* [PULL 00/35] ppc-for-5.0 queue 20200203
@ 2020-02-03 6:10 David Gibson
2020-02-03 6:10 ` [PULL 01/35] ppc/pnv: use QEMU unit definition MiB David Gibson
` (35 more replies)
0 siblings, 36 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell; +Cc: lvivier, David Gibson, qemu-ppc, qemu-devel, groug
The following changes since commit 28db64fce555a03b4ca256d5b6f4290abdfbd9e8:
Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging (2020-01-31 17:37:00 +0000)
are available in the Git repository at:
git://github.com/dgibson/qemu.git tags/ppc-for-5.0-20200203
for you to fetch changes up to 63d57c8f91d0d0e62fc4d91db6340a662b36a3c0:
tests: Silence various warnings with pseries (2020-02-03 11:33:11 +1100)
----------------------------------------------------------------
ppc patch queue 2020-02093
This pull request supersedes ppc-for-5.0-20200131. The only changes
are one extra patch to suppress some irritating warnings during tests
under TCG, and an extra Tested-by in one of the other patches.
Here's the next batch of patches for ppc and associated machine types.
Highlights includes:
* Remove the deprecated "prep" machine type and its OpenHackware
firmware
* Add TCG emulation of the msgsndp etc. supervisor privileged
doorbell instructions
* Allow "pnv" machine type to run Hostboot style firmwares
* Add a virtual TPM device for spapr machines
* Implement devices for POWER8 PHB3 and POWER9 PHB4 host bridges for
the pnv machine type
* Use faster Spectre mitigation by default for POWER9 DD2.3 machines
* Introduce Firmware Assisted NMI dump facility for spapr machines
* Fix a performance regression with load/store multiple instructions
in TCG
as well as some other assorted cleanups and fixes.
----------------------------------------------------------------
Aravinda Prasad (7):
Wrapper function to wait on condition for the main loop mutex
ppc: spapr: Introduce FWNMI capability
target/ppc: Handle NMI guest exit
target/ppc: Build rtas error log upon an MCE
ppc: spapr: Handle "ibm,nmi-register" and "ibm,nmi-interlock" RTAS calls
migration: Include migration support for machine check handling
ppc: spapr: Activate the FWNMI functionality
BALATON Zoltan (1):
target/ppc/cpu.h: Put macro parameter in parentheses
Benjamin Herrenschmidt (1):
ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
Cédric Le Goater (9):
ppc/pnv: use QEMU unit definition MiB
ppc/pnv: improve error logging when a PNOR update fails
target/ppc: Add privileged message send facilities
target/ppc: add support for Hypervisor Facility Unavailable Exception
ppc/pnv: Add support for HRMOR on Radix host
ppc/pnv: remove useless "core-pir" property alias.
ppc/pnv: Add support for "hostboot" mode
ppc/pnv: Add models for POWER8 PHB3 PCIe Host bridge
ppc/pnv: change the PowerNV machine devices to be non user creatable
David Gibson (1):
spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine
Fabiano Rosas (1):
target/ppc: Clarify the meaning of return values in kvm_handle_debug
Greg Kurz (3):
spapr: Fail CAS if option vector table cannot be parsed
spapr: Don't allow multiple active vCPUs at CAS
tests: Silence various warnings with pseries
Igor Mammedov (1):
ppc:virtex_ml507: remove unused arguments
Marc-André Lureau (1):
docs/specs/tpm: reST-ify TPM documentation
Richard Henderson (4):
target/ppc: Use probe_access for LSW, STSW
target/ppc: Use probe_access for LMW, STMW
target/ppc: Remove redundant mask in DCBZ
target/ppc: Use probe_write for DCBZ
Stefan Berger (5):
tpm: Move tpm_tis_show_buffer to tpm_util.c
spapr: Implement get_dt_compatible() callback
tpm_spapr: Support TPM for ppc64 using CRQ based interface
tpm_spapr: Support suspend and resume
hw/ppc/Kconfig: Enable TPM_SPAPR as part of PSERIES config
Thomas Huth (1):
hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS
.gitmodules | 3 -
MAINTAINERS | 1 -
Makefile | 2 +-
cpus.c | 5 +
docs/interop/firmware.json | 3 +-
docs/specs/index.rst | 1 +
docs/specs/tpm.rst | 503 ++++++++++++
docs/specs/tpm.txt | 427 -----------
hw/intc/xics.c | 14 +-
hw/pci-host/Makefile.objs | 2 +
hw/pci-host/pnv_phb3.c | 1197 +++++++++++++++++++++++++++++
hw/pci-host/pnv_phb3_msi.c | 349 +++++++++
hw/pci-host/pnv_phb3_pbcq.c | 358 +++++++++
hw/pci-host/pnv_phb4.c | 1439 +++++++++++++++++++++++++++++++++++
hw/pci-host/pnv_phb4_pec.c | 595 +++++++++++++++
hw/ppc/Kconfig | 2 +
hw/ppc/pnv.c | 204 ++++-
hw/ppc/pnv_core.c | 33 +-
hw/ppc/pnv_homer.c | 1 +
hw/ppc/pnv_lpc.c | 6 +-
hw/ppc/pnv_occ.c | 1 +
hw/ppc/pnv_pnor.c | 6 +-
hw/ppc/ppc.c | 18 -
hw/ppc/prep.c | 384 +---------
hw/ppc/spapr.c | 63 +-
hw/ppc/spapr_caps.c | 49 +-
hw/ppc/spapr_events.c | 269 +++++++
hw/ppc/spapr_hcall.c | 20 +
hw/ppc/spapr_rtas.c | 87 +++
hw/ppc/spapr_vio.c | 11 +-
hw/ppc/virtex_ml507.c | 7 +-
hw/tpm/Kconfig | 6 +
hw/tpm/Makefile.objs | 1 +
hw/tpm/tpm_spapr.c | 429 +++++++++++
hw/tpm/tpm_tis.c | 32 +-
hw/tpm/tpm_util.c | 25 +
hw/tpm/tpm_util.h | 3 +
hw/tpm/trace-events | 16 +-
include/hw/pci-host/pnv_phb3.h | 164 ++++
include/hw/pci-host/pnv_phb3_regs.h | 450 +++++++++++
include/hw/pci-host/pnv_phb4.h | 230 ++++++
include/hw/pci-host/pnv_phb4_regs.h | 553 ++++++++++++++
include/hw/pci/pcie_port.h | 1 +
include/hw/ppc/pnv.h | 13 +
include/hw/ppc/pnv_core.h | 1 +
include/hw/ppc/pnv_xscom.h | 20 +
include/hw/ppc/ppc.h | 1 -
include/hw/ppc/spapr.h | 25 +-
include/hw/ppc/spapr_vio.h | 1 +
include/hw/ppc/xics.h | 5 +
include/qemu/main-loop.h | 8 +
include/sysemu/tpm.h | 3 +
pc-bios/README | 3 -
pc-bios/ppc_rom.bin | Bin 1048576 -> 0 bytes
qapi/tpm.json | 6 +-
qemu-deprecated.texi | 6 -
qemu-doc.texi | 15 +-
roms/openhackware | 1 -
target/ppc/cpu.h | 8 +-
target/ppc/excp_helper.c | 79 +-
target/ppc/helper.h | 4 +
target/ppc/kvm.c | 43 +-
target/ppc/kvm_ppc.h | 8 +
target/ppc/mem_helper.c | 197 ++++-
target/ppc/misc_helper.c | 63 ++
target/ppc/mmu-radix64.c | 6 +
target/ppc/trace-events | 1 +
target/ppc/translate.c | 26 +
target/ppc/translate_init.inc.c | 20 +-
tests/qtest/boot-order-test.c | 25 -
tests/qtest/boot-serial-test.c | 3 +-
tests/qtest/cdrom-test.c | 2 +-
tests/qtest/endianness-test.c | 2 +-
tests/qtest/libqos/libqos-spapr.h | 8 +
tests/qtest/prom-env-test.c | 3 +-
tests/qtest/pxe-test.c | 7 +-
76 files changed, 7565 insertions(+), 1018 deletions(-)
create mode 100644 docs/specs/tpm.rst
delete mode 100644 docs/specs/tpm.txt
create mode 100644 hw/pci-host/pnv_phb3.c
create mode 100644 hw/pci-host/pnv_phb3_msi.c
create mode 100644 hw/pci-host/pnv_phb3_pbcq.c
create mode 100644 hw/pci-host/pnv_phb4.c
create mode 100644 hw/pci-host/pnv_phb4_pec.c
create mode 100644 hw/tpm/tpm_spapr.c
create mode 100644 include/hw/pci-host/pnv_phb3.h
create mode 100644 include/hw/pci-host/pnv_phb3_regs.h
create mode 100644 include/hw/pci-host/pnv_phb4.h
create mode 100644 include/hw/pci-host/pnv_phb4_regs.h
delete mode 100644 pc-bios/ppc_rom.bin
delete mode 160000 roms/openhackware
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PULL 01/35] ppc/pnv: use QEMU unit definition MiB
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 02/35] ppc/pnv: improve error logging when a PNOR update fails David Gibson
` (34 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
Philippe Mathieu-Daudé,
David Gibson
From: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200108090348.21224-2-clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/pnv_pnor.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/pnv_pnor.c b/hw/ppc/pnv_pnor.c
index f761d8dc26..060c6e6a31 100644
--- a/hw/ppc/pnv_pnor.c
+++ b/hw/ppc/pnv_pnor.c
@@ -11,6 +11,7 @@
#include "qapi/error.h"
#include "qemu/error-report.h"
#include "qemu/log.h"
+#include "qemu/units.h"
#include "sysemu/block-backend.h"
#include "sysemu/blockdev.h"
#include "hw/loader.h"
@@ -111,7 +112,7 @@ static void pnv_pnor_realize(DeviceState *dev, Error **errp)
}
static Property pnv_pnor_properties[] = {
- DEFINE_PROP_INT64("size", PnvPnor, size, 128 << 20),
+ DEFINE_PROP_INT64("size", PnvPnor, size, 128 * MiB),
DEFINE_PROP_DRIVE("drive", PnvPnor, blk),
DEFINE_PROP_END_OF_LIST(),
};
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 02/35] ppc/pnv: improve error logging when a PNOR update fails
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
2020-02-03 6:10 ` [PULL 01/35] ppc/pnv: use QEMU unit definition MiB David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 03/35] ppc:virtex_ml507: remove unused arguments David Gibson
` (33 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
Philippe Mathieu-Daudé,
David Gibson
From: Cédric Le Goater <clg@kaod.org>
Print out the offset at which the error occured.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200108090348.21224-3-clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/pnv_pnor.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/pnv_pnor.c b/hw/ppc/pnv_pnor.c
index 060c6e6a31..c365ee58b8 100644
--- a/hw/ppc/pnv_pnor.c
+++ b/hw/ppc/pnv_pnor.c
@@ -47,7 +47,8 @@ static void pnv_pnor_update(PnvPnor *s, int offset, int size)
ret = blk_pwrite(s->blk, offset, s->storage + offset,
offset_end - offset, 0);
if (ret < 0) {
- error_report("Could not update PNOR: %s", strerror(-ret));
+ error_report("Could not update PNOR offset=0x%" PRIx32" : %s", offset,
+ strerror(-ret));
}
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 03/35] ppc:virtex_ml507: remove unused arguments
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
2020-02-03 6:10 ` [PULL 01/35] ppc/pnv: use QEMU unit definition MiB David Gibson
2020-02-03 6:10 ` [PULL 02/35] ppc/pnv: improve error logging when a PNOR update fails David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 04/35] hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS David Gibson
` (32 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Igor Mammedov,
Philippe Mathieu-Daudé,
David Gibson
From: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <1579100861-73692-71-git-send-email-imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/virtex_ml507.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index 7526947ea7..91dd00ee91 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -89,10 +89,7 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
tlb->PID = 0;
}
-static PowerPCCPU *ppc440_init_xilinx(ram_addr_t *ram_size,
- int do_init,
- const char *cpu_type,
- uint32_t sysclk)
+static PowerPCCPU *ppc440_init_xilinx(const char *cpu_type, uint32_t sysclk)
{
PowerPCCPU *cpu;
CPUPPCState *env;
@@ -213,7 +210,7 @@ static void virtex_init(MachineState *machine)
int i;
/* init CPUs */
- cpu = ppc440_init_xilinx(&ram_size, 1, machine->cpu_type, 400000000);
+ cpu = ppc440_init_xilinx(machine->cpu_type, 400000000);
env = &cpu->env;
if (env->mmu_model != POWERPC_MMU_BOOKE) {
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 04/35] hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (2 preceding siblings ...)
2020-02-03 6:10 ` [PULL 03/35] ppc:virtex_ml507: remove unused arguments David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 05/35] target/ppc: Clarify the meaning of return values in kvm_handle_debug David Gibson
` (31 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Thomas Huth, qemu-devel, groug, qemu-ppc,
Hervé Poussineau, Philippe Mathieu-Daudé,
David Gibson
From: Thomas Huth <thuth@redhat.com>
It's been deprecated since QEMU v3.1. The 40p machine should be
used nowadays instead.
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20200114114617.28854-1-thuth@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
.gitmodules | 3 -
MAINTAINERS | 1 -
Makefile | 2 +-
docs/interop/firmware.json | 3 +-
hw/ppc/ppc.c | 18 --
hw/ppc/prep.c | 384 +---------------------------------
include/hw/ppc/ppc.h | 1 -
pc-bios/README | 3 -
pc-bios/ppc_rom.bin | Bin 1048576 -> 0 bytes
qemu-deprecated.texi | 6 -
qemu-doc.texi | 15 +-
roms/openhackware | 1 -
tests/qtest/boot-order-test.c | 25 ---
tests/qtest/cdrom-test.c | 2 +-
tests/qtest/endianness-test.c | 2 +-
15 files changed, 10 insertions(+), 456 deletions(-)
delete mode 100644 pc-bios/ppc_rom.bin
delete mode 160000 roms/openhackware
diff --git a/.gitmodules b/.gitmodules
index 19792c9a11..9c0501a4d4 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -10,9 +10,6 @@
[submodule "roms/openbios"]
path = roms/openbios
url = https://git.qemu.org/git/openbios.git
-[submodule "roms/openhackware"]
- path = roms/openhackware
- url = https://git.qemu.org/git/openhackware.git
[submodule "roms/qemu-palcode"]
path = roms/qemu-palcode
url = https://git.qemu.org/git/qemu-palcode.git
diff --git a/MAINTAINERS b/MAINTAINERS
index 4ceb1ad882..faffd447bf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1103,7 +1103,6 @@ F: hw/dma/i82374.c
F: hw/rtc/m48t59-isa.c
F: include/hw/isa/pc87312.h
F: include/hw/rtc/m48t59.h
-F: pc-bios/ppc_rom.bin
F: tests/acceptance/ppc_prep_40p.py
sPAPR
diff --git a/Makefile b/Makefile
index 9a5a1e689c..3b21c0ea48 100644
--- a/Makefile
+++ b/Makefile
@@ -784,7 +784,7 @@ ifdef INSTALL_BLOBS
BLOBS=bios.bin bios-256k.bin bios-microvm.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin vgabios-virtio.bin \
vgabios-ramfb.bin vgabios-bochs-display.bin vgabios-ati.bin \
-ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc QEMU,tcx.bin QEMU,cgthree.bin \
+openbios-sparc32 openbios-sparc64 openbios-ppc QEMU,tcx.bin QEMU,cgthree.bin \
pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
efi-e1000.rom efi-eepro100.rom efi-ne2k_pci.rom \
diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
index 8ffb7856d2..240f565397 100644
--- a/docs/interop/firmware.json
+++ b/docs/interop/firmware.json
@@ -27,8 +27,7 @@
#
# @openfirmware: The interface is defined by the (historical) IEEE
# 1275-1994 standard. Examples for firmware projects that
-# provide this interface are: OpenBIOS, OpenHackWare,
-# SLOF.
+# provide this interface are: OpenBIOS and SLOF.
#
# @uboot: Firmware interface defined by the U-Boot project.
#
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 4c5fa29399..4a11fb1640 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -1490,24 +1490,6 @@ int ppc_dcr_init (CPUPPCState *env, int (*read_error)(int dcrn),
}
/*****************************************************************************/
-/* Debug port */
-void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
-{
- addr &= 0xF;
- switch (addr) {
- case 0:
- printf("%c", val);
- break;
- case 1:
- printf("\n");
- fflush(stdout);
- break;
- case 2:
- printf("Set loglevel to %04" PRIx32 "\n", val);
- qemu_set_log(val | 0x100);
- break;
- }
-}
int ppc_cpu_pir(PowerPCCPU *cpu)
{
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 862345c2ac..111cc80867 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -42,7 +42,7 @@
#include "hw/loader.h"
#include "hw/rtc/mc146818rtc.h"
#include "hw/isa/pc87312.h"
-#include "hw/net/ne2000-isa.h"
+#include "hw/qdev-properties.h"
#include "sysemu/arch_init.h"
#include "sysemu/kvm.h"
#include "sysemu/qtest.h"
@@ -60,178 +60,9 @@
#define CFG_ADDR 0xf0000510
-#define BIOS_SIZE (1 * MiB)
-#define BIOS_FILENAME "ppc_rom.bin"
#define KERNEL_LOAD_ADDR 0x01000000
#define INITRD_LOAD_ADDR 0x01800000
-/* Constants for devices init */
-static const int ide_iobase[2] = { 0x1f0, 0x170 };
-static const int ide_iobase2[2] = { 0x3f6, 0x376 };
-static const int ide_irq[2] = { 13, 13 };
-
-#define NE2000_NB_MAX 6
-
-static uint32_t ne2000_io[NE2000_NB_MAX] = { 0x300, 0x320, 0x340, 0x360, 0x280, 0x380 };
-static int ne2000_irq[NE2000_NB_MAX] = { 9, 10, 11, 3, 4, 5 };
-
-/* ISA IO ports bridge */
-#define PPC_IO_BASE 0x80000000
-
-/* Fake super-io ports for PREP platform (Intel 82378ZB) */
-typedef struct sysctrl_t {
- qemu_irq reset_irq;
- Nvram *nvram;
- uint8_t state;
- uint8_t syscontrol;
- int contiguous_map;
- qemu_irq contiguous_map_irq;
- int endian;
-} sysctrl_t;
-
-enum {
- STATE_HARDFILE = 0x01,
-};
-
-static sysctrl_t *sysctrl;
-
-static void PREP_io_800_writeb (void *opaque, uint32_t addr, uint32_t val)
-{
- sysctrl_t *sysctrl = opaque;
-
- trace_prep_io_800_writeb(addr - PPC_IO_BASE, val);
- switch (addr) {
- case 0x0092:
- /* Special port 92 */
- /* Check soft reset asked */
- if (val & 0x01) {
- qemu_irq_raise(sysctrl->reset_irq);
- } else {
- qemu_irq_lower(sysctrl->reset_irq);
- }
- /* Check LE mode */
- if (val & 0x02) {
- sysctrl->endian = 1;
- } else {
- sysctrl->endian = 0;
- }
- break;
- case 0x0800:
- /* Motorola CPU configuration register : read-only */
- break;
- case 0x0802:
- /* Motorola base module feature register : read-only */
- break;
- case 0x0803:
- /* Motorola base module status register : read-only */
- break;
- case 0x0808:
- /* Hardfile light register */
- if (val & 1)
- sysctrl->state |= STATE_HARDFILE;
- else
- sysctrl->state &= ~STATE_HARDFILE;
- break;
- case 0x0810:
- /* Password protect 1 register */
- if (sysctrl->nvram != NULL) {
- NvramClass *k = NVRAM_GET_CLASS(sysctrl->nvram);
- (k->toggle_lock)(sysctrl->nvram, 1);
- }
- break;
- case 0x0812:
- /* Password protect 2 register */
- if (sysctrl->nvram != NULL) {
- NvramClass *k = NVRAM_GET_CLASS(sysctrl->nvram);
- (k->toggle_lock)(sysctrl->nvram, 2);
- }
- break;
- case 0x0814:
- /* L2 invalidate register */
- // tlb_flush(first_cpu, 1);
- break;
- case 0x081C:
- /* system control register */
- sysctrl->syscontrol = val & 0x0F;
- break;
- case 0x0850:
- /* I/O map type register */
- sysctrl->contiguous_map = val & 0x01;
- qemu_set_irq(sysctrl->contiguous_map_irq, sysctrl->contiguous_map);
- break;
- default:
- printf("ERROR: unaffected IO port write: %04" PRIx32
- " => %02" PRIx32"\n", addr, val);
- break;
- }
-}
-
-static uint32_t PREP_io_800_readb (void *opaque, uint32_t addr)
-{
- sysctrl_t *sysctrl = opaque;
- uint32_t retval = 0xFF;
-
- switch (addr) {
- case 0x0092:
- /* Special port 92 */
- retval = sysctrl->endian << 1;
- break;
- case 0x0800:
- /* Motorola CPU configuration register */
- retval = 0xEF; /* MPC750 */
- break;
- case 0x0802:
- /* Motorola Base module feature register */
- retval = 0xAD; /* No ESCC, PMC slot neither ethernet */
- break;
- case 0x0803:
- /* Motorola base module status register */
- retval = 0xE0; /* Standard MPC750 */
- break;
- case 0x080C:
- /* Equipment present register:
- * no L2 cache
- * no upgrade processor
- * no cards in PCI slots
- * SCSI fuse is bad
- */
- retval = 0x3C;
- break;
- case 0x0810:
- /* Motorola base module extended feature register */
- retval = 0x39; /* No USB, CF and PCI bridge. NVRAM present */
- break;
- case 0x0814:
- /* L2 invalidate: don't care */
- break;
- case 0x0818:
- /* Keylock */
- retval = 0x00;
- break;
- case 0x081C:
- /* system control register
- * 7 - 6 / 1 - 0: L2 cache enable
- */
- retval = sysctrl->syscontrol;
- break;
- case 0x0823:
- /* */
- retval = 0x03; /* no L2 cache */
- break;
- case 0x0850:
- /* I/O map type register */
- retval = sysctrl->contiguous_map;
- break;
- default:
- printf("ERROR: unaffected IO port: %04" PRIx32 " read\n", addr);
- break;
- }
- trace_prep_io_800_readb(addr - PPC_IO_BASE, retval);
-
- return retval;
-}
-
-
#define NVRAM_SIZE 0x2000
static void fw_cfg_boot_set(void *opaque, const char *boot_device,
@@ -247,17 +78,6 @@ static void ppc_prep_reset(void *opaque)
cpu_reset(CPU(cpu));
}
-static const MemoryRegionPortio prep_portio_list[] = {
- /* System control ports */
- { 0x0092, 1, 1, .read = PREP_io_800_readb, .write = PREP_io_800_writeb, },
- { 0x0800, 0x52, 1,
- .read = PREP_io_800_readb, .write = PREP_io_800_writeb, },
- /* Special port to get debug messages from Open-Firmware */
- { 0x0F00, 4, 1, .write = PPC_debug_write, },
- PORTIO_END_OF_LIST(),
-};
-
-static PortioList prep_port_list;
/*****************************************************************************/
/* NVRAM helpers */
@@ -397,207 +217,6 @@ static int PPC_NVRAM_set_params (Nvram *nvram, uint16_t NVRAM_size,
return 0;
}
-/* PowerPC PREP hardware initialisation */
-static void ppc_prep_init(MachineState *machine)
-{
- ram_addr_t ram_size = machine->ram_size;
- const char *kernel_filename = machine->kernel_filename;
- const char *kernel_cmdline = machine->kernel_cmdline;
- const char *initrd_filename = machine->initrd_filename;
- const char *boot_device = machine->boot_order;
- MemoryRegion *sysmem = get_system_memory();
- PowerPCCPU *cpu = NULL;
- CPUPPCState *env = NULL;
- Nvram *m48t59;
-#if 0
- MemoryRegion *xcsr = g_new(MemoryRegion, 1);
-#endif
- int linux_boot, i, nb_nics1;
- MemoryRegion *ram = g_new(MemoryRegion, 1);
- uint32_t kernel_base, initrd_base;
- long kernel_size, initrd_size;
- DeviceState *dev;
- PCIHostState *pcihost;
- PCIBus *pci_bus;
- PCIDevice *pci;
- ISABus *isa_bus;
- ISADevice *isa;
- int ppc_boot_device;
- DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
-
- sysctrl = g_malloc0(sizeof(sysctrl_t));
-
- linux_boot = (kernel_filename != NULL);
-
- /* init CPUs */
- for (i = 0; i < machine->smp.cpus; i++) {
- cpu = POWERPC_CPU(cpu_create(machine->cpu_type));
- env = &cpu->env;
-
- if (env->flags & POWERPC_FLAG_RTC_CLK) {
- /* POWER / PowerPC 601 RTC clock frequency is 7.8125 MHz */
- cpu_ppc_tb_init(env, 7812500UL);
- } else {
- /* Set time-base frequency to 100 Mhz */
- cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL);
- }
- qemu_register_reset(ppc_prep_reset, cpu);
- }
-
- /* allocate RAM */
- memory_region_allocate_system_memory(ram, NULL, "ppc_prep.ram", ram_size);
- memory_region_add_subregion(sysmem, 0, ram);
-
- if (linux_boot) {
- kernel_base = KERNEL_LOAD_ADDR;
- /* now we can load the kernel */
- kernel_size = load_image_targphys(kernel_filename, kernel_base,
- ram_size - kernel_base);
- if (kernel_size < 0) {
- error_report("could not load kernel '%s'", kernel_filename);
- exit(1);
- }
- /* load initrd */
- if (initrd_filename) {
- initrd_base = INITRD_LOAD_ADDR;
- initrd_size = load_image_targphys(initrd_filename, initrd_base,
- ram_size - initrd_base);
- if (initrd_size < 0) {
- error_report("could not load initial ram disk '%s'",
- initrd_filename);
- exit(1);
- }
- } else {
- initrd_base = 0;
- initrd_size = 0;
- }
- ppc_boot_device = 'm';
- } else {
- kernel_base = 0;
- kernel_size = 0;
- initrd_base = 0;
- initrd_size = 0;
- ppc_boot_device = '\0';
- /* For now, OHW cannot boot from the network. */
- for (i = 0; boot_device[i] != '\0'; i++) {
- if (boot_device[i] >= 'a' && boot_device[i] <= 'f') {
- ppc_boot_device = boot_device[i];
- break;
- }
- }
- if (ppc_boot_device == '\0') {
- error_report("No valid boot device for Mac99 machine");
- exit(1);
- }
- }
-
- if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) {
- error_report("Only 6xx bus is supported on PREP machine");
- exit(1);
- }
-
- dev = qdev_create(NULL, "raven-pcihost");
- if (bios_name == NULL) {
- bios_name = BIOS_FILENAME;
- }
- qdev_prop_set_string(dev, "bios-name", bios_name);
- qdev_prop_set_uint32(dev, "elf-machine", PPC_ELF_MACHINE);
- qdev_prop_set_bit(dev, "is-legacy-prep", true);
- pcihost = PCI_HOST_BRIDGE(dev);
- object_property_add_child(qdev_get_machine(), "raven", OBJECT(dev), NULL);
- qdev_init_nofail(dev);
- pci_bus = (PCIBus *)qdev_get_child_bus(dev, "pci.0");
- if (pci_bus == NULL) {
- error_report("Couldn't create PCI host controller");
- exit(1);
- }
- sysctrl->contiguous_map_irq = qdev_get_gpio_in(dev, 0);
-
- /* PCI -> ISA bridge */
- pci = pci_create_simple(pci_bus, PCI_DEVFN(1, 0), "i82378");
- cpu = POWERPC_CPU(first_cpu);
- qdev_connect_gpio_out(&pci->qdev, 0,
- cpu->env.irq_inputs[PPC6xx_INPUT_INT]);
- sysbus_connect_irq(&pcihost->busdev, 0, qdev_get_gpio_in(&pci->qdev, 9));
- sysbus_connect_irq(&pcihost->busdev, 1, qdev_get_gpio_in(&pci->qdev, 11));
- sysbus_connect_irq(&pcihost->busdev, 2, qdev_get_gpio_in(&pci->qdev, 9));
- sysbus_connect_irq(&pcihost->busdev, 3, qdev_get_gpio_in(&pci->qdev, 11));
- isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(pci), "isa.0"));
-
- /* Super I/O (parallel + serial ports) */
- isa = isa_create(isa_bus, TYPE_PC87312_SUPERIO);
- dev = DEVICE(isa);
- qdev_prop_set_uint8(dev, "config", 13); /* fdc, ser0, ser1, par0 */
- qdev_init_nofail(dev);
-
- /* init basic PC hardware */
- pci_vga_init(pci_bus);
-
- nb_nics1 = nb_nics;
- if (nb_nics1 > NE2000_NB_MAX)
- nb_nics1 = NE2000_NB_MAX;
- for(i = 0; i < nb_nics1; i++) {
- if (nd_table[i].model == NULL) {
- nd_table[i].model = g_strdup("ne2k_isa");
- }
- if (strcmp(nd_table[i].model, "ne2k_isa") == 0) {
- isa_ne2000_init(isa_bus, ne2000_io[i], ne2000_irq[i],
- &nd_table[i]);
- } else {
- pci_nic_init_nofail(&nd_table[i], pci_bus, "ne2k_pci", NULL);
- }
- }
-
- ide_drive_get(hd, ARRAY_SIZE(hd));
- for(i = 0; i < MAX_IDE_BUS; i++) {
- isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i], ide_irq[i],
- hd[2 * i],
- hd[2 * i + 1]);
- }
-
- cpu = POWERPC_CPU(first_cpu);
- sysctrl->reset_irq = cpu->env.irq_inputs[PPC6xx_INPUT_HRESET];
-
- portio_list_init(&prep_port_list, NULL, prep_portio_list, sysctrl, "prep");
- portio_list_add(&prep_port_list, isa_address_space_io(isa), 0x0);
-
- /*
- * PowerPC control and status register group: unimplemented,
- * would be at address 0xFEFF0000.
- */
-
- if (machine_usb(machine)) {
- pci_create_simple(pci_bus, -1, "pci-ohci");
- }
-
- m48t59 = m48t59_init_isa(isa_bus, 0x0074, NVRAM_SIZE, 2000, 59);
- if (m48t59 == NULL)
- return;
- sysctrl->nvram = m48t59;
-
- /* Initialise NVRAM */
- PPC_NVRAM_set_params(m48t59, NVRAM_SIZE, "PREP", ram_size,
- ppc_boot_device,
- kernel_base, kernel_size,
- kernel_cmdline,
- initrd_base, initrd_size,
- /* XXX: need an option to load a NVRAM image */
- 0,
- graphic_width, graphic_height, graphic_depth);
-}
-
-static void prep_machine_init(MachineClass *mc)
-{
- mc->deprecation_reason = "use 40p machine type instead";
- mc->desc = "PowerPC PREP platform";
- mc->init = ppc_prep_init;
- mc->block_default_type = IF_IDE;
- mc->max_cpus = MAX_CPUS;
- mc->default_boot_order = "cad";
- mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("602");
- mc->default_display = "std";
-}
-
static int prep_set_cmos_checksum(DeviceState *dev, void *opaque)
{
uint16_t checksum = *(uint16_t *)opaque;
@@ -821,4 +440,3 @@ static void ibm_40p_machine_init(MachineClass *mc)
}
DEFINE_MACHINE("40p", ibm_40p_machine_init)
-DEFINE_MACHINE("prep", prep_machine_init)
diff --git a/include/hw/ppc/ppc.h b/include/hw/ppc/ppc.h
index 4ea5436095..93e614cffd 100644
--- a/include/hw/ppc/ppc.h
+++ b/include/hw/ppc/ppc.h
@@ -68,7 +68,6 @@ clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, uint32_t freq,
void ppc40x_core_reset(PowerPCCPU *cpu);
void ppc40x_chip_reset(PowerPCCPU *cpu);
void ppc40x_system_reset(PowerPCCPU *cpu);
-void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val);
#if defined(CONFIG_USER_ONLY)
static inline void ppc40x_irq_init(PowerPCCPU *cpu) {}
diff --git a/pc-bios/README b/pc-bios/README
index 269d99afe0..d6d33d237f 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -4,9 +4,6 @@
- The VGA BIOS and the Cirrus VGA BIOS come from the LGPL VGA bios
project (http://www.nongnu.org/vgabios/).
-- The PowerPC Open Hack'Ware Open Firmware Compatible BIOS is
- available at https://repo.or.cz/openhackware.git.
-
- OpenBIOS (http://www.openbios.org/) is a free (GPL v2) portable
firmware implementation. The goal is to implement a 100% IEEE
1275-1994 (referred to as Open Firmware) compliant firmware.
diff --git a/pc-bios/ppc_rom.bin b/pc-bios/ppc_rom.bin
deleted file mode 100644
index 174a24744b73fb2824f9b1e7c0078f4499e1e724..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001
literal 1048576
zcmeFa4|r77wKu%aWD*95I@+lX5@aILCK3S^d(UK&Fp;Q}1iTR@hPJ4ao1jENqhdSO
zGntvpP!omwCImD{z)%PmTIz=tZ}AEk1SwR!AKog(TZC{00sp*3g$fEe-|x52nJ~nl
zV(<4o?{^{3b8_bFv;VBM_S$Q$z4qGss6vQ*zYvx8iL~G^l9p+Mla`GWqB=i}v{~0(
z|ME&9^74hpmm$)cGW5f975zl7>sb6bv^8m&E2^Jxt<z7;+$OB^-VoLsg?`L0oFepZ
zr|R|!aRHi@f7(>bGVK{$FXQ?Xu1_t?^6<tl#7gb5q-838$6@k{q3@uqX!hrc;A56$
z<@Z?&f{!IFi{P0s<JDRJmFjx;Sr_^rRG?Jvj{FZo=d4jF)lZ(|_@6k(@&9u5Su@T5
zpaP}(7w35YA3w+OKX#7e|M@vS{{ME4_y5sz9RDNdIR2lV<M@Aij^qEyIgbC~a~%J_
zp5yrc?{gggkI!-ZKRU<p|L`2g|ATWJ|3l|E{s+%-{12St_`iRS<G=qL$A8~Bj{ke-
zIR5{2j^n@goW{R3iuHAovhvojaMm?gmbt2Reb$pg$*~GiST9nsKE4;%;kt&TW$`>}
zOpHR>)}FNGDCZZpU=7yzpBxq_zt34vUfr(%b@VTc2s`q=fjEGVuy$`p*$O<*#`CVa
z<z}6X0r=VAfcEsTfVO6MKzrx<fcAwuV8kU{H|FL0ga}prB@k;9R+PQt_HC~gXsL&V
zCn9XFMY>)-%U;0u+N^^k@IF5w@3jfPujKE#eJ=-)=eC6O3-~)^-N<y;sr2rnGClKk
zre`Fizbn&={>1eD3F)uZO*QcOAGADp9+mSHI8TA|6gW?T^AtEwf%6nNPl59kI8TA|
z6gW?T{~;8(X~KkmoRI6hvHTWiRplf1Or0@e#E1dHIVDgvrFKTm1NVyo_t(_sj|vFq
z^oJjk_v%XX{&0<vGGOA22Wo3;?!O16rc^z`QUk<|#s4_*)U%i{<>4ta#Q4gpsWtac
zaaK*8Qgxpws+>{joIYjx0}nmwtgNb<^6<l=`2L4yJoHEvt8m^uWk%IhaZ_N%l!xxG
zoF)pV)!cLc^eOkx5M>WNaL+@P)5Wb1IPaeJK;;a!T>C%`-V{x#dT0vsOnFGQ_|VU$
zR67e#{k&03eDvWNQ>FveY14%7p~|W$;^xz;a8^DHw9v+shwgshq3M<PS50wFf8hR_
z84o;k8gRaGH#(=+0Ah(m{K<(j&WDkAN+0QHr~0%yDyyp>0@BWZdT2`JeFg$1cxbos
z9*KzXO`QTTra2Rm%J0AL{s(@3KNxTnuS;=d;L65zEiM<XvA8DTx(C;ET#w=UXI$;L
zR^WO8*UPxx!1WHUeYpOL>q{Z7RdD?P*Kk}OT&U;T2XLYMwJ3k>3&~+2MABjW6Cx~<
zjv?*$xc-bslso@-o&x77aGnC^DR7<w=P7WW0_Q1ko&x77@P8}?^8Lw?%KLt^sR`yj
ze%Dvt7Y*l!ai7&VEBK_pEI8}Z+MHCm7MvDr#QyI4u)jMj#Jnfv-tH4#kz9^F+F{LR
ztbKBSwtoKaJO$2E;QtpCU`z)uwFAKqR$bTjUG2#CTyjgOLG@IYXkCSiglBe^P}ELg
z({R3nR#g)4)%5H3RUNClHe1(&*~Ru?cA1)={qak#?5Hz1?6Lr2JGxljvq;~<y0s<4
z1F{Xj5MJ?oDu272ILBd_5d58Z4WB783m1yF8u4y;qi~}AmAGGn_!0%bw=sQWqZsKy
zo}8ItfXgF<`kMHWx?hZh>~XsK>)Q)k#kkqSgc2;t-od=Vk{cb!uj02W)XytC9r~{F
ztdvhj+Jr~5jS^^2Wx3vE3K#0zM?R_RXm{Mm7-ZlgF{!Cqh~U_X5+9dM-|Bfu@A5?S
zxrhbX$?_8B_4=_m%%DLT;Bu(Iop=UI#CGIetyT%e<=1um9@SGHaKUra+zh=*vssn}
z!{Vxz4Pxq;&g6Rc?zGV@8N%1HSX7U3CP&A#C)YPAVn&N1%9<l$TuY&t<i1nbS}Mh4
zcQ7rhB_jOp`Od&M+&H_qb-39DL(envcwx>%^{29d7r6{B5>NONVtYg8y4&5yBv
zp13A7bh~F{REQ=`2+tzn^E{((%7boDt1eT=ZN9eND_(kD1?*w8A3@uc{ZYUX1$@D9
z#2E!FQNR%e3{k)v1rAZbp=O9$(jW{tykh=QulVhoUgh3FUQzV+h$O@zJvKPt`JHeW
zZKX{z+q%gsLN)m!`KYf(T%OlC@WbiZ!d7Y9D}vc#w14xfqCESZI&I3}Kuxw#v_D)Q
z7?Leg!54GXun=RQ%R;+L9Krr$1K~R1aJQueNY61{$@O04k#&S6FDz`JZ`iBUt>bUC
z9cP~SlkxoI_wjzTR|x^%q+?$3tCzwH)3Wl~QD^kMfZCC!d6ifP#)egGPdXOb^jU!E
zY}2d!GFd)v{49VrXL*%|E7`8s^79+KV$r(rvuUGDJR1x=*WAIf=I`6Wi_&t;_sh++
z{BQ)cTP*BM_r<0Zs8wkz&375$P}(Tq6!nVMAG03ZZwuF@<=|dy)bo>8{LTkHcCQ$A
zK_o-in?ljBRyR0+aWTDcQPQZ9i^$_iJ41lkt2i<UKj~_eA5?9$_4^me%jmnCRKJJ!
zd`%l1Fw?FL?=k8GpJjpHa=>euY8PaS5Q1agEB<hZyj9qiG$|i^994i*O*9-W6gghy
zd-Fnn01a>YlcXbKvOrsuNq!LUs^Ftcz$!q4(PMTCyL-2;SL_y-VqB(<oJrU%hr@e?
zgYZjQZ4jfpBFPm7o~XO9_8y^l>Md#EN27DSA~p|oI`ch3sVvd;P-B?~JR=|{GRw2I
zI*eb+o3!%mV|C>vwmd$&N>F~0ez?5Eo?BTWEWxtqvf!lXGT>ziUW?zZ=rXlSq(p|K
zWod_!mZ5G7aW2oc<*^PI_!F}62xUNdwmmmk;!!KJMN%+(Vj!3sT_)@NX>?iP91&n#
z8EBXa`q{i<>|(%bBdowLH4d+5q2eK|`9fGEe1IP?r}u`r+-A!I+#i(}qfMLG9<-@u
zyJG{vJhW>A{6nJ4yyCIv(T?Q1@CxvB)u82J(tE40g%62Tlh?+RAIKYczsXE<8U6p8
zYqjbge%WcfdvT`u?)zHiz(jsJY`&jj^v}hM(XTnRHS8my0ngFe(%}KX!|@g&Plq<6
z&5oH<$xHbjj8E~42g9ZeVjE{Ghe$W}InKa2=oO7qa2Cu#@J*J%@0Vp7@U4E0aOFF9
z|F$x_b9eKVQbt#!z3E<&k&p57DB>j7h9OT`4tZ6RHa4^TOqm9rglrk_6_;PbJNh-9
zeCm%01!;pIs}y70eeYV1OZi)53`(GNj#=LgQH-%t{e;g|U>B|H?V>qDj1FE|ig?76
zRs;4yv&_8xDW`G9$0Re|W2C?EiJ9&(($jXC>F=27S<pe9)IrcIS#FQiD>-hzutWch
zcDD-wz2nq&ULSx?%G8d#1JF04w6((n&{rzuCv;O0WefCA9(0{;!4mx#uHy@;^e=FI
ziQgx1oy66>U@VkgM5Iw(d&R%LF|v((ta#Yx&}ooYoyCv?m$-((1_=!gl>hMNg7U0b
zLHX6M7A#ngy4Q>Tq5WS57SxFWp|O7owC)xIL$UV)t=%Fu^u-sB`In0e=HDqUoL?X=
zLjBV*CV$}W6askI=Z}GaaEjCgdxXHHV9cd0ctu!%gB8zKHH7;2h-6$T$P4S?U#~%a
z2cA=rm+vk>UK`3>h`bKuxd>@?To>cI1nJ)ct!$uEs#m=D3Cc1(9r=dhH_Hz}xlH7{
zocQC}N&4ZQf$Iw78-{W(fzOL5D<zME=8%_J(Mpj69Xkp-c61bUhmOsIj`dK-qV7xF
z-GF0}u!Y_OZ5E0CvVPEr^@A1zk(P?<0$dj^xRbPb@ivTwee8S4=6YB0Wd|h>pkC1Z
z(MZi@2O|T7b@A20#{QkNSEQ2<$OGgP*d96L1M&#@pt(}mniY}yJakQAy`{+Iyeif0
z6bkrBG>;MDg)zdaEgTkj;VzLv-XT2!+W^vB``jHMe|g2~b!wOLrn?h7rNf5ka`IlA
z*ER4%|AAMjQ=E97mDiPg)PG>Fz<9Rcxhbzp`P_ft36I+kSamU1?MgZbxuM{9tJ;Mz
zGe)%GcRTJ&aV^KS2G=HB+netayKwDm9x7%4#;Jhs-j+QgfJ?&_#udZWfNLeLRV^X0
z8uzuhcjCSU_iebpg=;6SE?fsu-$%F~Mx95z;%D>K&o9z_2gFr?w_oV-E|2ffl7gm?
zIEFkYTJ|WSC8SteUQv$WI?;TW#oDsRVrw2_NyWGrr5)%hLpi(ez>)&Ivm@Q13em4g
zx1@m{DR`F*T&-%CNCG`A>duSw^bV2g+bph1KOj<rcmJ1Th)txH-?yZoV*Qc=P0w{`
zuUzc_f7mP9mK69lFDVGUez=UZYnf@WwM?;CgF|n0G`(g?9a17vn;y4VRliL%-(#@_
z@0#Ff`GX}DZF!mwTC90pp!Y$GjW$@*R7<K$SVZ#xi#1<}ft9vnqUl~sDxPh@F(nR{
z2YuOy=VH9~h>M`t4&%2CI4I3ylC8LlrlA(m@=7vrPqBr;bM@dkQ_eeKZ+_!APzC7W
z1U)>$3YsJVPL6E_eEt!68@zrPcv~T-QYl-&*N(_Akr&ApnAgy!Va<q)5qTU#$kz|)
zuse-(*fCA8k6RPoi(cjA*h9G#+AYk7_g3g=A7EG&uP33rHL-rJX7Hn`AF{As*rDG!
zhk*SdvOot1#(FC0fbnkUct?Hh@%k`_Sj9Y)<-PNv&H(#lYE(=IO_b*TB2BBpJV0Pf
z7K>Co=lQDMsl#svE?IY+PKh)MSBbR9U62b)vUdbau6Bf;aC&Gj(O%S|!vevgi5R=j
z&kKh{T3_&*b#_5kIJ9-cN%u^xV{<L!MjG`7`oM<v(zR!?pCG$mH|dA@qK$pyS)^3^
zI}rX4T9UTDj+BBp?vVoY74$07lli`)<ClHCBc1VXb6@Y0jCXz3X_0M$e-hgR?VW5>
zz5|aWzB6Iz%{P-sC-mh~z?(*WO8j7ZdgJiBbzya{6NJ+iug_O=bAfN_s|CJ$V+E}t
z{lxsC`pNls>D}|k=sN2OH6FxVR_|mT<W&=<M1C!!eTH_um<zFAGNC&hay)_V;FWan
zlbnx(zGWCA?X(X<OFx9IH`r&`2)}{-FXyeB4BKIF%uHWsrmsA$Zz12=x9lg`x9efk
z#rqcHO^yp=yjcO)D$vps$Cu-x;<c0lbL`1JJN?~e`Oc(!vb*!t*i0Bxq&?<mr^bgC
z{M6wU4?V&>qzCIqp452Vm<M4#C;*SX^Xq7YI?Li^Fy?&iRU+3b9?ZhnuxizpIcUH7
zs;mV_b0AHH9b_?|tzXSkdl=<Ykhj&mH<|az=G_+`hm=uavkjxZ+D48sUsXy$qD-LA
zg7S^!ICkCd={owr7TR-#gLM?H6KU{Gc)g;wxGe<x^V!23!z$*w&{4HFz!u+*-$&6$
z+Y1-zyV!=5DX2s84C;)_ALE@6utUD`?#ysM@Md3d1Lo~4qy2h#fI7gp41E7Du>#-n
zR}0`XSq>bsKzm`@mpStb#RZfTlxN^Gfq5tK8$G{L*yd-5{;eCtfY!ZY;Cw}-;`u^c
z7vZv_+{L(Gg6n&bLz!Oj+_mBL7)O*J5n+Qp?K;y~8Xgs1b1b!S?EQZ=hS9FaY&Va(
z0rVS<F`Q|R;Vg{d9Q4U3>I8Fqt~SQ!znnD3=XNu_%S_*Irmu<j6Z-s9@(X#yEAGFh
zHY8qWT4>*wkm>gq<M+W*{ll$Q`!KGMj<g%hv=`Z*)H#GLkr(52$9WfJPBJg~hxzcl
zEuJS)&mdja2|Z#><T<3T27lYAb0ANwzL@hzTCBv;x|DN>`@`WVV2de!^SPFJS{oHV
z-c_?)ye-1R_E1kwyq?g$65^dt_!>gyyplMXx;FZru;Tp?zIW@2zpp&`PBA_d^Kw33
zREc@N`P=St!e=_HRQeCmURvZP_(l37%{##nEGd18@9Ae~9t-=!%qQ)jB_c2WjPbE5
z2;U%a7-<y>Y;F&HPSHqS^eymlQK(&9Rk7~RQfFeUc!A$IZIP72KH4}fl_IY>BGke~
z$zInTu#1L>6#6var#Trcp5Q3A*>fW$!W!&<qa$Ji9sj87(7kz~U#cF!Wo=GE*@Y>o
z6<hmtQ+C2;##s5=i{V#<E$+vYdSlatwQ5zmIp^#M7S6G*8o7Xem83R<2h*n-JlIiL
z*p$4QHVDTx=6Zs-K>yh)*4cAID?V_9gTgBPMvEZ(bjUEti~jwvnLUu>ecD-`Mb=TM
z?=*c9x8sm*qh5&1?_T<%M`zMrDx8z#VB4s#Q_7cikpdY*IU?l??gMZQ#6|gXfmf_J
zlvp3yYVX|^>gi|dou0PPhK*wzJmWCwv&x{)(n9xQ@ET+*WfOIiSKRmFne<m^(Lws&
zck=xi+A(EFQYU2QCFC!_m_pnj6K%u|>6yT#Kdu32I|uiHY#;CAI3`P4M&z6=vs6EJ
z!Pm5B%F3knI9))G9=k^B;2ym0-5-a)5wMgOzY~JbZu{^jM6zd*Whdae60lliKU6|?
zBTpPo!iY=4hx;ixpCK;xisj`A@Pc1IzvElLYdaIXpb`9X_qx93J?8uO4r+*qRN!%e
zFV=Zs!v=9tc}e*4MnzoMfb!ZC69bK)aj@k2K)KB`!dKOKVX$N@?A`F?4U5G<t)?{4
zuvZMg+%YZRlN=6a!=5<c8R06qbZ#))9YA^xeTtxo-IblBmuLTOJ<{m=_Fzof@tbo7
z>Ih#1<6X*6jD7eFJkn1OSpj|Rg}fdI*;aN+XQcZLzFWMNzHYT6-2wl5y~~zv*Om>3
zpXo$3c(o9AxId0R`3(JX>|64=$$!cuvky{wj|Hat>NZ@6dTGZCzE2#h(&vnMTc7WO
z@JAyuHU6$*oo7V6Y(-=E@?iFduoWyKIBYO!n5NZy2AsOr0{#Sh?#s8#F=*Po?dwb$
zq~~=e*9Viw2Gq^z&Qkr$N$8vUiWT-;SIOY4-~g;Olz2x(vf!_kG<!P7l$m*up(=cF
z+l+dL6d5#bpJF~&o6qHjKJFgJ^k8NwZ0{jk0Glx1L)X&&?#?mFrSCJ-hnVT6?6}<Y
zKei_u=_gN|sxQ4ZH03YmTEnxZ{y(|Pgd@$U@7XuZa;BX>WUiTR+W#k4n(vpIaAcY9
z=b7oV5^c|Ghr!2wXpkLt!V$x+nDRF4)$71VVc7lB&Lj_c#gs$LgZqmK?{^~Ys3G&G
zY&GA{gME6D=U4g>^Lb`M{z<6I#xkg9zImTQ-Dm#(@xzD2cKDe+X4zuH)|G3Hgr|wR
zopwy34P)SW`BDSVMZaYp;(CUBlg)fH<8?7_AN9q|e0O|9zC1IZ+5fuVv|+YGpQmdJ
zq<$YwJC^fl*cK}EehzUCHD(F;=h9#&IB7e>htvRl{e9}R!ZzgyY%9pa?sD^aUt}oo
z>Jkd(_o*Wv$6Pmm>{IGV*f3isJ{9a=i242}JFvc67Ao<Up{{8opP_CPsl(gknn_vs
zS=i86zbMr|i<otio})3Qr3|7^fN~2y%rwX;H46A4lbp0;A&*Y8VJT<Pm+;qoc7v>I
zy?&VeP_a7&>tC0fYYYoBU^l%V-h;ed&|w)k7eGKRI_2;FBY!E^MeLNdm1r05`{SL3
zb_RZ5fZvyJe&CK^PM}EraUtdm7vZumz}x|Pub;suRT;i}Q?8>;F!BizCNGs|rW648
z_F0SQ$FI63w5W@^_bns;KYc>J@>Qo4a1Moht6N@y&-4|_f$m)<oyE7Ivu9Daw3$xF
zyDj_STZFE*8@N|Aq!hF+hE4n{ojx=x@x;8;YVxh=<6m%;e8~PF{Y{;4M*16Nho&36
zx8NmXZ0nm~Ln|i#b%D>Mp9bSP6a1A{h;=E_w+Z$PWL_$Mm*EcES6qU-!{vle5VkLE
zUED#7&l(MSRc=Ta!zV~z^!<fiQTevX2Lnp=Pp&a}3iBVziOSgtW!9Kwl90Zb@1NX2
zzk6j(LY_{!J|ksAWf1!L0_Nj7jBim2=IWLC33=xx<h{*oZwUL8HVgWcvZ9T;33|XB
zPhzd4*|VZjtr}{saXk|;^)UI{pm~C?#h|g%YS8$Za`a86lq+Y<JJgij&tx+%>x|15
z$f6z}j@fsuM!oan^FPf@FEi8Q^S|l@xZg70LDouNkC$t;?C(f+bSLFH{WhF8#eJse
zcbjKD=Zivx-u3aloKqD;cRyPO`JjKq`3vB60N$_o2tc1nUh&VL80%@uB-dT~v)~s2
zyDzo5K#T%U6>&|1^AuP1Wk-U=Wg~)DL)RL<SZBT`IgIyVSIH%ruI!5sH{XdhJEXZv
z22DcwEIf|_FA0|idI+{Ap3~ztfx%DWBl^Su!*o73)rrx7e`iZK;75LpBhnx&>&zas
z8tnvFFX~KUTX?_x4DT)G`-U^TSIqZQ&+uND@4ctqXR5A}jJ0O_@$y+`cponheJIyD
z<=SGYzAI=x*G7_rJu+6LLT5OF-rFGGi+6-#Wgf)EI538tO-sm+M*Ir-fp#Kzpo{!q
z`fneVW4}<Y6Q)AX*eM4n7d#O~>L9IcSip@s+#b%)u`c)6rw&g9{?9S+onrhz2Bvcj
z6YKEgn@ptVK#z>>)kmB^IH5DranI!XAj+kM)_)iPKa_<Qg3lIWUUBEd0LzA6Lo7kt
zrw;lByy6-9`!bFE2X6}&lsMQH>dFLf&S1TSspT#K{^9xqVvizvHT77SV+^>NvN9FA
z%1*y2$6exhLz_-HhN_(ATJ2Nx%gM4m<FitnvAoeA`rJ5;(I2DCaTNDWI^*xmJ~)g%
zm*bLSF?uMvleX2!XE8Q0#z;rRoP^!G2dxHvS)s<mq-|DI$M{4Zj!D4R=Xf+^+WS2F
z=Pmde)7V}jpJ-EW+o4qz?_he59so_ao=0BD3n$l;2Q>J5rG9`N65c4JO{-Qpi`3X)
zPpIR=0OLIjS@ZN!z&Ost*9o}J=$qy{=+JTOkCr`%JL;n^;A<@+Y`A+RjL_Mf%K#UT
z+TomxxCX>!P236k)zg>a${sA&ydzliAU=!x3rBhJ&0~Or3K~Yi=c9pFk$X3MELiK*
zFvn<#uXpa1{*=sS@W}HDd`b1f4?oCs_g>7`cYPMX+Rb$637cn*@KOe14)9`5l3drx
ziQEal#uMm^_0&^hU-0VEK;&veexiSlz!&6ex>tzVV}wH5AZ>ND8*2j?OYB4Rr^a}r
zF&@N-wK=D{f8v~sdhGE&#{0?OOTn>X(D|v^@)=`pYD`SmVq&x}_D-EweEJgTFMX<9
zM?gEBVfa=Ui-Y`Sp}!y|NK9A}uNUuEq92MlJ|Yp*{|LH7K@&N*Jkz@LWO;_uDDo|J
ziNwj!8<`1uBMto^LQkai=ndJIrVQe5$SX%MbK+AtPf7_EQ)W5Kns0&M2y!e~Jn^Y!
