration at which point migration
should be complete.

On a test machine this further reduces the migration test time
from 8 minutes to 1 minute 40.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230601161347.1803440-11-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/migration-test.c | 143 ++++++++++++++++++++++++++++++-----
 1 file changed, 125 insertions(+), 18 deletions(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index b9cc194100..efa8c729db 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -46,6 +46,20 @@ static bool uffd_feature_thread_id;
 static bool got_src_stop;
 static bool got_dst_resume;
 
+/*
+ * An initial 3 MB offset is used as that corresponds
+ * to ~1 sec of data transfer with our bandwidth setting.
+ */
+#define MAGIC_OFFSET_BASE (3 * 1024 * 1024)
+/*
+ * A further 1k is added to ensure we're not a multiple
+ * of TEST_MEM_PAGE_SIZE, thus avoid clash with writes
+ * from the migration guest workload.
+ */
+#define MAGIC_OFFSET_SHUFFLE 1024
+#define MAGIC_OFFSET (MAGIC_OFFSET_BASE + MAGIC_OFFSET_SHUFFLE)
+#define MAGIC_MARKER 0xFEED12345678CAFEULL
+
 /*
  * Dirtylimit stop working if dirty page rate error
  * value less than DIRTYLIMIT_TOLERANCE_RANGE
@@ -445,6 +459,91 @@ static void migrate_ensure_converge(QTestState *who)
     migrate_set_parameter_int(who, "downtime-limit", 30 * 1000);
 }
 
+/*
+ * Our goal is to ensure that we run a single full migration
+ * iteration, and also dirty memory, ensuring that at least
+ * one further iteration is required.
+ *
+ * We can't directly synchronize with the start of a migration
+ * so we have to apply some tricks monitoring memory that is
+ * transferred.
+ *
+ * Initially we set the migration bandwidth to an insanely
+ * low value, with tiny max downtime too. This basically
+ * guarantees migration will never complete.
+ *
+ * This will result in a test that is unacceptably slow though,
+ * so we can't let the entire migration pass run at this speed.
+ * Our intent is to let it run just long enough that we can
+ * prove data prior to the marker has been transferred *AND*
+ * also prove this transferred data is dirty again.
+ *
+ * Before migration starts, we write a 64-bit magic marker
+ * into a fixed location in the src VM RAM.
+ *
+ * Then watch dst memory until the marker appears. This is
+ * proof that start_address -> MAGIC_OFFSET_BASE has been
+ * transferred.
+ *
+ * Finally we go back to the source and read a byte just
+ * before the marker untill we see it flip in value. This
+ * is proof that start_address -> MAGIC_OFFSET_BASE
+ * is now dirty again.
+ *
+ * IOW, we're guaranteed at least a 2nd migration pass
+ * at this point.
+ *
+ * We can now let migration run at full speed to finish
+ * the test
+ */
+static void migrate_prepare_for_dirty_mem(QTestState *from)
+{
+    /*
+     * The guest workflow iterates from start_address to
+     * end_address, writing 1 byte every TEST_MEM_PAGE_SIZE
+     * bytes.
+     *
+     * IOW, if we write to mem at a point which is NOT
+     * a multiple of TEST_MEM_PAGE_SIZE, our write won't
+     * conflict with the migration workflow.
+     *
+     * We put in a marker here, that we'll use to determine
+     * when the data has been transferred to the dst.
+     */
+    qtest_writeq(from, start_address + MAGIC_OFFSET, MAGIC_MARKER);
+}
+
+static void migrate_wait_for_dirty_mem(QTestState *from,
+                                       QTestState *to)
+{
+    uint64_t watch_address = start_address + MAGIC_OFFSET_BASE;
+    uint64_t marker_address = start_address + MAGIC_OFFSET;
+    uint8_t watch_byte;
+
+    /*
+     * Wait for the MAGIC_MARKER to get transferred, as an
+     * indicator that a migration pass has made some known
+     * amount of progress.
+     */
+    do {
+        usleep(1000 * 10);
+    } while (qtest_readq(to, marker_address) != MAGIC_MARKER);
+
+    /*
+     * Now ensure that already transferred bytes are
+     * dirty again from the guest workload. Note the
+     * guest byte value will wrap around and by chance
+     * match the original watch_byte. This is harmless
+     * as we'll eventually see a different value if we
+     * keep watching
+     */
+    watch_byte = qtest_readb(from, watch_address);
+    do {
+        usleep(1000 * 10);
+    } while (qtest_readb(from, watch_address) == watch_byte);
+}
+
+
 static void migrate_pause(QTestState *who)
 {
     qtest_qmp_assert_success(who, "{ 'execute': 'migrate-pause' }");
@@ -577,7 +676,10 @@ typedef struct {
         MIG_TEST_FAIL_DEST_QUIT_ERR,
     } result;
 
-    /* Optional: set number of migration passes to wait for, if live==true */
+    /*
+     * Optional: set number of migration passes to wait for, if live==true.
+     * If zero, then merely wait for a few MB of dirty data
+     */
     unsigned int iterations;
 
     /*
@@ -1165,12 +1267,14 @@ static int migrate_postcopy_prepare(QTestState **from_ptr,
 
     migrate_ensure_non_converge(from);
 
+    migrate_prepare_for_dirty_mem(from);
+
     /* Wait for the first serial output from the source */
     wait_for_serial("src_serial");
 
     migrate_qmp(from, uri, "{}");
 
-    wait_for_migration_pass(from);
+    migrate_wait_for_dirty_mem(from, to);
 
     *from_ptr = from;
     *to_ptr = to;
@@ -1405,14 +1509,8 @@ static void test_precopy_common(MigrateCommon *args)
     }
 
     if (args->live) {
-        /*
-         * Testing live migration, we want to ensure that some
-         * memory is re-dirtied after being transferred, so that
-         * we exercise logic for dirty page handling. We achieve
-         * this with a ridiculosly low bandwidth that guarantees
-         * non-convergance.
-         */
         migrate_ensure_non_converge(from);
+        migrate_prepare_for_dirty_mem(from);
     } else {
         /*
          * Testing non-live migration, we allow it to run at
@@ -1447,13 +1545,16 @@ static void test_precopy_common(MigrateCommon *args)
         }
     } else {
         if (args->live) {
-            if (args->iterations) {
-                while (args->iterations--) {
-                    wait_for_migration_pass(from);
-                }
-            } else {
+            /*
+             * For initial iteration(s) we must do a full pass,
+             * but for the final iteration, we need only wait
+             * for some dirty mem before switching to converge
+             */
+            while (args->iterations > 1) {
                 wait_for_migration_pass(from);
+                args->iterations--;
             }
+            migrate_wait_for_dirty_mem(from, to);
 
             migrate_ensure_converge(from);
 
@@ -1586,6 +1687,9 @@ static void test_ignore_shared(void)
         return;
     }
 
+    migrate_ensure_non_converge(from);
+    migrate_prepare_for_dirty_mem(from);
+
     migrate_set_capability(from, "x-ignore-shared", true);
     migrate_set_capability(to, "x-ignore-shared", true);
 
@@ -1594,7 +1698,7 @@ static void test_ignore_shared(void)
 
     migrate_qmp(from, uri, "{}");
 
-    wait_for_migration_pass(from);
+    migrate_wait_for_dirty_mem(from, to);
 
     if (!got_src_stop) {
         qtest_qmp_eventwait(from, "STOP");
@@ -2325,6 +2429,7 @@ static void test_multifd_tcp_cancel(void)
     }
 
     migrate_ensure_non_converge(from);
+    migrate_prepare_for_dirty_mem(from);
 
     migrate_set_parameter_int(from, "multifd-channels", 16);
     migrate_set_parameter_int(to, "multifd-channels", 16);
@@ -2343,7 +2448,7 @@ static void test_multifd_tcp_cancel(void)
 
     migrate_qmp(from, uri, "{}");
 
-    wait_for_migration_pass(from);
+    migrate_wait_for_dirty_mem(from, to);
 
     migrate_cancel(from);
 
@@ -2372,11 +2477,13 @@ static void test_multifd_tcp_cancel(void)
 
     wait_for_migration_status(from, "cancelled", NULL);
 
-    migrate_ensure_converge(from);
+    migrate_ensure_non_converge(from);
 
     migrate_qmp(from, uri, "{}");
 
-    wait_for_migration_pass(from);
+    migrate_wait_for_dirty_mem(from, to);
+
+    migrate_ensure_converge(from);
 
     if (!got_src_stop) {
         qtest_qmp_eventwait(from, "STOP");

From 7233bd122370155abfd75a42c86a9087ca5a8dbf Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 10 Jul 2023 11:26:38 +0200
Subject: [PATCH 0633/1353] docs/devel: Fix coding style in style.rst
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As defined earlier in this file, the opening curly brace of
functions should be placed on a separate line. So we should
do it in the examples here, too.

Fixes: 821f296756 ("docs: document use of automatic cleanup functions in glib")
Reported-by: Konstantin Kostiuk <kkostiuk@redhat.com>
Message-Id: <20230710092638.161625-1-thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/devel/style.rst | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/devel/style.rst b/docs/devel/style.rst
index aa5e083ff8..3cfcdeb9cd 100644
--- a/docs/devel/style.rst
+++ b/docs/devel/style.rst
@@ -567,7 +567,8 @@ For example, instead of
 
 .. code-block:: c
 
-    int somefunc(void) {
+    int somefunc(void)
+    {
         int ret = -1;
         char *foo = g_strdup_printf("foo%", "wibble");
         GList *bar = .....
@@ -588,7 +589,8 @@ Using g_autofree/g_autoptr enables the code to be written as:
 
 .. code-block:: c
 
-    int somefunc(void) {
+    int somefunc(void)
+    {
         g_autofree char *foo = g_strdup_printf("foo%", "wibble");
         g_autoptr (GList) bar = .....
 
@@ -613,7 +615,8 @@ are still some caveats to beware of
 
 .. code-block:: c
 
-    char *somefunc(void) {
+    char *somefunc(void)
+    {
         g_autofree char *foo = g_strdup_printf("foo%", "wibble");
         g_autoptr (GList) bar = .....
 

From 2b5de4d7dff457d34b57fcf3f985a41ddc0db062 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Fri, 26 May 2023 17:37:36 +0200
Subject: [PATCH 0634/1353] vdpa: Remove status in reset tracing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is always 0 and it is not useful to route call through file
descriptor.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20230526153736.472443-1-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/trace-events | 2 +-
 hw/virtio/vhost-vdpa.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 8f8d05cf9b..6265231683 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -44,7 +44,7 @@ vhost_vdpa_set_mem_table(void *dev, uint32_t nregions, uint32_t padding) "dev: %
 vhost_vdpa_dump_regions(void *dev, int i, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, uint64_t flags_padding) "dev: %p %d: guest_phys_addr: 0x%"PRIx64" memory_size: 0x%"PRIx64" userspace_addr: 0x%"PRIx64" flags_padding: 0x%"PRIx64
 vhost_vdpa_set_features(void *dev, uint64_t features) "dev: %p features: 0x%"PRIx64
 vhost_vdpa_get_device_id(void *dev, uint32_t device_id) "dev: %p device_id %"PRIu32
-vhost_vdpa_reset_device(void *dev, uint8_t status) "dev: %p status: 0x%"PRIx8
+vhost_vdpa_reset_device(void *dev) "dev: %p"
 vhost_vdpa_get_vq_index(void *dev, int idx, int vq_idx) "dev: %p idx: %d vq idx: %d"
 vhost_vdpa_set_vring_ready(void *dev) "dev: %p"
 vhost_vdpa_dump_config(void *dev, const char *line) "dev: %p %s"
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 3c575a9a6e..6246e5b9bf 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -859,7 +859,7 @@ static int vhost_vdpa_reset_device(struct vhost_dev *dev)
     uint8_t status = 0;
 
     ret = vhost_vdpa_call(dev, VHOST_VDPA_SET_STATUS, &status);
-    trace_vhost_vdpa_reset_device(dev, status);
+    trace_vhost_vdpa_reset_device(dev);
     v->suspended = false;
     return ret;
 }

From ee071f67f7a103c66f85f68ffe083712929122e3 Mon Sep 17 00:00:00 2001
From: Viktor Prutyanov <viktor@daynix.com>
Date: Mon, 26 Jun 2023 12:12:57 +0300
Subject: [PATCH 0635/1353] vhost: register and change IOMMU flag depending on
 Device-TLB state

The guest can disable or never enable Device-TLB. In these cases,
it can't be used even if enabled in QEMU. So, check Device-TLB state
before registering IOMMU notifier and select unmap flag depending on
that. Also, implement a way to change IOMMU notifier flag if Device-TLB
state is changed.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001312
Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20230626091258.24453-2-viktor@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-stub.c    |  4 ++++
 hw/virtio/vhost.c         | 38 ++++++++++++++++++++++++++------------
 include/hw/virtio/vhost.h |  1 +
 3 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/hw/virtio/vhost-stub.c b/hw/virtio/vhost-stub.c
index c175148fce..aa858ef3fb 100644
--- a/hw/virtio/vhost-stub.c
+++ b/hw/virtio/vhost-stub.c
@@ -15,3 +15,7 @@ bool vhost_user_init(VhostUserState *user, CharBackend *chr, Error **errp)
 void vhost_user_cleanup(VhostUserState *user)
 {
 }
+
+void vhost_toggle_device_iotlb(VirtIODevice *vdev)
+{
+}
diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 82394331bf..abf0d03c8d 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -780,7 +780,6 @@ static void vhost_iommu_region_add(MemoryListener *listener,
     Int128 end;
     int iommu_idx;
     IOMMUMemoryRegion *iommu_mr;
-    int ret;
 
     if (!memory_region_is_iommu(section->mr)) {
         return;
@@ -795,7 +794,9 @@ static void vhost_iommu_region_add(MemoryListener *listener,
     iommu_idx = memory_region_iommu_attrs_to_index(iommu_mr,
                                                    MEMTXATTRS_UNSPECIFIED);
     iommu_notifier_init(&iommu->n, vhost_iommu_unmap_notify,
-                        IOMMU_NOTIFIER_DEVIOTLB_UNMAP,
+                        dev->vdev->device_iotlb_enabled ?
+                            IOMMU_NOTIFIER_DEVIOTLB_UNMAP :
+                            IOMMU_NOTIFIER_UNMAP,
                         section->offset_within_region,
                         int128_get64(end),
                         iommu_idx);
@@ -803,16 +804,8 @@ static void vhost_iommu_region_add(MemoryListener *listener,
     iommu->iommu_offset = section->offset_within_address_space -
                           section->offset_within_region;
     iommu->hdev = dev;
-    ret = memory_region_register_iommu_notifier(section->mr, &iommu->n, NULL);
-    if (ret) {
-        /*
-         * Some vIOMMUs do not support dev-iotlb yet.  If so, try to use the
-         * UNMAP legacy message
-         */
-        iommu->n.notifier_flags = IOMMU_NOTIFIER_UNMAP;
-        memory_region_register_iommu_notifier(section->mr, &iommu->n,
-                                              &error_fatal);
-    }
+    memory_region_register_iommu_notifier(section->mr, &iommu->n,
+                                          &error_fatal);
     QLIST_INSERT_HEAD(&dev->iommu_list, iommu, iommu_next);
     /* TODO: can replay help performance here? */
 }
@@ -840,6 +833,27 @@ static void vhost_iommu_region_del(MemoryListener *listener,
     }
 }
 
+void vhost_toggle_device_iotlb(VirtIODevice *vdev)
+{
+    VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
+    struct vhost_dev *dev;
+    struct vhost_iommu *iommu;
+
+    if (vdev->vhost_started) {
+        dev = vdc->get_vhost(vdev);
+    } else {
+        return;
+    }
+
+    QLIST_FOREACH(iommu, &dev->iommu_list, iommu_next) {
+        memory_region_unregister_iommu_notifier(iommu->mr, &iommu->n);
+        iommu->n.notifier_flags = vdev->device_iotlb_enabled ?
+                IOMMU_NOTIFIER_DEVIOTLB_UNMAP : IOMMU_NOTIFIER_UNMAP;
+        memory_region_register_iommu_notifier(iommu->mr, &iommu->n,
+                                              &error_fatal);
+    }
+}
+
 static int vhost_virtqueue_set_addr(struct vhost_dev *dev,
                                     struct vhost_virtqueue *vq,
                                     unsigned idx, bool enable_log)
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index f7f10c8fb7..6a173cb9fa 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -320,6 +320,7 @@ bool vhost_has_free_slot(void);
 int vhost_net_set_backend(struct vhost_dev *hdev,
                           struct vhost_vring_file *file);
 
+void vhost_toggle_device_iotlb(VirtIODevice *vdev);
 int vhost_device_iotlb_miss(struct vhost_dev *dev, uint64_t iova, int write);
 
 int vhost_virtqueue_start(struct vhost_dev *dev, struct VirtIODevice *vdev,

From cd9b8346884353ba9ae6560b44b7cccdf00a6633 Mon Sep 17 00:00:00 2001
From: Viktor Prutyanov <viktor@daynix.com>
Date: Mon, 26 Jun 2023 12:12:58 +0300
Subject: [PATCH 0636/1353] virtio-net: pass Device-TLB enable/disable events
 to vhost

If vhost is enabled for virtio-net, Device-TLB enable/disable events
must be passed to vhost for proper IOMMU unmap flag selection.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20230626091258.24453-3-viktor@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 04783f5b94..d51067123b 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3951,6 +3951,7 @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
     vdc->vmsd = &vmstate_virtio_net_device;
     vdc->primary_unplug_pending = primary_unplug_pending;
     vdc->get_vhost = virtio_net_get_vhost;
+    vdc->toggle_device_iotlb = vhost_toggle_device_iotlb;
 }
 
 static const TypeInfo virtio_net_info = {

From b263688d236bc07266ce393fdce8c9b6bfd9d8d8 Mon Sep 17 00:00:00 2001
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date: Sun, 21 May 2023 12:35:50 +0200
Subject: [PATCH 0637/1353] target/mips: Rework cp0_timer with clock API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previous implementation of MIPS cp0_timer computes a
cp0_count_ns based on input clock. However rounding
error of cp0_count_ns can affect precision of cp0_timer.

Using clock API and a divider for cp0_timer, so we can
use clock_ns_to_ticks/clock_ns_to_ticks to avoid rounding
issue.

Also workaround the situation that in such handler flow:

count = read_c0_count()
write_c0_compare(count)

If timer had not progressed when compare was written, the
interrupt would trigger again.

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230521110037.90049-1-jiaxun.yang@flygoat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu.c              |  8 +++++---
 target/mips/cpu.h              |  3 ++-
 target/mips/sysemu/cp0_timer.c | 35 ++++++++++++++++++----------------
 3 files changed, 26 insertions(+), 20 deletions(-)

diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 01e0fbe10d..b7119cbbb4 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -449,9 +449,9 @@ static void mips_cp0_period_set(MIPSCPU *cpu)
 {
     CPUMIPSState *env = &cpu->env;
 
-    env->cp0_count_ns = clock_ticks_to_ns(MIPS_CPU(cpu)->clock,
-                                          env->cpu_model->CCRes);
-    assert(env->cp0_count_ns);
+    clock_set_mul_div(cpu->count_div, env->cpu_model->CCRes, 1);
+    clock_set_source(cpu->count_div, cpu->clock);
+    clock_set_source(env->count_clock, cpu->count_div);
 }
 
 static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
@@ -504,6 +504,8 @@ static void mips_cpu_initfn(Object *obj)
 
     cpu_set_cpustate_pointers(cpu);
     cpu->clock = qdev_init_clock_in(DEVICE(obj), "clk-in", NULL, cpu, 0);
+    cpu->count_div = clock_new(OBJECT(obj), "clk-div-count");
+    env->count_clock = clock_new(OBJECT(obj), "clk-count");
     env->cpu_model = mcc->cpu_def;
 }
 
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index a3bc646976..d3ee874a18 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -1160,8 +1160,8 @@ typedef struct CPUArchState {
 
     const mips_def_t *cpu_model;
     QEMUTimer *timer; /* Internal timer */
+    Clock *count_clock; /* CP0_Count clock */
     target_ulong exception_base; /* ExceptionBase input to the core */
-    uint64_t cp0_count_ns; /* CP0_Count clock period (in nanoseconds) */
 } CPUMIPSState;
 
 /**
@@ -1178,6 +1178,7 @@ struct ArchCPU {
     /*< public >*/
 
     Clock *clock;
+    Clock *count_div; /* Divider for CP0_Count clock */
     CPUNegativeOffsetState neg;
     CPUMIPSState env;
 };
diff --git a/target/mips/sysemu/cp0_timer.c b/target/mips/sysemu/cp0_timer.c
index 70de95d338..9d2bcb0dea 100644
--- a/target/mips/sysemu/cp0_timer.c
+++ b/target/mips/sysemu/cp0_timer.c
@@ -28,15 +28,26 @@
 #include "internal.h"
 
 /* MIPS R4K timer */
+static uint32_t cpu_mips_get_count_val(CPUMIPSState *env)
+{
+    int64_t now_ns;
+    now_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    return env->CP0_Count +
+            (uint32_t)clock_ns_to_ticks(env->count_clock, now_ns);
+}
+
 static void cpu_mips_timer_update(CPUMIPSState *env)
 {
     uint64_t now_ns, next_ns;
     uint32_t wait;
 
     now_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    wait = env->CP0_Compare - env->CP0_Count -
-           (uint32_t)(now_ns / env->cp0_count_ns);
-    next_ns = now_ns + (uint64_t)wait * env->cp0_count_ns;
+    wait = env->CP0_Compare - cpu_mips_get_count_val(env);
+    /* Clamp interval to overflow if virtual time had not progressed */
+    if (!wait) {
+        wait = UINT32_MAX;
+    }
+    next_ns = now_ns + clock_ticks_to_ns(env->count_clock, wait);
     timer_mod(env->timer, next_ns);
 }
 
@@ -64,7 +75,7 @@ uint32_t cpu_mips_get_count(CPUMIPSState *env)
             cpu_mips_timer_expire(env);
         }
 
-        return env->CP0_Count + (uint32_t)(now_ns / env->cp0_count_ns);
+        return cpu_mips_get_count_val(env);
     }
 }
 
@@ -79,9 +90,8 @@ void cpu_mips_store_count(CPUMIPSState *env, uint32_t count)
         env->CP0_Count = count;
     } else {
         /* Store new count register */
-        env->CP0_Count = count -
-               (uint32_t)(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
-                          env->cp0_count_ns);
+        env->CP0_Count = count - (uint32_t)clock_ns_to_ticks(env->count_clock,
+                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
         /* Update timer timer */
         cpu_mips_timer_update(env);
     }
@@ -107,8 +117,8 @@ void cpu_mips_start_count(CPUMIPSState *env)
 void cpu_mips_stop_count(CPUMIPSState *env)
 {
     /* Store the current value */
-    env->CP0_Count += (uint32_t)(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
-                                 env->cp0_count_ns);
+    env->CP0_Count += (uint32_t)clock_ns_to_ticks(env->count_clock,
+                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
 }
 
 static void mips_timer_cb(void *opaque)
@@ -121,14 +131,7 @@ static void mips_timer_cb(void *opaque)
         return;
     }
 
-    /*
-     * ??? This callback should occur when the counter is exactly equal to
-     * the comparator value.  Offset the count by one to avoid immediately
-     * retriggering the callback before any virtual time has passed.
-     */
-    env->CP0_Count++;
     cpu_mips_timer_expire(env);
-    env->CP0_Count--;
 }
 
 void cpu_mips_clock_init(MIPSCPU *cpu)

From ee3729d9b088a1988cd6b0a7738fad644fbbc415 Mon Sep 17 00:00:00 2001
From: Erico Nunes <ernunes@redhat.com>
Date: Mon, 26 Jun 2023 18:47:05 +0200
Subject: [PATCH 0638/1353] virtio-gpu: refactor generate_edid function to
 virtio_gpu_base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This functionality can be shared with upcoming use in vhost-user-gpu, so
move it to the shared file to avoid duplicating it.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230626164708.1163239-2-ernunes@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/display/virtio-gpu-base.c   | 17 +++++++++++++++++
 hw/display/virtio-gpu.c        | 20 +-------------------
 include/hw/virtio/virtio-gpu.h |  2 ++
 3 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index a29f191aa8..7ab7d08d0a 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -17,6 +17,7 @@
 #include "migration/blocker.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
+#include "hw/display/edid.h"
 #include "trace.h"
 
 void
@@ -51,6 +52,22 @@ virtio_gpu_base_fill_display_info(VirtIOGPUBase *g,
     }
 }
 
+void
+virtio_gpu_base_generate_edid(VirtIOGPUBase *g, int scanout,
+                              struct virtio_gpu_resp_edid *edid)
+{
+    qemu_edid_info info = {
+        .width_mm = g->req_state[scanout].width_mm,
+        .height_mm = g->req_state[scanout].height_mm,
+        .prefx = g->req_state[scanout].width,
+        .prefy = g->req_state[scanout].height,
+        .refresh_rate = g->req_state[scanout].refresh_rate,
+    };
+
+    edid->size = cpu_to_le32(sizeof(edid->edid));
+    qemu_edid_generate(edid->edid, sizeof(edid->edid), &info);
+}
+
 static void virtio_gpu_invalidate_display(void *opaque)
 {
 }
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 347e17d490..befa7d6d78 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -24,7 +24,6 @@
 #include "hw/virtio/virtio-gpu-bswap.h"
 #include "hw/virtio/virtio-gpu-pixman.h"
 #include "hw/virtio/virtio-bus.h"
-#include "hw/display/edid.h"
 #include "hw/qdev-properties.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
@@ -207,23 +206,6 @@ void virtio_gpu_get_display_info(VirtIOGPU *g,
                              sizeof(display_info));
 }
 
-static void
-virtio_gpu_generate_edid(VirtIOGPU *g, int scanout,
-                         struct virtio_gpu_resp_edid *edid)
-{
-    VirtIOGPUBase *b = VIRTIO_GPU_BASE(g);
-    qemu_edid_info info = {
-        .width_mm = b->req_state[scanout].width_mm,
-        .height_mm = b->req_state[scanout].height_mm,
-        .prefx = b->req_state[scanout].width,
-        .prefy = b->req_state[scanout].height,
-        .refresh_rate = b->req_state[scanout].refresh_rate,
-    };
-
-    edid->size = cpu_to_le32(sizeof(edid->edid));
-    qemu_edid_generate(edid->edid, sizeof(edid->edid), &info);
-}
-
 void virtio_gpu_get_edid(VirtIOGPU *g,
                          struct virtio_gpu_ctrl_command *cmd)
 {
@@ -242,7 +224,7 @@ void virtio_gpu_get_edid(VirtIOGPU *g,
     trace_virtio_gpu_cmd_get_edid(get_edid.scanout);
     memset(&edid, 0, sizeof(edid));
     edid.hdr.type = VIRTIO_GPU_RESP_OK_EDID;
-    virtio_gpu_generate_edid(g, get_edid.scanout, &edid);
+    virtio_gpu_base_generate_edid(VIRTIO_GPU_BASE(g), get_edid.scanout, &edid);
     virtio_gpu_ctrl_response(g, cmd, &edid.hdr, sizeof(edid));
 }
 
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 7a5f8056ea..7ea8ae2bee 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -242,6 +242,8 @@ void virtio_gpu_base_reset(VirtIOGPUBase *g);
 void virtio_gpu_base_fill_display_info(VirtIOGPUBase *g,
                         struct virtio_gpu_resp_display_info *dpy_info);
 
+void virtio_gpu_base_generate_edid(VirtIOGPUBase *g, int scanout,
+                                   struct virtio_gpu_resp_edid *edid);
 /* virtio-gpu.c */
 void virtio_gpu_ctrl_response(VirtIOGPU *g,
                               struct virtio_gpu_ctrl_command *cmd,

From 50cbd5b4b37de3f474495c5fd6a66d5c0e8e49c2 Mon Sep 17 00:00:00 2001
From: Erico Nunes <ernunes@redhat.com>
Date: Mon, 26 Jun 2023 18:47:06 +0200
Subject: [PATCH 0639/1353] docs: vhost-user-gpu: add protocol changes for EDID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VHOST_USER_GPU_GET_EDID is defined as a message from the backend to the
frontend to retrieve the EDID data for a given scanout.

The VHOST_USER_GPU_PROTOCOL_F_EDID protocol feature is defined as a way
to check whether this new message is supported or not.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230626164708.1163239-3-ernunes@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/interop/vhost-user-gpu.rst | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/docs/interop/vhost-user-gpu.rst b/docs/interop/vhost-user-gpu.rst
index 1640553729..b78806892d 100644
--- a/docs/interop/vhost-user-gpu.rst
+++ b/docs/interop/vhost-user-gpu.rst
@@ -124,6 +124,16 @@ VhostUserGpuDMABUFScanout
 :fourcc: ``i32``, the DMABUF fourcc
 
 
+VhostUserGpuEdidRequest
+^^^^^^^^^^^^^^^^^^^^^^^
+
++------------+
+| scanout-id |
++------------+
+
+:scanout-id: ``u32``, the scanout to get edid from
+
+
 C structure
 -----------
 
@@ -141,6 +151,8 @@ In QEMU the vhost-user-gpu message is implemented with the following struct:
           VhostUserGpuScanout scanout;
           VhostUserGpuUpdate update;
           VhostUserGpuDMABUFScanout dmabuf_scanout;
+          VhostUserGpuEdidRequest edid_req;
+          struct virtio_gpu_resp_edid resp_edid;
           struct virtio_gpu_resp_display_info display_info;
           uint64_t u64;
       } payload;
@@ -149,10 +161,11 @@ In QEMU the vhost-user-gpu message is implemented with the following struct:
 Protocol features
 -----------------
 
-None yet.
+.. code:: c
 
-As the protocol may need to evolve, new messages and communication
-changes are negotiated thanks to preliminary
+  #define VHOST_USER_GPU_PROTOCOL_F_EDID 0
+
+New messages and communication changes are negotiated thanks to the
 ``VHOST_USER_GPU_GET_PROTOCOL_FEATURES`` and
 ``VHOST_USER_GPU_SET_PROTOCOL_FEATURES`` requests.
 
@@ -241,3 +254,12 @@ Message types
   Note: there is no data payload, since the scanout is shared thanks
   to DMABUF, that must have been set previously with
   ``VHOST_USER_GPU_DMABUF_SCANOUT``.
+
+``VHOST_USER_GPU_GET_EDID``
+  :id: 11
+  :request payload: ``struct VhostUserGpuEdidRequest``
+  :reply payload: ``struct virtio_gpu_resp_edid`` (from virtio specification)
+
+  Retrieve the EDID data for a given scanout.
+  This message requires the ``VHOST_USER_GPU_PROTOCOL_F_EDID`` protocol
+  feature to be supported.

From c06444261e20f5c74962db08638b021e6ca2ad43 Mon Sep 17 00:00:00 2001
From: Erico Nunes <ernunes@redhat.com>
Date: Mon, 26 Jun 2023 18:47:07 +0200
Subject: [PATCH 0640/1353] contrib/vhost-user-gpu: implement get_edid feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement the virtio-gpu feature in contrib/vhost-user-gpu, which was
unsupported until now.
In this implementation, the feature is enabled inconditionally to avoid
creating another optional config argument.
Similarly to get_display_info, vhost-user-gpu sends a message back to
the frontend to have access to all the display information. In the
case of get_edid, it also needs to pass which scanout we should
retrieve the edid for.

The VHOST_USER_GPU_PROTOCOL_F_EDID protocol feature is required if the
frontend sets the VIRTIO_GPU_F_EDID virtio-gpu feature. If the frontend
sets the virtio-gpu feature but does not support the protocol feature,
the backend will abort with an error.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230626164708.1163239-4-ernunes@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 contrib/vhost-user-gpu/vhost-user-gpu.c | 73 +++++++++++++++++++++++--
 contrib/vhost-user-gpu/virgl.c          |  3 +
 contrib/vhost-user-gpu/vugpu.h          | 11 ++++
 3 files changed, 81 insertions(+), 6 deletions(-)

diff --git a/contrib/vhost-user-gpu/vhost-user-gpu.c b/contrib/vhost-user-gpu/vhost-user-gpu.c
index bfb8d93cf8..2e7815a7a3 100644
--- a/contrib/vhost-user-gpu/vhost-user-gpu.c
+++ b/contrib/vhost-user-gpu/vhost-user-gpu.c
@@ -303,6 +303,53 @@ vg_get_display_info(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
     cmd->state = VG_CMD_STATE_PENDING;
 }
 
+static gboolean
+get_edid_cb(gint fd, GIOCondition condition, gpointer user_data)
+{
+    struct virtio_gpu_resp_edid resp_edid;
+    VuGpu *vg = user_data;
+    struct virtio_gpu_ctrl_command *cmd = QTAILQ_LAST(&vg->fenceq);
+
+    g_debug("get edid cb");
+    assert(cmd->cmd_hdr.type == VIRTIO_GPU_CMD_GET_EDID);
+    if (!vg_recv_msg(vg, VHOST_USER_GPU_GET_EDID,
+                     sizeof(resp_edid), &resp_edid)) {
+        return G_SOURCE_CONTINUE;
+    }
+
+    QTAILQ_REMOVE(&vg->fenceq, cmd, next);
+    vg_ctrl_response(vg, cmd, &resp_edid.hdr, sizeof(resp_edid));
+
+    vg->wait_in = 0;
+    vg_handle_ctrl(&vg->dev.parent, 0);
+
+    return G_SOURCE_REMOVE;
+}
+
+void
+vg_get_edid(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
+{
+    struct virtio_gpu_cmd_get_edid get_edid;
+
+    VUGPU_FILL_CMD(get_edid);
+    virtio_gpu_bswap_32(&get_edid, sizeof(get_edid));
+
+    VhostUserGpuMsg msg = {
+        .request = VHOST_USER_GPU_GET_EDID,
+        .size = sizeof(VhostUserGpuEdidRequest),
+        .payload.edid_req = {
+                .scanout_id = get_edid.scanout,
+        },
+    };
+
+    assert(vg->wait_in == 0);
+
+    vg_send_msg(vg, &msg, -1);
+    vg->wait_in = g_unix_fd_add(vg->sock_fd, G_IO_IN | G_IO_HUP,
+                               get_edid_cb, vg);
+    cmd->state = VG_CMD_STATE_PENDING;
+}
+
 static void
 vg_resource_create_2d(VuGpu *g,
                       struct virtio_gpu_ctrl_command *cmd)
@@ -837,8 +884,9 @@ vg_process_cmd(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd)
     case VIRTIO_GPU_CMD_RESOURCE_DETACH_BACKING:
         vg_resource_detach_backing(vg, cmd);
         break;
-    /* case VIRTIO_GPU_CMD_GET_EDID: */
-    /*     break */
+    case VIRTIO_GPU_CMD_GET_EDID:
+        vg_get_edid(vg, cmd);
+        break;
     default:
         g_warning("TODO handle ctrl %x\n", cmd->cmd_hdr.type);
         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
@@ -1022,26 +1070,36 @@ vg_queue_set_started(VuDev *dev, int qidx, bool started)
 static gboolean
 protocol_features_cb(gint fd, GIOCondition condition, gpointer user_data)
 {
+    const uint64_t protocol_edid = (1 << VHOST_USER_GPU_PROTOCOL_F_EDID);
     VuGpu *g = user_data;
-    uint64_t u64;
+    uint64_t protocol_features;
     VhostUserGpuMsg msg = {
         .request = VHOST_USER_GPU_GET_PROTOCOL_FEATURES
     };
 
-    if (!vg_recv_msg(g, msg.request, sizeof(u64), &u64)) {
+    if (!vg_recv_msg(g, msg.request,
+                     sizeof(protocol_features), &protocol_features)) {
         return G_SOURCE_CONTINUE;
     }
 
+    protocol_features &= protocol_edid;
+
     msg = (VhostUserGpuMsg) {
         .request = VHOST_USER_GPU_SET_PROTOCOL_FEATURES,
         .size = sizeof(uint64_t),
-        .payload.u64 = 0
+        .payload.u64 = protocol_features,
     };
     vg_send_msg(g, &msg, -1);
 
     g->wait_in = 0;
     vg_handle_ctrl(&g->dev.parent, 0);
 
+    if (g->edid_inited && !(protocol_features & protocol_edid)) {
+        g_printerr("EDID feature set by the frontend but it does not support "
+                   "the EDID vhost-user-gpu protocol.\n");
+        exit(EXIT_FAILURE);
+    }
+
     return G_SOURCE_REMOVE;
 }
 
@@ -1049,7 +1107,7 @@ static void
 set_gpu_protocol_features(VuGpu *g)
 {
     VhostUserGpuMsg msg = {
-        .request = VHOST_USER_GPU_GET_PROTOCOL_FEATURES
+        .request = VHOST_USER_GPU_GET_PROTOCOL_FEATURES,
     };
 
     vg_send_msg(g, &msg, -1);
@@ -1086,6 +1144,7 @@ vg_get_features(VuDev *dev)
     if (opt_virgl) {
         features |= 1 << VIRTIO_GPU_F_VIRGL;
     }
+    features |= 1 << VIRTIO_GPU_F_EDID;
 
     return features;
 }
@@ -1103,6 +1162,8 @@ vg_set_features(VuDev *dev, uint64_t features)
         g->virgl_inited = true;
     }
 
+    g->edid_inited = !!(features & (1 << VIRTIO_GPU_F_EDID));
+
     g->virgl = virgl;
 }
 
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
index 3e45e1bd33..211aa110a9 100644
--- a/contrib/vhost-user-gpu/virgl.c
+++ b/contrib/vhost-user-gpu/virgl.c
@@ -495,6 +495,9 @@ void vg_virgl_process_cmd(VuGpu *g, struct virtio_gpu_ctrl_command *cmd)
     case VIRTIO_GPU_CMD_GET_DISPLAY_INFO:
         vg_get_display_info(g, cmd);
         break;
+    case VIRTIO_GPU_CMD_GET_EDID:
+        vg_get_edid(g, cmd);
+        break;
     default:
         g_debug("TODO handle ctrl %x\n", cmd->cmd_hdr.type);
         cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
diff --git a/contrib/vhost-user-gpu/vugpu.h b/contrib/vhost-user-gpu/vugpu.h
index e2864bba68..f0f2069c47 100644
--- a/contrib/vhost-user-gpu/vugpu.h
+++ b/contrib/vhost-user-gpu/vugpu.h
@@ -36,6 +36,7 @@ typedef enum VhostUserGpuRequest {
     VHOST_USER_GPU_UPDATE,
     VHOST_USER_GPU_DMABUF_SCANOUT,
     VHOST_USER_GPU_DMABUF_UPDATE,
+    VHOST_USER_GPU_GET_EDID,
 } VhostUserGpuRequest;
 
 typedef struct VhostUserGpuDisplayInfoReply {
@@ -83,6 +84,10 @@ typedef struct VhostUserGpuDMABUFScanout {
     int fd_drm_fourcc;
 } QEMU_PACKED VhostUserGpuDMABUFScanout;
 
+typedef struct VhostUserGpuEdidRequest {
+    uint32_t scanout_id;
+} QEMU_PACKED VhostUserGpuEdidRequest;
+
 typedef struct VhostUserGpuMsg {
     uint32_t request; /* VhostUserGpuRequest */
     uint32_t flags;
@@ -93,6 +98,8 @@ typedef struct VhostUserGpuMsg {
         VhostUserGpuScanout scanout;
         VhostUserGpuUpdate update;
         VhostUserGpuDMABUFScanout dmabuf_scanout;
+        VhostUserGpuEdidRequest edid_req;
+        struct virtio_gpu_resp_edid resp_edid;
         struct virtio_gpu_resp_display_info display_info;
         uint64_t u64;
     } payload;
@@ -104,6 +111,8 @@ static VhostUserGpuMsg m __attribute__ ((unused));
 
 #define VHOST_USER_GPU_MSG_FLAG_REPLY 0x4
 
+#define VHOST_USER_GPU_PROTOCOL_F_EDID 0
+
 struct virtio_gpu_scanout {
     uint32_t width, height;
     int x, y;
@@ -122,6 +131,7 @@ typedef struct VuGpu {
 
     bool virgl;
     bool virgl_inited;
+    bool edid_inited;
     uint32_t inflight;
 
     struct virtio_gpu_scanout scanout[VIRTIO_GPU_MAX_SCANOUTS];
@@ -171,6 +181,7 @@ int     vg_create_mapping_iov(VuGpu *g,
                               struct iovec **iov);
 void    vg_cleanup_mapping_iov(VuGpu *g, struct iovec *iov, uint32_t count);
 void    vg_get_display_info(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd);
+void    vg_get_edid(VuGpu *vg, struct virtio_gpu_ctrl_command *cmd);
 
 void    vg_wait_ok(VuGpu *g);
 

From 31f137e3d6c596883ecd572ff3c53eb03b0e87c7 Mon Sep 17 00:00:00 2001
From: Erico Nunes <ernunes@redhat.com>
Date: Mon, 26 Jun 2023 18:47:08 +0200
Subject: [PATCH 0641/1353] vhost-user-gpu: implement get_edid frontend feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement the frontend side of the get_edid feature in the qemu
vhost-user-gpu frontend device.

Signed-off-by: Erico Nunes <ernunes@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230626164708.1163239-5-ernunes@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/display/vhost-user-gpu.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index 15f9d99d09..543ea92721 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -31,6 +31,7 @@ typedef enum VhostUserGpuRequest {
     VHOST_USER_GPU_UPDATE,
     VHOST_USER_GPU_DMABUF_SCANOUT,
     VHOST_USER_GPU_DMABUF_UPDATE,
+    VHOST_USER_GPU_GET_EDID,
 } VhostUserGpuRequest;
 
 typedef struct VhostUserGpuDisplayInfoReply {
@@ -78,6 +79,10 @@ typedef struct VhostUserGpuDMABUFScanout {
     int fd_drm_fourcc;
 } QEMU_PACKED VhostUserGpuDMABUFScanout;
 
+typedef struct VhostUserGpuEdidRequest {
+    uint32_t scanout_id;
+} QEMU_PACKED VhostUserGpuEdidRequest;
+
 typedef struct VhostUserGpuMsg {
     uint32_t request; /* VhostUserGpuRequest */
     uint32_t flags;
@@ -88,6 +93,8 @@ typedef struct VhostUserGpuMsg {
         VhostUserGpuScanout scanout;
         VhostUserGpuUpdate update;
         VhostUserGpuDMABUFScanout dmabuf_scanout;
+        VhostUserGpuEdidRequest edid_req;
+        struct virtio_gpu_resp_edid resp_edid;
         struct virtio_gpu_resp_display_info display_info;
         uint64_t u64;
     } payload;
@@ -99,6 +106,8 @@ static VhostUserGpuMsg m __attribute__ ((unused));
 
 #define VHOST_USER_GPU_MSG_FLAG_REPLY 0x4
 
+#define VHOST_USER_GPU_PROTOCOL_F_EDID 0
+
 static void vhost_user_gpu_update_blocked(VhostUserGPU *g, bool blocked);
 
 static void
@@ -161,6 +170,9 @@ vhost_user_gpu_handle_display(VhostUserGPU *g, VhostUserGpuMsg *msg)
             .request = msg->request,
             .flags = VHOST_USER_GPU_MSG_FLAG_REPLY,
             .size = sizeof(uint64_t),
+            .payload = {
+                .u64 = (1 << VHOST_USER_GPU_PROTOCOL_F_EDID)
+            }
         };
 
         vhost_user_gpu_send_msg(g, &reply);
@@ -184,6 +196,26 @@ vhost_user_gpu_handle_display(VhostUserGPU *g, VhostUserGpuMsg *msg)
         vhost_user_gpu_send_msg(g, &reply);
         break;
     }
+    case VHOST_USER_GPU_GET_EDID: {
+        VhostUserGpuEdidRequest *m = &msg->payload.edid_req;
+        struct virtio_gpu_resp_edid resp = { {} };
+        VhostUserGpuMsg reply = {
+            .request = msg->request,
+            .flags = VHOST_USER_GPU_MSG_FLAG_REPLY,
+            .size = sizeof(reply.payload.resp_edid),
+        };
+
+        if (m->scanout_id >= g->parent_obj.conf.max_outputs) {
+            error_report("invalid scanout: %d", m->scanout_id);
+            break;
+        }
+
+        resp.hdr.type = VIRTIO_GPU_RESP_OK_EDID;
+        virtio_gpu_base_generate_edid(VIRTIO_GPU_BASE(g), m->scanout_id, &resp);
+        memcpy(&reply.payload.resp_edid, &resp, sizeof(resp));
+        vhost_user_gpu_send_msg(g, &reply);
+        break;
+    }
     case VHOST_USER_GPU_SCANOUT: {
         VhostUserGpuScanout *m = &msg->payload.scanout;
 

From a5dab090e1425929a1a5a3034768cb33dab69bf4 Mon Sep 17 00:00:00 2001
From: Milan Zamazal <mzamazal@redhat.com>
Date: Wed, 28 Jun 2023 12:05:22 +0200
Subject: [PATCH 0642/1353] hw/virtio: Add boilerplate for vhost-user-scmi
 device

This creates the QEMU side of the vhost-user-scmi device which connects to
the remote daemon.  It is based on code of similar vhost-user devices.

Signed-off-by: Milan Zamazal <mzamazal@redhat.com>
Message-Id: <20230628100524.342666-2-mzamazal@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 MAINTAINERS                         |   6 +
 hw/virtio/Kconfig                   |   5 +
 hw/virtio/meson.build               |   1 +
 hw/virtio/vhost-user-scmi.c         | 306 ++++++++++++++++++++++++++++
 include/hw/virtio/vhost-user-scmi.h |  30 +++
 5 files changed, 348 insertions(+)
 create mode 100644 hw/virtio/vhost-user-scmi.c
 create mode 100644 include/hw/virtio/vhost-user-scmi.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 1817cfc62f..504dddb7dd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2217,6 +2217,12 @@ F: hw/virtio/vhost-user-gpio*
 F: include/hw/virtio/vhost-user-gpio.h
 F: tests/qtest/libqos/virtio-gpio.*
 
+vhost-user-scmi
+R: mzamazal@redhat.com
+S: Supported
+F: hw/virtio/vhost-user-scmi*
+F: include/hw/virtio/vhost-user-scmi.h
+
 virtio-crypto
 M: Gonglei <arei.gonglei@huawei.com>
 S: Supported
diff --git a/hw/virtio/Kconfig b/hw/virtio/Kconfig
index de7a35429a..a9ee09062f 100644
--- a/hw/virtio/Kconfig
+++ b/hw/virtio/Kconfig
@@ -96,3 +96,8 @@ config VHOST_VDPA_DEV
     bool
     default y
     depends on VIRTIO && VHOST_VDPA && LINUX
+
+config VHOST_USER_SCMI
+    bool
+    default y
+    depends on VIRTIO && VHOST_USER
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index f32b22f61b..4a4d7e1c27 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -35,6 +35,7 @@ specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
 specific_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'], if_true: files('vhost-user-gpio-pci.c'))
+specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_SCMI', if_true: files('vhost-user-scmi.c'))
 
 virtio_pci_ss = ss.source_set()
 virtio_pci_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock-pci.c'))
diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
new file mode 100644
index 0000000000..d386fb2df9
--- /dev/null
+++ b/hw/virtio/vhost-user-scmi.c
@@ -0,0 +1,306 @@
+/*
+ * Vhost-user SCMI virtio device
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Implementation based on other vhost-user devices in QEMU.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "hw/virtio/virtio-bus.h"
+#include "hw/virtio/vhost-user-scmi.h"
+#include "standard-headers/linux/virtio_ids.h"
+#include "standard-headers/linux/virtio_scmi.h"
+#include "trace.h"
+
+/*
+ * In this version, we don't support VIRTIO_SCMI_F_SHARED_MEMORY.
+ * Note that VIRTIO_SCMI_F_SHARED_MEMORY is currently not supported in
+ * Linux VirtIO SCMI guest driver.
+ */
+static const int feature_bits[] = {
+    VIRTIO_F_VERSION_1,
+    VIRTIO_F_NOTIFY_ON_EMPTY,
+    VIRTIO_RING_F_INDIRECT_DESC,
+    VIRTIO_RING_F_EVENT_IDX,
+    VIRTIO_F_RING_RESET,
+    VIRTIO_SCMI_F_P2A_CHANNELS,
+    VHOST_INVALID_FEATURE_BIT
+};
+
+static int vu_scmi_start(VirtIODevice *vdev)
+{
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
+    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
+    struct vhost_dev *vhost_dev = &scmi->vhost_dev;
+    int ret, i;
+
+    if (!k->set_guest_notifiers) {
+        error_report("binding does not support guest notifiers");
+        return -ENOSYS;
+    }
+
+    ret = vhost_dev_enable_notifiers(vhost_dev, vdev);
+    if (ret < 0) {
+        error_report("Error enabling host notifiers: %d", ret);
+        return ret;
+    }
+
+    ret = k->set_guest_notifiers(qbus->parent, vhost_dev->nvqs, true);
+    if (ret < 0) {
+        error_report("Error binding guest notifier: %d", ret);
+        goto err_host_notifiers;
+    }
+
+    vhost_ack_features(&scmi->vhost_dev, feature_bits, vdev->guest_features);
+
+    ret = vhost_dev_start(&scmi->vhost_dev, vdev, true);
+    if (ret < 0) {
+        error_report("Error starting vhost-user-scmi: %d", ret);
+        goto err_guest_notifiers;
+    }
+
+    /*
+     * guest_notifier_mask/pending not used yet, so just unmask
+     * everything here. virtio-pci will do the right thing by
+     * enabling/disabling irqfd.
+     */
+    for (i = 0; i < scmi->vhost_dev.nvqs; i++) {
+        vhost_virtqueue_mask(&scmi->vhost_dev, vdev, i, false);
+    }
+    return 0;
+
+err_guest_notifiers:
+    k->set_guest_notifiers(qbus->parent, vhost_dev->nvqs, false);
+err_host_notifiers:
+    vhost_dev_disable_notifiers(vhost_dev, vdev);
+
+    return ret;
+}
+
+static void vu_scmi_stop(VirtIODevice *vdev)
+{
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
+    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
+    struct vhost_dev *vhost_dev = &scmi->vhost_dev;
+    int ret;
+
+    if (!k->set_guest_notifiers) {
+        return;
+    }
+
+    vhost_dev_stop(vhost_dev, vdev, true);
+
+    ret = k->set_guest_notifiers(qbus->parent, vhost_dev->nvqs, false);
+    if (ret < 0) {
+        error_report("vhost guest notifier cleanup failed: %d", ret);
+        return;
+    }
+    vhost_dev_disable_notifiers(vhost_dev, vdev);
+}
+
+static void vu_scmi_set_status(VirtIODevice *vdev, uint8_t status)
+{
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+    bool should_start = virtio_device_should_start(vdev, status);
+
+    if (!scmi->connected) {
+        return;
+    }
+    if (vhost_dev_is_started(&scmi->vhost_dev) == should_start) {
+        return;
+    }
+
+    if (should_start) {
+        vu_scmi_start(vdev);
+    } else {
+        vu_scmi_stop(vdev);
+    }
+}
+
+static uint64_t vu_scmi_get_features(VirtIODevice *vdev, uint64_t features,
+                                     Error **errp)
+{
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+
+    return vhost_get_features(&scmi->vhost_dev, feature_bits, features);
+}
+
+static void vu_scmi_handle_output(VirtIODevice *vdev, VirtQueue *vq)
+{
+    /*
+     * Not normally called; it's the daemon that handles the queue;
+     * however virtio's cleanup path can call this.
+     */
+}
+
+static void vu_scmi_guest_notifier_mask(VirtIODevice *vdev, int idx, bool mask)
+{
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+
+    if (idx == VIRTIO_CONFIG_IRQ_IDX) {
+        return;
+    }
+
+    vhost_virtqueue_mask(&scmi->vhost_dev, vdev, idx, mask);
+}
+
+static bool vu_scmi_guest_notifier_pending(VirtIODevice *vdev, int idx)
+{
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+
+    return vhost_virtqueue_pending(&scmi->vhost_dev, idx);
+}
+
+static void vu_scmi_connect(DeviceState *dev)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+
+    if (scmi->connected) {
+        return;
+    }
+    scmi->connected = true;
+
+    /* restore vhost state */
+    if (virtio_device_started(vdev, vdev->status)) {
+        vu_scmi_start(vdev);
+    }
+}
+
+static void vu_scmi_disconnect(DeviceState *dev)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(vdev);
+
+    if (!scmi->connected) {
+        return;
+    }
+    scmi->connected = false;
+
+    if (vhost_dev_is_started(&scmi->vhost_dev)) {
+        vu_scmi_stop(vdev);
+    }
+}
+
+static void vu_scmi_event(void *opaque, QEMUChrEvent event)
+{
+    DeviceState *dev = opaque;
+
+    switch (event) {
+    case CHR_EVENT_OPENED:
+        vu_scmi_connect(dev);
+        break;
+    case CHR_EVENT_CLOSED:
+        vu_scmi_disconnect(dev);
+        break;
+    case CHR_EVENT_BREAK:
+    case CHR_EVENT_MUX_IN:
+    case CHR_EVENT_MUX_OUT:
+        /* Ignore */
+        break;
+    }
+}
+
+static void do_vhost_user_cleanup(VirtIODevice *vdev, VHostUserSCMI *scmi)
+{
+    virtio_delete_queue(scmi->cmd_vq);
+    virtio_delete_queue(scmi->event_vq);
+    g_free(scmi->vhost_dev.vqs);
+    virtio_cleanup(vdev);
+    vhost_user_cleanup(&scmi->vhost_user);
+}
+
+static void vu_scmi_device_realize(DeviceState *dev, Error **errp)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(dev);
+    int ret;
+
+    if (!scmi->chardev.chr) {
+        error_setg(errp, "vhost-user-scmi: chardev is mandatory");
+        return;
+    }
+
+    vdev->host_features |= (1ULL << VIRTIO_SCMI_F_P2A_CHANNELS);
+
+    if (!vhost_user_init(&scmi->vhost_user, &scmi->chardev, errp)) {
+        return;
+    }
+
+    virtio_init(vdev, VIRTIO_ID_SCMI, 0);
+
+    scmi->cmd_vq = virtio_add_queue(vdev, 256, vu_scmi_handle_output);
+    scmi->event_vq = virtio_add_queue(vdev, 256, vu_scmi_handle_output);
+    scmi->vhost_dev.nvqs = 2;
+    scmi->vhost_dev.vqs = g_new0(struct vhost_virtqueue, scmi->vhost_dev.nvqs);
+
+    ret = vhost_dev_init(&scmi->vhost_dev, &scmi->vhost_user,
+                         VHOST_BACKEND_TYPE_USER, 0, errp);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret,
+                         "vhost-user-scmi: vhost_dev_init() failed");
+        do_vhost_user_cleanup(vdev, scmi);
+        return;
+    }
+
+    qemu_chr_fe_set_handlers(&scmi->chardev, NULL, NULL, vu_scmi_event, NULL,
+                             dev, NULL, true);
+
+    return;
+}
+
+static void vu_scmi_device_unrealize(DeviceState *dev)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(dev);
+    VHostUserSCMI *scmi = VHOST_USER_SCMI(dev);
+
+    vu_scmi_set_status(vdev, 0);
+    vhost_dev_cleanup(&scmi->vhost_dev);
+    do_vhost_user_cleanup(vdev, scmi);
+}
+
+static const VMStateDescription vu_scmi_vmstate = {
+    .name = "vhost-user-scmi",
+    .unmigratable = 1,
+};
+
+static Property vu_scmi_properties[] = {
+    DEFINE_PROP_CHR("chardev", VHostUserSCMI, chardev),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vu_scmi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
+
+    device_class_set_props(dc, vu_scmi_properties);
+    dc->vmsd = &vu_scmi_vmstate;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+    vdc->realize = vu_scmi_device_realize;
+    vdc->unrealize = vu_scmi_device_unrealize;
+    vdc->get_features = vu_scmi_get_features;
+    vdc->set_status = vu_scmi_set_status;
+    vdc->guest_notifier_mask = vu_scmi_guest_notifier_mask;
+    vdc->guest_notifier_pending = vu_scmi_guest_notifier_pending;
+}
+
+static const TypeInfo vu_scmi_info = {
+    .name = TYPE_VHOST_USER_SCMI,
+    .parent = TYPE_VIRTIO_DEVICE,
+    .instance_size = sizeof(VHostUserSCMI),
+    .class_init = vu_scmi_class_init,
+};
+
+static void vu_scmi_register_types(void)
+{
+    type_register_static(&vu_scmi_info);
+}
+
+type_init(vu_scmi_register_types)
diff --git a/include/hw/virtio/vhost-user-scmi.h b/include/hw/virtio/vhost-user-scmi.h
new file mode 100644
index 0000000000..6175a74ebd
--- /dev/null
+++ b/include/hw/virtio/vhost-user-scmi.h
@@ -0,0 +1,30 @@
+/*
+ * Vhost-user SCMI virtio device
+ *
+ * Copyright (c) 2023 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef _QEMU_VHOST_USER_SCMI_H
+#define _QEMU_VHOST_USER_SCMI_H
+
+#include "hw/virtio/virtio.h"
+#include "hw/virtio/vhost.h"
+#include "hw/virtio/vhost-user.h"
+
+#define TYPE_VHOST_USER_SCMI "vhost-user-scmi"
+OBJECT_DECLARE_SIMPLE_TYPE(VHostUserSCMI, VHOST_USER_SCMI);
+
+struct VHostUserSCMI {
+    VirtIODevice parent;
+    CharBackend chardev;
+    struct vhost_virtqueue *vhost_vqs;
+    struct vhost_dev vhost_dev;
+    VhostUserState vhost_user;
+    VirtQueue *cmd_vq;
+    VirtQueue *event_vq;
+    bool connected;
+};
+
+#endif /* _QEMU_VHOST_USER_SCMI_H */

From c46b20cf83ed5088626671447e214de165ca5297 Mon Sep 17 00:00:00 2001
From: Milan Zamazal <mzamazal@redhat.com>
Date: Wed, 28 Jun 2023 12:05:23 +0200
Subject: [PATCH 0643/1353] hw/virtio: Add vhost-user-scmi-pci boilerplate

This allows is to instantiate a vhost-user-scmi device as part of a PCI bus.
It is mostly boilerplate similar to the other vhost-user-*-pci boilerplates
of similar devices.

Signed-off-by: Milan Zamazal <mzamazal@redhat.com>
Message-Id: <20230628100524.342666-3-mzamazal@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/meson.build           |  1 +
 hw/virtio/vhost-user-scmi-pci.c | 68 +++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 hw/virtio/vhost-user-scmi-pci.c

diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index 4a4d7e1c27..c4f4fe05fa 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -36,6 +36,7 @@ specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
 specific_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'], if_true: files('vhost-user-gpio-pci.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_SCMI', if_true: files('vhost-user-scmi.c'))
+specific_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_SCMI'], if_true: files('vhost-user-scmi-pci.c'))
 
 virtio_pci_ss = ss.source_set()
 virtio_pci_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock-pci.c'))
diff --git a/hw/virtio/vhost-user-scmi-pci.c b/hw/virtio/vhost-user-scmi-pci.c
new file mode 100644
index 0000000000..7f53af7fce
--- /dev/null
+++ b/hw/virtio/vhost-user-scmi-pci.c
@@ -0,0 +1,68 @@
+/*
+ * Vhost-user SCMI virtio device PCI glue
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/qdev-properties.h"
+#include "hw/virtio/vhost-user-scmi.h"
+#include "hw/virtio/virtio-pci.h"
+
+struct VHostUserSCMIPCI {
+    VirtIOPCIProxy parent_obj;
+    VHostUserSCMI vdev;
+};
+
+typedef struct VHostUserSCMIPCI VHostUserSCMIPCI;
+
+#define TYPE_VHOST_USER_SCMI_PCI "vhost-user-scmi-pci-base"
+
+DECLARE_INSTANCE_CHECKER(VHostUserSCMIPCI, VHOST_USER_SCMI_PCI,
+                         TYPE_VHOST_USER_SCMI_PCI)
+
+static void vhost_user_scmi_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
+{
+    VHostUserSCMIPCI *dev = VHOST_USER_SCMI_PCI(vpci_dev);
+    DeviceState *vdev = DEVICE(&dev->vdev);
+
+    vpci_dev->nvectors = 1;
+    qdev_realize(vdev, BUS(&vpci_dev->bus), errp);
+}
+
+static void vhost_user_scmi_pci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+    PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+    k->realize = vhost_user_scmi_pci_realize;
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+    pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+    pcidev_k->device_id = 0; /* Set by virtio-pci based on virtio id */
+    pcidev_k->revision = 0x00;
+    pcidev_k->class_id = PCI_CLASS_COMMUNICATION_OTHER;
+}
+
+static void vhost_user_scmi_pci_instance_init(Object *obj)
+{
+    VHostUserSCMIPCI *dev = VHOST_USER_SCMI_PCI(obj);
+
+    virtio_instance_init_common(obj, &dev->vdev, sizeof(dev->vdev),
+                                TYPE_VHOST_USER_SCMI);
+}
+
+static const VirtioPCIDeviceTypeInfo vhost_user_scmi_pci_info = {
+    .base_name = TYPE_VHOST_USER_SCMI_PCI,
+    .non_transitional_name = "vhost-user-scmi-pci",
+    .instance_size = sizeof(VHostUserSCMIPCI),
+    .instance_init = vhost_user_scmi_pci_instance_init,
+    .class_init = vhost_user_scmi_pci_class_init,
+};
+
+static void vhost_user_scmi_pci_register(void)
+{
+    virtio_pci_types_register(&vhost_user_scmi_pci_info);
+}
+
+type_init(vhost_user_scmi_pci_register);

From b6f53ae005a1c05034769beebf799e861b82d48a Mon Sep 17 00:00:00 2001
From: Milan Zamazal <mzamazal@redhat.com>
Date: Wed, 28 Jun 2023 12:05:24 +0200
Subject: [PATCH 0644/1353] tests/qtest: enable tests for virtio-scmi

We don't have a virtio-scmi implementation in QEMU and only support a
vhost-user backend.  This is very similar to virtio-gpio and we add the same
set of tests, just passing some vhost-user messages over the control socket.

Signed-off-by: Milan Zamazal <mzamazal@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230628100524.342666-4-mzamazal@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 MAINTAINERS                      |   1 +
 tests/qtest/libqos/meson.build   |   1 +
 tests/qtest/libqos/virtio-scmi.c | 174 +++++++++++++++++++++++++++++++
 tests/qtest/libqos/virtio-scmi.h |  34 ++++++
 tests/qtest/vhost-user-test.c    |  44 ++++++++
 5 files changed, 254 insertions(+)
 create mode 100644 tests/qtest/libqos/virtio-scmi.c
 create mode 100644 tests/qtest/libqos/virtio-scmi.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 504dddb7dd..8f642141d0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2222,6 +2222,7 @@ R: mzamazal@redhat.com
 S: Supported
 F: hw/virtio/vhost-user-scmi*
 F: include/hw/virtio/vhost-user-scmi.h
+F: tests/qtest/libqos/virtio-scmi.*
 
 virtio-crypto
 M: Gonglei <arei.gonglei@huawei.com>
diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
index cc209a8de5..90aae42a22 100644
--- a/tests/qtest/libqos/meson.build
+++ b/tests/qtest/libqos/meson.build
@@ -46,6 +46,7 @@ libqos_srcs = files(
         'virtio-serial.c',
         'virtio-iommu.c',
         'virtio-gpio.c',
+        'virtio-scmi.c',
         'generic-pcihost.c',
 
         # qgraph machines:
diff --git a/tests/qtest/libqos/virtio-scmi.c b/tests/qtest/libqos/virtio-scmi.c
new file mode 100644
index 0000000000..ce8f4d5c06
--- /dev/null
+++ b/tests/qtest/libqos/virtio-scmi.c
@@ -0,0 +1,174 @@
+/*
+ * virtio-scmi nodes for testing
+ *
+ * SPDX-FileCopyrightText: Linaro Ltd
+ * SPDX-FileCopyrightText: Red Hat, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Based on virtio-gpio.c, doing basically the same thing.
+ */
+
+#include "qemu/osdep.h"
+#include "standard-headers/linux/virtio_config.h"
+#include "../libqtest.h"
+#include "qemu/module.h"
+#include "qgraph.h"
+#include "virtio-scmi.h"
+
+static QGuestAllocator *alloc;
+
+static void virtio_scmi_cleanup(QVhostUserSCMI *scmi)
+{
+    QVirtioDevice *vdev = scmi->vdev;
+    int i;
+
+    for (i = 0; i < 2; i++) {
+        qvirtqueue_cleanup(vdev->bus, scmi->queues[i], alloc);
+    }
+    g_free(scmi->queues);
+}
+
+/*
+ * This handles the VirtIO setup from the point of view of the driver
+ * frontend and therefore doesn't present any vhost specific features
+ * and in fact masks of the re-used bit.
+ */
+static void virtio_scmi_setup(QVhostUserSCMI *scmi)
+{
+    QVirtioDevice *vdev = scmi->vdev;
+    uint64_t features;
+    int i;
+
+    features = qvirtio_get_features(vdev);
+    features &= ~QVIRTIO_F_BAD_FEATURE;
+    qvirtio_set_features(vdev, features);
+
+    scmi->queues = g_new(QVirtQueue *, 2);
+    for (i = 0; i < 2; i++) {
+        scmi->queues[i] = qvirtqueue_setup(vdev, alloc, i);
+    }
+    qvirtio_set_driver_ok(vdev);
+}
+
+static void *qvirtio_scmi_get_driver(QVhostUserSCMI *v_scmi,
+                                     const char *interface)
+{
+    if (!g_strcmp0(interface, "vhost-user-scmi")) {
+        return v_scmi;
+    }
+    if (!g_strcmp0(interface, "virtio")) {
+        return v_scmi->vdev;
+    }
+
+    g_assert_not_reached();
+}
+
+static void *qvirtio_scmi_device_get_driver(void *object,
+                                            const char *interface)
+{
+    QVhostUserSCMIDevice *v_scmi = object;
+    return qvirtio_scmi_get_driver(&v_scmi->scmi, interface);
+}
+
+/* virtio-scmi (mmio) */
+static void qvirtio_scmi_device_destructor(QOSGraphObject *obj)
+{
+    QVhostUserSCMIDevice *scmi_dev = (QVhostUserSCMIDevice *) obj;
+    virtio_scmi_cleanup(&scmi_dev->scmi);
+}
+
+static void qvirtio_scmi_device_start_hw(QOSGraphObject *obj)
+{
+    QVhostUserSCMIDevice *scmi_dev = (QVhostUserSCMIDevice *) obj;
+    virtio_scmi_setup(&scmi_dev->scmi);
+}
+
+static void *virtio_scmi_device_create(void *virtio_dev,
+                                       QGuestAllocator *t_alloc,
+                                       void *addr)
+{
+    QVhostUserSCMIDevice *virtio_device = g_new0(QVhostUserSCMIDevice, 1);
+    QVhostUserSCMI *interface = &virtio_device->scmi;
+
+    interface->vdev = virtio_dev;
+    alloc = t_alloc;
+
+    virtio_device->obj.get_driver = qvirtio_scmi_device_get_driver;
+    virtio_device->obj.start_hw = qvirtio_scmi_device_start_hw;
+    virtio_device->obj.destructor = qvirtio_scmi_device_destructor;
+
+    return &virtio_device->obj;
+}
+
+/* virtio-scmi-pci */
+static void qvirtio_scmi_pci_destructor(QOSGraphObject *obj)
+{
+    QVhostUserSCMIPCI *scmi_pci = (QVhostUserSCMIPCI *) obj;
+    QOSGraphObject *pci_vobj =  &scmi_pci->pci_vdev.obj;
+
+    virtio_scmi_cleanup(&scmi_pci->scmi);
+    qvirtio_pci_destructor(pci_vobj);
+}
+
+static void qvirtio_scmi_pci_start_hw(QOSGraphObject *obj)
+{
+    QVhostUserSCMIPCI *scmi_pci = (QVhostUserSCMIPCI *) obj;
+    QOSGraphObject *pci_vobj =  &scmi_pci->pci_vdev.obj;
+
+    qvirtio_pci_start_hw(pci_vobj);
+    virtio_scmi_setup(&scmi_pci->scmi);
+}
+
+static void *qvirtio_scmi_pci_get_driver(void *object, const char *interface)
+{
+    QVhostUserSCMIPCI *v_scmi = object;
+
+    if (!g_strcmp0(interface, "pci-device")) {
+        return v_scmi->pci_vdev.pdev;
+    }
+    return qvirtio_scmi_get_driver(&v_scmi->scmi, interface);
+}
+
+static void *virtio_scmi_pci_create(void *pci_bus, QGuestAllocator *t_alloc,
+                                    void *addr)
+{
+    QVhostUserSCMIPCI *virtio_spci = g_new0(QVhostUserSCMIPCI, 1);
+    QVhostUserSCMI *interface = &virtio_spci->scmi;
+    QOSGraphObject *obj = &virtio_spci->pci_vdev.obj;
+
+    virtio_pci_init(&virtio_spci->pci_vdev, pci_bus, addr);
+    interface->vdev = &virtio_spci->pci_vdev.vdev;
+    alloc = t_alloc;
+
+    obj->get_driver = qvirtio_scmi_pci_get_driver;
+    obj->start_hw = qvirtio_scmi_pci_start_hw;
+    obj->destructor = qvirtio_scmi_pci_destructor;
+
+    return obj;
+}
+
+static void virtio_scmi_register_nodes(void)
+{
+    QPCIAddress addr = {
+        .devfn = QPCI_DEVFN(4, 0),
+    };
+
+    QOSGraphEdgeOptions edge_opts = { };
+
+    /* vhost-user-scmi-device */
+    edge_opts.extra_device_opts = "id=scmi,chardev=chr-vhost-user-test "
+        "-global virtio-mmio.force-legacy=false";
+    qos_node_create_driver("vhost-user-scmi-device",
+                            virtio_scmi_device_create);
+    qos_node_consumes("vhost-user-scmi-device", "virtio-bus", &edge_opts);
+    qos_node_produces("vhost-user-scmi-device", "vhost-user-scmi");
+
+    /* virtio-scmi-pci */
+    edge_opts.extra_device_opts = "id=scmi,addr=04.0,chardev=chr-vhost-user-test";
+    add_qpci_address(&edge_opts, &addr);
+    qos_node_create_driver("vhost-user-scmi-pci", virtio_scmi_pci_create);
+    qos_node_consumes("vhost-user-scmi-pci", "pci-bus", &edge_opts);
+    qos_node_produces("vhost-user-scmi-pci", "vhost-user-scmi");
+}
+
+libqos_init(virtio_scmi_register_nodes);
diff --git a/tests/qtest/libqos/virtio-scmi.h b/tests/qtest/libqos/virtio-scmi.h
new file mode 100644
index 0000000000..cb5670da6e
--- /dev/null
+++ b/tests/qtest/libqos/virtio-scmi.h
@@ -0,0 +1,34 @@
+/*
+ * virtio-scmi structures
+ *
+ * SPDX-FileCopyrightText: Red Hat, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef TESTS_LIBQOS_VIRTIO_SCMI_H
+#define TESTS_LIBQOS_VIRTIO_SCMI_H
+
+#include "qgraph.h"
+#include "virtio.h"
+#include "virtio-pci.h"
+
+typedef struct QVhostUserSCMI QVhostUserSCMI;
+typedef struct QVhostUserSCMIPCI QVhostUserSCMIPCI;
+typedef struct QVhostUserSCMIDevice QVhostUserSCMIDevice;
+
+struct QVhostUserSCMI {
+    QVirtioDevice *vdev;
+    QVirtQueue **queues;
+};
+
+struct QVhostUserSCMIPCI {
+    QVirtioPCIDevice pci_vdev;
+    QVhostUserSCMI scmi;
+};
+
+struct QVhostUserSCMIDevice {
+    QOSGraphObject obj;
+    QVhostUserSCMI scmi;
+};
+
+#endif
diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index dfb8003597..d4e437265f 100644
--- a/tests/qtest/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -33,6 +33,7 @@
 #include "standard-headers/linux/virtio_ids.h"
 #include "standard-headers/linux/virtio_net.h"
 #include "standard-headers/linux/virtio_gpio.h"
+#include "standard-headers/linux/virtio_scmi.h"
 
 #ifdef CONFIG_LINUX
 #include <sys/vfs.h>
@@ -145,6 +146,7 @@ enum {
 enum {
     VHOST_USER_NET,
     VHOST_USER_GPIO,
+    VHOST_USER_SCMI,
 };
 
 typedef struct TestServer {
@@ -1157,3 +1159,45 @@ static void register_vhost_gpio_test(void)
                  "vhost-user-gpio", test_read_guest_mem, &opts);
 }
 libqos_init(register_vhost_gpio_test);
+
+static uint64_t vu_scmi_get_features(TestServer *s)
+{
+    return 0x1ULL << VIRTIO_F_VERSION_1 |
+        0x1ULL << VIRTIO_SCMI_F_P2A_CHANNELS |
+        0x1ULL << VHOST_USER_F_PROTOCOL_FEATURES;
+}
+
+static void vu_scmi_get_protocol_features(TestServer *s, CharBackend *chr,
+                                          VhostUserMsg *msg)
+{
+    msg->flags |= VHOST_USER_REPLY_MASK;
+    msg->size = sizeof(m.payload.u64);
+    msg->payload.u64 = 1ULL << VHOST_USER_PROTOCOL_F_MQ;
+
+    qemu_chr_fe_write_all(chr, (uint8_t *)msg, VHOST_USER_HDR_SIZE + msg->size);
+}
+
+static struct vhost_user_ops g_vu_scmi_ops = {
+    .type = VHOST_USER_SCMI,
+
+    .append_opts = append_vhost_gpio_opts,
+
+    .get_features = vu_scmi_get_features,
+    .set_features = vu_net_set_features,
+    .get_protocol_features = vu_scmi_get_protocol_features,
+};
+
+static void register_vhost_scmi_test(void)
+{
+    QOSGraphTestOptions opts = {
+        .before = vhost_user_test_setup,
+        .subprocess = true,
+        .arg = &g_vu_scmi_ops,
+    };
+
+    qemu_add_opts(&qemu_chardev_opts);
+
+    qos_add_test("scmi/read-guest-mem/memfile",
+                 "vhost-user-scmi", test_read_guest_mem, &opts);
+}
+libqos_init(register_vhost_scmi_test);

From a1d027be95bc375238e5b9292c6aa661a8ddef4c Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Wed, 28 Jun 2023 21:54:34 +0800
Subject: [PATCH 0645/1353] machine: Add helpers to get cores/threads per
 socket

The number of cores/threads per socket are needed for smbios, and are
also useful for other modules.

Provide the helpers to wrap the calculation of cores/threads per socket
so that we can avoid calculation errors caused by other modules miss
topology changes.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20230628135437.1145805-2-zhao1.liu@linux.intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/core/machine-smp.c | 10 ++++++++++
 include/hw/boards.h   |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/hw/core/machine-smp.c b/hw/core/machine-smp.c
index 89fe0cda42..0f4d9b6f7a 100644
--- a/hw/core/machine-smp.c
+++ b/hw/core/machine-smp.c
@@ -197,3 +197,13 @@ void machine_parse_smp_config(MachineState *ms,
         return;
     }
 }
+
+unsigned int machine_topo_get_cores_per_socket(const MachineState *ms)
+{
+    return ms->smp.cores * ms->smp.clusters * ms->smp.dies;
+}
+
+unsigned int machine_topo_get_threads_per_socket(const MachineState *ms)
+{
+    return ms->smp.threads * machine_topo_get_cores_per_socket(ms);
+}
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 6b267c21ce..12d9e9d17c 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -35,6 +35,8 @@ void machine_set_cpu_numa_node(MachineState *machine,
                                Error **errp);
 void machine_parse_smp_config(MachineState *ms,
                               const SMPConfiguration *config, Error **errp);
+unsigned int machine_topo_get_cores_per_socket(const MachineState *ms);
+unsigned int machine_topo_get_threads_per_socket(const MachineState *ms);
 
 /**
  * machine_class_allow_dynamic_sysbus_dev: Add type to list of valid devices

From d79a284a44bb7d88b233fb6bb12ea3723f43469d Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Wed, 28 Jun 2023 21:54:35 +0800
Subject: [PATCH 0646/1353] hw/smbios: Fix smbios_smp_sockets caculation

smp.sockets is the number of sockets which is configured by "-smp" (
otherwise, the default is 1). Trying to recalculate it here with another
rules leads to errors, such as:

1. 003f230e37d7 ("machine: Tweak the order of topology members in struct
   CpuTopology") changes the meaning of smp.cores but doesn't fix
   original smp.cores uses.

   With the introduction of cluster, now smp.cores means the number of
   cores in one cluster. So smp.cores * smp.threads just means the
   threads in a cluster not in a socket.

2. On the other hand, we shouldn't use smp.cpus here because it
   indicates the initial number of online CPUs at the boot time, and is
   not mathematically related to smp.sockets.

So stop reinventing the another wheel and use the topo values that
has been calculated.

Fixes: 003f230e37d7 ("machine: Tweak the order of topology members in struct CpuTopology")
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20230628135437.1145805-3-zhao1.liu@linux.intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/smbios/smbios.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index d2007e70fb..d67415d44d 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -1088,8 +1088,7 @@ void smbios_get_tables(MachineState *ms,
         smbios_build_type_2_table();
         smbios_build_type_3_table();
 
-        smbios_smp_sockets = DIV_ROUND_UP(ms->smp.cpus,
-                                          ms->smp.cores * ms->smp.threads);
+        smbios_smp_sockets = ms->smp.sockets;
         assert(smbios_smp_sockets >= 1);
 
         for (i = 0; i < smbios_smp_sockets; i++) {

From 7298fd7de5551c4501f54381228458e3c21cab4b Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Wed, 28 Jun 2023 21:54:36 +0800
Subject: [PATCH 0647/1353] hw/smbios: Fix thread count in type4

>From SMBIOS 3.0 specification, thread count field means:

Thread Count is the total number of threads detected by the BIOS for
this processor socket. It is a processor-wide count, not a
thread-per-core count. [1]

So here we should use threads per socket other than threads per core.

[1] SMBIOS 3.0.0, section 7.5.8, Processor Information - Thread Count

Fixes: c97294ec1b9e ("SMBIOS: Build aggregate smbios tables and entry point")
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20230628135437.1145805-4-zhao1.liu@linux.intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/smbios/smbios.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index d67415d44d..3aae9328c0 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -713,6 +713,7 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
 {
     char sock_str[128];
     size_t tbl_len = SMBIOS_TYPE_4_LEN_V28;
+    unsigned threads_per_socket;
 
     if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
         tbl_len = SMBIOS_TYPE_4_LEN_V30;
@@ -747,17 +748,19 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
     SMBIOS_TABLE_SET_STR(4, asset_tag_number_str, type4.asset);
     SMBIOS_TABLE_SET_STR(4, part_number_str, type4.part);
 
+    threads_per_socket = machine_topo_get_threads_per_socket(ms);
+
     t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores;
     t->core_enabled = t->core_count;
 
-    t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads;
+    t->thread_count = (threads_per_socket > 255) ? 0xFF : threads_per_socket;
 
     t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */
     t->processor_family2 = cpu_to_le16(0x01); /* Other */
 
     if (tbl_len == SMBIOS_TYPE_4_LEN_V30) {
         t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
-        t->thread_count2 = cpu_to_le16(ms->smp.threads);
+        t->thread_count2 = cpu_to_le16(threads_per_socket);
     }
 
     SMBIOS_BUILD_TABLE_POST;

From 196ea60a734c346d7d75f1d89aa37703d4d854e7 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Wed, 28 Jun 2023 21:54:37 +0800
Subject: [PATCH 0648/1353] hw/smbios: Fix core count in type4

>From SMBIOS 3.0 specification, core count field means:

Core Count is the number of cores detected by the BIOS for this
processor socket. [1]

Before 003f230e37d7 ("machine: Tweak the order of topology members in
struct CpuTopology"), MachineState.smp.cores means "the number of cores
in one package", and it's correct to use smp.cores for core count.

But 003f230e37d7 changes the smp.cores' meaning to "the number of cores
in one die" and doesn't change the original smp.cores' use in smbios as
well, which makes core count in type4 go wrong.

Fix this issue with the correct "cores per socket" caculation.

[1] SMBIOS 3.0.0, section 7.5.6, Processor Information - Core Count

Fixes: 003f230e37d7 ("machine: Tweak the order of topology members in struct CpuTopology")
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20230628135437.1145805-5-zhao1.liu@linux.intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/smbios/smbios.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index 3aae9328c0..10cd22f610 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -714,6 +714,7 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
     char sock_str[128];
     size_t tbl_len = SMBIOS_TYPE_4_LEN_V28;
     unsigned threads_per_socket;
+    unsigned cores_per_socket;
 
     if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
         tbl_len = SMBIOS_TYPE_4_LEN_V30;
@@ -749,8 +750,9 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
     SMBIOS_TABLE_SET_STR(4, part_number_str, type4.part);
 
     threads_per_socket = machine_topo_get_threads_per_socket(ms);
+    cores_per_socket = machine_topo_get_cores_per_socket(ms);
 
-    t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores;
+    t->core_count = (cores_per_socket > 255) ? 0xFF : cores_per_socket;
     t->core_enabled = t->core_count;
 
     t->thread_count = (threads_per_socket > 255) ? 0xFF : threads_per_socket;
@@ -759,7 +761,7 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
     t->processor_family2 = cpu_to_le16(0x01); /* Other */
 
     if (tbl_len == SMBIOS_TYPE_4_LEN_V30) {
-        t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
+        t->core_count2 = t->core_enabled2 = cpu_to_le16(cores_per_socket);
         t->thread_count2 = cpu_to_le16(threads_per_socket);
     }
 

From 0dcb4172f2cecdfae113239ff931718eefdeb2d2 Mon Sep 17 00:00:00 2001
From: Tom Lonergan <tom.lonergan@nutanix.com>
Date: Wed, 28 Jun 2023 16:39:26 +0000
Subject: [PATCH 0649/1353] vhost-user: Change one_time to per_device request

Some devices, like virtio-scsi, consist of one vhost_dev, while others, like
virtio-net, contain multiple vhost_devs. The QEMU vhost-user code has a
concept of one-time messages which is misleading. One-time messages are sent
once per operation on the device, not once for the lifetime of the device.
Therefore, as discussed in [1], vhost_user_one_time_request should be
renamed to vhost_user_per_device_request and the relevant comments updated
to match the real functionality.

[1] https://lore.kernel.org/qemu-devel/20230127083027-mutt-send-email-mst@kernel.org/

Signed-off-by: Tom Lonergan <tom.lonergan@nutanix.com>
Message-Id: <20230628163927.108171-2-tom.lonergan@nutanix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
---
 hw/virtio/vhost-user.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index c4e0cbd702..65d6299343 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -367,7 +367,7 @@ static int process_message_reply(struct vhost_dev *dev,
     return msg_reply.payload.u64 ? -EIO : 0;
 }
 
-static bool vhost_user_one_time_request(VhostUserRequest request)
+static bool vhost_user_per_device_request(VhostUserRequest request)
 {
     switch (request) {
     case VHOST_USER_SET_OWNER:
@@ -392,11 +392,17 @@ static int vhost_user_write(struct vhost_dev *dev, VhostUserMsg *msg,
     int ret, size = VHOST_USER_HDR_SIZE + msg->hdr.size;
 
     /*
-     * For non-vring specific requests, like VHOST_USER_SET_MEM_TABLE,
-     * we just need send it once in the first time. For later such
-     * request, we just ignore it.
+     * Some devices, like virtio-scsi, are implemented as a single vhost_dev,
+     * while others, like virtio-net, contain multiple vhost_devs. For
+     * operations such as configuring device memory mappings or issuing device
+     * resets, which affect the whole device instead of individual VQs,
+     * vhost-user messages should only be sent once.
+     * 
+     * Devices with multiple vhost_devs are given an associated dev->vq_index
+     * so per_device requests are only sent if vq_index is 0.
      */
-    if (vhost_user_one_time_request(msg->hdr.request) && dev->vq_index != 0) {
+    if (vhost_user_per_device_request(msg->hdr.request)
+        && dev->vq_index != 0) {
         msg->hdr.flags &= ~VHOST_USER_NEED_REPLY_MASK;
         return 0;
     }
@@ -1256,7 +1262,7 @@ static int vhost_user_get_u64(struct vhost_dev *dev, int request, uint64_t *u64)
         .hdr.flags = VHOST_USER_VERSION,
     };
 
-    if (vhost_user_one_time_request(request) && dev->vq_index != 0) {
+    if (vhost_user_per_device_request(request) && dev->vq_index != 0) {
         return 0;
     }
 

From 667e58aef1aa7a0294f635ef070c591efebf75c1 Mon Sep 17 00:00:00 2001
From: Tom Lonergan <tom.lonergan@nutanix.com>
Date: Wed, 28 Jun 2023 16:39:27 +0000
Subject: [PATCH 0650/1353] vhost-user: Make RESET_DEVICE a per device message

A device reset is issued per device, not per VQ. The legacy device reset
message, VHOST_USER_RESET_OWNER, is already a per device message. Therefore,
this change adds the proper message, VHOST_USER_RESET_DEVICE, to per device
messages.

Signed-off-by: Tom Lonergan <tom.lonergan@nutanix.com>
Message-Id: <20230628163927.108171-3-tom.lonergan@nutanix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
---
 hw/virtio/vhost-user.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 65d6299343..8dcf049d42 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -375,6 +375,7 @@ static bool vhost_user_per_device_request(VhostUserRequest request)
     case VHOST_USER_SET_MEM_TABLE:
     case VHOST_USER_GET_QUEUE_NUM:
     case VHOST_USER_NET_SET_MTU:
+    case VHOST_USER_RESET_DEVICE:
     case VHOST_USER_ADD_MEM_REG:
     case VHOST_USER_REM_MEM_REG:
         return true;

From 00f52e77d742c788ade7d713a7bf558481a89eec Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:04 +0200
Subject: [PATCH 0651/1353] hw/i386/pc_q35: Resolve redundant q35_host variable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The variable is redundant to "phb" and is never used by its real type.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-2-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_q35.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 11a7084ea1..d9f3764184 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -120,8 +120,7 @@ static void pc_q35_init(MachineState *machine)
     PCMachineState *pcms = PC_MACHINE(machine);
     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
     X86MachineState *x86ms = X86_MACHINE(machine);
-    Q35PCIHost *q35_host;
-    PCIHostState *phb;
+    Object *phb;
     PCIBus *host_bus;
     PCIDevice *lpc;
     DeviceState *lpc_dev;
@@ -207,10 +206,10 @@ static void pc_q35_init(MachineState *machine)
     }
 
     /* create pci host bus */
-    q35_host = Q35_HOST_DEVICE(qdev_new(TYPE_Q35_HOST_DEVICE));
+    phb = OBJECT(qdev_new(TYPE_Q35_HOST_DEVICE));
 
     if (pcmc->pci_enabled) {
-        pci_hole64_size = object_property_get_uint(OBJECT(q35_host),
+        pci_hole64_size = object_property_get_uint(phb,
                                                    PCI_HOST_PROP_PCI_HOLE64_SIZE,
                                                    &error_abort);
     }
@@ -218,23 +217,23 @@ static void pc_q35_init(MachineState *machine)
     /* allocate ram and load rom/bios */
     pc_memory_init(pcms, system_memory, rom_memory, pci_hole64_size);
 
-    object_property_add_child(OBJECT(machine), "q35", OBJECT(q35_host));
-    object_property_set_link(OBJECT(q35_host), MCH_HOST_PROP_RAM_MEM,
+    object_property_add_child(OBJECT(machine), "q35", phb);
+    object_property_set_link(phb, MCH_HOST_PROP_RAM_MEM,
                              OBJECT(machine->ram), NULL);
-    object_property_set_link(OBJECT(q35_host), MCH_HOST_PROP_PCI_MEM,
+    object_property_set_link(phb, MCH_HOST_PROP_PCI_MEM,
                              OBJECT(pci_memory), NULL);
-    object_property_set_link(OBJECT(q35_host), MCH_HOST_PROP_SYSTEM_MEM,
+    object_property_set_link(phb, MCH_HOST_PROP_SYSTEM_MEM,
                              OBJECT(system_memory), NULL);
-    object_property_set_link(OBJECT(q35_host), MCH_HOST_PROP_IO_MEM,
+    object_property_set_link(phb, MCH_HOST_PROP_IO_MEM,
                              OBJECT(system_io), NULL);
-    object_property_set_int(OBJECT(q35_host), PCI_HOST_BELOW_4G_MEM_SIZE,
+    object_property_set_int(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
                             x86ms->below_4g_mem_size, NULL);
-    object_property_set_int(OBJECT(q35_host), PCI_HOST_ABOVE_4G_MEM_SIZE,
+    object_property_set_int(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
                             x86ms->above_4g_mem_size, NULL);
+
     /* pci */
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(q35_host), &error_fatal);
-    phb = PCI_HOST_BRIDGE(q35_host);
-    host_bus = phb->bus;
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
+    host_bus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pcie.0"));
     /* create ISA bus */
     lpc = pci_new_multifunction(PCI_DEVFN(ICH9_LPC_DEV, ICH9_LPC_FUNC), true,
                                 TYPE_ICH9_LPC_DEVICE);

From 8cf08065b1b19cea1958a43187755cec6546a5d0 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:05 +0200
Subject: [PATCH 0652/1353] hw/pci-host/q35: Fix double, contradicting
 .endianness assignment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes the following clangd warning (-Winitializer-overrides):

  q35.c:297:19: Initializer overrides prior initialization of this subobject
  q35.c:292:19: previous initialization is here

Settle on little endian which is consistent with using pci_host_conf_le_ops.

Fixes: bafc90bdc594 ("q35: implement TSEG")
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-3-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/q35.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index fd18920e7f..84137b9ad9 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -285,7 +285,6 @@ static void blackhole_write(void *opaque, hwaddr addr, uint64_t val,
 static const MemoryRegionOps blackhole_ops = {
     .read = blackhole_read,
     .write = blackhole_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
     .valid.min_access_size = 1,
     .valid.max_access_size = 4,
     .impl.min_access_size = 4,

From 06a492bd2b75653970e30c3ae0ea79ab1ed4ae31 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:06 +0200
Subject: [PATCH 0653/1353] hw/pci-host/q35: Initialize PCMachineState::bus in
 board code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Q35 PCI host currently sets the PC machine's PCI bus attribute
through global state, thereby assuming the machine to be a PC machine.
The Q35 machine code already holds on to Q35's pci bus attribute, so can
easily set its own property while preserving encapsulation.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-4-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_q35.c  | 4 +++-
 hw/pci-host/q35.c | 1 -
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index d9f3764184..4edc0b35f4 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -230,10 +230,12 @@ static void pc_q35_init(MachineState *machine)
                             x86ms->below_4g_mem_size, NULL);
     object_property_set_int(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
                             x86ms->above_4g_mem_size, NULL);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
 
     /* pci */
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
     host_bus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pcie.0"));
+    pcms->bus = host_bus;
+
     /* create ISA bus */
     lpc = pci_new_multifunction(PCI_DEVFN(ICH9_LPC_DEV, ICH9_LPC_FUNC), true,
                                 TYPE_ICH9_LPC_DEVICE);
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 84137b9ad9..0604464074 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -66,7 +66,6 @@ static void q35_host_realize(DeviceState *dev, Error **errp)
                                 s->mch.pci_address_space,
                                 s->mch.address_space_io,
                                 0, TYPE_PCIE_BUS);
-    PC_MACHINE(qdev_get_machine())->bus = pci->bus;
     pci->bypass_iommu =
         PC_MACHINE(qdev_get_machine())->default_bus_bypass_iommu;
     qdev_realize(DEVICE(&s->mch), BUS(pci->bus), &error_fatal);

From 3b20f4ca59b53f10240d94cdb3f482c116640437 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:07 +0200
Subject: [PATCH 0654/1353] hw/pci/pci_host: Introduce PCI_HOST_BYPASS_IOMMU
 macro

Introduce a macro to avoid copy and pasting strings which can easily
cause typos.

Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230630073720.21297-5-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci_host.c         | 2 +-
 include/hw/pci/pci_host.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index dfd185bbb4..7af8afdcbe 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -232,7 +232,7 @@ const VMStateDescription vmstate_pcihost = {
 static Property pci_host_properties_common[] = {
     DEFINE_PROP_BOOL("x-config-reg-migration-enabled", PCIHostState,
                      mig_enabled, true),
-    DEFINE_PROP_BOOL("bypass-iommu", PCIHostState, bypass_iommu, false),
+    DEFINE_PROP_BOOL(PCI_HOST_BYPASS_IOMMU, PCIHostState, bypass_iommu, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/pci/pci_host.h b/include/hw/pci/pci_host.h
index c6f4eb4585..e52d8ec2cd 100644
--- a/include/hw/pci/pci_host.h
+++ b/include/hw/pci/pci_host.h
@@ -31,6 +31,8 @@
 #include "hw/sysbus.h"
 #include "qom/object.h"
 
+#define PCI_HOST_BYPASS_IOMMU "bypass-iommu"
+
 #define TYPE_PCI_HOST_BRIDGE "pci-host-bridge"
 OBJECT_DECLARE_TYPE(PCIHostState, PCIHostBridgeClass, PCI_HOST_BRIDGE)
 

From e36102cb07dddb3f3758398322535a50e7ed41f2 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:08 +0200
Subject: [PATCH 0655/1353] hw/pci-host/q35: Initialize PCI_HOST_BYPASS_IOMMU
 property from board code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Q35 PCI host already has a PCI_HOST_BYPASS_IOMMU property. However, the
host initializes this property itself by accessing global machine state,
thereby assuming it to be a PC machine. Avoid this by having board code
set this property.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-6-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_q35.c  | 2 ++
 hw/pci-host/q35.c | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 4edc0b35f4..852250e8cb 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -230,6 +230,8 @@ static void pc_q35_init(MachineState *machine)
                             x86ms->below_4g_mem_size, NULL);
     object_property_set_int(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
                             x86ms->above_4g_mem_size, NULL);
+    object_property_set_bool(phb, PCI_HOST_BYPASS_IOMMU,
+                             pcms->default_bus_bypass_iommu, NULL);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
 
     /* pci */
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 0604464074..d2830cee34 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -66,8 +66,7 @@ static void q35_host_realize(DeviceState *dev, Error **errp)
                                 s->mch.pci_address_space,
                                 s->mch.address_space_io,
                                 0, TYPE_PCIE_BUS);
-    pci->bypass_iommu =
-        PC_MACHINE(qdev_get_machine())->default_bus_bypass_iommu;
+
     qdev_realize(DEVICE(&s->mch), BUS(pci->bus), &error_fatal);
 }
 

From 3d664a9a386dd5968962b038d056caf182ef29a1 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:09 +0200
Subject: [PATCH 0656/1353] hw/pci-host/q35: Make some property name macros
 reusable by i440fx

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230630073720.21297-7-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_q35.c          | 8 ++++----
 hw/pci-host/q35.c         | 8 ++++----
 include/hw/i386/pc.h      | 4 ++++
 include/hw/pci-host/q35.h | 5 -----
 4 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 852250e8cb..02dd274276 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -218,13 +218,13 @@ static void pc_q35_init(MachineState *machine)
     pc_memory_init(pcms, system_memory, rom_memory, pci_hole64_size);
 
     object_property_add_child(OBJECT(machine), "q35", phb);
-    object_property_set_link(phb, MCH_HOST_PROP_RAM_MEM,
+    object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
                              OBJECT(machine->ram), NULL);
-    object_property_set_link(phb, MCH_HOST_PROP_PCI_MEM,
+    object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
                              OBJECT(pci_memory), NULL);
-    object_property_set_link(phb, MCH_HOST_PROP_SYSTEM_MEM,
+    object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
                              OBJECT(system_memory), NULL);
-    object_property_set_link(phb, MCH_HOST_PROP_IO_MEM,
+    object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
                              OBJECT(system_io), NULL);
     object_property_set_int(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
                             x86ms->below_4g_mem_size, NULL);
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index d2830cee34..91c46df9ae 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -240,19 +240,19 @@ static void q35_host_initfn(Object *obj)
     object_property_add_uint64_ptr(obj, PCIE_HOST_MCFG_SIZE,
                                    &pehb->size, OBJ_PROP_FLAG_READ);
 
-    object_property_add_link(obj, MCH_HOST_PROP_RAM_MEM, TYPE_MEMORY_REGION,
+    object_property_add_link(obj, PCI_HOST_PROP_RAM_MEM, TYPE_MEMORY_REGION,
                              (Object **) &s->mch.ram_memory,
                              qdev_prop_allow_set_link_before_realize, 0);
 
-    object_property_add_link(obj, MCH_HOST_PROP_PCI_MEM, TYPE_MEMORY_REGION,
+    object_property_add_link(obj, PCI_HOST_PROP_PCI_MEM, TYPE_MEMORY_REGION,
                              (Object **) &s->mch.pci_address_space,
                              qdev_prop_allow_set_link_before_realize, 0);
 
-    object_property_add_link(obj, MCH_HOST_PROP_SYSTEM_MEM, TYPE_MEMORY_REGION,
+    object_property_add_link(obj, PCI_HOST_PROP_SYSTEM_MEM, TYPE_MEMORY_REGION,
                              (Object **) &s->mch.system_memory,
                              qdev_prop_allow_set_link_before_realize, 0);
 
-    object_property_add_link(obj, MCH_HOST_PROP_IO_MEM, TYPE_MEMORY_REGION,
+    object_property_add_link(obj, PCI_HOST_PROP_IO_MEM, TYPE_MEMORY_REGION,
                              (Object **) &s->mch.address_space_io,
                              qdev_prop_allow_set_link_before_realize, 0);
 }
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 6eec0fc51d..c34c698cdd 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -146,6 +146,10 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
 
 void pc_guest_info_init(PCMachineState *pcms);
 
+#define PCI_HOST_PROP_RAM_MEM          "ram-mem"
+#define PCI_HOST_PROP_PCI_MEM          "pci-mem"
+#define PCI_HOST_PROP_SYSTEM_MEM       "system-mem"
+#define PCI_HOST_PROP_IO_MEM           "io-mem"
 #define PCI_HOST_PROP_PCI_HOLE_START   "pci-hole-start"
 #define PCI_HOST_PROP_PCI_HOLE_END     "pci-hole-end"
 #define PCI_HOST_PROP_PCI_HOLE64_START "pci-hole64-start"
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index e89329c51e..1d98bbfe0d 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -74,11 +74,6 @@ struct Q35PCIHost {
  * gmch part
  */
 
-#define MCH_HOST_PROP_RAM_MEM "ram-mem"
-#define MCH_HOST_PROP_PCI_MEM "pci-mem"
-#define MCH_HOST_PROP_SYSTEM_MEM "system-mem"
-#define MCH_HOST_PROP_IO_MEM "io-mem"
-
 /* PCI configuration */
 #define MCH_HOST_BRIDGE                        "MCH"
 

From b90d7bff18c48500df86a35db56fecfb59d85088 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:10 +0200
Subject: [PATCH 0657/1353] hw/i386/pc_piix: Turn some local variables into
 initializers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Eliminates an else branch.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-8-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_piix.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index f9947fbc10..6a5b6dad2f 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -122,11 +122,11 @@ static void pc_init1(MachineState *machine,
     BusState *idebus[MAX_IDE_BUS];
     ISADevice *rtc_state;
     MemoryRegion *ram_memory;
-    MemoryRegion *pci_memory;
-    MemoryRegion *rom_memory;
+    MemoryRegion *pci_memory = NULL;
+    MemoryRegion *rom_memory = system_memory;
     ram_addr_t lowmem;
-    uint64_t hole64_size;
-    DeviceState *i440fx_host;
+    uint64_t hole64_size = 0;
+    DeviceState *i440fx_host = NULL;
 
     /*
      * Calculate ram split, for memory below and above 4G.  It's a bit
@@ -205,11 +205,6 @@ static void pc_init1(MachineState *machine,
         hole64_size = object_property_get_uint(OBJECT(i440fx_host),
                                                PCI_HOST_PROP_PCI_HOLE64_SIZE,
                                                &error_abort);
-    } else {
-        pci_memory = NULL;
-        rom_memory = system_memory;
-        i440fx_host = NULL;
-        hole64_size = 0;
     }
 
     pc_guest_info_init(pcms);

From f00f5e4b00e2cb414927b560cd6a82fad4dfc6e2 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:11 +0200
Subject: [PATCH 0658/1353] hw/pci-host/i440fx: Add "i440fx" child property in
 board code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The parent-child relation is usually established near a child's qdev_new(). For
i440fx this allows for reusing the machine parameter, thus avoiding
qdev_get_machine() which relies on a global variable.

Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230630073720.21297-9-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_piix.c    | 2 ++
 hw/pci-host/i440fx.c | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 6a5b6dad2f..26e8473a4d 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -202,6 +202,8 @@ static void pc_init1(MachineState *machine,
         memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
         rom_memory = pci_memory;
         i440fx_host = qdev_new(host_type);
+        object_property_add_child(OBJECT(machine), "i440fx",
+                                  OBJECT(i440fx_host));
         hole64_size = object_property_get_uint(OBJECT(i440fx_host),
                                                PCI_HOST_PROP_PCI_HOLE64_SIZE,
                                                &error_abort);
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index 61e7b97ff4..d95d9229d3 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -259,7 +259,6 @@ PCIBus *i440fx_init(const char *pci_type,
     b = pci_root_bus_new(dev, NULL, pci_address_space,
                          address_space_io, 0, TYPE_PCI_BUS);
     s->bus = b;
-    object_property_add_child(qdev_get_machine(), "i440fx", OBJECT(dev));
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     d = pci_create_simple(b, 0, pci_type);

From cda39f134ba197e2c8c9660dd3fb8fddf4c8647b Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:12 +0200
Subject: [PATCH 0659/1353] hw/pci-host/i440fx: Replace magic values by
 existing constants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-10-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/i440fx.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index d95d9229d3..b7c24a4e1d 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -276,8 +276,8 @@ PCIBus *i440fx_init(const char *pci_type,
 
     /* if *disabled* show SMRAM to all CPUs */
     memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
-                             f->pci_address_space, 0xa0000, 0x20000);
-    memory_region_add_subregion_overlap(f->system_memory, 0xa0000,
+                             f->pci_address_space, SMRAM_C_BASE, SMRAM_C_SIZE);
+    memory_region_add_subregion_overlap(f->system_memory, SMRAM_C_BASE,
                                         &f->smram_region, 1);
     memory_region_set_enabled(&f->smram_region, true);
 
@@ -285,9 +285,9 @@ PCIBus *i440fx_init(const char *pci_type,
     memory_region_init(&f->smram, OBJECT(d), "smram", 4 * GiB);
     memory_region_set_enabled(&f->smram, true);
     memory_region_init_alias(&f->low_smram, OBJECT(d), "smram-low",
-                             f->ram_memory, 0xa0000, 0x20000);
+                             f->ram_memory, SMRAM_C_BASE, SMRAM_C_SIZE);
     memory_region_set_enabled(&f->low_smram, true);
-    memory_region_add_subregion(&f->smram, 0xa0000, &f->low_smram);
+    memory_region_add_subregion(&f->smram, SMRAM_C_BASE, &f->low_smram);
     object_property_add_const_link(qdev_get_machine(), "smram",
                                    OBJECT(&f->smram));
 

From a707466dd62712e4a76e30217a8880e6ab8c7b10 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:13 +0200
Subject: [PATCH 0660/1353] hw/pci-host/i440fx: Have common names for some
 local variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`PCIHostState` is often referred to as `phb`, own device state usually as `s`.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-11-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/i440fx.c | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index b7c24a4e1d..0b76fe71af 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -205,28 +205,28 @@ static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v,
 
 static void i440fx_pcihost_initfn(Object *obj)
 {
-    PCIHostState *s = PCI_HOST_BRIDGE(obj);
+    PCIHostState *phb = PCI_HOST_BRIDGE(obj);
 
-    memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s,
+    memory_region_init_io(&phb->conf_mem, obj, &pci_host_conf_le_ops, phb,
                           "pci-conf-idx", 4);
-    memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s,
+    memory_region_init_io(&phb->data_mem, obj, &pci_host_data_le_ops, phb,
                           "pci-conf-data", 4);
 }
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
 {
-    PCIHostState *s = PCI_HOST_BRIDGE(dev);
+    PCIHostState *phb = PCI_HOST_BRIDGE(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    memory_region_add_subregion(s->bus->address_space_io, 0xcf8, &s->conf_mem);
+    memory_region_add_subregion(phb->bus->address_space_io, 0xcf8, &phb->conf_mem);
     sysbus_init_ioports(sbd, 0xcf8, 4);
 
-    memory_region_add_subregion(s->bus->address_space_io, 0xcfc, &s->data_mem);
+    memory_region_add_subregion(phb->bus->address_space_io, 0xcfc, &phb->data_mem);
     sysbus_init_ioports(sbd, 0xcfc, 4);
 
     /* register i440fx 0xcf8 port as coalesced pio */
-    memory_region_set_flush_coalesced(&s->data_mem);
-    memory_region_add_coalescing(&s->conf_mem, 0, 4);
+    memory_region_set_flush_coalesced(&phb->data_mem);
+    memory_region_add_coalescing(&phb->conf_mem, 0, 4);
 }
 
 static void i440fx_realize(PCIDevice *dev, Error **errp)
@@ -248,17 +248,16 @@ PCIBus *i440fx_init(const char *pci_type,
                     MemoryRegion *pci_address_space,
                     MemoryRegion *ram_memory)
 {
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(dev);
+    PCIHostState *phb = PCI_HOST_BRIDGE(dev);
     PCIBus *b;
     PCIDevice *d;
-    PCIHostState *s;
     PCII440FXState *f;
     unsigned i;
-    I440FXState *i440fx;
 
-    s = PCI_HOST_BRIDGE(dev);
     b = pci_root_bus_new(dev, NULL, pci_address_space,
                          address_space_io, 0, TYPE_PCI_BUS);
-    s->bus = b;
+    phb->bus = b;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     d = pci_create_simple(b, 0, pci_type);
@@ -267,8 +266,7 @@ PCIBus *i440fx_init(const char *pci_type,
     f->pci_address_space = pci_address_space;
     f->ram_memory = ram_memory;
 
-    i440fx = I440FX_PCI_HOST_BRIDGE(dev);
-    range_set_bounds(&i440fx->pci_hole, below_4g_mem_size,
+    range_set_bounds(&s->pci_hole, below_4g_mem_size,
                      IO_APIC_DEFAULT_ADDRESS - 1);
 
     /* setup pci memory mapping */

From 44df0552a020efd6191714da44edede5ded37ec8 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:14 +0200
Subject: [PATCH 0661/1353] hw/pci-host/i440fx: Move i440fx_realize() into
 PCII440FXState section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

i440fx_realize() realizes the PCI device inside the host bridge
(PCII440FXState), but is implemented between i440fx_pcihost_realize() and
i440fx_init() which deal with the host bridge itself (I440FXState). Since we
want to append i440fx_init() to i440fx_pcihost_realize() later let's move
i440fx_realize() out of the way.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-12-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/i440fx.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index 0b76fe71af..e84fcd50b6 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -65,6 +65,15 @@ struct I440FXState {
  */
 #define I440FX_COREBOOT_RAM_SIZE 0x57
 
+static void i440fx_realize(PCIDevice *dev, Error **errp)
+{
+    dev->config[I440FX_SMRAM] = 0x02;
+
+    if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
+        warn_report("i440fx doesn't support emulated iommu");
+    }
+}
+
 static void i440fx_update_memory_mappings(PCII440FXState *d)
 {
     int i;
@@ -229,15 +238,6 @@ static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
     memory_region_add_coalescing(&phb->conf_mem, 0, 4);
 }
 
-static void i440fx_realize(PCIDevice *dev, Error **errp)
-{
-    dev->config[I440FX_SMRAM] = 0x02;
-
-    if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
-        warn_report("i440fx doesn't support emulated iommu");
-    }
-}
-
 PCIBus *i440fx_init(const char *pci_type,
                     DeviceState *dev,
                     MemoryRegion *address_space_mem,

From 09f85b7b93a05f1551509b245be99529a9e278f9 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:15 +0200
Subject: [PATCH 0662/1353] hw/pci-host/i440fx: Make MemoryRegion pointers
 accessible as properties
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The goal is to eliminate i440fx_init() which is a legacy init function. This
neccessitates the memory regions to be properties, like in Q35, which will be
assigned in board code.

Since i440fx needs different PCI devices in Xen mode, and since i440fx shall
be self-contained, the PCI device will be created during realization of the
host. Thus the pointers need to be moved to the host structure to be usable as
properties.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-13-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/i440fx.c         | 42 +++++++++++++++++++++++++-----------
 include/hw/pci-host/i440fx.h |  3 ---
 2 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index e84fcd50b6..b9530fc3a0 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -47,6 +47,10 @@ OBJECT_DECLARE_SIMPLE_TYPE(I440FXState, I440FX_PCI_HOST_BRIDGE)
 
 struct I440FXState {
     PCIHostState parent_obj;
+
+    MemoryRegion *system_memory;
+    MemoryRegion *pci_address_space;
+    MemoryRegion *ram_memory;
     Range pci_hole;
     uint64_t pci_hole64_size;
     bool pci_hole64_fix;
@@ -214,12 +218,25 @@ static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v,
 
 static void i440fx_pcihost_initfn(Object *obj)
 {
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(obj);
     PCIHostState *phb = PCI_HOST_BRIDGE(obj);
 
     memory_region_init_io(&phb->conf_mem, obj, &pci_host_conf_le_ops, phb,
                           "pci-conf-idx", 4);
     memory_region_init_io(&phb->data_mem, obj, &pci_host_data_le_ops, phb,
                           "pci-conf-data", 4);
+
+    object_property_add_link(obj, PCI_HOST_PROP_RAM_MEM, TYPE_MEMORY_REGION,
+                             (Object **) &s->ram_memory,
+                             qdev_prop_allow_set_link_before_realize, 0);
+
+    object_property_add_link(obj, PCI_HOST_PROP_PCI_MEM, TYPE_MEMORY_REGION,
+                             (Object **) &s->pci_address_space,
+                             qdev_prop_allow_set_link_before_realize, 0);
+
+    object_property_add_link(obj, PCI_HOST_PROP_SYSTEM_MEM, TYPE_MEMORY_REGION,
+                             (Object **) &s->system_memory,
+                             qdev_prop_allow_set_link_before_realize, 0);
 }
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
@@ -255,27 +272,28 @@ PCIBus *i440fx_init(const char *pci_type,
     PCII440FXState *f;
     unsigned i;
 
-    b = pci_root_bus_new(dev, NULL, pci_address_space,
+    s->system_memory = address_space_mem;
+    s->pci_address_space = pci_address_space;
+    s->ram_memory = ram_memory;
+
+    b = pci_root_bus_new(dev, NULL, s->pci_address_space,
                          address_space_io, 0, TYPE_PCI_BUS);
     phb->bus = b;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     d = pci_create_simple(b, 0, pci_type);
     f = I440FX_PCI_DEVICE(d);
-    f->system_memory = address_space_mem;
-    f->pci_address_space = pci_address_space;
-    f->ram_memory = ram_memory;
 
     range_set_bounds(&s->pci_hole, below_4g_mem_size,
                      IO_APIC_DEFAULT_ADDRESS - 1);
 
     /* setup pci memory mapping */
-    pc_pci_as_mapping_init(f->system_memory, f->pci_address_space);
+    pc_pci_as_mapping_init(s->system_memory, s->pci_address_space);
 
     /* if *disabled* show SMRAM to all CPUs */
     memory_region_init_alias(&f->smram_region, OBJECT(d), "smram-region",
-                             f->pci_address_space, SMRAM_C_BASE, SMRAM_C_SIZE);
-    memory_region_add_subregion_overlap(f->system_memory, SMRAM_C_BASE,
+                             s->pci_address_space, SMRAM_C_BASE, SMRAM_C_SIZE);
+    memory_region_add_subregion_overlap(s->system_memory, SMRAM_C_BASE,
                                         &f->smram_region, 1);
     memory_region_set_enabled(&f->smram_region, true);
 
@@ -283,17 +301,17 @@ PCIBus *i440fx_init(const char *pci_type,
     memory_region_init(&f->smram, OBJECT(d), "smram", 4 * GiB);
     memory_region_set_enabled(&f->smram, true);
     memory_region_init_alias(&f->low_smram, OBJECT(d), "smram-low",
-                             f->ram_memory, SMRAM_C_BASE, SMRAM_C_SIZE);
+                             s->ram_memory, SMRAM_C_BASE, SMRAM_C_SIZE);
     memory_region_set_enabled(&f->low_smram, true);
     memory_region_add_subregion(&f->smram, SMRAM_C_BASE, &f->low_smram);
     object_property_add_const_link(qdev_get_machine(), "smram",
                                    OBJECT(&f->smram));
 
-    init_pam(&f->pam_regions[0], OBJECT(d), f->ram_memory, f->system_memory,
-             f->pci_address_space, PAM_BIOS_BASE, PAM_BIOS_SIZE);
+    init_pam(&f->pam_regions[0], OBJECT(d), s->ram_memory, s->system_memory,
+             s->pci_address_space, PAM_BIOS_BASE, PAM_BIOS_SIZE);
     for (i = 0; i < ARRAY_SIZE(f->pam_regions) - 1; ++i) {
-        init_pam(&f->pam_regions[i + 1], OBJECT(d), f->ram_memory,
-                 f->system_memory, f->pci_address_space,
+        init_pam(&f->pam_regions[i + 1], OBJECT(d), s->ram_memory,
+                 s->system_memory, s->pci_address_space,
                  PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
     }
 
diff --git a/include/hw/pci-host/i440fx.h b/include/hw/pci-host/i440fx.h
index bf57216c78..e3a550021e 100644
--- a/include/hw/pci-host/i440fx.h
+++ b/include/hw/pci-host/i440fx.h
@@ -25,9 +25,6 @@ struct PCII440FXState {
     PCIDevice parent_obj;
     /*< public >*/
 
-    MemoryRegion *system_memory;
-    MemoryRegion *pci_address_space;
-    MemoryRegion *ram_memory;
     PAMMemoryRegion pam_regions[PAM_REGIONS_COUNT];
     MemoryRegion smram_region;
     MemoryRegion smram, low_smram;

From c84858fd907067dcfb7624083dd44879664cc019 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:16 +0200
Subject: [PATCH 0663/1353] hw/pci-host/i440fx: Add PCI_HOST_PROP_IO_MEM
 property

Introduce the property in anticipation of QOM'ification; Q35 has the same
property.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230630073720.21297-14-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/i440fx.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index b9530fc3a0..de14c75e95 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -27,7 +27,6 @@
 #include "qemu/range.h"
 #include "hw/i386/pc.h"
 #include "hw/pci/pci.h"
-#include "hw/pci/pci_bus.h"
 #include "hw/pci/pci_host.h"
 #include "hw/pci-host/i440fx.h"
 #include "hw/qdev-properties.h"
@@ -49,6 +48,7 @@ struct I440FXState {
     PCIHostState parent_obj;
 
     MemoryRegion *system_memory;
+    MemoryRegion *io_memory;
     MemoryRegion *pci_address_space;
     MemoryRegion *ram_memory;
     Range pci_hole;
@@ -237,17 +237,22 @@ static void i440fx_pcihost_initfn(Object *obj)
     object_property_add_link(obj, PCI_HOST_PROP_SYSTEM_MEM, TYPE_MEMORY_REGION,
                              (Object **) &s->system_memory,
                              qdev_prop_allow_set_link_before_realize, 0);
+
+    object_property_add_link(obj, PCI_HOST_PROP_IO_MEM, TYPE_MEMORY_REGION,
+                             (Object **) &s->io_memory,
+                             qdev_prop_allow_set_link_before_realize, 0);
 }
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
 {
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(dev);
     PCIHostState *phb = PCI_HOST_BRIDGE(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    memory_region_add_subregion(phb->bus->address_space_io, 0xcf8, &phb->conf_mem);
+    memory_region_add_subregion(s->io_memory, 0xcf8, &phb->conf_mem);
     sysbus_init_ioports(sbd, 0xcf8, 4);
 
-    memory_region_add_subregion(phb->bus->address_space_io, 0xcfc, &phb->data_mem);
+    memory_region_add_subregion(s->io_memory, 0xcfc, &phb->data_mem);
     sysbus_init_ioports(sbd, 0xcfc, 4);
 
     /* register i440fx 0xcf8 port as coalesced pio */
@@ -273,11 +278,12 @@ PCIBus *i440fx_init(const char *pci_type,
     unsigned i;
 
     s->system_memory = address_space_mem;
+    s->io_memory = address_space_io;
     s->pci_address_space = pci_address_space;
     s->ram_memory = ram_memory;
 
     b = pci_root_bus_new(dev, NULL, s->pci_address_space,
-                         address_space_io, 0, TYPE_PCI_BUS);
+                         s->io_memory, 0, TYPE_PCI_BUS);
     phb->bus = b;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 

From 82feef45f42db607b9439411d4aad7c21bdf3047 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:17 +0200
Subject: [PATCH 0664/1353] hw/pci-host/i440fx: Add PCI_HOST_{ABOVE,
 BELOW}_4G_MEM_SIZE properties

Introduce the properties in anticipation of QOM'ification; Q35 has the same
properties.

Note that we want to avoid a "ram size" property in the QOM interface since it
seems redundant to both properties introduced in this change. Thus the removal
of the ram_size parameter. We assume the invariant of both properties to sum up
to "ram size" which is already asserted in pc_memory_init(). Under Xen the
invariant seems to hold as well, so we now also check it there.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230630073720.21297-15-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_piix.c            |  5 ++++-
 hw/pci-host/i440fx.c         | 12 ++++++++++--
 include/hw/pci-host/i440fx.h |  1 -
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 26e8473a4d..c36783809f 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -224,6 +224,9 @@ static void pc_init1(MachineState *machine,
     if (!xen_enabled()) {
         pc_memory_init(pcms, system_memory, rom_memory, hole64_size);
     } else {
+        assert(machine->ram_size == x86ms->below_4g_mem_size +
+                                    x86ms->above_4g_mem_size);
+
         pc_system_flash_cleanup_unused(pcms);
         if (machine->kernel_filename != NULL) {
             /* For xen HVM direct kernel boot, load linux here */
@@ -239,7 +242,7 @@ static void pc_init1(MachineState *machine,
 
         pci_bus = i440fx_init(pci_type,
                               i440fx_host,
-                              system_memory, system_io, machine->ram_size,
+                              system_memory, system_io,
                               x86ms->below_4g_mem_size,
                               x86ms->above_4g_mem_size,
                               pci_memory, ram_memory);
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index de14c75e95..8731740a1b 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -52,6 +52,8 @@ struct I440FXState {
     MemoryRegion *pci_address_space;
     MemoryRegion *ram_memory;
     Range pci_hole;
+    uint64_t below_4g_mem_size;
+    uint64_t above_4g_mem_size;
     uint64_t pci_hole64_size;
     bool pci_hole64_fix;
     uint32_t short_root_bus;
@@ -264,7 +266,6 @@ PCIBus *i440fx_init(const char *pci_type,
                     DeviceState *dev,
                     MemoryRegion *address_space_mem,
                     MemoryRegion *address_space_io,
-                    ram_addr_t ram_size,
                     ram_addr_t below_4g_mem_size,
                     ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_address_space,
@@ -281,6 +282,8 @@ PCIBus *i440fx_init(const char *pci_type,
     s->io_memory = address_space_io;
     s->pci_address_space = pci_address_space;
     s->ram_memory = ram_memory;
+    s->below_4g_mem_size = below_4g_mem_size;
+    s->above_4g_mem_size = above_4g_mem_size;
 
     b = pci_root_bus_new(dev, NULL, s->pci_address_space,
                          s->io_memory, 0, TYPE_PCI_BUS);
@@ -290,7 +293,7 @@ PCIBus *i440fx_init(const char *pci_type,
     d = pci_create_simple(b, 0, pci_type);
     f = I440FX_PCI_DEVICE(d);
 
-    range_set_bounds(&s->pci_hole, below_4g_mem_size,
+    range_set_bounds(&s->pci_hole, s->below_4g_mem_size,
                      IO_APIC_DEFAULT_ADDRESS - 1);
 
     /* setup pci memory mapping */
@@ -321,6 +324,7 @@ PCIBus *i440fx_init(const char *pci_type,
                  PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
     }
 
+    ram_addr_t ram_size = s->below_4g_mem_size + s->above_4g_mem_size;
     ram_size = ram_size / 8 / 1024 / 1024;
     if (ram_size > 255) {
         ram_size = 255;
@@ -380,6 +384,10 @@ static Property i440fx_props[] = {
     DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, I440FXState,
                      pci_hole64_size, I440FX_PCI_HOST_HOLE64_SIZE_DEFAULT),
     DEFINE_PROP_UINT32("short_root_bus", I440FXState, short_root_bus, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_BELOW_4G_MEM_SIZE, I440FXState,
+                     below_4g_mem_size, 0),
+    DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MEM_SIZE, I440FXState,
+                     above_4g_mem_size, 0),
     DEFINE_PROP_BOOL("x-pci-hole64-fix", I440FXState, pci_hole64_fix, true),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/include/hw/pci-host/i440fx.h b/include/hw/pci-host/i440fx.h
index e3a550021e..7e38456ebb 100644
--- a/include/hw/pci-host/i440fx.h
+++ b/include/hw/pci-host/i440fx.h
@@ -36,7 +36,6 @@ PCIBus *i440fx_init(const char *pci_type,
                     DeviceState *dev,
                     MemoryRegion *address_space_mem,
                     MemoryRegion *address_space_io,
-                    ram_addr_t ram_size,
                     ram_addr_t below_4g_mem_size,
                     ram_addr_t above_4g_mem_size,
                     MemoryRegion *pci_memory,

From ff0a8cc4bed6414ab09816b14e006a11140d0d73 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:18 +0200
Subject: [PATCH 0665/1353] hw/pci-host/i440fx: Add I440FX_HOST_PROP_PCI_TYPE
 property

I440FX needs a different PCI device model if the "igd-passthru" property is
enabled. The type name is currently passed as a parameter to i440fx_init(). This
parameter will be replaced by a property assignment once i440fx_init() gets
resolved.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230630073720.21297-16-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci-host/i440fx.c         | 6 +++++-
 include/hw/pci-host/i440fx.h | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index 8731740a1b..c458987405 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -57,6 +57,8 @@ struct I440FXState {
     uint64_t pci_hole64_size;
     bool pci_hole64_fix;
     uint32_t short_root_bus;
+
+    char *pci_type;
 };
 
 #define I440FX_PAM      0x59
@@ -284,13 +286,14 @@ PCIBus *i440fx_init(const char *pci_type,
     s->ram_memory = ram_memory;
     s->below_4g_mem_size = below_4g_mem_size;
     s->above_4g_mem_size = above_4g_mem_size;
+    s->pci_type = (char *)pci_type;
 
     b = pci_root_bus_new(dev, NULL, s->pci_address_space,
                          s->io_memory, 0, TYPE_PCI_BUS);
     phb->bus = b;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    d = pci_create_simple(b, 0, pci_type);
+    d = pci_create_simple(b, 0, s->pci_type);
     f = I440FX_PCI_DEVICE(d);
 
     range_set_bounds(&s->pci_hole, s->below_4g_mem_size,
@@ -389,6 +392,7 @@ static Property i440fx_props[] = {
     DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MEM_SIZE, I440FXState,
                      above_4g_mem_size, 0),
     DEFINE_PROP_BOOL("x-pci-hole64-fix", I440FXState, pci_hole64_fix, true),
+    DEFINE_PROP_STRING(I440FX_HOST_PROP_PCI_TYPE, I440FXState, pci_type),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/pci-host/i440fx.h b/include/hw/pci-host/i440fx.h
index 7e38456ebb..2d7bae5a45 100644
--- a/include/hw/pci-host/i440fx.h
+++ b/include/hw/pci-host/i440fx.h
@@ -15,6 +15,8 @@
 #include "hw/pci-host/pam.h"
 #include "qom/object.h"
 
+#define I440FX_HOST_PROP_PCI_TYPE "pci-type"
+
 #define TYPE_I440FX_PCI_HOST_BRIDGE "i440FX-pcihost"
 #define TYPE_I440FX_PCI_DEVICE "i440FX"
 

From ce5ac09a7548d90ac414f60bbe87c69a8487de10 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:19 +0200
Subject: [PATCH 0666/1353] hw/pci-host/i440fx: Resolve i440fx_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

i440fx_init() is a legacy init function. The previous patches worked towards
TYPE_I440FX_PCI_HOST_BRIDGE to be instantiated the QOM way. Do this now by
transforming the parameters passed to i440fx_init() into property assignments.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230630073720.21297-17-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/pc_piix.c            | 32 +++++++++++++++++++++-----------
 hw/pci-host/i440fx.c         | 33 +++++----------------------------
 include/hw/pci-host/i440fx.h | 10 ----------
 3 files changed, 26 insertions(+), 49 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index c36783809f..62148d7636 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -126,7 +126,7 @@ static void pc_init1(MachineState *machine,
     MemoryRegion *rom_memory = system_memory;
     ram_addr_t lowmem;
     uint64_t hole64_size = 0;
-    DeviceState *i440fx_host = NULL;
+    Object *phb = NULL;
 
     /*
      * Calculate ram split, for memory below and above 4G.  It's a bit
@@ -201,10 +201,9 @@ static void pc_init1(MachineState *machine,
         pci_memory = g_new(MemoryRegion, 1);
         memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
         rom_memory = pci_memory;
-        i440fx_host = qdev_new(host_type);
-        object_property_add_child(OBJECT(machine), "i440fx",
-                                  OBJECT(i440fx_host));
-        hole64_size = object_property_get_uint(OBJECT(i440fx_host),
+        phb = OBJECT(qdev_new(host_type));
+        object_property_add_child(OBJECT(machine), "i440fx", phb);
+        hole64_size = object_property_get_uint(phb,
                                                PCI_HOST_PROP_PCI_HOLE64_SIZE,
                                                &error_abort);
     }
@@ -240,12 +239,23 @@ static void pc_init1(MachineState *machine,
         PIIX3State *piix3;
         PCIDevice *pci_dev;
 
-        pci_bus = i440fx_init(pci_type,
-                              i440fx_host,
-                              system_memory, system_io,
-                              x86ms->below_4g_mem_size,
-                              x86ms->above_4g_mem_size,
-                              pci_memory, ram_memory);
+        object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
+                                 OBJECT(ram_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
+                                 OBJECT(pci_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
+                                 OBJECT(system_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
+                                 OBJECT(system_io), &error_fatal);
+        object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
+                                 x86ms->below_4g_mem_size, &error_fatal);
+        object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
+                                 x86ms->above_4g_mem_size, &error_fatal);
+        object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE,
+                                pci_type, &error_fatal);
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
+
+        pci_bus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
         pci_bus_map_irqs(pci_bus,
                          xen_enabled() ? xen_pci_slot_get_pirq
                                        : pc_pci_slot_get_pirq);
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index c458987405..62d6287681 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -249,9 +249,14 @@ static void i440fx_pcihost_initfn(Object *obj)
 
 static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
 {
+    ERRP_GUARD();
     I440FXState *s = I440FX_PCI_HOST_BRIDGE(dev);
     PCIHostState *phb = PCI_HOST_BRIDGE(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    PCIBus *b;
+    PCIDevice *d;
+    PCII440FXState *f;
+    unsigned i;
 
     memory_region_add_subregion(s->io_memory, 0xcf8, &phb->conf_mem);
     sysbus_init_ioports(sbd, 0xcf8, 4);
@@ -262,36 +267,10 @@ static void i440fx_pcihost_realize(DeviceState *dev, Error **errp)
     /* register i440fx 0xcf8 port as coalesced pio */
     memory_region_set_flush_coalesced(&phb->data_mem);
     memory_region_add_coalescing(&phb->conf_mem, 0, 4);
-}
-
-PCIBus *i440fx_init(const char *pci_type,
-                    DeviceState *dev,
-                    MemoryRegion *address_space_mem,
-                    MemoryRegion *address_space_io,
-                    ram_addr_t below_4g_mem_size,
-                    ram_addr_t above_4g_mem_size,
-                    MemoryRegion *pci_address_space,
-                    MemoryRegion *ram_memory)
-{
-    I440FXState *s = I440FX_PCI_HOST_BRIDGE(dev);
-    PCIHostState *phb = PCI_HOST_BRIDGE(dev);
-    PCIBus *b;
-    PCIDevice *d;
-    PCII440FXState *f;
-    unsigned i;
-
-    s->system_memory = address_space_mem;
-    s->io_memory = address_space_io;
-    s->pci_address_space = pci_address_space;
-    s->ram_memory = ram_memory;
-    s->below_4g_mem_size = below_4g_mem_size;
-    s->above_4g_mem_size = above_4g_mem_size;
-    s->pci_type = (char *)pci_type;
 
     b = pci_root_bus_new(dev, NULL, s->pci_address_space,
                          s->io_memory, 0, TYPE_PCI_BUS);
     phb->bus = b;
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     d = pci_create_simple(b, 0, s->pci_type);
     f = I440FX_PCI_DEVICE(d);
@@ -335,8 +314,6 @@ PCIBus *i440fx_init(const char *pci_type,
     d->config[I440FX_COREBOOT_RAM_SIZE] = ram_size;
 
     i440fx_update_memory_mappings(f);
-
-    return b;
 }
 
 static void i440fx_class_init(ObjectClass *klass, void *data)
diff --git a/include/hw/pci-host/i440fx.h b/include/hw/pci-host/i440fx.h
index 2d7bae5a45..c988f70890 100644
--- a/include/hw/pci-host/i440fx.h
+++ b/include/hw/pci-host/i440fx.h
@@ -34,14 +34,4 @@ struct PCII440FXState {
 
 #define TYPE_IGD_PASSTHROUGH_I440FX_PCI_DEVICE "igd-passthrough-i440FX"
 
-PCIBus *i440fx_init(const char *pci_type,
-                    DeviceState *dev,
-                    MemoryRegion *address_space_mem,
-                    MemoryRegion *address_space_io,
-                    ram_addr_t below_4g_mem_size,
-                    ram_addr_t above_4g_mem_size,
-                    MemoryRegion *pci_memory,
-                    MemoryRegion *ram_memory);
-
-
 #endif

From c589f7cf0860534dfd21023dec2ec322688a5a03 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Fri, 30 Jun 2023 09:37:20 +0200
Subject: [PATCH 0667/1353] hw/i386/pc_piix: Move i440fx' realize near its
 qdev_new()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I440FX realization is currently mixed with PIIX3 creation. Furthermore, it is
common practice to only set properties between a device's qdev_new() and
qdev_realize(). Clean up to resolve both issues.

Since I440FX spawns a PCI bus let's also move the pci_bus initialization there.

Note that when running `qemu-system-x86_64 -M pc -S` before and after this
patch, `info mtree` in the QEMU console doesn't show any differences except that
the ordering is different.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630073720.21297-18-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_piix.c | 51 ++++++++++++++++++++++++-----------------------
 1 file changed, 26 insertions(+), 25 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 62148d7636..b18443d3df 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -114,7 +114,7 @@ static void pc_init1(MachineState *machine,
     X86MachineState *x86ms = X86_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *system_io = get_system_io();
-    PCIBus *pci_bus;
+    PCIBus *pci_bus = NULL;
     ISABus *isa_bus;
     int piix3_devfn = -1;
     qemu_irq smi_irq;
@@ -126,7 +126,6 @@ static void pc_init1(MachineState *machine,
     MemoryRegion *rom_memory = system_memory;
     ram_addr_t lowmem;
     uint64_t hole64_size = 0;
-    Object *phb = NULL;
 
     /*
      * Calculate ram split, for memory below and above 4G.  It's a bit
@@ -198,11 +197,36 @@ static void pc_init1(MachineState *machine,
     }
 
     if (pcmc->pci_enabled) {
+        Object *phb;
+
         pci_memory = g_new(MemoryRegion, 1);
         memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
         rom_memory = pci_memory;
+
         phb = OBJECT(qdev_new(host_type));
         object_property_add_child(OBJECT(machine), "i440fx", phb);
+        object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
+                                 OBJECT(ram_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
+                                 OBJECT(pci_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
+                                 OBJECT(system_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
+                                 OBJECT(system_io), &error_fatal);
+        object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
+                                 x86ms->below_4g_mem_size, &error_fatal);
+        object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
+                                 x86ms->above_4g_mem_size, &error_fatal);
+        object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE, pci_type,
+                                &error_fatal);
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
+
+        pci_bus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
+        pci_bus_map_irqs(pci_bus,
+                         xen_enabled() ? xen_pci_slot_get_pirq
+                                       : pc_pci_slot_get_pirq);
+        pcms->bus = pci_bus;
+
         hole64_size = object_property_get_uint(phb,
                                                PCI_HOST_PROP_PCI_HOLE64_SIZE,
                                                &error_abort);
@@ -239,28 +263,6 @@ static void pc_init1(MachineState *machine,
         PIIX3State *piix3;
         PCIDevice *pci_dev;
 
-        object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
-                                 OBJECT(ram_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
-                                 OBJECT(pci_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
-                                 OBJECT(system_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
-                                 OBJECT(system_io), &error_fatal);
-        object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
-                                 x86ms->below_4g_mem_size, &error_fatal);
-        object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
-                                 x86ms->above_4g_mem_size, &error_fatal);
-        object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE,
-                                pci_type, &error_fatal);
-        sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
-
-        pci_bus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
-        pci_bus_map_irqs(pci_bus,
-                         xen_enabled() ? xen_pci_slot_get_pirq
-                                       : pc_pci_slot_get_pirq);
-        pcms->bus = pci_bus;
-
         pci_dev = pci_create_simple_multifunction(pci_bus, -1, true,
                                                   TYPE_PIIX3_DEVICE);
 
@@ -285,7 +287,6 @@ static void pc_init1(MachineState *machine,
         rtc_state = ISA_DEVICE(object_resolve_path_component(OBJECT(pci_dev),
                                                              "rtc"));
     } else {
-        pci_bus = NULL;
         isa_bus = isa_bus_new(NULL, system_memory, system_io,
                               &error_abort);
 

From e052944a966ca4eb0131121646fa0ef047c25e52 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sat, 4 Mar 2023 12:40:42 +0100
Subject: [PATCH 0668/1353] hw/pci/pci: Remove multifunction parameter from
 pci_create_simple_multifunction()

There is also pci_create_simple() which creates non-multifunction PCI
devices. Accordingly the parameter is always set to true when a multi
function PCI device is to be created.

The reason for the parameter's existence seems to be that it is used in the
internal PCI code as well which is the only location where it gets set to
false. This one usage can be replaced by trivial code.

Remove this redundant, error-prone parameter.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230304114043.121024-5-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_piix.c    | 3 +--
 hw/i386/pc_q35.c     | 4 ++--
 hw/mips/boston.c     | 3 +--
 hw/mips/fuloong2e.c  | 2 +-
 hw/mips/malta.c      | 2 +-
 hw/pci/pci.c         | 7 ++++---
 hw/ppc/pegasos2.c    | 2 +-
 include/hw/pci/pci.h | 1 -
 8 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index b18443d3df..ac72e8f5be 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -263,8 +263,7 @@ static void pc_init1(MachineState *machine,
         PIIX3State *piix3;
         PCIDevice *pci_dev;
 
-        pci_dev = pci_create_simple_multifunction(pci_bus, -1, true,
-                                                  TYPE_PIIX3_DEVICE);
+        pci_dev = pci_create_simple_multifunction(pci_bus, -1, TYPE_PIIX3_DEVICE);
 
         if (xen_enabled()) {
             pci_device_set_intx_routing_notifier(
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 02dd274276..fdab1f6a56 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -304,7 +304,7 @@ static void pc_q35_init(MachineState *machine)
         ahci = pci_create_simple_multifunction(host_bus,
                                                PCI_DEVFN(ICH9_SATA1_DEV,
                                                          ICH9_SATA1_FUNC),
-                                               true, "ich9-ahci");
+                                               "ich9-ahci");
         idebus[0] = qdev_get_child_bus(&ahci->qdev, "ide.0");
         idebus[1] = qdev_get_child_bus(&ahci->qdev, "ide.1");
         g_assert(MAX_SATA_PORTS == ahci_get_num_ports(ahci));
@@ -326,7 +326,7 @@ static void pc_q35_init(MachineState *machine)
         smb = pci_create_simple_multifunction(host_bus,
                                               PCI_DEVFN(ICH9_SMB_DEV,
                                                         ICH9_SMB_FUNC),
-                                              true, TYPE_ICH9_SMB_DEVICE);
+                                              TYPE_ICH9_SMB_DEVICE);
         pcms->smbus = I2C_BUS(qdev_get_child_bus(DEVICE(smb), "i2c"));
 
         smbus_eeprom_init(pcms->smbus, 8, NULL, 0);
diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index 21ad844519..4e11ff6cd6 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -770,8 +770,7 @@ static void boston_mach_init(MachineState *machine)
                              boston_lcd_event, NULL, s, NULL, true);
 
     ahci = pci_create_simple_multifunction(&PCI_BRIDGE(&pcie2->root)->sec_bus,
-                                           PCI_DEVFN(0, 0),
-                                           true, TYPE_ICH9_AHCI);
+                                           PCI_DEVFN(0, 0), TYPE_ICH9_AHCI);
     g_assert(ARRAY_SIZE(hd) == ahci_get_num_ports(ahci));
     ide_drive_get(hd, ahci_get_num_ports(ahci));
     ahci_ide_create_devs(ahci, hd);
diff --git a/hw/mips/fuloong2e.c b/hw/mips/fuloong2e.c
index cfc8ca6ae4..c827f615f3 100644
--- a/hw/mips/fuloong2e.c
+++ b/hw/mips/fuloong2e.c
@@ -297,7 +297,7 @@ static void mips_fuloong2e_init(MachineState *machine)
     /* South bridge -> IP5 */
     pci_dev = pci_create_simple_multifunction(pci_bus,
                                               PCI_DEVFN(FULOONG2E_VIA_SLOT, 0),
-                                              true, TYPE_VT82C686B_ISA);
+                                              TYPE_VT82C686B_ISA);
     object_property_add_alias(OBJECT(machine), "rtc-time",
                               object_resolve_path_component(OBJECT(pci_dev),
                                                             "rtc"),
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 47cb49f691..f9618fa5f5 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -1251,7 +1251,7 @@ void mips_malta_init(MachineState *machine)
     pci_bus_map_irqs(pci_bus, malta_pci_slot_get_pirq);
 
     /* Southbridge */
-    piix4 = pci_create_simple_multifunction(pci_bus, PIIX4_PCI_DEVFN, true,
+    piix4 = pci_create_simple_multifunction(pci_bus, PIIX4_PCI_DEVFN,
                                             TYPE_PIIX4_PCI_DEVICE);
     isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(piix4), "isa.0"));
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index e2eb4c3b4a..5152989c10 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2186,17 +2186,18 @@ bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp)
 }
 
 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
-                                           bool multifunction,
                                            const char *name)
 {
-    PCIDevice *dev = pci_new_multifunction(devfn, multifunction, name);
+    PCIDevice *dev = pci_new_multifunction(devfn, true, name);
     pci_realize_and_unref(dev, bus, &error_fatal);
     return dev;
 }
 
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name)
 {
-    return pci_create_simple_multifunction(bus, devfn, false, name);
+    PCIDevice *dev = pci_new(devfn, name);
+    pci_realize_and_unref(dev, bus, &error_fatal);
+    return dev;
 }
 
 static uint8_t pci_find_space(PCIDevice *pdev, uint8_t size)
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 9c9944188b..4447bbe8ec 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -180,7 +180,7 @@ static void pegasos2_init(MachineState *machine)
 
     /* VIA VT8231 South Bridge (multifunction PCI device) */
     via = OBJECT(pci_create_simple_multifunction(pci_bus, PCI_DEVFN(12, 0),
-                                                 true, TYPE_VT8231_ISA));
+                                                 TYPE_VT8231_ISA));
     for (i = 0; i < PCI_NUM_PINS; i++) {
         pm->via_pirq[i] = qdev_get_gpio_in_named(DEVICE(via), "pirq", i);
     }
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index e6d0574a29..18c35b64db 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -583,7 +583,6 @@ PCIDevice *pci_new(int devfn, const char *name);
 bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp);
 
 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
-                                           bool multifunction,
                                            const char *name);
 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name);
 

From 03afdc28b3ffb9315f9612052b2b1c250370c344 Mon Sep 17 00:00:00 2001
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date: Sun, 21 May 2023 19:01:46 +0100
Subject: [PATCH 0669/1353] target/mips: Implement Loongson CSR instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Loongson introduced CSR instructions since 3A4000, which looks
similar to IOCSR and CPUCFG instructions we seen in LoongArch.

Unfortunately we don't have much document about those instructions,
bit fields of CPUCFG instructions and IOCSR registers can be found
at 3A4000's user manual, while instruction encodings can be found
at arch/mips/include/asm/mach-loongson64/loongson_regs.h from
Linux Kernel.

Our predefined CPUCFG bits are differ from actual 3A4000, since
we can't emulate all CPUCFG features present in 3A4000 for now,
we just enable bits for what we have in TCG.

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Message-Id: <20230521214832.20145-2-jiaxun.yang@flygoat.com>
[JY:  Fixed typo in ase_lcsr_available(),
      retrict GEN_FALSE_TRANS]
[PMD: Fix meson's mips_softmmu_ss -> mips_system_ss,
      restrict AddressSpace/MemoryRegion to SysEmu]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu-defs.c.inc           |  9 ++++
 target/mips/cpu.c                    | 10 ++++
 target/mips/cpu.h                    | 42 ++++++++++++++++
 target/mips/helper.h                 |  4 ++
 target/mips/internal.h               |  2 +
 target/mips/tcg/lcsr.decode          | 17 +++++++
 target/mips/tcg/lcsr_translate.c     | 75 ++++++++++++++++++++++++++++
 target/mips/tcg/meson.build          |  2 +
 target/mips/tcg/op_helper.c          | 16 ++++++
 target/mips/tcg/sysemu/lcsr_helper.c | 45 +++++++++++++++++
 target/mips/tcg/sysemu/meson.build   |  4 ++
 target/mips/tcg/sysemu_helper.h.inc  |  8 +++
 target/mips/tcg/translate.c          |  3 ++
 target/mips/tcg/translate.h          |  1 +
 14 files changed, 238 insertions(+)
 create mode 100644 target/mips/tcg/lcsr.decode
 create mode 100644 target/mips/tcg/lcsr_translate.c
 create mode 100644 target/mips/tcg/sysemu/lcsr_helper.c

diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index d45f245a67..167c96cb27 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -895,6 +895,15 @@ const mips_def_t mips_defs[] =
         .CP1_fcr31 = 0,
         .CP1_fcr31_rw_bitmask = 0xFF83FFFF,
         .MSAIR = (0x01 << MSAIR_ProcID) | (0x40 << MSAIR_Rev),
+        .lcsr_cpucfg1 = (1 << CPUCFG1_FP) | (2 << CPUCFG1_FPREV) |
+                    (1 << CPUCFG1_MSA1) | (1 << CPUCFG1_LSLDR0) |
+                    (1 << CPUCFG1_LSPERF) | (1 << CPUCFG1_LSPERFX) |
+                    (1 << CPUCFG1_LSSYNCI) | (1 << CPUCFG1_LLEXC) |
+                    (1 << CPUCFG1_SCRAND) | (1 << CPUCFG1_MUALP) |
+                    (1 << CPUCFG1_KMUALEN) | (1 << CPUCFG1_ITLBT) |
+                    (1 << CPUCFG1_SFBP) | (1 << CPUCFG1_CDMAP),
+        .lcsr_cpucfg2 = (1 << CPUCFG2_LEXT1) | (1 << CPUCFG2_LCSRP) |
+                    (1 << CPUCFG2_LDISBLIKELY),
         .SEGBITS = 48,
         .PABITS = 48,
         .insn_flags = CPU_MIPS64R2 | INSN_LOONGSON3A |
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index b7119cbbb4..63da1948fd 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -244,6 +244,8 @@ static void mips_cpu_reset_hold(Object *obj)
     env->CP0_PageGrain_rw_bitmask = env->cpu_model->CP0_PageGrain_rw_bitmask;
     env->CP0_PageGrain = env->cpu_model->CP0_PageGrain;
     env->CP0_EBaseWG_rw_bitmask = env->cpu_model->CP0_EBaseWG_rw_bitmask;
+    env->lcsr_cpucfg1 = env->cpu_model->lcsr_cpucfg1;
+    env->lcsr_cpucfg2 = env->cpu_model->lcsr_cpucfg2;
     env->active_fpu.fcr0 = env->cpu_model->CP1_fcr0;
     env->active_fpu.fcr31_rw_bitmask = env->cpu_model->CP1_fcr31_rw_bitmask;
     env->active_fpu.fcr31 = env->cpu_model->CP1_fcr31;
@@ -507,6 +509,14 @@ static void mips_cpu_initfn(Object *obj)
     cpu->count_div = clock_new(OBJECT(obj), "clk-div-count");
     env->count_clock = clock_new(OBJECT(obj), "clk-count");
     env->cpu_model = mcc->cpu_def;
+#ifndef CONFIG_USER_ONLY
+    if (mcc->cpu_def->lcsr_cpucfg2 & (1 << CPUCFG2_LCSRP)) {
+        memory_region_init_io(&env->iocsr.mr, OBJECT(cpu), NULL,
+                                env, "iocsr", UINT64_MAX);
+        address_space_init(&env->iocsr.as,
+                            &env->iocsr.mr, "IOCSR");
+    }
+#endif
 }
 
 static char *mips_cpu_type_name(const char *cpu_model)
diff --git a/target/mips/cpu.h b/target/mips/cpu.h
index d3ee874a18..f81bd06f5e 100644
--- a/target/mips/cpu.h
+++ b/target/mips/cpu.h
@@ -3,6 +3,9 @@
 
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#ifndef CONFIG_USER_ONLY
+#include "exec/memory.h"
+#endif
 #include "fpu/softfloat-types.h"
 #include "hw/clock.h"
 #include "mips-defs.h"
@@ -1068,6 +1071,33 @@ typedef struct CPUArchState {
  */
     int32_t CP0_DESAVE;
     target_ulong CP0_KScratch[MIPS_KSCRATCH_NUM];
+/*
+ * Loongson CSR CPUCFG registers
+ */
+    uint32_t lcsr_cpucfg1;
+#define CPUCFG1_FP     0
+#define CPUCFG1_FPREV  1
+#define CPUCFG1_MMI    4
+#define CPUCFG1_MSA1   5
+#define CPUCFG1_MSA2   6
+#define CPUCFG1_LSLDR0 16
+#define CPUCFG1_LSPERF 17
+#define CPUCFG1_LSPERFX 18
+#define CPUCFG1_LSSYNCI 19
+#define CPUCFG1_LLEXC   20
+#define CPUCFG1_SCRAND  21
+#define CPUCFG1_MUALP   25
+#define CPUCFG1_KMUALEN 26
+#define CPUCFG1_ITLBT   27
+#define CPUCFG1_SFBP    29
+#define CPUCFG1_CDMAP   30
+    uint32_t lcsr_cpucfg2;
+#define CPUCFG2_LEXT1   0
+#define CPUCFG2_LEXT2   1
+#define CPUCFG2_LEXT3   2
+#define CPUCFG2_LSPW    3
+#define CPUCFG2_LCSRP   27
+#define CPUCFG2_LDISBLIKELY 28
 
     /* We waste some space so we can handle shadow registers like TCs. */
     TCState tcs[MIPS_SHADOW_SET_MAX];
@@ -1156,6 +1186,12 @@ typedef struct CPUArchState {
     void *irq[8];
     struct MIPSITUState *itu;
     MemoryRegion *itc_tag; /* ITC Configuration Tags */
+
+    /* Loongson IOCSR memory */
+    struct {
+        AddressSpace as;
+        MemoryRegion mr;
+    } iocsr;
 #endif
 
     const mips_def_t *cpu_model;
@@ -1281,6 +1317,12 @@ static inline bool ase_msa_available(CPUMIPSState *env)
     return env->CP0_Config3 & (1 << CP0C3_MSAP);
 }
 
+/* Check presence of Loongson CSR instructions */
+static inline bool ase_lcsr_available(CPUMIPSState *env)
+{
+    return env->lcsr_cpucfg2 & (1 << CPUCFG2_LCSRP);
+}
+
 /* Check presence of multi-threading ASE implementation */
 static inline bool ase_mt_available(CPUMIPSState *env)
 {
diff --git a/target/mips/helper.h b/target/mips/helper.h
index de32d82e98..0f8462febb 100644
--- a/target/mips/helper.h
+++ b/target/mips/helper.h
@@ -196,6 +196,10 @@ DEF_HELPER_1(rdhwr_xnp, tl, env)
 DEF_HELPER_2(pmon, void, env, int)
 DEF_HELPER_1(wait, void, env)
 
+#ifdef TARGET_MIPS64
+DEF_HELPER_FLAGS_2(lcsr_cpucfg, TCG_CALL_NO_RWG_SE, tl, env, tl)
+#endif
+
 /* Loongson multimedia functions.  */
 DEF_HELPER_FLAGS_2(paddsh, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(paddush, TCG_CALL_NO_RWG_SE, i64, i64, i64)
diff --git a/target/mips/internal.h b/target/mips/internal.h
index 4b0031d10d..1d0c026c7d 100644
--- a/target/mips/internal.h
+++ b/target/mips/internal.h
@@ -79,6 +79,8 @@ struct mips_def_t {
     int32_t CP0_PageGrain_rw_bitmask;
     int32_t CP0_PageGrain;
     target_ulong CP0_EBaseWG_rw_bitmask;
+    uint32_t lcsr_cpucfg1;
+    uint32_t lcsr_cpucfg2;
     uint64_t insn_flags;
     enum mips_mmu_types mmu_type;
     int32_t SAARP;
diff --git a/target/mips/tcg/lcsr.decode b/target/mips/tcg/lcsr.decode
new file mode 100644
index 0000000000..960ef8b6f9
--- /dev/null
+++ b/target/mips/tcg/lcsr.decode
@@ -0,0 +1,17 @@
+# Loongson CSR instructions
+#
+# Copyright (C) 2023 Jiaxun Yang <jiaxun.yang@flygoat.com>
+#
+# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+
+&r           rs rt rd sa
+
+@rs_rd       ...... rs:5 ..... rd:5 ..... ...... &r rt=0 sa=0
+
+CPUCFG       110010 ..... 01000 ..... 00100 011000 @rs_rd
+
+RDCSR        110010 ..... 00000 ..... 00100 011000 @rs_rd
+WRCSR        110010 ..... 00001 ..... 00100 011000 @rs_rd
+DRDCSR       110010 ..... 00010 ..... 00100 011000 @rs_rd
+DWRCSR       110010 ..... 00011 ..... 00100 011000 @rs_rd
diff --git a/target/mips/tcg/lcsr_translate.c b/target/mips/tcg/lcsr_translate.c
new file mode 100644
index 0000000000..9f2a5f4a37
--- /dev/null
+++ b/target/mips/tcg/lcsr_translate.c
@@ -0,0 +1,75 @@
+/*
+ * Loongson CSR instructions translation routines
+ *
+ *  Copyright (c) 2023 Jiaxun Yang <jiaxun.yang@flygoat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "tcg/tcg-op.h"
+#include "tcg/tcg-op-gvec.h"
+#include "exec/helper-gen.h"
+#include "translate.h"
+
+/* Include the auto-generated decoder.  */
+#include "decode-lcsr.c.inc"
+
+static bool trans_CPUCFG(DisasContext *ctx, arg_CPUCFG *a)
+{
+    TCGv dest = tcg_temp_new();
+    TCGv src1 = tcg_temp_new();
+
+    gen_load_gpr(src1, a->rs);
+    gen_helper_lcsr_cpucfg(dest, cpu_env, src1);
+    gen_store_gpr(dest, a->rd);
+
+    return true;
+}
+
+#ifndef CONFIG_USER_ONLY
+static bool gen_rdcsr(DisasContext *ctx, arg_r *a,
+                        void (*func)(TCGv, TCGv_ptr, TCGv))
+{
+    TCGv dest = tcg_temp_new();
+    TCGv src1 = tcg_temp_new();
+
+    check_cp0_enabled(ctx);
+    gen_load_gpr(src1, a->rs);
+    func(dest, cpu_env, src1);
+    gen_store_gpr(dest, a->rd);
+
+    return true;
+}
+
+static bool gen_wrcsr(DisasContext *ctx, arg_r *a,
+                        void (*func)(TCGv_ptr, TCGv, TCGv))
+{
+    TCGv val = tcg_temp_new();
+    TCGv addr = tcg_temp_new();
+
+    check_cp0_enabled(ctx);
+    gen_load_gpr(addr, a->rs);
+    gen_load_gpr(val, a->rd);
+    func(cpu_env, addr, val);
+
+    return true;
+}
+
+TRANS(RDCSR, gen_rdcsr, gen_helper_lcsr_rdcsr)
+TRANS(DRDCSR, gen_rdcsr, gen_helper_lcsr_drdcsr)
+TRANS(WRCSR, gen_wrcsr, gen_helper_lcsr_wrcsr)
+TRANS(DWRCSR, gen_wrcsr, gen_helper_lcsr_dwrcsr)
+#else
+#define GEN_FALSE_TRANS(name)   \
+static bool trans_##name(DisasContext *ctx, arg_##name * a)  \
+{   \
+    return false;   \
+}
+
+GEN_FALSE_TRANS(RDCSR)
+GEN_FALSE_TRANS(DRDCSR)
+GEN_FALSE_TRANS(WRCSR)
+GEN_FALSE_TRANS(DWRCSR)
+#endif
diff --git a/target/mips/tcg/meson.build b/target/mips/tcg/meson.build
index 7ee969ec8f..ea7fb582f2 100644
--- a/target/mips/tcg/meson.build
+++ b/target/mips/tcg/meson.build
@@ -4,6 +4,7 @@ gen = [
   decodetree.process('tx79.decode', extra_args: '--static-decode=decode_tx79'),
   decodetree.process('vr54xx.decode', extra_args: '--decode=decode_ext_vr54xx'),
   decodetree.process('octeon.decode', extra_args: '--decode=decode_ext_octeon'),
+  decodetree.process('lcsr.decode', extra_args: '--decode=decode_ase_lcsr'),
 ]
 
 mips_ss.add(gen)
@@ -26,6 +27,7 @@ mips_ss.add(files(
 mips_ss.add(when: 'TARGET_MIPS64', if_true: files(
   'tx79_translate.c',
   'octeon_translate.c',
+  'lcsr_translate.c',
 ), if_false: files(
   'mxu_translate.c',
 ))
diff --git a/target/mips/tcg/op_helper.c b/target/mips/tcg/op_helper.c
index ef3dafcbb3..98935b5e64 100644
--- a/target/mips/tcg/op_helper.c
+++ b/target/mips/tcg/op_helper.c
@@ -257,6 +257,22 @@ void helper_pmon(CPUMIPSState *env, int function)
     }
 }
 
+#ifdef TARGET_MIPS64
+target_ulong helper_lcsr_cpucfg(CPUMIPSState *env, target_ulong rs)
+{
+    switch (rs) {
+    case 0:
+        return env->CP0_PRid;
+    case 1:
+        return env->lcsr_cpucfg1;
+    case 2:
+        return env->lcsr_cpucfg2;
+    default:
+        return 0;
+    }
+}
+#endif
+
 #if !defined(CONFIG_USER_ONLY)
 
 void mips_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
diff --git a/target/mips/tcg/sysemu/lcsr_helper.c b/target/mips/tcg/sysemu/lcsr_helper.c
new file mode 100644
index 0000000000..942143d209
--- /dev/null
+++ b/target/mips/tcg/sysemu/lcsr_helper.c
@@ -0,0 +1,45 @@
+/*
+ * Loongson CSR instructions translation routines
+ *
+ *  Copyright (c) 2023 Jiaxun Yang <jiaxun.yang@flygoat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+#include "cpu.h"
+#include "internal.h"
+#include "qemu/host-utils.h"
+#include "exec/helper-proto.h"
+#include "exec/exec-all.h"
+#include "exec/cpu_ldst.h"
+
+#define GET_MEMTXATTRS(cas) \
+        ((MemTxAttrs){.requester_id = env_cpu(cas)->cpu_index})
+
+uint64_t helper_lcsr_rdcsr(CPUMIPSState *env, target_ulong r_addr)
+{
+    return address_space_ldl(&env->iocsr.as, r_addr,
+                             GET_MEMTXATTRS(env), NULL);
+}
+
+uint64_t helper_lcsr_drdcsr(CPUMIPSState *env, target_ulong r_addr)
+{
+    return address_space_ldq(&env->iocsr.as, r_addr,
+                             GET_MEMTXATTRS(env), NULL);
+}
+
+void helper_lcsr_wrcsr(CPUMIPSState *env, target_ulong w_addr,
+                      target_ulong val)
+{
+    address_space_stl(&env->iocsr.as, w_addr,
+                      val, GET_MEMTXATTRS(env), NULL);
+}
+
+void helper_lcsr_dwrcsr(CPUMIPSState *env, target_ulong w_addr,
+                      target_ulong val)
+{
+    address_space_stq(&env->iocsr.as, w_addr,
+                      val, GET_MEMTXATTRS(env), NULL);
+}
diff --git a/target/mips/tcg/sysemu/meson.build b/target/mips/tcg/sysemu/meson.build
index 43b35b3803..ec665a4b1e 100644
--- a/target/mips/tcg/sysemu/meson.build
+++ b/target/mips/tcg/sysemu/meson.build
@@ -4,3 +4,7 @@ mips_system_ss.add(files(
   'special_helper.c',
   'tlb_helper.c',
 ))
+
+mips_system_ss.add(when: 'TARGET_MIPS64', if_true: files(
+  'lcsr_helper.c',
+))
diff --git a/target/mips/tcg/sysemu_helper.h.inc b/target/mips/tcg/sysemu_helper.h.inc
index af585b5d9c..f163af1eac 100644
--- a/target/mips/tcg/sysemu_helper.h.inc
+++ b/target/mips/tcg/sysemu_helper.h.inc
@@ -181,3 +181,11 @@ DEF_HELPER_1(eret, void, env)
 DEF_HELPER_1(eretnc, void, env)
 DEF_HELPER_1(deret, void, env)
 DEF_HELPER_3(cache, void, env, tl, i32)
+
+#ifdef TARGET_MIPS64
+/* Longson CSR */
+DEF_HELPER_2(lcsr_rdcsr, i64, env, tl)
+DEF_HELPER_2(lcsr_drdcsr, i64, env, tl)
+DEF_HELPER_3(lcsr_wrcsr, void, env, tl, tl)
+DEF_HELPER_3(lcsr_dwrcsr, void, env, tl, tl)
+#endif
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 74af91e4f5..7abbb0b5e2 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -15352,6 +15352,9 @@ static void decode_opc(CPUMIPSState *env, DisasContext *ctx)
         return;
     }
 #if defined(TARGET_MIPS64)
+    if (ase_lcsr_available(env) && decode_ase_lcsr(ctx, ctx->opcode)) {
+        return;
+    }
     if (cpu_supports_isa(env, INSN_OCTEON) && decode_ext_octeon(ctx, ctx->opcode)) {
         return;
     }
diff --git a/target/mips/tcg/translate.h b/target/mips/tcg/translate.h
index 3b0498a47a..db3dc932c7 100644
--- a/target/mips/tcg/translate.h
+++ b/target/mips/tcg/translate.h
@@ -221,6 +221,7 @@ bool decode_isa_rel6(DisasContext *ctx, uint32_t insn);
 bool decode_ase_msa(DisasContext *ctx, uint32_t insn);
 bool decode_ext_txx9(DisasContext *ctx, uint32_t insn);
 #if defined(TARGET_MIPS64)
+bool decode_ase_lcsr(DisasContext *ctx, uint32_t insn);
 bool decode_ext_tx79(DisasContext *ctx, uint32_t insn);
 bool decode_ext_octeon(DisasContext *ctx, uint32_t insn);
 #endif

From 99eff13120c8695f5d14b2edfe24739dd13b982f Mon Sep 17 00:00:00 2001
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
Date: Sun, 21 May 2023 22:18:59 +0100
Subject: [PATCH 0670/1353] hw/mips/loongson3_virt: Relax CPU restrictions for
 TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After implemented CPUCFG and CSR, we are now able to boot Linux
kernel with Loongson-3A4000 CPU, so there is no point to restrict
CPU type to 3A1000 only, instead we just check for presence of
INSN_LOONGSON3A.

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Message-Id: <20230521214832.20145-3-jiaxun.yang@flygoat.com>
[JY: Check for cpu_type_supports_isa(INSN_LOONGSON3A)]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/mips/loongson3_virt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index 3dd91da7a6..4018b8c1d3 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -481,8 +481,8 @@ static void mips_loongson3_virt_init(MachineState *machine)
         if (!machine->cpu_type) {
             machine->cpu_type = MIPS_CPU_TYPE_NAME("Loongson-3A1000");
         }
-        if (!strstr(machine->cpu_type, "Loongson-3A1000")) {
-            error_report("Loongson-3/TCG needs cpu type Loongson-3A1000");
+        if (!cpu_type_supports_isa(machine->cpu_type, INSN_LOONGSON3A)) {
+            error_report("Loongson-3/TCG needs a Loongson-3 series cpu");
             exit(1);
         }
     } else {

From 59db94656d21e17a365af2e3b8f7e66b60e22810 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:50 +0300
Subject: [PATCH 0671/1353] target/mips: Add emulation of MXU instructions for
 32-bit load/store
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for emulating:
- S32LDDV and S32LDDVR
- S32STD and S32STDR
- S32STDV and S32STDVR
MXU instructions.

Add support for emulating MXU instructions with address register
post-modify counterparts:
- S32LDI and S32LDIR
- S32LDIV and S32LDIVR
- S32SDI and S32SDIR
- S32SDIV and S32SDIVR

Refactor support for emulating the S32LDD and S32LDDR instructions.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-2-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 306 +++++++++++++++++++++++++++++---
 1 file changed, 281 insertions(+), 25 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 39348b3a91..c69c5795c9 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -237,11 +237,11 @@
  *          ├─ 001100 ─ OPC_MXU_D16MADL
  *          ├─ 001101 ─ OPC_MXU_S16MAD
  *          ├─ 001110 ─ OPC_MXU_Q16ADD
- *          ├─ 001111 ─ OPC_MXU_D16MACE     23
+ *          ├─ 001111 ─ OPC_MXU_D16MACE     20 (13..10 don't care)
  *          │                            ┌─ 0 ─ OPC_MXU_S32LDD
  *          ├─ 010000 ─ OPC_MXU__POOL04 ─┴─ 1 ─ OPC_MXU_S32LDDR
  *          │
- *          │                               23
+ *          │                               20 (13..10 don't care)
  *          ├─ 010001 ─ OPC_MXU__POOL05 ─┬─ 0 ─ OPC_MXU_S32STD
  *          │                            └─ 1 ─ OPC_MXU_S32STDR
  *          │
@@ -253,11 +253,11 @@
  *          ├─ 010011 ─ OPC_MXU__POOL07 ─┬─ 0000 ─ OPC_MXU_S32STDV
  *          │                            └─ 0001 ─ OPC_MXU_S32STDVR
  *          │
- *          │                               23
+ *          │                               20 (13..10 don't care)
  *          ├─ 010100 ─ OPC_MXU__POOL08 ─┬─ 0 ─ OPC_MXU_S32LDI
  *          │                            └─ 1 ─ OPC_MXU_S32LDIR
  *          │
- *          │                               23
+ *          │                               20 (13..10 don't care)
  *          ├─ 010101 ─ OPC_MXU__POOL09 ─┬─ 0 ─ OPC_MXU_S32SDI
  *          │                            └─ 1 ─ OPC_MXU_S32SDIR
  *          │
@@ -357,6 +357,13 @@ enum {
     OPC_MXU_D16MUL   = 0x08,
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU__POOL04  = 0x10,
+    OPC_MXU__POOL05  = 0x11,
+    OPC_MXU__POOL06  = 0x12,
+    OPC_MXU__POOL07  = 0x13,
+    OPC_MXU__POOL08  = 0x14,
+    OPC_MXU__POOL09  = 0x15,
+    OPC_MXU__POOL10  = 0x16,
+    OPC_MXU__POOL11  = 0x17,
     OPC_MXU_S8LDD    = 0x22,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU_S32M2I   = 0x2E,
@@ -378,11 +385,11 @@ enum {
 };
 
 /*
- * MXU pool 04
+ * MXU pool 04 05 06 07 08 09 10 11
  */
 enum {
-    OPC_MXU_S32LDD   = 0x00,
-    OPC_MXU_S32LDDR  = 0x01,
+    OPC_MXU_S32LDST  = 0x00,
+    OPC_MXU_S32LDSTR = 0x01,
 };
 
 /*
@@ -806,35 +813,147 @@ static void gen_mxu_q8mul_q8mulsu(DisasContext *ctx)
 
 /*
  * S32LDD  XRa, Rb, S12 - Load a word from memory to XRF
- * S32LDDR XRa, Rb, S12 - Load a word from memory to XRF, reversed byte seq.
+ * S32LDDR XRa, Rb, S12 - Load a word from memory to XRF
+ *   in reversed byte seq.
+ * S32LDI  XRa, Rb, S12 - Load a word from memory to XRF,
+ *   post modify base address GPR.
+ * S32LDIR XRa, Rb, S12 - Load a word from memory to XRF,
+ *   post modify base address GPR and load in reversed byte seq.
  */
-static void gen_mxu_s32ldd_s32lddr(DisasContext *ctx)
+static void gen_mxu_s32ldxx(DisasContext *ctx, bool reversed, bool postinc)
 {
     TCGv t0, t1;
-    uint32_t XRa, Rb, s12, sel;
+    uint32_t XRa, Rb, s12;
 
     t0 = tcg_temp_new();
     t1 = tcg_temp_new();
 
     XRa = extract32(ctx->opcode, 6, 4);
-    s12 = extract32(ctx->opcode, 10, 10);
-    sel = extract32(ctx->opcode, 20, 1);
+    s12 = sextract32(ctx->opcode, 10, 10);
     Rb = extract32(ctx->opcode, 21, 5);
 
     gen_load_gpr(t0, Rb);
+    tcg_gen_movi_tl(t1, s12 * 4);
+    tcg_gen_add_tl(t0, t0, t1);
 
-    tcg_gen_movi_tl(t1, s12);
-    tcg_gen_shli_tl(t1, t1, 2);
-    if (s12 & 0x200) {
-        tcg_gen_ori_tl(t1, t1, 0xFFFFF000);
-    }
-    tcg_gen_add_tl(t1, t0, t1);
-    tcg_gen_qemu_ld_tl(t1, t1, ctx->mem_idx, (MO_TESL ^ (sel * MO_BSWAP)) |
-                       ctx->default_tcg_memop_mask);
-
+    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx,
+                       (MO_TESL ^ (reversed ? MO_BSWAP : 0)) |
+                        ctx->default_tcg_memop_mask);
     gen_store_mxu_gpr(t1, XRa);
+
+    if (postinc) {
+        gen_store_gpr(t0, Rb);
+    }
 }
 
+/*
+ * S32STD  XRa, Rb, S12 - Store a word from XRF to memory
+ * S32STDR XRa, Rb, S12 - Store a word from XRF to memory
+ *   in reversed byte seq.
+ * S32SDI  XRa, Rb, S12 - Store a word from XRF to memory,
+ *   post modify base address GPR.
+ * S32SDIR XRa, Rb, S12 - Store a word from XRF to memory,
+ *   post modify base address GPR and store in reversed byte seq.
+ */
+static void gen_mxu_s32stxx(DisasContext *ctx, bool reversed, bool postinc)
+{
+    TCGv t0, t1;
+    uint32_t XRa, Rb, s12;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    s12 = sextract32(ctx->opcode, 10, 10);
+    Rb = extract32(ctx->opcode, 21, 5);
+
+    gen_load_gpr(t0, Rb);
+    tcg_gen_movi_tl(t1, s12 * 4);
+    tcg_gen_add_tl(t0, t0, t1);
+
+    gen_load_mxu_gpr(t1, XRa);
+    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx,
+                       (MO_TESL ^ (reversed ? MO_BSWAP : 0)) |
+                        ctx->default_tcg_memop_mask);
+
+    if (postinc) {
+        gen_store_gpr(t0, Rb);
+    }
+}
+
+/*
+ * S32LDDV  XRa, Rb, Rc, STRD2 - Load a word from memory to XRF
+ * S32LDDVR XRa, Rb, Rc, STRD2 - Load a word from memory to XRF
+ *   in reversed byte seq.
+ * S32LDIV  XRa, Rb, Rc, STRD2 - Load a word from memory to XRF,
+ *   post modify base address GPR.
+ * S32LDIVR XRa, Rb, Rc, STRD2 - Load a word from memory to XRF,
+ *   post modify base address GPR and load in reversed byte seq.
+ */
+static void gen_mxu_s32ldxvx(DisasContext *ctx, bool reversed,
+                             bool postinc, uint32_t strd2)
+{
+    TCGv t0, t1;
+    uint32_t XRa, Rb, Rc;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    Rc = extract32(ctx->opcode, 16, 5);
+    Rb = extract32(ctx->opcode, 21, 5);
+
+    gen_load_gpr(t0, Rb);
+    gen_load_gpr(t1, Rc);
+    tcg_gen_shli_tl(t1, t1, strd2);
+    tcg_gen_add_tl(t0, t0, t1);
+
+    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx,
+                       (MO_TESL ^ (reversed ? MO_BSWAP : 0)) |
+                        ctx->default_tcg_memop_mask);
+    gen_store_mxu_gpr(t1, XRa);
+
+    if (postinc) {
+        gen_store_gpr(t0, Rb);
+    }
+}
+
+/*
+ * S32STDV  XRa, Rb, Rc, STRD2 - Load a word from memory to XRF
+ * S32STDVR XRa, Rb, Rc, STRD2 - Load a word from memory to XRF
+ *   in reversed byte seq.
+ * S32SDIV  XRa, Rb, Rc, STRD2 - Load a word from memory to XRF,
+ *   post modify base address GPR.
+ * S32SDIVR XRa, Rb, Rc, STRD2 - Load a word from memory to XRF,
+ *   post modify base address GPR and store in reversed byte seq.
+ */
+static void gen_mxu_s32stxvx(DisasContext *ctx, bool reversed,
+                             bool postinc, uint32_t strd2)
+{
+    TCGv t0, t1;
+    uint32_t XRa, Rb, Rc;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    Rc = extract32(ctx->opcode, 16, 5);
+    Rb = extract32(ctx->opcode, 21, 5);
+
+    gen_load_gpr(t0, Rb);
+    gen_load_gpr(t1, Rc);
+    tcg_gen_shli_tl(t1, t1, strd2);
+    tcg_gen_add_tl(t0, t0, t1);
+
+    gen_load_mxu_gpr(t1, XRa);
+    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx,
+                       (MO_TESL ^ (reversed ? MO_BSWAP : 0)) |
+                        ctx->default_tcg_memop_mask);
+
+    if (postinc) {
+        gen_store_gpr(t0, Rb);
+    }
+}
 
 /*
  *                 MXU instruction category: logic
@@ -1440,13 +1559,129 @@ static void decode_opc_mxu__pool00(DisasContext *ctx)
 
 static void decode_opc_mxu__pool04(DisasContext *ctx)
 {
-    uint32_t opcode = extract32(ctx->opcode, 20, 1);
+    uint32_t reversed = extract32(ctx->opcode, 20, 1);
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+
+    /* Don't care about opcode bits as their meaning is unknown yet */
+    switch (opcode) {
+    default:
+        gen_mxu_s32ldxx(ctx, reversed, false);
+        break;
+    }
+}
+
+static void decode_opc_mxu__pool05(DisasContext *ctx)
+{
+    uint32_t reversed = extract32(ctx->opcode, 20, 1);
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+
+    /* Don't care about opcode bits as their meaning is unknown yet */
+    switch (opcode) {
+    default:
+        gen_mxu_s32stxx(ctx, reversed, false);
+        break;
+    }
+}
+
+static void decode_opc_mxu__pool06(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+    uint32_t strd2  = extract32(ctx->opcode, 14, 2);
 
     switch (opcode) {
-    case OPC_MXU_S32LDD:
-    case OPC_MXU_S32LDDR:
-        gen_mxu_s32ldd_s32lddr(ctx);
+    case OPC_MXU_S32LDST:
+    case OPC_MXU_S32LDSTR:
+        if (strd2 <= 2) {
+            gen_mxu_s32ldxvx(ctx, opcode, false, strd2);
+            break;
+        }
+        /* fallthrough */
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
         break;
+    }
+}
+
+static void decode_opc_mxu__pool07(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+    uint32_t strd2  = extract32(ctx->opcode, 14, 2);
+
+    switch (opcode) {
+    case OPC_MXU_S32LDST:
+    case OPC_MXU_S32LDSTR:
+        if (strd2 <= 2) {
+            gen_mxu_s32stxvx(ctx, opcode, false, strd2);
+            break;
+        }
+        /* fallthrough */
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
+static void decode_opc_mxu__pool08(DisasContext *ctx)
+{
+    uint32_t reversed = extract32(ctx->opcode, 20, 1);
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+
+    /* Don't care about opcode bits as their meaning is unknown yet */
+    switch (opcode) {
+    default:
+        gen_mxu_s32ldxx(ctx, reversed, true);
+        break;
+    }
+}
+
+static void decode_opc_mxu__pool09(DisasContext *ctx)
+{
+    uint32_t reversed = extract32(ctx->opcode, 20, 1);
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+
+    /* Don't care about opcode bits as their meaning is unknown yet */
+    switch (opcode) {
+    default:
+        gen_mxu_s32stxx(ctx, reversed, true);
+        break;
+    }
+}
+
+static void decode_opc_mxu__pool10(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+    uint32_t strd2  = extract32(ctx->opcode, 14, 2);
+
+    switch (opcode) {
+    case OPC_MXU_S32LDST:
+    case OPC_MXU_S32LDSTR:
+        if (strd2 <= 2) {
+            gen_mxu_s32ldxvx(ctx, opcode, true, strd2);
+            break;
+        }
+        /* fallthrough */
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
+static void decode_opc_mxu__pool11(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 10, 4);
+    uint32_t strd2  = extract32(ctx->opcode, 14, 2);
+
+    switch (opcode) {
+    case OPC_MXU_S32LDST:
+    case OPC_MXU_S32LDSTR:
+        if (strd2 <= 2) {
+            gen_mxu_s32stxvx(ctx, opcode, true, strd2);
+            break;
+        }
+        /* fallthrough */
     default:
         MIPS_INVAL("decode_opc_mxu");
         gen_reserved_instruction(ctx);
@@ -1532,6 +1767,27 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL04:
             decode_opc_mxu__pool04(ctx);
             break;
+        case OPC_MXU__POOL05:
+            decode_opc_mxu__pool05(ctx);
+            break;
+        case OPC_MXU__POOL06:
+            decode_opc_mxu__pool06(ctx);
+            break;
+        case OPC_MXU__POOL07:
+            decode_opc_mxu__pool07(ctx);
+            break;
+        case OPC_MXU__POOL08:
+            decode_opc_mxu__pool08(ctx);
+            break;
+        case OPC_MXU__POOL09:
+            decode_opc_mxu__pool09(ctx);
+            break;
+        case OPC_MXU__POOL10:
+            decode_opc_mxu__pool10(ctx);
+            break;
+        case OPC_MXU__POOL11:
+            decode_opc_mxu__pool11(ctx);
+            break;
         case OPC_MXU_S8LDD:
             gen_mxu_s8ldd(ctx);
             break;

From 1980fa0a58ec8deada197e399a1c3c3b78c39e09 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:51 +0300
Subject: [PATCH 0672/1353] target/mips: Add support of two XBurst CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

XBurstR1 - is the MIPS32R1 CPU which aims to cover all Ingenic SoCs
older than JZ4770 and some newer.
XBurstR2 - is the MIPS32R2 CPU which aims to cover all Ingenic SoCs
starting from to JZ4770.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-3-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu-defs.c.inc | 46 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index 167c96cb27..05d9ec7125 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -117,6 +117,26 @@ const mips_def_t mips_defs[] =
         .insn_flags = CPU_MIPS32R1,
         .mmu_type = MMU_TYPE_R4000,
     },
+    {
+        .name = "XBurstR1",
+        .CP0_PRid = 0x1ed0024f,
+        .CP0_Config0 = MIPS_CONFIG0 | (MMU_TYPE_R4000 << CP0C0_MT),
+        .CP0_Config1 = MIPS_CONFIG1 | (15 << CP0C1_MMU) |
+                       (0 << CP0C1_IS) | (3 << CP0C1_IL) | (1 << CP0C1_IA) |
+                       (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA) |
+                       (0 << CP0C1_CA),
+        .CP0_Config2 = MIPS_CONFIG2,
+        .CP0_Config3 = MIPS_CONFIG3,
+        .CP0_LLAddr_rw_bitmask = 0,
+        .CP0_LLAddr_shift = 4,
+        .SYNCI_Step = 32,
+        .CCRes = 2,
+        .CP0_Status_rw_bitmask = 0x1278FF17,
+        .SEGBITS = 32,
+        .PABITS = 32,
+        .insn_flags = CPU_MIPS32R1 | ASE_MXU,
+        .mmu_type = MMU_TYPE_R4000,
+    },
     {
         .name = "4KEmR1",
         .CP0_PRid = 0x00018500,
@@ -323,6 +343,32 @@ const mips_def_t mips_defs[] =
         .insn_flags = CPU_MIPS32R2 | ASE_MIPS16 | ASE_DSP | ASE_DSP_R2,
         .mmu_type = MMU_TYPE_R4000,
     },
+    {
+        .name = "XBurstR2",
+        .CP0_PRid = 0x2ed1024f,
+        .CP0_Config0 = MIPS_CONFIG0 | (0x1 << CP0C0_AR) |
+                    (MMU_TYPE_R4000 << CP0C0_MT),
+        .CP0_Config1 = MIPS_CONFIG1 | (1 << CP0C1_FP) | (15 << CP0C1_MMU) |
+                       (0 << CP0C1_IS) | (3 << CP0C1_IL) | (1 << CP0C1_IA) |
+                       (0 << CP0C1_DS) | (3 << CP0C1_DL) | (1 << CP0C1_DA) |
+                       (1 << CP0C1_CA),
+        .CP0_Config2 = MIPS_CONFIG2,
+        .CP0_Config3 = MIPS_CONFIG3 | (1 << CP0C3_DSP2P) | (1 << CP0C3_DSPP) |
+                       (1 << CP0C3_VInt),
+        .CP0_LLAddr_rw_bitmask = 0,
+        .CP0_LLAddr_shift = 4,
+        .SYNCI_Step = 32,
+        .CCRes = 2,
+        .CP0_Status_rw_bitmask = 0x3778FF1F,
+        .CP1_fcr0 = (1 << FCR0_F64) | (1 << FCR0_L) | (1 << FCR0_W) |
+                    (1 << FCR0_D) | (1 << FCR0_S) | (0x93 << FCR0_PRID),
+        .CP1_fcr31 = 0,
+        .CP1_fcr31_rw_bitmask = 0xFF83FFFF,
+        .SEGBITS = 32,
+        .PABITS = 32,
+        .insn_flags = CPU_MIPS32R2 | ASE_MXU,
+        .mmu_type = MMU_TYPE_R4000,
+    },
     {
         .name = "M14K",
         .CP0_PRid = 0x00019b00,

From 73c260c1a63cabe81676a28e957df10ea2395443 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:52 +0300
Subject: [PATCH 0673/1353] target/mips/mxu: Add LXW LXB LXH LXBU LXHU
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions used to load from memory to GPR via indexed address
divided by base and index parts in GPR registers.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-4-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 83 ++++++++++++++++++++++++++++++++-
 1 file changed, 82 insertions(+), 1 deletion(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index c69c5795c9..6703e8aca4 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -304,7 +304,7 @@
  *          │                            ├─ 110 ─ OPC_MXU_S32OR
  *          │                            └─ 111 ─ OPC_MXU_S32XOR
  *          │
- *          │                               7..5
+ *          │                               8..6
  *          ├─ 101000 ─ OPC_MXU__POOL17 ─┬─ 000 ─ OPC_MXU_LXB
  *          │                            ├─ 001 ─ OPC_MXU_LXH
  *          ├─ 101001 ─ <not assigned>   ├─ 011 ─ OPC_MXU_LXW
@@ -366,6 +366,7 @@ enum {
     OPC_MXU__POOL11  = 0x17,
     OPC_MXU_S8LDD    = 0x22,
     OPC_MXU__POOL16  = 0x27,
+    OPC_MXU__POOL17  = 0x28,
     OPC_MXU_S32M2I   = 0x2E,
     OPC_MXU_S32I2M   = 0x2F,
     OPC_MXU__POOL19  = 0x38,
@@ -403,6 +404,17 @@ enum {
     OPC_MXU_S32XOR   = 0x07,
 };
 
+/*
+ * MXU pool 17
+ */
+enum {
+    OPC_MXU_LXB      = 0x00,
+    OPC_MXU_LXH      = 0x01,
+    OPC_MXU_LXW      = 0x03,
+    OPC_MXU_LXBU     = 0x04,
+    OPC_MXU_LXHU     = 0x05,
+};
+
 /*
  * MXU pool 19
  */
@@ -918,6 +930,38 @@ static void gen_mxu_s32ldxvx(DisasContext *ctx, bool reversed,
     }
 }
 
+/*
+ * LXW  Ra, Rb, Rc, STRD2 - Load a word from memory to GPR
+ * LXB  Ra, Rb, Rc, STRD2 - Load a byte from memory to GPR,
+ *   sign extending to GPR size.
+ * LXH  Ra, Rb, Rc, STRD2 - Load a byte from memory to GPR,
+ *   sign extending to GPR size.
+ * LXBU Ra, Rb, Rc, STRD2 - Load a halfword from memory to GPR,
+ *   zero extending to GPR size.
+ * LXHU Ra, Rb, Rc, STRD2 - Load a halfword from memory to GPR,
+ *   zero extending to GPR size.
+ */
+static void gen_mxu_lxx(DisasContext *ctx, uint32_t strd2, MemOp mop)
+{
+    TCGv t0, t1;
+    uint32_t Ra, Rb, Rc;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    Ra = extract32(ctx->opcode, 11, 5);
+    Rc = extract32(ctx->opcode, 16, 5);
+    Rb = extract32(ctx->opcode, 21, 5);
+
+    gen_load_gpr(t0, Rb);
+    gen_load_gpr(t1, Rc);
+    tcg_gen_shli_tl(t1, t1, strd2);
+    tcg_gen_add_tl(t0, t0, t1);
+
+    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, mop | ctx->default_tcg_memop_mask);
+    gen_store_gpr(t1, Ra);
+}
+
 /*
  * S32STDV  XRa, Rb, Rc, STRD2 - Load a word from memory to XRF
  * S32STDVR XRa, Rb, Rc, STRD2 - Load a word from memory to XRF
@@ -1716,6 +1760,40 @@ static void decode_opc_mxu__pool16(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool17(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 6, 3);
+    uint32_t strd2  = extract32(ctx->opcode, 9, 2);
+
+    if (strd2 > 2) {
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        return;
+    }
+
+    switch (opcode) {
+    case OPC_MXU_LXW:
+          gen_mxu_lxx(ctx, strd2, MO_TE | MO_UL);
+          break;
+    case OPC_MXU_LXB:
+          gen_mxu_lxx(ctx, strd2, MO_TE | MO_SB);
+          break;
+    case OPC_MXU_LXH:
+          gen_mxu_lxx(ctx, strd2, MO_TE | MO_SW);
+          break;
+    case OPC_MXU_LXBU:
+          gen_mxu_lxx(ctx, strd2, MO_TE | MO_UB);
+          break;
+    case OPC_MXU_LXHU:
+          gen_mxu_lxx(ctx, strd2, MO_TE | MO_UW);
+          break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool19(DisasContext *ctx)
 {
     uint32_t opcode = extract32(ctx->opcode, 22, 2);
@@ -1794,6 +1872,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL16:
             decode_opc_mxu__pool16(ctx);
             break;
+        case OPC_MXU__POOL17:
+            decode_opc_mxu__pool17(ctx);
+            break;
         case OPC_MXU__POOL19:
             decode_opc_mxu__pool19(ctx);
             break;

From 199fc7d2790ce07f054fc2773dce8ae9e9fc3046 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:53 +0300
Subject: [PATCH 0674/1353] target/mips/mxu: Add S32MADD/MADDU/MSUB/MSUBU
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions used to multiply 2x32-bit GPR sources & accumulate
result into 64-bit pair of XRF registers.

These instructions stain HI/LO registers with the final result.

Their opcode is close to the MIPS32R1 MADD[U]/MSUB[U], so it have to
call decode_opc_special2_legacy when failing to find MXU opcode.
Moreover, it solves issue with reinventing MUL and malfunction
MULU/CLZ/CLO instructions.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-5-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 105 +++++++++++++++++++++++++++++++-
 target/mips/tcg/translate.c     |   7 +--
 2 files changed, 105 insertions(+), 7 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 6703e8aca4..00a4d1da18 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -353,7 +353,11 @@
  */
 
 enum {
+    OPC_MXU_S32MADD  = 0x00,
+    OPC_MXU_S32MADDU = 0x01,
     OPC_MXU__POOL00  = 0x03,
+    OPC_MXU_S32MSUB  = 0x04,
+    OPC_MXU_S32MSUBU = 0x05,
     OPC_MXU_D16MUL   = 0x08,
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU__POOL04  = 0x10,
@@ -1571,6 +1575,70 @@ static void gen_mxu_S32ALNI(DisasContext *ctx)
     }
 }
 
+/*
+ *  S32MADD XRa, XRd, rb, rc
+ *    32 to 64 bit signed multiply with subsequent add
+ *    result stored in {XRa, XRd} pair, stain HI/LO.
+ *  S32MADDU XRa, XRd, rb, rc
+ *    32 to 64 bit unsigned multiply with subsequent add
+ *    result stored in {XRa, XRd} pair, stain HI/LO.
+ *  S32MSUB XRa, XRd, rb, rc
+ *    32 to 64 bit signed multiply with subsequent subtract
+ *    result stored in {XRa, XRd} pair, stain HI/LO.
+ *  S32MSUBU XRa, XRd, rb, rc
+ *    32 to 64 bit unsigned multiply with subsequent subtract
+ *    result stored in {XRa, XRd} pair, stain HI/LO.
+ */
+static void gen_mxu_s32madd_sub(DisasContext *ctx, bool sub, bool uns)
+{
+    uint32_t XRa, XRd, Rb, Rc;
+
+    XRa  = extract32(ctx->opcode,  6, 4);
+    XRd  = extract32(ctx->opcode, 10, 4);
+    Rb   = extract32(ctx->opcode, 16, 5);
+    Rc   = extract32(ctx->opcode, 21, 5);
+
+    if (unlikely(Rb == 0 || Rc == 0)) {
+        /* do nothing because x + 0 * y => x */
+    } else if (unlikely(XRa == 0 && XRd == 0)) {
+        /* do nothing because result just dropped */
+    } else {
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv_i64 t2 = tcg_temp_new_i64();
+        TCGv_i64 t3 = tcg_temp_new_i64();
+
+        gen_load_gpr(t0, Rb);
+        gen_load_gpr(t1, Rc);
+
+        if (uns) {
+            tcg_gen_extu_tl_i64(t2, t0);
+            tcg_gen_extu_tl_i64(t3, t1);
+        } else {
+            tcg_gen_ext_tl_i64(t2, t0);
+            tcg_gen_ext_tl_i64(t3, t1);
+        }
+        tcg_gen_mul_i64(t2, t2, t3);
+
+        gen_load_mxu_gpr(t0, XRa);
+        gen_load_mxu_gpr(t1, XRd);
+
+        tcg_gen_concat_tl_i64(t3, t1, t0);
+        if (sub) {
+            tcg_gen_sub_i64(t3, t3, t2);
+        } else {
+            tcg_gen_add_i64(t3, t3, t2);
+        }
+        gen_move_low32(t1, t3);
+        gen_move_high32(t0, t3);
+
+        tcg_gen_mov_tl(cpu_HI[0], t0);
+        tcg_gen_mov_tl(cpu_LO[0], t1);
+
+        gen_store_mxu_gpr(t1, XRd);
+        gen_store_mxu_gpr(t0, XRa);
+    }
+}
 
 /*
  * Decoding engine for MXU
@@ -1601,6 +1669,35 @@ static void decode_opc_mxu__pool00(DisasContext *ctx)
     }
 }
 
+static bool decode_opc_mxu_s32madd_sub(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 0, 6);
+    uint32_t pad  = extract32(ctx->opcode, 14, 2);
+
+    if (pad != 2) {
+        /* MIPS32R1 MADD/MADDU/MSUB/MSUBU are on pad == 0 */
+        return false;
+    }
+
+    switch (opcode) {
+    case OPC_MXU_S32MADD:
+        gen_mxu_s32madd_sub(ctx, false, false);
+        break;
+    case OPC_MXU_S32MADDU:
+        gen_mxu_s32madd_sub(ctx, false, true);
+        break;
+    case OPC_MXU_S32MSUB:
+        gen_mxu_s32madd_sub(ctx, true, false);
+        break;
+    case OPC_MXU_S32MSUBU:
+        gen_mxu_s32madd_sub(ctx, true, true);
+        break;
+    default:
+        return false;
+    }
+    return true;
+}
+
 static void decode_opc_mxu__pool04(DisasContext *ctx)
 {
     uint32_t reversed = extract32(ctx->opcode, 20, 1);
@@ -1833,6 +1930,11 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         tcg_gen_brcondi_tl(TCG_COND_NE, t_mxu_cr, MXU_CR_MXU_EN, l_exit);
 
         switch (opcode) {
+        case OPC_MXU_S32MADD:
+        case OPC_MXU_S32MADDU:
+        case OPC_MXU_S32MSUB:
+        case OPC_MXU_S32MSUBU:
+            return decode_opc_mxu_s32madd_sub(ctx);
         case OPC_MXU__POOL00:
             decode_opc_mxu__pool00(ctx);
             break;
@@ -1879,8 +1981,7 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
             decode_opc_mxu__pool19(ctx);
             break;
         default:
-            MIPS_INVAL("decode_opc_mxu");
-            gen_reserved_instruction(ctx);
+            return false;
         }
 
         gen_set_label(l_exit);
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index 7abbb0b5e2..9bb40f1849 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -14644,12 +14644,9 @@ static bool decode_opc_legacy(CPUMIPSState *env, DisasContext *ctx)
         }
 #endif
         if (TARGET_LONG_BITS == 32 && (ctx->insn_flags & ASE_MXU)) {
-            if (MASK_SPECIAL2(ctx->opcode) == OPC_MUL) {
-                gen_arith(ctx, OPC_MUL, rd, rs, rt);
-            } else {
-                decode_ase_mxu(ctx, ctx->opcode);
+            if (decode_ase_mxu(ctx, ctx->opcode)) {
+                break;
             }
-            break;
         }
         decode_opc_special2_legacy(env, ctx);
         break;

From 4051f035e057b3ceb728573ac75ae45c44ecd16b Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:54 +0300
Subject: [PATCH 0675/1353] target/mips/mxu: Add Q8SLT Q8SLTU instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are used to set bits depending on
comparison result in each byte respectively.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-6-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 65 +++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 00a4d1da18..6d25562710 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -387,6 +387,8 @@ enum {
     OPC_MXU_D16MIN   = 0x03,
     OPC_MXU_Q8MAX    = 0x04,
     OPC_MXU_Q8MIN    = 0x05,
+    OPC_MXU_Q8SLT    = 0x06,
+    OPC_MXU_Q8SLTU   = 0x07,
 };
 
 /*
@@ -1397,6 +1399,63 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
     }
 }
 
+/*
+ *  Q8SLT
+ *    Update XRa with the signed "set less than" comparison of XRb and XRc
+ *    on per-byte basis.
+ *    a.k.a. XRa[0..3] = XRb[0..3] < XRc[0..3] ? 1 : 0;
+ *
+ *  Q8SLTU
+ *    Update XRa with the unsigned "set less than" comparison of XRb and XRc
+ *    on per-byte basis.
+ *    a.k.a. XRa[0..3] = XRb[0..3] < XRc[0..3] ? 1 : 0;
+ */
+static void gen_mxu_q8slt(DisasContext *ctx, bool sltu)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRb == XRc)) {
+        /* both operands same registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t3, XRb);
+        gen_load_mxu_gpr(t4, XRc);
+        tcg_gen_movi_tl(t2, 0);
+
+        for (int i = 0; i < 4; i++) {
+            if (sltu) {
+                tcg_gen_extract_tl(t0, t3, 8 * i, 8);
+                tcg_gen_extract_tl(t1, t4, 8 * i, 8);
+            } else {
+                tcg_gen_sextract_tl(t0, t3, 8 * i, 8);
+                tcg_gen_sextract_tl(t1, t4, 8 * i, 8);
+            }
+            tcg_gen_setcond_tl(TCG_COND_LT, t0, t0, t1);
+            tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+        }
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
+
 
 /*
  *                 MXU instruction category: align
@@ -1662,6 +1721,12 @@ static void decode_opc_mxu__pool00(DisasContext *ctx)
     case OPC_MXU_Q8MIN:
         gen_mxu_Q8MAX_Q8MIN(ctx);
         break;
+    case OPC_MXU_Q8SLT:
+        gen_mxu_q8slt(ctx, false);
+        break;
+    case OPC_MXU_Q8SLTU:
+        gen_mxu_q8slt(ctx, true);
+        break;
     default:
         MIPS_INVAL("decode_opc_mxu");
         gen_reserved_instruction(ctx);

From fc34c76f365a110977234ddcaaba4198dcd4c397 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:55 +0300
Subject: [PATCH 0676/1353] target/mips/mxu: Fix D16MAX D16MIN Q8MAX Q8MIN
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions were designed that they overwrite source
register during partial storing of result.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-7-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 6d25562710..e63b4754be 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -1241,13 +1241,14 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
         /* ...and do half-word-wise max/min with one operand 0 */
         TCGv_i32 t0 = tcg_temp_new();
         TCGv_i32 t1 = tcg_constant_i32(0);
+        TCGv_i32 t2 = tcg_temp_new();
 
         /* the left half-word first */
         tcg_gen_andi_i32(t0, mxu_gpr[XRx - 1], 0xFFFF0000);
         if (opc == OPC_MXU_D16MAX) {
-            tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smax_i32(t2, t0, t1);
         } else {
-            tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smin_i32(t2, t0, t1);
         }
 
         /* the right half-word */
@@ -1263,7 +1264,7 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
         /* return resulting half-words to its original position */
         tcg_gen_shri_i32(t0, t0, 16);
         /* finally update the destination */
-        tcg_gen_or_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], t2, t0);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same -> just set destination to one of them */
         tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
@@ -1271,14 +1272,15 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
         /* the most general case */
         TCGv_i32 t0 = tcg_temp_new();
         TCGv_i32 t1 = tcg_temp_new();
+        TCGv_i32 t2 = tcg_temp_new();
 
         /* the left half-word first */
         tcg_gen_andi_i32(t0, mxu_gpr[XRb - 1], 0xFFFF0000);
         tcg_gen_andi_i32(t1, mxu_gpr[XRc - 1], 0xFFFF0000);
         if (opc == OPC_MXU_D16MAX) {
-            tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smax_i32(t2, t0, t1);
         } else {
-            tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smin_i32(t2, t0, t1);
         }
 
         /* the right half-word */
@@ -1296,7 +1298,7 @@ static void gen_mxu_D16MAX_D16MIN(DisasContext *ctx)
         /* return resulting half-words to its original position */
         tcg_gen_shri_i32(t0, t0, 16);
         /* finally update the destination */
-        tcg_gen_or_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+        tcg_gen_or_i32(mxu_gpr[XRa - 1], t2, t0);
     }
 }
 
@@ -1332,14 +1334,15 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
         /* ...and do byte-wise max/min with one operand 0 */
         TCGv_i32 t0 = tcg_temp_new();
         TCGv_i32 t1 = tcg_constant_i32(0);
+        TCGv_i32 t2 = tcg_temp_new();
         int32_t i;
 
         /* the leftmost byte (byte 3) first */
         tcg_gen_andi_i32(t0, mxu_gpr[XRx - 1], 0xFF000000);
         if (opc == OPC_MXU_Q8MAX) {
-            tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smax_i32(t2, t0, t1);
         } else {
-            tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smin_i32(t2, t0, t1);
         }
 
         /* bytes 2, 1, 0 */
@@ -1357,8 +1360,9 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
             /* return resulting byte to its original position */
             tcg_gen_shri_i32(t0, t0, 8 * (3 - i));
             /* finally update the destination */
-            tcg_gen_or_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            tcg_gen_or_i32(t2, t2, t0);
         }
+        gen_store_mxu_gpr(t2, XRa);
     } else if (unlikely(XRb == XRc)) {
         /* both operands same -> just set destination to one of them */
         tcg_gen_mov_i32(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
@@ -1366,15 +1370,16 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
         /* the most general case */
         TCGv_i32 t0 = tcg_temp_new();
         TCGv_i32 t1 = tcg_temp_new();
+        TCGv_i32 t2 = tcg_temp_new();
         int32_t i;
 
         /* the leftmost bytes (bytes 3) first */
         tcg_gen_andi_i32(t0, mxu_gpr[XRb - 1], 0xFF000000);
         tcg_gen_andi_i32(t1, mxu_gpr[XRc - 1], 0xFF000000);
         if (opc == OPC_MXU_Q8MAX) {
-            tcg_gen_smax_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smax_i32(t2, t0, t1);
         } else {
-            tcg_gen_smin_i32(mxu_gpr[XRa - 1], t0, t1);
+            tcg_gen_smin_i32(t2, t0, t1);
         }
 
         /* bytes 2, 1, 0 */
@@ -1394,8 +1399,9 @@ static void gen_mxu_Q8MAX_Q8MIN(DisasContext *ctx)
             /* return resulting byte to its original position */
             tcg_gen_shri_i32(t0, t0, 8 * (3 - i));
             /* finally update the destination */
-            tcg_gen_or_i32(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            tcg_gen_or_i32(t2, t2, t0);
         }
+        gen_store_mxu_gpr(t2, XRa);
     }
 }
 

From ff7936f0093fab939bf4a8bff316b2cbd7f9f35f Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:56 +0300
Subject: [PATCH 0677/1353] target/mips/mxu: Add S32SLT D16SLT D16AVG[R]
 Q8AVG[R] insns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are part of pool1, see the grand tree above
in the file. Q8ADD is part of pool1 too but belong to another
category of instructions, thus will be made in later patches.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-8-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 244 +++++++++++++++++++++++++++++++-
 1 file changed, 243 insertions(+), 1 deletion(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index e63b4754be..f170195feb 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -358,6 +358,7 @@ enum {
     OPC_MXU__POOL00  = 0x03,
     OPC_MXU_S32MSUB  = 0x04,
     OPC_MXU_S32MSUBU = 0x05,
+    OPC_MXU__POOL01  = 0x06,
     OPC_MXU_D16MUL   = 0x08,
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU__POOL04  = 0x10,
@@ -391,6 +392,18 @@ enum {
     OPC_MXU_Q8SLTU   = 0x07,
 };
 
+/*
+ * MXU pool 01
+ */
+enum {
+    OPC_MXU_S32SLT   = 0x00,
+    OPC_MXU_D16SLT   = 0x01,
+    OPC_MXU_D16AVG   = 0x02,
+    OPC_MXU_D16AVGR  = 0x03,
+    OPC_MXU_Q8AVG    = 0x04,
+    OPC_MXU_Q8AVGR   = 0x05,
+};
+
 /*
  * MXU pool 04 05 06 07 08 09 10 11
  */
@@ -1152,11 +1165,15 @@ static void gen_mxu_S32XOR(DisasContext *ctx)
 
 
 /*
- *                   MXU instruction category max/min
+ *                   MXU instruction category max/min/avg
  *                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *
  *                     S32MAX     D16MAX     Q8MAX
  *                     S32MIN     D16MIN     Q8MIN
+ *                     S32SLT     D16SLT     Q8SLT
+ *                                           Q8SLTU
+ *                                D16AVG     Q8AVG
+ *                                D16AVGR    Q8AVGR
  */
 
 /*
@@ -1462,6 +1479,199 @@ static void gen_mxu_q8slt(DisasContext *ctx, bool sltu)
     }
 }
 
+/*
+ *  S32SLT
+ *    Update XRa with the signed "set less than" comparison of XRb and XRc.
+ *    a.k.a. XRa = XRb < XRc ? 1 : 0;
+ */
+static void gen_mxu_S32SLT(DisasContext *ctx)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRb == XRc)) {
+        /* both operands same registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        tcg_gen_setcond_tl(TCG_COND_LT, mxu_gpr[XRa - 1],
+                           mxu_gpr[XRb - 1], mxu_gpr[XRc - 1]);
+    }
+}
+
+/*
+ *  D16SLT
+ *    Update XRa with the signed "set less than" comparison of XRb and XRc
+ *    on per-word basis.
+ *    a.k.a. XRa[0..1] = XRb[0..1] < XRc[0..1] ? 1 : 0;
+ */
+static void gen_mxu_D16SLT(DisasContext *ctx)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRb == XRc)) {
+        /* both operands same registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t3, XRb);
+        gen_load_mxu_gpr(t4, XRc);
+        tcg_gen_sextract_tl(t0, t3, 16, 16);
+        tcg_gen_sextract_tl(t1, t4, 16, 16);
+        tcg_gen_setcond_tl(TCG_COND_LT, t0, t0, t1);
+        tcg_gen_shli_tl(t2, t0, 16);
+        tcg_gen_sextract_tl(t0, t3,  0, 16);
+        tcg_gen_sextract_tl(t1, t4,  0, 16);
+        tcg_gen_setcond_tl(TCG_COND_LT, t0, t0, t1);
+        tcg_gen_or_tl(mxu_gpr[XRa - 1], t2, t0);
+    }
+}
+
+/*
+ *  D16AVG
+ *    Update XRa with the signed average of XRb and XRc
+ *    on per-word basis, rounding down.
+ *    a.k.a. XRa[0..1] = (XRb[0..1] + XRc[0..1]) >> 1;
+ *
+ *  D16AVGR
+ *    Update XRa with the signed average of XRb and XRc
+ *    on per-word basis, math rounding 4/5.
+ *    a.k.a. XRa[0..1] = (XRb[0..1] + XRc[0..1] + 1) >> 1;
+ */
+static void gen_mxu_d16avg(DisasContext *ctx, bool round45)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRb == XRc)) {
+        /* both operands same registers -> just set destination to same */
+        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t3, XRb);
+        gen_load_mxu_gpr(t4, XRc);
+        tcg_gen_sextract_tl(t0, t3, 16, 16);
+        tcg_gen_sextract_tl(t1, t4, 16, 16);
+        tcg_gen_add_tl(t0, t0, t1);
+        if (round45) {
+            tcg_gen_addi_tl(t0, t0, 1);
+        }
+        tcg_gen_shli_tl(t2, t0, 15);
+        tcg_gen_andi_tl(t2, t2, 0xffff0000);
+        tcg_gen_sextract_tl(t0, t3,  0, 16);
+        tcg_gen_sextract_tl(t1, t4,  0, 16);
+        tcg_gen_add_tl(t0, t0, t1);
+        if (round45) {
+            tcg_gen_addi_tl(t0, t0, 1);
+        }
+        tcg_gen_shri_tl(t0, t0, 1);
+        tcg_gen_deposit_tl(t2, t2, t0, 0, 16);
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
+
+/*
+ *  Q8AVG
+ *    Update XRa with the signed average of XRb and XRc
+ *    on per-byte basis, rounding down.
+ *    a.k.a. XRa[0..3] = (XRb[0..3] + XRc[0..3]) >> 1;
+ *
+ *  Q8AVGR
+ *    Update XRa with the signed average of XRb and XRc
+ *    on per-word basis, math rounding 4/5.
+ *    a.k.a. XRa[0..3] = (XRb[0..3] + XRc[0..3] + 1) >> 1;
+ */
+static void gen_mxu_q8avg(DisasContext *ctx, bool round45)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRb == XRc)) {
+        /* both operands same registers -> just set destination to same */
+        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t3, XRb);
+        gen_load_mxu_gpr(t4, XRc);
+        tcg_gen_movi_tl(t2, 0);
+
+        for (int i = 0; i < 4; i++) {
+            tcg_gen_extract_tl(t0, t3, 8 * i, 8);
+            tcg_gen_extract_tl(t1, t4, 8 * i, 8);
+            tcg_gen_add_tl(t0, t0, t1);
+            if (round45) {
+                tcg_gen_addi_tl(t0, t0, 1);
+            }
+            tcg_gen_shri_tl(t0, t0, 1);
+            tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+        }
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
+
 
 /*
  *                 MXU instruction category: align
@@ -1769,6 +1979,35 @@ static bool decode_opc_mxu_s32madd_sub(DisasContext *ctx)
     return true;
 }
 
+static void decode_opc_mxu__pool01(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 18, 3);
+
+    switch (opcode) {
+    case OPC_MXU_S32SLT:
+        gen_mxu_S32SLT(ctx);
+        break;
+    case OPC_MXU_D16SLT:
+        gen_mxu_D16SLT(ctx);
+        break;
+    case OPC_MXU_D16AVG:
+        gen_mxu_d16avg(ctx, false);
+        break;
+    case OPC_MXU_D16AVGR:
+        gen_mxu_d16avg(ctx, true);
+        break;
+    case OPC_MXU_Q8AVG:
+        gen_mxu_q8avg(ctx, false);
+        break;
+    case OPC_MXU_Q8AVGR:
+        gen_mxu_q8avg(ctx, true);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
 static void decode_opc_mxu__pool04(DisasContext *ctx)
 {
     uint32_t reversed = extract32(ctx->opcode, 20, 1);
@@ -2015,6 +2254,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_D16MAC:
             gen_mxu_d16mac(ctx);
             break;
+        case OPC_MXU__POOL01:
+            decode_opc_mxu__pool01(ctx);
+            break;
         case OPC_MXU__POOL04:
             decode_opc_mxu__pool04(ctx);
             break;

From bf1df65f0ae9a13c8677b3e63d77f0bd6320846c Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:57 +0300
Subject: [PATCH 0678/1353] target/mips/mxu: Add Q8ADD instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This instruction is used to add/subtract quadruple
8-bit values to another quadruple in parallel.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-9-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 77 +++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index f170195feb..034287e54b 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -402,6 +402,7 @@ enum {
     OPC_MXU_D16AVGR  = 0x03,
     OPC_MXU_Q8AVG    = 0x04,
     OPC_MXU_Q8AVGR   = 0x05,
+    OPC_MXU_Q8ADD    = 0x07,
 };
 
 /*
@@ -1673,6 +1674,79 @@ static void gen_mxu_q8avg(DisasContext *ctx, bool round45)
 }
 
 
+/*
+ *                 MXU instruction category: Arithmetic
+ *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *                       Q8ADD
+ */
+
+/*
+ *  Q8ADD XRa, XRb, XRc, ptn2
+ *  Add/subtract quadruple of 8-bit packed in XRb
+ *  to another one in XRc, put the result in XRa.
+ */
+static void gen_mxu_Q8ADD(DisasContext *ctx)
+{
+    uint32_t aptn2, pad, XRc, XRb, XRa;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    pad   = extract32(ctx->opcode, 21, 3);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_i32(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t3, XRb);
+        gen_load_mxu_gpr(t4, XRc);
+
+        for (int i = 0; i < 4; i++) {
+            tcg_gen_andi_tl(t0, t3, 0xff);
+            tcg_gen_andi_tl(t1, t4, 0xff);
+
+            if (i < 2) {
+                if (aptn2 & 0x01) {
+                    tcg_gen_sub_tl(t0, t0, t1);
+                } else {
+                    tcg_gen_add_tl(t0, t0, t1);
+                }
+            } else {
+                if (aptn2 & 0x02) {
+                    tcg_gen_sub_tl(t0, t0, t1);
+                } else {
+                    tcg_gen_add_tl(t0, t0, t1);
+                }
+            }
+            if (i < 3) {
+                tcg_gen_shri_tl(t3, t3, 8);
+                tcg_gen_shri_tl(t4, t4, 8);
+            }
+            if (i > 0) {
+                tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+            } else {
+                tcg_gen_andi_tl(t0, t0, 0xff);
+                tcg_gen_mov_tl(t2, t0);
+            }
+        }
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
+
+
 /*
  *                 MXU instruction category: align
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -2002,6 +2076,9 @@ static void decode_opc_mxu__pool01(DisasContext *ctx)
     case OPC_MXU_Q8AVGR:
         gen_mxu_q8avg(ctx, true);
         break;
+    case OPC_MXU_Q8ADD:
+        gen_mxu_Q8ADD(ctx);
+        break;
     default:
         MIPS_INVAL("decode_opc_mxu");
         gen_reserved_instruction(ctx);

From f1e6547cfc5dbf4a3c397ca61dfcb83ba588b97c Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:58 +0300
Subject: [PATCH 0679/1353] target/mips/mxu: Add S32CPS D16CPS Q8ABD Q16SAT
 insns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are part of pool2, see the grand tree above
in the file.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-10-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 296 +++++++++++++++++++++++++++++++-
 1 file changed, 293 insertions(+), 3 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 034287e54b..3bd5fcb98a 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -359,6 +359,7 @@ enum {
     OPC_MXU_S32MSUB  = 0x04,
     OPC_MXU_S32MSUBU = 0x05,
     OPC_MXU__POOL01  = 0x06,
+    OPC_MXU__POOL02  = 0x07,
     OPC_MXU_D16MUL   = 0x08,
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU__POOL04  = 0x10,
@@ -405,6 +406,16 @@ enum {
     OPC_MXU_Q8ADD    = 0x07,
 };
 
+/*
+ * MXU pool 02
+ */
+enum {
+    OPC_MXU_S32CPS   = 0x00,
+    OPC_MXU_D16CPS   = 0x02,
+    OPC_MXU_Q8ABD    = 0x04,
+    OPC_MXU_Q16SAT   = 0x06,
+};
+
 /*
  * MXU pool 04 05 06 07 08 09 10 11
  */
@@ -1675,12 +1686,155 @@ static void gen_mxu_q8avg(DisasContext *ctx, bool round45)
 
 
 /*
- *                 MXU instruction category: Arithmetic
- *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *      MXU instruction category: Addition and subtraction
+ *      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *
- *                       Q8ADD
+ *              S32CPS      D16CPS
+ *                                       Q8ADD
  */
 
+/*
+ *  S32CPS
+ *    Update XRa if XRc < 0 by value of 0 - XRb
+ *    else XRa = XRb
+ */
+static void gen_mxu_S32CPS(DisasContext *ctx)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely(XRb == 0)) {
+        /* XRc make no sense 0 - 0 = 0 -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRc == 0)) {
+        /* condition always false -> just move XRb to XRa */
+        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGLabel *l_not_less = gen_new_label();
+        TCGLabel *l_done = gen_new_label();
+
+        tcg_gen_brcondi_tl(TCG_COND_GE, mxu_gpr[XRc - 1], 0, l_not_less);
+        tcg_gen_neg_tl(t0, mxu_gpr[XRb - 1]);
+        tcg_gen_br(l_done);
+        gen_set_label(l_not_less);
+        gen_load_mxu_gpr(t0, XRb);
+        gen_set_label(l_done);
+        gen_store_mxu_gpr(t0, XRa);
+    }
+}
+
+/*
+ *  D16CPS
+ *    Update XRa[0..1] if XRc[0..1] < 0 by value of 0 - XRb[0..1]
+ *    else XRa[0..1] = XRb[0..1]
+ */
+static void gen_mxu_D16CPS(DisasContext *ctx)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely(XRb == 0)) {
+        /* XRc make no sense 0 - 0 = 0 -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else if (unlikely(XRc == 0)) {
+        /* condition always false -> just move XRb to XRa */
+        tcg_gen_mov_tl(mxu_gpr[XRa - 1], mxu_gpr[XRb - 1]);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGLabel *l_done_hi = gen_new_label();
+        TCGLabel *l_not_less_lo = gen_new_label();
+        TCGLabel *l_done_lo = gen_new_label();
+
+        tcg_gen_sextract_tl(t0, mxu_gpr[XRc - 1], 16, 16);
+        tcg_gen_sextract_tl(t1, mxu_gpr[XRb - 1], 16, 16);
+        tcg_gen_brcondi_tl(TCG_COND_GE, t0, 0, l_done_hi);
+        tcg_gen_subfi_tl(t1, 0, t1);
+
+        gen_set_label(l_done_hi);
+        tcg_gen_shli_i32(t1, t1, 16);
+
+        tcg_gen_sextract_tl(t0, mxu_gpr[XRc - 1],  0, 16);
+        tcg_gen_brcondi_tl(TCG_COND_GE, t0, 0, l_not_less_lo);
+        tcg_gen_sextract_tl(t0, mxu_gpr[XRb - 1],  0, 16);
+        tcg_gen_subfi_tl(t0, 0, t0);
+        tcg_gen_br(l_done_lo);
+
+        gen_set_label(l_not_less_lo);
+        tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1],  0, 16);
+
+        gen_set_label(l_done_lo);
+        tcg_gen_deposit_tl(mxu_gpr[XRa - 1], t1, t0, 0, 16);
+    }
+}
+
+/*
+ *  Q8ABD XRa, XRb, XRc
+ *  Gets absolute difference for quadruple of 8-bit
+ *  packed in XRb to another one in XRc,
+ *  put the result in XRa.
+ *  a.k.a. XRa[0..3] = abs(XRb[0..3] - XRc[0..3]);
+ */
+static void gen_mxu_Q8ABD(DisasContext *ctx)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 3);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t3, XRb);
+        gen_load_mxu_gpr(t4, XRc);
+        tcg_gen_movi_tl(t2, 0);
+
+        for (int i = 0; i < 4; i++) {
+            tcg_gen_extract_tl(t0, t3, 8 * i, 8);
+            tcg_gen_extract_tl(t1, t4, 8 * i, 8);
+
+            tcg_gen_sub_tl(t0, t0, t1);
+            tcg_gen_abs_tl(t0, t0);
+
+            tcg_gen_deposit_tl(t2, t2, t0, 8 * i, 8);
+        }
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
+
 /*
  *  Q8ADD XRa, XRb, XRc, ptn2
  *  Add/subtract quadruple of 8-bit packed in XRb
@@ -1746,6 +1900,114 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
     }
 }
 
+/*
+ *                 MXU instruction category: Miscellaneous
+ *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *                       Q16SAT
+ */
+
+/*
+ *  Q16SAT XRa, XRb, XRc
+ *  Packs four 16-bit signed integers in XRb and XRc to
+ *  four saturated unsigned 8-bit into XRa.
+ *
+ */
+static void gen_mxu_Q16SAT(DisasContext *ctx)
+{
+    uint32_t pad, XRc, XRb, XRa;
+
+    pad = extract32(ctx->opcode, 21, 3);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+
+        tcg_gen_movi_tl(t2, 0);
+        if (XRb != 0) {
+            TCGLabel *l_less_hi = gen_new_label();
+            TCGLabel *l_less_lo = gen_new_label();
+            TCGLabel *l_lo = gen_new_label();
+            TCGLabel *l_greater_hi = gen_new_label();
+            TCGLabel *l_greater_lo = gen_new_label();
+            TCGLabel *l_done = gen_new_label();
+
+            tcg_gen_sari_tl(t0, mxu_gpr[XRb - 1], 16);
+            tcg_gen_brcondi_tl(TCG_COND_LT, t0, 0, l_less_hi);
+            tcg_gen_brcondi_tl(TCG_COND_GT, t0, 255, l_greater_hi);
+            tcg_gen_br(l_lo);
+            gen_set_label(l_less_hi);
+            tcg_gen_movi_tl(t0, 0);
+            tcg_gen_br(l_lo);
+            gen_set_label(l_greater_hi);
+            tcg_gen_movi_tl(t0, 255);
+
+            gen_set_label(l_lo);
+            tcg_gen_shli_tl(t1, mxu_gpr[XRb - 1], 16);
+            tcg_gen_sari_tl(t1, t1, 16);
+            tcg_gen_brcondi_tl(TCG_COND_LT, t1, 0, l_less_lo);
+            tcg_gen_brcondi_tl(TCG_COND_GT, t1, 255, l_greater_lo);
+            tcg_gen_br(l_done);
+            gen_set_label(l_less_lo);
+            tcg_gen_movi_tl(t1, 0);
+            tcg_gen_br(l_done);
+            gen_set_label(l_greater_lo);
+            tcg_gen_movi_tl(t1, 255);
+
+            gen_set_label(l_done);
+            tcg_gen_shli_tl(t2, t0, 24);
+            tcg_gen_shli_tl(t1, t1, 16);
+            tcg_gen_or_tl(t2, t2, t1);
+        }
+
+        if (XRc != 0) {
+            TCGLabel *l_less_hi = gen_new_label();
+            TCGLabel *l_less_lo = gen_new_label();
+            TCGLabel *l_lo = gen_new_label();
+            TCGLabel *l_greater_hi = gen_new_label();
+            TCGLabel *l_greater_lo = gen_new_label();
+            TCGLabel *l_done = gen_new_label();
+
+            tcg_gen_sari_tl(t0, mxu_gpr[XRc - 1], 16);
+            tcg_gen_brcondi_tl(TCG_COND_LT, t0, 0, l_less_hi);
+            tcg_gen_brcondi_tl(TCG_COND_GT, t0, 255, l_greater_hi);
+            tcg_gen_br(l_lo);
+            gen_set_label(l_less_hi);
+            tcg_gen_movi_tl(t0, 0);
+            tcg_gen_br(l_lo);
+            gen_set_label(l_greater_hi);
+            tcg_gen_movi_tl(t0, 255);
+
+            gen_set_label(l_lo);
+            tcg_gen_shli_tl(t1, mxu_gpr[XRc - 1], 16);
+            tcg_gen_sari_tl(t1, t1, 16);
+            tcg_gen_brcondi_tl(TCG_COND_LT, t1, 0, l_less_lo);
+            tcg_gen_brcondi_tl(TCG_COND_GT, t1, 255, l_greater_lo);
+            tcg_gen_br(l_done);
+            gen_set_label(l_less_lo);
+            tcg_gen_movi_tl(t1, 0);
+            tcg_gen_br(l_done);
+            gen_set_label(l_greater_lo);
+            tcg_gen_movi_tl(t1, 255);
+
+            gen_set_label(l_done);
+            tcg_gen_shli_tl(t0, t0, 8);
+            tcg_gen_or_tl(t2, t2, t0);
+            tcg_gen_or_tl(t2, t2, t1);
+        }
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
+
 
 /*
  *                 MXU instruction category: align
@@ -2085,6 +2347,31 @@ static void decode_opc_mxu__pool01(DisasContext *ctx)
         break;
     }
 }
+
+static void decode_opc_mxu__pool02(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 18, 3);
+
+    switch (opcode) {
+    case OPC_MXU_S32CPS:
+        gen_mxu_S32CPS(ctx);
+        break;
+    case OPC_MXU_D16CPS:
+        gen_mxu_D16CPS(ctx);
+        break;
+    case OPC_MXU_Q8ABD:
+        gen_mxu_Q8ABD(ctx);
+        break;
+    case OPC_MXU_Q16SAT:
+        gen_mxu_Q16SAT(ctx);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool04(DisasContext *ctx)
 {
     uint32_t reversed = extract32(ctx->opcode, 20, 1);
@@ -2334,6 +2621,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL01:
             decode_opc_mxu__pool01(ctx);
             break;
+        case OPC_MXU__POOL02:
+            decode_opc_mxu__pool02(ctx);
+            break;
         case OPC_MXU__POOL04:
             decode_opc_mxu__pool04(ctx);
             break;

From 27dc0e289cf3e8f175a6e68921925302e1816fef Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:41:59 +0300
Subject: [PATCH 0680/1353] target/mips/mxu: Add D16MULF D16MULE instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are part of pool3, see the grand tree above
in the file.
The instructions are close to D16MUL so common generation function
provided.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-11-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 95 +++++++++++++++++++++++++++++++--
 1 file changed, 90 insertions(+), 5 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 3bd5fcb98a..b683f3d95c 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -361,6 +361,7 @@ enum {
     OPC_MXU__POOL01  = 0x06,
     OPC_MXU__POOL02  = 0x07,
     OPC_MXU_D16MUL   = 0x08,
+    OPC_MXU__POOL03  = 0x09,
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU__POOL04  = 0x10,
     OPC_MXU__POOL05  = 0x11,
@@ -416,6 +417,14 @@ enum {
     OPC_MXU_Q16SAT   = 0x06,
 };
 
+/*
+ * MXU pool 03
+ */
+enum {
+    OPC_MXU_D16MULF  = 0x00,
+    OPC_MXU_D16MULE  = 0x01,
+};
+
 /*
  * MXU pool 04 05 06 07 08 09 10 11
  */
@@ -660,9 +669,14 @@ static void gen_mxu_s8ldd(DisasContext *ctx)
 }
 
 /*
- * D16MUL XRa, XRb, XRc, XRd, optn2 - Signed 16 bit pattern multiplication
+ * D16MUL  XRa, XRb, XRc, XRd, optn2 - Signed 16 bit pattern multiplication
+ * D16MULF XRa, XRb, XRc, optn2 - Signed Q15 fraction pattern multiplication
+ *   with rounding and packing result
+ * D16MULE XRa, XRb, XRc, XRd, optn2 - Signed Q15 fraction pattern
+ *   multiplication with rounding
  */
-static void gen_mxu_d16mul(DisasContext *ctx)
+static void gen_mxu_d16mul(DisasContext *ctx, bool fractional,
+                           bool packed_result)
 {
     TCGv t0, t1, t2, t3;
     uint32_t XRa, XRb, XRc, XRd, optn2;
@@ -678,6 +692,12 @@ static void gen_mxu_d16mul(DisasContext *ctx)
     XRd = extract32(ctx->opcode, 18, 4);
     optn2 = extract32(ctx->opcode, 22, 2);
 
+    /*
+     * TODO: XRd field isn't used for D16MULF
+     * There's no knowledge how this field affect
+     * instruction decoding/behavior
+     */
+
     gen_load_mxu_gpr(t1, XRb);
     tcg_gen_sextract_tl(t0, t1, 0, 16);
     tcg_gen_sextract_tl(t1, t1, 16, 16);
@@ -703,8 +723,52 @@ static void gen_mxu_d16mul(DisasContext *ctx)
         tcg_gen_mul_tl(t2, t1, t2);
         break;
     }
-    gen_store_mxu_gpr(t3, XRa);
-    gen_store_mxu_gpr(t2, XRd);
+    if (fractional) {
+        TCGLabel *l_done = gen_new_label();
+        TCGv rounding = tcg_temp_new();
+
+        tcg_gen_shli_tl(t3, t3, 1);
+        tcg_gen_shli_tl(t2, t2, 1);
+        tcg_gen_andi_tl(rounding, mxu_CR, 0x2);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, rounding, 0, l_done);
+        if (packed_result) {
+            TCGLabel *l_apply_bias_l = gen_new_label();
+            TCGLabel *l_apply_bias_r = gen_new_label();
+            TCGLabel *l_half_done = gen_new_label();
+            TCGv bias = tcg_temp_new();
+
+            /*
+             * D16MULF supports unbiased rounding aka "bankers rounding",
+             * "round to even", "convergent rounding"
+             */
+            tcg_gen_andi_tl(bias, mxu_CR, 0x4);
+            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_l);
+            tcg_gen_andi_tl(t0, t3, 0x1ffff);
+            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_half_done);
+            gen_set_label(l_apply_bias_l);
+            tcg_gen_addi_tl(t3, t3, 0x8000);
+            gen_set_label(l_half_done);
+            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_r);
+            tcg_gen_andi_tl(t0, t2, 0x1ffff);
+            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_done);
+            gen_set_label(l_apply_bias_r);
+            tcg_gen_addi_tl(t2, t2, 0x8000);
+        } else {
+            /* D16MULE doesn't support unbiased rounding */
+            tcg_gen_addi_tl(t3, t3, 0x8000);
+            tcg_gen_addi_tl(t2, t2, 0x8000);
+        }
+        gen_set_label(l_done);
+    }
+    if (!packed_result) {
+        gen_store_mxu_gpr(t3, XRa);
+        gen_store_mxu_gpr(t2, XRd);
+    } else {
+        tcg_gen_andi_tl(t3, t3, 0xffff0000);
+        tcg_gen_shri_tl(t2, t2, 16);
+        tcg_gen_or_tl(t3, t3, t2);
+        gen_store_mxu_gpr(t3, XRa);
+    }
 }
 
 /*
@@ -2372,6 +2436,24 @@ static void decode_opc_mxu__pool02(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool03(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 24, 2);
+
+    switch (opcode) {
+    case OPC_MXU_D16MULF:
+        gen_mxu_d16mul(ctx, true, true);
+        break;
+    case OPC_MXU_D16MULE:
+        gen_mxu_d16mul(ctx, true, false);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool04(DisasContext *ctx)
 {
     uint32_t reversed = extract32(ctx->opcode, 20, 1);
@@ -2613,7 +2695,7 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
             decode_opc_mxu__pool00(ctx);
             break;
         case OPC_MXU_D16MUL:
-            gen_mxu_d16mul(ctx);
+            gen_mxu_d16mul(ctx, false, false);
             break;
         case OPC_MXU_D16MAC:
             gen_mxu_d16mac(ctx);
@@ -2624,6 +2706,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL02:
             decode_opc_mxu__pool02(ctx);
             break;
+        case OPC_MXU__POOL03:
+            decode_opc_mxu__pool03(ctx);
+            break;
         case OPC_MXU__POOL04:
             decode_opc_mxu__pool04(ctx);
             break;

From 2ebc66e4156b5c176994c738a2a1ae70be5c611c Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:00 +0300
Subject: [PATCH 0681/1353] target/mips/mxu: Add D16MACF D16MACE instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are close to D16MAC so common generation function
provided.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-12-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 74 ++++++++++++++++++++++++++++++---
 1 file changed, 68 insertions(+), 6 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index b683f3d95c..b58fad4436 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -363,6 +363,8 @@ enum {
     OPC_MXU_D16MUL   = 0x08,
     OPC_MXU__POOL03  = 0x09,
     OPC_MXU_D16MAC   = 0x0A,
+    OPC_MXU_D16MACF  = 0x0B,
+    OPC_MXU_D16MACE  = 0x0F,
     OPC_MXU__POOL04  = 0x10,
     OPC_MXU__POOL05  = 0x11,
     OPC_MXU__POOL06  = 0x12,
@@ -772,10 +774,15 @@ static void gen_mxu_d16mul(DisasContext *ctx, bool fractional,
 }
 
 /*
- * D16MAC XRa, XRb, XRc, XRd, aptn2, optn2 - Signed 16 bit pattern multiply
- *                                           and accumulate
+ * D16MAC XRa, XRb, XRc, XRd, aptn2, optn2
+ *   Signed 16 bit pattern multiply and accumulate
+ * D16MACF XRa, XRb, XRc, aptn2, optn2
+ *   Signed Q15 fraction pattern multiply accumulate and pack
+ * D16MACE XRa, XRb, XRc, XRd, aptn2, optn2
+ *   Signed Q15 fraction pattern multiply and accumulate
  */
-static void gen_mxu_d16mac(DisasContext *ctx)
+static void gen_mxu_d16mac(DisasContext *ctx, bool fractional,
+                           bool packed_result)
 {
     TCGv t0, t1, t2, t3;
     uint32_t XRa, XRb, XRc, XRd, optn2, aptn2;
@@ -818,6 +825,11 @@ static void gen_mxu_d16mac(DisasContext *ctx)
         tcg_gen_mul_tl(t2, t1, t2);
         break;
     }
+
+    if (fractional) {
+        tcg_gen_shli_tl(t3, t3, 1);
+        tcg_gen_shli_tl(t2, t2, 1);
+    }
     gen_load_mxu_gpr(t0, XRa);
     gen_load_mxu_gpr(t1, XRd);
 
@@ -839,8 +851,52 @@ static void gen_mxu_d16mac(DisasContext *ctx)
         tcg_gen_sub_tl(t2, t1, t2);
         break;
     }
-    gen_store_mxu_gpr(t3, XRa);
-    gen_store_mxu_gpr(t2, XRd);
+
+    if (fractional) {
+        TCGLabel *l_done = gen_new_label();
+        TCGv rounding = tcg_temp_new();
+
+        tcg_gen_andi_tl(rounding, mxu_CR, 0x2);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, rounding, 0, l_done);
+        if (packed_result) {
+            TCGLabel *l_apply_bias_l = gen_new_label();
+            TCGLabel *l_apply_bias_r = gen_new_label();
+            TCGLabel *l_half_done = gen_new_label();
+            TCGv bias = tcg_temp_new();
+
+            /*
+             * D16MACF supports unbiased rounding aka "bankers rounding",
+             * "round to even", "convergent rounding"
+             */
+            tcg_gen_andi_tl(bias, mxu_CR, 0x4);
+            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_l);
+            tcg_gen_andi_tl(t0, t3, 0x1ffff);
+            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_half_done);
+            gen_set_label(l_apply_bias_l);
+            tcg_gen_addi_tl(t3, t3, 0x8000);
+            gen_set_label(l_half_done);
+            tcg_gen_brcondi_tl(TCG_COND_NE, bias, 0, l_apply_bias_r);
+            tcg_gen_andi_tl(t0, t2, 0x1ffff);
+            tcg_gen_brcondi_tl(TCG_COND_EQ, t0, 0x8000, l_done);
+            gen_set_label(l_apply_bias_r);
+            tcg_gen_addi_tl(t2, t2, 0x8000);
+        } else {
+            /* D16MACE doesn't support unbiased rounding */
+            tcg_gen_addi_tl(t3, t3, 0x8000);
+            tcg_gen_addi_tl(t2, t2, 0x8000);
+        }
+        gen_set_label(l_done);
+    }
+
+    if (!packed_result) {
+        gen_store_mxu_gpr(t3, XRa);
+        gen_store_mxu_gpr(t2, XRd);
+    } else {
+        tcg_gen_andi_tl(t3, t3, 0xffff0000);
+        tcg_gen_shri_tl(t2, t2, 16);
+        tcg_gen_or_tl(t3, t3, t2);
+        gen_store_mxu_gpr(t3, XRa);
+    }
 }
 
 /*
@@ -2698,7 +2754,13 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
             gen_mxu_d16mul(ctx, false, false);
             break;
         case OPC_MXU_D16MAC:
-            gen_mxu_d16mac(ctx);
+            gen_mxu_d16mac(ctx, false, false);
+            break;
+        case OPC_MXU_D16MACF:
+            gen_mxu_d16mac(ctx, true, true);
+            break;
+        case OPC_MXU_D16MACE:
+            gen_mxu_d16mac(ctx, true, false);
             break;
         case OPC_MXU__POOL01:
             decode_opc_mxu__pool01(ctx);

From 15830fa2a196d18493415d1c9a6476949d3b9aa6 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:01 +0300
Subject: [PATCH 0682/1353] target/mips/mxu: Add D16MADL instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction is similar to multiply and accumulate
but works with MXU registers set.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-13-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 82 +++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index b58fad4436..202e1c6d35 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -364,6 +364,7 @@ enum {
     OPC_MXU__POOL03  = 0x09,
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU_D16MACF  = 0x0B,
+    OPC_MXU_D16MADL  = 0x0C,
     OPC_MXU_D16MACE  = 0x0F,
     OPC_MXU__POOL04  = 0x10,
     OPC_MXU__POOL05  = 0x11,
@@ -899,6 +900,84 @@ static void gen_mxu_d16mac(DisasContext *ctx, bool fractional,
     }
 }
 
+/*
+ * D16MADL XRa, XRb, XRc, XRd, aptn2, optn2 - Double packed
+ * unsigned 16 bit pattern multiply and add/subtract.
+ */
+static void gen_mxu_d16madl(DisasContext *ctx)
+{
+    TCGv t0, t1, t2, t3;
+    uint32_t XRa, XRb, XRc, XRd, optn2, aptn2;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+    t2 = tcg_temp_new();
+    t3 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRd = extract32(ctx->opcode, 18, 4);
+    optn2 = extract32(ctx->opcode, 22, 2);
+    aptn2 = extract32(ctx->opcode, 24, 2);
+
+    gen_load_mxu_gpr(t1, XRb);
+    tcg_gen_sextract_tl(t0, t1,  0, 16);
+    tcg_gen_sextract_tl(t1, t1, 16, 16);
+
+    gen_load_mxu_gpr(t3, XRc);
+    tcg_gen_sextract_tl(t2, t3,  0, 16);
+    tcg_gen_sextract_tl(t3, t3, 16, 16);
+
+    switch (optn2) {
+    case MXU_OPTN2_WW: /* XRB.H*XRC.H == lop, XRB.L*XRC.L == rop */
+        tcg_gen_mul_tl(t3, t1, t3);
+        tcg_gen_mul_tl(t2, t0, t2);
+        break;
+    case MXU_OPTN2_LW: /* XRB.L*XRC.H == lop, XRB.L*XRC.L == rop */
+        tcg_gen_mul_tl(t3, t0, t3);
+        tcg_gen_mul_tl(t2, t0, t2);
+        break;
+    case MXU_OPTN2_HW: /* XRB.H*XRC.H == lop, XRB.H*XRC.L == rop */
+        tcg_gen_mul_tl(t3, t1, t3);
+        tcg_gen_mul_tl(t2, t1, t2);
+        break;
+    case MXU_OPTN2_XW: /* XRB.L*XRC.H == lop, XRB.H*XRC.L == rop */
+        tcg_gen_mul_tl(t3, t0, t3);
+        tcg_gen_mul_tl(t2, t1, t2);
+        break;
+    }
+    tcg_gen_extract_tl(t2, t2, 0, 16);
+    tcg_gen_extract_tl(t3, t3, 0, 16);
+
+    gen_load_mxu_gpr(t1, XRa);
+    tcg_gen_extract_tl(t0, t1,  0, 16);
+    tcg_gen_extract_tl(t1, t1, 16, 16);
+
+    switch (aptn2) {
+    case MXU_APTN2_AA:
+        tcg_gen_add_tl(t3, t1, t3);
+        tcg_gen_add_tl(t2, t0, t2);
+        break;
+    case MXU_APTN2_AS:
+        tcg_gen_add_tl(t3, t1, t3);
+        tcg_gen_sub_tl(t2, t0, t2);
+        break;
+    case MXU_APTN2_SA:
+        tcg_gen_sub_tl(t3, t1, t3);
+        tcg_gen_add_tl(t2, t0, t2);
+        break;
+    case MXU_APTN2_SS:
+        tcg_gen_sub_tl(t3, t1, t3);
+        tcg_gen_sub_tl(t2, t0, t2);
+        break;
+    }
+
+    tcg_gen_andi_tl(t2, t2, 0xffff);
+    tcg_gen_shli_tl(t3, t3, 16);
+    tcg_gen_or_tl(mxu_gpr[XRd - 1], t3, t2);
+}
+
 /*
  * Q8MUL   XRa, XRb, XRc, XRd - Parallel unsigned 8 bit pattern multiply
  * Q8MULSU XRa, XRb, XRc, XRd - Parallel signed 8 bit pattern multiply
@@ -2759,6 +2838,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_D16MACF:
             gen_mxu_d16mac(ctx, true, true);
             break;
+        case OPC_MXU_D16MADL:
+            gen_mxu_d16madl(ctx);
+            break;
         case OPC_MXU_D16MACE:
             gen_mxu_d16mac(ctx, true, false);
             break;

From e722e680f737c8813bbb7cb7642830158cbebbdc Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:02 +0300
Subject: [PATCH 0683/1353] target/mips/mxu: Add S16MAD instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction is similar to multiply and accumulate
but works with MXU registers set.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-14-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 65 +++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 202e1c6d35..88d5d659c6 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -365,6 +365,7 @@ enum {
     OPC_MXU_D16MAC   = 0x0A,
     OPC_MXU_D16MACF  = 0x0B,
     OPC_MXU_D16MADL  = 0x0C,
+    OPC_MXU_S16MAD   = 0x0D,
     OPC_MXU_D16MACE  = 0x0F,
     OPC_MXU__POOL04  = 0x10,
     OPC_MXU__POOL05  = 0x11,
@@ -978,6 +979,67 @@ static void gen_mxu_d16madl(DisasContext *ctx)
     tcg_gen_or_tl(mxu_gpr[XRd - 1], t3, t2);
 }
 
+/*
+ * S16MAD XRa, XRb, XRc, XRd, aptn2, optn2 - Single packed
+ * signed 16 bit pattern multiply and 32-bit add/subtract.
+ */
+static void gen_mxu_s16mad(DisasContext *ctx)
+{
+    TCGv t0, t1;
+    uint32_t XRa, XRb, XRc, XRd, optn2, aptn1, pad;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRd = extract32(ctx->opcode, 18, 4);
+    optn2 = extract32(ctx->opcode, 22, 2);
+    aptn1 = extract32(ctx->opcode, 24, 1);
+    pad = extract32(ctx->opcode, 25, 1);
+
+    if (pad) {
+        /* FIXME check if it influence the result */
+    }
+
+    gen_load_mxu_gpr(t0, XRb);
+    gen_load_mxu_gpr(t1, XRc);
+
+    switch (optn2) {
+    case MXU_OPTN2_WW: /* XRB.H*XRC.H */
+        tcg_gen_sextract_tl(t0, t0, 16, 16);
+        tcg_gen_sextract_tl(t1, t1, 16, 16);
+        break;
+    case MXU_OPTN2_LW: /* XRB.L*XRC.L */
+        tcg_gen_sextract_tl(t0, t0,  0, 16);
+        tcg_gen_sextract_tl(t1, t1,  0, 16);
+        break;
+    case MXU_OPTN2_HW: /* XRB.H*XRC.L */
+        tcg_gen_sextract_tl(t0, t0, 16, 16);
+        tcg_gen_sextract_tl(t1, t1,  0, 16);
+        break;
+    case MXU_OPTN2_XW: /* XRB.L*XRC.H */
+        tcg_gen_sextract_tl(t0, t0,  0, 16);
+        tcg_gen_sextract_tl(t1, t1, 16, 16);
+        break;
+    }
+    tcg_gen_mul_tl(t0, t0, t1);
+
+    gen_load_mxu_gpr(t1, XRa);
+
+    switch (aptn1) {
+    case MXU_APTN1_A:
+        tcg_gen_add_tl(t1, t1, t0);
+        break;
+    case MXU_APTN1_S:
+        tcg_gen_sub_tl(t1, t1, t0);
+        break;
+    }
+
+    gen_store_mxu_gpr(t1, XRd);
+}
+
 /*
  * Q8MUL   XRa, XRb, XRc, XRd - Parallel unsigned 8 bit pattern multiply
  * Q8MULSU XRa, XRb, XRc, XRd - Parallel signed 8 bit pattern multiply
@@ -2841,6 +2903,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_D16MADL:
             gen_mxu_d16madl(ctx);
             break;
+        case OPC_MXU_S16MAD:
+            gen_mxu_s16mad(ctx);
+            break;
         case OPC_MXU_D16MACE:
             gen_mxu_d16mac(ctx, true, false);
             break;

From a9bfd80bd48f43ce333e8668f1b26b5cfd2d1ac2 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:03 +0300
Subject: [PATCH 0684/1353] target/mips/mxu: Add Q16ADD instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction adds/subtracts four 16-bit packed in XRb and XRc.
Placing packed 16-bit results in XRa and XRd.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-15-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 89 +++++++++++++++++++++++++++++++++
 1 file changed, 89 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 88d5d659c6..dc4fdf1dd9 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -366,6 +366,7 @@ enum {
     OPC_MXU_D16MACF  = 0x0B,
     OPC_MXU_D16MADL  = 0x0C,
     OPC_MXU_S16MAD   = 0x0D,
+    OPC_MXU_Q16ADD   = 0x0E,
     OPC_MXU_D16MACE  = 0x0F,
     OPC_MXU__POOL04  = 0x10,
     OPC_MXU__POOL05  = 0x11,
@@ -2161,6 +2162,91 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
     }
 }
 
+/*
+ * Q16ADD XRa, XRb, XRc, XRd, aptn2, optn2 - Quad packed
+ * 16-bit pattern addition.
+ */
+static void gen_mxu_q16add(DisasContext *ctx)
+{
+    uint32_t aptn2, optn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    optn2 = extract32(ctx->opcode, 22, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGv t4 = tcg_temp_new();
+    TCGv t5 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t1, XRb);
+    tcg_gen_extract_tl(t0, t1,  0, 16);
+    tcg_gen_extract_tl(t1, t1, 16, 16);
+
+    gen_load_mxu_gpr(t3, XRc);
+    tcg_gen_extract_tl(t2, t3,  0, 16);
+    tcg_gen_extract_tl(t3, t3, 16, 16);
+
+    switch (optn2) {
+    case MXU_OPTN2_WW: /* XRB.H+XRC.H == lop, XRB.L+XRC.L == rop */
+        tcg_gen_mov_tl(t4, t1);
+        tcg_gen_mov_tl(t5, t0);
+        break;
+    case MXU_OPTN2_LW: /* XRB.L+XRC.H == lop, XRB.L+XRC.L == rop */
+        tcg_gen_mov_tl(t4, t0);
+        tcg_gen_mov_tl(t5, t0);
+        break;
+    case MXU_OPTN2_HW: /* XRB.H+XRC.H == lop, XRB.H+XRC.L == rop */
+        tcg_gen_mov_tl(t4, t1);
+        tcg_gen_mov_tl(t5, t1);
+        break;
+    case MXU_OPTN2_XW: /* XRB.L+XRC.H == lop, XRB.H+XRC.L == rop */
+        tcg_gen_mov_tl(t4, t0);
+        tcg_gen_mov_tl(t5, t1);
+        break;
+    }
+
+    switch (aptn2) {
+    case MXU_APTN2_AA: /* lop +, rop + */
+        tcg_gen_add_tl(t0, t4, t3);
+        tcg_gen_add_tl(t1, t5, t2);
+        tcg_gen_add_tl(t4, t4, t3);
+        tcg_gen_add_tl(t5, t5, t2);
+        break;
+    case MXU_APTN2_AS: /* lop +, rop + */
+        tcg_gen_sub_tl(t0, t4, t3);
+        tcg_gen_sub_tl(t1, t5, t2);
+        tcg_gen_add_tl(t4, t4, t3);
+        tcg_gen_add_tl(t5, t5, t2);
+        break;
+    case MXU_APTN2_SA: /* lop +, rop + */
+        tcg_gen_add_tl(t0, t4, t3);
+        tcg_gen_add_tl(t1, t5, t2);
+        tcg_gen_sub_tl(t4, t4, t3);
+        tcg_gen_sub_tl(t5, t5, t2);
+        break;
+    case MXU_APTN2_SS: /* lop +, rop + */
+        tcg_gen_sub_tl(t0, t4, t3);
+        tcg_gen_sub_tl(t1, t5, t2);
+        tcg_gen_sub_tl(t4, t4, t3);
+        tcg_gen_sub_tl(t5, t5, t2);
+        break;
+    }
+
+    tcg_gen_shli_tl(t0, t0, 16);
+    tcg_gen_extract_tl(t1, t1, 0, 16);
+    tcg_gen_shli_tl(t4, t4, 16);
+    tcg_gen_extract_tl(t5, t5, 0, 16);
+
+    tcg_gen_or_tl(mxu_gpr[XRa - 1], t4, t5);
+    tcg_gen_or_tl(mxu_gpr[XRd - 1], t0, t1);
+}
+
 /*
  *                 MXU instruction category: Miscellaneous
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -2906,6 +2992,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_S16MAD:
             gen_mxu_s16mad(ctx);
             break;
+        case OPC_MXU_Q16ADD:
+            gen_mxu_q16add(ctx);
+            break;
         case OPC_MXU_D16MACE:
             gen_mxu_d16mac(ctx, true, false);
             break;

From 9e51e0cd4bac9dd94f593d66497f635edd871d2e Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:04 +0300
Subject: [PATCH 0685/1353] target/mips/mxu: Add D32ADD instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction adds/subtracts two 32-bit values in XRb and XRc.
Placing results in XRa and XRd and updates carry bits for each
path in the MXU control register.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-16-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 64 +++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index dc4fdf1dd9..b133f9f11d 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -376,6 +376,7 @@ enum {
     OPC_MXU__POOL09  = 0x15,
     OPC_MXU__POOL10  = 0x16,
     OPC_MXU__POOL11  = 0x17,
+    OPC_MXU_D32ADD   = 0x18,
     OPC_MXU_S8LDD    = 0x22,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
@@ -2247,6 +2248,66 @@ static void gen_mxu_q16add(DisasContext *ctx)
     tcg_gen_or_tl(mxu_gpr[XRd - 1], t0, t1);
 }
 
+/*
+ * D32ADD XRa, XRb, XRc, XRd, aptn2 - Double
+ * 32 bit pattern addition/subtraction.
+ */
+static void gen_mxu_d32add(DisasContext *ctx)
+{
+    uint32_t aptn2, pad, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    pad   = extract32(ctx->opcode, 22, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv carry = tcg_temp_new();
+    TCGv cr = tcg_temp_new();
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0 && XRd == 0)) {
+        /* destinations are zero register -> do nothing */
+    } else {
+        /* common case */
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        gen_load_mxu_cr(cr);
+        if (XRa != 0) {
+            if (aptn2 & 2) {
+                tcg_gen_sub_i32(t2, t0, t1);
+                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t1);
+            } else {
+                tcg_gen_add_i32(t2, t0, t1);
+                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t2);
+            }
+            tcg_gen_andi_tl(cr, cr, 0x7fffffff);
+            tcg_gen_shli_tl(carry, carry, 31);
+            tcg_gen_or_tl(cr, cr, carry);
+            gen_store_mxu_gpr(t2, XRa);
+        }
+        if (XRd != 0) {
+            if (aptn2 & 1) {
+                tcg_gen_sub_i32(t2, t0, t1);
+                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t1);
+            } else {
+                tcg_gen_add_i32(t2, t0, t1);
+                tcg_gen_setcond_tl(TCG_COND_GTU, carry, t0, t2);
+            }
+            tcg_gen_andi_tl(cr, cr, 0xbfffffff);
+            tcg_gen_shli_tl(carry, carry, 30);
+            tcg_gen_or_tl(cr, cr, carry);
+            gen_store_mxu_gpr(t2, XRd);
+        }
+        gen_store_mxu_cr(cr);
+    }
+}
+
 /*
  *                 MXU instruction category: Miscellaneous
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -3031,6 +3092,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL11:
             decode_opc_mxu__pool11(ctx);
             break;
+        case OPC_MXU_D32ADD:
+            gen_mxu_d32add(ctx);
+            break;
         case OPC_MXU_S8LDD:
             gen_mxu_s8ldd(ctx);
             break;

From 98db7a585eb402579d2e5a7ec2b04fa22d12490a Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:05 +0300
Subject: [PATCH 0686/1353] target/mips/mxu: Add D32ACC D32ACCM D32ASUM
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are all dual 32-bit addition/subtraction in
various combinations. The instructions are grouped in pool12,
see the opcode organization in the file.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-17-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 160 ++++++++++++++++++++++++++++++++
 1 file changed, 160 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index b133f9f11d..82a07040c6 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -377,6 +377,7 @@ enum {
     OPC_MXU__POOL10  = 0x16,
     OPC_MXU__POOL11  = 0x17,
     OPC_MXU_D32ADD   = 0x18,
+    OPC_MXU__POOL12  = 0x19,
     OPC_MXU_S8LDD    = 0x22,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
@@ -439,6 +440,15 @@ enum {
     OPC_MXU_S32LDSTR = 0x01,
 };
 
+/*
+ * MXU pool 12
+ */
+enum {
+    OPC_MXU_D32ACC    = 0x00,
+    OPC_MXU_D32ACCM   = 0x01,
+    OPC_MXU_D32ASUM   = 0x02,
+};
+
 /*
  * MXU pool 16
  */
@@ -2308,6 +2318,132 @@ static void gen_mxu_d32add(DisasContext *ctx)
     }
 }
 
+/*
+ * D32ACC XRa, XRb, XRc, XRd, aptn2 - Double
+ * 32 bit pattern addition/subtraction and accumulate.
+ */
+static void gen_mxu_d32acc(DisasContext *ctx)
+{
+    uint32_t aptn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+
+    if (unlikely(XRa == 0 && XRd == 0)) {
+        /* destinations are zero register -> do nothing */
+    } else {
+        /* common case */
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        if (XRa != 0) {
+            if (aptn2 & 2) {
+                tcg_gen_sub_tl(t2, t0, t1);
+            } else {
+                tcg_gen_add_tl(t2, t0, t1);
+            }
+            tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
+        }
+        if (XRd != 0) {
+            if (aptn2 & 1) {
+                tcg_gen_sub_tl(t2, t0, t1);
+            } else {
+                tcg_gen_add_tl(t2, t0, t1);
+            }
+            tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
+        }
+    }
+}
+
+/*
+ * D32ACCM XRa, XRb, XRc, XRd, aptn2 - Double
+ * 32 bit pattern addition/subtraction and accumulate.
+ */
+static void gen_mxu_d32accm(DisasContext *ctx)
+{
+    uint32_t aptn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+
+    if (unlikely(XRa == 0 && XRd == 0)) {
+        /* destinations are zero register -> do nothing */
+    } else {
+        /* common case */
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        if (XRa != 0) {
+            tcg_gen_add_tl(t2, t0, t1);
+            if (aptn2 & 2) {
+                tcg_gen_sub_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
+            } else {
+                tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t2);
+            }
+        }
+        if (XRd != 0) {
+            tcg_gen_sub_tl(t2, t0, t1);
+            if (aptn2 & 1) {
+                tcg_gen_sub_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
+            } else {
+                tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t2);
+            }
+        }
+    }
+}
+
+/*
+ * D32ASUM XRa, XRb, XRc, XRd, aptn2 - Double
+ * 32 bit pattern addition/subtraction.
+ */
+static void gen_mxu_d32asum(DisasContext *ctx)
+{
+    uint32_t aptn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+
+    if (unlikely(XRa == 0 && XRd == 0)) {
+        /* destinations are zero register -> do nothing */
+    } else {
+        /* common case */
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        if (XRa != 0) {
+            if (aptn2 & 2) {
+                tcg_gen_sub_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            } else {
+                tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            }
+        }
+        if (XRd != 0) {
+            if (aptn2 & 1) {
+                tcg_gen_sub_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
+            } else {
+                tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
+            }
+        }
+    }
+}
+
 /*
  *                 MXU instruction category: Miscellaneous
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -2930,6 +3066,27 @@ static void decode_opc_mxu__pool11(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool12(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 22, 2);
+
+    switch (opcode) {
+    case OPC_MXU_D32ACC:
+        gen_mxu_d32acc(ctx);
+        break;
+    case OPC_MXU_D32ACCM:
+        gen_mxu_d32accm(ctx);
+        break;
+    case OPC_MXU_D32ASUM:
+        gen_mxu_d32asum(ctx);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool16(DisasContext *ctx)
 {
     uint32_t opcode = extract32(ctx->opcode, 18, 3);
@@ -3095,6 +3252,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_D32ADD:
             gen_mxu_d32add(ctx);
             break;
+        case OPC_MXU__POOL12:
+            decode_opc_mxu__pool12(ctx);
+            break;
         case OPC_MXU_S8LDD:
             gen_mxu_s8ldd(ctx);
             break;

From 513cfdae7a45a705f2fb2919ad95c82f66169c6e Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:06 +0300
Subject: [PATCH 0687/1353] target/mips/mxu: Add D32ADDC instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction adds two 32-bit values with respect
to corresponding carry flags in MXU_CR.
XRa += XRb + LeftCarry flag;
XRd += XRc + RightCarry flag;
Suddenly, it doesn't modify carry flags as a result of addition.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-18-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 39 +++++++++++++++++++++++++++------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 82a07040c6..84e8f760e4 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -268,7 +268,7 @@
  *          │                               13..10
  *          ├─ 010111 ─ OPC_MXU__POOL11 ─┬─ 0000 ─ OPC_MXU_S32SDIV
  *          │                            └─ 0001 ─ OPC_MXU_S32SDIVR
- *          ├─ 011000 ─ OPC_MXU_D32ADD
+ *          ├─ 011000 ─ OPC_MXU_D32ADD  (catches D32ADDC too)
  *          │                               23..22
  *   MXU    ├─ 011001 ─ OPC_MXU__POOL12 ─┬─ 00 ─ OPC_MXU_D32ACC
  * opcodes ─┤                            ├─ 01 ─ OPC_MXU_D32ACCM
@@ -2260,14 +2260,17 @@ static void gen_mxu_q16add(DisasContext *ctx)
 
 /*
  * D32ADD XRa, XRb, XRc, XRd, aptn2 - Double
- * 32 bit pattern addition/subtraction.
+ * 32 bit pattern addition/subtraction, set carry.
+ *
+ * D32ADDC XRa, XRb, XRc, XRd, aptn2 - Double
+ * 32 bit pattern addition/subtraction with carry.
  */
 static void gen_mxu_d32add(DisasContext *ctx)
 {
-    uint32_t aptn2, pad, XRc, XRb, XRa, XRd;
+    uint32_t aptn2, addc, XRc, XRb, XRa, XRd;
 
     aptn2 = extract32(ctx->opcode, 24, 2);
-    pad   = extract32(ctx->opcode, 22, 2);
+    addc  = extract32(ctx->opcode, 22, 2);
     XRd   = extract32(ctx->opcode, 18, 4);
     XRc   = extract32(ctx->opcode, 14, 4);
     XRb   = extract32(ctx->opcode, 10, 4);
@@ -2276,15 +2279,37 @@ static void gen_mxu_d32add(DisasContext *ctx)
     TCGv t0 = tcg_temp_new();
     TCGv t1 = tcg_temp_new();
     TCGv t2 = tcg_temp_new();
-    TCGv carry = tcg_temp_new();
     TCGv cr = tcg_temp_new();
 
-    if (unlikely(pad != 0)) {
-        /* opcode padding incorrect -> do nothing */
+    if (unlikely(addc > 1)) {
+        /* opcode incorrect -> do nothing */
+    } else if (addc == 1) {
+        if (unlikely(XRa == 0 && XRd == 0)) {
+            /* destinations are zero register -> do nothing */
+        } else {
+            /* FIXME ??? What if XRa == XRd ??? */
+            /* aptn2 is unused here */
+            gen_load_mxu_gpr(t0, XRb);
+            gen_load_mxu_gpr(t1, XRc);
+            gen_load_mxu_cr(cr);
+            if (XRa != 0) {
+                tcg_gen_extract_tl(t2, cr, 31, 1);
+                tcg_gen_add_tl(t0, t0, t2);
+                tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+            }
+            if (XRd != 0) {
+                tcg_gen_extract_tl(t2, cr, 30, 1);
+                tcg_gen_add_tl(t1, t1, t2);
+                tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t1);
+            }
+        }
     } else if (unlikely(XRa == 0 && XRd == 0)) {
         /* destinations are zero register -> do nothing */
     } else {
         /* common case */
+        /* FIXME ??? What if XRa == XRd ??? */
+        TCGv carry = tcg_temp_new();
+
         gen_load_mxu_gpr(t0, XRb);
         gen_load_mxu_gpr(t1, XRc);
         gen_load_mxu_cr(cr);

From 6191a807fb865804c08b60b06393f25673f2fb64 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:07 +0300
Subject: [PATCH 0688/1353] target/mips/mxu: Add Q16ACC Q16ACCM D16ASUM
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are all dual 16-bit addition/subtraction in
various combinations. The instructions are grouped in pool13,
see the opcode organization in the file.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-19-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 228 +++++++++++++++++++++++++++++++-
 1 file changed, 227 insertions(+), 1 deletion(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 84e8f760e4..18188208b7 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -277,7 +277,7 @@
  *          │                               23..22
  *          ├─ 011011 ─ OPC_MXU__POOL13 ─┬─ 00 ─ OPC_MXU_Q16ACC
  *          │                            ├─ 01 ─ OPC_MXU_Q16ACCM
- *          │                            └─ 10 ─ OPC_MXU_Q16ASUM
+ *          │                            └─ 10 ─ OPC_MXU_D16ASUM
  *          │
  *          │                               23..22
  *          ├─ 011100 ─ OPC_MXU__POOL14 ─┬─ 00 ─ OPC_MXU_Q8ADDE
@@ -378,6 +378,7 @@ enum {
     OPC_MXU__POOL11  = 0x17,
     OPC_MXU_D32ADD   = 0x18,
     OPC_MXU__POOL12  = 0x19,
+    OPC_MXU__POOL13  = 0x1B,
     OPC_MXU_S8LDD    = 0x22,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
@@ -449,6 +450,15 @@ enum {
     OPC_MXU_D32ASUM   = 0x02,
 };
 
+/*
+ * MXU pool 13
+ */
+enum {
+    OPC_MXU_Q16ACC    = 0x00,
+    OPC_MXU_Q16ACCM   = 0x01,
+    OPC_MXU_D16ASUM   = 0x02,
+};
+
 /*
  * MXU pool 16
  */
@@ -2258,6 +2268,198 @@ static void gen_mxu_q16add(DisasContext *ctx)
     tcg_gen_or_tl(mxu_gpr[XRd - 1], t0, t1);
 }
 
+/*
+ * Q16ACC XRa, XRb, XRc, XRd, aptn2 - Quad packed
+ * 16-bit addition/subtraction with accumulate.
+ */
+static void gen_mxu_q16acc(DisasContext *ctx)
+{
+    uint32_t aptn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGv s3 = tcg_temp_new();
+    TCGv s2 = tcg_temp_new();
+    TCGv s1 = tcg_temp_new();
+    TCGv s0 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t1, XRb);
+    tcg_gen_extract_tl(t0, t1,  0, 16);
+    tcg_gen_extract_tl(t1, t1, 16, 16);
+
+    gen_load_mxu_gpr(t3, XRc);
+    tcg_gen_extract_tl(t2, t3,  0, 16);
+    tcg_gen_extract_tl(t3, t3, 16, 16);
+
+    switch (aptn2) {
+    case MXU_APTN2_AA: /* lop +, rop + */
+        tcg_gen_add_tl(s3, t1, t3);
+        tcg_gen_add_tl(s2, t0, t2);
+        tcg_gen_add_tl(s1, t1, t3);
+        tcg_gen_add_tl(s0, t0, t2);
+        break;
+    case MXU_APTN2_AS: /* lop +, rop - */
+        tcg_gen_sub_tl(s3, t1, t3);
+        tcg_gen_sub_tl(s2, t0, t2);
+        tcg_gen_add_tl(s1, t1, t3);
+        tcg_gen_add_tl(s0, t0, t2);
+        break;
+    case MXU_APTN2_SA: /* lop -, rop + */
+        tcg_gen_add_tl(s3, t1, t3);
+        tcg_gen_add_tl(s2, t0, t2);
+        tcg_gen_sub_tl(s1, t1, t3);
+        tcg_gen_sub_tl(s0, t0, t2);
+        break;
+    case MXU_APTN2_SS: /* lop -, rop - */
+        tcg_gen_sub_tl(s3, t1, t3);
+        tcg_gen_sub_tl(s2, t0, t2);
+        tcg_gen_sub_tl(s1, t1, t3);
+        tcg_gen_sub_tl(s0, t0, t2);
+        break;
+    }
+
+    if (XRa != 0) {
+        tcg_gen_add_tl(t0, mxu_gpr[XRa - 1], s0);
+        tcg_gen_extract_tl(t0, t0, 0, 16);
+        tcg_gen_extract_tl(t1, mxu_gpr[XRa - 1], 16, 16);
+        tcg_gen_add_tl(t1, t1, s1);
+        tcg_gen_shli_tl(t1, t1, 16);
+        tcg_gen_or_tl(mxu_gpr[XRa - 1], t1, t0);
+    }
+
+    if (XRd != 0) {
+        tcg_gen_add_tl(t0, mxu_gpr[XRd - 1], s2);
+        tcg_gen_extract_tl(t0, t0, 0, 16);
+        tcg_gen_extract_tl(t1, mxu_gpr[XRd - 1], 16, 16);
+        tcg_gen_add_tl(t1, t1, s3);
+        tcg_gen_shli_tl(t1, t1, 16);
+        tcg_gen_or_tl(mxu_gpr[XRd - 1], t1, t0);
+    }
+}
+
+/*
+ * Q16ACCM XRa, XRb, XRc, XRd, aptn2 - Quad packed
+ * 16-bit accumulate.
+ */
+static void gen_mxu_q16accm(DisasContext *ctx)
+{
+    uint32_t aptn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t2, XRb);
+    gen_load_mxu_gpr(t3, XRc);
+
+    if (XRa != 0) {
+        TCGv a0 = tcg_temp_new();
+        TCGv a1 = tcg_temp_new();
+
+        tcg_gen_extract_tl(t0, t2,  0, 16);
+        tcg_gen_extract_tl(t1, t2, 16, 16);
+
+        gen_load_mxu_gpr(a1, XRa);
+        tcg_gen_extract_tl(a0, a1,  0, 16);
+        tcg_gen_extract_tl(a1, a1, 16, 16);
+
+        if (aptn2 & 2) {
+            tcg_gen_sub_tl(a0, a0, t0);
+            tcg_gen_sub_tl(a1, a1, t1);
+        } else {
+            tcg_gen_add_tl(a0, a0, t0);
+            tcg_gen_add_tl(a1, a1, t1);
+        }
+        tcg_gen_extract_tl(a0, a0, 0, 16);
+        tcg_gen_shli_tl(a1, a1, 16);
+        tcg_gen_or_tl(mxu_gpr[XRa - 1], a1, a0);
+    }
+
+    if (XRd != 0) {
+        TCGv a0 = tcg_temp_new();
+        TCGv a1 = tcg_temp_new();
+
+        tcg_gen_extract_tl(t0, t3,  0, 16);
+        tcg_gen_extract_tl(t1, t3, 16, 16);
+
+        gen_load_mxu_gpr(a1, XRd);
+        tcg_gen_extract_tl(a0, a1,  0, 16);
+        tcg_gen_extract_tl(a1, a1, 16, 16);
+
+        if (aptn2 & 1) {
+            tcg_gen_sub_tl(a0, a0, t0);
+            tcg_gen_sub_tl(a1, a1, t1);
+        } else {
+            tcg_gen_add_tl(a0, a0, t0);
+            tcg_gen_add_tl(a1, a1, t1);
+        }
+        tcg_gen_extract_tl(a0, a0, 0, 16);
+        tcg_gen_shli_tl(a1, a1, 16);
+        tcg_gen_or_tl(mxu_gpr[XRd - 1], a1, a0);
+    }
+}
+
+
+/*
+ * D16ASUM XRa, XRb, XRc, XRd, aptn2 - Double packed
+ * 16-bit sign extended addition and accumulate.
+ */
+static void gen_mxu_d16asum(DisasContext *ctx)
+{
+    uint32_t aptn2, XRc, XRb, XRa, XRd;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t2, XRb);
+    gen_load_mxu_gpr(t3, XRc);
+
+    if (XRa != 0) {
+        tcg_gen_sextract_tl(t0, t2,  0, 16);
+        tcg_gen_sextract_tl(t1, t2, 16, 16);
+        tcg_gen_add_tl(t0, t0, t1);
+        if (aptn2 & 2) {
+            tcg_gen_sub_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+        } else {
+            tcg_gen_add_tl(mxu_gpr[XRa - 1], mxu_gpr[XRa - 1], t0);
+        }
+    }
+
+    if (XRd != 0) {
+        tcg_gen_sextract_tl(t0, t3,  0, 16);
+        tcg_gen_sextract_tl(t1, t3, 16, 16);
+        tcg_gen_add_tl(t0, t0, t1);
+        if (aptn2 & 1) {
+            tcg_gen_sub_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t0);
+        } else {
+            tcg_gen_add_tl(mxu_gpr[XRd - 1], mxu_gpr[XRd - 1], t0);
+        }
+    }
+}
+
 /*
  * D32ADD XRa, XRb, XRc, XRd, aptn2 - Double
  * 32 bit pattern addition/subtraction, set carry.
@@ -3112,6 +3314,27 @@ static void decode_opc_mxu__pool12(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool13(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 22, 2);
+
+    switch (opcode) {
+    case OPC_MXU_Q16ACC:
+        gen_mxu_q16acc(ctx);
+        break;
+    case OPC_MXU_Q16ACCM:
+        gen_mxu_q16accm(ctx);
+        break;
+    case OPC_MXU_D16ASUM:
+        gen_mxu_d16asum(ctx);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool16(DisasContext *ctx)
 {
     uint32_t opcode = extract32(ctx->opcode, 18, 3);
@@ -3280,6 +3503,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL12:
             decode_opc_mxu__pool12(ctx);
             break;
+        case OPC_MXU__POOL13:
+            decode_opc_mxu__pool13(ctx);
+            break;
         case OPC_MXU_S8LDD:
             gen_mxu_s8ldd(ctx);
             break;

From eb79951ab638ba84ef424a8f7c0929cd4a5ea53d Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:08 +0300
Subject: [PATCH 0689/1353] target/mips/mxu: Add Q8ADDE Q8ACCE D8SUM D8SUMC
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are all dual 8-bit addition/subtraction in
various combinations. Most instructions are grouped in pool14,
see the opcode organization in the file.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-20-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 200 ++++++++++++++++++++++++++++++++
 1 file changed, 200 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 18188208b7..5556fd152d 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -379,6 +379,8 @@ enum {
     OPC_MXU_D32ADD   = 0x18,
     OPC_MXU__POOL12  = 0x19,
     OPC_MXU__POOL13  = 0x1B,
+    OPC_MXU__POOL14  = 0x1C,
+    OPC_MXU_Q8ACCE   = 0x1D,
     OPC_MXU_S8LDD    = 0x22,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
@@ -459,6 +461,15 @@ enum {
     OPC_MXU_D16ASUM   = 0x02,
 };
 
+/*
+ * MXU pool 14
+ */
+enum {
+    OPC_MXU_Q8ADDE    = 0x00,
+    OPC_MXU_D8SUM     = 0x01,
+    OPC_MXU_D8SUMC    = 0x02,
+};
+
 /*
  * MXU pool 16
  */
@@ -2183,6 +2194,168 @@ static void gen_mxu_Q8ADD(DisasContext *ctx)
     }
 }
 
+/*
+ *  Q8ADDE XRa, XRb, XRc, XRd, aptn2
+ *    Add/subtract quadruple of 8-bit packed in XRb
+ *    to another one in XRc, with zero extending
+ *    to 16-bit and put results as packed 16-bit data
+ *    into XRa and XRd.
+ *    aptn2 manages action add or subract of pairs of data.
+ *
+ *  Q8ACCE XRa, XRb, XRc, XRd, aptn2
+ *    Add/subtract quadruple of 8-bit packed in XRb
+ *    to another one in XRc, with zero extending
+ *    to 16-bit and accumulate results as packed 16-bit data
+ *    into XRa and XRd.
+ *    aptn2 manages action add or subract of pairs of data.
+ */
+static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
+{
+    uint32_t aptn2, XRd, XRc, XRb, XRa;
+
+    aptn2 = extract32(ctx->opcode, 24, 2);
+    XRd   = extract32(ctx->opcode, 18, 4);
+    XRc   = extract32(ctx->opcode, 14, 4);
+    XRb   = extract32(ctx->opcode, 10, 4);
+    XRa   = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        if (XRa != 0) {
+            tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+        }
+        if (XRd != 0) {
+            tcg_gen_movi_tl(mxu_gpr[XRd - 1], 0);
+        }
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+        TCGv t5 = tcg_temp_new();
+
+        if (XRa != 0) {
+            tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1], 16, 8);
+            tcg_gen_extract_tl(t1, mxu_gpr[XRc - 1], 16, 8);
+            tcg_gen_extract_tl(t2, mxu_gpr[XRb - 1], 24, 8);
+            tcg_gen_extract_tl(t3, mxu_gpr[XRc - 1], 24, 8);
+            if (aptn2 & 2) {
+                tcg_gen_sub_tl(t0, t0, t1);
+                tcg_gen_sub_tl(t2, t2, t3);
+            } else {
+                tcg_gen_add_tl(t0, t0, t1);
+                tcg_gen_add_tl(t2, t2, t3);
+            }
+            if (accumulate) {
+                gen_load_mxu_gpr(t5, XRa);
+                tcg_gen_extract_tl(t1, t5,  0, 16);
+                tcg_gen_extract_tl(t3, t5, 16, 16);
+                tcg_gen_add_tl(t0, t0, t1);
+                tcg_gen_add_tl(t2, t2, t3);
+            }
+            tcg_gen_shli_tl(t2, t2, 16);
+            tcg_gen_extract_tl(t0, t0, 0, 16);
+            tcg_gen_or_tl(t4, t2, t0);
+        }
+        if (XRd != 0) {
+            tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1], 0, 8);
+            tcg_gen_extract_tl(t1, mxu_gpr[XRc - 1], 0, 8);
+            tcg_gen_extract_tl(t2, mxu_gpr[XRb - 1], 8, 8);
+            tcg_gen_extract_tl(t3, mxu_gpr[XRc - 1], 8, 8);
+            if (aptn2 & 1) {
+                tcg_gen_sub_tl(t0, t0, t1);
+                tcg_gen_sub_tl(t2, t2, t3);
+            } else {
+                tcg_gen_add_tl(t0, t0, t1);
+                tcg_gen_add_tl(t2, t2, t3);
+            }
+            if (accumulate) {
+                gen_load_mxu_gpr(t5, XRd);
+                tcg_gen_extract_tl(t1, t5,  0, 16);
+                tcg_gen_extract_tl(t3, t5, 16, 16);
+                tcg_gen_add_tl(t0, t0, t1);
+                tcg_gen_add_tl(t2, t2, t3);
+            }
+            tcg_gen_shli_tl(t2, t2, 16);
+            tcg_gen_extract_tl(t0, t0, 0, 16);
+            tcg_gen_or_tl(t5, t2, t0);
+        }
+
+        gen_store_mxu_gpr(t4, XRa);
+        gen_store_mxu_gpr(t5, XRd);
+    }
+}
+
+/*
+ *  D8SUM XRa, XRb, XRc
+ *    Double parallel add of quadruple unsigned 8-bit together
+ *    with zero extending to 16-bit data.
+ *  D8SUMC XRa, XRb, XRc
+ *    Double parallel add of quadruple unsigned 8-bit together
+ *    with zero extending to 16-bit data and adding 2 to each
+ *    parallel result.
+ */
+static void gen_mxu_d8sum(DisasContext *ctx, bool sumc)
+{
+    uint32_t pad, pad2, XRc, XRb, XRa;
+
+    pad  = extract32(ctx->opcode, 24, 2);
+    pad2 = extract32(ctx->opcode, 18, 4);
+    XRc  = extract32(ctx->opcode, 14, 4);
+    XRb  = extract32(ctx->opcode, 10, 4);
+    XRa  = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(pad != 0 || pad2 != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to zero */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGv t4 = tcg_temp_new();
+        TCGv t5 = tcg_temp_new();
+
+        if (XRb != 0) {
+            tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1],  0, 8);
+            tcg_gen_extract_tl(t1, mxu_gpr[XRb - 1],  8, 8);
+            tcg_gen_extract_tl(t2, mxu_gpr[XRb - 1], 16, 8);
+            tcg_gen_extract_tl(t3, mxu_gpr[XRb - 1], 24, 8);
+            tcg_gen_add_tl(t4, t0, t1);
+            tcg_gen_add_tl(t4, t4, t2);
+            tcg_gen_add_tl(t4, t4, t3);
+        } else {
+            tcg_gen_mov_tl(t4, 0);
+        }
+        if (XRc != 0) {
+            tcg_gen_extract_tl(t0, mxu_gpr[XRc - 1],  0, 8);
+            tcg_gen_extract_tl(t1, mxu_gpr[XRc - 1],  8, 8);
+            tcg_gen_extract_tl(t2, mxu_gpr[XRc - 1], 16, 8);
+            tcg_gen_extract_tl(t3, mxu_gpr[XRc - 1], 24, 8);
+            tcg_gen_add_tl(t5, t0, t1);
+            tcg_gen_add_tl(t5, t5, t2);
+            tcg_gen_add_tl(t5, t5, t3);
+        } else {
+            tcg_gen_mov_tl(t5, 0);
+        }
+
+        if (sumc) {
+            tcg_gen_addi_tl(t4, t4, 2);
+            tcg_gen_addi_tl(t5, t5, 2);
+        }
+        tcg_gen_shli_tl(t4, t4, 16);
+
+        tcg_gen_or_tl(mxu_gpr[XRa - 1], t4, t5);
+    }
+}
+
 /*
  * Q16ADD XRa, XRb, XRc, XRd, aptn2, optn2 - Quad packed
  * 16-bit pattern addition.
@@ -3335,6 +3508,27 @@ static void decode_opc_mxu__pool13(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool14(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 22, 2);
+
+    switch (opcode) {
+    case OPC_MXU_Q8ADDE:
+        gen_mxu_q8adde(ctx, false);
+        break;
+    case OPC_MXU_D8SUM:
+        gen_mxu_d8sum(ctx, false);
+        break;
+    case OPC_MXU_D8SUMC:
+        gen_mxu_d8sum(ctx, true);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool16(DisasContext *ctx)
 {
     uint32_t opcode = extract32(ctx->opcode, 18, 3);
@@ -3506,6 +3700,12 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL13:
             decode_opc_mxu__pool13(ctx);
             break;
+        case OPC_MXU__POOL14:
+            decode_opc_mxu__pool14(ctx);
+            break;
+        case OPC_MXU_Q8ACCE:
+            gen_mxu_q8adde(ctx, true);
+            break;
         case OPC_MXU_S8LDD:
             gen_mxu_s8ldd(ctx);
             break;

From 3f0e94c1348d29451db94fb0ebdbaf6fdda1c730 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:09 +0300
Subject: [PATCH 0690/1353] target/mips/mxu: Add S8STD S8LDI S8SDI instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are all load/store a byte from memory
and put it into/get it from MXU register in various combinations.
I-suffix instructions modify the base address GPR by offset provided.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-21-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 74 ++++++++++++++++++++++++++++++++-
 1 file changed, 72 insertions(+), 2 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 5556fd152d..dcb0e13f93 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -382,6 +382,9 @@ enum {
     OPC_MXU__POOL14  = 0x1C,
     OPC_MXU_Q8ACCE   = 0x1D,
     OPC_MXU_S8LDD    = 0x22,
+    OPC_MXU_S8STD    = 0x23,
+    OPC_MXU_S8LDI    = 0x24,
+    OPC_MXU_S8SDI    = 0x25,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
     OPC_MXU_S32M2I   = 0x2E,
@@ -633,8 +636,11 @@ static void gen_mxu_s32m2i(DisasContext *ctx)
 
 /*
  * S8LDD XRa, Rb, s8, optn3 - Load a byte from memory to XRF
+ *
+ * S8LDI XRa, Rb, s8, optn3 - Load a byte from memory to XRF,
+ * post modify address register
  */
-static void gen_mxu_s8ldd(DisasContext *ctx)
+static void gen_mxu_s8ldd(DisasContext *ctx, bool postmodify)
 {
     TCGv t0, t1;
     uint32_t XRa, Rb, s8, optn3;
@@ -649,6 +655,9 @@ static void gen_mxu_s8ldd(DisasContext *ctx)
 
     gen_load_gpr(t0, Rb);
     tcg_gen_addi_tl(t0, t0, (int8_t)s8);
+    if (postmodify) {
+        gen_store_gpr(t0, Rb);
+    }
 
     switch (optn3) {
     /* XRa[7:0] = tmp8 */
@@ -705,6 +714,58 @@ static void gen_mxu_s8ldd(DisasContext *ctx)
     gen_store_mxu_gpr(t0, XRa);
 }
 
+/*
+ * S8STD XRa, Rb, s8, optn3 - Store a byte from XRF to memory
+ *
+ * S8SDI XRa, Rb, s8, optn3 - Store a byte from XRF to memory,
+ * post modify address register
+ */
+static void gen_mxu_s8std(DisasContext *ctx, bool postmodify)
+{
+    TCGv t0, t1;
+    uint32_t XRa, Rb, s8, optn3;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    s8 = extract32(ctx->opcode, 10, 8);
+    optn3 = extract32(ctx->opcode, 18, 3);
+    Rb = extract32(ctx->opcode, 21, 5);
+
+    if (optn3 > 3) {
+        /* reserved, do nothing */
+        return;
+    }
+
+    gen_load_gpr(t0, Rb);
+    tcg_gen_addi_tl(t0, t0, (int8_t)s8);
+    if (postmodify) {
+        gen_store_gpr(t0, Rb);
+    }
+    gen_load_mxu_gpr(t1, XRa);
+
+    switch (optn3) {
+    /* XRa[7:0] => tmp8 */
+    case MXU_OPTN3_PTN0:
+        tcg_gen_extract_tl(t1, t1, 0, 8);
+        break;
+    /* XRa[15:8] => tmp8 */
+    case MXU_OPTN3_PTN1:
+        tcg_gen_extract_tl(t1, t1, 8, 8);
+        break;
+    /* XRa[23:16] => tmp8 */
+    case MXU_OPTN3_PTN2:
+        tcg_gen_extract_tl(t1, t1, 16, 8);
+        break;
+    /* XRa[31:24] => tmp8 */
+    case MXU_OPTN3_PTN3:
+        tcg_gen_extract_tl(t1, t1, 24, 8);
+        break;
+    }
+
+    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx, MO_UB);
+}
 /*
  * D16MUL  XRa, XRb, XRc, XRd, optn2 - Signed 16 bit pattern multiplication
  * D16MULF XRa, XRb, XRc, optn2 - Signed Q15 fraction pattern multiplication
@@ -3707,7 +3768,16 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
             gen_mxu_q8adde(ctx, true);
             break;
         case OPC_MXU_S8LDD:
-            gen_mxu_s8ldd(ctx);
+            gen_mxu_s8ldd(ctx, false);
+            break;
+        case OPC_MXU_S8STD:
+            gen_mxu_s8std(ctx, false);
+            break;
+        case OPC_MXU_S8LDI:
+            gen_mxu_s8ldd(ctx, true);
+            break;
+        case OPC_MXU_S8SDI:
+            gen_mxu_s8std(ctx, true);
             break;
         case OPC_MXU__POOL16:
             decode_opc_mxu__pool16(ctx);

From 968045b6c773fa61e48e4ca303f1acc9b54e4270 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:10 +0300
Subject: [PATCH 0691/1353] target/mips/mxu: Add S16LDD S16STD S16LDI S16SDI
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are all load/store a halfword from memory
and put it into/get it from MXU register in various combinations.
I-suffix instructions modify the base address GPR by offset provided.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-22-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 117 ++++++++++++++++++++++++++++++++
 1 file changed, 117 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index dcb0e13f93..caf5257952 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -387,6 +387,10 @@ enum {
     OPC_MXU_S8SDI    = 0x25,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
+    OPC_MXU_S16LDD   = 0x2A,
+    OPC_MXU_S16STD   = 0x2B,
+    OPC_MXU_S16LDI   = 0x2C,
+    OPC_MXU_S16SDI   = 0x2D,
     OPC_MXU_S32M2I   = 0x2E,
     OPC_MXU_S32I2M   = 0x2F,
     OPC_MXU__POOL19  = 0x38,
@@ -766,6 +770,107 @@ static void gen_mxu_s8std(DisasContext *ctx, bool postmodify)
 
     tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx, MO_UB);
 }
+
+/*
+ * S16LDD XRa, Rb, s10, optn2 - Load a halfword from memory to XRF
+ *
+ * S16LDI XRa, Rb, s10, optn2 - Load a halfword from memory to XRF,
+ * post modify address register
+ */
+static void gen_mxu_s16ldd(DisasContext *ctx, bool postmodify)
+{
+    TCGv t0, t1;
+    uint32_t XRa, Rb, optn2;
+    int32_t s10;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa   = extract32(ctx->opcode,   6, 4);
+    s10   = sextract32(ctx->opcode, 10, 9) * 2;
+    optn2 = extract32(ctx->opcode,  19, 2);
+    Rb    = extract32(ctx->opcode,  21, 5);
+
+    gen_load_gpr(t0, Rb);
+    tcg_gen_addi_tl(t0, t0, s10);
+    if (postmodify) {
+        gen_store_gpr(t0, Rb);
+    }
+
+    switch (optn2) {
+    /* XRa[15:0] = tmp16 */
+    case MXU_OPTN2_PTN0:
+        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UW);
+        gen_load_mxu_gpr(t0, XRa);
+        tcg_gen_deposit_tl(t0, t0, t1, 0, 16);
+        break;
+    /* XRa[31:16] = tmp16 */
+    case MXU_OPTN2_PTN1:
+        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UW);
+        gen_load_mxu_gpr(t0, XRa);
+        tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
+        break;
+    /* XRa = sign_extend(tmp16) */
+    case MXU_OPTN2_PTN2:
+        tcg_gen_qemu_ld_tl(t0, t0, ctx->mem_idx, MO_SW);
+        break;
+    /* XRa = {tmp16, tmp16} */
+    case MXU_OPTN2_PTN3:
+        tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, MO_UW);
+        tcg_gen_deposit_tl(t0, t1, t1,  0, 16);
+        tcg_gen_deposit_tl(t0, t1, t1, 16, 16);
+        break;
+    }
+
+    gen_store_mxu_gpr(t0, XRa);
+}
+
+/*
+ * S16STD XRa, Rb, s8, optn2 - Store a byte from XRF to memory
+ *
+ * S16SDI XRa, Rb, s8, optn2 - Store a byte from XRF to memory,
+ * post modify address register
+ */
+static void gen_mxu_s16std(DisasContext *ctx, bool postmodify)
+{
+    TCGv t0, t1;
+    uint32_t XRa, Rb, optn2;
+    int32_t s10;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    s10 = sextract32(ctx->opcode, 10, 9) * 2;
+    optn2 = extract32(ctx->opcode, 19, 2);
+    Rb = extract32(ctx->opcode, 21, 5);
+
+    if (optn2 > 1) {
+        /* reserved, do nothing */
+        return;
+    }
+
+    gen_load_gpr(t0, Rb);
+    tcg_gen_addi_tl(t0, t0, s10);
+    if (postmodify) {
+        gen_store_gpr(t0, Rb);
+    }
+    gen_load_mxu_gpr(t1, XRa);
+
+    switch (optn2) {
+    /* XRa[15:0] => tmp16 */
+    case MXU_OPTN2_PTN0:
+        tcg_gen_extract_tl(t1, t1, 0, 16);
+        break;
+    /* XRa[31:16] => tmp16 */
+    case MXU_OPTN2_PTN1:
+        tcg_gen_extract_tl(t1, t1, 16, 16);
+        break;
+    }
+
+    tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx, MO_UW);
+}
+
 /*
  * D16MUL  XRa, XRb, XRc, XRd, optn2 - Signed 16 bit pattern multiplication
  * D16MULF XRa, XRb, XRc, optn2 - Signed Q15 fraction pattern multiplication
@@ -3785,6 +3890,18 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL17:
             decode_opc_mxu__pool17(ctx);
             break;
+        case OPC_MXU_S16LDD:
+            gen_mxu_s16ldd(ctx, false);
+            break;
+        case OPC_MXU_S16STD:
+            gen_mxu_s16std(ctx, false);
+            break;
+        case OPC_MXU_S16LDI:
+            gen_mxu_s16ldd(ctx, true);
+            break;
+        case OPC_MXU_S16SDI:
+            gen_mxu_s16std(ctx, true);
+            break;
         case OPC_MXU__POOL19:
             decode_opc_mxu__pool19(ctx);
             break;

From 29059e72b0ddf6cddc94cccd61e0ef30063ff5be Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:11 +0300
Subject: [PATCH 0692/1353] target/mips/mxu: Add S32MUL S32MULU S32EXTR
 S32EXTRV insns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are part of pool15, see the grand opcode organization
tree on top of the file.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-23-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 200 +++++++++++++++++++++++++++++++-
 1 file changed, 196 insertions(+), 4 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index caf5257952..0704a8c7ff 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -290,9 +290,9 @@
  *          ├─ 100010 ─ OPC_MXU_S8LDD
  *          ├─ 100011 ─ OPC_MXU_S8STD       15..14
  *          ├─ 100100 ─ OPC_MXU_S8LDI    ┌─ 00 ─ OPC_MXU_S32MUL
- *          ├─ 100101 ─ OPC_MXU_S8SDI    ├─ 00 ─ OPC_MXU_S32MULU
- *          │                            ├─ 00 ─ OPC_MXU_S32EXTR
- *          ├─ 100110 ─ OPC_MXU__POOL15 ─┴─ 00 ─ OPC_MXU_S32EXTRV
+ *          ├─ 100101 ─ OPC_MXU_S8SDI    ├─ 01 ─ OPC_MXU_S32MULU
+ *          │                            ├─ 10 ─ OPC_MXU_S32EXTR
+ *          ├─ 100110 ─ OPC_MXU__POOL15 ─┴─ 11 ─ OPC_MXU_S32EXTRV
  *          │
  *          │                               20..18
  *          ├─ 100111 ─ OPC_MXU__POOL16 ─┬─ 000 ─ OPC_MXU_D32SARW
@@ -385,6 +385,7 @@ enum {
     OPC_MXU_S8STD    = 0x23,
     OPC_MXU_S8LDI    = 0x24,
     OPC_MXU_S8SDI    = 0x25,
+    OPC_MXU__POOL15  = 0x26,
     OPC_MXU__POOL16  = 0x27,
     OPC_MXU__POOL17  = 0x28,
     OPC_MXU_S16LDD   = 0x2A,
@@ -477,6 +478,16 @@ enum {
     OPC_MXU_D8SUMC    = 0x02,
 };
 
+/*
+ * MXU pool 15
+ */
+enum {
+    OPC_MXU_S32MUL    = 0x00,
+    OPC_MXU_S32MULU   = 0x01,
+    OPC_MXU_S32EXTR   = 0x02,
+    OPC_MXU_S32EXTRV  = 0x03,
+};
+
 /*
  * MXU pool 16
  */
@@ -871,6 +882,47 @@ static void gen_mxu_s16std(DisasContext *ctx, bool postmodify)
     tcg_gen_qemu_st_tl(t1, t0, ctx->mem_idx, MO_UW);
 }
 
+/*
+ * S32MUL  XRa, XRd, rs, rt - Signed 32x32=>64 bit multiplication
+ * of GPR's and stores result into pair of MXU registers.
+ * It strains HI and LO registers.
+ *
+ * S32MULU XRa, XRd, rs, rt - Unsigned 32x32=>64 bit multiplication
+ * of GPR's and stores result into pair of MXU registers.
+ * It strains HI and LO registers.
+ */
+static void gen_mxu_s32mul(DisasContext *ctx, bool mulu)
+{
+    TCGv t0, t1;
+    uint32_t XRa, XRd, rs, rt;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode,  6, 4);
+    XRd = extract32(ctx->opcode, 10, 4);
+    rs  = extract32(ctx->opcode, 16, 5);
+    rt  = extract32(ctx->opcode, 21, 5);
+
+    if (unlikely(rs == 0 || rt == 0)) {
+        tcg_gen_movi_tl(t0, 0);
+        tcg_gen_movi_tl(t1, 0);
+    } else {
+        gen_load_gpr(t0, rs);
+        gen_load_gpr(t1, rt);
+
+        if (mulu) {
+            tcg_gen_mulu2_tl(t0, t1, t0, t1);
+        } else {
+            tcg_gen_muls2_tl(t0, t1, t0, t1);
+        }
+    }
+    tcg_gen_mov_tl(cpu_HI[0], t1);
+    tcg_gen_mov_tl(cpu_LO[0], t0);
+    gen_store_mxu_gpr(t1, XRa);
+    gen_store_mxu_gpr(t0, XRd);
+}
+
 /*
  * D16MUL  XRa, XRb, XRc, XRd, optn2 - Signed 16 bit pattern multiplication
  * D16MULF XRa, XRb, XRc, optn2 - Signed Q15 fraction pattern multiplication
@@ -3014,9 +3066,122 @@ static void gen_mxu_d32asum(DisasContext *ctx)
  *                 MXU instruction category: Miscellaneous
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *
- *                       Q16SAT
+ *               S32EXTR
+ *               S32EXTRV
+ *                            Q16SAT
  */
 
+/*
+ *  S32EXTR XRa, XRd, rs, bits5
+ *    Extract bits5 bits from 64-bit pair {XRa:XRd}
+ *    starting from rs[4:0] offset and put to the XRa.
+ */
+static void gen_mxu_s32extr(DisasContext *ctx)
+{
+    TCGv t0, t1, t2, t3;
+    uint32_t XRa, XRd, rs, bits5;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+    t2 = tcg_temp_new();
+    t3 = tcg_temp_new();
+
+    XRa   = extract32(ctx->opcode,  6, 4);
+    XRd   = extract32(ctx->opcode, 10, 4);
+    bits5 = extract32(ctx->opcode, 16, 5);
+    rs    = extract32(ctx->opcode, 21, 5);
+
+    /* {tmp} = {XRa:XRd} >> (64 - rt - bits5); */
+    /* {XRa} = extract({tmp}, 0, bits5); */
+    if (bits5 > 0) {
+        TCGLabel *l_xra_only = gen_new_label();
+        TCGLabel *l_done = gen_new_label();
+
+        gen_load_mxu_gpr(t0, XRd);
+        gen_load_mxu_gpr(t1, XRa);
+        gen_load_gpr(t2, rs);
+        tcg_gen_andi_tl(t2, t2, 0x1f);
+        tcg_gen_subfi_tl(t2, 32, t2);
+        tcg_gen_brcondi_tl(TCG_COND_GE, t2, bits5, l_xra_only);
+        tcg_gen_subfi_tl(t2, bits5, t2);
+        tcg_gen_subfi_tl(t3, 32, t2);
+        tcg_gen_shr_tl(t0, t0, t3);
+        tcg_gen_shl_tl(t1, t1, t2);
+        tcg_gen_or_tl(t0, t0, t1);
+        tcg_gen_br(l_done);
+        gen_set_label(l_xra_only);
+        tcg_gen_subi_tl(t2, t2, bits5);
+        tcg_gen_shr_tl(t0, t1, t2);
+        gen_set_label(l_done);
+        tcg_gen_extract_tl(t0, t0, 0, bits5);
+    } else {
+        /* unspecified behavior but matches tests on real hardware*/
+        tcg_gen_movi_tl(t0, 0);
+    }
+    gen_store_mxu_gpr(t0, XRa);
+}
+
+/*
+ *  S32EXTRV XRa, XRd, rs, rt
+ *    Extract rt[4:0] bits from 64-bit pair {XRa:XRd}
+ *    starting from rs[4:0] offset and put to the XRa.
+ */
+static void gen_mxu_s32extrv(DisasContext *ctx)
+{
+    TCGv t0, t1, t2, t3, t4;
+    uint32_t XRa, XRd, rs, rt;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+    t2 = tcg_temp_new();
+    t3 = tcg_temp_new();
+    t4 = tcg_temp_new();
+    TCGLabel *l_xra_only = gen_new_label();
+    TCGLabel *l_done = gen_new_label();
+    TCGLabel *l_zero = gen_new_label();
+    TCGLabel *l_extract = gen_new_label();
+
+    XRa = extract32(ctx->opcode,  6, 4);
+    XRd = extract32(ctx->opcode, 10, 4);
+    rt  = extract32(ctx->opcode, 16, 5);
+    rs  = extract32(ctx->opcode, 21, 5);
+
+    /* {tmp} = {XRa:XRd} >> (64 - rs - rt) */
+    gen_load_mxu_gpr(t0, XRd);
+    gen_load_mxu_gpr(t1, XRa);
+    gen_load_gpr(t2, rs);
+    gen_load_gpr(t4, rt);
+    tcg_gen_brcondi_tl(TCG_COND_EQ, t4, 0, l_zero);
+    tcg_gen_andi_tl(t2, t2, 0x1f);
+    tcg_gen_subfi_tl(t2, 32, t2);
+    tcg_gen_brcond_tl(TCG_COND_GE, t2, t4, l_xra_only);
+    tcg_gen_sub_tl(t2, t4, t2);
+    tcg_gen_subfi_tl(t3, 32, t2);
+    tcg_gen_shr_tl(t0, t0, t3);
+    tcg_gen_shl_tl(t1, t1, t2);
+    tcg_gen_or_tl(t0, t0, t1);
+    tcg_gen_br(l_extract);
+
+    gen_set_label(l_xra_only);
+    tcg_gen_sub_tl(t2, t2, t4);
+    tcg_gen_shr_tl(t0, t1, t2);
+    tcg_gen_br(l_extract);
+
+    /* unspecified behavior but matches tests on real hardware*/
+    gen_set_label(l_zero);
+    tcg_gen_movi_tl(t0, 0);
+    tcg_gen_br(l_done);
+
+    /* {XRa} = extract({tmp}, 0, rt) */
+    gen_set_label(l_extract);
+    tcg_gen_subfi_tl(t4, 32, t4);
+    tcg_gen_shl_tl(t0, t0, t4);
+    tcg_gen_shr_tl(t0, t0, t4);
+
+    gen_set_label(l_done);
+    gen_store_mxu_gpr(t0, XRa);
+}
+
 /*
  *  Q16SAT XRa, XRb, XRc
  *  Packs four 16-bit signed integers in XRb and XRc to
@@ -3695,6 +3860,30 @@ static void decode_opc_mxu__pool14(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool15(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 14, 2);
+
+    switch (opcode) {
+    case OPC_MXU_S32MUL:
+        gen_mxu_s32mul(ctx, false);
+        break;
+    case OPC_MXU_S32MULU:
+        gen_mxu_s32mul(ctx, true);
+        break;
+    case OPC_MXU_S32EXTR:
+        gen_mxu_s32extr(ctx);
+        break;
+    case OPC_MXU_S32EXTRV:
+        gen_mxu_s32extrv(ctx);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool16(DisasContext *ctx)
 {
     uint32_t opcode = extract32(ctx->opcode, 18, 3);
@@ -3884,6 +4073,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_S8SDI:
             gen_mxu_s8std(ctx, true);
             break;
+        case OPC_MXU__POOL15:
+            decode_opc_mxu__pool15(ctx);
+            break;
         case OPC_MXU__POOL16:
             decode_opc_mxu__pool16(ctx);
             break;

From 5925963476d65ce1a74651bbf48865977ff0c1b0 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:12 +0300
Subject: [PATCH 0693/1353] target/mips/mxu: Add S32ALN S32LUI insns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are part of pool16, see the grand opcode organization
tree on top of the file.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-24-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 122 +++++++++++++++++++++++++++++++-
 1 file changed, 121 insertions(+), 1 deletion(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 0704a8c7ff..4f07201fcc 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -492,7 +492,9 @@ enum {
  * MXU pool 16
  */
 enum {
+    OPC_MXU_S32ALN   = 0x01,
     OPC_MXU_S32ALNI  = 0x02,
+    OPC_MXU_S32LUI   = 0x03,
     OPC_MXU_S32NOR   = 0x04,
     OPC_MXU_S32AND   = 0x05,
     OPC_MXU_S32OR    = 0x06,
@@ -3066,7 +3068,7 @@ static void gen_mxu_d32asum(DisasContext *ctx)
  *                 MXU instruction category: Miscellaneous
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  *
- *               S32EXTR
+ *               S32EXTR      S32LUI
  *               S32EXTRV
  *                            Q16SAT
  */
@@ -3182,6 +3184,59 @@ static void gen_mxu_s32extrv(DisasContext *ctx)
     gen_store_mxu_gpr(t0, XRa);
 }
 
+/*
+ *  S32LUI XRa, S8, optn3
+ *    Permutate the immediate S8 value to form a word
+ *    to update XRa.
+ */
+static void gen_mxu_s32lui(DisasContext *ctx)
+{
+    uint32_t XRa, s8, optn3, pad;
+
+    XRa   = extract32(ctx->opcode,  6, 4);
+    s8    = extract32(ctx->opcode, 10, 8);
+    pad   = extract32(ctx->opcode, 21, 2);
+    optn3 = extract32(ctx->opcode, 23, 3);
+
+    if (unlikely(pad != 0)) {
+        /* opcode padding incorrect -> do nothing */
+    } else if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else {
+        uint32_t s16;
+        TCGv t0 = tcg_temp_new();
+
+        switch (optn3) {
+        case 0:
+            tcg_gen_movi_tl(t0, s8);
+            break;
+        case 1:
+            tcg_gen_movi_tl(t0, s8 << 8);
+            break;
+        case 2:
+            tcg_gen_movi_tl(t0, s8 << 16);
+            break;
+        case 3:
+            tcg_gen_movi_tl(t0, s8 << 24);
+            break;
+        case 4:
+            tcg_gen_movi_tl(t0, (s8 << 16) | s8);
+            break;
+        case 5:
+            tcg_gen_movi_tl(t0, (s8 << 24) | (s8 << 8));
+            break;
+        case 6:
+            s16 = (uint16_t)(int16_t)(int8_t)s8;
+            tcg_gen_movi_tl(t0, (s16 << 16) | s16);
+            break;
+        case 7:
+            tcg_gen_movi_tl(t0, (s8 << 24) | (s8 << 16) | (s8 << 8) | s8);
+            break;
+        }
+        gen_store_mxu_gpr(t0, XRa);
+    }
+}
+
 /*
  *  Q16SAT XRa, XRb, XRc
  *  Packs four 16-bit signed integers in XRb and XRc to
@@ -3461,6 +3516,65 @@ static void gen_mxu_S32ALNI(DisasContext *ctx)
     }
 }
 
+/*
+ *  S32ALN XRc, XRb, XRa, rs
+ *    Arrange bytes from XRb and XRc according to one of five sets of
+ *    rules determined by rs[2:0], and place the result in XRa.
+ */
+static void gen_mxu_S32ALN(DisasContext *ctx)
+{
+    uint32_t rs, XRc, XRb, XRa;
+
+    rs  = extract32(ctx->opcode, 21, 5);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else if (unlikely((XRb == 0) && (XRc == 0))) {
+        /* both operands zero registers -> just set destination to all 0s */
+        tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
+    } else {
+        /* the most general case */
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+        TCGv t3 = tcg_temp_new();
+        TCGLabel *l_exit = gen_new_label();
+        TCGLabel *l_b_only = gen_new_label();
+        TCGLabel *l_c_only = gen_new_label();
+
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        gen_load_gpr(t2, rs);
+        tcg_gen_andi_tl(t2, t2, 0x07);
+
+        /* do nothing for undefined cases */
+        tcg_gen_brcondi_tl(TCG_COND_GE, t2, 5, l_exit);
+
+        tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, l_b_only);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 4, l_c_only);
+
+        tcg_gen_shli_tl(t2, t2, 3);
+        tcg_gen_subfi_tl(t3, 32, t2);
+
+        tcg_gen_shl_tl(t0, t0, t2);
+        tcg_gen_shr_tl(t1, t1, t3);
+        tcg_gen_or_tl(mxu_gpr[XRa - 1], t0, t1);
+        tcg_gen_br(l_exit);
+
+        gen_set_label(l_b_only);
+        gen_store_mxu_gpr(t0, XRa);
+        tcg_gen_br(l_exit);
+
+        gen_set_label(l_c_only);
+        gen_store_mxu_gpr(t1, XRa);
+
+        gen_set_label(l_exit);
+    }
+}
+
 /*
  *  S32MADD XRa, XRd, rb, rc
  *    32 to 64 bit signed multiply with subsequent add
@@ -3889,9 +4003,15 @@ static void decode_opc_mxu__pool16(DisasContext *ctx)
     uint32_t opcode = extract32(ctx->opcode, 18, 3);
 
     switch (opcode) {
+    case OPC_MXU_S32ALN:
+        gen_mxu_S32ALN(ctx);
+        break;
     case OPC_MXU_S32ALNI:
         gen_mxu_S32ALNI(ctx);
         break;
+    case OPC_MXU_S32LUI:
+        gen_mxu_s32lui(ctx);
+        break;
     case OPC_MXU_S32NOR:
         gen_mxu_S32NOR(ctx);
         break;

From f900da7691db16b534d5b4abcab2fdb29673aaa9 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:13 +0300
Subject: [PATCH 0694/1353] target/mips/mxu: Add D32SARL D32SARW instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are dual 32-bit arithmetic shift right and
pack LSBs to 2x 16-bit into a MXU register.
The difference is the shift amount source: immediate or GP reg.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-25-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 59 +++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 4f07201fcc..36fb4232cd 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -394,6 +394,7 @@ enum {
     OPC_MXU_S16SDI   = 0x2D,
     OPC_MXU_S32M2I   = 0x2E,
     OPC_MXU_S32I2M   = 0x2F,
+    OPC_MXU_D32SARL  = 0x32,
     OPC_MXU__POOL19  = 0x38,
 };
 
@@ -492,6 +493,7 @@ enum {
  * MXU pool 16
  */
 enum {
+    OPC_MXU_D32SARW  = 0x00,
     OPC_MXU_S32ALN   = 0x01,
     OPC_MXU_S32ALNI  = 0x02,
     OPC_MXU_S32LUI   = 0x03,
@@ -1689,6 +1691,57 @@ static void gen_mxu_S32XOR(DisasContext *ctx)
     }
 }
 
+/*
+ *                 MXU instruction category: shift
+ *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *               D32SLL    D32SLR    D32SAR    D32SARL
+ *               D32SLLV   D32SLRV   D32SARV   D32SARW
+ *               Q16SLL    Q16SLR    Q16SAR
+ *               Q16SLLV   Q16SLRV   Q16SARV
+ */
+
+/*
+ *  D32SARL XRa, XRb, XRc, SFT4
+ *    Dual shift arithmetic right 32-bit integers in XRb and XRc
+ *    to SFT4 bits (0..15). Pack 16 LSBs of each into XRa.
+ *
+ *  D32SARW XRa, XRb, XRc, rb
+ *    Dual shift arithmetic right 32-bit integers in XRb and XRc
+ *    to rb[3:0] bits. Pack 16 LSBs of each into XRa.
+ */
+static void gen_mxu_d32sarl(DisasContext *ctx, bool sarw)
+{
+    uint32_t XRa, XRb, XRc, rb;
+
+    XRa = extract32(ctx->opcode,  6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+    rb  = extract32(ctx->opcode, 21, 5);
+
+    if (unlikely(XRa == 0)) {
+        /* destination is zero register -> do nothing */
+    } else {
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+        TCGv t2 = tcg_temp_new();
+
+        if (!sarw) {
+            /* Make SFT4 from rb field */
+            tcg_gen_movi_tl(t2, rb >> 1);
+        } else {
+            gen_load_gpr(t2, rb);
+            tcg_gen_andi_tl(t2, t2, 0x0f);
+        }
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        tcg_gen_sar_tl(t0, t0, t2);
+        tcg_gen_sar_tl(t1, t1, t2);
+        tcg_gen_extract_tl(t2, t1, 0, 16);
+        tcg_gen_deposit_tl(t2, t2, t0, 16, 16);
+        gen_store_mxu_gpr(t2, XRa);
+    }
+}
 
 /*
  *                   MXU instruction category max/min/avg
@@ -4003,6 +4056,9 @@ static void decode_opc_mxu__pool16(DisasContext *ctx)
     uint32_t opcode = extract32(ctx->opcode, 18, 3);
 
     switch (opcode) {
+    case OPC_MXU_D32SARW:
+        gen_mxu_d32sarl(ctx, true);
+        break;
     case OPC_MXU_S32ALN:
         gen_mxu_S32ALN(ctx);
         break;
@@ -4214,6 +4270,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_S16SDI:
             gen_mxu_s16std(ctx, true);
             break;
+        case OPC_MXU_D32SARL:
+            gen_mxu_d32sarl(ctx, false);
+            break;
         case OPC_MXU__POOL19:
             decode_opc_mxu__pool19(ctx);
             break;

From f1fb103822bf69e261ca0902cfa75ea9aca2a8b4 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:14 +0300
Subject: [PATCH 0695/1353] target/mips/mxu: Add D32SLL D32SLR D32SAR
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are same data shift in various directions, thus one
generation function is implemented for all three.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-26-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 55 +++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 36fb4232cd..79263e97c3 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -394,7 +394,10 @@ enum {
     OPC_MXU_S16SDI   = 0x2D,
     OPC_MXU_S32M2I   = 0x2E,
     OPC_MXU_S32I2M   = 0x2F,
+    OPC_MXU_D32SLL   = 0x30,
+    OPC_MXU_D32SLR   = 0x31,
     OPC_MXU_D32SARL  = 0x32,
+    OPC_MXU_D32SAR   = 0x33,
     OPC_MXU__POOL19  = 0x38,
 };
 
@@ -1701,6 +1704,49 @@ static void gen_mxu_S32XOR(DisasContext *ctx)
  *               Q16SLLV   Q16SLRV   Q16SARV
  */
 
+/*
+ *  D32SLL XRa, XRd, XRb, XRc, SFT4
+ *    Dual 32-bit shift left from XRb and XRc to SFT4
+ *    bits (0..15). Store to XRa and XRd respectively.
+ *  D32SLR XRa, XRd, XRb, XRc, SFT4
+ *    Dual 32-bit shift logic right from XRb and XRc
+ *    to SFT4 bits (0..15). Store to XRa and XRd respectively.
+ *  D32SAR XRa, XRd, XRb, XRc, SFT4
+ *    Dual 32-bit shift arithmetic right from XRb and XRc
+ *    to SFT4 bits (0..15). Store to XRa and XRd respectively.
+ */
+static void gen_mxu_d32sxx(DisasContext *ctx, bool right, bool arithmetic)
+{
+    uint32_t XRa, XRb, XRc, XRd, sft4;
+
+    XRa  = extract32(ctx->opcode,  6, 4);
+    XRb  = extract32(ctx->opcode, 10, 4);
+    XRc  = extract32(ctx->opcode, 14, 4);
+    XRd  = extract32(ctx->opcode, 18, 4);
+    sft4 = extract32(ctx->opcode, 22, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t0, XRb);
+    gen_load_mxu_gpr(t1, XRc);
+
+    if (right) {
+        if (arithmetic) {
+            tcg_gen_sari_tl(t0, t0, sft4);
+            tcg_gen_sari_tl(t1, t1, sft4);
+        } else {
+            tcg_gen_shri_tl(t0, t0, sft4);
+            tcg_gen_shri_tl(t1, t1, sft4);
+        }
+    } else {
+        tcg_gen_shli_tl(t0, t0, sft4);
+        tcg_gen_shli_tl(t1, t1, sft4);
+    }
+    gen_store_mxu_gpr(t0, XRa);
+    gen_store_mxu_gpr(t1, XRd);
+}
+
 /*
  *  D32SARL XRa, XRb, XRc, SFT4
  *    Dual shift arithmetic right 32-bit integers in XRb and XRc
@@ -4270,9 +4316,18 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_S16SDI:
             gen_mxu_s16std(ctx, true);
             break;
+        case OPC_MXU_D32SLL:
+            gen_mxu_d32sxx(ctx, false, false);
+            break;
+        case OPC_MXU_D32SLR:
+            gen_mxu_d32sxx(ctx, true, false);
+            break;
         case OPC_MXU_D32SARL:
             gen_mxu_d32sarl(ctx, false);
             break;
+        case OPC_MXU_D32SAR:
+            gen_mxu_d32sxx(ctx, true, true);
+            break;
         case OPC_MXU__POOL19:
             decode_opc_mxu__pool19(ctx);
             break;

From 52fe25d4452f8b5d8151ffe65f35da34b7fc237e Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:15 +0300
Subject: [PATCH 0696/1353] target/mips/mxu: Add Q16SLL Q16SLR Q16SAR
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are same data shift in various directions, thus one
generation function is implemented for all three.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-27-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 78 +++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 79263e97c3..672b0041b5 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -398,6 +398,9 @@ enum {
     OPC_MXU_D32SLR   = 0x31,
     OPC_MXU_D32SARL  = 0x32,
     OPC_MXU_D32SAR   = 0x33,
+    OPC_MXU_Q16SLL   = 0x34,
+    OPC_MXU_Q16SLR   = 0x35,
+    OPC_MXU_Q16SAR   = 0x37,
     OPC_MXU__POOL19  = 0x38,
 };
 
@@ -1789,6 +1792,72 @@ static void gen_mxu_d32sarl(DisasContext *ctx, bool sarw)
     }
 }
 
+/*
+ *  Q16SLL XRa, XRd, XRb, XRc, SFT4
+ *    Quad 16-bit shift left from XRb and XRc to SFT4
+ *    bits (0..15). Store to XRa and XRd respectively.
+ *  Q16SLR XRa, XRd, XRb, XRc, SFT4
+ *    Quad 16-bit shift logic right from XRb and XRc
+ *    to SFT4 bits (0..15). Store to XRa and XRd respectively.
+ *  Q16SAR XRa, XRd, XRb, XRc, SFT4
+ *    Quad 16-bit shift arithmetic right from XRb and XRc
+ *    to SFT4 bits (0..15). Store to XRa and XRd respectively.
+ */
+static void gen_mxu_q16sxx(DisasContext *ctx, bool right, bool arithmetic)
+{
+    uint32_t XRa, XRb, XRc, XRd, sft4;
+
+    XRa  = extract32(ctx->opcode,  6, 4);
+    XRb  = extract32(ctx->opcode, 10, 4);
+    XRc  = extract32(ctx->opcode, 14, 4);
+    XRd  = extract32(ctx->opcode, 18, 4);
+    sft4 = extract32(ctx->opcode, 22, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t0, XRb);
+    gen_load_mxu_gpr(t2, XRc);
+
+    if (arithmetic) {
+        tcg_gen_sextract_tl(t1, t0, 16, 16);
+        tcg_gen_sextract_tl(t0, t0,  0, 16);
+        tcg_gen_sextract_tl(t3, t2, 16, 16);
+        tcg_gen_sextract_tl(t2, t2,  0, 16);
+    } else {
+        tcg_gen_extract_tl(t1, t0, 16, 16);
+        tcg_gen_extract_tl(t0, t0,  0, 16);
+        tcg_gen_extract_tl(t3, t2, 16, 16);
+        tcg_gen_extract_tl(t2, t2,  0, 16);
+    }
+
+    if (right) {
+        if (arithmetic) {
+            tcg_gen_sari_tl(t0, t0, sft4);
+            tcg_gen_sari_tl(t1, t1, sft4);
+            tcg_gen_sari_tl(t2, t2, sft4);
+            tcg_gen_sari_tl(t3, t3, sft4);
+        } else {
+            tcg_gen_shri_tl(t0, t0, sft4);
+            tcg_gen_shri_tl(t1, t1, sft4);
+            tcg_gen_shri_tl(t2, t2, sft4);
+            tcg_gen_shri_tl(t3, t3, sft4);
+        }
+    } else {
+        tcg_gen_shli_tl(t0, t0, sft4);
+        tcg_gen_shli_tl(t1, t1, sft4);
+        tcg_gen_shli_tl(t2, t2, sft4);
+        tcg_gen_shli_tl(t3, t3, sft4);
+    }
+    tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
+    tcg_gen_deposit_tl(t2, t2, t3, 16, 16);
+
+    gen_store_mxu_gpr(t0, XRa);
+    gen_store_mxu_gpr(t2, XRd);
+}
+
 /*
  *                   MXU instruction category max/min/avg
  *                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -4328,6 +4397,15 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_D32SAR:
             gen_mxu_d32sxx(ctx, true, true);
             break;
+        case OPC_MXU_Q16SLL:
+            gen_mxu_q16sxx(ctx, false, false);
+            break;
+        case OPC_MXU_Q16SLR:
+            gen_mxu_q16sxx(ctx, true, false);
+            break;
+        case OPC_MXU_Q16SAR:
+            gen_mxu_q16sxx(ctx, true, true);
+            break;
         case OPC_MXU__POOL19:
             decode_opc_mxu__pool19(ctx);
             break;

From 07c92895d758a9d2f77d555b92ae18149c14680d Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:16 +0300
Subject: [PATCH 0697/1353] target/mips/mxu: Add D32/Q16- SLLV/SLRV/SARV
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are counterparts for D32/Q16-SLL/SLR/SAR with
difference that the shift amount placed into GPR.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-28-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 166 +++++++++++++++++++++++++++++++-
 1 file changed, 162 insertions(+), 4 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 672b0041b5..32fc236d87 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -318,10 +318,10 @@
  *          ├─ 110001 ─ OPC_MXU_D32SLR      20..18
  *          ├─ 110010 ─ OPC_MXU_D32SARL  ┌─ 000 ─ OPC_MXU_D32SLLV
  *          ├─ 110011 ─ OPC_MXU_D32SAR   ├─ 001 ─ OPC_MXU_D32SLRV
- *          ├─ 110100 ─ OPC_MXU_Q16SLL   ├─ 010 ─ OPC_MXU_D32SARV
- *          ├─ 110101 ─ OPC_MXU_Q16SLR   ├─ 011 ─ OPC_MXU_Q16SLLV
- *          │                            ├─ 100 ─ OPC_MXU_Q16SLRV
- *          ├─ 110110 ─ OPC_MXU__POOL18 ─┴─ 101 ─ OPC_MXU_Q16SARV
+ *          ├─ 110100 ─ OPC_MXU_Q16SLL   ├─ 011 ─ OPC_MXU_D32SARV
+ *          ├─ 110101 ─ OPC_MXU_Q16SLR   ├─ 100 ─ OPC_MXU_Q16SLLV
+ *          │                            ├─ 101 ─ OPC_MXU_Q16SLRV
+ *          ├─ 110110 ─ OPC_MXU__POOL18 ─┴─ 111 ─ OPC_MXU_Q16SARV
  *          │
  *          ├─ 110111 ─ OPC_MXU_Q16SAR
  *          │                               23..22
@@ -400,6 +400,7 @@ enum {
     OPC_MXU_D32SAR   = 0x33,
     OPC_MXU_Q16SLL   = 0x34,
     OPC_MXU_Q16SLR   = 0x35,
+    OPC_MXU__POOL18  = 0x36,
     OPC_MXU_Q16SAR   = 0x37,
     OPC_MXU__POOL19  = 0x38,
 };
@@ -520,6 +521,18 @@ enum {
     OPC_MXU_LXHU     = 0x05,
 };
 
+/*
+ * MXU pool 18
+ */
+enum {
+    OPC_MXU_D32SLLV  = 0x00,
+    OPC_MXU_D32SLRV  = 0x01,
+    OPC_MXU_D32SARV  = 0x03,
+    OPC_MXU_Q16SLLV  = 0x04,
+    OPC_MXU_Q16SLRV  = 0x05,
+    OPC_MXU_Q16SARV  = 0x07,
+};
+
 /*
  * MXU pool 19
  */
@@ -1750,6 +1763,50 @@ static void gen_mxu_d32sxx(DisasContext *ctx, bool right, bool arithmetic)
     gen_store_mxu_gpr(t1, XRd);
 }
 
+/*
+ *  D32SLLV XRa, XRd, rs
+ *    Dual 32-bit shift left from XRa and XRd to rs[3:0]
+ *    bits. Store back to XRa and XRd respectively.
+ *  D32SLRV XRa, XRd, rs
+ *    Dual 32-bit shift logic right from XRa and XRd to rs[3:0]
+ *    bits. Store back to XRa and XRd respectively.
+ *  D32SARV XRa, XRd, rs
+ *    Dual 32-bit shift arithmetic right from XRa and XRd to rs[3:0]
+ *    bits. Store back to XRa and XRd respectively.
+ */
+static void gen_mxu_d32sxxv(DisasContext *ctx, bool right, bool arithmetic)
+{
+    uint32_t XRa, XRd, rs;
+
+    XRa = extract32(ctx->opcode, 10, 4);
+    XRd = extract32(ctx->opcode, 14, 4);
+    rs  = extract32(ctx->opcode, 21, 5);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t0, XRa);
+    gen_load_mxu_gpr(t1, XRd);
+    gen_load_gpr(t2, rs);
+    tcg_gen_andi_tl(t2, t2, 0x0f);
+
+    if (right) {
+        if (arithmetic) {
+            tcg_gen_sar_tl(t0, t0, t2);
+            tcg_gen_sar_tl(t1, t1, t2);
+        } else {
+            tcg_gen_shr_tl(t0, t0, t2);
+            tcg_gen_shr_tl(t1, t1, t2);
+        }
+    } else {
+        tcg_gen_shl_tl(t0, t0, t2);
+        tcg_gen_shl_tl(t1, t1, t2);
+    }
+    gen_store_mxu_gpr(t0, XRa);
+    gen_store_mxu_gpr(t1, XRd);
+}
+
 /*
  *  D32SARL XRa, XRb, XRc, SFT4
  *    Dual shift arithmetic right 32-bit integers in XRb and XRc
@@ -1858,6 +1915,74 @@ static void gen_mxu_q16sxx(DisasContext *ctx, bool right, bool arithmetic)
     gen_store_mxu_gpr(t2, XRd);
 }
 
+/*
+ *  Q16SLLV XRa, XRd, rs
+ *    Quad 16-bit shift left from XRa and XRd to rs[3:0]
+ *    bits. Store to XRa and XRd respectively.
+ *  Q16SLRV XRa, XRd, rs
+ *    Quad 16-bit shift logic right from XRa and XRd to rs[3:0]
+ *    bits. Store to XRa and XRd respectively.
+ *  Q16SARV XRa, XRd, rs
+ *    Quad 16-bit shift arithmetic right from XRa and XRd to rs[3:0]
+ *    bits. Store to XRa and XRd respectively.
+ */
+static void gen_mxu_q16sxxv(DisasContext *ctx, bool right, bool arithmetic)
+{
+    uint32_t XRa, XRd, rs;
+
+    XRa = extract32(ctx->opcode, 10, 4);
+    XRd = extract32(ctx->opcode, 14, 4);
+    rs  = extract32(ctx->opcode, 21, 5);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGv t5 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t0, XRa);
+    gen_load_mxu_gpr(t2, XRd);
+    gen_load_gpr(t5, rs);
+    tcg_gen_andi_tl(t5, t5, 0x0f);
+
+
+    if (arithmetic) {
+        tcg_gen_sextract_tl(t1, t0, 16, 16);
+        tcg_gen_sextract_tl(t0, t0,  0, 16);
+        tcg_gen_sextract_tl(t3, t2, 16, 16);
+        tcg_gen_sextract_tl(t2, t2,  0, 16);
+    } else {
+        tcg_gen_extract_tl(t1, t0, 16, 16);
+        tcg_gen_extract_tl(t0, t0,  0, 16);
+        tcg_gen_extract_tl(t3, t2, 16, 16);
+        tcg_gen_extract_tl(t2, t2,  0, 16);
+    }
+
+    if (right) {
+        if (arithmetic) {
+            tcg_gen_sar_tl(t0, t0, t5);
+            tcg_gen_sar_tl(t1, t1, t5);
+            tcg_gen_sar_tl(t2, t2, t5);
+            tcg_gen_sar_tl(t3, t3, t5);
+        } else {
+            tcg_gen_shr_tl(t0, t0, t5);
+            tcg_gen_shr_tl(t1, t1, t5);
+            tcg_gen_shr_tl(t2, t2, t5);
+            tcg_gen_shr_tl(t3, t3, t5);
+        }
+    } else {
+        tcg_gen_shl_tl(t0, t0, t5);
+        tcg_gen_shl_tl(t1, t1, t5);
+        tcg_gen_shl_tl(t2, t2, t5);
+        tcg_gen_shl_tl(t3, t3, t5);
+    }
+    tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
+    tcg_gen_deposit_tl(t2, t2, t3, 16, 16);
+
+    gen_store_mxu_gpr(t0, XRa);
+    gen_store_mxu_gpr(t2, XRd);
+}
+
 /*
  *                   MXU instruction category max/min/avg
  *                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -4236,6 +4361,36 @@ static void decode_opc_mxu__pool17(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool18(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 18, 3);
+
+    switch (opcode) {
+    case OPC_MXU_D32SLLV:
+        gen_mxu_d32sxxv(ctx, false, false);
+        break;
+    case OPC_MXU_D32SLRV:
+        gen_mxu_d32sxxv(ctx, true, false);
+        break;
+    case OPC_MXU_D32SARV:
+        gen_mxu_d32sxxv(ctx, true, true);
+        break;
+    case OPC_MXU_Q16SLLV:
+        gen_mxu_q16sxxv(ctx, false, false);
+        break;
+    case OPC_MXU_Q16SLRV:
+        gen_mxu_q16sxxv(ctx, true, false);
+        break;
+    case OPC_MXU_Q16SARV:
+        gen_mxu_q16sxxv(ctx, true, true);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 static void decode_opc_mxu__pool19(DisasContext *ctx)
 {
     uint32_t opcode = extract32(ctx->opcode, 22, 2);
@@ -4400,6 +4555,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_Q16SLL:
             gen_mxu_q16sxx(ctx, false, false);
             break;
+        case OPC_MXU__POOL18:
+            decode_opc_mxu__pool18(ctx);
+            break;
         case OPC_MXU_Q16SLR:
             gen_mxu_q16sxx(ctx, true, false);
             break;

From d1b6ded4f72bab624e6366121443a5f0a856ceda Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:17 +0300
Subject: [PATCH 0698/1353] target/mips/mxu: Add S32/D16/Q8- MOVZ/MOVN
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions are:
- single 32-bit
- dual 16-bit packed
- quad 8-bit packed
conditional moves.
They are grouped in pool20 in the source code.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-29-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 188 ++++++++++++++++++++++++++++++++
 1 file changed, 188 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 32fc236d87..f8c3fdb103 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -403,6 +403,7 @@ enum {
     OPC_MXU__POOL18  = 0x36,
     OPC_MXU_Q16SAR   = 0x37,
     OPC_MXU__POOL19  = 0x38,
+    OPC_MXU__POOL20  = 0x39,
 };
 
 
@@ -541,6 +542,18 @@ enum {
     OPC_MXU_Q8MULSU  = 0x01,
 };
 
+/*
+ * MXU pool 20
+ */
+enum {
+    OPC_MXU_Q8MOVZ   = 0x00,
+    OPC_MXU_Q8MOVN   = 0x01,
+    OPC_MXU_D16MOVZ  = 0x02,
+    OPC_MXU_D16MOVN  = 0x03,
+    OPC_MXU_S32MOVZ  = 0x04,
+    OPC_MXU_S32MOVN  = 0x05,
+};
+
 /* MXU accumulate add/subtract 1-bit pattern 'aptn1' */
 #define MXU_APTN1_A    0
 #define MXU_APTN1_S    1
@@ -1993,6 +2006,8 @@ static void gen_mxu_q16sxxv(DisasContext *ctx, bool right, bool arithmetic)
  *                                           Q8SLTU
  *                                D16AVG     Q8AVG
  *                                D16AVGR    Q8AVGR
+ *                     S32MOVZ    D16MOVZ    Q8MOVZ
+ *                     S32MOVN    D16MOVN    Q8MOVN
  */
 
 /*
@@ -2491,6 +2506,146 @@ static void gen_mxu_q8avg(DisasContext *ctx, bool round45)
     }
 }
 
+/*
+ *  Q8MOVZ
+ *    Quadruple 8-bit packed conditional move where
+ *    XRb contains conditions, XRc what to move and
+ *    XRa is the destination.
+ *    a.k.a. if (XRb[0..3] == 0) { XRa[0..3] = XRc[0..3] }
+ *
+ *  Q8MOVN
+ *    Quadruple 8-bit packed conditional move where
+ *    XRb contains conditions, XRc what to move and
+ *    XRa is the destination.
+ *    a.k.a. if (XRb[0..3] != 0) { XRa[0..3] = XRc[0..3] }
+ */
+static void gen_mxu_q8movzn(DisasContext *ctx, TCGCond cond)
+{
+    uint32_t XRc, XRb, XRa;
+
+    XRa = extract32(ctx->opcode,  6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGLabel *l_quarterdone = gen_new_label();
+    TCGLabel *l_halfdone = gen_new_label();
+    TCGLabel *l_quarterrest = gen_new_label();
+    TCGLabel *l_done = gen_new_label();
+
+    gen_load_mxu_gpr(t0, XRc);
+    gen_load_mxu_gpr(t1, XRb);
+    gen_load_mxu_gpr(t2, XRa);
+
+    tcg_gen_extract_tl(t3, t1, 24, 8);
+    tcg_gen_brcondi_tl(cond, t3, 0, l_quarterdone);
+    tcg_gen_extract_tl(t3, t0, 24, 8);
+    tcg_gen_deposit_tl(t2, t2, t3, 24, 8);
+
+    gen_set_label(l_quarterdone);
+    tcg_gen_extract_tl(t3, t1, 16, 8);
+    tcg_gen_brcondi_tl(cond, t3, 0, l_halfdone);
+    tcg_gen_extract_tl(t3, t0, 16, 8);
+    tcg_gen_deposit_tl(t2, t2, t3, 16, 8);
+
+    gen_set_label(l_halfdone);
+    tcg_gen_extract_tl(t3, t1, 8, 8);
+    tcg_gen_brcondi_tl(cond, t3, 0, l_quarterrest);
+    tcg_gen_extract_tl(t3, t0, 8, 8);
+    tcg_gen_deposit_tl(t2, t2, t3, 8, 8);
+
+    gen_set_label(l_quarterrest);
+    tcg_gen_extract_tl(t3, t1, 0, 8);
+    tcg_gen_brcondi_tl(cond, t3, 0, l_done);
+    tcg_gen_extract_tl(t3, t0, 0, 8);
+    tcg_gen_deposit_tl(t2, t2, t3, 0, 8);
+
+    gen_set_label(l_done);
+    gen_store_mxu_gpr(t2, XRa);
+}
+
+/*
+ *  D16MOVZ
+ *    Double 16-bit packed conditional move where
+ *    XRb contains conditions, XRc what to move and
+ *    XRa is the destination.
+ *    a.k.a. if (XRb[0..1] == 0) { XRa[0..1] = XRc[0..1] }
+ *
+ *  D16MOVN
+ *    Double 16-bit packed conditional move where
+ *    XRb contains conditions, XRc what to move and
+ *    XRa is the destination.
+ *    a.k.a. if (XRb[0..3] != 0) { XRa[0..1] = XRc[0..1] }
+ */
+static void gen_mxu_d16movzn(DisasContext *ctx, TCGCond cond)
+{
+    uint32_t XRc, XRb, XRa;
+
+    XRa = extract32(ctx->opcode,  6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGLabel *l_halfdone = gen_new_label();
+    TCGLabel *l_done = gen_new_label();
+
+    gen_load_mxu_gpr(t0, XRc);
+    gen_load_mxu_gpr(t1, XRb);
+    gen_load_mxu_gpr(t2, XRa);
+
+    tcg_gen_extract_tl(t3, t1, 16, 16);
+    tcg_gen_brcondi_tl(cond, t3, 0, l_halfdone);
+    tcg_gen_extract_tl(t3, t0, 16, 16);
+    tcg_gen_deposit_tl(t2, t2, t3, 16, 16);
+
+    gen_set_label(l_halfdone);
+    tcg_gen_extract_tl(t3, t1, 0, 16);
+    tcg_gen_brcondi_tl(cond, t3, 0, l_done);
+    tcg_gen_extract_tl(t3, t0, 0, 16);
+    tcg_gen_deposit_tl(t2, t2, t3, 0, 16);
+
+    gen_set_label(l_done);
+    gen_store_mxu_gpr(t2, XRa);
+}
+
+/*
+ *  S32MOVZ
+ *    Quadruple 32-bit conditional move where
+ *    XRb contains conditions, XRc what to move and
+ *    XRa is the destination.
+ *    a.k.a. if (XRb == 0) { XRa = XRc }
+ *
+ *  S32MOVN
+ *    Single 32-bit conditional move where
+ *    XRb contains conditions, XRc what to move and
+ *    XRa is the destination.
+ *    a.k.a. if (XRb != 0) { XRa = XRc }
+ */
+static void gen_mxu_s32movzn(DisasContext *ctx, TCGCond cond)
+{
+    uint32_t XRc, XRb, XRa;
+
+    XRa = extract32(ctx->opcode,  6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGLabel *l_done = gen_new_label();
+
+    gen_load_mxu_gpr(t0, XRc);
+    gen_load_mxu_gpr(t1, XRb);
+
+    tcg_gen_brcondi_tl(cond, t1, 0, l_done);
+    gen_store_mxu_gpr(t0, XRa);
+    gen_set_label(l_done);
+}
 
 /*
  *      MXU instruction category: Addition and subtraction
@@ -4407,6 +4562,36 @@ static void decode_opc_mxu__pool19(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool20(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 18, 3);
+
+    switch (opcode) {
+    case OPC_MXU_Q8MOVZ:
+        gen_mxu_q8movzn(ctx, TCG_COND_NE);
+        break;
+    case OPC_MXU_Q8MOVN:
+        gen_mxu_q8movzn(ctx, TCG_COND_EQ);
+        break;
+    case OPC_MXU_D16MOVZ:
+        gen_mxu_d16movzn(ctx, TCG_COND_NE);
+        break;
+    case OPC_MXU_D16MOVN:
+        gen_mxu_d16movzn(ctx, TCG_COND_EQ);
+        break;
+    case OPC_MXU_S32MOVZ:
+        gen_mxu_s32movzn(ctx, TCG_COND_NE);
+        break;
+    case OPC_MXU_S32MOVN:
+        gen_mxu_s32movzn(ctx, TCG_COND_EQ);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
 bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
 {
     uint32_t opcode = extract32(insn, 0, 6);
@@ -4567,6 +4752,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL19:
             decode_opc_mxu__pool19(ctx);
             break;
+        case OPC_MXU__POOL20:
+            decode_opc_mxu__pool20(ctx);
+            break;
         default:
             return false;
         }

From 7bb1206ab916bac96c029de850faf8d3bb1a08a2 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:18 +0300
Subject: [PATCH 0699/1353] target/mips/mxu: Add Q8MAC Q8MACSU instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These instructions do parallel quad 8-bit multiply and accumulate.
They are close to existing Q8MUL Q8MULSU so the generation
function modified to support all of them.
Also the patch fixes decoding of Q8MULSU according to tests on
hardware.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-30-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 128 +++++++++++++++++++++-----------
 1 file changed, 86 insertions(+), 42 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index f8c3fdb103..6a82849ef7 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -326,7 +326,7 @@
  *          ├─ 110111 ─ OPC_MXU_Q16SAR
  *          │                               23..22
  *          ├─ 111000 ─ OPC_MXU__POOL19 ─┬─ 00 ─ OPC_MXU_Q8MUL
- *          │                            └─ 01 ─ OPC_MXU_Q8MULSU
+ *          │                            └─ 10 ─ OPC_MXU_Q8MULSU
  *          │
  *          │                               20..18
  *          ├─ 111001 ─ OPC_MXU__POOL20 ─┬─ 000 ─ OPC_MXU_Q8MOVZ
@@ -404,6 +404,7 @@ enum {
     OPC_MXU_Q16SAR   = 0x37,
     OPC_MXU__POOL19  = 0x38,
     OPC_MXU__POOL20  = 0x39,
+    OPC_MXU__POOL21  = 0x3A,
 };
 
 
@@ -539,7 +540,7 @@ enum {
  */
 enum {
     OPC_MXU_Q8MUL    = 0x00,
-    OPC_MXU_Q8MULSU  = 0x01,
+    OPC_MXU_Q8MULSU  = 0x02,
 };
 
 /*
@@ -554,6 +555,15 @@ enum {
     OPC_MXU_S32MOVN  = 0x05,
 };
 
+/*
+ * MXU pool 21
+ */
+enum {
+    OPC_MXU_Q8MAC    = 0x00,
+    OPC_MXU_Q8MACSU  = 0x02,
+};
+
+
 /* MXU accumulate add/subtract 1-bit pattern 'aptn1' */
 #define MXU_APTN1_A    0
 #define MXU_APTN1_S    1
@@ -1328,13 +1338,17 @@ static void gen_mxu_s16mad(DisasContext *ctx)
 }
 
 /*
- * Q8MUL   XRa, XRb, XRc, XRd - Parallel unsigned 8 bit pattern multiply
- * Q8MULSU XRa, XRb, XRc, XRd - Parallel signed 8 bit pattern multiply
+ * Q8MUL   XRa, XRb, XRc, XRd - Parallel quad unsigned 8 bit multiply
+ * Q8MULSU XRa, XRb, XRc, XRd - Parallel quad signed 8 bit multiply
+ * Q8MAC   XRa, XRb, XRc, XRd - Parallel quad unsigned 8 bit multiply
+ *   and accumulate
+ * Q8MACSU XRa, XRb, XRc, XRd - Parallel quad signed 8 bit multiply
+ *   and accumulate
  */
-static void gen_mxu_q8mul_q8mulsu(DisasContext *ctx)
+static void gen_mxu_q8mul_mac(DisasContext *ctx, bool su, bool mac)
 {
     TCGv t0, t1, t2, t3, t4, t5, t6, t7;
-    uint32_t XRa, XRb, XRc, XRd, sel;
+    uint32_t XRa, XRb, XRc, XRd, aptn2;
 
     t0 = tcg_temp_new();
     t1 = tcg_temp_new();
@@ -1349,54 +1363,60 @@ static void gen_mxu_q8mul_q8mulsu(DisasContext *ctx)
     XRb = extract32(ctx->opcode, 10, 4);
     XRc = extract32(ctx->opcode, 14, 4);
     XRd = extract32(ctx->opcode, 18, 4);
-    sel = extract32(ctx->opcode, 22, 2);
+    aptn2 = extract32(ctx->opcode, 24, 2);
 
     gen_load_mxu_gpr(t3, XRb);
     gen_load_mxu_gpr(t7, XRc);
 
-    if (sel == 0x2) {
-        /* Q8MULSU */
-        tcg_gen_ext8s_tl(t0, t3);
-        tcg_gen_shri_tl(t3, t3, 8);
-        tcg_gen_ext8s_tl(t1, t3);
-        tcg_gen_shri_tl(t3, t3, 8);
-        tcg_gen_ext8s_tl(t2, t3);
-        tcg_gen_shri_tl(t3, t3, 8);
-        tcg_gen_ext8s_tl(t3, t3);
+    if (su) {
+        /* Q8MULSU / Q8MACSU */
+        tcg_gen_sextract_tl(t0, t3,  0, 8);
+        tcg_gen_sextract_tl(t1, t3,  8, 8);
+        tcg_gen_sextract_tl(t2, t3, 16, 8);
+        tcg_gen_sextract_tl(t3, t3, 24, 8);
     } else {
-        /* Q8MUL */
-        tcg_gen_ext8u_tl(t0, t3);
-        tcg_gen_shri_tl(t3, t3, 8);
-        tcg_gen_ext8u_tl(t1, t3);
-        tcg_gen_shri_tl(t3, t3, 8);
-        tcg_gen_ext8u_tl(t2, t3);
-        tcg_gen_shri_tl(t3, t3, 8);
-        tcg_gen_ext8u_tl(t3, t3);
+        /* Q8MUL / Q8MAC */
+        tcg_gen_extract_tl(t0, t3,  0, 8);
+        tcg_gen_extract_tl(t1, t3,  8, 8);
+        tcg_gen_extract_tl(t2, t3, 16, 8);
+        tcg_gen_extract_tl(t3, t3, 24, 8);
     }
 
-    tcg_gen_ext8u_tl(t4, t7);
-    tcg_gen_shri_tl(t7, t7, 8);
-    tcg_gen_ext8u_tl(t5, t7);
-    tcg_gen_shri_tl(t7, t7, 8);
-    tcg_gen_ext8u_tl(t6, t7);
-    tcg_gen_shri_tl(t7, t7, 8);
-    tcg_gen_ext8u_tl(t7, t7);
+    tcg_gen_extract_tl(t4, t7,  0, 8);
+    tcg_gen_extract_tl(t5, t7,  8, 8);
+    tcg_gen_extract_tl(t6, t7, 16, 8);
+    tcg_gen_extract_tl(t7, t7, 24, 8);
 
     tcg_gen_mul_tl(t0, t0, t4);
     tcg_gen_mul_tl(t1, t1, t5);
     tcg_gen_mul_tl(t2, t2, t6);
     tcg_gen_mul_tl(t3, t3, t7);
 
-    tcg_gen_andi_tl(t0, t0, 0xFFFF);
-    tcg_gen_andi_tl(t1, t1, 0xFFFF);
-    tcg_gen_andi_tl(t2, t2, 0xFFFF);
-    tcg_gen_andi_tl(t3, t3, 0xFFFF);
+    if (mac) {
+        gen_load_mxu_gpr(t4, XRd);
+        gen_load_mxu_gpr(t5, XRa);
+        tcg_gen_extract_tl(t6, t4,  0, 16);
+        tcg_gen_extract_tl(t7, t4, 16, 16);
+        if (aptn2 & 1) {
+            tcg_gen_sub_tl(t0, t6, t0);
+            tcg_gen_sub_tl(t1, t7, t1);
+        } else {
+            tcg_gen_add_tl(t0, t6, t0);
+            tcg_gen_add_tl(t1, t7, t1);
+        }
+        tcg_gen_extract_tl(t6, t5,  0, 16);
+        tcg_gen_extract_tl(t7, t5, 16, 16);
+        if (aptn2 & 2) {
+            tcg_gen_sub_tl(t2, t6, t2);
+            tcg_gen_sub_tl(t3, t7, t3);
+        } else {
+            tcg_gen_add_tl(t2, t6, t2);
+            tcg_gen_add_tl(t3, t7, t3);
+        }
+    }
 
-    tcg_gen_shli_tl(t1, t1, 16);
-    tcg_gen_shli_tl(t3, t3, 16);
-
-    tcg_gen_or_tl(t0, t0, t1);
-    tcg_gen_or_tl(t1, t2, t3);
+    tcg_gen_deposit_tl(t0, t0, t1, 16, 16);
+    tcg_gen_deposit_tl(t1, t2, t3, 16, 16);
 
     gen_store_mxu_gpr(t0, XRd);
     gen_store_mxu_gpr(t1, XRa);
@@ -4548,12 +4568,14 @@ static void decode_opc_mxu__pool18(DisasContext *ctx)
 
 static void decode_opc_mxu__pool19(DisasContext *ctx)
 {
-    uint32_t opcode = extract32(ctx->opcode, 22, 2);
+    uint32_t opcode = extract32(ctx->opcode, 22, 4);
 
     switch (opcode) {
     case OPC_MXU_Q8MUL:
+        gen_mxu_q8mul_mac(ctx, false, false);
+        break;
     case OPC_MXU_Q8MULSU:
-        gen_mxu_q8mul_q8mulsu(ctx);
+        gen_mxu_q8mul_mac(ctx, true, false);
         break;
     default:
         MIPS_INVAL("decode_opc_mxu");
@@ -4592,6 +4614,25 @@ static void decode_opc_mxu__pool20(DisasContext *ctx)
     }
 }
 
+static void decode_opc_mxu__pool21(DisasContext *ctx)
+{
+    uint32_t opcode = extract32(ctx->opcode, 22, 2);
+
+    switch (opcode) {
+    case OPC_MXU_Q8MAC:
+        gen_mxu_q8mul_mac(ctx, false, true);
+        break;
+    case OPC_MXU_Q8MACSU:
+        gen_mxu_q8mul_mac(ctx, true, true);
+        break;
+    default:
+        MIPS_INVAL("decode_opc_mxu");
+        gen_reserved_instruction(ctx);
+        break;
+    }
+}
+
+
 bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
 {
     uint32_t opcode = extract32(insn, 0, 6);
@@ -4755,6 +4796,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL20:
             decode_opc_mxu__pool20(ctx);
             break;
+        case OPC_MXU__POOL21:
+            decode_opc_mxu__pool21(ctx);
+            break;
         default:
             return false;
         }

From 68a48804cc0e84533f456a5a4bc48a1e96aeab99 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:19 +0300
Subject: [PATCH 0700/1353] target/mips/mxu: Add Q16SCOP instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction is used to determine sign of four 16-bit
packed data in parallel.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-31-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 85 +++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 6a82849ef7..6945dcb440 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -405,6 +405,7 @@ enum {
     OPC_MXU__POOL19  = 0x38,
     OPC_MXU__POOL20  = 0x39,
     OPC_MXU__POOL21  = 0x3A,
+    OPC_MXU_Q16SCOP  = 0x3B,
 };
 
 
@@ -3539,6 +3540,7 @@ static void gen_mxu_d32asum(DisasContext *ctx)
  *               S32EXTR      S32LUI
  *               S32EXTRV
  *                            Q16SAT
+ *                            Q16SCOP
  */
 
 /*
@@ -3806,6 +3808,86 @@ static void gen_mxu_Q16SAT(DisasContext *ctx)
     }
 }
 
+/*
+ *  Q16SCOP XRa, XRd, XRb, XRc
+ *    Determine sign of quad packed 16-bit signed values
+ *    in XRb and XRc put result in XRa and XRd respectively.
+ */
+static void gen_mxu_q16scop(DisasContext *ctx)
+{
+    uint32_t XRd, XRc, XRb, XRa;
+
+    XRd  = extract32(ctx->opcode, 18, 4);
+    XRc  = extract32(ctx->opcode, 14, 4);
+    XRb  = extract32(ctx->opcode, 10, 4);
+    XRa  = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGv t4 = tcg_temp_new();
+
+    TCGLabel *l_b_hi_lt = gen_new_label();
+    TCGLabel *l_b_hi_gt = gen_new_label();
+    TCGLabel *l_b_lo = gen_new_label();
+    TCGLabel *l_b_lo_lt = gen_new_label();
+    TCGLabel *l_c_hi = gen_new_label();
+    TCGLabel *l_c_hi_lt = gen_new_label();
+    TCGLabel *l_c_hi_gt = gen_new_label();
+    TCGLabel *l_c_lo = gen_new_label();
+    TCGLabel *l_c_lo_lt = gen_new_label();
+    TCGLabel *l_done = gen_new_label();
+
+    gen_load_mxu_gpr(t0, XRb);
+    gen_load_mxu_gpr(t1, XRc);
+
+    tcg_gen_sextract_tl(t2, t0, 16, 16);
+    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_b_hi_lt);
+    tcg_gen_brcondi_tl(TCG_COND_GT, t2, 0, l_b_hi_gt);
+    tcg_gen_movi_tl(t3, 0);
+    tcg_gen_br(l_b_lo);
+    gen_set_label(l_b_hi_lt);
+    tcg_gen_movi_tl(t3, 0xffff0000);
+    tcg_gen_br(l_b_lo);
+    gen_set_label(l_b_hi_gt);
+    tcg_gen_movi_tl(t3, 0x00010000);
+
+    gen_set_label(l_b_lo);
+    tcg_gen_sextract_tl(t2, t0, 0, 16);
+    tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, l_c_hi);
+    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_b_lo_lt);
+    tcg_gen_ori_tl(t3, t3, 0x00000001);
+    tcg_gen_br(l_c_hi);
+    gen_set_label(l_b_lo_lt);
+    tcg_gen_ori_tl(t3, t3, 0x0000ffff);
+    tcg_gen_br(l_c_hi);
+
+    gen_set_label(l_c_hi);
+    tcg_gen_sextract_tl(t2, t1, 16, 16);
+    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_c_hi_lt);
+    tcg_gen_brcondi_tl(TCG_COND_GT, t2, 0, l_c_hi_gt);
+    tcg_gen_movi_tl(t4, 0);
+    tcg_gen_br(l_c_lo);
+    gen_set_label(l_c_hi_lt);
+    tcg_gen_movi_tl(t4, 0xffff0000);
+    tcg_gen_br(l_c_lo);
+    gen_set_label(l_c_hi_gt);
+    tcg_gen_movi_tl(t4, 0x00010000);
+
+    gen_set_label(l_c_lo);
+    tcg_gen_sextract_tl(t2, t1, 0, 16);
+    tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, l_done);
+    tcg_gen_brcondi_tl(TCG_COND_LT, t2, 0, l_c_lo_lt);
+    tcg_gen_ori_tl(t4, t4, 0x00000001);
+    tcg_gen_br(l_done);
+    gen_set_label(l_c_lo_lt);
+    tcg_gen_ori_tl(t4, t4, 0x0000ffff);
+
+    gen_set_label(l_done);
+    gen_store_mxu_gpr(t3, XRa);
+    gen_store_mxu_gpr(t4, XRd);
+}
 
 /*
  *                 MXU instruction category: align
@@ -4799,6 +4881,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU__POOL21:
             decode_opc_mxu__pool21(ctx);
             break;
+        case OPC_MXU_Q16SCOP:
+            gen_mxu_q16scop(ctx);
+            break;
         default:
             return false;
         }

From b72e2b3a1fe42c7e0d086cd31bf52b0cd7780ca5 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:20 +0300
Subject: [PATCH 0701/1353] target/mips/mxu: Add Q8MADL instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction is used to parallel multiply and accumulate
four 8-bit data.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-32-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 75 +++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 6945dcb440..84c52c55d6 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -406,6 +406,7 @@ enum {
     OPC_MXU__POOL20  = 0x39,
     OPC_MXU__POOL21  = 0x3A,
     OPC_MXU_Q16SCOP  = 0x3B,
+    OPC_MXU_Q8MADL   = 0x3C,
 };
 
 
@@ -1423,6 +1424,77 @@ static void gen_mxu_q8mul_mac(DisasContext *ctx, bool su, bool mac)
     gen_store_mxu_gpr(t1, XRa);
 }
 
+/*
+ * Q8MADL  XRd, XRa, XRb, XRc
+ *   Parallel quad unsigned 8 bit multiply and accumulate.
+ *   e.g. XRd[0..3] = XRa[0..3] + XRb[0..3] * XRc[0..3]
+ */
+static void gen_mxu_q8madl(DisasContext *ctx)
+{
+    TCGv t0, t1, t2, t3, t4, t5, t6, t7;
+    uint32_t XRa, XRb, XRc, XRd, aptn2;
+
+    t0 = tcg_temp_new();
+    t1 = tcg_temp_new();
+    t2 = tcg_temp_new();
+    t3 = tcg_temp_new();
+    t4 = tcg_temp_new();
+    t5 = tcg_temp_new();
+    t6 = tcg_temp_new();
+    t7 = tcg_temp_new();
+
+    XRa = extract32(ctx->opcode, 6, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRd = extract32(ctx->opcode, 18, 4);
+    aptn2 = extract32(ctx->opcode, 24, 2);
+
+    gen_load_mxu_gpr(t3, XRb);
+    gen_load_mxu_gpr(t7, XRc);
+
+    tcg_gen_extract_tl(t0, t3,  0, 8);
+    tcg_gen_extract_tl(t1, t3,  8, 8);
+    tcg_gen_extract_tl(t2, t3, 16, 8);
+    tcg_gen_extract_tl(t3, t3, 24, 8);
+
+    tcg_gen_extract_tl(t4, t7,  0, 8);
+    tcg_gen_extract_tl(t5, t7,  8, 8);
+    tcg_gen_extract_tl(t6, t7, 16, 8);
+    tcg_gen_extract_tl(t7, t7, 24, 8);
+
+    tcg_gen_mul_tl(t0, t0, t4);
+    tcg_gen_mul_tl(t1, t1, t5);
+    tcg_gen_mul_tl(t2, t2, t6);
+    tcg_gen_mul_tl(t3, t3, t7);
+
+    gen_load_mxu_gpr(t4, XRa);
+    tcg_gen_extract_tl(t6, t4, 0, 8);
+    tcg_gen_extract_tl(t7, t4, 8, 8);
+    if (aptn2 & 1) {
+        tcg_gen_sub_tl(t0, t6, t0);
+        tcg_gen_sub_tl(t1, t7, t1);
+    } else {
+        tcg_gen_add_tl(t0, t6, t0);
+        tcg_gen_add_tl(t1, t7, t1);
+    }
+    tcg_gen_extract_tl(t6, t4, 16, 8);
+    tcg_gen_extract_tl(t7, t4, 24, 8);
+    if (aptn2 & 2) {
+        tcg_gen_sub_tl(t2, t6, t2);
+        tcg_gen_sub_tl(t3, t7, t3);
+    } else {
+        tcg_gen_add_tl(t2, t6, t2);
+        tcg_gen_add_tl(t3, t7, t3);
+    }
+
+    tcg_gen_andi_tl(t5, t0, 0xff);
+    tcg_gen_deposit_tl(t5, t5, t1,  8, 8);
+    tcg_gen_deposit_tl(t5, t5, t2, 16, 8);
+    tcg_gen_deposit_tl(t5, t5, t3, 24, 8);
+
+    gen_store_mxu_gpr(t5, XRd);
+}
+
 /*
  * S32LDD  XRa, Rb, S12 - Load a word from memory to XRF
  * S32LDDR XRa, Rb, S12 - Load a word from memory to XRF
@@ -4884,6 +4956,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_Q16SCOP:
             gen_mxu_q16scop(ctx);
             break;
+        case OPC_MXU_Q8MADL:
+            gen_mxu_q8madl(ctx);
+            break;
         default:
             return false;
         }

From 4b9680d3380525c75663c34071c039ae435ad285 Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:21 +0300
Subject: [PATCH 0702/1353] target/mips/mxu: Add S32SFL instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction shuffles 8 bytes in two registers by
one of 4 predefined patterns.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-33-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 81 +++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 84c52c55d6..c60404f739 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -407,6 +407,7 @@ enum {
     OPC_MXU__POOL21  = 0x3A,
     OPC_MXU_Q16SCOP  = 0x3B,
     OPC_MXU_Q8MADL   = 0x3C,
+    OPC_MXU_S32SFL   = 0x3D,
 };
 
 
@@ -3961,6 +3962,83 @@ static void gen_mxu_q16scop(DisasContext *ctx)
     gen_store_mxu_gpr(t4, XRd);
 }
 
+/*
+ *  S32SFL XRa, XRd, XRb, XRc
+ *    Shuffle bytes according to one of four patterns.
+ */
+static void gen_mxu_s32sfl(DisasContext *ctx)
+{
+    uint32_t XRd, XRc, XRb, XRa, ptn2;
+
+    XRd  = extract32(ctx->opcode, 18, 4);
+    XRc  = extract32(ctx->opcode, 14, 4);
+    XRb  = extract32(ctx->opcode, 10, 4);
+    XRa  = extract32(ctx->opcode,  6, 4);
+    ptn2 = extract32(ctx->opcode, 24, 2);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t0, XRb);
+    gen_load_mxu_gpr(t1, XRc);
+
+    switch (ptn2) {
+    case 0:
+        tcg_gen_andi_tl(t2, t0, 0xff000000);
+        tcg_gen_andi_tl(t3, t1, 0x000000ff);
+        tcg_gen_deposit_tl(t3, t3, t0,  8, 8);
+        tcg_gen_shri_tl(t0, t0,  8);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t3, t3, t0, 24, 8);
+        tcg_gen_deposit_tl(t3, t3, t1, 16, 8);
+        tcg_gen_shri_tl(t0, t0,  8);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t2, t2, t0,  8, 8);
+        tcg_gen_deposit_tl(t2, t2, t1,  0, 8);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t2, t2, t1, 16, 8);
+        break;
+    case 1:
+        tcg_gen_andi_tl(t2, t0, 0xff000000);
+        tcg_gen_andi_tl(t3, t1, 0x000000ff);
+        tcg_gen_deposit_tl(t3, t3, t0, 16, 8);
+        tcg_gen_shri_tl(t0, t0,  8);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t2, t2, t0, 16, 8);
+        tcg_gen_deposit_tl(t2, t2, t1,  0, 8);
+        tcg_gen_shri_tl(t0, t0,  8);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t3, t3, t0, 24, 8);
+        tcg_gen_deposit_tl(t3, t3, t1,  8, 8);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t2, t2, t1,  8, 8);
+        break;
+    case 2:
+        tcg_gen_andi_tl(t2, t0, 0xff00ff00);
+        tcg_gen_andi_tl(t3, t1, 0x00ff00ff);
+        tcg_gen_deposit_tl(t3, t3, t0,  8, 8);
+        tcg_gen_shri_tl(t0, t0, 16);
+        tcg_gen_shri_tl(t1, t1,  8);
+        tcg_gen_deposit_tl(t2, t2, t1,  0, 8);
+        tcg_gen_deposit_tl(t3, t3, t0, 24, 8);
+        tcg_gen_shri_tl(t1, t1, 16);
+        tcg_gen_deposit_tl(t2, t2, t1, 16, 8);
+        break;
+    case 3:
+        tcg_gen_andi_tl(t2, t0, 0xffff0000);
+        tcg_gen_andi_tl(t3, t1, 0x0000ffff);
+        tcg_gen_shri_tl(t1, t1, 16);
+        tcg_gen_deposit_tl(t2, t2, t1,  0, 16);
+        tcg_gen_deposit_tl(t3, t3, t0, 16, 16);
+        break;
+    }
+
+    gen_store_mxu_gpr(t2, XRa);
+    gen_store_mxu_gpr(t3, XRd);
+}
+
 /*
  *                 MXU instruction category: align
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -4959,6 +5037,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_Q8MADL:
             gen_mxu_q8madl(ctx);
             break;
+        case OPC_MXU_S32SFL:
+            gen_mxu_s32sfl(ctx);
+            break;
         default:
             return false;
         }

From 8aedfb64cdcfa60a077c66e802f6c65a419631de Mon Sep 17 00:00:00 2001
From: Siarhei Volkau <lis8215@gmail.com>
Date: Thu, 8 Jun 2023 13:42:22 +0300
Subject: [PATCH 0703/1353] target/mips/mxu: Add Q8SAD instruction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The instruction implements SAD (sum-absolute-difference) operation which
is used in motion estimation algorithms. The instruction handles four
8-bit data in parallel.

Signed-off-by: Siarhei Volkau <lis8215@gmail.com>
Message-Id: <20230608104222.1520143-34-lis8215@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 45 +++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index c60404f739..deb8060a17 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -408,6 +408,7 @@ enum {
     OPC_MXU_Q16SCOP  = 0x3B,
     OPC_MXU_Q8MADL   = 0x3C,
     OPC_MXU_S32SFL   = 0x3D,
+    OPC_MXU_Q8SAD    = 0x3E,
 };
 
 
@@ -4039,6 +4040,47 @@ static void gen_mxu_s32sfl(DisasContext *ctx)
     gen_store_mxu_gpr(t3, XRd);
 }
 
+/*
+ *  Q8SAD XRa, XRd, XRb, XRc
+ *    Typical SAD opration for motion estimation.
+ */
+static void gen_mxu_q8sad(DisasContext *ctx)
+{
+    uint32_t XRd, XRc, XRb, XRa;
+
+    XRd = extract32(ctx->opcode, 18, 4);
+    XRc = extract32(ctx->opcode, 14, 4);
+    XRb = extract32(ctx->opcode, 10, 4);
+    XRa = extract32(ctx->opcode,  6, 4);
+
+    TCGv t0 = tcg_temp_new();
+    TCGv t1 = tcg_temp_new();
+    TCGv t2 = tcg_temp_new();
+    TCGv t3 = tcg_temp_new();
+    TCGv t4 = tcg_temp_new();
+    TCGv t5 = tcg_temp_new();
+
+    gen_load_mxu_gpr(t2, XRb);
+    gen_load_mxu_gpr(t3, XRc);
+    gen_load_mxu_gpr(t5, XRd);
+    tcg_gen_movi_tl(t4, 0);
+
+    for (int i = 0; i < 4; i++) {
+        tcg_gen_andi_tl(t0, t2, 0xff);
+        tcg_gen_andi_tl(t1, t3, 0xff);
+        tcg_gen_sub_tl(t0, t0, t1);
+        tcg_gen_abs_tl(t0, t0);
+        tcg_gen_add_tl(t4, t4, t0);
+        if (i < 3) {
+            tcg_gen_shri_tl(t2, t2, 8);
+            tcg_gen_shri_tl(t3, t3, 8);
+        }
+    }
+    tcg_gen_add_tl(t5, t5, t4);
+    gen_store_mxu_gpr(t4, XRa);
+    gen_store_mxu_gpr(t5, XRd);
+}
+
 /*
  *                 MXU instruction category: align
  *                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -5040,6 +5082,9 @@ bool decode_ase_mxu(DisasContext *ctx, uint32_t insn)
         case OPC_MXU_S32SFL:
             gen_mxu_s32sfl(ctx);
             break;
+        case OPC_MXU_Q8SAD:
+            gen_mxu_q8sad(ctx);
+            break;
         default:
             return false;
         }

From baf21eebc3e1026d21d94fdf8ca470050e49968f Mon Sep 17 00:00:00 2001
From: Marcin Nowakowski <marcin.nowakowski@fungible.com>
Date: Fri, 30 Jun 2023 09:28:06 +0200
Subject: [PATCH 0704/1353] target/mips: enable GINVx support for I6400 and
 I6500
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GINVI and GINVT operations are supported on MIPS I6400 and I6500 cores,
so indicate that properly in CP0.Config5 register bits [16:15].

Cc: qemu-stable@nongnu.org
Signed-off-by: Marcin Nowakowski <marcin.nowakowski@fungible.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230630072806.3093704-1-marcin.nowakowski@fungible.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/cpu-defs.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/mips/cpu-defs.c.inc b/target/mips/cpu-defs.c.inc
index 05d9ec7125..03185d9aa0 100644
--- a/target/mips/cpu-defs.c.inc
+++ b/target/mips/cpu-defs.c.inc
@@ -755,7 +755,7 @@ const mips_def_t mips_defs[] =
         .CP0_Config4 = MIPS_CONFIG4 | (1U << CP0C4_M) | (3 << CP0C4_IE) |
                        (1 << CP0C4_AE) | (0xfc << CP0C4_KScrExist),
         .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_XNP) | (1 << CP0C5_VP) |
-                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP),
+                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP) | (3 << CP0C5_GI),
         .CP0_Config5_rw_bitmask = (1 << CP0C5_MSAEn) | (1 << CP0C5_SBRI) |
                                   (1 << CP0C5_FRE) | (1 << CP0C5_UFE),
         .CP0_LLAddr_rw_bitmask = 0,
@@ -795,7 +795,7 @@ const mips_def_t mips_defs[] =
         .CP0_Config4 = MIPS_CONFIG4 | (1U << CP0C4_M) | (3 << CP0C4_IE) |
                        (1 << CP0C4_AE) | (0xfc << CP0C4_KScrExist),
         .CP0_Config5 = MIPS_CONFIG5 | (1 << CP0C5_XNP) | (1 << CP0C5_VP) |
-                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP),
+                       (1 << CP0C5_LLB) | (1 << CP0C5_MRP) | (3 << CP0C5_GI),
         .CP0_Config5_rw_bitmask = (1 << CP0C5_MSAEn) | (1 << CP0C5_SBRI) |
                                   (1 << CP0C5_FRE) | (1 << CP0C5_UFE),
         .CP0_LLAddr_rw_bitmask = 0,

From e2b84ee41671edcaf975f88367f793e96e84b7c2 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:37 +0200
Subject: [PATCH 0705/1353] hw/ide/pci: Expose legacy interrupts as named GPIOs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Exposing the legacy IDE interrupts as GPIOs allows them to be connected in the
parent device through qdev_connect_gpio_out(), i.e. without accessing private
data of TYPE_PCI_IDE.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20230531211043.41724-2-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/pci.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index fc9224bbc9..9a5a7089d4 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -522,10 +522,19 @@ void bmdma_init(IDEBus *bus, BMDMAState *bm, PCIIDEState *d)
     bm->pci_dev = d;
 }
 
+static void pci_ide_init(Object *obj)
+{
+    PCIIDEState *d = PCI_IDE(obj);
+
+    qdev_init_gpio_out_named(DEVICE(d), d->isa_irq, "isa-irq",
+                             ARRAY_SIZE(d->isa_irq));
+}
+
 static const TypeInfo pci_ide_type_info = {
     .name = TYPE_PCI_IDE,
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIIDEState),
+    .instance_init = pci_ide_init,
     .abstract = true,
     .interfaces = (InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },

From 68eadfa2c6ee0ff357aaf674cc4cf0702393bcd1 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:38 +0200
Subject: [PATCH 0706/1353] hw/ide/via: Wire up IDE legacy interrupts in host
 device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves circular depencency between IDE function and south bridge.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20230531211043.41724-3-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/via.c      | 6 ++++--
 hw/isa/vt82c686.c | 5 +++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/ide/via.c b/hw/ide/via.c
index 177baea9a7..0caae52276 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -31,6 +31,7 @@
 #include "sysemu/dma.h"
 #include "hw/isa/vt82c686.h"
 #include "hw/ide/pci.h"
+#include "hw/irq.h"
 #include "trace.h"
 
 static uint64_t bmdma_read(void *opaque, hwaddr addr,
@@ -104,7 +105,8 @@ static void bmdma_setup_bar(PCIIDEState *d)
 
 static void via_ide_set_irq(void *opaque, int n, int level)
 {
-    PCIDevice *d = PCI_DEVICE(opaque);
+    PCIIDEState *s = opaque;
+    PCIDevice *d = PCI_DEVICE(s);
 
     if (level) {
         d->config[0x70 + n * 8] |= 0x80;
@@ -112,7 +114,7 @@ static void via_ide_set_irq(void *opaque, int n, int level)
         d->config[0x70 + n * 8] &= ~0x80;
     }
 
-    via_isa_set_irq(pci_get_function_0(d), 14 + n, level);
+    qemu_set_irq(s->isa_irq[n], level);
 }
 
 static void via_ide_reset(DeviceState *dev)
diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index ca89119ce0..8016c71315 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -692,6 +692,10 @@ static void via_isa_realize(PCIDevice *d, Error **errp)
     if (!qdev_realize(DEVICE(&s->ide), BUS(pci_bus), errp)) {
         return;
     }
+    for (i = 0; i < 2; i++) {
+        qdev_connect_gpio_out_named(DEVICE(&s->ide), "isa-irq", i,
+                                    s->isa_irqs_in[14 + i]);
+    }
 
     /* Functions 2-3: USB Ports */
     for (i = 0; i < ARRAY_SIZE(s->uhci); i++) {
@@ -814,6 +818,7 @@ static void vt8231_isa_reset(DeviceState *dev)
                  PCI_COMMAND_MASTER | PCI_COMMAND_SPECIAL);
     pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM);
 
+    pci_conf[0x4c] = 0x04; /* IDE interrupt Routing */
     pci_conf[0x58] = 0x40; /* Miscellaneous Control 0 */
     pci_conf[0x67] = 0x08; /* Fast IR Config */
     pci_conf[0x6b] = 0x01; /* Fast IR I/O Base */

From 4e5a20b6da9b1f6d2e9621ed7eb8b239560104ae Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:39 +0200
Subject: [PATCH 0707/1353] hw/isa/vt82c686: Remove via_isa_set_irq()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that via_isa_set_irq() is unused it can be removed.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20230531211043.41724-4-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/isa/vt82c686.c         | 6 ------
 include/hw/isa/vt82c686.h | 2 --
 2 files changed, 8 deletions(-)

diff --git a/hw/isa/vt82c686.c b/hw/isa/vt82c686.c
index 8016c71315..57bdfb4e78 100644
--- a/hw/isa/vt82c686.c
+++ b/hw/isa/vt82c686.c
@@ -592,12 +592,6 @@ static const TypeInfo via_isa_info = {
     },
 };
 
-void via_isa_set_irq(PCIDevice *d, int n, int level)
-{
-    ViaISAState *s = VIA_ISA(d);
-    qemu_set_irq(s->isa_irqs_in[n], level);
-}
-
 static void via_isa_request_i8259_irq(void *opaque, int irq, int level)
 {
     ViaISAState *s = opaque;
diff --git a/include/hw/isa/vt82c686.h b/include/hw/isa/vt82c686.h
index da1722daf2..b6e95b2851 100644
--- a/include/hw/isa/vt82c686.h
+++ b/include/hw/isa/vt82c686.h
@@ -34,6 +34,4 @@ struct ViaAC97State {
     uint32_t ac97_cmd;
 };
 
-void via_isa_set_irq(PCIDevice *d, int n, int level);
-
 #endif

From bf0576edd71cf4f70352cc8de1cc914b419b36ff Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:40 +0200
Subject: [PATCH 0708/1353] hw/ide: Extract IDEBus assignment into bmdma_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every invocation of bmdma_init() is followed by `d->bmdma[i].bus = &d->bus[i]`.
Resolve this redundancy by extracting it into bmdma_init().

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20230531211043.41724-5-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/cmd646.c  | 1 -
 hw/ide/pci.c     | 1 +
 hw/ide/piix.c    | 1 -
 hw/ide/sii3112.c | 1 -
 hw/ide/via.c     | 1 -
 5 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index a68357c1c5..a094a6e12a 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -297,7 +297,6 @@ static void pci_cmd646_ide_realize(PCIDevice *dev, Error **errp)
         ide_bus_init_output_irq(&d->bus[i], qdev_get_gpio_in(ds, i));
 
         bmdma_init(&d->bus[i], &d->bmdma[i], d);
-        d->bmdma[i].bus = &d->bus[i];
         ide_bus_register_restart_cb(&d->bus[i]);
     }
 }
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 9a5a7089d4..4cf1e9c679 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -519,6 +519,7 @@ void bmdma_init(IDEBus *bus, BMDMAState *bm, PCIIDEState *d)
     bus->dma = &bm->dma;
     bm->irq = bus->irq;
     bus->irq = qemu_allocate_irq(bmdma_irq, bm, 0);
+    bm->bus = bus;
     bm->pci_dev = d;
 }
 
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 41d60921e3..a32f7ccece 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -144,7 +144,6 @@ static bool pci_piix_init_bus(PCIIDEState *d, unsigned i, Error **errp)
     ide_bus_init_output_irq(&d->bus[i], isa_get_irq(NULL, port_info[i].isairq));
 
     bmdma_init(&d->bus[i], &d->bmdma[i], d);
-    d->bmdma[i].bus = &d->bus[i];
     ide_bus_register_restart_cb(&d->bus[i]);
 
     return true;
diff --git a/hw/ide/sii3112.c b/hw/ide/sii3112.c
index f9becdff8e..5dd3d03c29 100644
--- a/hw/ide/sii3112.c
+++ b/hw/ide/sii3112.c
@@ -287,7 +287,6 @@ static void sii3112_pci_realize(PCIDevice *dev, Error **errp)
         ide_bus_init_output_irq(&s->bus[i], qdev_get_gpio_in(ds, i));
 
         bmdma_init(&s->bus[i], &s->bmdma[i], s);
-        s->bmdma[i].bus = &s->bus[i];
         ide_bus_register_restart_cb(&s->bus[i]);
     }
 }
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 0caae52276..91253fa4ef 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -196,7 +196,6 @@ static void via_ide_realize(PCIDevice *dev, Error **errp)
         ide_bus_init_output_irq(&d->bus[i], qdev_get_gpio_in(ds, i));
 
         bmdma_init(&d->bus[i], &d->bmdma[i], d);
-        d->bmdma[i].bus = &d->bus[i];
         ide_bus_register_restart_cb(&d->bus[i]);
     }
 }

From 5fe24213f0c17c3050a7c9e95db459198e27de0e Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:41 +0200
Subject: [PATCH 0709/1353] hw/ide: Extract bmdma_status_writeb()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every TYPE_PCI_IDE device performs the same not-so-trivial bit manipulation by
copy'n'paste code. Extract this into bmdma_status_writeb(), mirroring
bmdma_cmd_writeb().

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-Id: <20230531211043.41724-6-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/cmd646.c      | 2 +-
 hw/ide/pci.c         | 5 +++++
 hw/ide/piix.c        | 2 +-
 hw/ide/sii3112.c     | 6 ++----
 hw/ide/via.c         | 2 +-
 include/hw/ide/pci.h | 1 +
 6 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/hw/ide/cmd646.c b/hw/ide/cmd646.c
index a094a6e12a..cabe9048b1 100644
--- a/hw/ide/cmd646.c
+++ b/hw/ide/cmd646.c
@@ -144,7 +144,7 @@ static void bmdma_write(void *opaque, hwaddr addr,
         cmd646_update_irq(pci_dev);
         break;
     case 2:
-        bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
+        bmdma_status_writeb(bm, val);
         break;
     case 3:
         if (bm == &bm->pci_dev->bmdma[0]) {
diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 4cf1e9c679..0b26a4ce9f 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -318,6 +318,11 @@ void bmdma_cmd_writeb(BMDMAState *bm, uint32_t val)
     bm->cmd = val & 0x09;
 }
 
+void bmdma_status_writeb(BMDMAState *bm, uint32_t val)
+{
+    bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
+}
+
 static uint64_t bmdma_addr_read(void *opaque, hwaddr addr,
                                 unsigned width)
 {
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index a32f7ccece..47e0b474c3 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -76,7 +76,7 @@ static void bmdma_write(void *opaque, hwaddr addr,
         bmdma_cmd_writeb(bm, val);
         break;
     case 2:
-        bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
+        bmdma_status_writeb(bm, val);
         break;
     }
 }
diff --git a/hw/ide/sii3112.c b/hw/ide/sii3112.c
index 5dd3d03c29..63dc4a0494 100644
--- a/hw/ide/sii3112.c
+++ b/hw/ide/sii3112.c
@@ -149,8 +149,7 @@ static void sii3112_reg_write(void *opaque, hwaddr addr,
         break;
     case 0x02:
     case 0x12:
-        d->i.bmdma[0].status = (val & 0x60) | (d->i.bmdma[0].status & 1) |
-                               (d->i.bmdma[0].status & ~val & 6);
+        bmdma_status_writeb(&d->i.bmdma[0], val);
         break;
     case 0x04 ... 0x07:
         bmdma_addr_ioport_ops.write(&d->i.bmdma[0], addr - 4, val, size);
@@ -165,8 +164,7 @@ static void sii3112_reg_write(void *opaque, hwaddr addr,
         break;
     case 0x0a:
     case 0x1a:
-        d->i.bmdma[1].status = (val & 0x60) | (d->i.bmdma[1].status & 1) |
-                               (d->i.bmdma[1].status & ~val & 6);
+        bmdma_status_writeb(&d->i.bmdma[1], val);
         break;
     case 0x0c ... 0x0f:
         bmdma_addr_ioport_ops.write(&d->i.bmdma[1], addr - 12, val, size);
diff --git a/hw/ide/via.c b/hw/ide/via.c
index 91253fa4ef..fff23803a6 100644
--- a/hw/ide/via.c
+++ b/hw/ide/via.c
@@ -75,7 +75,7 @@ static void bmdma_write(void *opaque, hwaddr addr,
         bmdma_cmd_writeb(bm, val);
         break;
     case 2:
-        bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
+        bmdma_status_writeb(bm, val);
         break;
     default:;
     }
diff --git a/include/hw/ide/pci.h b/include/hw/ide/pci.h
index 74c127e32f..1ff469de87 100644
--- a/include/hw/ide/pci.h
+++ b/include/hw/ide/pci.h
@@ -58,6 +58,7 @@ struct PCIIDEState {
 
 void bmdma_init(IDEBus *bus, BMDMAState *bm, PCIIDEState *d);
 void bmdma_cmd_writeb(BMDMAState *bm, uint32_t val);
+void bmdma_status_writeb(BMDMAState *bm, uint32_t val);
 extern MemoryRegionOps bmdma_addr_ioport_ops;
 void pci_ide_create_devs(PCIDevice *dev);
 

From 17d6a4a32589c54d16ecb27c5116c2e4aca1b742 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:42 +0200
Subject: [PATCH 0710/1353] hw/ide/pci: Replace some magic numbers by constants
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230531211043.41724-7-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ide/pci.c b/hw/ide/pci.c
index 0b26a4ce9f..a25b352537 100644
--- a/hw/ide/pci.c
+++ b/hw/ide/pci.c
@@ -320,7 +320,8 @@ void bmdma_cmd_writeb(BMDMAState *bm, uint32_t val)
 
 void bmdma_status_writeb(BMDMAState *bm, uint32_t val)
 {
-    bm->status = (val & 0x60) | (bm->status & 1) | (bm->status & ~val & 0x06);
+    bm->status = (val & 0x60) | (bm->status & BM_STATUS_DMAING)
+                 | (bm->status & ~val & (BM_STATUS_ERROR | BM_STATUS_INT));
 }
 
 static uint64_t bmdma_addr_read(void *opaque, hwaddr addr,

From 752dfff5ecf35a38145c2dfbb842224177fd1afd Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 31 May 2023 23:10:43 +0200
Subject: [PATCH 0711/1353] hw/ide/piix: Move registration of
 VMStateDescription to DeviceClass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The modern, declarative way to set up VM state handling is to assign to
DeviceClass::vmsd attribute.

There shouldn't be any change in behavior since dc->vmsd causes
vmstate_register_with_alias_id() to be called on the instance during
the instance init phase. vmstate_register() was also called during the
instance init phase which forwards to vmstate_register_with_alias_id()
internally. Checking the migration schema before and after this patch confirms:

before:
> qemu-system-x86_64 -S
> qemu > migrate -d exec:cat>before.mig

after:
> qemu-system-x86_64 -S
> qemu > migrate -d exec:cat>after.mig

> analyze-migration.py -d desc -f before.mig > before.json
> analyze-migration.py -d desc -f after.mig > after.json
> diff before.json after.json
-> empty

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230531211043.41724-8-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/piix.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 47e0b474c3..151f206046 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -28,7 +28,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "hw/pci/pci.h"
 #include "hw/ide/piix.h"
@@ -159,8 +158,6 @@ static void pci_piix_ide_realize(PCIDevice *dev, Error **errp)
     bmdma_setup_bar(d);
     pci_register_bar(dev, 4, PCI_BASE_ADDRESS_SPACE_IO, &d->bmdma_bar);
 
-    vmstate_register(VMSTATE_IF(dev), 0, &vmstate_ide_pci, d);
-
     for (unsigned i = 0; i < 2; i++) {
         if (!pci_piix_init_bus(d, i, errp)) {
             return;
@@ -186,6 +183,7 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
     dc->reset = piix_ide_reset;
+    dc->vmsd = &vmstate_ide_pci;
     k->realize = pci_piix_ide_realize;
     k->exit = pci_piix_ide_exitfn;
     k->vendor_id = PCI_VENDOR_ID_INTEL;
@@ -208,6 +206,7 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 
     dc->reset = piix_ide_reset;
+    dc->vmsd = &vmstate_ide_pci;
     k->realize = pci_piix_ide_realize;
     k->exit = pci_piix_ide_exitfn;
     k->vendor_id = PCI_VENDOR_ID_INTEL;

From c925f40a29906355b516bad4c6ef80d30cf971b6 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sat, 4 Mar 2023 12:40:43 +0100
Subject: [PATCH 0712/1353] hw/pci/pci: Remove multifunction parameter from
 pci_new_multifunction()

There is also pci_new() which creates non-multifunction PCI devices.
Accordingly the parameter is always set to true when a multi function PCI
device is to be created.

The reason for the parameter's existence seems to be that it is used in the
internal PCI code as well which is the only location where it gets set to
false. This one usage can be resolved by factoring out an internal helper
function.

Remove this redundant, error-prone parameter.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-Id: <20230304114043.121024-6-shentey@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc_q35.c     |  6 +++---
 hw/pci-host/sabre.c  |  6 ++----
 hw/pci/pci.c         | 13 +++++++++----
 hw/sparc64/sun4u.c   |  5 ++---
 include/hw/pci/pci.h |  3 +--
 5 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index fdab1f6a56..dc27a9e223 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -100,12 +100,12 @@ static int ehci_create_ich9_with_companions(PCIBus *bus, int slot)
         return -1;
     }
 
-    ehci = pci_new_multifunction(PCI_DEVFN(slot, 7), true, name);
+    ehci = pci_new_multifunction(PCI_DEVFN(slot, 7), name);
     pci_realize_and_unref(ehci, bus, &error_fatal);
     usbbus = QLIST_FIRST(&ehci->qdev.child_bus);
 
     for (i = 0; i < 3; i++) {
-        uhci = pci_new_multifunction(PCI_DEVFN(slot, comp[i].func), true,
+        uhci = pci_new_multifunction(PCI_DEVFN(slot, comp[i].func),
                                      comp[i].name);
         qdev_prop_set_string(&uhci->qdev, "masterbus", usbbus->name);
         qdev_prop_set_uint32(&uhci->qdev, "firstport", comp[i].port);
@@ -239,7 +239,7 @@ static void pc_q35_init(MachineState *machine)
     pcms->bus = host_bus;
 
     /* create ISA bus */
-    lpc = pci_new_multifunction(PCI_DEVFN(ICH9_LPC_DEV, ICH9_LPC_FUNC), true,
+    lpc = pci_new_multifunction(PCI_DEVFN(ICH9_LPC_DEV, ICH9_LPC_FUNC),
                                 TYPE_ICH9_LPC_DEVICE);
     qdev_prop_set_bit(DEVICE(lpc), "smm-enabled",
                       x86_machine_is_smm_enabled(x86ms));
diff --git a/hw/pci-host/sabre.c b/hw/pci-host/sabre.c
index 949ecc21f2..dcb2e230b6 100644
--- a/hw/pci-host/sabre.c
+++ b/hw/pci-host/sabre.c
@@ -387,14 +387,12 @@ static void sabre_realize(DeviceState *dev, Error **errp)
     pci_setup_iommu(phb->bus, sabre_pci_dma_iommu, s->iommu);
 
     /* APB secondary busses */
-    pci_dev = pci_new_multifunction(PCI_DEVFN(1, 0), true,
-                                    TYPE_SIMBA_PCI_BRIDGE);
+    pci_dev = pci_new_multifunction(PCI_DEVFN(1, 0), TYPE_SIMBA_PCI_BRIDGE);
     s->bridgeB = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(s->bridgeB, "pciB", pci_simbaB_map_irq);
     pci_realize_and_unref(pci_dev, phb->bus, &error_fatal);
 
-    pci_dev = pci_new_multifunction(PCI_DEVFN(1, 1), true,
-                                    TYPE_SIMBA_PCI_BRIDGE);
+    pci_dev = pci_new_multifunction(PCI_DEVFN(1, 1), TYPE_SIMBA_PCI_BRIDGE);
     s->bridgeA = PCI_BRIDGE(pci_dev);
     pci_bridge_map_irq(s->bridgeA, "pciA", pci_simbaA_map_irq);
     pci_realize_and_unref(pci_dev, phb->bus, &error_fatal);
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 5152989c10..fb17138f7d 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2164,8 +2164,8 @@ static void pci_qdev_realize(DeviceState *qdev, Error **errp)
     pci_dev->msi_trigger = pci_msi_trigger;
 }
 
-PCIDevice *pci_new_multifunction(int devfn, bool multifunction,
-                                 const char *name)
+static PCIDevice *pci_new_internal(int devfn, bool multifunction,
+                                   const char *name)
 {
     DeviceState *dev;
 
@@ -2175,9 +2175,14 @@ PCIDevice *pci_new_multifunction(int devfn, bool multifunction,
     return PCI_DEVICE(dev);
 }
 
+PCIDevice *pci_new_multifunction(int devfn, const char *name)
+{
+    return pci_new_internal(devfn, true, name);
+}
+
 PCIDevice *pci_new(int devfn, const char *name)
 {
-    return pci_new_multifunction(devfn, false, name);
+    return pci_new_internal(devfn, false, name);
 }
 
 bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp)
@@ -2188,7 +2193,7 @@ bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp)
 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
                                            const char *name)
 {
-    PCIDevice *dev = pci_new_multifunction(devfn, true, name);
+    PCIDevice *dev = pci_new_multifunction(devfn, name);
     pci_realize_and_unref(dev, bus, &error_fatal);
     return dev;
 }
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 29e9b6cc26..d908a38f73 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -612,7 +612,7 @@ static void sun4uv_init(MemoryRegion *address_space_mem,
     pci_bus_set_slot_reserved_mask(pci_busA, 0xfffffff1);
     pci_bus_set_slot_reserved_mask(pci_busB, 0xfffffff0);
 
-    ebus = pci_new_multifunction(PCI_DEVFN(1, 0), true, TYPE_EBUS);
+    ebus = pci_new_multifunction(PCI_DEVFN(1, 0), TYPE_EBUS);
     qdev_prop_set_uint64(DEVICE(ebus), "console-serial-base",
                          hwdef->console_serial_base);
     pci_realize_and_unref(ebus, pci_busA, &error_fatal);
@@ -648,8 +648,7 @@ static void sun4uv_init(MemoryRegion *address_space_mem,
 
         if (!nd->model || strcmp(nd->model, mc->default_nic) == 0) {
             if (!onboard_nic) {
-                pci_dev = pci_new_multifunction(PCI_DEVFN(1, 1),
-                                                   true, mc->default_nic);
+                pci_dev = pci_new_multifunction(PCI_DEVFN(1, 1), mc->default_nic);
                 bus = pci_busA;
                 memcpy(&macaddr, &nd->macaddr.a, sizeof(MACAddr));
                 onboard_nic = true;
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 18c35b64db..ab2bd65a3a 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -577,8 +577,7 @@ pci_set_quad_by_mask(uint8_t *config, uint64_t mask, uint64_t reg)
     pci_set_quad(config, (~mask & val) | (mask & rval));
 }
 
-PCIDevice *pci_new_multifunction(int devfn, bool multifunction,
-                                    const char *name);
+PCIDevice *pci_new_multifunction(int devfn, const char *name);
 PCIDevice *pci_new(int devfn, const char *name);
 bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp);
 

From 08f632848008544b7e1ab8a8aa50df02c39a26a1 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 11 Apr 2023 18:04:08 +0900
Subject: [PATCH 0713/1353] pcie: Release references of virtual functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pci_new() automatically retains a reference to a virtual function when
registering it so we need to release the reference when unregistering.

Fixes: 7c0fa8dff8 ("pcie: Add support for Single Root I/O Virtualization (SR/IOV)")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230411090408.48366-1-akihiko.odaki@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
---
 hw/pci/pcie_sriov.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index aa5a757b11..76a3b6917e 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -211,6 +211,7 @@ static void unregister_vfs(PCIDevice *dev)
             error_free(local_err);
         }
         object_unparent(OBJECT(vf));
+        object_unref(OBJECT(vf));
     }
     g_free(dev->exp.sriov_pf.vf);
     dev->exp.sriov_pf.vf = NULL;

From b479bc3c9d5e473553137641fd31069c251f0d6e Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Tue, 4 Jul 2023 11:34:33 +0800
Subject: [PATCH 0714/1353] vdpa: Return -EIO if device ack is VIRTIO_NET_ERR
 in _load_mac()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to VirtIO standard, "The class, command and
command-specific-data are set by the driver,
and the device sets the ack byte.
There is little it can do except issue a diagnostic
if ack is not VIRTIO_NET_OK."

Therefore, QEMU should stop sending the queued SVQ commands and
cancel the device startup if the device's ack is not VIRTIO_NET_OK.

Yet the problem is that, vhost_vdpa_net_load_mac() returns 1 based on
`*s->status != VIRTIO_NET_OK` when the device's ack is VIRTIO_NET_ERR.
As a result, net->nc->info->load() also returns 1, this makes
vhost_net_start_one() incorrectly assume the device state is
successfully loaded by vhost_vdpa_net_load() and return 0, instead of
goto `fail` label to cancel the device startup, as vhost_net_start_one()
only cancels the device startup when net->nc->info->load() returns a
negative value.

This patch fixes this problem by returning -EIO when the device's
ack is not VIRTIO_NET_OK.

Fixes: f73c0c43ac ("vdpa: extract vhost_vdpa_net_load_mac from vhost_vdpa_net_load")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <a21731518644abbd0c495c5b7960527c5911f80d.1688438055.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index c0e93ce568..345a301d62 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -652,8 +652,9 @@ static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
         if (unlikely(dev_written < 0)) {
             return dev_written;
         }
-
-        return *s->status != VIRTIO_NET_OK;
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
     }
 
     return 0;

From f45fd95ec9e8104f6af801c734375029dda0f542 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Tue, 4 Jul 2023 11:34:34 +0800
Subject: [PATCH 0715/1353] vdpa: Return -EIO if device ack is VIRTIO_NET_ERR
 in _load_mq()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to VirtIO standard, "The class, command and
command-specific-data are set by the driver,
and the device sets the ack byte.
There is little it can do except issue a diagnostic
if ack is not VIRTIO_NET_OK."

Therefore, QEMU should stop sending the queued SVQ commands and
cancel the device startup if the device's ack is not VIRTIO_NET_OK.

Yet the problem is that, vhost_vdpa_net_load_mq() returns 1 based on
`*s->status != VIRTIO_NET_OK` when the device's ack is VIRTIO_NET_ERR.
As a result, net->nc->info->load() also returns 1, this makes
vhost_net_start_one() incorrectly assume the device state is
successfully loaded by vhost_vdpa_net_load() and return 0, instead of
goto `fail` label to cancel the device startup, as vhost_net_start_one()
only cancels the device startup when net->nc->info->load() returns a
negative value.

This patch fixes this problem by returning -EIO when the device's
ack is not VIRTIO_NET_OK.

Fixes: f64c7cda69 ("vdpa: Add vhost_vdpa_net_load_mq")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <ec515ebb0b4f56368751b9e318e245a5d994fa72.1688438055.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 345a301d62..8477ed2579 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -677,8 +677,11 @@ static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
     if (unlikely(dev_written < 0)) {
         return dev_written;
     }
+    if (*s->status != VIRTIO_NET_OK) {
+        return -EIO;
+    }
 
-    return *s->status != VIRTIO_NET_OK;
+    return 0;
 }
 
 static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,

From 6f34807116ffef7c449a656dbe2091d4f4da89c8 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Tue, 4 Jul 2023 11:34:35 +0800
Subject: [PATCH 0716/1353] vdpa: Return -EIO if device ack is VIRTIO_NET_ERR
 in _load_offloads()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to VirtIO standard, "The class, command and
command-specific-data are set by the driver,
and the device sets the ack byte.
There is little it can do except issue a diagnostic
if ack is not VIRTIO_NET_OK."

Therefore, QEMU should stop sending the queued SVQ commands and
cancel the device startup if the device's ack is not VIRTIO_NET_OK.

Yet the problem is that, vhost_vdpa_net_load_offloads() returns 1 based on
`*s->status != VIRTIO_NET_OK` when the device's ack is VIRTIO_NET_ERR.
As a result, net->nc->info->load() also returns 1, this makes
vhost_net_start_one() incorrectly assume the device state is
successfully loaded by vhost_vdpa_net_load() and return 0, instead of
goto `fail` label to cancel the device startup, as vhost_net_start_one()
only cancels the device startup when net->nc->info->load() returns a
negative value.

This patch fixes this problem by returning -EIO when the device's
ack is not VIRTIO_NET_OK.

Fixes: 0b58d3686a ("vdpa: Add vhost_vdpa_net_load_offloads()")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <b0396b80e96322b86f1a0b10c098fc1edd947d72.1688438055.git.yin31149@gmail.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 8477ed2579..679ef4bed0 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -718,8 +718,11 @@ static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
     if (unlikely(dev_written < 0)) {
         return dev_written;
     }
+    if (*s->status != VIRTIO_NET_OK) {
+        return -EIO;
+    }
 
-    return *s->status != VIRTIO_NET_OK;
+    return 0;
 }
 
 static int vhost_vdpa_net_load(NetClientState *nc)

From 77812aa7b1fdf8f547c35a7f9a4eb1cbf3a073db Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Tue, 4 Jul 2023 09:19:31 +0200
Subject: [PATCH 0717/1353] vhost-vdpa: mute unaligned memory error report

With TPM CRM device, vhost-vdpa reports an error when it tries
to register a listener for a non aligned memory region:

  qemu-system-x86_64: vhost_vdpa_listener_region_add received unaligned region
  qemu-system-x86_64: vhost_vdpa_listener_region_del received unaligned region

This error can be confusing for the user whereas we only need to skip
the region (as it's already done after the error_report())

Rather than introducing a special case for TPM CRB memory section
to not display the message in this case, simply replace the
error_report() by a trace function (with more information, like the
memory region name).

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Message-Id: <20230704071931.575888-2-lvivier@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/trace-events | 2 ++
 hw/virtio/vhost-vdpa.c | 8 ++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 6265231683..4e39ed8a95 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -34,7 +34,9 @@ vhost_vdpa_dma_map(void *vdpa, int fd, uint32_t msg_type, uint32_t asid, uint64_
 vhost_vdpa_dma_unmap(void *vdpa, int fd, uint32_t msg_type, uint32_t asid, uint64_t iova, uint64_t size, uint8_t type) "vdpa:%p fd: %d msg_type: %"PRIu32" asid: %"PRIu32" iova: 0x%"PRIx64" size: 0x%"PRIx64" type: %"PRIu8
 vhost_vdpa_listener_begin_batch(void *v, int fd, uint32_t msg_type, uint8_t type)  "vdpa:%p fd: %d msg_type: %"PRIu32" type: %"PRIu8
 vhost_vdpa_listener_commit(void *v, int fd, uint32_t msg_type, uint8_t type)  "vdpa:%p fd: %d msg_type: %"PRIu32" type: %"PRIu8
+vhost_vdpa_listener_region_add_unaligned(void *v, const char *name, uint64_t offset_as, uint64_t offset_page) "vdpa: %p region %s offset_within_address_space %"PRIu64" offset_within_region %"PRIu64
 vhost_vdpa_listener_region_add(void *vdpa, uint64_t iova, uint64_t llend, void *vaddr, bool readonly) "vdpa: %p iova 0x%"PRIx64" llend 0x%"PRIx64" vaddr: %p read-only: %d"
+vhost_vdpa_listener_region_del_unaligned(void *v, const char *name, uint64_t offset_as, uint64_t offset_page) "vdpa: %p region %s offset_within_address_space %"PRIu64" offset_within_region %"PRIu64
 vhost_vdpa_listener_region_del(void *vdpa, uint64_t iova, uint64_t llend) "vdpa: %p iova 0x%"PRIx64" llend 0x%"PRIx64
 vhost_vdpa_add_status(void *dev, uint8_t status) "dev: %p status: 0x%"PRIx8
 vhost_vdpa_init(void *dev, void *vdpa) "dev: %p vdpa: %p"
diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 6246e5b9bf..42f2a4bae9 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -323,7 +323,9 @@ static void vhost_vdpa_listener_region_add(MemoryListener *listener,
 
     if (unlikely((section->offset_within_address_space & ~TARGET_PAGE_MASK) !=
                  (section->offset_within_region & ~TARGET_PAGE_MASK))) {
-        error_report("%s received unaligned region", __func__);
+        trace_vhost_vdpa_listener_region_add_unaligned(v, section->mr->name,
+                       section->offset_within_address_space & ~TARGET_PAGE_MASK,
+                       section->offset_within_region & ~TARGET_PAGE_MASK);
         return;
     }
 
@@ -405,7 +407,9 @@ static void vhost_vdpa_listener_region_del(MemoryListener *listener,
 
     if (unlikely((section->offset_within_address_space & ~TARGET_PAGE_MASK) !=
                  (section->offset_within_region & ~TARGET_PAGE_MASK))) {
-        error_report("%s received unaligned region", __func__);
+        trace_vhost_vdpa_listener_region_del_unaligned(v, section->mr->name,
+                       section->offset_within_address_space & ~TARGET_PAGE_MASK,
+                       section->offset_within_region & ~TARGET_PAGE_MASK);
         return;
     }
 

From 8d60105a5973320ffd72a48f208cfd2b041d6c0b Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Wed, 5 Jul 2023 17:29:19 +0530
Subject: [PATCH 0718/1353] tests/acpi: allow changes in DSDT.noacpihp table
 blob

We are going to fix bio-tables-test in the next patch and hence need to
make sure the acpi tests continue to pass.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230705115925.5339-2-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..31df9c6187 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,2 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/q35/DSDT.noacpihp",

From 7b0ba7b1c8b362a83bfb30170dae6035a71192c2 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Wed, 5 Jul 2023 17:29:20 +0530
Subject: [PATCH 0719/1353] tests/acpi/bios-tables-test: use the correct slot
 on the pcie-root-port

PCIE ports only have one slot, slot 0. Hence, non-zero slots are not available
for PCIE devices on PCIE root ports. Fix test_acpi_q35_tcg_no_acpi_hotplug()
so that the test does not use them.

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230705115925.5339-3-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index ed1c69cf01..47ba20b957 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -1020,9 +1020,9 @@ static void test_acpi_q35_tcg_no_acpi_hotplug(void)
         " -device pci-testdev,bus=nohprp,acpi-index=501"
         " -device pcie-root-port,id=nohprpint,port=0x0,chassis=3,hotplug=off,"
                                  "multifunction=on,addr=8.0"
-        " -device pci-testdev,bus=nohprpint,acpi-index=601,addr=8.1"
+        " -device pci-testdev,bus=nohprpint,acpi-index=601,addr=0.1"
         " -device pcie-root-port,id=hprp2,port=0x0,chassis=4,bus=nohprpint,"
-                                 "addr=9.0"
+                                 "addr=0.2"
         " -device pci-testdev,bus=hprp2,acpi-index=602"
         , &data);
     free_test_data(&data);

From bac4711b07ef92be45628ae7b399a09d850ee596 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Wed, 5 Jul 2023 17:29:21 +0530
Subject: [PATCH 0720/1353] tests/acpi/bios-tables-test: update acpi blob
 q35/DSDT.noacpihp

Some fixes were committed in bios-tables-test in the previous commit. Update
the acpi blob and clear bios-tables-test-allowed-diff.h so that the test
continues to pass with the changes in the bios-tables-test.

Following is the asl diff between the old and the newly updated blob:

@@ -1,30 +1,30 @@
 /*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20210604 (64-bit version)
  * Copyright (c) 2000 - 2021 Intel Corporation
  *
  * Disassembling to symbolic ASL+ operators
  *
- * Disassembly of tests/data/acpi/q35/DSDT.noacpihp, Wed Jun 21 18:26:52 2023
+ * Disassembly of /tmp/aml-O8SU61, Wed Jun 21 18:26:52 2023
  *
  * Original Table Header:
  *     Signature        "DSDT"
- *     Length           0x00002038 (8248)
+ *     Length           0x00002031 (8241)
  *     Revision         0x01 **** 32-bit table (V1), no 64-bit math support
- *     Checksum         0x4A
+ *     Checksum         0x89
  *     OEM ID           "BOCHS "
  *     OEM Table ID     "BXPC    "
  *     OEM Revision     0x00000001 (1)
  *     Compiler ID      "BXPC"
  *     Compiler Version 0x00000001 (1)
  */
 DefinitionBlock ("", "DSDT", 1, "BOCHS ", "BXPC    ", 0x00000001)
 {
     Scope (\)
     {
         OperationRegion (DBG, SystemIO, 0x0402, One)
         Field (DBG, ByteAcc, NoLock, Preserve)
         {
             DBGB,   8
         }

@@ -3148,48 +3148,48 @@
                 {
                     Name (_ADR, Zero)  // _ADR: Address
                     Method (_DSM, 4, Serialized)  // _DSM: Device-Specific Method
                     {
                         Local0 = Package (0x01)
                             {
                                 0x01F5
                             }
                         Return (EDSM (Arg0, Arg1, Arg2, Arg3, Local0))
                     }
                 }
             }

             Device (S40)
             {
                 Name (_ADR, 0x00080000)  // _ADR: Address
-                Device (S41)
+                Device (S01)
                 {
-                    Name (_ADR, 0x00080001)  // _ADR: Address
+                    Name (_ADR, One)  // _ADR: Address
                     Method (_DSM, 4, Serialized)  // _DSM: Device-Specific Method
                     {
                         Local0 = Package (0x01)
                             {
                                 0x0259
                             }
                         Return (EDSM (Arg0, Arg1, Arg2, Arg3, Local0))
                     }
                 }

-                Device (S48)
+                Device (S02)
                 {
-                    Name (_ADR, 0x00090000)  // _ADR: Address
+                    Name (_ADR, 0x02)  // _ADR: Address
                     Device (S00)
                     {
                         Name (_ADR, Zero)  // _ADR: Address
                     }
                 }
             }

             Device (SF8)
             {
                 Name (_ADR, 0x001F0000)  // _ADR: Address
                 OperationRegion (PIRQ, PCI_Config, 0x60, 0x0C)
                 Scope (\_SB)
                 {
                     Field (PCI0.SF8.PIRQ, ByteAcc, NoLock, Preserve)
                     {
                         PRQA,   8,

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230705115925.5339-4-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/q35/DSDT.noacpihp           | Bin 8248 -> 8241 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 2 files changed, 1 deletion(-)

diff --git a/tests/data/acpi/q35/DSDT.noacpihp b/tests/data/acpi/q35/DSDT.noacpihp
index 6ab1f0e52543fcb7f84a7fd1327fe5aa42010565..8cab2f8eb9ae94e0165f3f17857ec7d080fb0e13 100644
GIT binary patch
delta 109
zcmdntu+f3bCD<jzP=SGgv2!Dri!7J3UQB$jQ@nt;?&b(tDMlAZ)?gEZc#e2SmmnSn
z1`dYkCY4|VLx=#Qh(x?gurE)65Gx~hBvZl?S0FDVGb=kGx=AwFzzCv>i)r&-xoSoL
DyqFtK

delta 94
zcmdn!u)~4NCD<jzLV<yS(Q6}@i!7IyUQB$jQ@nta-sT8dDMm#P)?gEZc#e2SmmnSn
k1`dYkCXHYdL#O~FP+)SuoHV~ou!#j+5huguZF1F&02bsG6#xJL

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 31df9c6187..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,2 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/q35/DSDT.noacpihp",

From 579edbd459a53beb7929ee1169dc9675cc329865 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Wed, 5 Jul 2023 17:29:22 +0530
Subject: [PATCH 0721/1353] tests/qtest/hd-geo-test: fix incorrect
 pcie-root-port usage and simplify test

The test attaches a SCSI controller to a non-zero slot and a pcie-to-pci bridge
on slot 0 on the same pcie-root-port. Since a downstream device can be attached
to a pcie-root-port only on slot 0, the above test configuration is not allowed.
Additionally using pcie.0 as id for pcie-to-pci bridge is incorrect as that id
is reserved only for the root bus.

In the test scenario, there is no need to attach a pcie-root-port to the
root complex. A SCSI controller can be attached to a pcie-to-pci bridge
which can then be directly attached to the root bus (pcie.0).

Fix the test and simplify it.

CC: mst@redhat.com
CC: imammedo@redhat.com
CC: Michael Labiuk <michael.labiuk@virtuozzo.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Message-Id: <20230705115925.5339-5-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/hd-geo-test.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
index 5aa258a2b3..d08bffad91 100644
--- a/tests/qtest/hd-geo-test.c
+++ b/tests/qtest/hd-geo-test.c
@@ -784,14 +784,12 @@ static void test_override_scsi(void)
     test_override(args, "pc", expected);
 }
 
-static void setup_pci_bridge(TestArgs *args, const char *id, const char *rootid)
+static void setup_pci_bridge(TestArgs *args, const char *id)
 {
 
-    char *root, *br;
-    root = g_strdup_printf("-device pcie-root-port,id=%s", rootid);
-    br = g_strdup_printf("-device pcie-pci-bridge,bus=%s,id=%s", rootid, id);
+    char *br;
+    br = g_strdup_printf("-device pcie-pci-bridge,bus=pcie.0,id=%s", id);
 
-    args->argc = append_arg(args->argc, args->argv, ARGV_SIZE, root);
     args->argc = append_arg(args->argc, args->argv, ARGV_SIZE, br);
 }
 
@@ -811,8 +809,8 @@ static void test_override_scsi_q35(void)
     add_drive_with_mbr(args, empty_mbr, 1);
     add_drive_with_mbr(args, empty_mbr, 1);
     add_drive_with_mbr(args, empty_mbr, 1);
-    setup_pci_bridge(args, "pcie.0", "br");
-    add_scsi_controller(args, "lsi53c895a", "br", 3);
+    setup_pci_bridge(args, "pcie-pci-br");
+    add_scsi_controller(args, "lsi53c895a", "pcie-pci-br", 3);
     add_scsi_disk(args, 0, 0, 0, 0, 0, 10000, 120, 30);
     add_scsi_disk(args, 1, 0, 0, 1, 0, 9000, 120, 30);
     add_scsi_disk(args, 2, 0, 0, 2, 0, 1, 0, 0);
@@ -868,9 +866,9 @@ static void test_override_virtio_blk_q35(void)
     };
     add_drive_with_mbr(args, empty_mbr, 1);
     add_drive_with_mbr(args, empty_mbr, 1);
-    setup_pci_bridge(args, "pcie.0", "br");
-    add_virtio_disk(args, 0, "br", 3, 10000, 120, 30);
-    add_virtio_disk(args, 1, "br", 4, 9000, 120, 30);
+    setup_pci_bridge(args, "pcie-pci-br");
+    add_virtio_disk(args, 0, "pcie-pci-br", 3, 10000, 120, 30);
+    add_virtio_disk(args, 1, "pcie-pci-br", 4, 9000, 120, 30);
     test_override(args, "q35", expected);
 }
 

From ca92eb5defcf9d1c2106341744a73a03cf26e824 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Wed, 5 Jul 2023 17:29:23 +0530
Subject: [PATCH 0722/1353] hw/pci: warn when PCIe device is plugged into
 non-zero slot of downstream port

PCIe downstream ports only have a single device 0, so PCI Express devices can
only be plugged into slot 0 on a PCIe port. Add a warning to let users know
when the invalid configuration is used. We may enforce this more strongly later
once we get more clarity on whether we are introducing a bad regression for
users currently using the wrong configuration.

The change has been tested to not break or alter behaviors of ARI capable
devices by instantiating seven vfs on an emulated igb device (the maximum
number of vfs the igb device supports). The vfs are instantiated correctly
and are seen to have non-zero device/slot numbers in the conventional PCI BDF
representation.

CC: jusual@redhat.com
CC: imammedo@redhat.com
CC: mst@redhat.com
CC: akihiko.odaki@daynix.com

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2128929
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Julia Suvorova <jusual@redhat.com>
Message-Id: <20230705115925.5339-6-anisinha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
---
 hw/pci/pci.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index fb17138f7d..4b14f31859 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -65,6 +65,7 @@ bool pci_available = true;
 static char *pcibus_get_dev_path(DeviceState *dev);
 static char *pcibus_get_fw_dev_path(DeviceState *dev);
 static void pcibus_reset(BusState *qbus);
+static bool pcie_has_upstream_port(PCIDevice *dev);
 
 static Property pci_props[] = {
     DEFINE_PROP_PCI_DEVFN("addr", PCIDevice, devfn, -1),
@@ -2121,6 +2122,25 @@ static void pci_qdev_realize(DeviceState *qdev, Error **errp)
         }
     }
 
+    /*
+     * A PCIe Downstream Port that do not have ARI Forwarding enabled must
+     * associate only Device 0 with the device attached to the bus
+     * representing the Link from the Port (PCIe base spec rev 4.0 ver 0.3,
+     * sec 7.3.1).
+     * With ARI, PCI_SLOT() can return non-zero value as the traditional
+     * 5-bit Device Number and 3-bit Function Number fields in its associated
+     * Routing IDs, Requester IDs and Completer IDs are interpreted as a
+     * single 8-bit Function Number. Hence, ignore ARI capable devices.
+     */
+    if (pci_is_express(pci_dev) &&
+        !pcie_find_capability(pci_dev, PCI_EXT_CAP_ID_ARI) &&
+        pcie_has_upstream_port(pci_dev) &&
+        PCI_SLOT(pci_dev->devfn)) {
+        warn_report("PCI: slot %d is not valid for %s,"
+                    " parent device only allows plugging into slot 0.",
+                    PCI_SLOT(pci_dev->devfn), pci_dev->name);
+    }
+
     if (pci_dev->failover_pair_id) {
         if (!pci_bus_is_express(pci_get_bus(pci_dev))) {
             error_setg(errp, "failover primary device must be on "

From 94df5b2180d61fb2ee2b04cc007981e58b6479a9 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Wed, 5 Jul 2023 18:51:17 +0200
Subject: [PATCH 0723/1353] virtio-iommu: Fix 64kB host page size VFIO device
 assignment

When running on a 64kB page size host and protecting a VFIO device
with the virtio-iommu, qemu crashes with this kind of message:

qemu-kvm: virtio-iommu page mask 0xfffffffffffff000 is incompatible
with mask 0x20010000
qemu: hardware error: vfio: DMA mapping failed, unable to continue

This is due to the fact the IOMMU MR corresponding to the VFIO device
is enabled very late on domain attach, after the machine init.
The device reports a minimal 64kB page size but it is too late to be
applied. virtio_iommu_set_page_size_mask() fails and this causes
vfio_listener_region_add() to end up with hw_error();

To work around this issue, we transiently enable the IOMMU MR on
machine init to collect the page size requirements and then restore
the bypass state.

Fixes: 90519b9053 ("virtio-iommu: Add bypass mode support to assigned device")
Signed-off-by: Eric Auger <eric.auger@redhat.com>

Message-Id: <20230705165118.28194-2-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 hw/virtio/trace-events           |  1 +
 hw/virtio/virtio-iommu.c         | 31 +++++++++++++++++++++++++++++--
 include/hw/virtio/virtio-iommu.h |  2 ++
 3 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 4e39ed8a95..7109cf1a3b 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -133,6 +133,7 @@ virtio_iommu_set_page_size_mask(const char *name, uint64_t old, uint64_t new) "m
 virtio_iommu_notify_flag_add(const char *name) "add notifier to mr %s"
 virtio_iommu_notify_flag_del(const char *name) "del notifier from mr %s"
 virtio_iommu_switch_address_space(uint8_t bus, uint8_t slot, uint8_t fn, bool on) "Device %02x:%02x.%x switching address space (iommu enabled=%d)"
+virtio_iommu_freeze_granule(uint64_t page_size_mask) "granule set to 0x%"PRIx64
 
 # virtio-mem.c
 virtio_mem_send_response(uint16_t type) "type=%" PRIu16
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 1bbad23f4a..8d0c5e3f32 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -25,6 +25,7 @@
 #include "hw/virtio/virtio.h"
 #include "sysemu/kvm.h"
 #include "sysemu/reset.h"
+#include "sysemu/sysemu.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "trace.h"
@@ -1106,12 +1107,12 @@ static int virtio_iommu_set_page_size_mask(IOMMUMemoryRegion *mr,
     }
 
     /*
-     * After the machine is finalized, we can't change the mask anymore. If by
+     * Once the granule is frozen we can't change the mask anymore. If by
      * chance the hotplugged device supports the same granule, we can still
      * accept it. Having a different masks is possible but the guest will use
      * sub-optimal block sizes, so warn about it.
      */
-    if (phase_check(PHASE_MACHINE_READY)) {
+    if (s->granule_frozen) {
         int new_granule = ctz64(new_mask);
         int cur_granule = ctz64(cur_mask);
 
@@ -1146,6 +1147,28 @@ static void virtio_iommu_system_reset(void *opaque)
 
 }
 
+static void virtio_iommu_freeze_granule(Notifier *notifier, void *data)
+{
+    VirtIOIOMMU *s = container_of(notifier, VirtIOIOMMU, machine_done);
+    int granule;
+
+    if (likely(s->config.bypass)) {
+        /*
+         * Transient IOMMU MR enable to collect page_size_mask requirements
+         * through memory_region_iommu_set_page_size_mask() called by
+         * VFIO region_add() callback
+         */
+         s->config.bypass = false;
+         virtio_iommu_switch_address_space_all(s);
+         /* restore default */
+         s->config.bypass = true;
+         virtio_iommu_switch_address_space_all(s);
+    }
+    s->granule_frozen = true;
+    granule = ctz64(s->config.page_size_mask);
+    trace_virtio_iommu_freeze_granule(BIT(granule));
+}
+
 static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
@@ -1189,6 +1212,9 @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)
         error_setg(errp, "VIRTIO-IOMMU is not attached to any PCI bus!");
     }
 
+    s->machine_done.notify = virtio_iommu_freeze_granule;
+    qemu_add_machine_init_done_notifier(&s->machine_done);
+
     qemu_register_reset(virtio_iommu_system_reset, s);
 }
 
@@ -1198,6 +1224,7 @@ static void virtio_iommu_device_unrealize(DeviceState *dev)
     VirtIOIOMMU *s = VIRTIO_IOMMU(dev);
 
     qemu_unregister_reset(virtio_iommu_system_reset, s);
+    qemu_remove_machine_init_done_notifier(&s->machine_done);
 
     g_hash_table_destroy(s->as_by_busptr);
     if (s->domains) {
diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h
index 2ad5ee320b..a93fc5383e 100644
--- a/include/hw/virtio/virtio-iommu.h
+++ b/include/hw/virtio/virtio-iommu.h
@@ -61,6 +61,8 @@ struct VirtIOIOMMU {
     QemuRecMutex mutex;
     GTree *endpoints;
     bool boot_bypass;
+    Notifier machine_done;
+    bool granule_frozen;
 };
 
 #endif

From 587a7641d53055054d68d67d94c9408ef808f127 Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Wed, 5 Jul 2023 18:51:18 +0200
Subject: [PATCH 0724/1353] virtio-iommu: Rework the traces in
 virtio_iommu_set_page_size_mask()

The current error messages in virtio_iommu_set_page_size_mask()
sound quite similar for different situations and miss the IOMMU
memory region that causes the issue.

Clarify them and rework the comment.

Also remove the trace when the new page_size_mask is not applied as
the current frozen granule is kept. This message is rather confusing
for the end user and anyway the current granule would have been used
by the driver.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Message-Id: <20230705165118.28194-3-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
---
 hw/virtio/virtio-iommu.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 8d0c5e3f32..201127c488 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -1101,29 +1101,24 @@ static int virtio_iommu_set_page_size_mask(IOMMUMemoryRegion *mr,
                                           new_mask);
 
     if ((cur_mask & new_mask) == 0) {
-        error_setg(errp, "virtio-iommu page mask 0x%"PRIx64
-                   " is incompatible with mask 0x%"PRIx64, cur_mask, new_mask);
+        error_setg(errp, "virtio-iommu %s reports a page size mask 0x%"PRIx64
+                   " incompatible with currently supported mask 0x%"PRIx64,
+                   mr->parent_obj.name, new_mask, cur_mask);
         return -1;
     }
 
     /*
      * Once the granule is frozen we can't change the mask anymore. If by
      * chance the hotplugged device supports the same granule, we can still
-     * accept it. Having a different masks is possible but the guest will use
-     * sub-optimal block sizes, so warn about it.
+     * accept it.
      */
     if (s->granule_frozen) {
-        int new_granule = ctz64(new_mask);
         int cur_granule = ctz64(cur_mask);
 
-        if (new_granule != cur_granule) {
-            error_setg(errp, "virtio-iommu page mask 0x%"PRIx64
-                       " is incompatible with mask 0x%"PRIx64, cur_mask,
-                       new_mask);
+        if (!(BIT(cur_granule) & new_mask)) {
+            error_setg(errp, "virtio-iommu %s does not support frozen granule 0x%llx",
+                       mr->parent_obj.name, BIT_ULL(cur_granule));
             return -1;
-        } else if (new_mask != cur_mask) {
-            warn_report("virtio-iommu page mask 0x%"PRIx64
-                        " does not match 0x%"PRIx64, cur_mask, new_mask);
         }
         return 0;
     }

From 625b370c45f4acd155ee625d61c0057d770a5b5e Mon Sep 17 00:00:00 2001
From: Leonardo Bras <leobras@redhat.com>
Date: Thu, 6 Jul 2023 01:55:47 -0300
Subject: [PATCH 0725/1353] pcie: Add hotplug detect state register to cmask
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When trying to migrate a machine type pc-q35-6.0 or lower, with this
cmdline options,

-device driver=pcie-root-port,port=18,chassis=19,id=pcie-root-port18,bus=pcie.0,addr=0x12 \
-device driver=nec-usb-xhci,p2=4,p3=4,id=nex-usb-xhci0,bus=pcie-root-port18,addr=0x12.0x1

the following bug happens after all ram pages were sent:

qemu-kvm: get_pci_config_device: Bad config data: i=0x6e read: 0 device: 40 cmask: ff wmask: 0 w1cmask:19
qemu-kvm: Failed to load PCIDevice:config
qemu-kvm: Failed to load pcie-root-port:parent_obj.parent_obj.parent_obj
qemu-kvm: error while loading state for instance 0x0 of device '0000:00:12.0/pcie-root-port'
qemu-kvm: load of migration failed: Invalid argument

This happens on pc-q35-6.0 or lower because of:
{ "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" }

In this scenario, hotplug_handler_plug() calls pcie_cap_slot_plug_cb(),
which sets dev->config byte 0x6e with bit PCI_EXP_SLTSTA_PDS to signal PCI
hotplug for the guest. After a while the guest will deal with this hotplug
and qemu will clear the above bit.

Then, during migration, get_pci_config_device() will compare the
configs of both the freshly created device and the one that is being
received via migration, which will differ due to the PCI_EXP_SLTSTA_PDS bit
and cause the bug to reproduce.

To avoid this fake incompatibility, there are tree fields in PCIDevice that
can help:

- wmask: Used to implement R/W bytes, and
- w1cmask: Used to implement RW1C(Write 1 to Clear) bytes
- cmask: Used to enable config checks on load.

According to PCI Express® Base Specification Revision 5.0 Version 1.0,
table 7-27 (Slot Status Register) bit 6, the "Presence Detect State" is
listed as RO (read-only), so it only makes sense to make use of the cmask
field.

So, clear PCI_EXP_SLTSTA_PDS bit on cmask, so the fake incompatibility on
get_pci_config_device() does not abort the migration.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2215819
Signed-off-by: Leonardo Bras <leobras@redhat.com>
Message-Id: <20230706045546.593605-3-leobras@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
---
 hw/pci/pcie.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index b7f107ed8d..763f65c528 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -666,6 +666,10 @@ void pcie_cap_slot_init(PCIDevice *dev, PCIESlot *s)
     pci_word_test_and_set_mask(dev->w1cmask + pos + PCI_EXP_SLTSTA,
                                PCI_EXP_HP_EV_SUPPORTED);
 
+    /* Avoid migration abortion when this device hot-removed by guest */
+    pci_word_test_and_clear_mask(dev->cmask + pos + PCI_EXP_SLTSTA,
+                                 PCI_EXP_SLTSTA_PDS);
+
     dev->exp.hpev_notified = false;
 
     qbus_set_hotplug_handler(BUS(pci_bridge_get_sec_bus(PCI_BRIDGE(dev))),

From 031b1abacbdb3f4e016b6b926f7e7876c05339bb Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Sat, 8 Jul 2023 00:44:42 +0800
Subject: [PATCH 0726/1353] vdpa: Fix possible use-after-free for
 VirtQueueElement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU uses vhost_handle_guest_kick() to forward guest's available
buffers to the vdpa device in SVQ avail ring.