z_|?F#slgK1t5<u=ny)hC7vEFPX)*Bc(yJZ8D~oq%Td#AdclXFO>3asx<}jWrG6ww(
z+m!Q7!b<xZJdtJc`DpStXxtEL{E%@VPUZ*f4%w%RAXke;I)5XNFSPY~=E*Vhq?vir
zk;fU&-?CMtHEo5A>o3>&M$;~qatG}~-kfF|w_r`MWrav@IwatK(U(Gg<TPR2H$fI)
z-5qfgk1v+GEEIjKaJ{~oV-oYo95wbdF2q}jd6g053nPCR<xodnk6efBPQc&J^?4J2
zhaA`7e~xqd6@gpz$b}L|$mP@UPX&Aqz?o^pmQilY_i@})i7(!BO*4~n)x`BHvX!`b
z#V_AXz-N0ed|*G!Z3Yg3xIFT0P096jct%i1P00>3CMA<T6vFR|g)f(K32TkP%wYj-
z&-DSwhM0EJ4L+Y#NqFGbZ>V^$-+Ib<u7Oe3$KgX9EPdBb<Q@H;+Cw|CJ+xb)_gn83
z6(6&`(2C>FNm@{rGOn_hjxpOh+=CnX&BV=Nu7^NZz)uAH;y4jMvkkdU#CFWOZCcH-
z=YUs_Z~ME}5BRSE+>QjA_1JhOt-y~J;ycmmw7$9hwQt`yw*yaOjsI-v<rTNf`S{o4
zb9;~O%lCZBIkruE#?XJz4XN78avnaJ_K>#gdTHB`_sEZCU!`O0wD}f>FZZn|$_lM3
z4OFcYN=400_g6fTlFPV2cbBMUI&G$ZKtws@M+5BC82QmF%3s1YkI%SwgrZVz?}AR5
zRnge5?m;i+<Mm=R-ZyA9mpLR~5k~SA;5(BYgR<)}j<#|AkoE>-{TAPfgWXu;QbOyz
zJp0cdUL<0)b;9exvo|AN^B$a`*YI8-w1R8JSD3z!*^P!hbVb<EJ+mK;!|-kFp?Kd(
z+JZ+l-A$Rp_>9S>otTArG<*y)MmrOAJLn@KKNCl;*La0*E@H|nur9un?-Soqk9^BE
zhI~UC&cDBnlP{TV*cQAeeYRhL^;@*DU2B9a!@4PWF%7gDt@#H(3SLa74vXt9>Nfbk
zT8Be-a?J&Cv(lHC-T*mJ<!pe>6wsDj;n1Sa5z+mK{p=7{u5n@Qk+JZZp~f_iN7^gO
ztiorMhS?#JKKx0chx$+QfLEk{20XCc=<_FM(yj&Vzm>mXc-UwI_e;=+0nb8xD(yBY
z>pQMkt;Vic3;t_o8uSx<(^sr?cfxMLTDx0!Hh@P3{3>E(1NhdkE4pS56<K@+>~Af`
zyHLX@X;<L41%534?ux<(hP5fsLTQiQ1)B^$E&N^?g-vh9Beq6gfgY23PKg1hthlcA
zim;3J9CavlX<@yh5ntF%k`KeLzz%><jdKs!Sn1T`Em%iuslt2-^Q#ujucGL$DEbLw
z((r?!k5+9IV%2-nkCKWxm>uhG4)~JO;4|SIU#{_zMi>K4u+`%0V{0PM0+(4*A1{rB
zU<<wid*n&1&F_J4W|0`xI1qi=VD@E0nc0_E(|bmYo;^^c@m<J<bo3?cz0}~$ssQ~R
zXlFV2h4GR?#U1P8+rrofMmd3cz2V=WT^Was^@f4MKC(fkd&2jj{iyt%6a5f0q0SvL
zmi0~2R&qT-pUjvc+~qnE?rY3B_gkUmA2Pj@FyOwDeomD0hu)Pwdo8q<@4KgJ|HgW{
zedIO3H8;_YG5o%wnsQg#F6JDCwwqVf1x;JLns}ivte`LbXG!QUxkrVzS<6P@cwwWs
z1UyAMJ<YV!{iaQR#QlNrH(`vR-_JO2F<{fX0GnZB(vAczklr>2yfcS#YX@R#VUzJJ
zRK!&}cpfUpa&XXC&NtG7xuuM?bq0SrF~ISxoj~j@c!gsf^PoJ)w<50yt}t*?vVez`
z^90}|B8Uy0vr*zV1HZk%$@a{9@Np)Ii@}GE7oy^l7RXlcrXO^uZFx^rquf;dX3WrB
zl$nIIX-I3rZxwoGGJZGU_c%!-*iU%Y@JxSS7<V7;vrL-JHEGrwry1rpt(@D00ee00
zr_8Pg4G`yQM{J+tD`TRU{fqi1xplkvPB1Of11`W1o`N4&#&m0O+eF%hn6HASnbh5g
zC2$&gY*;FJ$QKhoA|Dy@?Ux-G(@x@4xL!=+Iz0B~L^)>+FN`*X*GFSvEjr69{^<sc
zQKzp;{KzYQdIQQ>As?KO3u?GV*jQ(HZFE+-4fl6Zt~(k-9-mj-@?*r}EC!9FeN0$M
zr@rRAaa{(u9fUayxq>-&maO|dk>l$?-BmIU^hbz21sr2!{7t-0>dQo(2s-rm_fXE6
zhdoPbl^_0_M>Y_4?QYEJUlDo0E0t|{#SMo5r_@`$>!geTFH#1l#^V@#zdqRQx>`S4
zo}E&FIr0Gcexbe(`aS0Bxaodvb1CD0l;G86qqIL_kHk&G1C2)feJAT1w+QrvUE(T6
z9VMva2{B;&LOC}y%TElrJe(hTM`>G21HmhY2U_<V^T4kwPrF>UzYj6Uo8|aav>Md0
zu{5AnQD%(um@*G>F2=mEHyp4x4))a3XC0+S{yrE=SDG+jO-%@Y)fwT~_YH7Nj`I!e
zEb>l*eKopNKbk?i1mi!AeM@}FC*(o$icB+~y`t2xgVyQW`pWw??Wm>t5o!ORophtD
zffL(_^X2Jnl`NI^&^mp~neu;4d+^sDDJH+gZ7%LBWIg1~MEux><jZyX_P*YmZG`DV
znzI<b8U?Z8dxciN1Ue%kYH9aJkBZ523gP>i0KeoO(KII_%Cs4XalPA!TbZ*#OyXJ;
z&(DSqm<;*v*PfE{znXRp<iFH!EtO(gXy$vIzXpP7V*||**mvEC1Avbz_z$IlX857z
zD3I|Ph|RCWp1{Roh8e%y#JzPPoLLPYi;R_FJ!sPs_pd%sqw6CZu|D}I<4=;RA$ywW
z17sQIML9e2_rz>Gu+_{DKLE#cXu)CF3zkg}AeM>s$h7&LOj|YlX`xrFy1C%?%To$u
z`l2;VZyi1d>Ca&w$DhpfmL{f$EB>!n3#k9=suu*x_apxEZp<xy_&W6a(IMK;x!=Yz
zS;A++2DlhkEn@^K)+EI30tfBE9=zpy6Yu;u-oqDR@4-WiiM41EMKsW6!M>^!BU|We
zv)1An@k+`^;XfPu?!r$a9;#|sdieM8{ZQeKx{WW$bH(Y;L|jQD&N2s#DJLSMg{XV)
zW%|#ihPuBDU{BR#H*96_z+}WQ`62sjfyWHk8P!eyDke8Y&^OkNl&M<NV$c-z!F~&)
zKONXhVFwSTd6ip^H~oxjYP$Zr0+IH+JH=&gq3hVskzN3sxFC$n4_{!r5V<dAdUEGx
zPRo5bb31I7wXj`N3Kyl!ty}V&Kxo;Afx4OnrcW@mH{Rb3@L7SLjH|FWtQQx@=@fzC
z=f6i-9?X(+N*jJFEW^Cy6P806hx;-8NMbo{_s+8LaiedT-?urXp!T3p;`y1kus-QX
z-huF`I4Ho0*e}M39SON#4}`yjztfEvzYoMeU~O~X$S3r}h3oZQ@p@QCWROTlEP%5I
zx5g!L+>(hmY*{B@<=k}!b$R(Ft{)FG*SYHUvY$%zjWxL#hZyHE_GyIU3-Tv|@fE??
zqF=Kf<EtLys~+RI9%HN?W4RvV9`?&5*e;W!7`w1ts$siKjbgmQp09<jo&lSm^HL46
zB}};)itYq|ooE9*P38ZdQb3r3TOSUDs=@15z8;Ws>c`&;)Y+n#PY*j`*cx>%@ShF5
zXJvlyB<5?G&hY1;{SSoG%=3Nd1NeX+?tpCxKD2t~z+Vg*X2n{TZNZ&#Pte8Sxw%+B
z64GwNJn4n?(zdm`ke*=QPD-%V7^@>%{wQPBE$EwB)cZV7pJOVNvM~_)7w}ZplYzS8
z7VIDO?hozwEYMUZQgad4;jR<uZUH`kpTJGt#P3|ceiCiXKwMxt+MVVSdN=Z5-ChyF
zerc+9Kx_{^?)7-uAa{N!{o>+b8}xZUvE7x;z2~{u*Xvb-{c|1717LsQdj%Xz^!Em{
zHwK!Hi}YsjEqN)luw8iClwFh~BU`~wKNQwE{cwSAz)M{t5Ce%gzuMe?(T~)vUtUID
zz5PWa_S}@44&qt2>^A}KXYCmm$QPHB95eAe@%Jvqy)?FZ3fJjc?Np(FM;*YGF@-t4
zK)(Xuj5Qp_H|X}^Er>Z^f3li=Ec+MzjJ}`7em46!)97RETF8$E$dAb?=m=Q->VIN9
z-UYh_eBHEH*yK1MyzfK)V80a7QgNSwyB+sx+#T#M$d{>*Eor!GxTjOzK!;`Gw=?o{
zd54eXv)c@rX2~NDfG5!Z%3A8R@FNBfG!7Ma5qH8;u`HzkvdR|fw=qz6^^*b0KCg1q
z2JnFeb0mCI;v~kq=PTnK<G}%6Rcc)4sJn$z?MB?GZ6j>1AJ#<vA#P`%@KZm;X^eO@
z_E$Cg0W_#(c~}37bfh)qmk2v->Z_<9T-fJZULr1S9*TJl^8sG9Q}pNpIcNIS7t6Ue
zQSrpVZmdr<X;l*(Dr_s_?5pax9{Ot)esd4cTw`o}5#Sn<E88i3Y)>XBWvbr_dFx^9
zf>P1HU!4|%?N~hw^E{>(_OIw?@KtL!=JC*7QWgSMDaR0#8kg&F{P>>l$P*lA81rUa
z=r6LdmXyjq01bM>F$p}?+6y)x(qgO!eAQ|2(xdw$<%0UO6*0eagJWPv+z#1r1LsEF
znV`9pHIWL$)>LKAh|8zClxQIMhlc~@2U7|tGtIi@1D;K0{a!O|Cel`!X>DfOgGg)3
zZKpgw(Fz)*kYDS1WcH)CAr0@2Z{b*pkCUo2q4+TeF~-Z6r_ZAc2Fm%d+b``dryH~f
zAIo?s*kd_!>kR!3988%X__!jNQsC}_F9TN#bg%ya_LIMlz5#DB?t}VQJLu*dgnQ}`
zbBCCzXN8WvIot=n4gMnC{h0i{hWN2<)PE3doAd}Yo<$qF(Z<o|&(ua3_^4<Ddc|0W
zi1ZyZ1^+@5&hm+`3r~xF7^ThW(cZc~fVwSn7Q;T=fc*<c-2vE}<ARsMw~&Fe8(>4i
z)|?dlF?<U+zkxm#(8UisvRbZp;v5Gvj$EEQu_PkumQ;#*_zyj(7h^(cz+FIw(;u{5
zL!W?lVjki*a=Va@n4sIgFlY|BZ!3Jp(usC$q&aCET7vap(j9A#A?Uu))W2~427k_x
zg%S9>Mh-P-&vA$SD4Uw|VP8T2sO{KOiuy5+hHvJIkHZ1-?#l~9NgJWlU!F&~0NTxf
zuJ%x$Lths`Uwfgi$3b7qb1R^)CxNb$p|ATqvqBBi7mgU|cKF7A3D}^=O7#zB!!JgA
zG&Qe1MG$^}hYol@o~Z?xt{h>kXn3zctmxCL^6wO#uB${ARFcx1hWb!vGv(wK=*hj9
zUw5U5<_x*FWgz-175pgBSN2fxp91JF2g--hUumFOI(QmuejmSN`mWZ1eiryz(02E%
zzF|GI*ML>=pAPFs@0hT9^Y5(dio-^@2^-;#6p8@go=VsNqZR2+_6zQrgq^UmO~MNL
z2*Rpv#ykYD5(mOd98iBJU`{5?o_f8^4Lu5YC!Yaco+SVpidDVf%{Jf_t-x8y>lU37
zRu%LFte_)(umRW2*wdR~z}G|DLK&|kB)sinpoDibXbN~GtpP9LB)p_`ss7QA4V|D*
zii{Pr;Aavzqk(%fW<iH#j>Nns_j8W_lQ{-1CmT3FrvK5L7jCCq0GyNyCjd`c6UMM1
z17}P(*T9>oTQGLAOue$!;BUmgL`0e)H?MS<WnAFn(cwzORT%SP=>yJpBBlXps2_ey
zdj;;8A9xkq?Rnv_$ZN;F^RUS4vWt8X7Rb+-aq!BQ?-+hrWfbe=nB@F7GEDUNH6f=L
zeie>~pYIzEg?q1h!2!PPfg>dHIss3Y0yw$}M>yYel5pH+`iEP;29EDTcR|OU*2aAX
zu41Us#;3s5VzxnCKb375xPI}m*+%A>+c^F_+HlYhLcQ5soCe!Re=FZZSbLuR`5w|R
z{@lF<^qPz{{MzOs*kajY2G59~jn6CYgJ{_x_sq+^M)XIcjEKS)8`^rfEVTR5TC9)L
zrl{sRhwSs%bsokqK@Y+PRP9FpKjbRae>ab7>4<Zh3Y{$~c4L3c)=#;%=WrF^Y&MS(
zV~m(F#x}|Qc$jzetnbQv==(^2V{HQS5*yzm-oW0>{lCSC*(^qz=rh6}-6MUYOV0ui
z#vM)l3LY`Y1o#h5;qu`0QvLa@CNBQ(j0@r`U_<M~gJS}CI3+$~G3HLkVdYuiz`p1U
z2jA)aQM&>-B%3%ehU~2S!&MBr16JrRd#S!!`cGL8<gnrA1zzxPo&a6~HmgYNOS5lU
zO}x6G6VjVtySGH(pF_Ng<gxcK?^_I8|Io2A@L*a<2d_z8jWZMyc@5`hs4->I>G(ac
zwNzhqC3QOZZA&B%`03!cLti*tV+>v+OwC9KUwv)-2JwupfNy^*&h5cj48$4o1~|VE
zG1s-rr0$0f#oGJZ#@_cI;@k)w=W9Xcq5jC^Q@(H40MO)W$=_+s>5?v7JF}zD<+vlP
zq+t*3P!?l(a`c3}7xmB#G?6p|?GneOq}i#lnFM~Ab{f4nHe<?E&@1T_Pu~yw_qn4c
zKeYGahs^l+gg-#Wb|j3^H1umv+%9O8iWtOH>T_cq>~~vvM|}C4u*0Ym?P?hB00ZXv
zLDGh}vOSIgjD<AdeGIWTqPf3*g6)~SbE=I!k`B|(VodbwdrT-{(4gNb8cd&8s{i&A
zlLlPF_%3529cK=u!e3@boSp+?BMs*dr4t976}AERI?i&8#N$A^I0pLc??TvN=<k+F
z%s(NIIfj5kKk@<a4)oFYoVO(4J#AsBzVf(<_glU2KGpYVN6M)?!Lw*f%4oF3K4QNm
z@&U$7I>(C~H=silbl|vw9V()Dhq3tvZHRDVbS>9OdG-zW^=OMSc1Rl)v6WtN<D1A2
z|H3M{hIAU;084y)NLWB$j-kF_F=dT<7W@L6rY{+)tODIEr}*VQoV)a!4JO?V_oCak
z(rH|4%g336kvpTiDs5dGFm`P4YvEiJ_|!e(s`8S*c5C-yK2qgT^Q!bwYSpMR%)@Vp
z6hwFBdm0+Fdj<z8OBx!3S>3gWBYsK^D@$R=S^;NLu!Q@$F0T!G%gS)}$wl-nrPqjL
zwMt0?ZEujgh<51{V!ulI!bZe;R5$kZo<M9K;;*B-;B)wjE;eb3xttNB^et?JGtqSI
z=`_9f;!^$B(@mPvCv)~=5Hy6089*7N`Y*!XmQlBThjACTgAacT+$dxF(7DPc_QNTD
zskxz4U(x(`;Z_XU(ulDq$I?ZRDI*{GJ8<iwjF2*g<97-A8Fn3YG4)C4-5&dneb<K$
zv1Fd!cT>wt_2ti-_%$T<U0i>}^#))*W2`~+UHE+S<^CI~L%ia^3e*10V>!782k$vI
zk@6^CSSf!HS1siDPt-?yq^^k3E|vRXs?;vS9=&IU<agL#aXCU64Lv)xN56gpZ763G
z?BCOE5~*V?y=<;~(EtAu@BcIFSk&7iX90t03!g4u^Pyj`uN<^8<nThqi@k5`S;Lv1
z(hn4S4>I&0Ge|Q7S5wEL{y5G(`n8w*HpllgN$-5<blB#Uug!NDz9_;(7+GGea!LBf
z<-bASyS+VhMBRPrEz*yA3w3-09jn1-33G`lAD8OOicLN{@{N3E(z8$9uob*U`_3Fw
zq#JY=Xu1Ce(?8LPF(KEfA(sXrrjkBntnUb}FK}FFob!6tBVM5nb0W~(SWA0jp`<zN
z-=-SF{v|D`&*FMY(l3GTkPT}R>+p&VSN5(0{JGZbo3zvOF8ZX8yiH%_`|9UqzOV3o
z_s;*u{^~XNtIjXgm(Dl(OIgnL<8!}0<-&LBulHse{iT$#zY_Xsr`b=_WIrv^+ex=l
z{f$G22~@PHTmx3h<k?alo_Beyj%Qf#OiK7kk7Se}UI}|hv8QMh%V{eLcW5!hQgj?F
zE7f10*$2%%%;y#D8D8;9<Ww8t$aiVOE7}HqwT<pwMjNkWB-9`KZuPJ4gU7lxgU7n7
zzsf)V^xzrz#|vMD6a3j~+`G4#&sk?-BVdiUFFk76gz=wpN{?1z{QoLG{{No&w}W$!
zg!wmRtf5;oPV*t0&HVcewt!_ja7eHPDzW~tc%~`C{vI4~Hr#1G1j8pn`{2JHhn=V6
z;D`O&9=Cu0Ps8C1_NJu^I3(EccP%c}pFR2C(+{Wd(*KM7U>$vWKiv5)aB!J8?D_`z
z+UK4*_yDb(d(dVsFNq-@4Z#8njq`NXs@$E1PQR1;5aFBnip{i=K1E}HYm%Mk@PzL*
zV|v%?ot%HFvD{<Osqe77saI*sIWW&S2LH6NcLx3<`0oVd2F~+?k7Ow5iSgKrk4MpV
zAq;W95@b$JPs}XlrHr$sZH763LSGWkaHowCKdX=PXxg}5G1X<-m8-b^fiq7Qx;J9I
zUHU5~X21rfzhV>jD;WL?|Hq^;?M}*#(AK17h3jZ582c`7^dQFdF7I=gzfpG_4h}7T
zj{7ljZt_RmE2y@?r;j;q=zaLBG~x7$_nH|)%QYUzf)#9+HbRs*(6#~&ec3F`!##1d
zdAX*^e6%@w$^qB7E#?)UdsV-*YnPjHcsuaVf;~1GG?4pS<NjRGC^NyQdj`Lem9jWN
zj!mvC)!WvYytnBac<+qoeZdAxC7;N7O)PIa{RUofqS%N75i_)_2Fg8<PcMV71N4%%
zd`BMUuGF>rE{49hgD#^PTY+_S5zO))BMpPLZpN@+@03TCemCS}|C#=`ER)A_z+-Yf
z!nCctXW(;>LBlUQTlQM>niOkM%VO(jt}n*@m2);&)9A09v)7tVe`Skeb;1W}Y00qS
zoLMW*nYH4aS?j2l4OSJpuHiJ_jPzq#kDV@`ehUA`f;$X9rqUJ3KZ73=>0!WAkM@ao
zJ=%|=?I_xfqTMLkjiTKs;Ekf~DBxE!tRCqn$GSb}ZzJtP!(I<W5Al4U|GdG7S5vg;
z4=|th3tRn8p?XDGf9)3>7fKWTc<?nK?_DptBUWqZ(3b&sC)P^AZ;j{!_7n2t(C!*J
z0PCL5h^4@}-7Bi8Gm_{h#d%QN=VMy{8~N!Ih;2C}$Ihm3rImAd){k=&7OmiVnkOO-
zqVE*OH#H*&$18q6ljFDP7jpe}4eF#_?n53+q|lnmJdN<PvVGWiIL}pnXTd)EYGXet
z^6rD3H<@E~KH!5KIVkyfy&fZv%=u5mo1>11iap^K!hS<BVgtj751&L{vlg*0B&|Vn
z%A}TTAxL-3k;J#9J=<wU{b+kt^dw>E&Ow}549~Nq?UngDVkY8q)=5X%=4tX5ZJ~^e
zxp6xY-&&P##zstn|689N$*`t276b7o#7N*<8wRa#Rx*4d^F9u5u*xyV^E}m9{z0Bo
zVaWL(XB+uezr(Wxy<*O7q%moYvpkLvhH%81N}T1~1~3p-w0+npKWRMH5oe%X#cVgr
ztgn&fP@ls3h%^0ukRQLr?=0}3rMVFBW(y1Rqu)lNZy5Kn1@e6r#~x&t7d|t5Q=%Xh
zYn`LD`NO0vm_u2HbC+8boaN24y}4eFeV>qV;~?vNhz(F%Dn%Y-ToLvQHyg5DSu4k1
zJM~k3wc2rA4&Dt)NUK#l3PzKUk*+XZu4~2eHKw^eJU8W&L#Of=6d`|^k^hr7DYM+K
z2&a3G$b9-{tcRi<LvH2AD7Orq^X_an#!HWUyBq7xh$B!t^5-VxsbN{Hj|$^mfnSBL
z#Csd-XwDEkw*dY0ZehHhr`|`Lo~);!I-#BnqaK_wj&kPvfLWIv_1Hl_8)%gZTH)M*
zU7tMAsN*a?x%b|ywf)h-v&s#9vS}XVt*@SRr>+9s5j)6zQY!RN9(0lia<>RN$_rgI
z4)V2(vL^3Q>|0_TRfh$~cd5Q<{CBFyPkt*f*OtrQ{VsLjY#r;k^*!sHU0jQ&ZNR-X
zP0+FG=E7056EH4P!%H#udlqp}VUC|K=7(QFY!UMFnd1g|AsfGlV0|_<jJ^o3r+gZ9
z5^!ZwPfHpl_@(}iwui*qj&?&no@(EN_7&OwV(<m_5~6*%zVdC_*H#P<Nc;&Sa3TH@
zU*JQU5P!A>pFZ$9-WUF8|9Awrr-s?Sw4p|x5&yWoMjj@O>2GXW3>yG^-URwdo_rR4
zP$lqvpW<r51D#Y!dUD->^lUj4Z3A!htP2^sxw|unc=nb`C1(uch?*3o$o*J!*PO+Q
zgE2!9?4_TxS4j{4U~GVTp+!+}2E3AK>{U{-7(?E&SIOgE*f|l!&V9&pHYjN=5d~+%
zD>xfoQJW)5YWOjppPgg{{3#W_@Z}YkdPeZO8I<Slc3hp1(+Xl4=e`h71?-W#ydxkB
z8C#?UAMuWO@D|8M>}$jGwDMa%@5WhGh%2$QsbTIx#Nl3xEN$uC@U6iYH56x=)Xf|o
z(6->L^A6aH4gclPo+wkb<*pHo4{cg2c&?(-lp?H6>4=4#j5x@2>}R?e>-H&_&)yBc
zohBM!i&|le21Z;C_~t_{9mn^I=2&8+IoqO5Nxp#$lk&wYc7AfrLcsXX7LUwxGBHmv
z<wh8J-asq~&f*fCQr@)-1vc6-<~Qp?%qe6Y>PFth?7K*Dv<c_SMI%|!*4uYjvp^Rs
zZGP&0R}JQ7HLx!m!EY<@fwmvobGdF?exE(pSA{EvtHYkFeVOYBeffnW_}EVz+G9Ac
zc)=A8b*o6xUcTBf=MQ2ozoi3zE;iNU8jGt)%$>7e%muw2zRfr<^bpRleC#?$%gbVJ
z)4^zK{c)TvHb+@gF}Pn{#h`=Th-0-II<0t?jOn`Sbs0Cs^C}D-=Tmq_hV1LM;x&kq
z7sQcclYN3Xc^hKwaNZ~8H$!zZ272Nfp@op8Z8(<%^%wrLk|lLKV#ZYL$q$)r81+wF
zjBlwFu|2dCKFfBdupQ{mx5D862>4anDd6XNjDuhVvEbn8dW?f8_&*B%j}|Jh5f#{o
z3T#9LHlhL>QGt!9NE;D+*`4QCAg@nOGk7%0-+uOadA9h`ysN|s+2^!ZI*M!A=jiW8
z5hK|p(|dRee1oxp_mCqyaOT0uO{c#H@11&&Sj&^)IE~`;0j<gm8chhoHgK}P*l+PZ
zOYASTs@U}RPq>ZoWv2b^fgQfmkPp^Pln=1uS4Usw{uXPKHg}j@Glh-5MvdK=C+BF;
zm$2cN!ggP!y#xDVuXU~V%J9IP3~Ovop|xR7rFGVv#n!p7|65`Ex54gjhrPetEB-nY
zb5PjJ{o17cfO=3Tbn9QI8+LSxIz~Y66bRLwR^X@npzP#cislTf4Oc2IJK#e6jWrE4
zn`h3S(=l&O#n|~C=IM6KKe&ehF?g`)F!t0s$W82bRy)R?P&dGq?h=lI&g7_9ygelH
zqbTFH5GRs+u)v9NiuQ7^EuE3qF06H#Phy-NdQf{<!kmfkb=9*zw~O}C@K^}_%e@+2
zaqyGe7xQc7yU&C(ccRFwTZ;Jdj^V9!RSQtZ!8hxQS^{-fKH1aXhF$d5LYCn>wWD-p
zys!B#7vsq*-U{YB#TfEcW%e(`ysNBo54Dm1W<!=pd+e=p<{`aUAM#Zjc}&~N$aAfk
z$71I3lP}GD?It`IK(BG0;p9FFoD*{h?aMr&WW<2K|1#T@bI#@r%#kuUFa6UyOFn}?
z0qt`h&w2gR?^`EJTqWQC>7~f^m}d&nkMq&;f%taO)!t*l60FhUdvmUz;=3JqPgxi~
z6m2CAQvNT*UfJv$9W5V#2O3ooEcuB8vf?oI#6$^y_~B?9XtqZEi<s*>02vlF^dsOY
z4!1<xn1^zd^{LguSy^&S;H(tzK<O3}588O(C+LF=tSc3g-haBl<Olf6k|!60+22CR
zom;w#d{Gx$g1AsW#_EAPun!A-oSa$ULI2HM5+E<+PAKidy3>C4eceqh^4m{%ej7AY
zau<Lv9ut|B*?z(OP^2e#aTMtZJ{?sTU4s5|l4nPI#ed8sJ&6NoIf?IB2D+%4eTMf_
zPVud^8aNJO-c$8pUTEY`Y=iY)!+LW8&r?@f%UCbV5l<ukxK!4kJ9ixXLI0ufOd#Tn
za|w0eQDe*#tQv78&hTL!m$(vt$z%Huv3}G&E;l4HbH~8OMg2zI1~1kP<CuE0gZ&c6
z5&Y_9yR`F}*US@<ds5&ZqJ6HmTf`XD<rS}GxYrf!tlR&xgpG41!0{m4r*8_pYr*q6
zW4@lWkG>$ni?s1<5A9l5585nJpN5Zz{lK<=4jW+IP2hny`zO?u#JWwqixTQma=S2R
zM}3^rJoUcS1O1js9UrfcFnh)Jb<D$b<jEr~#&kg*b&Q+DHkrq*kE=$$d8D<p5hShm
zoiyTu06*pj2K@VG^Ec^j)V(i=xu+d+8)pH*2Z^!eer#NfV~c(;jxX{o#~9+P;g{RD
zg7wh0q~8tC`8|9p`)=Pg@wprES7YOv0B0NWeINcGd*t?L6WgGDk~n^`_Gw4lcvB<~
zV;t{Kdxx}0ZXfALgU?`7J@kdt#f8>}dgzRL=$m@zje6(}_zv3OH)w~?W@!|<13sIT
z@Y$?_&t^4zHfy5LIq=zZavsGts29~LH{z{&!GL#$e)PTu{WuG9rk-Qgm3^HD<8?-O
zYw}9cDSRk-6=h+hfAVVZ5YBr_Ub8qmd2Q2%Q|B;2MmV0&5NYsL-eKqj#ZH|-9YCGn
z{tP^SJ?5Gm9~l4C35Fd1uQ%DZbsdlk?@JkaiNWLlzR=`Jg}ecttd%^_k>5`KF!MYL
zp0&$#Q(lnA<XFd8!aJuSGyeTH*#_E;>k+fOD^Wf}o=l^RCVXteEB<|uDW6jiBkVWm
z=r#Am-vXNiXFC|<<`Tf?ljHf6JTmKe<88$LE;q`Sn%^wD1@R9jKQhw}8hvm}A<}kI
zriKoHuX|)F=D(fdd!_ncv*T&VV?mmO`H+4wV3Yg()T(h#qpq8eqAuwdLRy}gwijsu
zj&IiEUN>$v>Pa!q*x9=xK7Kg{+)FUtH*y}e_Xf!46wd#9%Vdr-yhGeGW%4$B^UEn^
z7U-ao4t#I;4aTiCXu0hTj+L+QAkw7m=O>TeWb)(9h<`Y-&7jY?sV4jxNLz#XU^{Iy
zEqh>K&SEh-7xZdUMD?5vICmHOiQ(VL(|!+s4wfa%Z?_f6Z?_e~ALN1kR4K-}f07@A
zAEe9;y$C;#kN9HlI*DuYm}5?+UHH@r%*8<q!cJU*SCt0bowP-_B~z|Q*@g6{H*-H|
z{#;2{l&Ab)8TYyZ=>ON>NsyN)+f``DOW43+!(KY&PujCJAr1bdahq7yEA~9kboLMO
z8vdkbxhAk@K4E~2&3tMZ#sJqII6ok~at`(S9efY?Qsp}nF7uuA|KOcX_7!yl=W?gY
zX7ud$#dwnTG<eM==!bcpXH!+zgZ5HBf$sI7c@*@9U#AFu9d8sghF_-)ejOit3X?GR
zo(#W^pYq7))3`sT2>w5P_1uilJK3j@KhYM&=G0oTF0<G+THADefNL?@e)#J$Y?&>U
zwjAv*^x4@)1=Gg{S~l2J?hS9*YlDy7R@72x%Zg^lrg_EgcMLjPmM72@cImhycvs0Z
z$nX=A=RsraR|Y+I7aR1lrMmCJ*^cd?c@gN@F`hQDl{&~P{@CBlBk3m7Wu5}R@qTOE
z#}`&(?ip%F^$epAw;VO$V7jJu{M7XQZFx5#eU{qsW7F2$^4h8N@eZ}4BG0Vnw+ZR+
zca$A7)8{3m=cpaGeq^QxnNI#yW9bf@>2U3s&g3xtv+mvFC&Sl0TE3StNbb32nc^0l
z*Fpb2eY$G9Rd5~3E7rcoGlG~0bK`BY9P`LI%71M&bh6^(7*gSr_ljb9_Np328S*aX
z7O)K)<vLm$&ItsMa?XmlquX4Vzl3mh7sr>o?cO~4PGx)yXik5HG5&8{msl5li>Obo
z%X!-L?Sw~NjQLA!yvM*}*P{~e2+|hQe%)0=o51wV`xu|Zd|~iSlsre@BzP=J9s-|5
z!DCVIU=%zS1%Ig-HaWkQc%vNJQH`~}KMaB%Sj&27x6z(py|O;k`>pEqqmN*hKvr)z
za4p37=NxN#wJ~1Ysb)IPznAIb=4O1^#W9oDnOrZ&4cBw9Mu>T*oqk5lQyuhc^9)Dn
ziw;|{cWAr^b3??>W3A^9$I1TVMt@+924%cr{A;cZ$OO>RkT>JKJX6hVJO32!V>QUK
zw~aM7g?_er%D-@9lHI*-{4}G#jkyqf%|Dj<L-IgR+D%-CW1C;m2S^7T`L06b{o`d0
zw#juf&|B(6?q@aN@%)x~f>$4W4svO7=#QUCKb>d2JfAr$VeKXzYd2gUkZU*bbUc4_
z3ZEPEfKRfyhA8Jp>_e%)Hed{Nj0e8EnvJzXE6&bkjGI-iMaOMA*j_lNxeUC5bsgXU
zJ1h-0nDdm(8$Zr~d(4kv-(eqtQJ&?Pm*wL5*>=y^+sydpmx{q-z3h)M7k^Vd;E`4N
zo@BX466<2*4Nvrm*fjVXRQMF+_lMzw$bk=Hl=f%HRp|1dS{i7nwC2gPm^N6w+Lx5C
z)^Ucf+lp^<TZ>M~*Cf@{LC&W)Thk~rxrT8{_ZM;w2Rmxhn}#pK;svjSS;m!pUmom!
z2jU1EQr1F78TLY<YL;1Olu1g*9@L9i&Xs-dTIQ$C2N^U9=}z1;ap!)VbdD8c9NlWJ
zPvs;2r>;0u^OpeIWIM1=><RFB%(kvI;q!4UF)#K-cQU_}@vwhTF4cqqXY1ZNj&QIZ
zuh^I%+i#tuc1$?P{zJN42SOc?`L|9*x|E$>@oIvOxRv^4vXTGQHzhwpF4C8Tar1~V
zkG4!+JjU=L6m%Kz02W*B=U1*)7r<7<Tu*(B`fKC#$WI}A7&8#TxWYbg&I=LieT=d;
zm<^voiC1k#9(>>RxTF<z*JAK@)vaNJH}mjqaL~|z0s3OsCx%Z-*~E02H|AOC6@MPW
zJaS(u%H#P0>|3!9Z-pNN?Xu0D_K=P<wpX6X_5%<5FrP8khOq7o9>kmmYeQD74S`?5
zZx|m~8?s_;$ST){SeGFe$1nei{J=W{7xyRMrS3)u6ZpJtg?uQ(Z=Oe7gx^K@ZNcve
z_^sl15`N!~-#Iw<!%99m#Z$MotM8B|8xU)wry6kHnq|Ut2gdQS9@<xpZ!ptu`Yy00
z&|&A9>5zK}ZMGS3#Pvun<|N&<Mp}G6le+<FlQkihX@e0Dk&82l1lA)8CkC2u7XDmC
zKhf(t7JnWmM0KhDi@n&79jUzUH=BYDmSxRPVs1EGSi{4irxp8y@ploV2OE->A>B&Z
zsQHCFV<}H0hy7ya8tt;AW!hs&%UCDh!`?qkJqH`#!My$|dA`ZpVLn4=!>*Kj_<HB7
zt<wK*(Eqo+^J$?QWqZuuTnQf+#!7Jdjqe9%-T1zC0WL9#`*sgES3#FYg*Afr5#&p3
zhvk4zedT>=S&{qTtEu{lqXGFfk+SmJ<Ym5A*kIo(umAF#v#D1L56$^@^`@U?y+cl`
zmoORqcX^Jyqg~@U-FzNm+^t!cHYI^J*6ba)%RWz}eWV&Ro{2Tnfqn<y<5}QYXag(x
zEKK_M?A2V$y2uYnBCPe7_n4;0djoj)Dx}Y%jU-{I93058a=i>PE{1txM5KZr!sHv=
zV_JWCZ_pHZpQT;&iE~XM)?^jLEo7MdiM9wY=7l}y#9^*z;~4?%RkX#rhqQ+fYqRN9
zoVA1RYgAbakk%hC{2cRb$)}hD+3>v$`Q1v)g?f02c%W{%w}LhfcwBy41Z~N0jevh=
zs?Va%x}p)3FL>r2j?B=;!2!&zB>$ss*bX9{?Se<8y@5Knvu@0BoxZgqAMp<k-%I_v
zv0k6X^-9KXneC0nd^jEWWTDL*#Md0A4encDEvVWJpIH}Zz2FO}=X^110nda04C6!3
zc6mY@FAG%c#&=q4toTNGzk>4Y1NhGDgh2Vto)P6gR7aI(`LQPn=i3|{8<6MPWseO6
z@BB0n+FgQksPvU1=VL8!J<bSg`;VUbLAQCns-h8E&8M>Nv#l4j8BO0t6!=Q}8~8?n
zALgP?(2MKqS)f%8=p<vfh%4~~PBY?t!8r!#;~;%Nmo((Dus_&0=+C3{2}pZZ_Q%Qn
zhy%Jv3t{epd5SM&#dmV_eZz5n2G&~AD-NX;ROp)uLVAg#Lbnz$9cSi!#6GNeFQuS&
zA13slwCz>++R%q~epiC95VkR$@|=F|u}+Wk4ExC|a)0dJ{rKTv9{LM3D9<Dxp1cX?
zNnAu5Uke_84mMIM`_S`@zDx2E>=e*O+OdQs&P%=FkhUY*XWMK;woN*q9m%thhlG=K
zgOBD-pVoOH`IhhTyaB&0@@zKa`FT7i5q9&v+_P8l7}mz|4KwyzsO>MXO~K=+SF1w2
zBI@o7zIdO-;gPVg@8C1w*d)z3PT?PW^s8g^iz!T#bb$YZxMTb#_4Eno8y{0BuX3Eq
zF_pj@tXsB?^*vw5%>@RJ=+ik?v8JX}?EfYDK)=I$wp8rj%xA{2NE;b>WP24j|BdZS
zo<+N)Kk{Yvw8_4fZM-VmNaRlgzwYA+bt=T6?>f7sT#z!y=+An>?A|@0w5LwAMShxH
zAQbeIm9WFs5&Uim_$LixbT(oP2fE2e_+Bn}lJS%hA4$V@#I%t{=ts&W1DEbe=nspO
z$#Ho~8H)KT+9xlkwl9Hw1-Xwla@fA~>7p+32--pnSa+m-y|8c`g=QYZcU$x>+Uh*N
z2=FnUFAZZZjNgpsPQ@MHHnwE3JYeLy-A^zc-ZY;TJVSP$+<<o$wcRP(K^x5mPj<g+
z+`s%7?-j<q8P6x1fh)%e;~b%fB#u4uoOHtX0#}=D2w%tV)}zjR^BL_>ex4j}KJ&Zv
ze2%||uSLRijrqPmo^QnaA?EV{^Zf<p^FZVI#7Xlx70;~i4fFXz^Ld^5>@>@}%;!w=
zS^AZMXO{UqD4{;^;qe#oE<J$;)6Msr)ON1(pE$&RG1IoF9mkpWc0$@)YR3ttZ7}of
zq)!RY&nM(LsCIn8w1sA#k2rV1^K9lp`?7zGJjbuZv-K1_C*Eye#6E<dihUhpTgMgT
zNlD1_(%1DH-|<Wn_G|AxHDydE?7iq5j?te<o-I-<<ypq*u#so*9Am-=pR-fO2W3FN
za_zqmXCHro`Ew<{7cv<B$_N6j@-V-K?=*PFM9Pjl_lJ<D@S(06`1oPSnf{d3IGa(%
z0I&@;HX-a4>Z3A!kvx+d{_-zsu%E|5xeOk6vTgL8^abJ@rO9|c!Lh}8CC+MG7>Y8+
zLur+Mg)n9G=Z&>BiqP&u`Fcx^YuE|wXM%oeOvks?EsSGhOs(_zkg$N3kFf2+Hp@~u
z2b3^P#QgLh_H)jR@_8JGO*PRbjEPam{|3sA#`%qMzKipuHZ=Vl@cH=-wBye=1?2BM
z{O)LaRQ~qh_k6^8GEWhH&u)55{`TT`q)C&%$Km%QO+op)48Lp8hR?w7Z|ltVXCdu&
zGi`;L)_}B0X4*V6Eyic`c~QM7bL%0e;J=2i4mJY%EQ<bu&Vm0Aaf;|0$T9f;gyH{#
z-7kGJRTCx~bGK{wy$M+t;FmJtZ0ZAiCk*(G9;IDDo;BuW6V{mZXa7C*n{}D%PC4)X
zy>$hve+ob4gpUl^a%TTs_0gwb@DqGWH_S759R3{-&p%6!HY5HE@@!=S-;F~)`Ry{C
zp__wzmV|sU1J{YBuXOk)><`G_w1o0Ll$YPuLwUB7lu*7XA>SnAOHP2tnvhTWnG7D7
zSZ&Z@xIF)#u$uDXFutSLiM|!oZ}^_yan-N<JD#D(KE+(0@<xF!#{89IH-l?npXRU)
zjH7MTlhDzJSr_-}p{^~|k&LtCw^GeIJ1X}5Y(3r~e*2U875n}*{+oT`sMz<n_263>
z&&51O8=usoUTFhBme~qAlk0PLOq?|b`B3NR+`s8M=L(!Bv{d%`o`NFmb;n+&%#!-~
zf2lZ+4C^GJJ*&#<zI-`Q;R;`Vk4qQ-YXQ<<L9An&XGEwCYwC-RJxBhgy`W)j0Cr7w
zXyGx&oE;23b5Mj{!8-qL{R=#A!S@JuhVJ?k=LbvkJ;_nHUvQq`<2YX|91dcxM&A;A
ze_{XTa3t7&)KkG9!lz{`aUfnXIcO`W4fgYtEgT^C(d+{aMq_+Sd5-b;t<PI$AHb$q
z16_Vm;UalP6n%{zJlhxp%=f;jzbtTNKYqk_@8*JFf6sHA+rj7c+z=c0kEA_^GZa#^
zsS_OhCJg)1ckiYwU(LHSg2kl)U)BHa4h|bEzm4v@ckR8tnzvW?PG=vn9nwJBoamD=
zc;<XAigPd`u4t#WHhTyADR|k~M<XTCZR{8Jp|%;{wc9_zA^UH!oKI$j^y?g<HrEbM
z1Z$(v3*7hQZpT^+>S5o=`3(H(j7Ri}oNGf1w+o(y8`}M!4$fU@=aHV@c3zbq2JC*&
zF(<lK#&4Da-p=bEl{{TDXa{*YdN8_;-=~7^vjvk7pJ}^--^z>m)?=;Z^=RkFWW*<V
zFc<w0^UmG)=mF+S?){9lk^4k=c2Nv{Lc7n;eYlL*4Lt!n75sp-JhqMZ7Qp_N=Ow+%
zm8ExU4WBw*MBHeo(dj|@vEJp7whi)L?#JVJVc((bQrN)?%IjKV(z3Q1$zLbH$Fq=j
z0`Ftmilk+856PHWrq2ld(kXzeoG+OCv=)73!}@a+{gN8Gr+5eFOI*W5pK%RZezO5|
zNss&_+6jN@tkBj$J9tjBq@OLiEp#Y*M`-tri08$*Cpzw%Z^QEy=%4ExuzN?#{zTcH
z{+xofGufY49}O++5{Ls4>`TnQ<NZlpXV^P{>5OwMtnX=?aiQPT7<|f`5$9sU70k}w
z5g}|F@g98{?0+N95xLfY>)-^3XPw^mHE`V#hbx$kGjLDAwiCSetzaWRN%|H?+vPX`
zUybPk-wlnfV&5W0Lge8&^n^#sVe(qjAEHa4SK2*oA|35WTfVo=$9b;HtLx$J=xXW^
z$Y^=ypYK4LTJClJh~=SIhOj)_4?i1S#eDb<!fII;+99nde|<6Mj}W`J+}Dw&0v?{-
z1X+JV@&@5Y|3g1~IXliLCQoxO6nGcqYw(S$s#4l3vMuNb=$KP}Pp127@a=EN6s9vj
zf3rU3jq`C_FPZHP>D3;;Wy*O|j%>#xbiS{Iyk(uhccoe1@_2nly9R80$9!n7*ZVWV
z)srtiPUQR(Yn2=WptmApFQ7B!_@JGJy%sItQ;wTb{X>QNlXFCzPl<2+O5F-u^@Bq)
z9rJnoe%DOLH(Wlz`9R1I`wG8bGt;4qKX{4hY!APGYwBz#eiuvn6i2r)7N7l)@9Dx`
z)95x=f#?UH56+0cyq04#co)X<mgpM(9^;42k`-Nxb?s=&m(eY(qh)P$6Uudhwo^m;
z<+UMQnM=9e@<DWUXx&w{p>@VH^qOe-byTj`aW2w)byVs=+`((okC>U~*X4OiXY$#A
zCvjfVv5Y9%j-p-2q9($?_Mp?&`Z}CHirfoX{Qh<L#zXNA6UR03-e2NsCr@fmX6*1)
z!FN}M7*p^vaI2@xcG-Tjo&2mV$2SFsUE#p@YWZEqi!hd^;cf$+d{7&9v{z4kt#&|P
zmrR^BI~ivMS^xHL<+e-zO?%=BM{vN6j&KZqbsOZ*Ca0=x@u*rXHxRVt2AVL3#(rIE
zF#9JC>_OPlTOOaW{-FnQ%acCOEw}c|Ew}w3H}t_54((pV`^VcGif{MeJDF(Lt99b6
za~tj(fg{@&x!5xS7^-lO!_gnMTaB;+9vk4n_vR!#t-av^-cIN#yDORNUP;S5>-DnP
zUf_G@*6#AV{@h(YZclf)=RkM)*uQp{7k%DceiJ@IUed2Sw3{+dY!A-DnN5P{HsOll
z>Ofiv-t8WxhH#8iaMmcmhpP%#3|9xzO7L!XZXl$CX0re@;WuH|I*?Y98^AXQMGJIN
zGvIFm{J_NyTpUe^Yih>1S|&b|zJgCwT);U9_;nlX-vPKE#9f|u7?-y=i>sYH6PLN+
zt<jZ~yG#p*qDv|73^{WW=Uy0m3>#%N_c%A>ncp=7&uEk(l#z+@jCGJ-!!@YqiD<iN
zgQxR5AmbMaC*>-~T6k)7brat6w`(k9^%lq|rXP$h500G}z<k(=akms>N7@mrm(SGc
zz1zinat$uX?yvg#8{kJI44?z#boc&QA*>1F8MeZa-u19<!p^o_C5^LOB^U85?yH)M
z8;<Z@oPKP_H^qMy#}s6bh#qP<LV5-7y4peg&HP@G$$6!G?oA`sMSXL2cjMbBec?!7
zDSV&F#@faHj9S<@SPPK)kv>xP4`DEL*M9m;F@G`iTVmh!RX62Fe68eE8~fIw4X5W<
zsMF82!+)w|JBEDT_Xg`HUlPZ}wux`N4Sq|@<S}_>7xNN6=4U?aa}ea2hC`PM{{dld
z#a->fdJ@uG4>{z$;gAru2gIIM+|j>2`X6CSjicOB_d)mJ+o{aoSbUklcLuFE@2qY<
ze&f8xk7i?E7T<*)&+^PKHtK6E7NQ1cvCqdH{J}F*`z&juUn(9f5r3Uue5r(`5p}RU
z&fXox@@Fb*;@?GFs4GE(Oe3#R9(C^dy7JgRa1rwd3v(R}D;)6mh}70!gVqOx!uElu
zjd!e>+2goCkF5SCxKOX8M`JeXg#F!^f%EAaNe3~?eL(NVe0cz4w6%@bBQ|0v`#6)l
z4!)A-e53E=+7;uqk+;8b*0BB-#+o&bGx4QeK%C<?GvL?I_jd9a{r+BYakCN2A*wkJ
zah|a?QrvLNmECZR-vWcY=J(H1J?rH+&Q$YzU2^X?$27myMP4F&J$`K1AA~awBg=p$
zJ2?h;2R$XOz?<Lqm385_9r`BWo7VC1YK+5PWw?i#bo<&eJ#?Tw^#2g|{_#;(XWsuk
zlR<-xZS1Do*hURCwgFO!e$(Aah98p}w}HWaqlOg~HEhs=8~b33`@}lK%w&Ql7P|?d
z79>bgp~Y5R{8o3V1q>~^u#3C2MHXAsP_cqbpQ3A9er4|O`*ZGdCldtgy1TFEkG$^5
z{o|bLT<7|Iu5%qPc5dpRsx9F|Z3suSlL8JOrbVJ_;Rf1nGG~-SJNQv0@%XVP<d-Mc
z98}+><TvH(J8A~`aE~)FzLdLHb7gRX{bhKP{@~G3coE*f$3Baf-Tz5=6|)x{XM(pl
z2UeY1D_9HSy+@zW83KY?=KvYm-21`cWxo9NX=9)F%*CH*f`-6p=0wNQ$UV>y<Bz16
z<2B$K9EcX>;~?jXqg$ME@H)UaOl=>HCo*8hRGM+UZy2BIxoN)To9^X#fU{dZ0v%U!