In vhost_handle_guest_kick(), a `g_autofree` `elem` is used to
iterate through the available VirtQueueElements. This `elem` is
then passed to `svq->ops->avail_handler`, specifically to the
vhost_vdpa_net_handle_ctrl_avail(). If this handler fails to
process the CVQ command, vhost_handle_guest_kick() regains
ownership of the `elem`, and either frees it or requeues it.

Yet the problem is that, vhost_vdpa_net_handle_ctrl_avail()
mistakenly frees the `elem`, even if it fails to forward the
CVQ command to vdpa device. This can result in a use-after-free
for the `elem` in vhost_handle_guest_kick().

This patch solves this problem by refactoring
vhost_vdpa_net_handle_ctrl_avail() to only freeing the `elem` if
it owns it.

Fixes: bd907ae4b0 ("vdpa: manual forward CVQ buffers")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <e3f2d7db477734afe5c6a5ab3fa8b8317514ea34.1688746840.git.yin31149@gmail.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 679ef4bed0..5542b47a8f 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -831,7 +831,16 @@ out:
         error_report("Bad device CVQ written length");
     }
     vhost_svq_push_elem(svq, elem, MIN(in_len, sizeof(status)));
-    g_free(elem);
+    /*
+     * `elem` belongs to vhost_vdpa_net_handle_ctrl_avail() only when
+     * the function successfully forwards the CVQ command, indicated
+     * by a non-negative value of `dev_written`. Otherwise, it still
+     * belongs to SVQ.
+     * This function should only free the `elem` when it owns.
+     */
+    if (dev_written >= 0) {
+        g_free(elem);
+    }
     return dev_written < 0 ? dev_written : 0;
 }
 

From e57fc3dec9508cfa81c1bedcaa6b7469995ac6a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 10 Jul 2023 16:35:03 +0100
Subject: [PATCH 0727/1353] include: attempt to document device_class_set_props
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I'm still not sure how I achieve by use case of the parent class
defining the following properties:

  static Property vud_properties[] = {
      DEFINE_PROP_CHR("chardev", VHostUserDevice, chardev),
      DEFINE_PROP_UINT16("id", VHostUserDevice, id, 0),
      DEFINE_PROP_UINT32("num_vqs", VHostUserDevice, num_vqs, 1),
      DEFINE_PROP_END_OF_LIST(),
  };

But for the specialisation of the class I want the id to default to
the actual device id, e.g.:

  static Property vu_rng_properties[] = {
      DEFINE_PROP_UINT16("id", VHostUserDevice, id, VIRTIO_ID_RNG),
      DEFINE_PROP_UINT32("num_vqs", VHostUserDevice, num_vqs, 1),
      DEFINE_PROP_END_OF_LIST(),
  };

And so far the API for doing that isn't super clear.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230710153522.3469097-2-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/qdev-core.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 06cadfc492..196ebf6d91 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -926,6 +926,15 @@ BusState *sysbus_get_default(void);
 char *qdev_get_fw_dev_path(DeviceState *dev);
 char *qdev_get_own_fw_dev_path_from_handler(BusState *bus, DeviceState *dev);
 
+/**
+ * device_class_set_props(): add a set of properties to an device
+ * @dc: the parent DeviceClass all devices inherit
+ * @props: an array of properties, terminate by DEFINE_PROP_END_OF_LIST()
+ *
+ * This will add a set of properties to the object. It will fault if
+ * you attempt to add an existing property defined by a parent class.
+ * To modify an inherited property you need to use????
+ */
 void device_class_set_props(DeviceClass *dc, Property *props);
 
 /**

From c378e88218c9679d7df8230c9f988b22a6cbdc1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 10 Jul 2023 16:35:04 +0100
Subject: [PATCH 0728/1353] include/hw: document the device_class_set_parent_*
 fns
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These are useful functions for when you want proper inheritance of
functionality across realize/unrealize calls.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230710153522.3469097-3-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/qdev-core.h | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 196ebf6d91..884c726a87 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -952,9 +952,36 @@ void device_class_set_props(DeviceClass *dc, Property *props);
 void device_class_set_parent_reset(DeviceClass *dc,
                                    DeviceReset dev_reset,
                                    DeviceReset *parent_reset);
+
+/**
+ * device_class_set_parent_realize() - set up for chaining realize fns
+ * @dc: The device class
+ * @dev_realize: the device realize function
+ * @parent_realize: somewhere to save the parents realize function
+ *
+ * This is intended to be used when the new realize function will
+ * eventually call its parent realization function during creation.
+ * This requires storing the function call somewhere (usually in the
+ * instance structure) so you can eventually call
+ * dc->parent_realize(dev, errp)
+ */
 void device_class_set_parent_realize(DeviceClass *dc,
                                      DeviceRealize dev_realize,
                                      DeviceRealize *parent_realize);
+
+
+/**
+ * device_class_set_parent_unrealize() - set up for chaining unrealize fns
+ * @dc: The device class
+ * @dev_unrealize: the device realize function
+ * @parent_unrealize: somewhere to save the parents unrealize function
+ *
+ * This is intended to be used when the new unrealize function will
+ * eventually call its parent unrealization function during the
+ * unrealize phase. This requires storing the function call somewhere
+ * (usually in the instance structure) so you can eventually call
+ * dc->parent_unrealize(dev);
+ */
 void device_class_set_parent_unrealize(DeviceClass *dc,
                                        DeviceUnrealize dev_unrealize,
                                        DeviceUnrealize *parent_unrealize);

From 7e8094f0dfd04d4772b65dc92dd087dc86783dc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 10 Jul 2023 16:35:05 +0100
Subject: [PATCH 0729/1353] hw/virtio: fix typo in VIRTIO_CONFIG_IRQ_IDX
 comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: 544f0278af (virtio: introduce macro VIRTIO_CONFIG_IRQ_IDX)
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230710153522.3469097-4-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/display/vhost-user-gpu.c    | 4 ++--
 hw/net/virtio-net.c            | 4 ++--
 hw/virtio/vhost-user-fs.c      | 4 ++--
 hw/virtio/vhost-user-gpio.c    | 2 +-
 hw/virtio/vhost-vsock-common.c | 4 ++--
 hw/virtio/virtio-crypto.c      | 4 ++--
 6 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index 543ea92721..e8ee03094e 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -521,7 +521,7 @@ vhost_user_gpu_guest_notifier_pending(VirtIODevice *vdev, int idx)
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
@@ -538,7 +538,7 @@ vhost_user_gpu_guest_notifier_mask(VirtIODevice *vdev, int idx, bool mask)
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index d51067123b..7102ec4817 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -3362,7 +3362,7 @@ static bool virtio_net_guest_notifier_pending(VirtIODevice *vdev, int idx)
     }
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return false
      */
 
@@ -3394,7 +3394,7 @@ static void virtio_net_guest_notifier_mask(VirtIODevice *vdev, int idx,
     }
     /*
      *Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index 83fc20e49e..49d699ffc2 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -161,7 +161,7 @@ static void vuf_guest_notifier_mask(VirtIODevice *vdev, int idx,
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
@@ -177,7 +177,7 @@ static bool vuf_guest_notifier_pending(VirtIODevice *vdev, int idx)
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
diff --git a/hw/virtio/vhost-user-gpio.c b/hw/virtio/vhost-user-gpio.c
index d6927b610a..3b013f2d0f 100644
--- a/hw/virtio/vhost-user-gpio.c
+++ b/hw/virtio/vhost-user-gpio.c
@@ -194,7 +194,7 @@ static void vu_gpio_guest_notifier_mask(VirtIODevice *vdev, int idx, bool mask)
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
index 321262f6b3..12ea87d7a7 100644
--- a/hw/virtio/vhost-vsock-common.c
+++ b/hw/virtio/vhost-vsock-common.c
@@ -129,7 +129,7 @@ static void vhost_vsock_common_guest_notifier_mask(VirtIODevice *vdev, int idx,
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
@@ -146,7 +146,7 @@ static bool vhost_vsock_common_guest_notifier_pending(VirtIODevice *vdev,
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index a6d7e1e8ec..44faf5a522 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -1210,7 +1210,7 @@ static void virtio_crypto_guest_notifier_mask(VirtIODevice *vdev, int idx,
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 
@@ -1229,7 +1229,7 @@ static bool virtio_crypto_guest_notifier_pending(VirtIODevice *vdev, int idx)
 
     /*
      * Add the check for configure interrupt, Use VIRTIO_CONFIG_IRQ_IDX -1
-     * as the Marco of configure interrupt's IDX, If this driver does not
+     * as the macro of configure interrupt's IDX, If this driver does not
      * support, the function will return
      */
 

From a0cc7673ab731794caefed2033d68a2199d6bfaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 10 Jul 2023 16:35:06 +0100
Subject: [PATCH 0730/1353] include/hw/virtio: document virtio_notify_config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230710153522.3469097-5-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/virtio/virtio.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 0492d26900..0671989383 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -276,6 +276,13 @@ extern const VMStateInfo virtio_vmstate_info;
 
 int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id);
 
+/**
+ * virtio_notify_config() - signal a change to device config
+ * @vdev: the virtio device
+ *
+ * Assuming the virtio device is up (VIRTIO_CONFIG_S_DRIVER_OK) this
+ * will trigger a guest interrupt and update the config version.
+ */
 void virtio_notify_config(VirtIODevice *vdev);
 
 bool virtio_queue_get_notification(VirtQueue *vq);

From 3b6256c2c57061c365cfad7857e12fd8d15ca3c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 10 Jul 2023 16:35:07 +0100
Subject: [PATCH 0731/1353] include/hw/virtio: add kerneldoc for virtio_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230710153522.3469097-6-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/virtio/virtio.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 0671989383..631490bda4 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -219,6 +219,12 @@ struct VirtioDeviceClass {
 void virtio_instance_init_common(Object *proxy_obj, void *data,
                                  size_t vdev_size, const char *vdev_name);
 
+/**
+ * virtio_init() - initialise the common VirtIODevice structure
+ * @vdev: pointer to VirtIODevice
+ * @device_id: the VirtIO device ID (see virtio_ids.h)
+ * @config_size: size of the config space
+ */
 void virtio_init(VirtIODevice *vdev, uint16_t device_id, size_t config_size);
 
 void virtio_cleanup(VirtIODevice *vdev);

From 661dee7bd08dd93d15b898d43821bb46b2aa422c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 10 Jul 2023 16:35:08 +0100
Subject: [PATCH 0732/1353] include/hw/virtio: document some more usage of
 notifiers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lets document some more of the core VirtIODevice structure.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230710153522.3469097-7-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/virtio/virtio.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 631490bda4..c8f72850bc 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -150,10 +150,18 @@ struct VirtIODevice
     VMChangeStateEntry *vmstate;
     char *bus_name;
     uint8_t device_endian;
+    /**
+     * @user_guest_notifier_mask: gate usage of ->guest_notifier_mask() callback.
+     * This is used to suppress the masking of guest updates for
+     * vhost-user devices which are asynchronous by design.
+     */
     bool use_guest_notifier_mask;
     AddressSpace *dma_as;
     QLIST_HEAD(, VirtQueue) *vector_queues;
     QTAILQ_ENTRY(VirtIODevice) next;
+    /**
+     * @config_notifier: the event notifier that handles config events
+     */
     EventNotifier config_notifier;
     bool device_iotlb_enabled;
 };

From 445416e3010a2525c577d692921979a64d88a998 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 11 Jul 2023 00:38:35 +0900
Subject: [PATCH 0733/1353] pcie: Use common ARI next function number

Currently the only implementers of ARI is SR-IOV devices, and they
behave similar. Share the ARI next function number.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Message-Id: <20230710153838.33917-2-akihiko.odaki@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/pcie_sriov.txt   | 4 ++--
 hw/net/igb.c          | 2 +-
 hw/net/igbvf.c        | 2 +-
 hw/nvme/ctrl.c        | 2 +-
 hw/pci/pcie.c         | 4 +++-
 include/hw/pci/pcie.h | 2 +-
 6 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/docs/pcie_sriov.txt b/docs/pcie_sriov.txt
index 7eff7f2703..a47aad0bfa 100644
--- a/docs/pcie_sriov.txt
+++ b/docs/pcie_sriov.txt
@@ -48,7 +48,7 @@ setting up a BAR for a VF.
       ...
       int ret = pcie_endpoint_cap_init(d, 0x70);
       ...
-      pcie_ari_init(d, 0x100, 1);
+      pcie_ari_init(d, 0x100);
       ...
 
       /* Add and initialize the SR/IOV capability */
@@ -78,7 +78,7 @@ setting up a BAR for a VF.
       ...
       int ret = pcie_endpoint_cap_init(d, 0x60);
       ...
-      pcie_ari_init(d, 0x100, 1);
+      pcie_ari_init(d, 0x100);
       ...
       memory_region_init(mr, ... )
       pcie_sriov_vf_register_bar(d, bar_nr, mr);
diff --git a/hw/net/igb.c b/hw/net/igb.c
index 1c989d7677..8ff832acfc 100644
--- a/hw/net/igb.c
+++ b/hw/net/igb.c
@@ -431,7 +431,7 @@ static void igb_pci_realize(PCIDevice *pci_dev, Error **errp)
         hw_error("Failed to initialize AER capability");
     }
 
-    pcie_ari_init(pci_dev, 0x150, 1);
+    pcie_ari_init(pci_dev, 0x150);
 
     pcie_sriov_pf_init(pci_dev, IGB_CAP_SRIOV_OFFSET, TYPE_IGBVF,
         IGB_82576_VF_DEV_ID, IGB_MAX_VF_FUNCTIONS, IGB_MAX_VF_FUNCTIONS,
diff --git a/hw/net/igbvf.c b/hw/net/igbvf.c
index 284ea61184..d55e1e8a6a 100644
--- a/hw/net/igbvf.c
+++ b/hw/net/igbvf.c
@@ -270,7 +270,7 @@ static void igbvf_pci_realize(PCIDevice *dev, Error **errp)
         hw_error("Failed to initialize AER capability");
     }
 
-    pcie_ari_init(dev, 0x150, 1);
+    pcie_ari_init(dev, 0x150);
 }
 
 static void igbvf_pci_uninit(PCIDevice *dev)
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 355668bdf8..8e8e870b9a 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -8120,7 +8120,7 @@ static bool nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
     pcie_endpoint_cap_init(pci_dev, 0x80);
     pcie_cap_flr_init(pci_dev);
     if (n->params.sriov_max_vfs) {
-        pcie_ari_init(pci_dev, 0x100, 1);
+        pcie_ari_init(pci_dev, 0x100);
     }
 
     /* add one to max_ioqpairs to account for the admin queue pair */
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 763f65c528..6075ff5556 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1039,8 +1039,10 @@ void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
  */
 
 /* ARI */
-void pcie_ari_init(PCIDevice *dev, uint16_t offset, uint16_t nextfn)
+void pcie_ari_init(PCIDevice *dev, uint16_t offset)
 {
+    uint16_t nextfn = 1;
+
     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
                         offset, PCI_ARI_SIZEOF);
     pci_set_long(dev->config + offset + PCI_ARI_CAP, (nextfn & 0xff) << 8);
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index 51ab57bc3c..11f5a91bbb 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -135,7 +135,7 @@ void pcie_sync_bridge_lnk(PCIDevice *dev);
 void pcie_acs_init(PCIDevice *dev, uint16_t offset);
 void pcie_acs_reset(PCIDevice *dev);
 
-void pcie_ari_init(PCIDevice *dev, uint16_t offset, uint16_t nextfn);
+void pcie_ari_init(PCIDevice *dev, uint16_t offset);
 void pcie_dev_ser_num_init(PCIDevice *dev, uint16_t offset, uint64_t ser_num);
 void pcie_ats_init(PCIDevice *dev, uint16_t offset, bool aligned);
 

From 7c228c5f3301113ffd7cfee7f982e7ae04c8ffda Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 11 Jul 2023 00:38:36 +0900
Subject: [PATCH 0734/1353] pcie: Specify 0 for ARI next function numbers

The current implementers of ARI are all SR-IOV devices. The ARI next
function number field is undefined for VF according to PCI Express Base
Specification Revision 5.0 Version 1.0 section 9.3.7.7. The PF still
requires some defined value so end the linked list formed with the field
by specifying 0 as required for any ARI implementation according to
section 7.8.7.2.

For migration, the field will keep having 1 as its value on the old
QEMU machine versions.

Fixes: 2503461691 ("pcie: Add some SR/IOV API documentation in docs/pcie_sriov.txt")
Fixes: 44c2c09488 ("hw/nvme: Add support for SR-IOV")
Fixes: 3a977deebe ("Intrdocue igb device emulation")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Ani Sinha <anisinha@redhat.com>
Message-Id: <20230710153838.33917-3-akihiko.odaki@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/core/machine.c    | 1 +
 hw/pci/pci.c         | 2 ++
 hw/pci/pcie.c        | 2 +-
 include/hw/pci/pci.h | 2 ++
 4 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 46f8f9a2b0..f0d35c6401 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -41,6 +41,7 @@
 
 GlobalProperty hw_compat_8_0[] = {
     { "migration", "multifd-flush-after-each-section", "on"},
+    { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
 };
 const size_t hw_compat_8_0_len = G_N_ELEMENTS(hw_compat_8_0);
 
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 4b14f31859..784c02a182 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -83,6 +83,8 @@ static Property pci_props[] = {
     DEFINE_PROP_UINT32("acpi-index",  PCIDevice, acpi_index, 0),
     DEFINE_PROP_BIT("x-pcie-err-unc-mask", PCIDevice, cap_present,
                     QEMU_PCIE_ERR_UNC_MASK_BITNR, true),
+    DEFINE_PROP_BIT("x-pcie-ari-nextfn-1", PCIDevice, cap_present,
+                    QEMU_PCIE_ARI_NEXTFN_1_BITNR, false),
     DEFINE_PROP_END_OF_LIST()
 };
 
diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index 6075ff5556..6db0cf69cd 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1041,7 +1041,7 @@ void pcie_sync_bridge_lnk(PCIDevice *bridge_dev)
 /* ARI */
 void pcie_ari_init(PCIDevice *dev, uint16_t offset)
 {
-    uint16_t nextfn = 1;
+    uint16_t nextfn = dev->cap_present & QEMU_PCIE_ARI_NEXTFN_1 ? 1 : 0;
 
     pcie_add_capability(dev, PCI_EXT_CAP_ID_ARI, PCI_ARI_VER,
                         offset, PCI_ARI_SIZEOF);
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index ab2bd65a3a..abdc1ef103 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -209,6 +209,8 @@ enum {
     QEMU_PCIE_CAP_CXL = (1 << QEMU_PCIE_CXL_BITNR),
 #define QEMU_PCIE_ERR_UNC_MASK_BITNR 11
     QEMU_PCIE_ERR_UNC_MASK = (1 << QEMU_PCIE_ERR_UNC_MASK_BITNR),
+#define QEMU_PCIE_ARI_NEXTFN_1_BITNR 12
+    QEMU_PCIE_ARI_NEXTFN_1 = (1 << QEMU_PCIE_ARI_NEXTFN_1_BITNR),
 };
 
 typedef struct PCIINTxRoute {

From 2848c6aa7536fb48a57f38dabed1dce97fb45c6f Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:28 +0800
Subject: [PATCH 0735/1353] vdpa: Use iovec for vhost_vdpa_net_load_cmd()

According to VirtIO standard, "The driver MUST follow
the VIRTIO_NET_CTRL_MAC_TABLE_SET command by a le32 number,
followed by that number of non-multicast MAC addresses,
followed by another le32 number, followed by that number
of multicast addresses."

Considering that these data is not stored in contiguous memory,
this patch refactors vhost_vdpa_net_load_cmd() to accept
scattered data, eliminating the need for an addtional data copy or
packing the data into s->cvq_cmd_out_buffer outside of
vhost_vdpa_net_load_cmd().

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <3482cc50eebd13db4140b8b5dec9d0cc25b20b1b.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 33 +++++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 5542b47a8f..e192217a96 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -626,29 +626,38 @@ static ssize_t vhost_vdpa_net_cvq_add(VhostVDPAState *s, size_t out_len,
 }
 
 static ssize_t vhost_vdpa_net_load_cmd(VhostVDPAState *s, uint8_t class,
-                                       uint8_t cmd, const void *data,
-                                       size_t data_size)
+                                       uint8_t cmd, const struct iovec *data_sg,
+                                       size_t data_num)
 {
     const struct virtio_net_ctrl_hdr ctrl = {
         .class = class,
         .cmd = cmd,
     };
+    size_t data_size = iov_size(data_sg, data_num);
 
     assert(data_size < vhost_vdpa_net_cvq_cmd_page_len() - sizeof(ctrl));
 
+    /* pack the CVQ command header */
     memcpy(s->cvq_cmd_out_buffer, &ctrl, sizeof(ctrl));
-    memcpy(s->cvq_cmd_out_buffer + sizeof(ctrl), data, data_size);
 
-    return vhost_vdpa_net_cvq_add(s, sizeof(ctrl) + data_size,
+    /* pack the CVQ command command-specific-data */
+    iov_to_buf(data_sg, data_num, 0,
+               s->cvq_cmd_out_buffer + sizeof(ctrl), data_size);
+
+    return vhost_vdpa_net_cvq_add(s, data_size + sizeof(ctrl),
                                   sizeof(virtio_net_ctrl_ack));
 }
 
 static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
 {
     if (virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
+        const struct iovec data = {
+            .iov_base = (void *)n->mac,
+            .iov_len = sizeof(n->mac),
+        };
         ssize_t dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MAC,
                                                   VIRTIO_NET_CTRL_MAC_ADDR_SET,
-                                                  n->mac, sizeof(n->mac));
+                                                  &data, 1);
         if (unlikely(dev_written < 0)) {
             return dev_written;
         }
@@ -671,9 +680,13 @@ static int vhost_vdpa_net_load_mq(VhostVDPAState *s,
     }
 
     mq.virtqueue_pairs = cpu_to_le16(n->curr_queue_pairs);
+    const struct iovec data = {
+        .iov_base = &mq,
+        .iov_len = sizeof(mq),
+    };
     dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_MQ,
-                                          VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &mq,
-                                          sizeof(mq));
+                                          VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET,
+                                          &data, 1);
     if (unlikely(dev_written < 0)) {
         return dev_written;
     }
@@ -712,9 +725,13 @@ static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
     }
 
     offloads = cpu_to_le64(n->curr_guest_offloads);
+    const struct iovec data = {
+        .iov_base = &offloads,
+        .iov_len = sizeof(offloads),
+    };
     dev_written = vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
                                           VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET,
-                                          &offloads, sizeof(offloads));
+                                          &data, 1);
     if (unlikely(dev_written < 0)) {
         return dev_written;
     }

From 0ddcecb8f2e14b5aa6781ae3403ffa2ac4b25197 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:29 +0800
Subject: [PATCH 0736/1353] vdpa: Restore MAC address filtering state

This patch refactors vhost_vdpa_net_load_mac() to
restore the MAC address filtering state at device's startup.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <4b9550c14bc8c98c8f48e04dbf3d3ac41489d3fd.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index e192217a96..126afbc7a5 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -666,6 +666,58 @@ static int vhost_vdpa_net_load_mac(VhostVDPAState *s, const VirtIONet *n)
         }
     }
 
+    /*
+     * According to VirtIO standard, "The device MUST have an
+     * empty MAC filtering table on reset.".
+     *
+     * Therefore, there is no need to send this CVQ command if the
+     * driver also sets an empty MAC filter table, which aligns with
+     * the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX) ||
+        n->mac_table.in_use == 0) {
+        return 0;
+    }
+
+    uint32_t uni_entries = n->mac_table.first_multi,
+             uni_macs_size = uni_entries * ETH_ALEN,
+             mul_entries = n->mac_table.in_use - uni_entries,
+             mul_macs_size = mul_entries * ETH_ALEN;
+    struct virtio_net_ctrl_mac uni = {
+        .entries = cpu_to_le32(uni_entries),
+    };
+    struct virtio_net_ctrl_mac mul = {
+        .entries = cpu_to_le32(mul_entries),
+    };
+    const struct iovec data[] = {
+        {
+            .iov_base = &uni,
+            .iov_len = sizeof(uni),
+        }, {
+            .iov_base = n->mac_table.macs,
+            .iov_len = uni_macs_size,
+        }, {
+            .iov_base = &mul,
+            .iov_len = sizeof(mul),
+        }, {
+            .iov_base = &n->mac_table.macs[uni_macs_size],
+            .iov_len = mul_macs_size,
+        },
+    };
+    ssize_t dev_written = vhost_vdpa_net_load_cmd(s,
+                                VIRTIO_NET_CTRL_MAC,
+                                VIRTIO_NET_CTRL_MAC_TABLE_SET,
+                                data, ARRAY_SIZE(data));
+    if (unlikely(dev_written < 0)) {
+        return dev_written;
+    }
+    if (*s->status != VIRTIO_NET_OK) {
+        return -EIO;
+    }
+
     return 0;
 }
 

From b12f907eeaad7bd4d282502bd7f7773f95e1ee96 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:30 +0800
Subject: [PATCH 0737/1353] vdpa: Restore packet receive filtering state
 relative with _F_CTRL_RX feature

This patch introduces vhost_vdpa_net_load_rx_mode()
and vhost_vdpa_net_load_rx() to restore the packet
receive filtering state in relation to
VIRTIO_NET_F_CTRL_RX feature at device's startup.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <804cedac93e19ba3b810d52b274ca5ec11469f09.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 126afbc7a5..f299e446b0 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -794,6 +794,87 @@ static int vhost_vdpa_net_load_offloads(VhostVDPAState *s,
     return 0;
 }
 
+static int vhost_vdpa_net_load_rx_mode(VhostVDPAState *s,
+                                       uint8_t cmd,
+                                       uint8_t on)
+{
+    const struct iovec data = {
+        .iov_base = &on,
+        .iov_len = sizeof(on),
+    };
+    return vhost_vdpa_net_load_cmd(s, VIRTIO_NET_CTRL_RX,
+                                   cmd, &data, 1);
+}
+
+static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
+                                  const VirtIONet *n)
+{
+    ssize_t dev_written;
+
+    if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX)) {
+        return 0;
+    }
+
+    /*
+     * According to virtio_net_reset(), device turns promiscuous mode
+     * on by default.
+     *
+     * Addtionally, according to VirtIO standard, "Since there are
+     * no guarantees, it can use a hash filter or silently switch to
+     * allmulti or promiscuous mode if it is given too many addresses.".
+     * QEMU marks `n->mac_table.uni_overflow` if guest sets too many
+     * non-multicast MAC addresses, indicating that promiscuous mode
+     * should be enabled.
+     *
+     * Therefore, QEMU should only send this CVQ command if the
+     * `n->mac_table.uni_overflow` is not marked and `n->promisc` is off,
+     * which sets promiscuous mode on, different from the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (!n->mac_table.uni_overflow && !n->promisc) {
+        dev_written = vhost_vdpa_net_load_rx_mode(s,
+                                            VIRTIO_NET_CTRL_RX_PROMISC, 0);
+        if (unlikely(dev_written < 0)) {
+            return dev_written;
+        }
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
+    }
+
+    /*
+     * According to virtio_net_reset(), device turns all-multicast mode
+     * off by default.
+     *
+     * According to VirtIO standard, "Since there are no guarantees,
+     * it can use a hash filter or silently switch to allmulti or
+     * promiscuous mode if it is given too many addresses.". QEMU marks
+     * `n->mac_table.multi_overflow` if guest sets too many
+     * non-multicast MAC addresses.
+     *
+     * Therefore, QEMU should only send this CVQ command if the
+     * `n->mac_table.multi_overflow` is marked or `n->allmulti` is on,
+     * which sets all-multicast mode on, different from the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (n->mac_table.multi_overflow || n->allmulti) {
+        dev_written = vhost_vdpa_net_load_rx_mode(s,
+                                            VIRTIO_NET_CTRL_RX_ALLMULTI, 1);
+        if (unlikely(dev_written < 0)) {
+            return dev_written;
+        }
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
+    }
+
+    return 0;
+}
+
 static int vhost_vdpa_net_load(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
@@ -820,6 +901,10 @@ static int vhost_vdpa_net_load(NetClientState *nc)
     if (unlikely(r)) {
         return r;
     }
+    r = vhost_vdpa_net_load_rx(s, n);
+    if (unlikely(r)) {
+        return r;
+    }
 
     return 0;
 }

From b77a5f22aca4cef2dc893ea544841bdd95dc83ba Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:31 +0800
Subject: [PATCH 0738/1353] vhost: Fix false positive out-of-bounds

QEMU uses vhost_svq_translate_addr() to translate addresses
between the QEMU's virtual address and the SVQ IOVA. In order
to validate this translation, QEMU checks whether the translated
range falls within the mapped range.

Yet the problem is that, the value of `needle_last`, which is calculated
by `needle.translated_addr + iovec[i].iov_len`, should represent the
exclusive boundary of the translated range, rather than the last
inclusive addresses of the range. Consequently, QEMU fails the check
when the translated range matches the size of the mapped range.

This patch solves this problem by fixing the `needle_last` value to
the last inclusive address of the translated range.

Note that this bug cannot be triggered at the moment, because QEMU
is unable to translate such a big range due to the truncation of
the CVQ command in vhost_vdpa_net_handle_ctrl_avail().

Fixes: 34e3c94eda ("vdpa: Add custom IOTLB translations to SVQ")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <ee31c5420ffc8e6a29705ddd30badb814ddbae1d.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-shadow-virtqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-shadow-virtqueue.c b/hw/virtio/vhost-shadow-virtqueue.c
index 1b1d85306c..49e5aed931 100644
--- a/hw/virtio/vhost-shadow-virtqueue.c
+++ b/hw/virtio/vhost-shadow-virtqueue.c
@@ -111,7 +111,7 @@ static bool vhost_svq_translate_addr(const VhostShadowVirtqueue *svq,
         addrs[i] = map->iova + off;
 
         needle_last = int128_add(int128_make64(needle.translated_addr),
-                                 int128_make64(iovec[i].iov_len));
+                                 int128_makes64(iovec[i].iov_len - 1));
         map_last = int128_make64(map->translated_addr + map->size);
         if (unlikely(int128_gt(needle_last, map_last))) {
             qemu_log_mask(LOG_GUEST_ERROR,

From 45c4101828a483b87863f2e2ba6d98faf0ff7d92 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:32 +0800
Subject: [PATCH 0739/1353] vdpa: Accessing CVQ header through its structure

We can access the CVQ header through `struct virtio_net_ctrl_hdr`,
instead of accessing it through a `uint8_t` pointer,
which improves the code's readability and maintainability.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <cd522e06a4371e9d6b8a1c1a86f90a92401d56e8.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index f299e446b0..eee4b2a09e 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -934,6 +934,7 @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
 {
     VhostVDPAState *s = opaque;
     size_t in_len;
+    const struct virtio_net_ctrl_hdr *ctrl;
     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
     /* Out buffer sent to both the vdpa device and the device model */
     struct iovec out = {
@@ -949,7 +950,9 @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
                              s->cvq_cmd_out_buffer,
                              vhost_vdpa_net_cvq_cmd_len());
-    if (*(uint8_t *)s->cvq_cmd_out_buffer == VIRTIO_NET_CTRL_ANNOUNCE) {
+
+    ctrl = s->cvq_cmd_out_buffer;
+    if (ctrl->class == VIRTIO_NET_CTRL_ANNOUNCE) {
         /*
          * Guest announce capability is emulated by qemu, so don't forward to
          * the device.

From fee364e4b1ad82a78929f3eed114321f77b6f916 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:33 +0800
Subject: [PATCH 0740/1353] vdpa: Avoid forwarding large CVQ command failures

Due to the size limitation of the out buffer sent to the vdpa device,
which is determined by vhost_vdpa_net_cvq_cmd_len(), excessive CVQ
command is truncated in QEMU. As a result, the vdpa device rejects
this flawd CVQ command.

However, the problem is that, the VIRTIO_NET_CTRL_MAC_TABLE_SET
CVQ command has a variable length, which may exceed
vhost_vdpa_net_cvq_cmd_len() if the guest sets more than
`MAC_TABLE_ENTRIES` MAC addresses for the filter table.

This patch solves this problem by following steps:

  * Increase the out buffer size to vhost_vdpa_net_cvq_cmd_page_len(),
which represents the size of the buffer that is allocated and mmaped.
This ensures that everything works correctly as long as the guest
sets fewer than `(vhost_vdpa_net_cvq_cmd_page_len() -
sizeof(struct virtio_net_ctrl_hdr)
- 2 * sizeof(struct virtio_net_ctrl_mac)) / ETH_ALEN` MAC addresses.
    Considering the highly unlikely scenario for the guest setting
more than that number of MAC addresses for the filter table, this
should work fine for the majority of cases.

  * If the CVQ command exceeds vhost_vdpa_net_cvq_cmd_page_len(),
instead of directly sending this CVQ command, QEMU should send
a VIRTIO_NET_CTRL_RX_PROMISC CVQ command to vdpa device. Addtionally,
a fake VIRTIO_NET_CTRL_MAC_TABLE_SET command including
(`MAC_TABLE_ENTRIES` + 1) non-multicast MAC addresses and
(`MAC_TABLE_ENTRIES` + 1) multicast MAC addresses should be provided
to the device model.
    By doing so, the vdpa device turns promiscuous mode on, aligning
with the VirtIO standard. The device model marks
`n->mac_table.uni_overflow` and `n->mac_table.multi_overflow`,
which aligns with the state of the vdpa device.

Note that the bug cannot be triggered at the moment, since
VIRTIO_NET_F_CTRL_RX feature is not enabled for SVQ.

Fixes: 7a7f87e94c ("vdpa: Move command buffers map to start of net device")
Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <267e15e4eed2d7aeb9887f193da99a13d22a2f1d.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 162 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 161 insertions(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index eee4b2a09e..7610589a60 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -922,6 +922,148 @@ static NetClientInfo net_vhost_vdpa_cvq_info = {
     .check_peer_type = vhost_vdpa_check_peer_type,
 };
 
+/*
+ * Forward the excessive VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command to
+ * vdpa device.
+ *
+ * Considering that QEMU cannot send the entire filter table to the
+ * vdpa device, it should send the VIRTIO_NET_CTRL_RX_PROMISC CVQ
+ * command to enable promiscuous mode to receive all packets,
+ * according to VirtIO standard, "Since there are no guarantees,
+ * it can use a hash filter or silently switch to allmulti or
+ * promiscuous mode if it is given too many addresses.".
+ *
+ * Since QEMU ignores MAC addresses beyond `MAC_TABLE_ENTRIES` and
+ * marks `n->mac_table.x_overflow` accordingly, it should have
+ * the same effect on the device model to receive
+ * (`MAC_TABLE_ENTRIES` + 1) or more non-multicast MAC addresses.
+ * The same applies to multicast MAC addresses.
+ *
+ * Therefore, QEMU can provide the device model with a fake
+ * VIRTIO_NET_CTRL_MAC_TABLE_SET command with (`MAC_TABLE_ENTRIES` + 1)
+ * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1) multicast
+ * MAC addresses. This ensures that the device model marks
+ * `n->mac_table.uni_overflow` and `n->mac_table.multi_overflow`,
+ * allowing all packets to be received, which aligns with the
+ * state of the vdpa device.
+ */
+static int vhost_vdpa_net_excessive_mac_filter_cvq_add(VhostVDPAState *s,
+                                                       VirtQueueElement *elem,
+                                                       struct iovec *out)
+{
+    struct virtio_net_ctrl_mac mac_data, *mac_ptr;
+    struct virtio_net_ctrl_hdr *hdr_ptr;
+    uint32_t cursor;
+    ssize_t r;
+
+    /* parse the non-multicast MAC address entries from CVQ command */
+    cursor = sizeof(*hdr_ptr);
+    r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
+                   &mac_data, sizeof(mac_data));
+    if (unlikely(r != sizeof(mac_data))) {
+        /*
+         * If the CVQ command is invalid, we should simulate the vdpa device
+         * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
+         */
+        *s->status = VIRTIO_NET_ERR;
+        return sizeof(*s->status);
+    }
+    cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
+
+    /* parse the multicast MAC address entries from CVQ command */
+    r = iov_to_buf(elem->out_sg, elem->out_num, cursor,
+                   &mac_data, sizeof(mac_data));
+    if (r != sizeof(mac_data)) {
+        /*
+         * If the CVQ command is invalid, we should simulate the vdpa device
+         * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
+         */
+        *s->status = VIRTIO_NET_ERR;
+        return sizeof(*s->status);
+    }
+    cursor += sizeof(mac_data) + le32_to_cpu(mac_data.entries) * ETH_ALEN;
+
+    /* validate the CVQ command */
+    if (iov_size(elem->out_sg, elem->out_num) != cursor) {
+        /*
+         * If the CVQ command is invalid, we should simulate the vdpa device
+         * to reject the VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
+         */
+        *s->status = VIRTIO_NET_ERR;
+        return sizeof(*s->status);
+    }
+
+    /*
+     * According to VirtIO standard, "Since there are no guarantees,
+     * it can use a hash filter or silently switch to allmulti or
+     * promiscuous mode if it is given too many addresses.".
+     *
+     * Therefore, considering that QEMU is unable to send the entire
+     * filter table to the vdpa device, it should send the
+     * VIRTIO_NET_CTRL_RX_PROMISC CVQ command to enable promiscuous mode
+     */
+    r = vhost_vdpa_net_load_rx_mode(s, VIRTIO_NET_CTRL_RX_PROMISC, 1);
+    if (unlikely(r < 0)) {
+        return r;
+    }
+    if (*s->status != VIRTIO_NET_OK) {
+        return sizeof(*s->status);
+    }
+
+    /*
+     * QEMU should also send a fake VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ
+     * command to the device model, including (`MAC_TABLE_ENTRIES` + 1)
+     * non-multicast MAC addresses and (`MAC_TABLE_ENTRIES` + 1)
+     * multicast MAC addresses.
+     *
+     * By doing so, the device model can mark `n->mac_table.uni_overflow`
+     * and `n->mac_table.multi_overflow`, enabling all packets to be
+     * received, which aligns with the state of the vdpa device.
+     */
+    cursor = 0;
+    uint32_t fake_uni_entries = MAC_TABLE_ENTRIES + 1,
+             fake_mul_entries = MAC_TABLE_ENTRIES + 1,
+             fake_cvq_size = sizeof(struct virtio_net_ctrl_hdr) +
+                             sizeof(mac_data) + fake_uni_entries * ETH_ALEN +
+                             sizeof(mac_data) + fake_mul_entries * ETH_ALEN;
+
+    assert(fake_cvq_size < vhost_vdpa_net_cvq_cmd_page_len());
+    out->iov_len = fake_cvq_size;
+
+    /* pack the header for fake CVQ command */
+    hdr_ptr = out->iov_base + cursor;
+    hdr_ptr->class = VIRTIO_NET_CTRL_MAC;
+    hdr_ptr->cmd = VIRTIO_NET_CTRL_MAC_TABLE_SET;
+    cursor += sizeof(*hdr_ptr);
+
+    /*
+     * Pack the non-multicast MAC addresses part for fake CVQ command.
+     *
+     * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
+     * addresses provieded in CVQ command. Therefore, only the entries
+     * field need to be prepared in the CVQ command.
+     */
+    mac_ptr = out->iov_base + cursor;
+    mac_ptr->entries = cpu_to_le32(fake_uni_entries);
+    cursor += sizeof(*mac_ptr) + fake_uni_entries * ETH_ALEN;
+
+    /*
+     * Pack the multicast MAC addresses part for fake CVQ command.
+     *
+     * According to virtio_net_handle_mac(), QEMU doesn't verify the MAC
+     * addresses provieded in CVQ command. Therefore, only the entries
+     * field need to be prepared in the CVQ command.
+     */
+    mac_ptr = out->iov_base + cursor;
+    mac_ptr->entries = cpu_to_le32(fake_mul_entries);
+
+    /*
+     * Simulating QEMU poll a vdpa device used buffer
+     * for VIRTIO_NET_CTRL_MAC_TABLE_SET CVQ command
+     */
+    return sizeof(*s->status);
+}
+
 /**
  * Validate and copy control virtqueue commands.
  *
@@ -949,7 +1091,7 @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
 
     out.iov_len = iov_to_buf(elem->out_sg, elem->out_num, 0,
                              s->cvq_cmd_out_buffer,
-                             vhost_vdpa_net_cvq_cmd_len());
+                             vhost_vdpa_net_cvq_cmd_page_len());
 
     ctrl = s->cvq_cmd_out_buffer;
     if (ctrl->class == VIRTIO_NET_CTRL_ANNOUNCE) {
@@ -959,6 +1101,24 @@ static int vhost_vdpa_net_handle_ctrl_avail(VhostShadowVirtqueue *svq,
          */
         dev_written = sizeof(status);
         *s->status = VIRTIO_NET_OK;
+    } else if (unlikely(ctrl->class == VIRTIO_NET_CTRL_MAC &&
+                        ctrl->cmd == VIRTIO_NET_CTRL_MAC_TABLE_SET &&
+                        iov_size(elem->out_sg, elem->out_num) > out.iov_len)) {
+        /*
+         * Due to the size limitation of the out buffer sent to the vdpa device,
+         * which is determined by vhost_vdpa_net_cvq_cmd_page_len(), excessive
+         * MAC addresses set by the driver for the filter table can cause
+         * truncation of the CVQ command in QEMU. As a result, the vdpa device
+         * rejects the flawed CVQ command.
+         *
+         * Therefore, QEMU must handle this situation instead of sending
+         * the CVQ command direclty.
+         */
+        dev_written = vhost_vdpa_net_excessive_mac_filter_cvq_add(s, elem,
+                                                                  &out);
+        if (unlikely(dev_written < 0)) {
+            goto out;
+        }
     } else {
         dev_written = vhost_vdpa_net_cvq_add(s, out.iov_len, sizeof(status));
         if (unlikely(dev_written < 0)) {

From ea6eec497921f9c0db259445fc44429a743d0665 Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Fri, 7 Jul 2023 23:27:34 +0800
Subject: [PATCH 0741/1353] vdpa: Allow VIRTIO_NET_F_CTRL_RX in SVQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable SVQ with VIRTIO_NET_F_CTRL_RX feature.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <5d6173a6d7c4c514c98362b404c019f52d73b06c.1688743107.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 7610589a60..5cd671bfb9 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -110,6 +110,7 @@ static const uint64_t vdpa_svq_device_features =
     BIT_ULL(VIRTIO_NET_F_MRG_RXBUF) |
     BIT_ULL(VIRTIO_NET_F_STATUS) |
     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
+    BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
     BIT_ULL(VIRTIO_NET_F_MQ) |
     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |

From 4fd180c7bb476d0793f3849ae4e6c0f932b6e3ab Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Sat, 8 Jul 2023 17:24:51 +0800
Subject: [PATCH 0742/1353] vdpa: Restore packet receive filtering state
 relative with _F_CTRL_RX_EXTRA feature

This patch refactors vhost_vdpa_net_load_rx() to
restore the packet receive filtering state in relation to
VIRTIO_NET_F_CTRL_RX_EXTRA feature at device's startup.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Message-Id: <abddc477a476f756de6e3d24c0e9f7b21c99a4c1.1688797728.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 5cd671bfb9..0c1c0760a7 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -873,6 +873,94 @@ static int vhost_vdpa_net_load_rx(VhostVDPAState *s,
         }
     }
 
+    if (!virtio_vdev_has_feature(&n->parent_obj, VIRTIO_NET_F_CTRL_RX_EXTRA)) {
+        return 0;
+    }
+
+    /*
+     * According to virtio_net_reset(), device turns all-unicast mode
+     * off by default.
+     *
+     * Therefore, QEMU should only send this CVQ command if the driver
+     * sets all-unicast mode on, different from the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (n->alluni) {
+        dev_written = vhost_vdpa_net_load_rx_mode(s,
+                                            VIRTIO_NET_CTRL_RX_ALLUNI, 1);
+        if (dev_written < 0) {
+            return dev_written;
+        }
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
+    }
+
+    /*
+     * According to virtio_net_reset(), device turns non-multicast mode
+     * off by default.
+     *
+     * Therefore, QEMU should only send this CVQ command if the driver
+     * sets non-multicast mode on, different from the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (n->nomulti) {
+        dev_written = vhost_vdpa_net_load_rx_mode(s,
+                                            VIRTIO_NET_CTRL_RX_NOMULTI, 1);
+        if (dev_written < 0) {
+            return dev_written;
+        }
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
+    }
+
+    /*
+     * According to virtio_net_reset(), device turns non-unicast mode
+     * off by default.
+     *
+     * Therefore, QEMU should only send this CVQ command if the driver
+     * sets non-unicast mode on, different from the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (n->nouni) {
+        dev_written = vhost_vdpa_net_load_rx_mode(s,
+                                            VIRTIO_NET_CTRL_RX_NOUNI, 1);
+        if (dev_written < 0) {
+            return dev_written;
+        }
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
+    }
+
+    /*
+     * According to virtio_net_reset(), device turns non-broadcast mode
+     * off by default.
+     *
+     * Therefore, QEMU should only send this CVQ command if the driver
+     * sets non-broadcast mode on, different from the device's defaults.
+     *
+     * Note that the device's defaults can mismatch the driver's
+     * configuration only at live migration.
+     */
+    if (n->nobcast) {
+        dev_written = vhost_vdpa_net_load_rx_mode(s,
+                                            VIRTIO_NET_CTRL_RX_NOBCAST, 1);
+        if (dev_written < 0) {
+            return dev_written;
+        }
+        if (*s->status != VIRTIO_NET_OK) {
+            return -EIO;
+        }
+    }
+
     return 0;
 }
 

From d669b7bba22d45cb9e5926d63541e52bde1655dd Mon Sep 17 00:00:00 2001
From: Hawkins Jiawei <yin31149@gmail.com>
Date: Sat, 8 Jul 2023 17:24:52 +0800
Subject: [PATCH 0743/1353] vdpa: Allow VIRTIO_NET_F_CTRL_RX_EXTRA in SVQ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable SVQ with VIRTIO_NET_F_CTRL_RX_EXTRA feature.

Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <15ecc49975f9b8d1316ed4296879564a18abf31e.1688797728.git.yin31149@gmail.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 net/vhost-vdpa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index 0c1c0760a7..9795306742 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -111,6 +111,7 @@ static const uint64_t vdpa_svq_device_features =
     BIT_ULL(VIRTIO_NET_F_STATUS) |
     BIT_ULL(VIRTIO_NET_F_CTRL_VQ) |
     BIT_ULL(VIRTIO_NET_F_CTRL_RX) |
+    BIT_ULL(VIRTIO_NET_F_CTRL_RX_EXTRA) |
     BIT_ULL(VIRTIO_NET_F_MQ) |
     BIT_ULL(VIRTIO_F_ANY_LAYOUT) |
     BIT_ULL(VIRTIO_NET_F_CTRL_MAC_ADDR) |

From e3e477c3bca0beaf9326e0213d52ad4be804fb73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 13:06:19 +0200
Subject: [PATCH 0744/1353] configure: Fix cross-building for RISCV host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While when building on native Linux the host architecture
is reported as "riscv32" or "riscv64":

  Host machine cpu family: riscv64
  Host machine cpu: riscv64
  Found pkg-config: /usr/bin/pkg-config (0.29.2)

Since commit ba0e733362 ("configure: Merge riscv32 and riscv64
host architectures"), when cross-compiling it is detected as
"riscv". Meson handles the cross-detection but displays a warning:

  WARNING: Unknown CPU family riscv, please report this at https://github.com/mesonbuild/meson/issues/new
  Host machine cpu family: riscv
  Host machine cpu: riscv
  Target machine cpu family: riscv
  Target machine cpu: riscv
  Found pkg-config: /usr/bin/riscv64-linux-gnu-pkg-config (1.8.1)

Now since commit 278c1bcef5 ("target/riscv: Only unify 'riscv32/64'
-> 'riscv' for host cpu in meson") Meson expects the cpu to be in
[riscv32, riscv64]. So when cross-building (for example on our
cross-riscv64-system Gitlab-CI job) we get:

  WARNING: Unknown CPU family riscv, please report this at https://github.com/mesonbuild/meson/issues/new
  Host machine cpu family: riscv
  Host machine cpu: riscv
  Target machine cpu family: riscv
  Target machine cpu: riscv
  ../meson.build:684:6: ERROR: Problem encountered: Unsupported CPU riscv, try --enable-tcg-interpreter

Fix by partially revert commit ba0e733362 so when cross-building
the ./configure script passes the proper host architecture to meson.

Fixes: ba0e733362 ("configure: Merge riscv32 and riscv64 host architectures")
Fixes: 278c1bcef5 ("target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson")
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230711110619.56588-1-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/configure b/configure
index 2b41c49c0d..dffd44c059 100755
--- a/configure
+++ b/configure
@@ -451,7 +451,11 @@ elif check_define __s390__ ; then
     cpu="s390"
   fi
 elif check_define __riscv ; then
-  cpu="riscv"
+  if check_define _LP64 ; then
+    cpu="riscv64"
+  else
+    cpu="riscv32"
+  fi
 elif check_define __arm__ ; then
   cpu="arm"
 elif check_define __aarch64__ ; then

From 887cba855bb6ff4775256f7968409281350b568c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 17:56:09 +0100
Subject: [PATCH 0745/1353] configure: Fix cross-building for RISCV host (v5)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update $linux_arch to keep using the shared linux-headers/asm-riscv/
include path.

Fixes: e3e477c3bca0 ("configure: Fix cross-building for RISCV host")
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[rth: Missed v5, so now applying the diff between v4 and v5.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/configure b/configure
index dffd44c059..26ec5e4f54 100755
--- a/configure
+++ b/configure
@@ -1726,6 +1726,9 @@ if test "$linux" = "yes" ; then
   mips64)
     linux_arch=mips
     ;;
+  riscv32|riscv64)
+    linux_arch=riscv
+    ;;
   *)
     # For most CPUs the kernel architecture name and QEMU CPU name match.
     linux_arch="$cpu"

From 99d88de6eb577ff70cc1b1ed59f1a50f16038c2e Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:44 +0200
Subject: [PATCH 0746/1353] memory-device: Unify enabled vs. supported error
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's unify the error messages, such that we can simply stop allocating
ms->device_memory if the size would be 0 (and there are no memory
devices ever).

The case of "not supported by the machine" should barely pop up either
way: if the machine doesn't support memory devices, it usually doesn't
call the pre_plug handler ...

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-2-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/mem/memory-device.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/hw/mem/memory-device.c b/hw/mem/memory-device.c
index 1636db9679..49f86ec8a8 100644
--- a/hw/mem/memory-device.c
+++ b/hw/mem/memory-device.c
@@ -104,15 +104,10 @@ static uint64_t memory_device_get_free_addr(MachineState *ms,
     GSList *list = NULL, *item;
     Range as, new = range_empty;
 
-    if (!ms->device_memory) {
-        error_setg(errp, "memory devices (e.g. for memory hotplug) are not "
-                         "supported by the machine");
-        return 0;
-    }
-
-    if (!memory_region_size(&ms->device_memory->mr)) {
-        error_setg(errp, "memory devices (e.g. for memory hotplug) are not "
-                         "enabled, please specify the maxmem option");
+    if (!ms->device_memory || !memory_region_size(&ms->device_memory->mr)) {
+        error_setg(errp, "the configuration is not prepared for memory devices"
+                         " (e.g., for memory hotplug), consider specifying the"
+                         " maxmem option");
         return 0;
     }
     range_init_nofail(&as, ms->device_memory->base,

From cc0afd8a72996352e9f3f11b1cdde49b08aa11b6 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:45 +0200
Subject: [PATCH 0747/1353] memory-device: Introduce
 machine_memory_devices_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's intrduce a new helper that we will use to replace existing memory
device setup code during machine initialization. We'll enforce that the
size has to be > 0.

Once all machines were converted, we'll only allocate ms->device_memory
if the size > 0.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-3-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/mem/memory-device.c | 14 ++++++++++++++
 include/hw/boards.h    |  1 +
 2 files changed, 15 insertions(+)

diff --git a/hw/mem/memory-device.c b/hw/mem/memory-device.c
index 49f86ec8a8..bb9d7c2a20 100644
--- a/hw/mem/memory-device.c
+++ b/hw/mem/memory-device.c
@@ -17,6 +17,7 @@
 #include "qemu/range.h"
 #include "hw/virtio/vhost.h"
 #include "sysemu/kvm.h"
+#include "exec/address-spaces.h"
 #include "trace.h"
 
 static gint memory_device_addr_sort(gconstpointer a, gconstpointer b)
@@ -328,6 +329,19 @@ uint64_t memory_device_get_region_size(const MemoryDeviceState *md,
     return memory_region_size(mr);
 }
 
+void machine_memory_devices_init(MachineState *ms, hwaddr base, uint64_t size)
+{
+    g_assert(size);
+    g_assert(!ms->device_memory);
+    ms->device_memory = g_new0(DeviceMemoryState, 1);
+    ms->device_memory->base = base;
+
+    memory_region_init(&ms->device_memory->mr, OBJECT(ms), "device-memory",
+                       size);
+    memory_region_add_subregion(get_system_memory(), ms->device_memory->base,
+                                &ms->device_memory->mr);
+}
+
 static const TypeInfo memory_device_info = {
     .name          = TYPE_MEMORY_DEVICE,
     .parent        = TYPE_INTERFACE,
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 12d9e9d17c..3b7c30e853 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -37,6 +37,7 @@ void machine_parse_smp_config(MachineState *ms,
                               const SMPConfiguration *config, Error **errp);
 unsigned int machine_topo_get_cores_per_socket(const MachineState *ms);
 unsigned int machine_topo_get_threads_per_socket(const MachineState *ms);
+void machine_memory_devices_init(MachineState *ms, hwaddr base, uint64_t size);
 
 /**
  * machine_class_allow_dynamic_sysbus_dev: Add type to list of valid devices

From 176d073029083dd52e28e92c5712d0535a83c34d Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:46 +0200
Subject: [PATCH 0748/1353] hw/arm/virt: Use machine_memory_devices_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's use our new helper. We'll add the subregion to system RAM now
earlier. That shouldn't matter, because the system RAM memory region should
already be alive at that point.

Cc: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-4-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/arm/virt.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 8a4c663735..0546e43448 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1813,10 +1813,7 @@ static void virt_set_memmap(VirtMachineState *vms, int pa_bits)
     virt_set_high_memmap(vms, base, pa_bits);
 
     if (device_memory_size > 0) {
-        ms->device_memory = g_malloc0(sizeof(*ms->device_memory));
-        ms->device_memory->base = device_memory_base;
-        memory_region_init(&ms->device_memory->mr, OBJECT(vms),
-                           "device-memory", device_memory_size);
+        machine_memory_devices_init(ms, device_memory_base, device_memory_size);
     }
 }
 
@@ -2257,10 +2254,6 @@ static void machvirt_init(MachineState *machine)
 
     memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base,
                                 machine->ram);
-    if (machine->device_memory) {
-        memory_region_add_subregion(sysmem, machine->device_memory->base,
-                                    &machine->device_memory->mr);
-    }
 
     virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 

From c0ce7b4acb61c6a8376ff9e0d5cae2d58ac3bf1b Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:47 +0200
Subject: [PATCH 0749/1353] hw/ppc/spapr: Use machine_memory_devices_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's use our new helper and stop always allocating ms->device_memory.
There is no difference in common memory-device code anymore between
ms->device_memory being NULL or the size being 0. So we only have to
teach spapr code that ms->device_memory isn't always around.

We can now modify two maxram_size checks to rely on ms->device_memory
for detecting whether we have memory devices.

Cc: Daniel Henrique Barboza <danielhb413@gmail.com>
Cc: "Cédric Le Goater" <clg@kaod.org>
Cc: David Gibson <david@gibson.dropbear.id.au>
Cc: Greg Kurz <groug@kaod.org>
Cc: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-5-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/ppc/spapr.c       | 37 +++++++++++++++++++------------------
 hw/ppc/spapr_hcall.c |  2 +-
 2 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 54dbfd7fe9..1c8b8d57a7 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -547,10 +547,8 @@ static int spapr_dt_dynamic_reconfiguration_memory(SpaprMachineState *spapr,
                                 cpu_to_be32(lmb_size & 0xffffffff)};
     MemoryDeviceInfoList *dimms = NULL;
 
-    /*
-     * Don't create the node if there is no device memory
-     */
-    if (machine->ram_size == machine->maxram_size) {
+    /* Don't create the node if there is no device memory. */
+    if (!machine->device_memory) {
         return 0;
     }
 
@@ -860,16 +858,23 @@ static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
     int rtas;
     GString *hypertas = g_string_sized_new(256);
     GString *qemu_hypertas = g_string_sized_new(256);
-    uint64_t max_device_addr = MACHINE(spapr)->device_memory->base +
-        memory_region_size(&MACHINE(spapr)->device_memory->mr);
     uint32_t lrdr_capacity[] = {
-        cpu_to_be32(max_device_addr >> 32),
-        cpu_to_be32(max_device_addr & 0xffffffff),
+        0,
+        0,
         cpu_to_be32(SPAPR_MEMORY_BLOCK_SIZE >> 32),
         cpu_to_be32(SPAPR_MEMORY_BLOCK_SIZE & 0xffffffff),
         cpu_to_be32(ms->smp.max_cpus / ms->smp.threads),
     };
 
+    /* Do we have device memory? */
+    if (MACHINE(spapr)->device_memory) {
+        uint64_t max_device_addr = MACHINE(spapr)->device_memory->base +
+            memory_region_size(&MACHINE(spapr)->device_memory->mr);
+
+        lrdr_capacity[0] = cpu_to_be32(max_device_addr >> 32);
+        lrdr_capacity[1] = cpu_to_be32(max_device_addr & 0xffffffff);
+    }
+
     _FDT(rtas = fdt_add_subnode(fdt, 0, "rtas"));
 
     /* hypertas */
@@ -2455,6 +2460,7 @@ static void spapr_create_lmb_dr_connectors(SpaprMachineState *spapr)
     uint32_t nr_lmbs = (machine->maxram_size - machine->ram_size)/lmb_size;
     int i;
 
+    g_assert(!nr_lmbs || machine->device_memory);
     for (i = 0; i < nr_lmbs; i++) {
         uint64_t addr;
 
@@ -2876,12 +2882,11 @@ static void spapr_machine_init(MachineState *machine)
     /* map RAM */
     memory_region_add_subregion(sysmem, 0, machine->ram);
 
-    /* always allocate the device memory information */
-    machine->device_memory = g_malloc0(sizeof(*machine->device_memory));
-
     /* initialize hotplug memory address space */
     if (machine->ram_size < machine->maxram_size) {
         ram_addr_t device_mem_size = machine->maxram_size - machine->ram_size;
+        hwaddr device_mem_base;
+
         /*
          * Limit the number of hotpluggable memory slots to half the number
          * slots that KVM supports, leaving the other half for PCI and other
@@ -2900,12 +2905,8 @@ static void spapr_machine_init(MachineState *machine)
             exit(1);
         }
 
-        machine->device_memory->base = ROUND_UP(machine->ram_size,
-                                                SPAPR_DEVICE_MEM_ALIGN);
-        memory_region_init(&machine->device_memory->mr, OBJECT(spapr),
-                           "device-memory", device_mem_size);
-        memory_region_add_subregion(sysmem, machine->device_memory->base,
-                                    &machine->device_memory->mr);
+        device_mem_base = ROUND_UP(machine->ram_size, SPAPR_DEVICE_MEM_ALIGN);
+        machine_memory_devices_init(machine, device_mem_base, device_mem_size);
     }
 
     if (smc->dr_lmb_enabled) {
@@ -5119,7 +5120,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
     int i;
 
     /* Do we have device memory? */
-    if (MACHINE(spapr)->maxram_size > ram_top) {
+    if (MACHINE(spapr)->device_memory) {
         /* Can't just use maxram_size, because there may be an
          * alignment gap between normal and device memory regions
          */
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 002ea0b7c1..9b1f225d4a 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -32,7 +32,7 @@ bool is_ram_address(SpaprMachineState *spapr, hwaddr addr)
     if (addr < machine->ram_size) {
         return true;
     }
-    if ((addr >= dms->base)
+    if (dms && (addr >= dms->base)
         && ((addr - dms->base) < memory_region_size(&dms->mr))) {
         return true;
     }

From b13e115ff497581c60c94d4afca33225b1f69faf Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:48 +0200
Subject: [PATCH 0750/1353] hw/loongarch/virt: Use
 machine_memory_devices_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's use our new helper. While at it, use VIRT_HIGHMEM_BASE.

Cc: Xiaojuan Yang <yangxiaojuan@loongson.cn>
Cc: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-6-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/loongarch/virt.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 51a453fa9a..e19b042ce8 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -857,8 +857,8 @@ static void loongarch_init(MachineState *machine)
 
     /* initialize device memory address space */
     if (machine->ram_size < machine->maxram_size) {
-        machine->device_memory = g_malloc0(sizeof(*machine->device_memory));
         ram_addr_t device_mem_size = machine->maxram_size - machine->ram_size;
+        hwaddr device_mem_base;
 
         if (machine->ram_slots > ACPI_MAX_RAM_SLOTS) {
             error_report("unsupported amount of memory slots: %"PRIu64,
@@ -873,14 +873,8 @@ static void loongarch_init(MachineState *machine)
             exit(EXIT_FAILURE);
         }
         /* device memory base is the top of high memory address. */
-        machine->device_memory->base = 0x90000000 + highram_size;
-        machine->device_memory->base =
-            ROUND_UP(machine->device_memory->base, 1 * GiB);
-
-        memory_region_init(&machine->device_memory->mr, OBJECT(lams),
-                           "device-memory", device_mem_size);
-        memory_region_add_subregion(address_space_mem, machine->device_memory->base,
-                                    &machine->device_memory->mr);
+        device_mem_base = ROUND_UP(VIRT_HIGHMEM_BASE + highram_size, 1 * GiB);
+        machine_memory_devices_init(machine, device_mem_base, device_mem_size);
     }
 
     /* Add isa io region */

From 78732a765986d5270d6b3d88afeb9e4d33092360 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:49 +0200
Subject: [PATCH 0751/1353] hw/i386/pc: Use machine_memory_devices_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's use our new helper and stop always allocating ms->device_memory.
Once allcoated, we're sure that the size > 0 and that the base was
initialized.

Adjust the code in pc_memory_init() to check for machine->device_memory
instead of pcmc->has_reserved_memory and machine->device_memory->base.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Eduardo Habkost <eduardo@habkost.net>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-7-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/i386/pc.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index f01d7de5ad..55a49a9028 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1039,13 +1039,11 @@ void pc_memory_init(PCMachineState *pcms,
         exit(EXIT_FAILURE);
     }
 
-    /* always allocate the device memory information */
-    machine->device_memory = g_malloc0(sizeof(*machine->device_memory));
-
     /* initialize device memory address space */
     if (pcmc->has_reserved_memory &&
         (machine->ram_size < machine->maxram_size)) {
         ram_addr_t device_mem_size;
+        hwaddr device_mem_base;
 
         if (machine->ram_slots > ACPI_MAX_RAM_SLOTS) {
             error_report("unsupported amount of memory slots: %"PRIu64,
@@ -1060,19 +1058,14 @@ void pc_memory_init(PCMachineState *pcms,
             exit(EXIT_FAILURE);
         }
 
-        pc_get_device_memory_range(pcms, &machine->device_memory->base, &device_mem_size);
+        pc_get_device_memory_range(pcms, &device_mem_base, &device_mem_size);
 
-        if ((machine->device_memory->base + device_mem_size) <
-            device_mem_size) {
+        if (device_mem_base + device_mem_size < device_mem_size) {
             error_report("unsupported amount of maximum memory: " RAM_ADDR_FMT,
                          machine->maxram_size);
             exit(EXIT_FAILURE);
         }
-
-        memory_region_init(&machine->device_memory->mr, OBJECT(pcms),
-                           "device-memory", device_mem_size);
-        memory_region_add_subregion(system_memory, machine->device_memory->base,
-                                    &machine->device_memory->mr);
+        machine_memory_devices_init(machine, device_mem_base, device_mem_size);
     }
 
     if (pcms->cxl_devices_state.is_enabled) {
@@ -1120,7 +1113,7 @@ void pc_memory_init(PCMachineState *pcms,
 
     rom_set_fw(fw_cfg);
 
-    if (pcmc->has_reserved_memory && machine->device_memory->base) {
+    if (machine->device_memory) {
         uint64_t *val = g_malloc(sizeof(*val));
         PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
         uint64_t res_mem_end = machine->device_memory->base;

From 75d5f34396c7f951f99a8c9800db29b4a98c8f67 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:50 +0200
Subject: [PATCH 0752/1353] hw/i386/acpi-build: Rely on machine->device_memory
 when building SRAT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We're already looking at machine->device_memory when calling
build_srat_memory(), so let's simply avoid going via
PC_MACHINE_DEVMEM_REGION_SIZE to get the size and rely on
machine->device_memory directly.

Once machine->device_memory is set, we know that the size > 0. The code now
looks much more similar the hw/arm/virt-acpi-build.c variant.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Eduardo Habkost <eduardo@habkost.net>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-8-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/i386/acpi-build.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 512162003b..9c74fa17ad 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1950,12 +1950,8 @@ build_srat(GArray *table_data, BIOSLinker *linker, MachineState *machine)
     MachineClass *mc = MACHINE_GET_CLASS(machine);
     X86MachineState *x86ms = X86_MACHINE(machine);
     const CPUArchIdList *apic_ids = mc->possible_cpu_arch_ids(machine);
-    PCMachineState *pcms = PC_MACHINE(machine);
     int nb_numa_nodes = machine->numa_state->num_nodes;
     NodeInfo *numa_info = machine->numa_state->nodes;
-    ram_addr_t hotpluggable_address_space_size =
-        object_property_get_int(OBJECT(pcms), PC_MACHINE_DEVMEM_REGION_SIZE,
-                                NULL);
     AcpiTable table = { .sig = "SRAT", .rev = 1, .oem_id = x86ms->oem_id,
                         .oem_table_id = x86ms->oem_table_id };
 
@@ -2071,9 +2067,10 @@ build_srat(GArray *table_data, BIOSLinker *linker, MachineState *machine)
      * Memory devices may override proximity set by this entry,
      * providing _PXM method if necessary.
      */
-    if (hotpluggable_address_space_size) {
+    if (machine->device_memory) {
         build_srat_memory(table_data, machine->device_memory->base,
-                          hotpluggable_address_space_size, nb_numa_nodes - 1,
+                          memory_region_size(&machine->device_memory->mr),
+                          nb_numa_nodes - 1,
                           MEM_AFFINITY_HOTPLUGGABLE | MEM_AFFINITY_ENABLED);
     }
 

From a8e67ce35b74e8bec70d39f86886439208c7b645 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:51 +0200
Subject: [PATCH 0753/1353] hw/i386/pc: Remove PC_MACHINE_DEVMEM_REGION_SIZE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are no remaining users in the tree. Libvirt never used that
property and a quick internet search revealed no other users.

Further, we renamed that property already in commit f2ffbe2b7dd0
("pc: rename "hotplug memory" terminology to "device memory"") without
anybody complaining.

So let's just get rid of it.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Eduardo Habkost <eduardo@habkost.net>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-9-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/i386/pc.c         | 19 -------------------
 include/hw/i386/pc.h |  1 -
 2 files changed, 20 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 55a49a9028..1bd1e5ead1 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1649,21 +1649,6 @@ static HotplugHandler *pc_get_hotplug_handler(MachineState *machine,
     return NULL;
 }
 
-static void
-pc_machine_get_device_memory_region_size(Object *obj, Visitor *v,
-                                         const char *name, void *opaque,
-                                         Error **errp)
-{
-    MachineState *ms = MACHINE(obj);
-    int64_t value = 0;
-
-    if (ms->device_memory) {
-        value = memory_region_size(&ms->device_memory->mr);
-    }
-
-    visit_type_int(v, name, &value, errp);
-}
-
 static void pc_machine_get_vmport(Object *obj, Visitor *v, const char *name,
                                   void *opaque, Error **errp)
 {
@@ -1977,10 +1962,6 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     object_class_property_set_description(oc, PC_MACHINE_MAX_RAM_BELOW_4G,
         "Maximum ram below the 4G boundary (32bit boundary)");
 
-    object_class_property_add(oc, PC_MACHINE_DEVMEM_REGION_SIZE, "int",
-        pc_machine_get_device_memory_region_size, NULL,
-        NULL, NULL);
-
     object_class_property_add(oc, PC_MACHINE_VMPORT, "OnOffAuto",
         pc_machine_get_vmport, pc_machine_set_vmport,
         NULL, NULL);
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index c34c698cdd..d54e8b1101 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -60,7 +60,6 @@ typedef struct PCMachineState {
 
 #define PC_MACHINE_ACPI_DEVICE_PROP "acpi-device"
 #define PC_MACHINE_MAX_RAM_BELOW_4G "max-ram-below-4g"
-#define PC_MACHINE_DEVMEM_REGION_SIZE "device-memory-region-size"
 #define PC_MACHINE_VMPORT           "vmport"
 #define PC_MACHINE_SMBUS            "smbus"
 #define PC_MACHINE_SATA             "sata"

From d7f4891c85886efde88e0893ec19f89a9d14138e Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:52 +0200
Subject: [PATCH 0754/1353] memory-device: Refactor memory_device_pre_plug()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's move memory_device_check_addable() and basic checks out of
memory_device_get_free_addr() directly into memory_device_pre_plug().

Separating basic checks from address assignment is cleaner and
prepares for further changes.

As all memory device users now use memory_devices_init(), and that
function enforces that the size is 0, we can drop the check for an empty
region.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-10-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/mem/memory-device.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/hw/mem/memory-device.c b/hw/mem/memory-device.c
index bb9d7c2a20..00c7755557 100644
--- a/hw/mem/memory-device.c
+++ b/hw/mem/memory-device.c
@@ -69,9 +69,10 @@ static int memory_device_used_region_size(Object *obj, void *opaque)
     return 0;
 }
 
-static void memory_device_check_addable(MachineState *ms, uint64_t size,
+static void memory_device_check_addable(MachineState *ms, MemoryRegion *mr,
                                         Error **errp)
 {
+    const uint64_t size = memory_region_size(mr);
     uint64_t used_region_size = 0;
 
     /* we will need a new memory slot for kvm and vhost */
@@ -101,16 +102,9 @@ static uint64_t memory_device_get_free_addr(MachineState *ms,
                                             uint64_t align, uint64_t size,
                                             Error **errp)
 {
-    Error *err = NULL;
     GSList *list = NULL, *item;
     Range as, new = range_empty;
 
-    if (!ms->device_memory || !memory_region_size(&ms->device_memory->mr)) {
-        error_setg(errp, "the configuration is not prepared for memory devices"
-                         " (e.g., for memory hotplug), consider specifying the"
-                         " maxmem option");
-        return 0;
-    }
     range_init_nofail(&as, ms->device_memory->base,
                       memory_region_size(&ms->device_memory->mr));
 
@@ -122,12 +116,6 @@ static uint64_t memory_device_get_free_addr(MachineState *ms,
                     align);
     }
 
-    memory_device_check_addable(ms, size, &err);
-    if (err) {
-        error_propagate(errp, err);
-        return 0;
-    }
-
     if (hint && !QEMU_IS_ALIGNED(*hint, align)) {
         error_setg(errp, "address must be aligned to 0x%" PRIx64 " bytes",
                    align);
@@ -251,11 +239,23 @@ void memory_device_pre_plug(MemoryDeviceState *md, MachineState *ms,
     uint64_t addr, align = 0;
     MemoryRegion *mr;
 
+    if (!ms->device_memory) {
+        error_setg(errp, "the configuration is not prepared for memory devices"
+                         " (e.g., for memory hotplug), consider specifying the"
+                         " maxmem option");
+        return;
+    }
+
     mr = mdc->get_memory_region(md, &local_err);
     if (local_err) {
         goto out;
     }
 
+    memory_device_check_addable(ms, mr, &local_err);
+    if (local_err) {
+        goto out;
+    }
+
     if (legacy_align) {
         align = *legacy_align;
     } else {

From ac23dd2f293c59a5cd2fb385162277b4a6aef769 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Fri, 23 Jun 2023 14:45:53 +0200
Subject: [PATCH 0755/1353] memory-device: Track used region size in
 DeviceMemoryState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let's avoid iterating over all devices and simply track it in the
DeviceMemoryState.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230623124553.400585-11-david@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/mem/memory-device.c | 22 +++-------------------
 include/hw/boards.h    |  2 ++
 2 files changed, 5 insertions(+), 19 deletions(-)

diff --git a/hw/mem/memory-device.c b/hw/mem/memory-device.c
index 00c7755557..667d56bd29 100644
--- a/hw/mem/memory-device.c
+++ b/hw/mem/memory-device.c
@@ -52,28 +52,11 @@ static int memory_device_build_list(Object *obj, void *opaque)
     return 0;
 }
 
-static int memory_device_used_region_size(Object *obj, void *opaque)
-{
-    uint64_t *size = opaque;
-
-    if (object_dynamic_cast(obj, TYPE_MEMORY_DEVICE)) {
-        const DeviceState *dev = DEVICE(obj);
-        const MemoryDeviceState *md = MEMORY_DEVICE(obj);
-
-        if (dev->realized) {
-            *size += memory_device_get_region_size(md, &error_abort);
-        }
-    }
-
-    object_child_foreach(obj, memory_device_used_region_size, opaque);
-    return 0;
-}
-
 static void memory_device_check_addable(MachineState *ms, MemoryRegion *mr,
                                         Error **errp)
 {
+    const uint64_t used_region_size = ms->device_memory->used_region_size;
     const uint64_t size = memory_region_size(mr);
-    uint64_t used_region_size = 0;
 
     /* we will need a new memory slot for kvm and vhost */
     if (kvm_enabled() && !kvm_has_free_slot(ms)) {
@@ -86,7 +69,6 @@ static void memory_device_check_addable(MachineState *ms, MemoryRegion *mr,
     }
 
     /* will we exceed the total amount of memory specified */
-    memory_device_used_region_size(OBJECT(ms), &used_region_size);
     if (used_region_size + size < used_region_size ||
         used_region_size + size > ms->maxram_size - ms->ram_size) {
         error_setg(errp, "not enough space, currently 0x%" PRIx64
@@ -292,6 +274,7 @@ void memory_device_plug(MemoryDeviceState *md, MachineState *ms)
     mr = mdc->get_memory_region(md, &error_abort);
     g_assert(ms->device_memory);
 
+    ms->device_memory->used_region_size += memory_region_size(mr);
     memory_region_add_subregion(&ms->device_memory->mr,
                                 addr - ms->device_memory->base, mr);
     trace_memory_device_plug(DEVICE(md)->id ? DEVICE(md)->id : "", addr);
@@ -310,6 +293,7 @@ void memory_device_unplug(MemoryDeviceState *md, MachineState *ms)
     g_assert(ms->device_memory);
 
     memory_region_del_subregion(&ms->device_memory->mr, mr);
+    ms->device_memory->used_region_size -= memory_region_size(mr);
     trace_memory_device_unplug(DEVICE(md)->id ? DEVICE(md)->id : "",
                                mdc->get_addr(md));
 }
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 3b7c30e853..ed83360198 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -298,11 +298,13 @@ struct MachineClass {
  * address space for memory devices starts
  * @mr: address space container for memory devices
  * @dimm_size: the sum of plugged DIMMs' sizes
+ * @used_region_size: the part of @mr already used by memory devices
  */
 typedef struct DeviceMemoryState {
     hwaddr base;
     MemoryRegion mr;
     uint64_t dimm_size;
+    uint64_t used_region_size;
 } DeviceMemoryState;
 
 /**

From 1d44ff586f8a8e113379430750b5a0a2a3f64cf9 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Thu, 6 Jul 2023 09:56:06 +0200
Subject: [PATCH 0756/1353] softmmu/physmem: Warn with
 ram_block_discard_range() on MAP_PRIVATE file mapping

ram_block_discard_range() cannot possibly do the right thing in
MAP_PRIVATE file mappings in the general case.

To achieve the documented semantics, we also have to punch a hole into
the file, possibly messing with other MAP_PRIVATE/MAP_SHARED mappings
of such a file.

For example, using VM templating -- see commit b17fbbe55cba ("migration:
allow private destination ram with x-ignore-shared") -- in combination with
any mechanism that relies on discarding of RAM is problematic. This
includes:
* Postcopy live migration
* virtio-balloon inflation/deflation or free-page-reporting
* virtio-mem

So at least warn that there is something possibly dangerous is going on
when using ram_block_discard_range() in these cases.

Message-ID: <20230706075612.67404-2-david@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 softmmu/physmem.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index bda475a719..3df73542e1 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -3456,6 +3456,24 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
              * so a userfault will trigger.
              */
 #ifdef CONFIG_FALLOCATE_PUNCH_HOLE
+            /*
+             * We'll discard data from the actual file, even though we only
+             * have a MAP_PRIVATE mapping, possibly messing with other
+             * MAP_PRIVATE/MAP_SHARED mappings. There is no easy way to
+             * change that behavior whithout violating the promised
+             * semantics of ram_block_discard_range().
+             *
+             * Only warn, because it works as long as nobody else uses that
+             * file.
+             */
+            if (!qemu_ram_is_shared(rb)) {
+                warn_report_once("ram_block_discard_range: Discarding RAM"
+                                 " in private file mappings is possibly"
+                                 " dangerous, because it will modify the"
+                                 " underlying file and will affect other"
+                                 " users of the file");
+            }
+
             ret = fallocate(rb->fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
                             start, length);
             if (ret) {

From 836f657b6a32baf5579c6f218c9c104363562bb6 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Thu, 6 Jul 2023 09:56:07 +0200
Subject: [PATCH 0757/1353] virtio-mem: Skip most of virtio_mem_unplug_all()
 without plugged memory

Already when starting QEMU we perform one system reset that ends up
triggering virtio_mem_unplug_all() with no actual memory plugged yet.
That, in turn will trigger ram_block_discard_range() and perform some
other actions that are not required in that case.

Let's optimize virtio_mem_unplug_all() for the case that no memory is
plugged. This will be beneficial for x-ignore-shared support as well.

Message-ID: <20230706075612.67404-3-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/virtio/virtio-mem.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index ec0ae32589..a922c21380 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -621,20 +621,20 @@ static int virtio_mem_unplug_all(VirtIOMEM *vmem)
 {
     RAMBlock *rb = vmem->memdev->mr.ram_block;
 
-    if (virtio_mem_is_busy()) {
-        return -EBUSY;
-    }
-
-    if (ram_block_discard_range(rb, 0, qemu_ram_get_used_length(rb))) {
-        return -EBUSY;
-    }
-    virtio_mem_notify_unplug_all(vmem);
-
-    bitmap_clear(vmem->bitmap, 0, vmem->bitmap_size);
     if (vmem->size) {
+        if (virtio_mem_is_busy()) {
+            return -EBUSY;
+        }
+        if (ram_block_discard_range(rb, 0, qemu_ram_get_used_length(rb))) {
+            return -EBUSY;
+        }
+        virtio_mem_notify_unplug_all(vmem);
+
+        bitmap_clear(vmem->bitmap, 0, vmem->bitmap_size);
         vmem->size = 0;
         notifier_list_notify(&vmem->size_change_notifiers, &vmem->size);
     }
+
     trace_virtio_mem_unplugged_all();
     virtio_mem_resize_usable_region(vmem, vmem->requested_size, true);
     return 0;

From f161c88a03c646ee308653d3ea99318901093309 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Thu, 6 Jul 2023 09:56:08 +0200
Subject: [PATCH 0758/1353] migration/ram: Expose ramblock_is_ignored() as
 migrate_ram_is_ignored()

virtio-mem wants to know whether it should not mess with the RAMBlock
content (e.g., discard RAM, preallocate memory) on incoming migration.

So let's expose that function as migrate_ram_is_ignored() in
migration/misc.h

Message-ID: <20230706075612.67404-4-david@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 include/migration/misc.h |  1 +
 migration/postcopy-ram.c |  2 +-
 migration/ram.c          | 14 +++++++-------
 migration/ram.h          |  3 +--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/migration/misc.h b/include/migration/misc.h
index 5ebe13b4b9..7dcc0b5c2c 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -40,6 +40,7 @@ int precopy_notify(PrecopyNotifyReason reason, Error **errp);
 
 void ram_mig_init(void);
 void qemu_guest_free_page_hint(void *addr, size_t len);
+bool migrate_ram_is_ignored(RAMBlock *block);
 
 /* migration/block.c */
 
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 5615ec29eb..29aea9456d 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -408,7 +408,7 @@ bool postcopy_ram_supported_by_host(MigrationIncomingState *mis, Error **errp)
     /*
      * We don't support postcopy with some type of ramblocks.
      *
-     * NOTE: we explicitly ignored ramblock_is_ignored() instead we checked
+     * NOTE: we explicitly ignored migrate_ram_is_ignored() instead we checked
      * all possible ramblocks.  This is because this function can be called
      * when creating the migration object, during the phase RAM_MIGRATABLE
      * is not even properly set for all the ramblocks.
diff --git a/migration/ram.c b/migration/ram.c
index 5283a75f02..0ada6477e8 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -194,7 +194,7 @@ static bool postcopy_preempt_active(void)
     return migrate_postcopy_preempt() && migration_in_postcopy();
 }
 
-bool ramblock_is_ignored(RAMBlock *block)
+bool migrate_ram_is_ignored(RAMBlock *block)
 {
     return !qemu_ram_is_migratable(block) ||
            (migrate_ignore_shared() && qemu_ram_is_shared(block)
@@ -696,7 +696,7 @@ static void pss_find_next_dirty(PageSearchStatus *pss)
     unsigned long size = rb->used_length >> TARGET_PAGE_BITS;
     unsigned long *bitmap = rb->bmap;
 
-    if (ramblock_is_ignored(rb)) {
+    if (migrate_ram_is_ignored(rb)) {
         /* Points directly to the end, so we know no dirty page */
         pss->page = size;
         return;
@@ -780,7 +780,7 @@ unsigned long colo_bitmap_find_dirty(RAMState *rs, RAMBlock *rb,
 
     *num = 0;
 
-    if (ramblock_is_ignored(rb)) {
+    if (migrate_ram_is_ignored(rb)) {
         return size;
     }
 
@@ -2260,7 +2260,7 @@ static int ram_save_host_page(RAMState *rs, PageSearchStatus *pss)
     unsigned long start_page = pss->page;
     int res;
 
-    if (ramblock_is_ignored(pss->block)) {
+    if (migrate_ram_is_ignored(pss->block)) {
         error_report("block %s should not be migrated !", pss->block->idstr);
         return 0;
     }
@@ -3347,7 +3347,7 @@ static inline RAMBlock *ram_block_from_stream(MigrationIncomingState *mis,
         return NULL;
     }
 
-    if (ramblock_is_ignored(block)) {
+    if (migrate_ram_is_ignored(block)) {
         error_report("block %s should not be migrated !", id);
         return NULL;
     }
@@ -3958,7 +3958,7 @@ static int ram_load_precopy(QEMUFile *f)
                     }
                     if (migrate_ignore_shared()) {
                         hwaddr addr = qemu_get_be64(f);
-                        if (ramblock_is_ignored(block) &&
+                        if (migrate_ram_is_ignored(block) &&
                             block->mr->addr != addr) {
                             error_report("Mismatched GPAs for block %s "
                                          "%" PRId64 "!= %" PRId64,
@@ -4254,7 +4254,7 @@ static void ram_mig_ram_block_resized(RAMBlockNotifier *n, void *host,
     RAMBlock *rb = qemu_ram_block_from_host(host, false, &offset);
     Error *err = NULL;
 
-    if (ramblock_is_ignored(rb)) {
+    if (migrate_ram_is_ignored(rb)) {
         return;
     }
 
diff --git a/migration/ram.h b/migration/ram.h
index ea1f3c25b5..145c915ca7 100644
--- a/migration/ram.h
+++ b/migration/ram.h
@@ -36,11 +36,10 @@
 extern XBZRLECacheStats xbzrle_counters;
 extern CompressionStats compression_counters;
 
-bool ramblock_is_ignored(RAMBlock *block);
 /* Should be holding either ram_list.mutex, or the RCU lock. */
 #define RAMBLOCK_FOREACH_NOT_IGNORED(block)            \
     INTERNAL_RAMBLOCK_FOREACH(block)                   \
-        if (ramblock_is_ignored(block)) {} else
+        if (migrate_ram_is_ignored(block)) {} else
 
 #define RAMBLOCK_FOREACH_MIGRATABLE(block)             \
     INTERNAL_RAMBLOCK_FOREACH(block)                   \

From b01fd4b67a8fdf5a9ecf4ad5b49b70d52424f0f7 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Thu, 6 Jul 2023 09:56:09 +0200
Subject: [PATCH 0759/1353] virtio-mem: Support "x-ignore-shared" migration

To achieve desired "x-ignore-shared" functionality, we should not
discard all RAM when realizing the device and not mess with
preallocation/postcopy when loading device state. In essence, we should
not touch RAM content.

As "x-ignore-shared" gets set after realizing the device, we cannot
rely on that. Let's simply skip discarding of RAM on incoming migration.
Note that virtio_mem_post_load() will call
virtio_mem_restore_unplugged() -- unless "x-ignore-shared" is set. So
once migration finished we'll have a consistent state.

The initial system reset will also not discard any RAM, because
virtio_mem_unplug_all() will not call virtio_mem_unplug_all() when no
memory is plugged (which is the case before loading the device state).

Note that something like VM templating -- see commit b17fbbe55cba
("migration: allow private destination ram with x-ignore-shared") -- is
currently incompatible with virtio-mem and ram_block_discard_range() will
warn in case a private file mapping is supplied by virtio-mem.

For VM templating with virtio-mem, it makes more sense to either
(a) Create the template without the virtio-mem device and hotplug a
    virtio-mem device to the new VM instances using proper own memory
    backend.
(b) Use a virtio-mem device that doesn't provide any memory in the
    template (requested-size=0) and use private anonymous memory.

Message-ID: <20230706075612.67404-5-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/virtio/virtio-mem.c | 47 ++++++++++++++++++++++++++++++++++--------
 1 file changed, 38 insertions(+), 9 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index a922c21380..3f41e00e74 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -18,6 +18,7 @@
 #include "sysemu/numa.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/reset.h"
+#include "sysemu/runstate.h"
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-mem.h"
@@ -901,11 +902,23 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    ret = ram_block_discard_range(rb, 0, qemu_ram_get_used_length(rb));
-    if (ret) {
-        error_setg_errno(errp, -ret, "Unexpected error discarding RAM");
-        ram_block_coordinated_discard_require(false);
-        return;
+    /*
+     * We don't know at this point whether shared RAM is migrated using
+     * QEMU or migrated using the file content. "x-ignore-shared" will be
+     * configured after realizing the device. So in case we have an
+     * incoming migration, simply always skip the discard step.
+     *
+     * Otherwise, make sure that we start with a clean slate: either the
+     * memory backend might get reused or the shared file might still have
+     * memory allocated.
+     */
+    if (!runstate_check(RUN_STATE_INMIGRATE)) {
+        ret = ram_block_discard_range(rb, 0, qemu_ram_get_used_length(rb));
+        if (ret) {
+            error_setg_errno(errp, -ret, "Unexpected error discarding RAM");
+            ram_block_coordinated_discard_require(false);
+            return;
+        }
     }
 
     virtio_mem_resize_usable_region(vmem, vmem->requested_size, true);
@@ -977,10 +990,6 @@ static int virtio_mem_post_load(void *opaque, int version_id)
     RamDiscardListener *rdl;
     int ret;
 
-    if (vmem->prealloc && !vmem->early_migration) {
-        warn_report("Proper preallocation with migration requires a newer QEMU machine");
-    }
-
     /*
      * We started out with all memory discarded and our memory region is mapped
      * into an address space. Replay, now that we updated the bitmap.
@@ -993,6 +1002,18 @@ static int virtio_mem_post_load(void *opaque, int version_id)
         }
     }
 
+    /*
+     * If shared RAM is migrated using the file content and not using QEMU,
+     * don't mess with preallocation and postcopy.
+     */
+    if (migrate_ram_is_ignored(vmem->memdev->mr.ram_block)) {
+        return 0;
+    }
+
+    if (vmem->prealloc && !vmem->early_migration) {
+        warn_report("Proper preallocation with migration requires a newer QEMU machine");
+    }
+
     if (migration_in_incoming_postcopy()) {
         return 0;
     }
@@ -1025,6 +1046,14 @@ static int virtio_mem_post_load_early(void *opaque, int version_id)
         return 0;
     }
 
+    /*
+     * If shared RAM is migrated using the file content and not using QEMU,
+     * don't mess with preallocation and postcopy.
+     */
+    if (migrate_ram_is_ignored(rb)) {
+        return 0;
+    }
+
     /*
      * We restored the bitmap and verified that the basic properties
      * match on source and destination, so we can go ahead and preallocate

From 18129c15bcefc0064febe2dc7759b93f7c5aaab3 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:39 +0200
Subject: [PATCH 0760/1353] virtio-md-pci: New parent type for virtio-mem-pci
 and virtio-pmem-pci

Let's add a new abstract "virtio memory device" type, and use it as
parent class of virtio-mem-pci and virtio-pmem-pci.

Message-ID: <20230711153445.514112-2-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 MAINTAINERS                       |  6 ++++++
 hw/virtio/Kconfig                 |  8 +++++--
 hw/virtio/meson.build             |  1 +
 hw/virtio/virtio-md-pci.c         | 33 +++++++++++++++++++++++++++++
 hw/virtio/virtio-mem-pci.c        |  5 +----
 hw/virtio/virtio-mem-pci.h        |  6 +++---
 hw/virtio/virtio-pmem-pci.c       |  5 +----
 hw/virtio/virtio-pmem-pci.h       |  6 +++---
 include/hw/virtio/virtio-md-pci.h | 35 +++++++++++++++++++++++++++++++
 9 files changed, 89 insertions(+), 16 deletions(-)
 create mode 100644 hw/virtio/virtio-md-pci.c
 create mode 100644 include/hw/virtio/virtio-md-pci.h

diff --git a/MAINTAINERS b/MAINTAINERS
index e158a25cfe..bb4626faf7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2229,6 +2229,12 @@ F: hw/virtio/virtio-crypto.c
 F: hw/virtio/virtio-crypto-pci.c
 F: include/hw/virtio/virtio-crypto.h
 
+virtio based memory device
+M: David Hildenbrand <david@redhat.com>
+S: Supported
+F: hw/virtio/virtio-md-pci.c
+F: include/hw/virtio/virtio-md-pci.h
+
 virtio-mem
 M: David Hildenbrand <david@redhat.com>
 S: Supported
diff --git a/hw/virtio/Kconfig b/hw/virtio/Kconfig
index a9ee09062f..92c9cf6c96 100644
--- a/hw/virtio/Kconfig
+++ b/hw/virtio/Kconfig
@@ -35,6 +35,10 @@ config VIRTIO_CRYPTO
     default y
     depends on VIRTIO
 
+config VIRTIO_MD
+    bool
+    select MEM_DEVICE
+
 config VIRTIO_PMEM_SUPPORTED
     bool
 
@@ -43,7 +47,7 @@ config VIRTIO_PMEM
     default y
     depends on VIRTIO
     depends on VIRTIO_PMEM_SUPPORTED
-    select MEM_DEVICE
+    select VIRTIO_MD
 
 config VIRTIO_MEM_SUPPORTED
     bool
@@ -54,7 +58,7 @@ config VIRTIO_MEM
     depends on VIRTIO
     depends on LINUX
     depends on VIRTIO_MEM_SUPPORTED
-    select MEM_DEVICE
+    select VIRTIO_MD
 
 config VHOST_VSOCK_COMMON
     bool
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index c4f4fe05fa..13e7c6c272 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -63,6 +63,7 @@ virtio_pci_ss.add(when: 'CONFIG_VIRTIO_PMEM', if_true: files('virtio-pmem-pci.c'
 virtio_pci_ss.add(when: 'CONFIG_VIRTIO_IOMMU', if_true: files('virtio-iommu-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem-pci.c'))
 virtio_pci_ss.add(when: 'CONFIG_VHOST_VDPA_DEV', if_true: files('vdpa-dev-pci.c'))
+virtio_pci_ss.add(when: 'CONFIG_VIRTIO_MD', if_true: files('virtio-md-pci.c'))
 
 specific_virtio_ss.add_all(when: 'CONFIG_VIRTIO_PCI', if_true: virtio_pci_ss)
 
diff --git a/hw/virtio/virtio-md-pci.c b/hw/virtio/virtio-md-pci.c
new file mode 100644
index 0000000000..6b02ff908e
--- /dev/null
+++ b/hw/virtio/virtio-md-pci.c
@@ -0,0 +1,33 @@
+/*
+ * Abstract virtio based memory device
+ *
+ * Copyright (C) 2023 Red Hat, Inc.
+ *
+ * Authors:
+ *  David Hildenbrand <david@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/virtio/virtio-md-pci.h"
+#include "hw/mem/memory-device.h"
+
+static const TypeInfo virtio_md_pci_info = {
+    .name = TYPE_VIRTIO_MD_PCI,
+    .parent = TYPE_VIRTIO_PCI,
+    .instance_size = sizeof(VirtIOMDPCI),
+    .class_size = sizeof(VirtIOMDPCIClass),
+    .abstract = true,
+    .interfaces = (InterfaceInfo[]) {
+        { TYPE_MEMORY_DEVICE },
+        { }
+    },
+};
+
+static void virtio_md_pci_register(void)
+{
+    type_register_static(&virtio_md_pci_info);
+}
+type_init(virtio_md_pci_register)
diff --git a/hw/virtio/virtio-mem-pci.c b/hw/virtio/virtio-mem-pci.c
index b85c12668d..2ef0f07630 100644
--- a/hw/virtio/virtio-mem-pci.c
+++ b/hw/virtio/virtio-mem-pci.c
@@ -142,14 +142,11 @@ static void virtio_mem_pci_instance_init(Object *obj)
 
 static const VirtioPCIDeviceTypeInfo virtio_mem_pci_info = {
     .base_name = TYPE_VIRTIO_MEM_PCI,
+    .parent = TYPE_VIRTIO_MD_PCI,
     .generic_name = "virtio-mem-pci",
     .instance_size = sizeof(VirtIOMEMPCI),
     .instance_init = virtio_mem_pci_instance_init,
     .class_init = virtio_mem_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_MEMORY_DEVICE },
-        { }
-    },
 };
 
 static void virtio_mem_pci_register_types(void)
diff --git a/hw/virtio/virtio-mem-pci.h b/hw/virtio/virtio-mem-pci.h
index e636e1a48d..c50b51d608 100644
--- a/hw/virtio/virtio-mem-pci.h
+++ b/hw/virtio/virtio-mem-pci.h
@@ -13,21 +13,21 @@
 #ifndef QEMU_VIRTIO_MEM_PCI_H
 #define QEMU_VIRTIO_MEM_PCI_H
 
-#include "hw/virtio/virtio-pci.h"
+#include "hw/virtio/virtio-md-pci.h"
 #include "hw/virtio/virtio-mem.h"
 #include "qom/object.h"
 
 typedef struct VirtIOMEMPCI VirtIOMEMPCI;
 
 /*
- * virtio-mem-pci: This extends VirtioPCIProxy.
+ * virtio-mem-pci: This extends VirtIOMDPCI.
  */
 #define TYPE_VIRTIO_MEM_PCI "virtio-mem-pci-base"
 DECLARE_INSTANCE_CHECKER(VirtIOMEMPCI, VIRTIO_MEM_PCI,
                          TYPE_VIRTIO_MEM_PCI)
 
 struct VirtIOMEMPCI {
-    VirtIOPCIProxy parent_obj;
+    VirtIOMDPCI parent_obj;
     VirtIOMEM vdev;
     Notifier size_change_notifier;
 };
diff --git a/hw/virtio/virtio-pmem-pci.c b/hw/virtio/virtio-pmem-pci.c
index 197d219204..cfe7f3b67c 100644
--- a/hw/virtio/virtio-pmem-pci.c
+++ b/hw/virtio/virtio-pmem-pci.c
@@ -110,13 +110,10 @@ static void virtio_pmem_pci_instance_init(Object *obj)
 static const VirtioPCIDeviceTypeInfo virtio_pmem_pci_info = {
     .base_name             = TYPE_VIRTIO_PMEM_PCI,
     .generic_name          = "virtio-pmem-pci",
+    .parent                = TYPE_VIRTIO_MD_PCI,
     .instance_size = sizeof(VirtIOPMEMPCI),
     .instance_init = virtio_pmem_pci_instance_init,
     .class_init    = virtio_pmem_pci_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_MEMORY_DEVICE },
-        { }
-    },
 };
 
 static void virtio_pmem_pci_register_types(void)
diff --git a/hw/virtio/virtio-pmem-pci.h b/hw/virtio/virtio-pmem-pci.h
index 63cfe727f7..88b01ce2db 100644
--- a/hw/virtio/virtio-pmem-pci.h
+++ b/hw/virtio/virtio-pmem-pci.h
@@ -14,21 +14,21 @@
 #ifndef QEMU_VIRTIO_PMEM_PCI_H
 #define QEMU_VIRTIO_PMEM_PCI_H
 
-#include "hw/virtio/virtio-pci.h"
+#include "hw/virtio/virtio-md-pci.h"
 #include "hw/virtio/virtio-pmem.h"
 #include "qom/object.h"
 
 typedef struct VirtIOPMEMPCI VirtIOPMEMPCI;
 
 /*
- * virtio-pmem-pci: This extends VirtioPCIProxy.
+ * virtio-pmem-pci: This extends VirtIOMDPCI.
  */
 #define TYPE_VIRTIO_PMEM_PCI "virtio-pmem-pci-base"
 DECLARE_INSTANCE_CHECKER(VirtIOPMEMPCI, VIRTIO_PMEM_PCI,
                          TYPE_VIRTIO_PMEM_PCI)
 
 struct VirtIOPMEMPCI {
-    VirtIOPCIProxy parent_obj;
+    VirtIOMDPCI parent_obj;
     VirtIOPMEM vdev;
 };
 
diff --git a/include/hw/virtio/virtio-md-pci.h b/include/hw/virtio/virtio-md-pci.h
new file mode 100644
index 0000000000..a241b54fcd
--- /dev/null
+++ b/include/hw/virtio/virtio-md-pci.h
@@ -0,0 +1,35 @@
+/*
+ * Abstract virtio based memory device
+ *
+ * Copyright (C) 2023 Red Hat, Inc.
+ *
+ * Authors:
+ *  David Hildenbrand <david@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef HW_VIRTIO_MD_PCI_H
+#define HW_VIRTIO_MD_PCI_H
+
+#include "hw/virtio/virtio-pci.h"
+#include "qom/object.h"
+
+/*
+ * virtio-md-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VIRTIO_MD_PCI "virtio-md-pci"
+
+OBJECT_DECLARE_TYPE(VirtIOMDPCI, VirtIOMDPCIClass, VIRTIO_MD_PCI)
+
+struct VirtIOMDPCIClass {
+    /* private */
+    VirtioPCIClass parent;
+};
+
+struct VirtIOMDPCI {
+    VirtIOPCIProxy parent_obj;
+};
+
+#endif

From dbdf841b2ed8b88d30a8a1f0c26029b2ebb93e76 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:40 +0200
Subject: [PATCH 0761/1353] pc: Factor out (un)plug handling of virtio-md-pci
 devices

Let's factor out (un)plug handling, to be reused from arm/virt code.

Provide stubs for the case that CONFIG_VIRTIO_MD is not selected because
neither virtio-mem nor virtio-pmem is enabled. While this cannot
currently happen for x86, it will be possible for arm/virt.

Message-ID: <20230711153445.514112-3-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 MAINTAINERS                       |  1 +
 hw/i386/pc.c                      | 90 ++++---------------------------
 hw/virtio/virtio-md-pci.c         | 63 ++++++++++++++++++++++
 include/hw/virtio/virtio-md-pci.h |  6 +++
 stubs/meson.build                 |  1 +
 stubs/virtio-md-pci.c             | 24 +++++++++
 6 files changed, 106 insertions(+), 79 deletions(-)
 create mode 100644 stubs/virtio-md-pci.c

diff --git a/MAINTAINERS b/MAINTAINERS
index bb4626faf7..12e59b6b27 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2234,6 +2234,7 @@ M: David Hildenbrand <david@redhat.com>
 S: Supported
 F: hw/virtio/virtio-md-pci.c
 F: include/hw/virtio/virtio-md-pci.h
+F: stubs/virtio-md-pci.c
 
 virtio-mem
 M: David Hildenbrand <david@redhat.com>
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 1bd1e5ead1..3109d5e0e0 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -88,13 +88,11 @@
 #include "hw/net/ne2000-isa.h"
 #include "standard-headers/asm-x86/bootparam.h"
 #include "hw/virtio/virtio-iommu.h"
-#include "hw/virtio/virtio-pmem-pci.h"
-#include "hw/virtio/virtio-mem-pci.h"
+#include "hw/virtio/virtio-md-pci.h"
 #include "hw/i386/kvm/xen_overlay.h"
 #include "hw/i386/kvm/xen_evtchn.h"
 #include "hw/i386/kvm/xen_gnttab.h"
 #include "hw/i386/kvm/xen_xenstore.h"
-#include "hw/mem/memory-device.h"
 #include "sysemu/replay.h"
 #include "target/i386/cpu.h"
 #include "e820_memory_layout.h"
@@ -1493,68 +1491,6 @@ static void pc_memory_unplug(HotplugHandler *hotplug_dev,
     error_propagate(errp, local_err);
 }
 
-static void pc_virtio_md_pci_pre_plug(HotplugHandler *hotplug_dev,
-                                      DeviceState *dev, Error **errp)
-{
-    HotplugHandler *hotplug_dev2 = qdev_get_bus_hotplug_handler(dev);
-    Error *local_err = NULL;
-
-    if (!hotplug_dev2 && dev->hotplugged) {
-        /*
-         * Without a bus hotplug handler, we cannot control the plug/unplug
-         * order. We should never reach this point when hotplugging on x86,
-         * however, better add a safety net.
-         */
-        error_setg(errp, "hotplug of virtio based memory devices not supported"
-                   " on this bus.");
-        return;
-    }
-    /*
-     * First, see if we can plug this memory device at all. If that
-     * succeeds, branch of to the actual hotplug handler.
-     */
-    memory_device_pre_plug(MEMORY_DEVICE(dev), MACHINE(hotplug_dev), NULL,
-                           &local_err);
-    if (!local_err && hotplug_dev2) {
-        hotplug_handler_pre_plug(hotplug_dev2, dev, &local_err);
-    }
-    error_propagate(errp, local_err);
-}
-
-static void pc_virtio_md_pci_plug(HotplugHandler *hotplug_dev,
-                                  DeviceState *dev, Error **errp)
-{
-    HotplugHandler *hotplug_dev2 = qdev_get_bus_hotplug_handler(dev);
-    Error *local_err = NULL;
-
-    /*
-     * Plug the memory device first and then branch off to the actual
-     * hotplug handler. If that one fails, we can easily undo the memory
-     * device bits.
-     */
-    memory_device_plug(MEMORY_DEVICE(dev), MACHINE(hotplug_dev));
-    if (hotplug_dev2) {
-        hotplug_handler_plug(hotplug_dev2, dev, &local_err);
-        if (local_err) {
-            memory_device_unplug(MEMORY_DEVICE(dev), MACHINE(hotplug_dev));
-        }
-    }
-    error_propagate(errp, local_err);
-}
-
-static void pc_virtio_md_pci_unplug_request(HotplugHandler *hotplug_dev,
-                                            DeviceState *dev, Error **errp)
-{
-    /* We don't support hot unplug of virtio based memory devices */
-    error_setg(errp, "virtio based memory devices cannot be unplugged.");
-}
-
-static void pc_virtio_md_pci_unplug(HotplugHandler *hotplug_dev,
-                                    DeviceState *dev, Error **errp)
-{
-    /* We don't support hot unplug of virtio based memory devices */
-}
-
 static void pc_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
                                           DeviceState *dev, Error **errp)
 {
@@ -1562,9 +1498,8 @@ static void pc_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
         pc_memory_pre_plug(hotplug_dev, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         x86_cpu_pre_plug(hotplug_dev, dev, errp);
-    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_PMEM_PCI) ||
-               object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        pc_virtio_md_pci_pre_plug(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_pre_plug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
         /* Declare the APIC range as the reserved MSI region */
         char *resv_prop_str = g_strdup_printf("0xfee00000:0xfeefffff:%d",
@@ -1596,9 +1531,8 @@ static void pc_machine_device_plug_cb(HotplugHandler *hotplug_dev,
         pc_memory_plug(hotplug_dev, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         x86_cpu_plug(hotplug_dev, dev, errp);
-    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_PMEM_PCI) ||
-               object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        pc_virtio_md_pci_plug(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_plug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     }
 }
 
@@ -1609,9 +1543,9 @@ static void pc_machine_device_unplug_request_cb(HotplugHandler *hotplug_dev,
         pc_memory_unplug_request(hotplug_dev, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         x86_cpu_unplug_request_cb(hotplug_dev, dev, errp);
-    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_PMEM_PCI) ||
-               object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        pc_virtio_md_pci_unplug_request(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_unplug_request(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev),
+                                     errp);
     } else {
         error_setg(errp, "acpi: device unplug request for not supported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -1625,9 +1559,8 @@ static void pc_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
         pc_memory_unplug(hotplug_dev, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         x86_cpu_unplug_cb(hotplug_dev, dev, errp);
-    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_PMEM_PCI) ||
-               object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        pc_virtio_md_pci_unplug(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_unplug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     } else {
         error_setg(errp, "acpi: device unplug for not supported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -1639,8 +1572,7 @@ static HotplugHandler *pc_get_hotplug_handler(MachineState *machine,
 {
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
         object_dynamic_cast(OBJECT(dev), TYPE_CPU) ||
-        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_PMEM_PCI) ||
-        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI) ||
+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI) ||
         object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI) ||
         object_dynamic_cast(OBJECT(dev), TYPE_X86_IOMMU_DEVICE)) {
         return HOTPLUG_HANDLER(machine);
diff --git a/hw/virtio/virtio-md-pci.c b/hw/virtio/virtio-md-pci.c
index 6b02ff908e..e849c3131d 100644
--- a/hw/virtio/virtio-md-pci.c
+++ b/hw/virtio/virtio-md-pci.c
@@ -13,6 +13,69 @@
 #include "qemu/osdep.h"
 #include "hw/virtio/virtio-md-pci.h"
 #include "hw/mem/memory-device.h"
+#include "qapi/error.h"
+
+void virtio_md_pci_pre_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
+{
+    DeviceState *dev = DEVICE(vmd);
+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
+    MemoryDeviceState *md = MEMORY_DEVICE(vmd);
+    Error *local_err = NULL;
+
+    if (!bus_handler && dev->hotplugged) {
+        /*
+         * Without a bus hotplug handler, we cannot control the plug/unplug
+         * order. We should never reach this point when hotplugging on x86,
+         * however, better add a safety net.
+         */
+        error_setg(errp, "hotplug of virtio based memory devices not supported"
+                   " on this bus.");
+        return;
+    }
+    /*
+     * First, see if we can plug this memory device at all. If that
+     * succeeds, branch of to the actual hotplug handler.
+     */
+    memory_device_pre_plug(md, ms, NULL, &local_err);
+    if (!local_err && bus_handler) {
+        hotplug_handler_pre_plug(bus_handler, dev, &local_err);
+    }
+    error_propagate(errp, local_err);
+}
+
+void virtio_md_pci_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
+{
+    DeviceState *dev = DEVICE(vmd);
+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
+    MemoryDeviceState *md = MEMORY_DEVICE(vmd);
+    Error *local_err = NULL;
+
+    /*
+     * Plug the memory device first and then branch off to the actual
+     * hotplug handler. If that one fails, we can easily undo the memory
+     * device bits.
+     */
+    memory_device_plug(md, ms);
+    if (bus_handler) {
+        hotplug_handler_plug(bus_handler, dev, &local_err);
+        if (local_err) {
+            memory_device_unplug(md, ms);
+        }
+    }
+    error_propagate(errp, local_err);
+}
+
+void virtio_md_pci_unplug_request(VirtIOMDPCI *vmd, MachineState *ms,
+                                  Error **errp)
+{
+    /* We don't support hot unplug of virtio based memory devices */
+    error_setg(errp, "virtio based memory devices cannot be unplugged.");
+}
+
+void virtio_md_pci_unplug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
+{
+    /* We don't support hot unplug of virtio based memory devices */
+}
 
 static const TypeInfo virtio_md_pci_info = {
     .name = TYPE_VIRTIO_MD_PCI,
diff --git a/include/hw/virtio/virtio-md-pci.h b/include/hw/virtio/virtio-md-pci.h
index a241b54fcd..f9fa857aec 100644
--- a/include/hw/virtio/virtio-md-pci.h
+++ b/include/hw/virtio/virtio-md-pci.h
@@ -32,4 +32,10 @@ struct VirtIOMDPCI {
     VirtIOPCIProxy parent_obj;
 };
 
+void virtio_md_pci_pre_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp);
+void virtio_md_pci_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp);
+void virtio_md_pci_unplug_request(VirtIOMDPCI *vmd, MachineState *ms,
+                                  Error **errp);
+void virtio_md_pci_unplug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp);
+
 #endif
diff --git a/stubs/meson.build b/stubs/meson.build
index a56645e2f7..ef6e39a64d 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -60,6 +60,7 @@ if have_system
   stub_ss.add(files('semihost.c'))
   stub_ss.add(files('usb-dev-stub.c'))
   stub_ss.add(files('xen-hw-stub.c'))
+  stub_ss.add(files('virtio-md-pci.c'))
 else
   stub_ss.add(files('qdev.c'))
 endif
diff --git a/stubs/virtio-md-pci.c b/stubs/virtio-md-pci.c
new file mode 100644
index 0000000000..ce5bba0c9d
--- /dev/null
+++ b/stubs/virtio-md-pci.c
@@ -0,0 +1,24 @@
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/virtio/virtio-md-pci.h"
+
+void virtio_md_pci_pre_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
+{
+    error_setg(errp, "virtio based memory devices not supported");
+}
+
+void virtio_md_pci_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
+{
+    error_setg(errp, "virtio based memory devices not supported");
+}
+
+void virtio_md_pci_unplug_request(VirtIOMDPCI *vmd, MachineState *ms,
+                                  Error **errp)
+{
+    error_setg(errp, "virtio based memory devices not supported");
+}
+
+void virtio_md_pci_unplug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
+{
+    error_setg(errp, "virtio based memory devices not supported");
+}

From 30ec5ccd3a2692464f832ec5a18b448d5ff86752 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:41 +0200
Subject: [PATCH 0762/1353] arm/virt: Use virtio-md-pci (un)plug functions

Let's use our new helper functions. Note that virtio-pmem-pci is not
enabled for arm and, therefore, not compiled in.

Message-ID: <20230711153445.514112-4-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/arm/virt.c | 81 ++++++++-------------------------------------------
 1 file changed, 12 insertions(+), 69 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 0546e43448..7d9dbc2663 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -73,11 +73,10 @@
 #include "hw/arm/smmuv3.h"
 #include "hw/acpi/acpi.h"
 #include "target/arm/internals.h"
-#include "hw/mem/memory-device.h"
 #include "hw/mem/pc-dimm.h"
 #include "hw/mem/nvdimm.h"
 #include "hw/acpi/generic_event_device.h"
-#include "hw/virtio/virtio-mem-pci.h"
+#include "hw/virtio/virtio-md-pci.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
@@ -2733,64 +2732,6 @@ static void virt_memory_plug(HotplugHandler *hotplug_dev,
                          dev, &error_abort);
 }
 
-static void virt_virtio_md_pci_pre_plug(HotplugHandler *hotplug_dev,
-                                        DeviceState *dev, Error **errp)
-{
-    HotplugHandler *hotplug_dev2 = qdev_get_bus_hotplug_handler(dev);
-    Error *local_err = NULL;
-
-    if (!hotplug_dev2 && dev->hotplugged) {
-        /*
-         * Without a bus hotplug handler, we cannot control the plug/unplug
-         * order. We should never reach this point when hotplugging on ARM.
-         * However, it's nice to add a safety net, similar to what we have
-         * on x86.
-         */
-        error_setg(errp, "hotplug of virtio based memory devices not supported"
-                   " on this bus.");
-        return;
-    }
-    /*
-     * First, see if we can plug this memory device at all. If that
-     * succeeds, branch of to the actual hotplug handler.
-     */
-    memory_device_pre_plug(MEMORY_DEVICE(dev), MACHINE(hotplug_dev), NULL,
-                           &local_err);
-    if (!local_err && hotplug_dev2) {
-        hotplug_handler_pre_plug(hotplug_dev2, dev, &local_err);
-    }
-    error_propagate(errp, local_err);
-}
-
-static void virt_virtio_md_pci_plug(HotplugHandler *hotplug_dev,
-                                    DeviceState *dev, Error **errp)
-{
-    HotplugHandler *hotplug_dev2 = qdev_get_bus_hotplug_handler(dev);
-    Error *local_err = NULL;
-
-    /*
-     * Plug the memory device first and then branch off to the actual
-     * hotplug handler. If that one fails, we can easily undo the memory
-     * device bits.
-     */
-    memory_device_plug(MEMORY_DEVICE(dev), MACHINE(hotplug_dev));
-    if (hotplug_dev2) {
-        hotplug_handler_plug(hotplug_dev2, dev, &local_err);
-        if (local_err) {
-            memory_device_unplug(MEMORY_DEVICE(dev), MACHINE(hotplug_dev));
-        }
-    }
-    error_propagate(errp, local_err);
-}
-
-static void virt_virtio_md_pci_unplug_request(HotplugHandler *hotplug_dev,
-                                              DeviceState *dev, Error **errp)
-{
-    /* We don't support hot unplug of virtio based memory devices */
-    error_setg(errp, "virtio based memory devices cannot be unplugged.");
-}
-
-
 static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
                                             DeviceState *dev, Error **errp)
 {
@@ -2798,8 +2739,8 @@ static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
 
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
         virt_memory_pre_plug(hotplug_dev, dev, errp);
-    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        virt_virtio_md_pci_pre_plug(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_pre_plug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
         hwaddr db_start = 0, db_end = 0;
         char *resv_prop_str;
@@ -2848,12 +2789,11 @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
                                      SYS_BUS_DEVICE(dev));
         }
     }
+
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
         virt_memory_plug(hotplug_dev, dev, errp);
-    }
-
-    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        virt_virtio_md_pci_plug(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_plug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     }
 
     if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
@@ -2908,8 +2848,9 @@ static void virt_machine_device_unplug_request_cb(HotplugHandler *hotplug_dev,
 {
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
         virt_dimm_unplug_request(hotplug_dev, dev, errp);
-    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI)) {
-        virt_virtio_md_pci_unplug_request(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_unplug_request(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev),
+                                     errp);
     } else {
         error_setg(errp, "device unplug request for unsupported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -2921,6 +2862,8 @@ static void virt_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
 {
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
         virt_dimm_unplug(hotplug_dev, dev, errp);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI)) {
+        virtio_md_pci_unplug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     } else {
         error_setg(errp, "virt: device unplug for unsupported device"
                    " type: %s", object_get_typename(OBJECT(dev)));
@@ -2934,7 +2877,7 @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
 
     if (device_is_dynamic_sysbus(mc, dev) ||
         object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
-        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MEM_PCI) ||
+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_MD_PCI) ||
         object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
         return HOTPLUG_HANDLER(machine);
     }

From c29dd73f74fe6020ee0755d938885919a3719194 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:42 +0200
Subject: [PATCH 0763/1353] virtio-md-pci: Handle unplug of virtio based memory
 devices

While we fence unplug requests from the outside, the VM can still
trigger unplug of virtio based memory devices, for example, in Linux
doing on a virtio-mem-pci device:
    # echo 0 > /sys/bus/pci/slots/3/power

While doing that is not really expected to work without harming the
guest OS (e.g., removing a virtio-mem device while it still provides
memory), let's make sure that we properly handle it on the QEMU side.

We'll add support for unplugging of virtio-mem devices in some
configurations next.

Message-ID: <20230711153445.514112-5-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/virtio/virtio-md-pci.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-md-pci.c b/hw/virtio/virtio-md-pci.c
index e849c3131d..a22a259e2d 100644
--- a/hw/virtio/virtio-md-pci.c
+++ b/hw/virtio/virtio-md-pci.c
@@ -14,6 +14,7 @@
 #include "hw/virtio/virtio-md-pci.h"
 #include "hw/mem/memory-device.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 
 void virtio_md_pci_pre_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
 {
@@ -74,7 +75,27 @@ void virtio_md_pci_unplug_request(VirtIOMDPCI *vmd, MachineState *ms,
 
 void virtio_md_pci_unplug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
 {
-    /* We don't support hot unplug of virtio based memory devices */
+    DeviceState *dev = DEVICE(vmd);
+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
+    MemoryDeviceState *md = MEMORY_DEVICE(vmd);
+    Error *local_err = NULL;
+
+    /* Unplug the memory device while it is still realized. */
+    memory_device_unplug(md, ms);
+
+    if (bus_handler) {
+        hotplug_handler_unplug(bus_handler, dev, &local_err);
+        if (local_err) {
+            /* Not expected to fail ... but still try to recover. */
+            memory_device_plug(md, ms);
+            error_propagate(errp, local_err);
+            return;
+        }
+    } else {
+        /* Very unexpected, but let's just try to do the right thing. */
+        warn_report("Unexpected unplug of virtio based memory device");
+        qdev_unrealize(dev);
+    }
 }
 
 static const TypeInfo virtio_md_pci_info = {

From aac44204bc6d2a062c2e1658fe6a02a67f55b9e6 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:43 +0200
Subject: [PATCH 0764/1353] virtio-md-pci: Support unplug requests for
 compatible devices

Let's support unplug requests for virtio-md-pci devices that provide
a unplug_request_check() callback.

We'll wire that up for virtio-mem-pci next.

Message-ID: <20230711153445.514112-6-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/virtio/virtio-md-pci.c         | 38 +++++++++++++++++++++++++++++--
 include/hw/virtio/virtio-md-pci.h |  3 +++
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/virtio-md-pci.c b/hw/virtio/virtio-md-pci.c
index a22a259e2d..62bfb7920b 100644
--- a/hw/virtio/virtio-md-pci.c
+++ b/hw/virtio/virtio-md-pci.c
@@ -69,8 +69,42 @@ void virtio_md_pci_plug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
 void virtio_md_pci_unplug_request(VirtIOMDPCI *vmd, MachineState *ms,
                                   Error **errp)
 {
-    /* We don't support hot unplug of virtio based memory devices */
-    error_setg(errp, "virtio based memory devices cannot be unplugged.");
+    VirtIOMDPCIClass *vmdc = VIRTIO_MD_PCI_GET_CLASS(vmd);
+    DeviceState *dev = DEVICE(vmd);
+    HotplugHandler *bus_handler = qdev_get_bus_hotplug_handler(dev);
+    HotplugHandlerClass *hdc;
+    Error *local_err = NULL;
+
+    if (!vmdc->unplug_request_check) {
+        error_setg(errp, "this virtio based memory devices cannot be unplugged");
+        return;
+    }
+
+    if (!bus_handler) {
+        error_setg(errp, "hotunplug of virtio based memory devices not"
+                   "supported on this bus");
+        return;
+    }
+
+    vmdc->unplug_request_check(vmd, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    /*
+     * Forward the async request or turn it into a sync request (handling it
+     * like qdev_unplug()).
+     */
+    hdc = HOTPLUG_HANDLER_GET_CLASS(bus_handler);
+    if (hdc->unplug_request) {
+        hotplug_handler_unplug_request(bus_handler, dev, &local_err);
+    } else {
+        virtio_md_pci_unplug(vmd, ms, &local_err);
+        if (!local_err) {
+            object_unparent(OBJECT(dev));
+        }
+    }
 }
 
 void virtio_md_pci_unplug(VirtIOMDPCI *vmd, MachineState *ms, Error **errp)
diff --git a/include/hw/virtio/virtio-md-pci.h b/include/hw/virtio/virtio-md-pci.h
index f9fa857aec..5912e16674 100644
--- a/include/hw/virtio/virtio-md-pci.h
+++ b/include/hw/virtio/virtio-md-pci.h
@@ -26,6 +26,9 @@ OBJECT_DECLARE_TYPE(VirtIOMDPCI, VirtIOMDPCIClass, VIRTIO_MD_PCI)
 struct VirtIOMDPCIClass {
     /* private */
     VirtioPCIClass parent;
+
+    /* public */
+    void (*unplug_request_check)(VirtIOMDPCI *vmd, Error **errp);
 };
 
 struct VirtIOMDPCI {

From 92a8ee1b594244a82d4c955eab907034f8953f8b Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:44 +0200
Subject: [PATCH 0765/1353] virtio-mem: Prepare for device unplug support

In many cases, blindly unplugging a virtio-mem device is problematic. We
can only safely remove a device once:
* The guest is not expecting to be able to read unplugged memory
  (unplugged-inaccessible == on)
* The virtio-mem device does not have memory plugged (size == 0)
* The virtio-mem device does not have outstanding requests to the VM to
  plug memory (requested-size == 0)

So let's add a callback to the virtio-mem device class to check for that.
We'll wire-up virtio-mem-pci next.

Message-ID: <20230711153445.514112-7-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/virtio/virtio-mem.c         | 25 +++++++++++++++++++++++++
 include/hw/virtio/virtio-mem.h |  1 +
 2 files changed, 26 insertions(+)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 3f41e00e74..b6e781741e 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1512,6 +1512,30 @@ static void virtio_mem_rdm_unregister_listener(RamDiscardManager *rdm,
     QLIST_REMOVE(rdl, next);
 }
 
+static void virtio_mem_unplug_request_check(VirtIOMEM *vmem, Error **errp)
+{
+    if (vmem->unplugged_inaccessible == ON_OFF_AUTO_OFF) {
+        /*
+         * We could allow it with a usable region size of 0, but let's just
+         * not care about that legacy setting.
+         */
+        error_setg(errp, "virtio-mem device cannot get unplugged while"
+                   " '" VIRTIO_MEM_UNPLUGGED_INACCESSIBLE_PROP "' != 'on'");
+        return;
+    }
+
+    if (vmem->size) {
+        error_setg(errp, "virtio-mem device cannot get unplugged while"
+                   " '" VIRTIO_MEM_SIZE_PROP "' != '0'");
+        return;
+    }
+    if (vmem->requested_size) {
+        error_setg(errp, "virtio-mem device cannot get unplugged while"
+                   " '" VIRTIO_MEM_REQUESTED_SIZE_PROP "' != '0'");
+        return;
+    }
+}
+
 static void virtio_mem_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -1534,6 +1558,7 @@ static void virtio_mem_class_init(ObjectClass *klass, void *data)
     vmc->get_memory_region = virtio_mem_get_memory_region;
     vmc->add_size_change_notifier = virtio_mem_add_size_change_notifier;
     vmc->remove_size_change_notifier = virtio_mem_remove_size_change_notifier;
+    vmc->unplug_request_check = virtio_mem_unplug_request_check;
 
     rdmc->get_min_granularity = virtio_mem_rdm_get_min_granularity;
     rdmc->is_populated = virtio_mem_rdm_is_populated;
diff --git a/include/hw/virtio/virtio-mem.h b/include/hw/virtio/virtio-mem.h
index f15e561785..ab0fe2b4f2 100644
--- a/include/hw/virtio/virtio-mem.h
+++ b/include/hw/virtio/virtio-mem.h
@@ -98,6 +98,7 @@ struct VirtIOMEMClass {
     MemoryRegion *(*get_memory_region)(VirtIOMEM *vmem, Error **errp);
     void (*add_size_change_notifier)(VirtIOMEM *vmem, Notifier *notifier);
     void (*remove_size_change_notifier)(VirtIOMEM *vmem, Notifier *notifier);
+    void (*unplug_request_check)(VirtIOMEM *vmem, Error **errp);
 };
 
 #endif

From 339a8bbdfed910d0baa392c2071fd0e09b30aed9 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 11 Jul 2023 17:34:45 +0200
Subject: [PATCH 0766/1353] virtio-mem-pci: Device unplug support

Let's support device unplug by forwarding the unplug_request_check()
callback to the virtio-mem device.

Further, disallow changing the requested-size once an unplug request is
pending.

Disallowing requested-size changes handles corner cases such as
(1) pausing the VM (2) requesting device unplug and (3) adjusting the
requested size. If the VM would plug memory (due to the requested size
change) before processing the unplug request, we would be in trouble.

Message-ID: <20230711153445.514112-8-david@redhat.com>
Tested-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
---
 hw/virtio/virtio-mem-pci.c | 49 +++++++++++++++++++++++++++++++++++---
 1 file changed, 46 insertions(+), 3 deletions(-)

diff --git a/hw/virtio/virtio-mem-pci.c b/hw/virtio/virtio-mem-pci.c
index 2ef0f07630..c4597e029e 100644
--- a/hw/virtio/virtio-mem-pci.c
+++ b/hw/virtio/virtio-mem-pci.c
@@ -93,12 +93,53 @@ static void virtio_mem_pci_size_change_notify(Notifier *notifier, void *data)
     g_free(qom_path);
 }
 
+static void virtio_mem_pci_unplug_request_check(VirtIOMDPCI *vmd, Error **errp)
+{
+    VirtIOMEMPCI *pci_mem = VIRTIO_MEM_PCI(vmd);
+    VirtIOMEM *vmem = &pci_mem->vdev;
+    VirtIOMEMClass *vpc = VIRTIO_MEM_GET_CLASS(vmem);
+
+    vpc->unplug_request_check(vmem, errp);
+}
+
+static void virtio_mem_pci_get_requested_size(Object *obj, Visitor *v,
+                                              const char *name, void *opaque,
+                                              Error **errp)
+{
+    VirtIOMEMPCI *pci_mem = VIRTIO_MEM_PCI(obj);
+
+    object_property_get(OBJECT(&pci_mem->vdev), name, v, errp);
+}
+
+static void virtio_mem_pci_set_requested_size(Object *obj, Visitor *v,
+                                              const char *name, void *opaque,
+                                              Error **errp)
+{
+    VirtIOMEMPCI *pci_mem = VIRTIO_MEM_PCI(obj);
+    DeviceState *dev = DEVICE(obj);
+
+    /*
+     * If we passed virtio_mem_pci_unplug_request_check(), making sure that
+     * the requested size is 0, don't allow modifying the requested size
+     * anymore, otherwise the VM might end up hotplugging memory before
+     * handling the unplug request.
+     */
+    if (dev->pending_deleted_event) {
+        error_setg(errp, "'%s' cannot be changed if the device is in the"
+                   " process of unplug", name);
+        return;
+    }
+
+    object_property_set(OBJECT(&pci_mem->vdev), name, v, errp);
+}
+
 static void virtio_mem_pci_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
     MemoryDeviceClass *mdc = MEMORY_DEVICE_CLASS(klass);
+    VirtIOMDPCIClass *vmdc = VIRTIO_MD_PCI_CLASS(klass);
 
     k->realize = virtio_mem_pci_realize;
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
@@ -111,6 +152,8 @@ static void virtio_mem_pci_class_init(ObjectClass *klass, void *data)
     mdc->get_memory_region = virtio_mem_pci_get_memory_region;
     mdc->fill_device_info = virtio_mem_pci_fill_device_info;
     mdc->get_min_alignment = virtio_mem_pci_get_min_alignment;
+
+    vmdc->unplug_request_check = virtio_mem_pci_unplug_request_check;
 }
 
 static void virtio_mem_pci_instance_init(Object *obj)
@@ -135,9 +178,9 @@ static void virtio_mem_pci_instance_init(Object *obj)
                               OBJECT(&dev->vdev), VIRTIO_MEM_BLOCK_SIZE_PROP);
     object_property_add_alias(obj, VIRTIO_MEM_SIZE_PROP, OBJECT(&dev->vdev),
                               VIRTIO_MEM_SIZE_PROP);
-    object_property_add_alias(obj, VIRTIO_MEM_REQUESTED_SIZE_PROP,
-                              OBJECT(&dev->vdev),
-                              VIRTIO_MEM_REQUESTED_SIZE_PROP);
+    object_property_add(obj, VIRTIO_MEM_REQUESTED_SIZE_PROP, "size",
+                        virtio_mem_pci_get_requested_size,
+                        virtio_mem_pci_set_requested_size, NULL, NULL);
 }
 
 static const VirtioPCIDeviceTypeInfo virtio_mem_pci_info = {

From 75dcb4d790bbe5327169fd72b185960ca58e2fa6 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 4 Jul 2023 17:15:27 +0200
Subject: [PATCH 0767/1353] virtio-blk: fix host notifier issues during
 dataplane start/stop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The main loop thread can consume 100% CPU when using --device
virtio-blk-pci,iothread=<iothread>. ppoll() constantly returns but
reading virtqueue host notifiers fails with EAGAIN. The file descriptors
are stale and remain registered with the AioContext because of bugs in
the virtio-blk dataplane start/stop code.

The problem is that the dataplane start/stop code involves drain
operations, which call virtio_blk_drained_begin() and
virtio_blk_drained_end() at points where the host notifier is not
operational:
- In virtio_blk_data_plane_start(), blk_set_aio_context() drains after
  vblk->dataplane_started has been set to true but the host notifier has
  not been attached yet.
- In virtio_blk_data_plane_stop(), blk_drain() and blk_set_aio_context()
  drain after the host notifier has already been detached but with
  vblk->dataplane_started still set to true.

I would like to simplify ->ioeventfd_start/stop() to avoid interactions
with drain entirely, but couldn't find a way to do that. Instead, this
patch accepts the fragile nature of the code and reorders it so that
vblk->dataplane_started is false during drain operations. This way the
virtio_blk_drained_begin() and virtio_blk_drained_end() calls don't
touch the host notifier. The result is that
virtio_blk_data_plane_start() and virtio_blk_data_plane_stop() have
complete control over the host notifier and stale file descriptors are
no longer left in the AioContext.

This patch fixes the 100% CPU consumption in the main loop thread and
correctly moves host notifier processing to the IOThread.

Fixes: 1665d9326fd2 ("virtio-blk: implement BlockDevOps->drained_begin()")
Reported-by: Lukáš Doktor <ldoktor@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Lukas Doktor <ldoktor@redhat.com>
Message-id: 20230704151527.193586-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/dataplane/virtio-blk.c | 53 +++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 22 deletions(-)

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index c227b39408..da36fcfd0b 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -219,13 +219,6 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
 
     memory_region_transaction_commit();
 
-    /*
-     * These fields are visible to the IOThread so we rely on implicit barriers
-     * in aio_context_acquire() on the write side and aio_notify_accept() on
-     * the read side.
-     */
-    s->starting = false;
-    vblk->dataplane_started = true;
     trace_virtio_blk_data_plane_start(s);
 
     old_context = blk_get_aio_context(s->conf->conf.blk);
@@ -244,6 +237,18 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
         event_notifier_set(virtio_queue_get_host_notifier(vq));
     }
 
+    /*
+     * These fields must be visible to the IOThread when it processes the
+     * virtqueue, otherwise it will think dataplane has not started yet.
+     *
+     * Make sure ->dataplane_started is false when blk_set_aio_context() is
+     * called above so that draining does not cause the host notifier to be
+     * detached/attached prematurely.
+     */
+    s->starting = false;
+    vblk->dataplane_started = true;
+    smp_wmb(); /* paired with aio_notify_accept() on the read side */
+
     /* Get this show started by hooking up our callbacks */
     if (!blk_in_drain(s->conf->conf.blk)) {
         aio_context_acquire(s->ctx);
@@ -273,7 +278,6 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
   fail_guest_notifiers:
     vblk->dataplane_disabled = true;
     s->starting = false;
-    vblk->dataplane_started = true;
     return -ENOSYS;
 }
 
@@ -327,19 +331,6 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
         aio_wait_bh_oneshot(s->ctx, virtio_blk_data_plane_stop_bh, s);
     }
 
-    aio_context_acquire(s->ctx);
-
-    /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
-    blk_drain(s->conf->conf.blk);
-
-    /*
-     * Try to switch bs back to the QEMU main loop. If other users keep the
-     * BlockBackend in the iothread, that's ok
-     */
-    blk_set_aio_context(s->conf->conf.blk, qemu_get_aio_context(), NULL);
-
-    aio_context_release(s->ctx);
-
     /*
      * Batch all the host notifiers in a single transaction to avoid
      * quadratic time complexity in address_space_update_ioeventfds().
@@ -360,12 +351,30 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
         virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
     }
 
+    /*
+     * Set ->dataplane_started to false before draining so that host notifiers
+     * are not detached/attached anymore.
+     */
+    vblk->dataplane_started = false;
+
+    aio_context_acquire(s->ctx);
+
+    /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
+    blk_drain(s->conf->conf.blk);
+
+    /*
+     * Try to switch bs back to the QEMU main loop. If other users keep the
+     * BlockBackend in the iothread, that's ok
+     */
+    blk_set_aio_context(s->conf->conf.blk, qemu_get_aio_context(), NULL);
+
+    aio_context_release(s->ctx);
+
     qemu_bh_cancel(s->bh);
     notify_guest_bh(s); /* final chance to notify guest */
 
     /* Clean up guest notifier (irq) */
     k->set_guest_notifiers(qbus->parent, nvqs, false);
 
-    vblk->dataplane_started = false;
     s->stopping = false;
 }

From 230dfd9257e92259876c113e58b5f0d22b056d2e Mon Sep 17 00:00:00 2001
From: Olaf Hering <olaf@aepfle.de>
Date: Wed, 12 Jul 2023 09:47:22 +0200
Subject: [PATCH 0768/1353] hw/ide/piix: properly initialize the BMIBA register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to the 82371FB documentation (82371FB.pdf, 2.3.9. BMIBA-BUS
MASTER INTERFACE BASE ADDRESS REGISTER, April 1997), the register is
32bit wide. To properly reset it to default values, all 32bit need to be
cleared. Bit #0 "Resource Type Indicator (RTE)" needs to be enabled.

The initial change wrote just the lower 8 bit, leaving parts of the "Bus
Master Interface Base Address" address at bit 15:4 unchanged.

Fixes: e6a71ae327 ("Add support for 82371FB (Step A1) and Improved support for 82371SB (Function 1)")

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230712074721.14728-1-olaf@aepfle.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/ide/piix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index 151f206046..4e5e12935f 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -117,7 +117,7 @@ static void piix_ide_reset(DeviceState *dev)
     pci_set_word(pci_conf + PCI_COMMAND, 0x0000);
     pci_set_word(pci_conf + PCI_STATUS,
                  PCI_STATUS_DEVSEL_MEDIUM | PCI_STATUS_FAST_BACK);
-    pci_set_byte(pci_conf + 0x20, 0x01);  /* BMIBA: 20-23h */
+    pci_set_long(pci_conf + 0x20, 0x1);  /* BMIBA: 20-23h */
 }
 
 static bool pci_piix_init_bus(PCIIDEState *d, unsigned i, Error **errp)

From cc9ff56fc338499a2de939619fbe5d4e9389094b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 12 Jul 2023 10:01:46 +0200
Subject: [PATCH 0769/1353] kconfig: Add PCIe devices to s390x machines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is useful to extend the number of available PCIe devices to KVM guests
for passthrough scenarios and also to expose these models to a different
(big endian) architecture. Introduce a new config PCIE_DEVICES to select
models, Intel Ethernet adapters and one USB controller. These devices all
support MSI-X which is a requirement on s390x as legacy INTx are not
supported.

Cc: Matthew Rosato <mjrosato@linux.ibm.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Thomas Huth <thuth@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20230712080146.839113-1-clg@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configs/devices/s390x-softmmu/default.mak | 1 +
 hw/net/Kconfig                            | 4 ++--
 hw/pci/Kconfig                            | 3 +++
 hw/s390x/Kconfig                          | 3 ++-
 hw/usb/Kconfig                            | 2 +-
 5 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/configs/devices/s390x-softmmu/default.mak b/configs/devices/s390x-softmmu/default.mak
index f2287a133f..6d87bc8b4b 100644
--- a/configs/devices/s390x-softmmu/default.mak
+++ b/configs/devices/s390x-softmmu/default.mak
@@ -7,6 +7,7 @@
 #CONFIG_VFIO_CCW=n
 #CONFIG_VIRTIO_PCI=n
 #CONFIG_WDT_DIAG288=n
+#CONFIG_PCIE_DEVICES=n
 
 # Boards:
 #
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index 98e00be4f9..7fcc0d7faa 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -41,12 +41,12 @@ config E1000_PCI
 
 config E1000E_PCI_EXPRESS
     bool
-    default y if PCI_DEVICES
+    default y if PCI_DEVICES || PCIE_DEVICES
     depends on PCI_EXPRESS && MSI_NONBROKEN
 
 config IGB_PCI_EXPRESS
     bool
-    default y if PCI_DEVICES
+    default y if PCI_DEVICES || PCIE_DEVICES
     depends on PCI_EXPRESS && MSI_NONBROKEN
 
 config RTL8139_PCI
diff --git a/hw/pci/Kconfig b/hw/pci/Kconfig
index 77f8b005ff..fe70902cd8 100644
--- a/hw/pci/Kconfig
+++ b/hw/pci/Kconfig
@@ -8,6 +8,9 @@ config PCI_EXPRESS
 config PCI_DEVICES
     bool
 
+config PCIE_DEVICES
+    bool
+
 config MSI_NONBROKEN
     # selected by interrupt controllers that do not support MSI,
     # or support it and have a good implementation. See commit
diff --git a/hw/s390x/Kconfig b/hw/s390x/Kconfig
index 5e7d8a2bae..e8d4d68ece 100644
--- a/hw/s390x/Kconfig
+++ b/hw/s390x/Kconfig
@@ -5,7 +5,8 @@ config S390_CCW_VIRTIO
     imply VFIO_AP
     imply VFIO_CCW
     imply WDT_DIAG288
-    select PCI
+    imply PCIE_DEVICES
+    select PCI_EXPRESS
     select S390_FLIC
     select SCLPCONSOLE
     select VIRTIO_CCW
diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index 0ec6def4b8..0f486764ed 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -36,7 +36,7 @@ config USB_XHCI
 
 config USB_XHCI_PCI
     bool
-    default y if PCI_DEVICES
+    default y if PCI_DEVICES || PCIE_DEVICES
     depends on PCI
     select USB_XHCI
 

From 9472083e642bfb9bc836b38662baddd9bc964ebc Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Wed, 12 Jul 2023 15:43:50 +0200
Subject: [PATCH 0770/1353] scsi: fetch unit attention when creating the
 request

Commit 1880ad4f4e ("virtio-scsi: Batched prepare for cmd reqs") split
calls to scsi_req_new() and scsi_req_enqueue() in the virtio-scsi device.
No ill effects were observed until commit 8cc5583abe ("virtio-scsi: Send
"REPORTED LUNS CHANGED" sense data upon disk hotplug events") added a
unit attention that was easy to trigger with device hotplug and
hot-unplug.

Because the two calls were separated, all requests in the batch were
prepared calling scsi_req_new() to report a sense.  The first one
submitted would report the right sense and reset it to NO_SENSE, while
the others reported CHECK_CONDITION with no sense data.  This caused
SCSI errors in Linux.

To solve this issue, let's fetch the unit attention as early as possible
when we prepare the request, so that only the first request in the batch
will use the unit attention SCSIReqOps and the others will not report
CHECK CONDITION.

Fixes: 1880ad4f4e ("virtio-scsi: Batched prepare for cmd reqs")
Fixes: 8cc5583abe ("virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug events")
Reported-by: Thomas Huth <thuth@redhat.com>
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2176702
Co-developed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-ID: <20230712134352.118655-2-sgarzare@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-bus.c     | 40 +++++++++++++++++++++++++++++++++++-----
 include/hw/scsi/scsi.h |  1 +
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index f80f4cb4fc..f083373021 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -412,19 +412,35 @@ static const struct SCSIReqOps reqops_invalid_opcode = {
 
 /* SCSIReqOps implementation for unit attention conditions.  */
 
+static void scsi_fetch_unit_attention_sense(SCSIRequest *req)
+{
+    SCSISense *ua = NULL;
+
+    if (req->dev->unit_attention.key == UNIT_ATTENTION) {
+        ua = &req->dev->unit_attention;
+    } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
+        ua = &req->bus->unit_attention;
+    }
+
+    /*
+     * Fetch the unit attention sense immediately so that another
+     * scsi_req_new does not use reqops_unit_attention.
+     */
+    if (ua) {
+        scsi_req_build_sense(req, *ua);
+        *ua = SENSE_CODE(NO_SENSE);
+    }
+}
+
 static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)
 {
-    if (req->dev->unit_attention.key == UNIT_ATTENTION) {
-        scsi_req_build_sense(req, req->dev->unit_attention);
-    } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
-        scsi_req_build_sense(req, req->bus->unit_attention);
-    }
     scsi_req_complete(req, CHECK_CONDITION);
     return 0;
 }
 
 static const struct SCSIReqOps reqops_unit_attention = {
     .size         = sizeof(SCSIRequest),
+    .init_req     = scsi_fetch_unit_attention_sense,
     .send_command = scsi_unit_attention
 };
 
@@ -699,6 +715,11 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
     object_ref(OBJECT(d));
     object_ref(OBJECT(qbus->parent));
     notifier_list_init(&req->cancel_notifiers);
+
+    if (reqops->init_req) {
+        reqops->init_req(req);
+    }
+
     trace_scsi_req_alloc(req->dev->id, req->lun, req->tag);
     return req;
 }
@@ -798,6 +819,15 @@ uint8_t *scsi_req_get_buf(SCSIRequest *req)
 static void scsi_clear_unit_attention(SCSIRequest *req)
 {
     SCSISense *ua;
+
+    /*
+     * scsi_fetch_unit_attention_sense() already cleaned the unit attention
+     * in this case.
+     */
+    if (req->ops == &reqops_unit_attention) {
+        return;
+    }
+
     if (req->dev->unit_attention.key != UNIT_ATTENTION &&
         req->bus->unit_attention.key != UNIT_ATTENTION) {
         return;
diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
index e2bb1a2fbf..3692ca82f3 100644
--- a/include/hw/scsi/scsi.h
+++ b/include/hw/scsi/scsi.h
@@ -108,6 +108,7 @@ int cdrom_read_toc_raw(int nb_sectors, uint8_t *buf, int msf, int session_num);
 /* scsi-bus.c */
 struct SCSIReqOps {
     size_t size;
+    void (*init_req)(SCSIRequest *req);
     void (*free_req)(SCSIRequest *req);
     int32_t (*send_command)(SCSIRequest *req, uint8_t *buf);
     void (*read_data)(SCSIRequest *req);

From ba947dab98e7cd4337c70975bd255701a2a6aad8 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Wed, 12 Jul 2023 15:43:51 +0200
Subject: [PATCH 0771/1353] scsi: cleanup scsi_clear_unit_attention()

The previous commit moved the unit attention clearing when we create
the request. So now we can clean scsi_clear_unit_attention() to handle
only the case of the REPORT LUNS command: this is the only case in
which a UNIT ATTENTION is cleared without having been reported.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-ID: <20230712134352.118655-3-sgarzare@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-bus.c | 28 ++++++----------------------
 1 file changed, 6 insertions(+), 22 deletions(-)

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index f083373021..f9c95dfb50 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -828,26 +828,12 @@ static void scsi_clear_unit_attention(SCSIRequest *req)
         return;
     }
 
-    if (req->dev->unit_attention.key != UNIT_ATTENTION &&
-        req->bus->unit_attention.key != UNIT_ATTENTION) {
-        return;
-    }
-
-    /*
-     * If an INQUIRY command enters the enabled command state,
-     * the device server shall [not] clear any unit attention condition;
-     * See also MMC-6, paragraphs 6.5 and 6.6.2.
-     */
-    if (req->cmd.buf[0] == INQUIRY ||
-        req->cmd.buf[0] == GET_CONFIGURATION ||
-        req->cmd.buf[0] == GET_EVENT_STATUS_NOTIFICATION) {
-        return;
-    }
-
     if (req->dev->unit_attention.key == UNIT_ATTENTION) {
         ua = &req->dev->unit_attention;
-    } else {
+    } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
         ua = &req->bus->unit_attention;
+    } else {
+        return;
     }
 
     /*
@@ -856,12 +842,10 @@ static void scsi_clear_unit_attention(SCSIRequest *req)
      * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
      */
     if (req->cmd.buf[0] == REPORT_LUNS &&
-        !(ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
-          ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq)) {
-        return;
+        ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
+        ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq) {
+        *ua = SENSE_CODE(NO_SENSE);
     }
-
-    *ua = SENSE_CODE(NO_SENSE);
 }
 
 int scsi_req_get_sense(SCSIRequest *req, uint8_t *buf, int len)

From 2eb5599e8a73e70a9e86a97120818ff95a43a23a Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Wed, 12 Jul 2023 15:43:52 +0200
Subject: [PATCH 0772/1353] scsi: clear unit attention only for REPORT LUNS
 commands

scsi_clear_unit_attention() now only handles REPORTED LUNS DATA HAS
CHANGED.

This only happens when we handle REPORT LUNS commands, so let's rename
the function in scsi_clear_reported_luns_changed() and call it only in
scsi_target_emulate_report_luns().

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-ID: <20230712134352.118655-4-sgarzare@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-bus.c | 34 +++++++++++-----------------------
 1 file changed, 11 insertions(+), 23 deletions(-)

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index f9c95dfb50..fc4b77fdb0 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -22,6 +22,7 @@ static char *scsibus_get_fw_dev_path(DeviceState *dev);
 static void scsi_req_dequeue(SCSIRequest *req);
 static uint8_t *scsi_target_alloc_buf(SCSIRequest *req, size_t len);
 static void scsi_target_free_buf(SCSIRequest *req);
+static void scsi_clear_reported_luns_changed(SCSIRequest *req);
 
 static int next_scsi_bus;
 
@@ -518,6 +519,14 @@ static bool scsi_target_emulate_report_luns(SCSITargetReq *r)
 
     /* store the LUN list length */
     stl_be_p(&r->buf[0], len - 8);
+
+    /*
+     * If a REPORT LUNS command enters the enabled command state, [...]
+     * the device server shall clear any pending unit attention condition
+     * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
+     */
+    scsi_clear_reported_luns_changed(&r->req);
+
     return true;
 }
 
@@ -816,18 +825,10 @@ uint8_t *scsi_req_get_buf(SCSIRequest *req)
     return req->ops->get_buf(req);
 }
 
-static void scsi_clear_unit_attention(SCSIRequest *req)
+static void scsi_clear_reported_luns_changed(SCSIRequest *req)
 {
     SCSISense *ua;
 
-    /*
-     * scsi_fetch_unit_attention_sense() already cleaned the unit attention
-     * in this case.
-     */
-    if (req->ops == &reqops_unit_attention) {
-        return;
-    }
-
     if (req->dev->unit_attention.key == UNIT_ATTENTION) {
         ua = &req->dev->unit_attention;
     } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {
@@ -836,13 +837,7 @@ static void scsi_clear_unit_attention(SCSIRequest *req)
         return;
     }
 
-    /*
-     * If a REPORT LUNS command enters the enabled command state, [...]
-     * the device server shall clear any pending unit attention condition
-     * with an additional sense code of REPORTED LUNS DATA HAS CHANGED.
-     */
-    if (req->cmd.buf[0] == REPORT_LUNS &&
-        ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
+    if (ua->asc == SENSE_CODE(REPORTED_LUNS_CHANGED).asc &&
         ua->ascq == SENSE_CODE(REPORTED_LUNS_CHANGED).ascq) {
         *ua = SENSE_CODE(NO_SENSE);
     }
@@ -1528,13 +1523,6 @@ void scsi_req_complete(SCSIRequest *req, int status)
         req->dev->sense_is_ua = false;
     }
 
-    /*
-     * Unit attention state is now stored in the device's sense buffer
-     * if the HBA didn't do autosense.  Clear the pending unit attention
-     * flags.
-     */
-    scsi_clear_unit_attention(req);
-
     scsi_req_ref(req);
     scsi_req_dequeue(req);
     req->bus->info->complete(req, req->residual);

From 4c46fe2ed492f35f411632c8b5a8442f322bc3f0 Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@linux.ibm.com>
Date: Thu, 13 Jul 2023 13:19:55 -0400
Subject: [PATCH 0773/1353] hw/tpm: TIS on sysbus: Remove unsupport ppi command
 line option

The ppi command line option for the TIS device on sysbus never worked
and caused an immediate segfault. Remove support for it since it also
needs support in the firmware and needs testing inside the VM.

Reproducer with the ppi=on option passed:

qemu-system-aarch64 \
   -machine virt,gic-version=3 \
   -m 4G  \
   -nographic -no-acpi \
   -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
   -tpmdev emulator,id=tpm0,chardev=chrtpm \
   -device tpm-tis-device,tpmdev=tpm0,ppi=on
[...]
Segmentation fault (core dumped)

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230713171955.149236-1-stefanb@linux.ibm.com
---
 hw/tpm/tpm_tis_sysbus.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index 45e63efd63..6724b3d4f6 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -93,7 +93,6 @@ static void tpm_tis_sysbus_reset(DeviceState *dev)
 static Property tpm_tis_sysbus_properties[] = {
     DEFINE_PROP_UINT32("irq", TPMStateSysBus, state.irq_num, TPM_TIS_IRQ),
     DEFINE_PROP_TPMBE("tpmdev", TPMStateSysBus, state.be_driver),
-    DEFINE_PROP_BOOL("ppi", TPMStateSysBus, state.ppi_enabled, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 

From 4f8ed2fd7944ed76276c22abf07ccef4dc413fb3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 12:00:25 -0700
Subject: [PATCH 0774/1353] linux-user: Reformat syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Untabify and re-indent.
We had a mix of 2, 3, 4, and 8 space indentation.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 1948 ++++++++++++++++++-------------------
 1 file changed, 974 insertions(+), 974 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index cc37054cb5..e80d54780b 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -33,18 +33,18 @@
 #define TARGET_SYS_SENDMMSG     20        /* sendmmsg()            */
 
 #define IPCOP_CALL(VERSION, OP) ((VERSION) << 16 | (OP))
-#define IPCOP_semop		1
-#define IPCOP_semget		2
-#define IPCOP_semctl		3
-#define IPCOP_semtimedop	4
-#define IPCOP_msgsnd		11
-#define IPCOP_msgrcv		12
-#define IPCOP_msgget		13
-#define IPCOP_msgctl		14
-#define IPCOP_shmat		21
-#define IPCOP_shmdt		22
-#define IPCOP_shmget		23
-#define IPCOP_shmctl		24
+#define IPCOP_semop             1
+#define IPCOP_semget            2
+#define IPCOP_semctl            3
+#define IPCOP_semtimedop        4
+#define IPCOP_msgsnd            11
+#define IPCOP_msgrcv            12
+#define IPCOP_msgget            13
+#define IPCOP_msgctl            14
+#define IPCOP_shmat             21
+#define IPCOP_shmdt             22
+#define IPCOP_shmget            23
+#define IPCOP_shmctl            24
 
 #define TARGET_SEMOPM     500
 
@@ -56,42 +56,42 @@
  * this explicit here.  Please be sure to use the decoding macros
  * below from now on.
  */
-#define TARGET_IOC_NRBITS	8
-#define TARGET_IOC_TYPEBITS	8
+#define TARGET_IOC_NRBITS       8
+#define TARGET_IOC_TYPEBITS     8
 
-#if (defined(TARGET_I386) && defined(TARGET_ABI32)) \
-    || (defined(TARGET_ARM) && defined(TARGET_ABI32)) \
-    || (defined(TARGET_SPARC) && defined(TARGET_ABI32)) \
+#if (defined(TARGET_I386) && defined(TARGET_ABI32))                     \
+    || (defined(TARGET_ARM) && defined(TARGET_ABI32))                   \
+    || (defined(TARGET_SPARC) && defined(TARGET_ABI32))                 \
     || defined(TARGET_M68K) || defined(TARGET_SH4) || defined(TARGET_CRIS)
-    /* 16 bit uid wrappers emulation */
+/* 16 bit uid wrappers emulation */
 #define USE_UID16
 #define target_id uint16_t
 #else
 #define target_id uint32_t
 #endif
 
-#if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SH4) \
-    || defined(TARGET_M68K) || defined(TARGET_CRIS) \
-    || defined(TARGET_S390X) || defined(TARGET_OPENRISC) \
-    || defined(TARGET_NIOS2) || defined(TARGET_RISCV) \
+#if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SH4)  \
+    || defined(TARGET_M68K) || defined(TARGET_CRIS)                     \
+    || defined(TARGET_S390X) || defined(TARGET_OPENRISC)                \
+    || defined(TARGET_NIOS2) || defined(TARGET_RISCV)                   \
     || defined(TARGET_XTENSA) || defined(TARGET_LOONGARCH64)
 
-#define TARGET_IOC_SIZEBITS	14
-#define TARGET_IOC_DIRBITS	2
+#define TARGET_IOC_SIZEBITS     14
+#define TARGET_IOC_DIRBITS      2
 
-#define TARGET_IOC_NONE	  0U
+#define TARGET_IOC_NONE   0U
 #define TARGET_IOC_WRITE  1U
-#define TARGET_IOC_READ	  2U
+#define TARGET_IOC_READ   2U
 
-#elif defined(TARGET_PPC) || defined(TARGET_ALPHA) || \
-      defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE) || \
-      defined(TARGET_MIPS)
+#elif defined(TARGET_PPC) || defined(TARGET_ALPHA) ||           \
+    defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE) ||      \
+    defined(TARGET_MIPS)
 
-#define TARGET_IOC_SIZEBITS	13
-#define TARGET_IOC_DIRBITS	3
+#define TARGET_IOC_SIZEBITS     13
+#define TARGET_IOC_DIRBITS      3
 
-#define TARGET_IOC_NONE	  1U
-#define TARGET_IOC_READ	  2U
+#define TARGET_IOC_NONE   1U
+#define TARGET_IOC_READ   2U
 #define TARGET_IOC_WRITE  4U
 
 #elif defined(TARGET_HPPA)
@@ -115,32 +115,32 @@
 #error unsupported CPU
 #endif
 
-#define TARGET_IOC_NRMASK	((1 << TARGET_IOC_NRBITS)-1)
-#define TARGET_IOC_TYPEMASK	((1 << TARGET_IOC_TYPEBITS)-1)
-#define TARGET_IOC_SIZEMASK	((1 << TARGET_IOC_SIZEBITS)-1)
-#define TARGET_IOC_DIRMASK	((1 << TARGET_IOC_DIRBITS)-1)
+#define TARGET_IOC_NRMASK       ((1 << TARGET_IOC_NRBITS)-1)
+#define TARGET_IOC_TYPEMASK     ((1 << TARGET_IOC_TYPEBITS)-1)
+#define TARGET_IOC_SIZEMASK     ((1 << TARGET_IOC_SIZEBITS)-1)
+#define TARGET_IOC_DIRMASK      ((1 << TARGET_IOC_DIRBITS)-1)
 
-#define TARGET_IOC_NRSHIFT	0
-#define TARGET_IOC_TYPESHIFT	(TARGET_IOC_NRSHIFT+TARGET_IOC_NRBITS)
-#define TARGET_IOC_SIZESHIFT	(TARGET_IOC_TYPESHIFT+TARGET_IOC_TYPEBITS)
-#define TARGET_IOC_DIRSHIFT	(TARGET_IOC_SIZESHIFT+TARGET_IOC_SIZEBITS)
+#define TARGET_IOC_NRSHIFT      0
+#define TARGET_IOC_TYPESHIFT    (TARGET_IOC_NRSHIFT+TARGET_IOC_NRBITS)
+#define TARGET_IOC_SIZESHIFT    (TARGET_IOC_TYPESHIFT+TARGET_IOC_TYPEBITS)
+#define TARGET_IOC_DIRSHIFT     (TARGET_IOC_SIZESHIFT+TARGET_IOC_SIZEBITS)
 
-#define TARGET_IOC(dir,type,nr,size) \
-	(((dir)  << TARGET_IOC_DIRSHIFT) | \
-	 ((type) << TARGET_IOC_TYPESHIFT) | \
-	 ((nr)   << TARGET_IOC_NRSHIFT) | \
-	 ((size) << TARGET_IOC_SIZESHIFT))
+#define TARGET_IOC(dir,type,nr,size)            \
+    (((dir)  << TARGET_IOC_DIRSHIFT) |          \
+     ((type) << TARGET_IOC_TYPESHIFT) |         \
+     ((nr)   << TARGET_IOC_NRSHIFT) |           \
+     ((size) << TARGET_IOC_SIZESHIFT))
 
 /* used to create numbers */
-#define TARGET_IO(type,nr)		TARGET_IOC(TARGET_IOC_NONE,(type),(nr),0)
-#define TARGET_IOR(type,nr,size)	TARGET_IOC(TARGET_IOC_READ,(type),(nr),sizeof(size))
-#define TARGET_IOW(type,nr,size)	TARGET_IOC(TARGET_IOC_WRITE,(type),(nr),sizeof(size))
-#define TARGET_IOWR(type,nr,size)	TARGET_IOC(TARGET_IOC_READ|TARGET_IOC_WRITE,(type),(nr),sizeof(size))
+#define TARGET_IO(type,nr)              TARGET_IOC(TARGET_IOC_NONE,(type),(nr),0)
+#define TARGET_IOR(type,nr,size)        TARGET_IOC(TARGET_IOC_READ,(type),(nr),sizeof(size))
+#define TARGET_IOW(type,nr,size)        TARGET_IOC(TARGET_IOC_WRITE,(type),(nr),sizeof(size))
+#define TARGET_IOWR(type,nr,size)       TARGET_IOC(TARGET_IOC_READ|TARGET_IOC_WRITE,(type),(nr),sizeof(size))
 
 /* the size is automatically computed for these defines */
-#define TARGET_IORU(type,nr)	TARGET_IOC(TARGET_IOC_READ,(type),(nr),TARGET_IOC_SIZEMASK)
-#define TARGET_IOWU(type,nr)	TARGET_IOC(TARGET_IOC_WRITE,(type),(nr),TARGET_IOC_SIZEMASK)
-#define TARGET_IOWRU(type,nr)	TARGET_IOC(TARGET_IOC_READ|TARGET_IOC_WRITE,(type),(nr),TARGET_IOC_SIZEMASK)
+#define TARGET_IORU(type,nr)    TARGET_IOC(TARGET_IOC_READ,(type),(nr),TARGET_IOC_SIZEMASK)
+#define TARGET_IOWU(type,nr)    TARGET_IOC(TARGET_IOC_WRITE,(type),(nr),TARGET_IOC_SIZEMASK)
+#define TARGET_IOWRU(type,nr)   TARGET_IOC(TARGET_IOC_READ|TARGET_IOC_WRITE,(type),(nr),TARGET_IOC_SIZEMASK)
 
 struct target_sockaddr {
     abi_ushort sa_family;
@@ -174,12 +174,12 @@ struct target_in_addr {
 };
 
 struct target_sockaddr_in {
-  abi_ushort sin_family;
-  abi_short sin_port; /* big endian */
-  struct target_in_addr sin_addr;
-  uint8_t __pad[sizeof(struct target_sockaddr) -
-                sizeof(abi_ushort) - sizeof(abi_short) -
-                sizeof(struct target_in_addr)];
+    abi_ushort sin_family;
+    abi_short sin_port; /* big endian */
+    struct target_in_addr sin_addr;
+    uint8_t __pad[sizeof(struct target_sockaddr) -
+                  sizeof(abi_ushort) - sizeof(abi_short) -
+                  sizeof(struct target_in_addr)];
 };
 
 struct target_sockaddr_in6 {
@@ -360,12 +360,12 @@ struct target_iovec {
 };
 
 struct target_msghdr {
-    abi_long	 msg_name;	 /* Socket name			*/
-    int		 msg_namelen;	 /* Length of name		*/
-    abi_long	 msg_iov;	 /* Data blocks			*/
-    abi_long	 msg_iovlen;	 /* Number of blocks		*/
-    abi_long     msg_control;	 /* Per protocol magic (eg BSD file descriptor passing) */
-    abi_long	 msg_controllen; /* Length of cmsg list */
+    abi_long     msg_name;       /* Socket name                 */
+    int          msg_namelen;    /* Length of name              */
+    abi_long     msg_iov;        /* Data blocks                 */
+    abi_long     msg_iovlen;     /* Number of blocks            */
+    abi_long     msg_control;    /* Per protocol magic (eg BSD file descriptor passing) */
+    abi_long     msg_controllen; /* Length of cmsg list */
     unsigned int msg_flags;
 };
 
@@ -376,10 +376,10 @@ struct target_cmsghdr {
 };
 
 #define TARGET_CMSG_DATA(cmsg) ((unsigned char *) ((struct target_cmsghdr *) (cmsg) + 1))
-#define TARGET_CMSG_NXTHDR(mhdr, cmsg, cmsg_start) \
-                               __target_cmsg_nxthdr(mhdr, cmsg, cmsg_start)
-#define TARGET_CMSG_ALIGN(len) (((len) + sizeof (abi_long) - 1) \
-                               & (size_t) ~(sizeof (abi_long) - 1))
+#define TARGET_CMSG_NXTHDR(mhdr, cmsg, cmsg_start)      \
+    __target_cmsg_nxthdr(mhdr, cmsg, cmsg_start)
+#define TARGET_CMSG_ALIGN(len) (((len) + sizeof (abi_long) - 1)         \
+                                & (size_t) ~(sizeof (abi_long) - 1))
 #define TARGET_CMSG_SPACE(len) (sizeof(struct target_cmsghdr) + \
                                 TARGET_CMSG_ALIGN(len))
 #define TARGET_CMSG_LEN(len) (sizeof(struct target_cmsghdr) + (len))
@@ -389,16 +389,16 @@ __target_cmsg_nxthdr(struct target_msghdr *__mhdr,
                      struct target_cmsghdr *__cmsg,
                      struct target_cmsghdr *__cmsg_start)
 {
-  struct target_cmsghdr *__ptr;
+    struct target_cmsghdr *__ptr;
 
-  __ptr = (struct target_cmsghdr *)((unsigned char *) __cmsg
-                                    + TARGET_CMSG_ALIGN (tswapal(__cmsg->cmsg_len)));
-  if ((unsigned long)((char *)(__ptr+1) - (char *)__cmsg_start)
-      > tswapal(__mhdr->msg_controllen)) {
-    /* No more entries.  */
-    return (struct target_cmsghdr *)0;
-  }
-  return __ptr;
+    __ptr = (struct target_cmsghdr *)((unsigned char *) __cmsg
+                                      + TARGET_CMSG_ALIGN (tswapal(__cmsg->cmsg_len)));
+    if ((unsigned long)((char *)(__ptr+1) - (char *)__cmsg_start)
+        > tswapal(__mhdr->msg_controllen)) {
+        /* No more entries.  */
+        return (struct target_cmsghdr *)0;
+    }
+    return __ptr;
 }
 
 struct target_mmsghdr {
@@ -407,55 +407,55 @@ struct target_mmsghdr {
 };
 
 struct  target_rusage {
-        struct target_timeval ru_utime;        /* user time used */
-        struct target_timeval ru_stime;        /* system time used */
-        abi_long    ru_maxrss;                 /* maximum resident set size */
-        abi_long    ru_ixrss;                  /* integral shared memory size */
-        abi_long    ru_idrss;                  /* integral unshared data size */
-        abi_long    ru_isrss;                  /* integral unshared stack size */
-        abi_long    ru_minflt;                 /* page reclaims */
-        abi_long    ru_majflt;                 /* page faults */
-        abi_long    ru_nswap;                  /* swaps */
-        abi_long    ru_inblock;                /* block input operations */
-        abi_long    ru_oublock;                /* block output operations */
-        abi_long    ru_msgsnd;                 /* messages sent */
-        abi_long    ru_msgrcv;                 /* messages received */
-        abi_long    ru_nsignals;               /* signals received */
-        abi_long    ru_nvcsw;                  /* voluntary context switches */
-        abi_long    ru_nivcsw;                 /* involuntary " */
+    struct target_timeval ru_utime;        /* user time used */
+    struct target_timeval ru_stime;        /* system time used */
+    abi_long    ru_maxrss;                 /* maximum resident set size */
+    abi_long    ru_ixrss;                  /* integral shared memory size */
+    abi_long    ru_idrss;                  /* integral unshared data size */
+    abi_long    ru_isrss;                  /* integral unshared stack size */
+    abi_long    ru_minflt;                 /* page reclaims */
+    abi_long    ru_majflt;                 /* page faults */
+    abi_long    ru_nswap;                  /* swaps */
+    abi_long    ru_inblock;                /* block input operations */
+    abi_long    ru_oublock;                /* block output operations */
+    abi_long    ru_msgsnd;                 /* messages sent */
+    abi_long    ru_msgrcv;                 /* messages received */
+    abi_long    ru_nsignals;               /* signals received */
+    abi_long    ru_nvcsw;                  /* voluntary context switches */
+    abi_long    ru_nivcsw;                 /* involuntary " */
 };
 
 typedef struct {
-        int     val[2];
+    int     val[2];
 } kernel_fsid_t;
 
 struct target_dirent {
-        abi_long        d_ino;
-        abi_long        d_off;
-        unsigned short  d_reclen;
-        char            d_name[];
+    abi_long        d_ino;
+    abi_long        d_off;
+    unsigned short  d_reclen;
+    char            d_name[];
 };
 
 struct target_dirent64 {
-	abi_ullong      d_ino;
-	abi_llong       d_off;
-	abi_ushort      d_reclen;
-	unsigned char	d_type;
-	char		d_name[];
+    abi_ullong      d_ino;
+    abi_llong       d_off;
+    abi_ushort      d_reclen;
+    unsigned char   d_type;
+    char            d_name[];
 };
 
 
 /* mostly generic signal stuff */
-#define TARGET_SIG_DFL	((abi_long)0)	/* default signal handling */
-#define TARGET_SIG_IGN	((abi_long)1)	/* ignore signal */
-#define TARGET_SIG_ERR	((abi_long)-1)	/* error return from signal */
+#define TARGET_SIG_DFL  ((abi_long)0)   /* default signal handling */
+#define TARGET_SIG_IGN  ((abi_long)1)   /* ignore signal */
+#define TARGET_SIG_ERR  ((abi_long)-1)  /* error return from signal */
 
 #ifdef TARGET_MIPS
-#define TARGET_NSIG	   128
+#define TARGET_NSIG        128
 #else
-#define TARGET_NSIG	   64
+#define TARGET_NSIG        64
 #endif
-#define TARGET_NSIG_BPW	   TARGET_ABI_BITS
+#define TARGET_NSIG_BPW    TARGET_ABI_BITS
 #define TARGET_NSIG_WORDS  (TARGET_NSIG / TARGET_NSIG_BPW)
 
 typedef struct {
@@ -508,71 +508,71 @@ typedef abi_ulong target_old_sa_flags;
 
 #if defined(TARGET_MIPS)
 struct target_sigaction {
-	uint32_t	sa_flags;
+    uint32_t        sa_flags;
 #if defined(TARGET_ABI_MIPSN32)
-	uint32_t	_sa_handler;
+    uint32_t        _sa_handler;
 #else
-	abi_ulong	_sa_handler;
+    abi_ulong       _sa_handler;
 #endif
-	target_sigset_t	sa_mask;
+    target_sigset_t sa_mask;
 #ifdef TARGET_ARCH_HAS_SA_RESTORER
-        /* ??? This is always present, but ignored unless O32.  */
-        abi_ulong sa_restorer;
+    /* ??? This is always present, but ignored unless O32.  */
+    abi_ulong sa_restorer;
 #endif
 };
 #else
 struct target_old_sigaction {
-        abi_ulong _sa_handler;
-        abi_ulong sa_mask;
-        target_old_sa_flags sa_flags;
+    abi_ulong _sa_handler;
+    abi_ulong sa_mask;
+    target_old_sa_flags sa_flags;
 #ifdef TARGET_ARCH_HAS_SA_RESTORER
-        abi_ulong sa_restorer;
+    abi_ulong sa_restorer;
 #endif
 };
 
 struct target_sigaction {
-        abi_ulong _sa_handler;
-        abi_ulong sa_flags;
+    abi_ulong _sa_handler;
+    abi_ulong sa_flags;
 #ifdef TARGET_ARCH_HAS_SA_RESTORER
-        abi_ulong sa_restorer;
+    abi_ulong sa_restorer;
 #endif
-        target_sigset_t sa_mask;
+    target_sigset_t sa_mask;
 #ifdef TARGET_ARCH_HAS_KA_RESTORER
-        abi_ulong ka_restorer;
+    abi_ulong ka_restorer;
 #endif
 };
 #endif
 
 typedef union target_sigval {
-	int sival_int;
-        abi_ulong sival_ptr;
+    int sival_int;
+    abi_ulong sival_ptr;
 } target_sigval_t;
 #if 0
 #if defined (TARGET_SPARC)
 typedef struct {
-	struct {
-		abi_ulong psr;
-		abi_ulong pc;
-		abi_ulong npc;
-		abi_ulong y;
-		abi_ulong u_regs[16]; /* globals and ins */
-	}		si_regs;
-	int		si_mask;
+    struct {
+        abi_ulong psr;
+        abi_ulong pc;
+        abi_ulong npc;
+        abi_ulong y;
+        abi_ulong u_regs[16]; /* globals and ins */
+    }               si_regs;
+    int             si_mask;
 } __siginfo_t;
 
 typedef struct {
-	unsigned   long si_float_regs [32];
-	unsigned   long si_fsr;
-	unsigned   long si_fpqdepth;
-	struct {
-		unsigned long *insn_addr;
-		unsigned long insn;
-	} si_fpqueue [16];
+    unsigned   long si_float_regs [32];
+    unsigned   long si_fsr;
+    unsigned   long si_fpqdepth;
+    struct {
+        unsigned long *insn_addr;
+        unsigned long insn;
+    } si_fpqueue [16];
 } __siginfo_fpu_t;
 #endif
 #endif
 
-#define TARGET_SI_MAX_SIZE	128
+#define TARGET_SI_MAX_SIZE      128
 
 #if TARGET_ABI_BITS == 32
 #define TARGET_SI_PREAMBLE_SIZE (3 * sizeof(int))
@@ -599,82 +599,82 @@ typedef struct {
 
 typedef struct target_siginfo {
 #ifdef TARGET_MIPS
-	int si_signo;
-	int si_code;
-	int si_errno;
+    int si_signo;
+    int si_code;
+    int si_errno;
 #else
-	int si_signo;
-	int si_errno;
-	int si_code;
+    int si_signo;
+    int si_errno;
+    int si_code;
 #endif
 
-	union {
-		int _pad[TARGET_SI_PAD_SIZE];
+    union {
+        int _pad[TARGET_SI_PAD_SIZE];
 
-		/* kill() */
-		struct {
-			pid_t _pid;		/* sender's pid */
-			uid_t _uid;		/* sender's uid */
-		} _kill;
+        /* kill() */
+        struct {
+            pid_t _pid;             /* sender's pid */
+            uid_t _uid;             /* sender's uid */
+        } _kill;
 
-		/* POSIX.1b timers */
-		struct {
-			unsigned int _timer1;
-			unsigned int _timer2;
-		} _timer;
+        /* POSIX.1b timers */
+        struct {
+            unsigned int _timer1;
+            unsigned int _timer2;
+        } _timer;
 
-		/* POSIX.1b signals */
-		struct {
-			pid_t _pid;		/* sender's pid */
-			uid_t _uid;		/* sender's uid */
-			target_sigval_t _sigval;
-		} _rt;
+        /* POSIX.1b signals */
+        struct {
+            pid_t _pid;             /* sender's pid */
+            uid_t _uid;             /* sender's uid */
+            target_sigval_t _sigval;
+        } _rt;
 
-		/* SIGCHLD */
-		struct {
-			pid_t _pid;		/* which child */
-			uid_t _uid;		/* sender's uid */
-			int _status;		/* exit code */
-			target_clock_t _utime;
-                        target_clock_t _stime;
-		} _sigchld;
+        /* SIGCHLD */
+        struct {
+            pid_t _pid;             /* which child */
+            uid_t _uid;             /* sender's uid */
+            int _status;            /* exit code */
+            target_clock_t _utime;
+            target_clock_t _stime;
+        } _sigchld;
 
-		/* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
-		struct {
-			abi_ulong _addr; /* faulting insn/memory ref. */
-		} _sigfault;
+        /* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
+        struct {
+            abi_ulong _addr; /* faulting insn/memory ref. */
+        } _sigfault;
 
-		/* SIGPOLL */
-		struct {
-			int _band;	/* POLL_IN, POLL_OUT, POLL_MSG */
-			int _fd;
-		} _sigpoll;
-	} _sifields;
+        /* SIGPOLL */
+        struct {
+            int _band;      /* POLL_IN, POLL_OUT, POLL_MSG */
+            int _fd;
+        } _sigpoll;
+    } _sifields;
 } target_siginfo_t;
 
 /*
  * si_code values
  * Digital reserves positive values for kernel-generated signals.
  */
-#define TARGET_SI_USER		0	/* sent by kill, sigsend, raise */
-#define TARGET_SI_KERNEL	0x80	/* sent by the kernel from somewhere */
-#define TARGET_SI_QUEUE	-1		/* sent by sigqueue */
+#define TARGET_SI_USER          0       /* sent by kill, sigsend, raise */
+#define TARGET_SI_KERNEL        0x80    /* sent by the kernel from somewhere */
+#define TARGET_SI_QUEUE -1              /* sent by sigqueue */
 #define TARGET_SI_TIMER -2              /* sent by timer expiration */
-#define TARGET_SI_MESGQ	-3		/* sent by real time mesq state change */
-#define TARGET_SI_ASYNCIO	-4	/* sent by AIO completion */
-#define TARGET_SI_SIGIO	-5		/* sent by queued SIGIO */
+#define TARGET_SI_MESGQ -3              /* sent by real time mesq state change */
+#define TARGET_SI_ASYNCIO       -4      /* sent by AIO completion */
+#define TARGET_SI_SIGIO -5              /* sent by queued SIGIO */
 
 /*
  * SIGILL si_codes
  */
-#define TARGET_ILL_ILLOPC	(1)	/* illegal opcode */
-#define TARGET_ILL_ILLOPN	(2)	/* illegal operand */
-#define TARGET_ILL_ILLADR	(3)	/* illegal addressing mode */
-#define TARGET_ILL_ILLTRP	(4)	/* illegal trap */
-#define TARGET_ILL_PRVOPC	(5)	/* privileged opcode */
-#define TARGET_ILL_PRVREG	(6)	/* privileged register */
-#define TARGET_ILL_COPROC	(7)	/* coprocessor error */
-#define TARGET_ILL_BADSTK	(8)	/* internal stack error */
+#define TARGET_ILL_ILLOPC       (1)     /* illegal opcode */
+#define TARGET_ILL_ILLOPN       (2)     /* illegal operand */
+#define TARGET_ILL_ILLADR       (3)     /* illegal addressing mode */
+#define TARGET_ILL_ILLTRP       (4)     /* illegal trap */
+#define TARGET_ILL_PRVOPC       (5)     /* privileged opcode */
+#define TARGET_ILL_PRVREG       (6)     /* privileged register */
+#define TARGET_ILL_COPROC       (7)     /* coprocessor error */
+#define TARGET_ILL_BADSTK       (8)     /* internal stack error */
 
 /*
  * SIGFPE si_codes
@@ -700,9 +700,9 @@ typedef struct target_siginfo {
 /*
  * SIGBUS si_codes
  */
-#define TARGET_BUS_ADRALN       (1)	/* invalid address alignment */
-#define TARGET_BUS_ADRERR       (2)	/* non-existent physical address */
-#define TARGET_BUS_OBJERR       (3)	/* object specific hardware error */
+#define TARGET_BUS_ADRALN       (1)     /* invalid address alignment */
+#define TARGET_BUS_ADRERR       (2)     /* non-existent physical address */
+#define TARGET_BUS_OBJERR       (3)     /* object specific hardware error */
 /* hardware memory error consumed on a machine check: action required */
 #define TARGET_BUS_MCEERR_AR    (4)
 /* hardware memory error detected in process but not consumed: action optional*/
@@ -711,8 +711,8 @@ typedef struct target_siginfo {
 /*
  * SIGTRAP si_codes
  */
-#define TARGET_TRAP_BRKPT	(1)	/* process breakpoint */
-#define TARGET_TRAP_TRACE	(2)	/* process trace trap */
+#define TARGET_TRAP_BRKPT       (1)     /* process breakpoint */
+#define TARGET_TRAP_TRACE       (2)     /* process trace trap */
 #define TARGET_TRAP_BRANCH      (3)     /* process taken branch trap */
 #define TARGET_TRAP_HWBKPT      (4)     /* hardware breakpoint/watchpoint */
 #define TARGET_TRAP_UNK         (5)     /* undiagnosed trap */
@@ -731,18 +731,18 @@ struct target_pollfd {
 };
 
 /* virtual terminal ioctls */
-#define TARGET_KIOCSOUND       0x4B2F	/* start sound generation (0 for off) */
-#define TARGET_KDMKTONE	       0x4B30	/* generate tone */
+#define TARGET_KIOCSOUND       0x4B2F   /* start sound generation (0 for off) */
+#define TARGET_KDMKTONE        0x4B30   /* generate tone */
 #define TARGET_KDGKBTYPE       0x4b33
 #define TARGET_KDSETMODE       0x4b3a
 #define TARGET_KDGKBMODE       0x4b44
 #define TARGET_KDSKBMODE       0x4b45
-#define TARGET_KDGKBENT	       0x4B46	/* gets one entry in translation table */
-#define TARGET_KDGKBSENT       0x4B48	/* gets one function key string entry */
-#define TARGET_KDGKBLED        0x4B64	/* get led flags (not lights) */
-#define TARGET_KDSKBLED        0x4B65	/* set led flags (not lights) */
-#define TARGET_KDGETLED        0x4B31	/* return current led state */
-#define TARGET_KDSETLED        0x4B32	/* set led state [lights, not flags] */
+#define TARGET_KDGKBENT        0x4B46   /* gets one entry in translation table */
+#define TARGET_KDGKBSENT       0x4B48   /* gets one function key string entry */
+#define TARGET_KDGKBLED        0x4B64   /* get led flags (not lights) */
+#define TARGET_KDSKBLED        0x4B65   /* set led flags (not lights) */
+#define TARGET_KDGETLED        0x4B31   /* return current led state */
+#define TARGET_KDSETLED        0x4B32   /* set led state [lights, not flags] */
 #define TARGET_KDSIGACCEPT     0x4B4E
 
 struct target_rtc_pll_info {
@@ -774,15 +774,15 @@ struct target_rtc_pll_info {
 #define TARGET_RTC_EPOCH_SET        TARGET_IOW('p', 0x0e, abi_ulong)
 #define TARGET_RTC_WKALM_RD         TARGET_IOR('p', 0x10, struct rtc_wkalrm)
 #define TARGET_RTC_WKALM_SET        TARGET_IOW('p', 0x0f, struct rtc_wkalrm)
-#define TARGET_RTC_PLL_GET          TARGET_IOR('p', 0x11,                      \
+#define TARGET_RTC_PLL_GET          TARGET_IOR('p', 0x11,               \
                                                struct target_rtc_pll_info)
-#define TARGET_RTC_PLL_SET          TARGET_IOW('p', 0x12,                      \
+#define TARGET_RTC_PLL_SET          TARGET_IOW('p', 0x12,               \
                                                struct target_rtc_pll_info)
 #define TARGET_RTC_VL_READ          TARGET_IOR('p', 0x13, int)
 #define TARGET_RTC_VL_CLR           TARGET_IO('p', 0x14)
 
-#if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SH4) ||    \
-       defined(TARGET_XTENSA)
+#if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SH4) || \
+    defined(TARGET_XTENSA)
 #define TARGET_FIOGETOWN       TARGET_IOR('f', 123, int)
 #define TARGET_FIOSETOWN       TARGET_IOW('f', 124, int)
 #define TARGET_SIOCATMARK      TARGET_IOR('s', 7, int)
@@ -932,8 +932,8 @@ struct target_rtc_pll_info {
 #define TARGET_BLKBSZGET  TARGET_IOR(0x12, 112, abi_ulong)
 #define TARGET_BLKBSZSET  TARGET_IOW(0x12, 113, abi_ulong)
 #define TARGET_BLKGETSIZE64 TARGET_IOR(0x12,114,abi_ulong)
-                                             /* return device size in bytes
-                                                (u64 *arg) */
+/* return device size in bytes
+   (u64 *arg) */
 
 #define TARGET_BLKDISCARD TARGET_IO(0x12, 119)
 #define TARGET_BLKIOMIN TARGET_IO(0x12, 120)
@@ -991,11 +991,11 @@ struct target_rtc_pll_info {
 #define TARGET_BTRFS_IOC_SUBVOL_CREATE          TARGET_IOWU(BTRFS_IOCTL_MAGIC, 14)
 #define TARGET_BTRFS_IOC_SNAP_DESTROY           TARGET_IOWU(BTRFS_IOCTL_MAGIC, 15)
 #define TARGET_BTRFS_IOC_INO_LOOKUP             TARGET_IOWRU(BTRFS_IOCTL_MAGIC, 18)
-#define TARGET_BTRFS_IOC_DEFAULT_SUBVOL         TARGET_IOW(BTRFS_IOCTL_MAGIC, 19,\
+#define TARGET_BTRFS_IOC_DEFAULT_SUBVOL         TARGET_IOW(BTRFS_IOCTL_MAGIC, 19, \
                                                            abi_ullong)
-#define TARGET_BTRFS_IOC_SUBVOL_GETFLAGS        TARGET_IOR(BTRFS_IOCTL_MAGIC, 25,\
+#define TARGET_BTRFS_IOC_SUBVOL_GETFLAGS        TARGET_IOR(BTRFS_IOCTL_MAGIC, 25, \
                                                            abi_ullong)
-#define TARGET_BTRFS_IOC_SUBVOL_SETFLAGS        TARGET_IOW(BTRFS_IOCTL_MAGIC, 26,\
+#define TARGET_BTRFS_IOC_SUBVOL_SETFLAGS        TARGET_IOW(BTRFS_IOCTL_MAGIC, 26, \
                                                            abi_ullong)
 #define TARGET_BTRFS_IOC_SCRUB                  TARGET_IOWRU(BTRFS_IOCTL_MAGIC, 27)
 #define TARGET_BTRFS_IOC_SCRUB_CANCEL           TARGET_IO(BTRFS_IOCTL_MAGIC, 28)
@@ -1049,56 +1049,56 @@ struct target_rtc_pll_info {
 #define TARGET_USBDEVFS_GET_SPEED TARGET_IO('U', 31)
 
 /* cdrom commands */
-#define TARGET_CDROMPAUSE		0x5301 /* Pause Audio Operation */
-#define TARGET_CDROMRESUME		0x5302 /* Resume paused Audio Operation */
-#define TARGET_CDROMPLAYMSF		0x5303 /* Play Audio MSF (struct cdrom_msf) */
-#define TARGET_CDROMPLAYTRKIND		0x5304 /* Play Audio Track/index
-                                           (struct cdrom_ti) */
-#define TARGET_CDROMREADTOCHDR		0x5305 /* Read TOC header
-                                           (struct cdrom_tochdr) */
-#define TARGET_CDROMREADTOCENTRY	0x5306 /* Read TOC entry
-                                           (struct cdrom_tocentry) */
-#define TARGET_CDROMSTOP		0x5307 /* Stop the cdrom drive */
-#define TARGET_CDROMSTART		0x5308 /* Start the cdrom drive */
-#define TARGET_CDROMEJECT		0x5309 /* Ejects the cdrom media */
-#define TARGET_CDROMVOLCTRL		0x530a /* Control output volume
-                                           (struct cdrom_volctrl) */
-#define TARGET_CDROMSUBCHNL		0x530b /* Read subchannel data
-                                           (struct cdrom_subchnl) */
-#define TARGET_CDROMREADMODE2		0x530c /* Read TARGET_CDROM mode 2 data (2336 Bytes)
-                                           (struct cdrom_read) */
-#define TARGET_CDROMREADMODE1		0x530d /* Read TARGET_CDROM mode 1 data (2048 Bytes)
-                                           (struct cdrom_read) */
-#define TARGET_CDROMREADAUDIO		0x530e /* (struct cdrom_read_audio) */
-#define TARGET_CDROMEJECT_SW		0x530f /* enable(1)/disable(0) auto-ejecting */
-#define TARGET_CDROMMULTISESSION	0x5310 /* Obtain the start-of-last-session
-                                           address of multi session disks
-                                           (struct cdrom_multisession) */
-#define TARGET_CDROM_GET_MCN		0x5311 /* Obtain the "Universal Product Code"
-                                           if available (struct cdrom_mcn) */
-#define TARGET_CDROM_GET_UPC		TARGET_CDROM_GET_MCN  /* This one is deprecated,
-                                          but here anyway for compatibility */
-#define TARGET_CDROMRESET		0x5312 /* hard-reset the drive */
-#define TARGET_CDROMVOLREAD		0x5313 /* Get the drive's volume setting
-                                          (struct cdrom_volctrl) */
-#define TARGET_CDROMREADRAW		0x5314	/* read data in raw mode (2352 Bytes)
-                                           (struct cdrom_read) */
+#define TARGET_CDROMPAUSE               0x5301 /* Pause Audio Operation */
+#define TARGET_CDROMRESUME              0x5302 /* Resume paused Audio Operation */
+#define TARGET_CDROMPLAYMSF             0x5303 /* Play Audio MSF (struct cdrom_msf) */
+#define TARGET_CDROMPLAYTRKIND          0x5304 /* Play Audio Track/index
+                                                  (struct cdrom_ti) */
+#define TARGET_CDROMREADTOCHDR          0x5305 /* Read TOC header
+                                                  (struct cdrom_tochdr) */
+#define TARGET_CDROMREADTOCENTRY        0x5306 /* Read TOC entry
+                                                  (struct cdrom_tocentry) */
+#define TARGET_CDROMSTOP                0x5307 /* Stop the cdrom drive */
+#define TARGET_CDROMSTART               0x5308 /* Start the cdrom drive */
+#define TARGET_CDROMEJECT               0x5309 /* Ejects the cdrom media */
+#define TARGET_CDROMVOLCTRL             0x530a /* Control output volume
+                                                  (struct cdrom_volctrl) */
+#define TARGET_CDROMSUBCHNL             0x530b /* Read subchannel data
+                                                  (struct cdrom_subchnl) */
+#define TARGET_CDROMREADMODE2           0x530c /* Read TARGET_CDROM mode 2 data (2336 Bytes)
+                                                  (struct cdrom_read) */
+#define TARGET_CDROMREADMODE1           0x530d /* Read TARGET_CDROM mode 1 data (2048 Bytes)
+                                                  (struct cdrom_read) */
+#define TARGET_CDROMREADAUDIO           0x530e /* (struct cdrom_read_audio) */
+#define TARGET_CDROMEJECT_SW            0x530f /* enable(1)/disable(0) auto-ejecting */
+#define TARGET_CDROMMULTISESSION        0x5310 /* Obtain the start-of-last-session
+                                                  address of multi session disks
+                                                  (struct cdrom_multisession) */
+#define TARGET_CDROM_GET_MCN            0x5311 /* Obtain the "Universal Product Code"
+                                                  if available (struct cdrom_mcn) */
+#define TARGET_CDROM_GET_UPC            TARGET_CDROM_GET_MCN  /* This one is deprecated,
+                                                                 but here anyway for compatibility */
+#define TARGET_CDROMRESET               0x5312 /* hard-reset the drive */
+#define TARGET_CDROMVOLREAD             0x5313 /* Get the drive's volume setting
+                                                  (struct cdrom_volctrl) */
+#define TARGET_CDROMREADRAW             0x5314  /* read data in raw mode (2352 Bytes)
+                                                   (struct cdrom_read) */
 /*
  * These ioctls are used only used in aztcd.c and optcd.c
  */
-#define TARGET_CDROMREADCOOKED		0x5315	/* read data in cooked mode */
-#define TARGET_CDROMSEEK		0x5316  /* seek msf address */
+#define TARGET_CDROMREADCOOKED          0x5315  /* read data in cooked mode */
+#define TARGET_CDROMSEEK                0x5316  /* seek msf address */
 
 /*
  * This ioctl is only used by the scsi-cd driver.
-   It is for playing audio in logical block addressing mode.
- */
-#define TARGET_CDROMPLAYBLK		0x5317	/* (struct cdrom_blk) */
+ It is for playing audio in logical block addressing mode.
+*/
+#define TARGET_CDROMPLAYBLK             0x5317  /* (struct cdrom_blk) */
 
 /*
  * These ioctls are only used in optcd.c
  */
-#define TARGET_CDROMREADALL		0x5318	/* read all 2646 bytes */
+#define TARGET_CDROMREADALL             0x5318  /* read all 2646 bytes */
 
 /*
  * These ioctls are (now) only in ide-cd.c for controlling
@@ -1115,35 +1115,35 @@ struct target_rtc_pll_info {
  * They _will_ be adopted by all CD-ROM drivers, when all the CD-ROM
  * drivers are eventually ported to the uniform CD-ROM driver interface.
  */
-#define TARGET_CDROMCLOSETRAY		0x5319	/* pendant of CDROMEJECT */
-#define TARGET_CDROM_SET_OPTIONS	0x5320  /* Set behavior options */
-#define TARGET_CDROM_CLEAR_OPTIONS	0x5321  /* Clear behavior options */
-#define TARGET_CDROM_SELECT_SPEED	0x5322  /* Set the CD-ROM speed */
-#define TARGET_CDROM_SELECT_DISC	0x5323  /* Select disc (for juke-boxes) */
-#define TARGET_CDROM_MEDIA_CHANGED	0x5325  /* Check is media changed  */
-#define TARGET_CDROM_DRIVE_STATUS	0x5326  /* Get tray position, etc. */
-#define TARGET_CDROM_DISC_STATUS	0x5327  /* Get disc type, etc. */
+#define TARGET_CDROMCLOSETRAY           0x5319  /* pendant of CDROMEJECT */
+#define TARGET_CDROM_SET_OPTIONS        0x5320  /* Set behavior options */
+#define TARGET_CDROM_CLEAR_OPTIONS      0x5321  /* Clear behavior options */
+#define TARGET_CDROM_SELECT_SPEED       0x5322  /* Set the CD-ROM speed */
+#define TARGET_CDROM_SELECT_DISC        0x5323  /* Select disc (for juke-boxes) */
+#define TARGET_CDROM_MEDIA_CHANGED      0x5325  /* Check is media changed  */
+#define TARGET_CDROM_DRIVE_STATUS       0x5326  /* Get tray position, etc. */
+#define TARGET_CDROM_DISC_STATUS        0x5327  /* Get disc type, etc. */
 #define TARGET_CDROM_CHANGER_NSLOTS    0x5328  /* Get number of slots */
-#define TARGET_CDROM_LOCKDOOR		0x5329  /* lock or unlock door */
-#define TARGET_CDROM_DEBUG		0x5330	/* Turn debug messages on/off */
-#define TARGET_CDROM_GET_CAPABILITY	0x5331	/* get capabilities */
+#define TARGET_CDROM_LOCKDOOR           0x5329  /* lock or unlock door */
+#define TARGET_CDROM_DEBUG              0x5330  /* Turn debug messages on/off */
+#define TARGET_CDROM_GET_CAPABILITY     0x5331  /* get capabilities */
 
 /* Note that scsi/scsi_ioctl.h also uses 0x5382 - 0x5386.
  * Future CDROM ioctls should be kept below 0x537F
  */
 
 /* This ioctl is only used by sbpcd at the moment */
-#define TARGET_CDROMAUDIOBUFSIZ        0x5382	/* set the audio buffer size */
-					/* conflict with SCSI_IOCTL_GET_IDLUN */
+#define TARGET_CDROMAUDIOBUFSIZ        0x5382   /* set the audio buffer size */
+/* conflict with SCSI_IOCTL_GET_IDLUN */
 
 /* DVD-ROM Specific ioctls */
-#define TARGET_DVD_READ_STRUCT		0x5390  /* Read structure */
-#define TARGET_DVD_WRITE_STRUCT	0x5391  /* Write structure */
-#define TARGET_DVD_AUTH		0x5392  /* Authentication */
+#define TARGET_DVD_READ_STRUCT          0x5390  /* Read structure */
+#define TARGET_DVD_WRITE_STRUCT 0x5391  /* Write structure */
+#define TARGET_DVD_AUTH         0x5392  /* Authentication */
 
-#define TARGET_CDROM_SEND_PACKET	0x5393	/* send a packet to the drive */
-#define TARGET_CDROM_NEXT_WRITABLE	0x5394	/* get next writable block */
-#define TARGET_CDROM_LAST_WRITTEN	0x5395	/* get last block written on disc */
+#define TARGET_CDROM_SEND_PACKET        0x5393  /* send a packet to the drive */
+#define TARGET_CDROM_NEXT_WRITABLE      0x5394  /* get next writable block */
+#define TARGET_CDROM_LAST_WRITTEN       0x5395  /* get last block written on disc */
 
 /* HD commands */
 
@@ -1234,19 +1234,19 @@ struct target_rtc_pll_info {
 
 #define TARGET_NCC 8
 struct target_termio {
-	unsigned short c_iflag;		/* input mode flags */
-	unsigned short c_oflag;		/* output mode flags */
-	unsigned short c_cflag;		/* control mode flags */
-	unsigned short c_lflag;		/* local mode flags */
-	unsigned char c_line;		/* line discipline */
-	unsigned char c_cc[TARGET_NCC];	/* control characters */
+    unsigned short c_iflag;         /* input mode flags */
+    unsigned short c_oflag;         /* output mode flags */
+    unsigned short c_cflag;         /* control mode flags */
+    unsigned short c_lflag;         /* local mode flags */
+    unsigned char c_line;           /* line discipline */
+    unsigned char c_cc[TARGET_NCC]; /* control characters */
 };
 
 struct target_winsize {
-	unsigned short ws_row;
-	unsigned short ws_col;
-	unsigned short ws_xpixel;
-	unsigned short ws_ypixel;
+    unsigned short ws_row;
+    unsigned short ws_col;
+    unsigned short ws_xpixel;
+    unsigned short ws_ypixel;
 };
 
 #include "termbits.h"
@@ -1263,115 +1263,115 @@ struct target_winsize {
 #endif
 
 /* Common */
-#define TARGET_MAP_SHARED	0x01		/* Share changes */
-#define TARGET_MAP_PRIVATE	0x02		/* Changes are private */
+#define TARGET_MAP_SHARED       0x01            /* Share changes */
+#define TARGET_MAP_PRIVATE      0x02            /* Changes are private */
 #if defined(TARGET_HPPA)
-#define TARGET_MAP_TYPE         0x03		/* Mask for type of mapping */
+#define TARGET_MAP_TYPE         0x03            /* Mask for type of mapping */
 #else
-#define TARGET_MAP_TYPE         0x0f		/* Mask for type of mapping */
+#define TARGET_MAP_TYPE         0x0f            /* Mask for type of mapping */
 #endif
 
 /* Target specific */
 #if defined(TARGET_MIPS)
-#define TARGET_MAP_FIXED	0x10		/* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS	0x0800		/* don't use a file */
-#define TARGET_MAP_GROWSDOWN	0x1000		/* stack-like segment */
-#define TARGET_MAP_DENYWRITE	0x2000		/* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE	0x4000		/* mark it as an executable */
-#define TARGET_MAP_LOCKED	0x8000		/* pages are locked */
-#define TARGET_MAP_NORESERVE	0x0400		/* don't check for reservations */
-#define TARGET_MAP_POPULATE	0x10000		/* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK	0x20000		/* do not block on IO */
+#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
+#define TARGET_MAP_ANONYMOUS    0x0800          /* don't use a file */
+#define TARGET_MAP_GROWSDOWN    0x1000          /* stack-like segment */
+#define TARGET_MAP_DENYWRITE    0x2000          /* ETXTBSY */
+#define TARGET_MAP_EXECUTABLE   0x4000          /* mark it as an executable */
+#define TARGET_MAP_LOCKED       0x8000          /* pages are locked */
+#define TARGET_MAP_NORESERVE    0x0400          /* don't check for reservations */
+#define TARGET_MAP_POPULATE     0x10000         /* populate (prefault) pagetables */
+#define TARGET_MAP_NONBLOCK     0x20000         /* do not block on IO */
 #define TARGET_MAP_STACK        0x40000         /* ignored */
 #define TARGET_MAP_HUGETLB      0x80000         /* create a huge page mapping */
 #elif defined(TARGET_PPC)
-#define TARGET_MAP_FIXED	0x10		/* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS	0x20		/* don't use a file */
-#define TARGET_MAP_GROWSDOWN	0x0100		/* stack-like segment */
-#define TARGET_MAP_DENYWRITE	0x0800		/* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE	0x1000		/* mark it as an executable */
-#define TARGET_MAP_LOCKED	0x0080		/* pages are locked */
-#define TARGET_MAP_NORESERVE	0x0040		/* don't check for reservations */
-#define TARGET_MAP_POPULATE	0x8000		/* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK	0x10000		/* do not block on IO */
+#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
+#define TARGET_MAP_ANONYMOUS    0x20            /* don't use a file */
+#define TARGET_MAP_GROWSDOWN    0x0100          /* stack-like segment */
+#define TARGET_MAP_DENYWRITE    0x0800          /* ETXTBSY */
+#define TARGET_MAP_EXECUTABLE   0x1000          /* mark it as an executable */
+#define TARGET_MAP_LOCKED       0x0080          /* pages are locked */
+#define TARGET_MAP_NORESERVE    0x0040          /* don't check for reservations */
+#define TARGET_MAP_POPULATE     0x8000          /* populate (prefault) pagetables */
+#define TARGET_MAP_NONBLOCK     0x10000         /* do not block on IO */
 #define TARGET_MAP_STACK        0x20000         /* ignored */
 #define TARGET_MAP_HUGETLB      0x40000         /* create a huge page mapping */
 #elif defined(TARGET_ALPHA)
-#define TARGET_MAP_ANONYMOUS	0x10		/* don't use a file */
-#define TARGET_MAP_FIXED	0x100		/* Interpret addr exactly */
-#define TARGET_MAP_GROWSDOWN	0x01000		/* stack-like segment */
-#define TARGET_MAP_DENYWRITE	0x02000		/* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE	0x04000		/* mark it as an executable */
-#define TARGET_MAP_LOCKED	0x08000		/* lock the mapping */
-#define TARGET_MAP_NORESERVE	0x10000		/* no check for reservations */
-#define TARGET_MAP_POPULATE	0x20000		/* pop (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK	0x40000		/* do not block on IO */
+#define TARGET_MAP_ANONYMOUS    0x10            /* don't use a file */
+#define TARGET_MAP_FIXED        0x100           /* Interpret addr exactly */
+#define TARGET_MAP_GROWSDOWN    0x01000         /* stack-like segment */
+#define TARGET_MAP_DENYWRITE    0x02000         /* ETXTBSY */
+#define TARGET_MAP_EXECUTABLE   0x04000         /* mark it as an executable */
+#define TARGET_MAP_LOCKED       0x08000         /* lock the mapping */
+#define TARGET_MAP_NORESERVE    0x10000         /* no check for reservations */
+#define TARGET_MAP_POPULATE     0x20000         /* pop (prefault) pagetables */
+#define TARGET_MAP_NONBLOCK     0x40000         /* do not block on IO */
 #define TARGET_MAP_STACK        0x80000         /* ignored */
 #define TARGET_MAP_HUGETLB      0x100000        /* create a huge page mapping */
 #elif defined(TARGET_HPPA)
-#define TARGET_MAP_ANONYMOUS	0x10		/* don't use a file */
-#define TARGET_MAP_FIXED	0x04		/* Interpret addr exactly */
-#define TARGET_MAP_GROWSDOWN	0x08000		/* stack-like segment */
-#define TARGET_MAP_DENYWRITE	0x00800		/* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE	0x01000		/* mark it as an executable */
-#define TARGET_MAP_LOCKED	0x02000		/* lock the mapping */
-#define TARGET_MAP_NORESERVE	0x04000		/* no check for reservations */
-#define TARGET_MAP_POPULATE	0x10000		/* pop (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK	0x20000		/* do not block on IO */
+#define TARGET_MAP_ANONYMOUS    0x10            /* don't use a file */
+#define TARGET_MAP_FIXED        0x04            /* Interpret addr exactly */
+#define TARGET_MAP_GROWSDOWN    0x08000         /* stack-like segment */
+#define TARGET_MAP_DENYWRITE    0x00800         /* ETXTBSY */
+#define TARGET_MAP_EXECUTABLE   0x01000         /* mark it as an executable */
+#define TARGET_MAP_LOCKED       0x02000         /* lock the mapping */
+#define TARGET_MAP_NORESERVE    0x04000         /* no check for reservations */
+#define TARGET_MAP_POPULATE     0x10000         /* pop (prefault) pagetables */
+#define TARGET_MAP_NONBLOCK     0x20000         /* do not block on IO */
 #define TARGET_MAP_STACK        0x40000         /* ignored */
 #define TARGET_MAP_HUGETLB      0x80000         /* create a huge page mapping */
 #elif defined(TARGET_XTENSA)
-#define TARGET_MAP_FIXED	0x10		/* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS	0x0800		/* don't use a file */
-#define TARGET_MAP_GROWSDOWN	0x1000		/* stack-like segment */
-#define TARGET_MAP_DENYWRITE	0x2000		/* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE	0x4000		/* mark it as an executable */
-#define TARGET_MAP_LOCKED	0x8000		/* pages are locked */
-#define TARGET_MAP_NORESERVE	0x0400		/* don't check for reservations */
-#define TARGET_MAP_POPULATE	0x10000		/* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK	0x20000		/* do not block on IO */
-#define TARGET_MAP_STACK	0x40000
+#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
+#define TARGET_MAP_ANONYMOUS    0x0800          /* don't use a file */
+#define TARGET_MAP_GROWSDOWN    0x1000          /* stack-like segment */
+#define TARGET_MAP_DENYWRITE    0x2000          /* ETXTBSY */
+#define TARGET_MAP_EXECUTABLE   0x4000          /* mark it as an executable */
+#define TARGET_MAP_LOCKED       0x8000          /* pages are locked */
+#define TARGET_MAP_NORESERVE    0x0400          /* don't check for reservations */
+#define TARGET_MAP_POPULATE     0x10000         /* populate (prefault) pagetables */
+#define TARGET_MAP_NONBLOCK     0x20000         /* do not block on IO */
+#define TARGET_MAP_STACK        0x40000
 #define TARGET_MAP_HUGETLB  0x80000         /* create a huge page mapping */
 #else
-#define TARGET_MAP_FIXED	0x10		/* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS	0x20		/* don't use a file */
-#define TARGET_MAP_GROWSDOWN	0x0100		/* stack-like segment */
-#define TARGET_MAP_DENYWRITE	0x0800		/* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE	0x1000		/* mark it as an executable */
-#define TARGET_MAP_LOCKED	0x2000		/* pages are locked */
-#define TARGET_MAP_NORESERVE	0x4000		/* don't check for reservations */
-#define TARGET_MAP_POPULATE	0x8000		/* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK	0x10000		/* do not block on IO */
+#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
+#define TARGET_MAP_ANONYMOUS    0x20            /* don't use a file */
+#define TARGET_MAP_GROWSDOWN    0x0100          /* stack-like segment */
+#define TARGET_MAP_DENYWRITE    0x0800          /* ETXTBSY */
+#define TARGET_MAP_EXECUTABLE   0x1000          /* mark it as an executable */
+#define TARGET_MAP_LOCKED       0x2000          /* pages are locked */
+#define TARGET_MAP_NORESERVE    0x4000          /* don't check for reservations */
+#define TARGET_MAP_POPULATE     0x8000          /* populate (prefault) pagetables */
+#define TARGET_MAP_NONBLOCK     0x10000         /* do not block on IO */
 #define TARGET_MAP_STACK        0x20000         /* ignored */
 #define TARGET_MAP_HUGETLB      0x40000         /* create a huge page mapping */
-#define TARGET_MAP_UNINITIALIZED 0x4000000	/* for anonymous mmap, memory could be uninitialized */
+#define TARGET_MAP_UNINITIALIZED 0x4000000      /* for anonymous mmap, memory could be uninitialized */
 #endif
 
-#if (defined(TARGET_I386) && defined(TARGET_ABI32)) \
-    || (defined(TARGET_ARM) && defined(TARGET_ABI32)) \
+#if (defined(TARGET_I386) && defined(TARGET_ABI32))     \
+    || (defined(TARGET_ARM) && defined(TARGET_ABI32))   \
     || defined(TARGET_CRIS)
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	unsigned short st_dev;
-	unsigned short __pad1;
-	abi_ulong st_ino;
-	unsigned short st_mode;
-	unsigned short st_nlink;
-	unsigned short st_uid;
-	unsigned short st_gid;
-	unsigned short st_rdev;
-	unsigned short __pad2;
-	abi_ulong  st_size;
-	abi_ulong  st_blksize;
-	abi_ulong  st_blocks;
-	abi_ulong  target_st_atime;
-	abi_ulong  target_st_atime_nsec;
-	abi_ulong  target_st_mtime;
-	abi_ulong  target_st_mtime_nsec;
-	abi_ulong  target_st_ctime;
-	abi_ulong  target_st_ctime_nsec;
-	abi_ulong  __unused4;
-	abi_ulong  __unused5;
+    unsigned short st_dev;
+    unsigned short __pad1;
+    abi_ulong st_ino;
+    unsigned short st_mode;
+    unsigned short st_nlink;
+    unsigned short st_uid;
+    unsigned short st_gid;
+    unsigned short st_rdev;
+    unsigned short __pad2;
+    abi_ulong  st_size;
+    abi_ulong  st_blksize;
+    abi_ulong  st_blocks;
+    abi_ulong  target_st_atime;
+    abi_ulong  target_st_atime_nsec;
+    abi_ulong  target_st_mtime;
+    abi_ulong  target_st_mtime_nsec;
+    abi_ulong  target_st_ctime;
+    abi_ulong  target_st_ctime_nsec;
+    abi_ulong  __unused4;
+    abi_ulong  __unused5;
 };
 
 /* This matches struct stat64 in glibc2.1, hence the absolutely
@@ -1379,239 +1379,239 @@ struct target_stat {
  */
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-	unsigned short	st_dev;
-	unsigned char	__pad0[10];
+    unsigned short  st_dev;
+    unsigned char   __pad0[10];
 
-#define TARGET_STAT64_HAS_BROKEN_ST_INO	1
-	abi_ulong	__st_ino;
+#define TARGET_STAT64_HAS_BROKEN_ST_INO 1
+    abi_ulong       __st_ino;
 
-	unsigned int	st_mode;
-	unsigned int	st_nlink;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
 
-	abi_ulong	st_uid;
-	abi_ulong	st_gid;
+    abi_ulong       st_uid;
+    abi_ulong       st_gid;
 
-	unsigned short	st_rdev;
-	unsigned char	__pad3[10];
+    unsigned short  st_rdev;
+    unsigned char   __pad3[10];
 
-	long long	st_size;
-	abi_ulong	st_blksize;
+    long long       st_size;
+    abi_ulong       st_blksize;
 
-	abi_ulong	st_blocks;	/* Number 512-byte blocks allocated. */
-	abi_ulong	__pad4;		/* future possible st_blocks high bits */
+    abi_ulong       st_blocks;      /* Number 512-byte blocks allocated. */
+    abi_ulong       __pad4;         /* future possible st_blocks high bits */
 
-	abi_ulong	target_st_atime;
-	abi_ulong	target_st_atime_nsec;
+    abi_ulong       target_st_atime;
+    abi_ulong       target_st_atime_nsec;
 
-	abi_ulong	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;
+    abi_ulong       target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;
 
-	abi_ulong	target_st_ctime;
-	abi_ulong	target_st_ctime_nsec;
+    abi_ulong       target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;
 
-	unsigned long long	st_ino;
+    unsigned long long      st_ino;
 } QEMU_PACKED;
 
 #ifdef TARGET_ARM
 #define TARGET_HAS_STRUCT_STAT64
 struct target_eabi_stat64 {
-        unsigned long long st_dev;
-        unsigned int    __pad1;
-        abi_ulong    __st_ino;
-        unsigned int    st_mode;
-        unsigned int    st_nlink;
+    unsigned long long st_dev;
+    unsigned int    __pad1;
+    abi_ulong    __st_ino;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
 
-        abi_ulong    st_uid;
-        abi_ulong    st_gid;
+    abi_ulong    st_uid;
+    abi_ulong    st_gid;
 
-        unsigned long long st_rdev;
-        unsigned int    __pad2[2];
+    unsigned long long st_rdev;
+    unsigned int    __pad2[2];
 
-        long long       st_size;
-        abi_ulong    st_blksize;
-        unsigned int    __pad3;
-        unsigned long long st_blocks;
+    long long       st_size;
+    abi_ulong    st_blksize;
+    unsigned int    __pad3;
+    unsigned long long st_blocks;
 
-        abi_ulong    target_st_atime;
-        abi_ulong    target_st_atime_nsec;
+    abi_ulong    target_st_atime;
+    abi_ulong    target_st_atime_nsec;
 
-        abi_ulong    target_st_mtime;
-        abi_ulong    target_st_mtime_nsec;
+    abi_ulong    target_st_mtime;
+    abi_ulong    target_st_mtime_nsec;
 
-        abi_ulong    target_st_ctime;
-        abi_ulong    target_st_ctime_nsec;
+    abi_ulong    target_st_ctime;
+    abi_ulong    target_st_ctime_nsec;
 
-        unsigned long long st_ino;
+    unsigned long long st_ino;
 } QEMU_PACKED;
 #endif
 
 #elif defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 struct target_stat {
-	unsigned int	st_dev;
-	abi_ulong	st_ino;
-	unsigned int	st_mode;
-	unsigned int	st_nlink;
-	unsigned int	st_uid;
-	unsigned int	st_gid;
-	unsigned int	st_rdev;
-	abi_long	st_size;
-	abi_long	target_st_atime;
-	abi_long	target_st_mtime;
-	abi_long	target_st_ctime;
-	abi_long	st_blksize;
-	abi_long	st_blocks;
-	abi_ulong	__unused4[2];
+    unsigned int    st_dev;
+    abi_ulong       st_ino;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
+    unsigned int    st_uid;
+    unsigned int    st_gid;
+    unsigned int    st_rdev;
+    abi_long        st_size;
+    abi_long        target_st_atime;
+    abi_long        target_st_mtime;
+    abi_long        target_st_ctime;
+    abi_long        st_blksize;
+    abi_long        st_blocks;
+    abi_ulong       __unused4[2];
 };
 
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-	unsigned char	__pad0[6];
-	unsigned short	st_dev;
+    unsigned char   __pad0[6];
+    unsigned short  st_dev;
 
-	uint64_t	st_ino;
-	uint64_t	st_nlink;
+    uint64_t        st_ino;
+    uint64_t        st_nlink;
 
-	unsigned int	st_mode;
+    unsigned int    st_mode;
 
-	unsigned int	st_uid;
-	unsigned int	st_gid;
+    unsigned int    st_uid;
+    unsigned int    st_gid;
 
-	unsigned char	__pad2[6];
-	unsigned short	st_rdev;
+    unsigned char   __pad2[6];
+    unsigned short  st_rdev;
 
-        int64_t		st_size;
-	int64_t		st_blksize;
+    int64_t         st_size;
+    int64_t         st_blksize;
 
-	unsigned char	__pad4[4];
-	unsigned int	st_blocks;
+    unsigned char   __pad4[4];
+    unsigned int    st_blocks;
 
-	abi_ulong	target_st_atime;
-	abi_ulong	target_st_atime_nsec;
+    abi_ulong       target_st_atime;
+    abi_ulong       target_st_atime_nsec;
 
-	abi_ulong	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;
+    abi_ulong       target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;
 
-	abi_ulong	target_st_ctime;
-	abi_ulong	target_st_ctime_nsec;
+    abi_ulong       target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;
 
-	abi_ulong	__unused4[3];
+    abi_ulong       __unused4[3];
 };
 
 #elif defined(TARGET_SPARC)
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	unsigned short	st_dev;
-	abi_ulong	st_ino;
-	unsigned short	st_mode;
-	short		st_nlink;
-	unsigned short	st_uid;
-	unsigned short	st_gid;
-	unsigned short	st_rdev;
-	abi_long	st_size;
-	abi_long	target_st_atime;
-	abi_ulong	target_st_atime_nsec;
-	abi_long	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;
-	abi_long	target_st_ctime;
-	abi_ulong	target_st_ctime_nsec;
-	abi_long	st_blksize;
-	abi_long	st_blocks;
-	abi_ulong	__unused1[2];
+    unsigned short  st_dev;
+    abi_ulong       st_ino;
+    unsigned short  st_mode;
+    short           st_nlink;
+    unsigned short  st_uid;
+    unsigned short  st_gid;
+    unsigned short  st_rdev;
+    abi_long        st_size;
+    abi_long        target_st_atime;
+    abi_ulong       target_st_atime_nsec;
+    abi_long        target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;
+    abi_long        target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;
+    abi_long        st_blksize;
+    abi_long        st_blocks;
+    abi_ulong       __unused1[2];
 };
 
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-	unsigned char	__pad0[6];
-	unsigned short	st_dev;
+    unsigned char   __pad0[6];
+    unsigned short  st_dev;
 
-	uint64_t st_ino;
+    uint64_t st_ino;
 
-	unsigned int	st_mode;
-	unsigned int	st_nlink;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
 
-	unsigned int	st_uid;
-	unsigned int	st_gid;
+    unsigned int    st_uid;
+    unsigned int    st_gid;
 
-	unsigned char	__pad2[6];
-	unsigned short	st_rdev;
+    unsigned char   __pad2[6];
+    unsigned short  st_rdev;
 
-	unsigned char	__pad3[8];
+    unsigned char   __pad3[8];
 
-        int64_t	st_size;
-	unsigned int	st_blksize;
+    int64_t st_size;
+    unsigned int    st_blksize;
 
-	unsigned char	__pad4[8];
-	unsigned int	st_blocks;
+    unsigned char   __pad4[8];
+    unsigned int    st_blocks;
 
-	unsigned int	target_st_atime;
-	unsigned int	target_st_atime_nsec;
+    unsigned int    target_st_atime;
+    unsigned int    target_st_atime_nsec;
 
-	unsigned int	target_st_mtime;
-	unsigned int	target_st_mtime_nsec;
+    unsigned int    target_st_mtime;
+    unsigned int    target_st_mtime_nsec;
 
-	unsigned int	target_st_ctime;
-	unsigned int	target_st_ctime_nsec;
+    unsigned int    target_st_ctime;
+    unsigned int    target_st_ctime_nsec;
 
-	unsigned int	__unused1;
-	unsigned int	__unused2;
+    unsigned int    __unused1;
+    unsigned int    __unused2;
 };
 
 #elif defined(TARGET_PPC)
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	abi_ulong st_dev;
-	abi_ulong st_ino;
+    abi_ulong st_dev;
+    abi_ulong st_ino;
 #if defined(TARGET_PPC64)
-	abi_ulong st_nlink;
-	unsigned int st_mode;
+    abi_ulong st_nlink;
+    unsigned int st_mode;
 #else
-	unsigned int st_mode;
-	unsigned short st_nlink;
+    unsigned int st_mode;
+    unsigned short st_nlink;
 #endif
-	unsigned int st_uid;
-	unsigned int st_gid;
-	abi_ulong  st_rdev;
-	abi_ulong  st_size;
-	abi_ulong  st_blksize;
-	abi_ulong  st_blocks;
-	abi_ulong  target_st_atime;
-	abi_ulong  target_st_atime_nsec;
-	abi_ulong  target_st_mtime;
-	abi_ulong  target_st_mtime_nsec;
-	abi_ulong  target_st_ctime;
-	abi_ulong  target_st_ctime_nsec;
-	abi_ulong  __unused4;
-	abi_ulong  __unused5;
+    unsigned int st_uid;
+    unsigned int st_gid;
+    abi_ulong  st_rdev;
+    abi_ulong  st_size;
+    abi_ulong  st_blksize;
+    abi_ulong  st_blocks;
+    abi_ulong  target_st_atime;
+    abi_ulong  target_st_atime_nsec;
+    abi_ulong  target_st_mtime;
+    abi_ulong  target_st_mtime_nsec;
+    abi_ulong  target_st_ctime;
+    abi_ulong  target_st_ctime_nsec;
+    abi_ulong  __unused4;
+    abi_ulong  __unused5;
 #if defined(TARGET_PPC64)
-	abi_ulong  __unused6;
+    abi_ulong  __unused6;
 #endif
 };
 
 #if !defined(TARGET_PPC64)
 #define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
-	unsigned long long st_dev;
-        unsigned long long st_ino;
-	unsigned int st_mode;
-	unsigned int st_nlink;
-	unsigned int st_uid;
-	unsigned int st_gid;
-	unsigned long long st_rdev;
-	unsigned long long __pad0;
-	long long      st_size;
-	int	       st_blksize;
-	unsigned int   __pad1;
-	long long      st_blocks;	/* Number 512-byte blocks allocated. */
-	int	       target_st_atime;
-        unsigned int   target_st_atime_nsec;
-	int	       target_st_mtime;
-        unsigned int   target_st_mtime_nsec;
-	int            target_st_ctime;
-        unsigned int   target_st_ctime_nsec;
-        unsigned int   __unused4;
-        unsigned int   __unused5;
+    unsigned long long st_dev;
+    unsigned long long st_ino;
+    unsigned int st_mode;
+    unsigned int st_nlink;
+    unsigned int st_uid;
+    unsigned int st_gid;
+    unsigned long long st_rdev;
+    unsigned long long __pad0;
+    long long      st_size;
+    int            st_blksize;
+    unsigned int   __pad1;
+    long long      st_blocks;       /* Number 512-byte blocks allocated. */
+    int            target_st_atime;
+    unsigned int   target_st_atime_nsec;
+    int            target_st_mtime;
+    unsigned int   target_st_mtime_nsec;
+    int            target_st_ctime;
+    unsigned int   target_st_ctime_nsec;
+    unsigned int   __unused4;
+    unsigned int   __unused5;
 };
 #endif
 
@@ -1619,78 +1619,78 @@ struct QEMU_PACKED target_stat64 {
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	abi_ulong st_dev;
-	abi_ulong st_ino;
-	unsigned int st_mode;
-	unsigned short st_nlink;
-	unsigned int st_uid;
-	unsigned int st_gid;
-	abi_ulong  st_rdev;
-	abi_ulong  st_size;
-	abi_ulong  st_blksize;
-	abi_ulong  st_blocks;
-	abi_ulong  target_st_atime;
-	abi_ulong  target_st_atime_nsec;
-	abi_ulong  target_st_mtime;
-	abi_ulong  target_st_mtime_nsec;
-	abi_ulong  target_st_ctime;
-	abi_ulong  target_st_ctime_nsec;
-	abi_ulong  __unused4;
-	abi_ulong  __unused5;
+    abi_ulong st_dev;
+    abi_ulong st_ino;
+    unsigned int st_mode;
+    unsigned short st_nlink;
+    unsigned int st_uid;
+    unsigned int st_gid;
+    abi_ulong  st_rdev;
+    abi_ulong  st_size;
+    abi_ulong  st_blksize;
+    abi_ulong  st_blocks;
+    abi_ulong  target_st_atime;
+    abi_ulong  target_st_atime_nsec;
+    abi_ulong  target_st_mtime;
+    abi_ulong  target_st_mtime_nsec;
+    abi_ulong  target_st_ctime;
+    abi_ulong  target_st_ctime_nsec;
+    abi_ulong  __unused4;
+    abi_ulong  __unused5;
 };
 
 /* FIXME: Microblaze no-mmu user-space has a difference stat64 layout...  */
 #define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
-	uint64_t st_dev;
+    uint64_t st_dev;
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
-	uint32_t pad0;
-	uint32_t __st_ino;
+    uint32_t pad0;
+    uint32_t __st_ino;
 
-	uint32_t st_mode;
-	uint32_t st_nlink;
-	uint32_t st_uid;
-	uint32_t st_gid;
-	uint64_t st_rdev;
-	uint64_t __pad1;
+    uint32_t st_mode;
+    uint32_t st_nlink;
+    uint32_t st_uid;
+    uint32_t st_gid;
+    uint64_t st_rdev;
+    uint64_t __pad1;
 
-	int64_t  st_size;
-	int32_t  st_blksize;
-	uint32_t __pad2;
-	int64_t st_blocks;	/* Number 512-byte blocks allocated. */
+    int64_t  st_size;
+    int32_t  st_blksize;
+    uint32_t __pad2;
+    int64_t st_blocks;      /* Number 512-byte blocks allocated. */
 
-	int	       target_st_atime;
-	unsigned int   target_st_atime_nsec;
-	int	       target_st_mtime;
-	unsigned int   target_st_mtime_nsec;
-	int            target_st_ctime;
-	unsigned int   target_st_ctime_nsec;
-	uint64_t st_ino;
+    int            target_st_atime;
+    unsigned int   target_st_atime_nsec;
+    int            target_st_mtime;
+    unsigned int   target_st_mtime_nsec;
+    int            target_st_ctime;
+    unsigned int   target_st_ctime_nsec;
+    uint64_t st_ino;
 };
 
 #elif defined(TARGET_M68K)
 
 struct target_stat {
-	unsigned short st_dev;
-	unsigned short __pad1;
-	abi_ulong st_ino;
-	unsigned short st_mode;
-	unsigned short st_nlink;
-	unsigned short st_uid;
-	unsigned short st_gid;
-	unsigned short st_rdev;
-	unsigned short __pad2;
-	abi_ulong  st_size;
-	abi_ulong  st_blksize;
-	abi_ulong  st_blocks;
-	abi_ulong  target_st_atime;
-	abi_ulong  __unused1;
-	abi_ulong  target_st_mtime;
-	abi_ulong  __unused2;
-	abi_ulong  target_st_ctime;
-	abi_ulong  __unused3;
-	abi_ulong  __unused4;
-	abi_ulong  __unused5;
+    unsigned short st_dev;
+    unsigned short __pad1;
+    abi_ulong st_ino;
+    unsigned short st_mode;
+    unsigned short st_nlink;
+    unsigned short st_uid;
+    unsigned short st_gid;
+    unsigned short st_rdev;
+    unsigned short __pad2;
+    abi_ulong  st_size;
+    abi_ulong  st_blksize;
+    abi_ulong  st_blocks;
+    abi_ulong  target_st_atime;
+    abi_ulong  __unused1;
+    abi_ulong  target_st_mtime;
+    abi_ulong  __unused2;
+    abi_ulong  target_st_ctime;
+    abi_ulong  __unused3;
+    abi_ulong  __unused4;
+    abi_ulong  __unused5;
 };
 
 /* This matches struct stat64 in glibc2.1, hence the absolutely
@@ -1698,37 +1698,37 @@ struct target_stat {
  */
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-	unsigned long long	st_dev;
-	unsigned char	__pad1[2];
+    unsigned long long      st_dev;
+    unsigned char   __pad1[2];
 
-#define TARGET_STAT64_HAS_BROKEN_ST_INO	1
-	abi_ulong	__st_ino;
+#define TARGET_STAT64_HAS_BROKEN_ST_INO 1
+    abi_ulong       __st_ino;
 
-	unsigned int	st_mode;
-	unsigned int	st_nlink;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
 
-	abi_ulong	st_uid;
-	abi_ulong	st_gid;
+    abi_ulong       st_uid;
+    abi_ulong       st_gid;
 
-	unsigned long long	st_rdev;
-	unsigned char	__pad3[2];
+    unsigned long long      st_rdev;
+    unsigned char   __pad3[2];
 
-	long long	st_size;
-	abi_ulong	st_blksize;
+    long long       st_size;
+    abi_ulong       st_blksize;
 
-	abi_ulong	__pad4;		/* future possible st_blocks high bits */
-	abi_ulong	st_blocks;	/* Number 512-byte blocks allocated. */
+    abi_ulong       __pad4;         /* future possible st_blocks high bits */
+    abi_ulong       st_blocks;      /* Number 512-byte blocks allocated. */
 
-	abi_ulong	target_st_atime;
-	abi_ulong	target_st_atime_nsec;
+    abi_ulong       target_st_atime;
+    abi_ulong       target_st_atime_nsec;
 
-	abi_ulong	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;
+    abi_ulong       target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;
 
-	abi_ulong	target_st_ctime;
-	abi_ulong	target_st_ctime_nsec;
+    abi_ulong       target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;
 
-	unsigned long long	st_ino;
+    unsigned long long      st_ino;
 } QEMU_PACKED;
 
 #elif defined(TARGET_ABI_MIPSN64)
@@ -1736,94 +1736,94 @@ struct target_stat64 {
 #define TARGET_STAT_HAVE_NSEC
 /* The memory layout is the same as of struct stat64 of the 32-bit kernel.  */
 struct target_stat {
-	unsigned int		st_dev;
-	unsigned int		st_pad0[3]; /* Reserved for st_dev expansion */
+    unsigned int            st_dev;
+    unsigned int            st_pad0[3]; /* Reserved for st_dev expansion */
 
-	abi_ulong		st_ino;
+    abi_ulong               st_ino;
 
-	unsigned int		st_mode;
-	unsigned int		st_nlink;
+    unsigned int            st_mode;
+    unsigned int            st_nlink;
 
-	int			st_uid;
-	int			st_gid;
+    int                     st_uid;
+    int                     st_gid;
 
-	unsigned int		st_rdev;
-	unsigned int		st_pad1[3]; /* Reserved for st_rdev expansion */
+    unsigned int            st_rdev;
+    unsigned int            st_pad1[3]; /* Reserved for st_rdev expansion */
 
-	abi_ulong		st_size;
+    abi_ulong               st_size;
 
-	/*
-	 * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
-	 * but we don't have it under Linux.
-	 */
-	unsigned int		target_st_atime;
-	unsigned int		target_st_atime_nsec;
+    /*
+     * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
+     * but we don't have it under Linux.
+     */
+    unsigned int            target_st_atime;
+    unsigned int            target_st_atime_nsec;
 
-	unsigned int		target_st_mtime;
-	unsigned int		target_st_mtime_nsec;
+    unsigned int            target_st_mtime;
+    unsigned int            target_st_mtime_nsec;
 
-	unsigned int		target_st_ctime;
-	unsigned int		target_st_ctime_nsec;
+    unsigned int            target_st_ctime;
+    unsigned int            target_st_ctime_nsec;
 
-	unsigned int		st_blksize;
-	unsigned int		st_pad2;
+    unsigned int            st_blksize;
+    unsigned int            st_pad2;
 
-	abi_ulong		st_blocks;
+    abi_ulong               st_blocks;
 };
 
 #elif defined(TARGET_ABI_MIPSN32)
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-        abi_ulong    st_dev;
-        abi_ulong    st_pad0[3]; /* Reserved for st_dev expansion */
-        uint64_t     st_ino;
-        unsigned int st_mode;
-        unsigned int st_nlink;
-        int          st_uid;
-        int          st_gid;
-        abi_ulong    st_rdev;
-        abi_ulong    st_pad1[3]; /* Reserved for st_rdev expansion */
-        int64_t      st_size;
-        abi_long     target_st_atime;
-        abi_ulong    target_st_atime_nsec; /* Reserved for st_atime expansion */
-        abi_long     target_st_mtime;
-        abi_ulong    target_st_mtime_nsec; /* Reserved for st_mtime expansion */
-        abi_long     target_st_ctime;
-        abi_ulong    target_st_ctime_nsec; /* Reserved for st_ctime expansion */
-        abi_ulong    st_blksize;
-        abi_ulong    st_pad2;
-        int64_t      st_blocks;
+    abi_ulong    st_dev;
+    abi_ulong    st_pad0[3]; /* Reserved for st_dev expansion */
+    uint64_t     st_ino;
+    unsigned int st_mode;
+    unsigned int st_nlink;
+    int          st_uid;
+    int          st_gid;
+    abi_ulong    st_rdev;
+    abi_ulong    st_pad1[3]; /* Reserved for st_rdev expansion */
+    int64_t      st_size;
+    abi_long     target_st_atime;
+    abi_ulong    target_st_atime_nsec; /* Reserved for st_atime expansion */
+    abi_long     target_st_mtime;
+    abi_ulong    target_st_mtime_nsec; /* Reserved for st_mtime expansion */
+    abi_long     target_st_ctime;
+    abi_ulong    target_st_ctime_nsec; /* Reserved for st_ctime expansion */
+    abi_ulong    st_blksize;
+    abi_ulong    st_pad2;
+    int64_t      st_blocks;
 };
 
 #elif defined(TARGET_ABI_MIPSO32)
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	unsigned	st_dev;
-	abi_long	st_pad1[3];		/* Reserved for network id */
-	abi_ulong	st_ino;
-	unsigned int	st_mode;
-	unsigned int	st_nlink;
-	int		st_uid;
-	int		st_gid;
-	unsigned 	st_rdev;
-	abi_long	st_pad2[2];
-	abi_long	st_size;
-	abi_long	st_pad3;
-	/*
-	 * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
-	 * but we don't have it under Linux.
-	 */
-	abi_long		target_st_atime;
-	abi_long		target_st_atime_nsec;
-	abi_long		target_st_mtime;
-	abi_long		target_st_mtime_nsec;
-	abi_long		target_st_ctime;
-	abi_long		target_st_ctime_nsec;
-	abi_long		st_blksize;
-	abi_long		st_blocks;
-	abi_long		st_pad4[14];
+    unsigned        st_dev;
+    abi_long        st_pad1[3];             /* Reserved for network id */
+    abi_ulong       st_ino;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
+    int             st_uid;
+    int             st_gid;
+    unsigned        st_rdev;
+    abi_long        st_pad2[2];
+    abi_long        st_size;
+    abi_long        st_pad3;
+    /*
+     * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
+     * but we don't have it under Linux.
+     */
+    abi_long                target_st_atime;
+    abi_long                target_st_atime_nsec;
+    abi_long                target_st_mtime;
+    abi_long                target_st_mtime_nsec;
+    abi_long                target_st_ctime;
+    abi_long                target_st_ctime_nsec;
+    abi_long                st_blksize;
+    abi_long                st_blocks;
+    abi_long                st_pad4[14];
 };
 
 /*
@@ -1834,107 +1834,107 @@ struct target_stat {
 
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-	abi_ulong	st_dev;
-	abi_ulong	st_pad0[3];	/* Reserved for st_dev expansion  */
+    abi_ulong       st_dev;
+    abi_ulong       st_pad0[3];     /* Reserved for st_dev expansion  */
 
-	uint64_t	st_ino;
+    uint64_t        st_ino;
 
-        unsigned int	st_mode;
-        unsigned int	st_nlink;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
 
-	int		st_uid;
-	int		st_gid;
+    int             st_uid;
+    int             st_gid;
 
-	abi_ulong	st_rdev;
-	abi_ulong	st_pad1[3];	/* Reserved for st_rdev expansion  */
+    abi_ulong       st_rdev;
+    abi_ulong       st_pad1[3];     /* Reserved for st_rdev expansion  */
 
-	int64_t 	st_size;
+    int64_t         st_size;
 
-	/*
-	 * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
-	 * but we don't have it under Linux.
-	 */
-	abi_long	target_st_atime;
-	abi_ulong	target_st_atime_nsec;	/* Reserved for st_atime expansion  */
+    /*
+     * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
+     * but we don't have it under Linux.
+     */
+    abi_long        target_st_atime;
+    abi_ulong       target_st_atime_nsec;   /* Reserved for st_atime expansion  */
 
-	abi_long	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;	/* Reserved for st_mtime expansion  */
+    abi_long        target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;   /* Reserved for st_mtime expansion  */
 
-	abi_long	target_st_ctime;
-	abi_ulong	target_st_ctime_nsec;	/* Reserved for st_ctime expansion  */
+    abi_long        target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;   /* Reserved for st_ctime expansion  */
 
-	abi_ulong	st_blksize;
-	abi_ulong	st_pad2;
+    abi_ulong       st_blksize;
+    abi_ulong       st_pad2;
 
-	int64_t  	st_blocks;
+    int64_t         st_blocks;
 };
 
 #elif defined(TARGET_ALPHA)
 
 struct target_stat {
-       unsigned int    st_dev;
-       unsigned int    st_ino;
-       unsigned int    st_mode;
-       unsigned int    st_nlink;
-       unsigned int    st_uid;
-       unsigned int    st_gid;
-       unsigned int    st_rdev;
-       abi_long     st_size;
-       abi_ulong    target_st_atime;
-       abi_ulong    target_st_mtime;
-       abi_ulong    target_st_ctime;
-       unsigned int    st_blksize;
-       unsigned int    st_blocks;
-       unsigned int    st_flags;
-       unsigned int    st_gen;
+    unsigned int    st_dev;
+    unsigned int    st_ino;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
+    unsigned int    st_uid;
+    unsigned int    st_gid;
+    unsigned int    st_rdev;
+    abi_long     st_size;
+    abi_ulong    target_st_atime;
+    abi_ulong    target_st_mtime;
+    abi_ulong    target_st_ctime;
+    unsigned int    st_blksize;
+    unsigned int    st_blocks;
+    unsigned int    st_flags;
+    unsigned int    st_gen;
 };
 
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-       abi_ulong    st_dev;
-       abi_ulong    st_ino;
-       abi_ulong    st_rdev;
-       abi_long     st_size;
-       abi_ulong    st_blocks;
+    abi_ulong    st_dev;
+    abi_ulong    st_ino;
+    abi_ulong    st_rdev;
+    abi_long     st_size;
+    abi_ulong    st_blocks;
 
-       unsigned int    st_mode;
-       unsigned int    st_uid;
-       unsigned int    st_gid;
-       unsigned int    st_blksize;
-       unsigned int    st_nlink;
-       unsigned int    __pad0;
+    unsigned int    st_mode;
+    unsigned int    st_uid;
+    unsigned int    st_gid;
+    unsigned int    st_blksize;
+    unsigned int    st_nlink;
+    unsigned int    __pad0;
 
-       abi_ulong    target_st_atime;
-       abi_ulong    target_st_atime_nsec;
-       abi_ulong    target_st_mtime;
-       abi_ulong    target_st_mtime_nsec;
-       abi_ulong    target_st_ctime;
-       abi_ulong    target_st_ctime_nsec;
-       abi_long     __unused[3];
+    abi_ulong    target_st_atime;
+    abi_ulong    target_st_atime_nsec;
+    abi_ulong    target_st_mtime;
+    abi_ulong    target_st_mtime_nsec;
+    abi_ulong    target_st_ctime;
+    abi_ulong    target_st_ctime_nsec;
+    abi_long     __unused[3];
 };
 
 #elif defined(TARGET_SH4)
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	abi_ulong  st_dev;
-	abi_ulong  st_ino;
-	unsigned short st_mode;
-	unsigned short st_nlink;
-	unsigned short st_uid;
-	unsigned short st_gid;
-	abi_ulong  st_rdev;
-	abi_ulong  st_size;
-	abi_ulong  st_blksize;
-	abi_ulong  st_blocks;
-	abi_ulong  target_st_atime;
-	abi_ulong  target_st_atime_nsec;
-	abi_ulong  target_st_mtime;
-	abi_ulong  target_st_mtime_nsec;
-	abi_ulong  target_st_ctime;
-	abi_ulong  target_st_ctime_nsec;
-	abi_ulong  __unused4;
-	abi_ulong  __unused5;
+    abi_ulong  st_dev;
+    abi_ulong  st_ino;
+    unsigned short st_mode;
+    unsigned short st_nlink;
+    unsigned short st_uid;
+    unsigned short st_gid;
+    abi_ulong  st_rdev;
+    abi_ulong  st_size;
+    abi_ulong  st_blksize;
+    abi_ulong  st_blocks;
+    abi_ulong  target_st_atime;
+    abi_ulong  target_st_atime_nsec;
+    abi_ulong  target_st_mtime;
+    abi_ulong  target_st_mtime_nsec;
+    abi_ulong  target_st_ctime;
+    abi_ulong  target_st_ctime_nsec;
+    abi_ulong  __unused4;
+    abi_ulong  __unused5;
 };
 
 /* This matches struct stat64 in glibc2.1, hence the absolutely
@@ -1942,62 +1942,62 @@ struct target_stat {
  */
 #define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
-	unsigned long long	st_dev;
-	unsigned char	__pad0[4];
+    unsigned long long      st_dev;
+    unsigned char   __pad0[4];
 
-#define TARGET_STAT64_HAS_BROKEN_ST_INO	1
-	abi_ulong	__st_ino;
+#define TARGET_STAT64_HAS_BROKEN_ST_INO 1
+    abi_ulong       __st_ino;
 
-	unsigned int	st_mode;
-	unsigned int	st_nlink;
+    unsigned int    st_mode;
+    unsigned int    st_nlink;
 
-	abi_ulong	st_uid;
-	abi_ulong	st_gid;
+    abi_ulong       st_uid;
+    abi_ulong       st_gid;
 
-	unsigned long long	st_rdev;
-	unsigned char	__pad3[4];
+    unsigned long long      st_rdev;
+    unsigned char   __pad3[4];
 
-	long long	st_size;
-	abi_ulong	st_blksize;
+    long long       st_size;
+    abi_ulong       st_blksize;
 
-	unsigned long long	st_blocks;	/* Number 512-byte blocks allocated. */
+    unsigned long long      st_blocks;      /* Number 512-byte blocks allocated. */
 
-	abi_ulong	target_st_atime;
-	abi_ulong	target_st_atime_nsec;
+    abi_ulong       target_st_atime;
+    abi_ulong       target_st_atime_nsec;
 
-	abi_ulong	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;
+    abi_ulong       target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;
 
-	abi_ulong	target_st_ctime;
-	abi_ulong	target_st_ctime_nsec;
+    abi_ulong       target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;
 
-	unsigned long long	st_ino;
+    unsigned long long      st_ino;
 };
 
 #elif defined(TARGET_I386) && !defined(TARGET_ABI32)
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-	abi_ulong	st_dev;
-	abi_ulong	st_ino;
-	abi_ulong	st_nlink;
+    abi_ulong       st_dev;
+    abi_ulong       st_ino;
+    abi_ulong       st_nlink;
 
-	unsigned int	st_mode;
-	unsigned int	st_uid;
-	unsigned int	st_gid;
-	unsigned int	__pad0;
-	abi_ulong	st_rdev;
-	abi_long	st_size;
-	abi_long	st_blksize;
-	abi_long	st_blocks;	/* Number 512-byte blocks allocated. */
+    unsigned int    st_mode;
+    unsigned int    st_uid;
+    unsigned int    st_gid;
+    unsigned int    __pad0;
+    abi_ulong       st_rdev;
+    abi_long        st_size;
+    abi_long        st_blksize;
+    abi_long        st_blocks;      /* Number 512-byte blocks allocated. */
 
-	abi_ulong	target_st_atime;
-	abi_ulong 	target_st_atime_nsec; 
-	abi_ulong	target_st_mtime;
-	abi_ulong	target_st_mtime_nsec;
-	abi_ulong	target_st_ctime;
-	abi_ulong       target_st_ctime_nsec;
+    abi_ulong       target_st_atime;
+    abi_ulong       target_st_atime_nsec;
+    abi_ulong       target_st_mtime;
+    abi_ulong       target_st_mtime_nsec;
+    abi_ulong       target_st_ctime;
+    abi_ulong       target_st_ctime_nsec;
 
-	abi_long	__unused[3];
+    abi_long        __unused[3];
 };
 #elif defined(TARGET_S390X)
 struct target_stat {
@@ -2090,7 +2090,7 @@ struct target_stat64  {
 };
 
 #elif defined(TARGET_OPENRISC) || defined(TARGET_NIOS2) \
-        || defined(TARGET_RISCV) || defined(TARGET_HEXAGON)
+    || defined(TARGET_RISCV) || defined(TARGET_HEXAGON)
 
 /* These are the asm-generic versions of the stat and stat64 structures */
 
@@ -2210,93 +2210,93 @@ struct target_stat64 {
 #endif
 
 typedef struct {
-        int     val[2];
+    int     val[2];
 } target_fsid_t;
 
 #ifdef TARGET_MIPS
 #ifdef TARGET_ABI_MIPSN32
 struct target_statfs {
-	int32_t			f_type;
-	int32_t			f_bsize;
-	int32_t			f_frsize;	/* Fragment size - unsupported */
-	int32_t			f_blocks;
-	int32_t			f_bfree;
-	int32_t			f_files;
-	int32_t			f_ffree;
-	int32_t			f_bavail;
+    int32_t                 f_type;
+    int32_t                 f_bsize;
+    int32_t                 f_frsize;       /* Fragment size - unsupported */
+    int32_t                 f_blocks;
+    int32_t                 f_bfree;
+    int32_t                 f_files;
+    int32_t                 f_ffree;
+    int32_t                 f_bavail;
 
-	/* Linux specials */
-	target_fsid_t		f_fsid;
-	int32_t			f_namelen;
-	int32_t			f_flags;
-	int32_t			f_spare[5];
+    /* Linux specials */
+    target_fsid_t           f_fsid;
+    int32_t                 f_namelen;
+    int32_t                 f_flags;
+    int32_t                 f_spare[5];
 };
 #else
 struct target_statfs {
-	abi_long		f_type;
-	abi_long		f_bsize;
-	abi_long		f_frsize;	/* Fragment size - unsupported */
-	abi_long		f_blocks;
-	abi_long		f_bfree;
-	abi_long		f_files;
-	abi_long		f_ffree;
-	abi_long		f_bavail;
+    abi_long                f_type;
+    abi_long                f_bsize;
+    abi_long                f_frsize;       /* Fragment size - unsupported */
+    abi_long                f_blocks;
+    abi_long                f_bfree;
+    abi_long                f_files;
+    abi_long                f_ffree;
+    abi_long                f_bavail;
 
-	/* Linux specials */
-	target_fsid_t		f_fsid;
-	abi_long		f_namelen;
-	abi_long		f_flags;
-	abi_long		f_spare[5];
+    /* Linux specials */
+    target_fsid_t           f_fsid;
+    abi_long                f_namelen;
+    abi_long                f_flags;
+    abi_long                f_spare[5];
 };
 #endif
 
 struct target_statfs64 {
-	uint32_t	f_type;
-	uint32_t	f_bsize;
-	uint32_t	f_frsize;	/* Fragment size - unsupported */
-	uint32_t	__pad;
-	uint64_t	f_blocks;
-	uint64_t	f_bfree;
-	uint64_t	f_files;
-	uint64_t	f_ffree;
-	uint64_t	f_bavail;
-	target_fsid_t	f_fsid;
-	uint32_t	f_namelen;
-	uint32_t	f_flags;
-	uint32_t	f_spare[5];
+    uint32_t        f_type;
+    uint32_t        f_bsize;
+    uint32_t        f_frsize;       /* Fragment size - unsupported */
+    uint32_t        __pad;
+    uint64_t        f_blocks;
+    uint64_t        f_bfree;
+    uint64_t        f_files;
+    uint64_t        f_ffree;
+    uint64_t        f_bavail;
+    target_fsid_t   f_fsid;
+    uint32_t        f_namelen;
+    uint32_t        f_flags;
+    uint32_t        f_spare[5];
 };
-#elif (defined(TARGET_PPC64) || defined(TARGET_X86_64) || \
-       defined(TARGET_SPARC64) || defined(TARGET_AARCH64) || \
+#elif (defined(TARGET_PPC64) || defined(TARGET_X86_64) ||       \
+       defined(TARGET_SPARC64) || defined(TARGET_AARCH64) ||    \
        defined(TARGET_RISCV) || defined(TARGET_LOONGARCH64)) && \
-       !defined(TARGET_ABI32)
+    !defined(TARGET_ABI32)
 struct target_statfs {
-	abi_long f_type;
-	abi_long f_bsize;
-	abi_long f_blocks;
-	abi_long f_bfree;
-	abi_long f_bavail;
-	abi_long f_files;
-	abi_long f_ffree;
-	target_fsid_t f_fsid;
-	abi_long f_namelen;
-	abi_long f_frsize;
-	abi_long f_flags;
-	abi_long f_spare[4];
+    abi_long f_type;
+    abi_long f_bsize;
+    abi_long f_blocks;
+    abi_long f_bfree;
+    abi_long f_bavail;
+    abi_long f_files;
+    abi_long f_ffree;
+    target_fsid_t f_fsid;
+    abi_long f_namelen;
+    abi_long f_frsize;
+    abi_long f_flags;
+    abi_long f_spare[4];
 };
 
 struct target_statfs64 {
-	abi_long f_type;
-	abi_long f_bsize;
-	abi_long f_blocks;
-	abi_long f_bfree;
-	abi_long f_bavail;
-	abi_long f_files;
-	abi_long f_ffree;
-	target_fsid_t f_fsid;
-	abi_long f_namelen;
-	abi_long f_frsize;
-	abi_long f_flags;
-	abi_long f_spare[4];
+    abi_long f_type;
+    abi_long f_bsize;
+    abi_long f_blocks;
+    abi_long f_bfree;
+    abi_long f_bavail;
+    abi_long f_files;
+    abi_long f_ffree;
+    target_fsid_t f_fsid;
+    abi_long f_namelen;
+    abi_long f_frsize;
+    abi_long f_flags;
+    abi_long f_spare[4];
 };
 #elif defined(TARGET_S390X)
 struct target_statfs {
@@ -2331,33 +2331,33 @@ struct target_statfs64 {
 };
 #else
 struct target_statfs {
-	uint32_t f_type;
-	uint32_t f_bsize;
-	uint32_t f_blocks;
-	uint32_t f_bfree;
-	uint32_t f_bavail;
-	uint32_t f_files;
-	uint32_t f_ffree;
-	target_fsid_t f_fsid;
-	uint32_t f_namelen;
-	uint32_t f_frsize;
-	uint32_t f_flags;
-	uint32_t f_spare[4];
+    uint32_t f_type;
+    uint32_t f_bsize;
+    uint32_t f_blocks;
+    uint32_t f_bfree;
+    uint32_t f_bavail;
+    uint32_t f_files;
+    uint32_t f_ffree;
+    target_fsid_t f_fsid;
+    uint32_t f_namelen;
+    uint32_t f_frsize;
+    uint32_t f_flags;
+    uint32_t f_spare[4];
 };
 
 struct target_statfs64 {
-	uint32_t f_type;
-	uint32_t f_bsize;
-	uint64_t f_blocks;
-	uint64_t f_bfree;
-	uint64_t f_bavail;
-	uint64_t f_files;
-	uint64_t f_ffree;
-	target_fsid_t f_fsid;
-        uint32_t f_namelen;
-	uint32_t f_frsize;
-	uint32_t f_flags;
-	uint32_t f_spare[4];
+    uint32_t f_type;
+    uint32_t f_bsize;
+    uint64_t f_blocks;
+    uint64_t f_bfree;
+    uint64_t f_bavail;
+    uint64_t f_files;
+    uint64_t f_ffree;
+    target_fsid_t f_fsid;
+    uint32_t f_namelen;
+    uint32_t f_frsize;
+    uint32_t f_flags;
+    uint32_t f_spare[4];
 };
 #endif
 
@@ -2454,63 +2454,63 @@ struct target_statfs64 {
 #define TARGET_SOUND_MIXER_PRIVATE4       TARGET_IOWR('M', 114, int)
 #define TARGET_SOUND_MIXER_PRIVATE5       TARGET_IOWR('M', 115, int)
 
-#define TARGET_MIXER_READ(dev)	TARGET_IOR('M', dev, int)
+#define TARGET_MIXER_READ(dev)  TARGET_IOR('M', dev, int)
 
-#define TARGET_SOUND_MIXER_READ_VOLUME		TARGET_MIXER_READ(SOUND_MIXER_VOLUME)
-#define TARGET_SOUND_MIXER_READ_BASS		TARGET_MIXER_READ(SOUND_MIXER_BASS)
-#define TARGET_SOUND_MIXER_READ_TREBLE		TARGET_MIXER_READ(SOUND_MIXER_TREBLE)
-#define TARGET_SOUND_MIXER_READ_SYNTH		TARGET_MIXER_READ(SOUND_MIXER_SYNTH)
-#define TARGET_SOUND_MIXER_READ_PCM		TARGET_MIXER_READ(SOUND_MIXER_PCM)
-#define TARGET_SOUND_MIXER_READ_SPEAKER	        TARGET_MIXER_READ(SOUND_MIXER_SPEAKER)
-#define TARGET_SOUND_MIXER_READ_LINE		TARGET_MIXER_READ(SOUND_MIXER_LINE)
-#define TARGET_SOUND_MIXER_READ_MIC		TARGET_MIXER_READ(SOUND_MIXER_MIC)
-#define TARGET_SOUND_MIXER_READ_CD		TARGET_MIXER_READ(SOUND_MIXER_CD)
-#define TARGET_SOUND_MIXER_READ_IMIX		TARGET_MIXER_READ(SOUND_MIXER_IMIX)
-#define TARGET_SOUND_MIXER_READ_ALTPCM		TARGET_MIXER_READ(SOUND_MIXER_ALTPCM)
-#define TARGET_SOUND_MIXER_READ_RECLEV		TARGET_MIXER_READ(SOUND_MIXER_RECLEV)
-#define TARGET_SOUND_MIXER_READ_IGAIN		TARGET_MIXER_READ(SOUND_MIXER_IGAIN)
-#define TARGET_SOUND_MIXER_READ_OGAIN		TARGET_MIXER_READ(SOUND_MIXER_OGAIN)
-#define TARGET_SOUND_MIXER_READ_LINE1		TARGET_MIXER_READ(SOUND_MIXER_LINE1)
-#define TARGET_SOUND_MIXER_READ_LINE2		TARGET_MIXER_READ(SOUND_MIXER_LINE2)
-#define TARGET_SOUND_MIXER_READ_LINE3		TARGET_MIXER_READ(SOUND_MIXER_LINE3)
+#define TARGET_SOUND_MIXER_READ_VOLUME          TARGET_MIXER_READ(SOUND_MIXER_VOLUME)
+#define TARGET_SOUND_MIXER_READ_BASS            TARGET_MIXER_READ(SOUND_MIXER_BASS)
+#define TARGET_SOUND_MIXER_READ_TREBLE          TARGET_MIXER_READ(SOUND_MIXER_TREBLE)
+#define TARGET_SOUND_MIXER_READ_SYNTH           TARGET_MIXER_READ(SOUND_MIXER_SYNTH)
+#define TARGET_SOUND_MIXER_READ_PCM             TARGET_MIXER_READ(SOUND_MIXER_PCM)
+#define TARGET_SOUND_MIXER_READ_SPEAKER         TARGET_MIXER_READ(SOUND_MIXER_SPEAKER)
+#define TARGET_SOUND_MIXER_READ_LINE            TARGET_MIXER_READ(SOUND_MIXER_LINE)
+#define TARGET_SOUND_MIXER_READ_MIC             TARGET_MIXER_READ(SOUND_MIXER_MIC)
+#define TARGET_SOUND_MIXER_READ_CD              TARGET_MIXER_READ(SOUND_MIXER_CD)
+#define TARGET_SOUND_MIXER_READ_IMIX            TARGET_MIXER_READ(SOUND_MIXER_IMIX)
+#define TARGET_SOUND_MIXER_READ_ALTPCM          TARGET_MIXER_READ(SOUND_MIXER_ALTPCM)
+#define TARGET_SOUND_MIXER_READ_RECLEV          TARGET_MIXER_READ(SOUND_MIXER_RECLEV)
+#define TARGET_SOUND_MIXER_READ_IGAIN           TARGET_MIXER_READ(SOUND_MIXER_IGAIN)
+#define TARGET_SOUND_MIXER_READ_OGAIN           TARGET_MIXER_READ(SOUND_MIXER_OGAIN)
+#define TARGET_SOUND_MIXER_READ_LINE1           TARGET_MIXER_READ(SOUND_MIXER_LINE1)
+#define TARGET_SOUND_MIXER_READ_LINE2           TARGET_MIXER_READ(SOUND_MIXER_LINE2)
+#define TARGET_SOUND_MIXER_READ_LINE3           TARGET_MIXER_READ(SOUND_MIXER_LINE3)
 
 /* Obsolete macros */
-#define TARGET_SOUND_MIXER_READ_MUTE		TARGET_MIXER_READ(SOUND_MIXER_MUTE)
-#define TARGET_SOUND_MIXER_READ_ENHANCE	        TARGET_MIXER_READ(SOUND_MIXER_ENHANCE)
-#define TARGET_SOUND_MIXER_READ_LOUD		TARGET_MIXER_READ(SOUND_MIXER_LOUD)
+#define TARGET_SOUND_MIXER_READ_MUTE            TARGET_MIXER_READ(SOUND_MIXER_MUTE)
+#define TARGET_SOUND_MIXER_READ_ENHANCE         TARGET_MIXER_READ(SOUND_MIXER_ENHANCE)
+#define TARGET_SOUND_MIXER_READ_LOUD            TARGET_MIXER_READ(SOUND_MIXER_LOUD)
 
-#define TARGET_SOUND_MIXER_READ_RECSRC		TARGET_MIXER_READ(SOUND_MIXER_RECSRC)
-#define TARGET_SOUND_MIXER_READ_DEVMASK	        TARGET_MIXER_READ(SOUND_MIXER_DEVMASK)
-#define TARGET_SOUND_MIXER_READ_RECMASK	        TARGET_MIXER_READ(SOUND_MIXER_RECMASK)
-#define TARGET_SOUND_MIXER_READ_STEREODEVS	TARGET_MIXER_READ(SOUND_MIXER_STEREODEVS)
-#define TARGET_SOUND_MIXER_READ_CAPS		TARGET_MIXER_READ(SOUND_MIXER_CAPS)
+#define TARGET_SOUND_MIXER_READ_RECSRC          TARGET_MIXER_READ(SOUND_MIXER_RECSRC)
+#define TARGET_SOUND_MIXER_READ_DEVMASK         TARGET_MIXER_READ(SOUND_MIXER_DEVMASK)
+#define TARGET_SOUND_MIXER_READ_RECMASK         TARGET_MIXER_READ(SOUND_MIXER_RECMASK)
+#define TARGET_SOUND_MIXER_READ_STEREODEVS      TARGET_MIXER_READ(SOUND_MIXER_STEREODEVS)
+#define TARGET_SOUND_MIXER_READ_CAPS            TARGET_MIXER_READ(SOUND_MIXER_CAPS)
 
-#define TARGET_MIXER_WRITE(dev)		TARGET_IOWR('M', dev, int)
+#define TARGET_MIXER_WRITE(dev)         TARGET_IOWR('M', dev, int)
 
-#define TARGET_SOUND_MIXER_WRITE_VOLUME	TARGET_MIXER_WRITE(SOUND_MIXER_VOLUME)
-#define TARGET_SOUND_MIXER_WRITE_BASS		TARGET_MIXER_WRITE(SOUND_MIXER_BASS)
-#define TARGET_SOUND_MIXER_WRITE_TREBLE	TARGET_MIXER_WRITE(SOUND_MIXER_TREBLE)
-#define TARGET_SOUND_MIXER_WRITE_SYNTH		TARGET_MIXER_WRITE(SOUND_MIXER_SYNTH)
-#define TARGET_SOUND_MIXER_WRITE_PCM		TARGET_MIXER_WRITE(SOUND_MIXER_PCM)
-#define TARGET_SOUND_MIXER_WRITE_SPEAKER	TARGET_MIXER_WRITE(SOUND_MIXER_SPEAKER)
-#define TARGET_SOUND_MIXER_WRITE_LINE		TARGET_MIXER_WRITE(SOUND_MIXER_LINE)
-#define TARGET_SOUND_MIXER_WRITE_MIC		TARGET_MIXER_WRITE(SOUND_MIXER_MIC)
-#define TARGET_SOUND_MIXER_WRITE_CD		TARGET_MIXER_WRITE(SOUND_MIXER_CD)
-#define TARGET_SOUND_MIXER_WRITE_IMIX		TARGET_MIXER_WRITE(SOUND_MIXER_IMIX)
-#define TARGET_SOUND_MIXER_WRITE_ALTPCM	TARGET_MIXER_WRITE(SOUND_MIXER_ALTPCM)
-#define TARGET_SOUND_MIXER_WRITE_RECLEV	TARGET_MIXER_WRITE(SOUND_MIXER_RECLEV)
-#define TARGET_SOUND_MIXER_WRITE_IGAIN		TARGET_MIXER_WRITE(SOUND_MIXER_IGAIN)
-#define TARGET_SOUND_MIXER_WRITE_OGAIN		TARGET_MIXER_WRITE(SOUND_MIXER_OGAIN)
-#define TARGET_SOUND_MIXER_WRITE_LINE1		TARGET_MIXER_WRITE(SOUND_MIXER_LINE1)
-#define TARGET_SOUND_MIXER_WRITE_LINE2		TARGET_MIXER_WRITE(SOUND_MIXER_LINE2)
-#define TARGET_SOUND_MIXER_WRITE_LINE3		TARGET_MIXER_WRITE(SOUND_MIXER_LINE3)
+#define TARGET_SOUND_MIXER_WRITE_VOLUME TARGET_MIXER_WRITE(SOUND_MIXER_VOLUME)
+#define TARGET_SOUND_MIXER_WRITE_BASS           TARGET_MIXER_WRITE(SOUND_MIXER_BASS)
+#define TARGET_SOUND_MIXER_WRITE_TREBLE TARGET_MIXER_WRITE(SOUND_MIXER_TREBLE)
+#define TARGET_SOUND_MIXER_WRITE_SYNTH          TARGET_MIXER_WRITE(SOUND_MIXER_SYNTH)
+#define TARGET_SOUND_MIXER_WRITE_PCM            TARGET_MIXER_WRITE(SOUND_MIXER_PCM)
+#define TARGET_SOUND_MIXER_WRITE_SPEAKER        TARGET_MIXER_WRITE(SOUND_MIXER_SPEAKER)
+#define TARGET_SOUND_MIXER_WRITE_LINE           TARGET_MIXER_WRITE(SOUND_MIXER_LINE)
+#define TARGET_SOUND_MIXER_WRITE_MIC            TARGET_MIXER_WRITE(SOUND_MIXER_MIC)
+#define TARGET_SOUND_MIXER_WRITE_CD             TARGET_MIXER_WRITE(SOUND_MIXER_CD)
+#define TARGET_SOUND_MIXER_WRITE_IMIX           TARGET_MIXER_WRITE(SOUND_MIXER_IMIX)
+#define TARGET_SOUND_MIXER_WRITE_ALTPCM TARGET_MIXER_WRITE(SOUND_MIXER_ALTPCM)
+#define TARGET_SOUND_MIXER_WRITE_RECLEV TARGET_MIXER_WRITE(SOUND_MIXER_RECLEV)
+#define TARGET_SOUND_MIXER_WRITE_IGAIN          TARGET_MIXER_WRITE(SOUND_MIXER_IGAIN)
+#define TARGET_SOUND_MIXER_WRITE_OGAIN          TARGET_MIXER_WRITE(SOUND_MIXER_OGAIN)
+#define TARGET_SOUND_MIXER_WRITE_LINE1          TARGET_MIXER_WRITE(SOUND_MIXER_LINE1)
+#define TARGET_SOUND_MIXER_WRITE_LINE2          TARGET_MIXER_WRITE(SOUND_MIXER_LINE2)
+#define TARGET_SOUND_MIXER_WRITE_LINE3          TARGET_MIXER_WRITE(SOUND_MIXER_LINE3)
 
 /* Obsolete macros */
-#define TARGET_SOUND_MIXER_WRITE_MUTE		TARGET_MIXER_WRITE(SOUND_MIXER_MUTE)
-#define TARGET_SOUND_MIXER_WRITE_ENHANCE	TARGET_MIXER_WRITE(SOUND_MIXER_ENHANCE)
-#define TARGET_SOUND_MIXER_WRITE_LOUD		TARGET_MIXER_WRITE(SOUND_MIXER_LOUD)
+#define TARGET_SOUND_MIXER_WRITE_MUTE           TARGET_MIXER_WRITE(SOUND_MIXER_MUTE)
+#define TARGET_SOUND_MIXER_WRITE_ENHANCE        TARGET_MIXER_WRITE(SOUND_MIXER_ENHANCE)
+#define TARGET_SOUND_MIXER_WRITE_LOUD           TARGET_MIXER_WRITE(SOUND_MIXER_LOUD)
 
-#define TARGET_SOUND_MIXER_WRITE_RECSRC	TARGET_MIXER_WRITE(SOUND_MIXER_RECSRC)
+#define TARGET_SOUND_MIXER_WRITE_RECSRC TARGET_MIXER_WRITE(SOUND_MIXER_RECSRC)
 
 struct target_snd_timer_id {
     int dev_class;
@@ -2575,22 +2575,22 @@ struct target_snd_timer_status {
 
 /* alsa timer ioctls */
 #define TARGET_SNDRV_TIMER_IOCTL_PVERSION     TARGET_IOR('T', 0x00, int)
-#define TARGET_SNDRV_TIMER_IOCTL_NEXT_DEVICE  TARGET_IOWR('T', 0x01,           \
-                                                struct snd_timer_id)
-#define TARGET_SNDRV_TIMER_IOCTL_GINFO        TARGET_IOWR('T', 0x03,           \
-                                                struct target_snd_timer_ginfo)
-#define TARGET_SNDRV_TIMER_IOCTL_GPARAMS      TARGET_IOW('T', 0x04,            \
-                                                struct target_snd_timer_gparams)
-#define TARGET_SNDRV_TIMER_IOCTL_GSTATUS      TARGET_IOWR('T', 0x05,           \
-                                                struct target_snd_timer_gstatus)
-#define TARGET_SNDRV_TIMER_IOCTL_SELECT       TARGET_IOW('T', 0x10,            \
-                                                struct target_snd_timer_select)
-#define TARGET_SNDRV_TIMER_IOCTL_INFO         TARGET_IOR('T', 0x11,            \
-                                                struct target_snd_timer_info)
-#define TARGET_SNDRV_TIMER_IOCTL_PARAMS       TARGET_IOW('T', 0x12,            \
-                                                struct snd_timer_params)
-#define TARGET_SNDRV_TIMER_IOCTL_STATUS       TARGET_IOR('T', 0x14,            \
-                                                struct target_snd_timer_status)
+#define TARGET_SNDRV_TIMER_IOCTL_NEXT_DEVICE  TARGET_IOWR('T', 0x01,    \
+                                                          struct snd_timer_id)
+#define TARGET_SNDRV_TIMER_IOCTL_GINFO        TARGET_IOWR('T', 0x03,    \
+                                                          struct target_snd_timer_ginfo)
+#define TARGET_SNDRV_TIMER_IOCTL_GPARAMS      TARGET_IOW('T', 0x04,     \
+                                                         struct target_snd_timer_gparams)
+#define TARGET_SNDRV_TIMER_IOCTL_GSTATUS      TARGET_IOWR('T', 0x05,    \
+                                                          struct target_snd_timer_gstatus)
+#define TARGET_SNDRV_TIMER_IOCTL_SELECT       TARGET_IOW('T', 0x10,     \
+                                                         struct target_snd_timer_select)
+#define TARGET_SNDRV_TIMER_IOCTL_INFO         TARGET_IOR('T', 0x11,     \
+                                                         struct target_snd_timer_info)
+#define TARGET_SNDRV_TIMER_IOCTL_PARAMS       TARGET_IOW('T', 0x12,     \
+                                                         struct snd_timer_params)
+#define TARGET_SNDRV_TIMER_IOCTL_STATUS       TARGET_IOR('T', 0x14,     \
+                                                         struct target_snd_timer_status)
 #define TARGET_SNDRV_TIMER_IOCTL_START        TARGET_IO('T', 0xa0)
 #define TARGET_SNDRV_TIMER_IOCTL_STOP         TARGET_IO('T', 0xa1)
 #define TARGET_SNDRV_TIMER_IOCTL_CONTINUE     TARGET_IO('T', 0xa2)
@@ -2750,12 +2750,12 @@ typedef int32_t target_timer_t;
 #ifdef TARGET_MIPS
 #define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(int32_t) * 2 + sizeof(abi_long))
 #else
-#define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(int32_t) * 2 \
+#define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(int32_t) * 2         \
                                     + sizeof(target_sigval_t))
 #endif
 
-#define TARGET_SIGEV_PAD_SIZE ((TARGET_SIGEV_MAX_SIZE \
-                                - TARGET_SIGEV_PREAMBLE_SIZE) \
+#define TARGET_SIGEV_PAD_SIZE ((TARGET_SIGEV_MAX_SIZE           \
+                                - TARGET_SIGEV_PREAMBLE_SIZE)   \
                                / sizeof(int32_t))
 
 struct target_sigevent {
@@ -2814,40 +2814,40 @@ struct target_user_cap_data {
 #define TARGET_SYSLOG_ACTION_SIZE_BUFFER   10
 
 struct target_statx_timestamp {
-   int64_t tv_sec;
-   uint32_t tv_nsec;
-   int32_t __reserved;
+    int64_t tv_sec;
+    uint32_t tv_nsec;
+    int32_t __reserved;
 };
 
 struct target_statx {
-   /* 0x00 */
-   uint32_t stx_mask;       /* What results were written [uncond] */
-   uint32_t stx_blksize;    /* Preferred general I/O size [uncond] */
-   uint64_t stx_attributes; /* Flags conveying information about the file */
-   /* 0x10 */
-   uint32_t stx_nlink;      /* Number of hard links */
-   uint32_t stx_uid;        /* User ID of owner */
-   uint32_t stx_gid;        /* Group ID of owner */
-   uint16_t stx_mode;       /* File mode */
-   uint16_t __spare0[1];
-   /* 0x20 */
-   uint64_t stx_ino;        /* Inode number */
-   uint64_t stx_size;       /* File size */
-   uint64_t stx_blocks;     /* Number of 512-byte blocks allocated */
-   uint64_t stx_attributes_mask; /* Mask to show what is supported */
-   /* 0x40 */
-   struct target_statx_timestamp  stx_atime;  /* Last access time */
-   struct target_statx_timestamp  stx_btime;  /* File creation time */
-   struct target_statx_timestamp  stx_ctime;  /* Last attribute change time */
-   struct target_statx_timestamp  stx_mtime;  /* Last data modification time */
-   /* 0x80 */
-   uint32_t stx_rdev_major;   /* Device ID of special file [if bdev/cdev] */
-   uint32_t stx_rdev_minor;
-   uint32_t stx_dev_major; /* ID of device containing file [uncond] */
-   uint32_t stx_dev_minor;
-   /* 0x90 */
-   uint64_t __spare2[14];  /* Spare space for future expansion */
-   /* 0x100 */
+    /* 0x00 */
+    uint32_t stx_mask;       /* What results were written [uncond] */
+    uint32_t stx_blksize;    /* Preferred general I/O size [uncond] */
+    uint64_t stx_attributes; /* Flags conveying information about the file */
+    /* 0x10 */
+    uint32_t stx_nlink;      /* Number of hard links */
+    uint32_t stx_uid;        /* User ID of owner */
+    uint32_t stx_gid;        /* Group ID of owner */
+    uint16_t stx_mode;       /* File mode */
+    uint16_t __spare0[1];
+    /* 0x20 */
+    uint64_t stx_ino;        /* Inode number */
+    uint64_t stx_size;       /* File size */
+    uint64_t stx_blocks;     /* Number of 512-byte blocks allocated */
+    uint64_t stx_attributes_mask; /* Mask to show what is supported */
+    /* 0x40 */
+    struct target_statx_timestamp  stx_atime;  /* Last access time */
+    struct target_statx_timestamp  stx_btime;  /* File creation time */
+    struct target_statx_timestamp  stx_ctime;  /* Last attribute change time */
+    struct target_statx_timestamp  stx_mtime;  /* Last data modification time */
+    /* 0x80 */
+    uint32_t stx_rdev_major;   /* Device ID of special file [if bdev/cdev] */
+    uint32_t stx_rdev_minor;
+    uint32_t stx_dev_major; /* ID of device containing file [uncond] */
+    uint32_t stx_dev_minor;
+    /* 0x90 */
+    uint64_t __spare2[14];  /* Spare space for future expansion */
+    /* 0x100 */
 };
 
 /* from kernel's include/linux/sched/types.h */

From cb80ce5e65f2384c5c356484aa09df1176210223 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 13:37:39 -0700
Subject: [PATCH 0775/1353] linux-user: Remove #if 0 block in syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These definitions are in sparc/signal.c.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index e80d54780b..a4e4df8d3e 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -547,30 +547,6 @@ typedef union target_sigval {
     int sival_int;
     abi_ulong sival_ptr;
 } target_sigval_t;
-#if 0
-#if defined (TARGET_SPARC)
-typedef struct {
-    struct {
-        abi_ulong psr;
-        abi_ulong pc;
-        abi_ulong npc;
-        abi_ulong y;
-        abi_ulong u_regs[16]; /* globals and ins */
-    }               si_regs;
-    int             si_mask;
-} __siginfo_t;
-
-typedef struct {
-    unsigned   long si_float_regs [32];
-    unsigned   long si_fsr;
-    unsigned   long si_fpqdepth;
-    struct {
-        unsigned long *insn_addr;
-        unsigned long insn;
-    } si_fpqueue [16];
-} __siginfo_fpu_t;
-#endif
-#endif
 
 #define TARGET_SI_MAX_SIZE      128
 

From f6ee1627f3c886a84f1dd0943daf78c982e0ff17 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 12:02:28 -0700
Subject: [PATCH 0776/1353] linux-user: Use abi_uint not uint32_t in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 108 +++++++++++++++++++-------------------
 1 file changed, 54 insertions(+), 54 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index a4e4df8d3e..414d88a9ec 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -67,7 +67,7 @@
 #define USE_UID16
 #define target_id uint16_t
 #else
-#define target_id uint32_t
+#define target_id abi_uint
 #endif
 
 #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SH4)  \
@@ -215,9 +215,9 @@ struct target_ip_mreqn {
 
 struct target_ip_mreq_source {
     /* big endian */
-    uint32_t imr_multiaddr;
-    uint32_t imr_interface;
-    uint32_t imr_sourceaddr;
+    abi_uint imr_multiaddr;
+    abi_uint imr_interface;
+    abi_uint imr_sourceaddr;
 };
 
 struct target_linger {
@@ -508,9 +508,9 @@ typedef abi_ulong target_old_sa_flags;
 
 #if defined(TARGET_MIPS)
 struct target_sigaction {
-    uint32_t        sa_flags;
+    abi_uint        sa_flags;
 #if defined(TARGET_ABI_MIPSN32)
-    uint32_t        _sa_handler;
+    abi_uint        _sa_handler;
 #else
     abi_ulong       _sa_handler;
 #endif
@@ -1620,19 +1620,19 @@ struct target_stat {
 struct QEMU_PACKED target_stat64 {
     uint64_t st_dev;
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
-    uint32_t pad0;
-    uint32_t __st_ino;
+    abi_uint pad0;
+    abi_uint __st_ino;
 
-    uint32_t st_mode;
-    uint32_t st_nlink;
-    uint32_t st_uid;
-    uint32_t st_gid;
+    abi_uint st_mode;
+    abi_uint st_nlink;
+    abi_uint st_uid;
+    abi_uint st_gid;
     uint64_t st_rdev;
     uint64_t __pad1;
 
     int64_t  st_size;
     int32_t  st_blksize;
-    uint32_t __pad2;
+    abi_uint __pad2;
     int64_t st_blocks;      /* Number 512-byte blocks allocated. */
 
     int            target_st_atime;
@@ -2227,19 +2227,19 @@ struct target_statfs {
 #endif
 
 struct target_statfs64 {
-    uint32_t        f_type;
-    uint32_t        f_bsize;
-    uint32_t        f_frsize;       /* Fragment size - unsupported */
-    uint32_t        __pad;
+    abi_uint        f_type;
+    abi_uint        f_bsize;
+    abi_uint        f_frsize;       /* Fragment size - unsupported */
+    abi_uint        __pad;
     uint64_t        f_blocks;
     uint64_t        f_bfree;
     uint64_t        f_files;
     uint64_t        f_ffree;
     uint64_t        f_bavail;
     target_fsid_t   f_fsid;
-    uint32_t        f_namelen;
-    uint32_t        f_flags;
-    uint32_t        f_spare[5];
+    abi_uint        f_namelen;
+    abi_uint        f_flags;
+    abi_uint        f_spare[5];
 };
 #elif (defined(TARGET_PPC64) || defined(TARGET_X86_64) ||       \
        defined(TARGET_SPARC64) || defined(TARGET_AARCH64) ||    \
@@ -2307,33 +2307,33 @@ struct target_statfs64 {
 };
 #else
 struct target_statfs {
-    uint32_t f_type;
-    uint32_t f_bsize;
-    uint32_t f_blocks;
-    uint32_t f_bfree;
-    uint32_t f_bavail;
-    uint32_t f_files;
-    uint32_t f_ffree;
+    abi_uint f_type;
+    abi_uint f_bsize;
+    abi_uint f_blocks;
+    abi_uint f_bfree;
+    abi_uint f_bavail;
+    abi_uint f_files;
+    abi_uint f_ffree;
     target_fsid_t f_fsid;
-    uint32_t f_namelen;
-    uint32_t f_frsize;
-    uint32_t f_flags;
-    uint32_t f_spare[4];
+    abi_uint f_namelen;
+    abi_uint f_frsize;
+    abi_uint f_flags;
+    abi_uint f_spare[4];
 };
 
 struct target_statfs64 {
-    uint32_t f_type;
-    uint32_t f_bsize;
+    abi_uint f_type;
+    abi_uint f_bsize;
     uint64_t f_blocks;
     uint64_t f_bfree;
     uint64_t f_bavail;
     uint64_t f_files;
     uint64_t f_ffree;
     target_fsid_t f_fsid;
-    uint32_t f_namelen;
-    uint32_t f_frsize;
-    uint32_t f_flags;
-    uint32_t f_spare[4];
+    abi_uint f_namelen;
+    abi_uint f_frsize;
+    abi_uint f_flags;
+    abi_uint f_spare[4];
 };
 #endif
 
@@ -2713,9 +2713,9 @@ struct target_epoll_event {
 #endif
 
 struct target_ucred {
-    uint32_t pid;
-    uint32_t uid;
-    uint32_t gid;
+    abi_uint pid;
+    abi_uint uid;
+    abi_uint gid;
 };
 
 typedef int32_t target_timer_t;
@@ -2754,14 +2754,14 @@ struct target_sigevent {
 };
 
 struct target_user_cap_header {
-    uint32_t version;
+    abi_uint version;
     int pid;
 };
 
 struct target_user_cap_data {
-    uint32_t effective;
-    uint32_t permitted;
-    uint32_t inheritable;
+    abi_uint effective;
+    abi_uint permitted;
+    abi_uint inheritable;
 };
 
 /* from kernel's include/linux/syslog.h */
@@ -2791,19 +2791,19 @@ struct target_user_cap_data {
 
 struct target_statx_timestamp {
     int64_t tv_sec;
-    uint32_t tv_nsec;
+    abi_uint tv_nsec;
     int32_t __reserved;
 };
 
 struct target_statx {
     /* 0x00 */
-    uint32_t stx_mask;       /* What results were written [uncond] */
-    uint32_t stx_blksize;    /* Preferred general I/O size [uncond] */
+    abi_uint stx_mask;       /* What results were written [uncond] */
+    abi_uint stx_blksize;    /* Preferred general I/O size [uncond] */
     uint64_t stx_attributes; /* Flags conveying information about the file */
     /* 0x10 */
-    uint32_t stx_nlink;      /* Number of hard links */
-    uint32_t stx_uid;        /* User ID of owner */
-    uint32_t stx_gid;        /* Group ID of owner */
+    abi_uint stx_nlink;      /* Number of hard links */
+    abi_uint stx_uid;        /* User ID of owner */
+    abi_uint stx_gid;        /* Group ID of owner */
     uint16_t stx_mode;       /* File mode */
     uint16_t __spare0[1];
     /* 0x20 */
@@ -2817,10 +2817,10 @@ struct target_statx {
     struct target_statx_timestamp  stx_ctime;  /* Last attribute change time */
     struct target_statx_timestamp  stx_mtime;  /* Last data modification time */
     /* 0x80 */
-    uint32_t stx_rdev_major;   /* Device ID of special file [if bdev/cdev] */
-    uint32_t stx_rdev_minor;
-    uint32_t stx_dev_major; /* ID of device containing file [uncond] */
-    uint32_t stx_dev_minor;
+    abi_uint stx_rdev_major;   /* Device ID of special file [if bdev/cdev] */
+    abi_uint stx_rdev_minor;
+    abi_uint stx_dev_major; /* ID of device containing file [uncond] */
+    abi_uint stx_dev_minor;
     /* 0x90 */
     uint64_t __spare2[14];  /* Spare space for future expansion */
     /* 0x100 */

From 5dc0c97130fa5574584ed1186d88b5a02f6359a9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 12:03:49 -0700
Subject: [PATCH 0777/1353] linux-user: Use abi_int not int32_t in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 60 +++++++++++++++++++--------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 414d88a9ec..caaa895bec 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -501,7 +501,7 @@ int do_sigaction(int sig, const struct target_sigaction *act,
 #endif
 
 #if defined(TARGET_ALPHA)
-typedef int32_t target_old_sa_flags;
+typedef abi_int target_old_sa_flags;
 #else
 typedef abi_ulong target_old_sa_flags;
 #endif
@@ -1631,7 +1631,7 @@ struct QEMU_PACKED target_stat64 {
     uint64_t __pad1;
 
     int64_t  st_size;
-    int32_t  st_blksize;
+    abi_int  st_blksize;
     abi_uint __pad2;
     int64_t st_blocks;      /* Number 512-byte blocks allocated. */
 
@@ -2192,20 +2192,20 @@ typedef struct {
 #ifdef TARGET_MIPS
 #ifdef TARGET_ABI_MIPSN32
 struct target_statfs {
-    int32_t                 f_type;
-    int32_t                 f_bsize;
-    int32_t                 f_frsize;       /* Fragment size - unsupported */
-    int32_t                 f_blocks;
-    int32_t                 f_bfree;
-    int32_t                 f_files;
-    int32_t                 f_ffree;
-    int32_t                 f_bavail;
+    abi_int                 f_type;
+    abi_int                 f_bsize;
+    abi_int                 f_frsize;       /* Fragment size - unsupported */
+    abi_int                 f_blocks;
+    abi_int                 f_bfree;
+    abi_int                 f_files;
+    abi_int                 f_ffree;
+    abi_int                 f_bavail;
 
     /* Linux specials */
     target_fsid_t           f_fsid;
-    int32_t                 f_namelen;
-    int32_t                 f_flags;
-    int32_t                 f_spare[5];
+    abi_int                 f_namelen;
+    abi_int                 f_flags;
+    abi_int                 f_spare[5];
 };
 #else
 struct target_statfs {
@@ -2276,34 +2276,34 @@ struct target_statfs64 {
 };
 #elif defined(TARGET_S390X)
 struct target_statfs {
-    int32_t  f_type;
-    int32_t  f_bsize;
+    abi_int  f_type;
+    abi_int  f_bsize;
     abi_long f_blocks;
     abi_long f_bfree;
     abi_long f_bavail;
     abi_long f_files;
     abi_long f_ffree;
     kernel_fsid_t f_fsid;
-    int32_t  f_namelen;
-    int32_t  f_frsize;
-    int32_t  f_flags;
-    int32_t  f_spare[4];
+    abi_int  f_namelen;
+    abi_int  f_frsize;
+    abi_int  f_flags;
+    abi_int  f_spare[4];
 
 };
 
 struct target_statfs64 {
-    int32_t  f_type;
-    int32_t  f_bsize;
+    abi_int  f_type;
+    abi_int  f_bsize;
     abi_long f_blocks;
     abi_long f_bfree;
     abi_long f_bavail;
     abi_long f_files;
     abi_long f_ffree;
     kernel_fsid_t f_fsid;
-    int32_t  f_namelen;
-    int32_t  f_frsize;
-    int32_t  f_flags;
-    int32_t  f_spare[4];
+    abi_int  f_namelen;
+    abi_int  f_frsize;
+    abi_int  f_flags;
+    abi_int  f_spare[4];
 };
 #else
 struct target_statfs {
@@ -2718,21 +2718,21 @@ struct target_ucred {
     abi_uint gid;
 };
 
-typedef int32_t target_timer_t;
+typedef abi_int target_timer_t;
 
 #define TARGET_SIGEV_MAX_SIZE 64
 
 /* This is architecture-specific but most architectures use the default */
 #ifdef TARGET_MIPS
-#define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(int32_t) * 2 + sizeof(abi_long))
+#define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(abi_int) * 2 + sizeof(abi_long))
 #else
-#define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(int32_t) * 2         \
+#define TARGET_SIGEV_PREAMBLE_SIZE (sizeof(abi_int) * 2         \
                                     + sizeof(target_sigval_t))
 #endif
 
 #define TARGET_SIGEV_PAD_SIZE ((TARGET_SIGEV_MAX_SIZE           \
                                 - TARGET_SIGEV_PREAMBLE_SIZE)   \
-                               / sizeof(int32_t))
+                               / sizeof(abi_int))
 
 struct target_sigevent {
     target_sigval_t sigev_value;
@@ -2792,7 +2792,7 @@ struct target_user_cap_data {
 struct target_statx_timestamp {
     int64_t tv_sec;
     abi_uint tv_nsec;
-    int32_t __reserved;
+    abi_int __reserved;
 };
 
 struct target_statx {

From 7af406a629c1b97eeaa0d0ba28fb7229e9e2127e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 12:05:56 -0700
Subject: [PATCH 0778/1353] linux-user: Use abi_ullong not uint64_t in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Be careful not to change linux_dirent64, which is a host structure.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 72 +++++++++++++++++++--------------------
 1 file changed, 36 insertions(+), 36 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index caaa895bec..0af7249330 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1444,8 +1444,8 @@ struct target_stat64 {
     unsigned char   __pad0[6];
     unsigned short  st_dev;
 
-    uint64_t        st_ino;
-    uint64_t        st_nlink;
+    abi_ullong      st_ino;
+    abi_ullong      st_nlink;
 
     unsigned int    st_mode;
 
@@ -1501,7 +1501,7 @@ struct target_stat64 {
     unsigned char   __pad0[6];
     unsigned short  st_dev;
 
-    uint64_t st_ino;
+    abi_ullong      st_ino;
 
     unsigned int    st_mode;
     unsigned int    st_nlink;
@@ -1618,7 +1618,7 @@ struct target_stat {
 /* FIXME: Microblaze no-mmu user-space has a difference stat64 layout...  */
 #define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
-    uint64_t st_dev;
+    abi_ullong st_dev;
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
     abi_uint pad0;
     abi_uint __st_ino;
@@ -1627,8 +1627,8 @@ struct QEMU_PACKED target_stat64 {
     abi_uint st_nlink;
     abi_uint st_uid;
     abi_uint st_gid;
-    uint64_t st_rdev;
-    uint64_t __pad1;
+    abi_ullong st_rdev;
+    abi_ullong __pad1;
 
     int64_t  st_size;
     abi_int  st_blksize;
@@ -1641,7 +1641,7 @@ struct QEMU_PACKED target_stat64 {
     unsigned int   target_st_mtime_nsec;
     int            target_st_ctime;
     unsigned int   target_st_ctime_nsec;
-    uint64_t st_ino;
+    abi_ullong st_ino;
 };
 
 #elif defined(TARGET_M68K)
@@ -1753,7 +1753,7 @@ struct target_stat {
 struct target_stat {
     abi_ulong    st_dev;
     abi_ulong    st_pad0[3]; /* Reserved for st_dev expansion */
-    uint64_t     st_ino;
+    abi_ullong   st_ino;
     unsigned int st_mode;
     unsigned int st_nlink;
     int          st_uid;
@@ -1813,7 +1813,7 @@ struct target_stat64 {
     abi_ulong       st_dev;
     abi_ulong       st_pad0[3];     /* Reserved for st_dev expansion  */
 
-    uint64_t        st_ino;
+    abi_ullong      st_ino;
 
     unsigned int    st_mode;
     unsigned int    st_nlink;
@@ -2044,17 +2044,17 @@ struct target_stat {
 
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64  {
-    uint64_t st_dev;            /* Device */
-    uint64_t st_ino;            /* File serial number */
+    abi_ullong st_dev;          /* Device */
+    abi_ullong st_ino;          /* File serial number */
     unsigned int  st_mode;      /* File mode. */
     unsigned int  st_nlink;     /* Link count. */
     unsigned int  st_uid;       /* User ID of the file's owner. */
     unsigned int  st_gid;       /* Group ID of the file's group. */
-    uint64_t st_rdev;           /* Device number, if device. */
+    abi_ullong st_rdev;         /* Device number, if device. */
     int64_t st_size;            /* Size of file, in bytes. */
     abi_ulong st_blksize;       /* Optimal block size for I/O. */
     abi_ulong __unused2;
-    uint64_t st_blocks;         /* Number 512-byte blocks allocated. */
+    abi_ullong st_blocks;       /* Number 512-byte blocks allocated. */
     abi_ulong target_st_atime;  /* Time of last access. */
     abi_ulong target_st_atime_nsec;
     abi_ulong target_st_mtime;  /* Time of last modification. */
@@ -2097,14 +2097,14 @@ struct target_stat {
 #if !defined(TARGET_RISCV64)
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-    uint64_t st_dev;
-    uint64_t st_ino;
+    abi_ullong st_dev;
+    abi_ullong st_ino;
     unsigned int st_mode;
     unsigned int st_nlink;
     unsigned int st_uid;
     unsigned int st_gid;
-    uint64_t st_rdev;
-    uint64_t __pad1;
+    abi_ullong st_rdev;
+    abi_ullong __pad1;
     int64_t st_size;
     int st_blksize;
     int __pad2;
@@ -2156,14 +2156,14 @@ struct target_stat {
 
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-    uint64_t   st_dev;
+    abi_ullong st_dev;
     abi_uint   _pad1;
     abi_uint   _res1;
     abi_uint   st_mode;
     abi_uint   st_nlink;
     abi_uint   st_uid;
     abi_uint   st_gid;
-    uint64_t   st_rdev;
+    abi_ullong st_rdev;
     abi_uint   _pad2;
     int64_t    st_size;
     abi_int    st_blksize;
@@ -2174,7 +2174,7 @@ struct target_stat64 {
     abi_uint   target_st_mtime_nsec;
     abi_int    target_st_ctime;
     abi_uint   target_st_ctime_nsec;
-    uint64_t   st_ino;
+    abi_ullong st_ino;
 };
 
 #elif defined(TARGET_LOONGARCH64)
@@ -2231,11 +2231,11 @@ struct target_statfs64 {
     abi_uint        f_bsize;
     abi_uint        f_frsize;       /* Fragment size - unsupported */
     abi_uint        __pad;
-    uint64_t        f_blocks;
-    uint64_t        f_bfree;
-    uint64_t        f_files;
-    uint64_t        f_ffree;
-    uint64_t        f_bavail;
+    abi_ullong      f_blocks;
+    abi_ullong      f_bfree;
+    abi_ullong      f_files;
+    abi_ullong      f_ffree;
+    abi_ullong      f_bavail;
     target_fsid_t   f_fsid;
     abi_uint        f_namelen;
     abi_uint        f_flags;
@@ -2324,11 +2324,11 @@ struct target_statfs {
 struct target_statfs64 {
     abi_uint f_type;
     abi_uint f_bsize;
-    uint64_t f_blocks;
-    uint64_t f_bfree;
-    uint64_t f_bavail;
-    uint64_t f_files;
-    uint64_t f_ffree;
+    abi_ullong f_blocks;
+    abi_ullong f_bfree;
+    abi_ullong f_bavail;
+    abi_ullong f_files;
+    abi_ullong f_ffree;
     target_fsid_t f_fsid;
     abi_uint f_namelen;
     abi_uint f_frsize;
@@ -2799,7 +2799,7 @@ struct target_statx {
     /* 0x00 */
     abi_uint stx_mask;       /* What results were written [uncond] */
     abi_uint stx_blksize;    /* Preferred general I/O size [uncond] */
-    uint64_t stx_attributes; /* Flags conveying information about the file */
+    abi_ullong stx_attributes; /* Flags conveying information about the file */
     /* 0x10 */
     abi_uint stx_nlink;      /* Number of hard links */
     abi_uint stx_uid;        /* User ID of owner */
@@ -2807,10 +2807,10 @@ struct target_statx {
     uint16_t stx_mode;       /* File mode */
     uint16_t __spare0[1];
     /* 0x20 */
-    uint64_t stx_ino;        /* Inode number */
-    uint64_t stx_size;       /* File size */
-    uint64_t stx_blocks;     /* Number of 512-byte blocks allocated */
-    uint64_t stx_attributes_mask; /* Mask to show what is supported */
+    abi_ullong stx_ino;      /* Inode number */
+    abi_ullong stx_size;     /* File size */
+    abi_ullong stx_blocks;   /* Number of 512-byte blocks allocated */
+    abi_ullong stx_attributes_mask; /* Mask to show what is supported */
     /* 0x40 */
     struct target_statx_timestamp  stx_atime;  /* Last access time */
     struct target_statx_timestamp  stx_btime;  /* File creation time */
@@ -2822,7 +2822,7 @@ struct target_statx {
     abi_uint stx_dev_major; /* ID of device containing file [uncond] */
     abi_uint stx_dev_minor;
     /* 0x90 */
-    uint64_t __spare2[14];  /* Spare space for future expansion */
+    abi_ullong __spare2[14]; /* Spare space for future expansion */
     /* 0x100 */
 };
 

From 93c5c6cd99c2ae0af6bd424a706ce92d1c582c36 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 12:57:19 -0700
Subject: [PATCH 0779/1353] linux-user: Use abi_llong not int64_t in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Be careful not to change linux_dirent64, which is a host structure.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 0af7249330..2846a8cfa5 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1455,8 +1455,8 @@ struct target_stat64 {
     unsigned char   __pad2[6];
     unsigned short  st_rdev;
 
-    int64_t         st_size;
-    int64_t         st_blksize;
+    abi_llong       st_size;
+    abi_llong       st_blksize;
 
     unsigned char   __pad4[4];
     unsigned int    st_blocks;
@@ -1514,7 +1514,7 @@ struct target_stat64 {
 
     unsigned char   __pad3[8];
 
-    int64_t st_size;
+    abi_llong       st_size;
     unsigned int    st_blksize;
 
     unsigned char   __pad4[8];
@@ -1630,10 +1630,10 @@ struct QEMU_PACKED target_stat64 {
     abi_ullong st_rdev;
     abi_ullong __pad1;
 
-    int64_t  st_size;
+    abi_llong st_size;
     abi_int  st_blksize;
     abi_uint __pad2;
-    int64_t st_blocks;      /* Number 512-byte blocks allocated. */
+    abi_llong st_blocks;
 
     int            target_st_atime;
     unsigned int   target_st_atime_nsec;
@@ -1760,7 +1760,7 @@ struct target_stat {
     int          st_gid;
     abi_ulong    st_rdev;
     abi_ulong    st_pad1[3]; /* Reserved for st_rdev expansion */
-    int64_t      st_size;
+    abi_llong    st_size;
     abi_long     target_st_atime;
     abi_ulong    target_st_atime_nsec; /* Reserved for st_atime expansion */
     abi_long     target_st_mtime;
@@ -1769,7 +1769,7 @@ struct target_stat {
     abi_ulong    target_st_ctime_nsec; /* Reserved for st_ctime expansion */
     abi_ulong    st_blksize;
     abi_ulong    st_pad2;
-    int64_t      st_blocks;
+    abi_llong    st_blocks;
 };
 
 #elif defined(TARGET_ABI_MIPSO32)
@@ -1824,7 +1824,7 @@ struct target_stat64 {
     abi_ulong       st_rdev;
     abi_ulong       st_pad1[3];     /* Reserved for st_rdev expansion  */
 
-    int64_t         st_size;
+    abi_llong       st_size;
 
     /*
      * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
@@ -1842,7 +1842,7 @@ struct target_stat64 {
     abi_ulong       st_blksize;
     abi_ulong       st_pad2;
 
-    int64_t         st_blocks;
+    abi_llong       st_blocks;
 };
 
 #elif defined(TARGET_ALPHA)
@@ -2051,7 +2051,7 @@ struct target_stat64  {
     unsigned int  st_uid;       /* User ID of the file's owner. */
     unsigned int  st_gid;       /* Group ID of the file's group. */
     abi_ullong st_rdev;         /* Device number, if device. */
-    int64_t st_size;            /* Size of file, in bytes. */
+    abi_llong st_size;          /* Size of file, in bytes. */
     abi_ulong st_blksize;       /* Optimal block size for I/O. */
     abi_ulong __unused2;
     abi_ullong st_blocks;       /* Number 512-byte blocks allocated. */
@@ -2105,10 +2105,10 @@ struct target_stat64 {
     unsigned int st_gid;
     abi_ullong st_rdev;
     abi_ullong __pad1;
-    int64_t st_size;
+    abi_llong st_size;
     int st_blksize;
     int __pad2;
-    int64_t st_blocks;
+    abi_llong st_blocks;
     int target_st_atime;
     unsigned int target_st_atime_nsec;
     int target_st_mtime;
@@ -2165,9 +2165,9 @@ struct target_stat64 {
     abi_uint   st_gid;
     abi_ullong st_rdev;
     abi_uint   _pad2;
-    int64_t    st_size;
+    abi_llong  st_size;
     abi_int    st_blksize;
-    int64_t    st_blocks;
+    abi_llong  st_blocks;
     abi_int    target_st_atime;
     abi_uint   target_st_atime_nsec;
     abi_int    target_st_mtime;
@@ -2790,7 +2790,7 @@ struct target_user_cap_data {
 #define TARGET_SYSLOG_ACTION_SIZE_BUFFER   10
 
 struct target_statx_timestamp {
-    int64_t tv_sec;
+    abi_llong tv_sec;
     abi_uint tv_nsec;
     abi_int __reserved;
 };

From c7828bd1c2429d33e7e6ad98e0aa57d08b90ac2a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 13:12:50 -0700
Subject: [PATCH 0780/1353] linux-user: Use abi_uint not unsigned int in
 syscall_defs.h

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 290 +++++++++++++++++++-------------------
 1 file changed, 145 insertions(+), 145 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 2846a8cfa5..20986bd1d3 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -366,7 +366,7 @@ struct target_msghdr {
     abi_long     msg_iovlen;     /* Number of blocks            */
     abi_long     msg_control;    /* Per protocol magic (eg BSD file descriptor passing) */
     abi_long     msg_controllen; /* Length of cmsg list */
-    unsigned int msg_flags;
+    abi_uint     msg_flags;
 };
 
 struct target_cmsghdr {
@@ -403,7 +403,7 @@ __target_cmsg_nxthdr(struct target_msghdr *__mhdr,
 
 struct target_mmsghdr {
     struct target_msghdr msg_hdr;              /* Message header */
-    unsigned int         msg_len;              /* Number of bytes transmitted */
+    abi_uint             msg_len;              /* Number of bytes transmitted */
 };
 
 struct  target_rusage {
@@ -595,8 +595,8 @@ typedef struct target_siginfo {
 
         /* POSIX.1b timers */
         struct {
-            unsigned int _timer1;
-            unsigned int _timer2;
+            abi_uint _timer1;
+            abi_uint _timer2;
         } _timer;
 
         /* POSIX.1b signals */
@@ -857,10 +857,10 @@ struct target_rtc_pll_info {
 #define TARGET_TUNSETOWNER        TARGET_IOW('T', 204, int)
 #define TARGET_TUNSETLINK         TARGET_IOW('T', 205, int)
 #define TARGET_TUNSETGROUP        TARGET_IOW('T', 206, int)
-#define TARGET_TUNGETFEATURES     TARGET_IOR('T', 207, unsigned int)
-#define TARGET_TUNSETOFFLOAD      TARGET_IOW('T', 208, unsigned int)
-#define TARGET_TUNSETTXFILTER     TARGET_IOW('T', 209, unsigned int)
-#define TARGET_TUNGETIFF          TARGET_IOR('T', 210, unsigned int)
+#define TARGET_TUNGETFEATURES     TARGET_IOR('T', 207, abi_uint)
+#define TARGET_TUNSETOFFLOAD      TARGET_IOW('T', 208, abi_uint)
+#define TARGET_TUNSETTXFILTER     TARGET_IOW('T', 209, abi_uint)
+#define TARGET_TUNGETIFF          TARGET_IOR('T', 210, abi_uint)
 #define TARGET_TUNGETSNDBUF       TARGET_IOR('T', 211, int)
 #define TARGET_TUNSETSNDBUF       TARGET_IOW('T', 212, int)
 /*
@@ -870,7 +870,7 @@ struct target_rtc_pll_info {
 #define TARGET_TUNGETVNETHDRSZ    TARGET_IOR('T', 215, int)
 #define TARGET_TUNSETVNETHDRSZ    TARGET_IOW('T', 216, int)
 #define TARGET_TUNSETQUEUE        TARGET_IOW('T', 217, int)
-#define TARGET_TUNSETIFINDEX      TARGET_IOW('T', 218, unsigned int)
+#define TARGET_TUNSETIFINDEX      TARGET_IOW('T', 218, abi_uint)
 /* TUNGETFILTER is not supported: see TUNATTACHFILTER. */
 #define TARGET_TUNSETVNETLE       TARGET_IOW('T', 220, int)
 #define TARGET_TUNGETVNETLE       TARGET_IOR('T', 221, int)
@@ -1361,8 +1361,8 @@ struct target_stat64 {
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
     abi_ulong       __st_ino;
 
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
 
     abi_ulong       st_uid;
     abi_ulong       st_gid;
@@ -1392,20 +1392,20 @@ struct target_stat64 {
 #define TARGET_HAS_STRUCT_STAT64
 struct target_eabi_stat64 {
     unsigned long long st_dev;
-    unsigned int    __pad1;
+    abi_uint     __pad1;
     abi_ulong    __st_ino;
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint     st_mode;
+    abi_uint     st_nlink;
 
     abi_ulong    st_uid;
     abi_ulong    st_gid;
 
     unsigned long long st_rdev;
-    unsigned int    __pad2[2];
+    abi_uint     __pad2[2];
 
     long long       st_size;
     abi_ulong    st_blksize;
-    unsigned int    __pad3;
+    abi_uint     __pad3;
     unsigned long long st_blocks;
 
     abi_ulong    target_st_atime;
@@ -1423,13 +1423,13 @@ struct target_eabi_stat64 {
 
 #elif defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
 struct target_stat {
-    unsigned int    st_dev;
+    abi_uint        st_dev;
     abi_ulong       st_ino;
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
-    unsigned int    st_uid;
-    unsigned int    st_gid;
-    unsigned int    st_rdev;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
+    abi_uint        st_uid;
+    abi_uint        st_gid;
+    abi_uint        st_rdev;
     abi_long        st_size;
     abi_long        target_st_atime;
     abi_long        target_st_mtime;
@@ -1447,10 +1447,10 @@ struct target_stat64 {
     abi_ullong      st_ino;
     abi_ullong      st_nlink;
 
-    unsigned int    st_mode;
+    abi_uint        st_mode;
 
-    unsigned int    st_uid;
-    unsigned int    st_gid;
+    abi_uint        st_uid;
+    abi_uint        st_gid;
 
     unsigned char   __pad2[6];
     unsigned short  st_rdev;
@@ -1459,7 +1459,7 @@ struct target_stat64 {
     abi_llong       st_blksize;
 
     unsigned char   __pad4[4];
-    unsigned int    st_blocks;
+    abi_uint        st_blocks;
 
     abi_ulong       target_st_atime;
     abi_ulong       target_st_atime_nsec;
@@ -1503,11 +1503,11 @@ struct target_stat64 {
 
     abi_ullong      st_ino;
 
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
 
-    unsigned int    st_uid;
-    unsigned int    st_gid;
+    abi_uint        st_uid;
+    abi_uint        st_gid;
 
     unsigned char   __pad2[6];
     unsigned short  st_rdev;
@@ -1515,22 +1515,22 @@ struct target_stat64 {
     unsigned char   __pad3[8];
 
     abi_llong       st_size;
-    unsigned int    st_blksize;
+    abi_uint        st_blksize;
 
     unsigned char   __pad4[8];
-    unsigned int    st_blocks;
+    abi_uint        st_blocks;
 
-    unsigned int    target_st_atime;
-    unsigned int    target_st_atime_nsec;
+    abi_uint        target_st_atime;
+    abi_uint        target_st_atime_nsec;
 
-    unsigned int    target_st_mtime;
-    unsigned int    target_st_mtime_nsec;
+    abi_uint        target_st_mtime;
+    abi_uint        target_st_mtime_nsec;
 
-    unsigned int    target_st_ctime;
-    unsigned int    target_st_ctime_nsec;
+    abi_uint        target_st_ctime;
+    abi_uint        target_st_ctime_nsec;
 
-    unsigned int    __unused1;
-    unsigned int    __unused2;
+    abi_uint        __unused1;
+    abi_uint        __unused2;
 };
 
 #elif defined(TARGET_PPC)
@@ -1541,13 +1541,13 @@ struct target_stat {
     abi_ulong st_ino;
 #if defined(TARGET_PPC64)
     abi_ulong st_nlink;
-    unsigned int st_mode;
+    abi_uint  st_mode;
 #else
-    unsigned int st_mode;
+    abi_uint  st_mode;
     unsigned short st_nlink;
 #endif
-    unsigned int st_uid;
-    unsigned int st_gid;
+    abi_uint   st_uid;
+    abi_uint   st_gid;
     abi_ulong  st_rdev;
     abi_ulong  st_size;
     abi_ulong  st_blksize;
@@ -1570,24 +1570,24 @@ struct target_stat {
 struct QEMU_PACKED target_stat64 {
     unsigned long long st_dev;
     unsigned long long st_ino;
-    unsigned int st_mode;
-    unsigned int st_nlink;
-    unsigned int st_uid;
-    unsigned int st_gid;
+    abi_uint st_mode;
+    abi_uint st_nlink;
+    abi_uint st_uid;
+    abi_uint st_gid;
     unsigned long long st_rdev;
     unsigned long long __pad0;
     long long      st_size;
     int            st_blksize;
-    unsigned int   __pad1;
+    abi_uint       __pad1;
     long long      st_blocks;       /* Number 512-byte blocks allocated. */
     int            target_st_atime;
-    unsigned int   target_st_atime_nsec;
+    abi_uint       target_st_atime_nsec;
     int            target_st_mtime;
-    unsigned int   target_st_mtime_nsec;
+    abi_uint       target_st_mtime_nsec;
     int            target_st_ctime;
-    unsigned int   target_st_ctime_nsec;
-    unsigned int   __unused4;
-    unsigned int   __unused5;
+    abi_uint       target_st_ctime_nsec;
+    abi_uint       __unused4;
+    abi_uint       __unused5;
 };
 #endif
 
@@ -1597,10 +1597,10 @@ struct QEMU_PACKED target_stat64 {
 struct target_stat {
     abi_ulong st_dev;
     abi_ulong st_ino;
-    unsigned int st_mode;
+    abi_uint st_mode;
     unsigned short st_nlink;
-    unsigned int st_uid;
-    unsigned int st_gid;
+    abi_uint st_uid;
+    abi_uint st_gid;
     abi_ulong  st_rdev;
     abi_ulong  st_size;
     abi_ulong  st_blksize;
@@ -1636,11 +1636,11 @@ struct QEMU_PACKED target_stat64 {
     abi_llong st_blocks;
 
     int            target_st_atime;
-    unsigned int   target_st_atime_nsec;
+    abi_uint   target_st_atime_nsec;
     int            target_st_mtime;
-    unsigned int   target_st_mtime_nsec;
+    abi_uint   target_st_mtime_nsec;
     int            target_st_ctime;
-    unsigned int   target_st_ctime_nsec;
+    abi_uint   target_st_ctime_nsec;
     abi_ullong st_ino;
 };
 
@@ -1680,8 +1680,8 @@ struct target_stat64 {
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
     abi_ulong       __st_ino;
 
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint    st_mode;
+    abi_uint    st_nlink;
 
     abi_ulong       st_uid;
     abi_ulong       st_gid;
@@ -1712,19 +1712,19 @@ struct target_stat64 {
 #define TARGET_STAT_HAVE_NSEC
 /* The memory layout is the same as of struct stat64 of the 32-bit kernel.  */
 struct target_stat {
-    unsigned int            st_dev;
-    unsigned int            st_pad0[3]; /* Reserved for st_dev expansion */
+    abi_uint                st_dev;
+    abi_uint                st_pad0[3]; /* Reserved for st_dev expansion */
 
     abi_ulong               st_ino;
 
-    unsigned int            st_mode;
-    unsigned int            st_nlink;
+    abi_uint                st_mode;
+    abi_uint                st_nlink;
 
     int                     st_uid;
     int                     st_gid;
 
-    unsigned int            st_rdev;
-    unsigned int            st_pad1[3]; /* Reserved for st_rdev expansion */
+    abi_uint                st_rdev;
+    abi_uint                st_pad1[3]; /* Reserved for st_rdev expansion */
 
     abi_ulong               st_size;
 
@@ -1732,17 +1732,17 @@ struct target_stat {
      * Actually this should be timestruc_t st_atime, st_mtime and st_ctime
      * but we don't have it under Linux.
      */
-    unsigned int            target_st_atime;
-    unsigned int            target_st_atime_nsec;
+    abi_uint                target_st_atime;
+    abi_uint                target_st_atime_nsec;
 
-    unsigned int            target_st_mtime;
-    unsigned int            target_st_mtime_nsec;
+    abi_uint                target_st_mtime;
+    abi_uint                target_st_mtime_nsec;
 
-    unsigned int            target_st_ctime;
-    unsigned int            target_st_ctime_nsec;
+    abi_uint                target_st_ctime;
+    abi_uint                target_st_ctime_nsec;
 
-    unsigned int            st_blksize;
-    unsigned int            st_pad2;
+    abi_uint                st_blksize;
+    abi_uint                st_pad2;
 
     abi_ulong               st_blocks;
 };
@@ -1754,8 +1754,8 @@ struct target_stat {
     abi_ulong    st_dev;
     abi_ulong    st_pad0[3]; /* Reserved for st_dev expansion */
     abi_ullong   st_ino;
-    unsigned int st_mode;
-    unsigned int st_nlink;
+    abi_uint     st_mode;
+    abi_uint     st_nlink;
     int          st_uid;
     int          st_gid;
     abi_ulong    st_rdev;
@@ -1779,8 +1779,8 @@ struct target_stat {
     unsigned        st_dev;
     abi_long        st_pad1[3];             /* Reserved for network id */
     abi_ulong       st_ino;
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
     int             st_uid;
     int             st_gid;
     unsigned        st_rdev;
@@ -1815,8 +1815,8 @@ struct target_stat64 {
 
     abi_ullong      st_ino;
 
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
 
     int             st_uid;
     int             st_gid;
@@ -1848,21 +1848,21 @@ struct target_stat64 {
 #elif defined(TARGET_ALPHA)
 
 struct target_stat {
-    unsigned int    st_dev;
-    unsigned int    st_ino;
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
-    unsigned int    st_uid;
-    unsigned int    st_gid;
-    unsigned int    st_rdev;
+    abi_uint     st_dev;
+    abi_uint     st_ino;
+    abi_uint     st_mode;
+    abi_uint     st_nlink;
+    abi_uint     st_uid;
+    abi_uint     st_gid;
+    abi_uint     st_rdev;
     abi_long     st_size;
     abi_ulong    target_st_atime;
     abi_ulong    target_st_mtime;
     abi_ulong    target_st_ctime;
-    unsigned int    st_blksize;
-    unsigned int    st_blocks;
-    unsigned int    st_flags;
-    unsigned int    st_gen;
+    abi_uint     st_blksize;
+    abi_uint     st_blocks;
+    abi_uint     st_flags;
+    abi_uint     st_gen;
 };
 
 #define TARGET_HAS_STRUCT_STAT64
@@ -1873,12 +1873,12 @@ struct target_stat64 {
     abi_long     st_size;
     abi_ulong    st_blocks;
 
-    unsigned int    st_mode;
-    unsigned int    st_uid;
-    unsigned int    st_gid;
-    unsigned int    st_blksize;
-    unsigned int    st_nlink;
-    unsigned int    __pad0;
+    abi_uint     st_mode;
+    abi_uint     st_uid;
+    abi_uint     st_gid;
+    abi_uint     st_blksize;
+    abi_uint     st_nlink;
+    abi_uint     __pad0;
 
     abi_ulong    target_st_atime;
     abi_ulong    target_st_atime_nsec;
@@ -1924,8 +1924,8 @@ struct QEMU_PACKED target_stat64 {
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
     abi_ulong       __st_ino;
 
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
 
     abi_ulong       st_uid;
     abi_ulong       st_gid;
@@ -1957,10 +1957,10 @@ struct target_stat {
     abi_ulong       st_ino;
     abi_ulong       st_nlink;
 
-    unsigned int    st_mode;
-    unsigned int    st_uid;
-    unsigned int    st_gid;
-    unsigned int    __pad0;
+    abi_uint        st_mode;
+    abi_uint        st_uid;
+    abi_uint        st_gid;
+    abi_uint        __pad0;
     abi_ulong       st_rdev;
     abi_long        st_size;
     abi_long        st_blksize;
@@ -1980,10 +1980,10 @@ struct target_stat {
     abi_ulong  st_dev;
     abi_ulong  st_ino;
     abi_ulong  st_nlink;
-    unsigned int   st_mode;
-    unsigned int   st_uid;
-    unsigned int   st_gid;
-    unsigned int   __pad1;
+    abi_uint   st_mode;
+    abi_uint   st_uid;
+    abi_uint   st_gid;
+    abi_uint   __pad1;
     abi_ulong  st_rdev;
     abi_ulong  st_size;
     abi_ulong  target_st_atime;
@@ -2001,10 +2001,10 @@ struct target_stat {
 struct target_stat {
     abi_ulong  st_dev;
     abi_ulong  st_ino;
-    unsigned int st_mode;
-    unsigned int st_nlink;
-    unsigned int   st_uid;
-    unsigned int   st_gid;
+    abi_uint   st_mode;
+    abi_uint   st_nlink;
+    abi_uint   st_uid;
+    abi_uint   st_gid;
     abi_ulong  st_rdev;
     abi_ulong  _pad1;
     abi_long  st_size;
@@ -2017,17 +2017,17 @@ struct target_stat {
     abi_ulong  target_st_mtime_nsec;
     abi_long  target_st_ctime;
     abi_ulong  target_st_ctime_nsec;
-    unsigned int __unused[2];
+    abi_uint __unused[2];
 };
 #elif defined(TARGET_XTENSA)
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
     abi_ulong       st_dev;
     abi_ulong       st_ino;
-    unsigned int    st_mode;
-    unsigned int    st_nlink;
-    unsigned int    st_uid;
-    unsigned int    st_gid;
+    abi_uint        st_mode;
+    abi_uint        st_nlink;
+    abi_uint        st_uid;
+    abi_uint        st_gid;
     abi_ulong       st_rdev;
     abi_long        st_size;
     abi_ulong       st_blksize;
@@ -2046,10 +2046,10 @@ struct target_stat {
 struct target_stat64  {
     abi_ullong st_dev;          /* Device */
     abi_ullong st_ino;          /* File serial number */
-    unsigned int  st_mode;      /* File mode. */
-    unsigned int  st_nlink;     /* Link count. */
-    unsigned int  st_uid;       /* User ID of the file's owner. */
-    unsigned int  st_gid;       /* Group ID of the file's group. */
+    abi_uint  st_mode;          /* File mode. */
+    abi_uint  st_nlink;         /* Link count. */
+    abi_uint  st_uid;           /* User ID of the file's owner. */
+    abi_uint  st_gid;           /* Group ID of the file's group. */
     abi_ullong st_rdev;         /* Device number, if device. */
     abi_llong st_size;          /* Size of file, in bytes. */
     abi_ulong st_blksize;       /* Optimal block size for I/O. */
@@ -2074,10 +2074,10 @@ struct target_stat64  {
 struct target_stat {
     abi_ulong st_dev;
     abi_ulong st_ino;
-    unsigned int st_mode;
-    unsigned int st_nlink;
-    unsigned int st_uid;
-    unsigned int st_gid;
+    abi_uint st_mode;
+    abi_uint st_nlink;
+    abi_uint st_uid;
+    abi_uint st_gid;
     abi_ulong st_rdev;
     abi_ulong __pad1;
     abi_long st_size;
@@ -2090,8 +2090,8 @@ struct target_stat {
     abi_ulong target_st_mtime_nsec;
     abi_long target_st_ctime;
     abi_ulong target_st_ctime_nsec;
-    unsigned int __unused4;
-    unsigned int __unused5;
+    abi_uint __unused4;
+    abi_uint __unused5;
 };
 
 #if !defined(TARGET_RISCV64)
@@ -2099,10 +2099,10 @@ struct target_stat {
 struct target_stat64 {
     abi_ullong st_dev;
     abi_ullong st_ino;
-    unsigned int st_mode;
-    unsigned int st_nlink;
-    unsigned int st_uid;
-    unsigned int st_gid;
+    abi_uint st_mode;
+    abi_uint st_nlink;
+    abi_uint st_uid;
+    abi_uint st_gid;
     abi_ullong st_rdev;
     abi_ullong __pad1;
     abi_llong st_size;
@@ -2110,13 +2110,13 @@ struct target_stat64 {
     int __pad2;
     abi_llong st_blocks;
     int target_st_atime;
-    unsigned int target_st_atime_nsec;
+    abi_uint target_st_atime_nsec;
     int target_st_mtime;
-    unsigned int target_st_mtime_nsec;
+    abi_uint target_st_mtime_nsec;
     int target_st_ctime;
-    unsigned int target_st_ctime_nsec;
-    unsigned int __unused4;
-    unsigned int __unused5;
+    abi_uint target_st_ctime_nsec;
+    abi_uint __unused4;
+    abi_uint __unused5;
 };
 #endif
 
@@ -2498,7 +2498,7 @@ struct target_snd_timer_id {
 
 struct target_snd_timer_ginfo {
     struct target_snd_timer_id tid;
-    unsigned int flags;
+    abi_uint flags;
     int card;
     unsigned char id[64];
     unsigned char name[80];
@@ -2506,7 +2506,7 @@ struct target_snd_timer_ginfo {
     abi_ulong resolution;
     abi_ulong resolution_min;
     abi_ulong resolution_max;
-    unsigned int clients;
+    abi_uint clients;
     unsigned char reserved[32];
 };
 
@@ -2531,7 +2531,7 @@ struct target_snd_timer_select {
 };
 
 struct target_snd_timer_info {
-    unsigned int flags;
+    abi_uint flags;
     int card;
     unsigned char id[64];
     unsigned char name[80];
@@ -2542,10 +2542,10 @@ struct target_snd_timer_info {
 
 struct target_snd_timer_status {
     struct target_timespec tstamp;
-    unsigned int resolution;
-    unsigned int lost;
-    unsigned int overrun;
-    unsigned int queue;
+    abi_uint resolution;
+    abi_uint lost;
+    abi_uint overrun;
+    abi_uint queue;
     unsigned char reserved[64];
 };
 
@@ -2623,7 +2623,7 @@ struct target_sysinfo {
     unsigned short pad;             /* explicit padding for m68k */
     abi_ulong totalhigh;            /* Total high memory size */
     abi_ulong freehigh;             /* Available high memory size */
-    unsigned int mem_unit;          /* Memory unit size in bytes */
+    abi_uint mem_unit;              /* Memory unit size in bytes */
     char _f[20-2*sizeof(abi_long)-sizeof(int)]; /* Padding: libc5 uses this.. */
 };
 

From 6c977729efc9d70959d0e263037f2716120961e0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 13:15:46 -0700
Subject: [PATCH 0781/1353] linux-user: Use abi_ullong not unsigned long long
 in syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 20986bd1d3..45ebacd4b4 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1385,13 +1385,13 @@ struct target_stat64 {
     abi_ulong       target_st_ctime;
     abi_ulong       target_st_ctime_nsec;
 
-    unsigned long long      st_ino;
+    abi_ullong      st_ino;
 } QEMU_PACKED;
 
 #ifdef TARGET_ARM
 #define TARGET_HAS_STRUCT_STAT64
 struct target_eabi_stat64 {
-    unsigned long long st_dev;
+    abi_ullong   st_dev;
     abi_uint     __pad1;
     abi_ulong    __st_ino;
     abi_uint     st_mode;
@@ -1400,13 +1400,13 @@ struct target_eabi_stat64 {
     abi_ulong    st_uid;
     abi_ulong    st_gid;
 
-    unsigned long long st_rdev;
+    abi_ullong   st_rdev;
     abi_uint     __pad2[2];
 
     long long       st_size;
     abi_ulong    st_blksize;
     abi_uint     __pad3;
-    unsigned long long st_blocks;
+    abi_ullong   st_blocks;
 
     abi_ulong    target_st_atime;
     abi_ulong    target_st_atime_nsec;
@@ -1417,7 +1417,7 @@ struct target_eabi_stat64 {
     abi_ulong    target_st_ctime;
     abi_ulong    target_st_ctime_nsec;
 
-    unsigned long long st_ino;
+    abi_ullong   st_ino;
 } QEMU_PACKED;
 #endif
 
@@ -1568,14 +1568,14 @@ struct target_stat {
 #if !defined(TARGET_PPC64)
 #define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
-    unsigned long long st_dev;
-    unsigned long long st_ino;
+    abi_ullong st_dev;
+    abi_ullong st_ino;
     abi_uint st_mode;
     abi_uint st_nlink;
     abi_uint st_uid;
     abi_uint st_gid;
-    unsigned long long st_rdev;
-    unsigned long long __pad0;
+    abi_ullong st_rdev;
+    abi_ullong __pad0;
     long long      st_size;
     int            st_blksize;
     abi_uint       __pad1;
@@ -1674,7 +1674,7 @@ struct target_stat {
  */
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-    unsigned long long      st_dev;
+    abi_ullong      st_dev;
     unsigned char   __pad1[2];
 
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
@@ -1686,7 +1686,7 @@ struct target_stat64 {
     abi_ulong       st_uid;
     abi_ulong       st_gid;
 
-    unsigned long long      st_rdev;
+    abi_ullong      st_rdev;
     unsigned char   __pad3[2];
 
     long long       st_size;
@@ -1704,7 +1704,7 @@ struct target_stat64 {
     abi_ulong       target_st_ctime;
     abi_ulong       target_st_ctime_nsec;
 
-    unsigned long long      st_ino;
+    abi_ullong      st_ino;
 } QEMU_PACKED;
 
 #elif defined(TARGET_ABI_MIPSN64)
@@ -1918,7 +1918,7 @@ struct target_stat {
  */
 #define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
-    unsigned long long      st_dev;
+    abi_ullong      st_dev;
     unsigned char   __pad0[4];
 
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
@@ -1930,13 +1930,13 @@ struct QEMU_PACKED target_stat64 {
     abi_ulong       st_uid;
     abi_ulong       st_gid;
 
-    unsigned long long      st_rdev;
+    abi_ullong      st_rdev;
     unsigned char   __pad3[4];
 
     long long       st_size;
     abi_ulong       st_blksize;
 
-    unsigned long long      st_blocks;      /* Number 512-byte blocks allocated. */
+    abi_ullong      st_blocks;      /* Number 512-byte blocks allocated. */
 
     abi_ulong       target_st_atime;
     abi_ulong       target_st_atime_nsec;
@@ -1947,7 +1947,7 @@ struct QEMU_PACKED target_stat64 {
     abi_ulong       target_st_ctime;
     abi_ulong       target_st_ctime_nsec;
 
-    unsigned long long      st_ino;
+    abi_ullong      st_ino;
 };
 
 #elif defined(TARGET_I386) && !defined(TARGET_ABI32)

From 55a1bcff0c3cb67ab4b064d9b14641b3d3431795 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 13:17:35 -0700
Subject: [PATCH 0782/1353] linux-user: Use abi_llong not long long in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 45ebacd4b4..e4fcbd16d2 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1370,7 +1370,7 @@ struct target_stat64 {
     unsigned short  st_rdev;
     unsigned char   __pad3[10];
 
-    long long       st_size;
+    abi_llong       st_size;
     abi_ulong       st_blksize;
 
     abi_ulong       st_blocks;      /* Number 512-byte blocks allocated. */
@@ -1403,7 +1403,7 @@ struct target_eabi_stat64 {
     abi_ullong   st_rdev;
     abi_uint     __pad2[2];
 
-    long long       st_size;
+    abi_llong       st_size;
     abi_ulong    st_blksize;
     abi_uint     __pad3;
     abi_ullong   st_blocks;
@@ -1576,10 +1576,10 @@ struct QEMU_PACKED target_stat64 {
     abi_uint st_gid;
     abi_ullong st_rdev;
     abi_ullong __pad0;
-    long long      st_size;
+    abi_llong      st_size;
     int            st_blksize;
     abi_uint       __pad1;
-    long long      st_blocks;       /* Number 512-byte blocks allocated. */
+    abi_llong      st_blocks;       /* Number 512-byte blocks allocated. */
     int            target_st_atime;
     abi_uint       target_st_atime_nsec;
     int            target_st_mtime;
@@ -1689,7 +1689,7 @@ struct target_stat64 {
     abi_ullong      st_rdev;
     unsigned char   __pad3[2];
 
-    long long       st_size;
+    abi_llong       st_size;
     abi_ulong       st_blksize;
 
     abi_ulong       __pad4;         /* future possible st_blocks high bits */
@@ -1933,7 +1933,7 @@ struct QEMU_PACKED target_stat64 {
     abi_ullong      st_rdev;
     unsigned char   __pad3[4];
 
-    long long       st_size;
+    abi_llong       st_size;
     abi_ulong       st_blksize;
 
     abi_ullong      st_blocks;      /* Number 512-byte blocks allocated. */

From b3c719b2d11c8f0c83515317bdee453c8e679d38 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 13:28:57 -0700
Subject: [PATCH 0783/1353] linux-user: Use abi_int not int in syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 216 +++++++++++++++++++-------------------
 1 file changed, 108 insertions(+), 108 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index e4fcbd16d2..442a8aefe3 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -361,7 +361,7 @@ struct target_iovec {
 
 struct target_msghdr {
     abi_long     msg_name;       /* Socket name                 */
-    int          msg_namelen;    /* Length of name              */
+    abi_int      msg_namelen;    /* Length of name              */
     abi_long     msg_iov;        /* Data blocks                 */
     abi_long     msg_iovlen;     /* Number of blocks            */
     abi_long     msg_control;    /* Per protocol magic (eg BSD file descriptor passing) */
@@ -371,8 +371,8 @@ struct target_msghdr {
 
 struct target_cmsghdr {
     abi_long     cmsg_len;
-    int          cmsg_level;
-    int          cmsg_type;
+    abi_int      cmsg_level;
+    abi_int      cmsg_type;
 };
 
 #define TARGET_CMSG_DATA(cmsg) ((unsigned char *) ((struct target_cmsghdr *) (cmsg) + 1))
@@ -426,7 +426,7 @@ struct  target_rusage {
 };
 
 typedef struct {
-    int     val[2];
+    abi_int val[2];
 } kernel_fsid_t;
 
 struct target_dirent {
@@ -544,7 +544,7 @@ struct target_sigaction {
 #endif
 
 typedef union target_sigval {
-    int sival_int;
+    abi_int sival_int;
     abi_ulong sival_ptr;
 } target_sigval_t;
 
@@ -575,17 +575,17 @@ typedef union target_sigval {
 
 typedef struct target_siginfo {
 #ifdef TARGET_MIPS
-    int si_signo;
-    int si_code;
-    int si_errno;
+    abi_int si_signo;
+    abi_int si_code;
+    abi_int si_errno;
 #else
-    int si_signo;
-    int si_errno;
-    int si_code;
+    abi_int si_signo;
+    abi_int si_errno;
+    abi_int si_code;
 #endif
 
     union {
-        int _pad[TARGET_SI_PAD_SIZE];
+        abi_int _pad[TARGET_SI_PAD_SIZE];
 
         /* kill() */
         struct {
@@ -610,7 +610,7 @@ typedef struct target_siginfo {
         struct {
             pid_t _pid;             /* which child */
             uid_t _uid;             /* sender's uid */
-            int _status;            /* exit code */
+            abi_int _status;        /* exit code */
             target_clock_t _utime;
             target_clock_t _stime;
         } _sigchld;
@@ -622,8 +622,8 @@ typedef struct target_siginfo {
 
         /* SIGPOLL */
         struct {
-            int _band;      /* POLL_IN, POLL_OUT, POLL_MSG */
-            int _fd;
+            abi_int _band;   /* POLL_IN, POLL_OUT, POLL_MSG */
+            abi_int _fd;
         } _sigpoll;
     } _sifields;
 } target_siginfo_t;
@@ -701,7 +701,7 @@ typedef struct target_siginfo {
 #include "target_resource.h"
 
 struct target_pollfd {
-    int fd;           /* file descriptor */
+    abi_int fd;       /* file descriptor */
     short events;     /* requested events */
     short revents;    /* returned events */
 };
@@ -722,12 +722,12 @@ struct target_pollfd {
 #define TARGET_KDSIGACCEPT     0x4B4E
 
 struct target_rtc_pll_info {
-    int pll_ctrl;
-    int pll_value;
-    int pll_max;
-    int pll_min;
-    int pll_posmult;
-    int pll_negmult;
+    abi_int pll_ctrl;
+    abi_int pll_value;
+    abi_int pll_max;
+    abi_int pll_min;
+    abi_int pll_posmult;
+    abi_int pll_negmult;
     abi_long pll_clock;
 };
 
@@ -754,14 +754,14 @@ struct target_rtc_pll_info {
                                                struct target_rtc_pll_info)
 #define TARGET_RTC_PLL_SET          TARGET_IOW('p', 0x12,               \
                                                struct target_rtc_pll_info)
-#define TARGET_RTC_VL_READ          TARGET_IOR('p', 0x13, int)
+#define TARGET_RTC_VL_READ          TARGET_IOR('p', 0x13, abi_int)
 #define TARGET_RTC_VL_CLR           TARGET_IO('p', 0x14)
 
 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SH4) || \
     defined(TARGET_XTENSA)
-#define TARGET_FIOGETOWN       TARGET_IOR('f', 123, int)
-#define TARGET_FIOSETOWN       TARGET_IOW('f', 124, int)
-#define TARGET_SIOCATMARK      TARGET_IOR('s', 7, int)
+#define TARGET_FIOGETOWN       TARGET_IOR('f', 123, abi_int)
+#define TARGET_FIOSETOWN       TARGET_IOW('f', 124, abi_int)
+#define TARGET_SIOCATMARK      TARGET_IOR('s', 7, abi_int)
 #define TARGET_SIOCSPGRP       TARGET_IOW('s', 8, pid_t)
 #define TARGET_SIOCGPGRP       TARGET_IOR('s', 9, pid_t)
 #else
@@ -851,40 +851,40 @@ struct target_rtc_pll_info {
 
 /* From <linux/if_tun.h> */
 
-#define TARGET_TUNSETDEBUG        TARGET_IOW('T', 201, int)
-#define TARGET_TUNSETIFF          TARGET_IOW('T', 202, int)
-#define TARGET_TUNSETPERSIST      TARGET_IOW('T', 203, int)
-#define TARGET_TUNSETOWNER        TARGET_IOW('T', 204, int)
-#define TARGET_TUNSETLINK         TARGET_IOW('T', 205, int)
-#define TARGET_TUNSETGROUP        TARGET_IOW('T', 206, int)
+#define TARGET_TUNSETDEBUG        TARGET_IOW('T', 201, abi_int)
+#define TARGET_TUNSETIFF          TARGET_IOW('T', 202, abi_int)
+#define TARGET_TUNSETPERSIST      TARGET_IOW('T', 203, abi_int)
+#define TARGET_TUNSETOWNER        TARGET_IOW('T', 204, abi_int)
+#define TARGET_TUNSETLINK         TARGET_IOW('T', 205, abi_int)
+#define TARGET_TUNSETGROUP        TARGET_IOW('T', 206, abi_int)
 #define TARGET_TUNGETFEATURES     TARGET_IOR('T', 207, abi_uint)
 #define TARGET_TUNSETOFFLOAD      TARGET_IOW('T', 208, abi_uint)
 #define TARGET_TUNSETTXFILTER     TARGET_IOW('T', 209, abi_uint)
 #define TARGET_TUNGETIFF          TARGET_IOR('T', 210, abi_uint)
-#define TARGET_TUNGETSNDBUF       TARGET_IOR('T', 211, int)
-#define TARGET_TUNSETSNDBUF       TARGET_IOW('T', 212, int)
+#define TARGET_TUNGETSNDBUF       TARGET_IOR('T', 211, abi_int)
+#define TARGET_TUNSETSNDBUF       TARGET_IOW('T', 212, abi_int)
 /*
  * TUNATTACHFILTER and TUNDETACHFILTER are not supported. Linux kernel keeps a
  * user pointer in TUNATTACHFILTER, which we are not able to correctly handle.
  */
-#define TARGET_TUNGETVNETHDRSZ    TARGET_IOR('T', 215, int)
-#define TARGET_TUNSETVNETHDRSZ    TARGET_IOW('T', 216, int)
-#define TARGET_TUNSETQUEUE        TARGET_IOW('T', 217, int)
+#define TARGET_TUNGETVNETHDRSZ    TARGET_IOR('T', 215, abi_int)
+#define TARGET_TUNSETVNETHDRSZ    TARGET_IOW('T', 216, abi_int)
+#define TARGET_TUNSETQUEUE        TARGET_IOW('T', 217, abi_int)
 #define TARGET_TUNSETIFINDEX      TARGET_IOW('T', 218, abi_uint)
 /* TUNGETFILTER is not supported: see TUNATTACHFILTER. */
-#define TARGET_TUNSETVNETLE       TARGET_IOW('T', 220, int)
-#define TARGET_TUNGETVNETLE       TARGET_IOR('T', 221, int)
-#define TARGET_TUNSETVNETBE       TARGET_IOW('T', 222, int)
-#define TARGET_TUNGETVNETBE       TARGET_IOR('T', 223, int)
-#define TARGET_TUNSETSTEERINGEBPF TARGET_IOR('T', 224, int)
-#define TARGET_TUNSETFILTEREBPF   TARGET_IOR('T', 225, int)
-#define TARGET_TUNSETCARRIER      TARGET_IOW('T', 226, int)
+#define TARGET_TUNSETVNETLE       TARGET_IOW('T', 220, abi_int)
+#define TARGET_TUNGETVNETLE       TARGET_IOR('T', 221, abi_int)
+#define TARGET_TUNSETVNETBE       TARGET_IOW('T', 222, abi_int)
+#define TARGET_TUNGETVNETBE       TARGET_IOR('T', 223, abi_int)
+#define TARGET_TUNSETSTEERINGEBPF TARGET_IOR('T', 224, abi_int)
+#define TARGET_TUNSETFILTEREBPF   TARGET_IOR('T', 225, abi_int)
+#define TARGET_TUNSETCARRIER      TARGET_IOW('T', 226, abi_int)
 #define TARGET_TUNGETDEVNETNS     TARGET_IO('T', 227)
 
 /* From <linux/random.h> */
 
-#define TARGET_RNDGETENTCNT    TARGET_IOR('R', 0x00, int)
-#define TARGET_RNDADDTOENTCNT  TARGET_IOW('R', 0x01, int)
+#define TARGET_RNDGETENTCNT    TARGET_IOR('R', 0x00, abi_int)
+#define TARGET_RNDADDTOENTCNT  TARGET_IOW('R', 0x01, abi_int)
 #define TARGET_RNDZAPENTCNT    TARGET_IO('R', 0x04)
 #define TARGET_RNDCLEARPOOL    TARGET_IO('R', 0x06)
 #define TARGET_RNDRESEEDCRNG   TARGET_IO('R', 0x07)
@@ -940,7 +940,7 @@ struct target_rtc_pll_info {
 #define TARGET_FIBMAP     TARGET_IO(0x00,1)  /* bmap access */
 #define TARGET_FIGETBSZ   TARGET_IO(0x00,2)  /* get the block size used for bmap */
 
-#define TARGET_FICLONE    TARGET_IOW(0x94, 9, int)
+#define TARGET_FICLONE    TARGET_IOW(0x94, 9, abi_int)
 #define TARGET_FICLONERANGE TARGET_IOW(0x94, 13, struct file_clone_range)
 
 /*
@@ -952,10 +952,10 @@ struct target_rtc_pll_info {
 #define TARGET_FS_IOC_GETVERSION TARGET_IOR('v', 1, abi_long)
 #define TARGET_FS_IOC_SETVERSION TARGET_IOW('v', 2, abi_long)
 #define TARGET_FS_IOC_FIEMAP TARGET_IOWR('f',11,struct fiemap)
-#define TARGET_FS_IOC32_GETFLAGS TARGET_IOR('f', 1, int)
-#define TARGET_FS_IOC32_SETFLAGS TARGET_IOW('f', 2, int)
-#define TARGET_FS_IOC32_GETVERSION TARGET_IOR('v', 1, int)
-#define TARGET_FS_IOC32_SETVERSION TARGET_IOW('v', 2, int)
+#define TARGET_FS_IOC32_GETFLAGS TARGET_IOR('f', 1, abi_int)
+#define TARGET_FS_IOC32_SETFLAGS TARGET_IOW('f', 2, abi_int)
+#define TARGET_FS_IOC32_GETVERSION TARGET_IOR('v', 1, abi_int)
+#define TARGET_FS_IOC32_SETVERSION TARGET_IOW('v', 2, abi_int)
 
 /* btrfs ioctls */
 #ifdef HAVE_BTRFS_H
@@ -1577,14 +1577,14 @@ struct QEMU_PACKED target_stat64 {
     abi_ullong st_rdev;
     abi_ullong __pad0;
     abi_llong      st_size;
-    int            st_blksize;
+    abi_int        st_blksize;
     abi_uint       __pad1;
     abi_llong      st_blocks;       /* Number 512-byte blocks allocated. */
-    int            target_st_atime;
+    abi_int        target_st_atime;
     abi_uint       target_st_atime_nsec;
-    int            target_st_mtime;
+    abi_int        target_st_mtime;
     abi_uint       target_st_mtime_nsec;
-    int            target_st_ctime;
+    abi_int        target_st_ctime;
     abi_uint       target_st_ctime_nsec;
     abi_uint       __unused4;
     abi_uint       __unused5;
@@ -1635,11 +1635,11 @@ struct QEMU_PACKED target_stat64 {
     abi_uint __pad2;
     abi_llong st_blocks;
 
-    int            target_st_atime;
+    abi_int    target_st_atime;
     abi_uint   target_st_atime_nsec;
-    int            target_st_mtime;
+    abi_int    target_st_mtime;
     abi_uint   target_st_mtime_nsec;
-    int            target_st_ctime;
+    abi_int    target_st_ctime;
     abi_uint   target_st_ctime_nsec;
     abi_ullong st_ino;
 };
@@ -1720,8 +1720,8 @@ struct target_stat {
     abi_uint                st_mode;
     abi_uint                st_nlink;
 
-    int                     st_uid;
-    int                     st_gid;
+    abi_int                 st_uid;
+    abi_int                 st_gid;
 
     abi_uint                st_rdev;
     abi_uint                st_pad1[3]; /* Reserved for st_rdev expansion */
@@ -1756,8 +1756,8 @@ struct target_stat {
     abi_ullong   st_ino;
     abi_uint     st_mode;
     abi_uint     st_nlink;
-    int          st_uid;
-    int          st_gid;
+    abi_int      st_uid;
+    abi_int      st_gid;
     abi_ulong    st_rdev;
     abi_ulong    st_pad1[3]; /* Reserved for st_rdev expansion */
     abi_llong    st_size;
@@ -1781,8 +1781,8 @@ struct target_stat {
     abi_ulong       st_ino;
     abi_uint        st_mode;
     abi_uint        st_nlink;
-    int             st_uid;
-    int             st_gid;
+    abi_int         st_uid;
+    abi_int         st_gid;
     unsigned        st_rdev;
     abi_long        st_pad2[2];
     abi_long        st_size;
@@ -1818,8 +1818,8 @@ struct target_stat64 {
     abi_uint        st_mode;
     abi_uint        st_nlink;
 
-    int             st_uid;
-    int             st_gid;
+    abi_int         st_uid;
+    abi_int         st_gid;
 
     abi_ulong       st_rdev;
     abi_ulong       st_pad1[3];     /* Reserved for st_rdev expansion  */
@@ -2008,8 +2008,8 @@ struct target_stat {
     abi_ulong  st_rdev;
     abi_ulong  _pad1;
     abi_long  st_size;
-    int        st_blksize;
-    int        __pad2;
+    abi_int    st_blksize;
+    abi_int    __pad2;
     abi_long   st_blocks;
     abi_long  target_st_atime;
     abi_ulong  target_st_atime_nsec;
@@ -2081,8 +2081,8 @@ struct target_stat {
     abi_ulong st_rdev;
     abi_ulong __pad1;
     abi_long st_size;
-    int st_blksize;
-    int __pad2;
+    abi_int st_blksize;
+    abi_int __pad2;
     abi_long st_blocks;
     abi_long target_st_atime;
     abi_ulong target_st_atime_nsec;
@@ -2106,14 +2106,14 @@ struct target_stat64 {
     abi_ullong st_rdev;
     abi_ullong __pad1;
     abi_llong st_size;
-    int st_blksize;
-    int __pad2;
+    abi_int st_blksize;
+    abi_int __pad2;
     abi_llong st_blocks;
-    int target_st_atime;
+    abi_int target_st_atime;
     abi_uint target_st_atime_nsec;
-    int target_st_mtime;
+    abi_int target_st_mtime;
     abi_uint target_st_mtime_nsec;
-    int target_st_ctime;
+    abi_int target_st_ctime;
     abi_uint target_st_ctime_nsec;
     abi_uint __unused4;
     abi_uint __unused5;
@@ -2186,7 +2186,7 @@ struct target_stat64 {
 #endif
 
 typedef struct {
-    int     val[2];
+    abi_int val[2];
 } target_fsid_t;
 
 #ifdef TARGET_MIPS
@@ -2351,7 +2351,7 @@ struct target_statfs64 {
 
 /* soundcard defines */
 /* XXX: convert them all to arch independent entries */
-#define TARGET_SNDCTL_COPR_HALT           TARGET_IOWR('C',  7, int);
+#define TARGET_SNDCTL_COPR_HALT           TARGET_IOWR('C',  7, abi_int);
 #define TARGET_SNDCTL_COPR_LOAD           0xcfb04301
 #define TARGET_SNDCTL_COPR_RCODE          0xc0144303
 #define TARGET_SNDCTL_COPR_RCVMSG         0x8fa44309
@@ -2363,20 +2363,20 @@ struct target_statfs64 {
 #define TARGET_SNDCTL_COPR_WDATA          0x40144304
 #define TARGET_SNDCTL_DSP_RESET           TARGET_IO('P', 0)
 #define TARGET_SNDCTL_DSP_SYNC            TARGET_IO('P', 1)
-#define TARGET_SNDCTL_DSP_SPEED           TARGET_IOWR('P', 2, int)
-#define TARGET_SNDCTL_DSP_STEREO          TARGET_IOWR('P', 3, int)
-#define TARGET_SNDCTL_DSP_GETBLKSIZE      TARGET_IOWR('P', 4, int)
-#define TARGET_SNDCTL_DSP_SETFMT          TARGET_IOWR('P', 5, int)
-#define TARGET_SNDCTL_DSP_CHANNELS        TARGET_IOWR('P', 6, int)
-#define TARGET_SOUND_PCM_WRITE_FILTER     TARGET_IOWR('P', 7, int)
+#define TARGET_SNDCTL_DSP_SPEED           TARGET_IOWR('P', 2, abi_int)
+#define TARGET_SNDCTL_DSP_STEREO          TARGET_IOWR('P', 3, abi_int)
+#define TARGET_SNDCTL_DSP_GETBLKSIZE      TARGET_IOWR('P', 4, abi_int)
+#define TARGET_SNDCTL_DSP_SETFMT          TARGET_IOWR('P', 5, abi_int)
+#define TARGET_SNDCTL_DSP_CHANNELS        TARGET_IOWR('P', 6, abi_int)
+#define TARGET_SOUND_PCM_WRITE_FILTER     TARGET_IOWR('P', 7, abi_int)
 #define TARGET_SNDCTL_DSP_POST            TARGET_IO('P', 8)
-#define TARGET_SNDCTL_DSP_SUBDIVIDE       TARGET_IOWR('P', 9, int)
-#define TARGET_SNDCTL_DSP_SETFRAGMENT     TARGET_IOWR('P',10, int)
-#define TARGET_SNDCTL_DSP_GETFMTS         TARGET_IOR('P', 11, int)
+#define TARGET_SNDCTL_DSP_SUBDIVIDE       TARGET_IOWR('P', 9, abi_int)
+#define TARGET_SNDCTL_DSP_SETFRAGMENT     TARGET_IOWR('P',10, abi_int)
+#define TARGET_SNDCTL_DSP_GETFMTS         TARGET_IOR('P', 11, abi_int)
 #define TARGET_SNDCTL_DSP_GETOSPACE       TARGET_IORU('P',12)
 #define TARGET_SNDCTL_DSP_GETISPACE       TARGET_IORU('P',13)
-#define TARGET_SNDCTL_DSP_GETCAPS         TARGET_IOR('P', 15, int)
-#define TARGET_SNDCTL_DSP_GETTRIGGER      TARGET_IOR('P',16, int)
+#define TARGET_SNDCTL_DSP_GETCAPS         TARGET_IOR('P', 15, abi_int)
+#define TARGET_SNDCTL_DSP_GETTRIGGER      TARGET_IOR('P',16, abi_int)
 #define TARGET_SNDCTL_DSP_GETIPTR         TARGET_IORU('P',17)
 #define TARGET_SNDCTL_DSP_GETOPTR         TARGET_IORU('P',18)
 #define TARGET_SNDCTL_DSP_MAPINBUF        TARGET_IORU('P', 19)
@@ -2424,13 +2424,13 @@ struct target_statfs64 {
 #define TARGET_SOUND_PCM_READ_FILTER      0x80045007
 #define TARGET_SOUND_MIXER_INFO           TARGET_IOR ('M', 101, mixer_info)
 #define TARGET_SOUND_MIXER_ACCESS         0xc0804d66
-#define TARGET_SOUND_MIXER_PRIVATE1       TARGET_IOWR('M', 111, int)
-#define TARGET_SOUND_MIXER_PRIVATE2       TARGET_IOWR('M', 112, int)
-#define TARGET_SOUND_MIXER_PRIVATE3       TARGET_IOWR('M', 113, int)
-#define TARGET_SOUND_MIXER_PRIVATE4       TARGET_IOWR('M', 114, int)
-#define TARGET_SOUND_MIXER_PRIVATE5       TARGET_IOWR('M', 115, int)
+#define TARGET_SOUND_MIXER_PRIVATE1       TARGET_IOWR('M', 111, abi_int)
+#define TARGET_SOUND_MIXER_PRIVATE2       TARGET_IOWR('M', 112, abi_int)
+#define TARGET_SOUND_MIXER_PRIVATE3       TARGET_IOWR('M', 113, abi_int)
+#define TARGET_SOUND_MIXER_PRIVATE4       TARGET_IOWR('M', 114, abi_int)
+#define TARGET_SOUND_MIXER_PRIVATE5       TARGET_IOWR('M', 115, abi_int)
 
-#define TARGET_MIXER_READ(dev)  TARGET_IOR('M', dev, int)
+#define TARGET_MIXER_READ(dev)  TARGET_IOR('M', dev, abi_int)
 
 #define TARGET_SOUND_MIXER_READ_VOLUME          TARGET_MIXER_READ(SOUND_MIXER_VOLUME)
 #define TARGET_SOUND_MIXER_READ_BASS            TARGET_MIXER_READ(SOUND_MIXER_BASS)
@@ -2461,7 +2461,7 @@ struct target_statfs64 {
 #define TARGET_SOUND_MIXER_READ_STEREODEVS      TARGET_MIXER_READ(SOUND_MIXER_STEREODEVS)
 #define TARGET_SOUND_MIXER_READ_CAPS            TARGET_MIXER_READ(SOUND_MIXER_CAPS)
 
-#define TARGET_MIXER_WRITE(dev)         TARGET_IOWR('M', dev, int)
+#define TARGET_MIXER_WRITE(dev)         TARGET_IOWR('M', dev, abi_int)
 
 #define TARGET_SOUND_MIXER_WRITE_VOLUME TARGET_MIXER_WRITE(SOUND_MIXER_VOLUME)
 #define TARGET_SOUND_MIXER_WRITE_BASS           TARGET_MIXER_WRITE(SOUND_MIXER_BASS)
@@ -2489,17 +2489,17 @@ struct target_statfs64 {
 #define TARGET_SOUND_MIXER_WRITE_RECSRC TARGET_MIXER_WRITE(SOUND_MIXER_RECSRC)
 
 struct target_snd_timer_id {
-    int dev_class;
-    int dev_sclass;
-    int card;
-    int device;
-    int subdevice;
+    abi_int dev_class;
+    abi_int dev_sclass;
+    abi_int card;
+    abi_int device;
+    abi_int subdevice;
 };
 
 struct target_snd_timer_ginfo {
     struct target_snd_timer_id tid;
     abi_uint flags;
-    int card;
+    abi_int card;
     unsigned char id[64];
     unsigned char name[80];
     abi_ulong reserved0;
@@ -2532,7 +2532,7 @@ struct target_snd_timer_select {
 
 struct target_snd_timer_info {
     abi_uint flags;
-    int card;
+    abi_int card;
     unsigned char id[64];
     unsigned char name[80];
     abi_ulong reserved0;
@@ -2550,7 +2550,7 @@ struct target_snd_timer_status {
 };
 
 /* alsa timer ioctls */
-#define TARGET_SNDRV_TIMER_IOCTL_PVERSION     TARGET_IOR('T', 0x00, int)
+#define TARGET_SNDRV_TIMER_IOCTL_PVERSION     TARGET_IOR('T', 0x00, abi_int)
 #define TARGET_SNDRV_TIMER_IOCTL_NEXT_DEVICE  TARGET_IOWR('T', 0x01,    \
                                                           struct snd_timer_id)
 #define TARGET_SNDRV_TIMER_IOCTL_GINFO        TARGET_IOWR('T', 0x03,    \
@@ -2650,9 +2650,9 @@ struct target_mq_attr {
 };
 
 struct target_drm_version {
-    int version_major;
-    int version_minor;
-    int version_patchlevel;
+    abi_int version_major;
+    abi_int version_minor;
+    abi_int version_patchlevel;
     abi_ulong name_len;
     abi_ulong name;
     abi_ulong date_len;
@@ -2662,7 +2662,7 @@ struct target_drm_version {
 };
 
 struct target_drm_i915_getparam {
-    int param;
+    abi_int param;
     abi_ulong value;
 };
 
@@ -2755,7 +2755,7 @@ struct target_sigevent {
 
 struct target_user_cap_header {
     abi_uint version;
-    int pid;
+    abi_int  pid;
 };
 
 struct target_user_cap_data {

From 77e935f4e6ecfde42f806108ec1db7d81d3aecd7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 13:33:26 -0700
Subject: [PATCH 0784/1353] linux-user: Use abi_ushort not unsigned short in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 90 +++++++++++++++++++--------------------
 1 file changed, 45 insertions(+), 45 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 442a8aefe3..21ca03b0f4 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -432,7 +432,7 @@ typedef struct {
 struct target_dirent {
     abi_long        d_ino;
     abi_long        d_off;
-    unsigned short  d_reclen;
+    abi_ushort      d_reclen;
     char            d_name[];
 };
 
@@ -1210,19 +1210,19 @@ struct target_rtc_pll_info {
 
 #define TARGET_NCC 8
 struct target_termio {
-    unsigned short c_iflag;         /* input mode flags */
-    unsigned short c_oflag;         /* output mode flags */
-    unsigned short c_cflag;         /* control mode flags */
-    unsigned short c_lflag;         /* local mode flags */
+    abi_ushort c_iflag;             /* input mode flags */
+    abi_ushort c_oflag;             /* output mode flags */
+    abi_ushort c_cflag;             /* control mode flags */
+    abi_ushort c_lflag;             /* local mode flags */
     unsigned char c_line;           /* line discipline */
     unsigned char c_cc[TARGET_NCC]; /* control characters */
 };
 
 struct target_winsize {
-    unsigned short ws_row;
-    unsigned short ws_col;
-    unsigned short ws_xpixel;
-    unsigned short ws_ypixel;
+    abi_ushort ws_row;
+    abi_ushort ws_col;
+    abi_ushort ws_xpixel;
+    abi_ushort ws_ypixel;
 };
 
 #include "termbits.h"
@@ -1328,15 +1328,15 @@ struct target_winsize {
     || defined(TARGET_CRIS)
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-    unsigned short st_dev;
-    unsigned short __pad1;
+    abi_ushort st_dev;
+    abi_ushort __pad1;
     abi_ulong st_ino;
-    unsigned short st_mode;
-    unsigned short st_nlink;
-    unsigned short st_uid;
-    unsigned short st_gid;
-    unsigned short st_rdev;
-    unsigned short __pad2;
+    abi_ushort st_mode;
+    abi_ushort st_nlink;
+    abi_ushort st_uid;
+    abi_ushort st_gid;
+    abi_ushort st_rdev;
+    abi_ushort __pad2;
     abi_ulong  st_size;
     abi_ulong  st_blksize;
     abi_ulong  st_blocks;
@@ -1355,7 +1355,7 @@ struct target_stat {
  */
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
-    unsigned short  st_dev;
+    abi_ushort      st_dev;
     unsigned char   __pad0[10];
 
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
@@ -1367,7 +1367,7 @@ struct target_stat64 {
     abi_ulong       st_uid;
     abi_ulong       st_gid;
 
-    unsigned short  st_rdev;
+    abi_ushort      st_rdev;
     unsigned char   __pad3[10];
 
     abi_llong       st_size;
@@ -1442,7 +1442,7 @@ struct target_stat {
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
     unsigned char   __pad0[6];
-    unsigned short  st_dev;
+    abi_ushort      st_dev;
 
     abi_ullong      st_ino;
     abi_ullong      st_nlink;
@@ -1453,7 +1453,7 @@ struct target_stat64 {
     abi_uint        st_gid;
 
     unsigned char   __pad2[6];
-    unsigned short  st_rdev;
+    abi_ushort      st_rdev;
 
     abi_llong       st_size;
     abi_llong       st_blksize;
@@ -1477,13 +1477,13 @@ struct target_stat64 {
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-    unsigned short  st_dev;
+    abi_ushort      st_dev;
     abi_ulong       st_ino;
-    unsigned short  st_mode;
+    abi_ushort      st_mode;
     short           st_nlink;
-    unsigned short  st_uid;
-    unsigned short  st_gid;
-    unsigned short  st_rdev;
+    abi_ushort      st_uid;
+    abi_ushort      st_gid;
+    abi_ushort      st_rdev;
     abi_long        st_size;
     abi_long        target_st_atime;
     abi_ulong       target_st_atime_nsec;
@@ -1499,7 +1499,7 @@ struct target_stat {
 #define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
     unsigned char   __pad0[6];
-    unsigned short  st_dev;
+    abi_ushort      st_dev;
 
     abi_ullong      st_ino;
 
@@ -1510,7 +1510,7 @@ struct target_stat64 {
     abi_uint        st_gid;
 
     unsigned char   __pad2[6];
-    unsigned short  st_rdev;
+    abi_ushort      st_rdev;
 
     unsigned char   __pad3[8];
 
@@ -1544,7 +1544,7 @@ struct target_stat {
     abi_uint  st_mode;
 #else
     abi_uint  st_mode;
-    unsigned short st_nlink;
+    abi_ushort st_nlink;
 #endif
     abi_uint   st_uid;
     abi_uint   st_gid;
@@ -1598,7 +1598,7 @@ struct target_stat {
     abi_ulong st_dev;
     abi_ulong st_ino;
     abi_uint st_mode;
-    unsigned short st_nlink;
+    abi_ushort st_nlink;
     abi_uint st_uid;
     abi_uint st_gid;
     abi_ulong  st_rdev;
@@ -1647,15 +1647,15 @@ struct QEMU_PACKED target_stat64 {
 #elif defined(TARGET_M68K)
 
 struct target_stat {
-    unsigned short st_dev;
-    unsigned short __pad1;
-    abi_ulong st_ino;
-    unsigned short st_mode;
-    unsigned short st_nlink;
-    unsigned short st_uid;
-    unsigned short st_gid;
-    unsigned short st_rdev;
-    unsigned short __pad2;
+    abi_ushort st_dev;
+    abi_ushort __pad1;
+    abi_ulong  st_ino;
+    abi_ushort st_mode;
+    abi_ushort st_nlink;
+    abi_ushort st_uid;
+    abi_ushort st_gid;
+    abi_ushort st_rdev;
+    abi_ushort __pad2;
     abi_ulong  st_size;
     abi_ulong  st_blksize;
     abi_ulong  st_blocks;
@@ -1895,10 +1895,10 @@ struct target_stat64 {
 struct target_stat {
     abi_ulong  st_dev;
     abi_ulong  st_ino;
-    unsigned short st_mode;
-    unsigned short st_nlink;
-    unsigned short st_uid;
-    unsigned short st_gid;
+    abi_ushort st_mode;
+    abi_ushort st_nlink;
+    abi_ushort st_uid;
+    abi_ushort st_gid;
     abi_ulong  st_rdev;
     abi_ulong  st_size;
     abi_ulong  st_blksize;
@@ -2619,8 +2619,8 @@ struct target_sysinfo {
     abi_ulong bufferram;            /* Memory used by buffers */
     abi_ulong totalswap;            /* Total swap space size */
     abi_ulong freeswap;             /* swap space still available */
-    unsigned short procs;           /* Number of current processes */
-    unsigned short pad;             /* explicit padding for m68k */
+    abi_ushort procs;               /* Number of current processes */
+    abi_ushort pad;                 /* explicit padding for m68k */
     abi_ulong totalhigh;            /* Total high memory size */
     abi_ulong freehigh;             /* Available high memory size */
     abi_uint mem_unit;              /* Memory unit size in bytes */

From 20d49567a331c24db828c6bac643bc766bddfa26 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 14:06:23 -0700
Subject: [PATCH 0785/1353] linux-user: Use abi_short not short in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 21ca03b0f4..9dc41828cf 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -702,8 +702,8 @@ typedef struct target_siginfo {
 
 struct target_pollfd {
     abi_int fd;       /* file descriptor */
-    short events;     /* requested events */
-    short revents;    /* returned events */
+    abi_short events;     /* requested events */
+    abi_short revents;    /* returned events */
 };
 
 /* virtual terminal ioctls */
@@ -1480,7 +1480,7 @@ struct target_stat {
     abi_ushort      st_dev;
     abi_ulong       st_ino;
     abi_ushort      st_mode;
-    short           st_nlink;
+    abi_short       st_nlink;
     abi_ushort      st_uid;
     abi_ushort      st_gid;
     abi_ushort      st_rdev;

From 0f41be8d8958e9a84f9b4242d045c71d641da3be Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 14:09:00 -0700
Subject: [PATCH 0786/1353] linux-user: Use abi_uint not unsigned in
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall_defs.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 9dc41828cf..c8ffb4f785 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1776,14 +1776,14 @@ struct target_stat {
 
 #define TARGET_STAT_HAVE_NSEC
 struct target_stat {
-    unsigned        st_dev;
+    abi_uint        st_dev;
     abi_long        st_pad1[3];             /* Reserved for network id */
     abi_ulong       st_ino;
     abi_uint        st_mode;
     abi_uint        st_nlink;
     abi_int         st_uid;
     abi_int         st_gid;
-    unsigned        st_rdev;
+    abi_uint        st_rdev;
     abi_long        st_pad2[2];
     abi_long        st_size;
     abi_long        st_pad3;

From e73f27003e777fd9b77d13e71c5268015b8ed2b6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 14:55:03 -0700
Subject: [PATCH 0787/1353] include/exec/user: Set ABI_LLONG_ALIGNMENT to 4 for
 microblaze

Based on gcc's microblaze.h setting BIGGEST_ALIGNMENT to 32 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/user/abitypes.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index 743b8bb9ea..beba0a48c7 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -15,7 +15,9 @@
 #define ABI_LLONG_ALIGNMENT 2
 #endif
 
-#if (defined(TARGET_I386) && !defined(TARGET_X86_64)) || defined(TARGET_SH4)
+#if (defined(TARGET_I386) && !defined(TARGET_X86_64)) \
+    || defined(TARGET_SH4) \
+    || defined(TARGET_MICROBLAZE)
 #define ABI_LLONG_ALIGNMENT 4
 #endif
 

From ea9812d93f9c3e1a308ac33097021c50d581d10e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 3 Jun 2023 14:58:46 -0700
Subject: [PATCH 0788/1353] include/exec/user: Set ABI_LLONG_ALIGNMENT to 4 for
 nios2

Based on gcc's nios2.h setting BIGGEST_ALIGNMENT to 32 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/user/abitypes.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index beba0a48c7..6191ce9f74 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -17,7 +17,8 @@
 
 #if (defined(TARGET_I386) && !defined(TARGET_X86_64)) \
     || defined(TARGET_SH4) \
-    || defined(TARGET_MICROBLAZE)
+    || defined(TARGET_MICROBLAZE) \
+    || defined(TARGET_NIOS2)
 #define ABI_LLONG_ALIGNMENT 4
 #endif
 

From 7a8d9f3a0e882df50681e40f09c29cfb4966ea2d Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 5 Jul 2023 14:10:23 +0200
Subject: [PATCH 0789/1353] linux-user/syscall: Implement execve without
 execveat

Support for execveat syscall was implemented in 55bbe4 and is available
since QEMU 8.0.0. It relies on host execveat, which is widely available
on most of Linux kernels today.

However, this change breaks qemu-user self emulation, if "host" qemu
version is less than 8.0.0. Indeed, it does not implement yet execveat.
This strange use case happens with most of distribution today having
binfmt support.

With a concrete failing example:
$ qemu-x86_64-7.2 qemu-x86_64-8.0 /bin/bash -c /bin/ls
/bin/bash: line 1: /bin/ls: Function not implemented
-> not implemented means execve returned ENOSYS

qemu-user-static 7.2 and 8.0 can be conveniently grabbed from debian
packages qemu-user-static* [1].

One usage of this is running wine-arm64 from linux-x64 (details [2]).
This is by updating qemu embedded in docker image that we ran into this
issue.

The solution to update host qemu is not always possible. Either it's
complicated or ask you to recompile it, or simply is not accessible
(GitLab CI, GitHub Actions). Thus, it could be worth to implement execve
without relying on execveat, which is the goal of this patch.

This patch was tested with example presented in this commit message.

[1] http://ftp.us.debian.org/debian/pool/main/q/qemu/
[1] https://www.linaro.org/blog/emulate-windows-on-arm/

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20230705121023.973284-1-pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 420bab7c68..c15d9ad743 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -659,6 +659,7 @@ safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
 #endif
 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
               int, options, struct rusage *, rusage)
+safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
 safe_syscall5(int, execveat, int, dirfd, const char *, filename,
               char **, argv, char **, envp, int, flags)
 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
@@ -8629,9 +8630,9 @@ ssize_t do_guest_readlink(const char *pathname, char *buf, size_t bufsiz)
     return ret;
 }
 
-static int do_execveat(CPUArchState *cpu_env, int dirfd,
-                       abi_long pathname, abi_long guest_argp,
-                       abi_long guest_envp, int flags)
+static int do_execv(CPUArchState *cpu_env, int dirfd,
+                    abi_long pathname, abi_long guest_argp,
+                    abi_long guest_envp, int flags, bool is_execveat)
 {
     int ret;
     char **argp, **envp;
@@ -8710,11 +8711,14 @@ static int do_execveat(CPUArchState *cpu_env, int dirfd,
         goto execve_efault;
     }
 
+    const char *exe = p;
     if (is_proc_myself(p, "exe")) {
-        ret = get_errno(safe_execveat(dirfd, exec_path, argp, envp, flags));
-    } else {
-        ret = get_errno(safe_execveat(dirfd, p, argp, envp, flags));
+        exe = exec_path;
     }
+    ret = is_execveat
+        ? safe_execveat(dirfd, exe, argp, envp, flags)
+        : safe_execve(exe, argp, envp);
+    ret = get_errno(ret);
 
     unlock_user(p, pathname, 0);
 
@@ -9406,9 +9410,9 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return ret;
 #endif
     case TARGET_NR_execveat:
-        return do_execveat(cpu_env, arg1, arg2, arg3, arg4, arg5);
+        return do_execv(cpu_env, arg1, arg2, arg3, arg4, arg5, true);
     case TARGET_NR_execve:
-        return do_execveat(cpu_env, AT_FDCWD, arg1, arg2, arg3, 0);
+        return do_execv(cpu_env, AT_FDCWD, arg1, arg2, arg3, 0, false);
     case TARGET_NR_chdir:
         if (!(p = lock_user_string(arg1)))
             return -TARGET_EFAULT;

From 9b61f77f4001946446d0c7f61ed829a6aefa4c07 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 26 Jun 2023 16:02:50 +0200
Subject: [PATCH 0790/1353] linux-user: Fix do_shmat type errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The guest address, raddr, should be unsigned, aka abi_ulong.
The host addresses should be cast via *intptr_t not long.
Drop the inline and fix two other whitespace issues.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20230626140250.69572-1-richard.henderson@linaro.org>
---
 linux-user/syscall.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index c15d9ad743..b78eb686d8 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4539,14 +4539,14 @@ static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
 }
 #endif
 
-static inline abi_ulong do_shmat(CPUArchState *cpu_env,
-                                 int shmid, abi_ulong shmaddr, int shmflg)
+static abi_ulong do_shmat(CPUArchState *cpu_env, int shmid,
+                          abi_ulong shmaddr, int shmflg)
 {
     CPUState *cpu = env_cpu(cpu_env);
-    abi_long raddr;
+    abi_ulong raddr;
     void *host_raddr;
     struct shmid_ds shm_info;
-    int i,ret;
+    int i, ret;
     abi_ulong shmlba;
 
     /* shmat pointers are always untagged */
@@ -4602,9 +4602,9 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
 
     if (host_raddr == (void *)-1) {
         mmap_unlock();
-        return get_errno((long)host_raddr);
+        return get_errno((intptr_t)host_raddr);
     }
-    raddr=h2g((unsigned long)host_raddr);
+    raddr = h2g((uintptr_t)host_raddr);
 
     page_set_flags(raddr, raddr + shm_info.shm_segsz - 1,
                    PAGE_VALID | PAGE_RESET | PAGE_READ |
@@ -4621,7 +4621,6 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
 
     mmap_unlock();
     return raddr;
-
 }
 
 static inline abi_long do_shmdt(abi_ulong shmaddr)

From cb62bd15e14e304617d250158b77d0deb032f032 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 6 Jul 2023 08:45:13 +0100
Subject: [PATCH 0791/1353] accel/tcg: Split out cpu_exec_longjmp_cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Share the setjmp cleanup between cpu_exec_step_atomic
and cpu_exec_setjmp.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec.c | 43 +++++++++++++++++++------------------------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index ba1890a373..31aa320513 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -526,6 +526,23 @@ static void cpu_exec_exit(CPUState *cpu)
     }
 }
 
+static void cpu_exec_longjmp_cleanup(CPUState *cpu)
+{
+    /* Non-buggy compilers preserve this; assert the correct value. */
+    g_assert(cpu == current_cpu);
+
+#ifdef CONFIG_USER_ONLY
+    clear_helper_retaddr();
+    if (have_mmap_lock()) {
+        mmap_unlock();
+    }
+#endif
+    if (qemu_mutex_iothread_locked()) {
+        qemu_mutex_unlock_iothread();
+    }
+    assert_no_pages_locked();
+}
+
 void cpu_exec_step_atomic(CPUState *cpu)
 {
     CPUArchState *env = cpu->env_ptr;
@@ -568,16 +585,7 @@ void cpu_exec_step_atomic(CPUState *cpu)
         cpu_tb_exec(cpu, tb, &tb_exit);
         cpu_exec_exit(cpu);
     } else {
-#ifdef CONFIG_USER_ONLY
-        clear_helper_retaddr();
-        if (have_mmap_lock()) {
-            mmap_unlock();
-        }
-#endif
-        if (qemu_mutex_iothread_locked()) {
-            qemu_mutex_unlock_iothread();
-        }
-        assert_no_pages_locked();
+        cpu_exec_longjmp_cleanup(cpu);
     }
 
     /*
@@ -1023,20 +1031,7 @@ static int cpu_exec_setjmp(CPUState *cpu, SyncClocks *sc)
 {
     /* Prepare setjmp context for exception handling. */
     if (unlikely(sigsetjmp(cpu->jmp_env, 0) != 0)) {
-        /* Non-buggy compilers preserve this; assert the correct value. */
-        g_assert(cpu == current_cpu);
-
-#ifdef CONFIG_USER_ONLY
-        clear_helper_retaddr();
-        if (have_mmap_lock()) {
-            mmap_unlock();
-        }
-#endif
-        if (qemu_mutex_iothread_locked()) {
-            qemu_mutex_unlock_iothread();
-        }
-
-        assert_no_pages_locked();
+        cpu_exec_longjmp_cleanup(cpu);
     }
 
     return cpu_exec_loop(cpu, sc);

From e18ed26ce785f74a17e6f3a095647e08ba6fc669 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 10:17:44 +0000
Subject: [PATCH 0792/1353] tcg: Fix info_in_idx increment in layout_arg_by_ref
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Off by one error, failing to take into account that layout_arg_1
already incremented info_in_idx for the first piece.  We only
need care for the n-1 TCG_CALL_ARG_BY_REF_N pieces here.

Cc: qemu-stable@nongnu.org
Fixes: 313bdea84d2 ("tcg: Add TCG_CALL_{RET,ARG}_BY_REF")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1751
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
---
 tcg/tcg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/tcg.c b/tcg/tcg.c
index a0628fe424..652e8ea6b9 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1083,7 +1083,7 @@ static void layout_arg_by_ref(TCGCumulativeArgs *cum, TCGHelperInfo *info)
             .ref_slot = cum->ref_slot + i,
         };
     }
-    cum->info_in_idx += n;
+    cum->info_in_idx += n - 1;  /* i=0 accounted for in layout_arg_1 */
     cum->ref_slot += n;
 }
 

From d28b3c90cfad1a7e211ae2bce36ecb9071086129 Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@suse.de>
Date: Thu, 6 Jul 2023 13:34:19 +0200
Subject: [PATCH 0793/1353] linux-user: Make sure initial brk(0) is
 page-aligned

Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Signed-off-by: Andreas Schwab <schwab@suse.de>
Message-Id: <mvmpm55qnno.fsf@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index b78eb686d8..02d3b6c90a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -806,7 +806,7 @@ static abi_ulong brk_page;
 
 void target_set_brk(abi_ulong new_brk)
 {
-    target_brk = new_brk;
+    target_brk = TARGET_PAGE_ALIGN(new_brk);
     brk_page = HOST_PAGE_ALIGN(target_brk);
 }
 

From 2b730f797eb7b439d8e169d1062fa0a5ec2f4ebf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:32 +0100
Subject: [PATCH 0794/1353] linux-user: Fix formatting of mmap.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix all checkpatch.pl errors within mmap.c.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-5-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 199 ++++++++++++++++++++++++++++------------------
 1 file changed, 122 insertions(+), 77 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 2692936773..639921dba0 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -56,10 +56,11 @@ void mmap_fork_start(void)
 
 void mmap_fork_end(int child)
 {
-    if (child)
+    if (child) {
         pthread_mutex_init(&mmap_mutex, NULL);
-    else
+    } else {
         pthread_mutex_unlock(&mmap_mutex);
+    }
 }
 
 /*
@@ -203,40 +204,47 @@ static int mmap_frag(abi_ulong real_start,
 
     /* get the protection of the target pages outside the mapping */
     prot1 = 0;
-    for(addr = real_start; addr < real_end; addr++) {
-        if (addr < start || addr >= end)
+    for (addr = real_start; addr < real_end; addr++) {
+        if (addr < start || addr >= end) {
             prot1 |= page_get_flags(addr);
+        }
     }
 
     if (prot1 == 0) {
         /* no page was there, so we allocate one */
         void *p = mmap(host_start, qemu_host_page_size, prot,
                        flags | MAP_ANONYMOUS, -1, 0);
-        if (p == MAP_FAILED)
+        if (p == MAP_FAILED) {
             return -1;
+        }
         prot1 = prot;
     }
     prot1 &= PAGE_BITS;
 
     prot_new = prot | prot1;
     if (!(flags & MAP_ANONYMOUS)) {
-        /* msync() won't work here, so we return an error if write is
-           possible while it is a shared mapping */
-        if ((flags & MAP_TYPE) == MAP_SHARED &&
-            (prot & PROT_WRITE))
+        /*
+         * msync() won't work here, so we return an error if write is
+         * possible while it is a shared mapping.
+         */
+        if ((flags & MAP_TYPE) == MAP_SHARED && (prot & PROT_WRITE)) {
             return -1;
+        }
 
         /* adjust protection to be able to read */
-        if (!(prot1 & PROT_WRITE))
+        if (!(prot1 & PROT_WRITE)) {
             mprotect(host_start, qemu_host_page_size, prot1 | PROT_WRITE);
+        }
 
         /* read the corresponding file data */
-        if (pread(fd, g2h_untagged(start), end - start, offset) == -1)
+        if (pread(fd, g2h_untagged(start), end - start, offset) == -1) {
             return -1;
+        }
 
         /* put final protection */
-        if (prot_new != (prot1 | PROT_WRITE))
+        if (prot_new != (prot1 | PROT_WRITE)) {
             mprotect(host_start, qemu_host_page_size, prot_new);
+        }
     } else {
         if (prot_new != prot1) {
             mprotect(host_start, qemu_host_page_size, prot_new);
@@ -265,8 +273,10 @@ abi_ulong mmap_next_start = TASK_UNMAPPED_BASE;
 
 unsigned long last_brk;
 
-/* Subroutine of mmap_find_vma, used when we have pre-allocated a chunk
-   of guest address space.  */
+/*
+ * Subroutine of mmap_find_vma, used when we have pre-allocated
+ * a chunk of guest address space.
+ */
 static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
                                         abi_ulong align)
 {
@@ -362,15 +372,17 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
          *  - shmat() with SHM_REMAP flag
          */
         ptr = mmap(g2h_untagged(addr), size, PROT_NONE,
-                   MAP_ANONYMOUS|MAP_PRIVATE|MAP_NORESERVE, -1, 0);
+                   MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
 
         /* ENOMEM, if host address space has no memory */
         if (ptr == MAP_FAILED) {
             return (abi_ulong)-1;
         }
 
-        /* Count the number of sequential returns of the same address.
-           This is used to modify the search algorithm below.  */
+        /*
+         * Count the number of sequential returns of the same address.
+         * This is used to modify the search algorithm below.
+         */
         repeat = (ptr == prev ? repeat + 1 : 0);
 
         if (h2g_valid(ptr + size - 1)) {
@@ -387,14 +399,18 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
             /* The address is not properly aligned for the target.  */
             switch (repeat) {
             case 0:
-                /* Assume the result that the kernel gave us is the
-                   first with enough free space, so start again at the
-                   next higher target page.  */
+                /*
+                 * Assume the result that the kernel gave us is the
+                 * first with enough free space, so start again at the
+                 * next higher target page.
+                 */
                 addr = ROUND_UP(addr, align);
                 break;
             case 1:
-                /* Sometimes the kernel decides to perform the allocation
-                   at the top end of memory instead.  */
+                /*
+                 * Sometimes the kernel decides to perform the allocation
+                 * at the top end of memory instead.
+                 */
                 addr &= -align;
                 break;
             case 2:
@@ -407,8 +423,10 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
                 break;
             }
         } else {
-            /* Since the result the kernel gave didn't fit, start
-               again at low memory.  If any repetition, fail.  */
+            /*
+             * Since the result the kernel gave didn't fit, start
+             * again at low memory.  If any repetition, fail.
+             */
             addr = (repeat ? -1 : 0);
         }
 
@@ -423,8 +441,10 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
                 return (abi_ulong)-1;
             }
             wrapped = 1;
-            /* Don't actually use 0 when wrapping, instead indicate
-               that we'd truly like an allocation in low memory.  */
+            /*
+             * Don't actually use 0 when wrapping, instead indicate
+             * that we'd truly like an allocation in low memory.
+             */
             addr = (mmap_min_addr > TARGET_PAGE_SIZE
                      ? TARGET_PAGE_ALIGN(mmap_min_addr)
                      : TARGET_PAGE_SIZE);
@@ -485,8 +505,10 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
     real_start = start & qemu_host_page_mask;
     host_offset = offset & qemu_host_page_mask;
 
-    /* If the user is asking for the kernel to find a location, do that
-       before we truncate the length for mapping files below.  */
+    /*
+     * If the user is asking for the kernel to find a location, do that
+     * before we truncate the length for mapping files below.
+     */
     if (!(flags & MAP_FIXED)) {
         host_len = len + offset - host_offset;
         host_len = HOST_PAGE_ALIGN(host_len);
@@ -497,32 +519,36 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         }
     }
 
-    /* When mapping files into a memory area larger than the file, accesses
-       to pages beyond the file size will cause a SIGBUS. 
-
-       For example, if mmaping a file of 100 bytes on a host with 4K pages
-       emulating a target with 8K pages, the target expects to be able to
-       access the first 8K. But the host will trap us on any access beyond
-       4K.  
-
-       When emulating a target with a larger page-size than the hosts, we
-       may need to truncate file maps at EOF and add extra anonymous pages
-       up to the targets page boundary.  */
-
+    /*
+     * When mapping files into a memory area larger than the file, accesses
+     * to pages beyond the file size will cause a SIGBUS.
+     *
+     * For example, if mmaping a file of 100 bytes on a host with 4K pages
+     * emulating a target with 8K pages, the target expects to be able to
+     * access the first 8K. But the host will trap us on any access beyond
+     * 4K.
+     *
+     * When emulating a target with a larger page-size than the hosts, we
+     * may need to truncate file maps at EOF and add extra anonymous pages
+     * up to the targets page boundary.
+     */
     if ((qemu_real_host_page_size() < qemu_host_page_size) &&
         !(flags & MAP_ANONYMOUS)) {
         struct stat sb;
 
-       if (fstat (fd, &sb) == -1)
-           goto fail;
+        if (fstat(fd, &sb) == -1) {
+            goto fail;
+        }
 
-       /* Are we trying to create a map beyond EOF?.  */
-       if (offset + len > sb.st_size) {
-           /* If so, truncate the file map at eof aligned with 
-              the hosts real pagesize. Additional anonymous maps
-              will be created beyond EOF.  */
-           len = REAL_HOST_PAGE_ALIGN(sb.st_size - offset);
-       }
+        /* Are we trying to create a map beyond EOF?.  */
+        if (offset + len > sb.st_size) {
+            /*
+             * If so, truncate the file map at eof aligned with
+             * the hosts real pagesize. Additional anonymous maps
+             * will be created beyond EOF.
+             */
+            len = REAL_HOST_PAGE_ALIGN(sb.st_size - offset);
+        }
     }
 
     if (!(flags & MAP_FIXED)) {
@@ -532,9 +558,11 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         host_len = len + offset - host_offset;
         host_len = HOST_PAGE_ALIGN(host_len);
 
-        /* Note: we prefer to control the mapping address. It is
-           especially important if qemu_host_page_size >
-           qemu_real_host_page_size */
+        /*
+         * Note: we prefer to control the mapping address. It is
+         * especially important if qemu_host_page_size >
+         * qemu_real_host_page_size.
+         */
         p = mmap(g2h_untagged(start), host_len, host_prot,
                  flags | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
         if (p == MAP_FAILED) {
@@ -572,45 +600,52 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             goto fail;
         }
 
-        /* worst case: we cannot map the file because the offset is not
-           aligned, so we read it */
+        /*
+         * worst case: we cannot map the file because the offset is not
+         * aligned, so we read it
+         */
         if (!(flags & MAP_ANONYMOUS) &&
             (offset & ~qemu_host_page_mask) != (start & ~qemu_host_page_mask)) {
-            /* msync() won't work here, so we return an error if write is
-               possible while it is a shared mapping */
-            if ((flags & MAP_TYPE) == MAP_SHARED &&
-                (host_prot & PROT_WRITE)) {
+            /*
+             * msync() won't work here, so we return an error if write is
+             * possible while it is a shared mapping
+             */
+            if ((flags & MAP_TYPE) == MAP_SHARED && (host_prot & PROT_WRITE)) {
                 errno = EINVAL;
                 goto fail;
             }
             retaddr = target_mmap(start, len, target_prot | PROT_WRITE,
                                   MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
                                   -1, 0);
-            if (retaddr == -1)
+            if (retaddr == -1) {
                 goto fail;
-            if (pread(fd, g2h_untagged(start), len, offset) == -1)
+            }
+            if (pread(fd, g2h_untagged(start), len, offset) == -1) {
                 goto fail;
+            }
             if (!(host_prot & PROT_WRITE)) {
                 ret = target_mprotect(start, len, target_prot);
                 assert(ret == 0);
             }
             goto the_end;
         }
-        
+
         /* handle the start of the mapping */
         if (start > real_start) {
             if (real_end == real_start + qemu_host_page_size) {
                 /* one single host page */
                 ret = mmap_frag(real_start, start, end,
                                 host_prot, flags, fd, offset);
-                if (ret == -1)
+                if (ret == -1) {
                     goto fail;
+                }
                 goto the_end1;
             }
             ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
                             host_prot, flags, fd, offset);
-            if (ret == -1)
+            if (ret == -1) {
                 goto fail;
+            }
             real_start += qemu_host_page_size;
         }
         /* handle the end of the mapping */
@@ -619,8 +654,9 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
                             real_end - qemu_host_page_size, end,
                             host_prot, flags, fd,
                             offset + real_end - qemu_host_page_size - start);
-            if (ret == -1)
+            if (ret == -1) {
                 goto fail;
+            }
             real_end -= qemu_host_page_size;
         }
 
@@ -628,14 +664,16 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         if (real_start < real_end) {
             void *p;
             unsigned long offset1;
-            if (flags & MAP_ANONYMOUS)
+            if (flags & MAP_ANONYMOUS) {
                 offset1 = 0;
-            else
+            } else {
                 offset1 = offset + real_start - start;
+            }
             p = mmap(g2h_untagged(real_start), real_end - real_start,
                      host_prot, flags, fd, offset1);
-            if (p == MAP_FAILED)
+            if (p == MAP_FAILED) {
                 goto fail;
+            }
             passthrough_start = real_start;
             passthrough_end = real_end;
         }
@@ -697,16 +735,18 @@ static void mmap_reserve(abi_ulong start, abi_ulong size)
             }
             end = real_end;
         }
-        if (prot != 0)
+        if (prot != 0) {
             real_start += qemu_host_page_size;
+        }
     }
     if (end < real_end) {
         prot = 0;
         for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
             prot |= page_get_flags(addr);
         }
-        if (prot != 0)
+        if (prot != 0) {
             real_end -= qemu_host_page_size;
+        }
     }
     if (real_start != real_end) {
         mmap(g2h_untagged(real_start), real_end - real_start, PROT_NONE,
@@ -722,8 +762,9 @@ int target_munmap(abi_ulong start, abi_ulong len)
 
     trace_target_munmap(start, len);
 
-    if (start & ~TARGET_PAGE_MASK)
+    if (start & ~TARGET_PAGE_MASK) {
         return -TARGET_EINVAL;
+    }
     len = TARGET_PAGE_ALIGN(len);
     if (len == 0 || !guest_range_valid_untagged(start, len)) {
         return -TARGET_EINVAL;
@@ -737,25 +778,27 @@ int target_munmap(abi_ulong start, abi_ulong len)
     if (start > real_start) {
         /* handle host page containing start */
         prot = 0;
-        for(addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
+        for (addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
             prot |= page_get_flags(addr);
         }
         if (real_end == real_start + qemu_host_page_size) {
-            for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
+            for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
                 prot |= page_get_flags(addr);
             }
             end = real_end;
         }
-        if (prot != 0)
+        if (prot != 0) {
             real_start += qemu_host_page_size;
+        }
     }
     if (end < real_end) {
         prot = 0;
-        for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
+        for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
             prot |= page_get_flags(addr);
         }
-        if (prot != 0)
+        if (prot != 0) {
             real_end -= qemu_host_page_size;
+        }
     }
 
     ret = 0;
@@ -798,8 +841,10 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                            flags, g2h_untagged(new_addr));
 
         if (reserved_va && host_addr != MAP_FAILED) {
-            /* If new and old addresses overlap then the above mremap will
-               already have failed with EINVAL.  */
+            /*
+             * If new and old addresses overlap then the above mremap will
+             * already have failed with EINVAL.
+             */
             mmap_reserve(old_addr, old_size);
         }
     } else if (flags & MREMAP_MAYMOVE) {

From 40965ad93127204058b0f17719f9579709e4344a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:33 +0100
Subject: [PATCH 0795/1353] linux-user/strace: Expand struct flags to hold a
 mask
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A zero bit value does not make sense -- it must relate to
some field in some way.

Define FLAG_BASIC with a build-time sanity check.
Adjust FLAG_GENERIC and FLAG_TARGET to use it.
Add FLAG_GENERIC_MASK and FLAG_TARGET_MASK.

Fix up the existing flag definitions for build errors.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-6-richard.henderson@linaro.org>
---
 linux-user/strace.c | 40 ++++++++++++++++++++++------------------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index 669200c4a4..9228b235da 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -46,15 +46,21 @@ struct syscallname {
  */
 struct flags {
     abi_long    f_value;  /* flag */
+    abi_long    f_mask;   /* mask */
     const char  *f_string; /* stringified flag */
 };
 
+/* No 'struct flags' element should have a zero mask. */
+#define FLAG_BASIC(V, M, N)      { V, M | QEMU_BUILD_BUG_ON_ZERO(!(M)), N }
+
 /* common flags for all architectures */
-#define FLAG_GENERIC(name) { name, #name }
+#define FLAG_GENERIC_MASK(V, M)  FLAG_BASIC(V, M, #V)
+#define FLAG_GENERIC(V)          FLAG_BASIC(V, V, #V)
 /* target specific flags (syscall_defs.h has TARGET_<flag>) */
-#define FLAG_TARGET(name)  { TARGET_ ## name, #name }
+#define FLAG_TARGET_MASK(V, M)   FLAG_BASIC(TARGET_##V, TARGET_##M, #V)
+#define FLAG_TARGET(V)           FLAG_BASIC(TARGET_##V, TARGET_##V, #V)
 /* end of flags array */
-#define FLAG_END           { 0, NULL }
+#define FLAG_END           { 0, 0, NULL }
 
 /* Structure used to translate enumerated values into strings */
 struct enums {
@@ -963,7 +969,7 @@ print_syscall_ret_ioctl(CPUArchState *cpu_env, const struct syscallname *name,
 #endif
 
 UNUSED static const struct flags access_flags[] = {
-    FLAG_GENERIC(F_OK),
+    FLAG_GENERIC_MASK(F_OK, R_OK | W_OK | X_OK),
     FLAG_GENERIC(R_OK),
     FLAG_GENERIC(W_OK),
     FLAG_GENERIC(X_OK),
@@ -999,9 +1005,9 @@ UNUSED static const struct flags mode_flags[] = {
 };
 
 UNUSED static const struct flags open_access_flags[] = {
-    FLAG_TARGET(O_RDONLY),
-    FLAG_TARGET(O_WRONLY),
-    FLAG_TARGET(O_RDWR),
+    FLAG_TARGET_MASK(O_RDONLY, O_ACCMODE),
+    FLAG_TARGET_MASK(O_WRONLY, O_ACCMODE),
+    FLAG_TARGET_MASK(O_RDWR, O_ACCMODE),
     FLAG_END,
 };
 
@@ -1010,7 +1016,9 @@ UNUSED static const struct flags open_flags[] = {
     FLAG_TARGET(O_CREAT),
     FLAG_TARGET(O_DIRECTORY),
     FLAG_TARGET(O_EXCL),
+#if TARGET_O_LARGEFILE != 0
     FLAG_TARGET(O_LARGEFILE),
+#endif
     FLAG_TARGET(O_NOCTTY),
     FLAG_TARGET(O_NOFOLLOW),
     FLAG_TARGET(O_NONBLOCK),      /* also O_NDELAY */
@@ -1075,7 +1083,7 @@ UNUSED static const struct flags umount2_flags[] = {
 };
 
 UNUSED static const struct flags mmap_prot_flags[] = {
-    FLAG_GENERIC(PROT_NONE),
+    FLAG_GENERIC_MASK(PROT_NONE, PROT_READ | PROT_WRITE | PROT_EXEC),
     FLAG_GENERIC(PROT_EXEC),
     FLAG_GENERIC(PROT_READ),
     FLAG_GENERIC(PROT_WRITE),
@@ -1103,7 +1111,7 @@ UNUSED static const struct flags mmap_flags[] = {
 #ifdef MAP_POPULATE
     FLAG_TARGET(MAP_POPULATE),
 #endif
-#ifdef TARGET_MAP_UNINITIALIZED
+#if defined(TARGET_MAP_UNINITIALIZED) && TARGET_MAP_UNINITIALIZED != 0
     FLAG_TARGET(MAP_UNINITIALIZED),
 #endif
     FLAG_TARGET(MAP_HUGETLB),
@@ -1201,13 +1209,13 @@ UNUSED static const struct flags statx_flags[] = {
     FLAG_GENERIC(AT_SYMLINK_NOFOLLOW),
 #endif
 #ifdef AT_STATX_SYNC_AS_STAT
-    FLAG_GENERIC(AT_STATX_SYNC_AS_STAT),
+    FLAG_GENERIC_MASK(AT_STATX_SYNC_AS_STAT, AT_STATX_SYNC_TYPE),
 #endif
 #ifdef AT_STATX_FORCE_SYNC
-    FLAG_GENERIC(AT_STATX_FORCE_SYNC),
+    FLAG_GENERIC_MASK(AT_STATX_FORCE_SYNC, AT_STATX_SYNC_TYPE),
 #endif
 #ifdef AT_STATX_DONT_SYNC
-    FLAG_GENERIC(AT_STATX_DONT_SYNC),
+    FLAG_GENERIC_MASK(AT_STATX_DONT_SYNC, AT_STATX_SYNC_TYPE),
 #endif
     FLAG_END,
 };
@@ -1481,14 +1489,10 @@ print_flags(const struct flags *f, abi_long flags, int last)
     const char *sep = "";
     int n;
 
-    if ((flags == 0) && (f->f_value == 0)) {
-        qemu_log("%s%s", f->f_string, get_comma(last));
-        return;
-    }
     for (n = 0; f->f_string != NULL; f++) {
-        if ((f->f_value != 0) && ((flags & f->f_value) == f->f_value)) {
+        if ((flags & f->f_mask) == f->f_value) {
             qemu_log("%s%s", sep, f->f_string);
-            flags &= ~f->f_value;
+            flags &= ~f->f_mask;
             sep = "|";
             n++;
         }

From 492fe4e75461d016d77913d0b3f7356a433ee8a1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:34 +0100
Subject: [PATCH 0796/1353] linux-user: Split TARGET_MAP_* out of
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the values into the per-target target_mman.h headers

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-7-richard.henderson@linaro.org>
---
 linux-user/alpha/target_mman.h   | 13 +++++
 linux-user/generic/target_mman.h | 54 ++++++++++++++++++++
 linux-user/hppa/target_mman.h    | 10 ++++
 linux-user/mips/target_mman.h    | 16 ++++++
 linux-user/mips64/target_mman.h  |  2 +-
 linux-user/ppc/target_mman.h     |  8 +++
 linux-user/sparc/target_mman.h   |  9 ++++
 linux-user/syscall_defs.h        | 85 +-------------------------------
 linux-user/xtensa/target_mman.h  | 16 ++++++
 9 files changed, 128 insertions(+), 85 deletions(-)

diff --git a/linux-user/alpha/target_mman.h b/linux-user/alpha/target_mman.h
index 051544f5ab..6bb03e7336 100644
--- a/linux-user/alpha/target_mman.h
+++ b/linux-user/alpha/target_mman.h
@@ -1,6 +1,19 @@
 #ifndef ALPHA_TARGET_MMAN_H
 #define ALPHA_TARGET_MMAN_H
 
+#define TARGET_MAP_ANONYMOUS            0x10
+#define TARGET_MAP_FIXED                0x100
+#define TARGET_MAP_GROWSDOWN            0x01000
+#define TARGET_MAP_DENYWRITE            0x02000
+#define TARGET_MAP_EXECUTABLE           0x04000
+#define TARGET_MAP_LOCKED               0x08000
+#define TARGET_MAP_NORESERVE            0x10000
+#define TARGET_MAP_POPULATE             0x20000
+#define TARGET_MAP_NONBLOCK             0x40000
+#define TARGET_MAP_STACK                0x80000
+#define TARGET_MAP_HUGETLB              0x100000
+#define TARGET_MAP_FIXED_NOREPLACE      0x200000
+
 #define TARGET_MADV_DONTNEED 6
 
 #define TARGET_MS_ASYNC 1
diff --git a/linux-user/generic/target_mman.h b/linux-user/generic/target_mman.h
index 32bf1a52d0..7b888fb7f8 100644
--- a/linux-user/generic/target_mman.h
+++ b/linux-user/generic/target_mman.h
@@ -1,6 +1,60 @@
 #ifndef LINUX_USER_TARGET_MMAN_H
 #define LINUX_USER_TARGET_MMAN_H
 
+/* These are defined in linux/mmap.h */
+#define TARGET_MAP_SHARED               0x01
+#define TARGET_MAP_PRIVATE              0x02
+#define TARGET_MAP_SHARED_VALIDATE      0x03
+
+/* 0x0100 - 0x4000 flags are defined in asm-generic/mman.h */
+#ifndef TARGET_MAP_GROWSDOWN
+#define TARGET_MAP_GROWSDOWN            0x0100
+#endif
+#ifndef TARGET_MAP_DENYWRITE
+#define TARGET_MAP_DENYWRITE            0x0800
+#endif
+#ifndef TARGET_MAP_EXECUTABLE
+#define TARGET_MAP_EXECUTABLE           0x1000
+#endif
+#ifndef TARGET_MAP_LOCKED
+#define TARGET_MAP_LOCKED               0x2000
+#endif
+#ifndef TARGET_MAP_NORESERVE
+#define TARGET_MAP_NORESERVE            0x4000
+#endif
+
+/* Other MAP flags are defined in asm-generic/mman-common.h */
+#ifndef TARGET_MAP_TYPE
+#define TARGET_MAP_TYPE                 0x0f
+#endif
+#ifndef TARGET_MAP_FIXED
+#define TARGET_MAP_FIXED                0x10
+#endif
+#ifndef TARGET_MAP_ANONYMOUS
+#define TARGET_MAP_ANONYMOUS            0x20
+#endif
+#ifndef TARGET_MAP_POPULATE
+#define TARGET_MAP_POPULATE             0x008000
+#endif
+#ifndef TARGET_MAP_NONBLOCK
+#define TARGET_MAP_NONBLOCK             0x010000
+#endif
+#ifndef TARGET_MAP_STACK
+#define TARGET_MAP_STACK                0x020000
+#endif
+#ifndef TARGET_MAP_HUGETLB
+#define TARGET_MAP_HUGETLB              0x040000
+#endif
+#ifndef TARGET_MAP_SYNC
+#define TARGET_MAP_SYNC                 0x080000
+#endif
+#ifndef TARGET_MAP_FIXED_NOREPLACE
+#define TARGET_MAP_FIXED_NOREPLACE      0x100000
+#endif
+#ifndef TARGET_MAP_UNINITIALIZED
+#define TARGET_MAP_UNINITIALIZED        0x4000000
+#endif
+
 #ifndef TARGET_MADV_NORMAL
 #define TARGET_MADV_NORMAL 0
 #endif
diff --git a/linux-user/hppa/target_mman.h b/linux-user/hppa/target_mman.h
index f9b6b97032..97f87d042a 100644
--- a/linux-user/hppa/target_mman.h
+++ b/linux-user/hppa/target_mman.h
@@ -1,6 +1,16 @@
 #ifndef HPPA_TARGET_MMAN_H
 #define HPPA_TARGET_MMAN_H
 
+#define TARGET_MAP_TYPE                 0x2b
+#define TARGET_MAP_FIXED                0x04
+#define TARGET_MAP_ANONYMOUS            0x10
+#define TARGET_MAP_GROWSDOWN            0x8000
+#define TARGET_MAP_POPULATE             0x10000
+#define TARGET_MAP_NONBLOCK             0x20000
+#define TARGET_MAP_STACK                0x40000
+#define TARGET_MAP_HUGETLB              0x80000
+#define TARGET_MAP_UNINITIALIZED        0
+
 #define TARGET_MADV_MERGEABLE 65
 #define TARGET_MADV_UNMERGEABLE 66
 #define TARGET_MADV_HUGEPAGE 67
diff --git a/linux-user/mips/target_mman.h b/linux-user/mips/target_mman.h
index e7ba6070fe..cd566c24b6 100644
--- a/linux-user/mips/target_mman.h
+++ b/linux-user/mips/target_mman.h
@@ -1 +1,17 @@
+#ifndef MIPS_TARGET_MMAN_H
+#define MIPS_TARGET_MMAN_H
+
+#define TARGET_MAP_NORESERVE            0x0400
+#define TARGET_MAP_ANONYMOUS            0x0800
+#define TARGET_MAP_GROWSDOWN            0x1000
+#define TARGET_MAP_DENYWRITE            0x2000
+#define TARGET_MAP_EXECUTABLE           0x4000
+#define TARGET_MAP_LOCKED               0x8000
+#define TARGET_MAP_POPULATE             0x10000
+#define TARGET_MAP_NONBLOCK             0x20000
+#define TARGET_MAP_STACK                0x40000
+#define TARGET_MAP_HUGETLB              0x80000
+
 #include "../generic/target_mman.h"
+
+#endif
diff --git a/linux-user/mips64/target_mman.h b/linux-user/mips64/target_mman.h
index e7ba6070fe..7bdc47d902 100644
--- a/linux-user/mips64/target_mman.h
+++ b/linux-user/mips64/target_mman.h
@@ -1 +1 @@
-#include "../generic/target_mman.h"
+#include "../mips/target_mman.h"
diff --git a/linux-user/ppc/target_mman.h b/linux-user/ppc/target_mman.h
index e7ba6070fe..67cc218f2e 100644
--- a/linux-user/ppc/target_mman.h
+++ b/linux-user/ppc/target_mman.h
@@ -1 +1,9 @@
+#ifndef PPC_TARGET_MMAN_H
+#define PPC_TARGET_MMAN_H
+
+#define TARGET_MAP_NORESERVE            0x40
+#define TARGET_MAP_LOCKED               0x80
+
 #include "../generic/target_mman.h"
+
+#endif
diff --git a/linux-user/sparc/target_mman.h b/linux-user/sparc/target_mman.h
index e7ba6070fe..9bad99c852 100644
--- a/linux-user/sparc/target_mman.h
+++ b/linux-user/sparc/target_mman.h
@@ -1 +1,10 @@
+#ifndef SPARC_TARGET_MMAN_H
+#define SPARC_TARGET_MMAN_H
+
+#define TARGET_MAP_NORESERVE           0x40
+#define TARGET_MAP_LOCKED              0x100
+#define TARGET_MAP_GROWSDOWN           0x0200
+
 #include "../generic/target_mman.h"
+
+#endif
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index c8ffb4f785..041105b7a7 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1238,90 +1238,7 @@ struct target_winsize {
 #define TARGET_PROT_MTE         0x20
 #endif
 
-/* Common */
-#define TARGET_MAP_SHARED       0x01            /* Share changes */
-#define TARGET_MAP_PRIVATE      0x02            /* Changes are private */
-#if defined(TARGET_HPPA)
-#define TARGET_MAP_TYPE         0x03            /* Mask for type of mapping */
-#else
-#define TARGET_MAP_TYPE         0x0f            /* Mask for type of mapping */
-#endif
-
-/* Target specific */
-#if defined(TARGET_MIPS)
-#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS    0x0800          /* don't use a file */
-#define TARGET_MAP_GROWSDOWN    0x1000          /* stack-like segment */
-#define TARGET_MAP_DENYWRITE    0x2000          /* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE   0x4000          /* mark it as an executable */
-#define TARGET_MAP_LOCKED       0x8000          /* pages are locked */
-#define TARGET_MAP_NORESERVE    0x0400          /* don't check for reservations */
-#define TARGET_MAP_POPULATE     0x10000         /* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK     0x20000         /* do not block on IO */
-#define TARGET_MAP_STACK        0x40000         /* ignored */
-#define TARGET_MAP_HUGETLB      0x80000         /* create a huge page mapping */
-#elif defined(TARGET_PPC)
-#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS    0x20            /* don't use a file */
-#define TARGET_MAP_GROWSDOWN    0x0100          /* stack-like segment */
-#define TARGET_MAP_DENYWRITE    0x0800          /* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE   0x1000          /* mark it as an executable */
-#define TARGET_MAP_LOCKED       0x0080          /* pages are locked */
-#define TARGET_MAP_NORESERVE    0x0040          /* don't check for reservations */
-#define TARGET_MAP_POPULATE     0x8000          /* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK     0x10000         /* do not block on IO */
-#define TARGET_MAP_STACK        0x20000         /* ignored */
-#define TARGET_MAP_HUGETLB      0x40000         /* create a huge page mapping */
-#elif defined(TARGET_ALPHA)
-#define TARGET_MAP_ANONYMOUS    0x10            /* don't use a file */
-#define TARGET_MAP_FIXED        0x100           /* Interpret addr exactly */
-#define TARGET_MAP_GROWSDOWN    0x01000         /* stack-like segment */
-#define TARGET_MAP_DENYWRITE    0x02000         /* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE   0x04000         /* mark it as an executable */
-#define TARGET_MAP_LOCKED       0x08000         /* lock the mapping */
-#define TARGET_MAP_NORESERVE    0x10000         /* no check for reservations */
-#define TARGET_MAP_POPULATE     0x20000         /* pop (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK     0x40000         /* do not block on IO */
-#define TARGET_MAP_STACK        0x80000         /* ignored */
-#define TARGET_MAP_HUGETLB      0x100000        /* create a huge page mapping */
-#elif defined(TARGET_HPPA)
-#define TARGET_MAP_ANONYMOUS    0x10            /* don't use a file */
-#define TARGET_MAP_FIXED        0x04            /* Interpret addr exactly */
-#define TARGET_MAP_GROWSDOWN    0x08000         /* stack-like segment */
-#define TARGET_MAP_DENYWRITE    0x00800         /* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE   0x01000         /* mark it as an executable */
-#define TARGET_MAP_LOCKED       0x02000         /* lock the mapping */
-#define TARGET_MAP_NORESERVE    0x04000         /* no check for reservations */
-#define TARGET_MAP_POPULATE     0x10000         /* pop (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK     0x20000         /* do not block on IO */
-#define TARGET_MAP_STACK        0x40000         /* ignored */
-#define TARGET_MAP_HUGETLB      0x80000         /* create a huge page mapping */
-#elif defined(TARGET_XTENSA)
-#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS    0x0800          /* don't use a file */
-#define TARGET_MAP_GROWSDOWN    0x1000          /* stack-like segment */
-#define TARGET_MAP_DENYWRITE    0x2000          /* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE   0x4000          /* mark it as an executable */
-#define TARGET_MAP_LOCKED       0x8000          /* pages are locked */
-#define TARGET_MAP_NORESERVE    0x0400          /* don't check for reservations */
-#define TARGET_MAP_POPULATE     0x10000         /* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK     0x20000         /* do not block on IO */
-#define TARGET_MAP_STACK        0x40000
-#define TARGET_MAP_HUGETLB  0x80000         /* create a huge page mapping */
-#else
-#define TARGET_MAP_FIXED        0x10            /* Interpret addr exactly */
-#define TARGET_MAP_ANONYMOUS    0x20            /* don't use a file */
-#define TARGET_MAP_GROWSDOWN    0x0100          /* stack-like segment */
-#define TARGET_MAP_DENYWRITE    0x0800          /* ETXTBSY */
-#define TARGET_MAP_EXECUTABLE   0x1000          /* mark it as an executable */
-#define TARGET_MAP_LOCKED       0x2000          /* pages are locked */
-#define TARGET_MAP_NORESERVE    0x4000          /* don't check for reservations */
-#define TARGET_MAP_POPULATE     0x8000          /* populate (prefault) pagetables */
-#define TARGET_MAP_NONBLOCK     0x10000         /* do not block on IO */
-#define TARGET_MAP_STACK        0x20000         /* ignored */
-#define TARGET_MAP_HUGETLB      0x40000         /* create a huge page mapping */
-#define TARGET_MAP_UNINITIALIZED 0x4000000      /* for anonymous mmap, memory could be uninitialized */
-#endif
+#include "target_mman.h"
 
 #if (defined(TARGET_I386) && defined(TARGET_ABI32))     \
     || (defined(TARGET_ARM) && defined(TARGET_ABI32))   \
diff --git a/linux-user/xtensa/target_mman.h b/linux-user/xtensa/target_mman.h
index e7ba6070fe..3891bb5e07 100644
--- a/linux-user/xtensa/target_mman.h
+++ b/linux-user/xtensa/target_mman.h
@@ -1 +1,17 @@
+#ifndef XTENSA_TARGET_MMAN_H
+#define XTENSA_TARGET_MMAN_H
+
+#define TARGET_MAP_NORESERVE            0x0400
+#define TARGET_MAP_ANONYMOUS            0x0800
+#define TARGET_MAP_GROWSDOWN            0x1000
+#define TARGET_MAP_DENYWRITE            0x2000
+#define TARGET_MAP_EXECUTABLE           0x4000
+#define TARGET_MAP_LOCKED               0x8000
+#define TARGET_MAP_POPULATE             0x10000
+#define TARGET_MAP_NONBLOCK             0x20000
+#define TARGET_MAP_STACK                0x40000
+#define TARGET_MAP_HUGETLB              0x80000
+
 #include "../generic/target_mman.h"
+
+#endif

From 6edfca9eae639707b85d04b050bc7ff09330e58b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:35 +0100
Subject: [PATCH 0797/1353] linux-user: Split TARGET_PROT_* out of
 syscall_defs.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the values into the per-target target_mman.h headers

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-8-richard.henderson@linaro.org>
---
 linux-user/aarch64/target_mman.h |  8 ++++++++
 linux-user/generic/target_mman.h |  6 +++++-
 linux-user/mips/target_mman.h    |  2 ++
 linux-user/syscall_defs.h        | 11 -----------
 linux-user/xtensa/target_mman.h  |  2 ++
 5 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/linux-user/aarch64/target_mman.h b/linux-user/aarch64/target_mman.h
index e7ba6070fe..f721295fe1 100644
--- a/linux-user/aarch64/target_mman.h
+++ b/linux-user/aarch64/target_mman.h
@@ -1 +1,9 @@
+#ifndef AARCH64_TARGET_MMAN_H
+#define AARCH64_TARGET_MMAN_H
+
+#define TARGET_PROT_BTI         0x10
+#define TARGET_PROT_MTE         0x20
+
 #include "../generic/target_mman.h"
+
+#endif
diff --git a/linux-user/generic/target_mman.h b/linux-user/generic/target_mman.h
index 7b888fb7f8..ec76a91b46 100644
--- a/linux-user/generic/target_mman.h
+++ b/linux-user/generic/target_mman.h
@@ -23,7 +23,11 @@
 #define TARGET_MAP_NORESERVE            0x4000
 #endif
 
-/* Other MAP flags are defined in asm-generic/mman-common.h */
+/* Defined in asm-generic/mman-common.h */
+#ifndef TARGET_PROT_SEM
+#define TARGET_PROT_SEM                 0x08
+#endif
+
 #ifndef TARGET_MAP_TYPE
 #define TARGET_MAP_TYPE                 0x0f
 #endif
diff --git a/linux-user/mips/target_mman.h b/linux-user/mips/target_mman.h
index cd566c24b6..e97694aa4e 100644
--- a/linux-user/mips/target_mman.h
+++ b/linux-user/mips/target_mman.h
@@ -1,6 +1,8 @@
 #ifndef MIPS_TARGET_MMAN_H
 #define MIPS_TARGET_MMAN_H
 
+#define TARGET_PROT_SEM                 0x10
+
 #define TARGET_MAP_NORESERVE            0x0400
 #define TARGET_MAP_ANONYMOUS            0x0800
 #define TARGET_MAP_GROWSDOWN            0x1000
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 041105b7a7..77ba343c85 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1227,17 +1227,6 @@ struct target_winsize {
 
 #include "termbits.h"
 
-#if defined(TARGET_MIPS) || defined(TARGET_XTENSA)
-#define TARGET_PROT_SEM         0x10
-#else
-#define TARGET_PROT_SEM         0x08
-#endif
-
-#ifdef TARGET_AARCH64
-#define TARGET_PROT_BTI         0x10
-#define TARGET_PROT_MTE         0x20
-#endif
-
 #include "target_mman.h"
 
 #if (defined(TARGET_I386) && defined(TARGET_ABI32))     \
diff --git a/linux-user/xtensa/target_mman.h b/linux-user/xtensa/target_mman.h
index 3891bb5e07..3933771b5b 100644
--- a/linux-user/xtensa/target_mman.h
+++ b/linux-user/xtensa/target_mman.h
@@ -1,6 +1,8 @@
 #ifndef XTENSA_TARGET_MMAN_H
 #define XTENSA_TARGET_MMAN_H
 
+#define TARGET_PROT_SEM                 0x10
+
 #define TARGET_MAP_NORESERVE            0x0400
 #define TARGET_MAP_ANONYMOUS            0x0800
 #define TARGET_MAP_GROWSDOWN            0x1000

From 4b840f96096d11a69122de4b045a327a6e9a7dfa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:36 +0100
Subject: [PATCH 0798/1353] linux-user: Populate more bits in mmap_flags_tbl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix translation of TARGET_MAP_SHARED and TARGET_MAP_PRIVATE,
which are types not single bits.  Add TARGET_MAP_SHARED_VALIDATE,
TARGET_MAP_SYNC, TARGET_MAP_NONBLOCK, TARGET_MAP_POPULATE,
TARGET_MAP_FIXED_NOREPLACE, and TARGET_MAP_UNINITIALIZED.

Update strace to match.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-9-richard.henderson@linaro.org>
---
 linux-user/strace.c  | 23 ++++++++++-------------
 linux-user/syscall.c | 21 +++++++++++++++++++--
 2 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index 9228b235da..bbd29148d4 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -1094,28 +1094,25 @@ UNUSED static const struct flags mmap_prot_flags[] = {
 };
 
 UNUSED static const struct flags mmap_flags[] = {
-    FLAG_TARGET(MAP_SHARED),
-    FLAG_TARGET(MAP_PRIVATE),
+    FLAG_TARGET_MASK(MAP_SHARED, MAP_TYPE),
+    FLAG_TARGET_MASK(MAP_PRIVATE, MAP_TYPE),
+    FLAG_TARGET_MASK(MAP_SHARED_VALIDATE, MAP_TYPE),
     FLAG_TARGET(MAP_ANONYMOUS),
     FLAG_TARGET(MAP_DENYWRITE),
-    FLAG_TARGET(MAP_FIXED),
-    FLAG_TARGET(MAP_GROWSDOWN),
     FLAG_TARGET(MAP_EXECUTABLE),
-#ifdef MAP_LOCKED
+    FLAG_TARGET(MAP_FIXED),
+    FLAG_TARGET(MAP_FIXED_NOREPLACE),
+    FLAG_TARGET(MAP_GROWSDOWN),
+    FLAG_TARGET(MAP_HUGETLB),
     FLAG_TARGET(MAP_LOCKED),
-#endif
-#ifdef MAP_NONBLOCK
     FLAG_TARGET(MAP_NONBLOCK),
-#endif
     FLAG_TARGET(MAP_NORESERVE),
-#ifdef MAP_POPULATE
     FLAG_TARGET(MAP_POPULATE),
-#endif
-#if defined(TARGET_MAP_UNINITIALIZED) && TARGET_MAP_UNINITIALIZED != 0
+    FLAG_TARGET(MAP_STACK),
+    FLAG_TARGET(MAP_SYNC),
+#if TARGET_MAP_UNINITIALIZED != 0
     FLAG_TARGET(MAP_UNINITIALIZED),
 #endif
-    FLAG_TARGET(MAP_HUGETLB),
-    FLAG_TARGET(MAP_STACK),
     FLAG_END,
 };
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 02d3b6c90a..3a89f6b408 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6012,9 +6012,19 @@ static const StructEntry struct_termios_def = {
     .print = print_termios,
 };
 
+/* If the host does not provide these bits, they may be safely discarded. */
+#ifndef MAP_SYNC
+#define MAP_SYNC 0
+#endif
+#ifndef MAP_UNINITIALIZED
+#define MAP_UNINITIALIZED 0
+#endif
+
 static const bitmask_transtbl mmap_flags_tbl[] = {
-    { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
-    { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
+    { TARGET_MAP_TYPE, TARGET_MAP_SHARED, MAP_TYPE, MAP_SHARED },
+    { TARGET_MAP_TYPE, TARGET_MAP_PRIVATE, MAP_TYPE, MAP_PRIVATE },
+    { TARGET_MAP_TYPE, TARGET_MAP_SHARED_VALIDATE,
+      MAP_TYPE, MAP_SHARED_VALIDATE },
     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
       MAP_ANONYMOUS, MAP_ANONYMOUS },
@@ -6032,6 +6042,13 @@ static const bitmask_transtbl mmap_flags_tbl[] = {
        Recognize it for the target insofar as we do not want to pass
        it through to the host.  */
     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
+    { TARGET_MAP_SYNC, TARGET_MAP_SYNC, MAP_SYNC, MAP_SYNC },
+    { TARGET_MAP_NONBLOCK, TARGET_MAP_NONBLOCK, MAP_NONBLOCK, MAP_NONBLOCK },
+    { TARGET_MAP_POPULATE, TARGET_MAP_POPULATE, MAP_POPULATE, MAP_POPULATE },
+    { TARGET_MAP_FIXED_NOREPLACE, TARGET_MAP_FIXED_NOREPLACE,
+      MAP_FIXED_NOREPLACE, MAP_FIXED_NOREPLACE },
+    { TARGET_MAP_UNINITIALIZED, TARGET_MAP_UNINITIALIZED,
+      MAP_UNINITIALIZED, MAP_UNINITIALIZED },
     { 0, 0, 0, 0 }
 };
 

From c2281ddcf38cb851857718acc388f1b9b7564f39 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:37 +0100
Subject: [PATCH 0799/1353] accel/tcg: Introduce page_check_range_empty
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Examine the interval tree to validate that a region
has no existing mappings.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-10-richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c  |  7 +++++++
 include/exec/cpu-all.h | 12 ++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index d95b875a6a..ab684a3ea2 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -598,6 +598,13 @@ int page_check_range(target_ulong start, target_ulong len, int flags)
     return ret;
 }
 
+bool page_check_range_empty(target_ulong start, target_ulong last)
+{
+    assert(last >= start);
+    assert_memory_lock();
+    return pageflags_find(start, last) == NULL;
+}
+
 void page_protect(tb_page_addr_t address)
 {
     PageFlagsNode *p;
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 472fe9ad9c..94f828b109 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -224,6 +224,18 @@ void page_set_flags(target_ulong start, target_ulong last, int flags);
 void page_reset_target_data(target_ulong start, target_ulong last);
 int page_check_range(target_ulong start, target_ulong len, int flags);
 
+/**
+ * page_check_range_empty:
+ * @start: first byte of range
+ * @last: last byte of range
+ * Context: holding mmap lock
+ *
+ * Return true if the entire range [@start, @last] is unmapped.
+ * The memory lock must be held so that the caller will can ensure
+ * the result stays true until a new mapping can be installed.
+ */
+bool page_check_range_empty(target_ulong start, target_ulong last);
+
 /**
  * page_get_target_data(address)
  * @address: guest virtual address

From 9c255cb53e44d5db57b3388fd6dfab96d4883790 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:38 +0100
Subject: [PATCH 0800/1353] bsd-user: Use page_check_range_empty for MAP_EXCL

The previous check returned -1 when any page within
[start, start+len) is unmapped, not when all are unmapped.