z-=DKwI$Dw9JPH4t1gneMRezv%3+t%8e7o6QJN)eycSQ~j7N7bpeYRfLSy&V4<&2TY
zj3R7=dLK5P&DR`j9y5&H%roN^ADlYZ*F8!b_?NZ~Y-v}qB@b`l!doi@U&3A1St>kT
zcc`$&_`RG<uX-!gJPrAF|42Qwp$iQErkxhex4zLi_Ij5&Uuwr+m0ZK=6Zq>syqx>8
z^u6GnG!~ww-d1FgdB`A_9&)$oH*gQAjX(DN@YpO(h!%_-5<f5&e;lF%&AG-MIl)=#
z_c-lKm~Vf4q6yU>hYqmSPwr2y*&9t>SnNbspeNyJ#>8GsWFu=Ce{2qhVPbyBzsy87
zTbOcT7y^dP9t`T6eygbAW8|P<NY8*4k%{~+1jn2!F8vuAhfIj}yz1#O!E+{AC><-i
zM!YUvAK69>5nCbolefhiMUmI2g|S&Rbey`S#8L3Ej>g=5hmvcKMCr4V|A+Yhabpj(
zxr5Li_P`BS=e)aF?}C@Tz=7QXZOW#|u}P%whhd;^&v)b;7T&LSK9t6uRehdveXkhr
z4_-GiJ~(Vwwf|_BXWJZG?)C9*+eY8fcV1ZU_VInY{Lo|btc=^$GZ%TvS;+KR1&x>L
zOf=-O=(|kkZ439{$K+X<7#y)&@~`XQRV(`gVe$iHXAd9`q&Ii-e*yn*<4T+>P+Hp?
zsI>1W$3V{x%YFo&e8tg4&-KnHu7*!S=+MG2{K;I0!r+U!B^S_}TdN-{Yg5ib&hE*Q
zAA1(^XP)xAg*)0cd%P9nmd>tsiWTdqGWuHM6z&y^WNggEsGN%GDZ}j*sXf{%n7GQx
z<BZ$MYD0Sc{j|e)&hvSu-ud|IPUQWp@uh#3yeHP0OrB_6wO{ymkvokGu*<jm&*$P}
ztQ@CjS=E4X?C*WPF0%M46n`>TWf|-P;jZ2}|9rC+;o(zzZj8MsTBa?HzwA_7#pl1=
zHVy63p4tX)&z-r=p&e&v)8nNPI#yi;wO1q?2lMPnJAVZ_s{xxPL_4RAV*y`ZbyPNV
zka`2e6l$qI6?O7g)>1n=>Wt-jKG$=&euC?VxPFpr0oM|)=MuB5*VvRR42>0X|AH`M
z<JpISXCD7w2!1c(uav)W{C$eQi}@?#?~-M#olPAW)3%KDvzk3W+NC`?HOH}4*e4QU
z&ufqN;*`2s_@yDz<OCS!Z0S~TJ|{9@Y#P>UKAyJt9i9`x0BkxBXo-IN_~+eOx*r*2
zPw5`cQCb6C!#~#zaSodIp4Q0o;D_??pyRCS7oD7}Ro)issrm3gG`XO-^3Dl?-(ml5
zzjFdHjW%Z~*C6tvth$!C&x9Wrbxx;lwkI<SR#A5$Qp}nMx{ChJrj26ny<Zi5eTS*9
zEj=aMX<oRAx<BAV{L=<b-tV3n#&b5bz7d<cTyg~2FyD?xIRpN9f~y$Us&USE;)&iG
zS+Bd$>(_NZNWYv}`W5w)<Xlm3oDXl6=Jv-N+y0IZ8NIy8UCtQEFFxyB{jYW3+AVHs
z)gz8_85Bnih_5(r$?%qJkRIfd{$I5N8O8goZ9mD`Zw_amj%BQhNtSWVW6YBMfyLW?
zfbIPsztKC|=LK&rRo%9FCo?|hUhA+v*y`z3zE%AYt#hFh#@qp)N+-;dj^kMY^21?#
z<tw@J{3_L);&~W<K8=mUI#mBV#7#o%=|tw7d{jJV<e1t&MHlHEJ&U>54(UDGKdsKP
zGRefSeb_RGIy=Pg*loo*K0;IKHO_q-i|s=F56;L|tgR@05qz2tUvt%SVq=c{xGsLn
z#!wuMKgH8b3`?+_PIoGgn7sYM<iqvS$&G?n{2^Ks{^>VgF@Js+^Sgla#G|#nULT3G
zuh6-fj=qJ?cUk*Pbq4ag7z1=$PkY2ye{0Uf0jG1SqvRg2t|@&)OsKGXynBRL-%;Qw
z(ij+@&IJfnQ>%b;+;o;?k;c`X_mLyq&qwAtUAOU<#Qx^F*H2cqgX}rK*7%_D|ImZ-
zd6;+OGx~Xb;G4ShogK*kd}!!yTVrg)b?)<j1}_&TZa!WFtPSz((M#2C`U3c1^J}fD
zb*_7yJD_t!gx~yb&e=;$J$5Pheb4hDtY0*&ixjUC9F0lxRs|n+8#vJUer8`xW_xFc
z=0LWk@jJGFt1Ha7^P#Z<XkcT8IZ5`C55?8$Th+8Jv2)kR@51D2Gp{ElTZLb2XT4vR
zV+R)VyMT2PZ(hk!Nz`BK%`4xUdF?gxzY*9BZ3Cy_XW>BiR40#fj~4U*#~;IkWG8Lz
zOW%zB34E&gX3nHd;fr=2j8gwC1$=SAM7?Emej{V8N?*uWJL*M;i+C2IeoYA43-$00
z=NSD)?P-me+TkT?Gudg@o7W2-;Y56jonNdtq+;mo(<wQfZ^OIA!XGe(^*%IJNt?Rj
zV|Y2cqG`>EV*NgCY5p{yz;eEkfAP)^U_EjsdasT$AJBMp9<j<RpzSM+-VJm$8z15v
zu7#04=DV313|ByJ@ICaebIy@LC!Vu1Y|fvP!`kD52Nzm-RyxZ)5E+neJJE073Fp4U
z^Mk^P==w}+313VRCk1}VY}Q-4drtD3c*h@`Tk%}ig3K;I1|S<r_k=g$M?5Ed$$!<F
zXwTe{+)?2UJ9mX}C!dPnODAT|CTA8KIK#MBI~y7o9Lz=rP5tGhbS`5#T0M<;JGNnD
zF|>ZqjH1jhkyo@Y+-J7%d$sv}fO#!Q-{i?P=F^j*5#%QOxw^UPxrtG8wcnWBWN_eU
z-&wu$;ooWe%8ASXyOI0AFC3nZj<7!q1uJwjKhpdWVnxT#(|lZa&m&VKH#-}UFOO;8
zXv{ry$k0m?8H3(n-1F#jEc0jfH)8kK0ozj<=2p6;=N9A<|Mw)p-68Opb)KS+hI9lt
zR~g=JXZ{VZ56kfB!#<zK>m3c`P$I*p=I}b-8eaEs7wrL$!XNT+yT&bAe7|GIH@XBr
z=kD5XyW7PpjM3!NbS-9#__oYV%3HrXKFjC~)&m%mY9Zyp7lFi#qm|)9g-+re)<ec$
zQ$(GUXkvWrrPMijM`z{o4*pE-rOabNSJnwJ_5$`lsWxq(XE8YWC;onkjNm@F38PQ*
zwKpv09(>Nz&BqfO4`WlkZrPB)c+k{V<^2Pqe`=lG?en|(6Wzv}@b#h7m9<VGw&8l_
zxH8N>dTgPOR0qKEy@uAJoDFw&;>yaand7QSOT4wA#B|PgzrDO6%(;(@zc*2T1ABXk
zGyl`{C-jc!5IuOX`VuE_@#}m~E<<unI11h8$K6P)V&3w{5}_+vwRgdbcX|F)lzAHF
zPv8@6`teHOJ6o`M`SkmzA%DlJP1eXi!(U~he*6=H16~?r>``czId?mVhasO_7ymGz
z_hW9XL@?;Q?wI?3j=cN%jFThJe|ylkZ)DHdc%{kpRW7r>t#`&g$DEry!Nm0AMa-q+
z&FirzptsZ7D)MQJEWtP7?8dv9lX>09m2SqoEZ~$b8|RcQt98nkk;Au)9KL1!PSrAO
z?q%59@;~HzAaiCSyBpA}jledW`J6+Y(t2Wj)T`LJbLzltw`mW$YP^{}=+uj>9we4`
z&$S0?IM27H)VU<mPySSt{HYZ8Q%>byJ-zdVzuI%#mpbblXX5?NCCsmCE}=v6w#U0@
zYYjP~(3{R{OpYI!J9xdN6J45k?Q14}%Xb6G?1|R!fSbi84OFwQfclxgWbJ`k%g(i|
zx#p{Wa^l8@OA|AGQDlAk(n<HaS-w5Y)uqpl@D6uZ;+3y5Pwpnk$K*HQ?JdsEPHb(?
z4GfMWKO!;X>O$r=KmL3}INF<6S3Q<^0cW7j8edqm^5eiXfw<eFz|1~x)tQR_c2@(o
z?{AP{oUv)nKi`mWzg9#ZdocM>t7Jzg++<?s^U}<TXfVyZv@tJj%u5^d(#E{BF)wY*
zi+qy*j34BWgL9cTEG}Hw5Z=HTF8Nwf@*&2?`N{FW+tnbMl8a*>R$!ZLb<(`|z(L{Z
za3H%|Z9kNDJ}NtyoZF47($0DCzR&M<@cUSD(!}p!oeiHj=L*hM<&0+d6ujdT1rK;<
z#s~K$E~p`A4ZiKT`U%-9;(6-W1uj11jE%1*r)N#M$Mf)s#-f<=nPCnbIW5fNhhhE`
z&z1>v0P{zYbK<eFR!#}-a}pCQ+|X;HJk}aN)WF%&!*ClqrjAW0F$K7RH`!VHg!~S{
zJ&E;LX!xCr-(-C!2k!9w&>XOv@gTEuX`Ztrw|R3hv{&O24RUUE^mOA$LUV24e^Qs^
zY9PEgF9SY4azS!Uaa8NneCNa;IohDU7KbvY_A>|hUXZ+ZMKrqk<RCoddOUG*y-!QP
zvQe~KyJcvDp&Ql0=yL)OjYD5pK4lGgx%l@1_y|}%-tL4Bwzx-<M_AKZdsKW;u5*N|
zWtU!Oe8lY~!Yw>V&eX2>^D|gKK3R$1bWpm6IXEXVc7x4f{8N*=SaQ%gNAwkcLv(XR
zD?U$Ue8{5_=yx|`nK`<TtXU6($K^wZge$*)A7|9z-Bt6^Syj^E(CgSl{rW$hHRE8m
zg!z(uioX$Ukgf0ar8?x2AMQTJeCl{kYOaAB`p*_6#$6*{?XxTKe?$|s@2JiQx`R5*
zL+EOUyc)AURy;Dt&dk%!G5D7cS-a)Lw%j>Drw-4-qzrVn<)m~IdiuoD(RgqNtgcCQ
zrA=I~y{q3T?b_;;b?tY`y8})|_c*7L_*Yf*UZ-sDI48Wf)`{+&>(uW>5A5xCX7AnV
zH0|B*%zr6BOth5zquV~&$~Q%mo5rLC2lo_999uok>EM0=vC$%a7l-$wcbk70*19G4
zvAK___Gml0HzoOJ><G_iNOjG1io1CBUxJOCXZ4HykuTUZAMtxHZsq^6f~C6F=>Q&+
zCv0G<#cwch9aX&Xv~b10j(_aK_CawL#cn$luJ24dEnJCPZ){~Qe7G(<6)yP<noq`N
z=0UZ7G*)m|7QgS})^B3V`Z!lUH2WETLmOq_ywu0JAO8_<;@_nX25kr*v{AHtfrmRE
zPkjG4-xu-yaQ?vX_Z@uyJ@0$f3f1?CF;}#XYU3}k>pVDaJ++<x%XB$=gf4&ouK9nT
zcs6Z#<NN)RQ}J9ehP<3M*~-Lnuoc6|hzIJN!0PEHPxh$jzv3)-yN#THGHi*?a%Uwz
zta5qqeFO0wdEY_573&+>?#cUkKAlZ+JXcJ>=*A{*?fj4R6>pwk@~xBY#foE;n|1FT
zxYXvUu$gz-mCrVzNY6En2kKmRH89Y(f#0?_Q#w=cbY4NOgvKIR?N}7g8XilC@sD+a
zoim&~y<^5g&Va@ue5jpx`{nd`x#_c${;EUh)ts@%?=5YJw?`YaZ&`WApN~2v50I0J
ze9q>+N1KP$reHKMfP+zEN1kg=-fQgsxb^+1W6#BTV>@S<GsnH1UJkUGTjpOjkNPn4
z3I3Q*`PQW!3k0td5YFSb7dOby^KqbW!#VRRKdBR3lAAq38(v#Q;M?(N!+U1w;;{dH
z?spGBQ)&YpX68=wo45j;5I;&>T>gZf@w=jW0)Cg@{yA!2_LzBAsQeD$RkBsNWFCGi
zqn4Kk@f`|H&G>%SWL{>U*H*`?y(7O1J3(@)cC&0g)-|x-S=+6b&+D&eMO>pVcO)-3
z8Wm2YZ&Q3@)_m1AdgFBQ1icd(07qIIevkJ=oAKMR(Xml{`h1|w)Ut3^PXHeBTr{TP
z@n{^U>^~<4{=>*?;L^mg|IZZT%aapiYKdXbVatpihFRYWX7HdjGRfi7wQumm8kYQL
z;fOwFnLf0>i+`DX6&#uVe)EFuuSB>S>GQ-lrH6^N%0Kk*b%wr$gVT;5`tZl^)Ap(F
z`gGyr%*UbDiF|(Z^#fxv`E878xIO@>VhOD$D4#8H%O{LqmzZ|G_FotIZTj=TIL^3^
z;LB%&H|0NTtTsnlevOC2(0Ph=sUO;}?406_+xAzQ+`)co?6S{C-_`dKgG2BwT07nR
zDX-GVb7*GiJdb|j&GikF@;o_M`;aHks`Ko7<;GWCBfL*M$2nhoRJ&4fhqK<+xWk9s
zH51Qv&NuhQpY?WpK|^j^+e9;(6J$Z7cv`-++M>o%17oY#Zxg2=zbw2?G6k6n4>Pth
z)pa@@j58l{N}00*zO0b!$mwUczW?ul-}W=0w*9^|2Eh#MWkx1#F*#?YR{@jcl%6HW
z8d-J3|3=^Y-$^d}@-X*(-6wzLh~Bk4tUaVA#$xEulR>O=1%8*9`iUaDu2Y$~x%i3X
z{YM2)dGeL|2GIsGs<3l9aCrAkeMazgM0}QlHifU#tr-o|zeo3q!)Uz(-z<=}>(eda
zX8f&b#ZRa{!h-S6Bz%IZS>s<?9A8k}ApgzKtA`_<IZ~E%xqryQG;+T{?Fc5pBOXM?
z4Cf5v3n;HZc6yuchnp|lD_WK<$1~-H3<^h*If}iCXT(S1Dd63}_<w5QT^oKx@RmOj
ze|ExXcpohX-f|D#OU#@aczM_O$p(ib_X|X$f;ahUx#9scsj;ot;xS~b))Y%5<BUwB
z&Ykwh8ksijEl;K?wk&<(>wp}2$~f5rz&L?l;~aj^zC(Pu(x)A@2~M>)E|9pwoHZpq
z^Ug5+hYX)h_TSfB$j;!q0Q^*<Z{(}VN90+7{87eq*#BPb<9EI@Oa~tQ89ERRGS11;
zg`7KETkm|aUvm^+^T`M0vukWdhv}QO<M+hZ9c?gk$DGwW6C2DtH=TYz_M{H&Nil0M
z13dxgUuU?C!!P(D@{#xw`{7!9h%u?&1bVtMellYATU)s~IdRbylACqQYT3U%*C|+r
z9$f}Lmx1$T;1RkA6K7aYe$5zi*f>9C*5s*!W75R>(o^w4rl$Do<8NS0n)rF6m!DRD
zX=41_)PFN^z0&GG-(9b`zM11oh@G89%<n$c;2Meh5w{@DvkTk?inNZQ{>YJeiW-Gh
zW&|p<2hWoqfeN)(kGrksi8;j$!lUBi#!n5S@6iXM4fT^+4L^6h#y;Iy3$;Hr<{o+7
z*dDZjpMG^J!E>{B=5u$LcLggtz22GdVlqQ5@Fv+Lfdb~Ct_?hCzS_VQaXZchaEjW%
zRU5c^zk8;uFaK%jAHzp&Z}uJG0~%dQY$ywDwO9W?zgGNaV|CTbYq@Ty{@ky3aa~{i
zXM0Pz_7MwE{C@Tn)>){#sNcIhJXO3vefG=rJ2Rv>bH!%<A167aJ?A<1*KvPr>Lu_8
zJ`MiB3wUev@b>nVwArEi+*|M6`|V0Ec9lJlD_fweyP?1QL=F4<!Ii0-2fl`L1Ic@q
z%n=<ze`VUw1dlANcVeqG7xm8gk9o05!*BDG)cy1A#pD-$-kO}x92whaD4<xne#0ww
zijSD5vW%Ul41LQsJe~bWUzdT4wE6+RD{MS;8{=paPr(O^;@`wR+v=={ABeQtnEhIK
zqcy&V^G)`%ET^-R_B*|b;lqC^c(0vtcQEFq@LLzMbvbhPH-d{8iSkpb>S0USxzrF?
zpC0Gr-!UP1<)r&({snQ=d~#Zp_lr#y4DtJ1ev=m)EbK@-AD-B5?w9nBGwZRsU%~HB
z@D6(zgJFK_93kb0IJ8^J+8F#43`dYn5r@A%_hkH`XG}dDV7lJIG#Qvm>z&V-H8<VE
zU)qcOsmsiD8f25F(oQrn?H5Jhac2Bm#A8<wU&f9}4xJ$0$Q)B6k@m)FEiArzfY{&V
zm#7^Rdp7HYpLrlzve(%5w7n}*P5#~rr>UR#6EI(%ynnlsyn%hHtKE4$Ph-<Gu~zk`
zM&GW5zZMyO1LyEq93D%t@3x(Bb^zZ}VCrISmm~XE0CO*TuFu#3$zK(PQ_%6Iy}<Lf
z>gp~x^j!AO(DPqz@M!n&%c+24`q12ekbZL7H0Nco*4_DEZPW65$nx1c7S_wW``N?Z
z{l7GINVT?Z@9$3ado>>!U)cNR--qn8jrN=Q_WtYkexJQ>>LIYM{er#U;nNHJzR<$4
z-G2Kh?<l@G4?d~1e6rT?$$n?2;S<jm-wmIv7oWfn8%^Dht<HAwIehaNys`mac?v$+
z1fLARC)?PoXVxO&6Jk@!OS;6ah2}+}lh%oyfxYP7My@Y&oyql8!K>fkd^fbR*3RL2
zXyq|zWdpSG6tuE2LqE{U0JO3VTG<Y*?1WZ!iB|g3&ixCOTg5p-^rIY;dicr66w9;q
z>_6IJd3Go7<WK4he2912`TaG^Z_1-6AcsOc*UtX*wrLLQXM^a>XUN}!79-GgWWYTc
zslM(=r1-j{HGi0m&*#ifk8|cEABLy!`LzD5HEY9H5%#&Joq3XN@rOP|y!;RA#8>f$
zMbnpV<=GtOyvdV&W#c{g0`-DPxn$%ymnS<19ok)Cbgz+@f0(QH8CL^1CO`k;x4iG1
zO=0mn{6RjM$=9eQ|J~eUt&4kRy_$QCx~E!~@Rj+NxPMn_uEu~3yE;&rT%~wZph&QZ
z2U#0^;Z&I5b>-siHoX2Ke2Px(p+<`4unoHT&&;3bQ@SDCeBCyWMh}fq+iFX+`ax)7
zq|Mom*XF?||Eq2K_>e6|ZqN_mp~J$J^h$J7mh}vG(Brl1s%)QAJboN9b}r+~xA!lx
z_ia7R>w4||bG`c~-|=aUK6<@2XIcJzgFV6G-;=v+U)CmigFV6K{zmHLMvad!F0@wX
z1XAyI(+FROw&{!>V`tWe*0bh}JsEmRIo-=@?Rh@wP}j2loHKpqh90BV?gpI;6m#F%
z@6lgqA@oO{@whuZ`U^$V<3bDXnD9Al>}R&XLq#Jr`_AL`n<(FqJ3nrU{icj>qIXOP
ze00+N$Nz<OUU(_gAbw;`w8LA!hW`fGdjK8Q4DvUivoB^>)I5DddCh8aPal5M#2bKX
zy6r=<2e?XK^7;rKP4$ObCoXY54sFkC{NB6Qnk_$}+f~!MwBP$KuOdATJB&I5f=T=c
zFKUc&)f|BSJC<Q*iT;-z<sEEWy^B29xcHIpx9WXwPJdmk?@#%b`akYA3vVItR?@HK
z|KN7sXU!EHY;ijlFM7MEChB<S$Qb_r51;>Ki%@6gBFq25I^;<dJ}z(UJZmbnTA@6L
zbggnT0xRI>F#nS$5vcU&=K8%Je6Jh(FBRa74(8wR+T0I*K8M=&c=-l%PD9Lnz1pKo
zw~uixGIX6{4hKA6AiBjVu6F|K%`;+)$xahHn{RP5hcTi@E;9MIl1aQb2i$xVyLuPD
zo6@zRd5lYW%Jp3Hkh>;6g-qKpsn@LinYNSrsJlk{i5stNRUgb>pPqx8isbFsqMNTl
zJ`Xh*9BrZIh4+6nzM5PegZH-%f#33E`v%GOLhTblZ{_QZ2H`qU#$MNNk*n0pzIfiR
zcP_l%qoY6paE5EHA&2{`PF=FIi@vi}^z~RWW80D~skW%arMSIqr_htVhd95>9nkN@
zpUX}=RLlPxyx;B$Z!Tx=_U7_6>3`|=s*!oP-p<2oPuge2cK*%T8Zq}Z%|HH0*0J|H
zY+GqyJXka6@f^QROd{Mo+uB~Q&Gp(F+U|XKgO#(dP3PSWwk=anh(0*~V#vrb(S|vX
zr1|>CY(LbS_s%+_ZEMH8HpaHy;<YpTsQ2!#eq--9=K3nK|COiX$3e8OKt2gMy3Z*W
zMX_M<6SM{`IrUoi_GFARS#xFT#Zb?kn1-#9<PM@M%JfWrhj=1`uamKH3E3QaF5W-W
z^X21)x+H@WI+L+KI8QKyo1)}g1s8RvgJsM5gLUy2b;e?_KK}Qzse;(%j3E$gh#$o#
zNe7#Hwg%^SZw;1r?+;ci3j`~djSE&Ss||*i%?(aomJX8p6Xbl?;Ow5c!8twqgDo-l
z-)=R&6#8DaJmdeI#s&|Wb5HA?PnvTWjNj0H!+hP3xo@0@Pp3FeT)2*;*xTBC!y*sg
z`x7bPRc-7vFbfZ9;7J2dBE?yHz|;mzZNSt9Ol`o_#<<!TQyb&SFqRB3W`HpRj2Xt1
z0T&s@l>y%HxZpzJ5}6QCKF+0|<Z9slKZ$TUDEVgo2kvu;RkTfYI2&M)Yw16%(0jx0
z{0rx}MX}9F;W79mBAWf`4ZCUzZ`fD;+Zzu4)nylKVjt0t$c^|d%gA3_=_n7szM5~6
zH~zeJ<rlfqMsAyWmv6oqUFPoYtPSRqt2C8wW}0{TruttL19NxTXOodf2i0EnrA|Qa
zq;K)^rDRJAF13H@`CR#y?^bZnS#>EfVeCz4k$V2rdR!wpFlHb!m2(vNtvn_8{VK_k
z=)+?=GSITl%(C}C=iPUfr(b0sU@7$`zoGB*-bp28vz1-Vm0ZCxqZhf>ni{naJMSc3
z{i+9x#_YjEuASnGFJ9u+Xde^mAt%w$3G+k!kg+zVn7`^`;KGKDxxfDAq~+ug-lIMP
zUCAW%d4Pej6$?J)uE0;-Mg~6YHtAmCz&*O>`OXi!GpCfIE4ZKPyn(pL!CUP(LyWy3
zMQ&)!y?9*9f^U6Nbpa=JzI`kGq^6Y4KQMRv+qWh&#@-%CW;)dWe6GmV;I5VhUs*S)
z^PlgHJ{&55CV(e<Ky)Np(fl&6dF*4_oIBV2|G01>-Q>-IQz0B?z$-9}_3(JHT|4^J
zF|AK%ZHGDEN3DM5hT8qh9Q^r{yVb62>&4Igpmp(gzTX-@{$uh=B$E%Huh<E8+lFNP
zm%6T>QhM#9bH`slo3UsNeHs&bthHsqw)CXVNB2W-T`db@|2V1hi~q{+_Lc=_Z=BTm
z*YcNi-lnx3Z=4fB=6n45@(bX<KDh{eHas6g9r4BW4WdEz6@b&9*9y1%F7WCT?B~3t
zp?NI}Zv6D5&TIaHwo6(TG*6w>IkT7Fg)IxdziLwFu?oi8B|MmYgY9!FiOr@xS_v%g
zj6i?)n0<d0`sRU%k+1rOJ;tmpN62rUaQ5-)vF;y;zn0F*C-*O(a~QX{2UN?77-Spp
zO{!UbW0&#*lZ$`Zs`qG1I$bq8qFm37di#;9RLhk;OhbA$ajbK0h2Fi_>=Q30*S?7R
zI@^5TDtHTg>{fitJKIkCj(+9ssb)W-@)60gRt}W<DiDmkpA!7$-WK<$z1K1__8ZH|
ziCN<DLvV8E6|5Bz&u9I07yFB-IcaiHiyyeytZfh9V^8yuQ}0E&C%q1R!h5BgMSt3x
z=F#m?s%62)j!o*^`dxfB=Ki;zpVV3X>Dq_0@s<U(&rRxlwuxM?lhAhyxMQ3r3#z%U
zWXz&LXnLja9$#d1AMyP_vCaUb&gBr#4iRTX<_G3X?i=IPEKCJii<)vU`6a{0)^^?Z
zq-k?p@a)J|@<W>>d&v>~>Wu?6m(}kBPT9L<_>=izzSlXB$=iO}>e1r9yB@0LJ7j|G
zcZuk&-YFW2FZ|@)<Qh-bd6~NBz5mPekWa+TST6!@PbRwSEiLK1lV0ZLotXQ{>ACzB
z9z^ECU&^CHhCB^S0r_WMUfsvXftN7!eEFo#|G2aE;h|{Dg1f-ux%b1X1JHdXeFa2s
z!lCW61f1?Qx)8n!H_s{b;QPg$#K;cFzlMLTt#m{02=Dy@JMF|y)ky|U;|F$a4Hk!+
zZ(L!&zbxi{;(-+RXn*NQ`!`krbI`tXE^Tz=$i*gXCnNuBA3k1^bAO&}Do?f^4~Zuw
zN5kzm()Mc?c=wMT&beR8ee3@p+b!Lq{(<e_2>dT~({}-O%MsZv@)xlw>>6+o+xXXq
zWDj}qlpyo|CwH5EOx>|yk!(nGx?RT#np$&SAHLuE5_wTU>f;2dkwWb{Yzg$gc@JBT
z909YYby&7s7coKgj}7+@v8TO?J#`Ty>>@_kO>Ci?*w8X!L(7N_Evt1lE+aOyjMxzI
z-fhIJwiBP)NqlM-@u}U!r}hz_8pJj{(6iM!$T-H?amW`Xe)7>Ly>X0*8`(D3iH6(f
ztl$~4|K;E58F8XI`>c*<efF90FL_pOpVjkhy?wSBTOJw@V*5KYp)19Mowm77(_eCy
zbIg5Vv-W3o6RYA}(W8@k=wtPm3VgK=?Q5MH^=zG*@3|+d;W6G@8u<iyf3;3;O$vG+
zz`o(Vnrr5SYYOMgk?o{0;cH!K$0pkjKl{8Fy|IPbv0vkQmYM6cB!BUCQQLlJ;kWKW
z$HRYocP_E&6taswqk-AVmrh)+HK1j~Ye0I>e81IM6mt)}tl!#ypz~Ui|8}H-z82WN
z`r`LIV`8^Dr-{Ar-O28~(ra^SmLqSASugDA1E=mxaI=&#Q}5b!`MqM<1jf2U_CzSm
z{iU;}7uE<Tte0QPwO8vyT$gKaR%))(fh@QK`SY0CP2P#lqg}O6KIaj5aIM9K?8tDv
zQ)uIVp%VJar=5aiPrbpd@QOb;NA#-rLb&<nnI1pxNznexWP-Lm+P{~!unP-q{6DYh
z>sy_BuiNp`;_F^HOZ(14*dTF(ze?e+Z5V&Fn@vH_I)^T;xT<Vv=$Ksc4Q<eI8*~hP
zY-)p!iF<7$hPItK+L?iliGl9Uzy}#<IRh=@a~xnk58{s;CI)&$HnfFri3i_DUiRi9
zc+%c)xA&j3_Ydg4zh+DR@#Eh8yvEL2r#&(Bc9FMEnwQ_v?<_ICGx8B!M0vi%oM)!o
z*lPUg-(FL6T{ZPWU%RI@@!PkN6MMI+4fEao+oOq_@n?Ifow(Yo*DM>5{-&ru&N+K(
z1m`#H@^Jnl`-HN4Pl4O||G{?Xv^@e3z*EprU}o|g2TiOs`NY4sCciZpjcy)VzWC(E
z2HG%Z(v6Jq!*>3Ivo)UNX2D7fMt%hCnK5xc=DxJwK3hK;ryuV0a1`+GTbzE_#=inx
z1~%|C4Br-~0-Sj;gDc@F*||N+drK12-!4jSo?&t0#aRsuz~lA*()9+1cAnU)HTE<(
zJL2K&=bV2tv~~oSH(Q<c^Ud5}I%<q&+<S+Ty&8XZTVhByd3MuidN_Br9qS^EDLLhB
z*;LvyQ&l|(uc2#vyn5~Id7*j|b{_LSYZ7CuW^DJj!t>OvnIa!1Yk14pV9j%Oi^nY7
z7oeXHkH9@=p}jwb`@2W(-(=THe#ZG%CpW>nU6PZMfszGj$qwWO_m@kCNKfZ{YhwyO
zdy;Qcx^LllX9SL)eUoSNM!vbZ+=Jt13GUAny?A&UT0Zj5O;$$y?0ViQ&$(Y|zpdqd
zVb1*x_WpR_J34ZIj(`6=?hlUKzp2H0|EI^ezx|YWhspcEXYbHnXXW~dA6PFe#C}?Y
ztr{}($G&=Kd`J2gCzPIG)+HtHRFk7zduG`y<=2gxgWcRf&N}NN@WMs-R-7-FBE}(j
z6!(yhGdjEZ=Dp$eoAKQp8$bH#Y`v#<Je_WH<tA`e=bOmcY3%XS98JTY+Ry*2v53~R
z&(+T#(D%BR+eXa&SeJC9>;jz)s5Aa_1|Tu$Vx9TN*f*r>uy2X=be@Ae=pZoze<`(q
z`WKyMZ|if4xuC<h%BB##%1%{YK+N5JL3OQa9~?Kaz0T?8tYdv&l-z&32%S4=<t@s|
zCjSe3r5>gq&J85KV$NWUxkbNITm0Xh0xq3-r?H=U?p@~$FW&@Q+BnuN*cAVE(|dg*
zze4%PiZ6O&=d7Ns#0I^Xmf3FxoYC~f)P-PQype-jym~auv%@^+N5H%8^Ij$RC<gvw
z<eDGbQf_7u`orWwfb#<8(%50T-}9>aHSw<e+-Jk|H<w%h&O^th8nq7{7?~G*u(sg7
z)Q_m)`si8skdo2C`O^mR@7!A!YL2l7F6*33AFP>pFa{)BgnM(wC(qA2<#}0T0NObL
z-E2ZHt)WdXj@OWJ87KeqZ5=dUtT~Q18y$4Mk(Cd-gW#l4=jB1`fo^`Y&$`h3<|-QW
zU~~_s@i`1_5}%a6$ZyA|PeVV%z=)6Z>pkty*V;JyRn0l7TBk?GnK+B#1>s0I1V@Sw
zg6mPSL&j&~kI+S-+GCFLExg;{*Ej_-17_{r*iSz<`USo&O745RNIt8b+dAP%GW?YH
zYfW2QvO9C%$0jl|KIZ=7NzOu6Tx5ecAHV1~_ABR^gxhavPwpeX&ct{2yr}#x{IvSi
zJ@}~TNYR{d<l{xK8+#r2sX-UgUT(>YaPyatJG<{PcrtU&nm6*pi#sZIu*digjA@~5
zTebGy)pi%Ot2W;cPSw8YTe7M7mMZeht<Ko_!*G+q)BF(_ZizFO*0y&VEeydkz)&I>
zG%u(0p)<IO{PR0w?#`=iKW6_Y{5D<hhdBpE^3sD%d2Y8Xjc=OZ!*+r9&CpIO=iv2_
z-CK&R+aD^hxxC_!IiAe<nUOur$0YD*&#QOl%TE`6S3-;O(a=3tTOF`4yvF#X<gA&q
zIW6CZ;QNr_dz-^Msg`($?W0>)+sC=gF?8VenfWtqpJ3nk>D%(g<F4?}bCs+XjVL~E
zWH|D>D;)y9z2hYVQv42Y!7pIXzxqsW761N=@{J|K%($gH#3ST#MZrV4=++x!_5~wL
zY18l<efejOVz(F>2#@VP(>uZ$@e*KREvVfIT6vq&eSF7xX6>}rnIEZTpDlh<WUkp~
zyD*Y=>hUKRNxvZT;t_Ifx&q`4ZFO4FuQU0p=dX@G;0=Uz?y}C&PTq@bc|&VM1s~J?
zFO8q^>`L`JGgDis$xm)S?>DCT&dSC*@L3jfpM5}cK)j|SwIBa91uq83!^E$_=BXFn
z_@<89A%&9P%Jb{K2>tNN%`M2hBIHvkbrjG&|2jr7gzE9Pn0W@iQsNbrj5okI^7$V<
zar}JgY}>!qIogeG7Ct1?z()pLAlnuq+ZG|)q_^Yfkkl7b_#v`i-!<M3ebyf@^I>Wb
zy!)Nfk10NFadL)s&gnLK<6*7qWp|#!k59pmWsyM~Hj^W`eJk@?7al++jg}3&PkC?U
ze|C)O1NnK-@HBb8;pV20?ei*6rWU+t-`O^-!_l){=vVfMi#K2Q=96!!)f00!Kd#zW
zz(IV((;dD}w)}L^Z%1>_Tn*>u%Qn#7b8>Iyf*Y;lv@m~0uR&Y&vI*cF*?&gAN$2_U
z8=a{dgvF}4g^bHL{nMVuOCxrHg>kI*(;(ABs?h*$w_DhDrZP?_#kq&z75e%8Odr-<
zIFYSBOy%h--W#Tv`=M_N7DIPA_~3qg*bb4s>E}PAXW>U|Lz4r&Q1Zg+$a(1d0_7-D
zcO|6UCD}**_~mbDZ9(f>_0FdZPlB^Tc%@QfgO{p+<2`HOjHa!o3UCmWjVZeGXyW;5
z;$6i5-Ho|;8KH&a_H1|R+cCHBv~YXD>BcYqvTY24TO(I#$FG@c>gs5$ns4F4uQ5-)
z#aqPuDz*NQde*CZ2mSug=!afst*tGxEy9?=U6t%8(T(tv7(duRZj+O`o%6?(-^96T
zv}fYq$)6l)NN#372=;Mp%9+DARmpokL5@9Z<|Xyf#GLvDWKR|QBZ_FZ5?NHG{B7=4
zA_rE;&NBF&``-4F-VqKnf8;$&j~j+@Bpe`P4UV7>)r^G>9p82}c&fEETfk?%Q@X>}
zNf}fOITAH7kAmd02bK5U2d`9V{hGQw<_!46_`MC(B02>(rA8+wd+{x9pypBv@w0_<
zOvu4ct}2gq@f*K*12%bO{72;t`rosQSfAk@{<>fDRe8g%!4EJRo@D%IvMKdm@`|6g
z4&#V#&h)Ou(|XR?d90(^`MBr`8B#>O>`QZK%=jImQ=gB8yUb6VGU1J!jMenXnJ{nd
zVQ$L}e8>*pXYkL8p<PphRx(O$s||fWsvq&V;=Z)UdnMLxDOUTZ%0uxRatqrFJCEA;
z<h3o(d&ni@fBOBOvHc9~d$}9ZZAFq<sd?_<+<w4I2RwKyJY(L4R`;5B;g8(+&eR8E
zEVlBeMBkY`CmJLA)0gYK<JYtbYfO5_j%f~gc}D(Od24MO>~6hdeKq*^Iq+`VFl!^5
z>>90Vm6ghWiMLai7Q0JuGUmWAU*yUTpZ;@YC~IS~hmeH}g)7kuzbhEa`^wACyo&uG
zneec)Pqh8MzxxT};XClXQ#MS78c7l8L3|i_WsYQWIOhI+T5{6lQ(*tZ+~+Urxd|Fw
z?X6eG+<zS6T(#n!A$Sy9q~}LQp4R8g$wJRZX=?D~^G_}V-eTKtqxz5>q@VLg_w(G2
zo|oz8W!X`jp`-Vp!<hT@Tc^C&pYtAm#t`x1l9d@~$=EKv1}_a3KPJ8sZf;6>u>5!(
z^~OTfKeB7=S(95MT<}g8{T18y5|L;gHuH^L(1D4c@!ZCXe(dFkrHqevuHg%_?(Fhz
zX!5ZB?1y*p?~H6jPD-C3<H|HwjO~nhEj%OV?&8*%`_wTrZunMqXw2RAD0<WSj?dq%
zcIdlUI^4(x`a9JRJ_Q!?W1KMSJ^4M7^E%fTnp6#1qsvZeJqjGYV)m?K6F+sgwV@UX
z4hzF2)!+p^Q#2(yrVaimt)6jX7ylO<T9^)A<+n>ezKY&lL;c!UCHFt^md5;k>D21;
z-Lj>{Q`O@)IgI5<H+!Z$`?{%5vaI{l)>d1ieM6r}(7xo9;U|L=WP;DnYEyjbUn@fJ
zLE4$ec|UF1$HX42tl8K1M$`IrmpH*$6JC5q>&=NTG+gS%>e-YqfqhY(hQ3Nxmz%wv
zdsQz${!HTH%brmC{GMi?ZGw&uga-_N4C+}IcAR8RwF7@qBY>D%e*DePe;J*fU(I@b
z{|ssnWBaK_9y~foe5};szC7msc)gV`+H02|U&7gL><{9dd?VLibC0IahUT_i@nHO)
zyjsG7H93~LUBou95u%(q)}Z&<mvvyou4-BzZoaiL+#a&_)U#>fQFuB<o;va8Yxn3`
zVg_}7z69+cZxiR#?up;Zxhc05Hwf1{14d&-&r~pe?cvs$Tl3SOR^DKqWLCqZu_1?e
zXgzg`h9;il1lTJvIdz-9Exnp}NO;oO;P@e}>jm{bvOb`ziNh*Re%0oYdE`6ndw09(
zli#+Dnc;iE#Um5pqvw{J{+@An)oyWjnm+HR&&}?D+ULDu?(a2yY;kuf*6a5{y8~)>
zSgyl6${#R1Egph*(q(~s!$;zueoq$}e$qZ~@e{P!#XM*pktM{AhW*l}^t3>}u_;{m
zn)N@$eq^5}UCw0twfxu%?f~CqqOYD`LNnmI=OnTNIJAE$0}N-fLG+#Eu-;{UXX{<V
z6Y%`0F*8r*J!96TS)cApD5q|2aHecD^6BQ0U)LCU1YhO~_<DbEj>aUOAa|~q+&SuK
z1*xM&&RuPgI$Gq?rOBo1Czoz3xpe!3)X@qmm#&Unx_a{N8pykw-JK4aJ@)dO>|WR6
zdMB_!wUe|DIN70nr-8LR_hX0$Bj0mEnNLCwE2P5$@rV<2ls92xi?VxIL;KTP<13Es
zQOv2a{h7u1f-e}HBcsXPddkGq@JWPc>F~^S`p2%TcRqHP-s7Dv{cqM|$NWV1k9l@{
zUaO~5@)q_jcFrkjc9x4jWA5LXIFQa7<=e)-EzUWb>ymXmU#I6=-pXvIFW|<m4b=<*
z?^F{{cceqBFJK?i6nvrtb9$3g&_C5Vr}Jhrzs3At)O~@&dTT&6Em`Bv+xEzX*cxX1
z=x)Z}L%XVh6LX(1>u=<XQ4=w^Q!pffpZ@REm`%>GKjvSu7w-`F&>iH9u-2+^2UqC-
zoN))daR*c0xPz_iC1j4Ac!uwx<)x}m7bb3$f=0++G%<Se7mLYXEV22ErQ|P`wLur;
zFH*;gd`9Sk{KYW&i<8M;jFP`tNB&}c26`iZv4Q->M)DVDlgBWJ{Dmg*pT-W4=BID;
zat~F@f9e4GX9nx^dz#iyEoD7FW&RH-hf(YM$qRp6w19dVvTZmYN$YCPtQjvYt{&i<
z%WmCOv;5W#HGdx}z4RRZFTC|=%{8}`*8EMVklf>x_E%E(u|%=&zE`MIb^p(b7Qgw^
zOW{3gN(Q3IHI)wQ_~HK9ZZ>iAH6N>O%j+WVu^}@BWd6U`wsyS9{H`P??hRsIZ`Kqw
zzTr$pel>6pJUbf|hvB+N_>2_0*~ksfa*c^vg&m7u`w?@N-C)}K;<c@Pr)dk_uo1op
z>fP?i)SxVd7bnA?6P$Cn7IOVC*P{Lj&PTZx_s|b*&f&d)dG9mk{X$@#ot{MeG>*Lg
zTjy+^6?FWab5_iK=BCa`&RNOc8AYpT2RS$!8Y)Gf1ogdO=XV}+5?y>nPpfh!JsI*t
z_CLB6=}T>!Pe8}C+4l{#d6fJYw@|rCi`RbN>>pjc?+5;O=PthZ>#gD5P@#N#udR)&
z%lS2Whx#In19<xcpUK4m-md*Y?86^EDOjsD&y!~qt(*>@F(&#gO!2(m8*7m-BYJwB
zr97+a`z|#HmS`-2di?HpCN43$ri1y-pSZ;6se*}1LXtBDVa~u&pI(2PUQE-r#-;Yt
zpYd=GtW_GPfsJu{@BU%6aN)zk_!pg`cjM^YLOb5E;U?*blTXoR5q*Z3moRe5;LvMt
z<8zwpm6M$)<IPhoKh>-?<2>7$Av>b~3&btoAl@{V_~>+}9$kNscIHVQ&=z*YGjp+-
zI~cqC5ArgcMf_G?SQ-7AzIZ-=;*tPkhn7C$oTagHuQAo@gp~J{{PaIl+b?YG`=@@$
zvvA*i=$Y@rE5msDeg7$V3JDLqTcG;}PrR?T>BBrz8^pI3fP;gA1sv!wvr};J4`%<n
zaKN)V#?+wk^KMhj{fBjY`<Up8el}n;?vn0CFPF&{CugZpbsC917uo&a#qnRDr|04W
zVeg=~%OeA<KLxxq8PMMq*zDUfL+nRD7C<Y7&_~HdYn<iqZc${P+mhVzHvAtbjPz#r
zA{&b{_%O*=epM9dbz7_t@{aakYkzKPF+LQzMChHe<Rz@}vrpHLm8nLC^lfy7)A8rj
zFrnY|Df*?JC%H@RWAag?&m*tMUb`(CemGQV<6t(I@aY|T&i%<eZyDjEr`eZaZ11X!
z#;+JN<Hs&2#wIAiekjErD8qLs$M>$lhO7J{G8dS&_9=N)s{P-@Q<%Fy>=z!RZ6^Qc
zu}Pmq4?ja5kXg@S{esxLWQAZAocvzs+pMxzWebC2W3PhSg7n2~E*?(|6&;-F<o^j=
z7l_uf(`~Gk7>#_N@2ZBR$)UG&%)NhD8O}O&;s<y^b#6^<OJejDvab_gFz5W{qa$oR
zLj3#uYjj57LG*7O-x&Qz|3&yO<%#_1dx+_mr2@u}I$eww-gFPx@$8a~bSZYKXvW6C
zsy<7dCTzh{)euN!(dpnba)7nQ`;Mx1ak1#k(3|KH+p#;%zT{q~9o*^+C3F55G!}&i
z?)JtXs8TzTLDnSi1J|6#bkVcW-c)FBGqm^Uo1#6@qHHAD+2x{3Yd5c-)QO$V`9YG~
zTvu?F?Cz3&Q@er-ozre;d$qg%kJH!>ZnZQvb2N?p;HpTUM`Q8>(~Qf|nWeErI$e4u
zI!nC_9QW>xB5T$n-^&y$CSHGs>=o^?4<|JLPh-O|{w;2O?GtV<_lmW?f$aBUtnA~`
zn3$gm(Su|xbx89KtnG$hmLq3p3Pw-X{(p+CRS8bP`+i{^ExT{qq&BtgWZRss_MzRA
zBlMr$ZRuse&`XGQpjzm~^C9Y>l}go`M?O^{n@W*OWza|kG!=$+CPN=3nMcT-UY57h
zix&mvDPF`J)<F{vW2lqO#yGs#9BshcWwO08^pl}2@LmajSHa(5_<J(^9Tk5QXEZS+
zn`gf<vYLHW2KR4~n<RTMv<TiqU#zujprITc^3(<3IjD6n{PA@4_`I3;`ikd=1P}Mi
z#HYj#?b#z^S~zc@(4*nda`@itA!9Fwsmm^3g8c-8e3!59B@6f#dmLFzPCRz?!O4Bd
zHexQ}bzhnv9?)DLzr;T0yzRX05&G*H3KaCL4itJa<B=a49{P56uV6t>Ku15gH9aLz
zpfM8%DuVY56%Rsh*0C?Sg1Os3eSc&3vHrD|ckMbIH4=>+dPMtw?ymiIwmqlK^YmWN
zFPvgzS3N#KF|m`E3~Y<BSsrE&9nVe7{|0ngzo{b+of1cZkHg5r)Ys7U$iwa%WLLlS
z&76LfL*eD1JRIywu|A;rC+DM(cM7zJI#LZjz>DOjbc%<YV`DuyhxSRXOhz6{#(;xh
z`1u>V!q5&mPt~4G4Q?b3Tc~f<roQi@A5RV+-3njT2|jRZ#vu3wv*4vp$e|4Pg&Sgg
z^)dI`S1Na<_S-`~t$_0<-|G1qbuYmM_}^;qa*yzmS125?52m6!LR=ahqu4L!)vQZQ
z`{aZE|2$(4cz(C;=}hV5YeyUSro47ppf%#~&C5>yMCu9SzqDRj;snvb!106YtLHd%
zinS<*7P)6+J@iGtfkl!L$ovZaFEaaZPDpS4@=#`<Q|Pr7nB(KZ_(R~v!^a<<)Lt%)
zxAxm7Q!%%Hmgq`&6g_aSh4BWE!TH!G#q5J*uG~e)wZ@*~np<~1^i^!+?Ut-!*B_XF
zlShfOd2JSrq6Oy9rv>zN032vt`zh`@igm$T`OLAC+RXKhFZHt5;xfUHPA?uU-@YXI
z))E=?W#;49Whc6lt-l0U*`=fUd>8%w-sEz!f8qe&%#LM$dx_fNcLTJPuNWbGO`P`^
zclFF>ZZ7%>ZJwx_27D2>X}yu*O{}qt9@m6gxE7N0a=??bkL~B((7WmSOKUy4W}ViI
zXQ<*d?`*K|Oz~*nl|33#zs9zrZ)01n2~{$$0r7(E^A4j+)`aE&hs`Z{jJ!m5wiypJ
zhTqM2URuYQ8bQuZ&u6bPe!E-d)&6ixM)&chDC3%A+a@p3E!0|_!BO@%_&vwVH5Zzr
z5gqm=)?-382L1h)J$xSb;@H{WJO?enU&oG&?&r3{BmI2;QRZ#Eo(sqHSxKzNvyW?o
z#U>s+H>k6;gR)H+KekNJ*fPX_WIq!p4wifI;b0Z<9M-LZ<llzKHI}{z9FZ<n-blDl
z`xion*V$9Nw|^XdNv(7Lq|VRR@%th2!SC<p$~S)QY*78xJ9%%}ScI21JkplY1=NFi
zEIp1IiO3(mZ!~<Y|4Xr*9ya!QOaD}Uch*nDZ)-BRYo6ce;d%Xe;idq-?CO4R?gLTA
zieAvY$FEA?9N2_iRW4oBGmX7U<DXf~wNNsGwsvKvIt^Nz<-L+{Hc-mh8S|5e&~>*s
zE!Ehc=4=`V8~#mdzvG9+|0()qV!E<FLtQ(Z`S@Zj*q#T{H&a(5%iams*=WDt^gh1d
z$oHG<_Z7&WP~wuS_h>(SDiEylV&a<$f!Elr;w|DTMaWKKg~4Lh4V(;fYhs7YWrler
z#)7>c#NH1Yd*9-!)Wg+xUT2=#g-6+=!W(wQyqMd2tKqG0Yu!Frr5LgL@$9D{{zMRe
zg0|JiDeaHo`uqEt!;-%J*a%5y{;UblEC$DAiF2^OZ=wEJ6rE3=4Zlm#H4lTQV(jvg
zRN8q+IA;&iW`5r<{PF!p-uVXi9%U_}2panYxjGez3A6=nm{%`0w;0;soNe&N+3wk0
zTpMEUs+EGND~bNXhm5)3pKfS?m~8l!z<_)R#o>V`U-=lCU&YnU+`gGJw>;B(nw!+K
z*yW{K7aH0Z8BqU2^ZNtNy~3@=9B!Up0gPpd^67hKRX?*hS<N~=`<*<Tue;Om4|``l
zUT|JFys#x}_u~3|6<8o0TDvKmIvp?I{~jG)_u0z&{KFS>M)?G-F_*;KFWaL!Oln^-
zYsIUTv(Od5A0b{HbI-N=0Pw2~jvl(pu6dd~jUM{dT<ct1@@WdlNi4*^d{;bK_GOAT
zX~WTTLm%{o4O)zjCx^_-VJ4njpn7ES&Wl@<_m^sK|7>zy3b}9W9PLNJFHk;9Q92L!