Cc: Warner Losh <imp@bsdimp.com>
Cc: Kyle Evans <kevans@freebsd.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Message-Id: <20230707204054.8792-11-richard.henderson@linaro.org>
---
 bsd-user/mmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index 565b9f97ed..07b5b8055e 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -609,7 +609,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
         }
 
         /* Reject the mapping if any page within the range is mapped */
-        if ((flags & MAP_EXCL) && page_check_range(start, len, 0) < 0) {
+        if ((flags & MAP_EXCL) && !page_check_range_empty(start, end - 1)) {
             errno = EINVAL;
             goto fail;
         }

From 037986053b063866b029733d9508635d31b3f987 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:39 +0100
Subject: [PATCH 0801/1353] linux-user: Implement MAP_FIXED_NOREPLACE

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-12-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 639921dba0..9dc34fc29d 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -509,7 +509,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
      * If the user is asking for the kernel to find a location, do that
      * before we truncate the length for mapping files below.
      */
-    if (!(flags & MAP_FIXED)) {
+    if (!(flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) {
         host_len = len + offset - host_offset;
         host_len = HOST_PAGE_ALIGN(host_len);
         start = mmap_find_vma(real_start, host_len, TARGET_PAGE_SIZE);
@@ -551,7 +551,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         }
     }
 
-    if (!(flags & MAP_FIXED)) {
+    if (!(flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) {
         unsigned long host_start;
         void *p;
 
@@ -600,6 +600,13 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             goto fail;
         }
 
+        /* Validate that the chosen range is empty. */
+        if ((flags & MAP_FIXED_NOREPLACE)
+            && !page_check_range_empty(start, end - 1)) {
+            errno = EEXIST;
+            goto fail;
+        }
+
         /*
          * worst case: we cannot map the file because the offset is not
          * aligned, so we read it
@@ -615,7 +622,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
                 goto fail;
             }
             retaddr = target_mmap(start, len, target_prot | PROT_WRITE,
-                                  MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
+                                  (flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))
+                                  | MAP_PRIVATE | MAP_ANONYMOUS,
                                   -1, 0);
             if (retaddr == -1) {
                 goto fail;

From 0dd558121c41dd4578517a90668c24e7fcdd46ba Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:40 +0100
Subject: [PATCH 0802/1353] linux-user: Split out target_to_host_prot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split out from validate_prot_to_pageflags, as there is not
one single host_prot for the entire range.  We need to adjust
prot for every host page that overlaps multiple guest pages.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-13-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 78 ++++++++++++++++++++++++++---------------------
 1 file changed, 44 insertions(+), 34 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 9dc34fc29d..12b1308a83 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -69,24 +69,11 @@ void mmap_fork_end(int child)
  * Return 0 if the target prot bitmask is invalid, otherwise
  * the internal qemu page_flags (which will include PAGE_VALID).
  */
-static int validate_prot_to_pageflags(int *host_prot, int prot)
+static int validate_prot_to_pageflags(int prot)
 {
     int valid = PROT_READ | PROT_WRITE | PROT_EXEC | TARGET_PROT_SEM;
     int page_flags = (prot & PAGE_BITS) | PAGE_VALID;
 
-    /*
-     * For the host, we need not pass anything except read/write/exec.
-     * While PROT_SEM is allowed by all hosts, it is also ignored, so
-     * don't bother transforming guest bit to host bit.  Any other
-     * target-specific prot bits will not be understood by the host
-     * and will need to be encoded into page_flags for qemu emulation.
-     *
-     * Pages that are executable by the guest will never be executed
-     * by the host, but the host will need to be able to read them.
-     */
-    *host_prot = (prot & (PROT_READ | PROT_WRITE))
-               | (prot & PROT_EXEC ? PROT_READ : 0);
-
 #ifdef TARGET_AARCH64
     {
         ARMCPU *cpu = ARM_CPU(thread_cpu);
@@ -114,18 +101,34 @@ static int validate_prot_to_pageflags(int *host_prot, int prot)
     return prot & ~valid ? 0 : page_flags;
 }
 
+/*
+ * For the host, we need not pass anything except read/write/exec.
+ * While PROT_SEM is allowed by all hosts, it is also ignored, so
+ * don't bother transforming guest bit to host bit.  Any other
+ * target-specific prot bits will not be understood by the host
+ * and will need to be encoded into page_flags for qemu emulation.
+ *
+ * Pages that are executable by the guest will never be executed
+ * by the host, but the host will need to be able to read them.
+ */
+static int target_to_host_prot(int prot)
+{
+    return (prot & (PROT_READ | PROT_WRITE)) |
+           (prot & PROT_EXEC ? PROT_READ : 0);
+}
+
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
 int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
 {
     abi_ulong end, host_start, host_end, addr;
-    int prot1, ret, page_flags, host_prot;
+    int prot1, ret, page_flags;
 
     trace_target_mprotect(start, len, target_prot);
 
     if ((start & ~TARGET_PAGE_MASK) != 0) {
         return -TARGET_EINVAL;
     }
-    page_flags = validate_prot_to_pageflags(&host_prot, target_prot);
+    page_flags = validate_prot_to_pageflags(target_prot);
     if (!page_flags) {
         return -TARGET_EINVAL;
     }
@@ -143,7 +146,7 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
     host_end = HOST_PAGE_ALIGN(end);
     if (start > host_start) {
         /* handle host page containing start */
-        prot1 = host_prot;
+        prot1 = target_prot;
         for (addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) {
             prot1 |= page_get_flags(addr);
         }
@@ -154,19 +157,19 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
             end = host_end;
         }
         ret = mprotect(g2h_untagged(host_start), qemu_host_page_size,
-                       prot1 & PAGE_BITS);
+                       target_to_host_prot(prot1));
         if (ret != 0) {
             goto error;
         }
         host_start += qemu_host_page_size;
     }
     if (end < host_end) {
-        prot1 = host_prot;
+        prot1 = target_prot;
         for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
             prot1 |= page_get_flags(addr);
         }
         ret = mprotect(g2h_untagged(host_end - qemu_host_page_size),
-                       qemu_host_page_size, prot1 & PAGE_BITS);
+                       qemu_host_page_size, target_to_host_prot(prot1));
         if (ret != 0) {
             goto error;
         }
@@ -175,8 +178,8 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
 
     /* handle the pages in the middle */
     if (host_start < host_end) {
-        ret = mprotect(g2h_untagged(host_start),
-                       host_end - host_start, host_prot);
+        ret = mprotect(g2h_untagged(host_start), host_end - host_start,
+                       target_to_host_prot(target_prot));
         if (ret != 0) {
             goto error;
         }
@@ -212,7 +215,8 @@ static int mmap_frag(abi_ulong real_start,
 
     if (prot1 == 0) {
         /* no page was there, so we allocate one */
-        void *p = mmap(host_start, qemu_host_page_size, prot,
+        void *p = mmap(host_start, qemu_host_page_size,
+                       target_to_host_prot(prot),
                        flags | MAP_ANONYMOUS, -1, 0);
         if (p == MAP_FAILED) {
             return -1;
@@ -233,7 +237,8 @@ static int mmap_frag(abi_ulong real_start,
 
         /* adjust protection to be able to read */
         if (!(prot1 & PROT_WRITE)) {
-            mprotect(host_start, qemu_host_page_size, prot1 | PROT_WRITE);
+            mprotect(host_start, qemu_host_page_size,
+                     target_to_host_prot(prot1) | PROT_WRITE);
         }
 
         /* read the corresponding file data */
@@ -243,11 +248,13 @@ static int mmap_frag(abi_ulong real_start,
 
         /* put final protection */
         if (prot_new != (prot1 | PROT_WRITE)) {
-            mprotect(host_start, qemu_host_page_size, prot_new);
+            mprotect(host_start, qemu_host_page_size,
+                     target_to_host_prot(prot_new));
         }
     } else {
         if (prot_new != prot1) {
-            mprotect(host_start, qemu_host_page_size, prot_new);
+            mprotect(host_start, qemu_host_page_size,
+                     target_to_host_prot(prot_new));
         }
         if (prot_new & PROT_WRITE) {
             memset(g2h_untagged(start), 0, end - start);
@@ -460,7 +467,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
 {
     abi_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len,
               passthrough_start = -1, passthrough_end = -1;
-    int page_flags, host_prot;
+    int page_flags;
 
     mmap_lock();
     trace_target_mmap(start, len, target_prot, flags, fd, offset);
@@ -470,7 +477,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         goto fail;
     }
 
-    page_flags = validate_prot_to_pageflags(&host_prot, target_prot);
+    page_flags = validate_prot_to_pageflags(target_prot);
     if (!page_flags) {
         errno = EINVAL;
         goto fail;
@@ -553,10 +560,12 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
 
     if (!(flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) {
         unsigned long host_start;
+        int host_prot;
         void *p;
 
         host_len = len + offset - host_offset;
         host_len = HOST_PAGE_ALIGN(host_len);
+        host_prot = target_to_host_prot(target_prot);
 
         /*
          * Note: we prefer to control the mapping address. It is
@@ -617,7 +626,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
              * msync() won't work here, so we return an error if write is
              * possible while it is a shared mapping
              */
-            if ((flags & MAP_TYPE) == MAP_SHARED && (host_prot & PROT_WRITE)) {
+            if ((flags & MAP_TYPE) == MAP_SHARED
+                && (target_prot & PROT_WRITE)) {
                 errno = EINVAL;
                 goto fail;
             }
@@ -631,7 +641,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             if (pread(fd, g2h_untagged(start), len, offset) == -1) {
                 goto fail;
             }
-            if (!(host_prot & PROT_WRITE)) {
+            if (!(target_prot & PROT_WRITE)) {
                 ret = target_mprotect(start, len, target_prot);
                 assert(ret == 0);
             }
@@ -643,14 +653,14 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             if (real_end == real_start + qemu_host_page_size) {
                 /* one single host page */
                 ret = mmap_frag(real_start, start, end,
-                                host_prot, flags, fd, offset);
+                                target_prot, flags, fd, offset);
                 if (ret == -1) {
                     goto fail;
                 }
                 goto the_end1;
             }
             ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
-                            host_prot, flags, fd, offset);
+                            target_prot, flags, fd, offset);
             if (ret == -1) {
                 goto fail;
             }
@@ -660,7 +670,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         if (end < real_end) {
             ret = mmap_frag(real_end - qemu_host_page_size,
                             real_end - qemu_host_page_size, end,
-                            host_prot, flags, fd,
+                            target_prot, flags, fd,
                             offset + real_end - qemu_host_page_size - start);
             if (ret == -1) {
                 goto fail;
@@ -678,7 +688,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
                 offset1 = offset + real_start - start;
             }
             p = mmap(g2h_untagged(real_start), real_end - real_start,
-                     host_prot, flags, fd, offset1);
+                     target_to_host_prot(target_prot), flags, fd, offset1);
             if (p == MAP_FAILED) {
                 goto fail;
             }

From 55baec0f4c535e24a060070592b8c51d75108481 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:41 +0100
Subject: [PATCH 0803/1353] linux-user: Widen target_mmap offset argument to
 off_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We build with _FILE_OFFSET_BITS=64, so off_t = off64_t = uint64_t.
With an extra cast, this fixes emulation of mmap2, which could
overflow the computation of the full value of offset.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-14-richard.henderson@linaro.org>
---
 linux-user/mmap.c      | 14 ++++++++------
 linux-user/syscall.c   |  2 +-
 linux-user/user-mmap.h |  2 +-
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 12b1308a83..b2c2d85857 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -196,7 +196,7 @@ error:
 /* map an incomplete host page */
 static int mmap_frag(abi_ulong real_start,
                      abi_ulong start, abi_ulong end,
-                     int prot, int flags, int fd, abi_ulong offset)
+                     int prot, int flags, int fd, off_t offset)
 {
     abi_ulong real_end, addr;
     void *host_start;
@@ -463,11 +463,12 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
 
 /* NOTE: all the constants are the HOST ones */
 abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
-                     int flags, int fd, abi_ulong offset)
+                     int flags, int fd, off_t offset)
 {
-    abi_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len,
+    abi_ulong ret, end, real_start, real_end, retaddr, host_len,
               passthrough_start = -1, passthrough_end = -1;
     int page_flags;
+    off_t host_offset;
 
     mmap_lock();
     trace_target_mmap(start, len, target_prot, flags, fd, offset);
@@ -559,7 +560,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
     }
 
     if (!(flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) {
-        unsigned long host_start;
+        uintptr_t host_start;
         int host_prot;
         void *p;
 
@@ -578,7 +579,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             goto fail;
         }
         /* update start so that it points to the file position at 'offset' */
-        host_start = (unsigned long)p;
+        host_start = (uintptr_t)p;
         if (!(flags & MAP_ANONYMOUS)) {
             p = mmap(g2h_untagged(start), len, host_prot,
                      flags | MAP_FIXED, fd, host_offset);
@@ -681,7 +682,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         /* map the middle (easier) */
         if (real_start < real_end) {
             void *p;
-            unsigned long offset1;
+            off_t offset1;
+
             if (flags & MAP_ANONYMOUS) {
                 offset1 = 0;
             } else {
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 3a89f6b408..a80d33ecf2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -10591,7 +10591,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 #endif
         ret = target_mmap(arg1, arg2, arg3,
                           target_to_host_bitmask(arg4, mmap_flags_tbl),
-                          arg5, arg6 << MMAP_SHIFT);
+                          arg5, (off_t)(abi_ulong)arg6 << MMAP_SHIFT);
         return get_errno(ret);
 #endif
     case TARGET_NR_munmap:
diff --git a/linux-user/user-mmap.h b/linux-user/user-mmap.h
index 480ce1c114..3fc986f92f 100644
--- a/linux-user/user-mmap.h
+++ b/linux-user/user-mmap.h
@@ -20,7 +20,7 @@
 
 int target_mprotect(abi_ulong start, abi_ulong len, int prot);
 abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
-                     int flags, int fd, abi_ulong offset);
+                     int flags, int fd, off_t offset);
 int target_munmap(abi_ulong start, abi_ulong len);
 abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                        abi_ulong new_size, unsigned long flags,

From 7bdc1acc249ba9cfe1659145d58a96ebc4dbf6e4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:42 +0100
Subject: [PATCH 0804/1353] linux-user: Rewrite target_mprotect

Use 'last' variables instead of 'end' variables.
When host page size > guest page size, detect when
adjacent host pages have the same protection and
merge that expanded host range into fewer syscalls.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-15-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 106 +++++++++++++++++++++++++++++-----------------
 1 file changed, 67 insertions(+), 39 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index b2c2d85857..d02d74d279 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -120,8 +120,11 @@ static int target_to_host_prot(int prot)
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
 int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
 {
-    abi_ulong end, host_start, host_end, addr;
-    int prot1, ret, page_flags;
+    abi_ulong starts[3];
+    abi_ulong lens[3];
+    int prots[3];
+    abi_ulong host_start, host_last, last;
+    int prot1, ret, page_flags, nranges;
 
     trace_target_mprotect(start, len, target_prot);
 
@@ -132,63 +135,88 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
     if (!page_flags) {
         return -TARGET_EINVAL;
     }
-    len = TARGET_PAGE_ALIGN(len);
-    end = start + len;
-    if (!guest_range_valid_untagged(start, len)) {
-        return -TARGET_ENOMEM;
-    }
     if (len == 0) {
         return 0;
     }
+    len = TARGET_PAGE_ALIGN(len);
+    if (!guest_range_valid_untagged(start, len)) {
+        return -TARGET_ENOMEM;
+    }
+
+    last = start + len - 1;
+    host_start = start & qemu_host_page_mask;
+    host_last = HOST_PAGE_ALIGN(last) - 1;
+    nranges = 0;
 
     mmap_lock();
-    host_start = start & qemu_host_page_mask;
-    host_end = HOST_PAGE_ALIGN(end);
-    if (start > host_start) {
-        /* handle host page containing start */
+
+    if (host_last - host_start < qemu_host_page_size) {
+        /* Single host page contains all guest pages: sum the prot. */
         prot1 = target_prot;
-        for (addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) {
-            prot1 |= page_get_flags(addr);
+        for (abi_ulong a = host_start; a < start; a += TARGET_PAGE_SIZE) {
+            prot1 |= page_get_flags(a);
         }
-        if (host_end == host_start + qemu_host_page_size) {
-            for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
-                prot1 |= page_get_flags(addr);
+        for (abi_ulong a = last; a < host_last; a += TARGET_PAGE_SIZE) {
+            prot1 |= page_get_flags(a + 1);
+        }
+        starts[nranges] = host_start;
+        lens[nranges] = qemu_host_page_size;
+        prots[nranges] = prot1;
+        nranges++;
+    } else {
+        if (host_start < start) {
+            /* Host page contains more than one guest page: sum the prot. */
+            prot1 = target_prot;
+            for (abi_ulong a = host_start; a < start; a += TARGET_PAGE_SIZE) {
+                prot1 |= page_get_flags(a);
+            }
+            /* If the resulting sum differs, create a new range. */
+            if (prot1 != target_prot) {
+                starts[nranges] = host_start;
+                lens[nranges] = qemu_host_page_size;
+                prots[nranges] = prot1;
+                nranges++;
+                host_start += qemu_host_page_size;
             }
-            end = host_end;
         }
-        ret = mprotect(g2h_untagged(host_start), qemu_host_page_size,
-                       target_to_host_prot(prot1));
-        if (ret != 0) {
-            goto error;
+
+        if (last < host_last) {
+            /* Host page contains more than one guest page: sum the prot. */
+            prot1 = target_prot;
+            for (abi_ulong a = last; a < host_last; a += TARGET_PAGE_SIZE) {
+                prot1 |= page_get_flags(a + 1);
+            }
+            /* If the resulting sum differs, create a new range. */
+            if (prot1 != target_prot) {
+                host_last -= qemu_host_page_size;
+                starts[nranges] = host_last + 1;
+                lens[nranges] = qemu_host_page_size;
+                prots[nranges] = prot1;
+                nranges++;
+            }
         }
-        host_start += qemu_host_page_size;
-    }
-    if (end < host_end) {
-        prot1 = target_prot;
-        for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
-            prot1 |= page_get_flags(addr);
+
+        /* Create a range for the middle, if any remains. */
+        if (host_start < host_last) {
+            starts[nranges] = host_start;
+            lens[nranges] = host_last - host_start + 1;
+            prots[nranges] = target_prot;
+            nranges++;
         }
-        ret = mprotect(g2h_untagged(host_end - qemu_host_page_size),
-                       qemu_host_page_size, target_to_host_prot(prot1));
-        if (ret != 0) {
-            goto error;
-        }
-        host_end -= qemu_host_page_size;
     }
 
-    /* handle the pages in the middle */
-    if (host_start < host_end) {
-        ret = mprotect(g2h_untagged(host_start), host_end - host_start,
-                       target_to_host_prot(target_prot));
+    for (int i = 0; i < nranges; ++i) {
+        ret = mprotect(g2h_untagged(starts[i]), lens[i],
+                       target_to_host_prot(prots[i]));
         if (ret != 0) {
             goto error;
         }
     }
 
-    page_set_flags(start, start + len - 1, page_flags);
+    page_set_flags(start, last, page_flags);
     ret = 0;
 
-error:
+ error:
     mmap_unlock();
     return ret;
 }

From 99982beb4d0030470aa761b8b7bc6dc66c39a707 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:43 +0100
Subject: [PATCH 0805/1353] linux-user: Rewrite mmap_frag

Use 'last' variables instead of 'end' variables.
Always zero MAP_ANONYMOUS fragments, which we previously
failed to do if they were not writable; early exit in case
we allocate a new page from the kernel, known zeros.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-16-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 123 +++++++++++++++++++++++-----------------------
 1 file changed, 62 insertions(+), 61 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index d02d74d279..c4b2515271 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -222,73 +222,76 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
 }
 
 /* map an incomplete host page */
-static int mmap_frag(abi_ulong real_start,
-                     abi_ulong start, abi_ulong end,
-                     int prot, int flags, int fd, off_t offset)
+static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last,
+                      int prot, int flags, int fd, off_t offset)
 {
-    abi_ulong real_end, addr;
+    abi_ulong real_last;
     void *host_start;
-    int prot1, prot_new;
+    int prot_old, prot_new;
+    int host_prot_old, host_prot_new;
 
-    real_end = real_start + qemu_host_page_size;
-    host_start = g2h_untagged(real_start);
-
-    /* get the protection of the target pages outside the mapping */
-    prot1 = 0;
-    for (addr = real_start; addr < real_end; addr++) {
-        if (addr < start || addr >= end) {
-            prot1 |= page_get_flags(addr);
-        }
+    if (!(flags & MAP_ANONYMOUS)
+        && (flags & MAP_TYPE) == MAP_SHARED
+        && (prot & PROT_WRITE)) {
+        /*
+         * msync() won't work with the partial page, so we return an
+         * error if write is possible while it is a shared mapping.
+         */
+        errno = EINVAL;
+        return false;
     }
 
-    if (prot1 == 0) {
-        /* no page was there, so we allocate one */
+    real_last = real_start + qemu_host_page_size - 1;
+    host_start = g2h_untagged(real_start);
+
+    /* Get the protection of the target pages outside the mapping. */
+    prot_old = 0;
+    for (abi_ulong a = real_start; a < start; a += TARGET_PAGE_SIZE) {
+        prot_old |= page_get_flags(a);
+    }
+    for (abi_ulong a = real_last; a > last; a -= TARGET_PAGE_SIZE) {
+        prot_old |= page_get_flags(a);
+    }
+
+    if (prot_old == 0) {
+        /*
+         * Since !(prot_old & PAGE_VALID), there were no guest pages
+         * outside of the fragment we need to map.  Allocate a new host
+         * page to cover, discarding whatever else may have been present.
+         */
         void *p = mmap(host_start, qemu_host_page_size,
                        target_to_host_prot(prot),
                        flags | MAP_ANONYMOUS, -1, 0);
         if (p == MAP_FAILED) {
-            return -1;
+            return false;
         }
-        prot1 = prot;
+        prot_old = prot;
     }
-    prot1 &= PAGE_BITS;
+    prot_new = prot | prot_old;
 
-    prot_new = prot | prot1;
-    if (!(flags & MAP_ANONYMOUS)) {
-        /*
-         * msync() won't work here, so we return an error if write is
-         * possible while it is a shared mapping.
-         */
-        if ((flags & MAP_TYPE) == MAP_SHARED && (prot & PROT_WRITE)) {
-            return -1;
-        }
+    host_prot_old = target_to_host_prot(prot_old);
+    host_prot_new = target_to_host_prot(prot_new);
 
-        /* adjust protection to be able to read */
-        if (!(prot1 & PROT_WRITE)) {
-            mprotect(host_start, qemu_host_page_size,
-                     target_to_host_prot(prot1) | PROT_WRITE);
-        }
+    /* Adjust protection to be able to write. */
+    if (!(host_prot_old & PROT_WRITE)) {
+        host_prot_old |= PROT_WRITE;
+        mprotect(host_start, qemu_host_page_size, host_prot_old);
+    }
 
-        /* read the corresponding file data */
-        if (pread(fd, g2h_untagged(start), end - start, offset) == -1) {
-            return -1;
-        }
-
-        /* put final protection */
-        if (prot_new != (prot1 | PROT_WRITE)) {
-            mprotect(host_start, qemu_host_page_size,
-                     target_to_host_prot(prot_new));
-        }
+    /* Read or zero the new guest pages. */
+    if (flags & MAP_ANONYMOUS) {
+        memset(g2h_untagged(start), 0, last - start + 1);
     } else {
-        if (prot_new != prot1) {
-            mprotect(host_start, qemu_host_page_size,
-                     target_to_host_prot(prot_new));
-        }
-        if (prot_new & PROT_WRITE) {
-            memset(g2h_untagged(start), 0, end - start);
+        if (pread(fd, g2h_untagged(start), last - start + 1, offset) == -1) {
+            return false;
         }
     }
-    return 0;
+
+    /* Put final protection */
+    if (host_prot_new != host_prot_old) {
+        mprotect(host_start, qemu_host_page_size, host_prot_new);
+    }
+    return true;
 }
 
 #if HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
@@ -681,27 +684,25 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         if (start > real_start) {
             if (real_end == real_start + qemu_host_page_size) {
                 /* one single host page */
-                ret = mmap_frag(real_start, start, end,
-                                target_prot, flags, fd, offset);
-                if (ret == -1) {
+                if (!mmap_frag(real_start, start, end - 1,
+                               target_prot, flags, fd, offset)) {
                     goto fail;
                 }
                 goto the_end1;
             }
-            ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
-                            target_prot, flags, fd, offset);
-            if (ret == -1) {
+            if (!mmap_frag(real_start, start,
+                           real_start + qemu_host_page_size - 1,
+                           target_prot, flags, fd, offset)) {
                 goto fail;
             }
             real_start += qemu_host_page_size;
         }
         /* handle the end of the mapping */
         if (end < real_end) {
-            ret = mmap_frag(real_end - qemu_host_page_size,
-                            real_end - qemu_host_page_size, end,
-                            target_prot, flags, fd,
-                            offset + real_end - qemu_host_page_size - start);
-            if (ret == -1) {
+            if (!mmap_frag(real_end - qemu_host_page_size,
+                           real_end - qemu_host_page_size, end - 1,
+                           target_prot, flags, fd,
+                           offset + real_end - qemu_host_page_size - start)) {
                 goto fail;
             }
             real_end -= qemu_host_page_size;

From f2bb7cf29991121e427883f26f9737a409f56ee7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:44 +0100
Subject: [PATCH 0806/1353] accel/tcg: Introduce page_find_range_empty

Use the interval tree to locate an unused range in the VM.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-17-richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c  | 41 +++++++++++++++++++++++++++++++++++++++++
 include/exec/cpu-all.h | 15 +++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index ab684a3ea2..e4f9563730 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -605,6 +605,47 @@ bool page_check_range_empty(target_ulong start, target_ulong last)
     return pageflags_find(start, last) == NULL;
 }
 
+target_ulong page_find_range_empty(target_ulong min, target_ulong max,
+                                   target_ulong len, target_ulong align)
+{
+    target_ulong len_m1, align_m1;
+
+    assert(min <= max);
+    assert(max <= GUEST_ADDR_MAX);
+    assert(len != 0);
+    assert(is_power_of_2(align));
+    assert_memory_lock();
+
+    len_m1 = len - 1;
+    align_m1 = align - 1;
+
+    /* Iteratively narrow the search region. */
+    while (1) {
+        PageFlagsNode *p;
+
+        /* Align min and double-check there's enough space remaining. */
+        min = (min + align_m1) & ~align_m1;
+        if (min > max) {
+            return -1;
+        }
+        if (len_m1 > max - min) {
+            return -1;
+        }
+
+        p = pageflags_find(min, min + len_m1);
+        if (p == NULL) {
+            /* Found! */
+            return min;
+        }
+        if (max <= p->itree.last) {
+            /* Existing allocation fills the remainder of the search region. */
+            return -1;
+        }
+        /* Skip across existing allocation. */
+        min = p->itree.last + 1;
+    }
+}
+
 void page_protect(tb_page_addr_t address)
 {
     PageFlagsNode *p;
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 94f828b109..eb1c54701a 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -236,6 +236,21 @@ int page_check_range(target_ulong start, target_ulong len, int flags);
  */
 bool page_check_range_empty(target_ulong start, target_ulong last);
 
+/**
+ * page_find_range_empty
+ * @min: first byte of search range
+ * @max: last byte of search range
+ * @len: size of the hole required
+ * @align: alignment of the hole required (power of 2)
+ *
+ * If there is a range [x, x+@len) within [@min, @max] such that
+ * x % @align == 0, then return x.  Otherwise return -1.
+ * The memory lock must be held, as the caller will want to ensure
+ * the returned range stays empty until a new mapping can be installed.
+ */
+target_ulong page_find_range_empty(target_ulong min, target_ulong max,
+                                   target_ulong len, target_ulong align);
+
 /**
  * page_get_target_data(address)
  * @address: guest virtual address

From f12294b5bd214232eb0b4be87fed35519f006182 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:45 +0100
Subject: [PATCH 0807/1353] bsd-user: Use page_find_range_empty for
 mmap_find_vma_reserved

Use the interval tree to find empty space, rather than
probing each page in turn.

Cc: Warner Losh <imp@bsdimp.com>
Cc: Kyle Evans <kevans@freebsd.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-bt: Warner Losh <imp@bsdimp.com>
Message-Id: <20230707204054.8792-18-richard.henderson@linaro.org>
---
 bsd-user/mmap.c | 48 +++++++-----------------------------------------
 1 file changed, 7 insertions(+), 41 deletions(-)

diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index 07b5b8055e..aca8764356 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -222,50 +222,16 @@ unsigned long last_brk;
 static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
                                         abi_ulong alignment)
 {
-    abi_ulong addr;
-    abi_ulong end_addr;
-    int prot;
-    int looped = 0;
+    abi_ulong ret;
 
-    if (size > reserved_va) {
-        return (abi_ulong)-1;
+    ret = page_find_range_empty(start, reserved_va, size, alignment);
+    if (ret == -1 && start > TARGET_PAGE_SIZE) {
+        /* Restart at the beginning of the address space. */
+        ret = page_find_range_empty(TARGET_PAGE_SIZE, start - 1,
+                                    size, alignment);
     }
 
-    size = HOST_PAGE_ALIGN(size) + alignment;
-    end_addr = start + size;
-    if (end_addr > reserved_va) {
-        end_addr = reserved_va + 1;
-    }
-    addr = end_addr - qemu_host_page_size;
-
-    while (1) {
-        if (addr > end_addr) {
-            if (looped) {
-                return (abi_ulong)-1;
-            }
-            end_addr = reserved_va + 1;
-            addr = end_addr - qemu_host_page_size;
-            looped = 1;
-            continue;
-        }
-        prot = page_get_flags(addr);
-        if (prot) {
-            end_addr = addr;
-        }
-        if (end_addr - addr >= size) {
-            break;
-        }
-        addr -= qemu_host_page_size;
-    }
-
-    if (start == mmap_next_start) {
-        mmap_next_start = addr;
-    }
-    /* addr is sufficiently low to align it up */
-    if (alignment != 0) {
-        addr = (addr + alignment) & ~(alignment - 1);
-    }
-    return addr;
+    return ret;
 }
 
 /*

From 4c13048e02d93985320e4a9651dc29577ba53f0e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:46 +0100
Subject: [PATCH 0808/1353] linux-user: Use page_find_range_empty for
 mmap_find_vma_reserved

Use the interval tree to find empty space, rather than
probing each page in turn.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-19-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 52 ++++++-----------------------------------------
 1 file changed, 6 insertions(+), 46 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index c4b2515271..738b9b797d 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -318,55 +318,15 @@ unsigned long last_brk;
 static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
                                         abi_ulong align)
 {
-    abi_ulong addr, end_addr, incr = qemu_host_page_size;
-    int prot;
-    bool looped = false;
+    target_ulong ret;
 
-    if (size > reserved_va) {
-        return (abi_ulong)-1;
+    ret = page_find_range_empty(start, reserved_va, size, align);
+    if (ret == -1 && start > mmap_min_addr) {
+        /* Restart at the beginning of the address space. */
+        ret = page_find_range_empty(mmap_min_addr, start - 1, size, align);
     }
 
-    /* Note that start and size have already been aligned by mmap_find_vma. */
-
-    end_addr = start + size;
-    /*
-     * Start at the top of the address space, ignoring the last page.
-     * If reserved_va == UINT32_MAX, then end_addr wraps to 0,
-     * throwing the rest of the calculations off.
-     * TODO: rewrite using last_addr instead.
-     * TODO: use the interval tree instead of probing every page.
-     */
-    if (start > reserved_va - size) {
-        end_addr = ((reserved_va - size) & -align) + size;
-        looped = true;
-    }
-
-    /* Search downward from END_ADDR, checking to see if a page is in use.  */
-    addr = end_addr;
-    while (1) {
-        addr -= incr;
-        if (addr > end_addr) {
-            if (looped) {
-                /* Failure.  The entire address space has been searched.  */
-                return (abi_ulong)-1;
-            }
-            /* Re-start at the top of the address space (see above). */
-            addr = end_addr = ((reserved_va - size) & -align) + size;
-            looped = true;
-        } else {
-            prot = page_get_flags(addr);
-            if (prot) {
-                /* Page in use.  Restart below this page.  */
-                addr = end_addr = ((addr - size) & -align) + size;
-            } else if (addr && addr + size == end_addr) {
-                /* Success!  All pages between ADDR and END_ADDR are free.  */
-                if (start == mmap_next_start) {
-                    mmap_next_start = addr;
-                }
-                return addr;
-            }
-        }
-    }
+    return ret;
 }
 
 /*

From f9cd8f5eca2bb81761b846ca3162d7c9ea263385 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:47 +0100
Subject: [PATCH 0809/1353] linux-user: Use 'last' instead of 'end' in
 target_mmap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Complete the transition within the mmap functions to a formulation
that does not overflow at the end of the address space.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230707204054.8792-20-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 738b9b797d..bb9cbe52cd 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -456,8 +456,8 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
 abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
                      int flags, int fd, off_t offset)
 {
-    abi_ulong ret, end, real_start, real_end, retaddr, host_len,
-              passthrough_start = -1, passthrough_end = -1;
+    abi_ulong ret, last, real_start, real_last, retaddr, host_len;
+    abi_ulong passthrough_start = -1, passthrough_last = 0;
     int page_flags;
     off_t host_offset;
 
@@ -581,29 +581,30 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             host_start += offset - host_offset;
         }
         start = h2g(host_start);
+        last = start + len - 1;
         passthrough_start = start;
-        passthrough_end = start + len;
+        passthrough_last = last;
     } else {
         if (start & ~TARGET_PAGE_MASK) {
             errno = EINVAL;
             goto fail;
         }
-        end = start + len;
-        real_end = HOST_PAGE_ALIGN(end);
+        last = start + len - 1;
+        real_last = HOST_PAGE_ALIGN(last) - 1;
 
         /*
          * Test if requested memory area fits target address space
          * It can fail only on 64-bit host with 32-bit target.
          * On any other target/host host mmap() handles this error correctly.
          */
-        if (end < start || !guest_range_valid_untagged(start, len)) {
+        if (last < start || !guest_range_valid_untagged(start, len)) {
             errno = ENOMEM;
             goto fail;
         }
 
         /* Validate that the chosen range is empty. */
         if ((flags & MAP_FIXED_NOREPLACE)
-            && !page_check_range_empty(start, end - 1)) {
+            && !page_check_range_empty(start, last)) {
             errno = EEXIST;
             goto fail;
         }
@@ -642,9 +643,9 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
 
         /* handle the start of the mapping */
         if (start > real_start) {
-            if (real_end == real_start + qemu_host_page_size) {
+            if (real_last == real_start + qemu_host_page_size - 1) {
                 /* one single host page */
-                if (!mmap_frag(real_start, start, end - 1,
+                if (!mmap_frag(real_start, start, last,
                                target_prot, flags, fd, offset)) {
                     goto fail;
                 }
@@ -658,18 +659,18 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             real_start += qemu_host_page_size;
         }
         /* handle the end of the mapping */
-        if (end < real_end) {
-            if (!mmap_frag(real_end - qemu_host_page_size,
-                           real_end - qemu_host_page_size, end - 1,
+        if (last < real_last) {
+            abi_ulong real_page = real_last - qemu_host_page_size + 1;
+            if (!mmap_frag(real_page, real_page, last,
                            target_prot, flags, fd,
-                           offset + real_end - qemu_host_page_size - start)) {
+                           offset + real_page - start)) {
                 goto fail;
             }
-            real_end -= qemu_host_page_size;
+            real_last -= qemu_host_page_size;
         }
 
         /* map the middle (easier) */
-        if (real_start < real_end) {
+        if (real_start < real_last) {
             void *p;
             off_t offset1;
 
@@ -678,13 +679,13 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             } else {
                 offset1 = offset + real_start - start;
             }
-            p = mmap(g2h_untagged(real_start), real_end - real_start,
+            p = mmap(g2h_untagged(real_start), real_last - real_start + 1,
                      target_to_host_prot(target_prot), flags, fd, offset1);
             if (p == MAP_FAILED) {
                 goto fail;
             }
             passthrough_start = real_start;
-            passthrough_end = real_end;
+            passthrough_last = real_last;
         }
     }
  the_end1:
@@ -692,16 +693,16 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
         page_flags |= PAGE_ANON;
     }
     page_flags |= PAGE_RESET;
-    if (passthrough_start == passthrough_end) {
-        page_set_flags(start, start + len - 1, page_flags);
+    if (passthrough_start > passthrough_last) {
+        page_set_flags(start, last, page_flags);
     } else {
         if (start < passthrough_start) {
             page_set_flags(start, passthrough_start - 1, page_flags);
         }
-        page_set_flags(passthrough_start, passthrough_end - 1,
+        page_set_flags(passthrough_start, passthrough_last,
                        page_flags | PAGE_PASSTHROUGH);
-        if (passthrough_end < start + len) {
-            page_set_flags(passthrough_end, start + len - 1, page_flags);
+        if (passthrough_last < last) {
+            page_set_flags(passthrough_last + 1, last, page_flags);
         }
     }
  the_end:

From 260561d873106c2fd15565b1835c354a725ed678 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:48 +0100
Subject: [PATCH 0810/1353] linux-user: Rewrite mmap_reserve

Use 'last' variables instead of 'end' variables; be careful
about avoiding overflow.  Assert that the mmap succeeded.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-21-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 68 +++++++++++++++++++++++++++++------------------
 1 file changed, 42 insertions(+), 26 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index bb9cbe52cd..6308787942 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -722,47 +722,63 @@ fail:
     return -1;
 }
 
-static void mmap_reserve(abi_ulong start, abi_ulong size)
+static void mmap_reserve(abi_ulong start, abi_ulong len)
 {
     abi_ulong real_start;
-    abi_ulong real_end;
-    abi_ulong addr;
-    abi_ulong end;
+    abi_ulong real_last;
+    abi_ulong real_len;
+    abi_ulong last;
+    abi_ulong a;
+    void *host_start, *ptr;
     int prot;
 
+    last = start + len - 1;
     real_start = start & qemu_host_page_mask;
-    real_end = HOST_PAGE_ALIGN(start + size);
-    end = start + size;
-    if (start > real_start) {
-        /* handle host page containing start */
+    real_last = HOST_PAGE_ALIGN(last) - 1;
+
+    /*
+     * If guest pages remain on the first or last host pages,
+     * adjust the deallocation to retain those guest pages.
+     * The single page special case is required for the last page,
+     * lest real_start overflow to zero.
+     */
+    if (real_last - real_start < qemu_host_page_size) {
         prot = 0;
-        for (addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
-            prot |= page_get_flags(addr);
+        for (a = real_start; a < start; a += TARGET_PAGE_SIZE) {
+            prot |= page_get_flags(a);
         }
-        if (real_end == real_start + qemu_host_page_size) {
-            for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
-                prot |= page_get_flags(addr);
-            }
-            end = real_end;
+        for (a = last; a < real_last; a += TARGET_PAGE_SIZE) {
+            prot |= page_get_flags(a + 1);
+        }
+        if (prot != 0) {
+            return;
+        }
+    } else {
+        for (prot = 0, a = real_start; a < start; a += TARGET_PAGE_SIZE) {
+            prot |= page_get_flags(a);
         }
         if (prot != 0) {
             real_start += qemu_host_page_size;
         }
-    }
-    if (end < real_end) {
-        prot = 0;
-        for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
-            prot |= page_get_flags(addr);
+
+        for (prot = 0, a = last; a < real_last; a += TARGET_PAGE_SIZE) {
+            prot |= page_get_flags(a + 1);
         }
         if (prot != 0) {
-            real_end -= qemu_host_page_size;
+            real_last -= qemu_host_page_size;
+        }
+
+        if (real_last < real_start) {
+            return;
         }
     }
-    if (real_start != real_end) {
-        mmap(g2h_untagged(real_start), real_end - real_start, PROT_NONE,
-                 MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE,
-                 -1, 0);
-    }
+
+    real_len = real_last - real_start + 1;
+    host_start = g2h_untagged(real_start);
+
+    ptr = mmap(host_start, real_len, PROT_NONE,
+               MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
+    assert(ptr == host_start);
 }
 
 int target_munmap(abi_ulong start, abi_ulong len)

From 558a4411c25d43d3f35bc18d84c31ca336ac16c6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:49 +0100
Subject: [PATCH 0811/1353] linux-user: Rename mmap_reserve to
 mmap_reserve_or_unmap

If !reserved_va, munmap instead and assert success.
Update all callers.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-22-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 6308787942..22c2869be8 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -722,14 +722,14 @@ fail:
     return -1;
 }
 
-static void mmap_reserve(abi_ulong start, abi_ulong len)
+static void mmap_reserve_or_unmap(abi_ulong start, abi_ulong len)
 {
     abi_ulong real_start;
     abi_ulong real_last;
     abi_ulong real_len;
     abi_ulong last;
     abi_ulong a;
-    void *host_start, *ptr;
+    void *host_start;
     int prot;
 
     last = start + len - 1;
@@ -776,9 +776,15 @@ static void mmap_reserve(abi_ulong start, abi_ulong len)
     real_len = real_last - real_start + 1;
     host_start = g2h_untagged(real_start);
 
-    ptr = mmap(host_start, real_len, PROT_NONE,
-               MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
-    assert(ptr == host_start);
+    if (reserved_va) {
+        void *ptr = mmap(host_start, real_len, PROT_NONE,
+                         MAP_FIXED | MAP_ANONYMOUS
+                         | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
+        assert(ptr == host_start);
+    } else {
+        int ret = munmap(host_start, real_len);
+        assert(ret == 0);
+    }
 }
 
 int target_munmap(abi_ulong start, abi_ulong len)
@@ -830,11 +836,7 @@ int target_munmap(abi_ulong start, abi_ulong len)
     ret = 0;
     /* unmap what we can */
     if (real_start < real_end) {
-        if (reserved_va) {
-            mmap_reserve(real_start, real_end - real_start);
-        } else {
-            ret = munmap(g2h_untagged(real_start), real_end - real_start);
-        }
+        mmap_reserve_or_unmap(real_start, real_end - real_start);
     }
 
     if (ret == 0) {
@@ -871,7 +873,7 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
              * If new and old addresses overlap then the above mremap will
              * already have failed with EINVAL.
              */
-            mmap_reserve(old_addr, old_size);
+            mmap_reserve_or_unmap(old_addr, old_size);
         }
     } else if (flags & MREMAP_MAYMOVE) {
         abi_ulong mmap_start;
@@ -886,7 +888,7 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                                flags | MREMAP_FIXED,
                                g2h_untagged(mmap_start));
             if (reserved_va) {
-                mmap_reserve(old_addr, old_size);
+                mmap_reserve_or_unmap(old_addr, old_size);
             }
         }
     } else {
@@ -912,7 +914,8 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                     errno = ENOMEM;
                     host_addr = MAP_FAILED;
                 } else if (reserved_va && old_size > new_size) {
-                    mmap_reserve(old_addr + old_size, old_size - new_size);
+                    mmap_reserve_or_unmap(old_addr + old_size,
+                                          old_size - new_size);
                 }
             }
         } else {

From d7b0c5d01374468c36bbe95140b8db8df95a99e3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:50 +0100
Subject: [PATCH 0812/1353] linux-user: Simplify target_munmap

All of the guest to host page adjustment is handled by
mmap_reserve_or_unmap; there is no need to duplicate that.
There are no failure modes for munmap after alignment and
guest address range have been validated.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-23-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 47 ++++-------------------------------------------
 1 file changed, 4 insertions(+), 43 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 22c2869be8..c0946322fb 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -789,9 +789,6 @@ static void mmap_reserve_or_unmap(abi_ulong start, abi_ulong len)
 
 int target_munmap(abi_ulong start, abi_ulong len)
 {
-    abi_ulong end, real_start, real_end, addr;
-    int prot, ret;
-
     trace_target_munmap(start, len);
 
     if (start & ~TARGET_PAGE_MASK) {
@@ -803,47 +800,11 @@ int target_munmap(abi_ulong start, abi_ulong len)
     }
 
     mmap_lock();
-    end = start + len;
-    real_start = start & qemu_host_page_mask;
-    real_end = HOST_PAGE_ALIGN(end);
-
-    if (start > real_start) {
-        /* handle host page containing start */
-        prot = 0;
-        for (addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
-            prot |= page_get_flags(addr);
-        }
-        if (real_end == real_start + qemu_host_page_size) {
-            for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
-                prot |= page_get_flags(addr);
-            }
-            end = real_end;
-        }
-        if (prot != 0) {
-            real_start += qemu_host_page_size;
-        }
-    }
-    if (end < real_end) {
-        prot = 0;
-        for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
-            prot |= page_get_flags(addr);
-        }
-        if (prot != 0) {
-            real_end -= qemu_host_page_size;
-        }
-    }
-
-    ret = 0;
-    /* unmap what we can */
-    if (real_start < real_end) {
-        mmap_reserve_or_unmap(real_start, real_end - real_start);
-    }
-
-    if (ret == 0) {
-        page_set_flags(start, start + len - 1, 0);
-    }
+    mmap_reserve_or_unmap(start, len);
+    page_set_flags(start, start + len - 1, 0);
     mmap_unlock();
-    return ret;
+
+    return 0;
 }
 
 abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,

From 91e9e116fea2a3b957e86daf55c832155fdf4b04 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:51 +0100
Subject: [PATCH 0813/1353] accel/tcg: Accept more page flags in
 page_check_range
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only PAGE_WRITE needs special attention, all others can be
handled as we do for PAGE_READ.  Adjust the mask.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230707204054.8792-24-richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index e4f9563730..1e8fcaf6b0 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -561,8 +561,8 @@ int page_check_range(target_ulong start, target_ulong len, int flags)
         }
 
         missing = flags & ~p->flags;
-        if (missing & PAGE_READ) {
-            ret = -1; /* page not readable */
+        if (missing & ~PAGE_WRITE) {
+            ret = -1; /* page doesn't match */
             break;
         }
         if (missing & PAGE_WRITE) {

From bef6f008b9811d961fd311c102f1a22dc28278a1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:52 +0100
Subject: [PATCH 0814/1353] accel/tcg: Return bool from page_check_range

Replace the 0/-1 result with true/false.
Invert the sense of the test of all callers.
Document the function.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-25-richard.henderson@linaro.org>
---
 accel/tcg/ldst_atomicity.c.inc |  4 ++--
 accel/tcg/user-exec.c          | 22 +++++++++++-----------
 bsd-user/qemu.h                |  2 +-
 include/exec/cpu-all.h         | 13 ++++++++++++-
 linux-user/qemu.h              |  2 +-
 linux-user/syscall.c           |  2 +-
 target/hppa/op_helper.c        |  2 +-
 target/riscv/vector_helper.c   |  2 +-
 target/sparc/ldst_helper.c     |  2 +-
 9 files changed, 31 insertions(+), 20 deletions(-)

diff --git a/accel/tcg/ldst_atomicity.c.inc b/accel/tcg/ldst_atomicity.c.inc
index de70531a7a..4de0a80492 100644
--- a/accel/tcg/ldst_atomicity.c.inc
+++ b/accel/tcg/ldst_atomicity.c.inc
@@ -159,7 +159,7 @@ static uint64_t load_atomic8_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
      * another process, because the fallback start_exclusive solution
      * provides no protection across processes.
      */
-    if (!page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
+    if (page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
         uint64_t *p = __builtin_assume_aligned(pv, 8);
         return *p;
     }
@@ -194,7 +194,7 @@ static Int128 load_atomic16_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
      * another process, because the fallback start_exclusive solution
      * provides no protection across processes.
      */
-    if (!page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
+    if (page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
         return *p;
     }
 #endif
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 1e8fcaf6b0..df60c7d673 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -520,19 +520,19 @@ void page_set_flags(target_ulong start, target_ulong last, int flags)
     }
 }
 
-int page_check_range(target_ulong start, target_ulong len, int flags)
+bool page_check_range(target_ulong start, target_ulong len, int flags)
 {
     target_ulong last;
     int locked;  /* tri-state: =0: unlocked, +1: global, -1: local */
-    int ret;
+    bool ret;
 
     if (len == 0) {
-        return 0;  /* trivial length */
+        return true;  /* trivial length */
     }
 
     last = start + len - 1;
     if (last < start) {
-        return -1; /* wrap around */
+        return false; /* wrap around */
     }
 
     locked = have_mmap_lock();
@@ -551,33 +551,33 @@ int page_check_range(target_ulong start, target_ulong len, int flags)
                 p = pageflags_find(start, last);
             }
             if (!p) {
-                ret = -1; /* entire region invalid */
+                ret = false; /* entire region invalid */
                 break;
             }
         }
         if (start < p->itree.start) {
-            ret = -1; /* initial bytes invalid */
+            ret = false; /* initial bytes invalid */
             break;
         }
 
         missing = flags & ~p->flags;
         if (missing & ~PAGE_WRITE) {
-            ret = -1; /* page doesn't match */
+            ret = false; /* page doesn't match */
             break;
         }
         if (missing & PAGE_WRITE) {
             if (!(p->flags & PAGE_WRITE_ORG)) {
-                ret = -1; /* page not writable */
+                ret = false; /* page not writable */
                 break;
             }
             /* Asking about writable, but has been protected: undo. */
             if (!page_unprotect(start, 0)) {
-                ret = -1;
+                ret = false;
                 break;
             }
             /* TODO: page_unprotect should take a range, not a single page. */
             if (last - start < TARGET_PAGE_SIZE) {
-                ret = 0; /* ok */
+                ret = true; /* ok */
                 break;
             }
             start += TARGET_PAGE_SIZE;
@@ -585,7 +585,7 @@ int page_check_range(target_ulong start, target_ulong len, int flags)
         }
 
         if (last <= p->itree.last) {
-            ret = 0; /* ok */
+            ret = true; /* ok */
             break;
         }
         start = p->itree.last + 1;
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 41d84e0b81..edf9602f9b 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -267,7 +267,7 @@ abi_long do_freebsd_sysarch(void *cpu_env, abi_long arg1, abi_long arg2);
 
 static inline bool access_ok(int type, abi_ulong addr, abi_ulong size)
 {
-    return page_check_range((target_ulong)addr, size, type) == 0;
+    return page_check_range((target_ulong)addr, size, type);
 }
 
 /*
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index eb1c54701a..94f44f1f59 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -222,7 +222,18 @@ int walk_memory_regions(void *, walk_memory_regions_fn);
 int page_get_flags(target_ulong address);
 void page_set_flags(target_ulong start, target_ulong last, int flags);
 void page_reset_target_data(target_ulong start, target_ulong last);
-int page_check_range(target_ulong start, target_ulong len, int flags);
+
+/**
+ * page_check_range
+ * @start: first byte of range
+ * @len: length of range
+ * @flags: flags required for each page
+ *
+ * Return true if every page in [@start, @start+@len) has @flags set.
+ * Return false if any page is unmapped.  Thus testing flags == 0 is
+ * equivalent to testing for flags == PAGE_VALID.
+ */
+bool page_check_range(target_ulong start, target_ulong last, int flags);
 
 /**
  * page_check_range_empty:
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 9b8e0860d7..802794db63 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -182,7 +182,7 @@ static inline bool access_ok_untagged(int type, abi_ulong addr, abi_ulong size)
         : !guest_range_valid_untagged(addr, size)) {
         return false;
     }
-    return page_check_range((target_ulong)addr, size, type) == 0;
+    return page_check_range((target_ulong)addr, size, type);
 }
 
 static inline bool access_ok(CPUState *cpu, int type,
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a80d33ecf2..33bc242e6a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8122,7 +8122,7 @@ static int open_self_maps_1(CPUArchState *cpu_env, int fd, bool smaps)
             max = h2g_valid(max - 1) ?
                 max : (uintptr_t) g2h_untagged(GUEST_ADDR_MAX) + 1;
 
-            if (page_check_range(h2g(min), max - min, flags) == -1) {
+            if (!page_check_range(h2g(min), max - min, flags)) {
                 continue;
             }
 
diff --git a/target/hppa/op_helper.c b/target/hppa/op_helper.c
index 32c27c66b2..f25a5a72aa 100644
--- a/target/hppa/op_helper.c
+++ b/target/hppa/op_helper.c
@@ -168,7 +168,7 @@ target_ureg HELPER(probe)(CPUHPPAState *env, target_ulong addr,
                           uint32_t level, uint32_t want)
 {
 #ifdef CONFIG_USER_ONLY
-    return (page_check_range(addr, 1, want) == 0) ? 1 : 0;
+    return page_check_range(addr, 1, want);
 #else
     int prot, excp;
     hwaddr phys;
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 71bb9b4457..cfacf2ebba 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -583,7 +583,7 @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, offset, PAGE_READ) < 0) {
+                    if (page_check_range(addr, offset, PAGE_READ)) {
                         vl = i;
                         goto ProbeSuccess;
                     }
diff --git a/target/sparc/ldst_helper.c b/target/sparc/ldst_helper.c
index 981a47d8bb..78b03308ae 100644
--- a/target/sparc/ldst_helper.c
+++ b/target/sparc/ldst_helper.c
@@ -1191,7 +1191,7 @@ uint64_t helper_ld_asi(CPUSPARCState *env, target_ulong addr,
     case ASI_PNFL: /* Primary no-fault LE */
     case ASI_SNF:  /* Secondary no-fault */
     case ASI_SNFL: /* Secondary no-fault LE */
-        if (page_check_range(addr, size, PAGE_READ) == -1) {
+        if (!page_check_range(addr, size, PAGE_READ)) {
             ret = 0;
             break;
         }

From ecb796db038ad43707d344ce5da55b7f39c3e59f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:53 +0100
Subject: [PATCH 0815/1353] linux-user: Remove can_passthrough_madvise

Use page_check_range instead, which uses the interval tree
instead of checking each page individually.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-26-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index c0946322fb..49cfa873e0 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -898,23 +898,6 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
     return new_addr;
 }
 
-static bool can_passthrough_madvise(abi_ulong start, abi_ulong end)
-{
-    ulong addr;
-
-    if ((start | end) & ~qemu_host_page_mask) {
-        return false;
-    }
-
-    for (addr = start; addr < end; addr += TARGET_PAGE_SIZE) {
-        if (!(page_get_flags(addr) & PAGE_PASSTHROUGH)) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
 abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
 {
     abi_ulong len, end;
@@ -964,9 +947,8 @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
      *
      * A straight passthrough for those may not be safe because qemu sometimes
      * turns private file-backed mappings into anonymous mappings.
-     * can_passthrough_madvise() helps to check if a passthrough is possible by
-     * comparing mappings that are known to have the same semantics in the host
-     * and the guest. In this case passthrough is safe.
+     * If all guest pages have PAGE_PASSTHROUGH set, mappings have the
+     * same semantics for the host as for the guest.
      *
      * We pass through MADV_WIPEONFORK and MADV_KEEPONFORK if possible and
      * return failure if not.
@@ -984,7 +966,7 @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
         ret = -EINVAL;
         /* fall through */
     case MADV_DONTNEED:
-        if (can_passthrough_madvise(start, end)) {
+        if (page_check_range(start, len, PAGE_PASSTHROUGH)) {
             ret = get_errno(madvise(g2h_untagged(start), len, advice));
             if ((advice == MADV_DONTNEED) && (ret == 0)) {
                 page_reset_target_data(start, start + len - 1);

From e230ec090b61ea7642854197c143010d2c89bb24 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 7 Jul 2023 21:40:54 +0100
Subject: [PATCH 0816/1353] linux-user: Simplify target_madvise

The trivial length 0 check can be moved up, simplifying some
of the other cases.  The end < start test is handled by
guest_range_valid_untagged.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230707204054.8792-27-richard.henderson@linaro.org>
---
 linux-user/mmap.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 49cfa873e0..44b53bd446 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -900,28 +900,17 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
 
 abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
 {
-    abi_ulong len, end;
+    abi_ulong len;
     int ret = 0;
 
     if (start & ~TARGET_PAGE_MASK) {
         return -TARGET_EINVAL;
     }
-    len = TARGET_PAGE_ALIGN(len_in);
-
-    if (len_in && !len) {
-        return -TARGET_EINVAL;
-    }
-
-    end = start + len;
-    if (end < start) {
-        return -TARGET_EINVAL;
-    }
-
-    if (end == start) {
+    if (len_in == 0) {
         return 0;
     }
-
-    if (!guest_range_valid_untagged(start, len)) {
+    len = TARGET_PAGE_ALIGN(len_in);
+    if (len == 0 || !guest_range_valid_untagged(start, len)) {
         return -TARGET_EINVAL;
     }
 

From ac42f443102f601144682de19b69c31889e0ad49 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Sun, 9 Jul 2023 18:34:30 +0100
Subject: [PATCH 0817/1353] linux-user: Drop uint and ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These are types not used anymore anywhere else.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: <20230511085056.13809-1-quintela@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 33bc242e6a..1464151826 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -309,16 +309,16 @@ _syscall0(int, sys_gettid)
 #endif
 
 #if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
-_syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
+_syscall3(int, sys_getdents, unsigned int, fd, struct linux_dirent *, dirp, unsigned int, count);
 #endif
 #if (defined(TARGET_NR_getdents) && \
       !defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
-_syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
+_syscall3(int, sys_getdents64, unsigned int, fd, struct linux_dirent64 *, dirp, unsigned int, count);
 #endif
 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
-_syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
-          loff_t *, res, uint, wh);
+_syscall5(int, _llseek,  unsigned int,  fd, unsigned long, hi, unsigned long, lo,
+          loff_t *, res, unsigned int, wh);
 #endif
 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,

From d713cf4d6c71076513a10528303b3e337b4d5998 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 17:34:08 +0200
Subject: [PATCH 0818/1353] linux-user/arm: Do not allocate a commpage at all
 for M-profile CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit fbd3c4cff6 ("linux-user/arm: Mark the commpage
executable") executing bare-metal (linked with rdimon.specs)
cortex-M code fails as:

  $ qemu-arm -cpu cortex-m3 ~/hello.exe.m3
  qemu-arm: ../../accel/tcg/user-exec.c:492: page_set_flags: Assertion `last <= GUEST_ADDR_MAX' failed.
  Aborted (core dumped)

Commit 4f5c67f8df ("linux-user/arm: Take more care allocating
commpage") already took care of not allocating a commpage for
M-profile CPUs, however it had to be reverted as commit 6cda41daa2.

Re-introduce the M-profile fix from commit 4f5c67f8df.

Fixes: fbd3c4cff6 ("linux-user/arm: Mark the commpage executable")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1755
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230711153408.68389-1-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d3d1352c4e..a26200d9f3 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -424,10 +424,23 @@ enum {
 
 static bool init_guest_commpage(void)
 {
-    abi_ptr commpage = HI_COMMPAGE & -qemu_host_page_size;
-    void *want = g2h_untagged(commpage);
-    void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
-                      MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
+    ARMCPU *cpu = ARM_CPU(thread_cpu);
+    abi_ptr commpage;
+    void *want;
+    void *addr;
+
+    /*
+     * M-profile allocates maximum of 2GB address space, so can never
+     * allocate the commpage.  Skip it.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+        return true;
+    }
+
+    commpage = HI_COMMPAGE & -qemu_host_page_size;
+    want = g2h_untagged(commpage);
+    addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
+                MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
 
     if (addr == MAP_FAILED) {
         perror("Allocating guest commpage");

From deba78709ae8ce103e2248413857747f804cd1ef Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 6 Jul 2023 17:55:48 +0100
Subject: [PATCH 0819/1353] accel/tcg: Always lock pages before translation

We had done this for user-mode by invoking page_protect
within the translator loop.  Extend this to handle system
mode as well.  Move page locking out of tb_link_page.

Reported-by: Liren Wei <lrwei@bupt.edu.cn>
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Richard W.M. Jones <rjones@redhat.com>
---
 accel/tcg/cpu-exec.c      |  20 ++++
 accel/tcg/internal.h      |  30 ++++-
 accel/tcg/tb-maint.c      | 242 ++++++++++++++++++++------------------
 accel/tcg/translate-all.c |  43 ++++++-
 accel/tcg/translator.c    |  34 ++++--
 5 files changed, 236 insertions(+), 133 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 31aa320513..fdd6d3e0e4 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -536,6 +536,26 @@ static void cpu_exec_longjmp_cleanup(CPUState *cpu)
     if (have_mmap_lock()) {
         mmap_unlock();
     }
+#else
+    /*
+     * For softmmu, a tlb_fill fault during translation will land here,
+     * and we need to release any page locks held.  In system mode we
+     * have one tcg_ctx per thread, so we know it was this cpu doing
+     * the translation.
+     *
+     * Alternative 1: Install a cleanup to be called via an exception
+     * handling safe longjmp.  It seems plausible that all our hosts
+     * support such a thing.  We'd have to properly register unwind info
+     * for the JIT for EH, rather that just for GDB.
+     *
+     * Alternative 2: Set and restore cpu->jmp_env in tb_gen_code to
+     * capture the cpu_loop_exit longjmp, perform the cleanup, and
+     * jump again to arrive here.
+     */
+    if (tcg_ctx->gen_tb) {
+        tb_unlock_pages(tcg_ctx->gen_tb);
+        tcg_ctx->gen_tb = NULL;
+    }
 #endif
     if (qemu_mutex_iothread_locked()) {
         qemu_mutex_unlock_iothread();
diff --git a/accel/tcg/internal.h b/accel/tcg/internal.h
index 650c3ac53f..e8cbbde581 100644
--- a/accel/tcg/internal.h
+++ b/accel/tcg/internal.h
@@ -10,6 +10,7 @@
 #define ACCEL_TCG_INTERNAL_H
 
 #include "exec/exec-all.h"
+#include "exec/translate-all.h"
 
 /*
  * Access to the various translations structures need to be serialised
@@ -35,6 +36,32 @@ static inline void page_table_config_init(void) { }
 void page_table_config_init(void);
 #endif
 
+#ifdef CONFIG_USER_ONLY
+/*
+ * For user-only, page_protect sets the page read-only.
+ * Since most execution is already on read-only pages, and we'd need to
+ * account for other TBs on the same page, defer undoing any page protection
+ * until we receive the write fault.
+ */
+static inline void tb_lock_page0(tb_page_addr_t p0)
+{
+    page_protect(p0);
+}
+
+static inline void tb_lock_page1(tb_page_addr_t p0, tb_page_addr_t p1)
+{
+    page_protect(p1);
+}
+
+static inline void tb_unlock_page1(tb_page_addr_t p0, tb_page_addr_t p1) { }
+static inline void tb_unlock_pages(TranslationBlock *tb) { }
+#else
+void tb_lock_page0(tb_page_addr_t);
+void tb_lock_page1(tb_page_addr_t, tb_page_addr_t);
+void tb_unlock_page1(tb_page_addr_t, tb_page_addr_t);
+void tb_unlock_pages(TranslationBlock *);
+#endif
+
 #ifdef CONFIG_SOFTMMU
 void tb_invalidate_phys_range_fast(ram_addr_t ram_addr,
                                    unsigned size,
@@ -48,8 +75,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, vaddr pc,
 void page_init(void);
 void tb_htable_init(void);
 void tb_reset_jump(TranslationBlock *tb, int n);
-TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
-                               tb_page_addr_t phys_page2);
+TranslationBlock *tb_link_page(TranslationBlock *tb);
 bool tb_invalidate_phys_page_unwind(tb_page_addr_t addr, uintptr_t pc);
 void cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
                                uintptr_t host_pc);
diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 9566224d18..c406b2f7b7 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -70,17 +70,7 @@ typedef struct PageDesc PageDesc;
  */
 #define assert_page_locked(pd) tcg_debug_assert(have_mmap_lock())
 
-static inline void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-                                  PageDesc **ret_p2, tb_page_addr_t phys2,
-                                  bool alloc)
-{
-    *ret_p1 = NULL;
-    *ret_p2 = NULL;
-}
-
-static inline void page_unlock(PageDesc *pd) { }
-static inline void page_lock_tb(const TranslationBlock *tb) { }
-static inline void page_unlock_tb(const TranslationBlock *tb) { }
+static inline void tb_lock_pages(const TranslationBlock *tb) { }
 
 /*
  * For user-only, since we are protecting all of memory with a single lock,
@@ -96,7 +86,7 @@ static void tb_remove_all(void)
 }
 
 /* Call with mmap_lock held. */
-static void tb_record(TranslationBlock *tb, PageDesc *p1, PageDesc *p2)
+static void tb_record(TranslationBlock *tb)
 {
     vaddr addr;
     int flags;
@@ -391,12 +381,108 @@ static void page_lock(PageDesc *pd)
     qemu_spin_lock(&pd->lock);
 }
 
+/* Like qemu_spin_trylock, returns false on success */
+static bool page_trylock(PageDesc *pd)
+{
+    bool busy = qemu_spin_trylock(&pd->lock);
+    if (!busy) {
+        page_lock__debug(pd);
+    }
+    return busy;
+}
+
 static void page_unlock(PageDesc *pd)
 {
     qemu_spin_unlock(&pd->lock);
     page_unlock__debug(pd);
 }
 
+void tb_lock_page0(tb_page_addr_t paddr)
+{
+    page_lock(page_find_alloc(paddr >> TARGET_PAGE_BITS, true));
+}
+
+void tb_lock_page1(tb_page_addr_t paddr0, tb_page_addr_t paddr1)
+{
+    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
+    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
+    PageDesc *pd0, *pd1;
+
+    if (pindex0 == pindex1) {
+        /* Identical pages, and the first page is already locked. */
+        return;
+    }
+
+    pd1 = page_find_alloc(pindex1, true);
+    if (pindex0 < pindex1) {
+        /* Correct locking order, we may block. */
+        page_lock(pd1);
+        return;
+    }
+
+    /* Incorrect locking order, we cannot block lest we deadlock. */
+    if (!page_trylock(pd1)) {
+        return;
+    }
+
+    /*
+     * Drop the lock on page0 and get both page locks in the right order.
+     * Restart translation via longjmp.
+     */
+    pd0 = page_find_alloc(pindex0, false);
+    page_unlock(pd0);
+    page_lock(pd1);
+    page_lock(pd0);
+    siglongjmp(tcg_ctx->jmp_trans, -3);
+}
+
+void tb_unlock_page1(tb_page_addr_t paddr0, tb_page_addr_t paddr1)
+{
+    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
+    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
+
+    if (pindex0 != pindex1) {
+        page_unlock(page_find_alloc(pindex1, false));
+    }
+}
+
+static void tb_lock_pages(TranslationBlock *tb)
+{
+    tb_page_addr_t paddr0 = tb_page_addr0(tb);
+    tb_page_addr_t paddr1 = tb_page_addr1(tb);
+    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
+    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
+
+    if (unlikely(paddr0 == -1)) {
+        return;
+    }
+    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
+        if (pindex0 < pindex1) {
+            page_lock(page_find_alloc(pindex0, true));
+            page_lock(page_find_alloc(pindex1, true));
+            return;
+        }
+        page_lock(page_find_alloc(pindex1, true));
+    }
+    page_lock(page_find_alloc(pindex0, true));
+}
+
+void tb_unlock_pages(TranslationBlock *tb)
+{
+    tb_page_addr_t paddr0 = tb_page_addr0(tb);
+    tb_page_addr_t paddr1 = tb_page_addr1(tb);
+    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
+    tb_page_addr_t pindex1 = paddr1 >> TARGET_PAGE_BITS;
+
+    if (unlikely(paddr0 == -1)) {
+        return;
+    }
+    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
+        page_unlock(page_find_alloc(pindex1, false));
+    }
+    page_unlock(page_find_alloc(pindex0, false));
+}
+
 static inline struct page_entry *
 page_entry_new(PageDesc *pd, tb_page_addr_t index)
 {
@@ -420,13 +506,10 @@ static void page_entry_destroy(gpointer p)
 /* returns false on success */
 static bool page_entry_trylock(struct page_entry *pe)
 {
-    bool busy;
-
-    busy = qemu_spin_trylock(&pe->pd->lock);
+    bool busy = page_trylock(pe->pd);
     if (!busy) {
         g_assert(!pe->locked);
         pe->locked = true;
-        page_lock__debug(pe->pd);
     }
     return busy;
 }
@@ -604,8 +687,7 @@ static void tb_remove_all(void)
  * Add the tb in the target page and protect it if necessary.
  * Called with @p->lock held.
  */
-static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
-                               unsigned int n)
+static void tb_page_add(PageDesc *p, TranslationBlock *tb, unsigned int n)
 {
     bool page_already_protected;
 
@@ -625,15 +707,21 @@ static inline void tb_page_add(PageDesc *p, TranslationBlock *tb,
     }
 }
 
-static void tb_record(TranslationBlock *tb, PageDesc *p1, PageDesc *p2)
+static void tb_record(TranslationBlock *tb)
 {
-    tb_page_add(p1, tb, 0);
-    if (unlikely(p2)) {
-        tb_page_add(p2, tb, 1);
+    tb_page_addr_t paddr0 = tb_page_addr0(tb);
+    tb_page_addr_t paddr1 = tb_page_addr1(tb);
+    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
+    tb_page_addr_t pindex1 = paddr0 >> TARGET_PAGE_BITS;
+
+    assert(paddr0 != -1);
+    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
+        tb_page_add(page_find_alloc(pindex1, false), tb, 1);
     }
+    tb_page_add(page_find_alloc(pindex0, false), tb, 0);
 }
 
-static inline void tb_page_remove(PageDesc *pd, TranslationBlock *tb)
+static void tb_page_remove(PageDesc *pd, TranslationBlock *tb)
 {
     TranslationBlock *tb1;
     uintptr_t *pprev;
@@ -653,74 +741,16 @@ static inline void tb_page_remove(PageDesc *pd, TranslationBlock *tb)
 
 static void tb_remove(TranslationBlock *tb)
 {
-    PageDesc *pd;
+    tb_page_addr_t paddr0 = tb_page_addr0(tb);
+    tb_page_addr_t paddr1 = tb_page_addr1(tb);
+    tb_page_addr_t pindex0 = paddr0 >> TARGET_PAGE_BITS;
+    tb_page_addr_t pindex1 = paddr0 >> TARGET_PAGE_BITS;
 
-    pd = page_find(tb->page_addr[0] >> TARGET_PAGE_BITS);
-    tb_page_remove(pd, tb);
-    if (unlikely(tb->page_addr[1] != -1)) {
-        pd = page_find(tb->page_addr[1] >> TARGET_PAGE_BITS);
-        tb_page_remove(pd, tb);
-    }
-}
-
-static void page_lock_pair(PageDesc **ret_p1, tb_page_addr_t phys1,
-                           PageDesc **ret_p2, tb_page_addr_t phys2, bool alloc)
-{
-    PageDesc *p1, *p2;
-    tb_page_addr_t page1;
-    tb_page_addr_t page2;
-
-    assert_memory_lock();
-    g_assert(phys1 != -1);
-
-    page1 = phys1 >> TARGET_PAGE_BITS;
-    page2 = phys2 >> TARGET_PAGE_BITS;
-
-    p1 = page_find_alloc(page1, alloc);
-    if (ret_p1) {
-        *ret_p1 = p1;
-    }
-    if (likely(phys2 == -1)) {
-        page_lock(p1);
-        return;
-    } else if (page1 == page2) {
-        page_lock(p1);
-        if (ret_p2) {
-            *ret_p2 = p1;
-        }
-        return;
-    }
-    p2 = page_find_alloc(page2, alloc);
-    if (ret_p2) {
-        *ret_p2 = p2;
-    }
-    if (page1 < page2) {
-        page_lock(p1);
-        page_lock(p2);
-    } else {
-        page_lock(p2);
-        page_lock(p1);
-    }
-}
-
-/* lock the page(s) of a TB in the correct acquisition order */
-static void page_lock_tb(const TranslationBlock *tb)
-{
-    page_lock_pair(NULL, tb_page_addr0(tb), NULL, tb_page_addr1(tb), false);
-}
-
-static void page_unlock_tb(const TranslationBlock *tb)
-{
-    PageDesc *p1 = page_find(tb_page_addr0(tb) >> TARGET_PAGE_BITS);
-
-    page_unlock(p1);
-    if (unlikely(tb_page_addr1(tb) != -1)) {
-        PageDesc *p2 = page_find(tb_page_addr1(tb) >> TARGET_PAGE_BITS);
-
-        if (p2 != p1) {
-            page_unlock(p2);
-        }
+    assert(paddr0 != -1);
+    if (unlikely(paddr1 != -1) && pindex0 != pindex1) {
+        tb_page_remove(page_find_alloc(pindex1, false), tb);
     }
+    tb_page_remove(page_find_alloc(pindex0, false), tb);
 }
 #endif /* CONFIG_USER_ONLY */
 
@@ -925,18 +955,16 @@ static void tb_phys_invalidate__locked(TranslationBlock *tb)
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
 {
     if (page_addr == -1 && tb_page_addr0(tb) != -1) {
-        page_lock_tb(tb);
+        tb_lock_pages(tb);
         do_tb_phys_invalidate(tb, true);
-        page_unlock_tb(tb);
+        tb_unlock_pages(tb);
     } else {
         do_tb_phys_invalidate(tb, false);
     }
 }
 
 /*
- * Add a new TB and link it to the physical page tables. phys_page2 is
- * (-1) to indicate that only one page contains the TB.
- *
+ * Add a new TB and link it to the physical page tables.
  * Called with mmap_lock held for user-mode emulation.
  *
  * Returns a pointer @tb, or a pointer to an existing TB that matches @tb.
@@ -944,43 +972,29 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
  * for the same block of guest code that @tb corresponds to. In that case,
  * the caller should discard the original @tb, and use instead the returned TB.
  */
-TranslationBlock *tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
-                               tb_page_addr_t phys_page2)
+TranslationBlock *tb_link_page(TranslationBlock *tb)
 {
-    PageDesc *p;
-    PageDesc *p2 = NULL;
     void *existing_tb = NULL;
     uint32_t h;
 
     assert_memory_lock();
     tcg_debug_assert(!(tb->cflags & CF_INVALID));
 
-    /*
-     * Add the TB to the page list, acquiring first the pages's locks.
-     * We keep the locks held until after inserting the TB in the hash table,
-     * so that if the insertion fails we know for sure that the TBs are still
-     * in the page descriptors.
-     * Note that inserting into the hash table first isn't an option, since
-     * we can only insert TBs that are fully initialized.
-     */
-    page_lock_pair(&p, phys_pc, &p2, phys_page2, true);
-    tb_record(tb, p, p2);
+    tb_record(tb);
 
     /* add in the hash table */
-    h = tb_hash_func(phys_pc, (tb->cflags & CF_PCREL ? 0 : tb->pc),
+    h = tb_hash_func(tb_page_addr0(tb), (tb->cflags & CF_PCREL ? 0 : tb->pc),
                      tb->flags, tb->cs_base, tb->cflags);
     qht_insert(&tb_ctx.htable, tb, h, &existing_tb);
 
     /* remove TB from the page(s) if we couldn't insert it */
     if (unlikely(existing_tb)) {
         tb_remove(tb);
-        tb = existing_tb;
+        tb_unlock_pages(tb);
+        return existing_tb;
     }
 
-    if (p2 && p2 != p) {
-        page_unlock(p2);
-    }
-    page_unlock(p);
+    tb_unlock_pages(tb);
     return tb;
 }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index d3d4fbc1a4..4c17474fa2 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -290,7 +290,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
 {
     CPUArchState *env = cpu->env_ptr;
     TranslationBlock *tb, *existing_tb;
-    tb_page_addr_t phys_pc;
+    tb_page_addr_t phys_pc, phys_p2;
     tcg_insn_unit *gen_code_buf;
     int gen_code_size, search_size, max_insns;
     int64_t ti;
@@ -313,6 +313,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     QEMU_BUILD_BUG_ON(CF_COUNT_MASK + 1 != TCG_MAX_INSNS);
 
  buffer_overflow:
+    assert_no_pages_locked();
     tb = tcg_tb_alloc(tcg_ctx);
     if (unlikely(!tb)) {
         /* flush must be done */
@@ -333,6 +334,10 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->cflags = cflags;
     tb_set_page_addr0(tb, phys_pc);
     tb_set_page_addr1(tb, -1);
+    if (phys_pc != -1) {
+        tb_lock_page0(phys_pc);
+    }
+
     tcg_ctx->gen_tb = tb;
     tcg_ctx->addr_type = TARGET_LONG_BITS == 32 ? TCG_TYPE_I32 : TCG_TYPE_I64;
 #ifdef CONFIG_SOFTMMU
@@ -349,8 +354,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tcg_ctx->guest_mo = TCG_MO_ALL;
 #endif
 
- tb_overflow:
-
+ restart_translate:
     trace_translate_block(tb, pc, tb->tc.ptr);
 
     gen_code_size = setjmp_gen_code(env, tb, pc, host_pc, &max_insns, &ti);
@@ -369,6 +373,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
             qemu_log_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT,
                           "Restarting code generation for "
                           "code_gen_buffer overflow\n");
+            tb_unlock_pages(tb);
             goto buffer_overflow;
 
         case -2:
@@ -387,14 +392,39 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
                           "Restarting code generation with "
                           "smaller translation block (max %d insns)\n",
                           max_insns);
-            goto tb_overflow;
+
+            /*
+             * The half-sized TB may not cross pages.
+             * TODO: Fix all targets that cross pages except with
+             * the first insn, at which point this can't be reached.
+             */
+            phys_p2 = tb_page_addr1(tb);
+            if (unlikely(phys_p2 != -1)) {
+                tb_unlock_page1(phys_pc, phys_p2);
+                tb_set_page_addr1(tb, -1);
+            }
+            goto restart_translate;
+
+        case -3:
+            /*
+             * We had a page lock ordering problem.  In order to avoid
+             * deadlock we had to drop the lock on page0, which means
+             * that everything we translated so far is compromised.
+             * Restart with locks held on both pages.
+             */
+            qemu_log_mask(CPU_LOG_TB_OP | CPU_LOG_TB_OP_OPT,
+                          "Restarting code generation with re-locked pages");
+            goto restart_translate;
 
         default:
             g_assert_not_reached();
         }
     }
+    tcg_ctx->gen_tb = NULL;
+
     search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
     if (unlikely(search_size < 0)) {
+        tb_unlock_pages(tb);
         goto buffer_overflow;
     }
     tb->tc.size = gen_code_size;
@@ -504,6 +534,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      * before attempting to link to other TBs or add to the lookup table.
      */
     if (tb_page_addr0(tb) == -1) {
+        assert_no_pages_locked();
         return tb;
     }
 
@@ -518,7 +549,9 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
      * No explicit memory barrier is required -- tb_link_page() makes the
      * TB visible in a consistent state.
      */
-    existing_tb = tb_link_page(tb, tb_page_addr0(tb), tb_page_addr1(tb));
+    existing_tb = tb_link_page(tb);
+    assert_no_pages_locked();
+
     /* if the TB already exists, discard what we just translated */
     if (unlikely(existing_tb != tb)) {
         uintptr_t orig_aligned = (uintptr_t)gen_code_buf;
diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index 0fd9efceba..1a6a5448c8 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -12,9 +12,9 @@
 #include "qemu/error-report.h"
 #include "exec/exec-all.h"
 #include "exec/translator.h"
-#include "exec/translate-all.h"
 #include "exec/plugin-gen.h"
 #include "tcg/tcg-op-common.h"
+#include "internal.h"
 
 static void gen_io_start(void)
 {
@@ -147,10 +147,6 @@ void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,
     db->host_addr[0] = host_pc;
     db->host_addr[1] = NULL;
 
-#ifdef CONFIG_USER_ONLY
-    page_protect(pc);
-#endif
-
     ops->init_disas_context(db, cpu);
     tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
 
@@ -256,22 +252,36 @@ static void *translator_access(CPUArchState *env, DisasContextBase *db,
         host = db->host_addr[1];
         base = TARGET_PAGE_ALIGN(db->pc_first);
         if (host == NULL) {
-            tb_page_addr_t phys_page =
-                get_page_addr_code_hostp(env, base, &db->host_addr[1]);
+            tb_page_addr_t page0, old_page1, new_page1;
+
+            new_page1 = get_page_addr_code_hostp(env, base, &db->host_addr[1]);
 
             /*
              * If the second page is MMIO, treat as if the first page
              * was MMIO as well, so that we do not cache the TB.
              */
-            if (unlikely(phys_page == -1)) {
+            if (unlikely(new_page1 == -1)) {
+                tb_unlock_pages(tb);
                 tb_set_page_addr0(tb, -1);
                 return NULL;
             }
 
-            tb_set_page_addr1(tb, phys_page);
-#ifdef CONFIG_USER_ONLY
-            page_protect(end);
-#endif
+            /*
+             * If this is not the first time around, and page1 matches,
+             * then we already have the page locked.  Alternately, we're
+             * not doing anything to prevent the PTE from changing, so
+             * we might wind up with a different page, requiring us to
+             * re-do the locking.
+             */
+            old_page1 = tb_page_addr1(tb);
+            if (likely(new_page1 != old_page1)) {
+                page0 = tb_page_addr0(tb);
+                if (unlikely(old_page1 != -1)) {
+                    tb_unlock_page1(page0, old_page1);
+                }
+                tb_set_page_addr1(tb, new_page1);
+                tb_lock_page1(page0, new_page1);
+            }
             host = db->host_addr[1];
         }
 

From 76f9d6ad19494290eb2f00d33c6a582ce3447991 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 13 Jul 2023 20:06:15 +0000
Subject: [PATCH 0820/1353] tcg: Use HAVE_CMPXCHG128 instead of
 CONFIG_CMPXCHG128

We adjust CONFIG_ATOMIC128 and CONFIG_CMPXCHG128 with
CONFIG_ATOMIC128_OPT in atomic128.h.  It is difficult
to tell when those changes have been applied with the
ifdef we must use with CONFIG_CMPXCHG128.  So instead
use HAVE_CMPXCHG128, which triggers -Werror-undef when
the proper header has not been included.

Improves tcg_gen_atomic_cmpxchg_i128 for s390x host, which
requires CONFIG_ATOMIC128_OPT.  Without this we fall back
to EXCP_ATOMIC to single-step 128-bit atomics, which is
slow enough to cause some tests to time out.

Reported-by: Thomas Huth <thuth@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/atomic_common.c.inc      | 2 +-
 accel/tcg/cputlb.c                 | 2 +-
 accel/tcg/tcg-runtime.h            | 2 +-
 accel/tcg/user-exec.c              | 2 +-
 include/exec/helper-proto-common.h | 2 ++
 tcg/tcg-op-ldst.c                  | 2 +-
 6 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/atomic_common.c.inc b/accel/tcg/atomic_common.c.inc
index ee222fd7e7..95a5c5ff12 100644
--- a/accel/tcg/atomic_common.c.inc
+++ b/accel/tcg/atomic_common.c.inc
@@ -41,7 +41,7 @@ CMPXCHG_HELPER(cmpxchgq_be, uint64_t)
 CMPXCHG_HELPER(cmpxchgq_le, uint64_t)
 #endif
 
-#ifdef CONFIG_CMPXCHG128
+#if HAVE_CMPXCHG128
 CMPXCHG_HELPER(cmpxchgo_be, Int128)
 CMPXCHG_HELPER(cmpxchgo_le, Int128)
 #endif
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index c2b81ec569..e0079c9a9d 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -3105,7 +3105,7 @@ void cpu_st16_mmu(CPUArchState *env, target_ulong addr, Int128 val,
 #include "atomic_template.h"
 #endif
 
-#if defined(CONFIG_ATOMIC128) || defined(CONFIG_CMPXCHG128)
+#if defined(CONFIG_ATOMIC128) || HAVE_CMPXCHG128
 #define DATA_SIZE 16
 #include "atomic_template.h"
 #endif
diff --git a/accel/tcg/tcg-runtime.h b/accel/tcg/tcg-runtime.h
index 39e68007f9..186899a2c7 100644
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -58,7 +58,7 @@ DEF_HELPER_FLAGS_5(atomic_cmpxchgq_be, TCG_CALL_NO_WG,
 DEF_HELPER_FLAGS_5(atomic_cmpxchgq_le, TCG_CALL_NO_WG,
                    i64, env, i64, i64, i64, i32)
 #endif
-#ifdef CONFIG_CMPXCHG128
+#if HAVE_CMPXCHG128
 DEF_HELPER_FLAGS_5(atomic_cmpxchgo_be, TCG_CALL_NO_WG,
                    i128, env, i64, i128, i128, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgo_le, TCG_CALL_NO_WG,
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index df60c7d673..ac38c2bf96 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -1433,7 +1433,7 @@ static void *atomic_mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
 #include "atomic_template.h"
 #endif
 
-#if defined(CONFIG_ATOMIC128) || defined(CONFIG_CMPXCHG128)
+#if defined(CONFIG_ATOMIC128) || HAVE_CMPXCHG128
 #define DATA_SIZE 16
 #include "atomic_template.h"
 #endif
diff --git a/include/exec/helper-proto-common.h b/include/exec/helper-proto-common.h
index 4d4b022668..8b67170a22 100644
--- a/include/exec/helper-proto-common.h
+++ b/include/exec/helper-proto-common.h
@@ -7,6 +7,8 @@
 #ifndef HELPER_PROTO_COMMON_H
 #define HELPER_PROTO_COMMON_H
 
+#include "qemu/atomic128.h"  /* for HAVE_CMPXCHG128 */
+
 #define HELPER_H "accel/tcg/tcg-runtime.h"
 #include "exec/helper-proto.h.inc"
 #undef  HELPER_H
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 0fcc1618e5..d54c305598 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -778,7 +778,7 @@ typedef void (*gen_atomic_op_i64)(TCGv_i64, TCGv_env, TCGv_i64,
 #else
 # define WITH_ATOMIC64(X)
 #endif
-#ifdef CONFIG_CMPXCHG128
+#if HAVE_CMPXCHG128
 # define WITH_ATOMIC128(X) X,
 #else
 # define WITH_ATOMIC128(X)

From e65ecb665c88a7d61e5d21253c9672dedd72f84b Mon Sep 17 00:00:00 2001
From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
Date: Mon, 17 Jul 2023 11:05:07 +0100
Subject: [PATCH 0821/1353] hw/arm/sbsa-ref: set 'slots' property of xhci

This extends the slots of xhci to 64, since the default xhci_sysbus
just supports one slot.

Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 64e1cbce17..bc89eb4806 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -611,6 +611,7 @@ static void create_xhci(const SBSAMachineState *sms)
     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
     int irq = sbsa_ref_irqmap[SBSA_XHCI];
     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
+    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);

From aab746106c5afcf940bd7a146a099cd485dfe6e5 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 11:05:07 +0100
Subject: [PATCH 0822/1353] linux-user: Remove pointless NULL check in
 clock_adjtime handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
the address of the local variable htx.  This means it can never be
NULL, but later in the code we check it for NULL anyway.  Coverity
complains about this (CID 1507683) because the NULL check comes after
a call to clock_adjtime() that assumes it is non-NULL.

Since phtx is always &htx, and is used only in three places, it's not
really necessary.  Remove it, bringing the code structure in to line
with that for TARGET_NR_clock_adjtime64, which already uses a simple
'&htx' when it wants a pointer to 'htx'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
---
 linux-user/syscall.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 1464151826..c99ef9c01e 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -11190,16 +11190,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
     case TARGET_NR_clock_adjtime:
         {
-            struct timex htx, *phtx = &htx;
+            struct timex htx;
 
-            if (target_to_host_timex(phtx, arg2) != 0) {
+            if (target_to_host_timex(&htx, arg2) != 0) {
                 return -TARGET_EFAULT;
             }
-            ret = get_errno(clock_adjtime(arg1, phtx));
-            if (!is_error(ret) && phtx) {
-                if (host_to_target_timex(arg2, phtx) != 0) {
-                    return -TARGET_EFAULT;
-                }
+            ret = get_errno(clock_adjtime(arg1, &htx));
+            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
+                return -TARGET_EFAULT;
             }
         }
         return ret;

From 34eed551273cb42dbbff4d8fceb7b3576436aff3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 11:05:07 +0100
Subject: [PATCH 0823/1353] target/arm/ptw.c: Add comments to S1Translate
 struct fields

Add comments to the in_* fields in the S1Translate struct
that explain what they're doing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
---
 target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 9aaff1546a..21749375f9 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -19,10 +19,50 @@
 #endif
 
 typedef struct S1Translate {
+    /*
+     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
+     * Together with in_space, specifies the architectural translation regime.
+     */
     ARMMMUIdx in_mmu_idx;
+    /*
+     * in_ptw_idx: specifies which mmuidx to use for the actual
+     * page table descriptor load operations. This will be one of the
+     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     ARMMMUIdx in_ptw_idx;
+    /*
+     * in_space: the security space for this walk. This plus
+     * the in_mmu_idx specify the architectural translation regime.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     *
+     * Note that the security space for the in_ptw_idx may be different
+     * from that for the in_mmu_idx. We do not need to explicitly track
+     * the in_ptw_idx security space because:
+     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
+     *    itself specifies the security space
+     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
+     *    space used for ptw reads is the same as that of the security
+     *    space of the stage 1 translation for all cases except where
+     *    stage 1 is Secure; in that case the only possibilities for
+     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
+     *    value being Stage2 vs Stage2_S distinguishes those.
+     */
     ARMSecuritySpace in_space;
+    /*
+     * in_secure: whether the translation regime is a Secure one.
+     * This is always equal to arm_space_is_secure(in_space).
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     bool in_secure;
+    /*
+     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
+     * accesses will not update the guest page table access flags
+     * and will not change the state of the softmmu TLBs.
+     */
     bool in_debug;
     /*
      * If this is stage 2 of a stage 1+2 page table walk, then this must

From 3f74da440ddad65dee5a22d63b2048a5ee16a5e2 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 11:05:08 +0100
Subject: [PATCH 0824/1353] target/arm: Fix S1_ptw_translate() debug path

In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
so that the debug-access "call get_phys_addr_*" codepath is used both
when S1 is doing ptw reads from stage 2 and when it is doing ptw
reads from physical memory.  However, we didn't update the
calculation of s2ptw->in_space and s2ptw->in_secure to account for
the "ptw reads from physical memory" case.  This meant that debug
accesses when in Secure state broke.

Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.

Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 21749375f9..c0b9cee584 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -485,11 +485,39 @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
     }
 }
 
+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
+                                          ARMMMUIdx s2_mmu_idx)
+{
+    /*
+     * Return the security space to use for stage 2 when doing
+     * the S1 page table descriptor load.
+     */
+    if (regime_is_stage2(s2_mmu_idx)) {
+        /*
+         * The security space for ptw reads is almost always the same
+         * as that of the security space of the stage 1 translation.
+         * The only exception is when stage 1 is Secure; in that case
+         * the ptw read might be to the Secure or the NonSecure space
+         * (but never Realm or Root), and the s2_mmu_idx tells us which.
+         * Root translations are always single-stage.
+         */
+        if (s1_space == ARMSS_Secure) {
+            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
+        } else {
+            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
+            assert(s1_space != ARMSS_Root);
+            return s1_space;
+        }
+    } else {
+        /* ptw loads are from phys: the mmu idx itself says which space */
+        return arm_phys_to_space(s2_mmu_idx);
+    }
+}
+
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
-    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -502,13 +530,12 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
+        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                         : space == ARMSS_Realm ? ARMSS_Realm
-                         : ARMSS_NonSecure),
+            .in_secure = arm_space_is_secure(s2_space),
+            .in_space = s2_space,
             .in_debug = true,
         };
         GetPhysAddrResult s2 = { };

From eeb9578c36e78af6ee661f491e3f8744b1e0b6fb Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 11:05:08 +0100
Subject: [PATCH 0825/1353] target/arm/ptw.c: Account for FEAT_RME when
 applying {N}SW, SA bits

In get_phys_addr_twostage() the code that applies the effects of
VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
Now we also have f.attrs.space for FEAT_RME, we need to keep the two
in sync.

These bits only have an effect for Secure space translations, not
for Root, so use the input in_space field to determine whether to
apply them rather than the input is_secure. This doesn't actually
make a difference because Root translations are never two-stage,
but it's a little clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
---
 target/arm/ptw.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index c0b9cee584..8f94100c61 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3118,6 +3118,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     hwaddr ipa;
     int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
+    ARMSecuritySpace in_space = ptw->in_space;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
@@ -3200,11 +3201,13 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Check if IPA translates to secure or non-secure PA space.
      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
      */
-    result->f.attrs.secure =
-        (is_secure
-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-         && (ipa_secure
-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
+    if (in_space == ARMSS_Secure) {
+        result->f.attrs.secure =
+            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+            && (ipa_secure
+                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
+        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
+    }
 
     return false;
 }

From e60a7d0d4d89c8bca8a74a877e31abce50e848e3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 11:05:08 +0100
Subject: [PATCH 0826/1353] accel/tcg: Zero-pad PC in TCG CPU exec trace lines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit f0a08b0913befbd we changed the type of the PC from
target_ulong to vaddr.  In doing so we inadvertently dropped the
zero-padding on the PC in trace lines (the second item inside the []
in these lines).  They used to look like this on AArch64, for
instance:

Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]

and now they look like this:
Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]

and if the PC happens to be somewhere low like 0x5000
then the field is shown as /5000/.

This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
with no width specifier.

Restore the zero-padding by adding an 016 width specifier to
this tracing and a couple of others that were similarly recently
changed to use VADDR_PRIx without a width specifier.

We can't unfortunately restore the "32-bit guests are padded to
8 hex digits and 64-bit guests to 16 hex digits" behaviour so
easily.

Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
---
 accel/tcg/cpu-exec.c      | 4 ++--
 accel/tcg/translate-all.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index fdd6d3e0e4..e2c494e75e 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -298,7 +298,7 @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
     if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [%08" PRIx64
-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
+                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
                       tb->flags, tb->cflags, lookup_symbol(pc));
 
@@ -487,7 +487,7 @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
             vaddr pc = log_pc(cpu, last_tb);
             if (qemu_log_in_addr_range(pc)) {
-                qemu_log("Stopped execution of TB chain before %p [%"
+                qemu_log("Stopped execution of TB chain before %p [%016"
                          VADDR_PRIx "] %s\n",
                          last_tb->tc.ptr, pc, lookup_symbol(pc));
             }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 4c17474fa2..a1782db5dd 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -637,7 +637,7 @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         vaddr pc = log_pc(cpu, tb);
         if (qemu_log_in_addr_range(pc)) {
-            qemu_log("cpu_io_recompile: rewound execution of TB to %"
+            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                      VADDR_PRIx "\n", pc);
         }
     }

From c2c1c4a35c7c2b1a4140b0942b9797c857e476a4 Mon Sep 17 00:00:00 2001
From: Tong Ho <tong.ho@amd.com>
Date: Wed, 26 Apr 2023 14:16:07 -0700
Subject: [PATCH 0827/1353] hw/nvram: Avoid unnecessary Xilinx eFuse backstore
 write
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a check in the bit-set operation to write the backstore
only if the affected bit is 0 before.

With this in place, there will be no need for callers to
do the checking in order to avoid unnecessary writes.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-efuse.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
index fdfffaab99..655c40b8d1 100644
--- a/hw/nvram/xlnx-efuse.c
+++ b/hw/nvram/xlnx-efuse.c
@@ -143,6 +143,8 @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
 
 bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
 {
+    uint32_t set, *row;
+
     if (efuse_ro_bits_find(s, bit)) {
         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 
@@ -152,8 +154,13 @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
         return false;
     }
 
-    s->fuse32[bit / 32] |= 1 << (bit % 32);
-    efuse_bdrv_sync(s, bit);
+    /* Avoid back-end write unless there is a real update */
+    row = &s->fuse32[bit / 32];
+    set = 1 << (bit % 32);
+    if (!(set & *row)) {
+        *row |= set;
+        efuse_bdrv_sync(s, bit);
+    }
     return true;
 }
 

From 9c18a9234bab9d5e903f897b30fb4a37888aebfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 4 Jul 2023 11:16:42 +0200
Subject: [PATCH 0828/1353] virtio-gpu: fix potential divide-by-zero regression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 9462ff4695aa0 ("virtio-gpu/win32: allocate shareable 2d
resources/images") introduces a division, which can lead to crashes when
"height" is 0.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1744
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index befa7d6d78..e937c4e348 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -303,10 +303,11 @@ static void virtio_gpu_resource_create_2d(VirtIOGPU *g,
             goto end;
         }
 #endif
-        res->image = pixman_image_create_bits(pformat,
-                                              c2d.width,
-                                              c2d.height,
-                                              bits, res->hostmem / c2d.height);
+        res->image = pixman_image_create_bits(
+            pformat,
+            c2d.width,
+            c2d.height,
+            bits, c2d.height ? res->hostmem / c2d.height : 0);
 #ifdef WIN32
         if (res->image) {
             pixman_image_set_destroy_function(res->image, win32_pixman_image_destroy, res->handle);
@@ -1272,9 +1273,10 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
             return -EINVAL;
         }
 #endif
-        res->image = pixman_image_create_bits(pformat,
-                                              res->width, res->height,
-                                              bits, res->hostmem / res->height);
+        res->image = pixman_image_create_bits(
+            pformat,
+            res->width, res->height,
+            bits, res->height ? res->hostmem / res->height : 0);
         if (!res->image) {
             g_free(res);
             return -EINVAL;

From d921fea338c1059a27ce7b75309d7a2e485f710b Mon Sep 17 00:00:00 2001
From: Mauro Matteo Cascella <mcascell@redhat.com>
Date: Tue, 4 Jul 2023 10:41:22 +0200
Subject: [PATCH 0829/1353] ui/vnc-clipboard: fix infinite loop in
 inflate_buffer (CVE-2023-3255)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A wrong exit condition may lead to an infinite loop when inflating a
valid zlib buffer containing some extra bytes in the `inflate_buffer`
function. The bug only occurs post-authentication. Return the buffer
immediately if the end of the compressed data has been reached
(Z_STREAM_END).

Fixes: CVE-2023-3255
Fixes: 0bf41cab ("ui/vnc: clipboard support")
Reported-by: Kevin Denis <kevin.denis@synacktiv.com>
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230704084210.101822-1-mcascell@redhat.com>
---
 ui/vnc-clipboard.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c
index 8aeadfaa21..c759be3438 100644
--- a/ui/vnc-clipboard.c
+++ b/ui/vnc-clipboard.c
@@ -50,8 +50,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size)
         ret = inflate(&stream, Z_FINISH);
         switch (ret) {
         case Z_OK:
-        case Z_STREAM_END:
             break;
+        case Z_STREAM_END:
+            *size = stream.total_out;
+            inflateEnd(&stream);
+            return out;
         case Z_BUF_ERROR:
             out_len <<= 1;
             if (out_len > (1 << 20)) {
@@ -66,11 +69,6 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size)
         }
     }
 
-    *size = stream.total_out;
-    inflateEnd(&stream);
-
-    return out;
-
 err_end:
     inflateEnd(&stream);
 err:

From 83b4b236ed54dab35f1b821ee2b6f3101c45c8cc Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Wed, 28 Jun 2023 12:15:04 -0700
Subject: [PATCH 0830/1353] ui/gtk: Make sure the right EGL context is
 currently bound
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Observed a wrong context is bound when changing the scanout mode.
To prevent problem, it is needed to make sure to bind the right
context in gtk_egl_set_scanout_mode/gtk_gl_area_set_scanout_mode
as well as unbind one in the end of gd_egl_update/gd_gl_area_update.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230628191504.17185-1-dongwon.kim@intel.com>
---
 ui/gtk-egl.c     | 4 ++++
 ui/gtk-gl-area.c | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index d59b8cd7d7..42db1bb6cf 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -32,6 +32,8 @@ static void gtk_egl_set_scanout_mode(VirtualConsole *vc, bool scanout)
 
     vc->gfx.scanout_mode = scanout;
     if (!vc->gfx.scanout_mode) {
+        eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
+                       vc->gfx.esurface, vc->gfx.ectx);
         egl_fb_destroy(&vc->gfx.guest_fb);
         if (vc->gfx.surface) {
             surface_gl_destroy_texture(vc->gfx.gls, vc->gfx.ds);
@@ -135,6 +137,8 @@ void gd_egl_update(DisplayChangeListener *dcl,
                    vc->gfx.esurface, vc->gfx.ectx);
     surface_gl_update_texture(vc->gfx.gls, vc->gfx.ds, x, y, w, h);
     vc->gfx.glupdates++;
+    eglMakeCurrent(qemu_egl_display, EGL_NO_SURFACE,
+                   EGL_NO_SURFACE, EGL_NO_CONTEXT);
 }
 
 void gd_egl_refresh(DisplayChangeListener *dcl)
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 7367dfd793..a9a7fdf50c 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -26,6 +26,7 @@ static void gtk_gl_area_set_scanout_mode(VirtualConsole *vc, bool scanout)
 
     vc->gfx.scanout_mode = scanout;
     if (!vc->gfx.scanout_mode) {
+        gtk_gl_area_make_current(GTK_GL_AREA(vc->gfx.drawing_area));
         egl_fb_destroy(&vc->gfx.guest_fb);
         if (vc->gfx.surface) {
             surface_gl_destroy_texture(vc->gfx.gls, vc->gfx.ds);
@@ -115,6 +116,7 @@ void gd_gl_area_update(DisplayChangeListener *dcl,
     gtk_gl_area_make_current(GTK_GL_AREA(vc->gfx.drawing_area));
     surface_gl_update_texture(vc->gfx.gls, vc->gfx.ds, x, y, w, h);
     vc->gfx.glupdates++;
+    gdk_gl_context_clear_current();
 }
 
 void gd_gl_area_refresh(DisplayChangeListener *dcl)

From 0d0be87659b06ef7ce07ad07376086bd28e4d71b Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Tue, 27 Jun 2023 15:44:51 -0700
Subject: [PATCH 0831/1353] virtio-gpu: replace the surface with null surface
 when resetting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The primary guest scanout shows the booting screen right after reboot
but additional guest displays (i.e. max_ouptuts > 1) will keep displaying
the old frames until the guest virtio gpu driver gets initialized, which
could cause some confusion. A better way is to to replace the surface with
a place holder that tells the display is not active during the reset of
virtio-gpu device.

And to immediately update the surface with the place holder image after
the switch, displaychangelistener_gfx_switch needs to be called with
'update == TRUE' in dpy_gfx_replace_surface when the new surface is NULL.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230627224451.11739-1-dongwon.kim@intel.com>
---
 hw/display/virtio-gpu.c |  5 +++++
 ui/console.c            | 11 ++++++-----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index e937c4e348..e8603d78ca 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1397,6 +1397,7 @@ void virtio_gpu_reset(VirtIODevice *vdev)
     VirtIOGPU *g = VIRTIO_GPU(vdev);
     struct virtio_gpu_simple_resource *res, *tmp;
     struct virtio_gpu_ctrl_command *cmd;
+    int i = 0;
 
     QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {
         virtio_gpu_resource_destroy(g, res);
@@ -1415,6 +1416,10 @@ void virtio_gpu_reset(VirtIODevice *vdev)
         g_free(cmd);
     }
 
+    for (i = 0; i < g->parent_obj.conf.max_outputs; i++) {
+        dpy_gfx_replace_surface(g->parent_obj.scanout[i].con, NULL);
+    }
+
     virtio_gpu_base_reset(VIRTIO_GPU_BASE(vdev));
 }
 
diff --git a/ui/console.c b/ui/console.c
index c1544e0fb8..8da2170a7e 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -1898,6 +1898,7 @@ void dpy_gfx_replace_surface(QemuConsole *con,
     static const char placeholder_msg[] = "Display output is not active.";
     DisplayState *s = con->ds;
     DisplaySurface *old_surface = con->surface;
+    DisplaySurface *new_surface = surface;
     DisplayChangeListener *dcl;
     int width;
     int height;
@@ -1911,19 +1912,19 @@ void dpy_gfx_replace_surface(QemuConsole *con,
             height = 480;
         }
 
-        surface = qemu_create_placeholder_surface(width, height, placeholder_msg);
+        new_surface = qemu_create_placeholder_surface(width, height, placeholder_msg);
     }
 
-    assert(old_surface != surface);
+    assert(old_surface != new_surface);
 
     con->scanout.kind = SCANOUT_SURFACE;
-    con->surface = surface;
-    dpy_gfx_create_texture(con, surface);
+    con->surface = new_surface;
+    dpy_gfx_create_texture(con, new_surface);
     QLIST_FOREACH(dcl, &s->listeners, next) {
         if (con != (dcl->con ? dcl->con : active_console)) {
             continue;
         }
-        displaychangelistener_gfx_switch(dcl, surface, FALSE);
+        displaychangelistener_gfx_switch(dcl, new_surface, surface ? FALSE : TRUE);
     }
     dpy_gfx_destroy_texture(con, old_surface);
     qemu_free_displaysurface(old_surface);

From 9ac06df8b684e6409ebc7af6337500e7484e28b3 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Wed, 12 Jul 2023 21:04:44 -0700
Subject: [PATCH 0832/1353] virtio-gpu-udmabuf: correct naming of QemuDmaBuf
 size properties
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace 'width' and 'height' in QemuDmaBuf with 'backing_widht'
and 'backing_height' as these commonly indicate the size of the
whole surface (e.g. guest's Xorg extended display). Then use
'width' and 'height' for sub region in there (e.g. guest's
scanouts).

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230713040444.32267-1-dongwon.kim@intel.com>
---
 hw/display/virtio-gpu-udmabuf.c | 12 ++++++------
 include/ui/console.h            |  4 ++--
 ui/dbus-listener.c              |  8 ++++----
 ui/egl-helpers.c                |  8 ++++----
 ui/gtk-egl.c                    | 10 ++++++----
 ui/gtk-gl-area.c                |  7 ++++---
 6 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/hw/display/virtio-gpu-udmabuf.c b/hw/display/virtio-gpu-udmabuf.c
index ef1a740de5..d51184d658 100644
--- a/hw/display/virtio-gpu-udmabuf.c
+++ b/hw/display/virtio-gpu-udmabuf.c
@@ -181,13 +181,13 @@ static VGPUDMABuf
     }
 
     dmabuf = g_new0(VGPUDMABuf, 1);
-    dmabuf->buf.width = fb->width;
-    dmabuf->buf.height = fb->height;
+    dmabuf->buf.width = r->width;
+    dmabuf->buf.height = r->height;
     dmabuf->buf.stride = fb->stride;
     dmabuf->buf.x = r->x;
     dmabuf->buf.y = r->y;
-    dmabuf->buf.scanout_width = r->width;
-    dmabuf->buf.scanout_height = r->height;
+    dmabuf->buf.backing_width = fb->width;
+    dmabuf->buf.backing_height = fb->height;
     dmabuf->buf.fourcc = qemu_pixman_to_drm_format(fb->format);
     dmabuf->buf.fd = res->dmabuf_fd;
     dmabuf->buf.allow_fences = true;
@@ -218,8 +218,8 @@ int virtio_gpu_update_dmabuf(VirtIOGPU *g,
 
     g->dmabuf.primary[scanout_id] = new_primary;
     qemu_console_resize(scanout->con,
-                        new_primary->buf.scanout_width,
-                        new_primary->buf.scanout_height);
+                        new_primary->buf.width,
+                        new_primary->buf.height);
     dpy_gl_scanout_dmabuf(scanout->con, &new_primary->buf);
 
     if (old_primary) {
diff --git a/include/ui/console.h b/include/ui/console.h
index f27b2aad4f..3e8b22d6c6 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -201,8 +201,8 @@ typedef struct QemuDmaBuf {
     uint32_t  texture;
     uint32_t  x;
     uint32_t  y;
-    uint32_t  scanout_width;
-    uint32_t  scanout_height;
+    uint32_t  backing_width;
+    uint32_t  backing_height;
     bool      y0_top;
     void      *sync;
     int       fence_fd;
diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 0240c39510..68ff343799 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -415,13 +415,13 @@ static void dbus_scanout_texture(DisplayChangeListener *dcl,
                                backing_width, backing_height, x, y, w, h);
 #ifdef CONFIG_GBM
     QemuDmaBuf dmabuf = {
-        .width = backing_width,
-        .height = backing_height,
+        .width = w,
+        .height = h,
         .y0_top = backing_y_0_top,
         .x = x,
         .y = y,
-        .scanout_width = w,
-        .scanout_height = h,
+        .backing_width = backing_width,
+        .backing_height = backing_height,
     };
 
     assert(tex_id);
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 8f9fbf583e..3d19dbe382 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -148,8 +148,8 @@ void egl_fb_blit(egl_fb *dst, egl_fb *src, bool flip)
     if (src->dmabuf) {
         x1 = src->dmabuf->x;
         y1 = src->dmabuf->y;
-        w = src->dmabuf->scanout_width;
-        h = src->dmabuf->scanout_height;
+        w = src->dmabuf->width;
+        h = src->dmabuf->height;
     }
 
     w = (x1 + w) > src->width ? src->width - x1 : w;
@@ -314,9 +314,9 @@ void egl_dmabuf_import_texture(QemuDmaBuf *dmabuf)
     }
 
     attrs[i++] = EGL_WIDTH;
-    attrs[i++] = dmabuf->width;
+    attrs[i++] = dmabuf->backing_width;
     attrs[i++] = EGL_HEIGHT;
-    attrs[i++] = dmabuf->height;
+    attrs[i++] = dmabuf->backing_height;
     attrs[i++] = EGL_LINUX_DRM_FOURCC_EXT;
     attrs[i++] = dmabuf->fourcc;
 
diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 42db1bb6cf..eee821d73a 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -262,9 +262,10 @@ void gd_egl_scanout_dmabuf(DisplayChangeListener *dcl,
     }
 
     gd_egl_scanout_texture(dcl, dmabuf->texture,
-                           dmabuf->y0_top, dmabuf->width, dmabuf->height,
-                           dmabuf->x, dmabuf->y, dmabuf->scanout_width,
-                           dmabuf->scanout_height, NULL);
+                           dmabuf->y0_top,
+                           dmabuf->backing_width, dmabuf->backing_height,
+                           dmabuf->x, dmabuf->y, dmabuf->width,
+                           dmabuf->height, NULL);
 
     if (dmabuf->allow_fences) {
         vc->gfx.guest_fb.dmabuf = dmabuf;
@@ -284,7 +285,8 @@ void gd_egl_cursor_dmabuf(DisplayChangeListener *dcl,
         if (!dmabuf->texture) {
             return;
         }
-        egl_fb_setup_for_tex(&vc->gfx.cursor_fb, dmabuf->width, dmabuf->height,
+        egl_fb_setup_for_tex(&vc->gfx.cursor_fb,
+                             dmabuf->backing_width, dmabuf->backing_height,
                              dmabuf->texture, false);
     } else {
         egl_fb_destroy(&vc->gfx.cursor_fb);
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index a9a7fdf50c..4513d3d059 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -301,9 +301,10 @@ void gd_gl_area_scanout_dmabuf(DisplayChangeListener *dcl,
     }
 
     gd_gl_area_scanout_texture(dcl, dmabuf->texture,
-                               dmabuf->y0_top, dmabuf->width, dmabuf->height,
-                               dmabuf->x, dmabuf->y, dmabuf->scanout_width,
-                               dmabuf->scanout_height, NULL);
+                               dmabuf->y0_top,
+                               dmabuf->backing_width, dmabuf->backing_height,
+                               dmabuf->x, dmabuf->y, dmabuf->width,
+                               dmabuf->height, NULL);
 
     if (dmabuf->allow_fences) {
         vc->gfx.guest_fb.dmabuf = dmabuf;

From 92b58156e745b01a20861a872e327693a7e729b1 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Thu, 6 Jul 2023 11:33:54 -0700
Subject: [PATCH 0833/1353] ui/gtk: set scanout-mode right before scheduling
 draw
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Setting scanout mode is better to be done very last minute
right because the mode can be reset anytime after it is set in
dpy_gl_scanout_texture by any asynchronouse dpy_refresh call,
which eventually cancels drawing of the guest scanout texture.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230706183355.29361-1-dongwon.kim@intel.com>
---
 ui/gtk-egl.c     | 2 +-
 ui/gtk-gl-area.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index eee821d73a..98b3a116bf 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -242,7 +242,6 @@ void gd_egl_scanout_texture(DisplayChangeListener *dcl,
     eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
                    vc->gfx.esurface, vc->gfx.ectx);
 
-    gtk_egl_set_scanout_mode(vc, true);
     egl_fb_setup_for_tex(&vc->gfx.guest_fb, backing_width, backing_height,
                          backing_id, false);
 }
@@ -353,6 +352,7 @@ void gd_egl_flush(DisplayChangeListener *dcl,
     if (vc->gfx.guest_fb.dmabuf && !vc->gfx.guest_fb.dmabuf->draw_submitted) {
         graphic_hw_gl_block(vc->gfx.dcl.con, true);
         vc->gfx.guest_fb.dmabuf->draw_submitted = true;
+        gtk_egl_set_scanout_mode(vc, true);
         gtk_widget_queue_draw_area(area, x, y, w, h);
         return;
     }
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 4513d3d059..28d9e49888 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -264,7 +264,6 @@ void gd_gl_area_scanout_texture(DisplayChangeListener *dcl,
         return;
     }
 
-    gtk_gl_area_set_scanout_mode(vc, true);
     egl_fb_setup_for_tex(&vc->gfx.guest_fb, backing_width, backing_height,
                          backing_id, false);
 }
@@ -284,6 +283,7 @@ void gd_gl_area_scanout_flush(DisplayChangeListener *dcl,
     if (vc->gfx.guest_fb.dmabuf && !vc->gfx.guest_fb.dmabuf->draw_submitted) {
         graphic_hw_gl_block(vc->gfx.dcl.con, true);
         vc->gfx.guest_fb.dmabuf->draw_submitted = true;
+        gtk_gl_area_set_scanout_mode(vc, true);
     }
     gtk_gl_area_queue_render(GTK_GL_AREA(vc->gfx.drawing_area));
 }

From 1be878eb97abf8d43c9c5868bca69862ccae5da3 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Thu, 6 Jul 2023 11:33:55 -0700
Subject: [PATCH 0834/1353] ui/gtk: skip refresh if new dmabuf has been
 submitted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Skip refresh if a new dmabuf (guest scanout frame) has already been
submitted and ready to be drawn because the scanout will be updated
with new frame anyway.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230706183355.29361-2-dongwon.kim@intel.com>
---
 ui/gtk-egl.c     | 4 ++++
 ui/gtk-gl-area.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 98b3a116bf..4c29ac10d0 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -148,6 +148,10 @@ void gd_egl_refresh(DisplayChangeListener *dcl)
     gd_update_monitor_refresh_rate(
             vc, vc->window ? vc->window : vc->gfx.drawing_area);
 
+    if (vc->gfx.guest_fb.dmabuf && vc->gfx.guest_fb.dmabuf->draw_submitted) {
+        return;
+    }
+
     if (!vc->gfx.esurface) {
         gd_egl_init(vc);
         if (!vc->gfx.esurface) {
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 28d9e49888..1ce34a249e 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -125,6 +125,10 @@ void gd_gl_area_refresh(DisplayChangeListener *dcl)
 
     gd_update_monitor_refresh_rate(vc, vc->window ? vc->window : vc->gfx.drawing_area);
 
+    if (vc->gfx.guest_fb.dmabuf && vc->gfx.guest_fb.dmabuf->draw_submitted) {
+        return;
+    }
+
     if (!vc->gfx.gls) {
         if (!gtk_widget_get_realized(vc->gfx.drawing_area)) {
             return;

From 6200e0ff5f921d7d2b6facaa99f85512dd08a958 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:24 +0400
Subject: [PATCH 0835/1353] libvirt-ci: update submodule to cover pipewire
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230506163735.3481387-2-marcandre.lureau@redhat.com>
---
 tests/lcitool/libvirt-ci | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/lcitool/libvirt-ci b/tests/lcitool/libvirt-ci
index b0f44f929a..9bff3b763b 160000
--- a/tests/lcitool/libvirt-ci
+++ b/tests/lcitool/libvirt-ci
@@ -1 +1 @@
-Subproject commit b0f44f929a81c0a604fb7fbf8afc34d37ab0eae9
+Subproject commit 9bff3b763b5531a1490e238bfbf77306dc3a6dbb

From 62259d816c7cc61c59baa14aecaa3bdb3caa34eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:25 +0400
Subject: [PATCH 0836/1353] tests/lcitool: add pipewire
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230506163735.3481387-3-marcandre.lureau@redhat.com>
---
 tests/docker/dockerfiles/alpine.docker                | 1 +
 tests/docker/dockerfiles/centos8.docker               | 1 +
 tests/docker/dockerfiles/debian-amd64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-amd64.docker          | 1 +
 tests/docker/dockerfiles/debian-arm64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armel-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armhf-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-mips64el-cross.docker | 1 +
 tests/docker/dockerfiles/debian-mipsel-cross.docker   | 1 +
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  | 1 +
 tests/docker/dockerfiles/debian-s390x-cross.docker    | 1 +
 tests/docker/dockerfiles/fedora.docker                | 1 +
 tests/docker/dockerfiles/opensuse-leap.docker         | 1 +
 tests/docker/dockerfiles/ubuntu2204.docker            | 1 +
 tests/lcitool/projects/qemu.yml                       | 1 +
 15 files changed, 15 insertions(+)

diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index 43370f7b36..fa455f1474 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -77,6 +77,7 @@ RUN apk update && \
         numactl-dev \
         openssh-client \
         pcre-dev \
+        pipewire-dev \
         pixman-dev \
         pkgconf \
         pulseaudio-dev \
diff --git a/tests/docker/dockerfiles/centos8.docker b/tests/docker/dockerfiles/centos8.docker
index 78f454b782..da7dc818fb 100644
--- a/tests/docker/dockerfiles/centos8.docker
+++ b/tests/docker/dockerfiles/centos8.docker
@@ -90,6 +90,7 @@ RUN dnf distro-sync -y && \
         openssh-clients \
         pam-devel \
         pcre-static \
+        pipewire-devel \
         pixman-devel \
         pkgconfig \
         pulseaudio-libs-devel \
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 016c2321f1..b7bdc01243 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -116,6 +116,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:amd64 \
                       libnuma-dev:amd64 \
                       libpam0g-dev:amd64 \
+                      libpipewire-0.3-dev:amd64 \
                       libpixman-1-dev:amd64 \
                       libpmem-dev:amd64 \
                       libpng-dev:amd64 \
diff --git a/tests/docker/dockerfiles/debian-amd64.docker b/tests/docker/dockerfiles/debian-amd64.docker
index e39871c7bb..6d2fa38e3e 100644
--- a/tests/docker/dockerfiles/debian-amd64.docker
+++ b/tests/docker/dockerfiles/debian-amd64.docker
@@ -69,6 +69,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnuma-dev \
                       libpam0g-dev \
                       libpcre2-dev \
+                      libpipewire-0.3-dev \
                       libpixman-1-dev \
                       libpmem-dev \
                       libpng-dev \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 3c114efa11..68165c2f23 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -116,6 +116,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:arm64 \
                       libnuma-dev:arm64 \
                       libpam0g-dev:arm64 \
+                      libpipewire-0.3-dev:arm64 \
                       libpixman-1-dev:arm64 \
                       libpng-dev:arm64 \
                       libpulse-dev:arm64 \
diff --git a/tests/docker/dockerfiles/debian-armel-cross.docker b/tests/docker/dockerfiles/debian-armel-cross.docker
index dfbd47db89..2fb65308c7 100644
--- a/tests/docker/dockerfiles/debian-armel-cross.docker
+++ b/tests/docker/dockerfiles/debian-armel-cross.docker
@@ -116,6 +116,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:armel \
                       libnuma-dev:armel \
                       libpam0g-dev:armel \
+                      libpipewire-0.3-dev:armel \
                       libpixman-1-dev:armel \
                       libpng-dev:armel \
                       libpulse-dev:armel \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 4e0084e896..df77ccb57b 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -116,6 +116,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:armhf \
                       libnuma-dev:armhf \
                       libpam0g-dev:armhf \
+                      libpipewire-0.3-dev:armhf \
                       libpixman-1-dev:armhf \
                       libpng-dev:armhf \
                       libpulse-dev:armhf \
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 88adf333e9..63a3d7aa3b 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -115,6 +115,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:mips64el \
                       libnuma-dev:mips64el \
                       libpam0g-dev:mips64el \
+                      libpipewire-0.3-dev:mips64el \
                       libpixman-1-dev:mips64el \
                       libpng-dev:mips64el \
                       libpulse-dev:mips64el \
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 256e8b5dfe..ac87bbb095 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -115,6 +115,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:mipsel \
                       libnuma-dev:mipsel \
                       libpam0g-dev:mipsel \
+                      libpipewire-0.3-dev:mipsel \
                       libpixman-1-dev:mipsel \
                       libpng-dev:mipsel \
                       libpulse-dev:mipsel \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 4d19cd2bd7..def11f1693 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -116,6 +116,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:ppc64el \
                       libnuma-dev:ppc64el \
                       libpam0g-dev:ppc64el \
+                      libpipewire-0.3-dev:ppc64el \
                       libpixman-1-dev:ppc64el \
                       libpng-dev:ppc64el \
                       libpulse-dev:ppc64el \
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 642bbde3d1..80028e1eea 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -116,6 +116,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnfs-dev:s390x \
                       libnuma-dev:s390x \
                       libpam0g-dev:s390x \
+                      libpipewire-0.3-dev:s390x \
                       libpixman-1-dev:s390x \
                       libpng-dev:s390x \
                       libpulse-dev:s390x \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index 8a35a17617..c5b6c96943 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -98,6 +98,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                openssh-clients \
                pam-devel \
                pcre-static \
+               pipewire-devel \
                pixman-devel \
                pkgconfig \
                pulseaudio-libs-devel \
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index 185abe57d8..37c83e5e4e 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -88,6 +88,7 @@ RUN zypper update -y && \
            openssh \
            pam-devel \
            pcre-devel-static \
+           pipewire-devel \
            pkgconfig \
            python39-base \
            python39-pip \
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 1d442cdfe6..8f939870ae 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -69,6 +69,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libnuma-dev \
                       libpam0g-dev \
                       libpcre2-dev \
+                      libpipewire-0.3-dev \
                       libpixman-1-dev \
                       libpmem-dev \
                       libpng-dev \
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index 21fd3d2cf9..d452a891ee 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -85,6 +85,7 @@ packages:
  - pam
  - pcre-static
  - pixman
+ - pipewire
  - pkg-config
  - pulseaudio
  - python3

From 20c512480522a035627d4f53e28bc7b0ecb779b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:26 +0400
Subject: [PATCH 0837/1353] audio/pw: Pipewire->PipeWire case fix for
 user-visible text
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"PipeWire" is the correct case.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-4-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c               | 10 +++++-----
 audio/trace-events            |  2 +-
 meson.build                   |  2 +-
 meson_options.txt             |  2 +-
 qapi/audio.json               | 12 ++++++------
 qemu-options.hx               |  4 ++--
 scripts/meson-buildoptions.sh |  2 +-
 7 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 1d108bdebb..9eb69bfd18 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -1,5 +1,5 @@
 /*
- * QEMU Pipewire audio driver
+ * QEMU PipeWire audio driver
  *
  * Copyright (c) 2023 Red Hat Inc.
  *
@@ -800,21 +800,21 @@ qpw_audio_init(Audiodev *dev)
     assert(dev->driver == AUDIODEV_DRIVER_PIPEWIRE);
 
     pw->dev = dev;
-    pw->thread_loop = pw_thread_loop_new("Pipewire thread loop", NULL);
+    pw->thread_loop = pw_thread_loop_new("PipeWire thread loop", NULL);
     if (pw->thread_loop == NULL) {
-        error_report("Could not create Pipewire loop");
+        error_report("Could not create PipeWire loop");
         goto fail;
     }
 
     pw->context =
         pw_context_new(pw_thread_loop_get_loop(pw->thread_loop), NULL, 0);
     if (pw->context == NULL) {
-        error_report("Could not create Pipewire context");
+        error_report("Could not create PipeWire context");
         goto fail;
     }
 
     if (pw_thread_loop_start(pw->thread_loop) < 0) {
-        error_report("Could not start Pipewire loop");
+        error_report("Could not start PipeWire loop");
         goto fail;
     }
 
diff --git a/audio/trace-events b/audio/trace-events
index 85dbb506b2..ab04f020ce 100644
--- a/audio/trace-events
+++ b/audio/trace-events
@@ -24,7 +24,7 @@ pw_read(int32_t avail, uint32_t index, size_t len) "avail=%d index=%u len=%zu"
 pw_write(int32_t filled, int32_t avail, uint32_t index, size_t len) "filled=%d avail=%d index=%u len=%zu"
 pw_vol(const char *ret) "set volume: %s"
 pw_period(uint64_t quantum, uint32_t rate) "period =%" PRIu64 "/%u"
-pw_audio_init(void) "Initialize Pipewire context"
+pw_audio_init(void) "Initialize PipeWire context"
 
 # audio.c
 audio_timer_start(int interval) "interval %d ms"
diff --git a/meson.build b/meson.build
index 5fcdb37a71..98e68ef0b1 100644
--- a/meson.build
+++ b/meson.build
@@ -4251,7 +4251,7 @@ if targetos == 'linux'
   summary_info += {'ALSA support':    alsa}
   summary_info += {'PulseAudio support': pulse}
 endif
-summary_info += {'Pipewire support':  pipewire}
+summary_info += {'PipeWire support':  pipewire}
 summary_info += {'JACK support':      jack}
 summary(summary_info, bool_yn: true, section: 'Audio backends')
 
diff --git a/meson_options.txt b/meson_options.txt
index bbb5c7e886..aaea5ddd77 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -267,7 +267,7 @@ option('oss', type: 'feature', value: 'auto',
 option('pa', type: 'feature', value: 'auto',
        description: 'PulseAudio sound support')
 option('pipewire', type: 'feature', value: 'auto',
-       description: 'Pipewire sound support')
+       description: 'PipeWire sound support')
 option('sndio', type: 'feature', value: 'auto',
        description: 'sndio sound support')
 
diff --git a/qapi/audio.json b/qapi/audio.json
index 534f10d8b1..519697c0cd 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -328,17 +328,17 @@
 ##
 # @AudiodevPipewirePerDirectionOptions:
 #
-# Options of the Pipewire backend that are used for both playback and
+# Options of the PipeWire backend that are used for both playback and
 # recording.
 #
 # @name: name of the sink/source to use
 #
-# @stream-name: name of the Pipewire stream created by qemu.  Can be
-#     used to identify the stream in Pipewire when you create multiple
-#     Pipewire devices or run multiple qemu instances (default:
+# @stream-name: name of the PipeWire stream created by qemu.  Can be
+#     used to identify the stream in PipeWire when you create multiple
+#     PipeWire devices or run multiple qemu instances (default:
 #     audiodev's id)
 #
-# @latency: latency you want Pipewire to achieve in microseconds
+# @latency: latency you want PipeWire to achieve in microseconds
 #     (default 46000)
 #
 # Since: 8.1
@@ -353,7 +353,7 @@
 ##
 # @AudiodevPipewireOptions:
 #
-# Options of the Pipewire audio backend.
+# Options of the PipeWire audio backend.
 #
 # @in: options of the capture stream
 #
diff --git a/qemu-options.hx b/qemu-options.hx
index f8f384e551..29b98c3d4c 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -963,10 +963,10 @@ SRST
         to honor this value but actual latencies may be lower or higher.
 
 ``-audiodev pipewire,id=id[,prop[=value][,...]]``
-    Creates a backend using Pipewire. This backend is available on
+    Creates a backend using PipeWire. This backend is available on
     most systems.
 
-    Pipewire specific options are:
+    PipeWire specific options are:
 
     ``in|out.latency=usecs``
         Desired latency in microseconds.
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 7dd5709ef4..9da3fe299b 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -145,7 +145,7 @@ meson_options_help() {
   printf "%s\n" '  oss             OSS sound support'
   printf "%s\n" '  pa              PulseAudio sound support'
   printf "%s\n" '  parallels       parallels image format support'
-  printf "%s\n" '  pipewire        Pipewire sound support'
+  printf "%s\n" '  pipewire        PipeWire sound support'
   printf "%s\n" '  png             PNG support with libpng'
   printf "%s\n" '  pvrdma          Enable PVRDMA support'
   printf "%s\n" '  qcow1           qcow1 image format support'

From 2d216959e1e065ccb5523e4ce67b6f9ad47b17eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:27 +0400
Subject: [PATCH 0838/1353] audio/pw: drop needless case statement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-5-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 9eb69bfd18..51cfc0b052 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -197,16 +197,6 @@ on_stream_state_changed(void *data, enum pw_stream_state old,
 
     trace_pw_state_changed(pw_stream_get_node_id(v->stream),
                            pw_stream_state_as_string(state));
-
-    switch (state) {
-    case PW_STREAM_STATE_ERROR:
-    case PW_STREAM_STATE_UNCONNECTED:
-        break;
-    case PW_STREAM_STATE_PAUSED:
-    case PW_STREAM_STATE_CONNECTING:
-    case PW_STREAM_STATE_STREAMING:
-        break;
-    }
 }
 
 static const struct pw_stream_events capture_stream_events = {

From 3b2876086b2c5a23a82d70eeb9f2b68c833c2809 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:28 +0400
Subject: [PATCH 0839/1353] audio/pw: needless check for NULL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

g_clear_pointer() already checks for NULL.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-6-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 51cfc0b052..6ca4ef4f62 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -834,12 +834,8 @@ fail:
     if (pw->thread_loop) {
         pw_thread_loop_stop(pw->thread_loop);
     }
-    if (pw->context) {
-        g_clear_pointer(&pw->context, pw_context_destroy);
-    }
-    if (pw->thread_loop) {
-        g_clear_pointer(&pw->thread_loop, pw_thread_loop_destroy);
-    }
+    g_clear_pointer(&pw->context, pw_context_destroy);
+    g_clear_pointer(&pw->thread_loop, pw_thread_loop_destroy);
     return NULL;
 }
 

From 87048d20e64d5613ad08c59acfb0529d7f82ae70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:29 +0400
Subject: [PATCH 0840/1353] audio/pw: trace during init before calling pipewire
 API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-7-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 6ca4ef4f62..2b12b40934 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -784,10 +784,11 @@ static void *
 qpw_audio_init(Audiodev *dev)
 {
     g_autofree pwaudio *pw = g_new0(pwaudio, 1);
-    pw_init(NULL, NULL);
 
-    trace_pw_audio_init();
     assert(dev->driver == AUDIODEV_DRIVER_PIPEWIRE);
+    trace_pw_audio_init();
+
+    pw_init(NULL, NULL);
 
     pw->dev = dev;
     pw->thread_loop = pw_thread_loop_new("PipeWire thread loop", NULL);

From 24a9095c13e34e95a89adbe7cb8e11179ff48f94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:30 +0400
Subject: [PATCH 0841/1353] audio/pw: add more details on error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PipeWire uses errno to report error details.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-8-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 2b12b40934..d0bc4680a6 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -750,6 +750,7 @@ static int wait_resync(pwaudio *pw)
     }
     return 0;
 }
+
 static void
 on_core_error(void *data, uint32_t id, int seq, int res, const char *message)
 {
@@ -793,19 +794,19 @@ qpw_audio_init(Audiodev *dev)
     pw->dev = dev;
     pw->thread_loop = pw_thread_loop_new("PipeWire thread loop", NULL);
     if (pw->thread_loop == NULL) {
-        error_report("Could not create PipeWire loop");
+        error_report("Could not create PipeWire loop: %s", g_strerror(errno));
         goto fail;
     }
 
     pw->context =
         pw_context_new(pw_thread_loop_get_loop(pw->thread_loop), NULL, 0);
     if (pw->context == NULL) {
-        error_report("Could not create PipeWire context");
+        error_report("Could not create PipeWire context: %s", g_strerror(errno));
         goto fail;
     }
 
     if (pw_thread_loop_start(pw->thread_loop) < 0) {
-        error_report("Could not start PipeWire loop");
+        error_report("Could not start PipeWire loop: %s", g_strerror(errno));
         goto fail;
     }
 

From 92fd78689d0b06a00637e4e821a502b194d09328 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:31 +0400
Subject: [PATCH 0842/1353] audio/pw: factorize some common code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-9-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 115 +++++++++++++++++++++---------------------------
 1 file changed, 49 insertions(+), 66 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index d0bc4680a6..70f0c46240 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -66,6 +66,9 @@ typedef struct PWVoiceIn {
     PWVoice v;
 } PWVoiceIn;
 
+#define PW_VOICE_IN(v) ((PWVoiceIn *)v)
+#define PW_VOICE_OUT(v) ((PWVoiceOut *)v)
+
 static void
 stream_destroy(void *data)
 {
@@ -629,106 +632,86 @@ qpw_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
     return 0;
 }
 
+static void
+qpw_voice_fini(PWVoice *v)
+{
+    pwaudio *c = v->g;
+
+    if (!v->stream) {
+        return;
+    }
+    pw_thread_loop_lock(c->thread_loop);
+    pw_stream_destroy(v->stream);
+    v->stream = NULL;
+    pw_thread_loop_unlock(c->thread_loop);
+}
+
 static void
 qpw_fini_out(HWVoiceOut *hw)
 {
-    PWVoiceOut *pw = (PWVoiceOut *) hw;
-    PWVoice *v = &pw->v;
-
-    if (v->stream) {
-        pwaudio *c = v->g;
-        pw_thread_loop_lock(c->thread_loop);
-        pw_stream_destroy(v->stream);
-        v->stream = NULL;
-        pw_thread_loop_unlock(c->thread_loop);
-    }
+    qpw_voice_fini(&PW_VOICE_OUT(hw)->v);
 }
 
 static void
 qpw_fini_in(HWVoiceIn *hw)
 {
-    PWVoiceIn *pw = (PWVoiceIn *) hw;
-    PWVoice *v = &pw->v;
-
-    if (v->stream) {
-        pwaudio *c = v->g;
-        pw_thread_loop_lock(c->thread_loop);
-        pw_stream_destroy(v->stream);
-        v->stream = NULL;
-        pw_thread_loop_unlock(c->thread_loop);
-    }
+    qpw_voice_fini(&PW_VOICE_IN(hw)->v);
 }
 
 static void
-qpw_enable_out(HWVoiceOut *hw, bool enable)
+qpw_voice_set_enabled(PWVoice *v, bool enable)
 {
-    PWVoiceOut *po = (PWVoiceOut *) hw;
-    PWVoice *v = &po->v;
     pwaudio *c = v->g;
     pw_thread_loop_lock(c->thread_loop);
     pw_stream_set_active(v->stream, enable);
     pw_thread_loop_unlock(c->thread_loop);
 }
 
+static void
+qpw_enable_out(HWVoiceOut *hw, bool enable)
+{
+    qpw_voice_set_enabled(&PW_VOICE_OUT(hw)->v, enable);
+}
+
 static void
 qpw_enable_in(HWVoiceIn *hw, bool enable)
 {
-    PWVoiceIn *pi = (PWVoiceIn *) hw;
-    PWVoice *v = &pi->v;
+    qpw_voice_set_enabled(&PW_VOICE_IN(hw)->v, enable);
+}
+
+static void
+qpw_voice_set_volume(PWVoice *v, Volume *vol)
+{
     pwaudio *c = v->g;
+    int i, ret;
+
     pw_thread_loop_lock(c->thread_loop);
-    pw_stream_set_active(v->stream, enable);
+    v->volume.channels = vol->channels;
+
+    for (i = 0; i < vol->channels; ++i) {
+        v->volume.values[i] = (float)vol->vol[i] / 255;
+    }
+
+    ret = pw_stream_set_control(v->stream,
+        SPA_PROP_channelVolumes, v->volume.channels, v->volume.values, 0);
+    trace_pw_vol(ret == 0 ? "success" : "failed");
+
+    v->muted = vol->mute;
+    float val = v->muted ? 1.f : 0.f;
+    ret = pw_stream_set_control(v->stream, SPA_PROP_mute, 1, &val, 0);
     pw_thread_loop_unlock(c->thread_loop);
 }
 
 static void
 qpw_volume_out(HWVoiceOut *hw, Volume *vol)
 {
-    PWVoiceOut *pw = (PWVoiceOut *) hw;
-    PWVoice *v = &pw->v;
-    pwaudio *c = v->g;
-    int i, ret;
-
-    pw_thread_loop_lock(c->thread_loop);
-    v->volume.channels = vol->channels;
-
-    for (i = 0; i < vol->channels; ++i) {
-        v->volume.values[i] = (float)vol->vol[i] / 255;
-    }
-
-    ret = pw_stream_set_control(v->stream,
-        SPA_PROP_channelVolumes, v->volume.channels, v->volume.values, 0);
-    trace_pw_vol(ret == 0 ? "success" : "failed");
-
-    v->muted = vol->mute;
-    float val = v->muted ? 1.f : 0.f;
-    ret = pw_stream_set_control(v->stream, SPA_PROP_mute, 1, &val, 0);
-    pw_thread_loop_unlock(c->thread_loop);
+    qpw_voice_set_volume(&PW_VOICE_OUT(hw)->v, vol);
 }
 
 static void
 qpw_volume_in(HWVoiceIn *hw, Volume *vol)
 {
-    PWVoiceIn *pw = (PWVoiceIn *) hw;
-    PWVoice *v = &pw->v;
-    pwaudio *c = v->g;
-    int i, ret;
-
-    pw_thread_loop_lock(c->thread_loop);
-    v->volume.channels = vol->channels;
-
-    for (i = 0; i < vol->channels; ++i) {
-        v->volume.values[i] = (float)vol->vol[i] / 255;
-    }
-
-    ret = pw_stream_set_control(v->stream,
-        SPA_PROP_channelVolumes, v->volume.channels, v->volume.values, 0);
-    trace_pw_vol(ret == 0 ? "success" : "failed");
-
-    v->muted = vol->mute;
-    float val = v->muted ? 1.f : 0.f;
-    ret = pw_stream_set_control(v->stream, SPA_PROP_mute, 1, &val, 0);
-    pw_thread_loop_unlock(c->thread_loop);
+    qpw_voice_set_volume(&PW_VOICE_IN(hw)->v, vol);
 }
 
 static int wait_resync(pwaudio *pw)

From 0c57a05533d12a3788739666f67b425709f4a132 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:32 +0400
Subject: [PATCH 0843/1353] audio/pw: add more error reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-10-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 70f0c46240..f1c5e5dd48 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -429,6 +429,10 @@ create_stream(pwaudio *c, PWVoice *v, const char *stream_name,
     struct pw_properties *props;
 
     props = pw_properties_new(NULL, NULL);
+    if (!props) {
+        error_report("Failed to create PW properties: %s", g_strerror(errno));
+        return -1;
+    }
 
     /* 75% of the timer period for faster updates */
     buf_samples = (uint64_t)v->g->dev->timer_period * v->info.rate
@@ -441,8 +445,8 @@ create_stream(pwaudio *c, PWVoice *v, const char *stream_name,
         pw_properties_set(props, PW_KEY_TARGET_OBJECT, name);
     }
     v->stream = pw_stream_new(c->core, stream_name, props);
-
     if (v->stream == NULL) {
+        error_report("Failed to create PW stream: %s", g_strerror(errno));
         return -1;
     }
 
@@ -470,6 +474,7 @@ create_stream(pwaudio *c, PWVoice *v, const char *stream_name,
                             PW_STREAM_FLAG_MAP_BUFFERS |
                             PW_STREAM_FLAG_RT_PROCESS, params, n_params);
     if (res < 0) {
+        error_report("Failed to connect PW stream: %s", g_strerror(errno));
         pw_stream_destroy(v->stream);
         return -1;
     }

From 6f1b280e44297713bbdfffc92add4a64241b43d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:33 +0400
Subject: [PATCH 0844/1353] audio/pw: simplify error reporting in stream
 creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

create_stream() now reports on all error paths.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-11-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index f1c5e5dd48..7d5005b971 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -486,8 +486,6 @@ static int
 qpw_stream_new(pwaudio *c, PWVoice *v, const char *stream_name,
                const char *name, enum spa_direction dir)
 {
-    int r;
-
     switch (v->info.channels) {
     case 8:
         v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
@@ -540,13 +538,7 @@ qpw_stream_new(pwaudio *c, PWVoice *v, const char *stream_name,
     }
 
     /* create a new unconnected pwstream */
-    r = create_stream(c, v, stream_name, name, dir);
-    if (r < 0) {
-        AUD_log(AUDIO_CAP, "Failed to create stream.");
-        return -1;
-    }
-
-    return r;
+    return create_stream(c, v, stream_name, name, dir);
 }
 
 static int
@@ -577,7 +569,6 @@ qpw_init_out(HWVoiceOut *hw, struct audsettings *as, void *drv_opaque)
     r = qpw_stream_new(c, v, ppdo->stream_name ? : c->dev->id,
                        ppdo->name, SPA_DIRECTION_OUTPUT);
     if (r < 0) {
-        error_report("qpw_stream_new for playback failed");
         pw_thread_loop_unlock(c->thread_loop);
         return -1;
     }
@@ -621,7 +612,6 @@ qpw_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
     r = qpw_stream_new(c, v, ppdo->stream_name ? : c->dev->id,
                        ppdo->name, SPA_DIRECTION_INPUT);
     if (r < 0) {
-        error_report("qpw_stream_new for recording failed");
         pw_thread_loop_unlock(c->thread_loop);
         return -1;
     }

From 8297b3d3d00e475d5b2ba042ed2077167d312492 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:34 +0400
Subject: [PATCH 0845/1353] audio/pw: remove wrong comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The stream is actually created connected.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-12-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 7d5005b971..a101ffeff1 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -537,7 +537,6 @@ qpw_stream_new(pwaudio *c, PWVoice *v, const char *stream_name,
         break;
     }
 
-    /* create a new unconnected pwstream */
     return create_stream(c, v, stream_name, name, dir);
 }
 

From 92f69a2c9bca26ee756c7cb932142664aca9c9c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 6 May 2023 20:37:35 +0400
Subject: [PATCH 0846/1353] audio/pw: improve channel position code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow PulseAudio backend comment and code, and only implement the
channels QEMU actually supports at this point, and add the same comment
about limits and future mappings. Simplify a bit the code.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20230506163735.3481387-13-marcandre.lureau@redhat.com>
---
 audio/pwaudio.c | 75 +++++++++++++++++--------------------------------
 1 file changed, 26 insertions(+), 49 deletions(-)

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index a101ffeff1..b6a38738ee 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -417,8 +417,8 @@ pw_to_audfmt(enum spa_audio_format fmt, int *endianness,
 }
 
 static int
-create_stream(pwaudio *c, PWVoice *v, const char *stream_name,
-              const char *name, enum spa_direction dir)
+qpw_stream_new(pwaudio *c, PWVoice *v, const char *stream_name,
+               const char *name, enum spa_direction dir)
 {
     int res;
     uint32_t n_params;
@@ -482,62 +482,37 @@ create_stream(pwaudio *c, PWVoice *v, const char *stream_name,
     return 0;
 }
 
-static int
-qpw_stream_new(pwaudio *c, PWVoice *v, const char *stream_name,
-               const char *name, enum spa_direction dir)
+static void
+qpw_set_position(uint32_t channels, uint32_t position[SPA_AUDIO_MAX_CHANNELS])
 {
-    switch (v->info.channels) {
+    memcpy(position, (uint32_t[SPA_AUDIO_MAX_CHANNELS]) { SPA_AUDIO_CHANNEL_UNKNOWN, },
+           sizeof(uint32_t) * SPA_AUDIO_MAX_CHANNELS);
+    /*
+     * TODO: This currently expects the only frontend supporting more than 2
+     * channels is the usb-audio.  We will need some means to set channel
+     * order when a new frontend gains multi-channel support.
+     */
+    switch (channels) {
     case 8:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
-        v->info.position[1] = SPA_AUDIO_CHANNEL_FR;
-        v->info.position[2] = SPA_AUDIO_CHANNEL_FC;
-        v->info.position[3] = SPA_AUDIO_CHANNEL_LFE;
-        v->info.position[4] = SPA_AUDIO_CHANNEL_RL;
-        v->info.position[5] = SPA_AUDIO_CHANNEL_RR;
-        v->info.position[6] = SPA_AUDIO_CHANNEL_SL;
-        v->info.position[7] = SPA_AUDIO_CHANNEL_SR;
-        break;
+        position[6] = SPA_AUDIO_CHANNEL_SL;
+        position[7] = SPA_AUDIO_CHANNEL_SR;
+        /* fallthrough */
     case 6:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
-        v->info.position[1] = SPA_AUDIO_CHANNEL_FR;
-        v->info.position[2] = SPA_AUDIO_CHANNEL_FC;
-        v->info.position[3] = SPA_AUDIO_CHANNEL_LFE;
-        v->info.position[4] = SPA_AUDIO_CHANNEL_RL;
-        v->info.position[5] = SPA_AUDIO_CHANNEL_RR;
-        break;
-    case 5:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
-        v->info.position[1] = SPA_AUDIO_CHANNEL_FR;
-        v->info.position[2] = SPA_AUDIO_CHANNEL_FC;
-        v->info.position[3] = SPA_AUDIO_CHANNEL_LFE;
-        v->info.position[4] = SPA_AUDIO_CHANNEL_RC;
-        break;
-    case 4:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
-        v->info.position[1] = SPA_AUDIO_CHANNEL_FR;
-        v->info.position[2] = SPA_AUDIO_CHANNEL_FC;
-        v->info.position[3] = SPA_AUDIO_CHANNEL_RC;
-        break;
-    case 3:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
-        v->info.position[1] = SPA_AUDIO_CHANNEL_FR;
-        v->info.position[2] = SPA_AUDIO_CHANNEL_LFE;
-        break;
+        position[2] = SPA_AUDIO_CHANNEL_FC;
+        position[3] = SPA_AUDIO_CHANNEL_LFE;
+        position[4] = SPA_AUDIO_CHANNEL_RL;
+        position[5] = SPA_AUDIO_CHANNEL_RR;
+        /* fallthrough */
     case 2:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_FL;
-        v->info.position[1] = SPA_AUDIO_CHANNEL_FR;
+        position[0] = SPA_AUDIO_CHANNEL_FL;
+        position[1] = SPA_AUDIO_CHANNEL_FR;
         break;
     case 1:
-        v->info.position[0] = SPA_AUDIO_CHANNEL_MONO;
+        position[0] = SPA_AUDIO_CHANNEL_MONO;
         break;
     default:
-        for (size_t i = 0; i < v->info.channels; i++) {
-            v->info.position[i] = SPA_AUDIO_CHANNEL_UNKNOWN;
-        }
-        break;
+        dolog("Internal error: unsupported channel count %d\n", channels);
     }
-
-    return create_stream(c, v, stream_name, name, dir);
 }
 
 static int
@@ -555,6 +530,7 @@ qpw_init_out(HWVoiceOut *hw, struct audsettings *as, void *drv_opaque)
 
     v->info.format = audfmt_to_pw(as->fmt, as->endianness);
     v->info.channels = as->nchannels;
+    qpw_set_position(as->nchannels, v->info.position);
     v->info.rate = as->freq;
 
     obt_as.fmt =
@@ -601,6 +577,7 @@ qpw_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
 
     v->info.format = audfmt_to_pw(as->fmt, as->endianness);
     v->info.channels = as->nchannels;
+    qpw_set_position(as->nchannels, v->info.position);
     v->info.rate = as->freq;
 
     obt_as.fmt =

From 66547f416a61e0cb711dc76821890242432ba193 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Wed, 12 Jul 2023 15:16:28 -0400
Subject: [PATCH 0847/1353] block/nvme: invoke blk_io_plug_call() outside
 q->lock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

blk_io_plug_call() is invoked outside a blk_io_plug()/blk_io_unplug()
section while opening the NVMe drive from:

  nvme_file_open() ->
  nvme_init() ->
  nvme_identify() ->
  nvme_admin_cmd_sync() ->
  nvme_submit_command() ->
  blk_io_plug_call()

blk_io_plug_call() immediately invokes the given callback when the
current thread is not plugged, as is the case during nvme_file_open().

Unfortunately, nvme_submit_command() calls blk_io_plug_call() with
q->lock still held:

    ...
    q->sq.tail = (q->sq.tail + 1) % NVME_QUEUE_SIZE;
    q->need_kick++;
    blk_io_plug_call(nvme_unplug_fn, q);
    qemu_mutex_unlock(&q->lock);
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^

nvme_unplug_fn() deadlocks trying to acquire q->lock because the lock is
already acquired by the same thread. The symptom is that QEMU hangs
during startup while opening the NVMe drive.

Fix this by moving the blk_io_plug_call() outside q->lock. This is safe
because no other thread runs code related to this queue and
blk_io_plug_call()'s internal state is immune to thread safety issues
since it is thread-local.

Reported-by: Lukáš Doktor <ldoktor@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Tested-by: Lukas Doktor <ldoktor@redhat.com>
Message-id: 20230712191628.252806-1-stefanha@redhat.com
Fixes: f2e590002bd6 ("block/nvme: convert to blk_io_plug_call() API")
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/nvme.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/nvme.c b/block/nvme.c
index 7ca85bc44a..b6e95f0b7e 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -501,8 +501,9 @@ static void nvme_submit_command(NVMeQueuePair *q, NVMeRequest *req,
            q->sq.tail * NVME_SQ_ENTRY_BYTES, cmd, sizeof(*cmd));
     q->sq.tail = (q->sq.tail + 1) % NVME_QUEUE_SIZE;
     q->need_kick++;
-    blk_io_plug_call(nvme_unplug_fn, q);
     qemu_mutex_unlock(&q->lock);
+
+    blk_io_plug_call(nvme_unplug_fn, q);
 }
 
 static void nvme_admin_cmd_sync_cb(void *opaque, int ret)

From d9458f990afa1633b99d0d897d3e48689d6a01ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 11 Jul 2023 17:14:40 +0200
Subject: [PATCH 0848/1353] s390x: Fix QEMU abort by selecting S390_FLIC_KVM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If QEMU is built with --without-default-devices, the s390-flic-kvm
device is missing and QEMU aborts when started with the KVM accelerator.
Make sure it's available by selecting S390_FLIC_KVM in Kconfig.

Consequently, this also fixes an abort in tests/qtest/migration-test.

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20230711151440.716822-1-clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/intc/Kconfig  | 1 -
 hw/s390x/Kconfig | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 21441d0a0c..97d550b06b 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -49,7 +49,6 @@ config S390_FLIC
 
 config S390_FLIC_KVM
     bool
-    default y
     depends on S390_FLIC && KVM
 
 config OMPIC
diff --git a/hw/s390x/Kconfig b/hw/s390x/Kconfig
index e8d4d68ece..4c068d7960 100644
--- a/hw/s390x/Kconfig
+++ b/hw/s390x/Kconfig
@@ -8,6 +8,7 @@ config S390_CCW_VIRTIO
     imply PCIE_DEVICES
     select PCI_EXPRESS
     select S390_FLIC
+    select S390_FLIC_KVM if KVM
     select SCLPCONSOLE
     select VIRTIO_CCW
     select MSI_NONBROKEN

From 7f114a580710b3b2a7e3a3a30e2096e804b0fcb6 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 27 Jun 2023 17:13:33 +0200
Subject: [PATCH 0849/1353] linux-user/elfload: Fix /proc/cpuinfo features: on
 s390x

elf_hwcap_str() takes a bit number, but compares it for equality with
the HWCAP_S390_* masks. This causes /proc/cpuinfo to display incorrect
hwcaps.

Fix by introducing the HWCAP_S390_NR_* constants and using them in
elf_hwcap_str() instead of the HWCAP_S390_*. While at it, add the
missing nnpa, pcimio and sie hwcaps from the latest kernel.

Output before:

	features	: esan3 zarch stfle msa

Output after:

	features	: esan3 zarch stfle msa ldisp eimm etf3eh highgprs vx vxe

Fixes: e19807bee357 ("linux-user/elfload: Introduce elf_hwcap_str() on s390x")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230627151356.273259-1-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 include/elf.h        | 66 +++++++++++++++++++++++++++++++-------------
 linux-user/elfload.c | 41 ++++++++++++++-------------
 2 files changed, 69 insertions(+), 38 deletions(-)

diff --git a/include/elf.h b/include/elf.h
index 2f4d0e56d1..ec9755e73b 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -596,25 +596,53 @@ typedef struct {
 
 /* Bits present in AT_HWCAP for s390.  */
 
-#define HWCAP_S390_ESAN3        1
-#define HWCAP_S390_ZARCH        2
-#define HWCAP_S390_STFLE        4
-#define HWCAP_S390_MSA          8
-#define HWCAP_S390_LDISP        16
-#define HWCAP_S390_EIMM         32
-#define HWCAP_S390_DFP          64
-#define HWCAP_S390_HPAGE        128
-#define HWCAP_S390_ETF3EH       256
-#define HWCAP_S390_HIGH_GPRS    512
-#define HWCAP_S390_TE           1024
-#define HWCAP_S390_VXRS         2048
-#define HWCAP_S390_VXRS_BCD     4096
-#define HWCAP_S390_VXRS_EXT     8192
-#define HWCAP_S390_GS           16384
-#define HWCAP_S390_VXRS_EXT2    32768
-#define HWCAP_S390_VXRS_PDE     65536
-#define HWCAP_S390_SORT         131072
-#define HWCAP_S390_DFLT         262144
+#define HWCAP_S390_NR_ESAN3      0
+#define HWCAP_S390_NR_ZARCH      1
+#define HWCAP_S390_NR_STFLE      2
+#define HWCAP_S390_NR_MSA        3
+#define HWCAP_S390_NR_LDISP      4
+#define HWCAP_S390_NR_EIMM       5
+#define HWCAP_S390_NR_DFP        6
+#define HWCAP_S390_NR_HPAGE      7
+#define HWCAP_S390_NR_ETF3EH     8
+#define HWCAP_S390_NR_HIGH_GPRS  9
+#define HWCAP_S390_NR_TE        10
+#define HWCAP_S390_NR_VXRS      11
+#define HWCAP_S390_NR_VXRS_BCD  12
+#define HWCAP_S390_NR_VXRS_EXT  13
+#define HWCAP_S390_NR_GS        14
+#define HWCAP_S390_NR_VXRS_EXT2 15
+#define HWCAP_S390_NR_VXRS_PDE  16
+#define HWCAP_S390_NR_SORT      17
+#define HWCAP_S390_NR_DFLT      18
+#define HWCAP_S390_NR_VXRS_PDE2 19
+#define HWCAP_S390_NR_NNPA      20
+#define HWCAP_S390_NR_PCI_MIO   21
+#define HWCAP_S390_NR_SIE       22
+
+#define HWCAP_S390_ESAN3     (1 << HWCAP_S390_NR_ESAN3)
+#define HWCAP_S390_ZARCH     (1 << HWCAP_S390_NR_ZARCH)
+#define HWCAP_S390_STFLE     (1 << HWCAP_S390_NR_STFLE)
+#define HWCAP_S390_MSA       (1 << HWCAP_S390_NR_MSA)
+#define HWCAP_S390_LDISP     (1 << HWCAP_S390_NR_LDISP)
+#define HWCAP_S390_EIMM      (1 << HWCAP_S390_NR_EIMM)
+#define HWCAP_S390_DFP       (1 << HWCAP_S390_NR_DFP)
+#define HWCAP_S390_HPAGE     (1 << HWCAP_S390_NR_HPAGE)
+#define HWCAP_S390_ETF3EH    (1 << HWCAP_S390_NR_ETF3EH)
+#define HWCAP_S390_HIGH_GPRS (1 << HWCAP_S390_NR_HIGH_GPRS)
+#define HWCAP_S390_TE        (1 << HWCAP_S390_NR_TE)
+#define HWCAP_S390_VXRS      (1 << HWCAP_S390_NR_VXRS)
+#define HWCAP_S390_VXRS_BCD  (1 << HWCAP_S390_NR_VXRS_BCD)
+#define HWCAP_S390_VXRS_EXT  (1 << HWCAP_S390_NR_VXRS_EXT)
+#define HWCAP_S390_GS        (1 << HWCAP_S390_NR_GS)
+#define HWCAP_S390_VXRS_EXT2 (1 << HWCAP_S390_NR_VXRS_EXT2)
+#define HWCAP_S390_VXRS_PDE  (1 << HWCAP_S390_NR_VXRS_PDE)
+#define HWCAP_S390_SORT      (1 << HWCAP_S390_NR_SORT)
+#define HWCAP_S390_DFLT      (1 << HWCAP_S390_NR_DFLT)
+#define HWCAP_S390_VXRS_PDE2 (1 << HWCAP_S390_NR_VXRS_PDE2)
+#define HWCAP_S390_NNPA      (1 << HWCAP_S390_NR_NNPA)
+#define HWCAP_S390_PCI_MIO   (1 << HWCAP_S390_NR_PCI_MIO)
+#define HWCAP_S390_SIE       (1 << HWCAP_S390_NR_SIE)
 
 /* M68K specific definitions. */
 /* We use the top 24 bits to encode information about the
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a26200d9f3..861ec07abc 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1621,25 +1621,28 @@ uint32_t get_elf_hwcap(void)
 const char *elf_hwcap_str(uint32_t bit)
 {
     static const char *hwcap_str[] = {
-        [HWCAP_S390_ESAN3]     = "esan3",
-        [HWCAP_S390_ZARCH]     = "zarch",
-        [HWCAP_S390_STFLE]     = "stfle",
-        [HWCAP_S390_MSA]       = "msa",
-        [HWCAP_S390_LDISP]     = "ldisp",
-        [HWCAP_S390_EIMM]      = "eimm",
-        [HWCAP_S390_DFP]       = "dfp",
-        [HWCAP_S390_HPAGE]     = "edat",
-        [HWCAP_S390_ETF3EH]    = "etf3eh",
-        [HWCAP_S390_HIGH_GPRS] = "highgprs",
-        [HWCAP_S390_TE]        = "te",
-        [HWCAP_S390_VXRS]      = "vx",
-        [HWCAP_S390_VXRS_BCD]  = "vxd",
-        [HWCAP_S390_VXRS_EXT]  = "vxe",
-        [HWCAP_S390_GS]        = "gs",
-        [HWCAP_S390_VXRS_EXT2] = "vxe2",
-        [HWCAP_S390_VXRS_PDE]  = "vxp",
-        [HWCAP_S390_SORT]      = "sort",
-        [HWCAP_S390_DFLT]      = "dflt",
+        [HWCAP_S390_NR_ESAN3]     = "esan3",
+        [HWCAP_S390_NR_ZARCH]     = "zarch",
+        [HWCAP_S390_NR_STFLE]     = "stfle",
+        [HWCAP_S390_NR_MSA]       = "msa",
+        [HWCAP_S390_NR_LDISP]     = "ldisp",
+        [HWCAP_S390_NR_EIMM]      = "eimm",
+        [HWCAP_S390_NR_DFP]       = "dfp",
+        [HWCAP_S390_NR_HPAGE]     = "edat",
+        [HWCAP_S390_NR_ETF3EH]    = "etf3eh",
+        [HWCAP_S390_NR_HIGH_GPRS] = "highgprs",
+        [HWCAP_S390_NR_TE]        = "te",
+        [HWCAP_S390_NR_VXRS]      = "vx",
+        [HWCAP_S390_NR_VXRS_BCD]  = "vxd",
+        [HWCAP_S390_NR_VXRS_EXT]  = "vxe",
+        [HWCAP_S390_NR_GS]        = "gs",
+        [HWCAP_S390_NR_VXRS_EXT2] = "vxe2",
+        [HWCAP_S390_NR_VXRS_PDE]  = "vxp",
+        [HWCAP_S390_NR_SORT]      = "sort",
+        [HWCAP_S390_NR_DFLT]      = "dflt",
+        [HWCAP_S390_NR_NNPA]      = "nnpa",
+        [HWCAP_S390_NR_PCI_MIO]   = "pcimio",
+        [HWCAP_S390_NR_SIE]       = "sie",
     };
 
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;

From 94aaf6d8a589490706e8cdc1ae725743f101124a Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Tue, 11 Jul 2023 18:21:31 -0300
Subject: [PATCH 0850/1353] tests/qtest: Fix typo in multifd cancel test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This wasn't noticed because the test is currently disabled.

Fixes: 02f56e3de ("tests/qtest: massively speed up migration-test")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-Id: <20230711212131.2370-1-farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/qtest/migration-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index efa8c729db..e256da1216 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -2481,7 +2481,7 @@ static void test_multifd_tcp_cancel(void)
 
     migrate_qmp(from, uri, "{}");
 
-    migrate_wait_for_dirty_mem(from, to);
+    migrate_wait_for_dirty_mem(from, to2);
 
     migrate_ensure_converge(from);
 

From 03e596de1789af2d6d3ef222268642ee34c08a1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 16:49:19 +0200
Subject: [PATCH 0851/1353] tests/lcitool: Generate distribution packages list
 in JSON format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the generate_pkglist() helper to generate a list of packages
required by a distribution to build QEMU.

Since we can not add a "THIS FILE WAS AUTO-GENERATED" comment in
JSON, create the files under tests/vm/generated/ sub-directory;
add a README mentioning the files are generated.

Suggested-by: Erik Skultety <eskultet@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Message-Id: <20230711144922.67491-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/lcitool/refresh     | 11 +++++++++++
 tests/vm/generated/README |  5 +++++
 2 files changed, 16 insertions(+)
 create mode 100644 tests/vm/generated/README

diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index b54566edcc..4584870ea1 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -84,6 +84,12 @@ def generate_cirrus(target, trailer=None):
     generate(filename, cmd, trailer)
 
 
+def generate_pkglist(vm, target):
+    filename = Path(src_dir, "tests", "vm", "generated", vm + ".json")
+    cmd = lcitool_cmd + ["variables", "--format", "json", target, "qemu"]
+    generate(filename, cmd, None)
+
+
 # Netmap still needs to be manually built as it is yet to be packaged
 # into a distro. We also add cscope and gtags which are used in the CI
 # test
@@ -191,6 +197,11 @@ try:
     generate_cirrus("freebsd-13")
     generate_cirrus("macos-12")
 
+    #
+    # VM packages lists
+    #
+    generate_pkglist("freebsd", "freebsd-13")
+
     sys.exit(0)
 except Exception as ex:
     print(str(ex), file=sys.stderr)
diff --git a/tests/vm/generated/README b/tests/vm/generated/README
new file mode 100644
index 0000000000..7ccc6ffd3d
--- /dev/null
+++ b/tests/vm/generated/README
@@ -0,0 +1,5 @@
+# FILES IN THIS FOLDER WERE AUTO-GENERATED
+#
+#  $ make lcitool-refresh
+#
+# https://gitlab.com/libvirt/libvirt-ci

From a38dee6695b07a90f157e6eb592f91cef3849bfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 16:49:20 +0200
Subject: [PATCH 0852/1353] tests/lcitool: Refresh generated files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refresh the generated files by running:

  $ make lcitool-refresh

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230711144922.67491-3-philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
[thuth: Drop changes to libpmem-dev and libxen-dev]
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/vm/generated/freebsd.json | 77 +++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 tests/vm/generated/freebsd.json

diff --git a/tests/vm/generated/freebsd.json b/tests/vm/generated/freebsd.json
new file mode 100644
index 0000000000..7c435cf23e
--- /dev/null
+++ b/tests/vm/generated/freebsd.json
@@ -0,0 +1,77 @@
+{
+  "ccache": "/usr/local/bin/ccache",
+  "cpan_pkgs": [],
+  "cross_pkgs": [],
+  "make": "/usr/local/bin/gmake",
+  "ninja": "/usr/local/bin/ninja",
+  "packaging_command": "pkg",
+  "pip3": "/usr/local/bin/pip-3.8",
+  "pkgs": [
+    "alsa-lib",
+    "bash",
+    "bison",
+    "bzip2",
+    "ca_root_nss",
+    "capstone4",
+    "ccache",
+    "cmocka",
+    "ctags",
+    "curl",
+    "cyrus-sasl",
+    "dbus",
+    "diffutils",
+    "dtc",
+    "flex",
+    "fusefs-libs3",
+    "gettext",
+    "git",
+    "glib",
+    "gmake",
+    "gnutls",
+    "gsed",
+    "gtk3",
+    "json-c",
+    "libepoxy",
+    "libffi",
+    "libgcrypt",
+    "libjpeg-turbo",
+    "libnfs",
+    "libslirp",
+    "libspice-server",
+    "libssh",
+    "libtasn1",
+    "llvm",
+    "lzo2",
+    "meson",
+    "mtools",
+    "ncurses",
+    "nettle",
+    "ninja",
+    "opencv",
+    "pixman",
+    "pkgconf",
+    "png",
+    "py39-numpy",
+    "py39-pillow",
+    "py39-pip",
+    "py39-sphinx",
+    "py39-sphinx_rtd_theme",
+    "py39-yaml",
+    "python3",
+    "rpm2cpio",
+    "sdl2",
+    "sdl2_image",
+    "snappy",
+    "sndio",
+    "socat",
+    "spice-protocol",
+    "tesseract",
+    "usbredir",
+    "virglrenderer",
+    "vte3",
+    "xorriso",
+    "zstd"
+  ],
+  "pypi_pkgs": [],
+  "python": "/usr/local/bin/python3"
+}

From 4cd57671b777632be2dc20bc2f5a0410e258e3dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 16:49:21 +0200
Subject: [PATCH 0853/1353] tests/vm: Introduce
 get_qemu_packages_from_lcitool_json() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the get_qemu_packages_from_lcitool_json() helper which return
such package list from a lcitool env var file in JSON format.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230711144922.67491-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/vm/basevm.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/vm/basevm.py b/tests/vm/basevm.py
index 23229e23d1..a97e23b0ce 100644
--- a/tests/vm/basevm.py
+++ b/tests/vm/basevm.py
@@ -27,6 +27,7 @@ import shutil
 import multiprocessing
 import traceback
 import shlex
+import json
 
 from qemu.machine import QEMUMachine
 from qemu.utils import get_info_usernet_hostfwd_port, kvm_available
@@ -501,6 +502,16 @@ class BaseVM(object):
                               stderr=self._stdout)
         return os.path.join(cidir, "cloud-init.iso")
 
+    def get_qemu_packages_from_lcitool_json(self, json_path=None):
+        """Parse a lcitool variables json file and return the PKGS list."""
+        if json_path is None:
+            json_path = os.path.join(
+                os.path.dirname(__file__), "generated", self.name + ".json"
+            )
+        with open(json_path, "r") as fh:
+            return json.load(fh)["pkgs"]
+
+
 def get_qemu_path(arch, build_path=None):
     """Fetch the path to the qemu binary."""
     # If QEMU environment variable set, it takes precedence

From ca2a07f6c3630d5d39af24651987256a705ac500 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 11 Jul 2023 16:49:22 +0200
Subject: [PATCH 0854/1353] tests/vm/freebsd: Get up-to-date package list from
 lcitool vars file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Get an up-to-date package list from lcitool, that way we
don't need to manually keep this array in sync.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Inspired-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230711144922.67491-5-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/vm/freebsd | 42 ++----------------------------------------
 1 file changed, 2 insertions(+), 40 deletions(-)

diff --git a/tests/vm/freebsd b/tests/vm/freebsd
index 11de6473f4..ac51376c82 100755
--- a/tests/vm/freebsd
+++ b/tests/vm/freebsd
@@ -31,45 +31,6 @@ class FreeBSDVM(basevm.BaseVM):
     link = "https://download.freebsd.org/releases/CI-IMAGES/13.2-RELEASE/amd64/Latest/FreeBSD-13.2-RELEASE-amd64-BASIC-CI.raw.xz"
     csum = "a4fb3b6c7b75dd4d58fb0d75e4caf72844bffe0ca00e66459c028b198ffb3c0e"
     size = "20G"
-    pkgs = [
-        # build tools
-        "git",
-        "pkgconf",
-        "bzip2",
-        "python39",
-        "ninja",
-
-        # gnu tools
-        "bash",
-        "gmake",
-        "gsed",
-        "gettext",
-
-        # libs: crypto
-        "gnutls",
-
-        # libs: images
-        "jpeg-turbo",
-        "png",
-
-        # libs: ui
-        "sdl2",
-        "gtk3",
-        "libxkbcommon",
-
-        # libs: opengl
-        "libepoxy",
-        "mesa-libs",
-
-        # libs: migration
-        "zstd",
-
-        # libs: networking
-        "libslirp",
-
-        # libs: sndio
-        "sndio",
-    ]
 
     BUILD_SCRIPT = """
         set -e;
@@ -151,8 +112,9 @@ class FreeBSDVM(basevm.BaseVM):
         self.console_wait(prompt)
         self.console_send("echo 'chmod 666 /dev/vtbd1' >> /etc/rc.local\n")
 
+        pkgs = self.get_qemu_packages_from_lcitool_json()
         self.print_step("Installing packages")
-        self.ssh_root_check("pkg install -y %s\n" % " ".join(self.pkgs))
+        self.ssh_root_check("pkg install -y %s\n" % " ".join(pkgs))
 
         # shutdown
         self.ssh_root(self.poweroff)

From a5754847e0fc2bc08a414dd381803009e8bca390 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 10 Jul 2023 19:01:55 +0200
Subject: [PATCH 0855/1353] tests/avocado: Disable the
 test_sbsaref_edk2_firmware by default

The test fails occasionally, see e.g.:

 https://gitlab.com/thuth/qemu/-/jobs/4196177756#L489
 https://gitlab.com/thuth/qemu/-/jobs/4623296271#L290

It also fails on my laptop in ca. 50% of all runs. Thus disable it by
default by using the QEMU_TEST_FLAKY_TESTS environment variable to fence
it (which we also already use in flaky qtests). While we're at it, also
document this variable in docs/devel/testing.rst.

Message-Id: <20230710170155.7192-1-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/devel/testing.rst                   | 5 +++++
 tests/avocado/machine_aarch64_sbsaref.py | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/devel/testing.rst b/docs/devel/testing.rst
index fb651eae11..b6ad21bed1 100644
--- a/docs/devel/testing.rst
+++ b/docs/devel/testing.rst
@@ -1384,6 +1384,11 @@ variable as shown on the code snippet below to skip the test:
   def test(self):
       do_something()
 