zJFk6^c)ydVyLyjmJSN7n_Q2WlF}I+RcX&Q-k9mH{wGSqyU%e;(y>jNYAnf~~nuo-d
z#4MZVFJjDAjz4k?Sc^o<X8nTk8Tgwue+88(b3M1+$Qp7e?XwblEw)$xzOk)Y=c%*z
z&2@M_GzY}a4c?7BWq!z+5&pZLm3?sT<EBPTFK4~6ZYFx*-b&#Td+tHOAY4i&`7wNW
zy)YN2dPm>!4!Z5!o3w^)zHg2_sBg?%Fb{mEwg2I{@L|;VhE{-6a2Z&&mLXbFu169W
zSXb#Tlb!YGTgrRmUf7EPoZHVlc;_#9wJVDi%g3*;mkowKd?$Q6`L1gBHDoXJaVFaE
z=L}d1%o+-F#CU2oAEN*07E^1Wg#YUeKM<e5uLvbOkE)-;np4I%Dks1nqdykWxIadX
zIp%(AiNP^zuFBW)##C^=bf5kGv5BjLo=>vcfhK}Z^3i{PFrGMn4>&M!Sgz&ZzEtl^
zuF2NnS|OdtwUWOo<icCkr2+X%j{F+#73+Py8(uemMR-88m%USXl0TF?Z@F`J-R5T&
z`+cL&+l3p^oyFY-cswfpW)ABZ-%N|g#$^F&7>=WcVJ$Tb=W-58nsZS4IR}MU#xi0S
z_@b5gqE+~+;hwpigR<4BM>h)(*pk6^`H3~q3Hf4AdbkfZdA{R^`r%WPv&`BierjNa
zd|~-1QwJ3jntx=PBcEmdJjLkEe%BP&KK=%Hk9*Ua*dz9b1*O>WeLA-!{=<e#sR#RK
z)CVZV@7+NBZ9BiCw7r*W3f;Ut{LT4KaR#H4+Kye`Mvb!*^9O`aPp*FZ$+nAFf2nke
z6}!B%+)3#jy^meof)2o!eDT(<g)9e8L!T~iqU>pSK)=((lJBf14%$Y{Wvo*lIRvel
zaXAC&a;I45<LE2{;K*Y=u~Be_H_l%nSfRn$>La{t{#wBm{kGc@KK`ZoIdGkSDqQ3M
z3m){x?iWYHvu`LD9?p|rgdHDJ{NEd6{|oqVj^-e>R(9yvB{t7$lld+OcHpYVu8c|+
z$|qg?nXe-c7fg;*d*8OD_1{LxkT&Q<{MiPrv_UIv&`KM$(gv-xK`U+0N(NfNHmJ%#
zD;a17c^`#d>yY*J(CSQNYJ+G}x|Y51LmC&fEgWetO+om<`S>8&x^T~@9^*PWynMc{
zRh(TV-a`ImJ3QJtd1d_0PxAlJ3jNQSk%zok<j^AQpG<muhJB8rIo2t_1$&Xro+xDf
zPH$X&*uO*d-nSnb@98ynuXvmLmB_7P@jkM<bnc9R)Aa~4`6uu)F-ra_`K#hgwPMLE
zE8DAdMW&?0Z}6DOR}MEJAN*Wp;w|u66ke-?*XrT5nebWzyw(V>&4$<Jz-vwL+B|q|
zKD^cf&n|>l<1u&HG09u$YT?e)1!L~eRX(ZYNz5J7ZTPP@SWZ5-6X88@a3wgHCpwE|
z_djlE0(jEEV&+oh3_Q$dJ@Yw}`D|c58=249%;y~Dvq`od^EsdSY+*hZGM|f>&rx~E
zcAvyG(9;Uhl6V+8+Aco#@ZH<*!F<+B;%%+Z`TN@y|B5t`lkQMY<mubPHGjB$e$AfS
z7u77kJyrA7+n3i|cKdqChwB#9SE!A6=g%LEul*@?U+dB5p#`IH5PHDk;D~U*+I<7-
zq#?n_@2mJ-!tcsR)~QS$J7Ho0&|MjGU8>kSa;8u<Y&`u$PB(ExY`G)JfBlcv2PP4-
z@@VQX^G@I0w`y-aGH|!%gt_5f|9RN-TGK5MT-^;$zG`!HS86RE{V;7i?;H(GTImil
zFOA|^Bj@|HHoWditGgy^-)heN&)WNCS})7FPY$hvesfx>i=lXLJ>&Q&eHE)NfcjV8
ziP!IGjoc%-cJ#B!6?>g%Z+0Uzenj&m8eyK=y*YY_v$TiyW-i3er5$w0M&-Jj^*Q32
z)%zV=Pi@tmJabGv0qH0M`UQ#+wmYj-0suD#R3UK0Mw?HhCMUvFWTp8OQ;%``Gd
z?KR)N-M0BT?^|zwzxlTL_I>u*`S#hiobQf!&mI}F&(@DT`|FT>w%<Nmn)9s4K6}nS
zTbT2#+&+60I6rTmZ^`!MJP+IFHpby-J)tSJh4ZjIS}D*z1MNrGH#!F+-2B%A+MBTW
z?2MJMD`jW2Y2Jv#8y}yuDhm{=(%dQcgKrLcbF}h$wL{II754w>$iyPuo1Ef)`+^q5
zpqW$u{qgt!p^jH{)>W)E_dW1jVB28-=ZV3@r-9ATu)A;gz2@85pTEGy8CJY3dB?j0
zdhX4~U)Oo#|F%E>p`2$8_SqdCUcDTC``sM-%=l!~+1Q!$U5kBY=Rdn4=ULo7v-6)_
zp7X5Td)9B~KWoNo`&(|G+4=YO$l7Op_L-gkY&56M4fffib_`|u-+Tve;5XLlUFOg1
z0}3~{6s{cS*!`^EdYt?4(aD7=_7lze^fQZ*4K1@iGbXF|yEdRlDxEUfAzfYQ#6Irr
za>^H%@c$9?OoMF0y;ory8rpz251?N*Sp8BbT_syA+?4M`2AuQIGmXBj#<|$8>^0d?
z=#j~h8(LDb|03+=knJbCF6J&>hySiQH~Apseg-0W&KD#%Vp;b*BUcT7=R5rG%|&mZ
z#N@+3n|ue|^ckIl-8Ijbo5-O}&^~)cIE#Lzi3QcmuQmP9_B7};md!qio;Eb3es~tG
zIdn%k_h0BhUq_nQSHpAF@Qn=ce{V}i<QC_`=6k+3D{_(Z=}2|UM*5lD_pEcFbec!U
z4^AQObCK%K@ocx|$Zwl=?^3&7O<;GY#t?IFT9VA{m5p#%&yYb+dATz;C3JS5+7Zmc
znZZT-Yv5(**l4_DFA!ZIQ%zo|cu;%P!tE`@{#%+PUp?5q*)Q8Ymi@)}l<X;Bmc3;B
zo%d-o>3g*o%f9sb2W^8nDrIhTu56Lk+%0U(V|KeY_BnTgi*evdwG|xAQDb{yP4)Pe
zs>JltOLeB7U861)-AAHh`ohh36x0lk>GRt9*45KE*Na$8x#lqD&bdsu^z`NZp9}Zp
zQv@2ieZ-?V;gWTOw|eG~8#<XBrdsN%pG5XCKRt2Qz~cCZaeR<CK1iH1UZ(l^Ux5Zs
z-ra%Ux$5f9i=1(WXSEj!{3|CRdG=3`gLl}xgyrK>Cy7(_ItK34CeCngzN0m@&#Cm_
zULJtYly^|9wZ`O?KW_~){}#UA={vqL>ydm@PFwKL?kBxD-8<`p&WB(IUw;a%oQy<+
zyF6GPJhx^rxU0E11^%)d?K>akox{8{+s@e`-kIH8JfL@$H@40$*L%FP@4AnFFKgd<
zZt?LSf#2++k>_`m<UC(zpEriru;$dKnDK*mu9_=bB)eh6pIG)fGHgAvXF#$?vJ3mR
zO7h3rw{_j)hylsI-D>OL2kiPK>yF5u3S>_uvML;NJG8!FWWlf<n?1g6gr~4$v&VNB
zS=$@j(D7;@+u;V>iT66QkS7Hb?{mHf?KWww;@OU8;nC(hp7O@KY>GD@d!A!H>QcyO
zW8(r7yjFrOYt}=tW#4lxH1cZTpE{?yN2fWS9}2(Jiti%OUd>>Dnkru|t=V&j?6*?l
z`+3L-@;#6_TikYir}wdg4|+6zU#)K&b{T!~;9IG*7rWD#d)A6ae)Cqx7Wa2{KO*~H
z+>^9{Tne1b@J)EJdot$EKE#?rKJOj#><I@u);*#3z)K;&k9*$`_rUJ8-}mWzWBa?a
zALaW3;RK(&0RJXG$r--n5ELY4L>qKIw1pFR4&R*~$8+G53}x-SB$hqq%l~$RV|VuT
zvfCv?fbFWUPIvN5zDgTwxepn?tH8)bY+Uu}w@pljv&qRj<4Qm0y}O^IFL-m0o{_wC
zuX}5xpX**%ANmIWy9Brj%sH9s$M4ZzpW4;V^7x5sA56~R976{hosN$-7P}ssi))$k
zAGub__F8rbK4*N1FI>Hc9P9Gr?Ry)@Q-`O2Ggj~tcPvfe^QG|lSgYp#uIJzh_JdPX
zO*r3@ox|_n8$9!yXEQzi^KI$BeG+}W$k_4dN{>GOcC~?hx>@_1-SMz{LNIi^;vUb?
zXDoZNQ*%UHb9nX#`|S7j*&UjHo;m8r%Dz6MYldyTznvm`J(m6X4#j<Cs~KP0UTqxc
z2z)xS|A#mgYt$k3B2A6Cvu<6u06K1Sn);H?hxvb2<ASrk+}QlDS;jd5dfx<&=Xhgw
zw{yLqI_gk|k9+7q#TIyHX^J)z6B@J@f^RY0_E@z|Ok;hDSe#iaI3*rOdw<6Fv$=+8
zm)sQhF+)RJT<vwsPj)sq(M@iHzMnO|IGnzS{CVOLJaZD|oZGGT7BoDexUI&Wm~gFu
z0li*Ad-y-@93KbZM)^2qk7&%ztoGJ`*z=tN=03$rd!{4jnux^}2-p0s3AaC6%K!P2
ze_fK7;FbTKaC=~v@~dL*o!`_w!DnCrHXjy^m;NOaPB$lJe_<E#J=TL&ixHnec9ZrB
zyKdv!v$Q5+>UhN0P36poz+Cz$qYsnkK_8`No>THMfoCiHHYmCBzt@33%}*V*V#ca1
z;w);H^(pdF`@tzZrnc2b<GLML+8%S-wmtZlo+f50Jeu>k&<U#ddXvRv)wDkJQHuQ8
z&0Ed>J)W%;4C+sKVBbwac=hMazQ>rm@Ot$tc!)0y$E7t!e|(JPL;n1sOY$QFCN@1x
z%gC~ln4A8o$#vkYG0mknFWqJ@h~%I@FT^kM{kb8=6C%E&yah8i$VRg-gEa`{SoM{(
zJMGATeC|8(e=NOpR{f8sCi1Usjo<gFBAvyj`iiVo6mb@AVd5{UDjT0aJDbSAymeN7
zVa?>h0Q<r|U!?uIjq{xkH#P^SCOg97lLp$ZnmkBM!23Tsc`(oXX1*${j4zAdehoU-
z&9bIsU{k!2=f<bJY70IC^P;);bO$+aGm1yOAHSXTjhyfGuKsfI2;FHt$ly`&T5^Fx
z$?fbledSLVVo%GKo-ZCS@~!>ysP?I{kFP8|Al(}-^km!pTVvUOzCi1)jBC4O!F8_`
z){qZbRE<8Xjxz5zd;F3Te}I2u`_ivJ59xB^4lER-i~RUYSoUXne4Zb7Y3iR&ZV2CZ
z^Pax%z6f|}OY`ctGwU;<sT1!bp1azqoDv<=Hf#K!JX1X*k8}BEh&~I|M)E#%-xl(w
z$NTmq=k=8WA26s*$%@RY=319JpmhmzX3(H=mKqNg)<A#7k!{#K(5mW_iw9)a7#=3(
z3eKv~9ZviZIl0^aqg8ElZg!~sAh<yPEq~KJNnGij3&wNC2xt3t(U)W#GOd8xmM6Qu
zhfEubUPj)`I{V18(QlixzpBuA%1;VezRgdw2g=VG1?Ty+QJ{T2v##WuHg~t?p*o68
zdX+Wev6T(8#vFMT`ChhUEHy-5p{*J0Q#@4J(0!qMvhj8E%|ZHflB*k{i5Ukue-L<q
zUF)69Yr!|CnzhZ7%t6_i_;grCfE&+7gucL+!4d0^!coj!Jl@KQ16Jm;p7X$qDd@-M
zwDn5=F%M7MHOHe<oH1>zr-Z8W^9uXxLk9L)Gnni9nQQb8c2CskCawL9_i4yID)^t|
z{kiPrN#3v8uTC%T);$TX^gin@s?pS_bzNjqopAeJ<1=s||4#=8c3)ih2JS_)73I2t
zzN~E?4l{p+p6<S!xQbKf@y>lqBzt&wsrrs(cT$hr{2%xJ|L5QNZRmS=j<t7plSh*$
z&>bP<FZG(zA#+|3HkN}P38{Wl@(}q^)ayvP@bVhN%L_;GGI|R*T1NBoy}yfP|M6<Y
z&6)F~>B;c23ojo!4)2A^s;7DU?AKwEo>wg<d?#|YLah0R3jMkuI!_u~&G2+5%%^+`
zaQzr{p2jL~Lua)nJ`>YAdLVH#Yq&E$U)0GOikAcE9*_>v{6#ij9$onvu0zhE$mT#D
zP35yEtTB~@R*8QTr^Pn<+wSB=2mLcK56A`-yn^4z8t}n>uanq-9=vl-1FvKB^v=vl
zga0DInEXd#=dMd$sHu&$3%r{3ad2J*?klv8mU<rA85c78pr@9aS#v`r%ttA>FUO9L
z>f8s~*qY4jYET>>zafxG;D=0cD!}m()ivh52KFgodn`*NrcrwcdKLdbqo!6Cc$k#n
zoHxZKk`M1{;0%O9?N^%gkg*kxBv%hM&@N{VIDM&A<nXN{R-U9b9A`G*cdbmW`BjnT
z-uSldVd~-gag!ze`c1!M;>~Xs#TT=GkFyblciI1mX`CTm>zthv-zn1hlm1zh(EK~#
zxhli>4W1c)hVerO<bF`E3miZf<d%d?Zi(I%eZSxLHSTKcx0PksHciHko1d66cy+Yj
z-KcSzF*4Sed*9RX#lR2j;JVJU$HOZ;9%~;Lqx>HBbDy2ZBdYzw93s0zp6(OhNcZg+
z)_r-<>S=Uepbmb?8_|84=V*JJ)qO_h`nr#?4(mUoudEIPC+Mt^nn0{AhBz;;AhQE`
z|Ao+0_#9t1;B@CP=0WCHx~vpkHUnLTK1@u%rYQAK=q~IJU^M#$@i*q8Kb-Ju)CQai
zT_D?dR?6Jvi$@YSH#8(BjC<mgc`K?eN8cRucto=QRM@N@w0RRJOz!eB_&ol<iQ|le
z7dZ0-Jk~8k25{C%DfExeAHwGkRl+M(;F<j85c$iYqE7S`>oCxBKzoKv&2`zQ;HfUn
zbK$6scG_s)<cZTBbW)a~O=ybz<q-MH&>C%mKk}DDQDe`LgAh(Rle+p<>uBkY&t~9#
ze#cw!QP&kW)P5tdk$OU$7dX+>8xwED+$BpQgXp$#Zx$)vj_;$Z4oQwI?Tlcrc)5~J
zDfb-qwFP)?e1qhVSa-@kpO9agIYw^E8iVHzQwPShUHS>?B<=}sKt9b8Jx~XQd}OC3
zwHSWH5A^!|`c1~K!Olaj7beCZH2a9bLkYQ|kHN#5x3!X6$xfZ|$5~x2bM5t0k4~>(
zPRfNpc&}IeM1W1dkqPDUIav?3c3FCSEW33H{E!0o0iAma4|E9M;=%t4&P9(sht4jp
z{YK6@)<(5I^wNKIK8@aUhYovtb|1LI%%xeI%}#EdADY^@pndAZjsSJeLsR9G$_CJQ
zu3AkFdQ>(aF-vRn`8J-;J>|Et5u)Uah;Dp40UQ@&7Z#Y92>BxZIhAVD(3dCs2chL+
zXuS-2Huj#;wa5(VUdaukb3MCRvSYNaHFk3_8XhG(lAW>av#*~)c9i+HvvjI2Kcsgp
zpBBRd_(vgQ(?@pTJ1!vC?@{d1R}JkcmhhtLbz2*%6r0rKZ41AO9grjXS@Cyu9x`Lf
zDKdk6fW%Fwl^F)E?hA8d2Ji_k_;M6Xqh*IzTXB@X@ot%W27e>C6ujm58;h@wWw$(T
z@z(c&{0&d$h9qMpb7x&S>^IC-Zgk^!3Twh|<Q2x>xV$LE9y;0n%<1Ix7r>Ke$Cy||
z|BPXOHD9@Z@<oVmIlez)anO=$cZHj)%fszKtD6!_B)27ptE2cJ2oKFKJX>%54s_MX
zJ}LPbKHcT$sx#qj{b;-;&W~j`-}Qe9Z~6aCc(d`|_*MT6c+*~})9Co%JK!xiqT}z`
zAIomi`jUwWd=Pq@+&3nJJ)9q2m)VDHT9`T{p9~-N3hSex`>QWetsk#uCN^>Y=cAnI
zIu<=Zi~#w5ShjSsqf);IXU!-ME1nWxcTEwsFhcyHyWDo4-u~;fljn@4ov*zd%l@d^
z;$U_z4&;;jvdWiJo{Sppo9jK~tnuA_zg;|Y3a>mh>_g%=n!J}L;&o}8qq>P2CGxjd
z`@ZD=dfEDt%9pb7yJROaFy#4=X_IS!?<hZSAv(8;{Yl36<Nr$Q_f<(I8o!TzGzR&%
zz=%8>i9zAhRf6N)o^4s(VeDyai7;`IaC_cS&(^&AY3U8#d&=|QwtUXMzkz$ZhQ~IS
zm<#c2-YsUW)~g#~&WA&u?6WzRjM0oW8?k=#m*28uU2Df$j4!>~ThC0HTnjtS0c%H8
z+W9K?)&ai!q-+n~kzLXOjtb0r7rH6t#_!U;Xlpl4X5Wfqa5Dt``M3d2gBxHc7wELP
zzU-mV*v)!Aa&F&<&mkOzYz|3lx5d$89*#Dj=i#U(EF5|FHVxT(qHDk2Qu{DnBWH~+
zK{hI{8K2kWdPTil&?q*OV{N7?{6u2|6CX6W2=LDV(W3e}T`Wq^1mEeN>Aq}&;dvCj
z^j_@M_R&0o8^wkEm<M@<MY0u*?TMeI{S?Ztjx(o>>$7$~pYrDC4*z^8)s-%U-;P16
zsxw(2A5A%WioeC&ukC>U?7lg2gH@wK>)p_z_7?jwA<?rL<NKI5(Frm4rK9y!&3xvp
zcw}GW-@FtVH1n%Cei{3kw6`!n-0Q`o^`7V=`5n$72M_X{bK^wtc`5dxW80W#eX)1j
zRn6dDcGcWaLGqumt7KncSINEtPQ}+2<-+O3BtzxMtI&wd{+rLnvVY&{(SP8nTzTco
zs*#u^J_dam+CGCVQ$3OR+J{&h`Z}@}{XP=U2sFLlct&F<HU{-;<XbDAL7Rn{uft2<
zH+xH@TgtgtVB)1QVnt0RADDHNnx&p>xl8+u8mD06Hg=B0H8TsaPgXI1Tf7?kG52;;
zThBXp#%ZmdOq`{pvLX4XiQ^SMFr9cy{q!e@K^_%-7~cfCN`6;<(a?DHFF668^ON8E
zcjO{*6l@ZY_d^AoEp$>bY1ySF274OY4_aEUZ)AV^bLGchBrg>=g0{*vccK@@_?S1w
zMR#GhF7)(RcJ@dNCcDkj%e#Dc#afN;{`|1-eg?gc-!n?DFB%)mK6R_55!Fo`j$1S4
zGw8I@zI*kjp^LMii|?FD7tT)6ML2y*oU88LajwQkN7Ds#P+|K2G;smu0=wGC-R{3I
zd)pOfBi`-R6E-;->%6!?{Lu+Tsav51&D|DvfW2ccSlho+>%MApcphofpAXGNZkw7j
z=xn#0gQFTl{Jx7NuVzzgc$ek@AE+X-U-AxL2t6h`GO;h>J=#BppH!91a&H_l7Ggn)
zo5kF_*V$UZifIi>=Ap-^t(^Fn2WOz7Itrb=THLVm3iM9R<weRD!ggv)_2!v<ap83l
z^viGWA~vSIj8&3*S_{IL*>A^MpJFeHXfE6ysW7=9z~<4`SDyCU@z#cZ`&qkQv|GOT
z=ZHtvrkq~n0()wQ|8J!BPN850fA2farE{~;r8-NgB<DBrJ@=s6kql6+AGK@v3Oo_#
zD9(V-GsVu#H^507CZ`wNalXwxFKOJ-Z)dmrdw}5|qkpw8KHMCs^2UBA=Rdd=o=%O}
z+`l_*oe{VEOuY5}eT`7#XnS$t<FV|MV?Ev?NB)EG7PjGO;>UgOSKbO=qD#qI#lVnl
zS6Uhg_vdLX>HYD8wW(){*VJCB6IwKS`0#H={A>3q@cY<^ymGCr@(1)=K5>J5;s*I9
zZs5zSp8ouz<cQ2t%wUwCX!Y7W@R}2E{9m(T*}r?z%B+*Qczw5C%V(V?->#?TW6S0f
zFUU9Xg6i9H<W}=2eYT-`TnM=p8Xcd1A94#>SYYh_=Q-=b$gq5Jt6BTwzG%EViJSqR
z4EV@}<y0A#S%(Z;?a8ptaUrwsp7_`R^&v`a%=55huHAnzC|#V~f!%Xqw88qA#adG^
z>kHGPPuTT@Ba$uD1adlW9`@mP85xZnGw+t$wTLfBMiYb2S&I-Yv7an|Ww~U{*NAcD
z8=Xjw1GPToFXWr`g{}pRk@0ylbp+p@FY>!7mi{V41IU<)<h}Ls=PIa)XV<OFIl5(9
zQ-Gd~yw+MquB?W?%dKoK)I52zIlHJjV0=Ji^r%`lt%{>zm$D|o+V3xoZ&4n{kHUVg
zlI@KDq4hcPTn?|Z@Eyop0e-z)o{r3M&RkrBjPY#i)*RbfXZ2az`ftwj;+pOO#+5Hv
zwALcH<x3z#$^CIpsve~7^>mth%9qf7kz&ubICBje$#bJG+9Qi%?p?}lkiEKs{nciD
z&Fq6{jx=hG%#(L5pH;u&&tcr%1WvP$VPCjQ)vuoE9n&{3`0ru6mH@BzE3$@xZOi@^
z{6N+)ym~mEtbAYbtTU`3aGv)lp8o4}Ec^YJt*o4%%hSMl20P^4zO~ld<g*A@ibENm
zyFzwWBo1Ce^l9Q!$iYD?)7Jhsj74=Oa^%zPPcxSD{s+g>e#%&i{u{^AK6)$*4#l$H
zyYhc<EK5g^<z)Q_7|R)Af1y)irVB2JWgor!e{d|zM~~%1eDqjYt0q3Ic#eso_oI6+
zCdNPvTXcIGJ-^N9d0#gB>%_Ob+kTGpd3t`;ccE`%6Mf}5E63_qJ;J@8ux2X%7+VWF
z51HhI1grc%Y~&ZQ1JIMFKUYZa>pOiPhJQ}^cIA70EBn~i!D_Ph)yR6i#f7o2v|cYC
zSL^k_@!sq8A?*pxiG_dZ%2@Wh{YE~o4pa$Vf4$yctCudKzKmH9_tz3m7q36VJRJPs
z^KhrH@0M#GA{pkv;*y#^KlE&P>K*DHu?_ZG`t!C6xom8B{FZ#>Y^oM(-y`I=e5U?r
ze?Bp?H?j-$U1EGVJnNj)g|elQbBp5ZuBDx00W&Y))YHxHUYm%djDB5|$?BTjn=@CF
zjh#o^#?CXjeXorXtnAyIt#*yx0H3C9`WV(5%$;aT>oQsk@z-Vy&7o^#d;9O|J#6z{
zPgmWV28MaVF{Q0u+*5iR9qsMA_G5wU*^jwjG5K;@>*Y+5GV1A+D)xiyFV=pc;h2k!
zUB=vhSMHwYx1q~yOqKep<Y}YdWD7|D+n8!q%)O!0i%SLkIAc9Ah0kFF1&BqNnp)U-
zg|da8oJRh7d*raUw&~VNFL#mu&l+zy{^<|3%6I$Ly~K!;|37>00~l3x=Y8M63`QEe
zu@CLWmg-PJ5=|gL#K|8ZAqgaeK!l)JvB{8`kkLsp%^wJD0y9b4m9E_fgl@6L3R}}+
z>pri2*S>3?MH{P9-KBl#Q|scE+OSf^ecWBzbz9tG=KX%pId|sHWP)_xz8jxse;01<
zz32b=oO6EXcmCWv*st~w(mGP+@s9Dm)PH!}xW(@nXVg$GRp7l1uu}RS?niN-g*ixm
zqdTi?6yv$$)3XnM4f79J%iNUbS`M`@pYH{G-@tsvD*RsMOz0N)#)i=g%NyTtE#Lha
z{LVAx_&M*w_s^kgorE5U{r(7J62EZs{QiHyzM&gjS;(K7C*1#<D^uwz)S>kJ@C3bp
zIwJQOLBBYGG;`jvM(His%j6v{Yp#oh{?X_yMXU>~^WK&+^L|we_9w*jzUT3y8D^aJ
zmhz9X)pN`)^PWY^t=?u;f5XPzv+#QgdP6SO05Na)^{1hi;eDE~e}`p+>$kMKGR|K=
z7O!WRr{o@!{%4>Qa^6zUW%9iu{d*RuKm9+qzX5*t)fnev%&qrG)x|m?H}$+9>!F%Q
zMn2X2AI3(kgM1H>byD#{_<H{DAD(BPRC?_Fge_$UF&FfhZVOv`Rk(DIJnA-<ey-V`
zix}WHiswLn<6RToX0Y!7V`=q$Ju~-EdIWP7oSUG&i@6Ja`(hv3F6S?hmn->Ris~a+
zR>!!G9SCp^9pe~p@fPeI+k@|0&)I-|IjVl<mp`SxfBV+JNAVr-d+}|^uUO|<zp#HV
zhIzF&DOb23!065WsH=N1PnT`#d6n7|!1-LY4tq~6>jlO*W>3Ia@}7V%tG4kl=jV5S
zN$p`fsJ@x`5M(3j#_m-=hD;d$SN3^$KRw^EUtl)sgmb?@q*T|NezJuuD~j4O68wh1
zOnooz5_1sTJG}dIul5bh!8a8xjHj-|e&Q{Zxv^}9$NGjimE2|69EWkQ59Nja7Tu-i
zI8dhN*;k^h)NgZfPdoGly-x>wt?FXid^AHpUk;h{Gt<vE6ql>M-{QQH_b~U#p$x|#
z{t0C{<v71B!Z{!I8QAlNw)qa;6H)zwUeidKQ=>au{(DF9JrM1Ozd^`#?g@U-rgXZg
zcO#vw<6O5zyMLDQmRumqu@|fD4O7;0soOJs)Y(-%hu=tWI`+>cej`xzjnF;l#@6X+
z&pylO?uXHK&G)(S?l|7tR(sO$&2@YuIXBXR?>q2)@4rPG$NS#>7fLzas~IS%V>{n$
zey1lpg8XrhGuvh4yPQWaJBNLv*^wCJ0^SiHxTdm?ds!hPprcrgx~=+r5!ONMpV9Ln
zZ$F53#CM`|j;ui2h5Ro)W_e0aTXVl~1I8tXA@eW~gWo=%%|1YniO>ELZl~FO1>9vB
zH@OZsKcM}ez6PBj5k`^2{?BRu#TnKthkd!j{`1QI1}n#5zt&;juIyLgw>J?!(zlsu
zQ|VBB)!BM7vG-XknT+)q@9;7|-i`c6*kz}&3&ZY5uv7cBAs_VqJMFI@cHc%jQEND8
z_xv5H9KELpds*?F7IXh7%Y*at-j-#LQ&wp1O>b~L2=&K5$g*XBgtEoE`c)W9*9@UP
zKn^!R1~;PKY(~A=f;!X8bt~qRc?4(uyI;CIhRFiITOP2}fw6VJ!|mKSkC9~ujN4*6
zop8Iw;WpRd_ONk_-&&7(DRXdLYwGQolH2GXl#au`#_Vmt{H<$W6n)bpxefhKeJH%(
zTFAfq)6R{Z_Ks4IviG5HDXtqo^o8<$ilJjJAMf~MA9@sFaz35BsDDu&K`wEf5A#up
zb>0=DSgXexN9ij=r}572eO&8Md-0m*qi=oam*74Zy2*VEM}?VZ&7^<m*!L+Jhw#|f
zk@wKgRh}c4$}{uJalmEf`OV}!-wFNy%SVvsW|YUjJI^Xl;6oNh7OC&HGauOB_=L&F
zqX*`Uk16@=%TVjr`_E*|W}i!$)Bh}FOf(}~>61sW?y0^Nl!5Ziz})}eSD3l>^VI9q
zH_jilPU7C)-`~&uSm;ywAj=CM$gr+t8&G{r1?Jr{tPh|K9rd2EJ^-^T)c000)n4H%
zH|3pKfqps@y5D@9g%7UA9NJ)PY~j6XZ|q$7nOU3*9dSPTEQH<vdQAiO=0Aw}e)QEB
zReM%CTIrj0v6kA%SD@QcrYYV3uDd9^Bgn%L^USt}JPsj$Lr-U*-ryT>b23y}53HzT
zKUnxcg>^O3i0_=o?!`X7T!wG!JCPUIH!UCb4!g71ckA|iN7UP_^u|NFp8OW?Y3Y5b
z?E6qZ_<NwP;%dlfH%_ea49vsteL-Fi%>7W9^Pgtk6LYs%b3$M70P+^!TfJ)Hm>K)*
zr?by|0Q;E`ZWhOg-iXV>`VqddiajXvAp1X~*CjUvUCY^Ss6%7FT`v2qP4}3+sKJlV
zihMIJ8?oo?oip5n%YKsek-Y5nLbX=t=x3SE{_ig#vmVnv_M&g`Lmu>?Z)#(|spkmr
z?GcREp-Z^Xhc%!-YD6El8U5ZC^heEHkJWuipn^KJ`c^Py&G@1EWuC=<=F9uhpHQ~!
z9-{6v1HWyFF#*1HzRdHnJAHZE@EsVMPir&g=R?6)pIx};g%x<O{TTaS^tJ7f1N^;T
zd|R1yYT8`<&aw+_rU!DjLDdPQ39@(d5YhzM+YH(3M_X!xTnM2Jg((Y`d4`*Pc{_fq
z;^SH^(oz24jGSej?|<8u_v3FHbL`EgdB%xQFzdF3dxozo|H_P`s*Wn%rTo#l*x3QC
z_skeWpPha4Os-qaV1IB~>47Yxj-k>N3eNwFg?m1>2{ODW6wEuca8LeSxX%p*uP<7-
zr{c%xn@+O4*=Hzyh-nxpZ^ZX|%wCik=a@F{Vd_Zb{rG0>13GP2cu{uQ(Q8q^FeYN!
zICfXOFm@+1j@=KxiuZZo4t-Z6>Pt2m(mgriyKWcAa$pVCgTZqkufbbf6T3iNl4C9I
zTi%C#b7ZW>-Qb<b*PPEU+_U9x@NJ1Lp`iQ63->JkXWTdFdeU+Y+a7<9P_@gJ3iF=+
zrngmp%ekJGidnjCZu&*t_@7o>E?YZ(rjK<5?csDN_^lr-+*3af<H}*kJBuup9y+r8
zG1h6$&DeTsUF?58fN>0TC|6s8YuQP>CtsoGOI(jCd2-kt@eZ%Bydy0b)BW9#9A-J*
zk=vSeKL74J4s(pXHw_!}BM$R??@03##(a;%yv#e&^p-LIq{F<yJJMKa%<piRZ}E<-
zQ++?uQ{gZVAspL%p2NJyJMxK;3Fqq4a-%N}Se`Gg!tZ@Oh~KOsC%li3IfK()>Wh%c
z2>WTHs}&{eSM)pVk3i4x)WvF_!~SpTqGK2<a7+NRJ3g84Q*vSVjA#1b&tt+3ns5sf
zZdN?z2)EYQ=R53=IqdU{eXhg)d58U##@>;y6(<w+FTY{zJr4h;9QH35d!?glE-S_y
z_Kz5Qt>Y?gE6zFW_ZWMvBWwE$4*Q_7*E+VcFVA$?*Bbk*MEc5SIqdU{z0&g`BRt9u
z;b^`uU#Z42YM$=}Gj5yqBIo(|ekI%dKrZI?R^vU!%<*v9*tdQ#kXO!i+APlPHNRdz
zkH3GgX-(u>zWXvTbEBFQq)g#lAZ5uun6rJAKLtO~*$}4Mr-J_H0{gmsSa;&SWz6~3
zupX*5I81r^bF&W%->rpw<2*oJ?1f@2$1)C5E=4g98G#IAIuD;i8j)7YF!l?FpTWE&
z(#-TWzK*#_xbOddX<zY7{r=fr%q8u^dwrCBjGwaZ-TI19@a``!+;h`w6<>M#P$;+u
z{m#$vz3R6whJtHeT)5}Dg7UBY){A-02w6~OF&*BP75Ca4?eriG7s*Af!`_H=Abu^^
zZiP<%c6qY@<;O1Hf5Q*pU%g)lJp|*?3vY#jGoM<x=P2gb{_PN+&!&WZ`gaH$-<Z1a
zu*%aI*6+Y^@7<91cyCgd-`iQLOpq59rlSsc&)NM$EVj2zk7wCOcw5R(?H#xC-hl5c
zU#MbT;ao2HVP5tE_dD)`-Ve8rvp><C*5msZ7jjbEs`tqB9B#S!cJult@r~{C$$2i%
zzx+I}$Nb-K9=k+5_nP!<g1dW-zLX7Fmwo@!*7MMr-rD!Hb#&hu>rs4X?y>vlSdZUd
zVLfrb&pLL0)Ed42i1qCKXRH&@pH4!5dJ+25Dd<n9p+Aj5=Q<00>m23|p#N5Vp7Rsv
zkB0iUW347Q9IE)rOue6`8Fg&9teJg%UF?l-tr&9;((T^e)3Kj)X7-9vttXVevdr%t
zsW`y#^Kyg(w|UV;Lwh*~2c6!<zOFbAd%))KTQr%u-aYQMkk4w2xg25E#cq8gf-vch
zd&7$JmW91T_*O2yVTE}e%9XkBd!Xbu%b;((_$|sKy5Dv7uh3Uipgo`aj_OZg7TM!f
z@(Sk9mPR<QckV&DHT@9w2(5H^M^>W#p8L!S%RNXLMtjUzM@n;+4KrSTJA$%|aU;Hp
z<;_X%`b)YoCWgCRfiFAVU4t~7x5M-0Ew5)fG4Af8TkpuKxZ4%w%=3>`o|!JKORdCQ
z(YgBm9`<3GCnBHHX-0a>H2-t_whrya9Cm(V_rd-SW%sDV4&T6HxxN0jp2y8R#k7@t
z1n-Fb)|!j__6(f;bf2A9ewPYq+Ej8__sg{V)2~@!JCDZxX3R-uFSj&**7cI?xgqLp
z>f3YB+fc4}N4dd^?@xpA>jNh4D%Oo%ZpQKYRY&m6f2M`c;1en?#_yobvF^iluKH#g
z*hhRAhtIM0LO*(%aoT0bIKkvJ<7ED*D>~x4%EYJpOf}b0nZ-QU#a{aY%R|?hO7#v{
z$(?*R`LzM21w7i6ebs){smi%5f1T(5S>Z4*^p2uUj9Hekn@792nf6;nJ2FDr-HCcv
zxf$X5b>H~fl_l8~2UWPPA;uTxxBlv4zxd_EyjJ$7&+BV*bY8E(cmnM(f^VnRR^oTs
zD<9rfy`N!?sJb;=d5q6G-e2r<r003Wd&-#aWW8Y-mK}~o;P*NGt-~u^tgFR^s51@t
z{r8VAZyu=H*tg7zMflE?dbjjxs{uSR`P*j$i}CFh_IVlBLC7DB8GhuB;-2|reL{Q}
zF$S!H`z*Mr;_rvyx^@|+rg6oZ)5)K(Ea(>H;g8o%xPzV2ZOPU<T;)PK&m)~5)$@-t
zs){dKo{}xrT%_$h;!tVYh4Nq;5q87CtDi=?F}}@Ux=ywyI8+sRN2=E9cVf@ldN1Te
zRU^zXMtl`<pSAT~nnz&1*O*t3J>L<h+=(2`$v5VC%Is)PA?uql`ylg%Hr1@^4C|Mw
zFI5Mbwz}B=csUCBi1t%P9T_q*To+sWBUMMVyTfYV?3h(%+&_Z3hLm<ub#y{qfg61P
zR{ee^?c(hPW|;r`ndawStG?lh_Ehris#E+1B<!B<@1jg`=j<B!rkWdt*{#vVX#Xfr
z=1H~xZ&znBT>4?ys!g)}!yViYm@sBL!ni6;7=@PzqgaRG8dWj`X~Epm3k)NA>(E}i
zzr}pWG+PH^++?HdoOy;B#_|^Tm{OjU9;!af^isD*nC4p|u6xyYd>}jOV&9#ob;4;U
zsSlF>kxHynq3n+2V!aFVvyrH^cT-;ETFR?|TGanJTx<B@Ri=Jn%vOEQJ5t|FJ+m(M
zgKHAzcklI%+;!BLXFv~#_fbqY+odYY;p(>(*O66PuEJei?92<46VWF8jtbmTH;w0=
z<_k>To#rs3t}?+rb?Blr<}kzjNA}HEsy(v)eKRqK(9AU?>#ZpC4y6l2_ZWokF$mpb
z5W2@8bdSNPH9830V-PyZAoPzR=pWF3Uxfa9Y6$uV#`j|w+n>c;$vKSU-^BR&Jm*R{
zerEU>LnD9qou@r+HMT^1n7e$8vb6R&mKodI1RVkT0sCsOH#)+J&#V3d_0;GH&`-y{
z06proGDrENT+j|LU~Dk<vYw}$rsiB!+Z?XG*E=%rEbM%${V6?Tp_gS<GS0qatQO^d
zfOa(Vjx4Mx#kxGq7cKK#uqboX`Y7rPWh3hZzpu8;lVM@pn}O%7y4c^mL3u!T82@gG
z%R0D&om&5Z`DWV3`(SOS^dIn=uD&M=d+$i~0VDHV2)hCPKhOF!q5iA7^Nvf^wPrAA
zsUA(|M(dqb`2HvLhjCpm>7MUBwN%t#F4JS&d`G)^=S}L=unQaWBgXtiZN750G2dg%
zj~R2@{U?q2!^YfvE2HWTV}748KW4(IFy=kR-0Z8U$}{F$w0WiZ)@{|*#=Oe7H{VOG
zeA}4kYx63zm$34TF`s3^8PoArzM#!7UNr8{8uM=%^Rvd>yt7#OfH6Oz&8y3d`=~L0
z+?d<(295b4WB#ylf2%PcHs)={yx5qBu#W0k)(jmUYpM5FxQ-6i4TtVO<2u&=MYA?}
z#&sHc(*e$lvfsV`i0kqDpLRXb|849A$#9JhEXDfZ9M`i0n>Y4hE&X|}|6z~PN&TC3
zt{3^cc9@$!yYFe&!F^|3hwjgC9ln2#>*4!-u1D{Wx*pr_bDh8%?kUJo^=<Bo!5I;?
zhYIo)`+Rz}t}?^BY!u(w^FXKg;WB^8qE+Ps&vy6in)k=3^QZrn?E&>Vqx7d(Lxhg{
zg&SP=sy4>?xe@5*kh^SeTDN-s5y}kup&PgzR`HqjD%DoASDmPfJs(y5?rW|{BCO@j
zc380YDf_Rv`V;o6svPzewEyB~T`C?Oht}m82mH@b{*SwQ9R8_)sI<a9L;1hK6?WMB
z6ZYRfqwH6?LJs>LhyBwgex;w9`0sVtAAwAX&<*{6ah1z&+#Isq;CD&N>tf&EY0{ze
z598*j?FROD82c@bbUf~`FD`|gj>q#^*JcyOsO_d?lyfcLzk2IS5mhd<|I_2HM(X*t
zo4VNXUoLOf<EfJFRi}~O2D-CloGRZ4<^Ay&RC+$^TI)#9n~rcEG4?ej2Ue?Zm+bn?
zSDo?fG5M)V_+LHC;Xi2nmpkk^)->gIyq0<n-IRQLbw2V@rqT)h!*;W5Or=wmKl0%%
z{^!-o4Zq`TyFos5`G3}>=Py-VUcEM9|J<47qb8o0RyU)b6{>ii`wK@H&pm0<n(s)f
zqmDfHpt7Ig%B4NS_F_KOJF<E&elO8OeFwjVzO(euHa*8Yy!sGz7d;pI@&I)b@9^rQ
z4zr*!JLWLkWONt0J%O-a)MJO2m(iT}Fvs`0+1_9NjG2p7eI(nsccjL(Y?OWb%U3b2
zr3cZ*H=~Uocg<z}Q17mgJ@m>F%Y%CKtSbLMo#FD(E?z&BKK|^VtNh;Jnyu{Ya@ThI
zXoqms??h7XRIIgKFYOTKEc%O=leV+#f3^zK=CAFR9r5ZhEBQj!WU-#IoRF_9hL7}K
z6ZK+k^NVJV%Bgq49BXU`qtMMJ^taU4FyCq3Me_6ABduq-&PE|?wVvfVGzfV+2zfh5
z*$$aI2$?$w89oRZJ_tEK1R0KfH_r}1b`L=oW8ddV?D>2Vdsj|jf8uHEO&m+ovk<4!
zv!d9uav0yG!`?0S3;1o-D_Ner=iCEi_cdm3VD=F+Zs)!}%4~2@^TpijR~LKc8qU$#
zewk1BpOrM`fIZ~=3pzY&@2<Ij+~++)efg!g>6d=E2F&?Xd}H~=`(t!Jeu8{-zqiUm
z<`WpgUiXJ(rvD#**0^^WbJPEiKdQ}Fn|{00^#9}h9aR%YY1ZW7mzw^6+@Ek?lXD68
zrvD!=viIOYe;wM7y>9(q#=f*8dXEVA<V7&=#{L;|a{Bv<*qetrx*YsA;RA-(x!a%e
zEFI$h8`bX={zSj;nPKtW8TI}6(qGNOx_J3OX-xytbRO&E%efzm?*~WuJ*8oce{aCL
z=G@p@xVmt?fNLhM7x~T(*2YgO`O%L#w?mX4HAVV+SWhow`ItIdh_z#TEHD>3y;&nq
zzh^I!p?+^cl_~2r>ofge9Dp_TiSOL2I@C;EauwEpF}88GBcwr>XGw+Ddtwn?o;6j*
z+?0Q;4ZKIG3$Z?eqj$xqdx-lxF#lP|y?>Ei)?V-M+z`s3XfNg>z#Vn{?+WyqoAm@a
zl#YQJ<foRU&>5aaTN%S1+B53?{VZJhJxuIXQ}5Hv#+7y$2aI0D`hh(Ge}H|V>bnoj
z3x01@jg{>&cyT%2m4drvp3U5^owdx9$!m7;a;%Z6^$d(1u!ezhc}vR#?Dt{%$q?zr
z7|M$=R2jxl<!sxAh1p+P{87W`L{i-YbLNqC3;CXl^v)i70du~CmU<VQbxXJVm*<#z
zr}d_Uyt|j<FZ^!KpF8SAZc?3K984qPK>Dy>Lhp@9TNl#Q0e%Or^vP{)kWXQgryO0r
z-dd9<d*4JDx@U9$TS_-Q0DU#WZz*7XDGTpgWn*vsF!wk^FTI!h-te8@OzyqGUW@yX
zw?2jq9k|WgQgeX%FWV;cVn6ie5Om_O(uL=^dY}*Y4SX2-u+P>1XGdIL`?E8yZw#Tm
zLf)EjM@g+3mwq362(h1!GD`KE;I!-LH~V(I!7<&bYCX=(IGE@!Ip_PgW?y{9!N_;@
zyFA|En$upN{relY{E~H1?HwMOcY$?K_q#6^L<jIK>RsqZ$I-^_!MX<A4Foq|Kpo8-
z$isel&LP}W<7ImG!L4_Mb=bxC>l?rg^I%T~7CwMFj(U#%3Hv;z@w;}}`{uYZqjOw`
zxyKgwv-e^T2hJS0%UF0&x%GZ@HQt}fz&f4>Yc8YMYhANp7Jhp^W8aM~7tTza*$Cs{
z-oJKP`)9hc@T|TSjr|4w*{_>@c}Sn`Lpd+VZ+RX23F}`Z!*u}tTQlnr`Zz!OxHj~0
zA@p%!Fz-Ph*M~l?AAMW|ecUkmxO>sZ-G@GIFWZ4i+Z?3LV%nzRdzLzFOv}ERF4z7w
zu1uU+xX-@-uU#mEcs(=Y%bU-zy}?}75$xMH@6X;0`LE28Hua6rQM8{j?uAk^Bm?^K
zDeQ^zVQ)R&k>+<eS;r`I24<uFpv|JLjYY4+9!s>{#_@CGUp->2!JbRCAM<{+mHxlP
zcx(>VAh4%;;0}((@cZQ0yQ%B{EoW5SA~)FcJqiAf{O;Vp>C?ZL^pi8D%_<!~u?Igc
zyD||+Cf0;7|L|8qz0V212gG>UUXgyx)yy42oI}V1WzFPrrq;;fBK!L%PZ%aA!9;y0
z5lpZz8~e-fJq$3JZCL1c5|7|L1dJ)ww@N=+*+&N6mf9l2Cb#jabK~5j%6#raS?c^R
zJp&n16veas4Gg4}GA3W~(EHDs_Sw7t2yBk3{psqRKIRW{s1WNp$1qkNV_Ro>AtPoD
zJu)0Zo8Wgn^gdp^&q3XVGJ-lX+C9n(`^)hykG*&w1Yx*MTUK-LZ0mNr$K2l@J*R3t
zui7or#5o-A$ePErzJ0Qn?VoL&`^^&Vyy!~WbB<G)KTW;pWbI`0n4H6j_s5^G`{Q^2
zt_9i_-qD4Q1^<cu*oFQ${WrZ5b46?RvhGdjlM#+Co5g=_WOKik*>;;*jPGP~Oc3)Y
zaR*QKJCLoJ{C<Gyr=8p(2UsR7AN}qszQcxcz?#Y)-A8AfP;CM3VAe~Wo#nuGhj~`F
zZU-4^OwM;nw4A{@<?%JAwf^+Oe`NV6yLjJ*b;sjt&Y}!|bkm_}7x11+=1qsD<7ypd
z`rsb(xuwJ2k<FXgcAzWQ+U9(Q-F@DX_0Ph5k*&|B>Mxfu255GS0nirB-gD%AvNG~U
zwN9w?_}7@OZ&ov1tWVzIoQT%3{|57)_%w%I{?I$(<&QWZPcIq13Y(l%_}}<NBK$Sy
zP53uMS3jN5i`P8CGMP|c5U;K;g#)HuD7lc3v4sI+?t<RJy=c0fqKyx|!FCE6Yq!&<
z@w*-vqj29K`9r?WwPg<F4cgCLx~@!9>yNt3PS&zL+J4}sm~D<ap|=0}B0X1?(Z*-G
zt&4sAqmW@(3(0sK<(J7Z<dHk^juPt6kvyye@V%aqIxqT17uN#lk81(k+m5>M0)G?w
z$j6~4(;wZ#o_<%1VP7TP!#~|4jB@x<W2(|v)hYP>JnO2eyJ}qh*99hR4T?YI2lu4M
zUii+W^=guJkjdtUS$;;Y6ea56<-M~_*{ozsQr&`lMp>XQQF0hMVJ_u0Wik6|$~P@9
z)?AoSS73LkbWU&|uUiY|m^xIG2)}OPI1S;WO&oT(shJR_c4K5(jnP93p4Q=ypEG^l
z*s^le(?7nxuXqi{7-#etj{OJ6c>S+_Y!>&D;v25`U4xu*>fZe?ES`lusad-}>n$(G
zZ@!X&{=Kku$0+}G8!5Ph@qp{3-`@uB?EWWjQs02WUg)gSQS6_w@H_CI!^?8lVmv*J
zwWRAj<^6wz-`K@($3^bOo>ujn-BzgonUBrd{ZL^!zOB5r{4@Ao+99hSzgwMwa56FG
z7+r|pLV}+LrcKqsmi21~0(Y9U<v(eDXEJmD&oKT(od(Oz{Vo4CYxfm7<>g<BJ!Z_R
zus8eBfom&i|FACW_2wHT`8!QHc~l&%&n@dN>b&RQW$au|T?_5IiaHT>3hotF-@eYk
zo<6=yI|q6bzI~0hpO5#jrc>{t&P81d`G~O1sQCFFnrb`lQLNoN-etcD?|+A?&AYW@
zXt(iqYf%PO_WQNelc-N{4>k2A{@yg|c>WOerb%?BD84t!Z~pR|o!q-Ug!icSeVDp*
zMme4{Djv-6@OQjQBbfir!Q2V-%-uPEKZ~+;ch2+P70vFU-L7Zw+kQi*vB&iDm><t7
z{VLpk+PZJalPKdS-@tk%UO>beH@}a)`=L`TZ}pBq@m>5j4aU;5*UYMT3g2s3fizr+
z=S=**)3wigi?7A|eE5BsivJ#azWhP#Q>M&8Tw1QbGe`dxHNJJiaDN6ngpIweM;AV*
z>c;_cidJB+&*#+hY^;3`sqYnL4xQ$>VE;ET=9;PY(^c_(*!_>_d4PQ%2M4gc9G#O~
zZa<V+w)=BqR>hOC3%kp#ljv_wCDM6uCuBYASjg0|9$k-a{9qLE@H_iRhoyfTJl2SB
zTtL4c&xcN;<_Vx%D4iYp9qJdpX`J#s<GS&G{z3F3&hMsJ=hb`CD4(Rg_jgU)drz6T
zq8ww|kL&N6^O<uC`{uZEO21_Fpv?Gv^MkjK=XlkA_Wtt=>SBw(weUJi{q7yOXMp$E
z?!WuhEXYIX!!Gsi5Zg1yon9Zl?UaZ2$iB>PZOqE@9&tg|eK2cZ1;#k&+u@$$ILNw(
z=GBe=)6ZD9pa)b9A)iX`N8X`ZK-Zu6t>q}<0@DMftcPFcxIb28+U2M_^1(-OHsU;l
z^FEwwtw|1d<U@Yg_u+gP=K-A9t(X3AM{?f6c?>7Q%xS}UF1<_3is5h%&bz>qZg{1c
zeJHc&7f-n(B?zbF33sFv;g<H}^x|2$)&3XeV|UwLoM=UfL;F9N<BlwR3}=-)QaFY)
zj5FIES@0rV!cPrP9sk0bgm3(CCJuM>;AVHE?6f<w1PsbTxLUZn+>ynHw4WQscuhSr
zVBj9S;muTYK4&Yt`L1+!9&Lvizllc#M()A+MH6knGM%Br4E{Dd9^<zrE&Xu=$4vzH
z@b|F8D1LjX_;lXqKO1-KxS57~gn8Ow6u+IW?NnWe8=4!!au4RtN;T*6rP4xs_$%Z!