+QEMU_TEST_FLAKY_TESTS
+^^^^^^^^^^^^^^^^^^^^^
+Some tests are not working reliably and thus are disabled by default.
+Set this environment variable to enable them.
+
 Uninstalling Avocado
 ~~~~~~~~~~~~~~~~~~~~
 
diff --git a/tests/avocado/machine_aarch64_sbsaref.py b/tests/avocado/machine_aarch64_sbsaref.py
index cce6ef9f65..a794245e7e 100644
--- a/tests/avocado/machine_aarch64_sbsaref.py
+++ b/tests/avocado/machine_aarch64_sbsaref.py
@@ -8,7 +8,6 @@
 
 import os
 
-from avocado import skip
 from avocado import skipUnless
 from avocado.utils import archive
 
@@ -76,6 +75,7 @@ class Aarch64SbsarefMachine(QemuSystemTest):
             "sbsa-ref",
         )
 
+    @skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'), 'Test is not reliable')
     def test_sbsaref_edk2_firmware(self):
         """
         :avocado: tags=cpu:cortex-a57

From 15ad98536ad9410fb32ddf1ff09389b677643faa Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 17 Jul 2023 08:37:17 +0200
Subject: [PATCH 0856/1353] linux-user: Fix qemu brk() to not zero bytes on
 current page

The qemu brk() implementation is too aggressive and cleans remaining bytes
on the current page above the last brk address.

But some existing applications are buggy and read/write bytes above their
current heap address. On a phyiscal machine this does not trigger a
runtime error as long as the access happens on the same page. Additionally
the Linux kernel allocates only full pages and does no zeroing on already
allocated pages, even if the brk address is lowered.

Fix qemu to behave the same way as the kernel does. Do not touch already
allocated pages, and - when running with different page sizes of guest and
host - zero out only those memory areas where the host page size is bigger
than the guest page size.

Signed-off-by: Helge Deller <deller@gmx.de>
Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Cc: qemu-stable@nongnu.org
Buglink: https://github.com/upx/upx/issues/683
---
 linux-user/syscall.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index c99ef9c01e..ee54eed33b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -829,10 +829,8 @@ abi_long do_brk(abi_ulong brk_val)
 
     /* brk_val and old target_brk might be on the same page */
     if (new_brk == TARGET_PAGE_ALIGN(target_brk)) {
-        if (brk_val > target_brk) {
-            /* empty remaining bytes in (possibly larger) host page */
-            memset(g2h_untagged(target_brk), 0, new_host_brk_page - target_brk);
-        }
+        /* empty remaining bytes in (possibly larger) host page */
+        memset(g2h_untagged(new_brk), 0, new_host_brk_page - new_brk);
         target_brk = brk_val;
         return target_brk;
     }
@@ -840,7 +838,7 @@ abi_long do_brk(abi_ulong brk_val)
     /* Release heap if necesary */
     if (new_brk < target_brk) {
         /* empty remaining bytes in (possibly larger) host page */
-        memset(g2h_untagged(brk_val), 0, new_host_brk_page - brk_val);
+        memset(g2h_untagged(new_brk), 0, new_host_brk_page - new_brk);
 
         /* free unused host pages and set new brk_page */
         target_munmap(new_host_brk_page, brk_page - new_host_brk_page);
@@ -873,7 +871,7 @@ abi_long do_brk(abi_ulong brk_val)
          * come from the remaining part of the previous page: it may
          * contains garbage data due to a previous heap usage (grown
          * then shrunken).  */
-        memset(g2h_untagged(target_brk), 0, brk_page - target_brk);
+        memset(g2h_untagged(brk_page), 0, HOST_PAGE_ALIGN(brk_page) - brk_page);
 
         target_brk = brk_val;
         brk_page = new_host_brk_page;

From dfe49864afb06e7e452a4366051697bc4fcfc1a5 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 17 Jul 2023 12:27:13 +0200
Subject: [PATCH 0857/1353] linux-user: Prohibit brk() to to shrink below
 initial heap address

Since commit 86f04735ac ("linux-user: Fix brk() to release pages") it's
possible for userspace applications to reduce their memory footprint by
calling brk() with a lower address and free up memory. Before that commit
guest heap memory was never unmapped.

But the Linux kernel prohibits to reduce brk() below the initial memory
address which is set at startup by the set_brk() function in binfmt_elf.c.
Such a range check was missed in commit 86f04735ac.

This patch adds the missing check by storing the initial brk value in
initial_target_brk and verify any new brk addresses against that value.

Tested with the i386 upx binary from
https://github.com/upx/upx/releases/download/v4.0.2/upx-4.0.2-i386_linux.tar.xz

Signed-off-by: Helge Deller <deller@gmx.de>
Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Cc: qemu-stable@nongnu.org
Buglink: https://github.com/upx/upx/issues/683
---
 linux-user/syscall.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ee54eed33b..125fcbe423 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -801,12 +801,13 @@ static inline int host_to_target_sock_type(int host_type)
     return target_type;
 }
 
-static abi_ulong target_brk;
+static abi_ulong target_brk, initial_target_brk;
 static abi_ulong brk_page;
 
 void target_set_brk(abi_ulong new_brk)
 {
     target_brk = TARGET_PAGE_ALIGN(new_brk);
+    initial_target_brk = target_brk;
     brk_page = HOST_PAGE_ALIGN(target_brk);
 }
 
@@ -824,6 +825,11 @@ abi_long do_brk(abi_ulong brk_val)
         return target_brk;
     }
 
+    /* do not allow to shrink below initial brk value */
+    if (brk_val < initial_target_brk) {
+        brk_val = initial_target_brk;
+    }
+
     new_brk = TARGET_PAGE_ALIGN(brk_val);
     new_host_brk_page = HOST_PAGE_ALIGN(brk_val);
 

From eac78a4b0b7da4de2c0a297f4d528ca9cc6256a3 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 17 Jul 2023 12:39:38 +0200
Subject: [PATCH 0858/1353] linux-user: Fix signed math overflow in brk()
 syscall
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix the math overflow when calculating the new_malloc_size.

new_host_brk_page and brk_page are unsigned integers. If userspace
reduces the heap, new_host_brk_page is lower than brk_page which results
in a huge positive number (but should actually be negative).

Fix it by adding a proper check and as such make the code more readable.

Signed-off-by: Helge Deller <deller@gmx.de>
Tested-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Cc: qemu-stable@nongnu.org
Buglink: https://github.com/upx/upx/issues/683
---
 linux-user/syscall.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 125fcbe423..95727a816a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -860,12 +860,13 @@ abi_long do_brk(abi_ulong brk_val)
      * itself); instead we treat "mapped but at wrong address" as
      * a failure and unmap again.
      */
-    new_alloc_size = new_host_brk_page - brk_page;
-    if (new_alloc_size) {
+    if (new_host_brk_page > brk_page) {
+        new_alloc_size = new_host_brk_page - brk_page;
         mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
                                         PROT_READ|PROT_WRITE,
                                         MAP_ANON|MAP_PRIVATE, 0, 0));
     } else {
+        new_alloc_size = 0;
         mapped_addr = brk_page;
     }
 

From d971040c2d16b7fda9fcd52c993262b437501538 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 17 Jul 2023 19:06:32 +0200
Subject: [PATCH 0859/1353] linux-user: Fix strace output for old_mmap

The old_mmap syscall (e.g. on i386) hands over the parameters in
a struct. Adjust the strace output to print the correct values.

Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: John Reiser <jreiser@BitWagon.com>
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1760
---
 linux-user/strace.c | 47 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 44 insertions(+), 3 deletions(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index bbd29148d4..e0ab8046ec 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -3767,10 +3767,24 @@ print_utimensat(CPUArchState *cpu_env, const struct syscallname *name,
 
 #if defined(TARGET_NR_mmap) || defined(TARGET_NR_mmap2)
 static void
-print_mmap(CPUArchState *cpu_env, const struct syscallname *name,
+print_mmap_both(CPUArchState *cpu_env, const struct syscallname *name,
            abi_long arg0, abi_long arg1, abi_long arg2,
-           abi_long arg3, abi_long arg4, abi_long arg5)
+           abi_long arg3, abi_long arg4, abi_long arg5,
+           bool is_old_mmap)
 {
+    if (is_old_mmap) {
+            abi_ulong *v;
+            abi_ulong argp = arg0;
+            if (!(v = lock_user(VERIFY_READ, argp, 6 * sizeof(abi_ulong), 1)))
+                return;
+            arg0 = tswapal(v[0]);
+            arg1 = tswapal(v[1]);
+            arg2 = tswapal(v[2]);
+            arg3 = tswapal(v[3]);
+            arg4 = tswapal(v[4]);
+            arg5 = tswapal(v[5]);
+            unlock_user(v, argp, 0);
+        }
     print_syscall_prologue(name);
     print_pointer(arg0, 0);
     print_raw_param("%d", arg1, 0);
@@ -3780,7 +3794,34 @@ print_mmap(CPUArchState *cpu_env, const struct syscallname *name,
     print_raw_param("%#x", arg5, 1);
     print_syscall_epilogue(name);
 }
-#define print_mmap2     print_mmap
+#endif
+
+#if defined(TARGET_NR_mmap)
+static void
+print_mmap(CPUArchState *cpu_env, const struct syscallname *name,
+           abi_long arg0, abi_long arg1, abi_long arg2,
+           abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    return print_mmap_both(cpu_env, name, arg0, arg1, arg2, arg3,
+                           arg4, arg5,
+#if defined(TARGET_NR_mmap2)
+                            true
+#else
+                            false
+#endif
+                            );
+}
+#endif
+
+#if defined(TARGET_NR_mmap2)
+static void
+print_mmap2(CPUArchState *cpu_env, const struct syscallname *name,
+           abi_long arg0, abi_long arg1, abi_long arg2,
+           abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    return print_mmap_both(cpu_env, name, arg0, arg1, arg2, arg3,
+                           arg4, arg5, false);
+}
 #endif
 
 #ifdef TARGET_NR_mprotect

From 518f32221af759a29500ac172c4c857bef142067 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 17 Jul 2023 22:06:02 +0200
Subject: [PATCH 0860/1353] linux-user: Fix qemu-arm to run static armhf
 binaries

qemu-user crashes immediately when running static binaries on the armhf
architecture. The problem is the memory layout where the executable is
loaded before the interpreter library, in which case the reserved brk
region clashes with the interpreter code and is released before qemu
tries to start the program.

At load time qemu calculates a brk value for interpreter and executable
each.  The fix is to choose the higher one of both.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Andreas Schwab <schwab@suse.de>
Cc: qemu-stable@nongnu.org
Reported-by:  Venkata.Pyla@toshiba-tsip.com
Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040981
---
 linux-user/elfload.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a26200d9f3..94951630b1 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3615,6 +3615,13 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
 
     if (elf_interpreter) {
         load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
+        /*
+         * adjust brk address if the interpreter was loaded above the main
+         * executable, e.g. happens with static binaries on armhf
+         */
+        if (interp_info.brk > info->brk) {
+            info->brk = interp_info.brk;
+        }
 
         /* If the program interpreter is one of these two, then assume
            an iBCS2 image.  Otherwise assume a native linux image.  */

From 542c8776cabd94c8afa0524e989bc26119b42d10 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 12 Jul 2023 11:37:28 -0300
Subject: [PATCH 0861/1353] docs/system/target-riscv.rst: tidy CPU firmware
 section

This is how the content of the "RISC-V CPU firmware" section is
displayed after the html is generated:

"When using the sifive_u or virt machine there are three different
firmware boot options: 1. -bios default - This is the default behaviour
if no -bios option is included. (...) 3. -bios <file> - Tells QEMU to
load the specified file as the firmware."

It's all in the same paragraph, in a numbered list, and no special
formatting for the options.

Tidy it a bit by adding line breaks between items and its description.
Remove the numbered list. And apply formatting for the options cited in
the middle of the text.

Cc: qemu-trivial@nongnu.org
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230712143728.383528-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/target-riscv.rst | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index 89a866e4f4..ba195f1518 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -76,11 +76,19 @@ RISC-V CPU firmware
 
 When using the ``sifive_u`` or ``virt`` machine there are three different
 firmware boot options:
-1. ``-bios default`` - This is the default behaviour if no -bios option
-is included. This option will load the default OpenSBI firmware automatically.
-The firmware is included with the QEMU release and no user interaction is
-required. All a user needs to do is specify the kernel they want to boot
-with the -kernel option
-2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
-to the user to load all the images they need.
-3. ``-bios <file>`` - Tells QEMU to load the specified file as the firmware.
+
+* ``-bios default``
+
+This is the default behaviour if no ``-bios`` option is included. This option
+will load the default OpenSBI firmware automatically. The firmware is included
+with the QEMU release and no user interaction is required. All a user needs to
+do is specify the kernel they want to boot with the ``-kernel`` option
+
+* ``-bios none``
+
+QEMU will not automatically load any firmware. It is up to the user to load all
+the images they need.
+
+* ``-bios <file>``
+
+Tells QEMU to load the specified file as the firmware.

From 36df75a0a903c8ba3e2e28eb7162c43f8dd5d8f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christoph=20M=C3=BCllner?= <christoph.muellner@vrull.eu>
Date: Tue, 11 Jul 2023 09:50:51 +0200
Subject: [PATCH 0862/1353] riscv/disas: Fix disas output of upper immediates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The GNU assembler produces the following output for instructions
with upper immediates:
    00002597                auipc   a1,0x2
    000024b7                lui     s1,0x2
    6409                    lui     s0,0x2 # c.lui

The immediate operands of upper immediates are not shifted.

However, the QEMU disassembler prints them shifted:
    00002597          auipc                   a1,8192
    000024b7          lui                     s1,8192
    6409              lui                     s0,8192 # c.lui

The current implementation extracts the immediate bits and shifts the by 12,
so the internal representation of the immediate is the actual immediate.
However, the immediates are later printed using rv_fmt_rd_imm or
rv_fmt_rd_offset, which don't undo the shift.

Let's fix this by using specific output formats for instructions
with upper immediates, that take care of the shift.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230711075051.1531007-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 19 ++++++++++++++++---
 disas/riscv.h |  2 ++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index cd7b6e86a7..3873a69157 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -1135,8 +1135,8 @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
 
 const rv_opcode_data rvi_opcode_data[] = {
     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-    { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
-    { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
+    { "lui", rv_codec_u, rv_fmt_rd_uimm, NULL, 0, 0, 0 },
+    { "auipc", rv_codec_u, rv_fmt_rd_uoffset, NULL, 0, 0, 0 },
     { "jal", rv_codec_uj, rv_fmt_rd_offset, rvcp_jal, 0, 0, 0 },
     { "jalr", rv_codec_i, rv_fmt_rd_rs1_offset, rvcp_jalr, 0, 0, 0 },
     { "beq", rv_codec_sb, rv_fmt_rs1_rs2_offset, rvcp_beq, 0, 0, 0 },
@@ -1382,7 +1382,7 @@ const rv_opcode_data rvi_opcode_data[] = {
       rv_op_addi },
     { "c.addi16sp", rv_codec_ci_16sp, rv_fmt_rd_rs1_imm, NULL, rv_op_addi,
       rv_op_addi, rv_op_addi, rvcd_imm_nz },
-    { "c.lui", rv_codec_ci_lui, rv_fmt_rd_imm, NULL, rv_op_lui, rv_op_lui,
+    { "c.lui", rv_codec_ci_lui, rv_fmt_rd_uimm, NULL, rv_op_lui, rv_op_lui,
       rv_op_lui, rvcd_imm_nz },
     { "c.srli", rv_codec_cb_sh6, rv_fmt_rd_rs1_imm, NULL, rv_op_srli,
       rv_op_srli, rv_op_srli, rvcd_imm_nz },
@@ -4694,6 +4694,19 @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
                 dec->pc + dec->imm);
             append(buf, tmp, buflen);
             break;
+        case 'U':
+            fmt++;
+            snprintf(tmp, sizeof(tmp), "%d", dec->imm >> 12);
+            append(buf, tmp, buflen);
+            if (*fmt == 'o') {
+                while (strlen(buf) < tab * 2) {
+                    append(buf, " ", buflen);
+                }
+                snprintf(tmp, sizeof(tmp), "# 0x%" PRIx64,
+                    dec->pc + dec->imm);
+                append(buf, tmp, buflen);
+            }
+            break;
         case 'c': {
             const char *name = csr_name(dec->imm & 0xfff);
             if (name) {
diff --git a/disas/riscv.h b/disas/riscv.h
index 9cf901fc1e..8abb578b51 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -227,7 +227,9 @@ enum {
 #define rv_fmt_pred_succ              "O\tp,s"
 #define rv_fmt_rs1_rs2                "O\t1,2"
 #define rv_fmt_rd_imm                 "O\t0,i"
+#define rv_fmt_rd_uimm                "O\t0,Ui"
 #define rv_fmt_rd_offset              "O\t0,o"
+#define rv_fmt_rd_uoffset             "O\t0,Uo"
 #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 #define rv_fmt_frd_rs1                "O\t3,1"
 #define rv_fmt_frd_rs1_rs2            "O\t3,1,2"

From 55ea47397d07db2eb67cb7e86b4e7772098ece5f Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Mon, 17 Jul 2023 12:41:41 -0300
Subject: [PATCH 0863/1353] target/riscv/cpu.c: check priv_ver before
 auto-enable zca/zcd/zcf

Commit bd30559568 made changes in how we're checking and disabling
extensions based on env->priv_ver. One of the changes was to move the
extension disablement code to the end of realize(), being able to
disable extensions after we've auto-enabled some of them.

An unfortunate side effect of this change started to happen with CPUs
that has an older priv version, like sifive-u54. Starting on commit
2288a5ce43e5 we're auto-enabling zca, zcd and zcf if RVC is enabled,
but these extensions are priv version 1.12.0. When running a cpu that
has an older priv ver (like sifive-u54) the user is spammed with
warnings like these:

qemu-system-riscv64: warning: disabling zca extension for hart 0x0000000000000000 because privilege spec version does not match
qemu-system-riscv64: warning: disabling zcd extension for hart 0x0000000000000000 because privilege spec version does not match

The warnings are part of the code that disables the extension, but in this
case we're throwing user warnings for stuff that we enabled on our own,
without user intervention. Users are left wondering what they did wrong.

A quick 8.1 fix for this nuisance is to check the CPU priv spec before
auto-enabling zca/zcd/zcf. A more appropriate fix will include a more
robust framework that will account for both priv_ver and user choice
when auto-enabling/disabling extensions, but for 8.1 we'll make it do
with this simple check.

It's also worth noticing that this is the only case where we're
auto-enabling extensions based on a criteria (in this case RVC) that
doesn't match the priv spec of the extensions we're enabling. There's no
need for more 8.1 band-aids.

Cc: Conor Dooley <conor@kernel.org>
Fixes: 2288a5ce43e5 ("target/riscv: add cfg properties for Zc* extension")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Tested-by: Conor Dooley <conor.dooley@microchip.com>
Message-Id: <20230717154141.60898-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 9339c0241d..6b93b04453 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1225,7 +1225,8 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         }
     }
 
-    if (riscv_has_ext(env, RVC)) {
+    /* zca, zcd and zcf has a PRIV 1.12.0 restriction */
+    if (riscv_has_ext(env, RVC) && env->priv_ver >= PRIV_VERSION_1_12_0) {
         cpu->cfg.ext_zca = true;
         if (riscv_has_ext(env, RVF) && env->misa_mxl_max == MXL_RV32) {
             cpu->cfg.ext_zcf = true;

From a916dc954bb5d5aebe5bfcc222cbe9f984118442 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Tue, 18 Jul 2023 16:07:12 +0800
Subject: [PATCH 0864/1353] hw/riscv: Fix typo field in error_report

"smp.cpus" means the number of online CPUs and "smp.max_cpus" means the
total number of CPUs.

riscv_numa_get_default_cpu_node_id() checks "smp.cpus" and the
"available CPUs" description in the next error message also indicates
online CPUs.

So report "smp.cpus" in error_report() instand of "smp.max_cpus".

Since "smp.cpus" is "unsigned int", use "%u".

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230718080712.503333-1-zhao1.liu@linux.intel.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/numa.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/numa.c b/hw/riscv/numa.c
index e0414d5b1b..d319aefb45 100644
--- a/hw/riscv/numa.c
+++ b/hw/riscv/numa.c
@@ -209,8 +209,8 @@ int64_t riscv_numa_get_default_cpu_node_id(const MachineState *ms, int idx)
 
     if (ms->numa_state->num_nodes > ms->smp.cpus) {
         error_report("Number of NUMA nodes (%d)"
-                     " cannot exceed the number of available CPUs (%d).",
-                     ms->numa_state->num_nodes, ms->smp.max_cpus);
+                     " cannot exceed the number of available CPUs (%u).",
+                     ms->numa_state->num_nodes, ms->smp.cpus);
         exit(EXIT_FAILURE);
     }
     if (ms->numa_state->num_nodes) {

From 32be32509987fbe42cf5c2fd3cea3c2ad6eae179 Mon Sep 17 00:00:00 2001
From: Rob Bradford <rbradford@rivosinc.com>
Date: Tue, 18 Jul 2023 14:11:44 +0100
Subject: [PATCH 0865/1353] target/riscv: Fix LMUL check to use VLEN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous check was failing with:

VLEN=128 ELEN = 64 SEW = 16 and LMUL = 1/8 which is a
valid combination.

Fix the check to allow valid combinations when VLEN is a multiple of
ELEN.

From the specification:

"In general, the requirement is to support LMUL ≥ SEWMIN/ELEN, where
SEWMIN is the narrowest supported SEW value and ELEN is the widest
supported SEW value. In the standard extensions, SEWMIN=8. For standard
vector extensions with ELEN=32, fractional LMULs of 1/2 and 1/4 must be
supported. For standard vector extensions with ELEN=64, fractional LMULs
of 1/2, 1/4, and 1/8 must be supported." Elsewhere in the specification
it makes clear that VLEN>=ELEN.

From inspection this new check allows:

VLEN=ELEN=64 1/2, 1/4, 1/8 for SEW >=8
VLEN=ELEN=32 1/2, 1/4 for SEW >=8

Fixes: d9b7609a1fb2 ("target/riscv: rvv-1.0: configure instructions")
Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230718131316.12283-2-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index cfacf2ebba..4d06754826 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -43,9 +43,9 @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
                                             xlen - 1 - R_VTYPE_RESERVED_SHIFT);
 
     if (lmul & 4) {
-        /* Fractional LMUL. */
+        /* Fractional LMUL - check LMUL * VLEN >= SEW */
         if (lmul == 4 ||
-            cpu->cfg.elen >> (8 - lmul) < sew) {
+            cpu->cfg.vlen >> (8 - lmul) < sew) {
             vill = true;
         }
     }

From ea3c76f1494d0c75873c3b470e6e048202661ad8 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 18 Jul 2023 11:44:17 +0200
Subject: [PATCH 0866/1353] hw/nvme: fix endianness issue for shadow doorbells
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit 2fda0726e514 ("hw/nvme: fix missing endian conversions for
doorbell buffers"), we fixed shadow doorbells for big-endian guests
running on little endian hosts. But I did not fix little-endian guests
on big-endian hosts. Fix this.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1765
Fixes: 3f7fe8de3d49 ("hw/nvme: Implement shadow doorbell buffer support")
Cc: qemu-stable@nongnu.org
Reported-by: Thomas Huth <thuth@redhat.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 8e8e870b9a..dadc2dc7da 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -6801,6 +6801,7 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
     PCIDevice *pci = PCI_DEVICE(n);
     uint64_t dbs_addr = le64_to_cpu(req->cmd.dptr.prp1);
     uint64_t eis_addr = le64_to_cpu(req->cmd.dptr.prp2);
+    uint32_t v;
     int i;
 
     /* Address should be page aligned */
@@ -6818,6 +6819,8 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
         NvmeCQueue *cq = n->cq[i];
 
         if (sq) {
+            v = cpu_to_le32(sq->tail);
+
             /*
              * CAP.DSTRD is 0, so offset of ith sq db_addr is (i<<3)
              * nvme_process_db() uses this hard-coded way to calculate
@@ -6825,7 +6828,7 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
              */
             sq->db_addr = dbs_addr + (i << 3);
             sq->ei_addr = eis_addr + (i << 3);
-            pci_dma_write(pci, sq->db_addr, &sq->tail, sizeof(sq->tail));
+            pci_dma_write(pci, sq->db_addr, &v, sizeof(sq->tail));
 
             if (n->params.ioeventfd && sq->sqid != 0) {
                 if (!nvme_init_sq_ioeventfd(sq)) {
@@ -6835,10 +6838,12 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
         }
 
         if (cq) {
+            v = cpu_to_le32(cq->head);
+
             /* CAP.DSTRD is 0, so offset of ith cq db_addr is (i<<3)+(1<<2) */
             cq->db_addr = dbs_addr + (i << 3) + (1 << 2);
             cq->ei_addr = eis_addr + (i << 3) + (1 << 2);
-            pci_dma_write(pci, cq->db_addr, &cq->head, sizeof(cq->head));
+            pci_dma_write(pci, cq->db_addr, &v, sizeof(cq->head));
 
             if (n->params.ioeventfd && cq->cqid != 0) {
                 if (!nvme_init_cq_ioeventfd(cq)) {
@@ -7587,7 +7592,7 @@ static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
 static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
 {
     PCIDevice *pci = PCI_DEVICE(n);
-    uint32_t qid;
+    uint32_t qid, v;
 
     if (unlikely(addr & ((1 << 2) - 1))) {
         NVME_GUEST_ERR(pci_nvme_ub_db_wr_misaligned,
@@ -7654,7 +7659,8 @@ static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
         start_sqs = nvme_cq_full(cq) ? 1 : 0;
         cq->head = new_head;
         if (!qid && n->dbbuf_enabled) {
-            pci_dma_write(pci, cq->db_addr, &cq->head, sizeof(cq->head));
+            v = cpu_to_le32(cq->head);
+            pci_dma_write(pci, cq->db_addr, &v, sizeof(cq->head));
         }
         if (start_sqs) {
             NvmeSQueue *sq;
@@ -7714,6 +7720,8 @@ static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
 
         sq->tail = new_tail;
         if (!qid && n->dbbuf_enabled) {
+            v = cpu_to_le32(sq->tail);
+
             /*
              * The spec states "the host shall also update the controller's
              * corresponding doorbell property to match the value of that entry
@@ -7727,7 +7735,7 @@ static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
              * including ones that run on Linux, are not updating Admin Queues,
              * so we can't trust reading it for an appropriate sq tail.
              */
-            pci_dma_write(pci, sq->db_addr, &sq->tail, sizeof(sq->tail));
+            pci_dma_write(pci, sq->db_addr, &v, sizeof(sq->tail));
         }
 
         qemu_bh_schedule(sq->bh);

From 2c27fdc7a626408ee2cf30d791aa0b63027c7404 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 19 Jul 2023 20:31:43 +0100
Subject: [PATCH 0867/1353] Update version for v8.1.0-rc0 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 6f6578c5fa..46a6526f7c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.50
+8.0.90

From 03b67621445d601c9cdc7dfe25812e9f19b81488 Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Mon, 17 Jul 2023 16:55:40 +0200
Subject: [PATCH 0868/1353] qemu-nbd: pass structure into nbd_client_thread
 instead of plain char*

We are going to pass additional flag inside next patch.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
CC: <qemu-stable@nongnu.org>
Message-ID: <20230717145544.194786-2-den@openvz.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index 4276163564..77f98c736b 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -272,9 +272,13 @@ static void *show_parts(void *arg)
     return NULL;
 }
 
+struct NbdClientOpts {
+    char *device;
+};
+
 static void *nbd_client_thread(void *arg)
 {
-    char *device = arg;
+    struct NbdClientOpts *opts = arg;
     NBDExportInfo info = { .request_sizes = false, .name = g_strdup("") };
     QIOChannelSocket *sioc;
     int fd = -1;
@@ -298,10 +302,10 @@ static void *nbd_client_thread(void *arg)
         goto out;
     }
 
-    fd = open(device, O_RDWR);
+    fd = open(opts->device, O_RDWR);
     if (fd < 0) {
         /* Linux-only, we can use %m in printf.  */
-        error_report("Failed to open %s: %m", device);
+        error_report("Failed to open %s: %m", opts->device);
         goto out;
     }
 
@@ -311,11 +315,11 @@ static void *nbd_client_thread(void *arg)
     }
 
     /* update partition table */
-    pthread_create(&show_parts_thread, NULL, show_parts, device);
+    pthread_create(&show_parts_thread, NULL, show_parts, opts->device);
 
     if (verbose) {
         fprintf(stderr, "NBD device %s is now connected to %s\n",
-                device, srcpath);
+                opts->device, srcpath);
     } else {
         /* Close stderr so that the qemu-nbd process exits.  */
         dup2(STDOUT_FILENO, STDERR_FILENO);
@@ -1125,8 +1129,11 @@ int main(int argc, char **argv)
     if (device) {
 #if HAVE_NBD_DEVICE
         int ret;
+        struct NbdClientOpts opts = {
+            .device = device,
+        };
 
-        ret = pthread_create(&client_thread, NULL, nbd_client_thread, device);
+        ret = pthread_create(&client_thread, NULL, nbd_client_thread, &opts);
         if (ret != 0) {
             error_report("Failed to create client thread: %s", strerror(ret));
             exit(EXIT_FAILURE);

From 5c56dd27a2c905c9cf2472d2fd057621ce5fd00d Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Mon, 17 Jul 2023 16:55:41 +0200
Subject: [PATCH 0869/1353] qemu-nbd: fix regression with qemu-nbd --fork run
 over ssh

Commit e6df58a5578fee7a50bbf36f4a50a2781cff855d
    Author: Hanna Reitz <hreitz@redhat.com>
    Date:   Wed May 8 23:18:18 2019 +0200
    qemu-nbd: Do not close stderr

has introduced an interesting regression. Original behavior of
    ssh somehost qemu-nbd /home/den/tmp/file -f raw --fork
was the following:
 * qemu-nbd was started as a daemon
 * the command execution is done and ssh exited with success

The patch has changed this behavior and 'ssh' command now hangs forever.

According to the normal specification of the daemon() call, we should
endup with STDERR pointing to /dev/null. That should be done at the
very end of the successful startup sequence when the pipe to the
bootstrap process (used for diagnostics) is no longer needed.

This could be achived in the same way as done for 'qemu-nbd -c' case.
That was commit 0eaf453e, also fixing up e6df58a5. STDOUT copying to
STDERR does the trick.

This also leads to proper 'ssh' connection closing which fixes my
original problem.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
CC: Hanna Reitz <hreitz@redhat.com>
CC: <qemu-stable@nongnu.org>
Message-ID: <20230717145544.194786-3-den@openvz.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index 77f98c736b..186ce9474c 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -274,6 +274,7 @@ static void *show_parts(void *arg)
 
 struct NbdClientOpts {
     char *device;
+    bool fork_process;
 };
 
 static void *nbd_client_thread(void *arg)
@@ -317,7 +318,7 @@ static void *nbd_client_thread(void *arg)
     /* update partition table */
     pthread_create(&show_parts_thread, NULL, show_parts, opts->device);
 
-    if (verbose) {
+    if (verbose && !opts->fork_process) {
         fprintf(stderr, "NBD device %s is now connected to %s\n",
                 opts->device, srcpath);
     } else {
@@ -579,7 +580,6 @@ int main(int argc, char **argv)
     bool writethrough = false; /* Client will flush as needed. */
     bool fork_process = false;
     bool list = false;
-    int old_stderr = -1;
     unsigned socket_activation;
     const char *pid_file_name = NULL;
     const char *selinux_label = NULL;
@@ -934,11 +934,6 @@ int main(int argc, char **argv)
         } else if (pid == 0) {
             close(stderr_fd[0]);
 
-            /* Remember parent's stderr if we will be restoring it. */
-            if (fork_process) {
-                old_stderr = dup(STDERR_FILENO);
-            }
-
             ret = qemu_daemon(1, 0);
 
             /* Temporarily redirect stderr to the parent's pipe...  */
@@ -1131,6 +1126,7 @@ int main(int argc, char **argv)
         int ret;
         struct NbdClientOpts opts = {
             .device = device,
+            .fork_process = fork_process,
         };
 
         ret = pthread_create(&client_thread, NULL, nbd_client_thread, &opts);
@@ -1159,8 +1155,7 @@ int main(int argc, char **argv)
     }
 
     if (fork_process) {
-        dup2(old_stderr, STDERR_FILENO);
-        close(old_stderr);
+        dup2(STDOUT_FILENO, STDERR_FILENO);
     }
 
     state = RUNNING;

From 1dc8215118ca5b99669c3bf27082a365aef16ea6 Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Mon, 17 Jul 2023 16:55:43 +0200
Subject: [PATCH 0870/1353] qemu-nbd: properly report error if qemu_daemon() is
 failed

errno has been overwritten by dup2() just below qemu_daemon() and thus
improperly returned to the caller. Fix accordingly.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230717145544.194786-5-den@openvz.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: reorder patch series]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index 186ce9474c..5a8ae1f747 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -932,14 +932,17 @@ int main(int argc, char **argv)
             error_report("Failed to fork: %s", strerror(errno));
             exit(EXIT_FAILURE);
         } else if (pid == 0) {
+            int saved_errno;
+
             close(stderr_fd[0]);
 
             ret = qemu_daemon(1, 0);
+            saved_errno = errno;    /* dup2 will overwrite error below */
 
             /* Temporarily redirect stderr to the parent's pipe...  */
             dup2(stderr_fd[1], STDERR_FILENO);
             if (ret < 0) {
-                error_report("Failed to daemonize: %s", strerror(errno));
+                error_report("Failed to daemonize: %s", strerror(saved_errno));
                 exit(EXIT_FAILURE);
             }
 

From e0892ced0534b1009d009e32c3e338456018ab15 Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Mon, 17 Jul 2023 16:55:42 +0200
Subject: [PATCH 0871/1353] qemu-nbd: properly report error on error in dup2()
 after qemu_daemon()

We are trying to temporarily redirect stderr of daemonized process to
a pipe to report a error and get failed. In that case we could not
use error_report() helper, but should write the message directly into
the problematic pipe.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230717145544.194786-4-den@openvz.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: rearrange patch series, fix typo]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index 5a8ae1f747..f27613cb57 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -940,7 +940,20 @@ int main(int argc, char **argv)
             saved_errno = errno;    /* dup2 will overwrite error below */
 
             /* Temporarily redirect stderr to the parent's pipe...  */
-            dup2(stderr_fd[1], STDERR_FILENO);
+            if (dup2(stderr_fd[1], STDERR_FILENO) < 0) {
+                char str[256];
+                snprintf(str, sizeof(str),
+                         "%s: Failed to link stderr to the pipe: %s\n",
+                         g_get_prgname(), strerror(errno));
+                /*
+                 * We are unable to use error_report() here as we need to get
+                 * stderr pointed to the parent's pipe. Write to that pipe
+                 * manually.
+                 */
+                ret = write(stderr_fd[1], str, strlen(str));
+                exit(EXIT_FAILURE);
+            }
+
             if (ret < 0) {
                 error_report("Failed to daemonize: %s", strerror(saved_errno));
                 exit(EXIT_FAILURE);

From 173776f74d072f375b3815a4beaa6ddc7bf26cab Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Mon, 17 Jul 2023 16:55:44 +0200
Subject: [PATCH 0872/1353] qemu-nbd: handle dup2() error when qemu-nbd
 finished setup process

Fail on error, we are in trouble.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230717145544.194786-6-den@openvz.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
[eblake: avoid intermediate variable]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index f27613cb57..e30c9ac179 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -323,7 +323,11 @@ static void *nbd_client_thread(void *arg)
                 opts->device, srcpath);
     } else {
         /* Close stderr so that the qemu-nbd process exits.  */
-        dup2(STDOUT_FILENO, STDERR_FILENO);
+        if (dup2(STDOUT_FILENO, STDERR_FILENO) < 0) {
+            error_report("Could not set stderr to /dev/null: %s",
+                         strerror(errno));
+            exit(EXIT_FAILURE);
+        }
     }
 
     if (nbd_client(fd) < 0) {
@@ -1171,7 +1175,11 @@ int main(int argc, char **argv)
     }
 
     if (fork_process) {
-        dup2(STDOUT_FILENO, STDERR_FILENO);
+        if (dup2(STDOUT_FILENO, STDERR_FILENO) < 0) {
+            error_report("Could not set stderr to /dev/null: %s",
+                         strerror(errno));
+            exit(EXIT_FAILURE);
+        }
     }
 
     state = RUNNING;

From 414c0cf0e88b8cba1d4f5a6bc32f9796a66b5c26 Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Mon, 17 Jul 2023 22:25:20 +0200
Subject: [PATCH 0873/1353] qemu-nbd: make verbose bool and local variable in
 main()

Pass 'verbose' to nbd_client_thread() inside NbdClientOpts which looks
a little bit cleaner and make it bool as it is used as bool actually.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230717202520.236999-1-den@openvz.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index e30c9ac179..5b2757920c 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -73,7 +73,6 @@
 
 #define MBR_SIZE 512
 
-static int verbose;
 static char *srcpath;
 static SocketAddress *saddr;
 static int persistent = 0;
@@ -275,6 +274,7 @@ static void *show_parts(void *arg)
 struct NbdClientOpts {
     char *device;
     bool fork_process;
+    bool verbose;
 };
 
 static void *nbd_client_thread(void *arg)
@@ -318,7 +318,7 @@ static void *nbd_client_thread(void *arg)
     /* update partition table */
     pthread_create(&show_parts_thread, NULL, show_parts, opts->device);
 
-    if (verbose && !opts->fork_process) {
+    if (opts->verbose && !opts->fork_process) {
         fprintf(stderr, "NBD device %s is now connected to %s\n",
                 opts->device, srcpath);
     } else {
@@ -582,6 +582,7 @@ int main(int argc, char **argv)
     const char *tlshostname = NULL;
     bool imageOpts = false;
     bool writethrough = false; /* Client will flush as needed. */
+    bool verbose = false;
     bool fork_process = false;
     bool list = false;
     unsigned socket_activation;
@@ -746,7 +747,7 @@ int main(int argc, char **argv)
             }
             break;
         case 'v':
-            verbose = 1;
+            verbose = true;
             break;
         case 'V':
             version(argv[0]);
@@ -1147,6 +1148,7 @@ int main(int argc, char **argv)
         struct NbdClientOpts opts = {
             .device = device,
             .fork_process = fork_process,
+            .verbose = verbose,
         };
 
         ret = pthread_create(&client_thread, NULL, nbd_client_thread, &opts);

From f47b6eab8372fef45cdc711c5a904df82de3aecf Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:30 -0500
Subject: [PATCH 0874/1353] nbd/client: Use smarter assert

Assigning strlen() to a uint32_t and then asserting that it isn't too
large doesn't catch the case of an input string 4G in length.
Thankfully, the incoming strings can never be that large: if the
export name or query is reflecting a string the client got from the
server, we already guarantee that we dropped the NBD connection if the
server sent more than 32M in a single reply to our NBD_OPT_* request;
if the export name is coming from qemu, nbd_receive_negotiate()
asserted that strlen(info->name) <= NBD_MAX_STRING_SIZE; and
similarly, a query string via x->dirty_bitmap coming from the user was
bounds-checked in either qemu-nbd or by the limitations of QMP.
Still, it doesn't hurt to be more explicit in how we write our
assertions to not have to analyze whether inadvertent wraparound is
possible.

Fixes: 93676c88 ("nbd: Don't send oversize strings", v4.2.0)
Reported-by: Dr. David Alan Gilbert <dave@treblig.org>
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230608135653.2918540-2-eblake@redhat.com>
---
 nbd/client.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nbd/client.c b/nbd/client.c
index 30d5383cb1..ff75722e48 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -650,19 +650,20 @@ static int nbd_send_meta_query(QIOChannel *ioc, uint32_t opt,
                                Error **errp)
 {
     int ret;
-    uint32_t export_len = strlen(export);
+    uint32_t export_len;
     uint32_t queries = !!query;
     uint32_t query_len = 0;
     uint32_t data_len;
     char *data;
     char *p;
 
+    assert(strnlen(export, NBD_MAX_STRING_SIZE + 1) <= NBD_MAX_STRING_SIZE);
+    export_len = strlen(export);
     data_len = sizeof(export_len) + export_len + sizeof(queries);
-    assert(export_len <= NBD_MAX_STRING_SIZE);
     if (query) {
+        assert(strnlen(query, NBD_MAX_STRING_SIZE + 1) <= NBD_MAX_STRING_SIZE);
         query_len = strlen(query);
         data_len += sizeof(query_len) + query_len;
-        assert(query_len <= NBD_MAX_STRING_SIZE);
     } else {
         assert(opt == NBD_OPT_LIST_META_CONTEXT);
     }

From 8d2931dc85695e39be9db1d1cc55e0c3ca46fbe9 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:31 -0500
Subject: [PATCH 0875/1353] nbd: Consistent typedef usage in header

We had a mix of struct declarations followed by typedefs, and direct
struct definitions as part of a typedef.  Pick a single style.  Also
float forward declarations of opaque types to the top of the file,
rather than interspersed with function declarations, which will help a
future patch that wants to expose yet another opaque type that will be
referenced in NBDRequest.  No semantic impact.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20230608135653.2918540-3-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
[eblake: alter patch per mailing list feedback]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 include/block/nbd.h | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index a4c98169c3..9dcb5357d1 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2016-2022 Red Hat, Inc.
+ *  Copyright Red Hat
  *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
  *
  *  Network Block Device
@@ -26,24 +26,26 @@
 #include "qapi/error.h"
 #include "qemu/bswap.h"
 
+typedef struct NBDExport NBDExport;
+typedef struct NBDClient NBDClient;
+typedef struct NBDClientConnection NBDClientConnection;
+
 extern const BlockExportDriver blk_exp_nbd;
 
 /* Handshake phase structs - this struct is passed on the wire */
 
-struct NBDOption {
+typedef struct NBDOption {
     uint64_t magic; /* NBD_OPTS_MAGIC */
     uint32_t option; /* NBD_OPT_* */
     uint32_t length;
-} QEMU_PACKED;
-typedef struct NBDOption NBDOption;
+} QEMU_PACKED NBDOption;
 
-struct NBDOptionReply {
+typedef struct NBDOptionReply {
     uint64_t magic; /* NBD_REP_MAGIC */
     uint32_t option; /* NBD_OPT_* */
     uint32_t type; /* NBD_REP_* */
     uint32_t length;
-} QEMU_PACKED;
-typedef struct NBDOptionReply NBDOptionReply;
+} QEMU_PACKED NBDOptionReply;
 
 typedef struct NBDOptionReplyMetaContext {
     NBDOptionReply h; /* h.type = NBD_REP_META_CONTEXT, h.length > 4 */
@@ -56,14 +58,13 @@ typedef struct NBDOptionReplyMetaContext {
  * Note: these are _NOT_ the same as the network representation of an NBD
  * request and reply!
  */
-struct NBDRequest {
+typedef struct NBDRequest {
     uint64_t handle;
     uint64_t from;
     uint32_t len;
     uint16_t flags; /* NBD_CMD_FLAG_* */
     uint16_t type; /* NBD_CMD_* */
-};
-typedef struct NBDRequest NBDRequest;
+} NBDRequest;
 
 typedef struct NBDSimpleReply {
     uint32_t magic;  /* NBD_SIMPLE_REPLY_MAGIC */
@@ -282,7 +283,7 @@ static inline bool nbd_reply_type_is_error(int type)
 #define NBD_ESHUTDOWN  108
 
 /* Details collected by NBD_OPT_EXPORT_NAME and NBD_OPT_GO */
-struct NBDExportInfo {
+typedef struct NBDExportInfo {
     /* Set by client before nbd_receive_negotiate() */
     bool request_sizes;
     char *x_dirty_bitmap;
@@ -310,8 +311,7 @@ struct NBDExportInfo {
     char *description;
     int n_contexts;
     char **contexts;
-};
-typedef struct NBDExportInfo NBDExportInfo;
+} NBDExportInfo;
 
 int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
                           QCryptoTLSCreds *tlscreds,
@@ -330,9 +330,6 @@ int nbd_client(int fd);
 int nbd_disconnect(int fd);
 int nbd_errno_to_system_errno(int err);
 
-typedef struct NBDExport NBDExport;
-typedef struct NBDClient NBDClient;
-
 void nbd_export_set_on_eject_blk(BlockExport *exp, BlockBackend *blk);
 
 AioContext *nbd_export_aio_context(NBDExport *exp);
@@ -409,8 +406,6 @@ const char *nbd_cmd_lookup(uint16_t info);
 const char *nbd_err_lookup(int err);
 
 /* nbd/client-connection.c */
-typedef struct NBDClientConnection NBDClientConnection;
-
 void nbd_client_connection_enable_retry(NBDClientConnection *conn);
 
 NBDClientConnection *nbd_client_connection_new(const SocketAddress *saddr,

From a7c8ed36bf9d3b7f75faefb5bb01535eb818e260 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:32 -0500
Subject: [PATCH 0876/1353] nbd/server: Prepare for alternate-size headers

Upstream NBD now documents[1] an extension that supports 64-bit effect
lengths in requests.  As part of that extension, the size of the reply
headers will change in order to permit a 64-bit length in the reply
for symmetry[2].  Additionally, where the reply header is currently 16
bytes for simple reply, and 20 bytes for structured reply; with the
extension enabled, there will only be one extended reply header, of 32
bytes, with both structured and extended modes sending identical
payloads for chunked replies.

Since we are already wired up to use iovecs, it is easiest to allow
for this change in header size by splitting each structured reply
across multiple iovecs, one for the header (which will become wider in
a future patch according to client negotiation), and the other(s) for
the chunk payload, and removing the header from the payload struct
definitions.  Rename the affected functions with s/structured/chunk/
to make it obvious that the code will be reused in extended mode.

Interestingly, the client side code never utilized the packed types,
so only the server code needs to be updated.

[1] https://github.com/NetworkBlockDevice/nbd/blob/extension-ext-header/doc/proto.md
as of NBD commit e6f3b94a934

[2] Note that on the surface, this is because some future server might
permit a 4G+ NBD_CMD_READ and need to reply with that much data in one
transaction.  But even though the extended reply length is widened to
64 bits, for now the NBD spec is clear that servers will not reply
with more than a maximum payload bounded by the 32-bit
NBD_INFO_BLOCK_SIZE field; allowing a client and server to mutually
agree to transactions larger than 4G would require yet another
extension.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20230608135653.2918540-4-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 include/block/nbd.h |   8 +--
 nbd/server.c        | 137 ++++++++++++++++++++++++++------------------
 nbd/trace-events    |   8 +--
 3 files changed, 88 insertions(+), 65 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index 9dcb5357d1..ee71af099a 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -97,28 +97,28 @@ typedef union NBDReply {
 
 /* Header of chunk for NBD_REPLY_TYPE_OFFSET_DATA */
 typedef struct NBDStructuredReadData {
-    NBDStructuredReplyChunk h; /* h.length >= 9 */
+    /* header's .length >= 9 */
     uint64_t offset;
     /* At least one byte of data payload follows, calculated from h.length */
 } QEMU_PACKED NBDStructuredReadData;
 
 /* Complete chunk for NBD_REPLY_TYPE_OFFSET_HOLE */
 typedef struct NBDStructuredReadHole {
-    NBDStructuredReplyChunk h; /* h.length == 12 */
+    /* header's length == 12 */
     uint64_t offset;
     uint32_t length;
 } QEMU_PACKED NBDStructuredReadHole;
 
 /* Header of all NBD_REPLY_TYPE_ERROR* errors */
 typedef struct NBDStructuredError {
-    NBDStructuredReplyChunk h; /* h.length >= 6 */
+    /* header's length >= 6 */
     uint32_t error;
     uint16_t message_length;
 } QEMU_PACKED NBDStructuredError;
 
 /* Header of NBD_REPLY_TYPE_BLOCK_STATUS */
 typedef struct NBDStructuredMeta {
-    NBDStructuredReplyChunk h; /* h.length >= 12 (at least one extent) */
+    /* header's length >= 12 (at least one extent) */
     uint32_t context_id;
     /* extents follows */
 } QEMU_PACKED NBDStructuredMeta;
diff --git a/nbd/server.c b/nbd/server.c
index febe001a39..6698ab4636 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2016-2022 Red Hat, Inc.
+ *  Copyright Red Hat
  *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
  *
  *  Network Block Device Server Side
@@ -1906,16 +1906,36 @@ static int coroutine_fn nbd_co_send_simple_reply(NBDClient *client,
         {.iov_base = data, .iov_len = len}
     };
 
+    assert(!len || !nbd_err);
     trace_nbd_co_send_simple_reply(handle, nbd_err, nbd_err_lookup(nbd_err),
                                    len);
     set_be_simple_reply(&reply, nbd_err, handle);
 
-    return nbd_co_send_iov(client, iov, len ? 2 : 1, errp);
+    return nbd_co_send_iov(client, iov, 2, errp);
 }
 
-static inline void set_be_chunk(NBDStructuredReplyChunk *chunk, uint16_t flags,
-                                uint16_t type, uint64_t handle, uint32_t length)
+/*
+ * Prepare the header of a reply chunk for network transmission.
+ *
+ * On input, @iov is partially initialized: iov[0].iov_base must point
+ * to an uninitialized NBDReply, while the remaining @niov elements
+ * (if any) must be ready for transmission.  This function then
+ * populates iov[0] for transmission.
+ */
+static inline void set_be_chunk(NBDClient *client, struct iovec *iov,
+                                size_t niov, uint16_t flags, uint16_t type,
+                                uint64_t handle)
 {
+    /* TODO - handle structured vs. extended replies */
+    NBDStructuredReplyChunk *chunk = iov->iov_base;
+    size_t i, length = 0;
+
+    for (i = 1; i < niov; i++) {
+        length += iov[i].iov_len;
+    }
+    assert(length <= NBD_MAX_BUFFER_SIZE + sizeof(NBDStructuredReadData));
+
+    iov[0].iov_len = sizeof(*chunk);
     stl_be_p(&chunk->magic, NBD_STRUCTURED_REPLY_MAGIC);
     stw_be_p(&chunk->flags, flags);
     stw_be_p(&chunk->type, type);
@@ -1923,67 +1943,71 @@ static inline void set_be_chunk(NBDStructuredReplyChunk *chunk, uint16_t flags,
     stl_be_p(&chunk->length, length);
 }
 
-static int coroutine_fn nbd_co_send_structured_done(NBDClient *client,
-                                                    uint64_t handle,
-                                                    Error **errp)
+static int coroutine_fn nbd_co_send_chunk_done(NBDClient *client,
+                                               uint64_t handle,
+                                               Error **errp)
 {
-    NBDStructuredReplyChunk chunk;
+    NBDReply hdr;
     struct iovec iov[] = {
-        {.iov_base = &chunk, .iov_len = sizeof(chunk)},
+        {.iov_base = &hdr},
     };
 
-    trace_nbd_co_send_structured_done(handle);
-    set_be_chunk(&chunk, NBD_REPLY_FLAG_DONE, NBD_REPLY_TYPE_NONE, handle, 0);
+    trace_nbd_co_send_chunk_done(handle);
+    set_be_chunk(client, iov, 1, NBD_REPLY_FLAG_DONE,
+                 NBD_REPLY_TYPE_NONE, handle);
 
     return nbd_co_send_iov(client, iov, 1, errp);
 }
 
-static int coroutine_fn nbd_co_send_structured_read(NBDClient *client,
-                                                    uint64_t handle,
-                                                    uint64_t offset,
-                                                    void *data,
-                                                    size_t size,
-                                                    bool final,
-                                                    Error **errp)
+static int coroutine_fn nbd_co_send_chunk_read(NBDClient *client,
+                                               uint64_t handle,
+                                               uint64_t offset,
+                                               void *data,
+                                               size_t size,
+                                               bool final,
+                                               Error **errp)
 {
+    NBDReply hdr;
     NBDStructuredReadData chunk;
     struct iovec iov[] = {
+        {.iov_base = &hdr},
         {.iov_base = &chunk, .iov_len = sizeof(chunk)},
         {.iov_base = data, .iov_len = size}
     };
 
     assert(size);
-    trace_nbd_co_send_structured_read(handle, offset, data, size);
-    set_be_chunk(&chunk.h, final ? NBD_REPLY_FLAG_DONE : 0,
-                 NBD_REPLY_TYPE_OFFSET_DATA, handle,
-                 sizeof(chunk) - sizeof(chunk.h) + size);
+    trace_nbd_co_send_chunk_read(handle, offset, data, size);
+    set_be_chunk(client, iov, 3, final ? NBD_REPLY_FLAG_DONE : 0,
+                 NBD_REPLY_TYPE_OFFSET_DATA, handle);
     stq_be_p(&chunk.offset, offset);
 
-    return nbd_co_send_iov(client, iov, 2, errp);
+    return nbd_co_send_iov(client, iov, 3, errp);
 }
 
-static int coroutine_fn nbd_co_send_structured_error(NBDClient *client,
-                                                     uint64_t handle,
-                                                     uint32_t error,
-                                                     const char *msg,
-                                                     Error **errp)
+static int coroutine_fn nbd_co_send_chunk_error(NBDClient *client,
+                                                uint64_t handle,
+                                                uint32_t error,
+                                                const char *msg,
+                                                Error **errp)
 {
+    NBDReply hdr;
     NBDStructuredError chunk;
     int nbd_err = system_errno_to_nbd_errno(error);
     struct iovec iov[] = {
+        {.iov_base = &hdr},
         {.iov_base = &chunk, .iov_len = sizeof(chunk)},
         {.iov_base = (char *)msg, .iov_len = msg ? strlen(msg) : 0},
     };
 
     assert(nbd_err);
-    trace_nbd_co_send_structured_error(handle, nbd_err,
-                                       nbd_err_lookup(nbd_err), msg ? msg : "");
-    set_be_chunk(&chunk.h, NBD_REPLY_FLAG_DONE, NBD_REPLY_TYPE_ERROR, handle,
-                 sizeof(chunk) - sizeof(chunk.h) + iov[1].iov_len);
+    trace_nbd_co_send_chunk_error(handle, nbd_err,
+                                  nbd_err_lookup(nbd_err), msg ? msg : "");
+    set_be_chunk(client, iov, 3, NBD_REPLY_FLAG_DONE,
+                 NBD_REPLY_TYPE_ERROR, handle);
     stl_be_p(&chunk.error, nbd_err);
-    stw_be_p(&chunk.message_length, iov[1].iov_len);
+    stw_be_p(&chunk.message_length, iov[2].iov_len);
 
-    return nbd_co_send_iov(client, iov, 1 + !!iov[1].iov_len, errp);
+    return nbd_co_send_iov(client, iov, 3, errp);
 }
 
 /* Do a sparse read and send the structured reply to the client.
@@ -2013,27 +2037,27 @@ static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
             char *msg = g_strdup_printf("unable to check for holes: %s",
                                         strerror(-status));
 
-            ret = nbd_co_send_structured_error(client, handle, -status, msg,
-                                               errp);
+            ret = nbd_co_send_chunk_error(client, handle, -status, msg, errp);
             g_free(msg);
             return ret;
         }
         assert(pnum && pnum <= size - progress);
         final = progress + pnum == size;
         if (status & BDRV_BLOCK_ZERO) {
+            NBDReply hdr;
             NBDStructuredReadHole chunk;
             struct iovec iov[] = {
+                {.iov_base = &hdr},
                 {.iov_base = &chunk, .iov_len = sizeof(chunk)},
             };
 
-            trace_nbd_co_send_structured_read_hole(handle, offset + progress,
-                                                   pnum);
-            set_be_chunk(&chunk.h, final ? NBD_REPLY_FLAG_DONE : 0,
-                         NBD_REPLY_TYPE_OFFSET_HOLE,
-                         handle, sizeof(chunk) - sizeof(chunk.h));
+            trace_nbd_co_send_chunk_read_hole(handle, offset + progress, pnum);
+            set_be_chunk(client, iov, 2,
+                         final ? NBD_REPLY_FLAG_DONE : 0,
+                         NBD_REPLY_TYPE_OFFSET_HOLE, handle);
             stq_be_p(&chunk.offset, offset + progress);
             stl_be_p(&chunk.length, pnum);
-            ret = nbd_co_send_iov(client, iov, 1, errp);
+            ret = nbd_co_send_iov(client, iov, 2, errp);
         } else {
             ret = blk_co_pread(exp->common.blk, offset + progress, pnum,
                                data + progress, 0);
@@ -2041,9 +2065,8 @@ static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
                 error_setg_errno(errp, -ret, "reading from file failed");
                 break;
             }
-            ret = nbd_co_send_structured_read(client, handle, offset + progress,
-                                              data + progress, pnum, final,
-                                              errp);
+            ret = nbd_co_send_chunk_read(client, handle, offset + progress,
+                                         data + progress, pnum, final, errp);
         }
 
         if (ret < 0) {
@@ -2199,8 +2222,10 @@ static int coroutine_fn
 nbd_co_send_extents(NBDClient *client, uint64_t handle, NBDExtentArray *ea,
                     bool last, uint32_t context_id, Error **errp)
 {
+    NBDReply hdr;
     NBDStructuredMeta chunk;
     struct iovec iov[] = {
+        {.iov_base = &hdr},
         {.iov_base = &chunk, .iov_len = sizeof(chunk)},
         {.iov_base = ea->extents, .iov_len = ea->count * sizeof(ea->extents[0])}
     };
@@ -2209,12 +2234,11 @@ nbd_co_send_extents(NBDClient *client, uint64_t handle, NBDExtentArray *ea,
 
     trace_nbd_co_send_extents(handle, ea->count, context_id, ea->total_length,
                               last);
-    set_be_chunk(&chunk.h, last ? NBD_REPLY_FLAG_DONE : 0,
-                 NBD_REPLY_TYPE_BLOCK_STATUS,
-                 handle, sizeof(chunk) - sizeof(chunk.h) + iov[1].iov_len);
+    set_be_chunk(client, iov, 3, last ? NBD_REPLY_FLAG_DONE : 0,
+                 NBD_REPLY_TYPE_BLOCK_STATUS, handle);
     stl_be_p(&chunk.context_id, context_id);
 
-    return nbd_co_send_iov(client, iov, 2, errp);
+    return nbd_co_send_iov(client, iov, 3, errp);
 }
 
 /* Get block status from the exported device and send it to the client */
@@ -2235,8 +2259,8 @@ coroutine_fn nbd_co_send_block_status(NBDClient *client, uint64_t handle,
         ret = blockalloc_to_extents(blk, offset, length, ea);
     }
     if (ret < 0) {
-        return nbd_co_send_structured_error(
-                client, handle, -ret, "can't get block status", errp);
+        return nbd_co_send_chunk_error(client, handle, -ret,
+                                       "can't get block status", errp);
     }
 
     return nbd_co_send_extents(client, handle, ea, last, context_id, errp);
@@ -2408,8 +2432,7 @@ static coroutine_fn int nbd_send_generic_reply(NBDClient *client,
                                                Error **errp)
 {
     if (client->structured_reply && ret < 0) {
-        return nbd_co_send_structured_error(client, handle, -ret, error_msg,
-                                            errp);
+        return nbd_co_send_chunk_error(client, handle, -ret, error_msg, errp);
     } else {
         return nbd_co_send_simple_reply(client, handle, ret < 0 ? -ret : 0,
                                         NULL, 0, errp);
@@ -2451,11 +2474,11 @@ static coroutine_fn int nbd_do_cmd_read(NBDClient *client, NBDRequest *request,
 
     if (client->structured_reply) {
         if (request->len) {
-            return nbd_co_send_structured_read(client, request->handle,
-                                               request->from, data,
-                                               request->len, true, errp);
+            return nbd_co_send_chunk_read(client, request->handle,
+                                          request->from, data,
+                                          request->len, true, errp);
         } else {
-            return nbd_co_send_structured_done(client, request->handle, errp);
+            return nbd_co_send_chunk_done(client, request->handle, errp);
         }
     } else {
         return nbd_co_send_simple_reply(client, request->handle, 0,
diff --git a/nbd/trace-events b/nbd/trace-events
index b7032ca277..50ca05a9e2 100644
--- a/nbd/trace-events
+++ b/nbd/trace-events
@@ -64,11 +64,11 @@ nbd_receive_request(uint32_t magic, uint16_t flags, uint16_t type, uint64_t from
 nbd_blk_aio_attached(const char *name, void *ctx) "Export %s: Attaching clients to AIO context %p"
 nbd_blk_aio_detach(const char *name, void *ctx) "Export %s: Detaching clients from AIO context %p"
 nbd_co_send_simple_reply(uint64_t handle, uint32_t error, const char *errname, int len) "Send simple reply: handle = %" PRIu64 ", error = %" PRIu32 " (%s), len = %d"
-nbd_co_send_structured_done(uint64_t handle) "Send structured reply done: handle = %" PRIu64
-nbd_co_send_structured_read(uint64_t handle, uint64_t offset, void *data, size_t size) "Send structured read data reply: handle = %" PRIu64 ", offset = %" PRIu64 ", data = %p, len = %zu"
-nbd_co_send_structured_read_hole(uint64_t handle, uint64_t offset, size_t size) "Send structured read hole reply: handle = %" PRIu64 ", offset = %" PRIu64 ", len = %zu"
+nbd_co_send_chunk_done(uint64_t handle) "Send structured reply done: handle = %" PRIu64
+nbd_co_send_chunk_read(uint64_t handle, uint64_t offset, void *data, size_t size) "Send structured read data reply: handle = %" PRIu64 ", offset = %" PRIu64 ", data = %p, len = %zu"
+nbd_co_send_chunk_read_hole(uint64_t handle, uint64_t offset, size_t size) "Send structured read hole reply: handle = %" PRIu64 ", offset = %" PRIu64 ", len = %zu"
 nbd_co_send_extents(uint64_t handle, unsigned int extents, uint32_t id, uint64_t length, int last) "Send block status reply: handle = %" PRIu64 ", extents = %u, context = %d (extents cover %" PRIu64 " bytes, last chunk = %d)"
-nbd_co_send_structured_error(uint64_t handle, int err, const char *errname, const char *msg) "Send structured error reply: handle = %" PRIu64 ", error = %d (%s), msg = '%s'"
+nbd_co_send_chunk_error(uint64_t handle, int err, const char *errname, const char *msg) "Send structured error reply: handle = %" PRIu64 ", error = %d (%s), msg = '%s'"
 nbd_co_receive_request_decode_type(uint64_t handle, uint16_t type, const char *name) "Decoding type: handle = %" PRIu64 ", type = %" PRIu16 " (%s)"
 nbd_co_receive_request_payload_received(uint64_t handle, uint32_t len) "Payload received: handle = %" PRIu64 ", len = %" PRIu32
 nbd_co_receive_align_compliance(const char *op, uint64_t from, uint32_t len, uint32_t align) "client sent non-compliant unaligned %s request: from=0x%" PRIx64 ", len=0x%" PRIx32 ", align=0x%" PRIx32

From 66d4f4fe2f1c282a34a429f61aa4283e60336500 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:33 -0500
Subject: [PATCH 0877/1353] nbd/server: Refactor to pass full request around

Part of NBD's 64-bit headers extension involves passing the client's
requested offset back as part of the reply header (one reason it
stated for this change: converting absolute offsets stored in
NBD_REPLY_TYPE_OFFSET_DATA to relative offsets within the buffer is
easier if the absolute offset of the buffer is also available).  This
is a refactoring patch to pass the full request around the reply
stack, rather than just the handle, so that later patches can then
access request->from when extended headers are active.  Meanwhile,
this patch enables us to now assert that simple replies are only
attempted when appropriate, and otherwise has no semantic change.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230608135653.2918540-5-eblake@redhat.com>
---
 nbd/server.c | 114 ++++++++++++++++++++++++++-------------------------
 1 file changed, 59 insertions(+), 55 deletions(-)

diff --git a/nbd/server.c b/nbd/server.c
index 6698ab4636..26b27d6920 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -1893,7 +1893,7 @@ static inline void set_be_simple_reply(NBDSimpleReply *reply, uint64_t error,
 }
 
 static int coroutine_fn nbd_co_send_simple_reply(NBDClient *client,
-                                                 uint64_t handle,
+                                                 NBDRequest *request,
                                                  uint32_t error,
                                                  void *data,
                                                  size_t len,
@@ -1907,9 +1907,10 @@ static int coroutine_fn nbd_co_send_simple_reply(NBDClient *client,
     };
 
     assert(!len || !nbd_err);
-    trace_nbd_co_send_simple_reply(handle, nbd_err, nbd_err_lookup(nbd_err),
-                                   len);
-    set_be_simple_reply(&reply, nbd_err, handle);
+    assert(!client->structured_reply || request->type != NBD_CMD_READ);
+    trace_nbd_co_send_simple_reply(request->handle, nbd_err,
+                                   nbd_err_lookup(nbd_err), len);
+    set_be_simple_reply(&reply, nbd_err, request->handle);
 
     return nbd_co_send_iov(client, iov, 2, errp);
 }
@@ -1924,7 +1925,7 @@ static int coroutine_fn nbd_co_send_simple_reply(NBDClient *client,
  */
 static inline void set_be_chunk(NBDClient *client, struct iovec *iov,
                                 size_t niov, uint16_t flags, uint16_t type,
-                                uint64_t handle)
+                                NBDRequest *request)
 {
     /* TODO - handle structured vs. extended replies */
     NBDStructuredReplyChunk *chunk = iov->iov_base;
@@ -1939,12 +1940,12 @@ static inline void set_be_chunk(NBDClient *client, struct iovec *iov,
     stl_be_p(&chunk->magic, NBD_STRUCTURED_REPLY_MAGIC);
     stw_be_p(&chunk->flags, flags);
     stw_be_p(&chunk->type, type);
-    stq_be_p(&chunk->handle, handle);
+    stq_be_p(&chunk->handle, request->handle);
     stl_be_p(&chunk->length, length);
 }
 
 static int coroutine_fn nbd_co_send_chunk_done(NBDClient *client,
-                                               uint64_t handle,
+                                               NBDRequest *request,
                                                Error **errp)
 {
     NBDReply hdr;
@@ -1952,15 +1953,15 @@ static int coroutine_fn nbd_co_send_chunk_done(NBDClient *client,
         {.iov_base = &hdr},
     };
 
-    trace_nbd_co_send_chunk_done(handle);
+    trace_nbd_co_send_chunk_done(request->handle);
     set_be_chunk(client, iov, 1, NBD_REPLY_FLAG_DONE,
-                 NBD_REPLY_TYPE_NONE, handle);
+                 NBD_REPLY_TYPE_NONE, request);
 
     return nbd_co_send_iov(client, iov, 1, errp);
 }
 
 static int coroutine_fn nbd_co_send_chunk_read(NBDClient *client,
-                                               uint64_t handle,
+                                               NBDRequest *request,
                                                uint64_t offset,
                                                void *data,
                                                size_t size,
@@ -1976,16 +1977,16 @@ static int coroutine_fn nbd_co_send_chunk_read(NBDClient *client,
     };
 
     assert(size);
-    trace_nbd_co_send_chunk_read(handle, offset, data, size);
+    trace_nbd_co_send_chunk_read(request->handle, offset, data, size);
     set_be_chunk(client, iov, 3, final ? NBD_REPLY_FLAG_DONE : 0,
-                 NBD_REPLY_TYPE_OFFSET_DATA, handle);
+                 NBD_REPLY_TYPE_OFFSET_DATA, request);
     stq_be_p(&chunk.offset, offset);
 
     return nbd_co_send_iov(client, iov, 3, errp);
 }
-
+/*ebb*/
 static int coroutine_fn nbd_co_send_chunk_error(NBDClient *client,
-                                                uint64_t handle,
+                                                NBDRequest *request,
                                                 uint32_t error,
                                                 const char *msg,
                                                 Error **errp)
@@ -2000,10 +2001,10 @@ static int coroutine_fn nbd_co_send_chunk_error(NBDClient *client,
     };
 
     assert(nbd_err);
-    trace_nbd_co_send_chunk_error(handle, nbd_err,
+    trace_nbd_co_send_chunk_error(request->handle, nbd_err,
                                   nbd_err_lookup(nbd_err), msg ? msg : "");
     set_be_chunk(client, iov, 3, NBD_REPLY_FLAG_DONE,
-                 NBD_REPLY_TYPE_ERROR, handle);
+                 NBD_REPLY_TYPE_ERROR, request);
     stl_be_p(&chunk.error, nbd_err);
     stw_be_p(&chunk.message_length, iov[2].iov_len);
 
@@ -2015,7 +2016,7 @@ static int coroutine_fn nbd_co_send_chunk_error(NBDClient *client,
  * reported to the client, at which point this function succeeds.
  */
 static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
-                                                uint64_t handle,
+                                                NBDRequest *request,
                                                 uint64_t offset,
                                                 uint8_t *data,
                                                 size_t size,
@@ -2037,7 +2038,7 @@ static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
             char *msg = g_strdup_printf("unable to check for holes: %s",
                                         strerror(-status));
 
-            ret = nbd_co_send_chunk_error(client, handle, -status, msg, errp);
+            ret = nbd_co_send_chunk_error(client, request, -status, msg, errp);
             g_free(msg);
             return ret;
         }
@@ -2051,10 +2052,11 @@ static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
                 {.iov_base = &chunk, .iov_len = sizeof(chunk)},
             };
 
-            trace_nbd_co_send_chunk_read_hole(handle, offset + progress, pnum);
+            trace_nbd_co_send_chunk_read_hole(request->handle,
+                                              offset + progress, pnum);
             set_be_chunk(client, iov, 2,
                          final ? NBD_REPLY_FLAG_DONE : 0,
-                         NBD_REPLY_TYPE_OFFSET_HOLE, handle);
+                         NBD_REPLY_TYPE_OFFSET_HOLE, request);
             stq_be_p(&chunk.offset, offset + progress);
             stl_be_p(&chunk.length, pnum);
             ret = nbd_co_send_iov(client, iov, 2, errp);
@@ -2065,7 +2067,7 @@ static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
                 error_setg_errno(errp, -ret, "reading from file failed");
                 break;
             }
-            ret = nbd_co_send_chunk_read(client, handle, offset + progress,
+            ret = nbd_co_send_chunk_read(client, request, offset + progress,
                                          data + progress, pnum, final, errp);
         }
 
@@ -2219,7 +2221,7 @@ static int coroutine_fn blockalloc_to_extents(BlockBackend *blk,
  * @last controls whether NBD_REPLY_FLAG_DONE is sent.
  */
 static int coroutine_fn
-nbd_co_send_extents(NBDClient *client, uint64_t handle, NBDExtentArray *ea,
+nbd_co_send_extents(NBDClient *client, NBDRequest *request, NBDExtentArray *ea,
                     bool last, uint32_t context_id, Error **errp)
 {
     NBDReply hdr;
@@ -2232,10 +2234,10 @@ nbd_co_send_extents(NBDClient *client, uint64_t handle, NBDExtentArray *ea,
 
     nbd_extent_array_convert_to_be(ea);
 
-    trace_nbd_co_send_extents(handle, ea->count, context_id, ea->total_length,
-                              last);
+    trace_nbd_co_send_extents(request->handle, ea->count, context_id,
+                              ea->total_length, last);
     set_be_chunk(client, iov, 3, last ? NBD_REPLY_FLAG_DONE : 0,
-                 NBD_REPLY_TYPE_BLOCK_STATUS, handle);
+                 NBD_REPLY_TYPE_BLOCK_STATUS, request);
     stl_be_p(&chunk.context_id, context_id);
 
     return nbd_co_send_iov(client, iov, 3, errp);
@@ -2243,7 +2245,7 @@ nbd_co_send_extents(NBDClient *client, uint64_t handle, NBDExtentArray *ea,
 
 /* Get block status from the exported device and send it to the client */
 static int
-coroutine_fn nbd_co_send_block_status(NBDClient *client, uint64_t handle,
+coroutine_fn nbd_co_send_block_status(NBDClient *client, NBDRequest *request,
                                       BlockBackend *blk, uint64_t offset,
                                       uint32_t length, bool dont_fragment,
                                       bool last, uint32_t context_id,
@@ -2259,11 +2261,11 @@ coroutine_fn nbd_co_send_block_status(NBDClient *client, uint64_t handle,
         ret = blockalloc_to_extents(blk, offset, length, ea);
     }
     if (ret < 0) {
-        return nbd_co_send_chunk_error(client, handle, -ret,
+        return nbd_co_send_chunk_error(client, request, -ret,
                                        "can't get block status", errp);
     }
 
-    return nbd_co_send_extents(client, handle, ea, last, context_id, errp);
+    return nbd_co_send_extents(client, request, ea, last, context_id, errp);
 }
 
 /* Populate @ea from a dirty bitmap. */
@@ -2298,17 +2300,20 @@ static void bitmap_to_extents(BdrvDirtyBitmap *bitmap,
     bdrv_dirty_bitmap_unlock(bitmap);
 }
 
-static int coroutine_fn nbd_co_send_bitmap(NBDClient *client, uint64_t handle,
-                                           BdrvDirtyBitmap *bitmap, uint64_t offset,
-                                           uint32_t length, bool dont_fragment, bool last,
-                                           uint32_t context_id, Error **errp)
+static int coroutine_fn nbd_co_send_bitmap(NBDClient *client,
+                                           NBDRequest *request,
+                                           BdrvDirtyBitmap *bitmap,
+                                           uint64_t offset,
+                                           uint32_t length, bool dont_fragment,
+                                           bool last, uint32_t context_id,
+                                           Error **errp)
 {
     unsigned int nb_extents = dont_fragment ? 1 : NBD_MAX_BLOCK_STATUS_EXTENTS;
     g_autoptr(NBDExtentArray) ea = nbd_extent_array_new(nb_extents);
 
     bitmap_to_extents(bitmap, offset, length, ea);
 
-    return nbd_co_send_extents(client, handle, ea, last, context_id, errp);
+    return nbd_co_send_extents(client, request, ea, last, context_id, errp);
 }
 
 /* nbd_co_receive_request
@@ -2426,15 +2431,15 @@ static int coroutine_fn nbd_co_receive_request(NBDRequestData *req, NBDRequest *
  * Returns 0 if connection is still live, -errno on failure to talk to client
  */
 static coroutine_fn int nbd_send_generic_reply(NBDClient *client,
-                                               uint64_t handle,
+                                               NBDRequest *request,
                                                int ret,
                                                const char *error_msg,
                                                Error **errp)
 {
     if (client->structured_reply && ret < 0) {
-        return nbd_co_send_chunk_error(client, handle, -ret, error_msg, errp);
+        return nbd_co_send_chunk_error(client, request, -ret, error_msg, errp);
     } else {
-        return nbd_co_send_simple_reply(client, handle, ret < 0 ? -ret : 0,
+        return nbd_co_send_simple_reply(client, request, ret < 0 ? -ret : 0,
                                         NULL, 0, errp);
     }
 }
@@ -2454,7 +2459,7 @@ static coroutine_fn int nbd_do_cmd_read(NBDClient *client, NBDRequest *request,
     if (request->flags & NBD_CMD_FLAG_FUA) {
         ret = blk_co_flush(exp->common.blk);
         if (ret < 0) {
-            return nbd_send_generic_reply(client, request->handle, ret,
+            return nbd_send_generic_reply(client, request, ret,
                                           "flush failed", errp);
         }
     }
@@ -2462,26 +2467,25 @@ static coroutine_fn int nbd_do_cmd_read(NBDClient *client, NBDRequest *request,
     if (client->structured_reply && !(request->flags & NBD_CMD_FLAG_DF) &&
         request->len)
     {
-        return nbd_co_send_sparse_read(client, request->handle, request->from,
+        return nbd_co_send_sparse_read(client, request, request->from,
                                        data, request->len, errp);
     }
 
     ret = blk_co_pread(exp->common.blk, request->from, request->len, data, 0);
     if (ret < 0) {
-        return nbd_send_generic_reply(client, request->handle, ret,
+        return nbd_send_generic_reply(client, request, ret,
                                       "reading from file failed", errp);
     }
 
     if (client->structured_reply) {
         if (request->len) {
-            return nbd_co_send_chunk_read(client, request->handle,
-                                          request->from, data,
+            return nbd_co_send_chunk_read(client, request, request->from, data,
                                           request->len, true, errp);
         } else {
-            return nbd_co_send_chunk_done(client, request->handle, errp);
+            return nbd_co_send_chunk_done(client, request, errp);
         }
     } else {
-        return nbd_co_send_simple_reply(client, request->handle, 0,
+        return nbd_co_send_simple_reply(client, request, 0,
                                         data, request->len, errp);
     }
 }
@@ -2504,7 +2508,7 @@ static coroutine_fn int nbd_do_cmd_cache(NBDClient *client, NBDRequest *request,
     ret = blk_co_preadv(exp->common.blk, request->from, request->len,
                         NULL, BDRV_REQ_COPY_ON_READ | BDRV_REQ_PREFETCH);
 
-    return nbd_send_generic_reply(client, request->handle, ret,
+    return nbd_send_generic_reply(client, request, ret,
                                   "caching data failed", errp);
 }
 
@@ -2535,7 +2539,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
         }
         ret = blk_co_pwrite(exp->common.blk, request->from, request->len, data,
                             flags);
-        return nbd_send_generic_reply(client, request->handle, ret,
+        return nbd_send_generic_reply(client, request, ret,
                                       "writing to file failed", errp);
 
     case NBD_CMD_WRITE_ZEROES:
@@ -2551,7 +2555,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
         }
         ret = blk_co_pwrite_zeroes(exp->common.blk, request->from, request->len,
                                    flags);
-        return nbd_send_generic_reply(client, request->handle, ret,
+        return nbd_send_generic_reply(client, request, ret,
                                       "writing to file failed", errp);
 
     case NBD_CMD_DISC:
@@ -2560,7 +2564,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
 
     case NBD_CMD_FLUSH:
         ret = blk_co_flush(exp->common.blk);
-        return nbd_send_generic_reply(client, request->handle, ret,
+        return nbd_send_generic_reply(client, request, ret,
                                       "flush failed", errp);
 
     case NBD_CMD_TRIM:
@@ -2568,12 +2572,12 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
         if (ret >= 0 && request->flags & NBD_CMD_FLAG_FUA) {
             ret = blk_co_flush(exp->common.blk);
         }
-        return nbd_send_generic_reply(client, request->handle, ret,
+        return nbd_send_generic_reply(client, request, ret,
                                       "discard failed", errp);
 
     case NBD_CMD_BLOCK_STATUS:
         if (!request->len) {
-            return nbd_send_generic_reply(client, request->handle, -EINVAL,
+            return nbd_send_generic_reply(client, request, -EINVAL,
                                           "need non-zero length", errp);
         }
         if (client->export_meta.count) {
@@ -2581,7 +2585,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
             int contexts_remaining = client->export_meta.count;
 
             if (client->export_meta.base_allocation) {
-                ret = nbd_co_send_block_status(client, request->handle,
+                ret = nbd_co_send_block_status(client, request,
                                                exp->common.blk,
                                                request->from,
                                                request->len, dont_fragment,
@@ -2594,7 +2598,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
             }
 
             if (client->export_meta.allocation_depth) {
-                ret = nbd_co_send_block_status(client, request->handle,
+                ret = nbd_co_send_block_status(client, request,
                                                exp->common.blk,
                                                request->from, request->len,
                                                dont_fragment,
@@ -2610,7 +2614,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
                 if (!client->export_meta.bitmaps[i]) {
                     continue;
                 }
-                ret = nbd_co_send_bitmap(client, request->handle,
+                ret = nbd_co_send_bitmap(client, request,
                                          client->exp->export_bitmaps[i],
                                          request->from, request->len,
                                          dont_fragment, !--contexts_remaining,
@@ -2624,7 +2628,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
 
             return 0;
         } else {
-            return nbd_send_generic_reply(client, request->handle, -EINVAL,
+            return nbd_send_generic_reply(client, request, -EINVAL,
                                           "CMD_BLOCK_STATUS not negotiated",
                                           errp);
         }
@@ -2632,7 +2636,7 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
     default:
         msg = g_strdup_printf("invalid request type (%" PRIu32 ") received",
                               request->type);
-        ret = nbd_send_generic_reply(client, request->handle, -EINVAL, msg,
+        ret = nbd_send_generic_reply(client, request, -EINVAL, msg,
                                      errp);
         g_free(msg);
         return ret;
@@ -2695,7 +2699,7 @@ static coroutine_fn void nbd_trip(void *opaque)
         Error *export_err = local_err;
 
         local_err = NULL;
-        ret = nbd_send_generic_reply(client, request.handle, -EINVAL,
+        ret = nbd_send_generic_reply(client, &request, -EINVAL,
                                      error_get_pretty(export_err), &local_err);
         error_free(export_err);
     } else {

From 22efd81104f07f7dbe571a923cc43ed625560551 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:34 -0500
Subject: [PATCH 0878/1353] nbd: s/handle/cookie/ to match NBD spec

Externally, libnbd exposed the 64-bit opaque marker for each client
NBD packet as the "cookie", because it was less confusing when
contrasted with 'struct nbd_handle *' holding all libnbd state.  It
also avoids confusion between the noun 'handle' as a way to identify a
packet and the verb 'handle' for reacting to things like signals.
Upstream NBD changed their spec to favor the name "cookie" based on
libnbd's recommendations[1], so we can do likewise.

[1] https://github.com/NetworkBlockDevice/nbd/commit/ca4392eb2b

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20230608135653.2918540-6-eblake@redhat.com>
[eblake: typo fix]
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/nbd.c         | 96 +++++++++++++++++++++++----------------------
 include/block/nbd.h | 11 +++---
 nbd/client.c        | 14 +++----
 nbd/server.c        | 29 +++++++-------
 nbd/trace-events    | 22 +++++------
 5 files changed, 87 insertions(+), 85 deletions(-)

diff --git a/block/nbd.c b/block/nbd.c
index 5aef5cb6bd..be3c46c6fe 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -1,8 +1,8 @@
 /*
- * QEMU Block driver for  NBD
+ * QEMU Block driver for NBD
  *
  * Copyright (c) 2019 Virtuozzo International GmbH.
- * Copyright (C) 2016 Red Hat, Inc.
+ * Copyright Red Hat
  * Copyright (C) 2008 Bull S.A.S.
  *     Author: Laurent Vivier <Laurent.Vivier@bull.net>
  *
@@ -50,8 +50,8 @@
 #define EN_OPTSTR ":exportname="
 #define MAX_NBD_REQUESTS    16
 
-#define HANDLE_TO_INDEX(bs, handle) ((handle) ^ (uint64_t)(intptr_t)(bs))
-#define INDEX_TO_HANDLE(bs, index)  ((index)  ^ (uint64_t)(intptr_t)(bs))
+#define COOKIE_TO_INDEX(bs, cookie) ((cookie) ^ (uint64_t)(intptr_t)(bs))
+#define INDEX_TO_COOKIE(bs, index)  ((index)  ^ (uint64_t)(intptr_t)(bs))
 
 typedef struct {
     Coroutine *coroutine;
@@ -417,25 +417,25 @@ static void coroutine_fn GRAPH_RDLOCK nbd_reconnect_attempt(BDRVNBDState *s)
     reconnect_delay_timer_del(s);
 }
 
-static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
+static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t cookie)
 {
     int ret;
-    uint64_t ind = HANDLE_TO_INDEX(s, handle), ind2;
+    uint64_t ind = COOKIE_TO_INDEX(s, cookie), ind2;
     QEMU_LOCK_GUARD(&s->receive_mutex);
 
     while (true) {
-        if (s->reply.handle == handle) {
+        if (s->reply.cookie == cookie) {
             /* We are done */
             return 0;
         }
 
-        if (s->reply.handle != 0) {
+        if (s->reply.cookie != 0) {
             /*
              * Some other request is being handled now. It should already be
-             * woken by whoever set s->reply.handle (or never wait in this
+             * woken by whoever set s->reply.cookie (or never wait in this
              * yield). So, we should not wake it here.
              */
-            ind2 = HANDLE_TO_INDEX(s, s->reply.handle);
+            ind2 = COOKIE_TO_INDEX(s, s->reply.cookie);
             assert(!s->requests[ind2].receiving);
 
             s->requests[ind].receiving = true;
@@ -445,9 +445,9 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
             /*
              * We may be woken for 2 reasons:
              * 1. From this function, executing in parallel coroutine, when our
-             *    handle is received.
+             *    cookie is received.
              * 2. From nbd_co_receive_one_chunk(), when previous request is
-             *    finished and s->reply.handle set to 0.
+             *    finished and s->reply.cookie set to 0.
              * Anyway, it's OK to lock the mutex and go to the next iteration.
              */
 
@@ -456,8 +456,8 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
             continue;
         }
 
-        /* We are under mutex and handle is 0. We have to do the dirty work. */
-        assert(s->reply.handle == 0);
+        /* We are under mutex and cookie is 0. We have to do the dirty work. */
+        assert(s->reply.cookie == 0);
         ret = nbd_receive_reply(s->bs, s->ioc, &s->reply, NULL);
         if (ret <= 0) {
             ret = ret ? ret : -EIO;
@@ -468,12 +468,12 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
             nbd_channel_error(s, -EINVAL);
             return -EINVAL;
         }
-        ind2 = HANDLE_TO_INDEX(s, s->reply.handle);
+        ind2 = COOKIE_TO_INDEX(s, s->reply.cookie);
         if (ind2 >= MAX_NBD_REQUESTS || !s->requests[ind2].coroutine) {
             nbd_channel_error(s, -EINVAL);
             return -EINVAL;
         }
-        if (s->reply.handle == handle) {
+        if (s->reply.cookie == cookie) {
             /* We are done */
             return 0;
         }
@@ -519,7 +519,7 @@ nbd_co_send_request(BlockDriverState *bs, NBDRequest *request,
     qemu_mutex_unlock(&s->requests_lock);
 
     qemu_co_mutex_lock(&s->send_mutex);
-    request->handle = INDEX_TO_HANDLE(s, i);
+    request->cookie = INDEX_TO_COOKIE(s, i);
 
     assert(s->ioc);
 
@@ -828,11 +828,11 @@ static coroutine_fn int nbd_co_receive_structured_payload(
  * corresponding to the server's error reply), and errp is unchanged.
  */
 static coroutine_fn int nbd_co_do_receive_one_chunk(
-        BDRVNBDState *s, uint64_t handle, bool only_structured,
+        BDRVNBDState *s, uint64_t cookie, bool only_structured,
         int *request_ret, QEMUIOVector *qiov, void **payload, Error **errp)
 {
     int ret;
-    int i = HANDLE_TO_INDEX(s, handle);
+    int i = COOKIE_TO_INDEX(s, cookie);
     void *local_payload = NULL;
     NBDStructuredReplyChunk *chunk;
 
@@ -841,14 +841,14 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
     }
     *request_ret = 0;
 
-    ret = nbd_receive_replies(s, handle);
+    ret = nbd_receive_replies(s, cookie);
     if (ret < 0) {
         error_setg(errp, "Connection closed");
         return -EIO;
     }
     assert(s->ioc);
 
-    assert(s->reply.handle == handle);
+    assert(s->reply.cookie == cookie);
 
     if (nbd_reply_is_simple(&s->reply)) {
         if (only_structured) {
@@ -918,11 +918,11 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
  * Return value is a fatal error code or normal nbd reply error code
  */
 static coroutine_fn int nbd_co_receive_one_chunk(
-        BDRVNBDState *s, uint64_t handle, bool only_structured,
+        BDRVNBDState *s, uint64_t cookie, bool only_structured,
         int *request_ret, QEMUIOVector *qiov, NBDReply *reply, void **payload,
         Error **errp)
 {
-    int ret = nbd_co_do_receive_one_chunk(s, handle, only_structured,
+    int ret = nbd_co_do_receive_one_chunk(s, cookie, only_structured,
                                           request_ret, qiov, payload, errp);
 
     if (ret < 0) {
@@ -932,7 +932,7 @@ static coroutine_fn int nbd_co_receive_one_chunk(
         /* For assert at loop start in nbd_connection_entry */
         *reply = s->reply;
     }
-    s->reply.handle = 0;
+    s->reply.cookie = 0;
 
     nbd_recv_coroutines_wake(s);
 
@@ -975,10 +975,10 @@ static void nbd_iter_request_error(NBDReplyChunkIter *iter, int ret)
  * NBD_FOREACH_REPLY_CHUNK
  * The pointer stored in @payload requires g_free() to free it.
  */
-#define NBD_FOREACH_REPLY_CHUNK(s, iter, handle, structured, \
+#define NBD_FOREACH_REPLY_CHUNK(s, iter, cookie, structured, \
                                 qiov, reply, payload) \
     for (iter = (NBDReplyChunkIter) { .only_structured = structured }; \
-         nbd_reply_chunk_iter_receive(s, &iter, handle, qiov, reply, payload);)
+         nbd_reply_chunk_iter_receive(s, &iter, cookie, qiov, reply, payload);)
 
 /*
  * nbd_reply_chunk_iter_receive
@@ -986,7 +986,7 @@ static void nbd_iter_request_error(NBDReplyChunkIter *iter, int ret)
  */
 static bool coroutine_fn nbd_reply_chunk_iter_receive(BDRVNBDState *s,
                                                       NBDReplyChunkIter *iter,
-                                                      uint64_t handle,
+                                                      uint64_t cookie,
                                                       QEMUIOVector *qiov,
                                                       NBDReply *reply,
                                                       void **payload)
@@ -1005,7 +1005,7 @@ static bool coroutine_fn nbd_reply_chunk_iter_receive(BDRVNBDState *s,
         reply = &local_reply;
     }
 
-    ret = nbd_co_receive_one_chunk(s, handle, iter->only_structured,
+    ret = nbd_co_receive_one_chunk(s, cookie, iter->only_structured,
                                    &request_ret, qiov, reply, payload,
                                    &local_err);
     if (ret < 0) {
@@ -1038,7 +1038,7 @@ static bool coroutine_fn nbd_reply_chunk_iter_receive(BDRVNBDState *s,
 
 break_loop:
     qemu_mutex_lock(&s->requests_lock);
-    s->requests[HANDLE_TO_INDEX(s, handle)].coroutine = NULL;
+    s->requests[COOKIE_TO_INDEX(s, cookie)].coroutine = NULL;
     s->in_flight--;
     qemu_co_queue_next(&s->free_sema);
     qemu_mutex_unlock(&s->requests_lock);
@@ -1046,12 +1046,13 @@ break_loop:
     return false;
 }
 
-static int coroutine_fn nbd_co_receive_return_code(BDRVNBDState *s, uint64_t handle,
-                                                   int *request_ret, Error **errp)
+static int coroutine_fn
+nbd_co_receive_return_code(BDRVNBDState *s, uint64_t cookie,
+                           int *request_ret, Error **errp)
 {
     NBDReplyChunkIter iter;
 
-    NBD_FOREACH_REPLY_CHUNK(s, iter, handle, false, NULL, NULL, NULL) {
+    NBD_FOREACH_REPLY_CHUNK(s, iter, cookie, false, NULL, NULL, NULL) {
         /* nbd_reply_chunk_iter_receive does all the work */
     }
 
@@ -1060,16 +1061,17 @@ static int coroutine_fn nbd_co_receive_return_code(BDRVNBDState *s, uint64_t han
     return iter.ret;
 }
 
-static int coroutine_fn nbd_co_receive_cmdread_reply(BDRVNBDState *s, uint64_t handle,
-                                                     uint64_t offset, QEMUIOVector *qiov,
-                                                     int *request_ret, Error **errp)
+static int coroutine_fn
+nbd_co_receive_cmdread_reply(BDRVNBDState *s, uint64_t cookie,
+                             uint64_t offset, QEMUIOVector *qiov,
+                             int *request_ret, Error **errp)
 {
     NBDReplyChunkIter iter;
     NBDReply reply;
     void *payload = NULL;
     Error *local_err = NULL;
 
-    NBD_FOREACH_REPLY_CHUNK(s, iter, handle, s->info.structured_reply,
+    NBD_FOREACH_REPLY_CHUNK(s, iter, cookie, s->info.structured_reply,
                             qiov, &reply, &payload)
     {
         int ret;
@@ -1112,10 +1114,10 @@ static int coroutine_fn nbd_co_receive_cmdread_reply(BDRVNBDState *s, uint64_t h
     return iter.ret;
 }
 
-static int coroutine_fn nbd_co_receive_blockstatus_reply(BDRVNBDState *s,
-                                                         uint64_t handle, uint64_t length,
-                                                         NBDExtent *extent,
-                                                         int *request_ret, Error **errp)
+static int coroutine_fn
+nbd_co_receive_blockstatus_reply(BDRVNBDState *s, uint64_t cookie,
+                                 uint64_t length, NBDExtent *extent,
+                                 int *request_ret, Error **errp)
 {
     NBDReplyChunkIter iter;
     NBDReply reply;
@@ -1124,7 +1126,7 @@ static int coroutine_fn nbd_co_receive_blockstatus_reply(BDRVNBDState *s,
     bool received = false;
 
     assert(!extent->length);
-    NBD_FOREACH_REPLY_CHUNK(s, iter, handle, false, NULL, &reply, &payload) {
+    NBD_FOREACH_REPLY_CHUNK(s, iter, cookie, false, NULL, &reply, &payload) {
         int ret;
         NBDStructuredReplyChunk *chunk = &reply.structured;
 
@@ -1194,11 +1196,11 @@ nbd_co_request(BlockDriverState *bs, NBDRequest *request,
             continue;
         }
 
-        ret = nbd_co_receive_return_code(s, request->handle,
+        ret = nbd_co_receive_return_code(s, request->cookie,
                                          &request_ret, &local_err);
         if (local_err) {
             trace_nbd_co_request_fail(request->from, request->len,
-                                      request->handle, request->flags,
+                                      request->cookie, request->flags,
                                       request->type,
                                       nbd_cmd_lookup(request->type),
                                       ret, error_get_pretty(local_err));
@@ -1253,10 +1255,10 @@ nbd_client_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
             continue;
         }
 
-        ret = nbd_co_receive_cmdread_reply(s, request.handle, offset, qiov,
+        ret = nbd_co_receive_cmdread_reply(s, request.cookie, offset, qiov,
                                            &request_ret, &local_err);
         if (local_err) {
-            trace_nbd_co_request_fail(request.from, request.len, request.handle,
+            trace_nbd_co_request_fail(request.from, request.len, request.cookie,
                                       request.flags, request.type,
                                       nbd_cmd_lookup(request.type),
                                       ret, error_get_pretty(local_err));
@@ -1411,11 +1413,11 @@ static int coroutine_fn GRAPH_RDLOCK nbd_client_co_block_status(
             continue;
         }
 
-        ret = nbd_co_receive_blockstatus_reply(s, request.handle, bytes,
+        ret = nbd_co_receive_blockstatus_reply(s, request.cookie, bytes,
                                                &extent, &request_ret,
                                                &local_err);
         if (local_err) {
-            trace_nbd_co_request_fail(request.from, request.len, request.handle,
+            trace_nbd_co_request_fail(request.from, request.len, request.cookie,
                                       request.flags, request.type,
                                       nbd_cmd_lookup(request.type),
                                       ret, error_get_pretty(local_err));
diff --git a/include/block/nbd.h b/include/block/nbd.h
index ee71af099a..fb935d56e5 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -59,7 +59,7 @@ typedef struct NBDOptionReplyMetaContext {
  * request and reply!
  */
 typedef struct NBDRequest {
-    uint64_t handle;
+    uint64_t cookie;
     uint64_t from;
     uint32_t len;
     uint16_t flags; /* NBD_CMD_FLAG_* */
@@ -69,7 +69,7 @@ typedef struct NBDRequest {
 typedef struct NBDSimpleReply {
     uint32_t magic;  /* NBD_SIMPLE_REPLY_MAGIC */
     uint32_t error;
-    uint64_t handle;
+    uint64_t cookie;
 } QEMU_PACKED NBDSimpleReply;
 
 /* Header of all structured replies */
@@ -77,7 +77,7 @@ typedef struct NBDStructuredReplyChunk {
     uint32_t magic;  /* NBD_STRUCTURED_REPLY_MAGIC */
     uint16_t flags;  /* combination of NBD_REPLY_FLAG_* */
     uint16_t type;   /* NBD_REPLY_TYPE_* */
-    uint64_t handle; /* request handle */
+    uint64_t cookie; /* request handle */
     uint32_t length; /* length of payload */
 } QEMU_PACKED NBDStructuredReplyChunk;
 
@@ -85,13 +85,14 @@ typedef union NBDReply {
     NBDSimpleReply simple;
     NBDStructuredReplyChunk structured;
     struct {
-        /* @magic and @handle fields have the same offset and size both in
+        /*
+         * @magic and @cookie fields have the same offset and size both in
          * simple reply and structured reply chunk, so let them be accessible
          * without ".simple." or ".structured." specification
          */
         uint32_t magic;
         uint32_t _skip;
-        uint64_t handle;
+        uint64_t cookie;
     } QEMU_PACKED;
 } NBDReply;
 
diff --git a/nbd/client.c b/nbd/client.c
index ff75722e48..ea3590ca3d 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2016-2019 Red Hat, Inc.
+ *  Copyright Red Hat
  *  Copyright (C) 2005  Anthony Liguori <anthony@codemonkey.ws>
  *
  *  Network Block Device Client Side
@@ -1350,14 +1350,14 @@ int nbd_send_request(QIOChannel *ioc, NBDRequest *request)
 {
     uint8_t buf[NBD_REQUEST_SIZE];
 
-    trace_nbd_send_request(request->from, request->len, request->handle,
+    trace_nbd_send_request(request->from, request->len, request->cookie,
                            request->flags, request->type,
                            nbd_cmd_lookup(request->type));
 
     stl_be_p(buf, NBD_REQUEST_MAGIC);
     stw_be_p(buf + 4, request->flags);
     stw_be_p(buf + 6, request->type);
-    stq_be_p(buf + 8, request->handle);
+    stq_be_p(buf + 8, request->cookie);
     stq_be_p(buf + 16, request->from);
     stl_be_p(buf + 24, request->len);
 
@@ -1383,7 +1383,7 @@ static int nbd_receive_simple_reply(QIOChannel *ioc, NBDSimpleReply *reply,
     }
 
     reply->error = be32_to_cpu(reply->error);
-    reply->handle = be64_to_cpu(reply->handle);
+    reply->cookie = be64_to_cpu(reply->cookie);
 
     return 0;
 }
@@ -1410,7 +1410,7 @@ static int nbd_receive_structured_reply_chunk(QIOChannel *ioc,
 
     chunk->flags = be16_to_cpu(chunk->flags);
     chunk->type = be16_to_cpu(chunk->type);
-    chunk->handle = be64_to_cpu(chunk->handle);
+    chunk->cookie = be64_to_cpu(chunk->cookie);
     chunk->length = be32_to_cpu(chunk->length);
 
     return 0;
@@ -1487,7 +1487,7 @@ int coroutine_fn nbd_receive_reply(BlockDriverState *bs, QIOChannel *ioc,
         }
         trace_nbd_receive_simple_reply(reply->simple.error,
                                        nbd_err_lookup(reply->simple.error),
-                                       reply->handle);
+                                       reply->cookie);
         break;
     case NBD_STRUCTURED_REPLY_MAGIC:
         ret = nbd_receive_structured_reply_chunk(ioc, &reply->structured, errp);
@@ -1497,7 +1497,7 @@ int coroutine_fn nbd_receive_reply(BlockDriverState *bs, QIOChannel *ioc,
         type = nbd_reply_type_lookup(reply->structured.type);
         trace_nbd_receive_structured_reply_chunk(reply->structured.flags,
                                                  reply->structured.type, type,
-                                                 reply->structured.handle,
+                                                 reply->structured.cookie,
                                                  reply->structured.length);
         break;
     default:
diff --git a/nbd/server.c b/nbd/server.c
index 26b27d6920..8486b64b15 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -1428,7 +1428,7 @@ static int coroutine_fn nbd_receive_request(NBDClient *client, NBDRequest *reque
        [ 0 ..  3]   magic   (NBD_REQUEST_MAGIC)
        [ 4 ..  5]   flags   (NBD_CMD_FLAG_FUA, ...)
        [ 6 ..  7]   type    (NBD_CMD_READ, ...)
-       [ 8 .. 15]   handle
+       [ 8 .. 15]   cookie
        [16 .. 23]   from
        [24 .. 27]   len
      */
@@ -1436,7 +1436,7 @@ static int coroutine_fn nbd_receive_request(NBDClient *client, NBDRequest *reque
     magic = ldl_be_p(buf);
     request->flags  = lduw_be_p(buf + 4);
     request->type   = lduw_be_p(buf + 6);
-    request->handle = ldq_be_p(buf + 8);
+    request->cookie = ldq_be_p(buf + 8);
     request->from   = ldq_be_p(buf + 16);
     request->len    = ldl_be_p(buf + 24);
 
@@ -1885,11 +1885,11 @@ static int coroutine_fn nbd_co_send_iov(NBDClient *client, struct iovec *iov,
 }
 
 static inline void set_be_simple_reply(NBDSimpleReply *reply, uint64_t error,
-                                       uint64_t handle)
+                                       uint64_t cookie)
 {
     stl_be_p(&reply->magic, NBD_SIMPLE_REPLY_MAGIC);
     stl_be_p(&reply->error, error);
-    stq_be_p(&reply->handle, handle);
+    stq_be_p(&reply->cookie, cookie);
 }
 
 static int coroutine_fn nbd_co_send_simple_reply(NBDClient *client,
@@ -1908,9 +1908,9 @@ static int coroutine_fn nbd_co_send_simple_reply(NBDClient *client,
 
     assert(!len || !nbd_err);
     assert(!client->structured_reply || request->type != NBD_CMD_READ);
-    trace_nbd_co_send_simple_reply(request->handle, nbd_err,
+    trace_nbd_co_send_simple_reply(request->cookie, nbd_err,
                                    nbd_err_lookup(nbd_err), len);
-    set_be_simple_reply(&reply, nbd_err, request->handle);
+    set_be_simple_reply(&reply, nbd_err, request->cookie);
 
     return nbd_co_send_iov(client, iov, 2, errp);
 }
@@ -1940,7 +1940,7 @@ static inline void set_be_chunk(NBDClient *client, struct iovec *iov,
     stl_be_p(&chunk->magic, NBD_STRUCTURED_REPLY_MAGIC);
     stw_be_p(&chunk->flags, flags);
     stw_be_p(&chunk->type, type);
-    stq_be_p(&chunk->handle, request->handle);
+    stq_be_p(&chunk->cookie, request->cookie);
     stl_be_p(&chunk->length, length);
 }
 
@@ -1953,10 +1953,9 @@ static int coroutine_fn nbd_co_send_chunk_done(NBDClient *client,
         {.iov_base = &hdr},
     };
 
-    trace_nbd_co_send_chunk_done(request->handle);
+    trace_nbd_co_send_chunk_done(request->cookie);
     set_be_chunk(client, iov, 1, NBD_REPLY_FLAG_DONE,
                  NBD_REPLY_TYPE_NONE, request);
-
     return nbd_co_send_iov(client, iov, 1, errp);
 }
 
@@ -1977,7 +1976,7 @@ static int coroutine_fn nbd_co_send_chunk_read(NBDClient *client,
     };
 
     assert(size);
-    trace_nbd_co_send_chunk_read(request->handle, offset, data, size);
+    trace_nbd_co_send_chunk_read(request->cookie, offset, data, size);
     set_be_chunk(client, iov, 3, final ? NBD_REPLY_FLAG_DONE : 0,
                  NBD_REPLY_TYPE_OFFSET_DATA, request);
     stq_be_p(&chunk.offset, offset);
@@ -2001,7 +2000,7 @@ static int coroutine_fn nbd_co_send_chunk_error(NBDClient *client,
     };
 
     assert(nbd_err);
-    trace_nbd_co_send_chunk_error(request->handle, nbd_err,
+    trace_nbd_co_send_chunk_error(request->cookie, nbd_err,
                                   nbd_err_lookup(nbd_err), msg ? msg : "");
     set_be_chunk(client, iov, 3, NBD_REPLY_FLAG_DONE,
                  NBD_REPLY_TYPE_ERROR, request);
@@ -2052,7 +2051,7 @@ static int coroutine_fn nbd_co_send_sparse_read(NBDClient *client,
                 {.iov_base = &chunk, .iov_len = sizeof(chunk)},
             };
 
-            trace_nbd_co_send_chunk_read_hole(request->handle,
+            trace_nbd_co_send_chunk_read_hole(request->cookie,
                                               offset + progress, pnum);
             set_be_chunk(client, iov, 2,
                          final ? NBD_REPLY_FLAG_DONE : 0,
@@ -2234,7 +2233,7 @@ nbd_co_send_extents(NBDClient *client, NBDRequest *request, NBDExtentArray *ea,
 
     nbd_extent_array_convert_to_be(ea);
 
-    trace_nbd_co_send_extents(request->handle, ea->count, context_id,
+    trace_nbd_co_send_extents(request->cookie, ea->count, context_id,
                               ea->total_length, last);
     set_be_chunk(client, iov, 3, last ? NBD_REPLY_FLAG_DONE : 0,
                  NBD_REPLY_TYPE_BLOCK_STATUS, request);
@@ -2337,7 +2336,7 @@ static int coroutine_fn nbd_co_receive_request(NBDRequestData *req, NBDRequest *
         return ret;
     }
 
-    trace_nbd_co_receive_request_decode_type(request->handle, request->type,
+    trace_nbd_co_receive_request_decode_type(request->cookie, request->type,
                                              nbd_cmd_lookup(request->type));
 
     if (request->type != NBD_CMD_WRITE) {
@@ -2378,7 +2377,7 @@ static int coroutine_fn nbd_co_receive_request(NBDRequestData *req, NBDRequest *
         }
         req->complete = true;
 
-        trace_nbd_co_receive_request_payload_received(request->handle,
+        trace_nbd_co_receive_request_payload_received(request->cookie,
                                                       request->len);
     }
 
diff --git a/nbd/trace-events b/nbd/trace-events
index 50ca05a9e2..f19a4d0db3 100644
--- a/nbd/trace-events
+++ b/nbd/trace-events
@@ -31,9 +31,9 @@ nbd_client_loop(void) "Doing NBD loop"
 nbd_client_loop_ret(int ret, const char *error) "NBD loop returned %d: %s"
 nbd_client_clear_queue(void) "Clearing NBD queue"
 nbd_client_clear_socket(void) "Clearing NBD socket"
-nbd_send_request(uint64_t from, uint32_t len, uint64_t handle, uint16_t flags, uint16_t type, const char *name) "Sending request to server: { .from = %" PRIu64", .len = %" PRIu32 ", .handle = %" PRIu64 ", .flags = 0x%" PRIx16 ", .type = %" PRIu16 " (%s) }"
-nbd_receive_simple_reply(int32_t error, const char *errname, uint64_t handle) "Got simple reply: { .error = %" PRId32 " (%s), handle = %" PRIu64" }"
-nbd_receive_structured_reply_chunk(uint16_t flags, uint16_t type, const char *name, uint64_t handle, uint32_t length) "Got structured reply chunk: { flags = 0x%" PRIx16 ", type = %d (%s), handle = %" PRIu64 ", length = %" PRIu32 " }"
+nbd_send_request(uint64_t from, uint32_t len, uint64_t cookie, uint16_t flags, uint16_t type, const char *name) "Sending request to server: { .from = %" PRIu64", .len = %" PRIu32 ", .cookie = %" PRIu64 ", .flags = 0x%" PRIx16 ", .type = %" PRIu16 " (%s) }"
+nbd_receive_simple_reply(int32_t error, const char *errname, uint64_t cookie) "Got simple reply: { .error = %" PRId32 " (%s), cookie = %" PRIu64" }"
+nbd_receive_structured_reply_chunk(uint16_t flags, uint16_t type, const char *name, uint64_t cookie, uint32_t length) "Got structured reply chunk: { flags = 0x%" PRIx16 ", type = %d (%s), cookie = %" PRIu64 ", length = %" PRIu32 " }"
 
 # common.c
 nbd_unknown_error(int err) "Squashing unexpected error %d to EINVAL"
@@ -63,14 +63,14 @@ nbd_negotiate_success(void) "Negotiation succeeded"
 nbd_receive_request(uint32_t magic, uint16_t flags, uint16_t type, uint64_t from, uint32_t len) "Got request: { magic = 0x%" PRIx32 ", .flags = 0x%" PRIx16 ", .type = 0x%" PRIx16 ", from = %" PRIu64 ", len = %" PRIu32 " }"
 nbd_blk_aio_attached(const char *name, void *ctx) "Export %s: Attaching clients to AIO context %p"
 nbd_blk_aio_detach(const char *name, void *ctx) "Export %s: Detaching clients from AIO context %p"
-nbd_co_send_simple_reply(uint64_t handle, uint32_t error, const char *errname, int len) "Send simple reply: handle = %" PRIu64 ", error = %" PRIu32 " (%s), len = %d"
-nbd_co_send_chunk_done(uint64_t handle) "Send structured reply done: handle = %" PRIu64
-nbd_co_send_chunk_read(uint64_t handle, uint64_t offset, void *data, size_t size) "Send structured read data reply: handle = %" PRIu64 ", offset = %" PRIu64 ", data = %p, len = %zu"
-nbd_co_send_chunk_read_hole(uint64_t handle, uint64_t offset, size_t size) "Send structured read hole reply: handle = %" PRIu64 ", offset = %" PRIu64 ", len = %zu"
-nbd_co_send_extents(uint64_t handle, unsigned int extents, uint32_t id, uint64_t length, int last) "Send block status reply: handle = %" PRIu64 ", extents = %u, context = %d (extents cover %" PRIu64 " bytes, last chunk = %d)"
-nbd_co_send_chunk_error(uint64_t handle, int err, const char *errname, const char *msg) "Send structured error reply: handle = %" PRIu64 ", error = %d (%s), msg = '%s'"
-nbd_co_receive_request_decode_type(uint64_t handle, uint16_t type, const char *name) "Decoding type: handle = %" PRIu64 ", type = %" PRIu16 " (%s)"
-nbd_co_receive_request_payload_received(uint64_t handle, uint32_t len) "Payload received: handle = %" PRIu64 ", len = %" PRIu32
+nbd_co_send_simple_reply(uint64_t cookie, uint32_t error, const char *errname, int len) "Send simple reply: cookie = %" PRIu64 ", error = %" PRIu32 " (%s), len = %d"
+nbd_co_send_chunk_done(uint64_t cookie) "Send structured reply done: cookie = %" PRIu64
+nbd_co_send_chunk_read(uint64_t cookie, uint64_t offset, void *data, size_t size) "Send structured read data reply: cookie = %" PRIu64 ", offset = %" PRIu64 ", data = %p, len = %zu"
+nbd_co_send_chunk_read_hole(uint64_t cookie, uint64_t offset, size_t size) "Send structured read hole reply: cookie = %" PRIu64 ", offset = %" PRIu64 ", len = %zu"
+nbd_co_send_extents(uint64_t cookie, unsigned int extents, uint32_t id, uint64_t length, int last) "Send block status reply: cookie = %" PRIu64 ", extents = %u, context = %d (extents cover %" PRIu64 " bytes, last chunk = %d)"
+nbd_co_send_chunk_error(uint64_t cookie, int err, const char *errname, const char *msg) "Send structured error reply: cookie = %" PRIu64 ", error = %d (%s), msg = '%s'"
+nbd_co_receive_request_decode_type(uint64_t cookie, uint16_t type, const char *name) "Decoding type: cookie = %" PRIu64 ", type = %" PRIu16 " (%s)"
+nbd_co_receive_request_payload_received(uint64_t cookie, uint32_t len) "Payload received: cookie = %" PRIu64 ", len = %" PRIu32
 nbd_co_receive_align_compliance(const char *op, uint64_t from, uint32_t len, uint32_t align) "client sent non-compliant unaligned %s request: from=0x%" PRIx64 ", len=0x%" PRIx32 ", align=0x%" PRIx32
 nbd_trip(void) "Reading request"
 

From 8cb98a725e7397c9de25ebd77c00b1d5f2d8351e Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:35 -0500
Subject: [PATCH 0879/1353] nbd/client: Simplify cookie vs. index computation

Our code relies on a sentinel cookie value of zero for deciding when a
packet has been handled, as well as relying on array indices between 0
and MAX_NBD_REQUESTS-1 for dereferencing purposes.  As long as we can
symmetrically convert between two forms, there is no reason to go with
the odd choice of using XOR with a random pointer, when we can instead
simplify the mappings with a mere offset of 1.

Using ((uint64_t)-1) as the sentinel instead of NULL such that the two
macros could be entirely eliminated might also be possible, but would
require a more careful audit to find places where we currently rely on
zero-initialization to be interpreted as the sentinel value, so I did
not pursue that course.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20230608135653.2918540-7-eblake@redhat.com>
[eblake: enhance commit message]
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 block/nbd.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/block/nbd.c b/block/nbd.c
index be3c46c6fe..5322e66166 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -50,8 +50,8 @@
 #define EN_OPTSTR ":exportname="
 #define MAX_NBD_REQUESTS    16
 
-#define COOKIE_TO_INDEX(bs, cookie) ((cookie) ^ (uint64_t)(intptr_t)(bs))
-#define INDEX_TO_COOKIE(bs, index)  ((index)  ^ (uint64_t)(intptr_t)(bs))
+#define COOKIE_TO_INDEX(cookie) ((cookie) - 1)
+#define INDEX_TO_COOKIE(index)  ((index) + 1)
 
 typedef struct {
     Coroutine *coroutine;
@@ -420,7 +420,7 @@ static void coroutine_fn GRAPH_RDLOCK nbd_reconnect_attempt(BDRVNBDState *s)
 static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t cookie)
 {
     int ret;
-    uint64_t ind = COOKIE_TO_INDEX(s, cookie), ind2;
+    uint64_t ind = COOKIE_TO_INDEX(cookie), ind2;
     QEMU_LOCK_GUARD(&s->receive_mutex);
 
     while (true) {
@@ -435,7 +435,7 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t cookie)
              * woken by whoever set s->reply.cookie (or never wait in this
              * yield). So, we should not wake it here.
              */
-            ind2 = COOKIE_TO_INDEX(s, s->reply.cookie);
+            ind2 = COOKIE_TO_INDEX(s->reply.cookie);
             assert(!s->requests[ind2].receiving);
 
             s->requests[ind].receiving = true;
@@ -468,7 +468,7 @@ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t cookie)
             nbd_channel_error(s, -EINVAL);
             return -EINVAL;
         }
-        ind2 = COOKIE_TO_INDEX(s, s->reply.cookie);
+        ind2 = COOKIE_TO_INDEX(s->reply.cookie);
         if (ind2 >= MAX_NBD_REQUESTS || !s->requests[ind2].coroutine) {
             nbd_channel_error(s, -EINVAL);
             return -EINVAL;
@@ -519,7 +519,7 @@ nbd_co_send_request(BlockDriverState *bs, NBDRequest *request,
     qemu_mutex_unlock(&s->requests_lock);
 
     qemu_co_mutex_lock(&s->send_mutex);
-    request->cookie = INDEX_TO_COOKIE(s, i);
+    request->cookie = INDEX_TO_COOKIE(i);
 
     assert(s->ioc);
 
@@ -832,7 +832,7 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
         int *request_ret, QEMUIOVector *qiov, void **payload, Error **errp)
 {
     int ret;
-    int i = COOKIE_TO_INDEX(s, cookie);
+    int i = COOKIE_TO_INDEX(cookie);
     void *local_payload = NULL;
     NBDStructuredReplyChunk *chunk;
 
@@ -1038,7 +1038,7 @@ static bool coroutine_fn nbd_reply_chunk_iter_receive(BDRVNBDState *s,
 
 break_loop:
     qemu_mutex_lock(&s->requests_lock);
-    s->requests[COOKIE_TO_INDEX(s, cookie)].coroutine = NULL;
+    s->requests[COOKIE_TO_INDEX(cookie)].coroutine = NULL;
     s->in_flight--;
     qemu_co_queue_next(&s->free_sema);
     qemu_mutex_unlock(&s->requests_lock);

From 70fa99f445a6fabe4b46f188cc665cd469cd8293 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:36 -0500
Subject: [PATCH 0880/1353] nbd/client: Add safety check on chunk payload
 length

Our existing use of structured replies either reads into a qiov capped
at 32M (NBD_CMD_READ) or caps allocation to 1000 bytes (see
NBD_MAX_MALLOC_PAYLOAD in block/nbd.c).  But the existing length
checks are rather late; if we encounter a buggy (or malicious) server
that sends a super-large payload length, we should drop the connection
right then rather than assuming the layer on top will be careful.
This becomes more important when we permit 64-bit lengths which are
even more likely to have the potential for attempted denial of service
abuse.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20230608135653.2918540-8-eblake@redhat.com>
---
 nbd/client.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nbd/client.c b/nbd/client.c
index ea3590ca3d..1b5569556f 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -1413,6 +1413,18 @@ static int nbd_receive_structured_reply_chunk(QIOChannel *ioc,
     chunk->cookie = be64_to_cpu(chunk->cookie);
     chunk->length = be32_to_cpu(chunk->length);
 
+    /*
+     * Because we use BLOCK_STATUS with REQ_ONE, and cap READ requests
+     * at 32M, no valid server should send us payload larger than
+     * this.  Even if we stopped using REQ_ONE, sane servers will cap
+     * the number of extents they return for block status.
+     */
+    if (chunk->length > NBD_MAX_BUFFER_SIZE + sizeof(NBDStructuredReadData)) {
+        error_setg(errp, "server chunk %" PRIu32 " (%s) payload is too long",
+                   chunk->type, nbd_rep_lookup(chunk->type));
+        return -EINVAL;
+    }
+
     return 0;
 }
 

From bfe04d0a7d5e8a4f4c9014ee7622af2056685974 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 8 Jun 2023 08:56:37 -0500
Subject: [PATCH 0881/1353] nbd: Use enum for various negotiation modes

Deciphering the hard-coded list of integer return values from
nbd_start_negotiate() will only get more confusing when adding support
for 64-bit extended headers.  Better is to name things in an enum.
Although the function in question is private to client.c, putting the
enum in a public header and including an enum-to-string conversion
will allow its use in more places in upcoming patches.

The enum is intentionally laid out so that operators like <= can be
used to group multiple modes with similar characteristics, and where
the least powerful mode has value 0, even though this patch does not
exploit that.  No semantic change intended.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20230608135653.2918540-9-eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
 include/block/nbd.h | 11 +++++++++++
 nbd/client.c        | 46 ++++++++++++++++++++++++---------------------
 nbd/common.c        | 17 +++++++++++++++++
 3 files changed, 53 insertions(+), 21 deletions(-)

diff --git a/include/block/nbd.h b/include/block/nbd.h
index fb935d56e5..4428bcffbb 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -53,6 +53,16 @@ typedef struct NBDOptionReplyMetaContext {
     /* metadata context name follows */
 } QEMU_PACKED NBDOptionReplyMetaContext;
 
+/* Track results of negotiation */
+typedef enum NBDMode {
+    /* Keep this list in a continuum of increasing features. */
+    NBD_MODE_OLDSTYLE,     /* server lacks newstyle negotiation */
+    NBD_MODE_EXPORT_NAME,  /* newstyle but only OPT_EXPORT_NAME safe */
+    NBD_MODE_SIMPLE,       /* newstyle but only simple replies */
+    NBD_MODE_STRUCTURED,   /* newstyle, structured replies enabled */
+    /* TODO add NBD_MODE_EXTENDED */
+} NBDMode;
+
 /* Transmission phase structs
  *
  * Note: these are _NOT_ the same as the network representation of an NBD
@@ -405,6 +415,7 @@ const char *nbd_rep_lookup(uint32_t rep);
 const char *nbd_info_lookup(uint16_t info);
 const char *nbd_cmd_lookup(uint16_t info);
 const char *nbd_err_lookup(int err);
+const char *nbd_mode_lookup(NBDMode mode);
 
 /* nbd/client-connection.c */
 void nbd_client_connection_enable_retry(NBDClientConnection *conn);
diff --git a/nbd/client.c b/nbd/client.c
index 1b5569556f..479208d5d9 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -875,10 +875,7 @@ static int nbd_list_meta_contexts(QIOChannel *ioc,
  * Start the handshake to the server.  After a positive return, the server
  * is ready to accept additional NBD_OPT requests.
  * Returns: negative errno: failure talking to server
- *          0: server is oldstyle, must call nbd_negotiate_finish_oldstyle
- *          1: server is newstyle, but can only accept EXPORT_NAME
- *          2: server is newstyle, but lacks structured replies
- *          3: server is newstyle and set up for structured replies
+ *          non-negative: enum NBDMode describing server abilities
  */
 static int nbd_start_negotiate(AioContext *aio_context, QIOChannel *ioc,
                                QCryptoTLSCreds *tlscreds,
@@ -969,16 +966,16 @@ static int nbd_start_negotiate(AioContext *aio_context, QIOChannel *ioc,
                     return -EINVAL;
                 }
             }
-            return 2 + result;
+            return result ? NBD_MODE_STRUCTURED : NBD_MODE_SIMPLE;
         } else {
-            return 1;
+            return NBD_MODE_EXPORT_NAME;
         }
     } else if (magic == NBD_CLIENT_MAGIC) {
         if (tlscreds) {
             error_setg(errp, "Server does not support STARTTLS");
             return -EINVAL;
         }
-        return 0;
+        return NBD_MODE_OLDSTYLE;
     } else {
         error_setg(errp, "Bad server magic received: 0x%" PRIx64, magic);
         return -EINVAL;
@@ -1032,6 +1029,9 @@ int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
 
     result = nbd_start_negotiate(aio_context, ioc, tlscreds, hostname, outioc,
                                  info->structured_reply, &zeroes, errp);
+    if (result < 0) {
+        return result;
+    }
 
     info->structured_reply = false;
     info->base_allocation = false;
@@ -1039,8 +1039,8 @@ int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
         ioc = *outioc;
     }
 
-    switch (result) {
-    case 3: /* newstyle, with structured replies */
+    switch ((NBDMode)result) {
+    case NBD_MODE_STRUCTURED:
         info->structured_reply = true;
         if (base_allocation) {
             result = nbd_negotiate_simple_meta_context(ioc, info, errp);
@@ -1050,7 +1050,7 @@ int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
             info->base_allocation = result == 1;
         }
         /* fall through */
-    case 2: /* newstyle, try OPT_GO */
+    case NBD_MODE_SIMPLE:
         /* Try NBD_OPT_GO first - if it works, we are done (it
          * also gives us a good message if the server requires
          * TLS).  If it is not available, fall back to
@@ -1073,7 +1073,7 @@ int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
             return -EINVAL;
         }
         /* fall through */
-    case 1: /* newstyle, but limited to EXPORT_NAME */
+    case NBD_MODE_EXPORT_NAME:
         /* write the export name request */
         if (nbd_send_option_request(ioc, NBD_OPT_EXPORT_NAME, -1, info->name,
                                     errp) < 0) {
@@ -1089,7 +1089,7 @@ int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
             return -EINVAL;
         }
         break;
-    case 0: /* oldstyle, parse length and flags */
+    case NBD_MODE_OLDSTYLE:
         if (*info->name) {
             error_setg(errp, "Server does not support non-empty export names");
             return -EINVAL;
@@ -1099,7 +1099,7 @@ int nbd_receive_negotiate(AioContext *aio_context, QIOChannel *ioc,
         }
         break;
     default:
-        return result;
+        g_assert_not_reached();
     }
 
     trace_nbd_receive_negotiate_size_flags(info->size, info->flags);
@@ -1155,10 +1155,13 @@ int nbd_receive_export_list(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
     if (tlscreds && sioc) {
         ioc = sioc;
     }
+    if (result < 0) {
+        goto out;
+    }
 
-    switch (result) {
-    case 2:
-    case 3:
+    switch ((NBDMode)result) {
+    case NBD_MODE_SIMPLE:
+    case NBD_MODE_STRUCTURED:
         /* newstyle - use NBD_OPT_LIST to populate array, then try
          * NBD_OPT_INFO on each array member. If structured replies
          * are enabled, also try NBD_OPT_LIST_META_CONTEXT. */
@@ -1179,7 +1182,7 @@ int nbd_receive_export_list(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
             memset(&array[count - 1], 0, sizeof(*array));
             array[count - 1].name = name;
             array[count - 1].description = desc;
-            array[count - 1].structured_reply = result == 3;
+            array[count - 1].structured_reply = result == NBD_MODE_STRUCTURED;
         }
 
         for (i = 0; i < count; i++) {
@@ -1195,7 +1198,7 @@ int nbd_receive_export_list(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
                 break;
             }
 
-            if (result == 3 &&
+            if (result == NBD_MODE_STRUCTURED &&
                 nbd_list_meta_contexts(ioc, &array[i], errp) < 0) {
                 goto out;
             }
@@ -1204,11 +1207,12 @@ int nbd_receive_export_list(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
         /* Send NBD_OPT_ABORT as a courtesy before hanging up */
         nbd_send_opt_abort(ioc);
         break;
-    case 1: /* newstyle, but limited to EXPORT_NAME */
+    case NBD_MODE_EXPORT_NAME:
         error_setg(errp, "Server does not support export lists");
         /* We can't even send NBD_OPT_ABORT, so merely hang up */
         goto out;
-    case 0: /* oldstyle, parse length and flags */
+    case NBD_MODE_OLDSTYLE:
+        /* Lone export name is implied, but we can parse length and flags */
         array = g_new0(NBDExportInfo, 1);
         array->name = g_strdup("");
         count = 1;
@@ -1226,7 +1230,7 @@ int nbd_receive_export_list(QIOChannel *ioc, QCryptoTLSCreds *tlscreds,
         }
         break;
     default:
-        goto out;
+        g_assert_not_reached();
     }
 
     *info = array;
diff --git a/nbd/common.c b/nbd/common.c
index ddfe7d1183..989fbe54a1 100644
--- a/nbd/common.c
+++ b/nbd/common.c
@@ -248,3 +248,20 @@ int nbd_errno_to_system_errno(int err)
     }
     return ret;
 }
+
+
+const char *nbd_mode_lookup(NBDMode mode)
+{
+    switch (mode) {
+    case NBD_MODE_OLDSTYLE:
+        return "oldstyle";
+    case NBD_MODE_EXPORT_NAME:
+        return "export name only";
+    case NBD_MODE_SIMPLE:
+        return "simple headers";
+    case NBD_MODE_STRUCTURED:
+        return "structured replies";
+    default:
+        return "<unknown>";
+    }
+}

From 4ea3fa99bebe8f153e74cf625980183cfd2238f6 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 22 Jul 2023 19:54:22 +0300
Subject: [PATCH 0882/1353] Revert "linux-user: Fix qemu-arm to run static
 armhf binaries"

This reverts commit 518f32221af759a29500ac172c4c857bef142067.

It is causing similar segfaults at least on aarch64, ppc64el
and s390x. Let's revert this one for now and analyze what's
going on later.

Reopens: https://bugs.debian.org/1040981
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/elfload.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 88c6861d7d..861ec07abc 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3618,13 +3618,6 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
 
     if (elf_interpreter) {
         load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
-        /*
-         * adjust brk address if the interpreter was loaded above the main
-         * executable, e.g. happens with static binaries on armhf
-         */
-        if (interp_info.brk > info->brk) {
-            info->brk = interp_info.brk;
-        }
 
         /* If the program interpreter is one of these two, then assume
            an iBCS2 image.  Otherwise assume a native linux image.  */

From dcaaf2bf9bfd2c664dbeff0069fcab3d75c924d3 Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng@tinylab.org>
Date: Thu, 20 Jul 2023 00:24:55 +0800
Subject: [PATCH 0883/1353] roms/opensbi: Upgrade from v1.3 to v1.3.1

Upgrade OpenSBI from v1.3 to v1.3.1 and the pre-built bios images
which fixes the boot failure seen when using QEMU to do a direct
kernel boot with Microchip Icicle Kit board machine.

The v1.3.1 release includes the following commits:

0907de3 lib: sbi: fix comment indent
eb736a5 lib: sbi_pmu: Avoid out of bounds access
7828eeb gpio/desginware: add Synopsys DesignWare APB GPIO support
c6a3573 lib: utils: Fix sbi_hartid_to_scratch() usage in ACLINT drivers
057eb10 lib: utils/gpio: Fix RV32 compile error for designware GPIO driver

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230719165817.889465-1-bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 135344 -> 135376 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 138304 -> 138368 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index 7b6c67e0ae299abb79dc0975ce8336e0185d4071..9a2ba3f2a4d0e1e52c909cd71960410e118ef374 100644
GIT binary patch
delta 35168
zcmeFad014(wl}<M!|tX5p%Jw~L|dRi5CP{g(g@8YDjMfF5L<AF196HPwHu)uaYRck
zO;9_Df_998sHjl^Wl&T^qehKU5(MKAH_jvQt?Ipro^#LpeL3gebI<oaPyYCIt*W(Z
z)v9^iko}cS#aA}z^VzDfwF?bs(>gSf)%)fqpad(H8J}Bj-4w9}18}+Z{M^x!cBm!O
z&Y5ADnaVho;3|Cu*VF-LNC(J1a^_+=UR~K7KbCe!4%pA8D{6w{Y&u7MdNkIYawBx}
z$)%+2vmGy^4ar_nEH6*jHmQp?@TNrjCa=m3Kqbbu=bkxfczMNCMN5`(wl&Z8^e{73
zwp=X@O`L*n*tnw*{MyFNZa|d__W<I=RrJJ4naZxE=72L71nDyjj+H3_7ba)fGWg7!
z21Rqw#Boz|Uwno<O|KbV9sBugdH<l<D)l2iF0pGlSP<lnH_E!AF8Hj>6{&HJEWkxR
z4idPLq=6)q%6U~yxf|5L#2MJ%R@J{P(5Beo@T-q=t!l<yrM&E^Rc*K{mW-IPM<x42
zSs7NWsv-u&V1r?_0$gX#Fq)4Gk_dD$(1{$*ux-Ox@uq?fxWKkeN5q@-?G2Vxvt#{?
zvU6kujn5T`ai;Qdl}mV&+E<WKPr`CLMgK*-iSZGNkV$+O%kaIJD#VIg2x)jxJ1ahV
zClP;Gkf;U;^?crB^1!p~JY{ovlTyj66Lom2or0SUzSj7NohSMf-?Ver&D<WDX%IC}
z1I;sdCYv!Ev>ew>2vtqz<Cy7CZbK}gU6TDccDPaC#RE_M2_F}04Lp|XB<h&~`I-Vv
z!Nw9AB<h*T$LS~Y@>+XKXn+u^D~4d@q$CXoZK8HEuo%u?jF1Qs;*&H8II)v}<G{5O
z697)7mY2(QmQZg|{!@^jzy~oMETLXPXfcE;KTcN37|}lq{Bg;uD8WC1<L2y2f*g)d
zR;7s|s=44Fm+X_q{2|7v=51L;<@95cRi_)}J_G+p$zC$3XLUdGawyq8yYzl5p#Hk!
z*e0&Jkzlx=IR!H2Ye-02?QJx~3r1)b@^Pl&P$zwWtFG<iXKbv4>P3+DFhOcZZz$cN
zLfhMXM+j3b=Hs$;LUS+pl=93eh85a%QU^XL=mYa|?T4nO<zjv6c7QT<EH;E8QQ=~2
zZT$=q800KrY@!XB(17HjjY$`S>bL=vGn{gQ68kiAR7?1{g8uK~WJfo048T!FTN<Lu
zEGDbbLG46BSkFYcHv~ePhc2s!97j;W*mq%2o^jzcEM3_sR}5iF4K_J6Z|myF$gK<!
zLYLPx_w;_vB!xj~c@jI8N&fbJD}2Slx4GvB#~Twao(ysO^6BZ5aWh8)>WaT`bVr@>
zA^5ey4)Rv`v7;N}fEuk-w)8ff_VqUK3^O{}M<%(^e=Uq>;5RWJ^69aI@iMtPnu0Us
z5hxfxl&g?0ZszoXr|Q!S#Fb@mn(TLHH(zGpmx3wZ@|a_6Aa*Phj^{Y_M+vyV=>s$Z
z*E@ZTn&rkd?T%1*?k49Jh*kRMW;ZKCY+N_Is6|^e8gFe8#F|vNqD3ldhDR#yBR?GG
z5`tP{qf01K;xd=eka<@O1ED@lbDcTap^FCZ4SZ1LoC|q4^-{y95mg_*c<r2KJqwC4
zNZs~{kGhL&(yKKWUPw4RtT{tNm9ugOx;i2x#p7BYM(weS+awg6t9KiZkRz^aH4F{H
z-Q44mJI-)7D7<E?m@Y{g7}%maTu9P58|-KCL3+>J9<4uSn|NxiIe#lv*lRvc?t(Lw
zD>_azuhK5w%?!(THo7xV2yB9ZR~Jk$ud4cZ_iIc#FjvTp(5iJ=4MMC~dpx1-6eP!I
z+m2UEOwx>oAwOGIWzXF#GdLTpXYtC~3Amrf2T*r<kF_WqH}&k<e8@lp7^JKiOtYV)
zf$S^ggLC6Nw;-sSdM}-Gv>`%!Ig9ya#O!owC#Z$ExG0>iifbh)i7sGl%qcsn6*8DM
zWWL`*RU<Q5A6i_3?Y&3ooQ3cy+dY-Ln68CRn(B6*?RGJ~r*Fijl^*>tV}#f!;!H|s
zX;;S6>n?*O46CiIv9<zDSlShN`n_VjNwd&nkDWPvGhQF$V1{viwvYM|P0OY5`1)l9
zNqJT<{P23Yqcf*0{4Rg)ur2uuKJ~bS%e`CMr)4CCk^3+$thm1xzx3|ZEcmrKH4`el
z>P1AImEQ`MuWa)Q_w^arYxyz-XPN!>@j(U6t<2HPqfOkTT<I5#5N^oUPJ6+6ehsr?
zkiJEg%=R^bY(raJgG+ookRIRlY16#O3<VSv=iqH1w-J-P-C7ULCfB{)E0&!)5xcY>
z&1Q|mbJ_>6=8y39_KB|9cILF%{?H`CoNbHV4uNrMpurH$>(#h}fBV+@*$b{EX(qtT
zS<yZ@>$GI;eV{AX9La>=!25WfzxR;hk3-N>eTb7s31j10OkO}vQ&ZzMg`(0<VU)A%
zq~Hn?B7fYbP^UYJA7S8-rbccOB`7aBt8@&0=s(1(a{lc0OqXOIJJ!?x>Fe3P>POHv
z9r}#&TV8#V)IlPvrVqmtI|NNiXR)+a>bFW;lf@dMv8-0AmF_}Q!DMEHw)rrbv&7PH
zY3~iHaP?bN^=MbU^P)b?+VBa+8p9B1&J|W46gq`l8mpce)bn(*Ptlvv2G4*MQ2B2d
zPya6wuaCuVI=D#-`g5lbs=dizZ{&=F0$Q@!vvEv7IJ>JKULT-$;8GNG=~$>q;?<_!
z*dx%7we5}v2Bxz<0k|?SfW6~~<w1SeR3AJrs3lvf!c&7<bETd~$SG2&1(l{C8@s?<
z+C$fB_}EyS8>C_*TI1_MYPP}^x9X^D!NJh+_oZFh0uSlfgUxcrD?9dajCS<&GBd8{
z3>wIBtQ`N?u|1n*hpjt>vyPi_OsCQ8AdGi*8YdaF%25u>uYt}j@RBYP+^(~n4P1_U
zb@tQA=T+VJYM7laoBUWkA?#vUzo>mt9?|QfxsR9XVdXUE=RD-(aaL09T^4<6V9Ago
zMxN};F;>1B<^v61yCymJjxREtsT-k{yke8WxT#uO8PnOYnUN)3T+b&4&8WKP)$qP%
zL2uA>F$`CA?#zyVi(R_-!$_j((ngk^a5--{oy+j_E<UX8Dc;yc=~+9r>h9m_X|%9n
z?C*I{v5B$xS{FB`sGp&yGT6H4O{Ssm20m7exvuRU3v6h!F{hAw(CEzfaBx?5N2Su)
z*o=;HHgq^v;!nEvbWFQwPVw99Wa5Hhs8y<QZr2ak73c8duKsL+6f3(mLvgrkw>GZo
zCRL-jx5Et~U56NN8Wi!Cb|8m28&B`{If})1yQ$b(EtYp*6fH^PEArFd6#&hCPYqwG
zJ9#(1Ew~LQPUrhl|B1VK9jU+YbY2Mc7f#QQqW*#b`Gcvy0AK0u)#A?XF`>Vlw+a39
zbWFrAr^yw_PiBoC%X_$>MC{w6EqgZ$$Mo=Swqq?M`;}jsHj-mWDPlZ#XU)gP9$!OW
z^6lA~tyql5^&EoIaZXPi{C4d1C0mhz%X_tCQ}5w>y;?z4NPGJ<ttlV8)0sQm(7CIL
zk#T(Gtu(Ce-HFXC#B+KpZ4;-G1kh(Rmf)?um7z7o&RlK5?DpzM1PTNjRJZ(6M;nF0
zsV;_5ZszdRGUI5Yz}5ULaJUjE{24IZTJuagMtz#=c3c<ZoPv?>6RVvm%vCj+1R7IQ
z%Y+2O%Nn&*|0u}Dp9cMtt#(?Yt6~2qS=D7hb_b-$Bv|bXV>iVLvJs~Qy^>R)S7$Lk
z{-S8aNf=SJRy&K>O+y7?X^9|QQru|7j`M=7st^p01I1RGMhdc}C&dyv*(h6mRy6oH
z7(5pAT5TF58eAyI>cR^fg;iyu#ovR)AAw@)Lt;rp<ck*PH_FDBiUuD7gGYj5>qBBm
zNRNpIA8nM~Q6w6C5DXp$dbvZ9qQOUqPN>r(jl$K1qQ$vj@eokV9f}bxJ|rj(Kh!9z
z$`=jJ27_ZkvE)!=5g!x{KG-N5e^fO1J1}?v=#?C@l&}t`O81Kv=QaxOI4oNHEm#~4
zZ310wv^YnQHRd$RRv#1%-U$XrK%0<WZ8UhVXz<=fS=D~g;2mJF2J}i_>cqN>_)fI=
zyGG&o9MR&h!Qy@|$B4?l{e!<(OxO&3HLQiEW*UbW%MEleiybCNC#)Kr^DZ=fp_s<%
zV>y`?x%5c65R|zr=P-=v6??0(GPp&z^9ASfE#9i>m&J5feRp_BYWW`>%8)6f&aHzL
zL3d3KU$N#Go)+vK6yN1<W|2FzC;4>#uXDBnI95KX9r20aa8}j<+p4FrzTSAg+SpX-
zv`_6}nc%6Av-D0YEDs6lTk485Nu{So(Ba{adA~>kYXf3QrBq?HQ_5ToP4+p(E+v1f
zLJAX6h!>s5wu2Mlgv&zw*+~xgWk{!H$}rbrKD{!!F$S+MNW^{nwXjM3W#@-{rCNc<
z^mB1by|w*AS|sv?+8B-@!|0e}m;)i%YP_bOYcI)cN(T+7>c`ca4N2jO;b6MN+Y+j7
zx!^JkXWM?sgOy5=_lf8NYPI4nNXSk%;9vXswUA!1sIQG(2x^$Zp){$)k=P?NU~uWn
zR-vm(Gx~2i856pc(6OD4>Ym=)>%r<6p@>qSw+gjV71iIhOnyj1C1|N6XH9yxxe944
z^SY(1_yRrtD%20n#%Dvj#i-(7>d7{FY5Q|c6+c0ZwC`UC3nK<5uWJx{m+#4>XsuD&
z)XFSlGT~&#%G;JP*shgnZ6tEOveE|@PI3bIfR*B1JTS~dXB<TpDg(?0*=c7<t(Bsf
z&Q?2qfR){;<Sf`op8>yJ`-^MO+z3rNW3?lSSxP*;zP0xB{@z+B)aqdtlU!jV-j9Qg
zChU(VnNz?(TNI6LQ{G~`S}C+%BXBBfnI^v^`=q?3rfDC%Vfe0<rukUm$CMLUu@x{l
z+pDFN2}d6B=9H>o+*>TQMSG;t2G4f=IZyvL)_i4RckHF<;vRLCX0oc4?ZZq1mK41e
zDljvOTBF8uHJ*VH-|hTR2u+9})wBUrKjCX@rB21P=^zbl_(Fc;&%wC{F4gp$Y<S4)
zO>JGPsl>Xl1;eNe>_dzSh!5rRfY<BYy^Y^#ME`wQ9eaBl$z>?~9o#k{RCABlD}7M)
z;dZl`SUGILXA8}UHX=9!D99(xPvc5WGrTC=-h-=w1eHQ^f=SSn3T|BxLTK_hJA5oE
z!VVEVrAPOq@D;(g@W2Qacbu;+Sc2zAc%sWVBci+WMLs)wlvQSt-R5vHvo~-}gsRQ;
z&Ebj~FkX^*Ez<xeFWD6%Fjs3Um>Pc$`$hIdSMbEh4yXjLi`2Q#*%X>5MG|a`U|c@j
zbOJ?uCEavVC?-`V4v0E~WVx@SoRRD!1#~KBF8&#A(O-j}V|}cfbP|L}ecs|F{oQ0A
z3j7_lxnKAH*&1B}fwt%xuv*$yBQfsQ+>+RDY<#A@8-qH9kt|q{WMxf#7e)?3<ryVe
zIDJ$w`UY2w(x9!l#pq!41s*>7q%2MxrN>~8kNnXsJm{lv$7tGkx11sSp<=dM$KvfD
z#h~-}(MPS(QY;_i2EYDedZHMdFlI37jt`BAgm`Fd54X<8@;w8rUwbO8-+FogysY1n
zJkXI<8ia?AZ3{;X^Tw)R-<~m6W##kpF+6;1>mky17mlU<PV1P~aLjO<;e7Vq3R;0Q
z3k!z5>&%KBw8V<z`PzoVjr`3K+6Q?O8aui`VJSZtWV?)8fX3oI<4&Rv@vQM4t#9QU
ztYvqrzVK=g+65a$RSW7=gYmxcz1Z<b@Wb(5t;QeUQ2nmC?Mpp7LOy!gh=b7V+MLG$
zaUS*!r(KJMh?+<|Caw(}_%4cb3ta*IvOc3gSc=l&$Ywa^QtJ8a{504E{SAjN2s~m=
zt?JLc%_u;cS9vzW4?>e2bOc|IYYUC>ZJc}a4e#{C43m$x8OCSd%E192yQAJX=Hpz{
zaoq%eHuz^8FhSYA;g@&9VxkqduKj(YP^cC8c)<jBf8BX=D$;B&6*5uXj;}pm+gO;5
zmC(q;CnhXLx3OB=8=b|AwBgP79(Wu(Vd%x7{YJI5<S}MAU!cQ3YW><iLYiy&mh|8D
zG8T5lQhA})@tMR*mGTyjBus4{VvmVkQ2`z~G0^tJ<ztq!%7U4A?ZnAQn)`a<Gb?ls
z*G~Qtdg{t4fvE7Cqf@L9pL=Xt076UfgXuY_2i`j4K-)>lyCayYb@umixi3RH8@@z_
zUgnIdg&7UBnZY799?zNiQ()kW;mHvaM)5tg7rReJcm_;-Lz^;AnK&FbDSA`&h4c!F
zI($HAnm)tul0;Xx4|5Hh)t$L7ndUvr>#Oc{Y4ANJj((1KU*b!9N8T?@aey|!>cRNn
zr=D;Ybp2BwGyt=+BEY!lS>sVBYzDe7emu+I)|IbxyqfG?RPSx1c~x~WrwFlCUGTcu
zo~R=}ID0m_iv8wje6BPJhLVTI-zkjBSgCe2d)Is6B*2ojNzQoVoc@k^X0j|4ofb?_
zZJk>?$DKuQvBPJsG8<u3;Ev*;&j!d?!B>488$atRYY=>zJY4iyuI!26E6&0C`7IRZ
zH*^gDmChR3fk0g}OfYaw`0SbZyZJHW?+cRgxqR)dEgu|kHfqGN$M7YA@e5Aq@A9?5
z8BWKXjZsJlslFq`*|C+c-S)-r-|sUD;qf(8M&QMN3;H&_`X1j{-a2>Q0tNEj#@Dtn
zBzvFclHmYopivOhnE2ZK<o82VU*UrbeOxyyT0%|OPMt%>fDtRFZ6Y6myW;*<{Cr^)
z`WUM}cWb*%0b$N|E50J5fw$cDYe6<9os0$lswU}p(dWUT8GLQv<BTxp7e26EEnv|Z
zG377$+P$?IVQW{=(4<mWX4dZIYYYOndNcHzhhkPX<ND9LMkM4|!-oCddNpUer9Rm^
zO7gzdJJLY@w`6bG--H^L^R+YY{EgfSyl_#Q!E5>2LAR5APFti&I9O{;Se#ZWP{u`#
zrBl5Iw8DZwCZ#$AZq33*ImyCCx%f5s-l7h!Mo8@j&8ZYQouRoB>^B&2(Bk$mqK{eZ
zJ0J=2aM>we<bZGQCD%NKhPL`0I!Nt@>SG8FETT`*Ba4A0j9lmwR;uE)%?rgYwwAbp
z#c94h@WsU=T$d;NEVt2ambOUtiDvxLR-IQsYlcN`8t%7bg`JBbh76#!v1%T^y5vjG
z6d^6c6sVPhr;j;H{%BN7MJp2UMqO{G#N@0MHrkC+7eyLqllgM^SKXMV<G)PKvXdoy
zr*ULCC|w?1k7M<7on8{i0Bo5P1r^mF;wyR|*>ur23`>&K=vHn-k{kt&5&{ijd@Y}<
z*{S%JwxDmrt$h14WEaiVlyGO;S}FMg<}~xY8`!w?v@BYP!}Y);lLuIL=1ptxuH@FR
z95|JH&h~IlFLO%U-}l9OkhMlQm%4e-1|LbWLnd63q6*pX+R2<U>@u8@C~Mny-AM#H
zgG9?zeC7C`v9+?$N@d6Jrt{xL<p~m8fFMz<!u|&Lw(SMqj@Gc~zWQwFT2V^nCxok7
z;;DupG!uVmxC@iG!T3AtxD(Gwodupdsq>n@iH4&}h?@1pTPY^J;|-p*%+vMvz8h=?
zyc>yxwMBB)o%?vtGKKZMz8fNO(lTf6&Tk+GR5Nr3KVQ}XCJe8%!EO(nQ(rU~B67(c
zsEHR1x%XZ(ivF}XSNx9C)7E};38IIH%7twWEL@Vae17P=VN8fDBETRv{F;3RZOR?C
zNrc$ItF^1{Fr4U<+}0ZJh)uubwgS3}v!o;wFIw&j)5*r=9Z?xRwLG|I$)2>%vS&<^
z21+{p)_r<kb?tmoSW@(=NT)~wR^b&Zt{Vm@peZ^x`R=E*7)1<F_A9Sr^@@%ThdLWZ
zAvh#j0cY^(x3F$SKllAqQSjx{`LK!*GF1_hFHql><C`noP+soq6@3s}vk3QCH3*%-
z%T`T61V3IC+}>O98LZHJUd(ZZO8`E-%{t49?W?SH=9ICI=&|?dJOUCpwRBeQnAPo-
ziq+WqnH62s=V!v8fQS*8#+uc5>mC(aiHr6GE7F>s9CLEhNjP<9lYLVe;R-9>fLrc$
zb4yN&;!U@<p36&$s&XZ7FNJOj75Lmz9J|*OI{uu!0jL3gv)8NnLURgD=hnJppD32h
zqv;qw$2a!2L7(Bbd)?qScCQN#%8r2Zu=&}c&YxJWa!lKjZ^Q`FHJ{+}Yz3N(YqCAz
zYR5Lm%`HKjR?47=OA#5N-AL7z()!ISg|l5wi`6-8VX&T%)3JRA=@|PE=PTh1EgWZQ
z>6kr4F&`+K-^P-;V27c4j1Vh+Z0_-#_NZ<Dz8hdQZ#sVpj^S2qXZ(z$ITce)RDcU}
z^f+vr+g5SWOfo_ZC;wR2fGU_>HMn1Hpkw(S;H90XYGM2e!TQ|Js2uOlZSPpxcQYKe
z_E#*Tjo?8q{4m$x+sSXUIb}~83QyC}BHFt*Edtgzf23O+Bcxlb!5RBMXzu^6*TDR3
zsZBVsez?C~>%H5l*K<#ncZYNItRXowb03Nz@j&h14&p8cdLs{<cpwzD#`_QSbnDD#
zw>b|3_p8PX7IzmC;sUYF!BO3}9U)e`q>NT3vn60IUbzxBul5WFhw#x~INRGIxMeWS
zToZK{wneeJ4dxXVcP-v@Fdmk4^#?=Ymaku)ugXKvs&Ro8>%qFAck>~WvA5EMWeK$y
zmhcQt&+|p~_()!$kDDMLFNc-s9vG~z(P=?A#g>#aa<TwyNjv=#%MZ1cxd^h=cDUD}
zQK&X|{UKM>o)rRBPx<U^>*|JX$$vI<RsQcokL5LH)W8T5++%$8a4)nCJ0H=o!T0d!
zBjcI|jWMTn_yzyColz)gbMbkG%Z_-k1s~&wM}{LE)_flpa$iifn$JG}v~H9kf9$7U
z7iFF(D;RjwSTf{>9`=$>nt(Juu3_n_DEy)equtQm%K1f+l#Bq|Q++aU+4tj`1)rOq
z2Q#eAMOYtswtM=TPi%7*_c_`Dy}(nCZiiiu<FU`#HhFmEF{7W)%xn2yMWX?R0j~MS
zt#j|pK{@$p(IEqp2Ds)qbJnj(7Q<X8ca~<Y#C?vtfSJRN&qo(<`SE3J)l@t(Kb+Mj
zU{n4$(Atn6(lVltr`Pt^Yoosd1MI*6xJZHf8$L03IUZfmj`bXgQwsVjw<UMY*QWi*
zrb((c{P<SFInOmXu8k&yVa$+JL?`@fLAw@NfmGFi17dYT29vW=pJHWUZ&VAvu6S;t
z7kXf!atl4sT?@rS7@Us*x5Eh!^b3wX(Hs2?ziv3|gc4o1P*o>d!|qp*akZf(2kqoy
zV*s9UQVNsIypx}xQ~1}D<IxG+ujm=_Cg~2aYn)ju3CT&$vS$<!&C17TZ?dmca`-%5
z$t8c=e;10O*J#*QU#R#5>e#Nm(rT9-Q#aJgo1V>FG{OiR7uSL~IHEwhZ-xxH;RnUD
zSY;rND`~;TEyD9lx(7NY!`umrxAfXrzqICeGh#`UrDZ<b46}e8Blzw<Ej&+UvU}p2
zB_E-OxL4^&wzd~uU)t6w4ND?mQYorGlH!-fCo22kl2Q*_b^L-l=t=1nWAWqCx$S*;
zlP(Ks&gC_cC^$O&sQh@-_)MfJ%qQT7VJS!mulB&}PGzCCxYy~x{)yW^B$wgd$e@vc
zE~R{+b|@!NL_=Zt`6VX%*fQEwsRIFjve`TXMPa*?x6XF@!sK1HOx>`XMypI2<89z%
zd~Et~y#I7><c4ccx9GR+Nr!WtC904z165kv#hfOnT%JHx=A5Z2l06rc-kXT}V^C-X
z3d=#7mMkAz8-XLsrm@OMe6Xx9TiFLcFN<VjM`HDv0D0^%EAN!LWR-Oto&U0<@RBoK
zSW_pw|4d)j6oj8rCjfUj+lj5v;K^r4vT;86#Mx-JpgVRr*9K+bfOCOpJ05qgJNgQ5
zJQt35{PVdWv<W+ut6+BQQr;eIz;WfB(OSH|JlK5=Zwma0?oEZ09ijCKoBW8CxVC%*
zGUCYdhdFo{H0Tu0u4ut#Ex@fSI-_}bNW}+e7EZ6AbJlM7orzCX_@HUHwxT_nid$Xq
zfKC>Cp$D3d=U-5v33%&;Kr|kgU+C%j(Xx|{j2dNxqKFGpPyHQ6(UsPyCLSv<x}lM{
z&&6SIs<7_jDA@WvxcD)Ozyp8S0GqzsKWKpVyEF)H<QHD*44c6{mp+j7rH$J&;DtYa
zdZ|Ck!|KZi&~E(vaw;6eEV=Rl+K7){afKqea;1&!N8ScckM;F@?0MX9#lP7m>QOvn
zAaQPlr^hR(oAWsMM}Opkr~SB;t(b*te{63TogOO4#7AQ9tATEdEys=#mL8R4<tLRG
zPAYnW&sX+2PP{rayjG`;=HN~qs?n#Y?%JBeC*gj36zvmHyrKjWlNg=L44$UD47?B-
zYEE&dCysSO8B|+&eof7A%*3|Wy23D_zUGT+@YHJ>_bv)QC?(tIS=!~cjN%RGu{+aA
z2rHY3&tB{6kR229`%R<bIZdJ@0J~fdfd>|&uZMPi$j7c(*&*MY=AJJkW2oh0XRc7u
z(_`2Z%ZfXR^$)va734%!9EU5e`=T-U_4QUGEBc-aL*XbQDI9b9z7X*MoHxRqqdat3
zBn=UGd@P@9xyB7j58*2uw}WcSnlmZFwXm;YdUxVu89_!o`-xIG_0DiS<EJ)I&#Qmx
z!Bz}{#^1q7T@mwM>(?i0u;hl)z9LFi4Tl`{aIrlQce>$&4&l)^+Ih>vv=JN&#as`?
zTz_p1)PkiM6<?==r04EC`*?Nm1HALbFnDZIf5R7ji`)GifjZ#CpPQpVZ2WnF&r3@W
zmZvv&I!(G$^Rj$rr+>Dn4&H7|T2wBUWX*HzeX|XEhQn{pL~ZcFn=14>zHzfHx{vE`
z&gOD>_4s`JaFGjMeajau&8@gK8DZrw?U5-r=9fH#ZsuB74VIwD+~Id;v25@;Tz0=T
z^o+arr=y145f8Eu(&aY%o`cx&-{$V)!&r9EJ^b>K7j!50$E(m@{O#ke?4URJ*T;Tv
zSkvUm=ZFm~%w7Jp3j&G!XCcZ#r~Ov+EY6i}P%B`hgJszgK4|7nnBpzt9=8N5pSNV8
zIrVuSz&d`DJMFnWXjq3AzUUkpACQJ+MRk18pw(vMz*NN*OWT}C3#Dgo*J3zYsdI`j
zr)u>z)`D)0mJeF9;+<^xgxuN}J(2T(fV6#SyfXiJW3rkU+~-wfOWh+F8ZB0F5xjC+
zZ6jM1p1bvxHDcR5%iaEZKVpN6@aVU#V1@kITkO>4usIFeHfOZscQH+Nf>!KS=ME*-
zv#vKx=yU5jf?QVJV7Fki+2|}Ss`G{`Dp*R@IzH@BXikAiMhOd<`nIjx?84IKFfcrQ
z>uor`UORa+Ta_NsFvNHTB*quwA@yPGcoW`K-wEa8GxgIH4~0zJ+90SEN+aQSJg{N5
zN6q4oe0L_Rit3toZhkk@fap81%7$HVixA4OFi=C1RSl6&E9l6e{jip$<AJj*ZTW^i
zXiyUaeJ@J7K%-A7O4+apX*4gAeVSO-RaQP(FX^0o?I%Sm=y(1rUnj*l+ZDZ`bB55h
zr!L+yz{=MiX62-4VP3vY=Vhg7Jn=v%g^g=Zb|N%`t(`+$SfoM6$T$`)VH4Yun=G1%
zJ|Y9HPy`xIHd>(oHZGc!SfPF`*BtOve#;Dd<ZP=fEX;?yi8n%SGruAp)~GAWCnK#<
zKQ^5s8P;f`!Z8yrRG2D`t4;Rl&s1%b{swPmm3s+HxZ$W58OI?X)Poo~<cqqJYz}>h
zf~ey{T1il6)IKj(f_`QlXVJG#TgnvPP&AV8I?_jmKK2|!ieP$9@rvze;^TC9_V9wP
zu4N%hX%nn+>DItA`I|_A3<WwS&~3)%GX!E|qxU0HFGD`vC(x5RSp8dumQuQx4*BCA
zuf!IfMi43O)sy0A<h5rMAO|;u_sJMr)Zb~et@H>4UpOxYSLYqFMbnXcd4_t&nH%by
z^9qjkC)MRV8KcM6%Ms6PTSxlYqYi-&d1mixIB*!cZYVqIanyw9;f9OR8aS?na*>b!
z?o`33It)eoD&OMYowwB<Jwj+FU6g$g(#o<R1H+*5UBv~N9hmv8o$GrGvi49)cK5&f
zFAFkxEkhS%UC|a;inSxt98n)Oy(KX_A`dokJ}GF5T9V%!k-Mvuv2jjKfx-%7yp6mv
zJqA_7pq*%HN?OZNl;W;96W#YqgX@Inp8nR)dAT}~ERmy*ZuNZS%!lUXYdxEsw(_=P
zqRN_u2qo$Bf|SWoujtH5+5rYtcP*q#JcT`NyZ(=%?KaUD8qOqluxD;UpR~$s!hq6I
zX5(;pW)f}Ka3VQt6|?#LQlhonfkxF0H!N;T20EdUx@I9(S;hvJP)9~-6B|O0G)fu6
z@3{0u!{Rk`sgMlZO()k%Geik4qO+ouxn|+fm`>7G@GeVO!;D??N}ShRLXv$_8ye#n
z!gDv4FiF4TlIIQ2gqXmk@j^zyRmJ7M4T2E*DsISG$rbO5(G>&BhnI~$#kh!vqSLHk
zp|>hR`|F)%d(!;U_AQ5Vqz!Pt7|At-6^bOK&N4#C<0g{Wd8kEzvt3x-b)!(?-Z_@x
zs&eKTt&DR>_6e)g4y$!&6(VpYCFKTE<BOEK>u?|W^GYb>(!u9MDO;;{woI!Km<#K0
za~B40Ohx!=Dsm>N%!v)%Z5o))pGi?}O$&5wb;u-VskHX1Wao{|n04H%HJ8_PmL6fe
zH#*yJoULTJ^_Vk63LP&s;=bR;6YIr|;#eZF^scm4KN5|FExjGEA@-zo>CjTob|X-$
zAEx`mlXMsb;LcX+seH}+eylNDHHXD)9qssP?yz(8#eCtTW5ncyF0pNL$h@Y=NBV-M
z=rfOOZ;HCH<G&*}nxafL*hEsC8=2BcWS=wY;W9p>I?q|AEIcRHB!M*zHil0mY%|nR
zYVnlB<@IWYRw1W@bk>qAf_Cg}{T41CUy`fMk-OqB#7Nt<K=D1W?d~r~_OWN84F+qn
zq&ISJQyExdUIDKf&)7k$=MBy<QP7tNw2|_$74amp1!~u<VU1tfGBqzhpX6sOqmS>H
z{5q1-0(~MR8UD#dcz)P-Gu--AZ&aY(j)EbRXeeLN<`)vJKv81g1R-$SZt}GPjk7Nq
zc_am_t>-HmE)jbd)NA;Tm$3Dz&=o)%isGylMw+LZ7qpW(UWBkg91C>C`IRu^M8S)w
zBape}Q-?O*TCX{6d8G+0W^)z$g$!mWD!q3l$#6kKTT2Fj?#h`brrfpMLR-uXA8_3w
zbE}9rxFRo`2hnLJXlutwFIN=D2Cg9)u4qj3`9oTki}p)%<_hfjbUx41f0wn^hU-xn
z5u)+*@OlH6kFPzwVaJ>vc+hV-ywZ0-;a6bj21|c18{mnywKEq5<7V(V(yt}*a!BY&
zxe((e<aH03(-IkcD}rB{S57s08)^(y*X&<HF{cNbT}{}Y9?GV1eEOhWkePITC-HED
zvF?5liE~52sEC-{P_t%66})+sTrt#*0KEZJZ}4Vv$_;tjW_k#g1aBlS-H@NHw^Hyo
ztRw!dkiUb`-C|2Xmsfnn_%$S<74p(~y9qKgf2L1D;K_whRuJmxy^HQ3E6)E!Iq)u5
zLJUv`2F(E)>Ihk=3gK>>;Q+(>HCW;Y<>C*3i(0;5Td{c+tg~Ke`*HRm)12Y80f9z|
zSM*mj8Q^ShUyF7=q-9oc3l$Svchrf!l|=fwqae270!eg7Jsf80zstp(^&2RM*!(JT
z&>fYqZ3@Yf)=1sOvCwb1V2WWqHD%CM7=++c2dc1Pho|56x6phvoVBy8=q<7IiPJC0
z<JQP4Ix#X?6-Kw%1>?61a`ZI=?c2NH(-N9FLz+e71xo{DghpAijD|J*YS9XtW9TmZ
z3Ea^xWeXOO+ig()?sI9>;>EN*uPM~3Ih(o>o_<f?&h}G3GSfC!ux+*F^@TN-!8p0o
z(pC%Fq>}_C3a~Z)EVSM8XUJA18t$@fGc`>Euat#{q{3c5emb#li((?fFV+o%_X-tl
zPQVeRnv=lWdrOTOFHplO!vtT#MawcjwlcI#<V$|A@cUU#tK-%@BBr*;MOKm}$f-$T
zThzh3=9Hj3{}3o2!1+NHLRrGDz>-8sDJ_SY`$;nowBGCC4+cA}3)dQUB5ym|R-JhB
zvQf_axJ79NwBNHHNXecYNFI8i7HsJNBJo5Swlz5-{|mC)6WwI@93m^d&^R_YnLO}9
zL)kVdq@N1Sv?|cOCi_*WtyKXX;8gHEm18mK>y7sJ7_=Mg({LVU%llxZ%)CN7*yL>)
zu+)_fek)-!>IGBM8$~7^R7&6j8|Y&NZK{Z$4@&e)*TJLt;ijg7yqYtwguzA*OaIq`
ze8MaXr$Bd&6#1a%?D;k1Xgl<^WXDKez2*g(=!>S=8b7>9AAc3JIYeO7*vmFNR`B1-
zC9VC?jM(swQ0cpy!0KGF18m@mBl+5K`LG!P9~?VJKuOl#JmOj{-m+WX8VQm+!ui_c
zM;j%JHB_?iA#%eHbqn+EN1v*++3vS|R56r$T_N1JQ|<8~eC?8hjd2WW$Zc(Xj^A=s
z^%bL#Cy9if#X!3^k>Typ{AQ{mXsiVdskEP1nrQa6%jDPgs0$0jvx`6KqSPF<q@~w}
zQwbPG>qSigR8Pa|ylMW(2HA$Uwv6)y=j+Il4ycb~W=p|8^OY4CXdsRO$iI2JS4^WJ
z;R=E8_>9VTB)tPrYpChRWJ~~>(9L`m+rg`$Zy{55-(GQw>2BKqn+jR&cTqL)T8Spy
z<{ng6BqzBEb61TeOEYW8(*R_$k(9x?YXScg$p}Of?7W4IZb9JXB=S=btj>D|Av@df
zXO^Z{aK3^J3_^YE5*`cwnP&y5=9#aUi(-)(d4cD6id+X-+sp@ofA7gWWk=X&pdUzj
zClqd*c|pk0-Yint3H4}KvR3e~`NpZ(s$JNlwGrC8(&ml%uQ@A9e?`=tq4#^A5&VH$
z$^6b}k!?w#;6J}1tG+WrEPr)lSLi!~P7;@{DAGalt*6&3)*_O9tDem0iUM35&sX*1
z?wJjZNf>v)Y@AIyPgm5<C9n)0g}^ZF4ST39ovNC1x1ks-_U<QaH?+^Tgp|>_JNwpM
za=aV#Fut02bw^KaOF}G}&EEC{@#ul#9QK-E^b6&zX%(zlmzUlHMWPlZDo@iZ22OG;
zZ^!832oxP84|}4K@|h`SgFzN;(4OF|`Rw55WOy%hwMBybzsAsgMPrO`%5KBIALUjh
z+1(qhV*}R{bsscbzLyT6;he4I)2pDpzmm*8u%w##gxu_d+Vx8JGp8yx(7vFtsVbK~
z=PPd#y2Qyekd4sej5QJkxbT)x3b_rcoChNU-BT6>rV#Z9C@#8I2_s4vXARG5-asC+
zgW-lb<&9q&toh)0oSwRnc+32-opJ~LW*HwD7<?^SYiOUyKA%mu#-z0`@(2>bGuvBA
zF{suNzJG}3+R?++PcIfuMKL4;w5{B&BwN5;)!`=T(--x!OHjgu4wEUouO>--Q3ttq
z>&5`nxa2IjwoVL2elnvQe1v2Xdej$nwv&`M3aLq8Flys&S_CVTP|h|1)>3<(&|;`D
z&M*pb^yHIZ6sStD6TD1pa#k8sl_b4K54*%N5_xKpAB=o;CH7R5CIJN(Ez9#uJNJE+
z)E2%N0vk-h*qm0S=57{Ff=9r$*xipIUqY5veDX-l;v)rQ5$-=_dC-^X$_eeX3`M5#
z>mX(*cReY592{qWuI!l=i!aoG%>h3zs2iR7&^VQbTSG?G<P$ZT&d%IMuB%bI@PesO
zRkmaptq@fr%&*yeE;P?*;icoYBxopMoDDtbceYD;OTGZP<$kY4yNVT1^v?FXi%Db%
z@=~8a4rd&1%`0iMShLBTI?k}RRBN!ewCc_G`O4K5LNmH)oB(T0c&8g=nXOHZZ{aCq
zEccoWbcF3^NeFUirP(p6&)>g!BG4wWVaE<q8-iLXC0Q`0W;YzPtR!qKW2&Y7NWP-k
z=l2o+erS=6F@ySoza!cG(4gkZ2FQi=16WzglQe#5a9dmukO?0=p>R8WXp+WE7c5FW
zi4R4-Etq~V_eF3mg;Wifs2;}^WP2#u9&3WH%KVm7VN);j3M*C7?JLIURH4R=<(S?Y
zD{uW|<z009S4-n!phtOnJ-z*2yEq4@O3<ODw(v@uA)CTbT2sraJz?^3+Cr4h2<{t5
zXAPR-St1^osug}Kt75p9X2Ux@#&y(+Sdy<ny&Y<@X>y**r#0|}*%V?Ej{N;3d)|cw
zB~%UNuK2C2J|<*JlOuHV;@!NmA&ZO)M=j)<kDyp<2i+2uaPebEN;n$GPFhMXQEglk
z;F@k-(vIMmcaPe{DNX3UJHQ|lT^>ZBuF^b)@$`E!pCm+}7~MUV?(sZ5?!m`rba)%I
z4XQnygH@5UB#eG<9Te+eP8k5l-eGl$Vmkg9ye$J^<qR?`&*_(?dgLT27cMd30<)B%
zXEO<KMFX<1Wb}rF_4z;54HN5uegT=i_cFAPaE^s-HR%|M+`^+?dA7R?M!jMLG0BFy
zVN~$^1%-?rx<$Rv#&Xv5E1FfMXQ5%x-0%;Zgo};uKIFgR<_)qg5>04Y^e{u6R%(ba
zr)i&N!D+nXP6E$i`nao>@fAzTAtS|M%rdpJ?CD!BqRi+lQCh+CeKI}@`M6Zh=<u_k
zl3OKK0-Un&Psr9Nr0tkh)l^mw@9HfLz8bzdrG*in#48;i{Cq$NElyS#XejqN9HreO
zoubjoLFP+B0Yl-MZasv;jefsy3&xsLrofkcjfKluTMD<LzGklF8z=8FMlLBon8Lvc
z#M65CM3Xe>kKEJ|U5<X}`pf$-w#D*BeQ9~`bh11p7S2ut)8dl^({_BuD+m2ZCih2P
zY-uT3-5<4URoNdt90$W;cd$s1DxMAbuHa+Gzaba<qiCcj?lGu?&eV^KxM)P-bV~ik
z5q9Q5`ViHtwGlLQfEfA|LX~RYIxN*oXn4=}!cBeC^8Q{!+z0N@-j6>K&aRbxeDfRc
z8n%RU33>2YVt3A}4SaVvbJyRGKn9IqbM-XxTMQZ|T@4vo9WafA4M0!X2rJTSAo4@m
zBz_=j-!+I1F)N@|%Y#~2?Y3t!jlvGdIAlU9h7rQNVu&Hx9K%5F4?ct$6eOV^7Y{_9
z?NZlm3awH|AHXDH854|y9@3qUQaKu4ox8xx8aVxflaO>GAB2o{35C$9lrun)l6*A?
zx%ZE63c@D-lzCOvVD5qC4+Y4XMUB?TS@Uv1t+$hfr!>t1Ney>H99M+HgWqX_CL)VP
zA2ji{r|EktC%)#D4EZn?b#78)^L`MHMQbC9+w&FWSLg^&Km|6I_zB5K_6XKjcC8x0
zT{W*V9G;ynIX2seIi@*m8OSUNW;O^?FsBZN>B-?r-u1y~j5WJv3+XW&d9#jRlDOe0
zfxUB$oC1HBhfi0++uV*jXM4j3SC$5)sTV58@B=Ro{(8YMVSJ+B^Ko#r$}3^r<S_!Z
zw^ELOLSik1u9hqrf!wT=+a8h(3z7eT9I+6$?vbk_kh_)g)^FscK-3VIk(Q9#q=!KK
zN=6DqC7C}GwPtVKB%3Vm4RXlhUME*A?p5;A;$9&xqo~{^(!=6jBqJ?u1(|Pg%gH8-
zdzKusxMk$3#XUt{THF%iGMdIOB0Vhb2{O{+7LfU)QCHo8v>aa9<`{g+%X}PBweUqz
zG)(#*Ynt?}vgV4OsPu=MQ2zInznJn*Q2t_#jPg%BQPt+iDE~0!FQEJa%3q*4*9Z6o
zPgIpT=MDltkMieI{&C8mt2s^i$DgQl6*;G=zyT@%A9F8!ag+*tsu@59jy_Qp<P4zv
zT*{wL`9~;!x+aS9k33Oj=R{F{4&_gw{6myKMYD?X4?R(ta#m6PUdoTB{DYJquSui)
zgHLp-^qe#*@EsMfl)!!}03|>L_CpEeG@<-&DSs?gu#fV`YGjnZ?};igM@IQ@^V5|X
zMfus3KT3117x1&6sN!<Y?FW7q<qxC$J(NF8bDHw^=$@!zb52u%9aLa271&J$25SaT
zf!$A3>YM?T{|)62pnNms570zWzWIqNC?|^YzoPso%HK)(QJPhhzw?PonX`)Ww^6=^
z@-r!4qe-Lu{+Uly@|-j(u!RbQP=W1KAVkxI3T%I(Vse^L{+E>h0p)*9`5$Oxl>arf
zfovJ&ZzfO2z-dFnM$%#|xVP4m9@NcWM@Cb3TRK@pUEON3mAd0sk^<@mFDJi_g`0$i
zR3aG%ZoYx|QCF8t22wXTiOd>@dN(Pke`+?&tZhh!x$7-CG7hy@6fAj0gLHbn;P^vI
zop0a^T0bOj$Dy9R3&uTt_sGD~<LA;Tg!^0pE*uC9<mEHBPzm9C7B0MMYw6pMLBY+3
zByl_nXYUxuq4CJSS!xa5=)-g)E}_lO&_iMPdNhf=9FMv+yYtI?oEpjrUrhSNp$Tlj
zC6XD3PBe=scP3s8z4JMIQgMf&_b*e(qK{Fi&XH?@ERU-OmPpE@PtlKrT?Wv%Xs#z)
zMOBw(ggxSKgl$>zinrQjjhq)OV6-h|_J&E?&tBMTSIgw<)s}m|^yl`9dypO5sd340
zil$AII%thukmuK3tUR|{v%-P<ol7?^36%6o##OE~S!K)U=#i3@x3S<xWEoj5-3JzO
zvRq>xv-xDoiA^z8@ptQ2h8-)s5w<DvlsXq)V`^oWCApFVjCReBlJ4|&O45_z5_tKo
zbIpHQ8F?z~5C2)GyBTW50b0hYjjb*~d7eg^cjKx@G#yzl>C~6kY*}IWVeYV>^9Wt>
zeJ5QnB(^e)CRgQl`DLDj(XWzl2}d@-szE-!bin25`R~GDz%B{-IX(~Wy9yk3cq+||
zd*P-Sr#zuNmJg!kQMFb||JF`{!#9-g3jE?@^eyJ9{HBekdvIZAsX5~SGDHiDj!DsE
zz7`HbBO-`di+Z&PhNC#y-3)lbPjeKXLUYvm0C}xN@ZqnTw3vwCQm+rq0zB>fhAf;2
zO?pyKk}(lB$KG4XrHN={yXYWAHI1za@(j52`WwgnFZtTlUnYCm!rIaLbyAdYw(hr)
z42_3ayVjAF@u;t)+MBPPv4K>?BbP3vE0f?g#QKw0PoB;f(#l%lx!nhOW_CwbzR`?u
z%sOTHf&3<g@H7`}nbelVC7`yRJ1k~T;F&f>@45rce50U`yG78>B3K>A7nFZTRwkgn
z>?8#_n}Axesm;l~1k}>6)Y()1;_p6MgiXICo@O*{-Jbq0<b1)NZ%Du-q_EQKej$;Q
z&^U=V;q}2kk=>KfL`lgSUcc=UX)zhiVkK#0`DB=;OALAYCZl{LO#oXZ2~+asPet&@
zn%2C`TloocL2UiOyv%8+C1U&TASb57opRr=$>Zs09((+Yys0x#55(RwlI=5*KfC$?
zxi}Lv>b}f-JrhktO#|-!nr4VuaI9*%{bM*T%-(a6Bz_79$8FB%J^d7QL+rNiiT`Xg
z)&ABozclVNJ&9SpmwY`N8p56v<kW05!Yc9BZQ?Np9cLYK$ggwI7`EXeQO`vaJRWY}
zlJ6`{c?;V(xWyS_xZ7#KE4U|nJKT8P(2?V_AAU`W=0bf2my)-0(VU=d8L&&Rts7D0
z{tO<#71a%gK@@fhiF=KP2yOFcHeCN?UmEIdD2LEN24b3rM%vF<6)l_`WItR@tUp5?
ztV~OulP;g3Y=?$@a0&v~e^f~zk6%A+N$lsNZ5Dw&^U-#;&2=(#0Suvg)5!b<D4pGV
zj@T|lS6b=xoaOkkvvf0~{p}7*hjaL=BBrh9k%q|UAth<`IcnEs+gELill@Zaw8W32
zTbgnE-@Sf-ZE#}XOLvPJ?VS-;!@)@2bi9<z{~XRR9UqWA@KHZIzI5Xv6yEaI2{;je
zBOH2UT6INQkKl6@SSrTlZy|AuP%rr;H#$OYIH~xNj*z8?iFpwUl220nP3Qq~4?>&K
z4`zhXxXDR!g^sz#91^e?ZZD@7)7#VN3VM4wuzbkb;bn}Ab%<dSeX;&(rC-{s%AuOr
z5NG1eXlK;eI;TEwc%{(Zy<<zRL4Qe0`<4!<*GjE+$lzTw-ITz~T|4@w{0NMX^ieS<
z?QG0q(n>v*-UvQvVX7wlSf8wlV)ASmy|ZnYuFf!JmF?Q<t~+U<_RW6Qu<9b*LTjHK
zW(@IG@GS=vaqa4B^lbR%>+<zeet!QpU%1N`Hf`0v^XU$-P%Wlon`zGzPtz_&cA6%6
z;Bg3COZ<{Y`!5~G7SnAAyrv>haMn0AYa5APg8E2HzRU>MYM&8)3FPF`64Z>%+(7Ov
zLB~4OZhd1;ajh28QC;EF%XiRG!P~IT@>!m!Z6g$jvE&N5q=V)g{sXbsqt||CE?e&1
z;V{R_uk1onG<`3!;f$5PEu8TUgja_4@J+3gE$kr<k)R|L8x&m7;j}pgMMT5dHNBjM
zMs1pT(J!s1<>{H{_AbcT5XNK_&_}IsbajMeC&4{b{!wx}3C>x!Zii!MucWB9Cf;=O
zo4j62(XXtx&e-#uUmAkL`*$k$ZZfAdxeJGdbqY}AEQM2teg@Qz4Nf7`3}~U`;cr@*
zojqBSirk3Qh$7e-zmixZs*nu4taY$+5Evn;s5@JJo-9m736g=QwGOtdg^`Drp*!5h
zbkG;jG0!g@&65Qj{HnfzV#yA{9Rlu7@J|+9%9DI8@FZW8^3CYAZpOa)hKg(fn-0`B
ztOKkB7y){~Lckor48UZ-1i%=;a6l{|8W0BP3+Msp1n>uV1C)T4fMx&(fDM2Jyxm{l
z@ElOPzh3u8;*Cc9@4C8ox&PlySWH(Z7X5!DaY$Q76TSy^aT{<Ga20S7a28MkC;%J*
z><8=t>;!xb$N+2vqyv@%QUFT;^8vE}(*Oy8IKXJYP{2SyB%mLl51<>Z{~#dz0A7IB
z02e@0fIUD0U;wXk>l>Z|9s+&?{0g`MxB{pElmUtW#{q```vAKEnE(^u3&487YQQqU
zQotg>yj-aNL?EUDCIZF*MgoQaVgTU)HJ}%u3m^c{4&VW31!w_~1ODae`~OA#|I60@
z_Z#nD{r|twc>epvFZBPv>i<7h0)O@Y|5(vmde2|;|Np=s^53Y!zsCQ+#{d6h3H;Un
z|LXt$$rAX#YW}x{osKo29?lG20v-b%0BQi0fa`!ufO5bozzM)nz(GJZzzo<9*b3ML
zSho-Me=C770`!1|fH{B(fXRTZa9D5y4lQC$u-5~(0#F7h0vrb%0_+3q24n(EfG+^+
z0jmMa080Uj0P_HefT@6qfN_A4UqSyL0z?cT9H0jD0(1cc0NMd);{P`2{+-JIgl^rx
zEoXlsaY$SDr;64?tcF(LwgAWhwg78DJtXuJ@EGs_Py?t0TnAhNlmkuyP5_Pq4g#_P
zX25n6)c;l>HUZWFRsxIwJzybV4qygg-F7&DfRi(dqgkK?kPR>cwga{THUZWFRsxIw
zJzybV4qyggGGGE=3}84Q77(q2pD;jQKo3ACfIq++pair8Gy^my{y**N{-+iGllpZ3
zww(PrL!kcuoFJTFLN(X`Sisv%IKc$e0`38B18xGY0xkm10!jb{fFpqYfIWbnfUf}=
zfQ^839sDc@qyUxx<^yH{rU4QFae&c)p@4yaNI*Y8A3!%i5Wo-M1!xU$0W<~J10(<j
z@EVSPp8_5NegpgpxB<8V&{e=s8K4Mo9B>G*53n1M2`~Y^0IUbB1}p<C1uO#010({b
z0ww~+0Y(DoxpNF49H0jD0(1fVgOdKgsQ&+f_5UbG|6G_(98~@-%KwCJ-G3@!G2OrF
z{~vaXf36YziF*D&Rr6o<|G!q$|F8=F>i_?+SpFL=`k&MHPt5=SoZ>&(t^cb3e@n6c
z>Gtzi{r~Br`jajCpVRl({Qqw$);~R|{Wbsp>7x3x162U*blL$t0IdKm0CIpWz#32w
zX9+I>j{y&K@KXb*1Y8GP0+a(z0Zssp0uBPQ0cOB<z*fK}fDy0~Z~``@%z8LzSO<GO
z4DAW<5bzt|SHKOx6+i``3{V6(4mbqR?Sr4)fJ}f1@C9H!U^QSFU@2e`U>+b5FcmNn
zFb*&hFa!_-po#wr(ETfs{s-g0`2R0h{XZ8+_pcS(KQtg*tOhl>y#QSR0f2S@4?rtG
z3xFJ83$O-6)q?>q0gnL>05yP0z;(bSKsn$P-~`|(;2<CyU<PalYz1rrtRuw*Xtu6d
z2BZmy1<V6v04971Z4uCN3!Ga3tN}_uH$Xo?Bw)feIQIag0JZ~)00DqVz)+Y{rUK>w
zmI9Uo_5p4J=!vkyH;~5}bEi%7Wk_BjTA;hP8`|#w3;w_Oe;+sFyZ@^1{jmLi%lBwF
z@edMjy62se6L}X-pbw?)wvQkOwNP8&Mgpk68=wfnM(2f;!HZedcDIIxO@N(%a?zz>
z?_*~kSB~J1u5{4OoH1wC%xTl&XEC#9B+mAqF{{I*#3?gp!@rZAArhAGiJx`&IB|l7
z*CBD{tT_ym7kC~Wll0oU2vP#<0~`gE04f020k;7U0WSgU;)Vu$Knnn~u%RJ)0r9?q
zymj`;4Gq!D8ydO*<bVfh4GpIN+W~sOI6xmjOTf!z4GmWS`vL0!vj9T?od8V%k5d~O
zE&}!e)&XV#h5$MNngSjhfe+XRSO=J8Y|u4qS_;MWAA{~cnK-1a`;X;Z$heLc{Y^k5
z)JHc!3&3*&)HC29U?X52U^t)~patN03h)630UH4$q1_Azw;P}Z;5oFZD}aN5jesGb
zb0oOE0IdM?K;|K&IWM`vs-a+MUfETok`hHF`e3lUGox<_jlU^_m_FdLT^N0e=wAq~
zO9Z0_hmiw+Ke!L<SiL>CPK*t6kYyN~;&*&ID~8D?J1S8i+Da}{=M>?7L2Ev47tQLM
zSt2!IFk+YtNEE&ouq0Xxt`QQQCi)+P(&$c%eyHgG1?2reewOH$1AphOcZtFW>C8y-
z>=!iNekdg44_+sx2}Al+qcI&X`Z4-Vh}DB(%x$2LiuBE{jJ`mmcLH4`(ksd7YUHNt
z!3t4YhcNm+BE2<~(W^yzIMDEy7X`Kb7=5HjuLSuRk=_UNNRhq@^cay|2=Z|vJqGBB
zB7FjMP8Mh#(+wEYM8+Hj=@UiT8|XPAeZ&Fj=Zo|vpcjd>1mfyNdIHo=ib$)0UMAAf
zV9-jDo(y!lNUyhN_3PO|V$Q&`No34v!s;_b`V!D4k-iG<c9A}1#p+Lq^t5nBe^#V_
zBThX0lZh`hjNS%BXkGOA0_lf}bVVc-lt?R~wT%(!Za~M0bR5VRh_nRci$pq|EC$tm
z>mlejF=!4%dmz%`K))2}7*JtjEhJA}`#)&X`T<&}ixvIyF<_2J*M0=mAkzL2K1ZY@
zfnFxk&Bj6TiS+Zaj2^z+vSe`&gzpyVAfO9Gde(SGe@djwApC|v>zLKRxGgd+0{v2?
zhsHr;=LDr*KsOWVn2#BKE0LZL;Xxw(9Kw5u^kkr8L^@*vbSjZ<1@vT*J^^$hrxOwg
z&_aU|8CNGlBN6G{K&Ll`7cu(vB3*kJI@o)3#(T6$r2UUTsk|4y^F4ZZBdr5P*^M5c
z_rFIUdXGN(9$oMrUGyG(>OK1GdvwKn^riRct3c~$v!uDX@gAe{J^J>0^l$Ic58k6|
z-=m+tN56cJe)}HHNQ6>{bOZI)q9+B4%jO+JZ~q=G|AQt+9-sh6uM$S@C5BDbBI0%j
zxspDQ(9nP}V(2t*<3xI2DGWCv-7*2`DUW9RP#J0YJDQ;|iT<77ZWrmTW$-si9wC+P
zlo(I}?pcw(S;pw8-%@sGkiJr+e*^cnNVh%%eN&{Fvq=B4k(RRhw<4VZG7R{s9($0H
zi?j>4%>=p~a|48E02T5Ap>`r21g^hGw>rxZ{t<HR9VrIHf*T{!W6m;q>Zc0EfPy%Y
zo(%3pkv4+@=f{xUWnw@&xGP2aIVhlhs$e}RC=ltObI_$lIu7UuBHgW=(LWXG2|&Bp
z2yq_+9VXJs3h1FCJrw9ffz~l);F;eT0q6{oHeG<;B+?Z?pAzYN7ojdhI`#)hSfm$S
zV)SoCIvZ%EOfW)u8Jdnr_XE0}NIwPIUq+Vyj)qK`EQV!Xg>g`%gRX&HBCQ8^kw_l`
z8S1Bna~ldLTcqz@ht4e0`kxqmrAU`R_-&CMLqhH%h1(aP`lT2ow}s{*(hyDtJw~oN
zB?MCa?ZEXC=}gc`{WP4muO1?;2Dgt$d)<J!Tcl&p!E`Fp(GWgIq{jfQ7wKi-riip2
z!l@thtC={6d`M)R0>)91z5?_qk*)yutVrL6aO$VVojr%hProBo-~%z>Ex5HJosN+H
zsYovcn(}C*9_5HM{EnLUt%bm5u=b*XyKRxal}L{)M|yve?gMU+Nb9YTzKcjlTai7F
zQ7?xe2ul&e0%XMFAqsF<<cRbcVpuC3x%U|U_HW!n)J!LlBmE_jQL9J#8zTJ@5~Pbj
zYRF4)Yel*ltQMY%bP&*#M`f&mek;-`PDsyypN2;_MS9AkwE8?`PNbFKy4bTi3xh`Z
zf10>|&?cfd4&e8$R;of9ZR#LJGGuTFn4#by88T#uB}$7yj?&?j3O9(&P$a|Ad(=X2
zh)^VY9fD-&P~^Z2fpiEclEI;ZU=)Oi4i17DDkvz5@%tm+pws)j_kQpGCGXw)EjP=K
z+i|6(QwG==ASV%LP|nd3Z_(b2($Xg}F5+{e7`RAFY5!-B-p~6=YgYRBMoES4qTHr8
zE-785J1FaPFR%0-eH3HcBO_ko<bs?oo-W;et@I~4j=fc1>?3HtfX9Lc8BoK3SvrD~
zbQ@05ui#~R31b~PxQw-)?w~BuRm8}~PL98e(xW%g?gy+`7%ZI<H1|g7h|a-H+J@!8
z60-((=_8YP56}l!l>SWjVFP^<|L`jQ2Xut7*3iE3{5pO=c3ixnbe29uyGviYi94eo
z!zH>5SLq*k)79uD_!;fO9r_M@NJlQF;^gA+>e{FzriQMq<FV5{I8PTbI|}rDc!8F(
z_|M_fFKWgwqrqXLi*kkDxQn}@lkc#zr!`8CKD&iKC7ni0K<D6OY<Q84w^$D86xPoa
z9mlIS9pkh*Ffe7<Aqk&Fr_r9FCGpGBHcphIW$x!`$=eFFg|Q3tBgx<B7s%CY`rJIW
znaiwn5_l5yZwy|cB^PmN$xd(4k~Ee^G1x?{(fB^SF4K}IdUOWI)N}<Gy(yMyCD~)Z
z4iAr|LQDF%P48oHm2Sd2w1Jb==p@?fG(JwRcj*ZvT6^?Itm6?K!-oEJgB3|}n{?wt
zm@v(tRsW`59)B=xepO?wab;dO5jufNw6KU}$4+`ZrN93ftUB+N9>-nS;k_yI{2Awz
eVH`tMa`In;!77T0pC|(rE(Z8G(N3sh=99mbsp1&`

delta 33899
zcmeIb30PFex;DCMK{uleqBb~S%g`VqpyE8C(oCWfqek6EQ3Qu=l&G1F-3SeWsA#FB
z24lyqpu{MOikc{>fHR;`qsAx+;uK?}aSp@(R<A{LpR@11+2@>n_WhqHKF{0ruBvZU
zef3q<SHoHhE5ESL|H3-!Losg9ijNH>b0wK7s(lL*NP>lEe7m6BvN;iBqiMP2hXv!6
zzNEEL<01&c9JSyjg~dKn7~)T}t%li*cTvPBOd(Y*=p(D1q#5<I?oRA!taZ1@#BXBq
zQmzeIcWe>s@MO#LC_}PWq-b&qn$oO3%3v}k+BJJoZU9S+@l!l;)|#9WXQ*0>f{Sh5
zJWr22q1ska%VV9U(`(l4NC<st-Nr7u+EsBM_rzBAqG}s&J2&lK7e$c56y&6%F*d5e
zkCJn31$z3oMpaAXq)^N(c=iGDG`<u}Au%7%a~c{n&pYIyDK;^<92x|*rE6@ulWz2k
zjT;$AZ`lO6=1)KY*OIg-LR~z+y1C*SS1|D%>Tl~kR1I#78I50ktZQ`(#butBKcl+6
z;*z-{#{99#K9LrNB}=QBfe6%K7_UO;qA-j%#Re%PUJ9OQNwaO+D@2pA*q;{Lw(laC
zjCwzVxzv~ueyKKR*=l~jqFBCXrYW}SQ<E{oSCXlUr%raNp`VzHf<`i-Fz3}>hOgyP
zaaZg|D8rNMSvmfdMEn6sq6QKnADE2B4s@=ar_FqmQQh7YlDLq5Zl_Yr#Z^0c(9V-2
z((88Zbh9@{<QU|fXCdczOhUepXNXfMdPuR}@0enRS+HA-IW{=iPa%#;mD1vo7J|}Z
zERZHDy2|;?M!lw^D_EIhgXDbXm}2$QOis1-=GXu!R#%E>bwZL>fj*Hn4M~E+U%nv`
zH%v{^5~S3|BgH}CD;I#2swpO?{7=oX8d?5b$WJx}89SL{y`<Pu#HwSHy=?^fdM>Uf
zC3{Co*Ka8l^S33Th7*&$(`6Cw_i+7ovQN73yO_fJ{S8aGoc=G#-Y1*nKEU<(WG@?n
zHXM|f0n7H?ruSQd_Ul1onz`xTg5th;DX5sQAt8O4Ce;uxDWUz?6l)xfHtCDhklMa}
zsZDKAvjAm}lBBlug>~PQ`rf+RQk?gvrr7+2Qg<&-<Y{>+h9z+;tsG22LH+VF;@&hi
zFPGa>w*{GnjG%^4B4_w1wX}SK0*1RN1?wn74myz2;HIKWk#%e|PZ`5gf)e{SrFbti
z#TG}sx+g!fDaC*kb)>l?dgaN*YISIxaK!aabn-?d`aFiL9yJc*f-$e+V9!`SIuf(m
zH_4SEP8~{(4lO&lItoq}hHz=fYg>A1UJ6N}u$Bk26NTh2e{M}LIdp94(f@E$!KKr2
zZ+}x()->9}(LjRfddGI8E8UM@C3SFWOCLG5Ar@fc)y1wF!^w^sgGms^C;QkauMJ%R
ze}-$LFw&G26GIm}wIkDMj#D@pKp!}H6JOfGxxc5^yXTmjDA079UtHRB6o!8$sq*D7
zR3TX7?ifK!=Q|H2@wC{vKN&+CoF@~Pg4pIg3DFj;b!kP!V!wj?7N>|Pbf*hibs*#D
z=dFUo5HDKUDvh|%v8ta*M;hunh`7;I*CC`mJ>@!N(0i8*!_gkb`7R2Z{pSsu)uy1T
zdFKjg+J(k<!>cDhd+CyHITvOO3Q_;+6B2AQ?ZxtQ&y)%}x~0Hl)$bMzcXK4L!Nk@F
zh#z%rGmQ)=(6^aHhy$%^JDLoqJ=(>Swluq)LFGBmTL@0l!m&kmK9{6*G1$*F1?fEs
zdbv*)n|Z`pD*P?HLtmO=om4bOy`)QA-qN^Fw+o|-TvFQ!FoKw1FohIP&RbeNdHYMs
zIt!QBwIS6ja~q|*V(jRY4l{@&J=0;5DlSPo9xgxMy4qfG{glDQU^&;MuANK=d-O-!
z={;5uEp6`EyX70h4Nyp38N;ieq($}BPB8_so*M|-rol_+5@`sJyO=Bd_}08EtFCB;
z*w_e~<sD0RbXT^@OHtWi%CL$2a?6isXp+NL4Y_iP+H1zeH}_O;6FQ!C*8ZaQ^xY<O
zD7_Ywe*Bv^v)_`tLabU%t-1@IUM~cG=P-q*-!_5Yf9R=;Lf^uqk8#L@PoL)#@{p&y
z9yz>fadCQ)1ze3uALQtwP#<}>kXC6t?C)+!3S~dT^)DGpse@0~78`%dOUpr{RzC}`
zxA0pcnyPd!=_sG!eeR{J6nut@FF?DsvdD`P9<EhPE3jHGNbxnh;$}S)JvU+I3#w{W
zZDaeAp?WlZMi#y1<3Xxuqfh&mUfW@WpkfD&f!!oR^5&^Y=sX48d|!y-sdyUDX}o9^
zOEWqJh_-LjgPjuHob2<`=lP@ALtSi3>PEsB4L2B~OnM_7;@`==YTidzlC)DWI|lhD
z=bluq_!+#)^mPt?m*1zE{+d?aaf8Sr{UB$LGQrxdls!XD({4|uC;Z*rZ%<k~#QC=B
zJNN*r+mUOJbq(dBTqHTyXCk%iJW>q#h>q>77SE2MA9oHSwe-u*Zo^{VifcLA#zkrF
zRD5Iw1-15DTK#ZagUf<`!iumdskaOx(ba-1`yX)*Gj}9??1<hclYL5l8*lIoSVBDg
zeiJ<XKO-i6K6MUgBdVimKtNZ~X+E725GLA$(!2n@L%c!t9`{aL7MVhXezaGhpE$D@
zof?=WrUkBS(Sq6rwHCwusV1nO`)%KYZ1IpYLtfQ%o{tbLSHy?vgWN?QZ)yy3w_Co4
zkD(P>Q%pWR8RRYIwx_j0A-#fH+tg4iL7Zm{58fT(VYY*0vaX@3Cq%IDj(2;Nd6OA^
zT<P>Ky+o^)bW@jpj(JX=UU`DsS%VfPiAkitbm=5oHKVP&hKY05(<xoYi#u1*!(Ate
zJC{-SZb9PmB{Zg+A7=Vby0sIX-lOZgxr?S0da#?jTh{FAdtQx?LZ*bC4;>u2JJKUc
zF?o?5u9!aT)>ka5rvbtKxbZK+?QLokE*6e~mrkU~!9L=RCv<zTT8x=U%Y$8Qf+qe_
zh=xear>5XG&fBhIBnZ^9<hLBdfYqiLBW=^YQ(v_WwW_tsOJVoW>UmN5F1EE+akq0t
z%DmtovWFP7D~?-WLdG3xz1k(U1@|P@+~w(MQup4DcfZX`@muF?R1AbWQyb~Y?)}A|
z%c*q_f0f!gJv=WxPVq#v@E$4{v`LX;kV!Ee+M~Ujv03#vMco*~pzb46uNzeH=7x4Q
z1!d9X9-okW+StQejG0O`Jr_hJWSA=3uY6?;Zi?PoQ`L=<yG0!kPAWNB)RA8wyIa_W
zUmrVJIEY^#eWxgrUmqP-^aj5^LhtwV3Jl*dVaSga)<fPs86E!PNp=a<&Iw!eX?WaU
zzq8F@o<=KyDnrB$VL7Ye%t9*Zz+N51$Zd2=FHH*tg(iRVOOK0Ci0n8KJacnDrrEtV
zkytvgcQ-L;A)ViQBnHXx-a7n-_xa2{Xquw**N*wY^Zbm#aYJmxufpSg^s!P+Gmp5R
zSN3g-R&3YTr+HZA8(Uoz2O7I|HwrciQ`NvFbWGo_qVgEc=&QD^oXHX}Y*TL?r+fOU
zbz#R{6t%_kI)yxBup5@VReovXQzaW}kHa@5j!8R}IzClO-Ev(@iARclHk_lSNvM4@
zuB9T_A~)1JImgnvNm6l5&f^sP*IzBRrU;iq7*vJ7I4voVa~iTbbD`QRl5i=6)iW%%
zT9V75|3Fw$@RB5}IAIEkO|aM+Dz1%@WOGkS87G`<Qlj)*S&35k#W;(tCF0sqlI*nO
zlB`a1yh&JbP7*d8g~qYS*kbKiN!X`UHd#rNthQWMxCjbQM8+0tC&&sPm1}pjN!D;$
zR`?JU{tNQ8+%H=qx0vb7ZIMviBwTtz*7zVa9*c}E_sf=;c38?-bGS)XQ6?)~2!%%@
zW5xamS>bPFg}-i+)gF@--UEf-M81ms(Og!C_BbGGe4t6#P%LY_8yd$TW99xP6BkOd
z3589vrH5pNcS7M|$XL0*$;5kQh4(heD!!H#-VTMM&?m@cU6aNIvc|icgthx+jkiJL
z2=oc7%Vv$CaK5Z?ev_<WudHw`6xJeRtLJjl<?fIb-q9pmx?5IwGZY@Idp<$VZ2Rv5
z`EtQuLLdYSpugs%j!Z2#aL1TGT9PhX_QtMPv9%w|g)Bd`E5|HX8zIFgGj<(-1Fv+v
zU2Uf*ao%OBt=RCZkMLXdDyzdQc9|*zyB|GUWEQA-=c260vab$|Oe_C=$kpUZ>cmsb
z^gXq>$#j@58mMVi+Wqe)k=uN1r3KT&16{@2UFqe4Vd9Jcst%bYru)!kA*s#v&P|h%
z3bHO%;qFv3C`j~aL&pws_w;eI*lHzQ9+K>HLR`fDUUHhM?U3|}Y+5v^J)fTr4)PLn
zo71X6{^D^*>M*#gP9N%4YRU>3+H{*quYR|QW9BPSV!6PuGDyz7UA6U1Q)SEtf1j#3
z`g{8I&2MshIE{~sRtRh~cS$wxAtvA0FK(<tAX<LsO7onG-M|=BM48ZbJ{QOuRy|nJ
zkY`8=lcH12u}1p+;5K4MLZ1)zYc=hnIrrL_@wh=a63k0V>_vMG3DEewY&&G>@$8`+
zjztey#P|fkrv^{W<_1)3m}Ifr&uHclSC`{Y*Hsg(c^PD`nW?yn77p<vZ_=NJ^zblD
z#@v-Jc*hM@G*^9(*}l`4#mPQ)0%pZ4u)wzTqqI+GyJl8cVLP$As9*Ywdvt23hwrWN
z{6>91p26m%i?Y^2Rm$fv#YHT>P9*1IS9==Qc1ymcJ3?E#Xx}oI(i$7!!3u2fa0WoX
z4|Vgeifx9~Z%SPb4rb!+|0bBKjAN<FPbg<Lr51=+*j_%))3Ae0plYofQPDoyU~$_O
zny77Ir5wt0HPR(o&%oU6Ti=unSr)-+csppHm};x0IhXPlAX?t}Bo#}`v9_l_XnQMb
zOeVeHLEDD8MkpSb^i}ONsb6VTxEb~M1<Op0CY4=;5w^sCF2!#7*`(L|keb!%c|wd6
z*7NgtchMZ>9R?fb;`Zz4f-n!?_}j?0gVgd;$!NLaf#1IB3pnAzKUy62HYug<;k~U6
z?MN|I4y>XR!@U(nrrOwvbaA*RxkR^z_jLKzl%GG&BB#V|U6@p}njh%XaPRituM1P%
z;yo(oYK{TN6#12JQAMq-q-uOQ?Gw?Pd`IU;bSB5?rU+fTd25FhT4A@98ZNlLx%Mat
z|H5kRG07(0xpY9}X<}Po8|6Z5CaBPnvDSY|HAA)J8O@4mV+H5yV&zj$mkn)WGfGO|
z@~~j{&>t+xMF?~tSCQ1(wnmii-B@rb=5N+M@4OoHT|-$e)(tyzXTFMK`_NLU%B|Em
zZXnrAtHx=`MyeS<kbFiH#vikpEcucxZ_}=S@h3Vu=`Uf9k-T$lIL-E;VK!TipnLuj
zP3BNC!JQ;i^@KL~?Khz}8Ajiq@CNBYPfUowea>(9YSZ;lk!OJAOHZ|Bou>!jWm(4x
z`4~SQNT<Ht0sHaPx4p5+-Tt<>h31DtG~sRckybwE4yFIn<PxICSdTH~?>xtwkyqiP
z(XR%TY74hmX@aS?@jz4hy70LBg-U*RRI$ozzqGD2bmB*3B0W6u7#T$uP4aNp6&WmT
z?pCk&YLt417-{aQ=Ip#j(xa35h>Ztm!z8b^jfYm(yy|Yd)6Tr*G=A}0`_S!*%ISbu
z5BrTL-AW}rw2^dHY<p~HGh^Ef$;1F_$S#%^k=#pIkD-c`22*}f26iQXmtrao{5mhK
zdZ?l<yO?NS6k3njhmJeqYkDuX13IJq<aRCByviqfw9|O&(Wd+xyXk<*?MOd5VR8Y?
z=rqM&ym5^Vn4<2q@yA!va;cTNEB~=nShaEzO`p=vzkNks8quyhF4dx@Bj%slCTlje
zLQ@(&Kjl+WLu2CllG8LZF0AE<y^mt1j5<GR@VE}<N=A>tfTXwM{5m`$+ABro^6UDf
z9_dc4oQ}jfK2chDr_^BsZ)|U(U8i;@MRfYqK-(i151CK)iXG_}Q>PQ_0^9f}7NmUT
zjL$Gqvu6a7qklUy!-6a?I6EtVplj8=vy1emJ7(|gFg<yDxKO>){$7FNvq9YqpAkc!
zyzJ_avm1Fg!(5j@Q|5dh=<{rBa=21ZeU1KN_t&wW0aJhDU74m#eTz0L`K@}r)g=;n
zV6W6Qea6sbiEeF16&TiqbW?mLwCt6)s`_4VW5+}CRN_RBCO)^{`M@t-wU>9mnvt~Z
zT~882@4f4T<CErd!=c>xxs!0{d=Pvf73Ue+^e|O9UQX7OG-y(JRlS387Gb{IyF1-9
z&l62pHg6ueLi^0u`h3@HAPf)phP@zUEWEe0d^LKp7c^IGS__&pf2iZWJZwbCNlEpz
z_PgI}Cz5*V{(+l~jpP&*hiJ$L!)z?1tC}LZ=7a8-D9p}AyPsb8pupy_bXB^WW_{R7
zHD`5~u%Ed5&#ze3CG5Omib2uLl<!CneHcCIz9bpH$5eY`L;t-lsahh%7_u31#A)_D
zQ|-WP=R+>3kwl8Axg$wz*=VZWxc--~cc)76@wd5*lor1o`K^8NHNBtVUXc2cigYxZ
zYTFx<H76CxI6xVmDv4>oFx3_%zaHbgiI#or<F;Pa8VzAP^F1~JN@UJj$NqwF$<G_9
z@{>q1g~oi+rh`$1ILwWk*m$I6*#1qDjb6dt#`V%>D`@5?1BYxd)doJw4t06vgKcNA
zNKVToXPatw)@FyUSi)nIj$@ryyVG>bAf?u<$C!B_S7kkQSkOIu+Ad2|?ecr8LKL<e
z8j>}U%Gb5tk^%WU$r_u#i#04U)y}#7cXF9DV?q1TD^0Z{ZYKMjG)uEEXq%d_F#Wj1
zQa^37PE8ha<;Pl9JP#@L)+bGJ%1@f);vqNU28-!JTG8Sq*0k-Xc5Z1X`Wmmc6>&bz
zt0+~*kV->7?F8>W>(h?I7NJ5Hor~lYT<yHzRw!L<(WB^ZYYq`-k26sxl;xUJ!^;FG
zX?$3Cm#%DiL>_J{nH$tk@7SCE^yyn}OOkyutmD>MwMzDh68zGaR;bXkaWa%aM=o4q
zr!qvdVZ3RUen9Um{LIs!((=(}n29FZck+;n^7kH=ETwFjMssw1o!?E)U1A-##>!Qd
z4tbl7O8Q7Qp?Tx_<Xk(OWKFt)Wgydxs74yAf6w^^L#EW={jQWn%_w?H?_)Dtz8XVY
zC4~@O!COgAByhYGY0#Q#O=;S#sxNtW`ZC<2<4}QZ<F%R*&d)N~ddzQm_r9lV7M-*i
zD&3>#O{XUhvkW#F1L=WecPtGqC!Zw;X--NY`GQ_b@gB6-t!rM&=!-b!P}g?qzLiN@
zb&>VZ;85WQYN<YA;cbV<NOQi5ER-Y^fs#b2hW0bG>)<b4ZE26ghs#e!t&pX>J4x~0
zZRp2_Ak0u-8t!8HUY+`jxHFfgq|L>}v$XeH)<xm854Yz2s!<2YS=G@+i#^>Q3|MVF
z?3E9aRux#O-=~Kct1N#WusVXSSnQ&>eHU_IEyx|JOz(`DA~^kxHov%}J!>?C7qHu~
z`?JP^doKmmP;R^>52!JH#a}Ms_Ca#y(l!7~790p(7_fT6Ae-<2gWTtD?>5Ax+!mXK
z%YFM++|t{ELcUVg#HHSrdwp4r3ZukDS(ZyPGu%iy&B^G3`Ra1Uz~0Aqq<6D<A|z>H
z=`7vP{ISlJiloq_sHG9k5e!<<B}=|H3{#=wxitIgT6(l98q7ZPdm6K(i^G9#hH(VP
zvrBMPou#A8mke&VmuGb2!pS16bfrq28&o8*FDvMSC2h$50^7`fL`<DPBbJUJXXx6c
zGss#hE*sd%TlE3fW`WOelrM;;tfCd>wc57am3b*|KjbIICkq)QXxj041+$iQQmd9z
z%O@6mVP2F2e?V9&5>sz2r#p6dlcn^+j)AI-7RM$WTYJpY>#msGF-?%3^u(u9znyK`
zq$EX}j5j_%TbLAC?Z)aZ3|TuwN>?P)*qxpj<|#V^uoNuV>DBU+ycAx}jg`qhks^Da
zmy^1H-rw1td`Ru{+u%2Lrz;J~4=3-^#rZ>AW|^OO7&j(gi<YEs&7#-yRb&Qzn(s-b
z(bl`#w3!x{eq12o7s9iL^kCH+jyJ5!lnz`KQ)$eu4)D`+cXjFHZ8gz;kjteofg8ug
z>iF9`nCe3?>pK(Kd(gvB^R{$X{KSItU7bjW=mD#-jyG1Ez&Y8{&4OPlYstmD<5dVT
zJ5Qpm3p%LI<?*w{W4|wGkQL_DFgmgz(DCdJq@`EzY~ig2)2xDS<SZ>I=;T;7U|mwE
zVyJ2X?*#Yz(uM*<$8LV>@=|uBldyFDw92@1XL>jmHouo!I!r3JG>mTF)4yfsSEB|q
zx4AWMccKk@eBDQE=9iv1xxSsx@@;)`PR=e8&f>wgDE89Oy?u!%)$irceM<KBZWC<E
zZ(jj7{i3OYrM;wr6hYK=-?*NiA7mEWtb{ll8(Ri-X=bL2MV`H&z<GGodKY_Jf`fYF
zoaK>su`P<xt;t(r4p-8x`{Geqhr%J)q>L===<O-xs&&I!bzl9cyG5vE%#93bLBci0
z;+;@qVMo$PPZb9Gw3X!Jov|j}0oQzmPXd}#Q749%Da!>X_7QYRKly^H_jj;ylVoe`
zY1IC4<YB?){cfa_g%s)i#FW2rW&NlPMNdX8E&65Dp~9w$8i*vJ_?6x{&<E=&&x2a=
z#$7t|;Kb&Yee=>g|46^vET~kxyZAh%R}XrKv4d#C!7;Gh=&wTu-Iq(fg%!=?`f-M$
zx8L1Vl5_M_@$l=ZWh1ZYv5R!p2Be!}8<Uqt(r3X!-0GedF3(D=*jvy&&1VC>`t`&X
zH_p6Mh{@IZJeEeDzK>s;5{pjL=x;ic=k()mHe*rR{?I34(LS1eDAn)y@GC`MM3G^J
zVQxi-EemeXC%cN$qXrF28s=8$qOg3)m>^tbw-<%aqS1$4p=SKy56O9Y{qSNjIf_m%
z3KK2DXnxT|<my;FsP*kOo?e?@u88^y3fMsbJk#*!3fxGiGmCx2V?F7r;sNS`$=!?M
z(!UeamDQ`it5Ygm-ZMC^h~h=%p{U!=^ii>It8ho2)v&#CbE1ODxoN-Bpd)>W3BPXC
zaKwxJY-Y!fc)*SGxJJa?G_(Fk`D3NnqkYLW{I;QmN7Y!fa`x*{ckD^IbpNAn*4%RF
zC+C_X=)z-G@WZLc{))Np(XmP72pw7Sg!nL{1L;Y1rOHA1$+`A|3b$GK`0PmTXr(+*
z!54AKUk=?$qWP03YO6n@`YYPlu2Tn#ZFWNaC<~2^kYhNX3J)CP^geTUB!PU#j0&}-
zb)|E~Vh5U7)=Cs6(8Xmv1D%pFcVgX^l@;Wd-tumC42v}P%%|%x3)l(L)!ipYD!5FH
z8+}mr7nmgK_*gNkHQju?gY#ml49BEW(r_@vFWr<_+=gB{?qORM`cXYbQdWL{DxP?+
zlds9B%O%>gh0T;I1$RH*olM3_IYfJ;h~XM;sf!d}<4HH2$R!>$>SW;1Ih)^P7jZOU
z&{`ocwbSspQ3|Ch3dZpBo0IHgE5xN)IWSx&=jFXaBB@<Uor|6RNb)vYp?>uBREr!N
zL1R$Zm|}u@(2|pVN!yjDS`8lfYv;4wl-`3*8F-$x!FlOYjv4Vh$6cqZOKhG>dESd7
zLn-pJKz`+r=7u%JWckpsr)G)8KD6xA08!tTDo;m<wLNLf=>VtNU<*x3eX_S@J)i!v
zI?`pQgT;{MwB+;vF~o^lo<ZP1L(g;-6TRt&XU2+x6+M3@N{m%e_p|NERyyEpAlX7^
zpY2ID(VVkkWI6riY!F#T-OIf(Ifj;ZB5P=3c{j3>ZZ03#E(;5%@A;loI@pmque7@l
zU%Im5Es{pZRvb|1OvVu>XmMpL5syg%D!Y*n=#<L-WF9qE@)_$J{3g=Nl|JO1mFGH<
zzf%8m9vERG&h;X*>Ed(VB#!Pl7l>yo*U$BKo3QwpqYy%}hmi1dR-XFXf~q@jPHh4W
zI^PCQ>Z8w(#$m#y^W(7Nt2;lLM9_)fu7+=V{H+$e&xH{<2g$h54ST@D7y8=_<UQL{
z^DKZ`UK~pH)0m5U$yZc)DGlc@%P#dNtLd3bZe%;Xb*a7W1dYMdV^xDGW)5}y&cDSv
zexZ6Ipm4=lPmdR9nK^XCcm8-OV8M5b#Ke&+FL$yVnl(fciI1c`E(f+*U_J~CH;*R0
zg`btua7@)3R~>CWruxgH!m=jCMJX(C*jJBpf%+@U4;;he;c<LCMAoXxP?j>a#VLcQ
z@veY(J-X$kwBrYc^^yr{EIl`IEp~39t*>+^_h`(Oj^sA|_=>h&ca<NEWE(XvF2hz(
z{f2z(PIr^yP9@T7R|Yu5_z(K!daCLvFQP1v`d%GG{OQcAL%NwvF@c$#i}KRj6-mVy
z9-3ktmv|RSjcrrfRc?IjiM>%1@6yS%>S{;wHnsh}?bt;36QLxGgeQejg?<2T+>2KO
z@W?RVV{rtJk<v^t%L~j8OM`+s;Jke^vNo?blfvDO3^2UYllhpv$Ji&|bB2cqZ_$O{
zw?{L7{(UboF%Uh!vvWwI|7%@eALC71T~pg9cC@L%$wmVniwDrb*L=tUI`f*ZCf_qI
zTp_~D4KQ=VmE~v!b1y3Wo;yg-&A0cMLT>y__g@=Ltf|8f9nk}N{SXd|=znNQ0_d6_
zKJs~C9==XlEuBxYo?N|L-+5UdEU3rp4bv8s%a*+LjP|(Ro;;;vuFoOvwCuV!c|h-9
z??CQTha2-0yG<dDhouc)_6=<33aV~QCp75CPUMS%2|pGRa-*O{^&3hOS&(pdt|;C(
zL$Chqj*;===Xc1)f@$}2329&8_+S?i8}kZ|nnFd<beCE`^1@D{^P{C?1pWF^chU5c
zK6>PbGn#h4enP~G;)3;$g9#)mo(xi(PWUb9U0PtXIz$CGhc%hb6y&%S^SjyUDReaG
zX=@SvDf(%ExN}p%f~WS#VFfk|-G(Ftq*I%cdQ*^TX<q8^G}R?@=Zxo8>D||@6elY6
z&f$4!ar#@9Qr_CBrl7zjuVlmGc0cb;T!sgv?@l+VCp~Q{RXdDEzldnv{vrILSt&(?
zNj<Q(DcL)`V8;tfA{IR^*z<A^5pNu$Gwa%7b(~g5os0J8rBmCMLfoWnLbI*Nm3FFc
z2ZKe{_r+vxsP6)~!umJb+}M_v>S9$=ufd}sETd{2A9OyFmx2jKjYUjD2lt|_)T*W6
z8SuDHV>rAjZu&a0IxD<!Wa=eIG#1k-4WVM=M!L13E15*UZ<wVrNtMv8ma>(Mk??>{
zY@FwD`_sR4+?woNQs1&$%ey%S!e6hdYTTBW5;sI4!b_vbUmGKwGr4Dod$U&L{=mg1
zeaY%*GNM^3f2EQIqtmC97*=m3TJ6(hpJwJYm4#34Gd>?*`Cio)<IX?xMN+hjUCD2J
z!jOjc%!M0<S#-3=jGPoD&B<5!oU9HR$hs1eA_{hFKOwWltWnHYBwBKq%@)Z*(TT7J
zBAG)bu!$BVoV>+yEJ%PT__0eCWN_=iy`JhXh0zaPY}H4O6j5c#Z&Gb@HnFajq&qU1
zZb=4<>Ug%@l1x?Y+~Vo=rBJO<)F%536{<H{-N9?6>JiLGfuY}*%~lW}(wnVOkdCAW
zD^`#<Nf#ctGJhrMM*It7mE;G}@!dSU(6ix`N(0j<!x~t$4VmouCM&_zoZ|IH7o#aw
zN9T<x?(TMK&?4Rgt6h6EnuMZttkQ-AI>z%Y#=6rCchgkOBj#XBe0omi=W|&3n_bIs
zzK<Rxz4gNVnl0XJU{-uoPn*PVUU6ClISZe(`)rmi8R|UF*6JXl&sE6Lw+c_#l6OeE
zitLarr>}+Vs!%ETaPq!bXd~#UWd<<`8z~!UPdW#hOv29JcE@;(S~*G__b75o)ELA0
zC@s!tVHc;y?I()I)l-=EMUnaX%fcP@<RKy3_=2qepf={k7!*U}yUL3(JE-}kohx~@
z80!Qp+5NofKP|?b^s#&~)}4HgWtcBp;7Iz3>W|q$N8%yIjAhpyNl!PWVC|BY0y~8Y
znpBfI$e+}}U&jW`WdTkkQgu(7gp@z~rQ`X*Q%`@(rzWSW5p0<g>C&d&R5j;8UPk|b
zW+yE)c0%N-7K0=s`aES<ok*W3%}>1VkErQ>gs<#W_PpErKSZ}}raxjho!r@8xQ^jy
zk<&~-roHk~$KZ{SD8uTb$+=5~brp+PoZS{Ou6~Rm-iu9iCS%z*E~H%4onx6Th>sPl
zf^+57>|hJhLo7PW9<?Aj;>KdOzGYM5v{ZJYCF$i_^i55ni;eooS$Pg)O5QPYl9_8O
z(#6Vrq0tw{v?5E1vw6<FwI0>gSk~cb-dgrRMcO%@M9)i4U#mKeX0|)MmbG>z8u#V5
z@|NIjvD0?2iD`=qJP3ah%&UNPZ~~j?N_<;P%J)lO9Aa{+_`)ys6n{C&Y3ByE-j)1S
zDoK-Z9<Ox`ScgODRMyIk^mUXJFz{%YH;Ki%kw`gGZ;q^NJj1YEn`oc&!NC-0*?{K<
zPnbt*(r1FAH5SB`H>&WUF;ZcvO64v(%#F9foJWWop%B3<1HXbVio}a72T`evsCjq_
zp2}rRcg?TAfv>9;*W18%acM_LS5H#Z(b%Oe*cp`Ke(SF&rK;km8F%3g>Qwu9DVkYV
z&C&yFm{%L(WqoEwy3tg%^E!)ZLt@3{JK63wWP(%Rl{irm<(KZFD7H6cjkwI*+mhDm
z<(K?2@M5zA3A==$4E-MG8SqxCrHdjG<7nV7Y;0TN<q$TOr+R80KSvGASw>r8=vcLU
zU0&wQRE^=5q56vbb67WP`6)LewdV(P=?YWU&XcG@)`*j=7oO0FLu1(c?a086H@WM5
z@hcpZ6{fA{QVkM9J^fxNFB$6JLMZ{fl#K`2^>##Kn>t9+YvVrV;7<H(l>?>gNd;`M
zJMni&=x5d}Aozu;vS=q;;7+{yDEmk<74`hZ9z5litb|xk%{HaEmUTP@uQ)210qtPe
za*4<4*0HPZq^)0LP2N&Ww=d!bE9?i&a<Rj4=GTx~(y2$YVJ`OewPfo9ZmZ&fx0t#;
z=_(G~#74CzLE@xGEVVu9<xpY#s(>mie?#?S9aGqu_M}YI{m53SNl5UVAN?|<GHdqo
zGIu`5YfaX9=KLm=dHQXxLtoJ<EM06$>evC4n!c?Sv+h8=qVgk>y+ipftGK8{lB*uA
zsN=hsZFmWv*P<rRoZ~}tZxf^*sNr!{Ba+RzVt<6efwQR&WRWO*%3gLLLwlNU_1?%k
zuj$9Q5QTO9Tb_Q8>*o1|AR|<vxN!%%>`;XzwMnTbTg@G_SeMThc#r_w1oQKAbesEZ
zj|Um!+IWDgrY(9;dO%smT4J;tN*6H?PZF)uJggs$ht-w3pKwYQqEO<!1as3Q)N;kt
zTInk6p?S3zqYgbKr{8*LP9I`Eu#9b7VRMpbrN?{xH9h`dQEuXs(w+K{(!x(izkn8Z
zi{g}ufZp$VT+>{QV!wD2m8R^rq(u8GP-2+E4=oLwV-aaqCFd53s;s!c{Jh92arhHf
z>_uEdl|Ps>t{idlqtayGlDZAyao?(%?Fuir{9N?Zw5X5Ew6;}QU?#BeoN5tZA-Jq{
z6~fliR>K8b^VEj(lQ`Dan`GOTRmwSi&5nAL>!QO|wn;-KiW~pNL?1Fr)NN*CeaIY(
z%8K>uln?1(QOUia558QPQ^Q92l0Ch4o`K$4g-4$GZO>Snyd`mO7&T`17NU0a%fz0>
ziz-uoQ{|X_!^|8mS2-t{g>)o|ew8}Bo;=3bT$0x-@-pF>oG=n!%En(|PAR_ef?;3r
zR1C~#=l#egrQriCpBekO6Pab3F!wxvcc)l)nbme8eQY&zr0anf7+#Q^9ixdsr#aIM
zi#*j9=%Cm#%~U(_2G*3gLT5;Tg=?>0b*qt|&}z*MXqGg@n`#eVYm(eDl}iq|%pUoZ
z9-+#~{5=O<iC@OJQodh1f@ifncWtbxcHyO_d*UadwzUoC{4%_2E~QE~NbuqNd5oK4
zHmfuFu!W%poxOO{RzA+mT|B?>347j|1dH(H0Rbdfz2ygUS;n|9E&)&5Amwx`n&&fV
zXW^m%Vohu{{mqj?@xafSI*4>>sd*tZm6_UGO1c4`5=i>lYI;c5y475C1lo5cn;S%?
z^ss$N?cm72L{;qUo;yePv~9$S)TZ{U$Xl2iP+aAl3^Y=NLU|qY+bwfNZlp5XF2rb^
z@G}nVibvG3-Cf8OJEh9pwThQNNn#JXk{~vsE3vcHU<=EY4t&U_b|wAn!kne+iu<zE
z_gpH$L5iJoht)#LHq}nLcDz~GqZ^i|<X4sxOu}4JYo%&9o=ElyeHb^UR%}Z<{NmN^
zwVG=RBoWgw=TZyb(1$C+<L+9uY_dz)&vFJw*_iHdAj*5v_431PS$DF)Hm6Fu4&0a9
zq6Z<ZN4%&Wq<Bm%Q!s~Wu%JE=-0TH6%Fb#Q(33<s+&YPu(M9>5jVz@n32>cbsvfMk
zmuF}yGob|2c`+YQJxLGO<@fNG!A&W*4PC2SDsJ-p94|80USzjR&c0K8@-GhLZz$Bo
zjg~6txu!SiB~D6ZeR`9}wwgGzaq=5~Wxe{4SO>==@UBA?mfXyy-Gw=QNCau63HLPe
zx8$Waj6BtNJw1QmcWiur@|JUP#pXPN!6wQOcT{0%Dqg;Z&FV)kw<_!MpKrNwM80Lt
z^4D((Okzj-la=D~J#5SXGRDbqCwz36!q)s1Oi=q|_RRn+%x+NjcmVMYsr1WBQ?2HM
z#oMR4-0G>R>UtqxG36N88Vt$QGH(?^7o}2zst2h*fXm=}m*VA{vHX~*c+9ezlNKy-
zAPEZ#>HzN(ipfBc@*C=#zcCM0{LL@jV8u^k`9`0`o9CiZo?5in>|^oqlvF_3FdiFt
zj@1n${(h-ZW;+H2Ir%Mx*Yf2jc<-J+GLuBJY~+!dIgo8YxO8bF8yQ0S*o6(m+TbN}
z2#RGagmku3_HT-)Vih4I&?cb|z6CL-TMZ)J>=H~(>3W9Ou-dn)T7cEg5QS|5=ETF4
zo8VUJ>{RKVVwN<B1bT=0NtYop$+_u5b&}ORexM@TM^4kTi-Sl<bxtQP%8P)}hT0VR
zrJwz}+R7FmZa@d)#scO(n6w%;)Jd+5lM1zQX|~k25JMbmsh4D{*)JK3cITy64^doA
z3Y&;6GVaZ<sQvWZE$A3f|55$;v<Im(rT8E{OBzhx5i5#V?O@^?Cj1pmVJjKjumW>+
z{)h|cic!*gZjE1{PlPJ0`MI%+T}mBW4`XK7y0Om?E*W}L1ta63-c2@f2o_C&H?VE4
z%gf|Fz_dRvZK7et@i>FMxd*TN*;KWxR_Za=Q>X9+YmhO>yb>_#ve`F7uw~s+#_kUx
zt^*Xu_x5XgafX;5g760*Nm|K*2`AuK^Cx|0UXECs9jm$LB^>3|9`P+397+~g-#Wyv
zHlAf=p=3nMpb;Bf>@4qNRf=r<((%->c-e90rzK%_#aI&Lr9)U<%s$bQj;%rlV*(6U
zv}Wk-)DZtG&u7k;?4Xuxj;X>&JboEmxT;Uy5)1E=o0n3f(qz5(=Sm`u2kI;|B{zRE
zccKuC8c(msH(zW2`#7P%ptZ6!1qp=h2qWpu&FYt>ALczl?Ltgy9I1zs8J;;8q{BD8
z$}h7zTJb#3@G75#U0jPSb}^jvbttRg#d)e9-@=*qOy(Xz{9|sNc@>wKP(4a<$uG0!
zkW?w}N@*x>IgKNi6E5~aM_wEn<g6^?Zv$c@ZQvE(vH)i0?>CsQN<U@mBgk;^_}|z)
z<Zc}wfK=naC(J#Pw6-oQF&hc%gGkcd>bM|ydOusw7DQsb7UjxMY&<>g;fo*czjhYE
zAA~8eTyjx{@=sfXf*kTvhT-@$v|d%p{Y#D3?CGjz7mhA;{&A6>I4jGg2Vr;!_MN~V
zhZu0o4_Q0}2t&d8_I356<u=&I6>)ruz7eJnNjPQUQKU`SHV04Ny8`wHf+TjUpnfzL
z41A=r!HUafn|)l2!jgYvvGn+vA%tgYoV2`Im}D)3E$Ui%y^d{-B2$`sS!Rc%A2;yt
zBOd4CRCmq^)^;fAr&Q#cDi=Or6Ni#kB$mB5l=!$7&+hz#lts;#vcb2&;H%i4p(L)$
z@#^L_4R{aQ+|5ciO9EP>Nv+HLVXqXsWs?+Jv(BV$zl23ZlgwGR_auXIV+JmVF{55L
zrt$5(lo|MNs>zt~o{}*iq`p@u4JE-zS-vkt5l)ql8}MDhSeu&U@W&0F`p1I2mcmk)
zp$Tz7`X&n*Mq2rLcNoBpeA2n*)sq8BKdn*H&#=a%-ua9z97eoEpC8!fVZ^s>@lgI@
zu6YQ3CP{5sX;P2C_ryCtV|Rv;C|If6aMF2@ey}3^d@2d!ljh$Xv1t#A9pwFDML3Tg
zCdWQTtPs+%o?7XZJihm9@p|^faN-gb(!br4*Ke7MqfVh;$D*dQ=?!6ughG4;)>C1D
zue>TwHaVE4bc0sXvUCY+7*0l8eGb)^IV@r0N07&2t_O>WA%3KmeG)@Dbx-78WC=R2
zQ(`NN?e;=Ws<cx|cy~$~cLI4!MjDdyq6O6Vy9byEA&H^-eGKvRy`8&uNVUr9KIQ}S
z_C8_u1HMC2$BxJT$Q3VPNXH^unC1<VYFG9X#*TV6GKyt|Z;*CFwOt@=9C0^qY4sb5
z`{qxtokA8gX%i#nWk}g7gQU;0tL8#dtGFh+4s(%Z_PoF<)_x@E-%Qzwm+z^b`V!}i
zY{p2^ty!7R>rvZAk`*3XqD+<LPr3JI$O30Ck+Sv`lJ@EzY{HwQtxc-Cbd8DdO-wSg
zpBC1>NhVl|rbBG_SfUZ<e9hh;OA^H6&)Icc2RE$B#H*TJw$9VwlNht3@ouL=h}U-?
znVdEr{b=;x@6k*_Sm^W`hiBbEJ1I*585mTN#lI(fC%pQ-XV0TB$-Sf9(!Ku=zk25%
z*oF^AOv`xcjPUCBpFQQNGql^fd!PH&+jyWmQXQAF%5kKP1rEB|gK?xCNIG*EZzgFh
zKq3Y<Tq4PAwnUQHvhl=S9N5Tqn8SKjZVrEA56s~U=I|Gu{)`2f!zXOGIsBE)Hir+{
zGIMBRJIvuPtlS*_%pRD-yUbw%zyCH1Fo!j4xH+t5v(4d;Y}o`j+KcJC;4OY&r+B39
zdv?zpUSYOx^Xu=JpE<n9qRip9Y^FIp$1==e1<NysXW1!pc$(cahbNisM1DW!M{`)p
zqRinjHq#s)VHxJIh~=5XL+q3}{F>b}hX<JLB%&546*7Mw4&2Lz^RRsZOGN0^n9m!e
zBX5wkyg@o@zY3}r6l>8W`EzQE@SWL>9c&N3qi8$3#KVnw?D-@dc~08O+QuSmpTk0U
zc;jzuDi1e)!4}7ozRfBhtjaUYsclS#v)sTcV@W4f<?PiwN~bqf?pVfIMWd<GVHs;a
zne^^kIegVChxV!m)~r*#$9v$GcW~-=h)aAln!kIZ2&?}5c->@VP`-?%P9|Yu_-Cwq
zGVyP5TS3?O2tAnVkd~*}Q@GBYFvc9FkRC0<$$w1AS;@vuAydR<kJ&d<$k7(LzqsIg
zJ$^WS;F#*RfP-Qy9a|YkhUkdGRr1*U{g0><BTED)*J1pH8Mk9?BTJ8Eho1ZSTIhx)
zSAMqGW=UK=`bdatWn*oa7B}yib=)!=hgBiw2Nc;)m8yHFj_s-U_&Lws<8i6M#B)=y
zh395Vky&9dr&(RRc0po3m$EN+tgz7F5yn0puZOa#qtWtMc68jl7nau|PO%KDeb7{4
z(=F||Q1gs`%=T)0dYC_TybyA6`GzH1zI$)<4}~}pFP?qYQ=KPhPp*xgT$mZUqJ|Y>
zb+E~5e`e^l(6tdKLJIJ*S)AiVWr1?95Vz<%Wlw$puk0--bO~?(_l7;pj5rZ$j^NjK
zBVS~PsP>wd3A@^!GZhcG^|}H?ItMV<_g(_8ui;m&L_jH5qGjpYXi`+D6!c4#iiCr!
zk>AZ>SCR@}#bBOunp8dRhwgZ}q?P(eyTYb3C@hL@aeL%UVN>HV$)!zV8Syx-n>K-c
z6HofInsnJO-R5pK-ZJK@8UDsqyMBS$Cy>@+?r7$lK*rnpyus^^hoMJVW&*l(+Hkfb
z0XwX)L+n-p8S6U}A8+ux<F%dv7he9&anEy8?T)XLy=<{Sv3!{nDIfRZL$7JL>*Ox>
zIX*Zaspw~_UAA{$jAqoDQOa>oBNL)7MaA<eTq^6!Bs|Prb?ox7lSNX@@jTDXKEyMp
zC$Z=lB}m7E>D%@eH9La03i*M24;C<;bnuial7#cyo3925H%F6TcvrKaomminhoE@b
zS@!vKGC)l8XV<5bwqmXytD8<*``z~Sbb2QI{;bCQpcs3}E#|s@#QQu}iyHKlV=QC_
zQCVayPh#U|kcrB&y(ayn-`L?9WU4Y@he==bnEB2mbH$uomOT@bNy6sBl9{B4SiO&|
zl*+}08M6rf981yK!q49!u0%Y1sc`>n(wc}3CG5f+>@OOQFv~>pzPRvU;etfc3r}Hl
z*uHm(zc?|I-Fz20Zv48?elD3xnl~)|DcunL(V^-L`$ssY%Afs+Et-b|&w-{w<$Tfu
zg?!Hjyhmo*H~!$4t~iMePyX-<w&y)`joCl3tM8GwEcB)n7W_UrES6WY$M2H~V*6j&
z$PX~`ca*SwAHc!xILa=4fR>zen>l<)<_8shgGH!q{ae-Tp5PswlKL@lj#!8$R^;GA
z{FYCw6+@Fd@>q?b9I<n@u-zY$vGxI9MM;~_{2e=3tB*)$i~N8!EbJqa@6i5R?3^PM
z&3Pu1mQ&j&t(p7BWTRQ2_+zqJ9QcwYd;$krv5jSXLbAk)Us&4(<WlR6Muqu!tee$3
zA@0s?k-KSpQfr)OV)mbss2)W}I+P~+rPRkUKLuYZyI*+qbQW8y#7S%0neUIg{g%ZT
zXlF7myiK&y34rlaRDED3EB=(kh`QUX`9c!by74D$GqLaIXL8k-tQtrde>uz)d*cwB
zyO8v8O6$WN<mzK8EdMQhZkMxf7Lp*Rv>tyKdy3T|wgtXYk)3g~W9*W7(3Y_f9Z~Dv
zJMz)H9v3v{m6xI_hnJ5$Gv<`wYSB?47^d;}YP)@O7oUyAx!c%|)y52>t$c*I>6dIj
zRlQKf-Mnqfu3&Ja&nV_Tb=$GzEjD=nlJ6xfG`Bi-G^QNA78<wknV21V5H4~zcac^F
zsfDtOlph}I%uf%0e|BhWz$eSwgf1tqg`WNGOh}=vpm(titvAeAYHKJhFnA9-kH=|o
zza9__@ry&ER-0-a`128A#Jb_@v@gztRL?n3CoNdL@hE0^717SXS@k&csk!tw60oqv
zmk)f$grnoVYs1-8J?SHc?P5kf9_eVlWMUFI)LC%M&P#Etkyq$XkkxTM-Zcj4vp+c#
z)Rd-%J!SWk&|%9SF+6K)$$Bp$H4a0cm>&(|T)@IF>LK$_hR1U}z#@`KOv|FG&L{Iy
z2>xgZ4wLIi82YVoIr}P^xQS_3*okER+~WsUmy9#G!zDPd^h%2CU^E#UjunnfAwP+l
z#+=?~{nAOe=C%7P*5;)&yNd&(dKJU4x4QiW8=ppe#iGqDC5?P6x~H#Mj0NWBi`ewV
zq*9#yg!M@$W0Vg}aiYB~8<0-guwBSfoPD?OWjawR3-uYqRa}#WECiv@FN?fy6JY$J
zp^;<y7Afq9a3!us${|mym1SzbVCCz`OWnlX4UNV55*F`mXj}v=0Nw`@ftkQmU?MOU
z7zsoJVL%Ab2M7iN0AIiZXbZFgoB&(E5@^`d(D)p91l$L10abe%biWtgq{RPjsC!lW
z|J{P+a&@xl|1E{1Y#lH7D%#=#P!5~`jso8R`+$5P57-QR4y*-M0+~Q6pa(t%<^!{V
z>A)0V0x$-M0iu9VU;xky=nD7)8s7eDkk&v8zyYuZM4+yqq46nD3)};40@s1dz<J;d
zPzDqO2Z24n4qz*=3CIT409il=kOC|OJ_P0hvw(yGw0|tfcwiJT9Ebo01O0#=KoH;u
zcmeK!E6^OU2b6#S{Fj^W{}=85U)KJ=-+BKW|No87^WQhWH2(i=|9_hW{v7}RHq)C&
z&!6-E|9}(uZ#3bb{{K(^|L?TGpX2|}@&E6%!2ebA|4W<|JO&;BcYvROYrrL-5;z5v
z0EdD7z;0kWkOLTj^}s4%8L${wv>W@s1t9MOiNH)?Dlifl3oOII!5JJ_gcz~cLs$$P
z1oi+sfUUqLARAZ%WC0mK3a}9P5SR<h0uq2&U_3Ai7!E{yf$={Wq#w`&2m<^7FTfpe
z1$g2AGU)!5ng4;jb^o%O{ei+!w(bv^wz=F4_6U`L0K7y2kAVlk9pES68gL1y1Wo}Z
zz+qrNup8J8<N!usJ+R7%_Fo3F7+3@>0Nw`@ftkQmU?Q++GY%j&N!Xr?OaLRW9#{n|
z0~P~|fCa$&Kq4>`m<mh;#sVXOXdny-0s83h6AT0ZzJLeN7H9=H0k(i8&{X*Ubg28E
z&hVeiPxmjY*&kB`?f=IFae|qH6HMR{a38n@Q~_6k3qUz=0yqkM1MCCxfjnR{@Hwy+
zSP5hTseoRGpO1n0z-(YTFa?+Zi~(YRC?FIV0Q3U70{(yoPy?-j7Jvg_4TwM;j(nd2
zwZJ{#CU70N44enf0A+x#7(WMrJ-`lNE3gU32G#&sKn9QkECfCT<^r>T1Rxd|4~zna
z0};SrfS*100D=HNzzg^Xmj1t}{r`dX|ENa)T%1mJD*uwq|3Kcle^<eBxqr6*KO7eS
zTqpVi?fn1L%zw83|C*`)VH5m0{{Nv_{u@2|pUdx`nE(H|jQ`-U{<Ho6C1(A@{pZj2
z|HG#GgFX76%kR(m|6gL(KRl`ZIsgA*Q~gm#<&K?>E6^OU2b6#Syu=y8W8eXB2lxrN
zro+!Apb|I*lmLf;{lIQuJCFkyf%U*DU>UF&cpq2*?8f;(EyY2@O6>Iz-UO}#mx1%Z
z8K4X(1`YyyfE~bAK(`4$*}xhg3&;RcfQ7(^z+7M!kO0I2<AG7Ya3BI04D<td;r|8b
z{wp{A58ea+|6kDhf9@XLf6Z+FP=OwDGXx>@1H1rtz!hi?*aJ#H0A8Zp$3Wx*{M-S4
z0<Hm<fJ)#LPy!qV_5-_t?LZD-1l9wqfMvj9U=b@VCi8Tb*(ehT0TO^rVB}}$iva!*
zZlgc&7;#PrH9%LO7cg=o&OLznz$#!5;12WxLNTR`2c`mZfscVrKsmrqgc}h0&VFy!
ztd0UJJVHLwUEPkp`~QOfuk`<TZ{}D3IltHAHvfIPN8|2)P`J3`RVKR&&mARiTD5yw
ziy8oa4^dNqUuzKVK^Rpy=oDUh^<LGcv2ii57C0=2JnnU@EmV{f6>*t|KW{%RamJj^
zadT$RpF3yPtoXTwZ&i>(%0BrYH#QywN`P|UGVl{{A9xA~pENew0xbY{z!zx#VPoUb
z57_WaM5A+0YHXaaxUn$|@BkXp8XK<y`+$`|A}}2A2W){msf~?gz-Ax?m<ogfUVtTV
z(*Rw7%|Hq;6$k~q088Lz3ethiKuSuZt}##F_-};n-&r`y*8N*+-`J?*=C1|Dqdg)3
zU%(o;lib*N0@w;H2BrfMfG=PT+*yQlU@I^a{boAC2*4Mx2JWC=odC81Q<2|Hgwa3%
zuo&qA50e@#8qezsA6+KiRt)dG`Z84&>Ho&du7bWbdVF(%2>lS=?<VL|<m-<ST89gI
z1cDRN_aMA)C+e*cIt$jqKD;&iyyR87orNG6*_J92NEWk;JlM|^Ka%B>r$>tV7Ur9p
z36uyzDhf%!H7~RjVPdeLpCw;ELZ-n`YLtBaBjj5^ey)7&g!HvHUKNUukcD3C$&X}`
zZWW60$ECB-Ot5qk^-xDJUJ~@yGWWL;_4YDvp%nE_GCw0gJ(=_RyUIKW@oi<!?Vy%<
zFGo@D)g%vl_)1)7u7`h<5N-~V`C`;3SmyhodoP)DyY!QJiCWZ$$h;2shRQrk6!j4@
z=ZzIDb8f?!CK-jOALXQzYK*`7rXMROaKlZIc|T+tEAvcfJyqu1nA2sx09KhLb8gK<
zneWHF^JTsV{6m=wC~JYty>v*>%NO{YZ~7FO^DeSj=2f<$K2zpSmZCmO=DfvM$=t{-
zgj)0FvmPYq`^kLq5J4Xz^AK?S1wFG&`CvgG0j}dWypJ2A<%DeTu`)jjK0)SFaYL-k
z!@#G?d^<9oE^{^FXEn(SM4u@0R^anxp65XHAIf~O19?ZkK)$F&VS1U5EX9D5c@X$w
znFm8Avq=VgPcx}DHxZV|d|x!tpOE<_@G6<>-ynJx`xBYa<r_aizZSOURWAqsM&>8F
z3;JT2uLLiV`TOjbpGccEHN;gH1M~CSgbA>c%&Y!_TFbmG;^)h}7x-eCTTT@8Su(%%
zwxGwSWafN6NBnk~tHFz9K4p@iKOysjh`%Orov;uIH|2z*;Ll|q8jI159?g|&0p3F9
z{U!_gwlbfN_#m0zLVPcoj|GpGdFB*&5t-YAPnY>_@I*xisQ~vlG>@EcVk(+M=GjvP
zw)_rpn`Fe0;F@ejxLM}QPN7ONuS9r8=H-a5lKCBkH)ZZ{8nu(TU?uA7WS)6iU<2=w
zmbx<#@I?YIC<vjy%<a#hYs)+aVYJMn5g#k_=?JIFd_Ce9%RCEVrp#|4zF6k!vrt~<
zG2r*DM4h={O}U_dEGLWvceR!j`UyN#=1!HcugpWi6J>r7{KF=B@NAi9okItac`^72
znO{9G=qqI&@~sX9%NMgQ2>Lpi8^P7^+1x5l7X`hS%)5g7%KRqybeXTYjNU7A^%W>2
zb3MWZGT#cBe3@UpiebljTNIG^J=#uA*oTChGLL3o-6twt2J(9@M>)ZX)ybU4t8vYB
z^hM|;^EJq>m&`*D_LF&wYcQJ3`+(1vc{I3Q=8F-g$UG78`)$SM<^uNP;u|@kjIH<u
zdR;)&eL1QQVXe&dgy<j3d@i^@JU-X4AHpD+Ct47Fu*~~_r^wvh2J!ZiJP&)l#wW;p
zQy9_5+RHuXQUuY@k`wkIOqBVoaH8)g`>fC?q7RYz+@VAtE%VI?V`RP%GOi9%!P_Sh
zeOsA(#S*<*=2sCPA@k5U9Ws(H*2WS1_p#E=3E=Z(erqbxFOYczxKZX~z&Fc$DtM*L
z*C!DD1)1l83z+S><uVo!y`{`gf%|ff4`qdZ3t?V4;bZV1ne#CCH69}K2!x?BpP5AT
zV`UzTaDvR02BPOPKQDMbthq|&CE#miJ_=Uz$d)ho^kJ0wWrUk$e!_yasv#?FvzmNd
z2^)Eb1axgthVdl3p^=k`euB(rA&iyzrsJ3!Wo|u{`Q0V6S?$kc6x;s`@$#^jdrMn{
zPBO1TPirCbY+IJ|fCT7fITC%g9B2C}(Vvm|HH4Kie+rokGQSKH-k14fgtanvLe=>-
zH;DlLT;}tgiM~$eW1AB_m*X;R5w@@w$4fSZkgJ@K;6n6#3CD$aoAi@8Z-*1I*~Wwk
z`ZF>=uNCy%q+H(GLe$@vc?x^yCQ-Q+M_~R$G*5QIDsh6$HEaWtn>|HTi5#V8M-ZiZ
zfIIHUQB#q8U*<i)pUXUYJ<+d{+pOvUCi&NR_G{cI^R@@!XkUxp`WoN<8qZhAW0q&S
z=e30WukmkQ<HfJ>lGpf&*Z7&&c;##S!fX8U?;PI#+V2-|y07t@ukkyt@%yjw+SmBw
z*ZA|-c-?DUkb5w%uqEeyXsG!xm-TB2_OEfLSDfYEA*1d1nBc9u{}f?6?-K7oKIij@
z+S5eO=XuVBGjJ91>}e0~Ds!(hgne?4xY_afn+r}rM8!Sgt>P0jk5~n1K1FeU6NxwO
z6Spuvmo#O|=MT<f&JsPJ8#s>zuax;2aPIqge6Mo2&8E>%&L%#<XP;^d_R|A0M#o1S
zmw65uK7u$8s(`%AL%_XcJ^`FN9xk&Pp<d=?@cWBpUJLi0-NX^k<;*%<AbLIxaK8Op
zqUTNvTqisRIU^?o!`Jg`E;JuE)X6*r+)|zoR)O2gd@DHjcw9aO;RKn_Mn2PJ?tyuQ
zr*Rqki$tF(^S0otnrWqkAYAZChYLl6-;{X@ICsrFzV0$+H<?>sK>;#vdxfwLqL@}#
z`Iy+)t#%O~60uN0#GZDA6YRwh3+GYSi2g}K<D6bU5WNB!1+lLj#Xu+D=7M0ul>&Zi
WY@EX;D@1p`3vWd}WF4Huo&N`wLq4?t

diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index 1b831b412ca9ff7aac9b036db64b66caea1b2942..5d4e812819ea3721f52612281e72981b07fa22b2 100644
GIT binary patch
delta 26998
zcmc({eO!#$|37}6tFD=v?k1(Fq((KBqy`~vOK6JLO>41OON?^6WU-4ylbT7n%N`sz
zt!Ax4YZ;QkvSq2{u2}bLiBwo?vg=;z_d0W3EoML8$M4U#$K!O(c|Bj}bzbM3*Lj`S
zb<Vkz9<<RMvdLM<9$&m>k&cbG$JQvBjg}S7Km)8;c|y?v>s`pRw6hDtFtg<HPW-bb
zlz%36!;3`2B$_A}E`c*e%iZu*Q4cmJ8B4|CY-19R6?dId9d{(9Fe7*J#^Xy#ho|{3
z;<f4FS=J_L!W4%$@miC<bf&}03tIS<lHkBS?VvJAQ&LDrmcdyAwSN0|GPM$}ky53z
z{0>6Sifc?aW-(ms1??%aK^?E<#2ac&`h);nBlfh{bgOme9)hsMYAF`k`1_ZpsES=U
zB`6oo6h-Qp!Ns-9BoDe9Wo=o;g{xa^iZ%?xLu@?V44=%Aex#hEh<=O|ro;sM3!s{k
z!Aoqyy`&zsUR=$_6Gu{Vr>9jcCADq2nlu$uqDc(E=WIgV8$Yj=aW~8)xn^#yGk1eF
zr+OH6we|OxiXfv`Mp1q_Q|rQArJ!_Ztv7es+-`kNA3WC9vnw-JrbVEXc7`c2`ZF!9
zfJuo6*4dsV>kxyr+Uq>dEe3qFNzXXp9k$-7%%{+Y_GWf@PQqJu?($pq(%~k(M#A&x
zliu=_{l@c@Eixr)hMDxyHvCBFKYq)jJ^xltbOKaM+moV<7C5j<;v|v}G3jfp@ED12
zs{SLBJ`q8;e)?8K-6>u~(h^gmexNBQB^69Sq+O=oV(pzCnPshBE{Ve0Y=-C30#|gL
zi=Fj9E+WQer1m=WLqh0vEsy2{ny5<8mvBNp74k7ACdZ~wt7f^>2pM#i3#ZbU5}E!c
zxjw;6?qNMUK*uBbfF$;X^cf%w7tT}5(ttnOq?dnTrgr72NlQWD-X^I*YNjfADwhrl
zewe1>z$&X}0^-Pp2>j`wjsAl)6#_^}McH$~LIqHWi8RS;I5Ra!D3AgC5hkTR)JzQ!
zDggV9?wQ`*mJ#wg$oEL^o+ae9nLE?cz)G3!z=H(&%OD?~-lwN6ddtXVf47onP3#I(
zfmN{_THhr-+?EBa@Gs1U0rL)CzEcC^?|~!i<*7BDVG@QFX27Hi(<WzaX{WPhv`KtD
zidCk>nog!@sVm^oIj-$Q9J5(#EofGj16l+N<2VSk?wH;aMtb?i2EMdvjVV$2dFw3G
z$5FH}L%UqPPV8t>=0p`{t4Hcn+g#A{>~$bcuE5$1LG!vb*xLFZP{5CxM!dEFEYT2D
zAaHZvLWRD((Ey@s{Gb&{0z@x=TP8u-ij)Du_?Ru)b~DGBo000mC1EJgo{|%63kC6t
zwa{%|l$P@^D;U~35YUcN4OXoJz_9>T?;%?crYH&^#5{lV3FS&$<itp=v~j!xN(%5h
z@{&o5F-4ayB<)xx{pZtlF8Go|pj+ZX#Q~_<>=BY+dg|N2ycvMoIO^CMTfE89i)C!^
zK}SDy7T<9E0RQgT9)~;i^DS)~0MkW3jQ-V(Pw#0f%Kdr`cwWfs_1#T5QYGHt<i$o0
z!Uvq9*=Se%!YPQ2mSA6L^f0+-!g)+2EdKopl6iuEloU2?&Xh10Hp`$ktEe;k{Gy&b
z!5m{VL~BaWcwlj(xG+OqyWQR|!upAeU89wD@Wvfh-7}sRX?KAOsQCczmqxMCO8mEU
z466yoL!1-Yl-WfF=K+Xi+7`WP<B8bPjzw;+XArCJhVQnOvpGRn<QC4B`r#<IC2Xl3
zKH?V7YMil+EZRMK`u&p4nHO7T$JNew{;HjwUDq)%%1mdRD05{sQ}9=^7`8eQACX;P
zHPe2`aYt<96#T76Im;}@V>~CZDK5Cwa{ycISR`o&U}7Tn_Zr0-!tfHWDQry&zUQT3
zqiu_(wco@#8jxDd1zB~seh!2F6>cNX=_>DDxKh1%7n5Xk(Y0rw8`xwmj9a(Dm9^7%
zy>KC&nUQ2v|JpX&Tliwp)9^+4aF&tc;0~*3iw<{~#4?Fk?wi=Ax~J{WTv9uZGo+~$
z-<jmqJ&L~d&4yl(V{iW@Zu-vJIQ8Z2%u?BH*_<44R~Ws-#1OpCe^NWq!}uCTT9|RH
zPG$>3WSeyX2AM4+Yt=h(7sY6>U8b!`!^|$!b+4Qg82y-{?#F&vyR2q`(KZQ|tXX`y
z%1Xb8olJ*HSXvpmlb>=Y+xF~{Nm&&~<{X(W7)*jRwVk*-<0rq*U@^lYh5Bv-OXUq#
z`1$W-3!u)*>*;}6?1v>*;D<o=3>O<ter#pQyb(w7Q-#7l>qJ@%`4bke<<s>zARxkR
z{F}new7?76A==u1GT&H5*>R>CpC&vvU|3}QdKpL8WYtTPJZFm4;cVvi25xeZcoW0Z
z%bu&hc+UFmf5n*O2~%rrC9eo{07MA~z76z8N~{R<al88%dP**x5TGS@5tF|E?n;xq
zabnS!z!xl=y#Nmn9>Z45!G_>a_EZY437(G<@#s$NksN>BsgrkN!h&mQDi~9Z)DBu@
zv*u6uT@!Yo0RB2X#HF2r+!Q<dqNSR?&c1gU8;>#~hWaxb3UG5LZ|{a}8`RDXvMVs-
z#etu1sP&yhSt(1pG4KZ*88RHYVReXt{bDmd5Tb;d8$x`h$-AoCj<9tRne7Q28kqBp
z;FYzFJDXh=MKNn)C+h08!@$aFhJSd>IW|oN2CtC^_o__qnek$b)-P(gm0$R4)-PhS
zl}S_jRl3oEN$+lFJx-hZ^->a?)xHwNt}&OX3BW0xyP_QYL+74sRu;a|d6YvEk<Ft^
zWzt$xv>x{j4P*;7cv|R0wqYSY7aGE5evO+#Ln5}%J4}|T-?n>BAQMiWL+={Ja{&<=
z%J<1XfXM)}>KXSXP7L$3-(#GkV8Yj^ObLx*tPAsI8)o2wuqY(OwP79H>XP4zh3<rc
zICFav_Ebi&Vl^JF?BSF>&M%^n@i?nh!N4Zy@kV7QwqXn|SH`ldw_wLEW7w(<cv_cn
zY}L2;R2L<?XEko>5`t22$FA+6lDMuutZ5mZ($(7|XISk6|CX&O?A$w(`c2(Bm7S)V
zuv7!S9OrfYfZdaZZ*&bs3D~Zik8O4QCF4ly`f;~zfo#c3Jhq!03~X^X4_j%!zl<;*
zv{bit&bFOlHZa&a<3)kC_c~L89G~visZGj+&DI>um_{*q0Nr%>)O>6cE_coOx}DCI
zVcpQTf(Mm1F2GUYQO-L%6lMf(^w66c`}_?SAeG{*@DJIKyzt5JP?=$RR$O70ntRGx
z6)$JBs<eS))=?IR?mq3RXV;GAn!qF)Tk1#ZV9iXT!^s7ilm;BvJrz{0=pKj+*wlS-
ze0{E|dOUvHeA@V4Dwuo~_e;P9)Z~>{mUN`~^83avG+$O}>`U`yUz7}_`4fXnKBoB-
z_&^W;ZsONolhv!l_BQGTmG-mlSCY%n(t?7uF5*Tj_4F%}0^(;7Ggzdt>JVG7E?^x*
z3fQ4%2e$GlR`v{VRs96o><G?M58zk=Q^s%S_7!+qPd&^;yNF(3rmBcfVfem_$bz8^
z?6uLmI*BX$r=uZ!POv^)-QSk|DNcPmP%N8FXIp~=-|XcDg<kgxY@@3iy~Bk&)Y7fH
zp0VXjHGNj#@W^ns;0m4=DVL=5CCOl9I?*3^ZKOOk`GyPESURT@#QdFtGYNDb)+$=Y
z==hG*-Y_YnV@774(v8vaSkfCFsRKmc&xO-iLu5Kk-IfctGG<8A4_HfEIm=%0oT?g_
z(a}~1t<i=_1hmDOfp>Tn0`81S6~uBcgbHs%g&zVlyI}^;+#oR5-)R-Bddl;b-83mR
zkyZyYtPds%f^Q3gZ@2Pl|K@o)P`9)v@Nx&I@Vt|6QC>OLCEsdgE;9)lUjvQ11GDI0
z3U2<uBlRyqxyztjSD=dz&KH#Xov*O|_f{FI2ZD0HfpTHMYjd?#x$A;**IRkD4T5s#
zLAem%wY}P^+*O`8`6}ggr-M><S5WR8C>IROlB+3rca%r!9YML%pj;r(?XI>ecTrI8
zVrzw}TY_>YK{<cmwSUp7+;4(%zqRseZwShjgK`~!*WpF0a_0r*&c9XenxNcqP|gR2
z&uYV5Jnln})GLB=rJ$S_&>c4{5_;~epxoKk3RM>c<&J`K9>DALVy-Z(X9VTWwDQ6W
z89&i~2IbsdEaLHkQ~%;sJf6y(0tQ!8VorR4ZkX<zmin~n4|w+S9|rDyOKqIUQ<Jw9
z?=9f@LIu7pI}d^DtseRi-osCzy{5*hP2lBU*M2MhC2Oy#+EjkF#Ed`q;*y}q5BZ0N
zWuDWGX(yO>emSp?Vy8)2W2b^bdyeBty#tio(*L^u3e5&Js^AyT*0n{}Kv$H&RD8I1
zJUewE7WGMC2hPFs`z&G`rsHRQlx)Qm92D*CUy*EeP|R$YoZfR8x0Gy6WX)?ZE$$)~
zCwZx}s&c=<Inmzi_K7$<+MkU}#D?e)cJk-=W^|~FKFp)cl%wg<TF#`2#y)*zHWfQ}
zd}FFfY>#{Qbx*C>zU>=mZw<q!2XPEBy9{nUPz+34^(c-(sym7OCT*R>fq#YY9cGz}
zNVk^ahLGBRTyvo|EtaPiP^#XLvfz@bCbi(U5jp$b3%DC!BYMb4W%r?+t?f{{ycA|^
ztjPU3tAf7OEyb7mdbq`HG3&tGb^r+sngxHW6F$e*{X#z$5Aag2tjL}7-EsTLO9@ql
zD&iNut=W_#kK}uzLgl4~Aiep13&oL&auDdF^zDJFjkQQ+4sdEj5aO6h6LES!1*=?$
z3;Tups+Pj?q_18KEpH=(sLtwxAGPT{?Lb2U`lcTmnEh>kFGr?}n&YIDg0pr;;Nbqg
z!|K0*f(8w|q1#rvh#IYAWzalM+i0p8T9s~ux7^c^x3e>)oz9)SroyTi8cO`af3zke
z=;YVVr`1a5z#FoPqcM_RuEbmVySwH{+TTtO%y?A*yGQCruNhNK0*g=e_w?3;7G~6b
z!ZmFcOVDOwWa71cK_78`A+N20r9Wn4!rNB{S{=4!YTHR36=<>O#4FiII#Tu1srVfH
zNsM1u#k?Kg@YI5-q>d`0h%q%v+c}p}13@ZkyL?0PADa@TI6vltY5BduXha@$ybUZE
zLAy3h1v?K=-i0fRf*=hA=zdZO`452GE<i^vLGKkOsd;Krq)DT(x2-cVjA#y%Acc3@
z;k<27%Yc{e(!7mrD{*OzD;}q^_vLy3JI7bZk0qExY2G!SLKVO{s&Q=IW!$KWut}=h
zonflZyMvXnzM``Grp6R!JSx_gJ)yvhVuKYq12NYq5w!C&85$$43Nq|B#uC2$p|Im&
zsK%#bef&;z+88UVr+rosT%e_NWv{nolf0oUc8KfFY6EdhTqqmohUdnmuz?@o`nVvL
zyMUzws@aB4MRx{>kfd(C3<eqkQFr|Jz(H)L2ab*pVjJS|w0JKGw~7Zjm!h2bMON%~
zcQY!E#}PxkB#L1?s<>P<Zpch=(7OS;?<8V`(89RA;H{e>2Vfv|<t_Nhh~8}ZYaBi@
zhMoKzFC5vMP5uWT9{H;z|F|Hr6ze_>L3?n~rz+|Fp43dgJ55f&NbR@ok8MW9N0}bK
zHG~Bt-p(3XF>OrUO;h9e>#e?|ud}atM)6pF4PG@Wf{ioalcR>PVn6IYdH^cH6GnIM
zo$1%t=oe-E!cS@a$}b#Jg!L;@0ks+%e7-Y+KM+~LmWdgOdIDT`-{GhTz!yjRvy<KN
zD|m?8V)+>Pu*tG(N3;HFtv_UD&@_|5N7Jg;|Dkso=zX{q-x#NUXcSTNi?5M=3hfe4
zUWdOOGoLLh!S<h(vt<YH#m{`b$N#1Ex4mDx$=~c!woYQFQp4jLt2%&P$3~-6JYuW@
z{(dvogYEMMuOI7c@AJZ=jOQuajZcgXV0E+c!?9kjd+L#*Ftc_9*Zh|;D82y9IjjMD
zeeT(BXa<nSbFUVcgnzYbmh#IT)BU0@Hkk~4%C?&0dKFZv{BqZ<9n(#Q@wea7g5oik
z@y2AxGvN83`?6)*aPH^(*}7ajY#bfo)Nwwj3g?aUi7sj3>%Cvn+F_<@pVx(%NVTzo
z*EETk8i)SV+C8mYJf_%)o5w9-1LE<L@lkBt5qxBPtjp?K^@*{Q3MPrBDnL8v{nA^w
zZDMEE=?5H>C}*AWaB^Y~HgGTAlBl#38=n@NHxEnm@U_IrY|{LqeiKGovs3%wO-WnW
z$q_g*Ih38+y=YqUE-QBVYwSL4A1l)1Gt-u^aSeFTbU7PXS2S~a7z*=$ejz<hB)Ha(
zF8GB{dP%JpXIP)d4jC_MH;ON!fgcu|ZEJf)6+Sb=oBik<emKLE70tyqU)0#=<ppQ)
z4zBDhe)5Gct38d~X9lpgl{k843|m-)bu$y$?4R(xnX#<xVXT~`^VaSKpME{PN5-1~
zow*^6<G(M=5TxwE7iamhSw8`%JC>%5Wfi^g%#=aFswh)q-rvxdu;lnoqRdv^xz%qc
zExa1S48WNcEAicw1ZiMFA-s^HN`6|zZ7hnJ9l^4De#A@WcuN#t%DU6(r|`iAb5b0&
z(_BQb?P(^JwZr~%FZWc9<+CbRsP%g|519O-skY_bs|m3Muq|OSRFzJMeV_#=Y6yd0
z=d{zbx9v@aS-8u*k5kJ&5k$2$HTrDqcyxkfFl+{Cg$nAL2vmf%Ngu<j9C`XPt(vE(
z5`=Ob)Vc0#(OV>c2#@49!&@A_U9?Zfmrx9Tt9YFq$oqC)(dZ)d)dwh8flQ62H|YUc
zqI88VGfXFl2I}gjcPaTSPX0Q`)BYvt2wG*?UMErTT(RN>`2e2Fmos?B*F#wCI{e~m
zFYge<Q-8E_+585PNZ`nRU@iL)`qJSq6Ye^{pQob5)Hv%w?i82jfw22k%A(VJ&5CBc
zYQC4F>W!(<sevbPZ}7qS{^RoNHdbIx!$RQMIIH%7mIqbnwl(DMtWDH*T=y!yN0#_q
zt&<*@8u!$s_pp7Bs{IqD-K}@|>K@|A1>Pg;o|qcLZqV%-3X&e6x31uitP1{@?nZ0(
zB>e+oucZf8zQY&rdn=#ldMjVu-yrV_P8{fpUoDg1GYcf194wPVFVc34k@IQVa-os;
zaN~ktR&^J9E%Z{>Rn=<6^|ZA+j|%OqgAO^{%gE=FYC-TBB;>eSJY}JmYd+Wh7}*ax
zXJl~11D;t~)A5FdqdccJr*F4)R_BS`=wVmk%9T|zSj*sD_YIbOv%=n<;RXp~a}96(
zW}CnEo}kki2+((3D|XSX6ilzKo=56V;%SQ_+jOc;5459#-ANX$Z)YSvuxMhNmQt(0
z<<98`Y(*p+$l24n;o!wf+SG>--lBgK8c~c7FAk6-RSPnW_`%|SsHCX#5<jF&`dMJg
zhu7|=5j$i*gT{7tMyp=S8FGkLHqhuIfnAY8Sk4Y-AH$l|Gt&GY`9k>{APRn%RDv~b
zt~f=b^q>BNNk8<KpYlgWZN+)QyS4{x`+W%K19qG%Spm{koOy{)XlmH}KXE}?C>vIe
zFQ)~tihA6f<`$BlBZ!4iy`>6U%a2)gw_{BDu<E`>Vs4Ul70;p7;^?JbzKRtxh1qW`
z0X<GX9iAny<!AHs`~`T)QYD&&_bj~+i^azD*KAlNUZ3$5tRD{Ad2VH6;&rf6)r{Zx
zPk>y>m*GCc8??UO73$vWY(9SL&LA$?P8amJi9jES8?|nsHedW7@c7>A1`PZ!z2bB1
zrR&OOkHHDLDU#{&B-lJ)gYd7q9jO%qpip0-kU8QI>Wb^VZfsxMxKJ$#0Crt@|9x6@
zMg!{*$LC}Ft5-HKoRCZItJXCzJQC1P1|{GWqo1kfR`xp!A2@4Xc4pt+>$Gw1Nkznn
z?`H<GlY8Sf%X&Laj@+Hq&GspirUI|3pM}RSYwPx7gm$p3Gl+9=h|C%!3xQwu4<m5)
zGNn`Oy>8mk2=-fF!-iH)9<E&0-#fn+issyUQdt7QL?>XjTOPW=$p4xif`hZXSV^a%
z0a<X2AUc94Whb(!4{&+*3^v9dhcAx~3AB@CLIl|5`BktV)|4}TFV)zucsraqjd<(=
zTh*0D0vtF~e7Q)!{DzNvM;mPY)QY|Y<b4NcQ&vPrdn;Cg*Z%0w){F4rANz$DSi9DG
zHEgK$i@0x{-b;-5Gn%qylYTtmV~&1PhiJD>rO^nFfjd<0ig2xev$l3agBKKhY0U$w
z7kJUG0Jcv#-nPrvE$g4c3|h5M7F2D`S6%)L-`M5Nsv2?Au1MCV5l8&gk1c<I7yZ;P
z#QH8Hg>_25`ep7So;$fdEk>Prh1oDGSABSG?RQt2g#)D9_`y%UY{y&Jakr;eeT_P+
zf<bX>fvX3p{jQ>U;|ie>zvGzQayI{WoV>eBCqMCJ`w1?WV;S0uF5=8fyNPTW{IZ#H
zm1v<~v~|J}bJEqKUw4Nh-^t~@*TMURe&`X{+FQAe3DyzL%vUahCj|J%a2rE_dqZ&{
z$yKjB{%`aI!mPS$OL2lBTpGA{H-KxZs6tlVRY&kzLl3rMKR#oKkOc4KXa27J*m3VN
z)^-=(u-99{?dGLx3vlV)Xt%ojw{r#}2lMa-Zo_W-f_+z;v+zcsA9##>ZJvX<Ry)Md
z6=WXdijy#&xUV-mc{AR+uOI7AaQ(grZ!LzSRzpb%ELl%m8>HI6S6Q|SM-`2AZAd*#
ztPY78wVka*@J-oxSCOaW*51P9FhU7=KjG@4DeU-1IC6gso4FWk_6G&jrOBQ$v{$|c
z@da;&-!Fl|Pw*+=10i0&?ep=u{XwktSNO&LP>J>%zJzubRu+4)J5%tGV!4D{z*D*D
zcz*F%He^cC<zinHk~C2eKMcgDy&3&o$<xs*Oa2;t)CjGBim_Ie$aAO?u)i@9necey
zVAd%e?>3Hi(d*rVvp>9zUoK!|&p}IZ=5Q=O=+DZ>;@E?uPz%mG*k7WG=LM9-;D-n0
z>@C=lKjhAen{m*gaW1KKU(ojzDZNqP7xCnoDP=s~c&Ibm2ji263}`%FaQGWG?;PGW
z#~Zu;9K&wkg~$9nq}}$4W5zY{XmHx#r^V?#?V<QYt)G$>FTuxu*0N52;`k$#w%Zw|
zkTfjK)L^fp?OJnjTX6JIH#T(#(L^FwJmcs%w$JzY%+VBYpG_T0b|z<uYS&+B5{X^r
zWjcKyPXrmT^*rX60Jh;b{L3#Mc=InE*uZM|2@(7mGo@`w2R8Gh`RB(a;NDJ{f8r89
zHnS8fOWWb!N_^OgBj%q@r9Q0q5d4f_Cl{Of(n~wA+xMD(mcY*jh<>5So6`1dT%kbq
zz(bCS*zE;)<gpiQ=Jz<^*QkEGNV?IUkxhn4(6a%9n-S+9C)2@5f40j)gIpvTFR?^(
zO!f^-E4x28Ssk)t-VC?uVapU~FX+H&!X*TJ?pJuPSWm_}pb*^kc)XkD^WZF;ZH@ZY
zY2%L6T&BTpqS6<Cdptt<Q8pYKF%YKZD2D`RwY`61EExzBH)~+h#y{x}51*Sl=~@-#
zNr=R+jwiB}pX0G7MzPgB@PQNZHks40C==F+j5mifg0oC1@~QaV313N$WWgJl0Xc@x
zuxptn1g;+FQ#T;hS))S$Z#&wR)Ndlyu@c@WwV0=KI$T;-$|j}brRAZalZS2lhFmfm
zZC?;4Pl#3z=R~qG&^?jCpQQJcFzQUPBY}MS;oy()&2lfcdOmI{j~pXfO!<}Z!C9lv
zrw7KoI`$jp^j4<CS-A7r4@8Q-r)a1zPYEc@;-zH|q|)}Du03J<jF&ep4t<2}G{>wC
zNtkoMO}p8Ypqz$tDxyURVTD<<jX1h8fGwSln=7K(n(;XLWN)^55!RgamR2vc>XFfu
z-rc&1E@h1a@a~i0Y~rW*?#XC2aRd&igvTd%N+n#EnufPj4q;0N;YXE&*u-%->XbKI
z(E*P=70On4;}xfRuyO71iBnTpc((~Xtz^Y*aN_A;HqHsJINg;M+vC#H{k&CeO?s!Z
zbeZONsCZ{W?Fgo@2+PlmWW@;2KXcf-i~~;di~fH(#ZPd;*{*CwBhEP6JF4R0vRda;
zPE0gv=N8NSe5s7hRr}=_8JWuL)M4QZ+w*_dxcxqEJ`4Lj4LImr2pf18k32VsEqjW$
zor5;rz!&M`8n&*AWW|?pbd{So_sFELGVk2}SE;z)@Z73IHt;OITs4-Bt-#^cGuY%(
zytR5O8*~82o*&Mt&f?tjqo^x+cD^e+c_$9O&|6-2oHpOD=ksl*oIdq$6=j5fSaTr^
z)nUVhVss5B|F#{%JI9M3qA&2Ei|x=UJmsQ~1h&Ba!q+yL5?13i7eic6(2T5(I`6vu
ze!efk99HA=7o%)*{p66zDft<@T}rn~h<3!empVCa&w;HyGc(lyU%C|1?i2I2XB?f~
zfn%*A#p0F6WiaEcdQ~Q1ugfE%6PWhuIL;c5d7BO$hturQbT($GW#u47q#JNb>t}$9
z5}AdC8L$TmT>MznW%=!=+U&u5FGov0@1;LSPmgQ*;MbSE&=~A~#Tz-{o>zj~=3daD
zShMLX^<R)bVPY-sl!L#z;@6hEMdZ_X<j3WB_Z3e^!^pvP*LAXbszO0FzI>%W%EX>m
zRc+=$^MCLt5hCvSwEEdsJ$j@JwyLv6X|X64-imsg5{6!Ytx!1OHhgSV7lSB`Vy1+u
zYV+x?Qkh_?UcDKYUiGlk{`EWQ2~Ezd$iR26c0g%Zbgcu@;Gk=r&>}qinv!jt4%4f>
zb9Cd>cjlKSAqwxmCbw@)wymQ(+$N1ug=?+_f&;X<9wb*zP{(j^fgz(=dz@ERHJxs1
z`E`9B1Zrg9gzKN8B)sE#Pg@@XbO;OO_}+Duj5BVsVvG(_rtcTd_GyF2N7N6Ww#6~O
zrw0x<_o6h1ajqmVp6SNPqB%KVFM9LooSeyv&go>A&D}K&Kl<GVeT*G%e2-pY!;MZz
zg>T&OK{2@L#`o4yrsxv<{U3g)4=($|7n%0moPuz|txo7@(V|;c96DE|xx0gfq3hV-
zgI42#4d1X;q^P_>#KODR+56WJJhuNiorUc+mq!YehkHF*4Sy>ib%(z#k2<j}*+n6y
zO$db*RWuGoAV~JN%6reV!mM7EvNE$}{%ulLU8Z-r2;?EMdyE(UEoV)?;oQHwqCG`b
ze|JDo^W%Ra23`rx!nP-xOv+h@Hv|8WOx`GyFPl4}vE-abS$e>UCg-@qO!d-wYhFHg
z3HXig^4I@X^yQOJP}`%SS^Kh}a{W7%|BSCc9pn|Z8GN!?yQBjq<<L!U8Ip>N`aNrd
zK(7(ck0RRYmmSzDE$;Dhz00kd%@VkgX4{rg-x`h_c9`UO_}0tz5O2JB`2q65y<T;L
z0$;rP1iI$ft9I<IDtz;m9N?B$?Eq-^S_Qy_*WKA$<#@yE=^me%^^><8p~}06Pc+F6
z&=HLtgT0#Op<(#jCSNFA+!XKJ9$wiQ^(T$2tQYu2Tif<n`evw|EH|3ZPnF?mZ&a$A
z={+47Ss<PHakuHZe(V-~53-7SSeG`)#V+FoU20^o|KcJ!<@DWPt6ui7vZuxKYx{M&
zw#%z+@RK)Rd8Xd(cq~{KoJH3pIFBAvn1RmH*N2ijIHP%_U+Q(W6DJMU6=w7Eyrx5N
zHcX2`SSnp5bW29>gWoiVqhQ>%MaL@R@!^&^$h0mL#i0l5zC!ZQl3xn5dsPPO_~MC+
zg0nsD)7^-T$46?H5)i;tM+Rp*oTZ{lepz<{`FpOuPG8vJ)k-2icB}->RbKGDRqsGp
zgnFTT*n&c_Y))sAfl#t+)+xV;ADLPPuJra?&eU!a--D|NawmdV6pPN00W9i>PLnTL
z)Crv=TUhid`jtLBiPQ>pN52?jtxy3g?n4hCQ=G^@9NOTNKyN~6&&gmT2##~I$R-g|
z2O7zKFzO8d;x2kq;w{ZTpO$vdsyde5PA6t)<7(IUY%wvZM&d6<-JSZ=my?aB`L|!u
zVlqXHI(zh?TaNHH0pkWQ?hD|>eS&boM<YhA(uycrXw7MUTpPY37sTijryhraSaw_(
z>=a|T4O)QED6-oYwd=OWMIveAVw>@5rR|DIr*uPf8!MM39<w$jR<*z&rtI0#>vrwh
zm=;-Ey2ff(fqsNE*&_Egw<?z19Sz$+@?$UQ%?;_Ta$|r5rLr)P3BUG?^8yWz4Eoy~
zJ<6z+i605kV>{}#e*Ej5=#hV=_WMutD6MV_(PI~}*-9(CX$Tq1w){o5IUu;97eUG$
zPzS3N#)>>}K%PDF9@H6KY~{z!8t09ES%S>Rn4*Wo6{_2R_XZ<%$+SjTm%#++Aa0w6
z>gZ^db|8_CD9)w7tbop@dKH{`JSohAOS2qV>xjZSz@ez=BAv<9&Jss)XRUhJF$2%J
zP9V^zbYn#Yx$B6c2NguZgs7=H)%ln?Of@%g`mbmZw$~h6dD`lz9R$QfAYyZ1Oj6Ak
zg}RZjNi#&d@>iIIXie2pqL!>fqu<avG($*=6B?fCI>E{)YH{!H#K>)=DpsbAL%4`k
zFzf!p70+81ucl#8I&f?_zDArYa4nT_aouDUOd7ss#;F8nvDa~5Aqe|?^?f5Bh`CQl
z?<sD1TTUCBhKtshGiiU}@@FkiS36Ax@i1mBv@m^-y~GQAhw}OCtu;fQ=<WtI#lINV
zIP&3`dm0;Ihxacl@IWi!$fm({cXn`g*DScW1}Dzyew-_c!=jAWC>Fv2Y3Txw%JmD8
zYp9D|%xhTD%|j3?zHE*ah8keMO$w3nYxVd>N3Xs-n(T8~OZ+<`|J3WcVcIl*7@Z$S
zl$p6cZ<M6h!!0PWhI8-RP5X>Z@1F5`^T<rJ8MY1Dxn(k!Rzr6%^H!Z-y?MPW(>FPP
zi;GCq*zVIzW;Rd)m~OhA%(c~<*ZMQvG7m5=%Q%kpSSoX`|8=d)Xj@j8hc{(nm<Zy`
z5sGe8Uot(`SwC=p<QJ|$L<}=Kv!NlXp8qxZwpTL@X6IT@?h*CJ+CV@3OXiQ_)@F*@
z@Xd76cX>Q-#7p{Zz_HuK<QFG&lWo~dwn$M3+t7xbk)jB;&juoLM*CTxY;wdI=$Y2!
zfisG9@1tuqc;QuD1hImy-ik!EK|R=HW_>DhH7;v|W+40W-wLz*0<2$|s{8!D-WB=F
z<Ij^HX|#3vJf}BFoi?-+w`DHq#_8_R*Rh1gBogC_y0SxmB=cQSjH~H>aMrR!lhm||
zx?wtYRoSH470tCTFQu0#dv656<s_jkN|EReQ3@RH{z6W*MZ+Yq`}uqy9SLwl<Lt`|
z4`=v=S~o$7eI&;XMUG5r4=-xfskvYw137D%&K#-G3(hrF`++u;W8rt{_^WWocOcx;
zDg?c=3k%?Wh>r3&?JCTK$ppVQ*0P&y@6%Iw%1z`lG}1c&4v#?2wgrE|D)3S;qP**r
zr@G~PvQ~zIZFc3Z(Zg|(o|Maw+N#>8k%YLTNzy&JYFjQLILo}}n^U!!=-rXKJZux}
z{aSO52tND(4^kbrvrr2cx~*NfEM#IzE|IJ5$jdQyIYsF;WjMH7PFN4LBIwq&!WGkW
z0or<P?G^hMFxPWtt@6-gd%7oVD>CJ*UI|L&gsmh8JWy};qu1n_2Z{-9IZZ?K+yB6J
zxh<S$J(aDe-J|=;FX$zFB=P1`sKp<4C8|wN$RtnH!O0BQ&*7CbJtk{Ck%A`{%;t%E
z9+8utC@|H`89U3YsDJo#Q?=8d&Sh4CC!WE~J=x%zzTJ*dXUF-aPtJJer+jGx_eIPl
z0>0qItS+W^+ghoyK!wY=HndAjMHKN1*l9zwFjiXb8l|rOtx#LIqIM8>2UL!*enw`t
zL!w}xoWhmZHscvY#P)q>z};;z*=)AUsSbl(?Cl%Tjz_ecOH*^mmUdu~PB+Pgb|{=3
zzmM2>p`K2f)VtpmVb1zF^j$)q6UHH4C>*hQn@C1`)GyrhZE!ZPgLW^~!D$!V^n>dk
zRAShDzkqG8z`j(RwTo@cE3y&l&9d!JUbRR50~4at6(?R%zC8^*ADja>r3XrwowY)%
z3d|Do%@)e=RvVj7X{kreQW^N2U?7vd(P|V;o_nJa;bj}Cr4L;Tcr<78=2Ji4Cr$r!
zjDAclwyHX<BUt!Hpp7J>3GLwRc<2S9@j;=If<SY=dQToX=!3?%uYT<3yRB)SaUOr*
zf0w}e3_aaIg5_wy)MT$WBjAQcb?Ro=0FCBEa07_9i*{6}(r$cC)ZQFYC6snO)rz+_
z<6X>q<%v!gY%7s!>%Ui3%^S&PImwUsl5+C99CeZexbW5W`IbmKAXl5%HnbaNEh8Zv
z&{j6|0;%qR+$AC#bD>h7CIV5sue7QnUE##^okF}p^;I(~h`%o?kkr5CxnP;U=!=@z
zbNk5!KQxxzbB!qd(QvlvI??%~xoqlb(&UeP**=v-u0Sd5o{i*N1uE%P3TNjTu+sPz
zQZJ-TP!}#&kJ9^_&s3E;Q-hbQ`*QxU2E7m_Qr0QTSDLqvWCx)6LCVo^xqhr(%JZj;
zFI)lkA$_0|xDT4?rFlC@a3E^1DlMrcu0d#nNToMLJDni=g3wq=K<)*4b*;1{i@0}0
z(GuMTKJTL?6FZ_WMwtCu?ANB!)o&b*!J+gzn9v-2u+sR;5!exh9K80dh7N4(ebA$h
z?|n{X?t3$5{wh<W_u*E~vXzu`OEK{eMm=JZv+2DYr>DW$eJj%gPrR<I;HB4PnHp~v
zwU*(sz=JoA+Y_AKx$d$~u-pOW@V#{CW3nX}Ep+An081@heFZEvma_)?G?c6*A)R0~
zYQZGA6AG8tU8Eeds$fQ07t*^+Z+J<`Ur}pbeam>b6LLmQ=GKam&1*pE>a*l}2>Q^K
z?}CXuvFao^o!44&D+G0It9;3}s-zpo<It~As3+Ok8Tqhz<>XXnl-xt&iS59jFNeOf
zJ1uh_)Kk(z-*p;)8dwkO0`y5~%TXA+zMRcXxHemFp7B-tNpdLKXCsn?g63g6i98I=
zm6S*E1~>G3vLy_LtDqO3-;+!3(Y&q)pLg0o@$PN~FJYk+n%a$rX5rf;FARmZ-SHNS
zRq|NXDr314%|vYIDbk}Wij;`l%*`_7{X-UZMZJSW)qLK^<P3q#i8|*v^~C3Ht(_3y
z%%gq&A~jv9A8_LHCHIMYH?&Nm;{<6n#=>qW0D0}nuN}%Y!skg1h1vl6n%3x}cYaFe
zqf;(<7>?o{10MQ?zqICywUm>X?x?H#(9PhO>kGC2R$C7x4dZ_$tGc5|&#?8i{kc1>
z@^0nO&k(7^JuAqa?x;X2x@Mk42A_S@=+vW#rYi~|CwhRj3@swfJ<x5Zujr~3yV%?(
zhVi-NQBU-_lcD7=-o8MXVf-!Qm<Xgo?ReG+bZ3cvUO@expAx>dFsyDN-X9<(dC&`m
zO8cBI)M`7%Yt_d&Ym*`MR}vJ7YTQI0{kPcA`?T0NY0KevOZ3@AR(ybnmEl$m35Y@?
z+l>Dm{6-8XnZtj2sa#z^Rz;y;cF!SlI0}VEE1e26W%KA<O^T^46~8dmY*|jDrUESi
zjo~hLf0<cxU4QC#^rH&2!)W&#e9prqzy$6YjdV%WhiFi&k^`?C!&zf4<^^qe*aZk+
zUj%1CjOhF11?;!6B#C+fZ4pJCb_4fdjsYKTmLHG|RDGYn$+-_vV3?UyKhfN;O8K1N
zl@KlkSsk!tW?wiq4GkiTK+uYZ6UbtCuKYqq{ClIGQgb2EL<k&c{mMi#y*CPW<wcEe
zrIz+d-=0Ng^+tX~(+5dx13ove`${>v1u|?4M6Fq$KB&E~W_)lqcuGk!L}a_`X}{F#
zX2Q1sRK6x0BrznVH}W-$QX~)Jff{A{_DZI9rT89-gFu3Bo`A{8o<68kYVr`uN_B!h
z?eykoa8_MWEo*<%++clGMPXL$N8AnUWzQa)*3L78kwHV@R5y%o@X9cJ!=5$TwLruu
zfmp)q<Mcymsc7zcTI@8qjSLzZoXFzyk3jR8RSVvX$%N_6t1{r6$lL&ijE_b$tmJuj
z$hl|~8e21%8VVUf2Z>t(?oOZg0t`8xzZJTt*lb8PE|L>3VI$=wSqOaD*&mQ^;JMt6
zk-?a_*sownzrM&na!&>X8ZQf1fT_q!elN@%r(IK_*4i`aff+A1{%NW?_bYE?H+2(f
zxT~Z~6RmNmf$009P&WS$Qr#DMvPn0|!@kH{UVjUg0E5p`(5D|~V|L5t#w61q4D=+y
z{m@r7x=Xa#dtQ(o{m^jNyb}1z^_q)_k*BE&GvM62bmkf&?T-TNYT5!N3+j_6lD_>>
zn43Nzc!jz@=SyHFU~RsPs?z5?(e+1#T|{j$e2iw2x9DLn^!y#Frjl_2MFw$>e#&jt
zZwEQqg^HAt2{Gt+yV$&!t1qpF*tY5e@j}#27D(^O%3r|eRZ7xFh1%QY%n8mmf7C3M
zlF2Hhkd(jSE9$eHtXH9lwz|jsH_r(K_G?_kv6WPM3TYRMK5#5}NEPu5dU63i!Rk*Y
z#iEb|(Sx_Ngy`B&xpToQ{y54vsq7Iy$;<AU<g064?3KqJA4SfhhxAf3BjtItE1{1Y
zO;`AwVl}CWMZ?(18WJ9dLV`K^MJjA+sXyfye)*=0x3EO=V^M1!i>)L(4)qip8OE>U
z^RLLsI5a3Ke#$wjuKxqZF9Lj?KJN~Ak65mWzGPT8(H_-*U6?WWO?pr3CfOzGjTGC=
z-mzxpQj#zLx%-M;TaT!c@}U~d_}y<t@b+APkq-LmO(c5&^6As<c_L3v{_V{O3d|xh
zTX?s%o%*>tfo}Q3D}2R@I222D9lFCImTxWR1g)zcS4r*-K%?4ZjL1#Qs?gF;gPv@M
z4S#rd8a5Ecw9hXGp2LG*rk7<f%Mx8|pS<GYPU&1kax3^0fD{cxf$s9rov-mC%TCM8
zepOWln{Ed3_dt{wK67nt8{6h#I-$}so`Wkj$%pPJE9R;Bzw*@lLngVY;C?YSjBq8J
z;?c|qNfh6U<{m799*lpl2L}{pOoa~;|Lwum<{qqG@*9c%2)Rwt^tY``k9+dQPxIuR
z0VG!#x~pD$<QtFM?_N&lj|1yg_J+Q$YI3f7d$7Z6sS>m-GeYauwxZaO?n=&mglyQr
zFmm-H6y#Of13s`f&#I)Oe7ow3O!7S|O$n*TiPs=B1j)(tK`1O$-kFQLU_Le(qW!@M
z-szQ0Nav?(;wW`+EM19zaC!n%eQ=kTup1(x^j`1K<sG}1SW2h~<et7;e$s0wAK?7&
z_0#WSxnv`J7TJ@t;$UKqZzSG>kvp6J6NwlM!MW2O<NCqK8nF!qk~;(`;VV{hZU_ps
z(~PE57c5B15b;pd$*q13ox0#+q$Q1yv}0(bCa)Ps1`I{M!41!H``2RegSUPncD4EK
zPhQ$ZJ%saukCn}vFO#2;wL{T4yW~G%Wso<6KGEch1Qhs@irQ+<t(L--wPU%ve7&W;
z(^SFPRD)<0+#^kfDI<zinK3yN2b^)-#X_yQN;4*+uRwBG<PuO%$AV~DKRAzPpd~Dx
zAEOWlQSZ03X!7~TXl<mqV8Eo-mZhHP{<92LaEKI=Ow~gUQwL6f2R?I}#4C_|g>P3P
z=`;+rx7CI7S%!Q(49#QD?K7SnhSb(p^6@n!^i!m;lHdA+jQkW$Ym?aqUv5B$*XQ;-
zOqOPv<UT)>3!froYKzf9@i<QX_x8vDSkh*zOpPUf!40*DIf~M~FTwCyiX9Y(C>}v^
z_~5Rw<WInR%u&=B7E`>)K~YTc9u)6R@%w;>&rwtx7EpYzgJLhm!zm6Q<~5cy0Nxek
z8;%-Hsq&UR4hr}f?(gkgDMM$<PzMa~A6Xa-hp2#`927e#uB148;n!GF3wY=ph2HQX
z#eZ~A<WoG9;tGo220UbrBFE5+;yWD_-%~t<;;`S`SaJ*S;5iD7;Z1QWFl={Fd`B6A
zDMNe8@CPsi%~7NnUKRtM@1THN<bQ7uqPPdee+N8Zjv~>pnBqS;DArLtfZ}Z_ehqN{
zIf?|s0*Zg{pjbn3e~LR({0iW{5H1>ya+D#DWQ;~VQimA0qcAYJ4vLp?>VLL-Q}zYG
ze(OB^Ck$TD;d>FqH#sQYP~3~+iz!|OxaS;2<KD8L0pH-DxJGeLijSuFS-{;v-Mz;s
zzTQD`iQ?`QA3^ccfV<5}RV3_HQHHe+iu07gjWT>p87hIn74+TPm*U?#D9%#cmEwab
zUIBQUISS=oEyZ&j6qOWjLvi@@vhh|K;L<q?`Q9{&uX0e7QCv!K6~&JO?l@qMLb{iu
z3@aQI$0&m%W#~&8jsb%`e2BXjQ9Rp0ag^fr6#tOoC91Q~e#2St=Y5u~{|tGt<8{QF
zK2tMD6n*9`C1dEbL__9(hWsPSZlC~us^y=DP05W5My%PZjjPRh+58wb7>8i)5EYI<
zc;3Ew=b>stuS2Hlb1TTj&yX@`W)A&2B|y8?{B_ctfau43;H|p+uhdGAx`u>|MPIQE
zeq`HN)KwZ-NzYT@CM?`Xvg%pkLn1#1*DU%R`AZv)zYAr0QfMMOvz%=C94&#{W5jzL
zc+Kq+5-|=9O||3P7tHo;40srSPxNHSUB-PlY}$loZT!`1_S1^oDRs5EGrn8?S8Z;}
zcgr7}w3F3M&+OHXwrw^f(zRLL_PITI2~H)eBb)<3K1(cB!_J7`5q~Q`gSE8`Hl$&n
z`f~25gLnDgldm4U_qbMj%Bt9w-ZU#qh4rksE<bnpp*)xMVitdT8PO|mTwpidb~s$K
zzH@PS?Zhk1E2b15%bl?yW!a=6xQwZ`xg;tQ6+?AbY`B3-Y_X^p!zG)fEoa)^UXikF
z#=rT~&i8W@WyRDB=1=l^Y$|Q8x7bTc)ohq_ZS{A{*W8*nqRt4PM=^f;#gq7|R!pIl
z)p}iep^a@8trT&|hu6UZE6pn(acN!&zr`L{apbPB*<NwvUT5Q5PLtH<#K-49rpHpH
zjwk&LJDK*!E)Ks`%=g#8N3_3c*Tje)nHkC{g9k7iJ4&x&9)kZh!2A&nTr8zmfZ+1q
zU#+KX{670X@ZTBmm(c<r5KSU-CzBE(0&l3NnW(OL2ZFO~@8?e88?X3;Hh#%@{yV66
zE&oXhFNhZ+t|5;S(U73bKS()UBt)yZxU^b0>S6r$iC1l?|AVf=^p@*0iU#~nCQU$c
zd-3wWeutwT#;=<=o8(MDkpYU!<Oy(O_+K<NK3WIY_@Afmv_|R+wk&^>NdfdwLK-K)
zu37L>;yMv^`jB>d)bk|^N?HwZ$X(GB#vK+)XgS;}fot5MD|xZoPOXSe8;DfeSpF=v
z;2W}NBI;!hUq2LoMUG5FK_cx5Q{$>k@?au8z9=DM)hNKbE)4d?53~k8OEt869gY#0
zJ@A$N&t@KxBFt18T17vnfNPINa#D@F5;Keaq|X`t_=%o&t(?3$vu8J9))l?Qpm)qS
zjN$d%Y;M|)ln0t+fYE>FBRK>og7nihcqf7z8GWvhm`P}osNBY+$*U&2C!ral0>-3C
zh5f`N*k2UABI}coKU?t3cq9qw5F2pQ7&94#BGz=yIClyfhS)8aj3=j}D8&A9jEJVA
zDE8)25;GlTuuF=Kr>3I>#O}FGyuN^4>n%Ex@CEEz?|Ej_eSvb3>+Uz&!RehcUaTvw
z&2VUh?Knf|J<?+q(y%@T<H1>I5MujmCZgGBzP-<u;4JPeydD}J{YtWDL&wg%NDj_M
zqu7!P(&kHajy-pb-1!osuv_~{^c*yW9a2mR=fDYRXc0Lx2Tp=ux6*np`l{=m*Xq%n
z<jtqG?VmPb$%)q^!8Jm#lh|?zDd7M4X#doP`zXC5r3Yxw0X_91*)<nUv7eb6&%enV
z9(_mT^Wdd(6|`p_`qk0&BsdEqGgpw3vKl(>D^$;}N+UL3!+Ch0ZN%_3bl|Nk<nq_(
zTh_FVOq-9Mc{}~ymhN*keIVY*s2?=2OI_1);;AO<OnUFDWXS>)-=nIzV_AA|#%uM4
zU=C#Kn~w^&9$r&-4$))EtPAa_l-KHpPp#<xIRIs=N%I2eW4K%!z7Qp_x7HBdLO3rT
zzml9=h}>AGJEVRg>MhN@YxdC<vMbbm2lgdPzCm6j;Tz;FZMgL=lo>^#-cs@JJ&3#7
zp@Linhk2l&Cpq&C>Ilx;vHk3=_fFO59v0jk(lqSF$R`@9^#tu?m(1raFINO--M%+`
zpfm}u6R|E=>X3Ruy?wjPXDu&fa4ISx*TDF*DwWg`oj)x&<b3LnIoJ!bMgNya&Z_WJ
z2B7qSfv9%Ym8Mks87>^0ygGDD8{aJ9rmd88)Ki-J^?p{n@*JEntLGes|1Am5mKf;T
z##MX4gc_Gzzp!@dAFW@4-C59Y;nsx;dOsX0hfV0Mrkv1|NL6M8$EaWRk~&7)N?PTi
z=Dy$-Z<~)BsFPgmBseA7i!R~{f6}xFE^Nq2%wo7(;7)#7jBYu@ft^PkFF7gGlyhz;
z*}VjoKix8NatWBFNDBv)&5p}A(j#*joa$Lc#(zufHOLd~A%Pk+JnXy9m2jCPE*^H5
z;Y1`BY*Jr!H8`u6`KFoQj&S6n&0unC2%)ZI@(fa_LEX?Ma#Mq%?YC@)?O^{7dN7^>
zV{jT$TKSr8DUJnap}2r|<!vg=XnUWR5Z9F~$^h%$^9R|L0So?+2I8+plh{W!BwLG4
zv7r~qNF5r-hMpq_bSRN^JZW^#M0(Ns9GH}$U5ueQ=u1hcA+NcGrbR#S&jfgGg?zH`
zq!_E`F;;Ipw+Y(onX#w2rC>LobcW^@4WxyT=ECdnX5{Pm%iiXegOK(?+O?PX=0c#^
z%Ktxlrv9t&|3-n-w>|bhQNS67YZMH}Fi3+S#qK5b-=T$$XJ9DHA(cWpyob!(f_&R7
zf#1DhI3pl+g%n~STeqOzj`sVSTSSl;NU!#iM_W*U=L*WV3+&}b;Du)hqyR|rT_iLQ
zP4oN~WbKE#X<7@ss~|0dwA4WM<$<Z30bR-=l|nkam)yw%Q)%V@A3an5Rrr6S0GP`E
zredL9YAVSv9Ep&|KpMW66nqb+avg^9BBXPWPVOP0TftOT!0$mYoUxFiAw?R<#I0Z|
zo?s%bkQ^b|>?6Ckf~jnxd|(=L!BnE*83`#IQs^%7Xe*jVru=~Brd}>?ZfS(n<^b3g
zq;ZgfAioRJ4fx#*sT|TBNG~8+8=G4sG#zSgafcKPDF)IwNMAyFbrAS|Zf>zZ0yv}~
zNJ>a!AT5LRC18i)NpCd=&74O*+lJCof2jZk%KzWV`~L^GEc@*Lko7LD_xtjETa@n;
z%*yO~hqlGII3K+hw|BQ|X}KY3X&DL6DUfJ>5~OON#TeK9giKb7-rZVSLLv2oG*fs|
z+PkTrapzvtAAQhSJ!|INFK5k|k@O`qXJ*QrkeOe0o}4mu)*R@anZge<ebU#RC!|a?
zW1UlGeL0t5j4k`ncjCx<8(LcahSUT}w6Uc{3ds|aKcrAd5s>;p8U$%1q(n$p*R`}{
zuOpWaqu|sF`j(boAZ>xP1kyN2y&-u+YR+qExe4hPNLwH+fiw<MZ%9qwLr*|D0x1{L
zB1mH)MM3g{G<Pf12Pp!QC!}v7c|*B}Tc8}sZh{1jG^YNH=D8BDYBUL5C27@2Ht<YW
zMgs_=qkrHZoR2V41~E)5Pd5|c4_uaHoEaPDo(rp?G<W(3{vBX>{vdK2#Gyv=5{?#7
zGU<CB#j!RwN%nbkxl7Q;e4!w|41+;_8>l2%s61Jqm%)?LhmkcGkj$e^7hZ?q0(@I2
z_BT03;d_6)uVOB+Q5E&%@ddP+UG_0q`Wq_ua1G|!;CpZl6=X&Kz`p=8;UY*m9L~d2
zEa0VN4Zvs;*?AGgb&*8#T=0L!X=veAA-aBo4p#5edy@{AK=_%yJS??<=aY{qyhV_z
zw17{LGzw1?N=IA3F=Q`=3x&E9EMRYP8{mPX-tcuNTEG&4KE;AwV~@;DOR=E;Li%2Y
z+Wr=F)mXqw$!rQI{>s;uV*&Rd-vc~wxKLVe0lT;5`)!8>{h&ZMSkeiC|A!LICmvV8
z%!ZQ*G<Sw9xPrpa60#E>T@J_bnlxI!KO_>tqF-3h<;3<X3iEg*!1KBHi@{I<jP8-N
ztI*7`0@q0kE~RnrRg{X*Lek|rWgEroa8mTXu=QjDh4%?CBYq!VNY(&6aO@bqbc6-$
z`Wa6jU_oCm@TXYNZ;;2dHl<K(hXwqCbod?MsIk1%8VmRY`Iy3M1=!u@eO<SaGz#An
z-~<aef$XJl>F2!gWfpJ^xef5Zug39ksRb+=&(o_d=yL`73k!M>>3aieYf9vcNp0WP
z^#z$t;TR(i%Prs-^8LH8(gN0y^Y6mZ7H|wff4n0+;XiPfcj3hUz!TnuQ~m?5c^B6F
z2R`;Lobw;}@w>48KX8Ye?`UrL5B%}FaOr>Gw0Gg^|G<0Sg=_u;-+mWv{15DW3skES
zMvRfXKcF$BFNIqNRQexy_AN9X#gp^E#U>;gAKXGBgkV0@K;Bnvl-x$%2t6Vl@1U>Y
z63h2@z?pnW?$gIb(xn!bF1Jduuoh0RN0DQ-AZiooa2LRvWa?cg5khX?1)q>ioa;b~
z^{05VTITS+lG8|EGkltdOD*7FGMmC<&hoI0<NKvok?$#NbB>3jE#R)?Jir5Q3h;aj
z*s+Q)rnjI+R`Ya&1$`IkQV+E;7kK!d1sqN$P*^X(?oRLP`YTxjFq%tt)}s=SNtbyc
z%PhFSg*HI1eMR=t$8d7H0Yr+f@ytr;`yxY$^F0t*Lpt6A=22uc|H!%rgP|e!;gSlv
zL%Q5YVV*YEc?l8D?@RE!P8QyWJ;L5(C$M>F1hyR(Y^%s)fKe{#@Br?Heo6K|fNCd^
zN;vrhTX6mpa$QNsKOvVwX470G$@&v)Ku*v@$gL+H57Btf9S;2BIY0=HTH}NI#pK(E
z=(1;5M;<?Dfj>zlOaDTlT^Lth`9=#oLZH8}pr?@Ae<4|_y8zn=&(>=9Iq}s=E$A6i
zp59unm0w!K(_5=+r6&mGqb=kJ@>7`s7C?C$UQlbnRzX2R1t}K%%Y^)V3wmn<G#2!`
zF1&oc9Gsf8RuCanu)(6hD1m;^g5H`h{eRH!S<nXz<STA`mk#wa(>~$>8zEw8RcM2d
zms-$W<9Ytp$fuQmzQCun;GZE>9Bo100CH&k%oGb?y-=W4U~2`{2l<Ly6>FtO3-p5)
za@^f`lRRlbKQl;ZfE(*(4j5YnNe}S=EXIvU<{TlEZ-tfQV<4vv5V)3Ez}E$_ITmzw
z2rqSq1$~r^SI=NUcO1;~AGDym^ZcpINeh4x3e;H8_X%{N;J=n;Xl<sTKx_L-1$u-9
z{i;Cc6@JHLUkJc_%K}1vg9UxiP`+h)3;GO!UTs0&HJs<a`YxTCOvGUxkh{O{F>j9J
z=|L9sao}>H7^AeHO9XnN1wDBp&p*Y2ZUDO3WK%2vIJ+`eu)%_!J&C99u%JIv^Ym&9
z`XqsV)q?(|K$m*3<n`akA@yn!FTma7{T{d{&=V}^!xr=Wqb%sT0$pQ4?~%&$FSDR8
z;prhvjs?(~-|$~LdHoOSoLVCQ1`CE#A%D<<UbvLkpcQYm(yKr7^j3MT^hTllJqtP6
zIy3)7rj?<!z&$|_<N1CUGDr9dBHF!APq@f0)6o|6AR$T^K-N3~_mE%-BVNoX3wrCm
zMWO|L6vOjRv7oo^XQWur^+J2+^K=sU6ghinESQFM6CxV&@ly!8axCCvVV`1y1>NQ*
zUrcX7Z`}^rLH2?;4}%4qC^Y#XxlL;;wScb*wVkw}w{E6XThOIKXnmFReTHPj{W+4_
z{w>J3M`lyn07?rILW~zA4XRCLyxt$bdqRwDV?kdg?CnS`=u)8-?iO?#fiAb8PZ8)r
zJblc+{x(_|QKdzJ6rn(b1wBaEiHNqKHwu9t7}|3r>zH5xw{A9#vY<B_&p$`k#l?Q?
zV1%rUvk@zEAvu{S+6Xa7BIg@j!rS}P=9XF1Nd}ejd5&h_pZgIa@npxLQZm((4P%!f
Yl9q`^TFE_Ga-L;dsHji^ogx4K0C5_~bN~PV

delta 25925
zcmch=dwk5t_doucSMu6THn$~_O(JCFN<^{<A|;k)b1M;w;;pi*#I+Jsi>hoSyAhWP
zgP~QnDha7d2o^=66>+HuZ}%!8H@A94-Qt%0o!Qr>*nYl`-+%8u9%FXS^URquXU^Q`
zm1+;zmG8I9Tflz!#j1sR_S92si&9x_yV4mb&W2SdmhQ9NfxMUySB7EI<mxU$Ebk`7
zhVFQwXt;#=z?Dnlc%{J&UlH|Yr72h{4rkLR;TUm`DM>Mh(u=Y;PTug_V$$hpesh8@
zD?Hbhm*%B9y-CpV2IXf?FV5@WS9-Mr_q3CWmzK;VU04R^#_Rm{Y-egEToa`xedf0x
zQZ`&umNA#%V$SPMk@cDc9VcF2%NwfwagEr^k?B$E!94(B>LeE|vh(*>rm6P2ate-D
zR4*!xG%!Q<)-I9U>t&R+V;NVj{%c;T7={z=yxbMT=SV+N%n49FLIJ$GT5=v#Gc3Z3
z?83eCWVPO0&4y!#(l<`etXxcL+i^9SDkwx-<BzNCLOm4YYGvGYGf7@PyS5E?omMAl
z7<RMw_s_G1grOvol1diUx^h?Oue>3(9l1;9dK;usc$~dg5A9f)4uMj-8N9lDjE)w-
zq(=nn?az?4h`~DDH38?o2K*D=pmoCA>^o*?M}iF<%<S^&#JB9+rMK+Lk9h-QFYwf8
z-ttuZSKz5w$g7!QyrEnqw1hnAEsyTpTRG*4P%N!adP$Up1FIx1BEw+bpl0z{iEoBH
zfzNBo0JDyIE293CAR=WEua?IF{x!IONVi0@$+lxwWUj4dnWP`qEoB5Q9dMPaTpes5
zyNVdQQMzkjhosPJIswfGwC2OCd<kbsXFz%o&*a$^=`<{t5g`L(xpFEkuhtIa<u!?B
za&OyNfqDVS2c%{IgfW0HT)053$OQf<X!7Z1Y7c>$vKSQZ4<0EsQxyW0%K`;I$W(FQ
zmD0}uappoS{8^xlJTg;-07|E#9Jydi0gy=>!OP{gW@=|khHT*P!z*e+%+x?j0pP#o
zy|Q}QGnTX-(&1UXaxH0H&i2eq@KSA0;6WDoOCa4NYd{}+^p=rZ`uz%lwMGF{3v0kK
zsC`&gxIGJA;a9YjH`I6sFWat#_Lt!ZM|p-i1ghMvC>uImH(hG(ruKSUMwcR#6YveM
zRtNLSytaTVrLOHo9P^#d)}mQO9%#|o(vE{c>!7SY(9+8`Gzz&@t9W(Ee_DH)Jcgo0
z*}7$#wPI&pA^o6esb-WRqwRT}z+MmH41QRbZPC1b6}Gi~3<~&C*GSM6fF~+~3M|~*
zYA8@HI1M0*^vG5u1rWK<+dS2wtw;qR+74!q7JtWa=4xcPaw!-xcvEt<xX2<tU=5hf
zi_)Zat*qc^Ye9e~r7GCB)Ow)GJ!I>^6-9xBnEP)&p<Fc!To|d1E>;+TQUd)By<jq<
zd8KkbY0olQzns41iZ40^x!24K*asz>M}!pUp7J)(Z(?v;XFaR7!{0i4vsw|}@9c+8
z;_J>IpbGfc8;83L@@3otp~D!4(|@(eS$*t98^2ryV=tr)@^C&cFBGqL@n*{t@IDtM
zTizBoyL4vD?Xa&@Iox17;T$Fs7XNV>$-H2MloY-GE=R(g|4!!3GB*8w-|5%y$rH>m
zc8NMZiSfYVCUH@=rnb=0FT(bTt3#8GZpemhHodZ+mg;sOUa5}6d!+r?@=*M@bS%qs
z!HI3uY*SikNt-ytYF$fTw)H|R)49~$?RUi1bjNk=<g7FZi`>Im#uxW<U&JaU_>g-7
z%Sf@EOzBZR^={dBITuW`VryqSf7#x_p~qNgXKh!kmbtOaWc-CJnoUZ^hh*njX6lc5
z9*9k!j8}UeXSHA9v0jtdrZ%|TD~?TaDwVVcux32=_a4nELh&N+DXcmT-|^P6<>Jz5
z9lm9q6^usAb++kc`y876bKF***Tc}WXocqM9ZZVRRo{UDGq9;TXt^FmD{80jXm%yt
zm{DZ(hqY}BO+vQvDfohX1gmw%!JWQgmA?33r%9}KJeK>a+a~q4|Ak9w&v7N0s(|l#
zc~Y;^)xJv+EBC=2{TI2*Lv*p4ONGp0*)7?eJaG?bJ#|em-t9lBeL{`s0V6HSmf1rC
z*>69;_ZBoVTR_%m&f)F>W2W1u@LEHfU&MB%`x%%x8H0<TVmsTZ;?Shr%0qJwO}98h
zQgz06;$DoO`~^ev4+-$|-)@$Y|IC$R+VNWT^dgvh<^(ApQQYI`ku^(db{TD8!~txE
zD<?lX6}JftaEw2m8BOlP47IH57Cb00!rjMIl#>~BUYDq=eVp^grk?}H*W7%A^8$xQ
zO4iFbI`ML^czN{{n}bW4TkE;WrQ&ZHfv$U@`RqCCx926p%k!qz+Dl#%s3p#|-;ce6
z{82g{806!=^)XmOo-`p)N9quhwP))}UaruTei78nvI$?|^x&~<&RqO^a45TUHhvvE
z&&Mz>IQMY~6P_9ED#?Da*mJnP02Unhsy(YqfVyDZwQEO1()_ELDriq_l0#NduHCBp
z@VkaL7Qnw}|H9Y1c6P7dJ`gR|4s7FF$JlvR5HTp0Q@9O#g>>v#Sg>Bxrcrho`n$Ms
z{Q6qoNtBhcWEmT`;!z<ZkP`nC62Nx*9-j|U%rp#N>_$6J@QTblT>`dm5^L%TS<RBI
zs6FSzfKEL$?MB+Wip*XH10AnW&In#n+qAvKbzwhdRm?<vgKjwZo_u8gqitd`RnQHz
z>fpX7v-)H=kJb70TV~@I{)+XB_|AscGGF5KZeFZB2ruu}16AX)ZhhGJWw^Q9Xs3V;
zvbl7&3|Pl2Yw)L`LF}}}SRXo(EnJB2g@&-P^RY)*i1*|#50WLCx0Rn0#DtUQV0vTa
zT&xcBV#S~1g<)PHX$R&6FyX6Ie3HTrotcw&0qV%u%`wC(ZmS1P+A@io05&n_E1Zdc
z4eN)JuqmvQd;XNSqQS1ffO95K#=R90Y~>`JuITNOp!SO>Vm#02RM7HCHF&S0D_b}Y
z-&Vx1Lk&2%`&f46w^-kOJiBrYZs@LH(^g@R9w8YeV{7mGo95)%Pr02w=<_X~v-59H
z9W-srv`(N0tk1^$X`DaHw@LIQ@Ik_z#Jb@%j7L^qj<M;hWBRN3rsAcgja`uL^qWsK
zq8DstG&fBnv1fYfHZb;?=hwi@FueAjziCT4`}yrjgQjko%1%?6<yH@~(8%-I$O%{X
z2xQZ;aC47Pl!t?Q`q)c9x@a5)GeI66+B1mFc!lTnl>4O*s=e!P`ajhi^p_EuI=veI
z(zAV=lcCTV8El)~T%e0u%O|OEW6!Q_OD240%Q4iU$USJ5gG;}_{^4@B>Mz^t-5Ay#
zt+ou=a>W8XI=o+-seVP-!5cgceA9rx!MUVKI6u5U>(CL`g@?+Trsu{M<!ZR6tj*qK
zj82sqKXxr;>C(%my>xc%816NATa&3_lpdz(6zV<|U3f(k*7VAN4qDqQ2sL4c-d`sa
zY~rhZ*1ok5wN76Z3<W3dmch7GlYHW2Sr?kFyld=E)0HQU18MsBXJzp;eSApSFq*Ew
z=X?8mRKE6}tocUlXs4Nf(lPDsNpcBlT9CR9JNNMdukO;P6Px=S5AGA_#uY=sMZvk6
zIF2Qk5#v`__zl+gF(5S#is%cx6CyqV*E<lAi%Rf^eK)YuRD7ea7hC9vU-tC|ToxJB
zHl}gRHdpR|sb?=(IdgoCX$4M-3};iXVtu4sQZkUFf}84(-@ql2@{GV6u3S_3oUX8W
z=o*|uz$jQ(&y3Xz=26{%IVyTo&MEy^y?_On1SB7jnnA9d))p49!!_-=a2sQ`G;5!&
zw3So$THxev!w{gf*>8*1Pa>0P4{59wRA{Ijn_&@K@xoGIEfm-vnA!C+1m?mzfw`cr
zRWSEl;MLXeit<RC{n@tr)fU0GErM^i@~WN)ycK`)3MK-0x&2cF-k@8QcQDom-fCsm
zJ+f&02WZ?2m__^31?I^&1;ME|TX`!US`@wl3ikkB@&0-E;Rl`>4=l=E1m(hjZg-_s
zxj!t*{n08zb=RWYc~Gt!@Y-K#RqmR=8+fgiSJz<Ctr~O-242aPR^6^xbh|=%J!k_~
z)LN7~1Ih&fv%{5ncvC;mj9V7vPJwd%KzD3zRqldCxeKiYs%}`6s|4kIf!C?IRk{CK
zl>2WhukH_vauuMQ544`m`p+$fJ7-bu+*{?YSd{w}l=B8==k*J5Vt>z!OBUtIKsisK
zyEI#bG@h|2cc!&K)qgF@9RlTK%?mAs{QeJq&Vru?yd7+c6AJXh^;J4LcuD&S-1_|Z
zU2mxh%}jwDSg?0jfxsAMVKi(%0E2h6%R|`EA49wNrnBEZ4q{%_t`;B3-NjcIpEy%y
z#vgok(V|Fx{(<2+RsVFFloNtF^+miw?x=!1X%$!-6{x7l`uF^ivv|D*RSMJa63cWf
zgPFyqPooxJib`O+EX2M8(pmetc+G%?Y~g3Ptx^${GYzRSE4QW5PA}wz*}g^u^F3*#
zeJ*E;&3-YnesWfyCEQ}NMa`P0c^P1?;>uL4Rr<4&C*cB!#1rxF$`Cdv8NXD9rmDj{
zEBHKR@75f=R{Kfo?{`bcGQxu5E55pVK`V;d_}&pc2&`kIR0F{Cw|+&<l>Vt^Fvk${
zNK--A_9f+R_?v+qkumFNB0Z#b5Z6+q%Z!mh|8y0lQmP?6ef~whCZph%k%|qh6IPP4
zyTD<8G6~lV40ac9G|O*FnhqJ534`I^>XJw-9~8<~#^a<xUcGAi3iZv2_13^jzvZrp
zPVPu$p4_R9g^e*AYLUvkQZn0)FPG!Zg96yRPw??U;l5lpOgV<Uub~2MWw36v`Cxih
zRv!nZD4T#LSqJQwVDAsToz>17j+0Un&Yc>GV?OllT<|sIEK$Nv-~OblsL4iFL1!P;
z-+ax`vsp&iEuV(8!|5iR_o4fLR10V^)w5w^t>Wks%1{#qdzC~^f)cPK`z3a05`&BC
z0ja5(+~HPMQ1(l@EYv)F#qc$TWLFvNgFb0QRm8r+1~4vo{aK2`X$wZt?b#AJ?id~3
zA-9XoL3^gQz2sqm4vUVxl#QbHF8GWxCgHSbzp$J++rAR0snbb49a-vOb)lZurh+yy
zQc>p>YLWt5+a!E6`U5US2`++>3O1Heu!3U)^*^g*kQYve`UBz+s3#Y}R(k^`2-JXn
zytdrYzMf~4qB%^G6!xSegf<rT3VeC;cX*P@H?X1)Fml3jOlUJ`;qv4^-Y(GKppU`Z
zRO4BnE7&e3!mhqyXEw~IbvQ1@SERbnH)&_$^cY_@ItZ_c3C@tlW3EXeXrT%K&x^Dv
z$adTiBh)lM3=T<3k_NsNuNlEPqBf!j)c?S#VF8b`qq}X0ku^}e1%?#pXpWMIw^HkU
zKx&VpllzE~SQi8x&CC0@J~BqEi-F&`e{2Vq>w?F{f`iKN^4N5?Fao#4c4l?|#hv4-
z*~#5XU&e`$BxSv9B(-0?Czd1(X2tFC=!DMf<iR*8QRZUqM!J;(ht92ZTf#ycHpt7&
zlJgO;cuVp>7SR05rC%h@6nD;lXEWeCi5Ov-QChg|?Lb8KLCy3r2s@67Vq@Om!K0$t
z#%8=4QVmb=`BA@00xB#LkK#?AgrGEh`V*COYA@=@-=8MOpn3OXE3tfZ0xHJSM|TjV
z)bLHo*Ko^t8M=)NM#JKG7p@td$mYngVoV&$!1KrSV#S?s$rulIatC~BjGT@2#}CH%
zvyJU=+p+$(Ic@6?<KM@0bZ>OKdN}v5)`2HvX6I>q$>vNvbF3GeQi+$2?Z`H+!$o7~
zv8tok|3AlB)qecoKfcHZyNqkkRv2-}I3*f@KN}a|J>dS@`nP_zJ7-6lV)nL=_GR<s
zrq_7qIA6z`&pj(-d#T}7CHVTdz(moUeQVbb+?~^#usNBr8*7kii+KfYUOShE-9Z6G
zIkh9XmcNXh6AHjJi|@R}BNl{zu_JBUbj57Hes!<;^0PXe^r?Gr+3~k5irJKbFS&X9
zEv<6`=Ca@LB|f`x-lx8-ssQi#bPt=d2~QhO%}&Pqpq1D--lua0Y+PyCcgqG^hJC*J
z=F6fSq}os^RHA-8-!$|w{${iceT&_b7qJB&;dROV*vbR=LUN4j(3=hFm`MebL{kG`
zu?uD`-;BGdyRj>`;&Ey@yV8Icse7}9JMliX!XanR)4k@C!t!MNNIjXYpI<t5!YEtz
z?uU4H$|kn4FCLy6%HHi=x;S-*4eRg*E2iyc^*`XcX^Ys(J9yG`Ia}CJs-GT)rpupS
z$ch!Uj(`943!n6YIuOpzK98NUn`<|SFQEATdr2i7o@39sikn<&)z5EZdq(<8?hEB&
zPr4V*jJAxQXG?V(ls&oc7`~}&Nzt0xyWyrYzsP#i{;8jf<)76!CT|YTwG6&zvExi%
zmOFzLGXvS&Q+V{uXf}8+-ZWFqN{Uyf#jv@*U}?GsR;SHmxl&x6=EbUZ;Rk8HtbH*6
zpR@S`us(foa7BN<Y4hJ;cbIH_CsE-xy>xkR`x9&oL3^ANyAr=nPm&h?SOi;AbkbZU
zW97G{<7P#$Y}n6u-JFh+{5i5-)aCN!_{f}eXKse82+lsuBvl98@AFH2Dn1pG744wZ
zAK+48a`Wq2)18+SVhZ5cf-hNFJ|X6w4u-}OzHCBFm2R5umLp#hhU4cB%TSH9h?4P5
zJ{!6mo*)?l=RrD40Vyp63W70yIBc%S(_d)O0;OV@C7&3|TzjVUEfSC<AOT=;6TVft
zTQB6uPkgI*iWA6NJ-2jBspl6Tpx}I#Z{pu%1?Gyf0_>ULdW&cqzG>y_cPRn3c+r=g
zy_UZuT|lec+&@S^h?hIQBp*P$%z?$_Una5~!P0r&9e1z-wJYcP-5W$Afn(`3k*q)1
z(&@8DIAPu(HlM-Y%ySRPH$m}tHcnZ!40GjdW+f~MoA}0iIzf$!7QV@)QTVNE!PWEp
zJpvjxRANrcQpU8}e;8TpINv*?9%hx|nylXT;&)Z&{(`=C^Ib~HL%u2O25f-sxLD0M
zjZ&vrO?IPHvrOzPl$G)f@ay#ShUOyRv9K|@nOiCR65VJuQ~eVt?`l@iNrBJD%vf-}
zl~MmkD`N^UhFvCFFXVx5%$Ksdd$?)7JFB~k?G^+lR@6f^t2a)eCUAW&V`|%q>kjN)
zwTze@Amv=GPTWB2y#27nEDgYarms;*)z^XS-;pJytHas_-fjWn4oArz&^y~!OgtgZ
zwf_v4EEw%|*OXOg-$t`p>`rgLidL*RD}yP=RXo{*eZN}nxcm(_*wRja;DcXn_2=#h
zrRdJULVL&6y{`Hd7B@_}BOocK@ZyD$ZGWoE3UZ)=JxDGsuS-8%wQyqFvT~cCWo@$d
z*^9_hATPZajt70csBLN}5xo0?r4sw_`L6>d_2(=y4`6oDAe2$6TI7cm^@l7>1$@nb
z*CV&degTagmhHFcyNn?RXkjP!yGr29q6mhigOW15KI3;uz|TUafN$|kZ31_HD{pYY
zhqWEp!LRUjZ4Ddn7e101$`)7Rhna!V`Hg(j&1FT|LoPzEm6rtf+D6R!1+2D6$$_2w
zS!^pmYSYVs;SK!RfkuIY%M&=b96Wllw{QLmS%7)S$bbd%>8B%dEo=eH1$w|&c->+J
z3d5C)@4{@cE9(`@pTIk_zkmrOKsVQ2H7)@T72(ig!{b1?Ldc^Vhf8$6y<=0N*4hnw
zJCea_p%5x;tkeKK{@?W2i9r7hH|gBn<Nhx=8Hek8u#$0jihhdZ{zoL(+&)9_HT|}6
zu?bOY;|5w}3L6)pthlJP;|AKthU!Qlu<K(~yLHfaSf^MaeLPyTqLJY&sfIxseIp|v
z1s}>F2drp6#5Zz0Sn-FrIY+@Z4#2@nq9PkV*qPhY{wb5G0`nWfmcn%oQ}J77bY{Ye
zxHfU5D-^Y?You<7tQ&}MTJb^dU|9(Ka-0!~w=7Y(9KYLBHwN)FVXxpsDK8n{TJmAP
zfO-&>xB1D*GFTOZ09OYG#eAdi>wdRk#=f(Bn}^>SRVR8K_#~kz@xj;{Ekhj$FI^f^
zs?LS`guo4W;Zikgx{q%xoxvV+!h@G7LkjI=Ij}_Q|NIJ^wy=Dj&o0^se!B|oin2#O
zqKDZhjRZJgk9WCr|FY{o9^37)?Nb}NjNkk{)XRqGso{=0;2l5tv#ECY{7-{C0!41M
z-i_;P{UYw#X7v>#;krh};E)|&ER1|{J0jdtO>1h`H+lol3tIuNc!AgK2xLta_|OjD
z-u6$6%o`$~Tqwm>C?%#@v-~o%e!8Zij>${wK{U7O*o~Un^_N>L5*}f<pCj2Nk8sk@
zgV>k{c+Jm)LbB@_Da=@gl`l3f6vQ+%W=3mrKv3F7&A~Ob-?wJ3zm3_Qz7gAN=)peR
z1EK`o_sgOEp3r*Apq{W{ysgQtWKirH$l9CKeqY(LVY#Jtf8udF<!r#8c+t-8UBkqe
z94EM5ieadEUB%+dJBe%w{Ia`qmFU1=x|AzIw)(53*LH>?-^R+QwXmTu3_Sz~bSt(p
z!Fs}(`A*0nhV}WcIJhLxV{&N`*{E6ZTkArM3bE<M{feiQgi8x|?gVhvS%Fw_81E?Q
z&BpG=btMs!q5`rU<Sh@`hXZ#lVRL`RCA&IGbj5;nZX3R`OX;3c__o`@!ou9{h50yi
zcd+kJa}w6_TjGzBFU|dQgUvQEn1alO)ZY3$ykK_}+qe-Q+&zfhx*oUej_Am(h3nXo
zvND+4p0-w~VuMhmDi4n+9TzeA>x0DRfSA!Z*h>Tr2QRld=m-xP;N8Htu8tCRBKW<@
zH0Ca}VN!Bw(J~tQ6yrOkQ`nn49=<1<6=&e}dpZZEWXYZ~)Kv4J%z`%~?v{a<CT%Vh
z7EglGK?`uhp3ZFcmsq+tRKk5N<ltuExV_$Nm)SUVuUw*AAW(HPaNgc=?2f6W5BK__
zka~?p{Kp_Z^Uav=%bt!|QTErE!$znY6bvV069kTmVYr_$61FE_8i%lF7vtl`WY@gv
zxxq{O-@-5EGqUHPrC2-)N9^}!m3{H}{i9JCHtzpWQt^=>Kox^+56Hcf4J+dD^KeE(
z`q;P<H^%kL92fElv|>(<2`dkbcO6jwnGt+dN?#}VMLc=Nr~BYt2fDFkYjDkh64;om
zI`|bz#!kOz*vecy`<KM_m0OP*S0$h!nM0oL&FbR_IVbA;6f|cB{^J)NyYc~^c<5v_
zVVEM)xVZ3B6yVoy>$6n}2MpU&H5)HWT}K8n9dbKy&K$AuO#X^;{E*Pg0EZPI53X4h
zPn!Ak0XXgO9M)vOb%)bC-rUfoY<p_1sCM1u*CMg&+#Hu55?TdRPQ|m21hSLQ;iNK8
zTzaGvTX@F&lRx6eR-QEf>{ix^6(5J6O1AN+netPaA1gkBtIHzU*n<$Y$3f*jY|cLO
zPfd9TwsE(a@4NC&Y*4ZJ=a8eGxT)NZo&1xTsol{IY-OPZ@nM6u;+aRAMdBYb&u&b^
zo7%~6)~}rgg{;joIx@1!^n`5kDj3Ve`M;6r;PAgJ)1$%k+6+syM`d3@7j>Av(dK{y
z^JauiZ+oUdcU}(zwz}K{H~b1)8-hFj_JzA4GB_76wM7H#b+LzPF3}~mTA6{1ev43?
zUX}$jF)Rb~lDY=xw!3?M9EpdP&OMpB;XXYD5>j_luAZel=`!5*n3|1G#-AS>%{IB>
zs$=rD;;C4a17lS7n}gZGxqP}ZW_5+H#4vgO8|X55(!MyPLK~6~16sy<q&j1C3KX1;
zTge-e2~r&`6TFyPE6{a0_)0}NTc3@;Jsvu^ap=~s$VIc44+3%W>H%<KA(D*+!$cM(
zW%ZFTnjEn+fppfvqC^yr9kO4#I%tn(9gr|@M&8id?6YSAb(}q))HD*iRYs20FQQ^f
z;)8R?oXZM|etGo2m^0Y$>M-2x%m<=?fv4y;L*5inlq(b>iKT_?I$e9r{+UqBy=e3i
zh9YdBh$`TwcIT6lV)3?0rKmczD0h|-D^3KVIP88x$uj-%=o3+F(-^$|L`P}UCpNva
zUuX5QeNCs;q(FT9L^!Jr$FG4?+XF|Pgh+w4C&O839Nu>_k*(>1MW+V)YCo{AhfD0&
z@B|6bTPb>FCX6rCM_k3Re)#iKp=_)iZ#~tUt@Os%PfZc!%XvfEHC$fhfhV4JV{=^b
zywkyKr4(;H-Gj|>!dFfY5>>dvf)4!tj11Y~h~G!CIV{fm{h&xC2KqrP|6PWj;wfi(
zu(5yRjc20R*oXM~8E;X&3FfC_fZf@k``En-&Ufx$WmO1USdV8`4Q5r(@u4cv=LUX2
zqd&0s*+{RP%S&oq7$w@ML9yq=e%eMxrlNC<j>qX|z1YeNc==g1TUdo3o*l;?KY<5V
z&tMyl;)B&&*lk8U{@e(*q6+UhH<}IFiJi~)U>l3@pz~24DHYTPem$QT@Oc9ow)}I5
zhYjb$P$RBBzZd<1_5UqI=WytS{%AU$aiKl>9WS}yBl#sz=NG=_HJ@}A@467;cAO?;
z_2$8RpP%mwXx6j%(S?5Yo9MMXNI!&oU(B*mHciKeE_QX^o~N-eL&;_M>BW%t!_4QN
zv9#L;jkSpsi&y+6gZ^aG_hcgOcWI<jS+YPA%h|%c@aqG=!G-x4+ShVZWXGXQkv`#+
z&aVUtQX4)g%7!CQ;1VoUzszqB)rQCCE-59+eGOIgy1Awdx4-O-#^H#|9odz8h{6xK
z<C&LT+ig0pM=@qcRv11b_o4SJ>$)1RyX@C)!&^i?O+bEHfvYZiIVXh=slTR|HBdzg
zmg8raKSa4W@`|eMmtce+J<EjUdHw>b#HuTvy`^1k>TOYG42pq0RTQ7J@_Z(}4OS$D
z+0;iPN~0K`<Z{k@ORT8w2A2&Ram^J^hn&CuAbsd`QmMzbS399B90>m|#&K7>IxM1R
z{q5V$Wd<Ugej>m|nHLWor$ZZMUhF$PN2~C{7p}@3^P*|D$Zp}aQoq&Lf>0>#e66#*
zI!Y7Gv0%Lx-EV^0s?TIFfBE%z9t;ZUaQd}R&}4k#S|9sP!n`K-#dd$FWH!ccZ5X4I
zlo|M08^_GS<Rd!Zo)+Ute`E!XGTT#{$Fw;~pnbE9lWphZeYx<>Cv);9FRaqbE}0EC
z0y|&#K_BDL>p!69xcYim6pLR2B?f!{`Gai~uQcJKfBM0+TmPpodQ>XEF$Jo5vnwhq
z-FVZ6L)E2*x@{~PisKu7&{;gS@hjG4eQ86Zh()H-zwTZ|5LMov&VqoR4+GFmJm%p_
z`1kI^UhuCE-<2J(taLE{EkbFfjZH%l2<r2<sw4lbD7WuPS%ulJpYRHo%k-5Pfi#?p
zJjUPtEoZ|n;6s1+Kzu3xcP9iTw|No~e>F50+aG()D~b<(2mFaSf|sUVF<YXktje<@
zEAZIsHnBxHn#B#af_&~W@EhOdZ@5^x`pL(rU0G=E?p!GRhj$7;j9)$-?49-<47O(N
zQugzTmEXQ)NHLa9eAX6$UUQ!xMzq#1I<YQ#JnF?dSD#zoN#L!UeLF^Ta|CkQ#>;PF
z(~AyhGw$&616X~GdD#;(ta$k`nC8~Y_N-4eZh0vO*ymMy06uu70wD8MFV?3L?|(Jj
z^HZ~a@&Sjb@~+}zuVwpalg5n0{a(*SBk=CmzL5Fi>x4Ewu=i&)A2+eGzA${*+xuX}
zo1qS#8<j$OswZChMy0x*)yIjE1<|1(_9mUdkKUxaEt`H1YBLABI%GG~IYb7BI<Asa
zZN493)7KH^@XQ2Z7QaSkak)AbyS04bWxCbnXs|vwmrgct7a38Mjn2@G(12RJwPlo_
z>6*rclLqUHmI`xMUPkaz=oUpVHM&XY36B9xVhTqgc(_T=RtMp0ra9=*+C&tK9;{u5
z<e>w~ik9|08LSsZ3}$TbQqQ~eSYyL)qjZZ22w<usgO@s;p`r$qt*t};UT3fQDSl#L
zrzVjfJz54AEzN?p8eE7kLVeMXWE?^<tipk8MJQEPe9AB4C#IHx$HIM<F}2@{@4$-#
z`B2h{MKP$FOkq(MbcU>EQCD<|9AVKX=opQ>h{6W-LgmI(8&trG%jk_{`by#|LhD@;
zi{OQou1YuuZCFMQijXGg0NDdho$YVzZs66)nU6my@0EM@XjXf@n4y)cUDwCNGZ_a+
zv>5er8A!J@8%_)RYEcGRB1YXj`_pqw*n>d3Wf^0?g024q%i|$~7`aI+BWb2pr-gQH
zoJal^qmNy}4+62`H%nvBHjc1E^AQ?Ls_aqwp1WKnlD4k)*)LbvFQ0TupQzt(a*6t=
zE$F9(MobUe-uG7RnrM@(op~zE1N}A-Zwc~f>vLjB-IzBREc}8#(2)968e=3VgXKcr
zSt@$RdV{8i2E!|CSTD+`w}~HE){E`w@b%OEch-yM4g9izf2|j#>N&7p>@GHYYbD&I
z{T4#DIUz4L;~_cbgygKkoisS1PB!W$HBq=CuiifQ>y57V@}p;rbH}_WL+1NS(F5WJ
zMeeD)#z<XrY!TLHGl6<oOvR#lXgPIK1{v#&VqI0T0@|}uWBmHrJ}JuOrR5XJ9%mHR
z>A&#8>jLf7)aRJq+!>qR4orNN+XMm?gA<wxV(WsGg9H0R=cqY*s@qZX3e{ZA>E&oJ
zcGMnSaoXmv11y6RVOa(*x1{oqiu9x4C@4|4;#cU9Xw})pL?c;?#=N0r$U{h;3mQQr
zZP69><`GiY7Qrj4o}{fSieP<yA%k7f9@eyjux>za^d|~86zSo!y|wC=9i9m0GJT9c
zS?q>-v&ZGegKkKR91ETn<@yEMzT~SnzacU1$X_1(nEXWN;-4OK23}fxu)Vk)b6!7Q
zf157IlN70BsXOYy7M~$U+)=b!^77!^C2C%}au@BHFx^YjekSfR^toffZTgrmY6D2V
zL)OVqx+L`vO5v+bHAL!xhD!qBDLYMX-bQA4pz)3czaPx@3x(xl_2vuYk_U=ZRt$ut
zdiBjCa2*@Z*~;{^K|}+=A#1`e18peB!te63mvBWJ56^arK<}kXPqbdprd5$7Pvpjy
zy(FogXjDhhQIJ*>RyqGK7z$np%^P#{8oi#aPCiDid7@yu<wsT-_?qHhiK7?N*wm!0
zCbPZJq_~x38hb7&I2X==Jo&uhBk(v<q_N{7bg`>t166+EPn!J{{xA4Em&5QF*_Lxg
z@TCDbQ}xQzMLKvvZ0pM9BA!WZCLP-&Z|A_DDN0|(^3@qXleqS1dFKJIi<VE*2kIJh
zwU-^6q1p3>?(#HXM|ucpFXHpkN<hs#mlE>2J&Iy~YESxkqv+tx59w0w)?+x1wa@CE
z{nX;K>-{>vusg4N^9hvV5Bt~ZWI~F(Q70F(OCMh=D3`p3T=PZ&0#T0zqR%Sg+yMo-
znmGeknHBX9e-4VSAaNa#Plg!~trWQV%XB3K4+aEwpu&StJ6iLhmnh;FxZRHEpjmV&
zbe~ntKP}P~Ew3HS-3HAfY@b2jdd8P$>@He??X#c3g2-{;40sVNwz%Ljry;J6j!kIW
zLu$?Po4`jJIv@p`p(P$2Q8-(6fh2ZBeO&T}=6qj@Ios!8q$Hn4;~D@FYdS<u`Jh4J
zXZHp#6||_oNVQ0-f>&PfAb`r;yv#3f>r3-}zpbl%^h>e<w9UOci74gB-!V^_6>#h&
z<?~re(&flKDCLw{LZ#XL7{MhAPEy*<n`SAnk%Mg<`B{!uA}#6P361O+aD=*XF+9!I
zC^@?~pZNJcdHuMH@)333u*amN6F6z{6LP#03YF;N&F=-OU4A7kozPeh6ZZ4n`g*Q$
z?nq%TMPLMm1<@0d?u+8$Vxr!RgeUdYHxI+Xn35C0<L`B}lN|3)wP3=9R6~?`(oAA{
zo@&JhnDHLwGgvkMWSt-Kus_~bU{jM$eyD4psFxsn^B$1>Ar}hEEU*(SBF!ZPhSNHq
zEh4l1&=&u1p6R-3JUDq)(6N`@CAGi5de+L<(8VmYI&Bk)@JGJV;)_`UF3i9wq$AYh
zo5YJ`nm;O#9Pc1-4b3B70q8XwdX;ztqH(OtYw|@P8o`FWA-@Nr&)J)QkwHPom)(4y
zqz0jM*5wen5`@b7R=aG0F<=nqTSP|`MV_W;nP#-X-+V8psGb_UOf!)4$D-_Ji$Q)q
zMfu827f5wyG_P~|7<i*S&L9=|OOlJ0!}Aa6Jxf(nubJuPrc)%n3u?5fcF~iu!DziG
z;8$MBH<0FFG)^Kqa-Ke2D)-qz#&<<ZN$No%ol!`(bw!_b6^yn4%G~U96y9O4g=XUN
zck@l-Z^8)~q~L^X7nro^#x<f0L2mB4629rk^;Rsum|{^^$g~jDJ33|uG<tak30^wz
zB$)iw$x1<9#ZP?GqD!rL>Wg4JZfZFfytG^WCB4N}XPDP#<z<-Eg`fp)DF|G%oPPnX
z8N=CvLzeg$$?R@0u_W&!JG!B8x#|VwIQs~?419$GBj+2zhB51@`<gQMg`zgd#az9H
z9P@x)&htbbhWZP{z-)mScAw1nhnT7rh-nR!vk&3JkPmCRL!=6n+Iw0Qc7XAD8Cb}n
zYri&w`$$Z50o(L*d;>ha0Xvi@*FXym<m_(1JFf<FH--zh9SXGDE;Te1v|V|cq;^N2
zOA5xD-KxC!H!`mW>P0+zAP0&5KLXLEjD+@}Ej3z5ryZnBN{5({Li+69TV#F@6y9#z
z3zz@}^92qUu&`Z5$DU{=VyhmIh2bbt($L3J^|hot97T0bePXHLsx}qSLiKH8H4~q^
zx3+?)r+}_pNdkM(PTyTfyDTT;d!Z$gRP#f4XqUytrd}uzdAppb9m+MqcPx!Xx<I<>
zZt^j-c}ja=+7Z&D4@z(rIs1jbur-S*Nxn;#_CY;7iVwp`+fbzYr&#(0MoC#6xzGni
zvMcu!X#{d-U5ZKP2<U?iFU_5zB;x|P5`m_%#TQ9*Uv$ewPY0BOAIudmDLX>KBhjZW
z<wNrXm!Zv3oM|*fA{A;cu$qqtU}Fofjp5`~0nhSFOh2sahsH}cKQ7Ygx+Lf{zj3zk
z+@g-m?1yUHQ`6{q!uuJ@mO%yuS<@edN|XP5H`nGWa=t$zHsxViWJVMk)wb*nbp2>f
zV);Nwk#>??h(f{a%IoU}pwP&4m!cfmT-w`IskP<eX1*qBCtcGN=*Sn)>+}tiWDvtb
zFNKaAHKPl3!>NHwG9HsD15j$)bPk5UXwDXM(aliVl9f+L%>d-?Uw@gV(y9R+!Z9%L
znkz3_V&+)`111aSeBX3~dp$F7JlkwQg?di#3Rt*wrbm9W&L5qI29xEW#`52@$k!0B
zIP(FSrbK<D=1dJ)Fn!Zf6$Y|PiGte*qB2{ljFLQ1B88hM!#o`;)cvvwPofu%aAep_
znv^KyLs3@?5<zKDC@jo%K`;R|!!0p8r0O2+J&N+=;H5C)Nm5~DH9nVGr$IjxUTT{$
zvUwot9uPBANXolI5lrn0@f{Qk^S;@1A`7M_PY0r|@|bkWN_7N#c6|d=Q+;VI>v+R#
z07KY4q8x<WC4VIe75;1(Q4d0H-HY!Q<<=^>Ynd_A;JGN2T#|O+>vIo5Bj>;8zZshY
zT~H`&nq`Mc@&}<AHi|SIar+R3#>f+?6Oa@-lBR5-BN_iKxM+g#jL+qY*-7kNCC6UC
zw)O>C0DMcQeM-K9c-j3<vW4ISjx&78k`Ix;(xnil{TD^c!4Kq{TZ(eV>sD22bdF3`
zQ1*)r_xYNc^@0c8&`+dK0Tnecb3kk;K3|kwo5a1Om;dgBjYe(9aq#A1z&3i`_ud67
zI3x`CfMpc4V)V0uzz3oyj7O$QsA`NY4D%%!TcH|*I6L#uYc|1gx|V|Kk@RTvg<Zo7
zn)3OMJd8#o+%j&%N03)tMT|UCRg?`^q~%q6$tV>Hbdb9PB^T6`8%T}{g}K)R1}_Ic
z^(AIybbV<JHa{l6t58w*hTib{pM}$k-{3&&+-+Jrh0+BS8O%BRDYjO>ZTy&CRAdq<
zj6uJ#1;3FQvB;xK`Y2s+CkM_+lRJjXigkj!Uit;E0|P7NYF=7BCwQs(!&hk%`8gH^
zND6#}(tLK3>#=B}U#hDamgmh0US9hV*IcA~TVCLOT3!j65Qjc+);m+x{5n554`1^{
zlcG2j65QbMmX@ci{e-IuUjFA{p_2JhVJOI#@bV1(x_IO+t=|PkZsIRntWZh<<I!-o
zaw}O7k3#HH;2Z<)1oo1h@yN?Ah67U@OvgxdJnAE^WEj7Y=id_N1T;7!_=_s4iT^#u
zFM^JEd^Wg34ELI@|7~AW^J%|?CkJn``q;jfU8KX2?wEOOtZ~jCX>4<Av3C9}(G%(c
z33nI|a+#rrcj5nBD^x(i+Oq05BL&Ym{><zFhoC`}Fwn$eay0?D59slHrp0rfz8Oh5
z&K{82)6<{$>6#>Zpli>ps9YY4VrVsrPdUX1m9AGnC97NRlhBXQ=(dwI8`Zg$I{G=s
zlR`M=<yVvSAED?Dx;wygeaMTfifm?y+SUHaOD^`5-c=;Gp~KUQk5G^YGp5^Bi=qD#
z3?0zO%lY#pVlYzoa5mPqwQm`&w-nkSaMa)8<zc5Q_6k&8oj}$7!OPE{B&P<W?4kGK
z1=E6A4W^4=)`a)W8dsD(6}~q6$E?L>vsQO}HrM>6PT&K^L-b@{HW!OUPu}nfHTixB
zYOk!cIrNq1t#@A>3l})5ol#)v0h`;@zdfTDR12`EmVXthw2w3oLH?|`Kk1l=I(r*>
z!w1*qZlt;?RG{J_FJD;#m$D6HVj@aJ4B3^4!Ui(kxLDzIJ5l$e3+%gLgzWZoRV<|r
ziJ=qlk1kJustxY`0*kdGO7Hs)ogtluBG-iSAnxhASth-LEP-wQd4l+T43}zzkLLPt
zHVm%_!>wZsoCTO4c<59XGoK}khQd0VuQpyEifj=Zdyd>rf(@2@7I7PfLLJJ-(5?#Z
zB2|(h!%$cE<FL(QSQuC2EAd0!Sh^gO%ah4B!;o)qrR~NKYq9v=JDqixdFLi)dT0_k
zZ}@;!4BjY?Wy!T+sLJ8E3rrL87WiyWOG<~MppOEkP{$10QnaFW99Jil%M8d=1uvx<
zXjSllFqO{Lfs@UcTp0_TvD^jA_+Z8wqNqx067VtV<E)=Z%ZKsd8EEN2rhSY;oEnnf
z(zN8qkI|Y)VPer+Y9>u??DdOaA5{)t{qQ;+><RF|`H5ao;P@+{UIsF21nOX)I!Z_?
z2^oRrvO6ytokt>#t&IZKD4&l(0XB+aE!j8*O=~+j9A9cg2iI*JbdW60;pL`3iN{#5
z_swf0VJzy%-h>stIle@en&S(k$Q++1r_6CRxo3{6h~z(%|928>j!%&Ub9{nKGsnlt
zQgeKa6q(~+$*KRK-gXbqbBCeSBgAeT<c1A$XLEdz#F^v$WQsZ7N0yl5J!G3X-c3%J
z;}UYm9PcD{pVIt0Nas(H_c))QoC5B~!f+u8gt>dF3SJ~0jz2Rez_9Dw0bV{}yHh}Y
ztmbK<9Ys?B^*PiF(7aur0-9Xt6mTn6^Q=%r(FuSKIM^3Z?XC%cX5<qCl)!HOksSFH
z`A6ippg<YS@i2TohSRA-^GB}QrHif2d(rX;&W#@K<ql9O2&8P@J@*`ZSy<Bd0AD?`
zn0Spxiq6iZ^i6r7Zj1S=!a0G;N5Xm`p!pxE_d)6&GJ8Dwg01XM?u|!1q&au#$tgUZ
zgQp2LeG0n~Z8DOR!O6&98e8`+G`TZ{CbEflNnJ8p<Q;U8q6f~>gGc&3MnVlE6@=t?
zkVR@VG{cGW5T^ZvJEA9vb&SVo*v^OMdj94;>*8-4ryS)s&iH=WNq%Gc_sh=R*G<;U
zdv2$3vX`z=)1h3m>X{vR0dARV??R7(&Q)sk{>bl;zl~pstt}Bzhb_3YarB-#;kW+E
zo;%y`_dlJr*B)M`(0h^$o8GC%yBM->Umu}Ke=gcM;=pFSPR!!Vm(Xs|oC_+|8=1cz
z)9=)_{PW2oeRREM(#4hEFWdXyxg+b1L<|MxOs+aqC;Td`I&^0iJqs>(e(YDWol%{<
zG9ur&e9EeNLTAi<V*T<d8)vLfUoxpQ173`2TrP@AMSB^|;>#i~evv&E^<}tJUTV5G
z=IQeEB{Tj>-|hcqqguFu3D9~!;;VONzf}sUs9J(G;#;USYFCNrp8zSZx<{30S8-)T
z#bI4ci)e+2OFanRCYtJoT#f5xd`p6HUs_f>=Fd)L^ktWQS?h@lV@I$2ZF<$eY&~U%
zQ4}5=KZcK-h1V*T&&f9v;ZQW^35`9-wTZ~T$AGKBx%PKAPLb`U-m01d8kgUAEPT_D
zpkt?UZ!gEeuUy52e-VWSC3X(FPoQPs4QeqLn^|i%S*dvE`i4L0;10!-XB0hthZJa#
z+%f2<zy6R>vxbX{$axKl46LXnPk<x)*e$;4oBhxepJ#2iMVj;WtnhN70_ar-NRLTy
zjFPa0jGBbH_NM~+Ki@RJtkoG4>*zWZhFhpPbhT@crC1OfePy{aGajjQF~UXL@$bly
zNvN-RF%%_UM_MMK&Z2<xd{bx<2}ywi>6|lUQwj>~$R)u6=+(EADmAauQ37>`_t_`S
zJR;RlzWkd<<WveAaf&O5Bo%qb1pVeGeQx=%ir&kwnEYK%pPoWDntb#v2G%i8ZLr%j
zTRcCW^7!?AeuOWd*+^!jA`dqC1<|LXNutzXSWNv*no`jWX^bzg-F&~xQMe^+Srw~U
zL-JBlR|4PA4PXn}lPi;9mXGl;woFEP#2z;p^;1zOVqG2?_f12?5!>?ID4Bu!A+}>3
ziTe!oW20(_{xg)#-neXZoQaYUdozoSPXp&@*+y2U!I9<7^~MuvXd`m#XwVJG>YClW
zc5iLAQxhE3lx$i`=FLJ{cEEY#%UNhJVv`S(xH)K^<ACzuT<#3rl_u7c-{*i;tDcdU
zbI@q^=3O%4b5zBK))D`?Fp--sk;QY-6n5uj@?b7piF|XBIDY{L{$-~~%oi}G-Ta;$
z`2x9n`81;d_+tSbp4xFAWpz3Bik_=f!R^Q9XXN1*Xo_RikpyA?SCUvxCVq)R*@vM2
zm*`h#9|AkxM9vLn+4SQ3IQ5a7ES`ssvk!kH3G?9sEcrP3dp;P=^n!RSK&x4oO0r`C
zde$-QO*?uL^7;eu21awQkzMSTnU?@#b>Ldwu;?Wz{|Y7aHW|89WCdrx(yR|Que8V4
zSgtu=(NP^19qB8dbf8jRX&OJVq2Cfi-oJ@*A=tIJk$kZbC9$Sba$+Ie>SYuY>DO?)
zF(8|C{u)I|3vJCqb*1bw9mOjXN%_~vo2>pCb(D&kccGvJ3PnkSUiBs(8mCHf3D)BK
zVpPO=5$cj*$2oVHwdGDho&Le8n#9+`n@2s-N^Rf^aNT6road&V^Y6kpX&P61$I<cd
zCym;{V0x(@X{KM2eBI}TOw-sXAy>iUbGt;*G3tj(%UE0hI`wXNWFCs+G_#)DZjAfC
zhhq3MBTeP4-;3OyKWM?01@x;C80ZX(40NFDe)4+U#plZ>!Fl>i-AP?Si-eoDLQ<*=
z7+3{YOqw|d;g7N`Q75d0!QnhORMVnY!#Aj2ET2@HcHp%vpZ0d{S3Ym%eWaQSBj6bG
zC`iY{Sw{2lV{b?82j5WjAki6cHycWpXQ26Zf$I}8gEX~`WK{-ACNs2Xe%Dt;*`D=+
z#QH)$FR|*~sn;@;LA9}7w4F#Z!A14?BrX%Rba6OHFU(|cnPU@qYIkM=y@6hP+NPhx
za$)Ak=p>yayx}ZKTZ~48m3KP{SIx2Trx`@quTcy*v4Ou5oZHv@FvV|MIC9lxGaGA2
zAsuKMmy^F2qn_w63Cu!D$ML7&T+zRifj1mEX`G#f6gIx5#Q|_lgkl5VmG^B?cDuXu
zNglig8BUJrp*xgm$rC+vsE$j?j2twHJ(5Mv=b%&U!)IjE5;UHD*hE^EAT?Wc&#2Bt
z29dEQ7savb@}TcBj4?D1&6b3&+1z5HLH(l;heND~bb=+OSc8S9VY9L7TjYf#Gm2YG
z-|VD;up5!Db5u!-DFQ+d2q7h;$41mUWAv^T({KobA;drs`2S~d#{arNtMW4bXEn7d
z*ivpAbMw5b1bOy7THw4Knn({p3t>SCS+oiHw#|m-Tm)ergxL^Mi^=XyD9ZVF_<bBg
zIfR47q-7Hd^g04fxgWxA2s<Er4szr>T1<&Qk*LjRn%APAKn{f25N1GF0C_ipE*p1}
zUpIrR3<mxf2ucW%CFJkT;3}ygM-5>tgb@$~{{LB=@xLz6syuL&|8b4qFORy)`wEbK
zKY*)z3r(~J!Z#3>l#r+`;3})3IhRAwL(oF_yqL`10<LlmeqVr41>r<7IkE*@<#%Yx
z;}FUr9E7kK<b;B&jQfeSY(dkUmV<lfA!w<akdz<Mml;R)wwSI!cnLwi4?G2e6n?LP
za14GoK-dZ46oeWG4<P(a!~PZ%bD+i47D5Pw7zkq_+y;8hFD<4g5ST+C3xWrPK@id*
zj0O4@i0QY(ooCJ^|JjN%GYTp}fr|fk5dHt))_HFn|F^7nX@T#{^EG+APcSR9<{g^e
z_;o&dCGNmDm`ukcCQ}r|Nf2myFogX;3o)+!8Syp&9ebKg&JcVdBwAuhdpGzRx9>t9
zBG)-!g~{nt)4FNWW_~_9ZN`k0*~Xw!^u0Lp)H;*t0)!h7?m+k(!fOa3Vlqh~ctP-o
z5DFmz!XO9-vB@+8la_-hIAhNylgR)<3qcJ*2|*5lfl%|k$y5%(06_~u4M7P(4&laT
zlj#VAO%N7A7!M%|LPrQKkav^;%7fqq;Wf}chnV@^WUAT-`2fE`%YeDA@E0`KjllHR
znRr*DN$3#CtVXi<k{*l}U`9{>f&bt@o{=($xuX*3W+MCpZ>5+vj2&~wmDN(3l>P(%
z?Spxg@=M7r5C`wGUcjL=N+1Kzp;-3LpJeGdbg6s!P$5%iArFHQ!?cA=36{cBE%XYA
zDZMvYbsot)pD6?#Mp)ommTZ^EQ3{{<^L-UJ0vlCPO&*;`D_J-UU;JNm+_Slhzy{x#
zYN;R_`VagkArmfuluh9RJjDu5C942Nab)`i6x;pb0D%ksOqG^qZWS_ZkVOZZ_vyZ*
z(?t+oGEjh}R`577jKYhR0<5rtw~<T=$5?VJt>DgN7lpsEl$~S+v*Z@Q@eywX;c6@R
z-fMwA#fo0;h|E<>x1w(%11~{omn^z!t>9^77KP(}6{O}_!CvGCfa4=9xeZqE6*s|d
z+pOsG+6nX$YdS&j=j~7g@w^Of7C|P^R0)}X8HJ&VWIIINx5NsXG}*r2B!62xy4i|u
zN9?blFwaXdLbiF_``OfF7{K7znOC5i(H5=~R$Ly&T~|;B0v)<vqimxEVJAfI3tL1c
zQ21L5%!uEICz4eF$48G9az|LfuPyXAEBYb}J>80aj69;HdHhEZx6KN!A)WpJ*ngY=
z*I2<j$S?{ow7?#A@9VmpWKy`=0w-C)5o8yIw|y!IUt$HHAh!UHA3t7z;foiu@3nTT
zhZcIZ6@6T?z~5{|my&_kp|m=+088!P7gs}OQ8>gXz;Y`%g#7R>tgwQokaO?CN-H>o
zpg-Rcp7bxc`@69EU+{!?;q-sOtKNmR|ALRc3+Md{e)KME_!r#i#ygsq{0koTE?oXE
zIP+b&`d{#_cj20U!MEOpoBjp2xe2PBu(TK>dA~tJ$Uq9WHmLMp@T{9C8TBCNfQyxk
zH{QF6L<rsqKdOOrjoK)=g*qa1iFCP*zJ!y)A8x~7GM3z>(IL{k7N)M26J$XxJUCX8
zqqQIk{{C?tfXB(yI>_NhZq>n<kVx9pgBFWU32wE->3t=KlYwUVv;db|!EMPb3J*FX
zz;@2>=l+8HK;b3}th9o?$T@)Hk5>t~=UKteEOdhv-M3ocFR`MpA>A9Gv^(bn_>L9q
zO(sxSdtQJ&T;A7p3t0s)yp7%7fXY0hF9}>rthi2)%to-<D6)%2;pA2$h-|nbFe{|*
zi*zP!?tsX0(&Y{?N02c>lzRsnLrw0&vj_Am>3$c5dEL1xNQh|jzJ!-o$%4CZO4yNX
z2R2XjHGyrL728bm2w=33bh-ym1&5Pe_n_ElauTl3&>qs}KBU@`F83joL}t;H7s<U3
zKEM$408(EN&j%>kYl)LEdB$0mN38=H+#IidfG&Bpbr$gbR``yu$>P6IX!m9dy~zq!
zSmwu8yj3nNxBf!1jMXlJSUU?_E3B0Ybg31cDHZ6gVq5v+EPN4G{H^kpR`gA6%yL*J
zj&y$rdW^Qh6_#@5S<ze5+W!ZAn-!gn74$8!qWi}S^b-O-<Dd1|Xv?~x+A2epMbH&1
zdW40)$%-Cm;b$y(tD%O+2?ck4kDkFWNtO()0$Vd|+b?8jRjifnVWH1^PY}agv80z+
z(e(*}oL0P5&K)Wz8djuttTHrP3TU>X+Z_-D*}1>pUF2j}6OwgWV<{)e3O@9akZlU-
z{s<a8-3mTo$u`f5e#MerVnsh_;Wt>(XIP49&DUDZB^Isk2>g-%H28W8&}=2B#6tIw
zy<g30@&na>y@fp53Kk6!s;Rc32U_TPR`k^20)MN#R(+)h1$vDY|N3!edIodH3h?+;
z$k1d(KPF^g<R0(W!(T1%cebL>w9pk+^hgVRw3$Br?G7exq9ACBRfati1bUto-Pb~2
zZ$(#F=+##Ab)?f{FgRS3nOAsH&-d#g{Ys#FSkcE?=t?X4!-WEWoE5$I*8)Asif&0~
zFr)u(fKgk~(=F*KR&;|U-HNxiwAMnOXT?8JD<~x3PHzof@(Uub9;0qvgR%vV604l$
zzmTy{P)E;ZulG%*xFF1640-efW=^~I@53IJMUWK!R}BDrSi!9ueK{Eha7Je<_>N_F
zq_Cp5nkT}F-g*w8w4(R!DJU6dMW4b5+9nC~vHx`7gziFy(N-DmSa$bnD|+i$!W1j|
zJYS)JbTaT6ER5z^!L1ultrh){rT8UQ^wy(^Jn{n-x84fY!rwrLL6<RD(JxuVZL^}M
zTdH3|&~vc<ek-{3D5Knpe#g?LC#>l5B%%0fE4tL8))gzdorPW_(BE2riUqi1l|gCI
zx5<j0ZsBjXqDw8?fACGH-yl2q6Zh0St(`<_*#}Fl=&dI_9#-_~KMSi_78#XC(J=8|
zKXwR0tZ^1%Wv)h;^3|NLN14!fp0=3MXhBT5kmk$@hH3hRBzUpo>G6#h8^&fKaxNE*
VvZ?W8$vKua(Q~j+qV{Ix{~t2jmlXg2

diff --git a/roms/opensbi b/roms/opensbi
index 2552799a1d..057eb10b6d 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
+Subproject commit 057eb10b6d523540012e6947d5c9f63e95244e94

From 736a1588c104e9995c1831df33554df1f1def8b8 Mon Sep 17 00:00:00 2001
From: Jordan Niethe <jniethe5@gmail.com>
Date: Mon, 17 Jul 2023 19:30:01 +1000
Subject: [PATCH 0884/1353] tcg/ppc: Fix race in goto_tb implementation

Commit 20b6643324 ("tcg/ppc: Reorg goto_tb implementation") modified
goto_tb to ensure only a single instruction was patched to prevent
incorrect behavior if a thread was in the middle of multiple
instructions when they were replaced. However this introduced a race
between loading the jmp target into TCG_REG_TB and patching and
executing the direct branch.

The relevant part of the goto_tb implementation:

    ld TCG_REG_TB, TARGET_ADDR_LOCATION(TCG_REG_TB)
  patch_location:
    mtctr TCG_REG_TB
    bctr

tb_target_set_jmp_target() will replace 'patch_location' with a direct
branch if the target is in range. The direct branch now relies on
TCG_REG_TB being set up correctly by the ld. Prior to this commit
multiple instructions were patched in for the direct branch case; these
instructions would initialize TCG_REG_TB to the same value as the branch
target.

Imagine the following sequence:

1) Thread A is executing the goto_tb sequence and loads the jmp
   target into TCG_REG_TB.

2) Thread B updates the jmp target address and calls
   tb_target_set_jmp_target(). This patches a new direct branch into the
   goto_tb sequence.

3) Thread A executes the newly patched direct branch. The value in
   TCG_REG_TB still contains the old jmp target.

TCG_REG_TB MUST contain the translation block's tc.ptr. Execution will
eventually crash after performing memory accesses generated from a
faulty value in TCG_REG_TB.

This presents as segfaults or illegal instruction exceptions.

Do not revert commit 20b6643324 as it did fix a different race
condition. Instead remove the direct branch optimization and always use
indirect branches.

The direct branch optimization can be re-added later with a race free
sequence.

Fixes: 20b6643324 ("tcg/ppc: Reorg goto_tb implementation")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1726
Reported-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com>
Tested-by: Anushree Mathur <anushree.mathur@linux.vnet.ibm.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Co-developed-by: Benjamin Gray <bgray@linux.ibm.com>
Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
Message-Id: <20230717093001.13167-1-jniethe5@gmail.com>
---
 tcg/ppc/tcg-target.c.inc | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index c866f2c997..511e14b180 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -2496,11 +2496,10 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
         ptrdiff_t offset = tcg_tbrel_diff(s, (void *)ptr);
         tcg_out_mem_long(s, LD, LDX, TCG_REG_TB, TCG_REG_TB, offset);
     
-        /* Direct branch will be patched by tb_target_set_jmp_target. */
+        /* TODO: Use direct branches when possible. */
         set_jmp_insn_offset(s, which);
         tcg_out32(s, MTSPR | RS(TCG_REG_TB) | CTR);
 
-        /* When branch is out of range, fall through to indirect. */
         tcg_out32(s, BCCTR | BO_ALWAYS);
 
         /* For the unlinked case, need to reset TCG_REG_TB.  */
@@ -2528,10 +2527,12 @@ void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
     intptr_t diff = addr - jmp_rx;
     tcg_insn_unit insn;
 
+    if (USE_REG_TB) {
+        return;
+    }
+
     if (in_range_b(diff)) {
         insn = B | (diff & 0x3fffffc);
-    } else if (USE_REG_TB) {
-        insn = MTSPR | RS(TCG_REG_TB) | CTR;
     } else {
         insn = NOP;
     }

From 990ef9182b5b7cb63be8da918fe38865b3ab840a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 17 Jul 2023 19:58:58 +0100
Subject: [PATCH 0885/1353] include/exec: Add WITH_MMAP_LOCK_GUARD

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/mmap.c         |  1 +
 include/exec/exec-all.h | 10 ++++++++++
 linux-user/mmap.c       |  1 +
 3 files changed, 12 insertions(+)

diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index aca8764356..74ed00b9fe 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -32,6 +32,7 @@ void mmap_lock(void)
 
 void mmap_unlock(void)
 {
+    assert(mmap_lock_count > 0);
     if (--mmap_lock_count == 0) {
         pthread_mutex_unlock(&mmap_mutex);
     }
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index 5fa0687cd2..d02517e95f 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -629,6 +629,15 @@ void TSA_NO_TSA mmap_lock(void);
 void TSA_NO_TSA mmap_unlock(void);
 bool have_mmap_lock(void);
 
+static inline void mmap_unlock_guard(void *unused)
+{
+    mmap_unlock();
+}
+
+#define WITH_MMAP_LOCK_GUARD()                                            \
+    for (int _mmap_lock_iter __attribute__((cleanup(mmap_unlock_guard)))  \
+         = (mmap_lock(), 0); _mmap_lock_iter == 0; _mmap_lock_iter = 1)
+
 /**
  * adjust_signal_pc:
  * @pc: raw pc from the host signal ucontext_t.
@@ -683,6 +692,7 @@ G_NORETURN void cpu_loop_exit_sigbus(CPUState *cpu, target_ulong addr,
 #else
 static inline void mmap_lock(void) {}
 static inline void mmap_unlock(void) {}
+#define WITH_MMAP_LOCK_GUARD()
 
 void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length);
 void tlb_set_dirty(CPUState *cpu, vaddr addr);
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 44b53bd446..a5dfb56545 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -36,6 +36,7 @@ void mmap_lock(void)
 
 void mmap_unlock(void)
 {
+    assert(mmap_lock_count > 0);
     if (--mmap_lock_count == 0) {
         pthread_mutex_unlock(&mmap_mutex);
     }

From f1ce0b80283e19d5e65a5c2b0b4de6d92ca7f527 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Jul 2023 11:23:06 +0100
Subject: [PATCH 0886/1353] accel/tcg: Fix sense of read-only probes in
 ldst_atomicity

In the initial commit, cdfac37be0d, the sense of the test is incorrect,
as the -1/0 return was confusing.  In bef6f008b981, we mechanically
invert all callers while changing to false/true return, preserving the
incorrectness of the test.

Now that the return sense is sane, it's easy to see that if !write,
then the page is not modifiable (i.e. most likely read-only, with
PROT_NONE handled via SIGSEGV).

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_atomicity.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/ldst_atomicity.c.inc b/accel/tcg/ldst_atomicity.c.inc
index 4de0a80492..de70531a7a 100644
--- a/accel/tcg/ldst_atomicity.c.inc
+++ b/accel/tcg/ldst_atomicity.c.inc
@@ -159,7 +159,7 @@ static uint64_t load_atomic8_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
      * another process, because the fallback start_exclusive solution
      * provides no protection across processes.
      */
-    if (page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
+    if (!page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
         uint64_t *p = __builtin_assume_aligned(pv, 8);
         return *p;
     }
@@ -194,7 +194,7 @@ static Int128 load_atomic16_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
      * another process, because the fallback start_exclusive solution
      * provides no protection across processes.
      */
-    if (page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
+    if (!page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
         return *p;
     }
 #endif

From 2c8412d469707124c6f471822aff2e2cab395907 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 16 Jul 2023 16:54:16 +0000
Subject: [PATCH 0887/1353] accel/tcg: Take mmap_lock in load_atomic*_or_exit

For user-only, the probe for page writability may race with another
thread's mprotect.  Take the mmap_lock around the operation.  This
is still faster than the start/end_exclusive fallback.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_atomicity.c.inc | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/accel/tcg/ldst_atomicity.c.inc b/accel/tcg/ldst_atomicity.c.inc
index de70531a7a..e5c590a499 100644
--- a/accel/tcg/ldst_atomicity.c.inc
+++ b/accel/tcg/ldst_atomicity.c.inc
@@ -159,9 +159,11 @@ static uint64_t load_atomic8_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
      * another process, because the fallback start_exclusive solution
      * provides no protection across processes.
      */
-    if (!page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
-        uint64_t *p = __builtin_assume_aligned(pv, 8);
-        return *p;
+    WITH_MMAP_LOCK_GUARD() {
+        if (!page_check_range(h2g(pv), 8, PAGE_WRITE_ORG)) {
+            uint64_t *p = __builtin_assume_aligned(pv, 8);
+            return *p;
+        }
     }
 #endif
 
@@ -186,25 +188,27 @@ static Int128 load_atomic16_or_exit(CPUArchState *env, uintptr_t ra, void *pv)
         return atomic16_read_ro(p);
     }
 
-#ifdef CONFIG_USER_ONLY
     /*
      * We can only use cmpxchg to emulate a load if the page is writable.
      * If the page is not writable, then assume the value is immutable
      * and requires no locking.  This ignores the case of MAP_SHARED with
      * another process, because the fallback start_exclusive solution
      * provides no protection across processes.
+     *
+     * In system mode all guest pages are writable.  For user mode,
+     * we must take mmap_lock so that the query remains valid until
+     * the write is complete -- tests/tcg/multiarch/munmap-pthread.c
+     * is an example that can race.
      */
-    if (!page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
-        return *p;
-    }
+    WITH_MMAP_LOCK_GUARD() {
+#ifdef CONFIG_USER_ONLY
+        if (!page_check_range(h2g(p), 16, PAGE_WRITE_ORG)) {
+            return *p;
+        }
 #endif
-
-    /*
-     * In system mode all guest pages are writable, and for user-only
-     * we have just checked writability.  Try cmpxchg.
-     */
-    if (HAVE_ATOMIC128_RW) {
-        return atomic16_read_rw(p);
+        if (HAVE_ATOMIC128_RW) {
+            return atomic16_read_rw(p);
+        }
     }
 
     /* Ultimate fallback: re-execute in serial context. */

From 22d2e5351a18aff5a9c7e3984b50ecce61ff8975 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Thu, 20 Jul 2023 00:11:18 +0200
Subject: [PATCH 0888/1353] tcg/{i386, s390x}: Add earlyclobber to the
 op_add2's first output

i386 and s390x implementations of op_add2 require an earlyclobber,
which is currently missing. This breaks VCKSM in s390x guests. E.g., on
x86_64 the following op:

    add2_i32 tmp2,tmp3,tmp2,tmp3,tmp3,tmp2   dead: 0 2 3 4 5  pref=none,0xffff

is translated to:

    addl     %ebx, %r12d
    adcl     %r12d, %ebx

Introduce a new C_N1_O1_I4 constraint, and make sure that earlyclobber
of aliased outputs is honored.

Cc: qemu-stable@nongnu.org
Fixes: 82790a870992 ("tcg: Add markup for output requires new register")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230719221310.1968845-7-iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-con-set.h  | 5 ++++-
 tcg/i386/tcg-target.c.inc      | 2 +-
 tcg/s390x/tcg-target-con-set.h | 8 +++++---
 tcg/s390x/tcg-target.c.inc     | 4 ++--
 tcg/tcg.c                      | 8 +++++++-
 5 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index 91ceb0e1da..5ea3a292f0 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -11,6 +11,9 @@
  *
  * C_N1_Im(...) defines a constraint set with 1 output and <m> inputs,
  * except that the output must use a new register.
+ *
+ * C_Nn_Om_Ik(...) defines a constraint set with <n + m> outputs and <k>
+ * inputs, except that the first <n> outputs must use new registers.
  */
 C_O0_I1(r)
 C_O0_I2(L, L)
@@ -53,4 +56,4 @@ C_O2_I1(r, r, L)
 C_O2_I2(a, d, a, r)
 C_O2_I2(r, r, L, L)
 C_O2_I3(a, d, 0, 1, r)
-C_O2_I4(r, r, 0, 1, re, re)
+C_N1_O1_I4(r, r, 0, 1, re, re)
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index ab997b5fb3..77482da070 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -3335,7 +3335,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i32:
     case INDEX_op_sub2_i64:
-        return C_O2_I4(r, r, 0, 1, re, re);
+        return C_N1_O1_I4(r, r, 0, 1, re, re);
 
     case INDEX_op_ctz_i32:
     case INDEX_op_ctz_i64:
diff --git a/tcg/s390x/tcg-target-con-set.h b/tcg/s390x/tcg-target-con-set.h
index cbad91b2b5..9a42037499 100644
--- a/tcg/s390x/tcg-target-con-set.h
+++ b/tcg/s390x/tcg-target-con-set.h
@@ -8,6 +8,9 @@
  * C_On_Im(...) defines a constraint set with <n> outputs and <m> inputs.
  * Each operand should be a sequence of constraint letters as defined by
  * tcg-target-con-str.h; the constraint combination is inclusive or.
+ *
+ * C_Nn_Om_Ik(...) defines a constraint set with <n + m> outputs and <k>
+ * inputs, except that the first <n> outputs must use new registers.
  */
 C_O0_I1(r)
 C_O0_I2(r, r)
@@ -41,6 +44,5 @@ C_O2_I1(o, m, r)
 C_O2_I2(o, m, 0, r)
 C_O2_I2(o, m, r, r)
 C_O2_I3(o, m, 0, 1, r)
-C_O2_I4(r, r, 0, 1, rA, r)
-C_O2_I4(r, r, 0, 1, ri, r)
-C_O2_I4(r, r, 0, 1, r, r)
+C_N1_O1_I4(r, r, 0, 1, ri, r)
+C_N1_O1_I4(r, r, 0, 1, rA, r)
diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index a878acd8ca..a94f7908d6 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -3229,11 +3229,11 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_add2_i32:
     case INDEX_op_sub2_i32:
-        return C_O2_I4(r, r, 0, 1, ri, r);
+        return C_N1_O1_I4(r, r, 0, 1, ri, r);
 
     case INDEX_op_add2_i64:
     case INDEX_op_sub2_i64:
-        return C_O2_I4(r, r, 0, 1, rA, r);
+        return C_N1_O1_I4(r, r, 0, 1, rA, r);
 
     case INDEX_op_st_vec:
         return C_O0_I2(v, r);
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 652e8ea6b9..ddfe9a96cb 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -648,6 +648,7 @@ static void tcg_out_movext3(TCGContext *s, const TCGMovExtend *i1,
 #define C_O2_I2(O1, O2, I1, I2)         C_PFX4(c_o2_i2_, O1, O2, I1, I2),
 #define C_O2_I3(O1, O2, I1, I2, I3)     C_PFX5(c_o2_i3_, O1, O2, I1, I2, I3),
 #define C_O2_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_o2_i4_, O1, O2, I1, I2, I3, I4),
+#define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_n1_o1_i4_, O1, O2, I1, I2, I3, I4),
 
 typedef enum {
 #include "tcg-target-con-set.h"
@@ -668,6 +669,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode);
 #undef C_O2_I2
 #undef C_O2_I3
 #undef C_O2_I4
+#undef C_N1_O1_I4
 
 /* Put all of the constraint sets into an array, indexed by the enum. */
 
@@ -687,6 +689,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode);
 #define C_O2_I2(O1, O2, I1, I2)         { .args_ct_str = { #O1, #O2, #I1, #I2 } },
 #define C_O2_I3(O1, O2, I1, I2, I3)     { .args_ct_str = { #O1, #O2, #I1, #I2, #I3 } },
 #define C_O2_I4(O1, O2, I1, I2, I3, I4) { .args_ct_str = { #O1, #O2, #I1, #I2, #I3, #I4 } },
+#define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) { .args_ct_str = { "&" #O1, #O2, #I1, #I2, #I3, #I4 } },
 
 static const TCGTargetOpDef constraint_sets[] = {
 #include "tcg-target-con-set.h"
@@ -706,6 +709,7 @@ static const TCGTargetOpDef constraint_sets[] = {
 #undef C_O2_I2
 #undef C_O2_I3
 #undef C_O2_I4
+#undef C_N1_O1_I4
 
 /* Expand the enumerator to be returned from tcg_target_op_def(). */
 
@@ -725,6 +729,7 @@ static const TCGTargetOpDef constraint_sets[] = {
 #define C_O2_I2(O1, O2, I1, I2)         C_PFX4(c_o2_i2_, O1, O2, I1, I2)
 #define C_O2_I3(O1, O2, I1, I2, I3)     C_PFX5(c_o2_i3_, O1, O2, I1, I2, I3)
 #define C_O2_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_o2_i4_, O1, O2, I1, I2, I3, I4)
+#define C_N1_O1_I4(O1, O2, I1, I2, I3, I4) C_PFX6(c_n1_o1_i4_, O1, O2, I1, I2, I3, I4)
 
 #include "tcg-target.c.inc"
 
@@ -4703,7 +4708,8 @@ static void tcg_reg_alloc_op(TCGContext *s, const TCGOp *op)
                  * dead after the instruction, we must allocate a new
                  * register and move it.
                  */
-                if (temp_readonly(ts) || !IS_DEAD_ARG(i)) {
+                if (temp_readonly(ts) || !IS_DEAD_ARG(i)
+                    || def->args_ct[arg_ct->alias_index].newreg) {
                     allocate_new_reg = true;
                 } else if (ts->val_type == TEMP_VAL_REG) {
                     /*

From 8c605cf1d4d9a39a6953086bacddefb0583d91d7 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Thu, 13 Jul 2023 14:07:46 +0200
Subject: [PATCH 0889/1353] accel/tcg: Zero-pad vaddr in tlb_debug output

In replacing target_ulong with vaddr and TARGET_FMT_lx with VADDR_PRIx,
the zero-padding of TARGET_FMT_lx got lost.  Readd 16-wide zero-padding
for logging consistency.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20230713120746.26897-1-anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index e0079c9a9d..ba44501a7c 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -497,8 +497,8 @@ static void tlb_flush_page_locked(CPUArchState *env, int midx, vaddr page)
 
     /* Check if we need to flush due to large pages.  */
     if ((page & lp_mask) == lp_addr) {
-        tlb_debug("forcing full flush midx %d (%"
-                  VADDR_PRIx "/%" VADDR_PRIx ")\n",
+        tlb_debug("forcing full flush midx %d (%016"
+                  VADDR_PRIx "/%016" VADDR_PRIx ")\n",
                   midx, lp_addr, lp_mask);
         tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
     } else {
@@ -527,7 +527,7 @@ static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
 
     assert_cpu_is_self(cpu);
 
-    tlb_debug("page addr: %" VADDR_PRIx " mmu_map:0x%x\n", addr, idxmap);
+    tlb_debug("page addr: %016" VADDR_PRIx " mmu_map:0x%x\n", addr, idxmap);
 
     qemu_spin_lock(&env_tlb(env)->c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
@@ -591,7 +591,7 @@ static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
 
 void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr, uint16_t idxmap)
 {
-    tlb_debug("addr: %" VADDR_PRIx " mmu_idx:%" PRIx16 "\n", addr, idxmap);
+    tlb_debug("addr: %016" VADDR_PRIx " mmu_idx:%" PRIx16 "\n", addr, idxmap);
 
     /* This should already be page aligned */
     addr &= TARGET_PAGE_MASK;
@@ -625,7 +625,7 @@ void tlb_flush_page(CPUState *cpu, vaddr addr)
 void tlb_flush_page_by_mmuidx_all_cpus(CPUState *src_cpu, vaddr addr,
                                        uint16_t idxmap)
 {
-    tlb_debug("addr: %" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
+    tlb_debug("addr: %016" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
     addr &= TARGET_PAGE_MASK;
@@ -666,7 +666,7 @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                               vaddr addr,
                                               uint16_t idxmap)
 {
-    tlb_debug("addr: %" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
+    tlb_debug("addr: %016" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
 
     /* This should already be page aligned */
     addr &= TARGET_PAGE_MASK;
@@ -728,7 +728,7 @@ static void tlb_flush_range_locked(CPUArchState *env, int midx,
      */
     if (mask < f->mask || len > f->mask) {
         tlb_debug("forcing full flush midx %d ("
-                  "%" VADDR_PRIx "/%" VADDR_PRIx "+%" VADDR_PRIx ")\n",
+                  "%016" VADDR_PRIx "/%016" VADDR_PRIx "+%016" VADDR_PRIx ")\n",
                   midx, addr, mask, len);
         tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
         return;
@@ -741,7 +741,7 @@ static void tlb_flush_range_locked(CPUArchState *env, int midx,
      */
     if (((addr + len - 1) & d->large_page_mask) == d->large_page_addr) {
         tlb_debug("forcing full flush midx %d ("
-                  "%" VADDR_PRIx "/%" VADDR_PRIx ")\n",
+                  "%016" VADDR_PRIx "/%016" VADDR_PRIx ")\n",
                   midx, d->large_page_addr, d->large_page_mask);
         tlb_flush_one_mmuidx_locked(env, midx, get_clock_realtime());
         return;
@@ -773,7 +773,7 @@ static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
 
     assert_cpu_is_self(cpu);
 
-    tlb_debug("range: %" VADDR_PRIx "/%u+%" VADDR_PRIx " mmu_map:0x%x\n",
+    tlb_debug("range: %016" VADDR_PRIx "/%u+%016" VADDR_PRIx " mmu_map:0x%x\n",
               d.addr, d.bits, d.len, d.idxmap);
 
     qemu_spin_lock(&env_tlb(env)->c.lock);
@@ -1165,7 +1165,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
                                                 &xlat, &sz, full->attrs, &prot);
     assert(sz >= TARGET_PAGE_SIZE);
 
-    tlb_debug("vaddr=%" VADDR_PRIx " paddr=0x" HWADDR_FMT_plx
+    tlb_debug("vaddr=%016" VADDR_PRIx " paddr=0x" HWADDR_FMT_plx
               " prot=%x idx=%d\n",
               addr, full->phys_addr, prot, mmu_idx);
 

From 32b120394c578bc824f1db4835b3bffbeca88fae Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sun, 23 Jul 2023 18:31:58 +0100
Subject: [PATCH 0890/1353] accel/tcg: Fix type of 'last' for
 pageflags_{find,next}

These should match 'start' as target_ulong, not target_long.

On 32bit targets, the parameter was sign-extended to uint64_t,
so only the first mmap within the upper 2GB memory can succeed.

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Message-Id: <327460e2-0ebd-9edb-426b-1df80d16c32a@bonslack.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index ac38c2bf96..ab48cb41e4 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -144,7 +144,7 @@ typedef struct PageFlagsNode {
 
 static IntervalTreeRoot pageflags_root;
 
-static PageFlagsNode *pageflags_find(target_ulong start, target_long last)
+static PageFlagsNode *pageflags_find(target_ulong start, target_ulong last)
 {
     IntervalTreeNode *n;
 
@@ -153,7 +153,7 @@ static PageFlagsNode *pageflags_find(target_ulong start, target_long last)
 }
 
 static PageFlagsNode *pageflags_next(PageFlagsNode *p, target_ulong start,
-                                     target_long last)
+                                     target_ulong last)
 {
     IntervalTreeNode *n;
 

From 761b0aa9381e2f755b9b594f7f3033d564561751 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:15:54 +0200
Subject: [PATCH 0891/1353] target/s390x: Make CKSM raise an exception if R2 is
 odd

R2 designates an even-odd register pair; the instruction should raise
a specification exception when R2 is not even.

Cc: qemu-stable@nongnu.org
Fixes: e023e832d0ac ("s390x: translate engine for s390x CPU")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-2-iii@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/insn-data.h.inc | 2 +-
 target/s390x/tcg/translate.c     | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/s390x/tcg/insn-data.h.inc b/target/s390x/tcg/insn-data.h.inc
index 457ed25d2f..86a509b0ac 100644
--- a/target/s390x/tcg/insn-data.h.inc
+++ b/target/s390x/tcg/insn-data.h.inc
@@ -157,7 +157,7 @@
     C(0xb2fa, NIAI,    E,     EH,  0, 0, 0, 0, 0, 0)
 
 /* CHECKSUM */
-    C(0xb241, CKSM,    RRE,   Z,   r1_o, ra2, new, r1_32, cksm, 0)
+    C(0xb241, CKSM,    RRE,   Z,   r1_o, ra2_E, new, r1_32, cksm, 0)
 
 /* COPY SIGN */
     F(0xb372, CPSDR,   RRF_b, FPSSH, f3, f2, new, f1, cps, 0, IF_AFP1 | IF_AFP2 | IF_AFP3)
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 6661b27efa..d6e8acee99 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -5779,6 +5779,12 @@ static void in2_ra2(DisasContext *s, DisasOps *o)
 }
 #define SPEC_in2_ra2 0
 
+static void in2_ra2_E(DisasContext *s, DisasOps *o)
+{
+    return in2_ra2(s, o);
+}
+#define SPEC_in2_ra2_E SPEC_r2_even
+
 static void in2_a2(DisasContext *s, DisasOps *o)
 {
     int x2 = have_field(s, x2) ? get_field(s, x2) : 0;

From 4b6e4c0b8223681ae85462794848db4386de1a8d Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:15:55 +0200
Subject: [PATCH 0892/1353] target/s390x: Fix CLM with M3=0

When the mask is zero, access exceptions should still be recognized for
1 byte at the second-operand address. CC should be set to 0.

Cc: qemu-stable@nongnu.org
Fixes: defb0e3157af ("s390x: Implement opcode helpers")
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/mem_helper.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index f417fb1183..84103251b9 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -667,6 +667,11 @@ uint32_t HELPER(clm)(CPUS390XState *env, uint32_t r1, uint32_t mask,
     HELPER_LOG("%s: r1 0x%x mask 0x%x addr 0x%" PRIx64 "\n", __func__, r1,
                mask, addr);
 
+    if (!mask) {
+        /* Recognize access exceptions for the first byte */
+        probe_read(env, addr, 1, cpu_mmu_index(env, false), ra);
+    }
+
     while (mask) {
         if (mask & 8) {
             uint8_t d = cpu_ldub_data_ra(env, addr, ra);

From 53684e344a27da770acc9012740334154ddea24f Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:15:56 +0200
Subject: [PATCH 0893/1353] target/s390x: Fix CONVERT TO LOGICAL/FIXED with
 out-of-range inputs

CONVERT TO LOGICAL/FIXED deviate from IEEE 754 in that they raise an
inexact exception on out-of-range inputs. float_flag_invalid_cvti
aligns nicely with that behavior, so convert it to
S390_IEEE_MASK_INEXACT.

Cc: qemu-stable@nongnu.org
Fixes: defb0e3157af ("s390x: Implement opcode helpers")
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/fpu_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/s390x/tcg/fpu_helper.c b/target/s390x/tcg/fpu_helper.c
index 4b7fa58af3..3d941ed2d2 100644
--- a/target/s390x/tcg/fpu_helper.c
+++ b/target/s390x/tcg/fpu_helper.c
@@ -52,7 +52,8 @@ uint8_t s390_softfloat_exc_to_ieee(unsigned int exc)
     s390_exc |= (exc & float_flag_divbyzero) ? S390_IEEE_MASK_DIVBYZERO : 0;
     s390_exc |= (exc & float_flag_overflow) ? S390_IEEE_MASK_OVERFLOW : 0;
     s390_exc |= (exc & float_flag_underflow) ? S390_IEEE_MASK_UNDERFLOW : 0;
-    s390_exc |= (exc & float_flag_inexact) ? S390_IEEE_MASK_INEXACT : 0;
+    s390_exc |= (exc & (float_flag_inexact | float_flag_invalid_cvti)) ?
+                S390_IEEE_MASK_INEXACT : 0;
 
     return s390_exc;
 }

From a2025557ed4d8d5e6a4d0dd681717c390f51f5be Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:15:57 +0200
Subject: [PATCH 0894/1353] target/s390x: Fix ICM with M3=0

When the mask is zero, access exceptions should still be recognized for
1 byte at the second-operand address. CC should be set to 0.

Cc: qemu-stable@nongnu.org
Fixes: e023e832d0ac ("s390x: translate engine for s390x CPU")
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-5-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index d6e8acee99..244e61ad2e 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -2515,6 +2515,12 @@ static DisasJumpType op_icm(DisasContext *s, DisasOps *o)
         ccm = ((1ull << len) - 1) << pos;
         break;
 
+    case 0:
+        /* Recognize access exceptions for the first byte.  */
+        tcg_gen_qemu_ld_i64(tmp, o->in2, get_mem_index(s), MO_UB);
+        gen_op_movi_cc(s, 0);
+        return DISAS_NEXT;
+
     default:
         /* This is going to be a sequence of loads and inserts.  */
         pos = base + 32 - 8;

From 9c028c057adce49304c6e4a51f6b426bd4f8f6b8 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:15:58 +0200
Subject: [PATCH 0895/1353] target/s390x: Make MC raise specification exception
 when class >= 16

MC requires bit positions 8-11 (upper 4 bits of class) to be zeros,
otherwise it must raise a specification exception.

Cc: qemu-stable@nongnu.org
Fixes: 20d143e2cab8 ("s390x/tcg: Implement MONITOR CALL")
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-6-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/excp_helper.c | 2 +-
 target/s390x/tcg/translate.c   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 228aa9f237..3da337f7c7 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -639,7 +639,7 @@ void monitor_event(CPUS390XState *env,
 void HELPER(monitor_call)(CPUS390XState *env, uint64_t monitor_code,
                           uint32_t monitor_class)
 {
-    g_assert(monitor_class <= 0xff);
+    g_assert(monitor_class <= 0xf);
 
     if (env->cregs[8] & (0x8000 >> monitor_class)) {
         monitor_event(env, monitor_code, monitor_class, GETPC());
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 244e61ad2e..84d76f1cea 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -3177,9 +3177,9 @@ static DisasJumpType op_lcbb(DisasContext *s, DisasOps *o)
 
 static DisasJumpType op_mc(DisasContext *s, DisasOps *o)
 {
-    const uint16_t monitor_class = get_field(s, i2);
+    const uint8_t monitor_class = get_field(s, i2);
 
-    if (monitor_class & 0xff00) {
+    if (monitor_class & 0xf0) {
         gen_program_exception(s, PGM_SPECIFICATION);
         return DISAS_NORETURN;
     }

From ff537b0370ab5918052b8d8a798e803c47272406 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:00 +0200
Subject: [PATCH 0896/1353] target/s390x: Fix assertion failure in VFMIN/VFMAX
 with type 13

Type 13 is reserved, so using it should result in specification
exception. Due to an off-by-1 error the code triggers an assertion at a
later point in time instead.

Cc: qemu-stable@nongnu.org
Fixes: da4807527f3b ("s390x/tcg: Implement VECTOR FP (MAXIMUM|MINIMUM)")
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-8-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate_vx.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/translate_vx.c.inc b/target/s390x/tcg/translate_vx.c.inc
index 43dfbfd03f..f8df121d3d 100644
--- a/target/s390x/tcg/translate_vx.c.inc
+++ b/target/s390x/tcg/translate_vx.c.inc
@@ -3047,7 +3047,7 @@ static DisasJumpType op_vfmax(DisasContext *s, DisasOps *o)
     const uint8_t m5 = get_field(s, m5);
     gen_helper_gvec_3_ptr *fn;
 
-    if (m6 == 5 || m6 == 6 || m6 == 7 || m6 > 13) {
+    if (m6 == 5 || m6 == 6 || m6 == 7 || m6 >= 13) {
         gen_program_exception(s, PGM_SPECIFICATION);
         return DISAS_NORETURN;
     }

From f6044c994a7b43edfdb18daa2b72faebca1ff482 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:01 +0200
Subject: [PATCH 0897/1353] tests/tcg/s390x: Test CKSM

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-9-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/cksm.S                  | 29 +++++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 tests/tcg/s390x/cksm.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index 242c7b0f83..e813e318db 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -16,6 +16,7 @@ LDFLAGS=-nostdlib -static
 
 ASM_TESTS =                                                                    \
     bal                                                                        \
+    cksm                                                                       \
     exrl-ssm-early                                                             \
     sam                                                                        \
     lpsw                                                                       \
diff --git a/tests/tcg/s390x/cksm.S b/tests/tcg/s390x/cksm.S
new file mode 100644
index 0000000000..563fd3d233
--- /dev/null
+++ b/tests/tcg/s390x/cksm.S
@@ -0,0 +1,29 @@
+    .org 0x8e
+program_interruption_code:
+    .org 0x1d0                         /* program new PSW */
+    .quad 0,pgm
+    .org 0x200                         /* lowcore padding */
+    .globl _start
+_start:
+    lmg %r0,%r1,cksm_args
+    cksm %r2,%r0
+    c %r2,cksm_exp
+    jne failure
+    .insn rre,0xb2410000,%r2,%r15      /* cksm %r2,%r15 */
+failure:
+    lpswe failure_psw
+pgm:
+    chhsi program_interruption_code,6  /* specification exception? */
+    jne failure
+    lpswe success_psw
+cksm_args:
+    .quad cksm_buf, 16
+cksm_buf:
+    .quad 0xaaaabbbbcccc0000, 0x12345678
+cksm_exp:
+    .long 0x89ab1234
+    .align 8
+success_psw:
+    .quad 0x2000000000000,0xfff        /* see is_special_wait_psw() */
+failure_psw:
+    .quad 0x2000000000000,0            /* disabled wait */

From 372886d2aebe84587a1099f547f938f711d9d163 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:02 +0200
Subject: [PATCH 0898/1353] tests/tcg/s390x: Test CLGEBR and CGEBRA

Add a small test to prevent regressions.

Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-10-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  5 +++++
 tests/tcg/s390x/cgebra.c        | 32 ++++++++++++++++++++++++++++++++
 tests/tcg/s390x/clgebr.c        | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+)
 create mode 100644 tests/tcg/s390x/cgebra.c
 create mode 100644 tests/tcg/s390x/clgebr.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index 19fbbc6e53..71bf39b78d 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -39,12 +39,17 @@ TESTS+=mxdb
 TESTS+=epsw
 TESTS+=larl
 TESTS+=mdeb
+TESTS+=cgebra
+TESTS+=clgebr
 
 cdsg: CFLAGS+=-pthread
 cdsg: LDFLAGS+=-pthread
 
 rxsbg: CFLAGS+=-O2
 
+cgebra: LDFLAGS+=-lm
+clgebr: LDFLAGS+=-lm
+
 include $(S390X_SRC)/pgm-specification.mak
 $(PGM_SPECIFICATION_TESTS): pgm-specification-user.o
 $(PGM_SPECIFICATION_TESTS): LDFLAGS+=pgm-specification-user.o
diff --git a/tests/tcg/s390x/cgebra.c b/tests/tcg/s390x/cgebra.c
new file mode 100644
index 0000000000..f91e10d2d3
--- /dev/null
+++ b/tests/tcg/s390x/cgebra.c
@@ -0,0 +1,32 @@
+/*
+ * Test the CGEBRA instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <fenv.h>
+#include <stdlib.h>
+
+int main(void)
+{
+    float r2 = 1E+300;
+    long long r1;
+    int cc;
+
+    feclearexcept(FE_ALL_EXCEPT);
+    asm("cgebra %[r1],%[m3],%[r2],%[m4]\n"
+        "ipm %[cc]\n"
+        : [r1] "=r" (r1)
+        , [cc] "=r" (cc)
+        : [m3] "i" (5) /* round toward 0 */
+        , [r2] "f" (r2)
+        , [m4] "i" (8) /* bit 0 is set, but must be ignored; XxC is not set */
+        : "cc");
+    cc >>= 28;
+
+    assert(r1 == 0x7fffffffffffffffLL);
+    assert(cc == 3);
+    assert(fetestexcept(FE_ALL_EXCEPT) == (FE_INVALID | FE_INEXACT));
+
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/s390x/clgebr.c b/tests/tcg/s390x/clgebr.c
new file mode 100644
index 0000000000..d491899b56
--- /dev/null
+++ b/tests/tcg/s390x/clgebr.c
@@ -0,0 +1,32 @@
+/*
+ * Test the CLGEBR instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <fenv.h>
+#include <stdlib.h>
+
+int main(void)
+{
+    float r2 = -1;
+    long long r1;
+    int cc;
+
+    feclearexcept(FE_ALL_EXCEPT);
+    asm("clgebr %[r1],%[m3],%[r2],%[m4]\n"
+        "ipm %[cc]\n"
+        : [r1] "=r" (r1)
+        , [cc] "=r" (cc)
+        : [m3] "i" (5) /* round toward 0 */
+        , [r2] "f" (r2)
+        , [m4] "i" (8) /* bit 0 is set, but must be ignored; XxC is not set */
+        : "cc");
+    cc >>= 28;
+
+    assert(r1 == 0);
+    assert(cc == 3);
+    assert(fetestexcept(FE_ALL_EXCEPT) == (FE_INVALID | FE_INEXACT));
+
+    return EXIT_SUCCESS;
+}

From 285a672d29fa1cb602a0cf91efbcf7ba6c951fd9 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:03 +0200
Subject: [PATCH 0899/1353] tests/tcg/s390x: Test CLM

Add a small test to prevent regressions.

Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-11-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/clm.S                   | 29 +++++++++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 tests/tcg/s390x/clm.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index e813e318db..062d8e368a 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -17,6 +17,7 @@ LDFLAGS=-nostdlib -static
 ASM_TESTS =                                                                    \
     bal                                                                        \
     cksm                                                                       \
+    clm                                                                        \
     exrl-ssm-early                                                             \
     sam                                                                        \
     lpsw                                                                       \
diff --git a/tests/tcg/s390x/clm.S b/tests/tcg/s390x/clm.S
new file mode 100644
index 0000000000..17156a81f2
--- /dev/null
+++ b/tests/tcg/s390x/clm.S
@@ -0,0 +1,29 @@
+    .org 0x8e
+program_interruption_code:
+    .org 0x1d0                         /* program new PSW */
+    .quad 0,pgm
+    .org 0x200                         /* lowcore padding */
+    .globl _start
+_start:
+    lgrl %r0,op1
+    clm %r0,6,op2
+    jle failure
+    lgrl %r1,bad_addr
+    clm %r0,0,0(%r1)
+failure:
+    lpswe failure_psw
+pgm:
+    chhsi program_interruption_code,5  /* addressing exception? */
+    jne failure
+    lpswe success_psw
+    .align 8
+op1:
+    .quad 0x1234567887654321
+op2:
+    .quad 0x3456789abcdef012
+bad_addr:
+    .quad 0xffffffff00000000
+success_psw:
+    .quad 0x2000000000000,0xfff        /* see is_special_wait_psw() */
+failure_psw:
+    .quad 0x2000000000000,0            /* disabled wait */

From f383b2f770a49e76d2fce9bc299c9d565ce434bd Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:04 +0200
Subject: [PATCH 0900/1353] tests/tcg/s390x: Test ICM

Add a small test to prevent regressions.

Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-12-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/icm.S                   | 32 +++++++++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 tests/tcg/s390x/icm.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index 062d8e368a..58684d7da7 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -19,6 +19,7 @@ ASM_TESTS =                                                                    \
     cksm                                                                       \
     clm                                                                        \
     exrl-ssm-early                                                             \
+    icm                                                                        \
     sam                                                                        \
     lpsw                                                                       \
     lpswe-early                                                                \
diff --git a/tests/tcg/s390x/icm.S b/tests/tcg/s390x/icm.S
new file mode 100644
index 0000000000..d24d1f52fb
--- /dev/null
+++ b/tests/tcg/s390x/icm.S
@@ -0,0 +1,32 @@
+    .org 0x8e
+program_interruption_code:
+    .org 0x1d0                         /* program new PSW */
+    .quad 0,pgm
+    .org 0x200                         /* lowcore padding */
+    .globl _start
+_start:
+    lgrl %r0,op1
+    icm %r0,10,op2
+    cg %r0,exp
+    jne failure
+    lgrl %r1,bad_addr
+    icm %r0,0,0(%r1)
+failure:
+    lpswe failure_psw
+pgm:
+    chhsi program_interruption_code,5  /* addressing exception? */
+    jne failure
+    lpswe success_psw
+    .align 8
+op1:
+    .quad 0x1234567887654321
+op2:
+    .quad 0x0011223344556677
+exp:
+    .quad 0x1234567800651121
+bad_addr:
+    .quad 0xffffffff00000000
+success_psw:
+    .quad 0x2000000000000,0xfff        /* see is_special_wait_psw() */
+failure_psw:
+    .quad 0x2000000000000,0            /* disabled wait */

From eacfe7cbbd990cb9cf9978f0aedc308c2ab0ffd6 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:05 +0200
Subject: [PATCH 0901/1353] tests/tcg/s390x: Test MC

Add a small test to prevent regressions.

Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-13-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/mc.S                    | 56 +++++++++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 tests/tcg/s390x/mc.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index 58684d7da7..145e0bfde1 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -24,6 +24,7 @@ ASM_TESTS =                                                                    \
     lpsw                                                                       \
     lpswe-early                                                                \
     lra                                                                        \
+    mc                                                                         \
     ssm-early                                                                  \
     stosm-early                                                                \
     unaligned-lowcore
diff --git a/tests/tcg/s390x/mc.S b/tests/tcg/s390x/mc.S
new file mode 100644
index 0000000000..e7466bb4b5
--- /dev/null
+++ b/tests/tcg/s390x/mc.S
@@ -0,0 +1,56 @@
+    .org 0x8d
+ilc:
+    .org 0x8e
+program_interruption_code:
+    .org 0x94
+monitor_class:
+    .org 0xb0
+monitor_code:
+    .org 0x150
+program_old_psw:
+    .org 0x1d0                              /* program new PSW */
+    .quad 0x180000000,pgm                   /* 64-bit mode */
+    .org 0x200                              /* lowcore padding */
+    .globl _start
+_start:
+    stctg %c8,%c8,c8                        /* enable only monitor class 1 */
+    mvhhi c8+6,0x4000
+    lctlg %c8,%c8,c8
+mc_nop:
+    mc 123,0
+mc_monitor_event:
+    mc 321,1
+    j failure
+mc_specification:
+    mc 333,16
+    j failure
+pgm:
+    lgrl %r0,program_old_psw+8              /* ilc adjustment */
+    llgc %r1,ilc
+    sgr %r0,%r1
+    larl %r1,mc_monitor_event               /* dispatch based on old PSW */
+    cgrje %r0,%r1,pgm_monitor_event
+    larl %r1,mc_specification
+    cgrje %r0,%r1,pgm_specification
+    j failure
+pgm_monitor_event:
+    chhsi program_interruption_code,0x40    /* monitor event? */
+    jne failure
+    chhsi monitor_class,1                   /* class from mc_monitor_event? */
+    jne failure
+    cghsi monitor_code,321                  /* code from mc_monitor_event? */
+    jne failure
+    j mc_specification                      /* next test */
+pgm_specification:
+    chhsi program_interruption_code,6       /* specification exception? */
+    jne failure
+    lpswe success_psw
+failure:
+    lpswe failure_psw
+    .align 8
+c8:
+    .quad 0
+success_psw:
+    .quad 0x2000000000000,0xfff             /* see is_special_wait_psw() */
+failure_psw:
+    .quad 0x2000000000000,0                 /* disabled wait */

From e11e2fc6fbdd6c08d24926b1e80204f1d0457d38 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:06 +0200
Subject: [PATCH 0902/1353] tests/tcg/s390x: Test STPQ

Add a small test to prevent regressions.

Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-14-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/stpq.S                  | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 tests/tcg/s390x/stpq.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index 145e0bfde1..76345b6e64 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -27,6 +27,7 @@ ASM_TESTS =                                                                    \
     mc                                                                         \
     ssm-early                                                                  \
     stosm-early                                                                \
+    stpq                                                                       \
     unaligned-lowcore
 
 include $(S390X_SRC)/pgm-specification.mak
diff --git a/tests/tcg/s390x/stpq.S b/tests/tcg/s390x/stpq.S
new file mode 100644
index 0000000000..687a52eafa
--- /dev/null
+++ b/tests/tcg/s390x/stpq.S
@@ -0,0 +1,20 @@
+    .org 0x200                         /* lowcore padding */
+    .globl _start
+_start:
+    lgrl %r0,value
+    lgrl %r1,value+8
+    stpq %r0,stored_value
+    clc stored_value(16),value
+    jne failure
+    lpswe success_psw
+failure:
+    lpswe failure_psw
+    .align 16
+value:
+    .quad 0x1234567887654321, 0x8765432112345678
+stored_value:
+    .quad 0, 0
+success_psw:
+    .quad 0x2000000000000,0xfff        /* see is_special_wait_psw() */
+failure_psw:
+    .quad 0x2000000000000,0            /* disabled wait */

From 241ab36c0aa1d02ae1b9f38094b9df0c7e76f497 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 24 Jul 2023 10:16:07 +0200
Subject: [PATCH 0903/1353] tests/tcg/s390x: Test VCKSM

Add a small test to prevent regressions.

Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230724082032.66864-15-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/vcksm.c         | 31 +++++++++++++++++++++++++++++++
 tests/tcg/s390x/vx.h            |  2 ++
 3 files changed, 34 insertions(+)
 create mode 100644 tests/tcg/s390x/vcksm.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index 71bf39b78d..1fc9809907 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -58,6 +58,7 @@ TESTS += $(PGM_SPECIFICATION_TESTS)
 Z13_TESTS=vistr
 Z13_TESTS+=lcbb
 Z13_TESTS+=locfhr
+Z13_TESTS+=vcksm
 $(Z13_TESTS): CFLAGS+=-march=z13 -O2
 TESTS+=$(Z13_TESTS)
 
diff --git a/tests/tcg/s390x/vcksm.c b/tests/tcg/s390x/vcksm.c
new file mode 100644
index 0000000000..452daaae6c
--- /dev/null
+++ b/tests/tcg/s390x/vcksm.c
@@ -0,0 +1,31 @@
+/*
+ * Test the VCKSM instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <stdlib.h>
+#include <string.h>
+#include "vx.h"
+
+int main(void)
+{
+    S390Vector v1;
+    S390Vector v2 = {
+        .d[0] = 0xb2261c8140edce49ULL,
+        .d[1] = 0x387bf5a433af39d1ULL,
+    };
+    S390Vector v3 = {
+        .d[0] = 0x73b03d2c7f9e654eULL,
+        .d[1] = 0x23d74e51fb479877ULL,
+    };
+    S390Vector exp = {.d[0] = 0xdedd7f8eULL, .d[1] = 0ULL};
+
+    asm volatile("vcksm %[v1],%[v2],%[v3]"
+                 : [v1] "=v" (v1.v)
+                 : [v2] "v" (v2.v)
+                 , [v3] "v" (v3.v));
+    assert(memcmp(&v1, &exp, sizeof(v1)) == 0);
+
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/s390x/vx.h b/tests/tcg/s390x/vx.h
index 02e7fd518a..00701dbe35 100644
--- a/tests/tcg/s390x/vx.h
+++ b/tests/tcg/s390x/vx.h
@@ -1,6 +1,8 @@
 #ifndef QEMU_TESTS_S390X_VX_H
 #define QEMU_TESTS_S390X_VX_H
 
+#include <stdint.h>
+
 typedef union S390Vector {
     uint64_t d[2];  /* doubleword */
     uint32_t w[4];  /* word */

From 71a00a5baea0e291a59ae639cbecf54d8cd70abb Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 21 Jul 2023 18:43:46 +0200
Subject: [PATCH 0904/1353] tests/avocado/migration: Remove the malfunctioning
 s390x tests

The tests from tests/avocado/migration.py do not work at all
on s390x - the bios shuts down immediately when it cannot find
a boot disk, so there is nothing left to migrate here. For doing
a proper migration test, we would need a proper payload, but we
already do such tests in the migration *qtest*, so it is unnecessary
to redo such a test here, thus let's simply remove this test.

Message-Id: <20230721164346.10112-1-thuth@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/migration.py | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/tests/avocado/migration.py b/tests/avocado/migration.py
index 8b2ec0e3c4..fdc1d234fb 100644
--- a/tests/avocado/migration.py
+++ b/tests/avocado/migration.py
@@ -134,21 +134,3 @@ class PPC64(MigrationTest):
 
     def test_migration_with_exec(self):
         self.migration_with_exec()
-
-
-@skipUnless('s390x' in os.uname()[4], "host != target")
-class S390X(MigrationTest):
-    """
-    :avocado: tags=arch:s390x
-    :avocado: tags=machine:s390-ccw-virtio
-    :avocado: tags=cpu:qemu
-    """
-
-    def test_migration_with_tcp_localhost(self):
-        self.migration_with_tcp_localhost()
-
-    def test_migration_with_unix(self):
-        self.migration_with_unix()
-
-    def test_migration_with_exec(self):
-        self.migration_with_exec()

From c34ad459926f6c600a55fe6782a27edfa405d60b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 20 Jul 2023 19:53:07 +0200
Subject: [PATCH 0905/1353] target/loongarch: Fix the CSRRD CPUID instruction
 on big endian hosts

The test in tests/avocado/machine_loongarch.py is currently failing
on big endian hosts like s390x. By comparing the traces between running
the QEMU_EFI.fd bios on a s390x and on a x86 host, it's quickly obvious
that the CSRRD instruction for the CPUID is behaving differently. And
indeed: The code currently does a long read (i.e. 64 bit) from the
address that points to the CPUState->cpu_index field (with tcg_gen_ld_tl()
in the trans_csrrd() function). But this cpu_index field is only an "int"
(i.e. 32 bit). While this dirty pointer magic works on little endian hosts,
it of course fails on big endian hosts. Fix it by using a proper helper
function instead.

Message-Id: <20230720175307.854460-1-thuth@redhat.com>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/loongarch/cpu.h                             | 1 +
 target/loongarch/csr_helper.c                      | 9 +++++++++
 target/loongarch/helper.h                          | 1 +
 target/loongarch/insn_trans/trans_privileged.c.inc | 8 +-------
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index ed04027af1..fa371ca8ba 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -342,6 +342,7 @@ typedef struct CPUArchState {
     uint64_t CSR_DBG;
     uint64_t CSR_DERA;
     uint64_t CSR_DSAVE;
+    uint64_t CSR_CPUID;
 
 #ifndef CONFIG_USER_ONLY
     LoongArchTLB  tlb[LOONGARCH_TLB_MAX];
diff --git a/target/loongarch/csr_helper.c b/target/loongarch/csr_helper.c
index 6526367946..55341551a5 100644
--- a/target/loongarch/csr_helper.c
+++ b/target/loongarch/csr_helper.c
@@ -35,6 +35,15 @@ target_ulong helper_csrrd_pgd(CPULoongArchState *env)
     return v;
 }
 
+target_ulong helper_csrrd_cpuid(CPULoongArchState *env)
+{
+    LoongArchCPU *lac = env_archcpu(env);
+
+    env->CSR_CPUID = CPU(lac)->cpu_index;
+
+    return env->CSR_CPUID;
+}
+
 target_ulong helper_csrrd_tval(CPULoongArchState *env)
 {
     LoongArchCPU *cpu = env_archcpu(env);
diff --git a/target/loongarch/helper.h b/target/loongarch/helper.h
index b9de77d926..ffb1e0b0bf 100644
--- a/target/loongarch/helper.h
+++ b/target/loongarch/helper.h
@@ -98,6 +98,7 @@ DEF_HELPER_1(rdtime_d, i64, env)
 #ifndef CONFIG_USER_ONLY
 /* CSRs helper */
 DEF_HELPER_1(csrrd_pgd, i64, env)
+DEF_HELPER_1(csrrd_cpuid, i64, env)
 DEF_HELPER_1(csrrd_tval, i64, env)
 DEF_HELPER_2(csrwr_estat, i64, env, tl)
 DEF_HELPER_2(csrwr_asid, i64, env, tl)
diff --git a/target/loongarch/insn_trans/trans_privileged.c.inc b/target/loongarch/insn_trans/trans_privileged.c.inc
index 02bca7ca23..9c9de090f0 100644
--- a/target/loongarch/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/insn_trans/trans_privileged.c.inc
@@ -99,13 +99,7 @@ static const CSRInfo csr_info[] = {
     CSR_OFF(PWCH),
     CSR_OFF(STLBPS),
     CSR_OFF(RVACFG),
-    [LOONGARCH_CSR_CPUID] = {
-        .offset = (int)offsetof(CPUState, cpu_index)
-                  - (int)offsetof(LoongArchCPU, env),
-        .flags = CSRFL_READONLY,
-        .readfn = NULL,
-        .writefn = NULL
-    },
+    CSR_OFF_FUNCS(CPUID, CSRFL_READONLY, gen_helper_csrrd_cpuid, NULL),
     CSR_OFF_FLAGS(PRCFG1, CSRFL_READONLY),
     CSR_OFF_FLAGS(PRCFG2, CSRFL_READONLY),
     CSR_OFF_FLAGS(PRCFG3, CSRFL_READONLY),

From bd39b7b5f34c2f6b9272bf281ee0324cb07fc3ee Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 24 Jul 2023 10:48:51 +0200
Subject: [PATCH 0906/1353] tests/avocado/machine_s390_ccw_virtio: Skip the
 flaky virtio-gpu test by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The virtio-gpu test is known to be flaky - that's why we also did
not enable the test_s390x_fedora in the gitlab CI. However, a flaky
test can also be annoying when testing locally, so let's rather skip
this subtest by default and start running the test_s390x_fedora test
in the gitlab CI again (since the other things that are tested here
are quite valuable).

Message-Id: <20230724084851.24251-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/avocado/machine_s390_ccw_virtio.py | 51 +++++++++++++-----------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/tests/avocado/machine_s390_ccw_virtio.py b/tests/avocado/machine_s390_ccw_virtio.py
index 78152f2ad1..e7a2a20ba6 100644
--- a/tests/avocado/machine_s390_ccw_virtio.py
+++ b/tests/avocado/machine_s390_ccw_virtio.py
@@ -159,7 +159,6 @@ class S390CCWVirtioMachine(QemuSystemTest):
                                           'MemTotal:         115640 kB')
 
 
-    @skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
     def test_s390x_fedora(self):
 
         """
@@ -229,31 +228,35 @@ class S390CCWVirtioMachine(QemuSystemTest):
         # writing to the framebuffer. Since the PPM is uncompressed, we then
         # can simply read the written "magic bytes" back from the PPM file to
         # check whether the framebuffer is working as expected.
-        self.log.info("Test screendump of virtio-gpu device")
-        exec_command_and_wait_for_pattern(self,
+        # Unfortunately, this test is flaky, so we don't run it by default
+        if os.getenv('QEMU_TEST_FLAKY_TESTS'):
+            self.log.info("Test screendump of virtio-gpu device")
+            exec_command_and_wait_for_pattern(self,
                         'while ! (dmesg | grep gpudrmfb) ; do sleep 1 ; done',
                         'virtio_gpudrmfb frame buffer device')
-        exec_command_and_wait_for_pattern(self,
-            'echo -e "\e[?25l" > /dev/tty0', ':/#')
-        exec_command_and_wait_for_pattern(self, 'for ((i=0;i<250;i++)); do '
-            'echo " The  qu ick  fo x j ump s o ver  a  laz y d og" >> fox.txt;'
-            'done',
-            ':/#')
-        exec_command_and_wait_for_pattern(self,
-            'dd if=fox.txt of=/dev/fb0 bs=1000 oflag=sync,nocache ; rm fox.txt',
-            '12+0 records out')
-        with tempfile.NamedTemporaryFile(suffix='.ppm',
-                                         prefix='qemu-scrdump-') as ppmfile:
-            self.vm.command('screendump', filename=ppmfile.name)
-            ppmfile.seek(0)
-            line = ppmfile.readline()
-            self.assertEqual(line, b"P6\n")
-            line = ppmfile.readline()
-            self.assertEqual(line, b"1280 800\n")
-            line = ppmfile.readline()
-            self.assertEqual(line, b"255\n")
-            line = ppmfile.readline(256)
-            self.assertEqual(line, b"The quick fox jumps over a lazy dog\n")
+            exec_command_and_wait_for_pattern(self,
+                'echo -e "\e[?25l" > /dev/tty0', ':/#')
+            exec_command_and_wait_for_pattern(self, 'for ((i=0;i<250;i++)); do '
+                'echo " The  qu ick  fo x j ump s o ver  a  laz y d og" >> fox.txt;'
+                'done',
+                ':/#')
+            exec_command_and_wait_for_pattern(self,
+                'dd if=fox.txt of=/dev/fb0 bs=1000 oflag=sync,nocache ; rm fox.txt',
+                '12+0 records out')
+            with tempfile.NamedTemporaryFile(suffix='.ppm',
+                                             prefix='qemu-scrdump-') as ppmfile:
+                self.vm.command('screendump', filename=ppmfile.name)
+                ppmfile.seek(0)
+                line = ppmfile.readline()
+                self.assertEqual(line, b"P6\n")
+                line = ppmfile.readline()
+                self.assertEqual(line, b"1280 800\n")
+                line = ppmfile.readline()
+                self.assertEqual(line, b"255\n")
+                line = ppmfile.readline(256)
+                self.assertEqual(line, b"The quick fox jumps over a lazy dog\n")
+        else:
+            self.log.info("Skipped flaky screendump of virtio-gpu device test")
 
         # Hot-plug a virtio-crypto device and see whether it gets accepted
         self.log.info("Test hot-plug virtio-crypto device")

From c6445544d4cea2628fbad3bad09f3d3a03c749d3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 25 Jul 2023 10:56:51 +0100
Subject: [PATCH 0907/1353] hw/arm/smmu: Handle big-endian hosts correctly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The implementation of the SMMUv3 has multiple places where it reads a
data structure from the guest and directly operates on it without
doing a guest-to-host endianness conversion.  Since all SMMU data
structures are little-endian, this means that the SMMU doesn't work
on a big-endian host.  In particular, this causes the Avocado test
  machine_aarch64_virt.py:Aarch64VirtMachine.test_alpine_virt_tcg_gic_max
to fail on an s390x host.

Add appropriate byte-swapping on reads and writes of guest in-memory
data structures so that the device works correctly on big-endian
hosts.

As part of this we constrain queue_read() to operate only on Cmd
structs and queue_write() on Evt structs, because in practice these
are the only data structures the two functions are used with, and we
need to know what the data structure is to be able to byte-swap its
parts correctly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230717132641.764660-1-peter.maydell@linaro.org
Cc: qemu-stable@nongnu.org
---
 hw/arm/smmu-common.c |  3 +--
 hw/arm/smmuv3.c      | 39 +++++++++++++++++++++++++++++++--------
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index 5ab9d45d58..f35ae9aa22 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -216,8 +216,7 @@ static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
     dma_addr_t addr = baseaddr + index * sizeof(*pte);
 
     /* TODO: guarantee 64-bit single-copy atomicity */
-    ret = dma_memory_read(&address_space_memory, addr, pte, sizeof(*pte),
-                          MEMTXATTRS_UNSPECIFIED);
+    ret = ldq_le_dma(&address_space_memory, addr, pte, MEMTXATTRS_UNSPECIFIED);
 
     if (ret != MEMTX_OK) {
         info->type = SMMU_PTW_ERR_WALK_EABT;
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 932f009697..1e9be8e89a 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -102,20 +102,34 @@ static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
     trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
 }
 
-static inline MemTxResult queue_read(SMMUQueue *q, void *data)
+static inline MemTxResult queue_read(SMMUQueue *q, Cmd *cmd)
 {
     dma_addr_t addr = Q_CONS_ENTRY(q);
+    MemTxResult ret;
+    int i;
 
-    return dma_memory_read(&address_space_memory, addr, data, q->entry_size,
-                           MEMTXATTRS_UNSPECIFIED);
+    ret = dma_memory_read(&address_space_memory, addr, cmd, sizeof(Cmd),
+                          MEMTXATTRS_UNSPECIFIED);
+    if (ret != MEMTX_OK) {
+        return ret;
+    }
+    for (i = 0; i < ARRAY_SIZE(cmd->word); i++) {
+        le32_to_cpus(&cmd->word[i]);
+    }
+    return ret;
 }
 
-static MemTxResult queue_write(SMMUQueue *q, void *data)
+static MemTxResult queue_write(SMMUQueue *q, Evt *evt_in)
 {
     dma_addr_t addr = Q_PROD_ENTRY(q);
     MemTxResult ret;
+    Evt evt = *evt_in;
+    int i;
 
-    ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size,
+    for (i = 0; i < ARRAY_SIZE(evt.word); i++) {
+        cpu_to_le32s(&evt.word[i]);
+    }
+    ret = dma_memory_write(&address_space_memory, addr, &evt, sizeof(Evt),
                            MEMTXATTRS_UNSPECIFIED);
     if (ret != MEMTX_OK) {
         return ret;
@@ -298,7 +312,7 @@ static void smmuv3_init_regs(SMMUv3State *s)
 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
                         SMMUEventInfo *event)
 {
-    int ret;
+    int ret, i;
 
     trace_smmuv3_get_ste(addr);
     /* TODO: guarantee 64-bit single-copy atomicity */
@@ -311,6 +325,9 @@ static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
         event->u.f_ste_fetch.addr = addr;
         return -EINVAL;
     }
+    for (i = 0; i < ARRAY_SIZE(buf->word); i++) {
+        le32_to_cpus(&buf->word[i]);
+    }
     return 0;
 
 }
@@ -320,7 +337,7 @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
                        CD *buf, SMMUEventInfo *event)
 {
     dma_addr_t addr = STE_CTXPTR(ste);
-    int ret;
+    int ret, i;
 
     trace_smmuv3_get_cd(addr);
     /* TODO: guarantee 64-bit single-copy atomicity */
@@ -333,6 +350,9 @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
         event->u.f_ste_fetch.addr = addr;
         return -EINVAL;
     }
+    for (i = 0; i < ARRAY_SIZE(buf->word); i++) {
+        le32_to_cpus(&buf->word[i]);
+    }
     return 0;
 }
 
@@ -569,7 +589,7 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
         return -EINVAL;
     }
     if (s->features & SMMU_FEATURE_2LVL_STE) {
-        int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
+        int l1_ste_offset, l2_ste_offset, max_l2_ste, span, i;
         dma_addr_t l1ptr, l2ptr;
         STEDesc l1std;
 
@@ -593,6 +613,9 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
             event->u.f_ste_fetch.addr = l1ptr;
             return -EINVAL;
         }
+        for (i = 0; i < ARRAY_SIZE(l1std.word); i++) {
+            le32_to_cpus(&l1std.word[i]);
+        }
 
         span = L1STD_SPAN(&l1std);
 

From f9540bb1b2d35d2b0f7e831208c5f44854896cd0 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 25 Jul 2023 10:56:51 +0100
Subject: [PATCH 0908/1353] scripts/git-submodule.sh: Don't rely on non-POSIX
 'read' behaviour
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The POSIX definition of the 'read' utility requires that you
specify the variable name to set; omitting the name and
having it default to 'REPLY' is a bashism. If your system
sh is dash, then it will print an error message during build:

qemu/pc-bios/s390-ccw/../../scripts/git-submodule.sh: 106: read: arg count

Specify the variable name explicitly.

Fixes: fdb8fd8cb915647b ("git-submodule: allow partial update of .git-submodule-status")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230720153038.1587196-1-peter.maydell@linaro.org
---
 scripts/git-submodule.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/git-submodule.sh b/scripts/git-submodule.sh
index 335f7f5fdf..bb1222c772 100755
--- a/scripts/git-submodule.sh
+++ b/scripts/git-submodule.sh
@@ -103,7 +103,7 @@ update)
         check_updated $module || echo Updated "$module"
     done
 
-    (while read -r; do
+    (while read -r REPLY; do
         for module in $modules; do
             case $REPLY in
                 *" $module "*) continue 2 ;;

From 5d78893f39caf94c8587141e2219b57a7d63dd5c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 25 Jul 2023 10:56:51 +0100
Subject: [PATCH 0909/1353] target/arm: Special case M-profile in
 debug_helper.c code

A lot of the code called from helper_exception_bkpt_insn() is written
assuming A-profile, but we will also call this helper on M-profile
CPUs when they execute a BKPT insn.  This used to work by accident,
but recent changes mean that we will hit an assert when some of this
code calls down into lower level functions that end up calling
arm_security_space_below_el3(), arm_el_is_aa64(), and other functions
that now explicitly assert that the guest CPU is not M-profile.

Handle M-profile directly to avoid the assertions:
 * in arm_debug_target_el(), M-profile debug exceptions always
   go to EL1
 * in arm_debug_exception_fsr(), M-profile always uses the short
   format FSR (compare commit d7fe699be54b2, though in this case
   the code in arm_v7m_cpu_do_interrupt() does not need to
   look at the FSR value at all)

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1775
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230721143239.1753066-1-peter.maydell@linaro.org
---
 target/arm/debug_helper.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index 8362462a07..abe72e35ae 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -21,6 +21,10 @@ static int arm_debug_target_el(CPUARMState *env)
     bool secure = arm_is_secure(env);
     bool route_to_el2 = false;
 
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return 1;
+    }
+
     if (arm_is_el2_enabled(env)) {
         route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
                        env->cp15.mdcr_el2 & MDCR_TDE;
@@ -434,18 +438,20 @@ static uint32_t arm_debug_exception_fsr(CPUARMState *env)
 {
     ARMMMUFaultInfo fi = { .type = ARMFault_Debug };
     int target_el = arm_debug_target_el(env);
-    bool using_lpae = false;
+    bool using_lpae;
 
-    if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        using_lpae = false;
+    } else if (target_el == 2 || arm_el_is_aa64(env, target_el)) {
         using_lpae = true;
     } else if (arm_feature(env, ARM_FEATURE_PMSA) &&
                arm_feature(env, ARM_FEATURE_V8)) {
         using_lpae = true;
+    } else if (arm_feature(env, ARM_FEATURE_LPAE) &&
+               (env->cp15.tcr_el[target_el] & TTBCR_EAE)) {
+        using_lpae = true;
     } else {
-        if (arm_feature(env, ARM_FEATURE_LPAE) &&
-            (env->cp15.tcr_el[target_el] & TTBCR_EAE)) {
-            using_lpae = true;
-        }
+        using_lpae = false;
     }
 
     if (using_lpae) {

From 9b579543d7b01666218d8ae01561a96757678eb1 Mon Sep 17 00:00:00 2001
From: Sean Estabrooks <sean.estabrooks@gmail.com>
Date: Tue, 25 Jul 2023 10:56:51 +0100
Subject: [PATCH 0910/1353] For curses display, recognize a few more control
 keys

The curses display handles most control-X keys, and translates
them into their corresponding keycode.  Here we recognize
a few that are missing, Ctrl-@ (null), Ctrl-\ (backslash),
Ctrl-] (right bracket), Ctrl-^ (caret), Ctrl-_ (underscore).

Signed-off-by: Sean Estabrooks <sean.estabrooks@gmail.com>
Message-id: CAHyVn3Bh9CRgDuOmf7G7Ngwamu8d4cVozAcB2i4ymnnggBXNmg@mail.gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 ui/curses_keys.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ui/curses_keys.h b/ui/curses_keys.h
index 71e04acdc7..88a2208ed1 100644
--- a/ui/curses_keys.h
+++ b/ui/curses_keys.h
@@ -210,6 +210,12 @@ static const int _curses2keycode[CURSES_CHARS] = {
     ['N' - '@'] = 49 | CNTRL, /* Control + n */
     /* Control + m collides with the keycode for Enter */
 
+    ['@' - '@']  =  3 | CNTRL, /* Control + @ */
+    /* Control + [ collides with the keycode for Escape */
+    ['\\' - '@'] = 43 | CNTRL, /* Control + Backslash */
+    [']' - '@']  = 27 | CNTRL, /* Control + ] */
+    ['^' - '@']  =  7 | CNTRL, /* Control + ^ */
+    ['_' - '@']  = 12 | CNTRL, /* Control + Underscore */
 };
 
 static const int _curseskey2keycode[CURSES_KEYS] = {

From 78cc90346ec680a7f1bb9f138bf7c9654cf526d5 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 25 Jul 2023 10:56:52 +0100
Subject: [PATCH 0911/1353] tests/decode: Suppress "error: " string for
 expected-failure tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "expected failure" tests for decodetree result in the
error messages from decodetree ending up in logs and in
V=1 output:

>>> MALLOC_PERTURB_=226 /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/x86/pyvenv/bin/python3 /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/scripts/decodetree.py --output-null --test-for-error /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/x86/../../tests/decode/err_argset1.decode
――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――― ✀  ――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/x86/../../tests/decode/err_argset1.decode:5: error: duplicate argument "a"
―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
 1/44 qemu:decodetree / err_argset1                OK              0.05s

This then produces false positives when scanning the
logfiles for strings like "error: ".

For the expected-failure tests, make decodetree print
"detected:" instead of "error:".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230720131521.1325905-1-peter.maydell@linaro.org
---
 scripts/decodetree.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/decodetree.py b/scripts/decodetree.py
index a8a6cb69cd..e8b72da3a9 100644
--- a/scripts/decodetree.py
+++ b/scripts/decodetree.py
@@ -134,6 +134,10 @@ def error_with_file(file, lineno, *args):
     global output_file
     global output_fd
 
+    # For the test suite expected-errors case, don't print the
+    # string "error: ", so they don't turn up as false positives
+    # if you grep the meson logs for strings like that.
+    end = 'error: ' if not testforerror else 'detected: '
     prefix = ''
     if file:
         prefix += f'{file}:'
@@ -141,7 +145,7 @@ def error_with_file(file, lineno, *args):
         prefix += f'{lineno}:'
     if prefix:
         prefix += ' '
-    print(prefix, end='error: ', file=sys.stderr)
+    print(prefix, end=end, file=sys.stderr)
     print(*args, file=sys.stderr)
 
     if output_file and output_fd:

From 3b830790151ff231531ef2595793e387dd154efb Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 9 Jul 2023 10:09:50 +0200
Subject: [PATCH 0912/1353] hw/sd/sdhci: Do not force sdhci_mmio_*_ops onto all
 SD controllers

Since commit c0a55a0c9da2 "hw/sd/sdhci: Support big endian SD host controller
interfaces" sdhci_common_realize() forces all SD card controllers to use either
sdhci_mmio_le_ops or sdhci_mmio_be_ops, depending on the "endianness" property.
However, there are device models which use different MMIO ops: TYPE_IMX_USDHC
uses usdhc_mmio_ops and TYPE_S3C_SDHCI uses sdhci_s3c_mmio_ops.

Forcing sdhci_mmio_le_ops breaks SD card handling on the "sabrelite" board, for
example. Fix this by defaulting the io_ops to little endian and switch to big
endian in sdhci_common_realize() only if there is a matchig big endian variant
available.

Fixes: c0a55a0c9da2 ("hw/sd/sdhci: Support big endian SD host controller
interfaces")

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-Id: <20230709080950.92489-1-shentey@gmail.com>
---
 hw/sd/sdhci.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 6811f0f1a8..362c2c86aa 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1382,6 +1382,8 @@ void sdhci_initfn(SDHCIState *s)
 
     s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_raise_insertion_irq, s);
     s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_data_transfer, s);
+
+    s->io_ops = &sdhci_mmio_le_ops;
 }
 
 void sdhci_uninitfn(SDHCIState *s)
@@ -1399,9 +1401,13 @@ void sdhci_common_realize(SDHCIState *s, Error **errp)
 
     switch (s->endianness) {
     case DEVICE_LITTLE_ENDIAN:
-        s->io_ops = &sdhci_mmio_le_ops;
+        /* s->io_ops is little endian by default */
         break;
     case DEVICE_BIG_ENDIAN:
+        if (s->io_ops != &sdhci_mmio_le_ops) {
+            error_setg(errp, "SD controller doesn't support big endianness");
+            return;
+        }
         s->io_ops = &sdhci_mmio_be_ops;
         break;
     default:

From 5fc1a686607a40cbf0aa0b861dd8e9a642813a83 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 14 Jul 2023 12:49:03 +0200
Subject: [PATCH 0913/1353] hw/mips: Improve the default USB settings in the
 loongson3-virt machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's possible to compile QEMU without the USB devices (e.g. when using
"--without-default-devices" as option for the "configure" script).
To be still able to run the loongson3-virt machine in default mode with
such a QEMU binary, we have to check here for the availability of the
OHCI controller first before instantiating the USB devices.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230714104903.284845-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/mips/loongson3_virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index 4018b8c1d3..3ad0a223df 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -447,7 +447,7 @@ static inline void loongson3_virt_devices_init(MachineState *machine,
 
     pci_vga_init(pci_bus);
 
-    if (defaults_enabled()) {
+    if (defaults_enabled() && object_class_by_name("pci-ohci")) {
         pci_create_simple(pci_bus, -1, "pci-ohci");
         usb_create_simple(usb_bus_find(-1), "usb-kbd");
         usb_create_simple(usb_bus_find(-1), "usb-tablet");

From 02388b5925ff2411853bb69e449f1e5da76e12d4 Mon Sep 17 00:00:00 2001
From: Thomas Huth <huth@tuxfamily.org>
Date: Sun, 16 Jul 2023 17:35:19 +0200
Subject: [PATCH 0914/1353] hw/char/escc: Implement loopback mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The firmware of the m68k next-cube machine uses the loopback mode
for self-testing the hardware and currently fails during this step.
By implementing the loopback mode, we can make the firmware pass
to the next step.

Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230716153519.31722-1-huth@tuxfamily.org>
---
 hw/char/escc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/escc.c b/hw/char/escc.c
index 4f3872bfe9..4be66053c1 100644
--- a/hw/char/escc.c
+++ b/hw/char/escc.c
@@ -653,7 +653,9 @@ static void escc_mem_write(void *opaque, hwaddr addr,
         escc_update_irq(s);
         s->tx = val;
         if (s->wregs[W_TXCTRL2] & TXCTRL2_TXEN) { /* tx enabled */
-            if (qemu_chr_fe_backend_connected(&s->chr)) {
+            if (s->wregs[W_MISC2] & MISC2_LCL_LOOP) {
+                serial_receive_byte(s, s->tx);
+            } else if (qemu_chr_fe_backend_connected(&s->chr)) {
                 /*
                  * XXX this blocks entire thread. Rewrite to use
                  * qemu_chr_fe_write and background I/O callbacks

From d4eda549d27b6d0abdaa55a76dd2d0eff7d65bf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Jul 2023 07:52:26 +0200
Subject: [PATCH 0915/1353] target/mips/mxu: Replace magic array size by its
 definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230712060806.82323-2-philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index deb8060a17..b007948a73 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -609,7 +609,7 @@ enum {
 static TCGv mxu_gpr[NUMBER_OF_MXU_REGISTERS - 1];
 static TCGv mxu_CR;
 
-static const char mxuregnames[][4] = {
+static const char mxuregnames[NUMBER_OF_MXU_REGISTERS][4] = {
     "XR1",  "XR2",  "XR3",  "XR4",  "XR5",  "XR6",  "XR7",  "XR8",
     "XR9",  "XR10", "XR11", "XR12", "XR13", "XR14", "XR15", "XCR",
 };

From e37fdc73811dd40ccf1409e1edb9f7403283dd87 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Jul 2023 07:51:44 +0200
Subject: [PATCH 0916/1353] target/mips/mxu: Avoid overrun in gen_mxu_S32SLT()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity reports a potential overrun (CID 1517769):

  Overrunning array "mxu_gpr" of 15 8-byte elements at
  element index 4294967295 (byte offset 34359738367)
  using index "XRb - 1U" (which evaluates to 4294967295).

Use gen_load_mxu_gpr() to safely load MXU registers.

Fixes: ff7936f009 ("target/mips/mxu: Add S32SLT ... insns")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230712060806.82323-3-philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index b007948a73..520747a597 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -2434,8 +2434,12 @@ static void gen_mxu_S32SLT(DisasContext *ctx)
         tcg_gen_movi_tl(mxu_gpr[XRa - 1], 0);
     } else {
         /* the most general case */
-        tcg_gen_setcond_tl(TCG_COND_LT, mxu_gpr[XRa - 1],
-                           mxu_gpr[XRb - 1], mxu_gpr[XRc - 1]);
+        TCGv t0 = tcg_temp_new();
+        TCGv t1 = tcg_temp_new();
+
+        gen_load_mxu_gpr(t0, XRb);
+        gen_load_mxu_gpr(t1, XRc);
+        tcg_gen_setcond_tl(TCG_COND_LT, mxu_gpr[XRa - 1], t0, t1);
     }
 }
 

From fb51df0c8ea4afe17ec9af98d10650a05b36113e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Jul 2023 07:41:32 +0200
Subject: [PATCH 0917/1353] target/mips/mxu: Avoid overrun in gen_mxu_q8adde()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity reports a potential overruns (CID 1517770):

  Overrunning array "mxu_gpr" of 15 8-byte elements at
  element index 4294967295 (byte offset 34359738367)
  using index "XRb - 1U" (which evaluates to 4294967295).

Add a gen_extract_mxu_gpr() helper similar to
gen_load_mxu_gpr() to safely extract MXU registers.

Fixes: eb79951ab6 ("target/mips/mxu: Add Q8ADDE ... insns")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230712060806.82323-4-philmd@linaro.org>
---
 target/mips/tcg/mxu_translate.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/target/mips/tcg/mxu_translate.c b/target/mips/tcg/mxu_translate.c
index 520747a597..e662acd5df 100644
--- a/target/mips/tcg/mxu_translate.c
+++ b/target/mips/tcg/mxu_translate.c
@@ -644,6 +644,16 @@ static inline void gen_store_mxu_gpr(TCGv t, unsigned int reg)
     }
 }
 
+static inline void gen_extract_mxu_gpr(TCGv t, unsigned int reg,
+                                       unsigned int ofs, unsigned int len)
+{
+    if (reg == 0) {
+        tcg_gen_movi_tl(t, 0);
+    } else if (reg <= 15) {
+        tcg_gen_extract_tl(t, mxu_gpr[reg - 1], ofs, len);
+    }
+}
+
 /* MXU control register moves. */
 static inline void gen_load_mxu_cr(TCGv t)
 {
@@ -3004,10 +3014,10 @@ static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
         TCGv t5 = tcg_temp_new();
 
         if (XRa != 0) {
-            tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1], 16, 8);
-            tcg_gen_extract_tl(t1, mxu_gpr[XRc - 1], 16, 8);
-            tcg_gen_extract_tl(t2, mxu_gpr[XRb - 1], 24, 8);
-            tcg_gen_extract_tl(t3, mxu_gpr[XRc - 1], 24, 8);
+            gen_extract_mxu_gpr(t0, XRb, 16, 8);
+            gen_extract_mxu_gpr(t1, XRc, 16, 8);
+            gen_extract_mxu_gpr(t2, XRb, 24, 8);
+            gen_extract_mxu_gpr(t3, XRc, 24, 8);
             if (aptn2 & 2) {
                 tcg_gen_sub_tl(t0, t0, t1);
                 tcg_gen_sub_tl(t2, t2, t3);
@@ -3027,10 +3037,10 @@ static void gen_mxu_q8adde(DisasContext *ctx, bool accumulate)
             tcg_gen_or_tl(t4, t2, t0);
         }
         if (XRd != 0) {
-            tcg_gen_extract_tl(t0, mxu_gpr[XRb - 1], 0, 8);
-            tcg_gen_extract_tl(t1, mxu_gpr[XRc - 1], 0, 8);
-            tcg_gen_extract_tl(t2, mxu_gpr[XRb - 1], 8, 8);
-            tcg_gen_extract_tl(t3, mxu_gpr[XRc - 1], 8, 8);
+            gen_extract_mxu_gpr(t0, XRb, 0, 8);
+            gen_extract_mxu_gpr(t1, XRc, 0, 8);
+            gen_extract_mxu_gpr(t2, XRb, 8, 8);
+            gen_extract_mxu_gpr(t3, XRc, 8, 8);
             if (aptn2 & 1) {
                 tcg_gen_sub_tl(t0, t0, t1);
                 tcg_gen_sub_tl(t2, t2, t3);

From 60a38a3a57befec24a768cbda811d224f1ab89dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Jul 2023 22:42:09 +0200
Subject: [PATCH 0918/1353] target/mips: Pass directory/leaf shift values to
 walk_directory()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We already evaluated directory_shift and leaf_shift in
page_table_walk_refill(), no need to do that again: pass
as argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230717213504.24777-2-philmd@linaro.org>
---
 target/mips/tcg/sysemu/tlb_helper.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/target/mips/tcg/sysemu/tlb_helper.c b/target/mips/tcg/sysemu/tlb_helper.c
index e5e1e9dd3f..e7be649b02 100644
--- a/target/mips/tcg/sysemu/tlb_helper.c
+++ b/target/mips/tcg/sysemu/tlb_helper.c
@@ -623,18 +623,13 @@ static uint64_t get_tlb_entry_layout(CPUMIPSState *env, uint64_t entry,
 
 static int walk_directory(CPUMIPSState *env, uint64_t *vaddr,
         int directory_index, bool *huge_page, bool *hgpg_directory_hit,
-        uint64_t *pw_entrylo0, uint64_t *pw_entrylo1)
+        uint64_t *pw_entrylo0, uint64_t *pw_entrylo1,
+        int directory_shift, int leaf_shift)
 {
     int dph = (env->CP0_PWCtl >> CP0PC_DPH) & 0x1;
     int psn = (env->CP0_PWCtl >> CP0PC_PSN) & 0x3F;
     int hugepg = (env->CP0_PWCtl >> CP0PC_HUGEPG) & 0x1;
     int pf_ptew = (env->CP0_PWField >> CP0PF_PTEW) & 0x3F;
-    int ptew = (env->CP0_PWSize >> CP0PS_PTEW) & 0x3F;
-    int native_shift = (((env->CP0_PWSize >> CP0PS_PS) & 1) == 0) ? 2 : 3;
-    int directory_shift = (ptew > 1) ? -1 :
-            (hugepg && (ptew == 1)) ? native_shift + 1 : native_shift;
-    int leaf_shift = (ptew > 1) ? -1 :
-            (ptew == 1) ? native_shift + 1 : native_shift;
     uint32_t direntry_size = 1 << (directory_shift + 3);
     uint32_t leafentry_size = 1 << (leaf_shift + 3);
     uint64_t entry;
@@ -779,7 +774,8 @@ static bool page_table_walk_refill(CPUMIPSState *env, vaddr address,
     if (gdw > 0) {
         vaddr |= goffset;
         switch (walk_directory(env, &vaddr, pf_gdw, &huge_page, &hgpg_gdhit,
-                               &pw_entrylo0, &pw_entrylo1))
+                               &pw_entrylo0, &pw_entrylo1,
+                               directory_shift, leaf_shift))
         {
         case 0:
             return false;
@@ -795,7 +791,8 @@ static bool page_table_walk_refill(CPUMIPSState *env, vaddr address,
     if (udw > 0) {
         vaddr |= uoffset;
         switch (walk_directory(env, &vaddr, pf_udw, &huge_page, &hgpg_udhit,
-                               &pw_entrylo0, &pw_entrylo1))
+                               &pw_entrylo0, &pw_entrylo1,
+                               directory_shift, leaf_shift))
         {
         case 0:
             return false;
@@ -811,7 +808,8 @@ static bool page_table_walk_refill(CPUMIPSState *env, vaddr address,
     if (mdw > 0) {
         vaddr |= moffset;
         switch (walk_directory(env, &vaddr, pf_mdw, &huge_page, &hgpg_mdhit,
-                               &pw_entrylo0, &pw_entrylo1))
+                               &pw_entrylo0, &pw_entrylo1,
+                               directory_shift, leaf_shift))
         {
         case 0:
             return false;

From 0fe4cac5dda1028c22ec3a6997e1b9155a768004 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 18:29:40 +0200
Subject: [PATCH 0919/1353] target/mips: Avoid shift by negative number in
 page_table_walk_refill()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity points out that in page_table_walk_refill() we can
shift by a negative number, which is undefined behaviour
(CID 1452918, 1452920, 1452922).  We already catch the
negative directory_shift and leaf_shift as being a "bail
out early" case, but not until we've already used them to
calculated some offset values.

The shifts can be negative only if ptew > 1, so make the
bail-out-early check look directly at that, and only
calculate the shift amounts and the offsets based on them
after we have done that check. This allows
us to simplify the expressions used to calculate the
shift amounts, use an unsigned type, and avoids the
undefined behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
[PMD: Check for ptew > 1, use unsigned type]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230717213504.24777-3-philmd@linaro.org>
---
 target/mips/tcg/sysemu/tlb_helper.c | 32 +++++++++++++++--------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/target/mips/tcg/sysemu/tlb_helper.c b/target/mips/tcg/sysemu/tlb_helper.c
index e7be649b02..7dbc2e24c4 100644
--- a/target/mips/tcg/sysemu/tlb_helper.c
+++ b/target/mips/tcg/sysemu/tlb_helper.c
@@ -624,7 +624,7 @@ static uint64_t get_tlb_entry_layout(CPUMIPSState *env, uint64_t entry,
 static int walk_directory(CPUMIPSState *env, uint64_t *vaddr,
         int directory_index, bool *huge_page, bool *hgpg_directory_hit,
         uint64_t *pw_entrylo0, uint64_t *pw_entrylo1,
-        int directory_shift, int leaf_shift)
+        unsigned directory_shift, unsigned leaf_shift)
 {
     int dph = (env->CP0_PWCtl >> CP0PC_DPH) & 0x1;
     int psn = (env->CP0_PWCtl >> CP0PC_PSN) & 0x3F;
@@ -730,21 +730,11 @@ static bool page_table_walk_refill(CPUMIPSState *env, vaddr address,
 
     /* Other HTW configs */
     int hugepg = (env->CP0_PWCtl >> CP0PC_HUGEPG) & 0x1;
-
-    /* HTW Shift values (depend on entry size) */
-    int directory_shift = (ptew > 1) ? -1 :
-            (hugepg && (ptew == 1)) ? native_shift + 1 : native_shift;
-    int leaf_shift = (ptew > 1) ? -1 :
-            (ptew == 1) ? native_shift + 1 : native_shift;
+    unsigned directory_shift, leaf_shift;
 
     /* Offsets into tables */
-    int goffset = gindex << directory_shift;
-    int uoffset = uindex << directory_shift;
-    int moffset = mindex << directory_shift;
-    int ptoffset0 = (ptindex >> 1) << (leaf_shift + 1);
-    int ptoffset1 = ptoffset0 | (1 << (leaf_shift));
-
-    uint32_t leafentry_size = 1 << (leaf_shift + 3);
+    unsigned goffset, uoffset, moffset, ptoffset0, ptoffset1;
+    uint32_t leafentry_size;
 
     /* Starting address - Page Table Base */
     uint64_t vaddr = env->CP0_PWBase;
@@ -766,10 +756,22 @@ static bool page_table_walk_refill(CPUMIPSState *env, vaddr address,
         /* no structure to walk */
         return false;
     }
-    if ((directory_shift == -1) || (leaf_shift == -1)) {
+    if (ptew > 1) {
         return false;
     }
 
+    /* HTW Shift values (depend on entry size) */
+    directory_shift = (hugepg && (ptew == 1)) ? native_shift + 1 : native_shift;
+    leaf_shift = (ptew == 1) ? native_shift + 1 : native_shift;
+
+    goffset = gindex << directory_shift;
+    uoffset = uindex << directory_shift;
+    moffset = mindex << directory_shift;
+    ptoffset0 = (ptindex >> 1) << (leaf_shift + 1);
+    ptoffset1 = ptoffset0 | (1 << (leaf_shift));
+
+    leafentry_size = 1 << (leaf_shift + 3);
+
     /* Global Directory */
     if (gdw > 0) {
         vaddr |= goffset;

From ca4d5d862df43630381647552725eaf1099033b8 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 17 Jul 2023 11:35:44 +0100
Subject: [PATCH 0920/1353] target/sparc: Handle FPRS correctly on big-endian
 hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In CPUSparcState we define the fprs field as uint64_t.  However we
then refer to it in translate.c via a TCGv_i32 which we set up with
tcg_global_mem_new_ptr().  This means that on a big-endian host when
the guest does something to writo te the FPRS register this value
ends up in the wrong half of the uint64_t, and the QEMU C code that
refers to env->fprs sees the wrong value.  The effect of this is that
guest code that enables the FPU crashes with spurious FPU Disabled
exceptions.  In particular, this is why
 tests/avocado/machine_sparc64_sun4u.py:Sun4uMachine.test_sparc64_sun4u
times out on an s390 host.

There are multiple ways we could fix this; since there are actually
only three bits in the FPRS register and the code in translate.c
would be a bit painful to convert to dealing with a TCGv_i64, change
the type of the CPU state struct field to match what translate.c is
expecting.

(None of the other fields referenced by the r32[] array in
sparc_tcg_init() have the wrong type.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20230717103544.637453-1-peter.maydell@linaro.org>
---
 target/sparc/cpu.c     | 4 ++--
 target/sparc/cpu.h     | 2 +-
 target/sparc/machine.c | 3 ++-
 target/sparc/monitor.c | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index e329a7aece..130ab8f578 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -673,8 +673,8 @@ static void sparc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
                  "cleanwin: %d cwp: %d\n",
                  env->cansave, env->canrestore, env->otherwin, env->wstate,
                  env->cleanwin, env->nwindows - 1 - env->cwp);
-    qemu_fprintf(f, "fsr: " TARGET_FMT_lx " y: " TARGET_FMT_lx " fprs: "
-                 TARGET_FMT_lx "\n", env->fsr, env->y, env->fprs);
+    qemu_fprintf(f, "fsr: " TARGET_FMT_lx " y: " TARGET_FMT_lx " fprs: %016x\n",
+                 env->fsr, env->y, env->fprs);
 
 #else
     qemu_fprintf(f, "psr: %08x (icc: ", cpu_get_psr(env));
diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 95d2d0da71..98044572f2 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -521,7 +521,7 @@ struct CPUArchState {
     uint64_t igregs[8]; /* interrupt general registers */
     uint64_t mgregs[8]; /* mmu general registers */
     uint64_t glregs[8 * MAXTL_MAX];
-    uint64_t fprs;
+    uint32_t fprs;
     uint64_t tick_cmpr, stick_cmpr;
     CPUTimer *tick, *stick;
 #define TICK_NPT_MASK        0x8000000000000000ULL
diff --git a/target/sparc/machine.c b/target/sparc/machine.c
index 44b9e7d75d..274e1217df 100644
--- a/target/sparc/machine.c
+++ b/target/sparc/machine.c
@@ -168,7 +168,8 @@ const VMStateDescription vmstate_sparc_cpu = {
         VMSTATE_UINT64_ARRAY(env.bgregs, SPARCCPU, 8),
         VMSTATE_UINT64_ARRAY(env.igregs, SPARCCPU, 8),
         VMSTATE_UINT64_ARRAY(env.mgregs, SPARCCPU, 8),
-        VMSTATE_UINT64(env.fprs, SPARCCPU),
+        VMSTATE_UNUSED(4), /* was unused high half of uint64_t fprs */
+        VMSTATE_UINT32(env.fprs, SPARCCPU),
         VMSTATE_UINT64(env.tick_cmpr, SPARCCPU),
         VMSTATE_UINT64(env.stick_cmpr, SPARCCPU),
         VMSTATE_CPU_TIMER(env.tick, SPARCCPU),
diff --git a/target/sparc/monitor.c b/target/sparc/monitor.c
index 318413686a..73f15aa272 100644
--- a/target/sparc/monitor.c
+++ b/target/sparc/monitor.c
@@ -154,7 +154,7 @@ const MonitorDef monitor_defs[] = {
     { "otherwin", offsetof(CPUSPARCState, otherwin) },
     { "wstate", offsetof(CPUSPARCState, wstate) },
     { "cleanwin", offsetof(CPUSPARCState, cleanwin) },
-    { "fprs", offsetof(CPUSPARCState, fprs) },
+    { "fprs", offsetof(CPUSPARCState, fprs), NULL, MD_I32 },
 #endif
     { NULL },
 };

From f8cfdd2038c1823301e6df753242e465b1dc8539 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Fri, 21 Jul 2023 08:06:05 +0200
Subject: [PATCH 0921/1353] target/tricore: Rename tricore_feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

this name is used by capstone and will lead to a build failure of QEMU,
when capstone is enabled. So we rename it to tricore_has_feature(), to
match has_feature() in translate.c.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1774
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230721060605.76636-1-kbastian@mail.uni-paderborn.de>
---
 target/tricore/cpu.c       | 8 ++++----
 target/tricore/cpu.h       | 2 +-
 target/tricore/helper.c    | 4 ++--
 target/tricore/op_helper.c | 4 ++--
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index f15169bd1b..133a9ac70e 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -104,18 +104,18 @@ static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     /* Some features automatically imply others */
-    if (tricore_feature(env, TRICORE_FEATURE_162)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_162)) {
         set_feature(env, TRICORE_FEATURE_161);
     }
 
-    if (tricore_feature(env, TRICORE_FEATURE_161)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_161)) {
         set_feature(env, TRICORE_FEATURE_16);
     }
 
-    if (tricore_feature(env, TRICORE_FEATURE_16)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_16)) {
         set_feature(env, TRICORE_FEATURE_131);
     }
-    if (tricore_feature(env, TRICORE_FEATURE_131)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_131)) {
         set_feature(env, TRICORE_FEATURE_13);
     }
     cpu_reset(cs);
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index a50b91cc36..3708405be8 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -277,7 +277,7 @@ enum tricore_features {
     TRICORE_FEATURE_162,
 };
 
-static inline int tricore_feature(CPUTriCoreState *env, int feature)
+static inline int tricore_has_feature(CPUTriCoreState *env, int feature)
 {
     return (env->features & (1ULL << feature)) != 0;
 }
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index 951024d491..731a6e9cb6 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -155,7 +155,7 @@ void psw_write(CPUTriCoreState *env, uint32_t val)
 #define FIELD_GETTER_WITH_FEATURE(NAME, REG, FIELD, FEATURE)     \
 uint32_t NAME(CPUTriCoreState *env)                             \
 {                                                                \
-    if (tricore_feature(env, TRICORE_FEATURE_##FEATURE)) {       \
+    if (tricore_has_feature(env, TRICORE_FEATURE_##FEATURE)) {   \
         return FIELD_EX32(env->REG, REG, FIELD ## _ ## FEATURE); \
     }                                                            \
     return FIELD_EX32(env->REG, REG, FIELD ## _13);              \
@@ -170,7 +170,7 @@ uint32_t NAME(CPUTriCoreState *env)         \
 #define FIELD_SETTER_WITH_FEATURE(NAME, REG, FIELD, FEATURE)              \
 void NAME(CPUTriCoreState *env, uint32_t val)                            \
 {                                                                         \
-    if (tricore_feature(env, TRICORE_FEATURE_##FEATURE)) {                \
+    if (tricore_has_feature(env, TRICORE_FEATURE_##FEATURE)) {            \
         env->REG = FIELD_DP32(env->REG, REG, FIELD ## _ ## FEATURE, val); \
     }                                                                     \
     env->REG = FIELD_DP32(env->REG, REG, FIELD ## _13, val);              \
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 821a4b67cb..89be1ed648 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2584,7 +2584,7 @@ void helper_ret(CPUTriCoreState *env)
     /* PCXI = new_PCXI; */
     env->PCXI = new_PCXI;
 
-    if (tricore_feature(env, TRICORE_FEATURE_131)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_131)) {
         /* PSW = {new_PSW[31:26], PSW[25:24], new_PSW[23:0]}; */
         psw_write(env, (new_PSW & ~(0x3000000)) + (psw & (0x3000000)));
     } else { /* TRICORE_FEATURE_13 only */
@@ -2695,7 +2695,7 @@ void helper_rfm(CPUTriCoreState *env)
     env->gpr_a[10] = cpu_ldl_data(env, env->DCX+8);
     env->gpr_a[11] = cpu_ldl_data(env, env->DCX+12);
 
-    if (tricore_feature(env, TRICORE_FEATURE_131)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_131)) {
         env->DBGTCR = 0;
     }
 }

From d8b71d96b336054ac3cd0c9351b0cb75c47281ad Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 14 Jul 2023 14:32:41 +0300
Subject: [PATCH 0922/1353] migration: spelling fixes

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
---
 migration/migration-stats.c | 2 +-
 migration/migration.h       | 4 ++--
 migration/multifd-zlib.c    | 2 +-
 migration/multifd-zstd.c    | 2 +-
 migration/multifd.c         | 2 +-
 migration/savevm.c          | 2 +-
 migration/trace-events      | 2 +-
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/migration/migration-stats.c b/migration/migration-stats.c
index f98c8260be..095d6d75bb 100644
--- a/migration/migration-stats.c
+++ b/migration/migration-stats.c
@@ -48,7 +48,7 @@ uint64_t migration_rate_get(void)
 void migration_rate_set(uint64_t limit)
 {
     /*
-     * 'limit' is per second.  But we check it each BUFER_DELAY miliseconds.
+     * 'limit' is per second.  But we check it each BUFFER_DELAY milliseconds.
      */
     stat64_set(&mig_stats.rate_limit_max, limit / XFER_LIMIT_RATIO);
 }
diff --git a/migration/migration.h b/migration/migration.h
index b7c8b67542..6eea18db36 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -134,7 +134,7 @@ struct MigrationIncomingState {
     /*
      * Always set by the main vm load thread only, but can be read by the
      * postcopy preempt thread.  "volatile" makes sure all reads will be
-     * uptodate across cores.
+     * up-to-date across cores.
      */
     volatile PreemptThreadStatus preempt_thread_status;
     /*
@@ -409,7 +409,7 @@ struct MigrationState {
      *   channel itself.
      *
      * - postcopy preempt channel will be created at the switching phase
-     *   from precopy -> postcopy (to avoid race condtion of misordered
+     *   from precopy -> postcopy (to avoid race condition of misordered
      *   creation of channels).
      *
      * NOTE: See message-id <ZBoShWArKDPpX/D7@work-vm> on qemu-devel
diff --git a/migration/multifd-zlib.c b/migration/multifd-zlib.c
index 81701250ad..37ce48621e 100644
--- a/migration/multifd-zlib.c
+++ b/migration/multifd-zlib.c
@@ -57,7 +57,7 @@ static int zlib_send_setup(MultiFDSendParams *p, Error **errp)
         err_msg = "deflate init failed";
         goto err_free_z;
     }
-    /* This is the maxium size of the compressed buffer */
+    /* This is the maximum size of the compressed buffer */
     z->zbuff_len = compressBound(MULTIFD_PACKET_SIZE);
     z->zbuff = g_try_malloc(z->zbuff_len);
     if (!z->zbuff) {
diff --git a/migration/multifd-zstd.c b/migration/multifd-zstd.c
index d1d29e76cc..b471daadcd 100644
--- a/migration/multifd-zstd.c
+++ b/migration/multifd-zstd.c
@@ -68,7 +68,7 @@ static int zstd_send_setup(MultiFDSendParams *p, Error **errp)
                    p->id, ZSTD_getErrorName(res));
         return -1;
     }
-    /* This is the maxium size of the compressed buffer */
+    /* This is the maximum size of the compressed buffer */
     z->zbuff_len = ZSTD_compressBound(MULTIFD_PACKET_SIZE);
     z->zbuff = g_try_malloc(z->zbuff_len);
     if (!z->zbuff) {
diff --git a/migration/multifd.c b/migration/multifd.c
index 3387d8277f..0e3ae87449 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -878,7 +878,7 @@ static void multifd_new_send_channel_cleanup(MultiFDSendParams *p,
      qemu_sem_post(&p->sem_sync);
      /*
       * Although multifd_send_thread is not created, but main migration
-      * thread neet to judge whether it is running, so we need to mark
+      * thread need to judge whether it is running, so we need to mark
       * its status.
       */
      p->quit = true;
diff --git a/migration/savevm.c b/migration/savevm.c
index 95c2abf47c..51e40e3a0b 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -117,7 +117,7 @@ static struct mig_cmd_args {
  * The format of arguments is depending on postcopy mode:
  * - postcopy RAM only
  *   uint64_t host page size
- *   uint64_t taget page size
+ *   uint64_t target page size
  *
  * - postcopy RAM and postcopy dirty bitmaps
  *   format is the same as for postcopy RAM only
diff --git a/migration/trace-events b/migration/trace-events
index 5259c1044b..4e43fe20fc 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -184,7 +184,7 @@ source_return_path_thread_shut(uint32_t val) "0x%x"
 source_return_path_thread_resume_ack(uint32_t v) "%"PRIu32
 source_return_path_thread_switchover_acked(void) ""
 migration_thread_low_pending(uint64_t pending) "%" PRIu64
-migrate_transferred(uint64_t tranferred, uint64_t time_spent, uint64_t bandwidth, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " max_size %" PRId64
+migrate_transferred(uint64_t transferred, uint64_t time_spent, uint64_t bandwidth, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " max_size %" PRId64
 process_incoming_migration_co_end(int ret, int ps) "ret=%d postcopy-state=%d"
 process_incoming_migration_co_postcopy_end_main(void) ""
 postcopy_preempt_enabled(bool value) "%d"

From cced0d653973f6ad0d9e8bdbd365e12d0f2316f9 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 14 Jul 2023 14:20:07 +0300
Subject: [PATCH 0923/1353] s390x: spelling fixes

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
---
 hw/intc/s390_flic_kvm.c          | 2 +-
 include/hw/s390x/s390-pci-bus.h  | 2 +-
 include/hw/s390x/sclp.h          | 2 +-
 target/s390x/cpu_features.c      | 2 +-
 target/s390x/cpu_models.c        | 2 +-
 target/s390x/tcg/fpu_helper.c    | 2 +-
 target/s390x/tcg/insn-data.h.inc | 2 +-
 target/s390x/tcg/translate.c     | 2 +-
 tests/tcg/s390x/mvc.c            | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/intc/s390_flic_kvm.c b/hw/intc/s390_flic_kvm.c
index 4e86d2d436..28364b22d6 100644
--- a/hw/intc/s390_flic_kvm.c
+++ b/hw/intc/s390_flic_kvm.c
@@ -380,7 +380,7 @@ static void kvm_s390_release_adapter_routes(S390FLICState *fs,
  * @size: ignored
  *
  * Note: Pass buf and len to kernel. Start with one page and
- * increase until buffer is sufficient or maxium size is
+ * increase until buffer is sufficient or maximum size is
  * reached
  */
 static int kvm_flic_save(QEMUFile *f, void *opaque, size_t size,
diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bus.h
index e0a9f9385b..b1bdbeaeb5 100644
--- a/include/hw/s390x/s390-pci-bus.h
+++ b/include/hw/s390x/s390-pci-bus.h
@@ -184,7 +184,7 @@ enum ZpciIoatDtype {
  * The following states make up the "configured" meta-state:
  * disabled: device is configured but not enabled; transition between this
  *           state and enabled via clp enable/disable
- * enbaled: device is ready for use; transition to disabled via clp disable;
+ * enabled: device is ready for use; transition to disabled via clp disable;
  *          may enter an error state
  * blocked: ignore all DMA and interrupts; transition back to enabled or from
  *          error state via mpcifc
diff --git a/include/hw/s390x/sclp.h b/include/hw/s390x/sclp.h
index d3ade40a5a..cf1f2efae2 100644
--- a/include/hw/s390x/sclp.h
+++ b/include/hw/s390x/sclp.h
@@ -87,7 +87,7 @@
  * - we work on a private copy of the SCCB, since there are several length
  *   fields, that would cause a security nightmare if we allow the guest to
  *   alter the structure while we parse it. We cannot use ldl_p and friends
- *   either without doing pointer arithmetics
+ *   either without doing pointer arithmetic
  * So we have to double check that all users of sclp data structures use the
  * right endianness wrappers.
  */
diff --git a/target/s390x/cpu_features.c b/target/s390x/cpu_features.c
index ebb155ce1c..d28eb65845 100644
--- a/target/s390x/cpu_features.c
+++ b/target/s390x/cpu_features.c
@@ -249,7 +249,7 @@ static void init_groups(void)
 {
     int i;
 
-    /* init all bitmaps from gnerated data initially */
+    /* init all bitmaps from generated data initially */
     for (i = 0; i < ARRAY_SIZE(s390_feature_groups); i++) {
         s390_init_feat_bitmap(s390_feature_groups[i].init,
                               s390_feature_groups[i].feat);
diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
index 42b52afdb4..91ce896491 100644
--- a/target/s390x/cpu_models.c
+++ b/target/s390x/cpu_models.c
@@ -975,7 +975,7 @@ static void register_types(void)
 
     init_ignored_base_feat();
 
-    /* init all bitmaps from gnerated data initially */
+    /* init all bitmaps from generated data initially */
     s390_init_feat_bitmap(qemu_max_init, qemu_max_cpu_feat);
     for (i = 0; i < ARRAY_SIZE(s390_cpu_defs); i++) {
         s390_init_feat_bitmap(s390_cpu_defs[i].base_init,
diff --git a/target/s390x/tcg/fpu_helper.c b/target/s390x/tcg/fpu_helper.c
index 3d941ed2d2..c329b31261 100644
--- a/target/s390x/tcg/fpu_helper.c
+++ b/target/s390x/tcg/fpu_helper.c
@@ -87,7 +87,7 @@ static void handle_exceptions(CPUS390XState *env, bool XxC, uintptr_t retaddr)
 
     /*
      * FIXME:
-     * 1. Right now, all inexact conditions are inidicated as
+     * 1. Right now, all inexact conditions are indicated as
      *    "truncated" (0) and never as "incremented" (1) in the DXC.
      * 2. Only traps due to invalid/divbyzero are suppressing. Other traps
      *    are completing, meaning the target register has to be written!
diff --git a/target/s390x/tcg/insn-data.h.inc b/target/s390x/tcg/insn-data.h.inc
index 86a509b0ac..0bfd88d3c3 100644
--- a/target/s390x/tcg/insn-data.h.inc
+++ b/target/s390x/tcg/insn-data.h.inc
@@ -529,7 +529,7 @@
 /* LOAD LOGICAL HALFWORD RELATIVE LONG */
     C(0xc402, LLHRL,   RIL_b, GIE, 0, ri2, new, r1_32, ld16u, 0)
     C(0xc406, LLGHRL,  RIL_b, GIE, 0, ri2, r1, 0, ld16u, 0)
-/* LOAD LOGICAL IMMEDATE */
+/* LOAD LOGICAL IMMEDIATE */
     D(0xc00e, LLIHF,   RIL_a, EI, 0, i2_32u_shl, 0, r1, mov2, 0, 32)
     D(0xc00f, LLILF,   RIL_a, EI, 0, i2_32u_shl, 0, r1, mov2, 0, 0)
     D(0xa50c, LLIHH,   RI_a,  Z,  0, i2_16u_shl, 0, r1, mov2, 0, 48)
diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index 84d76f1cea..dc7041e1d8 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -429,7 +429,7 @@ static void gen_exception(int excp)
 
 static void gen_program_exception(DisasContext *s, int code)
 {
-    /* Remember what pgm exeption this was.  */
+    /* Remember what pgm exception this was.  */
     tcg_gen_st_i32(tcg_constant_i32(code), cpu_env,
                    offsetof(CPUS390XState, int_pgm_code));
 
diff --git a/tests/tcg/s390x/mvc.c b/tests/tcg/s390x/mvc.c
index 7ae4c44550..b572aa3ced 100644
--- a/tests/tcg/s390x/mvc.c
+++ b/tests/tcg/s390x/mvc.c
@@ -85,7 +85,7 @@ int main(void)
         }
     }
 
-    /* test if MVC works now correctly accross page boundaries */
+    /* test if MVC works now correctly across page boundaries */
     mvc_256(dst + 4096 - 128, src + 4096 - 128);
     for (i = 0; i < ALLOC_SIZE; i++) {
         if (src[i] != 0xff) {

From 673d8215415dc0c13e96b8d757102d942916d1b2 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 14 Jul 2023 14:14:49 +0300
Subject: [PATCH 0924/1353] arm: spelling fixes

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 host/include/aarch64/host/cpuinfo.h   | 2 +-
 hw/arm/aspeed.c                       | 2 +-
 hw/arm/mps2-tz.c                      | 2 +-
 hw/intc/arm_gic.c                     | 4 ++--
 hw/intc/arm_gicv3_redist.c            | 2 +-
 hw/intc/armv7m_nvic.c                 | 2 +-
 hw/misc/allwinner-r40-dramc.c         | 2 +-
 hw/misc/exynos4210_rng.c              | 2 +-
 include/hw/arm/fsl-imx7.h             | 2 +-
 include/hw/intc/armv7m_nvic.h         | 2 +-
 target/arm/cpu.c                      | 2 +-
 target/arm/cpu.h                      | 2 +-
 target/arm/cpu64.c                    | 2 +-
 target/arm/helper.c                   | 4 ++--
 target/arm/tcg/m_helper.c             | 2 +-
 target/arm/tcg/translate-a64.c        | 4 ++--
 target/arm/tcg/translate-mve.c        | 4 ++--
 target/arm/tcg/translate-sve.c        | 2 +-
 target/arm/tcg/translate-vfp.c        | 2 +-
 target/arm/tcg/vec_helper.c           | 2 +-
 tests/tcg/aarch64/gdbstub/test-sve.py | 2 +-
 tests/tcg/aarch64/sme-outprod1.c      | 2 +-
 tests/tcg/aarch64/system/boot.S       | 6 +++---
 tests/tcg/aarch64/system/semiheap.c   | 2 +-
 24 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/host/include/aarch64/host/cpuinfo.h b/host/include/aarch64/host/cpuinfo.h
index 05feeb4f43..769626b098 100644
--- a/host/include/aarch64/host/cpuinfo.h
+++ b/host/include/aarch64/host/cpuinfo.h
@@ -1,6 +1,6 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
- * Host specific cpu indentification for AArch64.
+ * Host specific cpu identification for AArch64.
  */
 
 #ifndef HOST_CPUINFO_H
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 6880998484..263626abea 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1565,7 +1565,7 @@ static void ast1030_evb_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
 
-    /* U10 24C08 connects to SDA/SCL Groupt 1 by default */
+    /* U10 24C08 connects to SDA/SCL Group 1 by default */
     uint8_t *eeprom_buf = g_malloc0(32 * 1024);
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50, eeprom_buf);
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 07aecd9497..5873107302 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -1205,7 +1205,7 @@ static void mps2_tz_idau_check(IDAUInterface *ii, uint32_t address,
 {
     /*
      * The MPS2 TZ FPGA images have IDAUs in them which are connected to
-     * the Master Security Controllers. Thes have the same logic as
+     * the Master Security Controllers. These have the same logic as
      * is used by the IoTKit for the IDAU connected to the CPU, except
      * that MSCs don't care about the NSC attribute.
      */
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index 7a34bc0998..074cf50af2 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -239,7 +239,7 @@ static inline bool gic_lr_entry_is_free(uint32_t entry)
 }
 
 /* Return true if this LR should trigger an EOI maintenance interrupt, i.e. the
- * corrsponding bit in EISR is set.
+ * corresponding bit in EISR is set.
  */
 static inline bool gic_lr_entry_is_eoi(uint32_t entry)
 {
@@ -1333,7 +1333,7 @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
 
             /* ??? This currently clears the pending bit for all CPUs, even
                for per-CPU interrupts.  It's unclear whether this is the
-               corect behavior.  */
+               correct behavior.  */
             if (value & (1 << i)) {
                 GIC_DIST_CLEAR_PENDING(irq + i, ALL_CPU_MASK);
             }
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index 297f7f0263..8153525849 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -494,7 +494,7 @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         /* Only the ProcessorSleep bit is writable. When the guest sets
          * it, it requests that we transition the channel between the
          * redistributor and the cpu interface to quiescent, and that
-         * we set the ChildrenAsleep bit once the inteface has reached the
+         * we set the ChildrenAsleep bit once the interface has reached the
          * quiescent state.
          * Setting the ProcessorSleep to 0 reverses the quiescing, and
          * ChildrenAsleep is cleared once the transition is complete.
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index 63afe1fdf5..03b6b8c986 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -894,7 +894,7 @@ int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure)
     vec->active = 0;
     if (vec->level) {
         /* Re-pend the exception if it's still held high; only
-         * happens for extenal IRQs
+         * happens for external IRQs
          */
         assert(irq >= NVIC_FIRST_IRQ);
         vec->pending = 1;
diff --git a/hw/misc/allwinner-r40-dramc.c b/hw/misc/allwinner-r40-dramc.c
index ea6124744f..6944f84455 100644
--- a/hw/misc/allwinner-r40-dramc.c
+++ b/hw/misc/allwinner-r40-dramc.c
@@ -368,7 +368,7 @@ static const MemoryRegionOps allwinner_r40_detect_ops = {
 
 /*
  * mctl_r40_detect_rank_count in u-boot will write the high 1G of DDR
- * to detect wether the board support dual_rank or not. Create a virtual memory
+ * to detect whether the board support dual_rank or not. Create a virtual memory
  * if the board's ram_size less or equal than 1G, and set read time out flag of
  * REG_DRAMCTL_PGSR when the user touch this high dram.
  */
diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
index 1b9e8347a1..9214ec14cc 100644
--- a/hw/misc/exynos4210_rng.c
+++ b/hw/misc/exynos4210_rng.c
@@ -1,5 +1,5 @@
 /*
- *  Exynos4210 Pseudo Random Nubmer Generator Emulation
+ *  Exynos4210 Pseudo Random Number Generator Emulation
  *
  *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
  *
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index 54ea2f0890..fcce6421c8 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -165,7 +165,7 @@ enum FslIMX7MemoryMap {
      * Some versions of the reference manual claim that UART2 is @
      * 0x30870000, but experiments with HW + DT files in upstream
      * Linux kernel show that not to be true and that block is
-     * acutally located @ 0x30890000
+     * actually located @ 0x30890000
      */
     FSL_IMX7_UART2_ADDR           = 0x30890000,
     FSL_IMX7_UART3_ADDR           = 0x30880000,
diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
index 1ca262fbf8..6b4ae566c9 100644
--- a/include/hw/intc/armv7m_nvic.h
+++ b/include/hw/intc/armv7m_nvic.h
@@ -74,7 +74,7 @@ struct NVICState {
      */
     bool vectpending_is_s_banked;
     int exception_prio; /* group prio of the highest prio active exception */
-    int vectpending_prio; /* group prio of the exeception in vectpending */
+    int vectpending_prio; /* group prio of the exception in vectpending */
 
     MemoryRegion sysregmem;
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 69e2bde3c2..93c28d50e5 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -677,7 +677,7 @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
     }
 
     /*
-     * The PSTATE bits only mask the interrupt if we have not overriden the
+     * The PSTATE bits only mask the interrupt if we have not overridden the
      * ability above.
      */
     return unmasked || pstate_unmasked;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 4d6c0f95d5..88e5accda6 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2592,7 +2592,7 @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
     return aa64;
 }
 
-/* Function for determing whether guest cp register reads and writes should
+/* Function for determining whether guest cp register reads and writes should
  * access the secure or non-secure bank of a cp register.  When EL3 is
  * operating in AArch32 state, the NS-bit determines whether the secure
  * instance of a cp register should be used. When EL3 is AArch64 (or if
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 6012e4ef54..96158093cc 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -95,7 +95,7 @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 
         if (kvm_enabled()) {
             /*
-             * For KVM we have to automatically enable all supported unitialized
+             * For KVM we have to automatically enable all supported uninitialized
              * lengths, even when the smaller lengths are not all powers-of-two.
              */
             vq_map |= vq_supported & ~vq_init & vq_mask;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8e836aaee1..50f61e42ca 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1674,7 +1674,7 @@ static void pmevtyper_rawwrite(CPUARMState *env, const ARMCPRegInfo *ri,
      * pmevtyper_rawwrite is called between a pair of pmu_op_start and
      * pmu_op_finish calls when loading saved state for a migration. Because
      * we're potentially updating the type of event here, the value written to
-     * c14_pmevcntr_delta by the preceeding pmu_op_start call may be for a
+     * c14_pmevcntr_delta by the preceding pmu_op_start call may be for a
      * different counter type. Therefore, we need to set this value to the
      * current count for the counter type we're writing so that pmu_op_finish
      * has the correct count for its calculation.
@@ -7009,7 +7009,7 @@ static const ARMCPRegInfo rme_reginfo[] = {
     /*
      * QEMU does not have a way to invalidate by physical address, thus
      * invalidating a range of physical addresses is accomplished by
-     * flushing all tlb entries in the outer sharable domain,
+     * flushing all tlb entries in the outer shareable domain,
      * just like PAALLOS.
      */
     { .name = "TLBI_RPALOS", .state = ARM_CP_STATE_AA64,
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index 9cef70e5c9..0045c18f80 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -148,7 +148,7 @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
      *  R: 0 because unpriv and A flag not set
      *  SRVALID: 0 because NS
      *  MRVALID: 0 because unpriv and A flag not set
-     *  SREGION: 0 becaus SRVALID is 0
+     *  SREGION: 0 because SRVALID is 0
      *  MREGION: 0 because MRVALID is 0
      */
     return 0;
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 7d0c8f79a7..ef0c47407a 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -182,7 +182,7 @@ void gen_a64_update_pc(DisasContext *s, target_long diff)
  *  + for EL2 and EL3 there is only one TBI bit, and if it is set
  *    then the address is zero-extended, clearing bits [63:56]
  *  + for EL0 and EL1, TBI0 controls addresses with bit 55 == 0
- *    and TBI1 controls addressses with bit 55 == 1.
+ *    and TBI1 controls addresses with bit 55 == 1.
  *    If the appropriate TBI bit is set for the address then
  *    the address is sign-extended from bit 55 into bits [63:56]
  *
@@ -2313,7 +2313,7 @@ static void handle_sys(DisasContext *s, bool isread,
 
     if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
         /*
-         * A write to any coprocessor regiser that ends a TB
+         * A write to any coprocessor register that ends a TB
          * must rebuild the hflags for the next TB.
          */
         gen_rebuild_hflags(s);
diff --git a/target/arm/tcg/translate-mve.c b/target/arm/tcg/translate-mve.c
index bbc7b3f4ce..17d8e6804e 100644
--- a/target/arm/tcg/translate-mve.c
+++ b/target/arm/tcg/translate-mve.c
@@ -2182,7 +2182,7 @@ static bool trans_VMOV_to_2gp(DisasContext *s, arg_VMOV_to_2gp *a)
      * execution if it is not in an IT block. For us this means
      * only that if PSR.ECI says we should not be executing the beat
      * corresponding to the lane of the vector register being accessed
-     * then we should skip perfoming the move, and that we need to do
+     * then we should skip performing the move, and that we need to do
      * the usual check for bad ECI state and advance of ECI state.
      * (If PSR.ECI is non-zero then we cannot be in an IT block.)
      */
@@ -2225,7 +2225,7 @@ static bool trans_VMOV_from_2gp(DisasContext *s, arg_VMOV_to_2gp *a)
      * execution if it is not in an IT block. For us this means
      * only that if PSR.ECI says we should not be executing the beat
      * corresponding to the lane of the vector register being accessed
-     * then we should skip perfoming the move, and that we need to do
+     * then we should skip performing the move, and that we need to do
      * the usual check for bad ECI state and advance of ECI state.
      * (If PSR.ECI is non-zero then we cannot be in an IT block.)
      */
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index 8350a65f31..2ba5efadfd 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -1841,7 +1841,7 @@ TRANS_FEAT(PNEXT, aa64_sve, do_pfirst_pnext, a, gen_helper_sve_pnext)
 
 /* Perform an inline saturating addition of a 32-bit value within
  * a 64-bit register.  The second operand is known to be positive,
- * which halves the comparisions we must perform to bound the result.
+ * which halves the comparisons we must perform to bound the result.
  */
 static void do_sat_addsub_32(TCGv_i64 reg, TCGv_i64 val, bool u, bool d)
 {
diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
index 359b1e3e96..d3e89fda91 100644
--- a/target/arm/tcg/translate-vfp.c
+++ b/target/arm/tcg/translate-vfp.c
@@ -144,7 +144,7 @@ static void gen_preserve_fp_state(DisasContext *s, bool skip_context_update)
  * Generate code for M-profile FP context handling: update the
  * ownership of the FP context, and create a new context if
  * necessary. This corresponds to the parts of the pseudocode
- * ExecuteFPCheck() after the inital PreserveFPState() call.
+ * ExecuteFPCheck() after the initial PreserveFPState() call.
  */
 static void gen_update_fp_context(DisasContext *s)
 {
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index f59d3b26ea..6712a2c790 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -2626,7 +2626,7 @@ void HELPER(gvec_bfmmla)(void *vd, void *vn, void *vm, void *va, uint32_t desc)
          * Process the entire segment at once, writing back the
          * results only after we've consumed all of the inputs.
          *
-         * Key to indicies by column:
+         * Key to indices by column:
          *               i   j           i   k             j   k
          */
         sum00 = a[s + H4(0 + 0)];
diff --git a/tests/tcg/aarch64/gdbstub/test-sve.py b/tests/tcg/aarch64/gdbstub/test-sve.py
index b96bdbb99a..ef57c7412c 100644
--- a/tests/tcg/aarch64/gdbstub/test-sve.py
+++ b/tests/tcg/aarch64/gdbstub/test-sve.py
@@ -1,6 +1,6 @@
 from __future__ import print_function
 #
-# Test the SVE registers are visable and changeable via gdbstub
+# Test the SVE registers are visible and changeable via gdbstub
 #
 # This is launched via tests/guest-debug/run-test.py
 #
diff --git a/tests/tcg/aarch64/sme-outprod1.c b/tests/tcg/aarch64/sme-outprod1.c
index 6e5972d75e..0c814ed529 100644
--- a/tests/tcg/aarch64/sme-outprod1.c
+++ b/tests/tcg/aarch64/sme-outprod1.c
@@ -28,7 +28,7 @@ asm(
 "	fmopa za1.s, p0/m, p0/m, z0.s, z0.s\n"
 /*
  * Read the first 4x4 sub-matrix of elements from tile 1:
- * Note that za1h should be interchangable here.
+ * Note that za1h should be interchangeable here.
  */
 "	mov w12, #0\n"
 "	mova z0.s, p0/m, za1v.s[w12, #0]\n"
diff --git a/tests/tcg/aarch64/system/boot.S b/tests/tcg/aarch64/system/boot.S
index f136363d2a..501685d0ec 100644
--- a/tests/tcg/aarch64/system/boot.S
+++ b/tests/tcg/aarch64/system/boot.S
@@ -9,7 +9,7 @@
 
 /*
  * Semihosting interface on ARM AArch64
- * See "Semihosting for AArch32 and AArch64 Relase 2.0" by ARM
+ * See "Semihosting for AArch32 and AArch64 Release 2.0" by ARM
  * w0 - semihosting call number
  * x1 - semihosting parameter
  */
@@ -147,7 +147,7 @@ __start:
 	 * T0SZ[5:0]  = 2^(64 - 25)
 	 *
 	 * The size of T0SZ controls what the initial lookup level. It
-	 * would be nice to start at level 2 but unfortunatly for a
+	 * would be nice to start at level 2 but unfortunately for a
 	 * flat-mapping on the virt machine we need to handle IA's
 	 * with at least 1gb range to see RAM. So we start with a
 	 * level 1 lookup.
@@ -189,7 +189,7 @@ __start:
 	msr	cpacr_el1, x0
 
 	/* Setup some stack space and enter the test code.
-	 * Assume everthing except the return value is garbage when we
+	 * Assume everything except the return value is garbage when we
 	 * return, we won't need it.
 	 */
 	adrp	x0, stack_end
diff --git a/tests/tcg/aarch64/system/semiheap.c b/tests/tcg/aarch64/system/semiheap.c
index 693a1b037d..1a8c0f31a0 100644
--- a/tests/tcg/aarch64/system/semiheap.c
+++ b/tests/tcg/aarch64/system/semiheap.c
@@ -86,7 +86,7 @@ int main(int argc, char *argv[argc])
         }
         ptr_to_heap++;
     }
-    ml_printf("r/w to heap upto %p\n", ptr_to_heap);
+    ml_printf("r/w to heap up to %p\n", ptr_to_heap);
 
     ml_printf("Passed HeapInfo checks\n");
     return 0;

From 8b81968c1cf351430dad66a1b36420f431243842 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 14 Jul 2023 14:23:51 +0300
Subject: [PATCH 0925/1353] other architectures: spelling fixes

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 host/include/generic/host/cpuinfo.h              |  2 +-
 hw/m68k/next-cube.c                              |  2 +-
 hw/m68k/next-kbd.c                               |  2 +-
 hw/m68k/virt.c                                   |  2 +-
 hw/microblaze/petalogix_ml605_mmu.c              |  2 +-
 hw/sparc/sun4m_iommu.c                           |  8 ++++----
 target/alpha/cpu.h                               |  4 ++--
 target/alpha/translate.c                         |  2 +-
 target/cris/helper.c                             |  6 +++---
 target/cris/op_helper.c                          |  2 +-
 target/cris/translate.c                          | 16 ++++++++--------
 target/hppa/cpu.h                                |  4 ++--
 target/hppa/int_helper.c                         |  2 +-
 target/hppa/translate.c                          |  2 +-
 target/loongarch/cpu-csr.h                       |  2 +-
 target/m68k/helper.c                             |  4 ++--
 target/microblaze/cpu.h                          |  2 +-
 target/openrisc/cpu.h                            |  2 +-
 target/openrisc/translate.c                      |  4 ++--
 target/rx/translate.c                            |  4 ++--
 target/sparc/asi.h                               | 14 +++++++-------
 target/tricore/csfr.h.inc                        |  2 +-
 target/tricore/helper.c                          |  2 +-
 target/tricore/translate.c                       |  8 ++++----
 tests/tcg/Makefile.target                        |  4 ++--
 tests/tcg/multiarch/sha512.c                     |  2 +-
 .../tcg/multiarch/system/Makefile.softmmu-target |  2 +-
 tests/tcg/tricore/c/crt0-tc2x.S                  |  4 ++--
 tests/tcg/x86_64/system/boot.S                   |  4 ++--
 29 files changed, 58 insertions(+), 58 deletions(-)

diff --git a/host/include/generic/host/cpuinfo.h b/host/include/generic/host/cpuinfo.h
index eca672064a..67ad410871 100644
--- a/host/include/generic/host/cpuinfo.h
+++ b/host/include/generic/host/cpuinfo.h
@@ -1,4 +1,4 @@
 /*
- * No host specific cpu indentification.
+ * No host specific cpu identification.
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
diff --git a/hw/m68k/next-cube.c b/hw/m68k/next-cube.c
index ce8ee50b9e..5d244b3b95 100644
--- a/hw/m68k/next-cube.c
+++ b/hw/m68k/next-cube.c
@@ -734,7 +734,7 @@ static void next_irq(void *opaque, int number, int level)
     M68kCPU *cpu = s->cpu;
     int shift = 0;
 
-    /* first switch sets interupt status */
+    /* first switch sets interrupt status */
     /* DPRINTF("IRQ %i\n",number); */
     switch (number) {
     /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
diff --git a/hw/m68k/next-kbd.c b/hw/m68k/next-kbd.c
index 0544160e91..0c348c18cf 100644
--- a/hw/m68k/next-kbd.c
+++ b/hw/m68k/next-kbd.c
@@ -37,7 +37,7 @@
 
 OBJECT_DECLARE_SIMPLE_TYPE(NextKBDState, NEXTKBD)
 
-/* following defintions from next68k netbsd */
+/* following definitions from next68k netbsd */
 #define CSR_INT 0x00800000
 #define CSR_DATA 0x00400000
 
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index 731205b215..de91726cf9 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -1,7 +1,7 @@
 /*
  * SPDX-License-Identifier: GPL-2.0-or-later
  *
- * QEMU Vitual M68K Machine
+ * QEMU Virtual M68K Machine
  *
  * (c) 2020 Laurent Vivier <laurent@vivier.eu>
  *
diff --git a/hw/microblaze/petalogix_ml605_mmu.c b/hw/microblaze/petalogix_ml605_mmu.c
index a24fadddca..babb053035 100644
--- a/hw/microblaze/petalogix_ml605_mmu.c
+++ b/hw/microblaze/petalogix_ml605_mmu.c
@@ -104,7 +104,7 @@ petalogix_ml605_init(MachineState *machine)
 
     dinfo = drive_get(IF_PFLASH, 0, 0);
     /* 5th parameter 2 means bank-width
-     * 10th paremeter 0 means little-endian */
+     * 10th parameter 0 means little-endian */
     pflash_cfi01_register(FLASH_BASEADDR, "petalogix_ml605.flash", FLASH_SIZE,
                           dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                           64 * KiB, 2, 0x89, 0x18, 0x0000, 0x0, 0);
diff --git a/hw/sparc/sun4m_iommu.c b/hw/sparc/sun4m_iommu.c
index 71f5465249..eb40f9377c 100644
--- a/hw/sparc/sun4m_iommu.c
+++ b/hw/sparc/sun4m_iommu.c
@@ -96,10 +96,10 @@
 #define IOMMU_AER_SBW       0x80000000    /* S-to-M asynchronous writes */
 #define IOMMU_AER_MASK      0x801f000f
 
-#define IOMMU_SBCFG0        (0x1010 >> 2) /* SBUS configration per-slot */
-#define IOMMU_SBCFG1        (0x1014 >> 2) /* SBUS configration per-slot */
-#define IOMMU_SBCFG2        (0x1018 >> 2) /* SBUS configration per-slot */
-#define IOMMU_SBCFG3        (0x101c >> 2) /* SBUS configration per-slot */
+#define IOMMU_SBCFG0        (0x1010 >> 2) /* SBUS configuration per-slot */
+#define IOMMU_SBCFG1        (0x1014 >> 2) /* SBUS configuration per-slot */
+#define IOMMU_SBCFG2        (0x1018 >> 2) /* SBUS configuration per-slot */
+#define IOMMU_SBCFG3        (0x101c >> 2) /* SBUS configuration per-slot */
 #define IOMMU_SBCFG_SAB30   0x00010000 /* Phys-address bit 30 when
                                           bypass enabled */
 #define IOMMU_SBCFG_BA16    0x00000004 /* Slave supports 16 byte bursts */
diff --git a/target/alpha/cpu.h b/target/alpha/cpu.h
index fcd20bfd3a..13306665af 100644
--- a/target/alpha/cpu.h
+++ b/target/alpha/cpu.h
@@ -191,7 +191,7 @@ enum {
 
    That said, we're only emulating Unix PALcode, and not attempting VMS,
    so we don't need to implement Executive and Supervisor.  QEMU's own
-   PALcode cheats and usees the KSEG mapping for its code+data rather than
+   PALcode cheats and uses the KSEG mapping for its code+data rather than
    physical addresses.  */
 
 #define MMU_KERNEL_IDX   0
@@ -362,7 +362,7 @@ enum {
    The Unix PALcode only uses bit 4.  */
 #define PS_USER_MODE  8u
 
-/* CPUAlphaState->flags constants.  These are layed out so that we
+/* CPUAlphaState->flags constants.  These are laid out so that we
    can set or reset the pieces individually by assigning to the byte,
    or manipulated as a whole.  */
 
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index 1f7dd078d8..846f3d8091 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -2893,7 +2893,7 @@ static void alpha_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
        the first fp insn of the TB.  Alternately we could define a proper
        default for every TB (e.g. QUAL_RM_N or QUAL_RM_D) and make sure
        to reset the FP_STATUS to that default at the end of any TB that
-       changes the default.  We could even (gasp) dynamiclly figure out
+       changes the default.  We could even (gasp) dynamically figure out
        what default would be most efficient given the running program.  */
     ctx->tb_rm = -1;
     /* Similarly for flush-to-zero.  */
diff --git a/target/cris/helper.c b/target/cris/helper.c
index 81a72699b5..c0bf987e3e 100644
--- a/target/cris/helper.c
+++ b/target/cris/helper.c
@@ -113,7 +113,7 @@ void crisv10_cpu_do_interrupt(CPUState *cs)
     assert(!(env->pregs[PR_CCS] & PFIX_FLAG));
     switch (cs->exception_index) {
     case EXCP_BREAK:
-        /* These exceptions are genereated by the core itself.
+        /* These exceptions are generated by the core itself.
            ERP should point to the insn following the brk.  */
         ex_vec = env->trap_vector;
         env->pregs[PRV10_BRP] = env->pc;
@@ -169,7 +169,7 @@ void cris_cpu_do_interrupt(CPUState *cs)
 
     switch (cs->exception_index) {
     case EXCP_BREAK:
-        /* These exceptions are genereated by the core itself.
+        /* These exceptions are generated by the core itself.
            ERP should point to the insn following the brk.  */
         ex_vec = env->trap_vector;
         env->pregs[PR_ERP] = env->pc;
@@ -228,7 +228,7 @@ void cris_cpu_do_interrupt(CPUState *cs)
        undefined.  */
     env->pc = cpu_ldl_code(env, env->pregs[PR_EBP] + ex_vec * 4);
 
-    /* Clear the excption_index to avoid spurios hw_aborts for recursive
+    /* Clear the excption_index to avoid spurious hw_aborts for recursive
        bus faults.  */
     cs->exception_index = -1;
 
diff --git a/target/cris/op_helper.c b/target/cris/op_helper.c
index d55a18a213..40cb74ce73 100644
--- a/target/cris/op_helper.c
+++ b/target/cris/op_helper.c
@@ -231,7 +231,7 @@ static inline uint32_t evaluate_flags_writeback(CPUCRISState *env,
 {
     unsigned int x, z, mask;
 
-    /* Extended arithmetics, leave the z flag alone.  */
+    /* Extended arithmetic, leave the z flag alone.  */
     x = env->cc_x;
     mask = env->cc_mask | X_FLAG;
     if (x) {
diff --git a/target/cris/translate.c b/target/cris/translate.c
index 1445cd8bb5..0b3d724281 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -342,7 +342,7 @@ static void t_gen_cris_mstep(TCGv d, TCGv a, TCGv b, TCGv ccs)
     tcg_gen_add_tl(d, d, t);
 }
 
-/* Extended arithmetics on CRIS.  */
+/* Extended arithmetic on CRIS.  */
 static inline void t_gen_add_flag(TCGv d, int flag)
 {
     TCGv c;
@@ -646,7 +646,7 @@ static void cris_alu_op_exec(DisasContext *dc, int op,
     switch (op) {
     case CC_OP_ADD:
         tcg_gen_add_tl(dst, a, b);
-        /* Extended arithmetics.  */
+        /* Extended arithmetic.  */
         t_gen_addx_carry(dc, dst);
         break;
     case CC_OP_ADDC:
@@ -659,7 +659,7 @@ static void cris_alu_op_exec(DisasContext *dc, int op,
         break;
     case CC_OP_SUB:
         tcg_gen_sub_tl(dst, a, b);
-        /* Extended arithmetics.  */
+        /* Extended arithmetic.  */
         t_gen_subx_carry(dc, dst);
         break;
     case CC_OP_MOVE:
@@ -685,7 +685,7 @@ static void cris_alu_op_exec(DisasContext *dc, int op,
         break;
     case CC_OP_NEG:
         tcg_gen_neg_tl(dst, b);
-        /* Extended arithmetics.  */
+        /* Extended arithmetic.  */
         t_gen_subx_carry(dc, dst);
         break;
     case CC_OP_LZ:
@@ -708,7 +708,7 @@ static void cris_alu_op_exec(DisasContext *dc, int op,
         break;
     case CC_OP_CMP:
         tcg_gen_sub_tl(dst, a, b);
-        /* Extended arithmetics.  */
+        /* Extended arithmetic.  */
         t_gen_subx_carry(dc, dst);
         break;
     default:
@@ -2924,12 +2924,12 @@ static unsigned int crisv32_decoder(CPUCRISState *env, DisasContext *dc)
  * On QEMU care needs to be taken when a branch+delayslot sequence is broken
  * and the branch and delayslot don't share pages.
  *
- * The TB contaning the branch insn will set up env->btarget and evaluate 
+ * The TB containing the branch insn will set up env->btarget and evaluate 
  * env->btaken. When the translation loop exits we will note that the branch 
  * sequence is broken and let env->dslot be the size of the branch insn (those
  * vary in length).
  *
- * The TB contaning the delayslot will have the PC of its real insn (i.e no lsb
+ * The TB containing the delayslot will have the PC of its real insn (i.e no lsb
  * set). It will also expect to have env->dslot setup with the size of the 
  * delay slot so that env->pc - env->dslot point to the branch insn. This TB 
  * will execute the dslot and take the branch, either to btarget or just one 
@@ -3143,7 +3143,7 @@ static void cris_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         tcg_gen_lookup_and_goto_ptr();
         break;
     case DISAS_UPDATE:
-        /* Indicate that interupts must be re-evaluated before the next TB. */
+        /* Indicate that interrupts must be re-evaluated before the next TB. */
         tcg_gen_exit_tb(NULL, 0);
         break;
     default:
diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 7373177b55..9fe79b1242 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -35,7 +35,7 @@
 #define MMU_PHYS_IDX     4
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
-/* Hardware exceptions, interupts, faults, and traps.  */
+/* Hardware exceptions, interrupts, faults, and traps.  */
 #define EXCP_HPMC                1  /* high priority machine check */
 #define EXCP_POWER_FAIL          2
 #define EXCP_RC                  3  /* recovery counter */
@@ -276,7 +276,7 @@ static inline void cpu_get_tb_cpu_state(CPUHPPAState *env, vaddr *pc,
     /* TB lookup assumes that PC contains the complete virtual address.
        If we leave space+offset separate, we'll get ITLB misses to an
        incomplete virtual address.  This also means that we must separate
-       out current cpu priviledge from the low bits of IAOQ_F.  */
+       out current cpu privilege from the low bits of IAOQ_F.  */
 #ifdef CONFIG_USER_ONLY
     *pc = env->iaoq_f & -4;
     *cs_base = env->iaoq_b & -4;
diff --git a/target/hppa/int_helper.c b/target/hppa/int_helper.c
index d2480b163b..bebc732c97 100644
--- a/target/hppa/int_helper.c
+++ b/target/hppa/int_helper.c
@@ -37,7 +37,7 @@ static void eval_interrupt(HPPACPU *cpu)
 
 /* Each CPU has a word mapped into the GSC bus.  Anything on the GSC bus
  * can write to this word to raise an external interrupt on the target CPU.
- * This includes the system controler (DINO) for regular devices, or
+ * This includes the system controller (DINO) for regular devices, or
  * another CPU for SMP interprocessor interrupts.
  */
 static uint64_t io_eir_read(void *opaque, hwaddr addr, unsigned size)
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index d33813d173..d66fcb3e6a 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1964,7 +1964,7 @@ static void do_page_zero(DisasContext *ctx)
 {
     /* If by some means we get here with PSW[N]=1, that implies that
        the B,GATE instruction would be skipped, and we'd fault on the
-       next insn within the privilaged page.  */
+       next insn within the privileged page.  */
     switch (ctx->null_cond.c) {
     case TCG_COND_NEVER:
         break;
diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 4c8ce7fed5..f8f24032cb 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -10,7 +10,7 @@
 
 #include "hw/registerfields.h"
 
-/* Base on kernal definitions: arch/loongarch/include/asm/loongarch.h */
+/* Based on kernel definitions: arch/loongarch/include/asm/loongarch.h */
 
 /* Basic CSRs */
 #define LOONGARCH_CSR_CRMD           0x0 /* Current mode info */
diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index 01c18a7c59..0a1544cd68 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -590,10 +590,10 @@ static void dump_address_map(CPUM68KState *env, uint32_t root_pointer)
 
 #define DUMP_CACHEFLAGS(a) \
     switch (a & M68K_DESC_CACHEMODE) { \
-    case M68K_DESC_CM_WRTHRU: /* cachable, write-through */ \
+    case M68K_DESC_CM_WRTHRU: /* cacheable, write-through */ \
         qemu_printf("T"); \
         break; \
-    case M68K_DESC_CM_COPYBK: /* cachable, copyback */ \
+    case M68K_DESC_CM_COPYBK: /* cacheable, copyback */ \
         qemu_printf("C"); \
         break; \
     case M68K_DESC_CM_SERIAL: /* noncachable, serialized */ \
diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index a7b040abd4..f6cab6ce19 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -205,7 +205,7 @@ typedef struct CPUArchState CPUMBState;
 #define PVR10_TARGET_FAMILY_MASK        0xFF000000
 #define PVR10_ASIZE_SHIFT               18
 
-/* MMU descrtiption */
+/* MMU description */
 #define PVR11_USE_MMU                   0xC0000000
 #define PVR11_MMU_ITLB_SIZE             0x38000000
 #define PVR11_MMU_DTLB_SIZE             0x07000000
diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index 92c38f54c2..ce4d605eb7 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -290,7 +290,7 @@ typedef struct CPUArchState {
     int is_counting;
 
     uint32_t picmr;         /* Interrupt mask register */
-    uint32_t picsr;         /* Interrupt contrl register*/
+    uint32_t picsr;         /* Interrupt control register */
 #endif
 } CPUOpenRISCState;
 
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 7760329e75..a86360d4f5 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -273,7 +273,7 @@ static void gen_div(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
 
     tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_sr_ov, srcb, 0);
     /* The result of divide-by-zero is undefined.
-       Supress the host-side exception by dividing by 1.  */
+       Suppress the host-side exception by dividing by 1. */
     tcg_gen_or_tl(t0, srcb, cpu_sr_ov);
     tcg_gen_div_tl(dest, srca, t0);
 
@@ -287,7 +287,7 @@ static void gen_divu(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
 
     tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_sr_cy, srcb, 0);
     /* The result of divide-by-zero is undefined.
-       Supress the host-side exception by dividing by 1.  */
+       Suppress the host-side exception by dividing by 1. */
     tcg_gen_or_tl(t0, srcb, cpu_sr_cy);
     tcg_gen_divu_tl(dest, srca, t0);
 
diff --git a/target/rx/translate.c b/target/rx/translate.c
index 08cabbde61..f552a0319a 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -2066,7 +2066,7 @@ static inline void clrsetpsw(DisasContext *ctx, int cb, int val)
             tcg_gen_movi_i32(cpu_psw_o, val << 31);
             break;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "Invalid distination %d", cb);
+            qemu_log_mask(LOG_GUEST_ERROR, "Invalid destination %d", cb);
             break;
         }
     } else if (is_privileged(ctx, 0)) {
@@ -2084,7 +2084,7 @@ static inline void clrsetpsw(DisasContext *ctx, int cb, int val)
             }
             break;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "Invalid distination %d", cb);
+            qemu_log_mask(LOG_GUEST_ERROR, "Invalid destination %d", cb);
             break;
         }
     }
diff --git a/target/sparc/asi.h b/target/sparc/asi.h
index bb58735ddb..3270ed0c7f 100644
--- a/target/sparc/asi.h
+++ b/target/sparc/asi.h
@@ -144,13 +144,13 @@
  * ASIs, "(4V)" designates SUN4V specific ASIs.  "(NG4)" designates SPARC-T4
  * and later ASIs.
  */
-#define ASI_REAL                0x14 /* Real address, cachable          */
+#define ASI_REAL                0x14 /* Real address, cacheable          */
 #define ASI_PHYS_USE_EC		0x14 /* PADDR, E-cachable		*/
 #define ASI_REAL_IO             0x15 /* Real address, non-cachable      */
 #define ASI_PHYS_BYPASS_EC_E	0x15 /* PADDR, E-bit			*/
 #define ASI_BLK_AIUP_4V		0x16 /* (4V) Prim, user, block ld/st	*/
 #define ASI_BLK_AIUS_4V		0x17 /* (4V) Sec, user, block ld/st	*/
-#define ASI_REAL_L              0x1c /* Real address, cachable, LE      */
+#define ASI_REAL_L              0x1c /* Real address, cacheable, LE      */
 #define ASI_PHYS_USE_EC_L	0x1c /* PADDR, E-cachable, little endian*/
 #define ASI_REAL_IO_L           0x1d /* Real address, non-cachable, LE  */
 #define ASI_PHYS_BYPASS_EC_E_L	0x1d /* PADDR, E-bit, little endian	*/
@@ -163,15 +163,15 @@
 #define ASI_BLK_INIT_QUAD_LDD_AIUS 0x23 /* (NG) init-store, twin load,
 					 * secondary, user
 					 */
-#define ASI_NUCLEUS_QUAD_LDD	0x24 /* Cachable, qword load		*/
+#define ASI_NUCLEUS_QUAD_LDD	0x24 /* Cacheable, qword load		*/
 #define ASI_QUEUE		0x25 /* (4V) Interrupt Queue Registers	*/
-#define ASI_TWINX_REAL          0x26 /* twin load, real, cachable       */
+#define ASI_TWINX_REAL          0x26 /* twin load, real, cacheable	*/
 #define ASI_QUAD_LDD_PHYS_4V	0x26 /* (4V) Physical, qword load	*/
 #define ASI_TWINX_N             0x27 /* twin load, nucleus              */
 #define ASI_TWINX_AIUP_L        0x2a /* twin load, primary user, LE     */
 #define ASI_TWINX_AIUS_L        0x2b /* twin load, secondary user, LE   */
-#define ASI_NUCLEUS_QUAD_LDD_L	0x2c /* Cachable, qword load, l-endian 	*/
-#define ASI_TWINX_REAL_L        0x2e /* twin load, real, cachable, LE   */
+#define ASI_NUCLEUS_QUAD_LDD_L	0x2c /* Cacheable, qword load, l-endian */
+#define ASI_TWINX_REAL_L        0x2e /* twin load, real, cacheable, LE	*/
 #define ASI_QUAD_LDD_PHYS_L_4V	0x2e /* (4V) Phys, qword load, l-endian	*/
 #define ASI_TWINX_NL            0x2f /* twin load, nucleus, LE          */
 #define ASI_PCACHE_DATA_STATUS	0x30 /* (III) PCache data stat RAM diag	*/
@@ -231,7 +231,7 @@
 #define ASI_INTR_ID		0x63 /* (CMT) Interrupt ID register	*/
 #define ASI_CORE_ID		0x63 /* (CMT) LP ID register		*/
 #define ASI_CESR_ID		0x63 /* (CMT) CESR ID register		*/
-#define ASI_IC_INSTR		0x66 /* Insn cache instrucion ram diag	*/
+#define ASI_IC_INSTR		0x66 /* Insn cache instruction ram diag	*/
 #define ASI_IC_TAG		0x67 /* Insn cache tag/valid ram diag 	*/
 #define ASI_IC_STAG		0x68 /* (III) Insn cache snoop tag ram	*/
 #define ASI_IC_PRE_DECODE	0x6e /* Insn cache pre-decode ram diag	*/
diff --git a/target/tricore/csfr.h.inc b/target/tricore/csfr.h.inc
index ff004cbddc..cdfaf1d662 100644
--- a/target/tricore/csfr.h.inc
+++ b/target/tricore/csfr.h.inc
@@ -1,4 +1,4 @@
-/* A(ll) access permited
+/* A(ll) access permitted
    R(ead only) access
    E(nd init protected) access
 
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index 951024d491..7587c2ffe8 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -57,7 +57,7 @@ hwaddr tricore_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
     return phys_addr;
 }
 
-/* TODO: Add exeption support*/
+/* TODO: Add exception support */
 static void raise_mmu_exception(CPUTriCoreState *env, target_ulong address,
                                 int rw, int tlb_error)
 {
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 2f32463d4d..1947733870 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -128,7 +128,7 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
  * Functions to generate micro-ops
  */
 
-/* Makros for generating helpers */
+/* Macros for generating helpers */
 
 #define gen_helper_1arg(name, arg) do {                           \
     TCGv_i32 helper_tmp = tcg_constant_i32(arg);                  \
@@ -336,8 +336,8 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
 
 /* We generate loads and store to core special function register (csfr) through
    the function gen_mfcr and gen_mtcr. To handle access permissions, we use 3
-   makros R, A and E, which allow read-only, all and endinit protected access.
-   These makros also specify in which ISA version the csfr was introduced. */
+   macros R, A and E, which allow read-only, all and endinit protected access.
+   These macros also specify in which ISA version the csfr was introduced. */
 #define R(ADDRESS, REG, FEATURE)                                         \
     case ADDRESS:                                                        \
         if (has_feature(ctx, FEATURE)) {                             \
@@ -362,7 +362,7 @@ static inline void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
 #undef E
 
 #define R(ADDRESS, REG, FEATURE) /* don't gen writes to read-only reg,
-                                    since no execption occurs */
+                                    since no exception occurs */
 #define A(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)                \
     case ADDRESS:                                                        \
         if (has_feature(ctx, FEATURE)) {                             \
diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index 2462c26000..462289f47c 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -120,7 +120,7 @@ endif
 %: %.S
 	$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $< -o $@ $(LDFLAGS)
 else
-# For softmmu targets we include a different Makefile fragement as the
+# For softmmu targets we include a different Makefile fragment as the
 # build options for bare programs are usually pretty different. They
 # are expected to provide their own build recipes.
 EXTRA_CFLAGS += -ffreestanding
@@ -154,7 +154,7 @@ PLUGINS=$(patsubst %.c, lib%.so, $(notdir $(wildcard $(PLUGIN_SRC)/*.c)))
 # pre-requistes manually here as we can't use stems to handle it. We
 # only expand MULTIARCH_TESTS which are common on most of our targets
 # to avoid an exponential explosion as new tests are added. We also
-# add some special helpers the run-plugin- rules can use bellow.
+# add some special helpers the run-plugin- rules can use below.
 
 ifneq ($(MULTIARCH_TESTS),)
 $(foreach p,$(PLUGINS), \
diff --git a/tests/tcg/multiarch/sha512.c b/tests/tcg/multiarch/sha512.c
index 9e701bcf20..12c2b6c2b7 100644
--- a/tests/tcg/multiarch/sha512.c
+++ b/tests/tcg/multiarch/sha512.c
@@ -453,7 +453,7 @@ void sha512(struct sha512 *sha, const void *p, size_t size)
 /* From hex.h */
 /**
  * hex_decode - Unpack a hex string.
- * @str: the hexidecimal string
+ * @str: the hexadecimal string
  * @slen: the length of @str
  * @buf: the buffer to write the data into
  * @bufsize: the length of @buf
diff --git a/tests/tcg/multiarch/system/Makefile.softmmu-target b/tests/tcg/multiarch/system/Makefile.softmmu-target
index fe40195d39..7ba9053375 100644
--- a/tests/tcg/multiarch/system/Makefile.softmmu-target
+++ b/tests/tcg/multiarch/system/Makefile.softmmu-target
@@ -3,7 +3,7 @@
 # Multiarch system tests
 #
 # We just collect the tests together here and rely on the actual guest
-# architecture to add to the test dependancies and deal with the
+# architecture to add to the test dependencies and deal with the
 # complications of building.
 #
 
diff --git a/tests/tcg/tricore/c/crt0-tc2x.S b/tests/tcg/tricore/c/crt0-tc2x.S
index 3100da123c..399f112c35 100644
--- a/tests/tcg/tricore/c/crt0-tc2x.S
+++ b/tests/tcg/tricore/c/crt0-tc2x.S
@@ -263,7 +263,7 @@ __copy_table_next:
     ld.w    %d3,[%a13+]4            # %d3 = block length
     jeq %d3,-1,__copy_table_done    # length == -1 => end of table
     sh  %d0,%d3,-3          # %d0 = length / 8 (doublewords)
-    and %d1,%d3,7           # %d1 = lenght % 8 (rem. bytes)
+    and %d1,%d3,7           # %d1 = length % 8 (rem. bytes)
     jz  %d0,__copy_word         # block size < 8 => copy word
     addi    %d0,%d0,-1          # else doublewords -= 1
     mov.a   %a2,%d0             # %a2 = loop counter
@@ -274,7 +274,7 @@ __copy_dword:
 __copy_word:
     jz  %d1,__copy_table_next
     sh  %d0,%d1,-2          # %d0 = length / 4 (words)
-    and %d1,%d1,3           # %d1 = lenght % 4 (rem. bytes)
+    and %d1,%d1,3           # %d1 = length % 4 (rem. bytes)
     jz  %d0,__copy_hword        # block size < 4 => copy hword
     ld.w    %d14,[%a15+]4           # copy one word
     st.w    [%a14+]4,%d14
diff --git a/tests/tcg/x86_64/system/boot.S b/tests/tcg/x86_64/system/boot.S
index ed0f638406..dac9bd534d 100644
--- a/tests/tcg/x86_64/system/boot.S
+++ b/tests/tcg/x86_64/system/boot.S
@@ -121,7 +121,7 @@ _start:
 	// Setup stack ASAP
 	movq $stack_end,%rsp
 
-        /* don't worry about stack frame, assume everthing is garbage when we return */
+        /* don't worry about stack frame, assume everything is garbage when we return */
 	call main
 
 _exit:	/* output any non-zero result in eax to isa-debug-exit device */
@@ -195,7 +195,7 @@ idt_1F: .int 0, 0
 	 *
 	 * This describes various memory areas (segments) through
 	 * segment descriptors. In 32 bit mode each segment each
-	 * segement is associated with segment registers which are
+	 * segment is associated with segment registers which are
 	 * implicitly (or explicitly) referenced depending on the
 	 * instruction. However in 64 bit mode selectors are flat and
 	 * segmented addressing isn't used.

From 28cbbdd28e2979dbf9768a70754550b8e377fcc4 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Fri, 14 Jul 2023 14:13:50 +0300
Subject: [PATCH 0926/1353] hw/9pfs: spelling fixes

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 hw/9pfs/9p-local.c | 8 ++++----
 hw/9pfs/9p-proxy.c | 2 +-
 hw/9pfs/9p-synth.c | 2 +-
 hw/9pfs/9p-util.h  | 2 +-
 hw/9pfs/9p.c       | 4 ++--
 hw/9pfs/9p.h       | 2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 9d07620235..1b1f3b9ec8 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -624,7 +624,7 @@ static ssize_t local_pwritev(FsContext *ctx, V9fsFidOpenState *fs,
         /*
          * Initiate a writeback. This is not a data integrity sync.
          * We want to ensure that we don't leave dirty pages in the cache
-         * after write when writeout=immediate is sepcified.
+         * after write when writeout=immediate is specified.
          */
         sync_file_range(fs->fd, offset, ret,
                         SYNC_FILE_RANGE_WAIT_BEFORE | SYNC_FILE_RANGE_WRITE);
@@ -843,7 +843,7 @@ static int local_open2(FsContext *fs_ctx, V9fsPath *dir_path, const char *name,
         }
         credp->fc_mode = credp->fc_mode | S_IFREG;
         if (fs_ctx->export_flags & V9FS_SM_MAPPED) {
-            /* Set cleint credentials in xattr */
+            /* Set client credentials in xattr */
             err = local_set_xattrat(dirfd, name, credp);
         } else {
             err = local_set_mapped_file_attrat(dirfd, name, credp);
@@ -912,7 +912,7 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
         if (write_size != oldpath_size) {
             goto err_end;
         }
-        /* Set cleint credentials in symlink's xattr */
+        /* Set client credentials in symlink's xattr */
         credp->fc_mode = credp->fc_mode | S_IFLNK;
 
         if (fs_ctx->export_flags & V9FS_SM_MAPPED) {
@@ -1418,7 +1418,7 @@ static int local_ioc_getversion_init(FsContext *ctx, LocalData *data, Error **er
     struct statfs stbuf;
 
     /*
-     * use ioc_getversion only if the ioctl is definied
+     * use ioc_getversion only if the ioctl is defined
      */
     if (fstatfs(data->mountfd, &stbuf) < 0) {
         error_setg_errno(errp, errno,
diff --git a/hw/9pfs/9p-proxy.c b/hw/9pfs/9p-proxy.c
index 905cae6992..7aac49ad4a 100644
--- a/hw/9pfs/9p-proxy.c
+++ b/hw/9pfs/9p-proxy.c
@@ -767,7 +767,7 @@ static ssize_t proxy_pwritev(FsContext *ctx, V9fsFidOpenState *fs,
         /*
          * Initiate a writeback. This is not a data integrity sync.
          * We want to ensure that we don't leave dirty pages in the cache
-         * after write when writeout=immediate is sepcified.
+         * after write when writeout=immediate is specified.
          */
         sync_file_range(fs->fd, offset, ret,
                         SYNC_FILE_RANGE_WAIT_BEFORE | SYNC_FILE_RANGE_WRITE);
diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index f62c40b639..0ac79a500b 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -493,7 +493,7 @@ static int synth_name_to_path(FsContext *ctx, V9fsPath *dir_path,
         node = dir_node;
         goto out;
     }
-    /* search for the name in the childern */
+    /* search for the name in the children */
     rcu_read_lock();
     QLIST_FOREACH(node, &dir_node->child, sibling) {
         if (!strcmp(node->name, name)) {
diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
index df1b583a5e..51c94b0116 100644
--- a/hw/9pfs/9p-util.h
+++ b/hw/9pfs/9p-util.h
@@ -48,7 +48,7 @@ static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor)
 /*
  * Converts given device number from host's device number format to Linux
  * device number format. As both the size of type dev_t and encoding of
- * dev_t is system dependant, we have to convert them for Linux guests if
+ * dev_t is system dependent, we have to convert them for Linux guests if
  * host is not running Linux.
  */
 static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 991645adca..323f042e65 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -644,7 +644,7 @@ static inline uint64_t mirror64bit(uint64_t value)
 }
 
 /*
- * Parameter k for the Exponential Golomb algorihm to be used.
+ * Parameter k for the Exponential Golomb algorithm to be used.
  *
  * The smaller this value, the smaller the minimum bit count for the Exp.
  * Golomb generated affixes will be (at lowest index) however for the
@@ -1039,7 +1039,7 @@ static void coroutine_fn pdu_complete(V9fsPDU *pdu, ssize_t len)
      * Sending a reply would confuse clients because they would
      * assume that any EINTR is the actual result of the operation,
      * rather than a consequence of the cancellation. However, if
-     * the operation completed (succesfully or with an error other
+     * the operation completed (successfully or with an error other
      * than caused be cancellation), we do send out that reply, both
      * for efficiency and to avoid confusing the rest of the state machine
      * that assumes passing a non-error here will mean a successful
diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
index 1b0d805b9c..a6f59abccb 100644
--- a/hw/9pfs/9p.h
+++ b/hw/9pfs/9p.h
@@ -304,7 +304,7 @@ typedef struct VariLenAffix {
     AffixType_t type; /* Whether this affix is a suffix or a prefix. */
     uint64_t value; /* Actual numerical value of this affix. */
     /*
-     * Lenght of the affix, that is how many (of the lowest) bits of ``value``
+     * Length of the affix, that is how many (of the lowest) bits of ``value``
      * must be used for appending/prepending this affix to its final resulting,
      * unique number.
      */

From 8c0e8ed327c8ff7b48a5f2b7f5295c0541fcdbf4 Mon Sep 17 00:00:00 2001
From: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Date: Fri, 21 Jul 2023 08:06:05 +0200
Subject: [PATCH 0927/1353] target/tricore: Rename tricore_feature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

this name is used by capstone and will lead to a build failure of QEMU,
when capstone is enabled. So we rename it to tricore_has_feature(), to
match has_feature() in translate.c.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1774
Signed-off-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/tricore/cpu.c       | 8 ++++----
 target/tricore/cpu.h       | 2 +-
 target/tricore/helper.c    | 4 ++--
 target/tricore/op_helper.c | 4 ++--
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index f15169bd1b..133a9ac70e 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -104,18 +104,18 @@ static void tricore_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     /* Some features automatically imply others */
-    if (tricore_feature(env, TRICORE_FEATURE_162)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_162)) {
         set_feature(env, TRICORE_FEATURE_161);
     }
 
-    if (tricore_feature(env, TRICORE_FEATURE_161)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_161)) {
         set_feature(env, TRICORE_FEATURE_16);
     }
 
-    if (tricore_feature(env, TRICORE_FEATURE_16)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_16)) {
         set_feature(env, TRICORE_FEATURE_131);
     }
-    if (tricore_feature(env, TRICORE_FEATURE_131)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_131)) {
         set_feature(env, TRICORE_FEATURE_13);
     }
     cpu_reset(cs);
diff --git a/target/tricore/cpu.h b/target/tricore/cpu.h
index a50b91cc36..3708405be8 100644
--- a/target/tricore/cpu.h
+++ b/target/tricore/cpu.h
@@ -277,7 +277,7 @@ enum tricore_features {
     TRICORE_FEATURE_162,
 };
 
-static inline int tricore_feature(CPUTriCoreState *env, int feature)
+static inline int tricore_has_feature(CPUTriCoreState *env, int feature)
 {
     return (env->features & (1ULL << feature)) != 0;
 }
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index 7587c2ffe8..6d076ac36f 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -155,7 +155,7 @@ void psw_write(CPUTriCoreState *env, uint32_t val)
 #define FIELD_GETTER_WITH_FEATURE(NAME, REG, FIELD, FEATURE)     \
 uint32_t NAME(CPUTriCoreState *env)                             \
 {                                                                \
-    if (tricore_feature(env, TRICORE_FEATURE_##FEATURE)) {       \
+    if (tricore_has_feature(env, TRICORE_FEATURE_##FEATURE)) {   \
         return FIELD_EX32(env->REG, REG, FIELD ## _ ## FEATURE); \
     }                                                            \
     return FIELD_EX32(env->REG, REG, FIELD ## _13);              \
@@ -170,7 +170,7 @@ uint32_t NAME(CPUTriCoreState *env)         \
 #define FIELD_SETTER_WITH_FEATURE(NAME, REG, FIELD, FEATURE)              \
 void NAME(CPUTriCoreState *env, uint32_t val)                            \
 {                                                                         \
-    if (tricore_feature(env, TRICORE_FEATURE_##FEATURE)) {                \
+    if (tricore_has_feature(env, TRICORE_FEATURE_##FEATURE)) {            \
         env->REG = FIELD_DP32(env->REG, REG, FIELD ## _ ## FEATURE, val); \
     }                                                                     \
     env->REG = FIELD_DP32(env->REG, REG, FIELD ## _13, val);              \
diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 821a4b67cb..89be1ed648 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -2584,7 +2584,7 @@ void helper_ret(CPUTriCoreState *env)
     /* PCXI = new_PCXI; */
     env->PCXI = new_PCXI;
 
-    if (tricore_feature(env, TRICORE_FEATURE_131)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_131)) {
         /* PSW = {new_PSW[31:26], PSW[25:24], new_PSW[23:0]}; */
         psw_write(env, (new_PSW & ~(0x3000000)) + (psw & (0x3000000)));
     } else { /* TRICORE_FEATURE_13 only */
@@ -2695,7 +2695,7 @@ void helper_rfm(CPUTriCoreState *env)
     env->gpr_a[10] = cpu_ldl_data(env, env->DCX+8);
     env->gpr_a[11] = cpu_ldl_data(env, env->DCX+12);
 
-    if (tricore_feature(env, TRICORE_FEATURE_131)) {
+    if (tricore_has_feature(env, TRICORE_FEATURE_131)) {
         env->DBGTCR = 0;
     }
 }

From 67d045a0ef5b9c5f871c3a1d87325a8a42d2b9d5 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Tue, 11 Jul 2023 12:33:01 +0530
Subject: [PATCH 0928/1353] hw/pci: add comment to explain checking for
 available function 0 in pci hotplug

This change is cosmetic. A comment is added explaining why we need to check for
the availability of function 0 when we hotplug a device.

CC: mst@redhat.com
CC: mjt@tls.msk.ru
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/pci/pci.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 784c02a182..b8d22e2e74 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1183,9 +1183,14 @@ static PCIDevice *do_pci_register_device(PCIDevice *pci_dev,
                    PCI_SLOT(devfn), PCI_FUNC(devfn), name,
                    bus->devices[devfn]->name, bus->devices[devfn]->qdev.id);
         return NULL;
-    } else if (dev->hotplugged &&
-               !pci_is_vf(pci_dev) &&
-               pci_get_function_0(pci_dev)) {
+    } /*
+       * Populating function 0 triggers a scan from the guest that
+       * exposes other non-zero functions. Hence we need to ensure that
+       * function 0 wasn't added yet.
+       */
+    else if (dev->hotplugged &&
+             !pci_is_vf(pci_dev) &&
+             pci_get_function_0(pci_dev)) {
         error_setg(errp, "PCI: slot %d function 0 already occupied by %s,"
                    " new func %s cannot be exposed to guest.",
                    PCI_SLOT(pci_get_function_0(pci_dev)->devfn),

From ff62c210165cf61b15f18c8a9835a5a5ce6c5a53 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 20 Jul 2023 09:16:08 +0200
Subject: [PATCH 0929/1353] qapi: Correct "eg." to "e.g." in documentation

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qapi/char.json | 2 +-
 qapi/misc.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/qapi/char.json b/qapi/char.json
index e413ac2b70..52aaff25eb 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -18,7 +18,7 @@
 # @filename: the filename of the character device
 #
 # @frontend-open: shows whether the frontend device attached to this
-#     backend (eg. with the chardev=... option) is in open or closed
+#     backend (e.g. with the chardev=... option) is in open or closed
 #     state (since 2.1)
 #
 # Notes: @filename is encoded using the QEMU command line character
diff --git a/qapi/misc.json b/qapi/misc.json
index ff070ec828..cda2effa81 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
@@ -18,7 +18,7 @@
 # fail and the FD will be closed.
 #
 # @protocol: protocol name.  Valid names are "vnc", "spice",
-#     "@dbus-display" or the name of a character device (eg. from
+#     "@dbus-display" or the name of a character device (e.g. from
 #     -chardev id=XXXX)
 #
 # @fdname: file descriptor name previously passed via 'getfd' command

From 55a01cab83b608bae6345b7e0e2fbecc142c1b2f Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 22 May 2023 20:47:37 +0900
Subject: [PATCH 0930/1353] crypto: Always initialize splitkeylen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When _FORTIFY_SOURCE=2, glibc version is 2.35, and GCC version is
12.1.0, the compiler complains as follows:

In file included from /usr/include/string.h:535,
                 from /home/alarm/q/var/qemu/include/qemu/osdep.h:99,
                 from ../crypto/block-luks.c:21:
In function 'memset',
    inlined from 'qcrypto_block_luks_store_key' at ../crypto/block-luks.c:843:9:
/usr/include/bits/string_fortified.h:59:10: error: 'splitkeylen' may be used uninitialized [-Werror=maybe-uninitialized]
   59 |   return __builtin___memset_chk (__dest, __ch, __len,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   60 |                                  __glibc_objsize0 (__dest));
      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
../crypto/block-luks.c: In function 'qcrypto_block_luks_store_key':
../crypto/block-luks.c:699:12: note: 'splitkeylen' was declared here
  699 |     size_t splitkeylen;
      |            ^~~~~~~~~~~

It seems the compiler cannot see that splitkeylen will not be used
when splitkey is NULL. Suppress the warning by initializing splitkeylen
even when splitkey stays NULL.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/block-luks.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index 5688783ab1..2f59c3a625 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -706,14 +706,14 @@ qcrypto_block_luks_store_key(QCryptoBlock *block,
 
     assert(slot_idx < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS);
     slot = &luks->header.key_slots[slot_idx];
+    splitkeylen = luks->header.master_key_len * slot->stripes;
+
     if (qcrypto_random_bytes(slot->salt,
                              QCRYPTO_BLOCK_LUKS_SALT_LEN,
                              errp) < 0) {
         goto cleanup;
     }
 
-    splitkeylen = luks->header.master_key_len * slot->stripes;
-
     /*
      * Determine how many iterations are required to
      * hash the user password while consuming 1 second of compute

From 0e6b20b9656174e815751cf8b21f5e326148bb99 Mon Sep 17 00:00:00 2001
From: "Hongren (Zenithal) Zheng" <i@zenithal.me>
Date: Sun, 30 Apr 2023 21:58:19 +0800
Subject: [PATCH 0931/1353] hw/usb/canokey: change license to GPLv2+
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apache license is considered by some to be not compatible
with GPLv2+. Since QEMU as combined work is GPLv2-only,
these two files should be made compatible.

Reported-by: "Daniel P. Berrangé" <berrange@redhat.com>
Link: https://lore.kernel.org/qemu-devel/ZEpKXncC%2Fe6FKRe9@redhat.com/
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-By: canokeys.org (http://canokeys.org) <contact@canokeys.org>
Acked-by: YuanYang Meng <mkfssion@mkfssion.com>
Signed-off-by: Hongren (Zenithal) Zheng <i@zenithal.me>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 hw/usb/canokey.c | 2 +-
 hw/usb/canokey.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
index bbc5da07b5..b306eeb20e 100644
--- a/hw/usb/canokey.c
+++ b/hw/usb/canokey.c
@@ -4,7 +4,7 @@
  * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
  * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
  *
- * This code is licensed under the Apache-2.0.
+ * This code is licensed under the GPL v2 or later.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
index 24cf304203..e528889d33 100644
--- a/hw/usb/canokey.h
+++ b/hw/usb/canokey.h
@@ -4,7 +4,7 @@
  * Copyright (c) 2021-2022 Canokeys.org <contact@canokeys.org>
  * Written by Hongren (Zenithal) Zheng <i@zenithal.me>
  *
- * This code is licensed under the Apache-2.0.
+ * This code is licensed under the GPL v2 or later.
  */
 
 #ifndef CANOKEY_H

From 6cb2011fedf8c4e7b66b4a3abd6b42c1bae99ce6 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 25 Jul 2023 20:09:05 +0100
Subject: [PATCH 0932/1353] Update version for v8.1.0-rc1 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 46a6526f7c..cbe9ed90f1 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.90
+8.0.91

From 9359c459889fce1804c4e1b2a2ff8f182b4a9ae8 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Tue, 25 Jul 2023 12:37:44 +0200
Subject: [PATCH 0933/1353] block/blkio: enable the completion eventfd

Until libblkio 1.3.0, virtio-blk drivers had completion eventfd
notifications enabled from the start, but from the next releases
this is no longer the case, so we have to explicitly enable them.

In fact, the libblkio documentation says they could be disabled,
so we should always enable them at the start if we want to be
sure to get completion eventfd notifications:

    By default, the driver might not generate completion events for
    requests so it is necessary to explicitly enable the completion
    file descriptor before use:

    void blkioq_set_completion_fd_enabled(struct blkioq *q, bool enable);

I discovered this while trying a development version of libblkio:
the guest kernel hangs during boot, while probing the device.

Fixes: fd66dbd424f5 ("blkio: add libblkio block driver")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230725103744.77343-1-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blkio.c b/block/blkio.c
index 1798648134..bc1fac48b7 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -845,6 +845,7 @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
     QLIST_INIT(&s->bounce_bufs);
     s->blkioq = blkio_get_queue(s->blkio, 0);
     s->completion_fd = blkioq_get_completion_fd(s->blkioq);
+    blkioq_set_completion_fd_enabled(s->blkioq, true);
 
     blkio_attach_aio_context(bs, bdrv_get_aio_context(bs));
     return 0;

From 788fa680419854db44205ec6e74602b5f91ee98d Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Wed, 7 Jun 2023 13:13:04 -0300
Subject: [PATCH 0934/1353] migration/multifd: Rename threadinfo.c functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We're about to add more functions to this file so make it use the same
coding style as the rest of the code.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Message-Id: <20230607161306.31425-2-farosas@suse.de>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/migration.c  | 4 ++--
 migration/multifd.c    | 4 ++--
 migration/threadinfo.c | 4 ++--
 migration/threadinfo.h | 5 ++---
 4 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 91bba630a8..ae49d42eab 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2953,7 +2953,7 @@ static void *migration_thread(void *opaque)
     MigThrError thr_error;
     bool urgent = false;
 
-    thread = MigrationThreadAdd("live_migration", qemu_get_thread_id());
+    thread = migration_threads_add("live_migration", qemu_get_thread_id());
 
     rcu_register_thread();
 
@@ -3031,7 +3031,7 @@ static void *migration_thread(void *opaque)
     migration_iteration_finish(s);
     object_unref(OBJECT(s));
     rcu_unregister_thread();
-    MigrationThreadDel(thread);
+    migration_threads_remove(thread);
     return NULL;
 }
 
diff --git a/migration/multifd.c b/migration/multifd.c
index 0e3ae87449..0f6b203877 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -651,7 +651,7 @@ static void *multifd_send_thread(void *opaque)
     int ret = 0;
     bool use_zero_copy_send = migrate_zero_copy_send();
 
-    thread = MigrationThreadAdd(p->name, qemu_get_thread_id());
+    thread = migration_threads_add(p->name, qemu_get_thread_id());
 
     trace_multifd_send_thread_start(p->id);
     rcu_register_thread();
@@ -767,7 +767,7 @@ out:
     qemu_mutex_unlock(&p->mutex);
 
     rcu_unregister_thread();
-    MigrationThreadDel(thread);
+    migration_threads_remove(thread);
     trace_multifd_send_thread_end(p->id, p->num_packets, p->total_normal_pages);
 
     return NULL;
diff --git a/migration/threadinfo.c b/migration/threadinfo.c
index 1de8b31855..3dd9b14ae6 100644
--- a/migration/threadinfo.c
+++ b/migration/threadinfo.c
@@ -14,7 +14,7 @@
 
 static QLIST_HEAD(, MigrationThread) migration_threads;
 
-MigrationThread *MigrationThreadAdd(const char *name, int thread_id)
+MigrationThread *migration_threads_add(const char *name, int thread_id)
 {
     MigrationThread *thread =  g_new0(MigrationThread, 1);
     thread->name = name;
@@ -25,7 +25,7 @@ MigrationThread *MigrationThreadAdd(const char *name, int thread_id)
     return thread;
 }
 
-void MigrationThreadDel(MigrationThread *thread)
+void migration_threads_remove(MigrationThread *thread)
 {
     if (thread) {
         QLIST_REMOVE(thread, node);
diff --git a/migration/threadinfo.h b/migration/threadinfo.h
index 4d69423c0a..8aa6999d58 100644
--- a/migration/threadinfo.h
+++ b/migration/threadinfo.h
@@ -23,6 +23,5 @@ struct MigrationThread {
     QLIST_ENTRY(MigrationThread) node;
 };
 
-MigrationThread *MigrationThreadAdd(const char *name, int thread_id);
-
-void MigrationThreadDel(MigrationThread *info);
+MigrationThread *migration_threads_add(const char *name, int thread_id);
+void migration_threads_remove(MigrationThread *info);

From 01ec0f3a9211cf4af88706188865b15ad53f7d76 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Wed, 7 Jun 2023 13:13:05 -0300
Subject: [PATCH 0935/1353] migration/multifd: Protect accesses to
 migration_threads

This doubly linked list is common for all the multifd and migration
threads so we need to avoid concurrent access.

Add a mutex to protect the data from concurrent access. This fixes a
crash when removing two MigrationThread objects from the list at the
same time during cleanup of multifd threads.

Fixes: 671326201d ("migration: Introduce interface query-migrationthreads")
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <20230607161306.31425-3-farosas@suse.de>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/threadinfo.c | 15 ++++++++++++++-
 migration/threadinfo.h |  2 --
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/migration/threadinfo.c b/migration/threadinfo.c
index 3dd9b14ae6..262990dd75 100644
--- a/migration/threadinfo.c
+++ b/migration/threadinfo.c
@@ -10,23 +10,35 @@
  *  See the COPYING file in the top-level directory.
  */
 
+#include "qemu/osdep.h"
+#include "qemu/queue.h"
+#include "qemu/lockable.h"
 #include "threadinfo.h"
 
+QemuMutex migration_threads_lock;
 static QLIST_HEAD(, MigrationThread) migration_threads;
 
+static void __attribute__((constructor)) migration_threads_init(void)
+{
+    qemu_mutex_init(&migration_threads_lock);
+}
+
 MigrationThread *migration_threads_add(const char *name, int thread_id)
 {
     MigrationThread *thread =  g_new0(MigrationThread, 1);
     thread->name = name;
     thread->thread_id = thread_id;
 
-    QLIST_INSERT_HEAD(&migration_threads, thread, node);
+    WITH_QEMU_LOCK_GUARD(&migration_threads_lock) {
+        QLIST_INSERT_HEAD(&migration_threads, thread, node);
+    }
 
     return thread;
 }
 
 void migration_threads_remove(MigrationThread *thread)
 {
+    QEMU_LOCK_GUARD(&migration_threads_lock);
     if (thread) {
         QLIST_REMOVE(thread, node);
         g_free(thread);
@@ -39,6 +51,7 @@ MigrationThreadInfoList *qmp_query_migrationthreads(Error **errp)
     MigrationThreadInfoList **tail = &head;
     MigrationThread *thread = NULL;
 
+    QEMU_LOCK_GUARD(&migration_threads_lock);
     QLIST_FOREACH(thread, &migration_threads, node) {
         MigrationThreadInfo *info = g_new0(MigrationThreadInfo, 1);
         info->name = g_strdup(thread->name);
diff --git a/migration/threadinfo.h b/migration/threadinfo.h
index 8aa6999d58..2f356ff312 100644
--- a/migration/threadinfo.h
+++ b/migration/threadinfo.h
@@ -10,8 +10,6 @@
  *  See the COPYING file in the top-level directory.
  */
 
-#include "qemu/queue.h"
-#include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-migration.h"
 

From 140e5a7632beb2adbc72066ca2d7146a7bdb2ec5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Fri, 18 Nov 2022 10:08:54 +0800
Subject: [PATCH 0936/1353] softmmu/dirtylimit: Add parameter check for hmp
 "set_vcpu_dirty_limit"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

dirty_rate paraemter of hmp command "set_vcpu_dirty_limit" is invalid
if less than 0, so add parameter check for it.

Note that this patch also delete the unsolicited help message and
clean up the code.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <168618975839.6361.17407633874747688653-1@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 softmmu/dirtylimit.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/softmmu/dirtylimit.c b/softmmu/dirtylimit.c
index 015a9038d1..e80201097a 100644
--- a/softmmu/dirtylimit.c
+++ b/softmmu/dirtylimit.c
@@ -515,14 +515,15 @@ void hmp_set_vcpu_dirty_limit(Monitor *mon, const QDict *qdict)
     int64_t cpu_index = qdict_get_try_int(qdict, "cpu_index", -1);
     Error *err = NULL;
 
-    qmp_set_vcpu_dirty_limit(!!(cpu_index != -1), cpu_index, dirty_rate, &err);
-    if (err) {
-        hmp_handle_error(mon, err);
-        return;
+    if (dirty_rate < 0) {
+        error_setg(&err, "invalid dirty page limit %" PRId64, dirty_rate);
+        goto out;
     }
 
-    monitor_printf(mon, "[Please use 'info vcpu_dirty_limit' to query "
-                   "dirty limit for virtual CPU]\n");
+    qmp_set_vcpu_dirty_limit(!!(cpu_index != -1), cpu_index, dirty_rate, &err);
+
+out:
+    hmp_handle_error(mon, err);
 }
 
 static struct DirtyLimitInfo *dirtylimit_query_vcpu(int cpu_index)

From 4d8078571906932c496ddeda541fb4b026fd12f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Wed, 7 Jun 2023 21:32:59 +0800
Subject: [PATCH 0937/1353] qapi/migration: Introduce x-vcpu-dirty-limit-period
 parameter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce "x-vcpu-dirty-limit-period" migration experimental
parameter, which is in the range of 1 to 1000ms and used to
make dirtyrate calculation period configurable.

Currently with the "x-vcpu-dirty-limit-period" varies, the
total time of live migration changes, test results show the
optimal value of "x-vcpu-dirty-limit-period" ranges from
500ms to 1000 ms. "x-vcpu-dirty-limit-period" should be made
stable once it proves best value can not be determined with
developer's experiments.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <168618975839.6361.17407633874747688653-2@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/migration-hmp-cmds.c |  8 ++++++++
 migration/options.c            | 28 ++++++++++++++++++++++++++++
 qapi/migration.json            | 34 +++++++++++++++++++++++++++-------
 3 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 9885d7c9f7..352e9ec716 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -364,6 +364,10 @@ void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
                 }
             }
         }
+
+        monitor_printf(mon, "%s: %" PRIu64 " ms\n",
+        MigrationParameter_str(MIGRATION_PARAMETER_X_VCPU_DIRTY_LIMIT_PERIOD),
+        params->x_vcpu_dirty_limit_period);
     }
 
     qapi_free_MigrationParameters(params);
@@ -620,6 +624,10 @@ void hmp_migrate_set_parameter(Monitor *mon, const QDict *qdict)
         error_setg(&err, "The block-bitmap-mapping parameter can only be set "
                    "through QMP");
         break;
+    case MIGRATION_PARAMETER_X_VCPU_DIRTY_LIMIT_PERIOD:
+        p->has_x_vcpu_dirty_limit_period = true;
+        visit_type_size(v, param, &p->x_vcpu_dirty_limit_period, &err);
+        break;
     default:
         assert(0);
     }
diff --git a/migration/options.c b/migration/options.c
index 5a9505adf7..1de63ba775 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -80,6 +80,8 @@
 #define DEFINE_PROP_MIG_CAP(name, x)             \
     DEFINE_PROP_BOOL(name, MigrationState, capabilities[x], false)
 
+#define DEFAULT_MIGRATE_VCPU_DIRTY_LIMIT_PERIOD     1000    /* milliseconds */
+
 Property migration_properties[] = {
     DEFINE_PROP_BOOL("store-global-state", MigrationState,
                      store_global_state, true),
@@ -163,6 +165,9 @@ Property migration_properties[] = {
     DEFINE_PROP_STRING("tls-creds", MigrationState, parameters.tls_creds),
     DEFINE_PROP_STRING("tls-hostname", MigrationState, parameters.tls_hostname),
     DEFINE_PROP_STRING("tls-authz", MigrationState, parameters.tls_authz),
+    DEFINE_PROP_UINT64("x-vcpu-dirty-limit-period", MigrationState,
+                       parameters.x_vcpu_dirty_limit_period,
+                       DEFAULT_MIGRATE_VCPU_DIRTY_LIMIT_PERIOD),
 
     /* Migration capabilities */
     DEFINE_PROP_MIG_CAP("x-xbzrle", MIGRATION_CAPABILITY_XBZRLE),
@@ -908,6 +913,9 @@ MigrationParameters *qmp_query_migrate_parameters(Error **errp)
                        s->parameters.block_bitmap_mapping);
     }
 
+    params->has_x_vcpu_dirty_limit_period = true;
+    params->x_vcpu_dirty_limit_period = s->parameters.x_vcpu_dirty_limit_period;
+
     return params;
 }
 
@@ -940,6 +948,7 @@ void migrate_params_init(MigrationParameters *params)
     params->has_announce_max = true;
     params->has_announce_rounds = true;
     params->has_announce_step = true;
+    params->has_x_vcpu_dirty_limit_period = true;
 }
 
 /*
@@ -1100,6 +1109,15 @@ bool migrate_params_check(MigrationParameters *params, Error **errp)
     }
 #endif
 
+    if (params->has_x_vcpu_dirty_limit_period &&
+        (params->x_vcpu_dirty_limit_period < 1 ||
+         params->x_vcpu_dirty_limit_period > 1000)) {
+        error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
+                   "x-vcpu-dirty-limit-period",
+                   "a value between 1 and 1000");
+        return false;
+    }
+
     return true;
 }
 
@@ -1199,6 +1217,11 @@ static void migrate_params_test_apply(MigrateSetParameters *params,
         dest->has_block_bitmap_mapping = true;
         dest->block_bitmap_mapping = params->block_bitmap_mapping;
     }
+
+    if (params->has_x_vcpu_dirty_limit_period) {
+        dest->x_vcpu_dirty_limit_period =
+            params->x_vcpu_dirty_limit_period;
+    }
 }
 
 static void migrate_params_apply(MigrateSetParameters *params, Error **errp)
@@ -1317,6 +1340,11 @@ static void migrate_params_apply(MigrateSetParameters *params, Error **errp)
             QAPI_CLONE(BitmapMigrationNodeAliasList,
                        params->block_bitmap_mapping);
     }
+
+    if (params->has_x_vcpu_dirty_limit_period) {
+        s->parameters.x_vcpu_dirty_limit_period =
+            params->x_vcpu_dirty_limit_period;
+    }
 }
 
 void qmp_migrate_set_parameters(MigrateSetParameters *params, Error **errp)
diff --git a/qapi/migration.json b/qapi/migration.json
index 2a6565a0f8..d83b694fef 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -789,9 +789,14 @@
 #     Nodes are mapped to their block device name if there is one, and
 #     to their node name otherwise.  (Since 5.2)
 #
+# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty limit during
+#                             live migration. Should be in the range 1 to 1000ms,
+#                             defaults to 1000ms. (Since 8.1)
+#
 # Features:
 #
-# @unstable: Member @x-checkpoint-delay is experimental.
+# @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
+#            are experimental.
 #
 # Since: 2.4
 ##
@@ -809,8 +814,9 @@
            'multifd-channels',
            'xbzrle-cache-size', 'max-postcopy-bandwidth',
            'max-cpu-throttle', 'multifd-compression',
-           'multifd-zlib-level' ,'multifd-zstd-level',
-           'block-bitmap-mapping' ] }
+           'multifd-zlib-level', 'multifd-zstd-level',
+           'block-bitmap-mapping',
+           { 'name': 'x-vcpu-dirty-limit-period', 'features': ['unstable'] } ] }
 
 ##
 # @MigrateSetParameters:
@@ -945,9 +951,14 @@
 #     Nodes are mapped to their block device name if there is one, and
 #     to their node name otherwise.  (Since 5.2)
 #
+# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty limit during
+#                             live migration. Should be in the range 1 to 1000ms,
+#                             defaults to 1000ms. (Since 8.1)
+#
 # Features:
 #
-# @unstable: Member @x-checkpoint-delay is experimental.
+# @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
+#            are experimental.
 #
 # TODO: either fuse back into MigrationParameters, or make
 #     MigrationParameters members mandatory
@@ -982,7 +993,9 @@
             '*multifd-compression': 'MultiFDCompression',
             '*multifd-zlib-level': 'uint8',
             '*multifd-zstd-level': 'uint8',
-            '*block-bitmap-mapping': [ 'BitmapMigrationNodeAlias' ] } }
+            '*block-bitmap-mapping': [ 'BitmapMigrationNodeAlias' ],
+            '*x-vcpu-dirty-limit-period': { 'type': 'uint64',
+                                            'features': [ 'unstable' ] } } }
 
 ##
 # @migrate-set-parameters:
@@ -1137,9 +1150,14 @@
 #     Nodes are mapped to their block device name if there is one, and
 #     to their node name otherwise.  (Since 5.2)
 #
+# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty limit during
+#                             live migration. Should be in the range 1 to 1000ms,
+#                             defaults to 1000ms. (Since 8.1)
+#
 # Features:
 #
-# @unstable: Member @x-checkpoint-delay is experimental.
+# @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
+#            are experimental.
 #
 # Since: 2.4
 ##
@@ -1171,7 +1189,9 @@
             '*multifd-compression': 'MultiFDCompression',
             '*multifd-zlib-level': 'uint8',
             '*multifd-zstd-level': 'uint8',
-            '*block-bitmap-mapping': [ 'BitmapMigrationNodeAlias' ] } }
+            '*block-bitmap-mapping': [ 'BitmapMigrationNodeAlias' ],
+            '*x-vcpu-dirty-limit-period': { 'type': 'uint64',
+                                            'features': [ 'unstable' ] } } }
 
 ##
 # @query-migrate-parameters:

From 09f9ec99133ab5735b57486323d9c592630c9fc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Wed, 7 Jun 2023 22:58:32 +0800
Subject: [PATCH 0938/1353] qapi/migration: Introduce vcpu-dirty-limit
 parameters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce "vcpu-dirty-limit" migration parameter used
to limit dirty page rate during live migration.

"vcpu-dirty-limit" and "x-vcpu-dirty-limit-period" are
two dirty-limit-related migration parameters, which can
be set before and during live migration by qmp
migrate-set-parameters.

This two parameters are used to help implement the dirty
page rate limit algo of migration.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <168618975839.6361.17407633874747688653-3@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/migration-hmp-cmds.c |  8 ++++++++
 migration/options.c            | 21 +++++++++++++++++++++
 qapi/migration.json            | 18 +++++++++++++++---
 3 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 352e9ec716..35e8020bbf 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -368,6 +368,10 @@ void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "%s: %" PRIu64 " ms\n",
         MigrationParameter_str(MIGRATION_PARAMETER_X_VCPU_DIRTY_LIMIT_PERIOD),
         params->x_vcpu_dirty_limit_period);
+
+        monitor_printf(mon, "%s: %" PRIu64 " MB/s\n",
+            MigrationParameter_str(MIGRATION_PARAMETER_VCPU_DIRTY_LIMIT),
+            params->vcpu_dirty_limit);
     }
 
     qapi_free_MigrationParameters(params);
@@ -628,6 +632,10 @@ void hmp_migrate_set_parameter(Monitor *mon, const QDict *qdict)
         p->has_x_vcpu_dirty_limit_period = true;
         visit_type_size(v, param, &p->x_vcpu_dirty_limit_period, &err);
         break;
+    case MIGRATION_PARAMETER_VCPU_DIRTY_LIMIT:
+        p->has_vcpu_dirty_limit = true;
+        visit_type_size(v, param, &p->vcpu_dirty_limit, &err);
+        break;
     default:
         assert(0);
     }
diff --git a/migration/options.c b/migration/options.c
index 1de63ba775..7d2d98830e 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -81,6 +81,7 @@
     DEFINE_PROP_BOOL(name, MigrationState, capabilities[x], false)
 
 #define DEFAULT_MIGRATE_VCPU_DIRTY_LIMIT_PERIOD     1000    /* milliseconds */
+#define DEFAULT_MIGRATE_VCPU_DIRTY_LIMIT            1       /* MB/s */
 
 Property migration_properties[] = {
     DEFINE_PROP_BOOL("store-global-state", MigrationState,
@@ -168,6 +169,9 @@ Property migration_properties[] = {
     DEFINE_PROP_UINT64("x-vcpu-dirty-limit-period", MigrationState,
                        parameters.x_vcpu_dirty_limit_period,
                        DEFAULT_MIGRATE_VCPU_DIRTY_LIMIT_PERIOD),
+    DEFINE_PROP_UINT64("vcpu-dirty-limit", MigrationState,
+                       parameters.vcpu_dirty_limit,
+                       DEFAULT_MIGRATE_VCPU_DIRTY_LIMIT),
 
     /* Migration capabilities */
     DEFINE_PROP_MIG_CAP("x-xbzrle", MIGRATION_CAPABILITY_XBZRLE),
@@ -915,6 +919,8 @@ MigrationParameters *qmp_query_migrate_parameters(Error **errp)
 
     params->has_x_vcpu_dirty_limit_period = true;
     params->x_vcpu_dirty_limit_period = s->parameters.x_vcpu_dirty_limit_period;
+    params->has_vcpu_dirty_limit = true;
+    params->vcpu_dirty_limit = s->parameters.vcpu_dirty_limit;
 
     return params;
 }
@@ -949,6 +955,7 @@ void migrate_params_init(MigrationParameters *params)
     params->has_announce_rounds = true;
     params->has_announce_step = true;
     params->has_x_vcpu_dirty_limit_period = true;
+    params->has_vcpu_dirty_limit = true;
 }
 
 /*
@@ -1118,6 +1125,14 @@ bool migrate_params_check(MigrationParameters *params, Error **errp)
         return false;
     }
 
+    if (params->has_vcpu_dirty_limit &&
+        (params->vcpu_dirty_limit < 1)) {
+        error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
+                   "vcpu_dirty_limit",
+                   "is invalid, it must greater then 1 MB/s");
+        return false;
+    }
+
     return true;
 }
 
@@ -1222,6 +1237,9 @@ static void migrate_params_test_apply(MigrateSetParameters *params,
         dest->x_vcpu_dirty_limit_period =
             params->x_vcpu_dirty_limit_period;
     }
+    if (params->has_vcpu_dirty_limit) {
+        dest->vcpu_dirty_limit = params->vcpu_dirty_limit;
+    }
 }
 
 static void migrate_params_apply(MigrateSetParameters *params, Error **errp)
@@ -1345,6 +1363,9 @@ static void migrate_params_apply(MigrateSetParameters *params, Error **errp)
         s->parameters.x_vcpu_dirty_limit_period =
             params->x_vcpu_dirty_limit_period;
     }
+    if (params->has_vcpu_dirty_limit) {
+        s->parameters.vcpu_dirty_limit = params->vcpu_dirty_limit;
+    }
 }
 
 void qmp_migrate_set_parameters(MigrateSetParameters *params, Error **errp)
diff --git a/qapi/migration.json b/qapi/migration.json
index d83b694fef..22104cef08 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -793,6 +793,9 @@
 #                             live migration. Should be in the range 1 to 1000ms,
 #                             defaults to 1000ms. (Since 8.1)
 #
+# @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
+#                    Defaults to 1. (Since 8.1)
+#
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
@@ -816,7 +819,8 @@
            'max-cpu-throttle', 'multifd-compression',
            'multifd-zlib-level', 'multifd-zstd-level',
            'block-bitmap-mapping',
-           { 'name': 'x-vcpu-dirty-limit-period', 'features': ['unstable'] } ] }
+           { 'name': 'x-vcpu-dirty-limit-period', 'features': ['unstable'] },
+           'vcpu-dirty-limit'] }
 
 ##
 # @MigrateSetParameters:
@@ -955,6 +959,9 @@
 #                             live migration. Should be in the range 1 to 1000ms,
 #                             defaults to 1000ms. (Since 8.1)
 #
+# @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
+#                    Defaults to 1. (Since 8.1)
+#
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
@@ -995,7 +1002,8 @@
             '*multifd-zstd-level': 'uint8',
             '*block-bitmap-mapping': [ 'BitmapMigrationNodeAlias' ],
             '*x-vcpu-dirty-limit-period': { 'type': 'uint64',
-                                            'features': [ 'unstable' ] } } }
+                                            'features': [ 'unstable' ] },
+            '*vcpu-dirty-limit': 'uint64'} }
 
 ##
 # @migrate-set-parameters:
@@ -1154,6 +1162,9 @@
 #                             live migration. Should be in the range 1 to 1000ms,
 #                             defaults to 1000ms. (Since 8.1)
 #
+# @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
+#                    Defaults to 1. (Since 8.1)
+#
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
@@ -1191,7 +1202,8 @@
             '*multifd-zstd-level': 'uint8',
             '*block-bitmap-mapping': [ 'BitmapMigrationNodeAlias' ],
             '*x-vcpu-dirty-limit-period': { 'type': 'uint64',
-                                            'features': [ 'unstable' ] } } }
+                                            'features': [ 'unstable' ] },
+            '*vcpu-dirty-limit': 'uint64'} }
 
 ##
 # @query-migrate-parameters:

From dc62395557b29312a9c2f9a1e0beece2557c3078 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Wed, 7 Jun 2023 23:30:50 +0800
Subject: [PATCH 0939/1353] migration: Introduce dirty-limit capability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce migration dirty-limit capability, which can
be turned on before live migration and limit dirty
page rate durty live migration.

Introduce migrate_dirty_limit function to help check
if dirty-limit capability enabled during live migration.

Meanwhile, refactor vcpu_dirty_rate_stat_collect
so that period can be configured instead of hardcoded.

dirty-limit capability is kind of like auto-converge
but using dirty limit instead of traditional cpu-throttle
to throttle guest down. To enable this feature, turn on
the dirty-limit capability before live migration using
migrate-set-capabilities, and set the parameters
"x-vcpu-dirty-limit-period", "vcpu-dirty-limit" suitably
to speed up convergence.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <168618975839.6361.17407633874747688653-4@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/options.c  | 23 ++++++++++++++++++++++-
 migration/options.h  |  1 +
 qapi/migration.json  | 13 ++++++++++++-
 softmmu/dirtylimit.c | 18 ++++++++++++++----
 4 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/migration/options.c b/migration/options.c
index 7d2d98830e..7d83f190d6 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -27,6 +27,7 @@
 #include "qemu-file.h"
 #include "ram.h"
 #include "options.h"
+#include "sysemu/kvm.h"
 
 /* Maximum migrate downtime set to 2000 seconds */
 #define MAX_MIGRATE_DOWNTIME_SECONDS 2000
@@ -196,7 +197,7 @@ Property migration_properties[] = {
 #endif
     DEFINE_PROP_MIG_CAP("x-switchover-ack",
                         MIGRATION_CAPABILITY_SWITCHOVER_ACK),
-
+    DEFINE_PROP_MIG_CAP("x-dirty-limit", MIGRATION_CAPABILITY_DIRTY_LIMIT),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -242,6 +243,13 @@ bool migrate_dirty_bitmaps(void)
     return s->capabilities[MIGRATION_CAPABILITY_DIRTY_BITMAPS];
 }
 
+bool migrate_dirty_limit(void)
+{
+    MigrationState *s = migrate_get_current();
+
+    return s->capabilities[MIGRATION_CAPABILITY_DIRTY_LIMIT];
+}
+
 bool migrate_events(void)
 {
     MigrationState *s = migrate_get_current();
@@ -572,6 +580,19 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
             return false;
         }
     }
+    if (new_caps[MIGRATION_CAPABILITY_DIRTY_LIMIT]) {
+        if (new_caps[MIGRATION_CAPABILITY_AUTO_CONVERGE]) {
+            error_setg(errp, "dirty-limit conflicts with auto-converge"
+                       " either of then available currently");
+            return false;
+        }
+
+        if (!kvm_enabled() || !kvm_dirty_ring_enabled()) {
+            error_setg(errp, "dirty-limit requires KVM with accelerator"
+                   " property 'dirty-ring-size' set");
+            return false;
+        }
+    }
 
     return true;
 }
diff --git a/migration/options.h b/migration/options.h
index 9aaf363322..045e2a41a2 100644
--- a/migration/options.h
+++ b/migration/options.h
@@ -29,6 +29,7 @@ bool migrate_block(void);
 bool migrate_colo(void);
 bool migrate_compress(void);
 bool migrate_dirty_bitmaps(void);
+bool migrate_dirty_limit(void);
 bool migrate_events(void);
 bool migrate_ignore_shared(void);
 bool migrate_late_block_activate(void);
diff --git a/qapi/migration.json b/qapi/migration.json
index 22104cef08..e094438d74 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -497,6 +497,16 @@
 #     are present.  'return-path' capability must be enabled to use
 #     it.  (since 8.1)
 #
+# @dirty-limit: If enabled, migration will use the dirty-limit algo to
+#               throttle down guest instead of auto-converge algo.
+#               Throttle algo only works when vCPU's dirtyrate greater
+#               than 'vcpu-dirty-limit', read processes in guest os
+#               aren't penalized any more, so this algo can improve
+#               performance of vCPU during live migration. This is an
+#               optional performance feature and should not affect the
+#               correctness of the existing auto-converge algo.
+#               (since 8.1)
+#
 # Features:
 #
 # @unstable: Members @x-colo and @x-ignore-shared are experimental.
@@ -512,7 +522,8 @@
            'dirty-bitmaps', 'postcopy-blocktime', 'late-block-activate',
            { 'name': 'x-ignore-shared', 'features': [ 'unstable' ] },
            'validate-uuid', 'background-snapshot',
-           'zero-copy-send', 'postcopy-preempt', 'switchover-ack'] }
+           'zero-copy-send', 'postcopy-preempt', 'switchover-ack',
+           'dirty-limit'] }
 
 ##
 # @MigrationCapabilityStatus:
diff --git a/softmmu/dirtylimit.c b/softmmu/dirtylimit.c
index e80201097a..942d876523 100644
--- a/softmmu/dirtylimit.c
+++ b/softmmu/dirtylimit.c
@@ -24,6 +24,9 @@
 #include "hw/boards.h"
 #include "sysemu/kvm.h"
 #include "trace.h"
+#include "migration/misc.h"
+#include "migration/migration.h"
+#include "migration/options.h"
 
 /*
  * Dirtylimit stop working if dirty page rate error
@@ -75,14 +78,21 @@ static bool dirtylimit_quit;
 
 static void vcpu_dirty_rate_stat_collect(void)
 {
+    MigrationState *s = migrate_get_current();
     VcpuStat stat;
     int i = 0;
+    int64_t period = DIRTYLIMIT_CALC_TIME_MS;
+
+    if (migrate_dirty_limit() &&
+        migration_is_active(s)) {
+        period = s->parameters.x_vcpu_dirty_limit_period;
+    }
 
     /* calculate vcpu dirtyrate */
-    vcpu_calculate_dirtyrate(DIRTYLIMIT_CALC_TIME_MS,
-                             &stat,
-                             GLOBAL_DIRTY_LIMIT,
-                             false);
+    vcpu_calculate_dirtyrate(period,
+                              &stat,
+                              GLOBAL_DIRTY_LIMIT,
+                              false);
 
     for (i = 0; i < stat.nvcpu; i++) {
         vcpu_dirty_rate_stat->stat.rates[i].id = i;

From bb9993c6725ac13098058f873efb06880ce46c32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Wed, 7 Jun 2023 23:32:51 +0800
Subject: [PATCH 0940/1353] migration: Refactor auto-converge capability logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check if block migration is running before throttling
guest down in auto-converge way.

Note that this modification is kind of like code clean,
because block migration does not depend on auto-converge
capability, so the order of checks can be adjusted.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <168618975839.6361.17407633874747688653-5@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/ram.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index 0ada6477e8..f31de47a47 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -995,7 +995,11 @@ static void migration_trigger_throttle(RAMState *rs)
     /* During block migration the auto-converge logic incorrectly detects
      * that ram migration makes no progress. Avoid this by disabling the
      * throttling logic during the bulk phase of block migration. */
-    if (migrate_auto_converge() && !blk_mig_bulk_active()) {
+    if (blk_mig_bulk_active()) {
+        return;
+    }
+
+    if (migrate_auto_converge()) {
         /* The following detection logic can be refined later. For now:
            Check to see if the ratio between dirtied bytes and the approx.
            amount of bytes that just got transferred since the last time

From 310ad5625e107568a0204ec1e1623e267fad3a9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Thu, 15 Jun 2023 21:29:44 +0800
Subject: [PATCH 0941/1353] migration: Put the detection logic before
 auto-converge checking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit is prepared for the implementation of dirty-limit
convergence algo.

The detection logic of throttling condition can apply to both
auto-converge and dirty-limit algo, putting it's position
before the checking logic for auto-converge feature.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-ID: <168733225273.5845.15871826788879741674-6@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/ram.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/migration/ram.c b/migration/ram.c
index f31de47a47..1d9300f4c5 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -999,17 +999,18 @@ static void migration_trigger_throttle(RAMState *rs)
         return;
     }
 
-    if (migrate_auto_converge()) {
-        /* The following detection logic can be refined later. For now:
-           Check to see if the ratio between dirtied bytes and the approx.
-           amount of bytes that just got transferred since the last time
-           we were in this routine reaches the threshold. If that happens
-           twice, start or increase throttling. */
-
-        if ((bytes_dirty_period > bytes_dirty_threshold) &&
-            (++rs->dirty_rate_high_cnt >= 2)) {
+    /*
+     * The following detection logic can be refined later. For now:
+     * Check to see if the ratio between dirtied bytes and the approx.
+     * amount of bytes that just got transferred since the last time
+     * we were in this routine reaches the threshold. If that happens
+     * twice, start or increase throttling.
+     */
+    if ((bytes_dirty_period > bytes_dirty_threshold) &&
+        (++rs->dirty_rate_high_cnt >= 2)) {
+        rs->dirty_rate_high_cnt = 0;
+        if (migrate_auto_converge()) {
             trace_migration_throttle();
-            rs->dirty_rate_high_cnt = 0;
             mig_throttle_guest_down(bytes_dirty_period,
                                     bytes_dirty_threshold);
         }

From acac51ba246ad1046c69de9e0b1a7e8523e2de99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Thu, 8 Jun 2023 00:12:40 +0800
Subject: [PATCH 0942/1353] migration: Implement dirty-limit convergence algo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement dirty-limit convergence algo for live migration,
which is kind of like auto-converge algo but using dirty-limit
instead of cpu throttle to make migration convergent.

Enable dirty page limit if dirty_rate_high_cnt greater than 2
when dirty-limit capability enabled, Disable dirty-limit if
migration be canceled.

Note that "set_vcpu_dirty_limit", "cancel_vcpu_dirty_limit"
commands are not allowed during dirty-limit live migration.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <168733225273.5845.15871826788879741674-7@git.sr.ht>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/migration.c  |  3 +++
 migration/ram.c        | 36 ++++++++++++++++++++++++++++++++++++
 migration/trace-events |  1 +
 softmmu/dirtylimit.c   | 29 +++++++++++++++++++++++++++++
 4 files changed, 69 insertions(+)

diff --git a/migration/migration.c b/migration/migration.c
index ae49d42eab..49332251e8 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -166,6 +166,9 @@ void migration_cancel(const Error *error)
     if (error) {
         migrate_set_error(current_migration, error);
     }
+    if (migrate_dirty_limit()) {
+        qmp_cancel_vcpu_dirty_limit(false, -1, NULL);
+    }
     migrate_fd_cancel(current_migration);
 }
 
diff --git a/migration/ram.c b/migration/ram.c
index 1d9300f4c5..9040d66e61 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -46,6 +46,7 @@
 #include "qapi/error.h"
 #include "qapi/qapi-types-migration.h"
 #include "qapi/qapi-events-migration.h"
+#include "qapi/qapi-commands-migration.h"
 #include "qapi/qmp/qerror.h"
 #include "trace.h"
 #include "exec/ram_addr.h"
@@ -59,6 +60,8 @@
 #include "multifd.h"
 #include "sysemu/runstate.h"
 #include "options.h"
+#include "sysemu/dirtylimit.h"
+#include "sysemu/kvm.h"
 
 #include "hw/boards.h" /* for machine_dump_guest_core() */
 
@@ -984,6 +987,37 @@ static void migration_update_rates(RAMState *rs, int64_t end_time)
     }
 }
 
+/*
+ * Enable dirty-limit to throttle down the guest
+ */
+static void migration_dirty_limit_guest(void)
+{
+    /*
+     * dirty page rate quota for all vCPUs fetched from
+     * migration parameter 'vcpu_dirty_limit'
+     */
+    static int64_t quota_dirtyrate;
+    MigrationState *s = migrate_get_current();
+
+    /*
+     * If dirty limit already enabled and migration parameter
+     * vcpu-dirty-limit untouched.
+     */
+    if (dirtylimit_in_service() &&
+        quota_dirtyrate == s->parameters.vcpu_dirty_limit) {
+        return;
+    }
+
+    quota_dirtyrate = s->parameters.vcpu_dirty_limit;
+
+    /*
+     * Set all vCPU a quota dirtyrate, note that the second
+     * parameter will be ignored if setting all vCPU for the vm
+     */
+    qmp_set_vcpu_dirty_limit(false, -1, quota_dirtyrate, NULL);
+    trace_migration_dirty_limit_guest(quota_dirtyrate);
+}
+
 static void migration_trigger_throttle(RAMState *rs)
 {
     uint64_t threshold = migrate_throttle_trigger_threshold();
@@ -1013,6 +1047,8 @@ static void migration_trigger_throttle(RAMState *rs)
             trace_migration_throttle();
             mig_throttle_guest_down(bytes_dirty_period,
                                     bytes_dirty_threshold);
+        } else if (migrate_dirty_limit()) {
+            migration_dirty_limit_guest();
         }
     }
 }
diff --git a/migration/trace-events b/migration/trace-events
index 4e43fe20fc..4666f19325 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -93,6 +93,7 @@ migration_bitmap_sync_start(void) ""
 migration_bitmap_sync_end(uint64_t dirty_pages) "dirty_pages %" PRIu64
 migration_bitmap_clear_dirty(char *str, uint64_t start, uint64_t size, unsigned long page) "rb %s start 0x%"PRIx64" size 0x%"PRIx64" page 0x%lx"
 migration_throttle(void) ""
+migration_dirty_limit_guest(int64_t dirtyrate) "guest dirty page rate limit %" PRIi64 " MB/s"
 ram_discard_range(const char *rbname, uint64_t start, size_t len) "%s: start: %" PRIx64 " %zx"
 ram_load_loop(const char *rbname, uint64_t addr, int flags, void *host) "%s: addr: 0x%" PRIx64 " flags: 0x%x host: %p"
 ram_load_postcopy_loop(int channel, uint64_t addr, int flags) "chan=%d addr=0x%" PRIx64 " flags=0x%x"
diff --git a/softmmu/dirtylimit.c b/softmmu/dirtylimit.c
index 942d876523..a6d854d161 100644
--- a/softmmu/dirtylimit.c
+++ b/softmmu/dirtylimit.c
@@ -436,6 +436,23 @@ static void dirtylimit_cleanup(void)
     dirtylimit_state_finalize();
 }
 
+/*
+ * dirty page rate limit is not allowed to set if migration
+ * is running with dirty-limit capability enabled.
+ */
+static bool dirtylimit_is_allowed(void)
+{
+    MigrationState *ms = migrate_get_current();
+
+    if (migration_is_running(ms->state) &&
+        (!qemu_thread_is_self(&ms->thread)) &&
+        migrate_dirty_limit() &&
+        dirtylimit_in_service()) {
+        return false;
+    }
+    return true;
+}
+
 void qmp_cancel_vcpu_dirty_limit(bool has_cpu_index,
                                  int64_t cpu_index,
                                  Error **errp)
@@ -449,6 +466,12 @@ void qmp_cancel_vcpu_dirty_limit(bool has_cpu_index,
         return;
     }
 
+    if (!dirtylimit_is_allowed()) {
+        error_setg(errp, "can't cancel dirty page rate limit while"
+                   " migration is running");
+        return;
+    }
+
     if (!dirtylimit_in_service()) {
         return;
     }
@@ -499,6 +522,12 @@ void qmp_set_vcpu_dirty_limit(bool has_cpu_index,
         return;
     }
 
+    if (!dirtylimit_is_allowed()) {
+        error_setg(errp, "can't set dirty page rate limit while"
+                   " migration is running");
+        return;
+    }
+
     if (!dirty_rate) {
         qmp_cancel_vcpu_dirty_limit(has_cpu_index, cpu_index, errp);
         return;

From 15699cf5422aa7577ebe1a936aca4d589446b952 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Thu, 8 Jun 2023 00:21:58 +0800
Subject: [PATCH 0943/1353] migration: Extend query-migrate to provide dirty
 page limit info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extend query-migrate to provide throttle time and estimated
ring full time with dirty-limit capability enabled, through which
we can observe if dirty limit take effect during live migration.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-ID: <168733225273.5845.15871826788879741674-8@git.sr.ht>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 include/sysemu/dirtylimit.h    |  2 ++
 migration/migration-hmp-cmds.c | 10 +++++++++
 migration/migration.c          | 10 +++++++++
 qapi/migration.json            | 16 +++++++++++++-
 softmmu/dirtylimit.c           | 39 ++++++++++++++++++++++++++++++++++
 5 files changed, 76 insertions(+), 1 deletion(-)

diff --git a/include/sysemu/dirtylimit.h b/include/sysemu/dirtylimit.h
index 8d2c1f3a6b..d11ebbbbdb 100644
--- a/include/sysemu/dirtylimit.h
+++ b/include/sysemu/dirtylimit.h
@@ -34,4 +34,6 @@ void dirtylimit_set_vcpu(int cpu_index,
 void dirtylimit_set_all(uint64_t quota,
                         bool enable);
 void dirtylimit_vcpu_execute(CPUState *cpu);
+uint64_t dirtylimit_throttle_time_per_round(void);
+uint64_t dirtylimit_ring_full_time(void);
 #endif
diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 35e8020bbf..c115ef2d23 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -190,6 +190,16 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
                        info->cpu_throttle_percentage);
     }
 
+    if (info->has_dirty_limit_throttle_time_per_round) {
+        monitor_printf(mon, "dirty-limit throttle time: %" PRIu64 " us\n",
+                       info->dirty_limit_throttle_time_per_round);
+    }
+
+    if (info->has_dirty_limit_ring_full_time) {
+        monitor_printf(mon, "dirty-limit ring full time: %" PRIu64 " us\n",
+                       info->dirty_limit_ring_full_time);
+    }
+
     if (info->has_postcopy_blocktime) {
         monitor_printf(mon, "postcopy blocktime: %u\n",
                        info->postcopy_blocktime);
diff --git a/migration/migration.c b/migration/migration.c
index 49332251e8..1ea7512291 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -64,6 +64,7 @@
 #include "yank_functions.h"
 #include "sysemu/qtest.h"
 #include "options.h"
+#include "sysemu/dirtylimit.h"
 
 static NotifierList migration_state_notifiers =
     NOTIFIER_LIST_INITIALIZER(migration_state_notifiers);
@@ -974,6 +975,15 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
         info->ram->dirty_pages_rate =
            stat64_get(&mig_stats.dirty_pages_rate);
     }
+
+    if (migrate_dirty_limit() && dirtylimit_in_service()) {
+        info->has_dirty_limit_throttle_time_per_round = true;
+        info->dirty_limit_throttle_time_per_round =
+                            dirtylimit_throttle_time_per_round();
+
+        info->has_dirty_limit_ring_full_time = true;
+        info->dirty_limit_ring_full_time = dirtylimit_ring_full_time();
+    }
 }
 
 static void populate_disk_info(MigrationInfo *info)
diff --git a/qapi/migration.json b/qapi/migration.json
index e094438d74..440660bced 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -250,6 +250,18 @@
 #     blocked.  Present and non-empty when migration is blocked.
 #     (since 6.0)
 #
+# @dirty-limit-throttle-time-per-round: Maximum throttle time (in microseconds) of virtual
+#                                       CPUs each dirty ring full round, which shows how
+#                                       MigrationCapability dirty-limit affects the guest
+#                                       during live migration. (since 8.1)
+#
+# @dirty-limit-ring-full-time: Estimated average dirty ring full time (in microseconds)
+#                              each dirty ring full round, note that the value equals
+#                              dirty ring memory size divided by average dirty page rate
+#                              of virtual CPU, which can be used to observe the average
+#                              memory load of virtual CPU indirectly. Note that zero
+#                              means guest doesn't dirty memory (since 8.1)
+#
 # Since: 0.14
 ##
 { 'struct': 'MigrationInfo',
@@ -267,7 +279,9 @@
            '*postcopy-blocktime': 'uint32',
            '*postcopy-vcpu-blocktime': ['uint32'],
            '*compression': 'CompressionStats',
-           '*socket-address': ['SocketAddress'] } }
+           '*socket-address': ['SocketAddress'],
+           '*dirty-limit-throttle-time-per-round': 'uint64',
+           '*dirty-limit-ring-full-time': 'uint64'} }
 
 ##
 # @query-migrate:
diff --git a/softmmu/dirtylimit.c b/softmmu/dirtylimit.c
index a6d854d161..3c275ee55b 100644
--- a/softmmu/dirtylimit.c
+++ b/softmmu/dirtylimit.c
@@ -565,6 +565,45 @@ out:
     hmp_handle_error(mon, err);
 }
 
+/* Return the max throttle time of each virtual CPU */
+uint64_t dirtylimit_throttle_time_per_round(void)
+{
+    CPUState *cpu;
+    int64_t max = 0;
+
+    CPU_FOREACH(cpu) {
+        if (cpu->throttle_us_per_full > max) {
+            max = cpu->throttle_us_per_full;
+        }
+    }
+
+    return max;
+}
+
+/*
+ * Estimate average dirty ring full time of each virtaul CPU.
+ * Return 0 if guest doesn't dirty memory.
+ */
+uint64_t dirtylimit_ring_full_time(void)
+{
+    CPUState *cpu;
+    uint64_t curr_rate = 0;
+    int nvcpus = 0;
+
+    CPU_FOREACH(cpu) {
+        if (cpu->running) {
+            nvcpus++;
+            curr_rate += vcpu_dirty_rate_get(cpu->cpu_index);
+        }
+    }
+
+    if (!curr_rate || !nvcpus) {
+        return 0;
+    }
+
+    return dirtylimit_dirty_ring_full_time(curr_rate / nvcpus);
+}
+
 static struct DirtyLimitInfo *dirtylimit_query_vcpu(int cpu_index)
 {
     DirtyLimitInfo *info = NULL;

From e3131dc76a7368395f40d96f77c372e9f5676dc8 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Fri, 9 Jun 2023 00:49:02 +0200
Subject: [PATCH 0944/1353] migration-test: Be consistent for ppc

It makes no sense that we don't have the same configuration on both sides.

Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Message-ID: <20230608224943.3877-2-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 tests/qtest/migration-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index e256da1216..2296ed4bf5 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -748,7 +748,7 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                       "'nvramrc=hex .\" _\" begin %x %x "
                                       "do i c@ 1 + i c! 1000 +loop .\" B\" 0 "
                                       "until'", end_address, start_address);
-        arch_target = g_strdup("");
+        arch_target = g_strdup("-nodefaults");
     } else if (strcmp(arch, "aarch64") == 0) {
         init_bootfile(bootpath, aarch64_kernel, sizeof(aarch64_kernel));
         machine_opts = "virt,gic-version=max";

From 42e52a8a7746d6f627cb391280f18dbbc72a16e5 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Fri, 9 Jun 2023 00:49:05 +0200
Subject: [PATCH 0945/1353] migration-test: Make machine_opts regular with
 other options

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230608224943.3877-5-quintela@redhat.com>
---
 tests/qtest/migration-test.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index 2296ed4bf5..f51a25e299 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -739,7 +739,7 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         start_address = S390_TEST_MEM_START;
         end_address = S390_TEST_MEM_END;
     } else if (strcmp(arch, "ppc64") == 0) {
-        machine_opts = "vsmt=8";
+        machine_opts = "-machine vsmt=8";
         memory_size = "256M";
         start_address = PPC_TEST_MEM_START;
         end_address = PPC_TEST_MEM_END;
@@ -751,7 +751,7 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         arch_target = g_strdup("-nodefaults");
     } else if (strcmp(arch, "aarch64") == 0) {
         init_bootfile(bootpath, aarch64_kernel, sizeof(aarch64_kernel));
-        machine_opts = "virt,gic-version=max";
+        machine_opts = "-machine virt,gic-version=max";
         memory_size = "150M";
         arch_source = g_strdup_printf("-cpu max "
                                       "-kernel %s",
@@ -791,14 +791,13 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         shmem_opts = g_strdup("");
     }
 
-    cmd_source = g_strdup_printf("-accel kvm%s -accel tcg%s%s "
+    cmd_source = g_strdup_printf("-accel kvm%s -accel tcg %s "
                                  "-name source,debug-threads=on "
                                  "-m %s "
                                  "-serial file:%s/src_serial "
                                  "%s %s %s %s",
                                  args->use_dirty_ring ?
                                  ",dirty-ring-size=4096" : "",
-                                 machine_opts ? " -machine " : "",
                                  machine_opts ? machine_opts : "",
                                  memory_size, tmpfs,
                                  arch_source, shmem_opts,
@@ -811,7 +810,7 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                      &got_src_stop);
     }
 
-    cmd_target = g_strdup_printf("-accel kvm%s -accel tcg%s%s "
+    cmd_target = g_strdup_printf("-accel kvm%s -accel tcg %s "
                                  "-name target,debug-threads=on "
                                  "-m %s "
                                  "-serial file:%s/dest_serial "
@@ -819,7 +818,6 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                  "%s %s %s %s",
                                  args->use_dirty_ring ?
                                  ",dirty-ring-size=4096" : "",
-                                 machine_opts ? " -machine " : "",
                                  machine_opts ? machine_opts : "",
                                  memory_size, tmpfs, uri,
                                  arch_target, shmem_opts,

From 832c732c5d30e4f8f5d9d4137a0c2ab4df429b98 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Fri, 9 Jun 2023 00:49:06 +0200
Subject: [PATCH 0946/1353] migration-test: Create arch_opts

This will contain the options needed for both source and target.

Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20230608224943.3877-6-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 tests/qtest/migration-test.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index f51a25e299..c723f083da 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -702,6 +702,8 @@ static int test_migrate_start(QTestState **from, QTestState **to,
 {
     g_autofree gchar *arch_source = NULL;
     g_autofree gchar *arch_target = NULL;
+    /* options for source and target */
+    g_autofree gchar *arch_opts = NULL;
     g_autofree gchar *cmd_source = NULL;
     g_autofree gchar *cmd_target = NULL;
     const gchar *ignore_stderr;
@@ -727,15 +729,13 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         assert(sizeof(x86_bootsect) == 512);
         init_bootfile(bootpath, x86_bootsect, sizeof(x86_bootsect));
         memory_size = "150M";
-        arch_source = g_strdup_printf("-drive file=%s,format=raw", bootpath);
-        arch_target = g_strdup(arch_source);
+        arch_opts = g_strdup_printf("-drive file=%s,format=raw", bootpath);
         start_address = X86_TEST_MEM_START;
         end_address = X86_TEST_MEM_END;
     } else if (g_str_equal(arch, "s390x")) {
         init_bootfile(bootpath, s390x_elf, sizeof(s390x_elf));
         memory_size = "128M";
-        arch_source = g_strdup_printf("-bios %s", bootpath);
-        arch_target = g_strdup(arch_source);
+        arch_opts = g_strdup_printf("-bios %s", bootpath);
         start_address = S390_TEST_MEM_START;
         end_address = S390_TEST_MEM_END;
     } else if (strcmp(arch, "ppc64") == 0) {
@@ -743,20 +743,16 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         memory_size = "256M";
         start_address = PPC_TEST_MEM_START;
         end_address = PPC_TEST_MEM_END;
-        arch_source = g_strdup_printf("-nodefaults "
-                                      "-prom-env 'use-nvramrc?=true' -prom-env "
+        arch_source = g_strdup_printf("-prom-env 'use-nvramrc?=true' -prom-env "
                                       "'nvramrc=hex .\" _\" begin %x %x "
                                       "do i c@ 1 + i c! 1000 +loop .\" B\" 0 "
                                       "until'", end_address, start_address);
-        arch_target = g_strdup("-nodefaults");
+        arch_opts = g_strdup("-nodefaults");
     } else if (strcmp(arch, "aarch64") == 0) {
         init_bootfile(bootpath, aarch64_kernel, sizeof(aarch64_kernel));
         machine_opts = "-machine virt,gic-version=max";
         memory_size = "150M";
-        arch_source = g_strdup_printf("-cpu max "
-                                      "-kernel %s",
-                                      bootpath);
-        arch_target = g_strdup(arch_source);
+        arch_opts = g_strdup_printf("-cpu max -kernel %s", bootpath);
         start_address = ARM_TEST_MEM_START;
         end_address = ARM_TEST_MEM_END;
 
@@ -795,12 +791,14 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                  "-name source,debug-threads=on "
                                  "-m %s "
                                  "-serial file:%s/src_serial "
-                                 "%s %s %s %s",
+                                 "%s %s %s %s %s",
                                  args->use_dirty_ring ?
                                  ",dirty-ring-size=4096" : "",
                                  machine_opts ? machine_opts : "",
                                  memory_size, tmpfs,
-                                 arch_source, shmem_opts,
+                                 arch_opts ? arch_opts : "",
+                                 arch_source ? arch_source : "",
+                                 shmem_opts,
                                  args->opts_source ? args->opts_source : "",
                                  ignore_stderr);
     if (!args->only_target) {
@@ -815,12 +813,14 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                  "-m %s "
                                  "-serial file:%s/dest_serial "
                                  "-incoming %s "
-                                 "%s %s %s %s",
+                                 "%s %s %s %s %s",
                                  args->use_dirty_ring ?
                                  ",dirty-ring-size=4096" : "",
                                  machine_opts ? machine_opts : "",
                                  memory_size, tmpfs, uri,
-                                 arch_target, shmem_opts,
+                                 arch_opts ? arch_opts : "",
+                                 arch_target ? arch_target : "",
+                                 shmem_opts,
                                  args->opts_target ? args->opts_target : "",
                                  ignore_stderr);
     *to = qtest_init(cmd_target);

From bc28a6111dc982386403c60de8df10a96f4d4f99 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Fri, 9 Jun 2023 00:49:07 +0200
Subject: [PATCH 0947/1353] migration-test: machine_opts is really arch
 specific

And it needs to be in both source and target, so put it on arch_opts.

Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20230608224943.3877-7-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 tests/qtest/migration-test.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index c723f083da..fd145e38d9 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -711,7 +711,6 @@ static int test_migrate_start(QTestState **from, QTestState **to,
     g_autofree char *shmem_opts = NULL;
     g_autofree char *shmem_path = NULL;
     const char *arch = qtest_get_arch();
-    const char *machine_opts = NULL;
     const char *memory_size;
 
     if (args->use_shmem) {
@@ -739,7 +738,6 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         start_address = S390_TEST_MEM_START;
         end_address = S390_TEST_MEM_END;
     } else if (strcmp(arch, "ppc64") == 0) {
-        machine_opts = "-machine vsmt=8";
         memory_size = "256M";
         start_address = PPC_TEST_MEM_START;
         end_address = PPC_TEST_MEM_END;
@@ -747,12 +745,12 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                       "'nvramrc=hex .\" _\" begin %x %x "
                                       "do i c@ 1 + i c! 1000 +loop .\" B\" 0 "
                                       "until'", end_address, start_address);
-        arch_opts = g_strdup("-nodefaults");
+        arch_opts = g_strdup("-nodefaults -machine vsmt=8");
     } else if (strcmp(arch, "aarch64") == 0) {
         init_bootfile(bootpath, aarch64_kernel, sizeof(aarch64_kernel));
-        machine_opts = "-machine virt,gic-version=max";
         memory_size = "150M";
-        arch_opts = g_strdup_printf("-cpu max -kernel %s", bootpath);
+        arch_opts = g_strdup_printf("-machine virt,gic-version=max -cpu max "
+                                    "-kernel %s", bootpath);
         start_address = ARM_TEST_MEM_START;
         end_address = ARM_TEST_MEM_END;
 
@@ -787,14 +785,13 @@ static int test_migrate_start(QTestState **from, QTestState **to,
         shmem_opts = g_strdup("");
     }
 
-    cmd_source = g_strdup_printf("-accel kvm%s -accel tcg %s "
+    cmd_source = g_strdup_printf("-accel kvm%s -accel tcg "
                                  "-name source,debug-threads=on "
                                  "-m %s "
                                  "-serial file:%s/src_serial "
                                  "%s %s %s %s %s",
                                  args->use_dirty_ring ?
                                  ",dirty-ring-size=4096" : "",
-                                 machine_opts ? machine_opts : "",
                                  memory_size, tmpfs,
                                  arch_opts ? arch_opts : "",
                                  arch_source ? arch_source : "",
@@ -808,7 +805,7 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                      &got_src_stop);
     }
 
-    cmd_target = g_strdup_printf("-accel kvm%s -accel tcg %s "
+    cmd_target = g_strdup_printf("-accel kvm%s -accel tcg "
                                  "-name target,debug-threads=on "
                                  "-m %s "
                                  "-serial file:%s/dest_serial "
@@ -816,7 +813,6 @@ static int test_migrate_start(QTestState **from, QTestState **to,
                                  "%s %s %s %s %s",
                                  args->use_dirty_ring ?
                                  ",dirty-ring-size=4096" : "",
-                                 machine_opts ? machine_opts : "",
                                  memory_size, tmpfs, uri,
                                  arch_opts ? arch_opts : "",
                                  arch_target ? arch_target : "",

From 7b24d326348e1672e63e2e325c90c2bf7711e5f6 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Mon, 12 Jun 2023 21:33:39 +0200
Subject: [PATCH 0948/1353] migration: skipped field is really obsolete.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Has return zero for more than 10 years.

Specifically we introduced the field in 1.5.0

commit f1c72795af573b24a7da5eb52375c9aba8a37972
Author: Peter Lieven <pl@kamp.de>
Date:   Tue Mar 26 10:58:37 2013 +0100

    migration: do not sent zero pages in bulk stage

    during bulk stage of ram migration if a page is a
    zero page do not send it at all.
    the memory at the destination reads as zero anyway.

    even if there is an madvise with QEMU_MADV_DONTNEED
    at the target upon receipt of a zero page I have observed
    that the target starts swapping if the memory is overcommitted.
    it seems that the pages are dropped asynchronously.

    this patch also updates QMP to return the number of
    skipped pages in MigrationStats.

but removed its usage in 1.5.3

commit 9ef051e5536b6368a1076046ec6c4ec4ac12b5c6
Author: Peter Lieven <pl@kamp.de>
Date:   Mon Jun 10 12:14:19 2013 +0200

    Revert "migration: do not sent zero pages in bulk stage"

    Not sending zero pages breaks migration if a page is zero
    at the source but not at the destination. This can e.g. happen
    if different BIOS versions are used at source and destination.
    It has also been reported that migration on pseries is completely
    broken with this patch.

    This effectively reverts commit f1c72795af573b24a7da5eb52375c9aba8a37972.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20230612193344.3796-2-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 docs/about/deprecated.rst | 10 ++++++++++
 qapi/migration.json       | 12 ++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 02ea5a839f..1c35f55666 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -451,3 +451,13 @@ both, older and future versions of QEMU.
 The ``blacklist`` config file option has been renamed to ``block-rpcs``
 (to be in sync with the renaming of the corresponding command line
 option).
+
+Migration
+---------
+
+``skipped`` MigrationStats field (since 8.1)
+''''''''''''''''''''''''''''''''''''''''''''
+
+``skipped`` field in Migration stats has been deprecated.  It hasn't
+been used for more than 10 years.
+
diff --git a/qapi/migration.json b/qapi/migration.json
index 440660bced..388425b4c8 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -23,7 +23,8 @@
 #
 # @duplicate: number of duplicate (zero) pages (since 1.2)
 #
-# @skipped: number of skipped zero pages (since 1.5)
+# @skipped: number of skipped zero pages. Always zero, only provided for
+#     compatibility (since 1.5)
 #
 # @normal: number of normal pages (since 1.2)
 #
@@ -62,11 +63,18 @@
 #     between 0 and @dirty-sync-count * @multifd-channels.  (since
 #     7.1)
 #
+# Features:
+#
+# @deprecated: Member @skipped is always zero since 1.5.3
+#
 # Since: 0.14
+#
 ##
 { 'struct': 'MigrationStats',
   'data': {'transferred': 'int', 'remaining': 'int', 'total': 'int' ,
-           'duplicate': 'int', 'skipped': 'int', 'normal': 'int',
+           'duplicate': 'int',
+           'skipped': { 'type': 'int', 'features': ['deprecated'] },
+           'normal': 'int',
            'normal-bytes': 'int', 'dirty-pages-rate': 'int',
            'mbps': 'number', 'dirty-sync-count': 'int',
            'postcopy-requests': 'int', 'page-size': 'int',

From f014880ab973a09e56e1b7fa100a201fe9f45966 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 6 Jul 2023 07:56:11 -0400
Subject: [PATCH 0949/1353] docs/migration: Update postcopy bits

We have postcopy recovery but not reflected in the document, do an update
for that.

Add a very small section on postcopy preempt.

Touch up the pagemap section, dropping the unsent map because it's already
been dropped in the source code in commit 1e7cf8c323 ("migration/postcopy:
unsentmap is not necessary for postcopy").

Touch up the postcopy section to remove "network connection" failures as
downside, because now it's not fatal and can be recovered.  Suggested by
Laszlo.

Acked-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230706115611.371048-1-peterx@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 docs/devel/migration.rst | 92 ++++++++++++++++++++++++++++------------
 1 file changed, 66 insertions(+), 26 deletions(-)

diff --git a/docs/devel/migration.rst b/docs/devel/migration.rst
index 6f65c23b47..c3e1400c0c 100644
--- a/docs/devel/migration.rst
+++ b/docs/devel/migration.rst
@@ -594,8 +594,7 @@ Postcopy
 'Postcopy' migration is a way to deal with migrations that refuse to converge
 (or take too long to converge) its plus side is that there is an upper bound on
 the amount of migration traffic and time it takes, the down side is that during
-the postcopy phase, a failure of *either* side or the network connection causes
-the guest to be lost.
+the postcopy phase, a failure of *either* side causes the guest to be lost.
 
 In postcopy the destination CPUs are started before all the memory has been
 transferred, and accesses to pages that are yet to be transferred cause
@@ -721,6 +720,42 @@ processing.
    is no longer used by migration, while the listen thread carries on servicing
    page data until the end of migration.
 
+Postcopy Recovery
+-----------------
+
+Comparing to precopy, postcopy is special on error handlings.  When any
+error happens (in this case, mostly network errors), QEMU cannot easily
+fail a migration because VM data resides in both source and destination
+QEMU instances.  On the other hand, when issue happens QEMU on both sides
+will go into a paused state.  It'll need a recovery phase to continue a
+paused postcopy migration.
+
+The recovery phase normally contains a few steps:
+
+  - When network issue occurs, both QEMU will go into PAUSED state
+
+  - When the network is recovered (or a new network is provided), the admin
+    can setup the new channel for migration using QMP command
+    'migrate-recover' on destination node, preparing for a resume.
+
+  - On source host, the admin can continue the interrupted postcopy
+    migration using QMP command 'migrate' with resume=true flag set.
+
+  - After the connection is re-established, QEMU will continue the postcopy
+    migration on both sides.
+
+During a paused postcopy migration, the VM can logically still continue
+running, and it will not be impacted from any page access to pages that
+were already migrated to destination VM before the interruption happens.
+However, if any of the missing pages got accessed on destination VM, the VM
+thread will be halted waiting for the page to be migrated, it means it can
+be halted until the recovery is complete.
+
+The impact of accessing missing pages can be relevant to different
+configurations of the guest.  For example, when with async page fault
+enabled, logically the guest can proactively schedule out the threads
+accessing missing pages.
+
 Postcopy states
 ---------------
 
@@ -765,36 +800,31 @@ ADVISE->DISCARD->LISTEN->RUNNING->END
     (although it can't do the cleanup it would do as it
     finishes a normal migration).
 
+ - Paused
+
+    Postcopy can run into a paused state (normally on both sides when
+    happens), where all threads will be temporarily halted mostly due to
+    network errors.  When reaching paused state, migration will make sure
+    the qemu binary on both sides maintain the data without corrupting
+    the VM.  To continue the migration, the admin needs to fix the
+    migration channel using the QMP command 'migrate-recover' on the
+    destination node, then resume the migration using QMP command 'migrate'
+    again on source node, with resume=true flag set.
+
  - End
 
     The listen thread can now quit, and perform the cleanup of migration
     state, the migration is now complete.
 
-Source side page maps
----------------------
+Source side page map
+--------------------
 
-The source side keeps two bitmaps during postcopy; 'the migration bitmap'
-and 'unsent map'.  The 'migration bitmap' is basically the same as in
-the precopy case, and holds a bit to indicate that page is 'dirty' -
-i.e. needs sending.  During the precopy phase this is updated as the CPU
-dirties pages, however during postcopy the CPUs are stopped and nothing
-should dirty anything any more.
-
-The 'unsent map' is used for the transition to postcopy. It is a bitmap that
-has a bit cleared whenever a page is sent to the destination, however during
-the transition to postcopy mode it is combined with the migration bitmap
-to form a set of pages that:
-
-   a) Have been sent but then redirtied (which must be discarded)
-   b) Have not yet been sent - which also must be discarded to cause any
-      transparent huge pages built during precopy to be broken.
-
-Note that the contents of the unsentmap are sacrificed during the calculation
-of the discard set and thus aren't valid once in postcopy.  The dirtymap
-is still valid and is used to ensure that no page is sent more than once.  Any
-request for a page that has already been sent is ignored.  Duplicate requests
-such as this can happen as a page is sent at about the same time the
-destination accesses it.
+The 'migration bitmap' in postcopy is basically the same as in the precopy,
+where each of the bit to indicate that page is 'dirty' - i.e. needs
+sending.  During the precopy phase this is updated as the CPU dirties
+pages, however during postcopy the CPUs are stopped and nothing should
+dirty anything any more. Instead, dirty bits are cleared when the relevant
+pages are sent during postcopy.
 
 Postcopy with hugepages
 -----------------------
@@ -853,6 +883,16 @@ Retro-fitting postcopy to existing clients is possible:
      guest memory access is made while holding a lock then all other
      threads waiting for that lock will also be blocked.
 
+Postcopy Preemption Mode
+------------------------
+
+Postcopy preempt is a new capability introduced in 8.0 QEMU release, it
+allows urgent pages (those got page fault requested from destination QEMU
+explicitly) to be sent in a separate preempt channel, rather than queued in
+the background migration channel.  Anyone who cares about latencies of page
+faults during a postcopy migration should enable this feature.  By default,
+it's not enabled.
+
 Firmware
 ========
 

From 908927db28eafb404ec4c3a50249ddb52bd4afde Mon Sep 17 00:00:00 2001
From: Tejus GK <tejus.gk@nutanix.com>
Date: Wed, 21 Jun 2023 13:09:39 +0000
Subject: [PATCH 0950/1353] migration: Update error description whenever
 migration fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are places in migration.c where the migration is marked failed with
MIGRATION_STATUS_FAILED, but the failure reason is never updated. Hence
libvirt doesn't know why the migration failed when it queries for it.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Tejus GK <tejus.gk@nutanix.com>
Message-ID: <20230621130940.178659-2-tejus.gk@nutanix.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/migration.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 1ea7512291..5528acb65e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1689,7 +1689,7 @@ void qmp_migrate(const char *uri, bool has_blk, bool blk,
         if (!resume_requested) {
             yank_unregister_instance(MIGRATION_YANK_INSTANCE);
         }
-        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "uri",
+        error_setg(&local_err, QERR_INVALID_PARAMETER_VALUE, "uri",
                    "a valid migration protocol");
         migrate_set_state(&s->state, MIGRATION_STATUS_SETUP,
                           MIGRATION_STATUS_FAILED);
@@ -2082,7 +2082,7 @@ migration_wait_main_channel(MigrationState *ms)
  * Switch from normal iteration to postcopy
  * Returns non-0 on error
  */
-static int postcopy_start(MigrationState *ms)
+static int postcopy_start(MigrationState *ms, Error **errp)
 {
     int ret;
     QIOChannelBuffer *bioc;
@@ -2192,7 +2192,7 @@ static int postcopy_start(MigrationState *ms)
      */
     ret = qemu_file_get_error(ms->to_dst_file);
     if (ret) {
-        error_report("postcopy_start: Migration stream errored (pre package)");
+        error_setg(errp, "postcopy_start: Migration stream errored (pre package)");
         goto fail_closefb;
     }
 
@@ -2229,7 +2229,7 @@ static int postcopy_start(MigrationState *ms)
 
     ret = qemu_file_get_error(ms->to_dst_file);
     if (ret) {
-        error_report("postcopy_start: Migration stream errored");
+        error_setg(errp, "postcopy_start: Migration stream errored");
         migrate_set_state(&ms->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
                               MIGRATION_STATUS_FAILED);
     }
@@ -2750,6 +2750,7 @@ typedef enum {
 static MigIterateState migration_iteration_run(MigrationState *s)
 {
     uint64_t must_precopy, can_postcopy;
+    Error *local_err = NULL;
     bool in_postcopy = s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE;
     bool can_switchover = migration_can_switchover(s);
 
@@ -2773,8 +2774,9 @@ static MigIterateState migration_iteration_run(MigrationState *s)
     /* Still a significant amount to transfer */
     if (!in_postcopy && must_precopy <= s->threshold_size && can_switchover &&
         qatomic_read(&s->start_postcopy)) {
-        if (postcopy_start(s)) {
-            error_report("%s: postcopy failed to start", __func__);
+        if (postcopy_start(s, &local_err)) {
+            migrate_set_error(s, local_err);
+            error_report_err(local_err);
         }
         return MIG_ITERATE_SKIP;
     }
@@ -3265,8 +3267,10 @@ void migrate_fd_connect(MigrationState *s, Error *error_in)
      */
     if (migrate_postcopy_ram() || migrate_return_path()) {
         if (open_return_path_on_source(s, !resume)) {
-            error_report("Unable to open return-path for postcopy");
+            error_setg(&local_err, "Unable to open return-path for postcopy");
             migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
+            migrate_set_error(s, local_err);
+            error_report_err(local_err);
             migrate_fd_cleanup(s);
             return;
         }
@@ -3290,6 +3294,7 @@ void migrate_fd_connect(MigrationState *s, Error *error_in)
     }
 
     if (multifd_save_setup(&local_err) != 0) {
+        migrate_set_error(s, local_err);
         error_report_err(local_err);
         migrate_set_state(&s->state, MIGRATION_STATUS_SETUP,
                           MIGRATION_STATUS_FAILED);

From 82137e6c8c517e70fe93e262975eaaac5c911635 Mon Sep 17 00:00:00 2001
From: Wei Wang <wei.w.wang@intel.com>
Date: Tue, 6 Jun 2023 18:19:09 +0800
Subject: [PATCH 0951/1353] migration: enforce multifd and postcopy preempt to
 be set before incoming

qemu_start_incoming_migration needs to check the number of multifd
channels or postcopy ram channels to configure the backlog parameter (i.e.
the maximum length to which the queue of pending connections for sockfd
may grow) of listen(). So enforce the usage of postcopy-preempt and
multifd as below:
- need to use "-incoming defer" on the destination; and
- set_capability and set_parameter need to be done before migrate_incoming

Otherwise, disable the use of the features and report error messages to
remind users to adjust the commands.

Signed-off-by: Wei Wang <wei.w.wang@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230606101910.20456-2-wei.w.wang@intel.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Acked-by: Juan Quintela <quintela@redhat.com>
---
 migration/options.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/migration/options.c b/migration/options.c
index 7d83f190d6..1d1e1321b0 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -441,6 +441,11 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
     MIGRATION_CAPABILITY_VALIDATE_UUID,
     MIGRATION_CAPABILITY_ZERO_COPY_SEND);
 
+static bool migrate_incoming_started(void)
+{
+    return !!migration_incoming_get_current()->transport_data;
+}
+
 /**
  * @migration_caps_check - check capability compatibility
  *
@@ -564,6 +569,12 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
             error_setg(errp, "Postcopy preempt not compatible with compress");
             return false;
         }
+
+        if (migrate_incoming_started()) {
+            error_setg(errp,
+                       "Postcopy preempt must be set before incoming starts");
+            return false;
+        }
     }
 
     if (new_caps[MIGRATION_CAPABILITY_MULTIFD]) {
@@ -571,6 +582,10 @@ bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp)
             error_setg(errp, "Multifd is not compatible with compress");
             return false;
         }
+        if (migrate_incoming_started()) {
+            error_setg(errp, "Multifd must be set before incoming starts");
+            return false;
+        }
     }
 
     if (new_caps[MIGRATION_CAPABILITY_SWITCHOVER_ACK]) {

From 06c48d6b37c598787fa60421ca15e8876c2fa402 Mon Sep 17 00:00:00 2001
From: Wei Wang <wei.w.wang@intel.com>
Date: Tue, 6 Jun 2023 18:19:10 +0800
Subject: [PATCH 0952/1353] qtest/migration-tests.c: use "-incoming defer" for
 postcopy tests

The Postcopy preempt capability is expected to be set before incoming
starts, so change the postcopy tests to start with deferred incoming and
call migrate-incoming after the cap has been set.

Why the existing tests (without this patch) didn't fail?
There could be two reasons:
1) "backlog" specifies the number of pending connections. As long as the
   server accepts the connections faster than the clients side connecting,
   connection will succeed. For the preempt test, it uses only 2 channels,
   so very likely to not have pending connections.
2) per my tests (on kernel 6.2), the number of pending connections allowed
   is actually "backlog + 1", which is 2 in this case.
That said, the implementation of socket_start_incoming_migration_internal
expects "migrate defer" to be used, and for safety, change the test to
work with the expected usage.

Signed-off-by: Wei Wang <wei.w.wang@intel.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230606101910.20456-3-wei.w.wang@intel.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 tests/qtest/migration-test.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index fd145e38d9..62d3f37021 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -1239,10 +1239,9 @@ static int migrate_postcopy_prepare(QTestState **from_ptr,
                                     QTestState **to_ptr,
                                     MigrateCommon *args)
 {
-    g_autofree char *uri = g_strdup_printf("unix:%s/migsocket", tmpfs);
     QTestState *from, *to;
 
-    if (test_migrate_start(&from, &to, uri, &args->start)) {
+    if (test_migrate_start(&from, &to, "defer", &args->start)) {
         return -1;
     }
 
@@ -1262,10 +1261,13 @@ static int migrate_postcopy_prepare(QTestState **from_ptr,
     migrate_ensure_non_converge(from);
 
     migrate_prepare_for_dirty_mem(from);
+    qtest_qmp_assert_success(to, "{ 'execute': 'migrate-incoming',"
+                             "  'arguments': { 'uri': 'tcp:127.0.0.1:0' }}");
 
     /* Wait for the first serial output from the source */
     wait_for_serial("src_serial");
 
+    g_autofree char *uri = migrate_get_socket_address(to, "socket-address");
     migrate_qmp(from, uri, "{}");
 
     migrate_wait_for_dirty_mem(from, to);

From fc95c63b603221b3bdedc544a39030fbea3f47a4 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Tue, 30 May 2023 20:39:22 +0200
Subject: [PATCH 0953/1353] qemu-file: Rename qemu_file_transferred_ fast ->
 noflush
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fast don't say much.  Noflush indicates more clearly that it is like
qemu_file_transferred but without the flush.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230530183941.7223-2-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/qemu-file.c |  2 +-
 migration/qemu-file.h | 11 +++++------
 migration/savevm.c    |  4 ++--
 migration/vmstate.c   |  4 ++--
 4 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index acc282654a..fdf115b5da 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -694,7 +694,7 @@ int coroutine_mixed_fn qemu_get_byte(QEMUFile *f)
     return result;
 }
 
-uint64_t qemu_file_transferred_fast(QEMUFile *f)
+uint64_t qemu_file_transferred_noflush(QEMUFile *f)
 {
     uint64_t ret = f->total_transferred;
     int i;
diff --git a/migration/qemu-file.h b/migration/qemu-file.h
index e649718492..aa6eee66da 100644
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@@ -86,16 +86,15 @@ int qemu_fclose(QEMUFile *f);
 uint64_t qemu_file_transferred(QEMUFile *f);
 
 /*
- * qemu_file_transferred_fast:
+ * qemu_file_transferred_noflush:
  *
- * As qemu_file_transferred except for writable
- * files, where no flush is performed and the reported
- * amount will include the size of any queued buffers,
- * on top of the amount actually transferred.
+ * As qemu_file_transferred except for writable files, where no flush
+ * is performed and the reported amount will include the size of any
+ * queued buffers, on top of the amount actually transferred.
  *
  * Returns: the total bytes transferred and queued
  */
-uint64_t qemu_file_transferred_fast(QEMUFile *f);
+uint64_t qemu_file_transferred_noflush(QEMUFile *f);
 
 /*
  * put_buffer without copying the buffer.
diff --git a/migration/savevm.c b/migration/savevm.c
index 51e40e3a0b..0b2583a205 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -927,9 +927,9 @@ static int vmstate_load(QEMUFile *f, SaveStateEntry *se)
 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se,
                                    JSONWriter *vmdesc)
 {
-    uint64_t old_offset = qemu_file_transferred_fast(f);
+    uint64_t old_offset = qemu_file_transferred_noflush(f);
     se->ops->save_state(f, se->opaque);
-    uint64_t size = qemu_file_transferred_fast(f) - old_offset;
+    uint64_t size = qemu_file_transferred_noflush(f) - old_offset;
 
     if (vmdesc) {
         json_writer_int64(vmdesc, "size", size);
diff --git a/migration/vmstate.c b/migration/vmstate.c
index af01d54b6f..31842c3afb 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -361,7 +361,7 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
                 void *curr_elem = first_elem + size * i;
 
                 vmsd_desc_field_start(vmsd, vmdesc_loop, field, i, n_elems);
-                old_offset = qemu_file_transferred_fast(f);
+                old_offset = qemu_file_transferred_noflush(f);
                 if (field->flags & VMS_ARRAY_OF_POINTER) {
                     assert(curr_elem);
                     curr_elem = *(void **)curr_elem;
@@ -391,7 +391,7 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
                     return ret;
                 }
 
-                written_bytes = qemu_file_transferred_fast(f) - old_offset;
+                written_bytes = qemu_file_transferred_noflush(f) - old_offset;
                 vmsd_desc_field_end(vmsd, vmdesc_loop, field, written_bytes, i);
 
                 /* Compressed arrays only care about the first element */

From cf786549ce6e8d775fbc8ebe06759d59fc709f08 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Tue, 30 May 2023 20:39:23 +0200
Subject: [PATCH 0954/1353] migration: Change qemu_file_transferred to noflush
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We do a qemu_fclose() just after that, that also does a qemu_fflush(),
so remove one qemu_fflush().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230530183941.7223-3-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/savevm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 0b2583a205..a2cb8855e2 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -3007,7 +3007,7 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
         goto the_end;
     }
     ret = qemu_savevm_state(f, errp);
-    vm_state_size = qemu_file_transferred(f);
+    vm_state_size = qemu_file_transferred_noflush(f);
     ret2 = qemu_fclose(f);
     if (ret < 0) {
         goto the_end;

From 9ccf83f486277a00be85646b305af6683ef3b8ed Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Tue, 30 May 2023 20:39:39 +0200
Subject: [PATCH 0955/1353] qemu_file: Make qemu_file_is_writable() static

It is not used outside of qemu_file, and it shouldn't.

Signed-off-by: Juan Quintela <quintela@redhat.com>
Message-ID: <20230530183941.7223-19-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/qemu-file.c | 2 +-
 migration/qemu-file.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index fdf115b5da..9a89e17924 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -228,7 +228,7 @@ void qemu_file_set_error(QEMUFile *f, int ret)
     qemu_file_set_error_obj(f, ret, NULL);
 }
 
-bool qemu_file_is_writable(QEMUFile *f)
+static bool qemu_file_is_writable(QEMUFile *f)
 {
     return f->is_writable;
 }
diff --git a/migration/qemu-file.h b/migration/qemu-file.h
index aa6eee66da..a081ef6c3f 100644
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@@ -103,7 +103,6 @@ uint64_t qemu_file_transferred_noflush(QEMUFile *f);
 void qemu_put_buffer_async(QEMUFile *f, const uint8_t *buf, size_t size,
                            bool may_free);
 bool qemu_file_mode_is_not_valid(const char *mode);
-bool qemu_file_is_writable(QEMUFile *f);
 
 #include "migration/qemu-file-types.h"
 

From 8c5ee0bfb86eae89c5480dc616bb9d2234ac1fd6 Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Tue, 30 May 2023 20:39:40 +0200
Subject: [PATCH 0956/1353] qemu-file: Simplify qemu_file_shutdown()

Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20230530183941.7223-20-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/qemu-file.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 9a89e17924..4c577bdff8 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -65,8 +65,6 @@ struct QEMUFile {
  */
 int qemu_file_shutdown(QEMUFile *f)
 {
-    int ret = 0;
-
     /*
      * We must set qemufile error before the real shutdown(), otherwise
      * there can be a race window where we thought IO all went though
@@ -96,10 +94,10 @@ int qemu_file_shutdown(QEMUFile *f)
     }
 
     if (qio_channel_shutdown(f->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL) < 0) {
-        ret = -EIO;
+        return -EIO;
     }
 
-    return ret;
+    return 0;
 }
 
 bool qemu_file_mode_is_not_valid(const char *mode)

From ac6f48e15d09412dcc4e4ac93019b6c97dc26a3c Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Tue, 30 May 2023 20:39:41 +0200
Subject: [PATCH 0957/1353] qemu-file: Make qemu_file_get_error_obj() static

It was not used outside of qemu_file.c anyways.

Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20230530183941.7223-21-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/qemu-file.c | 2 +-
 migration/qemu-file.h | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 4c577bdff8..d30bf3c377 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -158,7 +158,7 @@ void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks)
  * is not 0.
  *
  */
-int qemu_file_get_error_obj(QEMUFile *f, Error **errp)
+static int qemu_file_get_error_obj(QEMUFile *f, Error **errp)
 {
     if (errp) {
         *errp = f->last_error_obj ? error_copy(f->last_error_obj) : NULL;
diff --git a/migration/qemu-file.h b/migration/qemu-file.h
index a081ef6c3f..8b8b7d27fe 100644
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@@ -128,7 +128,6 @@ void qemu_file_skip(QEMUFile *f, int size);
  * accounting information tracks the total migration traffic.
  */
 void qemu_file_credit_transfer(QEMUFile *f, size_t size);
-int qemu_file_get_error_obj(QEMUFile *f, Error **errp);
 int qemu_file_get_error_obj_any(QEMUFile *f1, QEMUFile *f2, Error **errp);
 void qemu_file_set_error_obj(QEMUFile *f, int ret, Error *err);
 void qemu_file_set_error(QEMUFile *f, int ret);

From 697c4c86ab515a728ffb2adc2c3c04b22fa9210f Mon Sep 17 00:00:00 2001
From: Juan Quintela <quintela@redhat.com>
Date: Tue, 30 May 2023 20:39:37 +0200
Subject: [PATCH 0958/1353] migration/rdma: Split qemu_fopen_rdma() into
 input/output functions

This is how everything else in QEMUFile is structured.
As a bonus they are three less lines of code.

Reviewed-by: Peter Xu <peterx@redhat.com>
Message-ID: <20230530183941.7223-17-quintela@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
---
 migration/qemu-file.c | 12 ------------
 migration/qemu-file.h |  1 -
 migration/rdma.c      | 39 +++++++++++++++++++--------------------
 3 files changed, 19 insertions(+), 33 deletions(-)

diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index d30bf3c377..19c33c9985 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -100,18 +100,6 @@ int qemu_file_shutdown(QEMUFile *f)
     return 0;
 }
 
-bool qemu_file_mode_is_not_valid(const char *mode)
-{
-    if (mode == NULL ||
-        (mode[0] != 'r' && mode[0] != 'w') ||
-        mode[1] != 'b' || mode[2] != 0) {
-        fprintf(stderr, "qemu_fopen: Argument validity check failed\n");
-        return true;
-    }
-
-    return false;
-}
-
 static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
 {
     QEMUFile *f;
diff --git a/migration/qemu-file.h b/migration/qemu-file.h
index 8b8b7d27fe..47015f5201 100644
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@@ -102,7 +102,6 @@ uint64_t qemu_file_transferred_noflush(QEMUFile *f);
  */
 void qemu_put_buffer_async(QEMUFile *f, const uint8_t *buf, size_t size,
                            bool may_free);
-bool qemu_file_mode_is_not_valid(const char *mode);
 
 #include "migration/qemu-file-types.h"
 
diff --git a/migration/rdma.c b/migration/rdma.c
index dd1c039e6c..ca430d319d 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -4053,27 +4053,26 @@ static void qio_channel_rdma_register_types(void)
 
 type_init(qio_channel_rdma_register_types);
 
-static QEMUFile *qemu_fopen_rdma(RDMAContext *rdma, const char *mode)
+static QEMUFile *rdma_new_input(RDMAContext *rdma)
 {
-    QIOChannelRDMA *rioc;
+    QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(object_new(TYPE_QIO_CHANNEL_RDMA));
 
-    if (qemu_file_mode_is_not_valid(mode)) {
-        return NULL;
-    }
+    rioc->file = qemu_file_new_input(QIO_CHANNEL(rioc));
+    rioc->rdmain = rdma;
+    rioc->rdmaout = rdma->return_path;
+    qemu_file_set_hooks(rioc->file, &rdma_read_hooks);
 
-    rioc = QIO_CHANNEL_RDMA(object_new(TYPE_QIO_CHANNEL_RDMA));
+    return rioc->file;
+}
 
-    if (mode[0] == 'w') {
-        rioc->file = qemu_file_new_output(QIO_CHANNEL(rioc));
-        rioc->rdmaout = rdma;
-        rioc->rdmain = rdma->return_path;
-        qemu_file_set_hooks(rioc->file, &rdma_write_hooks);
-    } else {
-        rioc->file = qemu_file_new_input(QIO_CHANNEL(rioc));
-        rioc->rdmain = rdma;
-        rioc->rdmaout = rdma->return_path;
-        qemu_file_set_hooks(rioc->file, &rdma_read_hooks);
-    }
+static QEMUFile *rdma_new_output(RDMAContext *rdma)
+{
+    QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(object_new(TYPE_QIO_CHANNEL_RDMA));
+
+    rioc->file = qemu_file_new_output(QIO_CHANNEL(rioc));
+    rioc->rdmaout = rdma;
+    rioc->rdmain = rdma->return_path;
+    qemu_file_set_hooks(rioc->file, &rdma_write_hooks);
 
     return rioc->file;
 }
@@ -4099,9 +4098,9 @@ static void rdma_accept_incoming_migration(void *opaque)
         return;
     }
 
-    f = qemu_fopen_rdma(rdma, "rb");
+    f = rdma_new_input(rdma);
     if (f == NULL) {
-        fprintf(stderr, "RDMA ERROR: could not qemu_fopen_rdma\n");
+        fprintf(stderr, "RDMA ERROR: could not open RDMA for input\n");
         qemu_rdma_cleanup(rdma);
         return;
     }
@@ -4224,7 +4223,7 @@ void rdma_start_outgoing_migration(void *opaque,
 
     trace_rdma_start_outgoing_migration_after_rdma_connect();
 
-    s->to_dst_file = qemu_fopen_rdma(rdma, "wb");
+    s->to_dst_file = rdma_new_output(rdma);
     migrate_fd_connect(s, NULL);
     return;
 return_path_err:

From dad3c9565d7347bd61d036f0a1f5e2735be92c9b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 20 Jul 2023 09:16:04 +0200
Subject: [PATCH 0959/1353] qapi/block-core: Tidy up BlockLatencyHistogramInfo
 documentation

Documentation for member @bin comes out like

    list of io request counts corresponding to histogram intervals.
    len("bins") = len("boundaries") + 1 For the example above, "bins"
    may be something like [3, 1, 5, 2], and corresponding histogram
    looks like:

Note how the equation and the sentence following it run together.
Replace the equation:

    list of io request counts corresponding to histogram intervals,
    one more element than "boundaries" has.  For the example above,
    "bins" may be something like [3, 1, 5, 2], and corresponding
    histogram looks like:

Cc: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20230720071610.1096458-2-armbru@redhat.com>
[Off by one fixed]
---
 qapi/block-core.json | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index 5dd5f7e4b0..dcfd54d15c 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -652,10 +652,9 @@
 #     10), [10, 50), [50, 100), [100, +inf).
 #
 # @bins: list of io request counts corresponding to histogram
-#     intervals.
-#     len(@bins) = len(@boundaries) + 1
-#     For the example above, @bins may be something like [3, 1, 5, 2],
-#     and corresponding histogram looks like:
+#     intervals, one more element than @boundaries has.  For the
+#     example above, @bins may be something like [3, 1, 5, 2], and
+#     corresponding histogram looks like:
 #
 # ::
 #

From e893b9e3b3a6029384253f768cdc06969732e517 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 20 Jul 2023 09:16:05 +0200
Subject: [PATCH 0960/1353] qapi/block: Tidy up block-latency-histogram-set
 documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Examples come out like

    Example

       set new histograms for all io types with intervals [0, 10), [10,
       50), [50, 100), [100, +inf):

The sentence "set new histograms ..." starts with a lower case letter.
Capitalize it.  Same for the other examples.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20230720071610.1096458-3-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 qapi/block.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/qapi/block.json b/qapi/block.json
index 0f25ce3961..535892fddc 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -547,7 +547,7 @@
 #
 # Example:
 #
-# set new histograms for all io types with intervals [0, 10), [10,
+# Set new histograms for all io types with intervals [0, 10), [10,
 # 50), [50, 100), [100, +inf):
 #
 # -> { "execute": "block-latency-histogram-set",
@@ -557,7 +557,7 @@
 #
 # Example:
 #
-# set new histogram only for write, other histograms will remain not
+# Set new histogram only for write, other histograms will remain not
 # changed (or not created):
 #
 # -> { "execute": "block-latency-histogram-set",
@@ -567,7 +567,7 @@
 #
 # Example:
 #
-# set new histograms with the following intervals:   read, flush: [0,
+# Set new histograms with the following intervals:   read, flush: [0,
 # 10), [10, 50), [50, 100), [100, +inf)   write: [0, 1000), [1000,
 # 5000), [5000, +inf)
 #
@@ -579,7 +579,7 @@
 #
 # Example:
 #
-# remove all latency histograms:
+# Remove all latency histograms:
 #
 # -> { "execute": "block-latency-histogram-set",
 #      "arguments": { "id": "drive0" } }

From a9c72efd6d6d62ac84ae57ca55606747e04e8ba7 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 20 Jul 2023 09:16:06 +0200
Subject: [PATCH 0961/1353] qapi/qdev: Tidy up device_add documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The notes section comes out like this:

    Notes

    Additional arguments depend on the type.

    1. For detailed information about this command, please refer to the
       ‘docs/qdev-device-use.txt’ file.

    2. It’s possible to list device properties by running QEMU with the
       “-device DEVICE,help” command-line argument, where DEVICE is the
       device’s name

The first item isn't numbered.  Fix that:

    1. Additional arguments depend on the type.

    2. For detailed information about this command, please refer to the
       ‘docs/qdev-device-use.txt’ file.

    3. It’s possible to list device properties by running QEMU with the
       “-device DEVICE,help” command-line argument, where DEVICE is the
       device’s name

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20230720071610.1096458-4-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 qapi/qdev.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/qapi/qdev.json b/qapi/qdev.json
index 2d73b27c2a..6bc5a733b8 100644
--- a/qapi/qdev.json
+++ b/qapi/qdev.json
@@ -53,12 +53,12 @@
 #
 # Notes:
 #
-# Additional arguments depend on the type.
+# 1. Additional arguments depend on the type.
 #
-# 1. For detailed information about this command, please refer to the
+# 2. For detailed information about this command, please refer to the
 #    'docs/qdev-device-use.txt' file.
 #
-# 2. It's possible to list device properties by running QEMU with the
+# 3. It's possible to list device properties by running QEMU with the
 #    "-device DEVICE,help" command-line argument, where DEVICE is the
 #    device's name
 #

From e27a9d628d7a9d0c31bc48c82937dd73dbbca01a Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 20 Jul 2023 09:16:07 +0200
Subject: [PATCH 0962/1353] qapi/trace: Tidy up trace-event-get-state,
 -set-state documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

trace-event-set-state's explanation of how events are selected is
under "Features".  Doesn't belong there.  Simply delete it, as it
feels redundant with documentation of member @name.

trace-event-get-state's explanation is under "Returns".  Tolerable,
but similarly redundant.  Delete it, too.

Cc: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20230720071610.1096458-5-armbru@redhat.com>
---
 qapi/trace.json | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/qapi/trace.json b/qapi/trace.json
index 39b752fc88..0819d93016 100644
--- a/qapi/trace.json
+++ b/qapi/trace.json
@@ -60,9 +60,6 @@
 #
 # Returns: a list of @TraceEventInfo for the matching events
 #
-# An event is returned if its name matches the @name pattern
-# (There are no longer any per-vCPU events).
-#
 # Since: 2.2
 #
 # Example:
@@ -90,10 +87,8 @@
 # @vcpu: The vCPU to act upon (all by default; since 2.7).
 #
 # Features:
-# @deprecated: Member @vcpu is deprecated, and always ignored.
 #
-# An event is enabled if its name matches the @name pattern
-# (There are no longer any per-vCPU events).
+# @deprecated: Member @vcpu is deprecated, and always ignored.
 #
 # Since: 2.2
 #

From 9e272073e1c41acb3ba1e43b69c7a3f9c26089c2 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Thu, 20 Jul 2023 09:16:09 +0200
Subject: [PATCH 0963/1353] qapi: Reformat recent doc comments to conform to
 current conventions

Since commit a937b6aa739 (qapi: Reformat doc comments to conform to
current conventions), a number of comments not conforming to the
current formatting conventions were added.  No problem, just sweep
the entire documentation once more.

To check the generated documentation does not change, I compared the
generated HTML before and after this commit with "wdiff -3".  Finds no
differences.  Comparing with diff is not useful, as the reflown
paragraphs are visible there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20230720071610.1096458-7-armbru@redhat.com>
---
 qapi/block-core.json     | 78 +++++++++++++++++++---------------------
 qapi/block.json          |  4 +--
 qapi/cxl.json            |  4 +--
 qapi/machine-target.json |  2 +-
 qapi/migration.json      | 10 +++---
 qapi/net.json            |  1 -
 qapi/qom.json            |  9 ++---
 qapi/trace.json          |  2 ++
 qapi/ui.json             |  2 +-
 9 files changed, 55 insertions(+), 57 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index dcfd54d15c..2b1d493d6e 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -136,7 +136,7 @@
 #
 # @filename: Name of the extent file
 #
-# @format: Extent type (e.g.  FLAT or SPARSE)
+# @format: Extent type (e.g. FLAT or SPARSE)
 #
 # @virtual-size: Number of bytes covered by this extent
 #
@@ -853,9 +853,8 @@
 # @min_wr_latency_ns: Minimum latency of write operations in the
 #     defined interval, in nanoseconds.
 #
-# @min_zone_append_latency_ns: Minimum latency of zone append operations
-#                              in the defined interval, in nanoseconds
-#                              (since 8.1)
+# @min_zone_append_latency_ns: Minimum latency of zone append
+#     operations in the defined interval, in nanoseconds (since 8.1)
 #
 # @min_flush_latency_ns: Minimum latency of flush operations in the
 #     defined interval, in nanoseconds.
@@ -866,9 +865,8 @@
 # @max_wr_latency_ns: Maximum latency of write operations in the
 #     defined interval, in nanoseconds.
 #
-# @max_zone_append_latency_ns: Maximum latency of zone append operations
-#                              in the defined interval, in nanoseconds
-#                              (since 8.1)
+# @max_zone_append_latency_ns: Maximum latency of zone append
+#     operations in the defined interval, in nanoseconds (since 8.1)
 #
 # @max_flush_latency_ns: Maximum latency of flush operations in the
 #     defined interval, in nanoseconds.
@@ -879,9 +877,8 @@
 # @avg_wr_latency_ns: Average latency of write operations in the
 #     defined interval, in nanoseconds.
 #
-# @avg_zone_append_latency_ns: Average latency of zone append operations
-#                              in the defined interval, in nanoseconds
-#                              (since 8.1)
+# @avg_zone_append_latency_ns: Average latency of zone append
+#     operations in the defined interval, in nanoseconds (since 8.1)
 #
 # @avg_flush_latency_ns: Average latency of flush operations in the
 #     defined interval, in nanoseconds.
@@ -893,8 +890,7 @@
 #     the defined interval.
 #
 # @avg_zone_append_queue_depth: Average number of pending zone append
-#                               operations in the defined interval
-#                               (since 8.1).
+#     operations in the defined interval (since 8.1).
 #
 # Since: 2.5
 ##
@@ -919,8 +915,8 @@
 #
 # @wr_bytes: The number of bytes written by the device.
 #
-# @zone_append_bytes: The number of bytes appended by the zoned devices
-#                     (since 8.1)
+# @zone_append_bytes: The number of bytes appended by the zoned
+#     devices (since 8.1)
 #
 # @unmap_bytes: The number of bytes unmapped by the device (Since 4.2)
 #
@@ -930,8 +926,8 @@
 # @wr_operations: The number of write operations performed by the
 #     device.
 #
-# @zone_append_operations: The number of zone append operations performed
-#                          by the zoned devices (since 8.1)
+# @zone_append_operations: The number of zone append operations
+#     performed by the zoned devices (since 8.1)
 #
 # @flush_operations: The number of cache flush operations performed by
 #     the device (since 0.15)
@@ -946,7 +942,7 @@
 #     0.15).
 #
 # @zone_append_total_time_ns: Total time spent on zone append writes
-#                             in nanoseconds (since 8.1)
+#     in nanoseconds (since 8.1)
 #
 # @flush_total_time_ns: Total time spent on cache flushes in
 #     nanoseconds (since 0.15).
@@ -965,8 +961,8 @@
 # @wr_merged: Number of write requests that have been merged into
 #     another request (Since 2.3).
 #
-# @zone_append_merged: Number of zone append requests that have been merged
-#                      into another request (since 8.1)
+# @zone_append_merged: Number of zone append requests that have been
+#     merged into another request (since 8.1)
 #
 # @unmap_merged: Number of unmap requests that have been merged into
 #     another request (Since 4.2)
@@ -981,9 +977,8 @@
 # @failed_wr_operations: The number of failed write operations
 #     performed by the device (Since 2.5)
 #
-# @failed_zone_append_operations: The number of failed zone append write
-#                                 operations performed by the zoned devices
-#                                 (since 8.1)
+# @failed_zone_append_operations: The number of failed zone append
+#     write operations performed by the zoned devices (since 8.1)
 #
 # @failed_flush_operations: The number of failed flush operations
 #     performed by the device (Since 2.5)
@@ -997,8 +992,8 @@
 # @invalid_wr_operations: The number of invalid write operations
 #     performed by the device (Since 2.5)
 #
-# @invalid_zone_append_operations: The number of invalid zone append operations
-#                                  performed by the zoned device (since 8.1)
+# @invalid_zone_append_operations: The number of invalid zone append
+#     operations performed by the zoned device (since 8.1)
 #
 # @invalid_flush_operations: The number of invalid flush operations
 #     performed by the device (Since 2.5)
@@ -1019,7 +1014,8 @@
 #
 # @wr_latency_histogram: @BlockLatencyHistogramInfo.  (Since 4.0)
 #
-# @zone_append_latency_histogram: @BlockLatencyHistogramInfo.  (since 8.1)
+# @zone_append_latency_histogram: @BlockLatencyHistogramInfo.
+#     (since 8.1)
 #
 # @flush_latency_histogram: @BlockLatencyHistogramInfo.  (Since 4.0)
 #
@@ -1126,7 +1122,7 @@
 #
 # @parent: This describes the file block device if it has one.
 #     Contains recursively the statistics of the underlying protocol
-#     (e.g. the host file for a qcow2 image). If there is no
+#     (e.g. the host file for a qcow2 image).  If there is no
 #     underlying protocol, this field is omitted
 #
 # @backing: This describes the backing block device if it has one.
@@ -1486,7 +1482,7 @@
 # @format: the format of the overlay image, default is 'qcow2'.
 #
 # @mode: whether and how QEMU should create a new image, default is
-#        'absolute-paths'.
+#     'absolute-paths'.
 ##
 { 'struct': 'BlockdevSnapshotSync',
   'data': { '*device': 'str', '*node-name': 'str',
@@ -1550,7 +1546,7 @@
 #
 # @bitmap: The name of a dirty bitmap to use.  Must be present if sync
 #     is "bitmap" or "incremental". Can be present if sync is "full"
-#     or "top". Must not be present otherwise.
+#     or "top".  Must not be present otherwise.
 #     (Since 2.4 (drive-backup), 3.1 (blockdev-backup))
 #
 # @bitmap-mode: Specifies the type of data the bitmap should contain
@@ -3477,16 +3473,16 @@
 # @pass-discard-other: whether discard requests for the data source
 #     should be issued on other occasions where a cluster gets freed
 #
-# @discard-no-unref: when enabled, discards from the guest will not cause
-#     cluster allocations to be relinquished. This prevents qcow2 fragmentation
-#     that would be caused by such discards. Besides potential
-#     performance degradation, such fragmentation can lead to increased
-#     allocation of clusters past the end of the image file,
-#     resulting in image files whose file length can grow much larger
-#     than their guest disk size would suggest.
-#     If image file length is of concern (e.g. when storing qcow2
-#     images directly on block devices), you should consider enabling
-#     this option. (since 8.1)
+# @discard-no-unref: when enabled, discards from the guest will not
+#     cause cluster allocations to be relinquished.  This prevents
+#     qcow2 fragmentation that would be caused by such discards.
+#     Besides potential performance degradation, such fragmentation
+#     can lead to increased allocation of clusters past the end of the
+#     image file, resulting in image files whose file length can grow
+#     much larger than their guest disk size would suggest.  If image
+#     file length is of concern (e.g. when storing qcow2 images
+#     directly on block devices), you should consider enabling this
+#     option.  (since 8.1)
 #
 # @overlap-check: which overlap checks to perform for writes to the
 #     image, defaults to 'cached' (since 2.2)
@@ -5240,9 +5236,9 @@
 #
 # @subformat: vhdx subformat (default: dynamic)
 #
-# @block-state-zero: Force use of payload blocks of type
-#     'ZERO'. Non-standard, but default.  Do not set to 'off' when
-#     using 'qemu-img convert' with subformat=dynamic.
+# @block-state-zero: Force use of payload blocks of type 'ZERO'.
+#     Non-standard, but default.  Do not set to 'off' when using
+#     'qemu-img convert' with subformat=dynamic.
 #
 # Since: 2.12
 ##
diff --git a/qapi/block.json b/qapi/block.json
index 535892fddc..998008cfa8 100644
--- a/qapi/block.json
+++ b/qapi/block.json
@@ -534,8 +534,8 @@
 # @boundaries-write: list of interval boundary values for write
 #     latency histogram.
 #
-# @boundaries-zap: list of interval boundary values for zone append write
-#                  latency histogram.
+# @boundaries-zap: list of interval boundary values for zone append
+#     write latency histogram.
 #
 # @boundaries-flush: list of interval boundary values for flush
 #     latency histogram.
diff --git a/qapi/cxl.json b/qapi/cxl.json
index d5b5293eb5..8cc4c72fa9 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -172,8 +172,8 @@
 #
 # @temperature: Device temperature in degrees Celsius.
 #
-# @dirty-shutdown-count: Number of times the device has been unable
-#     to determine whether data loss may have occurred.
+# @dirty-shutdown-count: Number of times the device has been unable to
+#     determine whether data loss may have occurred.
 #
 # @corrected-volatile-error-count: Total number of correctable errors
 #     in volatile memory.
diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index 3362f8dc3f..f0a6b72414 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -61,7 +61,7 @@
 # @CpuModelCompareResult:
 #
 # An enumeration of CPU model comparison results.  The result is
-# usually calculated using e.g.  CPU features or CPU generations.
+# usually calculated using e.g. CPU features or CPU generations.
 #
 # @incompatible: If model A is incompatible to model B, model A is not
 #     guaranteed to run where model B runs and the other way around.
diff --git a/qapi/migration.json b/qapi/migration.json
index 2a6565a0f8..476b90bd50 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -465,8 +465,8 @@
 #     block devices (and thus take locks) immediately at the end of
 #     migration.  (since 3.0)
 #
-# @x-ignore-shared: If enabled, QEMU will not migrate shared memory that is
-#     accessible on the destination machine. (since 4.0)
+# @x-ignore-shared: If enabled, QEMU will not migrate shared memory
+#     that is accessible on the destination machine.  (since 4.0)
 #
 # @validate-uuid: Send the UUID of the source to allow the destination
 #     to ensure it is the same.  (since 4.2)
@@ -490,9 +490,9 @@
 # @switchover-ack: If enabled, migration will not stop the source VM
 #     and complete the migration until an ACK is received from the
 #     destination that it's OK to do so.  Exactly when this ACK is
-#     sent depends on the migrated devices that use this feature.
-#     For example, a device can use it to make sure some of its data
-#     is sent and loaded in the destination before doing switchover.
+#     sent depends on the migrated devices that use this feature.  For
+#     example, a device can use it to make sure some of its data is
+#     sent and loaded in the destination before doing switchover.
 #     This can reduce downtime if devices that support this capability
 #     are present.  'return-path' capability must be enabled to use
 #     it.  (since 8.1)
diff --git a/qapi/net.json b/qapi/net.json
index db67501308..313c8a606e 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -663,7 +663,6 @@
 # @type: Specify the driver used for interpreting remaining arguments.
 #
 # Since: 1.2
-#
 ##
 { 'union': 'Netdev',
   'base': { 'id': 'str', 'type': 'NetClientDriver' },
diff --git a/qapi/qom.json b/qapi/qom.json
index 7f92ea43e8..fa3e88c8e6 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -647,9 +647,10 @@
 #     selects a default alignment (currently the page size).
 #     (default: 0)
 #
-# @offset: the offset into the target file that the region starts at. You
-#     can use this option to back multiple regions with a single file. Must
-#     be a multiple of the page size. (default: 0) (since 8.1)
+# @offset: the offset into the target file that the region starts at.
+#     You can use this option to back multiple regions with a single
+#     file. Must be a multiple of the page size.
+#     (default: 0) (since 8.1)
 #
 # @discard-data: if true, the file contents can be destroyed when QEMU
 #     exits, to avoid unnecessarily flushing data to the backing file.
@@ -662,7 +663,7 @@
 #
 # @pmem: specifies whether the backing file specified by @mem-path is
 #     in host persistent memory that can be accessed using the SNIA
-#     NVM programming model (e.g.  Intel NVDIMM).
+#     NVM programming model (e.g. Intel NVDIMM).
 #
 # @readonly: if true, the backing file is opened read-only; if false,
 #     it is opened read-write.  (default: false)
diff --git a/qapi/trace.json b/qapi/trace.json
index 0819d93016..2077d7e117 100644
--- a/qapi/trace.json
+++ b/qapi/trace.json
@@ -38,6 +38,7 @@
 # @vcpu: Whether this is a per-vCPU event (since 2.7).
 #
 # Features:
+#
 # @deprecated: Member @vcpu is deprecated, and always ignored.
 #
 # Since: 2.2
@@ -56,6 +57,7 @@
 # @vcpu: The vCPU to query (since 2.7).
 #
 # Features:
+#
 # @deprecated: Member @vcpu is deprecated, and always ignored.
 #
 # Returns: a list of @TraceEventInfo for the matching events
diff --git a/qapi/ui.json b/qapi/ui.json
index bb06fb6039..006616aa77 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1309,7 +1309,7 @@
 #     defaults to "off". (Since 3.1)
 #
 # @show-tabs: Display the tab bar for switching between the various
-#     graphical interfaces (e.g.  VGA and virtual console character
+#     graphical interfaces (e.g. VGA and virtual console character
 #     devices) by default.  (Since 7.1)
 #
 # @show-menubar: Display the main window menubar.  Defaults to "on".

From a5942c177b7bcc1357e496b7d68668befcfc2bb9 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Wed, 26 Jul 2023 09:48:07 +0200
Subject: [PATCH 0964/1353] block/blkio: do not use open flags in qemu_open()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_open() in blkio_virtio_blk_common_open() is used to open the
character device (e.g. /dev/vhost-vdpa-0 or /dev/vfio/vfio) or in
the future eventually the unix socket.

In all these cases we cannot open the path in read-only mode,
when the `read-only` option of blockdev is on, because the exchange
of IOCTL commands for example will fail.

In order to open the device read-only, we have to use the `read-only`
property of the libblkio driver as we already do in blkio_file_open().

Fixes: cad2ccc395 ("block/blkio: use qemu_open() to support fd passing for virtio-blk")
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2225439
Reported-by: Qing Wang <qinwang@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20230726074807.14041-1-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index bc1fac48b7..7eb1b94820 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -686,15 +686,18 @@ static int blkio_virtio_blk_common_open(BlockDriverState *bs,
      * layer through the "/dev/fdset/N" special path.
      */
     if (fd_supported) {
-        int open_flags;
-
-        if (flags & BDRV_O_RDWR) {
-            open_flags = O_RDWR;
-        } else {
-            open_flags = O_RDONLY;
-        }
-
-        fd = qemu_open(path, open_flags, errp);
+        /*
+         * `path` can contain the path of a character device
+         * (e.g. /dev/vhost-vdpa-0 or /dev/vfio/vfio) or a unix socket.
+         *
+         * So, we should always open it with O_RDWR flag, also if BDRV_O_RDWR
+         * is not set in the open flags, because the exchange of IOCTL commands
+         * for example will fail.
+         *
+         * In order to open the device read-only, we are using the `read-only`
+         * property of the libblkio driver in blkio_file_open().
+         */
+        fd = qemu_open(path, O_RDWR, errp);
         if (fd < 0) {
             return -EINVAL;
         }

From e5b815b0defcc3617f473ba70c3e675ef0ee69c2 Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Thu, 27 Jul 2023 12:58:28 +0200
Subject: [PATCH 0965/1353] qemu-nbd: regression with arguments passing into
 nbd_client_thread()

Unfortunately
    commit 03b67621445d601c9cdc7dfe25812e9f19b81488
    Author: Denis V. Lunev <den@openvz.org>
    Date:   Mon Jul 17 16:55:40 2023 +0200
    qemu-nbd: pass structure into nbd_client_thread instead of plain char*
has introduced a regression. struct NbdClientOpts resides on stack inside
'if' block. This specifically means that this stack space could be reused
once the execution will leave that block of the code.

This means that parameters passed into nbd_client_thread could be
overwritten at any moment.

The patch moves the data to the namespace of main() function effectively
preserving it for the whole process lifetime.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Eric Blake <eblake@redhat.com>
CC: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
CC: <qemu-stable@nongnu.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20230727105828.324314-1-den@openvz.org>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 qemu-nbd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu-nbd.c b/qemu-nbd.c
index 5b2757920c..aaccaa3318 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -589,6 +589,9 @@ int main(int argc, char **argv)
     const char *pid_file_name = NULL;
     const char *selinux_label = NULL;
     BlockExportOptions *export_opts;
+#if HAVE_NBD_DEVICE
+    struct NbdClientOpts opts;
+#endif
 
 #ifdef CONFIG_POSIX
     os_setup_early_signal_handling();
@@ -1145,7 +1148,7 @@ int main(int argc, char **argv)
     if (device) {
 #if HAVE_NBD_DEVICE
         int ret;
-        struct NbdClientOpts opts = {
+        opts = (struct NbdClientOpts) {
             .device = device,
             .fork_process = fork_process,
             .verbose = verbose,

From 29a242e165610df9b158bdb8d6b84e83d8733fc4 Mon Sep 17 00:00:00 2001
From: Sam Li <faithilikerun@gmail.com>
Date: Thu, 27 Jul 2023 19:58:44 +0800
Subject: [PATCH 0966/1353] block/file-posix: fix g_file_get_contents return
 path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The g_file_get_contents() function returns a g_boolean. If it fails, the
returned value will be 0 instead of -1. Solve the issue by skipping
assigning ret value.

This issue was found by Matthew Rosato using virtio-blk-{pci,ccw} backed
by an NVMe partition e.g. /dev/nvme0n1p1 on s390x.

Signed-off-by: Sam Li <faithilikerun@gmail.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20230727115844.8480-1-faithilikerun@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/file-posix.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index 9e8e3d8ca5..b16e9c21a1 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1232,7 +1232,6 @@ static int hdev_get_max_hw_transfer(int fd, struct stat *st)
 static int get_sysfs_str_val(struct stat *st, const char *attribute,
                              char **val) {
     g_autofree char *sysfspath = NULL;
-    int ret;
     size_t len;
 
     if (!S_ISBLK(st->st_mode)) {
@@ -1242,8 +1241,7 @@ static int get_sysfs_str_val(struct stat *st, const char *attribute,
     sysfspath = g_strdup_printf("/sys/dev/block/%u:%u/queue/%s",
                                 major(st->st_rdev), minor(st->st_rdev),
                                 attribute);
-    ret = g_file_get_contents(sysfspath, val, &len, NULL);
-    if (ret == -1) {
+    if (!g_file_get_contents(sysfspath, val, &len, NULL)) {
         return -ENOENT;
     }
 
@@ -1253,7 +1251,7 @@ static int get_sysfs_str_val(struct stat *st, const char *attribute,
     if (*(p + len - 1) == '\n') {
         *(p + len - 1) = '\0';
     }
-    return ret;
+    return 0;
 }
 #endif
 

From ef256751e970bff435d40a8348dd51d81e67e52e Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Fri, 14 Jul 2023 10:59:38 +0200
Subject: [PATCH 0967/1353] block: Fix pad_request's request restriction

bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
which bdrv_check_qiov_request() does not guarantee.

bdrv_check_request32() however will guarantee this, and both of
bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
bdrv_co_pwritev_part()) already run it before calling
bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
bdrv_check_request32() without expecting error, too.

In effect, this patch will not change guest-visible behavior.  It is a
clean-up to tighten a condition to match what is guaranteed by our
callers, and which exists purely to show clearly why the subsequent
assertion (`assert(*bytes <= SIZE_MAX)`) is always true.

Note there is a difference between the interfaces of
bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
an errp, the latter does not, so we can no longer just pass
&error_abort.  Instead, we need to check the returned value.  While we
do expect success (because the callers have already run this function),
an assert(ret == 0) is not much simpler than just to return an error if
it occurs, so let us handle errors by returning them up the stack now.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-id: 20230714085938.202730-1-hreitz@redhat.com
Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/block/io.c b/block/io.c
index e8293d6b26..055fcf7438 100644
--- a/block/io.c
+++ b/block/io.c
@@ -1710,7 +1710,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
     int sliced_niov;
     size_t sliced_head, sliced_tail;
 
-    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
+    /* Should have been checked by the caller already */
+    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
+    if (ret < 0) {
+        return ret;
+    }
 
     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
@@ -1723,7 +1727,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
                                   &sliced_head, &sliced_tail,
                                   &sliced_niov);
 
-    /* Guaranteed by bdrv_check_qiov_request() */
+    /* Guaranteed by bdrv_check_request32() */
     assert(*bytes <= SIZE_MAX);
     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
                                   sliced_head, *bytes);

From 69785d66ae1ec43f77fc65109a21721992bead9f Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 27 Jul 2023 18:10:17 +0200
Subject: [PATCH 0968/1353] block/blkio: move blkio_connect() in the drivers
 functions

This is in preparation for the next patch, where for virtio-blk
drivers we need to handle the failure of blkio_connect().

Let's also rename the *_open() functions to *_connect() to make
the code reflect the changes applied.

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230727161020.84213-2-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 67 ++++++++++++++++++++++++++++++---------------------
 1 file changed, 40 insertions(+), 27 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index 7eb1b94820..8ad7c0b575 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -603,8 +603,8 @@ static void blkio_unregister_buf(BlockDriverState *bs, void *host, size_t size)
     }
 }
 
-static int blkio_io_uring_open(BlockDriverState *bs, QDict *options, int flags,
-                               Error **errp)
+static int blkio_io_uring_connect(BlockDriverState *bs, QDict *options,
+                                  int flags, Error **errp)
 {
     const char *filename = qdict_get_str(options, "filename");
     BDRVBlkioState *s = bs->opaque;
@@ -627,11 +627,18 @@ static int blkio_io_uring_open(BlockDriverState *bs, QDict *options, int flags,
         }
     }
 
+    ret = blkio_connect(s->blkio);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "blkio_connect failed: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
     return 0;
 }
 
-static int blkio_nvme_io_uring(BlockDriverState *bs, QDict *options, int flags,
-                               Error **errp)
+static int blkio_nvme_io_uring_connect(BlockDriverState *bs, QDict *options,
+                                       int flags, Error **errp)
 {
     const char *path = qdict_get_try_str(options, "path");
     BDRVBlkioState *s = bs->opaque;
@@ -655,11 +662,18 @@ static int blkio_nvme_io_uring(BlockDriverState *bs, QDict *options, int flags,
         return -EINVAL;
     }
 
+    ret = blkio_connect(s->blkio);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "blkio_connect failed: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
     return 0;
 }
 
-static int blkio_virtio_blk_common_open(BlockDriverState *bs,
-        QDict *options, int flags, Error **errp)
+static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
+                                    int flags, Error **errp)
 {
     const char *path = qdict_get_try_str(options, "path");
     BDRVBlkioState *s = bs->opaque;
@@ -718,6 +732,13 @@ static int blkio_virtio_blk_common_open(BlockDriverState *bs,
         }
     }
 
+    ret = blkio_connect(s->blkio);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "blkio_connect failed: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
     qdict_del(options, "path");
 
     return 0;
@@ -737,24 +758,6 @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 
-    if (strcmp(blkio_driver, "io_uring") == 0) {
-        ret = blkio_io_uring_open(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, "nvme-io_uring") == 0) {
-        ret = blkio_nvme_io_uring(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, "virtio-blk-vfio-pci") == 0) {
-        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, "virtio-blk-vhost-user") == 0) {
-        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
-    } else if (strcmp(blkio_driver, "virtio-blk-vhost-vdpa") == 0) {
-        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
-    } else {
-        g_assert_not_reached();
-    }
-    if (ret < 0) {
-        blkio_destroy(&s->blkio);
-        return ret;
-    }
-
     if (!(flags & BDRV_O_RDWR)) {
         ret = blkio_set_bool(s->blkio, "read-only", true);
         if (ret < 0) {
@@ -765,10 +768,20 @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
         }
     }
 
-    ret = blkio_connect(s->blkio);
+    if (strcmp(blkio_driver, "io_uring") == 0) {
+        ret = blkio_io_uring_connect(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, "nvme-io_uring") == 0) {
+        ret = blkio_nvme_io_uring_connect(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, "virtio-blk-vfio-pci") == 0) {
+        ret = blkio_virtio_blk_connect(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, "virtio-blk-vhost-user") == 0) {
+        ret = blkio_virtio_blk_connect(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, "virtio-blk-vhost-vdpa") == 0) {
+        ret = blkio_virtio_blk_connect(bs, options, flags, errp);
+    } else {
+        g_assert_not_reached();
+    }
     if (ret < 0) {
-        error_setg_errno(errp, -ret, "blkio_connect failed: %s",
-                         blkio_get_error_msg());
         blkio_destroy(&s->blkio);
         return ret;
     }

From 809c319f8a089fbc49223dc29e1cc2b978beeada Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 27 Jul 2023 18:10:18 +0200
Subject: [PATCH 0969/1353] block/blkio: retry blkio_connect() if it fails
 using `fd`

libblkio 1.3.0 added support of "fd" property for virtio-blk-vhost-vdpa
driver. In QEMU, starting from commit cad2ccc395 ("block/blkio: use
qemu_open() to support fd passing for virtio-blk") we are using
`blkio_get_int(..., "fd")` to check if the "fd" property is supported
for all the virtio-blk-* driver.

Unfortunately that property is also available for those driver that do
not support it, such as virtio-blk-vhost-user.

So, `blkio_get_int()` is not enough to check whether the driver supports
the `fd` property or not. This is because the virito-blk common libblkio
driver only checks whether or not `fd` is set during `blkio_connect()`
and fails with -EINVAL for those transports that do not support it
(all except vhost-vdpa for now).

So let's handle the `blkio_connect()` failure, retrying it using `path`
directly.

Fixes: cad2ccc395 ("block/blkio: use qemu_open() to support fd passing for virtio-blk")
Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230727161020.84213-3-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/block/blkio.c b/block/blkio.c
index 8ad7c0b575..60d2d0f129 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -733,6 +733,35 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
     }
 
     ret = blkio_connect(s->blkio);
+    /*
+     * If the libblkio driver doesn't support the `fd` property, blkio_connect()
+     * will fail with -EINVAL. So let's try calling blkio_connect() again by
+     * directly setting `path`.
+     */
+    if (fd_supported && ret == -EINVAL) {
+        qemu_close(fd);
+
+        /*
+         * We need to clear the `fd` property we set previously by setting
+         * it to -1.
+         */
+        ret = blkio_set_int(s->blkio, "fd", -1);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "failed to set fd: %s",
+                             blkio_get_error_msg());
+            return ret;
+        }
+
+        ret = blkio_set_str(s->blkio, "path", path);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "failed to set path: %s",
+                             blkio_get_error_msg());
+            return ret;
+        }
+
+        ret = blkio_connect(s->blkio);
+    }
+
     if (ret < 0) {
         error_setg_errno(errp, -ret, "blkio_connect failed: %s",
                          blkio_get_error_msg());

From 723bea27b127969931fa26bc0de79372a3d9e148 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 27 Jul 2023 18:10:19 +0200
Subject: [PATCH 0970/1353] block/blkio: fall back on using `path` when `fd`
 setting fails

qemu_open() fails if called with an unix domain socket in this way:
    -blockdev node-name=drive0,driver=virtio-blk-vhost-user,path=vhost-user-blk.sock,cache.direct=on: Could not open 'vhost-user-blk.sock': No such device or address

Since virtio-blk-vhost-user does not support fd passing, let`s always fall back
on using `path` if we fail the fd passing.

Fixes: cad2ccc395 ("block/blkio: use qemu_open() to support fd passing for virtio-blk")
Reported-by: Qing Wang <qinwang@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230727161020.84213-4-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index 60d2d0f129..72b46d61fd 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -711,19 +711,19 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
          * In order to open the device read-only, we are using the `read-only`
          * property of the libblkio driver in blkio_file_open().
          */
-        fd = qemu_open(path, O_RDWR, errp);
+        fd = qemu_open(path, O_RDWR, NULL);
         if (fd < 0) {
-            return -EINVAL;
+            fd_supported = false;
+        } else {
+            ret = blkio_set_int(s->blkio, "fd", fd);
+            if (ret < 0) {
+                fd_supported = false;
+                qemu_close(fd);
+            }
         }
+    }
 
-        ret = blkio_set_int(s->blkio, "fd", fd);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "failed to set fd: %s",
-                             blkio_get_error_msg());
-            qemu_close(fd);
-            return ret;
-        }
-    } else {
+    if (!fd_supported) {
         ret = blkio_set_str(s->blkio, "path", path);
         if (ret < 0) {
             error_setg_errno(errp, -ret, "failed to set path: %s",

From 1c38fe69e2b8a05c1762b122292fa7e3662f06fd Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 27 Jul 2023 18:10:20 +0200
Subject: [PATCH 0971/1353] block/blkio: use blkio_set_int("fd") to check fd
 support

Setting the `fd` property fails with virtio-blk-* libblkio drivers
that do not support fd passing since
https://gitlab.com/libblkio/libblkio/-/merge_requests/208.

Getting the `fd` property, on the other hand, always succeeds for
virtio-blk-* libblkio drivers even when they don't support fd passing.

This patch switches to setting the `fd` property because it is a
better mechanism for probing fd passing support than getting the `fd`
property.

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230727161020.84213-5-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blkio.c b/block/blkio.c
index 72b46d61fd..8e7ce42c79 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -690,7 +690,7 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
         return -EINVAL;
     }
 
-    if (blkio_get_int(s->blkio, "fd", &fd) == 0) {
+    if (blkio_set_int(s->blkio, "fd", -1) == 0) {
         fd_supported = true;
     }
 

From c1e244b6552efdff5612a33c6630aaf95964eaf5 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Thu, 20 Jul 2023 11:42:24 +0200
Subject: [PATCH 0972/1353] hw/nvme: use stl/ldl pci dma api
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the stl/ldl pci dma api for writing/reading doorbells. This removes
the explicit endian conversions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 42 +++++++++++++-----------------------------
 1 file changed, 13 insertions(+), 29 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index dadc2dc7da..f2e5a2fa73 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1468,20 +1468,16 @@ static inline void nvme_blk_write(BlockBackend *blk, int64_t offset,
 
 static void nvme_update_cq_eventidx(const NvmeCQueue *cq)
 {
-    uint32_t v = cpu_to_le32(cq->head);
-
     trace_pci_nvme_update_cq_eventidx(cq->cqid, cq->head);
 
-    pci_dma_write(PCI_DEVICE(cq->ctrl), cq->ei_addr, &v, sizeof(v));
+    stl_le_pci_dma(PCI_DEVICE(cq->ctrl), cq->ei_addr, cq->head,
+                   MEMTXATTRS_UNSPECIFIED);
 }
 
 static void nvme_update_cq_head(NvmeCQueue *cq)
 {
-    uint32_t v;
-
-    pci_dma_read(PCI_DEVICE(cq->ctrl), cq->db_addr, &v, sizeof(v));
-
-    cq->head = le32_to_cpu(v);
+    ldl_le_pci_dma(PCI_DEVICE(cq->ctrl), cq->db_addr, &cq->head,
+                   MEMTXATTRS_UNSPECIFIED);
 
     trace_pci_nvme_update_cq_head(cq->cqid, cq->head);
 }
@@ -6801,7 +6797,6 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
     PCIDevice *pci = PCI_DEVICE(n);
     uint64_t dbs_addr = le64_to_cpu(req->cmd.dptr.prp1);
     uint64_t eis_addr = le64_to_cpu(req->cmd.dptr.prp2);
-    uint32_t v;
     int i;
 
     /* Address should be page aligned */
@@ -6819,8 +6814,6 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
         NvmeCQueue *cq = n->cq[i];
 
         if (sq) {
-            v = cpu_to_le32(sq->tail);
-
             /*
              * CAP.DSTRD is 0, so offset of ith sq db_addr is (i<<3)
              * nvme_process_db() uses this hard-coded way to calculate
@@ -6828,7 +6821,7 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
              */
             sq->db_addr = dbs_addr + (i << 3);
             sq->ei_addr = eis_addr + (i << 3);
-            pci_dma_write(pci, sq->db_addr, &v, sizeof(sq->tail));
+            stl_le_pci_dma(pci, sq->db_addr, sq->tail, MEMTXATTRS_UNSPECIFIED);
 
             if (n->params.ioeventfd && sq->sqid != 0) {
                 if (!nvme_init_sq_ioeventfd(sq)) {
@@ -6838,12 +6831,10 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
         }
 
         if (cq) {
-            v = cpu_to_le32(cq->head);
-
             /* CAP.DSTRD is 0, so offset of ith cq db_addr is (i<<3)+(1<<2) */
             cq->db_addr = dbs_addr + (i << 3) + (1 << 2);
             cq->ei_addr = eis_addr + (i << 3) + (1 << 2);
-            pci_dma_write(pci, cq->db_addr, &v, sizeof(cq->head));
+            stl_le_pci_dma(pci, cq->db_addr, cq->head, MEMTXATTRS_UNSPECIFIED);
 
             if (n->params.ioeventfd && cq->cqid != 0) {
                 if (!nvme_init_cq_ioeventfd(cq)) {
@@ -6974,20 +6965,16 @@ static uint16_t nvme_admin_cmd(NvmeCtrl *n, NvmeRequest *req)
 
 static void nvme_update_sq_eventidx(const NvmeSQueue *sq)
 {
-    uint32_t v = cpu_to_le32(sq->tail);
-
     trace_pci_nvme_update_sq_eventidx(sq->sqid, sq->tail);
 
-    pci_dma_write(PCI_DEVICE(sq->ctrl), sq->ei_addr, &v, sizeof(v));
+    stl_le_pci_dma(PCI_DEVICE(sq->ctrl), sq->ei_addr, sq->tail,
+                   MEMTXATTRS_UNSPECIFIED);
 }
 
 static void nvme_update_sq_tail(NvmeSQueue *sq)
 {
-    uint32_t v;
-
-    pci_dma_read(PCI_DEVICE(sq->ctrl), sq->db_addr, &v, sizeof(v));
-
-    sq->tail = le32_to_cpu(v);
+    ldl_le_pci_dma(PCI_DEVICE(sq->ctrl), sq->db_addr, &sq->tail,
+                   MEMTXATTRS_UNSPECIFIED);
 
     trace_pci_nvme_update_sq_tail(sq->sqid, sq->tail);
 }
@@ -7592,7 +7579,7 @@ static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
 static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
 {
     PCIDevice *pci = PCI_DEVICE(n);
-    uint32_t qid, v;
+    uint32_t qid;
 
     if (unlikely(addr & ((1 << 2) - 1))) {
         NVME_GUEST_ERR(pci_nvme_ub_db_wr_misaligned,
@@ -7659,8 +7646,7 @@ static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
         start_sqs = nvme_cq_full(cq) ? 1 : 0;
         cq->head = new_head;
         if (!qid && n->dbbuf_enabled) {
-            v = cpu_to_le32(cq->head);
-            pci_dma_write(pci, cq->db_addr, &v, sizeof(cq->head));
+            stl_le_pci_dma(pci, cq->db_addr, cq->head, MEMTXATTRS_UNSPECIFIED);
         }
         if (start_sqs) {
             NvmeSQueue *sq;
@@ -7720,8 +7706,6 @@ static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
 
         sq->tail = new_tail;
         if (!qid && n->dbbuf_enabled) {
-            v = cpu_to_le32(sq->tail);
-
             /*
              * The spec states "the host shall also update the controller's
              * corresponding doorbell property to match the value of that entry
@@ -7735,7 +7719,7 @@ static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
              * including ones that run on Linux, are not updating Admin Queues,
              * so we can't trust reading it for an appropriate sq tail.
              */
-            pci_dma_write(pci, sq->db_addr, &v, sizeof(sq->tail));
+            stl_le_pci_dma(pci, sq->db_addr, sq->tail, MEMTXATTRS_UNSPECIFIED);
         }
 
         qemu_bh_schedule(sq->bh);

From 638511e99207290c83d87326187e41f88fb92301 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 31 Jul 2023 11:17:27 +0100
Subject: [PATCH 0973/1353] target/arm: Fix MemOp for STGP

When converting to decodetree, the code to rebuild mop for the pair
only made it into trans_STP and not into trans_STGP.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1790
Fixes: 8c212eb6594 ("target/arm: Convert load/store-pair to decodetree")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230726165416.309624-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index ef0c47407a..5fa1257d32 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -3004,6 +3004,9 @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a)
     MemOp mop;
     TCGv_i128 tmp;
 
+    /* STGP only comes in one size. */
+    tcg_debug_assert(a->sz == MO_64);
+
     if (!dc_isar_feature(aa64_mte_insn_reg, s)) {
         return false;
     }
@@ -3029,13 +3032,25 @@ static bool trans_STGP(DisasContext *s, arg_ldstpair *a)
         gen_helper_stg(cpu_env, dirty_addr, dirty_addr);
     }
 
-    mop = finalize_memop(s, a->sz);
-    clean_addr = gen_mte_checkN(s, dirty_addr, true, false, 2 << a->sz, mop);
+    mop = finalize_memop(s, MO_64);
+    clean_addr = gen_mte_checkN(s, dirty_addr, true, false, 2 << MO_64, mop);
 
     tcg_rt = cpu_reg(s, a->rt);
     tcg_rt2 = cpu_reg(s, a->rt2);
 
-    assert(a->sz == 3);
+    /*
+     * STGP is defined as two 8-byte memory operations and one tag operation.
+     * We implement it as one single 16-byte memory operation for convenience.
+     * Rebuild mop as for STP.
+     * TODO: The atomicity with LSE2 is stronger than required.
+     * Need a form of MO_ATOM_WITHIN16_PAIR that never requires
+     * 16-byte atomicity.
+     */
+    mop = MO_128;
+    if (s->align_mem) {
+        mop |= MO_ALIGN_8;
+    }
+    mop = finalize_memop_pair(s, mop);
 
     tmp = tcg_temp_new_i128();
     if (s->be_data == MO_LE) {

From 548b8edc6d9a5d6e1aab932f0ffcf43235c33a67 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Sun, 11 Jun 2023 12:34:34 +0900
Subject: [PATCH 0974/1353] elf2dmp: Don't abandon when Prcb is set to 0

Prcb may be set to 0 for some CPUs if the dump was taken before they
start. The dump may still contain valuable information for started CPUs
so don't abandon conversion in such a case.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
Message-id: 20230611033434.14659-1-akihiko.odaki@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index 89f0c69ab0..6d4d18501a 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -316,6 +316,11 @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
             return 1;
         }
 
+        if (!Prcb) {
+            eprintf("Context for CPU #%d is missing\n", i);
+            continue;
+        }
+
         if (va_space_rw(vs, Prcb + kdbg->OffsetPrcbContext,
                     &Context, sizeof(Context), 0)) {
             eprintf("Failed to read CPU #%d ContextFrame location\n", i);

From 2b0d656ab6484cae7f174e194215a6d50343ecd2 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 27 Jul 2023 11:39:06 +0100
Subject: [PATCH 0975/1353] target/arm: Avoid writing to constant TCGv in
 trans_CSEL()

In commit 0b188ea05acb5 we changed the implementation of
trans_CSEL() to use tcg_constant_i32(). However, this change
was incorrect, because the implementation of the function
sets up the TCGv_i32 rn and rm to be either zero or else
a TCG temp created in load_reg(), and these TCG temps are
then in both cases written to by the emitted TCG ops.
The result is that we hit a TCG assertion:

qemu-system-arm: ../../tcg/tcg.c:4455: tcg_reg_alloc_mov: Assertion `!temp_readonly(ots)' failed.

(or on a non-debug build, just produce a garbage result)

Adjust the code so that rn and rm are always writeable
temporaries whether the instruction is using the special
case "0" or a normal register as input.

Cc: qemu-stable@nongnu.org
Fixes: 0b188ea05acb5 ("target/arm: Use tcg_constant in trans_CSEL")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230727103906.2641264-1-peter.maydell@linaro.org
---
 target/arm/tcg/translate.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 13c88ba1b9..b71ac2d0d5 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -8799,7 +8799,7 @@ static bool trans_IT(DisasContext *s, arg_IT *a)
 /* v8.1M CSEL/CSINC/CSNEG/CSINV */
 static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
 {
-    TCGv_i32 rn, rm, zero;
+    TCGv_i32 rn, rm;
     DisasCompare c;
 
     if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
@@ -8817,16 +8817,17 @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
     }
 
     /* In this insn input reg fields of 0b1111 mean "zero", not "PC" */
-    zero = tcg_constant_i32(0);
+    rn = tcg_temp_new_i32();
+    rm = tcg_temp_new_i32();
     if (a->rn == 15) {
-        rn = zero;
+        tcg_gen_movi_i32(rn, 0);
     } else {
-        rn = load_reg(s, a->rn);
+        load_reg_var(s, rn, a->rn);
     }
     if (a->rm == 15) {
-        rm = zero;
+        tcg_gen_movi_i32(rm, 0);
     } else {
-        rm = load_reg(s, a->rm);
+        load_reg_var(s, rm, a->rm);
     }
 
     switch (a->op) {
@@ -8846,7 +8847,7 @@ static bool trans_CSEL(DisasContext *s, arg_CSEL *a)
     }
 
     arm_test_cc(&c, a->fcond);
-    tcg_gen_movcond_i32(c.cond, rn, c.value, zero, rn, rm);
+    tcg_gen_movcond_i32(c.cond, rn, c.value, tcg_constant_i32(0), rn, rm);
 
     store_reg(s, a->rd, rn);
     return true;

From 71054f72f14e7a62b6e623997404259d52ea43fb Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 18 Jul 2023 11:46:28 +0100
Subject: [PATCH 0976/1353] target/arm/tcg: Don't build AArch64 decodetree
 files for qemu-system-arm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we list all the Arm decodetree files together and add them
unconditionally to arm_ss.  This means we build them for both
qemu-system-aarch64 and qemu-system-arm.  However, some of them are
AArch64-specific, so there is no need to build them for
qemu-system-arm.  (Meson is smart enough to notice that the generated
.c.inc file is not used by any objects that go into qemu-system-arm,
so we only unnecessarily run decodetree, not anything more
heavyweight like a recompile or relink, but it's still unnecessary
work.)

Split gen into gen_a32 and gen_a64, and only add gen_a64 for
TARGET_AARCH64 compiles.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230718104628.1137734-1-peter.maydell@linaro.org
---
 target/arm/tcg/meson.build | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index bdcab56489..6fca38f2cc 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -1,7 +1,11 @@
-gen = [
+gen_a64 = [
+  decodetree.process('a64.decode', extra_args: ['--static-decode=disas_a64']),
   decodetree.process('sve.decode', extra_args: '--decode=disas_sve'),
   decodetree.process('sme.decode', extra_args: '--decode=disas_sme'),
   decodetree.process('sme-fa64.decode', extra_args: '--static-decode=disas_sme_fa64'),
+]
+
+gen_a32 = [
   decodetree.process('neon-shared.decode', extra_args: '--decode=disas_neon_shared'),
   decodetree.process('neon-dp.decode', extra_args: '--decode=disas_neon_dp'),
   decodetree.process('neon-ls.decode', extra_args: '--decode=disas_neon_ls'),
@@ -13,10 +17,10 @@ gen = [
   decodetree.process('a32-uncond.decode', extra_args: '--static-decode=disas_a32_uncond'),
   decodetree.process('t32.decode', extra_args: '--static-decode=disas_t32'),
   decodetree.process('t16.decode', extra_args: ['-w', '16', '--static-decode=disas_t16']),
-  decodetree.process('a64.decode', extra_args: ['--static-decode=disas_a64']),
 ]
 
-arm_ss.add(gen)
+arm_ss.add(gen_a32)
+arm_ss.add(when: 'TARGET_AARCH64', if_true: gen_a64)
 
 arm_ss.add(files(
   'cpu32.c',

From fe6bda58e083ec8ffa5c5166e3b1055501b6318a Mon Sep 17 00:00:00 2001
From: Gavin Shan <gshan@redhat.com>
Date: Mon, 31 Jul 2023 22:59:46 +1000
Subject: [PATCH 0977/1353] kvm: Fix crash due to access uninitialized
 kvm_state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Runs into core dump on arm64 and the backtrace extracted from the
core dump is shown as below. It's caused by accessing uninitialized
@kvm_state in kvm_flush_coalesced_mmio_buffer() due to commit 176d073029
("hw/arm/virt: Use machine_memory_devices_init()"), where the machine's
memory region is added earlier than before.

    main
    qemu_init
    configure_accelerators
    qemu_opts_foreach
    do_configure_accelerator
    accel_init_machine
    kvm_init
    virt_kvm_type
    virt_set_memmap
    machine_memory_devices_init
    memory_region_add_subregion
    memory_region_add_subregion_common
    memory_region_update_container_subregions
    memory_region_transaction_begin
    qemu_flush_coalesced_mmio_buffer
    kvm_flush_coalesced_mmio_buffer

Fix it by bailing early in kvm_flush_coalesced_mmio_buffer() on the
uninitialized @kvm_state. With this applied, no crash is observed on
arm64.

Fixes: 176d073029 ("hw/arm/virt: Use machine_memory_devices_init()")
Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230731125946.2038742-1-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/kvm/kvm-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 373d876c05..7b3da8dc3a 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2812,7 +2812,7 @@ void kvm_flush_coalesced_mmio_buffer(void)
 {
     KVMState *s = kvm_state;
 
-    if (s->coalesced_flush_in_progress) {
+    if (!s || s->coalesced_flush_in_progress) {
         return;
     }
 

From 108e8180c6b0c315711aa54e914030a313505c17 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 11 Jul 2023 18:59:03 +1000
Subject: [PATCH 0978/1353] gdbstub: Fix client Ctrl-C handling

The gdb remote protocol has a special interrupt character (0x03) that is
transmitted outside the regular packet processing, and represents a
Ctrl-C pressed in the client. Despite not being a regular packet, it
does expect a regular stop response if the stub successfully stops the
running program.

See: https://sourceware.org/gdb/onlinedocs/gdb/Interrupts.html

Inhibiting the stop reply packet can lead to gdb client hang. So permit
a stop response when receiving a character from gdb that stops the vm.
Additionally, add a warning if that was not a 0x03 character, because
the gdb session is likely to end up getting confused if this happens.

Cc: qemu-stable@nongnu.org
Fixes: 758370052fb ("gdbstub: only send stop-reply packets when allowed to")
Reported-by: Frederic Barrat <fbarrat@linux.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Tested-by: Joel Stanley <joel@jms.id.au>
Message-id: 20230711085903.304496-1-npiggin@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 gdbstub/gdbstub.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 6911b73c07..ce8b42eb15 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -2051,8 +2051,17 @@ void gdb_read_byte(uint8_t ch)
             return;
     }
     if (runstate_is_running()) {
-        /* when the CPU is running, we cannot do anything except stop
-           it when receiving a char */
+        /*
+         * When the CPU is running, we cannot do anything except stop
+         * it when receiving a char. This is expected on a Ctrl-C in the
+         * gdb client. Because we are in all-stop mode, gdb sends a
+         * 0x03 byte which is not a usual packet, so we handle it specially
+         * here, but it does expect a stop reply.
+         */
+        if (ch != 0x03) {
+            warn_report("gdbstub: client sent packet while target running\n");
+        }
+        gdbserver_state.allow_stop_reply = true;
         vm_stop(RUN_STATE_PAUSED);
     } else
 #endif

From 055b86e0f0b4325117055d8d31c49011258f4af3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Jul 2023 20:43:45 +0100
Subject: [PATCH 0979/1353] util/interval-tree: Use qatomic_read for left/right
 while searching

Fixes a race condition (generally without optimization) in which
the subtree is re-read after the protecting if condition.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/interval-tree.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/util/interval-tree.c b/util/interval-tree.c
index 4c0baf108f..5a0ad21b2d 100644
--- a/util/interval-tree.c
+++ b/util/interval-tree.c
@@ -745,8 +745,9 @@ static IntervalTreeNode *interval_tree_subtree_search(IntervalTreeNode *node,
          * Loop invariant: start <= node->subtree_last
          * (Cond2 is satisfied by one of the subtree nodes)
          */
-        if (node->rb.rb_left) {
-            IntervalTreeNode *left = rb_to_itree(node->rb.rb_left);
+        RBNode *tmp = qatomic_read(&node->rb.rb_left);
+        if (tmp) {
+            IntervalTreeNode *left = rb_to_itree(tmp);
 
             if (start <= left->subtree_last) {
                 /*
@@ -765,8 +766,9 @@ static IntervalTreeNode *interval_tree_subtree_search(IntervalTreeNode *node,
             if (start <= node->last) {     /* Cond2 */
                 return node; /* node is leftmost match */
             }
-            if (node->rb.rb_right) {
-                node = rb_to_itree(node->rb.rb_right);
+            tmp = qatomic_read(&node->rb.rb_right);
+            if (tmp) {
+                node = rb_to_itree(tmp);
                 if (start <= node->subtree_last) {
                     continue;
                 }
@@ -814,8 +816,9 @@ IntervalTreeNode *interval_tree_iter_first(IntervalTreeRoot *root,
 IntervalTreeNode *interval_tree_iter_next(IntervalTreeNode *node,
                                           uint64_t start, uint64_t last)
 {
-    RBNode *rb = node->rb.rb_right, *prev;
+    RBNode *rb, *prev;
 
+    rb = qatomic_read(&node->rb.rb_right);
     while (true) {
         /*
          * Loop invariants:
@@ -840,7 +843,7 @@ IntervalTreeNode *interval_tree_iter_next(IntervalTreeNode *node,
             }
             prev = &node->rb;
             node = rb_to_itree(rb);
-            rb = node->rb.rb_right;
+            rb = qatomic_read(&node->rb.rb_right);
         } while (prev == rb);
 
         /* Check if the node intersects [start;last] */

From 4c8baa02d36379507afd17bdea87aabe0aa32ed3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Jul 2023 15:25:30 +0100
Subject: [PATCH 0980/1353] util/interval-tree: Use qatomic_set_mb in
 rb_link_node

Ensure that the stores to rb_left and rb_right are complete before
inserting the new node into the tree.  Otherwise a concurrent reader
could see garbage in the new leaf.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/interval-tree.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/util/interval-tree.c b/util/interval-tree.c
index 5a0ad21b2d..759562db7d 100644
--- a/util/interval-tree.c
+++ b/util/interval-tree.c
@@ -128,7 +128,11 @@ static inline void rb_link_node(RBNode *node, RBNode *parent, RBNode **rb_link)
     node->rb_parent_color = (uintptr_t)parent;
     node->rb_left = node->rb_right = NULL;
 
-    qatomic_set(rb_link, node);
+    /*
+     * Ensure that node is initialized before insertion,
+     * as viewed by a concurrent search.
+     */
+    qatomic_set_mb(rb_link, node);
 }
 
 static RBNode *rb_next(RBNode *node)

From d37a259fa4f5164e300e8a20cdd83fe39c7fdadb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Jul 2023 21:20:05 +0100
Subject: [PATCH 0981/1353] util/interval-tree: Introduce pc_parent

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/interval-tree.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/util/interval-tree.c b/util/interval-tree.c
index 759562db7d..d86c0752db 100644
--- a/util/interval-tree.c
+++ b/util/interval-tree.c
@@ -68,9 +68,14 @@ typedef struct RBAugmentCallbacks {
     void (*rotate)(RBNode *old, RBNode *new);
 } RBAugmentCallbacks;
 
+static inline RBNode *pc_parent(uintptr_t pc)
+{
+    return (RBNode *)(pc & ~1);
+}
+
 static inline RBNode *rb_parent(const RBNode *n)
 {
-    return (RBNode *)(n->rb_parent_color & ~1);
+    return pc_parent(n->rb_parent_color);
 }
 
 static inline RBNode *rb_red_parent(const RBNode *n)
@@ -532,7 +537,7 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
          * so as to bypass rb_erase_color() later on.
          */
         pc = node->rb_parent_color;
-        parent = rb_parent(node);
+        parent = pc_parent(pc);
         rb_change_child(node, child, parent, root);
         if (child) {
             child->rb_parent_color = pc;
@@ -544,7 +549,7 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
     } else if (!child) {
         /* Still case 1, but this time the child is node->rb_left */
         pc = node->rb_parent_color;
-        parent = rb_parent(node);
+        parent = pc_parent(pc);
         tmp->rb_parent_color = pc;
         rb_change_child(node, tmp, parent, root);
         rebalance = NULL;
@@ -600,7 +605,7 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
         rb_set_parent(tmp, successor);
 
         pc = node->rb_parent_color;
-        tmp = rb_parent(node);
+        tmp = pc_parent(pc);
         rb_change_child(node, successor, tmp, root);
 
         if (child2) {

From 79e29851bf57741252a20838cdc59074ab5bac29 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 22 Jul 2023 15:17:38 +0100
Subject: [PATCH 0982/1353] util/interval-tree: Use qatomic_read/set for
 rb_parent_color

While less susceptible to optimization problems than left and right,
interval_tree_iter_next also reads rb_parent(), so make sure that
stores and loads are atomic.

This goes further than technically required, changing all loads to
be atomic, rather than simply the ones in the iteration side.  But
it doesn't really affect the code generation on the rebalance side
and is cleaner to handle everything the same.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/interval-tree.c | 47 ++++++++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 21 deletions(-)

diff --git a/util/interval-tree.c b/util/interval-tree.c
index d86c0752db..f2866aa7d3 100644
--- a/util/interval-tree.c
+++ b/util/interval-tree.c
@@ -48,12 +48,6 @@
  *
  * It also guarantees that if the lookup returns an element it is the 'correct'
  * one. But not returning an element does _NOT_ mean it's not present.
- *
- * NOTE:
- *
- * Stores to __rb_parent_color are not important for simple lookups so those
- * are left undone as of now. Nor did I check for loops involving parent
- * pointers.
  */
 
 typedef enum RBColor
@@ -68,6 +62,16 @@ typedef struct RBAugmentCallbacks {
     void (*rotate)(RBNode *old, RBNode *new);
 } RBAugmentCallbacks;
 
+static inline uintptr_t rb_pc(const RBNode *n)
+{
+    return qatomic_read(&n->rb_parent_color);
+}
+
+static inline void rb_set_pc(RBNode *n, uintptr_t pc)
+{
+    qatomic_set(&n->rb_parent_color, pc);
+}
+
 static inline RBNode *pc_parent(uintptr_t pc)
 {
     return (RBNode *)(pc & ~1);
@@ -75,12 +79,12 @@ static inline RBNode *pc_parent(uintptr_t pc)
 
 static inline RBNode *rb_parent(const RBNode *n)
 {
-    return pc_parent(n->rb_parent_color);
+    return pc_parent(rb_pc(n));
 }
 
 static inline RBNode *rb_red_parent(const RBNode *n)
 {
-    return (RBNode *)n->rb_parent_color;
+    return (RBNode *)rb_pc(n);
 }
 
 static inline RBColor pc_color(uintptr_t pc)
@@ -100,27 +104,27 @@ static inline bool pc_is_black(uintptr_t pc)
 
 static inline RBColor rb_color(const RBNode *n)
 {
-    return pc_color(n->rb_parent_color);
+    return pc_color(rb_pc(n));
 }
 
 static inline bool rb_is_red(const RBNode *n)
 {
-    return pc_is_red(n->rb_parent_color);
+    return pc_is_red(rb_pc(n));
 }
 
 static inline bool rb_is_black(const RBNode *n)
 {
-    return pc_is_black(n->rb_parent_color);
+    return pc_is_black(rb_pc(n));
 }
 
 static inline void rb_set_black(RBNode *n)
 {
-    n->rb_parent_color |= RB_BLACK;
+    rb_set_pc(n, rb_pc(n) | RB_BLACK);
 }
 
 static inline void rb_set_parent_color(RBNode *n, RBNode *p, RBColor color)
 {
-    n->rb_parent_color = (uintptr_t)p | color;
+    rb_set_pc(n, (uintptr_t)p | color);
 }
 
 static inline void rb_set_parent(RBNode *n, RBNode *p)
@@ -186,9 +190,10 @@ static inline void rb_change_child(RBNode *old, RBNode *new,