z_0Z|eEl)M)v*wbUmf6*?N0@2bzz4Kl1eXa%1SarzaDoL4E+Y?*!|#byza|f-QqB3S
zS?8WlXQx@`Aw7A_D(d;6knK*h&P&VMO}B%2X?f1jc2#yb&g&K0Zi{V(__FN#Ol=pB
z-)VQHwu{(qop$feEboBr&%SD2c}MMM`>I*xjoQ!l^-^(w!<g;PzUq3D_m=%^Up=^S
z58lYECLIwx!F+a-As)uH`2^0FPS1^Hsp0Th=lRC9>FjjAZ;Y3V(~Zu{jbW#meeb~y
z(jBp%omVCrb`#jsO}VyvnD?p2rSe9%2=nn&KYWhhgxv|=ryiFP=Gjy~d^XI|$|B9|
zCRaLtx?SCrlg^GF@Jp%r>Fgrft~{OHyXPU_Z~Jpc50BdSIuH5rIt06B+s@=6UQc0X
zTUjO#ah~qzLr>V2CJ&AFv-29k1M(N5nR{@~Szhhq-ScqMW42rSs?&ed^Y*iSy;N9;
z|FrGSzM62(+t2n@GstI_l8#G<pFg2&4d)5vYQis13LFpb68;3XCj92qa7_4Zspi=*
za1ZA9q?&ssF@KlzMC@?f(XTex_c~1lVf)z~{j*W~-lXe*{p`Hzx>XQo4u6HVJq?lW
z$Lwe4RrfpjqfRsXK7t$gi`Q4%oYza`jrQ<&j#uYlcu#2iI$s4@PPe=_dGe&1>--cH
zrJ7$VP42-2Q`?_mU1LAnSCgIz<!{mxvEA8M-KP{Bw4d$kyQJq)+ns$i>3P<Ewy!2V
z6WX6i&s(-T`>OdYn7~t)^@6#!JNv5jiv<(<xJ##hK_mUUqa#W6L+4?E-wxY()%jQu
zuiH*LotFjuPBZ)7<mX;KBfcazCQpZKx6Z4{*96XVqxGf*$DHo%`%K*6mu!;qW!q`J
zX~Ajx*?FC*{4I1E#qT59Zg$+jadRoo*;iXP&?&}J`3^6{MV!P9CSN?o@fGi#N9vf1
zcG>q>9$wA(&TGbKDdBzX7~Ea=?(Pm2!rir(<?eQCnvRp>(uIvUo8d1d-Y=fdzP(20
z3HgN^yA7tgyX^du0m6ZfzwmLL&V`Ssa^YCi*geZ@>Y?lO!WUD``8)x7iX+5(F2zVa
znlLBGLR#u}QpjpJ;fTP*Jy<xQ4b$Pfr=_r*?s&MPM;r8=t&<g&+0V|aNsDUhPIKNz
za3U=s-lrayk(OclK{^h)BgI*~*Gviz@ZNb$7FPDOhE;TjG(3hAWn4Jw^k?6Hpy+B2
zE$QxAbB@|}&MWJM^O^Ulb;Y(vI461Uj($U>UEL2Bo;7(mZ@Y6|HOob5%as+}J-8^x
z>E6C~X}ete*?HCSZ;{t&X5VZ1w`i^X?7T+sfcX4QGy8r51lt1F>^CEMe1zYAoT>~R
z*6J2)&i-yJ7wt_AgU_1fqKDmsi|4wd-%P5XhNWuLseTR16RGBWHY~@|*%_AS5nq0)
zeFO$DPc>H0m*n+@8LQyWgEM{kMT%8Ae>Yx>3)3a!Qt3$NK4G>iIueaO`9L(fOPlSA
z{WKPP=Ji<2JX=<197n%5+xC;~?RP%rl$E{y`s+D4b{XZA?SkjTGrYlxsolCwz5Wa%
zi08Ykb>+%d?Oho@^T3l&KJbjOzxMqfUfg#AN1u+rtQALD4kFOcE0(M%#1TF}rk{7W
z>~6ua?e*72wLwnKPs?5}`>Ams867)+Vf@1RvC)XKo;KtC*DfDle(n2buv+0j@^f->
zcG(HG7#$8=wf*j&{`9Ax{s<5C+<&~;8#;bG<jp$XuN|nrM5Z6(;TfL#8Bv(@^A1NM
zLL?z;Jj>XsFbbQ;o0Cd?bad2&uIzI|;~_^4%l3Nv`|arA0EO4@O%$I_R{Sr@rVR00
zCOydN+_;^(2_bZK@+l{$|M>St`)ADf?D2j(2j4rMl~dS!{IlAdHx%-2KaKL*uAWge
z&Dz5Jg<EyxWNCxKoGf+ZBy!kV7ArHfl^f8p<BA7`Bquzmshzl$zDf9)HiPLi<!!OF
zUV4coX54xE5Ec$oKK;kF^W%mvo@bQJm@&gH-mKYWp%dds^0nIkI11yU!`|DB=i@j`
zbr^?#ooDU7pH>cg-tU6{tUhf|#<)u)-+s2UtC9z56!H2%%1z?=+)O*>SX(0eEaWZ`
zAPio4<(1Q;CVkliGR_2P_ZLwE`dQ;I>gTf7?;(ey-!l!=x)7peYisC&wjXcZ+Sb?B
zytUQvGSAJ;=N<lEIexqqt71GDlZwv7$I7RUGHrjYstt+u{u-j{>qDfkY5Vid>WIg8
z{GZ0hQJgrm{qfg+J^soM6VHk@A5DH${uqQwpRs@GmHw>vGX!PNJev4m-|Wqr5%<4q
z*T<96%b?X^!Z%MLyTS4KrI%hB|EG{i-|-MyV?UtlXR=fbO#a7@f0l*!J-hyu>E==x
z*U=!s!rs|&c~z#HPga)l&(hT4ruoZG0+nNeO<z`jyuDgu&CR5ZN)UI~e;gIS<~JKL
zh2Y$@Z#wEfjz$o-U%I%kk7<tAXKOp1pXkq0A{^m|wljRg7gf{iEdLoZtoNfi-~bl{
z4)?kO828#Sd>CGE^5!@Izm&-LX$Ei0Yn470LLxufzCT_C?DW}9`t<hJMEy|yQ3GuM
z*@cA{nZ2d6VWSU~JqHiQ7MCw@qAP$Ye?Eu2US~Ne_YeYEc9S|md1~6z`;pZ!0jb(a
z!C)Uca@x^NPFOu}Kdp@&e^m>&gR>ItS^GF)S<dvM?j@BcJX=Zi1MZ#AkTyxrUdUCa
zJ=0<8kBX1sCDj)coAa6BIiIaoY{+HyOnK*^XK+5#z4Q4v_Hh}3#;B1TKF8%7`c*BU
z;_?HI-dwtL*Qrw-bZ=S9Lnls*lgJO%qfReN$kZQ|-o&#`Z{oSI??e($+B^AL@K4ti
z`V{%ckz0M}@Q)i?J3e-}s`Z%;!5i{7D-rnGMU_72B~*r}v#93_Cr(^=_QWfQ5)t8e
z|3_d$+f%xJuwQVN56j!hkM=r6Iz4<&N<S)?qkZ8iE^t+RR#_;t+}RybAFvENx+pBf
z|K?FUf65d4&{1`#|BSQw>)YnBt*s#>;xwe<au}KC)*pUpg?6I4Hl@VG16Ue56<Qj9
zvMfA>PU+{XtCIh1`bP4<pY2Hg2XN_*3rU6-a^lZR_3>+SwNo*k^qlJc*E8boZFlxn
zrFuNY{?{{%Y_KfjF8-|2h43A@=WRTFCf(QB_U1Wt_z*MZ_T@VJ#`uf7xBc7p>Uv#H
z+`UQPEp~p?^_IdFcKqtPqA=P1H!0H@G3z%e{^RbI|5(Dka`&5rdzGG4`=v|c>9_sc
z={M<$CB?UNX*|7l{){_)apc#SuSoG94^O8jCzWq%dBypuL6GB*oj%*>e9G|$DTi^F
zlw523=~Jgpo!0uf#j(|?6A(cV>^vYU*&1>1NgdSxahQkW5NT+T@eT#bCxSa=<O?0?
z?ic;*sPeM?w5F>btX+`cI3Tq2vn{P{eVot78Qni=`)i@GELT4CGyd+v5X|_-)ASj5
z{+C@QGHZ5Wb2FlDE}U)L+w%3e?H`Rr|2GC^cwvWV)aSSigM>tmv+U>he}ocs!r=sv
z1Gicl>lh#;@n0WG9Gd&Y#R%`XLBjVRDE02mP^e7jC!}gt+#$O2tenMm(zWp}eI(pC
z?%a{XFXF`Bn<H5`u?OhzS)6au37${j9(#=rU&KA9OEAY}mEpwRpmFT^88322uUhMl
zPHS{Wr&qb7*=y<Mf0yIo|1A=F>`7-bzjoC5l(>J2w~s%OFqo>ljA_$d?ip8PUODr9
zSy#RP53;ZRz<-(b!4Lgm&NUzY$n1|^d!1*_$F83{?}qugc{kpaU$9_d;iAP$if&$d
zi?_I>v~1b(73CExE32wkt*)tEQ@6H$-TH=GH*9R&bldHl@A&wgTkiTqQ?qYti$Bo1
ztu1)>J)!oF&hRI@x_f%J@95k4sZaM0?ArZq**<*a&%SDnSYNju`NlUN{qz6!e?9iC
z|NAejZ~s4kX?^Fv{}udxcl7D+J@f2y$G`vl3xEALCw}n5|8eq1|MSN${^X^<J@xY6
z{q*$DUitahnZJMa>@Qw>{oEV>@W0;t$A9|g^S}Jnzr6LYzy8gIxBu<87vCAT#c)hb
z2;tA7Ik6be#q;N@KTEEU#dsFY)#uIgVlkdeKcUZCZivNrdhxpnJn=i|>MX?jkvt2U
z^ttS&Sd3?;Ip8$L^OLvgbI0wm7|%epKD#!=Vmx~q^||woSd3@yCVd8LV=<nc>-8CK
zz)N2^@BH*fKEm^^fmn>^RpziW>Z^#wcy@2pr@sm>vfyl8rO$1vuegF|TTNyr&%4)L
zbrsKhuu+m{Xstd=OR%>W=lqZ9vl(-SJg1q6w)DsFQT15tQy<r7-)6jghO?zopWAQy
z(1*6)7K?3Nsn3peu^7+x`m3(unP0{qdyK^vEZ67471;ZY(>`tlJf8O9F^4-^_yo>T
zoX<PzmJj#H_0$|D9o@Ks`qUgI4Srlv+Ea6wG_>N1+BP+ZNkbd1N&8y=BU5A2unkvy
z>3wPrlZH>>iWWLGhe<;pu8<5<bC@)=;0nn!HHS$9^?69dsX0s<nsF_kniRy>Z?_^1
z=oO~sFdROKD|+UsIZPUM;0ldkY7Ucz0ItwTrsgnd=)x76(9|3z4Lfm#_BAz!Nkb2=
z&<3aGFlktXE41UOIZPV3kU!NjY6;SSQNh$4hC>mq7?n)TVbZ|)QH+G9<}hiv8CQ(R
zrsgndScWS`cT;niH1P8v7=2F7VbX95t{4qZ&0*3|fNRs#q#&-tc##Ij==47}HHJeW
zu6h5lF(+a(X}Akl%tB1fVbaivD`rWi<}hjK#T7F*Q*)R!+==U_rzQpQb`eAxFl#k6
zhvC3=RLqo3-GTV8n&OivxE_Srys0^u033JYTr)K(h}X&aNCRdur{*989QWYF?CR7U
zDg}6jA6LxiPR(J`umxAl8c)q((vXiUW}c_!Flpe6C@ZEW1@U&l{WO@7pPIvPXvejF
zYElsAumEYmD#X+sh@Y=6P1(tuBYw{mpNQTn!#UMuk%=@+**SH!Fga#0;Qsk3JDD21
zV=`?jPm_jBq+!ZVlZFhWVaiUXVLB2pm8ap5jbu#O$u!6z1cX2`0rV4SmKOK=EJ(Kb
z&-VldH}d??m-FNtgTYNalTH8gJ%It+#gv`@`G~)_bBwycvH!xUOeNx<()r1$%)2vg
zaNt@}fzwRxr-lH^forVGrY3eZ|B=DCk%q$eKpGak2hy<kJ&=Ya?}0QFy$8~8^Lro-
zOWy-&xMix+@Lq@)vdNZF-l<BDBMrq<m4^39ykMbpxv9FoS2##Ign$qb0zyCt2mv7=
z1cZPP5CTHr|2zWIu+%%1Cy7qOFV#%tsnakGX_&fy|L4`Le_xK=(Z%@Q&0>7-W-<2`
z%OM1WfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP_|Hbb7eS8QgC9PC^9kPL1MAkW
zaPm!O?s|qfztgD>+z(f8*sy*>iDy%XZ)+&v>FM;ebau1`xAk@fJPnn#Gp%5^&#K*6
zVYPI&^P6$jJbe9jWp6O#_be`4R8&xSOF?0gXVJ|ii<guvz8OEhIj?)BRUc^Y?Aqz+
z4t^?7;+g07)URCNnYpsFvnSZG&C}Y|+3xWNwg+1Ro_Q_&xlU_B8ny*`JncG=t)b2q
z<6ODjieSt$!VY_a?Y?aYD6C>bWOS6`#u>+|&fX5cr=!!O+=P8yJ;9z}XUCk0Zjv2%
zRAlqQ%3T6hsMF`yLA3@$0a~s^`rx+E+n4eOmb43Yw03rTd_5{an9W?*xkHB#>{+m2
zfhTufIBzD*yL)^s_b{M7PrEM!2u)jk-NYI8;8%Ta_VSl+3VFL!-4!zKh7HvXDl7&B
zhfMASwkpYXA^VtlT_o#n+fY%zz*Dic6HGd`AqWO(HFWL>bTw4wuf~`1?E7tjjzCwi
z#j5NK@9YY0YwJN>C|pv2KR0{UbhZRSJ3Bn}zMX+CgwW7X=~*8Rba-lzpZT}@P_I_j
zuHWcs?d<Y=GSJ@Z*&gWXW+Dm~6fIaZ)4COA^u)Mh<5{P0K7sQf&OV%*ae8rHNPoWX
zMQoitj}zYpn*M8?+xgLQetcr9zo|RW)5KD3VzD!P!zSntG<5}hbkNe%*#*Xa5AgT&
zb}RgImI3q4UgRacd(YC6iOyAd821&86%DnX4b>G@ix#8UQ-dyI(015KZvCAdfyq3y
z;0w?#ezYa{ZNt4k*v)Ux*x{_}^wd^Wd;DF&?YfyElk@x~wgK+ow#L`x_f)|n5>Q!H
zuwi}uOsfNNI?{7{?YgF_>f357tD81dZ>(-ilN?mT++cT;N(|ZM(Yu`vou9_)jg3v4
z*3~v5kcz51(got+d%1p!2sw#y?Ydhx)ow@^zJhGruI=0wZ1IIWy&b_Gh=Lvu3x8)K
zto0qCogSTt$|^uXb49If^L6+`0l%ua9i2NIj1pzmR9VqbQCZtKX$s=$y$r5Ji!Q;H
z{>idwT}5N<ZPiWn6`RvgRfOVkw)$I8&yn-s)-GR9z*NLUzEkZ{@o(Qy+gROHSzpEM
z+N@LE`F%aUOW7lwjn(TmRyWnIYeW%jYG`cQ*jUlHX(K)Hqb#Oe7%mz|SC49qC7vB!
zL8KBLPdm`t&BmE1B_31L?`X%SrNN6rRfU4Gy*T6S3P3WHc&awlH-PEt+Kou1$Ig@^
zZN}ZkhU&`NRd*N{4*MYLQxJ41rdg$wi%X@u)jzMLgq=}qs52bi=?Qjp2fBI!st=<b
z40MQ}(q@jhQqtn20-4{{1?kEpu)|e7sOlK!b(eT3``9<IpE2E~wPj0Z>kdjrltn{V
z=hlF7r8>rLRo@-mHGXUQ5Ahq)_+4mq7U5b2Z+tIYo$g4<EZp-qu0Q5*w;A{RR=e$P
zn(dCO!F2CDoGZk(Is7Y`jo+ZX5BCw8<9C0z;Qk=aN8Qm!vhka@<+y*`9sN3fV|d;%
z?dI$FeeHQCah`QYzjhYCDgGAjFSw%*!~MLA+Rc#$_uvgG-R|gDV1GldHvdYYd+<gR
z&V#3Mf3G$_bP;a&ZAhfyOQ&$(VD4w(p5NwI2ks-haYrAx7xxdF`yAYl>idJ?E8lnJ
z`}mt3{Hc!YSr&eu`=()>dzJm*O$T{3hxuJpu${%<(^l?|(hm1&-CZu*#x7q+cZec^
z>V`V~o_V<I^DJA=XT&kHG1wmH?CtURT3Q0#-K<#94?SDEf_~^<Ev?%;KEEHe66&AT
z+i?#hWQP^(*pBAlx39{Bu1e@{d>s_MXxh}@=FjV%@38jt><nwel9?tUxjH@b`p~^>
zgnD?}>I!PBNZd@zD0P7yp0>{J9y?7c%=jN$pFzCykqK&4%y37tC+#W`o+FF#kaS|z
z<Gir)kS5H8M-%a?u0X)k>boakl1JIMQo-xixkdia%`kDAiKC~{>0yv|L+mRd4u1hO
z74?6ng@Q_#LZwc!j@0|YPQcIwv|r6o6?*QxZryil)jM8BNw5;BfGAZ}BvCSn6krTc
z(J(PSL{_`uRwZ_77p}J|+X5~3C|9}~vF;?ybY5vjnPgYEgelBHB&_6>(v;$PZTGbl
z1o5@dii(D{`AdqHY+ST>5eF|}R8fS})7g>H7V!17b#?C0Zt4O%L%yzU@M1Y`QIDZK
z20H?5(CxnN?t*TphpetppL@DGL!m&I)e-2~(b;v6)5tcXP8JUNc3SPdp&qmzf6!+N
zkm2d!jUy!6tRTrO+!Ey2s~yS;Dl8Rcy9Hs4u(P`-(C!IC84tGwx_tZ)WUwQQM(S__
zOXxaVq0A<QyCc{Y2%)(;O@kdhflw$2^}ff0@^M;O-DoYaGaYgwHO@d=x^{+pI=6NC
z!fnBpB;QDDa9an`f#R~ohtns1%%q`qy{Em?-x~^8$Pk7HXa;bKV0w|PF8=6BGKcP+
z9W5xr4vbLAMU@eSNjsC@0@c=P4|ca;TzJWdlhd58G!bu7z7RZmX<x8IN0g`vI=*Db
zNtsMAY`o2hCt>dE^#|1u+^${@?%O*#WOfFa@JDSW$;ztTP*veHfxqtF_COaJpwrme
zuqx@%+8XK&^gtD8OE$K)c44Tym5P`%1*o%RoUSsVJXWEO(JHm}1p|S=q9w&eaAH+d
zR#tD^nCb#Qu(L5K`PQb5E0bdG?cQp&LXia#XyzS(P?9bD*RM>i@>VToHadbUCuE|w
zp}rQn7K*ji*MeV4*jT-x5<}Faj8;~xo6v@ozm4^^l@8C!?4H2Rt(_cPB?49ERK@P`
z^su{aMNuSd@loL#2(y$-u1{lDoyJU+L5g2K+EO66#JkjPd7bzbhG0?hGlu6q!CnXw
z-8kvQ@`b`}K8J}J`#Vg~r_?rVbQ-jD7C3{j%shd|k6crJQy*tbRq0JNM4WMK4)Xrs
zHYlQ>f}}-V>+J1LZUK-hEiC=6q{7<fYY&7mjo~y@ai$1I_8)DXJ>gLAHm6e~Hzo?#
zPJk*1W8woxeM7C9qksqs=Q}KDz8Lm)-ZwN>CWVc;G*7CTck#_d9wW@zQ82G`mttg9
zr!n*{UUG}4sy?Z)&{>L+_M2jec#AzIAN0dp6^CtxJ^)h}DxVmcupe=h49bK3ngTu1
zc6CE-QiJVo=fFdWWg{okcWO2_bOiy<ZPZ{MsoS$?Y0=Gv>>iTLZcbyiG>zFU4zsPn
z0zX7j3o9b~BOkiW5TpmQf#|I2$_CG(1$`4NYOAZOJ&P85i;@vo33I!(;YW}fJrjW-
zY@LgVR*RN0C+W<Yn{?*PQ95()B<96w&2{~cYs{+7X-y0qSRu?qeP#TXI#)qYX92z1
zPGMGGS(|WTt=qJ66GXbwZpoCTPT^^rbV17Q@a>F0cL&;o1xhNSIM{oqi3IbeklpNn
zCPc66lOsjYnF{Q<ln%J5Be)Lb%K<1fmx2y+U%$RFzrLYzQ6YZ)0$NMUJ<vVW9BK`R
z5e#sp9^Mpq>N}zOb%uPN4ZiIG>KawmmHE&rZ)PVJzhB^t*%4QPZyP2gEljW`)t=Un
zuRFD$-HwU6&bZ`;999}ZqHaM4f`SKu2X!nEZtLvWnQ*LRTpDF_Gsa3r7fp(PNmW{7
zBcHYM>h!=dms0?EZ(hXa&>n_Z=jwseuA=b{3nzGO3!vFp@T=x_IdB6CE6@Xt73!AL
zlWj)(p3ZwPY23wb!x^l#s;a8iX;RUc%(Ql6)jFsB?VVlzRl%^+$bv|#U+r1EK&3ve
z$s1iJjS9G~8dKYamZh((7|;<aH=+e3s~DVdbtZO|p4Q>iY?65`rh`+wqHfeyIUQlH
z%K50vWU@gBc(LZ8>ZmJ}LG9i#fLXt)34@3x)yg>3C*$tWj;8K#u%n6dOn8QyZ~(o}
zhQ^AGO<04$gm_1HXBQ{sln2;jimHctc@qZCbgwiT)XpY<yRWGgV_b#{^PWI=59TFq
zZFWb!n4h_|%^fXz5!bLgy0RbFK6kXD3fG7`TJ;332i(y*%<J5G*d1*R<9gH`Z79PP
zb2+tJa6RUZt~-b8^X_Q53)j=`Xz58@-*iWBM>wTD?&#(kJY!ym*HVOcTOY3XxucsN
z#dX*nZ5+e3A6LxLY{+y+_aDGD+a0ZZ9M>GA?*y(MToLYuTz7O^8?Hs}XiFom_>EnE
z4f#Myphh?KbmEo*1!h_ht4T}soWw*8o;8#0+khw-3ULw^5Vt|vDEBn?clmZCncHPU
zp1f~?Qot)jrRt|t8JR}i1Qi(K3sM0xhGnNq36qh!oRwL}_AXyLin6mym65}&HPF*S
z(U?@8EPiH$i+IK^UiNn86M0utwMqUt`<NPLcOanFC=^EudL1X3a!p1Vz^<hY%ZtXZ
zva=0f$2#2ZgD_QmdfU}Cyu+`qy<v=l0!>gOl@q3igIuhesk|kpUzMZbr4=nW){~%$
zO<Qm)1e7AEp1XUyq5i3Kspl{k#+o`?@hh0x9>9VfevZ<qKr1tar3p>531R`Os>qZw
zC!AzsZQjBOk)}XjOCW59wAws?J_oH4s;++KN){ExCJd9COhV8pnXu79Ifvfk<CvMu
zAXhv6s>P~j=;#<>_w2OWaQqp;(mgIT(u^q@Y@)D3wV+){^?`Usr|ge+PI&GJ^l8s3
z927UMx^n2WsA>VTmQW{4MWu(@Gu?GSy+b|6%#1ECMuZB>K7eU5Wsa<48WMeAQwUf%
z<)QM3c7=&|VD@+O`IEiDKsU#7xR19-6_Iuy&vOgbFijXr3aW8Vy{~0a{vynowQQ)}
zSgF@Nv7*_60b6Hxn|{XQl1sRWooA@!nDPF=udaC@^O^(ey64BvM=a}#NQQ0pxBqhS
z4`UbLEE6x78Fzn`een<DlT+=O$m+rX8%`86Uyv#><Z8teoXcN{HHMDfcGOc(XDen8
zw_$+a(bJ8&eZQvwvuvErGiwI(Fp;8XT;sEOc5|R#P94VAiZ8=0)ni13@UhU?f#DX$
zvRKIQ2RvL!FQ3<E#|xE2%@v!;VcS{0382Kp98YHz`$|p>x2lEu++dqpu}NA}tkfCd
zCIO=Z+gVA<uRrMLY$|IgV#Bz5USSa?i*c}>cy{=(uGf7}z|U!9-STNU(XM+(5b_a}
zT4_HyPu<My3|*Exh3-<^?P_X=da3x6+?tRt-#upPd%5sCA>C+s9OEmAkz7w4<&exb
z9!81BxKWiZIT+Sb6svIycRlk_JFp@P$?nl2oV;;|scU?I2`dQ@<P>QRKddRN2lI_B
zDlv|E-Sd<?RAgoD3E~E$4W&|sf*tp$T8c5e5{xQSjyi{$teb;n%L}{TvIUvlx7k80
zkq4$nOE6XCI9HsuZnh*=A=DCtYC0xX%VL9a<Wsjtd(|S@eY~78uIVW-t?Y9BCRS{)
ze?aZX!6*zWoXOAa6&u#ou3N3v4AIzaIYFB1HmzNov}YzEGyJ{b5IaFEA|}@wI}Yfe
zh@(5ygn4raYaCjhuT|o_E3hqyS?w-eDk)1Eg?(ycjVU2)%i!Zo3%#SivkU4k!ZP_#
z_g%;n_m<G61!JvlOszvjhHl(ZfbpKvKiYkL1=NQ-T6P-0O<a7k62ltKJNZ>dbG-pp
zfGsW|r2Kj+N9N&rHJR7d8}6}fF)rl(jpTheN$tVzn4EQFUiU&(c}*Ft!nPtu-PBbC
z`h7tW@|w2Z%~!UnA)xInR_huC91(CFj!{~H%AVyd<T``DmpfiyWr4eu$bzknaXkTr
z!E7PFCcZ>jv*{(3vRW<X7BFieMFQ$S3phEQs=daonb2f=(|+dLHAJ^*rSGNb`<*&5
z?`=KVskhKPRX0@OVeG@a+xPZ3h|ji8iAnSLyku=nYFgu+DNySf->tp6pXf$50v+@L
z?!8?YMpa;a)V|+r%<eGP+s(DcTvtI?SLn=hL$EIp+DKJghqbW>Xw5wrX6<mR0$guO
z%hSf`sB8;cuwDw?E7`p+A8n=C>$R!^rBo-owaY5uf<AQKQ(38Swbgtrmnp2%hi5xW
z2+xfzSmeSk4QQUru$e*Cu}a`qE0^omH+pL88`f6WS7VDw6~+6GpkK}Rv<0|9jdCHZ
zo=tp-Ivg*;b}Z?5*01seI<`+*Cmm7}8Rck!JFt|_IEj8p{Zj3bLtYd6<rWotmlP~2
zE-v;|grQ7(D$T4;zNfaM1)K1YuMJFhw`T)3r*v&sOOR&0Ps_QY#hjzpU1EBMi7wF;
z^CYZc%UXc^IGXGvZfzI3UbKXJmHbX0KW(+U^!B>W&;|Qhh!LgRrgv+*(BZ8FckIiu
z*25pxnA&$h8TBl&RCyF&S+K{~2YCjmj?Hg&pNK(()!iHBG;enS3yvExQ6^ilm$j!r
zEgxEm9j%aGc9d|_sYYYnlQ1#1NE(($dmv!Z8wGtGD=e$k7gB>9=nJ6&b|Nst7^N5c
zns%yZgw6eSxJ(i@pdegyRZ5UD*#(#6WV_Iul)h3BpBzBHs@E>myd&aVsW}#qfxm!b
zXUoBWn^f(My$QEwyQZbKYa$G6`M@dw`w4~93U>#3{hbAE?10mkWx@qhX$#KD8Q3m#
zp41x9q`Z`^au~Q9lPm@BJE_~a3*}zT3s34+*(!Io1fY&!?xAKtN5Hn#^!bGid`@oX
z5Xgw%IYFmN6T><-vI4}B9EOso@kW+xXXG+$ZCw_(7R~~@{5XBU9mNHhwEJYQQh(4E
zx}A?oPlArya*xB5`ckS{PiSj_Jx`?W1Jo8!Ckhfa=3dzZ3tD`b>WKS^Kga!Pd+JBF
zBijws_qaza1;k@E_bLQ`O8D_-6TbcI4Bs|$hR;oQUE9@~rP3F%H^EMh)!o^Ow#c1>
zYVCkK9#ozkdl%5ep_D_t;_5v1jzA2wD>wFhYFBSZ2jx;|vC3~s`PzM}u|*xyuJD7O
zi**LcIJw+)olw0x+}m{tDzJ(-*{unmJD?m6C-%uI%($>-oitUFI-}Orxm2RIUZv>k
zW<--VUd)OqKZuYTZ&Fx#@kS2;l*XSN?!+{jyf94dmrfF4(p)#zONPn%uVgL!+CwRf
z8nA&R;J5n`YGurBQgCJ$mIs-z^<hjul`s(=wJ(m77)fsgu(>!4XHFhw8|EpnMKn#&
zll!p~ZSTnobf+e3a=#|NcMBqInQ~FXl(`;dq}ESUPG;K1I7OexwPmbfbc7q$HRRu1
zxCr`eXFD{UN&KrNi*8OorPO~DJ_eL(4jc};d$8pT?r??aB<|<O`xrHVp`T9pjgNhj
zw`8S{bACH^2B<E==oETvkqAT2Nhdu+rRJ{v?Ll8bORt|pv`NCYUFh&v_I7W?LXE$&
zvx`d!sH<Bi@dq1tNn2L)@7d~y-Su00d$1u+$%n3<mPy>g25!|%b3ywyV6^bJ0Gm40
zd^pF`7))ZQq!gus@Q(HZY?Zgvk^|gczjY_pgHWdJ{-s4r^<Xq@n&JauT{F}p{Bt&8
z8{R0wt?6@{)c9W68;OkdrvjzQ(+%$JwJ6og!%S(zxMJI5N*<MbODJ)0qxxOlz^#19
zCO+%cp49T8UwdU$r#WrDY$s|^VmC#;agZ9GslT>+J$Om-fT`WBL5vHy78~s51ZS`v
zBM46Xs!igTj9(3csHb)WOp#bzctSrGUy$MgmGil!Gt}8N2kV_FImP@I_K0EX)HGuC
zrb$=6T5iYG`1+0cYE-0N<S}XD<QRrnx+_ud!C*%S=WzNw+k^32XwSw_SvlHxCv=yP
zFMRnvO}v<*#`|aiPgiGWJEtb>@?Xt&W0bs44l*@f_*bs5F_#m;N%LN6x;Q>xjlj9=
zVk-&i-d4B}uX<K%IR#wHL0_ZS=d?LD?H7bPw?Qai!?j7f8Js1ifE?-9A}!fU$6@ME
zfvLk#Q=Cgex?MKuWk2V#AZl{~^}>SA)+RsZ5un`I&lnvzp0VsypoM`NI3==#w#p@}
zg2WOQ=SmCE|58A31x$}g90uTGCpSJ)ff?g=ET>^VRZoFlj)o>>xS1qy2@YdBy*%ew
zwzJ2}_Oc%2IlN-48@v~gIlN)~#kv8#n+w)B)B-rJ_L`$T6K2muaQBHB1v5>Y{Zflz
z<{o>0%>o$0Kptq1eTs=ivgB~ol!QI*)<MGvujpXBs3xb?*f<^`(-qQ-K=#5W+dU`n
z0)2X2SoJUAE~=%_-yMr$c(xbCb~p|g+jZ@BY^L4jQSSljU9&xW3slXtSk|r8^_!Yj
z;?2ED-1l^0Dv|C@eOJpisH~<Q*XmaR?9k(`D>qasm!2~HrU9$>B!0BU#Ft}Cn2Fag
z0Uyg>D6$?1GA2U3WU6w)0J*1!;a1jcP}lm3%Hm?0uWztwsw*06Hmtv$_VIAl>kA&f
zy66lwu~@aF^??(Kw^ne+2fW9kF8Iq=TFlEA>W)UnfUa=Z*2<slJT`uJVQhTc`O7=+
zo(*?+NAg|I%M9;w<Ng1|-Pzc9+gM7zXT8fa^KbGNd_v#1<tNOx<(75yhC<6x6yu+&
zijD6q!u0^o`*059?DwP1bABFe2(K$E4V|?x%sR7{Z}y^Z#QGuT=g_LqiRdl+m=@uj
zz8?!%(CPUSmAP})UHu9c-?ilqCWc|&12J{XtOKZ*aa)63NC%Y}F0o8>yAJ)P&$DE)
z?)a<Mu2OCi?Lgaa4Q?|tPacO8yH4Bfk5+*`%t7_2_q|PHWgeKBlrTG-P91@oJm`4Y
zN|Hl$a&YF8t{@Mw^3v|X61P9lg?J4XJDrock2`e6os_=KmFrh&GRVqewa{zaR;=ID
z=+O!uc6?$r124yM{N>@|G?v)esY5SG1i%cWDJShfg{G6Al6ISMa(vq9WK8(VF^1<8
zc`WEbM}l-L;N(I2^w@smY!+<oR()D*d@vjvj~>E_dLKXMI__=ro-}60j$x!bqg83x
zw4zlcL5Y`>)|%J~SW{M2G%A@o84rd-nQH<|9lNOZ0`Xl_us%6DyS#LrG%nbb9A%m4
zFPy<(P=abWS$a%J-GOb?u;D6A-s5gmQC^N4)!uZ~H{os4ugrOp!%}aCp?^g3CXW~I
zRd4p-WhS&J#NE&p2y@vP<7d7$tMX;u$Fl=BR%)AwT7!2Fe*7)>;GNi4a%XlKJIR8T
z>(@6fx8qbyJM5JTSbI1i(t=Sb!zOK;>(}bmRf5)r&6`}t)_tZ&t&}?qW~#neMT5Fs
zxxT&uuQ9J&Tg|<+8!I=|HZ<0*UuQ8D1^Urizp-FtMb+x+g4)XU>!5`20<YG}+D5!;
z26>HF)bWn76$rILeQky66)&qQ$3~Du%C#fKXJYzoVyn1Q*n`z5wf3Y$q|t}$H)fN|
zg^GxZLhmu>S1?E+Q71NFDL}gj#@GClH2BHWf+fF%24a_uk(cpBEH#_w+osp1$R{>_
zUzt8XkMAb%ybpcmeSPL0SKj{#%>LvA&U<10L~Q)OW+mrKH5h2{eC-Kh+ac4|bne9H
zkb1LH!>#a+Ft;mBmOdl1)G#c?4J)uGA=47foPEM2?8&|}%oTnXYI6Fy3a5HlXL*}&
zRlKVAWv4LFud+w0!oD;UL~__pdyEz^$2&<FY<GNr4+1^4J*zNUda*kb-$t3t-lQSP
z-j*BjjHgK(3oohAj2pYZQVX93tm4y(uQ_mnzKOf+R6WI7R=3&_Y@XCJ`tq$9IpHY7
z*sBFoc*`w}v3uxNZ<$G$vr(W;B)O%TE+=-s+|cISvZdPxEU>SyM-RFe!n;bl?cU^o
z`WcE{&+X=NZ;E5TnC-R^ZBgy?;tIOjujWI;>o9MFu%+ri^tL2Nmh^lO6R$Ftng+WB
z3<50{9dki;{Hr#qc8)#T7=gA1Ia!mGmwK~PPE{eue5#lz4ZbqmWFk&-@04n^*U4Aq
zXUdmEJ339a7J6E{J#$pBO1~w1rP}&Jtb9A6>VdOvm#Zg8F}!0P>{D{f?o-!c*}x8i
zk#2yhyb5yJ9eoOWsGsz}Xi5%u^q6N#B9=&nfDo|SOh>^El{omkmC~8rhy9HCX7i}*
z?MJ%hJ?G18zwp%r*-Npb!{YA2ChC`}53-{((%0^-@ZKQgZIZlP$%Skx-W}9kxw}}&
zN}~i&d7wDc;#*CZCiH~~Vd)XO>T|l=I(tKylMi5suGJ#lS55HKu@(E4JRQg%_b*LM
zUyIrj%5=a9c1CLPZ`s`o)<Ari9Jc2w)QTf}8RKkXc(zA1xsfKmj;$P6U<}-$uf9G#
z&;a-eX?H+!CT@beb?k-JJW3Me3GUY869t&+NGQq5kC}nEbo?xS1sbI{AzVi~brI>*
zvY;opHKQ6+W+q#DZhwMXXJ4yoi6iAG%bu-$LDp9@CRotd(i*?Vcw}PS6T;KI>V$Za
zA1v^w!PNH75O()_Of^`D$pI9ss;#=ureEzwl{MaJ?)C)mY5?BO@EZ#t=eTH@le2PX
z`*RO-3(yl>Tpcea9lqerkQt2zSJ1lzOCJgk`~L%(nNd)wQ&IH%WuFc#oCNub+e
zuJo%lmX%9xoO8;<yYA4xl)`Nm(XqnKnKlNmK03tmYEa+xNQB^l=8R2y_#by>*79Kp
zji$l&%<ai`TxO5?N;d4cH)MsM#?$|m3{ZRU5NGYi^~Fn<7Fz1LNvXH$TXFhJNbxa6
zVje-M?W#ghea5tsns-(PI%^ZZr+1b9n2X-_7f%x=N%W^=v`&a5cB`QfUhh$HwEBRO
z^NcC)bZo_tDG`YJ)P<V=&c(;0=Cx1@rY)8{6XBMi4zX6nhm3Lm2^LMab#j4KbKsY2
z?EAP|^%9o0Z?MTXaihLAtKxU(sO={`7cEJBZmO(GanpnsA5;C&tO4&_n)KXmhwhB4
zsdjxGS3vAE=^AK1qjkjNsdwCOa@;p;SYM@<H%u6uS83XK+lIx~+F(a7zk#$a(6e%5
z)j~`ehSeZf$Hn5d<KaCv`ouY`j6W-Jlc<<+kd(prk8jtYLZZOpG*ydJ5?=k`Of?ot
z)x0IY$Yk24E#(v8sZS@}Ij{S!nHc+zVh(R~EzaE7_)}+b-5bQlrS8e=HtHQ)rml5J
zm#%oI8I@Iq+?HX-i>6}BB7FS=b0k5tz*Aeb5SuBGczzoQ{!BX8q4^Synss(~R&@>w
ztoZ69_iJ``&|uMm#rS5Z`6?O=7A+_$avCgN;PpD6YpV2TK<PJyi~i~knUE(OAZ}IW
zan4GLz!F~&O-8KUdvGw}iatv~O@;7Ab*waIv}%n>DJ}_#VW$PztKW#K<ycgUe=`Y?
z9AniI50|QReEP$t+tB>^Hbf6Ta-z-SC5<#A70&pT1EeK-y=4`b<GeC9wh!%QUv2Cn
z&I>r-!g(I&n>f$mJiBi?>UG5OC_nI9Ot)9UPo*~R&z$zP19M{M_djiA?#-}f?LT8>
z_3!>jAKec<W4U&}aK2&pD<29k{E9WL;wx5LS;Re9*6bei4lgd>{oKFwd55ih@2EA+
z+v3e$dwkJg-T18^t$SzRPPn(qAI!*#uCT1zU&$`n{lc$i6)%rnEH015_I(2J!yIqQ
z%^E_y{h8ChHiUS+bF6HY)><pG_)062X<zs`>k7pCX2pY64eqDoezg2SD~x+L?)z~6
z1lIaykO%UW2_CLXg$;i*;jbLwHR3)K_xIv@CBi^>v17&XUu?zRQDHUVdr`627T9ON
zT?4Mu%Abmjacwa*KDgTp`}e_JVey*Nr*8V(^w%q%j6F`buzPXn=jv+VITz23xMtwG
z7T0OGRux;*&*55z=jpf>{SM{Aw52JRjFTvrj6}Jt|4iLG|MiS67pu=%E-VMTY*-d{
z`LJx9<w7=*J>ZMF<8A%}t8V;*&(SZ#Lb@$gj_?z&W8mlXZx|f-9rDKVPM5cH$lLTp
z-qt;Wytz%@_WpbFHuQp(#kyUbhwEYY&_2|E?{G)HcVsBC`<Z{~>wh@6p>BLbeQJJ@
z*9-e!VBL#dB(Htx^W1OpJcjl)8|`fFejnP|r%gM1)pG5xurhbQaiL*<)XLr+`%rlQ
z5o^}Mhpg#nmpNe2m(=cl@msXJjEl((>PPC{`I8LzVY{0hEk(PFq20alZ?ll*xy37V
z+Z#eWs*IUV#I+CZh7i{f(u4HppuA?I9eUUfhia`XlzG+=%6#FM;O-IR4`q)wckk|p
zUhP{k>K@wtrN5t5`pVFO-QPXefR|xr_dj{zzm>+UjL0t3_wj4oyB``WNBSG}^M{Y@
zKKt9g-4Eqh6^CM{RJzdCm{wJHkT$#SsI=WVdD^0|Q~qy^UEIG$`&W5E7%DHwo61*e
zo_@=AIDY>3Umnx4lgnf62kYLs?~_wq9-8}qInzJzwknt8^0?;e_ey!74;o{c3`DFO
z*hbg~v7cf6_qG(TWt-U-wPxu)X3cjZ-?dz9=lzf5HuOLBq40uhQ7`Ye=CV#i;m*h+
zRi6hUQIB1xliHE$zozG)+^mEwS#ww2JD>Yb`97;WMUKp+jAYpC!&Dpkgk>>o_BRvS
z&d-&+Kk@%v)=g*s>X3D{Pa=KS7+KexlE%xD<6tz4?F{`~4C&VL06GC>wUX_oA2#y(
z(ceQJ%98U?^LE`kdp7+?=7Bm6^I_{Zrfy}TZnaVG(e<jvhdir#m7@1Fq^UP+ktc`V
zQ!}sboqMAuPhMxa*nO+ruadvbJx%}k;_rd?mSo<m_td@fN53#>d(@dWRTqq2X4h#`
zpOgCjDEfZy8%i&8?R{10Wf>KRtTO04ndlF)<2uiSR;~)O9DQP~saw~n_K_5xb^|@@
z5^hZWYyLg(2q*JcwX^P>&;H~;vi|)Jd6-1co_=p~eXIU9@^JNgG!HY<>uu8yBM&nY
zvbO4%b?<zp{`ZpyE5mM69N+vNWSMJ{JUoFsxEy&XsC#F4&wDfv96P1apQk^MJY12;
zLuIh;ouTJ`PkCTpc)5MbnCkD*$19!K^!prpM!t%12Kw5R{=EotV=nuyDD2pODVfFc
zMi}gislS>&OzE&`<n~$Q-O=B#Y_EG~@P*%Ve}A(7bJzEI$Dr4rvGV(WzN8QNE82Sm
zX{_GZ7rg;`%MI`A3*>$C2Vb}Wtb!lu^X{?cdRr_{-T3ph$YT*@^fJpm#Qb^BSUH<+
z%q}U;9I`Mz$>=|K>jEXC5jOOiLh9;9zKkvNxCiMknwR6DdvfjfBm80XYtY@jJ}Yz6
znh%xqA8lArT)X>XabD-eeHG~Up*QcFW6i>uT{r%hz2xj|hI@<!m<GmyK6I4vkSXFB
z+V8XSS3pOLe0qAeclcJ0T?)O2W3keRWnny%i@cX1{wj=RilE1NVLyAQb~scw{?ng9
zzuQ?cIQ`JFa`zC^T)bu|Qk>V3zibWi2R6lP5YEpn&p=*7L+N*|xtsE=YcVbx1h1Uk
z5C5+|@5uV2<jb*H-T3!ESnSdMjGI};&Ep9-$A8IizxY`zn{JH#vkv<o8GDZZZ2Qv=
z`)@JdyDNVTmMhEZ#>aN{_p3Z))7(2;SB`W%mp>hIg@e<2P=~V_9>Zc7(LBr2aW>>K
z%`Er2@#A-?`pNiS#hC7CjJ<{%%Df}}=j&qcd?$_FTJK1A7<Lb)vD@q&`Q#YvqG{~>
z-jR-c*agzq^}wzfcC~5jhLINfD@bE^$UE}sHrQRA#_p(h<WmpV#V-D98oMXFBRi4K
zi!Z0KdmeVPVfSPjyVKs0a5n6Yq_I2i9qG%0-Df7+-D)9!eXt9rv76-`*@3)YtWRU-
z@s4ai1iM9P>~g&$y{BOJLEDaHr^;~n)*{$hb+O;R9k(04wF+r}llFDv&wL(jJDY8W
z_QiRz7~0O}fg5Wsu<Z=284sh*d(pnp4o`g>?XU`C_FT5XA+$G)iwiNXErPuBLe`a`
zeU`IrM$1sIn^D(V8nPHB!;6OnJFVX?i(YPcI;{13jX%ny%Swmwci#BB`f~kQQ+#mK
zz8pe82nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CTF#2nYcoAOwVf5D)@FKnMr{As_^VfDjM@LO=)z0U;m+gn$qb0zyCt2mv7=1cZPP
z5CZ>iJ9LQCKo~_~^ui1phsU#kPC^kV5(th3Oh7cD23Ir57zCjS3Ihi92Qxc?wO|oV
zhnjAn*yG>(a&rg}AV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U
zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7
z2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N
z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+
z009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly
zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF
z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk
z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs
z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ
zfB*pk1PBlyK!5-N0t5)`DlkdX&Gt)kzfSX<lkTl5U7s@jNZk%U58cab(Y;sYD!H5X
zNxMAkyQiw$%yV=)PbRl#X_n(^bDwtDv_7lS4CCtYEA{Jl>hp}ho9<%U-L|g#9A9Lw
O-*vaY{|j7>>w`a^<P%E(
diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi
index 3d2a8ff54b..ea3e10bde3 100644
--- a/qemu-deprecated.texi
+++ b/qemu-deprecated.texi
@@ -270,12 +270,6 @@ machine type instead.
These machine types are very old and likely can not be used for live migration
from old QEMU versions anymore. A newer machine type should be used instead.
-@subsection prep (PowerPC) (since 3.1)
-
-This machine type uses an unmaintained firmware, broken in lots of ways,
-and unable to start post-2004 operating systems. 40p machine type should be
-used instead.
-
@subsection spike_v1.9.1 and spike_v1.10 (since 4.1)
The version specific Spike machines have been deprecated in favour of the
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 2328e7ea47..b79f1c340b 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -1729,7 +1729,7 @@ differences are mentioned in the following sections.
@section PowerPC System emulator
@cindex system emulation (PowerPC)
-Use the executable @file{qemu-system-ppc} to simulate a complete PREP
+Use the executable @file{qemu-system-ppc} to simulate a complete 40P (PREP)
or PowerMac PowerPC system.
QEMU emulates the following PowerMac peripherals:
@@ -1749,7 +1749,7 @@ Non Volatile RAM
VIA-CUDA with ADB keyboard and mouse.
@end itemize
-QEMU emulates the following PREP peripherals:
+QEMU emulates the following 40P (PREP) peripherals:
@itemize @minus
@item
@@ -1761,7 +1761,7 @@ PCI VGA compatible card with VESA Bochs Extensions
@item
Floppy disk
@item
-NE2000 network adapters
+PCnet network adapters
@item
Serial port
@item
@@ -1770,12 +1770,9 @@ PREP Non Volatile RAM
PC compatible keyboard and mouse.
@end itemize
-QEMU uses the Open Hack'Ware Open Firmware Compatible BIOS available at
-@url{http://perso.magic.fr/l_indien/OpenHackWare/index.htm}.
-
Since version 0.9.1, QEMU uses OpenBIOS @url{https://www.openbios.org/}
-for the g3beige and mac99 PowerMac machines. OpenBIOS is a free (GPL
-v2) portable firmware implementation. The goal is to implement a 100%
+for the g3beige and mac99 PowerMac and the 40p machines. OpenBIOS is a free
+(GPL v2) portable firmware implementation. The goal is to implement a 100%
IEEE 1275-1994 (referred to as Open Firmware) compliant firmware.
@c man begin OPTIONS
@@ -1798,8 +1795,6 @@ qemu-system-ppc -prom-env 'auto-boot?=false' \
-prom-env 'boot-args=conf=hd:2,\yaboot.conf'
@end example
-These variables are not used by Open Hack'Ware.
-
@end table
@c man end
diff --git a/roms/openhackware b/roms/openhackware
deleted file mode 160000
index c559da7c8e..0000000000
--- a/roms/openhackware
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit c559da7c8eec5e45ef1f67978827af6f0b9546f5
diff --git a/tests/qtest/boot-order-test.c b/tests/qtest/boot-order-test.c
index a725bce729..4a6218a516 100644
--- a/tests/qtest/boot-order-test.c
+++ b/tests/qtest/boot-order-test.c
@@ -108,30 +108,6 @@ static void test_pc_boot_order(void)
test_boot_orders(NULL, read_boot_order_pc, test_cases_pc);
}
-static uint8_t read_m48t59(QTestState *qts, uint64_t addr, uint16_t reg)
-{
- qtest_writeb(qts, addr, reg & 0xff);
- qtest_writeb(qts, addr + 1, reg >> 8);
- return qtest_readb(qts, addr + 3);
-}
-
-static uint64_t read_boot_order_prep(QTestState *qts)
-{
- return read_m48t59(qts, 0x80000000 + 0x74, 0x34);
-}
-
-static const boot_order_test test_cases_prep[] = {
- { "", 'c', 'c' },
- { "-boot c", 'c', 'c' },
- { "-boot d", 'd', 'd' },
- {}
-};
-
-static void test_prep_boot_order(void)
-{
- test_boot_orders("prep", read_boot_order_prep, test_cases_prep);
-}
-
static uint64_t read_boot_order_pmac(QTestState *qts)
{
QFWCFG *fw_cfg = mm_fw_cfg_init(qts, 0xf0000510);
@@ -190,7 +166,6 @@ int main(int argc, char *argv[])
if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
qtest_add_func("boot-order/pc", test_pc_boot_order);
} else if (strcmp(arch, "ppc") == 0 || strcmp(arch, "ppc64") == 0) {
- qtest_add_func("boot-order/prep", test_prep_boot_order);
qtest_add_func("boot-order/pmac_oldworld",
test_pmac_oldworld_boot_order);
qtest_add_func("boot-order/pmac_newworld",
diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
index 67635e387a..833a0508a1 100644
--- a/tests/qtest/cdrom-test.c
+++ b/tests/qtest/cdrom-test.c
@@ -189,7 +189,7 @@ int main(int argc, char **argv)
add_s390x_tests();
} else if (g_str_equal(arch, "ppc64")) {
const char *ppcmachines[] = {
- "pseries", "mac99", "g3beige", "40p", "prep", NULL
+ "pseries", "mac99", "g3beige", "40p", NULL
};
add_cdrom_param_tests(ppcmachines);
} else if (g_str_equal(arch, "sparc")) {
diff --git a/tests/qtest/endianness-test.c b/tests/qtest/endianness-test.c
index 58527952a5..2798802c63 100644
--- a/tests/qtest/endianness-test.c
+++ b/tests/qtest/endianness-test.c
@@ -35,7 +35,7 @@ static const TestCase test_cases[] = {
{ "mips64", "malta", 0x10000000, .bswap = true },
{ "mips64el", "fulong2e", 0x1fd00000 },
{ "ppc", "g3beige", 0xfe000000, .bswap = true, .superio = "i82378" },
- { "ppc", "prep", 0x80000000, .bswap = true },
+ { "ppc", "40p", 0x80000000, .bswap = true },
{ "ppc", "bamboo", 0xe8000000, .bswap = true, .superio = "i82378" },
{ "ppc64", "mac99", 0xf2000000, .bswap = true, .superio = "i82378" },
{ "ppc64", "pseries", (1ULL << 45), .bswap = true, .superio = "i82378" },
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 05/35] target/ppc: Clarify the meaning of return values in kvm_handle_debug
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (3 preceding siblings ...)
2020-02-03 6:10 ` [PULL 04/35] hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed David Gibson
` (30 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Fabiano Rosas, qemu-devel, groug, qemu-ppc,
Leonardo Bras, David Gibson
From: Fabiano Rosas <farosas@linux.ibm.com>
The kvm_handle_debug function can return 0 to go back into the guest
or return 1 to notify the gdbstub thread and pass control to GDB.
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Message-Id: <20200110151344.278471-2-farosas@linux.ibm.com>
Tested-by: Leonardo Bras <leonardo@ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/kvm.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 06fd0cc162..c05dde5985 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -53,6 +53,9 @@
#define PROC_DEVTREE_CPU "/proc/device-tree/cpus/"
+#define DEBUG_RETURN_GUEST 0
+#define DEBUG_RETURN_GDB 1
+
const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
KVM_CAP_LAST_INFO
};
@@ -1564,7 +1567,7 @@ void kvm_arch_update_guest_debug(CPUState *cs, struct kvm_guest_debug *dbg)
static int kvm_handle_hw_breakpoint(CPUState *cs,
struct kvm_debug_exit_arch *arch_info)
{
- int handle = 0;
+ int handle = DEBUG_RETURN_GUEST;
int n;
int flag = 0;
@@ -1572,13 +1575,13 @@ static int kvm_handle_hw_breakpoint(CPUState *cs,
if (arch_info->status & KVMPPC_DEBUG_BREAKPOINT) {
n = find_hw_breakpoint(arch_info->address, GDB_BREAKPOINT_HW);
if (n >= 0) {
- handle = 1;
+ handle = DEBUG_RETURN_GDB;
}
} else if (arch_info->status & (KVMPPC_DEBUG_WATCH_READ |
KVMPPC_DEBUG_WATCH_WRITE)) {
n = find_hw_watchpoint(arch_info->address, &flag);
if (n >= 0) {
- handle = 1;
+ handle = DEBUG_RETURN_GDB;
cs->watchpoint_hit = &hw_watchpoint;
hw_watchpoint.vaddr = hw_debug_points[n].addr;
hw_watchpoint.flags = flag;
@@ -1590,12 +1593,12 @@ static int kvm_handle_hw_breakpoint(CPUState *cs,
static int kvm_handle_singlestep(void)
{
- return 1;
+ return DEBUG_RETURN_GDB;
}
static int kvm_handle_sw_breakpoint(void)
{
- return 1;
+ return DEBUG_RETURN_GDB;
}
static int kvm_handle_debug(PowerPCCPU *cpu, struct kvm_run *run)
@@ -1647,7 +1650,7 @@ static int kvm_handle_debug(PowerPCCPU *cpu, struct kvm_run *run)
env->error_code = POWERPC_EXCP_INVAL;
ppc_cpu_do_interrupt(cs);
- return 0;
+ return DEBUG_RETURN_GUEST;
}
int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (4 preceding siblings ...)
2020-02-03 6:10 ` [PULL 05/35] target/ppc: Clarify the meaning of return values in kvm_handle_debug David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-03-20 17:38 ` Peter Maydell
2020-02-03 6:10 ` [PULL 07/35] target/ppc: Add privileged message send facilities David Gibson
` (29 subsequent siblings)
35 siblings, 1 reply; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Philippe Mathieu-Daudé,
David Gibson
From: Greg Kurz <groug@kaod.org>
Most of the option vector helpers have assertions to check their
arguments aren't null. The guest can provide an arbitrary address
for the CAS structure that would result in such null arguments.
Fail CAS with H_PARAMETER and print a warning instead of aborting
QEMU.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <157925255250.397143.10855183619366882459.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr_hcall.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index f1799b1b70..ffb14641f9 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1703,7 +1703,15 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
ov_table = addr;
ov1_guest = spapr_ovec_parse_vector(ov_table, 1);
+ if (!ov1_guest) {
+ warn_report("guest didn't provide option vector 1");
+ return H_PARAMETER;
+ }
ov5_guest = spapr_ovec_parse_vector(ov_table, 5);
+ if (!ov5_guest) {
+ warn_report("guest didn't provide option vector 5");
+ return H_PARAMETER;
+ }
if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) {
error_report("guest requested hash and radix MMU, which is invalid.");
exit(EXIT_FAILURE);
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 07/35] target/ppc: Add privileged message send facilities
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (5 preceding siblings ...)
2020-02-03 6:10 ` [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 08/35] target/ppc: add support for Hypervisor Facility Unavailable Exception David Gibson
` (28 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
Suraj Jitindar Singh, David Gibson
From: Cédric Le Goater <clg@kaod.org>
The Processor Control facility for POWER8 processors and later
provides a mechanism for the hypervisor to send messages to other
threads in the system (msgsnd instruction) and cause hypervisor-level
exceptions. Privileged non-hypervisor programs can also send messages
(msgsndp instruction) but are restricted to the threads of the same
subprocessor and cause privileged-level exceptions.
The Directed Privileged Doorbell Exception State (DPDES) register
reflects the state of pending privileged doorbell exceptions and can
be used to modify that state. The register can be used to read and
modify the state of privileged doorbell exceptions for all threads of
a subprocessor and thus is a shared facility for that subprocessor.
The register can be read/written by the hypervisor and read by the
supervisor if enabled in the HFSCR, otherwise a hypervisor facility
unavailable exception is generated.
The privileged message send and clear instructions (msgsndp & msgclrp)
are used to generate and clear the presence of a directed privileged
doorbell exception, respectively. The msgsndp instruction can be used
to target any thread of the current subprocessor, msgclrp acts on the
thread issuing the instruction. These instructions are privileged, but
will generate a hypervisor facility unavailable exception if not
enabled in the HFSCR and executed in privileged non-hypervisor
state. The HV facility unavailable exception will be addressed in
other patch.
Add and implement this register and instructions by reading or
modifying the pending interrupt state of the cpu.
Note that TCG only supports one thread per core and so we only need to
worry about the cpu making the access.
Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200120104935.24449-2-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/excp_helper.c | 66 +++++++++++++++++++++++++--------
target/ppc/helper.h | 4 ++
target/ppc/misc_helper.c | 36 ++++++++++++++++++
target/ppc/translate.c | 26 +++++++++++++
target/ppc/translate_init.inc.c | 20 ++++++++--
5 files changed, 132 insertions(+), 20 deletions(-)
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 5752ed4a4d..1b07c3ed56 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -900,7 +900,11 @@ static void ppc_hw_interrupt(CPUPPCState *env)
}
if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) {
env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL);
- powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_DOORI);
+ if (is_book3s_arch2x(env)) {
+ powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_SDOOR);
+ } else {
+ powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_DOORI);
+ }
return;
}
if (env->pending_interrupts & (1 << PPC_INTERRUPT_HDOORBELL)) {
@@ -1221,39 +1225,30 @@ void helper_msgsnd(target_ulong rb)
}
/* Server Processor Control */
-static int book3s_dbell2irq(target_ulong rb)
-{
- int msg = rb & DBELL_TYPE_MASK;
+static bool dbell_type_server(target_ulong rb)
+{
/*
* A Directed Hypervisor Doorbell message is sent only if the
* message type is 5. All other types are reserved and the
* instruction is a no-op
*/
- return msg == DBELL_TYPE_DBELL_SERVER ? PPC_INTERRUPT_HDOORBELL : -1;
+ return (rb & DBELL_TYPE_MASK) == DBELL_TYPE_DBELL_SERVER;
}
void helper_book3s_msgclr(CPUPPCState *env, target_ulong rb)
{
- int irq = book3s_dbell2irq(rb);
-
- if (irq < 0) {
+ if (!dbell_type_server(rb)) {
return;
}
- env->pending_interrupts &= ~(1 << irq);
+ env->pending_interrupts &= ~(1 << PPC_INTERRUPT_HDOORBELL);
}
-void helper_book3s_msgsnd(target_ulong rb)
+static void book3s_msgsnd_common(int pir, int irq)
{
- int irq = book3s_dbell2irq(rb);
- int pir = rb & DBELL_PROCIDTAG_MASK;
CPUState *cs;
- if (irq < 0) {
- return;
- }
-
qemu_mutex_lock_iothread();
CPU_FOREACH(cs) {
PowerPCCPU *cpu = POWERPC_CPU(cs);
@@ -1267,6 +1262,45 @@ void helper_book3s_msgsnd(target_ulong rb)
}
qemu_mutex_unlock_iothread();
}
+
+void helper_book3s_msgsnd(target_ulong rb)
+{
+ int pir = rb & DBELL_PROCIDTAG_MASK;
+
+ if (!dbell_type_server(rb)) {
+ return;
+ }
+
+ book3s_msgsnd_common(pir, PPC_INTERRUPT_HDOORBELL);
+}
+
+#if defined(TARGET_PPC64)
+void helper_book3s_msgclrp(CPUPPCState *env, target_ulong rb)
+{
+ if (!dbell_type_server(rb)) {
+ return;
+ }
+
+ env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL);
+}
+
+/*
+ * sends a message to other threads that are on the same
+ * multi-threaded processor
+ */
+void helper_book3s_msgsndp(CPUPPCState *env, target_ulong rb)
+{
+ int pir = env->spr_cb[SPR_PIR].default_value;
+
+ if (!dbell_type_server(rb)) {
+ return;
+ }
+
+ /* TODO: TCG supports only one thread */
+
+ book3s_msgsnd_common(pir, PPC_INTERRUPT_DOORBELL);
+}
+#endif
#endif
void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index cd0dfe383a..cfb4c07085 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -657,6 +657,10 @@ DEF_HELPER_FLAGS_1(load_601_rtcu, TCG_CALL_NO_RWG, tl, env)
DEF_HELPER_FLAGS_1(load_purr, TCG_CALL_NO_RWG, tl, env)
DEF_HELPER_FLAGS_2(store_purr, TCG_CALL_NO_RWG, void, env, tl)
DEF_HELPER_2(store_ptcr, void, env, tl)
+DEF_HELPER_FLAGS_1(load_dpdes, TCG_CALL_NO_RWG, tl, env)
+DEF_HELPER_FLAGS_2(store_dpdes, TCG_CALL_NO_RWG, void, env, tl)
+DEF_HELPER_2(book3s_msgsndp, void, env, tl)
+DEF_HELPER_2(book3s_msgclrp, void, env, tl)
#endif
DEF_HELPER_2(store_sdr1, void, env, tl)
DEF_HELPER_2(store_pidr, void, env, tl)
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 2318f3ab45..0c5919ff08 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -105,6 +105,42 @@ void helper_store_pcr(CPUPPCState *env, target_ulong value)
env->spr[SPR_PCR] = value & pcc->pcr_mask;
}
+
+/*
+ * DPDES register is shared. Each bit reflects the state of the
+ * doorbell interrupt of a thread of the same core.
+ */
+target_ulong helper_load_dpdes(CPUPPCState *env)
+{
+ target_ulong dpdes = 0;
+
+ /* TODO: TCG supports only one thread */
+ if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) {
+ dpdes = 1;
+ }
+
+ return dpdes;
+}
+
+void helper_store_dpdes(CPUPPCState *env, target_ulong val)
+{
+ PowerPCCPU *cpu = env_archcpu(env);
+ CPUState *cs = CPU(cpu);
+
+ /* TODO: TCG supports only one thread */
+ if (val & ~0x1) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Invalid DPDES register value "
+ TARGET_FMT_lx"\n", val);
+ return;
+ }
+
+ if (val & 0x1) {
+ env->pending_interrupts |= 1 << PPC_INTERRUPT_DOORBELL;
+ cpu_interrupt(cs, CPU_INTERRUPT_HARD);
+ } else {
+ env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL);
+ }
+}
#endif /* defined(TARGET_PPC64) */
void helper_store_pidr(CPUPPCState *env, target_ulong val)
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 9dcf8dc261..36fa27367c 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -6645,6 +6645,28 @@ static void gen_msgsnd(DisasContext *ctx)
#endif /* defined(CONFIG_USER_ONLY) */
}
+#if defined(TARGET_PPC64)
+static void gen_msgclrp(DisasContext *ctx)
+{
+#if defined(CONFIG_USER_ONLY)
+ GEN_PRIV;
+#else
+ CHK_SV;
+ gen_helper_book3s_msgclrp(cpu_env, cpu_gpr[rB(ctx->opcode)]);
+#endif /* defined(CONFIG_USER_ONLY) */
+}
+
+static void gen_msgsndp(DisasContext *ctx)
+{
+#if defined(CONFIG_USER_ONLY)
+ GEN_PRIV;
+#else
+ CHK_SV;
+ gen_helper_book3s_msgsndp(cpu_env, cpu_gpr[rB(ctx->opcode)]);
+#endif /* defined(CONFIG_USER_ONLY) */
+}
+#endif
+
static void gen_msgsync(DisasContext *ctx)
{
#if defined(CONFIG_USER_ONLY)
@@ -7187,6 +7209,10 @@ GEN_HANDLER(vmladduhm, 0x04, 0x11, 0xFF, 0x00000000, PPC_ALTIVEC),
GEN_HANDLER_E(maddhd_maddhdu, 0x04, 0x18, 0xFF, 0x00000000, PPC_NONE,
PPC2_ISA300),
GEN_HANDLER_E(maddld, 0x04, 0x19, 0xFF, 0x00000000, PPC_NONE, PPC2_ISA300),
+GEN_HANDLER2_E(msgsndp, "msgsndp", 0x1F, 0x0E, 0x04, 0x03ff0001,
+ PPC_NONE, PPC2_ISA207S),
+GEN_HANDLER2_E(msgclrp, "msgclrp", 0x1F, 0x0E, 0x05, 0x03ff0001,
+ PPC_NONE, PPC2_ISA207S),
#endif
#undef GEN_INT_ARITH_ADD
diff --git a/target/ppc/translate_init.inc.c b/target/ppc/translate_init.inc.c
index 2d3efad233..53995f62ea 100644
--- a/target/ppc/translate_init.inc.c
+++ b/target/ppc/translate_init.inc.c
@@ -464,6 +464,17 @@ static void spr_write_pcr(DisasContext *ctx, int sprn, int gprn)
{
gen_helper_store_pcr(cpu_env, cpu_gpr[gprn]);
}
+
+/* DPDES */
+static void spr_read_dpdes(DisasContext *ctx, int gprn, int sprn)
+{
+ gen_helper_load_dpdes(cpu_gpr[gprn], cpu_env);
+}
+
+static void spr_write_dpdes(DisasContext *ctx, int sprn, int gprn)
+{
+ gen_helper_store_dpdes(cpu_env, cpu_gpr[gprn]);
+}
#endif
#endif
@@ -8238,10 +8249,11 @@ static void gen_spr_power8_dpdes(CPUPPCState *env)
{
#if !defined(CONFIG_USER_ONLY)
/* Directed Privileged Door-bell Exception State, used for IPI */
- spr_register(env, SPR_DPDES, "DPDES",
- SPR_NOACCESS, SPR_NOACCESS,
- &spr_read_generic, SPR_NOACCESS,
- 0x00000000);
+ spr_register_kvm_hv(env, SPR_DPDES, "DPDES",
+ SPR_NOACCESS, SPR_NOACCESS,
+ &spr_read_dpdes, SPR_NOACCESS,
+ &spr_read_dpdes, &spr_write_dpdes,
+ KVM_REG_PPC_DPDES, 0x00000000);
#endif
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 08/35] target/ppc: add support for Hypervisor Facility Unavailable Exception
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (6 preceding siblings ...)
2020-02-03 6:10 ` [PULL 07/35] target/ppc: Add privileged message send facilities David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 09/35] spapr: Don't allow multiple active vCPUs at CAS David Gibson
` (27 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
Suraj Jitindar Singh, David Gibson
From: Cédric Le Goater <clg@kaod.org>
The privileged message send and clear instructions (msgsndp & msgclrp)
are privileged, but will generate a hypervisor facility unavailable
exception if not enabled in the HFSCR and executed in privileged
non-hypervisor state.
Add checks when accessing the DPDES register and when using the
msgsndp and msgclrp isntructions.
Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200120104935.24449-3-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/cpu.h | 6 ++++++
target/ppc/excp_helper.c | 13 +++++++++++++
target/ppc/misc_helper.c | 27 +++++++++++++++++++++++++++
3 files changed, 46 insertions(+)
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 8ebeaba649..96aeea1934 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -397,6 +397,10 @@ typedef struct ppc_v3_pate_t {
#define PSSCR_ESL PPC_BIT(42) /* Enable State Loss */
#define PSSCR_EC PPC_BIT(43) /* Exit Criterion */
+/* HFSCR bits */
+#define HFSCR_MSGP PPC_BIT(53) /* Privileged Message Send Facilities */
+#define HFSCR_IC_MSGP 0xA
+
#define msr_sf ((env->msr >> MSR_SF) & 1)
#define msr_isf ((env->msr >> MSR_ISF) & 1)
#define msr_shv ((env->msr >> MSR_SHV) & 1)
@@ -1329,6 +1333,8 @@ void cpu_ppc_set_vhyp(PowerPCCPU *cpu, PPCVirtualHypervisor *vhyp);
#endif
void store_fpscr(CPUPPCState *env, uint64_t arg, uint32_t mask);
+void helper_hfscr_facility_check(CPUPPCState *env, uint32_t bit,
+ const char *caller, uint32_t cause);
static inline uint64_t ppc_dump_gpr(CPUPPCState *env, int gprn)
{
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 1b07c3ed56..027f54c0ed 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -471,6 +471,15 @@ static inline void powerpc_excp(PowerPCCPU *cpu, int excp_model, int excp)
case POWERPC_EXCP_FU: /* Facility unavailable exception */
#ifdef TARGET_PPC64
env->spr[SPR_FSCR] |= ((target_ulong)env->error_code << 56);
+#endif
+ break;
+ case POWERPC_EXCP_HV_FU: /* Hypervisor Facility Unavailable Exception */
+#ifdef TARGET_PPC64
+ env->spr[SPR_HFSCR] |= ((target_ulong)env->error_code << FSCR_IC_POS);
+ srr0 = SPR_HSRR0;
+ srr1 = SPR_HSRR1;
+ new_msr |= (target_ulong)MSR_HVB;
+ new_msr |= env->msr & ((target_ulong)1 << MSR_RI);
#endif
break;
case POWERPC_EXCP_PIT: /* Programmable interval timer interrupt */
@@ -1277,6 +1286,8 @@ void helper_book3s_msgsnd(target_ulong rb)
#if defined(TARGET_PPC64)
void helper_book3s_msgclrp(CPUPPCState *env, target_ulong rb)
{
+ helper_hfscr_facility_check(env, HFSCR_MSGP, "msgclrp", HFSCR_IC_MSGP);
+
if (!dbell_type_server(rb)) {
return;
}
@@ -1292,6 +1303,8 @@ void helper_book3s_msgsndp(CPUPPCState *env, target_ulong rb)
{
int pir = env->spr_cb[SPR_PIR].default_value;
+ helper_hfscr_facility_check(env, HFSCR_MSGP, "msgsndp", HFSCR_IC_MSGP);
+
if (!dbell_type_server(rb)) {
return;
}
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index 0c5919ff08..55b68d1246 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -41,6 +41,18 @@ void helper_store_dump_spr(CPUPPCState *env, uint32_t sprn)
}
#ifdef TARGET_PPC64
+static void raise_hv_fu_exception(CPUPPCState *env, uint32_t bit,
+ const char *caller, uint32_t cause,
+ uintptr_t raddr)
+{
+ qemu_log_mask(CPU_LOG_INT, "HV Facility %d is unavailable (%s)\n",
+ bit, caller);
+
+ env->spr[SPR_HFSCR] &= ~((target_ulong)FSCR_IC_MASK << FSCR_IC_POS);
+
+ raise_exception_err_ra(env, POWERPC_EXCP_HV_FU, cause, raddr);
+}
+
static void raise_fu_exception(CPUPPCState *env, uint32_t bit,
uint32_t sprn, uint32_t cause,
uintptr_t raddr)
@@ -55,6 +67,17 @@ static void raise_fu_exception(CPUPPCState *env, uint32_t bit,
}
#endif
+void helper_hfscr_facility_check(CPUPPCState *env, uint32_t bit,
+ const char *caller, uint32_t cause)
+{
+#ifdef TARGET_PPC64
+ if ((env->msr_mask & MSR_HVB) && !msr_hv &&
+ !(env->spr[SPR_HFSCR] & (1UL << bit))) {
+ raise_hv_fu_exception(env, bit, caller, cause, GETPC());
+ }
+#endif
+}
+
void helper_fscr_facility_check(CPUPPCState *env, uint32_t bit,
uint32_t sprn, uint32_t cause)
{
@@ -114,6 +137,8 @@ target_ulong helper_load_dpdes(CPUPPCState *env)
{
target_ulong dpdes = 0;
+ helper_hfscr_facility_check(env, HFSCR_MSGP, "load DPDES", HFSCR_IC_MSGP);
+
/* TODO: TCG supports only one thread */
if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) {
dpdes = 1;
@@ -127,6 +152,8 @@ void helper_store_dpdes(CPUPPCState *env, target_ulong val)
PowerPCCPU *cpu = env_archcpu(env);
CPUState *cs = CPU(cpu);
+ helper_hfscr_facility_check(env, HFSCR_MSGP, "store DPDES", HFSCR_IC_MSGP);
+
/* TODO: TCG supports only one thread */
if (val & ~0x1) {
qemu_log_mask(LOG_GUEST_ERROR, "Invalid DPDES register value "
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 09/35] spapr: Don't allow multiple active vCPUs at CAS
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (7 preceding siblings ...)
2020-02-03 6:10 ` [PULL 08/35] target/ppc: add support for Hypervisor Facility Unavailable Exception David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 10/35] ppc/pnv: Add support for HRMOR on Radix host David Gibson
` (26 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell; +Cc: lvivier, David Gibson, qemu-ppc, qemu-devel, groug
From: Greg Kurz <groug@kaod.org>
According to the description of "ibm,client-architecture-support" that
can found in LoPAPR "B.6.2.3 Root Node Methods":
If multiple partition processors or threads are active at the time of
the ibm,client-architecture-support method call, or an error is detected
in the format of the ibm,architecture.vec structure, the err? boolean
shall be TRUE; else FALSE.
We certainly don't want to temper with the platform or with the PCR of
the other vCPUs if they happen to be active. Ensure we have only one
active vCPU and fail CAS otherwise. This is just for conformance and
robustness, it doesn't fix any known bugs.
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <157969867170.571404.12117797348882189656.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr_hcall.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index ffb14641f9..b8bb66b5c0 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1676,6 +1676,18 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
Error *local_err = NULL;
bool raw_mode_supported = false;
bool guest_xive;
+ CPUState *cs;
+
+ /* CAS is supposed to be called early when only the boot vCPU is active. */
+ CPU_FOREACH(cs) {
+ if (cs == CPU(cpu)) {
+ continue;
+ }
+ if (!cs->halted) {
+ warn_report("guest has multiple active vCPUs at CAS, which is not allowed");
+ return H_MULTI_THREADS_ACTIVE;
+ }
+ }
cas_pvr = cas_check_pvr(spapr, cpu, &addr, &raw_mode_supported, &local_err);
if (local_err) {
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 10/35] ppc/pnv: Add support for HRMOR on Radix host
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (8 preceding siblings ...)
2020-02-03 6:10 ` [PULL 09/35] spapr: Don't allow multiple active vCPUs at CAS David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:10 ` [PULL 11/35] ppc/pnv: remove useless "core-pir" property alias David Gibson
` (25 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
David Gibson
From: Cédric Le Goater <clg@kaod.org>
When in HV mode, if EA[0] is 0, the Hypervisor Offset Real Mode
Register controls the access.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200127144154.10170-2-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/mmu-radix64.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/target/ppc/mmu-radix64.c b/target/ppc/mmu-radix64.c
index 066e324464..224e646c50 100644
--- a/target/ppc/mmu-radix64.c
+++ b/target/ppc/mmu-radix64.c
@@ -235,6 +235,12 @@ int ppc_radix64_handle_mmu_fault(PowerPCCPU *cpu, vaddr eaddr, int rwx,
/* In real mode top 4 effective addr bits (mostly) ignored */
raddr = eaddr & 0x0FFFFFFFFFFFFFFFULL;
+ /* In HV mode, add HRMOR if top EA bit is clear */
+ if (msr_hv || !env->has_hv_mode) {
+ if (!(eaddr >> 63)) {
+ raddr |= env->spr[SPR_HRMOR];
+ }
+ }
tlb_set_page(cs, eaddr & TARGET_PAGE_MASK, raddr & TARGET_PAGE_MASK,
PAGE_READ | PAGE_WRITE | PAGE_EXEC, mmu_idx,
TARGET_PAGE_SIZE);
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 11/35] ppc/pnv: remove useless "core-pir" property alias.
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (9 preceding siblings ...)
2020-02-03 6:10 ` [PULL 10/35] ppc/pnv: Add support for HRMOR on Radix host David Gibson
@ 2020-02-03 6:10 ` David Gibson
2020-02-03 6:11 ` [PULL 12/35] ppc/pnv: Add support for "hostboot" mode David Gibson
` (24 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:10 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
David Gibson
From: Cédric Le Goater <clg@kaod.org>
Commit 158e17a65e1a ("ppc/pnv: Link "chip" property to PnvCore::chip
pointer") introduced some cleanups of the PnvCore realize handler.
Let's continue by reworking a bit the interface of the PnvCore
handlers for the CPU threads. These changes make the "core-pir"
property alias unused. Remove it.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200127144154.10170-3-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/pnv_core.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 8ca5fbd1a9..5fe3f21e12 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -40,11 +40,11 @@ static const char *pnv_core_cpu_typename(PnvCore *pc)
return cpu_type;
}
-static void pnv_core_cpu_reset(PowerPCCPU *cpu, PnvChip *chip)
+static void pnv_core_cpu_reset(PnvCore *pc, PowerPCCPU *cpu)
{
CPUState *cs = CPU(cpu);
CPUPPCState *env = &cpu->env;
- PnvChipClass *pcc = PNV_CHIP_GET_CLASS(chip);
+ PnvChipClass *pcc = PNV_CHIP_GET_CLASS(pc->chip);
cpu_reset(cs);
@@ -56,7 +56,7 @@ static void pnv_core_cpu_reset(PowerPCCPU *cpu, PnvChip *chip)
env->nip = 0x10;
env->msr |= MSR_HVB; /* Hypervisor mode */
- pcc->intc_reset(chip, cpu);
+ pcc->intc_reset(pc->chip, cpu);
}
/*
@@ -162,14 +162,14 @@ static const MemoryRegionOps pnv_core_power9_xscom_ops = {
.endianness = DEVICE_BIG_ENDIAN,
};
-static void pnv_core_cpu_realize(PowerPCCPU *cpu, PnvChip *chip, Error **errp)
+static void pnv_core_cpu_realize(PnvCore *pc, PowerPCCPU *cpu, Error **errp)
{
CPUPPCState *env = &cpu->env;
int core_pir;
int thread_index = 0; /* TODO: TCG supports only one thread */
ppc_spr_t *pir = &env->spr_cb[SPR_PIR];
Error *local_err = NULL;
- PnvChipClass *pcc = PNV_CHIP_GET_CLASS(chip);
+ PnvChipClass *pcc = PNV_CHIP_GET_CLASS(pc->chip);
object_property_set_bool(OBJECT(cpu), true, "realized", &local_err);
if (local_err) {
@@ -177,13 +177,13 @@ static void pnv_core_cpu_realize(PowerPCCPU *cpu, PnvChip *chip, Error **errp)
return;
}
- pcc->intc_create(chip, cpu, &local_err);
+ pcc->intc_create(pc->chip, cpu, &local_err);
if (local_err) {
error_propagate(errp, local_err);
return;
}
- core_pir = object_property_get_uint(OBJECT(cpu), "core-pir", &error_abort);
+ core_pir = object_property_get_uint(OBJECT(pc), "pir", &error_abort);
/*
* The PIR of a thread is the core PIR + the thread index. We will
@@ -203,7 +203,7 @@ static void pnv_core_reset(void *dev)
int i;
for (i = 0; i < cc->nr_threads; i++) {
- pnv_core_cpu_reset(pc->threads[i], pc->chip);
+ pnv_core_cpu_reset(pc, pc->threads[i]);
}
}
@@ -231,8 +231,6 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
snprintf(name, sizeof(name), "thread[%d]", i);
object_property_add_child(OBJECT(pc), name, obj, &error_abort);
- object_property_add_alias(obj, "core-pir", OBJECT(pc),
- "pir", &error_abort);
cpu->machine_data = g_new0(PnvCPUState, 1);
@@ -240,7 +238,7 @@ static void pnv_core_realize(DeviceState *dev, Error **errp)
}
for (j = 0; j < cc->nr_threads; j++) {
- pnv_core_cpu_realize(pc->threads[j], pc->chip, &local_err);
+ pnv_core_cpu_realize(pc, pc->threads[j], &local_err);
if (local_err) {
goto err;
}
@@ -263,12 +261,12 @@ err:
error_propagate(errp, local_err);
}
-static void pnv_core_cpu_unrealize(PowerPCCPU *cpu, PnvChip *chip)
+static void pnv_core_cpu_unrealize(PnvCore *pc, PowerPCCPU *cpu)
{
PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
- PnvChipClass *pcc = PNV_CHIP_GET_CLASS(chip);
+ PnvChipClass *pcc = PNV_CHIP_GET_CLASS(pc->chip);
- pcc->intc_destroy(chip, cpu);
+ pcc->intc_destroy(pc->chip, cpu);
cpu_remove_sync(CPU(cpu));
cpu->machine_data = NULL;
g_free(pnv_cpu);
@@ -284,7 +282,7 @@ static void pnv_core_unrealize(DeviceState *dev, Error **errp)
qemu_unregister_reset(pnv_core_reset, pc);
for (i = 0; i < cc->nr_threads; i++) {
- pnv_core_cpu_unrealize(pc->threads[i], pc->chip);
+ pnv_core_cpu_unrealize(pc, pc->threads[i]);
}
g_free(pc->threads);
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 12/35] ppc/pnv: Add support for "hostboot" mode
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (10 preceding siblings ...)
2020-02-03 6:10 ` [PULL 11/35] ppc/pnv: remove useless "core-pir" property alias David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 13/35] tpm: Move tpm_tis_show_buffer to tpm_util.c David Gibson
` (23 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
David Gibson
From: Cédric Le Goater <clg@kaod.org>
When the "hb-mode" option is activated on the powernv machine, the
firmware is mapped at 0x8000000 and the HRMOR of the HW threads are
set to the same address.
The PNOR mapping on the FW address space of the LPC bus is left enabled
to let the firmware load any other images required to boot the host.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200127144154.10170-4-clg@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/pnv.c | 28 +++++++++++++++++++++++++++-
hw/ppc/pnv_core.c | 3 +++
hw/ppc/pnv_lpc.c | 5 ++++-
include/hw/ppc/pnv.h | 2 ++
include/hw/ppc/pnv_core.h | 1 +
5 files changed, 37 insertions(+), 2 deletions(-)
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index e61994cf5a..9442e5eb63 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -716,7 +716,7 @@ static void pnv_init(MachineState *machine)
exit(1);
}
- fw_size = load_image_targphys(fw_filename, FW_LOAD_ADDR, FW_MAX_SIZE);
+ fw_size = load_image_targphys(fw_filename, pnv->fw_load_addr, FW_MAX_SIZE);
if (fw_size < 0) {
error_report("Could not load OPAL firmware '%s'", fw_filename);
exit(1);
@@ -1533,6 +1533,7 @@ static void pnv_chip_core_realize(PnvChip *chip, Error **errp)
PnvChipClass *pcc = PNV_CHIP_GET_CLASS(chip);
const char *typename = pnv_chip_core_typename(chip);
int i, core_hwid;
+ PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
if (!object_class_by_name(typename)) {
error_setg(errp, "Unable to find PowerNV CPU Core '%s'", typename);
@@ -1571,6 +1572,8 @@ static void pnv_chip_core_realize(PnvChip *chip, Error **errp)
object_property_set_int(OBJECT(pnv_core),
pcc->core_pir(chip, core_hwid),
"pir", &error_fatal);
+ object_property_set_int(OBJECT(pnv_core), pnv->fw_load_addr,
+ "hrmor", &error_fatal);
object_property_set_link(OBJECT(pnv_core), OBJECT(chip), "chip",
&error_abort);
object_property_set_bool(OBJECT(pnv_core), true, "realized",
@@ -1767,6 +1770,22 @@ static void pnv_machine_power10_class_init(ObjectClass *oc, void *data)
pmc->dt_power_mgt = pnv_dt_power_mgt;
}
+static bool pnv_machine_get_hb(Object *obj, Error **errp)
+{
+ PnvMachineState *pnv = PNV_MACHINE(obj);
+
+ return !!pnv->fw_load_addr;
+}
+
+static void pnv_machine_set_hb(Object *obj, bool value, Error **errp)
+{
+ PnvMachineState *pnv = PNV_MACHINE(obj);
+
+ if (value) {
+ pnv->fw_load_addr = 0x8000000;
+ }
+}
+
static void pnv_machine_class_init(ObjectClass *oc, void *data)
{
MachineClass *mc = MACHINE_CLASS(oc);
@@ -1786,6 +1805,13 @@ static void pnv_machine_class_init(ObjectClass *oc, void *data)
*/
mc->default_ram_size = INITRD_LOAD_ADDR + INITRD_MAX_SIZE;
ispc->print_info = pnv_pic_print_info;
+
+ object_class_property_add_bool(oc, "hb-mode",
+ pnv_machine_get_hb, pnv_machine_set_hb,
+ &error_abort);
+ object_class_property_set_description(oc, "hb-mode",
+ "Use a hostboot like boot loader",
+ NULL);
}
#define DEFINE_PNV8_CHIP_TYPE(type, class_initfn) \
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 5fe3f21e12..f7247222bc 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -56,6 +56,8 @@ static void pnv_core_cpu_reset(PnvCore *pc, PowerPCCPU *cpu)
env->nip = 0x10;
env->msr |= MSR_HVB; /* Hypervisor mode */
+ env->spr[SPR_HRMOR] = pc->hrmor;
+
pcc->intc_reset(pc->chip, cpu);
}
@@ -289,6 +291,7 @@ static void pnv_core_unrealize(DeviceState *dev, Error **errp)
static Property pnv_core_properties[] = {
DEFINE_PROP_UINT32("pir", PnvCore, pir, 0),
+ DEFINE_PROP_UINT64("hrmor", PnvCore, hrmor, 0),
DEFINE_PROP_LINK("chip", PnvCore, chip, TYPE_PNV_CHIP, PnvChip *),
DEFINE_PROP_END_OF_LIST(),
};
diff --git a/hw/ppc/pnv_lpc.c b/hw/ppc/pnv_lpc.c
index 22b205532b..d1de98f04c 100644
--- a/hw/ppc/pnv_lpc.c
+++ b/hw/ppc/pnv_lpc.c
@@ -825,6 +825,7 @@ ISABus *pnv_lpc_isa_create(PnvLpcController *lpc, bool use_cpld, Error **errp)
qemu_irq *irqs;
qemu_irq_handler handler;
PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
+ bool hostboot_mode = !!pnv->fw_load_addr;
/* let isa_bus_new() create its own bridge on SysBus otherwise
* devices speficied on the command line won't find the bus and
@@ -859,7 +860,9 @@ ISABus *pnv_lpc_isa_create(PnvLpcController *lpc, bool use_cpld, Error **errp)
* Start disabled. The HIOMAP protocol will activate the mapping
* with HIOMAP_C_CREATE_WRITE_WINDOW
*/
- memory_region_set_enabled(&pnv->pnor->mmio, false);
+ if (!hostboot_mode) {
+ memory_region_set_enabled(&pnv->pnor->mmio, false);
+ }
return isa_bus;
}
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index d65dd32036..f225f2f6bf 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -217,6 +217,8 @@ struct PnvMachineState {
Notifier powerdown_notifier;
PnvPnor *pnor;
+
+ hwaddr fw_load_addr;
};
#define PNV_FDT_ADDR 0x01000000
diff --git a/include/hw/ppc/pnv_core.h b/include/hw/ppc/pnv_core.h
index 55eee95104..113550eb7f 100644
--- a/include/hw/ppc/pnv_core.h
+++ b/include/hw/ppc/pnv_core.h
@@ -40,6 +40,7 @@ typedef struct PnvCore {
/*< public >*/
PowerPCCPU **threads;
uint32_t pir;
+ uint64_t hrmor;
PnvChip *chip;
MemoryRegion xscom_regs;
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 13/35] tpm: Move tpm_tis_show_buffer to tpm_util.c
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (11 preceding siblings ...)
2020-02-03 6:11 ` [PULL 12/35] ppc/pnv: Add support for "hostboot" mode David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 14/35] spapr: Implement get_dt_compatible() callback David Gibson
` (22 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Stefan Berger, qemu-devel, groug, qemu-ppc,
David Gibson, Philippe Mathieu-Daudé,
Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20200121152935.649898-2-stefanb@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/tpm/tpm_tis.c | 32 ++++----------------------------
hw/tpm/tpm_util.c | 25 +++++++++++++++++++++++++
hw/tpm/tpm_util.h | 3 +++
hw/tpm/trace-events | 2 +-
4 files changed, 33 insertions(+), 29 deletions(-)
diff --git a/hw/tpm/tpm_tis.c b/hw/tpm/tpm_tis.c
index 5362df2711..31facb896d 100644
--- a/hw/tpm/tpm_tis.c
+++ b/hw/tpm/tpm_tis.c
@@ -107,30 +107,6 @@ static uint8_t tpm_tis_locality_from_addr(hwaddr addr)
return (uint8_t)((addr >> TPM_TIS_LOCALITY_SHIFT) & 0x7);
}
-static void tpm_tis_show_buffer(const unsigned char *buffer,
- size_t buffer_size, const char *string)
-{
- size_t len, i;
- char *line_buffer, *p;
-
- len = MIN(tpm_cmd_get_size(buffer), buffer_size);
-
- /*
- * allocate enough room for 3 chars per buffer entry plus a
- * newline after every 16 chars and a final null terminator.
- */
- line_buffer = g_malloc(len * 3 + (len / 16) + 1);
-
- for (i = 0, p = line_buffer; i < len; i++) {
- if (i && !(i % 16)) {
- p += sprintf(p, "\n");
- }
- p += sprintf(p, "%.2X ", buffer[i]);
- }
- trace_tpm_tis_show_buffer(string, len, line_buffer);
-
- g_free(line_buffer);
-}
/*
* Set the given flags in the STS register by clearing the register but
@@ -156,8 +132,8 @@ static void tpm_tis_sts_set(TPMLocality *l, uint32_t flags)
*/
static void tpm_tis_tpm_send(TPMState *s, uint8_t locty)
{
- if (trace_event_get_state_backends(TRACE_TPM_TIS_SHOW_BUFFER)) {
- tpm_tis_show_buffer(s->buffer, s->be_buffer_size, "To TPM");
+ if (trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER)) {
+ tpm_util_show_buffer(s->buffer, s->be_buffer_size, "To TPM");
}
/*
@@ -325,8 +301,8 @@ static void tpm_tis_request_completed(TPMIf *ti, int ret)
s->loc[locty].state = TPM_TIS_STATE_COMPLETION;
s->rw_offset = 0;
- if (trace_event_get_state_backends(TRACE_TPM_TIS_SHOW_BUFFER)) {
- tpm_tis_show_buffer(s->buffer, s->be_buffer_size, "From TPM");
+ if (trace_event_get_state_backends(TRACE_TPM_UTIL_SHOW_BUFFER)) {
+ tpm_util_show_buffer(s->buffer, s->be_buffer_size, "From TPM");
}
if (TPM_TIS_IS_VALID_LOCTY(s->next_locty)) {
diff --git a/hw/tpm/tpm_util.c b/hw/tpm/tpm_util.c
index 62b091f0c0..c0a0f3d71f 100644
--- a/hw/tpm/tpm_util.c
+++ b/hw/tpm/tpm_util.c
@@ -350,3 +350,28 @@ void tpm_sized_buffer_reset(TPMSizedBuffer *tsb)
tsb->buffer = NULL;
tsb->size = 0;
}
+
+void tpm_util_show_buffer(const unsigned char *buffer,
+ size_t buffer_size, const char *string)
+{
+ size_t len, i;
+ char *line_buffer, *p;
+
+ len = MIN(tpm_cmd_get_size(buffer), buffer_size);
+
+ /*
+ * allocate enough room for 3 chars per buffer entry plus a
+ * newline after every 16 chars and a final null terminator.
+ */
+ line_buffer = g_malloc(len * 3 + (len / 16) + 1);
+
+ for (i = 0, p = line_buffer; i < len; i++) {
+ if (i && !(i % 16)) {
+ p += sprintf(p, "\n");
+ }
+ p += sprintf(p, "%.2X ", buffer[i]);
+ }
+ trace_tpm_util_show_buffer(string, len, line_buffer);
+
+ g_free(line_buffer);
+}
diff --git a/hw/tpm/tpm_util.h b/hw/tpm/tpm_util.h
index f397ac21b8..7889081fba 100644
--- a/hw/tpm/tpm_util.h
+++ b/hw/tpm/tpm_util.h
@@ -79,4 +79,7 @@ typedef struct TPMSizedBuffer {
void tpm_sized_buffer_reset(TPMSizedBuffer *tsb);
+void tpm_util_show_buffer(const unsigned char *buffer,
+ size_t buffer_size, const char *string);
+
#endif /* TPM_TPM_UTIL_H */
diff --git a/hw/tpm/trace-events b/hw/tpm/trace-events
index 89804bcd64..357c9e9a84 100644
--- a/hw/tpm/trace-events
+++ b/hw/tpm/trace-events
@@ -14,6 +14,7 @@ tpm_util_get_buffer_size_len(uint32_t len, size_t expected) "tpm_resp->len = %u,
tpm_util_get_buffer_size_hdr_len2(uint32_t len, size_t expected) "tpm2_resp->hdr.len = %u, expected = %zu"
tpm_util_get_buffer_size_len2(uint32_t len, size_t expected) "tpm2_resp->len = %u, expected = %zu"
tpm_util_get_buffer_size(size_t len) "buffersize of device: %zu"
+tpm_util_show_buffer(const char *direction, size_t len, const char *buf) "direction: %s len: %zu\n%s"
# tpm_emulator.c
tpm_emulator_set_locality(uint8_t locty) "setting locality to %d"
@@ -36,7 +37,6 @@ tpm_emulator_pre_save(void) ""
tpm_emulator_inst_init(void) ""
# tpm_tis.c
-tpm_tis_show_buffer(const char *direction, size_t len, const char *buf) "direction: %s len: %zu\nbuf: %s"
tpm_tis_raise_irq(uint32_t irqmask) "Raising IRQ for flag 0x%08x"
tpm_tis_new_active_locality(uint8_t locty) "Active locality is now %d"
tpm_tis_abort(uint8_t locty) "New active locality is %d"
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 14/35] spapr: Implement get_dt_compatible() callback
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (12 preceding siblings ...)
2020-02-03 6:11 ` [PULL 13/35] tpm: Move tpm_tis_show_buffer to tpm_util.c David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 15/35] tpm_spapr: Support TPM for ppc64 using CRQ based interface David Gibson
` (21 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Stefan Berger, qemu-devel, groug, qemu-ppc,
Marc-André Lureau, David Gibson, Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
For devices that cannot be statically initialized, implement a
get_dt_compatible() callback that allows us to ask the device for
the 'compatible' value.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20200121152935.649898-3-stefanb@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr_vio.c | 11 +++++++++--
include/hw/ppc/spapr_vio.h | 1 +
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index f14944e900..0b085eabe4 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -87,6 +87,7 @@ static int vio_make_devnode(SpaprVioDevice *dev,
SpaprVioDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
int vdevice_off, node_off, ret;
char *dt_name;
+ const char *dt_compatible;
vdevice_off = fdt_path_offset(fdt, "/vdevice");
if (vdevice_off < 0) {
@@ -113,9 +114,15 @@ static int vio_make_devnode(SpaprVioDevice *dev,
}
}
- if (pc->dt_compatible) {
+ if (pc->get_dt_compatible) {
+ dt_compatible = pc->get_dt_compatible(dev);
+ } else {
+ dt_compatible = pc->dt_compatible;
+ }
+
+ if (dt_compatible) {
ret = fdt_setprop_string(fdt, node_off, "compatible",
- pc->dt_compatible);
+ dt_compatible);
if (ret < 0) {
return ret;
}
diff --git a/include/hw/ppc/spapr_vio.h b/include/hw/ppc/spapr_vio.h
index ce6d9b0c66..bed7df60e3 100644
--- a/include/hw/ppc/spapr_vio.h
+++ b/include/hw/ppc/spapr_vio.h
@@ -58,6 +58,7 @@ typedef struct SpaprVioDeviceClass {
void (*realize)(SpaprVioDevice *dev, Error **errp);
void (*reset)(SpaprVioDevice *dev);
int (*devnode)(SpaprVioDevice *dev, void *fdt, int node_off);
+ const char *(*get_dt_compatible)(SpaprVioDevice *dev);
} SpaprVioDeviceClass;
struct SpaprVioDevice {
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 15/35] tpm_spapr: Support TPM for ppc64 using CRQ based interface
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (13 preceding siblings ...)
2020-02-03 6:11 ` [PULL 14/35] spapr: Implement get_dt_compatible() callback David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 16/35] tpm_spapr: Support suspend and resume David Gibson
` (20 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Stefan Berger, qemu-devel, groug, qemu-ppc, David Gibson
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement support for TPM on ppc64 by implementing the vTPM CRQ interface
as a frontend. It can use the tpm_emulator driver backend with the external
swtpm.
The Linux vTPM driver for ppc64 works with this emulation.
This TPM emulator also handles the TPM 2 case.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20200121152935.649898-4-stefanb@linux.ibm.com>
[dwg: Use device_class_set_props(), tweak Kconfig]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
docs/specs/tpm.txt | 20 ++-
hw/tpm/Kconfig | 6 +
hw/tpm/Makefile.objs | 1 +
hw/tpm/tpm_spapr.c | 379 +++++++++++++++++++++++++++++++++++++++++++
hw/tpm/trace-events | 12 ++
include/sysemu/tpm.h | 3 +
qapi/tpm.json | 6 +-
7 files changed, 423 insertions(+), 4 deletions(-)
create mode 100644 hw/tpm/tpm_spapr.c
diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt
index 9c8cca042d..9c3e67d8a7 100644
--- a/docs/specs/tpm.txt
+++ b/docs/specs/tpm.txt
@@ -34,6 +34,12 @@ The CRB interface makes a memory mapped IO region in the area 0xfed40000 -
QEMU files related to TPM CRB interface:
- hw/tpm/tpm_crb.c
+
+pSeries (ppc64) machines offer a tpm-spapr device model.
+
+QEMU files related to the SPAPR interface:
+ - hw/tpm/tpm_spapr.c
+
= fw_cfg interface =
The bios/firmware may read the "etc/tpm/config" fw_cfg entry for
@@ -281,7 +287,7 @@ swtpm socket --tpmstate dir=/tmp/mytpm1 \
--log level=20
Command line to start QEMU with the TPM emulator device communicating with
-the swtpm:
+the swtpm (x86):
qemu-system-x86_64 -display sdl -accel kvm \
-m 1024 -boot d -bios bios-256k.bin -boot menu=on \
@@ -289,6 +295,18 @@ qemu-system-x86_64 -display sdl -accel kvm \
-tpmdev emulator,id=tpm0,chardev=chrtpm \
-device tpm-tis,tpmdev=tpm0 test.img
+In case a pSeries machine is emulated, use the following command line:
+
+qemu-system-ppc64 -display sdl -machine pseries,accel=kvm \
+ -m 1024 -bios slof.bin -boot menu=on \
+ -nodefaults -device VGA -device pci-ohci -device usb-kbd \
+ -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-spapr,tpmdev=tpm0 \
+ -device spapr-vscsi,id=scsi0,reg=0x00002000 \
+ -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \
+ -drive file=test.img,format=raw,if=none,id=drive-virtio-disk0
+
In case SeaBIOS is used as firmware, it should show the TPM menu item
after entering the menu with 'ESC'.
diff --git a/hw/tpm/Kconfig b/hw/tpm/Kconfig
index 4c8ee87d67..4d4ab0855c 100644
--- a/hw/tpm/Kconfig
+++ b/hw/tpm/Kconfig
@@ -22,3 +22,9 @@ config TPM_EMULATOR
bool
default y
depends on TPMDEV
+
+config TPM_SPAPR
+ bool
+ default n
+ depends on TPM && PSERIES
+ select TPMDEV
diff --git a/hw/tpm/Makefile.objs b/hw/tpm/Makefile.objs
index de0b85d02a..85eb99ae05 100644
--- a/hw/tpm/Makefile.objs
+++ b/hw/tpm/Makefile.objs
@@ -4,3 +4,4 @@ common-obj-$(CONFIG_TPM_TIS) += tpm_tis.o
common-obj-$(CONFIG_TPM_CRB) += tpm_crb.o
common-obj-$(CONFIG_TPM_PASSTHROUGH) += tpm_passthrough.o
common-obj-$(CONFIG_TPM_EMULATOR) += tpm_emulator.o
+obj-$(CONFIG_TPM_SPAPR) += tpm_spapr.o
diff --git a/hw/tpm/tpm_spapr.c b/hw/tpm/tpm_spapr.c
new file mode 100644
index 0000000000..2ac4cb061c
--- /dev/null
+++ b/hw/tpm/tpm_spapr.c
@@ -0,0 +1,379 @@
+/*
+ * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
+ *
+ * PAPR Virtual TPM
+ *
+ * Copyright (c) 2015, 2017, 2019 IBM Corporation.
+ *
+ * Authors:
+ * Stefan Berger <stefanb@linux.vnet.ibm.com>
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+
+#include "sysemu/tpm_backend.h"
+#include "tpm_int.h"
+#include "tpm_util.h"
+
+#include "hw/ppc/spapr.h"
+#include "hw/ppc/spapr_vio.h"
+#include "trace.h"
+
+#define DEBUG_SPAPR 0
+
+#define VIO_SPAPR_VTPM(obj) \
+ OBJECT_CHECK(SpaprTpmState, (obj), TYPE_TPM_SPAPR)
+
+typedef struct TpmCrq {
+ uint8_t valid; /* 0x80: cmd; 0xc0: init crq */
+ /* 0x81-0x83: CRQ message response */
+ uint8_t msg; /* see below */
+ uint16_t len; /* len of TPM request; len of TPM response */
+ uint32_t data; /* rtce_dma_handle when sending TPM request */
+ uint64_t reserved;
+} TpmCrq;
+
+#define SPAPR_VTPM_VALID_INIT_CRQ_COMMAND 0xC0
+#define SPAPR_VTPM_VALID_COMMAND 0x80
+#define SPAPR_VTPM_MSG_RESULT 0x80
+
+/* msg types for valid = SPAPR_VTPM_VALID_INIT_CRQ */
+#define SPAPR_VTPM_INIT_CRQ_RESULT 0x1
+#define SPAPR_VTPM_INIT_CRQ_COMPLETE_RESULT 0x2
+
+/* msg types for valid = SPAPR_VTPM_VALID_CMD */
+#define SPAPR_VTPM_GET_VERSION 0x1
+#define SPAPR_VTPM_TPM_COMMAND 0x2
+#define SPAPR_VTPM_GET_RTCE_BUFFER_SIZE 0x3
+#define SPAPR_VTPM_PREPARE_TO_SUSPEND 0x4
+
+/* response error messages */
+#define SPAPR_VTPM_VTPM_ERROR 0xff
+
+/* error codes */
+#define SPAPR_VTPM_ERR_COPY_IN_FAILED 0x3
+#define SPAPR_VTPM_ERR_COPY_OUT_FAILED 0x4
+
+#define TPM_SPAPR_BUFFER_MAX 4096
+
+typedef struct {
+ SpaprVioDevice vdev;
+
+ TpmCrq crq; /* track single TPM command */
+
+ uint8_t state;
+#define SPAPR_VTPM_STATE_NONE 0
+#define SPAPR_VTPM_STATE_EXECUTION 1
+#define SPAPR_VTPM_STATE_COMPLETION 2
+
+ unsigned char *buffer;
+
+ TPMBackendCmd cmd;
+
+ TPMBackend *be_driver;
+ TPMVersion be_tpm_version;
+
+ size_t be_buffer_size;
+} SpaprTpmState;
+
+/*
+ * Send a request to the TPM.