 static inline void rb_rotate_set_parents(RBNode *old, RBNode *new,
                                          RBRoot *root, RBColor color)
 {
-    RBNode *parent = rb_parent(old);
+    uintptr_t pc = rb_pc(old);
+    RBNode *parent = pc_parent(pc);
 
-    new->rb_parent_color = old->rb_parent_color;
+    rb_set_pc(new, pc);
     rb_set_parent_color(old, new, color);
     rb_change_child(old, new, parent, root);
 }
@@ -536,11 +541,11 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
          * and node must be black due to 4). We adjust colors locally
          * so as to bypass rb_erase_color() later on.
          */
-        pc = node->rb_parent_color;
+        pc = rb_pc(node);
         parent = pc_parent(pc);
         rb_change_child(node, child, parent, root);
         if (child) {
-            child->rb_parent_color = pc;
+            rb_set_pc(child, pc);
             rebalance = NULL;
         } else {
             rebalance = pc_is_black(pc) ? parent : NULL;
@@ -548,9 +553,9 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
         tmp = parent;
     } else if (!child) {
         /* Still case 1, but this time the child is node->rb_left */
-        pc = node->rb_parent_color;
+        pc = rb_pc(node);
         parent = pc_parent(pc);
-        tmp->rb_parent_color = pc;
+        rb_set_pc(tmp, pc);
         rb_change_child(node, tmp, parent, root);
         rebalance = NULL;
         tmp = parent;
@@ -604,7 +609,7 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
         qatomic_set(&successor->rb_left, tmp);
         rb_set_parent(tmp, successor);
 
-        pc = node->rb_parent_color;
+        pc = rb_pc(node);
         tmp = pc_parent(pc);
         rb_change_child(node, successor, tmp, root);
 
@@ -614,7 +619,7 @@ static void rb_erase_augmented(RBNode *node, RBRoot *root,
         } else {
             rebalance = rb_is_black(successor) ? parent : NULL;
         }
-        successor->rb_parent_color = pc;
+        rb_set_pc(successor, pc);
         tmp = successor;
     }
 

From ad17868eb162a5466d8ad43e5ccb428776403308 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 26 Jul 2023 12:58:08 -0700
Subject: [PATCH 0983/1353] accel/tcg: Clear tcg_ctx->gen_tb on buffer overflow

On overflow of code_gen_buffer, we unlock the guest pages we had been
translating, but failed to clear gen_tb.  On restart, if we cannot
allocate a TB, we exit to the main loop to perform the flush of all
TBs as soon as possible.  With garbage in gen_tb, we hit an assert:

../src/accel/tcg/tb-maint.c:348:page_unlock__debug: \
    assertion failed: (page_is_locked(pd))

Fixes: deba78709ae8 ("accel/tcg: Always lock pages before translation")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index a1782db5dd..b2d4e22c17 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -374,6 +374,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
                           "Restarting code generation for "
                           "code_gen_buffer overflow\n");
             tb_unlock_pages(tb);
+            tcg_ctx->gen_tb = NULL;
             goto buffer_overflow;
 
         case -2:

From 28b61d49ac80bac8ef74aff0b75058bdd0b2f108 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 27 Jul 2023 09:11:48 -0700
Subject: [PATCH 0984/1353] bsd-user: Allocate guest virtual address space

With reserved_va, mmap.c expects to have pre-allocated host address
space for the entire guest address space.  When combined with the -B
command-line option, ensure that the chosen address does not overlap
anything else.  Ensure that mmap_next_start is within reserved_va,
as we use it within mmap.c without checking.

Reviewed by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230727161148.444988-1-richard.henderson@linaro.org>
---
 bsd-user/main.c | 48 +++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/bsd-user/main.c b/bsd-user/main.c
index b597328118..381bb18df8 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -473,10 +473,6 @@ int main(int argc, char **argv)
     target_environ = envlist_to_environ(envlist, NULL);
     envlist_free(envlist);
 
-    if (reserved_va) {
-        mmap_next_start = reserved_va + 1;
-    }
-
     {
         Error *err = NULL;
         if (seed_optarg != NULL) {
@@ -494,7 +490,49 @@ int main(int argc, char **argv)
      * Now that page sizes are configured we can do
      * proper page alignment for guest_base.
      */
-    guest_base = HOST_PAGE_ALIGN(guest_base);
+    if (have_guest_base) {
+        if (guest_base & ~qemu_host_page_mask) {
+            error_report("Selected guest base not host page aligned");
+            exit(1);
+        }
+    }
+
+    /*
+     * If reserving host virtual address space, do so now.
+     * Combined with '-B', ensure that the chosen range is free.
+     */
+    if (reserved_va) {
+        void *p;
+
+        if (have_guest_base) {
+            p = mmap((void *)guest_base, reserved_va + 1, PROT_NONE,
+                     MAP_ANON | MAP_PRIVATE | MAP_FIXED | MAP_EXCL, -1, 0);
+        } else {
+            p = mmap(NULL, reserved_va + 1, PROT_NONE,
+                     MAP_ANON | MAP_PRIVATE, -1, 0);
+        }
+        if (p == MAP_FAILED) {
+            const char *err = strerror(errno);
+            char *sz = size_to_str(reserved_va + 1);
+
+            if (have_guest_base) {
+                error_report("Cannot allocate %s bytes at -B %p for guest "
+                             "address space: %s", sz, (void *)guest_base, err);
+            } else {
+                error_report("Cannot allocate %s bytes for guest "
+                             "address space: %s", sz, err);
+            }
+            exit(1);
+        }
+        guest_base = (uintptr_t)p;
+        have_guest_base = true;
+
+        /* Ensure that mmap_next_start is within range. */
+        if (reserved_va <= mmap_next_start) {
+            mmap_next_start = (reserved_va / 4 * 3)
+                              & TARGET_PAGE_MASK & qemu_host_page_mask;
+        }
+    }
 
     if (loader_exec(filename, argv + optind, target_environ, regs, info,
                     &bprm) != 0) {

From 0f2f3247d456e08baa345768824dae6864d9acb6 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Fri, 28 Jul 2023 10:29:27 -0600
Subject: [PATCH 0985/1353] bsd-user: Specify host page alignment if none
 specified

We're hitting an assert when we pass in alignment == 0 since that's not
a power of two. so pass in the ideal page size.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Message-Id: <20230728162927.5009-1-imp@bsdimp.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/mmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index 74ed00b9fe..b62a69bd07 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -260,7 +260,8 @@ static abi_ulong mmap_find_vma_aligned(abi_ulong start, abi_ulong size,
 
     if (reserved_va) {
         return mmap_find_vma_reserved(start, size,
-            (alignment != 0 ? 1 << alignment : 0));
+            (alignment != 0 ? 1 << alignment :
+             MAX(qemu_host_page_size, TARGET_PAGE_SIZE)));
     }
 
     addr = start;

From 2e718e665706d5fcc3e3501bda26f277f055ed85 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 28 Jul 2023 10:22:52 -0700
Subject: [PATCH 0986/1353] target/ppc: Disable goto_tb with architectural
 singlestep
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The change to use translator_use_goto_tb went too far, as the
CF_SINGLE_STEP flag managed by the translator only handles
gdb single stepping and not the architectural single stepping
modeled in DisasContext.singlestep_enabled.

Fixes: 6e9cc373ec5 ("target/ppc: Use translator_use_goto_tb")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1795
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/translate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index e6a0709066..74796ec7ba 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -4175,6 +4175,9 @@ static void pmu_count_insns(DisasContext *ctx)
 
 static inline bool use_goto_tb(DisasContext *ctx, target_ulong dest)
 {
+    if (unlikely(ctx->singlestep_enabled)) {
+        return false;
+    }
     return translator_use_goto_tb(&ctx->base, dest);
 }
 

From 38dd78c41eaf08b490c9e7ec68fc508bbaa5cb1d Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Fri, 28 Jul 2023 21:23:10 +0200
Subject: [PATCH 0987/1353] linux-user/armeb: Fix __kernel_cmpxchg() for armeb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 7f4f0d9ea870 ("linux-user/arm: Implement __kernel_cmpxchg with host
atomics") switched to use qatomic_cmpxchg() to swap a word with the memory
content, but missed to endianess-swap the oldval and newval values when
emulating an armeb CPU, which expects words to be stored in big endian in
the guest memory.

The bug can be verified with qemu >= v7.0 on any little-endian host, when
starting the armeb binary of the upx program, which just hangs without
this patch.

Cc: qemu-stable@nongnu.org
Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Reported-by: John Reiser <jreiser@BitWagon.com>
Closes: https://github.com/upx/upx/issues/687
Message-Id: <ZMQVnqY+F+5sTNFd@p100>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/cpu_loop.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index a992423257..b404117ff3 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -117,8 +117,9 @@ static void arm_kernel_cmpxchg32_helper(CPUARMState *env)
 {
     uint32_t oldval, newval, val, addr, cpsr, *host_addr;
 
-    oldval = env->regs[0];
-    newval = env->regs[1];
+    /* Swap if host != guest endianness, for the host cmpxchg below */
+    oldval = tswap32(env->regs[0]);
+    newval = tswap32(env->regs[1]);
     addr = env->regs[2];
 
     mmap_lock();
@@ -174,6 +175,10 @@ static void arm_kernel_cmpxchg64_helper(CPUARMState *env)
         return;
     }
 
+    /* Swap if host != guest endianness, for the host cmpxchg below */
+    oldval = tswap64(oldval);
+    newval = tswap64(newval);
+
 #ifdef CONFIG_ATOMIC64
     val = qatomic_cmpxchg__nocheck(host_addr, oldval, newval);
     cpsr = (val == oldval) * CPSR_C;

From 8b94ec53f367db7adcc9b59c483ce3e6c7bc3740 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 28 Jul 2023 12:53:59 -0700
Subject: [PATCH 0988/1353] target/s390x: Move trans_exc_code update to
 do_program_interrupt

This solves a problem in which the store to LowCore during tlb_fill
triggers a clean-page TB invalidation for page0 during translation,
which results in an assertion failure for locked pages.

By delaying the store until after the exception has been raised,
we will have unwound the pages locked for translation and the
problem does not arise.  There are plenty of other updates to
LowCore while delivering an interrupt/exception; trans_exc_code
does not need to be special.

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/s390x/tcg/excp_helper.c | 40 ++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 3da337f7c7..b7116d0577 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -190,11 +190,6 @@ bool s390_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         return false;
     }
 
-    if (excp != PGM_ADDRESSING) {
-        stq_phys(env_cpu(env)->as,
-                 env->psa + offsetof(LowCore, trans_exc_code), tec);
-    }
-
     /*
      * For data accesses, ILEN will be filled in from the unwind info,
      * within cpu_loop_exit_restore.  For code accesses, retaddr == 0,
@@ -211,20 +206,33 @@ static void do_program_interrupt(CPUS390XState *env)
     uint64_t mask, addr;
     LowCore *lowcore;
     int ilen = env->int_pgm_ilen;
+    bool set_trans_exc_code = false;
+    bool advance = false;
 
     assert((env->int_pgm_code == PGM_SPECIFICATION && ilen == 0) ||
            ilen == 2 || ilen == 4 || ilen == 6);
 
     switch (env->int_pgm_code) {
     case PGM_PER:
-        if (env->per_perc_atmid & PER_CODE_EVENT_NULLIFICATION) {
-            break;
-        }
-        /* FALL THROUGH */
+        advance = !(env->per_perc_atmid & PER_CODE_EVENT_NULLIFICATION);
+        break;
+    case PGM_ASCE_TYPE:
+    case PGM_REG_FIRST_TRANS:
+    case PGM_REG_SEC_TRANS:
+    case PGM_REG_THIRD_TRANS:
+    case PGM_SEGMENT_TRANS:
+    case PGM_PAGE_TRANS:
+        assert(env->int_pgm_code == env->tlb_fill_exc);
+        set_trans_exc_code = true;
+        break;
+    case PGM_PROTECTION:
+        assert(env->int_pgm_code == env->tlb_fill_exc);
+        set_trans_exc_code = true;
+        advance = true;
+        break;
     case PGM_OPERATION:
     case PGM_PRIVILEGED:
     case PGM_EXECUTE:
-    case PGM_PROTECTION:
     case PGM_ADDRESSING:
     case PGM_SPECIFICATION:
     case PGM_DATA:
@@ -243,11 +251,15 @@ static void do_program_interrupt(CPUS390XState *env)
     case PGM_PC_TRANS_SPEC:
     case PGM_ALET_SPEC:
     case PGM_MONITOR:
-        /* advance the PSW if our exception is not nullifying */
-        env->psw.addr += ilen;
+        advance = true;
         break;
     }
 
+    /* advance the PSW if our exception is not nullifying */
+    if (advance) {
+        env->psw.addr += ilen;
+    }
+
     qemu_log_mask(CPU_LOG_INT,
                   "%s: code=0x%x ilen=%d psw: %" PRIx64 " %" PRIx64 "\n",
                   __func__, env->int_pgm_code, ilen, env->psw.mask,
@@ -263,6 +275,10 @@ static void do_program_interrupt(CPUS390XState *env)
         env->per_perc_atmid = 0;
     }
 
+    if (set_trans_exc_code) {
+        lowcore->trans_exc_code = cpu_to_be64(env->tlb_fill_tec);
+    }
+
     lowcore->pgm_ilen = cpu_to_be16(ilen);
     lowcore->pgm_code = cpu_to_be16(env->int_pgm_code);
     lowcore->program_old_psw.mask = cpu_to_be64(s390_cpu_get_psw_mask(env));

From 765fdc1e8355d4bae563b3b185c5f9d079384164 Mon Sep 17 00:00:00 2001
From: Stafford Horne <shorne@gmail.com>
Date: Sat, 29 Jul 2023 21:43:17 +0100
Subject: [PATCH 0989/1353] target/openrisc: Set EPCR to next PC on FPE
 exceptions

The architecture specification calls for the EPCR to be set to "Address
of next not executed instruction" when there is a floating point
exception (FPE).  This was not being done, so fix it by using the same
pattern as syscall.  Also, we move this logic down to be done for
instructions not in the delay slot as called for by the architecture
manual.

Without this patch FPU exceptions will loop, as the exception handling
will always return back to the failed floating point instruction.

This was not noticed in earlier testing because:

 1. The compiler usually generates code which clobbers the input operand
    such as:

      lf.div.s r19,r17,r19

 2. The target will store the operation output before to the register
    before handling the exception.  So an operation such as:

      float a = 100.0f;
      float b = 0.0f;
      float c = a / b;    /* lf.div.s r19,r17,r19 */

    Will first execute:

      100 / 0    -> Store inf to c (r19)
                 -> triggering divide by zero exception
                 -> handle and return

    Then it will execute:

      100 / inf  -> Store 0 to c  (no exception)

To confirm the looping behavior and the fix I used the following:

    float fpu_div(float a, float b) {
	float c;
	asm volatile("lf.div.s %0, %1, %2"
		      : "+r" (c)
		      : "r" (a), "r" (b));
	return c;
    }

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Stafford Horne <shorne@gmail.com>
---
 target/openrisc/interrupt.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/openrisc/interrupt.c b/target/openrisc/interrupt.c
index 3887812810..d4fdb8ce8e 100644
--- a/target/openrisc/interrupt.c
+++ b/target/openrisc/interrupt.c
@@ -34,9 +34,7 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
     int exception = cs->exception_index;
 
     env->epcr = env->pc;
-    if (exception == EXCP_SYSCALL) {
-        env->epcr += 4;
-    }
+
     /* When we have an illegal instruction the error effective address
        shall be set to the illegal instruction address.  */
     if (exception == EXCP_ILLEGAL) {
@@ -63,6 +61,9 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         env->epcr -= 4;
     } else {
         env->sr &= ~SR_DSX;
+        if (exception == EXCP_SYSCALL || exception == EXCP_FPE) {
+            env->epcr += 4;
+        }
     }
 
     if (exception > 0 && exception < EXCP_NR) {

From ace33a0e5a5191f79899397adb766dda7208cb93 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Tue, 20 Jun 2023 18:58:55 +0100
Subject: [PATCH 0990/1353] hw/xen: Clarify (lack of) error handling in
 transaction_commit()

Coverity was unhappy (CID 1508359) because we didn't check the return of
init_walk_op() in transaction_commit(), despite doing so at every other
call site.

Strictly speaking, this is a false positive since it can never fail. It
only fails for invalid user input (transaction ID or path), and both of
those are hard-coded to known sane values in this invocation.

But Coverity doesn't know that, and neither does the casual reader of the
code.

Returning an error here would be weird, since the transaction *is*
committed by this point; all the walk_op is doing is firing watches on
the newly-committed changed nodes. So make it a g_assert(!ret), since
it really should never happen.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20076888f6bdf06a65aafc5cf954260965d45b97.camel@infradead.org>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
---
 hw/i386/kvm/xenstore_impl.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/i386/kvm/xenstore_impl.c b/hw/i386/kvm/xenstore_impl.c
index 305fe75519..d9732b567e 100644
--- a/hw/i386/kvm/xenstore_impl.c
+++ b/hw/i386/kvm/xenstore_impl.c
@@ -1022,6 +1022,7 @@ static int transaction_commit(XenstoreImplState *s, XsTransaction *tx)
 {
     struct walk_op op;
     XsNode **n;
+    int ret;
 
     if (s->root_tx != tx->base_tx) {
         return EAGAIN;
@@ -1032,7 +1033,16 @@ static int transaction_commit(XenstoreImplState *s, XsTransaction *tx)
     s->root_tx = tx->tx_id;
     s->nr_nodes = tx->nr_nodes;
 
-    init_walk_op(s, &op, XBT_NULL, tx->dom_id, "/", &n);
+    ret = init_walk_op(s, &op, XBT_NULL, tx->dom_id, "/", &n);
+    /*
+     * There are two reasons why init_walk_op() may fail: an invalid tx_id,
+     * or an invalid path. We pass XBT_NULL and "/", and it cannot fail.
+     * If it does, the world is broken. And returning 'ret' would be weird
+     * because the transaction *was* committed, and all this tree walk is
+     * trying to do is fire the resulting watches on newly-committed nodes.
+     */
+    g_assert(!ret);
+
     op.deleted_in_tx = false;
     op.mutating = true;
 

From aa36243514a777f76c8b8a19b1f8a71f27ec6c78 Mon Sep 17 00:00:00 2001
From: Anthony PERARD <anthony.perard@citrix.com>
Date: Tue, 4 Jul 2023 18:18:19 +0100
Subject: [PATCH 0991/1353] xen-block: Avoid leaks on new error path

Commit 189829399070 ("xen-block: Use specific blockdev driver")
introduced a new error path, without taking care of allocated
resources.

So only allocate the qdicts after the error check, and free both
`filename` and `driver` when we are about to return and thus taking
care of both success and error path.

Coverity only spotted the leak of qdicts (*_layer variables).

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Fixes: Coverity CID 1508722, 1398649
Fixes: 189829399070 ("xen-block: Use specific blockdev driver")
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230704171819.42564-1-anthony.perard@citrix.com>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
---
 hw/block/xen-block.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index f099914831..3906b9058b 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -781,14 +781,15 @@ static XenBlockDrive *xen_block_drive_create(const char *id,
     drive = g_new0(XenBlockDrive, 1);
     drive->id = g_strdup(id);
 
-    file_layer = qdict_new();
-    driver_layer = qdict_new();
-
     rc = stat(filename, &st);
     if (rc) {
         error_setg_errno(errp, errno, "Could not stat file '%s'", filename);
         goto done;
     }
+
+    file_layer = qdict_new();
+    driver_layer = qdict_new();
+
     if (S_ISBLK(st.st_mode)) {
         qdict_put_str(file_layer, "driver", "host_device");
     } else {
@@ -796,7 +797,6 @@ static XenBlockDrive *xen_block_drive_create(const char *id,
     }
 
     qdict_put_str(file_layer, "filename", filename);
-    g_free(filename);
 
     if (mode && *mode != 'w') {
         qdict_put_bool(file_layer, "read-only", true);
@@ -831,7 +831,6 @@ static XenBlockDrive *xen_block_drive_create(const char *id,
     qdict_put_str(file_layer, "locking", "off");
 
     qdict_put_str(driver_layer, "driver", driver);
-    g_free(driver);
 
     qdict_put(driver_layer, "file", file_layer);
 
@@ -842,6 +841,8 @@ static XenBlockDrive *xen_block_drive_create(const char *id,
     qobject_unref(driver_layer);
 
 done:
+    g_free(filename);
+    g_free(driver);
     if (*errp) {
         xen_block_drive_destroy(drive, NULL);
         return NULL;

From f4f71363fcdb1092ff64d2bba6f9af39570c2f2b Mon Sep 17 00:00:00 2001
From: Anthony PERARD <anthony.perard@citrix.com>
Date: Fri, 14 Jul 2023 16:27:20 +0100
Subject: [PATCH 0992/1353] thread-pool: signal "request_cond" while locked

thread_pool_free() might have been called on the `pool`, which would
be a reason for worker_thread() to quit. In this case,
`pool->request_cond` is been destroyed.

If worker_thread() didn't managed to signal `request_cond` before it
been destroyed by thread_pool_free(), we got:
    util/qemu-thread-posix.c:198: qemu_cond_signal: Assertion `cond->initialized' failed.

One backtrace:
    __GI___assert_fail (assertion=0x55555614abcb "cond->initialized", file=0x55555614ab88 "util/qemu-thread-posix.c", line=198,
	function=0x55555614ad80 <__PRETTY_FUNCTION__.17104> "qemu_cond_signal") at assert.c:101
    qemu_cond_signal (cond=0x7fffb800db30) at util/qemu-thread-posix.c:198
    worker_thread (opaque=0x7fffb800dab0) at util/thread-pool.c:129
    qemu_thread_start (args=0x7fffb8000b20) at util/qemu-thread-posix.c:505
    start_thread (arg=<optimized out>) at pthread_create.c:486

Reported here:
    https://lore.kernel.org/all/ZJwoK50FcnTSfFZ8@MacBook-Air-de-Roger.local/T/#u

To avoid issue, keep lock while sending a signal to `request_cond`.

Fixes: 900fa208f506 ("thread-pool: replace semaphore with condition variable")
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20230714152720.5077-1-anthony.perard@citrix.com>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
---
 util/thread-pool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/thread-pool.c b/util/thread-pool.c
index 0d97888df0..e3d8292d14 100644
--- a/util/thread-pool.c
+++ b/util/thread-pool.c
@@ -120,13 +120,13 @@ static void *worker_thread(void *opaque)
 
     pool->cur_threads--;
     qemu_cond_signal(&pool->worker_stopped);
-    qemu_mutex_unlock(&pool->lock);
 
     /*
      * Wake up another thread, in case we got a wakeup but decided
      * to exit due to pool->cur_threads > pool->max_threads.
      */
     qemu_cond_signal(&pool->request_cond);
+    qemu_mutex_unlock(&pool->lock);
     return NULL;
 }
 

From bcb40db010517120dfffccc77cef9e4fcd3235fa Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 18 Jul 2023 11:10:57 +0100
Subject: [PATCH 0993/1353] xen: Don't pass MemoryListener around by value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity points out (CID 1513106, 1513107) that MemoryListener is a
192 byte struct which we are passing around by value.  Switch to
passing a const pointer into xen_register_ioreq() and then to
xen_do_ioreq_register().  We can also make the file-scope
MemoryListener variables const, since nothing changes them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Anthony PERARD <anthony.perard@citrix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230718101057.1110979-1-peter.maydell@linaro.org>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
---
 hw/arm/xen_arm.c                | 4 ++--
 hw/i386/xen/xen-hvm.c           | 4 ++--
 hw/xen/xen-hvm-common.c         | 8 ++++----
 include/hw/xen/xen-hvm-common.h | 2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/arm/xen_arm.c b/hw/arm/xen_arm.c
index 044093fec7..1d3e6d481a 100644
--- a/hw/arm/xen_arm.c
+++ b/hw/arm/xen_arm.c
@@ -37,7 +37,7 @@
 #define TYPE_XEN_ARM  MACHINE_TYPE_NAME("xenpvh")
 OBJECT_DECLARE_SIMPLE_TYPE(XenArmState, XEN_ARM)
 
-static MemoryListener xen_memory_listener = {
+static const MemoryListener xen_memory_listener = {
     .region_add = xen_region_add,
     .region_del = xen_region_del,
     .log_start = NULL,
@@ -108,7 +108,7 @@ static void xen_arm_init(MachineState *machine)
 
     xam->state =  g_new0(XenIOState, 1);
 
-    xen_register_ioreq(xam->state, machine->smp.cpus, xen_memory_listener);
+    xen_register_ioreq(xam->state, machine->smp.cpus, &xen_memory_listener);
 
 #ifdef CONFIG_TPM
     if (xam->cfg.tpm_base_addr) {
diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index 3da5a2b23f..f42621e674 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -458,7 +458,7 @@ static void xen_log_global_stop(MemoryListener *listener)
     xen_in_migration = false;
 }
 
-static MemoryListener xen_memory_listener = {
+static const MemoryListener xen_memory_listener = {
     .name = "xen-memory",
     .region_add = xen_region_add,
     .region_del = xen_region_del,
@@ -582,7 +582,7 @@ void xen_hvm_init_pc(PCMachineState *pcms, MemoryRegion **ram_memory)
 
     state = g_new0(XenIOState, 1);
 
-    xen_register_ioreq(state, max_cpus, xen_memory_listener);
+    xen_register_ioreq(state, max_cpus, &xen_memory_listener);
 
     QLIST_INIT(&xen_physmap);
     xen_read_physmap(state);
diff --git a/hw/xen/xen-hvm-common.c b/hw/xen/xen-hvm-common.c
index 886c3ee944..565dc39c8f 100644
--- a/hw/xen/xen-hvm-common.c
+++ b/hw/xen/xen-hvm-common.c
@@ -765,8 +765,8 @@ void xen_shutdown_fatal_error(const char *fmt, ...)
 }
 
 static void xen_do_ioreq_register(XenIOState *state,
-                                           unsigned int max_cpus,
-                                           MemoryListener xen_memory_listener)
+                                  unsigned int max_cpus,
+                                  const MemoryListener *xen_memory_listener)
 {
     int i, rc;
 
@@ -824,7 +824,7 @@ static void xen_do_ioreq_register(XenIOState *state,
 
     qemu_add_vm_change_state_handler(xen_hvm_change_state_handler, state);
 
-    state->memory_listener = xen_memory_listener;
+    state->memory_listener = *xen_memory_listener;
     memory_listener_register(&state->memory_listener, &address_space_memory);
 
     state->io_listener = xen_io_listener;
@@ -842,7 +842,7 @@ err:
 }
 
 void xen_register_ioreq(XenIOState *state, unsigned int max_cpus,
-                        MemoryListener xen_memory_listener)
+                        const MemoryListener *xen_memory_listener)
 {
     int rc;
 
diff --git a/include/hw/xen/xen-hvm-common.h b/include/hw/xen/xen-hvm-common.h
index f9559e2885..4e9904f1a6 100644
--- a/include/hw/xen/xen-hvm-common.h
+++ b/include/hw/xen/xen-hvm-common.h
@@ -93,7 +93,7 @@ void xen_device_unrealize(DeviceListener *listener, DeviceState *dev);
 
 void xen_hvm_change_state_handler(void *opaque, bool running, RunState rstate);
 void xen_register_ioreq(XenIOState *state, unsigned int max_cpus,
-                        MemoryListener xen_memory_listener);
+                        const MemoryListener *xen_memory_listener);
 
 void cpu_ioreq_pio(ioreq_t *req);
 #endif /* HW_XEN_HVM_COMMON_H */

From 856ca10f9ce1fcffeab18546b36a64f79017c905 Mon Sep 17 00:00:00 2001
From: Olaf Hering <olaf@aepfle.de>
Date: Thu, 20 Jul 2023 09:29:50 +0200
Subject: [PATCH 0994/1353] xen-platform: do full PCI reset during unplug of
 IDE devices

The IDE unplug function needs to reset the entire PCI device, to make
sure all state is initialized to defaults. This is done by calling
pci_device_reset, which resets not only the chip specific registers, but
also all PCI state. This fixes "unplug" in a Xen HVM domU with the
modular legacy xenlinux PV drivers.

Commit ee358e919e38 ("hw/ide/piix: Convert reset handler to
DeviceReset") changed the way how the the disks are unplugged. Prior
this commit the PCI device remained unchanged. After this change,
piix_ide_reset is exercised after the "unplug" command, which was not
the case prior that commit. This function resets the command register.
As a result the ata_piix driver inside the domU will see a disabled PCI
device. The generic PCI code will reenable the PCI device. On the qemu
side, this runs pci_default_write_config/pci_update_mappings. Here a
changed address is returned by pci_bar_address, this is the address
which was truncated in piix_ide_reset. In case of a Xen HVM domU, the
address changes from 0xc120 to 0xc100. This truncation was a bug in
piix_ide_reset, which was fixed in commit 230dfd9257 ("hw/ide/piix:
properly initialize the BMIBA register"). If pci_xen_ide_unplug had used
pci_device_reset, the PCI registers would have been properly reset, and
commit ee358e919e38 would have not introduced a regression for this
specific domU environment.

While the unplug is supposed to hide the IDE disks, the changed BMIBA
address broke the UHCI device. In case the domU has an USB tablet
configured, to recive absolute pointer coordinates for the GUI, it will
cause a hang during device discovery of the partly discovered USB hid
device. Reading the USBSTS word size register will fail. The access ends
up in the QEMU piix-bmdma device, instead of the expected uhci device.
Here a byte size request is expected, and a value of ~0 is returned. As
a result the UCHI driver sees an error state in the register, and turns
off the UHCI controller.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230720072950.20198-1-olaf@aepfle.de>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
---
 hw/i386/xen/xen_platform.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/i386/xen/xen_platform.c b/hw/i386/xen/xen_platform.c
index 57f1d742c1..17457ff3de 100644
--- a/hw/i386/xen/xen_platform.c
+++ b/hw/i386/xen/xen_platform.c
@@ -164,8 +164,9 @@ static void pci_unplug_nics(PCIBus *bus)
  *
  * [1] https://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=docs/misc/hvm-emulated-unplug.pandoc
  */
-static void pci_xen_ide_unplug(DeviceState *dev, bool aux)
+static void pci_xen_ide_unplug(PCIDevice *d, bool aux)
 {
+    DeviceState *dev = DEVICE(d);
     PCIIDEState *pci_ide;
     int i;
     IDEDevice *idedev;
@@ -195,7 +196,7 @@ static void pci_xen_ide_unplug(DeviceState *dev, bool aux)
             blk_unref(blk);
         }
     }
-    device_cold_reset(dev);
+    pci_device_reset(d);
 }
 
 static void unplug_disks(PCIBus *b, PCIDevice *d, void *opaque)
@@ -210,7 +211,7 @@ static void unplug_disks(PCIBus *b, PCIDevice *d, void *opaque)
 
     switch (pci_get_word(d->config + PCI_CLASS_DEVICE)) {
     case PCI_CLASS_STORAGE_IDE:
-        pci_xen_ide_unplug(DEVICE(d), aux);
+        pci_xen_ide_unplug(d, aux);
         break;
 
     case PCI_CLASS_STORAGE_SCSI:

From 10be627d2b5ec2d6b3dce045144aa739eef678b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 20 Jun 2023 09:45:34 +0100
Subject: [PATCH 0995/1353] io: remove io watch if TLS channel is closed during
 handshake
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TLS handshake make take some time to complete, during which time an
I/O watch might be registered with the main loop. If the owner of the
I/O channel invokes qio_channel_close() while the handshake is waiting
to continue the I/O watch must be removed. Failing to remove it will
later trigger the completion callback which the owner is not expecting
to receive. In the case of the VNC server, this results in a SEGV as
vnc_disconnect_start() tries to shutdown a client connection that is
already gone / NULL.

CVE-2023-3354
Reported-by: jiangyegen <jiangyegen@huawei.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel-tls.h |  1 +
 io/channel-tls.c         | 18 ++++++++++++------
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h
index 5672479e9e..26c67f17e2 100644
--- a/include/io/channel-tls.h
+++ b/include/io/channel-tls.h
@@ -48,6 +48,7 @@ struct QIOChannelTLS {
     QIOChannel *master;
     QCryptoTLSSession *session;
     QIOChannelShutdown shutdown;
+    guint hs_ioc_tag;
 };
 
 /**
diff --git a/io/channel-tls.c b/io/channel-tls.c
index 9805dd0a3f..847d5297c3 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -198,12 +198,13 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc,
         }
 
         trace_qio_channel_tls_handshake_pending(ioc, status);
-        qio_channel_add_watch_full(ioc->master,
-                                   condition,
-                                   qio_channel_tls_handshake_io,
-                                   data,
-                                   NULL,
-                                   context);
+        ioc->hs_ioc_tag =
+            qio_channel_add_watch_full(ioc->master,
+                                       condition,
+                                       qio_channel_tls_handshake_io,
+                                       data,
+                                       NULL,
+                                       context);
     }
 }
 
@@ -218,6 +219,7 @@ static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc,
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(
         qio_task_get_source(task));
 
+    tioc->hs_ioc_tag = 0;
     g_free(data);
     qio_channel_tls_handshake_task(tioc, task, context);
 
@@ -378,6 +380,10 @@ static int qio_channel_tls_close(QIOChannel *ioc,
 {
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 
+    if (tioc->hs_ioc_tag) {
+        g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove);
+    }
+
     return qio_channel_close(tioc->master, errp);
 }
 

From cf885b19579646d6a085470658bc83432d6786d2 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Fri, 7 Apr 2023 17:12:00 +0200
Subject: [PATCH 0996/1353] hw/xen: fix off-by-one in xen_evtchn_set_gsi()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity points out (CID 1508128) a bounds checking error. We need to check
for gsi >= IOAPIC_NUM_PINS, not just greater-than.

Also fix up an assert() that has the same problem, that Coverity didn't see.

Fixes: 4f81baa33ed6 ("hw/xen: Support GSI mapping to PIRQ")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230801175747.145906-2-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/kvm/xen_evtchn.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index 3d810dbd59..0e9c108614 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -1587,7 +1587,7 @@ static int allocate_pirq(XenEvtchnState *s, int type, int gsi)
  found:
     pirq_inuse_word(s, pirq) |= pirq_inuse_bit(pirq);
     if (gsi >= 0) {
-        assert(gsi <= IOAPIC_NUM_PINS);
+        assert(gsi < IOAPIC_NUM_PINS);
         s->gsi_pirq[gsi] = pirq;
     }
     s->pirq[pirq].gsi = gsi;
@@ -1601,7 +1601,7 @@ bool xen_evtchn_set_gsi(int gsi, int level)
 
     assert(qemu_mutex_iothread_locked());
 
-    if (!s || gsi < 0 || gsi > IOAPIC_NUM_PINS) {
+    if (!s || gsi < 0 || gsi >= IOAPIC_NUM_PINS) {
         return false;
     }
 

From 19c417ec87a446ffd1a13eeec23226fe30f31b7e Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Mon, 22 May 2023 20:52:00 +0200
Subject: [PATCH 0997/1353] i386/xen: consistent locking around Xen singleshot
 timers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverity points out (CID 1507534, 1507968) that we sometimes access
env->xen_singleshot_timer_ns under the protection of
env->xen_timers_lock and sometimes not.

This isn't always an issue. There are two modes for the timers; if the
kernel supports the EVTCHN_SEND capability then it handles all the timer
hypercalls and delivery internally, and all we use the field for is to
get/set the timer as part of the vCPU state via an ioctl(). If the
kernel doesn't have that support, then we do all the emulation within
qemu, and *those* are the code paths where we actually care about the
locking.

But it doesn't hurt to be a little bit more consistent and avoid having
to explain *why* it's OK.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230801175747.145906-3-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/i386/kvm/xen-emu.c | 37 +++++++++++++++++++++++++++----------
 1 file changed, 27 insertions(+), 10 deletions(-)

diff --git a/target/i386/kvm/xen-emu.c b/target/i386/kvm/xen-emu.c
index d7c7eb8d9c..a8146115f0 100644
--- a/target/i386/kvm/xen-emu.c
+++ b/target/i386/kvm/xen-emu.c
@@ -43,6 +43,7 @@
 
 static void xen_vcpu_singleshot_timer_event(void *opaque);
 static void xen_vcpu_periodic_timer_event(void *opaque);
+static int vcpuop_stop_singleshot_timer(CPUState *cs);
 
 #ifdef TARGET_X86_64
 #define hypercall_compat32(longmode) (!(longmode))
@@ -466,6 +467,7 @@ void kvm_xen_inject_vcpu_callback_vector(uint32_t vcpu_id, int type)
     }
 }
 
+/* Must always be called with xen_timers_lock held */
 static int kvm_xen_set_vcpu_timer(CPUState *cs)
 {
     X86CPU *cpu = X86_CPU(cs);
@@ -483,6 +485,7 @@ static int kvm_xen_set_vcpu_timer(CPUState *cs)
 
 static void do_set_vcpu_timer_virq(CPUState *cs, run_on_cpu_data data)
 {
+    QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock);
     kvm_xen_set_vcpu_timer(cs);
 }
 
@@ -545,7 +548,6 @@ static void do_vcpu_soft_reset(CPUState *cs, run_on_cpu_data data)
     env->xen_vcpu_time_info_gpa = INVALID_GPA;
     env->xen_vcpu_runstate_gpa = INVALID_GPA;
     env->xen_vcpu_callback_vector = 0;
-    env->xen_singleshot_timer_ns = 0;
     memset(env->xen_virq, 0, sizeof(env->xen_virq));
 
     set_vcpu_info(cs, INVALID_GPA);
@@ -555,8 +557,13 @@ static void do_vcpu_soft_reset(CPUState *cs, run_on_cpu_data data)
                           INVALID_GPA);
     if (kvm_xen_has_cap(EVTCHN_SEND)) {
         kvm_xen_set_vcpu_callback_vector(cs);
+
+        QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock);
+        env->xen_singleshot_timer_ns = 0;
         kvm_xen_set_vcpu_timer(cs);
-    }
+    } else {
+        vcpuop_stop_singleshot_timer(cs);
+    };
 
 }
 
@@ -1059,6 +1066,10 @@ static int vcpuop_stop_periodic_timer(CPUState *target)
     return 0;
 }
 
+/*
+ * Userspace handling of timer, for older kernels.
+ * Must always be called with xen_timers_lock held.
+ */
 static int do_set_singleshot_timer(CPUState *cs, uint64_t timeout_abs,
                                    bool future, bool linux_wa)
 {
@@ -1086,12 +1097,8 @@ static int do_set_singleshot_timer(CPUState *cs, uint64_t timeout_abs,
         timeout_abs = now + delta;
     }
 
-    qemu_mutex_lock(&env->xen_timers_lock);
-
     timer_mod_ns(env->xen_singleshot_timer, qemu_now + delta);
     env->xen_singleshot_timer_ns = now + delta;
-
-    qemu_mutex_unlock(&env->xen_timers_lock);
     return 0;
 }
 
@@ -1115,6 +1122,7 @@ static int vcpuop_set_singleshot_timer(CPUState *cs, uint64_t arg)
         return -EFAULT;
     }
 
+    QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock);
     return do_set_singleshot_timer(cs, sst.timeout_abs_ns,
                                    !!(sst.flags & VCPU_SSHOTTMR_future),
                                    false);
@@ -1141,6 +1149,7 @@ static bool kvm_xen_hcall_set_timer_op(struct kvm_xen_exit *exit, X86CPU *cpu,
     if (unlikely(timeout == 0)) {
         err = vcpuop_stop_singleshot_timer(CPU(cpu));
     } else {
+        QEMU_LOCK_GUARD(&X86_CPU(cpu)->env.xen_timers_lock);
         err = do_set_singleshot_timer(CPU(cpu), timeout, false, true);
     }
     exit->u.hcall.result = err;
@@ -1826,6 +1835,7 @@ int kvm_put_xen_state(CPUState *cs)
          * If the kernel has EVTCHN_SEND support then it handles timers too,
          * so the timer will be restored by kvm_xen_set_vcpu_timer() below.
          */
+        QEMU_LOCK_GUARD(&env->xen_timers_lock);
         if (env->xen_singleshot_timer_ns) {
             ret = do_set_singleshot_timer(cs, env->xen_singleshot_timer_ns,
                                     false, false);
@@ -1844,10 +1854,8 @@ int kvm_put_xen_state(CPUState *cs)
     }
 
     if (env->xen_virq[VIRQ_TIMER]) {
-        ret = kvm_xen_set_vcpu_timer(cs);
-        if (ret < 0) {
-            return ret;
-        }
+        do_set_vcpu_timer_virq(cs,
+                               RUN_ON_CPU_HOST_INT(env->xen_virq[VIRQ_TIMER]));
     }
     return 0;
 }
@@ -1896,6 +1904,15 @@ int kvm_get_xen_state(CPUState *cs)
         if (ret < 0) {
             return ret;
         }
+
+        /*
+         * This locking is fairly pointless, and is here to appease Coverity.
+         * There is an unavoidable race condition if a different vCPU sets a
+         * timer for this vCPU after the value has been read out. But that's
+         * OK in practice because *all* the vCPUs need to be stopped before
+         * we set about migrating their state.
+         */
+        QEMU_LOCK_GUARD(&X86_CPU(cs)->env.xen_timers_lock);
         env->xen_singleshot_timer_ns = va.u.timer.expires_ns;
     }
 

From 75a87af9b228ca7d14902a9390fe5e83c4898eb0 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw@amazon.co.uk>
Date: Tue, 25 Jul 2023 12:05:00 +0200
Subject: [PATCH 0998/1353] hw/xen: prevent guest from binding loopback event
 channel to itself
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fuzzing showed that a guest could bind an interdomain port to itself, by
guessing the next port to be allocated and putting that as the 'remote'
port number. By chance, that works because the newly-allocated port has
type EVTCHNSTAT_unbound. It shouldn't.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230801175747.145906-4-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/kvm/xen_evtchn.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index 0e9c108614..a731738411 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -1408,8 +1408,15 @@ int xen_evtchn_bind_interdomain_op(struct evtchn_bind_interdomain *interdomain)
         XenEvtchnPort *rp = &s->port_table[interdomain->remote_port];
         XenEvtchnPort *lp = &s->port_table[interdomain->local_port];
 
-        if (rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) {
-            /* It's a match! */
+        /*
+         * The 'remote' port for loopback must be an unbound port allocated for
+         * communication with the local domain (as indicated by rp->type_val
+         * being zero, not PORT_INFO_TYPEVAL_REMOTE_QEMU), and must *not* be
+         * the port that was just allocated for the local end.
+         */
+        if (interdomain->local_port != interdomain->remote_port &&
+            rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) {
+
             rp->type = EVTCHNSTAT_interdomain;
             rp->type_val = interdomain->local_port;
 

From 866b24e4c3d27b5b8bedd741bb92b62b9fa58044 Mon Sep 17 00:00:00 2001
From: Marc-Andre Lureau <marcandre.lureau@redhat.com>
Date: Tue, 25 Jul 2023 15:25:40 +0400
Subject: [PATCH 0999/1353] ui/dbus: fix win32 compilation when !opengl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1782

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230725112540.53284-1-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 ui/dbus-listener.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 68ff343799..02fc6ae239 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -338,6 +338,7 @@ static bool dbus_scanout_map(DBusDisplayListener *ddl)
     return true;
 }
 
+#ifdef CONFIG_OPENGL
 static bool
 dbus_scanout_share_d3d_texture(
     DBusDisplayListener *ddl,
@@ -399,7 +400,8 @@ dbus_scanout_share_d3d_texture(
 
     return true;
 }
-#endif
+#endif /* CONFIG_OPENGL */
+#endif /* WIN32 */
 
 #ifdef CONFIG_OPENGL
 static void dbus_scanout_texture(DisplayChangeListener *dcl,

From 7b4a3f814560341b1a18b3954b52e3318c2725d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 26 Jul 2023 19:12:21 +0400
Subject: [PATCH 1000/1353] ui/dbus: fix clang compilation issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

../ui/dbus-listener.c:236:9: error: expected expression
        Error *err = NULL;

See:
https://gitlab.com/qemu-project/qemu/-/issues/1782#note_1488517427

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230726151221.515761-1-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 ui/dbus-listener.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 02fc6ae239..30917271ab 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -232,7 +232,7 @@ static void dbus_call_update_gl(DisplayChangeListener *dcl,
         egl_fb_read_rect(ddl->ds, &ddl->fb, x, y, w, h);
         dbus_gfx_update(dcl, x, y, w, h);
         break;
-    case SHARE_KIND_D3DTEX:
+    case SHARE_KIND_D3DTEX: {
         Error *err = NULL;
         assert(ddl->d3d_texture);
 
@@ -249,6 +249,7 @@ static void dbus_call_update_gl(DisplayChangeListener *dcl,
             dbus_update_gl_cb,
             g_object_ref(ddl));
         break;
+    }
     default:
         g_warn_if_reached();
     }

From 313e162951682906430a6efeffdd1f2d67fd5bb4 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Sun, 30 Jul 2023 20:03:29 +0200
Subject: [PATCH 1001/1353] misc: Fix some typos in documentation and comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230730180329.851576-1-sw@weilnetz.de>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 docs/about/deprecated.rst    | 2 +-
 docs/devel/qom.rst           | 2 +-
 docs/system/devices/nvme.rst | 2 +-
 hw/core/loader.c             | 4 ++--
 include/exec/memory.h        | 2 +-
 ui/vnc-enc-tight.c           | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 1c35f55666..92a2bafd2b 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -369,7 +369,7 @@ mapping permissions et al by using its 'mapped' security model option.
 Nowadays it would make sense to reimplement the ``proxy`` backend by using
 QEMU's ``vhost`` feature, which would eliminate the high latency costs under
 which the 9p ``proxy`` backend currently suffers. However as of to date nobody
-has indicated plans for such kind of reimplemention unfortunately.
+has indicated plans for such kind of reimplementation unfortunately.
 
 
 Block device options
diff --git a/docs/devel/qom.rst b/docs/devel/qom.rst
index 0b506426d7..9918fac7f2 100644
--- a/docs/devel/qom.rst
+++ b/docs/devel/qom.rst
@@ -30,7 +30,7 @@ user configuration.
 Creating a QOM class
 ====================
 
-A simple minimal device implementation may look something like bellow:
+A simple minimal device implementation may look something like below:
 
 .. code-block:: c
    :caption: Creating a minimal type
diff --git a/docs/system/devices/nvme.rst b/docs/system/devices/nvme.rst
index a8bb8d729c..2a3af268f7 100644
--- a/docs/system/devices/nvme.rst
+++ b/docs/system/devices/nvme.rst
@@ -232,7 +232,7 @@ parameters:
   Set the number of Reclaim Groups.
 
 ``fdp.nruh`` (default: ``0``)
-  Set the number of Reclaim Unit Handles. This is a mandatory paramater and
+  Set the number of Reclaim Unit Handles. This is a mandatory parameter and
   must be non-zero.
 
 ``fdp.runs`` (default: ``96M``)
diff --git a/hw/core/loader.c b/hw/core/loader.c
index 8b7fd9e9e5..4dd5a71fb7 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -863,7 +863,7 @@ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
 
 /*
  * The Linux header magic number for a EFI PE/COFF
- * image targetting an unspecified architecture.
+ * image targeting an unspecified architecture.
  */
 #define EFI_PE_LINUX_MAGIC        "\xcd\x23\x82\x81"
 
@@ -1492,7 +1492,7 @@ RomGap rom_find_largest_gap_between(hwaddr base, size_t size)
         if (rom->mr || rom->fw_file) {
             continue;
         }
-        /* ignore anything finishing bellow base */
+        /* ignore anything finishing below base */
         if (rom->addr + rom->romsize <= base) {
             continue;
         }
diff --git a/include/exec/memory.h b/include/exec/memory.h
index 7f5c11a0cc..68284428f8 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -942,7 +942,7 @@ struct MemoryListener {
      *
      * @listener: The #MemoryListener.
      * @last_stage: The last stage to synchronize the log during migration.
-     * The caller should gurantee that the synchronization with true for
+     * The caller should guarantee that the synchronization with true for
      * @last_stage is triggered for once after all VCPUs have been stopped.
      */
     void (*log_sync_global)(MemoryListener *listener, bool last_stage);
diff --git a/ui/vnc-enc-tight.c b/ui/vnc-enc-tight.c
index 09200d71b8..ee853dcfcb 100644
--- a/ui/vnc-enc-tight.c
+++ b/ui/vnc-enc-tight.c
@@ -77,7 +77,7 @@ static int tight_send_framebuffer_update(VncState *vs, int x, int y,
 
 #ifdef CONFIG_VNC_JPEG
 static const struct {
-    double jpeg_freq_min;       /* Don't send JPEG if the freq is bellow */
+    double jpeg_freq_min;       /* Don't send JPEG if the freq is below */
     double jpeg_freq_threshold; /* Always send JPEG if the freq is above */
     int jpeg_idx;               /* Allow indexed JPEG */
     int jpeg_full;              /* Allow full color JPEG */

From 7a06a8fec9df3b6a0f72e7b37dff0969430aab96 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Mon, 31 Jul 2023 18:10:39 +0900
Subject: [PATCH 1002/1353] tests/migration: Add -fno-stack-protector
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A build of GCC 13.2 will have stack protector enabled by default if it
was configured with --enable-default-ssp option. For such a compiler,
it is necessary to explicitly disable stack protector when linking
without standard libraries.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230731091042.139159-2-akihiko.odaki@daynix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 tests/migration/s390x/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/migration/s390x/Makefile b/tests/migration/s390x/Makefile
index 6393c3e5b9..6671de2efc 100644
--- a/tests/migration/s390x/Makefile
+++ b/tests/migration/s390x/Makefile
@@ -6,8 +6,8 @@ all: a-b-bios.h
 fwdir=../../../pc-bios/s390-ccw
 
 CFLAGS+=-ffreestanding -fno-delete-null-pointer-checks -fPIE -Os \
-	-msoft-float -march=z900 -fno-asynchronous-unwind-tables -Wl,-pie \
-	-Wl,--build-id=none -nostdlib
+	-msoft-float -march=z900 -fno-asynchronous-unwind-tables \
+	-fno-stack-protector -Wl,-pie -Wl,--build-id=none -nostdlib
 
 a-b-bios.h: s390x.elf
 	echo "$$__note" > header.tmp

From c11d5bdae79a8edaf00dfcb2e49c064a50c67671 Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@keithp.com>
Date: Tue, 1 Aug 2023 08:22:45 -0700
Subject: [PATCH 1003/1353] target/nios2: Pass semihosting arg to exit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of using R_ARG0 (the semihost function number), use R_ARG1
(the provided exit status).

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230801152245.332749-1-keithp@keithp.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/nios2/nios2-semi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/nios2/nios2-semi.c b/target/nios2/nios2-semi.c
index 3738774976..f3b7aee4f1 100644
--- a/target/nios2/nios2-semi.c
+++ b/target/nios2/nios2-semi.c
@@ -133,8 +133,8 @@ void do_nios2_semihosting(CPUNios2State *env)
     args = env->regs[R_ARG1];
     switch (nr) {
     case HOSTED_EXIT:
-        gdb_exit(env->regs[R_ARG0]);
-        exit(env->regs[R_ARG0]);
+        gdb_exit(env->regs[R_ARG1]);
+        exit(env->regs[R_ARG1]);
 
     case HOSTED_OPEN:
         GET_ARG(0);

From 71e2dd6aa1bdbac19c661638a4ae91816002ac9e Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@keithp.com>
Date: Mon, 31 Jul 2023 16:52:45 -0700
Subject: [PATCH 1004/1353] target/nios2: Fix semihost lseek offset computation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The arguments for deposit64 are (value, start, length, fieldval); this
appears to have thought they were (value, fieldval, start,
length). Reorder the parameters to match the actual function.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: d1e23cbaa403b2d ("target/nios2: Use semihosting/syscalls.h")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230731235245.295513-1-keithp@keithp.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/nios2/nios2-semi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/nios2/nios2-semi.c b/target/nios2/nios2-semi.c
index f3b7aee4f1..9d0241c758 100644
--- a/target/nios2/nios2-semi.c
+++ b/target/nios2/nios2-semi.c
@@ -169,7 +169,7 @@ void do_nios2_semihosting(CPUNios2State *env)
         GET_ARG64(2);
         GET_ARG64(3);
         semihost_sys_lseek(cs, nios2_semi_u64_cb, arg0,
-                           deposit64(arg2, arg1, 32, 32), arg3);
+                           deposit64(arg2, 32, 32, arg1), arg3);
         break;
 
     case HOSTED_RENAME:

From 8caaae7319a5f7ca449900c0e6bfcaed78fa3ae2 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 1 Aug 2023 16:45:19 +0100
Subject: [PATCH 1005/1353] target/m68k: Fix semihost lseek offset computation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The arguments for deposit64 are (value, start, length, fieldval); this
appears to have thought they were (value, fieldval, start,
length). Reorder the parameters to match the actual function.

Cc: qemu-stable@nongnu.org
Fixes: 950272506d ("target/m68k: Use semihosting/syscalls.h")
Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230801154519.3505531-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/m68k/m68k-semi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/m68k/m68k-semi.c b/target/m68k/m68k-semi.c
index 88ad9ba814..239f6e44e9 100644
--- a/target/m68k/m68k-semi.c
+++ b/target/m68k/m68k-semi.c
@@ -166,7 +166,7 @@ void do_m68k_semihosting(CPUM68KState *env, int nr)
         GET_ARG64(2);
         GET_ARG64(3);
         semihost_sys_lseek(cs, m68k_semi_u64_cb, arg0,
-                           deposit64(arg2, arg1, 32, 32), arg3);
+                           deposit64(arg2, 32, 32, arg1), arg3);
         break;
 
     case HOSTED_RENAME:

From 8abc81150f2de51eabd75ef13117f6f1561a18a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Fri, 28 Jul 2023 17:38:07 +0800
Subject: [PATCH 1006/1353] qapi: Reformat the dirty-limit migration doc
 comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reformat the dirty-limit migration doc comments to conform
to current conventions as commit a937b6aa739 (qapi: Reformat
doc comments to conform to current conventions).

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Message-ID: <169073570563.19893.2928364761104733482-1@git.sr.ht>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Whitespace tidied up]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/migration.json | 67 ++++++++++++++++++++++-----------------------
 1 file changed, 33 insertions(+), 34 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 6b49593d2f..dffa60fd91 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -258,17 +258,17 @@
 #     blocked.  Present and non-empty when migration is blocked.
 #     (since 6.0)
 #
-# @dirty-limit-throttle-time-per-round: Maximum throttle time (in microseconds) of virtual
-#                                       CPUs each dirty ring full round, which shows how
-#                                       MigrationCapability dirty-limit affects the guest
-#                                       during live migration. (since 8.1)
+# @dirty-limit-throttle-time-per-round: Maximum throttle time
+#     (in microseconds) of virtual CPUs each dirty ring full round,
+#     which shows how MigrationCapability dirty-limit affects the
+#     guest during live migration.  (Since 8.1)
 #
-# @dirty-limit-ring-full-time: Estimated average dirty ring full time (in microseconds)
-#                              each dirty ring full round, note that the value equals
-#                              dirty ring memory size divided by average dirty page rate
-#                              of virtual CPU, which can be used to observe the average
-#                              memory load of virtual CPU indirectly. Note that zero
-#                              means guest doesn't dirty memory (since 8.1)
+# @dirty-limit-ring-full-time: Estimated average dirty ring full time
+#     (in microseconds) for each dirty ring full round.  The value
+#     equals the dirty ring memory size divided by the average dirty
+#     page rate of the virtual CPU, which can be used to observe the
+#     average memory load of the virtual CPU indirectly.  Note that
+#     zero means guest doesn't dirty memory.  (Since 8.1)
 #
 # Since: 0.14
 ##
@@ -519,15 +519,14 @@
 #     are present.  'return-path' capability must be enabled to use
 #     it.  (since 8.1)
 #
-# @dirty-limit: If enabled, migration will use the dirty-limit algo to
-#               throttle down guest instead of auto-converge algo.
-#               Throttle algo only works when vCPU's dirtyrate greater
-#               than 'vcpu-dirty-limit', read processes in guest os
-#               aren't penalized any more, so this algo can improve
-#               performance of vCPU during live migration. This is an
-#               optional performance feature and should not affect the
-#               correctness of the existing auto-converge algo.
-#               (since 8.1)
+# @dirty-limit: If enabled, migration will use the dirty-limit
+#     algorithim to throttle down guest instead of auto-converge
+#     algorithim. Throttle algorithim only works when vCPU's dirtyrate
+#     greater than 'vcpu-dirty-limit', read processes in guest os
+#     aren't penalized any more, so this algorithim can improve
+#     performance of vCPU during live migration. This is an optional
+#     performance feature and should not affect the correctness of the
+#     existing auto-converge algorithim.  (Since 8.1)
 #
 # Features:
 #
@@ -822,17 +821,17 @@
 #     Nodes are mapped to their block device name if there is one, and
 #     to their node name otherwise.  (Since 5.2)
 #
-# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty limit during
-#                             live migration. Should be in the range 1 to 1000ms,
-#                             defaults to 1000ms. (Since 8.1)
+# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty
+#     limit during live migration.  Should be in the range 1 to 1000ms.
+#     Defaults to 1000ms.  (Since 8.1)
 #
 # @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
-#                    Defaults to 1. (Since 8.1)
+#     Defaults to 1.  (Since 8.1)
 #
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
-#            are experimental.
+#     are experimental.
 #
 # Since: 2.4
 ##
@@ -988,17 +987,17 @@
 #     Nodes are mapped to their block device name if there is one, and
 #     to their node name otherwise.  (Since 5.2)
 #
-# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty limit during
-#                             live migration. Should be in the range 1 to 1000ms,
-#                             defaults to 1000ms. (Since 8.1)
+# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty
+#     limit during live migration.  Should be in the range 1 to 1000ms.
+#     Defaults to 1000ms.  (Since 8.1)
 #
 # @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
-#                    Defaults to 1. (Since 8.1)
+#     Defaults to 1.  (Since 8.1)
 #
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
-#            are experimental.
+#     are experimental.
 #
 # TODO: either fuse back into MigrationParameters, or make
 #     MigrationParameters members mandatory
@@ -1191,17 +1190,17 @@
 #     Nodes are mapped to their block device name if there is one, and
 #     to their node name otherwise.  (Since 5.2)
 #
-# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty limit during
-#                             live migration. Should be in the range 1 to 1000ms,
-#                             defaults to 1000ms. (Since 8.1)
+# @x-vcpu-dirty-limit-period: Periodic time (in milliseconds) of dirty
+#     limit during live migration.  Should be in the range 1 to 1000ms.
+#     Defaults to 1000ms.  (Since 8.1)
 #
 # @vcpu-dirty-limit: Dirtyrate limit (MB/s) during live migration.
-#                    Defaults to 1. (Since 8.1)
+#     Defaults to 1.  (Since 8.1)
 #
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and @x-vcpu-dirty-limit-period
-#            are experimental.
+#     are experimental.
 #
 # Since: 2.4
 ##

From ef965377325e186ce1f73e5f40d07d77e2cc9410 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Fri, 28 Jul 2023 23:10:40 +0800
Subject: [PATCH 1007/1353] qapi: Craft the dirty-limit capability comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Message-ID: <169073570563.19893.2928364761104733482-2@git.sr.ht>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 qapi/migration.json | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index dffa60fd91..8843e74b59 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -519,14 +519,11 @@
 #     are present.  'return-path' capability must be enabled to use
 #     it.  (since 8.1)
 #
-# @dirty-limit: If enabled, migration will use the dirty-limit
-#     algorithim to throttle down guest instead of auto-converge
-#     algorithim. Throttle algorithim only works when vCPU's dirtyrate
-#     greater than 'vcpu-dirty-limit', read processes in guest os
-#     aren't penalized any more, so this algorithim can improve
-#     performance of vCPU during live migration. This is an optional
-#     performance feature and should not affect the correctness of the
-#     existing auto-converge algorithim.  (Since 8.1)
+# @dirty-limit: If enabled, migration will throttle vCPUs as needed to
+#     keep their dirty page rate within @vcpu-dirty-limit.  This can
+#     improve responsiveness of large guests during live migration,
+#     and can result in more stable read performance.  Requires KVM
+#     with accelerator property "dirty-ring-size" set.  (Since 8.1)
 #
 # Features:
 #

From 2b3edd95186dc505f21d823119cdd0dfb23b3ee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hyman=20Huang=28=E9=BB=84=E5=8B=87=29?=
 <yong.huang@smartx.com>
Date: Thu, 27 Jul 2023 02:10:09 +0800
Subject: [PATCH 1008/1353] MAINTAINERS: Add section "Migration dirty limit and
 dirty page rate"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I've built interests in dirty limit and dirty page rate
features and also have been working on projects related
to this subsystem.

Add a section to the MAINTAINERS file for migration
dirty limit and dirty page rate.

Add myself as a maintainer for this subsystem so that I
can help to improve the dirty limit algorithm and review
the patches about dirty page rate.

Signed-off-by: Hyman Huang(黄勇) <yong.huang@smartx.com>
Acked-by: Peter Xu <peterx@redhat.com>
Message-ID: <169073570563.19893.2928364761104733482-3@git.sr.ht>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 MAINTAINERS | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 12e59b6b27..6111b6b4d9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3209,6 +3209,15 @@ F: qapi/migration.json
 F: tests/migration/
 F: util/userfaultfd.c
 
+Migration dirty limit and dirty page rate
+M: Hyman Huang <yong.huang@smartx.com>
+S: Maintained
+F: softmmu/dirtylimit.c
+F: include/sysemu/dirtylimit.h
+F: migration/dirtyrate.c
+F: migration/dirtyrate.h
+F: include/sysemu/dirtyrate.h
+
 D-Bus
 M: Marc-André Lureau <marcandre.lureau@redhat.com>
 S: Maintained

From 9ba37026fcf6b7f3f096c0cca3e1e7307802486b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 08:22:45 -0700
Subject: [PATCH 1009/1353] Update version for v8.1.0-rc2 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index cbe9ed90f1..66ab90161b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.91
+8.0.92

From c5b5288c3da9c7728b2d10b577bc31beb231fb8a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 28 Jul 2023 16:27:45 +0200
Subject: [PATCH 1010/1353] util/oslib-win32: Fix compiling with Clang from
 MSYS2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clang complains:

../util/oslib-win32.c:483:56: error: omitting the parameter name in a
 function definition is a C2x extension [-Werror,-Wc2x-extensions]
win32_close_exception_handler(struct _EXCEPTION_RECORD*,
                                                       ^
Fix it by adding parameter names.

Message-Id: <20230728142748.305341-4-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 util/oslib-win32.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 429542face..19a0ea7fbe 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -480,8 +480,9 @@ int qemu_bind_wrap(int sockfd, const struct sockaddr *addr,
 }
 
 EXCEPTION_DISPOSITION
-win32_close_exception_handler(struct _EXCEPTION_RECORD*,
-                              void*, struct _CONTEXT*, void*)
+win32_close_exception_handler(struct _EXCEPTION_RECORD *exception_record,
+                              void *registration, struct _CONTEXT *context,
+                              void *dispatcher)
 {
     return EXCEPTION_EXECUTE_HANDLER;
 }

From 11961d08fcbddf37d2393c412271d714900c02cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:03:56 +0100
Subject: [PATCH 1011/1353] gitlab: remove duplication between msys jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although they share a common parent, the two msys jobs still have
massive duplication in their script definitions that can easily be
collapsed.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230801130403.164060-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 142 +++++++++++++++------------------------
 1 file changed, 54 insertions(+), 88 deletions(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index f889a468b5..f086540e40 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -35,97 +35,63 @@
   - .\msys64\usr\bin\bash -lc 'pacman --noconfirm -Syuu'  # Core update
   - .\msys64\usr\bin\bash -lc 'pacman --noconfirm -Syuu'  # Normal update
   - taskkill /F /FI "MODULES eq msys-2.0.dll"
+  script:
+  - .\msys64\usr\bin\bash -lc "pacman -Sy --noconfirm --needed
+      bison diffutils flex
+      git grep make sed
+      $MINGW_TARGET-capstone
+      $MINGW_TARGET-curl
+      $MINGW_TARGET-cyrus-sasl
+      $MINGW_TARGET-dtc
+      $MINGW_TARGET-gcc
+      $MINGW_TARGET-glib2
+      $MINGW_TARGET-gnutls
+      $MINGW_TARGET-gtk3
+      $MINGW_TARGET-libgcrypt
+      $MINGW_TARGET-libjpeg-turbo
+      $MINGW_TARGET-libnfs
+      $MINGW_TARGET-libpng
+      $MINGW_TARGET-libssh
+      $MINGW_TARGET-libtasn1
+      $MINGW_TARGET-libusb
+      $MINGW_TARGET-lzo2
+      $MINGW_TARGET-nettle
+      $MINGW_TARGET-ninja
+      $MINGW_TARGET-pixman
+      $MINGW_TARGET-pkgconf
+      $MINGW_TARGET-python
+      $MINGW_TARGET-SDL2
+      $MINGW_TARGET-SDL2_image
+      $MINGW_TARGET-snappy
+      $MINGW_TARGET-spice
+      $MINGW_TARGET-usbredir
+      $MINGW_TARGET-zstd "
+  - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
+  - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
+  - mkdir build
+  - cd build
+  - ..\msys64\usr\bin\bash -lc "../configure --enable-fdt=system $CONFIGURE_ARGS"
+  - ..\msys64\usr\bin\bash -lc "make"
+  - ..\msys64\usr\bin\bash -lc "make check MTESTARGS='$TEST_ARGS' || { cat meson-logs/testlog.txt; exit 1; } ;"
 
 msys2-64bit:
   extends: .shared_msys2_builder
-  script:
-  - .\msys64\usr\bin\bash -lc "pacman -Sy --noconfirm --needed
-      bison diffutils flex
-      git grep make sed
-      mingw-w64-x86_64-capstone
-      mingw-w64-x86_64-curl
-      mingw-w64-x86_64-cyrus-sasl
-      mingw-w64-x86_64-dtc
-      mingw-w64-x86_64-gcc
-      mingw-w64-x86_64-glib2
-      mingw-w64-x86_64-gnutls
-      mingw-w64-x86_64-gtk3
-      mingw-w64-x86_64-libgcrypt
-      mingw-w64-x86_64-libjpeg-turbo
-      mingw-w64-x86_64-libnfs
-      mingw-w64-x86_64-libpng
-      mingw-w64-x86_64-libssh
-      mingw-w64-x86_64-libtasn1
-      mingw-w64-x86_64-libusb
-      mingw-w64-x86_64-lzo2
-      mingw-w64-x86_64-nettle
-      mingw-w64-x86_64-ninja
-      mingw-w64-x86_64-pixman
-      mingw-w64-x86_64-pkgconf
-      mingw-w64-x86_64-python
-      mingw-w64-x86_64-SDL2
-      mingw-w64-x86_64-SDL2_image
-      mingw-w64-x86_64-snappy
-      mingw-w64-x86_64-spice
-      mingw-w64-x86_64-usbredir
-      mingw-w64-x86_64-zstd "
-  - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
-  - $env:MSYSTEM = 'MINGW64'     # Start a 64-bit MinGW environment
-  - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
-  - mkdir build
-  - cd build
-  # Note: do not remove "--without-default-devices"!
-  # commit 9f8e6cad65a6 ("gitlab-ci: Speed up the msys2-64bit job by using --without-default-devices"
-  # changed to compile QEMU with the --without-default-devices switch
-  # for the msys2 64-bit job, due to the build could not complete within
-  # the project timeout.
-  - ..\msys64\usr\bin\bash -lc '../configure --target-list=x86_64-softmmu
-      --without-default-devices --enable-fdt=system'
-  - ..\msys64\usr\bin\bash -lc 'make'
-  # qTests don't run successfully with "--without-default-devices",
-  # so let's exclude the qtests from CI for now.
-  - ..\msys64\usr\bin\bash -lc 'make check MTESTARGS=\"--no-suite qtest\" || { cat meson-logs/testlog.txt; exit 1; } ;'
+  variables:
+    MINGW_TARGET: mingw-w64-x86_64
+    MSYSTEM: MINGW64
+    # do not remove "--without-default-devices"!
+    # commit 9f8e6cad65a6 ("gitlab-ci: Speed up the msys2-64bit job by using --without-default-devices"
+    # changed to compile QEMU with the --without-default-devices switch
+    # for the msys2 64-bit job, due to the build could not complete within
+    CONFIGURE_ARGS:  --target-list=x86_64-softmmu --without-default-devices
+    # qTests don't run successfully with "--without-default-devices",
+    # so let's exclude the qtests from CI for now.
+    TEST_ARGS: --no-suite qtest
 
 msys2-32bit:
   extends: .shared_msys2_builder
-  script:
-  - .\msys64\usr\bin\bash -lc "pacman -Sy --noconfirm --needed
-      bison diffutils flex
-      git grep make sed
-      mingw-w64-i686-capstone
-      mingw-w64-i686-curl
-      mingw-w64-i686-cyrus-sasl
-      mingw-w64-i686-dtc
-      mingw-w64-i686-gcc
-      mingw-w64-i686-glib2
-      mingw-w64-i686-gnutls
-      mingw-w64-i686-gtk3
-      mingw-w64-i686-libgcrypt
-      mingw-w64-i686-libjpeg-turbo
-      mingw-w64-i686-libnfs
-      mingw-w64-i686-libpng
-      mingw-w64-i686-libssh
-      mingw-w64-i686-libtasn1
-      mingw-w64-i686-libusb
-      mingw-w64-i686-lzo2
-      mingw-w64-i686-nettle
-      mingw-w64-i686-ninja
-      mingw-w64-i686-pixman
-      mingw-w64-i686-pkgconf
-      mingw-w64-i686-python
-      mingw-w64-i686-SDL2
-      mingw-w64-i686-SDL2_image
-      mingw-w64-i686-snappy
-      mingw-w64-i686-spice
-      mingw-w64-i686-usbredir
-      mingw-w64-i686-zstd "
-  - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
-  - $env:MSYSTEM = 'MINGW32'     # Start a 32-bit MinGW environment
-  - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
-  - mkdir build
-  - cd build
-  - ..\msys64\usr\bin\bash -lc '../configure --target-list=ppc64-softmmu
-                                --enable-fdt=system'
-  - ..\msys64\usr\bin\bash -lc 'make'
-  - ..\msys64\usr\bin\bash -lc 'make check MTESTARGS=\"--no-suite qtest\" ||
-                                { cat meson-logs/testlog.txt; exit 1; }'
+  variables:
+    MINGW_TARGET: mingw-w64-i686
+    MSYSTEM: MINGW32
+    CONFIGURE_ARGS:  --target-list=ppc64-softmmu
+    TEST_ARGS: --no-suite qtest

From b64052cdada197a06fd7ffe1ba239d4de8b89d45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:03:57 +0100
Subject: [PATCH 1012/1353] gitlab: print timestamps during windows msys jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is hard to get visibility into where time is consumed in our Windows
msys jobs. Adding a few log console messages with the timestamp will
aid in our debugging.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230801130403.164060-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index f086540e40..831b080d12 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -19,6 +19,7 @@
     reports:
       junit: "build/meson-logs/testlog.junit.xml"
   before_script:
+  - Write-Output "Acquiring msys2.exe installer at $(Get-Date -Format u)"
   - If ( !(Test-Path -Path msys64\var\cache ) ) {
       mkdir msys64\var\cache
     }
@@ -27,6 +28,7 @@
       "https://github.com/msys2/msys2-installer/releases/download/2022-06-03/msys2-base-x86_64-20220603.sfx.exe"
       -outfile "msys64\var\cache\msys2.exe"
     }
+  - Write-Output "Invoking msys2.exe installer at $(Get-Date -Format u)"
   - msys64\var\cache\msys2.exe -y
   - ((Get-Content -path .\msys64\etc\\post-install\\07-pacman-key.post -Raw)
       -replace '--refresh-keys', '--version') |
@@ -36,6 +38,7 @@
   - .\msys64\usr\bin\bash -lc 'pacman --noconfirm -Syuu'  # Normal update
   - taskkill /F /FI "MODULES eq msys-2.0.dll"
   script:
+  - Write-Output "Installing mingw packages at $(Get-Date -Format u)"
   - .\msys64\usr\bin\bash -lc "pacman -Sy --noconfirm --needed
       bison diffutils flex
       git grep make sed
@@ -66,6 +69,7 @@
       $MINGW_TARGET-spice
       $MINGW_TARGET-usbredir
       $MINGW_TARGET-zstd "
+  - Write-Output "Running build at $(Get-Date -Format u)"
   - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
   - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
   - mkdir build
@@ -73,6 +77,7 @@
   - ..\msys64\usr\bin\bash -lc "../configure --enable-fdt=system $CONFIGURE_ARGS"
   - ..\msys64\usr\bin\bash -lc "make"
   - ..\msys64\usr\bin\bash -lc "make check MTESTARGS='$TEST_ARGS' || { cat meson-logs/testlog.txt; exit 1; } ;"
+  - Write-Output "Finished build at $(Get-Date -Format u)"
 
 msys2-64bit:
   extends: .shared_msys2_builder

From 46aedd34b459a9e0ff7f61d554368b27910dd56d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:03:58 +0100
Subject: [PATCH 1013/1353] gitlab: always use updated msys installer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We current reference an msys installer binary from mid-2022, which means
after installation, it immediately has to re-download a bunch of newer
content. This wastes precious CI time.

The msys project publishes an installer binary with a fixed URL that
always references the latest content. We cache the downloads in gitlab
though and so once downloaded we would never re-fetch the installer
leading back to the same problem.

To deal with this we also fetch the pgp signature for the installer
on every run, and compare that to the previously cached signature. If
the signature changes, we re-download the full installer.

This ensures we always have the latest installer for msys, while also
maximising use of the gitlab cache.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230801130403.164060-4-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 831b080d12..0bc04ad068 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -23,10 +23,34 @@
   - If ( !(Test-Path -Path msys64\var\cache ) ) {
       mkdir msys64\var\cache
     }
-  - If ( !(Test-Path -Path msys64\var\cache\msys2.exe ) ) {
+  - Invoke-WebRequest
+    "https://repo.msys2.org/distrib/msys2-x86_64-latest.sfx.exe.sig"
+    -outfile "msys2.exe.sig"
+  - if ( Test-Path -Path msys64\var\cache\msys2.exe.sig ) {
+      Write-Output "Cached installer sig" ;
+      if ( ((Get-FileHash msys2.exe.sig).Hash -ne (Get-FileHash msys64\var\cache\msys2.exe.sig).Hash) ) {
+        Write-Output "Mis-matched installer sig, new installer download required" ;
+        Remove-Item -Path msys64\var\cache\msys2.exe.sig ;
+        if ( Test-Path -Path msys64\var\cache\msys2.exe ) {
+          Remove-Item -Path msys64\var\cache\msys2.exe
+        }
+      } else {
+        Write-Output "Matched installer sig, cached installer still valid"
+      }
+    } else {
+      Write-Output "No cached installer sig, new installer download required" ;
+      if ( Test-Path -Path msys64\var\cache\msys2.exe ) {
+        Remove-Item -Path msys64\var\cache\msys2.exe
+      }
+    }
+  - if ( !(Test-Path -Path msys64\var\cache\msys2.exe ) ) {
+      Write-Output "Fetching latest installer" ;
       Invoke-WebRequest
-      "https://github.com/msys2/msys2-installer/releases/download/2022-06-03/msys2-base-x86_64-20220603.sfx.exe"
-      -outfile "msys64\var\cache\msys2.exe"
+      "https://repo.msys2.org/distrib/msys2-x86_64-latest.sfx.exe"
+      -outfile "msys64\var\cache\msys2.exe" ;
+      Copy-Item -Path msys2.exe.sig -Destination msys64\var\cache\msys2.exe.sig
+    } else {
+      Write-Output "Using cached installer"
     }
   - Write-Output "Invoking msys2.exe installer at $(Get-Date -Format u)"
   - msys64\var\cache\msys2.exe -y

From 5ef56e3b18b185df12fea0901efa0843058572d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:03:59 +0100
Subject: [PATCH 1014/1353] gitlab: drop $CI_PROJECT_DIR from cache path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gitlab cache is limited to only handle content within the
$CI_PROJECT_DIR hierarchy, and as such relative paths are always
implicitly relative to $CI_PROJECT_DIR.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230801130403.164060-5-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 0bc04ad068..6454880cb7 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -7,7 +7,7 @@
   cache:
     key: "${CI_JOB_NAME}-cache"
     paths:
-      - ${CI_PROJECT_DIR}/msys64/var/cache
+      - msys64/var/cache
   needs: []
   stage: build
   timeout: 80m

From ef4fe31f33648ece16bf86b10262c7424c8470f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:04:00 +0100
Subject: [PATCH 1015/1353] gitlab: always populate cache for windows msys jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cache is used to hold the msys installer. Even if the build phase
fails, we should still populate the cache as the installer will be
valid for next time.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230801130403.164060-6-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 6454880cb7..34109a80f2 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -8,6 +8,7 @@
     key: "${CI_JOB_NAME}-cache"
     paths:
       - msys64/var/cache
+    when: always
   needs: []
   stage: build
   timeout: 80m

From ff136d2a99253483f263371bb7b479d2278d9401 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:04:01 +0100
Subject: [PATCH 1016/1353] configure: support passthrough of -Dxxx args to
 meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This can be useful for setting some meson global options, such as the
optimization level or debug state.xs

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230801130403.164060-7-berrange@redhat.com>
[thuth: Move the help text into the section with the other --... options]
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 configure | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/configure b/configure
index 26ec5e4f54..afb25fd558 100755
--- a/configure
+++ b/configure
@@ -757,6 +757,9 @@ for opt do
   # everything else has the same name in configure and meson
   --*) meson_option_parse "$opt" "$optarg"
   ;;
+  # Pass through -Dxxxx options to meson
+  -D*) meson_options="$meson_options $opt"
+  ;;
   esac
 done
 
@@ -846,6 +849,7 @@ $(echo Available targets: $default_target_list | \
   --target-list-exclude=LIST exclude a set of targets from the default target-list
 
 Advanced options (experts only):
+  -Dmesonoptname=val       passthrough option to meson unmodified
   --cross-prefix=PREFIX    use PREFIX for compile tools, PREFIX can be blank [$cross_prefix]
   --cc=CC                  use C compiler CC [$cc]
   --host-cc=CC             use C compiler CC [$host_cc] for code run at

From 63f5365cd4a86b3e1311093c01e9ab01b37acee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:04:02 +0100
Subject: [PATCH 1017/1353] gitlab: disable optimization and debug symbols in
 msys build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Building at -O2, adds 33% to the build time, over -O2. IOW a build that
takes 45 minutes at -O0, takes 60 minutes at -O2. Turning off debug
symbols drops it further, down to 38 minutes.

IOW, a "-O2 -g" build is 58% slower than a "-O0" build on msys in the
gitlab CI windows shared runners.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230801130403.164060-8-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 34109a80f2..552e3b751d 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -113,7 +113,7 @@ msys2-64bit:
     # commit 9f8e6cad65a6 ("gitlab-ci: Speed up the msys2-64bit job by using --without-default-devices"
     # changed to compile QEMU with the --without-default-devices switch
     # for the msys2 64-bit job, due to the build could not complete within
-    CONFIGURE_ARGS:  --target-list=x86_64-softmmu --without-default-devices
+    CONFIGURE_ARGS:  --target-list=x86_64-softmmu --without-default-devices -Ddebug=false -Doptimization=0
     # qTests don't run successfully with "--without-default-devices",
     # so let's exclude the qtests from CI for now.
     TEST_ARGS: --no-suite qtest
@@ -123,5 +123,5 @@ msys2-32bit:
   variables:
     MINGW_TARGET: mingw-w64-i686
     MSYSTEM: MINGW32
-    CONFIGURE_ARGS:  --target-list=ppc64-softmmu
+    CONFIGURE_ARGS:  --target-list=ppc64-softmmu -Ddebug=false -Doptimization=0
     TEST_ARGS: --no-suite qtest

From f54ba56dad0e9cea275e9802915a293f1a8c7d22 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Aug 2023 14:04:03 +0100
Subject: [PATCH 1018/1353] gitlab: disable FF_SCRIPT_SECTIONS on msys jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The FF_SCRIPT_SECTIONS=1 variable should ordinarily cause output from
each line of the job script to be presented in a collapsible section
with execution time listed.

While it works on Linux shared runners, when used with Windows runners
with PowerShell, this option does not create any sections, and actually
causes echo'ing of commands to be disabled, making it even worse to
debug the jobs.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230801130403.164060-9-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 552e3b751d..cd7622a761 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -12,6 +12,10 @@
   needs: []
   stage: build
   timeout: 80m
+  variables:
+    # This feature doesn't (currently) work with PowerShell, it stops
+    # the echo'ing of commands being run and doesn't show any timing
+    FF_SCRIPT_SECTIONS: 0
   artifacts:
     name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
     expire_in: 7 days

From 0b054b4c82ebad6e90111e3ffa3514f841dbb1d0 Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 3 Aug 2023 10:28:24 +0200
Subject: [PATCH 1019/1353] block/blkio: close the fd when blkio_connect()
 fails

libblkio drivers take ownership of `fd` only after a successful
blkio_connect(), so if it fails, we are still the owners.

Fixes: cad2ccc395 ("block/blkio: use qemu_open() to support fd passing for virtio-blk")
Suggested-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-id: 20230803082825.25293-2-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index 8e7ce42c79..baba2f0b67 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -678,7 +678,7 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
     const char *path = qdict_get_try_str(options, "path");
     BDRVBlkioState *s = bs->opaque;
     bool fd_supported = false;
-    int fd, ret;
+    int fd = -1, ret;
 
     if (!path) {
         error_setg(errp, "missing 'path' option");
@@ -719,6 +719,7 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
             if (ret < 0) {
                 fd_supported = false;
                 qemu_close(fd);
+                fd = -1;
             }
         }
     }
@@ -733,14 +734,18 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
     }
 
     ret = blkio_connect(s->blkio);
+    if (ret < 0 && fd >= 0) {
+        /* Failed to give the FD to libblkio, close it */
+        qemu_close(fd);
+        fd = -1;
+    }
+
     /*
      * If the libblkio driver doesn't support the `fd` property, blkio_connect()
      * will fail with -EINVAL. So let's try calling blkio_connect() again by
      * directly setting `path`.
      */
     if (fd_supported && ret == -EINVAL) {
-        qemu_close(fd);
-
         /*
          * We need to clear the `fd` property we set previously by setting
          * it to -1.

From 9b06d0d076271d76e5384d767ef94a676f0a9efd Mon Sep 17 00:00:00 2001
From: Stefano Garzarella <sgarzare@redhat.com>
Date: Thu, 3 Aug 2023 10:28:25 +0200
Subject: [PATCH 1020/1353] block/blkio: add more comments on the fd passing
 handling

As Hanna pointed out, it is not clear in the code why qemu_open()
can fail, and why blkio_set_int("fd") is not enough to discover
the `fd` property support.

Let's fix them by adding more details in the code comments.

Suggested-by: Hanna Czenczek <hreitz@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20230803082825.25293-3-sgarzare@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index baba2f0b67..1dd495617c 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -713,6 +713,12 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
          */
         fd = qemu_open(path, O_RDWR, NULL);
         if (fd < 0) {
+            /*
+             * qemu_open() can fail if the user specifies a path that is not
+             * a file or device, for example in the case of Unix Domain Socket
+             * for the virtio-blk-vhost-user driver. In such cases let's have
+             * libblkio open the path directly.
+             */
             fd_supported = false;
         } else {
             ret = blkio_set_int(s->blkio, "fd", fd);
@@ -741,9 +747,12 @@ static int blkio_virtio_blk_connect(BlockDriverState *bs, QDict *options,
     }
 
     /*
-     * If the libblkio driver doesn't support the `fd` property, blkio_connect()
-     * will fail with -EINVAL. So let's try calling blkio_connect() again by
-     * directly setting `path`.
+     * Before https://gitlab.com/libblkio/libblkio/-/merge_requests/208
+     * (libblkio <= v1.3.0), setting the `fd` property is not enough to check
+     * whether the driver supports the `fd` property or not. In that case,
+     * blkio_connect() will fail with -EINVAL.
+     * So let's try calling blkio_connect() again by directly setting `path`
+     * to cover this scenario.
      */
     if (fd_supported && ret == -EINVAL) {
         /*

From cf2f89edf36a59183166ae8721a8d7ab5cd286bd Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Mon, 17 Jul 2023 18:21:26 +0200
Subject: [PATCH 1021/1353] hw/virtio-iommu: Fix potential OOB access in
 virtio_iommu_handle_command()

In the virtio_iommu_handle_command() when a PROBE request is handled,
output_size takes a value greater than the tail size and on a subsequent
iteration we can get a stack out-of-band access. Initialize the
output_size on each iteration.

The issue was found with ASAN. Credits to:
Yiming Tao(Zhejiang University)
Gaoning Pan(Zhejiang University)

Fixes: 1733eebb9e7 ("virtio-iommu: Implement RESV_MEM probe request")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Mauro Matteo Cascella <mcascell@redhat.com>
Cc: qemu-stable@nongnu.org

Message-Id: <20230717162126.11693-1-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-iommu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 201127c488..4dcf1d5c62 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -728,13 +728,15 @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)
     VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);
     struct virtio_iommu_req_head head;
     struct virtio_iommu_req_tail tail = {};
-    size_t output_size = sizeof(tail), sz;
     VirtQueueElement *elem;
     unsigned int iov_cnt;
     struct iovec *iov;
     void *buf = NULL;
+    size_t sz;
 
     for (;;) {
+        size_t output_size = sizeof(tail);
+
         elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
         if (!elem) {
             return;

From 503d86dd66625b4bed9484bca71db1678c730dc9 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 18 Jul 2023 11:13:27 +0100
Subject: [PATCH 1022/1353] hw/pci-bridge/cxl_upstream.c: Use g_new0() in
 build_cdat_table()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In build_cdat_table() we do:
 *cdat_table = g_malloc0(sizeof(*cdat_table) * CXL_USP_CDAT_NUM_ENTRIES);
This is wrong because:
 - cdat_table has type CDATSubHeader ***
 - so *cdat_table has type CDATSubHeader **
 - so the array we're allocating here should be items of type CDATSubHeader *
 - but we pass sizeof(*cdat_table), which is sizeof(CDATSubHeader **),
   implying that we're allocating an array of CDATSubHeader **

It happens that sizeof(CDATSubHeader **) == sizeof(CDATSubHeader *)
so nothing blows up, but this should be sizeof(**cdat_table).

Avoid this excessively hard-to-understand code by using
g_new0() instead, which will do the type checking for us.
While we're here, we can drop the useless check against failure,
as g_malloc0() and g_new0() never fail.

This fixes Coverity issue CID 1508120.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20230718101327.1111374-1-peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 hw/pci-bridge/cxl_upstream.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index ef47e5d625..9159f48a8c 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -274,10 +274,7 @@ static int build_cdat_table(CDATSubHeader ***cdat_table, void *priv)
         };
     }
 
-    *cdat_table = g_malloc0(sizeof(*cdat_table) * CXL_USP_CDAT_NUM_ENTRIES);
-    if (!*cdat_table) {
-        return -ENOMEM;
-    }
+    *cdat_table = g_new0(CDATSubHeader *, CXL_USP_CDAT_NUM_ENTRIES);
 
     /* Header always at start of structure */
     (*cdat_table)[CXL_USP_CDAT_SSLBIS_LAT] = g_steal_pointer(&sslbis_latency);

From 1084feddc6a677cdfdde56936bfb97cf32cc4dee Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Tue, 18 Jul 2023 20:21:36 +0200
Subject: [PATCH 1023/1353] virtio-iommu: Standardize granule extraction and
 formatting

At several locations we compute the granule from the config
page_size_mask using ctz() and then format it in traces using
BIT(). As the page_size_mask is 64b we should use ctz64 and
BIT_ULL() for formatting. We failed to be consistent.

Note the page_size_mask is garanteed to be non null. The spec
mandates the device to set at least one bit, so ctz64 cannot
return 64. This is garanteed by the fact the device
initializes the page_size_mask to qemu_target_page_mask()
and then the page_size_mask is further constrained by
virtio_iommu_set_page_size_mask() callback which can't
result in a new mask being null. So if Coverity complains
round those ctz64/BIT_ULL with CID 1517772 this is a false
positive

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Fixes: 94df5b2180 ("virtio-iommu: Fix 64kB host page size VFIO device assignment")
Message-Id: <20230718182136.40096-1-eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
---
 hw/virtio/virtio-iommu.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 4dcf1d5c62..be51635895 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -854,17 +854,19 @@ static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     VirtIOIOMMUEndpoint *ep;
     uint32_t sid, flags;
     bool bypass_allowed;
+    int granule;
     bool found;
     int i;
 
     interval.low = addr;
     interval.high = addr + 1;
+    granule = ctz64(s->config.page_size_mask);
 
     IOMMUTLBEntry entry = {
         .target_as = &address_space_memory,
         .iova = addr,
         .translated_addr = addr,
-        .addr_mask = (1 << ctz32(s->config.page_size_mask)) - 1,
+        .addr_mask = BIT_ULL(granule) - 1,
         .perm = IOMMU_NONE,
     };
 
@@ -1117,7 +1119,7 @@ static int virtio_iommu_set_page_size_mask(IOMMUMemoryRegion *mr,
     if (s->granule_frozen) {
         int cur_granule = ctz64(cur_mask);
 
-        if (!(BIT(cur_granule) & new_mask)) {
+        if (!(BIT_ULL(cur_granule) & new_mask)) {
             error_setg(errp, "virtio-iommu %s does not support frozen granule 0x%llx",
                        mr->parent_obj.name, BIT_ULL(cur_granule));
             return -1;
@@ -1163,7 +1165,7 @@ static void virtio_iommu_freeze_granule(Notifier *notifier, void *data)
     }
     s->granule_frozen = true;
     granule = ctz64(s->config.page_size_mask);
-    trace_virtio_iommu_freeze_granule(BIT(granule));
+    trace_virtio_iommu_freeze_granule(BIT_ULL(granule));
 }
 
 static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

From 63a3520e29a1a68d8610315b049ccb5840fe22e9 Mon Sep 17 00:00:00 2001
From: Milan Zamazal <mzamazal@redhat.com>
Date: Thu, 20 Jul 2023 12:10:37 +0200
Subject: [PATCH 1024/1353] hw/virtio: Add a protection against duplicate
 vu_scmi_stop calls

The QEMU CI fails in virtio-scmi test occasionally.  As reported by
Thomas Huth, this happens most likely when the system is loaded and it
fails with the following error:

  qemu-system-aarch64: ../../devel/qemu/hw/pci/msix.c:659:
  msix_unset_vector_notifiers: Assertion `dev->msix_vector_use_notifier && dev->msix_vector_release_notifier' failed.
  ../../devel/qemu/tests/qtest/libqtest.c:200: kill_qemu() detected QEMU death from signal 6 (Aborted) (core dumped)

As discovered by Fabiano Rosas, the cause is a duplicate invocation of
msix_unset_vector_notifiers via duplicate vu_scmi_stop calls:

  msix_unset_vector_notifiers
  virtio_pci_set_guest_notifiers
  vu_scmi_stop
  vu_scmi_disconnect
  ...
  qemu_chr_write_buffer

  msix_unset_vector_notifiers
  virtio_pci_set_guest_notifiers
  vu_scmi_stop
  vu_scmi_set_status
  ...
  qemu_cleanup

While vu_scmi_stop calls are protected by vhost_dev_is_started()
check, it's apparently not enough.  vhost-user-blk and vhost-user-gpio
use an extra protection, see f5b22d06fb (vhost: recheck dev state in
the vhost_migration_log routine) for the motivation.  Let's use the
same in vhost-user-scmi, which fixes the failure above.

Fixes: a5dab090e142 ("hw/virtio: Add boilerplate for vhost-user-scmi device")
Signed-off-by: Milan Zamazal <mzamazal@redhat.com>
Message-Id: <20230720101037.2161450-1-mzamazal@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
---
 hw/virtio/vhost-user-scmi.c         | 7 +++++++
 include/hw/virtio/vhost-user-scmi.h | 1 +
 2 files changed, 8 insertions(+)

diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
index d386fb2df9..918bb7dcf7 100644
--- a/hw/virtio/vhost-user-scmi.c
+++ b/hw/virtio/vhost-user-scmi.c
@@ -63,6 +63,7 @@ static int vu_scmi_start(VirtIODevice *vdev)
         error_report("Error starting vhost-user-scmi: %d", ret);
         goto err_guest_notifiers;
     }
+    scmi->started_vu = true;
 
     /*
      * guest_notifier_mask/pending not used yet, so just unmask
@@ -90,6 +91,12 @@ static void vu_scmi_stop(VirtIODevice *vdev)
     struct vhost_dev *vhost_dev = &scmi->vhost_dev;
     int ret;
 
+    /* vhost_dev_is_started() check in the callers is not fully reliable. */
+    if (!scmi->started_vu) {
+        return;
+    }
+    scmi->started_vu = false;
+
     if (!k->set_guest_notifiers) {
         return;
     }
diff --git a/include/hw/virtio/vhost-user-scmi.h b/include/hw/virtio/vhost-user-scmi.h
index 6175a74ebd..c90db77dd5 100644
--- a/include/hw/virtio/vhost-user-scmi.h
+++ b/include/hw/virtio/vhost-user-scmi.h
@@ -25,6 +25,7 @@ struct VHostUserSCMI {
     VirtQueue *cmd_vq;
     VirtQueue *event_vq;
     bool connected;
+    bool started_vu;
 };
 
 #endif /* _QEMU_VHOST_USER_SCMI_H */

From 45d9d318c8d435cbe2d465f61e6975885d2242ca Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 20 Jul 2023 15:38:53 +0200
Subject: [PATCH 1025/1353] tests: acpi: x86: whitelist expected blobs

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230720133858.1974024-2-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..1983fa596b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,15 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/pc/DSDT",
+"tests/data/acpi/pc/DSDT.acpierst",
+"tests/data/acpi/pc/DSDT.acpihmat",
+"tests/data/acpi/pc/DSDT.bridge",
+"tests/data/acpi/pc/DSDT.cphp",
+"tests/data/acpi/pc/DSDT.dimmpxm",
+"tests/data/acpi/pc/DSDT.hpbridge",
+"tests/data/acpi/pc/DSDT.ipmikcs",
+"tests/data/acpi/pc/DSDT.memhp",
+"tests/data/acpi/pc/DSDT.nohpet",
+"tests/data/acpi/pc/DSDT.numamem",
+"tests/data/acpi/pc/DSDT.roothp",
+"tests/data/acpi/q35/DSDT.bridge",
+"tests/data/acpi/q35/DSDT.multi-bridge",

From 44d975ef340e2f21f236f9520c53e1b30d2213a4 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 20 Jul 2023 15:38:54 +0200
Subject: [PATCH 1026/1353] x86: acpi: workaround Windows not handling name
 references in Package properly

it seems that Windows is unable to handle variable references
making it choke up when accessing ASUN during _DSM call
when device is hotplugged (it lists package elements as DataAlias
but despite that later on it misbehaves) with following error
shown up in AMLI debugger (WS2012r2):
    Store(ShiftLeft(One,Arg1="ASUN",) AMLI_ERROR(c0140008): Unexpected argument type
    ValidateArgTypes: expected Arg1 to be type Integer (Type=String)
Similar outcome with WS2022.

Issue is not fatal but as result acpi-index/"PCI Label ID" property
is either not shown in device details page or shows incorrect value.

Fix it by doing assignment of BSEL/ASUN values to package
elements manually after package declaration.

Fix was tested with: WS2012r2, WS2022, RHEL9

Fixes: 467d099a2985 (x86: acpi: _DSM: use Package to pass parameters)
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230720133858.1974024-3-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/acpi-build.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 9c74fa17ad..19d268ff59 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -362,9 +362,13 @@ Aml *aml_pci_device_dsm(void)
     {
         Aml *params = aml_local(0);
         Aml *pkg = aml_package(2);
-        aml_append(pkg, aml_name("BSEL"));
-        aml_append(pkg, aml_name("ASUN"));
+        aml_append(pkg, aml_int(0));
+        aml_append(pkg, aml_int(0));
         aml_append(method, aml_store(pkg, params));
+        aml_append(method,
+            aml_store(aml_name("BSEL"), aml_index(params, aml_int(0))));
+        aml_append(method,
+            aml_store(aml_name("ASUN"), aml_index(params, aml_int(1))));
         aml_append(method,
             aml_return(aml_call5("PDSM", aml_arg(0), aml_arg(1),
                                  aml_arg(2), aml_arg(3), params))

From 6e510855a90b7ca1811bdfc4be66b0fd4a4af28a Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 20 Jul 2023 15:38:55 +0200
Subject: [PATCH 1027/1353] tests: acpi: x86: update expected blobs

Following change is expected on each PCI slot with enabled
ACPI PCI hotplug

-                            BSEL,
-                            ASUN
+                            Zero,
+                            Zero
                         }
+                    Local0 [Zero] = BSEL /* \_SB_.PCI0.BSEL */
+                    Local0 [One] = ASUN /* \_SB_.PCI0.S18_.ASUN */

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230720133858.1974024-4-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/pc/DSDT                     | Bin 6488 -> 6836 bytes
 tests/data/acpi/pc/DSDT.acpierst            | Bin 6411 -> 6747 bytes
 tests/data/acpi/pc/DSDT.acpihmat            | Bin 7813 -> 8161 bytes
 tests/data/acpi/pc/DSDT.bridge              | Bin 12615 -> 13707 bytes
 tests/data/acpi/pc/DSDT.cphp                | Bin 6952 -> 7300 bytes
 tests/data/acpi/pc/DSDT.dimmpxm             | Bin 8142 -> 8490 bytes
 tests/data/acpi/pc/DSDT.hpbridge            | Bin 6451 -> 6787 bytes
 tests/data/acpi/pc/DSDT.ipmikcs             | Bin 6560 -> 6908 bytes
 tests/data/acpi/pc/DSDT.memhp               | Bin 7847 -> 8195 bytes
 tests/data/acpi/pc/DSDT.nohpet              | Bin 6346 -> 6694 bytes
 tests/data/acpi/pc/DSDT.numamem             | Bin 6494 -> 6842 bytes
 tests/data/acpi/pc/DSDT.roothp              | Bin 9873 -> 10629 bytes
 tests/data/acpi/q35/DSDT.bridge             | Bin 11590 -> 11974 bytes
 tests/data/acpi/q35/DSDT.multi-bridge       | Bin 12770 -> 13214 bytes
 tests/qtest/bios-tables-test-allowed-diff.h |  14 --------------
 15 files changed, 14 deletions(-)

diff --git a/tests/data/acpi/pc/DSDT b/tests/data/acpi/pc/DSDT
index 32d255cfc0a207c89bf8459edaca11fad12979e9..3f104cc65c4fcc55616540867ec1ec50a7b9c7fd 100644
GIT binary patch
delta 1639
zcma*ly-vbV6u|LIp@g)BmeSTJAKggU6vBsNv6v8)sMSp^vk3{CiL;5!;%<Baje*U?
z+2~Bd3rON-d;tyjo_NO7ne*d+&q){6SzYl1|9G~+SnT~-nX5{7c^U@o(D0ViFV&Tr
zJvrEFg{jc<k2J>OEae3!eI;&HLO<BoMrJ}{Y%ppEoxSmZvC-<+@gT+~wM=<stDFBe
z0X9L}Yp~dr!OEna3tPi(5^R#RWxXu*<Vjz5Txz{bF?t_i^i7O@M;Ki<_yatHe!zvn
z?_0+ksj#O??)f5Y18<~()kv#ldAEVxG}tt0&xCDaHv=|9+DEY1)xqkd{S~%_T?4E^
z+5?mC+rn-ZY?ibS!fs>N1Z$G^2P}4TU~{D1$?-RP*tNh~q`d=+T^p=T+D~EI*mb}<
zq-|LI(?7T9Pya@YK1CQ^@X=eF{?m%h`-c%muWWu^A5WBrHS^?}AHsI<L<O(~(iR-v
g?O?YEwn*Bcu)EkTfi02t6)bjLur6h%`dU}|0|BpdeE<Le

delta 1309
zcmZ|KzfQt%5Ww+TN>YA>w)77a2vipwT$G65pav`?CIX2C<6u&EHSq~t^bOe5cQA-A
zp%aUVqmGVF>SnlJyyaYfzfZn*_gH_ei69JyM+He*xSxm@P4s5RQP_^m&TRUj`SQv@
z3D=sD8nuFhv?L`YwH1!~BH@&yAnc_tEFrhU&i?%IWW1wS=f1Z3=N0q{>+jH0KZ!oc
z`X9Y250vqek+Zq+hX#CK{_{OGV7qnNPQ_^|JIyp>Pur!?r&xa;`#SXndcpc<^wihT
zYph?+!g+%%fBkh9*4?0726GuU_a6HOt*fKgS-)*Tzd?Niy}|n1*f*(fqBmLpZNYhq
zHh<p8hVh$}voL3|xd-&Lu8rPiz2QK=MSTao!}>Gy)OXRltbcOgyibQeuj;~g-{rrr
zT-a`xw)1eB$4+}gPumsH7g)cQgML8$BKjihZ_rb}gucZ3uN<7`=lS!7c^KcJTp4p^
dHaCfVm)5PIudrVCpx>pwkKX6}^wisve*rUoCENf2

diff --git a/tests/data/acpi/pc/DSDT.acpierst b/tests/data/acpi/pc/DSDT.acpierst
index 33e872b2fae3d974a3dc4ec0401b1f1734db313b..d33cffc67a5dc49694a6c6a57b3f26da1f759bbe 100644
GIT binary patch
delta 1579
zcma*my-LGS6bJCz*p%9&`A!D=wG|YEQa>8Sr6E<J>R{@mkoW>MyWkw?SOj0dUF`$t
z0|;({=%9<x7jPEuJ$S~GIsYI3a}GC??)!QrjKb0B5@QAHzVfOpex1cp5F7iSv$@id
zdP6ztcH(l}506#Gimcp^PL3)?XE_d|Lp8OE5@SgkM1zAYVJ!Xonk5A`4YfA6{=b#M
z%A~y(b`5(=U`wR^*4olgo@%<+qDJiLJR0YSW+Hl*Bl;$y1%n=7#o#yEz#A#Br$X*|
zDeNZRNCm5s_8BbpR>4+D+c5deJ?z!MYNQ>5#a<n(PTEIdee5;B8l*KWKC_R#CRmfS
z=fZAbuLag3?E_fswZYn?U9kDgee89>I;0(e#a<VzOWIpu1MKy{dZhia`481}=%>Hu
z@aRR3=#7Xz<%rHj)O6_qwq1VT5N}k2J!|Bi6JZB<qdM3+X+OYXZv$+Dw5uMUc^7+|
UV4I}90*k#Zur12YUc4RY7pxX!J^%m!

delta 1277
zcmZ|Ky)pw~6vpwjv-#L}ce1<LFZqzrq|vM-Bn3rcV-zID(wW&bXx#ueV1^=G1qzcp
zKu4{RD^PL;#(B>;&C%}u=Knrt*1l|tIEfF8lA_FQJc@Tie>+N(erj*OPCt!ET^?yk
zGfMMmFWxs5MN{&<<Zvi7Zy}A7UGuCc)P6G9`TaPa>=hc|yMI1|KEwJ4>08v#qR+Bk
zSkP}#KZicY`ctc+j<m_O6}a5o7ny5QPRE?i=9X-DewF45^n&#l=&5g@H&{QDevSGj
zdXx2C2hJNi{CT$y%<WLFfVl#j`$kW5E%X-aM@8s&sc)mVS$~h7`VM-B^|}k^t+@Po
zC-V2zKfj+{Sl6R<9=_(WuPu7g(>fo$&-!!e`_vE62dw`<PyG;m$oh^C*QY*z{f!TE
zHz`-bT#3znNgvbPGWs&>hXM3s>Q~TLSbrz|fcjPRRo3T2I4=tM^NvG!ev5K7%+=W3
R6MC9kM_=dsv_8MC{s8n097O;C

diff --git a/tests/data/acpi/pc/DSDT.acpihmat b/tests/data/acpi/pc/DSDT.acpihmat
index cd84abc1b1d026e6055057f4c6170146e1921ea6..726741a0f0934fa6504ab451d6374a739f704301 100644
GIT binary patch
delta 1640
zcma*mJxjw-6b9hiv}w~&+9XZVFKL_#f`ebs78FSu3#IB{)JaIhUE&YWO)Rb*1ZTmy
z)Lr}o`U9N06v0_=l-_&rj3;y6C+|7;Cbv7YUDXf#<C())>TaS+x;mJjg@G4p?tE(N
zj?^B?!FnfDLf1bkFqUSD8=M@fX>%p?gM&hBWF*F-*bDadM-gN3;^`<#v2j#xE$qhH
zzs-QnkahwVdu6aPX(f~QZenj1Y?ibESnSP#&5`y=*e&c;z$&Eu0gJtPuzAw<t(G*D
z$CsAvP*?IGqOS>}Um~j6^jo_&AK*Me^xo!o)5bF@!k$HP&rh&;MkTN%(ymr`ZwGrd
zuo`Kv!D6otRwwPduwCpmz#61=s(j`y_LjkxNgE66Vy_9-B<&km?6tsJq%~@MW)FL9
zur_Hgz+!I&Y=yKh!uGJY3bsmGxz1<qVQ&p=jkKqA{^{S;>A&PzL_ZQle?@e;LBDm-
i-~(JGh(0#>o_#!{ChXZH_xuKnXXJo&C_CL=8c2T^#Byc;

delta 1309
zcmZwCO-{m45Ww+TnoybomX?+l+HRDM8$VDnN(@j)Oav02?o8@hS$G9CoPdpb3JE80
zrS3R^A16>Zx;0EE&Stjn{qmogkNr_Yi$ruh3M6S^IMHN7>&;GM(TW#4v#D)_^2$IF
zYxP)-o6(UjNhwKfij%&Uvivv_J^iwv$t}@2oIjq8hh}x|*H{0&f?i?$i&>Qi%J|!~
zO)gip;Ja_}-!~Ra+o0{zI4#Xidry3gwo}ootZx*dU!#5oeTMb-iQlBYhF)X+ZxPN5
zZT`Gt8^&)@PRE?i<|gQA-7NYn>vInDx2c~)pJV+6dg|xV=UM;kz<FN|f8KHl#@8ul
zV9sE3*NNYubqnYVtbapKeG|RO`aKu+X;R-pZ?XQ)h4UU={=A>$JMj2#;lZ>PZRg-L
zhn@D2_%>}<LSJHiwha9?^<DHX>(3J(QQt%FvHqzH*MFAz^Oh<wzC*bR<|=IN3O%js
fqxV_=n)ojD1M~swcYWBWOZ^ai$oc85e<1$>8O|oD

diff --git a/tests/data/acpi/pc/DSDT.bridge b/tests/data/acpi/pc/DSDT.bridge
index 69a73ea2a691de387b82bf85a7ba1a2279c01a0c..89b5ee17e156d08168fcc93ab635dfb83d63b335 100644
GIT binary patch
literal 13707
zcmeHO&2QV-5uc|In|hLLN@n6D&WDgq+U^Gu$<8MVw2?^JR&2?NC}+1|P*IW>Rnh=U
zWH-PjMo`6DWW6Z@G*wgd(1SMc-iqW;Xn~%3%W;p}LoYpU(M?Y4&OB10EsH=2<j?>T
zV45@Y_?wS6ocBhgG+nFy<}3jFI=7-O>Z#lZWi^E#1^{$U|K&pH8W?RYw@_ozK!_Rl
zqv9M7IZ1g>%dIZ3Keo(2nC2&+o2+g@<Ei|lQMW$ZG#fyJZZ|B>=|sLH)%0A=*jOAd
ztA(^wTP$d?><b>0YFVuUQf;-MfwC0NYkD!>J=eJbRwBs2>>m1Er<IuE@{99-|EGTT
zZt?N-zlsO{rWUu%?)a1IJg{Y2{Qjm1fQ-YP8+_bKh64}>6OFhDP`B!~P+nF}kp-mP
zXqQ#J%A)X$OU8Yf2o?FODLiN?qpjyJqrcKK9zutSP;=@0WfbH}#R`kc_GLt<xzcJe
zRW4{Bqzsl@R+m6ISyuCx1IAlKZEssG8e!dG*MTsM9};^Dly|du&9G5~WzoTO#+phl
zQWjCs#(aeZeJ3R%40vGBz+m3%G@#RnZQ}>-)mi;s{SM>fZkW0!cg1i3z-l<bTs%Xu
zl$SV#Q_*;>T&aSU475!P>Q8f#Cw1Po?$&t#8rJ%)dINY6nq9fm#6gh|z;bCxgSGC7
zPLp*LojMQo**dI!8ShhB9F*uZd7#h9Ih<ghqr#eX?@oiu5Jjgp*8r^bI_le8V_>aq
znsvBc-!he{!WEqJZe*ReTd>6=TRf_qD_l`45vg3Mq!SZ7`o$PTDDB}6JR}|u<FU|<
zK53yhEjr&Kwz081jt*pdNgSKB(^tYM=!yM&>Wc}81jC5K@h>Xyl*yW2&B7KLQLbD`
zD~Xy`(BU4P^S0nj*3^nlBh-qZr)zpeXAfJp6&9%{zN0-ipq=^9p4p*2BeZAGzMa}L
z%5d!&W1~pEs{`73z=!(T9qMO=`q=^XvmWYa9rfCvdMqRVbL{7KsGk$+=LXczd8nT=
zHdaFDy*{WuWUKF`P{f|{h&|<)XJcZrm8czKG8I`gyK>Pfi+O3WoUit98Tvy7(P%H0
zt3`+by!bu}SdC<&r>^EpTB=;pYANNM&|wkB#1zqL^}8mQ&2H>*$ApfFcf=NSCmwg|
z@cViU{_&si7Un+YD^7MI!6zP&sR#~uPu>ApsV$WA!iacQEf>=1^f{1Me&SSae(iLy
zS3=8`d_M|&OjsLN%d4ryk3O+(-u^}E)`uT|bo*BG!;isWYI%7HD?F);bH2dfIXq{v
zJLnw-g39o79y9L$h=?qt)N;PW)Iv#TYNdFUVKGh9VV*%yRf`%H>?Dm0s(OAog~PRM
zHKoLAg;GJXfS8ygbJs+zM}ur59d9yeGQ(bY!b(D|&i^dX<((EhP|?-v%HkNV1lfr3
z*0s~2osN<NRLTe0sLY}zsxv4c7c4%BC47%$c?oM#F-&gxQ^W?L5Me03GQVHd)sp1l
zhNPDA?<WJ>7Bnrk_EbxD)|iDQl!?;49Q$p@WKWvNGOgyIO5yMz6DOrR{bZ1f)6)E^
z8^PMXjcUHKhRL!153*_At>z}#NOc>n`tp4D?4DsFGjRHvJZS9+3<~kO+fCYz<U{s;
zga8}Rq$x+=nnq^0b9=DRp4*M#VJ=406}=ks2=nl4*@KV4v#t*Y0b^(Jz#x}~-WX)!
z(4p2DpIxAwrn?&eZx76CX^XNO?|@>qnuu}<B;5RwbfSiSM9CRwUB98s;LU?&pq5Y1
zf^)~yjYK&mtBQSR(Xwyf(U&;?(`Fn3SflW>O$WBXUd3L;n1p;53li%kieJV0bQ~9I
zfPa5J4PeV@sodVCrIJ1Y5E8KzBPnff|K)ojfWLnC@Ll&Bn@7WNJM*jFaGMKl`j16s
zLk*!f_Kq`NE|t?+ENXVaBL0p_g{8Qf<<T9L>YL}^JZB*Sxg07lmMeB?+zo=E7*h52
zV!<<b#tvYSeft`!*XL@<u@FO>@%&6JDTR0dcS}T_B?%cX|JV(-v2kkteRbY8;7Y!@
zijzA_qX#UO!*ZBvtNiFu;F{Q@{rXXWX3N-!>gjaN-fkNk^D}z-f=%JnFsj98(rSR4
zJS4v-E;R0+I31)bX&?z1?LKg?bR|QFSvt%~#>SbYoQ6R5em;l`7n$U&FbDX)1!jT?
z40B=)*6{!FfS8mM#g*0mRg+V@u9A58ILH+BtTeBw{bpet{iQ`@h96j9-v+-8LTG`#
z489BkJAMh?2?^lL{Bjw0W_D9CuN9Ih8F-kl@HFGkF~%qHFUe>4HowWg<C9#HYV%q?
zG0l~M{J|^)G+}nRT+Q^{3!w$LF5_Nnhm$goFR)L8p9UrAcw5*otF9FL*MxEO@M~TL
zUj;!rE{khUR;p@0AW_Ft0d0W=OgavXA~LC`FFMo4XxfO8a~K#0WW1wioN3014S<5S
zW;DQ-15ajqCv$XSY;69S=@~Z-g2>vHC8e)-XNi=<6@UkfjeOWmCMm10mOy#ChD}P$
zN`^3QrbPp(SFlL9X)@TN9tO+HFHN+A#wTmEvQx7}V~J;M6cE-mhk<}*KB3uA=%w)P
zxCm$-@QIBV46~cSUAu8o$!i|;3m)_WpLJ&xQ&511{DOx(!ClM44tUrvc-RYk&b55Z
z0Uz@VKIRGTT8_0rgk{_>__!DN8P{@LDh0UY7hLiLcP)=N;1R#z5ijtwuI1bT=YGMt
zC%9`lRw)sds9*4?7x+2X@|Xi2^9vsH1a~cuJK%A@;BhbT^RDF+4)}y$@Ci?F*YZgR
ze9|xYq!;)F*K*kbm;Hjvp5U(K2?spk7d+twe$ll&>3}Ewf+sz}UCXB&@F~CGQ(oX%
z*K)-HSNwu2p5U(K`yB9ne!=&7f#+Py_dDSG{etiJ1a~c;cEG3of=_#atFGk-9Pk5v
z!4G(XyOtkxzz_NbKj;Onxt1Stzz_KaKjaDST0Y}|&-ewO@dD4gmLGP&5Bmi_><R8#
ze#8Mk;urjg7x=tu`B4Y_s9*4-p5U(K#~koue!-6o0ar>#w5z3Rpc`FpF?c{*^y}T&
zdJ7v%BrZ5a2nlQvY>7lfPa-3MTTNS%BBCd`gamHoY)P94lEl|rQS3P$=(tyMDAIJM
zFC$gB8*yZ$>ug^}%5c4RWTfp}Uq<S1MRjDP?>xyS*IS}lMH*MF9*zA5(yknP=Lb5j
z4Lv!2&4IKlmx;y-+>@sS?aD6^jdiXkZwuO$3y-my^yJuNJ<!!1a`GDQ*}k0o)^^Cr
zbG$S9@)XfK<d=}f{OilxM5COVy<NSXV7R%2eFwEtOkN3z?u<5PucI%Mvv%(!HhZt7
zV-kpHxIi4WNnyIT#CH~$-lI0j`7!{TYOEx^u#DOyH!PzzY42A@m@T+Q^s;5tCb`)%
zYLkX$OV-VnQJdsu%cxBnnk~40>(!P~o8)H8o7pC1J=&yEXM~-`o7x%edPYK>5jL;A
zTQ)2nl<nSRQ>z5jh|q<i5qT|-R0JYw7KpFqISL_?=>l=|@MP2#cszj|bp=CL?on4T
zG%Ta8U}#uIUBS?>jJkrMVHtG=L&NfBb_Gj^?1v}xz-06!gr2ng-#!VEOOpF)q`V;B
zzLI}HkGK^44NnPwioyf*yBnHNe1&n9IVT#ulVuNJ9`c``A{ZLe8wuVc@yQvDlz&Pu
e%qkc0mDvo?`@sFz<n12;?O@PwdSQ3hi2nj(k2u5t

literal 12615
zcmeHN-ER}w6+hP>$@tn%#?C;1@L{pgc0UBR0|8X2#h!5zlh`pHhuvzTdTeJ^Ly>mG
zF4962)nuz|;HlJ`st<keqU<aD30<jAedABqKJ=xJTXo@S({pCV9>;j9fhQ{2Qk*&G
z-1(i~xgY1AJ03+<Dhnw9HkMtH7u7`eqmrD!4+8+YrvG9-um)O7$u3k`*cV{hgRpsx
zUs*x=K*_Eyus=8TKk52sU+S!8K>dlhTdx^k?C5o%MtAE5=X4=n6{>2ss%<Tfm*jj>
zs4nJ}Nai{B3)PHL2BEr|S3p_{<`lIM?aZ}rff4gF&^yQe*lxzAxcL0i-~XvzykB@c
z{jb8&zsZF?y)(Xhll%5`gFo2O0Z?(geT$D9@t_Z)pd*Rf05zj#8O3Gk95Ep8TB{_h
z6&8l4T+kkfB*>^=P2iW3&{}Hl8pbO;<pB(s1UZ|`T|+~*SSYiwXx&DFoGq>v5~aNI
zQ9@(cWqAptvn4rq&8NLX(*C~Dq!z|Kb`uCg`zfjSKzcue_Y7-ASO$IRc3WM_hDv6y
zC}XeHEf_mFF}nf37}T*dH`{e+*CYG*fz2ALZPxBFKJIi==j?$#8~`xtc4sbLpuQBB
zICZC_@M@`C0VD2f=?2uEWJ9|(-ZJjjxDV>a#+_OnxE~rFvE9H%p#Z>gaY=#o&Y5<D
zbz<!r5A@V3tbZNtNf~SuYd5&Br^(tHe@`RBy0Lk$&P51gP&?}Y#zqbO?W{8})_3$8
z+^y~D(p3IBj(I1v!COt(<Doqsmge%;<#I?UmCMQ41P?zPgAh%7xCf6&$AkEt?}T@o
z7)_I|_eia6EstXWneHTxOj^@dz+O;ehxydQ2?+Uvh{N$OY~o3iRkf0VJt9#mUr$Q0
zs*+b>ldgHo)J#_8vPv!FvMEnj)w0SSH7ynfxhK8tJv-o?y@vNxpZApMJ%#-Gy{Dw%
z-c#CEfnt{jymQ}cxKH=FPn+)31Mbr<?$fq=WzapQ5zl=;+vk4PbU!=be%8hPthTih
z!06RM_W{d&cM659ArDzYj`M8H9Be6U^)XRJ6^*V~u+w5rSS;l#U0jCoP(svNi=|2d
zA^^{S3<G8(k>sfxxuTLNm6d8jnlpVEq|tGTDAn41or`)W^0=)-TgMf#2c3z>?HYVl
zi@-nr6WqhOkMk7=I~L;;+e8(?0oUX`5T)uuDQA+1X5>;nnM}@sxbh1-bMv+H{%#5_
zm2<sb;A1A+s9ai2EPnEtar^FX5_dlS^pm@H8XtcO8k0-QOPJxwWt8&;2G8Ibi`>KL
zup=l9KjRVY!Ouv@Kte9%icHQIRVJ4UHy9?<Bz?^@@XK;R!Gs;BmVQ~yEhn(KlBp!5
zNHt%~3kHx9=g91und^~|MbeHYl_VP0#uJoca%KKkz7B6UVOz#fZ%T_}xD#YT+B<9K
z1O0(g0F=rH)#%KiEvh|epb!i`i7EUQ%kmQDqC$|udOb&M5DF27;!E>~WmPT;E@23A
zG52BIw{JkhVCzqmczc~0m_nJEx|bt=XzOgZfhyf-47xM}9#rC>bf$L)wKyz|Z#p5&
z?fdBF8)KLq^Z%fl#@%S_5J$?}$m;7$or|wDGiL@4UxWLNS2_lbc;DRyl_R-;RgVy0
z9U3&`7+XV24G-=WEaY>yKD?U?A$diuL|nRg_-uIvA3M*uIoJu<cLw(jYN_e1K_xaF
z%1-;@GR<jP-2k{ea9#_0G`n#H6f%`qm<u3a@kiE)D#j6}V4!*PmNbKl2h%_`mrR4b
z;%On#oDyZpT3NL1TPyl1=YQFWf)8^Pe)j2$EwGo7mk}nQo<;nmdV%Jbk)9mIjT+$J
zUrqy9cG@cU_i3x7j}J_XxfP=*?C<~eN7De`{_yC1=N?N(&9I#LUAMWVg%<tCB(o(4
zFdD1kjFyU}WCoL(m9R+Pm#HunS28@@m#Myc_T4iUAdqW;(qgG>rN)CG*cC&v-m6&f
z6rQppm}K8wL-*=zH9i(#$QiFMRO3Q``><Lf=^|N(y!dmcv$d^r^B>Cd7J=)z!YU4K
znpzJq7K37ta;x|-?^`o#v{v3nqor+y)nu}2mD}3Z{EV8sY)LpYjB@dXr0nB54~QR_
zH);>gocGh6)R2sfst>G{uBYfLO<%Kuwsm1Ct00h7&--!XB1-lSbA%sSU^?i)a89hl
zI{rWHGY92NVP&;<*W}cJy96FQ4I=e=MwnOR-eF-J<E2exh96mA-}}G!Ltufu@W1c_
zJAD=23z)#E`Q;K;X4au%UdhK3BJdzz;Yr4yVIQBxzc`=a`}{WlflqQlsLm_7*ff_0
z<`2$7Knm&QQYF<5FMteiU&dOiFG!I`7ue_i&;5dMx@B@m%PWQ6Jwa?e{GONomwpgV
zi{?FN%N4oTAz?dG6WRa+m~a{x^~j`}ykZX<qhTXO)>dFYpyE9>We+nBtPdpQno<Cd
z9C(rLUd+;kw)Oi>rly=};78SgSyKG=;4BfcxC3yXwv`V!lS#;^t3{AbRPm4!G2+}u
zjYy~O(YXav%5Qb_O>N>;+Rf>JL~Tfin>9i?6d0Ir%mW-73bztC7{3X}eID?z(J+1l
z=<ve<qtLkD3!vW(Fzt*GPAL;G-~}+?3g|El+JHeXfI&CFS%=}64LIfnaLg6ZVTkM4
z40+rO;J6#$1&1MSWhS8D1yFDWbQp$gz>pWfkQ?AdhatBCxfek03g|Gz3}J>G_5v7o
z1DtahMr^={7r=-spu;d~14g|7M%@4}ISeOkzzHva6Rv;`!$})((hK0E8{lP!p=bk&
zUI0Z`K!;(>28?+DjJW|`aTvyJz_=H{xGSK;aLNXp@&Y*J2AFXeN;aV61yFJYbQm78
z0S|crJmdzLbr>GD0S|itJnRbSFr2mlr@a79y8+4$!y`7}5ifv8Tmc=1M{U5PUI34}
z0V)o|V>aM1FM!8f0Ud@jHsFjGz!^8doWt<A4S3uO;Bi+#hv5ku@Prq@6K;U>4#Sf+
z;7KolCtU#@hNo=6Q(gd14FQyjCzKn-imwyiXfoKQ67gmyveCqY4GNcSA%FswsFp<_
zp=%LQz|zRFBuMC5uA+b?iDhY#K$hr6GmJIwwu-fYEs>`SJsY{gUD&pfuZuk!Im7+W
zwvo5Fo{ik$&STri-zBn5ZZyrq63UqMyE2{=P<HHicH34l=XULQ%tqO<izH*l>)I2h
z?AWi8jQOT(Z<(@VHzUT?-nC<qzpcuBc8VI;TF*{#D}8o~9A|pZo*=o;eidb$XFYq1
zWVF*^<G|U%R5<eoYhx<wnJ8PQ11eD7^jsk3tUBH-a^ARlH&KwFi83nLhn~v#sARWK
zqIl99mF#r59hL0ESIVelcUH=%WT%xfD%ppxlu^m<tdzIAWY4&i?4v3jtKR?DD*eFo
zWvbHgAZ7k0g2$Jj`J=(X=etz40~O13qggD!@#AO{rCV~p@iS;bA&MrK(SzsVNp|$$
z*-5f^cJEH`(Szsz`70bBRk6;r8C9{PD%SP)YCfuBot5%-SFuaStOw8ZuzB<pnVwR=
zwNH`7qTsyNBrXK$@xS;J`guUY_wS4N8aci}g73`Jfa2>%tIWPo@STfytp?1+{_ArD
rLv6Y(!M!EArIz9^>18+R3cl`^0(zIP_lm3a0)L-^n$yd62U`3W8!JGy

diff --git a/tests/data/acpi/pc/DSDT.cphp b/tests/data/acpi/pc/DSDT.cphp
index 20379056b399bf1ad8b8316453eac344f604d3b6..cb9fc3c524f238f90d9d84d795061fe78a21a6dd 100644
GIT binary patch
delta 1640
zcma*mJ4?e*6bJCzv?(P`+Ps<;`iL%qgT)8-AvmO@O07DWii?mA?$$4$ONWBs(nWAC
zbd}=ZCVm0^0D@aVa2DL8_Z~ds$(;X>|2c=7X>Hh4{J`%GON_;;kIF<-I`i`|Xob2r
zpFL}?RPV~cMk7pxo`0e;7H26hI6YS4_G;({N9w>#NR0Idt)P84>N7T2d>!>;Y#i5D
z7It&}-zLB&NZSL8y)sytv=d>sur~=dN!lNMMe54qis87_diw^CUPg%Ci|9*)=$D8Z
zCOyE8$?v<3H%h~vX>!k7VQY9J6|73y53ty)fz?R6X7QQp*qZ^HA?-C-?9GDBlJ-s5
z2KMS;b<!@`eC7uB8ek35UJ2X8UK6ZI+E=jHYk{>$YvuUN9`@Q`ZPH$V#oip)9BH3~
zZDFqi)*)@u;XhQ>p`ZSlh~7kqPDS)RLiATem-F-h2YG&9A8%BIJ&WX?55l(bMkTN%
k(td-*-ZI!SX?F{J<~{7KfUS`B4lMS%U|q`2J_{Y`58!ojQvd(}

delta 1309
zcmZwCy-vbV6u|LXN>VNqN?S^SKo=z@E^3sIs6(-sm<S|Z+)T=>4!(jPZ@{FxiKB$c
z(MjES0`(2lMOVY=iDx<My}$g=IoIv`h6rUiT&^g}f;|y;hUm?XBiV_}?ri#K`0C0)
zlWVO=kAm<pqbLbQ59Co_B%Ep#%3kK&5^6_w59W`fan7vI{rc*^*U)RMKSNLbB>E)l
zU(LEY(8k}UYjfl4dHC+<`R}VdY_~z%={QYir+uKO?NaDdtlzPqze#<8Ua<ZaJ@wP*
z)2#os;5^^v&l}n>zCk$ya|WB6#J)-EX3=L^pLL+$q<#*4j`gRpZ&BYwZ?gWyf%Co`
z{=B6EjBiuU!koqCF45DvHhP=&@39Z4@1S>BzwN?40rd;$3#`9!;k+l8Kkq00t`+%j
zS%hi3w4I03Ja*axdfKjpzQlUNgMLW;GWs&>Pta4pg1*A~XAiFb^!W1@OEA7mxhm$W
bZ0;iVd$ev1eU0^R=&A3c_c=e^D(|a*dzU5N

diff --git a/tests/data/acpi/pc/DSDT.dimmpxm b/tests/data/acpi/pc/DSDT.dimmpxm
index 435496e836939eeb767f1a524dc1471740ad917e..3fcb0a22a3d074ce3e6e6d12eed95d174876ff99 100644
GIT binary patch
delta 1674
zcma*mJ4?e*6u|M@U}~DC4@#Ox+cXGL(8))&oh(VyLaBBzIw_>1V;6T3gl>vm1!u)Y
zI{5`01@Q|gLN~=#L6F{i@QkPX`Q?A^<>skz>#IQ+>@6=a7W=+eyE(NpIgCO-%6gM=
zlyfDiE00ce!(EDka7P>D<|M}Y13zqS5BrP_yl}ra?8n&XMz2gqpJy2T(JQsC9In+P
zCGvt@jWL-i(+{b#PG!1zZr4}-Z5(Wzv{zuUI}diAv>(D&v8#YpNV{e5ovYYQfK8D0
zT-Xils$f;pzJkSW5^R#Rt0v!h6T2E%jkKp=v6}*$BJGQ?HSDIrrb)YK@ttef&4A62
z_E^|DcC%o!q<ysb)Bm*Szr?ipXv3yQkHqN345JTX^lgSwwZQMl!#m2uIrHQ>4}|sc
zjtsB{Y45;d*92>l_E*>@b}g_LX?sO}-X?Z!ur_J0g$=M<09zpK7g+2T!4^sDmH5sr
o?3TcmNP7tuyAD`~wC}>Uv0DaPCT-Q>JGZgxf^{i7K65(KA8fySnE(I)

delta 1292
zcmZ|KOG?8~6vpuw(g(LGO=6PPJaJMLC!(lzR2x!3v__4Oi4Zs7V+HC!-9V?h0SAIq
zH=$Cx15sC@Bk8>d&*XG`fBf(H9-@Ae#c90P4<%{r<B4q;tTQ;u(kRo~gI;EYvYaU0
zE7KnLvpDUj=LVCbw7uC%_qUF_FJ^r<QPTOjteCapT~(44sW^OMib;9H629^8bKrBN
zKNEfd`+4wr(!YbpegS-e^fPvSIB&<M=iQ3u#}UupHea)d*D?5wk-x20g~#hk;7g>x
z7k&x*DtMLjzu>W7245!qVU4f9tkLVAYy8}0%vB&)A#?f!_YFK(1Fw<(6g>8I@H*+=
zgkQnF0p1|}w8Q6ZJM_F8ho9TRoC!IT%zc5!b1m=|>6<R^N7%Q)+oZn(kNqn6D(Qb*
zK5x>a=N)+b`C`O#&*Rs{c%1{kIplAeFFao7f_F)OB77VB9(a%Rui&xogZD{474UgU
WK(D_J__=GC3n3R$x!z~6F8={LI3!;H

diff --git a/tests/data/acpi/pc/DSDT.hpbridge b/tests/data/acpi/pc/DSDT.hpbridge
index b6eafab250d508e1358ea09f81eb1b2a6d96ce32..2cb4310af36c483e62671c9a9eaefef9363e59c7 100644
GIT binary patch
delta 1620
zcma*my-vbV6u|Kdp-|dVX({C!Hxgq^42WRjU~B7wI#Ah6+Ay2Q1Gur^OyUceI7>Qf
zd;uLDTp5hJiJKAcJ;@mlbI-5;b8p(XJ?$!9;9X3sj3s^-%Db9fUWS1i=8u-~mpV@F
zI8xBw4P_@7ohvD8EA)ahZDOX9j71YS@K0wEW0U`<vnavlS9+^ASc!fphmJSY7?YT=
z5^0}=?W}5G(_qu2)i-#zgWU|+3~57Q_pmF2l}Y;u7Q0!nS<)u*eCIB96|f3vhhVX*
zf>lX-FYG>cHLx0KzrkWR2R27q-{9x%VOIyMllIPNB?r>{*|0aMPw-QWZkY6F-{fzN
z))>7Nql-00KTLkk1H7XGoU=flbGyK;gLh<swMcsd7Q02TMbf?s>tfdiYm>HV@ts}l
zmcW)sdoAoScFSPPq<sO4-3r(WX^kS^*~4xXY?ZWQu-L7Et&uhs*2iugY@M_zoA2yn
fw*j_6+L5p)*lmJslJ>#of61Fo{!sCceVF_Mj7@Di

delta 1250
zcmZ|KxlY4C5P)H0tQ?Nx#0Nf54$(wHG$8>JBnoUC4he|FLKn#qPY@cQrv{4jKm$E;
z3$NgY;~h920@xif&7|G^^v}%2a?(;G79F;INt&8}RNo8vbP%&JF0ZG_N8wnW>nW_&
zjB^1y+E*338b@qT8=0ycvfl3B<8XYgH{`xDzSA9x`hL?J3w?#Pe<N`a9cYr2kwh*-
z=2|7;yZ=55K1=#*;g_(V1D_-PH+byl!RJZ8Q|9NLl<D&x#CJO3d)naFtl)MUOw-6|
zL-4p=5qy#K&%$@GuY=b~KWp-RI@m9PFOmMt<k#Pt^!2YI*TtLxIfKkCT73K}u4{rf
zNq+?%`xbbM^k2dU*tfykq~Esrc_W)X@80I?hM038=a4yhMtEG;1@DqR7JdW!9(a%R
zPvEidgZD}AJN&%Bq0c)N-!~J!UmSi-54Wqpv<f+`=?ahARl!$De<}PX_G{p4r2hnu
O{W|zM<&!OMP5uEil^M7I

diff --git a/tests/data/acpi/pc/DSDT.ipmikcs b/tests/data/acpi/pc/DSDT.ipmikcs
index 06aa7bfdeca40e10ee8411eeda08486599b90e39..b0e0922f5e38f01b9eed33d6b7c7d60f81850a20 100644
GIT binary patch
delta 1691
zcma*mzfZzI6u|MLP$+Fdprz%vP9zQ*6%chR6bwNfEXKv8n3%XJ&L++zjx3HY{sBsy
zHO?kZZvF%4?!;iYd-08rx$l$jyUX>yGOeku=k}&K#scj}^;1)wpA+9}_=(Q<c%q$4
z^{(u#Z~2PvxQ9ApL8ds~(SaH?mwngU*9WPP#8`jO@LGGrK4XK~*I_@vM%VH3%x<jx
z+Ys0gY2U$OR|YGSwz$B%73_w=hDmz?7P}F!5z@X0Tg9#dRv~R7!FR4=HwrdN+EZa`
z*j2%*q<sR5T@9>8+F+9Jyop^MtWMe<SnS5Y#z^}hY#qCCuyNA<Cd*P+9+gtoBK3TC
zQ+)Jtj?p_Y`Z~wxM2sd4dVw8--|sfwkpbs4$aCHb>);)kU`^6~fyHhbY?`zyCf~V%
zT??#5+8eOgwZYn?{SdZ^-3-_aX_wM`=O%WuV6&vX64u3T4s4FJZ(y;T2b(9YVey??
n*e!r9koF8Lc8g$(q<t2)jolL15^2LW|DjfG^68I{?T+*ZT)=vq

delta 1292
zcmZ|K%QC}I9LMoUZ<&*{l9M!vUKTbTrW;gEtw^N{GpdN&!c6S!@C4Z40lLNX2^dqJ
zf~CFyHXgxcVS3Jg{5OBwoX>po|NYc^H5NwUW^YVUMymI0ptIIsFOHhA*?#GN=m%=G
zlZ>Vtu@(p6hM_14MGK;>RhDqdaTv9YW6soO)LI#S-0xoIDrzU$z00{a_57Zz40AJ>
zOF=G0=7Le-Yg2!}PlHdB{suhuGvG6%|CW9h`x<zS^t+~*cV^P_9!+s>9ditFjLdOM
zdOTMLuao{r`Z??y;0@A0gU5are3tZ+T+CbN^t=oCeEZMy8y9ODc%2D<Gs(X#+S227
z7I=&F*V4~ppM&S5{{oMF8@x^W9Y?G`b?EgEjyN~KTpn_HGH2z5Z{oQwc$f5t;IZ$4
z_elRF{Sx+l@IL7$TrqFWrRSZy;@l8(1;`c1+$(rIw+OyS`UOw)Ti7pwFOmKVJod}r
Y%cTGG#Jq8zp119b=M(z5-}jf*UpvSo^Z)<=

diff --git a/tests/data/acpi/pc/DSDT.memhp b/tests/data/acpi/pc/DSDT.memhp
index 10a0e44d610976cd5f08d53ec32c7d5eda064e1c..61b66fcf9a9ca62436f933c40e116a16686445c7 100644
GIT binary patch
delta 1640
zcma*mJxjw-6b9hiw6P_mA8GSpYuY%Jikn~9b`VWT3#D4Y=%kpAf=d^{SrIyl{Q<hU
zxJW0_S#TEIMd&E{0~G1K2hVsi=Y4qZc_FuJ=NpRWd%MwD#v+gRN?B9d<AcC&1Q~Zc
zs%ef??a2OOEl32ex1%x^WeL~c>nc%wKJff4wV#bijP?2rzqvW+G1i}a9rPk>c$TY7
z?9#%&je(7k_7yDl%3x*EmUZ5{jJ;D}r$~DO7JK7h<D`AoD^f=ue(I(}O=B56x^B?X
zBN4p}5q%KR_YhIV<QuKxMk?H?l6UTd#f_3+lcc>9wu-$euqo31fW_W4*feRo7QeTK
zy&13>(q4nbUJa~9+Am@2*qa5LC9ONn-(1Ju9M~LbuY`56R|l(;_5&>T8ek35uH^Zf
z8`x`tHA#B`7JDtQ7HQw|{D=C@(?8T)fk(Fsbo5k2Z$d<0MD#mEv@pXrYT`yV+-Z|{
k9)rb=ieQVReG;~Xy(O?E(k5;G<`(ukU>(Yi4(+z|2NqUy#sB~S

delta 1308
zcmZ|Ky-vbV6u|LPN+=EAEu}3K7Q^Boe&b+5p`a!riPa6QPoOON0<P*HyNOZ5Y}nL?
zAo>*QOBl{Q@hpe+-e3Oboa^RzTk`||Xk3w`$m6TFkkfk8K^U~cY-c)Y<f`&wUkR2Q
zp&EMrVN#N!lIjJ=2U^r{LqF&xhj~qI1)crb<Jss=ug&~Q{ogC-71sZvr+y55jP<)l
zP3|kBp<(LW_!k4luTn0Kxj37X3*gsiT@}5``Vc+!6X+AH{}6ti`WkwT^|lG;c_x3}
zmH2*`^ZjMQH5;^D3a6#mY4sxbP1-JvKF#`D^wiIw&#?YS_y+Z}=(DWfvEcd(i@*Na
zf_1kjm&aV5%|&eCX<Z$?&iYf~J?b0i4c5P-r+xu_f%TRH=QSPvyh{hxZBed>xgwkU
z6uwRCTIem-FO{I*roN5dX8n!uKJ^{+4(q>5a9*y=pVuwJ_xYUfr!s8Uq3v9p=5o{S
aUEp0>u7bS6@zDu-%2&}>IX`)G_vAl!D<m=i

diff --git a/tests/data/acpi/pc/DSDT.nohpet b/tests/data/acpi/pc/DSDT.nohpet
index 6905312d827502e8bb5852418cf58290eda8d86b..57ccde1618ae08a8f7ad65553387ddcfe26b178b 100644
GIT binary patch
delta 1640
zcma*mJxfAi6bJCftA^h9w*=p75gG~&OA8vVT@|w$x<y05b!gANK+z@yEiOTG(Hhbo
zjV<*7f;J&&4%))!IdsP3eE&cG=Nz8<TDh;ve&FwyGK@urk8)d)JLBUpXoRLW9vvw~
zsn(4Lm3o*6J%3MSEXopIaIh;!-G$H(cGSKdlNjsu8$ok>&||DW`8w!D*zis(P3&^{
z-^RekNc*Feq;7mz&{IXKrmgen=@ii$5q+K_`X!>4K@YHQ@I9+|qa^H^B=@`$b_H)F
zgOy490Tz1|unK7xO+ND~_Nri2(w>9GUJa~9+Bacq*sFupNjqopnQPc<fHg>aCTtyh
zO|T|uU%+Co1=b?1WAmBUu-67_llBBG_Bvo4(mo06VXq6;CGCvEf2bvge)@+ZdND=x
zK}6rDi2jP`yh{(T<?{P(;*HX<XPVseR#+czlmVL|?KfEL&4SI6c4L;$+{E4-*c@rE
j!D4S7Y@W2A!nUxt0JcEda*EH~!rmg-B4tOHsgCpqlh$$f

delta 1309
zcmZ|Ky-or_5Ww;CILNUF$9-{pMJQAn8&QZDZGb~#B9gFLNpiMoV{50rfuYeCuvNkf
zXrqRT7f|0oZL~J*PMl_JcYpcM%x!gCVF3^J##u#~IUBMqgLNkTkT*lCJsBMsC3Uf@
z@k%|^!$#0cC`v@p8+?D4MZDQC;GM*&!_+2k?@S*L2g77}>X(=Pyarw)y=h91{V4b-
z=})9z!F~*UjPx&NS?y|rFVlCabr(`%d=+y#<a9E32_DytgO8K`UHTgK8F)te4NL4(
z!@dFDApMOc&U>`z^M2%a(Wbw-EvBvFb|y?S$!YiCak~`w6zP+W=-07tfwxG13?BP7
zc$@Ukj=28Qq0gIl#rQSMxsY?o+=cWFT-O8dk^T)l_S4|gq+j>MK27ZV;C<3xd*ZwY
zk3R2P=31D`LM}_@dTBAfh3n?P=SY7ieSrNu_&n(ozUT+oFMuzQ{>T^SUHSBRPxAZY
fpYOShn6`=A6=7PDoOTW#w=01!QGWEA*;ao60qQ3j

diff --git a/tests/data/acpi/pc/DSDT.numamem b/tests/data/acpi/pc/DSDT.numamem
index 59e31338eeb3a84c39ed3ae63105226ce2ad1125..36bf83259ed7d3cb51e426d83663421ede24d998 100644
GIT binary patch
delta 1674
zcma*mJxjw-6oBE|VrrVCX-u2+yAg+iASkW<5L^;dp;R4=Iti)x2P(QMjzw_l<{xmD
zI&~AA73V_7E)K4a(t8h{@pM1Web2ol)9Sdc_<?^i&NCLdc~K^+(wUuyffpL?Z1kf#
z(P&p18oKSQhkkIV_06RyW4*o?v=0V7#`<n>dNk-o*l<U$%ttR47=6$y&8`$wTcI4f
z{;|fG#N_!wij<}@6Jcvx|276TM%s-e@7A!p40f5cx592?R|YGS_5&<-<6z^Ybqv09
z9lHuxg|vOJ*j2%*q<s^%fn5!(Mp|=)@7%y{0&Ie`m%=u&tAo`^`wAAjNw7)MN+#dA
zg<S)zLE1BufBJVO{g*t8(a!}&f5qr(iaxcI;tO0YF#43@_jK`%EV!pd-t${n58ucJ
zYm;_2&AT3UGhj2MeH3;NyIHVV(oVr*HwQLH+D(h^>|-|%Hc#4nu-GktEs*w0*fw^H
nV2h+(v-!?#?3TcmNP8{pK6cAs%cOk=i(Ln-L)np)=|ukk4#0Sa

delta 1292
zcmZwC$x6du5Ww*m(uFT+vnRC+z4fAkv{dUwXiNmbS}=N0i}4X$o<gsE0rd?^4=yiZ
z?t;rjk3NA5oea)p&hz6xGmqVuwg}^J?|5F4<_;#}SrvnHl*B<|MCtTPZOZac85?EK
zZX{tm&`vEO2XVCBkN0;@#!<PoFjV69a#BqC;jSi0id3A9gyL}i7JcvE=g{X^|C{*^
z_4DZStRLxcPlx&i^aa*G=&jj%?>hgUXTW&f;KvsRZ0pi>0=EfvTZ*2pQ_-ueUoxS;
zLVXRr#`-Jt)GwhgvHsJ9_jHSYFSKC&D&=&{>1^&M^F2D(KyR@A2R-#o^d{?%Y`ABQ
z`WAYN_4hWs_h$3&xeny|lyflWu(@;ebgqluW&Km;1L}L|J=QO}a8E#eAHC1|OBddo
zxcqw`*|_ZS;|&kCg>+pNw^i9~*XZfG8u}XRzcU|EzmC4n`a>V?iKyQ|-(dZn58uD~
V{CiFXa+{QEVy?;Mre~Ec`48DGBwPRh

diff --git a/tests/data/acpi/pc/DSDT.roothp b/tests/data/acpi/pc/DSDT.roothp
index 448d596cf413d7e487af114e5c80bc73311d17f9..ca44cca6a3e46777e1e3433512dfd101c1c7bb8b 100644
GIT binary patch
literal 10629
zcmeHN&2Jmm5ue8oY57P>OKNS|mOlu^M(ZT7NlBJ%6lhKEQW7nZT5~BU#R}z;R8ZPA
zkcATgkp-hPgF1?Psmr+Np$EoLP6g~gp#^&CrS-AL^w3L>DH{6}b!K<Tl_)OI1$rqU
z0$T0Ny#39`n>X(bmx`uTesK|i-OjDbOIj-TzAC5i!vKKp>AzSAt%KfDa*I_K4TPBf
zC~Do~B_~MlD!H{q_S>fM8^iecGlSJks6Q8<)obRbJ4PL7&}QA_oNmM$LRHIE_4d-J
zDi_j1b*Z4lvafhhsAiQi2-UTM0@89guV}@1cfNBM%tVlZ(LMF+PBSsV#aCDV{15HQ
zgW}W4e-=;vNiOah-O*=vcwpBs`J){J02!w{cloH93<n?%1{!e>pk~%=p|~PlA`3{n
z-cn_)!lLkk3;H9G2pRcnDZD5ty`|-EqQAlm9zutSkaOw$O%&ux#WIVE_G3iIxzbuO
zr52R;Q##A7$jcyIQ04s1fc_RydwXV+Mwnad4iJX^J!0>I^iCF^88(WrOu87(SVPK1
zR4XdVh_A4q@1(>E16~-^F_;fKb?DS%d-#EeHCB6A+hTmw4O92Rffx<|m~|(ZOLG)U
zahX#%C52bjas|v}pk<g)d!CCttMQikpvD7GH@ENC>cE50=!%^N4vK^TR!YkXY;@0e
z8myb>)Oe`R)?nkyc%RDRphTy^1AR`;;RO2}88*y^TXil%6rI}H05G>}sBdS3fw{3`
z)L^r=Ye*A?TR7+4$Tn{^VV6gCc~qJ&+>*-?K`ocli7_7id;}tt_OJy{h{wZtEp(&L
zn&?fF?sti;w^v5dfov~{W8-%E3K#_~ahy+lJ_eCs7;!lMMJ+sOysA~QuuDd$<y&bf
zQB?{WJfwTxvN+>axvbF$xopvsRjsVCCr#T5lhhO6(ViR7&U|Rk?9-mHv}e%1{n|6q
zaP1krT_oS-0qs2CL;cJ?^)r_GnE~}P9_nWt^~#`nEF=GQ>}U6>pS9G_4yd2?P(Q1;
zS3~H%HmE*itM8>y#GdkqJ>{5ZBi3X~Q9H(DDza#H#iCOd^TLvvuk>&k`a=a#Z!M{n
zBE$e*eHR6+Mk3J@xAP?>rIwXyN}9KHn8YzKMU-mofx$(i8++O@pkv^Q*oE%c(@qV(
zsKwy#{|@hB?qj~<WG51Q>@k^&;DBp#3q+~9sOBvr;#pZOq|@nn5LbWbRBpb0IoK<q
zYB}GJ0w1xgjmzp<YU#s|&3l_aP2K<CqYpRlH$M0XbSA4S%UIz_Wt{Ux1~1_yi*2EI
z7zirEFL_LV^nD_-kdoDWiOGeM#^iGGHp60?rpp3@pez>^EZ9jJ8I-mBN(zT7*-A=^
zRSTtpU;;5QM`qWpT8{?VMmpYP(qx9c@r0#>Tv_;WpvyZ=cr2r<cci5e+zGM~{jK%O
zq5Y1M160Zf*{IB<EvhppAQwzNjwSq%WMvs^Q87$z`BTIOp%7sxzO-;$*5s1l;f5fW
z^6w=BdnPnYw((p^b~c!aC6rmEdnNX(j=`QakY$*SL6w%ngG`*1?&PyUE>271t8N5q
z`yQ(K${Z%g`aj5~c{dw7WFysWwCc;N-7ANNS($;;*Wf|(P+(Aq&uup7IFb+9=Me&|
zLxZLqeQW5M;m#exLVGsr!^2#R$g5f<<`L%M*>VUUgJ<3u3<Ac^<bgph4ZS<a#Gym2
z(?7jNIZdk@0G9{mwXjRsjVqv-tt6sc009qwBps`wA5n4!ns@F>Q@D7r3{>;!8E{rS
zEhNe*QI_nLMccl;qHl2iyPY@$utwo$k1lMHy@|bvF#-8379`ed6u*h}={RoG0RQ@I
z62O+zR=KxFTP1x0U`ed47)fDo?+@Qu0{G*%Pu_8#v3WEMk262-4Y#?_qW@TA+HwfJ
zu}_?FwWOxASk&x-Mf`o03QKV%%cJ`$)z>e-e#t@vax<hZsb#w~9t6Qq45@mDvET)~
zU?;H1UR+1@+H5sB5@KjG-p^H&LWl?Ov_#Yul92J@58Pnu?Mn;q$qTjtxAMg`oZJ~2
zJz%jI7Q<9q#YcZ->(&`<=P!(AOK(TDbh>IExApeIl$O3`Q#dt@YVllJ4se5q#CNR+
z^+)F~2kA)~NJ2)Z4?HW~%FtzoF0+E(o?Ff-2xOn<gSc^#NzM*)f*)IC1{lCFCpKUM
z|4#?3NjYC!UF$zJK5^hFfrqC-q^M_w1x4;R3!~^SZ6Z_r#3K79_)QQ(i|lpqbr9I}
z4R||b0cRFgR6Lp4O~ryzNTx*KVZO@KjK9PfU%<a4pW=J`9{-k)b3v#sDEY)Bmj?0&
zvk=gPnH9B?>A4p|3vge?v(`Q*MIK*dp9DV%3c_^DvSCJEE%u)Y<LKefya~Puf-o&w
z&s->1<bFV+j;9v12_`UM8W=@nTuWbfrj60G5hLd?Fb>FgTgy1pj1wCG32n_NfGr2!
z%=B(%=|*q=^7l;3xM>hX)`2W3{_S9v2szvVnBLBZ-CPo~+FA*ui&gAVVrDXgVKYn`
zN3DWM!X1ObF10XNU4CYu88kjwrH!3>B^paSy<I?9*BS;EH1i3~hC(lg4~E5p<^iAB
z_`oo`3EZ_C=ajtWLBHTZFYp<6LNNm^@Q`2dkSDlndDsCD`vnhsfzP^@k2v5Xe!)jP
z!ClL-G+1F7^$R}g1wQ9mjyt6VF8Bo(Ji%SdBMx}PFL=ZY{EBNicfh${aPA52T8>4^
z3QN>4c+?Ag-nBgDfXDoT$2`GZ%i|7s+%I_C3;e2U`IrMf<`;a-6Wq0Y+yNi=3qI}z
ze$BO9bihTw;G!qEYk9%}Pxu8-c!6JcEl)b&Nx$GpPjJ`r2?u<_FZhHPc-FOCa=<0O
z;F2e}Yxyw;{Fq<xV_x7n*Ye{I_;J7B$34Ma%O@T1Nx$HeUf{B8`3VR7gkSIzp5U(K
zCmryUe!)+Afh(@%ryTH8e!)+9g1eSaIp9-%!Kb{y^RDHm9q`kB!B2aFyOy7Ez|Z&v
zKjQ_y;97px0YB>({H!OqYxy|`{G4C#b3?$T(i!D;sS@Z$x0?(e(-HknH@4lxz7mOR
z4iQ2EI|N%I5Ydx}NZ?V^mZXU2Np2v4M>$*4B7!9G?Pe5Pj>j6Fl^lvR&GluZ3Qr@B
zjC5V;%SajS_l}IT&G%)b4tG>XM*6OjY<#<E^{PnYuGOQl-$2@xW9$4_!@Z#=$8R~1
zcI6_`Sb=-;ltsJp8$@HB>&aUd?aD2Wv6}Sc*ke7`<b87T8rN)JPJS!<<m5T7jJ`ZY
z^gj6wq%r^c@)pr3x0)~fIyPkWUUc;O-*jC^t<jLRq_;6FnE%!{37B<9t&!8CV_1$_
zqr+caU|6uW^|IxtHFC4%s5KgzEx2R#vgN2Xa<k>AH5!^NIX7F5S|c}Gj#{Ik*@CCZ
zUTryQjjU{uvL3C`Q8$F$#s6bBL~p(hycZFbQTKJJxM01K5id~RE1gs268=1m(NFQH
zL&mq7Ys|S(=sk@s2M_sAE)fcik?^;Ih=dGmn(0>j5xpvxuH(z{4A3tD`ah7dfBv_R
MLBr`){ecnx0Z2bYmjD0&

delta 2603
zcmeH}y-wRu6vrLMpy0U9hn)~d!ASsnXqSNaYM~zq2C1kaw3kjrGHWX}>I0yDAP^Hn
zlmR+ad4mAT13;&$55NeBwL{7ykeqwz5z?V6OIH7X_jmtCvW~sYYGu`9-fGR2q`=aV
zdKwPzHUeutEBVo_M(a;FEz3I_^?p73^n?{={E%Pt-e?_G3YFNxtH8U>mkKKs_;V>#
zWN()xbIA8tS^E@M<u22GwqCF5&ckvCy`|_z0TTbMJ90&-U+GDMvc1T-k17fqLtBtv
zt_Dfn56+K^qMZR0!7C(x5dr@=`uhamNAhz~w_Eqi5MB2>kAFt#IA+6XJ4VM<8_G;z
znE_E|fGl$u1AY>RRRyn-{DU}Lzmlb|{}2b=6zVjg(@5PfuKOFOb<cC4n?{{3bULZ~
zW^f*-j|e_O^5+Ijlh4!F&zcZ_z9Zh}@rg;Fjt)ba$5_S?Wel>+N6r^<SX1yO$sZ)Z
zUqpXG@ClOFk}yqWgs%IZ$F(FKUyi`(_8sxFQ7AKyWh_y~BFlUo1m448(}GWv{MjH}
zpL6JTPg0;;KwU=YGNf)V1-j!Dt&6yzTST2LbT+AbZE+r_&k8<E@vWw%%DH*I4F9_Z
mdwcEXlhE613Y*6FtGCzw{VnwN8vZ%m?_R4nEvMCX_vCBofK}4~

diff --git a/tests/data/acpi/q35/DSDT.bridge b/tests/data/acpi/q35/DSDT.bridge
index 9f8a208aaadc167135e59839eefcd5b594c2f28a..a6765cebb6b95b9f192a04a79ac86c7386e35052 100644
GIT binary patch
delta 1812
zcma*myGufG6u|MHdavm9k?+CRO-)S*Q6V2gp>_?*Ea(=26xShWb#RY1ry3lC=AbDe
zXpfwut)=<{f@p9E8nWN-z!{IT=i~SM4m$3Rj}%SU_QrX}Ouk#?EpDG28hX?4tW8GW
z@w(}CR8o^mJCa@~7`BGKzs&+UL(@CXzE3hU*6TO**4D7cSpWaSVb8=y12tXVko7{<
zuo(?)*E#)W#;J*<k7~Nomi6Ma1=K94VkWJBKEo|$EnqFAJr=fvT?wp2+Iz6rmBGrS
zwI(v=wmixwLMnCD12K9!!|1gbeV$?TM~o(t^a7hne&1!hkpk~j$ah|X#Tz-mI!OB|
zY#F;wuujshr1;Kd?7G0ZNP8}91-ovrZqmMk#qJ!~Inovu_|8@Adcb-}dj=M}Ua(%$
zz6e{xt`Dq_w5c@TxrSXoSU+h8!ZxrQ02?6f6Ikp9!3Iei%JBc*YKH#lpNP?m8Acz(
z=*JAB_AFnZn57r!X8C<Jyipk587AL(0~T)-0UIIhudprbM!`l&+gap0x3C)n8zb$N
Yu<O{3gN>8+3oLe3uqtKm>N%_Q2VM%DrvLx|

delta 1427
zcmZ|MxlRIM5WsOD%e8F6AxAi5kz;{1Dxw^A0t*#L;%Z~mHBlQYdo6qh)|XH#;|qud
zy`9G3D=2Ru%uX`R*zWhse`d0ilgW{&>DobW&1SP-J&WII@ATNv+eV->HD~Ev``E0?
z*-S^!D;2}j(hv7+;blY92hw#&bhPzufAQ_iyps#+V2+xG$7pH$(!6E^ZfE(ITv#0n
z`sTce++lIi!TLr<aSR31$V8X8>Gv6Bk*iWpz?{J5X6R{KCweFA_g0|4MST}~7wezU
zQ{Ro=&3aE3&Z}hk^DeV6ew%V$%z4?|o8@b?u83Y_y_|!7jru<HKGxq_zD|7!y~O&@
z9Gqv*^XJv`@O=8uvzdqO8nm4sr}^1wzm{*(b^-JO)(;BMZ&E*qKFIn<%kNM>gg(T2
zw*u#FDE##o3XE@2E{wS_n;WC2btC8_tWOuA-==;PeU$Y#=&2t=A7lMTadF<L#9vn{
z!SoK*;#iBbwUOmD+BShc!TKNc)K8*Mvc6x2eY(_7p--{?p$tFoz09BIQsH@B<)6=0
SnAW51WSk~*(_UUxm+%J~MMH}K

diff --git a/tests/data/acpi/q35/DSDT.multi-bridge b/tests/data/acpi/q35/DSDT.multi-bridge
index 9ae8ee0b41738bd8951b9449abcfc67c293fdce1..15eef675913d2f10173f96ff6fc42b230d0a6618 100644
GIT binary patch
delta 2209
zcmbW(&r2Io5C`zLn{2yoqQ)q#Ka*_MP1L9)8cjr~P28kNG=;tv3Mp*BLp{cWe}M5K
zy|i?%qUTaC;;Bb3y-QD}2(|YX@hB9!d2e9oY1Ctq`RsRQc;xM`&BM2b!=0Ch^NcB>
z6XPNl+M8D1xV-E}-etV&*i-eH?&agw^z$IkW?j9+U)9;br0ejFa4Q;A8Edx6yt2OE
zWUSTsalffBZ#z-!xRZOj*~C5as=D_%k-T%Co^39h7d*G*>Tbz-5ms1$HQMDLV%p9(
z{-^49Z`aJ;?a}9^y|||FY!RO8@0W?~DdhGNNxM+fc+Ow9Xo)dZQbQ$eE141&V*_9V
zq&<^%4s(NGgQSgGB6kjRHLx0KH!XXnr15z;Ud97be6mt%P4mvJM{(*X-pI!CIFt^J
z>10f8Tnv@Rp}N3!k@i5^1<W<T8l?RV7IQ;jL!^CTi=G!THw-pR+V@~Fw;OCXX@5#v
zz}z0NJ*3U0M9&4x?FHLQ+P1Vs%#DDJkoFr`%<Ti)N80hU=y?fqqhO<?-2sca{b2h^
z`!y|&{+~2`^dC=%(v=CibW4_gxJBs~S$cVkQe#r=Xcc!f2y+gSb2h-@j)uSvk@i?x
z2XlwP4wLpTSj-&(J3`v}l$f`Ixual5NqYnqbH~7rk@ia3D(1$(#z<Srh@PvM8wVSw
r?CHnMs`|RF^Z)+j8twImczNobmjnL_t@u|Vv?m`=zC@gwvuA;S!q@uP

delta 1740
zcma)-K~EDw7=~xt#ocUMyHr{TP}<$HYiUbpMX=oHcH2Y&iH=^Z$(ne8qr%+-7nOq^
z_DYEU0~-!<;Xu%<`~X8VB<kI}#&+h@FD9R{$DMid%=^w{XZAPF9~wUQ@0`~dQ}(*X
z*;MSQsoW2^7nm=S;rFTK#EQmi)j$s#{_QvmZ{;(#W;Rt`?Tt0~-J5JA8~A)J{wQTc
zJl<OEk39&pRz0$!g-5wUeo(fZACSGFg{OIY5bw72p4XNjyTYQZv*VqJ<o!0iul8}+
zwW|MDC2Xg(*6UpVy$?)bqP;@4-?W{`x*EQ;Gnc5%d1t%jb(Po97L_(5O6shF;II5S
z1*QV8lKd0k(LV(I5XpZmI95yL^KhcZ1(KSb7AfY@s)1D_`CZ9h#nd|RI>~>VcKe%_
zbm&d<9kKiZ>I~2sr0zBF7&iudjO2exei8j~;Nv9UaYdd*^e2E%ko=)5>V0<Udg;qT
zcMWw(&?QOTmgMUg*96`q`BUK0KMedZ$ybUZ&l37mz^6$5c~R8s7U_Cl<@CiFdb&9y
zR%>9oG^~~;S9>LS57T9U&yf5N;L$${{3yxaD~UW!^p62QM)Ge<qWz~5U2mi;bUy0F
zK{rn79s`eYCxD+I`45tBp??ziNs=#DM4lG<v%qIb{#ixTdsCt7eUZ90>T;mVQMv<f
nwi#LVbpF@B+}T;y@M_lkPf72BzAhgcab5rWxj8tSJC6PW$(@kK

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 1983fa596b..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,15 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/pc/DSDT",
-"tests/data/acpi/pc/DSDT.acpierst",
-"tests/data/acpi/pc/DSDT.acpihmat",
-"tests/data/acpi/pc/DSDT.bridge",
-"tests/data/acpi/pc/DSDT.cphp",
-"tests/data/acpi/pc/DSDT.dimmpxm",
-"tests/data/acpi/pc/DSDT.hpbridge",
-"tests/data/acpi/pc/DSDT.ipmikcs",
-"tests/data/acpi/pc/DSDT.memhp",
-"tests/data/acpi/pc/DSDT.nohpet",
-"tests/data/acpi/pc/DSDT.numamem",
-"tests/data/acpi/pc/DSDT.roothp",
-"tests/data/acpi/q35/DSDT.bridge",
-"tests/data/acpi/q35/DSDT.multi-bridge",

From d3dc64f34d6b0567ae99fbfe80ed3c094991194b Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 20 Jul 2023 15:38:56 +0200
Subject: [PATCH 1028/1353] tests: acpi: whitelist expected blobs

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230720133858.1974024-5-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 37 +++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..8911b10650 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,38 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/pc/DSDT",
+"tests/data/acpi/pc/DSDT.acpierst",
+"tests/data/acpi/pc/DSDT.acpihmat",
+"tests/data/acpi/pc/DSDT.bridge",
+"tests/data/acpi/pc/DSDT.cphp",
+"tests/data/acpi/pc/DSDT.dimmpxm",
+"tests/data/acpi/pc/DSDT.hpbridge",
+"tests/data/acpi/pc/DSDT.hpbrroot",
+"tests/data/acpi/pc/DSDT.ipmikcs",
+"tests/data/acpi/pc/DSDT.memhp",
+"tests/data/acpi/pc/DSDT.nohpet",
+"tests/data/acpi/pc/DSDT.numamem",
+"tests/data/acpi/pc/DSDT.roothp",
+"tests/data/acpi/q35/DSDT",
+"tests/data/acpi/q35/DSDT.acpierst",
+"tests/data/acpi/q35/DSDT.acpihmat",
+"tests/data/acpi/q35/DSDT.acpihmat-noinitiator",
+"tests/data/acpi/q35/DSDT.applesmc",
+"tests/data/acpi/q35/DSDT.bridge",
+"tests/data/acpi/q35/DSDT.core-count2",
+"tests/data/acpi/q35/DSDT.cphp",
+"tests/data/acpi/q35/DSDT.cxl",
+"tests/data/acpi/q35/DSDT.dimmpxm",
+"tests/data/acpi/q35/DSDT.ipmibt",
+"tests/data/acpi/q35/DSDT.ipmismbus",
+"tests/data/acpi/q35/DSDT.ivrs",
+"tests/data/acpi/q35/DSDT.memhp",
+"tests/data/acpi/q35/DSDT.mmio64",
+"tests/data/acpi/q35/DSDT.multi-bridge",
+"tests/data/acpi/q35/DSDT.noacpihp",
+"tests/data/acpi/q35/DSDT.nohpet",
+"tests/data/acpi/q35/DSDT.numamem",
+"tests/data/acpi/q35/DSDT.pvpanic-isa",
+"tests/data/acpi/q35/DSDT.tis.tpm12",
+"tests/data/acpi/q35/DSDT.tis.tpm2",
+"tests/data/acpi/q35/DSDT.viot",
+"tests/data/acpi/q35/DSDT.xapic",

From 5ce869f788b0b8d82693212366d5637d9f3206c9 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 20 Jul 2023 15:38:57 +0200
Subject: [PATCH 1029/1353] acpi: x86: remove _ADR on host bridges

ACPI spec (since 2.0a) says
"
A device object must contain either an _HID object or
an _ADR object, but can contain both.
"

_ADR is used when device is attached to an ennumerable bus,
however hostbridge is not and uses dedicated _HID for
discovery, drop _ADR field.

It doesn't seem that having _ADR has a negative effects
OSes manage to tolerate that, but there is no point of
having it there. (only pc/q35 has it hostbridge description,
while others (microvm/arm) don't)

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230720133858.1974024-6-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/acpi-build.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 19d268ff59..bb12b0ad43 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1464,7 +1464,6 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         sb_scope = aml_scope("_SB");
         dev = aml_device("PCI0");
         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
-        aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
         aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
         aml_append(dev, aml_pci_edsm());
         aml_append(sb_scope, dev);
@@ -1479,7 +1478,6 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
         dev = aml_device("PCI0");
         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
         aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
-        aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
         aml_append(dev, aml_name_decl("_UID", aml_int(pcmc->pci_root_uid)));
         aml_append(dev, build_q35_osc_method(!pm->pcihp_bridge_en));
         aml_append(dev, aml_pci_edsm());
@@ -1593,7 +1591,6 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
                 aml_append(pkg, aml_eisaid("PNP0A08"));
                 aml_append(pkg, aml_eisaid("PNP0A03"));
                 aml_append(dev, aml_name_decl("_CID", pkg));
-                aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
                 build_cxl_osc_method(dev);
             } else if (pci_bus_is_express(bus)) {
                 aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));

From e3c79cf3ef24008e536beb41ed41dd253d62c95a Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 20 Jul 2023 15:38:58 +0200
Subject: [PATCH 1030/1353] tests: acpi: update expected blobs

Expected change is that _ADR object is removed from
hostbridge descriptor in DSDT for PC and Q35 machines.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20230720133858.1974024-7-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/pc/DSDT                       | Bin 6836 -> 6830 bytes
 tests/data/acpi/pc/DSDT.acpierst              | Bin 6747 -> 6741 bytes
 tests/data/acpi/pc/DSDT.acpihmat              | Bin 8161 -> 8155 bytes
 tests/data/acpi/pc/DSDT.bridge                | Bin 13707 -> 13701 bytes
 tests/data/acpi/pc/DSDT.cphp                  | Bin 7300 -> 7294 bytes
 tests/data/acpi/pc/DSDT.dimmpxm               | Bin 8490 -> 8484 bytes
 tests/data/acpi/pc/DSDT.hpbridge              | Bin 6787 -> 6781 bytes
 tests/data/acpi/pc/DSDT.hpbrroot              | Bin 3343 -> 3337 bytes
 tests/data/acpi/pc/DSDT.ipmikcs               | Bin 6908 -> 6902 bytes
 tests/data/acpi/pc/DSDT.memhp                 | Bin 8195 -> 8189 bytes
 tests/data/acpi/pc/DSDT.nohpet                | Bin 6694 -> 6688 bytes
 tests/data/acpi/pc/DSDT.numamem               | Bin 6842 -> 6836 bytes
 tests/data/acpi/pc/DSDT.roothp                | Bin 10629 -> 10623 bytes
 tests/data/acpi/q35/DSDT                      | Bin 8361 -> 8355 bytes
 tests/data/acpi/q35/DSDT.acpierst             | Bin 8378 -> 8372 bytes
 tests/data/acpi/q35/DSDT.acpihmat             | Bin 9686 -> 9680 bytes
 tests/data/acpi/q35/DSDT.acpihmat-noinitiator | Bin 8640 -> 8634 bytes
 tests/data/acpi/q35/DSDT.applesmc             | Bin 8407 -> 8401 bytes
 tests/data/acpi/q35/DSDT.bridge               | Bin 11974 -> 11968 bytes
 tests/data/acpi/q35/DSDT.core-count2          | Bin 32501 -> 32495 bytes
 tests/data/acpi/q35/DSDT.cphp                 | Bin 8825 -> 8819 bytes
 tests/data/acpi/q35/DSDT.cxl                  | Bin 9673 -> 9655 bytes
 tests/data/acpi/q35/DSDT.dimmpxm              | Bin 10015 -> 10009 bytes
 tests/data/acpi/q35/DSDT.ipmibt               | Bin 8436 -> 8430 bytes
 tests/data/acpi/q35/DSDT.ipmismbus            | Bin 8449 -> 8443 bytes
 tests/data/acpi/q35/DSDT.ivrs                 | Bin 8378 -> 8372 bytes
 tests/data/acpi/q35/DSDT.memhp                | Bin 9720 -> 9714 bytes
 tests/data/acpi/q35/DSDT.mmio64               | Bin 9491 -> 9485 bytes
 tests/data/acpi/q35/DSDT.multi-bridge         | Bin 13214 -> 13208 bytes
 tests/data/acpi/q35/DSDT.noacpihp             | Bin 8241 -> 8235 bytes
 tests/data/acpi/q35/DSDT.nohpet               | Bin 8219 -> 8213 bytes
 tests/data/acpi/q35/DSDT.numamem              | Bin 8367 -> 8361 bytes
 tests/data/acpi/q35/DSDT.pvpanic-isa          | Bin 8462 -> 8456 bytes
 tests/data/acpi/q35/DSDT.tis.tpm12            | Bin 8967 -> 8961 bytes
 tests/data/acpi/q35/DSDT.tis.tpm2             | Bin 8993 -> 8987 bytes
 tests/data/acpi/q35/DSDT.viot                 | Bin 9470 -> 9464 bytes
 tests/data/acpi/q35/DSDT.xapic                | Bin 35724 -> 35718 bytes
 tests/qtest/bios-tables-test-allowed-diff.h   |  37 ------------------
 38 files changed, 37 deletions(-)

diff --git a/tests/data/acpi/pc/DSDT b/tests/data/acpi/pc/DSDT
index 3f104cc65c4fcc55616540867ec1ec50a7b9c7fd..c93ad6b7f83a168a1833d7dba1112dd2ab8a431f 100644
GIT binary patch
delta 47
zcmdmDy3Ul#CD<ioofHEDBlkqER0%Kk_+Y2_=q4xj0B27Fj(87G7aqq8T+ADL)ujM4
Cu?(#M

delta 53
zcmZ2yy2X^sCD<ioixdL`<Ee>Usd5e+@xe~<(M=xg0nVNV9Pu8WE<BDGxR^QO9bJML
JHnyuv0RWzQ4y^zH

diff --git a/tests/data/acpi/pc/DSDT.acpierst b/tests/data/acpi/pc/DSDT.acpierst
index d33cffc67a5dc49694a6c6a57b3f26da1f759bbe..f643fa2d034053fa07f74f095565b64f021d4290 100644
GIT binary patch
delta 47
zcmca@a@B;(CD<h-REmLtF?b?Zs)QGNe6Uk|bdwW%fU~CoN4$rp3y<RkF6NEB=Oh6>
Cx($v1

delta 53
zcmca=a@&N<CD<h-T8e>zQD`Dps+<Eye6Uk|bdv{rfU~CoN4$rp3y<RkE@qB+N0%Um
IjqT?o0fXfZjsO4v

diff --git a/tests/data/acpi/pc/DSDT.acpihmat b/tests/data/acpi/pc/DSDT.acpihmat
index 726741a0f0934fa6504ab451d6374a739f704301..9d3695ff289036856886a093733926667a32a058 100644
GIT binary patch
delta 47
zcmaE8f7_nRCD<k8wmbs^<B5q}sS;l7@xe~<(M?Y50nVNV9Pu8WE<BDGxR^KghR6c|
DXM_$s

delta 53
zcmca@|InVxCD<k8p*#ZvWBWv|R5=HZ_+Y2_=q3;L0B27Fj(87G7aqq8T+AHtjxIqA
I8{0$V0keA#JOBUy

diff --git a/tests/data/acpi/pc/DSDT.bridge b/tests/data/acpi/pc/DSDT.bridge
index 89b5ee17e156d08168fcc93ab635dfb83d63b335..840b45f354ac14c858d0af8fbd31e97949a65d4b 100644
GIT binary patch
delta 47
zcmeCqZq4R$33dr-HDzF6l$^+wD&fT*AM6w#-Q>g`;OuF@5%1yY!sB>>i+N-3KNA2s
CSPi%U

delta 53
zcmZq8?#||N33dtTHf3O7yfKk0RnCDUKG-Qfy2*n*z}eG)Bi_T)g~#y%7c)n^qe~FO
I#`b?E0HnPSxBvhE

diff --git a/tests/data/acpi/pc/DSDT.cphp b/tests/data/acpi/pc/DSDT.cphp
index cb9fc3c524f238f90d9d84d795061fe78a21a6dd..dbc0141b2bbc77a6d806ff046dc137992c59a899 100644
GIT binary patch
delta 47
zcmZp%{Aa=C66_LEC&R$Nm_Ly#Rl<usKG-Qfy2*(>z}eG)Bi_T)g~#y%7xTv6@6rH4
C+zs0R

delta 53
zcmexo(PGKv66_MvBE!JIs5g--RnCDUKG-Qfy2*n*z}eG)Bi_T)g~#y%7c)n^qe~FO
I#`f>h0Ep2J+W-In

diff --git a/tests/data/acpi/pc/DSDT.dimmpxm b/tests/data/acpi/pc/DSDT.dimmpxm
index 3fcb0a22a3d074ce3e6e6d12eed95d174876ff99..1294f655d418dbdccc095e0d47ab220869a61a07 100644
GIT binary patch
delta 47
zcmZ4Gw8V+aCD<iIMUjDl(P|=Bs)QGNe6Uk|bdwW%fU~CoN4$rp3y<RkF6NEBa}@w6
CGYs1R

delta 53
zcmZ4Dw91LgCD<iIOOb(r@#jRYR5=HZ_+Y2_=q3;L0B27Fj(87G7aqq8T+AHtjxIqA
J8{6k9005CF4%+|#

diff --git a/tests/data/acpi/pc/DSDT.hpbridge b/tests/data/acpi/pc/DSDT.hpbridge
index 2cb4310af36c483e62671c9a9eaefef9363e59c7..8012b5eb3155377dc7995b73059ecb267d19232c 100644
GIT binary patch
delta 47
zcmZoR{cFPI66_LEE5*RTXg`rFRl<usKG-Qfy2*(>z}eG)Bi_T)g~#y%7xTv6Z;}8x
CbPbyT

delta 53
zcmexs(rn7*66_MvEXBaU_-`Uts+<Eye6Uk|bdv{rfU~CoN4$rp3y<RkE@qB+N0%Um
IjqTqg0j2v7n*aa+

diff --git a/tests/data/acpi/pc/DSDT.hpbrroot b/tests/data/acpi/pc/DSDT.hpbrroot
index a4073f36d686201296455e142e3bcbb2f368bbd2..4fa0c6fe720f7859f0541b82f828c0329a3c0548 100644
GIT binary patch
delta 47
zcmeB|>XhPg33dtL<Yi!B)SJkaD&fT*AM6w#-Q>g`;OuF@5%1yY!sB>>i+N*j6Au6f
CvkU70

delta 53
zcmeB_>X+hj33dtL=Vf4Ed^?dVRnCDUKG-Qfy2*n*z}eG)Bi_T)g~#y%7c)n^qe~FO
I#`Y#20Bj-+>i_@%

diff --git a/tests/data/acpi/pc/DSDT.ipmikcs b/tests/data/acpi/pc/DSDT.ipmikcs
index b0e0922f5e38f01b9eed33d6b7c7d60f81850a20..0a891baf458abee4a772ffba7a31914ec22418ec 100644
GIT binary patch
delta 47
zcmexk`puNfCD<k8n-l{BWBWv|R0%Kk_+Y2_=q4xj0B27Fj(87G7aqq8T+ADL^Q8c2
C%??Qb

delta 53
zcmexn`p1;ZCD<k8j}!v~quWHTR5=HZ_+Y2_=q3;L0B27Fj(87G7aqq8T+AHtjxIqA
I8{6}x0JM$|NdN!<

diff --git a/tests/data/acpi/pc/DSDT.memhp b/tests/data/acpi/pc/DSDT.memhp
index 61b66fcf9a9ca62436f933c40e116a16686445c7..9b442a64cf711b33d80691fe84f1d3a6256f943b 100644
GIT binary patch
delta 47
zcmZp6_-oJQ66_N4SDt}^@$W>gR0%Kk_+Y2_=q4xj0B27Fj(87G7aqq8T+ADL%j5xQ
Cj}CeO

delta 53
zcmexs-|WEU66_MftiZs)xO*a3s+<Eye6Uk|bdv{rfU~CoN4$rp3y<RkE@qB+N0%Um
IjqPRf0E#dUdH?_b

diff --git a/tests/data/acpi/pc/DSDT.nohpet b/tests/data/acpi/pc/DSDT.nohpet
index 57ccde1618ae08a8f7ad65553387ddcfe26b178b..1754c6878839fc657230e1e714cd7c5142e0a77e 100644
GIT binary patch
delta 47
zcmZ2xvcQDPCD<iIL5hKa@ybN5R0%Kk_+Y2_=q4xj0B27Fj(87G7aqq8T+ADLXG#J9
DGzSek

delta 53
zcmZ2rvdo0bCD<iIO^Shmaq>j2R5=HZ_+Y2_=q3;L0B27Fj(87G7aqq8T+AHtjxIqA
J8{20}0swe^4m$t<

diff --git a/tests/data/acpi/pc/DSDT.numamem b/tests/data/acpi/pc/DSDT.numamem
index 36bf83259ed7d3cb51e426d83663421ede24d998..9fc731d3d2bcde5e2612a8ccd81e12098134afe9 100644
GIT binary patch
delta 47
zcmdmGy2X^sCD<ioixdL`<JO5>sS;l7@xe~<(M?Y50nVNV9Pu8WE<BDGxR^Kg>Pi6s
DOtTGd

delta 53
zcmdmDy33TyCD<iomlOj7W64CWR5=HZ_+Y2_=q3;L0B27Fj(87G7aqq8T+AHtjxIqA
I8{2iI0F>koZvX%Q

diff --git a/tests/data/acpi/pc/DSDT.roothp b/tests/data/acpi/pc/DSDT.roothp
index ca44cca6a3e46777e1e3433512dfd101c1c7bb8b..e654c83ebe40c413b204c711adcefe3f04655e8c 100644
GIT binary patch
delta 47
zcmZn-{vX8U66_LEugSo`IDH~ls)QGNe6Uk|bdwW%fU~CoN4$rp3y<RkF6NEBKQsVR
CnhsR}

delta 53
zcmew#)Edm?66_Mvs>#5>7&ehBRnCDUKG-Qfy2*n*z}eG)Bi_T)g~#y%7c)n^qe~FO
I#`Yf?0Gt;ORR910

diff --git a/tests/data/acpi/q35/DSDT b/tests/data/acpi/q35/DSDT
index 720e8cbbbb10d86a458027b5cb47884bf8c5ee78..fb89ae0ac6d4346e33156e9e4d3718698a0a1a8e 100644
GIT binary patch
delta 57
zcmZ4KxY&`)CD<iou>u1FqxnRxR3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_2)|0LDuXT>t<8

delta 63
zcmZ4NxYCi!CD<ior2+#3<F|=isTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-g%kiuF%ew=

diff --git a/tests/data/acpi/q35/DSDT.acpierst b/tests/data/acpi/q35/DSDT.acpierst
index f26b1f2a19529c508d53ed3f434be0083c18dbab..46fd25400b7c00ee9149ddb64cb5d5bd73f6a82b 100644
GIT binary patch
delta 57
zcmdnxxW$pnCD<ioivj}!<MoMLsY>3$@xe~<(M_KG0nVNV9Pu8WE<BDGxHvfCogpmd
IjnkDC0PF1#K>z>%

delta 63
zcmdnuxXY2tCD<iomjVL=<FtufsTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-l@$O&#SuXO

diff --git a/tests/data/acpi/q35/DSDT.acpihmat b/tests/data/acpi/q35/DSDT.acpihmat
index 86771f17466a85e3c938e86d1a5c6cee7c0ec4b6..61c5bd52a42242e85090934e8e45bf01642609d6 100644
GIT binary patch
delta 57
zcmccSeZiZ{CD<k8f+_<8<ClqCsY>3$@xe~<(M_KG0nVNV9Pu8WE<BDGxHvfCogpmd
IjnnN_0SC_z>;M1&

delta 63
zcmccMea)N8CD<k8nkoYW<K~H6sTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-?NtF`)Di3e

diff --git a/tests/data/acpi/q35/DSDT.acpihmat-noinitiator b/tests/data/acpi/q35/DSDT.acpihmat-noinitiator
index a894a2d16c81fff8ade2c5ddb20858a03169fd47..3aaa2bbdf54a0d0cade14421e84c6ec5a42f96fa 100644
GIT binary patch
delta 57
zcmX@$yvv!(CD<iomm&iL<KBr}sY>3$@xe~<(M_KG0nVNV9Pu8WE<BDGxHvfCogpmd
Ijng$10qkcGMF0Q*

delta 63
zcmdnxe88E@CD<k8fFc6}W6eaaR1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
ON4%p;5W~ianu-8JEfGZk

diff --git a/tests/data/acpi/q35/DSDT.applesmc b/tests/data/acpi/q35/DSDT.applesmc
index 276ae1df511346ccd286216c6de03cd56db410fd..944209adeaa5bbb722431161c404cb51b8209993 100644
GIT binary patch
delta 57
zcmccac+ru|CD<k8q5=a0qxwXyR3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_0|U0N}R}1poj5

delta 63
zcmccUc-@i9CD<k8x&i|O<FkoesTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-9TWg&c@hNx

diff --git a/tests/data/acpi/q35/DSDT.bridge b/tests/data/acpi/q35/DSDT.bridge
index a6765cebb6b95b9f192a04a79ac86c7386e35052..d9938dba8fa5d405f7696c0dbdc24f3ae42ec934 100644
GIT binary patch
delta 57
zcmX>Wdmxs}CD<k8fF1(_WAH?-R3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_9Tc0PFz}K>z>%

delta 63
zcmX>Qdn}gACD<k8m>vTIqtHaIR1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
ON4%p;5W~ia`g#CDJrO|w

diff --git a/tests/data/acpi/q35/DSDT.core-count2 b/tests/data/acpi/q35/DSDT.core-count2
index 2ec11fe3c36d635080af05afa32852fcc1bf10be..b47891ec10be131a59bf404242241c054ac902f8 100644
GIT binary patch
delta 59
zcmezRm+}2yMlP3Nmyq{$3=E7x6S-2AyoKX~o#LaLJoy8hJq<YGJv?1_94~NjaKt-9
LSj-!z$JGG<W26$^

delta 65
zcmaF=m+|XgMlP3NmyoY@3=E8d6S-0~97W=To#LaL{P_c%Jq<YGJv?1_94~NjaKt-9
RSj-&pjxIqA8z;uq0RYB-6W#y-

diff --git a/tests/data/acpi/q35/DSDT.cphp b/tests/data/acpi/q35/DSDT.cphp
index 612c85b1b4c8e4cc642734b1d52f5d5e1e2ec4eb..20955d0aa30120553da35d5a6640055d26255cf9 100644
GIT binary patch
delta 57
zcmezA^4W#UCD<jTSc!pwarQ*6R3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_5j~0rX%I3IG5A

delta 63
zcmezD^3#ROCD<jTQi*|qF=`@Ls)nOTe6Uk|bdx`SfU~CoN4$rp3y<RkE)I@(X9$a#
OBi_*^h+*TzM~VPTZW0Or

diff --git a/tests/data/acpi/q35/DSDT.cxl b/tests/data/acpi/q35/DSDT.cxl
index f049f414f0e789324e82916cfd0aa955211408c4..ee16a861c2de7b7caaf11d91c50fcdf308815233 100644
GIT binary patch
delta 101
zcmX@<z1^G3CD<ioyD9?%qu)fXR3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
l#_2sWTz<+i5OuDTb!AOAua#fTI9XUe6j{7T9waWq1_0uY9y9;|

delta 120
zcmdn)ebSrDCD<k8q$&dgWA{X^R1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
vN4%p;5W~iaJu+M_Dlrh%-jmg3O<BPbo1<kJnUH1D<PkD!7&p5q7P0^U3l<^E

diff --git a/tests/data/acpi/q35/DSDT.dimmpxm b/tests/data/acpi/q35/DSDT.dimmpxm
index 23dabeacb06b3ad4360c1ca142c06a173f82ff51..228374b55bd544116e359f659e546fc66cf8a895 100644
GIT binary patch
delta 57
zcmbR5H`9;HCD<iIQk{W;F>NAOs*<;Ge6Uk|bdx84fU~CoN4$rp3y<RkE)I@(X9$aV
I<Ma+S0Jp&pivR!s

delta 63
zcmbQ~H{XxTCD<iIUY&t~QFS6$s)nOTe6Uk|bdx`SfU~CoN4$rp3y<RkE)I@(X9$a#
OBi_*^h+*Tz4mAJ=(-4aQ

diff --git a/tests/data/acpi/q35/DSDT.ipmibt b/tests/data/acpi/q35/DSDT.ipmibt
index 541bb70522e72dd477f72cba2f71a336f6978de4..45f911ada5645f158f3d6c0c430ec1d52cadc5d8 100644
GIT binary patch
delta 57
zcmez3_|B2bCD<k8odN>`WA;R@R3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_6#N0RDXty#N3J

delta 63
zcmaFo_{EXSCD<k8ivj}!qt-;OR1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
ON4%p;5W~iau?hfI;Ss$6

diff --git a/tests/data/acpi/q35/DSDT.ipmismbus b/tests/data/acpi/q35/DSDT.ipmismbus
index e2d57a331873ada2fcbcdc1f0f7a244f235d7447..e5d6811bee1233d74236453c49060390d74d4416 100644
GIT binary patch
delta 57
zcmZp4`t8W&66_N4TY-Ur@y<l9R3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_3rK0R3tZ;{X5v

delta 63
zcmezE*yzON66_MfsK~&;IBOzTs)nOTe6Uk|bdx`SfU~CoN4$rp3y<RkE)I@(X9$a#
OBi_*^h+*TzECm1|W)R~5

diff --git a/tests/data/acpi/q35/DSDT.ivrs b/tests/data/acpi/q35/DSDT.ivrs
index f26b1f2a19529c508d53ed3f434be0083c18dbab..46fd25400b7c00ee9149ddb64cb5d5bd73f6a82b 100644
GIT binary patch
delta 57
zcmdnxxW$pnCD<ioivj}!<MoMLsY>3$@xe~<(M_KG0nVNV9Pu8WE<BDGxHvfCogpmd
IjnkDC0PF1#K>z>%

delta 63
zcmdnuxXY2tCD<iomjVL=<FtufsTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-l@$O&#SuXO

diff --git a/tests/data/acpi/q35/DSDT.memhp b/tests/data/acpi/q35/DSDT.memhp
index 809d7e2f0fc15351abc99031a118b4012822deea..5ce081187a578ba7145a9ba20d30be36c13b7663 100644
GIT binary patch
delta 57
zcmez2{mGllCD<k8lPUuPqvk}eR3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_5Tw0Q)NtsQ>@~

delta 63
zcmez5{llBfCD<k8hbjXD<BN%0sTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-6IB6&;S#9;

diff --git a/tests/data/acpi/q35/DSDT.mmio64 b/tests/data/acpi/q35/DSDT.mmio64
index ab3fe3c1b56a35d1312779412978cc1d51f05d33..8459b82c958b842cd7b92c2145977634fb9c6e5d 100644
GIT binary patch
delta 57
zcmbR2)$7IO66_MftIEK@_+%nis*<;Ge6Uk|bdx84fU~CoN4$rp3y<RkE)I@(X9$aV
I<MbL80K+>E%>V!Z

delta 63
zcmeD6n(W2p66_KptjfT^xOgI0s)nOTe6Uk|bdx`SfU~CoN4$rp3y<RkE)I@(X9$a#
OBi_*^h+*Tz8WjK)EfCEB

diff --git a/tests/data/acpi/q35/DSDT.multi-bridge b/tests/data/acpi/q35/DSDT.multi-bridge
index 15eef675913d2f10173f96ff6fc42b230d0a6618..1db43a69e4c2affd8bd678bbef4d3c228380288e 100644
GIT binary patch
delta 57
zcmbQ2J|msWCD<iohA{&Jqt8UHR3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_8<F0M@_{xBvhE

delta 63
zcmbP{J};fiCD<ioo-qRhBlkqER1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
ON4%p;5W~ia?8X2pm=L%C

diff --git a/tests/data/acpi/q35/DSDT.noacpihp b/tests/data/acpi/q35/DSDT.noacpihp
index 8cab2f8eb9ae94e0165f3f17857ec7d080fb0e13..8bc16887e1c963c61aaecf71712a09c0554f6d67 100644
GIT binary patch
delta 57
zcmdn!u-bvkCD<iITY-Ur@zg}FR3&fW_+Y2_=q6A80B27Fj(87G7aqq8TpS$n&JY&!
I#_6-<0nD8c4FCWD

delta 63
zcmZ4Ou+f3bCD<jzP=SGgv2!9<s)nOTe6Uk|bdx`SfU~CoN4$rp3y<RkE)I@(X9$a#
OBi_*^h+*TzS@HlMc@Yf&

diff --git a/tests/data/acpi/q35/DSDT.nohpet b/tests/data/acpi/q35/DSDT.nohpet
index becb5f7cad68361463b30be80095ab10966d7c88..c13e45e3612646cc2e30f00b3b7e53335da816ea 100644
GIT binary patch
delta 57
zcmbR3Fx7#}CD<iIRDpqkkzpcNs*<;Ge6Uk|bdx84fU~CoN4$rp3y<RkE)I@(X9$aV
I<MbAJ0Gz`P>i_@%

delta 63
zcmbR0Fx!F4CD<iIT7iLqasNcFR1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
ON4%p;5W~iaE%E>wR}kv}

diff --git a/tests/data/acpi/q35/DSDT.numamem b/tests/data/acpi/q35/DSDT.numamem
index 0cdec0b4c53b2b0e38cd019caab552f66f7728e7..ba6669437e65952f24516ded954b33fe54bdedfb 100644
GIT binary patch
delta 57
zcmZ4QxYCi!CD<ior2+#3<HLzusY>3$@xe~<(M_KG0nVNV9Pu8WE<BDGxHvfCogpmd
IjngF*0Oq9-9{>OV

delta 63
zcmZ4KxZaV=CD<ioy#fOR<ARA?sTz(V@xe~<(M|sR0nVNV9Pu8WE<BDGxHvfCogpk{
Oj(A6xAcl<-B@_TW^AR5a

diff --git a/tests/data/acpi/q35/DSDT.pvpanic-isa b/tests/data/acpi/q35/DSDT.pvpanic-isa
index 6a9904ec947e373520e0135a89c559cb4f57fa7d..6ad42873e91c80cef5a42224cb4d31936dad59b4 100644
GIT binary patch
delta 57
zcmeBk>Tu$633dtLP-I|Wd^wRTRmod8KG-Qfy2+D2z}eG)Bi_T)g~#y%7Y9eYGla#w
IaeBD|0KB*lrT_o{

delta 63
zcmeBh>T}|933dtLQ)FOZTrrU=Rl`vvKG-Qfy2+nEz}eG)Bi_T)g~#y%7Y9eYGla#=
O5%1^{#ISK<xdH$U_7J83

diff --git a/tests/data/acpi/q35/DSDT.tis.tpm12 b/tests/data/acpi/q35/DSDT.tis.tpm12
index 628bf628f6891f906bf872f8916692ba0ccb6877..e381ce4cbf2b11f56a2d0537db4d21acc97450c9 100644
GIT binary patch
delta 57
zcmZp7Yjops33dr#RAyjcOrOY=s^l#kAM6w#-Q>w1;OuF@5%1yY!sB>>i-RNH8Ny=T
IIK4m#0Hll$6aWAK

delta 63
zcmZp4Yj@*v33dr#S7u;fRGY|^s^KUSAM6w#-Q>?7;OuF@5%1yY!sB>>i-RNH8Ny=b
Oh<9`eV%RvbKnVcyZ4eXy

diff --git a/tests/data/acpi/q35/DSDT.tis.tpm2 b/tests/data/acpi/q35/DSDT.tis.tpm2
index 35c6b08068d4d2fb0353802dc2460cc2912c129c..a09253042ce4a715922027245de8a2ab7449c5b7 100644
GIT binary patch
delta 57
zcmZ4JHrtKMCD<iITA6`?QE?(ys*<;Ge6Uk|bdx84fU~CoN4$rp3y<RkE)I@(X9$aV
I<Mb{i0I5C?HUIzs

delta 63
zcmbR3w$P2sCD<iIQJH~(@xer{R1HUw_+Y2_=q7*u0B27Fj(87G7aqq8TpS$n&JY$e
ON4%p;5W~iaT}l8bUJ*6`

diff --git a/tests/data/acpi/q35/DSDT.viot b/tests/data/acpi/q35/DSDT.viot
index 3ad4d26b7f5c183fd3e146b67ebb23662b5108eb..64e81f571120e3eb2b8c6c9545293a78c75b7bbd 100644
GIT binary patch
delta 51
zcmez8`NNaTCD<k8hYAA&<CBS8sl498@xe~<(M_KG0nVP2?PW#TIO0P+T^J^>mvh{B
HPeBC$z1a|1

delta 48
zcmez2`OlNfCD<k8p9%v5<Kl^2seFzi@xe~<(M|sR0nVNVlRwCduyMpYx&$$7oS3cx
E0F6TrOaK4?

diff --git a/tests/data/acpi/q35/DSDT.xapic b/tests/data/acpi/q35/DSDT.xapic
index d4a34e23512c295f73abbe5ef1370fac7a1a06cd..d4acd851c62c956436a436f9fa6d08fc5f370fa7 100644
GIT binary patch
delta 59
zcmeB~&eS%YiOVI}C8VvJfr0VuM6OgNZ{hf0r}*e5PyPUBPXms44^I~!#|vB>9P!Q&
K7W2mGU%LPi*b*cF

delta 65
zcmZph&eSuViOVI}C8VdDfq`+&M6Of~N0Inor}*e5fBpbxPXms44^I~!#|vB>9P!Q&
Q7Bfe@qe~FO#))6M0BnU5Bme*a

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 8911b10650..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,38 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/pc/DSDT",
-"tests/data/acpi/pc/DSDT.acpierst",
-"tests/data/acpi/pc/DSDT.acpihmat",
-"tests/data/acpi/pc/DSDT.bridge",
-"tests/data/acpi/pc/DSDT.cphp",
-"tests/data/acpi/pc/DSDT.dimmpxm",
-"tests/data/acpi/pc/DSDT.hpbridge",
-"tests/data/acpi/pc/DSDT.hpbrroot",
-"tests/data/acpi/pc/DSDT.ipmikcs",
-"tests/data/acpi/pc/DSDT.memhp",
-"tests/data/acpi/pc/DSDT.nohpet",
-"tests/data/acpi/pc/DSDT.numamem",
-"tests/data/acpi/pc/DSDT.roothp",
-"tests/data/acpi/q35/DSDT",
-"tests/data/acpi/q35/DSDT.acpierst",
-"tests/data/acpi/q35/DSDT.acpihmat",
-"tests/data/acpi/q35/DSDT.acpihmat-noinitiator",
-"tests/data/acpi/q35/DSDT.applesmc",
-"tests/data/acpi/q35/DSDT.bridge",
-"tests/data/acpi/q35/DSDT.core-count2",
-"tests/data/acpi/q35/DSDT.cphp",
-"tests/data/acpi/q35/DSDT.cxl",
-"tests/data/acpi/q35/DSDT.dimmpxm",
-"tests/data/acpi/q35/DSDT.ipmibt",
-"tests/data/acpi/q35/DSDT.ipmismbus",
-"tests/data/acpi/q35/DSDT.ivrs",
-"tests/data/acpi/q35/DSDT.memhp",
-"tests/data/acpi/q35/DSDT.mmio64",
-"tests/data/acpi/q35/DSDT.multi-bridge",
-"tests/data/acpi/q35/DSDT.noacpihp",
-"tests/data/acpi/q35/DSDT.nohpet",
-"tests/data/acpi/q35/DSDT.numamem",
-"tests/data/acpi/q35/DSDT.pvpanic-isa",
-"tests/data/acpi/q35/DSDT.tis.tpm12",
-"tests/data/acpi/q35/DSDT.tis.tpm2",
-"tests/data/acpi/q35/DSDT.viot",
-"tests/data/acpi/q35/DSDT.xapic",

From 92f04221379ae5e35f6474c2afed2eb02d552df3 Mon Sep 17 00:00:00 2001
From: David Edmondson <david.edmondson@oracle.com>
Date: Fri, 21 Jul 2023 08:28:20 +0100
Subject: [PATCH 1031/1353] hw/virtio: qmp: add RING_RESET to 'info
 virtio-status'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: David Edmondson <david.edmondson@oracle.com>
Message-Id: <20230721072820.75797-1-david.edmondson@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/virtio/virtio-qmp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
index 3d32dbec8d..7515b0947b 100644
--- a/hw/virtio/virtio-qmp.c
+++ b/hw/virtio/virtio-qmp.c
@@ -79,6 +79,8 @@ static const qmp_virtio_feature_map_t virtio_transport_map[] = {
             "VIRTIO_F_ORDER_PLATFORM: Memory accesses ordered by platform"),
     FEATURE_ENTRY(VIRTIO_F_SR_IOV, \
             "VIRTIO_F_SR_IOV: Device supports single root I/O virtualization"),
+    FEATURE_ENTRY(VIRTIO_F_RING_RESET, \
+            "VIRTIO_F_RING_RESET: Driver can reset a queue individually"),
     /* Virtio ring transport features */
     FEATURE_ENTRY(VIRTIO_RING_F_INDIRECT_DESC, \
             "VIRTIO_RING_F_INDIRECT_DESC: Indirect descriptors supported"),

From c92f4fcafa14890524945073b494937e97112677 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Fri, 21 Jul 2023 15:49:45 +0200
Subject: [PATCH 1032/1353] virtio: Fix packed virtqueue used_idx mask

virtio_queue_packed_set_last_avail_idx() is used by vhost devices to set
the internal queue indices to what has been reported by the vhost
back-end through GET_VRING_BASE.  For packed virtqueues, this
32-bit value is expected to contain both the device's internal avail and
used indices, as well as their respective wrap counters.

To get the used index, we shift the 32-bit value right by 16, and then
apply a mask of 0x7ffff.  That seems to be a typo, because it should be
0x7fff; first of all, the virtio specification says that the maximum
queue size for packed virt queues is 2^15, so the indices cannot exceed
2^15 - 1 anyway, making 0x7fff the correct mask.  Second, the mask
clearly is wrong from context, too, given that (A) `idx & 0x70000` must
be 0 at this point (`idx` is 32 bit and was shifted to the right by 16
already), (B) `idx & 0x8000` is the used_wrap_counter, so should not be
part of the used index, and (C) `vq->used_idx` is a `uint16_t`, so
cannot fit the 0x70000 part of the mask anyway.

This most likely never produced any guest-visible bugs, though, because
for a vhost device, qemu will probably not evaluate the used index
outside of virtio_queue_packed_get_last_avail_idx(), where we
reconstruct the 32-bit value from avail and used indices and their wrap
counters again.  There, it does not matter whether the highest bit of
the used_idx is the used index wrap counter, because we put the wrap
counter exactly in that position anyway.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-Id: <20230721134945.26967-1-hreitz@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: German Maglione <gmaglione@redhat.com>
---
 hw/virtio/virtio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 295a603e58..309038fd46 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3321,7 +3321,7 @@ static void virtio_queue_packed_set_last_avail_idx(VirtIODevice *vdev,
     vq->last_avail_wrap_counter =
         vq->shadow_avail_wrap_counter = !!(idx & 0x8000);
     idx >>= 16;
-    vq->used_idx = idx & 0x7ffff;
+    vq->used_idx = idx & 0x7fff;
     vq->used_wrap_counter = !!(idx & 0x8000);
 }
 

From 348e354417b64c484877354ee7cc66f29fa6c7df Mon Sep 17 00:00:00 2001
From: Yuri Benditovich <yuri.benditovich@daynix.com>
Date: Fri, 28 Jul 2023 11:40:49 +0300
Subject: [PATCH 1033/1353] pci: do not respond config requests after PCI
 device eject

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224964

In migration with VF failover, Windows guest and ACPI hot
unplug we do not need to satisfy config requests, otherwise
the guest immediately detects the device and brings up its
driver. Many network VF's are stuck on the guest PCI bus after
the migration.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Message-Id: <20230728084049.191454-1-yuri.benditovich@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci_host.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 7af8afdcbe..a18aa0a8d4 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -62,6 +62,17 @@ static void pci_adjust_config_limit(PCIBus *bus, uint32_t *limit)
     }
 }
 
+static bool is_pci_dev_ejected(PCIDevice *pci_dev)
+{
+    /*
+     * device unplug was requested and the guest acked it,
+     * so we stop responding config accesses even if the
+     * device is not deleted (failover flow)
+     */
+    return pci_dev && pci_dev->partially_hotplugged &&
+           !pci_dev->qdev.pending_deleted_event;
+}
+
 void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
                                   uint32_t limit, uint32_t val, uint32_t len)
 {
@@ -75,7 +86,7 @@ void pci_host_config_write_common(PCIDevice *pci_dev, uint32_t addr,
      * allowing direct removal of unexposed functions.
      */
     if ((pci_dev->qdev.hotplugged && !pci_get_function_0(pci_dev)) ||
-        !pci_dev->has_power) {
+        !pci_dev->has_power || is_pci_dev_ejected(pci_dev)) {
         return;
     }
 
@@ -100,7 +111,7 @@ uint32_t pci_host_config_read_common(PCIDevice *pci_dev, uint32_t addr,
      * allowing direct removal of unexposed functions.
      */
     if ((pci_dev->qdev.hotplugged && !pci_get_function_0(pci_dev)) ||
-        !pci_dev->has_power) {
+        !pci_dev->has_power || is_pci_dev_ejected(pci_dev)) {
         return ~0x0;
     }
 

From 18f2971ce403008d5e1c2875b483c9d1778143dc Mon Sep 17 00:00:00 2001
From: Li Feng <fengli@smartx.com>
Date: Mon, 31 Jul 2023 20:10:06 +0800
Subject: [PATCH 1034/1353] vhost: fix the fd leak

When the vhost-user reconnect to the backend, the notifer should be
cleanup. Otherwise, the fd resource will be exhausted.

Fixes: f9a09ca3ea ("vhost: add support for configure interrupt")

Signed-off-by: Li Feng <fengli@smartx.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Message-Id: <20230731121018.2856310-2-fengli@smartx.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
---
 hw/virtio/vhost.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index abf0d03c8d..e2f6ffb446 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -2044,6 +2044,8 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
     event_notifier_test_and_clear(
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);
     event_notifier_test_and_clear(&vdev->config_notifier);
+    event_notifier_cleanup(
+        &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);
 
     trace_vhost_dev_stop(hdev, vdev->name, vrings);
 

From cc2a08480e19007c05be8fe5b6893e20448954dc Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Aug 2023 15:57:18 +0200
Subject: [PATCH 1035/1353] hw/i386/intel_iommu: Fix trivial endianness
 problems
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After reading the guest memory with dma_memory_read(), we have
to make sure that we byteswap the little endian data to the host's
byte order.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230802135723.178083-2-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/intel_iommu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index dcc334060c..13fcde8e91 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -756,6 +756,8 @@ static int vtd_get_pdire_from_pdir_table(dma_addr_t pasid_dir_base,
         return -VTD_FR_PASID_TABLE_INV;
     }
 
+    pdire->val = le64_to_cpu(pdire->val);
+
     return 0;
 }
 
@@ -780,6 +782,9 @@ static int vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
                         pe, entry_size, MEMTXATTRS_UNSPECIFIED)) {
         return -VTD_FR_PASID_TABLE_INV;
     }
+    for (size_t i = 0; i < ARRAY_SIZE(pe->val); i++) {
+        pe->val[i] = le64_to_cpu(pe->val[i]);
+    }
 
     /* Do translation type check */
     if (!vtd_pe_type_check(x86_iommu, pe)) {

From 642ba89672279fbdd14016a90da239c85e845d18 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Aug 2023 15:57:19 +0200
Subject: [PATCH 1036/1353] hw/i386/intel_iommu: Fix endianness problems
 related to VTD_IR_TableEntry

The code already tries to do some endianness handling here, but
currently fails badly:
- While it already swaps the data when logging errors / tracing, it fails
  to byteswap the value before e.g. accessing entry->irte.present
- entry->irte.source_id is swapped with le32_to_cpu(), though this is
  a 16-bit value
- The whole union is apparently supposed to be swapped via the 64-bit
  data[2] array, but the struct is a mixture between 32 bit values
  (the first 8 bytes) and 64 bit values (the second 8 bytes), so this
  cannot work as expected.

Fix it by converting the struct to two proper 64-bit bitfields, and
by swapping the values only once for everybody right after reading
the data from memory.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230802135723.178083-3-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/intel_iommu.c         | 16 +++++------
 include/hw/i386/intel_iommu.h | 50 ++++++++++++++++++-----------------
 2 files changed, 34 insertions(+), 32 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 13fcde8e91..4028e32701 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3328,14 +3328,15 @@ static int vtd_irte_get(IntelIOMMUState *iommu, uint16_t index,
         return -VTD_FR_IR_ROOT_INVAL;
     }
 
-    trace_vtd_ir_irte_get(index, le64_to_cpu(entry->data[1]),
-                          le64_to_cpu(entry->data[0]));
+    entry->data[0] = le64_to_cpu(entry->data[0]);
+    entry->data[1] = le64_to_cpu(entry->data[1]);
+
+    trace_vtd_ir_irte_get(index, entry->data[1], entry->data[0]);
 
     if (!entry->irte.present) {
         error_report_once("%s: detected non-present IRTE "
                           "(index=%u, high=0x%" PRIx64 ", low=0x%" PRIx64 ")",
-                          __func__, index, le64_to_cpu(entry->data[1]),
-                          le64_to_cpu(entry->data[0]));
+                          __func__, index, entry->data[1], entry->data[0]);
         return -VTD_FR_IR_ENTRY_P;
     }
 
@@ -3343,14 +3344,13 @@ static int vtd_irte_get(IntelIOMMUState *iommu, uint16_t index,
         entry->irte.__reserved_2) {
         error_report_once("%s: detected non-zero reserved IRTE "
                           "(index=%u, high=0x%" PRIx64 ", low=0x%" PRIx64 ")",
-                          __func__, index, le64_to_cpu(entry->data[1]),
-                          le64_to_cpu(entry->data[0]));
+                          __func__, index, entry->data[1], entry->data[0]);
         return -VTD_FR_IR_IRTE_RSVD;
     }
 
     if (sid != X86_IOMMU_SID_INVALID) {
         /* Validate IRTE SID */
-        source_id = le32_to_cpu(entry->irte.source_id);
+        source_id = entry->irte.source_id;
         switch (entry->irte.sid_vtype) {
         case VTD_SVT_NONE:
             break;
@@ -3404,7 +3404,7 @@ static int vtd_remap_irq_get(IntelIOMMUState *iommu, uint16_t index,
     irq->trigger_mode = irte.irte.trigger_mode;
     irq->vector = irte.irte.vector;
     irq->delivery_mode = irte.irte.delivery_mode;
-    irq->dest = le32_to_cpu(irte.irte.dest_id);
+    irq->dest = irte.irte.dest_id;
     if (!iommu->intr_eime) {
 #define  VTD_IR_APIC_DEST_MASK         (0xff00ULL)
 #define  VTD_IR_APIC_DEST_SHIFT        (8)
diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
index 89dcbc5e1e..7fa0a695c8 100644
--- a/include/hw/i386/intel_iommu.h
+++ b/include/hw/i386/intel_iommu.h
@@ -178,37 +178,39 @@ enum {
 union VTD_IR_TableEntry {
     struct {
 #if HOST_BIG_ENDIAN
-        uint32_t __reserved_1:8;     /* Reserved 1 */
-        uint32_t vector:8;           /* Interrupt Vector */
-        uint32_t irte_mode:1;        /* IRTE Mode */
-        uint32_t __reserved_0:3;     /* Reserved 0 */
-        uint32_t __avail:4;          /* Available spaces for software */
-        uint32_t delivery_mode:3;    /* Delivery Mode */
-        uint32_t trigger_mode:1;     /* Trigger Mode */
-        uint32_t redir_hint:1;       /* Redirection Hint */
-        uint32_t dest_mode:1;        /* Destination Mode */
-        uint32_t fault_disable:1;    /* Fault Processing Disable */
-        uint32_t present:1;          /* Whether entry present/available */
+        uint64_t dest_id:32;         /* Destination ID */
+        uint64_t __reserved_1:8;     /* Reserved 1 */
+        uint64_t vector:8;           /* Interrupt Vector */
+        uint64_t irte_mode:1;        /* IRTE Mode */
+        uint64_t __reserved_0:3;     /* Reserved 0 */
+        uint64_t __avail:4;          /* Available spaces for software */
+        uint64_t delivery_mode:3;    /* Delivery Mode */
+        uint64_t trigger_mode:1;     /* Trigger Mode */
+        uint64_t redir_hint:1;       /* Redirection Hint */
+        uint64_t dest_mode:1;        /* Destination Mode */
+        uint64_t fault_disable:1;    /* Fault Processing Disable */
+        uint64_t present:1;          /* Whether entry present/available */
 #else
-        uint32_t present:1;          /* Whether entry present/available */
-        uint32_t fault_disable:1;    /* Fault Processing Disable */
-        uint32_t dest_mode:1;        /* Destination Mode */
-        uint32_t redir_hint:1;       /* Redirection Hint */
-        uint32_t trigger_mode:1;     /* Trigger Mode */
-        uint32_t delivery_mode:3;    /* Delivery Mode */
-        uint32_t __avail:4;          /* Available spaces for software */
-        uint32_t __reserved_0:3;     /* Reserved 0 */
-        uint32_t irte_mode:1;        /* IRTE Mode */
-        uint32_t vector:8;           /* Interrupt Vector */
-        uint32_t __reserved_1:8;     /* Reserved 1 */
+        uint64_t present:1;          /* Whether entry present/available */
+        uint64_t fault_disable:1;    /* Fault Processing Disable */
+        uint64_t dest_mode:1;        /* Destination Mode */
+        uint64_t redir_hint:1;       /* Redirection Hint */
+        uint64_t trigger_mode:1;     /* Trigger Mode */
+        uint64_t delivery_mode:3;    /* Delivery Mode */
+        uint64_t __avail:4;          /* Available spaces for software */
+        uint64_t __reserved_0:3;     /* Reserved 0 */
+        uint64_t irte_mode:1;        /* IRTE Mode */
+        uint64_t vector:8;           /* Interrupt Vector */
+        uint64_t __reserved_1:8;     /* Reserved 1 */
+        uint64_t dest_id:32;         /* Destination ID */
 #endif
-        uint32_t dest_id;            /* Destination ID */
-        uint16_t source_id;          /* Source-ID */
 #if HOST_BIG_ENDIAN
         uint64_t __reserved_2:44;    /* Reserved 2 */
         uint64_t sid_vtype:2;        /* Source-ID Validation Type */
         uint64_t sid_q:2;            /* Source-ID Qualifier */
+        uint64_t source_id:16;       /* Source-ID */
 #else
+        uint64_t source_id:16;       /* Source-ID */
         uint64_t sid_q:2;            /* Source-ID Qualifier */
         uint64_t sid_vtype:2;        /* Source-ID Validation Type */
         uint64_t __reserved_2:44;    /* Reserved 2 */

From 4572b22cf9ba432fa3955686853c706a1821bbc7 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Aug 2023 15:57:20 +0200
Subject: [PATCH 1037/1353] hw/i386/intel_iommu: Fix struct VTDInvDescIEC on
 big endian hosts

On big endian hosts, we need to reverse the bitfield order in the
struct VTDInvDescIEC, just like it is already done for the other
bitfields in the various structs of the intel-iommu device.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230802135723.178083-4-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/intel_iommu_internal.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index 2e61eec2f5..e1450c5cfe 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -321,12 +321,21 @@ typedef enum VTDFaultReason {
 
 /* Interrupt Entry Cache Invalidation Descriptor: VT-d 6.5.2.7. */
 struct VTDInvDescIEC {
+#if HOST_BIG_ENDIAN
+    uint64_t reserved_2:16;
+    uint64_t index:16;          /* Start index to invalidate */
+    uint64_t index_mask:5;      /* 2^N for continuous int invalidation */
+    uint64_t resved_1:22;
+    uint64_t granularity:1;     /* If set, it's global IR invalidation */
+    uint64_t type:4;            /* Should always be 0x4 */
+#else
     uint32_t type:4;            /* Should always be 0x4 */
     uint32_t granularity:1;     /* If set, it's global IR invalidation */
     uint32_t resved_1:22;
     uint32_t index_mask:5;      /* 2^N for continuous int invalidation */
     uint32_t index:16;          /* Start index to invalidate */
     uint32_t reserved_2:16;
+#endif
 };
 typedef struct VTDInvDescIEC VTDInvDescIEC;
 

From fcd8027423300b201b37842b88393dc5c6c8ee9e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Aug 2023 15:57:21 +0200
Subject: [PATCH 1038/1353] hw/i386/intel_iommu: Fix index calculation in
 vtd_interrupt_remap_msi()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The values in "addr" are populated locally in this function in host
endian byte order, so we must not swap the index_l field here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230802135723.178083-5-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/intel_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 4028e32701..3ca71df369 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3459,7 +3459,7 @@ static int vtd_interrupt_remap_msi(IntelIOMMUState *iommu,
         goto out;
     }
 
-    index = addr.addr.index_h << 15 | le16_to_cpu(addr.addr.index_l);
+    index = addr.addr.index_h << 15 | addr.addr.index_l;
 
 #define  VTD_IR_MSI_DATA_SUBHANDLE       (0x0000ffff)
 #define  VTD_IR_MSI_DATA_RESERVED        (0xffff0000)

From 37cf5cecb039a063c0abe3b51ae30f969e73aa84 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Aug 2023 15:57:22 +0200
Subject: [PATCH 1039/1353] hw/i386/x86-iommu: Fix endianness issue in
 x86_iommu_irq_to_msi_message()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The values in "msg" are assembled in host endian byte order (the other
field are also not swapped), so we must not swap the __addr_head here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230802135723.178083-6-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 hw/i386/x86-iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/x86-iommu.c b/hw/i386/x86-iommu.c
index 01d11325a6..726e9e1d16 100644
--- a/hw/i386/x86-iommu.c
+++ b/hw/i386/x86-iommu.c
@@ -63,7 +63,7 @@ void x86_iommu_irq_to_msi_message(X86IOMMUIrq *irq, MSIMessage *msg_out)
     msg.redir_hint = irq->redir_hint;
     msg.dest = irq->dest;
     msg.__addr_hi = irq->dest & 0xffffff00;
-    msg.__addr_head = cpu_to_le32(0xfee);
+    msg.__addr_head = 0xfee;
     /* Keep this from original MSI address bits */
     msg.__not_used = irq->msi_addr_last_bits;
 

From e1e56c07d1fa24aa37a7e89e6633768fc8ea8705 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 2 Aug 2023 15:57:23 +0200
Subject: [PATCH 1040/1353] include/hw/i386/x86-iommu: Fix struct
 X86IOMMU_MSIMessage for big endian hosts

The first bitfield here is supposed to be used as a 64-bit equivalent
to the "uint64_t msi_addr" in the union. To make this work correctly
on big endian hosts, too, the __addr_hi field has to be part of the
bitfield, and the the bitfield members must be declared with "uint64_t"
instead of "uint32_t" - otherwise the values are placed in the wrong
bytes on big endian hosts.

Same applies to the 32-bit "msi_data" field: __resved1 must be part
of the bitfield, and the members must be declared with "uint32_t"
instead of "uint16_t".

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230802135723.178083-7-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 include/hw/i386/x86-iommu.h | 50 +++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 24 deletions(-)

diff --git a/include/hw/i386/x86-iommu.h b/include/hw/i386/x86-iommu.h
index 8d8d53b18b..bfd21649d0 100644
--- a/include/hw/i386/x86-iommu.h
+++ b/include/hw/i386/x86-iommu.h
@@ -87,40 +87,42 @@ struct X86IOMMU_MSIMessage {
     union {
         struct {
 #if HOST_BIG_ENDIAN
-            uint32_t __addr_head:12; /* 0xfee */
-            uint32_t dest:8;
-            uint32_t __reserved:8;
-            uint32_t redir_hint:1;
-            uint32_t dest_mode:1;
-            uint32_t __not_used:2;
+            uint64_t __addr_hi:32;
+            uint64_t __addr_head:12; /* 0xfee */
+            uint64_t dest:8;
+            uint64_t __reserved:8;
+            uint64_t redir_hint:1;
+            uint64_t dest_mode:1;
+            uint64_t __not_used:2;
 #else
-            uint32_t __not_used:2;
-            uint32_t dest_mode:1;
-            uint32_t redir_hint:1;
-            uint32_t __reserved:8;
-            uint32_t dest:8;
-            uint32_t __addr_head:12; /* 0xfee */
+            uint64_t __not_used:2;
+            uint64_t dest_mode:1;
+            uint64_t redir_hint:1;
+            uint64_t __reserved:8;
+            uint64_t dest:8;
+            uint64_t __addr_head:12; /* 0xfee */
+            uint64_t __addr_hi:32;
 #endif
-            uint32_t __addr_hi;
         } QEMU_PACKED;
         uint64_t msi_addr;
     };
     union {
         struct {
 #if HOST_BIG_ENDIAN
-            uint16_t trigger_mode:1;
-            uint16_t level:1;
-            uint16_t __resved:3;
-            uint16_t delivery_mode:3;
-            uint16_t vector:8;
+            uint32_t __resved1:16;
+            uint32_t trigger_mode:1;
+            uint32_t level:1;
+            uint32_t __resved:3;
+            uint32_t delivery_mode:3;
+            uint32_t vector:8;
 #else
-            uint16_t vector:8;
-            uint16_t delivery_mode:3;
-            uint16_t __resved:3;
-            uint16_t level:1;
-            uint16_t trigger_mode:1;
+            uint32_t vector:8;
+            uint32_t delivery_mode:3;
+            uint32_t __resved:3;
+            uint32_t level:1;
+            uint32_t trigger_mode:1;
+            uint32_t __resved1:16;
 #endif
-            uint16_t __resved1;
         } QEMU_PACKED;
         uint32_t msi_data;
     };

From 9d38a8434721a6479fe03fb5afb150ca793d3980 Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@bytedance.com>
Date: Thu, 3 Aug 2023 10:43:13 +0800
Subject: [PATCH 1041/1353] virtio-crypto: verify src&dst buffer length for sym
 request

For symmetric algorithms, the length of ciphertext must be as same
as the plaintext.
The missing verification of the src_len and the dst_len in
virtio_crypto_sym_op_helper() may lead buffer overflow/divulged.

This patch is originally written by Yiming Tao for QEMU-SECURITY,
resend it(a few changes of error message) in qemu-devel.

Fixes: CVE-2023-3180
Fixes: 04b9b37edda("virtio-crypto: add data queue processing handler")
Cc: Gonglei <arei.gonglei@huawei.com>
Cc: Mauro Matteo Cascella <mcascell@redhat.com>
Cc: Yiming Tao <taoym@zju.edu.cn>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20230803024314.29962-2-pizhenwei@bytedance.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-crypto.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 44faf5a522..13aec771e1 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -634,6 +634,11 @@ virtio_crypto_sym_op_helper(VirtIODevice *vdev,
         return NULL;
     }
 
+    if (unlikely(src_len != dst_len)) {
+        virtio_error(vdev, "sym request src len is different from dst len");
+        return NULL;
+    }
+
     max_len = (uint64_t)iv_len + aad_len + src_len + dst_len + hash_result_len;
     if (unlikely(max_len > vcrypto->conf.max_size)) {
         virtio_error(vdev, "virtio-crypto too big length");

From 15b11a1da6a4b7c6b8bb37883f52b544dee2b8fd Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@bytedance.com>
Date: Thu, 3 Aug 2023 10:43:14 +0800
Subject: [PATCH 1042/1353] cryptodev: Handle unexpected request to avoid crash

Generally guest side should discover which services the device is
able to offer, then do requests on device.

However it's also possible to break this rule in a guest. Handle
unexpected request here to avoid NULL pointer dereference.

Fixes: e7a775fd ('cryptodev: Account statistics')
Cc: Gonglei <arei.gonglei@huawei.com>
Cc: Mauro Matteo Cascella <mcascell@redhat.com>
Cc: Xiao Lei <nop.leixiao@gmail.com>
Cc: Yongkang Jia <kangel@zju.edu.cn>
Reported-by: Yiming Tao <taoym@zju.edu.cn>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20230803024314.29962-3-pizhenwei@bytedance.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 backends/cryptodev.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/backends/cryptodev.c b/backends/cryptodev.c
index 7d29517843..4d183f7237 100644
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -191,6 +191,11 @@ static int cryptodev_backend_account(CryptoDevBackend *backend,
     if (algtype == QCRYPTODEV_BACKEND_ALG_ASYM) {
         CryptoDevBackendAsymOpInfo *asym_op_info = op_info->u.asym_op_info;
         len = asym_op_info->src_len;
+
+        if (unlikely(!backend->asym_stat)) {
+            error_report("cryptodev: Unexpected asym operation");
+            return -VIRTIO_CRYPTO_NOTSUPP;
+        }
         switch (op_info->op_code) {
         case VIRTIO_CRYPTO_AKCIPHER_ENCRYPT:
             CryptodevAsymStatIncEncrypt(backend, len);
@@ -210,6 +215,11 @@ static int cryptodev_backend_account(CryptoDevBackend *backend,
     } else if (algtype == QCRYPTODEV_BACKEND_ALG_SYM) {
         CryptoDevBackendSymOpInfo *sym_op_info = op_info->u.sym_op_info;
         len = sym_op_info->src_len;
+
+        if (unlikely(!backend->sym_stat)) {
+            error_report("cryptodev: Unexpected sym operation");
+            return -VIRTIO_CRYPTO_NOTSUPP;
+        }
         switch (op_info->op_code) {
         case VIRTIO_CRYPTO_CIPHER_ENCRYPT:
             CryptodevSymStatIncEncrypt(backend, len);

From f8c0fd9804f435a20c3baa4c0c77ba9a02af24ef Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sun, 30 Jul 2023 18:30:19 +0200
Subject: [PATCH 1043/1353] target/hppa: Move iaoq registers and thus reduce
 generated code size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On hppa the Instruction Address Offset Queue (IAOQ) registers specifies
the next to-be-executed instructions addresses. Each generated TB writes those
registers at least once, so those registers are used heavily in generated
code.

Looking at the generated assembly, for a x86-64 host this code
to write the address $0x7ffe826f into iaoq_f is generated:
0x7f73e8000184:  c7 85 d4 01 00 00 6f 82  movl     $0x7ffe826f, 0x1d4(%rbp)
0x7f73e800018c:  fe 7f
0x7f73e800018e:  c7 85 d8 01 00 00 73 82  movl     $0x7ffe8273, 0x1d8(%rbp)
0x7f73e8000196:  fe 7f

With the trivial change, by moving the variables iaoq_f and iaoq_b to
the top of struct CPUArchState, the offset to %rbp is reduced (from
0x1d4 to 0), which allows the x86-64 tcg to generate 3 bytes less of
generated code per move instruction:
0x7fc1e800018c:  c7 45 00 6f 82 fe 7f     movl     $0x7ffe826f, (%rbp)
0x7fc1e8000193:  c7 45 04 73 82 fe 7f     movl     $0x7ffe8273, 4(%rbp)

Overall this is a reduction of generated code (not a reduction of
number of instructions).
A test run with checks the generated code size by running "/bin/ls"
with qemu-user shows that the code size shrinks from 1616767 to 1569273
bytes, which is ~97% of the former size.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: qemu-stable@nongnu.org
---
 target/hppa/cpu.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 9fe79b1242..75c5c0ccf7 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -168,6 +168,9 @@ typedef struct {
 } hppa_tlb_entry;
 
 typedef struct CPUArchState {
+    target_ureg iaoq_f;      /* front */
+    target_ureg iaoq_b;      /* back, aka next instruction */
+
     target_ureg gr[32];
     uint64_t fr[32];
     uint64_t sr[8];          /* stored shifted into place for gva */
@@ -186,8 +189,6 @@ typedef struct CPUArchState {
     target_ureg psw_cb;      /* in least significant bit of next nibble */
     target_ureg psw_cb_msb;  /* boolean */
 
-    target_ureg iaoq_f;      /* front */
-    target_ureg iaoq_b;      /* back, aka next instruction */
     uint64_t iasq_f;
     uint64_t iasq_b;
 

From b2ea6450d8e1336a33eb958ccc64604bc35a43dd Mon Sep 17 00:00:00 2001
From: Matt Borgerson <contact@mborgerson.com>
Date: Thu, 13 Jul 2023 00:29:01 -0700
Subject: [PATCH 1044/1353] target/i386: Check CR0.TS before enter_mmx

When CR0.TS=1, execution of x87 FPU, MMX, and some SSE instructions will
cause a Device Not Available (DNA) exception (#NM). System software uses
this exception event to lazily context switch FPU state.

Before this patch, enter_mmx helpers may be generated just before #NM
generation, prematurely resetting FPU state before the guest has a
chance to save it.

Signed-off-by: Matt Borgerson <contact@mborgerson.com>
Message-ID: <CADc=-s5F10muEhLs4f3mxqsEPAHWj0XFfOC2sfFMVHrk9fcpMg@mail.gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/decode-new.c.inc | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 46afd9960b..8f93a239dd 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -1803,16 +1803,18 @@ static void disas_insn_new(DisasContext *s, CPUState *cpu, int b)
         }
         break;
 
-    case X86_SPECIAL_MMX:
-        if (!(s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
-            gen_helper_enter_mmx(cpu_env);
-        }
+    default:
         break;
     }
 
     if (!validate_vex(s, &decode)) {
         return;
     }
+    if (decode.e.special == X86_SPECIAL_MMX &&
+        !(s->prefix & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA))) {
+        gen_helper_enter_mmx(cpu_env);
+    }
+
     if (decode.op[0].has_ea || decode.op[1].has_ea || decode.op[2].has_ea) {
         gen_load_ea(s, &decode.mem, decode.e.vex_class == 12);
     }

From d9ab1f1f4d79683b2db00b0995fa65530c535972 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 4 Aug 2023 13:55:22 +0200
Subject: [PATCH 1045/1353] ci: install meson in CirrusCI KVM build environment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

scripts/archive-source.sh needs meson in order to download the subprojects,
therefore meson needs to be part of the host environment in which VM-based
build jobs run.

Fixes: 2019cabfee0 ("meson: subprojects: replace submodules with wrap files", 2023-06-06)
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/cirrus/kvm-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/cirrus/kvm-build.yml b/.gitlab-ci.d/cirrus/kvm-build.yml
index 4334fabf39..a93881aa8b 100644
--- a/.gitlab-ci.d/cirrus/kvm-build.yml
+++ b/.gitlab-ci.d/cirrus/kvm-build.yml
@@ -15,7 +15,7 @@ env:
     folder: $HOME/.cache/qemu-vm
   install_script:
     - dnf update -y
-    - dnf install -y git make openssh-clients qemu-img qemu-system-x86 wget
+    - dnf install -y git make openssh-clients qemu-img qemu-system-x86 wget meson
   clone_script:
     - git clone --depth 100 "$CI_REPOSITORY_URL" .
     - git fetch origin "$CI_COMMIT_REF_NAME"

From 19ac7b29f81196dc20c9d97cf36f9004fa7e60c4 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 19 Jul 2023 02:32:54 +0200
Subject: [PATCH 1046/1353] ppc/pegasos2: Fix reset state of USB functions

The original non-free board firmware sets the command register of the
USB functions to 7 and some guests rely on this for working USB. Match
what the board firmware does when using VOF instead.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <06a2b864431425f23d1f2b5abf0c027819ac11c6.1689725688.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pegasos2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 4447bbe8ec..4a2ab35f19 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -324,9 +324,13 @@ static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
 
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 2) << 8) |
                               PCI_INTERRUPT_LINE, 2, 0x409);
+    pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 2) << 8) |
+                              PCI_COMMAND, 2, 0x7);
 
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 3) << 8) |
                               PCI_INTERRUPT_LINE, 2, 0x409);
+    pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 3) << 8) |
+                              PCI_COMMAND, 2, 0x7);
 
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
                               PCI_INTERRUPT_LINE, 2, 0x9);

From aa1133475e0fdea0ab7d994c0a62b74d575cfcce Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 19 Jul 2023 02:32:55 +0200
Subject: [PATCH 1047/1353] ppc/pegasos2: Fix reg property of ROM BARs

The register offset of the ROM BAR is 0x30 not 0x28. This fixes the
reg property entry of the ROM region in the device tree.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <6abd73b1211f9d0776dfa5d71d6294f17eecb426.1689725688.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pegasos2.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 4a2ab35f19..8ed13a42a2 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -766,7 +766,11 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
         if (!d->io_regions[i].size) {
             continue;
         }
-        cells[j] = cpu_to_be32(d->devfn << 8 | (PCI_BASE_ADDRESS_0 + i * 4));
+        cells[j] = PCI_BASE_ADDRESS_0 + i * 4;
+        if (cells[j] == 0x28) {
+            cells[j] = 0x30;
+        }
+        cells[j] = cpu_to_be32(d->devfn << 8 | cells[j]);
         if (d->io_regions[i].type & PCI_BASE_ADDRESS_SPACE_IO) {
             cells[j] |= cpu_to_be32(1 << 24);
         } else {

From 889dd6c525852e341c737aaca273a92fae05886f Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 19 Jul 2023 02:32:56 +0200
Subject: [PATCH 1048/1353] ppc/pegasos2: Fix naming of device tree nodes

The board firmware names devices by their class so match that for
common devices. Also make sure the /rtas node has a name. This is
needed because VOF otherwise does not include it in results got by
nextprop which is how AmigaOS queries it and fails if no name property
is found.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <808ade37aa141563d1ee349254151672bf7a5d59.1689725688.git.balaton@eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pegasos2.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 8ed13a42a2..6475acfbed 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -739,6 +739,13 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
                                      pci_get_word(&d->config[PCI_VENDOR_ID]),
                                      pci_get_word(&d->config[PCI_DEVICE_ID]));
 
+    if (pci_get_word(&d->config[PCI_CLASS_DEVICE])  ==
+        PCI_CLASS_NETWORK_ETHERNET) {
+        name = "ethernet";
+    } else if (pci_get_word(&d->config[PCI_CLASS_DEVICE]) >> 8 ==
+        PCI_BASE_CLASS_DISPLAY) {
+        name = "display";
+    }
     for (i = 0; device_map[i].id; i++) {
         if (!strcmp(pn, device_map[i].id)) {
             name = device_map[i].name;
@@ -929,6 +936,7 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-display-device", 0);
     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-size", 20);
     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-version", 1);
+    qemu_fdt_setprop_string(fdt, "/rtas", "name", "rtas");
 
     /* cpus */
     qemu_fdt_add_subnode(fdt, "/cpus");

From 6b6d4c1a0116c51098975131c16ecf7cefe68e79 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 22 Jul 2023 00:13:20 +0200
Subject: [PATCH 1049/1353] ppc/pegasos2: Fix reg property of 64 bit BARs in
 device tree

The board firmware handles this correctly following the Open Firmware
standard which we missed. This fixes 64 bit BARs when using VOF.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Message-ID: <20230721221320.1311E7456AB@zero.eik.bme.hu>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/pegasos2.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 6475acfbed..075367d94d 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -781,7 +781,11 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
         if (d->io_regions[i].type & PCI_BASE_ADDRESS_SPACE_IO) {
             cells[j] |= cpu_to_be32(1 << 24);
         } else {
-            cells[j] |= cpu_to_be32(2 << 24);
+            if (d->io_regions[i].type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
+                cells[j] |= cpu_to_be32(3 << 24);
+            } else {
+                cells[j] |= cpu_to_be32(2 << 24);
+            }
             if (d->io_regions[i].type & PCI_BASE_ADDRESS_MEM_PREFETCH) {
                 cells[j] |= cpu_to_be32(4 << 28);
             }

From 9201af096962a1967ce5d0b270ed16ae4edd3db6 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 27 Jul 2023 04:22:25 +1000
Subject: [PATCH 1050/1353] target/ppc: Implement ASDR register for ISA v3.0
 for HPT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ASDR register was introduced in ISA v3.0. It has not been
implemented for HPT. With HPT, ASDR is the format of the slbmte RS
operand (containing VSID), which matches the ppc_slb_t field.

Fixes: 3367c62f522b ("target/ppc: Support for POWER9 native hash")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230726182230.433945-2-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/mmu-hash64.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index 900f906990..a0c90df3ce 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -770,7 +770,8 @@ static bool ppc_hash64_use_vrma(CPUPPCState *env)
     }
 }
 
-static void ppc_hash64_set_isi(CPUState *cs, int mmu_idx, uint64_t error_code)
+static void ppc_hash64_set_isi(CPUState *cs, int mmu_idx, uint64_t slb_vsid,
+                               uint64_t error_code)
 {
     CPUPPCState *env = &POWERPC_CPU(cs)->env;
     bool vpm;
@@ -782,13 +783,15 @@ static void ppc_hash64_set_isi(CPUState *cs, int mmu_idx, uint64_t error_code)
     }
     if (vpm && !mmuidx_hv(mmu_idx)) {
         cs->exception_index = POWERPC_EXCP_HISI;
+        env->spr[SPR_ASDR] = slb_vsid;
     } else {
         cs->exception_index = POWERPC_EXCP_ISI;
     }
     env->error_code = error_code;
 }
 
-static void ppc_hash64_set_dsi(CPUState *cs, int mmu_idx, uint64_t dar, uint64_t dsisr)
+static void ppc_hash64_set_dsi(CPUState *cs, int mmu_idx, uint64_t slb_vsid,
+                               uint64_t dar, uint64_t dsisr)
 {
     CPUPPCState *env = &POWERPC_CPU(cs)->env;
     bool vpm;
@@ -802,6 +805,7 @@ static void ppc_hash64_set_dsi(CPUState *cs, int mmu_idx, uint64_t dar, uint64_t
         cs->exception_index = POWERPC_EXCP_HDSI;
         env->spr[SPR_HDAR] = dar;
         env->spr[SPR_HDSISR] = dsisr;
+        env->spr[SPR_ASDR] = slb_vsid;
     } else {
         cs->exception_index = POWERPC_EXCP_DSI;
         env->spr[SPR_DAR] = dar;
@@ -963,13 +967,13 @@ bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
                 }
                 switch (access_type) {
                 case MMU_INST_FETCH:
-                    ppc_hash64_set_isi(cs, mmu_idx, SRR1_PROTFAULT);
+                    ppc_hash64_set_isi(cs, mmu_idx, 0, SRR1_PROTFAULT);
                     break;
                 case MMU_DATA_LOAD:
-                    ppc_hash64_set_dsi(cs, mmu_idx, eaddr, DSISR_PROTFAULT);
+                    ppc_hash64_set_dsi(cs, mmu_idx, 0, eaddr, DSISR_PROTFAULT);
                     break;
                 case MMU_DATA_STORE:
-                    ppc_hash64_set_dsi(cs, mmu_idx, eaddr,
+                    ppc_hash64_set_dsi(cs, mmu_idx, 0, eaddr,
                                        DSISR_PROTFAULT | DSISR_ISSTORE);
                     break;
                 default:
@@ -1022,7 +1026,7 @@ bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
     /* 3. Check for segment level no-execute violation */
     if (access_type == MMU_INST_FETCH && (slb->vsid & SLB_VSID_N)) {
         if (guest_visible) {
-            ppc_hash64_set_isi(cs, mmu_idx, SRR1_NOEXEC_GUARD);
+            ppc_hash64_set_isi(cs, mmu_idx, slb->vsid, SRR1_NOEXEC_GUARD);
         }
         return false;
     }
@@ -1035,13 +1039,14 @@ bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
         }
         switch (access_type) {
         case MMU_INST_FETCH:
-            ppc_hash64_set_isi(cs, mmu_idx, SRR1_NOPTE);
+            ppc_hash64_set_isi(cs, mmu_idx, slb->vsid, SRR1_NOPTE);
             break;
         case MMU_DATA_LOAD:
-            ppc_hash64_set_dsi(cs, mmu_idx, eaddr, DSISR_NOPTE);
+            ppc_hash64_set_dsi(cs, mmu_idx, slb->vsid, eaddr, DSISR_NOPTE);
             break;
         case MMU_DATA_STORE:
-            ppc_hash64_set_dsi(cs, mmu_idx, eaddr, DSISR_NOPTE | DSISR_ISSTORE);
+            ppc_hash64_set_dsi(cs, mmu_idx, slb->vsid, eaddr,
+                               DSISR_NOPTE | DSISR_ISSTORE);
             break;
         default:
             g_assert_not_reached();
@@ -1075,7 +1080,7 @@ bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
             if (PAGE_EXEC & ~amr_prot) {
                 srr1 |= SRR1_IAMR; /* Access violates virt pg class key prot */
             }
-            ppc_hash64_set_isi(cs, mmu_idx, srr1);
+            ppc_hash64_set_isi(cs, mmu_idx, slb->vsid, srr1);
         } else {
             int dsisr = 0;
             if (need_prot & ~pp_prot) {
@@ -1087,7 +1092,7 @@ bool ppc_hash64_xlate(PowerPCCPU *cpu, vaddr eaddr, MMUAccessType access_type,
             if (need_prot & ~amr_prot) {
                 dsisr |= DSISR_AMR;
             }
-            ppc_hash64_set_dsi(cs, mmu_idx, eaddr, dsisr);
+            ppc_hash64_set_dsi(cs, mmu_idx, slb->vsid, eaddr, dsisr);
         }
         return false;
     }

From 9915dac4847f3cc5ffd36e4c374a4eec83fe09b5 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 27 Jul 2023 04:22:27 +1000
Subject: [PATCH 1051/1353] target/ppc: Fix pending HDEC when entering PM state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HDEC is defined to not wake from PM state. There is a check in the HDEC
timer to avoid setting the interrupt if we are in a PM state, but no
check on PM entry to lower HDEC if it already fired. This can cause a
HDECR wake up and  QEMU abort with unsupported exception in Power Save
mode.

Fixes: 4b236b621bf ("ppc: Initial HDEC support")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230726182230.433945-4-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/excp_helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 003805b202..9aa8e46566 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -2685,6 +2685,12 @@ void helper_pminsn(CPUPPCState *env, uint32_t insn)
     env->resume_as_sreset = (insn != PPC_PM_STOP) ||
         (env->spr[SPR_PSSCR] & PSSCR_EC);
 
+    /* HDECR is not to wake from PM state, it may have already fired */
+    if (env->resume_as_sreset) {
+        PowerPCCPU *cpu = env_archcpu(env);
+        ppc_set_irq(cpu, PPC_INTERRUPT_HDECR, 0);
+    }
+
     ppc_maybe_interrupt(env);
 }
 #endif /* defined(TARGET_PPC64) */

From 0e2a3ec36885f6d79a96230f582d4455878c6373 Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Sun, 30 Jul 2023 21:18:42 +1000
Subject: [PATCH 1052/1353] target/ppc: Fix VRMA page size for ISA v3.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Until v2.07s, the VRMA page size (L||LP) was encoded in LPCR[VRMASD].
In v3.0 that moved to the partition table PS field.

The powernv machine can now run KVM HPT guests on POWER9/10 CPUs with
this fix and the patch to add ASDR.

Fixes: 3367c62f522b ("target/ppc: Support for POWER9 native hash")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-ID: <20230730111842.39292-1-npiggin@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 target/ppc/mmu-hash64.c | 45 +++++++++++++++++++++++++++++++++++------
 target/ppc/mmu-hash64.h |  5 +++++
 2 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/target/ppc/mmu-hash64.c b/target/ppc/mmu-hash64.c
index a0c90df3ce..d645c0bb94 100644
--- a/target/ppc/mmu-hash64.c
+++ b/target/ppc/mmu-hash64.c
@@ -874,12 +874,46 @@ static target_ulong rmls_limit(PowerPCCPU *cpu)
     return rma_sizes[rmls];
 }
 
-static int build_vrma_slbe(PowerPCCPU *cpu, ppc_slb_t *slb)
+/* Return the LLP in SLB_VSID format */
+static uint64_t get_vrma_llp(PowerPCCPU *cpu)
 {
     CPUPPCState *env = &cpu->env;
-    target_ulong lpcr = env->spr[SPR_LPCR];
-    uint32_t vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT;
-    target_ulong vsid = SLB_VSID_VRMA | ((vrmasd << 4) & SLB_VSID_LLP_MASK);
+    uint64_t llp;
+
+    if (env->mmu_model == POWERPC_MMU_3_00) {
+        ppc_v3_pate_t pate;
+        uint64_t ps, l, lp;
+
+        /*
+         * ISA v3.0 removes the LPCR[VRMASD] field and puts the VRMA base
+         * page size (L||LP equivalent) in the PS field in the HPT partition
+         * table entry.
+         */
+        if (!ppc64_v3_get_pate(cpu, cpu->env.spr[SPR_LPIDR], &pate)) {
+            error_report("Bad VRMA with no partition table entry");
+            return 0;
+        }
+        ps = PATE0_GET_PS(pate.dw0);
+        /* PS has L||LP in 3 consecutive bits, put them into SLB LLP format */
+        l = (ps >> 2) & 0x1;
+        lp = ps & 0x3;
+        llp = (l << SLB_VSID_L_SHIFT) | (lp << SLB_VSID_LP_SHIFT);
+
+    } else {
+        uint64_t lpcr = env->spr[SPR_LPCR];
+        target_ulong vrmasd = (lpcr & LPCR_VRMASD) >> LPCR_VRMASD_SHIFT;
+
+        /* VRMASD LLP matches SLB format, just shift and mask it */
+        llp = (vrmasd << SLB_VSID_LP_SHIFT) & SLB_VSID_LLP_MASK;
+    }
+
+    return llp;
+}
+
+static int build_vrma_slbe(PowerPCCPU *cpu, ppc_slb_t *slb)
+{
+    uint64_t llp = get_vrma_llp(cpu);
+    target_ulong vsid = SLB_VSID_VRMA | llp;
     int i;
 
     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
@@ -897,8 +931,7 @@ static int build_vrma_slbe(PowerPCCPU *cpu, ppc_slb_t *slb)
         }
     }
 
-    error_report("Bad page size encoding in LPCR[VRMASD]; LPCR=0x"
-                 TARGET_FMT_lx, lpcr);
+    error_report("Bad VRMA page size encoding 0x" TARGET_FMT_lx, llp);
 
     return -1;
 }
diff --git a/target/ppc/mmu-hash64.h b/target/ppc/mmu-hash64.h
index 1496955d38..de653fcae5 100644
--- a/target/ppc/mmu-hash64.h
+++ b/target/ppc/mmu-hash64.h
@@ -41,8 +41,10 @@ void ppc_hash64_finalize(PowerPCCPU *cpu);
 #define SLB_VSID_KP             0x0000000000000400ULL
 #define SLB_VSID_N              0x0000000000000200ULL /* no-execute */
 #define SLB_VSID_L              0x0000000000000100ULL
+#define SLB_VSID_L_SHIFT        PPC_BIT_NR(55)
 #define SLB_VSID_C              0x0000000000000080ULL /* class */
 #define SLB_VSID_LP             0x0000000000000030ULL
+#define SLB_VSID_LP_SHIFT       PPC_BIT_NR(59)
 #define SLB_VSID_ATTR           0x0000000000000FFFULL
 #define SLB_VSID_LLP_MASK       (SLB_VSID_L | SLB_VSID_LP)
 #define SLB_VSID_4K             0x0000000000000000ULL
@@ -58,6 +60,9 @@ void ppc_hash64_finalize(PowerPCCPU *cpu);
 #define SDR_64_HTABSIZE        0x000000000000001FULL
 
 #define PATE0_HTABORG           0x0FFFFFFFFFFC0000ULL
+#define PATE0_PS                PPC_BITMASK(56, 58)
+#define PATE0_GET_PS(dw0)       (((dw0) & PATE0_PS) >> PPC_BIT_NR(58))
+
 #define HPTES_PER_GROUP         8
 #define HASH_PTE_SIZE_64        16
 #define HASH_PTEG_SIZE_64       (HASH_PTE_SIZE_64 * HPTES_PER_GROUP)

From 1966855e567686e6547b058d8664aefd0e969a0f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 1 Aug 2023 07:55:38 -0700
Subject: [PATCH 1053/1353] accel/tcg: Adjust parameters and locking with
 do_{ld,st}_mmio_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace MMULookupPageData* with CPUTLBEntryFull, addr, size.
Move QEMU_IOTHREAD_LOCK_GUARD to the caller.

This simplifies the usage from do_ld16_beN and do_st16_leN, where
we weren't locking the entire operation, and required hoop jumping
for passing addr and size.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 67 +++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 33 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index ba44501a7c..23386ecfde 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2066,24 +2066,22 @@ static void *atomic_mmu_lookup(CPUArchState *env, vaddr addr, MemOpIdx oi,
 /**
  * do_ld_mmio_beN:
  * @env: cpu context
- * @p: translation parameters
+ * @full: page parameters
  * @ret_be: accumulated data
+ * @addr: virtual address
+ * @size: number of bytes
  * @mmu_idx: virtual address context
  * @ra: return address into tcg generated code, or 0
+ * Context: iothread lock held
  *
- * Load @p->size bytes from @p->addr, which is memory-mapped i/o.
+ * Load @size bytes from @addr, which is memory-mapped i/o.
  * The bytes are concatenated in big-endian order with @ret_be.
  */
-static uint64_t do_ld_mmio_beN(CPUArchState *env, MMULookupPageData *p,
-                               uint64_t ret_be, int mmu_idx,
-                               MMUAccessType type, uintptr_t ra)
+static uint64_t do_ld_mmio_beN(CPUArchState *env, CPUTLBEntryFull *full,
+                               uint64_t ret_be, vaddr addr, int size,
+                               int mmu_idx, MMUAccessType type, uintptr_t ra)
 {
-    CPUTLBEntryFull *full = p->full;
-    vaddr addr = p->addr;
-    int i, size = p->size;
-
-    QEMU_IOTHREAD_LOCK_GUARD();
-    for (i = 0; i < size; i++) {
+    for (int i = 0; i < size; i++) {
         uint8_t x = io_readx(env, full, mmu_idx, addr + i, ra, type, MO_UB);
         ret_be = (ret_be << 8) | x;
     }
@@ -2232,7 +2230,9 @@ static uint64_t do_ld_beN(CPUArchState *env, MMULookupPageData *p,
     unsigned tmp, half_size;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        return do_ld_mmio_beN(env, p, ret_be, mmu_idx, type, ra);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        return do_ld_mmio_beN(env, p->full, ret_be, p->addr, p->size,
+                              mmu_idx, type, ra);
     }
 
     /*
@@ -2281,11 +2281,11 @@ static Int128 do_ld16_beN(CPUArchState *env, MMULookupPageData *p,
     MemOp atom;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        p->size = size - 8;
-        a = do_ld_mmio_beN(env, p, a, mmu_idx, MMU_DATA_LOAD, ra);
-        p->addr += p->size;
-        p->size = 8;
-        b = do_ld_mmio_beN(env, p, 0, mmu_idx, MMU_DATA_LOAD, ra);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        a = do_ld_mmio_beN(env, p->full, a, p->addr, size - 8,
+                           mmu_idx, MMU_DATA_LOAD, ra);
+        b = do_ld_mmio_beN(env, p->full, 0, p->addr + 8, 8,
+                           mmu_idx, MMU_DATA_LOAD, ra);
         return int128_make128(b, a);
     }
 
@@ -2664,24 +2664,23 @@ Int128 cpu_ld16_mmu(CPUArchState *env, abi_ptr addr,
 /**
  * do_st_mmio_leN:
  * @env: cpu context
- * @p: translation parameters
+ * @full: page parameters
  * @val_le: data to store
+ * @addr: virtual address
+ * @size: number of bytes
  * @mmu_idx: virtual address context
  * @ra: return address into tcg generated code, or 0
+ * Context: iothread lock held
  *
- * Store @p->size bytes at @p->addr, which is memory-mapped i/o.
+ * Store @size bytes at @addr, which is memory-mapped i/o.
  * The bytes to store are extracted in little-endian order from @val_le;
  * return the bytes of @val_le beyond @p->size that have not been stored.
  */
-static uint64_t do_st_mmio_leN(CPUArchState *env, MMULookupPageData *p,
-                               uint64_t val_le, int mmu_idx, uintptr_t ra)
+static uint64_t do_st_mmio_leN(CPUArchState *env, CPUTLBEntryFull *full,
+                               uint64_t val_le, vaddr addr, int size,
+                               int mmu_idx, uintptr_t ra)
 {
-    CPUTLBEntryFull *full = p->full;
-    vaddr addr = p->addr;
-    int i, size = p->size;
-
-    QEMU_IOTHREAD_LOCK_GUARD();
-    for (i = 0; i < size; i++, val_le >>= 8) {
+    for (int i = 0; i < size; i++, val_le >>= 8) {
         io_writex(env, full, mmu_idx, val_le, addr + i, ra, MO_UB);
     }
     return val_le;
@@ -2698,7 +2697,9 @@ static uint64_t do_st_leN(CPUArchState *env, MMULookupPageData *p,
     unsigned tmp, half_size;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        return do_st_mmio_leN(env, p, val_le, mmu_idx, ra);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        return do_st_mmio_leN(env, p->full, val_le, p->addr,
+                              p->size, mmu_idx, ra);
     } else if (unlikely(p->flags & TLB_DISCARD_WRITE)) {
         return val_le >> (p->size * 8);
     }
@@ -2751,11 +2752,11 @@ static uint64_t do_st16_leN(CPUArchState *env, MMULookupPageData *p,
     MemOp atom;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        p->size = 8;
-        do_st_mmio_leN(env, p, int128_getlo(val_le), mmu_idx, ra);
-        p->size = size - 8;
-        p->addr += 8;
-        return do_st_mmio_leN(env, p, int128_gethi(val_le), mmu_idx, ra);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        do_st_mmio_leN(env, p->full, int128_getlo(val_le),
+                       p->addr, 8, mmu_idx, ra);
+        return do_st_mmio_leN(env, p->full, int128_gethi(val_le),
+                              p->addr + 8, size - 8, mmu_idx, ra);
     } else if (unlikely(p->flags & TLB_DISCARD_WRITE)) {
         return int128_gethi(val_le) >> ((size - 8) * 8);
     }

From 190aba803fbcac30b29bdab25f454b1284a96201 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 1 Aug 2023 10:10:45 -0700
Subject: [PATCH 1054/1353] accel/tcg: Issue wider aligned i/o in
 do_{ld,st}_mmio_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the address and size are aligned, send larger chunks
to the memory subsystem.  This will be required to make
more use of these helpers.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 76 +++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 69 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 23386ecfde..a308cb7534 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2081,10 +2081,40 @@ static uint64_t do_ld_mmio_beN(CPUArchState *env, CPUTLBEntryFull *full,
                                uint64_t ret_be, vaddr addr, int size,
                                int mmu_idx, MMUAccessType type, uintptr_t ra)
 {
-    for (int i = 0; i < size; i++) {
-        uint8_t x = io_readx(env, full, mmu_idx, addr + i, ra, type, MO_UB);
-        ret_be = (ret_be << 8) | x;
-    }
+    uint64_t t;
+
+    tcg_debug_assert(size > 0 && size <= 8);
+    do {
+        /* Read aligned pieces up to 8 bytes. */
+        switch ((size | (int)addr) & 7) {
+        case 1:
+        case 3:
+        case 5:
+        case 7:
+            t = io_readx(env, full, mmu_idx, addr, ra, type, MO_UB);
+            ret_be = (ret_be << 8) | t;
+            size -= 1;
+            addr += 1;
+            break;
+        case 2:
+        case 6:
+            t = io_readx(env, full, mmu_idx, addr, ra, type, MO_BEUW);
+            ret_be = (ret_be << 16) | t;
+            size -= 2;
+            addr += 2;
+            break;
+        case 4:
+            t = io_readx(env, full, mmu_idx, addr, ra, type, MO_BEUL);
+            ret_be = (ret_be << 32) | t;
+            size -= 4;
+            addr += 4;
+            break;
+        case 0:
+            return io_readx(env, full, mmu_idx, addr, ra, type, MO_BEUQ);
+        default:
+            qemu_build_not_reached();
+        }
+    } while (size);
     return ret_be;
 }
 
@@ -2680,9 +2710,41 @@ static uint64_t do_st_mmio_leN(CPUArchState *env, CPUTLBEntryFull *full,
                                uint64_t val_le, vaddr addr, int size,
                                int mmu_idx, uintptr_t ra)
 {
-    for (int i = 0; i < size; i++, val_le >>= 8) {
-        io_writex(env, full, mmu_idx, val_le, addr + i, ra, MO_UB);
-    }
+    tcg_debug_assert(size > 0 && size <= 8);
+
+    do {
+        /* Store aligned pieces up to 8 bytes. */
+        switch ((size | (int)addr) & 7) {
+        case 1:
+        case 3:
+        case 5:
+        case 7:
+            io_writex(env, full, mmu_idx, val_le, addr, ra, MO_UB);
+            val_le >>= 8;
+            size -= 1;
+            addr += 1;
+            break;
+        case 2:
+        case 6:
+            io_writex(env, full, mmu_idx, val_le, addr, ra, MO_LEUW);
+            val_le >>= 16;
+            size -= 2;
+            addr += 2;
+            break;
+        case 4:
+            io_writex(env, full, mmu_idx, val_le, addr, ra, MO_LEUL);
+            val_le >>= 32;
+            size -= 4;
+            addr += 4;
+            break;
+        case 0:
+            io_writex(env, full, mmu_idx, val_le, addr, ra, MO_LEUQ);
+            return 0;
+        default:
+            qemu_build_not_reached();
+        }
+    } while (size);
+
     return val_le;
 }
 

From f7eaf9d702efdd02481d5f1c25f7d8e0ffb64c6e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 1 Aug 2023 10:46:03 -0700
Subject: [PATCH 1055/1353] accel/tcg: Do not issue misaligned i/o
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the single-page case we were issuing misaligned i/o to
the memory subsystem, which does not handle it properly.
Split such accesses via do_{ld,st}_mmio_*.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1800
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 118 +++++++++++++++++++++++++++------------------
 1 file changed, 72 insertions(+), 46 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index a308cb7534..4b1bfaa53d 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -2370,16 +2370,20 @@ static uint8_t do_ld_1(CPUArchState *env, MMULookupPageData *p, int mmu_idx,
 static uint16_t do_ld_2(CPUArchState *env, MMULookupPageData *p, int mmu_idx,
                         MMUAccessType type, MemOp memop, uintptr_t ra)
 {
-    uint64_t ret;
+    uint16_t ret;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        return io_readx(env, p->full, mmu_idx, p->addr, ra, type, memop);
-    }
-
-    /* Perform the load host endian, then swap if necessary. */
-    ret = load_atom_2(env, ra, p->haddr, memop);
-    if (memop & MO_BSWAP) {
-        ret = bswap16(ret);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        ret = do_ld_mmio_beN(env, p->full, 0, p->addr, 2, mmu_idx, type, ra);
+        if ((memop & MO_BSWAP) == MO_LE) {
+            ret = bswap16(ret);
+        }
+    } else {
+        /* Perform the load host endian, then swap if necessary. */
+        ret = load_atom_2(env, ra, p->haddr, memop);
+        if (memop & MO_BSWAP) {
+            ret = bswap16(ret);
+        }
     }
     return ret;
 }
@@ -2390,13 +2394,17 @@ static uint32_t do_ld_4(CPUArchState *env, MMULookupPageData *p, int mmu_idx,
     uint32_t ret;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        return io_readx(env, p->full, mmu_idx, p->addr, ra, type, memop);
-    }
-
-    /* Perform the load host endian. */
-    ret = load_atom_4(env, ra, p->haddr, memop);
-    if (memop & MO_BSWAP) {
-        ret = bswap32(ret);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        ret = do_ld_mmio_beN(env, p->full, 0, p->addr, 4, mmu_idx, type, ra);
+        if ((memop & MO_BSWAP) == MO_LE) {
+            ret = bswap32(ret);
+        }
+    } else {
+        /* Perform the load host endian. */
+        ret = load_atom_4(env, ra, p->haddr, memop);
+        if (memop & MO_BSWAP) {
+            ret = bswap32(ret);
+        }
     }
     return ret;
 }
@@ -2407,13 +2415,17 @@ static uint64_t do_ld_8(CPUArchState *env, MMULookupPageData *p, int mmu_idx,
     uint64_t ret;
 
     if (unlikely(p->flags & TLB_MMIO)) {
-        return io_readx(env, p->full, mmu_idx, p->addr, ra, type, memop);
-    }
-
-    /* Perform the load host endian. */
-    ret = load_atom_8(env, ra, p->haddr, memop);
-    if (memop & MO_BSWAP) {
-        ret = bswap64(ret);
+        QEMU_IOTHREAD_LOCK_GUARD();
+        ret = do_ld_mmio_beN(env, p->full, 0, p->addr, 8, mmu_idx, type, ra);
+        if ((memop & MO_BSWAP) == MO_LE) {
+            ret = bswap64(ret);
+        }
+    } else {
+        /* Perform the load host endian. */
+        ret = load_atom_8(env, ra, p->haddr, memop);
+        if (memop & MO_BSWAP) {
+            ret = bswap64(ret);
+        }
     }
     return ret;
 }
@@ -2561,20 +2573,22 @@ static Int128 do_ld16_mmu(CPUArchState *env, vaddr addr,
     cpu_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_LOAD, &l);
     if (likely(!crosspage)) {
-        /* Perform the load host endian. */
         if (unlikely(l.page[0].flags & TLB_MMIO)) {
             QEMU_IOTHREAD_LOCK_GUARD();
-            a = io_readx(env, l.page[0].full, l.mmu_idx, addr,
-                         ra, MMU_DATA_LOAD, MO_64);
-            b = io_readx(env, l.page[0].full, l.mmu_idx, addr + 8,
-                         ra, MMU_DATA_LOAD, MO_64);
-            ret = int128_make128(HOST_BIG_ENDIAN ? b : a,
-                                 HOST_BIG_ENDIAN ? a : b);
+            a = do_ld_mmio_beN(env, l.page[0].full, 0, addr, 8,
+                               l.mmu_idx, MMU_DATA_LOAD, ra);
+            b = do_ld_mmio_beN(env, l.page[0].full, 0, addr + 8, 8,
+                               l.mmu_idx, MMU_DATA_LOAD, ra);
+            ret = int128_make128(b, a);
+            if ((l.memop & MO_BSWAP) == MO_LE) {
+                ret = bswap128(ret);
+            }
         } else {
+            /* Perform the load host endian. */
             ret = load_atom_16(env, ra, l.page[0].haddr, l.memop);
-        }
-        if (l.memop & MO_BSWAP) {
-            ret = bswap128(ret);
+            if (l.memop & MO_BSWAP) {
+                ret = bswap128(ret);
+            }
         }
         return ret;
     }
@@ -2874,7 +2888,11 @@ static void do_st_2(CPUArchState *env, MMULookupPageData *p, uint16_t val,
                     int mmu_idx, MemOp memop, uintptr_t ra)
 {
     if (unlikely(p->flags & TLB_MMIO)) {
-        io_writex(env, p->full, mmu_idx, val, p->addr, ra, memop);
+        if ((memop & MO_BSWAP) != MO_LE) {
+            val = bswap16(val);
+        }
+        QEMU_IOTHREAD_LOCK_GUARD();
+        do_st_mmio_leN(env, p->full, val, p->addr, 2, mmu_idx, ra);
     } else if (unlikely(p->flags & TLB_DISCARD_WRITE)) {
         /* nothing */
     } else {
@@ -2890,7 +2908,11 @@ static void do_st_4(CPUArchState *env, MMULookupPageData *p, uint32_t val,
                     int mmu_idx, MemOp memop, uintptr_t ra)
 {
     if (unlikely(p->flags & TLB_MMIO)) {
-        io_writex(env, p->full, mmu_idx, val, p->addr, ra, memop);
+        if ((memop & MO_BSWAP) != MO_LE) {
+            val = bswap32(val);
+        }
+        QEMU_IOTHREAD_LOCK_GUARD();
+        do_st_mmio_leN(env, p->full, val, p->addr, 4, mmu_idx, ra);
     } else if (unlikely(p->flags & TLB_DISCARD_WRITE)) {
         /* nothing */
     } else {
@@ -2906,7 +2928,11 @@ static void do_st_8(CPUArchState *env, MMULookupPageData *p, uint64_t val,
                     int mmu_idx, MemOp memop, uintptr_t ra)
 {
     if (unlikely(p->flags & TLB_MMIO)) {
-        io_writex(env, p->full, mmu_idx, val, p->addr, ra, memop);
+        if ((memop & MO_BSWAP) != MO_LE) {
+            val = bswap64(val);
+        }
+        QEMU_IOTHREAD_LOCK_GUARD();
+        do_st_mmio_leN(env, p->full, val, p->addr, 8, mmu_idx, ra);
     } else if (unlikely(p->flags & TLB_DISCARD_WRITE)) {
         /* nothing */
     } else {
@@ -3029,22 +3055,22 @@ static void do_st16_mmu(CPUArchState *env, vaddr addr, Int128 val,
     cpu_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     crosspage = mmu_lookup(env, addr, oi, ra, MMU_DATA_STORE, &l);
     if (likely(!crosspage)) {
-        /* Swap to host endian if necessary, then store. */
-        if (l.memop & MO_BSWAP) {
-            val = bswap128(val);
-        }
         if (unlikely(l.page[0].flags & TLB_MMIO)) {
-            QEMU_IOTHREAD_LOCK_GUARD();
-            if (HOST_BIG_ENDIAN) {
-                b = int128_getlo(val), a = int128_gethi(val);
-            } else {
-                a = int128_getlo(val), b = int128_gethi(val);
+            if ((l.memop & MO_BSWAP) != MO_LE) {
+                val = bswap128(val);
             }
-            io_writex(env, l.page[0].full, l.mmu_idx, a, addr, ra, MO_64);
-            io_writex(env, l.page[0].full, l.mmu_idx, b, addr + 8, ra, MO_64);
+            a = int128_getlo(val);
+            b = int128_gethi(val);
+            QEMU_IOTHREAD_LOCK_GUARD();
+            do_st_mmio_leN(env, l.page[0].full, a, addr, 8, l.mmu_idx, ra);
+            do_st_mmio_leN(env, l.page[0].full, b, addr + 8, 8, l.mmu_idx, ra);
         } else if (unlikely(l.page[0].flags & TLB_DISCARD_WRITE)) {
             /* nothing */
         } else {
+            /* Swap to host endian if necessary, then store. */
+            if (l.memop & MO_BSWAP) {
+                val = bswap128(val);
+            }
             store_atom_16(env, ra, l.page[0].haddr, l.memop, val);
         }
         return;

From c30d0b861cea8539ee0acb55a1a949ed4b5ec82a Mon Sep 17 00:00:00 2001
From: Mikhail Tyutin <m.tyutin@yadro.com>
Date: Fri, 4 Aug 2023 14:09:03 +0300
Subject: [PATCH 1056/1353] accel/tcg: Call save_iotlb_data from io_readx as
 well

Apply save_iotlb_data() to io_readx() as well as to io_writex().
This fixes SEGFAULT on qemu_plugin_hwaddr_phys_addr() call plugins
for addresses inside of MMIO region.

Signed-off-by: Dmitriy Solovev <d.solovev@yadro.com>
Signed-off-by: Mikhail Tyutin <m.tyutin@yadro.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230804110903.19968-1-m.tyutin@yadro.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 36 +++++++++++++++++++++---------------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 4b1bfaa53d..d68fa6867c 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1363,6 +1363,21 @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr,
     }
 }
 
+/*
+ * Save a potentially trashed CPUTLBEntryFull for later lookup by plugin.
+ * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
+ * because of the side effect of io_writex changing memory layout.
+ */
+static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
+                            hwaddr mr_offset)
+{
+#ifdef CONFIG_PLUGIN
+    SavedIOTLB *saved = &cs->saved_iotlb;
+    saved->section = section;
+    saved->mr_offset = mr_offset;
+#endif
+}
+
 static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
                          int mmu_idx, vaddr addr, uintptr_t retaddr,
                          MMUAccessType access_type, MemOp op)
@@ -1382,6 +1397,12 @@ static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
         cpu_io_recompile(cpu, retaddr);
     }
 
+    /*
+     * The memory_region_dispatch may trigger a flush/resize
+     * so for plugins we save the iotlb_data just in case.
+     */
+    save_iotlb_data(cpu, section, mr_offset);
+
     {
         QEMU_IOTHREAD_LOCK_GUARD();
         r = memory_region_dispatch_read(mr, mr_offset, &val, op, full->attrs);
@@ -1398,21 +1419,6 @@ static uint64_t io_readx(CPUArchState *env, CPUTLBEntryFull *full,
     return val;
 }
 
-/*
- * Save a potentially trashed CPUTLBEntryFull for later lookup by plugin.
- * This is read by tlb_plugin_lookup if the fulltlb entry doesn't match
- * because of the side effect of io_writex changing memory layout.
- */
-static void save_iotlb_data(CPUState *cs, MemoryRegionSection *section,
-                            hwaddr mr_offset)
-{
-#ifdef CONFIG_PLUGIN
-    SavedIOTLB *saved = &cs->saved_iotlb;
-    saved->section = section;
-    saved->mr_offset = mr_offset;
-#endif
-}
-
 static void io_writex(CPUArchState *env, CPUTLBEntryFull *full,
                       int mmu_idx, uint64_t val, vaddr addr,
                       uintptr_t retaddr, MemOp op)

From 6c78de6eb6f986b2e06e95fabad62731a44aaafd Mon Sep 17 00:00:00 2001
From: Matheus Tavares Bernardino <quic_mathbern@quicinc.com>
Date: Tue, 1 Aug 2023 12:37:11 -0300
Subject: [PATCH 1057/1353] gdbstub: use 0 ("any process") on packets with no
 PID

Previously, qemu-user would always report PID 1 to GDB. This was changed
at dc14a7a6e9 (gdbstub: Report the actual qemu-user pid, 2023-06-30),
but read_thread_id() still considers GDB packets with "no PID" as "PID
1", which is not the qemu-user PID. Fix that by parsing "no PID" as "0",
which the GDB Remote Protocol defines as "any process".

Note that this should have no effect for system emulation as, in this
case, gdb_create_default_process() will assign PID 1 for the first
process and that is what the gdbstub uses for GDB requests with no PID,
or PID 0.

This issue was found with hexagon-lldb, which sends a "Hg" packet with
only the thread-id, but no process-id, leading to the invalid usage of
"PID 1" by qemu-hexagon and a subsequent "E22" reply.

Signed-off-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <78a3b06f6ab90a7ff8e73ae14a996eb27ec76c85.1690904195.git.quic_mathbern@quicinc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 gdbstub/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index ce8b42eb15..e74ecc78cc 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -537,7 +537,7 @@ static GDBThreadIdKind read_thread_id(const char *buf, const char **end_buf,
         /* Skip '.' */
         buf++;
     } else {
-        p = 1;
+        p = 0;
     }
 
     ret = qemu_strtoul(buf, &buf, 16, &t);

From 89e5b7935e92af6f3b4e4cdb19dfddef4e9dde36 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 17:38:06 +0000
Subject: [PATCH 1058/1353] configure: Fix linux-user host detection for
 riscv64

Mirror the host_arch variable from meson.build, so that we
probe for the correct linux-user/include/host/ directory.

Fixes: e3e477c3bca0 ("configure: Fix cross-building for RISCV host")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 configure | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/configure b/configure
index afb25fd558..98dc78280e 100755
--- a/configure
+++ b/configure
@@ -469,6 +469,13 @@ else
   echo "WARNING: unrecognized host CPU, proceeding with 'uname -m' output '$cpu'"
 fi
 
+case "$cpu" in
+  riscv*)
+    host_arch=riscv ;;
+  *)
+    host_arch="$cpu" ;;
+esac
+
 # Normalise host CPU name and set multilib cflags.  The canonicalization
 # isn't really necessary, because the architectures that we check for
 # should not hit the 'uname -m' case, but better safe than sorry.
@@ -803,7 +810,7 @@ default_target_list=""
 mak_wilds=""
 
 if [ "$linux_user" != no ]; then
-    if [ "$targetos" = linux ] && [ -d "$source_path/linux-user/include/host/$cpu" ]; then
+    if [ "$targetos" = linux ] && [ -d "$source_path/linux-user/include/host/$host_arch" ]; then
         linux_user=yes
     elif [ "$linux_user" = yes ]; then
         error_exit "linux-user not supported on this architecture"

From 4333f0924c2f2ca8efaebaed8c24f55f77d8b013 Mon Sep 17 00:00:00 2001
From: Nathan Egge <negge@xiph.org>
Date: Thu, 3 Aug 2023 09:14:24 -0400
Subject: [PATCH 1059/1353] linux-user/elfload: Set V in ELF_HWCAP for RISC-V

Set V bit for hwcap if misa is set.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1793
Signed-off-by: Nathan Egge <negge@xiph.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230803131424.40744-1-negge@xiph.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 861ec07abc..a299ba7300 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1710,7 +1710,8 @@ static uint32_t get_elf_hwcap(void)
 #define MISA_BIT(EXT) (1 << (EXT - 'A'))
     RISCVCPU *cpu = RISCV_CPU(thread_cpu);
     uint32_t mask = MISA_BIT('I') | MISA_BIT('M') | MISA_BIT('A')
-                    | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C');
+                    | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C')
+                    | MISA_BIT('V');
 
     return cpu->env.misa_ext & mask;
 #undef MISA_BIT

From c3dd50da0f4d00fffe8ea5e211c2c189fe6ad4fb Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 2 Aug 2023 16:17:47 +0900
Subject: [PATCH 1060/1353] linux-user: Unset MAP_FIXED_NOREPLACE for host

Passing MAP_FIXED_NOREPLACE to host will fail for reserved_va because
the address space is reserved with mmap.  Replace it with MAP_FIXED
in that case.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230802071754.14876-2-akihiko.odaki@daynix.com>
[rth: Expand inline commentary.]
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/mmap.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index a5dfb56545..a11c630a7b 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -603,11 +603,26 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
             goto fail;
         }
 
-        /* Validate that the chosen range is empty. */
-        if ((flags & MAP_FIXED_NOREPLACE)
-            && !page_check_range_empty(start, last)) {
-            errno = EEXIST;
-            goto fail;
+        if (flags & MAP_FIXED_NOREPLACE) {
+            /* Validate that the chosen range is empty. */
+            if (!page_check_range_empty(start, last)) {
+                errno = EEXIST;
+                goto fail;
+            }
+
+            /*
+             * With reserved_va, the entire address space is mmaped in the
+             * host to ensure it isn't accidentally used for something else.
+             * We have just checked that the guest address is not mapped
+             * within the guest, but need to replace the host reservation.
+             *
+             * Without reserved_va, despite the guest address check above,
+             * keep MAP_FIXED_NOREPLACE so that the guest does not overwrite
+             * any host address mappings.
+             */
+            if (reserved_va) {
+                flags = (flags & ~MAP_FIXED_NOREPLACE) | MAP_FIXED;
+            }
         }
 
         /*

From ddcdd8c48fc48b2d528756fc98f1ce0ec3d7b617 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 2 Aug 2023 16:17:48 +0900
Subject: [PATCH 1061/1353] linux-user: Fix MAP_FIXED_NOREPLACE on old kernels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The man page states:
> Note that older kernels which do not recognize the MAP_FIXED_NOREPLACE
> flag will typically (upon detecting a collision with a preexisting
> mapping) fall back to a “non-MAP_FIXED” type of behavior: they will
> return an address that is different from the requested address.
> Therefore, backward-compatible software should check the returned
> address against the requested address.
https://man7.org/linux/man-pages/man2/mmap.2.html

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230802071754.14876-3-akihiko.odaki@daynix.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/mmap.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index a11c630a7b..90b3ef2140 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -263,7 +263,11 @@ static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last,
         void *p = mmap(host_start, qemu_host_page_size,
                        target_to_host_prot(prot),
                        flags | MAP_ANONYMOUS, -1, 0);
-        if (p == MAP_FAILED) {
+        if (p != host_start) {
+            if (p != MAP_FAILED) {
+                munmap(p, qemu_host_page_size);
+                errno = EEXIST;
+            }
             return false;
         }
         prot_old = prot;
@@ -687,17 +691,25 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
 
         /* map the middle (easier) */
         if (real_start < real_last) {
-            void *p;
+            void *p, *want_p;
             off_t offset1;
+            size_t len1;
 
             if (flags & MAP_ANONYMOUS) {
                 offset1 = 0;
             } else {
                 offset1 = offset + real_start - start;
             }
-            p = mmap(g2h_untagged(real_start), real_last - real_start + 1,
-                     target_to_host_prot(target_prot), flags, fd, offset1);
-            if (p == MAP_FAILED) {
+            len1 = real_last - real_start + 1;
+            want_p = g2h_untagged(real_start);
+
+            p = mmap(want_p, len1, target_to_host_prot(target_prot),
+                     flags, fd, offset1);
+            if (p != want_p) {
+                if (p != MAP_FAILED) {
+                    munmap(p, len1);
+                    errno = EEXIST;
+                }
                 goto fail;
             }
             passthrough_start = real_start;

From c6cc059eca18d9f6e4e26bb8b6d1135ddb35d81a Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 2 Aug 2023 16:17:49 +0900
Subject: [PATCH 1062/1353] linux-user: Do not call get_errno() in do_brk()

Later the returned value is compared with -1, and negated errno is not
expected.

Fixes: 00faf08c95 ("linux-user: Don't use MAP_FIXED in do_brk()")
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230802071754.14876-4-akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 95727a816a..b08276bdf8 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -862,9 +862,9 @@ abi_long do_brk(abi_ulong brk_val)
      */
     if (new_host_brk_page > brk_page) {
         new_alloc_size = new_host_brk_page - brk_page;
-        mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
-                                        PROT_READ|PROT_WRITE,
-                                        MAP_ANON|MAP_PRIVATE, 0, 0));
+        mapped_addr = target_mmap(brk_page, new_alloc_size,
+                                  PROT_READ | PROT_WRITE,
+                                  MAP_ANON | MAP_PRIVATE, -1, 0);
     } else {
         new_alloc_size = 0;
         mapped_addr = brk_page;

From e69e032d1a8ee8d754ca119009a3c2c997f8bb30 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 2 Aug 2023 16:17:50 +0900
Subject: [PATCH 1063/1353] linux-user: Use MAP_FIXED_NOREPLACE for do_brk()

MAP_FIXED_NOREPLACE can ensure the mapped address is fixed without
concerning that the new mapping overwrites something else.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230802071754.14876-5-akihiko.odaki@daynix.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index b08276bdf8..f64024273f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -854,17 +854,12 @@ abi_long do_brk(abi_ulong brk_val)
         return target_brk;
     }
 
-    /* We need to allocate more memory after the brk... Note that
-     * we don't use MAP_FIXED because that will map over the top of
-     * any existing mapping (like the one with the host libc or qemu
-     * itself); instead we treat "mapped but at wrong address" as
-     * a failure and unmap again.
-     */
     if (new_host_brk_page > brk_page) {
         new_alloc_size = new_host_brk_page - brk_page;
         mapped_addr = target_mmap(brk_page, new_alloc_size,
                                   PROT_READ | PROT_WRITE,
-                                  MAP_ANON | MAP_PRIVATE, -1, 0);
+                                  MAP_FIXED_NOREPLACE | MAP_ANON | MAP_PRIVATE,
+                                  -1, 0);
     } else {
         new_alloc_size = 0;
         mapped_addr = brk_page;
@@ -883,12 +878,6 @@ abi_long do_brk(abi_ulong brk_val)
         target_brk = brk_val;
         brk_page = new_host_brk_page;
         return target_brk;
-    } else if (mapped_addr != -1) {
-        /* Mapped but at wrong address, meaning there wasn't actually
-         * enough space for this brk.
-         */
-        target_munmap(mapped_addr, new_alloc_size);
-        mapped_addr = -1;
     }
 
 #if defined(TARGET_ALPHA)

From cb9d5d1fda0bc2312fc0c779b4ea1d7bf826f31f Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 2 Aug 2023 16:17:51 +0900
Subject: [PATCH 1064/1353] linux-user: Do nothing if too small brk is
 specified

Linux 6.4.7 does nothing when a value smaller than the initial brk is
specified.

Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230802071754.14876-6-akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index f64024273f..e1436a3962 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -820,14 +820,14 @@ abi_long do_brk(abi_ulong brk_val)
 
     /* brk pointers are always untagged */
 
-    /* return old brk value if brk_val unchanged or zero */
-    if (!brk_val || brk_val == target_brk) {
+    /* return old brk value if brk_val unchanged */
+    if (brk_val == target_brk) {
         return target_brk;
     }
 
     /* do not allow to shrink below initial brk value */
     if (brk_val < initial_target_brk) {
-        brk_val = initial_target_brk;
+        return target_brk;
     }
 
     new_brk = TARGET_PAGE_ALIGN(brk_val);

From 2aea137a425a87b930a33590177b04368fd7cc12 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Wed, 2 Aug 2023 16:17:52 +0900
Subject: [PATCH 1065/1353] linux-user: Do not align brk with host page size

do_brk() minimizes calls into target_mmap() by aligning the address
with host page size, which is potentially larger than the target page
size. However, the current implementation of this optimization has two
bugs:

- The start of brk is rounded up with the host page size while brk
  advertises an address aligned with the target page size as the
  beginning of brk. This makes the beginning of brk unmapped.
- Content clearing after mapping is flawed. The size to clear is
  specified as HOST_PAGE_ALIGN(brk_page) - brk_page, but brk_page is
  aligned with the host page size so it is always zero.

This optimization actually has no practical benefit. It makes difference
when brk() is called multiple times with values in a range of the host
page size. However, sophisticated memory allocators try to avoid to
make such frequent brk() calls. For example, glibc 2.37 calls brk() to
shrink the heap only when there is a room more than 128 KiB. It is
rare to have a page size larger than 128 KiB if it happens.

Let's remove the optimization to fix the bugs and make the code simpler.

Fixes: 86f04735ac ("linux-user: Fix brk() to release pages")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1616
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20230802071754.14876-7-akihiko.odaki@daynix.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c |  4 ++--
 linux-user/syscall.c | 54 ++++++++++----------------------------------
 2 files changed, 14 insertions(+), 44 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a299ba7300..36e4026f05 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3679,8 +3679,8 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
      * to mmap pages in this space.
      */
     if (info->reserve_brk) {
-        abi_ulong start_brk = HOST_PAGE_ALIGN(info->brk);
-        abi_ulong end_brk = HOST_PAGE_ALIGN(info->brk + info->reserve_brk);
+        abi_ulong start_brk = TARGET_PAGE_ALIGN(info->brk);
+        abi_ulong end_brk = TARGET_PAGE_ALIGN(info->brk + info->reserve_brk);
         target_munmap(start_brk, end_brk - start_brk);
     }
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e1436a3962..7c2c2f6e2f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -802,81 +802,51 @@ static inline int host_to_target_sock_type(int host_type)
 }
 
 static abi_ulong target_brk, initial_target_brk;
-static abi_ulong brk_page;
 
 void target_set_brk(abi_ulong new_brk)
 {
     target_brk = TARGET_PAGE_ALIGN(new_brk);
     initial_target_brk = target_brk;
-    brk_page = HOST_PAGE_ALIGN(target_brk);
 }
 
 /* do_brk() must return target values and target errnos. */
 abi_long do_brk(abi_ulong brk_val)
 {
     abi_long mapped_addr;
-    abi_ulong new_alloc_size;
-    abi_ulong new_brk, new_host_brk_page;
+    abi_ulong new_brk;
+    abi_ulong old_brk;
 
     /* brk pointers are always untagged */
 
-    /* return old brk value if brk_val unchanged */
-    if (brk_val == target_brk) {
-        return target_brk;
-    }
-
     /* do not allow to shrink below initial brk value */
     if (brk_val < initial_target_brk) {
         return target_brk;
     }
 
     new_brk = TARGET_PAGE_ALIGN(brk_val);
-    new_host_brk_page = HOST_PAGE_ALIGN(brk_val);
+    old_brk = TARGET_PAGE_ALIGN(target_brk);
 
-    /* brk_val and old target_brk might be on the same page */
-    if (new_brk == TARGET_PAGE_ALIGN(target_brk)) {
-        /* empty remaining bytes in (possibly larger) host page */
-        memset(g2h_untagged(new_brk), 0, new_host_brk_page - new_brk);
+    /* new and old target_brk might be on the same page */
+    if (new_brk == old_brk) {
         target_brk = brk_val;
         return target_brk;
     }
 
     /* Release heap if necesary */
-    if (new_brk < target_brk) {
-        /* empty remaining bytes in (possibly larger) host page */
-        memset(g2h_untagged(new_brk), 0, new_host_brk_page - new_brk);
-
-        /* free unused host pages and set new brk_page */
-        target_munmap(new_host_brk_page, brk_page - new_host_brk_page);
-        brk_page = new_host_brk_page;
+    if (new_brk < old_brk) {
+        target_munmap(new_brk, old_brk - new_brk);
 
         target_brk = brk_val;
         return target_brk;
     }
 
-    if (new_host_brk_page > brk_page) {
-        new_alloc_size = new_host_brk_page - brk_page;
-        mapped_addr = target_mmap(brk_page, new_alloc_size,
-                                  PROT_READ | PROT_WRITE,
-                                  MAP_FIXED_NOREPLACE | MAP_ANON | MAP_PRIVATE,
-                                  -1, 0);
-    } else {
-        new_alloc_size = 0;
-        mapped_addr = brk_page;
-    }
-
-    if (mapped_addr == brk_page) {
-        /* Heap contents are initialized to zero, as for anonymous
-         * mapped pages.  Technically the new pages are already
-         * initialized to zero since they *are* anonymous mapped
-         * pages, however we have to take care with the contents that
-         * come from the remaining part of the previous page: it may
-         * contains garbage data due to a previous heap usage (grown
-         * then shrunken).  */
-        memset(g2h_untagged(brk_page), 0, HOST_PAGE_ALIGN(brk_page) - brk_page);
+    mapped_addr = target_mmap(old_brk, new_brk - old_brk,
+                              PROT_READ | PROT_WRITE,
+                              MAP_FIXED_NOREPLACE | MAP_ANON | MAP_PRIVATE,
+                              -1, 0);
 
+    if (mapped_addr == old_brk) {
         target_brk = brk_val;
-        brk_page = new_host_brk_page;
         return target_brk;
     }
 

From 0662a626a712dde5f8a91e1b078644332336e9fa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 16:25:37 -0700
Subject: [PATCH 1066/1353] linux-user: Properly set image_info.brk in flatload

The heap starts at "brk" not "start_brk".  With this fixed,
image_info.start_brk is unused and may be removed.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/flatload.c | 2 +-
 linux-user/main.c     | 2 --
 linux-user/qemu.h     | 1 -
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/linux-user/flatload.c b/linux-user/flatload.c
index 5efec2630e..8f5e9f489b 100644
--- a/linux-user/flatload.c
+++ b/linux-user/flatload.c
@@ -811,7 +811,7 @@ int load_flt_binary(struct linux_binprm *bprm, struct image_info *info)
     info->end_code = libinfo[0].start_code + libinfo[0].text_len;
     info->start_data = libinfo[0].start_data;
     info->end_data = libinfo[0].end_data;
-    info->start_brk = libinfo[0].start_brk;
+    info->brk = libinfo[0].start_brk;
     info->start_stack = sp;
     info->stack_limit = libinfo[0].start_brk;
     info->entry = start_addr;
diff --git a/linux-user/main.c b/linux-user/main.c
index dba67ffa36..556956c363 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -920,8 +920,6 @@ int main(int argc, char **argv, char **envp)
             fprintf(f, "page layout changed following binary load\n");
             page_dump(f);
 
-            fprintf(f, "start_brk   0x" TARGET_ABI_FMT_lx "\n",
-                    info->start_brk);
             fprintf(f, "end_code    0x" TARGET_ABI_FMT_lx "\n",
                     info->end_code);
             fprintf(f, "start_code  0x" TARGET_ABI_FMT_lx "\n",
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 802794db63..2046a23037 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -29,7 +29,6 @@ struct image_info {
         abi_ulong       end_code;
         abi_ulong       start_data;
         abi_ulong       end_data;
-        abi_ulong       start_brk;
         abi_ulong       brk;
         abi_ulong       reserve_brk;
         abi_ulong       start_mmap;

From 62cbf0815005f0ba91b0c36fbcabd479c6e3a2f2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 14:02:46 -0700
Subject: [PATCH 1067/1353] linux-user: Remove last_brk

This variable is unused.

Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/mmap.c      | 2 --
 linux-user/user-mmap.h | 1 -
 2 files changed, 3 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 90b3ef2140..eb04fab8ab 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -314,8 +314,6 @@ static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last,
 #endif
 abi_ulong mmap_next_start = TASK_UNMAPPED_BASE;
 
-unsigned long last_brk;
-
 /*
  * Subroutine of mmap_find_vma, used when we have pre-allocated
  * a chunk of guest address space.
diff --git a/linux-user/user-mmap.h b/linux-user/user-mmap.h
index 3fc986f92f..7265c2c116 100644
--- a/linux-user/user-mmap.h
+++ b/linux-user/user-mmap.h
@@ -26,7 +26,6 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                        abi_ulong new_size, unsigned long flags,
                        abi_ulong new_addr);
 abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice);
-extern unsigned long last_brk;
 extern abi_ulong mmap_next_start;
 abi_ulong mmap_find_vma(abi_ulong, abi_ulong, abi_ulong);
 void mmap_fork_start(void);

From 3c4a8a8fdae95611ca48e7c40e56fbf60c3267f4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Aug 2023 09:33:58 -0700
Subject: [PATCH 1068/1353] bsd-user: Remove last_brk

This variable is unused.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/mmap.c | 2 --
 bsd-user/qemu.h | 1 -
 2 files changed, 3 deletions(-)

diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index b62a69bd07..8e148a2ea3 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -214,8 +214,6 @@ static int mmap_frag(abi_ulong real_start,
 #endif
 abi_ulong mmap_next_start = TASK_UNMAPPED_BASE;
 
-unsigned long last_brk;
-
 /*
  * Subroutine of mmap_find_vma, used when we have pre-allocated a chunk of guest
  * address space.
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index edf9602f9b..8f2d6a3c78 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -232,7 +232,6 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                        abi_ulong new_size, unsigned long flags,
                        abi_ulong new_addr);
 int target_msync(abi_ulong start, abi_ulong len, int flags);
-extern unsigned long last_brk;
 extern abi_ulong mmap_next_start;
 abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size);
 void TSA_NO_TSA mmap_fork_start(void);

From ecb1b7b082d3b7dceff0e486a114502fc52c0fdf Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Thu, 3 Aug 2023 20:44:23 +0200
Subject: [PATCH 1069/1353] hw/nvme: fix oob memory read in fdp events log

As reported by Trend Micro's Zero Day Initiative, an oob memory read
vulnerability exists in nvme_fdp_events(). The host-provided offset is
not verified.

Fix this.

This is only exploitable when Flexible Data Placement mode (fdp=on) is
enabled.

Fixes: CVE-2023-4135
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reported-by: Trend Micro's Zero Day Initiative
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index f2e5a2fa73..e9b5a55811 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -5120,6 +5120,11 @@ static uint16_t nvme_fdp_events(NvmeCtrl *n, uint32_t endgrpid,
     }
 
     log_size = sizeof(NvmeFdpEventsLog) + ebuf->nelems * sizeof(NvmeFdpEvent);
+
+    if (off >= log_size) {
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+
     trans_len = MIN(log_size - off, buf_len);
     elog = g_malloc0(log_size);
     elog->num_events = cpu_to_le32(ebuf->nelems);

From 6a33f2e920ec0b489a77200888e3692664077f2d Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Wed, 19 Jul 2023 20:21:58 +0200
Subject: [PATCH 1070/1353] hw/nvme: fix compliance issue wrt. iosqes/iocqes

As of prior to this patch, the controller checks the value of CC.IOCQES
and CC.IOSQES prior to enabling the controller. As reported by Ben in
GitLab issue #1691, this is not spec compliant. The controller should
only check these values when queues are created.

This patch moves these checks to nvme_create_cq(). We do not need to
check it in nvme_create_sq() since that will error out if the completion
queue is not already created.

Also, since the controller exclusively supports SQEs of size 64 bytes
and CQEs of size 16 bytes, hard code that.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1691
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c       | 46 ++++++++++++--------------------------------
 hw/nvme/nvme.h       |  9 +++++++--
 hw/nvme/trace-events |  1 +
 3 files changed, 20 insertions(+), 36 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e9b5a55811..d217ae91b5 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1507,7 +1507,7 @@ static void nvme_post_cqes(void *opaque)
         req->cqe.status = cpu_to_le16((req->status << 1) | cq->phase);
         req->cqe.sq_id = cpu_to_le16(sq->sqid);
         req->cqe.sq_head = cpu_to_le16(sq->head);
-        addr = cq->dma_addr + cq->tail * n->cqe_size;
+        addr = cq->dma_addr + (cq->tail << NVME_CQES);
         ret = pci_dma_write(PCI_DEVICE(n), addr, (void *)&req->cqe,
                             sizeof(req->cqe));
         if (ret) {
@@ -5300,10 +5300,18 @@ static uint16_t nvme_create_cq(NvmeCtrl *n, NvmeRequest *req)
     uint16_t qsize = le16_to_cpu(c->qsize);
     uint16_t qflags = le16_to_cpu(c->cq_flags);
     uint64_t prp1 = le64_to_cpu(c->prp1);
+    uint32_t cc = ldq_le_p(&n->bar.cc);
+    uint8_t iocqes = NVME_CC_IOCQES(cc);
+    uint8_t iosqes = NVME_CC_IOSQES(cc);
 
     trace_pci_nvme_create_cq(prp1, cqid, vector, qsize, qflags,
                              NVME_CQ_FLAGS_IEN(qflags) != 0);
 
+    if (iosqes != NVME_SQES || iocqes != NVME_CQES) {
+        trace_pci_nvme_err_invalid_create_cq_entry_size(iosqes, iocqes);
+        return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
+    }
+
     if (unlikely(!cqid || cqid > n->conf_ioqpairs || n->cq[cqid] != NULL)) {
         trace_pci_nvme_err_invalid_create_cq_cqid(cqid);
         return NVME_INVALID_QID | NVME_DNR;
@@ -7000,7 +7008,7 @@ static void nvme_process_sq(void *opaque)
     }
 
     while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
-        addr = sq->dma_addr + sq->head * n->sqe_size;
+        addr = sq->dma_addr + (sq->head << NVME_SQES);
         if (nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd))) {
             trace_pci_nvme_err_addr_read(addr);
             trace_pci_nvme_err_cfs();
@@ -7225,34 +7233,6 @@ static int nvme_start_ctrl(NvmeCtrl *n)
                     NVME_CAP_MPSMAX(cap));
         return -1;
     }
-    if (unlikely(NVME_CC_IOCQES(cc) <
-                 NVME_CTRL_CQES_MIN(n->id_ctrl.cqes))) {
-        trace_pci_nvme_err_startfail_cqent_too_small(
-                    NVME_CC_IOCQES(cc),
-                    NVME_CTRL_CQES_MIN(cap));
-        return -1;
-    }
-    if (unlikely(NVME_CC_IOCQES(cc) >
-                 NVME_CTRL_CQES_MAX(n->id_ctrl.cqes))) {
-        trace_pci_nvme_err_startfail_cqent_too_large(
-                    NVME_CC_IOCQES(cc),
-                    NVME_CTRL_CQES_MAX(cap));
-        return -1;
-    }
-    if (unlikely(NVME_CC_IOSQES(cc) <
-                 NVME_CTRL_SQES_MIN(n->id_ctrl.sqes))) {
-        trace_pci_nvme_err_startfail_sqent_too_small(
-                    NVME_CC_IOSQES(cc),
-                    NVME_CTRL_SQES_MIN(cap));
-        return -1;
-    }
-    if (unlikely(NVME_CC_IOSQES(cc) >
-                 NVME_CTRL_SQES_MAX(n->id_ctrl.sqes))) {
-        trace_pci_nvme_err_startfail_sqent_too_large(
-                    NVME_CC_IOSQES(cc),
-                    NVME_CTRL_SQES_MAX(cap));
-        return -1;
-    }
     if (unlikely(!NVME_AQA_ASQS(aqa))) {
         trace_pci_nvme_err_startfail_asqent_sz_zero();
         return -1;
@@ -7265,8 +7245,6 @@ static int nvme_start_ctrl(NvmeCtrl *n)
     n->page_bits = page_bits;
     n->page_size = page_size;
     n->max_prp_ents = n->page_size / sizeof(uint64_t);
-    n->cqe_size = 1 << NVME_CC_IOCQES(cc);
-    n->sqe_size = 1 << NVME_CC_IOSQES(cc);
     nvme_init_cq(&n->admin_cq, n, acq, 0, 0, NVME_AQA_ACQS(aqa) + 1, 1);
     nvme_init_sq(&n->admin_sq, n, asq, 0, 0, NVME_AQA_ASQS(aqa) + 1);
 
@@ -8235,8 +8213,8 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
     id->wctemp = cpu_to_le16(NVME_TEMPERATURE_WARNING);
     id->cctemp = cpu_to_le16(NVME_TEMPERATURE_CRITICAL);
 
-    id->sqes = (0x6 << 4) | 0x6;
-    id->cqes = (0x4 << 4) | 0x4;
+    id->sqes = (NVME_SQES << 4) | NVME_SQES;
+    id->cqes = (NVME_CQES << 4) | NVME_CQES;
     id->nn = cpu_to_le32(NVME_MAX_NAMESPACES);
     id->oncs = cpu_to_le16(NVME_ONCS_WRITE_ZEROES | NVME_ONCS_TIMESTAMP |
                            NVME_ONCS_FEATURES | NVME_ONCS_DSM |
diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index 209e8f5b4c..5f2ae7b28b 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -30,6 +30,13 @@
 #define NVME_FDP_MAX_EVENTS 63
 #define NVME_FDP_MAXPIDS 128
 
+/*
+ * The controller only supports Submission and Completion Queue Entry Sizes of
+ * 64 and 16 bytes respectively.
+ */
+#define NVME_SQES 6
+#define NVME_CQES 4
+
 QEMU_BUILD_BUG_ON(NVME_MAX_NAMESPACES > NVME_NSID_BROADCAST - 1);
 
 typedef struct NvmeCtrl NvmeCtrl;
@@ -530,8 +537,6 @@ typedef struct NvmeCtrl {
     uint32_t    page_size;
     uint16_t    page_bits;
     uint16_t    max_prp_ents;
-    uint16_t    cqe_size;
-    uint16_t    sqe_size;
     uint32_t    max_q_ents;
     uint8_t     outstanding_aers;
     uint32_t    irq_status;
diff --git a/hw/nvme/trace-events b/hw/nvme/trace-events
index 9afddf3b95..3a67680c6a 100644
--- a/hw/nvme/trace-events
+++ b/hw/nvme/trace-events
@@ -168,6 +168,7 @@ pci_nvme_err_invalid_create_cq_size(uint16_t size) "failed creating completion q
 pci_nvme_err_invalid_create_cq_addr(uint64_t addr) "failed creating completion queue, addr=0x%"PRIx64""
 pci_nvme_err_invalid_create_cq_vector(uint16_t vector) "failed creating completion queue, vector=%"PRIu16""
 pci_nvme_err_invalid_create_cq_qflags(uint16_t qflags) "failed creating completion queue, qflags=%"PRIu16""
+pci_nvme_err_invalid_create_cq_entry_size(uint8_t iosqes, uint8_t iocqes) "iosqes %"PRIu8" iocqes %"PRIu8""
 pci_nvme_err_invalid_identify_cns(uint16_t cns) "identify, invalid cns=0x%"PRIx16""
 pci_nvme_err_invalid_getfeat(int dw10) "invalid get features, dw10=0x%"PRIx32""
 pci_nvme_err_invalid_setfeat(uint32_t dw10) "invalid set features, dw10=0x%"PRIx32""

From 8ada214a902225c90583b644cabd85bc89bf188c Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 28 Jul 2023 02:45:24 +0200
Subject: [PATCH 1071/1353] hw/i2c: Fix bitbang_i2c_data trace event

The clock and data values were logged swapped. Correct the trace event
text to match what is logged. Also fix a typo in a comment nearby.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i2c/bitbang_i2c.c | 2 +-
 hw/i2c/trace-events  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i2c/bitbang_i2c.c b/hw/i2c/bitbang_i2c.c
index bb18954765..de5f5aacf5 100644
--- a/hw/i2c/bitbang_i2c.c
+++ b/hw/i2c/bitbang_i2c.c
@@ -70,7 +70,7 @@ static int bitbang_i2c_ret(bitbang_i2c_interface *i2c, int level)
     return level & i2c->last_data;
 }
 
-/* Leave device data pin unodified.  */
+/* Leave device data pin unmodified.  */
 static int bitbang_i2c_nop(bitbang_i2c_interface *i2c)
 {
     return bitbang_i2c_ret(i2c, i2c->device_out);
diff --git a/hw/i2c/trace-events b/hw/i2c/trace-events
index 8e88aa24c1..d7b1e25858 100644
--- a/hw/i2c/trace-events
+++ b/hw/i2c/trace-events
@@ -5,7 +5,7 @@ bitbang_i2c_state(const char *old_state, const char *new_state) "state %s -> %s"
 bitbang_i2c_addr(uint8_t addr) "Address 0x%02x"
 bitbang_i2c_send(uint8_t byte) "TX byte 0x%02x"
 bitbang_i2c_recv(uint8_t byte) "RX byte 0x%02x"
-bitbang_i2c_data(unsigned dat, unsigned clk, unsigned old_out, unsigned new_out) "dat %u clk %u out %u -> %u"
+bitbang_i2c_data(unsigned clk, unsigned dat, unsigned old_out, unsigned new_out) "clk %u dat %u out %u -> %u"
 
 # core.c
 

From beb1a91781f127c863740c94f865fa55a22e5c81 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Thu, 3 Aug 2023 16:06:54 +0300
Subject: [PATCH 1072/1353] stubs/colo.c: spelling

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 stubs/colo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stubs/colo.c b/stubs/colo.c
index f33379d0fd..08c9f982d5 100644
--- a/stubs/colo.c
+++ b/stubs/colo.c
@@ -21,7 +21,7 @@ void colo_checkpoint_delay_set(void)
 
 void migrate_start_colo_process(MigrationState *s)
 {
-    error_report("Impossible happend: trying to start COLO when COLO "
+    error_report("Impossible happened: trying to start COLO when COLO "
                  "module is not built in");
     abort();
 }

From 6ee960823da8fd780ae9912c4327b7e85e80d846 Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Thu, 3 Aug 2023 02:15:57 +0200
Subject: [PATCH 1073/1353] Fixed incorrect LLONG alignment for openrisc and
 cris

OpenRISC (or1k) has long long alignment to 4 bytes, but currently not
defined in abitypes.h. This lead to incorrect packing of /epoll_event/
structure and eventually infinite loop while waiting for file
descriptor[s] event[s].

Fixed also CRIS alignments (1 byte for all types).

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1770
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 include/exec/user/abitypes.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index 6191ce9f74..6178453d94 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -15,8 +15,16 @@
 #define ABI_LLONG_ALIGNMENT 2
 #endif
 
+#ifdef TARGET_CRIS
+#define ABI_SHORT_ALIGNMENT 1
+#define ABI_INT_ALIGNMENT 1
+#define ABI_LONG_ALIGNMENT 1
+#define ABI_LLONG_ALIGNMENT 1
+#endif
+
 #if (defined(TARGET_I386) && !defined(TARGET_X86_64)) \
     || defined(TARGET_SH4) \
+    || defined(TARGET_OPENRISC) \
     || defined(TARGET_MICROBLAZE) \
     || defined(TARGET_NIOS2)
 #define ABI_LLONG_ALIGNMENT 4

From 81cd34a359a36656d2f6542226235bd318ff8873 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 10 May 2023 11:25:31 +0400
Subject: [PATCH 1074/1353] chardev: report the handshake error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This can help to debug connection issues.

Related to:
https://bugzilla.redhat.com/show_bug.cgi?id=2196182

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230510072531.3937189-1-marcandre.lureau@redhat.com>
---
 chardev/char-socket.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 8c58532171..e8e3a743d5 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -742,8 +742,12 @@ static void tcp_chr_websock_handshake(QIOTask *task, gpointer user_data)
 {
     Chardev *chr = user_data;
     SocketChardev *s = user_data;
+    Error *err = NULL;
 
-    if (qio_task_propagate_error(task, NULL)) {
+    if (qio_task_propagate_error(task, &err)) {
+        error_reportf_err(err,
+                          "websock handshake of character device %s failed: ",
+                          chr->label);
         tcp_chr_disconnect(chr);
     } else {
         if (s->do_telnetopt) {
@@ -778,8 +782,12 @@ static void tcp_chr_tls_handshake(QIOTask *task,
 {
     Chardev *chr = user_data;
     SocketChardev *s = user_data;
+    Error *err = NULL;
 
-    if (qio_task_propagate_error(task, NULL)) {
+    if (qio_task_propagate_error(task, &err)) {
+        error_reportf_err(err,
+                          "TLS handshake of character device %s failed: ",
+                          chr->label);
         tcp_chr_disconnect(chr);
     } else {
         if (s->is_websock) {

From 957d77863e4564454eb97f8f371096843daf4678 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 26 Jul 2023 21:39:28 +0400
Subject: [PATCH 1075/1353] virtio-gpu: free BHs, by implementing unrealize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Acked-by: Dongwon Kim <dongwon.kim@intel.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230726173929.690601-2-marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu-base.c   |  2 +-
 hw/display/virtio-gpu.c        | 10 ++++++++++
 include/hw/virtio/virtio-gpu.h |  1 +
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index 7ab7d08d0a..ca1fb7b16f 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -244,7 +244,7 @@ virtio_gpu_base_set_features(VirtIODevice *vdev, uint64_t features)
     trace_virtio_gpu_features(((features & virgl) == virgl));
 }
 
-static void
+void
 virtio_gpu_base_device_unrealize(DeviceState *qdev)
 {
     VirtIOGPUBase *g = VIRTIO_GPU_BASE(qdev);
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index e8603d78ca..b1f5d392bb 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1392,6 +1392,15 @@ void virtio_gpu_device_realize(DeviceState *qdev, Error **errp)
     QTAILQ_INIT(&g->fenceq);
 }
 
+static void virtio_gpu_device_unrealize(DeviceState *qdev)
+{
+    VirtIOGPU *g = VIRTIO_GPU(qdev);
+
+    g_clear_pointer(&g->ctrl_bh, qemu_bh_delete);
+    g_clear_pointer(&g->cursor_bh, qemu_bh_delete);
+    virtio_gpu_base_device_unrealize(qdev);
+}
+
 void virtio_gpu_reset(VirtIODevice *vdev)
 {
     VirtIOGPU *g = VIRTIO_GPU(vdev);
@@ -1492,6 +1501,7 @@ static void virtio_gpu_class_init(ObjectClass *klass, void *data)
     vgbc->gl_flushed = virtio_gpu_handle_gl_flushed;
 
     vdc->realize = virtio_gpu_device_realize;
+    vdc->unrealize = virtio_gpu_device_unrealize;
     vdc->reset = virtio_gpu_reset;
     vdc->get_config = virtio_gpu_get_config;
     vdc->set_config = virtio_gpu_set_config;
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 7ea8ae2bee..05bee09e1a 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -238,6 +238,7 @@ bool virtio_gpu_base_device_realize(DeviceState *qdev,
                                     VirtIOHandleOutput ctrl_cb,
                                     VirtIOHandleOutput cursor_cb,
                                     Error **errp);
+void virtio_gpu_base_device_unrealize(DeviceState *qdev);
 void virtio_gpu_base_reset(VirtIOGPUBase *g);
 void virtio_gpu_base_fill_display_info(VirtIOGPUBase *g,
                         struct virtio_gpu_resp_display_info *dpy_info);

From a41e2d97f92b48552988b3cc62dce79d62f60dcc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 26 Jul 2023 21:39:29 +0400
Subject: [PATCH 1076/1353] virtio-gpu: reset gfx resources in main thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Calling OpenGL from different threads can have bad consequences if not
carefully reviewed. It's not generally supported. In my case, I was
debugging a crash in glDeleteTextures from OPENGL32.DLL, where I asked
qemu for gl=es, and thus ANGLE implementation was expected. libepoxy did
resolution of the global pointer for glGenTexture to the GLES version
from the main thread. But it resolved glDeleteTextures to the GL
version, because it was done from a different thread without correct
context. Oops.

Let's stick to the main thread for GL calls by using a BH.

Note: I didn't use atomics for reset_finished check, assuming the BQL
will provide enough of sync, but I might be wrong.

Acked-by: Dongwon Kim <dongwon.kim@intel.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230726173929.690601-3-marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu.c        | 40 +++++++++++++++++++++++++++-------
 include/hw/virtio/virtio-gpu.h |  3 +++
 2 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index b1f5d392bb..bbd5c6561a 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -14,6 +14,7 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qemu/iov.h"
+#include "sysemu/cpus.h"
 #include "ui/console.h"
 #include "trace.h"
 #include "sysemu/dma.h"
@@ -41,6 +42,7 @@ virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id,
 
 static void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
                                        struct virtio_gpu_simple_resource *res);
+static void virtio_gpu_reset_bh(void *opaque);
 
 void virtio_gpu_update_cursor_data(VirtIOGPU *g,
                                    struct virtio_gpu_scanout *s,
@@ -1387,6 +1389,8 @@ void virtio_gpu_device_realize(DeviceState *qdev, Error **errp)
                                      &qdev->mem_reentrancy_guard);
     g->cursor_bh = qemu_bh_new_guarded(virtio_gpu_cursor_bh, g,
                                        &qdev->mem_reentrancy_guard);
+    g->reset_bh = qemu_bh_new(virtio_gpu_reset_bh, g);
+    qemu_cond_init(&g->reset_cond);
     QTAILQ_INIT(&g->reslist);
     QTAILQ_INIT(&g->cmdq);
     QTAILQ_INIT(&g->fenceq);
@@ -1398,18 +1402,42 @@ static void virtio_gpu_device_unrealize(DeviceState *qdev)
 
     g_clear_pointer(&g->ctrl_bh, qemu_bh_delete);
     g_clear_pointer(&g->cursor_bh, qemu_bh_delete);
+    g_clear_pointer(&g->reset_bh, qemu_bh_delete);
+    qemu_cond_destroy(&g->reset_cond);
     virtio_gpu_base_device_unrealize(qdev);
 }
 
+static void virtio_gpu_reset_bh(void *opaque)
+{
+    VirtIOGPU *g = VIRTIO_GPU(opaque);
+    struct virtio_gpu_simple_resource *res, *tmp;
+    int i = 0;
+
+    QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {
+        virtio_gpu_resource_destroy(g, res);
+    }
+
+    for (i = 0; i < g->parent_obj.conf.max_outputs; i++) {
+        dpy_gfx_replace_surface(g->parent_obj.scanout[i].con, NULL);
+    }
+
+    g->reset_finished = true;
+    qemu_cond_signal(&g->reset_cond);
+}
+
 void virtio_gpu_reset(VirtIODevice *vdev)
 {
     VirtIOGPU *g = VIRTIO_GPU(vdev);
-    struct virtio_gpu_simple_resource *res, *tmp;
     struct virtio_gpu_ctrl_command *cmd;
-    int i = 0;
 
-    QTAILQ_FOREACH_SAFE(res, &g->reslist, next, tmp) {
-        virtio_gpu_resource_destroy(g, res);
+    if (qemu_in_vcpu_thread()) {
+        g->reset_finished = false;
+        qemu_bh_schedule(g->reset_bh);
+        while (!g->reset_finished) {
+            qemu_cond_wait_iothread(&g->reset_cond);
+        }
+    } else {
+        virtio_gpu_reset_bh(g);
     }
 
     while (!QTAILQ_EMPTY(&g->cmdq)) {
@@ -1425,10 +1453,6 @@ void virtio_gpu_reset(VirtIODevice *vdev)
         g_free(cmd);
     }
 
-    for (i = 0; i < g->parent_obj.conf.max_outputs; i++) {
-        dpy_gfx_replace_surface(g->parent_obj.scanout[i].con, NULL);
-    }
-
     virtio_gpu_base_reset(VIRTIO_GPU_BASE(vdev));
 }
 
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 05bee09e1a..390c4642b8 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -169,6 +169,9 @@ struct VirtIOGPU {
 
     QEMUBH *ctrl_bh;
     QEMUBH *cursor_bh;
+    QEMUBH *reset_bh;
+    QemuCond reset_cond;
+    bool reset_finished;
 
     QTAILQ_HEAD(, virtio_gpu_simple_resource) reslist;
     QTAILQ_HEAD(, virtio_gpu_ctrl_command) cmdq;

From 8a64609eea8cb2bac015968c4b62da5bce266e22 Mon Sep 17 00:00:00 2001
From: Dongli Zhang <dongli.zhang@oracle.com>
Date: Wed, 12 Jul 2023 22:58:19 -0700
Subject: [PATCH 1077/1353] dump: kdump-zlib data pages not dumped with
 pvtime/aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The kdump-zlib data pages are not dumped from aarch64 host when the
'pvtime' is involved, that is, when the block->target_end is not aligned to
page_size. In the below example, it is expected to dump two blocks.

(qemu) info mtree -f
... ...
  00000000090a0000-00000000090a0fff (prio 0, ram): pvtime KVM
... ...
  0000000040000000-00000001bfffffff (prio 0, ram): mach-virt.ram KVM
... ...

However, there is an issue with get_next_page() so that the pages for
"mach-virt.ram" will not be dumped.

At line 1296, although we have reached at the end of the 'pvtime' block,
since it is not aligned to the page_size (e.g., 0x10000), it will not break
at line 1298.

1255 static bool get_next_page(GuestPhysBlock **blockptr, uint64_t *pfnptr,
1256                           uint8_t **bufptr, DumpState *s)
... ...
1294             memcpy(buf + addr % page_size, hbuf, n);
1295             addr += n;
1296             if (addr % page_size == 0) {
1297                 /* we filled up the page */
1298                 break;
1299             }

As a result, get_next_page() will continue to the next
block ("mach-virt.ram"). Finally, when get_next_page() returns to the
caller:

- 'pfnptr' is referring to the 'pvtime'
- but 'blockptr' is referring to the "mach-virt.ram"

When get_next_page() is called the next time, "*pfnptr += 1" still refers
to the prior 'pvtime'. It will exit immediately because it is out of the
range of the current "mach-virt.ram".

The fix is to break when it is time to come to the next block, so that both
'pfnptr' and 'blockptr' refer to the same block.

Fixes: 94d788408d2d ("dump: fix kdump to work over non-aligned blocks")
Cc: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230713055819.30497-1-dongli.zhang@oracle.com>
---
 dump/dump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dump/dump.c b/dump/dump.c
index 1f1a6edcab..d4ef713cd0 100644
--- a/dump/dump.c
+++ b/dump/dump.c
@@ -1293,8 +1293,8 @@ static bool get_next_page(GuestPhysBlock **blockptr, uint64_t *pfnptr,
 
             memcpy(buf + addr % page_size, hbuf, n);
             addr += n;
-            if (addr % page_size == 0) {
-                /* we filled up the page */
+            if (addr % page_size == 0 || addr >= block->target_end) {
+                /* we filled up the page or the current block is finished */
                 break;
             }
         } else {

From fdd649538e6c6c9ef99082cb74cc36dbb6b9f953 Mon Sep 17 00:00:00 2001
From: Zongmin Zhou <zhouzongmin@kylinos.cn>
Date: Thu, 13 Apr 2023 16:15:26 +0800
Subject: [PATCH 1078/1353] hw/i386/vmmouse:add relative packet flag for button
 status
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The buttons value use macros instead of direct numbers.

If request relative mode, have to add this for
guest vmmouse driver to judge this is a relative packet.
otherwise,vmmouse driver will not match
the condition 'status & VMMOUSE_RELATIVE_PACKET',
and can't report events on the correct(relative) input device,
result to relative mode unuseful.

Signed-off-by: Zongmin Zhou<zhouzongmin@kylinos.cn>
Message-ID: <20230413081526.2229916-1-zhouzongmin@kylinos.cn>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/i386/vmmouse.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/hw/i386/vmmouse.c b/hw/i386/vmmouse.c
index a56c185f15..6cd624bd09 100644
--- a/hw/i386/vmmouse.c
+++ b/hw/i386/vmmouse.c
@@ -44,6 +44,12 @@
 
 #define VMMOUSE_VERSION		0x3442554a
 
+#define VMMOUSE_RELATIVE_PACKET    0x00010000
+
+#define VMMOUSE_LEFT_BUTTON        0x20
+#define VMMOUSE_RIGHT_BUTTON       0x10
+#define VMMOUSE_MIDDLE_BUTTON      0x08
+
 #ifdef DEBUG_VMMOUSE
 #define DPRINTF(fmt, ...) printf(fmt, ## __VA_ARGS__)
 #else
@@ -103,15 +109,18 @@ static void vmmouse_mouse_event(void *opaque, int x, int y, int dz, int buttons_
             x, y, dz, buttons_state);
 
     if ((buttons_state & MOUSE_EVENT_LBUTTON))
-        buttons |= 0x20;
+        buttons |= VMMOUSE_LEFT_BUTTON;
     if ((buttons_state & MOUSE_EVENT_RBUTTON))
-        buttons |= 0x10;
+        buttons |= VMMOUSE_RIGHT_BUTTON;
     if ((buttons_state & MOUSE_EVENT_MBUTTON))
-        buttons |= 0x08;
+        buttons |= VMMOUSE_MIDDLE_BUTTON;
 
     if (s->absolute) {
         x <<= 1;
         y <<= 1;
+    } else{
+        /* add for guest vmmouse driver to judge this is a relative packet. */
+        buttons |= VMMOUSE_RELATIVE_PACKET;
     }
 
     s->queue[s->nb_queue++] = buttons;

From 58ea90f8032912b41e753a95089ba764fcc6446a Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Mon, 24 Jul 2023 17:11:31 -0700
Subject: [PATCH 1079/1353] ui/gtk: set scanout mode in
 gd_egl/gd_gl_area_scanout_texture
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixing a regression (black screen) caused by a commit 92b58156e7
("ui/gtk: set scanout-mode right before scheduling draw").

The commit 92b58156e7 was made with an assumption that the scanout
mode needs to be set only if the guest scanout is a dmabuf but there
are cases (e.g. virtio-gpu-virgl) where the scanout is still processed
in a form of a texture but is not backed by dmabuf. So it is needed
to put back the line that sets scanout mode in gd_egl_scanout_texture
and gd_gl_area_scanout_texture.

Fixes: 92b58156e7 ("ui/gtk: set scanout-mode right before scheduling draw)
Reported-by: Volker Rümelin <vr_qemu@t-online.de>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20230725001131.24017-1-dongwon.kim@intel.com>
---
 ui/gtk-egl.c     | 1 +
 ui/gtk-gl-area.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 4c29ac10d0..a1060fd80f 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -246,6 +246,7 @@ void gd_egl_scanout_texture(DisplayChangeListener *dcl,
     eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
                    vc->gfx.esurface, vc->gfx.ectx);
 
+    gtk_egl_set_scanout_mode(vc, true);
     egl_fb_setup_for_tex(&vc->gfx.guest_fb, backing_width, backing_height,
                          backing_id, false);
 }
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 1ce34a249e..52dcac161e 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -268,6 +268,7 @@ void gd_gl_area_scanout_texture(DisplayChangeListener *dcl,
         return;
     }
 
+    gtk_gl_area_set_scanout_mode(vc, true);
     egl_fb_setup_for_tex(&vc->gfx.guest_fb, backing_width, backing_height,
                          backing_id, false);
 }

From dbdb13f931d7cf2d3c3ca662e751bb1551e9eab6 Mon Sep 17 00:00:00 2001
From: Ankit Kumar <ankit.kumar@samsung.com>
Date: Tue, 8 Aug 2023 02:57:43 +0530
Subject: [PATCH 1080/1353] hw/nvme: fix CRC64 for guard tag

The nvme CRC64 generator expects the caller to pass inverted seed value.
Pass inverted crc value for metadata buffer.

Cc: qemu-stable@nongnu.org
Fixes: 44219b6029fc ("hw/nvme: 64-bit pi support")
Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/dif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/nvme/dif.c b/hw/nvme/dif.c
index 63c44c86ab..01b19c3373 100644
--- a/hw/nvme/dif.c
+++ b/hw/nvme/dif.c
@@ -115,7 +115,7 @@ static void nvme_dif_pract_generate_dif_crc64(NvmeNamespace *ns, uint8_t *buf,
         uint64_t crc = crc64_nvme(~0ULL, buf, ns->lbasz);
 
         if (pil) {
-            crc = crc64_nvme(crc, mbuf, pil);
+            crc = crc64_nvme(~crc, mbuf, pil);
         }
 
         dif->g64.guard = cpu_to_be64(crc);
@@ -246,7 +246,7 @@ static uint16_t nvme_dif_prchk_crc64(NvmeNamespace *ns, NvmeDifTuple *dif,
         uint64_t crc = crc64_nvme(~0ULL, buf, ns->lbasz);
 
         if (pil) {
-            crc = crc64_nvme(crc, mbuf, pil);
+            crc = crc64_nvme(~crc, mbuf, pil);
         }
 
         trace_pci_nvme_dif_prchk_guard_crc64(be64_to_cpu(dif->g64.guard), crc);

From ec5a138ce63ce460575a44cf9ec3172c33eb0fd6 Mon Sep 17 00:00:00 2001
From: Ankit Kumar <ankit.kumar@samsung.com>
Date: Tue, 8 Aug 2023 02:57:45 +0530
Subject: [PATCH 1081/1353] docs: update hw/nvme documentation for protection
 information

Add missing entry for pif ("protection information format").
Protection information size can be 8 or 16 bytes, Update the pil entry
as per the NVM command set specification.

Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 docs/system/devices/nvme.rst | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/docs/system/devices/nvme.rst b/docs/system/devices/nvme.rst
index 2a3af268f7..4ea957baed 100644
--- a/docs/system/devices/nvme.rst
+++ b/docs/system/devices/nvme.rst
@@ -271,9 +271,15 @@ The virtual namespace device supports DIF- and DIX-based protection information
 
 ``pil=UINT8`` (default: ``0``)
   Controls the location of the protection information within the metadata. Set
-  to ``1`` to transfer protection information as the first eight bytes of
-  metadata. Otherwise, the protection information is transferred as the last
-  eight bytes.
+  to ``1`` to transfer protection information as the first bytes of metadata.
+  Otherwise, the protection information is transferred as the last bytes of
+  metadata.
+
+``pif=UINT8`` (default: ``0``)
+  By default, the namespace device uses 16 bit guard protection information
+  format (``pif=0``). Set to ``2`` to enable 64 bit guard protection
+  information format. This requires at least 16 bytes of metadata. Note that
+  ``pif=1`` (32 bit guards) is currently not supported.
 
 Virtualization Enhancements and SR-IOV (Experimental Support)
 -------------------------------------------------------------

From f140823c5644807d850d01a3f5b61a0fe5ef53f2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 14:03:01 +0200
Subject: [PATCH 1082/1353] configure: fix detection for x32 linux-user

x32 uses the same signal handling fragments as x86_64, since host_arch
is set to x86_64 when Meson runs.  Remove the unnecessary forwarder and
set the host_arch variable properly in configure.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20230808120303.585509-2-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure                                 | 2 ++
 linux-user/include/host/x32/host-signal.h | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)
 delete mode 100644 linux-user/include/host/x32/host-signal.h

diff --git a/configure b/configure
index 98dc78280e..484d38d81f 100755
--- a/configure
+++ b/configure
@@ -472,6 +472,8 @@ fi
 case "$cpu" in
   riscv*)
     host_arch=riscv ;;
+  x32)
+    host_arch=x86_64 ;;
   *)
     host_arch="$cpu" ;;
 esac
diff --git a/linux-user/include/host/x32/host-signal.h b/linux-user/include/host/x32/host-signal.h
deleted file mode 100644
index 26800591d3..0000000000
--- a/linux-user/include/host/x32/host-signal.h
+++ /dev/null
@@ -1 +0,0 @@
-#include "../x86_64/host-signal.h"

From 50a001222737ca04feb77f9117a623b91d61f2cd Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 14:03:02 +0200
Subject: [PATCH 1083/1353] linux-user: cleanup unused linux-user/include/host
 directories

Alpha and 31-bit s390 lack the assembly fragment to handle signals
occurring at the same time as system calls, so they cannot run
linux-user emulation anymore.  Drop the host-signal.h files for
them.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20230808120303.585509-3-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-user/include/host/alpha/host-signal.h |  55 --------
 linux-user/include/host/s390/host-signal.h  | 138 -------------------
 linux-user/include/host/s390x/host-signal.h | 139 +++++++++++++++++++-
 3 files changed, 138 insertions(+), 194 deletions(-)
 delete mode 100644 linux-user/include/host/alpha/host-signal.h
 delete mode 100644 linux-user/include/host/s390/host-signal.h

diff --git a/linux-user/include/host/alpha/host-signal.h b/linux-user/include/host/alpha/host-signal.h
deleted file mode 100644
index 4f9e2abc4b..0000000000
--- a/linux-user/include/host/alpha/host-signal.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * host-signal.h: signal info dependent on the host architecture
- *
- * Copyright (c) 2003-2005 Fabrice Bellard
- * Copyright (c) 2021 Linaro Limited
- *
- * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#ifndef ALPHA_HOST_SIGNAL_H
-#define ALPHA_HOST_SIGNAL_H
-
-/* The third argument to a SA_SIGINFO handler is ucontext_t. */
-typedef ucontext_t host_sigcontext;
-
-static inline uintptr_t host_signal_pc(host_sigcontext *uc)
-{
-    return uc->uc_mcontext.sc_pc;
-}
-
-static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
-{
-    uc->uc_mcontext.sc_pc = pc;
-}
-
-static inline void *host_signal_mask(host_sigcontext *uc)
-{
-    return &uc->uc_sigmask;
-}
-
-static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
-{
-    uint32_t *pc = (uint32_t *)host_signal_pc(uc);
-    uint32_t insn = *pc;
-
-    /* XXX: need kernel patch to get write flag faster */
-    switch (insn >> 26) {
-    case 0x0d: /* stw */
-    case 0x0e: /* stb */
-    case 0x0f: /* stq_u */
-    case 0x24: /* stf */
-    case 0x25: /* stg */
-    case 0x26: /* sts */
-    case 0x27: /* stt */
-    case 0x2c: /* stl */
-    case 0x2d: /* stq */
-    case 0x2e: /* stl_c */
-    case 0x2f: /* stq_c */
-        return true;
-    }
-    return false;
-}
-
-#endif
diff --git a/linux-user/include/host/s390/host-signal.h b/linux-user/include/host/s390/host-signal.h
deleted file mode 100644
index e6d3ec26dc..0000000000
--- a/linux-user/include/host/s390/host-signal.h
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * host-signal.h: signal info dependent on the host architecture
- *
- * Copyright (c) 2003-2005 Fabrice Bellard
- * Copyright (c) 2021 Linaro Limited
- *
- * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#ifndef S390_HOST_SIGNAL_H
-#define S390_HOST_SIGNAL_H
-
-/* The third argument to a SA_SIGINFO handler is ucontext_t. */
-typedef ucontext_t host_sigcontext;
-
-static inline uintptr_t host_signal_pc(host_sigcontext *uc)
-{
-    return uc->uc_mcontext.psw.addr;
-}
-
-static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
-{
-    uc->uc_mcontext.psw.addr = pc;
-}
-
-static inline void *host_signal_mask(host_sigcontext *uc)
-{
-    return &uc->uc_sigmask;
-}
-
-static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
-{
-    uint16_t *pinsn = (uint16_t *)host_signal_pc(uc);
-
-    /*
-     * ??? On linux, the non-rt signal handler has 4 (!) arguments instead
-     * of the normal 2 arguments.  The 4th argument contains the "Translation-
-     * Exception Identification for DAT Exceptions" from the hardware (aka
-     * "int_parm_long"), which does in fact contain the is_write value.
-     * The rt signal handler, as far as I can tell, does not give this value
-     * at all.  Not that we could get to it from here even if it were.
-     * So fall back to parsing instructions.  Treat read-modify-write ones as
-     * writes, which is not fully correct, but for tracking self-modifying code
-     * this is better than treating them as reads.  Checking si_addr page flags
-     * might be a viable improvement, albeit a racy one.
-     */
-    /* ??? This is not even close to complete.  */
-    switch (pinsn[0] >> 8) {
-    case 0x50: /* ST */
-    case 0x42: /* STC */
-    case 0x40: /* STH */
-    case 0x44: /* EX */
-    case 0xba: /* CS */
-    case 0xbb: /* CDS */
-        return true;
-    case 0xc4: /* RIL format insns */
-        switch (pinsn[0] & 0xf) {
-        case 0xf: /* STRL */
-        case 0xb: /* STGRL */
-        case 0x7: /* STHRL */
-            return true;
-        }
-        break;
-    case 0xc6: /* RIL-b format insns */
-        switch (pinsn[0] & 0xf) {
-        case 0x0: /* EXRL */
-            return true;
-        }
-        break;
-    case 0xc8: /* SSF format insns */
-        switch (pinsn[0] & 0xf) {
-        case 0x2: /* CSST */
-            return true;
-        }
-        break;
-    case 0xe3: /* RXY format insns */
-        switch (pinsn[2] & 0xff) {
-        case 0x50: /* STY */
-        case 0x24: /* STG */
-        case 0x72: /* STCY */
-        case 0x70: /* STHY */
-        case 0x8e: /* STPQ */
-        case 0x3f: /* STRVH */
-        case 0x3e: /* STRV */
-        case 0x2f: /* STRVG */
-            return true;
-        }
-        break;
-    case 0xe6:
-        switch (pinsn[2] & 0xff) {
-        case 0x09: /* VSTEBRH */
-        case 0x0a: /* VSTEBRG */
-        case 0x0b: /* VSTEBRF */
-        case 0x0e: /* VSTBR */
-        case 0x0f: /* VSTER */
-        case 0x3f: /* VSTRLR */
-            return true;
-        }
-        break;
-    case 0xe7:
-        switch (pinsn[2] & 0xff) {
-        case 0x08: /* VSTEB */
-        case 0x09: /* VSTEH */
-        case 0x0a: /* VSTEG */
-        case 0x0b: /* VSTEF */
-        case 0x0e: /* VST */
-        case 0x1a: /* VSCEG */
-        case 0x1b: /* VSCEF */
-        case 0x3e: /* VSTM */
-        case 0x3f: /* VSTL */
-            return true;
-        }
-        break;
-    case 0xeb: /* RSY format insns */
-        switch (pinsn[2] & 0xff) {
-        case 0x14: /* CSY */
-        case 0x30: /* CSG */
-        case 0x31: /* CDSY */
-        case 0x3e: /* CDSG */
-        case 0xe4: /* LANG */
-        case 0xe6: /* LAOG */
-        case 0xe7: /* LAXG */
-        case 0xe8: /* LAAG */
-        case 0xea: /* LAALG */
-        case 0xf4: /* LAN */
-        case 0xf6: /* LAO */
-        case 0xf7: /* LAX */
-        case 0xfa: /* LAAL */
-        case 0xf8: /* LAA */
-            return true;
-        }
-        break;
-    }
-    return false;
-}
-
-#endif
diff --git a/linux-user/include/host/s390x/host-signal.h b/linux-user/include/host/s390x/host-signal.h
index 0e83f9358d..e6d3ec26dc 100644
--- a/linux-user/include/host/s390x/host-signal.h
+++ b/linux-user/include/host/s390x/host-signal.h
@@ -1 +1,138 @@
-#include "../s390/host-signal.h"
+/*
+ * host-signal.h: signal info dependent on the host architecture
+ *
+ * Copyright (c) 2003-2005 Fabrice Bellard
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef S390_HOST_SIGNAL_H
+#define S390_HOST_SIGNAL_H
+
+/* The third argument to a SA_SIGINFO handler is ucontext_t. */
+typedef ucontext_t host_sigcontext;
+
+static inline uintptr_t host_signal_pc(host_sigcontext *uc)
+{
+    return uc->uc_mcontext.psw.addr;
+}
+
+static inline void host_signal_set_pc(host_sigcontext *uc, uintptr_t pc)
+{
+    uc->uc_mcontext.psw.addr = pc;
+}
+
+static inline void *host_signal_mask(host_sigcontext *uc)
+{
+    return &uc->uc_sigmask;
+}
+
+static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
+{
+    uint16_t *pinsn = (uint16_t *)host_signal_pc(uc);
+
+    /*
+     * ??? On linux, the non-rt signal handler has 4 (!) arguments instead
+     * of the normal 2 arguments.  The 4th argument contains the "Translation-
+     * Exception Identification for DAT Exceptions" from the hardware (aka
+     * "int_parm_long"), which does in fact contain the is_write value.
+     * The rt signal handler, as far as I can tell, does not give this value
+     * at all.  Not that we could get to it from here even if it were.
+     * So fall back to parsing instructions.  Treat read-modify-write ones as
+     * writes, which is not fully correct, but for tracking self-modifying code
+     * this is better than treating them as reads.  Checking si_addr page flags
+     * might be a viable improvement, albeit a racy one.
+     */
+    /* ??? This is not even close to complete.  */
+    switch (pinsn[0] >> 8) {
+    case 0x50: /* ST */
+    case 0x42: /* STC */
+    case 0x40: /* STH */
+    case 0x44: /* EX */
+    case 0xba: /* CS */
+    case 0xbb: /* CDS */
+        return true;
+    case 0xc4: /* RIL format insns */
+        switch (pinsn[0] & 0xf) {
+        case 0xf: /* STRL */
+        case 0xb: /* STGRL */
+        case 0x7: /* STHRL */
+            return true;
+        }
+        break;
+    case 0xc6: /* RIL-b format insns */
+        switch (pinsn[0] & 0xf) {
+        case 0x0: /* EXRL */
+            return true;
+        }
+        break;
+    case 0xc8: /* SSF format insns */
+        switch (pinsn[0] & 0xf) {
+        case 0x2: /* CSST */
+            return true;
+        }
+        break;
+    case 0xe3: /* RXY format insns */
+        switch (pinsn[2] & 0xff) {
+        case 0x50: /* STY */
+        case 0x24: /* STG */
+        case 0x72: /* STCY */
+        case 0x70: /* STHY */
+        case 0x8e: /* STPQ */
+        case 0x3f: /* STRVH */
+        case 0x3e: /* STRV */
+        case 0x2f: /* STRVG */
+            return true;
+        }
+        break;
+    case 0xe6:
+        switch (pinsn[2] & 0xff) {
+        case 0x09: /* VSTEBRH */
+        case 0x0a: /* VSTEBRG */
+        case 0x0b: /* VSTEBRF */
+        case 0x0e: /* VSTBR */
+        case 0x0f: /* VSTER */
+        case 0x3f: /* VSTRLR */
+            return true;
+        }
+        break;
+    case 0xe7:
+        switch (pinsn[2] & 0xff) {
+        case 0x08: /* VSTEB */
+        case 0x09: /* VSTEH */
+        case 0x0a: /* VSTEG */
+        case 0x0b: /* VSTEF */
+        case 0x0e: /* VST */
+        case 0x1a: /* VSCEG */
+        case 0x1b: /* VSCEF */
+        case 0x3e: /* VSTM */
+        case 0x3f: /* VSTL */
+            return true;
+        }
+        break;
+    case 0xeb: /* RSY format insns */
+        switch (pinsn[2] & 0xff) {
+        case 0x14: /* CSY */
+        case 0x30: /* CSG */
+        case 0x31: /* CDSY */
+        case 0x3e: /* CDSG */
+        case 0xe4: /* LANG */
+        case 0xe6: /* LAOG */
+        case 0xe7: /* LAXG */
+        case 0xe8: /* LAAG */
+        case 0xea: /* LAALG */
+        case 0xf4: /* LAN */
+        case 0xf6: /* LAO */
+        case 0xf7: /* LAX */
+        case 0xfa: /* LAAL */
+        case 0xf8: /* LAA */
+            return true;
+        }
+        break;
+    }
+    return false;
+}
+
+#endif

From 971fac2731e60f2143f35648b14fd2f1b5b2c1af Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 14:03:03 +0200
Subject: [PATCH 1084/1353] configure: unify case statements for CPU
 canonicalization

The CPU model has to be canonicalized to what Meson wants in the cross
file, to what Linux uses for its asm-$ARCH directories, and to what
QEMU uses for its user-mode emulation host/$ARCH directories.  Do
all three in a single case statement, and check that the Linux and
QEMU directories actually exist.

At a small cost in repeated lines, this ensures that there are no hidden
ordering requirements between the case statements.  In particular, commit
89e5b7935e9 ("configure: Fix linux-user host detection for riscv64",
2023-08-06) broke ppc64le because it assigned host_arch based on a
non-canonicalized version of $cpu.

Reported-by: Joel Stanley <joel@jms.id.au>
Fixes: 89e5b7935e9 ("configure: Fix linux-user host detection for riscv64", 2023-08-06)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20230808120303.585509-4-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure | 175 +++++++++++++++++++++++++++++++-----------------------
 1 file changed, 102 insertions(+), 73 deletions(-)

diff --git a/configure b/configure
index 484d38d81f..133f4e3235 100755
--- a/configure
+++ b/configure
@@ -469,59 +469,119 @@ else
   echo "WARNING: unrecognized host CPU, proceeding with 'uname -m' output '$cpu'"
 fi
 
-case "$cpu" in
-  riscv*)
-    host_arch=riscv ;;
-  x32)
-    host_arch=x86_64 ;;
-  *)
-    host_arch="$cpu" ;;
-esac
-
-# Normalise host CPU name and set multilib cflags.  The canonicalization
-# isn't really necessary, because the architectures that we check for
-# should not hit the 'uname -m' case, but better safe than sorry.
+# Normalise host CPU name to the values used by Meson cross files and in source
+# directories, and set multilib cflags.  The canonicalization isn't really
+# necessary, because the architectures that we check for should not hit the
+# 'uname -m' case, but better safe than sorry in case --cpu= is used.
+#
 # Note that this case should only have supported host CPUs, not guests.
+# Please keep it sorted and synchronized with meson.build's host_arch.
+host_arch=
+linux_arch=
 case "$cpu" in
+  aarch64)
+    host_arch=aarch64
+    linux_arch=arm64
+    ;;
+
   armv*b|armv*l|arm)
-    cpu="arm" ;;
+    cpu=arm
+    host_arch=arm
+    linux_arch=arm
+    ;;
 
   i386|i486|i586|i686)
     cpu="i386"
-    CPU_CFLAGS="-m32" ;;
+    host_arch=i386
+    linux_arch=x86
+    CPU_CFLAGS="-m32"
+    ;;
+
+  loongarch*)
+    cpu=loongarch64
+    host_arch=loongarch64
+    ;;
+
+  mips64*)
+    cpu=mips64
+    host_arch=mips
+    linux_arch=mips
+    ;;
+  mips*)
+    cpu=mips
+    host_arch=mips
+    linux_arch=mips
+    ;;
+
+  ppc)
+    host_arch=ppc
+    linux_arch=powerpc
+    CPU_CFLAGS="-m32"
+    ;;
+  ppc64)
+    host_arch=ppc64
+    linux_arch=powerpc
+    CPU_CFLAGS="-m64 -mbig-endian"
+    ;;
+  ppc64le)
+    cpu=ppc64
+    host_arch=ppc64
+    linux_arch=powerpc
+    CPU_CFLAGS="-m64 -mlittle-endian"
+    ;;
+
+  riscv32 | riscv64)
+    host_arch=riscv
+    linux_arch=riscv
+    ;;
+
+  s390)
+    linux_arch=s390
+    CPU_CFLAGS="-m31"
+    ;;
+  s390x)
+    host_arch=s390x
+    linux_arch=s390
+    CPU_CFLAGS="-m64"
+    ;;
+
+  sparc|sun4[cdmuv])
+    cpu=sparc
+    CPU_CFLAGS="-m32 -mv8plus -mcpu=ultrasparc"
+    ;;
+  sparc64)
+    host_arch=sparc64
+    CPU_CFLAGS="-m64 -mcpu=ultrasparc"
+    ;;
+
   x32)
     cpu="x86_64"
-    CPU_CFLAGS="-mx32" ;;
+    host_arch=x86_64
+    linux_arch=x86
+    CPU_CFLAGS="-mx32"
+    ;;
   x86_64|amd64)
     cpu="x86_64"
+    host_arch=x86_64
+    linux_arch=x86
     # ??? Only extremely old AMD cpus do not have cmpxchg16b.
     # If we truly care, we should simply detect this case at
     # runtime and generate the fallback to serial emulation.
-    CPU_CFLAGS="-m64 -mcx16" ;;
-
-  mips*)
-    cpu="mips" ;;
-
-  ppc)
-    CPU_CFLAGS="-m32" ;;
-  ppc64)
-    CPU_CFLAGS="-m64 -mbig-endian" ;;
-  ppc64le)
-    cpu="ppc64"
-    CPU_CFLAGS="-m64 -mlittle-endian" ;;
-
-  s390)
-    CPU_CFLAGS="-m31" ;;
-  s390x)
-    CPU_CFLAGS="-m64" ;;
-
-  sparc|sun4[cdmuv])
-    cpu="sparc"
-    CPU_CFLAGS="-m32 -mv8plus -mcpu=ultrasparc" ;;
-  sparc64)
-    CPU_CFLAGS="-m64 -mcpu=ultrasparc" ;;
+    CPU_CFLAGS="-m64 -mcx16"
+    ;;
 esac
 
+if test -n "$host_arch" && {
+    ! test -d "$source_path/linux-user/include/host/$host_arch" ||
+    ! test -d "$source_path/common-user/host/$host_arch"; }; then
+    error_exit "linux-user/include/host/$host_arch does not exist." \
+       "This is a bug in the configure script, please report it."
+fi
+if test -n "$linux_arch" && ! test -d "$source_path/linux-headers/asm-$linux_arch"; then
+    error_exit "linux-headers/asm-$linux_arch does not exist." \
+       "This is a bug in the configure script, please report it."
+fi
+
 check_py_version() {
     # We require python >= 3.7.
     # NB: a True python conditional creates a non-zero return code (Failure)
@@ -812,7 +872,7 @@ default_target_list=""
 mak_wilds=""
 
 if [ "$linux_user" != no ]; then
-    if [ "$targetos" = linux ] && [ -d "$source_path/linux-user/include/host/$host_arch" ]; then
+    if [ "$targetos" = linux ] && [ -n "$host_arch" ]; then
         linux_user=yes
     elif [ "$linux_user" = yes ]; then
         error_exit "linux-user not supported on this architecture"
@@ -1717,40 +1777,9 @@ echo "PKG_CONFIG=${pkg_config}" >> $config_host_mak
 echo "CC=$cc" >> $config_host_mak
 echo "EXESUF=$EXESUF" >> $config_host_mak
 
-# use included Linux headers
-if test "$linux" = "yes" ; then
-  mkdir -p linux-headers
-  case "$cpu" in
-  i386|x86_64)
-    linux_arch=x86
-    ;;
-  ppc|ppc64)
-    linux_arch=powerpc
-    ;;
-  s390x)
-    linux_arch=s390
-    ;;
-  aarch64)
-    linux_arch=arm64
-    ;;
-  loongarch*)
-    linux_arch=loongarch
-    ;;
-  mips64)
-    linux_arch=mips
-    ;;
-  riscv32|riscv64)
-    linux_arch=riscv
-    ;;
-  *)
-    # For most CPUs the kernel architecture name and QEMU CPU name match.
-    linux_arch="$cpu"
-    ;;
-  esac
-    # For non-KVM architectures we will not have asm headers
-    if [ -e "$source_path/linux-headers/asm-$linux_arch" ]; then
-      symlink "$source_path/linux-headers/asm-$linux_arch" linux-headers/asm
-    fi
+# use included Linux headers for KVM architectures
+if test "$linux" = "yes" && test -n "$linux_arch"; then
+  symlink "$source_path/linux-headers/asm-$linux_arch" linux-headers/asm
 fi
 
 for target in $target_list; do

From c8fb5cf97da11af11def1e910920c9ead03c304a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 14:25:27 -0700
Subject: [PATCH 1085/1353] linux-user: Adjust task_unmapped_base for
 reserved_va

Ensure that the chosen values for mmap_next_start and
task_unmapped_base are within the guest address space.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c      | 28 ++++++++++++++++++++++++++++
 linux-user/mmap.c      | 18 +++---------------
 linux-user/user-mmap.h | 34 +++++++++++++++++++++++++++++++++-
 3 files changed, 64 insertions(+), 16 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index 556956c363..be621dc792 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -821,6 +821,34 @@ int main(int argc, char **argv, char **envp)
         reserved_va = max_reserved_va;
     }
 
+    /*
+     * Temporarily disable
+     *   "comparison is always false due to limited range of data type"
+     * due to comparison between (possible) uint64_t and uintptr_t.
+     */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+
+    /*
+     * Select an initial value for task_unmapped_base that is in range.
+     */
+    if (reserved_va) {
+        if (TASK_UNMAPPED_BASE < reserved_va) {
+            task_unmapped_base = TASK_UNMAPPED_BASE;
+        } else {
+            /* The most common default formula is TASK_SIZE / 3. */
+            task_unmapped_base = TARGET_PAGE_ALIGN(reserved_va / 3);
+        }
+    } else if (TASK_UNMAPPED_BASE < UINTPTR_MAX) {
+        task_unmapped_base = TASK_UNMAPPED_BASE;
+    } else {
+        /* 32-bit host: pick something medium size. */
+        task_unmapped_base = 0x10000000;
+    }
+    mmap_next_start = task_unmapped_base;
+
+#pragma GCC diagnostic pop
+
     {
         Error *err = NULL;
         if (seed_optarg != NULL) {
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index eb04fab8ab..84436d45c8 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -299,20 +299,8 @@ static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last,
     return true;
 }
 
-#if HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
-#ifdef TARGET_AARCH64
-# define TASK_UNMAPPED_BASE  0x5500000000
-#else
-# define TASK_UNMAPPED_BASE  (1ul << 38)
-#endif
-#else
-#ifdef TARGET_HPPA
-# define TASK_UNMAPPED_BASE  0xfa000000
-#else
-# define TASK_UNMAPPED_BASE  0x40000000
-#endif
-#endif
-abi_ulong mmap_next_start = TASK_UNMAPPED_BASE;
+abi_ulong task_unmapped_base;
+abi_ulong mmap_next_start;
 
 /*
  * Subroutine of mmap_find_vma, used when we have pre-allocated
@@ -391,7 +379,7 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
 
             if ((addr & (align - 1)) == 0) {
                 /* Success.  */
-                if (start == mmap_next_start && addr >= TASK_UNMAPPED_BASE) {
+                if (start == mmap_next_start && addr >= task_unmapped_base) {
                     mmap_next_start = addr + size;
                 }
                 return addr;
diff --git a/linux-user/user-mmap.h b/linux-user/user-mmap.h
index 7265c2c116..2c9d99ed6c 100644
--- a/linux-user/user-mmap.h
+++ b/linux-user/user-mmap.h
@@ -18,6 +18,39 @@
 #ifndef LINUX_USER_USER_MMAP_H
 #define LINUX_USER_USER_MMAP_H
 
+#if HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
+#ifdef TARGET_AARCH64
+# define TASK_UNMAPPED_BASE  0x5500000000
+#else
+# define TASK_UNMAPPED_BASE  (1ul << 38)
+#endif
+#else
+#ifdef TARGET_HPPA
+# define TASK_UNMAPPED_BASE  0xfa000000
+#else
+# define TASK_UNMAPPED_BASE  0x40000000
+#endif
+#endif
+
+/*
+ * Guest parameters for the ADDR_COMPAT_LAYOUT personality
+ * (at present this is the only layout supported by QEMU).
+ *
+ * TASK_UNMAPPED_BASE: For mmap without hint (addr != 0), the search
+ * for unused virtual memory begins at TASK_UNMAPPED_BASE.
+ *
+ * task_unmapped_base: When the guest address space is limited via -R,
+ * the value of TASK_UNMAPPED_BASE is adjusted to fit.
+ */
+extern abi_ulong task_unmapped_base;
+
+/*
+ * mmap_next_start: The base address for the next mmap without hint,
+ * increased after each successful map, starting at task_unmapped_base.
+ * This is an optimization within QEMU and not part of ADDR_COMPAT_LAYOUT.
+ */
+extern abi_ulong mmap_next_start;
+
 int target_mprotect(abi_ulong start, abi_ulong len, int prot);
 abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
                      int flags, int fd, off_t offset);
@@ -26,7 +59,6 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                        abi_ulong new_size, unsigned long flags,
                        abi_ulong new_addr);
 abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice);
-extern abi_ulong mmap_next_start;
 abi_ulong mmap_find_vma(abi_ulong, abi_ulong, abi_ulong);
 void mmap_fork_start(void);
 void mmap_fork_end(int child);

From 2d708164e0475064e0e2167bd73e8570e22df1e0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 14:29:40 -0700
Subject: [PATCH 1086/1353] linux-user: Define TASK_UNMAPPED_BASE in
 $guest/target_mman.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Provide default values that are as close as possible to the
values used by the guest's kernel.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/target_mman.h     | 10 ++++++++++
 linux-user/alpha/target_mman.h       |  8 ++++++++
 linux-user/arm/target_mman.h         |  8 ++++++++
 linux-user/cris/target_mman.h        |  9 +++++++++
 linux-user/hexagon/target_mman.h     | 10 ++++++++++
 linux-user/hppa/target_mman.h        |  3 +++
 linux-user/i386/target_mman.h        | 13 +++++++++++++
 linux-user/loongarch64/target_mman.h |  8 ++++++++
 linux-user/m68k/target_mman.h        |  3 +++
 linux-user/microblaze/target_mman.h  |  8 ++++++++
 linux-user/mips/target_mman.h        |  7 +++++++
 linux-user/nios2/target_mman.h       |  7 +++++++
 linux-user/openrisc/target_mman.h    |  7 +++++++
 linux-user/ppc/target_mman.h         | 13 +++++++++++++
 linux-user/riscv/target_mman.h       |  7 +++++++
 linux-user/s390x/target_mman.h       | 10 ++++++++++
 linux-user/sh4/target_mman.h         |  4 ++++
 linux-user/sparc/target_mman.h       | 14 ++++++++++++++
 linux-user/user-mmap.h               | 14 --------------
 linux-user/x86_64/target_mman.h      | 12 ++++++++++++
 linux-user/xtensa/target_mman.h      |  6 ++++++
 21 files changed, 167 insertions(+), 14 deletions(-)

diff --git a/linux-user/aarch64/target_mman.h b/linux-user/aarch64/target_mman.h
index f721295fe1..4d3eecfb26 100644
--- a/linux-user/aarch64/target_mman.h
+++ b/linux-user/aarch64/target_mman.h
@@ -4,6 +4,16 @@
 #define TARGET_PROT_BTI         0x10
 #define TARGET_PROT_MTE         0x20
 
+/*
+ * arch/arm64/include/asm/processor.h:
+ *
+ * TASK_UNMAPPED_BASE     DEFAULT_MAP_WINDOW / 4
+ * DEFAULT_MAP_WINDOW     DEFAULT_MAP_WINDOW_64
+ * DEFAULT_MAP_WINDOW_64  UL(1) << VA_BITS_MIN
+ * VA_BITS_MIN            48 (unless explicitly configured smaller)
+ */
+#define TASK_UNMAPPED_BASE      (1ull << (48 - 2))
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/alpha/target_mman.h b/linux-user/alpha/target_mman.h
index 6bb03e7336..c90b493711 100644
--- a/linux-user/alpha/target_mman.h
+++ b/linux-user/alpha/target_mman.h
@@ -20,6 +20,14 @@
 #define TARGET_MS_SYNC 2
 #define TARGET_MS_INVALIDATE 4
 
+/*
+ * arch/alpha/include/asm/processor.h:
+ *
+ * TASK_UNMAPPED_BASE           TASK_SIZE / 2
+ * TASK_SIZE                    0x40000000000UL
+ */
+#define TASK_UNMAPPED_BASE      0x20000000000ull
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/arm/target_mman.h b/linux-user/arm/target_mman.h
index e7ba6070fe..76275b2c7e 100644
--- a/linux-user/arm/target_mman.h
+++ b/linux-user/arm/target_mman.h
@@ -1 +1,9 @@
+/*
+ * arch/arm/include/asm/memory.h
+ * TASK_UNMAPPED_BASE        ALIGN(TASK_SIZE / 3, SZ_16M)
+ * TASK_SIZE                 CONFIG_PAGE_OFFSET
+ * CONFIG_PAGE_OFFSET        0xC0000000 (default in Kconfig)
+ */
+#define TASK_UNMAPPED_BASE   0x40000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/cris/target_mman.h b/linux-user/cris/target_mman.h
index e7ba6070fe..9df7b1eda5 100644
--- a/linux-user/cris/target_mman.h
+++ b/linux-user/cris/target_mman.h
@@ -1 +1,10 @@
+/*
+ * arch/cris/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE      (PAGE_ALIGN(TASK_SIZE / 3))
+ *
+ * arch/cris/include/arch-v32/arch/processor.h
+ * TASK_SIZE               0xb0000000
+ */
+#define TASK_UNMAPPED_BASE TARGET_PAGE_ALIGN(0xb0000000 / 3)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/hexagon/target_mman.h b/linux-user/hexagon/target_mman.h
index e7ba6070fe..c5ae336e07 100644
--- a/linux-user/hexagon/target_mman.h
+++ b/linux-user/hexagon/target_mman.h
@@ -1 +1,11 @@
+/*
+ * arch/hexgon/include/asm/processor.h
+ * TASK_UNMAPPED_BASE        PAGE_ALIGN(TASK_SIZE / 3)
+ *
+ * arch/hexagon/include/asm/mem-layout.h
+ * TASK_SIZE                 PAGE_OFFSET
+ * PAGE_OFFSET               0xc0000000
+ */
+#define TASK_UNMAPPED_BASE   0x40000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/hppa/target_mman.h b/linux-user/hppa/target_mman.h
index 97f87d042a..6459e7dbdd 100644
--- a/linux-user/hppa/target_mman.h
+++ b/linux-user/hppa/target_mman.h
@@ -24,6 +24,9 @@
 #define TARGET_MS_ASYNC 2
 #define TARGET_MS_INVALIDATE 4
 
+/* arch/parisc/include/asm/processor.h: DEFAULT_MAP_BASE32 */
+#define TASK_UNMAPPED_BASE      0x40000000
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/i386/target_mman.h b/linux-user/i386/target_mman.h
index e7ba6070fe..cc3382007f 100644
--- a/linux-user/i386/target_mman.h
+++ b/linux-user/i386/target_mman.h
@@ -1 +1,14 @@
+/*
+ * arch/x86/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE         __TASK_UNMAPPED_BASE(TASK_SIZE_LOW)
+ * __TASK_UNMAPPED_BASE(S)    PAGE_ALIGN(S / 3)
+ *
+ * arch/x86/include/asm/page_32_types.h:
+ * TASK_SIZE_LOW              TASK_SIZE
+ * TASK_SIZE                  __PAGE_OFFSET
+ * __PAGE_OFFSET              CONFIG_PAGE_OFFSET
+ * CONFIG_PAGE_OFFSET         0xc0000000 (default in Kconfig)
+ */
+#define TASK_UNMAPPED_BASE    0x40000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/loongarch64/target_mman.h b/linux-user/loongarch64/target_mman.h
index e7ba6070fe..d70e44d44c 100644
--- a/linux-user/loongarch64/target_mman.h
+++ b/linux-user/loongarch64/target_mman.h
@@ -1 +1,9 @@
+/*
+ * arch/loongarch/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE         PAGE_ALIGN(TASK_SIZE / 3)
+ * TASK_SIZE64                0x1UL << (... ? VA_BITS : ...)
+ */
+#define TASK_UNMAPPED_BASE \
+    TARGET_PAGE_ALIGN((1ull << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/m68k/target_mman.h b/linux-user/m68k/target_mman.h
index e7ba6070fe..d3eceb663b 100644
--- a/linux-user/m68k/target_mman.h
+++ b/linux-user/m68k/target_mman.h
@@ -1 +1,4 @@
+/* arch/m68k/include/asm/processor.h */
+#define TASK_UNMAPPED_BASE      0xC0000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/microblaze/target_mman.h b/linux-user/microblaze/target_mman.h
index e7ba6070fe..ffee869db4 100644
--- a/linux-user/microblaze/target_mman.h
+++ b/linux-user/microblaze/target_mman.h
@@ -1 +1,9 @@
+/*
+ * arch/microblaze/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE           (TASK_SIZE / 8 * 3)
+ * TASK_SIZE                    CONFIG_KERNEL_START
+ * CONFIG_KERNEL_START          0xc0000000 (default in Kconfig)
+ */
+#define TASK_UNMAPPED_BASE      0x48000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/mips/target_mman.h b/linux-user/mips/target_mman.h
index e97694aa4e..fe1eec2d0b 100644
--- a/linux-user/mips/target_mman.h
+++ b/linux-user/mips/target_mman.h
@@ -14,6 +14,13 @@
 #define TARGET_MAP_STACK                0x40000
 #define TARGET_MAP_HUGETLB              0x80000
 
+/*
+ * arch/mips/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE         PAGE_ALIGN(TASK_SIZE / 3)
+ */
+#define TASK_UNMAPPED_BASE \
+    TARGET_PAGE_ALIGN((1ull << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/nios2/target_mman.h b/linux-user/nios2/target_mman.h
index e7ba6070fe..ce18f4f871 100644
--- a/linux-user/nios2/target_mman.h
+++ b/linux-user/nios2/target_mman.h
@@ -1 +1,8 @@
+/*
+ * arch/nios2/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE         PAGE_ALIGN(TASK_SIZE / 3)
+ * TASK_SIZE                  0x7FFF0000UL
+ */
+#define TASK_UNMAPPED_BASE    TARGET_PAGE_ALIGN(0x7FFF0000 / 3)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/openrisc/target_mman.h b/linux-user/openrisc/target_mman.h
index e7ba6070fe..f1aaad809d 100644
--- a/linux-user/openrisc/target_mman.h
+++ b/linux-user/openrisc/target_mman.h
@@ -1 +1,8 @@
+/*
+ * arch/openrisc/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE      (TASK_SIZE / 8 * 3)
+ * TASK_SIZE               (0x80000000UL)
+ */
+#define TASK_UNMAPPED_BASE      0x30000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/ppc/target_mman.h b/linux-user/ppc/target_mman.h
index 67cc218f2e..04f99c6077 100644
--- a/linux-user/ppc/target_mman.h
+++ b/linux-user/ppc/target_mman.h
@@ -4,6 +4,19 @@
 #define TARGET_MAP_NORESERVE            0x40
 #define TARGET_MAP_LOCKED               0x80
 
+/*
+ * arch/powerpc/include/asm/task_size_64.h
+ * TASK_UNMAPPED_BASE_USER32    (PAGE_ALIGN(TASK_SIZE_USER32 / 4))
+ * TASK_UNMAPPED_BASE_USER64    (PAGE_ALIGN(DEFAULT_MAP_WINDOW_USER64 / 4))
+ * TASK_SIZE_USER32             (0x0000000100000000UL - (1 * PAGE_SIZE))
+ * DEFAULT_MAP_WINDOW_USER64    TASK_SIZE_64TB (with 4k pages)
+ */
+#ifdef TARGET_PPC64
+#define TASK_UNMAPPED_BASE      0x0000100000000000ull
+#else
+#define TASK_UNMAPPED_BASE      0x40000000
+#endif
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/riscv/target_mman.h b/linux-user/riscv/target_mman.h
index e7ba6070fe..0f06dadbd4 100644
--- a/linux-user/riscv/target_mman.h
+++ b/linux-user/riscv/target_mman.h
@@ -1 +1,8 @@
+/*
+ * arch/loongarch/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE         PAGE_ALIGN(TASK_SIZE / 3)
+ */
+#define TASK_UNMAPPED_BASE \
+    TARGET_PAGE_ALIGN((1ull << (TARGET_VIRT_ADDR_SPACE_BITS - 1)) / 3)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/s390x/target_mman.h b/linux-user/s390x/target_mman.h
index e7ba6070fe..40d149b329 100644
--- a/linux-user/s390x/target_mman.h
+++ b/linux-user/s390x/target_mman.h
@@ -1 +1,11 @@
+/*
+ * arch/s390/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE           (... : (_REGION2_SIZE >> 1))
+ *
+ * arch/s390/include/asm/pgtable.h:
+ * _REGION2_SIZE                (1UL << _REGION2_SHIFT)
+ * _REGION2_SHIFT               42
+ */
+#define TASK_UNMAPPED_BASE      (1ull << 41)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/sh4/target_mman.h b/linux-user/sh4/target_mman.h
index e7ba6070fe..bbbc223398 100644
--- a/linux-user/sh4/target_mman.h
+++ b/linux-user/sh4/target_mman.h
@@ -1 +1,5 @@
+/* arch/sh/include/asm/processor_32.h */
+#define TASK_UNMAPPED_BASE \
+    TARGET_PAGE_ALIGN((1u << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/sparc/target_mman.h b/linux-user/sparc/target_mman.h
index 9bad99c852..692ebf9dd7 100644
--- a/linux-user/sparc/target_mman.h
+++ b/linux-user/sparc/target_mman.h
@@ -5,6 +5,20 @@
 #define TARGET_MAP_LOCKED              0x100
 #define TARGET_MAP_GROWSDOWN           0x0200
 
+/*
+ * arch/sparc/include/asm/page_64.h:
+ * TASK_UNMAPPED_BASE      (test_thread_flag(TIF_32BIT) ? \
+ *                          _AC(0x0000000070000000,UL) : \
+ *                          VA_EXCLUDE_END)
+ * But VA_EXCLUDE_END is > 0xffff800000000000UL which doesn't work
+ * in userland emulation.
+ */
+#ifdef TARGET_ABI32
+#define TASK_UNMAPPED_BASE      0x70000000
+#else
+#define TASK_UNMAPPED_BASE      (1ull << (TARGET_VIRT_ADDR_SPACE_BITS - 2))
+#endif
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/user-mmap.h b/linux-user/user-mmap.h
index 2c9d99ed6c..f844ba4e61 100644
--- a/linux-user/user-mmap.h
+++ b/linux-user/user-mmap.h
@@ -18,20 +18,6 @@
 #ifndef LINUX_USER_USER_MMAP_H
 #define LINUX_USER_USER_MMAP_H
 
-#if HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
-#ifdef TARGET_AARCH64
-# define TASK_UNMAPPED_BASE  0x5500000000
-#else
-# define TASK_UNMAPPED_BASE  (1ul << 38)
-#endif
-#else
-#ifdef TARGET_HPPA
-# define TASK_UNMAPPED_BASE  0xfa000000
-#else
-# define TASK_UNMAPPED_BASE  0x40000000
-#endif
-#endif
-
 /*
  * Guest parameters for the ADDR_COMPAT_LAYOUT personality
  * (at present this is the only layout supported by QEMU).
diff --git a/linux-user/x86_64/target_mman.h b/linux-user/x86_64/target_mman.h
index e7ba6070fe..f9ff652b37 100644
--- a/linux-user/x86_64/target_mman.h
+++ b/linux-user/x86_64/target_mman.h
@@ -1 +1,13 @@
+/*
+ * arch/x86/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE         __TASK_UNMAPPED_BASE(TASK_SIZE_LOW)
+ * __TASK_UNMAPPED_BASE(S)    PAGE_ALIGN(S / 3)
+ *
+ * arch/x86/include/asm/page_64_types.h:
+ * TASK_SIZE_LOW              DEFAULT_MAP_WINDOW
+ * DEFAULT_MAP_WINDOW         ((1UL << 47) - PAGE_SIZE)
+ */
+#define TASK_UNMAPPED_BASE \
+    TARGET_PAGE_ALIGN((1ull << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/xtensa/target_mman.h b/linux-user/xtensa/target_mman.h
index 3933771b5b..c4f671adb7 100644
--- a/linux-user/xtensa/target_mman.h
+++ b/linux-user/xtensa/target_mman.h
@@ -14,6 +14,12 @@
 #define TARGET_MAP_STACK                0x40000
 #define TARGET_MAP_HUGETLB              0x80000
 
+/*
+ * arch/xtensa/include/asm/processor.h:
+ * TASK_UNMAPPED_BASE           (TASK_SIZE / 2)
+ */
+#define TASK_UNMAPPED_BASE      (1u << (TARGET_VIRT_ADDR_SPACE_BITS - 1))
+
 #include "../generic/target_mman.h"
 
 #endif

From da2b71fab63f2396396021917eed9d52f33a45c0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 15:17:33 -0700
Subject: [PATCH 1087/1353] linux-user: Define ELF_ET_DYN_BASE in
 $guest/target_mman.h

Copy each guest kernel's default value, then bound it
against reserved_va or the host address space.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/target_mman.h     |  3 +++
 linux-user/alpha/target_mman.h       |  3 +++
 linux-user/arm/target_mman.h         |  3 +++
 linux-user/cris/target_mman.h        |  3 +++
 linux-user/hexagon/target_mman.h     |  3 +++
 linux-user/hppa/target_mman.h        |  3 +++
 linux-user/i386/target_mman.h        |  3 +++
 linux-user/loongarch64/target_mman.h |  3 +++
 linux-user/m68k/target_mman.h        |  2 ++
 linux-user/main.c                    | 15 +++++++++++++++
 linux-user/microblaze/target_mman.h  |  3 +++
 linux-user/mips/target_mman.h        |  3 +++
 linux-user/mmap.c                    |  1 +
 linux-user/nios2/target_mman.h       |  3 +++
 linux-user/openrisc/target_mman.h    |  3 +++
 linux-user/ppc/target_mman.h         |  7 +++++++
 linux-user/riscv/target_mman.h       |  3 +++
 linux-user/s390x/target_mman.h       | 10 ++++++++++
 linux-user/sh4/target_mman.h         |  3 +++
 linux-user/sparc/target_mman.h       | 11 +++++++++++
 linux-user/user-mmap.h               | 13 +++++++++++--
 linux-user/x86_64/target_mman.h      |  3 +++
 linux-user/xtensa/target_mman.h      |  4 ++++
 23 files changed, 106 insertions(+), 2 deletions(-)

diff --git a/linux-user/aarch64/target_mman.h b/linux-user/aarch64/target_mman.h
index 4d3eecfb26..69ec5d5739 100644
--- a/linux-user/aarch64/target_mman.h
+++ b/linux-user/aarch64/target_mman.h
@@ -14,6 +14,9 @@
  */
 #define TASK_UNMAPPED_BASE      (1ull << (48 - 2))
 
+/* arch/arm64/include/asm/elf.h */
+#define ELF_ET_DYN_BASE         TARGET_PAGE_ALIGN((1ull << 48) / 3 * 2)
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/alpha/target_mman.h b/linux-user/alpha/target_mman.h
index c90b493711..8edfe2b88c 100644
--- a/linux-user/alpha/target_mman.h
+++ b/linux-user/alpha/target_mman.h
@@ -28,6 +28,9 @@
  */
 #define TASK_UNMAPPED_BASE      0x20000000000ull
 
+/* arch/alpha/include/asm/elf.h */
+#define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x1000000)
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/arm/target_mman.h b/linux-user/arm/target_mman.h
index 76275b2c7e..51005da869 100644
--- a/linux-user/arm/target_mman.h
+++ b/linux-user/arm/target_mman.h
@@ -6,4 +6,7 @@
  */
 #define TASK_UNMAPPED_BASE   0x40000000
 
+/* arch/arm/include/asm/elf.h */
+#define ELF_ET_DYN_BASE      0x00400000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/cris/target_mman.h b/linux-user/cris/target_mman.h
index 9df7b1eda5..9ace8ac292 100644
--- a/linux-user/cris/target_mman.h
+++ b/linux-user/cris/target_mman.h
@@ -7,4 +7,7 @@
  */
 #define TASK_UNMAPPED_BASE TARGET_PAGE_ALIGN(0xb0000000 / 3)
 
+/* arch/cris/include/uapi/asm/elf.h */
+#define ELF_ET_DYN_BASE    (TASK_UNMAPPED_BASE * 2)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/hexagon/target_mman.h b/linux-user/hexagon/target_mman.h
index c5ae336e07..e6b5e2ca36 100644
--- a/linux-user/hexagon/target_mman.h
+++ b/linux-user/hexagon/target_mman.h
@@ -8,4 +8,7 @@
  */
 #define TASK_UNMAPPED_BASE   0x40000000
 
+/* arch/hexagon/include/asm/elf.h */
+#define ELF_ET_DYN_BASE      0x08000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/hppa/target_mman.h b/linux-user/hppa/target_mman.h
index 6459e7dbdd..ccda46e842 100644
--- a/linux-user/hppa/target_mman.h
+++ b/linux-user/hppa/target_mman.h
@@ -27,6 +27,9 @@
 /* arch/parisc/include/asm/processor.h: DEFAULT_MAP_BASE32 */
 #define TASK_UNMAPPED_BASE      0x40000000
 
+/* arch/parisc/include/asm/elf.h */
+#define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/i386/target_mman.h b/linux-user/i386/target_mman.h
index cc3382007f..e3b8e1eaa6 100644
--- a/linux-user/i386/target_mman.h
+++ b/linux-user/i386/target_mman.h
@@ -11,4 +11,7 @@
  */
 #define TASK_UNMAPPED_BASE    0x40000000
 
+/* arch/x86/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       0x00400000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/loongarch64/target_mman.h b/linux-user/loongarch64/target_mman.h
index d70e44d44c..8c2a3d5596 100644
--- a/linux-user/loongarch64/target_mman.h
+++ b/linux-user/loongarch64/target_mman.h
@@ -6,4 +6,7 @@
 #define TASK_UNMAPPED_BASE \
     TARGET_PAGE_ALIGN((1ull << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
 
+/* arch/loongarch/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       (TASK_UNMAPPED_BASE * 2)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/m68k/target_mman.h b/linux-user/m68k/target_mman.h
index d3eceb663b..20cfe750c5 100644
--- a/linux-user/m68k/target_mman.h
+++ b/linux-user/m68k/target_mman.h
@@ -1,4 +1,6 @@
 /* arch/m68k/include/asm/processor.h */
 #define TASK_UNMAPPED_BASE      0xC0000000
+/* arch/m68k/include/asm/elf.h */
+#define ELF_ET_DYN_BASE         0xD0000000
 
 #include "../generic/target_mman.h"
diff --git a/linux-user/main.c b/linux-user/main.c
index be621dc792..96be354897 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -847,6 +847,21 @@ int main(int argc, char **argv, char **envp)
     }
     mmap_next_start = task_unmapped_base;
 
+    /* Similarly for elf_et_dyn_base. */
+    if (reserved_va) {
+        if (ELF_ET_DYN_BASE < reserved_va) {
+            elf_et_dyn_base = ELF_ET_DYN_BASE;
+        } else {
+            /* The most common default formula is TASK_SIZE / 3 * 2. */
+            elf_et_dyn_base = TARGET_PAGE_ALIGN(reserved_va / 3) * 2;
+        }
+    } else if (ELF_ET_DYN_BASE < UINTPTR_MAX) {
+        elf_et_dyn_base = ELF_ET_DYN_BASE;
+    } else {
+        /* 32-bit host: pick something medium size. */
+        elf_et_dyn_base = 0x18000000;
+    }
+
 #pragma GCC diagnostic pop
 
     {
diff --git a/linux-user/microblaze/target_mman.h b/linux-user/microblaze/target_mman.h
index ffee869db4..6b3dd54f89 100644
--- a/linux-user/microblaze/target_mman.h
+++ b/linux-user/microblaze/target_mman.h
@@ -6,4 +6,7 @@
  */
 #define TASK_UNMAPPED_BASE      0x48000000
 
+/* arch/microblaze/include/uapi/asm/elf.h */
+#define ELF_ET_DYN_BASE         0x08000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/mips/target_mman.h b/linux-user/mips/target_mman.h
index fe1eec2d0b..b84fe1e8a8 100644
--- a/linux-user/mips/target_mman.h
+++ b/linux-user/mips/target_mman.h
@@ -21,6 +21,9 @@
 #define TASK_UNMAPPED_BASE \
     TARGET_PAGE_ALIGN((1ull << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
 
+/* arch/mips/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       (TASK_UNMAPPED_BASE * 2)
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 84436d45c8..9aab48d4a3 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -300,6 +300,7 @@ static bool mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong last,
 }
 
 abi_ulong task_unmapped_base;
+abi_ulong elf_et_dyn_base;
 abi_ulong mmap_next_start;
 
 /*
diff --git a/linux-user/nios2/target_mman.h b/linux-user/nios2/target_mman.h
index ce18f4f871..ab16ad4f03 100644
--- a/linux-user/nios2/target_mman.h
+++ b/linux-user/nios2/target_mman.h
@@ -5,4 +5,7 @@
  */
 #define TASK_UNMAPPED_BASE    TARGET_PAGE_ALIGN(0x7FFF0000 / 3)
 
+/* arch/nios2/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       0xD0000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/openrisc/target_mman.h b/linux-user/openrisc/target_mman.h
index f1aaad809d..243c1d5f26 100644
--- a/linux-user/openrisc/target_mman.h
+++ b/linux-user/openrisc/target_mman.h
@@ -5,4 +5,7 @@
  */
 #define TASK_UNMAPPED_BASE      0x30000000
 
+/* arch/openrisc/include/asm/elf.h */
+#define ELF_ET_DYN_BASE         0x08000000
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/ppc/target_mman.h b/linux-user/ppc/target_mman.h
index 04f99c6077..646d1ccae7 100644
--- a/linux-user/ppc/target_mman.h
+++ b/linux-user/ppc/target_mman.h
@@ -17,6 +17,13 @@
 #define TASK_UNMAPPED_BASE      0x40000000
 #endif
 
+/* arch/powerpc/include/asm/elf.h */
+#ifdef TARGET_PPC64
+#define ELF_ET_DYN_BASE         0x100000000ull
+#else
+#define ELF_ET_DYN_BASE         0x000400000
+#endif
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/riscv/target_mman.h b/linux-user/riscv/target_mman.h
index 0f06dadbd4..3049bcc67d 100644
--- a/linux-user/riscv/target_mman.h
+++ b/linux-user/riscv/target_mman.h
@@ -5,4 +5,7 @@
 #define TASK_UNMAPPED_BASE \
     TARGET_PAGE_ALIGN((1ull << (TARGET_VIRT_ADDR_SPACE_BITS - 1)) / 3)
 
+/* arch/riscv/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       (TASK_UNMAPPED_BASE * 2)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/s390x/target_mman.h b/linux-user/s390x/target_mman.h
index 40d149b329..c82435e381 100644
--- a/linux-user/s390x/target_mman.h
+++ b/linux-user/s390x/target_mman.h
@@ -8,4 +8,14 @@
  */
 #define TASK_UNMAPPED_BASE      (1ull << 41)
 
+/*
+ * arch/s390/include/asm/elf.h:
+ * ELF_ET_DYN_BASE              (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)
+ *
+ * arch/s390/include/asm/processor.h:
+ * STACK_TOP                    VDSO_LIMIT - VDSO_SIZE - PAGE_SIZE
+ * VDSO_LIMIT                   _REGION2_SIZE
+ */
+#define ELF_ET_DYN_BASE         (((1ull << 42) / 3 * 2) & ~0xffffffffull)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/sh4/target_mman.h b/linux-user/sh4/target_mman.h
index bbbc223398..dd9016081e 100644
--- a/linux-user/sh4/target_mman.h
+++ b/linux-user/sh4/target_mman.h
@@ -2,4 +2,7 @@
 #define TASK_UNMAPPED_BASE \
     TARGET_PAGE_ALIGN((1u << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
 
+/* arch/sh/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       (TASK_UNMAPPED_BASE * 2)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/sparc/target_mman.h b/linux-user/sparc/target_mman.h
index 692ebf9dd7..696ca73fe4 100644
--- a/linux-user/sparc/target_mman.h
+++ b/linux-user/sparc/target_mman.h
@@ -19,6 +19,17 @@
 #define TASK_UNMAPPED_BASE      (1ull << (TARGET_VIRT_ADDR_SPACE_BITS - 2))
 #endif
 
+/*
+ * arch/sparc/include/asm/elf_64.h
+ * Except that COMPAT_ELF_ET_DYN_BASE exactly matches TASK_UNMAPPED_BASE,
+ * so move it up a bit.
+ */
+#ifdef TARGET_ABI32
+#define ELF_ET_DYN_BASE         0x78000000
+#else
+#define ELF_ET_DYN_BASE         0x0000010000000000ull
+#endif
+
 #include "../generic/target_mman.h"
 
 #endif
diff --git a/linux-user/user-mmap.h b/linux-user/user-mmap.h
index f844ba4e61..0f4883eb57 100644
--- a/linux-user/user-mmap.h
+++ b/linux-user/user-mmap.h
@@ -25,10 +25,19 @@
  * TASK_UNMAPPED_BASE: For mmap without hint (addr != 0), the search
  * for unused virtual memory begins at TASK_UNMAPPED_BASE.
  *
- * task_unmapped_base: When the guest address space is limited via -R,
- * the value of TASK_UNMAPPED_BASE is adjusted to fit.
+ * ELF_ET_DYN_BASE: When the executable is ET_DYN (i.e. PIE), and requires
+ * an interpreter (i.e. not -static-pie), use ELF_ET_DYN_BASE instead of
+ * TASK_UNMAPPED_BASE for selecting the address of the executable.
+ * This provides some distance between the executable and the interpreter,
+ * which allows the initial brk to be placed immediately after the
+ * executable and also have room to grow.
+ *
+ * task_unmapped_base, elf_et_dyn_base: When the guest address space is
+ * limited via -R, the values of TASK_UNMAPPED_BASE and ELF_ET_DYN_BASE
+ * must be adjusted to fit.
  */
 extern abi_ulong task_unmapped_base;
+extern abi_ulong elf_et_dyn_base;
 
 /*
  * mmap_next_start: The base address for the next mmap without hint,
diff --git a/linux-user/x86_64/target_mman.h b/linux-user/x86_64/target_mman.h
index f9ff652b37..48fbf20b42 100644
--- a/linux-user/x86_64/target_mman.h
+++ b/linux-user/x86_64/target_mman.h
@@ -10,4 +10,7 @@
 #define TASK_UNMAPPED_BASE \
     TARGET_PAGE_ALIGN((1ull << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
 
+/* arch/x86/include/asm/elf.h */
+#define ELF_ET_DYN_BASE       (TASK_UNMAPPED_BASE * 2)
+
 #include "../generic/target_mman.h"
diff --git a/linux-user/xtensa/target_mman.h b/linux-user/xtensa/target_mman.h
index c4f671adb7..8fa6337a97 100644
--- a/linux-user/xtensa/target_mman.h
+++ b/linux-user/xtensa/target_mman.h
@@ -20,6 +20,10 @@
  */
 #define TASK_UNMAPPED_BASE      (1u << (TARGET_VIRT_ADDR_SPACE_BITS - 1))
 
+/* arch/xtensa/include/asm/elf.h */
+#define ELF_ET_DYN_BASE \
+    TARGET_PAGE_ALIGN((1u << TARGET_VIRT_ADDR_SPACE_BITS) / 3)
+
 #include "../generic/target_mman.h"
 
 #endif

From ad25051bae392ce35437cdf996aedecc0772af2f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Aug 2023 17:55:28 +0000
Subject: [PATCH 1088/1353] linux-user: Use MAP_FIXED_NOREPLACE for initial
 image mmap

Use this as extra protection for the guest mapping over
any qemu host mappings.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 36e4026f05..1b4bb2d5af 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3147,8 +3147,11 @@ static void load_elf_image(const char *image_name, int image_fd,
     /*
      * Reserve address space for all of this.
      *
-     * In the case of ET_EXEC, we supply MAP_FIXED so that we get
-     * exactly the address range that is required.
+     * In the case of ET_EXEC, we supply MAP_FIXED_NOREPLACE so that we get
+     * exactly the address range that is required.  Without reserved_va,
+     * the guest address space is not isolated.  We have attempted to avoid
+     * conflict with the host program itself via probe_guest_base, but using
+     * MAP_FIXED_NOREPLACE instead of MAP_FIXED provides an extra check.
      *
      * Otherwise this is ET_DYN, and we are searching for a location
      * that can hold the memory space required.  If the image is
@@ -3160,7 +3163,7 @@ static void load_elf_image(const char *image_name, int image_fd,
      */
     load_addr = target_mmap(loaddr, (size_t)hiaddr - loaddr + 1, PROT_NONE,
                             MAP_PRIVATE | MAP_ANON | MAP_NORESERVE |
-                            (ehdr->e_type == ET_EXEC ? MAP_FIXED : 0),
+                            (ehdr->e_type == ET_EXEC ? MAP_FIXED_NOREPLACE : 0),
                             -1, 0);
     if (load_addr == -1) {
         goto exit_mmap;

From 1ea06ded0de5adcd40a0122ea73c9761f488bfba Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 2 Aug 2023 15:58:07 -0700
Subject: [PATCH 1089/1353] linux-user: Use elf_et_dyn_base for ET_DYN with
 interpreter

Follow the lead of the linux kernel in fs/binfmt_elf.c,
in which an ET_DYN executable which uses an interpreter
(usually a PIE executable) is loaded away from where the
interpreter itself will be loaded.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 1b4bb2d5af..d1b278d799 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3107,6 +3107,8 @@ static void load_elf_image(const char *image_name, int image_fd,
         }
     }
 
+    load_addr = loaddr;
+
     if (pinterp_name != NULL) {
         /*
          * This is the main executable.
@@ -3136,11 +3138,32 @@ static void load_elf_image(const char *image_name, int image_fd,
              */
             probe_guest_base(image_name, loaddr, hiaddr);
         } else {
+            abi_ulong align;
+
             /*
              * The binary is dynamic, but we still need to
              * select guest_base.  In this case we pass a size.
              */
             probe_guest_base(image_name, 0, hiaddr - loaddr);
+
+            /*
+             * Avoid collision with the loader by providing a different
+             * default load address.
+             */
+            load_addr += elf_et_dyn_base;
+
+            /*
+             * TODO: Better support for mmap alignment is desirable.
+             * Since we do not have complete control over the guest
+             * address space, we prefer the kernel to choose some address
+             * rather than force the use of LOAD_ADDR via MAP_FIXED.
+             * But without MAP_FIXED we cannot guarantee alignment,
+             * only suggest it.
+             */
+            align = pow2ceil(info->alignment);
+            if (align) {
+                load_addr &= -align;
+            }
         }
     }
 
@@ -3155,13 +3178,13 @@ static void load_elf_image(const char *image_name, int image_fd,
      *
      * Otherwise this is ET_DYN, and we are searching for a location
      * that can hold the memory space required.  If the image is
-     * pre-linked, LOADDR will be non-zero, and the kernel should
+     * pre-linked, LOAD_ADDR will be non-zero, and the kernel should
      * honor that address if it happens to be free.
      *
      * In both cases, we will overwrite pages in this range with mappings
      * from the executable.
      */
-    load_addr = target_mmap(loaddr, (size_t)hiaddr - loaddr + 1, PROT_NONE,
+    load_addr = target_mmap(load_addr, (size_t)hiaddr - loaddr + 1, PROT_NONE,
                             MAP_PRIVATE | MAP_ANON | MAP_NORESERVE |
                             (ehdr->e_type == ET_EXEC ? MAP_FIXED_NOREPLACE : 0),
                             -1, 0);

From 1f356e8c013f254b6471985bc929c8db1d08c44c Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Wed, 2 Aug 2023 16:14:01 -0700
Subject: [PATCH 1090/1353] linux-user: Adjust initial brk when interpreter is
 close to executable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we attempt to load a ET_DYN executable far away from
TASK_UNMAPPED_BASE, we are not completely in control of the
address space layout.  If the interpreter lands close to
the executable, leaving insufficient heap space, move brk.

Tested-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
[rth: Re-order after ELF_ET_DYN_BASE patch so that we do not
 "temporarily break" tsan, and also to minimize the changes required.
 Remove image_info.reserve_brk as unused.]
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 51 +++++++++++++-------------------------------
 linux-user/qemu.h    |  1 -
 2 files changed, 15 insertions(+), 37 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d1b278d799..3553a3eaef 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3110,27 +3110,6 @@ static void load_elf_image(const char *image_name, int image_fd,
     load_addr = loaddr;
 
     if (pinterp_name != NULL) {
-        /*
-         * This is the main executable.
-         *
-         * Reserve extra space for brk.
-         * We hold on to this space while placing the interpreter
-         * and the stack, lest they be placed immediately after
-         * the data segment and block allocation from the brk.
-         *
-         * 16MB is chosen as "large enough" without being so large as
-         * to allow the result to not fit with a 32-bit guest on a
-         * 32-bit host. However some 64 bit guests (e.g. s390x)
-         * attempt to place their heap further ahead and currently
-         * nothing stops them smashing into QEMUs address space.
-         */
-#if TARGET_LONG_BITS == 64
-        info->reserve_brk = 32 * MiB;
-#else
-        info->reserve_brk = 16 * MiB;
-#endif
-        hiaddr += info->reserve_brk;
-
         if (ehdr->e_type == ET_EXEC) {
             /*
              * Make sure that the low address does not conflict with
@@ -3221,7 +3200,8 @@ static void load_elf_image(const char *image_name, int image_fd,
     info->end_code = 0;
     info->start_data = -1;
     info->end_data = 0;
-    info->brk = 0;
+    /* Usual start for brk is after all sections of the main executable. */
+    info->brk = TARGET_PAGE_ALIGN(hiaddr);
     info->elf_flags = ehdr->e_flags;
 
     prot_exec = PROT_EXEC;
@@ -3315,9 +3295,6 @@ static void load_elf_image(const char *image_name, int image_fd,
                     info->end_data = vaddr_ef;
                 }
             }
-            if (vaddr_em > info->brk) {
-                info->brk = vaddr_em;
-            }
 #ifdef TARGET_MIPS
         } else if (eppnt->p_type == PT_MIPS_ABIFLAGS) {
             Mips_elf_abiflags_v0 abiflags;
@@ -3646,6 +3623,19 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
     if (elf_interpreter) {
         load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
 
+        /*
+         * While unusual because of ELF_ET_DYN_BASE, if we are unlucky
+         * with the mappings the interpreter can be loaded above but
+         * near the main executable, which can leave very little room
+         * for the heap.
+         * If the current brk has less than 16MB, use the end of the
+         * interpreter.
+         */
+        if (interp_info.brk > info->brk &&
+            interp_info.load_bias - info->brk < 16 * MiB)  {
+            info->brk = interp_info.brk;
+        }
+
         /* If the program interpreter is one of these two, then assume
            an iBCS2 image.  Otherwise assume a native linux image.  */
 
@@ -3699,17 +3689,6 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
     bprm->core_dump = &elf_core_dump;
 #endif
 
-    /*
-     * If we reserved extra space for brk, release it now.
-     * The implementation of do_brk in syscalls.c expects to be able
-     * to mmap pages in this space.
-     */
-    if (info->reserve_brk) {
-        abi_ulong start_brk = TARGET_PAGE_ALIGN(info->brk);
-        abi_ulong end_brk = TARGET_PAGE_ALIGN(info->brk + info->reserve_brk);
-        target_munmap(start_brk, end_brk - start_brk);
-    }
-
     return 0;
 }
 
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 2046a23037..4f8b55e2fb 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -30,7 +30,6 @@ struct image_info {
         abi_ulong       start_data;
         abi_ulong       end_data;
         abi_ulong       brk;
-        abi_ulong       reserve_brk;
         abi_ulong       start_mmap;
         abi_ulong       start_stack;
         abi_ulong       stack_limit;

From e3d97d5c5d4b357ff8e2e891c557e6cef752145a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Aug 2023 20:13:03 +0000
Subject: [PATCH 1091/1353] linux-user: Do not adjust image mapping for host
 page size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove TARGET_ELF_EXEC_PAGESIZE, and 3 other TARGET_ELF_PAGE* macros
based off of that.  Rely on target_mmap to handle guest vs host page
size mismatch.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 3553a3eaef..964b21f997 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1960,15 +1960,6 @@ struct exec
 #define ZMAGIC 0413
 #define QMAGIC 0314
 
-/* Necessary parameters */
-#define TARGET_ELF_EXEC_PAGESIZE \
-        (((eppnt->p_align & ~qemu_host_page_mask) != 0) ? \
-         TARGET_PAGE_SIZE : MAX(qemu_host_page_size, TARGET_PAGE_SIZE))
-#define TARGET_ELF_PAGELENGTH(_v) ROUND_UP((_v), TARGET_ELF_EXEC_PAGESIZE)
-#define TARGET_ELF_PAGESTART(_v) ((_v) & \
-                                 ~(abi_ulong)(TARGET_ELF_EXEC_PAGESIZE-1))
-#define TARGET_ELF_PAGEOFFSET(_v) ((_v) & (TARGET_ELF_EXEC_PAGESIZE-1))
-
 #define DLINFO_ITEMS 16
 
 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)
@@ -3241,8 +3232,8 @@ static void load_elf_image(const char *image_name, int image_fd,
             }
 
             vaddr = load_bias + eppnt->p_vaddr;
-            vaddr_po = TARGET_ELF_PAGEOFFSET(vaddr);
-            vaddr_ps = TARGET_ELF_PAGESTART(vaddr);
+            vaddr_po = vaddr & ~TARGET_PAGE_MASK;
+            vaddr_ps = vaddr & TARGET_PAGE_MASK;
 
             vaddr_ef = vaddr + eppnt->p_filesz;
             vaddr_em = vaddr + eppnt->p_memsz;
@@ -3252,7 +3243,7 @@ static void load_elf_image(const char *image_name, int image_fd,
              * but no backing file segment.
              */
             if (eppnt->p_filesz != 0) {
-                vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_filesz + vaddr_po);
+                vaddr_len = eppnt->p_filesz + vaddr_po;
                 error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
                                     MAP_PRIVATE | MAP_FIXED,
                                     image_fd, eppnt->p_offset - vaddr_po);
@@ -3268,7 +3259,7 @@ static void load_elf_image(const char *image_name, int image_fd,
                     zero_bss(vaddr_ef, vaddr_em, elf_prot);
                 }
             } else if (eppnt->p_memsz != 0) {
-                vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_memsz + vaddr_po);
+                vaddr_len = eppnt->p_memsz + vaddr_po;
                 error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
                                     MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,
                                     -1, 0);

From 2d385be6152222b61540639d2c41cdc48efec22c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Aug 2023 20:25:38 +0000
Subject: [PATCH 1092/1353] linux-user: Do not adjust zero_bss for host page
 size

Rely on target_mmap to handle guest vs host page size mismatch.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 63 +++++++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 36 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 964b21f997..881fdeb157 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2211,47 +2211,37 @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
     }
 }
 
-/* Map and zero the bss.  We need to explicitly zero any fractional pages
-   after the data section (i.e. bss).  */
-static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot)
+/**
+ * zero_bss:
+ *
+ * Map and zero the bss.  We need to explicitly zero any fractional pages
+ * after the data section (i.e. bss).  Return false on mapping failure.
+ */
+static bool zero_bss(abi_ulong start_bss, abi_ulong end_bss, int prot)
 {
-    uintptr_t host_start, host_map_start, host_end;
+    abi_ulong align_bss;
 
-    last_bss = TARGET_PAGE_ALIGN(last_bss);
+    align_bss = TARGET_PAGE_ALIGN(start_bss);
+    end_bss = TARGET_PAGE_ALIGN(end_bss);
 
-    /* ??? There is confusion between qemu_real_host_page_size and
-       qemu_host_page_size here and elsewhere in target_mmap, which
-       may lead to the end of the data section mapping from the file
-       not being mapped.  At least there was an explicit test and
-       comment for that here, suggesting that "the file size must
-       be known".  The comment probably pre-dates the introduction
-       of the fstat system call in target_mmap which does in fact
-       find out the size.  What isn't clear is if the workaround
-       here is still actually needed.  For now, continue with it,
-       but merge it with the "normal" mmap that would allocate the bss.  */
+    if (start_bss < align_bss) {
+        int flags = page_get_flags(start_bss);
 
-    host_start = (uintptr_t) g2h_untagged(elf_bss);
-    host_end = (uintptr_t) g2h_untagged(last_bss);
-    host_map_start = REAL_HOST_PAGE_ALIGN(host_start);
-
-    if (host_map_start < host_end) {
-        void *p = mmap((void *)host_map_start, host_end - host_map_start,
-                       prot, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-        if (p == MAP_FAILED) {
-            perror("cannot mmap brk");
-            exit(-1);
+        if (!(flags & PAGE_VALID)) {
+            /* Map the start of the bss. */
+            align_bss -= TARGET_PAGE_SIZE;
+        } else if (flags & PAGE_WRITE) {
+            /* The page is already mapped writable. */
+            memset(g2h_untagged(start_bss), 0, align_bss - start_bss);
+        } else {
+            /* Read-only zeros? */
+            g_assert_not_reached();
         }
     }
 
-    /* Ensure that the bss page(s) are valid */
-    if ((page_get_flags(last_bss-1) & prot) != prot) {
-        page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss - 1,
-                       prot | PAGE_VALID);
-    }
-
-    if (host_start < host_map_start) {
-        memset((void *)host_start, 0, host_map_start - host_start);
-    }
+    return align_bss >= end_bss ||
+           target_mmap(align_bss, end_bss - align_bss, prot,
+                       MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0) != -1;
 }
 
 #if defined(TARGET_ARM)
@@ -3255,8 +3245,9 @@ static void load_elf_image(const char *image_name, int image_fd,
                 /*
                  * If the load segment requests extra zeros (e.g. bss), map it.
                  */
-                if (eppnt->p_filesz < eppnt->p_memsz) {
-                    zero_bss(vaddr_ef, vaddr_em, elf_prot);
+                if (eppnt->p_filesz < eppnt->p_memsz &&
+                    !zero_bss(vaddr_ef, vaddr_em, elf_prot)) {
+                    goto exit_mmap;
                 }
             } else if (eppnt->p_memsz != 0) {
                 vaddr_len = eppnt->p_memsz + vaddr_po;

From 5f4e5b34092556ab1577e25d1262bd5975b26980 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 3 Aug 2023 20:52:44 +0000
Subject: [PATCH 1093/1353] linux-user: Use zero_bss for PT_LOAD with no file
 contents too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If p_filesz == 0, then vaddr_ef == vaddr.  We can reuse the
code in zero_bss rather than incompletely duplicating it in
load_elf_image.

Tested-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 29 ++++++++---------------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 881fdeb157..e72497c4b4 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3208,7 +3208,7 @@ static void load_elf_image(const char *image_name, int image_fd,
     for (i = 0; i < ehdr->e_phnum; i++) {
         struct elf_phdr *eppnt = phdr + i;
         if (eppnt->p_type == PT_LOAD) {
-            abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em, vaddr_len;
+            abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em;
             int elf_prot = 0;
 
             if (eppnt->p_flags & PF_R) {
@@ -3233,31 +3233,18 @@ static void load_elf_image(const char *image_name, int image_fd,
              * but no backing file segment.
              */
             if (eppnt->p_filesz != 0) {
-                vaddr_len = eppnt->p_filesz + vaddr_po;
-                error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
-                                    MAP_PRIVATE | MAP_FIXED,
+                error = target_mmap(vaddr_ps, eppnt->p_filesz + vaddr_po,
+                                    elf_prot, MAP_PRIVATE | MAP_FIXED,
                                     image_fd, eppnt->p_offset - vaddr_po);
-
                 if (error == -1) {
                     goto exit_mmap;
                 }
+            }
 
-                /*
-                 * If the load segment requests extra zeros (e.g. bss), map it.
-                 */
-                if (eppnt->p_filesz < eppnt->p_memsz &&
-                    !zero_bss(vaddr_ef, vaddr_em, elf_prot)) {
-                    goto exit_mmap;
-                }
-            } else if (eppnt->p_memsz != 0) {
-                vaddr_len = eppnt->p_memsz + vaddr_po;
-                error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
-                                    MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,
-                                    -1, 0);
-
-                if (error == -1) {
-                    goto exit_mmap;
-                }
+            /* If the load segment requests extra zeros (e.g. bss), map it. */
+            if (vaddr_ef < vaddr_em &&
+                !zero_bss(vaddr_ef, vaddr_em, elf_prot)) {
+                goto exit_mmap;
             }
 
             /* Find the full program boundaries.  */

From 3ce3dd8ca965209b42660d943a3e9c8c662913fe Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 6 Aug 2023 17:10:44 +0000
Subject: [PATCH 1094/1353] util/selfmap: Rewrite using qemu/interval-tree.h

We will want to be able to search the set of mappings.
For this patch, the two users iterate the tree in order.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/qemu/selfmap.h |  22 ++++----
 linux-user/elfload.c   |  14 +++--
 linux-user/syscall.c   |  15 +++---
 util/selfmap.c         | 114 +++++++++++++++++++++++++----------------
 4 files changed, 97 insertions(+), 68 deletions(-)

diff --git a/include/qemu/selfmap.h b/include/qemu/selfmap.h
index 3479a2a618..7d938945cb 100644
--- a/include/qemu/selfmap.h
+++ b/include/qemu/selfmap.h
@@ -9,9 +9,10 @@
 #ifndef SELFMAP_H
 #define SELFMAP_H
 
+#include "qemu/interval-tree.h"
+
 typedef struct {
-    unsigned long start;
-    unsigned long end;
+    IntervalTreeNode itree;
 
     /* flags */
     bool is_read;
@@ -19,26 +20,25 @@ typedef struct {
     bool is_exec;
     bool is_priv;
 
-    unsigned long offset;
-    gchar *dev;
+    uint64_t offset;
     uint64_t inode;
-    gchar *path;
+    const char *path;
+    char dev[];
 } MapInfo;
 
-
 /**
  * read_self_maps:
  *
- * Read /proc/self/maps and return a list of MapInfo structures.
+ * Read /proc/self/maps and return a tree of MapInfo structures.
  */
-GSList *read_self_maps(void);
+IntervalTreeRoot *read_self_maps(void);
 
 /**
  * free_self_maps:
- * @info: a GSlist
+ * @info: an interval tree
  *
- * Free a list of MapInfo structures.
+ * Free a tree of MapInfo structures.
  */
-void free_self_maps(GSList *info);
+void free_self_maps(IntervalTreeRoot *root);
 
 #endif /* SELFMAP_H */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index e72497c4b4..fb137345f6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2620,7 +2620,8 @@ static uintptr_t pgd_find_hole_fallback(uintptr_t guest_size, uintptr_t brk,
 static uintptr_t pgb_find_hole(uintptr_t guest_loaddr, uintptr_t guest_size,
                                long align, uintptr_t offset)
 {
-    GSList *maps, *iter;
+    IntervalTreeRoot *maps;
+    IntervalTreeNode *iter;
     uintptr_t this_start, this_end, next_start, brk;
     intptr_t ret = -1;
 
@@ -2638,12 +2639,15 @@ static uintptr_t pgb_find_hole(uintptr_t guest_loaddr, uintptr_t guest_size,
     /* The first hole is before the first map entry. */
     this_start = mmap_min_addr;
 
-    for (iter = maps; iter;
-         this_start = next_start, iter = g_slist_next(iter)) {
+    for (iter = interval_tree_iter_first(maps, 0, -1);
+         iter;
+         this_start = next_start,
+         iter = interval_tree_iter_next(iter, 0, -1)) {
+        MapInfo *info = container_of(iter, MapInfo, itree);
         uintptr_t align_start, hole_size;
 
-        this_end = ((MapInfo *)iter->data)->start;
-        next_start = ((MapInfo *)iter->data)->end;
+        this_end = info->itree.start;
+        next_start = info->itree.last + 1;
         align_start = ROUND_UP(this_start + offset, align);
 
         /* Skip holes that are too small. */
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 7c2c2f6e2f..a15bce2be2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8070,16 +8070,17 @@ static int open_self_maps_1(CPUArchState *cpu_env, int fd, bool smaps)
 {
     CPUState *cpu = env_cpu(cpu_env);
     TaskState *ts = cpu->opaque;
-    GSList *map_info = read_self_maps();
-    GSList *s;
+    IntervalTreeRoot *map_info = read_self_maps();
+    IntervalTreeNode *s;
     int count;
 
-    for (s = map_info; s; s = g_slist_next(s)) {
-        MapInfo *e = (MapInfo *) s->data;
+    for (s = interval_tree_iter_first(map_info, 0, -1); s;
+         s = interval_tree_iter_next(s, 0, -1)) {
+        MapInfo *e = container_of(s, MapInfo, itree);
 
-        if (h2g_valid(e->start)) {
-            unsigned long min = e->start;
-            unsigned long max = e->end;
+        if (h2g_valid(e->itree.start)) {
+            unsigned long min = e->itree.start;
+            unsigned long max = e->itree.last + 1;
             int flags = page_get_flags(h2g(min));
             const char *path;
 
diff --git a/util/selfmap.c b/util/selfmap.c
index 2c14f019ce..4db5b42651 100644
--- a/util/selfmap.c
+++ b/util/selfmap.c
@@ -10,74 +10,98 @@
 #include "qemu/cutils.h"
 #include "qemu/selfmap.h"
 
-GSList *read_self_maps(void)
+IntervalTreeRoot *read_self_maps(void)
 {
-    gchar *maps;
-    GSList *map_info = NULL;
+    IntervalTreeRoot *root;
+    gchar *maps, **lines;
+    guint i, nlines;
 
-    if (g_file_get_contents("/proc/self/maps", &maps, NULL, NULL)) {
-        gchar **lines = g_strsplit(maps, "\n", 0);
-        int i, entries = g_strv_length(lines);
+    if (!g_file_get_contents("/proc/self/maps", &maps, NULL, NULL)) {
+        return NULL;
+    }
 
-        for (i = 0; i < entries; i++) {
-            gchar **fields = g_strsplit(lines[i], " ", 6);
-            if (g_strv_length(fields) > 4) {
-                MapInfo *e = g_new0(MapInfo, 1);
-                int errors = 0;
-                const char *end;
+    root = g_new0(IntervalTreeRoot, 1);
+    lines = g_strsplit(maps, "\n", 0);
+    nlines = g_strv_length(lines);
 
-                errors |= qemu_strtoul(fields[0], &end, 16, &e->start);
-                errors |= qemu_strtoul(end + 1, NULL, 16, &e->end);
+    for (i = 0; i < nlines; i++) {
+        gchar **fields = g_strsplit(lines[i], " ", 6);
+        guint nfields = g_strv_length(fields);
+
+        if (nfields > 4) {
+            uint64_t start, end, offset, inode;
+            int errors = 0;
+            const char *p;
+
+            errors |= qemu_strtou64(fields[0], &p, 16, &start);
+            errors |= qemu_strtou64(p + 1, NULL, 16, &end);
+            errors |= qemu_strtou64(fields[2], NULL, 16, &offset);
+            errors |= qemu_strtou64(fields[4], NULL, 10, &inode);
+
+            if (!errors) {
+                size_t dev_len, path_len;
+                MapInfo *e;
+
+                dev_len = strlen(fields[3]) + 1;
+                if (nfields == 6) {
+                    p = fields[5];
+                    p += strspn(p, " ");
+                    path_len = strlen(p) + 1;
+                } else {
+                    p = NULL;
+                    path_len = 0;
+                }
+
+                e = g_malloc0(sizeof(*e) + dev_len + path_len);
+
+                e->itree.start = start;
+                e->itree.last = end - 1;
+                e->offset = offset;
+                e->inode = inode;
 
                 e->is_read  = fields[1][0] == 'r';
                 e->is_write = fields[1][1] == 'w';
                 e->is_exec  = fields[1][2] == 'x';
                 e->is_priv  = fields[1][3] == 'p';
 
-                errors |= qemu_strtoul(fields[2], NULL, 16, &e->offset);
-                e->dev = g_strdup(fields[3]);
-                errors |= qemu_strtou64(fields[4], NULL, 10, &e->inode);
-
-                if (!errors) {
-                    /*
-                     * The last field may have leading spaces which we
-                     * need to strip.
-                     */
-                    if (g_strv_length(fields) == 6) {
-                        e->path = g_strdup(g_strchug(fields[5]));
-                    }
-                    map_info = g_slist_prepend(map_info, e);
-                } else {
-                    g_free(e->dev);
-                    g_free(e);
+                memcpy(e->dev, fields[3], dev_len);
+                if (path_len) {
+                    e->path = memcpy(e->dev + dev_len, p, path_len);
                 }
+
+                interval_tree_insert(&e->itree, root);
             }
-
-            g_strfreev(fields);
         }
-        g_strfreev(lines);
-        g_free(maps);
+        g_strfreev(fields);
     }
+    g_strfreev(lines);
+    g_free(maps);
 
-    /* ensure the map data is in the same order we collected it */
-    return g_slist_reverse(map_info);
+    return root;
 }
 
 /**
  * free_self_maps:
- * @info: a GSlist
+ * @root: an interval tree
  *
- * Free a list of MapInfo structures.
+ * Free a tree of MapInfo structures.
+ * Since we allocated each MapInfo in one chunk, we need not consider the
+ * contents and can simply free each RBNode.
  */
-static void free_info(gpointer data)
+
+static void free_rbnode(RBNode *n)
 {
-    MapInfo *e = (MapInfo *) data;
-    g_free(e->dev);
-    g_free(e->path);
-    g_free(e);
+    if (n) {
+        free_rbnode(n->rb_left);
+        free_rbnode(n->rb_right);
+        g_free(n);
+    }
 }
 
-void free_self_maps(GSList *info)
+void free_self_maps(IntervalTreeRoot *root)
 {
-    g_slist_free_full(info, &free_info);
+    if (root) {
+        free_rbnode(root->rb_root.rb_node);
+        g_free(root);
+    }
 }

From 435c042fdcfd383cee5402fb7fa5ac3e616f11df Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 6 Aug 2023 17:01:31 -0700
Subject: [PATCH 1095/1353] linux-user: Remove duplicate CPU_LOG_PAGE from
 probe_guest_base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The proper logging for probe_guest_base is in the main function.
There is no need to duplicate that in the subroutines.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index fb137345f6..c14139a5fc 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2560,9 +2560,6 @@ static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
     if (test != addr) {
         pgb_fail_in_use(image_name);
     }
-    qemu_log_mask(CPU_LOG_PAGE,
-                  "%s: base @ %p for %" PRIu64 " bytes\n",
-                  __func__, addr, (uint64_t)guest_hiaddr - guest_loaddr + 1);
 }
 
 /**
@@ -2605,9 +2602,6 @@ static uintptr_t pgd_find_hole_fallback(uintptr_t guest_size, uintptr_t brk,
             if (mmap_start != MAP_FAILED) {
                 munmap(mmap_start, guest_size);
                 if (mmap_start == (void *) align_start) {
-                    qemu_log_mask(CPU_LOG_PAGE,
-                                  "%s: base @ %p for %" PRIdPTR" bytes\n",
-                                  __func__, mmap_start + offset, guest_size);
                     return (uintptr_t) mmap_start + offset;
                 }
             }
@@ -2689,13 +2683,6 @@ static uintptr_t pgb_find_hole(uintptr_t guest_loaddr, uintptr_t guest_size,
         }
     }
     free_self_maps(maps);
-
-    if (ret != -1) {
-        qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %" PRIxPTR
-                      " for %" PRIuPTR " bytes\n",
-                      __func__, ret, guest_size);
-    }
-
     return ret;
 }
 
@@ -2747,9 +2734,6 @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
     }
 
     guest_base = addr;
-
-    qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %"PRIxPTR" for %" PRIuPTR" bytes\n",
-                  __func__, addr, hiaddr - loaddr);
 }
 
 static void pgb_dynamic(const char *image_name, long align)
@@ -2807,9 +2791,6 @@ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
                      reserved_va + 1, test, strerror(errno));
         exit(EXIT_FAILURE);
     }
-
-    qemu_log_mask(CPU_LOG_PAGE, "%s: base @ %p for %lu bytes\n",
-                  __func__, addr, reserved_va + 1);
 }
 
 void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,

From 0c441aeb39ce77cf0c68c93f94f1e64addaefaff Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 6 Aug 2023 20:46:36 -0700
Subject: [PATCH 1096/1353] linux-user: Consolidate guest bounds check in
 probe_guest_base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The three sets of checks are identical, logically.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 50 +++++++++++++++-----------------------------
 1 file changed, 17 insertions(+), 33 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index c14139a5fc..06d81f83b1 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2525,25 +2525,6 @@ static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
         exit(EXIT_FAILURE);
     }
 
-    /* Sanity check the guest binary. */
-    if (reserved_va) {
-        if (guest_hiaddr > reserved_va) {
-            error_report("%s: requires more than reserved virtual "
-                         "address space (0x%" PRIx64 " > 0x%lx)",
-                         image_name, (uint64_t)guest_hiaddr, reserved_va);
-            exit(EXIT_FAILURE);
-        }
-    } else {
-#if HOST_LONG_BITS < TARGET_ABI_BITS
-        if ((guest_hiaddr - guest_base) > ~(uintptr_t)0) {
-            error_report("%s: requires more virtual address space "
-                         "than the host can provide (0x%" PRIx64 ")",
-                         image_name, (uint64_t)guest_hiaddr + 1 - guest_base);
-            exit(EXIT_FAILURE);
-        }
-#endif
-    }
-
     /*
      * Expand the allocation to the entire reserved_va.
      * Exclude the mmap_min_addr hole.
@@ -2694,13 +2675,6 @@ static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
     uintptr_t offset = 0;
     uintptr_t addr;
 
-    if (hiaddr != orig_hiaddr) {
-        error_report("%s: requires virtual address space that the "
-                     "host cannot provide (0x%" PRIx64 ")",
-                     image_name, (uint64_t)orig_hiaddr + 1);
-        exit(EXIT_FAILURE);
-    }
-
     loaddr &= -align;
     if (HI_COMMPAGE) {
         /*
@@ -2766,13 +2740,6 @@ static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
     int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
     void *addr, *test;
 
-    if (guest_hiaddr > reserved_va) {
-        error_report("%s: requires more than reserved virtual "
-                     "address space (0x%" PRIx64 " > 0x%lx)",
-                     image_name, (uint64_t)guest_hiaddr, reserved_va);
-        exit(EXIT_FAILURE);
-    }
-
     /* Widen the "image" to the entire reserved address space. */
     pgb_static(image_name, 0, reserved_va, align);
 
@@ -2799,6 +2766,23 @@ void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
     /* In order to use host shmat, we must be able to honor SHMLBA.  */
     uintptr_t align = MAX(SHMLBA, qemu_host_page_size);
 
+    /* Sanity check the guest binary. */
+    if (reserved_va) {
+        if (guest_hiaddr > reserved_va) {
+            error_report("%s: requires more than reserved virtual "
+                         "address space (0x%" PRIx64 " > 0x%lx)",
+                         image_name, (uint64_t)guest_hiaddr, reserved_va);
+            exit(EXIT_FAILURE);
+        }
+    } else {
+        if (guest_hiaddr != (uintptr_t)guest_hiaddr) {
+            error_report("%s: requires more virtual address space "
+                         "than the host can provide (0x%" PRIx64 ")",
+                         image_name, (uint64_t)guest_hiaddr + 1);
+            exit(EXIT_FAILURE);
+        }
+    }
+
     if (have_guest_base) {
         pgb_have_guest_base(image_name, guest_loaddr, guest_hiaddr, align);
     } else if (reserved_va) {

From 06f38c6688f8b7dcf65377b3302e45bfecc5e060 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 6 Aug 2023 21:03:27 -0700
Subject: [PATCH 1097/1353] linux-user: Rewrite fixed probe_guest_base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create a set of subroutines to collect a set of guest addresses,
all of which must be mappable on the host.  Use this within the
renamed pgb_fixed subroutine to validate the user's choice of
guest_base specified by the -B command-line option.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 188 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 161 insertions(+), 27 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 06d81f83b1..a5f9dd5b31 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2504,6 +2504,157 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #endif
 #endif
 
+/**
+ * pgb_try_mmap:
+ * @addr: host start address
+ * @addr_last: host last address
+ * @keep: do not unmap the probe region
+ *
+ * Return 1 if [@addr, @addr_last] is not mapped in the host,
+ * return 0 if it is not available to map, and -1 on mmap error.
+ * If @keep, the region is left mapped on success, otherwise unmapped.
+ */
+static int pgb_try_mmap(uintptr_t addr, uintptr_t addr_last, bool keep)
+{
+    size_t size = addr_last - addr + 1;
+    void *p = mmap((void *)addr, size, PROT_NONE,
+                   MAP_ANONYMOUS | MAP_PRIVATE |
+                   MAP_NORESERVE | MAP_FIXED_NOREPLACE, -1, 0);
+    int ret;
+
+    if (p == MAP_FAILED) {
+        return errno == EEXIST ? 0 : -1;
+    }
+    ret = p == (void *)addr;
+    if (!keep || !ret) {
+        munmap(p, size);
+    }
+    return ret;
+}
+
+/**
+ * pgb_try_mmap_skip_brk(uintptr_t addr, uintptr_t size, uintptr_t brk)
+ * @addr: host address
+ * @addr_last: host last address
+ * @brk: host brk
+ *
+ * Like pgb_try_mmap, but additionally reserve some memory following brk.
+ */
+static int pgb_try_mmap_skip_brk(uintptr_t addr, uintptr_t addr_last,
+                                 uintptr_t brk, bool keep)
+{
+    uintptr_t brk_last = brk + 16 * MiB - 1;
+
+    /* Do not map anything close to the host brk. */
+    if (addr <= brk_last && brk <= addr_last) {
+        return 0;
+    }
+    return pgb_try_mmap(addr, addr_last, keep);
+}
+
+/**
+ * pgb_try_mmap_set:
+ * @ga: set of guest addrs
+ * @base: guest_base
+ * @brk: host brk
+ *
+ * Return true if all @ga can be mapped by the host at @base.
+ * On success, retain the mapping at index 0 for reserved_va.
+ */
+
+typedef struct PGBAddrs {
+    uintptr_t bounds[3][2]; /* start/last pairs */
+    int nbounds;
+} PGBAddrs;
+
+static bool pgb_try_mmap_set(const PGBAddrs *ga, uintptr_t base, uintptr_t brk)
+{
+    for (int i = ga->nbounds - 1; i >= 0; --i) {
+        if (pgb_try_mmap_skip_brk(ga->bounds[i][0] + base,
+                                  ga->bounds[i][1] + base,
+                                  brk, i == 0 && reserved_va) <= 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+/**
+ * pgb_addr_set:
+ * @ga: output set of guest addrs
+ * @guest_loaddr: guest image low address
+ * @guest_loaddr: guest image high address
+ * @identity: create for identity mapping
+ *
+ * Fill in @ga with the image, COMMPAGE and NULL page.
+ */
+static bool pgb_addr_set(PGBAddrs *ga, abi_ulong guest_loaddr,
+                         abi_ulong guest_hiaddr, bool try_identity)
+{
+    int n;
+
+    /*
+     * With a low commpage, or a guest mapped very low,
+     * we may not be able to use the identity map.
+     */
+    if (try_identity) {
+        if (LO_COMMPAGE != -1 && LO_COMMPAGE < mmap_min_addr) {
+            return false;
+        }
+        if (guest_loaddr != 0 && guest_loaddr < mmap_min_addr) {
+            return false;
+        }
+    }
+
+    memset(ga, 0, sizeof(*ga));
+    n = 0;
+
+    if (reserved_va) {
+        ga->bounds[n][0] = try_identity ? mmap_min_addr : 0;
+        ga->bounds[n][1] = reserved_va;
+        n++;
+        /* LO_COMMPAGE and NULL handled by reserving from 0. */
+    } else {
+        /* Add any LO_COMMPAGE or NULL page. */
+        if (LO_COMMPAGE != -1) {
+            ga->bounds[n][0] = 0;
+            ga->bounds[n][1] = LO_COMMPAGE + TARGET_PAGE_SIZE - 1;
+            n++;
+        } else if (!try_identity) {
+            ga->bounds[n][0] = 0;
+            ga->bounds[n][1] = TARGET_PAGE_SIZE - 1;
+            n++;
+        }
+
+        /* Add the guest image for ET_EXEC. */
+        if (guest_loaddr) {
+            ga->bounds[n][0] = guest_loaddr;
+            ga->bounds[n][1] = guest_hiaddr;
+            n++;
+        }
+    }
+
+    /*
+     * Temporarily disable
+     *   "comparison is always false due to limited range of data type"
+     * due to comparison between unsigned and (possible) 0.
+     */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+
+    /* Add any HI_COMMPAGE not covered by reserved_va. */
+    if (reserved_va < HI_COMMPAGE) {
+        ga->bounds[n][0] = HI_COMMPAGE & qemu_host_page_mask;
+        ga->bounds[n][1] = HI_COMMPAGE + TARGET_PAGE_SIZE - 1;
+        n++;
+    }
+
+#pragma GCC diagnostic pop
+
+    ga->nbounds = n;
+    return true;
+}
+
 static void pgb_fail_in_use(const char *image_name)
 {
     error_report("%s: requires virtual address space that is in use "
@@ -2512,33 +2663,21 @@ static void pgb_fail_in_use(const char *image_name)
     exit(EXIT_FAILURE);
 }
 
-static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
-                                abi_ulong guest_hiaddr, long align)
+static void pgb_fixed(const char *image_name, uintptr_t guest_loaddr,
+                      uintptr_t guest_hiaddr, uintptr_t align)
 {
-    const int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
-    void *addr, *test;
+    PGBAddrs ga;
+    uintptr_t brk = (uintptr_t)sbrk(0);
 
     if (!QEMU_IS_ALIGNED(guest_base, align)) {
         fprintf(stderr, "Requested guest base %p does not satisfy "
-                "host minimum alignment (0x%lx)\n",
+                "host minimum alignment (0x%" PRIxPTR ")\n",
                 (void *)guest_base, align);
         exit(EXIT_FAILURE);
     }
 
-    /*
-     * Expand the allocation to the entire reserved_va.
-     * Exclude the mmap_min_addr hole.
-     */
-    if (reserved_va) {
-        guest_loaddr = (guest_base >= mmap_min_addr ? 0
-                        : mmap_min_addr - guest_base);
-        guest_hiaddr = reserved_va;
-    }
-
-    /* Reserve the address space for the binary, or reserved_va. */
-    test = g2h_untagged(guest_loaddr);
-    addr = mmap(test, guest_hiaddr - guest_loaddr + 1, PROT_NONE, flags, -1, 0);
-    if (test != addr) {
+    if (!pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, !guest_base)
+        || !pgb_try_mmap_set(&ga, guest_base, brk)) {
         pgb_fail_in_use(image_name);
     }
 }
@@ -2784,7 +2923,7 @@ void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
     }
 
     if (have_guest_base) {
-        pgb_have_guest_base(image_name, guest_loaddr, guest_hiaddr, align);
+        pgb_fixed(image_name, guest_loaddr, guest_hiaddr, align);
     } else if (reserved_va) {
         pgb_reserved_va(image_name, guest_loaddr, guest_hiaddr, align);
     } else if (guest_loaddr) {
@@ -2795,13 +2934,8 @@ void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
 
     /* Reserve and initialize the commpage. */
     if (!init_guest_commpage()) {
-        /*
-         * With have_guest_base, the user has selected the address and
-         * we are trying to work with that.  Otherwise, we have selected
-         * free space and init_guest_commpage must succeeded.
-         */
-        assert(have_guest_base);
-        pgb_fail_in_use(image_name);
+        /* We have already probed for the commpage being free. */
+        g_assert_not_reached();
     }
 
     assert(QEMU_IS_ALIGNED(guest_base, align));

From dd55885516f42f718d0d121c59a5f7be5fdae3e6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 6 Aug 2023 22:26:10 -0700
Subject: [PATCH 1098/1353] linux-user: Rewrite non-fixed probe_guest_base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use pgb_addr_set to probe for all of the guest addresses,
not just the main executable.  Handle the identity map
specially and separately from the search.

If /proc/self/maps is available, utilize the full power
of the interval tree search, rather than a linear search
through the address list.

If /proc/self/maps is not available, increase the skip
between probes so that we do not probe every single page
of the host address space.  Choose 1 MiB for 32-bit hosts
(max 4k probes) and 1 GiB for 64-bit hosts (possibly a
large number of probes, but the large step makes it more
likely to find empty space quicker).

Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 311 ++++++++++++++++---------------------------
 1 file changed, 115 insertions(+), 196 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a5f9dd5b31..ac03beb01b 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2683,220 +2683,143 @@ static void pgb_fixed(const char *image_name, uintptr_t guest_loaddr,
 }
 
 /**
- * pgd_find_hole_fallback: potential mmap address
- * @guest_size: size of available space
- * @brk: location of break
- * @align: memory alignment
+ * pgb_find_fallback:
  *
- * This is a fallback method for finding a hole in the host address
- * space if we don't have the benefit of being able to access
- * /proc/self/map. It can potentially take a very long time as we can
- * only dumbly iterate up the host address space seeing if the
- * allocation would work.
+ * This is a fallback method for finding holes in the host address space
+ * if we don't have the benefit of being able to access /proc/self/map.
+ * It can potentially take a very long time as we can only dumbly iterate
+ * up the host address space seeing if the allocation would work.
  */
-static uintptr_t pgd_find_hole_fallback(uintptr_t guest_size, uintptr_t brk,
-                                        long align, uintptr_t offset)
+static uintptr_t pgb_find_fallback(const PGBAddrs *ga, uintptr_t align,
+                                   uintptr_t brk)
 {
-    uintptr_t base;
+    /* TODO: come up with a better estimate of how much to skip. */
+    uintptr_t skip = sizeof(uintptr_t) == 4 ? MiB : GiB;
 
-    /* Start (aligned) at the bottom and work our way up */
-    base = ROUND_UP(mmap_min_addr, align);
-
-    while (true) {
-        uintptr_t align_start, end;
-        align_start = ROUND_UP(base, align);
-        end = align_start + guest_size + offset;
-
-        /* if brk is anywhere in the range give ourselves some room to grow. */
-        if (align_start <= brk && brk < end) {
-            base = brk + (16 * MiB);
-            continue;
-        } else if (align_start + guest_size < align_start) {
-            /* we have run out of space */
+    for (uintptr_t base = skip; ; base += skip) {
+        base = ROUND_UP(base, align);
+        if (pgb_try_mmap_set(ga, base, brk)) {
+            return base;
+        }
+        if (base >= -skip) {
             return -1;
-        } else {
-            int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE |
-                MAP_FIXED_NOREPLACE;
-            void * mmap_start = mmap((void *) align_start, guest_size,
-                                     PROT_NONE, flags, -1, 0);
-            if (mmap_start != MAP_FAILED) {
-                munmap(mmap_start, guest_size);
-                if (mmap_start == (void *) align_start) {
-                    return (uintptr_t) mmap_start + offset;
-                }
-            }
-            base += qemu_host_page_size;
         }
     }
 }
 
-/* Return value for guest_base, or -1 if no hole found. */
-static uintptr_t pgb_find_hole(uintptr_t guest_loaddr, uintptr_t guest_size,
-                               long align, uintptr_t offset)
+static uintptr_t pgb_try_itree(const PGBAddrs *ga, uintptr_t base,
+                               IntervalTreeRoot *root)
 {
-    IntervalTreeRoot *maps;
-    IntervalTreeNode *iter;
-    uintptr_t this_start, this_end, next_start, brk;
-    intptr_t ret = -1;
+    for (int i = ga->nbounds - 1; i >= 0; --i) {
+        uintptr_t s = base + ga->bounds[i][0];
+        uintptr_t l = base + ga->bounds[i][1];
+        IntervalTreeNode *n;
+
+        if (l < s) {
+            /* Wraparound. Skip to advance S to mmap_min_addr. */
+            return mmap_min_addr - s;
+        }
+
+        n = interval_tree_iter_first(root, s, l);
+        if (n != NULL) {
+            /* Conflict.  Skip to advance S to LAST + 1. */
+            return n->last - s + 1;
+        }
+    }
+    return 0;  /* success */
+}
+
+static uintptr_t pgb_find_itree(const PGBAddrs *ga, IntervalTreeRoot *root,
+                                uintptr_t align, uintptr_t brk)
+{
+    uintptr_t last = mmap_min_addr;
+    uintptr_t base, skip;
+
+    while (true) {
+        base = ROUND_UP(last, align);
+        if (base < last) {
+            return -1;
+        }
+
+        skip = pgb_try_itree(ga, base, root);
+        if (skip == 0) {
+            break;
+        }
+
+        last = base + skip;
+        if (last < base) {
+            return -1;
+        }
+    }
+
+    /*
+     * We've chosen 'base' based on holes in the interval tree,
+     * but we don't yet know if it is a valid host address.
+     * Because it is the first matching hole, if the host addresses
+     * are invalid we know there are no further matches.
+     */
+    return pgb_try_mmap_set(ga, base, brk) ? base : -1;
+}
+
+static void pgb_dynamic(const char *image_name, uintptr_t guest_loaddr,
+                        uintptr_t guest_hiaddr, uintptr_t align)
+{
+    IntervalTreeRoot *root;
+    uintptr_t brk, ret;
+    PGBAddrs ga;
 
     assert(QEMU_IS_ALIGNED(guest_loaddr, align));
 
-    maps = read_self_maps();
+    /* Try the identity map first. */
+    if (pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, true)) {
+        brk = (uintptr_t)sbrk(0);
+        if (pgb_try_mmap_set(&ga, 0, brk)) {
+            guest_base = 0;
+            return;
+        }
+    }
+
+    /*
+     * Rebuild the address set for non-identity map.
+     * This differs in the mapping of the guest NULL page.
+     */
+    pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, false);
+
+    root = read_self_maps();
 
     /* Read brk after we've read the maps, which will malloc. */
     brk = (uintptr_t)sbrk(0);
 
-    if (!maps) {
-        return pgd_find_hole_fallback(guest_size, brk, align, offset);
-    }
-
-    /* The first hole is before the first map entry. */
-    this_start = mmap_min_addr;
-
-    for (iter = interval_tree_iter_first(maps, 0, -1);
-         iter;
-         this_start = next_start,
-         iter = interval_tree_iter_next(iter, 0, -1)) {
-        MapInfo *info = container_of(iter, MapInfo, itree);
-        uintptr_t align_start, hole_size;
-
-        this_end = info->itree.start;
-        next_start = info->itree.last + 1;
-        align_start = ROUND_UP(this_start + offset, align);
-
-        /* Skip holes that are too small. */
-        if (align_start >= this_end) {
-            continue;
-        }
-        hole_size = this_end - align_start;
-        if (hole_size < guest_size) {
-            continue;
-        }
-
-        /* If this hole contains brk, give ourselves some room to grow. */
-        if (this_start <= brk && brk < this_end) {
-            hole_size -= guest_size;
-            if (sizeof(uintptr_t) == 8 && hole_size >= 1 * GiB) {
-                align_start += 1 * GiB;
-            } else if (hole_size >= 16 * MiB) {
-                align_start += 16 * MiB;
-            } else {
-                align_start = (this_end - guest_size) & -align;
-                if (align_start < this_start) {
-                    continue;
-                }
-            }
-        }
-
-        /* Record the lowest successful match. */
-        if (ret < 0) {
-            ret = align_start;
-        }
-        /* If this hole contains the identity map, select it. */
-        if (align_start <= guest_loaddr &&
-            guest_loaddr + guest_size <= this_end) {
-            ret = 0;
-        }
-        /* If this hole ends above the identity map, stop looking. */
-        if (this_end >= guest_loaddr) {
-            break;
-        }
-    }
-    free_self_maps(maps);
-    return ret;
-}
-
-static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
-                       abi_ulong orig_hiaddr, long align)
-{
-    uintptr_t loaddr = orig_loaddr;
-    uintptr_t hiaddr = orig_hiaddr;
-    uintptr_t offset = 0;
-    uintptr_t addr;
-
-    loaddr &= -align;
-    if (HI_COMMPAGE) {
+    if (!root) {
+        ret = pgb_find_fallback(&ga, align, brk);
+    } else {
         /*
-         * Extend the allocation to include the commpage.
-         * For a 64-bit host, this is just 4GiB; for a 32-bit host we
-         * need to ensure there is space bellow the guest_base so we
-         * can map the commpage in the place needed when the address
-         * arithmetic wraps around.
+         * Reserve the area close to the host brk.
+         * This will be freed with the rest of the tree.
          */
-        if (sizeof(uintptr_t) == 8 || loaddr >= 0x80000000u) {
-            hiaddr = UINT32_MAX;
-        } else {
-            offset = -(HI_COMMPAGE & -align);
-        }
-    } else if (LO_COMMPAGE != -1) {
-        loaddr = MIN(loaddr, LO_COMMPAGE & -align);
+        IntervalTreeNode *b = g_new0(IntervalTreeNode, 1);
+        b->start = brk;
+        b->last = brk + 16 * MiB - 1;
+        interval_tree_insert(b, root);
+
+        ret = pgb_find_itree(&ga, root, align, brk);
+        free_self_maps(root);
     }
 
-    addr = pgb_find_hole(loaddr, hiaddr - loaddr + 1, align, offset);
-    if (addr == -1) {
-        /*
-         * If HI_COMMPAGE, there *might* be a non-consecutive allocation
-         * that can satisfy both.  But as the normal arm32 link base address
-         * is ~32k, and we extend down to include the commpage, making the
-         * overhead only ~96k, this is unlikely.
-         */
-        error_report("%s: Unable to allocate %#zx bytes of "
-                     "virtual address space", image_name,
-                     (size_t)(hiaddr - loaddr));
-        exit(EXIT_FAILURE);
-    }
-
-    guest_base = addr;
-}
-
-static void pgb_dynamic(const char *image_name, long align)
-{
-    /*
-     * The executable is dynamic and does not require a fixed address.
-     * All we need is a commpage that satisfies align.
-     * If we do not need a commpage, leave guest_base == 0.
-     */
-    if (HI_COMMPAGE) {
-        uintptr_t addr, commpage;
-
-        /* 64-bit hosts should have used reserved_va. */
-        assert(sizeof(uintptr_t) == 4);
-
-        /*
-         * By putting the commpage at the first hole, that puts guest_base
-         * just above that, and maximises the positive guest addresses.
-         */
-        commpage = HI_COMMPAGE & -align;
-        addr = pgb_find_hole(commpage, -commpage, align, 0);
-        assert(addr != -1);
-        guest_base = addr;
-    }
-}
-
-static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
-                            abi_ulong guest_hiaddr, long align)
-{
-    int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
-    void *addr, *test;
-
-    /* Widen the "image" to the entire reserved address space. */
-    pgb_static(image_name, 0, reserved_va, align);
-
-    /* osdep.h defines this as 0 if it's missing */
-    flags |= MAP_FIXED_NOREPLACE;
-
-    /* Reserve the memory on the host. */
-    assert(guest_base != 0);
-    test = g2h_untagged(0);
-    addr = mmap(test, reserved_va + 1, PROT_NONE, flags, -1, 0);
-    if (addr == MAP_FAILED || addr != test) {
-        error_report("Unable to reserve 0x%lx bytes of virtual address "
-                     "space at %p (%s) for use as guest address space (check your "
-                     "virtual memory ulimit setting, mmap_min_addr or reserve less "
-                     "using qemu-user's -R option)",
-                     reserved_va + 1, test, strerror(errno));
+    if (ret == -1) {
+        int w = TARGET_LONG_BITS / 4;
+
+        error_report("%s: Unable to find a guest_base to satisfy all "
+                     "guest address mapping requirements", image_name);
+
+        for (int i = 0; i < ga.nbounds; ++i) {
+            error_printf("  %0*" PRIx64 "-%0*" PRIx64 "\n",
+                         w, (uint64_t)ga.bounds[i][0],
+                         w, (uint64_t)ga.bounds[i][1]);
+        }
         exit(EXIT_FAILURE);
     }
+    guest_base = ret;
 }
 
 void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
@@ -2924,12 +2847,8 @@ void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
 
     if (have_guest_base) {
         pgb_fixed(image_name, guest_loaddr, guest_hiaddr, align);
-    } else if (reserved_va) {
-        pgb_reserved_va(image_name, guest_loaddr, guest_hiaddr, align);
-    } else if (guest_loaddr) {
-        pgb_static(image_name, guest_loaddr, guest_hiaddr, align);
     } else {
-        pgb_dynamic(image_name, align);
+        pgb_dynamic(image_name, guest_loaddr, guest_hiaddr, align);
     }
 
     /* Reserve and initialize the commpage. */

From c42e77a90d9244c8caf76fe0e54f84200430a4e1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 8 Aug 2023 09:44:18 -0700
Subject: [PATCH 1099/1353] qemu/osdep: Remove fallback for MAP_FIXED_NOREPLACE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order for our emulation of MAP_FIXED_NOREPLACE to succeed within
linux-user target_mmap, we require a non-zero value.  This does not
require host kernel support, merely the bit being defined.

MAP_FIXED_NOREPLACE was added with glibc 2.28.  From repology.org:

                  Fedora 36: 2.35
          CentOS 8 (RHEL-8): 2.28
                  Debian 11: 2.31
         OpenSUSE Leap 15.4: 2.31
           Ubuntu LTS 20.04: 2.31

Reported-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230808164418.69989-1-richard.henderson@linaro.org>
---
 include/qemu/osdep.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index cc61b00ba9..21ef8f1699 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -289,9 +289,6 @@ void QEMU_ERROR("code path is reachable")
 #ifndef MAP_ANONYMOUS
 #define MAP_ANONYMOUS MAP_ANON
 #endif
-#ifndef MAP_FIXED_NOREPLACE
-#define MAP_FIXED_NOREPLACE 0
-#endif
 #ifndef MAP_NORESERVE
 #define MAP_NORESERVE 0
 #endif

From 6c8f8456cb0b239812dee5211881426496da7b98 Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 8 Aug 2023 17:16:13 +0200
Subject: [PATCH 1100/1353] hw/nvme: fix null pointer access in directive
 receive

nvme_directive_receive() does not check if an endurance group has been
configured (set) prior to testing if flexible data placement is enabled
or not.

Fix this.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1815
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index d217ae91b5..e5b5c7034d 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -6900,7 +6900,7 @@ static uint16_t nvme_directive_receive(NvmeCtrl *n, NvmeRequest *req)
     case NVME_DIRECTIVE_IDENTIFY:
         switch (doper) {
         case NVME_DIRECTIVE_RETURN_PARAMS:
-            if (ns->endgrp->fdp.enabled) {
+            if (ns->endgrp && ns->endgrp->fdp.enabled) {
                 id.supported |= 1 << NVME_DIRECTIVE_DATA_PLACEMENT;
                 id.enabled |= 1 << NVME_DIRECTIVE_DATA_PLACEMENT;
                 id.persistent |= 1 << NVME_DIRECTIVE_DATA_PLACEMENT;

From 3439ba9c5da943d96f7a3c86e0a7eb2ff48de41c Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 8 Aug 2023 17:16:14 +0200
Subject: [PATCH 1101/1353] hw/nvme: fix null pointer access in ruh update

The Reclaim Unit Update operation in I/O Management Receive does not
verify the presence of a configured endurance group prior to accessing
it.

Fix this.

Cc: qemu-stable@nongnu.org
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reviewed-by: Jesper Wendel Devantier <j.devantier@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e5b5c7034d..539d273553 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -4361,7 +4361,13 @@ static uint16_t nvme_io_mgmt_send_ruh_update(NvmeCtrl *n, NvmeRequest *req)
     uint32_t npid = (cdw10 >> 1) + 1;
     unsigned int i = 0;
     g_autofree uint16_t *pids = NULL;
-    uint32_t maxnpid = n->subsys->endgrp.fdp.nrg * n->subsys->endgrp.fdp.nruh;
+    uint32_t maxnpid;
+
+    if (!ns->endgrp || !ns->endgrp->fdp.enabled) {
+        return NVME_FDP_DISABLED | NVME_DNR;
+    }
+
+    maxnpid = n->subsys->endgrp.fdp.nrg * n->subsys->endgrp.fdp.nruh;
 
     if (unlikely(npid >= MIN(NVME_FDP_MAXPIDS, maxnpid))) {
         return NVME_INVALID_FIELD | NVME_DNR;

From 9ab8d0714964abce6f5b8bcac49d6239c548ed12 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 7 Aug 2023 18:22:35 -0700
Subject: [PATCH 1102/1353] linux-user: Split out do_mmap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New function that rejects unsupported map types and flags.
In 4b840f96 we should not have accepted MAP_SHARED_VALIDATE
without actually validating the rest of the flags.

Fixes: 4b840f96 ("linux-user: Populate more bits in mmap_flags_tbl")
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 90 +++++++++++++++++++++++++++++++++++---------
 1 file changed, 73 insertions(+), 17 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index a15bce2be2..34deff0723 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5985,10 +5985,6 @@ static const StructEntry struct_termios_def = {
 #endif
 
 static const bitmask_transtbl mmap_flags_tbl[] = {
-    { TARGET_MAP_TYPE, TARGET_MAP_SHARED, MAP_TYPE, MAP_SHARED },
-    { TARGET_MAP_TYPE, TARGET_MAP_PRIVATE, MAP_TYPE, MAP_PRIVATE },
-    { TARGET_MAP_TYPE, TARGET_MAP_SHARED_VALIDATE,
-      MAP_TYPE, MAP_SHARED_VALIDATE },
     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
       MAP_ANONYMOUS, MAP_ANONYMOUS },
@@ -6006,7 +6002,6 @@ static const bitmask_transtbl mmap_flags_tbl[] = {
        Recognize it for the target insofar as we do not want to pass
        it through to the host.  */
     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
-    { TARGET_MAP_SYNC, TARGET_MAP_SYNC, MAP_SYNC, MAP_SYNC },
     { TARGET_MAP_NONBLOCK, TARGET_MAP_NONBLOCK, MAP_NONBLOCK, MAP_NONBLOCK },
     { TARGET_MAP_POPULATE, TARGET_MAP_POPULATE, MAP_POPULATE, MAP_POPULATE },
     { TARGET_MAP_FIXED_NOREPLACE, TARGET_MAP_FIXED_NOREPLACE,
@@ -6016,6 +6011,75 @@ static const bitmask_transtbl mmap_flags_tbl[] = {
     { 0, 0, 0, 0 }
 };
 
+/*
+ * Arrange for legacy / undefined architecture specific flags to be
+ * ignored by mmap handling code.
+ */
+#ifndef TARGET_MAP_32BIT
+#define TARGET_MAP_32BIT 0
+#endif
+#ifndef TARGET_MAP_HUGE_2MB
+#define TARGET_MAP_HUGE_2MB 0
+#endif
+#ifndef TARGET_MAP_HUGE_1GB
+#define TARGET_MAP_HUGE_1GB 0
+#endif
+
+static abi_long do_mmap(abi_ulong addr, abi_ulong len, int prot,
+                        int target_flags, int fd, off_t offset)
+{
+    /*
+     * The historical set of flags that all mmap types implicitly support.
+     */
+    enum {
+        TARGET_LEGACY_MAP_MASK = TARGET_MAP_SHARED
+                               | TARGET_MAP_PRIVATE
+                               | TARGET_MAP_FIXED
+                               | TARGET_MAP_ANONYMOUS
+                               | TARGET_MAP_DENYWRITE
+                               | TARGET_MAP_EXECUTABLE
+                               | TARGET_MAP_UNINITIALIZED
+                               | TARGET_MAP_GROWSDOWN
+                               | TARGET_MAP_LOCKED
+                               | TARGET_MAP_NORESERVE
+                               | TARGET_MAP_POPULATE
+                               | TARGET_MAP_NONBLOCK
+                               | TARGET_MAP_STACK
+                               | TARGET_MAP_HUGETLB
+                               | TARGET_MAP_32BIT
+                               | TARGET_MAP_HUGE_2MB
+                               | TARGET_MAP_HUGE_1GB
+    };
+    int host_flags;
+
+    switch (target_flags & TARGET_MAP_TYPE) {
+    case TARGET_MAP_PRIVATE:
+        host_flags = MAP_PRIVATE;
+        break;
+    case TARGET_MAP_SHARED:
+        host_flags = MAP_SHARED;
+        break;
+    case TARGET_MAP_SHARED_VALIDATE:
+        /*
+         * MAP_SYNC is only supported for MAP_SHARED_VALIDATE, and is
+         * therefore omitted from mmap_flags_tbl and TARGET_LEGACY_MAP_MASK.
+         */
+        if (target_flags & ~(TARGET_LEGACY_MAP_MASK | TARGET_MAP_SYNC)) {
+            return -TARGET_EOPNOTSUPP;
+        }
+        host_flags = MAP_SHARED_VALIDATE;
+        if (target_flags & TARGET_MAP_SYNC) {
+            host_flags |= MAP_SYNC;
+        }
+        break;
+    default:
+        return -TARGET_EINVAL;
+    }
+    host_flags |= target_to_host_bitmask(target_flags, mmap_flags_tbl);
+
+    return get_errno(target_mmap(addr, len, prot, host_flags, fd, offset));
+}
+
 /*
  * NOTE: TARGET_ABI32 is defined for TARGET_I386 (but not for TARGET_X86_64)
  *       TARGET_I386 is defined if TARGET_X86_64 is defined
@@ -10536,28 +10600,20 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
             v5 = tswapal(v[4]);
             v6 = tswapal(v[5]);
             unlock_user(v, arg1, 0);
-            ret = get_errno(target_mmap(v1, v2, v3,
-                                        target_to_host_bitmask(v4, mmap_flags_tbl),
-                                        v5, v6));
+            return do_mmap(v1, v2, v3, v4, v5, v6);
         }
 #else
         /* mmap pointers are always untagged */
-        ret = get_errno(target_mmap(arg1, arg2, arg3,
-                                    target_to_host_bitmask(arg4, mmap_flags_tbl),
-                                    arg5,
-                                    arg6));
+        return do_mmap(arg1, arg2, arg3, arg4, arg5, arg6);
 #endif
-        return ret;
 #endif
 #ifdef TARGET_NR_mmap2
     case TARGET_NR_mmap2:
 #ifndef MMAP_SHIFT
 #define MMAP_SHIFT 12
 #endif
-        ret = target_mmap(arg1, arg2, arg3,
-                          target_to_host_bitmask(arg4, mmap_flags_tbl),
-                          arg5, (off_t)(abi_ulong)arg6 << MMAP_SHIFT);
-        return get_errno(ret);
+        return do_mmap(arg1, arg2, arg3, arg4, arg5,
+                       (off_t)(abi_ulong)arg6 << MMAP_SHIFT);
 #endif
     case TARGET_NR_munmap:
         arg1 = cpu_untagged_addr(cpu, arg1);

From a05cee93f4052179c036789c5a246948dcc362f0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 7 Aug 2023 18:26:54 -0700
Subject: [PATCH 1103/1353] linux-user: Use ARRAY_SIZE with bitmask_transtbl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than using a zero tuple to end the table, use a macro
to apply ARRAY_SIZE and pass that on to the convert functions.

This fixes two bugs in which the conversion functions required
that both the target and host masks be non-zero in order to
continue, rather than require both target and host masks be
zero in order to terminate.

This affected mmap_flags_tbl when the host does not support
all of the flags we wish to convert (e.g. MAP_UNINITIALIZED).
Mapping these flags to zero is good enough, and matches how
the kernel ignores bits that are unknown.

Fixes: 4b840f96 ("linux-user: Populate more bits in mmap_flags_tbl")
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/syscall_defs.h   |  2 ++
 include/exec/user/thunk.h | 15 +++++++++++----
 linux-user/syscall.c      |  6 ------
 linux-user/thunk.c        | 24 ++++++++++++------------
 4 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index b6d113d24a..aedfbf2d7d 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -227,7 +227,9 @@ type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
 }
 
 /* So far all target and host bitmasks are the same */
+#undef  target_to_host_bitmask
 #define target_to_host_bitmask(x, tbl) (x)
+#undef  host_to_target_bitmask
 #define host_to_target_bitmask(x, tbl) (x)
 
 #endif /* SYSCALL_DEFS_H */
diff --git a/include/exec/user/thunk.h b/include/exec/user/thunk.h
index 300a840d58..6eedef48d8 100644
--- a/include/exec/user/thunk.h
+++ b/include/exec/user/thunk.h
@@ -193,10 +193,17 @@ static inline int thunk_type_align(const argtype *type_ptr, int is_host)
     }
 }
 
-unsigned int target_to_host_bitmask(unsigned int target_mask,
-                                    const bitmask_transtbl * trans_tbl);
-unsigned int host_to_target_bitmask(unsigned int host_mask,
-                                    const bitmask_transtbl * trans_tbl);
+unsigned int target_to_host_bitmask_len(unsigned int target_mask,
+                                        const bitmask_transtbl *trans_tbl,
+                                        size_t trans_len);
+unsigned int host_to_target_bitmask_len(unsigned int host_mask,
+                                        const bitmask_transtbl * trans_tbl,
+                                        size_t trans_len);
+
+#define target_to_host_bitmask(M, T) \
+    target_to_host_bitmask_len(M, T, ARRAY_SIZE(T))
+#define host_to_target_bitmask(M, T) \
+    host_to_target_bitmask_len(M, T, ARRAY_SIZE(T))
 
 void thunk_init(unsigned int max_structs);
 
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 34deff0723..12ebc70df5 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -455,7 +455,6 @@ static const bitmask_transtbl fcntl_flags_tbl[] = {
 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
 #endif
-  { 0, 0, 0, 0 }
 };
 
 _syscall2(int, sys_getcwd1, char *, buf, size_t, size)
@@ -5813,7 +5812,6 @@ static const bitmask_transtbl iflag_tbl[] = {
         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
         { TARGET_IUTF8, TARGET_IUTF8, IUTF8, IUTF8},
-        { 0, 0, 0, 0 }
 };
 
 static const bitmask_transtbl oflag_tbl[] = {
@@ -5841,7 +5839,6 @@ static const bitmask_transtbl oflag_tbl[] = {
 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
-	{ 0, 0, 0, 0 }
 };
 
 static const bitmask_transtbl cflag_tbl[] = {
@@ -5876,7 +5873,6 @@ static const bitmask_transtbl cflag_tbl[] = {
 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
-	{ 0, 0, 0, 0 }
 };
 
 static const bitmask_transtbl lflag_tbl[] = {
@@ -5896,7 +5892,6 @@ static const bitmask_transtbl lflag_tbl[] = {
   { TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
   { TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
   { TARGET_EXTPROC, TARGET_EXTPROC, EXTPROC, EXTPROC},
-  { 0, 0, 0, 0 }
 };
 
 static void target_to_host_termios (void *dst, const void *src)
@@ -6008,7 +6003,6 @@ static const bitmask_transtbl mmap_flags_tbl[] = {
       MAP_FIXED_NOREPLACE, MAP_FIXED_NOREPLACE },
     { TARGET_MAP_UNINITIALIZED, TARGET_MAP_UNINITIALIZED,
       MAP_UNINITIALIZED, MAP_UNINITIALIZED },
-    { 0, 0, 0, 0 }
 };
 
 /*
diff --git a/linux-user/thunk.c b/linux-user/thunk.c
index dac4bf11c6..071aad4b5f 100644
--- a/linux-user/thunk.c
+++ b/linux-user/thunk.c
@@ -436,29 +436,29 @@ const argtype *thunk_print(void *arg, const argtype *type_ptr)
 /* Utility function: Table-driven functions to translate bitmasks
  * between host and target formats
  */
-unsigned int target_to_host_bitmask(unsigned int target_mask,
-                                    const bitmask_transtbl * trans_tbl)
+unsigned int target_to_host_bitmask_len(unsigned int target_mask,
+                                        const bitmask_transtbl *tbl,
+                                        size_t len)
 {
-    const bitmask_transtbl *btp;
     unsigned int host_mask = 0;
 
-    for (btp = trans_tbl; btp->target_mask && btp->host_mask; btp++) {
-        if ((target_mask & btp->target_mask) == btp->target_bits) {
-            host_mask |= btp->host_bits;
+    for (size_t i = 0; i < len; ++i) {
+        if ((target_mask & tbl[i].target_mask) == tbl[i].target_bits) {
+            host_mask |= tbl[i].host_bits;
         }
     }
     return host_mask;
 }
 
-unsigned int host_to_target_bitmask(unsigned int host_mask,
-                                    const bitmask_transtbl * trans_tbl)
+unsigned int host_to_target_bitmask_len(unsigned int host_mask,
+                                        const bitmask_transtbl *tbl,
+                                        size_t len)
 {
-    const bitmask_transtbl *btp;
     unsigned int target_mask = 0;
 
-    for (btp = trans_tbl; btp->target_mask && btp->host_mask; btp++) {
-        if ((host_mask & btp->host_mask) == btp->host_bits) {
-            target_mask |= btp->target_bits;
+    for (size_t i = 0; i < len; ++i) {
+        if ((host_mask & tbl[i].host_mask) == tbl[i].host_bits) {
+            target_mask |= tbl[i].target_bits;
         }
     }
     return target_mask;

From 1b65895ddd9bb3898458ec622f5550173f9a8550 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 8 Aug 2023 23:41:20 +0000
Subject: [PATCH 1104/1353] tests/tcg: Disable filename test for info proc
 mappings

This test fails when host page size != guest page size,
because qemu may not be able to directly map the file.

Fixes: a6341482695 ("tests/tcg: Add a test for info proc mappings")
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/multiarch/gdbstub/test-proc-mappings.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
index 7b596ac21b..5e3e5a2fb7 100644
--- a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
+++ b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
@@ -33,7 +33,8 @@ def run_test():
             return
         raise
     report(isinstance(mappings, str), "Fetched the mappings from the inferior")
-    report("/sha1" in mappings, "Found the test binary name in the mappings")
+    # Broken with host page size > guest page size
+    # report("/sha1" in mappings, "Found the test binary name in the mappings")
 
 
 def main():

From 47d1e982318a0d97c557ce349ea9e2b601554055 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Wed, 9 Aug 2023 17:11:39 +0200
Subject: [PATCH 1105/1353] util/interval-tree: Check root for null in
 interval_tree_iter_first

Fix a crash in qemu-user when running

    cat /proc/self/maps

in a chroot, where /proc isn't mounted.

The problem was introduced by commit 3ce3dd8ca965 ("util/selfmap:
Rewrite using qemu/interval-tree.h") where in open_self_maps_1() the
function read_self_maps() is called and which returns NULL if it can't
read the hosts /proc/self/maps file. Afterwards that NULL is fed into
interval_tree_iter_first() which doesn't check if the root node is NULL.

Fix it by adding a check if root is NULL and return NULL in that case.

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: 3ce3dd8ca965 ("util/selfmap: Rewrite using qemu/interval-tree.h")
Message-Id: <ZNOsq6Z7t/eyIG/9@p100>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 util/interval-tree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/interval-tree.c b/util/interval-tree.c
index f2866aa7d3..53465182e6 100644
--- a/util/interval-tree.c
+++ b/util/interval-tree.c
@@ -797,7 +797,7 @@ IntervalTreeNode *interval_tree_iter_first(IntervalTreeRoot *root,
 {
     IntervalTreeNode *node, *leftmost;
 
-    if (!root->rb_root.rb_node) {
+    if (!root || !root->rb_root.rb_node) {
         return NULL;
     }
 

From b8002058c45a50d893c51cf62ec96c70128fc1eb Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 3 Aug 2023 23:44:47 +0200
Subject: [PATCH 1106/1353] linux-user: Fix openat() emulation to correctly
 detect accesses to /proc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In qemu we catch accesses to files like /proc/cpuinfo or /proc/net/route
and return to the guest contents which would be visible on a real system
(instead what the host would show).

This patch fixes a bug, where for example the accesses
    cat /proc////cpuinfo
or
    cd /proc && cat cpuinfo
will not be recognized by qemu and where qemu will wrongly show
the contents of the host's /proc/cpuinfo file.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230803214450.647040-2-deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/syscall.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 12ebc70df5..9353268cc1 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -8557,9 +8557,12 @@ static int open_hardware(CPUArchState *cpu_env, int fd)
 }
 #endif
 
-int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
+
+int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *fname,
                     int flags, mode_t mode, bool safe)
 {
+    g_autofree char *proc_name = NULL;
+    const char *pathname;
     struct fake_open {
         const char *filename;
         int (*fill)(CPUArchState *cpu_env, int fd);
@@ -8585,6 +8588,14 @@ int do_guest_openat(CPUArchState *cpu_env, int dirfd, const char *pathname,
         { NULL, NULL, NULL }
     };
 
+    /* if this is a file from /proc/ filesystem, expand full name */
+    proc_name = realpath(fname, NULL);
+    if (proc_name && strncmp(proc_name, "/proc/", 6) == 0) {
+        pathname = proc_name;
+    } else {
+        pathname = fname;
+    }
+
     if (is_proc_myself(pathname, "exe")) {
         if (safe) {
             return safe_openat(dirfd, exec_path, flags, mode);

From 6a2c23ddeb5bc8883c227ce1a3ff22e9978291af Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 10 Aug 2023 08:37:14 -0700
Subject: [PATCH 1107/1353] accel/tcg: Avoid reading too much in
 load_atom_{2,4}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When load_atom_extract_al16_or_al8 is inexpensive, we want to use
it early, in order to avoid the overhead of required_atomicity.
However, we must not read past the end of the page.

If there are more than 8 bytes remaining, then both the "aligned 16"
and "aligned 8" paths align down so that the read has at least
16 bytes remaining on the page.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/ldst_atomicity.c.inc    | 10 ++++++--
 tests/tcg/aarch64/Makefile.target |  2 +-
 tests/tcg/aarch64/lse2-fault.c    | 38 +++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 3 deletions(-)
 create mode 100644 tests/tcg/aarch64/lse2-fault.c

diff --git a/accel/tcg/ldst_atomicity.c.inc b/accel/tcg/ldst_atomicity.c.inc
index e5c590a499..1b793e6935 100644
--- a/accel/tcg/ldst_atomicity.c.inc
+++ b/accel/tcg/ldst_atomicity.c.inc
@@ -404,7 +404,10 @@ static uint16_t load_atom_2(CPUArchState *env, uintptr_t ra,
         return load_atomic2(pv);
     }
     if (HAVE_ATOMIC128_RO) {
-        return load_atom_extract_al16_or_al8(pv, 2);
+        intptr_t left_in_page = -(pi | TARGET_PAGE_MASK);
+        if (likely(left_in_page > 8)) {
+            return load_atom_extract_al16_or_al8(pv, 2);
+        }
     }
 
     atmax = required_atomicity(env, pi, memop);
@@ -443,7 +446,10 @@ static uint32_t load_atom_4(CPUArchState *env, uintptr_t ra,
         return load_atomic4(pv);
     }
     if (HAVE_ATOMIC128_RO) {
-        return load_atom_extract_al16_or_al8(pv, 4);
+        intptr_t left_in_page = -(pi | TARGET_PAGE_MASK);
+        if (likely(left_in_page > 8)) {
+            return load_atom_extract_al16_or_al8(pv, 4);
+        }
     }
 
     atmax = required_atomicity(env, pi, memop);
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 617f821613..681dfa077c 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -9,7 +9,7 @@ AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64
 VPATH 		+= $(AARCH64_SRC)
 
 # Base architecture tests
-AARCH64_TESTS=fcvt pcalign-a64
+AARCH64_TESTS=fcvt pcalign-a64 lse2-fault
 
 fcvt: LDFLAGS+=-lm
 
diff --git a/tests/tcg/aarch64/lse2-fault.c b/tests/tcg/aarch64/lse2-fault.c
new file mode 100644
index 0000000000..2187219a08
--- /dev/null
+++ b/tests/tcg/aarch64/lse2-fault.c
@@ -0,0 +1,38 @@
+#include <sys/mman.h>
+#include <sys/shm.h>
+#include <unistd.h>
+#include <stdio.h>
+
+int main()
+{
+    int psize = getpagesize();
+    int id;
+    void *p;
+
+    /*
+     * We need a shared mapping to enter CF_PARALLEL mode.
+     * The easiest way to get that is shmat.
+     */
+    id = shmget(IPC_PRIVATE, 2 * psize, IPC_CREAT | 0600);
+    if (id < 0) {
+        perror("shmget");
+        return 2;
+    }
+    p = shmat(id, NULL, 0);
+    if (p == MAP_FAILED) {
+        perror("shmat");
+        return 2;
+    }
+
+    /* Protect the second page. */
+    if (mprotect(p + psize, psize, PROT_NONE) < 0) {
+        perror("mprotect");
+        return 2;
+    }
+
+    /*
+     * Load 4 bytes, 6 bytes from the end of the page.
+     * On success this will load 0 from the newly allocated shm.
+     */
+    return *(int *)(p + psize - 6);
+}

From dad1036f43b55c68eb76e73ef771b252ec764b14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Aug 2023 16:36:38 +0100
Subject: [PATCH 1108/1353] tests/tcg: ensure system-mode gdb tests start
 stopped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without -S we run into potential races with tests starting before the
gdbstub attaches. We don't need to worry about user-mode as enabling
the gdbstub implies we wait for the initial connection.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230810153640.1879717-7-alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/guest-debug/run-test.py | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/tests/guest-debug/run-test.py b/tests/guest-debug/run-test.py
index de6106a5e5..a032e01f79 100755
--- a/tests/guest-debug/run-test.py
+++ b/tests/guest-debug/run-test.py
@@ -69,13 +69,10 @@ if __name__ == '__main__':
 
     # Launch QEMU with binary
     if "system" in args.qemu:
-        cmd = "%s %s %s -gdb unix:path=%s,server=on" % (args.qemu,
-                                                        args.qargs,
-                                                        args.binary,
-                                                        socket_name)
+        cmd = f'{args.qemu} {args.qargs} {args.binary}' \
+            f' -S -gdb unix:path={socket_name},server=on'
     else:
-        cmd = "%s %s -g %s %s" % (args.qemu, args.qargs, socket_name,
-                                  args.binary)
+        cmd = f'{args.qemu} {args.qargs} -g {socket_name} {args.binary}'
 
     log(output, "QEMU CMD: %s" % (cmd))
     inferior = subprocess.Popen(shlex.split(cmd))

From 3869eb7eee6f6c00d51e8ce8fd71a769f3e0bf3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Aug 2023 16:36:39 +0100
Subject: [PATCH 1109/1353] gdbstub: more fixes for client Ctrl-C handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The original fix caused problems with spurious characters on other
system emulation. So:

  - instead of spamming output make the warning a trace point
  - ensure we only allow a stop reply if it was 0x3

Suggested-by: Matheus Tavares Bernardino <quic_mathbern@quicinc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <456ed3318421dd7946bdfb5ceda7e05332da368c.1690910333.git.quic_mathbern@quicinc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230810153640.1879717-8-alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 gdbstub/gdbstub.c    | 5 +++--
 gdbstub/trace-events | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index e74ecc78cc..20b6fe03fb 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -2059,9 +2059,10 @@ void gdb_read_byte(uint8_t ch)
          * here, but it does expect a stop reply.
          */
         if (ch != 0x03) {
-            warn_report("gdbstub: client sent packet while target running\n");
+            trace_gdbstub_err_unexpected_runpkt(ch);
+        } else {
+            gdbserver_state.allow_stop_reply = true;
         }
-        gdbserver_state.allow_stop_reply = true;
         vm_stop(RUN_STATE_PAUSED);
     } else
 #endif
diff --git a/gdbstub/trace-events b/gdbstub/trace-events
index 0c18a4d70a..7bc79a73c4 100644
--- a/gdbstub/trace-events
+++ b/gdbstub/trace-events
@@ -26,6 +26,7 @@ gdbstub_err_invalid_repeat(uint8_t ch) "got invalid RLE count: 0x%02x"
 gdbstub_err_invalid_rle(void) "got invalid RLE sequence"
 gdbstub_err_checksum_invalid(uint8_t ch) "got invalid command checksum digit: 0x%02x"
 gdbstub_err_checksum_incorrect(uint8_t expected, uint8_t got) "got command packet with incorrect checksum, expected=0x%02x, received=0x%02x"
+gdbstub_err_unexpected_runpkt(uint8_t ch) "unexpected packet (0x%02x) while target running"
 
 # softmmu.c
 gdbstub_hit_watchpoint(const char *type, int cpu_gdb_index, uint64_t vaddr) "Watchpoint hit, type=\"%s\" cpu=%d, vaddr=0x%" PRIx64 ""

From f1b0f894c8c25f7ed24197ff130c7acb6b9fd6e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 10 Aug 2023 16:36:40 +0100
Subject: [PATCH 1110/1353] gdbstub: don't complain about preemptive ACK chars
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When starting a remote connection GDB sends an '+':

  /* Ack any packet which the remote side has already sent.  */
  remote_serial_write ("+", 1);

which gets flagged as a garbage character in the gdbstub state
machine. As gdb does send it out lets be permissive about the handling
so we can better see real issues.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Cc: gdb-patches@sourceware.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230810153640.1879717-9-alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 gdbstub/gdbstub.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 20b6fe03fb..5f28d5cf57 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -2074,6 +2074,11 @@ void gdb_read_byte(uint8_t ch)
                 gdbserver_state.line_buf_index = 0;
                 gdbserver_state.line_sum = 0;
                 gdbserver_state.state = RS_GETLINE;
+            } else if (ch == '+') {
+                /*
+                 * do nothing, gdb may preemptively send out ACKs on
+                 * initial connection
+                 */
             } else {
                 trace_gdbstub_err_garbage(ch);
             }

From 3944e93af06f06eb07316e0bef46b007573e0309 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 10 Aug 2023 12:49:56 -0700
Subject: [PATCH 1111/1353] Update version for v8.1.0-rc3 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 66ab90161b..eb3e782582 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.92
+8.0.93

From 3d449bc6030904ead784a4e4644c9640c2152796 Mon Sep 17 00:00:00 2001
From: Jason Chien <jason.chien@sifive.com>
Date: Wed, 9 Aug 2023 10:22:50 +0000
Subject: [PATCH 1112/1353] hw/pci-host: Allow extended config space access for
 Designware PCIe host

In pcie_bus_realize(), a root bus is realized as a PCIe bus and a non-root
bus is realized as a PCIe bus if its parent bus is a PCIe bus. However,
the child bus "dw-pcie" is realized before the parent bus "pcie" which is
the root PCIe bus. Thus, the extended configuration space is not accessible
on "dw-pcie". The issue can be resolved by adding the
PCI_BUS_EXTENDED_CONFIG_SPACE flag to "pcie" before "dw-pcie" is realized.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Message-Id: <20230809102257.25121-1-jason.chien@sifive.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Jason Chien &lt;<a href="mailto:jason.chien@sifive.com" target="_blank">jason.chien@sifive.com</a>&gt;<br>
---
 hw/pci-host/designware.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index 9e183caa48..388d252ee2 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -694,6 +694,7 @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
                                      &s->pci.io,
                                      0, 4,
                                      TYPE_PCIE_BUS);
+    pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
 
     memory_region_init(&s->pci.address_space_root,
                        OBJECT(s),

From 0f936247e8ed0ab5fb7e75827dd8c8f73d5ef4b5 Mon Sep 17 00:00:00 2001
From: Guoyi Tu <tugy@chinatelecom.cn>
Date: Fri, 11 Aug 2023 22:46:51 +0800
Subject: [PATCH 1113/1353] pci: Fix the update of interrupt disable bit in
 PCI_COMMAND register

The PCI_COMMAND register is located at offset 4 within
the PCI configuration space and occupies 2 bytes. The
interrupt disable bit is at the 10th bit, which corresponds
to the byte at offset 5 in the PCI configuration space.

In our testing environment, the guest driver may directly
updates the byte at offset 5 in the PCI configuration space.
The backtrace looks like as following:
    at hw/pci/pci.c:1442
    at hw/virtio/virtio-pci.c:605
    val=5, len=1) at hw/pci/pci_host.c:81

In this situation, the range_covers_byte function called
by the pci_default_write_config function will return false,
resulting in the inability to handle the interrupt disable
update event.

To fix this issue, we can use the ranges_overlap function
instead of range_covers_byte to determine whether the interrupt
bit has been updated.

Signed-off-by: Guoyi Tu <tugy@chinatelecom.cn>
Signed-off-by: yuanminghao <yuanmh12@chinatelecom.cn>
Message-Id: <ce2d0437-8faa-4d61-b536-4668f645a959@chinatelecom.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: b6981cb57be5 ("pci: interrupt disable bit support")
---
 hw/pci/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index b8d22e2e74..881d774fb6 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1613,7 +1613,7 @@ void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int
         range_covers_byte(addr, l, PCI_COMMAND))
         pci_update_mappings(d);
 
-    if (range_covers_byte(addr, l, PCI_COMMAND)) {
+    if (ranges_overlap(addr, l, PCI_COMMAND, 2)) {
         pci_update_irq_disabled(d, was_irq_disabled);
         memory_region_set_enabled(&d->bus_master_enable_region,
                                   (pci_get_word(d->config + PCI_COMMAND)

From 136cb9cc03154615609d454db40e0b3dfbb4bbf3 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 2 Aug 2023 15:00:58 -0300
Subject: [PATCH 1114/1353] target/riscv/kvm.c: fix mvendorid size in
 vcpu_set_machine_ids()

cpu->cfg.mvendorid is a 32 bit field and kvm_set_one_reg() always write
a target_ulong val, i.e. a 64 bit field in a 64 bit host.

Given that we're passing a pointer to the mvendorid field, the reg is
reading 64 bits starting from mvendorid and going 32 bits in the next
field, marchid. Here's an example:

$ ./qemu-system-riscv64 -machine virt,accel=kvm -m 2G -smp 1 \
   -cpu rv64,marchid=0xab,mvendorid=0xcd,mimpid=0xef(...)

(inside the guest)
 # cat /proc/cpuinfo
processor	: 0
hart		: 0
isa		: rv64imafdc_zicbom_zicboz_zihintpause_zbb_sstc
mmu		: sv57
mvendorid	: 0xab000000cd
marchid		: 0xab
mimpid		: 0xef

'mvendorid' was written as a combination of 0xab (the value from the
adjacent field, marchid) and its intended value 0xcd.

Fix it by assigning cpu->cfg.mvendorid to a target_ulong var 'reg' and
use it as input for kvm_set_one_reg(). Here's the result with this patch
applied and using the same QEMU command line:

 # cat /proc/cpuinfo
processor	: 0
hart		: 0
isa		: rv64imafdc_zicbom_zicboz_zihintpause_zbb_sstc
mmu		: sv57
mvendorid	: 0xcd
marchid		: 0xab
mimpid		: 0xef

This bug affects only the generic (rv64) CPUs when running with KVM in a
64 bit env since the 'host' CPU does not allow the machine IDs to be
changed via command line.

Fixes: 1fb5a622f7 ("target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230802180058.281385-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index 9d8a8982f9..b1fd2233c0 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -852,12 +852,19 @@ void kvm_arch_init_irq_routing(KVMState *s)
 static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
+    target_ulong reg;
     uint64_t id;
     int ret;
 
     id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
                           KVM_REG_RISCV_CONFIG_REG(mvendorid));
-    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
+    /*
+     * cfg.mvendorid is an uint32 but a target_ulong will
+     * be written. Assign it to a target_ulong var to avoid
+     * writing pieces of other cpu->cfg fields in the reg.
+     */
+    reg = cpu->cfg.mvendorid;
+    ret = kvm_set_one_reg(cs, id, &reg);
     if (ret != 0) {
         return ret;
     }

From b274c2388e9fcde75d60c6e7c7d8f888874b61b7 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Fri, 11 Aug 2023 13:02:24 -0300
Subject: [PATCH 1115/1353] hw/riscv/virt.c: change 'aclint' TCG check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'aclint' property is being conditioned with tcg acceleration in
virt_machine_class_init(). But acceleration code starts later than the
class init of the board, meaning that tcg_enabled() will be always be
false during class_init(), and the option is never being declared even
when declaring TCG accel:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg,aclint=on
qemu-system-riscv64: Property 'virt-machine.aclint' not found

Fix it by moving the check from class_init() to machine_init(). Tune the
description to mention that the option is TCG only.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: c0716c81b ("hw/riscv/virt: Restrict ACLINT to TCG")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1823
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230811160224.440697-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index d90286dc46..99c4e6314b 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1350,6 +1350,11 @@ static void virt_machine_init(MachineState *machine)
         exit(1);
     }
 
+    if (!tcg_enabled() && s->have_aclint) {
+        error_report("'aclint' is only available with TCG acceleration");
+        exit(1);
+    }
+
     /* Initialize sockets */
     mmio_irqchip = virtio_irqchip = pcie_irqchip = NULL;
     for (i = 0; i < socket_count; i++) {
@@ -1683,13 +1688,14 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
 
-    if (tcg_enabled()) {
-        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
-                                       virt_set_aclint);
-        object_class_property_set_description(oc, "aclint",
-                                              "Set on/off to enable/disable "
-                                              "emulating ACLINT devices");
-    }
+
+    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
+                                   virt_set_aclint);
+    object_class_property_set_description(oc, "aclint",
+                                          "(TCG only) Set on/off to "
+                                          "enable/disable emulating "
+                                          "ACLINT devices");
+
     object_class_property_add_str(oc, "aia", virt_get_aia,
                                   virt_set_aia);
     object_class_property_set_description(oc, "aia",

From d3b41127c205062ca6c29c89c9542c4112c39ca0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 12 Aug 2023 08:48:18 -0700
Subject: [PATCH 1116/1353] tcg/i386: Output %gs prefix in tcg_out_vex_opc

Missing the segment prefix means that user-only fails
to add guest_base for some 128-bit load/store.

Fixes: 098d0fc10d2 ("tcg/i386: Support 128-bit load/store")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1763
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 77482da070..a6b2eae995 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -595,6 +595,9 @@ static void tcg_out_vex_opc(TCGContext *s, int opc, int r, int v,
 {
     int tmp;
 
+    if (opc & P_GS) {
+        tcg_out8(s, 0x65);
+    }
     /* Use the two byte form if possible, which cannot encode
        VEX.W, VEX.B, VEX.X, or an m-mmmm field other than P_EXT.  */
     if ((opc & (P_EXT | P_EXT38 | P_EXT3A | P_VEXW)) == P_EXT

From 0d52116fd82cdd1f4a88837336af5b6290c364a4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 15 Aug 2023 17:10:57 -0700
Subject: [PATCH 1117/1353] Update version for v8.1.0-rc4 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index eb3e782582..e834d89620 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.93
+8.0.94

From 7e5a8bb22368b3555644cb2debd3df24592f3a21 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 22 Aug 2023 07:13:44 -0700
Subject: [PATCH 1118/1353] Update version for v8.1.0 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index e834d89620..8104cabd36 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.94
+8.1.0

From b0dd9a7d6dd15a6898e9c585b521e6bec79b25aa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 22 Aug 2023 07:14:07 -0700
Subject: [PATCH 1119/1353] Open 8.2 development tree

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 8104cabd36..ae3313c92b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.1.0
+8.1.50

From 8d6b2f947d4d19b3ba22f836d203d6282107bc11 Mon Sep 17 00:00:00 2001
From: Chris Laplante <chris@laplante.io>
Date: Tue, 22 Aug 2023 17:24:15 +0100
Subject: [PATCH 1120/1353] hw/gpio/nrf51: implement DETECT signal

Implement nRF51 DETECT signal in the GPIO peripheral.

The reference manual makes mention of a per-pin DETECT signal, but these
are not exposed to the user. See https://devzone.nordicsemi.com/f/nordic-q-a/39858/gpio-per-pin-detect-signal-available
for more information. Currently, I don't see a reason to model these.

Signed-off-by: Chris Laplante <chris@laplante.io>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230728160324.1159090-2-chris@laplante.io
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/nrf51_gpio.c         | 14 +++++++++++++-
 include/hw/gpio/nrf51_gpio.h |  1 +
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/gpio/nrf51_gpio.c b/hw/gpio/nrf51_gpio.c
index b47fddf4ed..08396c69a4 100644
--- a/hw/gpio/nrf51_gpio.c
+++ b/hw/gpio/nrf51_gpio.c
@@ -78,6 +78,7 @@ static void update_state(NRF51GPIOState *s)
     int pull;
     size_t i;
     bool connected_out, dir, connected_in, out, in, input;
+    bool assert_detect = false;
 
     for (i = 0; i < NRF51_GPIO_PINS; i++) {
         pull = pull_value(s->cnf[i]);
@@ -99,7 +100,15 @@ static void update_state(NRF51GPIOState *s)
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "GPIO pin %zu short circuited\n", i);
             }
-            if (!connected_in) {
+            if (connected_in) {
+                uint32_t detect_config = extract32(s->cnf[i], 16, 2);
+                if ((detect_config == 2) && (in == 1)) {
+                    assert_detect = true;
+                }
+                if ((detect_config == 3) && (in == 0)) {
+                    assert_detect = true;
+                }
+            } else {
                 /*
                  * Floating input: the output stimulates IN if connected,
                  * otherwise pull-up/pull-down resistors put a value on both
@@ -116,6 +125,8 @@ static void update_state(NRF51GPIOState *s)
         }
         update_output_irq(s, i, connected_out, out);
     }
+
+    qemu_set_irq(s->detect, assert_detect);
 }
 
 /*
@@ -291,6 +302,7 @@ static void nrf51_gpio_init(Object *obj)
 
     qdev_init_gpio_in(DEVICE(s), nrf51_gpio_set, NRF51_GPIO_PINS);
     qdev_init_gpio_out(DEVICE(s), s->output, NRF51_GPIO_PINS);
+    qdev_init_gpio_out_named(DEVICE(s), &s->detect, "detect", 1);
 }
 
 static void nrf51_gpio_class_init(ObjectClass *klass, void *data)
diff --git a/include/hw/gpio/nrf51_gpio.h b/include/hw/gpio/nrf51_gpio.h
index 8f9c2f86da..fcfa2bac17 100644
--- a/include/hw/gpio/nrf51_gpio.h
+++ b/include/hw/gpio/nrf51_gpio.h
@@ -64,6 +64,7 @@ struct NRF51GPIOState {
     uint32_t old_out_connected;
 
     qemu_irq output[NRF51_GPIO_PINS];
+    qemu_irq detect;
 };
 
 

From 7458dcf4e64249af961243cb1619858a242ec15e Mon Sep 17 00:00:00 2001
From: Chris Laplante <chris@laplante.io>
Date: Tue, 22 Aug 2023 17:31:00 +0100
Subject: [PATCH 1121/1353] qtest: factor out qtest_install_gpio_out_intercept

Signed-off-by: Chris Laplante <chris@laplante.io>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230728160324.1159090-3-chris@laplante.io
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 softmmu/qtest.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index f8d764b719..1b86489162 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -365,6 +365,15 @@ void qtest_set_command_cb(bool (*pc_cb)(CharBackend *chr, gchar **words))
     process_command_cb = pc_cb;
 }
 
+static void qtest_install_gpio_out_intercept(DeviceState *dev, const char *name, int n)
+{
+    qemu_irq *disconnected = g_new0(qemu_irq, 1);
+    qemu_irq icpt = qemu_allocate_irq(qtest_irq_handler,
+                                      disconnected, n);
+
+    *disconnected = qdev_intercept_gpio_out(dev, icpt, name, n);
+}
+
 static void qtest_process_command(CharBackend *chr, gchar **words)
 {
     const gchar *command;
@@ -415,12 +424,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
             if (words[0][14] == 'o') {
                 int i;
                 for (i = 0; i < ngl->num_out; ++i) {
-                    qemu_irq *disconnected = g_new0(qemu_irq, 1);
-                    qemu_irq icpt = qemu_allocate_irq(qtest_irq_handler,
-                                                      disconnected, i);
-
-                    *disconnected = qdev_intercept_gpio_out(dev, icpt,
-                                                            ngl->name, i);
+                    qtest_install_gpio_out_intercept(dev, ngl->name, i);
                 }
             } else {
                 qemu_irq_intercept_in(ngl->in, qtest_irq_handler,

From a8610f8bd7465a9c30c206074d47dd3f387b5b9a Mon Sep 17 00:00:00 2001
From: Chris Laplante <chris@laplante.io>
Date: Tue, 22 Aug 2023 17:31:00 +0100
Subject: [PATCH 1122/1353] qtest: implement named interception of out-GPIO

Adds qtest_irq_intercept_out_named method, which utilizes a new optional
name parameter to the irq_intercept_out qtest command.

Signed-off-by: Chris Laplante <chris@laplante.io>
Message-id: 20230728160324.1159090-4-chris@laplante.io
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 softmmu/qtest.c        | 18 ++++++++++--------
 tests/qtest/libqtest.c |  6 ++++++
 tests/qtest/libqtest.h | 11 +++++++++++
 3 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index 1b86489162..0f1d478bda 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -397,8 +397,10 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         || strcmp(words[0], "irq_intercept_in") == 0) {
         DeviceState *dev;
         NamedGPIOList *ngl;
+        bool is_outbound;
 
         g_assert(words[1]);
+        is_outbound = words[0][14] == 'o';
         dev = DEVICE(object_resolve_path(words[1], NULL));
         if (!dev) {
             qtest_send_prefix(chr);
@@ -417,14 +419,14 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         }
 
         QLIST_FOREACH(ngl, &dev->gpios, node) {
-            /* We don't support intercept of named GPIOs yet */
-            if (ngl->name) {
-                continue;
-            }
-            if (words[0][14] == 'o') {
-                int i;
-                for (i = 0; i < ngl->num_out; ++i) {
-                    qtest_install_gpio_out_intercept(dev, ngl->name, i);
+            /* We don't support inbound interception of named GPIOs yet */
+            if (is_outbound) {
+                /* NULL is valid and matchable, for "unnamed GPIO" */
+                if (g_strcmp0(ngl->name, words[2]) == 0) {
+                    int i;
+                    for (i = 0; i < ngl->num_out; ++i) {
+                        qtest_install_gpio_out_intercept(dev, ngl->name, i);
+                    }
                 }
             } else {
                 qemu_irq_intercept_in(ngl->in, qtest_irq_handler,
diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index c22dfc30d3..471529e6cc 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -993,6 +993,12 @@ void qtest_irq_intercept_out(QTestState *s, const char *qom_path)
     qtest_rsp(s);
 }
 
+void qtest_irq_intercept_out_named(QTestState *s, const char *qom_path, const char *name)
+{
+    qtest_sendf(s, "irq_intercept_out %s %s\n", qom_path, name);
+    qtest_rsp(s);
+}
+
 void qtest_irq_intercept_in(QTestState *s, const char *qom_path)
 {
     qtest_sendf(s, "irq_intercept_in %s\n", qom_path);
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index 3a71bc45fc..e53e350e3a 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -371,6 +371,17 @@ void qtest_irq_intercept_in(QTestState *s, const char *string);
  */
 void qtest_irq_intercept_out(QTestState *s, const char *string);
 
+/**
+ * qtest_irq_intercept_out_named:
+ * @s: #QTestState instance to operate on.
+ * @qom_path: QOM path of a device.
+ * @name: Name of the GPIO out pin
+ *
+ * Associate a qtest irq with the named GPIO-out pin of the device
+ * whose path is specified by @string and whose name is @name.
+ */
+void qtest_irq_intercept_out_named(QTestState *s, const char *qom_path, const char *name);
+
 /**
  * qtest_set_irq_in:
  * @s: QTestState instance to operate on.

From fe692f7c8c477dd794a45b18148e248c3c327931 Mon Sep 17 00:00:00 2001
From: Chris Laplante <chris@laplante.io>
Date: Tue, 22 Aug 2023 17:31:01 +0100
Subject: [PATCH 1123/1353] qtest: bail from irq_intercept_in if name is
 specified

Named interception of in-GPIOs is not supported yet.

Signed-off-by: Chris Laplante <chris@laplante.io>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230728160324.1159090-5-chris@laplante.io
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 softmmu/qtest.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index 0f1d478bda..66757ba261 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -397,9 +397,11 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         || strcmp(words[0], "irq_intercept_in") == 0) {
         DeviceState *dev;
         NamedGPIOList *ngl;
+        bool is_named;
         bool is_outbound;
 
         g_assert(words[1]);
+        is_named = words[2] != NULL;
         is_outbound = words[0][14] == 'o';
         dev = DEVICE(object_resolve_path(words[1], NULL));
         if (!dev) {
@@ -408,6 +410,12 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
             return;
         }
 
+        if (is_named && !is_outbound) {
+            qtest_send_prefix(chr);
+            qtest_send(chr, "FAIL Interception of named in-GPIOs not yet supported\n");
+            return;
+        }
+
         if (irq_intercept_dev) {
             qtest_send_prefix(chr);
             if (irq_intercept_dev != dev) {

From c7bb6fa6afb427f9538bf2f95ea55e8a1ce8da60 Mon Sep 17 00:00:00 2001
From: Chris Laplante <chris@laplante.io>
Date: Tue, 22 Aug 2023 17:31:01 +0100
Subject: [PATCH 1124/1353] qtest: irq_intercept_[out/in]: return FAIL if no
 intercepts are installed

This is much better than just silently failing with OK.

Signed-off-by: Chris Laplante <chris@laplante.io>
Message-id: 20230728160324.1159090-6-chris@laplante.io
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 softmmu/qtest.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/softmmu/qtest.c b/softmmu/qtest.c
index 66757ba261..35b643a274 100644
--- a/softmmu/qtest.c
+++ b/softmmu/qtest.c
@@ -399,6 +399,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
         NamedGPIOList *ngl;
         bool is_named;
         bool is_outbound;
+        bool interception_succeeded = false;
 
         g_assert(words[1]);
         is_named = words[2] != NULL;
@@ -435,15 +436,22 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
                     for (i = 0; i < ngl->num_out; ++i) {
                         qtest_install_gpio_out_intercept(dev, ngl->name, i);
                     }
+                    interception_succeeded = true;
                 }
             } else {
                 qemu_irq_intercept_in(ngl->in, qtest_irq_handler,
                                       ngl->num_in);
+                interception_succeeded = true;
             }
         }
-        irq_intercept_dev = dev;
+
         qtest_send_prefix(chr);
-        qtest_send(chr, "OK\n");
+        if (interception_succeeded) {
+            irq_intercept_dev = dev;
+            qtest_send(chr, "OK\n");
+        } else {
+            qtest_send(chr, "FAIL No intercepts installed\n");
+        }
     } else if (strcmp(words[0], "set_irq_in") == 0) {
         DeviceState *dev;
         qemu_irq irq;

From a9c9bbee855877293683012942d3485d50f286af Mon Sep 17 00:00:00 2001
From: Chris Laplante <chris@laplante.io>
Date: Tue, 22 Aug 2023 17:31:02 +0100
Subject: [PATCH 1125/1353] qtest: microbit-test: add tests for nRF51 DETECT

Exercise the DETECT mechanism of the GPIO peripheral.

Signed-off-by: Chris Laplante <chris@laplante.io>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230728160324.1159090-7-chris@laplante.io
[PMM: fixed coding style nits]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/microbit-test.c | 44 +++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/tests/qtest/microbit-test.c b/tests/qtest/microbit-test.c
index 6022a92b6a..2abcad8e31 100644
--- a/tests/qtest/microbit-test.c
+++ b/tests/qtest/microbit-test.c
@@ -393,6 +393,49 @@ static void test_nrf51_gpio(void)
     qtest_quit(qts);
 }
 
+static void test_nrf51_gpio_detect(void)
+{
+    QTestState *qts = qtest_init("-M microbit");
+    int i;
+
+    /* Connect input buffer on pins 1-7, configure SENSE for high level */
+    for (i = 1; i <= 7; i++) {
+        qtest_writel(qts, NRF51_GPIO_BASE + NRF51_GPIO_REG_CNF_START + i * 4,
+                     deposit32(0, 16, 2, 2));
+    }
+
+    qtest_irq_intercept_out_named(qts, "/machine/nrf51/gpio", "detect");
+
+    for (i = 1; i <= 7; i++) {
+        /* Set pin high */
+        qtest_set_irq_in(qts, "/machine/nrf51", "unnamed-gpio-in", i, 1);
+        uint32_t actual = qtest_readl(qts, NRF51_GPIO_BASE + NRF51_GPIO_REG_IN);
+        g_assert_cmpuint(actual, ==, 1 << i);
+
+        /* Check that DETECT is high */
+        g_assert_true(qtest_get_irq(qts, 0));
+
+        /* Set pin low, check that DETECT goes low. */
+        qtest_set_irq_in(qts, "/machine/nrf51", "unnamed-gpio-in", i, 0);
+        actual = qtest_readl(qts, NRF51_GPIO_BASE + NRF51_GPIO_REG_IN);
+        g_assert_cmpuint(actual, ==, 0x0);
+        g_assert_false(qtest_get_irq(qts, 0));
+    }
+
+    /* Set pin 0 high, check that DETECT doesn't fire */
+    qtest_set_irq_in(qts, "/machine/nrf51", "unnamed-gpio-in", 0, 1);
+    g_assert_false(qtest_get_irq(qts, 0));
+    qtest_set_irq_in(qts, "/machine/nrf51", "unnamed-gpio-in", 0, 0);
+
+    /* Set pins 1, 2, and 3 high, then set 3 low. Check DETECT is still high */
+    for (i = 1; i <= 3; i++) {
+        qtest_set_irq_in(qts, "/machine/nrf51", "unnamed-gpio-in", i, 1);
+    }
+    g_assert_true(qtest_get_irq(qts, 0));
+    qtest_set_irq_in(qts, "/machine/nrf51", "unnamed-gpio-in", 3, 0);
+    g_assert_true(qtest_get_irq(qts, 0));
+}
+
 static void timer_task(QTestState *qts, hwaddr task)
 {
     qtest_writel(qts, NRF51_TIMER_BASE + task, NRF51_TRIGGER_TASK);
@@ -499,6 +542,7 @@ int main(int argc, char **argv)
 
     qtest_add_func("/microbit/nrf51/uart", test_nrf51_uart);
     qtest_add_func("/microbit/nrf51/gpio", test_nrf51_gpio);
+    qtest_add_func("/microbit/nrf51/gpio_detect", test_nrf51_gpio_detect);
     qtest_add_func("/microbit/nrf51/nvmc", test_nrf51_nvmc);
     qtest_add_func("/microbit/nrf51/timer", test_nrf51_timer);
     qtest_add_func("/microbit/microbit/i2c", test_microbit_i2c);

From 5e0d65909c6f335d578b90491e165440c99adf81 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 22 Aug 2023 17:31:02 +0100
Subject: [PATCH 1126/1353] kvm: Introduce kvm_arch_get_default_type hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kvm_arch_get_default_type() returns the default KVM type. This hook is
particularly useful to derive a KVM type that is valid for "none"
machine model, which is used by libvirt to probe the availability of
KVM.

For MIPS, the existing mips_kvm_type() is reused. This function ensures
the availability of VZ which is mandatory to use KVM on the current
QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230727073134.134102-2-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added doc comment for new function]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/kvm/kvm-all.c      | 4 +++-
 hw/mips/loongson3_virt.c | 2 --
 include/sysemu/kvm.h     | 2 ++
 target/arm/kvm.c         | 5 +++++
 target/i386/kvm/kvm.c    | 5 +++++
 target/mips/kvm.c        | 2 +-
 target/mips/kvm_mips.h   | 9 ---------
 target/ppc/kvm.c         | 5 +++++
 target/riscv/kvm.c       | 5 +++++
 target/s390x/kvm/kvm.c   | 5 +++++
 10 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 7b3da8dc3a..b472301637 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2458,7 +2458,7 @@ static int kvm_init(MachineState *ms)
     KVMState *s;
     const KVMCapabilityInfo *missing_cap;
     int ret;
-    int type = 0;
+    int type;
     uint64_t dirty_log_manual_caps;
 
     qemu_mutex_init(&kml_slots_lock);
@@ -2523,6 +2523,8 @@ static int kvm_init(MachineState *ms)
         type = mc->kvm_type(ms, kvm_type);
     } else if (mc->kvm_type) {
         type = mc->kvm_type(ms, NULL);
+    } else {
+        type = kvm_arch_get_default_type(ms);
     }
 
     do {
diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index 3ad0a223df..b74b358874 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -29,7 +29,6 @@
 #include "qemu/datadir.h"
 #include "qapi/error.h"
 #include "elf.h"
-#include "kvm_mips.h"
 #include "hw/char/serial.h"
 #include "hw/intc/loongson_liointc.h"
 #include "hw/mips/mips.h"
@@ -612,7 +611,6 @@ static void loongson3v_machine_class_init(ObjectClass *oc, void *data)
     mc->max_cpus = LOONGSON_MAX_VCPUS;
     mc->default_ram_id = "loongson3.highram";
     mc->default_ram_size = 1600 * MiB;
-    mc->kvm_type = mips_kvm_type;
     mc->minimum_page_bits = 14;
     mc->default_nic = "virtio-net-pci";
 }
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 115f0cca79..ccaf55caf7 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -369,6 +369,8 @@ int kvm_arch_get_registers(CPUState *cpu);
 
 int kvm_arch_put_registers(CPUState *cpu, int level);
 
+int kvm_arch_get_default_type(MachineState *ms);
+
 int kvm_arch_init(MachineState *ms, KVMState *s);
 
 int kvm_arch_init_vcpu(CPUState *cpu);
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index b4c7654f49..40f577bfd5 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -247,6 +247,11 @@ int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
     return ret > 0 ? ret : 40;
 }
 
+int kvm_arch_get_default_type(MachineState *ms)
+{
+    return 0;
+}
+
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
     int ret = 0;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index ebfaf3d24c..b45ce20fd8 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2556,6 +2556,11 @@ static void register_smram_listener(Notifier *n, void *unused)
                                  &smram_address_space, 1, "kvm-smram");
 }
 
+int kvm_arch_get_default_type(MachineState *ms)
+{
+    return 0;
+}
+
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
     uint64_t identity_base = 0xfffbc000;
diff --git a/target/mips/kvm.c b/target/mips/kvm.c
index c14e8f550f..e98aad01bd 100644
--- a/target/mips/kvm.c
+++ b/target/mips/kvm.c
@@ -1266,7 +1266,7 @@ int kvm_arch_msi_data_to_gsi(uint32_t data)
     abort();
 }
 
-int mips_kvm_type(MachineState *machine, const char *vm_type)
+int kvm_arch_get_default_type(MachineState *machine)
 {
 #if defined(KVM_CAP_MIPS_VZ)
     int r;
diff --git a/target/mips/kvm_mips.h b/target/mips/kvm_mips.h
index 171d53dbe1..c711269d0a 100644
--- a/target/mips/kvm_mips.h
+++ b/target/mips/kvm_mips.h
@@ -25,13 +25,4 @@ void kvm_mips_reset_vcpu(MIPSCPU *cpu);
 int kvm_mips_set_interrupt(MIPSCPU *cpu, int irq, int level);
 int kvm_mips_set_ipi_interrupt(MIPSCPU *cpu, int irq, int level);
 
-#ifdef CONFIG_KVM
-int mips_kvm_type(MachineState *machine, const char *vm_type);
-#else
-static inline int mips_kvm_type(MachineState *machine, const char *vm_type)
-{
-    return 0;
-}
-#endif
-
 #endif /* KVM_MIPS_H */
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index a8a935e267..dc1182cd37 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -108,6 +108,11 @@ static int kvm_ppc_register_host_cpu_type(void);
 static void kvmppc_get_cpu_characteristics(KVMState *s);
 static int kvmppc_get_dec_bits(void);
 
+int kvm_arch_get_default_type(MachineState *ms)
+{
+    return 0;
+}
+
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
     cap_interrupt_unset = kvm_check_extension(s, KVM_CAP_PPC_UNSET_IRQ);
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index b1fd2233c0..dbcf26f27d 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -914,6 +914,11 @@ int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
     return 0;
 }
 
+int kvm_arch_get_default_type(MachineState *ms)
+{
+    return 0;
+}
+
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
     return 0;
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index a9e5880349..9117fab6e8 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -340,6 +340,11 @@ static void ccw_machine_class_foreach(ObjectClass *oc, void *opaque)
     mc->default_cpu_type = S390_CPU_TYPE_NAME("host");
 }
 
+int kvm_arch_get_default_type(MachineState *ms)
+{
+    return 0;
+}
+
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
     object_class_foreach(ccw_machine_class_foreach, TYPE_S390_CCW_MACHINE,

From 1ab445af8cd99343f29032b5944023ad7d8edebf Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 22 Aug 2023 17:31:02 +0100
Subject: [PATCH 1127/1353] accel/kvm: Specify default IPA size for arm64

Before this change, the default KVM type, which is used for non-virt
machine models, was 0.

The kernel documentation says:
> On arm64, the physical address size for a VM (IPA Size limit) is
> limited to 40bits by default. The limit can be configured if the host
> supports the extension KVM_CAP_ARM_VM_IPA_SIZE. When supported, use
> KVM_VM_TYPE_ARM_IPA_SIZE(IPA_Bits) to set the size in the machine type
> identifier, where IPA_Bits is the maximum width of any physical
> address used by the VM. The IPA_Bits is encoded in bits[7-0] of the
> machine type identifier.
>
> e.g, to configure a guest to use 48bit physical address size::
>
>     vm_fd = ioctl(dev_fd, KVM_CREATE_VM, KVM_VM_TYPE_ARM_IPA_SIZE(48));
>
> The requested size (IPA_Bits) must be:
>
>  ==   =========================================================
>   0   Implies default size, 40bits (for backward compatibility)
>   N   Implies N bits, where N is a positive integer such that,
>       32 <= N <= Host_IPA_Limit
>  ==   =========================================================

> Host_IPA_Limit is the maximum possible value for IPA_Bits on the host
> and is dependent on the CPU capability and the kernel configuration.
> The limit can be retrieved using KVM_CAP_ARM_VM_IPA_SIZE of the
> KVM_CHECK_EXTENSION ioctl() at run-time.
>
> Creation of the VM will fail if the requested IPA size (whether it is
> implicit or explicit) is unsupported on the host.
https://docs.kernel.org/virt/kvm/api.html#kvm-create-vm

So if Host_IPA_Limit < 40, specifying 0 as the type will fail. This
actually confused libvirt, which uses "none" machine model to probe the
KVM availability, on M2 MacBook Air.

Fix this by using Host_IPA_Limit as the default type when
KVM_CAP_ARM_VM_IPA_SIZE is available.

Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230727073134.134102-3-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 40f577bfd5..23aeb09949 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -249,7 +249,9 @@ int kvm_arm_get_max_vm_ipa_size(MachineState *ms, bool *fixed_ipa)
 
 int kvm_arch_get_default_type(MachineState *ms)
 {
-    return 0;
+    bool fixed_ipa;
+    int size = kvm_arm_get_max_vm_ipa_size(ms, &fixed_ipa);
+    return fixed_ipa ? 0 : size;
 }
 
 int kvm_arch_init(MachineState *ms, KVMState *s)

From 875b3eb88f7d09c0bd650b3d5f0e642d55f199bc Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 22 Aug 2023 17:31:03 +0100
Subject: [PATCH 1128/1353] mips: Report an error when KVM_VM_MIPS_VZ is
 unavailable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On MIPS, QEMU requires KVM_VM_MIPS_VZ type for KVM. Report an error in
such a case as other architectures do when an error occurred during KVM
type decision.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230727073134.134102-4-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/kvm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/mips/kvm.c b/target/mips/kvm.c
index e98aad01bd..e22e24ed97 100644
--- a/target/mips/kvm.c
+++ b/target/mips/kvm.c
@@ -1278,6 +1278,7 @@ int kvm_arch_get_default_type(MachineState *machine)
     }
 #endif
 
+    error_report("KVM_VM_MIPS_VZ type is not available");
     return -1;
 }
 

From bc3e41a0e8a3c932733dd363dfcfb38bf167b707 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 22 Aug 2023 17:31:03 +0100
Subject: [PATCH 1129/1353] accel/kvm: Use negative KVM type for error
 propagation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On MIPS, kvm_arch_get_default_type() returns a negative value when an
error occurred so handle the case. Also, let other machines return
negative values when errors occur and declare returning a negative
value as the correct way to propagate an error that happened when
determining KVM type.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230727073134.134102-5-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 5 +++++
 hw/arm/virt.c       | 2 +-
 hw/ppc/spapr.c      | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index b472301637..3bac5aa678 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2527,6 +2527,11 @@ static int kvm_init(MachineState *ms)
         type = kvm_arch_get_default_type(ms);
     }
 
+    if (type < 0) {
+        ret = -EINVAL;
+        goto err;
+    }
+
     do {
         ret = kvm_ioctl(s, KVM_CREATE_VM, type);
     } while (ret == -EINTR);
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 7d9dbc2663..83c05f1b9f 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2913,7 +2913,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
                      "require an IPA range (%d bits) larger than "
                      "the one supported by the host (%d bits)",
                      requested_pa_size, max_vm_pa_size);
-        exit(1);
+        return -1;
     }
     /*
      * We return the requested PA log size, unless KVM only supports
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 1c8b8d57a7..e851f60919 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -3105,7 +3105,7 @@ static int spapr_kvm_type(MachineState *machine, const char *vm_type)
     }
 
     error_report("Unknown kvm-type specified '%s'", vm_type);
-    exit(1);
+    return -1;
 }
 
 /*

From 4625742cd2aeb1400407889a2f7a5b4c75437818 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 22 Aug 2023 17:31:04 +0100
Subject: [PATCH 1130/1353] accel/kvm: Free as when an error occurred

An error may occur after s->as is allocated, for example if the
KVM_CREATE_VM ioctl call fails.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230727073134.134102-6-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/kvm/kvm-all.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 3bac5aa678..ed30f4135b 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2765,6 +2765,7 @@ err:
     if (s->fd != -1) {
         close(s->fd);
     }
+    g_free(s->as);
     g_free(s->memory_listener.slots);
 
     return ret;

From 43a5e377f42d1d3ed12ea562196f723b354ce411 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <akihiko.odaki@daynix.com>
Date: Tue, 22 Aug 2023 17:31:04 +0100
Subject: [PATCH 1131/1353] accel/kvm: Make kvm_dirty_ring_reaper_init() void
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The returned value was always zero and had no meaning.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-id: 20230727073134.134102-7-akihiko.odaki@daynix.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index ed30f4135b..d07f1ecbd3 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -1454,15 +1454,13 @@ static void *kvm_dirty_ring_reaper_thread(void *data)
     return NULL;
 }
 
-static int kvm_dirty_ring_reaper_init(KVMState *s)
+static void kvm_dirty_ring_reaper_init(KVMState *s)
 {
     struct KVMDirtyRingReaper *r = &s->reaper;
 
     qemu_thread_create(&r->reaper_thr, "kvm-reaper",
                        kvm_dirty_ring_reaper_thread,
                        s, QEMU_THREAD_JOINABLE);
-
-    return 0;
 }
 
 static int kvm_dirty_ring_init(KVMState *s)
@@ -2744,10 +2742,7 @@ static int kvm_init(MachineState *ms)
     }
 
     if (s->kvm_dirty_ring_size) {
-        ret = kvm_dirty_ring_reaper_init(s);
-        if (ret) {
-            goto err;
-        }
+        kvm_dirty_ring_reaper_init(s);
     }
 
     if (kvm_check_extension(kvm_state, KVM_CAP_BINARY_STATS_FD)) {

From c986d860398ff44c32a612b3d8dfc9f89ffe5e52 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:05 +0100
Subject: [PATCH 1132/1353] target/arm/ptw: Don't set fi->s1ptw for
 UnsuppAtomicUpdate fault

For an Unsupported Atomic Update fault where the stage 1 translation
table descriptor update can't be done because it's to an unsupported
memory type, this is a stage 1 abort (per the Arm ARM R_VSXXT).  This
means we should not set fi->s1ptw, because this will cause the code
in the get_phys_addr_lpae() error-exit path to mark it as stage 2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-2-peter.maydell@linaro.org
---
 target/arm/ptw.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 8f94100c61..bafeb876ad 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -701,7 +701,6 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
 
     if (unlikely(!host)) {
         fi->type = ARMFault_UnsuppAtomicUpdate;
-        fi->s1ptw = true;
         return 0;
     }
 

From f6415660746fcf58d6baf8dd8da77cb08adb9970 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:05 +0100
Subject: [PATCH 1133/1353] target/arm/ptw: Don't report GPC faults on stage 1
 ptw as stage2 faults

In S1_ptw_translate() we set up the ARMMMUFaultInfo if the attempt to
translate the page descriptor address into a physical address fails.
This used to only be possible if we are doing a stage 2 ptw for that
descriptor address, and so the code always sets fi->stage2 and
fi->s1ptw to true.  However, with FEAT_RME it is also possible for
the lookup of the page descriptor address to fail because of a
Granule Protection Check fault.  These should not be reported as
stage 2, otherwise arm_deliver_fault() will incorrectly set
HPFAR_EL2.  Similarly the s1ptw bit should only be set for stage 2
faults on stage 1 translation table walks, i.e.  not for GPC faults.

Add a comment to the the other place where we might detect a
stage2-fault-on-stage-1-ptw, in arm_casq_ptw(), noting why we know in
that case that it must really be a stage 2 fault and not a GPC fault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-3-peter.maydell@linaro.org
---
 target/arm/ptw.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index bafeb876ad..eb57ebd897 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -600,8 +600,8 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         fi->type = ARMFault_GPCFOnWalk;
     }
     fi->s2addr = addr;
-    fi->stage2 = true;
-    fi->s1ptw = true;
+    fi->stage2 = regime_is_stage2(s2_mmu_idx);
+    fi->s1ptw = fi->stage2;
     fi->s1ns = !is_secure;
     return false;
 }
@@ -719,6 +719,12 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
         env->tlb_fi = NULL;
 
         if (unlikely(flags & TLB_INVALID_MASK)) {
+            /*
+             * We know this must be a stage 2 fault because the granule
+             * protection table does not separately track read and write
+             * permission, so all GPC faults are caught in S1_ptw_translate():
+             * we only get here for "readable but not writeable".
+             */
             assert(fi->type != ARMFault_None);
             fi->s2addr = ptw->out_virt;
             fi->stage2 = true;

From 4f51edd3cd1746c0eee66eebafdfb642f8dd7e87 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:05 +0100
Subject: [PATCH 1134/1353] target/arm/ptw: Set s1ns bit in fault info more
 consistently

The s1ns bit in ARMMMUFaultInfo is documented as "true if
we faulted on a non-secure IPA while in secure state". Both the
places which look at this bit only do so after having confirmed
that this is a stage 2 fault and we're dealing with Secure EL2,
which leaves the ptw.c code free to set the bit to any random
value in the other cases.

Instead of taking advantage of that freedom, consistently
make the bit be set to false for the "not a stage 2 fault
for Secure EL2" cases. This removes some cases where we
were using an 'is_secure' boolean and leaving the reader
guessing about whether that was the right thing for Realm
and Root cases.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-4-peter.maydell@linaro.org
---
 target/arm/ptw.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index eb57ebd897..67078ae350 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -514,6 +514,17 @@ static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
     }
 }
 
+static bool fault_s1ns(ARMSecuritySpace space, ARMMMUIdx s2_mmu_idx)
+{
+    /*
+     * For stage 2 faults in Secure EL22, S1NS indicates
+     * whether the faulting IPA is in the Secure or NonSecure
+     * IPA space. For all other kinds of fault, it is false.
+     */
+    return space == ARMSS_Secure && regime_is_stage2(s2_mmu_idx)
+        && s2_mmu_idx == ARMMMUIdx_Stage2_S;
+}
+
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
@@ -586,7 +597,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
-            fi->s1ns = !is_secure;
+            fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
             return false;
         }
     }
@@ -602,7 +613,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
     fi->s2addr = addr;
     fi->stage2 = regime_is_stage2(s2_mmu_idx);
     fi->s1ptw = fi->stage2;
-    fi->s1ns = !is_secure;
+    fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
     return false;
 }
 
@@ -729,7 +740,7 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
             fi->s2addr = ptw->out_virt;
             fi->stage2 = true;
             fi->s1ptw = true;
-            fi->s1ns = !ptw->in_secure;
+            fi->s1ns = fault_s1ns(ptw->in_space, ptw->in_ptw_idx);
             return 0;
         }
 
@@ -2030,7 +2041,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     fi->level = level;
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
     fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
-    fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
+    fi->s1ns = fault_s1ns(ptw->in_space, mmu_idx);
     return true;
 }
 

From a5637bec4c8989373f70c3d2841988c967fc4642 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:06 +0100
Subject: [PATCH 1135/1353] target/arm/ptw: Pass ptw into get_phys_addr_pmsa*()
 and get_phys_addr_disabled()

In commit 6d2654ffacea813916176 we created the S1Translate struct and
used it to plumb through various arguments that we were previously
passing one-at-a-time to get_phys_addr_v5(), get_phys_addr_v6(), and
get_phys_addr_lpae().  Extend that pattern to get_phys_addr_pmsav5(),
get_phys_addr_pmsav7(), get_phys_addr_pmsav8() and
get_phys_addr_disabled(), so that all the get_phys_addr_* functions
we call from get_phys_addr_nogpc() take the S1Translate struct rather
than the mmu_idx and is_secure bool.

(This refactoring is a prelude to having the called functions look
at ptw->is_space rather than using an is_secure boolean.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-5-peter.maydell@linaro.org
---
 target/arm/ptw.c | 57 ++++++++++++++++++++++++++++++------------------
 1 file changed, 36 insertions(+), 21 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 67078ae350..a873fbe023 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2045,15 +2045,19 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     return true;
 }
 
-static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
-                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                 bool is_secure, GetPhysAddrResult *result,
+static bool get_phys_addr_pmsav5(CPUARMState *env,
+                                 S1Translate *ptw,
+                                 uint32_t address,
+                                 MMUAccessType access_type,
+                                 GetPhysAddrResult *result,
                                  ARMMMUFaultInfo *fi)
 {
     int n;
     uint32_t mask;
     uint32_t base;
+    ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     bool is_user = regime_is_user(env, mmu_idx);
+    bool is_secure = arm_space_is_secure(ptw->in_space);
 
     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
         /* MPU disabled.  */
@@ -2210,14 +2214,18 @@ static bool pmsav7_use_background_region(ARMCPU *cpu, ARMMMUIdx mmu_idx,
     return regime_sctlr(env, mmu_idx) & SCTLR_BR;
 }
 
-static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                 bool secure, GetPhysAddrResult *result,
+static bool get_phys_addr_pmsav7(CPUARMState *env,
+                                 S1Translate *ptw,
+                                 uint32_t address,
+                                 MMUAccessType access_type,
+                                 GetPhysAddrResult *result,
                                  ARMMMUFaultInfo *fi)
 {
     ARMCPU *cpu = env_archcpu(env);
     int n;
+    ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     bool is_user = regime_is_user(env, mmu_idx);
+    bool secure = arm_space_is_secure(ptw->in_space);
 
     result->f.phys_addr = address;
     result->f.lg_page_size = TARGET_PAGE_BITS;
@@ -2736,12 +2744,16 @@ void v8m_security_lookup(CPUARMState *env, uint32_t address,
     }
 }
 
-static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
-                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                 bool secure, GetPhysAddrResult *result,
+static bool get_phys_addr_pmsav8(CPUARMState *env,
+                                 S1Translate *ptw,
+                                 uint32_t address,
+                                 MMUAccessType access_type,
+                                 GetPhysAddrResult *result,
                                  ARMMMUFaultInfo *fi)
 {
     V8M_SAttributes sattrs = {};
+    ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
+    bool secure = arm_space_is_secure(ptw->in_space);
     bool ret;
 
     if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
@@ -3045,12 +3057,15 @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
  * MMU disabled.  S1 addresses within aa64 translation regimes are
  * still checked for bounds -- see AArch64.S1DisabledOutput().
  */
-static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
+static bool get_phys_addr_disabled(CPUARMState *env,
+                                   S1Translate *ptw,
+                                   target_ulong address,
                                    MMUAccessType access_type,
-                                   ARMMMUIdx mmu_idx, bool is_secure,
                                    GetPhysAddrResult *result,
                                    ARMMMUFaultInfo *fi)
 {
+    ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
+    bool is_secure = arm_space_is_secure(ptw->in_space);
     uint8_t memattr = 0x00;    /* Device nGnRnE */
     uint8_t shareability = 0;  /* non-shareable */
     int r_el;
@@ -3252,8 +3267,8 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
     case ARMMMUIdx_Phys_Root:
     case ARMMMUIdx_Phys_Realm:
         /* Checking Phys early avoids special casing later vs regime_el. */
-        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
-                                      is_secure, result, fi);
+        return get_phys_addr_disabled(env, ptw, address, access_type,
+                                      result, fi);
 
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
@@ -3321,16 +3336,16 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
 
         if (arm_feature(env, ARM_FEATURE_V8)) {
             /* PMSAv8 */
-            ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
-                                       is_secure, result, fi);
+            ret = get_phys_addr_pmsav8(env, ptw, address, access_type,
+                                       result, fi);
         } else if (arm_feature(env, ARM_FEATURE_V7)) {
             /* PMSAv7 */
-            ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
-                                       is_secure, result, fi);
+            ret = get_phys_addr_pmsav7(env, ptw, address, access_type,
+                                       result, fi);
         } else {
             /* Pre-v7 MPU */
-            ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
-                                       is_secure, result, fi);
+            ret = get_phys_addr_pmsav5(env, ptw, address, access_type,
+                                       result, fi);
         }
         qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32
                       " mmu_idx %u -> %s (prot %c%c%c)\n",
@@ -3348,8 +3363,8 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
     /* Definitely a real MMU, not an MPU */
 
     if (regime_translation_disabled(env, mmu_idx, is_secure)) {
-        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
-                                      is_secure, result, fi);
+        return get_phys_addr_disabled(env, ptw, address, access_type,
+                                      result, fi);
     }
 
     if (regime_using_lpae_format(env, mmu_idx)) {

From d1289140a009f17633a1badeeddcff5746c258c9 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:06 +0100
Subject: [PATCH 1136/1353] target/arm/ptw: Pass ARMSecurityState to
 regime_translation_disabled()

Plumb the ARMSecurityState through to regime_translation_disabled()
rather than just a bool is_secure.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-6-peter.maydell@linaro.org
---
 target/arm/ptw.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index a873fbe023..63dd8e3cbe 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -206,9 +206,10 @@ static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
 
 /* Return true if the specified stage of address translation is disabled */
 static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
-                                        bool is_secure)
+                                        ARMSecuritySpace space)
 {
     uint64_t hcr_el2;
+    bool is_secure = arm_space_is_secure(space);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
         switch (env->v7m.mpu_ctrl[is_secure] &
@@ -2057,9 +2058,8 @@ static bool get_phys_addr_pmsav5(CPUARMState *env,
     uint32_t base;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     bool is_user = regime_is_user(env, mmu_idx);
-    bool is_secure = arm_space_is_secure(ptw->in_space);
 
-    if (regime_translation_disabled(env, mmu_idx, is_secure)) {
+    if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
         /* MPU disabled.  */
         result->f.phys_addr = address;
         result->f.prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
@@ -2231,7 +2231,7 @@ static bool get_phys_addr_pmsav7(CPUARMState *env,
     result->f.lg_page_size = TARGET_PAGE_BITS;
     result->f.prot = 0;
 
-    if (regime_translation_disabled(env, mmu_idx, secure) ||
+    if (regime_translation_disabled(env, mmu_idx, ptw->in_space) ||
         m_is_ppb_region(env, address)) {
         /*
          * MPU disabled or M profile PPB access: use default memory map.
@@ -2475,7 +2475,8 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
      * are done in arm_v7m_load_vector(), which always does a direct
      * read using address_space_ldl(), rather than going via this function.
      */
-    if (regime_translation_disabled(env, mmu_idx, secure)) { /* MPU disabled */
+    if (regime_translation_disabled(env, mmu_idx, arm_secure_to_space(secure))) {
+        /* MPU disabled */
         hit = true;
     } else if (m_is_ppb_region(env, address)) {
         hit = true;
@@ -3303,7 +3304,7 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
          */
         ptw->in_mmu_idx = mmu_idx = s1_mmu_idx;
         if (arm_feature(env, ARM_FEATURE_EL2) &&
-            !regime_translation_disabled(env, ARMMMUIdx_Stage2, is_secure)) {
+            !regime_translation_disabled(env, ARMMMUIdx_Stage2, ptw->in_space)) {
             return get_phys_addr_twostage(env, ptw, address, access_type,
                                           result, fi);
         }
@@ -3362,7 +3363,7 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
 
     /* Definitely a real MMU, not an MPU */
 
-    if (regime_translation_disabled(env, mmu_idx, is_secure)) {
+    if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
         return get_phys_addr_disabled(env, ptw, address, access_type,
                                       result, fi);
     }

From 2d12bb96bdb8ccded608e56af8c644602b2bebf7 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:07 +0100
Subject: [PATCH 1137/1353] target/arm/ptw: Pass an ARMSecuritySpace to
 arm_hcr_el2_eff_secstate()

arm_hcr_el2_eff_secstate() takes a bool secure, which it uses to
determine whether EL2 is enabled in the current security state.
With the advent of FEAT_RME this is no longer sufficient, because
EL2 can be enabled for Secure state but not for Root, and both
of those will pass 'secure == true' in the callsites in ptw.c.

As it happens in all of our callsites in ptw.c we either avoid making
the call or else avoid using the returned value if we're doing a
translation for Root, so this is not a behaviour change even if the
experimental FEAT_RME is enabled.  But it is less confusing in the
ptw.c code if we avoid the use of a bool secure that duplicates some
of the information in the ArmSecuritySpace argument.

Make arm_hcr_el2_eff_secstate() take an ARMSecuritySpace argument
instead. Because we always want to know the HCR_EL2 for the
security state defined by the current effective value of
SCR_EL3.{NSE,NS}, it makes no sense to pass ARMSS_Root here,
and we assert that callers don't do that.

To avoid the assert(), we thus push the call to
arm_hcr_el2_eff_secstate() down into the cases in
regime_translation_disabled() that need it, rather than calling the
function and ignoring the result for the Root space translations.
All other calls to this function in ptw.c are already in places
where we have confirmed that the mmu_idx is a stage 2 translation
or that the regime EL is not 3.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-7-peter.maydell@linaro.org
---
 target/arm/cpu.h    |  2 +-
 target/arm/helper.c |  8 +++++---
 target/arm/ptw.c    | 15 +++++++--------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 88e5accda6..bcd65a63ca 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2555,7 +2555,7 @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
  * "for all purposes other than a direct read or write access of HCR_EL2."
  * Not included here is HCR_RW.
  */
-uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure);
+uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space);
 uint64_t arm_hcr_el2_eff(CPUARMState *env);
 uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 50f61e42ca..9862bc73b5 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5772,11 +5772,13 @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
  * Bits that are not included here:
  * RW       (read from SCR_EL3.RW as needed)
  */
-uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
+uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space)
 {
     uint64_t ret = env->cp15.hcr_el2;
 
-    if (!arm_is_el2_enabled_secstate(env, secure)) {
+    assert(space != ARMSS_Root);
+
+    if (!arm_is_el2_enabled_secstate(env, arm_space_is_secure(space))) {
         /*
          * "This register has no effect if EL2 is not enabled in the
          * current Security state".  This is ARMv8.4-SecEL2 speak for
@@ -5840,7 +5842,7 @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)
     if (arm_feature(env, ARM_FEATURE_M)) {
         return 0;
     }
-    return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
+    return arm_hcr_el2_eff_secstate(env, arm_security_space_below_el3(env));
 }
 
 /*
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 63dd8e3cbe..4c60de753d 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -209,9 +209,9 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
                                         ARMSecuritySpace space)
 {
     uint64_t hcr_el2;
-    bool is_secure = arm_space_is_secure(space);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
+        bool is_secure = arm_space_is_secure(space);
         switch (env->v7m.mpu_ctrl[is_secure] &
                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
         case R_V7M_MPU_CTRL_ENABLE_MASK:
@@ -230,18 +230,19 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
         }
     }
 
-    hcr_el2 = arm_hcr_el2_eff_secstate(env, is_secure);
 
     switch (mmu_idx) {
     case ARMMMUIdx_Stage2:
     case ARMMMUIdx_Stage2_S:
         /* HCR.DC means HCR.VM behaves as 1 */
+        hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
 
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
         /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
+        hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
         if (hcr_el2 & HCR_TGE) {
             return true;
         }
@@ -251,6 +252,7 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
+        hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
         if (hcr_el2 & HCR_DC) {
             return true;
         }
@@ -530,7 +532,6 @@ static bool fault_s1ns(ARMSecuritySpace space, ARMMMUIdx s2_mmu_idx)
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
-    bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
     uint8_t pte_attrs;
@@ -587,7 +588,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
     }
 
     if (regime_is_stage2(s2_mmu_idx)) {
-        uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
+        uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
 
         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
             /*
@@ -3066,7 +3067,6 @@ static bool get_phys_addr_disabled(CPUARMState *env,
                                    ARMMMUFaultInfo *fi)
 {
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    bool is_secure = arm_space_is_secure(ptw->in_space);
     uint8_t memattr = 0x00;    /* Device nGnRnE */
     uint8_t shareability = 0;  /* non-shareable */
     int r_el;
@@ -3112,7 +3112,7 @@ static bool get_phys_addr_disabled(CPUARMState *env,
 
         /* Fill in cacheattr a-la AArch64.TranslateAddressS1Off. */
         if (r_el == 1) {
-            uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
+            uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
             if (hcr & HCR_DC) {
                 if (hcr & HCR_DCT) {
                     memattr = 0xf0;  /* Tagged, Normal, WB, RWA */
@@ -3149,7 +3149,6 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
 {
     hwaddr ipa;
     int s1_prot, s1_lgpgsz;
-    bool is_secure = ptw->in_secure;
     ARMSecuritySpace in_space = ptw->in_space;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
@@ -3212,7 +3211,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     }
 
     /* Combine the S1 and S2 cache attributes. */
-    hcr = arm_hcr_el2_eff_secstate(env, is_secure);
+    hcr = arm_hcr_el2_eff_secstate(env, in_space);
     if (hcr & HCR_DC) {
         /*
          * HCR.DC forces the first stage attributes to

From 4477020d3811d0509241d0b752015f1ead2196bc Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:07 +0100
Subject: [PATCH 1138/1353] target/arm: Pass an ARMSecuritySpace to
 arm_is_el2_enabled_secstate()

Pass an ARMSecuritySpace instead of a bool secure to
arm_is_el2_enabled_secstate(). This doesn't change behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-8-peter.maydell@linaro.org
---
 target/arm/cpu.h    | 13 ++++++++-----
 target/arm/helper.c |  2 +-
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index bcd65a63ca..02bc8f0e8e 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2504,17 +2504,19 @@ static inline bool arm_is_secure(CPUARMState *env)
 
 /*
  * Return true if the current security state has AArch64 EL2 or AArch32 Hyp.
- * This corresponds to the pseudocode EL2Enabled()
+ * This corresponds to the pseudocode EL2Enabled().
  */
-static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)
+static inline bool arm_is_el2_enabled_secstate(CPUARMState *env,
+                                               ARMSecuritySpace space)
 {
+    assert(space != ARMSS_Root);
     return arm_feature(env, ARM_FEATURE_EL2)
-           && (!secure || (env->cp15.scr_el3 & SCR_EEL2));
+           && (space != ARMSS_Secure || (env->cp15.scr_el3 & SCR_EEL2));
 }
 
 static inline bool arm_is_el2_enabled(CPUARMState *env)
 {
-    return arm_is_el2_enabled_secstate(env, arm_is_secure_below_el3(env));
+    return arm_is_el2_enabled_secstate(env, arm_security_space_below_el3(env));
 }
 
 #else
@@ -2538,7 +2540,8 @@ static inline bool arm_is_secure(CPUARMState *env)
     return false;
 }
 
-static inline bool arm_is_el2_enabled_secstate(CPUARMState *env, bool secure)
+static inline bool arm_is_el2_enabled_secstate(CPUARMState *env,
+                                               ARMSecuritySpace space)
 {
     return false;
 }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 9862bc73b5..8290ca0aaa 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5778,7 +5778,7 @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space)
 
     assert(space != ARMSS_Root);
 
-    if (!arm_is_el2_enabled_secstate(env, arm_space_is_secure(space))) {
+    if (!arm_is_el2_enabled_secstate(env, space)) {
         /*
          * "This register has no effect if EL2 is not enabled in the
          * current Security state".  This is ARMv8.4-SecEL2 speak for

From b9c139dc581c793094b1889f304e049a75e2d455 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:08 +0100
Subject: [PATCH 1139/1353] target/arm/ptw: Only fold in NSTable bit effects in
 Secure state

When we do a translation in Secure state, the NSTable bits in table
descriptors may downgrade us to NonSecure; we update ptw->in_secure
and ptw->in_space accordingly.  We guard that check correctly with a
conditional that means it's only applied for Secure stage 1
translations.  However, later on in get_phys_addr_lpae() we fold the
effects of the NSTable bits into the final descriptor attributes
bits, and there we do it unconditionally regardless of the CPU state.
That means that in Realm state (where in_secure is false) we will set
bit 5 in attrs, and later use it to decide to output to non-secure
space.

We don't in fact need to do this folding in at all any more (since
commit 2f1ff4e7b9f30c): if an NSTable bit was set then we have
already set ptw->in_space to ARMSS_NonSecure, and in that situation
we don't look at attrs bit 5.  The only thing we still need to deal
with is the real NS bit in the final descriptor word, so we can just
drop the code that ORed in the NSTable bit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-9-peter.maydell@linaro.org
---
 target/arm/ptw.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 4c60de753d..6e736bacd7 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1886,11 +1886,10 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * Extract attributes from the (modified) descriptor, and apply
      * table descriptors. Stage 2 table descriptors do not include
      * any attribute fields. HPD disables all the table attributes
-     * except NSTable.
+     * except NSTable (which we have already handled).
      */
     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
     if (!regime_is_stage2(mmu_idx)) {
-        attrs |= !ptw->in_secure << 5; /* NS */
         if (!param.hpd) {
             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
             /*

From cdbae5e7e1de104e2cc168a7938ed0c5b467a3e7 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:08 +0100
Subject: [PATCH 1140/1353] target/arm/ptw: Remove last uses of ptw->in_secure

Replace the last uses of ptw->in_secure with appropriate
checks on ptw->in_space.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-10-peter.maydell@linaro.org
---
 target/arm/ptw.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 6e736bacd7..1ca25438c3 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3249,7 +3249,6 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
                                       ARMMMUFaultInfo *fi)
 {
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    bool is_secure = ptw->in_secure;
     ARMMMUIdx s1_mmu_idx;
 
     /*
@@ -3257,8 +3256,8 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
      * cannot upgrade a NonSecure translation regime's attributes
      * to Secure or Realm.
      */
-    result->f.attrs.secure = is_secure;
     result->f.attrs.space = ptw->in_space;
+    result->f.attrs.secure = arm_space_is_secure(ptw->in_space);
 
     switch (mmu_idx) {
     case ARMMMUIdx_Phys_S:
@@ -3272,8 +3271,12 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
-        /* First stage lookup uses second stage for ptw. */
-        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+        /*
+         * First stage lookup uses second stage for ptw; only
+         * Secure has both S and NS IPA and starts with Stage2_S.
+         */
+        ptw->in_ptw_idx = (ptw->in_space == ARMSS_Secure) ?
+            ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
         break;
 
     case ARMMMUIdx_Stage2:

From 6279f6dcdb08a45597536b546faa6a178a2c0f4a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:08 +0100
Subject: [PATCH 1141/1353] target/arm/ptw: Remove S1Translate::in_secure

We no longer look at the in_secure field of the S1Translate struct
anyway, so we can remove it and all the code which sets it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-11-peter.maydell@linaro.org
---
 target/arm/ptw.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 1ca25438c3..78bc679dee 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -51,13 +51,6 @@ typedef struct S1Translate {
      *    value being Stage2 vs Stage2_S distinguishes those.
      */
     ARMSecuritySpace in_space;
-    /*
-     * in_secure: whether the translation regime is a Secure one.
-     * This is always equal to arm_space_is_secure(in_space).
-     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
-     * this field is updated accordingly.
-     */
-    bool in_secure;
     /*
      * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
      * accesses will not update the guest page table access flags
@@ -547,7 +540,6 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-            .in_secure = arm_space_is_secure(s2_space),
             .in_space = s2_space,
             .in_debug = true,
         };
@@ -1784,7 +1776,6 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
         ptw->in_ptw_idx += 1;
-        ptw->in_secure = false;
         ptw->in_space = ARMSS_NonSecure;
     }
 
@@ -3167,7 +3158,6 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
 
     ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-    ptw->in_secure = ipa_secure;
     ptw->in_space = ipa_space;
     ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
 
@@ -3403,7 +3393,6 @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
 {
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
-        .in_secure = is_secure,
         .in_space = arm_secure_to_space(is_secure),
     };
     return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
@@ -3475,7 +3464,6 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     }
 
     ptw.in_space = ss;
-    ptw.in_secure = arm_space_is_secure(ss);
     return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
 }
 
@@ -3489,7 +3477,6 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_space = ss,
-        .in_secure = arm_space_is_secure(ss),
         .in_debug = true,
     };
     GetPhysAddrResult res = {};

From b02f5e06bcc87a52b9955d1425faadc9ddc9d38e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:09 +0100
Subject: [PATCH 1142/1353] target/arm/ptw: Drop S1Translate::out_secure

We only use S1Translate::out_secure in two places, where we are
setting up MemTxAttrs for a page table load. We can use
arm_space_is_secure(ptw->out_space) instead, which guarantees
that we're setting the MemTxAttrs secure and space fields
consistently, and allows us to drop the out_secure field in
S1Translate entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-12-peter.maydell@linaro.org
---
 target/arm/ptw.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 78bc679dee..312ccabe92 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -63,7 +63,6 @@ typedef struct S1Translate {
      * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
      */
     bool in_s1_is_el0;
-    bool out_secure;
     bool out_rw;
     bool out_be;
     ARMSecuritySpace out_space;
@@ -553,7 +552,6 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         pte_attrs = s2.cacheattrs.attrs;
         ptw->out_host = NULL;
         ptw->out_rw = false;
-        ptw->out_secure = s2.f.attrs.secure;
         ptw->out_space = s2.f.attrs.space;
     } else {
 #ifdef CONFIG_TCG
@@ -572,7 +570,6 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         ptw->out_phys = full->phys_addr | (addr & ~TARGET_PAGE_MASK);
         ptw->out_rw = full->prot & PAGE_WRITE;
         pte_attrs = full->pte_attrs;
-        ptw->out_secure = full->attrs.secure;
         ptw->out_space = full->attrs.space;
 #else
         g_assert_not_reached();
@@ -630,8 +627,8 @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
     } else {
         /* Page tables are in MMIO. */
         MemTxAttrs attrs = {
-            .secure = ptw->out_secure,
             .space = ptw->out_space,
+            .secure = arm_space_is_secure(ptw->out_space),
         };
         AddressSpace *as = arm_addressspace(cs, attrs);
         MemTxResult result = MEMTX_OK;
@@ -676,8 +673,8 @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
     } else {
         /* Page tables are in MMIO. */
         MemTxAttrs attrs = {
-            .secure = ptw->out_secure,
             .space = ptw->out_space,
+            .secure = arm_space_is_secure(ptw->out_space),
         };
         AddressSpace *as = arm_addressspace(cs, attrs);
         MemTxResult result = MEMTX_OK;

From 3d9ca96221ba7212aacb27ec472f0be703e99a78 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:09 +0100
Subject: [PATCH 1143/1353] target/arm/ptw: Set attributes correctly for MMU
 disabled data accesses

When the MMU is disabled, data accesses should be Device nGnRnE,
Outer Shareable, Untagged.  We handle the other cases from
AArch64.S1DisabledOutput() correctly but missed this one.
Device nGnRnE is memattr == 0, so the only part we were missing
was that shareability should be set to 2 for both insn fetches
and data accesses.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-13-peter.maydell@linaro.org
---
 target/arm/ptw.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 312ccabe92..7f217a3189 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3108,11 +3108,13 @@ static bool get_phys_addr_disabled(CPUARMState *env,
                 }
             }
         }
-        if (memattr == 0 && access_type == MMU_INST_FETCH) {
-            if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
-                memattr = 0xee;  /* Normal, WT, RA, NT */
-            } else {
-                memattr = 0x44;  /* Normal, NC, No */
+        if (memattr == 0) {
+            if (access_type == MMU_INST_FETCH) {
+                if (regime_sctlr(env, mmu_idx) & SCTLR_I) {
+                    memattr = 0xee;  /* Normal, WT, RA, NT */
+                } else {
+                    memattr = 0x44;  /* Normal, NC, No */
+                }
             }
             shareability = 2; /* outer shareable */
         }

From d53e25075bd9c89c81ab2bfc45ccbcdc92842b24 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:10 +0100
Subject: [PATCH 1144/1353] target/arm/ptw: Check for block descriptors at
 invalid levels

The architecture doesn't permit block descriptors at any arbitrary
level of the page table walk; it depends on the granule size which
levels are permitted.  We implemented only a partial version of this
check which assumes that block descriptors are valid at all levels
except level 3, which meant that we wouldn't deliver the Translation
fault for all cases of this sort of guest page table error.

Implement the logic corresponding to the pseudocode
AArch64.DecodeDescriptorType() and AArch64.BlockDescSupported().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-14-peter.maydell@linaro.org
---
 target/arm/ptw.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 7f217a3189..fbb0f8a0bf 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1551,6 +1551,25 @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
     return INT_MIN;
 }
 
+static bool lpae_block_desc_valid(ARMCPU *cpu, bool ds,
+                                  ARMGranuleSize gran, int level)
+{
+    /*
+     * See pseudocode AArch46.BlockDescSupported(): block descriptors
+     * are not valid at all levels, depending on the page size.
+     */
+    switch (gran) {
+    case Gran4K:
+        return (level == 0 && ds) || level == 1 || level == 2;
+    case Gran16K:
+        return (level == 1 && ds) || level == 2;
+    case Gran64K:
+        return (level == 1 && arm_pamax(cpu) == 52) || level == 2;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 /**
  * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
  *
@@ -1786,8 +1805,10 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     new_descriptor = descriptor;
 
  restart_atomic_update:
-    if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
-        /* Invalid, or the Reserved level 3 encoding */
+    if (!(descriptor & 1) ||
+        (!(descriptor & 2) &&
+         !lpae_block_desc_valid(cpu, param.ds, param.gran, level))) {
+        /* Invalid, or a block descriptor at an invalid level */
         goto do_translation_fault;
     }
 

From a729d63642b01f2b7a3c1db468811a7b40b88f70 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:10 +0100
Subject: [PATCH 1145/1353] target/arm/ptw: Report stage 2 fault level for
 stage 2 faults on stage 1 ptw

When we report faults due to stage 2 faults during a stage 1
page table walk, the 'level' parameter should be the level
of the walk in stage 2 that faulted, not the level of the
walk in stage 1. Correct the reporting of these faults.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-15-peter.maydell@linaro.org
---
 target/arm/ptw.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index fbb0f8a0bf..07832eb8f7 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2048,9 +2048,13 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
  do_translation_fault:
     fi->type = ARMFault_Translation;
  do_fault:
-    fi->level = level;
-    /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
-    fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
+    if (fi->s1ptw) {
+        /* Retain the existing stage 2 fi->level */
+        assert(fi->stage2);
+    } else {
+        fi->level = level;
+        fi->stage2 = regime_is_stage2(mmu_idx);
+    }
     fi->s1ns = fault_s1ns(ptw->in_space, mmu_idx);
     return true;
 }

From b17d86eb5ef745f393f3387b15df2b9b2aaae793 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 22 Aug 2023 17:31:10 +0100
Subject: [PATCH 1146/1353] target/arm: Adjust PAR_EL1.SH for Device and
 Normal-NC memory types

The PAR_EL1.SH field documents that for the cases of:
 * Device memory
 * Normal memory with both Inner and Outer Non-Cacheable
the field should be 0b10 rather than whatever was in the
translation table descriptor field. (In the pseudocode this
is handled by PAREncodeShareability().) Perform this
adjustment when assembling a PAR value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807141514.19075-16-peter.maydell@linaro.org
---
 target/arm/helper.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8290ca0aaa..da5db6d3ff 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3342,6 +3342,19 @@ static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
 }
 
 #ifdef CONFIG_TCG
+static int par_el1_shareability(GetPhysAddrResult *res)
+{
+    /*
+     * The PAR_EL1.SH field must be 0b10 for Device or Normal-NC
+     * memory -- see pseudocode PAREncodeShareability().
+     */
+    if (((res->cacheattrs.attrs & 0xf0) == 0) ||
+        res->cacheattrs.attrs == 0x44 || res->cacheattrs.attrs == 0x40) {
+        return 2;
+    }
+    return res->cacheattrs.shareability;
+}
+
 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
                              MMUAccessType access_type, ARMMMUIdx mmu_idx,
                              bool is_secure)
@@ -3470,7 +3483,7 @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
                 par64 |= (1 << 9); /* NS */
             }
             par64 |= (uint64_t)res.cacheattrs.attrs << 56; /* ATTR */
-            par64 |= res.cacheattrs.shareability << 7; /* SH */
+            par64 |= par_el1_shareability(&res) << 7; /* SH */
         } else {
             uint32_t fsr = arm_fi_to_lfsc(&fi);
 

From da64251e9317b3937cad54f71f606f5f9b837c8e Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
Date: Tue, 22 Aug 2023 17:31:11 +0100
Subject: [PATCH 1147/1353] target/arm/ptw: Load stage-2 tables from realm
 physical space

In realm state, stage-2 translation tables are fetched from the realm
physical address space (R_PGRQD).

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230809123706.1842548-2-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 07832eb8f7..7a69968dd7 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -157,22 +157,32 @@ static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx)
 
     /*
      * We're OK to check the current state of the CPU here because
-     * (1) we always invalidate all TLBs when the SCR_EL3.NS bit changes
+     * (1) we always invalidate all TLBs when the SCR_EL3.NS or SCR_EL3.NSE bit
+     * changes.
      * (2) there's no way to do a lookup that cares about Stage 2 for a
      * different security state to the current one for AArch64, and AArch32
      * never has a secure EL2. (AArch32 ATS12NSO[UP][RW] allow EL3 to do
      * an NS stage 1+2 lookup while the NS bit is 0.)
      */
-    if (!arm_is_secure_below_el3(env) || !arm_el_is_aa64(env, 3)) {
+    if (!arm_el_is_aa64(env, 3)) {
         return ARMMMUIdx_Phys_NS;
     }
-    if (stage2idx == ARMMMUIdx_Stage2_S) {
-        s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
-    } else {
-        s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
-    }
-    return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
 
+    switch (arm_security_space_below_el3(env)) {
+    case ARMSS_NonSecure:
+        return ARMMMUIdx_Phys_NS;
+    case ARMSS_Realm:
+        return ARMMMUIdx_Phys_Realm;
+    case ARMSS_Secure:
+        if (stage2idx == ARMMMUIdx_Stage2_S) {
+            s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
+        } else {
+            s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
+        }
+        return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
+    default:
+        g_assert_not_reached();
+    }
 }
 
 static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)

From ceaa97465f58cf2b3b4fc07a3b1067eb6f48d2e3 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
Date: Tue, 22 Aug 2023 17:31:11 +0100
Subject: [PATCH 1148/1353] target/arm/helper: Fix tlbmask and tlbbits for TLBI
 VAE2*

When HCR_EL2.E2H is enabled, TLB entries are formed using the EL2&0
translation regime, instead of the EL2 translation regime. The TLB VAE2*
instructions invalidate the regime that corresponds to the current value
of HCR_EL2.E2H.

At the moment we only invalidate the EL2 translation regime. This causes
problems with RMM, which issues TLBI VAE2IS instructions with
HCR_EL2.E2H enabled. Update vae2_tlbmask() to take HCR_EL2.E2H into
account.

Add vae2_tlbbits() as well, since the top-byte-ignore configuration is
different between the EL2&0 and EL2 regime.

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230809123706.1842548-3-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 50 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 40 insertions(+), 10 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index da5db6d3ff..808f35218a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4663,6 +4663,21 @@ static int vae1_tlbmask(CPUARMState *env)
     return mask;
 }
 
+static int vae2_tlbmask(CPUARMState *env)
+{
+    uint64_t hcr = arm_hcr_el2_eff(env);
+    uint16_t mask;
+
+    if (hcr & HCR_E2H) {
+        mask = ARMMMUIdxBit_E20_2 |
+               ARMMMUIdxBit_E20_2_PAN |
+               ARMMMUIdxBit_E20_0;
+    } else {
+        mask = ARMMMUIdxBit_E2;
+    }
+    return mask;
+}
+
 /* Return 56 if TBI is enabled, 64 otherwise. */
 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
                               uint64_t addr)
@@ -4689,6 +4704,25 @@ static int vae1_tlbbits(CPUARMState *env, uint64_t addr)
     return tlbbits_for_regime(env, mmu_idx, addr);
 }
 
+static int vae2_tlbbits(CPUARMState *env, uint64_t addr)
+{
+    uint64_t hcr = arm_hcr_el2_eff(env);
+    ARMMMUIdx mmu_idx;
+
+    /*
+     * Only the regime of the mmu_idx below is significant.
+     * Regime EL2&0 has two ranges with separate TBI configuration, while EL2
+     * only has one.
+     */
+    if (hcr & HCR_E2H) {
+        mmu_idx = ARMMMUIdx_E20_2;
+    } else {
+        mmu_idx = ARMMMUIdx_E2;
+    }
+
+    return tlbbits_for_regime(env, mmu_idx, addr);
+}
+
 static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                       uint64_t value)
 {
@@ -4781,10 +4815,11 @@ static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
      * flush-last-level-only.
      */
     CPUState *cs = env_cpu(env);
-    int mask = e2_tlbmask(env);
+    int mask = vae2_tlbmask(env);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
+    int bits = vae2_tlbbits(env, pageaddr);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, mask);
+    tlb_flush_page_bits_by_mmuidx(cs, pageaddr, mask, bits);
 }
 
 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -4838,11 +4873,11 @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                    uint64_t value)
 {
     CPUState *cs = env_cpu(env);
+    int mask = vae2_tlbmask(env);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
-    int bits = tlbbits_for_regime(env, ARMMMUIdx_E2, pageaddr);
+    int bits = vae2_tlbbits(env, pageaddr);
 
-    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                  ARMMMUIdxBit_E2, bits);
+    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
 }
 
 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -5014,11 +5049,6 @@ static void tlbi_aa64_rvae1is_write(CPUARMState *env,
     do_rvae_write(env, value, vae1_tlbmask(env), true);
 }
 
-static int vae2_tlbmask(CPUARMState *env)
-{
-    return ARMMMUIdxBit_E2;
-}
-
 static void tlbi_aa64_rvae2_write(CPUARMState *env,
                                   const ARMCPRegInfo *ri,
                                   uint64_t value)

From f1269a98aaf8e2884cb067d09bce0d3056ede289 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
Date: Tue, 22 Aug 2023 17:31:12 +0100
Subject: [PATCH 1149/1353] target/arm: Skip granule protection checks for AT
 instructions

GPC checks are not performed on the output address for AT instructions,
as stated by ARM DDI 0487J in D8.12.2:

  When populating PAR_EL1 with the result of an address translation
  instruction, granule protection checks are not performed on the final
  output address of a successful translation.

Rename get_phys_addr_with_secure(), since it's only used to handle AT
instructions.

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230809123706.1842548-4-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    |  8 ++++++--
 target/arm/internals.h | 25 ++++++++++++++-----------
 target/arm/ptw.c       | 11 ++++++-----
 3 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 808f35218a..e8a232a1f8 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3365,8 +3365,12 @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
     ARMMMUFaultInfo fi = {};
     GetPhysAddrResult res = {};
 
-    ret = get_phys_addr_with_secure(env, value, access_type, mmu_idx,
-                                    is_secure, &res, &fi);
+    /*
+     * I_MXTJT: Granule protection checks are not performed on the final address
+     * of a successful translation.
+     */
+    ret = get_phys_addr_with_secure_nogpc(env, value, access_type, mmu_idx,
+                                          is_secure, &res, &fi);
 
     /*
      * ATS operations only do S1 or S1+S2 translations, so we never
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 0f01bc32a8..fc90c364f7 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1190,12 +1190,11 @@ typedef struct GetPhysAddrResult {
 } GetPhysAddrResult;
 
 /**
- * get_phys_addr_with_secure: get the physical address for a virtual address
+ * get_phys_addr: get the physical address for a virtual address
  * @env: CPUARMState
  * @address: virtual address to get physical address for
  * @access_type: 0 for read, 1 for write, 2 for execute
  * @mmu_idx: MMU index indicating required translation regime
- * @is_secure: security state for the access
  * @result: set on translation success.
  * @fi: set to fault info if the translation fails
  *
@@ -1212,26 +1211,30 @@ typedef struct GetPhysAddrResult {
  *  * for PSMAv5 based systems we don't bother to return a full FSR format
  *    value.
  */
-bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
-                               MMUAccessType access_type,
-                               ARMMMUIdx mmu_idx, bool is_secure,
-                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+bool get_phys_addr(CPUARMState *env, target_ulong address,
+                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
     __attribute__((nonnull));
 
 /**
- * get_phys_addr: get the physical address for a virtual address
+ * get_phys_addr_with_secure_nogpc: get the physical address for a virtual
+ *                                  address
  * @env: CPUARMState
  * @address: virtual address to get physical address for
  * @access_type: 0 for read, 1 for write, 2 for execute
  * @mmu_idx: MMU index indicating required translation regime
+ * @is_secure: security state for the access
  * @result: set on translation success.
  * @fi: set to fault info if the translation fails
  *
- * Similarly, but use the security regime of @mmu_idx.
+ * Similar to get_phys_addr, but use the given security regime and don't perform
+ * a Granule Protection Check on the resulting address.
  */
-bool get_phys_addr(CPUARMState *env, target_ulong address,
-                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                   GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
+bool get_phys_addr_with_secure_nogpc(CPUARMState *env, target_ulong address,
+                                     MMUAccessType access_type,
+                                     ARMMMUIdx mmu_idx, bool is_secure,
+                                     GetPhysAddrResult *result,
+                                     ARMMMUFaultInfo *fi)
     __attribute__((nonnull));
 
 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 7a69968dd7..ca4de6e399 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3420,16 +3420,17 @@ static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
     return false;
 }
 
-bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
-                               MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                               bool is_secure, GetPhysAddrResult *result,
-                               ARMMMUFaultInfo *fi)
+bool get_phys_addr_with_secure_nogpc(CPUARMState *env, target_ulong address,
+                                     MMUAccessType access_type,
+                                     ARMMMUIdx mmu_idx, bool is_secure,
+                                     GetPhysAddrResult *result,
+                                     ARMMMUFaultInfo *fi)
 {
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_space = arm_secure_to_space(is_secure),
     };
-    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
+    return get_phys_addr_nogpc(env, &ptw, address, access_type, result, fi);
 }
 
 bool get_phys_addr(CPUARMState *env, target_ulong address,

From e1ee56ec2383fcc6c1bab613e783a0c190fc0ea7 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
Date: Tue, 22 Aug 2023 17:31:12 +0100
Subject: [PATCH 1150/1353] target/arm: Pass security space rather than flag
 for AT instructions

At the moment we only handle Secure and Nonsecure security spaces for
the AT instructions. Add support for Realm and Root.

For AArch64, arm_security_space() gives the desired space. ARM DDI0487J
says (R_NYXTL):

  If EL3 is implemented, then when an address translation instruction
  that applies to an Exception level lower than EL3 is executed, the
  Effective value of SCR_EL3.{NSE, NS} determines the target Security
  state that the instruction applies to.

For AArch32, some instructions can access NonSecure space from Secure,
so we still need to pass the state explicitly to do_ats_write().

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230809123706.1842548-5-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    | 27 ++++++++++++---------------
 target/arm/internals.h | 18 +++++++++---------
 target/arm/ptw.c       | 12 ++++++------
 3 files changed, 27 insertions(+), 30 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index e8a232a1f8..de639d4087 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3357,7 +3357,7 @@ static int par_el1_shareability(GetPhysAddrResult *res)
 
 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
                              MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                             bool is_secure)
+                             ARMSecuritySpace ss)
 {
     bool ret;
     uint64_t par64;
@@ -3369,8 +3369,8 @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
      * I_MXTJT: Granule protection checks are not performed on the final address
      * of a successful translation.
      */
-    ret = get_phys_addr_with_secure_nogpc(env, value, access_type, mmu_idx,
-                                          is_secure, &res, &fi);
+    ret = get_phys_addr_with_space_nogpc(env, value, access_type, mmu_idx, ss,
+                                         &res, &fi);
 
     /*
      * ATS operations only do S1 or S1+S2 translations, so we never
@@ -3535,7 +3535,7 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     uint64_t par64;
     ARMMMUIdx mmu_idx;
     int el = arm_current_el(env);
-    bool secure = arm_is_secure_below_el3(env);
+    ARMSecuritySpace ss = arm_security_space(env);
 
     switch (ri->opc2 & 6) {
     case 0:
@@ -3543,10 +3543,9 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         switch (el) {
         case 3:
             mmu_idx = ARMMMUIdx_E3;
-            secure = true;
             break;
         case 2:
-            g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
+            g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
             /* fall through */
         case 1:
             if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
@@ -3564,10 +3563,9 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         switch (el) {
         case 3:
             mmu_idx = ARMMMUIdx_E10_0;
-            secure = true;
             break;
         case 2:
-            g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
+            g_assert(ss != ARMSS_Secure);  /* ARMv8.4-SecEL2 is 64-bit only */
             mmu_idx = ARMMMUIdx_Stage1_E0;
             break;
         case 1:
@@ -3580,18 +3578,18 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     case 4:
         /* stage 1+2 NonSecure PL1: ATS12NSOPR, ATS12NSOPW */
         mmu_idx = ARMMMUIdx_E10_1;
-        secure = false;
+        ss = ARMSS_NonSecure;
         break;
     case 6:
         /* stage 1+2 NonSecure PL0: ATS12NSOUR, ATS12NSOUW */
         mmu_idx = ARMMMUIdx_E10_0;
-        secure = false;
+        ss = ARMSS_NonSecure;
         break;
     default:
         g_assert_not_reached();
     }
 
-    par64 = do_ats_write(env, value, access_type, mmu_idx, secure);
+    par64 = do_ats_write(env, value, access_type, mmu_idx, ss);
 
     A32_BANKED_CURRENT_REG_SET(env, par, par64);
 #else
@@ -3608,7 +3606,8 @@ static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t par64;
 
     /* There is no SecureEL2 for AArch32. */
-    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2, false);
+    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2,
+                         ARMSS_NonSecure);
 
     A32_BANKED_CURRENT_REG_SET(env, par, par64);
 #else
@@ -3633,7 +3632,6 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
 #ifdef CONFIG_TCG
     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
     ARMMMUIdx mmu_idx;
-    int secure = arm_is_secure_below_el3(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
 
@@ -3653,7 +3651,6 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
             break;
         case 6: /* AT S1E3R, AT S1E3W */
             mmu_idx = ARMMMUIdx_E3;
-            secure = true;
             break;
         default:
             g_assert_not_reached();
@@ -3673,7 +3670,7 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 
     env->cp15.par_el[1] = do_ats_write(env, value, access_type,
-                                       mmu_idx, secure);
+                                       mmu_idx, arm_security_space(env));
 #else
     /* Handled by hardware accelerator. */
     g_assert_not_reached();
diff --git a/target/arm/internals.h b/target/arm/internals.h
index fc90c364f7..cf13bb94f5 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1217,24 +1217,24 @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     __attribute__((nonnull));
 
 /**
- * get_phys_addr_with_secure_nogpc: get the physical address for a virtual
- *                                  address
+ * get_phys_addr_with_space_nogpc: get the physical address for a virtual
+ *                                 address
  * @env: CPUARMState
  * @address: virtual address to get physical address for
  * @access_type: 0 for read, 1 for write, 2 for execute
  * @mmu_idx: MMU index indicating required translation regime
- * @is_secure: security state for the access
+ * @space: security space for the access
  * @result: set on translation success.
  * @fi: set to fault info if the translation fails
  *
- * Similar to get_phys_addr, but use the given security regime and don't perform
+ * Similar to get_phys_addr, but use the given security space and don't perform
  * a Granule Protection Check on the resulting address.
  */
-bool get_phys_addr_with_secure_nogpc(CPUARMState *env, target_ulong address,
-                                     MMUAccessType access_type,
-                                     ARMMMUIdx mmu_idx, bool is_secure,
-                                     GetPhysAddrResult *result,
-                                     ARMMMUFaultInfo *fi)
+bool get_phys_addr_with_space_nogpc(CPUARMState *env, target_ulong address,
+                                    MMUAccessType access_type,
+                                    ARMMMUIdx mmu_idx, ARMSecuritySpace space,
+                                    GetPhysAddrResult *result,
+                                    ARMMMUFaultInfo *fi)
     __attribute__((nonnull));
 
 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index ca4de6e399..bfbab26b9b 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3420,15 +3420,15 @@ static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
     return false;
 }
 
-bool get_phys_addr_with_secure_nogpc(CPUARMState *env, target_ulong address,
-                                     MMUAccessType access_type,
-                                     ARMMMUIdx mmu_idx, bool is_secure,
-                                     GetPhysAddrResult *result,
-                                     ARMMMUFaultInfo *fi)
+bool get_phys_addr_with_space_nogpc(CPUARMState *env, target_ulong address,
+                                    MMUAccessType access_type,
+                                    ARMMMUIdx mmu_idx, ARMSecuritySpace space,
+                                    GetPhysAddrResult *result,
+                                    ARMMMUFaultInfo *fi)
 {
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
-        .in_space = arm_secure_to_space(is_secure),
+        .in_space = space,
     };
     return get_phys_addr_nogpc(env, &ptw, address, access_type, result, fi);
 }

From 1acd00ef14101434cd99df0b01b32f62255423a9 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
Date: Tue, 22 Aug 2023 17:31:13 +0100
Subject: [PATCH 1151/1353] target/arm/helper: Check SCR_EL3.{NSE, NS} encoding
 for AT instructions

The AT instruction is UNDEFINED if the {NSE,NS} configuration is
invalid. Add a function to check this on all AT instructions that apply
to an EL lower than 3.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230809123706.1842548-6-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 38 +++++++++++++++++++++++++++-----------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index de639d4087..b4618ee2b9 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3616,6 +3616,22 @@ static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
 #endif /* CONFIG_TCG */
 }
 
+static CPAccessResult at_e012_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                     bool isread)
+{
+    /*
+     * R_NYXTL: instruction is UNDEFINED if it applies to an Exception level
+     * lower than EL3 and the combination SCR_EL3.{NSE,NS} is reserved. This can
+     * only happen when executing at EL3 because that combination also causes an
+     * illegal exception return. We don't need to check FEAT_RME either, because
+     * scr_write() ensures that the NSE bit is not set otherwise.
+     */
+    if ((env->cp15.scr_el3 & (SCR_NSE | SCR_NS)) == SCR_NSE) {
+        return CP_ACCESS_TRAP;
+    }
+    return CP_ACCESS_OK;
+}
+
 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                      bool isread)
 {
@@ -3623,7 +3639,7 @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
         !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
         return CP_ACCESS_TRAP;
     }
-    return CP_ACCESS_OK;
+    return at_e012_access(env, ri, isread);
 }
 
 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -5505,38 +5521,38 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 0,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .fgt = FGT_ATS1E1R,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S1E1W", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 1,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .fgt = FGT_ATS1E1W,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S1E0R", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 2,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .fgt = FGT_ATS1E0R,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S1E0W", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 8, .opc2 = 3,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .fgt = FGT_ATS1E0W,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S12E1R", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 4,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S12E1W", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S12E0R", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 6,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S12E0W", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 7,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     /* AT S1E2* are elsewhere as they UNDEF from EL3 if EL2 is not present */
     { .name = "AT_S1E3R", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 8, .opc2 = 0,
@@ -8079,12 +8095,12 @@ static const ARMCPRegInfo ats1e1_reginfo[] = {
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 0,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .fgt = FGT_ATS1E1RP,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
     { .name = "AT_S1E1WP", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 1,
       .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
       .fgt = FGT_ATS1E1WP,
-      .writefn = ats_write64 },
+      .accessfn = at_e012_access, .writefn = ats_write64 },
 };
 
 static const ARMCPRegInfo ats1cp_reginfo[] = {

From f6fc36deef6abcee406211f3e2f11ff894b87fa4 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
Date: Tue, 22 Aug 2023 17:31:13 +0100
Subject: [PATCH 1152/1353] target/arm/helper: Implement
 CNTHCTL_EL2.CNT[VP]MASK

When FEAT_RME is implemented, these bits override the value of
CNT[VP]_CTL_EL0.IMASK in Realm and Root state. Move the IRQ state update
into a new gt_update_irq() function and test those bits every time we
recompute the IRQ state.

Since we're removing the IRQ state from some trace events, add a new
trace event for gt_update_irq().

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230809123706.1842548-7-jean-philippe@linaro.org
[PMM: only register change hook if not USER_ONLY and if TCG]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c        |  6 ++++
 target/arm/cpu.h        |  4 +++
 target/arm/helper.c     | 65 ++++++++++++++++++++++++++++++++++-------
 target/arm/trace-events |  7 +++--
 4 files changed, 68 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 93c28d50e5..d906d2b1ca 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2169,6 +2169,12 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         set_feature(env, ARM_FEATURE_VBAR);
     }
 
+#ifndef CONFIG_USER_ONLY
+    if (tcg_enabled() && cpu_isar_feature(aa64_rme, cpu)) {
+        arm_register_el_change_hook(cpu, &gt_rme_post_el_change, 0);
+    }
+#endif
+
     register_cp_regs_for_features(cpu);
     arm_cpu_register_gdb_regs_for_features(cpu);
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 02bc8f0e8e..cdf8600b96 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1115,6 +1115,7 @@ struct ArchCPU {
 };
 
 unsigned int gt_cntfrq_period_ns(ARMCPU *cpu);
+void gt_rme_post_el_change(ARMCPU *cpu, void *opaque);
 
 void arm_cpu_post_init(Object *obj);
 
@@ -1743,6 +1744,9 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b4618ee2b9..85291d5b8e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2608,6 +2608,39 @@ static uint64_t gt_get_countervalue(CPUARMState *env)
     return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / gt_cntfrq_period_ns(cpu);
 }
 
+static void gt_update_irq(ARMCPU *cpu, int timeridx)
+{
+    CPUARMState *env = &cpu->env;
+    uint64_t cnthctl = env->cp15.cnthctl_el2;
+    ARMSecuritySpace ss = arm_security_space(env);
+    /* ISTATUS && !IMASK */
+    int irqstate = (env->cp15.c14_timer[timeridx].ctl & 6) == 4;
+
+    /*
+     * If bit CNTHCTL_EL2.CNT[VP]MASK is set, it overrides IMASK.
+     * It is RES0 in Secure and NonSecure state.
+     */
+    if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
+        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        irqstate = 0;
+    }
+
+    qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
+    trace_arm_gt_update_irq(timeridx, irqstate);
+}
+
+void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
+{
+    /*
+     * Changing security state between Root and Secure/NonSecure, which may
+     * happen when switching EL, can change the effective value of CNTHCTL_EL2
+     * mask bits. Update the IRQ state accordingly.
+     */
+    gt_update_irq(cpu, GTIMER_VIRT);
+    gt_update_irq(cpu, GTIMER_PHYS);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -2623,13 +2656,9 @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
         uint64_t nexttick;
-        int irqstate;
 
         gt->ctl = deposit32(gt->ctl, 2, 1, istatus);
 
-        irqstate = (istatus && !(gt->ctl & 2));
-        qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
-
         if (istatus) {
             /* Next transition is when count rolls back over to zero */
             nexttick = UINT64_MAX;
@@ -2648,14 +2677,14 @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
         } else {
             timer_mod(cpu->gt_timer[timeridx], nexttick);
         }
-        trace_arm_gt_recalc(timeridx, irqstate, nexttick);
+        trace_arm_gt_recalc(timeridx, nexttick);
     } else {
         /* Timer disabled: ISTATUS and timer output always clear */
         gt->ctl &= ~4;
-        qemu_set_irq(cpu->gt_timer_outputs[timeridx], 0);
         timer_del(cpu->gt_timer[timeridx]);
         trace_arm_gt_recalc_disabled(timeridx);
     }
+    gt_update_irq(cpu, timeridx);
 }
 
 static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -2759,10 +2788,8 @@ static void gt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
          * IMASK toggled: don't need to recalculate,
          * just set the interrupt line based on ISTATUS
          */
-        int irqstate = (oldval & 4) && !(value & 2);
-
-        trace_arm_gt_imask_toggle(timeridx, irqstate);
-        qemu_set_irq(cpu->gt_timer_outputs[timeridx], irqstate);
+        trace_arm_gt_imask_toggle(timeridx);
+        gt_update_irq(cpu, timeridx);
     }
 }
 
@@ -2888,6 +2915,21 @@ static void gt_virt_ctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     gt_ctl_write(env, ri, GTIMER_VIRT, value);
 }
 
+static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    uint32_t oldval = env->cp15.cnthctl_el2;
+
+    raw_write(env, ri, value);
+
+    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+        gt_update_irq(cpu, GTIMER_VIRT);
+    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+        gt_update_irq(cpu, GTIMER_PHYS);
+    }
+}
+
 static void gt_cntvoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
                               uint64_t value)
 {
@@ -6203,7 +6245,8 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
        * reset values as IMPDEF. We choose to reset to 3 to comply with
        * both ARMv7 and ARMv8.
        */
-      .access = PL2_RW, .resetvalue = 3,
+      .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 3,
+      .writefn = gt_cnthctl_write, .raw_writefn = raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.cnthctl_el2) },
     { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index 2a0ba7bffc..48cc0512db 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -1,13 +1,14 @@
 # See docs/devel/tracing.rst for syntax documentation.
 
 # helper.c
-arm_gt_recalc(int timer, int irqstate, uint64_t nexttick) "gt recalc: timer %d irqstate %d next tick 0x%" PRIx64
-arm_gt_recalc_disabled(int timer) "gt recalc: timer %d irqstate 0 timer disabled"
+arm_gt_recalc(int timer, uint64_t nexttick) "gt recalc: timer %d next tick 0x%" PRIx64
+arm_gt_recalc_disabled(int timer) "gt recalc: timer %d timer disabled"
 arm_gt_cval_write(int timer, uint64_t value) "gt_cval_write: timer %d value 0x%" PRIx64
 arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%" PRIx64
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
-arm_gt_imask_toggle(int timer, int irqstate) "gt_ctl_write: timer %d IMASK toggle, new irqstate %d"
+arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
 kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64

From 4b3520fd93cd49cc56dfcab45d90735cc2e35af7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 22 Aug 2023 17:31:13 +0100
Subject: [PATCH 1153/1353] target/arm: Fix SME ST1Q
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A typo, noted in the bug report, resulting in an
incorrect write offset.

Cc: qemu-stable@nongnu.org
Fixes: 7390e0e9ab8 ("target/arm: Implement SME LD1, ST1")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1833
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230818214255.146905-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index 1e67fcac30..296826ffe6 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -379,7 +379,7 @@ static inline void HNAME##_host(void *za, intptr_t off, void *host)         \
 {                                                                           \
     uint64_t *ptr = za + off;                                               \
     HOST(host, ptr[BE]);                                                    \
-    HOST(host + 1, ptr[!BE]);                                               \
+    HOST(host + 8, ptr[!BE]);                                               \
 }                                                                           \
 static inline void VNAME##_v_host(void *za, intptr_t off, void *host)       \
 {                                                                           \

From cd1e4db73646006039f25879af3bff55b2295ff3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 22 Aug 2023 17:31:14 +0100
Subject: [PATCH 1154/1353] target/arm: Fix 64-bit SSRA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Typo applied byte-wise shift instead of double-word shift.

Cc: qemu-stable@nongnu.org
Fixes: 631e565450c ("target/arm: Create gen_gvec_[us]sra")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1737
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230821022025.397682-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index b71ac2d0d5..39541ecdf0 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -3053,7 +3053,7 @@ void gen_gvec_ssra(unsigned vece, uint32_t rd_ofs, uint32_t rm_ofs,
           .vece = MO_32 },
         { .fni8 = gen_ssra64_i64,
           .fniv = gen_ssra_vec,
-          .fno = gen_helper_gvec_ssra_b,
+          .fno = gen_helper_gvec_ssra_d,
           .prefer_i64 = TCG_TARGET_REG_BITS == 64,
           .opt_opc = vecop_list,
           .load_dest = true,

From 95f5c89ecaf0f5ecedc660831ace68f291a7113f Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Tue, 18 Jul 2023 16:22:35 +0200
Subject: [PATCH 1155/1353] hw: Add compat machines for 8.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add 8.2 machine types for arm/i440fx/m68k/q35/s390x/spapr.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <20230718142235.135319-1-cohuck@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Laurent Vivier <laurent@vivier.eu>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/arm/virt.c              | 11 +++++++++--
 hw/core/machine.c          |  3 +++
 hw/i386/pc.c               |  3 +++
 hw/i386/pc_piix.c          | 16 +++++++++++++---
 hw/i386/pc_q35.c           | 14 ++++++++++++--
 hw/m68k/virt.c             | 11 +++++++++--
 hw/ppc/spapr.c             | 17 ++++++++++++++---
 hw/s390x/s390-virtio-ccw.c | 14 +++++++++++++-
 include/hw/boards.h        |  3 +++
 include/hw/i386/pc.h       |  3 +++
 10 files changed, 82 insertions(+), 13 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 7d9dbc2663..2a560271b5 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3170,10 +3170,17 @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
-static void virt_machine_8_1_options(MachineClass *mc)
+static void virt_machine_8_2_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(8, 1)
+DEFINE_VIRT_MACHINE_AS_LATEST(8, 2)
+
+static void virt_machine_8_1_options(MachineClass *mc)
+{
+    virt_machine_8_2_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_8_1, hw_compat_8_1_len);
+}
+DEFINE_VIRT_MACHINE(8, 1)
 
 static void virt_machine_8_0_options(MachineClass *mc)
 {
diff --git a/hw/core/machine.c b/hw/core/machine.c
index f0d35c6401..da699cf4e1 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -39,6 +39,9 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-pci.h"
 
+GlobalProperty hw_compat_8_1[] = {};
+const size_t hw_compat_8_1_len = G_N_ELEMENTS(hw_compat_8_1);
+
 GlobalProperty hw_compat_8_0[] = {
     { "migration", "multifd-flush-after-each-section", "on"},
     { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 3109d5e0e0..54838c0c41 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -114,6 +114,9 @@
     { "qemu64-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },\
     { "athlon-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },
 
+GlobalProperty pc_compat_8_1[] = {};
+const size_t pc_compat_8_1_len = G_N_ELEMENTS(pc_compat_8_1);
+
 GlobalProperty pc_compat_8_0[] = {
     { "virtio-mem", "unplugged-inaccessible", "auto" },
 };
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index ac72e8f5be..ce1ac95274 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -504,13 +504,25 @@ static void pc_i440fx_machine_options(MachineClass *m)
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_VMBUS_BRIDGE);
 }
 
-static void pc_i440fx_8_1_machine_options(MachineClass *m)
+static void pc_i440fx_8_2_machine_options(MachineClass *m)
 {
     pc_i440fx_machine_options(m);
     m->alias = "pc";
     m->is_default = true;
 }
 
+DEFINE_I440FX_MACHINE(v8_2, "pc-i440fx-8.2", NULL,
+                      pc_i440fx_8_2_machine_options);
+
+static void pc_i440fx_8_1_machine_options(MachineClass *m)
+{
+    pc_i440fx_8_2_machine_options(m);
+    m->alias = NULL;
+    m->is_default = false;
+    compat_props_add(m->compat_props, hw_compat_8_1, hw_compat_8_1_len);
+    compat_props_add(m->compat_props, pc_compat_8_1, pc_compat_8_1_len);
+}
+
 DEFINE_I440FX_MACHINE(v8_1, "pc-i440fx-8.1", NULL,
                       pc_i440fx_8_1_machine_options);
 
@@ -519,8 +531,6 @@ static void pc_i440fx_8_0_machine_options(MachineClass *m)
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 
     pc_i440fx_8_1_machine_options(m);
-    m->alias = NULL;
-    m->is_default = false;
     compat_props_add(m->compat_props, hw_compat_8_0, hw_compat_8_0_len);
     compat_props_add(m->compat_props, pc_compat_8_0, pc_compat_8_0_len);
 
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index dc27a9e223..37c4814bed 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -379,12 +379,23 @@ static void pc_q35_machine_options(MachineClass *m)
     machine_class_allow_dynamic_sysbus_dev(m, TYPE_VMBUS_BRIDGE);
 }
 
-static void pc_q35_8_1_machine_options(MachineClass *m)
+static void pc_q35_8_2_machine_options(MachineClass *m)
 {
     pc_q35_machine_options(m);
     m->alias = "q35";
 }
 
+DEFINE_Q35_MACHINE(v8_2, "pc-q35-8.2", NULL,
+                   pc_q35_8_2_machine_options);
+
+static void pc_q35_8_1_machine_options(MachineClass *m)
+{
+    pc_q35_8_2_machine_options(m);
+    m->alias = NULL;
+    compat_props_add(m->compat_props, hw_compat_8_1, hw_compat_8_1_len);
+    compat_props_add(m->compat_props, pc_compat_8_1, pc_compat_8_1_len);
+}
+
 DEFINE_Q35_MACHINE(v8_1, "pc-q35-8.1", NULL,
                    pc_q35_8_1_machine_options);
 
@@ -393,7 +404,6 @@ static void pc_q35_8_0_machine_options(MachineClass *m)
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 
     pc_q35_8_1_machine_options(m);
-    m->alias = NULL;
     compat_props_add(m->compat_props, hw_compat_8_0, hw_compat_8_0_len);
     compat_props_add(m->compat_props, pc_compat_8_0, pc_compat_8_0_len);
 
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index de91726cf9..2dd3c99894 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -347,10 +347,17 @@ type_init(virt_machine_register_types)
     } \
     type_init(machvirt_machine_##major##_##minor##_init);
 
-static void virt_machine_8_1_options(MachineClass *mc)
+static void virt_machine_8_2_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE(8, 1, true)
+DEFINE_VIRT_MACHINE(8, 2, true)
+
+static void virt_machine_8_1_options(MachineClass *mc)
+{
+    virt_machine_8_2_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_8_1, hw_compat_8_1_len);
+}
+DEFINE_VIRT_MACHINE(8, 1, false)
 
 static void virt_machine_8_0_options(MachineClass *mc)
 {
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 1c8b8d57a7..622fea8256 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4753,14 +4753,25 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     type_init(spapr_machine_register_##suffix)
 
 /*
- * pseries-8.1
+ * pseries-8.2
  */
-static void spapr_machine_8_1_class_options(MachineClass *mc)
+static void spapr_machine_8_2_class_options(MachineClass *mc)
 {
     /* Defaults for the latest behaviour inherited from the base class */
 }
 
-DEFINE_SPAPR_MACHINE(8_1, "8.1", true);
+DEFINE_SPAPR_MACHINE(8_2, "8.2", true);
+
+/*
+ * pseries-8.1
+ */
+static void spapr_machine_8_1_class_options(MachineClass *mc)
+{
+    spapr_machine_8_2_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_8_1, hw_compat_8_1_len);
+}
+
+DEFINE_SPAPR_MACHINE(8_1, "8.1", false);
 
 /*
  * pseries-8.0
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 4516d73ff5..c52a1fcf67 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -828,14 +828,26 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 
+static void ccw_machine_8_2_instance_options(MachineState *machine)
+{
+}
+
+static void ccw_machine_8_2_class_options(MachineClass *mc)
+{
+}
+DEFINE_CCW_MACHINE(8_2, "8.2", true);
+
 static void ccw_machine_8_1_instance_options(MachineState *machine)
 {
+    ccw_machine_8_2_instance_options(machine);
 }
 
 static void ccw_machine_8_1_class_options(MachineClass *mc)
 {
+    ccw_machine_8_2_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_8_1, hw_compat_8_1_len);
 }
-DEFINE_CCW_MACHINE(8_1, "8.1", true);
+DEFINE_CCW_MACHINE(8_1, "8.1", false);
 
 static void ccw_machine_8_0_instance_options(MachineState *machine)
 {
diff --git a/include/hw/boards.h b/include/hw/boards.h
index ed83360198..3b541ffd24 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -390,6 +390,9 @@ struct MachineState {
     } \
     type_init(machine_initfn##_register_types)
 
+extern GlobalProperty hw_compat_8_1[];
+extern const size_t hw_compat_8_1_len;
+
 extern GlobalProperty hw_compat_8_0[];
 extern const size_t hw_compat_8_0_len;
 
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index d54e8b1101..0fabece236 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -200,6 +200,9 @@ void pc_madt_cpu_entry(int uid, const CPUArchIdList *apic_ids,
 /* sgx.c */
 void pc_machine_init_sgx_epc(PCMachineState *pcms);
 
+extern GlobalProperty pc_compat_8_1[];
+extern const size_t pc_compat_8_1_len;
+
 extern GlobalProperty pc_compat_8_0[];
 extern const size_t pc_compat_8_0_len;
 

From f4a69168ffb863ebc9f92465d683bcba71eb9318 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Fri, 4 Aug 2023 10:04:15 +0200
Subject: [PATCH 1156/1353] s390x: Convert DPRINTF to trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Output message are slightly modified to ease selection with wildcards
and to report extra parameters.

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20230804080415.56852-1-clg@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-pci-bus.c       | 25 ++++++------------
 hw/s390x/s390-pci-inst.c      | 48 ++++++++++++++---------------------
 hw/s390x/trace-events         | 17 +++++++++++++
 target/s390x/kvm/kvm.c        | 33 ++++++++----------------
 target/s390x/kvm/trace-events |  7 +++++
 5 files changed, 62 insertions(+), 68 deletions(-)

diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index 02751f3597..2ca36f9f3b 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -27,16 +27,7 @@
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
 
-#ifndef DEBUG_S390PCI_BUS
-#define DEBUG_S390PCI_BUS  0
-#endif
-
-#define DPRINTF(fmt, ...)                                         \
-    do {                                                          \
-        if (DEBUG_S390PCI_BUS) {                                  \
-            fprintf(stderr, "S390pci-bus: " fmt, ## __VA_ARGS__); \
-        }                                                         \
-    } while (0)
+#include "trace.h"
 
 S390pciState *s390_get_phb(void)
 {
@@ -132,7 +123,7 @@ void s390_pci_sclp_configure(SCCB *sccb)
     uint16_t rc;
 
     if (!pbdev) {
-        DPRINTF("sclp config no dev found\n");
+        trace_s390_pci_sclp_nodev("configure", be32_to_cpu(psccb->aid));
         rc = SCLP_RC_ADAPTER_ID_NOT_RECOGNIZED;
         goto out;
     }
@@ -199,7 +190,7 @@ void s390_pci_sclp_deconfigure(SCCB *sccb)
     uint16_t rc;
 
     if (!pbdev) {
-        DPRINTF("sclp deconfig no dev found\n");
+        trace_s390_pci_sclp_nodev("deconfigure", be32_to_cpu(psccb->aid));
         rc = SCLP_RC_ADAPTER_ID_NOT_RECOGNIZED;
         goto out;
     }
@@ -573,7 +564,7 @@ static IOMMUTLBEntry s390_translate_iommu(IOMMUMemoryRegion *mr, hwaddr addr,
         return ret;
     }
 
-    DPRINTF("iommu trans addr 0x%" PRIx64 "\n", addr);
+    trace_s390_pci_iommu_xlate(addr);
 
     if (addr < iommu->pba || addr > iommu->pal) {
         error = ERR_EVENT_OORANGE;
@@ -692,8 +683,8 @@ static void s390_msi_ctrl_write(void *opaque, hwaddr addr, uint64_t data,
     uint32_t sum_bit;
 
     assert(pbdev);
-    DPRINTF("write_msix data 0x%" PRIx64 " idx %d vec 0x%x\n", data,
-            pbdev->idx, vec);
+
+    trace_s390_pci_msi_ctrl_write(data, pbdev->idx, vec);
 
     if (pbdev->state != ZPCI_FS_ENABLED) {
         return;
@@ -843,7 +834,7 @@ static void s390_pcihost_realize(DeviceState *dev, Error **errp)
     PCIHostState *phb = PCI_HOST_BRIDGE(dev);
     S390pciState *s = S390_PCI_HOST_BRIDGE(dev);
 
-    DPRINTF("host_init\n");
+    trace_s390_pcihost("realize");
 
     b = pci_register_root_bus(dev, NULL, s390_pci_set_irq, s390_pci_map_irq,
                               NULL, get_system_memory(), get_system_io(), 0,
@@ -1120,7 +1111,7 @@ static void s390_pcihost_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
                         return;
                     }
                 } else {
-                    DPRINTF("zPCI interpretation facilities missing.\n");
+                    trace_s390_pcihost("zPCI interpretation missing");
                     pbdev->interp = false;
                     pbdev->forwarding_assist = false;
                 }
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 8f84ac6251..30149546c0 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -23,16 +23,7 @@
 #include "hw/s390x/s390-pci-vfio.h"
 #include "hw/s390x/tod.h"
 
-#ifndef DEBUG_S390PCI_INST
-#define DEBUG_S390PCI_INST  0
-#endif
-
-#define DPRINTF(fmt, ...)                                          \
-    do {                                                           \
-        if (DEBUG_S390PCI_INST) {                                  \
-            fprintf(stderr, "s390pci-inst: " fmt, ## __VA_ARGS__); \
-        }                                                          \
-    } while (0)
+#include "trace.h"
 
 static inline void inc_dma_avail(S390PCIIOMMU *iommu)
 {
@@ -133,8 +124,7 @@ static int list_pci(ClpReqRspListPci *rrb, uint8_t *cc)
 
         g_l2 += sizeof(ClpFhListEntry);
         /* Add endian check for DPRINTF? */
-        DPRINTF("g_l2 %d vendor id 0x%x device id 0x%x fid 0x%x fh 0x%x\n",
-                g_l2,
+        trace_s390_pci_list_entry(g_l2,
                 lduw_p(&rrb->response.fh_list[i].vendor_id),
                 lduw_p(&rrb->response.fh_list[i].device_id),
                 ldl_p(&rrb->response.fh_list[i].fid),
@@ -153,7 +143,7 @@ static int list_pci(ClpReqRspListPci *rrb, uint8_t *cc)
     stw_p(&rrb->response.hdr.rsp, CLP_RC_OK);
 out:
     if (rc) {
-        DPRINTF("list pci failed rc 0x%x\n", rc);
+        trace_s390_pci_list(rc);
         stw_p(&rrb->response.hdr.rsp, res_code);
     }
     return rc;
@@ -280,7 +270,7 @@ int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
             break;
         default:
-            DPRINTF("unknown set pci command\n");
+            trace_s390_pci_unknown("set-pci", reqsetpci->oc);
             stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
             break;
         }
@@ -292,7 +282,7 @@ int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
 
         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqquery->fh));
         if (!pbdev) {
-            DPRINTF("query pci no pci dev\n");
+            trace_s390_pci_nodev("query", ldl_p(&reqquery->fh));
             stw_p(&resquery->hdr.rsp, CLP_RC_SETPCIFN_FH);
             goto out;
         }
@@ -317,7 +307,7 @@ int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
             stl_p(&resquery->bar[i], data);
             resquery->bar_size[i] = pbdev->pdev->io_regions[i].size ?
                                     ctz64(pbdev->pdev->io_regions[i].size) : 0;
-            DPRINTF("bar %d addr 0x%x size 0x%" PRIx64 "barsize 0x%x\n", i,
+            trace_s390_pci_bar(i,
                     ldl_p(&resquery->bar[i]),
                     pbdev->pdev->io_regions[i].size,
                     resquery->bar_size[i]);
@@ -351,7 +341,7 @@ int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
         break;
     }
     default:
-        DPRINTF("unknown clp command\n");
+        trace_s390_pci_unknown("clp", lduw_p(&reqh->cmd));
         stw_p(&resh->rsp, CLP_RC_CMD);
         break;
     }
@@ -459,7 +449,7 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 
     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
     if (!pbdev) {
-        DPRINTF("pcilg no pci dev\n");
+        trace_s390_pci_nodev("pcilg", fh);
         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
         return 0;
     }
@@ -500,7 +490,7 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
         }
         break;
     default:
-        DPRINTF("pcilg invalid space\n");
+        trace_s390_pci_invalid("pcilg", fh);
         setcc(cpu, ZPCI_PCI_LS_ERR);
         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
         return 0;
@@ -559,7 +549,7 @@ int pcistg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 
     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
     if (!pbdev) {
-        DPRINTF("pcistg no pci dev\n");
+        trace_s390_pci_nodev("pcistg", fh);
         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
         return 0;
     }
@@ -608,7 +598,7 @@ int pcistg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
                                      data, len);
         break;
     default:
-        DPRINTF("pcistg invalid space\n");
+        trace_s390_pci_invalid("pcistg", fh);
         setcc(cpu, ZPCI_PCI_LS_ERR);
         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
         return 0;
@@ -729,7 +719,7 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 
     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
     if (!pbdev) {
-        DPRINTF("rpcit no pci dev\n");
+        trace_s390_pci_nodev("rpcit", fh);
         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
         return 0;
     }
@@ -863,7 +853,7 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
 
     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
     if (!pbdev) {
-        DPRINTF("pcistb no pci dev fh 0x%x\n", fh);
+        trace_s390_pci_nodev("pcistb", fh);
         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
         return 0;
     }
@@ -879,7 +869,7 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
     }
 
     if (pcias > ZPCI_IO_BAR_MAX) {
-        DPRINTF("pcistb invalid space\n");
+        trace_s390_pci_invalid("pcistb", fh);
         setcc(cpu, ZPCI_PCI_LS_ERR);
         s390_set_status_code(env, r1, ZPCI_PCI_ST_INVAL_AS);
         return 0;
@@ -971,7 +961,7 @@ static int reg_irqs(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib)
     pbdev->noi = FIB_DATA_NOI(ldl_p(&fib.data));
     pbdev->sum = FIB_DATA_SUM(ldl_p(&fib.data));
 
-    DPRINTF("reg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
+    trace_s390_pci_irqs("register", pbdev->routes.adapter.adapter_id);
     return 0;
 out:
     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
@@ -996,7 +986,7 @@ int pci_dereg_irqs(S390PCIBusDevice *pbdev)
     pbdev->noi = 0;
     pbdev->sum = 0;
 
-    DPRINTF("dereg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
+    trace_s390_pci_irqs("unregister", pbdev->routes.adapter.adapter_id);
     return 0;
 }
 
@@ -1139,7 +1129,7 @@ static int mpcifc_reg_int_interp(S390PCIBusDevice *pbdev, ZpciFib *fib)
 
     rc = s390_pci_kvm_aif_enable(pbdev, fib, pbdev->forwarding_assist);
     if (rc) {
-        DPRINTF("Failed to enable interrupt forwarding\n");
+        trace_s390_pci_kvm_aif("enable");
         return rc;
     }
 
@@ -1152,7 +1142,7 @@ static int mpcifc_dereg_int_interp(S390PCIBusDevice *pbdev, ZpciFib *fib)
 
     rc = s390_pci_kvm_aif_disable(pbdev);
     if (rc) {
-        DPRINTF("Failed to disable interrupt forwarding\n");
+        trace_s390_pci_kvm_aif("disable");
         return rc;
     }
 
@@ -1185,7 +1175,7 @@ int mpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
 
     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
     if (!pbdev) {
-        DPRINTF("mpcifc no pci dev fh 0x%x\n", fh);
+        trace_s390_pci_nodev("mpcifc", fh);
         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
         return 0;
     }
diff --git a/hw/s390x/trace-events b/hw/s390x/trace-events
index 8b9213eab9..34da5ea323 100644
--- a/hw/s390x/trace-events
+++ b/hw/s390x/trace-events
@@ -19,3 +19,20 @@ virtio_ccw_set_ind(uint64_t ind_loc, uint8_t ind_old, uint8_t ind_new) "VIRTIO-C
 s390_pci_clp_cap(const char *id, uint32_t cap) "PCI: %s: missing expected CLP capability %u"
 s390_pci_clp_cap_size(const char *id, uint32_t size, uint32_t cap) "PCI: %s: bad size (%u) for CLP capability %u"
 s390_pci_clp_dev_info(const char *id) "PCI: %s: cannot read vfio device info"
+
+# s390-pci-bus.c
+s390_pci_sclp_nodev(const char *str, uint32_t aid) "%s no dev found aid 0x%x"
+s390_pci_iommu_xlate(uint64_t addr) "iommu trans addr 0x%" PRIx64
+s390_pci_msi_ctrl_write(uint64_t data, uint32_t idx, uint32_t vec) "write_msix data 0x%" PRIx64 " idx %d vec 0x%x"
+s390_pcihost(const char *msg) "%s"
+
+# s390-pci-inst.c
+s390_pci_irqs(const char *str, uint32_t id) "%s irqs for adapter id %d"
+s390_pci_kvm_aif(const char *str) "Failed to %s interrupt forwarding"
+
+s390_pci_list_entry(uint32_t g_l2, uint32_t vid, uint32_t did, uint32_t fid, uint32_t fh) "g_l2 %d vendor id 0x%x device id 0x%x fid 0x%x fh 0x%x"
+s390_pci_list(uint32_t rc) "failed rc 0x%x"
+s390_pci_unknown(const char *msg, uint32_t cmd) "%s unknown command 0x%x"
+s390_pci_bar(uint32_t bar, uint32_t addr, uint64_t size, uint32_t barsize) "bar %d addr 0x%x size 0x%" PRIx64 "barsize 0x%x"
+s390_pci_nodev(const char *cmd, uint32_t fh) "%s no pci dev fh 0x%x"
+s390_pci_invalid(const char *cmd, uint32_t fh) "%s invalid space fh 0x%x"
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index a9e5880349..c47a4a2c13 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -52,16 +52,6 @@
 #include "hw/s390x/s390-virtio-hcall.h"
 #include "target/s390x/kvm/pv.h"
 
-#ifndef DEBUG_KVM
-#define DEBUG_KVM  0
-#endif
-
-#define DPRINTF(fmt, ...) do {                \
-    if (DEBUG_KVM) {                          \
-        fprintf(stderr, fmt, ## __VA_ARGS__); \
-    }                                         \
-} while (0)
-
 #define kvm_vm_check_mem_attr(s, attr) \
     kvm_vm_check_attr(s, KVM_S390_VM_MEM_CTRL, attr)
 
@@ -912,11 +902,11 @@ static void determine_sw_breakpoint_instr(void)
         if (kvm_vm_enable_cap(kvm_state, KVM_CAP_S390_USER_INSTR0, 0)) {
             sw_bp_inst = diag_501;
             sw_bp_ilen = sizeof(diag_501);
-            DPRINTF("KVM: will use 4-byte sw breakpoints.\n");
+            trace_kvm_sw_breakpoint(4);
         } else {
             sw_bp_inst = instr_0x0000;
             sw_bp_ilen = sizeof(instr_0x0000);
-            DPRINTF("KVM: will use 2-byte sw breakpoints.\n");
+            trace_kvm_sw_breakpoint(2);
         }
 }
 
@@ -1307,7 +1297,7 @@ static int handle_b2(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
         break;
     default:
         rc = -1;
-        DPRINTF("KVM: unhandled PRIV: 0xb2%x\n", ipa1);
+        trace_kvm_insn_unhandled_priv(ipa1);
         break;
     }
 
@@ -1487,7 +1477,7 @@ static int handle_b9(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
         break;
     default:
         r = -1;
-        DPRINTF("KVM: unhandled PRIV: 0xb9%x\n", ipa1);
+        trace_kvm_insn_unhandled_priv(ipa1);
         break;
     }
 
@@ -1511,7 +1501,7 @@ static int handle_eb(S390CPU *cpu, struct kvm_run *run, uint8_t ipbl)
         break;
     default:
         r = -1;
-        DPRINTF("KVM: unhandled PRIV: 0xeb%x\n", ipbl);
+        trace_kvm_insn_unhandled_priv(ipbl);
         break;
     }
 
@@ -1531,7 +1521,7 @@ static int handle_e3(S390CPU *cpu, struct kvm_run *run, uint8_t ipbl)
         break;
     default:
         r = -1;
-        DPRINTF("KVM: unhandled PRIV: 0xe3%x\n", ipbl);
+        trace_kvm_insn_unhandled_priv(ipbl);
         break;
     }
 
@@ -1654,7 +1644,7 @@ static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb)
         r = handle_sw_breakpoint(cpu, run);
         break;
     default:
-        DPRINTF("KVM: unknown DIAG: 0x%x\n", func_code);
+        trace_kvm_insn_diag(func_code);
         kvm_s390_program_interrupt(cpu, PGM_SPECIFICATION);
         break;
     }
@@ -1684,8 +1674,7 @@ static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
     uint8_t ipa1 = run->s390_sieic.ipa & 0x00ff;
     int r = -1;
 
-    DPRINTF("handle_instruction 0x%x 0x%x\n",
-            run->s390_sieic.ipa, run->s390_sieic.ipb);
+    trace_kvm_insn(run->s390_sieic.ipa, run->s390_sieic.ipb);
     switch (ipa0) {
     case IPA0_B2:
         r = handle_b2(cpu, run, ipa1);
@@ -1765,7 +1754,7 @@ static int handle_intercept(S390CPU *cpu)
     int icpt_code = run->s390_sieic.icptcode;
     int r = 0;
 
-    DPRINTF("intercept: 0x%x (at 0x%lx)\n", icpt_code, (long)run->psw_addr);
+    trace_kvm_intercept(icpt_code, (long)run->psw_addr);
     switch (icpt_code) {
         case ICPT_INSTRUCTION:
         case ICPT_PV_INSTR:
@@ -2150,13 +2139,13 @@ int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
     uint32_t vec = data & ZPCI_MSI_VEC_MASK;
 
     if (!dev) {
-        DPRINTF("add_msi_route no pci device\n");
+        trace_kvm_msi_route_fixup("no pci device");
         return -ENODEV;
     }
 
     pbdev = s390_pci_find_dev_by_target(s390_get_phb(), DEVICE(dev)->id);
     if (!pbdev) {
-        DPRINTF("add_msi_route no zpci device\n");
+        trace_kvm_msi_route_fixup("no zpci device");
         return -ENODEV;
     }
 
diff --git a/target/s390x/kvm/trace-events b/target/s390x/kvm/trace-events
index 5289f5f675..818f1a37a1 100644
--- a/target/s390x/kvm/trace-events
+++ b/target/s390x/kvm/trace-events
@@ -5,3 +5,10 @@ kvm_enable_cmma(int rc) "CMMA: enabling with result code %d"
 kvm_clear_cmma(int rc) "CMMA: clearing with result code %d"
 kvm_failed_cpu_state_set(int cpu_index, uint8_t state, const char *msg) "Warning: Unable to set cpu %d state %" PRIu8 " to KVM: %s"
 kvm_assign_subch_ioeventfd(int fd, uint32_t addr, bool assign, int datamatch) "fd: %d sch: @0x%x assign: %d vq: %d"
+
+kvm_sw_breakpoint(uint32_t n) "KVM: will use %d-byte sw breakpoints"
+kvm_insn_unhandled_priv(uint32_t x) "KVM: unhandled PRIV: 0x%x"
+kvm_insn_diag(uint32_t x) "KVM: unknown DIAG: 0x%x"
+kvm_insn(uint32_t ipa, uint32_t ipb) "handle_instruction 0x%x 0x%x"
+kvm_intercept(uint32_t icpt_code, uint64_t psw_addr) "intercept: 0x%x (at 0x%"PRIx64"lx)"
+kvm_msi_route_fixup(const char* msg) "%s"

From 6a2ea6151835aa4f5fee29382a421c13b0e6619f Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Sat, 5 Aug 2023 01:46:10 +0200
Subject: [PATCH 1157/1353] target/s390x: Check reserved bits of VFMIN/VFMAX's
 M5

VFMIN and VFMAX should raise a specification exceptions when bits 1-3
of M5 are set.

Cc: qemu-stable@nongnu.org
Fixes: da4807527f3b ("s390x/tcg: Implement VECTOR FP (MAXIMUM|MINIMUM)")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230804234621.252522-1-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate_vx.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/translate_vx.c.inc b/target/s390x/tcg/translate_vx.c.inc
index f8df121d3d..b5d07d5ec5 100644
--- a/target/s390x/tcg/translate_vx.c.inc
+++ b/target/s390x/tcg/translate_vx.c.inc
@@ -3047,7 +3047,7 @@ static DisasJumpType op_vfmax(DisasContext *s, DisasOps *o)
     const uint8_t m5 = get_field(s, m5);
     gen_helper_gvec_3_ptr *fn;
 
-    if (m6 == 5 || m6 == 6 || m6 == 7 || m6 >= 13) {
+    if (m6 == 5 || m6 == 6 || m6 == 7 || m6 >= 13 || (m5 & 7)) {
         gen_program_exception(s, PGM_SPECIFICATION);
         return DISAS_NORETURN;
     }

From 6db3518ba4fcddd71049718f138552999f0d97b4 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Sat, 5 Aug 2023 01:55:33 +0200
Subject: [PATCH 1158/1353] target/s390x: Fix VSTL with a large length

The length is always truncated to 16 bytes. Do not probe more than
that.

Cc: qemu-stable@nongnu.org
Fixes: 0e0a5b49ad58 ("s390x/tcg: Implement VECTOR STORE WITH LENGTH")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230804235624.263260-1-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/vec_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/vec_helper.c b/target/s390x/tcg/vec_helper.c
index 48d86722b2..dafc4c3582 100644
--- a/target/s390x/tcg/vec_helper.c
+++ b/target/s390x/tcg/vec_helper.c
@@ -193,7 +193,7 @@ void HELPER(vstl)(CPUS390XState *env, const void *v1, uint64_t addr,
                   uint64_t bytes)
 {
     /* Probe write access before actually modifying memory */
-    probe_write_access(env, addr, bytes, GETPC());
+    probe_write_access(env, addr, MIN(bytes, 16), GETPC());
 
     if (likely(bytes >= 16)) {
         cpu_stq_data_ra(env, addr, s390_vec_read_element64(v1, 0), GETPC());

From 93af6e0a61f45fe0704e27f04e759924afa59e6e Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Sat, 5 Aug 2023 01:55:34 +0200
Subject: [PATCH 1159/1353] tests/tcg/s390x: Test VSTL

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230804235624.263260-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/vstl.c          | 37 +++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 tests/tcg/s390x/vstl.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index 1fc9809907..e280c8c280 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -59,6 +59,7 @@ Z13_TESTS=vistr
 Z13_TESTS+=lcbb
 Z13_TESTS+=locfhr
 Z13_TESTS+=vcksm
+Z13_TESTS+=vstl
 $(Z13_TESTS): CFLAGS+=-march=z13 -O2
 TESTS+=$(Z13_TESTS)
 
diff --git a/tests/tcg/s390x/vstl.c b/tests/tcg/s390x/vstl.c
new file mode 100644
index 0000000000..bece952c7e
--- /dev/null
+++ b/tests/tcg/s390x/vstl.c
@@ -0,0 +1,37 @@
+/*
+ * Test the VSTL instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <stdlib.h>
+#include "vx.h"
+
+static inline void vstl(S390Vector *v1, void *db2, size_t r3)
+{
+    asm("vstl %[v1],%[r3],%[db2]"
+        : [db2] "=Q" (*(char *)db2)
+        : [v1] "v" (v1->v), [r3] "r" (r3)
+        : "memory");
+}
+
+int main(void)
+{
+    uint64_t buf[3] = {0x1122334455667788ULL, 0x99aabbccddeeffULL,
+                       0x5a5a5a5a5a5a5a5aULL};
+    S390Vector v = {.d[0] = 0x1234567887654321ULL,
+                    .d[1] = 0x9abcdef00fedcba9ULL};
+
+    vstl(&v, buf, 0);
+    assert(buf[0] == 0x1222334455667788ULL);
+
+    vstl(&v, buf, 1);
+    assert(buf[0] == 0x1234334455667788ULL);
+
+    vstl(&v, buf, -1);
+    assert(buf[0] == 0x1234567887654321ULL);
+    assert(buf[1] == 0x9abcdef00fedcba9ULL);
+    assert(buf[2] == 0x5a5a5a5a5a5a5a5aULL);
+
+    return EXIT_SUCCESS;
+}

From 23e87d419f347b6b5f4da3bf70d222acc24cdb64 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 7 Aug 2023 18:34:31 +0200
Subject: [PATCH 1160/1353] target/s390x: Use a 16-bit immediate in VREP

Unlike most other instructions that contain an immediate element index,
VREP's one is 16-bit, and not 4-bit. The code uses only 8 bits, so
using, e.g., 0x101 does not lead to a specification exception.

Fix by checking all 16 bits.

Cc: qemu-stable@nongnu.org
Fixes: 28d08731b1d8 ("s390x/tcg: Implement VECTOR REPLICATE")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230807163459.849766-1-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate_vx.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/s390x/tcg/translate_vx.c.inc b/target/s390x/tcg/translate_vx.c.inc
index b5d07d5ec5..ec94d39df0 100644
--- a/target/s390x/tcg/translate_vx.c.inc
+++ b/target/s390x/tcg/translate_vx.c.inc
@@ -57,7 +57,7 @@
 #define FPF_LONG        3
 #define FPF_EXT         4
 
-static inline bool valid_vec_element(uint8_t enr, MemOp es)
+static inline bool valid_vec_element(uint16_t enr, MemOp es)
 {
     return !(enr & ~(NUM_VEC_ELEMENTS(es) - 1));
 }
@@ -964,7 +964,7 @@ static DisasJumpType op_vpdi(DisasContext *s, DisasOps *o)
 
 static DisasJumpType op_vrep(DisasContext *s, DisasOps *o)
 {
-    const uint8_t enr = get_field(s, i2);
+    const uint16_t enr = get_field(s, i2);
     const uint8_t es = get_field(s, m4);
 
     if (es > ES_64 || !valid_vec_element(enr, es)) {

From 024d7cafd9b888dfcc5976513d808f5ba4508054 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 7 Aug 2023 18:34:32 +0200
Subject: [PATCH 1161/1353] tests/tcg/s390x: Test VREP

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230807163459.849766-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/vrep.c          | 81 +++++++++++++++++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 tests/tcg/s390x/vrep.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index e280c8c280..a6062b5c07 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -60,6 +60,7 @@ Z13_TESTS+=lcbb
 Z13_TESTS+=locfhr
 Z13_TESTS+=vcksm
 Z13_TESTS+=vstl
+Z13_TESTS+=vrep
 $(Z13_TESTS): CFLAGS+=-march=z13 -O2
 TESTS+=$(Z13_TESTS)
 
diff --git a/tests/tcg/s390x/vrep.c b/tests/tcg/s390x/vrep.c
new file mode 100644
index 0000000000..d5a3bd8eb2
--- /dev/null
+++ b/tests/tcg/s390x/vrep.c
@@ -0,0 +1,81 @@
+/*
+ * Test the VREP instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "vx.h"
+
+static void handle_sigill(int sig, siginfo_t *info, void *ucontext)
+{
+    mcontext_t *mcontext = &((ucontext_t *)ucontext)->uc_mcontext;