+ */
+static void tpm_spapr_tpm_send(SpaprTpmState *s)
+{
+ if (trace_event_get_state_backends(TRACE_TPM_SPAPR_SHOW_BUFFER)) {
+ tpm_util_show_buffer(s->buffer, s->be_buffer_size, "To TPM");
+ }
+
+ s->state = SPAPR_VTPM_STATE_EXECUTION;
+ s->cmd = (TPMBackendCmd) {
+ .locty = 0,
+ .in = s->buffer,
+ .in_len = MIN(tpm_cmd_get_size(s->buffer), s->be_buffer_size),
+ .out = s->buffer,
+ .out_len = s->be_buffer_size,
+ };
+
+ tpm_backend_deliver_request(s->be_driver, &s->cmd);
+}
+
+static int tpm_spapr_process_cmd(SpaprTpmState *s, uint64_t dataptr)
+{
+ long rc;
+
+ /* a max. of be_buffer_size bytes can be transported */
+ rc = spapr_vio_dma_read(&s->vdev, dataptr,
+ s->buffer, s->be_buffer_size);
+ if (rc) {
+ error_report("tpm_spapr_got_payload: DMA read failure");
+ }
+ /* let vTPM handle any malformed request */
+ tpm_spapr_tpm_send(s);
+
+ return rc;
+}
+
+static inline int spapr_tpm_send_crq(struct SpaprVioDevice *dev, TpmCrq *crq)
+{
+ return spapr_vio_send_crq(dev, (uint8_t *)crq);
+}
+
+static int tpm_spapr_do_crq(struct SpaprVioDevice *dev, uint8_t *crq_data)
+{
+ SpaprTpmState *s = VIO_SPAPR_VTPM(dev);
+ TpmCrq local_crq;
+ TpmCrq *crq = &s->crq; /* requests only */
+ int rc;
+ uint8_t valid = crq_data[0];
+ uint8_t msg = crq_data[1];
+
+ trace_tpm_spapr_do_crq(valid, msg);
+
+ switch (valid) {
+ case SPAPR_VTPM_VALID_INIT_CRQ_COMMAND: /* Init command/response */
+
+ /* Respond to initialization request */
+ switch (msg) {
+ case SPAPR_VTPM_INIT_CRQ_RESULT:
+ trace_tpm_spapr_do_crq_crq_result();
+ memset(&local_crq, 0, sizeof(local_crq));
+ local_crq.valid = SPAPR_VTPM_VALID_INIT_CRQ_COMMAND;
+ local_crq.msg = SPAPR_VTPM_INIT_CRQ_RESULT;
+ spapr_tpm_send_crq(dev, &local_crq);
+ break;
+
+ case SPAPR_VTPM_INIT_CRQ_COMPLETE_RESULT:
+ trace_tpm_spapr_do_crq_crq_complete_result();
+ memset(&local_crq, 0, sizeof(local_crq));
+ local_crq.valid = SPAPR_VTPM_VALID_INIT_CRQ_COMMAND;
+ local_crq.msg = SPAPR_VTPM_INIT_CRQ_COMPLETE_RESULT;
+ spapr_tpm_send_crq(dev, &local_crq);
+ break;
+ }
+
+ break;
+ case SPAPR_VTPM_VALID_COMMAND: /* Payloads */
+ switch (msg) {
+ case SPAPR_VTPM_TPM_COMMAND:
+ trace_tpm_spapr_do_crq_tpm_command();
+ if (s->state == SPAPR_VTPM_STATE_EXECUTION) {
+ return H_BUSY;
+ }
+ memcpy(crq, crq_data, sizeof(*crq));
+
+ rc = tpm_spapr_process_cmd(s, be32_to_cpu(crq->data));
+
+ if (rc == H_SUCCESS) {
+ crq->valid = be16_to_cpu(0);
+ } else {
+ local_crq.valid = SPAPR_VTPM_MSG_RESULT;
+ local_crq.msg = SPAPR_VTPM_VTPM_ERROR;
+ local_crq.len = cpu_to_be16(0);
+ local_crq.data = cpu_to_be32(SPAPR_VTPM_ERR_COPY_IN_FAILED);
+ spapr_tpm_send_crq(dev, &local_crq);
+ }
+ break;
+
+ case SPAPR_VTPM_GET_RTCE_BUFFER_SIZE:
+ trace_tpm_spapr_do_crq_tpm_get_rtce_buffer_size(s->be_buffer_size);
+ local_crq.valid = SPAPR_VTPM_VALID_COMMAND;
+ local_crq.msg = SPAPR_VTPM_GET_RTCE_BUFFER_SIZE |
+ SPAPR_VTPM_MSG_RESULT;
+ local_crq.len = cpu_to_be16(s->be_buffer_size);
+ spapr_tpm_send_crq(dev, &local_crq);
+ break;
+
+ case SPAPR_VTPM_GET_VERSION:
+ local_crq.valid = SPAPR_VTPM_VALID_COMMAND;
+ local_crq.msg = SPAPR_VTPM_GET_VERSION | SPAPR_VTPM_MSG_RESULT;
+ local_crq.len = cpu_to_be16(0);
+ switch (s->be_tpm_version) {
+ case TPM_VERSION_1_2:
+ local_crq.data = cpu_to_be32(1);
+ break;
+ case TPM_VERSION_2_0:
+ local_crq.data = cpu_to_be32(2);
+ break;
+ default:
+ g_assert_not_reached();
+ break;
+ }
+ trace_tpm_spapr_do_crq_get_version(be32_to_cpu(local_crq.data));
+ spapr_tpm_send_crq(dev, &local_crq);
+ break;
+
+ case SPAPR_VTPM_PREPARE_TO_SUSPEND:
+ trace_tpm_spapr_do_crq_prepare_to_suspend();
+ local_crq.valid = SPAPR_VTPM_VALID_COMMAND;
+ local_crq.msg = SPAPR_VTPM_PREPARE_TO_SUSPEND |
+ SPAPR_VTPM_MSG_RESULT;
+ spapr_tpm_send_crq(dev, &local_crq);
+ break;
+
+ default:
+ trace_tpm_spapr_do_crq_unknown_msg_type(crq->msg);
+ }
+ break;
+ default:
+ trace_tpm_spapr_do_crq_unknown_crq(valid, msg);
+ };
+
+ return H_SUCCESS;
+}
+
+static void tpm_spapr_request_completed(TPMIf *ti, int ret)
+{
+ SpaprTpmState *s = VIO_SPAPR_VTPM(ti);
+ TpmCrq *crq = &s->crq;
+ uint32_t len;
+ int rc;
+
+ s->state = SPAPR_VTPM_STATE_COMPLETION;
+
+ /* a max. of be_buffer_size bytes can be transported */
+ len = MIN(tpm_cmd_get_size(s->buffer), s->be_buffer_size);
+ rc = spapr_vio_dma_write(&s->vdev, be32_to_cpu(crq->data),
+ s->buffer, len);
+
+ if (trace_event_get_state_backends(TRACE_TPM_SPAPR_SHOW_BUFFER)) {
+ tpm_util_show_buffer(s->buffer, len, "From TPM");
+ }
+
+ crq->valid = SPAPR_VTPM_MSG_RESULT;
+ if (rc == H_SUCCESS) {
+ crq->msg = SPAPR_VTPM_TPM_COMMAND | SPAPR_VTPM_MSG_RESULT;
+ crq->len = cpu_to_be16(len);
+ } else {
+ error_report("%s: DMA write failure", __func__);
+ crq->msg = SPAPR_VTPM_VTPM_ERROR;
+ crq->len = cpu_to_be16(0);
+ crq->data = cpu_to_be32(SPAPR_VTPM_ERR_COPY_OUT_FAILED);
+ }
+
+ rc = spapr_tpm_send_crq(&s->vdev, crq);
+ if (rc) {
+ error_report("%s: Error sending response", __func__);
+ }
+}
+
+static int tpm_spapr_do_startup_tpm(SpaprTpmState *s, size_t buffersize)
+{
+ return tpm_backend_startup_tpm(s->be_driver, buffersize);
+}
+
+static const char *tpm_spapr_get_dt_compatible(SpaprVioDevice *dev)
+{
+ SpaprTpmState *s = VIO_SPAPR_VTPM(dev);
+
+ switch (s->be_tpm_version) {
+ case TPM_VERSION_1_2:
+ return "IBM,vtpm";
+ case TPM_VERSION_2_0:
+ return "IBM,vtpm20";
+ default:
+ g_assert_not_reached();
+ }
+}
+
+static void tpm_spapr_reset(SpaprVioDevice *dev)
+{
+ SpaprTpmState *s = VIO_SPAPR_VTPM(dev);
+
+ s->state = SPAPR_VTPM_STATE_NONE;
+
+ s->be_tpm_version = tpm_backend_get_tpm_version(s->be_driver);
+
+ s->be_buffer_size = MIN(tpm_backend_get_buffer_size(s->be_driver),
+ TPM_SPAPR_BUFFER_MAX);
+
+ tpm_backend_reset(s->be_driver);
+ tpm_spapr_do_startup_tpm(s, s->be_buffer_size);
+}
+
+static enum TPMVersion tpm_spapr_get_version(TPMIf *ti)
+{
+ SpaprTpmState *s = VIO_SPAPR_VTPM(ti);
+
+ if (tpm_backend_had_startup_error(s->be_driver)) {
+ return TPM_VERSION_UNSPEC;
+ }
+
+ return tpm_backend_get_tpm_version(s->be_driver);
+}
+
+static const VMStateDescription vmstate_spapr_vtpm = {
+ .name = "tpm-spapr",
+ .unmigratable = 1,
+};
+
+static Property tpm_spapr_properties[] = {
+ DEFINE_SPAPR_PROPERTIES(SpaprTpmState, vdev),
+ DEFINE_PROP_TPMBE("tpmdev", SpaprTpmState, be_driver),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void tpm_spapr_realizefn(SpaprVioDevice *dev, Error **errp)
+{
+ SpaprTpmState *s = VIO_SPAPR_VTPM(dev);
+
+ if (!tpm_find()) {
+ error_setg(errp, "at most one TPM device is permitted");
+ return;
+ }
+
+ dev->crq.SendFunc = tpm_spapr_do_crq;
+
+ if (!s->be_driver) {
+ error_setg(errp, "'tpmdev' property is required");
+ return;
+ }
+ s->buffer = g_malloc(TPM_SPAPR_BUFFER_MAX);
+}
+
+static void tpm_spapr_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
+ TPMIfClass *tc = TPM_IF_CLASS(klass);
+
+ k->realize = tpm_spapr_realizefn;
+ k->reset = tpm_spapr_reset;
+ k->dt_name = "vtpm";
+ k->dt_type = "IBM,vtpm";
+ k->get_dt_compatible = tpm_spapr_get_dt_compatible;
+ k->signal_mask = 0x00000001;
+ set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+ device_class_set_props(dc, tpm_spapr_properties);
+ k->rtce_window_size = 0x10000000;
+ dc->vmsd = &vmstate_spapr_vtpm;
+
+ tc->model = TPM_MODEL_TPM_SPAPR;
+ tc->get_version = tpm_spapr_get_version;
+ tc->request_completed = tpm_spapr_request_completed;
+}
+
+static const TypeInfo tpm_spapr_info = {
+ .name = TYPE_TPM_SPAPR,
+ .parent = TYPE_VIO_SPAPR_DEVICE,
+ .instance_size = sizeof(SpaprTpmState),
+ .class_init = tpm_spapr_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_TPM_IF },
+ { }
+ }
+};
+
+static void tpm_spapr_register_types(void)
+{
+ type_register_static(&tpm_spapr_info);
+}
+
+type_init(tpm_spapr_register_types)
diff --git a/hw/tpm/trace-events b/hw/tpm/trace-events
index 357c9e9a84..9143a8eaa3 100644
--- a/hw/tpm/trace-events
+++ b/hw/tpm/trace-events
@@ -55,3 +55,15 @@ tpm_tis_pre_save(uint8_t locty, uint32_t rw_offset) "locty: %d, rw_offset = %u"
# tpm_ppi.c
tpm_ppi_memset(uint8_t *ptr, size_t size) "memset: %p %zu"
+
+# hw/tpm/tpm_spapr.c
+tpm_spapr_show_buffer(const char *direction, size_t len, const char *buf) "direction: %s len: %zu\n%s"
+tpm_spapr_do_crq(uint8_t raw1, uint8_t raw2) "1st 2 bytes in CRQ: 0x%02x 0x%02x"
+tpm_spapr_do_crq_crq_result(void) "SPAPR_VTPM_INIT_CRQ_RESULT"
+tpm_spapr_do_crq_crq_complete_result(void) "SPAPR_VTPM_INIT_CRQ_COMP_RESULT"
+tpm_spapr_do_crq_tpm_command(void) "got TPM command payload"
+tpm_spapr_do_crq_tpm_get_rtce_buffer_size(size_t buffersize) "response: buffer size is %zu"
+tpm_spapr_do_crq_get_version(uint32_t version) "response: version %u"
+tpm_spapr_do_crq_prepare_to_suspend(void) "response: preparing to suspend"
+tpm_spapr_do_crq_unknown_msg_type(uint8_t type) "Unknown message type 0x%02x"
+tpm_spapr_do_crq_unknown_crq(uint8_t raw1, uint8_t raw2) "unknown CRQ 0x%02x 0x%02x ..."
diff --git a/include/sysemu/tpm.h b/include/sysemu/tpm.h
index 5b541a71c8..15979a3647 100644
--- a/include/sysemu/tpm.h
+++ b/include/sysemu/tpm.h
@@ -45,11 +45,14 @@ typedef struct TPMIfClass {
#define TYPE_TPM_TIS "tpm-tis"
#define TYPE_TPM_CRB "tpm-crb"
+#define TYPE_TPM_SPAPR "tpm-spapr"
#define TPM_IS_TIS(chr) \
object_dynamic_cast(OBJECT(chr), TYPE_TPM_TIS)
#define TPM_IS_CRB(chr) \
object_dynamic_cast(OBJECT(chr), TYPE_TPM_CRB)
+#define TPM_IS_SPAPR(chr) \
+ object_dynamic_cast(OBJECT(chr), TYPE_TPM_SPAPR)
/* returns NULL unless there is exactly one TPM device */
static inline TPMIf *tpm_find(void)
diff --git a/qapi/tpm.json b/qapi/tpm.json
index b30323bb6b..63878aa0f4 100644
--- a/qapi/tpm.json
+++ b/qapi/tpm.json
@@ -12,11 +12,11 @@
#
# @tpm-tis: TPM TIS model
# @tpm-crb: TPM CRB model (since 2.12)
+# @tpm-spapr: TPM SPAPR model (since 5.0)
#
# Since: 1.5
##
-{ 'enum': 'TpmModel', 'data': [ 'tpm-tis', 'tpm-crb' ] }
-
+{ 'enum': 'TpmModel', 'data': [ 'tpm-tis', 'tpm-crb', 'tpm-spapr' ] }
##
# @query-tpm-models:
#
@@ -29,7 +29,7 @@
# Example:
#
# -> { "execute": "query-tpm-models" }
-# <- { "return": [ "tpm-tis", "tpm-crb" ] }
+# <- { "return": [ "tpm-tis", "tpm-crb", "tpm-spapr" ] }
#
##
{ 'command': 'query-tpm-models', 'returns': ['TpmModel'] }
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 16/35] tpm_spapr: Support suspend and resume
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (14 preceding siblings ...)
2020-02-03 6:11 ` [PULL 15/35] tpm_spapr: Support TPM for ppc64 using CRQ based interface David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 17/35] hw/ppc/Kconfig: Enable TPM_SPAPR as part of PSERIES config David Gibson
` (19 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Stefan Berger, qemu-devel, groug, qemu-ppc,
Marc-André Lureau, David Gibson
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the tpm_spapr frontend with VM suspend and resume support.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Message-Id: <20200121152935.649898-5-stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/tpm/tpm_spapr.c | 52 ++++++++++++++++++++++++++++++++++++++++++++-
hw/tpm/trace-events | 2 ++
2 files changed, 53 insertions(+), 1 deletion(-)
diff --git a/hw/tpm/tpm_spapr.c b/hw/tpm/tpm_spapr.c
index 2ac4cb061c..ce65eb2e45 100644
--- a/hw/tpm/tpm_spapr.c
+++ b/hw/tpm/tpm_spapr.c
@@ -76,6 +76,8 @@ typedef struct {
unsigned char *buffer;
+ uint32_t numbytes; /* number of bytes to deliver on resume */
+
TPMBackendCmd cmd;
TPMBackend *be_driver;
@@ -240,6 +242,14 @@ static void tpm_spapr_request_completed(TPMIf *ti, int ret)
/* a max. of be_buffer_size bytes can be transported */
len = MIN(tpm_cmd_get_size(s->buffer), s->be_buffer_size);
+
+ if (runstate_check(RUN_STATE_FINISH_MIGRATE)) {
+ trace_tpm_spapr_caught_response(len);
+ /* defer delivery of response until .post_load */
+ s->numbytes = len;
+ return;
+ }
+
rc = spapr_vio_dma_write(&s->vdev, be32_to_cpu(crq->data),
s->buffer, len);
@@ -288,6 +298,7 @@ static void tpm_spapr_reset(SpaprVioDevice *dev)
SpaprTpmState *s = VIO_SPAPR_VTPM(dev);
s->state = SPAPR_VTPM_STATE_NONE;
+ s->numbytes = 0;
s->be_tpm_version = tpm_backend_get_tpm_version(s->be_driver);
@@ -309,9 +320,48 @@ static enum TPMVersion tpm_spapr_get_version(TPMIf *ti)
return tpm_backend_get_tpm_version(s->be_driver);
}
+/* persistent state handling */
+
+static int tpm_spapr_pre_save(void *opaque)
+{
+ SpaprTpmState *s = opaque;
+
+ tpm_backend_finish_sync(s->be_driver);
+ /*
+ * we cannot deliver the results to the VM since DMA would touch VM memory
+ */
+
+ return 0;
+}
+
+static int tpm_spapr_post_load(void *opaque, int version_id)
+{
+ SpaprTpmState *s = opaque;
+
+ if (s->numbytes) {
+ trace_tpm_spapr_post_load();
+ /* deliver the results to the VM via DMA */
+ tpm_spapr_request_completed(TPM_IF(s), 0);
+ s->numbytes = 0;
+ }
+
+ return 0;
+}
+
static const VMStateDescription vmstate_spapr_vtpm = {
.name = "tpm-spapr",
- .unmigratable = 1,
+ .pre_save = tpm_spapr_pre_save,
+ .post_load = tpm_spapr_post_load,
+ .fields = (VMStateField[]) {
+ VMSTATE_SPAPR_VIO(vdev, SpaprTpmState),
+
+ VMSTATE_UINT8(state, SpaprTpmState),
+ VMSTATE_UINT32(numbytes, SpaprTpmState),
+ VMSTATE_VBUFFER_UINT32(buffer, SpaprTpmState, 0, NULL, numbytes),
+ /* remember DMA address */
+ VMSTATE_UINT32(crq.data, SpaprTpmState),
+ VMSTATE_END_OF_LIST(),
+ }
};
static Property tpm_spapr_properties[] = {
diff --git a/hw/tpm/trace-events b/hw/tpm/trace-events
index 9143a8eaa3..439e514787 100644
--- a/hw/tpm/trace-events
+++ b/hw/tpm/trace-events
@@ -67,3 +67,5 @@ tpm_spapr_do_crq_get_version(uint32_t version) "response: version %u"
tpm_spapr_do_crq_prepare_to_suspend(void) "response: preparing to suspend"
tpm_spapr_do_crq_unknown_msg_type(uint8_t type) "Unknown message type 0x%02x"
tpm_spapr_do_crq_unknown_crq(uint8_t raw1, uint8_t raw2) "unknown CRQ 0x%02x 0x%02x ..."
+tpm_spapr_post_load(void) "Delivering TPM response after resume"
+tpm_spapr_caught_response(uint32_t v) "Caught response to deliver after resume: %u bytes"
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 17/35] hw/ppc/Kconfig: Enable TPM_SPAPR as part of PSERIES config
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (15 preceding siblings ...)
2020-02-03 6:11 ` [PULL 16/35] tpm_spapr: Support suspend and resume David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 18/35] docs/specs/tpm: reST-ify TPM documentation David Gibson
` (18 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Stefan Berger, qemu-devel, groug, qemu-ppc,
Marc-André Lureau, David Gibson, Stefan Berger
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20200121152935.649898-6-stefanb@linux.ibm.com>
[dwg: Use default in Kconfig rather than select to avoid breaking
Windows host build]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/tpm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/tpm/Kconfig b/hw/tpm/Kconfig
index 4d4ab0855c..9e67d990e8 100644
--- a/hw/tpm/Kconfig
+++ b/hw/tpm/Kconfig
@@ -25,6 +25,6 @@ config TPM_EMULATOR
config TPM_SPAPR
bool
- default n
+ default y
depends on TPM && PSERIES
select TPMDEV
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 18/35] docs/specs/tpm: reST-ify TPM documentation
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (16 preceding siblings ...)
2020-02-03 6:11 ` [PULL 17/35] hw/ppc/Kconfig: Enable TPM_SPAPR as part of PSERIES config David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge David Gibson
` (17 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Marc-André Lureau,
David Gibson, Stefan Berger
From: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Message-Id: <20200121152935.649898-7-stefanb@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
docs/specs/index.rst | 1 +
docs/specs/tpm.rst | 503 +++++++++++++++++++++++++++++++++++++++++++
docs/specs/tpm.txt | 445 --------------------------------------
3 files changed, 504 insertions(+), 445 deletions(-)
create mode 100644 docs/specs/tpm.rst
delete mode 100644 docs/specs/tpm.txt
diff --git a/docs/specs/index.rst b/docs/specs/index.rst
index 984ba44029..de46a8b5e7 100644
--- a/docs/specs/index.rst
+++ b/docs/specs/index.rst
@@ -13,3 +13,4 @@ Contents:
ppc-xive
ppc-spapr-xive
acpi_hw_reduced_hotplug
+ tpm
diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
new file mode 100644
index 0000000000..2bdf637f55
--- /dev/null
+++ b/docs/specs/tpm.rst
@@ -0,0 +1,503 @@
+===============
+QEMU TPM Device
+===============
+
+Guest-side hardware interface
+=============================
+
+TIS interface
+-------------
+
+The QEMU TPM emulation implements a TPM TIS hardware interface
+following the Trusted Computing Group's specification "TCG PC Client
+Specific TPM Interface Specification (TIS)", Specification Version
+1.3, 21 March 2013. (see the `TIS specification`_, or a later version
+of it).
+
+The TIS interface makes a memory mapped IO region in the area
+0xfed40000-0xfed44fff available to the guest operating system.
+
+QEMU files related to TPM TIS interface:
+ - ``hw/tpm/tpm_tis.c``
+ - ``hw/tpm/tpm_tis.h``
+
+CRB interface
+-------------
+
+QEMU also implements a TPM CRB interface following the Trusted
+Computing Group's specification "TCG PC Client Platform TPM Profile
+(PTP) Specification", Family "2.0", Level 00 Revision 01.03 v22, May
+22, 2017. (see the `CRB specification`_, or a later version of it)
+
+The CRB interface makes a memory mapped IO region in the area
+0xfed40000-0xfed40fff (1 locality) available to the guest
+operating system.
+
+QEMU files related to TPM CRB interface:
+ - ``hw/tpm/tpm_crb.c``
+
+SPAPR interface
+---------------
+
+pSeries (ppc64) machines offer a tpm-spapr device model.
+
+QEMU files related to the SPAPR interface:
+ - ``hw/tpm/tpm_spapr.c``
+
+fw_cfg interface
+================
+
+The bios/firmware may read the ``"etc/tpm/config"`` fw_cfg entry for
+configuring the guest appropriately.
+
+The entry of 6 bytes has the following content, in little-endian:
+
+.. code-block:: c
+
+ #define TPM_VERSION_UNSPEC 0
+ #define TPM_VERSION_1_2 1
+ #define TPM_VERSION_2_0 2
+
+ #define TPM_PPI_VERSION_NONE 0
+ #define TPM_PPI_VERSION_1_30 1
+
+ struct FwCfgTPMConfig {
+ uint32_t tpmppi_address; /* PPI memory location */
+ uint8_t tpm_version; /* TPM version */
+ uint8_t tpmppi_version; /* PPI version */
+ };
+
+ACPI interface
+==============
+
+The TPM device is defined with ACPI ID "PNP0C31". QEMU builds a SSDT
+and passes it into the guest through the fw_cfg device. The device
+description contains the base address of the TIS interface 0xfed40000
+and the size of the MMIO area (0x5000). In case a TPM2 is used by
+QEMU, a TPM2 ACPI table is also provided. The device is described to
+be used in polling mode rather than interrupt mode primarily because
+no unused IRQ could be found.
+
+To support measurement logs to be written by the firmware,
+e.g. SeaBIOS, a TCPA table is implemented. This table provides a 64kb
+buffer where the firmware can write its log into. For TPM 2 only a
+more recent version of the TPM2 table provides support for
+measurements logs and a TCPA table does not need to be created.
+
+The TCPA and TPM2 ACPI tables follow the Trusted Computing Group
+specification "TCG ACPI Specification" Family "1.2" and "2.0", Level
+00 Revision 00.37. (see the `ACPI specification`_, or a later version
+of it)
+
+ACPI PPI Interface
+------------------
+
+QEMU supports the Physical Presence Interface (PPI) for TPM 1.2 and
+TPM 2. This interface requires ACPI and firmware support. (see the
+`PPI specification`_)
+
+PPI enables a system administrator (root) to request a modification to
+the TPM upon reboot. The PPI specification defines the operation
+requests and the actions the firmware has to take. The system
+administrator passes the operation request number to the firmware
+through an ACPI interface which writes this number to a memory
+location that the firmware knows. Upon reboot, the firmware finds the
+number and sends commands to the TPM. The firmware writes the TPM
+result code and the operation request number to a memory location that
+ACPI can read from and pass the result on to the administrator.
+
+The PPI specification defines a set of mandatory and optional
+operations for the firmware to implement. The ACPI interface also
+allows an administrator to list the supported operations. In QEMU the
+ACPI code is generated by QEMU, yet the firmware needs to implement
+support on a per-operations basis, and different firmwares may support
+a different subset. Therefore, QEMU introduces the virtual memory
+device for PPI where the firmware can indicate which operations it
+supports and ACPI can enable the ones that are supported and disable
+all others. This interface lies in main memory and has the following
+layout:
+
+ +-------------+--------+--------+-------------------------------------------+
+ | Field | Length | Offset | Description |
+ +=============+========+========+===========================================+
+ | ``func`` | 0x100 | 0x000 | Firmware sets values for each supported |
+ | | | | operation. See defined values below. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``ppin`` | 0x1 | 0x100 | SMI interrupt to use. Set by firmware. |
+ | | | | Not supported. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``ppip`` | 0x4 | 0x101 | ACPI function index to pass to SMM code. |
+ | | | | Set by ACPI. Not supported. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``pprp`` | 0x4 | 0x105 | Result of last executed operation. Set by |
+ | | | | firmware. See function index 5 for values.|
+ +-------------+--------+--------+-------------------------------------------+
+ | ``pprq`` | 0x4 | 0x109 | Operation request number to execute. See |
+ | | | | 'Physical Presence Interface Operation |
+ | | | | Summary' tables in specs. Set by ACPI. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``pprm`` | 0x4 | 0x10d | Operation request optional parameter. |
+ | | | | Values depend on operation. Set by ACPI. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``lppr`` | 0x4 | 0x111 | Last executed operation request number. |
+ | | | | Copied from pprq field by firmware. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``fret`` | 0x4 | 0x115 | Result code from SMM function. |
+ | | | | Not supported. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``res1`` | 0x40 | 0x119 | Reserved for future use |
+ +-------------+--------+--------+-------------------------------------------+
+ |``next_step``| 0x1 | 0x159 | Operation to execute after reboot by |
+ | | | | firmware. Used by firmware. |
+ +-------------+--------+--------+-------------------------------------------+
+ | ``movv`` | 0x1 | 0x15a | Memory overwrite variable |
+ +-------------+--------+--------+-------------------------------------------+
+
+The following values are supported for the ``func`` field. They
+correspond to the values used by ACPI function index 8.
+
+ +----------+-------------------------------------------------------------+
+ | Value | Description |
+ +==========+=============================================================+
+ | 0 | Operation is not implemented. |
+ +----------+-------------------------------------------------------------+
+ | 1 | Operation is only accessible through firmware. |
+ +----------+-------------------------------------------------------------+
+ | 2 | Operation is blocked for OS by firmware configuration. |
+ +----------+-------------------------------------------------------------+
+ | 3 | Operation is allowed and physically present user required. |
+ +----------+-------------------------------------------------------------+
+ | 4 | Operation is allowed and physically present user is not |
+ | | required. |
+ +----------+-------------------------------------------------------------+
+
+The location of the table is given by the fw_cfg ``tpmppi_address``
+field. The PPI memory region size is 0x400 (``TPM_PPI_ADDR_SIZE``) to
+leave enough room for future updates.
+
+QEMU files related to TPM ACPI tables:
+ - ``hw/i386/acpi-build.c``
+ - ``include/hw/acpi/tpm.h``
+
+TPM backend devices
+===================
+
+The TPM implementation is split into two parts, frontend and
+backend. The frontend part is the hardware interface, such as the TPM
+TIS interface described earlier, and the other part is the TPM backend
+interface. The backend interfaces implement the interaction with a TPM
+device, which may be a physical or an emulated device. The split
+between the front- and backend devices allows a frontend to be
+connected with any available backend. This enables the TIS interface
+to be used with the passthrough backend or the swtpm backend.
+
+QEMU files related to TPM backends:
+ - ``backends/tpm.c``
+ - ``include/sysemu/tpm_backend.h``
+ - ``include/sysemu/tpm_backend_int.h``
+
+The QEMU TPM passthrough device
+-------------------------------
+
+In case QEMU is run on Linux as the host operating system it is
+possible to make the hardware TPM device available to a single QEMU
+guest. In this case the user must make sure that no other program is
+using the device, e.g., /dev/tpm0, before trying to start QEMU with
+it.
+
+The passthrough driver uses the host's TPM device for sending TPM
+commands and receiving responses from. Besides that it accesses the
+TPM device's sysfs entry for support of command cancellation. Since
+none of the state of a hardware TPM can be migrated between hosts,
+virtual machine migration is disabled when the TPM passthrough driver
+is used.
+
+Since the host's TPM device will already be initialized by the host's
+firmware, certain commands, e.g. ``TPM_Startup()``, sent by the
+virtual firmware for device initialization, will fail. In this case
+the firmware should not use the TPM.
+
+Sharing the device with the host is generally not a recommended usage
+scenario for a TPM device. The primary reason for this is that two
+operating systems can then access the device's single set of
+resources, such as platform configuration registers
+(PCRs). Applications or kernel security subsystems, such as the Linux
+Integrity Measurement Architecture (IMA), are not expecting to share
+PCRs.
+
+QEMU files related to the TPM passthrough device:
+ - ``hw/tpm/tpm_passthrough.c``
+ - ``hw/tpm/tpm_util.c``
+ - ``hw/tpm/tpm_util.h``
+
+
+Command line to start QEMU with the TPM passthrough device using the host's
+hardware TPM ``/dev/tpm0``:
+
+.. code-block:: console
+
+ qemu-system-x86_64 -display sdl -accel kvm \
+ -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
+ -tpmdev passthrough,id=tpm0,path=/dev/tpm0 \
+ -device tpm-tis,tpmdev=tpm0 test.img
+
+
+The following commands should result in similar output inside the VM
+with a Linux kernel that either has the TPM TIS driver built-in or
+available as a module:
+
+.. code-block:: console
+
+ # dmesg | grep -i tpm
+ [ 0.711310] tpm_tis 00:06: 1.2 TPM (device=id 0x1, rev-id 1)
+
+ # dmesg | grep TCPA
+ [ 0.000000] ACPI: TCPA 0x0000000003FFD191C 000032 (v02 BOCHS \
+ BXPCTCPA 0000001 BXPC 00000001)
+
+ # ls -l /dev/tpm*
+ crw-------. 1 root root 10, 224 Jul 11 10:11 /dev/tpm0
+
+ # find /sys/devices/ | grep pcrs$ | xargs cat
+ PCR-00: 35 4E 3B CE 23 9F 38 59 ...
+ ...
+ PCR-23: 00 00 00 00 00 00 00 00 ...
+
+The QEMU TPM emulator device
+----------------------------
+
+The TPM emulator device uses an external TPM emulator called 'swtpm'
+for sending TPM commands to and receiving responses from. The swtpm
+program must have been started before trying to access it through the
+TPM emulator with QEMU.
+
+The TPM emulator implements a command channel for transferring TPM
+commands and responses as well as a control channel over which control
+commands can be sent. (see the `SWTPM protocol`_ specification)
+
+The control channel serves the purpose of resetting, initializing, and
+migrating the TPM state, among other things.
+
+The swtpm program behaves like a hardware TPM and therefore needs to
+be initialized by the firmware running inside the QEMU virtual
+machine. One necessary step for initializing the device is to send
+the TPM_Startup command to it. SeaBIOS, for example, has been
+instrumented to initialize a TPM 1.2 or TPM 2 device using this
+command.
+
+QEMU files related to the TPM emulator device:
+ - ``hw/tpm/tpm_emulator.c``
+ - ``hw/tpm/tpm_util.c``
+ - ``hw/tpm/tpm_util.h``
+
+The following commands start the swtpm with a UnixIO control channel over
+a socket interface. They do not need to be run as root.
+
+.. code-block:: console
+
+ mkdir /tmp/mytpm1
+ swtpm socket --tpmstate dir=/tmp/mytpm1 \
+ --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
+ --log level=20
+
+Command line to start QEMU with the TPM emulator device communicating
+with the swtpm (x86):
+
+.. code-block:: console
+
+ qemu-system-x86_64 -display sdl -accel kvm \
+ -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
+ -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-tis,tpmdev=tpm0 test.img
+
+In case a pSeries machine is emulated, use the following command line:
+
+.. code-block:: console
+
+ qemu-system-ppc64 -display sdl -machine pseries,accel=kvm \
+ -m 1024 -bios slof.bin -boot menu=on \
+ -nodefaults -device VGA -device pci-ohci -device usb-kbd \
+ -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-spapr,tpmdev=tpm0 \
+ -device spapr-vscsi,id=scsi0,reg=0x00002000 \
+ -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \
+ -drive file=test.img,format=raw,if=none,id=drive-virtio-disk0
+
+In case SeaBIOS is used as firmware, it should show the TPM menu item
+after entering the menu with 'ESC'.
+
+.. code-block:: console
+
+ Select boot device:
+ 1. DVD/CD [ata1-0: QEMU DVD-ROM ATAPI-4 DVD/CD]
+ [...]
+ 5. Legacy option rom
+
+ t. TPM Configuration
+
+The following commands should result in similar output inside the VM
+with a Linux kernel that either has the TPM TIS driver built-in or
+available as a module:
+
+.. code-block:: console
+
+ # dmesg | grep -i tpm
+ [ 0.711310] tpm_tis 00:06: 1.2 TPM (device=id 0x1, rev-id 1)
+
+ # dmesg | grep TCPA
+ [ 0.000000] ACPI: TCPA 0x0000000003FFD191C 000032 (v02 BOCHS \
+ BXPCTCPA 0000001 BXPC 00000001)
+
+ # ls -l /dev/tpm*
+ crw-------. 1 root root 10, 224 Jul 11 10:11 /dev/tpm0
+
+ # find /sys/devices/ | grep pcrs$ | xargs cat
+ PCR-00: 35 4E 3B CE 23 9F 38 59 ...
+ ...
+ PCR-23: 00 00 00 00 00 00 00 00 ...
+
+Migration with the TPM emulator
+===============================
+
+The TPM emulator supports the following types of virtual machine
+migration:
+
+- VM save / restore (migration into a file)
+- Network migration
+- Snapshotting (migration into storage like QoW2 or QED)
+
+The following command sequences can be used to test VM save / restore.
+
+In a 1st terminal start an instance of a swtpm using the following command:
+
+.. code-block:: console
+
+ mkdir /tmp/mytpm1
+ swtpm socket --tpmstate dir=/tmp/mytpm1 \
+ --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
+ --log level=20 --tpm2
+
+In a 2nd terminal start the VM:
+
+.. code-block:: console
+
+ qemu-system-x86_64 -display sdl -accel kvm \
+ -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
+ -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-tis,tpmdev=tpm0 \
+ -monitor stdio \
+ test.img
+
+Verify that the attached TPM is working as expected using applications
+inside the VM.
+
+To store the state of the VM use the following command in the QEMU
+monitor in the 2nd terminal:
+
+.. code-block:: console
+
+ (qemu) migrate "exec:cat > testvm.bin"
+ (qemu) quit
+
+At this point a file called ``testvm.bin`` should exists and the swtpm
+and QEMU processes should have ended.
+
+To test 'VM restore' you have to start the swtpm with the same
+parameters as before. If previously a TPM 2 [--tpm2] was saved, --tpm2
+must now be passed again on the command line.
+
+In the 1st terminal restart the swtpm with the same command line as
+before:
+
+.. code-block:: console
+
+ swtpm socket --tpmstate dir=/tmp/mytpm1 \
+ --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
+ --log level=20 --tpm2
+
+In the 2nd terminal restore the state of the VM using the additional
+'-incoming' option.
+
+.. code-block:: console
+
+ qemu-system-x86_64 -display sdl -accel kvm \
+ -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
+ -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm \
+ -device tpm-tis,tpmdev=tpm0 \
+ -incoming "exec:cat < testvm.bin" \
+ test.img
+
+Troubleshooting migration
+-------------------------
+
+There are several reasons why migration may fail. In case of problems,
+please ensure that the command lines adhere to the following rules
+and, if possible, that identical versions of QEMU and swtpm are used
+at all times.
+
+VM save and restore:
+
+ - QEMU command line parameters should be identical apart from the
+ '-incoming' option on VM restore
+
+ - swtpm command line parameters should be identical
+
+VM migration to 'localhost':
+
+ - QEMU command line parameters should be identical apart from the
+ '-incoming' option on the destination side
+
+ - swtpm command line parameters should point to two different
+ directories on the source and destination swtpm (--tpmstate dir=...)
+ (especially if different versions of libtpms were to be used on the
+ same machine).
+
+VM migration across the network:
+
+ - QEMU command line parameters should be identical apart from the
+ '-incoming' option on the destination side
+
+ - swtpm command line parameters should be identical
+
+VM Snapshotting:
+ - QEMU command line parameters should be identical
+
+ - swtpm command line parameters should be identical
+
+
+Besides that, migration failure reasons on the swtpm level may include
+the following:
+
+ - the versions of the swtpm on the source and destination sides are
+ incompatible
+
+ - downgrading of TPM state may not be supported
+
+ - the source and destination libtpms were compiled with different
+ compile-time options and the destination side refuses to accept the
+ state
+
+ - different migration keys are used on the source and destination side
+ and the destination side cannot decrypt the migrated state
+ (swtpm ... --migration-key ... )
+
+
+.. _TIS specification:
+ https://trustedcomputinggroup.org/pc-client-work-group-pc-client-specific-tpm-interface-specification-tis/
+
+.. _CRB specification:
+ https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/
+
+
+.. _ACPI specification:
+ https://trustedcomputinggroup.org/tcg-acpi-specification/
+
+.. _PPI specification:
+ https://trustedcomputinggroup.org/resource/tcg-physical-presence-interface-specification/
+
+.. _SWTPM protocol:
+ https://github.com/stefanberger/swtpm/blob/master/man/man3/swtpm_ioctls.pod
diff --git a/docs/specs/tpm.txt b/docs/specs/tpm.txt
deleted file mode 100644
index 9c3e67d8a7..0000000000
--- a/docs/specs/tpm.txt
+++ /dev/null
@@ -1,445 +0,0 @@
-QEMU TPM Device
-===============
-
-= Guest-side Hardware Interface =
-
-The QEMU TPM emulation implements a TPM TIS hardware interface following the
-Trusted Computing Group's specification "TCG PC Client Specific TPM Interface
-Specification (TIS)", Specification Version 1.3, 21 March 2013. This
-specification, or a later version of it, can be accessed from the following
-URL:
-
-https://trustedcomputinggroup.org/pc-client-work-group-pc-client-specific-tpm-interface-specification-tis/
-
-The TIS interface makes a memory mapped IO region in the area 0xfed40000 -
-0xfed44fff available to the guest operating system.
-
-
-QEMU files related to TPM TIS interface:
- - hw/tpm/tpm_tis.c
- - hw/tpm/tpm_tis.h
-
-
-QEMU also implements a TPM CRB interface following the Trusted Computing
-Group's specification "TCG PC Client Platform TPM Profile (PTP)
-Specification", Family "2.0", Level 00 Revision 01.03 v22, May 22, 2017.
-This specification, or a later version of it, can be accessed from the
-following URL:
-
-https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/
-
-The CRB interface makes a memory mapped IO region in the area 0xfed40000 -
-0xfed40fff (1 locality) available to the guest operating system.
-
-QEMU files related to TPM CRB interface:
- - hw/tpm/tpm_crb.c
-
-
-pSeries (ppc64) machines offer a tpm-spapr device model.
-
-QEMU files related to the SPAPR interface:
- - hw/tpm/tpm_spapr.c
-
-= fw_cfg interface =
-
-The bios/firmware may read the "etc/tpm/config" fw_cfg entry for
-configuring the guest appropriately.
-
-The entry of 6 bytes has the following content, in little-endian:
-
- #define TPM_VERSION_UNSPEC 0
- #define TPM_VERSION_1_2 1
- #define TPM_VERSION_2_0 2
-
- #define TPM_PPI_VERSION_NONE 0
- #define TPM_PPI_VERSION_1_30 1
-
- struct FwCfgTPMConfig {
- uint32_t tpmppi_address; /* PPI memory location */
- uint8_t tpm_version; /* TPM version */
- uint8_t tpmppi_version; /* PPI version */
- };
-
-= ACPI Interface =
-
-The TPM device is defined with ACPI ID "PNP0C31". QEMU builds a SSDT and passes
-it into the guest through the fw_cfg device. The device description contains
-the base address of the TIS interface 0xfed40000 and the size of the MMIO area
-(0x5000). In case a TPM2 is used by QEMU, a TPM2 ACPI table is also provided.
-The device is described to be used in polling mode rather than interrupt mode
-primarily because no unused IRQ could be found.
-
-To support measurement logs to be written by the firmware, e.g. SeaBIOS, a TCPA
-table is implemented. This table provides a 64kb buffer where the firmware can
-write its log into. For TPM 2 only a more recent version of the TPM2 table
-provides support for measurements logs and a TCPA table does not need to be
-created.
-
-The TCPA and TPM2 ACPI tables follow the Trusted Computing Group specification
-"TCG ACPI Specification" Family "1.2" and "2.0", Level 00 Revision 00.37. This
-specification, or a later version of it, can be accessed from the following
-URL:
-
-https://trustedcomputinggroup.org/tcg-acpi-specification/
-
-== ACPI PPI Interface ==
-
-QEMU supports the Physical Presence Interface (PPI) for TPM 1.2 and TPM 2. This
-interface requires ACPI and firmware support. The specification can be found at
-the following URL:
-
-https://trustedcomputinggroup.org/resource/tcg-physical-presence-interface-specification/
-
-PPI enables a system administrator (root) to request a modification to the
-TPM upon reboot. The PPI specification defines the operation requests and the
-actions the firmware has to take. The system administrator passes the operation
-request number to the firmware through an ACPI interface which writes this
-number to a memory location that the firmware knows. Upon reboot, the firmware
-finds the number and sends commands to the TPM. The firmware writes the TPM
-result code and the operation request number to a memory location that ACPI can
-read from and pass the result on to the administrator.
-
-The PPI specification defines a set of mandatory and optional operations for
-the firmware to implement. The ACPI interface also allows an administrator to
-list the supported operations. In QEMU the ACPI code is generated by QEMU, yet
-the firmware needs to implement support on a per-operations basis, and
-different firmwares may support a different subset. Therefore, QEMU introduces
-the virtual memory device for PPI where the firmware can indicate which
-operations it supports and ACPI can enable the ones that are supported and
-disable all others. This interface lies in main memory and has the following
-layout:
-
- +----------+--------+--------+-------------------------------------------+
- | Field | Length | Offset | Description |
- +----------+--------+--------+-------------------------------------------+
- | func | 0x100 | 0x000 | Firmware sets values for each supported |
- | | | | operation. See defined values below. |
- +----------+--------+--------+-------------------------------------------+
- | ppin | 0x1 | 0x100 | SMI interrupt to use. Set by firmware. |
- | | | | Not supported. |
- +----------+--------+--------+-------------------------------------------+
- | ppip | 0x4 | 0x101 | ACPI function index to pass to SMM code. |
- | | | | Set by ACPI. Not supported. |
- +----------+--------+--------+-------------------------------------------+
- | pprp | 0x4 | 0x105 | Result of last executed operation. Set by |
- | | | | firmware. See function index 5 for values.|
- +----------+--------+--------+-------------------------------------------+
- | pprq | 0x4 | 0x109 | Operation request number to execute. See |
- | | | | 'Physical Presence Interface Operation |
- | | | | Summary' tables in specs. Set by ACPI. |
- +----------+--------+--------+-------------------------------------------+
- | pprm | 0x4 | 0x10d | Operation request optional parameter. |
- | | | | Values depend on operation. Set by ACPI. |
- +----------+--------+--------+-------------------------------------------+
- | lppr | 0x4 | 0x111 | Last executed operation request number. |
- | | | | Copied from pprq field by firmware. |
- +----------+--------+--------+-------------------------------------------+
- | fret | 0x4 | 0x115 | Result code from SMM function. |
- | | | | Not supported. |
- +----------+--------+--------+-------------------------------------------+
- | res1 | 0x40 | 0x119 | Reserved for future use |
- +----------+--------+--------+-------------------------------------------+
- | next_step| 0x1 | 0x159 | Operation to execute after reboot by |
- | | | | firmware. Used by firmware. |
- +----------+--------+--------+-------------------------------------------+
- | movv | 0x1 | 0x15a | Memory overwrite variable |
- +----------+--------+--------+-------------------------------------------+
-
- The following values are supported for the 'func' field. They correspond
- to the values used by ACPI function index 8.
-
- +----------+-------------------------------------------------------------+
- | value | Description |
- +----------+-------------------------------------------------------------+
- | 0 | Operation is not implemented. |
- +----------+-------------------------------------------------------------+
- | 1 | Operation is only accessible through firmware. |
- +----------+-------------------------------------------------------------+
- | 2 | Operation is blocked for OS by firmware configuration. |
- +----------+-------------------------------------------------------------+
- | 3 | Operation is allowed and physically present user required. |
- +----------+-------------------------------------------------------------+
- | 4 | Operation is allowed and physically present user is not |
- | | required. |
- +----------+-------------------------------------------------------------+
-
-The location of the table is given by the fw_cfg tpmppi_address field.
-The PPI memory region size is 0x400 (TPM_PPI_ADDR_SIZE) to leave
-enough room for future updates.
-
-
-QEMU files related to TPM ACPI tables:
- - hw/i386/acpi-build.c
- - include/hw/acpi/tpm.h
-
-
-= TPM backend devices =
-
-The TPM implementation is split into two parts, frontend and backend. The
-frontend part is the hardware interface, such as the TPM TIS interface
-described earlier, and the other part is the TPM backend interface. The backend
-interfaces implement the interaction with a TPM device, which may be a physical
-or an emulated device. The split between the front- and backend devices allows
-a frontend to be connected with any available backend. This enables the TIS
-interface to be used with the passthrough backend or the (future) swtpm backend.
-
-
-QEMU files related to TPM backends:
- - backends/tpm.c
- - include/sysemu/tpm_backend.h
- - include/sysemu/tpm_backend_int.h
-
-
-== The QEMU TPM passthrough device ==
-
-In case QEMU is run on Linux as the host operating system it is possible to
-make the hardware TPM device available to a single QEMU guest. In this case the
-user must make sure that no other program is using the device, e.g., /dev/tpm0,
-before trying to start QEMU with it.
-
-The passthrough driver uses the host's TPM device for sending TPM commands
-and receiving responses from. Besides that it accesses the TPM device's sysfs
-entry for support of command cancellation. Since none of the state of a
-hardware TPM can be migrated between hosts, virtual machine migration is
-disabled when the TPM passthrough driver is used.
-
-Since the host's TPM device will already be initialized by the host's firmware,
-certain commands, e.g. TPM_Startup(), sent by the virtual firmware for device
-initialization, will fail. In this case the firmware should not use the TPM.
-
-Sharing the device with the host is generally not a recommended usage scenario
-for a TPM device. The primary reason for this is that two operating systems can
-then access the device's single set of resources, such as platform configuration
-registers (PCRs). Applications or kernel security subsystems, such as the
-Linux Integrity Measurement Architecture (IMA), are not expecting to share PCRs.
-
-
-QEMU files related to the TPM passthrough device:
- - hw/tpm/tpm_passthrough.c
- - hw/tpm/tpm_util.c
- - hw/tpm/tpm_util.h
-
-
-Command line to start QEMU with the TPM passthrough device using the host's
-hardware TPM /dev/tpm0:
-
-qemu-system-x86_64 -display sdl -accel kvm \
- -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
- -tpmdev passthrough,id=tpm0,path=/dev/tpm0 \
- -device tpm-tis,tpmdev=tpm0 test.img
-
-The following commands should result in similar output inside the VM with a
-Linux kernel that either has the TPM TIS driver built-in or available as a
-module:
-
-#> dmesg | grep -i tpm
-[ 0.711310] tpm_tis 00:06: 1.2 TPM (device=id 0x1, rev-id 1)
-
-#> dmesg | grep TCPA
-[ 0.000000] ACPI: TCPA 0x0000000003FFD191C 000032 (v02 BOCHS \
- BXPCTCPA 0000001 BXPC 00000001)
-
-#> ls -l /dev/tpm*
-crw-------. 1 root root 10, 224 Jul 11 10:11 /dev/tpm0
-
-#> find /sys/devices/ | grep pcrs$ | xargs cat
-PCR-00: 35 4E 3B CE 23 9F 38 59 ...
-...
-PCR-23: 00 00 00 00 00 00 00 00 ...
-
-
-== The QEMU TPM emulator device ==
-
-The TPM emulator device uses an external TPM emulator called 'swtpm' for
-sending TPM commands to and receiving responses from. The swtpm program
-must have been started before trying to access it through the TPM emulator
-with QEMU.
-
-The TPM emulator implements a command channel for transferring TPM commands
-and responses as well as a control channel over which control commands can
-be sent. The specification for the control channel can be found here:
-
-https://github.com/stefanberger/swtpm/blob/master/man/man3/swtpm_ioctls.pod
-
-
-The control channel serves the purpose of resetting, initializing, and
-migrating the TPM state, among other things.
-
-The swtpm program behaves like a hardware TPM and therefore needs to be
-initialized by the firmware running inside the QEMU virtual machine.
-One necessary step for initializing the device is to send the TPM_Startup
-command to it. SeaBIOS, for example, has been instrumented to initialize
-a TPM 1.2 or TPM 2 device using this command.
-
-
-QEMU files related to the TPM emulator device:
- - hw/tpm/tpm_emulator.c
- - hw/tpm/tpm_util.c
- - hw/tpm/tpm_util.h
-
-
-The following commands start the swtpm with a UnixIO control channel over
-a socket interface. They do not need to be run as root.
-
-mkdir /tmp/mytpm1
-swtpm socket --tpmstate dir=/tmp/mytpm1 \
- --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
- --log level=20
-
-Command line to start QEMU with the TPM emulator device communicating with
-the swtpm (x86):
-
-qemu-system-x86_64 -display sdl -accel kvm \
- -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
- -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
- -tpmdev emulator,id=tpm0,chardev=chrtpm \
- -device tpm-tis,tpmdev=tpm0 test.img
-
-In case a pSeries machine is emulated, use the following command line:
-
-qemu-system-ppc64 -display sdl -machine pseries,accel=kvm \
- -m 1024 -bios slof.bin -boot menu=on \
- -nodefaults -device VGA -device pci-ohci -device usb-kbd \
- -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
- -tpmdev emulator,id=tpm0,chardev=chrtpm \
- -device tpm-spapr,tpmdev=tpm0 \
- -device spapr-vscsi,id=scsi0,reg=0x00002000 \
- -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,id=virtio-disk0 \
- -drive file=test.img,format=raw,if=none,id=drive-virtio-disk0
-
-
-In case SeaBIOS is used as firmware, it should show the TPM menu item
-after entering the menu with 'ESC'.