+    char *insn = (char *)info->si_addr;
+
+    if (insn[0] != 0xe7 || insn[5] != 0x4d) {
+        _exit(EXIT_FAILURE);
+    }
+
+    mcontext->gregs[2] = SIGILL;
+}
+
+static inline __attribute__((__always_inline__)) unsigned long
+vrep(S390Vector *v1, const S390Vector *v3, const uint16_t i2, const uint8_t m4)
+{
+    register unsigned long sig asm("r2") = -1;
+
+    asm("vrep %[v1],%[v3],%[i2],%[m4]\n"
+        : [v1] "=v" (v1->v)
+        , [sig] "+r" (sig)
+        : [v3] "v" (v3->v)
+        , [i2] "i" (i2)
+        , [m4] "i" (m4));
+
+    return sig;
+}
+
+int main(int argc, char *argv[])
+{
+    S390Vector v3 = {.d[0] = 1, .d[1] = 2};
+    struct sigaction act;
+    S390Vector v1;
+    int err;
+
+    memset(&act, 0, sizeof(act));
+    act.sa_sigaction = handle_sigill;
+    act.sa_flags = SA_SIGINFO;
+    err = sigaction(SIGILL, &act, NULL);
+    assert(err == 0);
+
+    assert(vrep(&v1, &v3, 7, 0) == -1);
+    assert(v1.d[0] == 0x0101010101010101ULL);
+    assert(v1.d[1] == 0x0101010101010101ULL);
+
+    assert(vrep(&v1, &v3, 7, 1) == -1);
+    assert(v1.d[0] == 0x0002000200020002ULL);
+    assert(v1.d[1] == 0x0002000200020002ULL);
+
+    assert(vrep(&v1, &v3, 1, 2) == -1);
+    assert(v1.d[0] == 0x0000000100000001ULL);
+    assert(v1.d[1] == 0x0000000100000001ULL);
+
+    assert(vrep(&v1, &v3, 1, 3) == -1);
+    assert(v1.d[0] == 2);
+    assert(v1.d[1] == 2);
+
+    assert(vrep(&v1, &v3, 0x10, 0) == SIGILL);
+    assert(vrep(&v1, &v3, 0x101, 0) == SIGILL);
+    assert(vrep(&v1, &v3, 0x8, 1) == SIGILL);
+    assert(vrep(&v1, &v3, 0x108, 1) == SIGILL);
+    assert(vrep(&v1, &v3, 0x4, 2) == SIGILL);
+    assert(vrep(&v1, &v3, 0x104, 2) == SIGILL);
+    assert(vrep(&v1, &v3, 0x2, 3) == SIGILL);
+    assert(vrep(&v1, &v3, 0x102, 3) == SIGILL);
+
+    return EXIT_SUCCESS;
+}

From ce5943792f4bc6792f37c09c4575f91c4f37ff0b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 4 Aug 2023 09:35:25 +0200
Subject: [PATCH 1162/1353] hw/s390x/s390-virtio-ccw: Remove superfluous code
 to set the NIC model

The check for nd->model being NULL was originally required, but in
commit e11f463295d95aba ("s390x/virtio: use qemu_check_nic_model()")
the corresponding code had been replaced by a call to the function
qemu_check_nic_model() - and this in turn calls qemu_find_nic_model()
which contains the same check for nd->model being NULL again. So we
can remove this from the calling site now.

Message-Id: <20230804073525.11857-1-thuth@redhat.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index c52a1fcf67..bfcf64d007 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -222,10 +222,6 @@ static void s390_create_virtio_net(BusState *bus, const char *name)
         NICInfo *nd = &nd_table[i];
         DeviceState *dev;
 
-        if (!nd->model) {
-            nd->model = g_strdup("virtio");
-        }
-
         qemu_check_nic_model(nd, "virtio");
 
         dev = qdev_new(name);

From d194362910138776e8abd6bb3c9fb3693254e95f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 15 Aug 2023 14:20:07 +0200
Subject: [PATCH 1163/1353] include/hw/virtio/virtio-gpu: Fix virtio-gpu with
 blob on big endian hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Using "-device virtio-gpu,blob=true" currently does not work on big
endian hosts (like s390x). The guest kernel prints an error message
like:

 [drm:virtio_gpu_dequeue_ctrl_func [virtio_gpu]] *ERROR* response 0x1200 (command 0x10c)

and the display stays black. When running QEMU with "-d guest_errors",
it shows an error message like this:

 virtio_gpu_create_mapping_iov: nr_entries is too big (83886080 > 16384)

which indicates that this value has not been properly byte-swapped.
And indeed, the virtio_gpu_create_blob_bswap() function (that should
swap the fields in the related structure) fails to swap some of the
entries. After correctly swapping all missing values here, too, the
virtio-gpu device is now also working with blob=true on s390x hosts.

Fixes: e0933d91b1 ("virtio-gpu: Add virtio_gpu_resource_create_blob")
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2230469
Message-Id: <20230815122007.928049-1-thuth@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 include/hw/virtio/virtio-gpu-bswap.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/hw/virtio/virtio-gpu-bswap.h b/include/hw/virtio/virtio-gpu-bswap.h
index 9124108485..637a0585d0 100644
--- a/include/hw/virtio/virtio-gpu-bswap.h
+++ b/include/hw/virtio/virtio-gpu-bswap.h
@@ -63,7 +63,10 @@ virtio_gpu_create_blob_bswap(struct virtio_gpu_resource_create_blob *cblob)
 {
     virtio_gpu_ctrl_hdr_bswap(&cblob->hdr);
     le32_to_cpus(&cblob->resource_id);
+    le32_to_cpus(&cblob->blob_mem);
     le32_to_cpus(&cblob->blob_flags);
+    le32_to_cpus(&cblob->nr_entries);
+    le64_to_cpus(&cblob->blob_id);
     le64_to_cpus(&cblob->size);
 }
 

From ffc8453bd25ac62ad89e26974a8107846d2f1390 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Sat, 5 Aug 2023 01:03:17 +0200
Subject: [PATCH 1164/1353] linux-user/elfload: Enable vxe2 on s390x

The vxe2 hwcap is not set for programs running in linux-user, but is
set by a Linux kernel running in softmmu. Add it to the former.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230804233748.218935-2-iii@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 linux-user/elfload.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ac03beb01b..92b981c445 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1614,6 +1614,7 @@ uint32_t get_elf_hwcap(void)
     }
     GET_FEATURE(S390_FEAT_VECTOR, HWCAP_S390_VXRS);
     GET_FEATURE(S390_FEAT_VECTOR_ENH, HWCAP_S390_VXRS_EXT);
+    GET_FEATURE(S390_FEAT_VECTOR_ENH2, HWCAP_S390_VXRS_EXT2);
 
     return hwcap;
 }

From 791b2b6a930273db694b9ba48bbb406e78715927 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Sat, 5 Aug 2023 01:03:18 +0200
Subject: [PATCH 1165/1353] target/s390x: Fix the "ignored match" case in VSTRS

Currently the emulation of VSTRS recognizes partial matches in presence
of \0 in the haystack, which, according to PoP, is not correct:

    If the ZS flag is one and a zero byte was detected
    in the second operand, then there can not be a
    partial match ...

Add a check for this. While at it, fold a number of explicitly handled
special cases into the generic logic.

Cc: qemu-stable@nongnu.org
Reported-by: Claudio Fontana <cfontana@suse.de>
Closes: https://lists.gnu.org/archive/html/qemu-devel/2023-08/msg00633.html
Fixes: 1d706f314191 ("target/s390x: vxeh2: vector string search")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230804233748.218935-3-iii@linux.ibm.com>
Tested-by: Claudio Fontana <cfontana@suse.de>
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/vec_string_helper.c | 54 +++++++++-------------------
 1 file changed, 17 insertions(+), 37 deletions(-)

diff --git a/target/s390x/tcg/vec_string_helper.c b/target/s390x/tcg/vec_string_helper.c
index 9b85becdfb..a19f429768 100644
--- a/target/s390x/tcg/vec_string_helper.c
+++ b/target/s390x/tcg/vec_string_helper.c
@@ -474,9 +474,9 @@ DEF_VSTRC_CC_RT_HELPER(32)
 static int vstrs(S390Vector *v1, const S390Vector *v2, const S390Vector *v3,
                  const S390Vector *v4, uint8_t es, bool zs)
 {
-    int substr_elen, substr_0, str_elen, i, j, k, cc;
+    int substr_elen, i, j, k, cc;
     int nelem = 16 >> es;
-    bool eos = false;
+    int str_leftmost_0;
 
     substr_elen = s390_vec_read_element8(v4, 7) >> es;
 
@@ -498,47 +498,20 @@ static int vstrs(S390Vector *v1, const S390Vector *v2, const S390Vector *v3,
     }
 
     /* If ZS, look for eos in the searched string. */
+    str_leftmost_0 = nelem;
     if (zs) {
         for (k = 0; k < nelem; k++) {
             if (s390_vec_read_element(v2, k, es) == 0) {
-                eos = true;
+                str_leftmost_0 = k;
                 break;
             }
         }
-        str_elen = k;
-    } else {
-        str_elen = nelem;
     }
 
-    substr_0 = s390_vec_read_element(v3, 0, es);
-
-    for (k = 0; ; k++) {
-        for (; k < str_elen; k++) {
-            if (s390_vec_read_element(v2, k, es) == substr_0) {
-                break;
-            }
-        }
-
-        /* If we reached the end of the string, no match. */
-        if (k == str_elen) {
-            cc = eos; /* no match (with or without zero char) */
-            goto done;
-        }
-
-        /* If the substring is only one char, match. */
-        if (substr_elen == 1) {
-            cc = 2; /* full match */
-            goto done;
-        }
-
-        /* If the match begins at the last char, we have a partial match. */
-        if (k == str_elen - 1) {
-            cc = 3; /* partial match */
-            goto done;
-        }
-
+    cc = str_leftmost_0 == nelem ? 0 : 1;  /* No match. */
+    for (k = 0; k < nelem; k++) {
         i = MIN(nelem, k + substr_elen);
-        for (j = k + 1; j < i; j++) {
+        for (j = k; j < i; j++) {
             uint32_t e2 = s390_vec_read_element(v2, j, es);
             uint32_t e3 = s390_vec_read_element(v3, j - k, es);
             if (e2 != e3) {
@@ -546,9 +519,16 @@ static int vstrs(S390Vector *v1, const S390Vector *v2, const S390Vector *v3,
             }
         }
         if (j == i) {
-            /* Matched up until "end". */
-            cc = i - k == substr_elen ? 2 : 3; /* full or partial match */
-            goto done;
+            /* All elements matched. */
+            if (k > str_leftmost_0) {
+                cc = 1;  /* Ignored match. */
+                k = nelem;
+            } else if (i - k == substr_elen) {
+                cc = 2;  /* Full match. */
+            } else {
+                cc = 3;  /* Partial match. */
+            }
+            break;
         }
     }
 

From 6c49f685d30ffe81cfa47da2c258904ad28ac368 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Sat, 5 Aug 2023 01:03:19 +0200
Subject: [PATCH 1166/1353] tests/tcg/s390x: Test VSTRS

Add a small test to prevent regressions.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-Id: <20230804233748.218935-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.target |  1 +
 tests/tcg/s390x/vxeh2_vstrs.c   | 88 +++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+)
 create mode 100644 tests/tcg/s390x/vxeh2_vstrs.c

diff --git a/tests/tcg/s390x/Makefile.target b/tests/tcg/s390x/Makefile.target
index a6062b5c07..9c0e70c6ca 100644
--- a/tests/tcg/s390x/Makefile.target
+++ b/tests/tcg/s390x/Makefile.target
@@ -75,6 +75,7 @@ ifneq ($(CROSS_CC_HAS_Z15),)
 Z15_TESTS=vxeh2_vs
 Z15_TESTS+=vxeh2_vcvt
 Z15_TESTS+=vxeh2_vlstr
+Z15_TESTS+=vxeh2_vstrs
 $(Z15_TESTS): CFLAGS+=-march=z15 -O2
 TESTS+=$(Z15_TESTS)
 endif
diff --git a/tests/tcg/s390x/vxeh2_vstrs.c b/tests/tcg/s390x/vxeh2_vstrs.c
new file mode 100644
index 0000000000..313ec1d728
--- /dev/null
+++ b/tests/tcg/s390x/vxeh2_vstrs.c
@@ -0,0 +1,88 @@
+/*
+ * Test the VSTRS instruction.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#include <assert.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "vx.h"
+
+static inline __attribute__((__always_inline__)) int
+vstrs(S390Vector *v1, const S390Vector *v2, const S390Vector *v3,
+      const S390Vector *v4, const uint8_t m5, const uint8_t m6)
+{
+    int cc;
+
+    asm("vstrs %[v1],%[v2],%[v3],%[v4],%[m5],%[m6]\n"
+        "ipm %[cc]"
+        : [v1] "=v" (v1->v)
+        , [cc] "=r" (cc)
+        : [v2] "v" (v2->v)
+        , [v3] "v" (v3->v)
+        , [v4] "v" (v4->v)
+        , [m5] "i" (m5)
+        , [m6]  "i" (m6)
+        : "cc");
+
+    return (cc >> 28) & 3;
+}
+
+static void test_ignored_match(void)
+{
+    S390Vector v1;
+    S390Vector v2 = {.d[0] = 0x222000205e410000ULL, .d[1] = 0};
+    S390Vector v3 = {.d[0] = 0x205e410000000000ULL, .d[1] = 0};
+    S390Vector v4 = {.d[0] = 3, .d[1] = 0};
+
+    assert(vstrs(&v1, &v2, &v3, &v4, 0, 2) == 1);
+    assert(v1.d[0] == 16);
+    assert(v1.d[1] == 0);
+}
+
+static void test_empty_needle(void)
+{
+    S390Vector v1;
+    S390Vector v2 = {.d[0] = 0x5300000000000000ULL, .d[1] = 0};
+    S390Vector v3 = {.d[0] = 0, .d[1] = 0};
+    S390Vector v4 = {.d[0] = 0, .d[1] = 0};
+
+    assert(vstrs(&v1, &v2, &v3, &v4, 0, 0) == 2);
+    assert(v1.d[0] == 0);
+    assert(v1.d[1] == 0);
+}
+
+static void test_max_length(void)
+{
+    S390Vector v1;
+    S390Vector v2 = {.d[0] = 0x1122334455667700ULL, .d[1] = 0};
+    S390Vector v3 = {.d[0] = 0, .d[1] = 0};
+    S390Vector v4 = {.d[0] = 16, .d[1] = 0};
+
+    assert(vstrs(&v1, &v2, &v3, &v4, 0, 0) == 3);
+    assert(v1.d[0] == 7);
+    assert(v1.d[1] == 0);
+}
+
+static void test_no_match(void)
+{
+    S390Vector v1;
+    S390Vector v2 = {.d[0] = 0xffffff000fffff00ULL, .d[1] = 0x82b};
+    S390Vector v3 = {.d[0] = 0xfffffffeffffffffULL,
+                     .d[1] = 0xffffffff00000000ULL};
+    S390Vector v4 = {.d[0] = 11, .d[1] = 0};
+
+    assert(vstrs(&v1, &v2, &v3, &v4, 0, 2) == 1);
+    assert(v1.d[0] == 16);
+    assert(v1.d[1] == 0);
+}
+
+int main(void)
+{
+    test_ignored_match();
+    test_empty_needle();
+    test_max_length();
+    test_no_match();
+    return EXIT_SUCCESS;
+}

From 09a3fffae00b042bed8ad9c351b1a58c505fde37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 22 Aug 2023 14:57:16 +0200
Subject: [PATCH 1167/1353] docs/about/license: Update LICENSE URL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In early 2021 (see commit 2ad784339e "docs: update README to use
GitLab repo URLs") almost all of the code base was converted to
point to GitLab instead of git.qemu.org. During 2023, git.qemu.org
switched from a git mirror to a http redirect to GitLab (see [1]).

Update the LICENSE URL to match its previous content, displaying
the file raw content similarly to gitweb 'blob_plain' format ([2]).

[1] https://lore.kernel.org/qemu-devel/CABgObfZu3mFc8tM20K-yXdt7F-7eV-uKZN4sKDarSeu7DYoRbA@mail.gmail.com/
[2] https://git-scm.com/docs/gitweb#Documentation/gitweb.txt-blobplain

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20230822125716.55295-1-philmd@linaro.org>
---
 docs/about/license.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/about/license.rst b/docs/about/license.rst
index cde3d2d25d..303c55d61b 100644
--- a/docs/about/license.rst
+++ b/docs/about/license.rst
@@ -8,4 +8,4 @@ QEMU is a trademark of Fabrice Bellard.
 QEMU is released under the `GNU General Public
 License <https://www.gnu.org/licenses/gpl-2.0.txt>`__, version 2. Parts
 of QEMU have specific licenses, see file
-`LICENSE <https://git.qemu.org/?p=qemu.git;a=blob_plain;f=LICENSE>`__.
+`LICENSE <https://gitlab.com/qemu-project/qemu/-/raw/master/LICENSE>`__.

From 3da4004c217148b1662a6fa6a6198b1c5df1adbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 21 Aug 2023 14:59:52 +0200
Subject: [PATCH 1168/1353] target/loongarch: Log I/O write accesses to CSR
 registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Various CSR registers have Read/Write fields. We might
want to see guest trying to change such registers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20230821125959.28666-2-philmd@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index ad93ecac92..7107968699 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -544,6 +544,8 @@ static void loongarch_cpu_realizefn(DeviceState *dev, Error **errp)
 static void loongarch_qemu_write(void *opaque, hwaddr addr,
                                  uint64_t val, unsigned size)
 {
+    qemu_log_mask(LOG_UNIMP, "[%s]: Unimplemented reg 0x%" HWADDR_PRIx "\n",
+                  __func__, addr);
 }
 
 static uint64_t loongarch_qemu_read(void *opaque, hwaddr addr, unsigned size)

From 3a4b64c702d72844c9e58f72e8175e402627f240 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 21 Aug 2023 14:59:53 +0200
Subject: [PATCH 1169/1353] target/loongarch: Remove duplicated disas_set_info
 assignment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 228021f05e ("target/loongarch: Add core definition") sets
disas_set_info to loongarch_cpu_disas_set_info. Probably due to
a failed git-rebase, commit ca61e75071 ("target/loongarch: Add gdb
support") also sets it to the same value. Remove the duplication.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20230821125959.28666-3-philmd@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 7107968699..dc617be36f 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -723,7 +723,6 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = loongarch_cpu_disas_set_info;
     cc->gdb_read_register = loongarch_cpu_gdb_read_register;
     cc->gdb_write_register = loongarch_cpu_gdb_write_register;
-    cc->disas_set_info = loongarch_cpu_disas_set_info;
     cc->gdb_num_core_regs = 35;
     cc->gdb_core_xml_file = "loongarch-base64.xml";
     cc->gdb_stop_before_watchpoint = true;

From 0b36072786c1972d4876ff799ef611be153dfaa3 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Mon, 21 Aug 2023 14:59:54 +0200
Subject: [PATCH 1170/1353] target/loongarch: Fix loongarch_la464_initfn()
 misses setting LSPW
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230817093121.1053890-11-gaosong@loongson.cn>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230821125959.28666-4-philmd@linaro.org>
---
 target/loongarch/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index dc617be36f..a1ebc20330 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -391,6 +391,7 @@ static void loongarch_la464_initfn(Object *obj)
     data = FIELD_DP32(data, CPUCFG2, LSX, 1),
     data = FIELD_DP32(data, CPUCFG2, LLFTP, 1);
     data = FIELD_DP32(data, CPUCFG2, LLFTP_VER, 1);
+    data = FIELD_DP32(data, CPUCFG2, LSPW, 1);
     data = FIELD_DP32(data, CPUCFG2, LAM, 1);
     env->cpucfg[2] = data;
 

From 146f2354b58aaa7b223e0394d889f83138911d9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 21 Aug 2023 14:59:55 +0200
Subject: [PATCH 1171/1353] target/loongarch: Introduce abstract
 TYPE_LOONGARCH64_CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation of introducing TYPE_LOONGARCH32_CPU, introduce
an abstract TYPE_LOONGARCH64_CPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230821125959.28666-5-philmd@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c | 12 +++++++++---
 target/loongarch/cpu.h |  1 +
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index a1ebc20330..34d6c5a31d 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -734,9 +734,9 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
 #endif
 }
 
-#define DEFINE_LOONGARCH_CPU_TYPE(model, initfn) \
+#define DEFINE_LOONGARCH_CPU_TYPE(size, model, initfn) \
     { \
-        .parent = TYPE_LOONGARCH_CPU, \
+        .parent = TYPE_LOONGARCH##size##_CPU, \
         .instance_init = initfn, \
         .name = LOONGARCH_CPU_TYPE_NAME(model), \
     }
@@ -752,7 +752,13 @@ static const TypeInfo loongarch_cpu_type_infos[] = {
         .class_size = sizeof(LoongArchCPUClass),
         .class_init = loongarch_cpu_class_init,
     },
-    DEFINE_LOONGARCH_CPU_TYPE("la464", loongarch_la464_initfn),
+    {
+        .name = TYPE_LOONGARCH64_CPU,
+        .parent = TYPE_LOONGARCH_CPU,
+
+        .abstract = true,
+    },
+    DEFINE_LOONGARCH_CPU_TYPE(64, "la464", loongarch_la464_initfn),
 };
 
 DEFINE_TYPES(loongarch_cpu_type_infos)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index fa371ca8ba..c50b3a5ef3 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -377,6 +377,7 @@ struct ArchCPU {
 };
 
 #define TYPE_LOONGARCH_CPU "loongarch-cpu"
+#define TYPE_LOONGARCH64_CPU "loongarch64-cpu"
 
 OBJECT_DECLARE_CPU_TYPE(LoongArchCPU, LoongArchCPUClass,
                         LOONGARCH_CPU)

From e389358e569628dec1e3be6210621d64335f0c90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 21 Aug 2023 14:59:56 +0200
Subject: [PATCH 1172/1353] target/loongarch: Extract 64-bit specifics to
 loongarch64_cpu_class_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract loongarch64 specific code from loongarch_cpu_class_init()
to a new loongarch64_cpu_class_init().

In preparation of supporting loongarch32 cores, rename these
functions using the '64' suffix.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230821125959.28666-6-philmd@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 34d6c5a31d..6384bda1bd 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -695,11 +695,6 @@ static const struct SysemuCPUOps loongarch_sysemu_ops = {
 };
 #endif
 
-static gchar *loongarch_gdb_arch_name(CPUState *cs)
-{
-    return g_strdup("loongarch64");
-}
-
 static void loongarch_cpu_class_init(ObjectClass *c, void *data)
 {
     LoongArchCPUClass *lacc = LOONGARCH_CPU_CLASS(c);
@@ -724,16 +719,27 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
     cc->disas_set_info = loongarch_cpu_disas_set_info;
     cc->gdb_read_register = loongarch_cpu_gdb_read_register;
     cc->gdb_write_register = loongarch_cpu_gdb_write_register;
-    cc->gdb_num_core_regs = 35;
-    cc->gdb_core_xml_file = "loongarch-base64.xml";
     cc->gdb_stop_before_watchpoint = true;
-    cc->gdb_arch_name = loongarch_gdb_arch_name;
 
 #ifdef CONFIG_TCG
     cc->tcg_ops = &loongarch_tcg_ops;
 #endif
 }
 
+static gchar *loongarch64_gdb_arch_name(CPUState *cs)
+{
+    return g_strdup("loongarch64");
+}
+
+static void loongarch64_cpu_class_init(ObjectClass *c, void *data)
+{
+    CPUClass *cc = CPU_CLASS(c);
+
+    cc->gdb_num_core_regs = 35;
+    cc->gdb_core_xml_file = "loongarch-base64.xml";
+    cc->gdb_arch_name = loongarch64_gdb_arch_name;
+}
+
 #define DEFINE_LOONGARCH_CPU_TYPE(size, model, initfn) \
     { \
         .parent = TYPE_LOONGARCH##size##_CPU, \
@@ -757,6 +763,7 @@ static const TypeInfo loongarch_cpu_type_infos[] = {
         .parent = TYPE_LOONGARCH_CPU,
 
         .abstract = true,
+        .class_init = loongarch64_cpu_class_init,
     },
     DEFINE_LOONGARCH_CPU_TYPE(64, "la464", loongarch_la464_initfn),
 };

From 19f82a4a6ae6da44fb8167bd3b415025d914f428 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Mon, 21 Aug 2023 14:59:57 +0200
Subject: [PATCH 1173/1353] target/loongarch: Add function to check current
 arch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add is_la64 function to check if the current cpucfg[1].arch equals to
2(LA64).

Signed-off-by: Jiajie Chen <c@jia.je>
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230817093121.1053890-2-gaosong@loongson.cn>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230821125959.28666-7-philmd@linaro.org>
---
 target/loongarch/cpu.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index c50b3a5ef3..3235ad081f 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -132,6 +132,11 @@ FIELD(CPUCFG1, HP, 24, 1)
 FIELD(CPUCFG1, IOCSR_BRD, 25, 1)
 FIELD(CPUCFG1, MSG_INT, 26, 1)
 
+/* cpucfg[1].arch */
+#define CPUCFG1_ARCH_LA32R       0
+#define CPUCFG1_ARCH_LA32        1
+#define CPUCFG1_ARCH_LA64        2
+
 /* cpucfg[2] bits */
 FIELD(CPUCFG2, FP, 0, 1)
 FIELD(CPUCFG2, FP_SP, 1, 1)
@@ -421,6 +426,11 @@ static inline int cpu_mmu_index(CPULoongArchState *env, bool ifetch)
 #endif
 }
 
+static inline bool is_la64(CPULoongArchState *env)
+{
+    return FIELD_EX32(env->cpucfg[1], CPUCFG1, ARCH) == CPUCFG1_ARCH_LA64;
+}
+
 /*
  * LoongArch CPUs hardware flags.
  */

From 6cbba3e9eb3e55353f23cbd567e508d01b7677e0 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Mon, 21 Aug 2023 14:59:58 +0200
Subject: [PATCH 1174/1353] target/loongarch: Add new object class for
 loongarch32 cpus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add object class stub for future loongarch32 cpus.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230817093121.1053890-3-gaosong@loongson.cn>
[Rebased on TYPE_LOONGARCH64_CPU introduction]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230821125959.28666-8-philmd@linaro.org>
---
 target/loongarch/cpu.c | 11 +++++++++++
 target/loongarch/cpu.h |  1 +
 2 files changed, 12 insertions(+)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 6384bda1bd..556419f159 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -726,6 +726,10 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
 #endif
 }
 
+static void loongarch32_cpu_class_init(ObjectClass *c, void *data)
+{
+}
+
 static gchar *loongarch64_gdb_arch_name(CPUState *cs)
 {
     return g_strdup("loongarch64");
@@ -758,6 +762,13 @@ static const TypeInfo loongarch_cpu_type_infos[] = {
         .class_size = sizeof(LoongArchCPUClass),
         .class_init = loongarch_cpu_class_init,
     },
+    {
+        .name = TYPE_LOONGARCH32_CPU,
+        .parent = TYPE_LOONGARCH_CPU,
+
+        .abstract = true,
+        .class_init = loongarch32_cpu_class_init,
+    },
     {
         .name = TYPE_LOONGARCH64_CPU,
         .parent = TYPE_LOONGARCH_CPU,
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 3235ad081f..b8af491041 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -382,6 +382,7 @@ struct ArchCPU {
 };
 
 #define TYPE_LOONGARCH_CPU "loongarch-cpu"
+#define TYPE_LOONGARCH32_CPU "loongarch32-cpu"
 #define TYPE_LOONGARCH64_CPU "loongarch64-cpu"
 
 OBJECT_DECLARE_CPU_TYPE(LoongArchCPU, LoongArchCPUClass,

From ebda3036e18b84d3e4280f05ac71ad462593e8ac Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Mon, 21 Aug 2023 14:59:59 +0200
Subject: [PATCH 1175/1353] target/loongarch: Add GDB support for loongarch32
 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GPRs and PC are 32-bit wide in loongarch32 mode.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230817093121.1053890-4-gaosong@loongson.cn>
[PMD: Rebased, set gdb_num_core_regs]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230821125959.28666-9-philmd@linaro.org>
---
 configs/targets/loongarch64-softmmu.mak |  2 +-
 gdb-xml/loongarch-base32.xml            | 45 +++++++++++++++++++++++++
 target/loongarch/cpu.c                  | 10 ++++++
 target/loongarch/gdbstub.c              | 32 ++++++++++++++----
 4 files changed, 81 insertions(+), 8 deletions(-)
 create mode 100644 gdb-xml/loongarch-base32.xml

diff --git a/configs/targets/loongarch64-softmmu.mak b/configs/targets/loongarch64-softmmu.mak
index 9abc99056f..f23780fdd8 100644
--- a/configs/targets/loongarch64-softmmu.mak
+++ b/configs/targets/loongarch64-softmmu.mak
@@ -1,5 +1,5 @@
 TARGET_ARCH=loongarch64
 TARGET_BASE_ARCH=loongarch
 TARGET_SUPPORTS_MTTCG=y
-TARGET_XML_FILES= gdb-xml/loongarch-base64.xml gdb-xml/loongarch-fpu.xml
+TARGET_XML_FILES= gdb-xml/loongarch-base32.xml gdb-xml/loongarch-base64.xml gdb-xml/loongarch-fpu.xml
 TARGET_NEED_FDT=y
diff --git a/gdb-xml/loongarch-base32.xml b/gdb-xml/loongarch-base32.xml
new file mode 100644
index 0000000000..af47bbd3da
--- /dev/null
+++ b/gdb-xml/loongarch-base32.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<!-- Copyright (C) 2022 Free Software Foundation, Inc.
+
+     Copying and distribution of this file, with or without modification,
+     are permitted in any medium without royalty provided the copyright
+     notice and this notice are preserved.  -->
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.loongarch.base">
+  <reg name="r0" bitsize="32" type="uint32" group="general"/>
+  <reg name="r1" bitsize="32" type="code_ptr" group="general"/>
+  <reg name="r2" bitsize="32" type="data_ptr" group="general"/>
+  <reg name="r3" bitsize="32" type="data_ptr" group="general"/>
+  <reg name="r4" bitsize="32" type="uint32" group="general"/>
+  <reg name="r5" bitsize="32" type="uint32" group="general"/>
+  <reg name="r6" bitsize="32" type="uint32" group="general"/>
+  <reg name="r7" bitsize="32" type="uint32" group="general"/>
+  <reg name="r8" bitsize="32" type="uint32" group="general"/>
+  <reg name="r9" bitsize="32" type="uint32" group="general"/>
+  <reg name="r10" bitsize="32" type="uint32" group="general"/>
+  <reg name="r11" bitsize="32" type="uint32" group="general"/>
+  <reg name="r12" bitsize="32" type="uint32" group="general"/>
+  <reg name="r13" bitsize="32" type="uint32" group="general"/>
+  <reg name="r14" bitsize="32" type="uint32" group="general"/>
+  <reg name="r15" bitsize="32" type="uint32" group="general"/>
+  <reg name="r16" bitsize="32" type="uint32" group="general"/>
+  <reg name="r17" bitsize="32" type="uint32" group="general"/>
+  <reg name="r18" bitsize="32" type="uint32" group="general"/>
+  <reg name="r19" bitsize="32" type="uint32" group="general"/>
+  <reg name="r20" bitsize="32" type="uint32" group="general"/>
+  <reg name="r21" bitsize="32" type="uint32" group="general"/>
+  <reg name="r22" bitsize="32" type="data_ptr" group="general"/>
+  <reg name="r23" bitsize="32" type="uint32" group="general"/>
+  <reg name="r24" bitsize="32" type="uint32" group="general"/>
+  <reg name="r25" bitsize="32" type="uint32" group="general"/>
+  <reg name="r26" bitsize="32" type="uint32" group="general"/>
+  <reg name="r27" bitsize="32" type="uint32" group="general"/>
+  <reg name="r28" bitsize="32" type="uint32" group="general"/>
+  <reg name="r29" bitsize="32" type="uint32" group="general"/>
+  <reg name="r30" bitsize="32" type="uint32" group="general"/>
+  <reg name="r31" bitsize="32" type="uint32" group="general"/>
+  <reg name="orig_a0" bitsize="32" type="uint32" group="general"/>
+  <reg name="pc" bitsize="32" type="code_ptr" group="general"/>
+  <reg name="badv" bitsize="32" type="code_ptr" group="general"/>
+</feature>
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 556419f159..822f2a72e5 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -726,8 +726,18 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
 #endif
 }
 
+static gchar *loongarch32_gdb_arch_name(CPUState *cs)
+{
+    return g_strdup("loongarch32");
+}
+
 static void loongarch32_cpu_class_init(ObjectClass *c, void *data)
 {
+    CPUClass *cc = CPU_CLASS(c);
+
+    cc->gdb_num_core_regs = 35;
+    cc->gdb_core_xml_file = "loongarch-base32.xml";
+    cc->gdb_arch_name = loongarch32_gdb_arch_name;
 }
 
 static gchar *loongarch64_gdb_arch_name(CPUState *cs)
diff --git a/target/loongarch/gdbstub.c b/target/loongarch/gdbstub.c
index 0752fff924..a462e25737 100644
--- a/target/loongarch/gdbstub.c
+++ b/target/loongarch/gdbstub.c
@@ -34,16 +34,25 @@ int loongarch_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
     CPULoongArchState *env = &cpu->env;
+    uint64_t val;
 
     if (0 <= n && n < 32) {
-        return gdb_get_regl(mem_buf, env->gpr[n]);
+        val = env->gpr[n];
     } else if (n == 32) {
         /* orig_a0 */
-        return gdb_get_regl(mem_buf, 0);
+        val = 0;
     } else if (n == 33) {
-        return gdb_get_regl(mem_buf, env->pc);
+        val = env->pc;
     } else if (n == 34) {
-        return gdb_get_regl(mem_buf, env->CSR_BADV);
+        val = env->CSR_BADV;
+    }
+
+    if (0 <= n && n <= 34) {
+        if (is_la64(env)) {
+            return gdb_get_reg64(mem_buf, val);
+        } else {
+            return gdb_get_reg32(mem_buf, val);
+        }
     }
     return 0;
 }
@@ -52,15 +61,24 @@ int loongarch_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
     CPULoongArchState *env = &cpu->env;
-    target_ulong tmp = ldtul_p(mem_buf);
+    target_ulong tmp;
+    int read_length;
     int length = 0;
 
+    if (is_la64(env)) {
+        tmp = ldq_p(mem_buf);
+        read_length = 8;
+    } else {
+        tmp = ldl_p(mem_buf);
+        read_length = 4;
+    }
+
     if (0 <= n && n < 32) {
         env->gpr[n] = tmp;
-        length = sizeof(target_ulong);
+        length = read_length;
     } else if (n == 33) {
         env->pc = tmp;
-        length = sizeof(target_ulong);
+        length = read_length;
     }
     return length;
 }

From e70bb6fb9afd0c560b3200b569d9d47239448c30 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:47 +0200
Subject: [PATCH 1176/1353] target/loongarch: Support LoongArch32 TLB entry

The TLB entry of LA32 lacks NR, NX and RPLV and they are hardwired to
zero in LoongArch32.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230822032724.1353391-2-gaosong@loongson.cn>
Message-Id: <20230822071405.35386-2-philmd@linaro.org>
---
 target/loongarch/cpu-csr.h    |  9 +++++----
 target/loongarch/tlb_helper.c | 17 ++++++++++++-----
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index f8f24032cb..48ed2e0632 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -66,10 +66,11 @@ FIELD(TLBENTRY, D, 1, 1)
 FIELD(TLBENTRY, PLV, 2, 2)
 FIELD(TLBENTRY, MAT, 4, 2)
 FIELD(TLBENTRY, G, 6, 1)
-FIELD(TLBENTRY, PPN, 12, 36)
-FIELD(TLBENTRY, NR, 61, 1)
-FIELD(TLBENTRY, NX, 62, 1)
-FIELD(TLBENTRY, RPLV, 63, 1)
+FIELD(TLBENTRY_32, PPN, 8, 24)
+FIELD(TLBENTRY_64, PPN, 12, 36)
+FIELD(TLBENTRY_64, NR, 61, 1)
+FIELD(TLBENTRY_64, NX, 62, 1)
+FIELD(TLBENTRY_64, RPLV, 63, 1)
 
 #define LOONGARCH_CSR_ASID           0x18 /* Address space identifier */
 FIELD(CSR_ASID, ASID, 0, 10)
diff --git a/target/loongarch/tlb_helper.c b/target/loongarch/tlb_helper.c
index 6e00190547..cef10e2257 100644
--- a/target/loongarch/tlb_helper.c
+++ b/target/loongarch/tlb_helper.c
@@ -48,10 +48,17 @@ static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
     tlb_v = FIELD_EX64(tlb_entry, TLBENTRY, V);
     tlb_d = FIELD_EX64(tlb_entry, TLBENTRY, D);
     tlb_plv = FIELD_EX64(tlb_entry, TLBENTRY, PLV);
-    tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY, PPN);
-    tlb_nx = FIELD_EX64(tlb_entry, TLBENTRY, NX);
-    tlb_nr = FIELD_EX64(tlb_entry, TLBENTRY, NR);
-    tlb_rplv = FIELD_EX64(tlb_entry, TLBENTRY, RPLV);
+    if (is_la64(env)) {
+        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_64, PPN);
+        tlb_nx = FIELD_EX64(tlb_entry, TLBENTRY_64, NX);
+        tlb_nr = FIELD_EX64(tlb_entry, TLBENTRY_64, NR);
+        tlb_rplv = FIELD_EX64(tlb_entry, TLBENTRY_64, RPLV);
+    } else {
+        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_32, PPN);
+        tlb_nx = 0;
+        tlb_nr = 0;
+        tlb_rplv = 0;
+    }
 
     /* Check access rights */
     if (!tlb_v) {
@@ -79,7 +86,7 @@ static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
      * tlb_entry contains ppn[47:12] while 16KiB ppn is [47:15]
      * need adjust.
      */
-    *physical = (tlb_ppn << R_TLBENTRY_PPN_SHIFT) |
+    *physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
                 (address & MAKE_64BIT_MASK(0, tlb_ps));
     *prot = PAGE_READ;
     if (tlb_d) {

From eece5764092063f3f7a091a8b42935e9cb1a37ff Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:48 +0200
Subject: [PATCH 1177/1353] target/loongarch: Support LoongArch32 DMW

LA32 uses a different encoding for CSR.DMW and a new direct mapping
mechanism.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230822032724.1353391-3-gaosong@loongson.cn>
Message-Id: <20230822071405.35386-3-philmd@linaro.org>
---
 target/loongarch/cpu-csr.h    |  7 +++----
 target/loongarch/tlb_helper.c | 26 +++++++++++++++++++++++---
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 48ed2e0632..b93f99a9ef 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -188,10 +188,9 @@ FIELD(CSR_DMW, PLV1, 1, 1)
 FIELD(CSR_DMW, PLV2, 2, 1)
 FIELD(CSR_DMW, PLV3, 3, 1)
 FIELD(CSR_DMW, MAT, 4, 2)
-FIELD(CSR_DMW, VSEG, 60, 4)
-
-#define dmw_va2pa(va) \
-    (va & MAKE_64BIT_MASK(0, TARGET_VIRT_ADDR_SPACE_BITS))
+FIELD(CSR_DMW_32, PSEG, 25, 3)
+FIELD(CSR_DMW_32, VSEG, 29, 3)
+FIELD(CSR_DMW_64, VSEG, 60, 4)
 
 /* Debug CSRs */
 #define LOONGARCH_CSR_DBG            0x500 /* debug config */
diff --git a/target/loongarch/tlb_helper.c b/target/loongarch/tlb_helper.c
index cef10e2257..1f8e7911c7 100644
--- a/target/loongarch/tlb_helper.c
+++ b/target/loongarch/tlb_helper.c
@@ -173,6 +173,18 @@ static int loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
     return TLBRET_NOMATCH;
 }
 
+static hwaddr dmw_va2pa(CPULoongArchState *env, target_ulong va,
+                        target_ulong dmw)
+{
+    if (is_la64(env)) {
+        return va & TARGET_VIRT_MASK;
+    } else {
+        uint32_t pseg = FIELD_EX32(dmw, CSR_DMW_32, PSEG);
+        return (va & MAKE_64BIT_MASK(0, R_CSR_DMW_32_VSEG_SHIFT)) | \
+            (pseg << R_CSR_DMW_32_VSEG_SHIFT);
+    }
+}
+
 static int get_physical_address(CPULoongArchState *env, hwaddr *physical,
                                 int *prot, target_ulong address,
                                 MMUAccessType access_type, int mmu_idx)
@@ -192,12 +204,20 @@ static int get_physical_address(CPULoongArchState *env, hwaddr *physical,
     }
 
     plv = kernel_mode | (user_mode << R_CSR_DMW_PLV3_SHIFT);
-    base_v = address >> R_CSR_DMW_VSEG_SHIFT;
+    if (is_la64(env)) {
+        base_v = address >> R_CSR_DMW_64_VSEG_SHIFT;
+    } else {
+        base_v = address >> R_CSR_DMW_32_VSEG_SHIFT;
+    }
     /* Check direct map window */
     for (int i = 0; i < 4; i++) {
-        base_c = FIELD_EX64(env->CSR_DMW[i], CSR_DMW, VSEG);
+        if (is_la64(env)) {
+            base_c = FIELD_EX64(env->CSR_DMW[i], CSR_DMW_64, VSEG);
+        } else {
+            base_c = FIELD_EX64(env->CSR_DMW[i], CSR_DMW_32, VSEG);
+        }
         if ((plv & env->CSR_DMW[i]) && (base_c == base_v)) {
-            *physical = dmw_va2pa(address);
+            *physical = dmw_va2pa(env, address, env->CSR_DMW[i]);
             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
             return TLBRET_MATCH;
         }

From 50fffcc49b0e68f53de5c1eaf21ec07819540d5a Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:49 +0200
Subject: [PATCH 1178/1353] target/loongarch: Support LoongArch32 VPPN

VPPN of TLBEHI/TLBREHI is limited to 19 bits in LA32.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230822032724.1353391-4-gaosong@loongson.cn>
Message-Id: <20230822071405.35386-4-philmd@linaro.org>
---
 target/loongarch/cpu-csr.h    |  6 ++++--
 target/loongarch/tlb_helper.c | 23 ++++++++++++++++++-----
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index b93f99a9ef..c59d7a9fcb 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -57,7 +57,8 @@ FIELD(CSR_TLBIDX, PS, 24, 6)
 FIELD(CSR_TLBIDX, NE, 31, 1)
 
 #define LOONGARCH_CSR_TLBEHI         0x11 /* TLB EntryHi */
-FIELD(CSR_TLBEHI, VPPN, 13, 35)
+FIELD(CSR_TLBEHI_32, VPPN, 13, 19)
+FIELD(CSR_TLBEHI_64, VPPN, 13, 35)
 
 #define LOONGARCH_CSR_TLBELO0        0x12 /* TLB EntryLo0 */
 #define LOONGARCH_CSR_TLBELO1        0x13 /* TLB EntryLo1 */
@@ -164,7 +165,8 @@ FIELD(CSR_TLBRERA, PC, 2, 62)
 #define LOONGARCH_CSR_TLBRELO1       0x8d /* TLB refill entrylo1 */
 #define LOONGARCH_CSR_TLBREHI        0x8e /* TLB refill entryhi */
 FIELD(CSR_TLBREHI, PS, 0, 6)
-FIELD(CSR_TLBREHI, VPPN, 13, 35)
+FIELD(CSR_TLBREHI_32, VPPN, 13, 19)
+FIELD(CSR_TLBREHI_64, VPPN, 13, 35)
 #define LOONGARCH_CSR_TLBRPRMD       0x8f /* TLB refill mode info */
 FIELD(CSR_TLBRPRMD, PPLV, 0, 2)
 FIELD(CSR_TLBRPRMD, PIE, 2, 1)
diff --git a/target/loongarch/tlb_helper.c b/target/loongarch/tlb_helper.c
index 1f8e7911c7..c8b8b0497f 100644
--- a/target/loongarch/tlb_helper.c
+++ b/target/loongarch/tlb_helper.c
@@ -300,8 +300,13 @@ static void raise_mmu_exception(CPULoongArchState *env, target_ulong address,
 
     if (tlb_error == TLBRET_NOMATCH) {
         env->CSR_TLBRBADV = address;
-        env->CSR_TLBREHI = FIELD_DP64(env->CSR_TLBREHI, CSR_TLBREHI, VPPN,
-                                      extract64(address, 13, 35));
+        if (is_la64(env)) {
+            env->CSR_TLBREHI = FIELD_DP64(env->CSR_TLBREHI, CSR_TLBREHI_64,
+                                        VPPN, extract64(address, 13, 35));
+        } else {
+            env->CSR_TLBREHI = FIELD_DP64(env->CSR_TLBREHI, CSR_TLBREHI_32,
+                                        VPPN, extract64(address, 13, 19));
+        }
     } else {
         if (!FIELD_EX64(env->CSR_DBG, CSR_DBG, DST)) {
             env->CSR_BADV = address;
@@ -366,12 +371,20 @@ static void fill_tlb_entry(CPULoongArchState *env, int index)
 
     if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
         csr_ps = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI, PS);
-        csr_vppn = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI, VPPN);
+        if (is_la64(env)) {
+            csr_vppn = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI_64, VPPN);
+        } else {
+            csr_vppn = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI_32, VPPN);
+        }
         lo0 = env->CSR_TLBRELO0;
         lo1 = env->CSR_TLBRELO1;
     } else {
         csr_ps = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
-        csr_vppn = FIELD_EX64(env->CSR_TLBEHI, CSR_TLBEHI, VPPN);
+        if (is_la64(env)) {
+            csr_vppn = FIELD_EX64(env->CSR_TLBEHI, CSR_TLBEHI_64, VPPN);
+        } else {
+            csr_vppn = FIELD_EX64(env->CSR_TLBEHI, CSR_TLBEHI_32, VPPN);
+        }
         lo0 = env->CSR_TLBELO0;
         lo1 = env->CSR_TLBELO1;
     }
@@ -491,7 +504,7 @@ void helper_tlbfill(CPULoongArchState *env)
 
     if (pagesize == stlb_ps) {
         /* Only write into STLB bits [47:13] */
-        address = entryhi & ~MAKE_64BIT_MASK(0, R_CSR_TLBEHI_VPPN_SHIFT);
+        address = entryhi & ~MAKE_64BIT_MASK(0, R_CSR_TLBEHI_64_VPPN_SHIFT);
 
         /* Choose one set ramdomly */
         set = get_random_tlb(0, 7);

From 3966582099b0c94b45a2ea0fd8afb0dcac8ad292 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:50 +0200
Subject: [PATCH 1179/1353] target/loongarch: Add LA64 & VA32 to DisasContext

Add LA64 and VA32(32-bit Virtual Address) to DisasContext to allow the
translator to reject doubleword instructions in LA32 mode for example.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20230822032724.1353391-5-gaosong@loongson.cn>
Message-Id: <20230822071405.35386-5-philmd@linaro.org>
---
 target/loongarch/cpu.h       | 13 +++++++++++++
 target/loongarch/translate.c |  3 +++
 target/loongarch/translate.h |  2 ++
 3 files changed, 18 insertions(+)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index b8af491041..72109095e4 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -432,6 +432,17 @@ static inline bool is_la64(CPULoongArchState *env)
     return FIELD_EX32(env->cpucfg[1], CPUCFG1, ARCH) == CPUCFG1_ARCH_LA64;
 }
 
+static inline bool is_va32(CPULoongArchState *env)
+{
+    /* VA32 if !LA64 or VA32L[1-3] */
+    bool va32 = !is_la64(env);
+    uint64_t plv = FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV);
+    if (plv >= 1 && (FIELD_EX64(env->CSR_MISC, CSR_MISC, VA32) & (1 << plv))) {
+        va32 = true;
+    }
+    return va32;
+}
+
 /*
  * LoongArch CPUs hardware flags.
  */
@@ -439,6 +450,7 @@ static inline bool is_la64(CPULoongArchState *env)
 #define HW_FLAGS_CRMD_PG    R_CSR_CRMD_PG_MASK   /* 0x10 */
 #define HW_FLAGS_EUEN_FPE   0x04
 #define HW_FLAGS_EUEN_SXE   0x08
+#define HW_FLAGS_VA32       0x20
 
 static inline void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
                                         uint64_t *cs_base, uint32_t *flags)
@@ -448,6 +460,7 @@ static inline void cpu_get_tb_cpu_state(CPULoongArchState *env, vaddr *pc,
     *flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
     *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
     *flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
+    *flags |= is_va32(env) * HW_FLAGS_VA32;
 }
 
 void loongarch_cpu_list(void);
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index 3146a2d4ac..ac847745df 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -119,6 +119,9 @@ static void loongarch_tr_init_disas_context(DisasContextBase *dcbase,
         ctx->vl = LSX_LEN;
     }
 
+    ctx->la64 = is_la64(env);
+    ctx->va32 = (ctx->base.tb->flags & HW_FLAGS_VA32) != 0;
+
     ctx->zero = tcg_constant_tl(0);
 }
 
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index 7f60090580..b6fa5df82d 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -33,6 +33,8 @@ typedef struct DisasContext {
     uint16_t plv;
     int vl;   /* Vector length */
     TCGv zero;
+    bool la64; /* LoongArch64 mode */
+    bool va32; /* 32-bit virtual address */
 } DisasContext;
 
 void generate_exception(DisasContext *ctx, int excp);

From 34423c01941928974f4854bc23a949789154fee7 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:51 +0200
Subject: [PATCH 1180/1353] target/loongarch: Extract make_address_x() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jiajie Chen <c@jia.je>
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-6-gaosong@loongson.cn>
[PMD: Extract helper from bigger patch]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230822071405.35386-6-philmd@linaro.org>
---
 .../loongarch/insn_trans/trans_fmemory.c.inc   | 18 ++++++------------
 target/loongarch/insn_trans/trans_lsx.c.inc    |  6 ++----
 target/loongarch/insn_trans/trans_memory.c.inc |  6 ++----
 target/loongarch/translate.c                   | 12 ++++++++++++
 4 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_fmemory.c.inc b/target/loongarch/insn_trans/trans_fmemory.c.inc
index 91c09fb6d9..88ad209338 100644
--- a/target/loongarch/insn_trans/trans_fmemory.c.inc
+++ b/target/loongarch/insn_trans/trans_fmemory.c.inc
@@ -57,8 +57,7 @@ static bool gen_floadx(DisasContext *ctx, arg_frr *a, MemOp mop)
 
     CHECK_FPE;
 
-    addr = tcg_temp_new();
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     maybe_nanbox_load(dest, mop);
     set_fpr(a->fd, dest);
@@ -75,8 +74,7 @@ static bool gen_fstorex(DisasContext *ctx, arg_frr *a, MemOp mop)
 
     CHECK_FPE;
 
-    addr = tcg_temp_new();
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_st_tl(src3, addr, ctx->mem_idx, mop);
 
     return true;
@@ -91,9 +89,8 @@ static bool gen_fload_gt(DisasContext *ctx, arg_frr *a, MemOp mop)
 
     CHECK_FPE;
 
-    addr = tcg_temp_new();
     gen_helper_asrtgt_d(cpu_env, src1, src2);
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     maybe_nanbox_load(dest, mop);
     set_fpr(a->fd, dest);
@@ -110,9 +107,8 @@ static bool gen_fstore_gt(DisasContext *ctx, arg_frr *a, MemOp mop)
 
     CHECK_FPE;
 
-    addr = tcg_temp_new();
     gen_helper_asrtgt_d(cpu_env, src1, src2);
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_st_tl(src3, addr, ctx->mem_idx, mop);
 
     return true;
@@ -127,9 +123,8 @@ static bool gen_fload_le(DisasContext *ctx, arg_frr *a, MemOp mop)
 
     CHECK_FPE;
 
-    addr = tcg_temp_new();
     gen_helper_asrtle_d(cpu_env, src1, src2);
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     maybe_nanbox_load(dest, mop);
     set_fpr(a->fd, dest);
@@ -146,9 +141,8 @@ static bool gen_fstore_le(DisasContext *ctx, arg_frr *a, MemOp mop)
 
     CHECK_FPE;
 
-    addr = tcg_temp_new();
     gen_helper_asrtle_d(cpu_env, src1, src2);
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_st_tl(src3, addr, ctx->mem_idx, mop);
 
     return true;
diff --git a/target/loongarch/insn_trans/trans_lsx.c.inc b/target/loongarch/insn_trans/trans_lsx.c.inc
index 68779daff6..875cb7d51d 100644
--- a/target/loongarch/insn_trans/trans_lsx.c.inc
+++ b/target/loongarch/insn_trans/trans_lsx.c.inc
@@ -4315,14 +4315,13 @@ static bool trans_vldx(DisasContext *ctx, arg_vrr *a)
 
     CHECK_SXE;
 
-    addr = tcg_temp_new();
     src1 = gpr_src(ctx, a->rj, EXT_NONE);
     src2 = gpr_src(ctx, a->rk, EXT_NONE);
     val = tcg_temp_new_i128();
     rl = tcg_temp_new_i64();
     rh = tcg_temp_new_i64();
 
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     tcg_gen_qemu_ld_i128(val, addr, ctx->mem_idx, MO_128 | MO_TE);
     tcg_gen_extr_i128_i64(rl, rh, val);
     set_vreg64(rh, a->vd, 1);
@@ -4339,14 +4338,13 @@ static bool trans_vstx(DisasContext *ctx, arg_vrr *a)
 
     CHECK_SXE;
 
-    addr = tcg_temp_new();
     src1 = gpr_src(ctx, a->rj, EXT_NONE);
     src2 = gpr_src(ctx, a->rk, EXT_NONE);
     val = tcg_temp_new_i128();
     ah = tcg_temp_new_i64();
     al = tcg_temp_new_i64();
 
-    tcg_gen_add_tl(addr, src1, src2);
+    addr = make_address_x(ctx, src1, src2);
     get_vreg64(ah, a->vd, 1);
     get_vreg64(al, a->vd, 0);
     tcg_gen_concat_i64_i128(val, al, ah);
diff --git a/target/loongarch/insn_trans/trans_memory.c.inc b/target/loongarch/insn_trans/trans_memory.c.inc
index 75cfdf59ad..ccebd0a4e0 100644
--- a/target/loongarch/insn_trans/trans_memory.c.inc
+++ b/target/loongarch/insn_trans/trans_memory.c.inc
@@ -39,9 +39,8 @@ static bool gen_loadx(DisasContext *ctx, arg_rrr *a, MemOp mop)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr = make_address_x(ctx, src1, src2);
 
-    tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -53,9 +52,8 @@ static bool gen_storex(DisasContext *ctx, arg_rrr *a, MemOp mop)
     TCGv data = gpr_src(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
-    TCGv addr = tcg_temp_new();
+    TCGv addr = make_address_x(ctx, src1, src2);
 
-    tcg_gen_add_tl(addr, src1, src2);
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, mop);
 
     return true;
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index ac847745df..a68a979a55 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -208,6 +208,18 @@ static void set_fpr(int reg_num, TCGv val)
                    offsetof(CPULoongArchState, fpr[reg_num].vreg.D(0)));
 }
 
+static TCGv make_address_x(DisasContext *ctx, TCGv base, TCGv addend)
+{
+    TCGv temp = NULL;
+
+    if (addend) {
+        temp = tcg_temp_new();
+        tcg_gen_add_tl(temp, base, addend);
+        base = temp;
+    }
+    return base;
+}
+
 #include "decode-insns.c.inc"
 #include "insn_trans/trans_arith.c.inc"
 #include "insn_trans/trans_shift.c.inc"

From c5af6628f4be5d30800233e59ba3842ca19a12e6 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:52 +0200
Subject: [PATCH 1181/1353] target/loongarch: Extract make_address_i() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jiajie Chen <c@jia.je>
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-6-gaosong@loongson.cn>
[PMD: Extract helper from bigger patch]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230822071405.35386-7-philmd@linaro.org>
---
 .../loongarch/insn_trans/trans_atomic.c.inc   |  5 +--
 .../loongarch/insn_trans/trans_branch.c.inc   |  3 +-
 .../loongarch/insn_trans/trans_fmemory.c.inc  | 12 ++-----
 target/loongarch/insn_trans/trans_lsx.c.inc   | 32 +++++--------------
 .../loongarch/insn_trans/trans_memory.c.inc   | 28 +++++-----------
 target/loongarch/translate.c                  |  6 ++++
 6 files changed, 29 insertions(+), 57 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_atomic.c.inc b/target/loongarch/insn_trans/trans_atomic.c.inc
index 612709f2a7..fbc081448d 100644
--- a/target/loongarch/insn_trans/trans_atomic.c.inc
+++ b/target/loongarch/insn_trans/trans_atomic.c.inc
@@ -7,9 +7,8 @@ static bool gen_ll(DisasContext *ctx, arg_rr_i *a, MemOp mop)
 {
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
-    TCGv t0 = tcg_temp_new();
+    TCGv t0 = make_address_i(ctx, src1, a->imm);
 
-    tcg_gen_addi_tl(t0, src1, a->imm);
     tcg_gen_qemu_ld_i64(dest, t0, ctx->mem_idx, mop);
     tcg_gen_st_tl(t0, cpu_env, offsetof(CPULoongArchState, lladdr));
     tcg_gen_st_tl(dest, cpu_env, offsetof(CPULoongArchState, llval));
@@ -62,6 +61,8 @@ static bool gen_am(DisasContext *ctx, arg_rrr *a,
         return false;
     }
 
+    addr = make_address_i(ctx, addr, 0);
+
     func(dest, addr, val, ctx->mem_idx, mop);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
diff --git a/target/loongarch/insn_trans/trans_branch.c.inc b/target/loongarch/insn_trans/trans_branch.c.inc
index a860f7e733..3ad34bcc05 100644
--- a/target/loongarch/insn_trans/trans_branch.c.inc
+++ b/target/loongarch/insn_trans/trans_branch.c.inc
@@ -23,7 +23,8 @@ static bool trans_jirl(DisasContext *ctx, arg_jirl *a)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
 
-    tcg_gen_addi_tl(cpu_pc, src1, a->imm);
+    TCGv addr = make_address_i(ctx, src1, a->imm);
+    tcg_gen_mov_tl(cpu_pc, addr);
     tcg_gen_movi_tl(dest, ctx->base.pc_next + 4);
     gen_set_gpr(a->rd, dest, EXT_NONE);
     tcg_gen_lookup_and_goto_ptr();
diff --git a/target/loongarch/insn_trans/trans_fmemory.c.inc b/target/loongarch/insn_trans/trans_fmemory.c.inc
index 88ad209338..bd3aba2c49 100644
--- a/target/loongarch/insn_trans/trans_fmemory.c.inc
+++ b/target/loongarch/insn_trans/trans_fmemory.c.inc
@@ -17,11 +17,7 @@ static bool gen_fload_i(DisasContext *ctx, arg_fr_i *a, MemOp mop)
 
     CHECK_FPE;
 
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     maybe_nanbox_load(dest, mop);
@@ -37,11 +33,7 @@ static bool gen_fstore_i(DisasContext *ctx, arg_fr_i *a, MemOp mop)
 
     CHECK_FPE;
 
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_st_tl(src, addr, ctx->mem_idx, mop);
 
diff --git a/target/loongarch/insn_trans/trans_lsx.c.inc b/target/loongarch/insn_trans/trans_lsx.c.inc
index 875cb7d51d..50153d6d0b 100644
--- a/target/loongarch/insn_trans/trans_lsx.c.inc
+++ b/target/loongarch/insn_trans/trans_lsx.c.inc
@@ -4255,7 +4255,7 @@ TRANS(vextrins_d, gen_vv_i, gen_helper_vextrins_d)
 
 static bool trans_vld(DisasContext *ctx, arg_vr_i *a)
 {
-    TCGv addr, temp;
+    TCGv addr;
     TCGv_i64 rl, rh;
     TCGv_i128 val;
 
@@ -4266,11 +4266,7 @@ static bool trans_vld(DisasContext *ctx, arg_vr_i *a)
     rl = tcg_temp_new_i64();
     rh = tcg_temp_new_i64();
 
-    if (a->imm) {
-        temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_ld_i128(val, addr, ctx->mem_idx, MO_128 | MO_TE);
     tcg_gen_extr_i128_i64(rl, rh, val);
@@ -4282,7 +4278,7 @@ static bool trans_vld(DisasContext *ctx, arg_vr_i *a)
 
 static bool trans_vst(DisasContext *ctx, arg_vr_i *a)
 {
-    TCGv addr, temp;
+    TCGv addr;
     TCGv_i128 val;
     TCGv_i64 ah, al;
 
@@ -4293,11 +4289,7 @@ static bool trans_vst(DisasContext *ctx, arg_vr_i *a)
     ah = tcg_temp_new_i64();
     al = tcg_temp_new_i64();
 
-    if (a->imm) {
-        temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     get_vreg64(ah, a->vd, 1);
     get_vreg64(al, a->vd, 0);
@@ -4356,7 +4348,7 @@ static bool trans_vstx(DisasContext *ctx, arg_vrr *a)
 #define VLDREPL(NAME, MO)                                                 \
 static bool trans_## NAME (DisasContext *ctx, arg_vr_i *a)                \
 {                                                                         \
-    TCGv addr, temp;                                                      \
+    TCGv addr;                                                            \
     TCGv_i64 val;                                                         \
                                                                           \
     CHECK_SXE;                                                            \
@@ -4364,11 +4356,7 @@ static bool trans_## NAME (DisasContext *ctx, arg_vr_i *a)                \
     addr = gpr_src(ctx, a->rj, EXT_NONE);                                 \
     val = tcg_temp_new_i64();                                             \
                                                                           \
-    if (a->imm) {                                                         \
-        temp = tcg_temp_new();                                            \
-        tcg_gen_addi_tl(temp, addr, a->imm);                              \
-        addr = temp;                                                      \
-    }                                                                     \
+    addr = make_address_i(ctx, addr, a->imm);                             \
                                                                           \
     tcg_gen_qemu_ld_i64(val, addr, ctx->mem_idx, MO);                     \
     tcg_gen_gvec_dup_i64(MO, vec_full_offset(a->vd), 16, ctx->vl/8, val); \
@@ -4384,7 +4372,7 @@ VLDREPL(vldrepl_d, MO_64)
 #define VSTELM(NAME, MO, E)                                                  \
 static bool trans_## NAME (DisasContext *ctx, arg_vr_ii *a)                  \
 {                                                                            \
-    TCGv addr, temp;                                                         \
+    TCGv addr;                                                               \
     TCGv_i64 val;                                                            \
                                                                              \
     CHECK_SXE;                                                               \
@@ -4392,11 +4380,7 @@ static bool trans_## NAME (DisasContext *ctx, arg_vr_ii *a)                  \
     addr = gpr_src(ctx, a->rj, EXT_NONE);                                    \
     val = tcg_temp_new_i64();                                                \
                                                                              \
-    if (a->imm) {                                                            \
-        temp = tcg_temp_new();                                               \
-        tcg_gen_addi_tl(temp, addr, a->imm);                                 \
-        addr = temp;                                                         \
-    }                                                                        \
+    addr = make_address_i(ctx, addr, a->imm);                                \
                                                                              \
     tcg_gen_ld_i64(val, cpu_env,                                             \
                    offsetof(CPULoongArchState, fpr[a->vd].vreg.E(a->imm2))); \
diff --git a/target/loongarch/insn_trans/trans_memory.c.inc b/target/loongarch/insn_trans/trans_memory.c.inc
index ccebd0a4e0..88953f0ab0 100644
--- a/target/loongarch/insn_trans/trans_memory.c.inc
+++ b/target/loongarch/insn_trans/trans_memory.c.inc
@@ -8,11 +8,7 @@ static bool gen_load(DisasContext *ctx, arg_rr_i *a, MemOp mop)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
 
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     gen_set_gpr(a->rd, dest, EXT_NONE);
@@ -24,11 +20,7 @@ static bool gen_store(DisasContext *ctx, arg_rr_i *a, MemOp mop)
     TCGv data = gpr_src(ctx, a->rd, EXT_NONE);
     TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
 
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, mop);
     return true;
@@ -66,6 +58,7 @@ static bool gen_load_gt(DisasContext *ctx, arg_rrr *a, MemOp mop)
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 
     gen_helper_asrtgt_d(cpu_env, src1, src2);
+    src1 = make_address_i(ctx, src1, 0);
     tcg_gen_qemu_ld_tl(dest, src1, ctx->mem_idx, mop);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -79,6 +72,7 @@ static bool gen_load_le(DisasContext *ctx, arg_rrr *a, MemOp mop)
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 
     gen_helper_asrtle_d(cpu_env, src1, src2);
+    src1 = make_address_i(ctx, src1, 0);
     tcg_gen_qemu_ld_tl(dest, src1, ctx->mem_idx, mop);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -92,6 +86,7 @@ static bool gen_store_gt(DisasContext *ctx, arg_rrr *a, MemOp mop)
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 
     gen_helper_asrtgt_d(cpu_env, src1, src2);
+    src1 = make_address_i(ctx, src1, 0);
     tcg_gen_qemu_st_tl(data, src1, ctx->mem_idx, mop);
 
     return true;
@@ -104,6 +99,7 @@ static bool gen_store_le(DisasContext *ctx, arg_rrr *a, MemOp mop)
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 
     gen_helper_asrtle_d(cpu_env, src1, src2);
+    src1 = make_address_i(ctx, src1, 0);
     tcg_gen_qemu_st_tl(data, src1, ctx->mem_idx, mop);
 
     return true;
@@ -131,11 +127,7 @@ static bool gen_ldptr(DisasContext *ctx, arg_rr_i *a, MemOp mop)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
 
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, mop);
     gen_set_gpr(a->rd, dest, EXT_NONE);
@@ -147,11 +139,7 @@ static bool gen_stptr(DisasContext *ctx, arg_rr_i *a, MemOp mop)
     TCGv data = gpr_src(ctx, a->rd, EXT_NONE);
     TCGv addr = gpr_src(ctx, a->rj, EXT_NONE);
 
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
+    addr = make_address_i(ctx, addr, a->imm);
 
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, mop);
     return true;
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index a68a979a55..acc54d7587 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -220,6 +220,12 @@ static TCGv make_address_x(DisasContext *ctx, TCGv base, TCGv addend)
     return base;
 }
 
+static TCGv make_address_i(DisasContext *ctx, TCGv base, target_long ofs)
+{
+    TCGv addend = ofs ? tcg_constant_tl(ofs) : NULL;
+    return make_address_x(ctx, base, addend);
+}
+
 #include "decode-insns.c.inc"
 #include "insn_trans/trans_arith.c.inc"
 #include "insn_trans/trans_shift.c.inc"

From 5a7ce25d0db050b8ddd62dc91c56f4af46e9cf3c Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:53 +0200
Subject: [PATCH 1182/1353] target/loongarch: Extract make_address_pc() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-7-gaosong@loongson.cn>
[PMD: Extract helper from bigger patch]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230822071405.35386-8-philmd@linaro.org>
---
 target/loongarch/insn_trans/trans_arith.c.inc  | 2 +-
 target/loongarch/insn_trans/trans_branch.c.inc | 4 ++--
 target/loongarch/translate.c                   | 5 +++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_arith.c.inc b/target/loongarch/insn_trans/trans_arith.c.inc
index 43d6cf261d..2aea4e41d5 100644
--- a/target/loongarch/insn_trans/trans_arith.c.inc
+++ b/target/loongarch/insn_trans/trans_arith.c.inc
@@ -72,7 +72,7 @@ static bool gen_pc(DisasContext *ctx, arg_r_i *a,
                    target_ulong (*func)(target_ulong, int))
 {
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
-    target_ulong addr = func(ctx->base.pc_next, a->imm);
+    target_ulong addr = make_address_pc(ctx, func(ctx->base.pc_next, a->imm));
 
     tcg_gen_movi_tl(dest, addr);
     gen_set_gpr(a->rd, dest, EXT_NONE);
diff --git a/target/loongarch/insn_trans/trans_branch.c.inc b/target/loongarch/insn_trans/trans_branch.c.inc
index 3ad34bcc05..2e35572cea 100644
--- a/target/loongarch/insn_trans/trans_branch.c.inc
+++ b/target/loongarch/insn_trans/trans_branch.c.inc
@@ -12,7 +12,7 @@ static bool trans_b(DisasContext *ctx, arg_b *a)
 
 static bool trans_bl(DisasContext *ctx, arg_bl *a)
 {
-    tcg_gen_movi_tl(cpu_gpr[1], ctx->base.pc_next + 4);
+    tcg_gen_movi_tl(cpu_gpr[1], make_address_pc(ctx, ctx->base.pc_next + 4));
     gen_goto_tb(ctx, 0, ctx->base.pc_next + a->offs);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
@@ -25,7 +25,7 @@ static bool trans_jirl(DisasContext *ctx, arg_jirl *a)
 
     TCGv addr = make_address_i(ctx, src1, a->imm);
     tcg_gen_mov_tl(cpu_pc, addr);
-    tcg_gen_movi_tl(dest, ctx->base.pc_next + 4);
+    tcg_gen_movi_tl(dest, make_address_pc(ctx, ctx->base.pc_next + 4));
     gen_set_gpr(a->rd, dest, EXT_NONE);
     tcg_gen_lookup_and_goto_ptr();
     ctx->base.is_jmp = DISAS_NORETURN;
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index acc54d7587..8b26555a27 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -226,6 +226,11 @@ static TCGv make_address_i(DisasContext *ctx, TCGv base, target_long ofs)
     return make_address_x(ctx, base, addend);
 }
 
+static uint64_t make_address_pc(DisasContext *ctx, uint64_t addr)
+{
+    return addr;
+}
+
 #include "decode-insns.c.inc"
 #include "insn_trans/trans_arith.c.inc"
 #include "insn_trans/trans_shift.c.inc"

From 2f6478ffad1770a474460b7692588bae7f031da3 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:54 +0200
Subject: [PATCH 1183/1353] target/loongarch: Extract set_pc() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jiajie Chen <c@jia.je>
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-6-gaosong@loongson.cn>
[PMD: Extract helper from bigger patch]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230822071405.35386-9-philmd@linaro.org>
---
 target/loongarch/cpu.c       | 16 ++++++++--------
 target/loongarch/cpu.h       |  5 +++++
 target/loongarch/gdbstub.c   |  2 +-
 target/loongarch/op_helper.c |  4 ++--
 4 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 822f2a72e5..67eb6c3135 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -81,7 +81,7 @@ static void loongarch_cpu_set_pc(CPUState *cs, vaddr value)
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
     CPULoongArchState *env = &cpu->env;
 
-    env->pc = value;
+    set_pc(env, value);
 }
 
 static vaddr loongarch_cpu_get_pc(CPUState *cs)
@@ -168,7 +168,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
     set_DERA:
         env->CSR_DERA = env->pc;
         env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DST, 1);
-        env->pc = env->CSR_EENTRY + 0x480;
+        set_pc(env, env->CSR_EENTRY + 0x480);
         break;
     case EXCCODE_INT:
         if (FIELD_EX64(env->CSR_DBG, CSR_DBG, DST)) {
@@ -249,7 +249,8 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
 
         /* Find the highest-priority interrupt. */
         vector = 31 - clz32(pending);
-        env->pc = env->CSR_EENTRY + (EXCCODE_EXTERNAL_INT + vector) * vec_size;
+        set_pc(env, env->CSR_EENTRY + \
+               (EXCCODE_EXTERNAL_INT + vector) * vec_size);
         qemu_log_mask(CPU_LOG_INT,
                       "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
                       " cause %d\n" "    A " TARGET_FMT_lx " D "
@@ -260,10 +261,9 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
                       env->CSR_ECFG, env->CSR_ESTAT);
     } else {
         if (tlbfill) {
-            env->pc = env->CSR_TLBRENTRY;
+            set_pc(env, env->CSR_TLBRENTRY);
         } else {
-            env->pc = env->CSR_EENTRY;
-            env->pc += EXCODE_MCODE(cause) * vec_size;
+            set_pc(env, env->CSR_EENTRY + EXCODE_MCODE(cause) * vec_size);
         }
         qemu_log_mask(CPU_LOG_INT,
                       "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
@@ -324,7 +324,7 @@ static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
     CPULoongArchState *env = &cpu->env;
 
     tcg_debug_assert(!(cs->tcg_cflags & CF_PCREL));
-    env->pc = tb->pc;
+    set_pc(env, tb->pc);
 }
 
 static void loongarch_restore_state_to_opc(CPUState *cs,
@@ -334,7 +334,7 @@ static void loongarch_restore_state_to_opc(CPUState *cs,
     LoongArchCPU *cpu = LOONGARCH_CPU(cs);
     CPULoongArchState *env = &cpu->env;
 
-    env->pc = data[0];
+    set_pc(env, data[0]);
 }
 #endif /* CONFIG_TCG */
 
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 72109095e4..e1562695e8 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -443,6 +443,11 @@ static inline bool is_va32(CPULoongArchState *env)
     return va32;
 }
 
+static inline void set_pc(CPULoongArchState *env, uint64_t value)
+{
+    env->pc = value;
+}
+
 /*
  * LoongArch CPUs hardware flags.
  */
diff --git a/target/loongarch/gdbstub.c b/target/loongarch/gdbstub.c
index a462e25737..e20b20f99b 100644
--- a/target/loongarch/gdbstub.c
+++ b/target/loongarch/gdbstub.c
@@ -77,7 +77,7 @@ int loongarch_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
         env->gpr[n] = tmp;
         length = read_length;
     } else if (n == 33) {
-        env->pc = tmp;
+        set_pc(env, tmp);
         length = read_length;
     }
     return length;
diff --git a/target/loongarch/op_helper.c b/target/loongarch/op_helper.c
index 60335a05e2..cf84f20aba 100644
--- a/target/loongarch/op_helper.c
+++ b/target/loongarch/op_helper.c
@@ -114,14 +114,14 @@ void helper_ertn(CPULoongArchState *env)
         env->CSR_TLBRERA = FIELD_DP64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR, 0);
         env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, DA, 0);
         env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, PG, 1);
-        env->pc = env->CSR_TLBRERA;
+        set_pc(env, env->CSR_TLBRERA);
         qemu_log_mask(CPU_LOG_INT, "%s: TLBRERA " TARGET_FMT_lx "\n",
                       __func__, env->CSR_TLBRERA);
     } else {
         csr_pplv = FIELD_EX64(env->CSR_PRMD, CSR_PRMD, PPLV);
         csr_pie = FIELD_EX64(env->CSR_PRMD, CSR_PRMD, PIE);
 
-        env->pc = env->CSR_ERA;
+        set_pc(env, env->CSR_ERA);
         qemu_log_mask(CPU_LOG_INT, "%s: ERA " TARGET_FMT_lx "\n",
                       __func__, env->CSR_ERA);
     }

From 7033c0e6dd36cd2bfa9a323c3a51ecb0b55903fc Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:13:55 +0200
Subject: [PATCH 1184/1353] target/loongarch: Truncate high 32 bits of address
 in VA32 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When running in VA32 mode(!LA64 or VA32L[1-3] matching PLV), virtual
address is truncated to 32 bits before address mapping.

Signed-off-by: Jiajie Chen <c@jia.je>
Co-authored-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-6-gaosong@loongson.cn>
Message-Id: <20230822071405.35386-10-philmd@linaro.org>
---
 target/loongarch/cpu.h       |  6 +++++-
 target/loongarch/translate.c | 16 +++++++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index e1562695e8..25a0ef7e41 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -445,7 +445,11 @@ static inline bool is_va32(CPULoongArchState *env)
 
 static inline void set_pc(CPULoongArchState *env, uint64_t value)
 {
-    env->pc = value;
+    if (is_va32(env)) {
+        env->pc = (uint32_t)value;
+    } else {
+        env->pc = value;
+    }
 }
 
 /*
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index 8b26555a27..9a23ec786d 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -86,6 +86,10 @@ void generate_exception(DisasContext *ctx, int excp)
 
 static inline void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
+    if (ctx->va32) {
+        dest = (uint32_t) dest;
+    }
+
     if (translator_use_goto_tb(&ctx->base, dest)) {
         tcg_gen_goto_tb(n);
         tcg_gen_movi_tl(cpu_pc, dest);
@@ -212,11 +216,17 @@ static TCGv make_address_x(DisasContext *ctx, TCGv base, TCGv addend)
 {
     TCGv temp = NULL;
 
-    if (addend) {
+    if (addend || ctx->va32) {
         temp = tcg_temp_new();
+    }
+    if (addend) {
         tcg_gen_add_tl(temp, base, addend);
         base = temp;
     }
+    if (ctx->va32) {
+        tcg_gen_ext32u_tl(temp, base);
+        base = temp;
+    }
     return base;
 }
 
@@ -262,6 +272,10 @@ static void loongarch_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
     }
 
     ctx->base.pc_next += 4;
+
+    if (ctx->va32) {
+        ctx->base.pc_next = (uint32_t)ctx->base.pc_next;
+    }
 }
 
 static void loongarch_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)

From 6496269d7e0b7f0d42499d7e4dde19c8b6c759c9 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:19:50 +0200
Subject: [PATCH 1185/1353] target/loongarch: Sign extend results in VA32 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In VA32 mode, BL, JIRL and PC* instructions should sign-extend the low
32 bit result to 64 bits.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-7-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-1-philmd@linaro.org>
---
 target/loongarch/translate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index 9a23ec786d..de7c1c5d1f 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -238,6 +238,9 @@ static TCGv make_address_i(DisasContext *ctx, TCGv base, target_long ofs)
 
 static uint64_t make_address_pc(DisasContext *ctx, uint64_t addr)
 {
+    if (ctx->va32) {
+        addr = (int32_t)addr;
+    }
     return addr;
 }
 

From ec3a951891b00b2382bca29266c28f7ed021b0e5 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:19:51 +0200
Subject: [PATCH 1186/1353] target/loongarch: Add a check parameter to the
 TRANS macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default check parmeter is ALL.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-8-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-2-philmd@linaro.org>
---
 target/loongarch/insn_trans/trans_arith.c.inc |   84 +-
 .../loongarch/insn_trans/trans_atomic.c.inc   |   80 +-
 target/loongarch/insn_trans/trans_bit.c.inc   |   56 +-
 .../loongarch/insn_trans/trans_branch.c.inc   |   20 +-
 target/loongarch/insn_trans/trans_extra.c.inc |   16 +-
 .../loongarch/insn_trans/trans_farith.c.inc   |   72 +-
 target/loongarch/insn_trans/trans_fcnv.c.inc  |   56 +-
 .../loongarch/insn_trans/trans_fmemory.c.inc  |   32 +-
 target/loongarch/insn_trans/trans_fmov.c.inc  |   16 +-
 target/loongarch/insn_trans/trans_lsx.c.inc   | 1236 ++++++++---------
 .../loongarch/insn_trans/trans_memory.c.inc   |   84 +-
 .../insn_trans/trans_privileged.c.inc         |   16 +-
 target/loongarch/insn_trans/trans_shift.c.inc |   30 +-
 target/loongarch/translate.h                  |    6 +-
 14 files changed, 903 insertions(+), 901 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_arith.c.inc b/target/loongarch/insn_trans/trans_arith.c.inc
index 2aea4e41d5..d7f69a7553 100644
--- a/target/loongarch/insn_trans/trans_arith.c.inc
+++ b/target/loongarch/insn_trans/trans_arith.c.inc
@@ -248,45 +248,45 @@ static bool trans_addu16i_d(DisasContext *ctx, arg_addu16i_d *a)
     return true;
 }
 
-TRANS(add_w, gen_rrr, EXT_NONE, EXT_NONE, EXT_SIGN, tcg_gen_add_tl)
-TRANS(add_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_add_tl)
-TRANS(sub_w, gen_rrr, EXT_NONE, EXT_NONE, EXT_SIGN, tcg_gen_sub_tl)
-TRANS(sub_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_sub_tl)
-TRANS(and, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_and_tl)
-TRANS(or, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_or_tl)
-TRANS(xor, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_xor_tl)
-TRANS(nor, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_nor_tl)
-TRANS(andn, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_andc_tl)
-TRANS(orn, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_orc_tl)
-TRANS(slt, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_slt)
-TRANS(sltu, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sltu)
-TRANS(mul_w, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, tcg_gen_mul_tl)
-TRANS(mul_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_mul_tl)
-TRANS(mulh_w, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, gen_mulh_w)
-TRANS(mulh_wu, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, gen_mulh_w)
-TRANS(mulh_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_d)
-TRANS(mulh_du, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_du)
-TRANS(mulw_d_w, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, tcg_gen_mul_tl)
-TRANS(mulw_d_wu, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, tcg_gen_mul_tl)
-TRANS(div_w, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, gen_div_w)
-TRANS(mod_w, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, gen_rem_w)
-TRANS(div_wu, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_SIGN, gen_div_du)
-TRANS(mod_wu, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_SIGN, gen_rem_du)
-TRANS(div_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_d)
-TRANS(mod_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_d)
-TRANS(div_du, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_du)
-TRANS(mod_du, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_du)
-TRANS(slti, gen_rri_v, EXT_NONE, EXT_NONE, gen_slt)
-TRANS(sltui, gen_rri_v, EXT_NONE, EXT_NONE, gen_sltu)
-TRANS(addi_w, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_addi_tl)
-TRANS(addi_d, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_addi_tl)
-TRANS(alsl_w, gen_rrr_sa, EXT_NONE, EXT_SIGN, gen_alsl)
-TRANS(alsl_wu, gen_rrr_sa, EXT_NONE, EXT_ZERO, gen_alsl)
-TRANS(alsl_d, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_alsl)
-TRANS(pcaddi, gen_pc, gen_pcaddi)
-TRANS(pcalau12i, gen_pc, gen_pcalau12i)
-TRANS(pcaddu12i, gen_pc, gen_pcaddu12i)
-TRANS(pcaddu18i, gen_pc, gen_pcaddu18i)
-TRANS(andi, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_andi_tl)
-TRANS(ori, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_ori_tl)
-TRANS(xori, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_xori_tl)
+TRANS(add_w, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_SIGN, tcg_gen_add_tl)
+TRANS(add_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_add_tl)
+TRANS(sub_w, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_SIGN, tcg_gen_sub_tl)
+TRANS(sub_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_sub_tl)
+TRANS(and, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_and_tl)
+TRANS(or, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_or_tl)
+TRANS(xor, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_xor_tl)
+TRANS(nor, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_nor_tl)
+TRANS(andn, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_andc_tl)
+TRANS(orn, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_orc_tl)
+TRANS(slt, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_slt)
+TRANS(sltu, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sltu)
+TRANS(mul_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, tcg_gen_mul_tl)
+TRANS(mul_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_mul_tl)
+TRANS(mulh_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, gen_mulh_w)
+TRANS(mulh_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, gen_mulh_w)
+TRANS(mulh_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_d)
+TRANS(mulh_du, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_du)
+TRANS(mulw_d_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, tcg_gen_mul_tl)
+TRANS(mulw_d_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, tcg_gen_mul_tl)
+TRANS(div_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, gen_div_w)
+TRANS(mod_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, gen_rem_w)
+TRANS(div_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_SIGN, gen_div_du)
+TRANS(mod_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_SIGN, gen_rem_du)
+TRANS(div_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_d)
+TRANS(mod_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_d)
+TRANS(div_du, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_du)
+TRANS(mod_du, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_du)
+TRANS(slti, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_slt)
+TRANS(sltui, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_sltu)
+TRANS(addi_w, ALL, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_addi_tl)
+TRANS(addi_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_addi_tl)
+TRANS(alsl_w, ALL, gen_rrr_sa, EXT_NONE, EXT_SIGN, gen_alsl)
+TRANS(alsl_wu, ALL, gen_rrr_sa, EXT_NONE, EXT_ZERO, gen_alsl)
+TRANS(alsl_d, ALL, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_alsl)
+TRANS(pcaddi, ALL, gen_pc, gen_pcaddi)
+TRANS(pcalau12i, ALL, gen_pc, gen_pcalau12i)
+TRANS(pcaddu12i, ALL, gen_pc, gen_pcaddu12i)
+TRANS(pcaddu18i, ALL, gen_pc, gen_pcaddu18i)
+TRANS(andi, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_andi_tl)
+TRANS(ori, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_ori_tl)
+TRANS(xori, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_xori_tl)
diff --git a/target/loongarch/insn_trans/trans_atomic.c.inc b/target/loongarch/insn_trans/trans_atomic.c.inc
index fbc081448d..0a02f0dbf3 100644
--- a/target/loongarch/insn_trans/trans_atomic.c.inc
+++ b/target/loongarch/insn_trans/trans_atomic.c.inc
@@ -69,43 +69,43 @@ static bool gen_am(DisasContext *ctx, arg_rrr *a,
     return true;
 }
 
-TRANS(ll_w, gen_ll, MO_TESL)
-TRANS(sc_w, gen_sc, MO_TESL)
-TRANS(ll_d, gen_ll, MO_TEUQ)
-TRANS(sc_d, gen_sc, MO_TEUQ)
-TRANS(amswap_w, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_d, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
-TRANS(amadd_w, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_d, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
-TRANS(amand_w, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_d, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
-TRANS(amor_w, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_d, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
-TRANS(amxor_w, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_d, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
-TRANS(ammax_w, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_d, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
-TRANS(ammin_w, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_d, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
-TRANS(ammax_wu, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_du, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
-TRANS(ammin_wu, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_du, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
-TRANS(amswap_db_w, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_db_d, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
-TRANS(amadd_db_w, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_db_d, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
-TRANS(amand_db_w, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_db_d, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
-TRANS(amor_db_w, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_db_d, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
-TRANS(amxor_db_w, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_db_d, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
-TRANS(ammax_db_w, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_db_d, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
-TRANS(ammin_db_w, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_db_d, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
-TRANS(ammax_db_wu, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_db_du, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
-TRANS(ammin_db_wu, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_db_du, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS(ll_w, ALL, gen_ll, MO_TESL)
+TRANS(sc_w, ALL, gen_sc, MO_TESL)
+TRANS(ll_d, ALL, gen_ll, MO_TEUQ)
+TRANS(sc_d, ALL, gen_sc, MO_TEUQ)
+TRANS(amswap_w, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
+TRANS(amswap_d, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS(amadd_w, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
+TRANS(amadd_d, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS(amand_w, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
+TRANS(amand_d, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS(amor_w, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
+TRANS(amor_d, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS(amxor_w, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
+TRANS(amxor_d, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS(ammax_w, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
+TRANS(ammax_d, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS(ammin_w, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
+TRANS(ammin_d, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS(ammax_wu, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
+TRANS(ammax_du, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS(ammin_wu, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
+TRANS(ammin_du, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS(amswap_db_w, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
+TRANS(amswap_db_d, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS(amadd_db_w, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
+TRANS(amadd_db_d, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS(amand_db_w, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
+TRANS(amand_db_d, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS(amor_db_w, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
+TRANS(amor_db_d, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS(amxor_db_w, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
+TRANS(amxor_db_d, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS(ammax_db_w, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
+TRANS(ammax_db_d, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS(ammin_db_w, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
+TRANS(ammin_db_d, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS(ammax_db_wu, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
+TRANS(ammax_db_du, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS(ammin_db_wu, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
+TRANS(ammin_db_du, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
diff --git a/target/loongarch/insn_trans/trans_bit.c.inc b/target/loongarch/insn_trans/trans_bit.c.inc
index 25b4d7858b..d2a7ac28f7 100644
--- a/target/loongarch/insn_trans/trans_bit.c.inc
+++ b/target/loongarch/insn_trans/trans_bit.c.inc
@@ -178,31 +178,31 @@ static void gen_masknez(TCGv dest, TCGv src1, TCGv src2)
     tcg_gen_movcond_tl(TCG_COND_NE, dest, src2, zero, zero, src1);
 }
 
-TRANS(ext_w_h, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_ext16s_tl)
-TRANS(ext_w_b, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_ext8s_tl)
-TRANS(clo_w, gen_rr, EXT_NONE, EXT_NONE, gen_clo_w)
-TRANS(clz_w, gen_rr, EXT_ZERO, EXT_NONE, gen_clz_w)
-TRANS(cto_w, gen_rr, EXT_NONE, EXT_NONE, gen_cto_w)
-TRANS(ctz_w, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_w)
-TRANS(clo_d, gen_rr, EXT_NONE, EXT_NONE, gen_clo_d)
-TRANS(clz_d, gen_rr, EXT_NONE, EXT_NONE, gen_clz_d)
-TRANS(cto_d, gen_rr, EXT_NONE, EXT_NONE, gen_cto_d)
-TRANS(ctz_d, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_d)
-TRANS(revb_2h, gen_rr, EXT_NONE, EXT_SIGN, gen_revb_2h)
-TRANS(revb_4h, gen_rr, EXT_NONE, EXT_NONE, gen_revb_4h)
-TRANS(revb_2w, gen_rr, EXT_NONE, EXT_NONE, gen_revb_2w)
-TRANS(revb_d, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_bswap64_i64)
-TRANS(revh_2w, gen_rr, EXT_NONE, EXT_NONE, gen_revh_2w)
-TRANS(revh_d, gen_rr, EXT_NONE, EXT_NONE, gen_revh_d)
-TRANS(bitrev_4b, gen_rr, EXT_ZERO, EXT_SIGN, gen_helper_bitswap)
-TRANS(bitrev_8b, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitswap)
-TRANS(bitrev_w, gen_rr, EXT_NONE, EXT_SIGN, gen_helper_bitrev_w)
-TRANS(bitrev_d, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitrev_d)
-TRANS(maskeqz, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_maskeqz)
-TRANS(masknez, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_masknez)
-TRANS(bytepick_w, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_w)
-TRANS(bytepick_d, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_d)
-TRANS(bstrins_w, gen_bstrins, EXT_SIGN)
-TRANS(bstrins_d, gen_bstrins, EXT_NONE)
-TRANS(bstrpick_w, gen_bstrpick, EXT_SIGN)
-TRANS(bstrpick_d, gen_bstrpick, EXT_NONE)
+TRANS(ext_w_h, ALL, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_ext16s_tl)
+TRANS(ext_w_b, ALL, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_ext8s_tl)
+TRANS(clo_w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_clo_w)
+TRANS(clz_w, ALL, gen_rr, EXT_ZERO, EXT_NONE, gen_clz_w)
+TRANS(cto_w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_cto_w)
+TRANS(ctz_w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_w)
+TRANS(clo_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_clo_d)
+TRANS(clz_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_clz_d)
+TRANS(cto_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_cto_d)
+TRANS(ctz_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_d)
+TRANS(revb_2h, ALL, gen_rr, EXT_NONE, EXT_SIGN, gen_revb_2h)
+TRANS(revb_4h, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revb_4h)
+TRANS(revb_2w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revb_2w)
+TRANS(revb_d, ALL, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_bswap64_i64)
+TRANS(revh_2w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revh_2w)
+TRANS(revh_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revh_d)
+TRANS(bitrev_4b, ALL, gen_rr, EXT_ZERO, EXT_SIGN, gen_helper_bitswap)
+TRANS(bitrev_8b, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitswap)
+TRANS(bitrev_w, ALL, gen_rr, EXT_NONE, EXT_SIGN, gen_helper_bitrev_w)
+TRANS(bitrev_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitrev_d)
+TRANS(maskeqz, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_maskeqz)
+TRANS(masknez, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_masknez)
+TRANS(bytepick_w, ALL, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_w)
+TRANS(bytepick_d, ALL, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_d)
+TRANS(bstrins_w, ALL, gen_bstrins, EXT_SIGN)
+TRANS(bstrins_d, ALL, gen_bstrins, EXT_NONE)
+TRANS(bstrpick_w, ALL, gen_bstrpick, EXT_SIGN)
+TRANS(bstrpick_d, ALL, gen_bstrpick, EXT_NONE)
diff --git a/target/loongarch/insn_trans/trans_branch.c.inc b/target/loongarch/insn_trans/trans_branch.c.inc
index 2e35572cea..50f7eb640a 100644
--- a/target/loongarch/insn_trans/trans_branch.c.inc
+++ b/target/loongarch/insn_trans/trans_branch.c.inc
@@ -72,13 +72,13 @@ static bool gen_cz_bc(DisasContext *ctx, arg_c_offs *a, TCGCond cond)
     return true;
 }
 
-TRANS(beq, gen_rr_bc, TCG_COND_EQ)
-TRANS(bne, gen_rr_bc, TCG_COND_NE)
-TRANS(blt, gen_rr_bc, TCG_COND_LT)
-TRANS(bge, gen_rr_bc, TCG_COND_GE)
-TRANS(bltu, gen_rr_bc, TCG_COND_LTU)
-TRANS(bgeu, gen_rr_bc, TCG_COND_GEU)
-TRANS(beqz, gen_rz_bc, TCG_COND_EQ)
-TRANS(bnez, gen_rz_bc, TCG_COND_NE)
-TRANS(bceqz, gen_cz_bc, TCG_COND_EQ)
-TRANS(bcnez, gen_cz_bc, TCG_COND_NE)
+TRANS(beq, ALL, gen_rr_bc, TCG_COND_EQ)
+TRANS(bne, ALL, gen_rr_bc, TCG_COND_NE)
+TRANS(blt, ALL, gen_rr_bc, TCG_COND_LT)
+TRANS(bge, ALL, gen_rr_bc, TCG_COND_GE)
+TRANS(bltu, ALL, gen_rr_bc, TCG_COND_LTU)
+TRANS(bgeu, ALL, gen_rr_bc, TCG_COND_GEU)
+TRANS(beqz, ALL, gen_rz_bc, TCG_COND_EQ)
+TRANS(bnez, ALL, gen_rz_bc, TCG_COND_NE)
+TRANS(bceqz, ALL, gen_cz_bc, TCG_COND_EQ)
+TRANS(bcnez, ALL, gen_cz_bc, TCG_COND_NE)
diff --git a/target/loongarch/insn_trans/trans_extra.c.inc b/target/loongarch/insn_trans/trans_extra.c.inc
index 06f4de4515..b354ca0f86 100644
--- a/target/loongarch/insn_trans/trans_extra.c.inc
+++ b/target/loongarch/insn_trans/trans_extra.c.inc
@@ -89,11 +89,11 @@ static bool gen_crc(DisasContext *ctx, arg_rrr *a,
     return true;
 }
 
-TRANS(crc_w_b_w, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
-TRANS(crc_w_h_w, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
-TRANS(crc_w_w_w, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
-TRANS(crc_w_d_w, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
-TRANS(crcc_w_b_w, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
-TRANS(crcc_w_h_w, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
-TRANS(crcc_w_w_w, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
-TRANS(crcc_w_d_w, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
+TRANS(crc_w_b_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
+TRANS(crc_w_h_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
+TRANS(crc_w_w_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
+TRANS(crc_w_d_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
+TRANS(crcc_w_b_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
+TRANS(crcc_w_h_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
+TRANS(crcc_w_w_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
+TRANS(crcc_w_d_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
diff --git a/target/loongarch/insn_trans/trans_farith.c.inc b/target/loongarch/insn_trans/trans_farith.c.inc
index 21ea47308b..b1a1dc7b01 100644
--- a/target/loongarch/insn_trans/trans_farith.c.inc
+++ b/target/loongarch/insn_trans/trans_farith.c.inc
@@ -143,41 +143,41 @@ static bool trans_fneg_d(DisasContext *ctx, arg_fneg_d *a)
     return true;
 }
 
-TRANS(fadd_s, gen_fff, gen_helper_fadd_s)
-TRANS(fadd_d, gen_fff, gen_helper_fadd_d)
-TRANS(fsub_s, gen_fff, gen_helper_fsub_s)
-TRANS(fsub_d, gen_fff, gen_helper_fsub_d)
-TRANS(fmul_s, gen_fff, gen_helper_fmul_s)
-TRANS(fmul_d, gen_fff, gen_helper_fmul_d)
-TRANS(fdiv_s, gen_fff, gen_helper_fdiv_s)
-TRANS(fdiv_d, gen_fff, gen_helper_fdiv_d)
-TRANS(fmax_s, gen_fff, gen_helper_fmax_s)
-TRANS(fmax_d, gen_fff, gen_helper_fmax_d)
-TRANS(fmin_s, gen_fff, gen_helper_fmin_s)
-TRANS(fmin_d, gen_fff, gen_helper_fmin_d)
-TRANS(fmaxa_s, gen_fff, gen_helper_fmaxa_s)
-TRANS(fmaxa_d, gen_fff, gen_helper_fmaxa_d)
-TRANS(fmina_s, gen_fff, gen_helper_fmina_s)
-TRANS(fmina_d, gen_fff, gen_helper_fmina_d)
-TRANS(fscaleb_s, gen_fff, gen_helper_fscaleb_s)
-TRANS(fscaleb_d, gen_fff, gen_helper_fscaleb_d)
-TRANS(fsqrt_s, gen_ff, gen_helper_fsqrt_s)
-TRANS(fsqrt_d, gen_ff, gen_helper_fsqrt_d)
-TRANS(frecip_s, gen_ff, gen_helper_frecip_s)
-TRANS(frecip_d, gen_ff, gen_helper_frecip_d)
-TRANS(frsqrt_s, gen_ff, gen_helper_frsqrt_s)
-TRANS(frsqrt_d, gen_ff, gen_helper_frsqrt_d)
-TRANS(flogb_s, gen_ff, gen_helper_flogb_s)
-TRANS(flogb_d, gen_ff, gen_helper_flogb_d)
-TRANS(fclass_s, gen_ff, gen_helper_fclass_s)
-TRANS(fclass_d, gen_ff, gen_helper_fclass_d)
-TRANS(fmadd_s, gen_muladd, gen_helper_fmuladd_s, 0)
-TRANS(fmadd_d, gen_muladd, gen_helper_fmuladd_d, 0)
-TRANS(fmsub_s, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_c)
-TRANS(fmsub_d, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_c)
-TRANS(fnmadd_s, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_result)
-TRANS(fnmadd_d, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_result)
-TRANS(fnmsub_s, gen_muladd, gen_helper_fmuladd_s,
+TRANS(fadd_s, ALL, gen_fff, gen_helper_fadd_s)
+TRANS(fadd_d, ALL, gen_fff, gen_helper_fadd_d)
+TRANS(fsub_s, ALL, gen_fff, gen_helper_fsub_s)
+TRANS(fsub_d, ALL, gen_fff, gen_helper_fsub_d)
+TRANS(fmul_s, ALL, gen_fff, gen_helper_fmul_s)
+TRANS(fmul_d, ALL, gen_fff, gen_helper_fmul_d)
+TRANS(fdiv_s, ALL, gen_fff, gen_helper_fdiv_s)
+TRANS(fdiv_d, ALL, gen_fff, gen_helper_fdiv_d)
+TRANS(fmax_s, ALL, gen_fff, gen_helper_fmax_s)
+TRANS(fmax_d, ALL, gen_fff, gen_helper_fmax_d)
+TRANS(fmin_s, ALL, gen_fff, gen_helper_fmin_s)
+TRANS(fmin_d, ALL, gen_fff, gen_helper_fmin_d)
+TRANS(fmaxa_s, ALL, gen_fff, gen_helper_fmaxa_s)
+TRANS(fmaxa_d, ALL, gen_fff, gen_helper_fmaxa_d)
+TRANS(fmina_s, ALL, gen_fff, gen_helper_fmina_s)
+TRANS(fmina_d, ALL, gen_fff, gen_helper_fmina_d)
+TRANS(fscaleb_s, ALL, gen_fff, gen_helper_fscaleb_s)
+TRANS(fscaleb_d, ALL, gen_fff, gen_helper_fscaleb_d)
+TRANS(fsqrt_s, ALL, gen_ff, gen_helper_fsqrt_s)
+TRANS(fsqrt_d, ALL, gen_ff, gen_helper_fsqrt_d)
+TRANS(frecip_s, ALL, gen_ff, gen_helper_frecip_s)
+TRANS(frecip_d, ALL, gen_ff, gen_helper_frecip_d)
+TRANS(frsqrt_s, ALL, gen_ff, gen_helper_frsqrt_s)
+TRANS(frsqrt_d, ALL, gen_ff, gen_helper_frsqrt_d)
+TRANS(flogb_s, ALL, gen_ff, gen_helper_flogb_s)
+TRANS(flogb_d, ALL, gen_ff, gen_helper_flogb_d)
+TRANS(fclass_s, ALL, gen_ff, gen_helper_fclass_s)
+TRANS(fclass_d, ALL, gen_ff, gen_helper_fclass_d)
+TRANS(fmadd_s, ALL, gen_muladd, gen_helper_fmuladd_s, 0)
+TRANS(fmadd_d, ALL, gen_muladd, gen_helper_fmuladd_d, 0)
+TRANS(fmsub_s, ALL, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_c)
+TRANS(fmsub_d, ALL, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_c)
+TRANS(fnmadd_s, ALL, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_result)
+TRANS(fnmadd_d, ALL, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_result)
+TRANS(fnmsub_s, ALL, gen_muladd, gen_helper_fmuladd_s,
       float_muladd_negate_c | float_muladd_negate_result)
-TRANS(fnmsub_d, gen_muladd, gen_helper_fmuladd_d,
+TRANS(fnmsub_d, ALL, gen_muladd, gen_helper_fmuladd_d,
       float_muladd_negate_c | float_muladd_negate_result)
diff --git a/target/loongarch/insn_trans/trans_fcnv.c.inc b/target/loongarch/insn_trans/trans_fcnv.c.inc
index c1c6918ad1..329a2d6872 100644
--- a/target/loongarch/insn_trans/trans_fcnv.c.inc
+++ b/target/loongarch/insn_trans/trans_fcnv.c.inc
@@ -3,31 +3,31 @@
  * Copyright (c) 2021 Loongson Technology Corporation Limited
  */
 
-TRANS(fcvt_s_d, gen_ff, gen_helper_fcvt_s_d)
-TRANS(fcvt_d_s, gen_ff, gen_helper_fcvt_d_s)
-TRANS(ftintrm_w_s, gen_ff, gen_helper_ftintrm_w_s)
-TRANS(ftintrm_w_d, gen_ff, gen_helper_ftintrm_w_d)
-TRANS(ftintrm_l_s, gen_ff, gen_helper_ftintrm_l_s)
-TRANS(ftintrm_l_d, gen_ff, gen_helper_ftintrm_l_d)
-TRANS(ftintrp_w_s, gen_ff, gen_helper_ftintrp_w_s)
-TRANS(ftintrp_w_d, gen_ff, gen_helper_ftintrp_w_d)
-TRANS(ftintrp_l_s, gen_ff, gen_helper_ftintrp_l_s)
-TRANS(ftintrp_l_d, gen_ff, gen_helper_ftintrp_l_d)
-TRANS(ftintrz_w_s, gen_ff, gen_helper_ftintrz_w_s)
-TRANS(ftintrz_w_d, gen_ff, gen_helper_ftintrz_w_d)
-TRANS(ftintrz_l_s, gen_ff, gen_helper_ftintrz_l_s)
-TRANS(ftintrz_l_d, gen_ff, gen_helper_ftintrz_l_d)
-TRANS(ftintrne_w_s, gen_ff, gen_helper_ftintrne_w_s)
-TRANS(ftintrne_w_d, gen_ff, gen_helper_ftintrne_w_d)
-TRANS(ftintrne_l_s, gen_ff, gen_helper_ftintrne_l_s)
-TRANS(ftintrne_l_d, gen_ff, gen_helper_ftintrne_l_d)
-TRANS(ftint_w_s, gen_ff, gen_helper_ftint_w_s)
-TRANS(ftint_w_d, gen_ff, gen_helper_ftint_w_d)
-TRANS(ftint_l_s, gen_ff, gen_helper_ftint_l_s)
-TRANS(ftint_l_d, gen_ff, gen_helper_ftint_l_d)
-TRANS(ffint_s_w, gen_ff, gen_helper_ffint_s_w)
-TRANS(ffint_s_l, gen_ff, gen_helper_ffint_s_l)
-TRANS(ffint_d_w, gen_ff, gen_helper_ffint_d_w)
-TRANS(ffint_d_l, gen_ff, gen_helper_ffint_d_l)
-TRANS(frint_s, gen_ff, gen_helper_frint_s)
-TRANS(frint_d, gen_ff, gen_helper_frint_d)
+TRANS(fcvt_s_d, ALL, gen_ff, gen_helper_fcvt_s_d)
+TRANS(fcvt_d_s, ALL, gen_ff, gen_helper_fcvt_d_s)
+TRANS(ftintrm_w_s, ALL, gen_ff, gen_helper_ftintrm_w_s)
+TRANS(ftintrm_w_d, ALL, gen_ff, gen_helper_ftintrm_w_d)
+TRANS(ftintrm_l_s, ALL, gen_ff, gen_helper_ftintrm_l_s)
+TRANS(ftintrm_l_d, ALL, gen_ff, gen_helper_ftintrm_l_d)
+TRANS(ftintrp_w_s, ALL, gen_ff, gen_helper_ftintrp_w_s)
+TRANS(ftintrp_w_d, ALL, gen_ff, gen_helper_ftintrp_w_d)
+TRANS(ftintrp_l_s, ALL, gen_ff, gen_helper_ftintrp_l_s)
+TRANS(ftintrp_l_d, ALL, gen_ff, gen_helper_ftintrp_l_d)
+TRANS(ftintrz_w_s, ALL, gen_ff, gen_helper_ftintrz_w_s)
+TRANS(ftintrz_w_d, ALL, gen_ff, gen_helper_ftintrz_w_d)
+TRANS(ftintrz_l_s, ALL, gen_ff, gen_helper_ftintrz_l_s)
+TRANS(ftintrz_l_d, ALL, gen_ff, gen_helper_ftintrz_l_d)
+TRANS(ftintrne_w_s, ALL, gen_ff, gen_helper_ftintrne_w_s)
+TRANS(ftintrne_w_d, ALL, gen_ff, gen_helper_ftintrne_w_d)
+TRANS(ftintrne_l_s, ALL, gen_ff, gen_helper_ftintrne_l_s)
+TRANS(ftintrne_l_d, ALL, gen_ff, gen_helper_ftintrne_l_d)
+TRANS(ftint_w_s, ALL, gen_ff, gen_helper_ftint_w_s)
+TRANS(ftint_w_d, ALL, gen_ff, gen_helper_ftint_w_d)
+TRANS(ftint_l_s, ALL, gen_ff, gen_helper_ftint_l_s)
+TRANS(ftint_l_d, ALL, gen_ff, gen_helper_ftint_l_d)
+TRANS(ffint_s_w, ALL, gen_ff, gen_helper_ffint_s_w)
+TRANS(ffint_s_l, ALL, gen_ff, gen_helper_ffint_s_l)
+TRANS(ffint_d_w, ALL, gen_ff, gen_helper_ffint_d_w)
+TRANS(ffint_d_l, ALL, gen_ff, gen_helper_ffint_d_l)
+TRANS(frint_s, ALL, gen_ff, gen_helper_frint_s)
+TRANS(frint_d, ALL, gen_ff, gen_helper_frint_d)
diff --git a/target/loongarch/insn_trans/trans_fmemory.c.inc b/target/loongarch/insn_trans/trans_fmemory.c.inc
index bd3aba2c49..8e3b4522c9 100644
--- a/target/loongarch/insn_trans/trans_fmemory.c.inc
+++ b/target/loongarch/insn_trans/trans_fmemory.c.inc
@@ -140,19 +140,19 @@ static bool gen_fstore_le(DisasContext *ctx, arg_frr *a, MemOp mop)
     return true;
 }
 
-TRANS(fld_s, gen_fload_i, MO_TEUL)
-TRANS(fst_s, gen_fstore_i, MO_TEUL)
-TRANS(fld_d, gen_fload_i, MO_TEUQ)
-TRANS(fst_d, gen_fstore_i, MO_TEUQ)
-TRANS(fldx_s, gen_floadx, MO_TEUL)
-TRANS(fldx_d, gen_floadx, MO_TEUQ)
-TRANS(fstx_s, gen_fstorex, MO_TEUL)
-TRANS(fstx_d, gen_fstorex, MO_TEUQ)
-TRANS(fldgt_s, gen_fload_gt, MO_TEUL)
-TRANS(fldgt_d, gen_fload_gt, MO_TEUQ)
-TRANS(fldle_s, gen_fload_le, MO_TEUL)
-TRANS(fldle_d, gen_fload_le, MO_TEUQ)
-TRANS(fstgt_s, gen_fstore_gt, MO_TEUL)
-TRANS(fstgt_d, gen_fstore_gt, MO_TEUQ)
-TRANS(fstle_s, gen_fstore_le, MO_TEUL)
-TRANS(fstle_d, gen_fstore_le, MO_TEUQ)
+TRANS(fld_s, ALL, gen_fload_i, MO_TEUL)
+TRANS(fst_s, ALL, gen_fstore_i, MO_TEUL)
+TRANS(fld_d, ALL, gen_fload_i, MO_TEUQ)
+TRANS(fst_d, ALL, gen_fstore_i, MO_TEUQ)
+TRANS(fldx_s, ALL, gen_floadx, MO_TEUL)
+TRANS(fldx_d, ALL, gen_floadx, MO_TEUQ)
+TRANS(fstx_s, ALL, gen_fstorex, MO_TEUL)
+TRANS(fstx_d, ALL, gen_fstorex, MO_TEUQ)
+TRANS(fldgt_s, ALL, gen_fload_gt, MO_TEUL)
+TRANS(fldgt_d, ALL, gen_fload_gt, MO_TEUQ)
+TRANS(fldle_s, ALL, gen_fload_le, MO_TEUL)
+TRANS(fldle_d, ALL, gen_fload_le, MO_TEUQ)
+TRANS(fstgt_s, ALL, gen_fstore_gt, MO_TEUL)
+TRANS(fstgt_d, ALL, gen_fstore_gt, MO_TEUQ)
+TRANS(fstle_s, ALL, gen_fstore_le, MO_TEUL)
+TRANS(fstle_d, ALL, gen_fstore_le, MO_TEUQ)
diff --git a/target/loongarch/insn_trans/trans_fmov.c.inc b/target/loongarch/insn_trans/trans_fmov.c.inc
index 5af0dd1b66..aa7fea67b5 100644
--- a/target/loongarch/insn_trans/trans_fmov.c.inc
+++ b/target/loongarch/insn_trans/trans_fmov.c.inc
@@ -178,11 +178,11 @@ static bool trans_movcf2gr(DisasContext *ctx, arg_movcf2gr *a)
     return true;
 }
 
-TRANS(fmov_s, gen_f2f, tcg_gen_mov_tl, true)
-TRANS(fmov_d, gen_f2f, tcg_gen_mov_tl, false)
-TRANS(movgr2fr_w, gen_r2f, gen_movgr2fr_w)
-TRANS(movgr2fr_d, gen_r2f, tcg_gen_mov_tl)
-TRANS(movgr2frh_w, gen_r2f, gen_movgr2frh_w)
-TRANS(movfr2gr_s, gen_f2r, tcg_gen_ext32s_tl)
-TRANS(movfr2gr_d, gen_f2r, tcg_gen_mov_tl)
-TRANS(movfrh2gr_s, gen_f2r, gen_movfrh2gr_s)
+TRANS(fmov_s, ALL, gen_f2f, tcg_gen_mov_tl, true)
+TRANS(fmov_d, ALL, gen_f2f, tcg_gen_mov_tl, false)
+TRANS(movgr2fr_w, ALL, gen_r2f, gen_movgr2fr_w)
+TRANS(movgr2fr_d, ALL, gen_r2f, tcg_gen_mov_tl)
+TRANS(movgr2frh_w, ALL, gen_r2f, gen_movgr2frh_w)
+TRANS(movfr2gr_s, ALL, gen_f2r, tcg_gen_ext32s_tl)
+TRANS(movfr2gr_d, ALL, gen_f2r, tcg_gen_mov_tl)
+TRANS(movfrh2gr_s, ALL, gen_f2r, gen_movfrh2gr_s)
diff --git a/target/loongarch/insn_trans/trans_lsx.c.inc b/target/loongarch/insn_trans/trans_lsx.c.inc
index 50153d6d0b..45e0e738ad 100644
--- a/target/loongarch/insn_trans/trans_lsx.c.inc
+++ b/target/loongarch/insn_trans/trans_lsx.c.inc
@@ -135,10 +135,10 @@ static bool gvec_subi(DisasContext *ctx, arg_vv_i *a, MemOp mop)
     return true;
 }
 
-TRANS(vadd_b, gvec_vvv, MO_8, tcg_gen_gvec_add)
-TRANS(vadd_h, gvec_vvv, MO_16, tcg_gen_gvec_add)
-TRANS(vadd_w, gvec_vvv, MO_32, tcg_gen_gvec_add)
-TRANS(vadd_d, gvec_vvv, MO_64, tcg_gen_gvec_add)
+TRANS(vadd_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_add)
+TRANS(vadd_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_add)
+TRANS(vadd_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_add)
+TRANS(vadd_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_add)
 
 #define VADDSUB_Q(NAME)                                        \
 static bool trans_v## NAME ##_q(DisasContext *ctx, arg_vvv *a) \
@@ -170,58 +170,58 @@ static bool trans_v## NAME ##_q(DisasContext *ctx, arg_vvv *a) \
 VADDSUB_Q(add)
 VADDSUB_Q(sub)
 
-TRANS(vsub_b, gvec_vvv, MO_8, tcg_gen_gvec_sub)
-TRANS(vsub_h, gvec_vvv, MO_16, tcg_gen_gvec_sub)
-TRANS(vsub_w, gvec_vvv, MO_32, tcg_gen_gvec_sub)
-TRANS(vsub_d, gvec_vvv, MO_64, tcg_gen_gvec_sub)
+TRANS(vsub_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_sub)
+TRANS(vsub_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_sub)
+TRANS(vsub_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_sub)
+TRANS(vsub_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_sub)
 
-TRANS(vaddi_bu, gvec_vv_i, MO_8, tcg_gen_gvec_addi)
-TRANS(vaddi_hu, gvec_vv_i, MO_16, tcg_gen_gvec_addi)
-TRANS(vaddi_wu, gvec_vv_i, MO_32, tcg_gen_gvec_addi)
-TRANS(vaddi_du, gvec_vv_i, MO_64, tcg_gen_gvec_addi)
-TRANS(vsubi_bu, gvec_subi, MO_8)
-TRANS(vsubi_hu, gvec_subi, MO_16)
-TRANS(vsubi_wu, gvec_subi, MO_32)
-TRANS(vsubi_du, gvec_subi, MO_64)
+TRANS(vaddi_bu, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_addi)
+TRANS(vaddi_hu, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_addi)
+TRANS(vaddi_wu, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_addi)
+TRANS(vaddi_du, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_addi)
+TRANS(vsubi_bu, ALL, gvec_subi, MO_8)
+TRANS(vsubi_hu, ALL, gvec_subi, MO_16)
+TRANS(vsubi_wu, ALL, gvec_subi, MO_32)
+TRANS(vsubi_du, ALL, gvec_subi, MO_64)
 
-TRANS(vneg_b, gvec_vv, MO_8, tcg_gen_gvec_neg)
-TRANS(vneg_h, gvec_vv, MO_16, tcg_gen_gvec_neg)
-TRANS(vneg_w, gvec_vv, MO_32, tcg_gen_gvec_neg)
-TRANS(vneg_d, gvec_vv, MO_64, tcg_gen_gvec_neg)
+TRANS(vneg_b, ALL, gvec_vv, MO_8, tcg_gen_gvec_neg)
+TRANS(vneg_h, ALL, gvec_vv, MO_16, tcg_gen_gvec_neg)
+TRANS(vneg_w, ALL, gvec_vv, MO_32, tcg_gen_gvec_neg)
+TRANS(vneg_d, ALL, gvec_vv, MO_64, tcg_gen_gvec_neg)
 
-TRANS(vsadd_b, gvec_vvv, MO_8, tcg_gen_gvec_ssadd)
-TRANS(vsadd_h, gvec_vvv, MO_16, tcg_gen_gvec_ssadd)
-TRANS(vsadd_w, gvec_vvv, MO_32, tcg_gen_gvec_ssadd)
-TRANS(vsadd_d, gvec_vvv, MO_64, tcg_gen_gvec_ssadd)
-TRANS(vsadd_bu, gvec_vvv, MO_8, tcg_gen_gvec_usadd)
-TRANS(vsadd_hu, gvec_vvv, MO_16, tcg_gen_gvec_usadd)
-TRANS(vsadd_wu, gvec_vvv, MO_32, tcg_gen_gvec_usadd)
-TRANS(vsadd_du, gvec_vvv, MO_64, tcg_gen_gvec_usadd)
-TRANS(vssub_b, gvec_vvv, MO_8, tcg_gen_gvec_sssub)
-TRANS(vssub_h, gvec_vvv, MO_16, tcg_gen_gvec_sssub)
-TRANS(vssub_w, gvec_vvv, MO_32, tcg_gen_gvec_sssub)
-TRANS(vssub_d, gvec_vvv, MO_64, tcg_gen_gvec_sssub)
-TRANS(vssub_bu, gvec_vvv, MO_8, tcg_gen_gvec_ussub)
-TRANS(vssub_hu, gvec_vvv, MO_16, tcg_gen_gvec_ussub)
-TRANS(vssub_wu, gvec_vvv, MO_32, tcg_gen_gvec_ussub)
-TRANS(vssub_du, gvec_vvv, MO_64, tcg_gen_gvec_ussub)
+TRANS(vsadd_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_ssadd)
+TRANS(vsadd_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_ssadd)
+TRANS(vsadd_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_ssadd)
+TRANS(vsadd_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_ssadd)
+TRANS(vsadd_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_usadd)
+TRANS(vsadd_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_usadd)
+TRANS(vsadd_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_usadd)
+TRANS(vsadd_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_usadd)
+TRANS(vssub_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_sssub)
+TRANS(vssub_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_sssub)
+TRANS(vssub_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_sssub)
+TRANS(vssub_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_sssub)
+TRANS(vssub_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_ussub)
+TRANS(vssub_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_ussub)
+TRANS(vssub_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_ussub)
+TRANS(vssub_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_ussub)
 
-TRANS(vhaddw_h_b, gen_vvv, gen_helper_vhaddw_h_b)
-TRANS(vhaddw_w_h, gen_vvv, gen_helper_vhaddw_w_h)
-TRANS(vhaddw_d_w, gen_vvv, gen_helper_vhaddw_d_w)
-TRANS(vhaddw_q_d, gen_vvv, gen_helper_vhaddw_q_d)
-TRANS(vhaddw_hu_bu, gen_vvv, gen_helper_vhaddw_hu_bu)
-TRANS(vhaddw_wu_hu, gen_vvv, gen_helper_vhaddw_wu_hu)
-TRANS(vhaddw_du_wu, gen_vvv, gen_helper_vhaddw_du_wu)
-TRANS(vhaddw_qu_du, gen_vvv, gen_helper_vhaddw_qu_du)
-TRANS(vhsubw_h_b, gen_vvv, gen_helper_vhsubw_h_b)
-TRANS(vhsubw_w_h, gen_vvv, gen_helper_vhsubw_w_h)
-TRANS(vhsubw_d_w, gen_vvv, gen_helper_vhsubw_d_w)
-TRANS(vhsubw_q_d, gen_vvv, gen_helper_vhsubw_q_d)
-TRANS(vhsubw_hu_bu, gen_vvv, gen_helper_vhsubw_hu_bu)
-TRANS(vhsubw_wu_hu, gen_vvv, gen_helper_vhsubw_wu_hu)
-TRANS(vhsubw_du_wu, gen_vvv, gen_helper_vhsubw_du_wu)
-TRANS(vhsubw_qu_du, gen_vvv, gen_helper_vhsubw_qu_du)
+TRANS(vhaddw_h_b, ALL, gen_vvv, gen_helper_vhaddw_h_b)
+TRANS(vhaddw_w_h, ALL, gen_vvv, gen_helper_vhaddw_w_h)
+TRANS(vhaddw_d_w, ALL, gen_vvv, gen_helper_vhaddw_d_w)
+TRANS(vhaddw_q_d, ALL, gen_vvv, gen_helper_vhaddw_q_d)
+TRANS(vhaddw_hu_bu, ALL, gen_vvv, gen_helper_vhaddw_hu_bu)
+TRANS(vhaddw_wu_hu, ALL, gen_vvv, gen_helper_vhaddw_wu_hu)
+TRANS(vhaddw_du_wu, ALL, gen_vvv, gen_helper_vhaddw_du_wu)
+TRANS(vhaddw_qu_du, ALL, gen_vvv, gen_helper_vhaddw_qu_du)
+TRANS(vhsubw_h_b, ALL, gen_vvv, gen_helper_vhsubw_h_b)
+TRANS(vhsubw_w_h, ALL, gen_vvv, gen_helper_vhsubw_w_h)
+TRANS(vhsubw_d_w, ALL, gen_vvv, gen_helper_vhsubw_d_w)
+TRANS(vhsubw_q_d, ALL, gen_vvv, gen_helper_vhsubw_q_d)
+TRANS(vhsubw_hu_bu, ALL, gen_vvv, gen_helper_vhsubw_hu_bu)
+TRANS(vhsubw_wu_hu, ALL, gen_vvv, gen_helper_vhsubw_wu_hu)
+TRANS(vhsubw_du_wu, ALL, gen_vvv, gen_helper_vhsubw_du_wu)
+TRANS(vhsubw_qu_du, ALL, gen_vvv, gen_helper_vhsubw_qu_du)
 
 static void gen_vaddwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -301,10 +301,10 @@ static void do_vaddwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwev_h_b, gvec_vvv, MO_8, do_vaddwev_s)
-TRANS(vaddwev_w_h, gvec_vvv, MO_16, do_vaddwev_s)
-TRANS(vaddwev_d_w, gvec_vvv, MO_32, do_vaddwev_s)
-TRANS(vaddwev_q_d, gvec_vvv, MO_64, do_vaddwev_s)
+TRANS(vaddwev_h_b, ALL, gvec_vvv, MO_8, do_vaddwev_s)
+TRANS(vaddwev_w_h, ALL, gvec_vvv, MO_16, do_vaddwev_s)
+TRANS(vaddwev_d_w, ALL, gvec_vvv, MO_32, do_vaddwev_s)
+TRANS(vaddwev_q_d, ALL, gvec_vvv, MO_64, do_vaddwev_s)
 
 static void gen_vaddwod_w_h(TCGv_i32 t, TCGv_i32 a, TCGv_i32 b)
 {
@@ -380,10 +380,10 @@ static void do_vaddwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwod_h_b, gvec_vvv, MO_8, do_vaddwod_s)
-TRANS(vaddwod_w_h, gvec_vvv, MO_16, do_vaddwod_s)
-TRANS(vaddwod_d_w, gvec_vvv, MO_32, do_vaddwod_s)
-TRANS(vaddwod_q_d, gvec_vvv, MO_64, do_vaddwod_s)
+TRANS(vaddwod_h_b, ALL, gvec_vvv, MO_8, do_vaddwod_s)
+TRANS(vaddwod_w_h, ALL, gvec_vvv, MO_16, do_vaddwod_s)
+TRANS(vaddwod_d_w, ALL, gvec_vvv, MO_32, do_vaddwod_s)
+TRANS(vaddwod_q_d, ALL, gvec_vvv, MO_64, do_vaddwod_s)
 
 static void gen_vsubwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -463,10 +463,10 @@ static void do_vsubwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwev_h_b, gvec_vvv, MO_8, do_vsubwev_s)
-TRANS(vsubwev_w_h, gvec_vvv, MO_16, do_vsubwev_s)
-TRANS(vsubwev_d_w, gvec_vvv, MO_32, do_vsubwev_s)
-TRANS(vsubwev_q_d, gvec_vvv, MO_64, do_vsubwev_s)
+TRANS(vsubwev_h_b, ALL, gvec_vvv, MO_8, do_vsubwev_s)
+TRANS(vsubwev_w_h, ALL, gvec_vvv, MO_16, do_vsubwev_s)
+TRANS(vsubwev_d_w, ALL, gvec_vvv, MO_32, do_vsubwev_s)
+TRANS(vsubwev_q_d, ALL, gvec_vvv, MO_64, do_vsubwev_s)
 
 static void gen_vsubwod_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -542,10 +542,10 @@ static void do_vsubwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwod_h_b, gvec_vvv, MO_8, do_vsubwod_s)
-TRANS(vsubwod_w_h, gvec_vvv, MO_16, do_vsubwod_s)
-TRANS(vsubwod_d_w, gvec_vvv, MO_32, do_vsubwod_s)
-TRANS(vsubwod_q_d, gvec_vvv, MO_64, do_vsubwod_s)
+TRANS(vsubwod_h_b, ALL, gvec_vvv, MO_8, do_vsubwod_s)
+TRANS(vsubwod_w_h, ALL, gvec_vvv, MO_16, do_vsubwod_s)
+TRANS(vsubwod_d_w, ALL, gvec_vvv, MO_32, do_vsubwod_s)
+TRANS(vsubwod_q_d, ALL, gvec_vvv, MO_64, do_vsubwod_s)
 
 static void gen_vaddwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -617,10 +617,10 @@ static void do_vaddwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwev_h_bu, gvec_vvv, MO_8, do_vaddwev_u)
-TRANS(vaddwev_w_hu, gvec_vvv, MO_16, do_vaddwev_u)
-TRANS(vaddwev_d_wu, gvec_vvv, MO_32, do_vaddwev_u)
-TRANS(vaddwev_q_du, gvec_vvv, MO_64, do_vaddwev_u)
+TRANS(vaddwev_h_bu, ALL, gvec_vvv, MO_8, do_vaddwev_u)
+TRANS(vaddwev_w_hu, ALL, gvec_vvv, MO_16, do_vaddwev_u)
+TRANS(vaddwev_d_wu, ALL, gvec_vvv, MO_32, do_vaddwev_u)
+TRANS(vaddwev_q_du, ALL, gvec_vvv, MO_64, do_vaddwev_u)
 
 static void gen_vaddwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -696,10 +696,10 @@ static void do_vaddwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwod_h_bu, gvec_vvv, MO_8, do_vaddwod_u)
-TRANS(vaddwod_w_hu, gvec_vvv, MO_16, do_vaddwod_u)
-TRANS(vaddwod_d_wu, gvec_vvv, MO_32, do_vaddwod_u)
-TRANS(vaddwod_q_du, gvec_vvv, MO_64, do_vaddwod_u)
+TRANS(vaddwod_h_bu, ALL, gvec_vvv, MO_8, do_vaddwod_u)
+TRANS(vaddwod_w_hu, ALL, gvec_vvv, MO_16, do_vaddwod_u)
+TRANS(vaddwod_d_wu, ALL, gvec_vvv, MO_32, do_vaddwod_u)
+TRANS(vaddwod_q_du, ALL, gvec_vvv, MO_64, do_vaddwod_u)
 
 static void gen_vsubwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -771,10 +771,10 @@ static void do_vsubwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwev_h_bu, gvec_vvv, MO_8, do_vsubwev_u)
-TRANS(vsubwev_w_hu, gvec_vvv, MO_16, do_vsubwev_u)
-TRANS(vsubwev_d_wu, gvec_vvv, MO_32, do_vsubwev_u)
-TRANS(vsubwev_q_du, gvec_vvv, MO_64, do_vsubwev_u)
+TRANS(vsubwev_h_bu, ALL, gvec_vvv, MO_8, do_vsubwev_u)
+TRANS(vsubwev_w_hu, ALL, gvec_vvv, MO_16, do_vsubwev_u)
+TRANS(vsubwev_d_wu, ALL, gvec_vvv, MO_32, do_vsubwev_u)
+TRANS(vsubwev_q_du, ALL, gvec_vvv, MO_64, do_vsubwev_u)
 
 static void gen_vsubwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -850,10 +850,10 @@ static void do_vsubwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwod_h_bu, gvec_vvv, MO_8, do_vsubwod_u)
-TRANS(vsubwod_w_hu, gvec_vvv, MO_16, do_vsubwod_u)
-TRANS(vsubwod_d_wu, gvec_vvv, MO_32, do_vsubwod_u)
-TRANS(vsubwod_q_du, gvec_vvv, MO_64, do_vsubwod_u)
+TRANS(vsubwod_h_bu, ALL, gvec_vvv, MO_8, do_vsubwod_u)
+TRANS(vsubwod_w_hu, ALL, gvec_vvv, MO_16, do_vsubwod_u)
+TRANS(vsubwod_d_wu, ALL, gvec_vvv, MO_32, do_vsubwod_u)
+TRANS(vsubwod_q_du, ALL, gvec_vvv, MO_64, do_vsubwod_u)
 
 static void gen_vaddwev_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -933,10 +933,10 @@ static void do_vaddwev_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwev_h_bu_b, gvec_vvv, MO_8, do_vaddwev_u_s)
-TRANS(vaddwev_w_hu_h, gvec_vvv, MO_16, do_vaddwev_u_s)
-TRANS(vaddwev_d_wu_w, gvec_vvv, MO_32, do_vaddwev_u_s)
-TRANS(vaddwev_q_du_d, gvec_vvv, MO_64, do_vaddwev_u_s)
+TRANS(vaddwev_h_bu_b, ALL, gvec_vvv, MO_8, do_vaddwev_u_s)
+TRANS(vaddwev_w_hu_h, ALL, gvec_vvv, MO_16, do_vaddwev_u_s)
+TRANS(vaddwev_d_wu_w, ALL, gvec_vvv, MO_32, do_vaddwev_u_s)
+TRANS(vaddwev_q_du_d, ALL, gvec_vvv, MO_64, do_vaddwev_u_s)
 
 static void gen_vaddwod_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1013,10 +1013,10 @@ static void do_vaddwod_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwod_h_bu_b, gvec_vvv, MO_8, do_vaddwod_u_s)
-TRANS(vaddwod_w_hu_h, gvec_vvv, MO_16, do_vaddwod_u_s)
-TRANS(vaddwod_d_wu_w, gvec_vvv, MO_32, do_vaddwod_u_s)
-TRANS(vaddwod_q_du_d, gvec_vvv, MO_64, do_vaddwod_u_s)
+TRANS(vaddwod_h_bu_b, ALL, gvec_vvv, MO_8, do_vaddwod_u_s)
+TRANS(vaddwod_w_hu_h, ALL, gvec_vvv, MO_16, do_vaddwod_u_s)
+TRANS(vaddwod_d_wu_w, ALL, gvec_vvv, MO_32, do_vaddwod_u_s)
+TRANS(vaddwod_q_du_d, ALL, gvec_vvv, MO_64, do_vaddwod_u_s)
 
 static void do_vavg(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b,
                     void (*gen_shr_vec)(unsigned, TCGv_vec,
@@ -1125,14 +1125,14 @@ static void do_vavg_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vavg_b, gvec_vvv, MO_8, do_vavg_s)
-TRANS(vavg_h, gvec_vvv, MO_16, do_vavg_s)
-TRANS(vavg_w, gvec_vvv, MO_32, do_vavg_s)
-TRANS(vavg_d, gvec_vvv, MO_64, do_vavg_s)
-TRANS(vavg_bu, gvec_vvv, MO_8, do_vavg_u)
-TRANS(vavg_hu, gvec_vvv, MO_16, do_vavg_u)
-TRANS(vavg_wu, gvec_vvv, MO_32, do_vavg_u)
-TRANS(vavg_du, gvec_vvv, MO_64, do_vavg_u)
+TRANS(vavg_b, ALL, gvec_vvv, MO_8, do_vavg_s)
+TRANS(vavg_h, ALL, gvec_vvv, MO_16, do_vavg_s)
+TRANS(vavg_w, ALL, gvec_vvv, MO_32, do_vavg_s)
+TRANS(vavg_d, ALL, gvec_vvv, MO_64, do_vavg_s)
+TRANS(vavg_bu, ALL, gvec_vvv, MO_8, do_vavg_u)
+TRANS(vavg_hu, ALL, gvec_vvv, MO_16, do_vavg_u)
+TRANS(vavg_wu, ALL, gvec_vvv, MO_32, do_vavg_u)
+TRANS(vavg_du, ALL, gvec_vvv, MO_64, do_vavg_u)
 
 static void do_vavgr_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        uint32_t vk_ofs, uint32_t oprsz, uint32_t maxsz)
@@ -1206,14 +1206,14 @@ static void do_vavgr_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vavgr_b, gvec_vvv, MO_8, do_vavgr_s)
-TRANS(vavgr_h, gvec_vvv, MO_16, do_vavgr_s)
-TRANS(vavgr_w, gvec_vvv, MO_32, do_vavgr_s)
-TRANS(vavgr_d, gvec_vvv, MO_64, do_vavgr_s)
-TRANS(vavgr_bu, gvec_vvv, MO_8, do_vavgr_u)
-TRANS(vavgr_hu, gvec_vvv, MO_16, do_vavgr_u)
-TRANS(vavgr_wu, gvec_vvv, MO_32, do_vavgr_u)
-TRANS(vavgr_du, gvec_vvv, MO_64, do_vavgr_u)
+TRANS(vavgr_b, ALL, gvec_vvv, MO_8, do_vavgr_s)
+TRANS(vavgr_h, ALL, gvec_vvv, MO_16, do_vavgr_s)
+TRANS(vavgr_w, ALL, gvec_vvv, MO_32, do_vavgr_s)
+TRANS(vavgr_d, ALL, gvec_vvv, MO_64, do_vavgr_s)
+TRANS(vavgr_bu, ALL, gvec_vvv, MO_8, do_vavgr_u)
+TRANS(vavgr_hu, ALL, gvec_vvv, MO_16, do_vavgr_u)
+TRANS(vavgr_wu, ALL, gvec_vvv, MO_32, do_vavgr_u)
+TRANS(vavgr_du, ALL, gvec_vvv, MO_64, do_vavgr_u)
 
 static void gen_vabsd_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1301,14 +1301,14 @@ static void do_vabsd_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vabsd_b, gvec_vvv, MO_8, do_vabsd_s)
-TRANS(vabsd_h, gvec_vvv, MO_16, do_vabsd_s)
-TRANS(vabsd_w, gvec_vvv, MO_32, do_vabsd_s)
-TRANS(vabsd_d, gvec_vvv, MO_64, do_vabsd_s)
-TRANS(vabsd_bu, gvec_vvv, MO_8, do_vabsd_u)
-TRANS(vabsd_hu, gvec_vvv, MO_16, do_vabsd_u)
-TRANS(vabsd_wu, gvec_vvv, MO_32, do_vabsd_u)
-TRANS(vabsd_du, gvec_vvv, MO_64, do_vabsd_u)
+TRANS(vabsd_b, ALL, gvec_vvv, MO_8, do_vabsd_s)
+TRANS(vabsd_h, ALL, gvec_vvv, MO_16, do_vabsd_s)
+TRANS(vabsd_w, ALL, gvec_vvv, MO_32, do_vabsd_s)
+TRANS(vabsd_d, ALL, gvec_vvv, MO_64, do_vabsd_s)
+TRANS(vabsd_bu, ALL, gvec_vvv, MO_8, do_vabsd_u)
+TRANS(vabsd_hu, ALL, gvec_vvv, MO_16, do_vabsd_u)
+TRANS(vabsd_wu, ALL, gvec_vvv, MO_32, do_vabsd_u)
+TRANS(vabsd_du, ALL, gvec_vvv, MO_64, do_vabsd_u)
 
 static void gen_vadda(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1358,28 +1358,28 @@ static void do_vadda(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vadda_b, gvec_vvv, MO_8, do_vadda)
-TRANS(vadda_h, gvec_vvv, MO_16, do_vadda)
-TRANS(vadda_w, gvec_vvv, MO_32, do_vadda)
-TRANS(vadda_d, gvec_vvv, MO_64, do_vadda)
+TRANS(vadda_b, ALL, gvec_vvv, MO_8, do_vadda)
+TRANS(vadda_h, ALL, gvec_vvv, MO_16, do_vadda)
+TRANS(vadda_w, ALL, gvec_vvv, MO_32, do_vadda)
+TRANS(vadda_d, ALL, gvec_vvv, MO_64, do_vadda)
 
-TRANS(vmax_b, gvec_vvv, MO_8, tcg_gen_gvec_smax)
-TRANS(vmax_h, gvec_vvv, MO_16, tcg_gen_gvec_smax)
-TRANS(vmax_w, gvec_vvv, MO_32, tcg_gen_gvec_smax)
-TRANS(vmax_d, gvec_vvv, MO_64, tcg_gen_gvec_smax)
-TRANS(vmax_bu, gvec_vvv, MO_8, tcg_gen_gvec_umax)
-TRANS(vmax_hu, gvec_vvv, MO_16, tcg_gen_gvec_umax)
-TRANS(vmax_wu, gvec_vvv, MO_32, tcg_gen_gvec_umax)
-TRANS(vmax_du, gvec_vvv, MO_64, tcg_gen_gvec_umax)
+TRANS(vmax_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_smax)
+TRANS(vmax_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_smax)
+TRANS(vmax_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_smax)
+TRANS(vmax_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_smax)
+TRANS(vmax_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_umax)
+TRANS(vmax_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_umax)
+TRANS(vmax_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_umax)
+TRANS(vmax_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_umax)
 
-TRANS(vmin_b, gvec_vvv, MO_8, tcg_gen_gvec_smin)
-TRANS(vmin_h, gvec_vvv, MO_16, tcg_gen_gvec_smin)
-TRANS(vmin_w, gvec_vvv, MO_32, tcg_gen_gvec_smin)
-TRANS(vmin_d, gvec_vvv, MO_64, tcg_gen_gvec_smin)
-TRANS(vmin_bu, gvec_vvv, MO_8, tcg_gen_gvec_umin)
-TRANS(vmin_hu, gvec_vvv, MO_16, tcg_gen_gvec_umin)
-TRANS(vmin_wu, gvec_vvv, MO_32, tcg_gen_gvec_umin)
-TRANS(vmin_du, gvec_vvv, MO_64, tcg_gen_gvec_umin)
+TRANS(vmin_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_smin)
+TRANS(vmin_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_smin)
+TRANS(vmin_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_smin)
+TRANS(vmin_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_smin)
+TRANS(vmin_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_umin)
+TRANS(vmin_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_umin)
+TRANS(vmin_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_umin)
+TRANS(vmin_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_umin)
 
 static void gen_vmini_s(unsigned vece, TCGv_vec t, TCGv_vec a, int64_t imm)
 {
@@ -1473,14 +1473,14 @@ static void do_vmini_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vmini_b, gvec_vv_i, MO_8, do_vmini_s)
-TRANS(vmini_h, gvec_vv_i, MO_16, do_vmini_s)
-TRANS(vmini_w, gvec_vv_i, MO_32, do_vmini_s)
-TRANS(vmini_d, gvec_vv_i, MO_64, do_vmini_s)
-TRANS(vmini_bu, gvec_vv_i, MO_8, do_vmini_u)
-TRANS(vmini_hu, gvec_vv_i, MO_16, do_vmini_u)
-TRANS(vmini_wu, gvec_vv_i, MO_32, do_vmini_u)
-TRANS(vmini_du, gvec_vv_i, MO_64, do_vmini_u)
+TRANS(vmini_b, ALL, gvec_vv_i, MO_8, do_vmini_s)
+TRANS(vmini_h, ALL, gvec_vv_i, MO_16, do_vmini_s)
+TRANS(vmini_w, ALL, gvec_vv_i, MO_32, do_vmini_s)
+TRANS(vmini_d, ALL, gvec_vv_i, MO_64, do_vmini_s)
+TRANS(vmini_bu, ALL, gvec_vv_i, MO_8, do_vmini_u)
+TRANS(vmini_hu, ALL, gvec_vv_i, MO_16, do_vmini_u)
+TRANS(vmini_wu, ALL, gvec_vv_i, MO_32, do_vmini_u)
+TRANS(vmini_du, ALL, gvec_vv_i, MO_64, do_vmini_u)
 
 static void do_vmaxi_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        int64_t imm, uint32_t oprsz, uint32_t maxsz)
@@ -1554,19 +1554,19 @@ static void do_vmaxi_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vmaxi_b, gvec_vv_i, MO_8, do_vmaxi_s)
-TRANS(vmaxi_h, gvec_vv_i, MO_16, do_vmaxi_s)
-TRANS(vmaxi_w, gvec_vv_i, MO_32, do_vmaxi_s)
-TRANS(vmaxi_d, gvec_vv_i, MO_64, do_vmaxi_s)
-TRANS(vmaxi_bu, gvec_vv_i, MO_8, do_vmaxi_u)
-TRANS(vmaxi_hu, gvec_vv_i, MO_16, do_vmaxi_u)
-TRANS(vmaxi_wu, gvec_vv_i, MO_32, do_vmaxi_u)
-TRANS(vmaxi_du, gvec_vv_i, MO_64, do_vmaxi_u)
+TRANS(vmaxi_b, ALL, gvec_vv_i, MO_8, do_vmaxi_s)
+TRANS(vmaxi_h, ALL, gvec_vv_i, MO_16, do_vmaxi_s)
+TRANS(vmaxi_w, ALL, gvec_vv_i, MO_32, do_vmaxi_s)
+TRANS(vmaxi_d, ALL, gvec_vv_i, MO_64, do_vmaxi_s)
+TRANS(vmaxi_bu, ALL, gvec_vv_i, MO_8, do_vmaxi_u)
+TRANS(vmaxi_hu, ALL, gvec_vv_i, MO_16, do_vmaxi_u)
+TRANS(vmaxi_wu, ALL, gvec_vv_i, MO_32, do_vmaxi_u)
+TRANS(vmaxi_du, ALL, gvec_vv_i, MO_64, do_vmaxi_u)
 
-TRANS(vmul_b, gvec_vvv, MO_8, tcg_gen_gvec_mul)
-TRANS(vmul_h, gvec_vvv, MO_16, tcg_gen_gvec_mul)
-TRANS(vmul_w, gvec_vvv, MO_32, tcg_gen_gvec_mul)
-TRANS(vmul_d, gvec_vvv, MO_64, tcg_gen_gvec_mul)
+TRANS(vmul_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_mul)
+TRANS(vmul_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_mul)
+TRANS(vmul_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_mul)
+TRANS(vmul_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_mul)
 
 static void gen_vmuh_w(TCGv_i32 t, TCGv_i32 a, TCGv_i32 b)
 {
@@ -1607,10 +1607,10 @@ static void do_vmuh_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmuh_b, gvec_vvv, MO_8, do_vmuh_s)
-TRANS(vmuh_h, gvec_vvv, MO_16, do_vmuh_s)
-TRANS(vmuh_w, gvec_vvv, MO_32, do_vmuh_s)
-TRANS(vmuh_d, gvec_vvv, MO_64, do_vmuh_s)
+TRANS(vmuh_b, ALL, gvec_vvv, MO_8, do_vmuh_s)
+TRANS(vmuh_h, ALL, gvec_vvv, MO_16, do_vmuh_s)
+TRANS(vmuh_w, ALL, gvec_vvv, MO_32, do_vmuh_s)
+TRANS(vmuh_d, ALL, gvec_vvv, MO_64, do_vmuh_s)
 
 static void gen_vmuh_wu(TCGv_i32 t, TCGv_i32 a, TCGv_i32 b)
 {
@@ -1651,10 +1651,10 @@ static void do_vmuh_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmuh_bu, gvec_vvv, MO_8,  do_vmuh_u)
-TRANS(vmuh_hu, gvec_vvv, MO_16, do_vmuh_u)
-TRANS(vmuh_wu, gvec_vvv, MO_32, do_vmuh_u)
-TRANS(vmuh_du, gvec_vvv, MO_64, do_vmuh_u)
+TRANS(vmuh_bu, ALL, gvec_vvv, MO_8,  do_vmuh_u)
+TRANS(vmuh_hu, ALL, gvec_vvv, MO_16, do_vmuh_u)
+TRANS(vmuh_wu, ALL, gvec_vvv, MO_32, do_vmuh_u)
+TRANS(vmuh_du, ALL, gvec_vvv, MO_64, do_vmuh_u)
 
 static void gen_vmulwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1724,9 +1724,9 @@ static void do_vmulwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwev_h_b, gvec_vvv, MO_8, do_vmulwev_s)
-TRANS(vmulwev_w_h, gvec_vvv, MO_16, do_vmulwev_s)
-TRANS(vmulwev_d_w, gvec_vvv, MO_32, do_vmulwev_s)
+TRANS(vmulwev_h_b, ALL, gvec_vvv, MO_8, do_vmulwev_s)
+TRANS(vmulwev_w_h, ALL, gvec_vvv, MO_16, do_vmulwev_s)
+TRANS(vmulwev_d_w, ALL, gvec_vvv, MO_32, do_vmulwev_s)
 
 static void tcg_gen_mulus2_i64(TCGv_i64 rl, TCGv_i64 rh,
                                TCGv_i64 arg1, TCGv_i64 arg2)
@@ -1828,9 +1828,9 @@ static void do_vmulwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwod_h_b, gvec_vvv, MO_8, do_vmulwod_s)
-TRANS(vmulwod_w_h, gvec_vvv, MO_16, do_vmulwod_s)
-TRANS(vmulwod_d_w, gvec_vvv, MO_32, do_vmulwod_s)
+TRANS(vmulwod_h_b, ALL, gvec_vvv, MO_8, do_vmulwod_s)
+TRANS(vmulwod_w_h, ALL, gvec_vvv, MO_16, do_vmulwod_s)
+TRANS(vmulwod_d_w, ALL, gvec_vvv, MO_32, do_vmulwod_s)
 
 static void gen_vmulwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1898,9 +1898,9 @@ static void do_vmulwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwev_h_bu, gvec_vvv, MO_8, do_vmulwev_u)
-TRANS(vmulwev_w_hu, gvec_vvv, MO_16, do_vmulwev_u)
-TRANS(vmulwev_d_wu, gvec_vvv, MO_32, do_vmulwev_u)
+TRANS(vmulwev_h_bu, ALL, gvec_vvv, MO_8, do_vmulwev_u)
+TRANS(vmulwev_w_hu, ALL, gvec_vvv, MO_16, do_vmulwev_u)
+TRANS(vmulwev_d_wu, ALL, gvec_vvv, MO_32, do_vmulwev_u)
 
 static void gen_vmulwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1968,9 +1968,9 @@ static void do_vmulwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwod_h_bu, gvec_vvv, MO_8, do_vmulwod_u)
-TRANS(vmulwod_w_hu, gvec_vvv, MO_16, do_vmulwod_u)
-TRANS(vmulwod_d_wu, gvec_vvv, MO_32, do_vmulwod_u)
+TRANS(vmulwod_h_bu, ALL, gvec_vvv, MO_8, do_vmulwod_u)
+TRANS(vmulwod_w_hu, ALL, gvec_vvv, MO_16, do_vmulwod_u)
+TRANS(vmulwod_d_wu, ALL, gvec_vvv, MO_32, do_vmulwod_u)
 
 static void gen_vmulwev_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2040,9 +2040,9 @@ static void do_vmulwev_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwev_h_bu_b, gvec_vvv, MO_8, do_vmulwev_u_s)
-TRANS(vmulwev_w_hu_h, gvec_vvv, MO_16, do_vmulwev_u_s)
-TRANS(vmulwev_d_wu_w, gvec_vvv, MO_32, do_vmulwev_u_s)
+TRANS(vmulwev_h_bu_b, ALL, gvec_vvv, MO_8, do_vmulwev_u_s)
+TRANS(vmulwev_w_hu_h, ALL, gvec_vvv, MO_16, do_vmulwev_u_s)
+TRANS(vmulwev_d_wu_w, ALL, gvec_vvv, MO_32, do_vmulwev_u_s)
 
 static void gen_vmulwod_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2109,9 +2109,9 @@ static void do_vmulwod_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwod_h_bu_b, gvec_vvv, MO_8, do_vmulwod_u_s)
-TRANS(vmulwod_w_hu_h, gvec_vvv, MO_16, do_vmulwod_u_s)
-TRANS(vmulwod_d_wu_w, gvec_vvv, MO_32, do_vmulwod_u_s)
+TRANS(vmulwod_h_bu_b, ALL, gvec_vvv, MO_8, do_vmulwod_u_s)
+TRANS(vmulwod_w_hu_h, ALL, gvec_vvv, MO_16, do_vmulwod_u_s)
+TRANS(vmulwod_d_wu_w, ALL, gvec_vvv, MO_32, do_vmulwod_u_s)
 
 static void gen_vmadd(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2182,10 +2182,10 @@ static void do_vmadd(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmadd_b, gvec_vvv, MO_8, do_vmadd)
-TRANS(vmadd_h, gvec_vvv, MO_16, do_vmadd)
-TRANS(vmadd_w, gvec_vvv, MO_32, do_vmadd)
-TRANS(vmadd_d, gvec_vvv, MO_64, do_vmadd)
+TRANS(vmadd_b, ALL, gvec_vvv, MO_8, do_vmadd)
+TRANS(vmadd_h, ALL, gvec_vvv, MO_16, do_vmadd)
+TRANS(vmadd_w, ALL, gvec_vvv, MO_32, do_vmadd)
+TRANS(vmadd_d, ALL, gvec_vvv, MO_64, do_vmadd)
 
 static void gen_vmsub(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2256,10 +2256,10 @@ static void do_vmsub(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmsub_b, gvec_vvv, MO_8, do_vmsub)
-TRANS(vmsub_h, gvec_vvv, MO_16, do_vmsub)
-TRANS(vmsub_w, gvec_vvv, MO_32, do_vmsub)
-TRANS(vmsub_d, gvec_vvv, MO_64, do_vmsub)
+TRANS(vmsub_b, ALL, gvec_vvv, MO_8, do_vmsub)
+TRANS(vmsub_h, ALL, gvec_vvv, MO_16, do_vmsub)
+TRANS(vmsub_w, ALL, gvec_vvv, MO_32, do_vmsub)
+TRANS(vmsub_d, ALL, gvec_vvv, MO_64, do_vmsub)
 
 static void gen_vmaddwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2331,9 +2331,9 @@ static void do_vmaddwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwev_h_b, gvec_vvv, MO_8, do_vmaddwev_s)
-TRANS(vmaddwev_w_h, gvec_vvv, MO_16, do_vmaddwev_s)
-TRANS(vmaddwev_d_w, gvec_vvv, MO_32, do_vmaddwev_s)
+TRANS(vmaddwev_h_b, ALL, gvec_vvv, MO_8, do_vmaddwev_s)
+TRANS(vmaddwev_w_h, ALL, gvec_vvv, MO_16, do_vmaddwev_s)
+TRANS(vmaddwev_d_w, ALL, gvec_vvv, MO_32, do_vmaddwev_s)
 
 #define VMADD_Q(NAME, FN, idx1, idx2)                     \
 static bool trans_## NAME (DisasContext *ctx, arg_vvv *a) \
@@ -2435,9 +2435,9 @@ static void do_vmaddwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwod_h_b, gvec_vvv, MO_8, do_vmaddwod_s)
-TRANS(vmaddwod_w_h, gvec_vvv, MO_16, do_vmaddwod_s)
-TRANS(vmaddwod_d_w, gvec_vvv, MO_32, do_vmaddwod_s)
+TRANS(vmaddwod_h_b, ALL, gvec_vvv, MO_8, do_vmaddwod_s)
+TRANS(vmaddwod_w_h, ALL, gvec_vvv, MO_16, do_vmaddwod_s)
+TRANS(vmaddwod_d_w, ALL, gvec_vvv, MO_32, do_vmaddwod_s)
 
 static void gen_vmaddwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2505,9 +2505,9 @@ static void do_vmaddwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwev_h_bu, gvec_vvv, MO_8, do_vmaddwev_u)
-TRANS(vmaddwev_w_hu, gvec_vvv, MO_16, do_vmaddwev_u)
-TRANS(vmaddwev_d_wu, gvec_vvv, MO_32, do_vmaddwev_u)
+TRANS(vmaddwev_h_bu, ALL, gvec_vvv, MO_8, do_vmaddwev_u)
+TRANS(vmaddwev_w_hu, ALL, gvec_vvv, MO_16, do_vmaddwev_u)
+TRANS(vmaddwev_d_wu, ALL, gvec_vvv, MO_32, do_vmaddwev_u)
 
 static void gen_vmaddwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2576,9 +2576,9 @@ static void do_vmaddwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwod_h_bu, gvec_vvv, MO_8, do_vmaddwod_u)
-TRANS(vmaddwod_w_hu, gvec_vvv, MO_16, do_vmaddwod_u)
-TRANS(vmaddwod_d_wu, gvec_vvv, MO_32, do_vmaddwod_u)
+TRANS(vmaddwod_h_bu, ALL, gvec_vvv, MO_8, do_vmaddwod_u)
+TRANS(vmaddwod_w_hu, ALL, gvec_vvv, MO_16, do_vmaddwod_u)
+TRANS(vmaddwod_d_wu, ALL, gvec_vvv, MO_32, do_vmaddwod_u)
 
 static void gen_vmaddwev_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2649,9 +2649,9 @@ static void do_vmaddwev_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwev_h_bu_b, gvec_vvv, MO_8, do_vmaddwev_u_s)
-TRANS(vmaddwev_w_hu_h, gvec_vvv, MO_16, do_vmaddwev_u_s)
-TRANS(vmaddwev_d_wu_w, gvec_vvv, MO_32, do_vmaddwev_u_s)
+TRANS(vmaddwev_h_bu_b, ALL, gvec_vvv, MO_8, do_vmaddwev_u_s)
+TRANS(vmaddwev_w_hu_h, ALL, gvec_vvv, MO_16, do_vmaddwev_u_s)
+TRANS(vmaddwev_d_wu_w, ALL, gvec_vvv, MO_32, do_vmaddwev_u_s)
 
 static void gen_vmaddwod_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2721,26 +2721,26 @@ static void do_vmaddwod_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwod_h_bu_b, gvec_vvv, MO_8, do_vmaddwod_u_s)
-TRANS(vmaddwod_w_hu_h, gvec_vvv, MO_16, do_vmaddwod_u_s)
-TRANS(vmaddwod_d_wu_w, gvec_vvv, MO_32, do_vmaddwod_u_s)
+TRANS(vmaddwod_h_bu_b, ALL, gvec_vvv, MO_8, do_vmaddwod_u_s)
+TRANS(vmaddwod_w_hu_h, ALL, gvec_vvv, MO_16, do_vmaddwod_u_s)
+TRANS(vmaddwod_d_wu_w, ALL, gvec_vvv, MO_32, do_vmaddwod_u_s)
 
-TRANS(vdiv_b, gen_vvv, gen_helper_vdiv_b)
-TRANS(vdiv_h, gen_vvv, gen_helper_vdiv_h)
-TRANS(vdiv_w, gen_vvv, gen_helper_vdiv_w)
-TRANS(vdiv_d, gen_vvv, gen_helper_vdiv_d)
-TRANS(vdiv_bu, gen_vvv, gen_helper_vdiv_bu)
-TRANS(vdiv_hu, gen_vvv, gen_helper_vdiv_hu)
-TRANS(vdiv_wu, gen_vvv, gen_helper_vdiv_wu)
-TRANS(vdiv_du, gen_vvv, gen_helper_vdiv_du)
-TRANS(vmod_b, gen_vvv, gen_helper_vmod_b)
-TRANS(vmod_h, gen_vvv, gen_helper_vmod_h)
-TRANS(vmod_w, gen_vvv, gen_helper_vmod_w)
-TRANS(vmod_d, gen_vvv, gen_helper_vmod_d)
-TRANS(vmod_bu, gen_vvv, gen_helper_vmod_bu)
-TRANS(vmod_hu, gen_vvv, gen_helper_vmod_hu)
-TRANS(vmod_wu, gen_vvv, gen_helper_vmod_wu)
-TRANS(vmod_du, gen_vvv, gen_helper_vmod_du)
+TRANS(vdiv_b, ALL, gen_vvv, gen_helper_vdiv_b)
+TRANS(vdiv_h, ALL, gen_vvv, gen_helper_vdiv_h)
+TRANS(vdiv_w, ALL, gen_vvv, gen_helper_vdiv_w)
+TRANS(vdiv_d, ALL, gen_vvv, gen_helper_vdiv_d)
+TRANS(vdiv_bu, ALL, gen_vvv, gen_helper_vdiv_bu)
+TRANS(vdiv_hu, ALL, gen_vvv, gen_helper_vdiv_hu)
+TRANS(vdiv_wu, ALL, gen_vvv, gen_helper_vdiv_wu)
+TRANS(vdiv_du, ALL, gen_vvv, gen_helper_vdiv_du)
+TRANS(vmod_b, ALL, gen_vvv, gen_helper_vmod_b)
+TRANS(vmod_h, ALL, gen_vvv, gen_helper_vmod_h)
+TRANS(vmod_w, ALL, gen_vvv, gen_helper_vmod_w)
+TRANS(vmod_d, ALL, gen_vvv, gen_helper_vmod_d)
+TRANS(vmod_bu, ALL, gen_vvv, gen_helper_vmod_bu)
+TRANS(vmod_hu, ALL, gen_vvv, gen_helper_vmod_hu)
+TRANS(vmod_wu, ALL, gen_vvv, gen_helper_vmod_wu)
+TRANS(vmod_du, ALL, gen_vvv, gen_helper_vmod_du)
 
 static void gen_vsat_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec max)
 {
@@ -2789,10 +2789,10 @@ static void do_vsat_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                     tcg_constant_i64((1ll<< imm) -1), &op[vece]);
 }
 
-TRANS(vsat_b, gvec_vv_i, MO_8, do_vsat_s)
-TRANS(vsat_h, gvec_vv_i, MO_16, do_vsat_s)
-TRANS(vsat_w, gvec_vv_i, MO_32, do_vsat_s)
-TRANS(vsat_d, gvec_vv_i, MO_64, do_vsat_s)
+TRANS(vsat_b, ALL, gvec_vv_i, MO_8, do_vsat_s)
+TRANS(vsat_h, ALL, gvec_vv_i, MO_16, do_vsat_s)
+TRANS(vsat_w, ALL, gvec_vv_i, MO_32, do_vsat_s)
+TRANS(vsat_d, ALL, gvec_vv_i, MO_64, do_vsat_s)
 
 static void gen_vsat_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec max)
 {
@@ -2838,19 +2838,19 @@ static void do_vsat_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                     tcg_constant_i64(max), &op[vece]);
 }
 
-TRANS(vsat_bu, gvec_vv_i, MO_8, do_vsat_u)
-TRANS(vsat_hu, gvec_vv_i, MO_16, do_vsat_u)
-TRANS(vsat_wu, gvec_vv_i, MO_32, do_vsat_u)
-TRANS(vsat_du, gvec_vv_i, MO_64, do_vsat_u)
+TRANS(vsat_bu, ALL, gvec_vv_i, MO_8, do_vsat_u)
+TRANS(vsat_hu, ALL, gvec_vv_i, MO_16, do_vsat_u)
+TRANS(vsat_wu, ALL, gvec_vv_i, MO_32, do_vsat_u)
+TRANS(vsat_du, ALL, gvec_vv_i, MO_64, do_vsat_u)
 
-TRANS(vexth_h_b, gen_vv, gen_helper_vexth_h_b)
-TRANS(vexth_w_h, gen_vv, gen_helper_vexth_w_h)
-TRANS(vexth_d_w, gen_vv, gen_helper_vexth_d_w)
-TRANS(vexth_q_d, gen_vv, gen_helper_vexth_q_d)
-TRANS(vexth_hu_bu, gen_vv, gen_helper_vexth_hu_bu)
-TRANS(vexth_wu_hu, gen_vv, gen_helper_vexth_wu_hu)
-TRANS(vexth_du_wu, gen_vv, gen_helper_vexth_du_wu)
-TRANS(vexth_qu_du, gen_vv, gen_helper_vexth_qu_du)
+TRANS(vexth_h_b, ALL, gen_vv, gen_helper_vexth_h_b)
+TRANS(vexth_w_h, ALL, gen_vv, gen_helper_vexth_w_h)
+TRANS(vexth_d_w, ALL, gen_vv, gen_helper_vexth_d_w)
+TRANS(vexth_q_d, ALL, gen_vv, gen_helper_vexth_q_d)
+TRANS(vexth_hu_bu, ALL, gen_vv, gen_helper_vexth_hu_bu)
+TRANS(vexth_wu_hu, ALL, gen_vv, gen_helper_vexth_wu_hu)
+TRANS(vexth_du_wu, ALL, gen_vv, gen_helper_vexth_du_wu)
+TRANS(vexth_qu_du, ALL, gen_vv, gen_helper_vexth_qu_du)
 
 static void gen_vsigncov(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2900,17 +2900,17 @@ static void do_vsigncov(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsigncov_b, gvec_vvv, MO_8, do_vsigncov)
-TRANS(vsigncov_h, gvec_vvv, MO_16, do_vsigncov)
-TRANS(vsigncov_w, gvec_vvv, MO_32, do_vsigncov)
-TRANS(vsigncov_d, gvec_vvv, MO_64, do_vsigncov)
+TRANS(vsigncov_b, ALL, gvec_vvv, MO_8, do_vsigncov)
+TRANS(vsigncov_h, ALL, gvec_vvv, MO_16, do_vsigncov)
+TRANS(vsigncov_w, ALL, gvec_vvv, MO_32, do_vsigncov)
+TRANS(vsigncov_d, ALL, gvec_vvv, MO_64, do_vsigncov)
 
-TRANS(vmskltz_b, gen_vv, gen_helper_vmskltz_b)
-TRANS(vmskltz_h, gen_vv, gen_helper_vmskltz_h)
-TRANS(vmskltz_w, gen_vv, gen_helper_vmskltz_w)
-TRANS(vmskltz_d, gen_vv, gen_helper_vmskltz_d)
-TRANS(vmskgez_b, gen_vv, gen_helper_vmskgez_b)
-TRANS(vmsknz_b, gen_vv, gen_helper_vmsknz_b)
+TRANS(vmskltz_b, ALL, gen_vv, gen_helper_vmskltz_b)
+TRANS(vmskltz_h, ALL, gen_vv, gen_helper_vmskltz_h)
+TRANS(vmskltz_w, ALL, gen_vv, gen_helper_vmskltz_w)
+TRANS(vmskltz_d, ALL, gen_vv, gen_helper_vmskltz_d)
+TRANS(vmskgez_b, ALL, gen_vv, gen_helper_vmskgez_b)
+TRANS(vmsknz_b, ALL, gen_vv, gen_helper_vmsknz_b)
 
 #define EXPAND_BYTE(bit)  ((uint64_t)(bit ? 0xff : 0))
 
@@ -3049,10 +3049,10 @@ static bool trans_vldi(DisasContext *ctx, arg_vldi *a)
     return true;
 }
 
-TRANS(vand_v, gvec_vvv, MO_64, tcg_gen_gvec_and)
-TRANS(vor_v, gvec_vvv, MO_64, tcg_gen_gvec_or)
-TRANS(vxor_v, gvec_vvv, MO_64, tcg_gen_gvec_xor)
-TRANS(vnor_v, gvec_vvv, MO_64, tcg_gen_gvec_nor)
+TRANS(vand_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_and)
+TRANS(vor_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_or)
+TRANS(vxor_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_xor)
+TRANS(vnor_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_nor)
 
 static bool trans_vandn_v(DisasContext *ctx, arg_vvv *a)
 {
@@ -3067,10 +3067,10 @@ static bool trans_vandn_v(DisasContext *ctx, arg_vvv *a)
     tcg_gen_gvec_andc(MO_64, vd_ofs, vk_ofs, vj_ofs, 16, ctx->vl/8);
     return true;
 }
-TRANS(vorn_v, gvec_vvv, MO_64, tcg_gen_gvec_orc)
-TRANS(vandi_b, gvec_vv_i, MO_8, tcg_gen_gvec_andi)
-TRANS(vori_b, gvec_vv_i, MO_8, tcg_gen_gvec_ori)
-TRANS(vxori_b, gvec_vv_i, MO_8, tcg_gen_gvec_xori)
+TRANS(vorn_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_orc)
+TRANS(vandi_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_andi)
+TRANS(vori_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_ori)
+TRANS(vxori_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_xori)
 
 static void gen_vnori(unsigned vece, TCGv_vec t, TCGv_vec a, int64_t imm)
 {
@@ -3103,176 +3103,176 @@ static void do_vnori_b(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op);
 }
 
-TRANS(vnori_b, gvec_vv_i, MO_8, do_vnori_b)
+TRANS(vnori_b, ALL, gvec_vv_i, MO_8, do_vnori_b)
 
-TRANS(vsll_b, gvec_vvv, MO_8, tcg_gen_gvec_shlv)
-TRANS(vsll_h, gvec_vvv, MO_16, tcg_gen_gvec_shlv)
-TRANS(vsll_w, gvec_vvv, MO_32, tcg_gen_gvec_shlv)
-TRANS(vsll_d, gvec_vvv, MO_64, tcg_gen_gvec_shlv)
-TRANS(vslli_b, gvec_vv_i, MO_8, tcg_gen_gvec_shli)
-TRANS(vslli_h, gvec_vv_i, MO_16, tcg_gen_gvec_shli)
-TRANS(vslli_w, gvec_vv_i, MO_32, tcg_gen_gvec_shli)
-TRANS(vslli_d, gvec_vv_i, MO_64, tcg_gen_gvec_shli)
+TRANS(vsll_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_shlv)
+TRANS(vsll_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_shlv)
+TRANS(vsll_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_shlv)
+TRANS(vsll_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_shlv)
+TRANS(vslli_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_shli)
+TRANS(vslli_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_shli)
+TRANS(vslli_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_shli)
+TRANS(vslli_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_shli)
 
-TRANS(vsrl_b, gvec_vvv, MO_8, tcg_gen_gvec_shrv)
-TRANS(vsrl_h, gvec_vvv, MO_16, tcg_gen_gvec_shrv)
-TRANS(vsrl_w, gvec_vvv, MO_32, tcg_gen_gvec_shrv)
-TRANS(vsrl_d, gvec_vvv, MO_64, tcg_gen_gvec_shrv)
-TRANS(vsrli_b, gvec_vv_i, MO_8, tcg_gen_gvec_shri)
-TRANS(vsrli_h, gvec_vv_i, MO_16, tcg_gen_gvec_shri)
-TRANS(vsrli_w, gvec_vv_i, MO_32, tcg_gen_gvec_shri)
-TRANS(vsrli_d, gvec_vv_i, MO_64, tcg_gen_gvec_shri)
+TRANS(vsrl_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_shrv)
+TRANS(vsrl_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_shrv)
+TRANS(vsrl_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_shrv)
+TRANS(vsrl_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_shrv)
+TRANS(vsrli_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_shri)
+TRANS(vsrli_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_shri)
+TRANS(vsrli_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_shri)
+TRANS(vsrli_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_shri)
 
-TRANS(vsra_b, gvec_vvv, MO_8, tcg_gen_gvec_sarv)
-TRANS(vsra_h, gvec_vvv, MO_16, tcg_gen_gvec_sarv)
-TRANS(vsra_w, gvec_vvv, MO_32, tcg_gen_gvec_sarv)
-TRANS(vsra_d, gvec_vvv, MO_64, tcg_gen_gvec_sarv)
-TRANS(vsrai_b, gvec_vv_i, MO_8, tcg_gen_gvec_sari)
-TRANS(vsrai_h, gvec_vv_i, MO_16, tcg_gen_gvec_sari)
-TRANS(vsrai_w, gvec_vv_i, MO_32, tcg_gen_gvec_sari)
-TRANS(vsrai_d, gvec_vv_i, MO_64, tcg_gen_gvec_sari)
+TRANS(vsra_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_sarv)
+TRANS(vsra_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_sarv)
+TRANS(vsra_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_sarv)
+TRANS(vsra_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_sarv)
+TRANS(vsrai_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_sari)
+TRANS(vsrai_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_sari)
+TRANS(vsrai_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_sari)
+TRANS(vsrai_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_sari)
 
-TRANS(vrotr_b, gvec_vvv, MO_8, tcg_gen_gvec_rotrv)
-TRANS(vrotr_h, gvec_vvv, MO_16, tcg_gen_gvec_rotrv)
-TRANS(vrotr_w, gvec_vvv, MO_32, tcg_gen_gvec_rotrv)
-TRANS(vrotr_d, gvec_vvv, MO_64, tcg_gen_gvec_rotrv)
-TRANS(vrotri_b, gvec_vv_i, MO_8, tcg_gen_gvec_rotri)
-TRANS(vrotri_h, gvec_vv_i, MO_16, tcg_gen_gvec_rotri)
-TRANS(vrotri_w, gvec_vv_i, MO_32, tcg_gen_gvec_rotri)
-TRANS(vrotri_d, gvec_vv_i, MO_64, tcg_gen_gvec_rotri)
+TRANS(vrotr_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_rotrv)
+TRANS(vrotr_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_rotrv)
+TRANS(vrotr_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_rotrv)
+TRANS(vrotr_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_rotrv)
+TRANS(vrotri_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_rotri)
+TRANS(vrotri_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_rotri)
+TRANS(vrotri_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_rotri)
+TRANS(vrotri_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_rotri)
 
-TRANS(vsllwil_h_b, gen_vv_i, gen_helper_vsllwil_h_b)
-TRANS(vsllwil_w_h, gen_vv_i, gen_helper_vsllwil_w_h)
-TRANS(vsllwil_d_w, gen_vv_i, gen_helper_vsllwil_d_w)
-TRANS(vextl_q_d, gen_vv, gen_helper_vextl_q_d)
-TRANS(vsllwil_hu_bu, gen_vv_i, gen_helper_vsllwil_hu_bu)
-TRANS(vsllwil_wu_hu, gen_vv_i, gen_helper_vsllwil_wu_hu)
-TRANS(vsllwil_du_wu, gen_vv_i, gen_helper_vsllwil_du_wu)
-TRANS(vextl_qu_du, gen_vv, gen_helper_vextl_qu_du)
+TRANS(vsllwil_h_b, ALL, gen_vv_i, gen_helper_vsllwil_h_b)
+TRANS(vsllwil_w_h, ALL, gen_vv_i, gen_helper_vsllwil_w_h)
+TRANS(vsllwil_d_w, ALL, gen_vv_i, gen_helper_vsllwil_d_w)
+TRANS(vextl_q_d, ALL, gen_vv, gen_helper_vextl_q_d)
+TRANS(vsllwil_hu_bu, ALL, gen_vv_i, gen_helper_vsllwil_hu_bu)
+TRANS(vsllwil_wu_hu, ALL, gen_vv_i, gen_helper_vsllwil_wu_hu)
+TRANS(vsllwil_du_wu, ALL, gen_vv_i, gen_helper_vsllwil_du_wu)
+TRANS(vextl_qu_du, ALL, gen_vv, gen_helper_vextl_qu_du)
 
-TRANS(vsrlr_b, gen_vvv, gen_helper_vsrlr_b)
-TRANS(vsrlr_h, gen_vvv, gen_helper_vsrlr_h)
-TRANS(vsrlr_w, gen_vvv, gen_helper_vsrlr_w)
-TRANS(vsrlr_d, gen_vvv, gen_helper_vsrlr_d)
-TRANS(vsrlri_b, gen_vv_i, gen_helper_vsrlri_b)
-TRANS(vsrlri_h, gen_vv_i, gen_helper_vsrlri_h)
-TRANS(vsrlri_w, gen_vv_i, gen_helper_vsrlri_w)
-TRANS(vsrlri_d, gen_vv_i, gen_helper_vsrlri_d)
+TRANS(vsrlr_b, ALL, gen_vvv, gen_helper_vsrlr_b)
+TRANS(vsrlr_h, ALL, gen_vvv, gen_helper_vsrlr_h)
+TRANS(vsrlr_w, ALL, gen_vvv, gen_helper_vsrlr_w)
+TRANS(vsrlr_d, ALL, gen_vvv, gen_helper_vsrlr_d)
+TRANS(vsrlri_b, ALL, gen_vv_i, gen_helper_vsrlri_b)
+TRANS(vsrlri_h, ALL, gen_vv_i, gen_helper_vsrlri_h)
+TRANS(vsrlri_w, ALL, gen_vv_i, gen_helper_vsrlri_w)
+TRANS(vsrlri_d, ALL, gen_vv_i, gen_helper_vsrlri_d)
 
-TRANS(vsrar_b, gen_vvv, gen_helper_vsrar_b)
-TRANS(vsrar_h, gen_vvv, gen_helper_vsrar_h)
-TRANS(vsrar_w, gen_vvv, gen_helper_vsrar_w)
-TRANS(vsrar_d, gen_vvv, gen_helper_vsrar_d)
-TRANS(vsrari_b, gen_vv_i, gen_helper_vsrari_b)
-TRANS(vsrari_h, gen_vv_i, gen_helper_vsrari_h)
-TRANS(vsrari_w, gen_vv_i, gen_helper_vsrari_w)
-TRANS(vsrari_d, gen_vv_i, gen_helper_vsrari_d)
+TRANS(vsrar_b, ALL, gen_vvv, gen_helper_vsrar_b)
+TRANS(vsrar_h, ALL, gen_vvv, gen_helper_vsrar_h)
+TRANS(vsrar_w, ALL, gen_vvv, gen_helper_vsrar_w)
+TRANS(vsrar_d, ALL, gen_vvv, gen_helper_vsrar_d)
+TRANS(vsrari_b, ALL, gen_vv_i, gen_helper_vsrari_b)
+TRANS(vsrari_h, ALL, gen_vv_i, gen_helper_vsrari_h)
+TRANS(vsrari_w, ALL, gen_vv_i, gen_helper_vsrari_w)
+TRANS(vsrari_d, ALL, gen_vv_i, gen_helper_vsrari_d)
 
-TRANS(vsrln_b_h, gen_vvv, gen_helper_vsrln_b_h)
-TRANS(vsrln_h_w, gen_vvv, gen_helper_vsrln_h_w)
-TRANS(vsrln_w_d, gen_vvv, gen_helper_vsrln_w_d)
-TRANS(vsran_b_h, gen_vvv, gen_helper_vsran_b_h)
-TRANS(vsran_h_w, gen_vvv, gen_helper_vsran_h_w)
-TRANS(vsran_w_d, gen_vvv, gen_helper_vsran_w_d)
+TRANS(vsrln_b_h, ALL, gen_vvv, gen_helper_vsrln_b_h)
+TRANS(vsrln_h_w, ALL, gen_vvv, gen_helper_vsrln_h_w)
+TRANS(vsrln_w_d, ALL, gen_vvv, gen_helper_vsrln_w_d)
+TRANS(vsran_b_h, ALL, gen_vvv, gen_helper_vsran_b_h)
+TRANS(vsran_h_w, ALL, gen_vvv, gen_helper_vsran_h_w)
+TRANS(vsran_w_d, ALL, gen_vvv, gen_helper_vsran_w_d)
 
-TRANS(vsrlni_b_h, gen_vv_i, gen_helper_vsrlni_b_h)
-TRANS(vsrlni_h_w, gen_vv_i, gen_helper_vsrlni_h_w)
-TRANS(vsrlni_w_d, gen_vv_i, gen_helper_vsrlni_w_d)
-TRANS(vsrlni_d_q, gen_vv_i, gen_helper_vsrlni_d_q)
-TRANS(vsrani_b_h, gen_vv_i, gen_helper_vsrani_b_h)
-TRANS(vsrani_h_w, gen_vv_i, gen_helper_vsrani_h_w)
-TRANS(vsrani_w_d, gen_vv_i, gen_helper_vsrani_w_d)
-TRANS(vsrani_d_q, gen_vv_i, gen_helper_vsrani_d_q)
+TRANS(vsrlni_b_h, ALL, gen_vv_i, gen_helper_vsrlni_b_h)
+TRANS(vsrlni_h_w, ALL, gen_vv_i, gen_helper_vsrlni_h_w)
+TRANS(vsrlni_w_d, ALL, gen_vv_i, gen_helper_vsrlni_w_d)
+TRANS(vsrlni_d_q, ALL, gen_vv_i, gen_helper_vsrlni_d_q)
+TRANS(vsrani_b_h, ALL, gen_vv_i, gen_helper_vsrani_b_h)
+TRANS(vsrani_h_w, ALL, gen_vv_i, gen_helper_vsrani_h_w)
+TRANS(vsrani_w_d, ALL, gen_vv_i, gen_helper_vsrani_w_d)
+TRANS(vsrani_d_q, ALL, gen_vv_i, gen_helper_vsrani_d_q)
 
-TRANS(vsrlrn_b_h, gen_vvv, gen_helper_vsrlrn_b_h)
-TRANS(vsrlrn_h_w, gen_vvv, gen_helper_vsrlrn_h_w)
-TRANS(vsrlrn_w_d, gen_vvv, gen_helper_vsrlrn_w_d)
-TRANS(vsrarn_b_h, gen_vvv, gen_helper_vsrarn_b_h)
-TRANS(vsrarn_h_w, gen_vvv, gen_helper_vsrarn_h_w)
-TRANS(vsrarn_w_d, gen_vvv, gen_helper_vsrarn_w_d)
+TRANS(vsrlrn_b_h, ALL, gen_vvv, gen_helper_vsrlrn_b_h)
+TRANS(vsrlrn_h_w, ALL, gen_vvv, gen_helper_vsrlrn_h_w)
+TRANS(vsrlrn_w_d, ALL, gen_vvv, gen_helper_vsrlrn_w_d)
+TRANS(vsrarn_b_h, ALL, gen_vvv, gen_helper_vsrarn_b_h)
+TRANS(vsrarn_h_w, ALL, gen_vvv, gen_helper_vsrarn_h_w)
+TRANS(vsrarn_w_d, ALL, gen_vvv, gen_helper_vsrarn_w_d)
 
-TRANS(vsrlrni_b_h, gen_vv_i, gen_helper_vsrlrni_b_h)
-TRANS(vsrlrni_h_w, gen_vv_i, gen_helper_vsrlrni_h_w)
-TRANS(vsrlrni_w_d, gen_vv_i, gen_helper_vsrlrni_w_d)
-TRANS(vsrlrni_d_q, gen_vv_i, gen_helper_vsrlrni_d_q)
-TRANS(vsrarni_b_h, gen_vv_i, gen_helper_vsrarni_b_h)
-TRANS(vsrarni_h_w, gen_vv_i, gen_helper_vsrarni_h_w)
-TRANS(vsrarni_w_d, gen_vv_i, gen_helper_vsrarni_w_d)
-TRANS(vsrarni_d_q, gen_vv_i, gen_helper_vsrarni_d_q)
+TRANS(vsrlrni_b_h, ALL, gen_vv_i, gen_helper_vsrlrni_b_h)
+TRANS(vsrlrni_h_w, ALL, gen_vv_i, gen_helper_vsrlrni_h_w)
+TRANS(vsrlrni_w_d, ALL, gen_vv_i, gen_helper_vsrlrni_w_d)
+TRANS(vsrlrni_d_q, ALL, gen_vv_i, gen_helper_vsrlrni_d_q)
+TRANS(vsrarni_b_h, ALL, gen_vv_i, gen_helper_vsrarni_b_h)
+TRANS(vsrarni_h_w, ALL, gen_vv_i, gen_helper_vsrarni_h_w)
+TRANS(vsrarni_w_d, ALL, gen_vv_i, gen_helper_vsrarni_w_d)
+TRANS(vsrarni_d_q, ALL, gen_vv_i, gen_helper_vsrarni_d_q)
 
-TRANS(vssrln_b_h, gen_vvv, gen_helper_vssrln_b_h)
-TRANS(vssrln_h_w, gen_vvv, gen_helper_vssrln_h_w)
-TRANS(vssrln_w_d, gen_vvv, gen_helper_vssrln_w_d)
-TRANS(vssran_b_h, gen_vvv, gen_helper_vssran_b_h)
-TRANS(vssran_h_w, gen_vvv, gen_helper_vssran_h_w)
-TRANS(vssran_w_d, gen_vvv, gen_helper_vssran_w_d)
-TRANS(vssrln_bu_h, gen_vvv, gen_helper_vssrln_bu_h)
-TRANS(vssrln_hu_w, gen_vvv, gen_helper_vssrln_hu_w)
-TRANS(vssrln_wu_d, gen_vvv, gen_helper_vssrln_wu_d)
-TRANS(vssran_bu_h, gen_vvv, gen_helper_vssran_bu_h)
-TRANS(vssran_hu_w, gen_vvv, gen_helper_vssran_hu_w)
-TRANS(vssran_wu_d, gen_vvv, gen_helper_vssran_wu_d)
+TRANS(vssrln_b_h, ALL, gen_vvv, gen_helper_vssrln_b_h)
+TRANS(vssrln_h_w, ALL, gen_vvv, gen_helper_vssrln_h_w)
+TRANS(vssrln_w_d, ALL, gen_vvv, gen_helper_vssrln_w_d)
+TRANS(vssran_b_h, ALL, gen_vvv, gen_helper_vssran_b_h)
+TRANS(vssran_h_w, ALL, gen_vvv, gen_helper_vssran_h_w)
+TRANS(vssran_w_d, ALL, gen_vvv, gen_helper_vssran_w_d)
+TRANS(vssrln_bu_h, ALL, gen_vvv, gen_helper_vssrln_bu_h)
+TRANS(vssrln_hu_w, ALL, gen_vvv, gen_helper_vssrln_hu_w)
+TRANS(vssrln_wu_d, ALL, gen_vvv, gen_helper_vssrln_wu_d)
+TRANS(vssran_bu_h, ALL, gen_vvv, gen_helper_vssran_bu_h)
+TRANS(vssran_hu_w, ALL, gen_vvv, gen_helper_vssran_hu_w)
+TRANS(vssran_wu_d, ALL, gen_vvv, gen_helper_vssran_wu_d)
 
-TRANS(vssrlni_b_h, gen_vv_i, gen_helper_vssrlni_b_h)
-TRANS(vssrlni_h_w, gen_vv_i, gen_helper_vssrlni_h_w)
-TRANS(vssrlni_w_d, gen_vv_i, gen_helper_vssrlni_w_d)
-TRANS(vssrlni_d_q, gen_vv_i, gen_helper_vssrlni_d_q)
-TRANS(vssrani_b_h, gen_vv_i, gen_helper_vssrani_b_h)
-TRANS(vssrani_h_w, gen_vv_i, gen_helper_vssrani_h_w)
-TRANS(vssrani_w_d, gen_vv_i, gen_helper_vssrani_w_d)
-TRANS(vssrani_d_q, gen_vv_i, gen_helper_vssrani_d_q)
-TRANS(vssrlni_bu_h, gen_vv_i, gen_helper_vssrlni_bu_h)
-TRANS(vssrlni_hu_w, gen_vv_i, gen_helper_vssrlni_hu_w)
-TRANS(vssrlni_wu_d, gen_vv_i, gen_helper_vssrlni_wu_d)
-TRANS(vssrlni_du_q, gen_vv_i, gen_helper_vssrlni_du_q)
-TRANS(vssrani_bu_h, gen_vv_i, gen_helper_vssrani_bu_h)
-TRANS(vssrani_hu_w, gen_vv_i, gen_helper_vssrani_hu_w)
-TRANS(vssrani_wu_d, gen_vv_i, gen_helper_vssrani_wu_d)
-TRANS(vssrani_du_q, gen_vv_i, gen_helper_vssrani_du_q)
+TRANS(vssrlni_b_h, ALL, gen_vv_i, gen_helper_vssrlni_b_h)
+TRANS(vssrlni_h_w, ALL, gen_vv_i, gen_helper_vssrlni_h_w)
+TRANS(vssrlni_w_d, ALL, gen_vv_i, gen_helper_vssrlni_w_d)
+TRANS(vssrlni_d_q, ALL, gen_vv_i, gen_helper_vssrlni_d_q)
+TRANS(vssrani_b_h, ALL, gen_vv_i, gen_helper_vssrani_b_h)
+TRANS(vssrani_h_w, ALL, gen_vv_i, gen_helper_vssrani_h_w)
+TRANS(vssrani_w_d, ALL, gen_vv_i, gen_helper_vssrani_w_d)
+TRANS(vssrani_d_q, ALL, gen_vv_i, gen_helper_vssrani_d_q)
+TRANS(vssrlni_bu_h, ALL, gen_vv_i, gen_helper_vssrlni_bu_h)
+TRANS(vssrlni_hu_w, ALL, gen_vv_i, gen_helper_vssrlni_hu_w)
+TRANS(vssrlni_wu_d, ALL, gen_vv_i, gen_helper_vssrlni_wu_d)
+TRANS(vssrlni_du_q, ALL, gen_vv_i, gen_helper_vssrlni_du_q)
+TRANS(vssrani_bu_h, ALL, gen_vv_i, gen_helper_vssrani_bu_h)
+TRANS(vssrani_hu_w, ALL, gen_vv_i, gen_helper_vssrani_hu_w)
+TRANS(vssrani_wu_d, ALL, gen_vv_i, gen_helper_vssrani_wu_d)
+TRANS(vssrani_du_q, ALL, gen_vv_i, gen_helper_vssrani_du_q)
 
-TRANS(vssrlrn_b_h, gen_vvv, gen_helper_vssrlrn_b_h)
-TRANS(vssrlrn_h_w, gen_vvv, gen_helper_vssrlrn_h_w)
-TRANS(vssrlrn_w_d, gen_vvv, gen_helper_vssrlrn_w_d)
-TRANS(vssrarn_b_h, gen_vvv, gen_helper_vssrarn_b_h)
-TRANS(vssrarn_h_w, gen_vvv, gen_helper_vssrarn_h_w)
-TRANS(vssrarn_w_d, gen_vvv, gen_helper_vssrarn_w_d)
-TRANS(vssrlrn_bu_h, gen_vvv, gen_helper_vssrlrn_bu_h)
-TRANS(vssrlrn_hu_w, gen_vvv, gen_helper_vssrlrn_hu_w)
-TRANS(vssrlrn_wu_d, gen_vvv, gen_helper_vssrlrn_wu_d)
-TRANS(vssrarn_bu_h, gen_vvv, gen_helper_vssrarn_bu_h)
-TRANS(vssrarn_hu_w, gen_vvv, gen_helper_vssrarn_hu_w)
-TRANS(vssrarn_wu_d, gen_vvv, gen_helper_vssrarn_wu_d)
+TRANS(vssrlrn_b_h, ALL, gen_vvv, gen_helper_vssrlrn_b_h)
+TRANS(vssrlrn_h_w, ALL, gen_vvv, gen_helper_vssrlrn_h_w)
+TRANS(vssrlrn_w_d, ALL, gen_vvv, gen_helper_vssrlrn_w_d)
+TRANS(vssrarn_b_h, ALL, gen_vvv, gen_helper_vssrarn_b_h)
+TRANS(vssrarn_h_w, ALL, gen_vvv, gen_helper_vssrarn_h_w)
+TRANS(vssrarn_w_d, ALL, gen_vvv, gen_helper_vssrarn_w_d)
+TRANS(vssrlrn_bu_h, ALL, gen_vvv, gen_helper_vssrlrn_bu_h)
+TRANS(vssrlrn_hu_w, ALL, gen_vvv, gen_helper_vssrlrn_hu_w)
+TRANS(vssrlrn_wu_d, ALL, gen_vvv, gen_helper_vssrlrn_wu_d)
+TRANS(vssrarn_bu_h, ALL, gen_vvv, gen_helper_vssrarn_bu_h)
+TRANS(vssrarn_hu_w, ALL, gen_vvv, gen_helper_vssrarn_hu_w)
+TRANS(vssrarn_wu_d, ALL, gen_vvv, gen_helper_vssrarn_wu_d)
 
-TRANS(vssrlrni_b_h, gen_vv_i, gen_helper_vssrlrni_b_h)
-TRANS(vssrlrni_h_w, gen_vv_i, gen_helper_vssrlrni_h_w)
-TRANS(vssrlrni_w_d, gen_vv_i, gen_helper_vssrlrni_w_d)
-TRANS(vssrlrni_d_q, gen_vv_i, gen_helper_vssrlrni_d_q)
-TRANS(vssrarni_b_h, gen_vv_i, gen_helper_vssrarni_b_h)
-TRANS(vssrarni_h_w, gen_vv_i, gen_helper_vssrarni_h_w)
-TRANS(vssrarni_w_d, gen_vv_i, gen_helper_vssrarni_w_d)
-TRANS(vssrarni_d_q, gen_vv_i, gen_helper_vssrarni_d_q)
-TRANS(vssrlrni_bu_h, gen_vv_i, gen_helper_vssrlrni_bu_h)
-TRANS(vssrlrni_hu_w, gen_vv_i, gen_helper_vssrlrni_hu_w)
-TRANS(vssrlrni_wu_d, gen_vv_i, gen_helper_vssrlrni_wu_d)
-TRANS(vssrlrni_du_q, gen_vv_i, gen_helper_vssrlrni_du_q)
-TRANS(vssrarni_bu_h, gen_vv_i, gen_helper_vssrarni_bu_h)
-TRANS(vssrarni_hu_w, gen_vv_i, gen_helper_vssrarni_hu_w)
-TRANS(vssrarni_wu_d, gen_vv_i, gen_helper_vssrarni_wu_d)
-TRANS(vssrarni_du_q, gen_vv_i, gen_helper_vssrarni_du_q)
+TRANS(vssrlrni_b_h, ALL, gen_vv_i, gen_helper_vssrlrni_b_h)
+TRANS(vssrlrni_h_w, ALL, gen_vv_i, gen_helper_vssrlrni_h_w)
+TRANS(vssrlrni_w_d, ALL, gen_vv_i, gen_helper_vssrlrni_w_d)
+TRANS(vssrlrni_d_q, ALL, gen_vv_i, gen_helper_vssrlrni_d_q)
+TRANS(vssrarni_b_h, ALL, gen_vv_i, gen_helper_vssrarni_b_h)
+TRANS(vssrarni_h_w, ALL, gen_vv_i, gen_helper_vssrarni_h_w)
+TRANS(vssrarni_w_d, ALL, gen_vv_i, gen_helper_vssrarni_w_d)
+TRANS(vssrarni_d_q, ALL, gen_vv_i, gen_helper_vssrarni_d_q)
+TRANS(vssrlrni_bu_h, ALL, gen_vv_i, gen_helper_vssrlrni_bu_h)
+TRANS(vssrlrni_hu_w, ALL, gen_vv_i, gen_helper_vssrlrni_hu_w)
+TRANS(vssrlrni_wu_d, ALL, gen_vv_i, gen_helper_vssrlrni_wu_d)
+TRANS(vssrlrni_du_q, ALL, gen_vv_i, gen_helper_vssrlrni_du_q)
+TRANS(vssrarni_bu_h, ALL, gen_vv_i, gen_helper_vssrarni_bu_h)
+TRANS(vssrarni_hu_w, ALL, gen_vv_i, gen_helper_vssrarni_hu_w)
+TRANS(vssrarni_wu_d, ALL, gen_vv_i, gen_helper_vssrarni_wu_d)
+TRANS(vssrarni_du_q, ALL, gen_vv_i, gen_helper_vssrarni_du_q)
 
-TRANS(vclo_b, gen_vv, gen_helper_vclo_b)
-TRANS(vclo_h, gen_vv, gen_helper_vclo_h)
-TRANS(vclo_w, gen_vv, gen_helper_vclo_w)
-TRANS(vclo_d, gen_vv, gen_helper_vclo_d)
-TRANS(vclz_b, gen_vv, gen_helper_vclz_b)
-TRANS(vclz_h, gen_vv, gen_helper_vclz_h)
-TRANS(vclz_w, gen_vv, gen_helper_vclz_w)
-TRANS(vclz_d, gen_vv, gen_helper_vclz_d)
+TRANS(vclo_b, ALL, gen_vv, gen_helper_vclo_b)
+TRANS(vclo_h, ALL, gen_vv, gen_helper_vclo_h)
+TRANS(vclo_w, ALL, gen_vv, gen_helper_vclo_w)
+TRANS(vclo_d, ALL, gen_vv, gen_helper_vclo_d)
+TRANS(vclz_b, ALL, gen_vv, gen_helper_vclz_b)
+TRANS(vclz_h, ALL, gen_vv, gen_helper_vclz_h)
+TRANS(vclz_w, ALL, gen_vv, gen_helper_vclz_w)
+TRANS(vclz_d, ALL, gen_vv, gen_helper_vclz_d)
 
-TRANS(vpcnt_b, gen_vv, gen_helper_vpcnt_b)
-TRANS(vpcnt_h, gen_vv, gen_helper_vpcnt_h)
-TRANS(vpcnt_w, gen_vv, gen_helper_vpcnt_w)
-TRANS(vpcnt_d, gen_vv, gen_helper_vpcnt_d)
+TRANS(vpcnt_b, ALL, gen_vv, gen_helper_vpcnt_b)
+TRANS(vpcnt_h, ALL, gen_vv, gen_helper_vpcnt_h)
+TRANS(vpcnt_w, ALL, gen_vv, gen_helper_vpcnt_w)
+TRANS(vpcnt_d, ALL, gen_vv, gen_helper_vpcnt_d)
 
 static void do_vbit(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b,
                     void (*func)(unsigned, TCGv_vec, TCGv_vec, TCGv_vec))
@@ -3340,10 +3340,10 @@ static void do_vbitclr(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vbitclr_b, gvec_vvv, MO_8, do_vbitclr)
-TRANS(vbitclr_h, gvec_vvv, MO_16, do_vbitclr)
-TRANS(vbitclr_w, gvec_vvv, MO_32, do_vbitclr)
-TRANS(vbitclr_d, gvec_vvv, MO_64, do_vbitclr)
+TRANS(vbitclr_b, ALL, gvec_vvv, MO_8, do_vbitclr)
+TRANS(vbitclr_h, ALL, gvec_vvv, MO_16, do_vbitclr)
+TRANS(vbitclr_w, ALL, gvec_vvv, MO_32, do_vbitclr)
+TRANS(vbitclr_d, ALL, gvec_vvv, MO_64, do_vbitclr)
 
 static void do_vbiti(unsigned vece, TCGv_vec t, TCGv_vec a, int64_t imm,
                      void (*func)(unsigned, TCGv_vec, TCGv_vec, TCGv_vec))
@@ -3410,10 +3410,10 @@ static void do_vbitclri(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vbitclri_b, gvec_vv_i, MO_8, do_vbitclri)
-TRANS(vbitclri_h, gvec_vv_i, MO_16, do_vbitclri)
-TRANS(vbitclri_w, gvec_vv_i, MO_32, do_vbitclri)
-TRANS(vbitclri_d, gvec_vv_i, MO_64, do_vbitclri)
+TRANS(vbitclri_b, ALL, gvec_vv_i, MO_8, do_vbitclri)
+TRANS(vbitclri_h, ALL, gvec_vv_i, MO_16, do_vbitclri)
+TRANS(vbitclri_w, ALL, gvec_vv_i, MO_32, do_vbitclri)
+TRANS(vbitclri_d, ALL, gvec_vv_i, MO_64, do_vbitclri)
 
 static void do_vbitset(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        uint32_t vk_ofs, uint32_t oprsz, uint32_t maxsz)
@@ -3451,10 +3451,10 @@ static void do_vbitset(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vbitset_b, gvec_vvv, MO_8, do_vbitset)
-TRANS(vbitset_h, gvec_vvv, MO_16, do_vbitset)
-TRANS(vbitset_w, gvec_vvv, MO_32, do_vbitset)
-TRANS(vbitset_d, gvec_vvv, MO_64, do_vbitset)
+TRANS(vbitset_b, ALL, gvec_vvv, MO_8, do_vbitset)
+TRANS(vbitset_h, ALL, gvec_vvv, MO_16, do_vbitset)
+TRANS(vbitset_w, ALL, gvec_vvv, MO_32, do_vbitset)
+TRANS(vbitset_d, ALL, gvec_vvv, MO_64, do_vbitset)
 
 static void do_vbitseti(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                         int64_t imm, uint32_t oprsz, uint32_t maxsz)
@@ -3492,10 +3492,10 @@ static void do_vbitseti(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vbitseti_b, gvec_vv_i, MO_8, do_vbitseti)
-TRANS(vbitseti_h, gvec_vv_i, MO_16, do_vbitseti)
-TRANS(vbitseti_w, gvec_vv_i, MO_32, do_vbitseti)
-TRANS(vbitseti_d, gvec_vv_i, MO_64, do_vbitseti)
+TRANS(vbitseti_b, ALL, gvec_vv_i, MO_8, do_vbitseti)
+TRANS(vbitseti_h, ALL, gvec_vv_i, MO_16, do_vbitseti)
+TRANS(vbitseti_w, ALL, gvec_vv_i, MO_32, do_vbitseti)
+TRANS(vbitseti_d, ALL, gvec_vv_i, MO_64, do_vbitseti)
 
 static void do_vbitrev(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        uint32_t vk_ofs, uint32_t oprsz, uint32_t maxsz)
@@ -3533,10 +3533,10 @@ static void do_vbitrev(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vbitrev_b, gvec_vvv, MO_8, do_vbitrev)
-TRANS(vbitrev_h, gvec_vvv, MO_16, do_vbitrev)
-TRANS(vbitrev_w, gvec_vvv, MO_32, do_vbitrev)
-TRANS(vbitrev_d, gvec_vvv, MO_64, do_vbitrev)
+TRANS(vbitrev_b, ALL, gvec_vvv, MO_8, do_vbitrev)
+TRANS(vbitrev_h, ALL, gvec_vvv, MO_16, do_vbitrev)
+TRANS(vbitrev_w, ALL, gvec_vvv, MO_32, do_vbitrev)
+TRANS(vbitrev_d, ALL, gvec_vvv, MO_64, do_vbitrev)
 
 static void do_vbitrevi(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                         int64_t imm, uint32_t oprsz, uint32_t maxsz)
@@ -3574,112 +3574,112 @@ static void do_vbitrevi(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vbitrevi_b, gvec_vv_i, MO_8, do_vbitrevi)
-TRANS(vbitrevi_h, gvec_vv_i, MO_16, do_vbitrevi)
-TRANS(vbitrevi_w, gvec_vv_i, MO_32, do_vbitrevi)
-TRANS(vbitrevi_d, gvec_vv_i, MO_64, do_vbitrevi)
+TRANS(vbitrevi_b, ALL, gvec_vv_i, MO_8, do_vbitrevi)
+TRANS(vbitrevi_h, ALL, gvec_vv_i, MO_16, do_vbitrevi)
+TRANS(vbitrevi_w, ALL, gvec_vv_i, MO_32, do_vbitrevi)
+TRANS(vbitrevi_d, ALL, gvec_vv_i, MO_64, do_vbitrevi)
 
-TRANS(vfrstp_b, gen_vvv, gen_helper_vfrstp_b)
-TRANS(vfrstp_h, gen_vvv, gen_helper_vfrstp_h)
-TRANS(vfrstpi_b, gen_vv_i, gen_helper_vfrstpi_b)
-TRANS(vfrstpi_h, gen_vv_i, gen_helper_vfrstpi_h)
+TRANS(vfrstp_b, ALL, gen_vvv, gen_helper_vfrstp_b)
+TRANS(vfrstp_h, ALL, gen_vvv, gen_helper_vfrstp_h)
+TRANS(vfrstpi_b, ALL, gen_vv_i, gen_helper_vfrstpi_b)
+TRANS(vfrstpi_h, ALL, gen_vv_i, gen_helper_vfrstpi_h)
 
-TRANS(vfadd_s, gen_vvv, gen_helper_vfadd_s)
-TRANS(vfadd_d, gen_vvv, gen_helper_vfadd_d)
-TRANS(vfsub_s, gen_vvv, gen_helper_vfsub_s)
-TRANS(vfsub_d, gen_vvv, gen_helper_vfsub_d)
-TRANS(vfmul_s, gen_vvv, gen_helper_vfmul_s)
-TRANS(vfmul_d, gen_vvv, gen_helper_vfmul_d)
-TRANS(vfdiv_s, gen_vvv, gen_helper_vfdiv_s)
-TRANS(vfdiv_d, gen_vvv, gen_helper_vfdiv_d)
+TRANS(vfadd_s, ALL, gen_vvv, gen_helper_vfadd_s)
+TRANS(vfadd_d, ALL, gen_vvv, gen_helper_vfadd_d)
+TRANS(vfsub_s, ALL, gen_vvv, gen_helper_vfsub_s)
+TRANS(vfsub_d, ALL, gen_vvv, gen_helper_vfsub_d)
+TRANS(vfmul_s, ALL, gen_vvv, gen_helper_vfmul_s)
+TRANS(vfmul_d, ALL, gen_vvv, gen_helper_vfmul_d)
+TRANS(vfdiv_s, ALL, gen_vvv, gen_helper_vfdiv_s)
+TRANS(vfdiv_d, ALL, gen_vvv, gen_helper_vfdiv_d)
 
-TRANS(vfmadd_s, gen_vvvv, gen_helper_vfmadd_s)
-TRANS(vfmadd_d, gen_vvvv, gen_helper_vfmadd_d)
-TRANS(vfmsub_s, gen_vvvv, gen_helper_vfmsub_s)
-TRANS(vfmsub_d, gen_vvvv, gen_helper_vfmsub_d)
-TRANS(vfnmadd_s, gen_vvvv, gen_helper_vfnmadd_s)
-TRANS(vfnmadd_d, gen_vvvv, gen_helper_vfnmadd_d)
-TRANS(vfnmsub_s, gen_vvvv, gen_helper_vfnmsub_s)
-TRANS(vfnmsub_d, gen_vvvv, gen_helper_vfnmsub_d)
+TRANS(vfmadd_s, ALL, gen_vvvv, gen_helper_vfmadd_s)
+TRANS(vfmadd_d, ALL, gen_vvvv, gen_helper_vfmadd_d)
+TRANS(vfmsub_s, ALL, gen_vvvv, gen_helper_vfmsub_s)
+TRANS(vfmsub_d, ALL, gen_vvvv, gen_helper_vfmsub_d)
+TRANS(vfnmadd_s, ALL, gen_vvvv, gen_helper_vfnmadd_s)
+TRANS(vfnmadd_d, ALL, gen_vvvv, gen_helper_vfnmadd_d)
+TRANS(vfnmsub_s, ALL, gen_vvvv, gen_helper_vfnmsub_s)
+TRANS(vfnmsub_d, ALL, gen_vvvv, gen_helper_vfnmsub_d)
 
-TRANS(vfmax_s, gen_vvv, gen_helper_vfmax_s)
-TRANS(vfmax_d, gen_vvv, gen_helper_vfmax_d)
-TRANS(vfmin_s, gen_vvv, gen_helper_vfmin_s)
-TRANS(vfmin_d, gen_vvv, gen_helper_vfmin_d)
+TRANS(vfmax_s, ALL, gen_vvv, gen_helper_vfmax_s)
+TRANS(vfmax_d, ALL, gen_vvv, gen_helper_vfmax_d)
+TRANS(vfmin_s, ALL, gen_vvv, gen_helper_vfmin_s)
+TRANS(vfmin_d, ALL, gen_vvv, gen_helper_vfmin_d)
 
-TRANS(vfmaxa_s, gen_vvv, gen_helper_vfmaxa_s)
-TRANS(vfmaxa_d, gen_vvv, gen_helper_vfmaxa_d)
-TRANS(vfmina_s, gen_vvv, gen_helper_vfmina_s)
-TRANS(vfmina_d, gen_vvv, gen_helper_vfmina_d)
+TRANS(vfmaxa_s, ALL, gen_vvv, gen_helper_vfmaxa_s)
+TRANS(vfmaxa_d, ALL, gen_vvv, gen_helper_vfmaxa_d)
+TRANS(vfmina_s, ALL, gen_vvv, gen_helper_vfmina_s)
+TRANS(vfmina_d, ALL, gen_vvv, gen_helper_vfmina_d)
 
-TRANS(vflogb_s, gen_vv, gen_helper_vflogb_s)
-TRANS(vflogb_d, gen_vv, gen_helper_vflogb_d)
+TRANS(vflogb_s, ALL, gen_vv, gen_helper_vflogb_s)
+TRANS(vflogb_d, ALL, gen_vv, gen_helper_vflogb_d)
 
-TRANS(vfclass_s, gen_vv, gen_helper_vfclass_s)
-TRANS(vfclass_d, gen_vv, gen_helper_vfclass_d)
+TRANS(vfclass_s, ALL, gen_vv, gen_helper_vfclass_s)
+TRANS(vfclass_d, ALL, gen_vv, gen_helper_vfclass_d)
 
-TRANS(vfsqrt_s, gen_vv, gen_helper_vfsqrt_s)
-TRANS(vfsqrt_d, gen_vv, gen_helper_vfsqrt_d)
-TRANS(vfrecip_s, gen_vv, gen_helper_vfrecip_s)
-TRANS(vfrecip_d, gen_vv, gen_helper_vfrecip_d)
-TRANS(vfrsqrt_s, gen_vv, gen_helper_vfrsqrt_s)
-TRANS(vfrsqrt_d, gen_vv, gen_helper_vfrsqrt_d)
+TRANS(vfsqrt_s, ALL, gen_vv, gen_helper_vfsqrt_s)
+TRANS(vfsqrt_d, ALL, gen_vv, gen_helper_vfsqrt_d)
+TRANS(vfrecip_s, ALL, gen_vv, gen_helper_vfrecip_s)
+TRANS(vfrecip_d, ALL, gen_vv, gen_helper_vfrecip_d)
+TRANS(vfrsqrt_s, ALL, gen_vv, gen_helper_vfrsqrt_s)
+TRANS(vfrsqrt_d, ALL, gen_vv, gen_helper_vfrsqrt_d)
 
-TRANS(vfcvtl_s_h, gen_vv, gen_helper_vfcvtl_s_h)
-TRANS(vfcvth_s_h, gen_vv, gen_helper_vfcvth_s_h)
-TRANS(vfcvtl_d_s, gen_vv, gen_helper_vfcvtl_d_s)
-TRANS(vfcvth_d_s, gen_vv, gen_helper_vfcvth_d_s)
-TRANS(vfcvt_h_s, gen_vvv, gen_helper_vfcvt_h_s)
-TRANS(vfcvt_s_d, gen_vvv, gen_helper_vfcvt_s_d)
+TRANS(vfcvtl_s_h, ALL, gen_vv, gen_helper_vfcvtl_s_h)
+TRANS(vfcvth_s_h, ALL, gen_vv, gen_helper_vfcvth_s_h)
+TRANS(vfcvtl_d_s, ALL, gen_vv, gen_helper_vfcvtl_d_s)
+TRANS(vfcvth_d_s, ALL, gen_vv, gen_helper_vfcvth_d_s)
+TRANS(vfcvt_h_s, ALL, gen_vvv, gen_helper_vfcvt_h_s)
+TRANS(vfcvt_s_d, ALL, gen_vvv, gen_helper_vfcvt_s_d)
 
-TRANS(vfrintrne_s, gen_vv, gen_helper_vfrintrne_s)
-TRANS(vfrintrne_d, gen_vv, gen_helper_vfrintrne_d)
-TRANS(vfrintrz_s, gen_vv, gen_helper_vfrintrz_s)
-TRANS(vfrintrz_d, gen_vv, gen_helper_vfrintrz_d)
-TRANS(vfrintrp_s, gen_vv, gen_helper_vfrintrp_s)
-TRANS(vfrintrp_d, gen_vv, gen_helper_vfrintrp_d)
-TRANS(vfrintrm_s, gen_vv, gen_helper_vfrintrm_s)
-TRANS(vfrintrm_d, gen_vv, gen_helper_vfrintrm_d)
-TRANS(vfrint_s, gen_vv, gen_helper_vfrint_s)
-TRANS(vfrint_d, gen_vv, gen_helper_vfrint_d)
+TRANS(vfrintrne_s, ALL, gen_vv, gen_helper_vfrintrne_s)
+TRANS(vfrintrne_d, ALL, gen_vv, gen_helper_vfrintrne_d)
+TRANS(vfrintrz_s, ALL, gen_vv, gen_helper_vfrintrz_s)
+TRANS(vfrintrz_d, ALL, gen_vv, gen_helper_vfrintrz_d)
+TRANS(vfrintrp_s, ALL, gen_vv, gen_helper_vfrintrp_s)
+TRANS(vfrintrp_d, ALL, gen_vv, gen_helper_vfrintrp_d)
+TRANS(vfrintrm_s, ALL, gen_vv, gen_helper_vfrintrm_s)
+TRANS(vfrintrm_d, ALL, gen_vv, gen_helper_vfrintrm_d)
+TRANS(vfrint_s, ALL, gen_vv, gen_helper_vfrint_s)
+TRANS(vfrint_d, ALL, gen_vv, gen_helper_vfrint_d)
 
-TRANS(vftintrne_w_s, gen_vv, gen_helper_vftintrne_w_s)
-TRANS(vftintrne_l_d, gen_vv, gen_helper_vftintrne_l_d)
-TRANS(vftintrz_w_s, gen_vv, gen_helper_vftintrz_w_s)
-TRANS(vftintrz_l_d, gen_vv, gen_helper_vftintrz_l_d)
-TRANS(vftintrp_w_s, gen_vv, gen_helper_vftintrp_w_s)
-TRANS(vftintrp_l_d, gen_vv, gen_helper_vftintrp_l_d)
-TRANS(vftintrm_w_s, gen_vv, gen_helper_vftintrm_w_s)
-TRANS(vftintrm_l_d, gen_vv, gen_helper_vftintrm_l_d)
-TRANS(vftint_w_s, gen_vv, gen_helper_vftint_w_s)
-TRANS(vftint_l_d, gen_vv, gen_helper_vftint_l_d)
-TRANS(vftintrz_wu_s, gen_vv, gen_helper_vftintrz_wu_s)
-TRANS(vftintrz_lu_d, gen_vv, gen_helper_vftintrz_lu_d)
-TRANS(vftint_wu_s, gen_vv, gen_helper_vftint_wu_s)
-TRANS(vftint_lu_d, gen_vv, gen_helper_vftint_lu_d)
-TRANS(vftintrne_w_d, gen_vvv, gen_helper_vftintrne_w_d)
-TRANS(vftintrz_w_d, gen_vvv, gen_helper_vftintrz_w_d)
-TRANS(vftintrp_w_d, gen_vvv, gen_helper_vftintrp_w_d)
-TRANS(vftintrm_w_d, gen_vvv, gen_helper_vftintrm_w_d)
-TRANS(vftint_w_d, gen_vvv, gen_helper_vftint_w_d)
-TRANS(vftintrnel_l_s, gen_vv, gen_helper_vftintrnel_l_s)
-TRANS(vftintrneh_l_s, gen_vv, gen_helper_vftintrneh_l_s)
-TRANS(vftintrzl_l_s, gen_vv, gen_helper_vftintrzl_l_s)
-TRANS(vftintrzh_l_s, gen_vv, gen_helper_vftintrzh_l_s)
-TRANS(vftintrpl_l_s, gen_vv, gen_helper_vftintrpl_l_s)
-TRANS(vftintrph_l_s, gen_vv, gen_helper_vftintrph_l_s)
-TRANS(vftintrml_l_s, gen_vv, gen_helper_vftintrml_l_s)
-TRANS(vftintrmh_l_s, gen_vv, gen_helper_vftintrmh_l_s)
-TRANS(vftintl_l_s, gen_vv, gen_helper_vftintl_l_s)
-TRANS(vftinth_l_s, gen_vv, gen_helper_vftinth_l_s)
+TRANS(vftintrne_w_s, ALL, gen_vv, gen_helper_vftintrne_w_s)
+TRANS(vftintrne_l_d, ALL, gen_vv, gen_helper_vftintrne_l_d)
+TRANS(vftintrz_w_s, ALL, gen_vv, gen_helper_vftintrz_w_s)
+TRANS(vftintrz_l_d, ALL, gen_vv, gen_helper_vftintrz_l_d)
+TRANS(vftintrp_w_s, ALL, gen_vv, gen_helper_vftintrp_w_s)
+TRANS(vftintrp_l_d, ALL, gen_vv, gen_helper_vftintrp_l_d)
+TRANS(vftintrm_w_s, ALL, gen_vv, gen_helper_vftintrm_w_s)
+TRANS(vftintrm_l_d, ALL, gen_vv, gen_helper_vftintrm_l_d)
+TRANS(vftint_w_s, ALL, gen_vv, gen_helper_vftint_w_s)
+TRANS(vftint_l_d, ALL, gen_vv, gen_helper_vftint_l_d)
+TRANS(vftintrz_wu_s, ALL, gen_vv, gen_helper_vftintrz_wu_s)
+TRANS(vftintrz_lu_d, ALL, gen_vv, gen_helper_vftintrz_lu_d)
+TRANS(vftint_wu_s, ALL, gen_vv, gen_helper_vftint_wu_s)
+TRANS(vftint_lu_d, ALL, gen_vv, gen_helper_vftint_lu_d)
+TRANS(vftintrne_w_d, ALL, gen_vvv, gen_helper_vftintrne_w_d)
+TRANS(vftintrz_w_d, ALL, gen_vvv, gen_helper_vftintrz_w_d)
+TRANS(vftintrp_w_d, ALL, gen_vvv, gen_helper_vftintrp_w_d)
+TRANS(vftintrm_w_d, ALL, gen_vvv, gen_helper_vftintrm_w_d)
+TRANS(vftint_w_d, ALL, gen_vvv, gen_helper_vftint_w_d)
+TRANS(vftintrnel_l_s, ALL, gen_vv, gen_helper_vftintrnel_l_s)
+TRANS(vftintrneh_l_s, ALL, gen_vv, gen_helper_vftintrneh_l_s)
+TRANS(vftintrzl_l_s, ALL, gen_vv, gen_helper_vftintrzl_l_s)
+TRANS(vftintrzh_l_s, ALL, gen_vv, gen_helper_vftintrzh_l_s)
+TRANS(vftintrpl_l_s, ALL, gen_vv, gen_helper_vftintrpl_l_s)
+TRANS(vftintrph_l_s, ALL, gen_vv, gen_helper_vftintrph_l_s)
+TRANS(vftintrml_l_s, ALL, gen_vv, gen_helper_vftintrml_l_s)
+TRANS(vftintrmh_l_s, ALL, gen_vv, gen_helper_vftintrmh_l_s)
+TRANS(vftintl_l_s, ALL, gen_vv, gen_helper_vftintl_l_s)
+TRANS(vftinth_l_s, ALL, gen_vv, gen_helper_vftinth_l_s)
 
-TRANS(vffint_s_w, gen_vv, gen_helper_vffint_s_w)
-TRANS(vffint_d_l, gen_vv, gen_helper_vffint_d_l)
-TRANS(vffint_s_wu, gen_vv, gen_helper_vffint_s_wu)
-TRANS(vffint_d_lu, gen_vv, gen_helper_vffint_d_lu)
-TRANS(vffintl_d_w, gen_vv, gen_helper_vffintl_d_w)
-TRANS(vffinth_d_w, gen_vv, gen_helper_vffinth_d_w)
-TRANS(vffint_s_l, gen_vvv, gen_helper_vffint_s_l)
+TRANS(vffint_s_w, ALL, gen_vv, gen_helper_vffint_s_w)
+TRANS(vffint_d_l, ALL, gen_vv, gen_helper_vffint_d_l)
+TRANS(vffint_s_wu, ALL, gen_vv, gen_helper_vffint_s_wu)
+TRANS(vffint_d_lu, ALL, gen_vv, gen_helper_vffint_d_lu)
+TRANS(vffintl_d_w, ALL, gen_vv, gen_helper_vffintl_d_w)
+TRANS(vffinth_d_w, ALL, gen_vv, gen_helper_vffinth_d_w)
+TRANS(vffint_s_l, ALL, gen_vvv, gen_helper_vffint_s_l)
 
 static bool do_cmp(DisasContext *ctx, arg_vvv *a, MemOp mop, TCGCond cond)
 {
@@ -3823,48 +3823,48 @@ static bool do_## NAME ##_u(DisasContext *ctx, arg_vv_i *a, MemOp mop) \
 DO_CMPI_U(vslei)
 DO_CMPI_U(vslti)
 
-TRANS(vseq_b, do_cmp, MO_8, TCG_COND_EQ)
-TRANS(vseq_h, do_cmp, MO_16, TCG_COND_EQ)
-TRANS(vseq_w, do_cmp, MO_32, TCG_COND_EQ)
-TRANS(vseq_d, do_cmp, MO_64, TCG_COND_EQ)
-TRANS(vseqi_b, do_vseqi_s, MO_8)
-TRANS(vseqi_h, do_vseqi_s, MO_16)
-TRANS(vseqi_w, do_vseqi_s, MO_32)
-TRANS(vseqi_d, do_vseqi_s, MO_64)
+TRANS(vseq_b, ALL, do_cmp, MO_8, TCG_COND_EQ)
+TRANS(vseq_h, ALL, do_cmp, MO_16, TCG_COND_EQ)
+TRANS(vseq_w, ALL, do_cmp, MO_32, TCG_COND_EQ)
+TRANS(vseq_d, ALL, do_cmp, MO_64, TCG_COND_EQ)
+TRANS(vseqi_b, ALL, do_vseqi_s, MO_8)
+TRANS(vseqi_h, ALL, do_vseqi_s, MO_16)
+TRANS(vseqi_w, ALL, do_vseqi_s, MO_32)
+TRANS(vseqi_d, ALL, do_vseqi_s, MO_64)
 
-TRANS(vsle_b, do_cmp, MO_8, TCG_COND_LE)
-TRANS(vsle_h, do_cmp, MO_16, TCG_COND_LE)
-TRANS(vsle_w, do_cmp, MO_32, TCG_COND_LE)
-TRANS(vsle_d, do_cmp, MO_64, TCG_COND_LE)
-TRANS(vslei_b, do_vslei_s, MO_8)
-TRANS(vslei_h, do_vslei_s, MO_16)
-TRANS(vslei_w, do_vslei_s, MO_32)
-TRANS(vslei_d, do_vslei_s, MO_64)
-TRANS(vsle_bu, do_cmp, MO_8, TCG_COND_LEU)
-TRANS(vsle_hu, do_cmp, MO_16, TCG_COND_LEU)
-TRANS(vsle_wu, do_cmp, MO_32, TCG_COND_LEU)
-TRANS(vsle_du, do_cmp, MO_64, TCG_COND_LEU)
-TRANS(vslei_bu, do_vslei_u, MO_8)
-TRANS(vslei_hu, do_vslei_u, MO_16)
-TRANS(vslei_wu, do_vslei_u, MO_32)
-TRANS(vslei_du, do_vslei_u, MO_64)
+TRANS(vsle_b, ALL, do_cmp, MO_8, TCG_COND_LE)
+TRANS(vsle_h, ALL, do_cmp, MO_16, TCG_COND_LE)
+TRANS(vsle_w, ALL, do_cmp, MO_32, TCG_COND_LE)
+TRANS(vsle_d, ALL, do_cmp, MO_64, TCG_COND_LE)
+TRANS(vslei_b, ALL, do_vslei_s, MO_8)
+TRANS(vslei_h, ALL, do_vslei_s, MO_16)
+TRANS(vslei_w, ALL, do_vslei_s, MO_32)
+TRANS(vslei_d, ALL, do_vslei_s, MO_64)
+TRANS(vsle_bu, ALL, do_cmp, MO_8, TCG_COND_LEU)
+TRANS(vsle_hu, ALL, do_cmp, MO_16, TCG_COND_LEU)
+TRANS(vsle_wu, ALL, do_cmp, MO_32, TCG_COND_LEU)
+TRANS(vsle_du, ALL, do_cmp, MO_64, TCG_COND_LEU)
+TRANS(vslei_bu, ALL, do_vslei_u, MO_8)
+TRANS(vslei_hu, ALL, do_vslei_u, MO_16)
+TRANS(vslei_wu, ALL, do_vslei_u, MO_32)
+TRANS(vslei_du, ALL, do_vslei_u, MO_64)
 
-TRANS(vslt_b, do_cmp, MO_8, TCG_COND_LT)
-TRANS(vslt_h, do_cmp, MO_16, TCG_COND_LT)
-TRANS(vslt_w, do_cmp, MO_32, TCG_COND_LT)
-TRANS(vslt_d, do_cmp, MO_64, TCG_COND_LT)
-TRANS(vslti_b, do_vslti_s, MO_8)
-TRANS(vslti_h, do_vslti_s, MO_16)
-TRANS(vslti_w, do_vslti_s, MO_32)
-TRANS(vslti_d, do_vslti_s, MO_64)
-TRANS(vslt_bu, do_cmp, MO_8, TCG_COND_LTU)
-TRANS(vslt_hu, do_cmp, MO_16, TCG_COND_LTU)
-TRANS(vslt_wu, do_cmp, MO_32, TCG_COND_LTU)
-TRANS(vslt_du, do_cmp, MO_64, TCG_COND_LTU)
-TRANS(vslti_bu, do_vslti_u, MO_8)
-TRANS(vslti_hu, do_vslti_u, MO_16)
-TRANS(vslti_wu, do_vslti_u, MO_32)
-TRANS(vslti_du, do_vslti_u, MO_64)
+TRANS(vslt_b, ALL, do_cmp, MO_8, TCG_COND_LT)
+TRANS(vslt_h, ALL, do_cmp, MO_16, TCG_COND_LT)
+TRANS(vslt_w, ALL, do_cmp, MO_32, TCG_COND_LT)
+TRANS(vslt_d, ALL, do_cmp, MO_64, TCG_COND_LT)
+TRANS(vslti_b, ALL, do_vslti_s, MO_8)
+TRANS(vslti_h, ALL, do_vslti_s, MO_16)
+TRANS(vslti_w, ALL, do_vslti_s, MO_32)
+TRANS(vslti_d, ALL, do_vslti_s, MO_64)
+TRANS(vslt_bu, ALL, do_cmp, MO_8, TCG_COND_LTU)
+TRANS(vslt_hu, ALL, do_cmp, MO_16, TCG_COND_LTU)
+TRANS(vslt_wu, ALL, do_cmp, MO_32, TCG_COND_LTU)
+TRANS(vslt_du, ALL, do_cmp, MO_64, TCG_COND_LTU)
+TRANS(vslti_bu, ALL, do_vslti_u, MO_8)
+TRANS(vslti_hu, ALL, do_vslti_u, MO_16)
+TRANS(vslti_wu, ALL, do_vslti_u, MO_32)
+TRANS(vslti_du, ALL, do_vslti_u, MO_64)
 
 static bool trans_vfcmp_cond_s(DisasContext *ctx, arg_vvv_fcond *a)
 {
@@ -3952,14 +3952,14 @@ static bool trans_## NAME (DisasContext *ctx, arg_cv *a)                       \
 VSET(vseteqz_v, TCG_COND_EQ)
 VSET(vsetnez_v, TCG_COND_NE)
 
-TRANS(vsetanyeqz_b, gen_cv, gen_helper_vsetanyeqz_b)
-TRANS(vsetanyeqz_h, gen_cv, gen_helper_vsetanyeqz_h)
-TRANS(vsetanyeqz_w, gen_cv, gen_helper_vsetanyeqz_w)
-TRANS(vsetanyeqz_d, gen_cv, gen_helper_vsetanyeqz_d)
-TRANS(vsetallnez_b, gen_cv, gen_helper_vsetallnez_b)
-TRANS(vsetallnez_h, gen_cv, gen_helper_vsetallnez_h)
-TRANS(vsetallnez_w, gen_cv, gen_helper_vsetallnez_w)
-TRANS(vsetallnez_d, gen_cv, gen_helper_vsetallnez_d)
+TRANS(vsetanyeqz_b, ALL, gen_cv, gen_helper_vsetanyeqz_b)
+TRANS(vsetanyeqz_h, ALL, gen_cv, gen_helper_vsetanyeqz_h)
+TRANS(vsetanyeqz_w, ALL, gen_cv, gen_helper_vsetanyeqz_w)
+TRANS(vsetanyeqz_d, ALL, gen_cv, gen_helper_vsetanyeqz_d)
+TRANS(vsetallnez_b, ALL, gen_cv, gen_helper_vsetallnez_b)
+TRANS(vsetallnez_h, ALL, gen_cv, gen_helper_vsetallnez_h)
+TRANS(vsetallnez_w, ALL, gen_cv, gen_helper_vsetallnez_w)
+TRANS(vsetallnez_d, ALL, gen_cv, gen_helper_vsetallnez_d)
 
 static bool trans_vinsgr2vr_b(DisasContext *ctx, arg_vr_i *a)
 {
@@ -4079,10 +4079,10 @@ static bool gvec_dup(DisasContext *ctx, arg_vr *a, MemOp mop)
     return true;
 }
 
-TRANS(vreplgr2vr_b, gvec_dup, MO_8)
-TRANS(vreplgr2vr_h, gvec_dup, MO_16)
-TRANS(vreplgr2vr_w, gvec_dup, MO_32)
-TRANS(vreplgr2vr_d, gvec_dup, MO_64)
+TRANS(vreplgr2vr_b, ALL, gvec_dup, MO_8)
+TRANS(vreplgr2vr_h, ALL, gvec_dup, MO_16)
+TRANS(vreplgr2vr_w, ALL, gvec_dup, MO_32)
+TRANS(vreplgr2vr_d, ALL, gvec_dup, MO_64)
 
 static bool trans_vreplvei_b(DisasContext *ctx, arg_vv_i *a)
 {
@@ -4145,10 +4145,10 @@ static bool gen_vreplve(DisasContext *ctx, arg_vvr *a, int vece, int bit,
     return true;
 }
 
-TRANS(vreplve_b, gen_vreplve, MO_8,  8, tcg_gen_ld8u_i64)
-TRANS(vreplve_h, gen_vreplve, MO_16, 16, tcg_gen_ld16u_i64)
-TRANS(vreplve_w, gen_vreplve, MO_32, 32, tcg_gen_ld32u_i64)
-TRANS(vreplve_d, gen_vreplve, MO_64, 64, tcg_gen_ld_i64)
+TRANS(vreplve_b, ALL, gen_vreplve, MO_8,  8, tcg_gen_ld8u_i64)
+TRANS(vreplve_h, ALL, gen_vreplve, MO_16, 16, tcg_gen_ld16u_i64)
+TRANS(vreplve_w, ALL, gen_vreplve, MO_32, 32, tcg_gen_ld32u_i64)
+TRANS(vreplve_d, ALL, gen_vreplve, MO_64, 64, tcg_gen_ld_i64)
 
 static bool trans_vbsll_v(DisasContext *ctx, arg_vv_i *a)
 {
@@ -4210,48 +4210,48 @@ static bool trans_vbsrl_v(DisasContext *ctx, arg_vv_i *a)
     return true;
 }
 
-TRANS(vpackev_b, gen_vvv, gen_helper_vpackev_b)
-TRANS(vpackev_h, gen_vvv, gen_helper_vpackev_h)
-TRANS(vpackev_w, gen_vvv, gen_helper_vpackev_w)
-TRANS(vpackev_d, gen_vvv, gen_helper_vpackev_d)
-TRANS(vpackod_b, gen_vvv, gen_helper_vpackod_b)
-TRANS(vpackod_h, gen_vvv, gen_helper_vpackod_h)
-TRANS(vpackod_w, gen_vvv, gen_helper_vpackod_w)
-TRANS(vpackod_d, gen_vvv, gen_helper_vpackod_d)
+TRANS(vpackev_b, ALL, gen_vvv, gen_helper_vpackev_b)
+TRANS(vpackev_h, ALL, gen_vvv, gen_helper_vpackev_h)
+TRANS(vpackev_w, ALL, gen_vvv, gen_helper_vpackev_w)
+TRANS(vpackev_d, ALL, gen_vvv, gen_helper_vpackev_d)
+TRANS(vpackod_b, ALL, gen_vvv, gen_helper_vpackod_b)
+TRANS(vpackod_h, ALL, gen_vvv, gen_helper_vpackod_h)
+TRANS(vpackod_w, ALL, gen_vvv, gen_helper_vpackod_w)
+TRANS(vpackod_d, ALL, gen_vvv, gen_helper_vpackod_d)
 
-TRANS(vpickev_b, gen_vvv, gen_helper_vpickev_b)
-TRANS(vpickev_h, gen_vvv, gen_helper_vpickev_h)
-TRANS(vpickev_w, gen_vvv, gen_helper_vpickev_w)
-TRANS(vpickev_d, gen_vvv, gen_helper_vpickev_d)
-TRANS(vpickod_b, gen_vvv, gen_helper_vpickod_b)
-TRANS(vpickod_h, gen_vvv, gen_helper_vpickod_h)
-TRANS(vpickod_w, gen_vvv, gen_helper_vpickod_w)
-TRANS(vpickod_d, gen_vvv, gen_helper_vpickod_d)
+TRANS(vpickev_b, ALL, gen_vvv, gen_helper_vpickev_b)
+TRANS(vpickev_h, ALL, gen_vvv, gen_helper_vpickev_h)
+TRANS(vpickev_w, ALL, gen_vvv, gen_helper_vpickev_w)
+TRANS(vpickev_d, ALL, gen_vvv, gen_helper_vpickev_d)
+TRANS(vpickod_b, ALL, gen_vvv, gen_helper_vpickod_b)
+TRANS(vpickod_h, ALL, gen_vvv, gen_helper_vpickod_h)
+TRANS(vpickod_w, ALL, gen_vvv, gen_helper_vpickod_w)
+TRANS(vpickod_d, ALL, gen_vvv, gen_helper_vpickod_d)
 
-TRANS(vilvl_b, gen_vvv, gen_helper_vilvl_b)
-TRANS(vilvl_h, gen_vvv, gen_helper_vilvl_h)
-TRANS(vilvl_w, gen_vvv, gen_helper_vilvl_w)
-TRANS(vilvl_d, gen_vvv, gen_helper_vilvl_d)
-TRANS(vilvh_b, gen_vvv, gen_helper_vilvh_b)
-TRANS(vilvh_h, gen_vvv, gen_helper_vilvh_h)
-TRANS(vilvh_w, gen_vvv, gen_helper_vilvh_w)
-TRANS(vilvh_d, gen_vvv, gen_helper_vilvh_d)
+TRANS(vilvl_b, ALL, gen_vvv, gen_helper_vilvl_b)
+TRANS(vilvl_h, ALL, gen_vvv, gen_helper_vilvl_h)
+TRANS(vilvl_w, ALL, gen_vvv, gen_helper_vilvl_w)
+TRANS(vilvl_d, ALL, gen_vvv, gen_helper_vilvl_d)
+TRANS(vilvh_b, ALL, gen_vvv, gen_helper_vilvh_b)
+TRANS(vilvh_h, ALL, gen_vvv, gen_helper_vilvh_h)
+TRANS(vilvh_w, ALL, gen_vvv, gen_helper_vilvh_w)
+TRANS(vilvh_d, ALL, gen_vvv, gen_helper_vilvh_d)
 
-TRANS(vshuf_b, gen_vvvv, gen_helper_vshuf_b)
-TRANS(vshuf_h, gen_vvv, gen_helper_vshuf_h)
-TRANS(vshuf_w, gen_vvv, gen_helper_vshuf_w)
-TRANS(vshuf_d, gen_vvv, gen_helper_vshuf_d)
-TRANS(vshuf4i_b, gen_vv_i, gen_helper_vshuf4i_b)
-TRANS(vshuf4i_h, gen_vv_i, gen_helper_vshuf4i_h)
-TRANS(vshuf4i_w, gen_vv_i, gen_helper_vshuf4i_w)
-TRANS(vshuf4i_d, gen_vv_i, gen_helper_vshuf4i_d)
+TRANS(vshuf_b, ALL, gen_vvvv, gen_helper_vshuf_b)
+TRANS(vshuf_h, ALL, gen_vvv, gen_helper_vshuf_h)
+TRANS(vshuf_w, ALL, gen_vvv, gen_helper_vshuf_w)
+TRANS(vshuf_d, ALL, gen_vvv, gen_helper_vshuf_d)
+TRANS(vshuf4i_b, ALL, gen_vv_i, gen_helper_vshuf4i_b)
+TRANS(vshuf4i_h, ALL, gen_vv_i, gen_helper_vshuf4i_h)
+TRANS(vshuf4i_w, ALL, gen_vv_i, gen_helper_vshuf4i_w)
+TRANS(vshuf4i_d, ALL, gen_vv_i, gen_helper_vshuf4i_d)
 
-TRANS(vpermi_w, gen_vv_i, gen_helper_vpermi_w)
+TRANS(vpermi_w, ALL, gen_vv_i, gen_helper_vpermi_w)
 
-TRANS(vextrins_b, gen_vv_i, gen_helper_vextrins_b)
-TRANS(vextrins_h, gen_vv_i, gen_helper_vextrins_h)
-TRANS(vextrins_w, gen_vv_i, gen_helper_vextrins_w)
-TRANS(vextrins_d, gen_vv_i, gen_helper_vextrins_d)
+TRANS(vextrins_b, ALL, gen_vv_i, gen_helper_vextrins_b)
+TRANS(vextrins_h, ALL, gen_vv_i, gen_helper_vextrins_h)
+TRANS(vextrins_w, ALL, gen_vv_i, gen_helper_vextrins_w)
+TRANS(vextrins_d, ALL, gen_vv_i, gen_helper_vextrins_d)
 
 static bool trans_vld(DisasContext *ctx, arg_vr_i *a)
 {
diff --git a/target/loongarch/insn_trans/trans_memory.c.inc b/target/loongarch/insn_trans/trans_memory.c.inc
index 88953f0ab0..ad6a4b006d 100644
--- a/target/loongarch/insn_trans/trans_memory.c.inc
+++ b/target/loongarch/insn_trans/trans_memory.c.inc
@@ -145,45 +145,45 @@ static bool gen_stptr(DisasContext *ctx, arg_rr_i *a, MemOp mop)
     return true;
 }
 
-TRANS(ld_b, gen_load, MO_SB)
-TRANS(ld_h, gen_load, MO_TESW)
-TRANS(ld_w, gen_load, MO_TESL)
-TRANS(ld_d, gen_load, MO_TEUQ)
-TRANS(st_b, gen_store, MO_UB)
-TRANS(st_h, gen_store, MO_TEUW)
-TRANS(st_w, gen_store, MO_TEUL)
-TRANS(st_d, gen_store, MO_TEUQ)
-TRANS(ld_bu, gen_load, MO_UB)
-TRANS(ld_hu, gen_load, MO_TEUW)
-TRANS(ld_wu, gen_load, MO_TEUL)
-TRANS(ldx_b, gen_loadx, MO_SB)
-TRANS(ldx_h, gen_loadx, MO_TESW)
-TRANS(ldx_w, gen_loadx, MO_TESL)
-TRANS(ldx_d, gen_loadx, MO_TEUQ)
-TRANS(stx_b, gen_storex, MO_UB)
-TRANS(stx_h, gen_storex, MO_TEUW)
-TRANS(stx_w, gen_storex, MO_TEUL)
-TRANS(stx_d, gen_storex, MO_TEUQ)
-TRANS(ldx_bu, gen_loadx, MO_UB)
-TRANS(ldx_hu, gen_loadx, MO_TEUW)
-TRANS(ldx_wu, gen_loadx, MO_TEUL)
-TRANS(ldptr_w, gen_ldptr, MO_TESL)
-TRANS(stptr_w, gen_stptr, MO_TEUL)
-TRANS(ldptr_d, gen_ldptr, MO_TEUQ)
-TRANS(stptr_d, gen_stptr, MO_TEUQ)
-TRANS(ldgt_b, gen_load_gt, MO_SB)
-TRANS(ldgt_h, gen_load_gt, MO_TESW)
-TRANS(ldgt_w, gen_load_gt, MO_TESL)
-TRANS(ldgt_d, gen_load_gt, MO_TEUQ)
-TRANS(ldle_b, gen_load_le, MO_SB)
-TRANS(ldle_h, gen_load_le, MO_TESW)
-TRANS(ldle_w, gen_load_le, MO_TESL)
-TRANS(ldle_d, gen_load_le, MO_TEUQ)
-TRANS(stgt_b, gen_store_gt, MO_UB)
-TRANS(stgt_h, gen_store_gt, MO_TEUW)
-TRANS(stgt_w, gen_store_gt, MO_TEUL)
-TRANS(stgt_d, gen_store_gt, MO_TEUQ)
-TRANS(stle_b, gen_store_le, MO_UB)
-TRANS(stle_h, gen_store_le, MO_TEUW)
-TRANS(stle_w, gen_store_le, MO_TEUL)
-TRANS(stle_d, gen_store_le, MO_TEUQ)
+TRANS(ld_b, ALL, gen_load, MO_SB)
+TRANS(ld_h, ALL, gen_load, MO_TESW)
+TRANS(ld_w, ALL, gen_load, MO_TESL)
+TRANS(ld_d, ALL, gen_load, MO_TEUQ)
+TRANS(st_b, ALL, gen_store, MO_UB)
+TRANS(st_h, ALL, gen_store, MO_TEUW)
+TRANS(st_w, ALL, gen_store, MO_TEUL)
+TRANS(st_d, ALL, gen_store, MO_TEUQ)
+TRANS(ld_bu, ALL, gen_load, MO_UB)
+TRANS(ld_hu, ALL, gen_load, MO_TEUW)
+TRANS(ld_wu, ALL, gen_load, MO_TEUL)
+TRANS(ldx_b, ALL, gen_loadx, MO_SB)
+TRANS(ldx_h, ALL, gen_loadx, MO_TESW)
+TRANS(ldx_w, ALL, gen_loadx, MO_TESL)
+TRANS(ldx_d, ALL, gen_loadx, MO_TEUQ)
+TRANS(stx_b, ALL, gen_storex, MO_UB)
+TRANS(stx_h, ALL, gen_storex, MO_TEUW)
+TRANS(stx_w, ALL, gen_storex, MO_TEUL)
+TRANS(stx_d, ALL, gen_storex, MO_TEUQ)
+TRANS(ldx_bu, ALL, gen_loadx, MO_UB)
+TRANS(ldx_hu, ALL, gen_loadx, MO_TEUW)
+TRANS(ldx_wu, ALL, gen_loadx, MO_TEUL)
+TRANS(ldptr_w, ALL, gen_ldptr, MO_TESL)
+TRANS(stptr_w, ALL, gen_stptr, MO_TEUL)
+TRANS(ldptr_d, ALL, gen_ldptr, MO_TEUQ)
+TRANS(stptr_d, ALL, gen_stptr, MO_TEUQ)
+TRANS(ldgt_b, ALL, gen_load_gt, MO_SB)
+TRANS(ldgt_h, ALL, gen_load_gt, MO_TESW)
+TRANS(ldgt_w, ALL, gen_load_gt, MO_TESL)
+TRANS(ldgt_d, ALL, gen_load_gt, MO_TEUQ)
+TRANS(ldle_b, ALL, gen_load_le, MO_SB)
+TRANS(ldle_h, ALL, gen_load_le, MO_TESW)
+TRANS(ldle_w, ALL, gen_load_le, MO_TESL)
+TRANS(ldle_d, ALL, gen_load_le, MO_TEUQ)
+TRANS(stgt_b, ALL, gen_store_gt, MO_UB)
+TRANS(stgt_h, ALL, gen_store_gt, MO_TEUW)
+TRANS(stgt_w, ALL, gen_store_gt, MO_TEUL)
+TRANS(stgt_d, ALL, gen_store_gt, MO_TEUQ)
+TRANS(stle_b, ALL, gen_store_le, MO_UB)
+TRANS(stle_h, ALL, gen_store_le, MO_TEUW)
+TRANS(stle_w, ALL, gen_store_le, MO_TEUL)
+TRANS(stle_d, ALL, gen_store_le, MO_TEUQ)
diff --git a/target/loongarch/insn_trans/trans_privileged.c.inc b/target/loongarch/insn_trans/trans_privileged.c.inc
index 9c9de090f0..684ff547a7 100644
--- a/target/loongarch/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/insn_trans/trans_privileged.c.inc
@@ -312,14 +312,14 @@ static bool gen_iocsrwr(DisasContext *ctx, arg_rr *a,
     return true;
 }
 
-TRANS(iocsrrd_b, gen_iocsrrd, gen_helper_iocsrrd_b)
-TRANS(iocsrrd_h, gen_iocsrrd, gen_helper_iocsrrd_h)
-TRANS(iocsrrd_w, gen_iocsrrd, gen_helper_iocsrrd_w)
-TRANS(iocsrrd_d, gen_iocsrrd, gen_helper_iocsrrd_d)
-TRANS(iocsrwr_b, gen_iocsrwr, gen_helper_iocsrwr_b)
-TRANS(iocsrwr_h, gen_iocsrwr, gen_helper_iocsrwr_h)
-TRANS(iocsrwr_w, gen_iocsrwr, gen_helper_iocsrwr_w)
-TRANS(iocsrwr_d, gen_iocsrwr, gen_helper_iocsrwr_d)
+TRANS(iocsrrd_b, ALL, gen_iocsrrd, gen_helper_iocsrrd_b)
+TRANS(iocsrrd_h, ALL, gen_iocsrrd, gen_helper_iocsrrd_h)
+TRANS(iocsrrd_w, ALL, gen_iocsrrd, gen_helper_iocsrrd_w)
+TRANS(iocsrrd_d, ALL, gen_iocsrrd, gen_helper_iocsrrd_d)
+TRANS(iocsrwr_b, ALL, gen_iocsrwr, gen_helper_iocsrwr_b)
+TRANS(iocsrwr_h, ALL, gen_iocsrwr, gen_helper_iocsrwr_h)
+TRANS(iocsrwr_w, ALL, gen_iocsrwr, gen_helper_iocsrwr_w)
+TRANS(iocsrwr_d, ALL, gen_iocsrwr, gen_helper_iocsrwr_d)
 
 static void check_mmu_idx(DisasContext *ctx)
 {
diff --git a/target/loongarch/insn_trans/trans_shift.c.inc b/target/loongarch/insn_trans/trans_shift.c.inc
index bf5428a2ba..849759b94b 100644
--- a/target/loongarch/insn_trans/trans_shift.c.inc
+++ b/target/loongarch/insn_trans/trans_shift.c.inc
@@ -78,18 +78,18 @@ static bool trans_srai_w(DisasContext *ctx, arg_srai_w *a)
     return true;
 }
 
-TRANS(sll_w, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_sll_w)
-TRANS(srl_w, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_srl_w)
-TRANS(sra_w, gen_rrr, EXT_SIGN, EXT_NONE, EXT_SIGN, gen_sra_w)
-TRANS(sll_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sll_d)
-TRANS(srl_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_srl_d)
-TRANS(sra_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sra_d)
-TRANS(rotr_w, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_rotr_w)
-TRANS(rotr_d, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rotr_d)
-TRANS(slli_w, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_shli_tl)
-TRANS(slli_d, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shli_tl)
-TRANS(srli_w, gen_rri_c, EXT_ZERO, EXT_SIGN, tcg_gen_shri_tl)
-TRANS(srli_d, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shri_tl)
-TRANS(srai_d, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_sari_tl)
-TRANS(rotri_w, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)
-TRANS(rotri_d, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_rotri_tl)
+TRANS(sll_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_sll_w)
+TRANS(srl_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_srl_w)
+TRANS(sra_w, ALL, gen_rrr, EXT_SIGN, EXT_NONE, EXT_SIGN, gen_sra_w)
+TRANS(sll_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sll_d)
+TRANS(srl_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_srl_d)
+TRANS(sra_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sra_d)
+TRANS(rotr_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_rotr_w)
+TRANS(rotr_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rotr_d)
+TRANS(slli_w, ALL, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_shli_tl)
+TRANS(slli_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shli_tl)
+TRANS(srli_w, ALL, gen_rri_c, EXT_ZERO, EXT_SIGN, tcg_gen_shri_tl)
+TRANS(srli_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shri_tl)
+TRANS(srai_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_sari_tl)
+TRANS(rotri_w, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)
+TRANS(rotri_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_rotri_tl)
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index b6fa5df82d..3c5c746f30 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -10,9 +10,11 @@
 
 #include "exec/translator.h"
 
-#define TRANS(NAME, FUNC, ...) \
+#define TRANS(NAME, AVAIL, FUNC, ...) \
     static bool trans_##NAME(DisasContext *ctx, arg_##NAME * a) \
-    { return FUNC(ctx, a, __VA_ARGS__); }
+    { return avail_##AVAIL(ctx) && FUNC(ctx, a, __VA_ARGS__); }
+
+#define avail_ALL(C)   true
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,

From c0c0461e3a06c8e854b8666a2610b1b619d0d1f8 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:19:52 +0200
Subject: [PATCH 1187/1353] target/loongarch: Add avail_64 to check la64-only
 instructions

The la32 instructions listed in Table 2 at
https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#overview-of-basic-integer-instructions

Co-authored-by: Jiajie Chen <c@jia.je>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-9-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-3-philmd@linaro.org>
---
 target/loongarch/insn_trans/trans_arith.c.inc | 42 ++++++----
 .../loongarch/insn_trans/trans_atomic.c.inc   | 76 +++++++++----------
 target/loongarch/insn_trans/trans_bit.c.inc   | 28 +++----
 .../loongarch/insn_trans/trans_branch.c.inc   |  4 +-
 target/loongarch/insn_trans/trans_extra.c.inc | 24 ++++--
 target/loongarch/insn_trans/trans_fmov.c.inc  |  4 +-
 .../loongarch/insn_trans/trans_memory.c.inc   | 68 ++++++++---------
 target/loongarch/insn_trans/trans_shift.c.inc | 24 +++---
 target/loongarch/translate.c                  |  2 +
 target/loongarch/translate.h                  |  3 +
 10 files changed, 152 insertions(+), 123 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_arith.c.inc b/target/loongarch/insn_trans/trans_arith.c.inc
index d7f69a7553..2be057e932 100644
--- a/target/loongarch/insn_trans/trans_arith.c.inc
+++ b/target/loongarch/insn_trans/trans_arith.c.inc
@@ -199,6 +199,10 @@ static bool trans_lu32i_d(DisasContext *ctx, arg_lu32i_d *a)
     TCGv src1 = gpr_src(ctx, a->rd, EXT_NONE);
     TCGv src2 = tcg_constant_tl(a->imm);
 
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     tcg_gen_deposit_tl(dest, src1, src2, 32, 32);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -211,6 +215,10 @@ static bool trans_lu52i_d(DisasContext *ctx, arg_lu52i_d *a)
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = tcg_constant_tl(a->imm);
 
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     tcg_gen_deposit_tl(dest, src1, src2, 52, 12);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -242,6 +250,10 @@ static bool trans_addu16i_d(DisasContext *ctx, arg_addu16i_d *a)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
 
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     tcg_gen_addi_tl(dest, src1, a->imm << 16);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -249,9 +261,9 @@ static bool trans_addu16i_d(DisasContext *ctx, arg_addu16i_d *a)
 }
 
 TRANS(add_w, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_SIGN, tcg_gen_add_tl)
-TRANS(add_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_add_tl)
+TRANS(add_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_add_tl)
 TRANS(sub_w, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_SIGN, tcg_gen_sub_tl)
-TRANS(sub_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_sub_tl)
+TRANS(sub_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_sub_tl)
 TRANS(and, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_and_tl)
 TRANS(or, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_or_tl)
 TRANS(xor, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_xor_tl)
@@ -261,32 +273,32 @@ TRANS(orn, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_orc_tl)
 TRANS(slt, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_slt)
 TRANS(sltu, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sltu)
 TRANS(mul_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, tcg_gen_mul_tl)
-TRANS(mul_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_mul_tl)
+TRANS(mul_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, tcg_gen_mul_tl)
 TRANS(mulh_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, gen_mulh_w)
 TRANS(mulh_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, gen_mulh_w)
-TRANS(mulh_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_d)
-TRANS(mulh_du, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_du)
-TRANS(mulw_d_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, tcg_gen_mul_tl)
-TRANS(mulw_d_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, tcg_gen_mul_tl)
+TRANS(mulh_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_d)
+TRANS(mulh_du, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_mulh_du)
+TRANS(mulw_d_w, 64, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_NONE, tcg_gen_mul_tl)
+TRANS(mulw_d_wu, 64, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_NONE, tcg_gen_mul_tl)
 TRANS(div_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, gen_div_w)
 TRANS(mod_w, ALL, gen_rrr, EXT_SIGN, EXT_SIGN, EXT_SIGN, gen_rem_w)
 TRANS(div_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_SIGN, gen_div_du)
 TRANS(mod_wu, ALL, gen_rrr, EXT_ZERO, EXT_ZERO, EXT_SIGN, gen_rem_du)
-TRANS(div_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_d)
-TRANS(mod_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_d)
-TRANS(div_du, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_du)
-TRANS(mod_du, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_du)
+TRANS(div_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_d)
+TRANS(mod_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_d)
+TRANS(div_du, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_div_du)
+TRANS(mod_du, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rem_du)
 TRANS(slti, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_slt)
 TRANS(sltui, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_sltu)
 TRANS(addi_w, ALL, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_addi_tl)
-TRANS(addi_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_addi_tl)
+TRANS(addi_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_addi_tl)
 TRANS(alsl_w, ALL, gen_rrr_sa, EXT_NONE, EXT_SIGN, gen_alsl)
-TRANS(alsl_wu, ALL, gen_rrr_sa, EXT_NONE, EXT_ZERO, gen_alsl)
-TRANS(alsl_d, ALL, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_alsl)
+TRANS(alsl_wu, 64, gen_rrr_sa, EXT_NONE, EXT_ZERO, gen_alsl)
+TRANS(alsl_d, 64, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_alsl)
 TRANS(pcaddi, ALL, gen_pc, gen_pcaddi)
 TRANS(pcalau12i, ALL, gen_pc, gen_pcalau12i)
 TRANS(pcaddu12i, ALL, gen_pc, gen_pcaddu12i)
-TRANS(pcaddu18i, ALL, gen_pc, gen_pcaddu18i)
+TRANS(pcaddu18i, 64, gen_pc, gen_pcaddu18i)
 TRANS(andi, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_andi_tl)
 TRANS(ori, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_ori_tl)
 TRANS(xori, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_xori_tl)
diff --git a/target/loongarch/insn_trans/trans_atomic.c.inc b/target/loongarch/insn_trans/trans_atomic.c.inc
index 0a02f0dbf3..194818d74d 100644
--- a/target/loongarch/insn_trans/trans_atomic.c.inc
+++ b/target/loongarch/insn_trans/trans_atomic.c.inc
@@ -71,41 +71,41 @@ static bool gen_am(DisasContext *ctx, arg_rrr *a,
 
 TRANS(ll_w, ALL, gen_ll, MO_TESL)
 TRANS(sc_w, ALL, gen_sc, MO_TESL)
-TRANS(ll_d, ALL, gen_ll, MO_TEUQ)
-TRANS(sc_d, ALL, gen_sc, MO_TEUQ)
-TRANS(amswap_w, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_d, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
-TRANS(amadd_w, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_d, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
-TRANS(amand_w, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_d, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
-TRANS(amor_w, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_d, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
-TRANS(amxor_w, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_d, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
-TRANS(ammax_w, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_d, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
-TRANS(ammin_w, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_d, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
-TRANS(ammax_wu, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_du, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
-TRANS(ammin_wu, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_du, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
-TRANS(amswap_db_w, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_db_d, ALL, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
-TRANS(amadd_db_w, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_db_d, ALL, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
-TRANS(amand_db_w, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_db_d, ALL, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
-TRANS(amor_db_w, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_db_d, ALL, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
-TRANS(amxor_db_w, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_db_d, ALL, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
-TRANS(ammax_db_w, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_db_d, ALL, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
-TRANS(ammin_db_w, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_db_d, ALL, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
-TRANS(ammax_db_wu, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_db_du, ALL, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
-TRANS(ammin_db_wu, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_db_du, ALL, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS(ll_d, 64, gen_ll, MO_TEUQ)
+TRANS(sc_d, 64, gen_sc, MO_TEUQ)
+TRANS(amswap_w, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
+TRANS(amswap_d, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS(amadd_w, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
+TRANS(amadd_d, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS(amand_w, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
+TRANS(amand_d, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS(amor_w, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
+TRANS(amor_d, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS(amxor_w, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
+TRANS(amxor_d, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS(ammax_w, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
+TRANS(ammax_d, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS(ammin_w, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
+TRANS(ammin_d, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS(ammax_wu, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
+TRANS(ammax_du, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS(ammin_wu, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
+TRANS(ammin_du, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS(amswap_db_w, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
+TRANS(amswap_db_d, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS(amadd_db_w, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
+TRANS(amadd_db_d, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS(amand_db_w, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
+TRANS(amand_db_d, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS(amor_db_w, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
+TRANS(amor_db_d, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS(amxor_db_w, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
+TRANS(amxor_db_d, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS(ammax_db_w, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
+TRANS(ammax_db_d, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS(ammin_db_w, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
+TRANS(ammin_db_d, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS(ammax_db_wu, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
+TRANS(ammax_db_du, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS(ammin_db_wu, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
+TRANS(ammin_db_du, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
diff --git a/target/loongarch/insn_trans/trans_bit.c.inc b/target/loongarch/insn_trans/trans_bit.c.inc
index d2a7ac28f7..ee5fa003ce 100644
--- a/target/loongarch/insn_trans/trans_bit.c.inc
+++ b/target/loongarch/insn_trans/trans_bit.c.inc
@@ -184,25 +184,25 @@ TRANS(clo_w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_clo_w)
 TRANS(clz_w, ALL, gen_rr, EXT_ZERO, EXT_NONE, gen_clz_w)
 TRANS(cto_w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_cto_w)
 TRANS(ctz_w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_w)
-TRANS(clo_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_clo_d)
-TRANS(clz_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_clz_d)
-TRANS(cto_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_cto_d)
-TRANS(ctz_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_d)
+TRANS(clo_d, 64, gen_rr, EXT_NONE, EXT_NONE, gen_clo_d)
+TRANS(clz_d, 64, gen_rr, EXT_NONE, EXT_NONE, gen_clz_d)
+TRANS(cto_d, 64, gen_rr, EXT_NONE, EXT_NONE, gen_cto_d)
+TRANS(ctz_d, 64, gen_rr, EXT_NONE, EXT_NONE, gen_ctz_d)
 TRANS(revb_2h, ALL, gen_rr, EXT_NONE, EXT_SIGN, gen_revb_2h)
-TRANS(revb_4h, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revb_4h)
-TRANS(revb_2w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revb_2w)
-TRANS(revb_d, ALL, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_bswap64_i64)
-TRANS(revh_2w, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revh_2w)
-TRANS(revh_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_revh_d)
+TRANS(revb_4h, 64, gen_rr, EXT_NONE, EXT_NONE, gen_revb_4h)
+TRANS(revb_2w, 64, gen_rr, EXT_NONE, EXT_NONE, gen_revb_2w)
+TRANS(revb_d, 64, gen_rr, EXT_NONE, EXT_NONE, tcg_gen_bswap64_i64)
+TRANS(revh_2w, 64, gen_rr, EXT_NONE, EXT_NONE, gen_revh_2w)
+TRANS(revh_d, 64, gen_rr, EXT_NONE, EXT_NONE, gen_revh_d)
 TRANS(bitrev_4b, ALL, gen_rr, EXT_ZERO, EXT_SIGN, gen_helper_bitswap)
-TRANS(bitrev_8b, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitswap)
+TRANS(bitrev_8b, 64, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitswap)
 TRANS(bitrev_w, ALL, gen_rr, EXT_NONE, EXT_SIGN, gen_helper_bitrev_w)
-TRANS(bitrev_d, ALL, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitrev_d)
+TRANS(bitrev_d, 64, gen_rr, EXT_NONE, EXT_NONE, gen_helper_bitrev_d)
 TRANS(maskeqz, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_maskeqz)
 TRANS(masknez, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_masknez)
 TRANS(bytepick_w, ALL, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_w)
-TRANS(bytepick_d, ALL, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_d)
+TRANS(bytepick_d, 64, gen_rrr_sa, EXT_NONE, EXT_NONE, gen_bytepick_d)
 TRANS(bstrins_w, ALL, gen_bstrins, EXT_SIGN)
-TRANS(bstrins_d, ALL, gen_bstrins, EXT_NONE)
+TRANS(bstrins_d, 64, gen_bstrins, EXT_NONE)
 TRANS(bstrpick_w, ALL, gen_bstrpick, EXT_SIGN)
-TRANS(bstrpick_d, ALL, gen_bstrpick, EXT_NONE)
+TRANS(bstrpick_d, 64, gen_bstrpick, EXT_NONE)
diff --git a/target/loongarch/insn_trans/trans_branch.c.inc b/target/loongarch/insn_trans/trans_branch.c.inc
index 50f7eb640a..a4fd2092e5 100644
--- a/target/loongarch/insn_trans/trans_branch.c.inc
+++ b/target/loongarch/insn_trans/trans_branch.c.inc
@@ -80,5 +80,5 @@ TRANS(bltu, ALL, gen_rr_bc, TCG_COND_LTU)
 TRANS(bgeu, ALL, gen_rr_bc, TCG_COND_GEU)
 TRANS(beqz, ALL, gen_rz_bc, TCG_COND_EQ)
 TRANS(bnez, ALL, gen_rz_bc, TCG_COND_NE)
-TRANS(bceqz, ALL, gen_cz_bc, TCG_COND_EQ)
-TRANS(bcnez, ALL, gen_cz_bc, TCG_COND_NE)
+TRANS(bceqz, 64, gen_cz_bc, TCG_COND_EQ)
+TRANS(bcnez, 64, gen_cz_bc, TCG_COND_NE)
diff --git a/target/loongarch/insn_trans/trans_extra.c.inc b/target/loongarch/insn_trans/trans_extra.c.inc
index b354ca0f86..dd5d02e88c 100644
--- a/target/loongarch/insn_trans/trans_extra.c.inc
+++ b/target/loongarch/insn_trans/trans_extra.c.inc
@@ -20,6 +20,10 @@ static bool trans_asrtle_d(DisasContext *ctx, arg_asrtle_d * a)
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     gen_helper_asrtle_d(cpu_env, src1, src2);
     return true;
 }
@@ -29,6 +33,10 @@ static bool trans_asrtgt_d(DisasContext *ctx, arg_asrtgt_d * a)
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv src2 = gpr_src(ctx, a->rk, EXT_NONE);
 
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     gen_helper_asrtgt_d(cpu_env, src1, src2);
     return true;
 }
@@ -89,11 +97,11 @@ static bool gen_crc(DisasContext *ctx, arg_rrr *a,
     return true;
 }
 
-TRANS(crc_w_b_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
-TRANS(crc_w_h_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
-TRANS(crc_w_w_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
-TRANS(crc_w_d_w, ALL, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
-TRANS(crcc_w_b_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
-TRANS(crcc_w_h_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
-TRANS(crcc_w_w_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
-TRANS(crcc_w_d_w, ALL, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
+TRANS(crc_w_b_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
+TRANS(crc_w_h_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
+TRANS(crc_w_w_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
+TRANS(crc_w_d_w, 64, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
+TRANS(crcc_w_b_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
+TRANS(crcc_w_h_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
+TRANS(crcc_w_w_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
+TRANS(crcc_w_d_w, 64, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
diff --git a/target/loongarch/insn_trans/trans_fmov.c.inc b/target/loongarch/insn_trans/trans_fmov.c.inc
index aa7fea67b5..385bbb7929 100644
--- a/target/loongarch/insn_trans/trans_fmov.c.inc
+++ b/target/loongarch/insn_trans/trans_fmov.c.inc
@@ -181,8 +181,8 @@ static bool trans_movcf2gr(DisasContext *ctx, arg_movcf2gr *a)
 TRANS(fmov_s, ALL, gen_f2f, tcg_gen_mov_tl, true)
 TRANS(fmov_d, ALL, gen_f2f, tcg_gen_mov_tl, false)
 TRANS(movgr2fr_w, ALL, gen_r2f, gen_movgr2fr_w)
-TRANS(movgr2fr_d, ALL, gen_r2f, tcg_gen_mov_tl)
+TRANS(movgr2fr_d, 64, gen_r2f, tcg_gen_mov_tl)
 TRANS(movgr2frh_w, ALL, gen_r2f, gen_movgr2frh_w)
 TRANS(movfr2gr_s, ALL, gen_f2r, tcg_gen_ext32s_tl)
-TRANS(movfr2gr_d, ALL, gen_f2r, tcg_gen_mov_tl)
+TRANS(movfr2gr_d, 64, gen_f2r, tcg_gen_mov_tl)
 TRANS(movfrh2gr_s, ALL, gen_f2r, gen_movfrh2gr_s)
diff --git a/target/loongarch/insn_trans/trans_memory.c.inc b/target/loongarch/insn_trans/trans_memory.c.inc
index ad6a4b006d..d9d062235a 100644
--- a/target/loongarch/insn_trans/trans_memory.c.inc
+++ b/target/loongarch/insn_trans/trans_memory.c.inc
@@ -148,42 +148,42 @@ static bool gen_stptr(DisasContext *ctx, arg_rr_i *a, MemOp mop)
 TRANS(ld_b, ALL, gen_load, MO_SB)
 TRANS(ld_h, ALL, gen_load, MO_TESW)
 TRANS(ld_w, ALL, gen_load, MO_TESL)
-TRANS(ld_d, ALL, gen_load, MO_TEUQ)
+TRANS(ld_d, 64, gen_load, MO_TEUQ)
 TRANS(st_b, ALL, gen_store, MO_UB)
 TRANS(st_h, ALL, gen_store, MO_TEUW)
 TRANS(st_w, ALL, gen_store, MO_TEUL)
-TRANS(st_d, ALL, gen_store, MO_TEUQ)
+TRANS(st_d, 64, gen_store, MO_TEUQ)
 TRANS(ld_bu, ALL, gen_load, MO_UB)
 TRANS(ld_hu, ALL, gen_load, MO_TEUW)
-TRANS(ld_wu, ALL, gen_load, MO_TEUL)
-TRANS(ldx_b, ALL, gen_loadx, MO_SB)
-TRANS(ldx_h, ALL, gen_loadx, MO_TESW)
-TRANS(ldx_w, ALL, gen_loadx, MO_TESL)
-TRANS(ldx_d, ALL, gen_loadx, MO_TEUQ)
-TRANS(stx_b, ALL, gen_storex, MO_UB)
-TRANS(stx_h, ALL, gen_storex, MO_TEUW)
-TRANS(stx_w, ALL, gen_storex, MO_TEUL)
-TRANS(stx_d, ALL, gen_storex, MO_TEUQ)
-TRANS(ldx_bu, ALL, gen_loadx, MO_UB)
-TRANS(ldx_hu, ALL, gen_loadx, MO_TEUW)
-TRANS(ldx_wu, ALL, gen_loadx, MO_TEUL)
-TRANS(ldptr_w, ALL, gen_ldptr, MO_TESL)
-TRANS(stptr_w, ALL, gen_stptr, MO_TEUL)
-TRANS(ldptr_d, ALL, gen_ldptr, MO_TEUQ)
-TRANS(stptr_d, ALL, gen_stptr, MO_TEUQ)
-TRANS(ldgt_b, ALL, gen_load_gt, MO_SB)
-TRANS(ldgt_h, ALL, gen_load_gt, MO_TESW)
-TRANS(ldgt_w, ALL, gen_load_gt, MO_TESL)
-TRANS(ldgt_d, ALL, gen_load_gt, MO_TEUQ)
-TRANS(ldle_b, ALL, gen_load_le, MO_SB)
-TRANS(ldle_h, ALL, gen_load_le, MO_TESW)
-TRANS(ldle_w, ALL, gen_load_le, MO_TESL)
-TRANS(ldle_d, ALL, gen_load_le, MO_TEUQ)
-TRANS(stgt_b, ALL, gen_store_gt, MO_UB)
-TRANS(stgt_h, ALL, gen_store_gt, MO_TEUW)
-TRANS(stgt_w, ALL, gen_store_gt, MO_TEUL)
-TRANS(stgt_d, ALL, gen_store_gt, MO_TEUQ)
-TRANS(stle_b, ALL, gen_store_le, MO_UB)
-TRANS(stle_h, ALL, gen_store_le, MO_TEUW)
-TRANS(stle_w, ALL, gen_store_le, MO_TEUL)
-TRANS(stle_d, ALL, gen_store_le, MO_TEUQ)
+TRANS(ld_wu, 64, gen_load, MO_TEUL)
+TRANS(ldx_b, 64, gen_loadx, MO_SB)
+TRANS(ldx_h, 64, gen_loadx, MO_TESW)
+TRANS(ldx_w, 64, gen_loadx, MO_TESL)
+TRANS(ldx_d, 64, gen_loadx, MO_TEUQ)
+TRANS(stx_b, 64, gen_storex, MO_UB)
+TRANS(stx_h, 64, gen_storex, MO_TEUW)
+TRANS(stx_w, 64, gen_storex, MO_TEUL)
+TRANS(stx_d, 64, gen_storex, MO_TEUQ)
+TRANS(ldx_bu, 64, gen_loadx, MO_UB)
+TRANS(ldx_hu, 64, gen_loadx, MO_TEUW)
+TRANS(ldx_wu, 64, gen_loadx, MO_TEUL)
+TRANS(ldptr_w, 64, gen_ldptr, MO_TESL)
+TRANS(stptr_w, 64, gen_stptr, MO_TEUL)
+TRANS(ldptr_d, 64, gen_ldptr, MO_TEUQ)
+TRANS(stptr_d, 64, gen_stptr, MO_TEUQ)
+TRANS(ldgt_b, 64, gen_load_gt, MO_SB)
+TRANS(ldgt_h, 64, gen_load_gt, MO_TESW)
+TRANS(ldgt_w, 64, gen_load_gt, MO_TESL)
+TRANS(ldgt_d, 64, gen_load_gt, MO_TEUQ)
+TRANS(ldle_b, 64, gen_load_le, MO_SB)
+TRANS(ldle_h, 64, gen_load_le, MO_TESW)
+TRANS(ldle_w, 64, gen_load_le, MO_TESL)
+TRANS(ldle_d, 64, gen_load_le, MO_TEUQ)
+TRANS(stgt_b, 64, gen_store_gt, MO_UB)
+TRANS(stgt_h, 64, gen_store_gt, MO_TEUW)
+TRANS(stgt_w, 64, gen_store_gt, MO_TEUL)
+TRANS(stgt_d, 64, gen_store_gt, MO_TEUQ)
+TRANS(stle_b, 64, gen_store_le, MO_UB)
+TRANS(stle_h, 64, gen_store_le, MO_TEUW)
+TRANS(stle_w, 64, gen_store_le, MO_TEUL)
+TRANS(stle_d, 64, gen_store_le, MO_TEUQ)
diff --git a/target/loongarch/insn_trans/trans_shift.c.inc b/target/loongarch/insn_trans/trans_shift.c.inc
index 849759b94b..2f4bd6ff28 100644
--- a/target/loongarch/insn_trans/trans_shift.c.inc
+++ b/target/loongarch/insn_trans/trans_shift.c.inc
@@ -72,6 +72,10 @@ static bool trans_srai_w(DisasContext *ctx, arg_srai_w *a)
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_ZERO);
 
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     tcg_gen_sextract_tl(dest, src1, a->imm, 32 - a->imm);
     gen_set_gpr(a->rd, dest, EXT_NONE);
 
@@ -81,15 +85,15 @@ static bool trans_srai_w(DisasContext *ctx, arg_srai_w *a)
 TRANS(sll_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_sll_w)
 TRANS(srl_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_srl_w)
 TRANS(sra_w, ALL, gen_rrr, EXT_SIGN, EXT_NONE, EXT_SIGN, gen_sra_w)
-TRANS(sll_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sll_d)
-TRANS(srl_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_srl_d)
-TRANS(sra_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sra_d)
-TRANS(rotr_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_rotr_w)
-TRANS(rotr_d, ALL, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rotr_d)
+TRANS(sll_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sll_d)
+TRANS(srl_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_srl_d)
+TRANS(sra_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sra_d)
+TRANS(rotr_w, 64, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_rotr_w)
+TRANS(rotr_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rotr_d)
 TRANS(slli_w, ALL, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_shli_tl)
-TRANS(slli_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shli_tl)
+TRANS(slli_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shli_tl)
 TRANS(srli_w, ALL, gen_rri_c, EXT_ZERO, EXT_SIGN, tcg_gen_shri_tl)
-TRANS(srli_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shri_tl)
-TRANS(srai_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_sari_tl)
-TRANS(rotri_w, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)
-TRANS(rotri_d, ALL, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_rotri_tl)
+TRANS(srli_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shri_tl)
+TRANS(srai_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_sari_tl)
+TRANS(rotri_w, 64, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)
+TRANS(rotri_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_rotri_tl)
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index de7c1c5d1f..6967e12fc3 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -127,6 +127,8 @@ static void loongarch_tr_init_disas_context(DisasContextBase *dcbase,
     ctx->va32 = (ctx->base.tb->flags & HW_FLAGS_VA32) != 0;
 
     ctx->zero = tcg_constant_tl(0);
+
+    ctx->cpucfg1 = env->cpucfg[1];
 }
 
 static void loongarch_tr_tb_start(DisasContextBase *dcbase, CPUState *cs)
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index 3c5c746f30..1342446242 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -15,6 +15,8 @@
     { return avail_##AVAIL(ctx) && FUNC(ctx, a, __VA_ARGS__); }
 
 #define avail_ALL(C)   true
+#define avail_64(C)    (FIELD_EX32((C)->cpucfg1, CPUCFG1, ARCH) == \
+                        CPUCFG1_ARCH_LA64)
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,
@@ -37,6 +39,7 @@ typedef struct DisasContext {
     TCGv zero;
     bool la64; /* LoongArch64 mode */
     bool va32; /* 32-bit virtual address */
+    uint32_t cpucfg1;
 } DisasContext;
 
 void generate_exception(DisasContext *ctx, int excp);

From bb8710cf0a637c4af189675f234639ce9e90a27d Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 22 Aug 2023 09:19:53 +0200
Subject: [PATCH 1188/1353] target/loongarch: Add LoongArch32 cpu la132
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add LoongArch32 cpu la132.

Due to lack of public documentation of la132, it is currently a
synthetic LoongArch32 cpu model. Details need to be added in the future.

Signed-off-by: Jiajie Chen <c@jia.je>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-10-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-4-philmd@linaro.org>
---
 target/loongarch/cpu.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 67eb6c3135..d3c3e0d8a1 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -440,6 +440,35 @@ static void loongarch_la464_initfn(Object *obj)
     env->CSR_ASID = FIELD_DP64(0, CSR_ASID, ASIDBITS, 0xa);
 }
 
+static void loongarch_la132_initfn(Object *obj)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+    CPULoongArchState *env = &cpu->env;
+
+    int i;
+
+    for (i = 0; i < 21; i++) {
+        env->cpucfg[i] = 0x0;
+    }
+
+    cpu->dtb_compatible = "loongarch,Loongson-1C103";
+    env->cpucfg[0] = 0x148042;  /* PRID */
+
+    uint32_t data = 0;
+    data = FIELD_DP32(data, CPUCFG1, ARCH, 1); /* LA32 */
+    data = FIELD_DP32(data, CPUCFG1, PGMMU, 1);
+    data = FIELD_DP32(data, CPUCFG1, IOCSR, 1);
+    data = FIELD_DP32(data, CPUCFG1, PALEN, 0x1f); /* 32 bits */
+    data = FIELD_DP32(data, CPUCFG1, VALEN, 0x1f); /* 32 bits */
+    data = FIELD_DP32(data, CPUCFG1, UAL, 1);
+    data = FIELD_DP32(data, CPUCFG1, RI, 0);
+    data = FIELD_DP32(data, CPUCFG1, EP, 0);
+    data = FIELD_DP32(data, CPUCFG1, RPLV, 0);
+    data = FIELD_DP32(data, CPUCFG1, HP, 1);
+    data = FIELD_DP32(data, CPUCFG1, IOCSR_BRD, 1);
+    env->cpucfg[1] = data;
+}
+
 static void loongarch_cpu_list_entry(gpointer data, gpointer user_data)
 {
     const char *typename = object_class_get_name(OBJECT_CLASS(data));
@@ -787,6 +816,7 @@ static const TypeInfo loongarch_cpu_type_infos[] = {
         .class_init = loongarch64_cpu_class_init,
     },
     DEFINE_LOONGARCH_CPU_TYPE(64, "la464", loongarch_la464_initfn),
+    DEFINE_LOONGARCH_CPU_TYPE(32, "la132", loongarch_la132_initfn),
 };
 
 DEFINE_TYPES(loongarch_cpu_type_infos)

From 3055122ff6d5d96e5394f495de3d512f1d6e94cf Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:19:54 +0200
Subject: [PATCH 1189/1353] hw/loongarch: Remove restriction of la464 cores in
 the virt machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow virt machine to be used with la132 instead of la464.

Co-authored-by: Jiajie Chen <c@jia.je>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230822032724.1353391-11-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-5-philmd@linaro.org>
---
 hw/loongarch/virt.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index e19b042ce8..af15bf5aaa 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -798,11 +798,6 @@ static void loongarch_init(MachineState *machine)
         cpu_model = LOONGARCH_CPU_TYPE_NAME("la464");
     }
 
-    if (!strstr(cpu_model, "la464")) {
-        error_report("LoongArch/TCG needs cpu type la464");
-        exit(1);
-    }
-
     if (ram_size < 1 * GiB) {
         error_report("ram_size must be greater than 1G.");
         exit(1);

From 95e2ca240739fc1a917102710d79a09f055f4d79 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:19:55 +0200
Subject: [PATCH 1190/1353] target/loongarch: Add avail_FP/FP_SP/FP_DP to check
 fpu instructions

Signed-off-by: Song Gao <gaosong@loongson.cn>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-12-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-6-philmd@linaro.org>
---
 .../loongarch/insn_trans/trans_farith.c.inc   | 96 ++++++++++++-------
 target/loongarch/insn_trans/trans_fcmp.c.inc  |  8 ++
 target/loongarch/insn_trans/trans_fcnv.c.inc  | 56 +++++------
 .../loongarch/insn_trans/trans_fmemory.c.inc  | 32 +++----
 target/loongarch/insn_trans/trans_fmov.c.inc  | 48 ++++++++--
 target/loongarch/translate.c                  |  1 +
 target/loongarch/translate.h                  |  4 +
 7 files changed, 159 insertions(+), 86 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_farith.c.inc b/target/loongarch/insn_trans/trans_farith.c.inc
index b1a1dc7b01..a7ced99fd3 100644
--- a/target/loongarch/insn_trans/trans_farith.c.inc
+++ b/target/loongarch/insn_trans/trans_farith.c.inc
@@ -67,6 +67,10 @@ static bool trans_fcopysign_s(DisasContext *ctx, arg_fcopysign_s *a)
     TCGv src1 = get_fpr(ctx, a->fk);
     TCGv src2 = get_fpr(ctx, a->fj);
 
+    if (!avail_FP_SP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_deposit_i64(dest, src1, src2, 0, 31);
@@ -81,6 +85,10 @@ static bool trans_fcopysign_d(DisasContext *ctx, arg_fcopysign_d *a)
     TCGv src1 = get_fpr(ctx, a->fk);
     TCGv src2 = get_fpr(ctx, a->fj);
 
+    if (!avail_FP_DP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_deposit_i64(dest, src1, src2, 0, 63);
@@ -94,6 +102,10 @@ static bool trans_fabs_s(DisasContext *ctx, arg_fabs_s *a)
     TCGv dest = get_fpr(ctx, a->fd);
     TCGv src = get_fpr(ctx, a->fj);
 
+    if (!avail_FP_SP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_andi_i64(dest, src, MAKE_64BIT_MASK(0, 31));
@@ -108,6 +120,10 @@ static bool trans_fabs_d(DisasContext *ctx, arg_fabs_d *a)
     TCGv dest = get_fpr(ctx, a->fd);
     TCGv src = get_fpr(ctx, a->fj);
 
+    if (!avail_FP_DP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_andi_i64(dest, src, MAKE_64BIT_MASK(0, 63));
@@ -121,6 +137,10 @@ static bool trans_fneg_s(DisasContext *ctx, arg_fneg_s *a)
     TCGv dest = get_fpr(ctx, a->fd);
     TCGv src = get_fpr(ctx, a->fj);
 
+    if (!avail_FP_SP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_xori_i64(dest, src, 0x80000000);
@@ -135,6 +155,10 @@ static bool trans_fneg_d(DisasContext *ctx, arg_fneg_d *a)
     TCGv dest = get_fpr(ctx, a->fd);
     TCGv src = get_fpr(ctx, a->fj);
 
+    if (!avail_FP_DP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_xori_i64(dest, src, 0x8000000000000000LL);
@@ -143,41 +167,41 @@ static bool trans_fneg_d(DisasContext *ctx, arg_fneg_d *a)
     return true;
 }
 
-TRANS(fadd_s, ALL, gen_fff, gen_helper_fadd_s)
-TRANS(fadd_d, ALL, gen_fff, gen_helper_fadd_d)
-TRANS(fsub_s, ALL, gen_fff, gen_helper_fsub_s)
-TRANS(fsub_d, ALL, gen_fff, gen_helper_fsub_d)
-TRANS(fmul_s, ALL, gen_fff, gen_helper_fmul_s)
-TRANS(fmul_d, ALL, gen_fff, gen_helper_fmul_d)
-TRANS(fdiv_s, ALL, gen_fff, gen_helper_fdiv_s)
-TRANS(fdiv_d, ALL, gen_fff, gen_helper_fdiv_d)
-TRANS(fmax_s, ALL, gen_fff, gen_helper_fmax_s)
-TRANS(fmax_d, ALL, gen_fff, gen_helper_fmax_d)
-TRANS(fmin_s, ALL, gen_fff, gen_helper_fmin_s)
-TRANS(fmin_d, ALL, gen_fff, gen_helper_fmin_d)
-TRANS(fmaxa_s, ALL, gen_fff, gen_helper_fmaxa_s)
-TRANS(fmaxa_d, ALL, gen_fff, gen_helper_fmaxa_d)
-TRANS(fmina_s, ALL, gen_fff, gen_helper_fmina_s)
-TRANS(fmina_d, ALL, gen_fff, gen_helper_fmina_d)
-TRANS(fscaleb_s, ALL, gen_fff, gen_helper_fscaleb_s)
-TRANS(fscaleb_d, ALL, gen_fff, gen_helper_fscaleb_d)
-TRANS(fsqrt_s, ALL, gen_ff, gen_helper_fsqrt_s)
-TRANS(fsqrt_d, ALL, gen_ff, gen_helper_fsqrt_d)
-TRANS(frecip_s, ALL, gen_ff, gen_helper_frecip_s)
-TRANS(frecip_d, ALL, gen_ff, gen_helper_frecip_d)
-TRANS(frsqrt_s, ALL, gen_ff, gen_helper_frsqrt_s)
-TRANS(frsqrt_d, ALL, gen_ff, gen_helper_frsqrt_d)
-TRANS(flogb_s, ALL, gen_ff, gen_helper_flogb_s)
-TRANS(flogb_d, ALL, gen_ff, gen_helper_flogb_d)
-TRANS(fclass_s, ALL, gen_ff, gen_helper_fclass_s)
-TRANS(fclass_d, ALL, gen_ff, gen_helper_fclass_d)
-TRANS(fmadd_s, ALL, gen_muladd, gen_helper_fmuladd_s, 0)
-TRANS(fmadd_d, ALL, gen_muladd, gen_helper_fmuladd_d, 0)
-TRANS(fmsub_s, ALL, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_c)
-TRANS(fmsub_d, ALL, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_c)
-TRANS(fnmadd_s, ALL, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_result)
-TRANS(fnmadd_d, ALL, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_result)
-TRANS(fnmsub_s, ALL, gen_muladd, gen_helper_fmuladd_s,
+TRANS(fadd_s, FP_SP, gen_fff, gen_helper_fadd_s)
+TRANS(fadd_d, FP_DP, gen_fff, gen_helper_fadd_d)
+TRANS(fsub_s, FP_SP, gen_fff, gen_helper_fsub_s)
+TRANS(fsub_d, FP_DP, gen_fff, gen_helper_fsub_d)
+TRANS(fmul_s, FP_SP, gen_fff, gen_helper_fmul_s)
+TRANS(fmul_d, FP_DP, gen_fff, gen_helper_fmul_d)
+TRANS(fdiv_s, FP_SP, gen_fff, gen_helper_fdiv_s)
+TRANS(fdiv_d, FP_DP, gen_fff, gen_helper_fdiv_d)
+TRANS(fmax_s, FP_SP, gen_fff, gen_helper_fmax_s)
+TRANS(fmax_d, FP_DP, gen_fff, gen_helper_fmax_d)
+TRANS(fmin_s, FP_SP, gen_fff, gen_helper_fmin_s)
+TRANS(fmin_d, FP_DP, gen_fff, gen_helper_fmin_d)
+TRANS(fmaxa_s, FP_SP, gen_fff, gen_helper_fmaxa_s)
+TRANS(fmaxa_d, FP_DP, gen_fff, gen_helper_fmaxa_d)
+TRANS(fmina_s, FP_SP, gen_fff, gen_helper_fmina_s)
+TRANS(fmina_d, FP_DP, gen_fff, gen_helper_fmina_d)
+TRANS(fscaleb_s, FP_SP, gen_fff, gen_helper_fscaleb_s)
+TRANS(fscaleb_d, FP_DP, gen_fff, gen_helper_fscaleb_d)
+TRANS(fsqrt_s, FP_SP, gen_ff, gen_helper_fsqrt_s)
+TRANS(fsqrt_d, FP_DP, gen_ff, gen_helper_fsqrt_d)
+TRANS(frecip_s, FP_SP, gen_ff, gen_helper_frecip_s)
+TRANS(frecip_d, FP_DP, gen_ff, gen_helper_frecip_d)
+TRANS(frsqrt_s, FP_SP, gen_ff, gen_helper_frsqrt_s)
+TRANS(frsqrt_d, FP_DP, gen_ff, gen_helper_frsqrt_d)
+TRANS(flogb_s, FP_SP, gen_ff, gen_helper_flogb_s)
+TRANS(flogb_d, FP_DP, gen_ff, gen_helper_flogb_d)
+TRANS(fclass_s, FP_SP, gen_ff, gen_helper_fclass_s)
+TRANS(fclass_d, FP_DP, gen_ff, gen_helper_fclass_d)
+TRANS(fmadd_s, FP_SP, gen_muladd, gen_helper_fmuladd_s, 0)
+TRANS(fmadd_d, FP_DP, gen_muladd, gen_helper_fmuladd_d, 0)
+TRANS(fmsub_s, FP_SP, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_c)
+TRANS(fmsub_d, FP_DP, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_c)
+TRANS(fnmadd_s, FP_SP, gen_muladd, gen_helper_fmuladd_s, float_muladd_negate_result)
+TRANS(fnmadd_d, FP_DP, gen_muladd, gen_helper_fmuladd_d, float_muladd_negate_result)
+TRANS(fnmsub_s, FP_SP, gen_muladd, gen_helper_fmuladd_s,
       float_muladd_negate_c | float_muladd_negate_result)
-TRANS(fnmsub_d, ALL, gen_muladd, gen_helper_fmuladd_d,
+TRANS(fnmsub_d, FP_DP, gen_muladd, gen_helper_fmuladd_d,
       float_muladd_negate_c | float_muladd_negate_result)
diff --git a/target/loongarch/insn_trans/trans_fcmp.c.inc b/target/loongarch/insn_trans/trans_fcmp.c.inc
index a78868dbc4..43d5866a67 100644
--- a/target/loongarch/insn_trans/trans_fcmp.c.inc
+++ b/target/loongarch/insn_trans/trans_fcmp.c.inc
@@ -29,6 +29,10 @@ static bool trans_fcmp_cond_s(DisasContext *ctx, arg_fcmp_cond_s *a)
     uint32_t flags;
     void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 
+    if (!avail_FP_SP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     var = tcg_temp_new();
@@ -49,6 +53,10 @@ static bool trans_fcmp_cond_d(DisasContext *ctx, arg_fcmp_cond_d *a)
     uint32_t flags;
     void (*fn)(TCGv, TCGv_env, TCGv, TCGv, TCGv_i32);
 
+    if (!avail_FP_DP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     var = tcg_temp_new();
diff --git a/target/loongarch/insn_trans/trans_fcnv.c.inc b/target/loongarch/insn_trans/trans_fcnv.c.inc
index 329a2d6872..833c059d6d 100644
--- a/target/loongarch/insn_trans/trans_fcnv.c.inc
+++ b/target/loongarch/insn_trans/trans_fcnv.c.inc
@@ -3,31 +3,31 @@
  * Copyright (c) 2021 Loongson Technology Corporation Limited
  */
 
-TRANS(fcvt_s_d, ALL, gen_ff, gen_helper_fcvt_s_d)
-TRANS(fcvt_d_s, ALL, gen_ff, gen_helper_fcvt_d_s)
-TRANS(ftintrm_w_s, ALL, gen_ff, gen_helper_ftintrm_w_s)
-TRANS(ftintrm_w_d, ALL, gen_ff, gen_helper_ftintrm_w_d)
-TRANS(ftintrm_l_s, ALL, gen_ff, gen_helper_ftintrm_l_s)
-TRANS(ftintrm_l_d, ALL, gen_ff, gen_helper_ftintrm_l_d)
-TRANS(ftintrp_w_s, ALL, gen_ff, gen_helper_ftintrp_w_s)
-TRANS(ftintrp_w_d, ALL, gen_ff, gen_helper_ftintrp_w_d)
-TRANS(ftintrp_l_s, ALL, gen_ff, gen_helper_ftintrp_l_s)
-TRANS(ftintrp_l_d, ALL, gen_ff, gen_helper_ftintrp_l_d)
-TRANS(ftintrz_w_s, ALL, gen_ff, gen_helper_ftintrz_w_s)
-TRANS(ftintrz_w_d, ALL, gen_ff, gen_helper_ftintrz_w_d)
-TRANS(ftintrz_l_s, ALL, gen_ff, gen_helper_ftintrz_l_s)
-TRANS(ftintrz_l_d, ALL, gen_ff, gen_helper_ftintrz_l_d)
-TRANS(ftintrne_w_s, ALL, gen_ff, gen_helper_ftintrne_w_s)
-TRANS(ftintrne_w_d, ALL, gen_ff, gen_helper_ftintrne_w_d)
-TRANS(ftintrne_l_s, ALL, gen_ff, gen_helper_ftintrne_l_s)
-TRANS(ftintrne_l_d, ALL, gen_ff, gen_helper_ftintrne_l_d)
-TRANS(ftint_w_s, ALL, gen_ff, gen_helper_ftint_w_s)
-TRANS(ftint_w_d, ALL, gen_ff, gen_helper_ftint_w_d)
-TRANS(ftint_l_s, ALL, gen_ff, gen_helper_ftint_l_s)
-TRANS(ftint_l_d, ALL, gen_ff, gen_helper_ftint_l_d)
-TRANS(ffint_s_w, ALL, gen_ff, gen_helper_ffint_s_w)
-TRANS(ffint_s_l, ALL, gen_ff, gen_helper_ffint_s_l)
-TRANS(ffint_d_w, ALL, gen_ff, gen_helper_ffint_d_w)
-TRANS(ffint_d_l, ALL, gen_ff, gen_helper_ffint_d_l)
-TRANS(frint_s, ALL, gen_ff, gen_helper_frint_s)
-TRANS(frint_d, ALL, gen_ff, gen_helper_frint_d)
+TRANS(fcvt_s_d, FP_DP, gen_ff, gen_helper_fcvt_s_d)
+TRANS(fcvt_d_s, FP_DP, gen_ff, gen_helper_fcvt_d_s)
+TRANS(ftintrm_w_s, FP_SP, gen_ff, gen_helper_ftintrm_w_s)
+TRANS(ftintrm_w_d, FP_DP, gen_ff, gen_helper_ftintrm_w_d)
+TRANS(ftintrm_l_s, FP_SP, gen_ff, gen_helper_ftintrm_l_s)
+TRANS(ftintrm_l_d, FP_DP, gen_ff, gen_helper_ftintrm_l_d)
+TRANS(ftintrp_w_s, FP_SP, gen_ff, gen_helper_ftintrp_w_s)
+TRANS(ftintrp_w_d, FP_DP, gen_ff, gen_helper_ftintrp_w_d)
+TRANS(ftintrp_l_s, FP_SP, gen_ff, gen_helper_ftintrp_l_s)
+TRANS(ftintrp_l_d, FP_DP, gen_ff, gen_helper_ftintrp_l_d)
+TRANS(ftintrz_w_s, FP_SP, gen_ff, gen_helper_ftintrz_w_s)
+TRANS(ftintrz_w_d, FP_DP, gen_ff, gen_helper_ftintrz_w_d)
+TRANS(ftintrz_l_s, FP_SP, gen_ff, gen_helper_ftintrz_l_s)
+TRANS(ftintrz_l_d, FP_DP, gen_ff, gen_helper_ftintrz_l_d)
+TRANS(ftintrne_w_s, FP_SP, gen_ff, gen_helper_ftintrne_w_s)
+TRANS(ftintrne_w_d, FP_DP, gen_ff, gen_helper_ftintrne_w_d)
+TRANS(ftintrne_l_s, FP_SP, gen_ff, gen_helper_ftintrne_l_s)
+TRANS(ftintrne_l_d, FP_DP, gen_ff, gen_helper_ftintrne_l_d)
+TRANS(ftint_w_s, FP_SP, gen_ff, gen_helper_ftint_w_s)
+TRANS(ftint_w_d, FP_DP, gen_ff, gen_helper_ftint_w_d)
+TRANS(ftint_l_s, FP_SP, gen_ff, gen_helper_ftint_l_s)
+TRANS(ftint_l_d, FP_DP, gen_ff, gen_helper_ftint_l_d)
+TRANS(ffint_s_w, FP_SP, gen_ff, gen_helper_ffint_s_w)
+TRANS(ffint_s_l, FP_SP, gen_ff, gen_helper_ffint_s_l)
+TRANS(ffint_d_w, FP_DP, gen_ff, gen_helper_ffint_d_w)
+TRANS(ffint_d_l, FP_DP, gen_ff, gen_helper_ffint_d_l)
+TRANS(frint_s, FP_SP, gen_ff, gen_helper_frint_s)
+TRANS(frint_d, FP_DP, gen_ff, gen_helper_frint_d)
diff --git a/target/loongarch/insn_trans/trans_fmemory.c.inc b/target/loongarch/insn_trans/trans_fmemory.c.inc
index 8e3b4522c9..5ddb8a473b 100644
--- a/target/loongarch/insn_trans/trans_fmemory.c.inc
+++ b/target/loongarch/insn_trans/trans_fmemory.c.inc
@@ -140,19 +140,19 @@ static bool gen_fstore_le(DisasContext *ctx, arg_frr *a, MemOp mop)
     return true;
 }
 
-TRANS(fld_s, ALL, gen_fload_i, MO_TEUL)
-TRANS(fst_s, ALL, gen_fstore_i, MO_TEUL)
-TRANS(fld_d, ALL, gen_fload_i, MO_TEUQ)
-TRANS(fst_d, ALL, gen_fstore_i, MO_TEUQ)
-TRANS(fldx_s, ALL, gen_floadx, MO_TEUL)
-TRANS(fldx_d, ALL, gen_floadx, MO_TEUQ)
-TRANS(fstx_s, ALL, gen_fstorex, MO_TEUL)
-TRANS(fstx_d, ALL, gen_fstorex, MO_TEUQ)
-TRANS(fldgt_s, ALL, gen_fload_gt, MO_TEUL)
-TRANS(fldgt_d, ALL, gen_fload_gt, MO_TEUQ)
-TRANS(fldle_s, ALL, gen_fload_le, MO_TEUL)
-TRANS(fldle_d, ALL, gen_fload_le, MO_TEUQ)
-TRANS(fstgt_s, ALL, gen_fstore_gt, MO_TEUL)
-TRANS(fstgt_d, ALL, gen_fstore_gt, MO_TEUQ)
-TRANS(fstle_s, ALL, gen_fstore_le, MO_TEUL)
-TRANS(fstle_d, ALL, gen_fstore_le, MO_TEUQ)
+TRANS(fld_s, FP_SP, gen_fload_i, MO_TEUL)
+TRANS(fst_s, FP_SP, gen_fstore_i, MO_TEUL)
+TRANS(fld_d, FP_DP, gen_fload_i, MO_TEUQ)
+TRANS(fst_d, FP_DP, gen_fstore_i, MO_TEUQ)
+TRANS(fldx_s, FP_SP, gen_floadx, MO_TEUL)
+TRANS(fldx_d, FP_DP, gen_floadx, MO_TEUQ)
+TRANS(fstx_s, FP_SP, gen_fstorex, MO_TEUL)
+TRANS(fstx_d, FP_DP, gen_fstorex, MO_TEUQ)
+TRANS(fldgt_s, FP_SP, gen_fload_gt, MO_TEUL)
+TRANS(fldgt_d, FP_DP, gen_fload_gt, MO_TEUQ)
+TRANS(fldle_s, FP_SP, gen_fload_le, MO_TEUL)
+TRANS(fldle_d, FP_DP, gen_fload_le, MO_TEUQ)
+TRANS(fstgt_s, FP_SP, gen_fstore_gt, MO_TEUL)
+TRANS(fstgt_d, FP_DP, gen_fstore_gt, MO_TEUQ)
+TRANS(fstle_s, FP_SP, gen_fstore_le, MO_TEUL)
+TRANS(fstle_d, FP_DP, gen_fstore_le, MO_TEUQ)
diff --git a/target/loongarch/insn_trans/trans_fmov.c.inc b/target/loongarch/insn_trans/trans_fmov.c.inc
index 385bbb7929..928e127820 100644
--- a/target/loongarch/insn_trans/trans_fmov.c.inc
+++ b/target/loongarch/insn_trans/trans_fmov.c.inc
@@ -15,6 +15,10 @@ static bool trans_fsel(DisasContext *ctx, arg_fsel *a)
     TCGv src2 = get_fpr(ctx, a->fk);
     TCGv cond;
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     cond = tcg_temp_new();
@@ -48,6 +52,10 @@ static bool gen_r2f(DisasContext *ctx, arg_fr *a,
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv dest = get_fpr(ctx, a->fd);
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     func(dest, src);
@@ -62,6 +70,10 @@ static bool gen_f2r(DisasContext *ctx, arg_rf *a,
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
     TCGv src = get_fpr(ctx, a->fj);
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     func(dest, src);
@@ -75,6 +87,10 @@ static bool trans_movgr2fcsr(DisasContext *ctx, arg_movgr2fcsr *a)
     uint32_t mask = fcsr_mask[a->fcsrd];
     TCGv Rj = gpr_src(ctx, a->rj, EXT_NONE);
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     if (mask == UINT32_MAX) {
@@ -105,6 +121,10 @@ static bool trans_movfcsr2gr(DisasContext *ctx, arg_movfcsr2gr *a)
 {
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_ld32u_i64(dest, cpu_env, offsetof(CPULoongArchState, fcsr0));
@@ -134,6 +154,10 @@ static bool trans_movfr2cf(DisasContext *ctx, arg_movfr2cf *a)
     TCGv t0;
     TCGv src = get_fpr(ctx, a->fj);
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     t0 = tcg_temp_new();
@@ -147,6 +171,10 @@ static bool trans_movcf2fr(DisasContext *ctx, arg_movcf2fr *a)
 {
     TCGv dest = get_fpr(ctx, a->fd);
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_ld8u_tl(dest, cpu_env,
@@ -160,6 +188,10 @@ static bool trans_movgr2cf(DisasContext *ctx, arg_movgr2cf *a)
 {
     TCGv t0;
 
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     t0 = tcg_temp_new();
@@ -171,6 +203,10 @@ static bool trans_movgr2cf(DisasContext *ctx, arg_movgr2cf *a)
 
 static bool trans_movcf2gr(DisasContext *ctx, arg_movcf2gr *a)
 {
+    if (!avail_FP(ctx)) {
+        return false;
+    }
+
     CHECK_FPE;
 
     tcg_gen_ld8u_tl(gpr_dst(ctx, a->rd, EXT_NONE), cpu_env,
@@ -178,11 +214,11 @@ static bool trans_movcf2gr(DisasContext *ctx, arg_movcf2gr *a)
     return true;
 }
 
-TRANS(fmov_s, ALL, gen_f2f, tcg_gen_mov_tl, true)
-TRANS(fmov_d, ALL, gen_f2f, tcg_gen_mov_tl, false)
-TRANS(movgr2fr_w, ALL, gen_r2f, gen_movgr2fr_w)
+TRANS(fmov_s, FP_SP, gen_f2f, tcg_gen_mov_tl, true)
+TRANS(fmov_d, FP_DP, gen_f2f, tcg_gen_mov_tl, false)
+TRANS(movgr2fr_w, FP_SP, gen_r2f, gen_movgr2fr_w)
 TRANS(movgr2fr_d, 64, gen_r2f, tcg_gen_mov_tl)
-TRANS(movgr2frh_w, ALL, gen_r2f, gen_movgr2frh_w)
-TRANS(movfr2gr_s, ALL, gen_f2r, tcg_gen_ext32s_tl)
+TRANS(movgr2frh_w, FP_DP, gen_r2f, gen_movgr2frh_w)
+TRANS(movfr2gr_s, FP_SP, gen_f2r, tcg_gen_ext32s_tl)
 TRANS(movfr2gr_d, 64, gen_f2r, tcg_gen_mov_tl)
-TRANS(movfrh2gr_s, ALL, gen_f2r, gen_movfrh2gr_s)
+TRANS(movfrh2gr_s, FP_DP, gen_f2r, gen_movfrh2gr_s)
diff --git a/target/loongarch/translate.c b/target/loongarch/translate.c
index 6967e12fc3..fd393ed76d 100644
--- a/target/loongarch/translate.c
+++ b/target/loongarch/translate.c
@@ -129,6 +129,7 @@ static void loongarch_tr_init_disas_context(DisasContextBase *dcbase,
     ctx->zero = tcg_constant_tl(0);
 
     ctx->cpucfg1 = env->cpucfg[1];
+    ctx->cpucfg2 = env->cpucfg[2];
 }
 
 static void loongarch_tr_tb_start(DisasContextBase *dcbase, CPUState *cs)
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index 1342446242..0f244cd83b 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -17,6 +17,9 @@
 #define avail_ALL(C)   true
 #define avail_64(C)    (FIELD_EX32((C)->cpucfg1, CPUCFG1, ARCH) == \
                         CPUCFG1_ARCH_LA64)
+#define avail_FP(C)    (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP))
+#define avail_FP_SP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_SP))
+#define avail_FP_DP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_DP))
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,
@@ -40,6 +43,7 @@ typedef struct DisasContext {
     bool la64; /* LoongArch64 mode */
     bool va32; /* 32-bit virtual address */
     uint32_t cpucfg1;
+    uint32_t cpucfg2;
 } DisasContext;
 
 void generate_exception(DisasContext *ctx, int excp);

From 70c8d5eaaaf1b39b13af942a359d35a3aedd0803 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:19:56 +0200
Subject: [PATCH 1191/1353] target/loongarch: Add avail_LSPW to check LSPW
 instructions

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-13-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-7-philmd@linaro.org>
---
 target/loongarch/insn_trans/trans_privileged.c.inc | 8 ++++++++
 target/loongarch/translate.h                       | 1 +
 2 files changed, 9 insertions(+)

diff --git a/target/loongarch/insn_trans/trans_privileged.c.inc b/target/loongarch/insn_trans/trans_privileged.c.inc
index 684ff547a7..099cd871f0 100644
--- a/target/loongarch/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/insn_trans/trans_privileged.c.inc
@@ -437,6 +437,10 @@ static bool trans_ldpte(DisasContext *ctx, arg_ldpte *a)
     TCGv_i32 mem_idx = tcg_constant_i32(ctx->mem_idx);
     TCGv src1 = gpr_src(ctx, a->rj, EXT_NONE);
 
+    if (!avail_LSPW(ctx)) {
+        return true;
+    }
+
     if (check_plv(ctx)) {
         return false;
     }
@@ -450,6 +454,10 @@ static bool trans_lddir(DisasContext *ctx, arg_lddir *a)
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
     TCGv dest = gpr_dst(ctx, a->rd, EXT_NONE);
 
+    if (!avail_LSPW(ctx)) {
+        return true;
+    }
+
     if (check_plv(ctx)) {
         return false;
     }
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index 0f244cd83b..f0d7b82932 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -20,6 +20,7 @@
 #define avail_FP(C)    (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP))
 #define avail_FP_SP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_SP))
 #define avail_FP_DP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_DP))
+#define avail_LSPW(C)  (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSPW))
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,

From b139ddf1e944e395def788193232088cd6caf946 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:19:57 +0200
Subject: [PATCH 1192/1353] target/loongarch: Add avail_LAM to check atomic
 instructions

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-14-gaosong@loongson.cn>
Message-Id: <20230822071959.35620-8-philmd@linaro.org>
---
 .../loongarch/insn_trans/trans_atomic.c.inc   | 72 +++++++++----------
 target/loongarch/translate.h                  |  1 +
 2 files changed, 37 insertions(+), 36 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_atomic.c.inc b/target/loongarch/insn_trans/trans_atomic.c.inc
index 194818d74d..40085190f6 100644
--- a/target/loongarch/insn_trans/trans_atomic.c.inc
+++ b/target/loongarch/insn_trans/trans_atomic.c.inc
@@ -73,39 +73,39 @@ TRANS(ll_w, ALL, gen_ll, MO_TESL)
 TRANS(sc_w, ALL, gen_sc, MO_TESL)
 TRANS(ll_d, 64, gen_ll, MO_TEUQ)
 TRANS(sc_d, 64, gen_sc, MO_TEUQ)
-TRANS(amswap_w, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_d, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
-TRANS(amadd_w, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_d, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
-TRANS(amand_w, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_d, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
-TRANS(amor_w, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_d, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
-TRANS(amxor_w, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_d, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
-TRANS(ammax_w, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_d, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
-TRANS(ammin_w, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_d, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
-TRANS(ammax_wu, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_du, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
-TRANS(ammin_wu, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_du, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
-TRANS(amswap_db_w, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_db_d, 64, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
-TRANS(amadd_db_w, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_db_d, 64, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
-TRANS(amand_db_w, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_db_d, 64, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
-TRANS(amor_db_w, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_db_d, 64, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
-TRANS(amxor_db_w, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_db_d, 64, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
-TRANS(ammax_db_w, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_db_d, 64, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
-TRANS(ammin_db_w, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_db_d, 64, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
-TRANS(ammax_db_wu, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_db_du, 64, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
-TRANS(ammin_db_wu, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_db_du, 64, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS(amswap_w, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
+TRANS(amswap_d, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS(amadd_w, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
+TRANS(amadd_d, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS(amand_w, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
+TRANS(amand_d, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS(amor_w, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
+TRANS(amor_d, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS(amxor_w, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
+TRANS(amxor_d, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS(ammax_w, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
+TRANS(ammax_d, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS(ammin_w, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
+TRANS(ammin_d, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS(ammax_wu, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
+TRANS(ammax_du, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS(ammin_wu, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
+TRANS(ammin_du, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS(amswap_db_w, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
+TRANS(amswap_db_d, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS(amadd_db_w, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
+TRANS(amadd_db_d, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS(amand_db_w, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
+TRANS(amand_db_d, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS(amor_db_w, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
+TRANS(amor_db_d, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS(amxor_db_w, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
+TRANS(amxor_db_d, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS(ammax_db_w, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
+TRANS(ammax_db_d, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS(ammin_db_w, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
+TRANS(ammin_db_d, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS(ammax_db_wu, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
+TRANS(ammax_db_du, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS(ammin_db_wu, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
+TRANS(ammin_db_du, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index f0d7b82932..faf4ce87f9 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -21,6 +21,7 @@
 #define avail_FP_SP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_SP))
 #define avail_FP_DP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_DP))
 #define avail_LSPW(C)  (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSPW))
+#define avail_LAM(C)   (FIELD_EX32((C)->cpucfg2, CPUCFG2, LAM))
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,

From ebf288b410a38316dd6d6d15a9453222fff13d92 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:30:26 +0200
Subject: [PATCH 1193/1353] target/loongarch: Add avail_LSX to check LSX
 instructions

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-15-gaosong@loongson.cn>
Message-Id: <20230822073026.35776-1-philmd@linaro.org>
---
 target/loongarch/insn_trans/trans_lsx.c.inc | 1396 +++++++++++--------
 target/loongarch/translate.h                |    2 +
 2 files changed, 780 insertions(+), 618 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_lsx.c.inc b/target/loongarch/insn_trans/trans_lsx.c.inc
index 45e0e738ad..5fbf2718f7 100644
--- a/target/loongarch/insn_trans/trans_lsx.c.inc
+++ b/target/loongarch/insn_trans/trans_lsx.c.inc
@@ -135,16 +135,20 @@ static bool gvec_subi(DisasContext *ctx, arg_vv_i *a, MemOp mop)
     return true;
 }
 
-TRANS(vadd_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_add)
-TRANS(vadd_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_add)
-TRANS(vadd_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_add)
-TRANS(vadd_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_add)
+TRANS(vadd_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_add)
+TRANS(vadd_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_add)
+TRANS(vadd_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_add)
+TRANS(vadd_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_add)
 
 #define VADDSUB_Q(NAME)                                        \
 static bool trans_v## NAME ##_q(DisasContext *ctx, arg_vvv *a) \
 {                                                              \
     TCGv_i64 rh, rl, ah, al, bh, bl;                           \
                                                                \
+    if (!avail_LSX(ctx)) {                                     \
+        return false;                                          \
+    }                                                          \
+                                                               \
     CHECK_SXE;                                                 \
                                                                \
     rh = tcg_temp_new_i64();                                   \
@@ -170,58 +174,58 @@ static bool trans_v## NAME ##_q(DisasContext *ctx, arg_vvv *a) \
 VADDSUB_Q(add)
 VADDSUB_Q(sub)
 
-TRANS(vsub_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_sub)
-TRANS(vsub_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_sub)
-TRANS(vsub_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_sub)
-TRANS(vsub_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_sub)
+TRANS(vsub_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_sub)
+TRANS(vsub_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_sub)
+TRANS(vsub_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_sub)
+TRANS(vsub_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_sub)
 
-TRANS(vaddi_bu, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_addi)
-TRANS(vaddi_hu, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_addi)
-TRANS(vaddi_wu, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_addi)
-TRANS(vaddi_du, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_addi)
-TRANS(vsubi_bu, ALL, gvec_subi, MO_8)
-TRANS(vsubi_hu, ALL, gvec_subi, MO_16)
-TRANS(vsubi_wu, ALL, gvec_subi, MO_32)
-TRANS(vsubi_du, ALL, gvec_subi, MO_64)
+TRANS(vaddi_bu, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_addi)
+TRANS(vaddi_hu, LSX, gvec_vv_i, MO_16, tcg_gen_gvec_addi)
+TRANS(vaddi_wu, LSX, gvec_vv_i, MO_32, tcg_gen_gvec_addi)
+TRANS(vaddi_du, LSX, gvec_vv_i, MO_64, tcg_gen_gvec_addi)
+TRANS(vsubi_bu, LSX, gvec_subi, MO_8)
+TRANS(vsubi_hu, LSX, gvec_subi, MO_16)
+TRANS(vsubi_wu, LSX, gvec_subi, MO_32)
+TRANS(vsubi_du, LSX, gvec_subi, MO_64)
 
-TRANS(vneg_b, ALL, gvec_vv, MO_8, tcg_gen_gvec_neg)
-TRANS(vneg_h, ALL, gvec_vv, MO_16, tcg_gen_gvec_neg)
-TRANS(vneg_w, ALL, gvec_vv, MO_32, tcg_gen_gvec_neg)
-TRANS(vneg_d, ALL, gvec_vv, MO_64, tcg_gen_gvec_neg)
+TRANS(vneg_b, LSX, gvec_vv, MO_8, tcg_gen_gvec_neg)
+TRANS(vneg_h, LSX, gvec_vv, MO_16, tcg_gen_gvec_neg)
+TRANS(vneg_w, LSX, gvec_vv, MO_32, tcg_gen_gvec_neg)
+TRANS(vneg_d, LSX, gvec_vv, MO_64, tcg_gen_gvec_neg)
 
-TRANS(vsadd_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_ssadd)
-TRANS(vsadd_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_ssadd)
-TRANS(vsadd_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_ssadd)
-TRANS(vsadd_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_ssadd)
-TRANS(vsadd_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_usadd)
-TRANS(vsadd_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_usadd)
-TRANS(vsadd_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_usadd)
-TRANS(vsadd_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_usadd)
-TRANS(vssub_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_sssub)
-TRANS(vssub_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_sssub)
-TRANS(vssub_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_sssub)
-TRANS(vssub_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_sssub)
-TRANS(vssub_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_ussub)
-TRANS(vssub_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_ussub)
-TRANS(vssub_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_ussub)
-TRANS(vssub_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_ussub)
+TRANS(vsadd_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_ssadd)
+TRANS(vsadd_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_ssadd)
+TRANS(vsadd_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_ssadd)
+TRANS(vsadd_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_ssadd)
+TRANS(vsadd_bu, LSX, gvec_vvv, MO_8, tcg_gen_gvec_usadd)
+TRANS(vsadd_hu, LSX, gvec_vvv, MO_16, tcg_gen_gvec_usadd)
+TRANS(vsadd_wu, LSX, gvec_vvv, MO_32, tcg_gen_gvec_usadd)
+TRANS(vsadd_du, LSX, gvec_vvv, MO_64, tcg_gen_gvec_usadd)
+TRANS(vssub_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_sssub)
+TRANS(vssub_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_sssub)
+TRANS(vssub_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_sssub)
+TRANS(vssub_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_sssub)
+TRANS(vssub_bu, LSX, gvec_vvv, MO_8, tcg_gen_gvec_ussub)
+TRANS(vssub_hu, LSX, gvec_vvv, MO_16, tcg_gen_gvec_ussub)
+TRANS(vssub_wu, LSX, gvec_vvv, MO_32, tcg_gen_gvec_ussub)
+TRANS(vssub_du, LSX, gvec_vvv, MO_64, tcg_gen_gvec_ussub)
 
-TRANS(vhaddw_h_b, ALL, gen_vvv, gen_helper_vhaddw_h_b)
-TRANS(vhaddw_w_h, ALL, gen_vvv, gen_helper_vhaddw_w_h)
-TRANS(vhaddw_d_w, ALL, gen_vvv, gen_helper_vhaddw_d_w)
-TRANS(vhaddw_q_d, ALL, gen_vvv, gen_helper_vhaddw_q_d)
-TRANS(vhaddw_hu_bu, ALL, gen_vvv, gen_helper_vhaddw_hu_bu)
-TRANS(vhaddw_wu_hu, ALL, gen_vvv, gen_helper_vhaddw_wu_hu)
-TRANS(vhaddw_du_wu, ALL, gen_vvv, gen_helper_vhaddw_du_wu)
-TRANS(vhaddw_qu_du, ALL, gen_vvv, gen_helper_vhaddw_qu_du)
-TRANS(vhsubw_h_b, ALL, gen_vvv, gen_helper_vhsubw_h_b)
-TRANS(vhsubw_w_h, ALL, gen_vvv, gen_helper_vhsubw_w_h)
-TRANS(vhsubw_d_w, ALL, gen_vvv, gen_helper_vhsubw_d_w)
-TRANS(vhsubw_q_d, ALL, gen_vvv, gen_helper_vhsubw_q_d)
-TRANS(vhsubw_hu_bu, ALL, gen_vvv, gen_helper_vhsubw_hu_bu)
-TRANS(vhsubw_wu_hu, ALL, gen_vvv, gen_helper_vhsubw_wu_hu)
-TRANS(vhsubw_du_wu, ALL, gen_vvv, gen_helper_vhsubw_du_wu)
-TRANS(vhsubw_qu_du, ALL, gen_vvv, gen_helper_vhsubw_qu_du)
+TRANS(vhaddw_h_b, LSX, gen_vvv, gen_helper_vhaddw_h_b)
+TRANS(vhaddw_w_h, LSX, gen_vvv, gen_helper_vhaddw_w_h)
+TRANS(vhaddw_d_w, LSX, gen_vvv, gen_helper_vhaddw_d_w)
+TRANS(vhaddw_q_d, LSX, gen_vvv, gen_helper_vhaddw_q_d)
+TRANS(vhaddw_hu_bu, LSX, gen_vvv, gen_helper_vhaddw_hu_bu)
+TRANS(vhaddw_wu_hu, LSX, gen_vvv, gen_helper_vhaddw_wu_hu)
+TRANS(vhaddw_du_wu, LSX, gen_vvv, gen_helper_vhaddw_du_wu)
+TRANS(vhaddw_qu_du, LSX, gen_vvv, gen_helper_vhaddw_qu_du)
+TRANS(vhsubw_h_b, LSX, gen_vvv, gen_helper_vhsubw_h_b)
+TRANS(vhsubw_w_h, LSX, gen_vvv, gen_helper_vhsubw_w_h)
+TRANS(vhsubw_d_w, LSX, gen_vvv, gen_helper_vhsubw_d_w)
+TRANS(vhsubw_q_d, LSX, gen_vvv, gen_helper_vhsubw_q_d)
+TRANS(vhsubw_hu_bu, LSX, gen_vvv, gen_helper_vhsubw_hu_bu)
+TRANS(vhsubw_wu_hu, LSX, gen_vvv, gen_helper_vhsubw_wu_hu)
+TRANS(vhsubw_du_wu, LSX, gen_vvv, gen_helper_vhsubw_du_wu)
+TRANS(vhsubw_qu_du, LSX, gen_vvv, gen_helper_vhsubw_qu_du)
 
 static void gen_vaddwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -301,10 +305,10 @@ static void do_vaddwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwev_h_b, ALL, gvec_vvv, MO_8, do_vaddwev_s)
-TRANS(vaddwev_w_h, ALL, gvec_vvv, MO_16, do_vaddwev_s)
-TRANS(vaddwev_d_w, ALL, gvec_vvv, MO_32, do_vaddwev_s)
-TRANS(vaddwev_q_d, ALL, gvec_vvv, MO_64, do_vaddwev_s)
+TRANS(vaddwev_h_b, LSX, gvec_vvv, MO_8, do_vaddwev_s)
+TRANS(vaddwev_w_h, LSX, gvec_vvv, MO_16, do_vaddwev_s)
+TRANS(vaddwev_d_w, LSX, gvec_vvv, MO_32, do_vaddwev_s)
+TRANS(vaddwev_q_d, LSX, gvec_vvv, MO_64, do_vaddwev_s)
 
 static void gen_vaddwod_w_h(TCGv_i32 t, TCGv_i32 a, TCGv_i32 b)
 {
@@ -380,10 +384,10 @@ static void do_vaddwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwod_h_b, ALL, gvec_vvv, MO_8, do_vaddwod_s)
-TRANS(vaddwod_w_h, ALL, gvec_vvv, MO_16, do_vaddwod_s)
-TRANS(vaddwod_d_w, ALL, gvec_vvv, MO_32, do_vaddwod_s)
-TRANS(vaddwod_q_d, ALL, gvec_vvv, MO_64, do_vaddwod_s)
+TRANS(vaddwod_h_b, LSX, gvec_vvv, MO_8, do_vaddwod_s)
+TRANS(vaddwod_w_h, LSX, gvec_vvv, MO_16, do_vaddwod_s)
+TRANS(vaddwod_d_w, LSX, gvec_vvv, MO_32, do_vaddwod_s)
+TRANS(vaddwod_q_d, LSX, gvec_vvv, MO_64, do_vaddwod_s)
 
 static void gen_vsubwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -463,10 +467,10 @@ static void do_vsubwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwev_h_b, ALL, gvec_vvv, MO_8, do_vsubwev_s)
-TRANS(vsubwev_w_h, ALL, gvec_vvv, MO_16, do_vsubwev_s)
-TRANS(vsubwev_d_w, ALL, gvec_vvv, MO_32, do_vsubwev_s)
-TRANS(vsubwev_q_d, ALL, gvec_vvv, MO_64, do_vsubwev_s)
+TRANS(vsubwev_h_b, LSX, gvec_vvv, MO_8, do_vsubwev_s)
+TRANS(vsubwev_w_h, LSX, gvec_vvv, MO_16, do_vsubwev_s)
+TRANS(vsubwev_d_w, LSX, gvec_vvv, MO_32, do_vsubwev_s)
+TRANS(vsubwev_q_d, LSX, gvec_vvv, MO_64, do_vsubwev_s)
 
 static void gen_vsubwod_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -542,10 +546,10 @@ static void do_vsubwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwod_h_b, ALL, gvec_vvv, MO_8, do_vsubwod_s)
-TRANS(vsubwod_w_h, ALL, gvec_vvv, MO_16, do_vsubwod_s)
-TRANS(vsubwod_d_w, ALL, gvec_vvv, MO_32, do_vsubwod_s)
-TRANS(vsubwod_q_d, ALL, gvec_vvv, MO_64, do_vsubwod_s)
+TRANS(vsubwod_h_b, LSX, gvec_vvv, MO_8, do_vsubwod_s)
+TRANS(vsubwod_w_h, LSX, gvec_vvv, MO_16, do_vsubwod_s)
+TRANS(vsubwod_d_w, LSX, gvec_vvv, MO_32, do_vsubwod_s)
+TRANS(vsubwod_q_d, LSX, gvec_vvv, MO_64, do_vsubwod_s)
 
 static void gen_vaddwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -617,10 +621,10 @@ static void do_vaddwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwev_h_bu, ALL, gvec_vvv, MO_8, do_vaddwev_u)
-TRANS(vaddwev_w_hu, ALL, gvec_vvv, MO_16, do_vaddwev_u)
-TRANS(vaddwev_d_wu, ALL, gvec_vvv, MO_32, do_vaddwev_u)
-TRANS(vaddwev_q_du, ALL, gvec_vvv, MO_64, do_vaddwev_u)
+TRANS(vaddwev_h_bu, LSX, gvec_vvv, MO_8, do_vaddwev_u)
+TRANS(vaddwev_w_hu, LSX, gvec_vvv, MO_16, do_vaddwev_u)
+TRANS(vaddwev_d_wu, LSX, gvec_vvv, MO_32, do_vaddwev_u)
+TRANS(vaddwev_q_du, LSX, gvec_vvv, MO_64, do_vaddwev_u)
 
 static void gen_vaddwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -696,10 +700,10 @@ static void do_vaddwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwod_h_bu, ALL, gvec_vvv, MO_8, do_vaddwod_u)
-TRANS(vaddwod_w_hu, ALL, gvec_vvv, MO_16, do_vaddwod_u)
-TRANS(vaddwod_d_wu, ALL, gvec_vvv, MO_32, do_vaddwod_u)
-TRANS(vaddwod_q_du, ALL, gvec_vvv, MO_64, do_vaddwod_u)
+TRANS(vaddwod_h_bu, LSX, gvec_vvv, MO_8, do_vaddwod_u)
+TRANS(vaddwod_w_hu, LSX, gvec_vvv, MO_16, do_vaddwod_u)
+TRANS(vaddwod_d_wu, LSX, gvec_vvv, MO_32, do_vaddwod_u)
+TRANS(vaddwod_q_du, LSX, gvec_vvv, MO_64, do_vaddwod_u)
 
 static void gen_vsubwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -771,10 +775,10 @@ static void do_vsubwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwev_h_bu, ALL, gvec_vvv, MO_8, do_vsubwev_u)
-TRANS(vsubwev_w_hu, ALL, gvec_vvv, MO_16, do_vsubwev_u)
-TRANS(vsubwev_d_wu, ALL, gvec_vvv, MO_32, do_vsubwev_u)
-TRANS(vsubwev_q_du, ALL, gvec_vvv, MO_64, do_vsubwev_u)
+TRANS(vsubwev_h_bu, LSX, gvec_vvv, MO_8, do_vsubwev_u)
+TRANS(vsubwev_w_hu, LSX, gvec_vvv, MO_16, do_vsubwev_u)
+TRANS(vsubwev_d_wu, LSX, gvec_vvv, MO_32, do_vsubwev_u)
+TRANS(vsubwev_q_du, LSX, gvec_vvv, MO_64, do_vsubwev_u)
 
 static void gen_vsubwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -850,10 +854,10 @@ static void do_vsubwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsubwod_h_bu, ALL, gvec_vvv, MO_8, do_vsubwod_u)
-TRANS(vsubwod_w_hu, ALL, gvec_vvv, MO_16, do_vsubwod_u)
-TRANS(vsubwod_d_wu, ALL, gvec_vvv, MO_32, do_vsubwod_u)
-TRANS(vsubwod_q_du, ALL, gvec_vvv, MO_64, do_vsubwod_u)
+TRANS(vsubwod_h_bu, LSX, gvec_vvv, MO_8, do_vsubwod_u)
+TRANS(vsubwod_w_hu, LSX, gvec_vvv, MO_16, do_vsubwod_u)
+TRANS(vsubwod_d_wu, LSX, gvec_vvv, MO_32, do_vsubwod_u)
+TRANS(vsubwod_q_du, LSX, gvec_vvv, MO_64, do_vsubwod_u)
 
 static void gen_vaddwev_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -933,10 +937,10 @@ static void do_vaddwev_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwev_h_bu_b, ALL, gvec_vvv, MO_8, do_vaddwev_u_s)
-TRANS(vaddwev_w_hu_h, ALL, gvec_vvv, MO_16, do_vaddwev_u_s)
-TRANS(vaddwev_d_wu_w, ALL, gvec_vvv, MO_32, do_vaddwev_u_s)
-TRANS(vaddwev_q_du_d, ALL, gvec_vvv, MO_64, do_vaddwev_u_s)
+TRANS(vaddwev_h_bu_b, LSX, gvec_vvv, MO_8, do_vaddwev_u_s)
+TRANS(vaddwev_w_hu_h, LSX, gvec_vvv, MO_16, do_vaddwev_u_s)
+TRANS(vaddwev_d_wu_w, LSX, gvec_vvv, MO_32, do_vaddwev_u_s)
+TRANS(vaddwev_q_du_d, LSX, gvec_vvv, MO_64, do_vaddwev_u_s)
 
 static void gen_vaddwod_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1013,10 +1017,10 @@ static void do_vaddwod_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vaddwod_h_bu_b, ALL, gvec_vvv, MO_8, do_vaddwod_u_s)
-TRANS(vaddwod_w_hu_h, ALL, gvec_vvv, MO_16, do_vaddwod_u_s)
-TRANS(vaddwod_d_wu_w, ALL, gvec_vvv, MO_32, do_vaddwod_u_s)
-TRANS(vaddwod_q_du_d, ALL, gvec_vvv, MO_64, do_vaddwod_u_s)
+TRANS(vaddwod_h_bu_b, LSX, gvec_vvv, MO_8, do_vaddwod_u_s)
+TRANS(vaddwod_w_hu_h, LSX, gvec_vvv, MO_16, do_vaddwod_u_s)
+TRANS(vaddwod_d_wu_w, LSX, gvec_vvv, MO_32, do_vaddwod_u_s)
+TRANS(vaddwod_q_du_d, LSX, gvec_vvv, MO_64, do_vaddwod_u_s)
 
 static void do_vavg(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b,
                     void (*gen_shr_vec)(unsigned, TCGv_vec,
@@ -1125,14 +1129,14 @@ static void do_vavg_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vavg_b, ALL, gvec_vvv, MO_8, do_vavg_s)
-TRANS(vavg_h, ALL, gvec_vvv, MO_16, do_vavg_s)
-TRANS(vavg_w, ALL, gvec_vvv, MO_32, do_vavg_s)
-TRANS(vavg_d, ALL, gvec_vvv, MO_64, do_vavg_s)
-TRANS(vavg_bu, ALL, gvec_vvv, MO_8, do_vavg_u)
-TRANS(vavg_hu, ALL, gvec_vvv, MO_16, do_vavg_u)
-TRANS(vavg_wu, ALL, gvec_vvv, MO_32, do_vavg_u)
-TRANS(vavg_du, ALL, gvec_vvv, MO_64, do_vavg_u)
+TRANS(vavg_b, LSX, gvec_vvv, MO_8, do_vavg_s)
+TRANS(vavg_h, LSX, gvec_vvv, MO_16, do_vavg_s)
+TRANS(vavg_w, LSX, gvec_vvv, MO_32, do_vavg_s)
+TRANS(vavg_d, LSX, gvec_vvv, MO_64, do_vavg_s)
+TRANS(vavg_bu, LSX, gvec_vvv, MO_8, do_vavg_u)
+TRANS(vavg_hu, LSX, gvec_vvv, MO_16, do_vavg_u)
+TRANS(vavg_wu, LSX, gvec_vvv, MO_32, do_vavg_u)
+TRANS(vavg_du, LSX, gvec_vvv, MO_64, do_vavg_u)
 
 static void do_vavgr_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        uint32_t vk_ofs, uint32_t oprsz, uint32_t maxsz)
@@ -1206,14 +1210,14 @@ static void do_vavgr_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vavgr_b, ALL, gvec_vvv, MO_8, do_vavgr_s)
-TRANS(vavgr_h, ALL, gvec_vvv, MO_16, do_vavgr_s)
-TRANS(vavgr_w, ALL, gvec_vvv, MO_32, do_vavgr_s)
-TRANS(vavgr_d, ALL, gvec_vvv, MO_64, do_vavgr_s)
-TRANS(vavgr_bu, ALL, gvec_vvv, MO_8, do_vavgr_u)
-TRANS(vavgr_hu, ALL, gvec_vvv, MO_16, do_vavgr_u)
-TRANS(vavgr_wu, ALL, gvec_vvv, MO_32, do_vavgr_u)
-TRANS(vavgr_du, ALL, gvec_vvv, MO_64, do_vavgr_u)
+TRANS(vavgr_b, LSX, gvec_vvv, MO_8, do_vavgr_s)
+TRANS(vavgr_h, LSX, gvec_vvv, MO_16, do_vavgr_s)
+TRANS(vavgr_w, LSX, gvec_vvv, MO_32, do_vavgr_s)
+TRANS(vavgr_d, LSX, gvec_vvv, MO_64, do_vavgr_s)
+TRANS(vavgr_bu, LSX, gvec_vvv, MO_8, do_vavgr_u)
+TRANS(vavgr_hu, LSX, gvec_vvv, MO_16, do_vavgr_u)
+TRANS(vavgr_wu, LSX, gvec_vvv, MO_32, do_vavgr_u)
+TRANS(vavgr_du, LSX, gvec_vvv, MO_64, do_vavgr_u)
 
 static void gen_vabsd_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1301,14 +1305,14 @@ static void do_vabsd_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vabsd_b, ALL, gvec_vvv, MO_8, do_vabsd_s)
-TRANS(vabsd_h, ALL, gvec_vvv, MO_16, do_vabsd_s)
-TRANS(vabsd_w, ALL, gvec_vvv, MO_32, do_vabsd_s)
-TRANS(vabsd_d, ALL, gvec_vvv, MO_64, do_vabsd_s)
-TRANS(vabsd_bu, ALL, gvec_vvv, MO_8, do_vabsd_u)
-TRANS(vabsd_hu, ALL, gvec_vvv, MO_16, do_vabsd_u)
-TRANS(vabsd_wu, ALL, gvec_vvv, MO_32, do_vabsd_u)
-TRANS(vabsd_du, ALL, gvec_vvv, MO_64, do_vabsd_u)
+TRANS(vabsd_b, LSX, gvec_vvv, MO_8, do_vabsd_s)
+TRANS(vabsd_h, LSX, gvec_vvv, MO_16, do_vabsd_s)
+TRANS(vabsd_w, LSX, gvec_vvv, MO_32, do_vabsd_s)
+TRANS(vabsd_d, LSX, gvec_vvv, MO_64, do_vabsd_s)
+TRANS(vabsd_bu, LSX, gvec_vvv, MO_8, do_vabsd_u)
+TRANS(vabsd_hu, LSX, gvec_vvv, MO_16, do_vabsd_u)
+TRANS(vabsd_wu, LSX, gvec_vvv, MO_32, do_vabsd_u)
+TRANS(vabsd_du, LSX, gvec_vvv, MO_64, do_vabsd_u)
 
 static void gen_vadda(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1358,28 +1362,28 @@ static void do_vadda(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vadda_b, ALL, gvec_vvv, MO_8, do_vadda)
-TRANS(vadda_h, ALL, gvec_vvv, MO_16, do_vadda)
-TRANS(vadda_w, ALL, gvec_vvv, MO_32, do_vadda)
-TRANS(vadda_d, ALL, gvec_vvv, MO_64, do_vadda)
+TRANS(vadda_b, LSX, gvec_vvv, MO_8, do_vadda)
+TRANS(vadda_h, LSX, gvec_vvv, MO_16, do_vadda)
+TRANS(vadda_w, LSX, gvec_vvv, MO_32, do_vadda)
+TRANS(vadda_d, LSX, gvec_vvv, MO_64, do_vadda)
 
-TRANS(vmax_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_smax)
-TRANS(vmax_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_smax)
-TRANS(vmax_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_smax)
-TRANS(vmax_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_smax)
-TRANS(vmax_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_umax)
-TRANS(vmax_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_umax)
-TRANS(vmax_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_umax)
-TRANS(vmax_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_umax)
+TRANS(vmax_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_smax)
+TRANS(vmax_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_smax)
+TRANS(vmax_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_smax)
+TRANS(vmax_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_smax)
+TRANS(vmax_bu, LSX, gvec_vvv, MO_8, tcg_gen_gvec_umax)
+TRANS(vmax_hu, LSX, gvec_vvv, MO_16, tcg_gen_gvec_umax)
+TRANS(vmax_wu, LSX, gvec_vvv, MO_32, tcg_gen_gvec_umax)
+TRANS(vmax_du, LSX, gvec_vvv, MO_64, tcg_gen_gvec_umax)
 
-TRANS(vmin_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_smin)
-TRANS(vmin_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_smin)
-TRANS(vmin_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_smin)
-TRANS(vmin_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_smin)
-TRANS(vmin_bu, ALL, gvec_vvv, MO_8, tcg_gen_gvec_umin)
-TRANS(vmin_hu, ALL, gvec_vvv, MO_16, tcg_gen_gvec_umin)
-TRANS(vmin_wu, ALL, gvec_vvv, MO_32, tcg_gen_gvec_umin)
-TRANS(vmin_du, ALL, gvec_vvv, MO_64, tcg_gen_gvec_umin)
+TRANS(vmin_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_smin)
+TRANS(vmin_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_smin)
+TRANS(vmin_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_smin)
+TRANS(vmin_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_smin)
+TRANS(vmin_bu, LSX, gvec_vvv, MO_8, tcg_gen_gvec_umin)
+TRANS(vmin_hu, LSX, gvec_vvv, MO_16, tcg_gen_gvec_umin)
+TRANS(vmin_wu, LSX, gvec_vvv, MO_32, tcg_gen_gvec_umin)
+TRANS(vmin_du, LSX, gvec_vvv, MO_64, tcg_gen_gvec_umin)
 
 static void gen_vmini_s(unsigned vece, TCGv_vec t, TCGv_vec a, int64_t imm)
 {
@@ -1473,14 +1477,14 @@ static void do_vmini_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vmini_b, ALL, gvec_vv_i, MO_8, do_vmini_s)
-TRANS(vmini_h, ALL, gvec_vv_i, MO_16, do_vmini_s)
-TRANS(vmini_w, ALL, gvec_vv_i, MO_32, do_vmini_s)
-TRANS(vmini_d, ALL, gvec_vv_i, MO_64, do_vmini_s)
-TRANS(vmini_bu, ALL, gvec_vv_i, MO_8, do_vmini_u)
-TRANS(vmini_hu, ALL, gvec_vv_i, MO_16, do_vmini_u)
-TRANS(vmini_wu, ALL, gvec_vv_i, MO_32, do_vmini_u)
-TRANS(vmini_du, ALL, gvec_vv_i, MO_64, do_vmini_u)
+TRANS(vmini_b, LSX, gvec_vv_i, MO_8, do_vmini_s)
+TRANS(vmini_h, LSX, gvec_vv_i, MO_16, do_vmini_s)
+TRANS(vmini_w, LSX, gvec_vv_i, MO_32, do_vmini_s)
+TRANS(vmini_d, LSX, gvec_vv_i, MO_64, do_vmini_s)
+TRANS(vmini_bu, LSX, gvec_vv_i, MO_8, do_vmini_u)
+TRANS(vmini_hu, LSX, gvec_vv_i, MO_16, do_vmini_u)
+TRANS(vmini_wu, LSX, gvec_vv_i, MO_32, do_vmini_u)
+TRANS(vmini_du, LSX, gvec_vv_i, MO_64, do_vmini_u)
 
 static void do_vmaxi_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        int64_t imm, uint32_t oprsz, uint32_t maxsz)
@@ -1554,19 +1558,19 @@ static void do_vmaxi_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vmaxi_b, ALL, gvec_vv_i, MO_8, do_vmaxi_s)
-TRANS(vmaxi_h, ALL, gvec_vv_i, MO_16, do_vmaxi_s)
-TRANS(vmaxi_w, ALL, gvec_vv_i, MO_32, do_vmaxi_s)
-TRANS(vmaxi_d, ALL, gvec_vv_i, MO_64, do_vmaxi_s)
-TRANS(vmaxi_bu, ALL, gvec_vv_i, MO_8, do_vmaxi_u)
-TRANS(vmaxi_hu, ALL, gvec_vv_i, MO_16, do_vmaxi_u)
-TRANS(vmaxi_wu, ALL, gvec_vv_i, MO_32, do_vmaxi_u)
-TRANS(vmaxi_du, ALL, gvec_vv_i, MO_64, do_vmaxi_u)
+TRANS(vmaxi_b, LSX, gvec_vv_i, MO_8, do_vmaxi_s)
+TRANS(vmaxi_h, LSX, gvec_vv_i, MO_16, do_vmaxi_s)
+TRANS(vmaxi_w, LSX, gvec_vv_i, MO_32, do_vmaxi_s)
+TRANS(vmaxi_d, LSX, gvec_vv_i, MO_64, do_vmaxi_s)
+TRANS(vmaxi_bu, LSX, gvec_vv_i, MO_8, do_vmaxi_u)
+TRANS(vmaxi_hu, LSX, gvec_vv_i, MO_16, do_vmaxi_u)
+TRANS(vmaxi_wu, LSX, gvec_vv_i, MO_32, do_vmaxi_u)
+TRANS(vmaxi_du, LSX, gvec_vv_i, MO_64, do_vmaxi_u)
 
-TRANS(vmul_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_mul)
-TRANS(vmul_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_mul)
-TRANS(vmul_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_mul)
-TRANS(vmul_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_mul)
+TRANS(vmul_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_mul)
+TRANS(vmul_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_mul)
+TRANS(vmul_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_mul)
+TRANS(vmul_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_mul)
 
 static void gen_vmuh_w(TCGv_i32 t, TCGv_i32 a, TCGv_i32 b)
 {
@@ -1607,10 +1611,10 @@ static void do_vmuh_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmuh_b, ALL, gvec_vvv, MO_8, do_vmuh_s)
-TRANS(vmuh_h, ALL, gvec_vvv, MO_16, do_vmuh_s)
-TRANS(vmuh_w, ALL, gvec_vvv, MO_32, do_vmuh_s)
-TRANS(vmuh_d, ALL, gvec_vvv, MO_64, do_vmuh_s)
+TRANS(vmuh_b, LSX, gvec_vvv, MO_8, do_vmuh_s)
+TRANS(vmuh_h, LSX, gvec_vvv, MO_16, do_vmuh_s)
+TRANS(vmuh_w, LSX, gvec_vvv, MO_32, do_vmuh_s)
+TRANS(vmuh_d, LSX, gvec_vvv, MO_64, do_vmuh_s)
 
 static void gen_vmuh_wu(TCGv_i32 t, TCGv_i32 a, TCGv_i32 b)
 {
@@ -1651,10 +1655,10 @@ static void do_vmuh_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmuh_bu, ALL, gvec_vvv, MO_8,  do_vmuh_u)
-TRANS(vmuh_hu, ALL, gvec_vvv, MO_16, do_vmuh_u)
-TRANS(vmuh_wu, ALL, gvec_vvv, MO_32, do_vmuh_u)
-TRANS(vmuh_du, ALL, gvec_vvv, MO_64, do_vmuh_u)
+TRANS(vmuh_bu, LSX, gvec_vvv, MO_8,  do_vmuh_u)
+TRANS(vmuh_hu, LSX, gvec_vvv, MO_16, do_vmuh_u)
+TRANS(vmuh_wu, LSX, gvec_vvv, MO_32, do_vmuh_u)
+TRANS(vmuh_du, LSX, gvec_vvv, MO_64, do_vmuh_u)
 
 static void gen_vmulwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1724,9 +1728,9 @@ static void do_vmulwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwev_h_b, ALL, gvec_vvv, MO_8, do_vmulwev_s)
-TRANS(vmulwev_w_h, ALL, gvec_vvv, MO_16, do_vmulwev_s)
-TRANS(vmulwev_d_w, ALL, gvec_vvv, MO_32, do_vmulwev_s)
+TRANS(vmulwev_h_b, LSX, gvec_vvv, MO_8, do_vmulwev_s)
+TRANS(vmulwev_w_h, LSX, gvec_vvv, MO_16, do_vmulwev_s)
+TRANS(vmulwev_d_w, LSX, gvec_vvv, MO_32, do_vmulwev_s)
 
 static void tcg_gen_mulus2_i64(TCGv_i64 rl, TCGv_i64 rh,
                                TCGv_i64 arg1, TCGv_i64 arg2)
@@ -1739,6 +1743,10 @@ static bool trans_## NAME (DisasContext *ctx, arg_vvv *a) \
 {                                                         \
     TCGv_i64 rh, rl, arg1, arg2;                          \
                                                           \
+    if (!avail_LSX(ctx)) {                                \
+        return false;                                     \
+    }                                                     \
+                                                          \
     rh = tcg_temp_new_i64();                              \
     rl = tcg_temp_new_i64();                              \
     arg1 = tcg_temp_new_i64();                            \
@@ -1828,9 +1836,9 @@ static void do_vmulwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwod_h_b, ALL, gvec_vvv, MO_8, do_vmulwod_s)
-TRANS(vmulwod_w_h, ALL, gvec_vvv, MO_16, do_vmulwod_s)
-TRANS(vmulwod_d_w, ALL, gvec_vvv, MO_32, do_vmulwod_s)
+TRANS(vmulwod_h_b, LSX, gvec_vvv, MO_8, do_vmulwod_s)
+TRANS(vmulwod_w_h, LSX, gvec_vvv, MO_16, do_vmulwod_s)
+TRANS(vmulwod_d_w, LSX, gvec_vvv, MO_32, do_vmulwod_s)
 
 static void gen_vmulwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1898,9 +1906,9 @@ static void do_vmulwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwev_h_bu, ALL, gvec_vvv, MO_8, do_vmulwev_u)
-TRANS(vmulwev_w_hu, ALL, gvec_vvv, MO_16, do_vmulwev_u)
-TRANS(vmulwev_d_wu, ALL, gvec_vvv, MO_32, do_vmulwev_u)
+TRANS(vmulwev_h_bu, LSX, gvec_vvv, MO_8, do_vmulwev_u)
+TRANS(vmulwev_w_hu, LSX, gvec_vvv, MO_16, do_vmulwev_u)
+TRANS(vmulwev_d_wu, LSX, gvec_vvv, MO_32, do_vmulwev_u)
 
 static void gen_vmulwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -1968,9 +1976,9 @@ static void do_vmulwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwod_h_bu, ALL, gvec_vvv, MO_8, do_vmulwod_u)
-TRANS(vmulwod_w_hu, ALL, gvec_vvv, MO_16, do_vmulwod_u)
-TRANS(vmulwod_d_wu, ALL, gvec_vvv, MO_32, do_vmulwod_u)
+TRANS(vmulwod_h_bu, LSX, gvec_vvv, MO_8, do_vmulwod_u)
+TRANS(vmulwod_w_hu, LSX, gvec_vvv, MO_16, do_vmulwod_u)
+TRANS(vmulwod_d_wu, LSX, gvec_vvv, MO_32, do_vmulwod_u)
 
 static void gen_vmulwev_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2040,9 +2048,9 @@ static void do_vmulwev_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwev_h_bu_b, ALL, gvec_vvv, MO_8, do_vmulwev_u_s)
-TRANS(vmulwev_w_hu_h, ALL, gvec_vvv, MO_16, do_vmulwev_u_s)
-TRANS(vmulwev_d_wu_w, ALL, gvec_vvv, MO_32, do_vmulwev_u_s)
+TRANS(vmulwev_h_bu_b, LSX, gvec_vvv, MO_8, do_vmulwev_u_s)
+TRANS(vmulwev_w_hu_h, LSX, gvec_vvv, MO_16, do_vmulwev_u_s)
+TRANS(vmulwev_d_wu_w, LSX, gvec_vvv, MO_32, do_vmulwev_u_s)
 
 static void gen_vmulwod_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2109,9 +2117,9 @@ static void do_vmulwod_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmulwod_h_bu_b, ALL, gvec_vvv, MO_8, do_vmulwod_u_s)
-TRANS(vmulwod_w_hu_h, ALL, gvec_vvv, MO_16, do_vmulwod_u_s)
-TRANS(vmulwod_d_wu_w, ALL, gvec_vvv, MO_32, do_vmulwod_u_s)
+TRANS(vmulwod_h_bu_b, LSX, gvec_vvv, MO_8, do_vmulwod_u_s)
+TRANS(vmulwod_w_hu_h, LSX, gvec_vvv, MO_16, do_vmulwod_u_s)
+TRANS(vmulwod_d_wu_w, LSX, gvec_vvv, MO_32, do_vmulwod_u_s)
 
 static void gen_vmadd(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2182,10 +2190,10 @@ static void do_vmadd(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmadd_b, ALL, gvec_vvv, MO_8, do_vmadd)
-TRANS(vmadd_h, ALL, gvec_vvv, MO_16, do_vmadd)
-TRANS(vmadd_w, ALL, gvec_vvv, MO_32, do_vmadd)
-TRANS(vmadd_d, ALL, gvec_vvv, MO_64, do_vmadd)
+TRANS(vmadd_b, LSX, gvec_vvv, MO_8, do_vmadd)
+TRANS(vmadd_h, LSX, gvec_vvv, MO_16, do_vmadd)
+TRANS(vmadd_w, LSX, gvec_vvv, MO_32, do_vmadd)
+TRANS(vmadd_d, LSX, gvec_vvv, MO_64, do_vmadd)
 
 static void gen_vmsub(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2256,10 +2264,10 @@ static void do_vmsub(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmsub_b, ALL, gvec_vvv, MO_8, do_vmsub)
-TRANS(vmsub_h, ALL, gvec_vvv, MO_16, do_vmsub)
-TRANS(vmsub_w, ALL, gvec_vvv, MO_32, do_vmsub)
-TRANS(vmsub_d, ALL, gvec_vvv, MO_64, do_vmsub)
+TRANS(vmsub_b, LSX, gvec_vvv, MO_8, do_vmsub)
+TRANS(vmsub_h, LSX, gvec_vvv, MO_16, do_vmsub)
+TRANS(vmsub_w, LSX, gvec_vvv, MO_32, do_vmsub)
+TRANS(vmsub_d, LSX, gvec_vvv, MO_64, do_vmsub)
 
 static void gen_vmaddwev_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2331,15 +2339,19 @@ static void do_vmaddwev_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwev_h_b, ALL, gvec_vvv, MO_8, do_vmaddwev_s)
-TRANS(vmaddwev_w_h, ALL, gvec_vvv, MO_16, do_vmaddwev_s)
-TRANS(vmaddwev_d_w, ALL, gvec_vvv, MO_32, do_vmaddwev_s)
+TRANS(vmaddwev_h_b, LSX, gvec_vvv, MO_8, do_vmaddwev_s)
+TRANS(vmaddwev_w_h, LSX, gvec_vvv, MO_16, do_vmaddwev_s)
+TRANS(vmaddwev_d_w, LSX, gvec_vvv, MO_32, do_vmaddwev_s)
 
 #define VMADD_Q(NAME, FN, idx1, idx2)                     \
 static bool trans_## NAME (DisasContext *ctx, arg_vvv *a) \
 {                                                         \
     TCGv_i64 rh, rl, arg1, arg2, th, tl;                  \
                                                           \
+    if (!avail_LSX(ctx)) {                                \
+        return false;                                     \
+    }                                                     \
+                                                          \
     rh = tcg_temp_new_i64();                              \
     rl = tcg_temp_new_i64();                              \
     arg1 = tcg_temp_new_i64();                            \
@@ -2435,9 +2447,9 @@ static void do_vmaddwod_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwod_h_b, ALL, gvec_vvv, MO_8, do_vmaddwod_s)
-TRANS(vmaddwod_w_h, ALL, gvec_vvv, MO_16, do_vmaddwod_s)
-TRANS(vmaddwod_d_w, ALL, gvec_vvv, MO_32, do_vmaddwod_s)
+TRANS(vmaddwod_h_b, LSX, gvec_vvv, MO_8, do_vmaddwod_s)
+TRANS(vmaddwod_w_h, LSX, gvec_vvv, MO_16, do_vmaddwod_s)
+TRANS(vmaddwod_d_w, LSX, gvec_vvv, MO_32, do_vmaddwod_s)
 
 static void gen_vmaddwev_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2505,9 +2517,9 @@ static void do_vmaddwev_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwev_h_bu, ALL, gvec_vvv, MO_8, do_vmaddwev_u)
-TRANS(vmaddwev_w_hu, ALL, gvec_vvv, MO_16, do_vmaddwev_u)
-TRANS(vmaddwev_d_wu, ALL, gvec_vvv, MO_32, do_vmaddwev_u)
+TRANS(vmaddwev_h_bu, LSX, gvec_vvv, MO_8, do_vmaddwev_u)
+TRANS(vmaddwev_w_hu, LSX, gvec_vvv, MO_16, do_vmaddwev_u)
+TRANS(vmaddwev_d_wu, LSX, gvec_vvv, MO_32, do_vmaddwev_u)
 
 static void gen_vmaddwod_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2576,9 +2588,9 @@ static void do_vmaddwod_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwod_h_bu, ALL, gvec_vvv, MO_8, do_vmaddwod_u)
-TRANS(vmaddwod_w_hu, ALL, gvec_vvv, MO_16, do_vmaddwod_u)
-TRANS(vmaddwod_d_wu, ALL, gvec_vvv, MO_32, do_vmaddwod_u)
+TRANS(vmaddwod_h_bu, LSX, gvec_vvv, MO_8, do_vmaddwod_u)
+TRANS(vmaddwod_w_hu, LSX, gvec_vvv, MO_16, do_vmaddwod_u)
+TRANS(vmaddwod_d_wu, LSX, gvec_vvv, MO_32, do_vmaddwod_u)
 
 static void gen_vmaddwev_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2649,9 +2661,9 @@ static void do_vmaddwev_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwev_h_bu_b, ALL, gvec_vvv, MO_8, do_vmaddwev_u_s)
-TRANS(vmaddwev_w_hu_h, ALL, gvec_vvv, MO_16, do_vmaddwev_u_s)
-TRANS(vmaddwev_d_wu_w, ALL, gvec_vvv, MO_32, do_vmaddwev_u_s)
+TRANS(vmaddwev_h_bu_b, LSX, gvec_vvv, MO_8, do_vmaddwev_u_s)
+TRANS(vmaddwev_w_hu_h, LSX, gvec_vvv, MO_16, do_vmaddwev_u_s)
+TRANS(vmaddwev_d_wu_w, LSX, gvec_vvv, MO_32, do_vmaddwev_u_s)
 
 static void gen_vmaddwod_u_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2721,26 +2733,26 @@ static void do_vmaddwod_u_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vmaddwod_h_bu_b, ALL, gvec_vvv, MO_8, do_vmaddwod_u_s)
-TRANS(vmaddwod_w_hu_h, ALL, gvec_vvv, MO_16, do_vmaddwod_u_s)
-TRANS(vmaddwod_d_wu_w, ALL, gvec_vvv, MO_32, do_vmaddwod_u_s)
+TRANS(vmaddwod_h_bu_b, LSX, gvec_vvv, MO_8, do_vmaddwod_u_s)
+TRANS(vmaddwod_w_hu_h, LSX, gvec_vvv, MO_16, do_vmaddwod_u_s)
+TRANS(vmaddwod_d_wu_w, LSX, gvec_vvv, MO_32, do_vmaddwod_u_s)
 
-TRANS(vdiv_b, ALL, gen_vvv, gen_helper_vdiv_b)
-TRANS(vdiv_h, ALL, gen_vvv, gen_helper_vdiv_h)
-TRANS(vdiv_w, ALL, gen_vvv, gen_helper_vdiv_w)
-TRANS(vdiv_d, ALL, gen_vvv, gen_helper_vdiv_d)
-TRANS(vdiv_bu, ALL, gen_vvv, gen_helper_vdiv_bu)
-TRANS(vdiv_hu, ALL, gen_vvv, gen_helper_vdiv_hu)
-TRANS(vdiv_wu, ALL, gen_vvv, gen_helper_vdiv_wu)
-TRANS(vdiv_du, ALL, gen_vvv, gen_helper_vdiv_du)
-TRANS(vmod_b, ALL, gen_vvv, gen_helper_vmod_b)
-TRANS(vmod_h, ALL, gen_vvv, gen_helper_vmod_h)
-TRANS(vmod_w, ALL, gen_vvv, gen_helper_vmod_w)
-TRANS(vmod_d, ALL, gen_vvv, gen_helper_vmod_d)
-TRANS(vmod_bu, ALL, gen_vvv, gen_helper_vmod_bu)
-TRANS(vmod_hu, ALL, gen_vvv, gen_helper_vmod_hu)
-TRANS(vmod_wu, ALL, gen_vvv, gen_helper_vmod_wu)
-TRANS(vmod_du, ALL, gen_vvv, gen_helper_vmod_du)
+TRANS(vdiv_b, LSX, gen_vvv, gen_helper_vdiv_b)
+TRANS(vdiv_h, LSX, gen_vvv, gen_helper_vdiv_h)
+TRANS(vdiv_w, LSX, gen_vvv, gen_helper_vdiv_w)
+TRANS(vdiv_d, LSX, gen_vvv, gen_helper_vdiv_d)
+TRANS(vdiv_bu, LSX, gen_vvv, gen_helper_vdiv_bu)
+TRANS(vdiv_hu, LSX, gen_vvv, gen_helper_vdiv_hu)
+TRANS(vdiv_wu, LSX, gen_vvv, gen_helper_vdiv_wu)
+TRANS(vdiv_du, LSX, gen_vvv, gen_helper_vdiv_du)
+TRANS(vmod_b, LSX, gen_vvv, gen_helper_vmod_b)
+TRANS(vmod_h, LSX, gen_vvv, gen_helper_vmod_h)
+TRANS(vmod_w, LSX, gen_vvv, gen_helper_vmod_w)
+TRANS(vmod_d, LSX, gen_vvv, gen_helper_vmod_d)
+TRANS(vmod_bu, LSX, gen_vvv, gen_helper_vmod_bu)
+TRANS(vmod_hu, LSX, gen_vvv, gen_helper_vmod_hu)
+TRANS(vmod_wu, LSX, gen_vvv, gen_helper_vmod_wu)
+TRANS(vmod_du, LSX, gen_vvv, gen_helper_vmod_du)
 
 static void gen_vsat_s(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec max)
 {
@@ -2789,10 +2801,10 @@ static void do_vsat_s(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                     tcg_constant_i64((1ll<< imm) -1), &op[vece]);
 }
 
-TRANS(vsat_b, ALL, gvec_vv_i, MO_8, do_vsat_s)
-TRANS(vsat_h, ALL, gvec_vv_i, MO_16, do_vsat_s)
-TRANS(vsat_w, ALL, gvec_vv_i, MO_32, do_vsat_s)
-TRANS(vsat_d, ALL, gvec_vv_i, MO_64, do_vsat_s)
+TRANS(vsat_b, LSX, gvec_vv_i, MO_8, do_vsat_s)
+TRANS(vsat_h, LSX, gvec_vv_i, MO_16, do_vsat_s)
+TRANS(vsat_w, LSX, gvec_vv_i, MO_32, do_vsat_s)
+TRANS(vsat_d, LSX, gvec_vv_i, MO_64, do_vsat_s)
 
 static void gen_vsat_u(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec max)
 {
@@ -2838,19 +2850,19 @@ static void do_vsat_u(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                     tcg_constant_i64(max), &op[vece]);
 }
 
-TRANS(vsat_bu, ALL, gvec_vv_i, MO_8, do_vsat_u)
-TRANS(vsat_hu, ALL, gvec_vv_i, MO_16, do_vsat_u)
-TRANS(vsat_wu, ALL, gvec_vv_i, MO_32, do_vsat_u)
-TRANS(vsat_du, ALL, gvec_vv_i, MO_64, do_vsat_u)
+TRANS(vsat_bu, LSX, gvec_vv_i, MO_8, do_vsat_u)
+TRANS(vsat_hu, LSX, gvec_vv_i, MO_16, do_vsat_u)
+TRANS(vsat_wu, LSX, gvec_vv_i, MO_32, do_vsat_u)
+TRANS(vsat_du, LSX, gvec_vv_i, MO_64, do_vsat_u)
 
-TRANS(vexth_h_b, ALL, gen_vv, gen_helper_vexth_h_b)
-TRANS(vexth_w_h, ALL, gen_vv, gen_helper_vexth_w_h)
-TRANS(vexth_d_w, ALL, gen_vv, gen_helper_vexth_d_w)
-TRANS(vexth_q_d, ALL, gen_vv, gen_helper_vexth_q_d)
-TRANS(vexth_hu_bu, ALL, gen_vv, gen_helper_vexth_hu_bu)
-TRANS(vexth_wu_hu, ALL, gen_vv, gen_helper_vexth_wu_hu)
-TRANS(vexth_du_wu, ALL, gen_vv, gen_helper_vexth_du_wu)
-TRANS(vexth_qu_du, ALL, gen_vv, gen_helper_vexth_qu_du)
+TRANS(vexth_h_b, LSX, gen_vv, gen_helper_vexth_h_b)
+TRANS(vexth_w_h, LSX, gen_vv, gen_helper_vexth_w_h)
+TRANS(vexth_d_w, LSX, gen_vv, gen_helper_vexth_d_w)
+TRANS(vexth_q_d, LSX, gen_vv, gen_helper_vexth_q_d)
+TRANS(vexth_hu_bu, LSX, gen_vv, gen_helper_vexth_hu_bu)
+TRANS(vexth_wu_hu, LSX, gen_vv, gen_helper_vexth_wu_hu)
+TRANS(vexth_du_wu, LSX, gen_vv, gen_helper_vexth_du_wu)
+TRANS(vexth_qu_du, LSX, gen_vv, gen_helper_vexth_qu_du)
 
 static void gen_vsigncov(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b)
 {
@@ -2900,17 +2912,17 @@ static void do_vsigncov(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vsigncov_b, ALL, gvec_vvv, MO_8, do_vsigncov)
-TRANS(vsigncov_h, ALL, gvec_vvv, MO_16, do_vsigncov)
-TRANS(vsigncov_w, ALL, gvec_vvv, MO_32, do_vsigncov)
-TRANS(vsigncov_d, ALL, gvec_vvv, MO_64, do_vsigncov)
+TRANS(vsigncov_b, LSX, gvec_vvv, MO_8, do_vsigncov)
+TRANS(vsigncov_h, LSX, gvec_vvv, MO_16, do_vsigncov)
+TRANS(vsigncov_w, LSX, gvec_vvv, MO_32, do_vsigncov)
+TRANS(vsigncov_d, LSX, gvec_vvv, MO_64, do_vsigncov)
 
-TRANS(vmskltz_b, ALL, gen_vv, gen_helper_vmskltz_b)
-TRANS(vmskltz_h, ALL, gen_vv, gen_helper_vmskltz_h)
-TRANS(vmskltz_w, ALL, gen_vv, gen_helper_vmskltz_w)
-TRANS(vmskltz_d, ALL, gen_vv, gen_helper_vmskltz_d)
-TRANS(vmskgez_b, ALL, gen_vv, gen_helper_vmskgez_b)
-TRANS(vmsknz_b, ALL, gen_vv, gen_helper_vmsknz_b)
+TRANS(vmskltz_b, LSX, gen_vv, gen_helper_vmskltz_b)
+TRANS(vmskltz_h, LSX, gen_vv, gen_helper_vmskltz_h)
+TRANS(vmskltz_w, LSX, gen_vv, gen_helper_vmskltz_w)
+TRANS(vmskltz_d, LSX, gen_vv, gen_helper_vmskltz_d)
+TRANS(vmskgez_b, LSX, gen_vv, gen_helper_vmskgez_b)
+TRANS(vmsknz_b, LSX, gen_vv, gen_helper_vmsknz_b)
 
 #define EXPAND_BYTE(bit)  ((uint64_t)(bit ? 0xff : 0))
 
@@ -3032,6 +3044,11 @@ static bool trans_vldi(DisasContext *ctx, arg_vldi *a)
 {
     int sel, vece;
     uint64_t value;
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     sel = (a->imm >> 12) & 0x1;
@@ -3049,15 +3066,19 @@ static bool trans_vldi(DisasContext *ctx, arg_vldi *a)
     return true;
 }
 
-TRANS(vand_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_and)
-TRANS(vor_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_or)
-TRANS(vxor_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_xor)
-TRANS(vnor_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_nor)
+TRANS(vand_v, LSX, gvec_vvv, MO_64, tcg_gen_gvec_and)
+TRANS(vor_v, LSX, gvec_vvv, MO_64, tcg_gen_gvec_or)
+TRANS(vxor_v, LSX, gvec_vvv, MO_64, tcg_gen_gvec_xor)
+TRANS(vnor_v, LSX, gvec_vvv, MO_64, tcg_gen_gvec_nor)
 
 static bool trans_vandn_v(DisasContext *ctx, arg_vvv *a)
 {
     uint32_t vd_ofs, vj_ofs, vk_ofs;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     vd_ofs = vec_full_offset(a->vd);
@@ -3067,10 +3088,10 @@ static bool trans_vandn_v(DisasContext *ctx, arg_vvv *a)
     tcg_gen_gvec_andc(MO_64, vd_ofs, vk_ofs, vj_ofs, 16, ctx->vl/8);
     return true;
 }
-TRANS(vorn_v, ALL, gvec_vvv, MO_64, tcg_gen_gvec_orc)
-TRANS(vandi_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_andi)
-TRANS(vori_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_ori)
-TRANS(vxori_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_xori)
+TRANS(vorn_v, LSX, gvec_vvv, MO_64, tcg_gen_gvec_orc)
+TRANS(vandi_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_andi)
+TRANS(vori_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_ori)
+TRANS(vxori_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_xori)
 
 static void gen_vnori(unsigned vece, TCGv_vec t, TCGv_vec a, int64_t imm)
 {
@@ -3103,176 +3124,176 @@ static void do_vnori_b(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op);
 }
 
-TRANS(vnori_b, ALL, gvec_vv_i, MO_8, do_vnori_b)
+TRANS(vnori_b, LSX, gvec_vv_i, MO_8, do_vnori_b)
 
-TRANS(vsll_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_shlv)
-TRANS(vsll_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_shlv)
-TRANS(vsll_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_shlv)
-TRANS(vsll_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_shlv)
-TRANS(vslli_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_shli)
-TRANS(vslli_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_shli)
-TRANS(vslli_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_shli)
-TRANS(vslli_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_shli)
+TRANS(vsll_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_shlv)
+TRANS(vsll_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_shlv)
+TRANS(vsll_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_shlv)
+TRANS(vsll_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_shlv)
+TRANS(vslli_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_shli)
+TRANS(vslli_h, LSX, gvec_vv_i, MO_16, tcg_gen_gvec_shli)
+TRANS(vslli_w, LSX, gvec_vv_i, MO_32, tcg_gen_gvec_shli)
+TRANS(vslli_d, LSX, gvec_vv_i, MO_64, tcg_gen_gvec_shli)
 
-TRANS(vsrl_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_shrv)
-TRANS(vsrl_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_shrv)
-TRANS(vsrl_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_shrv)
-TRANS(vsrl_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_shrv)
-TRANS(vsrli_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_shri)
-TRANS(vsrli_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_shri)
-TRANS(vsrli_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_shri)
-TRANS(vsrli_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_shri)
+TRANS(vsrl_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_shrv)
+TRANS(vsrl_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_shrv)
+TRANS(vsrl_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_shrv)
+TRANS(vsrl_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_shrv)
+TRANS(vsrli_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_shri)
+TRANS(vsrli_h, LSX, gvec_vv_i, MO_16, tcg_gen_gvec_shri)
+TRANS(vsrli_w, LSX, gvec_vv_i, MO_32, tcg_gen_gvec_shri)
+TRANS(vsrli_d, LSX, gvec_vv_i, MO_64, tcg_gen_gvec_shri)
 
-TRANS(vsra_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_sarv)
-TRANS(vsra_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_sarv)
-TRANS(vsra_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_sarv)
-TRANS(vsra_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_sarv)
-TRANS(vsrai_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_sari)
-TRANS(vsrai_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_sari)
-TRANS(vsrai_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_sari)
-TRANS(vsrai_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_sari)
+TRANS(vsra_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_sarv)
+TRANS(vsra_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_sarv)
+TRANS(vsra_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_sarv)
+TRANS(vsra_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_sarv)
+TRANS(vsrai_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_sari)
+TRANS(vsrai_h, LSX, gvec_vv_i, MO_16, tcg_gen_gvec_sari)
+TRANS(vsrai_w, LSX, gvec_vv_i, MO_32, tcg_gen_gvec_sari)
+TRANS(vsrai_d, LSX, gvec_vv_i, MO_64, tcg_gen_gvec_sari)
 
-TRANS(vrotr_b, ALL, gvec_vvv, MO_8, tcg_gen_gvec_rotrv)
-TRANS(vrotr_h, ALL, gvec_vvv, MO_16, tcg_gen_gvec_rotrv)
-TRANS(vrotr_w, ALL, gvec_vvv, MO_32, tcg_gen_gvec_rotrv)
-TRANS(vrotr_d, ALL, gvec_vvv, MO_64, tcg_gen_gvec_rotrv)
-TRANS(vrotri_b, ALL, gvec_vv_i, MO_8, tcg_gen_gvec_rotri)
-TRANS(vrotri_h, ALL, gvec_vv_i, MO_16, tcg_gen_gvec_rotri)
-TRANS(vrotri_w, ALL, gvec_vv_i, MO_32, tcg_gen_gvec_rotri)
-TRANS(vrotri_d, ALL, gvec_vv_i, MO_64, tcg_gen_gvec_rotri)
+TRANS(vrotr_b, LSX, gvec_vvv, MO_8, tcg_gen_gvec_rotrv)
+TRANS(vrotr_h, LSX, gvec_vvv, MO_16, tcg_gen_gvec_rotrv)
+TRANS(vrotr_w, LSX, gvec_vvv, MO_32, tcg_gen_gvec_rotrv)
+TRANS(vrotr_d, LSX, gvec_vvv, MO_64, tcg_gen_gvec_rotrv)
+TRANS(vrotri_b, LSX, gvec_vv_i, MO_8, tcg_gen_gvec_rotri)
+TRANS(vrotri_h, LSX, gvec_vv_i, MO_16, tcg_gen_gvec_rotri)
+TRANS(vrotri_w, LSX, gvec_vv_i, MO_32, tcg_gen_gvec_rotri)
+TRANS(vrotri_d, LSX, gvec_vv_i, MO_64, tcg_gen_gvec_rotri)
 
-TRANS(vsllwil_h_b, ALL, gen_vv_i, gen_helper_vsllwil_h_b)
-TRANS(vsllwil_w_h, ALL, gen_vv_i, gen_helper_vsllwil_w_h)
-TRANS(vsllwil_d_w, ALL, gen_vv_i, gen_helper_vsllwil_d_w)
-TRANS(vextl_q_d, ALL, gen_vv, gen_helper_vextl_q_d)
-TRANS(vsllwil_hu_bu, ALL, gen_vv_i, gen_helper_vsllwil_hu_bu)
-TRANS(vsllwil_wu_hu, ALL, gen_vv_i, gen_helper_vsllwil_wu_hu)
-TRANS(vsllwil_du_wu, ALL, gen_vv_i, gen_helper_vsllwil_du_wu)
-TRANS(vextl_qu_du, ALL, gen_vv, gen_helper_vextl_qu_du)
+TRANS(vsllwil_h_b, LSX, gen_vv_i, gen_helper_vsllwil_h_b)
+TRANS(vsllwil_w_h, LSX, gen_vv_i, gen_helper_vsllwil_w_h)
+TRANS(vsllwil_d_w, LSX, gen_vv_i, gen_helper_vsllwil_d_w)
+TRANS(vextl_q_d, LSX, gen_vv, gen_helper_vextl_q_d)
+TRANS(vsllwil_hu_bu, LSX, gen_vv_i, gen_helper_vsllwil_hu_bu)
+TRANS(vsllwil_wu_hu, LSX, gen_vv_i, gen_helper_vsllwil_wu_hu)
+TRANS(vsllwil_du_wu, LSX, gen_vv_i, gen_helper_vsllwil_du_wu)
+TRANS(vextl_qu_du, LSX, gen_vv, gen_helper_vextl_qu_du)
 
-TRANS(vsrlr_b, ALL, gen_vvv, gen_helper_vsrlr_b)
-TRANS(vsrlr_h, ALL, gen_vvv, gen_helper_vsrlr_h)
-TRANS(vsrlr_w, ALL, gen_vvv, gen_helper_vsrlr_w)
-TRANS(vsrlr_d, ALL, gen_vvv, gen_helper_vsrlr_d)
-TRANS(vsrlri_b, ALL, gen_vv_i, gen_helper_vsrlri_b)
-TRANS(vsrlri_h, ALL, gen_vv_i, gen_helper_vsrlri_h)
-TRANS(vsrlri_w, ALL, gen_vv_i, gen_helper_vsrlri_w)
-TRANS(vsrlri_d, ALL, gen_vv_i, gen_helper_vsrlri_d)
+TRANS(vsrlr_b, LSX, gen_vvv, gen_helper_vsrlr_b)
+TRANS(vsrlr_h, LSX, gen_vvv, gen_helper_vsrlr_h)
+TRANS(vsrlr_w, LSX, gen_vvv, gen_helper_vsrlr_w)
+TRANS(vsrlr_d, LSX, gen_vvv, gen_helper_vsrlr_d)
+TRANS(vsrlri_b, LSX, gen_vv_i, gen_helper_vsrlri_b)
+TRANS(vsrlri_h, LSX, gen_vv_i, gen_helper_vsrlri_h)
+TRANS(vsrlri_w, LSX, gen_vv_i, gen_helper_vsrlri_w)
+TRANS(vsrlri_d, LSX, gen_vv_i, gen_helper_vsrlri_d)
 
-TRANS(vsrar_b, ALL, gen_vvv, gen_helper_vsrar_b)
-TRANS(vsrar_h, ALL, gen_vvv, gen_helper_vsrar_h)
-TRANS(vsrar_w, ALL, gen_vvv, gen_helper_vsrar_w)
-TRANS(vsrar_d, ALL, gen_vvv, gen_helper_vsrar_d)
-TRANS(vsrari_b, ALL, gen_vv_i, gen_helper_vsrari_b)
-TRANS(vsrari_h, ALL, gen_vv_i, gen_helper_vsrari_h)
-TRANS(vsrari_w, ALL, gen_vv_i, gen_helper_vsrari_w)
-TRANS(vsrari_d, ALL, gen_vv_i, gen_helper_vsrari_d)
+TRANS(vsrar_b, LSX, gen_vvv, gen_helper_vsrar_b)
+TRANS(vsrar_h, LSX, gen_vvv, gen_helper_vsrar_h)
+TRANS(vsrar_w, LSX, gen_vvv, gen_helper_vsrar_w)
+TRANS(vsrar_d, LSX, gen_vvv, gen_helper_vsrar_d)
+TRANS(vsrari_b, LSX, gen_vv_i, gen_helper_vsrari_b)
+TRANS(vsrari_h, LSX, gen_vv_i, gen_helper_vsrari_h)
+TRANS(vsrari_w, LSX, gen_vv_i, gen_helper_vsrari_w)
+TRANS(vsrari_d, LSX, gen_vv_i, gen_helper_vsrari_d)
 
-TRANS(vsrln_b_h, ALL, gen_vvv, gen_helper_vsrln_b_h)
-TRANS(vsrln_h_w, ALL, gen_vvv, gen_helper_vsrln_h_w)
-TRANS(vsrln_w_d, ALL, gen_vvv, gen_helper_vsrln_w_d)
-TRANS(vsran_b_h, ALL, gen_vvv, gen_helper_vsran_b_h)
-TRANS(vsran_h_w, ALL, gen_vvv, gen_helper_vsran_h_w)
-TRANS(vsran_w_d, ALL, gen_vvv, gen_helper_vsran_w_d)
+TRANS(vsrln_b_h, LSX, gen_vvv, gen_helper_vsrln_b_h)
+TRANS(vsrln_h_w, LSX, gen_vvv, gen_helper_vsrln_h_w)
+TRANS(vsrln_w_d, LSX, gen_vvv, gen_helper_vsrln_w_d)
+TRANS(vsran_b_h, LSX, gen_vvv, gen_helper_vsran_b_h)
+TRANS(vsran_h_w, LSX, gen_vvv, gen_helper_vsran_h_w)
+TRANS(vsran_w_d, LSX, gen_vvv, gen_helper_vsran_w_d)
 
-TRANS(vsrlni_b_h, ALL, gen_vv_i, gen_helper_vsrlni_b_h)
-TRANS(vsrlni_h_w, ALL, gen_vv_i, gen_helper_vsrlni_h_w)
-TRANS(vsrlni_w_d, ALL, gen_vv_i, gen_helper_vsrlni_w_d)
-TRANS(vsrlni_d_q, ALL, gen_vv_i, gen_helper_vsrlni_d_q)
-TRANS(vsrani_b_h, ALL, gen_vv_i, gen_helper_vsrani_b_h)
-TRANS(vsrani_h_w, ALL, gen_vv_i, gen_helper_vsrani_h_w)
-TRANS(vsrani_w_d, ALL, gen_vv_i, gen_helper_vsrani_w_d)
-TRANS(vsrani_d_q, ALL, gen_vv_i, gen_helper_vsrani_d_q)
+TRANS(vsrlni_b_h, LSX, gen_vv_i, gen_helper_vsrlni_b_h)
+TRANS(vsrlni_h_w, LSX, gen_vv_i, gen_helper_vsrlni_h_w)
+TRANS(vsrlni_w_d, LSX, gen_vv_i, gen_helper_vsrlni_w_d)
+TRANS(vsrlni_d_q, LSX, gen_vv_i, gen_helper_vsrlni_d_q)
+TRANS(vsrani_b_h, LSX, gen_vv_i, gen_helper_vsrani_b_h)
+TRANS(vsrani_h_w, LSX, gen_vv_i, gen_helper_vsrani_h_w)
+TRANS(vsrani_w_d, LSX, gen_vv_i, gen_helper_vsrani_w_d)
+TRANS(vsrani_d_q, LSX, gen_vv_i, gen_helper_vsrani_d_q)
 
-TRANS(vsrlrn_b_h, ALL, gen_vvv, gen_helper_vsrlrn_b_h)
-TRANS(vsrlrn_h_w, ALL, gen_vvv, gen_helper_vsrlrn_h_w)
-TRANS(vsrlrn_w_d, ALL, gen_vvv, gen_helper_vsrlrn_w_d)
-TRANS(vsrarn_b_h, ALL, gen_vvv, gen_helper_vsrarn_b_h)
-TRANS(vsrarn_h_w, ALL, gen_vvv, gen_helper_vsrarn_h_w)
-TRANS(vsrarn_w_d, ALL, gen_vvv, gen_helper_vsrarn_w_d)
+TRANS(vsrlrn_b_h, LSX, gen_vvv, gen_helper_vsrlrn_b_h)
+TRANS(vsrlrn_h_w, LSX, gen_vvv, gen_helper_vsrlrn_h_w)
+TRANS(vsrlrn_w_d, LSX, gen_vvv, gen_helper_vsrlrn_w_d)
+TRANS(vsrarn_b_h, LSX, gen_vvv, gen_helper_vsrarn_b_h)
+TRANS(vsrarn_h_w, LSX, gen_vvv, gen_helper_vsrarn_h_w)
+TRANS(vsrarn_w_d, LSX, gen_vvv, gen_helper_vsrarn_w_d)
 
-TRANS(vsrlrni_b_h, ALL, gen_vv_i, gen_helper_vsrlrni_b_h)
-TRANS(vsrlrni_h_w, ALL, gen_vv_i, gen_helper_vsrlrni_h_w)
-TRANS(vsrlrni_w_d, ALL, gen_vv_i, gen_helper_vsrlrni_w_d)
-TRANS(vsrlrni_d_q, ALL, gen_vv_i, gen_helper_vsrlrni_d_q)
-TRANS(vsrarni_b_h, ALL, gen_vv_i, gen_helper_vsrarni_b_h)
-TRANS(vsrarni_h_w, ALL, gen_vv_i, gen_helper_vsrarni_h_w)
-TRANS(vsrarni_w_d, ALL, gen_vv_i, gen_helper_vsrarni_w_d)
-TRANS(vsrarni_d_q, ALL, gen_vv_i, gen_helper_vsrarni_d_q)
+TRANS(vsrlrni_b_h, LSX, gen_vv_i, gen_helper_vsrlrni_b_h)
+TRANS(vsrlrni_h_w, LSX, gen_vv_i, gen_helper_vsrlrni_h_w)
+TRANS(vsrlrni_w_d, LSX, gen_vv_i, gen_helper_vsrlrni_w_d)
+TRANS(vsrlrni_d_q, LSX, gen_vv_i, gen_helper_vsrlrni_d_q)
+TRANS(vsrarni_b_h, LSX, gen_vv_i, gen_helper_vsrarni_b_h)
+TRANS(vsrarni_h_w, LSX, gen_vv_i, gen_helper_vsrarni_h_w)
+TRANS(vsrarni_w_d, LSX, gen_vv_i, gen_helper_vsrarni_w_d)
+TRANS(vsrarni_d_q, LSX, gen_vv_i, gen_helper_vsrarni_d_q)
 
-TRANS(vssrln_b_h, ALL, gen_vvv, gen_helper_vssrln_b_h)
-TRANS(vssrln_h_w, ALL, gen_vvv, gen_helper_vssrln_h_w)
-TRANS(vssrln_w_d, ALL, gen_vvv, gen_helper_vssrln_w_d)
-TRANS(vssran_b_h, ALL, gen_vvv, gen_helper_vssran_b_h)
-TRANS(vssran_h_w, ALL, gen_vvv, gen_helper_vssran_h_w)
-TRANS(vssran_w_d, ALL, gen_vvv, gen_helper_vssran_w_d)
-TRANS(vssrln_bu_h, ALL, gen_vvv, gen_helper_vssrln_bu_h)
-TRANS(vssrln_hu_w, ALL, gen_vvv, gen_helper_vssrln_hu_w)
-TRANS(vssrln_wu_d, ALL, gen_vvv, gen_helper_vssrln_wu_d)
-TRANS(vssran_bu_h, ALL, gen_vvv, gen_helper_vssran_bu_h)
-TRANS(vssran_hu_w, ALL, gen_vvv, gen_helper_vssran_hu_w)
-TRANS(vssran_wu_d, ALL, gen_vvv, gen_helper_vssran_wu_d)
+TRANS(vssrln_b_h, LSX, gen_vvv, gen_helper_vssrln_b_h)
+TRANS(vssrln_h_w, LSX, gen_vvv, gen_helper_vssrln_h_w)
+TRANS(vssrln_w_d, LSX, gen_vvv, gen_helper_vssrln_w_d)
+TRANS(vssran_b_h, LSX, gen_vvv, gen_helper_vssran_b_h)
+TRANS(vssran_h_w, LSX, gen_vvv, gen_helper_vssran_h_w)
+TRANS(vssran_w_d, LSX, gen_vvv, gen_helper_vssran_w_d)
+TRANS(vssrln_bu_h, LSX, gen_vvv, gen_helper_vssrln_bu_h)
+TRANS(vssrln_hu_w, LSX, gen_vvv, gen_helper_vssrln_hu_w)
+TRANS(vssrln_wu_d, LSX, gen_vvv, gen_helper_vssrln_wu_d)
+TRANS(vssran_bu_h, LSX, gen_vvv, gen_helper_vssran_bu_h)
+TRANS(vssran_hu_w, LSX, gen_vvv, gen_helper_vssran_hu_w)
+TRANS(vssran_wu_d, LSX, gen_vvv, gen_helper_vssran_wu_d)
 
-TRANS(vssrlni_b_h, ALL, gen_vv_i, gen_helper_vssrlni_b_h)
-TRANS(vssrlni_h_w, ALL, gen_vv_i, gen_helper_vssrlni_h_w)
-TRANS(vssrlni_w_d, ALL, gen_vv_i, gen_helper_vssrlni_w_d)
-TRANS(vssrlni_d_q, ALL, gen_vv_i, gen_helper_vssrlni_d_q)
-TRANS(vssrani_b_h, ALL, gen_vv_i, gen_helper_vssrani_b_h)
-TRANS(vssrani_h_w, ALL, gen_vv_i, gen_helper_vssrani_h_w)
-TRANS(vssrani_w_d, ALL, gen_vv_i, gen_helper_vssrani_w_d)
-TRANS(vssrani_d_q, ALL, gen_vv_i, gen_helper_vssrani_d_q)
-TRANS(vssrlni_bu_h, ALL, gen_vv_i, gen_helper_vssrlni_bu_h)
-TRANS(vssrlni_hu_w, ALL, gen_vv_i, gen_helper_vssrlni_hu_w)
-TRANS(vssrlni_wu_d, ALL, gen_vv_i, gen_helper_vssrlni_wu_d)
-TRANS(vssrlni_du_q, ALL, gen_vv_i, gen_helper_vssrlni_du_q)
-TRANS(vssrani_bu_h, ALL, gen_vv_i, gen_helper_vssrani_bu_h)
-TRANS(vssrani_hu_w, ALL, gen_vv_i, gen_helper_vssrani_hu_w)
-TRANS(vssrani_wu_d, ALL, gen_vv_i, gen_helper_vssrani_wu_d)
-TRANS(vssrani_du_q, ALL, gen_vv_i, gen_helper_vssrani_du_q)
+TRANS(vssrlni_b_h, LSX, gen_vv_i, gen_helper_vssrlni_b_h)
+TRANS(vssrlni_h_w, LSX, gen_vv_i, gen_helper_vssrlni_h_w)
+TRANS(vssrlni_w_d, LSX, gen_vv_i, gen_helper_vssrlni_w_d)
+TRANS(vssrlni_d_q, LSX, gen_vv_i, gen_helper_vssrlni_d_q)
+TRANS(vssrani_b_h, LSX, gen_vv_i, gen_helper_vssrani_b_h)
+TRANS(vssrani_h_w, LSX, gen_vv_i, gen_helper_vssrani_h_w)
+TRANS(vssrani_w_d, LSX, gen_vv_i, gen_helper_vssrani_w_d)
+TRANS(vssrani_d_q, LSX, gen_vv_i, gen_helper_vssrani_d_q)
+TRANS(vssrlni_bu_h, LSX, gen_vv_i, gen_helper_vssrlni_bu_h)
+TRANS(vssrlni_hu_w, LSX, gen_vv_i, gen_helper_vssrlni_hu_w)
+TRANS(vssrlni_wu_d, LSX, gen_vv_i, gen_helper_vssrlni_wu_d)
+TRANS(vssrlni_du_q, LSX, gen_vv_i, gen_helper_vssrlni_du_q)
+TRANS(vssrani_bu_h, LSX, gen_vv_i, gen_helper_vssrani_bu_h)
+TRANS(vssrani_hu_w, LSX, gen_vv_i, gen_helper_vssrani_hu_w)
+TRANS(vssrani_wu_d, LSX, gen_vv_i, gen_helper_vssrani_wu_d)
+TRANS(vssrani_du_q, LSX, gen_vv_i, gen_helper_vssrani_du_q)
 
-TRANS(vssrlrn_b_h, ALL, gen_vvv, gen_helper_vssrlrn_b_h)
-TRANS(vssrlrn_h_w, ALL, gen_vvv, gen_helper_vssrlrn_h_w)
-TRANS(vssrlrn_w_d, ALL, gen_vvv, gen_helper_vssrlrn_w_d)
-TRANS(vssrarn_b_h, ALL, gen_vvv, gen_helper_vssrarn_b_h)
-TRANS(vssrarn_h_w, ALL, gen_vvv, gen_helper_vssrarn_h_w)
-TRANS(vssrarn_w_d, ALL, gen_vvv, gen_helper_vssrarn_w_d)
-TRANS(vssrlrn_bu_h, ALL, gen_vvv, gen_helper_vssrlrn_bu_h)
-TRANS(vssrlrn_hu_w, ALL, gen_vvv, gen_helper_vssrlrn_hu_w)
-TRANS(vssrlrn_wu_d, ALL, gen_vvv, gen_helper_vssrlrn_wu_d)
-TRANS(vssrarn_bu_h, ALL, gen_vvv, gen_helper_vssrarn_bu_h)
-TRANS(vssrarn_hu_w, ALL, gen_vvv, gen_helper_vssrarn_hu_w)
-TRANS(vssrarn_wu_d, ALL, gen_vvv, gen_helper_vssrarn_wu_d)
+TRANS(vssrlrn_b_h, LSX, gen_vvv, gen_helper_vssrlrn_b_h)
+TRANS(vssrlrn_h_w, LSX, gen_vvv, gen_helper_vssrlrn_h_w)
+TRANS(vssrlrn_w_d, LSX, gen_vvv, gen_helper_vssrlrn_w_d)
+TRANS(vssrarn_b_h, LSX, gen_vvv, gen_helper_vssrarn_b_h)
+TRANS(vssrarn_h_w, LSX, gen_vvv, gen_helper_vssrarn_h_w)
+TRANS(vssrarn_w_d, LSX, gen_vvv, gen_helper_vssrarn_w_d)
+TRANS(vssrlrn_bu_h, LSX, gen_vvv, gen_helper_vssrlrn_bu_h)
+TRANS(vssrlrn_hu_w, LSX, gen_vvv, gen_helper_vssrlrn_hu_w)
+TRANS(vssrlrn_wu_d, LSX, gen_vvv, gen_helper_vssrlrn_wu_d)
+TRANS(vssrarn_bu_h, LSX, gen_vvv, gen_helper_vssrarn_bu_h)
+TRANS(vssrarn_hu_w, LSX, gen_vvv, gen_helper_vssrarn_hu_w)
+TRANS(vssrarn_wu_d, LSX, gen_vvv, gen_helper_vssrarn_wu_d)
 
-TRANS(vssrlrni_b_h, ALL, gen_vv_i, gen_helper_vssrlrni_b_h)
-TRANS(vssrlrni_h_w, ALL, gen_vv_i, gen_helper_vssrlrni_h_w)
-TRANS(vssrlrni_w_d, ALL, gen_vv_i, gen_helper_vssrlrni_w_d)
-TRANS(vssrlrni_d_q, ALL, gen_vv_i, gen_helper_vssrlrni_d_q)
-TRANS(vssrarni_b_h, ALL, gen_vv_i, gen_helper_vssrarni_b_h)
-TRANS(vssrarni_h_w, ALL, gen_vv_i, gen_helper_vssrarni_h_w)
-TRANS(vssrarni_w_d, ALL, gen_vv_i, gen_helper_vssrarni_w_d)
-TRANS(vssrarni_d_q, ALL, gen_vv_i, gen_helper_vssrarni_d_q)
-TRANS(vssrlrni_bu_h, ALL, gen_vv_i, gen_helper_vssrlrni_bu_h)
-TRANS(vssrlrni_hu_w, ALL, gen_vv_i, gen_helper_vssrlrni_hu_w)
-TRANS(vssrlrni_wu_d, ALL, gen_vv_i, gen_helper_vssrlrni_wu_d)
-TRANS(vssrlrni_du_q, ALL, gen_vv_i, gen_helper_vssrlrni_du_q)
-TRANS(vssrarni_bu_h, ALL, gen_vv_i, gen_helper_vssrarni_bu_h)
-TRANS(vssrarni_hu_w, ALL, gen_vv_i, gen_helper_vssrarni_hu_w)
-TRANS(vssrarni_wu_d, ALL, gen_vv_i, gen_helper_vssrarni_wu_d)
-TRANS(vssrarni_du_q, ALL, gen_vv_i, gen_helper_vssrarni_du_q)
+TRANS(vssrlrni_b_h, LSX, gen_vv_i, gen_helper_vssrlrni_b_h)
+TRANS(vssrlrni_h_w, LSX, gen_vv_i, gen_helper_vssrlrni_h_w)
+TRANS(vssrlrni_w_d, LSX, gen_vv_i, gen_helper_vssrlrni_w_d)
+TRANS(vssrlrni_d_q, LSX, gen_vv_i, gen_helper_vssrlrni_d_q)
+TRANS(vssrarni_b_h, LSX, gen_vv_i, gen_helper_vssrarni_b_h)
+TRANS(vssrarni_h_w, LSX, gen_vv_i, gen_helper_vssrarni_h_w)
+TRANS(vssrarni_w_d, LSX, gen_vv_i, gen_helper_vssrarni_w_d)
+TRANS(vssrarni_d_q, LSX, gen_vv_i, gen_helper_vssrarni_d_q)
+TRANS(vssrlrni_bu_h, LSX, gen_vv_i, gen_helper_vssrlrni_bu_h)
+TRANS(vssrlrni_hu_w, LSX, gen_vv_i, gen_helper_vssrlrni_hu_w)
+TRANS(vssrlrni_wu_d, LSX, gen_vv_i, gen_helper_vssrlrni_wu_d)
+TRANS(vssrlrni_du_q, LSX, gen_vv_i, gen_helper_vssrlrni_du_q)
+TRANS(vssrarni_bu_h, LSX, gen_vv_i, gen_helper_vssrarni_bu_h)
+TRANS(vssrarni_hu_w, LSX, gen_vv_i, gen_helper_vssrarni_hu_w)
+TRANS(vssrarni_wu_d, LSX, gen_vv_i, gen_helper_vssrarni_wu_d)
+TRANS(vssrarni_du_q, LSX, gen_vv_i, gen_helper_vssrarni_du_q)
 
-TRANS(vclo_b, ALL, gen_vv, gen_helper_vclo_b)
-TRANS(vclo_h, ALL, gen_vv, gen_helper_vclo_h)
-TRANS(vclo_w, ALL, gen_vv, gen_helper_vclo_w)
-TRANS(vclo_d, ALL, gen_vv, gen_helper_vclo_d)
-TRANS(vclz_b, ALL, gen_vv, gen_helper_vclz_b)
-TRANS(vclz_h, ALL, gen_vv, gen_helper_vclz_h)
-TRANS(vclz_w, ALL, gen_vv, gen_helper_vclz_w)
-TRANS(vclz_d, ALL, gen_vv, gen_helper_vclz_d)
+TRANS(vclo_b, LSX, gen_vv, gen_helper_vclo_b)
+TRANS(vclo_h, LSX, gen_vv, gen_helper_vclo_h)
+TRANS(vclo_w, LSX, gen_vv, gen_helper_vclo_w)
+TRANS(vclo_d, LSX, gen_vv, gen_helper_vclo_d)
+TRANS(vclz_b, LSX, gen_vv, gen_helper_vclz_b)
+TRANS(vclz_h, LSX, gen_vv, gen_helper_vclz_h)
+TRANS(vclz_w, LSX, gen_vv, gen_helper_vclz_w)
+TRANS(vclz_d, LSX, gen_vv, gen_helper_vclz_d)
 
-TRANS(vpcnt_b, ALL, gen_vv, gen_helper_vpcnt_b)
-TRANS(vpcnt_h, ALL, gen_vv, gen_helper_vpcnt_h)
-TRANS(vpcnt_w, ALL, gen_vv, gen_helper_vpcnt_w)
-TRANS(vpcnt_d, ALL, gen_vv, gen_helper_vpcnt_d)
+TRANS(vpcnt_b, LSX, gen_vv, gen_helper_vpcnt_b)
+TRANS(vpcnt_h, LSX, gen_vv, gen_helper_vpcnt_h)
+TRANS(vpcnt_w, LSX, gen_vv, gen_helper_vpcnt_w)
+TRANS(vpcnt_d, LSX, gen_vv, gen_helper_vpcnt_d)
 
 static void do_vbit(unsigned vece, TCGv_vec t, TCGv_vec a, TCGv_vec b,
                     void (*func)(unsigned, TCGv_vec, TCGv_vec, TCGv_vec))
@@ -3340,10 +3361,10 @@ static void do_vbitclr(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vbitclr_b, ALL, gvec_vvv, MO_8, do_vbitclr)
-TRANS(vbitclr_h, ALL, gvec_vvv, MO_16, do_vbitclr)
-TRANS(vbitclr_w, ALL, gvec_vvv, MO_32, do_vbitclr)
-TRANS(vbitclr_d, ALL, gvec_vvv, MO_64, do_vbitclr)
+TRANS(vbitclr_b, LSX, gvec_vvv, MO_8, do_vbitclr)
+TRANS(vbitclr_h, LSX, gvec_vvv, MO_16, do_vbitclr)
+TRANS(vbitclr_w, LSX, gvec_vvv, MO_32, do_vbitclr)
+TRANS(vbitclr_d, LSX, gvec_vvv, MO_64, do_vbitclr)
 
 static void do_vbiti(unsigned vece, TCGv_vec t, TCGv_vec a, int64_t imm,
                      void (*func)(unsigned, TCGv_vec, TCGv_vec, TCGv_vec))
@@ -3410,10 +3431,10 @@ static void do_vbitclri(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vbitclri_b, ALL, gvec_vv_i, MO_8, do_vbitclri)
-TRANS(vbitclri_h, ALL, gvec_vv_i, MO_16, do_vbitclri)
-TRANS(vbitclri_w, ALL, gvec_vv_i, MO_32, do_vbitclri)
-TRANS(vbitclri_d, ALL, gvec_vv_i, MO_64, do_vbitclri)
+TRANS(vbitclri_b, LSX, gvec_vv_i, MO_8, do_vbitclri)
+TRANS(vbitclri_h, LSX, gvec_vv_i, MO_16, do_vbitclri)
+TRANS(vbitclri_w, LSX, gvec_vv_i, MO_32, do_vbitclri)
+TRANS(vbitclri_d, LSX, gvec_vv_i, MO_64, do_vbitclri)
 
 static void do_vbitset(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        uint32_t vk_ofs, uint32_t oprsz, uint32_t maxsz)
@@ -3451,10 +3472,10 @@ static void do_vbitset(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vbitset_b, ALL, gvec_vvv, MO_8, do_vbitset)
-TRANS(vbitset_h, ALL, gvec_vvv, MO_16, do_vbitset)
-TRANS(vbitset_w, ALL, gvec_vvv, MO_32, do_vbitset)
-TRANS(vbitset_d, ALL, gvec_vvv, MO_64, do_vbitset)
+TRANS(vbitset_b, LSX, gvec_vvv, MO_8, do_vbitset)
+TRANS(vbitset_h, LSX, gvec_vvv, MO_16, do_vbitset)
+TRANS(vbitset_w, LSX, gvec_vvv, MO_32, do_vbitset)
+TRANS(vbitset_d, LSX, gvec_vvv, MO_64, do_vbitset)
 
 static void do_vbitseti(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                         int64_t imm, uint32_t oprsz, uint32_t maxsz)
@@ -3492,10 +3513,10 @@ static void do_vbitseti(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vbitseti_b, ALL, gvec_vv_i, MO_8, do_vbitseti)
-TRANS(vbitseti_h, ALL, gvec_vv_i, MO_16, do_vbitseti)
-TRANS(vbitseti_w, ALL, gvec_vv_i, MO_32, do_vbitseti)
-TRANS(vbitseti_d, ALL, gvec_vv_i, MO_64, do_vbitseti)
+TRANS(vbitseti_b, LSX, gvec_vv_i, MO_8, do_vbitseti)
+TRANS(vbitseti_h, LSX, gvec_vv_i, MO_16, do_vbitseti)
+TRANS(vbitseti_w, LSX, gvec_vv_i, MO_32, do_vbitseti)
+TRANS(vbitseti_d, LSX, gvec_vv_i, MO_64, do_vbitseti)
 
 static void do_vbitrev(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                        uint32_t vk_ofs, uint32_t oprsz, uint32_t maxsz)
@@ -3533,10 +3554,10 @@ static void do_vbitrev(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_3(vd_ofs, vj_ofs, vk_ofs, oprsz, maxsz, &op[vece]);
 }
 
-TRANS(vbitrev_b, ALL, gvec_vvv, MO_8, do_vbitrev)
-TRANS(vbitrev_h, ALL, gvec_vvv, MO_16, do_vbitrev)
-TRANS(vbitrev_w, ALL, gvec_vvv, MO_32, do_vbitrev)
-TRANS(vbitrev_d, ALL, gvec_vvv, MO_64, do_vbitrev)
+TRANS(vbitrev_b, LSX, gvec_vvv, MO_8, do_vbitrev)
+TRANS(vbitrev_h, LSX, gvec_vvv, MO_16, do_vbitrev)
+TRANS(vbitrev_w, LSX, gvec_vvv, MO_32, do_vbitrev)
+TRANS(vbitrev_d, LSX, gvec_vvv, MO_64, do_vbitrev)
 
 static void do_vbitrevi(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
                         int64_t imm, uint32_t oprsz, uint32_t maxsz)
@@ -3574,112 +3595,112 @@ static void do_vbitrevi(unsigned vece, uint32_t vd_ofs, uint32_t vj_ofs,
     tcg_gen_gvec_2i(vd_ofs, vj_ofs, oprsz, maxsz, imm, &op[vece]);
 }
 
-TRANS(vbitrevi_b, ALL, gvec_vv_i, MO_8, do_vbitrevi)
-TRANS(vbitrevi_h, ALL, gvec_vv_i, MO_16, do_vbitrevi)
-TRANS(vbitrevi_w, ALL, gvec_vv_i, MO_32, do_vbitrevi)
-TRANS(vbitrevi_d, ALL, gvec_vv_i, MO_64, do_vbitrevi)
+TRANS(vbitrevi_b, LSX, gvec_vv_i, MO_8, do_vbitrevi)
+TRANS(vbitrevi_h, LSX, gvec_vv_i, MO_16, do_vbitrevi)
+TRANS(vbitrevi_w, LSX, gvec_vv_i, MO_32, do_vbitrevi)
+TRANS(vbitrevi_d, LSX, gvec_vv_i, MO_64, do_vbitrevi)
 
-TRANS(vfrstp_b, ALL, gen_vvv, gen_helper_vfrstp_b)
-TRANS(vfrstp_h, ALL, gen_vvv, gen_helper_vfrstp_h)
-TRANS(vfrstpi_b, ALL, gen_vv_i, gen_helper_vfrstpi_b)
-TRANS(vfrstpi_h, ALL, gen_vv_i, gen_helper_vfrstpi_h)
+TRANS(vfrstp_b, LSX, gen_vvv, gen_helper_vfrstp_b)
+TRANS(vfrstp_h, LSX, gen_vvv, gen_helper_vfrstp_h)
+TRANS(vfrstpi_b, LSX, gen_vv_i, gen_helper_vfrstpi_b)
+TRANS(vfrstpi_h, LSX, gen_vv_i, gen_helper_vfrstpi_h)
 
-TRANS(vfadd_s, ALL, gen_vvv, gen_helper_vfadd_s)
-TRANS(vfadd_d, ALL, gen_vvv, gen_helper_vfadd_d)
-TRANS(vfsub_s, ALL, gen_vvv, gen_helper_vfsub_s)
-TRANS(vfsub_d, ALL, gen_vvv, gen_helper_vfsub_d)
-TRANS(vfmul_s, ALL, gen_vvv, gen_helper_vfmul_s)
-TRANS(vfmul_d, ALL, gen_vvv, gen_helper_vfmul_d)
-TRANS(vfdiv_s, ALL, gen_vvv, gen_helper_vfdiv_s)
-TRANS(vfdiv_d, ALL, gen_vvv, gen_helper_vfdiv_d)
+TRANS(vfadd_s, LSX, gen_vvv, gen_helper_vfadd_s)
+TRANS(vfadd_d, LSX, gen_vvv, gen_helper_vfadd_d)
+TRANS(vfsub_s, LSX, gen_vvv, gen_helper_vfsub_s)
+TRANS(vfsub_d, LSX, gen_vvv, gen_helper_vfsub_d)
+TRANS(vfmul_s, LSX, gen_vvv, gen_helper_vfmul_s)
+TRANS(vfmul_d, LSX, gen_vvv, gen_helper_vfmul_d)
+TRANS(vfdiv_s, LSX, gen_vvv, gen_helper_vfdiv_s)
+TRANS(vfdiv_d, LSX, gen_vvv, gen_helper_vfdiv_d)
 
-TRANS(vfmadd_s, ALL, gen_vvvv, gen_helper_vfmadd_s)
-TRANS(vfmadd_d, ALL, gen_vvvv, gen_helper_vfmadd_d)
-TRANS(vfmsub_s, ALL, gen_vvvv, gen_helper_vfmsub_s)
-TRANS(vfmsub_d, ALL, gen_vvvv, gen_helper_vfmsub_d)
-TRANS(vfnmadd_s, ALL, gen_vvvv, gen_helper_vfnmadd_s)
-TRANS(vfnmadd_d, ALL, gen_vvvv, gen_helper_vfnmadd_d)
-TRANS(vfnmsub_s, ALL, gen_vvvv, gen_helper_vfnmsub_s)
-TRANS(vfnmsub_d, ALL, gen_vvvv, gen_helper_vfnmsub_d)
+TRANS(vfmadd_s, LSX, gen_vvvv, gen_helper_vfmadd_s)
+TRANS(vfmadd_d, LSX, gen_vvvv, gen_helper_vfmadd_d)
+TRANS(vfmsub_s, LSX, gen_vvvv, gen_helper_vfmsub_s)
+TRANS(vfmsub_d, LSX, gen_vvvv, gen_helper_vfmsub_d)
+TRANS(vfnmadd_s, LSX, gen_vvvv, gen_helper_vfnmadd_s)
+TRANS(vfnmadd_d, LSX, gen_vvvv, gen_helper_vfnmadd_d)
+TRANS(vfnmsub_s, LSX, gen_vvvv, gen_helper_vfnmsub_s)
+TRANS(vfnmsub_d, LSX, gen_vvvv, gen_helper_vfnmsub_d)
 
-TRANS(vfmax_s, ALL, gen_vvv, gen_helper_vfmax_s)
-TRANS(vfmax_d, ALL, gen_vvv, gen_helper_vfmax_d)
-TRANS(vfmin_s, ALL, gen_vvv, gen_helper_vfmin_s)
-TRANS(vfmin_d, ALL, gen_vvv, gen_helper_vfmin_d)
+TRANS(vfmax_s, LSX, gen_vvv, gen_helper_vfmax_s)
+TRANS(vfmax_d, LSX, gen_vvv, gen_helper_vfmax_d)
+TRANS(vfmin_s, LSX, gen_vvv, gen_helper_vfmin_s)
+TRANS(vfmin_d, LSX, gen_vvv, gen_helper_vfmin_d)
 
-TRANS(vfmaxa_s, ALL, gen_vvv, gen_helper_vfmaxa_s)
-TRANS(vfmaxa_d, ALL, gen_vvv, gen_helper_vfmaxa_d)
-TRANS(vfmina_s, ALL, gen_vvv, gen_helper_vfmina_s)
-TRANS(vfmina_d, ALL, gen_vvv, gen_helper_vfmina_d)
+TRANS(vfmaxa_s, LSX, gen_vvv, gen_helper_vfmaxa_s)
+TRANS(vfmaxa_d, LSX, gen_vvv, gen_helper_vfmaxa_d)
+TRANS(vfmina_s, LSX, gen_vvv, gen_helper_vfmina_s)
+TRANS(vfmina_d, LSX, gen_vvv, gen_helper_vfmina_d)
 
-TRANS(vflogb_s, ALL, gen_vv, gen_helper_vflogb_s)
-TRANS(vflogb_d, ALL, gen_vv, gen_helper_vflogb_d)
+TRANS(vflogb_s, LSX, gen_vv, gen_helper_vflogb_s)
+TRANS(vflogb_d, LSX, gen_vv, gen_helper_vflogb_d)
 
-TRANS(vfclass_s, ALL, gen_vv, gen_helper_vfclass_s)
-TRANS(vfclass_d, ALL, gen_vv, gen_helper_vfclass_d)
+TRANS(vfclass_s, LSX, gen_vv, gen_helper_vfclass_s)
+TRANS(vfclass_d, LSX, gen_vv, gen_helper_vfclass_d)
 
-TRANS(vfsqrt_s, ALL, gen_vv, gen_helper_vfsqrt_s)
-TRANS(vfsqrt_d, ALL, gen_vv, gen_helper_vfsqrt_d)
-TRANS(vfrecip_s, ALL, gen_vv, gen_helper_vfrecip_s)
-TRANS(vfrecip_d, ALL, gen_vv, gen_helper_vfrecip_d)
-TRANS(vfrsqrt_s, ALL, gen_vv, gen_helper_vfrsqrt_s)
-TRANS(vfrsqrt_d, ALL, gen_vv, gen_helper_vfrsqrt_d)
+TRANS(vfsqrt_s, LSX, gen_vv, gen_helper_vfsqrt_s)
+TRANS(vfsqrt_d, LSX, gen_vv, gen_helper_vfsqrt_d)
+TRANS(vfrecip_s, LSX, gen_vv, gen_helper_vfrecip_s)
+TRANS(vfrecip_d, LSX, gen_vv, gen_helper_vfrecip_d)
+TRANS(vfrsqrt_s, LSX, gen_vv, gen_helper_vfrsqrt_s)
+TRANS(vfrsqrt_d, LSX, gen_vv, gen_helper_vfrsqrt_d)
 
-TRANS(vfcvtl_s_h, ALL, gen_vv, gen_helper_vfcvtl_s_h)
-TRANS(vfcvth_s_h, ALL, gen_vv, gen_helper_vfcvth_s_h)
-TRANS(vfcvtl_d_s, ALL, gen_vv, gen_helper_vfcvtl_d_s)
-TRANS(vfcvth_d_s, ALL, gen_vv, gen_helper_vfcvth_d_s)
-TRANS(vfcvt_h_s, ALL, gen_vvv, gen_helper_vfcvt_h_s)
-TRANS(vfcvt_s_d, ALL, gen_vvv, gen_helper_vfcvt_s_d)
+TRANS(vfcvtl_s_h, LSX, gen_vv, gen_helper_vfcvtl_s_h)
+TRANS(vfcvth_s_h, LSX, gen_vv, gen_helper_vfcvth_s_h)
+TRANS(vfcvtl_d_s, LSX, gen_vv, gen_helper_vfcvtl_d_s)
+TRANS(vfcvth_d_s, LSX, gen_vv, gen_helper_vfcvth_d_s)
+TRANS(vfcvt_h_s, LSX, gen_vvv, gen_helper_vfcvt_h_s)
+TRANS(vfcvt_s_d, LSX, gen_vvv, gen_helper_vfcvt_s_d)
 
-TRANS(vfrintrne_s, ALL, gen_vv, gen_helper_vfrintrne_s)
-TRANS(vfrintrne_d, ALL, gen_vv, gen_helper_vfrintrne_d)
-TRANS(vfrintrz_s, ALL, gen_vv, gen_helper_vfrintrz_s)
-TRANS(vfrintrz_d, ALL, gen_vv, gen_helper_vfrintrz_d)
-TRANS(vfrintrp_s, ALL, gen_vv, gen_helper_vfrintrp_s)
-TRANS(vfrintrp_d, ALL, gen_vv, gen_helper_vfrintrp_d)
-TRANS(vfrintrm_s, ALL, gen_vv, gen_helper_vfrintrm_s)
-TRANS(vfrintrm_d, ALL, gen_vv, gen_helper_vfrintrm_d)
-TRANS(vfrint_s, ALL, gen_vv, gen_helper_vfrint_s)
-TRANS(vfrint_d, ALL, gen_vv, gen_helper_vfrint_d)
+TRANS(vfrintrne_s, LSX, gen_vv, gen_helper_vfrintrne_s)
+TRANS(vfrintrne_d, LSX, gen_vv, gen_helper_vfrintrne_d)
+TRANS(vfrintrz_s, LSX, gen_vv, gen_helper_vfrintrz_s)
+TRANS(vfrintrz_d, LSX, gen_vv, gen_helper_vfrintrz_d)
+TRANS(vfrintrp_s, LSX, gen_vv, gen_helper_vfrintrp_s)
+TRANS(vfrintrp_d, LSX, gen_vv, gen_helper_vfrintrp_d)
+TRANS(vfrintrm_s, LSX, gen_vv, gen_helper_vfrintrm_s)
+TRANS(vfrintrm_d, LSX, gen_vv, gen_helper_vfrintrm_d)
+TRANS(vfrint_s, LSX, gen_vv, gen_helper_vfrint_s)
+TRANS(vfrint_d, LSX, gen_vv, gen_helper_vfrint_d)
 
-TRANS(vftintrne_w_s, ALL, gen_vv, gen_helper_vftintrne_w_s)
-TRANS(vftintrne_l_d, ALL, gen_vv, gen_helper_vftintrne_l_d)
-TRANS(vftintrz_w_s, ALL, gen_vv, gen_helper_vftintrz_w_s)
-TRANS(vftintrz_l_d, ALL, gen_vv, gen_helper_vftintrz_l_d)
-TRANS(vftintrp_w_s, ALL, gen_vv, gen_helper_vftintrp_w_s)
-TRANS(vftintrp_l_d, ALL, gen_vv, gen_helper_vftintrp_l_d)
-TRANS(vftintrm_w_s, ALL, gen_vv, gen_helper_vftintrm_w_s)
-TRANS(vftintrm_l_d, ALL, gen_vv, gen_helper_vftintrm_l_d)
-TRANS(vftint_w_s, ALL, gen_vv, gen_helper_vftint_w_s)
-TRANS(vftint_l_d, ALL, gen_vv, gen_helper_vftint_l_d)
-TRANS(vftintrz_wu_s, ALL, gen_vv, gen_helper_vftintrz_wu_s)
-TRANS(vftintrz_lu_d, ALL, gen_vv, gen_helper_vftintrz_lu_d)
-TRANS(vftint_wu_s, ALL, gen_vv, gen_helper_vftint_wu_s)
-TRANS(vftint_lu_d, ALL, gen_vv, gen_helper_vftint_lu_d)
-TRANS(vftintrne_w_d, ALL, gen_vvv, gen_helper_vftintrne_w_d)
-TRANS(vftintrz_w_d, ALL, gen_vvv, gen_helper_vftintrz_w_d)
-TRANS(vftintrp_w_d, ALL, gen_vvv, gen_helper_vftintrp_w_d)
-TRANS(vftintrm_w_d, ALL, gen_vvv, gen_helper_vftintrm_w_d)
-TRANS(vftint_w_d, ALL, gen_vvv, gen_helper_vftint_w_d)
-TRANS(vftintrnel_l_s, ALL, gen_vv, gen_helper_vftintrnel_l_s)
-TRANS(vftintrneh_l_s, ALL, gen_vv, gen_helper_vftintrneh_l_s)
-TRANS(vftintrzl_l_s, ALL, gen_vv, gen_helper_vftintrzl_l_s)
-TRANS(vftintrzh_l_s, ALL, gen_vv, gen_helper_vftintrzh_l_s)
-TRANS(vftintrpl_l_s, ALL, gen_vv, gen_helper_vftintrpl_l_s)
-TRANS(vftintrph_l_s, ALL, gen_vv, gen_helper_vftintrph_l_s)
-TRANS(vftintrml_l_s, ALL, gen_vv, gen_helper_vftintrml_l_s)
-TRANS(vftintrmh_l_s, ALL, gen_vv, gen_helper_vftintrmh_l_s)
-TRANS(vftintl_l_s, ALL, gen_vv, gen_helper_vftintl_l_s)
-TRANS(vftinth_l_s, ALL, gen_vv, gen_helper_vftinth_l_s)
+TRANS(vftintrne_w_s, LSX, gen_vv, gen_helper_vftintrne_w_s)
+TRANS(vftintrne_l_d, LSX, gen_vv, gen_helper_vftintrne_l_d)
+TRANS(vftintrz_w_s, LSX, gen_vv, gen_helper_vftintrz_w_s)
+TRANS(vftintrz_l_d, LSX, gen_vv, gen_helper_vftintrz_l_d)
+TRANS(vftintrp_w_s, LSX, gen_vv, gen_helper_vftintrp_w_s)
+TRANS(vftintrp_l_d, LSX, gen_vv, gen_helper_vftintrp_l_d)
+TRANS(vftintrm_w_s, LSX, gen_vv, gen_helper_vftintrm_w_s)
+TRANS(vftintrm_l_d, LSX, gen_vv, gen_helper_vftintrm_l_d)
+TRANS(vftint_w_s, LSX, gen_vv, gen_helper_vftint_w_s)
+TRANS(vftint_l_d, LSX, gen_vv, gen_helper_vftint_l_d)
+TRANS(vftintrz_wu_s, LSX, gen_vv, gen_helper_vftintrz_wu_s)
+TRANS(vftintrz_lu_d, LSX, gen_vv, gen_helper_vftintrz_lu_d)
+TRANS(vftint_wu_s, LSX, gen_vv, gen_helper_vftint_wu_s)
+TRANS(vftint_lu_d, LSX, gen_vv, gen_helper_vftint_lu_d)
+TRANS(vftintrne_w_d, LSX, gen_vvv, gen_helper_vftintrne_w_d)
+TRANS(vftintrz_w_d, LSX, gen_vvv, gen_helper_vftintrz_w_d)
+TRANS(vftintrp_w_d, LSX, gen_vvv, gen_helper_vftintrp_w_d)
+TRANS(vftintrm_w_d, LSX, gen_vvv, gen_helper_vftintrm_w_d)
+TRANS(vftint_w_d, LSX, gen_vvv, gen_helper_vftint_w_d)
+TRANS(vftintrnel_l_s, LSX, gen_vv, gen_helper_vftintrnel_l_s)
+TRANS(vftintrneh_l_s, LSX, gen_vv, gen_helper_vftintrneh_l_s)
+TRANS(vftintrzl_l_s, LSX, gen_vv, gen_helper_vftintrzl_l_s)
+TRANS(vftintrzh_l_s, LSX, gen_vv, gen_helper_vftintrzh_l_s)
+TRANS(vftintrpl_l_s, LSX, gen_vv, gen_helper_vftintrpl_l_s)
+TRANS(vftintrph_l_s, LSX, gen_vv, gen_helper_vftintrph_l_s)
+TRANS(vftintrml_l_s, LSX, gen_vv, gen_helper_vftintrml_l_s)
+TRANS(vftintrmh_l_s, LSX, gen_vv, gen_helper_vftintrmh_l_s)
+TRANS(vftintl_l_s, LSX, gen_vv, gen_helper_vftintl_l_s)
+TRANS(vftinth_l_s, LSX, gen_vv, gen_helper_vftinth_l_s)
 
-TRANS(vffint_s_w, ALL, gen_vv, gen_helper_vffint_s_w)
-TRANS(vffint_d_l, ALL, gen_vv, gen_helper_vffint_d_l)
-TRANS(vffint_s_wu, ALL, gen_vv, gen_helper_vffint_s_wu)
-TRANS(vffint_d_lu, ALL, gen_vv, gen_helper_vffint_d_lu)
-TRANS(vffintl_d_w, ALL, gen_vv, gen_helper_vffintl_d_w)
-TRANS(vffinth_d_w, ALL, gen_vv, gen_helper_vffinth_d_w)
-TRANS(vffint_s_l, ALL, gen_vvv, gen_helper_vffint_s_l)
+TRANS(vffint_s_w, LSX, gen_vv, gen_helper_vffint_s_w)
+TRANS(vffint_d_l, LSX, gen_vv, gen_helper_vffint_d_l)
+TRANS(vffint_s_wu, LSX, gen_vv, gen_helper_vffint_s_wu)
+TRANS(vffint_d_lu, LSX, gen_vv, gen_helper_vffint_d_lu)
+TRANS(vffintl_d_w, LSX, gen_vv, gen_helper_vffintl_d_w)
+TRANS(vffinth_d_w, LSX, gen_vv, gen_helper_vffinth_d_w)
+TRANS(vffint_s_l, LSX, gen_vvv, gen_helper_vffint_s_l)
 
 static bool do_cmp(DisasContext *ctx, arg_vvv *a, MemOp mop, TCGCond cond)
 {
@@ -3823,48 +3844,48 @@ static bool do_## NAME ##_u(DisasContext *ctx, arg_vv_i *a, MemOp mop) \
 DO_CMPI_U(vslei)
 DO_CMPI_U(vslti)
 
-TRANS(vseq_b, ALL, do_cmp, MO_8, TCG_COND_EQ)
-TRANS(vseq_h, ALL, do_cmp, MO_16, TCG_COND_EQ)
-TRANS(vseq_w, ALL, do_cmp, MO_32, TCG_COND_EQ)
-TRANS(vseq_d, ALL, do_cmp, MO_64, TCG_COND_EQ)
-TRANS(vseqi_b, ALL, do_vseqi_s, MO_8)
-TRANS(vseqi_h, ALL, do_vseqi_s, MO_16)
-TRANS(vseqi_w, ALL, do_vseqi_s, MO_32)
-TRANS(vseqi_d, ALL, do_vseqi_s, MO_64)
+TRANS(vseq_b, LSX, do_cmp, MO_8, TCG_COND_EQ)
+TRANS(vseq_h, LSX, do_cmp, MO_16, TCG_COND_EQ)
+TRANS(vseq_w, LSX, do_cmp, MO_32, TCG_COND_EQ)
+TRANS(vseq_d, LSX, do_cmp, MO_64, TCG_COND_EQ)
+TRANS(vseqi_b, LSX, do_vseqi_s, MO_8)
+TRANS(vseqi_h, LSX, do_vseqi_s, MO_16)
+TRANS(vseqi_w, LSX, do_vseqi_s, MO_32)
+TRANS(vseqi_d, LSX, do_vseqi_s, MO_64)
 
-TRANS(vsle_b, ALL, do_cmp, MO_8, TCG_COND_LE)
-TRANS(vsle_h, ALL, do_cmp, MO_16, TCG_COND_LE)
-TRANS(vsle_w, ALL, do_cmp, MO_32, TCG_COND_LE)
-TRANS(vsle_d, ALL, do_cmp, MO_64, TCG_COND_LE)
-TRANS(vslei_b, ALL, do_vslei_s, MO_8)
-TRANS(vslei_h, ALL, do_vslei_s, MO_16)
-TRANS(vslei_w, ALL, do_vslei_s, MO_32)
-TRANS(vslei_d, ALL, do_vslei_s, MO_64)
-TRANS(vsle_bu, ALL, do_cmp, MO_8, TCG_COND_LEU)
-TRANS(vsle_hu, ALL, do_cmp, MO_16, TCG_COND_LEU)
-TRANS(vsle_wu, ALL, do_cmp, MO_32, TCG_COND_LEU)
-TRANS(vsle_du, ALL, do_cmp, MO_64, TCG_COND_LEU)
-TRANS(vslei_bu, ALL, do_vslei_u, MO_8)
-TRANS(vslei_hu, ALL, do_vslei_u, MO_16)
-TRANS(vslei_wu, ALL, do_vslei_u, MO_32)
-TRANS(vslei_du, ALL, do_vslei_u, MO_64)
+TRANS(vsle_b, LSX, do_cmp, MO_8, TCG_COND_LE)
+TRANS(vsle_h, LSX, do_cmp, MO_16, TCG_COND_LE)
+TRANS(vsle_w, LSX, do_cmp, MO_32, TCG_COND_LE)
+TRANS(vsle_d, LSX, do_cmp, MO_64, TCG_COND_LE)
+TRANS(vslei_b, LSX, do_vslei_s, MO_8)
+TRANS(vslei_h, LSX, do_vslei_s, MO_16)
+TRANS(vslei_w, LSX, do_vslei_s, MO_32)
+TRANS(vslei_d, LSX, do_vslei_s, MO_64)
+TRANS(vsle_bu, LSX, do_cmp, MO_8, TCG_COND_LEU)
+TRANS(vsle_hu, LSX, do_cmp, MO_16, TCG_COND_LEU)
+TRANS(vsle_wu, LSX, do_cmp, MO_32, TCG_COND_LEU)
+TRANS(vsle_du, LSX, do_cmp, MO_64, TCG_COND_LEU)
+TRANS(vslei_bu, LSX, do_vslei_u, MO_8)
+TRANS(vslei_hu, LSX, do_vslei_u, MO_16)
+TRANS(vslei_wu, LSX, do_vslei_u, MO_32)
+TRANS(vslei_du, LSX, do_vslei_u, MO_64)
 
-TRANS(vslt_b, ALL, do_cmp, MO_8, TCG_COND_LT)
-TRANS(vslt_h, ALL, do_cmp, MO_16, TCG_COND_LT)
-TRANS(vslt_w, ALL, do_cmp, MO_32, TCG_COND_LT)
-TRANS(vslt_d, ALL, do_cmp, MO_64, TCG_COND_LT)
-TRANS(vslti_b, ALL, do_vslti_s, MO_8)
-TRANS(vslti_h, ALL, do_vslti_s, MO_16)
-TRANS(vslti_w, ALL, do_vslti_s, MO_32)
-TRANS(vslti_d, ALL, do_vslti_s, MO_64)
-TRANS(vslt_bu, ALL, do_cmp, MO_8, TCG_COND_LTU)
-TRANS(vslt_hu, ALL, do_cmp, MO_16, TCG_COND_LTU)
-TRANS(vslt_wu, ALL, do_cmp, MO_32, TCG_COND_LTU)
-TRANS(vslt_du, ALL, do_cmp, MO_64, TCG_COND_LTU)
-TRANS(vslti_bu, ALL, do_vslti_u, MO_8)
-TRANS(vslti_hu, ALL, do_vslti_u, MO_16)
-TRANS(vslti_wu, ALL, do_vslti_u, MO_32)
-TRANS(vslti_du, ALL, do_vslti_u, MO_64)
+TRANS(vslt_b, LSX, do_cmp, MO_8, TCG_COND_LT)
+TRANS(vslt_h, LSX, do_cmp, MO_16, TCG_COND_LT)
+TRANS(vslt_w, LSX, do_cmp, MO_32, TCG_COND_LT)
+TRANS(vslt_d, LSX, do_cmp, MO_64, TCG_COND_LT)
+TRANS(vslti_b, LSX, do_vslti_s, MO_8)
+TRANS(vslti_h, LSX, do_vslti_s, MO_16)
+TRANS(vslti_w, LSX, do_vslti_s, MO_32)
+TRANS(vslti_d, LSX, do_vslti_s, MO_64)
+TRANS(vslt_bu, LSX, do_cmp, MO_8, TCG_COND_LTU)
+TRANS(vslt_hu, LSX, do_cmp, MO_16, TCG_COND_LTU)
+TRANS(vslt_wu, LSX, do_cmp, MO_32, TCG_COND_LTU)
+TRANS(vslt_du, LSX, do_cmp, MO_64, TCG_COND_LTU)
+TRANS(vslti_bu, LSX, do_vslti_u, MO_8)
+TRANS(vslti_hu, LSX, do_vslti_u, MO_16)
+TRANS(vslti_wu, LSX, do_vslti_u, MO_32)
+TRANS(vslti_du, LSX, do_vslti_u, MO_64)
 
 static bool trans_vfcmp_cond_s(DisasContext *ctx, arg_vvv_fcond *a)
 {
@@ -3874,6 +3895,10 @@ static bool trans_vfcmp_cond_s(DisasContext *ctx, arg_vvv_fcond *a)
     TCGv_i32 vj = tcg_constant_i32(a->vj);
     TCGv_i32 vk = tcg_constant_i32(a->vk);
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     fn = (a->fcond & 1 ? gen_helper_vfcmp_s_s : gen_helper_vfcmp_c_s);
@@ -3891,6 +3916,12 @@ static bool trans_vfcmp_cond_d(DisasContext *ctx, arg_vvv_fcond *a)
     TCGv_i32 vj = tcg_constant_i32(a->vj);
     TCGv_i32 vk = tcg_constant_i32(a->vk);
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
+    CHECK_SXE;
+
     fn = (a->fcond & 1 ? gen_helper_vfcmp_s_d : gen_helper_vfcmp_c_d);
     flags = get_fcmp_flags(a->fcond >> 1);
     fn(cpu_env, vd, vj, vk, tcg_constant_i32(flags));
@@ -3900,6 +3931,10 @@ static bool trans_vfcmp_cond_d(DisasContext *ctx, arg_vvv_fcond *a)
 
 static bool trans_vbitsel_v(DisasContext *ctx, arg_vvvv *a)
 {
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     tcg_gen_gvec_bitsel(MO_64, vec_full_offset(a->vd), vec_full_offset(a->va),
@@ -3922,6 +3957,10 @@ static bool trans_vbitseli_b(DisasContext *ctx, arg_vv_i *a)
        .load_dest = true
     };
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     tcg_gen_gvec_2i(vec_full_offset(a->vd), vec_full_offset(a->vj),
@@ -3941,6 +3980,10 @@ static bool trans_## NAME (DisasContext *ctx, arg_cv *a)                       \
     get_vreg64(ah, a->vj, 1);                                                  \
     get_vreg64(al, a->vj, 0);                                                  \
                                                                                \
+    if (!avail_LSX(ctx)) {                                                     \
+        return false;                                                          \
+    }                                                                          \
+                                                                               \
     CHECK_SXE;                                                                 \
     tcg_gen_or_i64(t1, al, ah);                                                \
     tcg_gen_setcondi_i64(COND, t1, t1, 0);                                     \
@@ -3952,18 +3995,23 @@ static bool trans_## NAME (DisasContext *ctx, arg_cv *a)                       \
 VSET(vseteqz_v, TCG_COND_EQ)
 VSET(vsetnez_v, TCG_COND_NE)
 
-TRANS(vsetanyeqz_b, ALL, gen_cv, gen_helper_vsetanyeqz_b)
-TRANS(vsetanyeqz_h, ALL, gen_cv, gen_helper_vsetanyeqz_h)
-TRANS(vsetanyeqz_w, ALL, gen_cv, gen_helper_vsetanyeqz_w)
-TRANS(vsetanyeqz_d, ALL, gen_cv, gen_helper_vsetanyeqz_d)
-TRANS(vsetallnez_b, ALL, gen_cv, gen_helper_vsetallnez_b)
-TRANS(vsetallnez_h, ALL, gen_cv, gen_helper_vsetallnez_h)
-TRANS(vsetallnez_w, ALL, gen_cv, gen_helper_vsetallnez_w)
-TRANS(vsetallnez_d, ALL, gen_cv, gen_helper_vsetallnez_d)
+TRANS(vsetanyeqz_b, LSX, gen_cv, gen_helper_vsetanyeqz_b)
+TRANS(vsetanyeqz_h, LSX, gen_cv, gen_helper_vsetanyeqz_h)
+TRANS(vsetanyeqz_w, LSX, gen_cv, gen_helper_vsetanyeqz_w)
+TRANS(vsetanyeqz_d, LSX, gen_cv, gen_helper_vsetanyeqz_d)
+TRANS(vsetallnez_b, LSX, gen_cv, gen_helper_vsetallnez_b)
+TRANS(vsetallnez_h, LSX, gen_cv, gen_helper_vsetallnez_h)
+TRANS(vsetallnez_w, LSX, gen_cv, gen_helper_vsetallnez_w)
+TRANS(vsetallnez_d, LSX, gen_cv, gen_helper_vsetallnez_d)
 
 static bool trans_vinsgr2vr_b(DisasContext *ctx, arg_vr_i *a)
 {
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_st8_i64(src, cpu_env,
                     offsetof(CPULoongArchState, fpr[a->vd].vreg.B(a->imm)));
@@ -3973,6 +4021,11 @@ static bool trans_vinsgr2vr_b(DisasContext *ctx, arg_vr_i *a)
 static bool trans_vinsgr2vr_h(DisasContext *ctx, arg_vr_i *a)
 {
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_st16_i64(src, cpu_env,
                     offsetof(CPULoongArchState, fpr[a->vd].vreg.H(a->imm)));
@@ -3982,6 +4035,11 @@ static bool trans_vinsgr2vr_h(DisasContext *ctx, arg_vr_i *a)
 static bool trans_vinsgr2vr_w(DisasContext *ctx, arg_vr_i *a)
 {
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_st32_i64(src, cpu_env,
                      offsetof(CPULoongArchState, fpr[a->vd].vreg.W(a->imm)));
@@ -3991,6 +4049,11 @@ static bool trans_vinsgr2vr_w(DisasContext *ctx, arg_vr_i *a)
 static bool trans_vinsgr2vr_d(DisasContext *ctx, arg_vr_i *a)
 {
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_st_i64(src, cpu_env,
                    offsetof(CPULoongArchState, fpr[a->vd].vreg.D(a->imm)));
@@ -4000,6 +4063,11 @@ static bool trans_vinsgr2vr_d(DisasContext *ctx, arg_vr_i *a)
 static bool trans_vpickve2gr_b(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld8s_i64(dst, cpu_env,
                      offsetof(CPULoongArchState, fpr[a->vj].vreg.B(a->imm)));
@@ -4009,6 +4077,11 @@ static bool trans_vpickve2gr_b(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_h(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld16s_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.H(a->imm)));
@@ -4018,6 +4091,11 @@ static bool trans_vpickve2gr_h(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_w(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld32s_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.W(a->imm)));
@@ -4027,6 +4105,11 @@ static bool trans_vpickve2gr_w(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_d(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld_i64(dst, cpu_env,
                    offsetof(CPULoongArchState, fpr[a->vj].vreg.D(a->imm)));
@@ -4036,6 +4119,11 @@ static bool trans_vpickve2gr_d(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_bu(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld8u_i64(dst, cpu_env,
                      offsetof(CPULoongArchState, fpr[a->vj].vreg.B(a->imm)));
@@ -4045,6 +4133,11 @@ static bool trans_vpickve2gr_bu(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_hu(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld16u_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.H(a->imm)));
@@ -4054,6 +4147,11 @@ static bool trans_vpickve2gr_hu(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_wu(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld32u_i64(dst, cpu_env,
                       offsetof(CPULoongArchState, fpr[a->vj].vreg.W(a->imm)));
@@ -4063,6 +4161,11 @@ static bool trans_vpickve2gr_wu(DisasContext *ctx, arg_rv_i *a)
 static bool trans_vpickve2gr_du(DisasContext *ctx, arg_rv_i *a)
 {
     TCGv dst = gpr_dst(ctx, a->rd, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_ld_i64(dst, cpu_env,
                    offsetof(CPULoongArchState, fpr[a->vj].vreg.D(a->imm)));
@@ -4072,6 +4175,11 @@ static bool trans_vpickve2gr_du(DisasContext *ctx, arg_rv_i *a)
 static bool gvec_dup(DisasContext *ctx, arg_vr *a, MemOp mop)
 {
     TCGv src = gpr_src(ctx, a->rj, EXT_NONE);
+
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     tcg_gen_gvec_dup_i64(mop, vec_full_offset(a->vd),
@@ -4079,13 +4187,17 @@ static bool gvec_dup(DisasContext *ctx, arg_vr *a, MemOp mop)
     return true;
 }
 
-TRANS(vreplgr2vr_b, ALL, gvec_dup, MO_8)
-TRANS(vreplgr2vr_h, ALL, gvec_dup, MO_16)
-TRANS(vreplgr2vr_w, ALL, gvec_dup, MO_32)
-TRANS(vreplgr2vr_d, ALL, gvec_dup, MO_64)
+TRANS(vreplgr2vr_b, LSX, gvec_dup, MO_8)
+TRANS(vreplgr2vr_h, LSX, gvec_dup, MO_16)
+TRANS(vreplgr2vr_w, LSX, gvec_dup, MO_32)
+TRANS(vreplgr2vr_d, LSX, gvec_dup, MO_64)
 
 static bool trans_vreplvei_b(DisasContext *ctx, arg_vv_i *a)
 {
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_gvec_dup_mem(MO_8,vec_full_offset(a->vd),
                          offsetof(CPULoongArchState,
@@ -4096,6 +4208,10 @@ static bool trans_vreplvei_b(DisasContext *ctx, arg_vv_i *a)
 
 static bool trans_vreplvei_h(DisasContext *ctx, arg_vv_i *a)
 {
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_gvec_dup_mem(MO_16, vec_full_offset(a->vd),
                          offsetof(CPULoongArchState,
@@ -4105,6 +4221,10 @@ static bool trans_vreplvei_h(DisasContext *ctx, arg_vv_i *a)
 }
 static bool trans_vreplvei_w(DisasContext *ctx, arg_vv_i *a)
 {
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_gvec_dup_mem(MO_32, vec_full_offset(a->vd),
                          offsetof(CPULoongArchState,
@@ -4114,6 +4234,10 @@ static bool trans_vreplvei_w(DisasContext *ctx, arg_vv_i *a)
 }
 static bool trans_vreplvei_d(DisasContext *ctx, arg_vv_i *a)
 {
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
     tcg_gen_gvec_dup_mem(MO_64, vec_full_offset(a->vd),
                          offsetof(CPULoongArchState,
@@ -4129,6 +4253,10 @@ static bool gen_vreplve(DisasContext *ctx, arg_vvr *a, int vece, int bit,
     TCGv_ptr t1 = tcg_temp_new_ptr();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     tcg_gen_andi_i64(t0, gpr_src(ctx, a->rk, EXT_NONE), (LSX_LEN/bit) -1);
@@ -4145,16 +4273,20 @@ static bool gen_vreplve(DisasContext *ctx, arg_vvr *a, int vece, int bit,
     return true;
 }
 
-TRANS(vreplve_b, ALL, gen_vreplve, MO_8,  8, tcg_gen_ld8u_i64)
-TRANS(vreplve_h, ALL, gen_vreplve, MO_16, 16, tcg_gen_ld16u_i64)
-TRANS(vreplve_w, ALL, gen_vreplve, MO_32, 32, tcg_gen_ld32u_i64)
-TRANS(vreplve_d, ALL, gen_vreplve, MO_64, 64, tcg_gen_ld_i64)
+TRANS(vreplve_b, LSX, gen_vreplve, MO_8,  8, tcg_gen_ld8u_i64)
+TRANS(vreplve_h, LSX, gen_vreplve, MO_16, 16, tcg_gen_ld16u_i64)
+TRANS(vreplve_w, LSX, gen_vreplve, MO_32, 32, tcg_gen_ld32u_i64)
+TRANS(vreplve_d, LSX, gen_vreplve, MO_64, 64, tcg_gen_ld_i64)
 
 static bool trans_vbsll_v(DisasContext *ctx, arg_vv_i *a)
 {
     int ofs;
     TCGv_i64 desthigh, destlow, high, low;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     desthigh = tcg_temp_new_i64();
@@ -4185,6 +4317,10 @@ static bool trans_vbsrl_v(DisasContext *ctx, arg_vv_i *a)
     TCGv_i64 desthigh, destlow, high, low;
     int ofs;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     desthigh = tcg_temp_new_i64();
@@ -4210,48 +4346,48 @@ static bool trans_vbsrl_v(DisasContext *ctx, arg_vv_i *a)
     return true;
 }
 
-TRANS(vpackev_b, ALL, gen_vvv, gen_helper_vpackev_b)
-TRANS(vpackev_h, ALL, gen_vvv, gen_helper_vpackev_h)
-TRANS(vpackev_w, ALL, gen_vvv, gen_helper_vpackev_w)
-TRANS(vpackev_d, ALL, gen_vvv, gen_helper_vpackev_d)
-TRANS(vpackod_b, ALL, gen_vvv, gen_helper_vpackod_b)
-TRANS(vpackod_h, ALL, gen_vvv, gen_helper_vpackod_h)
-TRANS(vpackod_w, ALL, gen_vvv, gen_helper_vpackod_w)
-TRANS(vpackod_d, ALL, gen_vvv, gen_helper_vpackod_d)
+TRANS(vpackev_b, LSX, gen_vvv, gen_helper_vpackev_b)
+TRANS(vpackev_h, LSX, gen_vvv, gen_helper_vpackev_h)
+TRANS(vpackev_w, LSX, gen_vvv, gen_helper_vpackev_w)
+TRANS(vpackev_d, LSX, gen_vvv, gen_helper_vpackev_d)
+TRANS(vpackod_b, LSX, gen_vvv, gen_helper_vpackod_b)
+TRANS(vpackod_h, LSX, gen_vvv, gen_helper_vpackod_h)
+TRANS(vpackod_w, LSX, gen_vvv, gen_helper_vpackod_w)
+TRANS(vpackod_d, LSX, gen_vvv, gen_helper_vpackod_d)
 
-TRANS(vpickev_b, ALL, gen_vvv, gen_helper_vpickev_b)
-TRANS(vpickev_h, ALL, gen_vvv, gen_helper_vpickev_h)
-TRANS(vpickev_w, ALL, gen_vvv, gen_helper_vpickev_w)
-TRANS(vpickev_d, ALL, gen_vvv, gen_helper_vpickev_d)
-TRANS(vpickod_b, ALL, gen_vvv, gen_helper_vpickod_b)
-TRANS(vpickod_h, ALL, gen_vvv, gen_helper_vpickod_h)
-TRANS(vpickod_w, ALL, gen_vvv, gen_helper_vpickod_w)
-TRANS(vpickod_d, ALL, gen_vvv, gen_helper_vpickod_d)
+TRANS(vpickev_b, LSX, gen_vvv, gen_helper_vpickev_b)
+TRANS(vpickev_h, LSX, gen_vvv, gen_helper_vpickev_h)
+TRANS(vpickev_w, LSX, gen_vvv, gen_helper_vpickev_w)
+TRANS(vpickev_d, LSX, gen_vvv, gen_helper_vpickev_d)
+TRANS(vpickod_b, LSX, gen_vvv, gen_helper_vpickod_b)
+TRANS(vpickod_h, LSX, gen_vvv, gen_helper_vpickod_h)
+TRANS(vpickod_w, LSX, gen_vvv, gen_helper_vpickod_w)
+TRANS(vpickod_d, LSX, gen_vvv, gen_helper_vpickod_d)
 
-TRANS(vilvl_b, ALL, gen_vvv, gen_helper_vilvl_b)
-TRANS(vilvl_h, ALL, gen_vvv, gen_helper_vilvl_h)
-TRANS(vilvl_w, ALL, gen_vvv, gen_helper_vilvl_w)
-TRANS(vilvl_d, ALL, gen_vvv, gen_helper_vilvl_d)
-TRANS(vilvh_b, ALL, gen_vvv, gen_helper_vilvh_b)
-TRANS(vilvh_h, ALL, gen_vvv, gen_helper_vilvh_h)
-TRANS(vilvh_w, ALL, gen_vvv, gen_helper_vilvh_w)
-TRANS(vilvh_d, ALL, gen_vvv, gen_helper_vilvh_d)
+TRANS(vilvl_b, LSX, gen_vvv, gen_helper_vilvl_b)
+TRANS(vilvl_h, LSX, gen_vvv, gen_helper_vilvl_h)
+TRANS(vilvl_w, LSX, gen_vvv, gen_helper_vilvl_w)
+TRANS(vilvl_d, LSX, gen_vvv, gen_helper_vilvl_d)
+TRANS(vilvh_b, LSX, gen_vvv, gen_helper_vilvh_b)
+TRANS(vilvh_h, LSX, gen_vvv, gen_helper_vilvh_h)
+TRANS(vilvh_w, LSX, gen_vvv, gen_helper_vilvh_w)
+TRANS(vilvh_d, LSX, gen_vvv, gen_helper_vilvh_d)
 
-TRANS(vshuf_b, ALL, gen_vvvv, gen_helper_vshuf_b)
-TRANS(vshuf_h, ALL, gen_vvv, gen_helper_vshuf_h)
-TRANS(vshuf_w, ALL, gen_vvv, gen_helper_vshuf_w)
-TRANS(vshuf_d, ALL, gen_vvv, gen_helper_vshuf_d)
-TRANS(vshuf4i_b, ALL, gen_vv_i, gen_helper_vshuf4i_b)
-TRANS(vshuf4i_h, ALL, gen_vv_i, gen_helper_vshuf4i_h)
-TRANS(vshuf4i_w, ALL, gen_vv_i, gen_helper_vshuf4i_w)
-TRANS(vshuf4i_d, ALL, gen_vv_i, gen_helper_vshuf4i_d)
+TRANS(vshuf_b, LSX, gen_vvvv, gen_helper_vshuf_b)
+TRANS(vshuf_h, LSX, gen_vvv, gen_helper_vshuf_h)
+TRANS(vshuf_w, LSX, gen_vvv, gen_helper_vshuf_w)
+TRANS(vshuf_d, LSX, gen_vvv, gen_helper_vshuf_d)
+TRANS(vshuf4i_b, LSX, gen_vv_i, gen_helper_vshuf4i_b)
+TRANS(vshuf4i_h, LSX, gen_vv_i, gen_helper_vshuf4i_h)
+TRANS(vshuf4i_w, LSX, gen_vv_i, gen_helper_vshuf4i_w)
+TRANS(vshuf4i_d, LSX, gen_vv_i, gen_helper_vshuf4i_d)
 
-TRANS(vpermi_w, ALL, gen_vv_i, gen_helper_vpermi_w)
+TRANS(vpermi_w, LSX, gen_vv_i, gen_helper_vpermi_w)
 
-TRANS(vextrins_b, ALL, gen_vv_i, gen_helper_vextrins_b)
-TRANS(vextrins_h, ALL, gen_vv_i, gen_helper_vextrins_h)
-TRANS(vextrins_w, ALL, gen_vv_i, gen_helper_vextrins_w)
-TRANS(vextrins_d, ALL, gen_vv_i, gen_helper_vextrins_d)
+TRANS(vextrins_b, LSX, gen_vv_i, gen_helper_vextrins_b)
+TRANS(vextrins_h, LSX, gen_vv_i, gen_helper_vextrins_h)
+TRANS(vextrins_w, LSX, gen_vv_i, gen_helper_vextrins_w)
+TRANS(vextrins_d, LSX, gen_vv_i, gen_helper_vextrins_d)
 
 static bool trans_vld(DisasContext *ctx, arg_vr_i *a)
 {
@@ -4259,6 +4395,10 @@ static bool trans_vld(DisasContext *ctx, arg_vr_i *a)
     TCGv_i64 rl, rh;
     TCGv_i128 val;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     addr = gpr_src(ctx, a->rj, EXT_NONE);
@@ -4282,6 +4422,10 @@ static bool trans_vst(DisasContext *ctx, arg_vr_i *a)
     TCGv_i128 val;
     TCGv_i64 ah, al;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     addr = gpr_src(ctx, a->rj, EXT_NONE);
@@ -4305,6 +4449,10 @@ static bool trans_vldx(DisasContext *ctx, arg_vrr *a)
     TCGv_i64 rl, rh;
     TCGv_i128 val;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     src1 = gpr_src(ctx, a->rj, EXT_NONE);
@@ -4328,6 +4476,10 @@ static bool trans_vstx(DisasContext *ctx, arg_vrr *a)
     TCGv_i64 ah, al;
     TCGv_i128 val;
 
+    if (!avail_LSX(ctx)) {
+        return false;
+    }
+
     CHECK_SXE;
 
     src1 = gpr_src(ctx, a->rj, EXT_NONE);
@@ -4351,6 +4503,10 @@ static bool trans_## NAME (DisasContext *ctx, arg_vr_i *a)                \
     TCGv addr;                                                            \
     TCGv_i64 val;                                                         \
                                                                           \
+    if (!avail_LSX(ctx)) {                                                \
+        return false;                                                     \
+    }                                                                     \
+                                                                          \
     CHECK_SXE;                                                            \
                                                                           \
     addr = gpr_src(ctx, a->rj, EXT_NONE);                                 \
@@ -4375,6 +4531,10 @@ static bool trans_## NAME (DisasContext *ctx, arg_vr_ii *a)                  \
     TCGv addr;                                                               \
     TCGv_i64 val;                                                            \
                                                                              \
+    if (!avail_LSX(ctx)) {                                                   \
+        return false;                                                        \
+    }                                                                        \
+                                                                             \
     CHECK_SXE;                                                               \
                                                                              \
     addr = gpr_src(ctx, a->rj, EXT_NONE);                                    \
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index faf4ce87f9..db46e9aa0f 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -22,6 +22,8 @@
 #define avail_FP_DP(C) (FIELD_EX32((C)->cpucfg2, CPUCFG2, FP_DP))
 #define avail_LSPW(C)  (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSPW))
 #define avail_LAM(C)   (FIELD_EX32((C)->cpucfg2, CPUCFG2, LAM))
+#define avail_LSX(C)   (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSX))
+
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,

From a380c6f11fd9f1ca96f204c4ae26c79e483ede8a Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 22 Aug 2023 09:22:19 +0200
Subject: [PATCH 1194/1353] target/loongarch: Add avail_IOCSR to check iocsr
 instructions

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230822032724.1353391-16-gaosong@loongson.cn>
Message-Id: <20230822072219.35719-1-philmd@linaro.org>
---
 .../loongarch/insn_trans/trans_privileged.c.inc  | 16 ++++++++--------
 target/loongarch/translate.h                     |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/loongarch/insn_trans/trans_privileged.c.inc b/target/loongarch/insn_trans/trans_privileged.c.inc
index 099cd871f0..4cb701b4b5 100644
--- a/target/loongarch/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/insn_trans/trans_privileged.c.inc
@@ -312,14 +312,14 @@ static bool gen_iocsrwr(DisasContext *ctx, arg_rr *a,
     return true;
 }
 
-TRANS(iocsrrd_b, ALL, gen_iocsrrd, gen_helper_iocsrrd_b)
-TRANS(iocsrrd_h, ALL, gen_iocsrrd, gen_helper_iocsrrd_h)
-TRANS(iocsrrd_w, ALL, gen_iocsrrd, gen_helper_iocsrrd_w)
-TRANS(iocsrrd_d, ALL, gen_iocsrrd, gen_helper_iocsrrd_d)
-TRANS(iocsrwr_b, ALL, gen_iocsrwr, gen_helper_iocsrwr_b)
-TRANS(iocsrwr_h, ALL, gen_iocsrwr, gen_helper_iocsrwr_h)
-TRANS(iocsrwr_w, ALL, gen_iocsrwr, gen_helper_iocsrwr_w)
-TRANS(iocsrwr_d, ALL, gen_iocsrwr, gen_helper_iocsrwr_d)
+TRANS(iocsrrd_b, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_b)
+TRANS(iocsrrd_h, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_h)
+TRANS(iocsrrd_w, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_w)
+TRANS(iocsrrd_d, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_d)
+TRANS(iocsrwr_b, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_b)
+TRANS(iocsrwr_h, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_h)
+TRANS(iocsrwr_w, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_w)
+TRANS(iocsrwr_d, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_d)
 
 static void check_mmu_idx(DisasContext *ctx)
 {
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index db46e9aa0f..89b49a859e 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -23,7 +23,7 @@
 #define avail_LSPW(C)  (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSPW))
 #define avail_LAM(C)   (FIELD_EX32((C)->cpucfg2, CPUCFG2, LAM))
 #define avail_LSX(C)   (FIELD_EX32((C)->cpucfg2, CPUCFG2, LSX))
-
+#define avail_IOCSR(C) (FIELD_EX32((C)->cpucfg1, CPUCFG1, IOCSR))
 
 /*
  * If an operation is being performed on less than TARGET_LONG_BITS,

From 14f21f673a01cf3efa22a70256947fb9b6bbfdfa Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 24 Aug 2023 08:50:07 +0800
Subject: [PATCH 1195/1353] target/loongarch: cpu: Implement get_arch_id
 callback

Implement the callback for getting the architecture-dependent CPU
ID, the cpu ID is physical id described in ACPI MADT table, this
will be used for cpu hotplug.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20230824005007.2000525-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c    | 2 ++
 target/loongarch/cpu.c | 8 ++++++++
 target/loongarch/cpu.h | 1 +
 3 files changed, 11 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index af15bf5aaa..2629128aed 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -810,6 +810,8 @@ static void loongarch_init(MachineState *machine)
         cpu = cpu_create(machine->cpu_type);
         cpu->cpu_index = i;
         machine->possible_cpus->cpus[i].cpu = OBJECT(cpu);
+        lacpu = LOONGARCH_CPU(cpu);
+        lacpu->phy_id = machine->possible_cpus->cpus[i].arch_id;
     }
     fdt_add_cpu_nodes(lams);
 
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index d3c3e0d8a1..27fc6e1f33 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -722,6 +722,13 @@ static struct TCGCPUOps loongarch_tcg_ops = {
 static const struct SysemuCPUOps loongarch_sysemu_ops = {
     .get_phys_page_debug = loongarch_cpu_get_phys_page_debug,
 };
+
+static int64_t loongarch_cpu_get_arch_id(CPUState *cs)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+
+    return cpu->phy_id;
+}
 #endif
 
 static void loongarch_cpu_class_init(ObjectClass *c, void *data)
@@ -742,6 +749,7 @@ static void loongarch_cpu_class_init(ObjectClass *c, void *data)
     cc->set_pc = loongarch_cpu_set_pc;
     cc->get_pc = loongarch_cpu_get_pc;
 #ifndef CONFIG_USER_ONLY
+    cc->get_arch_id = loongarch_cpu_get_arch_id;
     dc->vmsd = &vmstate_loongarch_cpu;
     cc->sysemu_ops = &loongarch_sysemu_ops;
 #endif
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 25a0ef7e41..4d7201995a 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -376,6 +376,7 @@ struct ArchCPU {
     CPUNegativeOffsetState neg;
     CPULoongArchState env;
     QEMUTimer timer;
+    uint32_t  phy_id;
 
     /* 'compatible' string for this CPU for Linux device trees */
     const char *dtb_compatible;

From 2948c1fb6b8d806d92394ec358e6ed727e946df9 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 7 Jul 2023 17:15:57 +0800
Subject: [PATCH 1196/1353] hw/intc/loongarch_pch: fix edge triggered irq
 handling

For edge triggered irq, qemu_irq_pulse is used to inject irq. It will
set irq with high level and low level soon to simluate pulse irq.

For edge triggered irq, irq is injected and set as pending at rising
level, do not clear irq at lowering level. LoongArch pch interrupt will
clear irq for lowering level irq, there will be problem. ACPI ged deivce
is edge-triggered irq, it is used for cpu/memory hotplug.

This patch fixes memory hotplug issue on LoongArch virt machine.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20230707091557.1474790-1-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index 9208fc4460..6aa4cadfa4 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -30,7 +30,11 @@ static void pch_pic_update_irq(LoongArchPCHPIC *s, uint64_t mask, int level)
             qemu_set_irq(s->parent_irq[s->htmsi_vector[irq]], 1);
         }
     } else {
-        val = mask & s->intisr;
+        /*
+         * intirr means requested pending irq
+         * do not clear pending irq for edge-triggered on lowering edge
+         */
+        val = mask & s->intisr & ~s->intirr;
         if (val) {
             irq = ctz64(val);
             s->intisr &= ~MAKE_64BIT_MASK(irq, 1);
@@ -51,6 +55,7 @@ static void pch_pic_irq_handler(void *opaque, int irq, int level)
         /* Edge triggered */
         if (level) {
             if ((s->last_intirr & mask) == 0) {
+                /* marked pending on a rising edge */
                 s->intirr |= mask;
             }
             s->last_intirr |= mask;

From 17ffe331a923c9015887917b27212ab39ff1d8ea Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Tue, 8 Aug 2023 13:42:47 +0800
Subject: [PATCH 1197/1353] target/loongarch: Split fcc register to fcc0-7 in
 gdbstub

Since GDB 13.1(GDB commit ea3352172), GDB LoongArch changed to use
fcc0-7 instead of fcc register. This commit partially reverts commit
2f149c759 (`target/loongarch: Update gdb_set_fpu() and gdb_get_fpu()`)
to match the behavior of GDB.

Note that it is a breaking change for GDB 13.0 or earlier, but it is
also required for GDB 13.1 or later to work.

Signed-off-by: Jiajie Chen <c@jia.je>
Acked-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20230808054315.3391465-1-c@jia.je>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 gdb-xml/loongarch-fpu.xml  |  9 ++++++++-
 target/loongarch/gdbstub.c | 16 +++++++---------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/gdb-xml/loongarch-fpu.xml b/gdb-xml/loongarch-fpu.xml
index 78e42cf5dd..e81e3382e7 100644
--- a/gdb-xml/loongarch-fpu.xml
+++ b/gdb-xml/loongarch-fpu.xml
@@ -45,6 +45,13 @@
   <reg name="f29" bitsize="64" type="fputype" group="float"/>
   <reg name="f30" bitsize="64" type="fputype" group="float"/>
   <reg name="f31" bitsize="64" type="fputype" group="float"/>
-  <reg name="fcc" bitsize="64" type="uint64" group="float"/>
+  <reg name="fcc0" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc1" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc2" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc3" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc4" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc5" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc6" bitsize="8" type="uint8" group="float"/>
+  <reg name="fcc7" bitsize="8" type="uint8" group="float"/>
   <reg name="fcsr" bitsize="32" type="uint32" group="float"/>
 </feature>
diff --git a/target/loongarch/gdbstub.c b/target/loongarch/gdbstub.c
index e20b20f99b..b09804b62f 100644
--- a/target/loongarch/gdbstub.c
+++ b/target/loongarch/gdbstub.c
@@ -88,10 +88,9 @@ static int loongarch_gdb_get_fpu(CPULoongArchState *env,
 {
     if (0 <= n && n < 32) {
         return gdb_get_reg64(mem_buf, env->fpr[n].vreg.D(0));
-    } else if (n == 32) {
-        uint64_t val = read_fcc(env);
-        return gdb_get_reg64(mem_buf, val);
-    } else if (n == 33) {
+    } else if (32 <= n && n < 40) {
+        return gdb_get_reg8(mem_buf, env->cf[n - 32]);
+    } else if (n == 40) {
         return gdb_get_reg32(mem_buf, env->fcsr0);
     }
     return 0;
@@ -105,11 +104,10 @@ static int loongarch_gdb_set_fpu(CPULoongArchState *env,
     if (0 <= n && n < 32) {
         env->fpr[n].vreg.D(0) = ldq_p(mem_buf);
         length = 8;
-    } else if (n == 32) {
-        uint64_t val = ldq_p(mem_buf);
-        write_fcc(env, val);
-        length = 8;
-    } else if (n == 33) {
+    } else if (32 <= n && n < 40) {
+        env->cf[n - 32] = ldub_p(mem_buf);
+        length = 1;
+    } else if (n == 40) {
         env->fcsr0 = ldl_p(mem_buf);
         length = 4;
     }

From 3f6bec4a9f7c159d32d49f6df5c2c3d587b953b9 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Sun, 20 Aug 2023 18:56:59 +0800
Subject: [PATCH 1198/1353] hw/loongarch: Fix ACPI processor id off-by-one
 error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In hw/acpi/aml-build.c:build_pptt() function, the code assumes that the
ACPI processor id equals to the cpu index, for example if we have 8
cpus, then the ACPI processor id should be in range 0-7.

However, in hw/loongarch/acpi-build.c:build_madt() function we broke the
assumption. If we have 8 cpus again, the ACPI processor id in MADT table
would be in range 1-8. It violates the following description taken from
ACPI spec 6.4 table 5.138:

If the processor structure represents an actual processor, this field
must match the value of ACPI processor ID field in the processor’s entry
in the MADT.

It will break the latest Linux 6.5-rc6 with the
following error message:

ACPI PPTT: PPTT table found, but unable to locate core 7 (8)
Invalid BIOS PPTT

Here 7 is the last cpu index, 8 is the ACPI processor id learned from
MADT.

With this patch, Linux can properly detect SMT threads when "-smp
8,sockets=1,cores=4,threads=2" is passed:

Thread(s) per core:  2
Core(s) per socket:  2
Socket(s):           2

The detection of number of sockets is still wrong, but that is out of
scope of the commit.

Signed-off-by: Jiajie Chen <c@jia.je>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20230820105658.99123-2-c@jia.je>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/loongarch/acpi-build.c b/hw/loongarch/acpi-build.c
index 0b62c3a2f7..ae292fc543 100644
--- a/hw/loongarch/acpi-build.c
+++ b/hw/loongarch/acpi-build.c
@@ -127,7 +127,7 @@ build_madt(GArray *table_data, BIOSLinker *linker, LoongArchMachineState *lams)
         build_append_int_noprefix(table_data, 17, 1);    /* Type */
         build_append_int_noprefix(table_data, 15, 1);    /* Length */
         build_append_int_noprefix(table_data, 1, 1);     /* Version */
-        build_append_int_noprefix(table_data, i + 1, 4); /* ACPI Processor ID */
+        build_append_int_noprefix(table_data, i, 4);     /* ACPI Processor ID */
         build_append_int_noprefix(table_data, arch_id, 4); /* Core ID */
         build_append_int_noprefix(table_data, 1, 4);     /* Flags */
     }

From b67be03e3ac9d20a258f24dcaf1b61c91c1306f5 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:56:58 +0200
Subject: [PATCH 1199/1353] accel/kvm: Widen pc/saved_insn for
 kvm_sw_breakpoint

Widens the pc and saved_insn fields of kvm_sw_breakpoint from
target_ulong to vaddr. The pc argument of kvm_find_sw_breakpoint is also
widened to match.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-2-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/kvm/kvm-all.c  | 3 +--
 include/sysemu/kvm.h | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index d07f1ecbd3..2ba7521695 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3309,8 +3309,7 @@ bool kvm_arm_supports_user_irq(void)
 }
 
 #ifdef KVM_CAP_SET_GUEST_DEBUG
-struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
-                                                 target_ulong pc)
+struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu, vaddr pc)
 {
     struct kvm_sw_breakpoint *bp;
 
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index ccaf55caf7..407fe183cc 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -413,14 +413,14 @@ struct kvm_guest_debug;
 struct kvm_debug_exit_arch;
 
 struct kvm_sw_breakpoint {
-    target_ulong pc;
-    target_ulong saved_insn;
+    vaddr pc;
+    vaddr saved_insn;
     int use_count;
     QTAILQ_ENTRY(kvm_sw_breakpoint) entry;
 };
 
 struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
-                                                 target_ulong pc);
+                                                 vaddr pc);
 
 int kvm_sw_breakpoints_active(CPUState *cpu);
 

From fcfe761680e2a94f64a20914c0df9462ec31b113 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:56:59 +0200
Subject: [PATCH 1200/1353] accel/hvf: Widen pc/saved_insn for
 hvf_sw_breakpoint

Widens the pc and saved_insn fields of hvf_sw_breakpoint from
target_ulong to vaddr. Other hvf_* functions accessing hvf_sw_breakpoint
are also widened to match.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-3-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 4 ++--
 accel/hvf/hvf-all.c       | 2 +-
 include/sysemu/hvf.h      | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index a44cf1c144..3c94c79747 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -474,7 +474,7 @@ static void hvf_start_vcpu_thread(CPUState *cpu)
                        cpu, QEMU_THREAD_JOINABLE);
 }
 
-static int hvf_insert_breakpoint(CPUState *cpu, int type, hwaddr addr, hwaddr len)
+static int hvf_insert_breakpoint(CPUState *cpu, int type, vaddr addr, vaddr len)
 {
     struct hvf_sw_breakpoint *bp;
     int err;
@@ -512,7 +512,7 @@ static int hvf_insert_breakpoint(CPUState *cpu, int type, hwaddr addr, hwaddr le
     return 0;
 }
 
-static int hvf_remove_breakpoint(CPUState *cpu, int type, hwaddr addr, hwaddr len)
+static int hvf_remove_breakpoint(CPUState *cpu, int type, vaddr addr, vaddr len)
 {
     struct hvf_sw_breakpoint *bp;
     int err;
diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index 4920787af6..db05b81be5 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -51,7 +51,7 @@ void assert_hvf_ok(hv_return_t ret)
     abort();
 }
 
-struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu, target_ulong pc)
+struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu, vaddr pc)
 {
     struct hvf_sw_breakpoint *bp;
 
diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index 70549b9158..4cbae87ced 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -39,14 +39,14 @@ DECLARE_INSTANCE_CHECKER(HVFState, HVF_STATE,
 
 #ifdef NEED_CPU_H
 struct hvf_sw_breakpoint {
-    target_ulong pc;
-    target_ulong saved_insn;
+    vaddr pc;
+    vaddr saved_insn;
     int use_count;
     QTAILQ_ENTRY(hvf_sw_breakpoint) entry;
 };
 
 struct hvf_sw_breakpoint *hvf_find_sw_breakpoint(CPUState *cpu,
-                                                 target_ulong pc);
+                                                 vaddr pc);
 int hvf_sw_breakpoints_active(CPUState *cpu);
 
 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);

From b8a6eb1862a96b1c51518df2562804a39eccd97b Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:00 +0200
Subject: [PATCH 1201/1353] sysemu/kvm: Use vaddr for
 kvm_arch_[insert|remove]_hw_breakpoint

Changes the signature of the target-defined functions for
inserting/removing kvm hw breakpoints. The address and length arguments
are now of vaddr type, which both matches the type used internally in
accel/kvm/kvm-all.c and makes the api target-agnostic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-4-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/kvm.h   |  6 ++----
 target/arm/kvm64.c     |  6 ++----
 target/i386/kvm/kvm.c  |  8 +++-----
 target/ppc/kvm.c       | 13 ++++++-------
 target/s390x/kvm/kvm.c |  6 ++----
 5 files changed, 15 insertions(+), 24 deletions(-)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 407fe183cc..ebdca41052 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -428,10 +428,8 @@ int kvm_arch_insert_sw_breakpoint(CPUState *cpu,
                                   struct kvm_sw_breakpoint *bp);
 int kvm_arch_remove_sw_breakpoint(CPUState *cpu,
                                   struct kvm_sw_breakpoint *bp);
-int kvm_arch_insert_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type);
-int kvm_arch_remove_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type);
+int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type);
+int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type);
 void kvm_arch_remove_all_hw_breakpoints(void);
 
 void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg);
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index 94bbd9661f..4d904a1d11 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -49,8 +49,7 @@ void kvm_arm_init_debug(KVMState *s)
     return;
 }
 
-int kvm_arch_insert_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     switch (type) {
     case GDB_BREAKPOINT_HW:
@@ -65,8 +64,7 @@ int kvm_arch_insert_hw_breakpoint(target_ulong addr,
     }
 }
 
-int kvm_arch_remove_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     switch (type) {
     case GDB_BREAKPOINT_HW:
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index b45ce20fd8..639a242ad8 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5000,7 +5000,7 @@ MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
         kvm_rate_limit_on_bus_lock();
     }
 
-#ifdef CONFIG_XEN_EMU    
+#ifdef CONFIG_XEN_EMU
     /*
      * If the callback is asserted as a GSI (or PCI INTx) then check if
      * vcpu_info->evtchn_upcall_pending has been cleared, and deassert
@@ -5161,8 +5161,7 @@ static int find_hw_breakpoint(target_ulong addr, int len, int type)
     return -1;
 }
 
-int kvm_arch_insert_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     switch (type) {
     case GDB_BREAKPOINT_HW:
@@ -5202,8 +5201,7 @@ int kvm_arch_insert_hw_breakpoint(target_ulong addr,
     return 0;
 }
 
-int kvm_arch_remove_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     int n;
 
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index dc1182cd37..7698501743 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1449,15 +1449,15 @@ static int find_hw_watchpoint(target_ulong addr, int *flag)
     return -1;
 }
 
-int kvm_arch_insert_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
-    if ((nb_hw_breakpoint + nb_hw_watchpoint) >= ARRAY_SIZE(hw_debug_points)) {
+    const unsigned breakpoint_index = nb_hw_breakpoint + nb_hw_watchpoint;
+    if (breakpoint_index >= ARRAY_SIZE(hw_debug_points)) {
         return -ENOBUFS;
     }
 
-    hw_debug_points[nb_hw_breakpoint + nb_hw_watchpoint].addr = addr;
-    hw_debug_points[nb_hw_breakpoint + nb_hw_watchpoint].type = type;
+    hw_debug_points[breakpoint_index].addr = addr;
+    hw_debug_points[breakpoint_index].type = type;
 
     switch (type) {
     case GDB_BREAKPOINT_HW:
@@ -1493,8 +1493,7 @@ int kvm_arch_insert_hw_breakpoint(target_ulong addr,
     return 0;
 }
 
-int kvm_arch_remove_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     int n;
 
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index c413eca74c..852fbd0df7 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -990,8 +990,7 @@ static int insert_hw_breakpoint(target_ulong addr, int len, int type)
     return 0;
 }
 
-int kvm_arch_insert_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     switch (type) {
     case GDB_BREAKPOINT_HW:
@@ -1009,8 +1008,7 @@ int kvm_arch_insert_hw_breakpoint(target_ulong addr,
     return insert_hw_breakpoint(addr, len, type);
 }
 
-int kvm_arch_remove_hw_breakpoint(target_ulong addr,
-                                  target_ulong len, int type)
+int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     int size;
     struct kvm_hw_breakpoint *bp = find_hw_breakpoint(addr, len, type);

From d447a624d0cffb28836e776687a861cd27d06d2f Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:01 +0200
Subject: [PATCH 1202/1353] sysemu/hvf: Use vaddr for
 hvf_arch_[insert|remove]_hw_breakpoint

Changes the signature of the target-defined functions for
inserting/removing hvf hw breakpoints. The address and length arguments
are now of vaddr type, which both matches the type used internally in
accel/hvf/hvf-all.c and makes the api target-agnostic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-5-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/sysemu/hvf.h  | 6 ++----
 target/arm/hvf/hvf.c  | 4 ++--
 target/i386/hvf/hvf.c | 4 ++--
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/include/sysemu/hvf.h b/include/sysemu/hvf.h
index 4cbae87ced..4037cd6a73 100644
--- a/include/sysemu/hvf.h
+++ b/include/sysemu/hvf.h
@@ -51,10 +51,8 @@ int hvf_sw_breakpoints_active(CPUState *cpu);
 
 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp);
-int hvf_arch_insert_hw_breakpoint(target_ulong addr, target_ulong len,
-                                  int type);
-int hvf_arch_remove_hw_breakpoint(target_ulong addr, target_ulong len,
-                                  int type);
+int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type);
+int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type);
 void hvf_arch_remove_all_hw_breakpoints(void);
 
 /*
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8fce64bbf6..486f90be1d 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2063,7 +2063,7 @@ int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
     return 0;
 }
 
-int hvf_arch_insert_hw_breakpoint(target_ulong addr, target_ulong len, int type)
+int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     switch (type) {
     case GDB_BREAKPOINT_HW:
@@ -2077,7 +2077,7 @@ int hvf_arch_insert_hw_breakpoint(target_ulong addr, target_ulong len, int type)
     }
 }
 
-int hvf_arch_remove_hw_breakpoint(target_ulong addr, target_ulong len, int type)
+int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     switch (type) {
     case GDB_BREAKPOINT_HW:
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index b9cbcc02a8..cb2cd0b02f 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -690,12 +690,12 @@ int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
     return -ENOSYS;
 }
 
-int hvf_arch_insert_hw_breakpoint(target_ulong addr, target_ulong len, int type)
+int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     return -ENOSYS;
 }
 
-int hvf_arch_remove_hw_breakpoint(target_ulong addr, target_ulong len, int type)
+int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 {
     return -ENOSYS;
 }

From 022b9bcedef9b6123d287345e424cc8fc8475dca Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:02 +0200
Subject: [PATCH 1203/1353] include/exec: Replace target_ulong with abi_ptr in
 cpu_[st|ld]*()

Changes the address type of the guest memory read/write functions from
target_ulong to abi_ptr. (abi_ptr is currently typedef'd to target_ulong
but that will change in a following commit.) This will reduce the
coupling between accel/ and target/.

Note: Function pointers that point to cpu_[st|ld]*() in target/riscv and
target/rx are also updated in this commit.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-6-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/atomic_template.h  | 16 ++++++++--------
 accel/tcg/cputlb.c           | 10 +++++-----
 include/exec/cpu_ldst.h      | 24 ++++++++++++------------
 target/riscv/vector_helper.c |  2 +-
 target/rx/op_helper.c        |  6 +++---
 5 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index e312acd16d..84c08b1425 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -69,7 +69,7 @@
 # define END  _le
 #endif
 
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
+ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
                               ABI_TYPE cmpv, ABI_TYPE newv,
                               MemOpIdx oi, uintptr_t retaddr)
 {
@@ -87,7 +87,7 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
 }
 
 #if DATA_SIZE < 16
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr, ABI_TYPE val,
+ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
                            MemOpIdx oi, uintptr_t retaddr)
 {
     DATA_TYPE *haddr = atomic_mmu_lookup(env, addr, oi, DATA_SIZE, retaddr);
@@ -100,7 +100,7 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr, ABI_TYPE val,
 }
 
 #define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
                         ABI_TYPE val, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     DATA_TYPE *haddr, ret;                                          \
@@ -131,7 +131,7 @@ GEN_ATOMIC_HELPER(xor_fetch)
  * of CF_PARALLEL's value, we'll trace just a read and a write.
  */
 #define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
                         ABI_TYPE xval, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     XDATA_TYPE *haddr, cmp, old, new, val = xval;                   \
@@ -172,7 +172,7 @@ GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 # define END  _be
 #endif
 
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
+ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, abi_ptr addr,
                               ABI_TYPE cmpv, ABI_TYPE newv,
                               MemOpIdx oi, uintptr_t retaddr)
 {
@@ -190,7 +190,7 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
 }
 
 #if DATA_SIZE < 16
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr, ABI_TYPE val,
+ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, abi_ptr addr, ABI_TYPE val,
                            MemOpIdx oi, uintptr_t retaddr)
 {
     DATA_TYPE *haddr = atomic_mmu_lookup(env, addr, oi, DATA_SIZE, retaddr);
@@ -203,7 +203,7 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr, ABI_TYPE val,
 }
 
 #define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
                         ABI_TYPE val, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     DATA_TYPE *haddr, ret;                                          \
@@ -231,7 +231,7 @@ GEN_ATOMIC_HELPER(xor_fetch)
  * of CF_PARALLEL's value, we'll trace just a read and a write.
  */
 #define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, abi_ptr addr,            \
                         ABI_TYPE xval, MemOpIdx oi, uintptr_t retaddr) \
 {                                                                   \
     XDATA_TYPE *haddr, ldo, ldn, old, new, val = xval;              \
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index d68fa6867c..11095c4f5f 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -3133,14 +3133,14 @@ static void plugin_store_cb(CPUArchState *env, abi_ptr addr, MemOpIdx oi)
     qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, oi, QEMU_PLUGIN_MEM_W);
 }
 
-void cpu_stb_mmu(CPUArchState *env, target_ulong addr, uint8_t val,
+void cpu_stb_mmu(CPUArchState *env, abi_ptr addr, uint8_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     helper_stb_mmu(env, addr, val, oi, retaddr);
     plugin_store_cb(env, addr, oi);
 }
 
-void cpu_stw_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
+void cpu_stw_mmu(CPUArchState *env, abi_ptr addr, uint16_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_16);
@@ -3148,7 +3148,7 @@ void cpu_stw_mmu(CPUArchState *env, target_ulong addr, uint16_t val,
     plugin_store_cb(env, addr, oi);
 }
 
-void cpu_stl_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
+void cpu_stl_mmu(CPUArchState *env, abi_ptr addr, uint32_t val,
                     MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_32);
@@ -3156,7 +3156,7 @@ void cpu_stl_mmu(CPUArchState *env, target_ulong addr, uint32_t val,
     plugin_store_cb(env, addr, oi);
 }
 
-void cpu_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
+void cpu_stq_mmu(CPUArchState *env, abi_ptr addr, uint64_t val,
                  MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_64);
@@ -3164,7 +3164,7 @@ void cpu_stq_mmu(CPUArchState *env, target_ulong addr, uint64_t val,
     plugin_store_cb(env, addr, oi);
 }
 
-void cpu_st16_mmu(CPUArchState *env, target_ulong addr, Int128 val,
+void cpu_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
                   MemOpIdx oi, uintptr_t retaddr)
 {
     tcg_debug_assert((get_memop(oi) & MO_SIZE) == MO_128);
diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index 645476f0e5..da10ba1433 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -223,31 +223,31 @@ void cpu_stq_mmu(CPUArchState *env, abi_ptr ptr, uint64_t val,
 void cpu_st16_mmu(CPUArchState *env, abi_ptr addr, Int128 val,
                   MemOpIdx oi, uintptr_t ra);
 
-uint32_t cpu_atomic_cmpxchgb_mmu(CPUArchState *env, target_ulong addr,
+uint32_t cpu_atomic_cmpxchgb_mmu(CPUArchState *env, abi_ptr addr,
                                  uint32_t cmpv, uint32_t newv,
                                  MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgw_le_mmu(CPUArchState *env, target_ulong addr,
+uint32_t cpu_atomic_cmpxchgw_le_mmu(CPUArchState *env, abi_ptr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgl_le_mmu(CPUArchState *env, target_ulong addr,
+uint32_t cpu_atomic_cmpxchgl_le_mmu(CPUArchState *env, abi_ptr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint64_t cpu_atomic_cmpxchgq_le_mmu(CPUArchState *env, target_ulong addr,
+uint64_t cpu_atomic_cmpxchgq_le_mmu(CPUArchState *env, abi_ptr addr,
                                     uint64_t cmpv, uint64_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgw_be_mmu(CPUArchState *env, target_ulong addr,
+uint32_t cpu_atomic_cmpxchgw_be_mmu(CPUArchState *env, abi_ptr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint32_t cpu_atomic_cmpxchgl_be_mmu(CPUArchState *env, target_ulong addr,
+uint32_t cpu_atomic_cmpxchgl_be_mmu(CPUArchState *env, abi_ptr addr,
                                     uint32_t cmpv, uint32_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
-uint64_t cpu_atomic_cmpxchgq_be_mmu(CPUArchState *env, target_ulong addr,
+uint64_t cpu_atomic_cmpxchgq_be_mmu(CPUArchState *env, abi_ptr addr,
                                     uint64_t cmpv, uint64_t newv,
                                     MemOpIdx oi, uintptr_t retaddr);
 
-#define GEN_ATOMIC_HELPER(NAME, TYPE, SUFFIX)         \
-TYPE cpu_atomic_ ## NAME ## SUFFIX ## _mmu            \
-    (CPUArchState *env, target_ulong addr, TYPE val,  \
+#define GEN_ATOMIC_HELPER(NAME, TYPE, SUFFIX)   \
+TYPE cpu_atomic_ ## NAME ## SUFFIX ## _mmu      \
+    (CPUArchState *env, abi_ptr addr, TYPE val, \
      MemOpIdx oi, uintptr_t retaddr);
 
 #ifdef CONFIG_ATOMIC64
@@ -293,10 +293,10 @@ GEN_ATOMIC_HELPER_ALL(xchg)
 #undef GEN_ATOMIC_HELPER_ALL
 #undef GEN_ATOMIC_HELPER
 
-Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, target_ulong addr,
+Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, abi_ptr addr,
                                   Int128 cmpv, Int128 newv,
                                   MemOpIdx oi, uintptr_t retaddr);
-Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, target_ulong addr,
+Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, abi_ptr addr,
                                   Int128 cmpv, Int128 newv,
                                   MemOpIdx oi, uintptr_t retaddr);
 
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 4d06754826..bf7e0029a1 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -235,7 +235,7 @@ static inline int vext_elem_mask(void *v0, int index)
 }
 
 /* elements operations for load and store */
-typedef void vext_ldst_elem_fn(CPURISCVState *env, target_ulong addr,
+typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                uint32_t idx, void *vd, uintptr_t retaddr);
 
 #define GEN_VEXT_LD_ELEM(NAME, ETYPE, H, LDSUF)            \
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index dc0092ca99..691a12b2be 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -216,19 +216,19 @@ void helper_scmpu(CPURXState *env)
 }
 
 static uint32_t (* const cpu_ldufn[])(CPUArchState *env,
-                                     target_ulong ptr,
+                                     abi_ptr ptr,
                                      uintptr_t retaddr) = {
     cpu_ldub_data_ra, cpu_lduw_data_ra, cpu_ldl_data_ra,
 };
 
 static uint32_t (* const cpu_ldfn[])(CPUArchState *env,
-                                     target_ulong ptr,
+                                     abi_ptr ptr,
                                      uintptr_t retaddr) = {
     cpu_ldub_data_ra, cpu_lduw_data_ra, cpu_ldl_data_ra,
 };
 
 static void (* const cpu_stfn[])(CPUArchState *env,
-                                 target_ulong ptr,
+                                 abi_ptr ptr,
                                  uint32_t val,
                                  uintptr_t retaddr) = {
     cpu_stb_data_ra, cpu_stw_data_ra, cpu_stl_data_ra,

From fc15bfb6a6bda8d4d01f1383579d385acae17c0f Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:03 +0200
Subject: [PATCH 1204/1353] include/exec: typedef abi_ptr to vaddr in softmmu

In system mode, abi_ptr is primarily used for representing addresses
when accessing guest memory with cpu_[st|ld]*(). Widening it from
target_ulong to vaddr reduces the target dependence of these functions
and is step towards building accel/ once for system mode.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-7-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu_ldst.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index da10ba1433..f3ce4eb1d0 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -121,8 +121,8 @@ static inline bool guest_range_valid_untagged(abi_ulong start, abi_ulong len)
     h2g_nocheck(x); \
 })
 #else
-typedef target_ulong abi_ptr;
-#define TARGET_ABI_FMT_ptr TARGET_FMT_lx
+typedef vaddr abi_ptr;
+#define TARGET_ABI_FMT_ptr "%016" VADDR_PRIx
 #endif
 
 uint32_t cpu_ldub_data(CPUArchState *env, abi_ptr ptr);

From c78edb563942ce80c9c6c03b07397725b006b625 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:04 +0200
Subject: [PATCH 1205/1353] include/exec: Widen tlb_hit/tlb_hit_page()

tlb_addr is changed from target_ulong to uint64_t to match the type of
a CPUTLBEntry value, and the addressed is changed to vaddr.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-8-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu-all.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 94f44f1f59..c2c62160c6 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -397,7 +397,7 @@ QEMU_BUILD_BUG_ON(TLB_FLAGS_MASK & TLB_SLOW_FLAGS_MASK);
  * @addr: virtual address to test (must be page aligned)
  * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
  */
-static inline bool tlb_hit_page(target_ulong tlb_addr, target_ulong addr)
+static inline bool tlb_hit_page(uint64_t tlb_addr, vaddr addr)
 {
     return addr == (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK));
 }
@@ -408,7 +408,7 @@ static inline bool tlb_hit_page(target_ulong tlb_addr, target_ulong addr)
  * @addr: virtual address to test (need not be page aligned)
  * @tlb_addr: TLB entry address (a CPUTLBEntry addr_read/write/code value)
  */
-static inline bool tlb_hit(target_ulong tlb_addr, target_ulong addr)
+static inline bool tlb_hit(uint64_t tlb_addr, vaddr addr)
 {
     return tlb_hit_page(tlb_addr, addr & TARGET_PAGE_MASK);
 }

From d712b116385e262329e323d02de79998f18191a8 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:05 +0200
Subject: [PATCH 1206/1353] accel/tcg: Widen address arg in tlb_compare_set()

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-9-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 11095c4f5f..bd2cf4b0be 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1108,7 +1108,7 @@ static void tlb_add_large_page(CPUArchState *env, int mmu_idx,
 }
 
 static inline void tlb_set_compare(CPUTLBEntryFull *full, CPUTLBEntry *ent,
-                                   target_ulong address, int flags,
+                                   vaddr address, int flags,
                                    MMUAccessType access_type, bool enable)
 {
     if (enable) {

From e79f81421b78c4329d54a895b96d74a88d055968 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 7 Aug 2023 17:57:06 +0200
Subject: [PATCH 1207/1353] accel/tcg: Update run_on_cpu_data static assert

As we are now using vaddr for representing guest addresses, update the
static assert to check that vaddr fits in the run_on_cpu_data union.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230807155706.9580-10-anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index bd2cf4b0be..c643d66190 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -74,8 +74,9 @@
     } while (0)
 
 /* run_on_cpu_data.target_ptr should always be big enough for a
- * target_ulong even on 32 bit builds */
-QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
+ * vaddr even on 32 bit builds
+ */
+QEMU_BUILD_BUG_ON(sizeof(vaddr) > sizeof(run_on_cpu_data));
 
 /* We currently can't handle more than 16 bits in the MMUIDX bitmask.
  */

From 64919f710f3547e59e56089e91e4cbe0c623a6af Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 17:36:02 -0700
Subject: [PATCH 1208/1353] target/m68k: Use tcg_gen_deposit_i32 in
 gen_partset_reg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/m68k/translate.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index e07161d76f..d08e823b6c 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -697,19 +697,12 @@ static inline int ext_opsize(int ext, int pos)
  */
 static void gen_partset_reg(int opsize, TCGv reg, TCGv val)
 {
-    TCGv tmp;
     switch (opsize) {
     case OS_BYTE:
-        tcg_gen_andi_i32(reg, reg, 0xffffff00);
-        tmp = tcg_temp_new();
-        tcg_gen_ext8u_i32(tmp, val);
-        tcg_gen_or_i32(reg, reg, tmp);
+        tcg_gen_deposit_i32(reg, reg, val, 0, 8);
         break;
     case OS_WORD:
-        tcg_gen_andi_i32(reg, reg, 0xffff0000);
-        tmp = tcg_temp_new();
-        tcg_gen_ext16u_i32(tmp, val);
-        tcg_gen_or_i32(reg, reg, tmp);
+        tcg_gen_deposit_i32(reg, reg, val, 0, 16);
         break;
     case OS_LONG:
     case OS_SINGLE:

From 36df88c0405aafa747d3ee04c3d96f81827841f7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 13 Aug 2023 10:42:54 -0700
Subject: [PATCH 1209/1353] tcg/i386: Drop BYTEH deposits for 64-bit

It is more useful to allow low-part deposits into all registers
than to restrict allocation for high-byte deposits.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-con-set.h | 2 +-
 tcg/i386/tcg-target-con-str.h | 1 -
 tcg/i386/tcg-target.c.inc     | 7 +++----
 tcg/i386/tcg-target.h         | 4 ++--
 4 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index 5ea3a292f0..3949d49538 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -33,7 +33,7 @@ C_O1_I1(r, q)
 C_O1_I1(r, r)
 C_O1_I1(x, r)
 C_O1_I1(x, x)
-C_O1_I2(Q, 0, Q)
+C_O1_I2(q, 0, q)
 C_O1_I2(q, r, re)
 C_O1_I2(r, 0, ci)
 C_O1_I2(r, 0, r)
diff --git a/tcg/i386/tcg-target-con-str.h b/tcg/i386/tcg-target-con-str.h
index 24e6bcb80d..95a30e58cd 100644
--- a/tcg/i386/tcg-target-con-str.h
+++ b/tcg/i386/tcg-target-con-str.h
@@ -19,7 +19,6 @@ REGS('D', 1u << TCG_REG_EDI)
 REGS('r', ALL_GENERAL_REGS)
 REGS('x', ALL_VECTOR_REGS)
 REGS('q', ALL_BYTEL_REGS)     /* regs that can be used as a byte operand */
-REGS('Q', ALL_BYTEH_REGS)     /* regs with a second byte (e.g. %ah) */
 REGS('L', ALL_GENERAL_REGS & ~SOFTMMU_RESERVE_REGS)  /* qemu_ld/st */
 REGS('s', ALL_BYTEL_REGS & ~SOFTMMU_RESERVE_REGS)    /* qemu_st8_i32 data */
 
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index a6b2eae995..ba40dd0f4d 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -144,7 +144,6 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 # define TCG_REG_L1 TCG_REG_EDX
 #endif
 
-#define ALL_BYTEH_REGS         0x0000000fu
 #if TCG_TARGET_REG_BITS == 64
 # define ALL_GENERAL_REGS      0x0000ffffu
 # define ALL_VECTOR_REGS       0xffff0000u
@@ -152,7 +151,7 @@ static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
 #else
 # define ALL_GENERAL_REGS      0x000000ffu
 # define ALL_VECTOR_REGS       0x00ff0000u
-# define ALL_BYTEL_REGS        ALL_BYTEH_REGS
+# define ALL_BYTEL_REGS        0x0000000fu
 #endif
 #ifdef CONFIG_SOFTMMU
 # define SOFTMMU_RESERVE_REGS  ((1 << TCG_REG_L0) | (1 << TCG_REG_L1))
@@ -2752,7 +2751,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         if (args[3] == 0 && args[4] == 8) {
             /* load bits 0..7 */
             tcg_out_modrm(s, OPC_MOVB_EvGv | P_REXB_R | P_REXB_RM, a2, a0);
-        } else if (args[3] == 8 && args[4] == 8) {
+        } else if (TCG_TARGET_REG_BITS == 32 && args[3] == 8 && args[4] == 8) {
             /* load bits 8..15 */
             tcg_out_modrm(s, OPC_MOVB_EvGv, a2, a0 + 4);
         } else if (args[3] == 0 && args[4] == 16) {
@@ -3312,7 +3311,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-        return C_O1_I2(Q, 0, Q);
+        return C_O1_I2(q, 0, q);
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index 2a2e3fffa8..30cce01ca4 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -227,8 +227,8 @@ typedef enum {
 #define TCG_TARGET_HAS_cmpsel_vec       -1
 
 #define TCG_TARGET_deposit_i32_valid(ofs, len) \
-    (((ofs) == 0 && (len) == 8) || ((ofs) == 8 && (len) == 8) || \
-     ((ofs) == 0 && (len) == 16))
+    (((ofs) == 0 && ((len) == 8 || (len) == 16)) || \
+     (TCG_TARGET_REG_BITS == 32 && (ofs) == 8 && (len) == 8))
 #define TCG_TARGET_deposit_i64_valid    TCG_TARGET_deposit_i32_valid
 
 /* Check for the possibility of high-byte extraction and, for 64-bit,

From 8f7a840d7df92ecbf78802e54eee52e82aa55383 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 13 Aug 2023 11:03:05 -0700
Subject: [PATCH 1210/1353] tcg: Fold deposit with zero to and
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Inserting a zero into a value, or inserting a value
into zero at offset 0 may be implemented with AND.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/optimize.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index d2156367a3..bbd9bb64c6 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1279,6 +1279,8 @@ static bool fold_ctpop(OptContext *ctx, TCGOp *op)
 
 static bool fold_deposit(OptContext *ctx, TCGOp *op)
 {
+    TCGOpcode and_opc;
+
     if (arg_is_const(op->args[1]) && arg_is_const(op->args[2])) {
         uint64_t t1 = arg_info(op->args[1])->val;
         uint64_t t2 = arg_info(op->args[2])->val;
@@ -1287,6 +1289,41 @@ static bool fold_deposit(OptContext *ctx, TCGOp *op)
         return tcg_opt_gen_movi(ctx, op, op->args[0], t1);
     }
 
+    switch (ctx->type) {
+    case TCG_TYPE_I32:
+        and_opc = INDEX_op_and_i32;
+        break;
+    case TCG_TYPE_I64:
+        and_opc = INDEX_op_and_i64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    /* Inserting a value into zero at offset 0. */
+    if (arg_is_const(op->args[1])
+        && arg_info(op->args[1])->val == 0
+        && op->args[3] == 0) {
+        uint64_t mask = MAKE_64BIT_MASK(0, op->args[4]);
+
+        op->opc = and_opc;
+        op->args[1] = op->args[2];
+        op->args[2] = temp_arg(tcg_constant_internal(ctx->type, mask));
+        ctx->z_mask = mask & arg_info(op->args[1])->z_mask;
+        return false;
+    }
+
+    /* Inserting zero into a value. */
+    if (arg_is_const(op->args[2])
+        && arg_info(op->args[2])->val == 0) {
+        uint64_t mask = deposit64(-1, op->args[3], op->args[4], 0);
+
+        op->opc = and_opc;
+        op->args[2] = temp_arg(tcg_constant_internal(ctx->type, mask));
+        ctx->z_mask = mask & arg_info(op->args[1])->z_mask;
+        return false;
+    }
+
     ctx->z_mask = deposit64(arg_info(op->args[1])->z_mask,
                             op->args[3], op->args[4],
                             arg_info(op->args[2])->z_mask);

From 73f97f0aa34c1da9946b399ae92e7b65c51627b1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 13 Aug 2023 11:49:27 -0700
Subject: [PATCH 1211/1353] tcg/i386: Allow immediate as input to deposit_*

We can use MOVB and MOVW with an immediate just as easily
as with a register input.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-con-set.h |  2 +-
 tcg/i386/tcg-target.c.inc     | 26 ++++++++++++++++++++++----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/tcg/i386/tcg-target-con-set.h b/tcg/i386/tcg-target-con-set.h
index 3949d49538..7d00a7dde8 100644
--- a/tcg/i386/tcg-target-con-set.h
+++ b/tcg/i386/tcg-target-con-set.h
@@ -33,7 +33,7 @@ C_O1_I1(r, q)
 C_O1_I1(r, r)
 C_O1_I1(x, r)
 C_O1_I1(x, x)
-C_O1_I2(q, 0, q)
+C_O1_I2(q, 0, qi)
 C_O1_I2(q, r, re)
 C_O1_I2(r, 0, ci)
 C_O1_I2(r, 0, r)
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index ba40dd0f4d..3045b56002 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -276,6 +276,7 @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define OPC_MOVL_GvEv	(0x8b)		/* loads, more or less */
 #define OPC_MOVB_EvIz   (0xc6)
 #define OPC_MOVL_EvIz	(0xc7)
+#define OPC_MOVB_Ib     (0xb0)
 #define OPC_MOVL_Iv     (0xb8)
 #define OPC_MOVBE_GyMy  (0xf0 | P_EXT38)
 #define OPC_MOVBE_MyGy  (0xf1 | P_EXT38)
@@ -2750,13 +2751,30 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     OP_32_64(deposit):
         if (args[3] == 0 && args[4] == 8) {
             /* load bits 0..7 */
-            tcg_out_modrm(s, OPC_MOVB_EvGv | P_REXB_R | P_REXB_RM, a2, a0);
+            if (const_a2) {
+                tcg_out_opc(s, OPC_MOVB_Ib | P_REXB_RM | LOWREGMASK(a0),
+                            0, a0, 0);
+                tcg_out8(s, a2);
+            } else {
+                tcg_out_modrm(s, OPC_MOVB_EvGv | P_REXB_R | P_REXB_RM, a2, a0);
+            }
         } else if (TCG_TARGET_REG_BITS == 32 && args[3] == 8 && args[4] == 8) {
             /* load bits 8..15 */
-            tcg_out_modrm(s, OPC_MOVB_EvGv, a2, a0 + 4);
+            if (const_a2) {
+                tcg_out8(s, OPC_MOVB_Ib + a0 + 4);
+                tcg_out8(s, a2);
+            } else {
+                tcg_out_modrm(s, OPC_MOVB_EvGv, a2, a0 + 4);
+            }
         } else if (args[3] == 0 && args[4] == 16) {
             /* load bits 0..15 */
-            tcg_out_modrm(s, OPC_MOVL_EvGv | P_DATA16, a2, a0);
+            if (const_a2) {
+                tcg_out_opc(s, OPC_MOVL_Iv | P_DATA16 | LOWREGMASK(a0),
+                            0, a0, 0);
+                tcg_out16(s, a2);
+            } else {
+                tcg_out_modrm(s, OPC_MOVL_EvGv | P_DATA16, a2, a0);
+            }
         } else {
             g_assert_not_reached();
         }
@@ -3311,7 +3329,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_deposit_i32:
     case INDEX_op_deposit_i64:
-        return C_O1_I2(q, 0, q);
+        return C_O1_I2(q, 0, qi);
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:

From bb9d7ee83e7279d71dae5dfba4d149abbf2c3b59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 22 Aug 2023 18:28:47 +0200
Subject: [PATCH 1212/1353] docs/devel/tcg-ops: Bury mentions of
 trunc_shr_i64_i32()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 609ad70562 ("tcg: Split trunc_shr_i32 opcode into
extr[lh]_i64_i32") remove trunc_shr_i64_i32(). Update the
backend documentation.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230822162847.71206-1-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 6a166c5665..53695e1623 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -882,14 +882,15 @@ sub2_i32, brcond2_i32).
 On a 64 bit target, the values are transferred between 32 and 64-bit
 registers using the following ops:
 
-- trunc_shr_i64_i32
+- extrl_i64_i32
+- extrh_i64_i32
 - ext_i32_i64
 - extu_i32_i64
 
 They ensure that the values are correctly truncated or extended when
 moved from a 32-bit to a 64-bit register or vice-versa. Note that the
-trunc_shr_i64_i32 is an optional op. It is not necessary to implement
-it if all the following conditions are met:
+extrl_i64_i32 and extrh_i64_i32 are optional ops. It is not necessary
+to implement them if all the following conditions are met:
 
 - 64-bit registers can hold 32-bit values
 - 32-bit values in a 64-bit register do not need to stay zero or

From 13d885b0ad4ada4d216b0341de5ae4a9ce3f5abb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 22 Aug 2023 10:51:10 -0700
Subject: [PATCH 1213/1353] tcg: Unify TCG_TARGET_HAS_extr[lh]_i64_i32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the separate defines with TCG_TARGET_HAS_extr_i64_i32,
so that the two parts of backend-specific type changing cannot
be out of sync.

Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: <20230822175127.1173698-1-richard.henderson@linaro.org>
---
 include/tcg/tcg-opc.h        | 4 ++--
 include/tcg/tcg.h            | 3 +--
 tcg/aarch64/tcg-target.h     | 3 +--
 tcg/i386/tcg-target.h        | 3 +--
 tcg/loongarch64/tcg-target.h | 3 +--
 tcg/mips/tcg-target.h        | 3 +--
 tcg/ppc/tcg-target.h         | 3 +--
 tcg/riscv/tcg-target.h       | 3 +--
 tcg/s390x/tcg-target.h       | 3 +--
 tcg/sparc64/tcg-target.h     | 3 +--
 tcg/tcg-op.c                 | 4 ++--
 tcg/tcg.c                    | 3 +--
 tcg/tci/tcg-target.h         | 3 +--
 13 files changed, 15 insertions(+), 26 deletions(-)

diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index acfa5ba753..c64dfe558c 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -152,10 +152,10 @@ DEF(extract2_i64, 1, 2, 1, IMPL64 | IMPL(TCG_TARGET_HAS_extract2_i64))
 DEF(ext_i32_i64, 1, 1, 0, IMPL64)
 DEF(extu_i32_i64, 1, 1, 0, IMPL64)
 DEF(extrl_i64_i32, 1, 1, 0,
-    IMPL(TCG_TARGET_HAS_extrl_i64_i32)
+    IMPL(TCG_TARGET_HAS_extr_i64_i32)
     | (TCG_TARGET_REG_BITS == 32 ? TCG_OPF_NOT_PRESENT : 0))
 DEF(extrh_i64_i32, 1, 1, 0,
-    IMPL(TCG_TARGET_HAS_extrh_i64_i32)
+    IMPL(TCG_TARGET_HAS_extr_i64_i32)
     | (TCG_TARGET_REG_BITS == 32 ? TCG_OPF_NOT_PRESENT : 0))
 
 DEF(brcond_i64, 0, 2, 2, TCG_OPF_BB_END | TCG_OPF_COND_BRANCH | IMPL64)
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index 0875971719..ea7e55eeb8 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -68,8 +68,7 @@ typedef uint64_t TCGRegSet;
 
 #if TCG_TARGET_REG_BITS == 32
 /* Turn some undef macros into false macros.  */
-#define TCG_TARGET_HAS_extrl_i64_i32    0
-#define TCG_TARGET_HAS_extrh_i64_i32    0
+#define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_div_i64          0
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_div2_i64         0
diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index ce64de06e5..12765cc281 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -92,8 +92,7 @@ typedef enum {
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
-#define TCG_TARGET_HAS_extrl_i64_i32    0
-#define TCG_TARGET_HAS_extrh_i64_i32    0
+#define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_div_i64          1
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index 30cce01ca4..32dd795259 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -159,8 +159,7 @@ typedef enum {
 
 #if TCG_TARGET_REG_BITS == 64
 /* Keep 32-bit values zero-extended in a register.  */
-#define TCG_TARGET_HAS_extrl_i64_i32    1
-#define TCG_TARGET_HAS_extrh_i64_i32    1
+#define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_div2_i64         1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_ext8s_i64        1
diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
index 26f1aab780..c94e0c6044 100644
--- a/tcg/loongarch64/tcg-target.h
+++ b/tcg/loongarch64/tcg-target.h
@@ -130,8 +130,7 @@ typedef enum {
 #define TCG_TARGET_HAS_extract_i64      1
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_extrl_i64_i32    1
-#define TCG_TARGET_HAS_extrh_i64_i32    1
+#define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index dd2efa795c..bdfa25bef4 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -132,8 +132,7 @@ extern bool use_mips32r2_instructions;
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
-#define TCG_TARGET_HAS_extrl_i64_i32    1
-#define TCG_TARGET_HAS_extrh_i64_i32    1
+#define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_not_i64          1
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index 9a41fab8cc..37b54e6aeb 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -106,8 +106,7 @@ typedef enum {
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
 #define TCG_TARGET_HAS_sub2_i32         0
-#define TCG_TARGET_HAS_extrl_i64_i32    0
-#define TCG_TARGET_HAS_extrh_i64_i32    0
+#define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          have_isa_3_00
 #define TCG_TARGET_HAS_rot_i64          1
diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
index e1d8110ee4..6cbd226ca9 100644
--- a/tcg/riscv/tcg-target.h
+++ b/tcg/riscv/tcg-target.h
@@ -131,8 +131,7 @@ extern bool have_zbb;
 #define TCG_TARGET_HAS_extract_i64      0
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
-#define TCG_TARGET_HAS_extrl_i64_i32    1
-#define TCG_TARGET_HAS_extrh_i64_i32    1
+#define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_ext8s_i64        1
 #define TCG_TARGET_HAS_ext16s_i64       1
 #define TCG_TARGET_HAS_ext32s_i64       1
diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
index 9a405003b9..2edc2056ba 100644
--- a/tcg/s390x/tcg-target.h
+++ b/tcg/s390x/tcg-target.h
@@ -102,8 +102,7 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_muls2_i32      0
 #define TCG_TARGET_HAS_muluh_i32      0
 #define TCG_TARGET_HAS_mulsh_i32      0
-#define TCG_TARGET_HAS_extrl_i64_i32  0
-#define TCG_TARGET_HAS_extrh_i64_i32  0
+#define TCG_TARGET_HAS_extr_i64_i32   0
 #define TCG_TARGET_HAS_qemu_st8_i32   0
 
 #define TCG_TARGET_HAS_div2_i64       1
diff --git a/tcg/sparc64/tcg-target.h b/tcg/sparc64/tcg-target.h
index d454278811..682e6f1613 100644
--- a/tcg/sparc64/tcg-target.h
+++ b/tcg/sparc64/tcg-target.h
@@ -114,8 +114,7 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_extrl_i64_i32    1
-#define TCG_TARGET_HAS_extrh_i64_i32    1
+#define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 7aadb37756..68b93a3d4b 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -2681,7 +2681,7 @@ void tcg_gen_extrl_i64_i32(TCGv_i32 ret, TCGv_i64 arg)
 {
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_mov_i32(ret, TCGV_LOW(arg));
-    } else if (TCG_TARGET_HAS_extrl_i64_i32) {
+    } else if (TCG_TARGET_HAS_extr_i64_i32) {
         tcg_gen_op2(INDEX_op_extrl_i64_i32,
                     tcgv_i32_arg(ret), tcgv_i64_arg(arg));
     } else {
@@ -2693,7 +2693,7 @@ void tcg_gen_extrh_i64_i32(TCGv_i32 ret, TCGv_i64 arg)
 {
     if (TCG_TARGET_REG_BITS == 32) {
         tcg_gen_mov_i32(ret, TCGV_HIGH(arg));
-    } else if (TCG_TARGET_HAS_extrh_i64_i32) {
+    } else if (TCG_TARGET_HAS_extr_i64_i32) {
         tcg_gen_op2(INDEX_op_extrh_i64_i32,
                     tcgv_i32_arg(ret), tcgv_i64_arg(arg));
     } else {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index ddfe9a96cb..a23348824b 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -2000,9 +2000,8 @@ bool tcg_op_supported(TCGOpcode op)
     case INDEX_op_extract2_i64:
         return TCG_TARGET_HAS_extract2_i64;
     case INDEX_op_extrl_i64_i32:
-        return TCG_TARGET_HAS_extrl_i64_i32;
     case INDEX_op_extrh_i64_i32:
-        return TCG_TARGET_HAS_extrh_i64_i32;
+        return TCG_TARGET_HAS_extr_i64_i32;
     case INDEX_op_ext8s_i64:
         return TCG_TARGET_HAS_ext8s_i64;
     case INDEX_op_ext16s_i64:
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index 37ee10c959..d33185fb36 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -76,8 +76,7 @@
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #if TCG_TARGET_REG_BITS == 64
-#define TCG_TARGET_HAS_extrl_i64_i32    0
-#define TCG_TARGET_HAS_extrh_i64_i32    0
+#define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_bswap16_i64      1
 #define TCG_TARGET_HAS_bswap32_i64      1
 #define TCG_TARGET_HAS_bswap64_i64      1

From 3635502dd00bcfee3a6ab790d950c2fc4ace607b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Aug 2023 23:24:04 +0000
Subject: [PATCH 1214/1353] tcg: Introduce negsetcond opcodes

Introduce a new opcode for negative setcond.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst       |  6 ++++++
 include/tcg/tcg-op-common.h  |  4 ++++
 include/tcg/tcg-op.h         |  2 ++
 include/tcg/tcg-opc.h        |  2 ++
 include/tcg/tcg.h            |  1 +
 tcg/aarch64/tcg-target.h     |  2 ++
 tcg/arm/tcg-target.h         |  1 +
 tcg/i386/tcg-target.h        |  2 ++
 tcg/loongarch64/tcg-target.h |  3 +++
 tcg/mips/tcg-target.h        |  2 ++
 tcg/optimize.c               | 41 +++++++++++++++++++++++++++++++++++-
 tcg/ppc/tcg-target.h         |  2 ++
 tcg/riscv/tcg-target.h       |  2 ++
 tcg/s390x/tcg-target.h       |  2 ++
 tcg/sparc64/tcg-target.h     |  2 ++
 tcg/tcg-op.c                 | 36 +++++++++++++++++++++++++++++++
 tcg/tcg.c                    |  6 ++++++
 tcg/tci/tcg-target.h         |  2 ++
 18 files changed, 117 insertions(+), 1 deletion(-)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 53695e1623..9e2a931d85 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -498,6 +498,12 @@ Conditional moves
        |
        | Set *dest* to 1 if (*t1* *cond* *t2*) is true, otherwise set to 0.
 
+   * - negsetcond_i32/i64 *dest*, *t1*, *t2*, *cond*
+
+     - | *dest* = -(*t1* *cond* *t2*)
+       |
+       | Set *dest* to -1 if (*t1* *cond* *t2*) is true, otherwise set to 0.
+
    * - movcond_i32/i64 *dest*, *c1*, *c2*, *v1*, *v2*, *cond*
 
      - | *dest* = (*c1* *cond* *c2* ? *v1* : *v2*)
diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
index be382bbf77..a53b15933b 100644
--- a/include/tcg/tcg-op-common.h
+++ b/include/tcg/tcg-op-common.h
@@ -344,6 +344,8 @@ void tcg_gen_setcond_i32(TCGCond cond, TCGv_i32 ret,
                          TCGv_i32 arg1, TCGv_i32 arg2);
 void tcg_gen_setcondi_i32(TCGCond cond, TCGv_i32 ret,
                           TCGv_i32 arg1, int32_t arg2);
+void tcg_gen_negsetcond_i32(TCGCond cond, TCGv_i32 ret,
+                            TCGv_i32 arg1, TCGv_i32 arg2);
 void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
                          TCGv_i32 c2, TCGv_i32 v1, TCGv_i32 v2);
 void tcg_gen_add2_i32(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 al,
@@ -540,6 +542,8 @@ void tcg_gen_setcond_i64(TCGCond cond, TCGv_i64 ret,
                          TCGv_i64 arg1, TCGv_i64 arg2);
 void tcg_gen_setcondi_i64(TCGCond cond, TCGv_i64 ret,
                           TCGv_i64 arg1, int64_t arg2);
+void tcg_gen_negsetcond_i64(TCGCond cond, TCGv_i64 ret,
+                            TCGv_i64 arg1, TCGv_i64 arg2);
 void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
                          TCGv_i64 c2, TCGv_i64 v1, TCGv_i64 v2);
 void tcg_gen_add2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 al,
diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index d63683c47b..80cfcf8104 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -200,6 +200,7 @@ DEF_ATOMIC2(tcg_gen_atomic_umax_fetch, i64)
 #define tcg_gen_brcondi_tl tcg_gen_brcondi_i64
 #define tcg_gen_setcond_tl tcg_gen_setcond_i64
 #define tcg_gen_setcondi_tl tcg_gen_setcondi_i64
+#define tcg_gen_negsetcond_tl tcg_gen_negsetcond_i64
 #define tcg_gen_mul_tl tcg_gen_mul_i64
 #define tcg_gen_muli_tl tcg_gen_muli_i64
 #define tcg_gen_div_tl tcg_gen_div_i64
@@ -317,6 +318,7 @@ DEF_ATOMIC2(tcg_gen_atomic_umax_fetch, i64)
 #define tcg_gen_brcondi_tl tcg_gen_brcondi_i32
 #define tcg_gen_setcond_tl tcg_gen_setcond_i32
 #define tcg_gen_setcondi_tl tcg_gen_setcondi_i32
+#define tcg_gen_negsetcond_tl tcg_gen_negsetcond_i32
 #define tcg_gen_mul_tl tcg_gen_mul_i32
 #define tcg_gen_muli_tl tcg_gen_muli_i32
 #define tcg_gen_div_tl tcg_gen_div_i32
diff --git a/include/tcg/tcg-opc.h b/include/tcg/tcg-opc.h
index c64dfe558c..6eff3d9106 100644
--- a/include/tcg/tcg-opc.h
+++ b/include/tcg/tcg-opc.h
@@ -46,6 +46,7 @@ DEF(mb, 0, 0, 1, 0)
 
 DEF(mov_i32, 1, 1, 0, TCG_OPF_NOT_PRESENT)
 DEF(setcond_i32, 1, 2, 1, 0)
+DEF(negsetcond_i32, 1, 2, 1, IMPL(TCG_TARGET_HAS_negsetcond_i32))
 DEF(movcond_i32, 1, 4, 1, IMPL(TCG_TARGET_HAS_movcond_i32))
 /* load/store */
 DEF(ld8u_i32, 1, 1, 1, 0)
@@ -111,6 +112,7 @@ DEF(ctpop_i32, 1, 1, 0, IMPL(TCG_TARGET_HAS_ctpop_i32))
 
 DEF(mov_i64, 1, 1, 0, TCG_OPF_64BIT | TCG_OPF_NOT_PRESENT)
 DEF(setcond_i64, 1, 2, 1, IMPL64)
+DEF(negsetcond_i64, 1, 2, 1, IMPL64 | IMPL(TCG_TARGET_HAS_negsetcond_i64))
 DEF(movcond_i64, 1, 4, 1, IMPL64 | IMPL(TCG_TARGET_HAS_movcond_i64))
 /* load/store */
 DEF(ld8u_i64, 1, 1, 1, IMPL64)
diff --git a/include/tcg/tcg.h b/include/tcg/tcg.h
index ea7e55eeb8..61d7c81b44 100644
--- a/include/tcg/tcg.h
+++ b/include/tcg/tcg.h
@@ -97,6 +97,7 @@ typedef uint64_t TCGRegSet;
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      0
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         0
 #define TCG_TARGET_HAS_sub2_i64         0
 #define TCG_TARGET_HAS_mulu2_i64        0
diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index 12765cc281..bfa3e5aae9 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -86,6 +86,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i32     1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
@@ -122,6 +123,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i64     1
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index c649db72a6..ad66f11574 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -116,6 +116,7 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_muluh_i32        0
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index 32dd795259..ebc0b1a6ce 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -150,6 +150,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i32     1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
@@ -186,6 +187,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1
diff --git a/tcg/loongarch64/tcg-target.h b/tcg/loongarch64/tcg-target.h
index c94e0c6044..559be67186 100644
--- a/tcg/loongarch64/tcg-target.h
+++ b/tcg/loongarch64/tcg-target.h
@@ -86,6 +86,7 @@ typedef enum {
 
 /* optional instructions */
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_div2_i32         0
@@ -122,6 +123,7 @@ typedef enum {
 
 /* 64-bit operations */
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_div2_i64         0
@@ -156,6 +158,7 @@ typedef enum {
 #define TCG_TARGET_HAS_muls2_i64        0
 #define TCG_TARGET_HAS_muluh_i64        1
 #define TCG_TARGET_HAS_mulsh_i64        1
+
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
 
 #define TCG_TARGET_DEFAULT_MO (0)
diff --git a/tcg/mips/tcg-target.h b/tcg/mips/tcg-target.h
index bdfa25bef4..c0576f66d7 100644
--- a/tcg/mips/tcg-target.h
+++ b/tcg/mips/tcg-target.h
@@ -128,6 +128,7 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_muluh_i32        1
 #define TCG_TARGET_HAS_mulsh_i32        1
 #define TCG_TARGET_HAS_bswap32_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 
 #if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_add2_i32         0
@@ -149,6 +150,7 @@ extern bool use_mips32r2_instructions;
 #define TCG_TARGET_HAS_mulsh_i64        1
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #endif
 
 /* optional instructions detected at runtime */
diff --git a/tcg/optimize.c b/tcg/optimize.c
index bbd9bb64c6..3013eb04e6 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1567,14 +1567,22 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
     if (arg_is_const(op->args[3]) && arg_is_const(op->args[4])) {
         uint64_t tv = arg_info(op->args[3])->val;
         uint64_t fv = arg_info(op->args[4])->val;
-        TCGOpcode opc;
+        TCGOpcode opc, negopc = 0;
 
         switch (ctx->type) {
         case TCG_TYPE_I32:
             opc = INDEX_op_setcond_i32;
+            if (TCG_TARGET_HAS_negsetcond_i32) {
+                negopc = INDEX_op_negsetcond_i32;
+            }
+            tv = (int32_t)tv;
+            fv = (int32_t)fv;
             break;
         case TCG_TYPE_I64:
             opc = INDEX_op_setcond_i64;
+            if (TCG_TARGET_HAS_negsetcond_i64) {
+                negopc = INDEX_op_negsetcond_i64;
+            }
             break;
         default:
             g_assert_not_reached();
@@ -1586,6 +1594,14 @@ static bool fold_movcond(OptContext *ctx, TCGOp *op)
         } else if (fv == 1 && tv == 0) {
             op->opc = opc;
             op->args[3] = tcg_invert_cond(cond);
+        } else if (negopc) {
+            if (tv == -1 && fv == 0) {
+                op->opc = negopc;
+                op->args[3] = cond;
+            } else if (fv == -1 && tv == 0) {
+                op->opc = negopc;
+                op->args[3] = tcg_invert_cond(cond);
+            }
         }
     }
     return false;
@@ -1796,6 +1812,26 @@ static bool fold_setcond(OptContext *ctx, TCGOp *op)
     return false;
 }
 
+static bool fold_negsetcond(OptContext *ctx, TCGOp *op)
+{
+    TCGCond cond = op->args[3];
+    int i;
+
+    if (swap_commutative(op->args[0], &op->args[1], &op->args[2])) {
+        op->args[3] = cond = tcg_swap_cond(cond);
+    }
+
+    i = do_constant_folding_cond(ctx->type, op->args[1], op->args[2], cond);
+    if (i >= 0) {
+        return tcg_opt_gen_movi(ctx, op, op->args[0], -i);
+    }
+
+    /* Value is {0,-1} so all bits are repetitions of the sign. */
+    ctx->s_mask = -1;
+    return false;
+}
+
+
 static bool fold_setcond2(OptContext *ctx, TCGOp *op)
 {
     TCGCond cond = op->args[5];
@@ -2253,6 +2289,9 @@ void tcg_optimize(TCGContext *s)
         CASE_OP_32_64(setcond):
             done = fold_setcond(&ctx, op);
             break;
+        CASE_OP_32_64(negsetcond):
+            done = fold_negsetcond(&ctx, op);
+            break;
         case INDEX_op_setcond2_i32:
             done = fold_setcond2(&ctx, op);
             break;
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index 37b54e6aeb..a2ca0b44ce 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -97,6 +97,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i32     0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        1
@@ -134,6 +135,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
index 6cbd226ca9..0efb3fc0b8 100644
--- a/tcg/riscv/tcg-target.h
+++ b/tcg/riscv/tcg-target.h
@@ -88,6 +88,7 @@ extern bool have_zbb;
 
 /* optional instructions */
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_div2_i32         0
@@ -123,6 +124,7 @@ extern bool have_zbb;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_div2_i64         0
diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
index 2edc2056ba..123a4b1645 100644
--- a/tcg/s390x/tcg-target.h
+++ b/tcg/s390x/tcg-target.h
@@ -96,6 +96,7 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sextract_i32   0
 #define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_movcond_i32    1
+#define TCG_TARGET_HAS_negsetcond_i32 0
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_mulu2_i32      0
@@ -131,6 +132,7 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sextract_i64   0
 #define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_movcond_i64    1
+#define TCG_TARGET_HAS_negsetcond_i64 0
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
 #define TCG_TARGET_HAS_mulu2_i64      1
diff --git a/tcg/sparc64/tcg-target.h b/tcg/sparc64/tcg-target.h
index 682e6f1613..79889db760 100644
--- a/tcg/sparc64/tcg-target.h
+++ b/tcg/sparc64/tcg-target.h
@@ -106,6 +106,7 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sextract_i32     0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
@@ -142,6 +143,7 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 68b93a3d4b..a954004cff 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -276,6 +276,21 @@ void tcg_gen_setcondi_i32(TCGCond cond, TCGv_i32 ret,
     tcg_gen_setcond_i32(cond, ret, arg1, tcg_constant_i32(arg2));
 }
 
+void tcg_gen_negsetcond_i32(TCGCond cond, TCGv_i32 ret,
+                            TCGv_i32 arg1, TCGv_i32 arg2)
+{
+    if (cond == TCG_COND_ALWAYS) {
+        tcg_gen_movi_i32(ret, -1);
+    } else if (cond == TCG_COND_NEVER) {
+        tcg_gen_movi_i32(ret, 0);
+    } else if (TCG_TARGET_HAS_negsetcond_i32) {
+        tcg_gen_op4i_i32(INDEX_op_negsetcond_i32, ret, arg1, arg2, cond);
+    } else {
+        tcg_gen_setcond_i32(cond, ret, arg1, arg2);
+        tcg_gen_neg_i32(ret, ret);
+    }
+}
+
 void tcg_gen_muli_i32(TCGv_i32 ret, TCGv_i32 arg1, int32_t arg2)
 {
     if (arg2 == 0) {
@@ -1567,6 +1582,27 @@ void tcg_gen_setcondi_i64(TCGCond cond, TCGv_i64 ret,
     }
 }
 
+void tcg_gen_negsetcond_i64(TCGCond cond, TCGv_i64 ret,
+                            TCGv_i64 arg1, TCGv_i64 arg2)
+{
+    if (cond == TCG_COND_ALWAYS) {
+        tcg_gen_movi_i64(ret, -1);
+    } else if (cond == TCG_COND_NEVER) {
+        tcg_gen_movi_i64(ret, 0);
+    } else if (TCG_TARGET_HAS_negsetcond_i64) {
+        tcg_gen_op4i_i64(INDEX_op_negsetcond_i64, ret, arg1, arg2, cond);
+    } else if (TCG_TARGET_REG_BITS == 32) {
+        tcg_gen_op6i_i32(INDEX_op_setcond2_i32, TCGV_LOW(ret),
+                         TCGV_LOW(arg1), TCGV_HIGH(arg1),
+                         TCGV_LOW(arg2), TCGV_HIGH(arg2), cond);
+        tcg_gen_neg_i32(TCGV_LOW(ret), TCGV_LOW(ret));
+        tcg_gen_mov_i32(TCGV_HIGH(ret), TCGV_LOW(ret));
+    } else {
+        tcg_gen_setcond_i64(cond, ret, arg1, arg2);
+        tcg_gen_neg_i64(ret, ret);
+    }
+}
+
 void tcg_gen_muli_i64(TCGv_i64 ret, TCGv_i64 arg1, int64_t arg2)
 {
     if (arg2 == 0) {
diff --git a/tcg/tcg.c b/tcg/tcg.c
index a23348824b..620dbe08da 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -1879,6 +1879,8 @@ bool tcg_op_supported(TCGOpcode op)
     case INDEX_op_sar_i32:
         return true;
 
+    case INDEX_op_negsetcond_i32:
+        return TCG_TARGET_HAS_negsetcond_i32;
     case INDEX_op_movcond_i32:
         return TCG_TARGET_HAS_movcond_i32;
     case INDEX_op_div_i32:
@@ -1977,6 +1979,8 @@ bool tcg_op_supported(TCGOpcode op)
     case INDEX_op_extu_i32_i64:
         return TCG_TARGET_REG_BITS == 64;
 
+    case INDEX_op_negsetcond_i64:
+        return TCG_TARGET_HAS_negsetcond_i64;
     case INDEX_op_movcond_i64:
         return TCG_TARGET_HAS_movcond_i64;
     case INDEX_op_div_i64:
@@ -2509,11 +2513,13 @@ static void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
             switch (c) {
             case INDEX_op_brcond_i32:
             case INDEX_op_setcond_i32:
+            case INDEX_op_negsetcond_i32:
             case INDEX_op_movcond_i32:
             case INDEX_op_brcond2_i32:
             case INDEX_op_setcond2_i32:
             case INDEX_op_brcond_i64:
             case INDEX_op_setcond_i64:
+            case INDEX_op_negsetcond_i64:
             case INDEX_op_movcond_i64:
             case INDEX_op_cmp_vec:
             case INDEX_op_cmpsel_vec:
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index d33185fb36..91ca33b616 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -70,6 +70,7 @@
 #define TCG_TARGET_HAS_orc_i32          1
 #define TCG_TARGET_HAS_rot_i32          1
 #define TCG_TARGET_HAS_movcond_i32      1
+#define TCG_TARGET_HAS_negsetcond_i32   0
 #define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_muluh_i32        0
 #define TCG_TARGET_HAS_mulsh_i32        0
@@ -104,6 +105,7 @@
 #define TCG_TARGET_HAS_orc_i64          1
 #define TCG_TARGET_HAS_rot_i64          1
 #define TCG_TARGET_HAS_movcond_i64      1
+#define TCG_TARGET_HAS_negsetcond_i64   0
 #define TCG_TARGET_HAS_muls2_i64        1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1

From 4a8838705660a72bcb35ef6ba271769fb1c8ab02 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Aug 2023 23:29:53 +0000
Subject: [PATCH 1215/1353] tcg: Use tcg_gen_negsetcond_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-gvec.c | 6 ++----
 tcg/tcg-op.c      | 6 ++----
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index a062239804..e260a07c61 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -3692,8 +3692,7 @@ static void expand_cmp_i32(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     for (i = 0; i < oprsz; i += 4) {
         tcg_gen_ld_i32(t0, cpu_env, aofs + i);
         tcg_gen_ld_i32(t1, cpu_env, bofs + i);
-        tcg_gen_setcond_i32(cond, t0, t0, t1);
-        tcg_gen_neg_i32(t0, t0);
+        tcg_gen_negsetcond_i32(cond, t0, t0, t1);
         tcg_gen_st_i32(t0, cpu_env, dofs + i);
     }
     tcg_temp_free_i32(t1);
@@ -3710,8 +3709,7 @@ static void expand_cmp_i64(uint32_t dofs, uint32_t aofs, uint32_t bofs,
     for (i = 0; i < oprsz; i += 8) {
         tcg_gen_ld_i64(t0, cpu_env, aofs + i);
         tcg_gen_ld_i64(t1, cpu_env, bofs + i);
-        tcg_gen_setcond_i64(cond, t0, t0, t1);
-        tcg_gen_neg_i64(t0, t0);
+        tcg_gen_negsetcond_i64(cond, t0, t0, t1);
         tcg_gen_st_i64(t0, cpu_env, dofs + i);
     }
     tcg_temp_free_i64(t1);
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index a954004cff..b59a50a5a9 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -863,8 +863,7 @@ void tcg_gen_movcond_i32(TCGCond cond, TCGv_i32 ret, TCGv_i32 c1,
     } else {
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
-        tcg_gen_setcond_i32(cond, t0, c1, c2);
-        tcg_gen_neg_i32(t0, t0);
+        tcg_gen_negsetcond_i32(cond, t0, c1, c2);
         tcg_gen_and_i32(t1, v1, t0);
         tcg_gen_andc_i32(ret, v2, t0);
         tcg_gen_or_i32(ret, ret, t1);
@@ -2563,8 +2562,7 @@ void tcg_gen_movcond_i64(TCGCond cond, TCGv_i64 ret, TCGv_i64 c1,
     } else {
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
-        tcg_gen_setcond_i64(cond, t0, c1, c2);
-        tcg_gen_neg_i64(t0, t0);
+        tcg_gen_negsetcond_i64(cond, t0, c1, c2);
         tcg_gen_and_i64(t1, v1, t0);
         tcg_gen_andc_i64(ret, v2, t0);
         tcg_gen_or_i64(ret, ret, t1);

From d55a3211e24d7b918b1b0bcb8a89aafb524c2b14 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Aug 2023 23:40:42 +0000
Subject: [PATCH 1216/1353] target/alpha: Use tcg_gen_movcond_i64 in
 gen_fold_mzero

The setcond + neg + and sequence is a complex method of
performing a conditional move.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/alpha/translate.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index 846f3d8091..0839182a1f 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -517,10 +517,9 @@ static void gen_fold_mzero(TCGCond cond, TCGv dest, TCGv src)
 
     case TCG_COND_GE:
     case TCG_COND_LT:
-        /* For >= or <, map -0.0 to +0.0 via comparison and mask.  */
-        tcg_gen_setcondi_i64(TCG_COND_NE, dest, src, mzero);
-        tcg_gen_neg_i64(dest, dest);
-        tcg_gen_and_i64(dest, dest, src);
+        /* For >= or <, map -0.0 to +0.0. */
+        tcg_gen_movcond_i64(TCG_COND_NE, dest, src, tcg_constant_i64(mzero),
+                            src, tcg_constant_i64(0));
         break;
 
     default:

From a1264259902039ad4427f6c912d453f7d3763059 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 4 Aug 2023 23:58:29 +0000
Subject: [PATCH 1217/1353] target/arm: Use tcg_gen_negsetcond_*

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 22 +++++++++-------------
 target/arm/tcg/translate.c     | 12 ++++--------
 2 files changed, 13 insertions(+), 21 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 5fa1257d32..da686cc953 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -4935,9 +4935,12 @@ static void disas_cond_select(DisasContext *s, uint32_t insn)
 
     if (rn == 31 && rm == 31 && (else_inc ^ else_inv)) {
         /* CSET & CSETM.  */
-        tcg_gen_setcond_i64(tcg_invert_cond(c.cond), tcg_rd, c.value, zero);
         if (else_inv) {
-            tcg_gen_neg_i64(tcg_rd, tcg_rd);
+            tcg_gen_negsetcond_i64(tcg_invert_cond(c.cond),
+                                   tcg_rd, c.value, zero);
+        } else {
+            tcg_gen_setcond_i64(tcg_invert_cond(c.cond),
+                                tcg_rd, c.value, zero);
         }
     } else {
         TCGv_i64 t_true = cpu_reg(s, rn);
@@ -8670,13 +8673,10 @@ static void handle_3same_64(DisasContext *s, int opcode, bool u,
         }
         break;
     case 0x6: /* CMGT, CMHI */
-        /* 64 bit integer comparison, result = test ? (2^64 - 1) : 0.
-         * We implement this using setcond (test) and then negating.
-         */
         cond = u ? TCG_COND_GTU : TCG_COND_GT;
     do_cmop:
-        tcg_gen_setcond_i64(cond, tcg_rd, tcg_rn, tcg_rm);
-        tcg_gen_neg_i64(tcg_rd, tcg_rd);
+        /* 64 bit integer comparison, result = test ? -1 : 0. */
+        tcg_gen_negsetcond_i64(cond, tcg_rd, tcg_rn, tcg_rm);
         break;
     case 0x7: /* CMGE, CMHS */
         cond = u ? TCG_COND_GEU : TCG_COND_GE;
@@ -9265,14 +9265,10 @@ static void handle_2misc_64(DisasContext *s, int opcode, bool u,
         }
         break;
     case 0xa: /* CMLT */
-        /* 64 bit integer comparison against zero, result is
-         * test ? (2^64 - 1) : 0. We implement via setcond(!test) and
-         * subtracting 1.
-         */
         cond = TCG_COND_LT;
     do_cmop:
-        tcg_gen_setcondi_i64(cond, tcg_rd, tcg_rn, 0);
-        tcg_gen_neg_i64(tcg_rd, tcg_rd);
+        /* 64 bit integer comparison against zero, result is test ? -1 : 0. */
+        tcg_gen_negsetcond_i64(cond, tcg_rd, tcg_rn, tcg_constant_i64(0));
         break;
     case 0x8: /* CMGT, CMGE */
         cond = u ? TCG_COND_GE : TCG_COND_GT;
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 39541ecdf0..38ad8dd4bd 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -2946,13 +2946,11 @@ void gen_gvec_sqrdmlsh_qc(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
 #define GEN_CMP0(NAME, COND)                                            \
     static void gen_##NAME##0_i32(TCGv_i32 d, TCGv_i32 a)               \
     {                                                                   \
-        tcg_gen_setcondi_i32(COND, d, a, 0);                            \
-        tcg_gen_neg_i32(d, d);                                          \
+        tcg_gen_negsetcond_i32(COND, d, a, tcg_constant_i32(0));        \
     }                                                                   \
     static void gen_##NAME##0_i64(TCGv_i64 d, TCGv_i64 a)               \
     {                                                                   \
-        tcg_gen_setcondi_i64(COND, d, a, 0);                            \
-        tcg_gen_neg_i64(d, d);                                          \
+        tcg_gen_negsetcond_i64(COND, d, a, tcg_constant_i64(0));        \
     }                                                                   \
     static void gen_##NAME##0_vec(unsigned vece, TCGv_vec d, TCGv_vec a) \
     {                                                                   \
@@ -3863,15 +3861,13 @@ void gen_gvec_mls(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
 static void gen_cmtst_i32(TCGv_i32 d, TCGv_i32 a, TCGv_i32 b)
 {
     tcg_gen_and_i32(d, a, b);
-    tcg_gen_setcondi_i32(TCG_COND_NE, d, d, 0);
-    tcg_gen_neg_i32(d, d);
+    tcg_gen_negsetcond_i32(TCG_COND_NE, d, d, tcg_constant_i32(0));
 }
 
 void gen_cmtst_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
 {
     tcg_gen_and_i64(d, a, b);
-    tcg_gen_setcondi_i64(TCG_COND_NE, d, d, 0);
-    tcg_gen_neg_i64(d, d);
+    tcg_gen_negsetcond_i64(TCG_COND_NE, d, d, tcg_constant_i64(0));
 }
 
 static void gen_cmtst_vec(unsigned vece, TCGv_vec d, TCGv_vec a, TCGv_vec b)

From 27f9af76e11441c498aedf34cb08d0a148fc71f1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 00:07:59 +0000
Subject: [PATCH 1218/1353] target/m68k: Use tcg_gen_negsetcond_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/m68k/translate.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index d08e823b6c..15b3701b8f 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -1350,8 +1350,7 @@ static void gen_cc_cond(DisasCompare *c, DisasContext *s, int cond)
     case 14: /* GT (!(Z || (N ^ V))) */
     case 15: /* LE (Z || (N ^ V)) */
         c->v1 = tmp = tcg_temp_new();
-        tcg_gen_setcond_i32(TCG_COND_EQ, tmp, QREG_CC_Z, c->v2);
-        tcg_gen_neg_i32(tmp, tmp);
+        tcg_gen_negsetcond_i32(TCG_COND_EQ, tmp, QREG_CC_Z, c->v2);
         tmp2 = tcg_temp_new();
         tcg_gen_xor_i32(tmp2, QREG_CC_N, QREG_CC_V);
         tcg_gen_or_i32(tmp, tmp, tmp2);
@@ -1430,9 +1429,8 @@ DISAS_INSN(scc)
     gen_cc_cond(&c, s, cond);
 
     tmp = tcg_temp_new();
-    tcg_gen_setcond_i32(c.tcond, tmp, c.v1, c.v2);
+    tcg_gen_negsetcond_i32(c.tcond, tmp, c.v1, c.v2);
 
-    tcg_gen_neg_i32(tmp, tmp);
     DEST_EA(env, insn, OS_BYTE, tmp, NULL);
 }
 
@@ -2764,13 +2762,14 @@ DISAS_INSN(mull)
             tcg_gen_muls2_i32(QREG_CC_N, QREG_CC_V, src1, DREG(ext, 12));
             /* QREG_CC_V is -(QREG_CC_V != (QREG_CC_N >> 31)) */
             tcg_gen_sari_i32(QREG_CC_Z, QREG_CC_N, 31);
-            tcg_gen_setcond_i32(TCG_COND_NE, QREG_CC_V, QREG_CC_V, QREG_CC_Z);
+            tcg_gen_negsetcond_i32(TCG_COND_NE, QREG_CC_V,
+                                   QREG_CC_V, QREG_CC_Z);
         } else {
             tcg_gen_mulu2_i32(QREG_CC_N, QREG_CC_V, src1, DREG(ext, 12));
             /* QREG_CC_V is -(QREG_CC_V != 0), use QREG_CC_C as 0 */
-            tcg_gen_setcond_i32(TCG_COND_NE, QREG_CC_V, QREG_CC_V, QREG_CC_C);
+            tcg_gen_negsetcond_i32(TCG_COND_NE, QREG_CC_V,
+                                   QREG_CC_V, QREG_CC_C);
         }
-        tcg_gen_neg_i32(QREG_CC_V, QREG_CC_V);
         tcg_gen_mov_i32(DREG(ext, 12), QREG_CC_N);
 
         tcg_gen_mov_i32(QREG_CC_Z, QREG_CC_N);
@@ -3339,14 +3338,13 @@ static inline void shift_im(DisasContext *s, uint16_t insn, int opsize)
         if (!logical && m68k_feature(s->env, M68K_FEATURE_M68K)) {
             /* if shift count >= bits, V is (reg != 0) */
             if (count >= bits) {
-                tcg_gen_setcond_i32(TCG_COND_NE, QREG_CC_V, reg, QREG_CC_V);
+                tcg_gen_negsetcond_i32(TCG_COND_NE, QREG_CC_V, reg, QREG_CC_V);
             } else {
                 TCGv t0 = tcg_temp_new();
                 tcg_gen_sari_i32(QREG_CC_V, reg, bits - 1);
                 tcg_gen_sari_i32(t0, reg, bits - count - 1);
-                tcg_gen_setcond_i32(TCG_COND_NE, QREG_CC_V, QREG_CC_V, t0);
+                tcg_gen_negsetcond_i32(TCG_COND_NE, QREG_CC_V, QREG_CC_V, t0);
             }
-            tcg_gen_neg_i32(QREG_CC_V, QREG_CC_V);
         }
     } else {
         tcg_gen_shri_i32(QREG_CC_C, reg, count - 1);
@@ -3430,9 +3428,8 @@ static inline void shift_reg(DisasContext *s, uint16_t insn, int opsize)
             /* Ignore the bits below the sign bit.  */
             tcg_gen_andi_i64(t64, t64, -1ULL << (bits - 1));
             /* If any bits remain set, we have overflow.  */
-            tcg_gen_setcondi_i64(TCG_COND_NE, t64, t64, 0);
+            tcg_gen_negsetcond_i64(TCG_COND_NE, t64, t64, tcg_constant_i64(0));
             tcg_gen_extrl_i64_i32(QREG_CC_V, t64);
-            tcg_gen_neg_i32(QREG_CC_V, QREG_CC_V);
         }
     } else {
         tcg_gen_shli_i64(t64, t64, 32);
@@ -5311,9 +5308,8 @@ DISAS_INSN(fscc)
     gen_fcc_cond(&c, s, cond);
 
     tmp = tcg_temp_new();
-    tcg_gen_setcond_i32(c.tcond, tmp, c.v1, c.v2);
+    tcg_gen_negsetcond_i32(c.tcond, tmp, c.v1, c.v2);
 
-    tcg_gen_neg_i32(tmp, tmp);
     DEST_EA(env, insn, OS_BYTE, tmp, NULL);
 }
 

From cfe158875b81df65771d8bfabf6f9a18a9c4307a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 00:15:06 +0000
Subject: [PATCH 1219/1353] target/openrisc: Use tcg_gen_negsetcond_*
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/openrisc/translate.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index a86360d4f5..7c6f80daf1 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -253,9 +253,8 @@ static void gen_mul(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
 
     tcg_gen_muls2_tl(dest, cpu_sr_ov, srca, srcb);
     tcg_gen_sari_tl(t0, dest, TARGET_LONG_BITS - 1);
-    tcg_gen_setcond_tl(TCG_COND_NE, cpu_sr_ov, cpu_sr_ov, t0);
+    tcg_gen_negsetcond_tl(TCG_COND_NE, cpu_sr_ov, cpu_sr_ov, t0);
 
-    tcg_gen_neg_tl(cpu_sr_ov, cpu_sr_ov);
     gen_ove_ov(dc);
 }
 
@@ -309,9 +308,8 @@ static void gen_muld(DisasContext *dc, TCGv srca, TCGv srcb)
 
         tcg_gen_muls2_i64(cpu_mac, high, t1, t2);
         tcg_gen_sari_i64(t1, cpu_mac, 63);
-        tcg_gen_setcond_i64(TCG_COND_NE, t1, t1, high);
+        tcg_gen_negsetcond_i64(TCG_COND_NE, t1, t1, high);
         tcg_gen_trunc_i64_tl(cpu_sr_ov, t1);
-        tcg_gen_neg_tl(cpu_sr_ov, cpu_sr_ov);
 
         gen_ove_ov(dc);
     }

From 253d110dba77769e1f2919d066c53dfd65942dc3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 00:22:26 +0000
Subject: [PATCH 1220/1353] target/ppc: Use tcg_gen_negsetcond_*

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/ppc/translate/fixedpoint-impl.c.inc | 6 ++++--
 target/ppc/translate/vmx-impl.c.inc        | 8 +++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/ppc/translate/fixedpoint-impl.c.inc b/target/ppc/translate/fixedpoint-impl.c.inc
index f47f1a50e8..4ce02fd3a4 100644
--- a/target/ppc/translate/fixedpoint-impl.c.inc
+++ b/target/ppc/translate/fixedpoint-impl.c.inc
@@ -342,12 +342,14 @@ static bool do_set_bool_cond(DisasContext *ctx, arg_X_bi *a, bool neg, bool rev)
     uint32_t mask = 0x08 >> (a->bi & 0x03);
     TCGCond cond = rev ? TCG_COND_EQ : TCG_COND_NE;
     TCGv temp = tcg_temp_new();
+    TCGv zero = tcg_constant_tl(0);
 
     tcg_gen_extu_i32_tl(temp, cpu_crf[a->bi >> 2]);
     tcg_gen_andi_tl(temp, temp, mask);
-    tcg_gen_setcondi_tl(cond, cpu_gpr[a->rt], temp, 0);
     if (neg) {
-        tcg_gen_neg_tl(cpu_gpr[a->rt], cpu_gpr[a->rt]);
+        tcg_gen_negsetcond_tl(cond, cpu_gpr[a->rt], temp, zero);
+    } else {
+        tcg_gen_setcond_tl(cond, cpu_gpr[a->rt], temp, zero);
     }
     return true;
 }
diff --git a/target/ppc/translate/vmx-impl.c.inc b/target/ppc/translate/vmx-impl.c.inc
index c8712dd7d8..6d7669aabd 100644
--- a/target/ppc/translate/vmx-impl.c.inc
+++ b/target/ppc/translate/vmx-impl.c.inc
@@ -1341,8 +1341,7 @@ static bool trans_VCMPEQUQ(DisasContext *ctx, arg_VC *a)
     tcg_gen_xor_i64(t1, t0, t1);
 
     tcg_gen_or_i64(t1, t1, t2);
-    tcg_gen_setcondi_i64(TCG_COND_EQ, t1, t1, 0);
-    tcg_gen_neg_i64(t1, t1);
+    tcg_gen_negsetcond_i64(TCG_COND_EQ, t1, t1, tcg_constant_i64(0));
 
     set_avr64(a->vrt, t1, true);
     set_avr64(a->vrt, t1, false);
@@ -1365,15 +1364,14 @@ static bool do_vcmpgtq(DisasContext *ctx, arg_VC *a, bool sign)
 
     get_avr64(t0, a->vra, false);
     get_avr64(t1, a->vrb, false);
-    tcg_gen_setcond_i64(TCG_COND_GTU, t2, t0, t1);
+    tcg_gen_negsetcond_i64(TCG_COND_GTU, t2, t0, t1);
 
     get_avr64(t0, a->vra, true);
     get_avr64(t1, a->vrb, true);
     tcg_gen_movcond_i64(TCG_COND_EQ, t2, t0, t1, t2, tcg_constant_i64(0));
-    tcg_gen_setcond_i64(sign ? TCG_COND_GT : TCG_COND_GTU, t1, t0, t1);
+    tcg_gen_negsetcond_i64(sign ? TCG_COND_GT : TCG_COND_GTU, t1, t0, t1);
 
     tcg_gen_or_i64(t1, t1, t2);
-    tcg_gen_neg_i64(t1, t1);
 
     set_avr64(a->vrt, t1, true);
     set_avr64(a->vrt, t1, false);

From e3ebbade58aae114c0d61a7365ea54b36f07f2fb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 00:31:29 +0000
Subject: [PATCH 1221/1353] target/sparc: Use tcg_gen_movcond_i64 in gen_edge

The setcond + neg + or sequence is a complex method of
performing a conditional move.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/translate.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index bd877a5e4a..fa80a91161 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -2916,7 +2916,7 @@ static void gen_edge(DisasContext *dc, TCGv dst, TCGv s1, TCGv s2,
 
     tcg_gen_shr_tl(lo1, tcg_constant_tl(tabl), lo1);
     tcg_gen_shr_tl(lo2, tcg_constant_tl(tabr), lo2);
-    tcg_gen_andi_tl(dst, lo1, omask);
+    tcg_gen_andi_tl(lo1, lo1, omask);
     tcg_gen_andi_tl(lo2, lo2, omask);
 
     amask = -8;
@@ -2926,18 +2926,9 @@ static void gen_edge(DisasContext *dc, TCGv dst, TCGv s1, TCGv s2,
     tcg_gen_andi_tl(s1, s1, amask);
     tcg_gen_andi_tl(s2, s2, amask);
 
-    /* We want to compute
-        dst = (s1 == s2 ? lo1 : lo1 & lo2).
-       We've already done dst = lo1, so this reduces to
-        dst &= (s1 == s2 ? -1 : lo2)
-       Which we perform by
-        lo2 |= -(s1 == s2)
-        dst &= lo2
-    */
-    tcg_gen_setcond_tl(TCG_COND_EQ, lo1, s1, s2);
-    tcg_gen_neg_tl(lo1, lo1);
-    tcg_gen_or_tl(lo2, lo2, lo1);
-    tcg_gen_and_tl(dst, dst, lo2);
+    /* Compute dst = (s1 == s2 ? lo1 : lo1 & lo2). */
+    tcg_gen_and_tl(lo2, lo2, lo1);
+    tcg_gen_movcond_tl(TCG_COND_EQ, dst, s1, s2, lo1, lo2);
 }
 
 static void gen_alignaddr(TCGv dst, TCGv s1, TCGv s2, bool left)

From b0a433be48c120fdc2be676216a240a316f3613e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 00:38:57 +0000
Subject: [PATCH 1222/1353] target/tricore: Replace gen_cond_w with
 tcg_gen_negsetcond_tl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/tricore/translate.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 1947733870..6ae5ccbf72 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -2680,13 +2680,6 @@ gen_accumulating_condi(int cond, TCGv ret, TCGv r1, int32_t con,
     gen_accumulating_cond(cond, ret, r1, temp, op);
 }
 
-/* ret = (r1 cond r2) ? 0xFFFFFFFF ? 0x00000000;*/
-static inline void gen_cond_w(TCGCond cond, TCGv ret, TCGv r1, TCGv r2)
-{
-    tcg_gen_setcond_tl(cond, ret, r1, r2);
-    tcg_gen_neg_tl(ret, ret);
-}
-
 static inline void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv b0 = tcg_temp_new();
@@ -5692,7 +5685,8 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_eq_h(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_EQ_W:
-        gen_cond_w(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_negsetcond_tl(TCG_COND_EQ, cpu_gpr_d[r3],
+                              cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_EQANY_B:
         gen_helper_eqany_b(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
@@ -5729,10 +5723,12 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_lt_hu(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT_W:
-        gen_cond_w(TCG_COND_LT, cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_negsetcond_tl(TCG_COND_LT, cpu_gpr_d[r3],
+                              cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT_WU:
-        gen_cond_w(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_negsetcond_tl(TCG_COND_LTU, cpu_gpr_d[r3],
+                              cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MAX:
         tcg_gen_movcond_tl(TCG_COND_GT, cpu_gpr_d[r3], cpu_gpr_d[r1],

From cba10bb3c8875f428821608f9dfb860a97a63aa1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 01:55:23 +0000
Subject: [PATCH 1223/1353] tcg/ppc: Implement negsetcond_*

In the general case we simply negate.  However with isel we
may load -1 instead of 1 with no extra effort.

Consolidate EQ0 and NE0 logic.  Replace the NE0 zero-extension
with inversion+negation of EQ0, which is never worse and may
eliminate one insn.  Provide a special case for -EQ0.

Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 127 ++++++++++++++++++++++++---------------
 tcg/ppc/tcg-target.h     |   4 +-
 2 files changed, 82 insertions(+), 49 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 511e14b180..10448aa0e6 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -1548,8 +1548,20 @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
 }
 
 static void tcg_out_setcond_eq0(TCGContext *s, TCGType type,
-                                TCGReg dst, TCGReg src)
+                                TCGReg dst, TCGReg src, bool neg)
 {
+    if (neg && (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I64)) {
+        /*
+         * X != 0 implies X + -1 generates a carry.
+         * RT = (~X + X) + CA
+         *    = -1 + CA
+         *    = CA ? 0 : -1
+         */
+        tcg_out32(s, ADDIC | TAI(TCG_REG_R0, src, -1));
+        tcg_out32(s, SUBFE | TAB(dst, src, src));
+        return;
+    }
+
     if (type == TCG_TYPE_I32) {
         tcg_out32(s, CNTLZW | RS(src) | RA(dst));
         tcg_out_shri32(s, dst, dst, 5);
@@ -1557,18 +1569,28 @@ static void tcg_out_setcond_eq0(TCGContext *s, TCGType type,
         tcg_out32(s, CNTLZD | RS(src) | RA(dst));
         tcg_out_shri64(s, dst, dst, 6);
     }
+    if (neg) {
+        tcg_out32(s, NEG | RT(dst) | RA(dst));
+    }
 }
 
-static void tcg_out_setcond_ne0(TCGContext *s, TCGReg dst, TCGReg src)
+static void tcg_out_setcond_ne0(TCGContext *s, TCGType type,
+                                TCGReg dst, TCGReg src, bool neg)
 {
-    /* X != 0 implies X + -1 generates a carry.  Extra addition
-       trickery means: R = X-1 + ~X + C = X-1 + (-X+1) + C = C.  */
-    if (dst != src) {
-        tcg_out32(s, ADDIC | TAI(dst, src, -1));
-        tcg_out32(s, SUBFE | TAB(dst, dst, src));
-    } else {
+    if (!neg && (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I64)) {
+        /*
+         * X != 0 implies X + -1 generates a carry.  Extra addition
+         * trickery means: R = X-1 + ~X + C = X-1 + (-X+1) + C = C.
+         */
         tcg_out32(s, ADDIC | TAI(TCG_REG_R0, src, -1));
         tcg_out32(s, SUBFE | TAB(dst, TCG_REG_R0, src));
+        return;
+    }
+    tcg_out_setcond_eq0(s, type, dst, src, false);
+    if (neg) {
+        tcg_out32(s, ADDI | TAI(dst, dst, -1));
+    } else {
+        tcg_out_xori32(s, dst, dst, 1);
     }
 }
 
@@ -1590,9 +1612,10 @@ static TCGReg tcg_gen_setcond_xor(TCGContext *s, TCGReg arg1, TCGArg arg2,
 
 static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
                             TCGArg arg0, TCGArg arg1, TCGArg arg2,
-                            int const_arg2)
+                            int const_arg2, bool neg)
 {
-    int crop, sh;
+    int sh;
+    bool inv;
 
     tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
 
@@ -1605,14 +1628,10 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
     if (arg2 == 0) {
         switch (cond) {
         case TCG_COND_EQ:
-            tcg_out_setcond_eq0(s, type, arg0, arg1);
+            tcg_out_setcond_eq0(s, type, arg0, arg1, neg);
             return;
         case TCG_COND_NE:
-            if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I32) {
-                tcg_out_ext32u(s, TCG_REG_R0, arg1);
-                arg1 = TCG_REG_R0;
-            }
-            tcg_out_setcond_ne0(s, arg0, arg1);
+            tcg_out_setcond_ne0(s, type, arg0, arg1, neg);
             return;
         case TCG_COND_GE:
             tcg_out32(s, NOR | SAB(arg1, arg0, arg1));
@@ -1621,9 +1640,17 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
         case TCG_COND_LT:
             /* Extract the sign bit.  */
             if (type == TCG_TYPE_I32) {
-                tcg_out_shri32(s, arg0, arg1, 31);
+                if (neg) {
+                    tcg_out_sari32(s, arg0, arg1, 31);
+                } else {
+                    tcg_out_shri32(s, arg0, arg1, 31);
+                }
             } else {
-                tcg_out_shri64(s, arg0, arg1, 63);
+                if (neg) {
+                    tcg_out_sari64(s, arg0, arg1, 63);
+                } else {
+                    tcg_out_shri64(s, arg0, arg1, 63);
+                }
             }
             return;
         default:
@@ -1641,7 +1668,7 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
 
         isel = tcg_to_isel[cond];
 
-        tcg_out_movi(s, type, arg0, 1);
+        tcg_out_movi(s, type, arg0, neg ? -1 : 1);
         if (isel & 1) {
             /* arg0 = (bc ? 0 : 1) */
             tab = TAB(arg0, 0, arg0);
@@ -1655,51 +1682,47 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
         return;
     }
 
+    inv = false;
     switch (cond) {
     case TCG_COND_EQ:
         arg1 = tcg_gen_setcond_xor(s, arg1, arg2, const_arg2);
-        tcg_out_setcond_eq0(s, type, arg0, arg1);
-        return;
+        tcg_out_setcond_eq0(s, type, arg0, arg1, neg);
+        break;
 
     case TCG_COND_NE:
         arg1 = tcg_gen_setcond_xor(s, arg1, arg2, const_arg2);
-        /* Discard the high bits only once, rather than both inputs.  */
-        if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I32) {
-            tcg_out_ext32u(s, TCG_REG_R0, arg1);
-            arg1 = TCG_REG_R0;
-        }
-        tcg_out_setcond_ne0(s, arg0, arg1);
-        return;
+        tcg_out_setcond_ne0(s, type, arg0, arg1, neg);
+        break;
 
+    case TCG_COND_LE:
+    case TCG_COND_LEU:
+        inv = true;
+        /* fall through */
     case TCG_COND_GT:
     case TCG_COND_GTU:
-        sh = 30;
-        crop = 0;
-        goto crtest;
-
-    case TCG_COND_LT:
-    case TCG_COND_LTU:
-        sh = 29;
-        crop = 0;
+        sh = 30; /* CR7 CR_GT */
         goto crtest;
 
     case TCG_COND_GE:
     case TCG_COND_GEU:
-        sh = 31;
-        crop = CRNOR | BT(7, CR_EQ) | BA(7, CR_LT) | BB(7, CR_LT);
+        inv = true;
+        /* fall through */
+    case TCG_COND_LT:
+    case TCG_COND_LTU:
+        sh = 29; /* CR7 CR_LT */
         goto crtest;
 
-    case TCG_COND_LE:
-    case TCG_COND_LEU:
-        sh = 31;
-        crop = CRNOR | BT(7, CR_EQ) | BA(7, CR_GT) | BB(7, CR_GT);
     crtest:
         tcg_out_cmp(s, cond, arg1, arg2, const_arg2, 7, type);
-        if (crop) {
-            tcg_out32(s, crop);
-        }
         tcg_out32(s, MFOCRF | RT(TCG_REG_R0) | FXM(7));
         tcg_out_rlw(s, RLWINM, arg0, TCG_REG_R0, sh, 31, 31);
+        if (neg && inv) {
+            tcg_out32(s, ADDI | TAI(arg0, arg0, -1));
+        } else if (neg) {
+            tcg_out32(s, NEG | RT(arg0) | RA(arg0));
+        } else if (inv) {
+            tcg_out_xori32(s, arg0, arg0, 1);
+        }
         break;
 
     default:
@@ -2982,11 +3005,19 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_setcond_i32:
         tcg_out_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1], args[2],
-                        const_args[2]);
+                        const_args[2], false);
         break;
     case INDEX_op_setcond_i64:
         tcg_out_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1], args[2],
-                        const_args[2]);
+                        const_args[2], false);
+        break;
+    case INDEX_op_negsetcond_i32:
+        tcg_out_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1], args[2],
+                        const_args[2], true);
+        break;
+    case INDEX_op_negsetcond_i64:
+        tcg_out_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1], args[2],
+                        const_args[2], true);
         break;
     case INDEX_op_setcond2_i32:
         tcg_out_setcond2(s, args, const_args);
@@ -3724,6 +3755,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rotl_i32:
     case INDEX_op_rotr_i32:
     case INDEX_op_setcond_i32:
+    case INDEX_op_negsetcond_i32:
     case INDEX_op_and_i64:
     case INDEX_op_andc_i64:
     case INDEX_op_shl_i64:
@@ -3732,6 +3764,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rotl_i64:
     case INDEX_op_rotr_i64:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, ri);
 
     case INDEX_op_mul_i32:
diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index a2ca0b44ce..8bfb14998e 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -97,7 +97,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i32     0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        0
 #define TCG_TARGET_HAS_muls2_i32        0
 #define TCG_TARGET_HAS_muluh_i32        1
@@ -135,7 +135,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0

From 72fa954a6321734b2d7875af7741e23e84601a5b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 02:04:56 +0000
Subject: [PATCH 1224/1353] tcg/ppc: Use the Set Boolean Extension

The SETBC family of instructions requires exactly two insns for
all comparisions, saving 0-3 insns per (neg)setcond.

Tested-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index 10448aa0e6..090f11e71c 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -447,6 +447,11 @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
 #define TW     XO31( 4)
 #define TRAP   (TW | TO(31))
 
+#define SETBC    XO31(384)  /* v3.10 */
+#define SETBCR   XO31(416)  /* v3.10 */
+#define SETNBC   XO31(448)  /* v3.10 */
+#define SETNBCR  XO31(480)  /* v3.10 */
+
 #define NOP    ORI  /* ori 0,0,0 */
 
 #define LVX        XO31(103)
@@ -1624,6 +1629,23 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
         arg2 = (uint32_t)arg2;
     }
 
+    /* With SETBC/SETBCR, we can always implement with 2 insns. */
+    if (have_isa_3_10) {
+        tcg_insn_unit bi, opc;
+
+        tcg_out_cmp(s, cond, arg1, arg2, const_arg2, 7, type);
+
+        /* Re-use tcg_to_bc for BI and BO_COND_{TRUE,FALSE}. */
+        bi = tcg_to_bc[cond] & (0x1f << 16);
+        if (tcg_to_bc[cond] & BO(8)) {
+            opc = neg ? SETNBC : SETBC;
+        } else {
+            opc = neg ? SETNBCR : SETBCR;
+        }
+        tcg_out32(s, opc | RT(arg0) | bi);
+        return;
+    }
+
     /* Handle common and trivial cases before handling anything else.  */
     if (arg2 == 0) {
         switch (cond) {

From f58a7dea0f0652779e1525f072ef45bf99dbfd72 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 14:27:12 +0000
Subject: [PATCH 1225/1353] tcg/aarch64: Implement negsetcond_*

Trivial, as aarch64 has an instruction for this: CSETM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc | 12 ++++++++++++
 tcg/aarch64/tcg-target.h     |  4 ++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 35ca80cd56..7d8d114c9e 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -2262,6 +2262,16 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
                      TCG_REG_XZR, tcg_invert_cond(args[3]));
         break;
 
+    case INDEX_op_negsetcond_i32:
+        a2 = (int32_t)a2;
+        /* FALLTHRU */
+    case INDEX_op_negsetcond_i64:
+        tcg_out_cmp(s, ext, a1, a2, c2);
+        /* Use CSETM alias of CSINV Wd, WZR, WZR, invert(cond).  */
+        tcg_out_insn(s, 3506, CSINV, ext, a0, TCG_REG_XZR,
+                     TCG_REG_XZR, tcg_invert_cond(args[3]));
+        break;
+
     case INDEX_op_movcond_i32:
         a2 = (int32_t)a2;
         /* FALLTHRU */
@@ -2868,6 +2878,8 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_sub_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rA);
 
     case INDEX_op_mul_i32:
diff --git a/tcg/aarch64/tcg-target.h b/tcg/aarch64/tcg-target.h
index bfa3e5aae9..98727ea53b 100644
--- a/tcg/aarch64/tcg-target.h
+++ b/tcg/aarch64/tcg-target.h
@@ -86,7 +86,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i32     1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        0
@@ -123,7 +123,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i64     1
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_movcond_i64      1
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0

From fe06b8973385c9421b2988239cadb9d091cdc628 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 14:32:57 +0000
Subject: [PATCH 1226/1353] tcg/arm: Implement negsetcond_i32

Trivial, as we simply need to load a different constant
in the conditional move.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 9 +++++++++
 tcg/arm/tcg-target.h     | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 83e286088f..162df38c73 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1975,6 +1975,14 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_dat_imm(s, tcg_cond_to_arm_cond[tcg_invert_cond(args[3])],
                         ARITH_MOV, args[0], 0, 0);
         break;
+    case INDEX_op_negsetcond_i32:
+        tcg_out_dat_rIN(s, COND_AL, ARITH_CMP, ARITH_CMN, 0,
+                        args[1], args[2], const_args[2]);
+        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[args[3]],
+                        ARITH_MVN, args[0], 0, 0);
+        tcg_out_dat_imm(s, tcg_cond_to_arm_cond[tcg_invert_cond(args[3])],
+                        ARITH_MOV, args[0], 0, 0);
+        break;
 
     case INDEX_op_brcond2_i32:
         c = tcg_out_cmp2(s, args, const_args);
@@ -2112,6 +2120,7 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_add_i32:
     case INDEX_op_sub_i32:
     case INDEX_op_setcond_i32:
+    case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, rIN);
 
     case INDEX_op_and_i32:
diff --git a/tcg/arm/tcg-target.h b/tcg/arm/tcg-target.h
index ad66f11574..311a985209 100644
--- a/tcg/arm/tcg-target.h
+++ b/tcg/arm/tcg-target.h
@@ -116,7 +116,7 @@ extern bool use_neon_instructions;
 #define TCG_TARGET_HAS_sextract_i32     use_armv7_instructions
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_mulu2_i32        1
 #define TCG_TARGET_HAS_muls2_i32        1
 #define TCG_TARGET_HAS_muluh_i32        0

From 41e4c0a9ad2b10fc14896447361225b410eb112e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 18:16:32 +0000
Subject: [PATCH 1227/1353] tcg/riscv: Implement negsetcond_*

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/riscv/tcg-target.c.inc | 45 ++++++++++++++++++++++++++++++++++++++
 tcg/riscv/tcg-target.h     |  4 ++--
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index eeaeb6b6e3..232b616af3 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -936,6 +936,44 @@ static void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGReg ret,
     }
 }
 
+static void tcg_out_negsetcond(TCGContext *s, TCGCond cond, TCGReg ret,
+                               TCGReg arg1, tcg_target_long arg2, bool c2)
+{
+    int tmpflags;
+    TCGReg tmp;
+
+    /* For LT/GE comparison against 0, replicate the sign bit. */
+    if (c2 && arg2 == 0) {
+        switch (cond) {
+        case TCG_COND_GE:
+            tcg_out_opc_imm(s, OPC_XORI, ret, arg1, -1);
+            arg1 = ret;
+            /* fall through */
+        case TCG_COND_LT:
+            tcg_out_opc_imm(s, OPC_SRAI, ret, arg1, TCG_TARGET_REG_BITS - 1);
+            return;
+        default:
+            break;
+        }
+    }
+
+    tmpflags = tcg_out_setcond_int(s, cond, ret, arg1, arg2, c2);
+    tmp = tmpflags & ~SETCOND_FLAGS;
+
+    /* If intermediate result is zero/non-zero: test != 0. */
+    if (tmpflags & SETCOND_NEZ) {
+        tcg_out_opc_reg(s, OPC_SLTU, ret, TCG_REG_ZERO, tmp);
+        tmp = ret;
+    }
+
+    /* Produce the 0/-1 result. */
+    if (tmpflags & SETCOND_INV) {
+        tcg_out_opc_imm(s, OPC_ADDI, ret, tmp, -1);
+    } else {
+        tcg_out_opc_reg(s, OPC_SUB, ret, TCG_REG_ZERO, tmp);
+    }
+}
+
 static void tcg_out_movcond_zicond(TCGContext *s, TCGReg ret, TCGReg test_ne,
                                    int val1, bool c_val1,
                                    int val2, bool c_val2)
@@ -1782,6 +1820,11 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_setcond(s, args[3], a0, a1, a2, c2);
         break;
 
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
+        tcg_out_negsetcond(s, args[3], a0, a1, a2, c2);
+        break;
+
     case INDEX_op_movcond_i32:
     case INDEX_op_movcond_i64:
         tcg_out_movcond(s, args[5], a0, a1, a2, c2,
@@ -1910,6 +1953,8 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_xor_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rI);
 
     case INDEX_op_andc_i32:
diff --git a/tcg/riscv/tcg-target.h b/tcg/riscv/tcg-target.h
index 0efb3fc0b8..c1132d178f 100644
--- a/tcg/riscv/tcg-target.h
+++ b/tcg/riscv/tcg-target.h
@@ -88,7 +88,7 @@ extern bool have_zbb;
 
 /* optional instructions */
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_div_i32          1
 #define TCG_TARGET_HAS_rem_i32          1
 #define TCG_TARGET_HAS_div2_i32         0
@@ -124,7 +124,7 @@ extern bool have_zbb;
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
 #define TCG_TARGET_HAS_movcond_i64      1
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          1
 #define TCG_TARGET_HAS_div2_i64         0

From 128c7d51942fed5bf09ad835ef2dd9b57946ada3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 18:55:54 +0000
Subject: [PATCH 1228/1353] tcg/s390x: Implement negsetcond_*

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/s390x/tcg-target.c.inc | 78 +++++++++++++++++++++++++-------------
 tcg/s390x/tcg-target.h     |  4 +-
 2 files changed, 54 insertions(+), 28 deletions(-)

diff --git a/tcg/s390x/tcg-target.c.inc b/tcg/s390x/tcg-target.c.inc
index a94f7908d6..ecd8aaf2a1 100644
--- a/tcg/s390x/tcg-target.c.inc
+++ b/tcg/s390x/tcg-target.c.inc
@@ -1266,7 +1266,8 @@ static int tgen_cmp(TCGContext *s, TCGType type, TCGCond c, TCGReg r1,
 }
 
 static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
-                         TCGReg dest, TCGReg c1, TCGArg c2, int c2const)
+                         TCGReg dest, TCGReg c1, TCGArg c2,
+                         bool c2const, bool neg)
 {
     int cc;
 
@@ -1275,11 +1276,27 @@ static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
         /* Emit: d = 0, d = (cc ? 1 : d).  */
         cc = tgen_cmp(s, type, cond, c1, c2, c2const, false);
         tcg_out_movi(s, TCG_TYPE_I64, dest, 0);
-        tcg_out_insn(s, RIEg, LOCGHI, dest, 1, cc);
+        tcg_out_insn(s, RIEg, LOCGHI, dest, neg ? -1 : 1, cc);
         return;
     }
 
- restart:
+    switch (cond) {
+    case TCG_COND_GEU:
+    case TCG_COND_LTU:
+    case TCG_COND_LT:
+    case TCG_COND_GE:
+        /* Swap operands so that we can use LEU/GTU/GT/LE.  */
+        if (!c2const) {
+            TCGReg t = c1;
+            c1 = c2;
+            c2 = t;
+            cond = tcg_swap_cond(cond);
+        }
+        break;
+    default:
+        break;
+    }
+
     switch (cond) {
     case TCG_COND_NE:
         /* X != 0 is X > 0.  */
@@ -1292,11 +1309,20 @@ static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
 
     case TCG_COND_GTU:
     case TCG_COND_GT:
-        /* The result of a compare has CC=2 for GT and CC=3 unused.
-           ADD LOGICAL WITH CARRY considers (CC & 2) the carry bit.  */
+        /*
+         * The result of a compare has CC=2 for GT and CC=3 unused.
+         * ADD LOGICAL WITH CARRY considers (CC & 2) the carry bit.
+         */
         tgen_cmp(s, type, cond, c1, c2, c2const, true);
         tcg_out_movi(s, type, dest, 0);
         tcg_out_insn(s, RRE, ALCGR, dest, dest);
+        if (neg) {
+            if (type == TCG_TYPE_I32) {
+                tcg_out_insn(s, RR, LCR, dest, dest);
+            } else {
+                tcg_out_insn(s, RRE, LCGR, dest, dest);
+            }
+        }
         return;
 
     case TCG_COND_EQ:
@@ -1310,27 +1336,17 @@ static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
 
     case TCG_COND_LEU:
     case TCG_COND_LE:
-        /* As above, but we're looking for borrow, or !carry.
-           The second insn computes d - d - borrow, or -1 for true
-           and 0 for false.  So we must mask to 1 bit afterward.  */
+        /*
+         * As above, but we're looking for borrow, or !carry.
+         * The second insn computes d - d - borrow, or -1 for true
+         * and 0 for false.  So we must mask to 1 bit afterward.
+         */
         tgen_cmp(s, type, cond, c1, c2, c2const, true);
         tcg_out_insn(s, RRE, SLBGR, dest, dest);
-        tgen_andi(s, type, dest, 1);
-        return;
-
-    case TCG_COND_GEU:
-    case TCG_COND_LTU:
-    case TCG_COND_LT:
-    case TCG_COND_GE:
-        /* Swap operands so that we can use LEU/GTU/GT/LE.  */
-        if (!c2const) {
-            TCGReg t = c1;
-            c1 = c2;
-            c2 = t;
-            cond = tcg_swap_cond(cond);
-            goto restart;
+        if (!neg) {
+            tgen_andi(s, type, dest, 1);
         }
-        break;
+        return;
 
     default:
         g_assert_not_reached();
@@ -1339,7 +1355,7 @@ static void tgen_setcond(TCGContext *s, TCGType type, TCGCond cond,
     cc = tgen_cmp(s, type, cond, c1, c2, c2const, false);
     /* Emit: d = 0, t = 1, d = (cc ? t : d).  */
     tcg_out_movi(s, TCG_TYPE_I64, dest, 0);
-    tcg_out_movi(s, TCG_TYPE_I64, TCG_TMP0, 1);
+    tcg_out_movi(s, TCG_TYPE_I64, TCG_TMP0, neg ? -1 : 1);
     tcg_out_insn(s, RRFc, LOCGR, dest, TCG_TMP0, cc);
 }
 
@@ -2288,7 +2304,11 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_setcond_i32:
         tgen_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1],
-                     args[2], const_args[2]);
+                     args[2], const_args[2], false);
+        break;
+    case INDEX_op_negsetcond_i32:
+        tgen_setcond(s, TCG_TYPE_I32, args[3], args[0], args[1],
+                     args[2], const_args[2], true);
         break;
     case INDEX_op_movcond_i32:
         tgen_movcond(s, TCG_TYPE_I32, args[5], args[0], args[1],
@@ -2566,7 +2586,11 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_setcond_i64:
         tgen_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1],
-                     args[2], const_args[2]);
+                     args[2], const_args[2], false);
+        break;
+    case INDEX_op_negsetcond_i64:
+        tgen_setcond(s, TCG_TYPE_I64, args[3], args[0], args[1],
+                     args[2], const_args[2], true);
         break;
     case INDEX_op_movcond_i64:
         tgen_movcond(s, TCG_TYPE_I64, args[5], args[0], args[1],
@@ -3109,8 +3133,10 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_rotr_i32:
     case INDEX_op_rotr_i64:
     case INDEX_op_setcond_i32:
+    case INDEX_op_negsetcond_i32:
         return C_O1_I2(r, r, ri);
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, r, rA);
 
     case INDEX_op_clz_i64:
diff --git a/tcg/s390x/tcg-target.h b/tcg/s390x/tcg-target.h
index 123a4b1645..50e12ef9d6 100644
--- a/tcg/s390x/tcg-target.h
+++ b/tcg/s390x/tcg-target.h
@@ -96,7 +96,7 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sextract_i32   0
 #define TCG_TARGET_HAS_extract2_i32   0
 #define TCG_TARGET_HAS_movcond_i32    1
-#define TCG_TARGET_HAS_negsetcond_i32 0
+#define TCG_TARGET_HAS_negsetcond_i32 1
 #define TCG_TARGET_HAS_add2_i32       1
 #define TCG_TARGET_HAS_sub2_i32       1
 #define TCG_TARGET_HAS_mulu2_i32      0
@@ -132,7 +132,7 @@ extern uint64_t s390_facilities[3];
 #define TCG_TARGET_HAS_sextract_i64   0
 #define TCG_TARGET_HAS_extract2_i64   0
 #define TCG_TARGET_HAS_movcond_i64    1
-#define TCG_TARGET_HAS_negsetcond_i64 0
+#define TCG_TARGET_HAS_negsetcond_i64 1
 #define TCG_TARGET_HAS_add2_i64       1
 #define TCG_TARGET_HAS_sub2_i64       1
 #define TCG_TARGET_HAS_mulu2_i64      1

From a0fdd7c91c220ea9240643b155f9f5bdc4a2e2a1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 13:57:32 -0700
Subject: [PATCH 1229/1353] tcg/sparc64: Implement negsetcond_*

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target.c.inc | 40 +++++++++++++++++++++++++++---------
 tcg/sparc64/tcg-target.h     |  4 ++--
 2 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index ffcb879211..f2a346a1bd 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -720,7 +720,7 @@ static void tcg_out_movcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
 }
 
 static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
-                                TCGReg c1, int32_t c2, int c2const)
+                                TCGReg c1, int32_t c2, int c2const, bool neg)
 {
     /* For 32-bit comparisons, we can play games with ADDC/SUBC.  */
     switch (cond) {
@@ -760,22 +760,34 @@ static void tcg_out_setcond_i32(TCGContext *s, TCGCond cond, TCGReg ret,
     default:
         tcg_out_cmp(s, c1, c2, c2const);
         tcg_out_movi_s13(s, ret, 0);
-        tcg_out_movcc(s, cond, MOVCC_ICC, ret, 1, 1);
+        tcg_out_movcc(s, cond, MOVCC_ICC, ret, neg ? -1 : 1, 1);
         return;
     }
 
     tcg_out_cmp(s, c1, c2, c2const);
     if (cond == TCG_COND_LTU) {
-        tcg_out_arithi(s, ret, TCG_REG_G0, 0, ARITH_ADDC);
+        if (neg) {
+            /* 0 - 0 - C = -C = (C ? -1 : 0) */
+            tcg_out_arithi(s, ret, TCG_REG_G0, 0, ARITH_SUBC);
+        } else {
+            /* 0 + 0 + C =  C = (C ? 1 : 0) */
+            tcg_out_arithi(s, ret, TCG_REG_G0, 0, ARITH_ADDC);
+        }
     } else {
-        tcg_out_arithi(s, ret, TCG_REG_G0, -1, ARITH_SUBC);
+        if (neg) {
+            /* 0 + -1 + C = C - 1 = (C ? 0 : -1) */
+            tcg_out_arithi(s, ret, TCG_REG_G0, -1, ARITH_ADDC);
+        } else {
+            /* 0 - -1 - C = 1 - C = (C ? 0 : 1) */
+            tcg_out_arithi(s, ret, TCG_REG_G0, -1, ARITH_SUBC);
+        }
     }
 }
 
 static void tcg_out_setcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
-                                TCGReg c1, int32_t c2, int c2const)
+                                TCGReg c1, int32_t c2, int c2const, bool neg)
 {
-    if (use_vis3_instructions) {
+    if (use_vis3_instructions && !neg) {
         switch (cond) {
         case TCG_COND_NE:
             if (c2 != 0) {
@@ -796,11 +808,11 @@ static void tcg_out_setcond_i64(TCGContext *s, TCGCond cond, TCGReg ret,
        if the input does not overlap the output.  */
     if (c2 == 0 && !is_unsigned_cond(cond) && c1 != ret) {
         tcg_out_movi_s13(s, ret, 0);
-        tcg_out_movr(s, cond, ret, c1, 1, 1);
+        tcg_out_movr(s, cond, ret, c1, neg ? -1 : 1, 1);
     } else {
         tcg_out_cmp(s, c1, c2, c2const);
         tcg_out_movi_s13(s, ret, 0);
-        tcg_out_movcc(s, cond, MOVCC_XCC, ret, 1, 1);
+        tcg_out_movcc(s, cond, MOVCC_XCC, ret, neg ? -1 : 1, 1);
     }
 }
 
@@ -1355,7 +1367,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond_i32(s, a2, a0, a1, const_args[1], arg_label(args[3]));
         break;
     case INDEX_op_setcond_i32:
-        tcg_out_setcond_i32(s, args[3], a0, a1, a2, c2);
+        tcg_out_setcond_i32(s, args[3], a0, a1, a2, c2, false);
+        break;
+    case INDEX_op_negsetcond_i32:
+        tcg_out_setcond_i32(s, args[3], a0, a1, a2, c2, true);
         break;
     case INDEX_op_movcond_i32:
         tcg_out_movcond_i32(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
@@ -1437,7 +1452,10 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
         break;
     case INDEX_op_setcond_i64:
-        tcg_out_setcond_i64(s, args[3], a0, a1, a2, c2);
+        tcg_out_setcond_i64(s, args[3], a0, a1, a2, c2, false);
+        break;
+    case INDEX_op_negsetcond_i64:
+        tcg_out_setcond_i64(s, args[3], a0, a1, a2, c2, true);
         break;
     case INDEX_op_movcond_i64:
         tcg_out_movcond_i64(s, args[5], a0, a1, a2, c2, args[3], const_args[3]);
@@ -1564,6 +1582,8 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_sar_i64:
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(r, rZ, rJ);
 
     case INDEX_op_brcond_i32:
diff --git a/tcg/sparc64/tcg-target.h b/tcg/sparc64/tcg-target.h
index 79889db760..3d41c9659b 100644
--- a/tcg/sparc64/tcg-target.h
+++ b/tcg/sparc64/tcg-target.h
@@ -106,7 +106,7 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sextract_i32     0
 #define TCG_TARGET_HAS_extract2_i32     0
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
@@ -143,7 +143,7 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     0
 #define TCG_TARGET_HAS_movcond_i64      1
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        0

From c359ce756db4fd8ba27a390780e3013b479ae537 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 14:48:27 -0700
Subject: [PATCH 1230/1353] tcg/i386: Merge tcg_out_brcond{32,64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass a rexw parameter instead of duplicating the functions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 110 +++++++++++++++++---------------------
 1 file changed, 49 insertions(+), 61 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 3045b56002..33f66ba204 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1436,99 +1436,89 @@ static void tcg_out_cmp(TCGContext *s, TCGArg arg1, TCGArg arg2,
     }
 }
 
-static void tcg_out_brcond32(TCGContext *s, TCGCond cond,
-                             TCGArg arg1, TCGArg arg2, int const_arg2,
-                             TCGLabel *label, int small)
+static void tcg_out_brcond(TCGContext *s, int rexw, TCGCond cond,
+                           TCGArg arg1, TCGArg arg2, int const_arg2,
+                           TCGLabel *label, bool small)
 {
-    tcg_out_cmp(s, arg1, arg2, const_arg2, 0);
+    tcg_out_cmp(s, arg1, arg2, const_arg2, rexw);
     tcg_out_jxx(s, tcg_cond_to_jcc[cond], label, small);
 }
 
-#if TCG_TARGET_REG_BITS == 64
-static void tcg_out_brcond64(TCGContext *s, TCGCond cond,
-                             TCGArg arg1, TCGArg arg2, int const_arg2,
-                             TCGLabel *label, int small)
-{
-    tcg_out_cmp(s, arg1, arg2, const_arg2, P_REXW);
-    tcg_out_jxx(s, tcg_cond_to_jcc[cond], label, small);
-}
-#else
-/* XXX: we implement it at the target level to avoid having to
-   handle cross basic blocks temporaries */
+#if TCG_TARGET_REG_BITS == 32
 static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
-                            const int *const_args, int small)
+                            const int *const_args, bool small)
 {
     TCGLabel *label_next = gen_new_label();
     TCGLabel *label_this = arg_label(args[5]);
 
     switch(args[4]) {
     case TCG_COND_EQ:
-        tcg_out_brcond32(s, TCG_COND_NE, args[0], args[2], const_args[2],
-                         label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_EQ, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_NE, args[0], args[2], const_args[2],
+                       label_next, 1);
+        tcg_out_brcond(s, 0, TCG_COND_EQ, args[1], args[3], const_args[3],
+                       label_this, small);
         break;
     case TCG_COND_NE:
-        tcg_out_brcond32(s, TCG_COND_NE, args[0], args[2], const_args[2],
-                         label_this, small);
-        tcg_out_brcond32(s, TCG_COND_NE, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_NE, args[0], args[2], const_args[2],
+                       label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_NE, args[1], args[3], const_args[3],
+                       label_this, small);
         break;
     case TCG_COND_LT:
-        tcg_out_brcond32(s, TCG_COND_LT, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LT, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_LTU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LTU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_LE:
-        tcg_out_brcond32(s, TCG_COND_LT, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LT, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_LEU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LEU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_GT:
-        tcg_out_brcond32(s, TCG_COND_GT, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GT, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_GTU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GTU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_GE:
-        tcg_out_brcond32(s, TCG_COND_GT, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GT, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_GEU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GEU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_LTU:
-        tcg_out_brcond32(s, TCG_COND_LTU, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LTU, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_LTU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LTU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_LEU:
-        tcg_out_brcond32(s, TCG_COND_LTU, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LTU, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_LEU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_LEU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_GTU:
-        tcg_out_brcond32(s, TCG_COND_GTU, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GTU, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_GTU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GTU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     case TCG_COND_GEU:
-        tcg_out_brcond32(s, TCG_COND_GTU, args[1], args[3], const_args[3],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GTU, args[1], args[3], const_args[3],
+                       label_this, small);
         tcg_out_jxx(s, JCC_JNE, label_next, 1);
-        tcg_out_brcond32(s, TCG_COND_GEU, args[0], args[2], const_args[2],
-                         label_this, small);
+        tcg_out_brcond(s, 0, TCG_COND_GEU, args[0], args[2], const_args[2],
+                       label_this, small);
         break;
     default:
         g_assert_not_reached();
@@ -2574,8 +2564,9 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_modrm(s, OPC_POPCNT + rexw, a0, a1);
         break;
 
-    case INDEX_op_brcond_i32:
-        tcg_out_brcond32(s, a2, a0, a1, const_args[1], arg_label(args[3]), 0);
+    OP_32_64(brcond):
+        tcg_out_brcond(s, rexw, a2, a0, a1, const_args[1],
+                       arg_label(args[3]), 0);
         break;
     case INDEX_op_setcond_i32:
         tcg_out_setcond32(s, args[3], a0, a1, a2, const_a2);
@@ -2730,9 +2721,6 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_brcond_i64:
-        tcg_out_brcond64(s, a2, a0, a1, const_args[1], arg_label(args[3]), 0);
-        break;
     case INDEX_op_setcond_i64:
         tcg_out_setcond64(s, args[3], a0, a1, a2, const_a2);
         break;

From 7ba99a1c762d46e08a5adf68f71f9d4ab621a094 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 14:59:16 -0700
Subject: [PATCH 1231/1353] tcg/i386: Merge tcg_out_setcond{32,64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass a rexw parameter instead of duplicating the functions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 33f66ba204..010432d3a9 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1527,23 +1527,16 @@ static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
 }
 #endif
 
-static void tcg_out_setcond32(TCGContext *s, TCGCond cond, TCGArg dest,
-                              TCGArg arg1, TCGArg arg2, int const_arg2)
+static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
+                            TCGArg dest, TCGArg arg1, TCGArg arg2,
+                            int const_arg2)
 {
-    tcg_out_cmp(s, arg1, arg2, const_arg2, 0);
+    tcg_out_cmp(s, arg1, arg2, const_arg2, rexw);
     tcg_out_modrm(s, OPC_SETCC | tcg_cond_to_jcc[cond], 0, dest);
     tcg_out_ext8u(s, dest, dest);
 }
 
-#if TCG_TARGET_REG_BITS == 64
-static void tcg_out_setcond64(TCGContext *s, TCGCond cond, TCGArg dest,
-                              TCGArg arg1, TCGArg arg2, int const_arg2)
-{
-    tcg_out_cmp(s, arg1, arg2, const_arg2, P_REXW);
-    tcg_out_modrm(s, OPC_SETCC | tcg_cond_to_jcc[cond], 0, dest);
-    tcg_out_ext8u(s, dest, dest);
-}
-#else
+#if TCG_TARGET_REG_BITS == 32
 static void tcg_out_setcond2(TCGContext *s, const TCGArg *args,
                              const int *const_args)
 {
@@ -2568,8 +2561,8 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_brcond(s, rexw, a2, a0, a1, const_args[1],
                        arg_label(args[3]), 0);
         break;
-    case INDEX_op_setcond_i32:
-        tcg_out_setcond32(s, args[3], a0, a1, a2, const_a2);
+    OP_32_64(setcond):
+        tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2);
         break;
     case INDEX_op_movcond_i32:
         tcg_out_movcond32(s, args[5], a0, a1, a2, const_a2, args[3]);
@@ -2721,9 +2714,6 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_setcond_i64:
-        tcg_out_setcond64(s, args[3], a0, a1, a2, const_a2);
-        break;
     case INDEX_op_movcond_i64:
         tcg_out_movcond64(s, args[5], a0, a1, a2, const_a2, args[3]);
         break;

From 78ddf0dc75229865ba637cfffd53cc605cc33ca1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 15:02:35 -0700
Subject: [PATCH 1232/1353] tcg/i386: Merge tcg_out_movcond{32,64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass a rexw parameter instead of duplicating the functions.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 28 +++++++---------------------
 1 file changed, 7 insertions(+), 21 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 010432d3a9..1542afd94d 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1593,24 +1593,14 @@ static void tcg_out_cmov(TCGContext *s, TCGCond cond, int rexw,
     }
 }
 
-static void tcg_out_movcond32(TCGContext *s, TCGCond cond, TCGReg dest,
-                              TCGReg c1, TCGArg c2, int const_c2,
-                              TCGReg v1)
+static void tcg_out_movcond(TCGContext *s, int rexw, TCGCond cond,
+                            TCGReg dest, TCGReg c1, TCGArg c2, int const_c2,
+                            TCGReg v1)
 {
-    tcg_out_cmp(s, c1, c2, const_c2, 0);
-    tcg_out_cmov(s, cond, 0, dest, v1);
+    tcg_out_cmp(s, c1, c2, const_c2, rexw);
+    tcg_out_cmov(s, cond, rexw, dest, v1);
 }
 
-#if TCG_TARGET_REG_BITS == 64
-static void tcg_out_movcond64(TCGContext *s, TCGCond cond, TCGReg dest,
-                              TCGReg c1, TCGArg c2, int const_c2,
-                              TCGReg v1)
-{
-    tcg_out_cmp(s, c1, c2, const_c2, P_REXW);
-    tcg_out_cmov(s, cond, P_REXW, dest, v1);
-}
-#endif
-
 static void tcg_out_ctz(TCGContext *s, int rexw, TCGReg dest, TCGReg arg1,
                         TCGArg arg2, bool const_a2)
 {
@@ -2564,8 +2554,8 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
     OP_32_64(setcond):
         tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2);
         break;
-    case INDEX_op_movcond_i32:
-        tcg_out_movcond32(s, args[5], a0, a1, a2, const_a2, args[3]);
+    OP_32_64(movcond):
+        tcg_out_movcond(s, rexw, args[5], a0, a1, a2, const_a2, args[3]);
         break;
 
     OP_32_64(bswap16):
@@ -2714,10 +2704,6 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         }
         break;
 
-    case INDEX_op_movcond_i64:
-        tcg_out_movcond64(s, args[5], a0, a1, a2, const_a2, args[3]);
-        break;
-
     case INDEX_op_bswap64_i64:
         tcg_out_bswap64(s, a0);
         break;

From 6950f68b62e4913513a40b574de0219b7ae15b9f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 15:43:23 -0700
Subject: [PATCH 1233/1353] tcg/i386: Use CMP+SBB in tcg_out_setcond

Use the carry bit to optimize some forms of setcond.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 50 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 1542afd94d..4d7b745a52 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1531,6 +1531,56 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
                             TCGArg dest, TCGArg arg1, TCGArg arg2,
                             int const_arg2)
 {
+    bool inv = false;
+
+    switch (cond) {
+    case TCG_COND_NE:
+        inv = true;
+        /* fall through */
+    case TCG_COND_EQ:
+        /* If arg2 is 0, convert to LTU/GEU vs 1. */
+        if (const_arg2 && arg2 == 0) {
+            arg2 = 1;
+            goto do_ltu;
+        }
+        break;
+
+    case TCG_COND_LEU:
+        inv = true;
+        /* fall through */
+    case TCG_COND_GTU:
+        /* If arg2 is a register, swap for LTU/GEU. */
+        if (!const_arg2) {
+            TCGReg t = arg1;
+            arg1 = arg2;
+            arg2 = t;
+            goto do_ltu;
+        }
+        break;
+
+    case TCG_COND_GEU:
+        inv = true;
+        /* fall through */
+    case TCG_COND_LTU:
+    do_ltu:
+        /*
+         * Relying on the carry bit, use SBB to produce -1 if LTU, 0 if GEU.
+         * We can then use NEG or INC to produce the desired result.
+         * This is always smaller than the SETCC expansion.
+         */
+        tcg_out_cmp(s, arg1, arg2, const_arg2, rexw);
+        tgen_arithr(s, ARITH_SBB, dest, dest);              /* T:-1 F:0 */
+        if (inv) {
+            tgen_arithi(s, ARITH_ADD, dest, 1, 0);          /* T:0  F:1 */
+        } else {
+            tcg_out_modrm(s, OPC_GRP3_Ev, EXT3_NEG, dest);  /* T:1  F:0 */
+        }
+        return;
+
+    default:
+        break;
+    }
+
     tcg_out_cmp(s, arg1, arg2, const_arg2, rexw);
     tcg_out_modrm(s, OPC_SETCC | tcg_cond_to_jcc[cond], 0, dest);
     tcg_out_ext8u(s, dest, dest);

From 96658acafd9ade24d00526e46cc073ed8fcf2111 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 15:51:30 -0700
Subject: [PATCH 1234/1353] tcg/i386: Clear dest first in tcg_out_setcond if
 possible

Using XOR first is both smaller and more efficient,
though cannot be applied if it clobbers an input.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 4d7b745a52..3f3c114efd 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1532,6 +1532,7 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
                             int const_arg2)
 {
     bool inv = false;
+    bool cleared;
 
     switch (cond) {
     case TCG_COND_NE:
@@ -1581,9 +1582,23 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
         break;
     }
 
+    /*
+     * If dest does not overlap the inputs, clearing it first is preferred.
+     * The XOR breaks any false dependency for the low-byte write to dest,
+     * and is also one byte smaller than MOVZBL.
+     */
+    cleared = false;
+    if (dest != arg1 && (const_arg2 || dest != arg2)) {
+        tgen_arithr(s, ARITH_XOR, dest, dest);
+        cleared = true;
+    }
+
     tcg_out_cmp(s, arg1, arg2, const_arg2, rexw);
     tcg_out_modrm(s, OPC_SETCC | tcg_cond_to_jcc[cond], 0, dest);
-    tcg_out_ext8u(s, dest, dest);
+
+    if (!cleared) {
+        tcg_out_ext8u(s, dest, dest);
+    }
 }
 
 #if TCG_TARGET_REG_BITS == 32

From e91f015b62d72158c4f69a5b1cbf87fba4599ba1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 16:07:34 -0700
Subject: [PATCH 1235/1353] tcg/i386: Use shift in tcg_out_setcond

For LT/GE vs zero, shift down the sign bit.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 3f3c114efd..16e830051d 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1578,6 +1578,21 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
         }
         return;
 
+    case TCG_COND_GE:
+        inv = true;
+        /* fall through */
+    case TCG_COND_LT:
+        /* If arg2 is 0, extract the sign bit. */
+        if (const_arg2 && arg2 == 0) {
+            tcg_out_mov(s, rexw ? TCG_TYPE_I64 : TCG_TYPE_I32, dest, arg1);
+            if (inv) {
+                tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, dest);
+            }
+            tcg_out_shifti(s, SHIFT_SHR + rexw, dest, rexw ? 63 : 31);
+            return;
+        }
+        break;
+
     default:
         break;
     }

From 95bf306e3a058a38f5adb27be2ac598134b159d9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 5 Aug 2023 16:58:43 -0700
Subject: [PATCH 1236/1353] tcg/i386: Implement negsetcond_*

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 32 ++++++++++++++++++++++++--------
 tcg/i386/tcg-target.h     |  4 ++--
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 16e830051d..0c3d1e4cef 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -1529,7 +1529,7 @@ static void tcg_out_brcond2(TCGContext *s, const TCGArg *args,
 
 static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
                             TCGArg dest, TCGArg arg1, TCGArg arg2,
-                            int const_arg2)
+                            int const_arg2, bool neg)
 {
     bool inv = false;
     bool cleared;
@@ -1570,11 +1570,18 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
          * This is always smaller than the SETCC expansion.
          */
         tcg_out_cmp(s, arg1, arg2, const_arg2, rexw);
-        tgen_arithr(s, ARITH_SBB, dest, dest);              /* T:-1 F:0 */
-        if (inv) {
-            tgen_arithi(s, ARITH_ADD, dest, 1, 0);          /* T:0  F:1 */
-        } else {
-            tcg_out_modrm(s, OPC_GRP3_Ev, EXT3_NEG, dest);  /* T:1  F:0 */
+
+        /* X - X - C = -C = (C ? -1 : 0) */
+        tgen_arithr(s, ARITH_SBB + (neg ? rexw : 0), dest, dest);
+        if (inv && neg) {
+            /* ~(C ? -1 : 0) = (C ? 0 : -1) */
+            tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, dest);
+        } else if (inv) {
+            /* (C ? -1 : 0) + 1 = (C ? 0 : 1) */
+            tgen_arithi(s, ARITH_ADD, dest, 1, 0);
+        } else if (!neg) {
+            /* -(C ? -1 : 0) = (C ? 1 : 0) */
+            tcg_out_modrm(s, OPC_GRP3_Ev, EXT3_NEG, dest);
         }
         return;
 
@@ -1588,7 +1595,8 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
             if (inv) {
                 tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NOT, dest);
             }
-            tcg_out_shifti(s, SHIFT_SHR + rexw, dest, rexw ? 63 : 31);
+            tcg_out_shifti(s, (neg ? SHIFT_SAR : SHIFT_SHR) + rexw,
+                           dest, rexw ? 63 : 31);
             return;
         }
         break;
@@ -1614,6 +1622,9 @@ static void tcg_out_setcond(TCGContext *s, int rexw, TCGCond cond,
     if (!cleared) {
         tcg_out_ext8u(s, dest, dest);
     }
+    if (neg) {
+        tcg_out_modrm(s, OPC_GRP3_Ev + rexw, EXT3_NEG, dest);
+    }
 }
 
 #if TCG_TARGET_REG_BITS == 32
@@ -2632,7 +2643,10 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
                        arg_label(args[3]), 0);
         break;
     OP_32_64(setcond):
-        tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2);
+        tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2, false);
+        break;
+    OP_32_64(negsetcond):
+        tcg_out_setcond(s, rexw, args[3], a0, a1, a2, const_a2, true);
         break;
     OP_32_64(movcond):
         tcg_out_movcond(s, rexw, args[5], a0, a1, a2, const_a2, args[3]);
@@ -3377,6 +3391,8 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
 
     case INDEX_op_setcond_i32:
     case INDEX_op_setcond_i64:
+    case INDEX_op_negsetcond_i32:
+    case INDEX_op_negsetcond_i64:
         return C_O1_I2(q, r, re);
 
     case INDEX_op_movcond_i32:
diff --git a/tcg/i386/tcg-target.h b/tcg/i386/tcg-target.h
index ebc0b1a6ce..8417ea4899 100644
--- a/tcg/i386/tcg-target.h
+++ b/tcg/i386/tcg-target.h
@@ -150,7 +150,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i32     1
 #define TCG_TARGET_HAS_extract2_i32     1
 #define TCG_TARGET_HAS_movcond_i32      1
-#define TCG_TARGET_HAS_negsetcond_i32   0
+#define TCG_TARGET_HAS_negsetcond_i32   1
 #define TCG_TARGET_HAS_add2_i32         1
 #define TCG_TARGET_HAS_sub2_i32         1
 #define TCG_TARGET_HAS_mulu2_i32        1
@@ -187,7 +187,7 @@ typedef enum {
 #define TCG_TARGET_HAS_sextract_i64     0
 #define TCG_TARGET_HAS_extract2_i64     1
 #define TCG_TARGET_HAS_movcond_i64      1
-#define TCG_TARGET_HAS_negsetcond_i64   0
+#define TCG_TARGET_HAS_negsetcond_i64   1
 #define TCG_TARGET_HAS_add2_i64         1
 #define TCG_TARGET_HAS_sub2_i64         1
 #define TCG_TARGET_HAS_mulu2_i64        1

From 4de5a76a923e1afab28bfbf9d19b67368bf98fb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:35 +0200
Subject: [PATCH 1237/1353] tcg/tcg-op: Document bswap16_i32() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-2-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b59a50a5a9..fc3a0ab7fc 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1035,6 +1035,14 @@ void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg)
     }
 }
 
+/*
+ * bswap16_i32: 16-bit byte swap on the low bits of a 32-bit value.
+ *
+ * Byte pattern: xxab -> yyba
+ *
+ * With TCG_BSWAP_IZ, x == zero, else undefined.
+ * With TCG_BSWAP_OZ, y == zero, with TCG_BSWAP_OS y == sign, else undefined.
+ */
 void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
 {
     /* Only one extension flag may be present. */
@@ -1046,22 +1054,25 @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
         TCGv_i32 t0 = tcg_temp_ebb_new_i32();
         TCGv_i32 t1 = tcg_temp_ebb_new_i32();
 
-        tcg_gen_shri_i32(t0, arg, 8);
+                                            /* arg = ..ab (IZ) xxab (!IZ) */
+        tcg_gen_shri_i32(t0, arg, 8);       /*  t0 = ...a (IZ) .xxa (!IZ) */
         if (!(flags & TCG_BSWAP_IZ)) {
-            tcg_gen_ext8u_i32(t0, t0);
+            tcg_gen_ext8u_i32(t0, t0);      /*  t0 = ...a */
         }
 
         if (flags & TCG_BSWAP_OS) {
-            tcg_gen_shli_i32(t1, arg, 24);
-            tcg_gen_sari_i32(t1, t1, 16);
+            tcg_gen_shli_i32(t1, arg, 24);  /*  t1 = b... */
+            tcg_gen_sari_i32(t1, t1, 16);   /*  t1 = ssb. */
         } else if (flags & TCG_BSWAP_OZ) {
-            tcg_gen_ext8u_i32(t1, arg);
-            tcg_gen_shli_i32(t1, t1, 8);
+            tcg_gen_ext8u_i32(t1, arg);     /*  t1 = ...b */
+            tcg_gen_shli_i32(t1, t1, 8);    /*  t1 = ..b. */
         } else {
-            tcg_gen_shli_i32(t1, arg, 8);
+            tcg_gen_shli_i32(t1, arg, 8);   /*  t1 = xab. */
         }
 
-        tcg_gen_or_i32(ret, t0, t1);
+        tcg_gen_or_i32(ret, t0, t1);        /* ret = ..ba (OZ) */
+                                            /*     = ssba (OS) */
+                                            /*     = xaba (no flag) */
         tcg_temp_free_i32(t0);
         tcg_temp_free_i32(t1);
     }

From 8b078800ab23c38e07a11dffbd88a988a6633152 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:36 +0200
Subject: [PATCH 1238/1353] tcg/tcg-op: Document bswap16_i64() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-3-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index fc3a0ab7fc..88c7c60ffe 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1767,6 +1767,14 @@ void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg)
     }
 }
 
+/*
+ * bswap16_i64: 16-bit byte swap on the low bits of a 64-bit value.
+ *
+ * Byte pattern: xxxxxxxxab -> yyyyyyyyba
+ *
+ * With TCG_BSWAP_IZ, x == zero, else undefined.
+ * With TCG_BSWAP_OZ, y == zero, with TCG_BSWAP_OS y == sign, else undefined.
+ */
 void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
 {
     /* Only one extension flag may be present. */
@@ -1785,22 +1793,25 @@ void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
         TCGv_i64 t0 = tcg_temp_ebb_new_i64();
         TCGv_i64 t1 = tcg_temp_ebb_new_i64();
 
-        tcg_gen_shri_i64(t0, arg, 8);
+                                            /* arg = ......ab or xxxxxxab */
+        tcg_gen_shri_i64(t0, arg, 8);       /*  t0 = .......a or .xxxxxxa */
         if (!(flags & TCG_BSWAP_IZ)) {
-            tcg_gen_ext8u_i64(t0, t0);
+            tcg_gen_ext8u_i64(t0, t0);      /*  t0 = .......a */
         }
 
         if (flags & TCG_BSWAP_OS) {
-            tcg_gen_shli_i64(t1, arg, 56);
-            tcg_gen_sari_i64(t1, t1, 48);
+            tcg_gen_shli_i64(t1, arg, 56);  /*  t1 = b....... */
+            tcg_gen_sari_i64(t1, t1, 48);   /*  t1 = ssssssb. */
         } else if (flags & TCG_BSWAP_OZ) {
-            tcg_gen_ext8u_i64(t1, arg);
-            tcg_gen_shli_i64(t1, t1, 8);
+            tcg_gen_ext8u_i64(t1, arg);     /*  t1 = .......b */
+            tcg_gen_shli_i64(t1, t1, 8);    /*  t1 = ......b. */
         } else {
-            tcg_gen_shli_i64(t1, arg, 8);
+            tcg_gen_shli_i64(t1, arg, 8);   /*  t1 = xxxxxab. */
         }
 
-        tcg_gen_or_i64(ret, t0, t1);
+        tcg_gen_or_i64(ret, t0, t1);        /* ret = ......ba (OZ) */
+                                            /*       ssssssba (OS) */
+                                            /*       xxxxxaba (no flag) */
         tcg_temp_free_i64(t0);
         tcg_temp_free_i64(t1);
     }

From 9296455697dbc423f0ca201f75d4e44bfcb68a5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:37 +0200
Subject: [PATCH 1239/1353] tcg/tcg-op: Document bswap32_i32() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-4-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 88c7c60ffe..ed0ab218a1 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1078,6 +1078,11 @@ void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg, int flags)
     }
 }
 
+/*
+ * bswap32_i32: 32-bit byte swap on a 32-bit value.
+ *
+ * Byte pattern: abcd -> dcba
+ */
 void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
     if (TCG_TARGET_HAS_bswap32_i32) {

From 9c40621584622078dcf47bb9add9a05925105130 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:38 +0200
Subject: [PATCH 1240/1353] tcg/tcg-op: Document bswap32_i64() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-5-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index ed0ab218a1..b56ae748b8 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1822,6 +1822,14 @@ void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
     }
 }
 
+/*
+ * bswap32_i64: 32-bit byte swap on the low bits of a 64-bit value.
+ *
+ * Byte pattern: xxxxabcd -> yyyydcba
+ *
+ * With TCG_BSWAP_IZ, x == zero, else undefined.
+ * With TCG_BSWAP_OZ, y == zero, with TCG_BSWAP_OS y == sign, else undefined.
+ */
 void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
 {
     /* Only one extension flag may be present. */
@@ -1855,7 +1863,8 @@ void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
         } else {
             tcg_gen_shri_i64(t1, t1, 32);   /*  t1 = ....dc.. */
         }
-        tcg_gen_or_i64(ret, t0, t1);        /* ret = ssssdcba */
+        tcg_gen_or_i64(ret, t0, t1);        /* ret = ssssdcba (OS) */
+                                            /*       ....dcba (else) */
 
         tcg_temp_free_i64(t0);
         tcg_temp_free_i64(t1);

From 95180e750b16ab21556b1073c3051a848911093a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:39 +0200
Subject: [PATCH 1241/1353] tcg/tcg-op: Document bswap64_i64() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230823145542.79633-6-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index b56ae748b8..22c682c28e 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1871,6 +1871,11 @@ void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg, int flags)
     }
 }
 
+/*
+ * bswap64_i64: 64-bit byte swap on a 64-bit value.
+ *
+ * Byte pattern: abcdefgh -> hgfedcba
+ */
 void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
     if (TCG_TARGET_REG_BITS == 32) {

From b8976aa5fe65e335af2eb5243a67d3b7fcd5442e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:40 +0200
Subject: [PATCH 1242/1353] tcg/tcg-op: Document hswap_i32/64() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document hswap_i32() and hswap_i64(), added in commit
46be8425ff ("tcg: Implement tcg_gen_{h,w}swap_{i32,i64}").

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-7-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 22c682c28e..58572526b7 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1108,6 +1108,11 @@ void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
     }
 }
 
+/*
+ * hswap_i32: Swap 16-bit halfwords within a 32-bit value.
+ *
+ * Byte pattern: abcd -> cdab
+ */
 void tcg_gen_hswap_i32(TCGv_i32 ret, TCGv_i32 arg)
 {
     /* Swapping 2 16-bit elements is a rotate. */
@@ -1921,19 +1926,25 @@ void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg)
     }
 }
 
+/*
+ * hswap_i64: Swap 16-bit halfwords within a 64-bit value.
+ * See also include/qemu/bitops.h, hswap64.
+ *
+ * Byte pattern: abcdefgh -> ghefcdab
+ */
 void tcg_gen_hswap_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
     uint64_t m = 0x0000ffff0000ffffull;
     TCGv_i64 t0 = tcg_temp_ebb_new_i64();
     TCGv_i64 t1 = tcg_temp_ebb_new_i64();
 
-    /* See include/qemu/bitops.h, hswap64. */
-    tcg_gen_rotli_i64(t1, arg, 32);
-    tcg_gen_andi_i64(t0, t1, m);
-    tcg_gen_shli_i64(t0, t0, 16);
-    tcg_gen_shri_i64(t1, t1, 16);
-    tcg_gen_andi_i64(t1, t1, m);
-    tcg_gen_or_i64(ret, t0, t1);
+                                        /* arg = abcdefgh */
+    tcg_gen_rotli_i64(t1, arg, 32);     /*  t1 = efghabcd */
+    tcg_gen_andi_i64(t0, t1, m);        /*  t0 = ..gh..cd */
+    tcg_gen_shli_i64(t0, t0, 16);       /*  t0 = gh..cd.. */
+    tcg_gen_shri_i64(t1, t1, 16);       /*  t1 = ..efghab */
+    tcg_gen_andi_i64(t1, t1, m);        /*  t1 = ..ef..ab */
+    tcg_gen_or_i64(ret, t0, t1);        /* ret = ghefcdab */
 
     tcg_temp_free_i64(t0);
     tcg_temp_free_i64(t1);

From ad262fb56bd8b04a992f20c598286587080eb3c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:41 +0200
Subject: [PATCH 1243/1353] tcg/tcg-op: Document wswap_i64() byte pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document wswap_i64(), added in commit 46be8425ff
("tcg: Implement tcg_gen_{h,w}swap_{i32,i64}").

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-8-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index 58572526b7..02a8cadcc0 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1950,6 +1950,11 @@ void tcg_gen_hswap_i64(TCGv_i64 ret, TCGv_i64 arg)
     tcg_temp_free_i64(t1);
 }
 
+/*
+ * wswap_i64: Swap 32-bit words within a 64-bit value.
+ *
+ * Byte pattern: abcdefgh -> efghabcd
+ */
 void tcg_gen_wswap_i64(TCGv_i64 ret, TCGv_i64 arg)
 {
     /* Swapping 2 32-bit elements is a rotate. */

From 277561638f482f54f6e18f8206429cdc62294179 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 23 Aug 2023 16:55:42 +0200
Subject: [PATCH 1244/1353] target/cris: Fix a typo in gen_swapr()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823145542.79633-9-philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/cris/translate.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/target/cris/translate.c b/target/cris/translate.c
index 0b3d724281..42103b5558 100644
--- a/target/cris/translate.c
+++ b/target/cris/translate.c
@@ -411,15 +411,17 @@ static inline void t_gen_swapw(TCGv d, TCGv s)
     tcg_gen_or_tl(d, d, t);
 }
 
-/* Reverse the within each byte.
-   T0 = (((T0 << 7) & 0x80808080) |
-   ((T0 << 5) & 0x40404040) |
-   ((T0 << 3) & 0x20202020) |
-   ((T0 << 1) & 0x10101010) |
-   ((T0 >> 1) & 0x08080808) |
-   ((T0 >> 3) & 0x04040404) |
-   ((T0 >> 5) & 0x02020202) |
-   ((T0 >> 7) & 0x01010101));
+/*
+ * Reverse the bits within each byte.
+ *
+ *  T0 = ((T0 << 7) & 0x80808080)
+ *     | ((T0 << 5) & 0x40404040)
+ *     | ((T0 << 3) & 0x20202020)
+ *     | ((T0 << 1) & 0x10101010)
+ *     | ((T0 >> 1) & 0x08080808)
+ *     | ((T0 >> 3) & 0x04040404)
+ *     | ((T0 >> 5) & 0x02020202)
+ *     | ((T0 >> 7) & 0x01010101);
  */
 static void t_gen_swapr(TCGv d, TCGv s)
 {

From b08caa6d50d45debfb67822a3c667e12a29ba437 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 23 Aug 2023 15:17:40 +0100
Subject: [PATCH 1245/1353] docs/devel/tcg-ops: fix missing newlines in "Host
 vector operations"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This unintentionally causes the mov_vec, ld_vec and st_vec operations
to appear on the same line.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230823141740.35974-1-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/devel/tcg-ops.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/devel/tcg-ops.rst b/docs/devel/tcg-ops.rst
index 9e2a931d85..8ae59ea02b 100644
--- a/docs/devel/tcg-ops.rst
+++ b/docs/devel/tcg-ops.rst
@@ -718,7 +718,9 @@ E.g. VECL = 1 -> 64 << 1 -> v128, and VECE = 2 -> 1 << 2 -> i32.
 .. list-table::
 
    * - mov_vec *v0*, *v1*
+
        ld_vec *v0*, *t1*
+
        st_vec *v0*, *t1*
 
      - | Move, load and store.

From 4daad8d9d6b9d426beb8ce505d2164ba36ea3168 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 23 Aug 2023 09:53:16 +0300
Subject: [PATCH 1246/1353] tcg: spelling fixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Acked-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20230823065335.1919380-4-mjt@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/aarch64/tcg-target.c.inc |  2 +-
 tcg/arm/tcg-target.c.inc     | 10 ++++++----
 tcg/riscv/tcg-target.c.inc   |  4 ++--
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 7d8d114c9e..0931a69448 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -3098,7 +3098,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
 #if !defined(CONFIG_SOFTMMU)
     /*
      * Note that XZR cannot be encoded in the address base register slot,
-     * as that actaully encodes SP.  Depending on the guest, we may need
+     * as that actually encodes SP.  Depending on the guest, we may need
      * to zero-extend the guest address via the address index register slot,
      * therefore we need to load even a zero guest base into a register.
      */
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 162df38c73..acb5f23b54 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1216,9 +1216,11 @@ static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg *args,
     case TCG_COND_LEU:
     case TCG_COND_GTU:
     case TCG_COND_GEU:
-        /* We perform a conditional comparision.  If the high half is
-           equal, then overwrite the flags with the comparison of the
-           low half.  The resulting flags cover the whole.  */
+        /*
+         * We perform a conditional comparison.  If the high half is
+         * equal, then overwrite the flags with the comparison of the
+         * low half.  The resulting flags cover the whole.
+         */
         tcg_out_dat_rI(s, COND_AL, ARITH_CMP, 0, ah, bh, const_bh);
         tcg_out_dat_rI(s, COND_EQ, ARITH_CMP, 0, al, bl, const_bl);
         return cond;
@@ -1250,7 +1252,7 @@ static TCGCond tcg_out_cmp2(TCGContext *s, const TCGArg *args,
 
 /*
  * Note that TCGReg references Q-registers.
- * Q-regno = 2 * D-regno, so shift left by 1 whlie inserting.
+ * Q-regno = 2 * D-regno, so shift left by 1 while inserting.
  */
 static uint32_t encode_vd(TCGReg rd)
 {
diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 232b616af3..9be81c1b7b 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -69,7 +69,7 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 
 static const int tcg_target_reg_alloc_order[] = {
     /* Call saved registers */
-    /* TCG_REG_S0 reservered for TCG_AREG0 */
+    /* TCG_REG_S0 reserved for TCG_AREG0 */
     TCG_REG_S1,
     TCG_REG_S2,
     TCG_REG_S3,
@@ -260,7 +260,7 @@ typedef enum {
     /* Zba: Bit manipulation extension, address generation */
     OPC_ADD_UW = 0x0800003b,
 
-    /* Zbb: Bit manipulation extension, basic bit manipulaton */
+    /* Zbb: Bit manipulation extension, basic bit manipulation */
     OPC_ANDN   = 0x40007033,
     OPC_CLZ    = 0x60001013,
     OPC_CLZW   = 0x6000101b,

From c400b6ed877213ad3d87d0e27f260401a9194c7c Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 7 Aug 2023 11:17:59 +0200
Subject: [PATCH 1247/1353] target/hppa: Add missing PL1 and PL2 privilege
 levels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hppa CPU has 4 privilege levels (0-3).
Mention the missing PL1 and PL2 levels, although the Linux kernel
uses only 0 (KERNEL) and 3 (USER). Not sure about HP-UX.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/cpu.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 75c5c0ccf7..6c5b0e67c8 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -31,8 +31,11 @@
 #define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
 
 #define MMU_KERNEL_IDX   0
+#define MMU_PL1_IDX      1
+#define MMU_PL2_IDX      2
 #define MMU_USER_IDX     3
 #define MMU_PHYS_IDX     4
+
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
 /* Hardware exceptions, interrupts, faults, and traps.  */

From c01e5dfb9a5b7a4c044e5da8840b6bc1175e5839 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 7 Aug 2023 11:32:09 +0200
Subject: [PATCH 1248/1353] target/hppa: Add privilege to MMU index conversion
 helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add two macros which convert privilege level to/from MMU index:

- PRIV_TO_MMU_IDX(priv)
    returns the MMU index for the given privilege level

- MMU_IDX_TO_PRIV(mmu_idx)
    returns the corresponding privilege level for this MMU index

The introduction of those macros make the code easier to read and
will help to improve performance in follow-up patch.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/cpu.h       | 5 ++++-
 target/hppa/translate.c | 9 +++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 6c5b0e67c8..50b513f0ea 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -36,6 +36,9 @@
 #define MMU_USER_IDX     3
 #define MMU_PHYS_IDX     4
 
+#define PRIV_TO_MMU_IDX(priv)    (priv)
+#define MMU_IDX_TO_PRIV(mmu_idx) (mmu_idx)
+
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
 /* Hardware exceptions, interrupts, faults, and traps.  */
@@ -236,7 +239,7 @@ static inline int cpu_mmu_index(CPUHPPAState *env, bool ifetch)
     return MMU_USER_IDX;
 #else
     if (env->psw & (ifetch ? PSW_C : PSW_D)) {
-        return env->iaoq_f & 3;
+        return PRIV_TO_MMU_IDX(env->iaoq_f & 3);
     }
     return MMU_PHYS_IDX;  /* mmu disabled */
 #endif
diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index d66fcb3e6a..e3af668252 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -4057,14 +4057,15 @@ static void hppa_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->tb_flags = ctx->base.tb->flags;
 
 #ifdef CONFIG_USER_ONLY
-    ctx->privilege = MMU_USER_IDX;
+    ctx->privilege = MMU_IDX_TO_PRIV(MMU_USER_IDX);
     ctx->mmu_idx = MMU_USER_IDX;
-    ctx->iaoq_f = ctx->base.pc_first | MMU_USER_IDX;
-    ctx->iaoq_b = ctx->base.tb->cs_base | MMU_USER_IDX;
+    ctx->iaoq_f = ctx->base.pc_first | ctx->privilege;
+    ctx->iaoq_b = ctx->base.tb->cs_base | ctx->privilege;
     ctx->unalign = (ctx->tb_flags & TB_FLAG_UNALIGN ? MO_UNALN : MO_ALIGN);
 #else
     ctx->privilege = (ctx->tb_flags >> TB_FLAG_PRIV_SHIFT) & 3;
-    ctx->mmu_idx = (ctx->tb_flags & PSW_D ? ctx->privilege : MMU_PHYS_IDX);
+    ctx->mmu_idx = (ctx->tb_flags & PSW_D ?
+                    PRIV_TO_MMU_IDX(ctx->privilege) : MMU_PHYS_IDX);
 
     /* Recover the IAOQ values from the GVA + PRIV.  */
     uint64_t cs_base = ctx->base.tb->cs_base;

From 88b7ad10dd7cecfb5977f99175fe62ac2c511290 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 7 Aug 2023 11:42:11 +0200
Subject: [PATCH 1249/1353] target/hppa: Do not use hardcoded value for
 tlb_flush_*()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid using hardcoded values when calling the tlb_flush*() functions.
Instead, define and use HPPA_MMU_FLUSH_MASK (keeping the current
behavior, which doesn't flush the physical address MMU).

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/cpu.h        | 5 +++++
 target/hppa/helper.c     | 2 +-
 target/hppa/mem_helper.c | 7 +++----
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 50b513f0ea..6623712644 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -41,6 +41,11 @@
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 
+/* No need to flush MMU_PHYS_IDX  */
+#define HPPA_MMU_FLUSH_MASK                             \
+        (1 << MMU_KERNEL_IDX | 1 << MMU_PL1_IDX |       \
+         1 << MMU_PL2_IDX    | 1 << MMU_USER_IDX)
+
 /* Hardware exceptions, interrupts, faults, and traps.  */
 #define EXCP_HPMC                1  /* high priority machine check */
 #define EXCP_POWER_FAIL          2
diff --git a/target/hppa/helper.c b/target/hppa/helper.c
index 74b8747083..a8d3f456ee 100644
--- a/target/hppa/helper.c
+++ b/target/hppa/helper.c
@@ -71,7 +71,7 @@ void cpu_hppa_put_psw(CPUHPPAState *env, target_ureg psw)
     /* If PSW_P changes, it affects how we translate addresses.  */
     if ((psw ^ old_psw) & PSW_P) {
 #ifndef CONFIG_USER_ONLY
-        tlb_flush_by_mmuidx(env_cpu(env), 0xf);
+        tlb_flush_by_mmuidx(env_cpu(env), HPPA_MMU_FLUSH_MASK);
 #endif
     }
 }
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index 5046cc8f9d..6f04c101dd 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -50,8 +50,7 @@ static void hppa_flush_tlb_ent(CPUHPPAState *env, hppa_tlb_entry *ent)
     trace_hppa_tlb_flush_ent(env, ent, ent->va_b, ent->va_e, ent->pa);
 
     for (i = 0; i < n; ++i, addr += TARGET_PAGE_SIZE) {
-        /* Do not flush MMU_PHYS_IDX.  */
-        tlb_flush_page_by_mmuidx(cs, addr, 0xf);
+        tlb_flush_page_by_mmuidx(cs, addr, HPPA_MMU_FLUSH_MASK);
     }
 
     memset(ent, 0, sizeof(*ent));
@@ -335,13 +334,13 @@ void HELPER(ptlbe)(CPUHPPAState *env)
 {
     trace_hppa_tlb_ptlbe(env);
     memset(env->tlb, 0, sizeof(env->tlb));
-    tlb_flush_by_mmuidx(env_cpu(env), 0xf);
+    tlb_flush_by_mmuidx(env_cpu(env), HPPA_MMU_FLUSH_MASK);
 }
 
 void cpu_hppa_change_prot_id(CPUHPPAState *env)
 {
     if (env->psw & PSW_P) {
-        tlb_flush_by_mmuidx(env_cpu(env), 0xf);
+        tlb_flush_by_mmuidx(env_cpu(env), HPPA_MMU_FLUSH_MASK);
     }
 }
 

From 3d066afc68d469b2c7cbabf62d32421eef478a66 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 7 Aug 2023 11:52:39 +0200
Subject: [PATCH 1250/1353] target/hppa: Use privilege helper in
 hppa_get_physical_address()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert hppa_get_physical_address() to use the privilege helper macro.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/mem_helper.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index 6f04c101dd..46c3dcaf15 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -73,7 +73,7 @@ int hppa_get_physical_address(CPUHPPAState *env, vaddr addr, int mmu_idx,
                               int type, hwaddr *pphys, int *pprot)
 {
     hwaddr phys;
-    int prot, r_prot, w_prot, x_prot;
+    int prot, r_prot, w_prot, x_prot, priv;
     hppa_tlb_entry *ent;
     int ret = -1;
 
@@ -97,9 +97,10 @@ int hppa_get_physical_address(CPUHPPAState *env, vaddr addr, int mmu_idx,
     phys = ent->pa + (addr & ~TARGET_PAGE_MASK);
 
     /* Map TLB access_rights field to QEMU protection.  */
-    r_prot = (mmu_idx <= ent->ar_pl1) * PAGE_READ;
-    w_prot = (mmu_idx <= ent->ar_pl2) * PAGE_WRITE;
-    x_prot = (ent->ar_pl2 <= mmu_idx && mmu_idx <= ent->ar_pl1) * PAGE_EXEC;
+    priv = MMU_IDX_TO_PRIV(mmu_idx);
+    r_prot = (priv <= ent->ar_pl1) * PAGE_READ;
+    w_prot = (priv <= ent->ar_pl2) * PAGE_WRITE;
+    x_prot = (ent->ar_pl2 <= priv && priv <= ent->ar_pl1) * PAGE_EXEC;
     switch (ent->ar_type) {
     case 0: /* read-only: data page */
         prot = r_prot;

From 2ad04500543094bc83f5f13dbb099000f010e008 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 7 Aug 2023 12:14:36 +0200
Subject: [PATCH 1251/1353] target/hppa: Switch to use MMU indices 11-15

The MMU indices 9-15 will use shorter assembler instructions
when run on a x86-64 host. So, switch over to those to get
smaller code and maybe minimally faster emulation.

Signed-off-by: Helge Deller <deller@gmx.de>
---
 target/hppa/cpu.h | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 6623712644..fa13694dab 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -30,14 +30,14 @@
    basis.  It's probably easier to fall back to a strong memory model.  */
 #define TCG_GUEST_DEFAULT_MO        TCG_MO_ALL
 
-#define MMU_KERNEL_IDX   0
-#define MMU_PL1_IDX      1
-#define MMU_PL2_IDX      2
-#define MMU_USER_IDX     3
-#define MMU_PHYS_IDX     4
+#define MMU_KERNEL_IDX   11
+#define MMU_PL1_IDX      12
+#define MMU_PL2_IDX      13
+#define MMU_USER_IDX     14
+#define MMU_PHYS_IDX     15
 
-#define PRIV_TO_MMU_IDX(priv)    (priv)
-#define MMU_IDX_TO_PRIV(mmu_idx) (mmu_idx)
+#define PRIV_TO_MMU_IDX(priv)    (MMU_KERNEL_IDX + (priv))
+#define MMU_IDX_TO_PRIV(mmu_idx) ((mmu_idx) - MMU_KERNEL_IDX)
 
 #define TARGET_INSN_START_EXTRA_WORDS 1
 

From a3d3de8e1d4aff1343066e351020de9a6294c102 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 9 Aug 2023 10:13:43 +0200
Subject: [PATCH 1252/1353] configure: fix and complete detection of tricore
 tools

The tricore tools are not detected when they are installed in
the host system, only if they are taken from an external
container.  For this reason the build-tricore-softmmu job
was not running the TCG tests.

In addition the container provides all tools, not just as/ld/gcc,
so there is no need to special case tricore.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/configure b/configure
index 133f4e3235..f2bd8858d6 100755
--- a/configure
+++ b/configure
@@ -1271,6 +1271,7 @@ fi
 : ${cross_prefix_sh4="sh4-linux-gnu-"}
 : ${cross_prefix_sparc64="sparc64-linux-gnu-"}
 : ${cross_prefix_sparc="$cross_prefix_sparc64"}
+: ${cross_prefix_tricore="tricore-"}
 : ${cross_prefix_x86_64="x86_64-linux-gnu-"}
 
 : ${cross_cc_aarch64_be="$cross_cc_aarch64"}
@@ -1458,10 +1459,6 @@ probe_target_compiler() {
       tricore)
         container_image=debian-tricore-cross
         container_cross_prefix=tricore-
-        container_cross_as=tricore-as
-        container_cross_ld=tricore-ld
-        container_cross_cc=tricore-gcc
-        break
         ;;
       x86_64)
         container_image=debian-amd64-cross

From 87f77f58d897314f0726374ce8f9cdf44ccd9c5b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 16:02:57 +0200
Subject: [PATCH 1253/1353] dockerfiles: bump tricore cross compiler container
 to Debian 11

With the release of version 12 on June 10, 2023, Debian 10 is
not supported anymore.  Modify the cross compiler container to
build on a newer version.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 tests/docker/dockerfiles/debian-tricore-cross.docker | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/docker/dockerfiles/debian-tricore-cross.docker b/tests/docker/dockerfiles/debian-tricore-cross.docker
index 269bfa8d42..5bd1963fb5 100644
--- a/tests/docker/dockerfiles/debian-tricore-cross.docker
+++ b/tests/docker/dockerfiles/debian-tricore-cross.docker
@@ -9,7 +9,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
-FROM docker.io/library/debian:buster-slim
+FROM docker.io/library/debian:11-slim
 
 MAINTAINER Philippe Mathieu-Daudé <f4bug@amsat.org>
 

From 67b9a83daf384f3dc24e83f22da40e34da49021d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 13:25:09 +0200
Subject: [PATCH 1254/1353] python: mkvenv: tweak the matching of --diagnose to
 depspecs

Move the matching between the "absent" array and dep_specs[0] inside
the loop, preparing for the possibility of having multiple canaries
among the installed packages.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 python/scripts/mkvenv.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index a47f1eaf5d..399659b22f 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -806,6 +806,7 @@ def _do_ensure(
     """
     absent = []
     present = []
+    canary = None
     for spec in dep_specs:
         matcher = distlib.version.LegacyMatcher(spec)
         ver = _get_version(matcher.name)
@@ -817,6 +818,8 @@ def _do_ensure(
             or not matcher.match(distlib.version.LegacyVersion(ver))
         ):
             absent.append(spec)
+            if spec == dep_specs[0]:
+                canary = prog
         else:
             logger.info("found %s %s", matcher.name, ver)
             present.append(matcher.name)
@@ -839,7 +842,7 @@ def _do_ensure(
             absent[0],
             online,
             wheels_dir,
-            prog if absent[0] == dep_specs[0] else None,
+            canary,
         )
 
     return None

From 0f1ec0705b92b79e5e5f69bed236639dae67d312 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 09:47:25 +0200
Subject: [PATCH 1255/1353] python: mkvenv: introduce TOML-like representation
 of dependencies

We would like to place all Python dependencies in the same file, so that
we can add more information without having long and complex command lines.
The plan is to have a TOML file with one entry per package, for example

  [avocado]
  avocado-framework = {
    accepted = "(>=88.1, <93.0)",
    installed = "88.1",
    canary = "avocado"
  }

Each TOML section will thus be a dictionary of dictionaries.  Modify
mkvenv.py's workhorse function, _do_ensure, to already operate on such
a data structure.  The "ensure" subcommand is modified to separate the
depspec into a name and a version part, and use the result (plus the
--diagnose argument) to build a dictionary for each command line argument.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 python/scripts/mkvenv.py | 77 +++++++++++++++++++++++++++++++---------
 1 file changed, 61 insertions(+), 16 deletions(-)

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index 399659b22f..96f506d7e2 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -46,6 +46,9 @@ options:
 
 """
 
+# The duplication between importlib and pkg_resources does not help
+# pylint: disable=too-many-lines
+
 # Copyright (C) 2022-2023 Red Hat, Inc.
 #
 # Authors:
@@ -69,6 +72,7 @@ import sysconfig
 from types import SimpleNamespace
 from typing import (
     Any,
+    Dict,
     Iterator,
     Optional,
     Sequence,
@@ -786,43 +790,67 @@ def pip_install(
     )
 
 
+def _make_version_constraint(info: Dict[str, str], install: bool) -> str:
+    """
+    Construct the version constraint part of a PEP 508 dependency
+    specification (for example '>=0.61.5') from the accepted and
+    installed keys of the provided dictionary.
+
+    :param info: A dictionary corresponding to a TOML key-value list.
+    :param install: True generates install constraints, False generates
+        presence constraints
+    """
+    if install and "installed" in info:
+        return "==" + info["installed"]
+
+    dep_spec = info.get("accepted", "")
+    dep_spec = dep_spec.strip()
+    # Double check that they didn't just use a version number
+    if dep_spec and dep_spec[0] not in "!~><=(":
+        raise Ouch(
+            "invalid dependency specifier " + dep_spec + " in dependency file"
+        )
+
+    return dep_spec
+
+
 def _do_ensure(
-    dep_specs: Sequence[str],
+    group: Dict[str, Dict[str, str]],
     online: bool = False,
     wheels_dir: Optional[Union[str, Path]] = None,
-    prog: Optional[str] = None,
 ) -> Optional[Tuple[str, bool]]:
     """
-    Use pip to ensure we have the package specified by @dep_specs.
+    Use pip to ensure we have the packages specified in @group.
 
-    If the package is already installed, do nothing. If online and
+    If the packages are already installed, do nothing. If online and
     wheels_dir are both provided, prefer packages found in wheels_dir
     first before connecting to PyPI.
 
-    :param dep_specs:
-        PEP 508 dependency specifications. e.g. ['meson>=0.61.5'].
+    :param group: A dictionary of dictionaries, corresponding to a
+        section in a pythondeps.toml file.
     :param online: If True, fall back to PyPI.
     :param wheels_dir: If specified, search this path for packages.
     """
     absent = []
     present = []
     canary = None
-    for spec in dep_specs:
-        matcher = distlib.version.LegacyMatcher(spec)
-        ver = _get_version(matcher.name)
+    for name, info in group.items():
+        constraint = _make_version_constraint(info, False)
+        matcher = distlib.version.LegacyMatcher(name + constraint)
+        ver = _get_version(name)
         if (
             ver is None
             # Always pass installed package to pip, so that they can be
             # updated if the requested version changes
-            or not _is_system_package(matcher.name)
+            or not _is_system_package(name)
             or not matcher.match(distlib.version.LegacyVersion(ver))
         ):
-            absent.append(spec)
-            if spec == dep_specs[0]:
-                canary = prog
+            absent.append(name + _make_version_constraint(info, True))
+            if len(absent) == 1:
+                canary = info.get("canary", None)
         else:
-            logger.info("found %s %s", matcher.name, ver)
-            present.append(matcher.name)
+            logger.info("found %s %s", name, ver)
+            present.append(name)
 
     if present:
         generate_console_scripts(present)
@@ -875,7 +903,24 @@ def ensure(
     if not HAVE_DISTLIB:
         raise Ouch("a usable distlib could not be found, please install it")
 
-    result = _do_ensure(dep_specs, online, wheels_dir, prog)
+    # Convert the depspecs to a dictionary, as if they came
+    # from a section in a pythondeps.toml file
+    group: Dict[str, Dict[str, str]] = {}
+    for spec in dep_specs:
+        name = distlib.version.LegacyMatcher(spec).name
+        group[name] = {}
+
+        spec = spec.strip()
+        pos = len(name)
+        ver = spec[pos:].strip()
+        if ver:
+            group[name]["accepted"] = ver
+
+        if prog:
+            group[name]["canary"] = prog
+            prog = None
+
+    result = _do_ensure(group, online, wheels_dir)
     if result:
         # Well, that's not good.
         if result[1]:

From 71ed611cd47d961e1897721d7d002ffb498221d4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 10:03:42 +0200
Subject: [PATCH 1256/1353] python: mkvenv: add ensuregroup command

Introduce a new subcommand that retrieves the packages to be installed
from a TOML file. This allows being more flexible in using the system
version of a package, while at the same time using a known-good version
when installing the package.  This is important for packages that
sometimes have backwards-incompatible changes or that depend on
specific versions of their dependencies.

Compared to JSON, TOML is more human readable and easier to edit.  A
parser is available in 3.11 but also available as a small (12k) package
for older versions, tomli.  While tomli is bundled with pip, this is only
true of recent versions of pip.  Of all the supported OSes pretty much
only FreeBSD has a recent enough version of pip while staying on Python
<3.11.  So we cannot use the same trick that is in place for distlib.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 python/scripts/mkvenv.py | 126 ++++++++++++++++++++++++++++++++++++++-
 python/setup.cfg         |   6 ++
 pythondeps.toml          |  17 ++++++
 3 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 pythondeps.toml

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index 96f506d7e2..02bcd9a8c9 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -14,6 +14,8 @@ Commands:
     post_init
               post-venv initialization
     ensure    Ensure that the specified package is installed.
+    ensuregroup
+              Ensure that the specified package group is installed.
 
 --------------------------------------------------
 
@@ -44,6 +46,19 @@ options:
   --online    Install packages from PyPI, if necessary.
   --dir DIR   Path to vendored packages where we may install from.
 
+--------------------------------------------------
+
+usage: mkvenv ensuregroup [-h] [--online] [--dir DIR] file group...
+
+positional arguments:
+  file        pointer to a TOML file
+  group       section name in the TOML file
+
+options:
+  -h, --help  show this help message and exit
+  --online    Install packages from PyPI, if necessary.
+  --dir DIR   Path to vendored packages where we may install from.
+
 """
 
 # The duplication between importlib and pkg_resources does not help
@@ -99,6 +114,18 @@ except ImportError:
     except ImportError:
         HAVE_DISTLIB = False
 
+# Try to load tomllib, with a fallback to tomli.
+# HAVE_TOMLLIB is checked below, just-in-time, so that mkvenv does not fail
+# outside the venv or before a potential call to ensurepip in checkpip().
+HAVE_TOMLLIB = True
+try:
+    import tomllib
+except ImportError:
+    try:
+        import tomli as tomllib
+    except ImportError:
+        HAVE_TOMLLIB = False
+
 # Do not add any mandatory dependencies from outside the stdlib:
 # This script *must* be usable standalone!
 
@@ -837,6 +864,7 @@ def _do_ensure(
     for name, info in group.items():
         constraint = _make_version_constraint(info, False)
         matcher = distlib.version.LegacyMatcher(name + constraint)
+        print(f"mkvenv: checking for {matcher}", file=sys.stderr)
         ver = _get_version(name)
         if (
             ver is None
@@ -898,7 +926,6 @@ def ensure(
         be presented to the user. e.g., 'sphinx-build' can be used as a
         bellwether for the presence of 'sphinx'.
     """
-    print(f"mkvenv: checking for {', '.join(dep_specs)}", file=sys.stderr)
 
     if not HAVE_DISTLIB:
         raise Ouch("a usable distlib could not be found, please install it")
@@ -928,6 +955,64 @@ def ensure(
         raise SystemExit(f"\n{result[0]}\n\n")
 
 
+def _parse_groups(file: str) -> Dict[str, Dict[str, Any]]:
+    if not HAVE_TOMLLIB:
+        if sys.version_info < (3, 11):
+            raise Ouch("found no usable tomli, please install it")
+
+        raise Ouch(
+            "Python >=3.11 does not have tomllib... what have you done!?"
+        )
+
+    try:
+        # Use loads() to support both tomli v1.2.x (Ubuntu 22.04,
+        # Debian bullseye-backports) and v2.0.x
+        with open(file, "r", encoding="ascii") as depfile:
+            contents = depfile.read()
+            return tomllib.loads(contents)  # type: ignore
+    except tomllib.TOMLDecodeError as exc:
+        raise Ouch(f"parsing {file} failed: {exc}") from exc
+
+
+def ensure_group(
+    file: str,
+    groups: Sequence[str],
+    online: bool = False,
+    wheels_dir: Optional[Union[str, Path]] = None,
+) -> None:
+    """
+    Use pip to ensure we have the package specified by @dep_specs.
+
+    If the package is already installed, do nothing. If online and
+    wheels_dir are both provided, prefer packages found in wheels_dir
+    first before connecting to PyPI.
+
+    :param dep_specs:
+        PEP 508 dependency specifications. e.g. ['meson>=0.61.5'].
+    :param online: If True, fall back to PyPI.
+    :param wheels_dir: If specified, search this path for packages.
+    """
+
+    if not HAVE_DISTLIB:
+        raise Ouch("found no usable distlib, please install it")
+
+    parsed_deps = _parse_groups(file)
+
+    to_install: Dict[str, Dict[str, str]] = {}
+    for group in groups:
+        try:
+            to_install.update(parsed_deps[group])
+        except KeyError as exc:
+            raise Ouch(f"group {group} not defined") from exc
+
+    result = _do_ensure(to_install, online, wheels_dir)
+    if result:
+        # Well, that's not good.
+        if result[1]:
+            raise Ouch(result[0])
+        raise SystemExit(f"\n{result[0]}\n\n")
+
+
 def post_venv_setup() -> None:
     """
     This is intended to be run *inside the venv* after it is created.
@@ -955,6 +1040,37 @@ def _add_post_init_subcommand(subparsers: Any) -> None:
     subparsers.add_parser("post_init", help="post-venv initialization")
 
 
+def _add_ensuregroup_subcommand(subparsers: Any) -> None:
+    subparser = subparsers.add_parser(
+        "ensuregroup",
+        help="Ensure that the specified package group is installed.",
+    )
+    subparser.add_argument(
+        "--online",
+        action="store_true",
+        help="Install packages from PyPI, if necessary.",
+    )
+    subparser.add_argument(
+        "--dir",
+        type=str,
+        action="store",
+        help="Path to vendored packages where we may install from.",
+    )
+    subparser.add_argument(
+        "file",
+        type=str,
+        action="store",
+        help=("Path to a TOML file describing package groups"),
+    )
+    subparser.add_argument(
+        "group",
+        type=str,
+        action="store",
+        help="One or more package group names",
+        nargs="+",
+    )
+
+
 def _add_ensure_subcommand(subparsers: Any) -> None:
     subparser = subparsers.add_parser(
         "ensure", help="Ensure that the specified package is installed."
@@ -1012,6 +1128,7 @@ def main() -> int:
     _add_create_subcommand(subparsers)
     _add_post_init_subcommand(subparsers)
     _add_ensure_subcommand(subparsers)
+    _add_ensuregroup_subcommand(subparsers)
 
     args = parser.parse_args()
     try:
@@ -1030,6 +1147,13 @@ def main() -> int:
                 wheels_dir=args.dir,
                 prog=args.diagnose,
             )
+        if args.command == "ensuregroup":
+            ensure_group(
+                file=args.file,
+                groups=args.group,
+                online=args.online,
+                wheels_dir=args.dir,
+            )
         logger.debug("mkvenv.py %s: exiting", args.command)
     except Ouch as exc:
         print("\n*** Ouch! ***\n", file=sys.stderr)
diff --git a/python/setup.cfg b/python/setup.cfg
index 5d7e95f5d2..e74b58a8c2 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -94,6 +94,12 @@ allow_subclassing_any = True
 [mypy-fuse]
 ignore_missing_imports = True
 
+[mypy-tomli]
+ignore_missing_imports = True
+
+[mypy-tomllib]
+ignore_missing_imports = True
+
 [mypy-urwid]
 ignore_missing_imports = True
 
diff --git a/pythondeps.toml b/pythondeps.toml
new file mode 100644
index 0000000000..362f63ff2c
--- /dev/null
+++ b/pythondeps.toml
@@ -0,0 +1,17 @@
+# This file describes Python package requirements to be
+# installed in the pyvenv Python virtual environment.
+#
+# Packages are placed in groups, which are installed using
+# the ensuregroup subcommand of python/scripts/mkvenv.py.
+# Each group forms a TOML section and each entry in the
+# section is a TOML key-value list describing a package.
+# All fields are optional; valid fields are:
+#
+# - accepted: accepted versions when using a system package
+# - installed: fixed version to install in the virtual environment
+#              if a system package is not found; if not specified,
+#              the minimum and maximum
+# - canary: if specified, use this program name to present more
+#           precise error diagnostics to the user.  For example,
+#           'sphinx-build' can be used as a bellwether for the
+#           presence of 'sphinx' in the system.

From dcb8541b0b726e18af7bb32acc6eea383d3b75af Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 15:31:22 +0200
Subject: [PATCH 1257/1353] lcitool: bump libvirt-ci submodule and regenerate

This brings in a newer version of the pipewire mapping, so rename it.

Python 3.9 and 3.10 do not seem to work in OpenSUSE LEAP 15.5 (weird,
because 3.9 persisted from 15.3 to 15.4) so bump the Python runtime
version to 3.11.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .../dockerfiles/debian-amd64-cross.docker     |  2 +-
 .../dockerfiles/debian-arm64-cross.docker     |  2 +-
 .../dockerfiles/debian-armel-cross.docker     |  2 +-
 .../dockerfiles/debian-armhf-cross.docker     |  2 +-
 .../dockerfiles/debian-mips64el-cross.docker  |  2 +-
 .../dockerfiles/debian-mipsel-cross.docker    |  2 +-
 .../dockerfiles/debian-ppc64el-cross.docker   |  2 +-
 .../dockerfiles/debian-riscv64-cross.docker   |  2 +-
 .../dockerfiles/debian-s390x-cross.docker     |  2 +-
 .../dockerfiles/fedora-win32-cross.docker     |  2 +-
 .../dockerfiles/fedora-win64-cross.docker     |  2 +-
 tests/docker/dockerfiles/opensuse-leap.docker | 22 +++++++++----------
 tests/lcitool/libvirt-ci                      |  2 +-
 tests/lcitool/mappings.yml                    | 12 +++++-----
 tests/lcitool/projects/qemu.yml               |  2 +-
 tests/lcitool/targets/opensuse-leap-15.yml    |  4 ++--
 16 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index b7bdc01243..b9871f9c8c 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross x86_64 debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch x86_64 debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 68165c2f23..3504c771a7 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross aarch64 debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch aarch64 debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-armel-cross.docker b/tests/docker/dockerfiles/debian-armel-cross.docker
index 2fb65308c7..6d11c9510f 100644
--- a/tests/docker/dockerfiles/debian-armel-cross.docker
+++ b/tests/docker/dockerfiles/debian-armel-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross armv6l debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch armv6l debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index df77ccb57b..37ae575cf7 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross armv7l debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch armv7l debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 63a3d7aa3b..26ed730165 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross mips64el debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch mips64el debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index ac87bbb095..ade2f37ed1 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross mipsel debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch mipsel debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index def11f1693..08dcffa0a8 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross ppc64le debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch ppc64le debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index a2d879ee1f..a26637ec4f 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross riscv64 debian-sid qemu-minimal
+#  $ lcitool dockerfile --layers all --cross-arch riscv64 debian-sid qemu-minimal
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 80028e1eea..48a2c10fdb 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross s390x debian-11 qemu
+#  $ lcitool dockerfile --layers all --cross-arch s390x debian-11 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/fedora-win32-cross.docker b/tests/docker/dockerfiles/fedora-win32-cross.docker
index e3dfd68bed..afa988574f 100644
--- a/tests/docker/dockerfiles/fedora-win32-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win32-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross mingw32 fedora-38 qemu
+#  $ lcitool dockerfile --layers all --cross-arch mingw32 fedora-38 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index 0e15c9643a..cf93a0ca60 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross mingw64 fedora-38 qemu
+#  $ lcitool dockerfile --layers all --cross-arch mingw64 fedora-38 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index 37c83e5e4e..fef8d5a2e4 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.opensuse.org/opensuse/leap:15.4
+FROM registry.opensuse.org/opensuse/leap:15.5
 
 RUN zypper update -y && \
     zypper install -y \
@@ -90,9 +90,9 @@ RUN zypper update -y && \
            pcre-devel-static \
            pipewire-devel \
            pkgconfig \
-           python39-base \
-           python39-pip \
-           python39-setuptools \
+           python311-base \
+           python311-pip \
+           python311-setuptools \
            rdma-core-devel \
            sed \
            snappy-devel \
@@ -125,18 +125,18 @@ RUN zypper update -y && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/g++ && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
-RUN /usr/bin/pip3.9 install \
-                    PyYAML \
-                    meson==0.63.2 \
-                    pillow \
-                    sphinx \
-                    sphinx-rtd-theme
+RUN /usr/bin/pip3.11 install \
+                     PyYAML \
+                     meson==0.63.2 \
+                     pillow \
+                     sphinx \
+                     sphinx-rtd-theme
 
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3.9"
+ENV PYTHON "/usr/bin/python3.11"
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/lcitool/libvirt-ci b/tests/lcitool/libvirt-ci
index 9bff3b763b..bbd55b4d18 160000
--- a/tests/lcitool/libvirt-ci
+++ b/tests/lcitool/libvirt-ci
@@ -1 +1 @@
-Subproject commit 9bff3b763b5531a1490e238bfbf77306dc3a6dbb
+Subproject commit bbd55b4d18cce8f89b5167675e434a6941315634
diff --git a/tests/lcitool/mappings.yml b/tests/lcitool/mappings.yml
index 454963f07b..3c554099ed 100644
--- a/tests/lcitool/mappings.yml
+++ b/tests/lcitool/mappings.yml
@@ -9,7 +9,7 @@ mappings:
 
   python3:
     CentOSStream8: python38
-    OpenSUSELeap15: python39-base
+    OpenSUSELeap15: python311-base
 
   python3-PyYAML:
     CentOSStream8: python38-PyYAML
@@ -17,7 +17,7 @@ mappings:
 
   python3-devel:
     CentOSStream8: python38-devel
-    OpenSUSELeap15: python39-devel
+    OpenSUSELeap15: python311-devel
 
   python3-docutils:
     CentOSStream8:
@@ -37,7 +37,7 @@ mappings:
 
   python3-pip:
     CentOSStream8: python38-pip
-    OpenSUSELeap15: python39-pip
+    OpenSUSELeap15: python311-pip
 
   python3-pillow:
     CentOSStream8:
@@ -49,7 +49,7 @@ mappings:
 
   python3-setuptools:
     CentOSStream8: python38-setuptools
-    OpenSUSELeap15: python39-setuptools
+    OpenSUSELeap15: python311-setuptools
 
   python3-sphinx:
     CentOSStream8:
@@ -61,11 +61,11 @@ mappings:
 
   python3-venv:
     CentOSStream8: python38
-    OpenSUSELeap15: python39-base
+    OpenSUSELeap15: python311-base
 
   python3-wheel:
     CentOSStream8: python38-wheel
-    OpenSUSELeap15: python39-pip
+    OpenSUSELeap15: python311-pip
 
 pypi_mappings:
   # Request more recent version
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index d452a891ee..2d31cf792a 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -85,7 +85,7 @@ packages:
  - pam
  - pcre-static
  - pixman
- - pipewire
+ - libpipewire-dev
  - pkg-config
  - pulseaudio
  - python3
diff --git a/tests/lcitool/targets/opensuse-leap-15.yml b/tests/lcitool/targets/opensuse-leap-15.yml
index 683016e007..c2d87f6cb4 100644
--- a/tests/lcitool/targets/opensuse-leap-15.yml
+++ b/tests/lcitool/targets/opensuse-leap-15.yml
@@ -1,3 +1,3 @@
 paths:
-  pip3: /usr/bin/pip3.9
-  python: /usr/bin/python3.9
+  pip3: /usr/bin/pip3.11
+  python: /usr/bin/python3.11

From 7c3fb52bcdaef85b15a91b3ca4d1516f9d9b5402 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 20:28:25 +0200
Subject: [PATCH 1258/1353] configure: never use PyPI for Meson

Since there is a vendored copy, there is no point in choosing online
operation.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/configure b/configure
index f2bd8858d6..f13f0662b9 100755
--- a/configure
+++ b/configure
@@ -1018,13 +1018,7 @@ fi
 python="$python -B"
 mkvenv="$python ${source_path}/python/scripts/mkvenv.py"
 
-mkvenv_flags=""
-if test "$download" = "enabled" ; then
-    mkvenv_flags="--online"
-fi
-
 if ! $mkvenv ensure \
-     $mkvenv_flags \
      --dir "${source_path}/python/wheels" \
      --diagnose "meson" \
      "meson>=0.63.0" ;

From edc2107895007d621fe474d58bcb99036c8e55d2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 20:19:43 +0200
Subject: [PATCH 1259/1353] python: use vendored tomli

Debian only introduced tomli in the bookworm release.  Use a
vendored wheel to avoid requiring a package that is only in
bullseye-backports and is also absent in Ubuntu 20.04.

While at it, fix an issue in the vendor.py scripts which does
not add a newline after each package and hash.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure                                  |   6 ++++++
 python/scripts/vendor.py                   |   5 ++++-
 python/wheels/tomli-2.0.1-py3-none-any.whl | Bin 0 -> 12757 bytes
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 python/wheels/tomli-2.0.1-py3-none-any.whl

diff --git a/configure b/configure
index f13f0662b9..347153702c 100755
--- a/configure
+++ b/configure
@@ -1018,6 +1018,12 @@ fi
 python="$python -B"
 mkvenv="$python ${source_path}/python/scripts/mkvenv.py"
 
+# Finish preparing the virtual environment using vendored .whl files
+
+if $python -c 'import sys; sys.exit(sys.version_info >= (3,11))'; then
+    $mkvenv ensure --dir "${source_path}/python/wheels" \
+        'tomli>=1.2.0' || exit 1
+fi
 if ! $mkvenv ensure \
      --dir "${source_path}/python/wheels" \
      --diagnose "meson" \
diff --git a/python/scripts/vendor.py b/python/scripts/vendor.py
index 34486a51f4..7627487117 100755
--- a/python/scripts/vendor.py
+++ b/python/scripts/vendor.py
@@ -43,13 +43,16 @@ def main() -> int:
     packages = {
         "meson==0.63.3":
         "d677b809c4895dcbaac9bf6c43703fcb3609a4b24c6057c78f828590049cf43a",
+
+        "tomli==2.0.1":
+        "939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc",
     }
 
     vendor_dir = Path(__file__, "..", "..", "wheels").resolve()
 
     with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8") as file:
         for dep_spec, checksum in packages.items():
-            file.write(f"{dep_spec} --hash=sha256:{checksum}")
+            print(f"{dep_spec} --hash=sha256:{checksum}", file=file)
         file.flush()
 
         cli_args = [
diff --git a/python/wheels/tomli-2.0.1-py3-none-any.whl b/python/wheels/tomli-2.0.1-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..29670b98d16e2bc770d4fea718582e1dc0dd8aca
GIT binary patch
literal 12757
zcmZ{K19T?cvi6(2v8{=1TN67I+qN;W?TKyMwlT47dy-6?{B!QT=Y02k_dnfhuU_4&
zpQrb(uBz4bbjeEt!O#Ez02H7}RYJMAoa`MF1OSNoGm!sWb+)sywqVfHv#_;r*3+Z6
zch`}hi0BtU>O7{2a9ah3PcNtq)hCA71L7L+!5ht;=`*8pC+Iw0f6veEbjEa6aZ!t{
z-7eZr5K1xTPCr1$E}2eui*cb3n04x0V575s9eHtd3AnP2al@G=Ow7|XTHLl>i@Uu~
zQ2;lqTW6Tfh`@q@wZc7Dx~3&*V^rA36cr>aDz~D#4UVmCE<fvM!q-1B?4Vbqwh_f{
zIJ}vk_YLE*nG{ADo@GrB?u9zV$fy!XJ_0pNx>h*IfIByKl8D&D${Pjy<~={mz=uH0
z;OKxG#BXMAx=t8hwKuh0k+D=iu>QdmGLYQ_>$QTHK(gPU>jK%Hve4f5qUJ)GmUw5^
zilT(pi7l$g-h5`|Q5ZK@Iy|sLApdVx1nrKoh{6B>EYtx2q`$0aZ{X-;;`qmiL%gew
z>k{$TZxNPH{>B-G()C>|lj^cyTE!*UBx4BSTc<kVAc6V{BCud9oU~<ZFOQQyx#fcc
zLz}Wqg6L36$1Cc8mG7f>yxf1Z1UB>@D~ux!JK>x35$}xoWyMldsqH<45+0P?zA!=C
zrmO~iH3qtRxp@te>kbb1y{B()f+NS~wt=ylY5e5Z@z!@|J%+wpvA{KvWSnT=G#FS9
zx<e;CYtf7()n!`NInc<qUpDEp#G}Bz%cq>`qzx-jZob`TJmBX$^<>dw!!_f*H6^ke
z+osYFw-rsfaF|qDyxGvI*_|vQ^>NGWh1~?hFJ~V(sT=WuCT4KQ^}VQrwHrE4@PeNa
zJ@3x2Uu>Q?ylKO2yADm5HTL2^D}yv6kP9_iN{F03?unuwnodf2mgb1uY)iSNRll9v
zXZ+n&d*q&2W6FEl)E<Er+2L!S`<9SW_$G|yiR~3DXg^Rff4jn$rJY@e3bFYym^a4#
z!F&p))9jZArH)iL7-{Q%Jn7If@u6br>im{s+XBAt(HCe9O@hsU^(M;|h~dZgYrt!2
zm7oomE|;Ut2;g?~{N3WDXo5e3_L<}k1wsCeS5kjtK)m@r-yO<wuLxjqNk#~F<Vod-
zMg-9;W{T20O2Tzgb-TKHay`KEn6kV0w9u8V-Cojzz)<7I7B~$I1UV*mYHweEHp5D6
zxE(TQ0B|7t%`i?4C(M$)vAwd#sRVvkx)wWwIVd5Ro)*VUs0!0ch&?vD`dU-T^c@RY
zxZ5!l^LjIK_A4?Gs}kOa$!$#LCo|Z?`^ZTT+g!eXs)aYhLtrnwI|M3|NzEbH#dP30
z;lTEkKde2{;FBRQHVFZWGIVqFhJ|pAo_J3e!KXK`#c=llA}A`HB2nn<;_1!&Xcw+G
z_m}J#dGnPvYmh-WpZw3;{f&*EnILath=_=vXZKj1WD9PW&l}cBr>b8gRns_Fw#8rG
z<vS7kIO#caGNLisXUojN<{gH{t57!2y37wfB~jd3GRbghO$*nX?F5YLFK_G2BOB(3
zao0x4ufM^6*rzKtnAOr(B_sAI&4oX1#2$Mkk~+*iGcf!dTE6nb;fZ01!WyB_7X)p5
z?gOQL=l$)(dPOUNjpgur5jK#^|6CZ;@9QxvgqY<PNJ9@k*6-gV*{Kg#pf)SLwPu|6
zPc0J&AHzrfIXVMRk2AV*Y)lL3H;nah_!-E?&4A;fz18a-zA#YhufVXd?i_o<Lh0%H
z1BcwAB%weJ-*2FC*Uy2|%R8jZyQ4vj5%{FQkO(rcVm&196Tww#ITm)H;S#TqgJ{Gc
zy8bECR?lSvuAf&QMAmQOm{*NXn03CTZ>E=5nBoH$F!&665^%LM5GYn_l5||zSlb;T
zPfBsV-1?-Wb_u-H@@SvC@GGa&q2iPKgvZp;{OlgV^!`OwS1b&0`>$x3p7%)<*zJbL
z<o?h>yFg7sq;WO;yuv~w%=ZDnrcdhcRqW|CsuNskql<)quW*4wBz1ujWy0xCtXouY
zkK9448_4P&GU{B`4KWU*h^L;JB-;dc)>&p*u-T?wANcCm&Yl;-C!57t)h7*LhkX*z
zoeYgBmWEI$_|=^}SH)Wa9m97qe53&sL>yT1`skfRvP6JgCO8P=41{4CBmzI6jst^K
z8J8wzB2qYS^xfcbK>RBi^(N_<dtOn^ib9UgCb-os9T<ZA*$nG`a~>+FWM0`hgMTxE
zL|v$y=eVB49Qew9_W|LUFanUp!|!%7OaPh1&wro~!kV1zhD)C}-H0T!6uu^I<rmFY
z-MqN**z2c#IlWo+J_#_%XSyc<Sa^EW3kn1y2@g_aFWTGqEwo1!6zEqJv6cYT3vdzY
z1@9JH(sQ^dVe<*>?f^p|7ZDsKSgrTwNWJir;O)LV=?7bwZ~3-lAZrNHYo2k`4GU27
z`X04*5_Afhs%sN%<mCaHr+!vw6kmj^#t)!V@pMPsiHZxIBGxaO#dr^Sq$c+bf8xg3
z%FkL=fG%R@;JSTKS2X`gvaea(2~<`U2^5L7BsiDIjVoPqvl*%r44u&8wUWQr-PfPI
zum><f0O1>;1Mmi0JX!e(<iRM#sV<C4Bn8Qu`G%R)E_T2UieKy{?pAuKwd=iZ{toc!
zqP``=wMb{c=mX|-AQ@oQW;&39!q|}FO~7^iSgNwdmH9PD1HW+gsj5Xk@JnAv$*iFJ
zTIM~^ws;Auq&zUV5sU%JO60A3Fg#|yQ&fz~gGd3^a5<hx1DfSPAUZ^O>AWEM<mAUj
zA;RPd<`cl)jK(hdD4zTsmrmp*fjy%Pn>bULIE@+6>(esH%$x}Jb(~vJWJ7@Qf{$44
z7e~`MjMB^Qul>&``bN2BBtbO&yYN&p;~W+Q)6}oI*a(bF=-i0mR1#y5_sE>#Sikl~
zgsA#kaDi~Ytf$zBvbkx!qnNJ+kr-bt=U1Q5>Qf?T7lSO?4Bigg1<{PF*CpLsb7x@a
zf|0%Z_q(M-4E05Ho@`*^va_Y>ir^La2nE}xYHb~4UHl2hi&x<9ifsjhIC8A^1NA*P
zae)d_0s_E`6^YE?dc<1pES|*%EB&&SHi+apoIDWuUbTU=qSOU|``o5SZlVu@|F)XX
zFOYuW0pw-mOX2&3RFpBMCTF5f>al_lZRZ$LMLv0Uict{f9(-I}S(|zTk8K4*Fghfu
zMW_@-9w6RFTX%*o4>EYs)IxqqPs}o9lvVF4i3j`^rG+hy$vB|#0>T<&#Gua^`S?$Q
z-M%0Oy?<jI;u0FZ7PycC10zN92vc4fm-)S+W~s=|$%mUij13hH$x^D}G+|dr2+3HI
z{g}Y1Sg3AAD&w3o`5|ZCK%}eIPNMUI?e0#l@XaE5?u~YVSYnedfxyK;-!b~9q0u@6
zw4Fc$!h@)13TaGm9=Nb2&Ddj(PylX+7254!6J!gVmPT&Ajmpn?vCLGvMT>aos(hIu
zNyBgOO4B$lGAspX1-ABRdI1n)kREccqQQ%*&@pl4jt`<fyeq3c;V^!1phz^95i+P$
z(JE&~>vs3Pfr{utt-{gI7;tWIh8RC+#@megPSS`mU#fH7)V&_Opu`m;3Y82H>SSO@
zXwpwC!!D5^Bz`DbM1(GADdp+uudt_;GAk#5N0@?!sSyrGdTsU5^GW%1JUpST1Qx((
z=QqK@q*Z~C<*OjoQ-*Ufp0x%D4g2-iV(UQ&Xf_9#5#p3+EwO>w1<@vU&DYLpLNnIp
zR8%V<ni#??<SwOoinC><kCkpOAz&TqN_mu@vSTZj4Bt}1I$(`il1ExdLI|x&pfO`O
zAoN=&myy>pfUUZFuqV_z3Yp&lWOTmr$vt$c9Wr%EkV}pj>+7q7dr$(Eq`-{f=f0tv
z5TPhWfmG`}P=W_sTY4i>yd^?lZo!DC{wA~3p}x(pBLYmC#K3c{;ykf9Wx7}+XNhYd
z!8GJk*-1VHc!UF-81|bQ8I+m7@0-ihnjwAvt(7tYYvArt1@9%Sdpy3ue)|f-JdYe^
zVrx~anRs*l63W}}f0EvAi`<|TProaOq;QZe7m!O3Z#Gh?)e<$9i}Voaj9=I@;y*g=
zzzB(Q(74XIHs@v8$By_yK1a4nV2%P_|I<(N;5n7>E0yzLXc>OIfOJhHj<93{N0f;Z
zm1VoE(ZmCJ1CHsE8tIS;n<@brB(3*@GKj9!L!m2Pz1it#IG()=hYT@Q-U9gYfg=9(
z*0KhumaYq#jrr*mr<?i}u`v=bpE=amNoQOe?sDmO1zJ=TmC)t4aghaxkzlYh7%OyG
ztYdxNpd>P)u&8WZf0j6q(m7ilOV{eGC0nm^7sOxLl<eh${f~|oa4WPhDXC2I!?MGj
zb}C%$ShDQw=;+u+ICg2_C5^CPxL-MOp}u4T7FZ^(fH@P-YWi~~emMC!<)BLo^D31u
zfIjAean$S4P(zZB@q|~>QO-Lom7y=uM4FCaaPhQVi1j8TY21d4uA-&zcAjg)WTa8$
zCbQG1WXx1bYxTQ{W@V{wy-ih>sw&T-;~v(O=RF!)JqqA;plP>jili1riMuqviFPv&
zbXddoJQZx<nEha4=!QT`F~fJFYnE0E!nOq1RNsAi3RgvCrOtP0ASO-Si-mccA>bkT
z`^BTGlo-#6cq3B!Xa(4ic(TU#Ke|lib)r5#zXt0vhL$H##s?qMHJq$uiWUtq@_1C{
zNbouNw>boNqv4ff&!M6)Q$!5LPUJ&WBt5irMSS0)b%{ink)g-$V(%?|2tXozK)*GU
zE)Ucf&-{(oF#SN7n%q+C&((i|)+ABgX#@lhSX%^g&>)mZUu}n{amF^tRPv7o@bT^%
zwn+6G)S6p>sDTT7FB_KQfrBrxTgMEp-XgoIYc0BrF7B^ofthG9qG#CemO|7d_t?)w
z0T))-K@nTua0;0BPlxs-T#cP{`6a~dh^NC2`s4wv=c2~LOvjR&0_HsF+Yp5Fv$;z1
zRsCiy)m7Zd*2tT^d86^Hz6Q<3N9kUF;PpdQK4Oj*n;4H_gh&UmI$vYLMp+Bxcdhyu
z4KBnBDVdpQros#14&PFryt=ADdmxUD(4%oWv=*KWWbl|jA;xoa#C1?5KSdc^e6*NH
z0addwfm6y_@<~y??luw8py(m0nJ<Ie+|v2r+<`|?7W*(ib(ZZl`qJu0gpZA*(hySm
zM>TJzEVhY~*P4<KO#?3lKV@`cIcGjlN!DYtYo&U^)ant<S}}kwLcRpfB={tS1A8UE
z$<eSPv3|NZwkwDRJZfdUe-qu#U6+Pds}Y38;WK*;?kABaY-8PEOkPFh#HISrT0xbw
zlLZK>rCi8#*9P^4YK+JrsKaFG+9FAd%BU-wlFb>s)bF!qtt<@iZ#a}4moI%LMZK`m
z^|)dI{p7m<p5Lv@Mw=QyTJM&XGRN7#QsSTXDLGR=WTZv~mrSSNy9;H|+lRU9p>70>
z<0vjX*2>j$i-j`yf_TvIq|iYFn#!of$=$yPR<|ispw1X6@m2pQFg(J}c!r3uw_+Nh
zD9T}9>tQZw|B^nrrTb->U)%?4--ANX$$BcnMrE7PgC|y>#jdzKVrQx-?2-&ex+BSw
zRh8C9=@xY|zphKO(6v$HLgccs`s|KeT!|#)xGKULNx5>3{p>!{(dzA@i%ZN_az*#&
zT6xebM&peVw1n}TkyKT;WqBKGO8&%`1{|lnOBTyxFA11BE{Zil`)jAQvS=Ze1OjJX
zIT-so=E8%8IG>Axxu?~|I6gZj<EHd#qR!spG-e0dibkjE(3~~JgJLu}Xvgc)1y;AU
zv<}{fu7{Aljo6Ts<#nOKbTub5BENQ|E@jADH_NpVBa;DE6sc-hKyItt)FgaC0*xDz
z>|1oES;L%Yk;{G|2;F_(%2#9BhyvigEV9_CcOL{UE$XCE&$PK|#9a9zpTt8lQ2SXi
zBkJ|&33G7X=O|;X0kUHX__knsWVhxf`)j+~Y8x&d&-3+ecyndp`ve>^XzD(6SMzAb
zkV5fXca+`C-b?TVj&7wvE|8GJT`9BY05ND<;IVlf?C=g>{zFq~htXow&FfCnsCll+
zo5nmtY(QIbMITq2kK<8_?5qLO#QrQE%HTjoQ6^7S2DKZ`UHM|Yk_@P2fTGnTQr|NL
zRkuU0^<Cll(32JI#QCzI4JobgIh`V3ih}!+o1D5S&_}gQ;Tu%Ani9e2WFn42EZ%#l
zs(fAD_+$Y9(YBp%b4J?ujL7r48;n$?h%x?`NW}<0?2}Ay%P6}Fj@%4Q<&s2l{Am}e
zqRk=I%#cSXWKBJ(E`z9_f|>v$oRr0RXrFV3?TGl{j)%o^=+-aIo<war9`l!>7eC1^
zDsnz-957J?jq$ma#%@VxyYxA*wR6K`Xjj7!C!zc~x+7jVMpwu>bPzgH%gKDzJ^FQ@
zSO0n20f80WN?yt@SLmhJWufJ6HXhMvK{_kJ{>Da@lKUb~kD5|*TWqBVv#x8dbA^4^
ziu^y45qWwH2c9!$+wwy7lWNpm2?B4YQKo0o?kTuWv-gn7Ox6-Vf833#L7EvHb&JkF
ze6xlvB;kVtDqYRSUtPN~zshd2l8}KDEv2(a4jHm-dLwhju{2rJi)+|`tN$k9u?@4&
zAXlI&x5*YWwbw+dR<<sIrE4@qvgijEt1Om2t>buC^u01$(^=7v-jq$HUTL>~hB&@A
zV?jjCP=}o)YRcZ^=dvc5z-LurkCjuye5qEc%nPv=pttZ?cgS?rAuA6!n!GZno@Ea2
zIPI;6Ql)9D6L6^q(rb*RNz=`qkt~)K<C_`PdaQTn=FRo|$Qkac*0RL<qw%z;KD<Hq
zteHgipJPLah{&^H@^>1$G^%60<4e=c{feFb>fM<M$3PCO{cQD$3M~h&HTCNM9>4{?
z`%%qB@pWgP963UwH#DdZFLmAocN)D`Z$^7mGKJbxooC{ADx|8VJhc14&e%+WHs88;
zw5X#!`3~!?e%0rKh$LD{XCh>WSHl2xLOj14dFMmEkaKg|3EYiMO>oa8x_FDsPUK`S
zCMV%~Ue9@%ky1bkQSxR*rZxxJg2#Jlb$zAsCS|{h;8!+(`sG&+eYb0a)L<td0~s>s
z0-q_pjtWG>bSr9=+;n-QtZNQDzA{IYS<k!;b<xB;H+!L!MjPiZKaS{I@3+cvX=GqX
z3`~M!b0@8AMk0T;zKbUY<btr?jVX-GHuf@Uonp<neDW5}#iG?AcTsZ4Z{s(N#~-^l
z+zOeMoioTOpQG<OdkeatRro7>S4=~mZ$}`yV#1kjvm~2sYQ{y4>pus)<3R)x1msCP
z-Sp(Zx-3{OqEO$RFS6OwW-jfa2r=3XPcjKbH$u#$<TvV;N%<SRMO}|3B6bERVpfZN
zY_+TWrE4pN4DaocNn4>^!!rUZ&{H_tmkgT=Q0$QCY8$_}tD3an(x!31U=y}OT#05b
zqkC>8%PX<;dl4%1B>N)9LA-T^C%3pX63S3zZjz^$=Z^{#7cC`G8YOMbu|!ZywIo4v
z_wDM!F!TK`TG)f#>PfJ7_r*R@iAX8my|M^TaZc%dVgf@zvzy14b{J4}Pyx63F+y(J
zzZ`vt>t@)7jJB~IA*|MvJwUa&ps;{7Iu%Kx=aVU(MyrPlQ#2B`IY_1{ETP7~g?UsV
zF_@*A(w^WaHV^F22x~CK*sFJ?#T9xF`uzHcmPm2?xLS9GOtsC?VxO%al%oL||4E_M
z4Z7;2b}pqfgqSmv{MtT$fns+Y_fCPooJe;&((!%dYfnJ|ZPs^R_q*RVMSZigvszCj
zGj?7374=fOZwu+%A~e_(__}d0<j4l~3=mNaa7_2XKQAzyt1?&EX>k>H%&6k!V5|8U
zYq~?1$HOCePPgQL3=F%6S#ekwq3dRi6$`Hr$5H<N4q9rRHg97C+x{jpc=b|0)qRgB
z0oEJ$rVqXdE38RJCLCAK5Ulk<45y$Fj=XuQsG3%V)aOk`F@WlS!6#GOEx~2Ziu?)l
zO+-LS+J0q(?divkT<S$y^<(Py=H2{cELLsMK>l3bmK}uWCW4w=gSg>YkZP{bt#(J&
zY!93i+r*@RkCBsRMx8it^aR<?mhYH}9_&@sI655FbudQSQ34}OZQGU7i+8IKs#e@7
zTz2ma|E^rSTqH30fB^u$umAwuU&^(k$sg6aNY%z}ogL|;T2GKtuTU9<)XWOUpgN@(
z0fW#YaF8y-JtSWuu}TF4K7!hC<oTMX`*d<O#NZ<?Zlq&>^KJvrCFsiTtB+I79asvw
zYmK6IJ?{h){Osi7PtN#}6nB4yQB&!=!-&ZnRM^>30&sJTl-AK%yNAbX_i$->wHU=g
zsP?WN5tlT>2t#K<DY3hebmWMs6tsOd?E`Evu`wJ`1=WW1JxZZx4`E7S2MrXAhRnpI
zIZ2}sjqYL1!0Rlrv)tcy5wI8&hcSuTtrHVb5*!*j<WX_?b3QPd;*yz_wRvD@(z4B)
z2ZxFkSt(lRVVHf;wik9rn!6JLgFpT5OSa|$ed&L_-x#C4bblxJ;Y&lFthOzl-DGXg
z+00|gFJ^lT9NPFkjq!^7#-p)96t<C5RM}HUzDtlzwlwX3_j?Fq!pPGQ2cq@u{_to(
z*=<NyXz7do6f@FWsYQB-onPAuze9u5BeQD*_-MYQnH@o3KeFa7MP56mFM)fM6iXcS
z`!=%2&xsfikl2#w>v`b>5)l;BmEo<_9tTX+nfu2(K)l5s$d`_S?7cxj_puukOG{KG
zh}Dgcc!!(ktFBhn9g-+dTk=gSj?Vf$P!rZ~3yQ5uznyq>!s2vY=Ich}zLeI+OIoc1
z!ti!UY4%LmAYi(`UGsZ&=WyFY9ccS@bM_n^JU*W;1<t&>@n_(dOX9Fh73_UJm!x2>
zH+lK5@dI|vXRnU?B+wVbb7cf5*C2$`@^>yac{l(G^Tm`$EFl<%4;#^^qClfb-)*{!
zuA#oV&mwb3`S2|=4OIhx<*#W8Y_SNI#u$zI2&{1D1T7&HM+w`faj~mcSNe+~#Uqd{
zgPpftulU?hgj~cqnw)QlYjg9FkYEF43_gCyLwH+5?%;f%Z1k4AMQHcG;Ofv-uM|N;
z8SCVQD2LF|g0cLVUXU@}sX-Iy1T)<D@Ja`lW)|Cqn4+o0vc&2`X4}pp=iJsYD<$|E
z$0yQvyDR(0<f-xs&n8@56vPeF*@-2!ln*EBYbp>B?9?C!2(2m2{Zm^C3%8V$ZB8=r
z(kKW{wPph7TUgPW%{?mm1TWE{=D=t23IyDP`31E?WLeP$&J|%!s&;keGS|6bSVH#;
zg=Y9&pk(=_a*>k0k*1H=2QSflRMMDsxx}4jG*1fKAR^OKM|oup08ZJ#n_(AuAcChF
z0<8uclEkc+Ri~{AJB5aCvWIoaLG3)2mIOJVT2*=~bSF`Ybavw&Jp@tAonz`Jl3q-C
zO^pOX%+H93riid(KxMuj8a3|=?=2r)hK$`PAM)@XwX7I=H13!a3Xv+>8OR4fSa+kd
zh?Y>Y93RIC^ghqFoAZhteNn1EhS(fzbdZ+1Q<ysrA5n=8e%u$Vd$>35<(ss{Lulnm
z%??QF!ONlRv*~h%6^)Iu9qV2j_-uLNInnqmx^p&$bWeGBL7q35L+~x9!3~cMsl9t3
zpYf~dly5Pl5TCH_W|Dc;uXM)M)FD~FA}5bO$>ttyiS7aXd!A~zMll=ulb=5R48*_k
zl(W0NiPN7{#TVUYIUoQha{Y=Ppp7?wgmpsHni|BeABGsbGf=Fm{iCVT++_5_o5SYR
zW$R}KdS?4_>;sQCF@-jPm~jD3p6#yN$>tem3tH`u)TCmD^IKc36<(X{yvHbi{hkfm
z!O@}*3Y<Q$b|qNY*wURmWcH#7!~EI|GzWU|CMUHdY+CU>X!DqS2%af)R(>#FXm!D!
zLBHzKS6pP?hExueZ`F6{weWlJx*w3oPRw}ap(gfrsjx3hyn8Tb?fBXhWrc%B-5~$I
zVj3#I6Yigt;`|v1|5~xVJN-Y_Y^<buBTGB}jZRTw;-{pF!~}yPls&vWBOA*B=-(`-
zqwW&$9TWgy{FCMJ{>ekfOwUNqL~m^2<V<H_Yih?JBPlHUO-WQoam;p|5vl8r27-&s
zFRq#Ex0tlEi1HUo?&{cj5iM(zS)?+Y=hvyxZ*ypjg!aiT(N1MV4OQ4(2DGln%VYSj
zfX7Q9uebLLL_7ARK2etMXLA8IcEwNU`YkPvfQOlku?xLjPBtS(9k9?bEPF`vS5xkE
zsDMCIui%C>UiwyV^9%D464n`F%z?2PlBn;Y_7>!U19+@k9ZT$CkXcs83E0A@Vb}VQ
z`@8)25LajG!<z#_b7`jfu3%?fO*@9d*GGVaTZ4K!0}=fZ*HoUln<e~<u`MifZ|GhY
zuq-}q!Yt%WZ8OAsw#cfxPJ+s7k`r3N>tjDrxgoN#FfT6$R5unlIAq#0-A<oUEmMh?
zG*I}KFkTh<E*@`JLq49L^I?gmtEaeP&5R$+Hn}j-1RIR4uo_mID;kamJuJm_ix-;&
z4Q_2)-<?5<bjfBwrU=x!n!L8*fESZ=j0Zz*8NL@XBG*9tEp}k$X5-Df-5v6?5{OIN
zl2$d?C=Rts_oxV|{fL#<wrFh<HysC#z0j@Db*?s$!SzNMLlSJytVl#hxGeQ&g$zvP
z81WQ)IBm8;u%~FauVI>WbZ$Esai^f90;)Q_a^_w_jWPKHy`fbZY`=C245zZT1-2b?
zb?#bec_sK91(epPVO5;yLH<naXapM)!;>HPp@x`pl%0GRu{To6;<vG5WnoRz@ZLSC
zT;}fa!6X>jA?y@)FzD&$2K8ns5rwGX>NEWe7;0pK5xq(ijkxGm+QxpfAo?U9z0Gk=
zk=~?As<<ZVyD){!Rt0*(R<$r17*Y5f`T&yqt%W^2B$Pgu!E%c<+HUx-^*w)iJ^(-@
zQE&aYq4>vB75<Db|IuUBBt%7JV5cQyCuiZM>8PiEPB$nrF0kx4%1uhsNzslm)c=W%
zF<J%2B^F==#Nlzui3i3xL?TAfkukXjRU%qav12f4u@)7YGS2zY;c?L!`H_kv$o~qS
ze@und>lBpy&v#J;F#v%7AEzQKsw^lXs4Uo};r)HS8Rv65M+i1W7}%812wc+!J*WJ_
zM>8Ycad~y`7-mEhuDZ?~zkxJ-W!BRp9&gk#sS2}xxhpU2v31}1^$gZ_kColw2~|yV
z)Nr&pU+{)`>NyTO&5YO_@7}>#`_R2IS-5$G`NyUKMU5_QJ+o?h#SUb*wnUO;D9(k7
zDZR?*ow~8GD+(qr>V><DD>;mAt+><cgDkiV9=hT!vz8c(!O<eAl<^0r+vK*2kOLk*
zogfqnFTRa9VxV_5Dwz~8ufL?8v6FFkte({W*>gV7*{n<(t#6)oNmB+~P1uzZMb~^P
zMELjFliy`hQT#D)(L-cl!pjrrctw20N|@nrOv>8LM*r|w#r}DoNPc0ml5k{>D2T;<
zlZ1HO`S!g7WyIM#_zek}8TFKt5NA}R2Kw}cY^LUk)w*uwXfnr8Ah%saos&`2<`*Nl
z7Y-4w(TS+zo1oN<0N3pH0fu6yM&9<)MO2N5pl>k-yP}nx>&M5u31oR(z;DWxV9RuK
z491!!Z~2(LW|DDv?|T-2Q=h|dXkRaHsN3T>L}jxKYg?JJ&@Nq696n5LzAw35lH?RO
z9-Q%KeBRxUzh2EkYr129NrUA~WTv!UH{A#9+*i!o(fla7z_Kj8&xk%J6`0A9WpQ)A
z4zeonOyJDAmB^XS7C;qcCg3`4Usj4ho$K)VRlR4)Rerj)wbc-G&E=@h9q^d@)UU6h
z>aj)EhMM+EBwJjFy)(UQ%i2fMC0VzM_eqS)F6i0^26_UW-?4W}C)+wsgg^3L`-XNg
zNWFif%PDqIVAhp%u~LoOYSB1Q>xR`TX5?Ja#{Th2l6Q<VLFp(Vx7#zNu7gEa-cit2
zOJL-JRjx$wunsy}=0oPwruAx*(CuCYtNu6nJh^H}aNbn;>L_wAb?mm;!Dj(vBT}%I
zwZSbXl#r{3JQldo2FiWMxvK!xgmutrpsB^Q?}EJ&uJV1y7sik-l6JPpESN?GC|m(`
zogfDZYS_&y?x(WRClm9vyV~h};$UJ?2YfT)CQ85T_05@UO;SWemq4{7EcOt!Fy5(r
z??=zdRpqe_r%7XLB;J;I9RB;Aj}!#xl}IE1%ZHxzSIoHLTb}8w<LCIawwbM8a`vsM
z48m(Lo5_&8GjP8fHA+Pm56&{@BI8v+ZWS2mK-T6|G^D^Wi8OQf>iQvQtZRj0(W`55
zTurCYE!;Cz-OENYtUKlVZ<rDyqTK}*SWM^3YXvXUG;r1X@`Et=3(5P0LfPzXaN6|C
zoL^Wa;?oZuprx@jC{#P73y&R<i{~unZTnd!;sgff0@`&d_DHHL^)SO9B25={jvqTE
zvN*QehblR~Mrim$SS-}>Z@RygV(u@9(FA7gX*U1F2p|JiC0)s7c`iCg>=AQ07eIJx
znykjtY7moB_Uqtk;bkJu1U}T{KDy01i4z_SS{s&=*)(Xt^5Mr))MY~!5jL$kZU5dK
zjIW<<%{MTr7wZn*XY+3Z)kV#w>z<<aA04aUo%i$U0;l{^_pJm-q5l38je}q+nR8_m
zehsq3EJ<-s*7IB~Q4fHC-^>x7U62Dacr{uVh2&PYRr>4-Trj&jy!9jbtu^9w4cF(L
z;6f`+>vN7o;{}KR@!?rjFD;cP)1XV{?3g7~d22Ej3BQy6tVObof<vvy6b)4jbXX{y
zH(}B?GiT`hi2pKQop573RV7bb(`bNdJ650@79cAkh>$^owi;p*ZEs>^=qE6>hy8ZG
zj`35dSI-RuQjW6#B`rQSBOOHK<@TV%ex%J_1*-gq!!S(uC?n838Aeu=b`y>~{))>a
zvQ6SBs-60<{S!@1fR!?MEv&T`rZFNqvwGS1I;na2;Km9MsbDgPQo+u7tJC2$^`j}Z
zet!NN$IdmXu7@GA&2@s}6H8H{qqB67|LVzG|Aef$H8l*Wz(z$}h=!rUNXBUqD{iLY
z0H;AirWFjoO_DI1XrZ=7Lz{MRX^16Rh+mjYr?Ce;4XcBQyHN9t%2i`Hqn;)VxmZ=0
zh5BsuYH0@6Ws+xsVvFKy31(--QmqId?_KdN?Q&6s3xp81G}tC6dT(ycJm5sUgGWp6
z+LlPO60)o5O+5S8V(Hf|siM0OMgNhNlS;}zjacX^b)@v8V63~tlACEmjBu7j2tN|2
zrnQVu5ZD<#lK3RPl~|?-j`=xsyl7a}7*MlndbbJi6tnv)P@h%xMUgp$J1nb`{oLBA
z*;R(s8pq=RbBkB@E5Qyiexx@xKGKwS8xc&t#SUvLm!an(?}~P)N{nX7gI@!A8O941
znqaDnQ>Yyo{yL;_C}eoS40TG5k)G*3K1>IUCSoTq0izYk$g6NXNmS(z^(oUyrst5Q
zX_c;0ibiENxH4Zi-S4QhC#W&BszB71bR+v^93cj72@*Hy$jV6=-i(ZE;QEr&k>UXx
z@!9wO$gTj4^~s4J$bxp7<OGE2en&mgnq5}Atr5IZm>{9~^Ql{|r0gkEbHBIG>K-^X
zc7!p5bN||sM(=KzktjnL4(DJcYis-piL<yP68Fg3OjF#Z!Q-i(jZMC(D@(oGg#s^c
z7s@R_H#S1{EIzgP(}ZEJBlDXmaU4o-e&2oOSRI3_#<D%BYM5+U@DEE1S(;hE^wH>q
zNPLO#cMA^sy|pl^Lc?RroLN^6y4C26>oo(t@llmu4m6K!lk8VU)GG2gf>VMfkFyp|
zaKXVr$r)4*0S?<?`7x$2TCXN|2vnI;qBs@Ki}UT=P7B&A+rrB(8R`_~j9~zCcNXrt
zUR7z#7yhQos}^j5-lzoM^@5^v0ebDZ;#AX;HnziHVXEnkpdHO4f<cev`4hew1%r!6
z<fWp6{i+>Z-<cTmhQgzOUnB>b<1k&3lfGNOI5Pa!Tt6GRO4%RF=%#n4m%DR=BI(2b
zRB)`YJhIB*)tYmFSS^h|w$qvpzFet%(yhB9$8?tR3Bib}smzgDNx2}2AgxfGhHc7^
zq98^!ZIfK3N~z6f`_o9GZH8H*O0P!rb|7qrRaQNK=Z&nwvc2!Uhqc1$laoAWdFf*<
zu{_^D!fvv3api;>Dbq0h@(lHDw}`;i<s9+**XI$(wG>H{`8g|SX^m5Fj8@8p<IN)P
z5`q~U-Fz;w7Upiam&42$9mIRzogm4aY59@$%pCz=V9B-hyo>+Q%J;9nOeJ<?+?@AL
zHs4S$q8a>sxJuOKsVw=|#RK5wM5d~)4GeDZ772{j*a*!11h1GFFAIe*h(s(MVIPSF
zgYmd31WP{u{K=f@JC#?ITW5TM`?jBwyyo)Vl9O$%qu1h1&0^ZYak;I3Z1b35udzhg
zi^%os%h5Z^Ns5zW%_1h(JKyR_Zth4h#z0RvYBXV0%HUCS$*NWtydoltpiR!a9))LV
zHHvUuJ_ROE5$h%eyk99}wUZT89eTZu-Q{_1`L^cNEftN9TIEs>bmJF<F9#kdRd4!%
z>}PziT1Z5bNc)s-I_RRZJ%W%AUXqR$uPXwEgfWQ(3>y-p4Knn8+>J(jUEqYLU`kXy
zX@ize+q&cL1cD!ZOU#J$^yg-hmi<(Y59X{Z(ai-Prt#qi)~p^_@cC7;i7qp=(wSo3
zmD{t9tY=yhDh&9B3ciR?KVgJ8fxZD^Ga$A)$v|#c3!L0<-lH)-T<#xdhj(53$0O6(
zm$6sYe62lBpXZPr@0&cnL7a_z%-s0iYreoorz|K~RM(Ln>jkC{xlbu)q7D(U;#<dp
z^)6KFhZYEfPlMK`cj!(C8{ItL9q7&)YjK|Yk)`u8>!woH7`Wb2Z3uCn{=B+5eyRG`
zcb}XeCmvW{y0H8B6C1SA@`u+<b~tL1YYufkl=LEy((OHpPMg~{VL#35vcEL=?4byM
zUAsg~9R@{ZX@NEgG!;lkx6-?#0;_H?BKqE3(D%L`ljuT=2q3%G^sB-ESh+Dh-2q{1
zzwoX6KEBpG4it3W&i)$Z+I-RWUB%buQ}BQkuyJ*Hl(b9%vhFN>m<@X=q1K}{V?>yb
zo|ADht7g~oP!TfE&;6_k`H(}^3GQ}w2lV>^S}HRS6nJGT%!*<Ul+h%2B?q}qBIdxL
zrf2i?xYk{c0h>bdd1Nb=c<C7a{9A?bP$?o){-^mm;7^JEk8=ON8nFLQd9ElbET<^q
zGQ$<0FAo6BbWZ=O`(g}Fo(lp3ZUQMuX`JBw>SzCwR%THm)7cA)Z+%Yv2^Y{gW`K0j
zjvn=hL^7&3($U39I_6t|O+Sg$<T9nOpO}HfWrX*#v&dq{VsjVfP-`}d_=I@YZy*zb
zNnwPvi(4NN?lteArORWxb|I|Zrjnt6VK}bVB=0qkmkYxfwQ-#@7uQL7TQv%Gb)~iP
zfyVr0KpK-FI&ak?GHW>Pj1AnoyKyms7GQMq38md(?B#$oi^4Q=HE~r}`mV}@`6f`+
zqJ%ra(VV6}CT*n_Tj^B;jOz7GwcUIV-YXHZ8agY;n?K9i{TU~8ZjtSgj~Um`{d5S8
zj9%6`GFBA>_^lME-%*3t9(jjM?4Hn^6Y&$;Ovx=BHKT2RRkwJ)SUuC4)GL2kh(m{Q
zR+%$3j=W3sedUA&VTJ+5v!FemkW#K;Mww)%g}I-PH`ZC*j#ZQG*h;?M=%vJ0y{wz<
zsA7-KPi#A^T)&Rjs!q;%{)v)nam^789rMMCOX68LPkY4ayrA{jybcFL!J&#Am|h&l
zQAuQv83?(v&mk`j0*VIw&u#X9Ui5!$h5r9I{GX=#zr+9DU;f`<0HDxc?2qgG5By)<
z=6^^3UE}`?4Z!*r`o9$aza#&yy8VSL{o||u^W1-GaDNB?UBLPaoc>3L`fu<*<*dJB
z|1Mhnh28rn_W#7l|43N>o9h3kCj5&EB$4ocrtyEM{!3f<JJH{@fWL?ci2f7NKb3*M
lbNxN)|Kjqe`%hf|ode{h!6E)}H}s!f^H0t&Vfe?{{{t3-h1385

literal 0
HcmV?d00001


From c853c4d08728f8e7fa6965e8508ed826b5461f04 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 11:23:48 +0200
Subject: [PATCH 1260/1353] configure: switch to ensuregroup

Using the new ensuregroup command, the desired versions of meson and
sphinx can be placed in pythondeps.toml rather than configure.

The meson.install entry in pythondeps.toml matches the version that is
found in python/wheels.  This ensures that mkvenv.py uses the bundled
wheel even if PyPI is enabled; thus not introducing warnings or errors
from versions that are more recent than the one used in CI.

The sphinx entries match what is shipped in Fedora 38.  It's the
last release that has support for older versions of Python (sphinx 6.0
requires Python 3.8) and especially docutils (of which sphinx 6.0 requires
version 0.18).  This is important because Ubuntu 20.04 has docutils 0.14
and Debian 11 has docutils 0.16.

"mkvenv.py ensure" is only used to bootstrap tomli.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure       | 14 ++++----------
 pythondeps.toml |  8 ++++++++
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/configure b/configure
index 347153702c..e4d42d640e 100755
--- a/configure
+++ b/configure
@@ -1024,13 +1024,8 @@ if $python -c 'import sys; sys.exit(sys.version_info >= (3,11))'; then
     $mkvenv ensure --dir "${source_path}/python/wheels" \
         'tomli>=1.2.0' || exit 1
 fi
-if ! $mkvenv ensure \
-     --dir "${source_path}/python/wheels" \
-     --diagnose "meson" \
-     "meson>=0.63.0" ;
-then
-    exit 1
-fi
+$mkvenv ensuregroup --dir "${source_path}/python/wheels" \
+     ${source_path}/pythondeps.toml meson || exit 1
 
 # At this point, we expect Meson to be installed and available.
 # We expect mkvenv or pip to have created pyvenv/bin/meson for us.
@@ -1047,10 +1042,9 @@ if test "$download" = "enabled" -a "$docs" = "enabled" ; then
 fi
 
 if test "$docs" != "disabled" ; then
-    if ! $mkvenv ensure \
+    if ! $mkvenv ensuregroup \
          $mkvenv_flags \
-         --diagnose "sphinx-build" \
-         "sphinx>=1.6.0" "sphinx-rtd-theme>=0.5.0";
+         ${source_path}/pythondeps.toml docs;
     then
         if test "$docs" = "enabled" ; then
             exit 1
diff --git a/pythondeps.toml b/pythondeps.toml
index 362f63ff2c..6be31dba30 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -15,3 +15,11 @@
 #           precise error diagnostics to the user.  For example,
 #           'sphinx-build' can be used as a bellwether for the
 #           presence of 'sphinx' in the system.
+
+[meson]
+# The install key should match the version in python/wheels/
+meson = { accepted = ">=0.63.0", installed = "0.63.3", canary = "meson" }
+
+[docs]
+sphinx = { accepted = ">=1.6", installed = "5.3.0", canary = "sphinx-build" }
+sphinx_rtd_theme = { accepted = ">=0.5", installed = "1.1.1" }

From c03f57fd5bf72588a05750f14202f63be7ddbd0c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 11:28:08 +0200
Subject: [PATCH 1261/1353] Revert "tests: Use separate virtual environment for
 avocado"

This reverts commit e8e4298feadae7924cf7600bb3bcc5b0a8d7cbe9.

ensuregroup allows to specify both the acceptable versions of avocado,
and a locked version to be used when avocado is not installed as a system
pacakge.  This lets us install avocado in pyvenv/ using "mkvenv.py" and
reuse the distro package on Fedora and CentOS Stream (the only distros
where it's available).

ensuregroup's usage of "(>=..., <=...)" constraints when evaluating
the distro package, and "==" constraints when installing it from PyPI,
makes it possible to avoid conflicts between the known-good version and
a package plugins included in the distro.

This is because package plugins have "==" constraints on the version
that is included in the distro, and, using "pip install avocado==88.1"
on a venv that includes system packages will result in an error:

   avocado-framework-plugin-varianter-yaml-to-mux 98.0 requires avocado-framework==98.0, but you have avocado-framework 88.1 which is incompatible.
   avocado-framework-plugin-result-html 98.0 requires avocado-framework==98.0, but you have avocado-framework 88.1 which is incompatible.

But at the same time, if the venv does not include a system distribution
of avocado then we can install a known-good version and stick to LTS
releases.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1663
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/buildtest.yml                    |  6 +++---
 docs/devel/acpi-bits.rst                      |  6 +++---
 docs/devel/testing.rst                        | 14 +++++++-------
 python/scripts/mkvenv.py                      | 13 +++++--------
 pythondeps.toml                               |  7 +++++++
 .../org.centos/stream/8/x86_64/test-avocado   |  4 ++--
 scripts/device-crash-test                     |  2 +-
 tests/Makefile.include                        | 19 ++++++++-----------
 tests/requirements.txt                        |  6 ------
 tests/vm/Makefile.include                     |  2 +-
 10 files changed, 37 insertions(+), 42 deletions(-)
 delete mode 100644 tests/requirements.txt

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 77dc83a6be..aee9101507 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -103,7 +103,7 @@ crash-test-debian:
   script:
     - cd build
     - make NINJA=":" check-venv
-    - tests/venv/bin/python3 scripts/device-crash-test -q --tcg-only ./qemu-system-i386
+    - pyvenv/bin/python3 scripts/device-crash-test -q --tcg-only ./qemu-system-i386
 
 build-system-fedora:
   extends:
@@ -146,8 +146,8 @@ crash-test-fedora:
   script:
     - cd build
     - make NINJA=":" check-venv
-    - tests/venv/bin/python3 scripts/device-crash-test -q ./qemu-system-ppc
-    - tests/venv/bin/python3 scripts/device-crash-test -q ./qemu-system-riscv32
+    - pyvenv/bin/python3 scripts/device-crash-test -q ./qemu-system-ppc
+    - pyvenv/bin/python3 scripts/device-crash-test -q ./qemu-system-riscv32
 
 build-system-centos:
   extends:
diff --git a/docs/devel/acpi-bits.rst b/docs/devel/acpi-bits.rst
index 22e2580200..9677b0098f 100644
--- a/docs/devel/acpi-bits.rst
+++ b/docs/devel/acpi-bits.rst
@@ -61,19 +61,19 @@ Under ``tests/avocado/`` as the root we have:
    ::
 
      $ make check-venv (needed only the first time to create the venv)
-     $ ./tests/venv/bin/avocado run -t acpi tests/avocado
+     $ ./pyvenv/bin/avocado run -t acpi tests/avocado
 
    The above will run all acpi avocado tests including this one.
    In order to run the individual tests, perform the following:
    ::
 
-     $ ./tests/venv/bin/avocado run tests/avocado/acpi-bits.py --tap -
+     $ ./pyvenv/bin/avocado run tests/avocado/acpi-bits.py --tap -
 
    The above will produce output in tap format. You can omit "--tap -" in the
    end and it will produce output like the following:
    ::
 
-      $ ./tests/venv/bin/avocado run tests/avocado/acpi-bits.py
+      $ ./pyvenv/bin/avocado run tests/avocado/acpi-bits.py
       Fetching asset from tests/avocado/acpi-bits.py:AcpiBitsTest.test_acpi_smbios_bits
       JOB ID     : eab225724da7b64c012c65705dc2fa14ab1defef
       JOB LOG    : /home/anisinha/avocado/job-results/job-2022-10-10T17.58-eab2257/job.log
diff --git a/docs/devel/testing.rst b/docs/devel/testing.rst
index b6ad21bed1..5d1fc0aa95 100644
--- a/docs/devel/testing.rst
+++ b/docs/devel/testing.rst
@@ -894,9 +894,9 @@ You can run the avocado tests simply by executing:
 
   make check-avocado
 
-This involves the automatic creation of Python virtual environment
-within the build tree (at ``tests/venv``) which will have all the
-right dependencies, and will save tests results also within the
+This involves the automatic installation, from PyPI, of all the
+necessary avocado-framework dependencies into the QEMU venv within the
+build tree (at ``./pyvenv``). Test results are also saved within the
 build tree (at ``tests/results``).
 
 Note: the build environment must be using a Python 3 stack, and have
@@ -953,7 +953,7 @@ may be invoked by running:
 
  .. code::
 
-  tests/venv/bin/avocado run $OPTION1 $OPTION2 tests/avocado/
+  pyvenv/bin/avocado run $OPTION1 $OPTION2 tests/avocado/
 
 Note that if ``make check-avocado`` was not executed before, it is
 possible to create the Python virtual environment with the dependencies
@@ -968,20 +968,20 @@ a test file. To run tests from a single file within the build tree, use:
 
  .. code::
 
-  tests/venv/bin/avocado run tests/avocado/$TESTFILE
+  pyvenv/bin/avocado run tests/avocado/$TESTFILE
 
 To run a single test within a test file, use:
 
  .. code::
 
-  tests/venv/bin/avocado run tests/avocado/$TESTFILE:$TESTCLASS.$TESTNAME
+  pyvenv/bin/avocado run tests/avocado/$TESTFILE:$TESTCLASS.$TESTNAME
 
 Valid test names are visible in the output from any previous execution
 of Avocado or ``make check-avocado``, and can also be queried using:
 
  .. code::
 
-  tests/venv/bin/avocado list tests/avocado
+  pyvenv/bin/avocado list tests/avocado
 
 Manual Installation
 ~~~~~~~~~~~~~~~~~~~
diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index 02bcd9a8c9..4f2349fbb6 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -964,14 +964,11 @@ def _parse_groups(file: str) -> Dict[str, Dict[str, Any]]:
             "Python >=3.11 does not have tomllib... what have you done!?"
         )
 
-    try:
-        # Use loads() to support both tomli v1.2.x (Ubuntu 22.04,
-        # Debian bullseye-backports) and v2.0.x
-        with open(file, "r", encoding="ascii") as depfile:
-            contents = depfile.read()
-            return tomllib.loads(contents)  # type: ignore
-    except tomllib.TOMLDecodeError as exc:
-        raise Ouch(f"parsing {file} failed: {exc}") from exc
+    # Use loads() to support both tomli v1.2.x (Ubuntu 22.04,
+    # Debian bullseye-backports) and v2.0.x
+    with open(file, "r", encoding="ascii") as depfile:
+        contents = depfile.read()
+        return tomllib.loads(contents)  # type: ignore
 
 
 def ensure_group(
diff --git a/pythondeps.toml b/pythondeps.toml
index 6be31dba30..0a35ebcf9f 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -23,3 +23,10 @@ meson = { accepted = ">=0.63.0", installed = "0.63.3", canary = "meson" }
 [docs]
 sphinx = { accepted = ">=1.6", installed = "5.3.0", canary = "sphinx-build" }
 sphinx_rtd_theme = { accepted = ">=0.5", installed = "1.1.1" }
+
+[avocado]
+# Note that qemu.git/python/ is always implicitly installed.
+# Prefer an LTS version when updating the accepted versions of
+# avocado-framework, for example right now the limit is 92.x.
+avocado-framework = { accepted = "(>=88.1, <93.0)", installed = "88.1", canary = "avocado" }
+pycdlib = { accepted = ">=1.11.0" }
diff --git a/scripts/ci/org.centos/stream/8/x86_64/test-avocado b/scripts/ci/org.centos/stream/8/x86_64/test-avocado
index e0443fc8ae..73e7a1a312 100755
--- a/scripts/ci/org.centos/stream/8/x86_64/test-avocado
+++ b/scripts/ci/org.centos/stream/8/x86_64/test-avocado
@@ -4,7 +4,7 @@
 # KVM and x86_64, or tests that are generic enough to be valid for all
 # targets. Such a test list can be generated with:
 #
-# ./tests/venv/bin/avocado list --filter-by-tags-include-empty \
+# ./pyvenv/bin/avocado list --filter-by-tags-include-empty \
 #   --filter-by-tags-include-empty-key -t accel:kvm,arch:x86_64 \
 #   tests/avocado/
 #
@@ -22,7 +22,7 @@
 #   - tests/avocado/virtio_check_params.py:VirtioMaxSegSettingsCheck.test_machine_types
 #
 make get-vm-images
-./tests/venv/bin/avocado run \
+./pyvenv/bin/avocado run \
     --job-results-dir=tests/results/ \
     tests/avocado/boot_linux.py:BootLinuxX8664.test_pc_i440fx_kvm \
     tests/avocado/boot_linux.py:BootLinuxX8664.test_pc_q35_kvm \
diff --git a/scripts/device-crash-test b/scripts/device-crash-test
index b74d887331..353aa575d7 100755
--- a/scripts/device-crash-test
+++ b/scripts/device-crash-test
@@ -43,7 +43,7 @@ except ModuleNotFoundError as exc:
     print(f"Module '{exc.name}' not found.")
     print("  Try 'make check-venv' from your build directory,")
     print("  and then one way to run this script is like so:")
-    print(f'  > $builddir/tests/venv/bin/python3 "{path}"')
+    print(f'  > $builddir/pyvenv/bin/python3 "{path}"')
     sys.exit(1)
 
 logger = logging.getLogger('device-crash-test')
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 9422ddaece..985cda7a94 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -89,10 +89,8 @@ distclean-tcg: $(DISTCLEAN_TCG_TARGET_RULES)
 # Build up our target list from the filtered list of ninja targets
 TARGETS=$(patsubst libqemu-%.fa, %, $(filter libqemu-%.fa, $(ninja-targets)))
 
-TESTS_VENV_DIR=$(BUILD_DIR)/tests/venv
-TESTS_VENV_REQ=$(SRC_PATH)/tests/requirements.txt
+TESTS_VENV_TOKEN=$(BUILD_DIR)/pyvenv/tests.group
 TESTS_RESULTS_DIR=$(BUILD_DIR)/tests/results
-TESTS_PYTHON=$(TESTS_VENV_DIR)/bin/python3
 ifndef AVOCADO_TESTS
 	AVOCADO_TESTS=tests/avocado
 endif
@@ -108,20 +106,19 @@ else
 endif
 
 quiet-venv-pip = $(quiet-@)$(call quiet-command-run, \
-    $(TESTS_PYTHON) -m pip -q --disable-pip-version-check $1, \
+    $(PYTHON) -m pip -q --disable-pip-version-check $1, \
     "VENVPIP","$1")
 
-$(TESTS_VENV_DIR): $(TESTS_VENV_REQ)
-	$(call quiet-command, $(PYTHON) -m venv $@, VENV, $@)
+$(TESTS_VENV_TOKEN): $(SRC_PATH)/pythondeps.toml
 	$(call quiet-venv-pip,install -e "$(SRC_PATH)/python/")
-	$(call quiet-venv-pip,install -r $(TESTS_VENV_REQ))
+	$(PYTHON) python/scripts/mkvenv.py ensuregroup --online $< avocado
 	$(call quiet-command, touch $@)
 
 $(TESTS_RESULTS_DIR):
 	$(call quiet-command, mkdir -p $@, \
             MKDIR, $@)
 
-check-venv: $(TESTS_VENV_DIR)
+check-venv: $(TESTS_VENV_TOKEN)
 
 FEDORA_31_ARCHES_TARGETS=$(patsubst %-softmmu,%, $(filter %-softmmu,$(TARGETS)))
 FEDORA_31_ARCHES_CANDIDATES=$(patsubst ppc64,ppc64le,$(FEDORA_31_ARCHES_TARGETS))
@@ -131,7 +128,7 @@ FEDORA_31_DOWNLOAD=$(filter $(FEDORA_31_ARCHES),$(FEDORA_31_ARCHES_CANDIDATES))
 # download one specific Fedora 31 image
 get-vm-image-fedora-31-%: check-venv
 	$(call quiet-command, \
-             $(TESTS_PYTHON) -m avocado vmimage get \
+             $(PYTHON) -m avocado vmimage get \
              --distro=fedora --distro-version=31 --arch=$*, \
 	"AVOCADO", "Downloading avocado tests VM image for $*")
 
@@ -140,7 +137,7 @@ get-vm-images: check-venv $(patsubst %,get-vm-image-fedora-31-%, $(FEDORA_31_DOW
 
 check-avocado: check-venv $(TESTS_RESULTS_DIR) get-vm-images
 	$(call quiet-command, \
-            $(TESTS_PYTHON) -m avocado \
+            $(PYTHON) -m avocado \
             --show=$(AVOCADO_SHOW) run --job-results-dir=$(TESTS_RESULTS_DIR) \
             $(if $(AVOCADO_TAGS),, --filter-by-tags-include-empty \
 			--filter-by-tags-include-empty-key) \
@@ -163,7 +160,7 @@ check:
 check-build: run-ninja
 
 check-clean:
-	rm -rf $(TESTS_VENV_DIR) $(TESTS_RESULTS_DIR)
+	rm -rf $(TESTS_RESULTS_DIR)
 
 clean: check-clean clean-tcg
 distclean: distclean-tcg
diff --git a/tests/requirements.txt b/tests/requirements.txt
deleted file mode 100644
index 0ba561b6bd..0000000000
--- a/tests/requirements.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-# Add Python module requirements, one per line, to be installed
-# in the tests/venv Python virtual environment. For more info,
-# refer to: https://pip.pypa.io/en/stable/user_guide/#id1
-# Note that qemu.git/python/ is always implicitly installed.
-avocado-framework==88.1
-pycdlib==1.11.0
diff --git a/tests/vm/Makefile.include b/tests/vm/Makefile.include
index c2a8ca1c17..f0f5d32fb0 100644
--- a/tests/vm/Makefile.include
+++ b/tests/vm/Makefile.include
@@ -5,7 +5,7 @@ ifeq ($(realpath $(SRC_PATH)),$(realpath .))
 VM_PYTHON = PYTHONPATH=$(SRC_PATH)/python /usr/bin/env python3
 VM_VENV =
 else
-VM_PYTHON = $(TESTS_PYTHON)
+VM_PYTHON = $(PYTHON)
 VM_VENV = check-venv
 endif
 

From 7ace219303e28cc67852e1d193437cd1f367b5c8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 8 Aug 2023 23:35:47 +0200
Subject: [PATCH 1262/1353] tests/docker: add python3-tomli dependency to
 containers

Instead of having CI pick tomli from the vendored wheel at configure
time, place it in the containers.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/cirrus/freebsd-13.vars              |  2 +-
 .gitlab-ci.d/cirrus/macos-12.vars                |  2 +-
 tests/docker/dockerfiles/centos8.docker          |  3 ++-
 .../dockerfiles/debian-all-test-cross.docker     |  7 ++++++-
 .../docker/dockerfiles/debian-amd64-cross.docker |  4 ++++
 tests/docker/dockerfiles/debian-amd64.docker     |  4 ++++
 .../docker/dockerfiles/debian-arm64-cross.docker |  4 ++++
 .../docker/dockerfiles/debian-armel-cross.docker |  4 ++++
 .../docker/dockerfiles/debian-armhf-cross.docker |  4 ++++
 .../dockerfiles/debian-hexagon-cross.docker      |  6 +++++-
 .../dockerfiles/debian-mips64el-cross.docker     |  4 ++++
 .../dockerfiles/debian-mipsel-cross.docker       |  4 ++++
 .../dockerfiles/debian-ppc64el-cross.docker      |  4 ++++
 .../docker/dockerfiles/debian-s390x-cross.docker |  4 ++++
 .../dockerfiles/debian-tricore-cross.docker      |  2 ++
 .../docker/dockerfiles/fedora-i386-cross.docker  |  1 +
 tests/docker/dockerfiles/ubuntu2004.docker       |  4 +++-
 tests/docker/dockerfiles/ubuntu2204.docker       |  1 +
 tests/lcitool/mappings.yml                       | 16 ++++++++++++++++
 tests/lcitool/projects/qemu.yml                  |  1 +
 tests/vm/generated/freebsd.json                  |  1 +
 21 files changed, 76 insertions(+), 6 deletions(-)

diff --git a/.gitlab-ci.d/cirrus/freebsd-13.vars b/.gitlab-ci.d/cirrus/freebsd-13.vars
index facb649f5b..3785afca36 100644
--- a/.gitlab-ci.d/cirrus/freebsd-13.vars
+++ b/.gitlab-ci.d/cirrus/freebsd-13.vars
@@ -11,6 +11,6 @@ MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='pkg'
 PIP3='/usr/local/bin/pip-3.8'
-PKGS='alsa-lib bash bison bzip2 ca_root_nss capstone4 ccache cmocka ctags curl cyrus-sasl dbus diffutils dtc flex fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 json-c libepoxy libffi libgcrypt libjpeg-turbo libnfs libslirp libspice-server libssh libtasn1 llvm lzo2 meson mtools ncurses nettle ninja opencv pixman pkgconf png py39-numpy py39-pillow py39-pip py39-sphinx py39-sphinx_rtd_theme py39-yaml python3 rpm2cpio sdl2 sdl2_image snappy sndio socat spice-protocol tesseract usbredir virglrenderer vte3 xorriso zstd'
+PKGS='alsa-lib bash bison bzip2 ca_root_nss capstone4 ccache cmocka ctags curl cyrus-sasl dbus diffutils dtc flex fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 json-c libepoxy libffi libgcrypt libjpeg-turbo libnfs libslirp libspice-server libssh libtasn1 llvm lzo2 meson mtools ncurses nettle ninja opencv pixman pkgconf png py39-numpy py39-pillow py39-pip py39-sphinx py39-sphinx_rtd_theme py39-tomli py39-yaml python3 rpm2cpio sdl2 sdl2_image snappy sndio socat spice-protocol tesseract usbredir virglrenderer vte3 xorriso zstd'
 PYPI_PKGS=''
 PYTHON='/usr/local/bin/python3'
diff --git a/.gitlab-ci.d/cirrus/macos-12.vars b/.gitlab-ci.d/cirrus/macos-12.vars
index ceb294e153..80eadaab29 100644
--- a/.gitlab-ci.d/cirrus/macos-12.vars
+++ b/.gitlab-ci.d/cirrus/macos-12.vars
@@ -12,5 +12,5 @@ NINJA='/opt/homebrew/bin/ninja'
 PACKAGING_COMMAND='brew'
 PIP3='/opt/homebrew/bin/pip3'
 PKGS='bash bc bison bzip2 capstone ccache cmocka ctags curl dbus diffutils dtc flex gcovr gettext git glib gnu-sed gnutls gtk+3 jemalloc jpeg-turbo json-c libepoxy libffi libgcrypt libiscsi libnfs libpng libslirp libssh libtasn1 libusb llvm lzo make meson mtools ncurses nettle ninja pixman pkg-config python3 rpm2cpio sdl2 sdl2_image snappy socat sparse spice-protocol tesseract usbredir vde vte3 xorriso zlib zstd'
-PYPI_PKGS='PyYAML numpy pillow sphinx sphinx-rtd-theme'
+PYPI_PKGS='PyYAML numpy pillow sphinx sphinx-rtd-theme tomli'
 PYTHON='/opt/homebrew/bin/python3'
diff --git a/tests/docker/dockerfiles/centos8.docker b/tests/docker/dockerfiles/centos8.docker
index da7dc818fb..fc1830966f 100644
--- a/tests/docker/dockerfiles/centos8.docker
+++ b/tests/docker/dockerfiles/centos8.docker
@@ -133,7 +133,8 @@ RUN /usr/bin/pip3.8 install \
                     meson==0.63.2 \
                     pillow \
                     sphinx \
-                    sphinx-rtd-theme
+                    sphinx-rtd-theme \
+                    tomli
 
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
diff --git a/tests/docker/dockerfiles/debian-all-test-cross.docker b/tests/docker/dockerfiles/debian-all-test-cross.docker
index f9f401544a..54e957d5e7 100644
--- a/tests/docker/dockerfiles/debian-all-test-cross.docker
+++ b/tests/docker/dockerfiles/debian-all-test-cross.docker
@@ -58,7 +58,12 @@ RUN DEBIAN_FRONTEND=noninteractive eatmydata \
         libc6-dev-sh4-cross \
         gcc-sparc64-linux-gnu \
         libc6-dev-sparc64-cross \
-        python3-venv
+        python3-pip \
+        python3-setuptools \
+        python3-venv \
+        python3-wheel
+
+RUN /usr/bin/pip3 install tomli
 
 ENV QEMU_CONFIGURE_OPTS --disable-system --disable-docs --disable-tools
 ENV DEF_TARGET_LIST aarch64-linux-user,alpha-linux-user,arm-linux-user,hppa-linux-user,i386-linux-user,m68k-linux-user,mips-linux-user,mips64-linux-user,mips64el-linux-user,mipsel-linux-user,ppc-linux-user,ppc64-linux-user,ppc64le-linux-user,riscv64-linux-user,s390x-linux-user,sh4-linux-user,sparc64-linux-user
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index b9871f9c8c..b66b9cc191 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-amd64.docker b/tests/docker/dockerfiles/debian-amd64.docker
index 6d2fa38e3e..02262bc70e 100644
--- a/tests/docker/dockerfiles/debian-amd64.docker
+++ b/tests/docker/dockerfiles/debian-amd64.docker
@@ -115,9 +115,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -143,6 +145,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/g++ && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 3504c771a7..a0a968b8c6 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-armel-cross.docker b/tests/docker/dockerfiles/debian-armel-cross.docker
index 6d11c9510f..f1fc34a28a 100644
--- a/tests/docker/dockerfiles/debian-armel-cross.docker
+++ b/tests/docker/dockerfiles/debian-armel-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 37ae575cf7..a278578211 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-hexagon-cross.docker b/tests/docker/dockerfiles/debian-hexagon-cross.docker
index c2cfb6a5d0..153fc7cfb3 100644
--- a/tests/docker/dockerfiles/debian-hexagon-cross.docker
+++ b/tests/docker/dockerfiles/debian-hexagon-cross.docker
@@ -21,11 +21,15 @@ RUN apt-get update && \
         flex \
         git \
         ninja-build \
-        python3-venv && \
+        python3-pip \
+        python3-setuptools \
+        python3-venv \
+        python3-wheel && \
 # Install QEMU build deps for use in CI
     DEBIAN_FRONTEND=noninteractive eatmydata \
     apt build-dep -yy --arch-only qemu
 
+RUN /usr/bin/pip3 install tomli
 
 ENV TOOLCHAIN_INSTALL /opt
 ENV TOOLCHAIN_RELEASE 16.0.0
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 26ed730165..17d3e01ecc 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index ade2f37ed1..5fcd641f15 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 08dcffa0a8..30e5efa986 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 48a2c10fdb..ee6db7b526 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -47,9 +47,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       sed \
@@ -65,6 +67,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
     dpkg-reconfigure locales
 
+RUN /usr/bin/pip3 install tomli
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-tricore-cross.docker b/tests/docker/dockerfiles/debian-tricore-cross.docker
index 5bd1963fb5..c597f8e16b 100644
--- a/tests/docker/dockerfiles/debian-tricore-cross.docker
+++ b/tests/docker/dockerfiles/debian-tricore-cross.docker
@@ -36,6 +36,8 @@ RUN apt update && \
        python3-wheel \
        python3-venv
 
+RUN /usr/bin/pip3 install tomli
+
 RUN curl -#SL https://github.com/bkoppelmann/package_940/releases/download/tricore-toolchain-9.40/tricore-toolchain-9.4.0.tar.gz \
     | tar -xzC /usr/local/
 
diff --git a/tests/docker/dockerfiles/fedora-i386-cross.docker b/tests/docker/dockerfiles/fedora-i386-cross.docker
index 14c1fb2c93..b59a9115c4 100644
--- a/tests/docker/dockerfiles/fedora-i386-cross.docker
+++ b/tests/docker/dockerfiles/fedora-i386-cross.docker
@@ -24,6 +24,7 @@ ENV PACKAGES \
     nettle-devel.i686 \
     pcre-devel.i686 \
     pixman-devel.i686 \
+    python3-tomli \
     sysprof-capture-devel.i686 \
     zlib-devel.i686
 
diff --git a/tests/docker/dockerfiles/ubuntu2004.docker b/tests/docker/dockerfiles/ubuntu2004.docker
index 8f864d19e6..4180cd8674 100644
--- a/tests/docker/dockerfiles/ubuntu2004.docker
+++ b/tests/docker/dockerfiles/ubuntu2004.docker
@@ -141,7 +141,9 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/g++ && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
-RUN /usr/bin/pip3 install meson==0.63.2
+RUN /usr/bin/pip3 install \
+                            meson==0.63.2 \
+                            tomli
 
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 8f939870ae..88493f00f6 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -117,6 +117,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-pip \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-yaml \
                       rpm2cpio \
diff --git a/tests/lcitool/mappings.yml b/tests/lcitool/mappings.yml
index 3c554099ed..0b908882f1 100644
--- a/tests/lcitool/mappings.yml
+++ b/tests/lcitool/mappings.yml
@@ -59,6 +59,15 @@ mappings:
     CentOSStream8:
     OpenSUSELeap15:
 
+  python3-tomli:
+    # test using tomllib
+    apk:
+    Fedora:
+    Debian12:
+    OpenSUSELeap15:
+    # Not available for Python 3.8
+    CentOSStream8:
+
   python3-venv:
     CentOSStream8: python38
     OpenSUSELeap15: python311-base
@@ -75,3 +84,10 @@ pypi_mappings:
   # Drop packages that need devel headers
   python3-numpy:
     OpenSUSELeap15:
+
+  # see above
+  python3-tomli:
+    apk:
+    Fedora:
+    Debian12:
+    OpenSUSELeap15:
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index 2d31cf792a..584f78cb7f 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -96,6 +96,7 @@ packages:
  - python3-pip
  - python3-sphinx
  - python3-sphinx-rtd-theme
+ - python3-tomli
  - python3-venv
  - rpm2cpio
  - sdl2
diff --git a/tests/vm/generated/freebsd.json b/tests/vm/generated/freebsd.json
index 7c435cf23e..2d5895ebed 100644
--- a/tests/vm/generated/freebsd.json
+++ b/tests/vm/generated/freebsd.json
@@ -56,6 +56,7 @@
     "py39-pip",
     "py39-sphinx",
     "py39-sphinx_rtd_theme",
+    "py39-tomli",
     "py39-yaml",
     "python3",
     "rpm2cpio",

From 33cc88261c352445d31599054653d759f20531c1 Mon Sep 17 00:00:00 2001
From: Ake Koomsin <ake@igel.co.jp>
Date: Mon, 7 Aug 2023 18:33:40 +0900
Subject: [PATCH 1263/1353] target/i386: add support for
 VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE

Current QEMU can expose waitpkg to guests when it is available. However,
VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE is still not recognized and
masked by QEMU. This can lead to an unexpected situation when a L1
hypervisor wants to expose waitpkg to a L2 guest. The L1 hypervisor can
assume that VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE exists as waitpkg is
available. The L1 hypervisor then can accidentally expose waitpkg to the
L2 guest. This will cause invalid opcode exception in the L2 guest when
it executes waitpkg related instructions.

This patch adds VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE support, and
sets up dependency between the bit and CPUID_7_0_ECX_WAITPKG. QEMU should
not expose waitpkg feature if VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE is
not available to avoid unexpected invalid opcode exception in L2 guests.

Signed-off-by: Ake Koomsin <ake@igel.co.jp>
Message-ID: <20230807093339.32091-2-ake@igel.co.jp>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 6 +++++-
 target/i386/cpu.h | 1 +
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 97ad229d8b..00f913b638 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1228,7 +1228,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
             "vmx-invpcid-exit", "vmx-vmfunc", "vmx-shadow-vmcs", "vmx-encls-exit",
             "vmx-rdseed-exit", "vmx-pml", NULL, NULL,
             "vmx-xsaves", NULL, NULL, NULL,
-            NULL, "vmx-tsc-scaling", NULL, NULL,
+            NULL, "vmx-tsc-scaling", "vmx-enable-user-wait-pause", NULL,
             NULL, NULL, NULL, NULL,
         },
         .msr = {
@@ -1545,6 +1545,10 @@ static FeatureDep feature_dependencies[] = {
         .from = { FEAT_8000_0001_ECX,       CPUID_EXT3_SVM },
         .to = { FEAT_SVM,                   ~0ull },
     },
+    {
+        .from = { FEAT_VMX_SECONDARY_CTLS,  VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE },
+        .to = { FEAT_7_0_ECX,               CPUID_7_0_ECX_WAITPKG },
+    },
 };
 
 typedef struct X86RegisterInfo32 {
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index e0771a1043..a6000e93bd 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1111,6 +1111,7 @@ uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 #define VMX_SECONDARY_EXEC_ENABLE_PML               0x00020000
 #define VMX_SECONDARY_EXEC_XSAVES                   0x00100000
 #define VMX_SECONDARY_EXEC_TSC_SCALING              0x02000000
+#define VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE   0x04000000
 
 #define VMX_PIN_BASED_EXT_INTR_MASK                 0x00000001
 #define VMX_PIN_BASED_NMI_EXITING                   0x00000008

From a04f33727cea092dc71be32745e8964f62fb8104 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 7 Aug 2023 11:22:08 +0200
Subject: [PATCH 1264/1353] configure: fix container_hosts misspellings and
 duplications

container_hosts is matched against $cpu, so it must contain QEMU
canonical architecture names, not Debian architecture names.
Also do not set $container_hosts inside the loop, since it is
already set before.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/configure b/configure
index e4d42d640e..08bf24b689 100755
--- a/configure
+++ b/configure
@@ -1352,7 +1352,7 @@ probe_target_compiler() {
     sh4) container_hosts=x86_64 ;;
     sparc64) container_hosts=x86_64 ;;
     tricore) container_hosts=x86_64 ;;
-    x86_64) container_hosts="aarch64 ppc64el x86_64" ;;
+    x86_64) container_hosts="aarch64 ppc64le x86_64" ;;
     xtensa*) container_hosts=x86_64 ;;
   esac
 
@@ -1459,7 +1459,6 @@ probe_target_compiler() {
         container_cross_prefix=x86_64-linux-gnu-
         ;;
       xtensa*)
-        container_hosts=x86_64
         container_image=debian-xtensa-cross
 
         # default to the dc232b cpu

From 29a8238510df27080b0ffa92c58400412ce19daa Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 7 Aug 2023 14:17:43 +0200
Subject: [PATCH 1265/1353] configure: remove unnecessary mkdir -p

It is already included in the symlink shell function.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure | 1 -
 1 file changed, 1 deletion(-)

diff --git a/configure b/configure
index 08bf24b689..b9bd008592 100755
--- a/configure
+++ b/configure
@@ -1775,7 +1775,6 @@ fi
 for target in $target_list; do
     target_dir="$target"
     target_name=$(echo $target | cut -d '-' -f 1)$EXESUF
-    mkdir -p "$target_dir"
     case $target in
         *-user) symlink "../qemu-$target_name" "$target_dir/qemu-$target_name" ;;
         *) symlink "../qemu-system-$target_name" "$target_dir/qemu-system-$target_name" ;;

From 935f1dd8181b757e6eff83522d85b0a2b84c27c5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 18 Aug 2023 10:57:34 -0700
Subject: [PATCH 1266/1353] bsd-user: Remove ELF_START_MMAP and
 image_info.start_mmap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The start_mmap value is write-only.
Remove the field and the defines that populated it.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230818175736.144194-2-richard.henderson@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/arm/target_arch_elf.h    | 1 -
 bsd-user/elfload.c                | 1 -
 bsd-user/i386/target_arch_elf.h   | 1 -
 bsd-user/qemu.h                   | 1 -
 bsd-user/x86_64/target_arch_elf.h | 1 -
 5 files changed, 5 deletions(-)

diff --git a/bsd-user/arm/target_arch_elf.h b/bsd-user/arm/target_arch_elf.h
index 935bce347f..b1c0fd2b32 100644
--- a/bsd-user/arm/target_arch_elf.h
+++ b/bsd-user/arm/target_arch_elf.h
@@ -20,7 +20,6 @@
 #ifndef TARGET_ARCH_ELF_H
 #define TARGET_ARCH_ELF_H
 
-#define ELF_START_MMAP 0x80000000
 #define ELF_ET_DYN_LOAD_ADDR    0x500000
 
 #define elf_check_arch(x) ((x) == EM_ARM)
diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index 1f650bdde8..38a3439d2c 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -738,7 +738,6 @@ int load_elf_binary(struct bsd_binprm *bprm, struct target_pt_regs *regs,
     /* OK, This is the point of no return */
     info->end_data = 0;
     info->end_code = 0;
-    info->start_mmap = (abi_ulong)ELF_START_MMAP;
     info->mmap = 0;
     elf_entry = (abi_ulong) elf_ex.e_entry;
 
diff --git a/bsd-user/i386/target_arch_elf.h b/bsd-user/i386/target_arch_elf.h
index cbcd1f08e2..4ac27b02e7 100644
--- a/bsd-user/i386/target_arch_elf.h
+++ b/bsd-user/i386/target_arch_elf.h
@@ -20,7 +20,6 @@
 #ifndef TARGET_ARCH_ELF_H
 #define TARGET_ARCH_ELF_H
 
-#define ELF_START_MMAP 0x80000000
 #define ELF_ET_DYN_LOAD_ADDR    0x01001000
 #define elf_check_arch(x) (((x) == EM_386) || ((x) == EM_486))
 
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 8f2d6a3c78..178114b423 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -52,7 +52,6 @@ struct image_info {
     abi_ulong end_data;
     abi_ulong start_brk;
     abi_ulong brk;
-    abi_ulong start_mmap;
     abi_ulong mmap;
     abi_ulong rss;
     abi_ulong start_stack;
diff --git a/bsd-user/x86_64/target_arch_elf.h b/bsd-user/x86_64/target_arch_elf.h
index b244711888..e51c2faf08 100644
--- a/bsd-user/x86_64/target_arch_elf.h
+++ b/bsd-user/x86_64/target_arch_elf.h
@@ -20,7 +20,6 @@
 #ifndef TARGET_ARCH_ELF_H
 #define TARGET_ARCH_ELF_H
 
-#define ELF_START_MMAP 0x2aaaaab000ULL
 #define ELF_ET_DYN_LOAD_ADDR    0x01021000
 #define elf_check_arch(x) (((x) == ELF_ARCH))
 

From 7db1873664dcba22820981ad105b0d30bcd509b8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 18 Aug 2023 10:57:35 -0700
Subject: [PATCH 1267/1353] bsd-user: Remove image_info.mmap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This value is unused.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230818175736.144194-3-richard.henderson@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/elfload.c | 1 -
 bsd-user/qemu.h    | 1 -
 2 files changed, 2 deletions(-)

diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index 38a3439d2c..2d39e59258 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -738,7 +738,6 @@ int load_elf_binary(struct bsd_binprm *bprm, struct target_pt_regs *regs,
     /* OK, This is the point of no return */
     info->end_data = 0;
     info->end_code = 0;
-    info->mmap = 0;
     elf_entry = (abi_ulong) elf_ex.e_entry;
 
     /* XXX Join this with PT_INTERP search? */
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 178114b423..898fe3e8b3 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -52,7 +52,6 @@ struct image_info {
     abi_ulong end_data;
     abi_ulong start_brk;
     abi_ulong brk;
-    abi_ulong mmap;
     abi_ulong rss;
     abi_ulong start_stack;
     abi_ulong entry;

From 4436e2ff6cae585f4863fa59a3ad77dd3c54ac63 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 18 Aug 2023 10:57:36 -0700
Subject: [PATCH 1268/1353] bsd-user: Remove image_info.start_brk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This has the same value is image_info.brk, which is also logged,
and is otherwise unused.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230818175736.144194-4-richard.henderson@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/elfload.c | 2 +-
 bsd-user/main.c    | 2 --
 bsd-user/qemu.h    | 1 -
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index 2d39e59258..baf2f63d2f 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -811,7 +811,7 @@ int load_elf_binary(struct bsd_binprm *bprm, struct target_pt_regs *regs,
                                        bprm->stringp, &elf_ex, load_addr,
                                        et_dyn_addr, interp_load_addr, info);
     info->load_addr = reloc_func_desc;
-    info->start_brk = info->brk = elf_brk;
+    info->brk = elf_brk;
     info->start_stack = bprm->p;
     info->load_bias = 0;
 
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 381bb18df8..f913cb55a7 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -553,8 +553,6 @@ int main(int argc, char **argv)
             fprintf(f, "page layout changed following binary load\n");
             page_dump(f);
 
-            fprintf(f, "start_brk   0x" TARGET_ABI_FMT_lx "\n",
-                    info->start_brk);
             fprintf(f, "end_code    0x" TARGET_ABI_FMT_lx "\n",
                     info->end_code);
             fprintf(f, "start_code  0x" TARGET_ABI_FMT_lx "\n",
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 898fe3e8b3..61501c321b 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -50,7 +50,6 @@ struct image_info {
     abi_ulong end_code;
     abi_ulong start_data;
     abi_ulong end_data;
-    abi_ulong start_brk;
     abi_ulong brk;
     abi_ulong rss;
     abi_ulong start_stack;

From 25e2cfbb8e621a4a726040427f14dca68f78bd1b Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:22 +0200
Subject: [PATCH 1269/1353] bsd-user: Move _WANT_FREEBSD macros to
 include/qemu/osdep.h

move _WANT_FREEBSD macros from bsd-user/freebsd/os-syscall.c to
include/qemu/osdep.h in order to pull some struct defintions needed
later in the build.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/freebsd/os-syscall.c | 11 -----------
 include/qemu/osdep.h          | 13 +++++++++++++
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/bsd-user/freebsd/os-syscall.c b/bsd-user/freebsd/os-syscall.c
index de36c4b71c..2224a280ea 100644
--- a/bsd-user/freebsd/os-syscall.c
+++ b/bsd-user/freebsd/os-syscall.c
@@ -17,17 +17,6 @@
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
-
-/*
- * We need the FreeBSD "legacy" definitions. Rust needs the FreeBSD 11 system
- * calls since it doesn't use libc at all, so we have to emulate that despite
- * FreeBSD 11 being EOL'd.
- */
-#define _WANT_FREEBSD11_STAT
-#define _WANT_FREEBSD11_STATFS
-#define _WANT_FREEBSD11_DIRENT
-#define _WANT_KERNEL_ERRNO
-#define _WANT_SEMUN
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
 #include "qemu/path.h"
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 21ef8f1699..2cae135280 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -88,6 +88,19 @@ QEMU_EXTERN_C int daemon(int, int);
 #define __USE_MINGW_ANSI_STDIO 1
 #endif
 
+/*
+ * We need the FreeBSD "legacy" definitions. Rust needs the FreeBSD 11 system
+ * calls since it doesn't use libc at all, so we have to emulate that despite
+ * FreeBSD 11 being EOL'd.
+ */
+#ifdef __FreeBSD__
+#define _WANT_FREEBSD11_STAT
+#define _WANT_FREEBSD11_STATFS
+#define _WANT_FREEBSD11_DIRENT
+#define _WANT_KERNEL_ERRNO
+#define _WANT_SEMUN
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdbool.h>

From 15b950ecd16ecc6e9a1f21e1f9f185ee61a5a1d5 Mon Sep 17 00:00:00 2001
From: Kyle Evans <kevans@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:23 +0200
Subject: [PATCH 1270/1353] bsd-user: Disable clang warnings

Implement PRAGMA_DISABLE_PACKED_WARNING and
PRAGMA_REENABLE_PACKED_WARNING macros in include/qemu/compiler.h.

Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 include/qemu/compiler.h | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index a309f90c76..b037442518 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -22,6 +22,36 @@
 #define QEMU_EXTERN_C extern
 #endif
 
+/*
+ * Tricky points:
+ * - Use __builtin_choose_expr to avoid type promotion from ?:,
+ * - Invalid sizes result in a compile time error stemming from
+ *   the fact that abort has no parameters.
+ * - It's easier to use the endian-specific unaligned load/store
+ *   functions than host-endian unaligned load/store plus tswapN.
+ * - The pragmas are necessary only to silence a clang false-positive
+ *   warning: see https://bugs.llvm.org/show_bug.cgi?id=39113 .
+ * - We have to disable -Wpragmas warnings to avoid a complaint about
+ *   an unknown warning type from older compilers that don't know about
+ *   -Waddress-of-packed-member.
+ * - gcc has bugs in its _Pragma() support in some versions, eg
+ *   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 -- so we only
+ *   include the warning-suppression pragmas for clang
+ */
+#ifdef __clang__
+#define PRAGMA_DISABLE_PACKED_WARNING                                   \
+    _Pragma("GCC diagnostic push");                                     \
+    _Pragma("GCC diagnostic ignored \"-Wpragmas\"");                    \
+    _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"")
+
+#define PRAGMA_REENABLE_PACKED_WARNING          \
+    _Pragma("GCC diagnostic pop")
+
+#else
+#define PRAGMA_DISABLE_PACKED_WARNING
+#define PRAGMA_REENABLE_PACKED_WARNING
+#endif
+
 #if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
 # define QEMU_PACKED __attribute__((gcc_struct, packed))
 #else

From 6538c682db9c2b34fbffc22e111a4bcd8f4b02de Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:24 +0200
Subject: [PATCH 1271/1353] bsd-user; Update the definitions of __put_user and
 __get_user macros

Use __builtin_choose_expr to avoid type promotion from ?:
in __put_user_e and __get_user_e macros.
Copied from linux-user/qemu.h, originally by Blue Swirl.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/qemu.h   | 81 ++++++++++++++++++++---------------------------
 bsd-user/signal.c |  5 +--
 2 files changed, 35 insertions(+), 51 deletions(-)

diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 61501c321b..ca791e18b2 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -272,50 +272,37 @@ static inline bool access_ok(int type, abi_ulong addr, abi_ulong size)
  * These are usually used to access struct data members once the struct has been
  * locked - usually with lock_user_struct().
  */
-#define __put_user(x, hptr)\
-({\
-    int size = sizeof(*hptr);\
-    switch (size) {\
-    case 1:\
-        *(uint8_t *)(hptr) = (uint8_t)(typeof(*hptr))(x);\
-        break;\
-    case 2:\
-        *(uint16_t *)(hptr) = tswap16((typeof(*hptr))(x));\
-        break;\
-    case 4:\
-        *(uint32_t *)(hptr) = tswap32((typeof(*hptr))(x));\
-        break;\
-    case 8:\
-        *(uint64_t *)(hptr) = tswap64((typeof(*hptr))(x));\
-        break;\
-    default:\
-        abort();\
-    } \
-    0;\
-})
+#define __put_user_e(x, hptr, e)                                            \
+    do {                                                                    \
+        PRAGMA_DISABLE_PACKED_WARNING;                                      \
+        (__builtin_choose_expr(sizeof(*(hptr)) == 1, stb_p,                 \
+        __builtin_choose_expr(sizeof(*(hptr)) == 2, stw_##e##_p,            \
+        __builtin_choose_expr(sizeof(*(hptr)) == 4, stl_##e##_p,            \
+        __builtin_choose_expr(sizeof(*(hptr)) == 8, stq_##e##_p, abort))))  \
+            ((hptr), (x)), (void)0);                                        \
+        PRAGMA_REENABLE_PACKED_WARNING;                                     \
+    } while (0)
 
-#define __get_user(x, hptr) \
-({\
-    int size = sizeof(*hptr);\
-    switch (size) {\
-    case 1:\
-        x = (typeof(*hptr))*(uint8_t *)(hptr);\
-        break;\
-    case 2:\
-        x = (typeof(*hptr))tswap16(*(uint16_t *)(hptr));\
-        break;\
-    case 4:\
-        x = (typeof(*hptr))tswap32(*(uint32_t *)(hptr));\
-        break;\
-    case 8:\
-        x = (typeof(*hptr))tswap64(*(uint64_t *)(hptr));\
-        break;\
-    default:\
-        x = 0;\
-        abort();\
-    } \
-    0;\
-})
+#define __get_user_e(x, hptr, e)                                            \
+    do {                                                                    \
+        PRAGMA_DISABLE_PACKED_WARNING;                                      \
+        ((x) = (typeof(*hptr))(                                             \
+        __builtin_choose_expr(sizeof(*(hptr)) == 1, ldub_p,                 \
+        __builtin_choose_expr(sizeof(*(hptr)) == 2, lduw_##e##_p,           \
+        __builtin_choose_expr(sizeof(*(hptr)) == 4, ldl_##e##_p,            \
+        __builtin_choose_expr(sizeof(*(hptr)) == 8, ldq_##e##_p, abort))))  \
+            (hptr)), (void)0);                                              \
+        PRAGMA_REENABLE_PACKED_WARNING;                                     \
+    } while (0)
+
+
+#if TARGET_BIG_ENDIAN
+# define __put_user(x, hptr)  __put_user_e(x, hptr, be)
+# define __get_user(x, hptr)  __get_user_e(x, hptr, be)
+#else
+# define __put_user(x, hptr)  __put_user_e(x, hptr, le)
+# define __get_user(x, hptr)  __get_user_e(x, hptr, le)
+#endif
 
 /*
  * put_user()/get_user() take a guest address and check access
@@ -328,10 +315,10 @@ static inline bool access_ok(int type, abi_ulong addr, abi_ulong size)
 ({                                                                      \
     abi_ulong __gaddr = (gaddr);                                        \
     target_type *__hptr;                                                \
-    abi_long __ret;                                                     \
+    abi_long __ret = 0;                                                 \
     __hptr = lock_user(VERIFY_WRITE, __gaddr, sizeof(target_type), 0);  \
     if (__hptr) {                                                       \
-        __ret = __put_user((x), __hptr);                                \
+        __put_user((x), __hptr);                                        \
         unlock_user(__hptr, __gaddr, sizeof(target_type));              \
     } else                                                              \
         __ret = -TARGET_EFAULT;                                         \
@@ -342,10 +329,10 @@ static inline bool access_ok(int type, abi_ulong addr, abi_ulong size)
 ({                                                                      \
     abi_ulong __gaddr = (gaddr);                                        \
     target_type *__hptr;                                                \
-    abi_long __ret;                                                     \
+    abi_long __ret = 0;                                                 \
     __hptr = lock_user(VERIFY_READ, __gaddr, sizeof(target_type), 1);   \
     if (__hptr) {                                                       \
-        __ret = __get_user((x), __hptr);                                \
+        __get_user((x), __hptr);                                        \
         unlock_user(__hptr, __gaddr, 0);                                \
     } else {                                                            \
         (x) = 0;                                                        \
diff --git a/bsd-user/signal.c b/bsd-user/signal.c
index f4e078ee1d..4db85a3485 100644
--- a/bsd-user/signal.c
+++ b/bsd-user/signal.c
@@ -787,10 +787,7 @@ static int reset_signal_mask(target_ucontext_t *ucontext)
     TaskState *ts = (TaskState *)thread_cpu->opaque;
 
     for (i = 0; i < TARGET_NSIG_WORDS; i++) {
-        if (__get_user(target_set.__bits[i],
-                    &ucontext->uc_sigmask.__bits[i])) {
-            return -TARGET_EFAULT;
-        }
+        __get_user(target_set.__bits[i], &ucontext->uc_sigmask.__bits[i]);
     }
     target_to_host_sigset_internal(&blocked, &target_set);
     ts->signal_mask = blocked;

From 9b4a902d3164b60ea732cca7405fcd2d083b784e Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:25 +0200
Subject: [PATCH 1272/1353] bsd-user: Declarations of h2t and t2h conversion
 functions.

Declarations of functions that convert between host and target structs.

Co-authored-by: Michal Meloun <mmel@FreeBSD.org>

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/qemu-os.h | 50 ++++++++++++++++++++++++++++++++++++++
 bsd-user/qemu.h            |  1 +
 2 files changed, 51 insertions(+)
 create mode 100644 bsd-user/freebsd/qemu-os.h

diff --git a/bsd-user/freebsd/qemu-os.h b/bsd-user/freebsd/qemu-os.h
new file mode 100644
index 0000000000..12adc50928
--- /dev/null
+++ b/bsd-user/freebsd/qemu-os.h
@@ -0,0 +1,50 @@
+/*
+ *  FreeBSD conversion extern declarations
+ *
+ *  Copyright (c) 2013 Stacey D. Son
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef QEMU_OS_H
+#define QEMU_OS_H
+
+/* qemu/osdep.h pulls in the rest */
+
+#include <sys/acl.h>
+#include <sys/mount.h>
+#include <sys/timex.h>
+#include <sys/rtprio.h>
+#include <sys/select.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+struct freebsd11_stat;
+
+/* os-stat.c */
+abi_long h2t_freebsd11_stat(abi_ulong target_addr,
+        struct freebsd11_stat *host_st);
+abi_long h2t_freebsd11_nstat(abi_ulong target_addr,
+        struct freebsd11_stat *host_st);
+abi_long t2h_freebsd_fhandle(fhandle_t *host_fh, abi_ulong target_addr);
+abi_long h2t_freebsd_fhandle(abi_ulong target_addr, fhandle_t *host_fh);
+abi_long h2t_freebsd11_statfs(abi_ulong target_addr,
+    struct freebsd11_statfs *host_statfs);
+abi_long target_to_host_fcntl_cmd(int cmd);
+abi_long h2t_freebsd_stat(abi_ulong target_addr,
+        struct stat *host_st);
+abi_long h2t_freebsd_statfs(abi_ulong target_addr,
+    struct statfs *host_statfs);
+
+#endif /* QEMU_OS_H */
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index ca791e18b2..4cfd5c6337 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -38,6 +38,7 @@ extern char **environ;
 #include "exec/gdbstub.h"
 #include "qemu/clang-tsa.h"
 
+#include "qemu-os.h"
 /*
  * This struct is used to hold certain information about the image.  Basically,
  * it replicates in user space what would be certain task_struct fields in the

From 40f5e2983407e51e00e0fc82ff59c1ed55001530 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:26 +0200
Subject: [PATCH 1273/1353] bsd-user: Add struct target_freebsd11_stat to
 bsd-user/syscall_defs

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Singed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/syscall_defs.h | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index aedfbf2d7d..56198cc6a0 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -179,6 +179,39 @@ struct target_freebsd__wrusage {
     struct target_freebsd_rusage wru_children;
 };
 
+/*
+ * sys/stat.h
+ */
+struct target_freebsd11_stat {
+    uint32_t  st_dev;       /* inode's device */
+    uint32_t  st_ino;       /* inode's number */
+    int16_t   st_mode;      /* inode protection mode */
+    int16_t   st_nlink;     /* number of hard links */
+    uint32_t  st_uid;       /* user ID of the file's owner */
+    uint32_t  st_gid;       /* group ID of the file's group */
+    uint32_t  st_rdev;      /* device type */
+    struct  target_freebsd_timespec st_atim; /* time last accessed */
+    struct  target_freebsd_timespec st_mtim; /* time last data modification */
+    struct  target_freebsd_timespec st_ctim; /* time last file status change */
+    int64_t    st_size;     /* file size, in bytes */
+    int64_t    st_blocks;   /* blocks allocated for file */
+    uint32_t   st_blksize;  /* optimal blocksize for I/O */
+    uint32_t   st_flags;    /* user defined flags for file */
+    uint32_t   st_gen;      /* file generation number */
+    int32_t    st_lspare;
+    struct target_freebsd_timespec st_birthtim; /* time of file creation */
+    /*
+     * Explicitly pad st_birthtim to 16 bytes so that the size of
+     * struct stat is backwards compatible.  We use bitfields instead
+     * of an array of chars so that this doesn't require a C99 compiler
+     * to compile if the size of the padding is 0.  We use 2 bitfields
+     * to cover up to 64 bits on 32-bit machines.  We assume that
+     * CHAR_BIT is 8...
+     */
+    unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
+    unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
+} __packed;
+
 #define safe_syscall0(type, name) \
 type safe_##name(void) \
 { \

From ad805a77592a1765515c70be225ec3097c954e5c Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:27 +0200
Subject: [PATCH 1274/1353] bsd-user: Add struct target_stat to
 bsd-user/syscall_defs.h

Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Acked-by:  Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/syscall_defs.h | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index 56198cc6a0..bd04b30a56 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -212,6 +212,44 @@ struct target_freebsd11_stat {
     unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
 } __packed;
 
+#if defined(__i386__)
+#define TARGET_HAS_STAT_TIME_T_EXT       1
+#endif
+
+struct target_stat {
+    uint64_t  st_dev;               /* inode's device */
+    uint64_t  st_ino;               /* inode's number */
+    uint64_t  st_nlink;             /* number of hard links */
+    int16_t   st_mode;              /* inode protection mode */
+    int16_t   st_padding0;
+    uint32_t  st_uid;               /* user ID of the file's owner */
+    uint32_t  st_gid;               /* group ID of the file's group */
+    int32_t   st_padding1;
+    uint64_t  st_rdev;              /* device type */
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+    int32_t   st_atim_ext;
+#endif
+    struct  target_freebsd_timespec st_atim; /* time of last access */
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+    int32_t   st_mtim_ext;
+#endif
+    struct  target_freebsd_timespec st_mtim; /* time of last data modification */
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+    int32_t st_ctim_ext;
+#endif
+    struct  target_freebsd_timespec st_ctim;/* time of last file status change */
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+    int32_t st_btim_ext;
+#endif
+    struct  target_freebsd_timespec st_birthtim;   /* time of file creation */
+    int64_t   st_size;              /* file size, in bytes */
+    int64_t   st_blocks;            /* blocks allocated for file */
+    uint32_t  st_blksize;           /* optimal blocksize for I/O */
+    uint32_t  st_flags;             /* user defined flags for file */
+    uint64_t  st_gen;               /* file generation number */
+    uint64_t  st_spare[10];
+};
+
 #define safe_syscall0(type, name) \
 type safe_##name(void) \
 { \

From 1de075a0f6c6aa0ab54cef4fae902d4c0e95effa Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:28 +0200
Subject: [PATCH 1275/1353] bsd-user: Add structs
 target_freebsd11_{nstat,statfs}

Add structs target_freebsd11_nstat and target_freebsd11_statfs to
bsd-user/syscall_defs.h

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/syscall_defs.h | 64 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index bd04b30a56..51d8ff0dd8 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -250,6 +250,70 @@ struct target_stat {
     uint64_t  st_spare[10];
 };
 
+
+/* struct nstat is the same as stat above but without the st_lspare field */
+struct target_freebsd11_nstat {
+    uint32_t  st_dev;       /* inode's device */
+    uint32_t  st_ino;       /* inode's number */
+    int16_t   st_mode;      /* inode protection mode */
+    int16_t   st_nlink;     /* number of hard links */
+    uint32_t  st_uid;       /* user ID of the file's owner */
+    uint32_t  st_gid;       /* group ID of the file's group */
+    uint32_t  st_rdev;      /* device type */
+    struct  target_freebsd_timespec st_atim; /* time last accessed */
+    struct  target_freebsd_timespec st_mtim; /* time last data modification */
+    struct  target_freebsd_timespec st_ctim; /* time last file status change */
+    int64_t    st_size;     /* file size, in bytes */
+    int64_t    st_blocks;   /* blocks allocated for file */
+    uint32_t   st_blksize;  /* optimal blocksize for I/O */
+    uint32_t   st_flags;    /* user defined flags for file */
+    uint32_t   st_gen;      /* file generation number */
+    struct target_freebsd_timespec st_birthtim; /* time of file creation */
+    /*
+     * Explicitly pad st_birthtim to 16 bytes so that the size of
+     * struct stat is backwards compatible.  We use bitfields instead
+     * of an array of chars so that this doesn't require a C99 compiler
+     * to compile if the size of the padding is 0.  We use 2 bitfields
+     * to cover up to 64 bits on 32-bit machines.  We assume that
+     * CHAR_BIT is 8...
+     */
+    unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
+    unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
+} __packed;
+
+/*
+ * sys/mount.h
+ */
+
+/* filesystem id type */
+typedef struct target_freebsd_fsid { int32_t val[2]; } target_freebsd_fsid_t;
+
+/* filesystem statistics */
+struct target_freebsd11_statfs {
+    uint32_t f_version; /* structure version number */
+    uint32_t f_type;    /* type of filesystem */
+    uint64_t f_flags;   /* copy of mount exported flags */
+    uint64_t f_bsize;   /* filesystem fragment size */
+    uint64_t f_iosize;  /* optimal transfer block size */
+    uint64_t f_blocks;  /* total data blocks in filesystem */
+    uint64_t f_bfree;   /* free blocks in filesystem */
+    int64_t  f_bavail;  /* free blocks avail to non-superuser */
+    uint64_t f_files;   /* total file nodes in filesystem */
+    int64_t  f_ffree;   /* free nodes avail to non-superuser */
+    uint64_t f_syncwrites;  /* count of sync writes since mount */
+    uint64_t f_asyncwrites; /* count of async writes since mount */
+    uint64_t f_syncreads;   /* count of sync reads since mount */
+    uint64_t f_asyncreads;  /* count of async reads since mount */
+    uint64_t f_spare[10];   /* unused spare */
+    uint32_t f_namemax; /* maximum filename length */
+    uint32_t f_owner;   /* user that mounted the filesystem */
+    target_freebsd_fsid_t   f_fsid; /* filesystem id */
+    char     f_charspare[80];           /* spare string space */
+    char     f_fstypename[16];   /* filesys type name */
+    char     f_mntfromname[88];    /* mount filesystem */
+    char     f_mntonname[88];      /* dir on which mounted*/
+};
+
 #define safe_syscall0(type, name) \
 type safe_##name(void) \
 { \

From 25efcda41f107f124019f338ae929a694ec6191e Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:29 +0200
Subject: [PATCH 1276/1353] bsd-user: Add struct target_statfs

Add struct target_statfs to bsd-user/syscall_defs.h

Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/syscall_defs.h | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index 51d8ff0dd8..499a80f8bf 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -314,6 +314,31 @@ struct target_freebsd11_statfs {
     char     f_mntonname[88];      /* dir on which mounted*/
 };
 
+struct target_statfs {
+    uint32_t f_version;             /* structure version number */
+    uint32_t f_type;                /* type of filesystem */
+    uint64_t f_flags;               /* copy of mount exported flags */
+    uint64_t f_bsize;               /* filesystem fragment size */
+    uint64_t f_iosize;              /* optimal transfer block size */
+    uint64_t f_blocks;              /* total data blocks in filesystem */
+    uint64_t f_bfree;               /* free blocks in filesystem */
+    int64_t  f_bavail;              /* free blocks avail to non-superuser */
+    uint64_t f_files;               /* total file nodes in filesystem */
+    int64_t  f_ffree;               /* free nodes avail to non-superuser */
+    uint64_t f_syncwrites;          /* count of sync writes since mount */
+    uint64_t f_asyncwrites;         /* count of async writes since mount */
+    uint64_t f_syncreads;           /* count of sync reads since mount */
+    uint64_t f_asyncreads;          /* count of async reads since mount */
+    uint64_t f_spare[10];           /* unused spare */
+    uint32_t f_namemax;             /* maximum filename length */
+    uint32_t f_owner;               /* user that mounted the filesystem */
+    target_freebsd_fsid_t f_fsid;   /* filesystem id */
+    char      f_charspare[80];      /* spare string space */
+    char      f_fstypename[16];     /* filesystem type name */
+    char      f_mntfromname[1024];  /* mounted filesystem */
+    char      f_mntonname[1024];    /* directory on which mounted */
+};
+
 #define safe_syscall0(type, name) \
 type safe_##name(void) \
 { \

From 54d07b44aa534277d72fa570498bd379c06d9a40 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:30 +0200
Subject: [PATCH 1277/1353] bsd-user: Add struct target_freebsd_fhandle and
 fcntl flags

Add struct target_freebsd_fhandle and fcntl flags to
bsd-user/syscall_defs.h

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/syscall_defs.h | 51 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index 499a80f8bf..96ae90b063 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -339,6 +339,57 @@ struct target_statfs {
     char      f_mntonname[1024];    /* directory on which mounted */
 };
 
+/* File identifier. These are unique per filesystem on a single machine. */
+#define TARGET_MAXFIDSZ     16
+
+struct target_freebsd_fid {
+    uint16_t    fid_len;            /* len of data in bytes */
+    uint16_t    fid_data0;          /* force longword align */
+    char        fid_data[TARGET_MAXFIDSZ];  /* data (variable len) */
+};
+
+/* Generic file handle */
+struct target_freebsd_fhandle {
+    target_freebsd_fsid_t   fh_fsid;    /* Filesystem id of mount point */
+    struct target_freebsd_fid fh_fid;   /* Filesys specific id */
+};
+typedef struct target_freebsd_fhandle target_freebsd_fhandle_t;
+
+/*
+ * sys/fcntl.h
+ */
+#define TARGET_F_DUPFD              0
+#define TARGET_F_GETFD              1
+#define TARGET_F_SETFD              2
+#define TARGET_F_GETFL              3
+#define TARGET_F_SETFL              4
+#define TARGET_F_GETOWN             5
+#define TARGET_F_SETOWN             6
+#define TARGET_F_OGETLK             7
+#define TARGET_F_OSETLK             8
+#define TARGET_F_OSETLKW            9
+#define TARGET_F_DUP2FD             10
+#define TARGET_F_GETLK              11
+#define TARGET_F_SETLK              12
+#define TARGET_F_SETLKW             13
+#define TARGET_F_SETLK_REMOTE       14
+#define TARGET_F_READAHEAD          15
+#define TARGET_F_RDAHEAD            16
+#define TARGET_F_DUPFD_CLOEXEC     17
+#define TARGET_F_DUP2FD_CLOEXEC    18
+/* FreeBSD-specific */
+#define TARGET_F_ADD_SEALS          19
+#define TARGET_F_GET_SEALS          20
+
+struct target_freebsd_flock {
+    int64_t l_start;
+    int64_t l_len;
+    int32_t l_pid;
+    int16_t l_type;
+    int16_t l_whence;
+    int32_t l_sysid;
+} QEMU_PACKED;
+
 #define safe_syscall0(type, name) \
 type safe_##name(void) \
 { \

From 243c725fe7489b15aa441a20b0298035481da2f9 Mon Sep 17 00:00:00 2001
From: Kyle Evans <kevans@FreeBSD.org>
Date: Sat, 19 Aug 2023 20:23:27 -0600
Subject: [PATCH 1278/1353] bsd-user: Define safe_fcntl macro in
 bsd-user/syscall_defs.h

Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/syscall_defs.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index 96ae90b063..c6699c9943 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -437,6 +437,8 @@ type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
     return safe_syscall(SYS_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
 }
 
+#define safe_fcntl(...) safe_syscall(SYS_fcntl, __VA_ARGS__)
+
 /* So far all target and host bitmasks are the same */
 #undef  target_to_host_bitmask
 #define target_to_host_bitmask(x, tbl) (x)

From a0c20b1b36576042d1c2789f92b42043f48409c4 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:32 +0200
Subject: [PATCH 1279/1353] bsd-user: Rename target_freebsd_time_t to
 target_time_t

This is necessary for future code using target_time_t, in
bsd-user/syscall_defs.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/syscall_defs.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index c6699c9943..9c90616baa 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -45,9 +45,9 @@
  *
  */
 #if (!defined(TARGET_I386))
-typedef int64_t target_freebsd_time_t;
+typedef int64_t target_time_t;
 #else
-typedef int32_t target_freebsd_time_t;
+typedef int32_t target_time_t;
 #endif
 
 struct target_iovec {
@@ -102,7 +102,7 @@ typedef abi_long target_freebsd_suseconds_t;
 
 /* compare to sys/timespec.h */
 struct target_freebsd_timespec {
-    target_freebsd_time_t   tv_sec;     /* seconds */
+    target_time_t   tv_sec;     /* seconds */
     abi_long                tv_nsec;    /* and nanoseconds */
 #if !defined(TARGET_I386) && TARGET_ABI_BITS == 32
     abi_long _pad;
@@ -120,7 +120,7 @@ struct target_freebsd__umtx_time {
 };
 
 struct target_freebsd_timeval {
-    target_freebsd_time_t       tv_sec; /* seconds */
+    target_time_t       tv_sec; /* seconds */
     target_freebsd_suseconds_t  tv_usec;/* and microseconds */
 #if !defined(TARGET_I386) && TARGET_ABI_BITS == 32
     abi_long _pad;

From 86547e577bdfe55f32778a052b82227599233067 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:33 +0200
Subject: [PATCH 1280/1353] bsd-user: Implement h2t_freebsd11_stat
 h2t_freebsd_nstat

Implement the stat conversion functions:
h2t_freebsd11_stat
h2t_freebsd_nstat

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.c | 94 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 bsd-user/freebsd/os-stat.c

diff --git a/bsd-user/freebsd/os-stat.c b/bsd-user/freebsd/os-stat.c
new file mode 100644
index 0000000000..8c73f7402c
--- /dev/null
+++ b/bsd-user/freebsd/os-stat.c
@@ -0,0 +1,94 @@
+/*
+ *  FreeBSD stat related conversion routines
+ *
+ *  Copyright (c) 2013 Stacey D. Son
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#include "qemu/osdep.h"
+
+#include "qemu.h"
+
+/*
+ * stat conversion
+ */
+abi_long h2t_freebsd11_stat(abi_ulong target_addr,
+        struct freebsd11_stat *host_st)
+{
+    struct target_freebsd11_stat *target_st;
+
+    if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0)) {
+        return -TARGET_EFAULT;
+    }
+    memset(target_st, 0, sizeof(*target_st));
+    __put_user(host_st->st_dev, &target_st->st_dev);
+    __put_user(host_st->st_ino, &target_st->st_ino);
+    __put_user(host_st->st_mode, &target_st->st_mode);
+    __put_user(host_st->st_nlink, &target_st->st_nlink);
+    __put_user(host_st->st_uid, &target_st->st_uid);
+    __put_user(host_st->st_gid, &target_st->st_gid);
+    __put_user(host_st->st_rdev, &target_st->st_rdev);
+    __put_user(host_st->st_atim.tv_sec, &target_st->st_atim.tv_sec);
+    __put_user(host_st->st_atim.tv_nsec, &target_st->st_atim.tv_nsec);
+    __put_user(host_st->st_mtim.tv_sec, &target_st->st_mtim.tv_sec);
+    __put_user(host_st->st_mtim.tv_nsec, &target_st->st_mtim.tv_nsec);
+    __put_user(host_st->st_ctim.tv_sec, &target_st->st_ctim.tv_sec);
+    __put_user(host_st->st_ctim.tv_nsec, &target_st->st_ctim.tv_nsec);
+    __put_user(host_st->st_size, &target_st->st_size);
+    __put_user(host_st->st_blocks, &target_st->st_blocks);
+    __put_user(host_st->st_blksize, &target_st->st_blksize);
+    __put_user(host_st->st_flags, &target_st->st_flags);
+    __put_user(host_st->st_gen, &target_st->st_gen);
+    /* st_lspare not used */
+    __put_user(host_st->st_birthtim.tv_sec, &target_st->st_birthtim.tv_sec);
+    __put_user(host_st->st_birthtim.tv_nsec, &target_st->st_birthtim.tv_nsec);
+    unlock_user_struct(target_st, target_addr, 1);
+
+    return 0;
+}
+
+abi_long h2t_freebsd11_nstat(abi_ulong target_addr,
+        struct freebsd11_stat *host_st)
+{
+    struct target_freebsd11_nstat *target_st;
+
+    if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0)) {
+        return -TARGET_EFAULT;
+    }
+    memset(target_st, 0, sizeof(*target_st));
+    __put_user(host_st->st_dev, &target_st->st_dev);
+    __put_user(host_st->st_ino, &target_st->st_ino);
+    __put_user(host_st->st_mode, &target_st->st_mode);
+    __put_user(host_st->st_nlink, &target_st->st_nlink);
+    __put_user(host_st->st_uid, &target_st->st_uid);
+    __put_user(host_st->st_gid, &target_st->st_gid);
+    __put_user(host_st->st_rdev, &target_st->st_rdev);
+    __put_user(host_st->st_atim.tv_sec, &target_st->st_atim.tv_sec);
+    __put_user(host_st->st_atim.tv_nsec, &target_st->st_atim.tv_nsec);
+    __put_user(host_st->st_mtim.tv_sec, &target_st->st_mtim.tv_sec);
+    __put_user(host_st->st_mtim.tv_nsec, &target_st->st_mtim.tv_nsec);
+    __put_user(host_st->st_ctim.tv_sec, &target_st->st_ctim.tv_sec);
+    __put_user(host_st->st_ctim.tv_nsec, &target_st->st_ctim.tv_nsec);
+    __put_user(host_st->st_size, &target_st->st_size);
+    __put_user(host_st->st_blocks, &target_st->st_blocks);
+    __put_user(host_st->st_blksize, &target_st->st_blksize);
+    __put_user(host_st->st_flags, &target_st->st_flags);
+    __put_user(host_st->st_gen, &target_st->st_gen);
+    __put_user(host_st->st_birthtim.tv_sec, &target_st->st_birthtim.tv_sec);
+    __put_user(host_st->st_birthtim.tv_nsec, &target_st->st_birthtim.tv_nsec);
+    unlock_user_struct(target_st, target_addr, 1);
+
+    return 0;
+}
+

From f2bc92aaf3d2944fd41073ed3bfb5addf9ee96e7 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:34 +0200
Subject: [PATCH 1281/1353] bsd-user: Implement h2t_freebsd_fhandle
 t2h_freebsd_fhandle

Implement the stat conversion functions:
h2t_freebsd_fhandle
t2h_freebsd_fhandle

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.c b/bsd-user/freebsd/os-stat.c
index 8c73f7402c..6716cee3e2 100644
--- a/bsd-user/freebsd/os-stat.c
+++ b/bsd-user/freebsd/os-stat.c
@@ -92,3 +92,40 @@ abi_long h2t_freebsd11_nstat(abi_ulong target_addr,
     return 0;
 }
 
+/*
+ * file handle conversion
+ */
+abi_long t2h_freebsd_fhandle(fhandle_t *host_fh, abi_ulong target_addr)
+{
+    target_freebsd_fhandle_t *target_fh;
+
+    if (!lock_user_struct(VERIFY_READ, target_fh, target_addr, 1)) {
+        return -TARGET_EFAULT;
+    }
+    __get_user(host_fh->fh_fsid.val[0], &target_fh->fh_fsid.val[0]);
+    __get_user(host_fh->fh_fsid.val[1], &target_fh->fh_fsid.val[0]);
+    __get_user(host_fh->fh_fid.fid_len, &target_fh->fh_fid.fid_len);
+    /* u_short         fid_data0; */
+    memcpy(host_fh->fh_fid.fid_data, target_fh->fh_fid.fid_data,
+        TARGET_MAXFIDSZ);
+    unlock_user_struct(target_fh, target_addr, 0);
+    return 0;
+}
+
+abi_long h2t_freebsd_fhandle(abi_ulong target_addr, fhandle_t *host_fh)
+{
+    target_freebsd_fhandle_t *target_fh;
+
+    if (!lock_user_struct(VERIFY_WRITE, target_fh, target_addr, 0)) {
+        return -TARGET_EFAULT;
+    }
+    __put_user(host_fh->fh_fsid.val[0], &target_fh->fh_fsid.val[0]);
+    __put_user(host_fh->fh_fsid.val[1], &target_fh->fh_fsid.val[0]);
+    __put_user(host_fh->fh_fid.fid_len, &target_fh->fh_fid.fid_len);
+    /* u_short         fid_data0; */
+    memcpy(target_fh->fh_fid.fid_data, host_fh->fh_fid.fid_data,
+            TARGET_MAXFIDSZ);
+    unlock_user_struct(target_fh, target_addr, 1);
+    return 0;
+}
+

From 5aa88f962cac2e93f222c48c92a14d685aaf00e7 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:35 +0200
Subject: [PATCH 1282/1353] bsd-user: Implement h2t_freebds11_statfs

Implement the stat conversion functions:
h2t_freebds11_statfs

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.c | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.c b/bsd-user/freebsd/os-stat.c
index 6716cee3e2..9eb01bf664 100644
--- a/bsd-user/freebsd/os-stat.c
+++ b/bsd-user/freebsd/os-stat.c
@@ -129,3 +129,44 @@ abi_long h2t_freebsd_fhandle(abi_ulong target_addr, fhandle_t *host_fh)
     return 0;
 }
 
+/*
+ *  file system stat
+ */
+abi_long h2t_freebsd11_statfs(abi_ulong target_addr,
+        struct freebsd11_statfs *host_statfs)
+{
+    struct target_freebsd11_statfs *target_statfs;
+
+    if (!lock_user_struct(VERIFY_WRITE, target_statfs, target_addr, 0)) {
+        return -TARGET_EFAULT;
+    }
+    __put_user(host_statfs->f_version, &target_statfs->f_version);
+    __put_user(host_statfs->f_type, &target_statfs->f_type);
+    __put_user(host_statfs->f_flags, &target_statfs->f_flags);
+    __put_user(host_statfs->f_bsize, &target_statfs->f_bsize);
+    __put_user(host_statfs->f_iosize, &target_statfs->f_iosize);
+    __put_user(host_statfs->f_blocks, &target_statfs->f_blocks);
+    __put_user(host_statfs->f_bfree, &target_statfs->f_bfree);
+    __put_user(host_statfs->f_bavail, &target_statfs->f_bavail);
+    __put_user(host_statfs->f_files, &target_statfs->f_files);
+    __put_user(host_statfs->f_ffree, &target_statfs->f_ffree);
+    __put_user(host_statfs->f_syncwrites, &target_statfs->f_syncwrites);
+    __put_user(host_statfs->f_asyncwrites, &target_statfs->f_asyncwrites);
+    __put_user(host_statfs->f_syncreads, &target_statfs->f_syncreads);
+    __put_user(host_statfs->f_asyncreads, &target_statfs->f_asyncreads);
+    /* uint64_t f_spare[10]; */
+    __put_user(host_statfs->f_namemax, &target_statfs->f_namemax);
+    __put_user(host_statfs->f_owner, &target_statfs->f_owner);
+    __put_user(host_statfs->f_fsid.val[0], &target_statfs->f_fsid.val[0]);
+    __put_user(host_statfs->f_fsid.val[1], &target_statfs->f_fsid.val[1]);
+    /* char f_charspace[80]; */
+    strncpy(target_statfs->f_fstypename, host_statfs->f_fstypename,
+        sizeof(target_statfs->f_fstypename));
+    strncpy(target_statfs->f_mntfromname, host_statfs->f_mntfromname,
+        sizeof(target_statfs->f_mntfromname));
+    strncpy(target_statfs->f_mntonname, host_statfs->f_mntonname,
+        sizeof(target_statfs->f_mntonname));
+    unlock_user_struct(target_statfs, target_addr, 1);
+    return 0;
+}
+

From 584d6fce65bd80335795d80c0e9bf1062ef3c4f6 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:36 +0200
Subject: [PATCH 1283/1353] bsd-user: Implement target_to_host_fcntl_cmd

Implement the stat conversion functions:
target_to_host_fcntl_cmd

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.c b/bsd-user/freebsd/os-stat.c
index 9eb01bf664..2ce235d5da 100644
--- a/bsd-user/freebsd/os-stat.c
+++ b/bsd-user/freebsd/os-stat.c
@@ -170,3 +170,11 @@ abi_long h2t_freebsd11_statfs(abi_ulong target_addr,
     return 0;
 }
 
+/*
+ * fcntl cmd conversion
+ */
+abi_long target_to_host_fcntl_cmd(int cmd)
+{
+    return cmd;
+}
+

From f9d5a35fbbfeb534e748fc79df7f3f85b83c695a Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:37 +0200
Subject: [PATCH 1284/1353] bsd-uesr: Implement h2t_freebsd_stat and
 h2t_freebsd_statfs functions

They are the 64-bit variants of h2t_freebsd11_stat and
h2t_freebsd11_statfs, respectively

Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.c | 82 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.c b/bsd-user/freebsd/os-stat.c
index 2ce235d5da..f0f9e609c3 100644
--- a/bsd-user/freebsd/os-stat.c
+++ b/bsd-user/freebsd/os-stat.c
@@ -58,6 +58,50 @@ abi_long h2t_freebsd11_stat(abi_ulong target_addr,
     return 0;
 }
 
+abi_long h2t_freebsd_stat(abi_ulong target_addr,
+        struct stat *host_st)
+{
+    struct target_stat *target_st;
+
+    if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0)) {
+        return -TARGET_EFAULT;
+    }
+    memset(target_st, 0, sizeof(*target_st));
+    __put_user(host_st->st_dev, &target_st->st_dev);
+    __put_user(host_st->st_ino, &target_st->st_ino);
+    __put_user(host_st->st_nlink, &target_st->st_nlink);
+    __put_user(host_st->st_mode, &target_st->st_mode);
+    __put_user(host_st->st_uid, &target_st->st_uid);
+    __put_user(host_st->st_gid, &target_st->st_gid);
+    __put_user(host_st->st_rdev, &target_st->st_rdev);
+    __put_user(host_st->st_atim.tv_sec, &target_st->st_atim.tv_sec);
+    __put_user(host_st->st_atim.tv_nsec, &target_st->st_atim.tv_nsec);
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+/*    __put_user(host_st->st_mtim_ext, &target_st->st_mtim_ext); XXX */
+#endif
+    __put_user(host_st->st_mtim.tv_sec, &target_st->st_mtim.tv_sec);
+    __put_user(host_st->st_mtim.tv_nsec, &target_st->st_mtim.tv_nsec);
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+/*    __put_user(host_st->st_ctim_ext, &target_st->st_ctim_ext); XXX */
+#endif
+    __put_user(host_st->st_ctim.tv_sec, &target_st->st_ctim.tv_sec);
+    __put_user(host_st->st_ctim.tv_nsec, &target_st->st_ctim.tv_nsec);
+#ifdef TARGET_HAS_STAT_TIME_T_EXT
+/*    __put_user(host_st->st_birthtim_ext, &target_st->st_birthtim_ext); XXX */
+#endif
+    __put_user(host_st->st_birthtim.tv_sec, &target_st->st_birthtim.tv_sec);
+    __put_user(host_st->st_birthtim.tv_nsec, &target_st->st_birthtim.tv_nsec);
+
+    __put_user(host_st->st_size, &target_st->st_size);
+    __put_user(host_st->st_blocks, &target_st->st_blocks);
+    __put_user(host_st->st_blksize, &target_st->st_blksize);
+    __put_user(host_st->st_flags, &target_st->st_flags);
+    __put_user(host_st->st_gen, &target_st->st_gen);
+    unlock_user_struct(target_st, target_addr, 1);
+
+    return 0;
+}
+
 abi_long h2t_freebsd11_nstat(abi_ulong target_addr,
         struct freebsd11_stat *host_st)
 {
@@ -170,6 +214,44 @@ abi_long h2t_freebsd11_statfs(abi_ulong target_addr,
     return 0;
 }
 
+abi_long h2t_freebsd_statfs(abi_ulong target_addr,
+        struct statfs *host_statfs)
+{
+    struct target_statfs *target_statfs;
+
+    if (!lock_user_struct(VERIFY_WRITE, target_statfs, target_addr, 0)) {
+        return -TARGET_EFAULT;
+    }
+    __put_user(host_statfs->f_version, &target_statfs->f_version);
+    __put_user(host_statfs->f_type, &target_statfs->f_type);
+    __put_user(host_statfs->f_flags, &target_statfs->f_flags);
+    __put_user(host_statfs->f_bsize, &target_statfs->f_bsize);
+    __put_user(host_statfs->f_iosize, &target_statfs->f_iosize);
+    __put_user(host_statfs->f_blocks, &target_statfs->f_blocks);
+    __put_user(host_statfs->f_bfree, &target_statfs->f_bfree);
+    __put_user(host_statfs->f_bavail, &target_statfs->f_bavail);
+    __put_user(host_statfs->f_files, &target_statfs->f_files);
+    __put_user(host_statfs->f_ffree, &target_statfs->f_ffree);
+    __put_user(host_statfs->f_syncwrites, &target_statfs->f_syncwrites);
+    __put_user(host_statfs->f_asyncwrites, &target_statfs->f_asyncwrites);
+    __put_user(host_statfs->f_syncreads, &target_statfs->f_syncreads);
+    __put_user(host_statfs->f_asyncreads, &target_statfs->f_asyncreads);
+    /* uint64_t f_spare[10]; */
+    __put_user(host_statfs->f_namemax, &target_statfs->f_namemax);
+    __put_user(host_statfs->f_owner, &target_statfs->f_owner);
+    __put_user(host_statfs->f_fsid.val[0], &target_statfs->f_fsid.val[0]);
+    __put_user(host_statfs->f_fsid.val[1], &target_statfs->f_fsid.val[1]);
+    /* char f_charspace[80]; */
+    strncpy(target_statfs->f_fstypename, host_statfs->f_fstypename,
+        sizeof(target_statfs->f_fstypename));
+    strncpy(target_statfs->f_mntfromname, host_statfs->f_mntfromname,
+        sizeof(target_statfs->f_mntfromname));
+    strncpy(target_statfs->f_mntonname, host_statfs->f_mntonname,
+        sizeof(target_statfs->f_mntonname));
+    unlock_user_struct(target_statfs, target_addr, 1);
+    return 0;
+}
+
 /*
  * fcntl cmd conversion
  */

From bf14f13d8be8f572fa169a866d3244fa4a1988ac Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:38 +0200
Subject: [PATCH 1285/1353] bsd-user: Implement stat related syscalls

Implement the following syscalls:
stat(2)
lstat(2)
fstat(2)
fstatat(2)
nstat
nfstat
nlstat

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 130 +++++++++++++++++++++++++++++++++++++
 1 file changed, 130 insertions(+)
 create mode 100644 bsd-user/freebsd/os-stat.h

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
new file mode 100644
index 0000000000..f8f99b4a72
--- /dev/null
+++ b/bsd-user/freebsd/os-stat.h
@@ -0,0 +1,130 @@
+/*
+ *  stat related system call shims and definitions
+ *
+ *  Copyright (c) 2013 Stacey D. Son
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef BSD_USER_FREEBSD_OS_STAT_H
+#define BSD_USER_FREEBSD_OS_STAT_H
+
+/* stat(2) */
+static inline abi_long do_freebsd11_stat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    struct freebsd11_stat st;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(freebsd11_stat(path(p), &st));
+    UNLOCK_PATH(p, arg1);
+    if (!is_error(ret)) {
+        ret = h2t_freebsd11_stat(arg2, &st);
+    }
+    return ret;
+}
+
+/* lstat(2) */
+static inline abi_long do_freebsd11_lstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    struct freebsd11_stat st;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(freebsd11_lstat(path(p), &st));
+    UNLOCK_PATH(p, arg1);
+    if (!is_error(ret)) {
+        ret = h2t_freebsd11_stat(arg2, &st);
+    }
+    return ret;
+}
+
+/* fstat(2) */
+static inline abi_long do_freebsd_fstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    struct stat st;
+
+    ret = get_errno(fstat(arg1, &st));
+    if (!is_error(ret))  {
+        ret = h2t_freebsd_stat(arg2, &st);
+    }
+    return ret;
+}
+
+/* fstatat(2) */
+static inline abi_long do_freebsd_fstatat(abi_long arg1, abi_long arg2,
+        abi_long arg3, abi_long arg4)
+{
+    abi_long ret;
+    void *p;
+    struct stat st;
+
+    LOCK_PATH(p, arg2);
+    ret = get_errno(fstatat(arg1, p, &st, arg4));
+    UNLOCK_PATH(p, arg2);
+    if (!is_error(ret) && arg3) {
+        ret = h2t_freebsd_stat(arg3, &st);
+    }
+    return ret;
+}
+
+/* undocummented nstat(char *path, struct nstat *ub) syscall */
+static abi_long do_freebsd11_nstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    struct freebsd11_stat st;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(freebsd11_nstat(path(p), &st));
+    UNLOCK_PATH(p, arg1);
+    if (!is_error(ret)) {
+        ret = h2t_freebsd11_nstat(arg2, &st);
+    }
+    return ret;
+}
+
+/* undocummented nfstat(int fd, struct nstat *sb) syscall */
+static abi_long do_freebsd11_nfstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    struct freebsd11_stat st;
+
+    ret = get_errno(freebsd11_nfstat(arg1, &st));
+    if (!is_error(ret))  {
+        ret = h2t_freebsd11_nstat(arg2, &st);
+    }
+    return ret;
+}
+
+/* undocummented nlstat(char *path, struct nstat *ub) syscall */
+static abi_long do_freebsd11_nlstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    struct freebsd11_stat st;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(freebsd11_nlstat(path(p), &st));
+    UNLOCK_PATH(p, arg1);
+    if (!is_error(ret)) {
+        ret = h2t_freebsd11_nstat(arg2, &st);
+    }
+    return ret;
+}
+
+#endif /* BSD_USER_FREEBSD_OS_STAT_H */

From db8ee08f0a88ae04ee6b684690a3d53f862e7ea3 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:39 +0200
Subject: [PATCH 1286/1353] bsd-user: Implement statfh related syscalls

Implement the following syscalls:
getfh(2)
lgetfh(2)
fhopen(2)
fhstat(2)
fhstatfs(2)

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 83 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index f8f99b4a72..935663c071 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -127,4 +127,87 @@ static abi_long do_freebsd11_nlstat(abi_long arg1, abi_long arg2)
     return ret;
 }
 
+/* getfh(2) */
+static abi_long do_freebsd_getfh(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    fhandle_t host_fh;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(getfh(path(p), &host_fh));
+    UNLOCK_PATH(p, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+    return h2t_freebsd_fhandle(arg2, &host_fh);
+}
+
+/* lgetfh(2) */
+static inline abi_long do_freebsd_lgetfh(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    fhandle_t host_fh;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(lgetfh(path(p), &host_fh));
+    UNLOCK_PATH(p, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+    return h2t_freebsd_fhandle(arg2, &host_fh);
+}
+
+/* fhopen(2) */
+static inline abi_long do_freebsd_fhopen(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    fhandle_t host_fh;
+
+    ret = t2h_freebsd_fhandle(&host_fh, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    return get_errno(fhopen(&host_fh, arg2));
+}
+
+/* fhstat(2) */
+static inline abi_long do_freebsd_fhstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    fhandle_t host_fh;
+    struct stat host_sb;
+
+    ret = t2h_freebsd_fhandle(&host_fh, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+    ret = get_errno(fhstat(&host_fh, &host_sb));
+    if (is_error(ret)) {
+        return ret;
+    }
+    return h2t_freebsd_stat(arg2, &host_sb);
+}
+
+/* fhstatfs(2) */
+static inline abi_long do_freebsd_fhstatfs(abi_ulong target_fhp_addr,
+        abi_ulong target_stfs_addr)
+{
+    abi_long ret;
+    fhandle_t host_fh;
+    struct statfs host_stfs;
+
+    ret = t2h_freebsd_fhandle(&host_fh, target_fhp_addr);
+    if (is_error(ret)) {
+        return ret;
+    }
+    ret = get_errno(fhstatfs(&host_fh, &host_stfs));
+    if (is_error(ret)) {
+        return ret;
+    }
+    return h2t_freebsd_statfs(target_stfs_addr, &host_stfs);
+}
+
 #endif /* BSD_USER_FREEBSD_OS_STAT_H */

From 191fe50d5dc8f26e0049d62e92d192d410520fab Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:40 +0200
Subject: [PATCH 1287/1353] bsd-user: Implement statfs related syscalls

Implement the following syscalls:
statfs(2)
fstatfs(2)
getfsstat(2)

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 69 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 935663c071..9492c93c55 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -210,4 +210,73 @@ static inline abi_long do_freebsd_fhstatfs(abi_ulong target_fhp_addr,
     return h2t_freebsd_statfs(target_stfs_addr, &host_stfs);
 }
 
+/* statfs(2) */
+static inline abi_long do_freebsd_statfs(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    struct statfs host_stfs;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(statfs(path(p), &host_stfs));
+    UNLOCK_PATH(p, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    return h2t_freebsd_statfs(arg2, &host_stfs);
+}
+
+/* fstatfs(2) */
+static inline abi_long do_freebsd_fstatfs(abi_long fd, abi_ulong target_addr)
+{
+    abi_long ret;
+    struct statfs host_stfs;
+
+    ret = get_errno(fstatfs(fd, &host_stfs));
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    return h2t_freebsd_statfs(target_addr, &host_stfs);
+}
+
+/* getfsstat(2) */
+static inline abi_long do_freebsd_getfsstat(abi_ulong target_addr,
+        abi_long bufsize, abi_long flags)
+{
+    abi_long ret;
+    struct statfs *host_stfs;
+    int count;
+    long host_bufsize;
+
+    count = bufsize / sizeof(struct target_statfs);
+
+    /* if user buffer is NULL then return number of mounted FS's */
+    if (target_addr == 0 || count == 0) {
+        return get_errno(freebsd11_getfsstat(NULL, 0, flags));
+    }
+
+    /* XXX check count to be reasonable */
+    host_bufsize = sizeof(struct statfs) * count;
+    host_stfs = alloca(host_bufsize);
+    if (!host_stfs) {
+        return -TARGET_EINVAL;
+    }
+
+    ret = count = get_errno(getfsstat(host_stfs, host_bufsize, flags));
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    while (count--) {
+        if (h2t_freebsd_statfs((target_addr +
+                        (count * sizeof(struct target_statfs))),
+                    &host_stfs[count])) {
+            return -TARGET_EFAULT;
+        }
+    }
+    return ret;
+}
+
 #endif /* BSD_USER_FREEBSD_OS_STAT_H */

From 213444529de083d1cbd1ef2391a1323207182f93 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:41 +0200
Subject: [PATCH 1288/1353] bsd-user: Implement getdents related syscalls

Implement the following syscalls:
getdents(2)
getdirecentries(2)

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 72 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 9492c93c55..7dc41cd0bf 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -279,4 +279,76 @@ static inline abi_long do_freebsd_getfsstat(abi_ulong target_addr,
     return ret;
 }
 
+/* getdents(2) */
+static inline abi_long do_freebsd11_getdents(abi_long arg1,
+        abi_ulong arg2, abi_long nbytes)
+{
+    abi_long ret;
+    struct freebsd11_dirent *dirp;
+
+    dirp = lock_user(VERIFY_WRITE, arg2, nbytes, 0);
+    if (dirp == NULL) {
+        return -TARGET_EFAULT;
+    }
+    ret = get_errno(freebsd11_getdents(arg1, (char *)dirp, nbytes));
+    if (!is_error(ret)) {
+        struct freebsd11_dirent *de;
+        int len = ret;
+        int reclen;
+
+        de = dirp;
+        while (len > 0) {
+            reclen = de->d_reclen;
+            if (reclen > len) {
+                return -TARGET_EFAULT;
+            }
+            de->d_reclen = tswap16(reclen);
+            de->d_fileno = tswap32(de->d_fileno);
+            len -= reclen;
+        }
+    }
+    return ret;
+}
+
+/* getdirecentries(2) */
+static inline abi_long do_freebsd_getdirentries(abi_long arg1,
+        abi_ulong arg2, abi_long nbytes, abi_ulong arg4)
+{
+    abi_long ret;
+    struct dirent *dirp;
+    long basep;
+
+    dirp = lock_user(VERIFY_WRITE, arg2, nbytes, 0);
+    if (dirp == NULL) {
+        return -TARGET_EFAULT;
+    }
+    ret = get_errno(getdirentries(arg1, (char *)dirp, nbytes, &basep));
+    if (!is_error(ret)) {
+        struct dirent *de;
+        int len = ret;
+        int reclen;
+
+        de = dirp;
+        while (len > 0) {
+            reclen = de->d_reclen;
+            if (reclen > len) {
+                return -TARGET_EFAULT;
+            }
+            de->d_fileno = tswap64(de->d_fileno);
+            de->d_off = tswap64(de->d_off);
+            de->d_reclen = tswap16(de->d_reclen);
+            de->d_namlen = tswap16(de->d_namlen);
+            len -= reclen;
+            de = (struct dirent *)((void *)de + reclen);
+        }
+    }
+    unlock_user(dirp, arg2, ret);
+    if (arg4) {
+        if (put_user(basep, arg4, abi_ulong)) {
+            return -TARGET_EFAULT;
+        }
+    }
+    return ret;
+}
+
 #endif /* BSD_USER_FREEBSD_OS_STAT_H */

From c0023204cb05f330c51432fdcae8929413ff6d73 Mon Sep 17 00:00:00 2001
From: Stacey Son <sson@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:42 +0200
Subject: [PATCH 1289/1353] bsd-user: Implement stat related syscalls

Implement the following syscalls:
fcntl(2)

Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 74 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 7dc41cd0bf..5d9323c7d1 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -351,4 +351,78 @@ static inline abi_long do_freebsd_getdirentries(abi_long arg1,
     return ret;
 }
 
+/* fcntl(2) */
+static inline abi_long do_freebsd_fcntl(abi_long arg1, abi_long arg2,
+        abi_ulong arg3)
+{
+    abi_long ret;
+    int host_cmd;
+    struct flock fl;
+    struct target_freebsd_flock *target_fl;
+
+    host_cmd = target_to_host_fcntl_cmd(arg2);
+    if (host_cmd < 0) {
+        return host_cmd;
+    }
+    switch (arg2) {
+    case TARGET_F_GETLK:
+        if (!lock_user_struct(VERIFY_READ, target_fl, arg3, 1)) {
+            return -TARGET_EFAULT;
+        }
+        __get_user(fl.l_type, &target_fl->l_type);
+        __get_user(fl.l_whence, &target_fl->l_whence);
+        __get_user(fl.l_start, &target_fl->l_start);
+        __get_user(fl.l_len, &target_fl->l_len);
+        __get_user(fl.l_pid, &target_fl->l_pid);
+        __get_user(fl.l_sysid, &target_fl->l_sysid);
+        unlock_user_struct(target_fl, arg3, 0);
+        ret = get_errno(safe_fcntl(arg1, host_cmd, &fl));
+        if (!is_error(ret)) {
+            if (!lock_user_struct(VERIFY_WRITE, target_fl, arg3, 0)) {
+                return -TARGET_EFAULT;
+            }
+            __put_user(fl.l_type, &target_fl->l_type);
+            __put_user(fl.l_whence, &target_fl->l_whence);
+            __put_user(fl.l_start, &target_fl->l_start);
+            __put_user(fl.l_len, &target_fl->l_len);
+            __put_user(fl.l_pid, &target_fl->l_pid);
+            __put_user(fl.l_sysid, &target_fl->l_sysid);
+            unlock_user_struct(target_fl, arg3, 1);
+        }
+        break;
+
+    case TARGET_F_SETLK:
+    case TARGET_F_SETLKW:
+        if (!lock_user_struct(VERIFY_READ, target_fl, arg3, 1)) {
+            return -TARGET_EFAULT;
+        }
+        __get_user(fl.l_type, &target_fl->l_type);
+        __get_user(fl.l_whence, &target_fl->l_whence);
+        __get_user(fl.l_start, &target_fl->l_start);
+        __get_user(fl.l_len, &target_fl->l_len);
+        __get_user(fl.l_pid, &target_fl->l_pid);
+        __get_user(fl.l_sysid, &target_fl->l_sysid);
+        unlock_user_struct(target_fl, arg3, 0);
+        ret = get_errno(safe_fcntl(arg1, host_cmd, &fl));
+        break;
+
+    case TARGET_F_DUPFD:
+    case TARGET_F_DUP2FD:
+    case TARGET_F_GETOWN:
+    case TARGET_F_SETOWN:
+    case TARGET_F_GETFD:
+    case TARGET_F_SETFD:
+    case TARGET_F_GETFL:
+    case TARGET_F_SETFL:
+    case TARGET_F_READAHEAD:
+    case TARGET_F_RDAHEAD:
+    case TARGET_F_ADD_SEALS:
+    case TARGET_F_GET_SEALS:
+    default:
+        ret = get_errno(safe_fcntl(arg1, host_cmd, arg3));
+        break;
+    }
+    return ret;
+}
+
 #endif /* BSD_USER_FREEBSD_OS_STAT_H */

From b443297793ef696f282e470775dc89815758fb24 Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:43 +0200
Subject: [PATCH 1290/1353] bsd-user: Implement freebsd11 stat related syscalls

Rename the following syscalls to the freebsd11 variant:
do_freebsd_lstat -> do_freebsd11_lstat
do_freebsd_stat -> do_freebsd11_stat

Co-authored-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 5d9323c7d1..aef55c8bb5 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -20,6 +20,11 @@
 #ifndef BSD_USER_FREEBSD_OS_STAT_H
 #define BSD_USER_FREEBSD_OS_STAT_H
 
+int freebsd11_stat(const char *path, struct freebsd11_stat *stat);
+__sym_compat(stat, freebsd11_stat, FBSD_1.0);
+int freebsd11_lstat(const char *path, struct freebsd11_stat *stat);
+__sym_compat(lstat, freebsd11_lstat, FBSD_1.0);
+
 /* stat(2) */
 static inline abi_long do_freebsd11_stat(abi_long arg1, abi_long arg2)
 {

From 33d730684efbe9f9343a07a6f4259e322d22f63e Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:44 +0200
Subject: [PATCH 1291/1353] bsd-user: Implement freebsd11 fstat and fhstat
 related syscalls

Implement the freebsd11 variant of the following syscalls:
fstat(2)
fstatat(2)
fhstat(2)
fhstatfs(2)

Co-authored-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 78 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index aef55c8bb5..2e0c7245df 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -24,6 +24,17 @@ int freebsd11_stat(const char *path, struct freebsd11_stat *stat);
 __sym_compat(stat, freebsd11_stat, FBSD_1.0);
 int freebsd11_lstat(const char *path, struct freebsd11_stat *stat);
 __sym_compat(lstat, freebsd11_lstat, FBSD_1.0);
+int freebsd11_fstat(int fd, struct freebsd11_stat *stat);
+__sym_compat(fstat, freebsd11_fstat, FBSD_1.0);
+int freebsd11_fstatat(int fd, const char *path, struct freebsd11_stat *stat,
+        int flag);
+__sym_compat(fstatat, freebsd11_fstatat, FBSD_1.1);
+
+int freebsd11_fhstat(const fhandle_t *fhandle, struct freebsd11_stat *stat);
+__sym_compat(fhstat, freebsd11_fhstat, FBSD_1.0);
+int freebsd11_fhstatfs(const fhandle_t *fhandle, struct freebsd11_statfs * buf);
+__sym_compat(fhstatfs, freebsd11_fhstatfs, FBSD_1.0);
+int freebsd11_statfs(const char *path, struct freebsd11_statfs *buf);
 
 /* stat(2) */
 static inline abi_long do_freebsd11_stat(abi_long arg1, abi_long arg2)
@@ -57,6 +68,19 @@ static inline abi_long do_freebsd11_lstat(abi_long arg1, abi_long arg2)
     return ret;
 }
 
+/* fstat(2) */
+static inline abi_long do_freebsd11_fstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    struct freebsd11_stat st;
+
+    ret = get_errno(freebsd11_fstat(arg1, &st));
+    if (!is_error(ret))  {
+        ret = h2t_freebsd11_stat(arg2, &st);
+    }
+    return ret;
+}
+
 /* fstat(2) */
 static inline abi_long do_freebsd_fstat(abi_long arg1, abi_long arg2)
 {
@@ -70,6 +94,23 @@ static inline abi_long do_freebsd_fstat(abi_long arg1, abi_long arg2)
     return ret;
 }
 
+/* fstatat(2) */
+static inline abi_long do_freebsd11_fstatat(abi_long arg1, abi_long arg2,
+        abi_long arg3, abi_long arg4)
+{
+    abi_long ret;
+    void *p;
+    struct freebsd11_stat st;
+
+    LOCK_PATH(p, arg2);
+    ret = get_errno(freebsd11_fstatat(arg1, p, &st, arg4));
+    UNLOCK_PATH(p, arg2);
+    if (!is_error(ret) && arg3) {
+        ret = h2t_freebsd11_stat(arg3, &st);
+    }
+    return ret;
+}
+
 /* fstatat(2) */
 static inline abi_long do_freebsd_fstatat(abi_long arg1, abi_long arg2,
         abi_long arg3, abi_long arg4)
@@ -178,6 +219,24 @@ static inline abi_long do_freebsd_fhopen(abi_long arg1, abi_long arg2)
     return get_errno(fhopen(&host_fh, arg2));
 }
 
+/* fhstat(2) */
+static inline abi_long do_freebsd11_fhstat(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    fhandle_t host_fh;
+    struct freebsd11_stat host_sb;
+
+    ret = t2h_freebsd_fhandle(&host_fh, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+    ret = get_errno(freebsd11_fhstat(&host_fh, &host_sb));
+    if (is_error(ret)) {
+        return ret;
+    }
+    return h2t_freebsd11_stat(arg2, &host_sb);
+}
+
 /* fhstat(2) */
 static inline abi_long do_freebsd_fhstat(abi_long arg1, abi_long arg2)
 {
@@ -196,6 +255,25 @@ static inline abi_long do_freebsd_fhstat(abi_long arg1, abi_long arg2)
     return h2t_freebsd_stat(arg2, &host_sb);
 }
 
+/* fhstatfs(2) */
+static inline abi_long do_freebsd11_fhstatfs(abi_ulong target_fhp_addr,
+        abi_ulong target_stfs_addr)
+{
+    abi_long ret;
+    fhandle_t host_fh;
+    struct freebsd11_statfs host_stfs;
+
+    ret = t2h_freebsd_fhandle(&host_fh, target_fhp_addr);
+    if (is_error(ret)) {
+        return ret;
+    }
+    ret = get_errno(freebsd11_fhstatfs(&host_fh, &host_stfs));
+    if (is_error(ret)) {
+        return ret;
+    }
+    return h2t_freebsd11_statfs(target_stfs_addr, &host_stfs);
+}
+
 /* fhstatfs(2) */
 static inline abi_long do_freebsd_fhstatfs(abi_ulong target_fhp_addr,
         abi_ulong target_stfs_addr)

From 196da9d3d3f1ab142473a6b2f714720ba1b29a33 Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:45 +0200
Subject: [PATCH 1292/1353] bsd-user: Implement freebsd11 statfs related
 syscalls

Implement the freebsd11 variant of the following syscalls:
statfs(2)
fstatfs(2)
getfsstat(2)

Co-authored-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 75 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 2e0c7245df..04a61fabd1 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -32,9 +32,15 @@ __sym_compat(fstatat, freebsd11_fstatat, FBSD_1.1);
 
 int freebsd11_fhstat(const fhandle_t *fhandle, struct freebsd11_stat *stat);
 __sym_compat(fhstat, freebsd11_fhstat, FBSD_1.0);
+int freebsd11_getfsstat(struct freebsd11_statfs *buf, long bufsize, int mode);
+__sym_compat(getfsstat, freebsd11_getfsstat, FBSD_1.0);
 int freebsd11_fhstatfs(const fhandle_t *fhandle, struct freebsd11_statfs * buf);
 __sym_compat(fhstatfs, freebsd11_fhstatfs, FBSD_1.0);
 int freebsd11_statfs(const char *path, struct freebsd11_statfs *buf);
+__sym_compat(statfs, freebsd11_statfs, FBSD_1.0);
+int freebsd11_fstatfs(int fd, struct freebsd11_statfs *buf);
+__sym_compat(fstatfs, freebsd11_fstatfs, FBSD_1.0);
+
 
 /* stat(2) */
 static inline abi_long do_freebsd11_stat(abi_long arg1, abi_long arg2)
@@ -293,6 +299,23 @@ static inline abi_long do_freebsd_fhstatfs(abi_ulong target_fhp_addr,
     return h2t_freebsd_statfs(target_stfs_addr, &host_stfs);
 }
 
+/* statfs(2) */
+static inline abi_long do_freebsd11_statfs(abi_long arg1, abi_long arg2)
+{
+    abi_long ret;
+    void *p;
+    struct freebsd11_statfs host_stfs;
+
+    LOCK_PATH(p, arg1);
+    ret = get_errno(freebsd11_statfs(path(p), &host_stfs));
+    UNLOCK_PATH(p, arg1);
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    return h2t_freebsd11_statfs(arg2, &host_stfs);
+}
+
 /* statfs(2) */
 static inline abi_long do_freebsd_statfs(abi_long arg1, abi_long arg2)
 {
@@ -310,6 +333,20 @@ static inline abi_long do_freebsd_statfs(abi_long arg1, abi_long arg2)
     return h2t_freebsd_statfs(arg2, &host_stfs);
 }
 
+/* fstatfs(2) */
+static inline abi_long do_freebsd11_fstatfs(abi_long fd, abi_ulong target_addr)
+{
+    abi_long ret;
+    struct freebsd11_statfs host_stfs;
+
+    ret = get_errno(freebsd11_fstatfs(fd, &host_stfs));
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    return h2t_freebsd11_statfs(target_addr, &host_stfs);
+}
+
 /* fstatfs(2) */
 static inline abi_long do_freebsd_fstatfs(abi_long fd, abi_ulong target_addr)
 {
@@ -324,6 +361,44 @@ static inline abi_long do_freebsd_fstatfs(abi_long fd, abi_ulong target_addr)
     return h2t_freebsd_statfs(target_addr, &host_stfs);
 }
 
+/* getfsstat(2) */
+static inline abi_long do_freebsd11_getfsstat(abi_ulong target_addr,
+        abi_long bufsize, abi_long flags)
+{
+    abi_long ret;
+    struct freebsd11_statfs *host_stfs;
+    int count;
+    long host_bufsize;
+
+    count = bufsize / sizeof(struct target_freebsd11_statfs);
+
+    /* if user buffer is NULL then return number of mounted FS's */
+    if (target_addr == 0 || count == 0) {
+        return get_errno(freebsd11_getfsstat(NULL, 0, flags));
+    }
+
+    /* XXX check count to be reasonable */
+    host_bufsize = sizeof(struct freebsd11_statfs) * count;
+    host_stfs = alloca(host_bufsize);
+    if (!host_stfs) {
+        return -TARGET_EINVAL;
+    }
+
+    ret = count = get_errno(freebsd11_getfsstat(host_stfs, host_bufsize, flags));
+    if (is_error(ret)) {
+        return ret;
+    }
+
+    while (count--) {
+        if (h2t_freebsd11_statfs((target_addr +
+                        (count * sizeof(struct target_freebsd11_statfs))),
+                    &host_stfs[count])) {
+            return -TARGET_EFAULT;
+        }
+    }
+    return ret;
+}
+
 /* getfsstat(2) */
 static inline abi_long do_freebsd_getfsstat(abi_ulong target_addr,
         abi_long bufsize, abi_long flags)

From 91a98c9bbcfba2a9f278a0811676cd2f8000481c Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:46 +0200
Subject: [PATCH 1293/1353] bsd-user: Implement freebsd11 getdirents related
 syscalls

Implement the freebsd11 variant of the following syscalls:
getdirentries(2)

Co-authored-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 44 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 04a61fabd1..26909af455 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -41,6 +41,11 @@ __sym_compat(statfs, freebsd11_statfs, FBSD_1.0);
 int freebsd11_fstatfs(int fd, struct freebsd11_statfs *buf);
 __sym_compat(fstatfs, freebsd11_fstatfs, FBSD_1.0);
 
+ssize_t freebsd11_getdirentries(int fd, char *buf, size_t nbytes, off_t *basep);
+__sym_compat(getdirentries, freebsd11_getdirentries, FBSD_1.0);
+ssize_t freebsd11_getdents(int fd, char *buf, size_t nbytes);
+__sym_compat(getdents, freebsd11_getdents, FBSD_1.0);
+
 
 /* stat(2) */
 static inline abi_long do_freebsd11_stat(abi_long arg1, abi_long arg2)
@@ -468,6 +473,45 @@ static inline abi_long do_freebsd11_getdents(abi_long arg1,
     return ret;
 }
 
+/* getdirecentries(2) */
+static inline abi_long do_freebsd11_getdirentries(abi_long arg1,
+        abi_ulong arg2, abi_long nbytes, abi_ulong arg4)
+{
+    abi_long ret;
+    struct freebsd11_dirent *dirp;
+    long basep;
+
+    dirp = lock_user(VERIFY_WRITE, arg2, nbytes, 0);
+    if (dirp == NULL) {
+        return -TARGET_EFAULT;
+    }
+    ret = get_errno(freebsd11_getdirentries(arg1, (char *)dirp, nbytes, &basep));
+    if (!is_error(ret)) {
+        struct freebsd11_dirent *de;
+        int len = ret;
+        int reclen;
+
+        de = dirp;
+        while (len > 0) {
+            reclen = de->d_reclen;
+            if (reclen > len) {
+                return -TARGET_EFAULT;
+            }
+            de->d_reclen = tswap16(reclen);
+            de->d_fileno = tswap32(de->d_fileno);
+            len -= reclen;
+            de = (struct freebsd11_dirent *)((void *)de + reclen);
+        }
+    }
+    unlock_user(dirp, arg2, ret);
+    if (arg4) {
+        if (put_user(basep, arg4, abi_ulong)) {
+            return -TARGET_EFAULT;
+        }
+    }
+    return ret;
+}
+
 /* getdirecentries(2) */
 static inline abi_long do_freebsd_getdirentries(abi_long arg1,
         abi_ulong arg2, abi_long nbytes, abi_ulong arg4)

From 292f00c05bfa62a020eee5eb1d8c0983e8483b33 Mon Sep 17 00:00:00 2001
From: Michal Meloun <mmel@FreeBSD.org>
Date: Sun, 13 Aug 2023 10:41:47 +0200
Subject: [PATCH 1294/1353] bsd-user: Implement freebsd11 netbsd stat related
 syscalls

Forward declaration of the nstat syscalls:
nstat
nlstat
nfstat

Co-authored-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Stacey Son <sson@FreeBSD.org>
Signed-off-by: Michal Meloun <mmel@FreeBSD.org>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index 26909af455..e31b2aab9e 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -46,6 +46,13 @@ __sym_compat(getdirentries, freebsd11_getdirentries, FBSD_1.0);
 ssize_t freebsd11_getdents(int fd, char *buf, size_t nbytes);
 __sym_compat(getdents, freebsd11_getdents, FBSD_1.0);
 
+/* undocumented nstat system calls */
+int freebsd11_nstat(const char *path, struct freebsd11_stat *sb);
+__sym_compat(nstat, freebsd11_nstat, FBSD_1.0);
+int freebsd11_nlstat(const char *path, struct freebsd11_stat *sb);
+__sym_compat(nlstat, freebsd11_nlstat, FBSD_1.0);
+int freebsd11_nfstat(int fd, struct freebsd11_stat *sb);
+__sym_compat(nfstat, freebsd11_nfstat, FBSD_1.0);
 
 /* stat(2) */
 static inline abi_long do_freebsd11_stat(abi_long arg1, abi_long arg2)

From 292bfd0f512aa71fcc8f7e2f6ce2aa40a5a825ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Urankar?= <mikael.urankar@gmail.com>
Date: Sun, 13 Aug 2023 10:41:48 +0200
Subject: [PATCH 1295/1353] bsd-user: Implement do_freebsd_realpathat syscall
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Mikaël Urankar <mikael.urankar@gmail.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-stat.h | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/bsd-user/freebsd/os-stat.h b/bsd-user/freebsd/os-stat.h
index e31b2aab9e..b20e270774 100644
--- a/bsd-user/freebsd/os-stat.h
+++ b/bsd-user/freebsd/os-stat.h
@@ -634,4 +634,30 @@ static inline abi_long do_freebsd_fcntl(abi_long arg1, abi_long arg2,
     return ret;
 }
 
+#if defined(__FreeBSD_version) && __FreeBSD_version >= 1300080
+extern int __realpathat(int fd, const char *path, char *buf, size_t size,
+        int flags);
+/* https://svnweb.freebsd.org/base?view=revision&revision=358172 */
+/* no man page */
+static inline abi_long do_freebsd_realpathat(abi_long arg1, abi_long arg2,
+        abi_long arg3, abi_long arg4, abi_long arg5)
+{
+    abi_long ret;
+    void *p, *b;
+
+    LOCK_PATH(p, arg2);
+    b = lock_user(VERIFY_WRITE, arg3, arg4, 0);
+    if (b == NULL) {
+        UNLOCK_PATH(p, arg2);
+        return -TARGET_EFAULT;
+    }
+
+    ret = get_errno(__realpathat(arg1, p, b, arg4, arg5));
+    UNLOCK_PATH(p, arg2);
+    unlock_user(b, arg3, ret);
+
+    return ret;
+}
+#endif
+
 #endif /* BSD_USER_FREEBSD_OS_STAT_H */

From c97c1f3a9f4d4a5bebf88c844b9b3fc07c4296e3 Mon Sep 17 00:00:00 2001
From: Karim Taha <kariem.taha2.7@gmail.com>
Date: Sun, 13 Aug 2023 10:41:49 +0200
Subject: [PATCH 1296/1353] bsd-user: Add os-stat.c to the build

Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bsd-user/freebsd/meson.build b/bsd-user/freebsd/meson.build
index f87c788e84..f2f047cca3 100644
--- a/bsd-user/freebsd/meson.build
+++ b/bsd-user/freebsd/meson.build
@@ -1,4 +1,5 @@
 bsd_user_ss.add(files(
+  'os-stat.c',
   'os-sys.c',
   'os-syscall.c',
 ))

From e800e6c541b4088a52f4c0129eb4cbbf8a0ea9fb Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:50 +0200
Subject: [PATCH 1297/1353] bsd-user: Add glue for the freebsd11_stat syscalls

Add glue to call the freebsd11_stat syscalls to the freebsd_syscall:

freebsd11_stat
freebsd11_lstat
freebsd11_fstat
freebsd11_fstatat
freebsd11_nstat, freebsd11_nfstat, freebsd11_nlstat
fstatat
fstat

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-syscall.c | 42 +++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/bsd-user/freebsd/os-syscall.c b/bsd-user/freebsd/os-syscall.c
index 2224a280ea..ade47a0d2f 100644
--- a/bsd-user/freebsd/os-syscall.c
+++ b/bsd-user/freebsd/os-syscall.c
@@ -36,6 +36,9 @@
 #include "bsd-file.h"
 #include "bsd-proc.h"
 
+/* *BSD dependent syscall shims */
+#include "os-stat.h"
+
 /* I/O */
 safe_syscall3(int, open, const char *, path, int, flags, mode_t, mode);
 safe_syscall4(int, openat, int, fd, const char *, path, int, flags, mode_t,
@@ -482,6 +485,45 @@ static abi_long freebsd_syscall(void *cpu_env, int num, abi_long arg1,
         ret = do_bsd_undelete(arg1);
         break;
 
+        /*
+         * stat system calls
+         */
+    case TARGET_FREEBSD_NR_freebsd11_stat: /* stat(2) */
+        ret = do_freebsd11_stat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_lstat: /* lstat(2) */
+        ret = do_freebsd11_lstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_fstat: /* fstat(2) */
+        ret = do_freebsd11_fstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_fstat: /* fstat(2) */
+        ret = do_freebsd_fstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_fstatat: /* fstatat(2) */
+        ret = do_freebsd11_fstatat(arg1, arg2, arg3, arg4);
+        break;
+
+    case TARGET_FREEBSD_NR_fstatat: /* fstatat(2) */
+        ret = do_freebsd_fstatat(arg1, arg2, arg3, arg4);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_nstat: /* undocumented */
+        ret = do_freebsd11_nstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_nfstat: /* undocumented */
+        ret = do_freebsd11_nfstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_nlstat: /* undocumented */
+        ret = do_freebsd11_nlstat(arg1, arg2);
+        break;
+
         /*
          * sys{ctl, arch, call}
          */

From 6fe97c6cf7969bcf809a89ecabc30acf10b77735 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:51 +0200
Subject: [PATCH 1298/1353] bsd-user: Add glue for getfh and related syscalls

Add glue to call the following syscalls to the freebsd_syscall:

getfh
lgetfh
fhopen
freebsd11_fhstat
freebsd11_fhstatfs
fhstat
fhstatfs

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/freebsd/os-syscall.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/bsd-user/freebsd/os-syscall.c b/bsd-user/freebsd/os-syscall.c
index ade47a0d2f..73616a5be0 100644
--- a/bsd-user/freebsd/os-syscall.c
+++ b/bsd-user/freebsd/os-syscall.c
@@ -524,6 +524,34 @@ static abi_long freebsd_syscall(void *cpu_env, int num, abi_long arg1,
         ret = do_freebsd11_nlstat(arg1, arg2);
         break;
 
+    case TARGET_FREEBSD_NR_getfh: /* getfh(2) */
+        ret = do_freebsd_getfh(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_lgetfh: /* lgetfh(2) */
+        ret = do_freebsd_lgetfh(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_fhopen: /* fhopen(2) */
+        ret = do_freebsd_fhopen(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_fhstat: /* fhstat(2) */
+        ret = do_freebsd11_fhstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_fhstat: /* fhstat(2) */
+        ret = do_freebsd_fhstat(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_fhstatfs: /* fhstatfs(2) */
+        ret = do_freebsd11_fhstatfs(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_fhstatfs: /* fhstatfs(2) */
+        ret = do_freebsd_fhstatfs(arg1, arg2);
+        break;
+
         /*
          * sys{ctl, arch, call}
          */

From d7e9a545084ba1ded8fe864697db174cc3e6ebe2 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:52 +0200
Subject: [PATCH 1299/1353] bsd-user: Add glue for statfs related system calls

Add glue to call the following syscalls to the freebsd_syscall:

freebsd11_statfs
statfs
freebsd11_fstatfs
fstatfs
freebsd11_getfsstat
getfsstat

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 bsd-user/freebsd/os-syscall.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/bsd-user/freebsd/os-syscall.c b/bsd-user/freebsd/os-syscall.c
index 73616a5be0..916a754bf8 100644
--- a/bsd-user/freebsd/os-syscall.c
+++ b/bsd-user/freebsd/os-syscall.c
@@ -552,6 +552,30 @@ static abi_long freebsd_syscall(void *cpu_env, int num, abi_long arg1,
         ret = do_freebsd_fhstatfs(arg1, arg2);
         break;
 
+    case TARGET_FREEBSD_NR_freebsd11_statfs: /* statfs(2) */
+        ret = do_freebsd11_statfs(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_statfs: /* statfs(2) */
+        ret = do_freebsd_statfs(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_fstatfs: /* fstatfs(2) */
+        ret = do_freebsd11_fstatfs(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_fstatfs: /* fstatfs(2) */
+        ret = do_freebsd_fstatfs(arg1, arg2);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_getfsstat: /* getfsstat(2) */
+        ret = do_freebsd11_getfsstat(arg1, arg2, arg3);
+        break;
+
+    case TARGET_FREEBSD_NR_getfsstat: /* getfsstat(2) */
+        ret = do_freebsd_getfsstat(arg1, arg2, arg3);
+        break;
+
         /*
          * sys{ctl, arch, call}
          */

From 97a3c571147c3b62a79a994ebd85769419e630c2 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sun, 13 Aug 2023 10:41:53 +0200
Subject: [PATCH 1300/1353] bsd-user: Add getdents and fcntl related system
 calls

Add glue to call the following syscalls to the freebsd_syscall:

freebsd11_getdents
getdirentries
freebsd11_getdirentries
fcntl

Signed-off-by: Warner Losh <imp@bsdimp.com>
Signed-off-by: Karim Taha <kariem.taha2.7@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Warner Losh <imp@bsdimp.com>
---
 bsd-user/freebsd/os-syscall.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/bsd-user/freebsd/os-syscall.c b/bsd-user/freebsd/os-syscall.c
index 916a754bf8..e9b1b663af 100644
--- a/bsd-user/freebsd/os-syscall.c
+++ b/bsd-user/freebsd/os-syscall.c
@@ -576,6 +576,22 @@ static abi_long freebsd_syscall(void *cpu_env, int num, abi_long arg1,
         ret = do_freebsd_getfsstat(arg1, arg2, arg3);
         break;
 
+    case TARGET_FREEBSD_NR_freebsd11_getdents: /* getdents(2) */
+        ret = do_freebsd11_getdents(arg1, arg2, arg3);
+        break;
+
+    case TARGET_FREEBSD_NR_getdirentries: /* getdirentries(2) */
+        ret = do_freebsd_getdirentries(arg1, arg2, arg3, arg4);
+        break;
+
+    case TARGET_FREEBSD_NR_freebsd11_getdirentries: /* getdirentries(2) */
+        ret = do_freebsd11_getdirentries(arg1, arg2, arg3, arg4);
+        break;
+    case TARGET_FREEBSD_NR_fcntl: /* fcntl(2) */
+        ret = do_freebsd_fcntl(arg1, arg2, arg3);
+        break;
+
+
         /*
          * sys{ctl, arch, call}
          */

From f51e7c41acb4b17d28fc74f9f10df50a4a65fbcc Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Sat, 19 Aug 2023 22:54:19 -0600
Subject: [PATCH 1301/1353] bsd-user: Add missing break after do_bsd_preadv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without it, we'd call preadv, then write with weird parameters, which is
clearly not ideal...

Signed-off-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: 770d8abae7 ("bsd-user/bsd-file.h: Meat of the write system calls")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230820045419.89691-1-imp@bsdimp.com>
---
 bsd-user/freebsd/os-syscall.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bsd-user/freebsd/os-syscall.c b/bsd-user/freebsd/os-syscall.c
index e9b1b663af..fa60df529e 100644
--- a/bsd-user/freebsd/os-syscall.c
+++ b/bsd-user/freebsd/os-syscall.c
@@ -240,6 +240,7 @@ static abi_long freebsd_syscall(void *cpu_env, int num, abi_long arg1,
 
     case TARGET_FREEBSD_NR_preadv: /* preadv(2) */
         ret = do_bsd_preadv(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
+        break;
 
     case TARGET_FREEBSD_NR_write: /* write(2) */
         ret = do_bsd_write(arg1, arg2, arg3);

From 58b4def2a28b38d7c5d49e99beb31e45936b1096 Mon Sep 17 00:00:00 2001
From: "alloc.young" <alloc.young@outlook.com>
Date: Fri, 25 Aug 2023 10:31:20 +0800
Subject: [PATCH 1302/1353] softmmu: Fix dirtylimit memory leak

Fix memory leak in hmp_info_vcpu_dirty_limit,use g_autoptr
to handle memory deallocation.

Signed-off-by: alloc.young <alloc.young@outlook.com>
Reviewed-by: Hyman Huang <yong.huang@smartx.com>
Message-Id: <SA1PR11MB6760B9AB7EAFBDAFB524ED06F5E3A@SA1PR11MB6760.namprd11.prod.outlook.com>
Signed-off-by: Hyman Huang <yong.huang@smartx.com>
---
 softmmu/dirtylimit.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/softmmu/dirtylimit.c b/softmmu/dirtylimit.c
index 3c275ee55b..e3ff53b8fc 100644
--- a/softmmu/dirtylimit.c
+++ b/softmmu/dirtylimit.c
@@ -653,7 +653,8 @@ struct DirtyLimitInfoList *qmp_query_vcpu_dirty_limit(Error **errp)
 
 void hmp_info_vcpu_dirty_limit(Monitor *mon, const QDict *qdict)
 {
-    DirtyLimitInfoList *limit, *head, *info = NULL;
+    DirtyLimitInfoList *info;
+    g_autoptr(DirtyLimitInfoList) head = NULL;
     Error *err = NULL;
 
     if (!dirtylimit_in_service()) {
@@ -661,20 +662,17 @@ void hmp_info_vcpu_dirty_limit(Monitor *mon, const QDict *qdict)
         return;
     }
 
-    info = qmp_query_vcpu_dirty_limit(&err);
+    head = qmp_query_vcpu_dirty_limit(&err);
     if (err) {
         hmp_handle_error(mon, err);
         return;
     }
 
-    head = info;
-    for (limit = head; limit != NULL; limit = limit->next) {
+    for (info = head; info != NULL; info = info->next) {
         monitor_printf(mon, "vcpu[%"PRIi64"], limit rate %"PRIi64 " (MB/s),"
                             " current rate %"PRIi64 " (MB/s)\n",
-                            limit->value->cpu_index,
-                            limit->value->limit_rate,
-                            limit->value->current_rate);
+                            info->value->cpu_index,
+                            info->value->limit_rate,
+                            info->value->current_rate);
     }
-
-    g_free(info);
 }

From 19b14cea453b7429a06922fe96e55e6b32fe718a Mon Sep 17 00:00:00 2001
From: "alloc.young" <alloc.young@outlook.com>
Date: Fri, 25 Aug 2023 10:32:51 +0800
Subject: [PATCH 1303/1353] softmmu/dirtylimit: Convert free to g_free
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert free to g_free to match g_new and g_malloc functions.

Fixes: cc2b33eab0 ("softmmu/dirtylimit: Implement vCPU dirtyrate calculation periodically")
Fixes: baa609832e ("softmmu/dirtylimit: Implement virtual CPU throttle")
Signed-off-by: alloc.young <alloc.young@outlook.com>
Reviewed-by: Hyman Huang <yong.huang@smartx.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <SA1PR11MB67604ECD85AFF34BEB3072F7F5E3A@SA1PR11MB6760.namprd11.prod.outlook.com>
Signed-off-by: Hyman Huang <yong.huang@smartx.com>
---
 softmmu/dirtylimit.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/softmmu/dirtylimit.c b/softmmu/dirtylimit.c
index e3ff53b8fc..fa959d7743 100644
--- a/softmmu/dirtylimit.c
+++ b/softmmu/dirtylimit.c
@@ -100,7 +100,7 @@ static void vcpu_dirty_rate_stat_collect(void)
             stat.rates[i].dirty_rate;
     }
 
-    free(stat.rates);
+    g_free(stat.rates);
 }
 
 static void *vcpu_dirty_rate_stat_thread(void *opaque)
@@ -171,10 +171,10 @@ void vcpu_dirty_rate_stat_initialize(void)
 
 void vcpu_dirty_rate_stat_finalize(void)
 {
-    free(vcpu_dirty_rate_stat->stat.rates);
+    g_free(vcpu_dirty_rate_stat->stat.rates);
     vcpu_dirty_rate_stat->stat.rates = NULL;
 
-    free(vcpu_dirty_rate_stat);
+    g_free(vcpu_dirty_rate_stat);
     vcpu_dirty_rate_stat = NULL;
 }
 
@@ -220,10 +220,10 @@ void dirtylimit_state_initialize(void)
 
 void dirtylimit_state_finalize(void)
 {
-    free(dirtylimit_state->states);
+    g_free(dirtylimit_state->states);
     dirtylimit_state->states = NULL;
 
-    free(dirtylimit_state);
+    g_free(dirtylimit_state);
     dirtylimit_state = NULL;
 
     trace_dirtylimit_state_finalize();

From 3eb82637fbf8c0471990b59e6733fd4beb1f9939 Mon Sep 17 00:00:00 2001
From: Andrei Gudkov <gudkov.andrei@huawei.com>
Date: Mon, 28 Aug 2023 20:55:57 +0800
Subject: [PATCH 1304/1353] migration/dirtyrate: Fix precision losses and
 g_usleep overshoot

Signed-off-by: Andrei Gudkov <gudkov.andrei@huawei.com>
Reviewed-by: Hyman Huang <yong.huang@smartx.com>
Message-Id: <8ddb0d40d143f77aab8f602bd494e01e5fa01614.1691161009.git.gudkov.andrei@huawei.com>
Signed-off-by: Hyman Huang <yong.huang@smartx.com>
---
 migration/dirtyrate.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/migration/dirtyrate.c b/migration/dirtyrate.c
index 84f1b0fb20..bccb3515e3 100644
--- a/migration/dirtyrate.c
+++ b/migration/dirtyrate.c
@@ -57,6 +57,8 @@ static int64_t dirty_stat_wait(int64_t msec, int64_t initial_time)
         msec = current_time - initial_time;
     } else {
         g_usleep((msec + initial_time - current_time) * 1000);
+        /* g_usleep may overshoot */
+        msec = qemu_clock_get_ms(QEMU_CLOCK_REALTIME) - initial_time;
     }
 
     return msec;
@@ -77,9 +79,13 @@ static int64_t do_calculate_dirtyrate(DirtyPageRecord dirty_pages,
 {
     uint64_t increased_dirty_pages =
         dirty_pages.end_pages - dirty_pages.start_pages;
-    uint64_t memory_size_MiB = qemu_target_pages_to_MiB(increased_dirty_pages);
 
-    return memory_size_MiB * 1000 / calc_time_ms;
+    /*
+     * multiply by 1000ms/s _before_ converting down to megabytes
+     * to avoid losing precision
+     */
+    return qemu_target_pages_to_MiB(increased_dirty_pages * 1000) /
+        calc_time_ms;
 }
 
 void global_dirty_log_change(unsigned int flag, bool start)

From 86e4f93d827d3c1efd00cd8a906e38a2c0f2b5bc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Aug 2023 14:06:58 -0700
Subject: [PATCH 1305/1353] softmmu: Assert data in bounds in iotlb_to_section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Acked-by: Alex Bennée <alex.bennee@linaro.org>
Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 softmmu/physmem.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 3df73542e1..7597dc1c39 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2413,9 +2413,15 @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
     AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch);
-    MemoryRegionSection *sections = d->map.sections;
+    int section_index = index & ~TARGET_PAGE_MASK;
+    MemoryRegionSection *ret;
 
-    return &sections[index & ~TARGET_PAGE_MASK];
+    assert(section_index < d->map.sections_nb);
+    ret = d->map.sections + section_index;
+    assert(ret->mr);
+    assert(ret->mr->ops);
+
+    return ret;
 }
 
 static void io_mem_init(void)

From 0d58c660689f6da1e3feff8a997014003d928b3b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 25 Aug 2023 16:13:17 -0700
Subject: [PATCH 1306/1353] softmmu: Use async_run_on_cpu in tcg_commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After system startup, run the update to memory_dispatch
and the tlb_flush on the cpu.  This eliminates a race,
wherein a running cpu sees the memory_dispatch change
but has not yet seen the tlb_flush.

Since the update now happens on the cpu, we need not use
qatomic_rcu_read to protect the read of memory_dispatch.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1826
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1834
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1846
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cpu-exec-common.c | 30 ----------------------------
 include/exec/cpu-common.h   |  1 -
 softmmu/physmem.c           | 40 +++++++++++++++++++++++++++----------
 3 files changed, 29 insertions(+), 42 deletions(-)

diff --git a/accel/tcg/cpu-exec-common.c b/accel/tcg/cpu-exec-common.c
index 9a5fabf625..7e35d7f4b5 100644
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -33,36 +33,6 @@ void cpu_loop_exit_noexc(CPUState *cpu)
     cpu_loop_exit(cpu);
 }
 
-#if defined(CONFIG_SOFTMMU)
-void cpu_reloading_memory_map(void)
-{
-    if (qemu_in_vcpu_thread() && current_cpu->running) {
-        /* The guest can in theory prolong the RCU critical section as long
-         * as it feels like. The major problem with this is that because it
-         * can do multiple reconfigurations of the memory map within the
-         * critical section, we could potentially accumulate an unbounded
-         * collection of memory data structures awaiting reclamation.
-         *
-         * Because the only thing we're currently protecting with RCU is the
-         * memory data structures, it's sufficient to break the critical section
-         * in this callback, which we know will get called every time the
-         * memory map is rearranged.
-         *
-         * (If we add anything else in the system that uses RCU to protect
-         * its data structures, we will need to implement some other mechanism
-         * to force TCG CPUs to exit the critical section, at which point this
-         * part of this callback might become unnecessary.)
-         *
-         * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
-         * only protects cpu->as->dispatch. Since we know our caller is about
-         * to reload it, it's safe to split the critical section.
-         */
-        rcu_read_unlock();
-        rcu_read_lock();
-    }
-}
-#endif
-
 void cpu_loop_exit(CPUState *cpu)
 {
     /* Undo the setting in cpu_tb_exec.  */
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 87dc9a752c..41788c0bdd 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -133,7 +133,6 @@ static inline void cpu_physical_memory_write(hwaddr addr,
 {
     cpu_physical_memory_rw(addr, (void *)buf, len, true);
 }
-void cpu_reloading_memory_map(void);
 void *cpu_physical_memory_map(hwaddr addr,
                               hwaddr *plen,
                               bool is_write);
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 7597dc1c39..18277ddd67 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -680,8 +680,7 @@ address_space_translate_for_iotlb(CPUState *cpu, int asidx, hwaddr orig_addr,
     IOMMUTLBEntry iotlb;
     int iommu_idx;
     hwaddr addr = orig_addr;
-    AddressSpaceDispatch *d =
-        qatomic_rcu_read(&cpu->cpu_ases[asidx].memory_dispatch);
+    AddressSpaceDispatch *d = cpu->cpu_ases[asidx].memory_dispatch;
 
     for (;;) {
         section = address_space_translate_internal(d, addr, &addr, plen, false);
@@ -2412,7 +2411,7 @@ MemoryRegionSection *iotlb_to_section(CPUState *cpu,
 {
     int asidx = cpu_asidx_from_attrs(cpu, attrs);
     CPUAddressSpace *cpuas = &cpu->cpu_ases[asidx];
-    AddressSpaceDispatch *d = qatomic_rcu_read(&cpuas->memory_dispatch);
+    AddressSpaceDispatch *d = cpuas->memory_dispatch;
     int section_index = index & ~TARGET_PAGE_MASK;
     MemoryRegionSection *ret;
 
@@ -2487,23 +2486,42 @@ static void tcg_log_global_after_sync(MemoryListener *listener)
     }
 }
 
+static void tcg_commit_cpu(CPUState *cpu, run_on_cpu_data data)
+{
+    CPUAddressSpace *cpuas = data.host_ptr;
+
+    cpuas->memory_dispatch = address_space_to_dispatch(cpuas->as);
+    tlb_flush(cpu);
+}
+
 static void tcg_commit(MemoryListener *listener)
 {
     CPUAddressSpace *cpuas;
-    AddressSpaceDispatch *d;
+    CPUState *cpu;
 
     assert(tcg_enabled());
     /* since each CPU stores ram addresses in its TLB cache, we must
        reset the modified entries */
     cpuas = container_of(listener, CPUAddressSpace, tcg_as_listener);
-    cpu_reloading_memory_map();
-    /* The CPU and TLB are protected by the iothread lock.
-     * We reload the dispatch pointer now because cpu_reloading_memory_map()
-     * may have split the RCU critical section.
+    cpu = cpuas->cpu;
+
+    /*
+     * Defer changes to as->memory_dispatch until the cpu is quiescent.
+     * Otherwise we race between (1) other cpu threads and (2) ongoing
+     * i/o for the current cpu thread, with data cached by mmu_lookup().
+     *
+     * In addition, queueing the work function will kick the cpu back to
+     * the main loop, which will end the RCU critical section and reclaim
+     * the memory data structures.
+     *
+     * That said, the listener is also called during realize, before
+     * all of the tcg machinery for run-on is initialized: thus halt_cond.
      */
-    d = address_space_to_dispatch(cpuas->as);
-    qatomic_rcu_set(&cpuas->memory_dispatch, d);
-    tlb_flush(cpuas->cpu);
+    if (cpu->halt_cond) {
+        async_run_on_cpu(cpu, tcg_commit_cpu, RUN_ON_CPU_HOST_PTR(cpuas));
+    } else {
+        tcg_commit_cpu(cpu, RUN_ON_CPU_HOST_PTR(cpuas));
+    }
 }
 
 static void memory_map_init(void)

From 77fafcb50046f6c683f3cab9df975fdab43e1a68 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Aug 2023 12:15:35 -0700
Subject: [PATCH 1307/1353] tcg: Remove vecop_list check from tcg_gen_not_vec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The not pattern is always available via generic expansion.
See debug block in tcg_can_emit_vecop_list.

Fixes: 11978f6f58 ("tcg: Fix expansion of INDEX_op_not_vec")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-vec.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tcg/tcg-op-vec.c b/tcg/tcg-op-vec.c
index ad8ee08a7e..094298bb27 100644
--- a/tcg/tcg-op-vec.c
+++ b/tcg/tcg-op-vec.c
@@ -391,12 +391,11 @@ static bool do_op2(unsigned vece, TCGv_vec r, TCGv_vec a, TCGOpcode opc)
 
 void tcg_gen_not_vec(unsigned vece, TCGv_vec r, TCGv_vec a)
 {
-    const TCGOpcode *hold_list = tcg_swap_vecop_list(NULL);
-
-    if (!TCG_TARGET_HAS_not_vec || !do_op2(vece, r, a, INDEX_op_not_vec)) {
+    if (TCG_TARGET_HAS_not_vec) {
+        vec_gen_op2(INDEX_op_not_vec, 0, r, a);
+    } else {
         tcg_gen_xor_vec(0, r, a, tcg_constant_vec_matching(r, 0, -1));
     }
-    tcg_swap_vecop_list(hold_list);
 }
 
 void tcg_gen_neg_vec(unsigned vece, TCGv_vec r, TCGv_vec a)

From dad2f2f5afbaf58d6056f31dfd4b9edd0854b8ab Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 22 Aug 2023 11:02:00 -0700
Subject: [PATCH 1308/1353] tcg/sparc64: Disable TCG_TARGET_HAS_extr_i64_i32

Since a59a29312660 ("tcg/sparc64: Remove sparc32plus constraints")
we no longer distinguish registers with 32 vs 64 bits.
Therefore we can remove support for the backend-specific
type change opcodes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/sparc64/tcg-target.c.inc | 11 -----------
 tcg/sparc64/tcg-target.h     |  2 +-
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/tcg/sparc64/tcg-target.c.inc b/tcg/sparc64/tcg-target.c.inc
index f2a346a1bd..81a08bb6c5 100644
--- a/tcg/sparc64/tcg-target.c.inc
+++ b/tcg/sparc64/tcg-target.c.inc
@@ -529,11 +529,6 @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg rd, TCGReg rs)
     tcg_out_ext32u(s, rd, rs);
 }
 
-static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rs)
-{
-    tcg_out_mov(s, TCG_TYPE_I32, rd, rs);
-}
-
 static bool tcg_out_xchg(TCGContext *s, TCGType type, TCGReg r1, TCGReg r2)
 {
     return false;
@@ -1444,9 +1439,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_divu_i64:
         c = ARITH_UDIVX;
         goto gen_arith;
-    case INDEX_op_extrh_i64_i32:
-        tcg_out_arithi(s, a0, a1, 32, SHIFT_SRLX);
-        break;
 
     case INDEX_op_brcond_i64:
         tcg_out_brcond_i64(s, a2, a0, a1, const_args[1], arg_label(args[3]));
@@ -1501,7 +1493,6 @@ static void tcg_out_op(TCGContext *s, TCGOpcode opc,
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extrl_i64_i32:
     default:
         g_assert_not_reached();
     }
@@ -1533,8 +1524,6 @@ static TCGConstraintSetIndex tcg_target_op_def(TCGOpcode op)
     case INDEX_op_ext32u_i64:
     case INDEX_op_ext_i32_i64:
     case INDEX_op_extu_i32_i64:
-    case INDEX_op_extrl_i64_i32:
-    case INDEX_op_extrh_i64_i32:
     case INDEX_op_qemu_ld_a32_i32:
     case INDEX_op_qemu_ld_a64_i32:
     case INDEX_op_qemu_ld_a32_i64:
diff --git a/tcg/sparc64/tcg-target.h b/tcg/sparc64/tcg-target.h
index 3d41c9659b..5cfc4b4679 100644
--- a/tcg/sparc64/tcg-target.h
+++ b/tcg/sparc64/tcg-target.h
@@ -115,7 +115,7 @@ extern bool use_vis3_instructions;
 #define TCG_TARGET_HAS_mulsh_i32        0
 #define TCG_TARGET_HAS_qemu_st8_i32     0
 
-#define TCG_TARGET_HAS_extr_i64_i32     1
+#define TCG_TARGET_HAS_extr_i64_i32     0
 #define TCG_TARGET_HAS_div_i64          1
 #define TCG_TARGET_HAS_rem_i64          0
 #define TCG_TARGET_HAS_rot_i64          0

From 669fd6151337fdc81e34f7eb4940ba2f20d89957 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Aug 2023 11:29:09 -0700
Subject: [PATCH 1309/1353] Revert "include/exec: typedef abi_ptr to vaddr in
 softmmu"

This reverts commit fc15bfb6a6bda8d4d01f1383579d385acae17c0f.

This patch caused a regression for tricore-softmmu,
./tests/tcg/tricore-softmmu/test_boot_to_main.c.tst.

Reported-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/cpu_ldst.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
index f3ce4eb1d0..da10ba1433 100644
--- a/include/exec/cpu_ldst.h
+++ b/include/exec/cpu_ldst.h
@@ -121,8 +121,8 @@ static inline bool guest_range_valid_untagged(abi_ulong start, abi_ulong len)
     h2g_nocheck(x); \
 })
 #else
-typedef vaddr abi_ptr;
-#define TARGET_ABI_FMT_ptr "%016" VADDR_PRIx
+typedef target_ulong abi_ptr;
+#define TARGET_ABI_FMT_ptr TARGET_FMT_lx
 #endif
 
 uint32_t cpu_ldub_data(CPUArchState *env, abi_ptr ptr);

From f187609f27b261702a17f79d20bf252ee0d4f9cd Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Mon, 31 Jul 2023 17:33:38 -0300
Subject: [PATCH 1310/1353] block-migration: Ensure we don't crash during
 migration cleanup

We can fail the blk_insert_bs() at init_blk_migration(), leaving the
BlkMigDevState without a dirty_bitmap and BlockDriverState. Account
for the possibly missing elements when doing cleanup.

Fix the following crashes:

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555ec83ef in bdrv_release_dirty_bitmap (bitmap=0x0) at ../block/dirty-bitmap.c:359
359         BlockDriverState *bs = bitmap->bs;
 #0  0x0000555555ec83ef in bdrv_release_dirty_bitmap (bitmap=0x0) at ../block/dirty-bitmap.c:359
 #1  0x0000555555bba331 in unset_dirty_tracking () at ../migration/block.c:371
 #2  0x0000555555bbad98 in block_migration_cleanup_bmds () at ../migration/block.c:681

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555e971ff in bdrv_op_unblock (bs=0x0, op=BLOCK_OP_TYPE_BACKUP_SOURCE, reason=0x0) at ../block.c:7073
7073        QLIST_FOREACH_SAFE(blocker, &bs->op_blockers[op], list, next) {
 #0  0x0000555555e971ff in bdrv_op_unblock (bs=0x0, op=BLOCK_OP_TYPE_BACKUP_SOURCE, reason=0x0) at ../block.c:7073
 #1  0x0000555555e9734a in bdrv_op_unblock_all (bs=0x0, reason=0x0) at ../block.c:7095
 #2  0x0000555555bbae13 in block_migration_cleanup_bmds () at ../migration/block.c:690

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230731203338.27581-1-farosas@suse.de
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 migration/block.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/migration/block.c b/migration/block.c
index b9580a6c7e..86c2256a2b 100644
--- a/migration/block.c
+++ b/migration/block.c
@@ -368,7 +368,9 @@ static void unset_dirty_tracking(void)
     BlkMigDevState *bmds;
 
     QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        bdrv_release_dirty_bitmap(bmds->dirty_bitmap);
+        if (bmds->dirty_bitmap) {
+            bdrv_release_dirty_bitmap(bmds->dirty_bitmap);
+        }
     }
 }
 
@@ -676,13 +678,18 @@ static int64_t get_remaining_dirty(void)
 static void block_migration_cleanup_bmds(void)
 {
     BlkMigDevState *bmds;
+    BlockDriverState *bs;
     AioContext *ctx;
 
     unset_dirty_tracking();
 
     while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
         QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
-        bdrv_op_unblock_all(blk_bs(bmds->blk), bmds->blocker);
+
+        bs = blk_bs(bmds->blk);
+        if (bs) {
+            bdrv_op_unblock_all(bs, bmds->blocker);
+        }
         error_free(bmds->blocker);
 
         /* Save ctx, because bmds->blk can disappear during blk_unref.  */

From c54483b6f45a0c84e230728a1a9e7adf90345e15 Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Tue, 11 Jul 2023 20:25:51 +0300
Subject: [PATCH 1311/1353] block: add subcluster_size field to BlockDriverInfo

This is going to be used in the subsequent commit as requests alignment
(in particular, during copy-on-read).  This value only makes sense for
the formats which support subclusters (currently QCOW2 only).  If this
field isn't set by driver's own bdrv_get_info() implementation, we
simply set it equal to the cluster size thus treating each cluster as
having a single subcluster.

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20230711172553.234055-2-andrey.drobyshev@virtuozzo.com>
---
 block.c                      | 7 +++++++
 block/qcow2.c                | 1 +
 include/block/block-common.h | 5 +++++
 3 files changed, 13 insertions(+)

diff --git a/block.c b/block.c
index a307c151a8..0af890f647 100644
--- a/block.c
+++ b/block.c
@@ -6480,6 +6480,13 @@ int coroutine_fn bdrv_co_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
     }
     memset(bdi, 0, sizeof(*bdi));
     ret = drv->bdrv_co_get_info(bs, bdi);
+    if (bdi->subcluster_size == 0) {
+        /*
+         * If the driver left this unset, subclusters are not supported.
+         * Then it is safe to treat each cluster as having only one subcluster.
+         */
+        bdi->subcluster_size = bdi->cluster_size;
+    }
     if (ret < 0) {
         return ret;
     }
diff --git a/block/qcow2.c b/block/qcow2.c
index c51388e99d..b48cd9ce63 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -5197,6 +5197,7 @@ qcow2_co_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
     BDRVQcow2State *s = bs->opaque;
     bdi->cluster_size = s->cluster_size;
+    bdi->subcluster_size = s->subcluster_size;
     bdi->vm_state_offset = qcow2_vm_state_offset(s);
     bdi->is_dirty = s->incompatible_features & QCOW2_INCOMPAT_DIRTY;
     return 0;
diff --git a/include/block/block-common.h b/include/block/block-common.h
index e15395f2cb..df5ffc8d09 100644
--- a/include/block/block-common.h
+++ b/include/block/block-common.h
@@ -132,6 +132,11 @@ typedef struct BlockZoneWps {
 typedef struct BlockDriverInfo {
     /* in bytes, 0 if irrelevant */
     int cluster_size;
+    /*
+     * A fraction of cluster_size, if supported (currently QCOW2 only); if
+     * disabled or unsupported, set equal to cluster_size.
+     */
+    int subcluster_size;
     /* offset at which the VM state can be saved (0 if not possible) */
     int64_t vm_state_offset;
     bool is_dirty;

From fc6b211f920a68f4c9c8db91ccc35ca95fe6683a Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Tue, 11 Jul 2023 20:25:52 +0300
Subject: [PATCH 1312/1353] block/io: align requests to subcluster_size

When target image is using subclusters, and we align the request during
copy-on-read, it makes sense to align to subcluster_size rather than
cluster_size.  Otherwise we end up with unnecessary allocations.

This commit renames bdrv_round_to_clusters() to bdrv_round_to_subclusters()
and utilizes subcluster_size field of BlockDriverInfo to make necessary
alignments.  It affects copy-on-read as well as mirror job (which is
using bdrv_round_to_clusters()).

This change also fixes the following bug with failing assert (covered by
the test in the subsequent commit):

qemu-img create -f qcow2 base.qcow2 64K
qemu-img create -f qcow2 -o extended_l2=on,backing_file=base.qcow2,backing_fmt=qcow2 img.qcow2 64K
qemu-io -c "write -P 0xaa 0 2K" img.qcow2
qemu-io -C -c "read -P 0x00 2K 62K" img.qcow2

qemu-io: ../block/io.c:1236: bdrv_co_do_copy_on_readv: Assertion `skip_bytes < pnum' failed.

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20230711172553.234055-3-andrey.drobyshev@virtuozzo.com>
---
 block/io.c               | 50 ++++++++++++++++++++--------------------
 block/mirror.c           |  8 +++----
 include/block/block-io.h |  8 +++----
 3 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/block/io.c b/block/io.c
index 055fcf7438..76e7df18d8 100644
--- a/block/io.c
+++ b/block/io.c
@@ -728,21 +728,21 @@ BdrvTrackedRequest *coroutine_fn bdrv_co_get_self_request(BlockDriverState *bs)
 }
 
 /**
- * Round a region to cluster boundaries
+ * Round a region to subcluster (if supported) or cluster boundaries
  */
 void coroutine_fn GRAPH_RDLOCK
-bdrv_round_to_clusters(BlockDriverState *bs, int64_t offset, int64_t bytes,
-                       int64_t *cluster_offset, int64_t *cluster_bytes)
+bdrv_round_to_subclusters(BlockDriverState *bs, int64_t offset, int64_t bytes,
+                          int64_t *align_offset, int64_t *align_bytes)
 {
     BlockDriverInfo bdi;
     IO_CODE();
-    if (bdrv_co_get_info(bs, &bdi) < 0 || bdi.cluster_size == 0) {
-        *cluster_offset = offset;
-        *cluster_bytes = bytes;
+    if (bdrv_co_get_info(bs, &bdi) < 0 || bdi.subcluster_size == 0) {
+        *align_offset = offset;
+        *align_bytes = bytes;
     } else {
-        int64_t c = bdi.cluster_size;
-        *cluster_offset = QEMU_ALIGN_DOWN(offset, c);
-        *cluster_bytes = QEMU_ALIGN_UP(offset - *cluster_offset + bytes, c);
+        int64_t c = bdi.subcluster_size;
+        *align_offset = QEMU_ALIGN_DOWN(offset, c);
+        *align_bytes = QEMU_ALIGN_UP(offset - *align_offset + bytes, c);
     }
 }
 
@@ -1168,8 +1168,8 @@ bdrv_co_do_copy_on_readv(BdrvChild *child, int64_t offset, int64_t bytes,
     void *bounce_buffer = NULL;
 
     BlockDriver *drv = bs->drv;
-    int64_t cluster_offset;
-    int64_t cluster_bytes;
+    int64_t align_offset;
+    int64_t align_bytes;
     int64_t skip_bytes;
     int ret;
     int max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
@@ -1203,28 +1203,28 @@ bdrv_co_do_copy_on_readv(BdrvChild *child, int64_t offset, int64_t bytes,
      * BDRV_REQUEST_MAX_BYTES (even when the original read did not), which
      * is one reason we loop rather than doing it all at once.
      */
-    bdrv_round_to_clusters(bs, offset, bytes, &cluster_offset, &cluster_bytes);
-    skip_bytes = offset - cluster_offset;
+    bdrv_round_to_subclusters(bs, offset, bytes, &align_offset, &align_bytes);
+    skip_bytes = offset - align_offset;
 
     trace_bdrv_co_do_copy_on_readv(bs, offset, bytes,
-                                   cluster_offset, cluster_bytes);
+                                   align_offset, align_bytes);
 
-    while (cluster_bytes) {
+    while (align_bytes) {
         int64_t pnum;
 
         if (skip_write) {
             ret = 1; /* "already allocated", so nothing will be copied */
-            pnum = MIN(cluster_bytes, max_transfer);
+            pnum = MIN(align_bytes, max_transfer);
         } else {
-            ret = bdrv_is_allocated(bs, cluster_offset,
-                                    MIN(cluster_bytes, max_transfer), &pnum);
+            ret = bdrv_is_allocated(bs, align_offset,
+                                    MIN(align_bytes, max_transfer), &pnum);
             if (ret < 0) {
                 /*
                  * Safe to treat errors in querying allocation as if
                  * unallocated; we'll probably fail again soon on the
                  * read, but at least that will set a decent errno.
                  */
-                pnum = MIN(cluster_bytes, max_transfer);
+                pnum = MIN(align_bytes, max_transfer);
             }
 
             /* Stop at EOF if the image ends in the middle of the cluster */
@@ -1242,7 +1242,7 @@ bdrv_co_do_copy_on_readv(BdrvChild *child, int64_t offset, int64_t bytes,
             /* Must copy-on-read; use the bounce buffer */
             pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
             if (!bounce_buffer) {
-                int64_t max_we_need = MAX(pnum, cluster_bytes - pnum);
+                int64_t max_we_need = MAX(pnum, align_bytes - pnum);
                 int64_t max_allowed = MIN(max_transfer, MAX_BOUNCE_BUFFER);
                 int64_t bounce_buffer_len = MIN(max_we_need, max_allowed);
 
@@ -1254,7 +1254,7 @@ bdrv_co_do_copy_on_readv(BdrvChild *child, int64_t offset, int64_t bytes,
             }
             qemu_iovec_init_buf(&local_qiov, bounce_buffer, pnum);
 
-            ret = bdrv_driver_preadv(bs, cluster_offset, pnum,
+            ret = bdrv_driver_preadv(bs, align_offset, pnum,
                                      &local_qiov, 0, 0);
             if (ret < 0) {
                 goto err;
@@ -1266,13 +1266,13 @@ bdrv_co_do_copy_on_readv(BdrvChild *child, int64_t offset, int64_t bytes,
                 /* FIXME: Should we (perhaps conditionally) be setting
                  * BDRV_REQ_MAY_UNMAP, if it will allow for a sparser copy
                  * that still correctly reads as zero? */
-                ret = bdrv_co_do_pwrite_zeroes(bs, cluster_offset, pnum,
+                ret = bdrv_co_do_pwrite_zeroes(bs, align_offset, pnum,
                                                BDRV_REQ_WRITE_UNCHANGED);
             } else {
                 /* This does not change the data on the disk, it is not
                  * necessary to flush even in cache=writethrough mode.
                  */
-                ret = bdrv_driver_pwritev(bs, cluster_offset, pnum,
+                ret = bdrv_driver_pwritev(bs, align_offset, pnum,
                                           &local_qiov, 0,
                                           BDRV_REQ_WRITE_UNCHANGED);
             }
@@ -1301,8 +1301,8 @@ bdrv_co_do_copy_on_readv(BdrvChild *child, int64_t offset, int64_t bytes,
             }
         }
 
-        cluster_offset += pnum;
-        cluster_bytes -= pnum;
+        align_offset += pnum;
+        align_bytes -= pnum;
         progress += pnum - skip_bytes;
         skip_bytes = 0;
     }
diff --git a/block/mirror.c b/block/mirror.c
index d3cacd1708..e213a892db 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -283,8 +283,8 @@ static int coroutine_fn mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
     need_cow |= !test_bit((*offset + *bytes - 1) / s->granularity,
                           s->cow_bitmap);
     if (need_cow) {
-        bdrv_round_to_clusters(blk_bs(s->target), *offset, *bytes,
-                               &align_offset, &align_bytes);
+        bdrv_round_to_subclusters(blk_bs(s->target), *offset, *bytes,
+                                  &align_offset, &align_bytes);
     }
 
     if (align_bytes > max_bytes) {
@@ -576,8 +576,8 @@ static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
             int64_t target_offset;
             int64_t target_bytes;
             WITH_GRAPH_RDLOCK_GUARD() {
-                bdrv_round_to_clusters(blk_bs(s->target), offset, io_bytes,
-                                       &target_offset, &target_bytes);
+                bdrv_round_to_subclusters(blk_bs(s->target), offset, io_bytes,
+                                          &target_offset, &target_bytes);
             }
             if (target_offset == offset &&
                 target_bytes == io_bytes) {
diff --git a/include/block/block-io.h b/include/block/block-io.h
index 4415506e40..6db48f2d35 100644
--- a/include/block/block-io.h
+++ b/include/block/block-io.h
@@ -189,10 +189,10 @@ bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
 ImageInfoSpecific *bdrv_get_specific_info(BlockDriverState *bs,
                                           Error **errp);
 BlockStatsSpecific *bdrv_get_specific_stats(BlockDriverState *bs);
-void bdrv_round_to_clusters(BlockDriverState *bs,
-                            int64_t offset, int64_t bytes,
-                            int64_t *cluster_offset,
-                            int64_t *cluster_bytes);
+void bdrv_round_to_subclusters(BlockDriverState *bs,
+                               int64_t offset, int64_t bytes,
+                               int64_t *cluster_offset,
+                               int64_t *cluster_bytes);
 
 void bdrv_get_backing_filename(BlockDriverState *bs,
                                char *filename, int filename_size);

From e2f938265e0aa8486303d260f3cb13d5bb9e9d6a Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Tue, 11 Jul 2023 20:25:53 +0300
Subject: [PATCH 1313/1353] tests/qemu-iotests/197: add testcase for CoR with
 subclusters

Add testcase which checks that allocations during copy-on-read are
performed on the subcluster basis when subclusters are enabled in target
image.

This testcase also triggers the following assert with previous commit
not being applied, so we check that as well:

qemu-io: ../block/io.c:1236: bdrv_co_do_copy_on_readv: Assertion `skip_bytes < pnum' failed.

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20230711172553.234055-4-andrey.drobyshev@virtuozzo.com>
---
 tests/qemu-iotests/197     | 29 +++++++++++++++++++++++++++++
 tests/qemu-iotests/197.out | 24 ++++++++++++++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/tests/qemu-iotests/197 b/tests/qemu-iotests/197
index a2547bc280..f07a9da136 100755
--- a/tests/qemu-iotests/197
+++ b/tests/qemu-iotests/197
@@ -122,6 +122,35 @@ $QEMU_IO -f qcow2 -C -c 'read 0 1024' "$TEST_WRAP" | _filter_qemu_io
 $QEMU_IO -f qcow2 -c map "$TEST_WRAP"
 _check_test_img
 
+echo
+echo '=== Copy-on-read with subclusters ==='
+echo
+
+# Create base and top images 64K (1 cluster) each.  Make subclusters enabled
+# for the top image
+_make_test_img 64K
+IMGPROTO=file IMGFMT=qcow2 TEST_IMG_FILE="$TEST_WRAP" \
+    _make_test_img --no-opts -o extended_l2=true -F "$IMGFMT" -b "$TEST_IMG" \
+    64K | _filter_img_create
+
+$QEMU_IO -c "write -P 0xaa 0 64k" "$TEST_IMG" | _filter_qemu_io
+
+# Allocate individual subclusters in the top image, and not the whole cluster
+$QEMU_IO -c "write -P 0xbb 28K 2K" -c "write -P 0xcc 34K 2K" "$TEST_WRAP" \
+    | _filter_qemu_io
+
+# Only 2 subclusters should be allocated in the top image at this point
+$QEMU_IMG map "$TEST_WRAP" | _filter_qemu_img_map
+
+# Actual copy-on-read operation
+$QEMU_IO -C -c "read -P 0xaa 30K 4K" "$TEST_WRAP" | _filter_qemu_io
+
+# And here we should have 4 subclusters allocated right in the middle of the
+# top image. Make sure the whole cluster remains unallocated
+$QEMU_IMG map "$TEST_WRAP" | _filter_qemu_img_map
+
+_check_test_img
+
 # success, all done
 echo '*** done'
 status=0
diff --git a/tests/qemu-iotests/197.out b/tests/qemu-iotests/197.out
index ad414c3b0e..8f34a30afe 100644
--- a/tests/qemu-iotests/197.out
+++ b/tests/qemu-iotests/197.out
@@ -31,4 +31,28 @@ read 1024/1024 bytes at offset 0
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 1 KiB (0x400) bytes     allocated at offset 0 bytes (0x0)
 No errors were found on the image.
+
+=== Copy-on-read with subclusters ===
+
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=65536
+Formatting 'TEST_DIR/t.wrap.IMGFMT', fmt=IMGFMT size=65536 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
+wrote 65536/65536 bytes at offset 0
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 2048/2048 bytes at offset 28672
+2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 2048/2048 bytes at offset 34816
+2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+Offset          Length          File
+0               0x7000          TEST_DIR/t.IMGFMT
+0x7000          0x800           TEST_DIR/t.wrap.IMGFMT
+0x7800          0x1000          TEST_DIR/t.IMGFMT
+0x8800          0x800           TEST_DIR/t.wrap.IMGFMT
+0x9000          0x7000          TEST_DIR/t.IMGFMT
+read 4096/4096 bytes at offset 30720
+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+Offset          Length          File
+0               0x7000          TEST_DIR/t.IMGFMT
+0x7000          0x2000          TEST_DIR/t.wrap.IMGFMT
+0x9000          0x7000          TEST_DIR/t.IMGFMT
+No errors were found on the image.
 *** done

From 87ec6f55af38e29be5b2b65a8acf84da73e06d06 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Wed, 26 Apr 2023 17:26:39 -0400
Subject: [PATCH 1314/1353] aio-posix: zero out io_uring sqe user_data

liburing does not clear sqe->user_data. We must do it ourselves to avoid
undefined behavior in process_cqe() when user_data is used.

Note that fdmon-io_uring is currently disabled, so this is a latent bug
that does not affect users. Let's merge this fix now to make it easier
to enable fdmon-io_uring in the future (and I'm working on that).

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20230426212639.82310-1-stefanha@redhat.com>
---
 util/fdmon-io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index 17ec18b7bd..16054c5ede 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -184,6 +184,7 @@ static void add_poll_remove_sqe(AioContext *ctx, AioHandler *node)
 #else
     io_uring_prep_poll_remove(sqe, node);
 #endif
+    io_uring_sqe_set_data(sqe, NULL);
 }
 
 /* Add a timeout that self-cancels when another cqe becomes ready */
@@ -197,6 +198,7 @@ static void add_timeout_sqe(AioContext *ctx, int64_t ns)
 
     sqe = get_sqe(ctx);
     io_uring_prep_timeout(sqe, &ts, 1, 0);
+    io_uring_sqe_set_data(sqe, NULL);
 }
 
 /* Add sqes from ctx->submit_list for submission */

From 2f7350cd43ebda0011c9cf191c621eed1439bcf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 29 Aug 2023 17:15:17 +0100
Subject: [PATCH 1315/1353] gitlab: enable ccache for many build jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `ccache` tool can be very effective at reducing compilation times
when re-running pipelines with only minor changes each time. For example
a fresh 'build-system-fedora' job will typically take 20 minutes on the
gitlab.com shared runners. With ccache this is reduced to as little as
6 minutes.

Normally meson would auto-detect existance of ccache in $PATH and use
it automatically, but the way we wrap meson from configure breaks this,
as we're passing in an config file with explicitly set compiler paths.
Thus we need to add $CCACHE_WRAPPERSPATH to the front of $PATH. For
unknown reasons if doing this in msys though, gcc becomes unable to
invoke 'cc1' when run from meson. For msys we thus set CC='ccache gcc'
before invoking 'configure' instead.

A second problem with msys is that cache misses are incredibly
expensive, so enabling ccache massively slows down the build when
the cache isn't well populated. This is suspected to be a result of
the cost of spawning processes under the msys architecture. To deal
with this we set CCACHE_DEPEND=1 which enables ccache's 'depend_only'
strategy. This avoids extra spawning of the pre-processor during
cache misses, with the downside that is it less likely ccache will
find a cache hit after semantically benign compiler flag changes.
This is the lesser of two evils, as otherwise we can't use ccache
at all under msys and remain inside the job time limit.

If people are finding ccache to hurt their pipelines, it can be
disabled by setting the 'CCACHE_DISABLE=1' env variable against
their gitlab fork CI settings.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230804111054.281802-2-berrange@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-2-alex.bennee@linaro.org>
---
 .gitlab-ci.d/buildtest-template.yml           | 11 ++++++++
 .gitlab-ci.d/crossbuild-template.yml          | 26 +++++++++++++++++++
 .gitlab-ci.d/windows.yml                      | 13 ++++++++--
 docs/devel/ci-jobs.rst.inc                    |  7 +++++
 .../dockerfiles/debian-hexagon-cross.docker   |  9 ++++++-
 5 files changed, 63 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index f3e39b7eb1..4fbfeb6667 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -2,11 +2,21 @@
   extends: .base_job_template
   stage: build
   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
+  cache:
+    paths:
+      - ccache
+    key: "$CI_JOB_NAME"
+    when: always
   before_script:
     - JOBS=$(expr $(nproc) + 1)
   script:
+    - export CCACHE_BASEDIR="$(pwd)"
+    - export CCACHE_DIR="$CCACHE_BASEDIR/ccache"
+    - export CCACHE_MAXSIZE="500M"
+    - export PATH="$CCACHE_WRAPPERSDIR:$PATH"
     - mkdir build
     - cd build
+    - ccache --zero-stats
     - ../configure --enable-werror --disable-docs --enable-fdt=system
           ${TARGETS:+--target-list="$TARGETS"}
           $CONFIGURE_ARGS ||
@@ -20,6 +30,7 @@
       then
         make -j"$JOBS" $MAKE_CHECK_ARGS ;
       fi
+    - ccache --show-stats
 
 # We jump some hoops in common_test_job_template to avoid
 # rebuilding all the object files we skip in the artifacts
diff --git a/.gitlab-ci.d/crossbuild-template.yml b/.gitlab-ci.d/crossbuild-template.yml
index d97611053b..3e5f4d9cd8 100644
--- a/.gitlab-ci.d/crossbuild-template.yml
+++ b/.gitlab-ci.d/crossbuild-template.yml
@@ -2,10 +2,20 @@
   extends: .base_job_template
   stage: build
   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
+  cache:
+    paths:
+      - ccache
+    key: "$CI_JOB_NAME"
+    when: always
   timeout: 80m
   script:
+    - export CCACHE_BASEDIR="$(pwd)"
+    - export CCACHE_DIR="$CCACHE_BASEDIR/ccache"
+    - export CCACHE_MAXSIZE="500M"
+    - export PATH="$CCACHE_WRAPPERSDIR:$PATH"
     - mkdir build
     - cd build
+    - ccache --zero-stats
     - ../configure --enable-werror --disable-docs --enable-fdt=system
         --disable-user $QEMU_CONFIGURE_OPTS $EXTRA_CONFIGURE_OPTS
         --target-list-exclude="arm-softmmu cris-softmmu
@@ -18,6 +28,7 @@
       version="$(git describe --match v[0-9]* 2>/dev/null || git rev-parse --short HEAD)";
       mv -v qemu-setup*.exe qemu-setup-${version}.exe;
       fi
+    - ccache --show-stats
 
 # Job to cross-build specific accelerators.
 #
@@ -29,7 +40,15 @@
   stage: build
   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   timeout: 30m
+  cache:
+    paths:
+      - ccache/
+    key: "$CI_JOB_NAME"
   script:
+    - export CCACHE_BASEDIR="$(pwd)"
+    - export CCACHE_DIR="$CCACHE_BASEDIR/ccache"
+    - export CCACHE_MAXSIZE="500M"
+    - export PATH="$CCACHE_WRAPPERSDIR:$PATH"
     - mkdir build
     - cd build
     - ../configure --enable-werror --disable-docs $QEMU_CONFIGURE_OPTS
@@ -40,7 +59,14 @@
   extends: .base_job_template
   stage: build
   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
+  cache:
+    paths:
+      - ccache/
+    key: "$CI_JOB_NAME"
   script:
+    - export CCACHE_BASEDIR="$(pwd)"
+    - export CCACHE_DIR="$CCACHE_BASEDIR/ccache"
+    - export CCACHE_MAXSIZE="500M"
     - mkdir build
     - cd build
     - ../configure --enable-werror --disable-docs $QEMU_CONFIGURE_OPTS
diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index cd7622a761..12a987cd71 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -5,13 +5,14 @@
   - windows
   - windows-1809
   cache:
-    key: "${CI_JOB_NAME}-cache"
+    key: "$CI_JOB_NAME"
     paths:
       - msys64/var/cache
+      - ccache
     when: always
   needs: []
   stage: build
-  timeout: 80m
+  timeout: 100m
   variables:
     # This feature doesn't (currently) work with PowerShell, it stops
     # the echo'ing of commands being run and doesn't show any timing
@@ -72,6 +73,7 @@
       bison diffutils flex
       git grep make sed
       $MINGW_TARGET-capstone
+      $MINGW_TARGET-ccache
       $MINGW_TARGET-curl
       $MINGW_TARGET-cyrus-sasl
       $MINGW_TARGET-dtc
@@ -101,11 +103,18 @@
   - Write-Output "Running build at $(Get-Date -Format u)"
   - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory
   - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
+  - $env:CCACHE_BASEDIR = "$env:CI_PROJECT_DIR"
+  - $env:CCACHE_DIR = "$env:CCACHE_BASEDIR/ccache"
+  - $env:CCACHE_MAXSIZE = "500M"
+  - $env:CCACHE_DEPEND = 1 # cache misses are too expensive with preprocessor mode
+  - $env:CC = "ccache gcc"
   - mkdir build
   - cd build
+  - ..\msys64\usr\bin\bash -lc "ccache --zero-stats"
   - ..\msys64\usr\bin\bash -lc "../configure --enable-fdt=system $CONFIGURE_ARGS"
   - ..\msys64\usr\bin\bash -lc "make"
   - ..\msys64\usr\bin\bash -lc "make check MTESTARGS='$TEST_ARGS' || { cat meson-logs/testlog.txt; exit 1; } ;"
+  - ..\msys64\usr\bin\bash -lc "ccache --show-stats"
   - Write-Output "Finished build at $(Get-Date -Format u)"
 
 msys2-64bit:
diff --git a/docs/devel/ci-jobs.rst.inc b/docs/devel/ci-jobs.rst.inc
index 3f6802d51e..4c39cdb2d9 100644
--- a/docs/devel/ci-jobs.rst.inc
+++ b/docs/devel/ci-jobs.rst.inc
@@ -188,3 +188,10 @@ If you've got access to a CentOS Stream 8 x86_64 host that can be
 used as a gitlab-CI runner, you can set this variable to enable the
 tests that require this kind of host. The runner should be tagged with
 both "centos_stream_8" and "x86_64".
+
+CCACHE_DISABLE
+~~~~~~~~~~~~~~
+The jobs are configured to use "ccache" by default since this typically
+reduces compilation time, at the cost of increased storage. If the
+use of "ccache" is suspected to be hurting the overall job execution
+time, setting the "CCACHE_DISABLE=1" env variable to disable it.
diff --git a/tests/docker/dockerfiles/debian-hexagon-cross.docker b/tests/docker/dockerfiles/debian-hexagon-cross.docker
index 153fc7cfb3..7c38d7c9e4 100644
--- a/tests/docker/dockerfiles/debian-hexagon-cross.docker
+++ b/tests/docker/dockerfiles/debian-hexagon-cross.docker
@@ -15,6 +15,7 @@ RUN apt-get update && \
 # Install common build utilities
     apt-get install -y --no-install-recommends \
         curl \
+        ccache \
         xz-utils \
         ca-certificates \
         bison \
@@ -27,7 +28,12 @@ RUN apt-get update && \
         python3-wheel && \
 # Install QEMU build deps for use in CI
     DEBIAN_FRONTEND=noninteractive eatmydata \
-    apt build-dep -yy --arch-only qemu
+    apt build-dep -yy --arch-only qemu && \
+    mkdir -p /usr/libexec/ccache-wrappers && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/c++ && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/g++ && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
 RUN /usr/bin/pip3 install tomli
 
@@ -35,6 +41,7 @@ ENV TOOLCHAIN_INSTALL /opt
 ENV TOOLCHAIN_RELEASE 16.0.0
 ENV TOOLCHAIN_BASENAME "clang+llvm-${TOOLCHAIN_RELEASE}-cross-hexagon-unknown-linux-musl"
 ENV TOOLCHAIN_URL https://codelinaro.jfrog.io/artifactory/codelinaro-toolchain-for-hexagon/v${TOOLCHAIN_RELEASE}/${TOOLCHAIN_BASENAME}.tar.xz
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 
 RUN curl -#SL "$TOOLCHAIN_URL" | tar -xJC "$TOOLCHAIN_INSTALL"
 ENV PATH $PATH:${TOOLCHAIN_INSTALL}/${TOOLCHAIN_BASENAME}/x86_64-linux-gnu/bin

From 6445c2cace9f284e8326510c01d6d83c2bef12da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:18 +0100
Subject: [PATCH 1316/1353] tests/docker: cleanup non-verbose output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Even with --quiet docker will spam the sha256 to the console. Avoid
this by redirecting stdout. While we are at it fix the name we echo
which was broken during 0b1a649047 (tests/docker: use direct RUNC call
to build containers).

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-3-alex.bennee@linaro.org>
---
 tests/docker/Makefile.include | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/docker/Makefile.include b/tests/docker/Makefile.include
index 142e8605ee..dfabafab92 100644
--- a/tests/docker/Makefile.include
+++ b/tests/docker/Makefile.include
@@ -46,9 +46,9 @@ docker-image-%: $(DOCKER_FILES_DIR)/%.docker
 		--build-arg BUILDKIT_INLINE_CACHE=1 	\
 		$(if $(NOUSER),,			\
 			--build-arg USER=$(USER)	\
-			--build-arg UID=$(UID))	\
-		-t qemu/$* - < $<, 			\
-		"BUILD", $1)
+			--build-arg UID=$(UID))		\
+		-t qemu/$* - < $< $(if $V,,> /dev/null),\
+		"BUILD", $*)
 
 # Special rule for debootstraped binfmt linux-user images
 docker-binfmt-image-debian-%: $(DOCKER_FILES_DIR)/debian-bootstrap.docker

From bb16cb45192b344c8bd5e3c2f423b96fb438ed29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:19 +0100
Subject: [PATCH 1317/1353] tests/tcg: remove quoting for info output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This avoids ugly multi-line wrapping for the test on non V=1 builds.

Acked-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-4-alex.bennee@linaro.org>
---
 tests/tcg/aarch64/Makefile.target                  | 2 +-
 tests/tcg/multiarch/system/Makefile.softmmu-target | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 681dfa077c..b77bbd9b3c 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -14,7 +14,7 @@ AARCH64_TESTS=fcvt pcalign-a64 lse2-fault
 fcvt: LDFLAGS+=-lm
 
 run-fcvt: fcvt
-	$(call run-test,$<,$(QEMU) $<, "$< on $(TARGET_NAME)")
+	$(call run-test,$<,$(QEMU) $<)
 	$(call diff-out,$<,$(AARCH64_SRC)/fcvt.ref)
 
 config-cc.mak: Makefile
diff --git a/tests/tcg/multiarch/system/Makefile.softmmu-target b/tests/tcg/multiarch/system/Makefile.softmmu-target
index 7ba9053375..a051d689d7 100644
--- a/tests/tcg/multiarch/system/Makefile.softmmu-target
+++ b/tests/tcg/multiarch/system/Makefile.softmmu-target
@@ -37,10 +37,10 @@ run-gdbstub-untimely-packet: hello
 		--qemu $(QEMU) \
 		--bin $< --qargs \
 		"-monitor none -display none -chardev file$(COMMA)path=untimely-packet.out$(COMMA)id=output $(QEMU_OPTS)", \
-	"softmmu gdbstub untimely packets")
+	softmmu gdbstub untimely packets)
 	$(call quiet-command, \
 		(! grep -Fq 'Packet instead of Ack, ignoring it' untimely-packet.gdb.err), \
-		"GREP", "file  untimely-packet.gdb.err")
+		"GREP", file untimely-packet.gdb.err)
 else
 run-gdbstub-%:
 	$(call skip-test, "gdbstub test $*", "no guest arch support")

From 4b77429adbecf970d0ebb7213b99b82771b6368f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:20 +0100
Subject: [PATCH 1318/1353] docs/style: permit inline loop variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I've already wasted enough of my time debugging aliased variables in
deeply nested loops. While not scattering variable declarations around
is a good aim I think we can make an exception for stuff used inside a
loop.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-5-alex.bennee@linaro.org>
---
 docs/devel/style.rst | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/docs/devel/style.rst b/docs/devel/style.rst
index 3cfcdeb9cd..2f68b50079 100644
--- a/docs/devel/style.rst
+++ b/docs/devel/style.rst
@@ -204,7 +204,14 @@ Declarations
 
 Mixed declarations (interleaving statements and declarations within
 blocks) are generally not allowed; declarations should be at the beginning
-of blocks.
+of blocks. To avoid accidental re-use it is permissible to declare
+loop variables inside for loops:
+
+.. code-block:: c
+
+    for (int i = 0; i < ARRAY_SIZE(thing); i++) {
+        /* do something loopy */
+    }
 
 Every now and then, an exception is made for declarations inside a
 #ifdef or #ifndef block: if the code looks nicer, such declarations can

From e05a4beaecc346346c1fa7d5c1d13941dc609c80 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 29 Aug 2023 17:15:21 +0100
Subject: [PATCH 1319/1353] .gitlab-ci.d/cirrus.yml: Update FreeBSD to v13.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The FreeBSD CI job started to fail due to linking problems ... time
to update to the latest version to get this fixed.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20230823144533.230477-1-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-6-alex.bennee@linaro.org>
---
 .gitlab-ci.d/cirrus.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/cirrus.yml b/.gitlab-ci.d/cirrus.yml
index 1507c928e5..41d64d6680 100644
--- a/.gitlab-ci.d/cirrus.yml
+++ b/.gitlab-ci.d/cirrus.yml
@@ -50,7 +50,7 @@ x64-freebsd-13-build:
     NAME: freebsd-13
     CIRRUS_VM_INSTANCE_TYPE: freebsd_instance
     CIRRUS_VM_IMAGE_SELECTOR: image_family
-    CIRRUS_VM_IMAGE_NAME: freebsd-13-1
+    CIRRUS_VM_IMAGE_NAME: freebsd-13-2
     CIRRUS_VM_CPUS: 8
     CIRRUS_VM_RAM: 8G
     UPDATE_COMMAND: pkg update; pkg upgrade -y

From d84842be6c53c03c9498101b509a25961ed5856f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:22 +0100
Subject: [PATCH 1320/1353] tests: remove test-gdbstub.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This isn't directly called by our CI and because it doesn't run via
our run-test.py script does things slightly differently. Lets remove
it as we have plenty of working in-tree tests now for various aspects
of gdbstub.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-7-alex.bennee@linaro.org>
---
 tests/guest-debug/test-gdbstub.py | 177 ------------------------------
 1 file changed, 177 deletions(-)
 delete mode 100644 tests/guest-debug/test-gdbstub.py

diff --git a/tests/guest-debug/test-gdbstub.py b/tests/guest-debug/test-gdbstub.py
deleted file mode 100644
index 98a5df4d42..0000000000
--- a/tests/guest-debug/test-gdbstub.py
+++ /dev/null
@@ -1,177 +0,0 @@
-#
-# This script needs to be run on startup
-# qemu -kernel ${KERNEL} -s -S
-# and then:
-# gdb ${KERNEL}.vmlinux -x ${QEMU_SRC}/tests/guest-debug/test-gdbstub.py
-
-import gdb
-
-failcount = 0
-
-
-def report(cond, msg):
-    "Report success/fail of test"
-    if cond:
-        print ("PASS: %s" % (msg))
-    else:
-        print ("FAIL: %s" % (msg))
-        global failcount
-        failcount += 1
-
-
-def check_step():
-    "Step an instruction, check it moved."
-    start_pc = gdb.parse_and_eval('$pc')
-    gdb.execute("si")
-    end_pc = gdb.parse_and_eval('$pc')
-
-    return not (start_pc == end_pc)
-
-
-def check_break(sym_name):
-    "Setup breakpoint, continue and check we stopped."
-    sym, ok = gdb.lookup_symbol(sym_name)
-    bp = gdb.Breakpoint(sym_name)
-
-    gdb.execute("c")
-
-    # hopefully we came back
-    end_pc = gdb.parse_and_eval('$pc')
-    print ("%s == %s %d" % (end_pc, sym.value(), bp.hit_count))
-    bp.delete()
-
-    # can we test we hit bp?
-    return end_pc == sym.value()
-
-
-# We need to do hbreak manually as the python interface doesn't export it
-def check_hbreak(sym_name):
-    "Setup hardware breakpoint, continue and check we stopped."
-    sym, ok = gdb.lookup_symbol(sym_name)
-    gdb.execute("hbreak %s" % (sym_name))
-    gdb.execute("c")
-
-    # hopefully we came back
-    end_pc = gdb.parse_and_eval('$pc')
-    print ("%s == %s" % (end_pc, sym.value()))
-
-    if end_pc == sym.value():
-        gdb.execute("d 1")
-        return True
-    else:
-        return False
-
-
-class WatchPoint(gdb.Breakpoint):
-
-    def get_wpstr(self, sym_name):
-        "Setup sym and wp_str for given symbol."
-        self.sym, ok = gdb.lookup_symbol(sym_name)
-        wp_addr = gdb.parse_and_eval(sym_name).address
-        self.wp_str = '*(%(type)s)(&%(address)s)' % dict(
-            type = wp_addr.type, address = sym_name)
-
-        return(self.wp_str)
-
-    def __init__(self, sym_name, type):
-        wp_str = self.get_wpstr(sym_name)
-        super(WatchPoint, self).__init__(wp_str, gdb.BP_WATCHPOINT, type)
-
-    def stop(self):
-        end_pc = gdb.parse_and_eval('$pc')
-        print ("HIT WP @ %s" % (end_pc))
-        return True
-
-
-def do_one_watch(sym, wtype, text):
-
-    wp = WatchPoint(sym, wtype)
-    gdb.execute("c")
-    report_str = "%s for %s (%s)" % (text, sym, wp.sym.value())
-
-    if wp.hit_count > 0:
-        report(True, report_str)
-        wp.delete()
-    else:
-        report(False, report_str)
-
-
-def check_watches(sym_name):
-    "Watch a symbol for any access."
-
-    # Should hit for any read
-    do_one_watch(sym_name, gdb.WP_ACCESS, "awatch")
-
-    # Again should hit for reads
-    do_one_watch(sym_name, gdb.WP_READ, "rwatch")
-
-    # Finally when it is written
-    do_one_watch(sym_name, gdb.WP_WRITE, "watch")
-
-
-class CatchBreakpoint(gdb.Breakpoint):
-    def __init__(self, sym_name):
-        super(CatchBreakpoint, self).__init__(sym_name)
-        self.sym, ok = gdb.lookup_symbol(sym_name)
-
-    def stop(self):
-        end_pc = gdb.parse_and_eval('$pc')
-        print ("CB: %s == %s" % (end_pc, self.sym.value()))
-        if end_pc == self.sym.value():
-            report(False, "Hit final catchpoint")
-
-
-def run_test():
-    "Run through the tests one by one"
-
-    print ("Checking we can step the first few instructions")
-    step_ok = 0
-    for i in range(3):
-        if check_step():
-            step_ok += 1
-
-    report(step_ok == 3, "single step in boot code")
-
-    print ("Checking HW breakpoint works")
-    break_ok = check_hbreak("kernel_init")
-    report(break_ok, "hbreak @ kernel_init")
-
-    # Can't set this up until we are in the kernel proper
-    # if we make it to run_init_process we've over-run and
-    # one of the tests failed
-    print ("Setup catch-all for run_init_process")
-    cbp = CatchBreakpoint("run_init_process")
-    cpb2 = CatchBreakpoint("try_to_run_init_process")
-
-    print ("Checking Normal breakpoint works")
-    break_ok = check_break("wait_for_completion")
-    report(break_ok, "break @ wait_for_completion")
-
-    print ("Checking watchpoint works")
-    check_watches("system_state")
-
-#
-# This runs as the script it sourced (via -x)
-#
-
-try:
-    print ("Connecting to remote")
-    gdb.execute("target remote localhost:1234")
-
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-    gdb.execute("set confirm off")
-
-    # Run the actual tests
-    run_test()
-
-except:
-    print ("GDB Exception: %s" % (sys.exc_info()[0]))
-    failcount += 1
-    import code
-    code.InteractiveConsole(locals=globals()).interact()
-    raise
-
-# Finally kill the inferior and exit gdb with a count of failures
-gdb.execute("kill")
-exit(failcount)

From a8fea70f656416b2ed7d388fbcc7cc6cda126a82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:23 +0100
Subject: [PATCH 1321/1353] tests/tcg: clean-up gdb confirm/pagination settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can do this all in the run-test.py script so remove the extraneous
bits from the individual tests which got copied from the original
non-CI gdb tests.

Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-8-alex.bennee@linaro.org>
---
 tests/guest-debug/run-test.py                         | 2 ++
 tests/tcg/aarch64/gdbstub/test-sve-ioctl.py           | 3 ---
 tests/tcg/aarch64/gdbstub/test-sve.py                 | 3 ---
 tests/tcg/multiarch/gdbstub/memory.py                 | 3 ---
 tests/tcg/multiarch/gdbstub/sha1.py                   | 4 ----
 tests/tcg/multiarch/gdbstub/test-proc-mappings.py     | 4 ----
 tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py   | 4 ----
 tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py | 4 ----
 tests/tcg/s390x/gdbstub/test-signals-s390x.py         | 4 ----
 tests/tcg/s390x/gdbstub/test-svc.py                   | 4 ----
 10 files changed, 2 insertions(+), 33 deletions(-)

diff --git a/tests/guest-debug/run-test.py b/tests/guest-debug/run-test.py
index a032e01f79..b13b27d4b1 100755
--- a/tests/guest-debug/run-test.py
+++ b/tests/guest-debug/run-test.py
@@ -83,6 +83,8 @@ if __name__ == '__main__':
         gdb_cmd += " %s" % (args.gdb_args)
     # run quietly and ignore .gdbinit
     gdb_cmd += " -q -n -batch"
+    # disable pagination
+    gdb_cmd += " -ex 'set pagination off'"
     # disable prompts in case of crash
     gdb_cmd += " -ex 'set confirm off'"
     # connect to remote
diff --git a/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py b/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py
index b9ef169c1a..ee8d467e59 100644
--- a/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py
+++ b/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py
@@ -76,9 +76,6 @@ except (gdb.error, AttributeError):
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-
     # Run the actual tests
     run_test()
 except:
diff --git a/tests/tcg/aarch64/gdbstub/test-sve.py b/tests/tcg/aarch64/gdbstub/test-sve.py
index ef57c7412c..afd8ece98d 100644
--- a/tests/tcg/aarch64/gdbstub/test-sve.py
+++ b/tests/tcg/aarch64/gdbstub/test-sve.py
@@ -66,9 +66,6 @@ except (gdb.error, AttributeError):
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-
     # Run the actual tests
     run_test()
 except:
diff --git a/tests/tcg/multiarch/gdbstub/memory.py b/tests/tcg/multiarch/gdbstub/memory.py
index 67864ad902..dd25e72281 100644
--- a/tests/tcg/multiarch/gdbstub/memory.py
+++ b/tests/tcg/multiarch/gdbstub/memory.py
@@ -115,9 +115,6 @@ if gdb.parse_and_eval('$pc') == 0:
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-
     # Run the actual tests
     run_test()
 except (gdb.error):
diff --git a/tests/tcg/multiarch/gdbstub/sha1.py b/tests/tcg/multiarch/gdbstub/sha1.py
index 423b720e6d..416728415f 100644
--- a/tests/tcg/multiarch/gdbstub/sha1.py
+++ b/tests/tcg/multiarch/gdbstub/sha1.py
@@ -73,10 +73,6 @@ if gdb.parse_and_eval('$pc') == 0:
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-    gdb.execute("set confirm off")
-
     # Run the actual tests
     run_test()
 except (gdb.error):
diff --git a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
index 5e3e5a2fb7..04ec61d219 100644
--- a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
+++ b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
@@ -51,10 +51,6 @@ def main():
         exit(0)
 
     try:
-        # These are not very useful in scripts
-        gdb.execute("set pagination off")
-        gdb.execute("set confirm off")
-
         # Run the actual tests
         run_test()
     except gdb.error:
diff --git a/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py b/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py
index d91e8fdf19..926fa962b7 100644
--- a/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py
+++ b/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py
@@ -42,10 +42,6 @@ if gdb.parse_and_eval('$pc') == 0:
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-    gdb.execute("set confirm off")
-
     # Run the actual tests
     run_test()
 except (gdb.error):
diff --git a/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py b/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py
index 798d508bc7..e57d2a8db8 100644
--- a/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py
+++ b/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py
@@ -45,10 +45,6 @@ if gdb.parse_and_eval('$pc') == 0:
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-    gdb.execute("set confirm off")
-
     # Run the actual tests
     run_test()
 except (gdb.error):
diff --git a/tests/tcg/s390x/gdbstub/test-signals-s390x.py b/tests/tcg/s390x/gdbstub/test-signals-s390x.py
index 80a284b475..ca2bbc0b03 100644
--- a/tests/tcg/s390x/gdbstub/test-signals-s390x.py
+++ b/tests/tcg/s390x/gdbstub/test-signals-s390x.py
@@ -61,10 +61,6 @@ if gdb.parse_and_eval("$pc") == 0:
     exit(0)
 
 try:
-    # These are not very useful in scripts
-    gdb.execute("set pagination off")
-    gdb.execute("set confirm off")
-
     # Run the actual tests
     run_test()
 except (gdb.error):
diff --git a/tests/tcg/s390x/gdbstub/test-svc.py b/tests/tcg/s390x/gdbstub/test-svc.py
index 18fad3f163..804705fede 100644
--- a/tests/tcg/s390x/gdbstub/test-svc.py
+++ b/tests/tcg/s390x/gdbstub/test-svc.py
@@ -49,10 +49,6 @@ def main():
         exit(0)
 
     try:
-        # These are not very useful in scripts
-        gdb.execute("set pagination off")
-        gdb.execute("set confirm off")
-
         # Run the actual tests
         run_test()
     except gdb.error:

From 761e3c10881b5f521b19b713cf8d16c72c47affb Mon Sep 17 00:00:00 2001
From: Matheus Branco Borella <dark.ryu.550@gmail.com>
Date: Tue, 29 Aug 2023 17:15:24 +0100
Subject: [PATCH 1322/1353] gdbstub: fixes cases where wrong threads were
 reported to GDB on SIGINT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fix is implemented by having the vCont handler set the value of
`gdbserver_state.c_cpu` if any threads are to be resumed. The specific
CPU picked is arbitrarily from the ones to be resumed, but it should
be okay, as all GDB cares about is that it is a resumed thread.

Signed-off-by: Matheus Branco Borella <dark.ryu.550@gmail.com>
Message-Id: <20230804182633.47300-2-dark.ryu.550@gmail.com>
[AJB: style and whitespace fixes]
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1725
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-9-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c                             | 29 ++++++
 tests/tcg/multiarch/gdbstub/interrupt.py      | 97 +++++++++++++++++++
 .../multiarch/system/Makefile.softmmu-target  | 12 ++-
 tests/tcg/multiarch/system/interrupt.c        | 28 ++++++
 4 files changed, 164 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/multiarch/gdbstub/interrupt.py
 create mode 100644 tests/tcg/multiarch/system/interrupt.c

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 5f28d5cf57..e7d48fa0d4 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -597,6 +597,15 @@ static int gdb_handle_vcont(const char *p)
      *  or incorrect parameters passed.
      */
     res = 0;
+
+    /*
+     * target_count and last_target keep track of how many CPUs we are going to
+     * step or resume, and a pointer to the state structure of one of them,
+     * respectivelly
+     */
+    int target_count = 0;
+    CPUState *last_target = NULL;
+
     while (*p) {
         if (*p++ != ';') {
             return -ENOTSUP;
@@ -637,6 +646,9 @@ static int gdb_handle_vcont(const char *p)
             while (cpu) {
                 if (newstates[cpu->cpu_index] == 1) {
                     newstates[cpu->cpu_index] = cur_action;
+
+                    target_count++;
+                    last_target = cpu;
                 }
 
                 cpu = gdb_next_attached_cpu(cpu);
@@ -654,6 +666,9 @@ static int gdb_handle_vcont(const char *p)
             while (cpu) {
                 if (newstates[cpu->cpu_index] == 1) {
                     newstates[cpu->cpu_index] = cur_action;
+
+                    target_count++;
+                    last_target = cpu;
                 }
 
                 cpu = gdb_next_cpu_in_process(cpu);
@@ -671,11 +686,25 @@ static int gdb_handle_vcont(const char *p)
             /* only use if no previous match occourred */
             if (newstates[cpu->cpu_index] == 1) {
                 newstates[cpu->cpu_index] = cur_action;
+
+                target_count++;
+                last_target = cpu;
             }
             break;
         }
     }
 
+    /*
+     * if we're about to resume a specific set of CPUs/threads, make it so that
+     * in case execution gets interrupted, we can send GDB a stop reply with a
+     * correct value. it doesn't really matter which CPU we tell GDB the signal
+     * happened in (VM pauses stop all of them anyway), so long as it is one of
+     * the ones we resumed/single stepped here.
+     */
+    if (target_count > 0) {
+        gdbserver_state.c_cpu = last_target;
+    }
+
     gdbserver_state.signal = signal;
     gdb_continue_partial(newstates);
     return res;
diff --git a/tests/tcg/multiarch/gdbstub/interrupt.py b/tests/tcg/multiarch/gdbstub/interrupt.py
new file mode 100644
index 0000000000..e222ac94c5
--- /dev/null
+++ b/tests/tcg/multiarch/gdbstub/interrupt.py
@@ -0,0 +1,97 @@
+from __future__ import print_function
+#
+# Test some of the softmmu debug features with the multiarch memory
+# test. It is a port of the original vmlinux focused test case but
+# using the "memory" test instead.
+#
+# This is launched via tests/guest-debug/run-test.py
+#
+
+import gdb
+import sys
+
+failcount = 0
+
+
+def report(cond, msg):
+    "Report success/fail of test"
+    if cond:
+        print("PASS: %s" % (msg))
+    else:
+        print("FAIL: %s" % (msg))
+        global failcount
+        failcount += 1
+
+
+def check_interrupt(thread):
+    """
+    Check that, if thread is resumed, we go back to the same thread when the
+    program gets interrupted.
+    """
+
+    # Switch to the thread we're going to be running the test in.
+    print("thread ", thread.num)
+    gdb.execute("thr %d" % thread.num)
+
+    # Enter the loop() function on this thread.
+    #
+    # While there are cleaner ways to do this, we want to minimize the number of
+    # side effects on the gdbstub's internal state, since those may mask bugs.
+    # Ideally, there should be no difference between what we're doing here and
+    # the program reaching the loop() function on its own.
+    #
+    # For this to be safe, we only need the prologue of loop() to not have
+    # instructions that may have problems with what we're doing here. We don't
+    # have to worry about anything else, as this function never returns.
+    gdb.execute("set $pc = loop")
+
+    # Continue and then interrupt the task.
+    gdb.post_event(lambda: gdb.execute("interrupt"))
+    gdb.execute("c")
+
+    # Check whether the thread we're in after the interruption is the same we
+    # ran continue from.
+    return (thread.num == gdb.selected_thread().num)
+
+
+def run_test():
+    """
+    Test if interrupting the code always lands us on the same thread when
+    running with scheduler-lock enabled.
+    """
+
+    gdb.execute("set scheduler-locking on")
+    for thread in gdb.selected_inferior().threads():
+        report(check_interrupt(thread),
+               "thread %d resumes correctly on interrupt" % thread.num)
+
+
+#
+# This runs as the script it sourced (via -x, via run-test.py)
+#
+try:
+    inferior = gdb.selected_inferior()
+    arch = inferior.architecture()
+    print("ATTACHED: %s" % arch.name())
+except (gdb.error, AttributeError):
+    print("SKIPPING (not connected)", file=sys.stderr)
+    exit(0)
+
+if gdb.parse_and_eval('$pc') == 0:
+    print("SKIP: PC not set")
+    exit(0)
+if len(gdb.selected_inferior().threads()) == 1:
+    print("SKIP: set to run on a single thread")
+    exit(0)
+
+try:
+    # Run the actual tests
+    run_test()
+except (gdb.error):
+    print("GDB Exception: %s" % (sys.exc_info()[0]))
+    failcount += 1
+    pass
+
+# Finally kill the inferior and exit gdb with a count of failures
+gdb.execute("kill")
+exit(failcount)
diff --git a/tests/tcg/multiarch/system/Makefile.softmmu-target b/tests/tcg/multiarch/system/Makefile.softmmu-target
index a051d689d7..90810a32b2 100644
--- a/tests/tcg/multiarch/system/Makefile.softmmu-target
+++ b/tests/tcg/multiarch/system/Makefile.softmmu-target
@@ -27,7 +27,15 @@ run-gdbstub-memory: memory
 		"-monitor none -display none -chardev file$(COMMA)path=$<.out$(COMMA)id=output $(QEMU_OPTS)" \
 		--bin $< --test $(MULTIARCH_SRC)/gdbstub/memory.py, \
 	softmmu gdbstub support)
-
+run-gdbstub-interrupt: interrupt
+	$(call run-test, $@, $(GDB_SCRIPT) \
+		--gdb $(HAVE_GDB_BIN) \
+		--qemu $(QEMU) \
+		--output $<.gdb.out \
+		--qargs \
+		"-smp 2 -monitor none -display none -chardev file$(COMMA)path=$<.out$(COMMA)id=output $(QEMU_OPTS)" \
+		--bin $< --test $(MULTIARCH_SRC)/gdbstub/interrupt.py, \
+	softmmu gdbstub support)
 run-gdbstub-untimely-packet: hello
 	$(call run-test, $@, $(GDB_SCRIPT) \
 		--gdb $(HAVE_GDB_BIN) \
@@ -50,4 +58,4 @@ run-gdbstub-%:
 	$(call skip-test, "gdbstub test $*", "need working gdb")
 endif
 
-MULTIARCH_RUNS += run-gdbstub-memory run-gdbstub-untimely-packet
+MULTIARCH_RUNS += run-gdbstub-memory run-gdbstub-interrupt run-gdbstub-untimely-packet
diff --git a/tests/tcg/multiarch/system/interrupt.c b/tests/tcg/multiarch/system/interrupt.c
new file mode 100644
index 0000000000..98d4f2eff9
--- /dev/null
+++ b/tests/tcg/multiarch/system/interrupt.c
@@ -0,0 +1,28 @@
+/*
+ * External interruption test. This test is structured in such a way that it
+ * passes the cases that require it to exit, but we can make it enter an
+ * infinite loop from GDB.
+ *
+ * We don't have the benefit of libc, just builtin C primitives and
+ * whatever is in minilib.
+ */
+
+#include <minilib.h>
+
+void loop(void)
+{
+    do {
+        /*
+         * Loop forever. Just make sure the condition is always a constant
+         * expression, so that this loop is not UB, as per the C
+         * standard.
+         */
+    } while (1);
+}
+
+int main(void)
+{
+    return 0;
+}
+
+

From 5b030993dba1bbb841431506c0919c7a7bef986c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:25 +0100
Subject: [PATCH 1323/1353] gdbstub: remove unused user_ctx field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This was always NULL so drop it.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-10-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index e7d48fa0d4..8e9bc17e07 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -836,7 +836,7 @@ static inline int startswith(const char *string, const char *pattern)
   return !strncmp(string, pattern, strlen(pattern));
 }
 
-static int process_string_cmd(void *user_ctx, const char *data,
+static int process_string_cmd(const char *data,
                               const GdbCmdParseEntry *cmds, int num_cmds)
 {
     int i;
@@ -863,7 +863,7 @@ static int process_string_cmd(void *user_ctx, const char *data,
         }
 
         gdbserver_state.allow_stop_reply = cmd->allow_stop_reply;
-        cmd->handler(params, user_ctx);
+        cmd->handler(params, NULL);
         return 0;
     }
 
@@ -881,7 +881,7 @@ static void run_cmd_parser(const char *data, const GdbCmdParseEntry *cmd)
 
     /* In case there was an error during the command parsing we must
     * send a NULL packet to indicate the command is not supported */
-    if (process_string_cmd(NULL, data, cmd, 1)) {
+    if (process_string_cmd(data, cmd, 1)) {
         gdb_put_packet("");
     }
 }
@@ -1394,7 +1394,7 @@ static void handle_v_commands(GArray *params, void *user_ctx)
         return;
     }
 
-    if (process_string_cmd(NULL, get_param(params, 0)->data,
+    if (process_string_cmd(get_param(params, 0)->data,
                            gdb_v_commands_table,
                            ARRAY_SIZE(gdb_v_commands_table))) {
         gdb_put_packet("");
@@ -1738,13 +1738,13 @@ static void handle_gen_query(GArray *params, void *user_ctx)
         return;
     }
 
-    if (!process_string_cmd(NULL, get_param(params, 0)->data,
+    if (!process_string_cmd(get_param(params, 0)->data,
                             gdb_gen_query_set_common_table,
                             ARRAY_SIZE(gdb_gen_query_set_common_table))) {
         return;
     }
 
-    if (process_string_cmd(NULL, get_param(params, 0)->data,
+    if (process_string_cmd(get_param(params, 0)->data,
                            gdb_gen_query_table,
                            ARRAY_SIZE(gdb_gen_query_table))) {
         gdb_put_packet("");
@@ -1757,13 +1757,13 @@ static void handle_gen_set(GArray *params, void *user_ctx)
         return;
     }
 
-    if (!process_string_cmd(NULL, get_param(params, 0)->data,
+    if (!process_string_cmd(get_param(params, 0)->data,
                             gdb_gen_query_set_common_table,
                             ARRAY_SIZE(gdb_gen_query_set_common_table))) {
         return;
     }
 
-    if (process_string_cmd(NULL, get_param(params, 0)->data,
+    if (process_string_cmd(get_param(params, 0)->data,
                            gdb_gen_set_table,
                            ARRAY_SIZE(gdb_gen_set_table))) {
         gdb_put_packet("");

From 56e534bd116afda6f7b9ef96691549373c64040d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:26 +0100
Subject: [PATCH 1324/1353] gdbstub: refactor get_feature_xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Try to bring up the code to more modern standards by:

  - use dynamic GString built xml over a fixed buffer
  - use autofree to save on explicit g_free() calls
  - don't hand hack strstr to find the delimiter
  - fix up style of xml_builtin and invert loop

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-11-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c   | 87 +++++++++++++++++++++++----------------------
 gdbstub/internals.h |  2 +-
 2 files changed, 46 insertions(+), 43 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 8e9bc17e07..729e54139a 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -354,64 +354,67 @@ static CPUState *gdb_get_cpu(uint32_t pid, uint32_t tid)
 static const char *get_feature_xml(const char *p, const char **newp,
                                    GDBProcess *process)
 {
-    size_t len;
-    int i;
-    const char *name;
     CPUState *cpu = gdb_get_first_cpu_in_process(process);
     CPUClass *cc = CPU_GET_CLASS(cpu);
+    size_t len;
 
-    len = 0;
-    while (p[len] && p[len] != ':')
-        len++;
-    *newp = p + len;
+    /*
+     * qXfer:features:read:ANNEX:OFFSET,LENGTH'
+     *                     ^p    ^newp
+     */
+    char *term = strchr(p, ':');
+    *newp = term + 1;
+    len = term - p;
 
-    name = NULL;
+    /* Is it the main target xml? */
     if (strncmp(p, "target.xml", len) == 0) {
-        char *buf = process->target_xml;
-        const size_t buf_sz = sizeof(process->target_xml);
-
-        /* Generate the XML description for this CPU.  */
-        if (!buf[0]) {
+        if (!process->target_xml) {
             GDBRegisterState *r;
+            GString *xml = g_string_new("<?xml version=\"1.0\"?>");
+
+            g_string_append(xml,
+                            "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
+                            "<target>");
 
-            pstrcat(buf, buf_sz,
-                    "<?xml version=\"1.0\"?>"
-                    "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">"
-                    "<target>");
             if (cc->gdb_arch_name) {
-                gchar *arch = cc->gdb_arch_name(cpu);
-                pstrcat(buf, buf_sz, "<architecture>");
-                pstrcat(buf, buf_sz, arch);
-                pstrcat(buf, buf_sz, "</architecture>");
-                g_free(arch);
+                g_autofree gchar *arch = cc->gdb_arch_name(cpu);
+                g_string_append_printf(xml,
+                                       "<architecture>%s</architecture>",
+                                       arch);
             }
-            pstrcat(buf, buf_sz, "<xi:include href=\"");
-            pstrcat(buf, buf_sz, cc->gdb_core_xml_file);
-            pstrcat(buf, buf_sz, "\"/>");
+            g_string_append(xml, "<xi:include href=\"");
+            g_string_append(xml, cc->gdb_core_xml_file);
+            g_string_append(xml, "\"/>");
             for (r = cpu->gdb_regs; r; r = r->next) {
-                pstrcat(buf, buf_sz, "<xi:include href=\"");
-                pstrcat(buf, buf_sz, r->xml);
-                pstrcat(buf, buf_sz, "\"/>");
+                g_string_append(xml, "<xi:include href=\"");
+                g_string_append(xml, r->xml);
+                g_string_append(xml, "\"/>");
             }
-            pstrcat(buf, buf_sz, "</target>");
-        }
-        return buf;
-    }
-    if (cc->gdb_get_dynamic_xml) {
-        char *xmlname = g_strndup(p, len);
-        const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
+            g_string_append(xml, "</target>");
 
-        g_free(xmlname);
+            process->target_xml = g_string_free(xml, false);
+            return process->target_xml;
+        }
+    }
+    /* Is it dynamically generated by the target? */
+    if (cc->gdb_get_dynamic_xml) {
+        g_autofree char *xmlname = g_strndup(p, len);
+        const char *xml = cc->gdb_get_dynamic_xml(cpu, xmlname);
         if (xml) {
             return xml;
         }
     }
-    for (i = 0; ; i++) {
-        name = xml_builtin[i][0];
-        if (!name || (strncmp(name, p, len) == 0 && strlen(name) == len))
-            break;
+    /* Is it one of the encoded gdb-xml/ files? */
+    for (int i = 0; xml_builtin[i][0]; i++) {
+        const char *name = xml_builtin[i][0];
+        if ((strncmp(name, p, len) == 0) &&
+            strlen(name) == len) {
+            return xml_builtin[i][1];
+        }
     }
-    return name ? xml_builtin[i][1] : NULL;
+
+    /* failed */
+    return NULL;
 }
 
 static int gdb_read_register(CPUState *cpu, GByteArray *buf, int reg)
@@ -2245,6 +2248,6 @@ void gdb_create_default_process(GDBState *s)
     process = &s->processes[s->process_num - 1];
     process->pid = pid;
     process->attached = false;
-    process->target_xml[0] = '\0';
+    process->target_xml = NULL;
 }
 
diff --git a/gdbstub/internals.h b/gdbstub/internals.h
index f2b46cce41..4876ebd74f 100644
--- a/gdbstub/internals.h
+++ b/gdbstub/internals.h
@@ -33,7 +33,7 @@ typedef struct GDBProcess {
     uint32_t pid;
     bool attached;
 
-    char target_xml[1024];
+    char *target_xml;
 } GDBProcess;
 
 enum RSState {

From d0e5fa849db4d729e0607ef597cb31eac79532a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:27 +0100
Subject: [PATCH 1325/1353] gdbstub: replace global gdb_has_xml with a function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Try and make the self reported global hack a little less hackish by
providing a query function instead. As gdb_has_xml was always set if
we negotiated XML we can now use the presence of ->target_xml as the
test instead.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-12-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c      | 12 +++++++-----
 gdbstub/internals.h    |  1 +
 gdbstub/softmmu.c      |  1 -
 gdbstub/user.c         |  1 -
 include/exec/gdbstub.h | 10 +++++-----
 target/arm/gdbstub.c   |  8 ++++----
 target/ppc/gdbstub.c   |  4 ++--
 7 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index 729e54139a..fdebfe25ea 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -75,8 +75,6 @@ void gdb_init_gdbserver_state(void)
     gdbserver_state.sstep_flags &= gdbserver_state.supported_sstep_flags;
 }
 
-bool gdb_has_xml;
-
 /* writes 2*len+1 bytes in buf */
 void gdb_memtohex(GString *buf, const uint8_t *mem, int len)
 {
@@ -351,6 +349,11 @@ static CPUState *gdb_get_cpu(uint32_t pid, uint32_t tid)
     }
 }
 
+bool gdb_has_xml(void)
+{
+    return !!gdb_get_cpu_process(gdbserver_state.g_cpu)->target_xml;
+}
+
 static const char *get_feature_xml(const char *p, const char **newp,
                                    GDBProcess *process)
 {
@@ -1084,7 +1087,7 @@ static void handle_set_reg(GArray *params, void *user_ctx)
 {
     int reg_size;
 
-    if (!gdb_has_xml) {
+    if (!gdb_get_cpu_process(gdbserver_state.g_cpu)->target_xml) {
         gdb_put_packet("");
         return;
     }
@@ -1105,7 +1108,7 @@ static void handle_get_reg(GArray *params, void *user_ctx)
 {
     int reg_size;
 
-    if (!gdb_has_xml) {
+    if (!gdb_get_cpu_process(gdbserver_state.g_cpu)->target_xml) {
         gdb_put_packet("");
         return;
     }
@@ -1572,7 +1575,6 @@ static void handle_query_xfer_features(GArray *params, void *user_ctx)
         return;
     }
 
-    gdb_has_xml = true;
     p = get_param(params, 0)->data;
     xml = get_feature_xml(p, &p, process);
     if (!xml) {
diff --git a/gdbstub/internals.h b/gdbstub/internals.h
index 4876ebd74f..fee243081f 100644
--- a/gdbstub/internals.h
+++ b/gdbstub/internals.h
@@ -33,6 +33,7 @@ typedef struct GDBProcess {
     uint32_t pid;
     bool attached;
 
+    /* If gdb sends qXfer:features:read:target.xml this will be populated */
     char *target_xml;
 } GDBProcess;
 
diff --git a/gdbstub/softmmu.c b/gdbstub/softmmu.c
index f509b7285d..9f0b8b5497 100644
--- a/gdbstub/softmmu.c
+++ b/gdbstub/softmmu.c
@@ -97,7 +97,6 @@ static void gdb_chr_event(void *opaque, QEMUChrEvent event)
 
         vm_stop(RUN_STATE_PAUSED);
         replay_gdb_attached();
-        gdb_has_xml = false;
         break;
     default:
         break;
diff --git a/gdbstub/user.c b/gdbstub/user.c
index 5b375be1d9..7ab6e5d975 100644
--- a/gdbstub/user.c
+++ b/gdbstub/user.c
@@ -198,7 +198,6 @@ static void gdb_accept_init(int fd)
     gdbserver_state.c_cpu = gdb_first_attached_cpu();
     gdbserver_state.g_cpu = gdbserver_state.c_cpu;
     gdbserver_user_state.fd = fd;
-    gdb_has_xml = false;
 }
 
 static bool gdb_accept_socket(int gdb_fd)
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 7d743fe1e9..0ee39cfdd1 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -31,12 +31,12 @@ int gdbserver_start(const char *port_or_device);
 void gdb_set_stop_cpu(CPUState *cpu);
 
 /**
- * gdb_has_xml:
- * This is an ugly hack to cope with both new and old gdb.
- * If gdb sends qXfer:features:read then assume we're talking to a newish
- * gdb that understands target descriptions.
+ * gdb_has_xml() - report of gdb supports modern target descriptions
+ *
+ * This will report true if the gdb negotiated qXfer:features:read
+ * target descriptions.
  */
-extern bool gdb_has_xml;
+bool gdb_has_xml(void);
 
 /* in gdbstub-xml.c, generated by scripts/feature_to_c.sh */
 extern const char *const xml_builtin[][2];
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index f421c5d041..8fc8351df7 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -48,7 +48,7 @@ int arm_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     }
     if (n < 24) {
         /* FPA registers.  */
-        if (gdb_has_xml) {
+        if (gdb_has_xml()) {
             return 0;
         }
         return gdb_get_zeroes(mem_buf, 12);
@@ -56,7 +56,7 @@ int arm_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     switch (n) {
     case 24:
         /* FPA status register.  */
-        if (gdb_has_xml) {
+        if (gdb_has_xml()) {
             return 0;
         }
         return gdb_get_reg32(mem_buf, 0);
@@ -102,7 +102,7 @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     }
     if (n < 24) { /* 16-23 */
         /* FPA registers (ignored).  */
-        if (gdb_has_xml) {
+        if (gdb_has_xml()) {
             return 0;
         }
         return 12;
@@ -110,7 +110,7 @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     switch (n) {
     case 24:
         /* FPA status register (ignored).  */
-        if (gdb_has_xml) {
+        if (gdb_has_xml()) {
             return 0;
         }
         return 4;
diff --git a/target/ppc/gdbstub.c b/target/ppc/gdbstub.c
index ca39efdc35..2ad11510bf 100644
--- a/target/ppc/gdbstub.c
+++ b/target/ppc/gdbstub.c
@@ -56,7 +56,7 @@ static int ppc_gdb_register_len(int n)
         return sizeof(target_ulong);
     case 32 ... 63:
         /* fprs */
-        if (gdb_has_xml) {
+        if (gdb_has_xml()) {
             return 0;
         }
         return 8;
@@ -76,7 +76,7 @@ static int ppc_gdb_register_len(int n)
         return sizeof(target_ulong);
     case 70:
         /* fpscr */
-        if (gdb_has_xml) {
+        if (gdb_has_xml()) {
             return 0;
         }
         return sizeof(target_ulong);

From 8dd7a4b3487ab93ff8fddc5f818942ff39d4550f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 29 Aug 2023 17:15:28 +0100
Subject: [PATCH 1326/1353] gdbstub: move comment for gdb_register_coprocessor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use proper kdoc style comments for this API function.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20230829161528.2707696-13-alex.bennee@linaro.org>
---
 gdbstub/gdbstub.c      |  6 ------
 include/exec/gdbstub.h | 10 ++++++++++
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index fdebfe25ea..349d348c7b 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -456,12 +456,6 @@ static int gdb_write_register(CPUState *cpu, uint8_t *mem_buf, int reg)
     return 0;
 }
 
-/* Register a supplemental set of CPU registers.  If g_pos is nonzero it
-   specifies the first register number and these registers are included in
-   a standard "g" packet.  Direction is relative to gdb, i.e. get_reg is
-   gdb reading a CPU register, and set_reg is gdb modifying a CPU register.
- */
-
 void gdb_register_coprocessor(CPUState *cpu,
                               gdb_get_reg_cb get_reg, gdb_set_reg_cb set_reg,
                               int num_regs, const char *xml, int g_pos)
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 0ee39cfdd1..16a139043f 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -14,6 +14,16 @@
 /* Get or set a register.  Returns the size of the register.  */
 typedef int (*gdb_get_reg_cb)(CPUArchState *env, GByteArray *buf, int reg);
 typedef int (*gdb_set_reg_cb)(CPUArchState *env, uint8_t *buf, int reg);
+
+/**
+ * gdb_register_coprocessor() - register a supplemental set of registers
+ * @cpu - the CPU associated with registers
+ * @get_reg - get function (gdb reading)
+ * @set_reg - set function (gdb modifying)
+ * @num_regs - number of registers in set
+ * @xml - xml name of set
+ * @gpos - non-zero to append to "general" register set at @gpos
+ */
 void gdb_register_coprocessor(CPUState *cpu,
                               gdb_get_reg_cb get_reg, gdb_set_reg_cb set_reg,
                               int num_regs, const char *xml, int g_pos);

From 8a45962be33d4f7449567f8b9e07c724733ca303 Mon Sep 17 00:00:00 2001
From: Warner Losh <imp@bsdimp.com>
Date: Wed, 30 Aug 2023 08:44:01 -0600
Subject: [PATCH 1327/1353] bsd-user: Move PRAGMA_DISABLE_PACKED_WARNING etc to
 qemu.h

For the moment, move PRAGMA_DISABLE_PACKED_WARNING and
PRAGMA_ENABLE_PACKED_WARNING back to bsd-user/qemu.h.

Of course, these should be in compiler.h, but that interferes with too
many things at the moment, so take one step back to unbreak clang
linux-user builds first. Use the exact same version that's in
linux-user/qemu.h since that's what should be in compiler.h.

Signed-off-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 bsd-user/qemu.h         | 27 +++++++++++++++++++++++++++
 include/qemu/compiler.h | 30 ------------------------------
 2 files changed, 27 insertions(+), 30 deletions(-)

diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 4cfd5c6337..d3158bc2ed 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -273,6 +273,33 @@ static inline bool access_ok(int type, abi_ulong addr, abi_ulong size)
  * These are usually used to access struct data members once the struct has been
  * locked - usually with lock_user_struct().
  */
+
+/*
+ * Tricky points:
+ * - Use __builtin_choose_expr to avoid type promotion from ?:,
+ * - Invalid sizes result in a compile time error stemming from
+ *   the fact that abort has no parameters.
+ * - It's easier to use the endian-specific unaligned load/store
+ *   functions than host-endian unaligned load/store plus tswapN.
+ * - The pragmas are necessary only to silence a clang false-positive
+ *   warning: see https://bugs.llvm.org/show_bug.cgi?id=39113 .
+ * - gcc has bugs in its _Pragma() support in some versions, eg
+ *   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 -- so we only
+ *   include the warning-suppression pragmas for clang
+ */
+#if defined(__clang__) && __has_warning("-Waddress-of-packed-member")
+#define PRAGMA_DISABLE_PACKED_WARNING                                   \
+    _Pragma("GCC diagnostic push");                                     \
+    _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"")
+
+#define PRAGMA_REENABLE_PACKED_WARNING          \
+    _Pragma("GCC diagnostic pop")
+
+#else
+#define PRAGMA_DISABLE_PACKED_WARNING
+#define PRAGMA_REENABLE_PACKED_WARNING
+#endif
+
 #define __put_user_e(x, hptr, e)                                            \
     do {                                                                    \
         PRAGMA_DISABLE_PACKED_WARNING;                                      \
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index b037442518..a309f90c76 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -22,36 +22,6 @@
 #define QEMU_EXTERN_C extern
 #endif
 
-/*
- * Tricky points:
- * - Use __builtin_choose_expr to avoid type promotion from ?:,
- * - Invalid sizes result in a compile time error stemming from
- *   the fact that abort has no parameters.
- * - It's easier to use the endian-specific unaligned load/store
- *   functions than host-endian unaligned load/store plus tswapN.
- * - The pragmas are necessary only to silence a clang false-positive
- *   warning: see https://bugs.llvm.org/show_bug.cgi?id=39113 .
- * - We have to disable -Wpragmas warnings to avoid a complaint about
- *   an unknown warning type from older compilers that don't know about
- *   -Waddress-of-packed-member.
- * - gcc has bugs in its _Pragma() support in some versions, eg
- *   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83256 -- so we only
- *   include the warning-suppression pragmas for clang
- */
-#ifdef __clang__
-#define PRAGMA_DISABLE_PACKED_WARNING                                   \
-    _Pragma("GCC diagnostic push");                                     \
-    _Pragma("GCC diagnostic ignored \"-Wpragmas\"");                    \
-    _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"")
-
-#define PRAGMA_REENABLE_PACKED_WARNING          \
-    _Pragma("GCC diagnostic pop")
-
-#else
-#define PRAGMA_DISABLE_PACKED_WARNING
-#define PRAGMA_REENABLE_PACKED_WARNING
-#endif
-
 #if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
 # define QEMU_PACKED __attribute__((gcc_struct, packed))
 #else

From 0c8ab1cddd6c1bf4e3722fcea111e614c22dcc09 Mon Sep 17 00:00:00 2001
From: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Date: Tue, 29 Aug 2023 21:35:17 -0700
Subject: [PATCH 1328/1353] xen_arm: Create virtio-mmio devices during
 initialization

In order to use virtio backends we need to allocate virtio-mmio
parameters (irq and base) and register corresponding buses.

Use the constants defined in public header arch-arm.h to be
aligned with the toolstack. So the number of current supported
virtio-mmio devices is 10.

For the interrupts triggering use already existing on Arm
device-model hypercall.

The toolstack should then insert the same amount of device nodes
into guest device-tree.

Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
---
 hw/arm/xen_arm.c            | 35 +++++++++++++++++++++++++++++++++++
 include/hw/xen/xen_native.h | 16 ++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/hw/arm/xen_arm.c b/hw/arm/xen_arm.c
index 1d3e6d481a..7393b37355 100644
--- a/hw/arm/xen_arm.c
+++ b/hw/arm/xen_arm.c
@@ -26,6 +26,7 @@
 #include "qapi/qapi-commands-migration.h"
 #include "qapi/visitor.h"
 #include "hw/boards.h"
+#include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/tpm_backend.h"
@@ -59,6 +60,38 @@ struct XenArmState {
     } cfg;
 };
 
+/*
+ * VIRTIO_MMIO_DEV_SIZE is imported from tools/libs/light/libxl_arm.c under Xen
+ * repository.
+ *
+ * Origin: git://xenbits.xen.org/xen.git 2128143c114c
+ */
+#define VIRTIO_MMIO_DEV_SIZE   0x200
+
+#define NR_VIRTIO_MMIO_DEVICES   \
+   (GUEST_VIRTIO_MMIO_SPI_LAST - GUEST_VIRTIO_MMIO_SPI_FIRST)
+
+static void xen_set_irq(void *opaque, int irq, int level)
+{
+    xendevicemodel_set_irq_level(xen_dmod, xen_domid, irq, level);
+}
+
+static void xen_create_virtio_mmio_devices(XenArmState *xam)
+{
+    int i;
+
+    for (i = 0; i < NR_VIRTIO_MMIO_DEVICES; i++) {
+        hwaddr base = GUEST_VIRTIO_MMIO_BASE + i * VIRTIO_MMIO_DEV_SIZE;
+        qemu_irq irq = qemu_allocate_irq(xen_set_irq, NULL,
+                                         GUEST_VIRTIO_MMIO_SPI_FIRST + i);
+
+        sysbus_create_simple("virtio-mmio", base, irq);
+
+        DPRINTF("Created virtio-mmio device %d: irq %d base 0x%lx\n",
+                i, GUEST_VIRTIO_MMIO_SPI_FIRST + i, base);
+    }
+}
+
 void arch_handle_ioreq(XenIOState *state, ioreq_t *req)
 {
     hw_error("Invalid ioreq type 0x%x\n", req->type);
@@ -110,6 +143,8 @@ static void xen_arm_init(MachineState *machine)
 
     xen_register_ioreq(xam->state, machine->smp.cpus, &xen_memory_listener);
 
+    xen_create_virtio_mmio_devices(xam);
+
 #ifdef CONFIG_TPM
     if (xam->cfg.tpm_base_addr) {
         xen_enable_tpm(xam);
diff --git a/include/hw/xen/xen_native.h b/include/hw/xen/xen_native.h
index 4dce905fde..a4b1aa9e5d 100644
--- a/include/hw/xen/xen_native.h
+++ b/include/hw/xen/xen_native.h
@@ -523,4 +523,20 @@ static inline int xen_set_ioreq_server_state(domid_t dom,
                                                  enable);
 }
 
+#if CONFIG_XEN_CTRL_INTERFACE_VERSION <= 41500
+static inline int xendevicemodel_set_irq_level(xendevicemodel_handle *dmod,
+                                               domid_t domid, uint32_t irq,
+                                               unsigned int level)
+{
+    return 0;
+}
+#endif
+
+#if CONFIG_XEN_CTRL_INTERFACE_VERSION <= 41700
+#define GUEST_VIRTIO_MMIO_BASE   xen_mk_ullong(0x02000000)
+#define GUEST_VIRTIO_MMIO_SIZE   xen_mk_ullong(0x00100000)
+#define GUEST_VIRTIO_MMIO_SPI_FIRST   33
+#define GUEST_VIRTIO_MMIO_SPI_LAST    43
+#endif
+
 #endif /* QEMU_HW_XEN_NATIVE_H */

From 560142190bc347fdd4511a795bdcff768799519d Mon Sep 17 00:00:00 2001
From: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Date: Tue, 29 Aug 2023 21:35:18 -0700
Subject: [PATCH 1329/1353] xen_arm: Initialize RAM and add hi/low memory
 regions

In order to use virtio backends we need to initialize RAM for the
xen-mapcache (which is responsible for mapping guest memory using foreign
mapping) to work. Calculate and add hi/low memory regions based on
machine->ram_size.

Use the constants defined in public header arch-arm.h to be aligned with the xen
toolstack.

While using this machine, the toolstack should then pass real ram_size using
"-m" arg. If "-m" is not given, create a QEMU machine without IOREQ and other
emulated devices like TPM and VIRTIO. This is done to keep this QEMU machine
usable for /etc/init.d/xencommons.

Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Signed-off-by: Vikram Garhwal <vikram.garhwal@amd.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
---
 hw/arm/xen_arm.c            | 45 +++++++++++++++++++++++++++++++++++++
 include/hw/xen/xen_native.h |  8 +++++++
 2 files changed, 53 insertions(+)

diff --git a/hw/arm/xen_arm.c b/hw/arm/xen_arm.c
index 7393b37355..f83b983ec5 100644
--- a/hw/arm/xen_arm.c
+++ b/hw/arm/xen_arm.c
@@ -60,6 +60,8 @@ struct XenArmState {
     } cfg;
 };
 
+static MemoryRegion ram_lo, ram_hi;
+
 /*
  * VIRTIO_MMIO_DEV_SIZE is imported from tools/libs/light/libxl_arm.c under Xen
  * repository.
@@ -92,6 +94,39 @@ static void xen_create_virtio_mmio_devices(XenArmState *xam)
     }
 }
 
+static void xen_init_ram(MachineState *machine)
+{
+    MemoryRegion *sysmem = get_system_memory();
+    ram_addr_t block_len, ram_size[GUEST_RAM_BANKS];
+
+    if (machine->ram_size <= GUEST_RAM0_SIZE) {
+        ram_size[0] = machine->ram_size;
+        ram_size[1] = 0;
+        block_len = GUEST_RAM0_BASE + ram_size[0];
+    } else {
+        ram_size[0] = GUEST_RAM0_SIZE;
+        ram_size[1] = machine->ram_size - GUEST_RAM0_SIZE;
+        block_len = GUEST_RAM1_BASE + ram_size[1];
+    }
+
+    memory_region_init_ram(&ram_memory, NULL, "xen.ram", block_len,
+                           &error_fatal);
+
+    memory_region_init_alias(&ram_lo, NULL, "xen.ram.lo", &ram_memory,
+                             GUEST_RAM0_BASE, ram_size[0]);
+    memory_region_add_subregion(sysmem, GUEST_RAM0_BASE, &ram_lo);
+    DPRINTF("Initialized region xen.ram.lo: base 0x%llx size 0x%lx\n",
+            GUEST_RAM0_BASE, ram_size[0]);
+
+    if (ram_size[1] > 0) {
+        memory_region_init_alias(&ram_hi, NULL, "xen.ram.hi", &ram_memory,
+                                 GUEST_RAM1_BASE, ram_size[1]);
+        memory_region_add_subregion(sysmem, GUEST_RAM1_BASE, &ram_hi);
+        DPRINTF("Initialized region xen.ram.hi: base 0x%llx size 0x%lx\n",
+                GUEST_RAM1_BASE, ram_size[1]);
+    }
+}
+
 void arch_handle_ioreq(XenIOState *state, ioreq_t *req)
 {
     hw_error("Invalid ioreq type 0x%x\n", req->type);
@@ -141,6 +176,14 @@ static void xen_arm_init(MachineState *machine)
 
     xam->state =  g_new0(XenIOState, 1);
 
+    if (machine->ram_size == 0) {
+        DPRINTF("ram_size not specified. QEMU machine started without IOREQ"
+                "(no emulated devices including Virtio)\n");
+        return;
+    }
+
+    xen_init_ram(machine);
+
     xen_register_ioreq(xam->state, machine->smp.cpus, &xen_memory_listener);
 
     xen_create_virtio_mmio_devices(xam);
@@ -188,6 +231,8 @@ static void xen_arm_machine_class_init(ObjectClass *oc, void *data)
     mc->init = xen_arm_init;
     mc->max_cpus = 1;
     mc->default_machine_opts = "accel=xen";
+    /* Set explicitly here to make sure that real ram_size is passed */
+    mc->default_ram_size = 0;
 
 #ifdef CONFIG_TPM
     object_class_property_add(oc, "tpm-base-addr", "uint64_t",
diff --git a/include/hw/xen/xen_native.h b/include/hw/xen/xen_native.h
index a4b1aa9e5d..5d2718261f 100644
--- a/include/hw/xen/xen_native.h
+++ b/include/hw/xen/xen_native.h
@@ -539,4 +539,12 @@ static inline int xendevicemodel_set_irq_level(xendevicemodel_handle *dmod,
 #define GUEST_VIRTIO_MMIO_SPI_LAST    43
 #endif
 
+#if defined(__i386__) || defined(__x86_64__)
+#define GUEST_RAM_BANKS   2
+#define GUEST_RAM0_BASE   0x40000000ULL /* 3GB of low RAM @ 1GB */
+#define GUEST_RAM0_SIZE   0xc0000000ULL
+#define GUEST_RAM1_BASE   0x0200000000ULL /* 1016GB of RAM @ 8GB */
+#define GUEST_RAM1_SIZE   0xfe00000000ULL
+#endif
+
 #endif /* QEMU_HW_XEN_NATIVE_H */

From ae4acc696f34bf0cb8865521c16ff378b19915b3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:14 +0100
Subject: [PATCH 1330/1353] target/arm: Reduce dcz_blocksize to uint8_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This value is only 4 bits wide.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230811214031.171020-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index cdf8600b96..a1e604366b 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1074,7 +1074,8 @@ struct ArchCPU {
     bool prop_lpa2;
 
     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
-    uint32_t dcz_blocksize;
+    uint8_t dcz_blocksize;
+
     uint64_t rvbar_prop; /* Property/input signals.  */
 
     /* Configurable aspects of GIC cpu interface (which is part of the CPU) */

From 851ec6eba56d0153574c042bff05a3d0f235a00e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:14 +0100
Subject: [PATCH 1331/1353] target/arm: Allow cpu to configure GM blocksize

Previously we hard-coded the blocksize with GMID_EL1_BS.
But the value we choose for -cpu max does not match the
value that cortex-a710 uses.

Mirror the way we handle dcz_blocksize.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230811214031.171020-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               |  2 ++
 target/arm/helper.c            | 11 +++++---
 target/arm/internals.h         |  6 -----
 target/arm/tcg/cpu64.c         |  1 +
 target/arm/tcg/mte_helper.c    | 46 ++++++++++++++++++++++------------
 target/arm/tcg/translate-a64.c |  5 ++--
 target/arm/tcg/translate.h     |  2 ++
 7 files changed, 45 insertions(+), 28 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index a1e604366b..278cc135c2 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1075,6 +1075,8 @@ struct ArchCPU {
 
     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
     uint8_t dcz_blocksize;
+    /* GM blocksize, in log_2(words), ie low 4 bits of GMID_EL0 */
+    uint8_t gm_blocksize;
 
     uint64_t rvbar_prop; /* Property/input signals.  */
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 85291d5b8e..4dfc51de35 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7748,10 +7748,6 @@ static const ARMCPRegInfo mte_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 6,
       .access = PL1_RW, .accessfn = access_mte,
       .fieldoffset = offsetof(CPUARMState, cp15.gcr_el1) },
-    { .name = "GMID_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 4,
-      .access = PL1_R, .accessfn = access_aa64_tid5,
-      .type = ARM_CP_CONST, .resetvalue = GMID_EL1_BS },
     { .name = "TCO", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 7,
       .type = ARM_CP_NO_RAW,
@@ -9342,6 +9338,13 @@ void register_cp_regs_for_features(ARMCPU *cpu)
      * then define only a RAZ/WI version of PSTATE.TCO.
      */
     if (cpu_isar_feature(aa64_mte, cpu)) {
+        ARMCPRegInfo gmid_reginfo = {
+            .name = "GMID_EL1", .state = ARM_CP_STATE_AA64,
+            .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 4,
+            .access = PL1_R, .accessfn = access_aa64_tid5,
+            .type = ARM_CP_CONST, .resetvalue = cpu->gm_blocksize,
+        };
+        define_one_arm_cp_reg(cpu, &gmid_reginfo);
         define_arm_cp_regs(cpu, mte_reginfo);
         define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo);
     } else if (cpu_isar_feature(aa64_mte_insn_reg, cpu)) {
diff --git a/target/arm/internals.h b/target/arm/internals.h
index cf13bb94f5..5f5393b25c 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1246,12 +1246,6 @@ void arm_log_exception(CPUState *cs);
 
 #endif /* !CONFIG_USER_ONLY */
 
-/*
- * The log2 of the words in the tag block, for GMID_EL1.BS.
- * The is the maximum, 256 bytes, which manipulates 64-bits of tags.
- */
-#define GMID_EL1_BS  6
-
 /*
  * SVE predicates are 1/8 the size of SVE vectors, and cannot use
  * the same simd_desc() encoding due to restrictions on size.
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 8019f00bc3..4cd73779c8 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -868,6 +868,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
     cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
+    cpu->gm_blocksize = 6;  /*  256 bytes */
 
     cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
     cpu->sme_vq.supported = SVE_VQ_POW2_MAP;
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 9c64def081..3640c6e57f 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -421,46 +421,54 @@ void HELPER(st2g_stub)(CPUARMState *env, uint64_t ptr)
     }
 }
 
-#define LDGM_STGM_SIZE  (4 << GMID_EL1_BS)
-
 uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)
 {
     int mmu_idx = cpu_mmu_index(env, false);
     uintptr_t ra = GETPC();
+    int gm_bs = env_archcpu(env)->gm_blocksize;
+    int gm_bs_bytes = 4 << gm_bs;
     void *tag_mem;
 
-    ptr = QEMU_ALIGN_DOWN(ptr, LDGM_STGM_SIZE);
+    ptr = QEMU_ALIGN_DOWN(ptr, gm_bs_bytes);
 
     /* Trap if accessing an invalid page.  */
     tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_LOAD,
-                                 LDGM_STGM_SIZE, MMU_DATA_LOAD,
-                                 LDGM_STGM_SIZE / (2 * TAG_GRANULE), ra);
+                                 gm_bs_bytes, MMU_DATA_LOAD,
+                                 gm_bs_bytes / (2 * TAG_GRANULE), ra);
 
     /* The tag is squashed to zero if the page does not support tags.  */
     if (!tag_mem) {
         return 0;
     }
 
-    QEMU_BUILD_BUG_ON(GMID_EL1_BS != 6);
     /*
-     * We are loading 64-bits worth of tags.  The ordering of elements
-     * within the word corresponds to a 64-bit little-endian operation.
+     * The ordering of elements within the word corresponds to
+     * a little-endian operation.
      */
-    return ldq_le_p(tag_mem);
+    switch (gm_bs) {
+    case 6:
+        /* 256 bytes -> 16 tags -> 64 result bits */
+        return ldq_le_p(tag_mem);
+    default:
+        /* cpu configured with unsupported gm blocksize. */
+        g_assert_not_reached();
+    }
 }
 
 void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)
 {
     int mmu_idx = cpu_mmu_index(env, false);
     uintptr_t ra = GETPC();
+    int gm_bs = env_archcpu(env)->gm_blocksize;
+    int gm_bs_bytes = 4 << gm_bs;
     void *tag_mem;
 
-    ptr = QEMU_ALIGN_DOWN(ptr, LDGM_STGM_SIZE);
+    ptr = QEMU_ALIGN_DOWN(ptr, gm_bs_bytes);
 
     /* Trap if accessing an invalid page.  */
     tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,
-                                 LDGM_STGM_SIZE, MMU_DATA_LOAD,
-                                 LDGM_STGM_SIZE / (2 * TAG_GRANULE), ra);
+                                 gm_bs_bytes, MMU_DATA_LOAD,
+                                 gm_bs_bytes / (2 * TAG_GRANULE), ra);
 
     /*
      * Tag store only happens if the page support tags,
@@ -470,12 +478,18 @@ void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)
         return;
     }
 
-    QEMU_BUILD_BUG_ON(GMID_EL1_BS != 6);
     /*
-     * We are storing 64-bits worth of tags.  The ordering of elements
-     * within the word corresponds to a 64-bit little-endian operation.
+     * The ordering of elements within the word corresponds to
+     * a little-endian operation.
      */
-    stq_le_p(tag_mem, val);
+    switch (gm_bs) {
+    case 6:
+        stq_le_p(tag_mem, val);
+        break;
+    default:
+        /* cpu configured with unsupported gm blocksize. */
+        g_assert_not_reached();
+    }
 }
 
 void HELPER(stzgm_tags)(CPUARMState *env, uint64_t ptr, uint64_t val)
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index da686cc953..0b77c92437 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -3786,7 +3786,7 @@ static bool trans_STGM(DisasContext *s, arg_ldst_tag *a)
         gen_helper_stgm(cpu_env, addr, tcg_rt);
     } else {
         MMUAccessType acc = MMU_DATA_STORE;
-        int size = 4 << GMID_EL1_BS;
+        int size = 4 << s->gm_blocksize;
 
         clean_addr = clean_data_tbi(s, addr);
         tcg_gen_andi_i64(clean_addr, clean_addr, -size);
@@ -3818,7 +3818,7 @@ static bool trans_LDGM(DisasContext *s, arg_ldst_tag *a)
         gen_helper_ldgm(tcg_rt, cpu_env, addr);
     } else {
         MMUAccessType acc = MMU_DATA_LOAD;
-        int size = 4 << GMID_EL1_BS;
+        int size = 4 << s->gm_blocksize;
 
         clean_addr = clean_data_tbi(s, addr);
         tcg_gen_andi_i64(clean_addr, clean_addr, -size);
@@ -13896,6 +13896,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->cp_regs = arm_cpu->cp_regs;
     dc->features = env->features;
     dc->dcz_blocksize = arm_cpu->dcz_blocksize;
+    dc->gm_blocksize = arm_cpu->gm_blocksize;
 
 #ifdef CONFIG_USER_ONLY
     /* In sve_probe_page, we assume TBI is enabled. */
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index d1cacff0b2..f748ba6f39 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -151,6 +151,8 @@ typedef struct DisasContext {
     int8_t btype;
     /* A copy of cpu->dcz_blocksize. */
     uint8_t dcz_blocksize;
+    /* A copy of cpu->gm_blocksize. */
+    uint8_t gm_blocksize;
     /* True if this page is guarded.  */
     bool guarded_page;
     /* Bottom two bits of XScale c15_cpar coprocessor access control reg */

From 7134cb07b749b669c25526c044b19204686f4663 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:14 +0100
Subject: [PATCH 1332/1353] target/arm: Support more GM blocksizes

Support all of the easy GM block sizes.
Use direct memory operations, since the pointers are aligned.

While BS=2 (16 bytes, 1 tag) is a legal setting, that requires
an atomic store of one nibble.  This is not difficult, but there
is also no point in supporting it until required.

Note that cortex-a710 sets GM blocksize to match its cacheline
size of 64 bytes.  I expect many implementations will also
match the cacheline, which makes 16 bytes very unlikely.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c            | 18 +++++++++---
 target/arm/tcg/mte_helper.c | 56 +++++++++++++++++++++++++++++++------
 2 files changed, 62 insertions(+), 12 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index d906d2b1ca..fe73fd8af7 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2056,16 +2056,26 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
                                        ID_PFR1, VIRTUALIZATION, 0);
     }
 
+    if (cpu_isar_feature(aa64_mte, cpu)) {
+        /*
+         * The architectural range of GM blocksize is 2-6, however qemu
+         * doesn't support blocksize of 2 (see HELPER(ldgm)).
+         */
+        if (tcg_enabled()) {
+            assert(cpu->gm_blocksize >= 3 && cpu->gm_blocksize <= 6);
+        }
+
 #ifndef CONFIG_USER_ONLY
-    if (cpu->tag_memory == NULL && cpu_isar_feature(aa64_mte, cpu)) {
         /*
          * Disable the MTE feature bits if we do not have tag-memory
          * provided by the machine.
          */
-        cpu->isar.id_aa64pfr1 =
-            FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);
-    }
+        if (cpu->tag_memory == NULL) {
+            cpu->isar.id_aa64pfr1 =
+                FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);
+        }
 #endif
+    }
 
     if (tcg_enabled()) {
         /*
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 3640c6e57f..b23d11563a 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -428,6 +428,8 @@ uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)
     int gm_bs = env_archcpu(env)->gm_blocksize;
     int gm_bs_bytes = 4 << gm_bs;
     void *tag_mem;
+    uint64_t ret;
+    int shift;
 
     ptr = QEMU_ALIGN_DOWN(ptr, gm_bs_bytes);
 
@@ -443,16 +445,41 @@ uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)
 
     /*
      * The ordering of elements within the word corresponds to
-     * a little-endian operation.
+     * a little-endian operation.  Computation of shift comes from
+     *
+     *     index = address<LOG2_TAG_GRANULE+3:LOG2_TAG_GRANULE>
+     *     data<index*4+3:index*4> = tag
+     *
+     * Because of the alignment of ptr above, BS=6 has shift=0.
+     * All memory operations are aligned.  Defer support for BS=2,
+     * requiring insertion or extraction of a nibble, until we
+     * support a cpu that requires it.
      */
     switch (gm_bs) {
+    case 3:
+        /* 32 bytes -> 2 tags -> 8 result bits */
+        ret = *(uint8_t *)tag_mem;
+        break;
+    case 4:
+        /* 64 bytes -> 4 tags -> 16 result bits */
+        ret = cpu_to_le16(*(uint16_t *)tag_mem);
+        break;
+    case 5:
+        /* 128 bytes -> 8 tags -> 32 result bits */
+        ret = cpu_to_le32(*(uint32_t *)tag_mem);
+        break;
     case 6:
         /* 256 bytes -> 16 tags -> 64 result bits */
-        return ldq_le_p(tag_mem);
+        return cpu_to_le64(*(uint64_t *)tag_mem);
     default:
-        /* cpu configured with unsupported gm blocksize. */
+        /*
+         * CPU configured with unsupported/invalid gm blocksize.
+         * This is detected early in arm_cpu_realizefn.
+         */
         g_assert_not_reached();
     }
+    shift = extract64(ptr, LOG2_TAG_GRANULE, 4) * 4;
+    return ret << shift;
 }
 
 void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)
@@ -462,6 +489,7 @@ void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)
     int gm_bs = env_archcpu(env)->gm_blocksize;
     int gm_bs_bytes = 4 << gm_bs;
     void *tag_mem;
+    int shift;
 
     ptr = QEMU_ALIGN_DOWN(ptr, gm_bs_bytes);
 
@@ -478,13 +506,25 @@ void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)
         return;
     }
 
-    /*
-     * The ordering of elements within the word corresponds to
-     * a little-endian operation.
-     */
+    /* See LDGM for comments on BS and on shift.  */
+    shift = extract64(ptr, LOG2_TAG_GRANULE, 4) * 4;
+    val >>= shift;
     switch (gm_bs) {
+    case 3:
+        /* 32 bytes -> 2 tags -> 8 result bits */
+        *(uint8_t *)tag_mem = val;
+        break;
+    case 4:
+        /* 64 bytes -> 4 tags -> 16 result bits */
+        *(uint16_t *)tag_mem = cpu_to_le16(val);
+        break;
+    case 5:
+        /* 128 bytes -> 8 tags -> 32 result bits */
+        *(uint32_t *)tag_mem = cpu_to_le32(val);
+        break;
     case 6:
-        stq_le_p(tag_mem, val);
+        /* 256 bytes -> 16 tags -> 64 result bits */
+        *(uint64_t *)tag_mem = cpu_to_le64(val);
         break;
     default:
         /* cpu configured with unsupported gm blocksize. */

From cd305b5f311d6ecea6cf487f3ec78b84bcd60d63 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:15 +0100
Subject: [PATCH 1333/1353] target/arm: When tag memory is not present, set
 MTE=1

When the cpu support MTE, but the system does not, reduce cpu
support to user instructions at EL0 instead of completely
disabling MTE.  If we encounter a cpu implementation which does
something else, we can revisit this setting.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index fe73fd8af7..23901121ac 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2067,12 +2067,13 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
 #ifndef CONFIG_USER_ONLY
         /*
-         * Disable the MTE feature bits if we do not have tag-memory
-         * provided by the machine.
+         * If we do not have tag-memory provided by the machine,
+         * reduce MTE support to instructions enabled at EL0.
+         * This matches Cortex-A710 BROADCASTMTE input being LOW.
          */
         if (cpu->tag_memory == NULL) {
             cpu->isar.id_aa64pfr1 =
-                FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 0);
+                FIELD_DP64(cpu->isar.id_aa64pfr1, ID_AA64PFR1, MTE, 1);
         }
 #endif
     }

From d8100822d6988cf7837aa780eaa24de6752b1c59 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:15 +0100
Subject: [PATCH 1334/1353] target/arm: Introduce make_ccsidr64

Do not hard-code the constants for Neoverse V1.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu64.c | 48 ++++++++++++++++++++++++++++--------------
 1 file changed, 32 insertions(+), 16 deletions(-)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 4cd73779c8..00f39d42a8 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -24,9 +24,36 @@
 #include "qemu/module.h"
 #include "qapi/visitor.h"
 #include "hw/qdev-properties.h"
+#include "qemu/units.h"
 #include "internals.h"
 #include "cpregs.h"
 
+static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
+                              unsigned cachesize)
+{
+    unsigned lg_linesize = ctz32(linesize);
+    unsigned sets;
+
+    /*
+     * The 64-bit CCSIDR_EL1 format is:
+     *   [55:32] number of sets - 1
+     *   [23:3]  associativity - 1
+     *   [2:0]   log2(linesize) - 4
+     *           so 0 == 16 bytes, 1 == 32 bytes, 2 == 64 bytes, etc
+     */
+    assert(assoc != 0);
+    assert(is_power_of_2(linesize));
+    assert(lg_linesize >= 4 && lg_linesize <= 7 + 4);
+
+    /* sets * associativity * linesize == cachesize. */
+    sets = cachesize / (assoc * linesize);
+    assert(cachesize % (assoc * linesize) == 0);
+
+    return ((uint64_t)(sets - 1) << 32)
+         | ((assoc - 1) << 3)
+         | (lg_linesize - 4);
+}
+
 static void aarch64_a35_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -651,26 +678,15 @@ static void aarch64_neoverse_v1_initfn(Object *obj)
      * The Neoverse-V1 r1p2 TRM lists 32-bit format CCSIDR_EL1 values,
      * but also says it implements CCIDX, which means they should be
      * 64-bit format. So we here use values which are based on the textual
-     * information in chapter 2 of the TRM (and on the fact that
-     * sets * associativity * linesize == cachesize).
-     *
-     * The 64-bit CCSIDR_EL1 format is:
-     *   [55:32] number of sets - 1
-     *   [23:3]  associativity - 1
-     *   [2:0]   log2(linesize) - 4
-     *           so 0 == 16 bytes, 1 == 32 bytes, 2 == 64 bytes, etc
-     *
-     * L1: 4-way set associative 64-byte line size, total size 64K,
-     * so sets is 256.
+     * information in chapter 2 of the TRM:
      *
+     * L1: 4-way set associative 64-byte line size, total size 64K.
      * L2: 8-way set associative, 64 byte line size, either 512K or 1MB.
-     * We pick 1MB, so this has 2048 sets.
-     *
      * L3: No L3 (this matches the CLIDR_EL1 value).
      */
-    cpu->ccsidr[0] = 0x000000ff0000001aull; /* 64KB L1 dcache */
-    cpu->ccsidr[1] = 0x000000ff0000001aull; /* 64KB L1 icache */
-    cpu->ccsidr[2] = 0x000007ff0000003aull; /* 1MB L2 cache */
+    cpu->ccsidr[0] = make_ccsidr64(4, 64, 64 * KiB); /* L1 dcache */
+    cpu->ccsidr[1] = cpu->ccsidr[0];                 /* L1 icache */
+    cpu->ccsidr[2] = make_ccsidr64(8, 64, 1 * MiB);  /* L2 cache */
 
     /* From 3.2.115 SCTLR_EL3 */
     cpu->reset_sctlr = 0x30c50838;

From 6d482423fcecb34056013268fa552b1ce2efcfeb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:15 +0100
Subject: [PATCH 1335/1353] target/arm: Apply access checks to neoverse-n1
 special registers

Access to many of the special registers is enabled or disabled
by ACTLR_EL[23], which we implement as constant 0, which means
that all writes outside EL3 should trap.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h    |  2 ++
 target/arm/helper.c    |  4 ++--
 target/arm/tcg/cpu64.c | 46 +++++++++++++++++++++++++++++++++---------
 3 files changed, 41 insertions(+), 11 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 14785686f6..f1293d16c0 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -1077,4 +1077,6 @@ static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
 void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
 #endif
 
+CPAccessResult access_tvm_trvm(CPUARMState *, const ARMCPRegInfo *, bool);
+
 #endif /* TARGET_ARM_CPREGS_H */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 4dfc51de35..e3f5a7d2bd 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -319,8 +319,8 @@ static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
 }
 
 /* Check for traps from EL1 due to HCR_EL2.TVM and HCR_EL2.TRVM.  */
-static CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri,
-                                      bool isread)
+CPAccessResult access_tvm_trvm(CPUARMState *env, const ARMCPRegInfo *ri,
+                               bool isread)
 {
     if (arm_current_el(env) == 1) {
         uint64_t trap = isread ? HCR_TRVM : HCR_TVM;
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 00f39d42a8..bc3db798f0 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -463,10 +463,30 @@ static void aarch64_a64fx_initfn(Object *obj)
     /* TODO:  Add A64FX specific HPC extension registers */
 }
 
+static CPAccessResult access_actlr_w(CPUARMState *env, const ARMCPRegInfo *r,
+                                     bool read)
+{
+    if (!read) {
+        int el = arm_current_el(env);
+
+        /* Because ACTLR_EL2 is constant 0, writes below EL2 trap to EL2. */
+        if (el < 2 && arm_is_el2_enabled(env)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+        /* Because ACTLR_EL3 is constant 0, writes below EL3 trap to EL3. */
+        if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
+            return CP_ACCESS_TRAP_EL3;
+        }
+    }
+    return CP_ACCESS_OK;
+}
+
 static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
     { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      /* Traps and enables are the same as for TCR_EL1. */
+      .accessfn = access_tvm_trvm, .fgt = FGT_TCR_EL1, },
     { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
@@ -481,13 +501,16 @@ static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
       .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     /*
      * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
      * (and in particular its system registers).
@@ -497,7 +520,8 @@ static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
       .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
     { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010,
+      .accessfn = access_actlr_w },
     { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
       .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
@@ -512,16 +536,20 @@ static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
       .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
 };
 
 static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)

From 87da10b45ce50b55c0306862a511c77243b1b065 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:15 +0100
Subject: [PATCH 1336/1353] target/arm: Apply access checks to neoverse-v1
 special registers

There is only one additional EL1 register modeled, which
also needs to use access_actlr_w.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index bc3db798f0..b0cac05be6 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -560,7 +560,8 @@ static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
 static const ARMCPRegInfo neoverse_v1_cp_reginfo[] = {
     { .name = "CPUECTLR2_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 5,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0,
+      .accessfn = access_actlr_w },
     { .name = "CPUPPMCR_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 2, .opc2 = 0,
       .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },

From 3d5f45ec895b278bfc442a436eebefab598f416a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:16 +0100
Subject: [PATCH 1337/1353] target/arm: Suppress FEAT_TRBE (Trace Buffer
 Extension)

Like FEAT_TRF (Self-hosted Trace Extension), suppress tracing
external to the cpu, which is out of scope for QEMU.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 23901121ac..17540300fe 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2088,6 +2088,9 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         /* FEAT_SPE (Statistical Profiling Extension) */
         cpu->isar.id_aa64dfr0 =
             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
+        /* FEAT_TRBE (Trace Buffer Extension) */
+        cpu->isar.id_aa64dfr0 =
+            FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEBUFFER, 0);
         /* FEAT_TRF (Self-hosted Trace Extension) */
         cpu->isar.id_aa64dfr0 =
             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, TRACEFILT, 0);

From df9a391757c7fc5a6c88f6d32b82d6f2f860bd1d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 31 Aug 2023 09:45:16 +0100
Subject: [PATCH 1338/1353] target/arm: Implement FEAT_HPDS2 as a no-op

This feature allows the operating system to set TCR_ELx.HWU*
to allow the implementation to use the PBHA bits from the
block and page descriptors for for IMPLEMENTATION DEFINED
purposes.  Since QEMU has no need to use these bits, we may
simply ignore them.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230811214031.171020-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu32.c        | 2 +-
 target/arm/tcg/cpu64.c        | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index bdafc68819..2012bbf7c7 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -40,6 +40,7 @@ the following architecture extensions:
 - FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
 - FEAT_HCX (Support for the HCRX_EL2 register)
 - FEAT_HPDS (Hierarchical permission disables)
+- FEAT_HPDS2 (Translation table page-based hardware attributes)
 - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
 - FEAT_IDST (ID space trap handling)
 - FEAT_IESB (Implicit error synchronization event)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index 47d2e8e781..1f918ff537 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -62,7 +62,7 @@ void aa32_max_features(ARMCPU *cpu)
     cpu->isar.id_mmfr3 = t;
 
     t = cpu->isar.id_mmfr4;
-    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1);         /* FEAT_AA32HPD */
+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 2);         /* FEAT_HPDS2 */
     t = FIELD_DP32(t, ID_MMFR4, AC2, 1);          /* ACTLR2, HACTLR2 */
     t = FIELD_DP32(t, ID_MMFR4, CNP, 1);          /* FEAT_TTCNP */
     t = FIELD_DP32(t, ID_MMFR4, XNX, 1);          /* FEAT_XNX */
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index b0cac05be6..11e406d960 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -852,7 +852,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 2);   /* FEAT_HAFDBS */
     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
-    t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
+    t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 2);     /* FEAT_HPDS2 */
     t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);       /* FEAT_LOR */
     t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 3);      /* FEAT_PAN3 */
     t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1);      /* FEAT_XNX */

From 9e771a2fc68d98c5719b877e008d1dca64e6896e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 31 Aug 2023 09:45:16 +0100
Subject: [PATCH 1339/1353] target/arm: properly document FEAT_CRC32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a mandatory feature for Armv8.1 architectures but we don't
state the feature clearly in our emulation list. Also include
FEAT_CRC32 comment in aarch64_max_tcg_initfn for ease of grepping.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20230824075406.1515566-1-alex.bennee@linaro.org
Cc: qemu-stable@nongnu.org
Message-Id: <20230222110104.3996971-1-alex.bennee@linaro.org>
[PMM: pluralize 'instructions' in docs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 2012bbf7c7..2e6a7c8961 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -14,6 +14,7 @@ the following architecture extensions:
 - FEAT_BBM at level 2 (Translation table break-before-make levels)
 - FEAT_BF16 (AArch64 BFloat16 instructions)
 - FEAT_BTI (Branch Target Identification)
+- FEAT_CRC32 (CRC32 instructions)
 - FEAT_CSV2 (Cache speculation variant 2)
 - FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
 - FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 11e406d960..0f8972950d 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -788,7 +788,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2);      /* FEAT_PMULL */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);     /* FEAT_SHA1 */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2);     /* FEAT_SHA512 */
-    t = FIELD_DP64(t, ID_AA64ISAR0, CRC32, 1);
+    t = FIELD_DP64(t, ID_AA64ISAR0, CRC32, 1);    /* FEAT_CRC32 */
     t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 2);   /* FEAT_LSE */
     t = FIELD_DP64(t, ID_AA64ISAR0, RDM, 1);      /* FEAT_RDM */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 1);     /* FEAT_SHA3 */

From 6f97cfd8e0e081c9f5e4ee27984b239912b911b9 Mon Sep 17 00:00:00 2001
From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Thu, 31 Aug 2023 09:45:16 +0100
Subject: [PATCH 1340/1353] Remove i.MX7 IOMUX GPR device from i.MX6UL

i.MX7 IOMUX GPR device is not equivalent to i.MX6UL IOMUXC GPR device.
In particular, register 22 is not present on i.MX6UL and this is actualy
The only register that is really emulated in the i.MX7 IOMUX GPR device.

Note: The i.MX6UL code is actually also implementing the IOMUX GPR device
as an unimplemented device at the same bus adress and the 2 instantiations
were actualy colliding. So we go back to the unimplemented device for now.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 48681bf51ee97646479bb261bee19abebbc8074e.1692964892.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6ul.c         | 11 -----------
 include/hw/arm/fsl-imx6ul.h |  2 --
 2 files changed, 13 deletions(-)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index 2189dcbb72..0fdd2782ba 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -63,11 +63,6 @@ static void fsl_imx6ul_init(Object *obj)
      */
     object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
 
-    /*
-     * GPR
-     */
-    object_initialize_child(obj, "gpr", &s->gpr, TYPE_IMX7_GPR);
-
     /*
      * GPIOs 1 to 5
      */
@@ -537,12 +532,6 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                                             FSL_IMX6UL_WDOGn_IRQ[i]));
     }
 
-    /*
-     * GPR
-     */
-    sysbus_realize(SYS_BUS_DEVICE(&s->gpr), &error_abort);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpr), 0, FSL_IMX6UL_IOMUXC_GPR_ADDR);
-
     /*
      * SDMA
      */
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index 9ee15ae38d..3bec6bb3fb 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -22,7 +22,6 @@
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
 #include "hw/misc/imx7_snvs.h"
-#include "hw/misc/imx7_gpr.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/gpio/imx_gpio.h"
@@ -74,7 +73,6 @@ struct FslIMX6ULState {
     IMX6SRCState       src;
     IMX7SNVSState      snvs;
     IMXGPCv2State      gpcv2;
-    IMX7GPRState       gpr;
     IMXSPIState        spi[FSL_IMX6UL_NUM_ECSPIS];
     IMXI2CState        i2c[FSL_IMX6UL_NUM_I2CS];
     IMXSerialState     uart[FSL_IMX6UL_NUM_UARTS];

From 0cd4926b855c491c88facaa0abeaf910f7d6ff01 Mon Sep 17 00:00:00 2001
From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Thu, 31 Aug 2023 09:45:16 +0100
Subject: [PATCH 1341/1353] Refactor i.MX6UL processor code

* Add Addr and size definition for most i.MX6UL devices in i.MX6UL header file.
* Use those newly defined named constants whenever possible.
* Standardize the way we init a familly of unimplemented devices
  - SAI
  - PWM
  - CAN
* Add/rework few comments

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: d579043fbd4e4b490370783fda43fc02c8e9be75.1692964892.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6ul.c         | 147 ++++++++++++++++++++++-----------
 include/hw/arm/fsl-imx6ul.h | 156 +++++++++++++++++++++++++++++++-----
 2 files changed, 232 insertions(+), 71 deletions(-)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index 0fdd2782ba..06a32aff64 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -64,7 +64,7 @@ static void fsl_imx6ul_init(Object *obj)
     object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
 
     /*
-     * GPIOs 1 to 5
+     * GPIOs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_GPIOS; i++) {
         snprintf(name, NAME_SIZE, "gpio%d", i);
@@ -72,7 +72,7 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * GPT 1, 2
+     * GPTs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_GPTS; i++) {
         snprintf(name, NAME_SIZE, "gpt%d", i);
@@ -80,7 +80,7 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * EPIT 1, 2
+     * EPITs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_EPITS; i++) {
         snprintf(name, NAME_SIZE, "epit%d", i + 1);
@@ -88,7 +88,7 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * eCSPI
+     * eCSPIs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_ECSPIS; i++) {
         snprintf(name, NAME_SIZE, "spi%d", i + 1);
@@ -96,7 +96,7 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * I2C
+     * I2Cs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_I2CS; i++) {
         snprintf(name, NAME_SIZE, "i2c%d", i + 1);
@@ -104,7 +104,7 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * UART
+     * UARTs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_UARTS; i++) {
         snprintf(name, NAME_SIZE, "uart%d", i);
@@ -112,25 +112,31 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * Ethernet
+     * Ethernets
      */
     for (i = 0; i < FSL_IMX6UL_NUM_ETHS; i++) {
         snprintf(name, NAME_SIZE, "eth%d", i);
         object_initialize_child(obj, name, &s->eth[i], TYPE_IMX_ENET);
     }
 
-    /* USB */
+    /*
+     * USB PHYs
+     */
     for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
         snprintf(name, NAME_SIZE, "usbphy%d", i);
         object_initialize_child(obj, name, &s->usbphy[i], TYPE_IMX_USBPHY);
     }
+
+    /*
+     * USBs
+     */
     for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
         snprintf(name, NAME_SIZE, "usb%d", i);
         object_initialize_child(obj, name, &s->usb[i], TYPE_CHIPIDEA);
     }
 
     /*
-     * SDHCI
+     * SDHCIs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_USDHCS; i++) {
         snprintf(name, NAME_SIZE, "usdhc%d", i);
@@ -138,7 +144,7 @@ static void fsl_imx6ul_init(Object *obj)
     }
 
     /*
-     * Watchdog
+     * Watchdogs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_WDTS; i++) {
         snprintf(name, NAME_SIZE, "wdt%d", i);
@@ -184,10 +190,10 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
      * A7MPCORE DAP
      */
     create_unimplemented_device("a7mpcore-dap", FSL_IMX6UL_A7MPCORE_DAP_ADDR,
-                                0x100000);
+                                FSL_IMX6UL_A7MPCORE_DAP_SIZE);
 
     /*
-     * GPT 1, 2
+     * GPTs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_GPTS; i++) {
         static const hwaddr FSL_IMX6UL_GPTn_ADDR[FSL_IMX6UL_NUM_GPTS] = {
@@ -212,7 +218,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * EPIT 1, 2
+     * EPITs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_EPITS; i++) {
         static const hwaddr FSL_IMX6UL_EPITn_ADDR[FSL_IMX6UL_NUM_EPITS] = {
@@ -237,7 +243,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * GPIO
+     * GPIOs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_GPIOS; i++) {
         static const hwaddr FSL_IMX6UL_GPIOn_ADDR[FSL_IMX6UL_NUM_GPIOS] = {
@@ -279,17 +285,12 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * IOMUXC and IOMUXC_GPR
+     * IOMUXC
      */
-    for (i = 0; i < 1; i++) {
-        static const hwaddr FSL_IMX6UL_IOMUXCn_ADDR[FSL_IMX6UL_NUM_IOMUXCS] = {
-            FSL_IMX6UL_IOMUXC_ADDR,
-            FSL_IMX6UL_IOMUXC_GPR_ADDR,
-        };
-
-        snprintf(name, NAME_SIZE, "iomuxc%d", i);
-        create_unimplemented_device(name, FSL_IMX6UL_IOMUXCn_ADDR[i], 0x4000);
-    }
+    create_unimplemented_device("iomuxc", FSL_IMX6UL_IOMUXC_ADDR,
+                                FSL_IMX6UL_IOMUXC_SIZE);
+    create_unimplemented_device("iomuxc_gpr", FSL_IMX6UL_IOMUXC_GPR_ADDR,
+                                FSL_IMX6UL_IOMUXC_GPR_SIZE);
 
     /*
      * CCM
@@ -309,7 +310,9 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->gpcv2), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpcv2), 0, FSL_IMX6UL_GPC_ADDR);
 
-    /* Initialize all ECSPI */
+    /*
+     * ECSPIs
+     */
     for (i = 0; i < FSL_IMX6UL_NUM_ECSPIS; i++) {
         static const hwaddr FSL_IMX6UL_SPIn_ADDR[FSL_IMX6UL_NUM_ECSPIS] = {
             FSL_IMX6UL_ECSPI1_ADDR,
@@ -337,7 +340,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * I2C
+     * I2Cs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_I2CS; i++) {
         static const hwaddr FSL_IMX6UL_I2Cn_ADDR[FSL_IMX6UL_NUM_I2CS] = {
@@ -363,7 +366,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * UART
+     * UARTs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_UARTS; i++) {
         static const hwaddr FSL_IMX6UL_UARTn_ADDR[FSL_IMX6UL_NUM_UARTS] = {
@@ -401,7 +404,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * Ethernet
+     * Ethernets
      *
      * We must use two loops since phy_connected affects the other interface
      * and we have to set all properties before calling sysbus_realize().
@@ -454,28 +457,45 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                                             FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
     }
 
-    /* USB */
+    /*
+     * USB PHYs
+     */
     for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
+        static const hwaddr
+                     FSL_IMX6UL_USB_PHYn_ADDR[FSL_IMX6UL_NUM_USB_PHYS] = {
+            FSL_IMX6UL_USBPHY1_ADDR,
+            FSL_IMX6UL_USBPHY2_ADDR,
+        };
+
         sysbus_realize(SYS_BUS_DEVICE(&s->usbphy[i]), &error_abort);
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
-                        FSL_IMX6UL_USBPHY1_ADDR + i * 0x1000);
+                        FSL_IMX6UL_USB_PHYn_ADDR[i]);
     }
 
+    /*
+     * USBs
+     */
     for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
+        static const hwaddr FSL_IMX6UL_USB02_USBn_ADDR[FSL_IMX6UL_NUM_USBS] = {
+            FSL_IMX6UL_USBO2_USB1_ADDR,
+            FSL_IMX6UL_USBO2_USB2_ADDR,
+        };
+
         static const int FSL_IMX6UL_USBn_IRQ[] = {
             FSL_IMX6UL_USB1_IRQ,
             FSL_IMX6UL_USB2_IRQ,
         };
+
         sysbus_realize(SYS_BUS_DEVICE(&s->usb[i]), &error_abort);
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
-                        FSL_IMX6UL_USBO2_USB_ADDR + i * 0x200);
+                        FSL_IMX6UL_USB02_USBn_ADDR[i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
                            qdev_get_gpio_in(DEVICE(&s->a7mpcore),
                                             FSL_IMX6UL_USBn_IRQ[i]));
     }
 
     /*
-     * USDHC
+     * USDHCs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_USDHCS; i++) {
         static const hwaddr FSL_IMX6UL_USDHCn_ADDR[FSL_IMX6UL_NUM_USDHCS] = {
@@ -507,7 +527,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6UL_SNVS_HP_ADDR);
 
     /*
-     * Watchdog
+     * Watchdogs
      */
     for (i = 0; i < FSL_IMX6UL_NUM_WDTS; i++) {
         static const hwaddr FSL_IMX6UL_WDOGn_ADDR[FSL_IMX6UL_NUM_WDTS] = {
@@ -515,6 +535,7 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
             FSL_IMX6UL_WDOG2_ADDR,
             FSL_IMX6UL_WDOG3_ADDR,
         };
+
         static const int FSL_IMX6UL_WDOGn_IRQ[FSL_IMX6UL_NUM_WDTS] = {
             FSL_IMX6UL_WDOG1_IRQ,
             FSL_IMX6UL_WDOG2_IRQ,
@@ -535,33 +556,59 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     /*
      * SDMA
      */
-    create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR, 0x4000);
+    create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR,
+                                FSL_IMX6UL_SDMA_SIZE);
 
     /*
-     * SAI (Audio SSI (Synchronous Serial Interface))
+     * SAIs (Audio SSI (Synchronous Serial Interface))
      */
-    create_unimplemented_device("sai1", FSL_IMX6UL_SAI1_ADDR, 0x4000);
-    create_unimplemented_device("sai2", FSL_IMX6UL_SAI2_ADDR, 0x4000);
-    create_unimplemented_device("sai3", FSL_IMX6UL_SAI3_ADDR, 0x4000);
+    for (i = 0; i < FSL_IMX6UL_NUM_SAIS; i++) {
+        static const hwaddr FSL_IMX6UL_SAIn_ADDR[FSL_IMX6UL_NUM_SAIS] = {
+            FSL_IMX6UL_SAI1_ADDR,
+            FSL_IMX6UL_SAI2_ADDR,
+            FSL_IMX6UL_SAI3_ADDR,
+        };
+
+        snprintf(name, NAME_SIZE, "sai%d", i);
+        create_unimplemented_device(name, FSL_IMX6UL_SAIn_ADDR[i],
+                                    FSL_IMX6UL_SAIn_SIZE);
+    }
 
     /*
-     * PWM
+     * PWMs
      */
-    create_unimplemented_device("pwm1", FSL_IMX6UL_PWM1_ADDR, 0x4000);
-    create_unimplemented_device("pwm2", FSL_IMX6UL_PWM2_ADDR, 0x4000);
-    create_unimplemented_device("pwm3", FSL_IMX6UL_PWM3_ADDR, 0x4000);
-    create_unimplemented_device("pwm4", FSL_IMX6UL_PWM4_ADDR, 0x4000);
+    for (i = 0; i < FSL_IMX6UL_NUM_PWMS; i++) {
+        static const hwaddr FSL_IMX6UL_PWMn_ADDR[FSL_IMX6UL_NUM_PWMS] = {
+            FSL_IMX6UL_PWM1_ADDR,
+            FSL_IMX6UL_PWM2_ADDR,
+            FSL_IMX6UL_PWM3_ADDR,
+            FSL_IMX6UL_PWM4_ADDR,
+        };
+
+        snprintf(name, NAME_SIZE, "pwm%d", i);
+        create_unimplemented_device(name, FSL_IMX6UL_PWMn_ADDR[i],
+                                    FSL_IMX6UL_PWMn_SIZE);
+    }
 
     /*
      * Audio ASRC (asynchronous sample rate converter)
      */
-    create_unimplemented_device("asrc", FSL_IMX6UL_ASRC_ADDR, 0x4000);
+    create_unimplemented_device("asrc", FSL_IMX6UL_ASRC_ADDR,
+                                FSL_IMX6UL_ASRC_SIZE);
 
     /*
-     * CAN
+     * CANs
      */
-    create_unimplemented_device("can1", FSL_IMX6UL_CAN1_ADDR, 0x4000);
-    create_unimplemented_device("can2", FSL_IMX6UL_CAN2_ADDR, 0x4000);
+    for (i = 0; i < FSL_IMX6UL_NUM_CANS; i++) {
+        static const hwaddr FSL_IMX6UL_CANn_ADDR[FSL_IMX6UL_NUM_CANS] = {
+            FSL_IMX6UL_CAN1_ADDR,
+            FSL_IMX6UL_CAN2_ADDR,
+        };
+
+        snprintf(name, NAME_SIZE, "can%d", i);
+        create_unimplemented_device(name, FSL_IMX6UL_CANn_ADDR[i],
+                                    FSL_IMX6UL_CANn_SIZE);
+    }
 
     /*
      * APHB_DMA
@@ -579,13 +626,15 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
         };
 
         snprintf(name, NAME_SIZE, "adc%d", i);
-        create_unimplemented_device(name, FSL_IMX6UL_ADCn_ADDR[i], 0x4000);
+        create_unimplemented_device(name, FSL_IMX6UL_ADCn_ADDR[i],
+                                    FSL_IMX6UL_ADCn_SIZE);
     }
 
     /*
      * LCD
      */
-    create_unimplemented_device("lcdif", FSL_IMX6UL_LCDIF_ADDR, 0x4000);
+    create_unimplemented_device("lcdif", FSL_IMX6UL_LCDIF_ADDR,
+                                FSL_IMX6UL_LCDIF_SIZE);
 
     /*
      * ROM memory
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index 3bec6bb3fb..f7bf684b42 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -37,6 +37,7 @@
 #include "exec/memory.h"
 #include "cpu.h"
 #include "qom/object.h"
+#include "qemu/units.h"
 
 #define TYPE_FSL_IMX6UL "fsl-imx6ul"
 OBJECT_DECLARE_SIMPLE_TYPE(FslIMX6ULState, FSL_IMX6UL)
@@ -57,6 +58,9 @@ enum FslIMX6ULConfiguration {
     FSL_IMX6UL_NUM_ADCS         = 2,
     FSL_IMX6UL_NUM_USB_PHYS     = 2,
     FSL_IMX6UL_NUM_USBS         = 2,
+    FSL_IMX6UL_NUM_SAIS         = 3,
+    FSL_IMX6UL_NUM_CANS         = 2,
+    FSL_IMX6UL_NUM_PWMS         = 4,
 };
 
 struct FslIMX6ULState {
@@ -92,119 +96,227 @@ struct FslIMX6ULState {
 
 enum FslIMX6ULMemoryMap {
     FSL_IMX6UL_MMDC_ADDR            = 0x80000000,
-    FSL_IMX6UL_MMDC_SIZE            = 2 * 1024 * 1024 * 1024UL,
+    FSL_IMX6UL_MMDC_SIZE            = (2 * GiB),
 
     FSL_IMX6UL_QSPI1_MEM_ADDR       = 0x60000000,
-    FSL_IMX6UL_EIM_ALIAS_ADDR       = 0x58000000,
-    FSL_IMX6UL_EIM_CS_ADDR          = 0x50000000,
-    FSL_IMX6UL_AES_ENCRYPT_ADDR     = 0x10000000,
-    FSL_IMX6UL_QSPI1_RX_ADDR        = 0x0C000000,
+    FSL_IMX6UL_QSPI1_MEM_SIZE       = (256 * MiB),
 
-    /* AIPS-2 */
+    FSL_IMX6UL_EIM_ALIAS_ADDR       = 0x58000000,
+    FSL_IMX6UL_EIM_ALIAS_SIZE       = (128 * MiB),
+
+    FSL_IMX6UL_EIM_CS_ADDR          = 0x50000000,
+    FSL_IMX6UL_EIM_CS_SIZE          = (128 * MiB),
+
+    FSL_IMX6UL_AES_ENCRYPT_ADDR     = 0x10000000,
+    FSL_IMX6UL_AES_ENCRYPT_SIZE     = (1 * MiB),
+
+    FSL_IMX6UL_QSPI1_RX_ADDR        = 0x0C000000,
+    FSL_IMX6UL_QSPI1_RX_SIZE        = (32 * MiB),
+
+    /* AIPS-2 Begin */
     FSL_IMX6UL_UART6_ADDR           = 0x021FC000,
+
     FSL_IMX6UL_I2C4_ADDR            = 0x021F8000,
+
     FSL_IMX6UL_UART5_ADDR           = 0x021F4000,
     FSL_IMX6UL_UART4_ADDR           = 0x021F0000,
     FSL_IMX6UL_UART3_ADDR           = 0x021EC000,
     FSL_IMX6UL_UART2_ADDR           = 0x021E8000,
+
     FSL_IMX6UL_WDOG3_ADDR           = 0x021E4000,
+
     FSL_IMX6UL_QSPI_ADDR            = 0x021E0000,
+    FSL_IMX6UL_QSPI_SIZE            = 0x500,
+
     FSL_IMX6UL_SYS_CNT_CTRL_ADDR    = 0x021DC000,
+    FSL_IMX6UL_SYS_CNT_CTRL_SIZE    = (16 * KiB),
+
     FSL_IMX6UL_SYS_CNT_CMP_ADDR     = 0x021D8000,
+    FSL_IMX6UL_SYS_CNT_CMP_SIZE     = (16 * KiB),
+
     FSL_IMX6UL_SYS_CNT_RD_ADDR      = 0x021D4000,
+    FSL_IMX6UL_SYS_CNT_RD_SIZE      = (16 * KiB),
+
     FSL_IMX6UL_TZASC_ADDR           = 0x021D0000,
+    FSL_IMX6UL_TZASC_SIZE           = (16 * KiB),
+
     FSL_IMX6UL_PXP_ADDR             = 0x021CC000,
+    FSL_IMX6UL_PXP_SIZE             = (16 * KiB),
+
     FSL_IMX6UL_LCDIF_ADDR           = 0x021C8000,
+    FSL_IMX6UL_LCDIF_SIZE           = 0x100,
+
     FSL_IMX6UL_CSI_ADDR             = 0x021C4000,
+    FSL_IMX6UL_CSI_SIZE             = 0x100,
+
     FSL_IMX6UL_CSU_ADDR             = 0x021C0000,
+    FSL_IMX6UL_CSU_SIZE             = (16 * KiB),
+
     FSL_IMX6UL_OCOTP_CTRL_ADDR      = 0x021BC000,
+    FSL_IMX6UL_OCOTP_CTRL_SIZE      = (4 * KiB),
+
     FSL_IMX6UL_EIM_ADDR             = 0x021B8000,
+    FSL_IMX6UL_EIM_SIZE             = 0x100,
+
     FSL_IMX6UL_SIM2_ADDR            = 0x021B4000,
+
     FSL_IMX6UL_MMDC_CFG_ADDR        = 0x021B0000,
+    FSL_IMX6UL_MMDC_CFG_SIZE        = (4 * KiB),
+
     FSL_IMX6UL_ROMCP_ADDR           = 0x021AC000,
+    FSL_IMX6UL_ROMCP_SIZE           = 0x300,
+
     FSL_IMX6UL_I2C3_ADDR            = 0x021A8000,
     FSL_IMX6UL_I2C2_ADDR            = 0x021A4000,
     FSL_IMX6UL_I2C1_ADDR            = 0x021A0000,
+
     FSL_IMX6UL_ADC2_ADDR            = 0x0219C000,
     FSL_IMX6UL_ADC1_ADDR            = 0x02198000,
+    FSL_IMX6UL_ADCn_SIZE            = 0x100,
+
     FSL_IMX6UL_USDHC2_ADDR          = 0x02194000,
     FSL_IMX6UL_USDHC1_ADDR          = 0x02190000,
-    FSL_IMX6UL_SIM1_ADDR            = 0x0218C000,
-    FSL_IMX6UL_ENET1_ADDR           = 0x02188000,
-    FSL_IMX6UL_USBO2_USBMISC_ADDR   = 0x02184800,
-    FSL_IMX6UL_USBO2_USB_ADDR       = 0x02184000,
-    FSL_IMX6UL_USBO2_PL301_ADDR     = 0x02180000,
-    FSL_IMX6UL_AIPS2_CFG_ADDR       = 0x0217C000,
-    FSL_IMX6UL_CAAM_ADDR            = 0x02140000,
-    FSL_IMX6UL_A7MPCORE_DAP_ADDR    = 0x02100000,
 
-    /* AIPS-1 */
+    FSL_IMX6UL_SIM1_ADDR            = 0x0218C000,
+    FSL_IMX6UL_SIMn_SIZE            = (16 * KiB),
+
+    FSL_IMX6UL_ENET1_ADDR           = 0x02188000,
+
+    FSL_IMX6UL_USBO2_USBMISC_ADDR   = 0x02184800,
+    FSL_IMX6UL_USBO2_USB1_ADDR      = 0x02184000,
+    FSL_IMX6UL_USBO2_USB2_ADDR      = 0x02184200,
+
+    FSL_IMX6UL_USBO2_PL301_ADDR     = 0x02180000,
+    FSL_IMX6UL_USBO2_PL301_SIZE     = (16 * KiB),
+
+    FSL_IMX6UL_AIPS2_CFG_ADDR       = 0x0217C000,
+    FSL_IMX6UL_AIPS2_CFG_SIZE       = 0x100,
+
+    FSL_IMX6UL_CAAM_ADDR            = 0x02140000,
+    FSL_IMX6UL_CAAM_SIZE            = (16 * KiB),
+
+    FSL_IMX6UL_A7MPCORE_DAP_ADDR    = 0x02100000,
+    FSL_IMX6UL_A7MPCORE_DAP_SIZE    = (4 * KiB),
+    /* AIPS-2 End */
+
+    /* AIPS-1 Begin */
     FSL_IMX6UL_PWM8_ADDR            = 0x020FC000,
     FSL_IMX6UL_PWM7_ADDR            = 0x020F8000,
     FSL_IMX6UL_PWM6_ADDR            = 0x020F4000,
     FSL_IMX6UL_PWM5_ADDR            = 0x020F0000,
+
     FSL_IMX6UL_SDMA_ADDR            = 0x020EC000,
+    FSL_IMX6UL_SDMA_SIZE            = 0x300,
+
     FSL_IMX6UL_GPT2_ADDR            = 0x020E8000,
+
     FSL_IMX6UL_IOMUXC_GPR_ADDR      = 0x020E4000,
+    FSL_IMX6UL_IOMUXC_GPR_SIZE      = 0x40,
+
     FSL_IMX6UL_IOMUXC_ADDR          = 0x020E0000,
+    FSL_IMX6UL_IOMUXC_SIZE          = 0x700,
+
     FSL_IMX6UL_GPC_ADDR             = 0x020DC000,
+
     FSL_IMX6UL_SRC_ADDR             = 0x020D8000,
+
     FSL_IMX6UL_EPIT2_ADDR           = 0x020D4000,
     FSL_IMX6UL_EPIT1_ADDR           = 0x020D0000,
+
     FSL_IMX6UL_SNVS_HP_ADDR         = 0x020CC000,
+
     FSL_IMX6UL_USBPHY2_ADDR         = 0x020CA000,
-    FSL_IMX6UL_USBPHY2_SIZE         = (4 * 1024),
     FSL_IMX6UL_USBPHY1_ADDR         = 0x020C9000,
-    FSL_IMX6UL_USBPHY1_SIZE         = (4 * 1024),
+
     FSL_IMX6UL_ANALOG_ADDR          = 0x020C8000,
+    FSL_IMX6UL_ANALOG_SIZE          = 0x300,
+
     FSL_IMX6UL_CCM_ADDR             = 0x020C4000,
+
     FSL_IMX6UL_WDOG2_ADDR           = 0x020C0000,
     FSL_IMX6UL_WDOG1_ADDR           = 0x020BC000,
+
     FSL_IMX6UL_KPP_ADDR             = 0x020B8000,
+    FSL_IMX6UL_KPP_SIZE             = 0x10,
+
     FSL_IMX6UL_ENET2_ADDR           = 0x020B4000,
+
     FSL_IMX6UL_SNVS_LP_ADDR         = 0x020B0000,
+    FSL_IMX6UL_SNVS_LP_SIZE         = (16 * KiB),
+
     FSL_IMX6UL_GPIO5_ADDR           = 0x020AC000,
     FSL_IMX6UL_GPIO4_ADDR           = 0x020A8000,
     FSL_IMX6UL_GPIO3_ADDR           = 0x020A4000,
     FSL_IMX6UL_GPIO2_ADDR           = 0x020A0000,
     FSL_IMX6UL_GPIO1_ADDR           = 0x0209C000,
+
     FSL_IMX6UL_GPT1_ADDR            = 0x02098000,
+
     FSL_IMX6UL_CAN2_ADDR            = 0x02094000,
     FSL_IMX6UL_CAN1_ADDR            = 0x02090000,
+    FSL_IMX6UL_CANn_SIZE            = (4 * KiB),
+
     FSL_IMX6UL_PWM4_ADDR            = 0x0208C000,
     FSL_IMX6UL_PWM3_ADDR            = 0x02088000,
     FSL_IMX6UL_PWM2_ADDR            = 0x02084000,
     FSL_IMX6UL_PWM1_ADDR            = 0x02080000,
+    FSL_IMX6UL_PWMn_SIZE            = 0x20,
+
     FSL_IMX6UL_AIPS1_CFG_ADDR       = 0x0207C000,
+    FSL_IMX6UL_AIPS1_CFG_SIZE       = (16 * KiB),
+
     FSL_IMX6UL_BEE_ADDR             = 0x02044000,
+    FSL_IMX6UL_BEE_SIZE             = (16 * KiB),
+
     FSL_IMX6UL_TOUCH_CTRL_ADDR      = 0x02040000,
+    FSL_IMX6UL_TOUCH_CTRL_SIZE      = 0x100,
+
     FSL_IMX6UL_SPBA_ADDR            = 0x0203C000,
+    FSL_IMX6UL_SPBA_SIZE            = 0x100,
+
     FSL_IMX6UL_ASRC_ADDR            = 0x02034000,
+    FSL_IMX6UL_ASRC_SIZE            = 0x100,
+
     FSL_IMX6UL_SAI3_ADDR            = 0x02030000,
     FSL_IMX6UL_SAI2_ADDR            = 0x0202C000,
     FSL_IMX6UL_SAI1_ADDR            = 0x02028000,
+    FSL_IMX6UL_SAIn_SIZE            = 0x200,
+
     FSL_IMX6UL_UART8_ADDR           = 0x02024000,
     FSL_IMX6UL_UART1_ADDR           = 0x02020000,
     FSL_IMX6UL_UART7_ADDR           = 0x02018000,
+
     FSL_IMX6UL_ECSPI4_ADDR          = 0x02014000,
     FSL_IMX6UL_ECSPI3_ADDR          = 0x02010000,
     FSL_IMX6UL_ECSPI2_ADDR          = 0x0200C000,
     FSL_IMX6UL_ECSPI1_ADDR          = 0x02008000,
+
     FSL_IMX6UL_SPDIF_ADDR           = 0x02004000,
+    FSL_IMX6UL_SPDIF_SIZE           = 0x100,
+    /* AIPS-1 End */
+
+    FSL_IMX6UL_BCH_ADDR             = 0x01808000,
+    FSL_IMX6UL_BCH_SIZE             = 0x200,
+
+    FSL_IMX6UL_GPMI_ADDR            = 0x01806000,
+    FSL_IMX6UL_GPMI_SIZE            = 0x200,
 
     FSL_IMX6UL_APBH_DMA_ADDR        = 0x01804000,
-    FSL_IMX6UL_APBH_DMA_SIZE        = (32 * 1024),
+    FSL_IMX6UL_APBH_DMA_SIZE        = (4 * KiB),
 
     FSL_IMX6UL_A7MPCORE_ADDR        = 0x00A00000,
 
     FSL_IMX6UL_OCRAM_ALIAS_ADDR     = 0x00920000,
-    FSL_IMX6UL_OCRAM_ALIAS_SIZE     = 0x00060000,
+    FSL_IMX6UL_OCRAM_ALIAS_SIZE     = (384 * KiB),
+
     FSL_IMX6UL_OCRAM_MEM_ADDR       = 0x00900000,
-    FSL_IMX6UL_OCRAM_MEM_SIZE       = 0x00020000,
+    FSL_IMX6UL_OCRAM_MEM_SIZE       = (128 * KiB),
+
     FSL_IMX6UL_CAAM_MEM_ADDR        = 0x00100000,
-    FSL_IMX6UL_CAAM_MEM_SIZE        = 0x00008000,
+    FSL_IMX6UL_CAAM_MEM_SIZE        = (32 * KiB),
+
     FSL_IMX6UL_ROM_ADDR             = 0x00000000,
-    FSL_IMX6UL_ROM_SIZE             = 0x00018000,
+    FSL_IMX6UL_ROM_SIZE             = (96 * KiB),
 };
 
 enum FslIMX6ULIRQs {

From f6020845e20d1cc033770bbff8c1d92855d2bba5 Mon Sep 17 00:00:00 2001
From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Thu, 31 Aug 2023 09:45:16 +0100
Subject: [PATCH 1342/1353] Add i.MX6UL missing devices.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add TZASC as unimplemented device.
  - Allow bare metal application to access this (unimplemented) device
* Add CSU as unimplemented device.
  - Allow bare metal application to access this (unimplemented) device
* Add 4 missing PWM devices

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 59e4dc56e14eccfefd379275ec19048dff9c10b3.1692964892.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6ul.c         | 16 ++++++++++++++++
 include/hw/arm/fsl-imx6ul.h |  2 +-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index 06a32aff64..e37b69a5e1 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -583,6 +583,10 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
             FSL_IMX6UL_PWM2_ADDR,
             FSL_IMX6UL_PWM3_ADDR,
             FSL_IMX6UL_PWM4_ADDR,
+            FSL_IMX6UL_PWM5_ADDR,
+            FSL_IMX6UL_PWM6_ADDR,
+            FSL_IMX6UL_PWM7_ADDR,
+            FSL_IMX6UL_PWM8_ADDR,
         };
 
         snprintf(name, NAME_SIZE, "pwm%d", i);
@@ -636,6 +640,18 @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("lcdif", FSL_IMX6UL_LCDIF_ADDR,
                                 FSL_IMX6UL_LCDIF_SIZE);
 
+    /*
+     * CSU
+     */
+    create_unimplemented_device("csu", FSL_IMX6UL_CSU_ADDR,
+                                FSL_IMX6UL_CSU_SIZE);
+
+    /*
+     * TZASC
+     */
+    create_unimplemented_device("tzasc", FSL_IMX6UL_TZASC_ADDR,
+                                FSL_IMX6UL_TZASC_SIZE);
+
     /*
      * ROM memory
      */
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index f7bf684b42..63012628ff 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -60,7 +60,7 @@ enum FslIMX6ULConfiguration {
     FSL_IMX6UL_NUM_USBS         = 2,
     FSL_IMX6UL_NUM_SAIS         = 3,
     FSL_IMX6UL_NUM_CANS         = 2,
-    FSL_IMX6UL_NUM_PWMS         = 4,
+    FSL_IMX6UL_NUM_PWMS         = 8,
 };
 
 struct FslIMX6ULState {

From 45b8b34dfacb14503d6f8692fa450f81175328e6 Mon Sep 17 00:00:00 2001
From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Thu, 31 Aug 2023 09:45:17 +0100
Subject: [PATCH 1343/1353] Refactor i.MX7 processor code

* Add Addr and size definition for all i.MX7 devices in i.MX7 header file.
* Use those newly defined named constants whenever possible.
* Standardize the way we init a familly of unimplemented devices
  - SAI
  - PWM
  - CAN
* Add/rework few comments

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 59e195d33e4d486a8d131392acd46633c8c10ed7.1692964892.git.jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx7.c         | 130 ++++++++++-----
 include/hw/arm/fsl-imx7.h | 330 ++++++++++++++++++++++++++++----------
 2 files changed, 335 insertions(+), 125 deletions(-)

diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index 9e41d4b677..e976053539 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -36,6 +36,9 @@ static void fsl_imx7_init(Object *obj)
     char name[NAME_SIZE];
     int i;
 
+    /*
+     * CPUs
+     */
     for (i = 0; i < MIN(ms->smp.cpus, FSL_IMX7_NUM_CPUS); i++) {
         snprintf(name, NAME_SIZE, "cpu%d", i);
         object_initialize_child(obj, name, &s->cpu[i],
@@ -49,7 +52,7 @@ static void fsl_imx7_init(Object *obj)
                             TYPE_A15MPCORE_PRIV);
 
     /*
-     * GPIOs 1 to 7
+     * GPIOs
      */
     for (i = 0; i < FSL_IMX7_NUM_GPIOS; i++) {
         snprintf(name, NAME_SIZE, "gpio%d", i);
@@ -57,7 +60,7 @@ static void fsl_imx7_init(Object *obj)
     }
 
     /*
-     * GPT1, 2, 3, 4
+     * GPTs
      */
     for (i = 0; i < FSL_IMX7_NUM_GPTS; i++) {
         snprintf(name, NAME_SIZE, "gpt%d", i);
@@ -79,19 +82,24 @@ static void fsl_imx7_init(Object *obj)
      */
     object_initialize_child(obj, "gpcv2", &s->gpcv2, TYPE_IMX_GPCV2);
 
+    /*
+     * ECSPIs
+     */
     for (i = 0; i < FSL_IMX7_NUM_ECSPIS; i++) {
         snprintf(name, NAME_SIZE, "spi%d", i + 1);
         object_initialize_child(obj, name, &s->spi[i], TYPE_IMX_SPI);
     }
 
-
+    /*
+     * I2Cs
+     */
     for (i = 0; i < FSL_IMX7_NUM_I2CS; i++) {
         snprintf(name, NAME_SIZE, "i2c%d", i + 1);
         object_initialize_child(obj, name, &s->i2c[i], TYPE_IMX_I2C);
     }
 
     /*
-     * UART
+     * UARTs
      */
     for (i = 0; i < FSL_IMX7_NUM_UARTS; i++) {
             snprintf(name, NAME_SIZE, "uart%d", i);
@@ -99,7 +107,7 @@ static void fsl_imx7_init(Object *obj)
     }
 
     /*
-     * Ethernet
+     * Ethernets
      */
     for (i = 0; i < FSL_IMX7_NUM_ETHS; i++) {
             snprintf(name, NAME_SIZE, "eth%d", i);
@@ -107,7 +115,7 @@ static void fsl_imx7_init(Object *obj)
     }
 
     /*
-     * SDHCI
+     * SDHCIs
      */
     for (i = 0; i < FSL_IMX7_NUM_USDHCS; i++) {
             snprintf(name, NAME_SIZE, "usdhc%d", i);
@@ -120,7 +128,7 @@ static void fsl_imx7_init(Object *obj)
     object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
 
     /*
-     * Watchdog
+     * Watchdogs
      */
     for (i = 0; i < FSL_IMX7_NUM_WDTS; i++) {
             snprintf(name, NAME_SIZE, "wdt%d", i);
@@ -132,8 +140,14 @@ static void fsl_imx7_init(Object *obj)
      */
     object_initialize_child(obj, "gpr", &s->gpr, TYPE_IMX7_GPR);
 
+    /*
+     * PCIE
+     */
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
 
+    /*
+     * USBs
+     */
     for (i = 0; i < FSL_IMX7_NUM_USBS; i++) {
         snprintf(name, NAME_SIZE, "usb%d", i);
         object_initialize_child(obj, name, &s->usb[i], TYPE_CHIPIDEA);
@@ -156,6 +170,9 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    /*
+     * CPUs
+     */
     for (i = 0; i < smp_cpus; i++) {
         o = OBJECT(&s->cpu[i]);
 
@@ -206,10 +223,10 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
      * A7MPCORE DAP
      */
     create_unimplemented_device("a7mpcore-dap", FSL_IMX7_A7MPCORE_DAP_ADDR,
-                                0x100000);
+                                FSL_IMX7_A7MPCORE_DAP_SIZE);
 
     /*
-     * GPT1, 2, 3, 4
+     * GPTs
      */
     for (i = 0; i < FSL_IMX7_NUM_GPTS; i++) {
         static const hwaddr FSL_IMX7_GPTn_ADDR[FSL_IMX7_NUM_GPTS] = {
@@ -234,6 +251,9 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                                             FSL_IMX7_GPTn_IRQ[i]));
     }
 
+    /*
+     * GPIOs
+     */
     for (i = 0; i < FSL_IMX7_NUM_GPIOS; i++) {
         static const hwaddr FSL_IMX7_GPIOn_ADDR[FSL_IMX7_NUM_GPIOS] = {
             FSL_IMX7_GPIO1_ADDR,
@@ -281,16 +301,10 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     /*
      * IOMUXC and IOMUXC_LPSR
      */
-    for (i = 0; i < FSL_IMX7_NUM_IOMUXCS; i++) {
-        static const hwaddr FSL_IMX7_IOMUXCn_ADDR[FSL_IMX7_NUM_IOMUXCS] = {
-            FSL_IMX7_IOMUXC_ADDR,
-            FSL_IMX7_IOMUXC_LPSR_ADDR,
-        };
-
-        snprintf(name, NAME_SIZE, "iomuxc%d", i);
-        create_unimplemented_device(name, FSL_IMX7_IOMUXCn_ADDR[i],
-                                    FSL_IMX7_IOMUXCn_SIZE);
-    }
+    create_unimplemented_device("iomuxc", FSL_IMX7_IOMUXC_ADDR,
+                                FSL_IMX7_IOMUXC_SIZE);
+    create_unimplemented_device("iomuxc_lspr", FSL_IMX7_IOMUXC_LPSR_ADDR,
+                                FSL_IMX7_IOMUXC_LPSR_SIZE);
 
     /*
      * CCM
@@ -310,7 +324,9 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->gpcv2), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpcv2), 0, FSL_IMX7_GPC_ADDR);
 
-    /* Initialize all ECSPI */
+    /*
+     * ECSPIs
+     */
     for (i = 0; i < FSL_IMX7_NUM_ECSPIS; i++) {
         static const hwaddr FSL_IMX7_SPIn_ADDR[FSL_IMX7_NUM_ECSPIS] = {
             FSL_IMX7_ECSPI1_ADDR,
@@ -335,6 +351,9 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
                                             FSL_IMX7_SPIn_IRQ[i]));
     }
 
+    /*
+     * I2Cs
+     */
     for (i = 0; i < FSL_IMX7_NUM_I2CS; i++) {
         static const hwaddr FSL_IMX7_I2Cn_ADDR[FSL_IMX7_NUM_I2CS] = {
             FSL_IMX7_I2C1_ADDR,
@@ -359,7 +378,7 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * UART
+     * UARTs
      */
     for (i = 0; i < FSL_IMX7_NUM_UARTS; i++) {
         static const hwaddr FSL_IMX7_UARTn_ADDR[FSL_IMX7_NUM_UARTS] = {
@@ -394,7 +413,7 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * Ethernet
+     * Ethernets
      *
      * We must use two loops since phy_connected affects the other interface
      * and we have to set all properties before calling sysbus_realize().
@@ -434,7 +453,7 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     }
 
     /*
-     * USDHC
+     * USDHCs
      */
     for (i = 0; i < FSL_IMX7_NUM_USDHCS; i++) {
         static const hwaddr FSL_IMX7_USDHCn_ADDR[FSL_IMX7_NUM_USDHCS] = {
@@ -464,7 +483,7 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
      * SNVS
      */
     sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX7_SNVS_ADDR);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX7_SNVS_HP_ADDR);
 
     /*
      * SRC
@@ -472,7 +491,7 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("src", FSL_IMX7_SRC_ADDR, FSL_IMX7_SRC_SIZE);
 
     /*
-     * Watchdog
+     * Watchdogs
      */
     for (i = 0; i < FSL_IMX7_NUM_WDTS; i++) {
         static const hwaddr FSL_IMX7_WDOGn_ADDR[FSL_IMX7_NUM_WDTS] = {
@@ -509,25 +528,49 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("caam", FSL_IMX7_CAAM_ADDR, FSL_IMX7_CAAM_SIZE);
 
     /*
-     * PWM
+     * PWMs
      */
-    create_unimplemented_device("pwm1", FSL_IMX7_PWM1_ADDR, FSL_IMX7_PWMn_SIZE);
-    create_unimplemented_device("pwm2", FSL_IMX7_PWM2_ADDR, FSL_IMX7_PWMn_SIZE);
-    create_unimplemented_device("pwm3", FSL_IMX7_PWM3_ADDR, FSL_IMX7_PWMn_SIZE);
-    create_unimplemented_device("pwm4", FSL_IMX7_PWM4_ADDR, FSL_IMX7_PWMn_SIZE);
+    for (i = 0; i < FSL_IMX7_NUM_PWMS; i++) {
+        static const hwaddr FSL_IMX7_PWMn_ADDR[FSL_IMX7_NUM_PWMS] = {
+            FSL_IMX7_PWM1_ADDR,
+            FSL_IMX7_PWM2_ADDR,
+            FSL_IMX7_PWM3_ADDR,
+            FSL_IMX7_PWM4_ADDR,
+        };
+
+        snprintf(name, NAME_SIZE, "pwm%d", i);
+        create_unimplemented_device(name, FSL_IMX7_PWMn_ADDR[i],
+                                    FSL_IMX7_PWMn_SIZE);
+    }
 
     /*
-     * CAN
+     * CANs
      */
-    create_unimplemented_device("can1", FSL_IMX7_CAN1_ADDR, FSL_IMX7_CANn_SIZE);
-    create_unimplemented_device("can2", FSL_IMX7_CAN2_ADDR, FSL_IMX7_CANn_SIZE);
+    for (i = 0; i < FSL_IMX7_NUM_CANS; i++) {
+        static const hwaddr FSL_IMX7_CANn_ADDR[FSL_IMX7_NUM_CANS] = {
+            FSL_IMX7_CAN1_ADDR,
+            FSL_IMX7_CAN2_ADDR,
+        };
+
+        snprintf(name, NAME_SIZE, "can%d", i);
+        create_unimplemented_device(name, FSL_IMX7_CANn_ADDR[i],
+                                    FSL_IMX7_CANn_SIZE);
+    }
 
     /*
-     * SAI (Audio SSI (Synchronous Serial Interface))
+     * SAIs (Audio SSI (Synchronous Serial Interface))
      */
-    create_unimplemented_device("sai1", FSL_IMX7_SAI1_ADDR, FSL_IMX7_SAIn_SIZE);
-    create_unimplemented_device("sai2", FSL_IMX7_SAI2_ADDR, FSL_IMX7_SAIn_SIZE);
-    create_unimplemented_device("sai2", FSL_IMX7_SAI3_ADDR, FSL_IMX7_SAIn_SIZE);
+    for (i = 0; i < FSL_IMX7_NUM_SAIS; i++) {
+        static const hwaddr FSL_IMX7_SAIn_ADDR[FSL_IMX7_NUM_SAIS] = {
+            FSL_IMX7_SAI1_ADDR,
+            FSL_IMX7_SAI2_ADDR,
+            FSL_IMX7_SAI3_ADDR,
+        };
+
+        snprintf(name, NAME_SIZE, "sai%d", i);
+        create_unimplemented_device(name, FSL_IMX7_SAIn_ADDR[i],
+                                    FSL_IMX7_SAIn_SIZE);
+    }
 
     /*
      * OCOTP
@@ -535,9 +578,15 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("ocotp", FSL_IMX7_OCOTP_ADDR,
                                 FSL_IMX7_OCOTP_SIZE);
 
+    /*
+     * GPR
+     */
     sysbus_realize(SYS_BUS_DEVICE(&s->gpr), &error_abort);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpr), 0, FSL_IMX7_GPR_ADDR);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpr), 0, FSL_IMX7_IOMUXC_GPR_ADDR);
 
+    /*
+     * PCIE
+     */
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
 
@@ -550,7 +599,9 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
 
-
+    /*
+     * USBs
+     */
     for (i = 0; i < FSL_IMX7_NUM_USBS; i++) {
         static const hwaddr FSL_IMX7_USBMISCn_ADDR[FSL_IMX7_NUM_USBS] = {
             FSL_IMX7_USBMISC1_ADDR,
@@ -612,6 +663,7 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
      */
     create_unimplemented_device("pcie-phy", FSL_IMX7_PCIE_PHY_ADDR,
                                 FSL_IMX7_PCIE_PHY_SIZE);
+
 }
 
 static Property fsl_imx7_properties[] = {
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index fcce6421c8..06b2c5e4ac 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -25,7 +25,6 @@
 #include "hw/misc/imx7_ccm.h"
 #include "hw/misc/imx7_snvs.h"
 #include "hw/misc/imx7_gpr.h"
-#include "hw/misc/imx6_src.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/gpio/imx_gpio.h"
 #include "hw/char/imx_serial.h"
@@ -39,6 +38,7 @@
 #include "hw/usb/chipidea.h"
 #include "cpu.h"
 #include "qom/object.h"
+#include "qemu/units.h"
 
 #define TYPE_FSL_IMX7 "fsl-imx7"
 OBJECT_DECLARE_SIMPLE_TYPE(FslIMX7State, FSL_IMX7)
@@ -57,6 +57,9 @@ enum FslIMX7Configuration {
     FSL_IMX7_NUM_ECSPIS       = 4,
     FSL_IMX7_NUM_USBS         = 3,
     FSL_IMX7_NUM_ADCS         = 2,
+    FSL_IMX7_NUM_SAIS         = 3,
+    FSL_IMX7_NUM_CANS         = 2,
+    FSL_IMX7_NUM_PWMS         = 4,
 };
 
 struct FslIMX7State {
@@ -87,80 +90,106 @@ struct FslIMX7State {
 
 enum FslIMX7MemoryMap {
     FSL_IMX7_MMDC_ADDR            = 0x80000000,
-    FSL_IMX7_MMDC_SIZE            = 2 * 1024 * 1024 * 1024UL,
+    FSL_IMX7_MMDC_SIZE            = (2 * GiB),
 
-    FSL_IMX7_GPIO1_ADDR           = 0x30200000,
-    FSL_IMX7_GPIO2_ADDR           = 0x30210000,
-    FSL_IMX7_GPIO3_ADDR           = 0x30220000,
-    FSL_IMX7_GPIO4_ADDR           = 0x30230000,
-    FSL_IMX7_GPIO5_ADDR           = 0x30240000,
-    FSL_IMX7_GPIO6_ADDR           = 0x30250000,
-    FSL_IMX7_GPIO7_ADDR           = 0x30260000,
+    FSL_IMX7_QSPI1_MEM_ADDR       = 0x60000000,
+    FSL_IMX7_QSPI1_MEM_SIZE       = (256 * MiB),
 
-    FSL_IMX7_IOMUXC_LPSR_GPR_ADDR = 0x30270000,
+    FSL_IMX7_PCIE1_MEM_ADDR       = 0x40000000,
+    FSL_IMX7_PCIE1_MEM_SIZE       = (256 * MiB),
 
-    FSL_IMX7_WDOG1_ADDR           = 0x30280000,
-    FSL_IMX7_WDOG2_ADDR           = 0x30290000,
-    FSL_IMX7_WDOG3_ADDR           = 0x302A0000,
-    FSL_IMX7_WDOG4_ADDR           = 0x302B0000,
+    FSL_IMX7_QSPI1_RX_BUF_ADDR    = 0x34000000,
+    FSL_IMX7_QSPI1_RX_BUF_SIZE    = (32 * MiB),
 
-    FSL_IMX7_IOMUXC_LPSR_ADDR     = 0x302C0000,
+    /* PCIe Peripherals */
+    FSL_IMX7_PCIE_REG_ADDR        = 0x33800000,
 
-    FSL_IMX7_GPT1_ADDR            = 0x302D0000,
-    FSL_IMX7_GPT2_ADDR            = 0x302E0000,
-    FSL_IMX7_GPT3_ADDR            = 0x302F0000,
-    FSL_IMX7_GPT4_ADDR            = 0x30300000,
+    /* MMAP Peripherals */
+    FSL_IMX7_DMA_APBH_ADDR        = 0x33000000,
+    FSL_IMX7_DMA_APBH_SIZE        = 0x8000,
 
-    FSL_IMX7_IOMUXC_ADDR          = 0x30330000,
-    FSL_IMX7_IOMUXC_GPR_ADDR      = 0x30340000,
-    FSL_IMX7_IOMUXCn_SIZE         = 0x1000,
+    /* GPV configuration */
+    FSL_IMX7_GPV6_ADDR            = 0x32600000,
+    FSL_IMX7_GPV5_ADDR            = 0x32500000,
+    FSL_IMX7_GPV4_ADDR            = 0x32400000,
+    FSL_IMX7_GPV3_ADDR            = 0x32300000,
+    FSL_IMX7_GPV2_ADDR            = 0x32200000,
+    FSL_IMX7_GPV1_ADDR            = 0x32100000,
+    FSL_IMX7_GPV0_ADDR            = 0x32000000,
+    FSL_IMX7_GPVn_SIZE            = (1 * MiB),
 
-    FSL_IMX7_OCOTP_ADDR           = 0x30350000,
-    FSL_IMX7_OCOTP_SIZE           = 0x10000,
+    /* Arm Peripherals */
+    FSL_IMX7_A7MPCORE_ADDR        = 0x31000000,
 
-    FSL_IMX7_ANALOG_ADDR          = 0x30360000,
-    FSL_IMX7_SNVS_ADDR            = 0x30370000,
-    FSL_IMX7_CCM_ADDR             = 0x30380000,
+    /* AIPS-3 Begin */
 
-    FSL_IMX7_SRC_ADDR             = 0x30390000,
-    FSL_IMX7_SRC_SIZE             = 0x1000,
+    FSL_IMX7_ENET2_ADDR           = 0x30BF0000,
+    FSL_IMX7_ENET1_ADDR           = 0x30BE0000,
 
-    FSL_IMX7_ADC1_ADDR            = 0x30610000,
-    FSL_IMX7_ADC2_ADDR            = 0x30620000,
-    FSL_IMX7_ADCn_SIZE            = 0x1000,
+    FSL_IMX7_SDMA_ADDR            = 0x30BD0000,
+    FSL_IMX7_SDMA_SIZE            = (4 * KiB),
 
-    FSL_IMX7_PWM1_ADDR            = 0x30660000,
-    FSL_IMX7_PWM2_ADDR            = 0x30670000,
-    FSL_IMX7_PWM3_ADDR            = 0x30680000,
-    FSL_IMX7_PWM4_ADDR            = 0x30690000,
-    FSL_IMX7_PWMn_SIZE            = 0x10000,
+    FSL_IMX7_EIM_ADDR             = 0x30BC0000,
+    FSL_IMX7_EIM_SIZE             = (4 * KiB),
 
-    FSL_IMX7_PCIE_PHY_ADDR        = 0x306D0000,
-    FSL_IMX7_PCIE_PHY_SIZE        = 0x10000,
+    FSL_IMX7_QSPI_ADDR            = 0x30BB0000,
+    FSL_IMX7_QSPI_SIZE            = 0x8000,
 
-    FSL_IMX7_GPC_ADDR             = 0x303A0000,
+    FSL_IMX7_SIM2_ADDR            = 0x30BA0000,
+    FSL_IMX7_SIM1_ADDR            = 0x30B90000,
+    FSL_IMX7_SIMn_SIZE            = (4 * KiB),
+
+    FSL_IMX7_USDHC3_ADDR          = 0x30B60000,
+    FSL_IMX7_USDHC2_ADDR          = 0x30B50000,
+    FSL_IMX7_USDHC1_ADDR          = 0x30B40000,
+
+    FSL_IMX7_USB3_ADDR            = 0x30B30000,
+    FSL_IMX7_USBMISC3_ADDR        = 0x30B30200,
+    FSL_IMX7_USB2_ADDR            = 0x30B20000,
+    FSL_IMX7_USBMISC2_ADDR        = 0x30B20200,
+    FSL_IMX7_USB1_ADDR            = 0x30B10000,
+    FSL_IMX7_USBMISC1_ADDR        = 0x30B10200,
+    FSL_IMX7_USBMISCn_SIZE        = 0x200,
+
+    FSL_IMX7_USB_PL301_ADDR       = 0x30AD0000,
+    FSL_IMX7_USB_PL301_SIZE       = (64 * KiB),
+
+    FSL_IMX7_SEMAPHORE_HS_ADDR    = 0x30AC0000,
+    FSL_IMX7_SEMAPHORE_HS_SIZE    = (64 * KiB),
+
+    FSL_IMX7_MUB_ADDR             = 0x30AB0000,
+    FSL_IMX7_MUA_ADDR             = 0x30AA0000,
+    FSL_IMX7_MUn_SIZE             = (KiB),
+
+    FSL_IMX7_UART7_ADDR           = 0x30A90000,
+    FSL_IMX7_UART6_ADDR           = 0x30A80000,
+    FSL_IMX7_UART5_ADDR           = 0x30A70000,
+    FSL_IMX7_UART4_ADDR           = 0x30A60000,
+
+    FSL_IMX7_I2C4_ADDR            = 0x30A50000,
+    FSL_IMX7_I2C3_ADDR            = 0x30A40000,
+    FSL_IMX7_I2C2_ADDR            = 0x30A30000,
+    FSL_IMX7_I2C1_ADDR            = 0x30A20000,
+
+    FSL_IMX7_CAN2_ADDR            = 0x30A10000,
+    FSL_IMX7_CAN1_ADDR            = 0x30A00000,
+    FSL_IMX7_CANn_SIZE            = (4 * KiB),
+
+    FSL_IMX7_AIPS3_CONF_ADDR      = 0x309F0000,
+    FSL_IMX7_AIPS3_CONF_SIZE      = (64 * KiB),
 
     FSL_IMX7_CAAM_ADDR            = 0x30900000,
-    FSL_IMX7_CAAM_SIZE            = 0x40000,
+    FSL_IMX7_CAAM_SIZE            = (256 * KiB),
 
-    FSL_IMX7_CAN1_ADDR            = 0x30A00000,
-    FSL_IMX7_CAN2_ADDR            = 0x30A10000,
-    FSL_IMX7_CANn_SIZE            = 0x10000,
+    FSL_IMX7_SPBA_ADDR            = 0x308F0000,
+    FSL_IMX7_SPBA_SIZE            = (4 * KiB),
 
-    FSL_IMX7_I2C1_ADDR            = 0x30A20000,
-    FSL_IMX7_I2C2_ADDR            = 0x30A30000,
-    FSL_IMX7_I2C3_ADDR            = 0x30A40000,
-    FSL_IMX7_I2C4_ADDR            = 0x30A50000,
+    FSL_IMX7_SAI3_ADDR            = 0x308C0000,
+    FSL_IMX7_SAI2_ADDR            = 0x308B0000,
+    FSL_IMX7_SAI1_ADDR            = 0x308A0000,
+    FSL_IMX7_SAIn_SIZE            = (4 * KiB),
 
-    FSL_IMX7_ECSPI1_ADDR          = 0x30820000,
-    FSL_IMX7_ECSPI2_ADDR          = 0x30830000,
-    FSL_IMX7_ECSPI3_ADDR          = 0x30840000,
-    FSL_IMX7_ECSPI4_ADDR          = 0x30630000,
-
-    FSL_IMX7_LCDIF_ADDR           = 0x30730000,
-    FSL_IMX7_LCDIF_SIZE           = 0x1000,
-
-    FSL_IMX7_UART1_ADDR           = 0x30860000,
+    FSL_IMX7_UART3_ADDR           = 0x30880000,
     /*
      * Some versions of the reference manual claim that UART2 is @
      * 0x30870000, but experiments with HW + DT files in upstream
@@ -168,45 +197,174 @@ enum FslIMX7MemoryMap {
      * actually located @ 0x30890000
      */
     FSL_IMX7_UART2_ADDR           = 0x30890000,
-    FSL_IMX7_UART3_ADDR           = 0x30880000,
-    FSL_IMX7_UART4_ADDR           = 0x30A60000,
-    FSL_IMX7_UART5_ADDR           = 0x30A70000,
-    FSL_IMX7_UART6_ADDR           = 0x30A80000,
-    FSL_IMX7_UART7_ADDR           = 0x30A90000,
+    FSL_IMX7_UART1_ADDR           = 0x30860000,
 
-    FSL_IMX7_SAI1_ADDR            = 0x308A0000,
-    FSL_IMX7_SAI2_ADDR            = 0x308B0000,
-    FSL_IMX7_SAI3_ADDR            = 0x308C0000,
-    FSL_IMX7_SAIn_SIZE            = 0x10000,
+    FSL_IMX7_ECSPI3_ADDR          = 0x30840000,
+    FSL_IMX7_ECSPI2_ADDR          = 0x30830000,
+    FSL_IMX7_ECSPI1_ADDR          = 0x30820000,
+    FSL_IMX7_ECSPIn_SIZE          = (4 * KiB),
 
-    FSL_IMX7_ENET1_ADDR           = 0x30BE0000,
-    FSL_IMX7_ENET2_ADDR           = 0x30BF0000,
+    /* AIPS-3 End */
 
-    FSL_IMX7_USB1_ADDR            = 0x30B10000,
-    FSL_IMX7_USBMISC1_ADDR        = 0x30B10200,
-    FSL_IMX7_USB2_ADDR            = 0x30B20000,
-    FSL_IMX7_USBMISC2_ADDR        = 0x30B20200,
-    FSL_IMX7_USB3_ADDR            = 0x30B30000,
-    FSL_IMX7_USBMISC3_ADDR        = 0x30B30200,
-    FSL_IMX7_USBMISCn_SIZE        = 0x200,
+    /* AIPS-2 Begin */
 
-    FSL_IMX7_USDHC1_ADDR          = 0x30B40000,
-    FSL_IMX7_USDHC2_ADDR          = 0x30B50000,
-    FSL_IMX7_USDHC3_ADDR          = 0x30B60000,
+    FSL_IMX7_AXI_DEBUG_MON_ADDR   = 0x307E0000,
+    FSL_IMX7_AXI_DEBUG_MON_SIZE   = (64 * KiB),
 
-    FSL_IMX7_SDMA_ADDR            = 0x30BD0000,
-    FSL_IMX7_SDMA_SIZE            = 0x1000,
+    FSL_IMX7_PERFMON2_ADDR        = 0x307D0000,
+    FSL_IMX7_PERFMON1_ADDR        = 0x307C0000,
+    FSL_IMX7_PERFMONn_SIZE        = (64 * KiB),
+
+    FSL_IMX7_DDRC_ADDR            = 0x307A0000,
+    FSL_IMX7_DDRC_SIZE            = (4 * KiB),
+
+    FSL_IMX7_DDRC_PHY_ADDR        = 0x30790000,
+    FSL_IMX7_DDRC_PHY_SIZE        = (4 * KiB),
+
+    FSL_IMX7_TZASC_ADDR           = 0x30780000,
+    FSL_IMX7_TZASC_SIZE           = (64 * KiB),
+
+    FSL_IMX7_MIPI_DSI_ADDR        = 0x30760000,
+    FSL_IMX7_MIPI_DSI_SIZE        = (4 * KiB),
+
+    FSL_IMX7_MIPI_CSI_ADDR        = 0x30750000,
+    FSL_IMX7_MIPI_CSI_SIZE        = 0x4000,
+
+    FSL_IMX7_LCDIF_ADDR           = 0x30730000,
+    FSL_IMX7_LCDIF_SIZE           = 0x8000,
+
+    FSL_IMX7_CSI_ADDR             = 0x30710000,
+    FSL_IMX7_CSI_SIZE             = (4 * KiB),
+
+    FSL_IMX7_PXP_ADDR             = 0x30700000,
+    FSL_IMX7_PXP_SIZE             = 0x4000,
+
+    FSL_IMX7_EPDC_ADDR            = 0x306F0000,
+    FSL_IMX7_EPDC_SIZE            = (4 * KiB),
+
+    FSL_IMX7_PCIE_PHY_ADDR        = 0x306D0000,
+    FSL_IMX7_PCIE_PHY_SIZE        = (4 * KiB),
+
+    FSL_IMX7_SYSCNT_CTRL_ADDR     = 0x306C0000,
+    FSL_IMX7_SYSCNT_CMP_ADDR      = 0x306B0000,
+    FSL_IMX7_SYSCNT_RD_ADDR       = 0x306A0000,
+
+    FSL_IMX7_PWM4_ADDR            = 0x30690000,
+    FSL_IMX7_PWM3_ADDR            = 0x30680000,
+    FSL_IMX7_PWM2_ADDR            = 0x30670000,
+    FSL_IMX7_PWM1_ADDR            = 0x30660000,
+    FSL_IMX7_PWMn_SIZE            = (4 * KiB),
+
+    FSL_IMX7_FlEXTIMER2_ADDR      = 0x30650000,
+    FSL_IMX7_FlEXTIMER1_ADDR      = 0x30640000,
+    FSL_IMX7_FLEXTIMERn_SIZE      = (4 * KiB),
+
+    FSL_IMX7_ECSPI4_ADDR          = 0x30630000,
+
+    FSL_IMX7_ADC2_ADDR            = 0x30620000,
+    FSL_IMX7_ADC1_ADDR            = 0x30610000,
+    FSL_IMX7_ADCn_SIZE            = (4 * KiB),
+
+    FSL_IMX7_AIPS2_CONF_ADDR      = 0x305F0000,
+    FSL_IMX7_AIPS2_CONF_SIZE      = (64 * KiB),
+
+    /* AIPS-2 End */
+
+    /* AIPS-1 Begin */
+
+    FSL_IMX7_CSU_ADDR             = 0x303E0000,
+    FSL_IMX7_CSU_SIZE             = (64 * KiB),
+
+    FSL_IMX7_RDC_ADDR             = 0x303D0000,
+    FSL_IMX7_RDC_SIZE             = (4 * KiB),
+
+    FSL_IMX7_SEMAPHORE2_ADDR      = 0x303C0000,
+    FSL_IMX7_SEMAPHORE1_ADDR      = 0x303B0000,
+    FSL_IMX7_SEMAPHOREn_SIZE      = (4 * KiB),
+
+    FSL_IMX7_GPC_ADDR             = 0x303A0000,
+
+    FSL_IMX7_SRC_ADDR             = 0x30390000,
+    FSL_IMX7_SRC_SIZE             = (4 * KiB),
+
+    FSL_IMX7_CCM_ADDR             = 0x30380000,
+
+    FSL_IMX7_SNVS_HP_ADDR         = 0x30370000,
+
+    FSL_IMX7_ANALOG_ADDR          = 0x30360000,
+
+    FSL_IMX7_OCOTP_ADDR           = 0x30350000,
+    FSL_IMX7_OCOTP_SIZE           = 0x10000,
+
+    FSL_IMX7_IOMUXC_GPR_ADDR      = 0x30340000,
+    FSL_IMX7_IOMUXC_GPR_SIZE      = (4 * KiB),
+
+    FSL_IMX7_IOMUXC_ADDR          = 0x30330000,
+    FSL_IMX7_IOMUXC_SIZE          = (4 * KiB),
+
+    FSL_IMX7_KPP_ADDR             = 0x30320000,
+    FSL_IMX7_KPP_SIZE             = (4 * KiB),
+
+    FSL_IMX7_ROMCP_ADDR           = 0x30310000,
+    FSL_IMX7_ROMCP_SIZE           = (4 * KiB),
+
+    FSL_IMX7_GPT4_ADDR            = 0x30300000,
+    FSL_IMX7_GPT3_ADDR            = 0x302F0000,
+    FSL_IMX7_GPT2_ADDR            = 0x302E0000,
+    FSL_IMX7_GPT1_ADDR            = 0x302D0000,
+
+    FSL_IMX7_IOMUXC_LPSR_ADDR     = 0x302C0000,
+    FSL_IMX7_IOMUXC_LPSR_SIZE     = (4 * KiB),
+
+    FSL_IMX7_WDOG4_ADDR           = 0x302B0000,
+    FSL_IMX7_WDOG3_ADDR           = 0x302A0000,
+    FSL_IMX7_WDOG2_ADDR           = 0x30290000,
+    FSL_IMX7_WDOG1_ADDR           = 0x30280000,
+
+    FSL_IMX7_IOMUXC_LPSR_GPR_ADDR = 0x30270000,
+
+    FSL_IMX7_GPIO7_ADDR           = 0x30260000,
+    FSL_IMX7_GPIO6_ADDR           = 0x30250000,
+    FSL_IMX7_GPIO5_ADDR           = 0x30240000,
+    FSL_IMX7_GPIO4_ADDR           = 0x30230000,
+    FSL_IMX7_GPIO3_ADDR           = 0x30220000,
+    FSL_IMX7_GPIO2_ADDR           = 0x30210000,
+    FSL_IMX7_GPIO1_ADDR           = 0x30200000,
+
+    FSL_IMX7_AIPS1_CONF_ADDR      = 0x301F0000,
+    FSL_IMX7_AIPS1_CONF_SIZE      = (64 * KiB),
 
-    FSL_IMX7_A7MPCORE_ADDR        = 0x31000000,
     FSL_IMX7_A7MPCORE_DAP_ADDR    = 0x30000000,
+    FSL_IMX7_A7MPCORE_DAP_SIZE    = (1 * MiB),
 
-    FSL_IMX7_PCIE_REG_ADDR        = 0x33800000,
-    FSL_IMX7_PCIE_REG_SIZE        = 16 * 1024,
+    /* AIPS-1 End */
 
-    FSL_IMX7_GPR_ADDR             = 0x30340000,
+    FSL_IMX7_EIM_CS0_ADDR         = 0x28000000,
+    FSL_IMX7_EIM_CS0_SIZE         = (128 * MiB),
 
-    FSL_IMX7_DMA_APBH_ADDR        = 0x33000000,
-    FSL_IMX7_DMA_APBH_SIZE        = 0x2000,
+    FSL_IMX7_OCRAM_PXP_ADDR       = 0x00940000,
+    FSL_IMX7_OCRAM_PXP_SIZE       = (32 * KiB),
+
+    FSL_IMX7_OCRAM_EPDC_ADDR      = 0x00920000,
+    FSL_IMX7_OCRAM_EPDC_SIZE      = (128 * KiB),
+
+    FSL_IMX7_OCRAM_MEM_ADDR       = 0x00900000,
+    FSL_IMX7_OCRAM_MEM_SIZE       = (128 * KiB),
+
+    FSL_IMX7_TCMU_ADDR            = 0x00800000,
+    FSL_IMX7_TCMU_SIZE            = (32 * KiB),
+
+    FSL_IMX7_TCML_ADDR            = 0x007F8000,
+    FSL_IMX7_TCML_SIZE            = (32 * KiB),
+
+    FSL_IMX7_OCRAM_S_ADDR         = 0x00180000,
+    FSL_IMX7_OCRAM_S_SIZE         = (32 * KiB),
+
+    FSL_IMX7_CAAM_MEM_ADDR        = 0x00100000,
+    FSL_IMX7_CAAM_MEM_SIZE        = (32 * KiB),
+
+    FSL_IMX7_ROM_ADDR             = 0x00000000,
+    FSL_IMX7_ROM_SIZE             = (96 * KiB),
 };
 
 enum FslIMX7IRQs {

From 736988a040b58b7021445580634d4d2d35a4a6cc Mon Sep 17 00:00:00 2001
From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Thu, 31 Aug 2023 09:45:17 +0100
Subject: [PATCH 1344/1353] Add i.MX7 missing TZ devices and memory regions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add TZASC as unimplemented device.
  - Allow bare metal application to access this (unimplemented) device
* Add CSU as unimplemented device.
  - Allow bare metal application to access this (unimplemented) device
* Add various memory segments
  - OCRAM
  - OCRAM EPDC
  - OCRAM PXP
  - OCRAM S
  - ROM
  - CAAM

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: f887a3483996ba06d40bd62ffdfb0ecf68621987.1692964892.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx7.c         | 63 +++++++++++++++++++++++++++++++++++++++
 include/hw/arm/fsl-imx7.h |  7 +++++
 2 files changed, 70 insertions(+)

diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index e976053539..97e982bf06 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -664,6 +664,69 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("pcie-phy", FSL_IMX7_PCIE_PHY_ADDR,
                                 FSL_IMX7_PCIE_PHY_SIZE);
 
+    /*
+     * CSU
+     */
+    create_unimplemented_device("csu", FSL_IMX7_CSU_ADDR,
+                                FSL_IMX7_CSU_SIZE);
+
+    /*
+     * TZASC
+     */
+    create_unimplemented_device("tzasc", FSL_IMX7_TZASC_ADDR,
+                                FSL_IMX7_TZASC_SIZE);
+
+    /*
+     * OCRAM memory
+     */
+    memory_region_init_ram(&s->ocram, NULL, "imx7.ocram",
+                           FSL_IMX7_OCRAM_MEM_SIZE,
+                           &error_abort);
+    memory_region_add_subregion(get_system_memory(), FSL_IMX7_OCRAM_MEM_ADDR,
+                                &s->ocram);
+
+    /*
+     * OCRAM EPDC memory
+     */
+    memory_region_init_ram(&s->ocram_epdc, NULL, "imx7.ocram_epdc",
+                           FSL_IMX7_OCRAM_EPDC_SIZE,
+                           &error_abort);
+    memory_region_add_subregion(get_system_memory(), FSL_IMX7_OCRAM_EPDC_ADDR,
+                                &s->ocram_epdc);
+
+    /*
+     * OCRAM PXP memory
+     */
+    memory_region_init_ram(&s->ocram_pxp, NULL, "imx7.ocram_pxp",
+                           FSL_IMX7_OCRAM_PXP_SIZE,
+                           &error_abort);
+    memory_region_add_subregion(get_system_memory(), FSL_IMX7_OCRAM_PXP_ADDR,
+                                &s->ocram_pxp);
+
+    /*
+     * OCRAM_S memory
+     */
+    memory_region_init_ram(&s->ocram_s, NULL, "imx7.ocram_s",
+                           FSL_IMX7_OCRAM_S_SIZE,
+                           &error_abort);
+    memory_region_add_subregion(get_system_memory(), FSL_IMX7_OCRAM_S_ADDR,
+                                &s->ocram_s);
+
+    /*
+     * ROM memory
+     */
+    memory_region_init_rom(&s->rom, OBJECT(dev), "imx7.rom",
+                           FSL_IMX7_ROM_SIZE, &error_abort);
+    memory_region_add_subregion(get_system_memory(), FSL_IMX7_ROM_ADDR,
+                                &s->rom);
+
+    /*
+     * CAAM memory
+     */
+    memory_region_init_rom(&s->caam, OBJECT(dev), "imx7.caam",
+                           FSL_IMX7_CAAM_MEM_SIZE, &error_abort);
+    memory_region_add_subregion(get_system_memory(), FSL_IMX7_CAAM_MEM_ADDR,
+                                &s->caam);
 }
 
 static Property fsl_imx7_properties[] = {
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index 06b2c5e4ac..01e15004d7 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -84,6 +84,13 @@ struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    MemoryRegion       rom;
+    MemoryRegion       caam;
+    MemoryRegion       ocram;
+    MemoryRegion       ocram_epdc;
+    MemoryRegion       ocram_pxp;
+    MemoryRegion       ocram_s;
+
     uint32_t           phy_num[FSL_IMX7_NUM_ETHS];
     bool               phy_connected[FSL_IMX7_NUM_ETHS];
 };

From 12517bc978e62ce19df0160ad2ef229169a567b2 Mon Sep 17 00:00:00 2001
From: Jean-Christophe Dubois <jcd@tribudubois.net>
Date: Thu, 31 Aug 2023 09:45:17 +0100
Subject: [PATCH 1345/1353] Add i.MX7 SRC device implementation

The SRC device is normally used to start the secondary CPU.

When running Linux directly, QEMU is emulating a PSCI interface that UBOOT
is installing at boot time and therefore the fact that the SRC device is
unimplemented is hidden as Qemu respond directly to PSCI requets without
using the SRC device.

But if you try to run a more bare metal application (maybe uboot itself),
then it is not possible to start the secondary CPU as the SRC is an
unimplemented device.

This patch adds the ability to start the secondary CPU through the SRC
device so that you can use this feature in bare metal applications.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: ce9a0162defd2acee5dc7f8a674743de0cded569.1692964892.git.jcd@tribudubois.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx7.c          |   8 +-
 hw/misc/imx7_src.c         | 276 +++++++++++++++++++++++++++++++++++++
 hw/misc/meson.build        |   1 +
 hw/misc/trace-events       |   4 +
 include/hw/arm/fsl-imx7.h  |   3 +-
 include/hw/misc/imx7_src.h |  66 +++++++++
 6 files changed, 356 insertions(+), 2 deletions(-)
 create mode 100644 hw/misc/imx7_src.c
 create mode 100644 include/hw/misc/imx7_src.h

diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index 97e982bf06..474cfdc87c 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -82,6 +82,11 @@ static void fsl_imx7_init(Object *obj)
      */
     object_initialize_child(obj, "gpcv2", &s->gpcv2, TYPE_IMX_GPCV2);
 
+    /*
+     * SRC
+     */
+    object_initialize_child(obj, "src", &s->src, TYPE_IMX7_SRC);
+
     /*
      * ECSPIs
      */
@@ -488,7 +493,8 @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     /*
      * SRC
      */
-    create_unimplemented_device("src", FSL_IMX7_SRC_ADDR, FSL_IMX7_SRC_SIZE);
+    sysbus_realize(SYS_BUS_DEVICE(&s->src), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->src), 0, FSL_IMX7_SRC_ADDR);
 
     /*
      * Watchdogs
diff --git a/hw/misc/imx7_src.c b/hw/misc/imx7_src.c
new file mode 100644
index 0000000000..983251e86f
--- /dev/null
+++ b/hw/misc/imx7_src.c
@@ -0,0 +1,276 @@
+/*
+ * IMX7 System Reset Controller
+ *
+ * Copyright (c) 2023 Jean-Christophe Dubois <jcd@tribudubois.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "hw/misc/imx7_src.h"
+#include "migration/vmstate.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "qemu/main-loop.h"
+#include "qemu/module.h"
+#include "target/arm/arm-powerctl.h"
+#include "hw/core/cpu.h"
+#include "hw/registerfields.h"
+
+#include "trace.h"
+
+static const char *imx7_src_reg_name(uint32_t reg)
+{
+    static char unknown[20];
+
+    switch (reg) {
+    case SRC_SCR:
+        return "SRC_SCR";
+    case SRC_A7RCR0:
+        return "SRC_A7RCR0";
+    case SRC_A7RCR1:
+        return "SRC_A7RCR1";
+    case SRC_M4RCR:
+        return "SRC_M4RCR";
+    case SRC_ERCR:
+        return "SRC_ERCR";
+    case SRC_HSICPHY_RCR:
+        return "SRC_HSICPHY_RCR";
+    case SRC_USBOPHY1_RCR:
+        return "SRC_USBOPHY1_RCR";
+    case SRC_USBOPHY2_RCR:
+        return "SRC_USBOPHY2_RCR";
+    case SRC_PCIEPHY_RCR:
+        return "SRC_PCIEPHY_RCR";
+    case SRC_SBMR1:
+        return "SRC_SBMR1";
+    case SRC_SRSR:
+        return "SRC_SRSR";
+    case SRC_SISR:
+        return "SRC_SISR";
+    case SRC_SIMR:
+        return "SRC_SIMR";
+    case SRC_SBMR2:
+        return "SRC_SBMR2";
+    case SRC_GPR1:
+        return "SRC_GPR1";
+    case SRC_GPR2:
+        return "SRC_GPR2";
+    case SRC_GPR3:
+        return "SRC_GPR3";
+    case SRC_GPR4:
+        return "SRC_GPR4";
+    case SRC_GPR5:
+        return "SRC_GPR5";
+    case SRC_GPR6:
+        return "SRC_GPR6";
+    case SRC_GPR7:
+        return "SRC_GPR7";
+    case SRC_GPR8:
+        return "SRC_GPR8";
+    case SRC_GPR9:
+        return "SRC_GPR9";
+    case SRC_GPR10:
+        return "SRC_GPR10";
+    default:
+        sprintf(unknown, "%u ?", reg);
+        return unknown;
+    }
+}
+
+static const VMStateDescription vmstate_imx7_src = {
+    .name = TYPE_IMX7_SRC,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, IMX7SRCState, SRC_MAX),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void imx7_src_reset(DeviceState *dev)
+{
+    IMX7SRCState *s = IMX7_SRC(dev);
+
+    memset(s->regs, 0, sizeof(s->regs));
+
+    /* Set reset values */
+    s->regs[SRC_SCR] = 0xA0;
+    s->regs[SRC_SRSR] = 0x1;
+    s->regs[SRC_SIMR] = 0x1F;
+}
+
+static uint64_t imx7_src_read(void *opaque, hwaddr offset, unsigned size)
+{
+    uint32_t value = 0;
+    IMX7SRCState *s = (IMX7SRCState *)opaque;
+    uint32_t index = offset >> 2;
+
+    if (index < SRC_MAX) {
+        value = s->regs[index];
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%"
+                      HWADDR_PRIx "\n", TYPE_IMX7_SRC, __func__, offset);
+    }
+
+    trace_imx7_src_read(imx7_src_reg_name(index), value);
+
+    return value;
+}
+
+
+/*
+ * The reset is asynchronous so we need to defer clearing the reset
+ * bit until the work is completed.
+ */
+
+struct SRCSCRResetInfo {
+    IMX7SRCState *s;
+    uint32_t reset_bit;
+};
+
+static void imx7_clear_reset_bit(CPUState *cpu, run_on_cpu_data data)
+{
+    struct SRCSCRResetInfo *ri = data.host_ptr;
+    IMX7SRCState *s = ri->s;
+
+    assert(qemu_mutex_iothread_locked());
+
+    s->regs[SRC_A7RCR0] = deposit32(s->regs[SRC_A7RCR0], ri->reset_bit, 1, 0);
+
+    trace_imx7_src_write(imx7_src_reg_name(SRC_A7RCR0), s->regs[SRC_A7RCR0]);
+
+    g_free(ri);
+}
+
+static void imx7_defer_clear_reset_bit(uint32_t cpuid,
+                                       IMX7SRCState *s,
+                                       uint32_t reset_shift)
+{
+    struct SRCSCRResetInfo *ri;
+    CPUState *cpu = arm_get_cpu_by_id(cpuid);
+
+    if (!cpu) {
+        return;
+    }
+
+    ri = g_new(struct SRCSCRResetInfo, 1);
+    ri->s = s;
+    ri->reset_bit = reset_shift;
+
+    async_run_on_cpu(cpu, imx7_clear_reset_bit, RUN_ON_CPU_HOST_PTR(ri));
+}
+
+
+static void imx7_src_write(void *opaque, hwaddr offset, uint64_t value,
+                           unsigned size)
+{
+    IMX7SRCState *s = (IMX7SRCState *)opaque;
+    uint32_t index = offset >> 2;
+    long unsigned int change_mask;
+    uint32_t current_value = value;
+
+    if (index >= SRC_MAX) {
+        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%"
+                      HWADDR_PRIx "\n", TYPE_IMX7_SRC, __func__, offset);
+        return;
+    }
+
+    trace_imx7_src_write(imx7_src_reg_name(SRC_A7RCR0), s->regs[SRC_A7RCR0]);
+
+    change_mask = s->regs[index] ^ (uint32_t)current_value;
+
+    switch (index) {
+    case SRC_A7RCR0:
+        if (FIELD_EX32(change_mask, CORE0, RST)) {
+            arm_reset_cpu(0);
+            imx7_defer_clear_reset_bit(0, s, R_CORE0_RST_SHIFT);
+        }
+        if (FIELD_EX32(change_mask, CORE1, RST)) {
+            arm_reset_cpu(1);
+            imx7_defer_clear_reset_bit(1, s, R_CORE1_RST_SHIFT);
+        }
+        s->regs[index] = current_value;
+        break;
+    case SRC_A7RCR1:
+        /*
+         * On real hardware when the system reset controller starts a
+         * secondary CPU it runs through some boot ROM code which reads
+         * the SRC_GPRX registers controlling the start address and branches
+         * to it.
+         * Here we are taking a short cut and branching directly to the
+         * requested address (we don't want to run the boot ROM code inside
+         * QEMU)
+         */
+        if (FIELD_EX32(change_mask, CORE1, ENABLE)) {
+            if (FIELD_EX32(current_value, CORE1, ENABLE)) {
+                /* CORE 1 is brought up */
+                arm_set_cpu_on(1, s->regs[SRC_GPR3], s->regs[SRC_GPR4],
+                               3, false);
+            } else {
+                /* CORE 1 is shut down */
+                arm_set_cpu_off(1);
+            }
+            /* We clear the reset bits as the processor changed state */
+            imx7_defer_clear_reset_bit(1, s, R_CORE1_RST_SHIFT);
+            clear_bit(R_CORE1_RST_SHIFT, &change_mask);
+        }
+        s->regs[index] = current_value;
+        break;
+    default:
+        s->regs[index] = current_value;
+        break;
+    }
+}
+
+static const struct MemoryRegionOps imx7_src_ops = {
+    .read = imx7_src_read,
+    .write = imx7_src_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        /*
+         * Our device would not work correctly if the guest was doing
+         * unaligned access. This might not be a limitation on the real
+         * device but in practice there is no reason for a guest to access
+         * this device unaligned.
+         */
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void imx7_src_realize(DeviceState *dev, Error **errp)
+{
+    IMX7SRCState *s = IMX7_SRC(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(dev), &imx7_src_ops, s,
+                          TYPE_IMX7_SRC, 0x1000);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+}
+
+static void imx7_src_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = imx7_src_realize;
+    dc->reset = imx7_src_reset;
+    dc->vmsd = &vmstate_imx7_src;
+    dc->desc = "i.MX6 System Reset Controller";
+}
+
+static const TypeInfo imx7_src_info = {
+    .name          = TYPE_IMX7_SRC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IMX7SRCState),
+    .class_init    = imx7_src_class_init,
+};
+
+static void imx7_src_register_types(void)
+{
+    type_register_static(&imx7_src_info);
+}
+
+type_init(imx7_src_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 892f8b91c5..d9a370c1de 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -60,6 +60,7 @@ system_ss.add(when: 'CONFIG_IMX', if_true: files(
   'imx6_src.c',
   'imx6ul_ccm.c',
   'imx7_ccm.c',
+  'imx7_src.c',
   'imx7_gpr.c',
   'imx7_snvs.c',
   'imx_ccm.c',
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index 4d1a0e17af..e8b2be14c0 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -199,6 +199,10 @@ ccm_clock_freq(uint32_t clock, uint32_t freq) "(Clock = %d) = %d"
 ccm_read_reg(const char *reg_name, uint32_t value) "reg[%s] <= 0x%" PRIx32
 ccm_write_reg(const char *reg_name, uint32_t value) "reg[%s] => 0x%" PRIx32
 
+# imx7_src.c
+imx7_src_read(const char *reg_name, uint32_t value) "reg[%s] => 0x%" PRIx32
+imx7_src_write(const char *reg_name, uint32_t value) "reg[%s] <= 0x%" PRIx32
+
 # iotkit-sysinfo.c
 iotkit_sysinfo_read(uint64_t offset, uint64_t data, unsigned size) "IoTKit SysInfo read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 iotkit_sysinfo_write(uint64_t offset, uint64_t data, unsigned size) "IoTKit SysInfo write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index 01e15004d7..2cbfc6b2b2 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -25,6 +25,7 @@
 #include "hw/misc/imx7_ccm.h"
 #include "hw/misc/imx7_snvs.h"
 #include "hw/misc/imx7_gpr.h"
+#include "hw/misc/imx7_src.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/gpio/imx_gpio.h"
 #include "hw/char/imx_serial.h"
@@ -74,6 +75,7 @@ struct FslIMX7State {
     IMX7CCMState       ccm;
     IMX7AnalogState    analog;
     IMX7SNVSState      snvs;
+    IMX7SRCState       src;
     IMXGPCv2State      gpcv2;
     IMXSPIState        spi[FSL_IMX7_NUM_ECSPIS];
     IMXI2CState        i2c[FSL_IMX7_NUM_I2CS];
@@ -292,7 +294,6 @@ enum FslIMX7MemoryMap {
     FSL_IMX7_GPC_ADDR             = 0x303A0000,
 
     FSL_IMX7_SRC_ADDR             = 0x30390000,
-    FSL_IMX7_SRC_SIZE             = (4 * KiB),
 
     FSL_IMX7_CCM_ADDR             = 0x30380000,
 
diff --git a/include/hw/misc/imx7_src.h b/include/hw/misc/imx7_src.h
new file mode 100644
index 0000000000..b4b97dcb1c
--- /dev/null
+++ b/include/hw/misc/imx7_src.h
@@ -0,0 +1,66 @@
+/*
+ * IMX7 System Reset Controller
+ *
+ * Copyright (C) 2023 Jean-Christophe Dubois <jcd@tribudubois.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef IMX7_SRC_H
+#define IMX7_SRC_H
+
+#include "hw/sysbus.h"
+#include "qemu/bitops.h"
+#include "qom/object.h"
+
+#define SRC_SCR 0
+#define SRC_A7RCR0 1
+#define SRC_A7RCR1 2
+#define SRC_M4RCR 3
+#define SRC_ERCR 5
+#define SRC_HSICPHY_RCR 7
+#define SRC_USBOPHY1_RCR 8
+#define SRC_USBOPHY2_RCR 9
+#define SRC_MPIPHY_RCR 10
+#define SRC_PCIEPHY_RCR 11
+#define SRC_SBMR1 22
+#define SRC_SRSR 23
+#define SRC_SISR 26
+#define SRC_SIMR 27
+#define SRC_SBMR2 28
+#define SRC_GPR1 29
+#define SRC_GPR2 30
+#define SRC_GPR3 31
+#define SRC_GPR4 32
+#define SRC_GPR5 33
+#define SRC_GPR6 34
+#define SRC_GPR7 35
+#define SRC_GPR8 36
+#define SRC_GPR9 37
+#define SRC_GPR10 38
+#define SRC_MAX 39
+
+/* SRC_A7SCR1 */
+#define R_CORE1_ENABLE_SHIFT     1
+#define R_CORE1_ENABLE_LENGTH    1
+/* SRC_A7SCR0 */
+#define R_CORE1_RST_SHIFT        5
+#define R_CORE1_RST_LENGTH       1
+#define R_CORE0_RST_SHIFT        4
+#define R_CORE0_RST_LENGTH       1
+
+#define TYPE_IMX7_SRC "imx7.src"
+OBJECT_DECLARE_SIMPLE_TYPE(IMX7SRCState, IMX7_SRC)
+
+struct IMX7SRCState {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion iomem;
+
+    uint32_t regs[SRC_MAX];
+};
+
+#endif /* IMX7_SRC_H */

From 35aa6715ddcd9748bae5bc01563331e8eae8d7cf Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 31 Aug 2023 09:45:17 +0100
Subject: [PATCH 1346/1353] target/arm: Catch illegal-exception-return from EL3
 with bad NSE/NS

The architecture requires (R_TYTWB) that an attempt to return from EL3
when SCR_EL3.{NSE,NS} are {1,0} is an illegal exception return. (This
enforces that the CPU can't ever be executing below EL3 with the
NSE,NS bits indicating an invalid security state.)

We were missing this check; add it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230807150618.101357-1-peter.maydell@linaro.org
---
 target/arm/tcg/helper-a64.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 1c9370f07b..0cf56f6dc4 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -780,6 +780,15 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         spsr &= ~PSTATE_SS;
     }
 
+    /*
+     * FEAT_RME forbids return from EL3 with an invalid security state.
+     * We don't need an explicit check for FEAT_RME here because we enforce
+     * in scr_write() that you can't set the NSE bit without it.
+     */
+    if (cur_el == 3 && (env->cp15.scr_el3 & (SCR_NS | SCR_NSE)) == SCR_NSE) {
+        goto illegal_return;
+    }
+
     new_el = el_from_spsr(spsr);
     if (new_el == -1) {
         goto illegal_return;

From 7038b6e4e71d9fb3a234e00da31c222d3e97dd5c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 31 Aug 2023 09:45:17 +0100
Subject: [PATCH 1347/1353] hw/rtc/m48t59: Use 64-bit arithmetic in set_alarm()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the m48t59 device we almost always use 64-bit arithmetic when
dealing with time_t deltas.  The one exception is in set_alarm(),
which currently uses a plain 'int' to hold the difference between two
time_t values.  Switch to int64_t instead to avoid any possible
overflow issues.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/rtc/m48t59.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/rtc/m48t59.c b/hw/rtc/m48t59.c
index ec3e56e84f..2e2c849985 100644
--- a/hw/rtc/m48t59.c
+++ b/hw/rtc/m48t59.c
@@ -133,7 +133,7 @@ static void alarm_cb (void *opaque)
 
 static void set_alarm(M48t59State *NVRAM)
 {
-    int diff;
+    int64_t diff;
     if (NVRAM->alrm_timer != NULL) {
         timer_del(NVRAM->alrm_timer);
         diff = qemu_timedate_diff(&NVRAM->alarm) - NVRAM->time_offset;

From 279695a4a4472c41d8764317e4fae04d93ee2b42 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 31 Aug 2023 09:45:18 +0100
Subject: [PATCH 1348/1353] hw/rtc/twl92230: Use int64_t for sec_offset and
 alm_sec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the twl92230 device, use int64_t for the two state fields
sec_offset and alm_sec, because we set these to values that
are either time_t or differences between two time_t values.

These fields aren't saved in vmstate anywhere, so we can
safely widen them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/rtc/twl92230.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/rtc/twl92230.c b/hw/rtc/twl92230.c
index d8534dad94..64c61c3dae 100644
--- a/hw/rtc/twl92230.c
+++ b/hw/rtc/twl92230.c
@@ -65,8 +65,8 @@ struct MenelausState {
         struct tm tm;
         struct tm new;
         struct tm alm;
-        int sec_offset;
-        int alm_sec;
+        int64_t sec_offset;
+        int64_t alm_sec;
         int next_comp;
     } rtc;
     uint16_t rtc_next_vmstate;

From c0a63857282afebaeed606a3dca803bb3bfb6aa3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 31 Aug 2023 09:45:18 +0100
Subject: [PATCH 1349/1353] hw/rtc/aspeed_rtc: Use 64-bit offset for holding
 time_t difference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the aspeed_rtc device we store a difference between two time_t
values in an 'int'. This is not really correct when time_t could
be 64 bits. Enlarge the field to 'int64_t'.

This is a migration compatibility break for the aspeed boards.
While we are changing the vmstate, remove the accidental
duplicate of the offset field.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
---
 hw/rtc/aspeed_rtc.c         | 5 ++---
 include/hw/rtc/aspeed_rtc.h | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/hw/rtc/aspeed_rtc.c b/hw/rtc/aspeed_rtc.c
index f6da7b666d..fa861e2d49 100644
--- a/hw/rtc/aspeed_rtc.c
+++ b/hw/rtc/aspeed_rtc.c
@@ -136,11 +136,10 @@ static const MemoryRegionOps aspeed_rtc_ops = {
 
 static const VMStateDescription vmstate_aspeed_rtc = {
     .name = TYPE_ASPEED_RTC,
-    .version_id = 1,
+    .version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(reg, AspeedRtcState, 0x18),
-        VMSTATE_INT32(offset, AspeedRtcState),
-        VMSTATE_INT32(offset, AspeedRtcState),
+        VMSTATE_INT64(offset, AspeedRtcState),
         VMSTATE_END_OF_LIST()
     }
 };
diff --git a/include/hw/rtc/aspeed_rtc.h b/include/hw/rtc/aspeed_rtc.h
index df61e46059..596dfebb46 100644
--- a/include/hw/rtc/aspeed_rtc.h
+++ b/include/hw/rtc/aspeed_rtc.h
@@ -18,7 +18,7 @@ struct AspeedRtcState {
     qemu_irq irq;
 
     uint32_t reg[0x18];
-    int offset;
+    int64_t offset;
 
 };
 

From 5ec008a2bd7e928d41d2a158120223311742d860 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 31 Aug 2023 09:45:18 +0100
Subject: [PATCH 1350/1353] rtc: Use time_t for passing and returning time
 offsets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The functions qemu_get_timedate() and qemu_timedate_diff() take
and return a time offset as an integer. Coverity points out that
means that when an RTC device implementation holds an offset
as a time_t, as the m48t59 does, the time_t will get truncated.
(CID 1507157, 1517772).

The functions work with time_t internally, so make them use that type
in their APIs.

Note that this won't help any Y2038 issues where either the device
model itself is keeping the offset in a 32-bit integer, or where the
hardware under emulation has Y2038 or other rollover problems.  If we
missed any cases of the former then hopefully Coverity will warn us
about them since after this patch we'd be truncating a time_t in
assignments from qemu_timedate_diff().)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/sysemu/rtc.h | 4 ++--
 softmmu/rtc.c        | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/sysemu/rtc.h b/include/sysemu/rtc.h
index 159702b45b..0fc8ad6fdf 100644
--- a/include/sysemu/rtc.h
+++ b/include/sysemu/rtc.h
@@ -42,7 +42,7 @@
  * The behaviour of the clock whose value this function returns will
  * depend on the -rtc command line option passed by the user.
  */
-void qemu_get_timedate(struct tm *tm, int offset);
+void qemu_get_timedate(struct tm *tm, time_t offset);
 
 /**
  * qemu_timedate_diff: Return difference between a struct tm and the RTC
@@ -53,6 +53,6 @@ void qemu_get_timedate(struct tm *tm, int offset);
  * a timestamp one hour further ahead than the current RTC time
  * then this function will return 3600.
  */
-int qemu_timedate_diff(struct tm *tm);
+time_t qemu_timedate_diff(struct tm *tm);
 
 #endif
diff --git a/softmmu/rtc.c b/softmmu/rtc.c
index 4b2bf75dd6..4904581abe 100644
--- a/softmmu/rtc.c
+++ b/softmmu/rtc.c
@@ -68,7 +68,7 @@ static time_t qemu_ref_timedate(QEMUClockType clock)
     return value;
 }
 
-void qemu_get_timedate(struct tm *tm, int offset)
+void qemu_get_timedate(struct tm *tm, time_t offset)
 {
     time_t ti = qemu_ref_timedate(rtc_clock);
 
@@ -85,7 +85,7 @@ void qemu_get_timedate(struct tm *tm, int offset)
     }
 }
 
-int qemu_timedate_diff(struct tm *tm)
+time_t qemu_timedate_diff(struct tm *tm)
 {
     time_t seconds;
 

From b8f7959f28c4f36496bc0a694fa28bf5078152c5 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 24 Jul 2023 18:43:33 +0100
Subject: [PATCH 1351/1353] target/arm: Do all "ARM_FEATURE_X implies Y" checks
 in post_init

Where architecturally one ARM_FEATURE_X flag implies another
ARM_FEATURE_Y, we allow the CPU init function to only set X, and then
set Y for it.  Currently we do this in two places -- we set a few
flags in arm_cpu_post_init() because we need them to decide which
properties to create on the CPU object, and then we do the rest in
arm_cpu_realizefn().  However, this is fragile, because it's easy to
add a new property and not notice that this means that an X-implies-Y
check now has to move from realize to post-init.

As a specific example, the pmsav7-dregion property is conditional
on ARM_FEATURE_PMSA && ARM_FEATURE_V7, which means it won't appear
on the Cortex-M33 and -M55, because they set ARM_FEATURE_V8 and
rely on V8-implies-V7, which doesn't happen until the realizefn.

Move all of these X-implies-Y checks into a new function, which
we call at the top of arm_cpu_post_init(), so the feature bits
are available at that point.

This does now give us the reverse issue, that if there's a feature
bit which is enabled or disabled by the setting of a property then
then X-implies-Y features that are dependent on that property need to
be in realize, not in this new function.  But the only one of those
is the "EL3 implies VBAR" which is already in the right place, so
putting things this way round seems better to me.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230724174335.2150499-2-peter.maydell@linaro.org
---
 target/arm/cpu.c | 179 +++++++++++++++++++++++++----------------------
 1 file changed, 97 insertions(+), 82 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 17540300fe..0bb0585441 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1356,17 +1356,108 @@ unsigned int gt_cntfrq_period_ns(ARMCPU *cpu)
       NANOSECONDS_PER_SECOND / cpu->gt_cntfrq_hz : 1;
 }
 
+static void arm_cpu_propagate_feature_implications(ARMCPU *cpu)
+{
+    CPUARMState *env = &cpu->env;
+    bool no_aa32 = false;
+
+    /*
+     * Some features automatically imply others: set the feature
+     * bits explicitly for these cases.
+     */
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        set_feature(env, ARM_FEATURE_PMSA);
+    }
+
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        if (arm_feature(env, ARM_FEATURE_M)) {
+            set_feature(env, ARM_FEATURE_V7);
+        } else {
+            set_feature(env, ARM_FEATURE_V7VE);
+        }
+    }
+
+    /*
+     * There exist AArch64 cpus without AArch32 support.  When KVM
+     * queries ID_ISAR0_EL1 on such a host, the value is UNKNOWN.
+     * Similarly, we cannot check ID_AA64PFR0 without AArch64 support.
+     * As a general principle, we also do not make ID register
+     * consistency checks anywhere unless using TCG, because only
+     * for TCG would a consistency-check failure be a QEMU bug.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        no_aa32 = !cpu_isar_feature(aa64_aa32, cpu);
+    }
+
+    if (arm_feature(env, ARM_FEATURE_V7VE)) {
+        /*
+         * v7 Virtualization Extensions. In real hardware this implies
+         * EL2 and also the presence of the Security Extensions.
+         * For QEMU, for backwards-compatibility we implement some
+         * CPUs or CPU configs which have no actual EL2 or EL3 but do
+         * include the various other features that V7VE implies.
+         * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
+         * Security Extensions is ARM_FEATURE_EL3.
+         */
+        assert(!tcg_enabled() || no_aa32 ||
+               cpu_isar_feature(aa32_arm_div, cpu));
+        set_feature(env, ARM_FEATURE_LPAE);
+        set_feature(env, ARM_FEATURE_V7);
+    }
+    if (arm_feature(env, ARM_FEATURE_V7)) {
+        set_feature(env, ARM_FEATURE_VAPA);
+        set_feature(env, ARM_FEATURE_THUMB2);
+        set_feature(env, ARM_FEATURE_MPIDR);
+        if (!arm_feature(env, ARM_FEATURE_M)) {
+            set_feature(env, ARM_FEATURE_V6K);
+        } else {
+            set_feature(env, ARM_FEATURE_V6);
+        }
+
+        /*
+         * Always define VBAR for V7 CPUs even if it doesn't exist in
+         * non-EL3 configs. This is needed by some legacy boards.
+         */
+        set_feature(env, ARM_FEATURE_VBAR);
+    }
+    if (arm_feature(env, ARM_FEATURE_V6K)) {
+        set_feature(env, ARM_FEATURE_V6);
+        set_feature(env, ARM_FEATURE_MVFR);
+    }
+    if (arm_feature(env, ARM_FEATURE_V6)) {
+        set_feature(env, ARM_FEATURE_V5);
+        if (!arm_feature(env, ARM_FEATURE_M)) {
+            assert(!tcg_enabled() || no_aa32 ||
+                   cpu_isar_feature(aa32_jazelle, cpu));
+            set_feature(env, ARM_FEATURE_AUXCR);
+        }
+    }
+    if (arm_feature(env, ARM_FEATURE_V5)) {
+        set_feature(env, ARM_FEATURE_V4T);
+    }
+    if (arm_feature(env, ARM_FEATURE_LPAE)) {
+        set_feature(env, ARM_FEATURE_V7MP);
+    }
+    if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
+        set_feature(env, ARM_FEATURE_CBAR);
+    }
+    if (arm_feature(env, ARM_FEATURE_THUMB2) &&
+        !arm_feature(env, ARM_FEATURE_M)) {
+        set_feature(env, ARM_FEATURE_THUMB_DSP);
+    }
+}
+
 void arm_cpu_post_init(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
-    /* M profile implies PMSA. We have to do this here rather than
-     * in realize with the other feature-implication checks because
-     * we look at the PMSA bit to see if we should add some properties.
+    /*
+     * Some features imply others. Figure this out now, because we
+     * are going to look at the feature bits in deciding which
+     * properties to add.
      */
-    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
-        set_feature(&cpu->env, ARM_FEATURE_PMSA);
-    }
+    arm_cpu_propagate_feature_implications(cpu);
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -1588,7 +1679,6 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     CPUARMState *env = &cpu->env;
     int pagebits;
     Error *local_err = NULL;
-    bool no_aa32 = false;
 
     /* Use pc-relative instructions in system-mode */
 #ifndef CONFIG_USER_ONLY
@@ -1869,81 +1959,6 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.id_isar3 = u;
     }
 
-    /* Some features automatically imply others: */
-    if (arm_feature(env, ARM_FEATURE_V8)) {
-        if (arm_feature(env, ARM_FEATURE_M)) {
-            set_feature(env, ARM_FEATURE_V7);
-        } else {
-            set_feature(env, ARM_FEATURE_V7VE);
-        }
-    }
-
-    /*
-     * There exist AArch64 cpus without AArch32 support.  When KVM
-     * queries ID_ISAR0_EL1 on such a host, the value is UNKNOWN.
-     * Similarly, we cannot check ID_AA64PFR0 without AArch64 support.
-     * As a general principle, we also do not make ID register
-     * consistency checks anywhere unless using TCG, because only
-     * for TCG would a consistency-check failure be a QEMU bug.
-     */
-    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-        no_aa32 = !cpu_isar_feature(aa64_aa32, cpu);
-    }
-
-    if (arm_feature(env, ARM_FEATURE_V7VE)) {
-        /* v7 Virtualization Extensions. In real hardware this implies
-         * EL2 and also the presence of the Security Extensions.
-         * For QEMU, for backwards-compatibility we implement some
-         * CPUs or CPU configs which have no actual EL2 or EL3 but do
-         * include the various other features that V7VE implies.
-         * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
-         * Security Extensions is ARM_FEATURE_EL3.
-         */
-        assert(!tcg_enabled() || no_aa32 ||
-               cpu_isar_feature(aa32_arm_div, cpu));
-        set_feature(env, ARM_FEATURE_LPAE);
-        set_feature(env, ARM_FEATURE_V7);
-    }
-    if (arm_feature(env, ARM_FEATURE_V7)) {
-        set_feature(env, ARM_FEATURE_VAPA);
-        set_feature(env, ARM_FEATURE_THUMB2);
-        set_feature(env, ARM_FEATURE_MPIDR);
-        if (!arm_feature(env, ARM_FEATURE_M)) {
-            set_feature(env, ARM_FEATURE_V6K);
-        } else {
-            set_feature(env, ARM_FEATURE_V6);
-        }
-
-        /* Always define VBAR for V7 CPUs even if it doesn't exist in
-         * non-EL3 configs. This is needed by some legacy boards.
-         */
-        set_feature(env, ARM_FEATURE_VBAR);
-    }
-    if (arm_feature(env, ARM_FEATURE_V6K)) {
-        set_feature(env, ARM_FEATURE_V6);
-        set_feature(env, ARM_FEATURE_MVFR);
-    }
-    if (arm_feature(env, ARM_FEATURE_V6)) {
-        set_feature(env, ARM_FEATURE_V5);
-        if (!arm_feature(env, ARM_FEATURE_M)) {
-            assert(!tcg_enabled() || no_aa32 ||
-                   cpu_isar_feature(aa32_jazelle, cpu));
-            set_feature(env, ARM_FEATURE_AUXCR);
-        }
-    }
-    if (arm_feature(env, ARM_FEATURE_V5)) {
-        set_feature(env, ARM_FEATURE_V4T);
-    }
-    if (arm_feature(env, ARM_FEATURE_LPAE)) {
-        set_feature(env, ARM_FEATURE_V7MP);
-    }
-    if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
-        set_feature(env, ARM_FEATURE_CBAR);
-    }
-    if (arm_feature(env, ARM_FEATURE_THUMB2) &&
-        !arm_feature(env, ARM_FEATURE_M)) {
-        set_feature(env, ARM_FEATURE_THUMB_DSP);
-    }
 
     /*
      * We rely on no XScale CPU having VFP so we can use the same bits in the

From cb0929bb1344d095c9e7980e3803562b8b3cd604 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 24 Jul 2023 18:43:34 +0100
Subject: [PATCH 1352/1353] hw/arm/armv7m: Add mpu-ns-regions and mpu-s-regions
 properties
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

M-profile CPUs generally allow configuration of the number of MPU
regions that they have.  We don't currently model this, so our
implementations of some of the board models provide CPUs with the
wrong number of regions.  RTOSes like Zephyr that hardcode the
expected number of regions may therefore not run on the model if they
are set up to run on real hardware.

Add properties mpu-ns-regions and mpu-s-regions to the ARMV7M object,
matching the ability of hardware to configure the number of Secure
and NonSecure regions separately.  Our actual CPU implementation
doesn't currently support that, and it happens that none of the MPS
boards we model set the number of regions differently for Secure vs
NonSecure, so we provide an interface to the boards and SoCs that
won't need to change if we ever do add that functionality in future,
but make it an error to configure the two properties to different
values.

(The property name on the CPU is the somewhat misnamed-for-M-profile
"pmsav7-dregion", so we don't follow that naming convention for
the properties here. The TRM doesn't say what the CPU configuration
variable names are, so we pick something, and follow the lowercase
convention we already have for properties here.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230724174335.2150499-3-peter.maydell@linaro.org
---
 hw/arm/armv7m.c         | 21 +++++++++++++++++++++
 include/hw/arm/armv7m.h |  8 ++++++++
 2 files changed, 29 insertions(+)

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 50a9507c0b..bf173b10b8 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -334,6 +334,25 @@ static void armv7m_realize(DeviceState *dev, Error **errp)
         }
     }
 
+    /*
+     * Real M-profile hardware can be configured with a different number of
+     * MPU regions for Secure vs NonSecure. QEMU's CPU implementation doesn't
+     * support that yet, so catch attempts to select that.
+     */
+    if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) &&
+        s->mpu_ns_regions != s->mpu_s_regions) {
+        error_setg(errp,
+                   "mpu-ns-regions and mpu-s-regions properties must have the same value");
+        return;
+    }
+    if (s->mpu_ns_regions != UINT_MAX &&
+        object_property_find(OBJECT(s->cpu), "pmsav7-dregion")) {
+        if (!object_property_set_uint(OBJECT(s->cpu), "pmsav7-dregion",
+                                      s->mpu_ns_regions, errp)) {
+            return;
+        }
+    }
+
     /*
      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
      * have one. Similarly, tell the NVIC where its CPU is.
@@ -530,6 +549,8 @@ static Property armv7m_properties[] = {
                      false),
     DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
     DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
+    DEFINE_PROP_UINT32("mpu-ns-regions", ARMv7MState, mpu_ns_regions, UINT_MAX),
+    DEFINE_PROP_UINT32("mpu-s-regions", ARMv7MState, mpu_s_regions, UINT_MAX),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index b7ba0ff409..e2cebbd15c 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -52,6 +52,12 @@ OBJECT_DECLARE_SIMPLE_TYPE(ARMv7MState, ARMV7M)
  * + Property "vfp": enable VFP (forwarded to CPU object)
  * + Property "dsp": enable DSP (forwarded to CPU object)
  * + Property "enable-bitband": expose bitbanded IO
+ * + Property "mpu-ns-regions": number of Non-Secure MPU regions (forwarded
+ *   to CPU object pmsav7-dregion property; default is whatever the default
+ *   for the CPU is)
+ * + Property "mpu-s-regions": number of Secure MPU regions (default is
+ *   whatever the default for the CPU is; must currently be set to the same
+ *   value as mpu-ns-regions if the CPU implements the Security Extension)
  * + Clock input "refclk" is the external reference clock for the systick timers
  * + Clock input "cpuclk" is the main CPU clock
  */
@@ -95,6 +101,8 @@ struct ARMv7MState {
     Object *idau;
     uint32_t init_svtor;
     uint32_t init_nsvtor;
+    uint32_t mpu_ns_regions;
+    uint32_t mpu_s_regions;
     bool enable_bitband;
     bool start_powered_off;
     bool vfp;

From e73b8bb8a3e9a162f70e9ffbf922d4fafc96bbfb Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 24 Jul 2023 18:43:35 +0100
Subject: [PATCH 1353/1353] hw/arm: Set number of MPU regions correctly for
 an505, an521, an524
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The IoTKit, SSE200 and SSE300 all default to 8 MPU regions.  The
MPS2/MPS3 FPGA images don't override these except in the case of
AN547, which uses 16 MPU regions.

Define properties on the ARMSSE object for the MPU regions (using the
same names as the documented RTL configuration settings, and
following the pattern we already have for this device of using
all-caps names as the RTL does), and set them in the board code.

We don't actually need to override the default except on AN547,
but it's simpler code to have the board code set them always
rather than tracking which board subtypes want to set them to
a non-default value separately from what that value is.

Tho overall effect is that for mps2-an505, mps2-an521 and mps3-an524
we now correctly use 8 MPU regions, while mps3-an547 stays at its
current 16 regions.

It's possible some guest code wrongly depended on the previous
incorrectly modeled number of memory regions. (Such guest code
should ideally check the number of regions via the MPU_TYPE
register.) The old behaviour can be obtained with additional
-global arguments to QEMU:

For mps2-an521 and mps2-an524:
 -global sse-200.CPU0_MPU_NS=16 -global sse-200.CPU0_MPU_S=16 -global sse-200.CPU1_MPU_NS=16 -global sse-200.CPU1_MPU_S=16

For mps2-an505:
 -global sse-200.CPU0_MPU_NS=16 -global sse-200.CPU0_MPU_S=16

NB that the way the implementation allows this use of -global
is slightly fragile: if the board code explicitly sets the
properties on the sse-200 object, this overrides the -global
command line option. So we rely on:
 - the boards that need fixing all happen to use the SSE defaults
 - we can write the board code to only set the property if it
   is different from the default, rather than having all boards
   explicitly set the property
 - the board that does need to use a non-default value happens
   to need to set it to the same value (16) we previously used
This works, but there are some kinds of refactoring of the
mps2-tz.c code that would break the support for -global here.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1772
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230724174335.2150499-4-peter.maydell@linaro.org
---
 hw/arm/armsse.c         | 16 ++++++++++++++++
 hw/arm/mps2-tz.c        | 29 +++++++++++++++++++++++++++++
 include/hw/arm/armsse.h |  5 +++++
 3 files changed, 50 insertions(+)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index 0202bad787..11cd08b6c1 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -85,6 +85,8 @@ static Property iotkit_properties[] = {
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+    DEFINE_PROP_UINT32("CPU0_MPU_NS", ARMSSE, cpu_mpu_ns[0], 8),
+    DEFINE_PROP_UINT32("CPU0_MPU_S", ARMSSE, cpu_mpu_s[0], 8),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -98,6 +100,10 @@ static Property sse200_properties[] = {
     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
     DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
     DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
+    DEFINE_PROP_UINT32("CPU0_MPU_NS", ARMSSE, cpu_mpu_ns[0], 8),
+    DEFINE_PROP_UINT32("CPU0_MPU_S", ARMSSE, cpu_mpu_s[0], 8),
+    DEFINE_PROP_UINT32("CPU1_MPU_NS", ARMSSE, cpu_mpu_ns[1], 8),
+    DEFINE_PROP_UINT32("CPU1_MPU_S", ARMSSE, cpu_mpu_s[1], 8),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -109,6 +115,8 @@ static Property sse300_properties[] = {
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
     DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+    DEFINE_PROP_UINT32("CPU0_MPU_NS", ARMSSE, cpu_mpu_ns[0], 8),
+    DEFINE_PROP_UINT32("CPU0_MPU_S", ARMSSE, cpu_mpu_s[0], 8),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -1029,6 +1037,14 @@ static void armsse_realize(DeviceState *dev, Error **errp)
                 return;
             }
         }
+        if (!object_property_set_uint(cpuobj, "mpu-ns-regions",
+                                      s->cpu_mpu_ns[i], errp)) {
+            return;
+        }
+        if (!object_property_set_uint(cpuobj, "mpu-s-regions",
+                                      s->cpu_mpu_s[i], errp)) {
+            return;
+        }
 
         if (i > 0) {
             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 5873107302..eae3639da2 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -124,6 +124,10 @@ struct MPS2TZMachineClass {
     int uart_overflow_irq; /* number of the combined UART overflow IRQ */
     uint32_t init_svtor; /* init-svtor setting for SSE */
     uint32_t sram_addr_width; /* SRAM_ADDR_WIDTH setting for SSE */
+    uint32_t cpu0_mpu_ns; /* CPU0_MPU_NS setting for SSE */
+    uint32_t cpu0_mpu_s; /* CPU0_MPU_S setting for SSE */
+    uint32_t cpu1_mpu_ns; /* CPU1_MPU_NS setting for SSE */
+    uint32_t cpu1_mpu_s; /* CPU1_MPU_S setting for SSE */
     const RAMInfo *raminfo;
     const char *armsse_type;
     uint32_t boot_ram_size; /* size of ram at address 0; 0 == find in raminfo */
@@ -183,6 +187,9 @@ OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
 #define MPS3_DDR_SIZE (2 * GiB)
 #endif
 
+/* For cpu{0,1}_mpu_{ns,s}, means "leave at SSE's default value" */
+#define MPU_REGION_DEFAULT UINT32_MAX
+
 static const uint32_t an505_oscclk[] = {
     40000000,
     24580000,
@@ -828,6 +835,20 @@ static void mps2tz_common_init(MachineState *machine)
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", mmc->numirq);
     qdev_prop_set_uint32(iotkitdev, "init-svtor", mmc->init_svtor);
+    if (mmc->cpu0_mpu_ns != MPU_REGION_DEFAULT) {
+        qdev_prop_set_uint32(iotkitdev, "CPU0_MPU_NS", mmc->cpu0_mpu_ns);
+    }
+    if (mmc->cpu0_mpu_s != MPU_REGION_DEFAULT) {
+        qdev_prop_set_uint32(iotkitdev, "CPU0_MPU_S", mmc->cpu0_mpu_s);
+    }
+    if (object_property_find(OBJECT(iotkitdev), "CPU1_MPU_NS")) {
+        if (mmc->cpu1_mpu_ns != MPU_REGION_DEFAULT) {
+            qdev_prop_set_uint32(iotkitdev, "CPU1_MPU_NS", mmc->cpu1_mpu_ns);
+        }
+        if (mmc->cpu1_mpu_s != MPU_REGION_DEFAULT) {
+            qdev_prop_set_uint32(iotkitdev, "CPU1_MPU_S", mmc->cpu1_mpu_s);
+        }
+    }
     qdev_prop_set_uint32(iotkitdev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
     qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
@@ -1256,10 +1277,17 @@ static void mps2tz_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(oc);
+    MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
 
     mc->init = mps2tz_common_init;
     mc->reset = mps2_machine_reset;
     iic->check = mps2_tz_idau_check;
+
+    /* Most machines leave these at the SSE defaults */
+    mmc->cpu0_mpu_ns = MPU_REGION_DEFAULT;
+    mmc->cpu0_mpu_s = MPU_REGION_DEFAULT;
+    mmc->cpu1_mpu_ns = MPU_REGION_DEFAULT;
+    mmc->cpu1_mpu_s = MPU_REGION_DEFAULT;
 }
 
 static void mps2tz_set_default_ram_info(MPS2TZMachineClass *mmc)
@@ -1396,6 +1424,7 @@ static void mps3tz_an547_class_init(ObjectClass *oc, void *data)
     mmc->numirq = 96;
     mmc->uart_overflow_irq = 48;
     mmc->init_svtor = 0x00000000;
+    mmc->cpu0_mpu_s = mmc->cpu0_mpu_ns = 16;
     mmc->sram_addr_width = 21;
     mmc->raminfo = an547_raminfo;
     mmc->armsse_type = TYPE_SSE300;
diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index cd0931d0a0..88b3b759c5 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -56,6 +56,9 @@
  *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
  *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
  *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
+ *  + QOM properties "CPU0_MPU_NS", "CPU0_MPU_S", "CPU1_MPU_NS" and "CPU1_MPU_S"
+ *    which set the number of MPU regions on the CPUs. If there is only one
+ *    CPU the CPU1 properties are not present.
  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
  *    which are wired to its NVIC lines 32 .. n+32
  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
@@ -221,6 +224,8 @@ struct ARMSSE {
     uint32_t exp_numirq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
+    uint32_t cpu_mpu_ns[SSE_MAX_CPUS];
+    uint32_t cpu_mpu_s[SSE_MAX_CPUS];
     bool cpu_fpu[SSE_MAX_CPUS];
     bool cpu_dsp[SSE_MAX_CPUS];
 };