-
-Select boot device:
-1. DVD/CD [ata1-0: QEMU DVD-ROM ATAPI-4 DVD/CD]
-[...]
-5. Legacy option rom
-
-t. TPM Configuration
-
-
-The following commands should result in similar output inside the VM with a
-Linux kernel that either has the TPM TIS driver built-in or available as a
-module:
-
-#> dmesg | grep -i tpm
-[ 0.711310] tpm_tis 00:06: 1.2 TPM (device=id 0x1, rev-id 1)
-
-#> dmesg | grep TCPA
-[ 0.000000] ACPI: TCPA 0x0000000003FFD191C 000032 (v02 BOCHS \
- BXPCTCPA 0000001 BXPC 00000001)
-
-#> ls -l /dev/tpm*
-crw-------. 1 root root 10, 224 Jul 11 10:11 /dev/tpm0
-
-#> find /sys/devices/ | grep pcrs$ | xargs cat
-PCR-00: 35 4E 3B CE 23 9F 38 59 ...
-...
-PCR-23: 00 00 00 00 00 00 00 00 ...
-
-
-=== Migration with the TPM emulator ===
-
-The TPM emulator supports the following types of virtual machine migration:
-
-- VM save / restore (migration into a file)
-- Network migration
-- Snapshotting (migration into storage like QoW2 or QED)
-
-The following command sequences can be used to test VM save / restore.
-
-
-In a 1st terminal start an instance of a swtpm using the following command:
-
-mkdir /tmp/mytpm1
-swtpm socket --tpmstate dir=/tmp/mytpm1 \
- --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
- --log level=20 --tpm2
-
-In a 2nd terminal start the VM:
-
-qemu-system-x86_64 -display sdl -accel kvm \
- -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
- -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
- -tpmdev emulator,id=tpm0,chardev=chrtpm \
- -device tpm-tis,tpmdev=tpm0 \
- -monitor stdio \
- test.img
-
-Verify that the attached TPM is working as expected using applications inside
-the VM.
-
-To store the state of the VM use the following command in the QEMU monitor in
-the 2nd terminal:
-
-(qemu) migrate "exec:cat > testvm.bin"
-(qemu) quit
-
-At this point a file called 'testvm.bin' should exists and the swtpm and QEMU
-processes should have ended.
-
-To test 'VM restore' you have to start the swtpm with the same parameters
-as before. If previously a TPM 2 [--tpm2] was saved, --tpm2 must now be
-passed again on the command line.
-
-In the 1st terminal restart the swtpm with the same command line as before:
-
-swtpm socket --tpmstate dir=/tmp/mytpm1 \
- --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
- --log level=20 --tpm2
-
-In the 2nd terminal restore the state of the VM using the additional
-'-incoming' option.
-
-qemu-system-x86_64 -display sdl -accel kvm \
- -m 1024 -boot d -bios bios-256k.bin -boot menu=on \
- -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
- -tpmdev emulator,id=tpm0,chardev=chrtpm \
- -device tpm-tis,tpmdev=tpm0 \
- -incoming "exec:cat < testvm.bin" \
- test.img
-
-
-Troubleshooting migration:
-
-There are several reasons why migration may fail. In case of problems,
-please ensure that the command lines adhere to the following rules and,
-if possible, that identical versions of QEMU and swtpm are used at all
-times.
-
-VM save and restore:
- - QEMU command line parameters should be identical apart from the
- '-incoming' option on VM restore
- - swtpm command line parameters should be identical
-
-VM migration to 'localhost':
- - QEMU command line parameters should be identical apart from the
- '-incoming' option on the destination side
- - swtpm command line parameters should point to two different
- directories on the source and destination swtpm (--tpmstate dir=...)
- (especially if different versions of libtpms were to be used on the
- same machine).
-
-VM migration across the network:
- - QEMU command line parameters should be identical apart from the
- '-incoming' option on the destination side
- - swtpm command line parameters should be identical
-
-VM Snapshotting:
- - QEMU command line parameters should be identical
- - swtpm command line parameters should be identical
-
-
-Besides that, migration failure reasons on the swtpm level may include
-the following:
-
- - the versions of the swtpm on the source and destination sides are
- incompatible
- - downgrading of TPM state may not be supported
- - the source and destination libtpms were compiled with different
- compile-time options and the destination side refuses to accept the
- state
- - different migration keys are used on the source and destination side
- and the destination side cannot decrypt the migrated state
- (swtpm ... --migration-key ... )
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (17 preceding siblings ...)
2020-02-03 6:11 ` [PULL 18/35] docs/specs/tpm: reST-ify TPM documentation David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-05 13:26 ` Laurent Vivier
2022-03-31 17:51 ` Peter Maydell
2020-02-03 6:11 ` [PULL 20/35] ppc/pnv: Add models for POWER8 PHB3 " David Gibson
` (16 subsequent siblings)
35 siblings, 2 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
David Gibson
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
These changes introduces models for the PCIe Host Bridge (PHB4) of the
POWER9 processor. It includes the PowerBus logic interface (PBCQ),
IOMMU support, a single PCIe Gen.4 Root Complex, and support for MSI
and LSI interrupt sources as found on a POWER9 system using the XIVE
interrupt controller.
POWER9 processor comes with 3 PHB4 PEC (PCI Express Controller) and
each PEC can have several PHBs. By default,
* PEC0 provides 1 PHB (PHB0)
* PEC1 provides 2 PHBs (PHB1 and PHB2)
* PEC2 provides 3 PHBs (PHB3, PHB4 and PHB5)
Each PEC has a set "global" registers and some "per-stack" (per-PHB)
registers. Those are organized in two XSCOM ranges, the "Nest" range
and the "PCI" range, each range contains both some "PEC" registers and
some "per-stack" registers.
No default device layout is provided and PCI devices can be added on
any of the available PCIe Root Port (pcie.0 .. 2 of a Power9 chip)
with address 0x0 as the firwware (skiboot) only accepts a single
device per root port. To run a simple system with a network and a
storage adapters, use a command line options such as :
-device e1000e,netdev=net0,mac=C0:FF:EE:00:00:02,bus=pcie.0,addr=0x0
-netdev bridge,id=net0,helper=/usr/libexec/qemu-bridge-helper,br=virbr0,id=hostnet0
-device megasas,id=scsi0,bus=pcie.1,addr=0x0
-drive file=$disk,if=none,id=drive-scsi0-0-0-0,format=qcow2,cache=none
-device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2
If more are needed, include a bridge.
Multi chip is supported, each chip adding its set of PHB4 controllers
and its PCI busses. The model doesn't emulate the EEH error handling.
This model is not ready for hotplug yet.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
[ clg: - numerous cleanups
- commit log
- fix for broken LSI support
- PHB pic printinfo
- large QOM rework ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200127144506.11132-2-clg@kaod.org>
[dwg: Use device_class_set_props()]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/pci-host/Makefile.objs | 1 +
hw/pci-host/pnv_phb4.c | 1438 +++++++++++++++++++++++++++
hw/pci-host/pnv_phb4_pec.c | 593 +++++++++++
hw/ppc/Kconfig | 2 +
hw/ppc/pnv.c | 107 ++
include/hw/pci-host/pnv_phb4.h | 230 +++++
include/hw/pci-host/pnv_phb4_regs.h | 553 ++++++++++
include/hw/pci/pcie_port.h | 1 +
include/hw/ppc/pnv.h | 7 +
include/hw/ppc/pnv_xscom.h | 11 +
10 files changed, 2943 insertions(+)
create mode 100644 hw/pci-host/pnv_phb4.c
create mode 100644 hw/pci-host/pnv_phb4_pec.c
create mode 100644 include/hw/pci-host/pnv_phb4.h
create mode 100644 include/hw/pci-host/pnv_phb4_regs.h
diff --git a/hw/pci-host/Makefile.objs b/hw/pci-host/Makefile.objs
index 9c466fab01..8a296e2f93 100644
--- a/hw/pci-host/Makefile.objs
+++ b/hw/pci-host/Makefile.objs
@@ -20,3 +20,4 @@ common-obj-$(CONFIG_PCI_EXPRESS_GENERIC_BRIDGE) += gpex.o
common-obj-$(CONFIG_PCI_EXPRESS_XILINX) += xilinx-pcie.o
common-obj-$(CONFIG_PCI_EXPRESS_DESIGNWARE) += designware.o
+obj-$(CONFIG_POWERNV) += pnv_phb4.o pnv_phb4_pec.o
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
new file mode 100644
index 0000000000..61235d13a6
--- /dev/null
+++ b/hw/pci-host/pnv_phb4.c
@@ -0,0 +1,1438 @@
+/*
+ * QEMU PowerPC PowerNV (POWER9) PHB4 model
+ *
+ * Copyright (c) 2018-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "monitor/monitor.h"
+#include "target/ppc/cpu.h"
+#include "hw/pci-host/pnv_phb4_regs.h"
+#include "hw/pci-host/pnv_phb4.h"
+#include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/ppc/pnv.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+
+#define phb_error(phb, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb4[%d:%d]: " fmt "\n", \
+ (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
+
+/*
+ * QEMU version of the GETFIELD/SETFIELD macros
+ *
+ * These are common with the PnvXive model.
+ */
+static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
+{
+ return (word & mask) >> ctz64(mask);
+}
+
+static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
+ uint64_t value)
+{
+ return (word & ~mask) | ((value << ctz64(mask)) & mask);
+}
+
+static PCIDevice *pnv_phb4_find_cfg_dev(PnvPHB4 *phb)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
+ uint8_t bus, devfn;
+
+ if (!(addr >> 63)) {
+ return NULL;
+ }
+ bus = (addr >> 52) & 0xff;
+ devfn = (addr >> 44) & 0xff;
+
+ /* We don't access the root complex this way */
+ if (bus == 0 && devfn == 0) {
+ return NULL;
+ }
+ return pci_find_device(pci->bus, bus, devfn);
+}
+
+/*
+ * The CONFIG_DATA register expects little endian accesses, but as the
+ * region is big endian, we have to swap the value.
+ */
+static void pnv_phb4_config_write(PnvPHB4 *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+
+ pdev = pnv_phb4_find_cfg_dev(phb);
+ if (!pdev) {
+ return;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return;
+ }
+ switch (size) {
+ case 1:
+ break;
+ case 2:
+ val = bswap16(val);
+ break;
+ case 4:
+ val = bswap32(val);
+ break;
+ default:
+ g_assert_not_reached();
+ }
+ pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
+}
+
+static uint64_t pnv_phb4_config_read(PnvPHB4 *phb, unsigned off,
+ unsigned size)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+ uint64_t val;
+
+ pdev = pnv_phb4_find_cfg_dev(phb);
+ if (!pdev) {
+ return ~0ull;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return ~0ull;
+ }
+ val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
+ switch (size) {
+ case 1:
+ return val;
+ case 2:
+ return bswap16(val);
+ case 4:
+ return bswap32(val);
+ default:
+ g_assert_not_reached();
+ }
+}
+
+/*
+ * Root complex register accesses are memory mapped.
+ */
+static void pnv_phb4_rc_config_write(PnvPHB4 *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ PCIDevice *pdev;
+
+ if (size != 4) {
+ phb_error(phb, "rc_config_write invalid size %d\n", size);
+ return;
+ }
+
+ pdev = pci_find_device(pci->bus, 0, 0);
+ assert(pdev);
+
+ pci_host_config_write_common(pdev, off, PHB_RC_CONFIG_SIZE,
+ bswap32(val), 4);
+}
+
+static uint64_t pnv_phb4_rc_config_read(PnvPHB4 *phb, unsigned off,
+ unsigned size)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ PCIDevice *pdev;
+ uint64_t val;
+
+ if (size != 4) {
+ phb_error(phb, "rc_config_read invalid size %d\n", size);
+ return ~0ull;
+ }
+
+ pdev = pci_find_device(pci->bus, 0, 0);
+ assert(pdev);
+
+ val = pci_host_config_read_common(pdev, off, PHB_RC_CONFIG_SIZE, 4);
+ return bswap32(val);
+}
+
+static void pnv_phb4_check_mbt(PnvPHB4 *phb, uint32_t index)
+{
+ uint64_t base, start, size, mbe0, mbe1;
+ MemoryRegion *parent;
+ char name[64];
+
+ /* Unmap first */
+ if (memory_region_is_mapped(&phb->mr_mmio[index])) {
+ /* Should we destroy it in RCU friendly way... ? */
+ memory_region_del_subregion(phb->mr_mmio[index].container,
+ &phb->mr_mmio[index]);
+ }
+
+ /* Get table entry */
+ mbe0 = phb->ioda_MBT[(index << 1)];
+ mbe1 = phb->ioda_MBT[(index << 1) + 1];
+
+ if (!(mbe0 & IODA3_MBT0_ENABLE)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = GETFIELD(IODA3_MBT0_BASE_ADDR, mbe0) << 12;
+ size = GETFIELD(IODA3_MBT1_MASK, mbe1) << 12;
+ size |= 0xff00000000000000ull;
+ size = ~size + 1;
+
+ /* Calculate PCI side start address based on M32/M64 window type */
+ if (mbe0 & IODA3_MBT0_TYPE_M32) {
+ start = phb->regs[PHB_M32_START_ADDR >> 3];
+ if ((start + size) > 0x100000000ull) {
+ phb_error(phb, "M32 set beyond 4GB boundary !");
+ size = 0x100000000 - start;
+ }
+ } else {
+ start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
+ }
+
+ /* TODO: Figure out how to implemet/decode AOMASK */
+
+ /* Check if it matches an enabled MMIO region in the PEC stack */
+ if (memory_region_is_mapped(&phb->stack->mmbar0) &&
+ base >= phb->stack->mmio0_base &&
+ (base + size) <= (phb->stack->mmio0_base + phb->stack->mmio0_size)) {
+ parent = &phb->stack->mmbar0;
+ base -= phb->stack->mmio0_base;
+ } else if (memory_region_is_mapped(&phb->stack->mmbar1) &&
+ base >= phb->stack->mmio1_base &&
+ (base + size) <= (phb->stack->mmio1_base + phb->stack->mmio1_size)) {
+ parent = &phb->stack->mmbar1;
+ base -= phb->stack->mmio1_base;
+ } else {
+ phb_error(phb, "PHB MBAR %d out of parent bounds", index);
+ return;
+ }
+
+ /* Create alias (better name ?) */
+ snprintf(name, sizeof(name), "phb4-mbar%d", index);
+ memory_region_init_alias(&phb->mr_mmio[index], OBJECT(phb), name,
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_mmio[index]);
+}
+
+static void pnv_phb4_check_all_mbt(PnvPHB4 *phb)
+{
+ uint64_t i;
+ uint32_t num_windows = phb->big_phb ? PNV_PHB4_MAX_MMIO_WINDOWS :
+ PNV_PHB4_MIN_MMIO_WINDOWS;
+
+ for (i = 0; i < num_windows; i++) {
+ pnv_phb4_check_mbt(phb, i);
+ }
+}
+
+static uint64_t *pnv_phb4_ioda_access(PnvPHB4 *phb,
+ unsigned *out_table, unsigned *out_idx)
+{
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
+ unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
+ unsigned int mask;
+ uint64_t *tptr = NULL;
+
+ switch (table) {
+ case IODA3_TBL_LIST:
+ tptr = phb->ioda_LIST;
+ mask = 7;
+ break;
+ case IODA3_TBL_MIST:
+ tptr = phb->ioda_MIST;
+ mask = phb->big_phb ? PNV_PHB4_MAX_MIST : (PNV_PHB4_MAX_MIST >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_RCAM:
+ mask = phb->big_phb ? 127 : 63;
+ break;
+ case IODA3_TBL_MRT:
+ mask = phb->big_phb ? 15 : 7;
+ break;
+ case IODA3_TBL_PESTA:
+ case IODA3_TBL_PESTB:
+ mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_TVT:
+ tptr = phb->ioda_TVT;
+ mask = phb->big_phb ? PNV_PHB4_MAX_TVEs : (PNV_PHB4_MAX_TVEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_TCR:
+ case IODA3_TBL_TDR:
+ mask = phb->big_phb ? 1023 : 511;
+ break;
+ case IODA3_TBL_MBT:
+ tptr = phb->ioda_MBT;
+ mask = phb->big_phb ? PNV_PHB4_MAX_MBEs : (PNV_PHB4_MAX_MBEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_MDT:
+ tptr = phb->ioda_MDT;
+ mask = phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
+ mask -= 1;
+ break;
+ case IODA3_TBL_PEEV:
+ tptr = phb->ioda_PEEV;
+ mask = phb->big_phb ? PNV_PHB4_MAX_PEEVs : (PNV_PHB4_MAX_PEEVs >> 1);
+ mask -= 1;
+ break;
+ default:
+ phb_error(phb, "invalid IODA table %d", table);
+ return NULL;
+ }
+ index &= mask;
+ if (out_idx) {
+ *out_idx = index;
+ }
+ if (out_table) {
+ *out_table = table;
+ }
+ if (tptr) {
+ tptr += index;
+ }
+ if (adreg & PHB_IODA_AD_AUTOINC) {
+ index = (index + 1) & mask;
+ adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
+ }
+
+ phb->regs[PHB_IODA_ADDR >> 3] = adreg;
+ return tptr;
+}
+
+static uint64_t pnv_phb4_ioda_read(PnvPHB4 *phb)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb4_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ /* Special PESTA case */
+ if (table == IODA3_TBL_PESTA) {
+ return ((uint64_t)(phb->ioda_PEST_AB[idx] & 1)) << 63;
+ } else if (table == IODA3_TBL_PESTB) {
+ return ((uint64_t)(phb->ioda_PEST_AB[idx] & 2)) << 62;
+ }
+ /* Return 0 on unsupported tables, not ff's */
+ return 0;
+ }
+ return *tptr;
+}
+
+static void pnv_phb4_ioda_write(PnvPHB4 *phb, uint64_t val)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb4_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ /* Special PESTA case */
+ if (table == IODA3_TBL_PESTA) {
+ phb->ioda_PEST_AB[idx] &= ~1;
+ phb->ioda_PEST_AB[idx] |= (val >> 63) & 1;
+ } else if (table == IODA3_TBL_PESTB) {
+ phb->ioda_PEST_AB[idx] &= ~2;
+ phb->ioda_PEST_AB[idx] |= (val >> 62) & 2;
+ }
+ return;
+ }
+
+ /* Handle side effects */
+ switch (table) {
+ case IODA3_TBL_LIST:
+ break;
+ case IODA3_TBL_MIST: {
+ /* Special mask for MIST partial write */
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ uint32_t mmask = GETFIELD(PHB_IODA_AD_MIST_PWV, adreg);
+ uint64_t v = *tptr;
+ if (mmask == 0) {
+ mmask = 0xf;
+ }
+ if (mmask & 8) {
+ v &= 0x0000ffffffffffffull;
+ v |= 0xcfff000000000000ull & val;
+ }
+ if (mmask & 4) {
+ v &= 0xffff0000ffffffffull;
+ v |= 0x0000cfff00000000ull & val;
+ }
+ if (mmask & 2) {
+ v &= 0xffffffff0000ffffull;
+ v |= 0x00000000cfff0000ull & val;
+ }
+ if (mmask & 1) {
+ v &= 0xffffffffffff0000ull;
+ v |= 0x000000000000cfffull & val;
+ }
+ *tptr = val;
+ break;
+ }
+ case IODA3_TBL_MBT:
+ *tptr = val;
+
+ /* Copy accross the valid bit to the other half */
+ phb->ioda_MBT[idx ^ 1] &= 0x7fffffffffffffffull;
+ phb->ioda_MBT[idx ^ 1] |= 0x8000000000000000ull & val;
+
+ /* Update mappings */
+ pnv_phb4_check_mbt(phb, idx >> 1);
+ break;
+ default:
+ *tptr = val;
+ }
+}
+
+static void pnv_phb4_rtc_invalidate(PnvPHB4 *phb, uint64_t val)
+{
+ PnvPhb4DMASpace *ds;
+
+ /* Always invalidate all for now ... */
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ ds->pe_num = PHB_INVALID_PE;
+ }
+}
+
+static void pnv_phb4_update_msi_regions(PnvPhb4DMASpace *ds)
+{
+ uint64_t cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
+
+ if (cfg & PHB_PHB4C_32BIT_MSI_EN) {
+ if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ 0xffff0000, &ds->msi32_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(MEMORY_REGION(&ds->msi32_mr))) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi32_mr);
+ }
+ }
+
+ if (cfg & PHB_PHB4C_64BIT_MSI_EN) {
+ if (!memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ (1ull << 60), &ds->msi64_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(MEMORY_REGION(&ds->msi64_mr))) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi64_mr);
+ }
+ }
+}
+
+static void pnv_phb4_update_all_msi_regions(PnvPHB4 *phb)
+{
+ PnvPhb4DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ pnv_phb4_update_msi_regions(ds);
+ }
+}
+
+static void pnv_phb4_update_xsrc(PnvPHB4 *phb)
+{
+ int shift, flags, i, lsi_base;
+ XiveSource *xsrc = &phb->xsrc;
+
+ /* The XIVE source characteristics can be set at run time */
+ if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_PGSZ_64K) {
+ shift = XIVE_ESB_64K;
+ } else {
+ shift = XIVE_ESB_4K;
+ }
+ if (phb->regs[PHB_CTRLR >> 3] & PHB_CTRLR_IRQ_STORE_EOI) {
+ flags = XIVE_SRC_STORE_EOI;
+ } else {
+ flags = 0;
+ }
+
+ phb->xsrc.esb_shift = shift;
+ phb->xsrc.esb_flags = flags;
+
+ lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
+ lsi_base <<= 3;
+
+ /* TODO: handle reset values of PHB_LSI_SRC_ID */
+ if (!lsi_base) {
+ return;
+ }
+
+ /* TODO: need a xive_source_irq_reset_lsi() */
+ bitmap_zero(xsrc->lsi_map, xsrc->nr_irqs);
+
+ for (i = 0; i < xsrc->nr_irqs; i++) {
+ bool msi = (i < lsi_base || i >= (lsi_base + 8));
+ if (!msi) {
+ xive_source_irq_set_lsi(xsrc, i);
+ }
+ }
+}
+
+static void pnv_phb4_reg_write(void *opaque, hwaddr off, uint64_t val,
+ unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ bool changed;
+
+ /* Special case outbound configuration data */
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ pnv_phb4_config_write(phb, off & 0x3, size, val);
+ return;
+ }
+
+ /* Special case RC configuration space */
+ if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
+ pnv_phb4_rc_config_write(phb, off & 0x7ff, size, val);
+ return;
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return;
+ }
+
+ /* Handle masking */
+ switch (off) {
+ case PHB_LSI_SOURCE_ID:
+ val &= PHB_LSI_SRC_ID;
+ break;
+ case PHB_M64_UPPER_BITS:
+ val &= 0xff00000000000000ull;
+ break;
+ /* TCE Kill */
+ case PHB_TCE_KILL:
+ /* Clear top 3 bits which HW does to indicate successful queuing */
+ val &= ~(PHB_TCE_KILL_ALL | PHB_TCE_KILL_PE | PHB_TCE_KILL_ONE);
+ break;
+ case PHB_Q_DMA_R:
+ /*
+ * This is enough logic to make SW happy but we aren't
+ * actually quiescing the DMAs
+ */
+ if (val & PHB_Q_DMA_R_AUTORESET) {
+ val = 0;
+ } else {
+ val &= PHB_Q_DMA_R_QUIESCE_DMA;
+ }
+ break;
+ /* LEM stuff */
+ case PHB_LEM_FIR_AND_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
+ return;
+ case PHB_LEM_FIR_OR_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
+ return;
+ case PHB_LEM_ERROR_AND_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
+ return;
+ case PHB_LEM_ERROR_OR_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
+ return;
+ case PHB_LEM_WOF:
+ val = 0;
+ break;
+ /* TODO: More regs ..., maybe create a table with masks... */
+
+ /* Read only registers */
+ case PHB_CPU_LOADSTORE_STATUS:
+ case PHB_ETU_ERR_SUMMARY:
+ case PHB_PHB4_GEN_CAP:
+ case PHB_PHB4_TCE_CAP:
+ case PHB_PHB4_IRQ_CAP:
+ case PHB_PHB4_EEH_CAP:
+ return;
+ }
+
+ /* Record whether it changed */
+ changed = phb->regs[off >> 3] != val;
+
+ /* Store in register cache first */
+ phb->regs[off >> 3] = val;
+
+ /* Handle side effects */
+ switch (off) {
+ case PHB_PHB4_CONFIG:
+ if (changed) {
+ pnv_phb4_update_all_msi_regions(phb);
+ }
+ break;
+ case PHB_M32_START_ADDR:
+ case PHB_M64_UPPER_BITS:
+ if (changed) {
+ pnv_phb4_check_all_mbt(phb);
+ }
+ break;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ pnv_phb4_ioda_write(phb, val);
+ break;
+
+ /* RTC invalidation */
+ case PHB_RTC_INVALIDATE:
+ pnv_phb4_rtc_invalidate(phb, val);
+ break;
+
+ /* PHB Control (Affects XIVE source) */
+ case PHB_CTRLR:
+ case PHB_LSI_SOURCE_ID:
+ pnv_phb4_update_xsrc(phb);
+ break;
+
+ /* Silent simple writes */
+ case PHB_ASN_CMPM:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ case PHB_TCE_TAG_ENABLE:
+ case PHB_INT_NOTIFY_ADDR:
+ case PHB_INT_NOTIFY_INDEX:
+ case PHB_DMARD_SYNC:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: reg_write 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+}
+
+static uint64_t pnv_phb4_reg_read(void *opaque, hwaddr off, unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint64_t val;
+
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ return pnv_phb4_config_read(phb, off & 0x3, size);
+ }
+
+ /* Special case RC configuration space */
+ if ((off & 0xf800) == PHB_RC_CONFIG_BASE) {
+ return pnv_phb4_rc_config_read(phb, off & 0x7ff, size);
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return ~0ull;
+ }
+
+ /* Default read from cache */
+ val = phb->regs[off >> 3];
+
+ switch (off) {
+ case PHB_VERSION:
+ return phb->version;
+
+ /* Read-only */
+ case PHB_PHB4_GEN_CAP:
+ return 0xe4b8000000000000ull;
+ case PHB_PHB4_TCE_CAP:
+ return phb->big_phb ? 0x4008440000000400ull : 0x2008440000000200ull;
+ case PHB_PHB4_IRQ_CAP:
+ return phb->big_phb ? 0x0800000000001000ull : 0x0800000000000800ull;
+ case PHB_PHB4_EEH_CAP:
+ return phb->big_phb ? 0x2000000000000000ull : 0x1000000000000000ull;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ return pnv_phb4_ioda_read(phb);
+
+ /* Link training always appears trained */
+ case PHB_PCIE_DLP_TRAIN_CTL:
+ /* TODO: Do something sensible with speed ? */
+ return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TL_LINKACT;
+
+ /* DMA read sync: make it look like it's complete */
+ case PHB_DMARD_SYNC:
+ return PHB_DMARD_SYNC_COMPLETE;
+
+ /* Silent simple reads */
+ case PHB_LSI_SOURCE_ID:
+ case PHB_CPU_LOADSTORE_STATUS:
+ case PHB_ASN_CMPM:
+ case PHB_PHB4_CONFIG:
+ case PHB_M32_START_ADDR:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_RTC_INVALIDATE:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_M64_UPPER_BITS:
+ case PHB_CTRLR:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ case PHB_TCE_TAG_ENABLE:
+ case PHB_INT_NOTIFY_ADDR:
+ case PHB_INT_NOTIFY_INDEX:
+ case PHB_Q_DMA_R:
+ case PHB_ETU_ERR_SUMMARY:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: reg_read 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+ return val;
+}
+
+static const MemoryRegionOps pnv_phb4_reg_ops = {
+ .read = pnv_phb4_reg_read,
+ .write = pnv_phb4_reg_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_phb4_xscom_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint32_t reg = addr >> 3;
+ uint64_t val;
+ hwaddr offset;
+
+ switch (reg) {
+ case PHB_SCOM_HV_IND_ADDR:
+ return phb->scom_hv_ind_addr_reg;
+
+ case PHB_SCOM_HV_IND_DATA:
+ if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
+ phb_error(phb, "Invalid indirect address");
+ return ~0ull;
+ }
+ size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
+ offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
+ val = pnv_phb4_reg_read(phb, offset, size);
+ if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
+ offset += size;
+ offset &= 0x3fff;
+ phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
+ phb->scom_hv_ind_addr_reg,
+ offset);
+ }
+ return val;
+ case PHB_SCOM_ETU_LEM_FIR:
+ case PHB_SCOM_ETU_LEM_FIR_AND:
+ case PHB_SCOM_ETU_LEM_FIR_OR:
+ case PHB_SCOM_ETU_LEM_FIR_MSK:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
+ case PHB_SCOM_ETU_LEM_ACT0:
+ case PHB_SCOM_ETU_LEM_ACT1:
+ case PHB_SCOM_ETU_LEM_WOF:
+ offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
+ return pnv_phb4_reg_read(phb, offset, size);
+ case PHB_SCOM_ETU_PMON_CONFIG:
+ case PHB_SCOM_ETU_PMON_CTR0:
+ case PHB_SCOM_ETU_PMON_CTR1:
+ case PHB_SCOM_ETU_PMON_CTR2:
+ case PHB_SCOM_ETU_PMON_CTR3:
+ offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
+ return pnv_phb4_reg_read(phb, offset, size);
+
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: xscom_read 0x%"HWADDR_PRIx"\n", addr);
+ return ~0ull;
+ }
+}
+
+static void pnv_phb4_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint32_t reg = addr >> 3;
+ hwaddr offset;
+
+ switch (reg) {
+ case PHB_SCOM_HV_IND_ADDR:
+ phb->scom_hv_ind_addr_reg = val & 0xe000000000001fff;
+ break;
+ case PHB_SCOM_HV_IND_DATA:
+ if (!(phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_VALID)) {
+ phb_error(phb, "Invalid indirect address");
+ break;
+ }
+ size = (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_4B) ? 4 : 8;
+ offset = GETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR, phb->scom_hv_ind_addr_reg);
+ pnv_phb4_reg_write(phb, offset, val, size);
+ if (phb->scom_hv_ind_addr_reg & PHB_SCOM_HV_IND_ADDR_AUTOINC) {
+ offset += size;
+ offset &= 0x3fff;
+ phb->scom_hv_ind_addr_reg = SETFIELD(PHB_SCOM_HV_IND_ADDR_ADDR,
+ phb->scom_hv_ind_addr_reg,
+ offset);
+ }
+ break;
+ case PHB_SCOM_ETU_LEM_FIR:
+ case PHB_SCOM_ETU_LEM_FIR_AND:
+ case PHB_SCOM_ETU_LEM_FIR_OR:
+ case PHB_SCOM_ETU_LEM_FIR_MSK:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_AND:
+ case PHB_SCOM_ETU_LEM_ERR_MSK_OR:
+ case PHB_SCOM_ETU_LEM_ACT0:
+ case PHB_SCOM_ETU_LEM_ACT1:
+ case PHB_SCOM_ETU_LEM_WOF:
+ offset = ((reg - PHB_SCOM_ETU_LEM_FIR) << 3) + PHB_LEM_FIR_ACCUM;
+ pnv_phb4_reg_write(phb, offset, val, size);
+ break;
+ case PHB_SCOM_ETU_PMON_CONFIG:
+ case PHB_SCOM_ETU_PMON_CTR0:
+ case PHB_SCOM_ETU_PMON_CTR1:
+ case PHB_SCOM_ETU_PMON_CTR2:
+ case PHB_SCOM_ETU_PMON_CTR3:
+ offset = ((reg - PHB_SCOM_ETU_PMON_CONFIG) << 3) + PHB_PERFMON_CONFIG;
+ pnv_phb4_reg_write(phb, offset, val, size);
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4: xscom_write 0x%"HWADDR_PRIx
+ "=%"PRIx64"\n", addr, val);
+ }
+}
+
+const MemoryRegionOps pnv_phb4_xscom_ops = {
+ .read = pnv_phb4_xscom_read,
+ .write = pnv_phb4_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static int pnv_phb4_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* Check that out properly ... */
+ return irq_num & 3;
+}
+
+static void pnv_phb4_set_irq(void *opaque, int irq_num, int level)
+{
+ PnvPHB4 *phb = PNV_PHB4(opaque);
+ uint32_t lsi_base;
+
+ /* LSI only ... */
+ if (irq_num > 3) {
+ phb_error(phb, "IRQ %x is not an LSI", irq_num);
+ }
+ lsi_base = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]);
+ lsi_base <<= 3;
+ qemu_set_irq(phb->qirqs[lsi_base + irq_num], level);
+}
+
+static bool pnv_phb4_resolve_pe(PnvPhb4DMASpace *ds)
+{
+ uint64_t rtt, addr;
+ uint16_t rte;
+ int bus_num;
+ int num_PEs;
+
+ /* Already resolved ? */
+ if (ds->pe_num != PHB_INVALID_PE) {
+ return true;
+ }
+
+ /* We need to lookup the RTT */
+ rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
+ if (!(rtt & PHB_RTT_BAR_ENABLE)) {
+ phb_error(ds->phb, "DMA with RTT BAR disabled !");
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+
+ /* Read RTE */
+ bus_num = pci_bus_num(ds->bus);
+ addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
+ addr += 2 * ((bus_num << 8) | ds->devfn);
+ if (dma_memory_read(&address_space_memory, addr, &rte, sizeof(rte))) {
+ phb_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+ rte = be16_to_cpu(rte);
+
+ /* Fail upon reading of invalid PE# */
+ num_PEs = ds->phb->big_phb ? PNV_PHB4_MAX_PEs : (PNV_PHB4_MAX_PEs >> 1);
+ if (rte >= num_PEs) {
+ phb_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
+ rte &= num_PEs - 1;
+ }
+ ds->pe_num = rte;
+ return true;
+}
+
+static void pnv_phb4_translate_tve(PnvPhb4DMASpace *ds, hwaddr addr,
+ bool is_write, uint64_t tve,
+ IOMMUTLBEntry *tlb)
+{
+ uint64_t tta = GETFIELD(IODA3_TVT_TABLE_ADDR, tve);
+ int32_t lev = GETFIELD(IODA3_TVT_NUM_LEVELS, tve);
+ uint32_t tts = GETFIELD(IODA3_TVT_TCE_TABLE_SIZE, tve);
+ uint32_t tps = GETFIELD(IODA3_TVT_IO_PSIZE, tve);
+
+ /* Invalid levels */
+ if (lev > 4) {
+ phb_error(ds->phb, "Invalid #levels in TVE %d", lev);
+ return;
+ }
+
+ /* Invalid entry */
+ if (tts == 0) {
+ phb_error(ds->phb, "Access to invalid TVE");
+ return;
+ }
+
+ /* IO Page Size of 0 means untranslated, else use TCEs */
+ if (tps == 0) {
+ /* TODO: Handle boundaries */
+
+ /* Use 4k pages like q35 ... for now */
+ tlb->iova = addr & 0xfffffffffffff000ull;
+ tlb->translated_addr = addr & 0x0003fffffffff000ull;
+ tlb->addr_mask = 0xfffull;
+ tlb->perm = IOMMU_RW;
+ } else {
+ uint32_t tce_shift, tbl_shift, sh;
+ uint64_t base, taddr, tce, tce_mask;
+
+ /* Address bits per bottom level TCE entry */
+ tce_shift = tps + 11;
+
+ /* Address bits per table level */
+ tbl_shift = tts + 8;
+
+ /* Top level table base address */
+ base = tta << 12;
+
+ /* Total shift to first level */
+ sh = tbl_shift * lev + tce_shift;
+
+ /* TODO: Limit to support IO page sizes */
+
+ /* TODO: Multi-level untested */
+ while ((lev--) >= 0) {
+ /* Grab the TCE address */
+ taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
+ if (dma_memory_read(&address_space_memory, taddr, &tce,
+ sizeof(tce))) {
+ phb_error(ds->phb, "Failed to read TCE at 0x%"PRIx64, taddr);
+ return;
+ }
+ tce = be64_to_cpu(tce);
+
+ /* Check permission for indirect TCE */
+ if ((lev >= 0) && !(tce & 3)) {
+ phb_error(ds->phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
+ phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ return;
+ }
+ sh -= tbl_shift;
+ base = tce & ~0xfffull;
+ }
+
+ /* We exit the loop with TCE being the final TCE */
+ tce_mask = ~((1ull << tce_shift) - 1);
+ tlb->iova = addr & tce_mask;
+ tlb->translated_addr = tce & tce_mask;
+ tlb->addr_mask = ~tce_mask;
+ tlb->perm = tce & 3;
+ if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
+ phb_error(ds->phb, "TCE access fault at 0x%"PRIx64, taddr);
+ phb_error(ds->phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb_error(ds->phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ }
+ }
+}
+
+static IOMMUTLBEntry pnv_phb4_translate_iommu(IOMMUMemoryRegion *iommu,
+ hwaddr addr,
+ IOMMUAccessFlags flag,
+ int iommu_idx)
+{
+ PnvPhb4DMASpace *ds = container_of(iommu, PnvPhb4DMASpace, dma_mr);
+ int tve_sel;
+ uint64_t tve, cfg;
+ IOMMUTLBEntry ret = {
+ .target_as = &address_space_memory,
+ .iova = addr,
+ .translated_addr = 0,
+ .addr_mask = ~(hwaddr)0,
+ .perm = IOMMU_NONE,
+ };
+
+ /* Resolve PE# */
+ if (!pnv_phb4_resolve_pe(ds)) {
+ phb_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return ret;
+ }
+
+ /* Check top bits */
+ switch (addr >> 60) {
+ case 00:
+ /* DMA or 32-bit MSI ? */
+ cfg = ds->phb->regs[PHB_PHB4_CONFIG >> 3];
+ if ((cfg & PHB_PHB4C_32BIT_MSI_EN) &&
+ ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
+ phb_error(ds->phb, "xlate on 32-bit MSI region");
+ return ret;
+ }
+ /* Choose TVE XXX Use PHB4 Control Register */
+ tve_sel = (addr >> 59) & 1;
+ tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
+ pnv_phb4_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
+ break;
+ case 01:
+ phb_error(ds->phb, "xlate on 64-bit MSI region");
+ break;
+ default:
+ phb_error(ds->phb, "xlate on unsupported address 0x%"PRIx64, addr);
+ }
+ return ret;
+}
+
+#define TYPE_PNV_PHB4_IOMMU_MEMORY_REGION "pnv-phb4-iommu-memory-region"
+#define PNV_PHB4_IOMMU_MEMORY_REGION(obj) \
+ OBJECT_CHECK(IOMMUMemoryRegion, (obj), TYPE_PNV_PHB4_IOMMU_MEMORY_REGION)
+
+static void pnv_phb4_iommu_memory_region_class_init(ObjectClass *klass,
+ void *data)
+{
+ IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+
+ imrc->translate = pnv_phb4_translate_iommu;
+}
+
+static const TypeInfo pnv_phb4_iommu_memory_region_info = {
+ .parent = TYPE_IOMMU_MEMORY_REGION,
+ .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
+ .class_init = pnv_phb4_iommu_memory_region_class_init,
+};
+
+/*
+ * MSI/MSIX memory region implementation.
+ * The handler handles both MSI and MSIX.
+ */
+static void pnv_phb4_msi_write(void *opaque, hwaddr addr,
+ uint64_t data, unsigned size)
+{
+ PnvPhb4DMASpace *ds = opaque;
+ PnvPHB4 *phb = ds->phb;
+
+ uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
+
+ /* Resolve PE# */
+ if (!pnv_phb4_resolve_pe(ds)) {
+ phb_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return;
+ }
+
+ /* TODO: Check it doesn't collide with LSIs */
+ if (src >= phb->xsrc.nr_irqs) {
+ phb_error(phb, "MSI %d out of bounds", src);
+ return;
+ }
+
+ /* TODO: check PE/MSI assignement */
+
+ qemu_irq_pulse(phb->qirqs[src]);
+}
+
+/* There is no .read as the read result is undefined by PCI spec */
+static uint64_t pnv_phb4_msi_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PnvPhb4DMASpace *ds = opaque;
+
+ phb_error(ds->phb, "Invalid MSI read @ 0x%" HWADDR_PRIx, addr);
+ return -1;
+}
+
+static const MemoryRegionOps pnv_phb4_msi_ops = {
+ .read = pnv_phb4_msi_read,
+ .write = pnv_phb4_msi_write,
+ .endianness = DEVICE_LITTLE_ENDIAN
+};
+
+static PnvPhb4DMASpace *pnv_phb4_dma_find(PnvPHB4 *phb, PCIBus *bus, int devfn)
+{
+ PnvPhb4DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ if (ds->bus == bus && ds->devfn == devfn) {
+ break;
+ }
+ }
+ return ds;
+}
+
+static AddressSpace *pnv_phb4_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ PnvPHB4 *phb = opaque;
+ PnvPhb4DMASpace *ds;
+ char name[32];
+
+ ds = pnv_phb4_dma_find(phb, bus, devfn);
+
+ if (ds == NULL) {
+ ds = g_malloc0(sizeof(PnvPhb4DMASpace));
+ ds->bus = bus;
+ ds->devfn = devfn;
+ ds->pe_num = PHB_INVALID_PE;
+ ds->phb = phb;
+ snprintf(name, sizeof(name), "phb4-%d.%d-iommu", phb->chip_id,
+ phb->phb_id);
+ memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
+ TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
+ OBJECT(phb), name, UINT64_MAX);
+ address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
+ name);
+ memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb4_msi_ops,
+ ds, "msi32", 0x10000);
+ memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb4_msi_ops,
+ ds, "msi64", 0x100000);
+ pnv_phb4_update_msi_regions(ds);
+
+ QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
+ }
+ return &ds->dma_as;
+}
+
+static void pnv_phb4_instance_init(Object *obj)
+{
+ PnvPHB4 *phb = PNV_PHB4(obj);
+
+ QLIST_INIT(&phb->dma_spaces);
+
+ /* XIVE interrupt source object */
+ object_initialize_child(obj, "source", &phb->xsrc, sizeof(XiveSource),
+ TYPE_XIVE_SOURCE, &error_abort, NULL);
+
+ /* Root Port */
+ object_initialize_child(obj, "root", &phb->root, sizeof(phb->root),
+ TYPE_PNV_PHB4_ROOT_PORT, &error_abort, NULL);
+
+ qdev_prop_set_int32(DEVICE(&phb->root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(&phb->root), "multifunction", false);
+}
+
+static void pnv_phb4_realize(DeviceState *dev, Error **errp)
+{
+ PnvPHB4 *phb = PNV_PHB4(dev);
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ XiveSource *xsrc = &phb->xsrc;
+ Error *local_err = NULL;
+ int nr_irqs;
+ char name[32];
+
+ assert(phb->stack);
+
+ /* Set the "big_phb" flag */
+ phb->big_phb = phb->phb_id == 0 || phb->phb_id == 3;
+
+ /* Controller Registers */
+ snprintf(name, sizeof(name), "phb4-%d.%d-regs", phb->chip_id,
+ phb->phb_id);
+ memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb4_reg_ops, phb,
+ name, 0x2000);
+
+ /*
+ * PHB4 doesn't support IO space. However, qemu gets very upset if
+ * we don't have an IO region to anchor IO BARs onto so we just
+ * initialize one which we never hook up to anything
+ */
+
+ snprintf(name, sizeof(name), "phb4-%d.%d-pci-io", phb->chip_id,
+ phb->phb_id);
+ memory_region_init(&phb->pci_io, OBJECT(phb), name, 0x10000);
+
+ snprintf(name, sizeof(name), "phb4-%d.%d-pci-mmio", phb->chip_id,
+ phb->phb_id);
+ memory_region_init(&phb->pci_mmio, OBJECT(phb), name,
+ PCI_MMIO_TOTAL_SIZE);
+
+ pci->bus = pci_register_root_bus(dev, "root-bus",
+ pnv_phb4_set_irq, pnv_phb4_map_irq, phb,
+ &phb->pci_mmio, &phb->pci_io,
+ 0, 4, TYPE_PNV_PHB4_ROOT_BUS);
+ pci_setup_iommu(pci->bus, pnv_phb4_dma_iommu, phb);
+
+ /* Add a single Root port */
+ qdev_prop_set_uint8(DEVICE(&phb->root), "chassis", phb->chip_id);
+ qdev_prop_set_uint16(DEVICE(&phb->root), "slot", phb->phb_id);
+ qdev_set_parent_bus(DEVICE(&phb->root), BUS(pci->bus));
+ qdev_init_nofail(DEVICE(&phb->root));
+
+ /* Setup XIVE Source */
+ if (phb->big_phb) {
+ nr_irqs = PNV_PHB4_MAX_INTs;
+ } else {
+ nr_irqs = PNV_PHB4_MAX_INTs >> 1;
+ }
+ object_property_set_int(OBJECT(xsrc), nr_irqs, "nr-irqs", &error_fatal);
+ object_property_set_link(OBJECT(xsrc), OBJECT(phb), "xive", &error_fatal);
+ object_property_set_bool(OBJECT(xsrc), true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ pnv_phb4_update_xsrc(phb);
+
+ phb->qirqs = qemu_allocate_irqs(xive_source_set_irq, xsrc, xsrc->nr_irqs);
+}
+
+static void pnv_phb4_reset(DeviceState *dev)
+{
+ PnvPHB4 *phb = PNV_PHB4(dev);
+ PCIDevice *root_dev = PCI_DEVICE(&phb->root);
+
+ /*
+ * Configure PCI device id at reset using a property.
+ */
+ pci_config_set_vendor_id(root_dev->config, PCI_VENDOR_ID_IBM);
+ pci_config_set_device_id(root_dev->config, phb->device_id);
+}
+
+static const char *pnv_phb4_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ PnvPHB4 *phb = PNV_PHB4(host_bridge);
+
+ snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
+ phb->chip_id, phb->phb_id);
+ return phb->bus_path;
+}
+
+static void pnv_phb4_xive_notify(XiveNotifier *xf, uint32_t srcno)
+{
+ PnvPHB4 *phb = PNV_PHB4(xf);
+ uint64_t notif_port = phb->regs[PHB_INT_NOTIFY_ADDR >> 3];
+ uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
+ uint64_t data = XIVE_TRIGGER_PQ | offset | srcno;
+ MemTxResult result;
+
+ address_space_stq_be(&address_space_memory, notif_port, data,
+ MEMTXATTRS_UNSPECIFIED, &result);
+ if (result != MEMTX_OK) {
+ phb_error(phb, "trigger failed @%"HWADDR_PRIx "\n", notif_port);
+ return;
+ }
+}
+
+static Property pnv_phb4_properties[] = {
+ DEFINE_PROP_UINT32("index", PnvPHB4, phb_id, 0),
+ DEFINE_PROP_UINT32("chip-id", PnvPHB4, chip_id, 0),
+ DEFINE_PROP_UINT64("version", PnvPHB4, version, 0),
+ DEFINE_PROP_UINT16("device-id", PnvPHB4, device_id, 0),
+ DEFINE_PROP_LINK("stack", PnvPHB4, stack, TYPE_PNV_PHB4_PEC_STACK,
+ PnvPhb4PecStack *),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_phb4_class_init(ObjectClass *klass, void *data)
+{
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ XiveNotifierClass *xfc = XIVE_NOTIFIER_CLASS(klass);
+
+ hc->root_bus_path = pnv_phb4_root_bus_path;
+ dc->realize = pnv_phb4_realize;
+ device_class_set_props(dc, pnv_phb4_properties);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->user_creatable = true;
+ dc->reset = pnv_phb4_reset;
+
+ xfc->notify = pnv_phb4_xive_notify;
+}
+
+static const TypeInfo pnv_phb4_type_info = {
+ .name = TYPE_PNV_PHB4,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_init = pnv_phb4_instance_init,
+ .instance_size = sizeof(PnvPHB4),
+ .class_init = pnv_phb4_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_XIVE_NOTIFIER },
+ { },
+ }
+};
+
+static void pnv_phb4_root_bus_class_init(ObjectClass *klass, void *data)
+{
+ BusClass *k = BUS_CLASS(klass);
+
+ /*
+ * PHB4 has only a single root complex. Enforce the limit on the
+ * parent bus
+ */
+ k->max_dev = 1;
+}
+
+static const TypeInfo pnv_phb4_root_bus_info = {
+ .name = TYPE_PNV_PHB4_ROOT_BUS,
+ .parent = TYPE_PCIE_BUS,
+ .class_init = pnv_phb4_root_bus_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_PCIE_DEVICE },
+ { }
+ },
+};
+
+static void pnv_phb4_root_port_reset(DeviceState *dev)
+{
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
+ PCIDevice *d = PCI_DEVICE(dev);
+ uint8_t *conf = d->config;
+
+ rpc->parent_reset(dev);
+
+ pci_byte_test_and_set_mask(conf + PCI_IO_BASE,
+ PCI_IO_RANGE_MASK & 0xff);
+ pci_byte_test_and_clear_mask(conf + PCI_IO_LIMIT,
+ PCI_IO_RANGE_MASK & 0xff);
+ pci_set_word(conf + PCI_MEMORY_BASE, 0);
+ pci_set_word(conf + PCI_MEMORY_LIMIT, 0xfff0);
+ pci_set_word(conf + PCI_PREF_MEMORY_BASE, 0x1);
+ pci_set_word(conf + PCI_PREF_MEMORY_LIMIT, 0xfff1);
+ pci_set_long(conf + PCI_PREF_BASE_UPPER32, 0x1); /* Hack */
+ pci_set_long(conf + PCI_PREF_LIMIT_UPPER32, 0xffffffff);
+}
+
+static void pnv_phb4_root_port_realize(DeviceState *dev, Error **errp)
+{
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
+ Error *local_err = NULL;
+
+ rpc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+}
+
+static void pnv_phb4_root_port_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
+
+ dc->desc = "IBM PHB4 PCIE Root Port";
+
+ device_class_set_parent_realize(dc, pnv_phb4_root_port_realize,
+ &rpc->parent_realize);
+ device_class_set_parent_reset(dc, pnv_phb4_root_port_reset,
+ &rpc->parent_reset);
+
+ k->vendor_id = PCI_VENDOR_ID_IBM;
+ k->device_id = PNV_PHB4_DEVICE_ID;
+ k->revision = 0;
+
+ rpc->exp_offset = 0x48;
+ rpc->aer_offset = 0x100;
+
+ dc->reset = &pnv_phb4_root_port_reset;
+}
+
+static const TypeInfo pnv_phb4_root_port_info = {
+ .name = TYPE_PNV_PHB4_ROOT_PORT,
+ .parent = TYPE_PCIE_ROOT_PORT,
+ .instance_size = sizeof(PnvPHB4RootPort),
+ .class_init = pnv_phb4_root_port_class_init,
+};
+
+static void pnv_phb4_register_types(void)
+{
+ type_register_static(&pnv_phb4_root_bus_info);
+ type_register_static(&pnv_phb4_root_port_info);
+ type_register_static(&pnv_phb4_type_info);
+ type_register_static(&pnv_phb4_iommu_memory_region_info);
+}
+
+type_init(pnv_phb4_register_types);
+
+void pnv_phb4_update_regions(PnvPhb4PecStack *stack)
+{
+ PnvPHB4 *phb = &stack->phb;
+
+ /* Unmap first always */
+ if (memory_region_is_mapped(&phb->mr_regs)) {
+ memory_region_del_subregion(&stack->phbbar, &phb->mr_regs);
+ }
+ if (memory_region_is_mapped(&phb->xsrc.esb_mmio)) {
+ memory_region_del_subregion(&stack->intbar, &phb->xsrc.esb_mmio);
+ }
+
+ /* Map registers if enabled */
+ if (memory_region_is_mapped(&stack->phbbar)) {
+ memory_region_add_subregion(&stack->phbbar, 0, &phb->mr_regs);
+ }
+
+ /* Map ESB if enabled */
+ if (memory_region_is_mapped(&stack->intbar)) {
+ memory_region_add_subregion(&stack->intbar, 0, &phb->xsrc.esb_mmio);
+ }
+
+ /* Check/update m32 */
+ pnv_phb4_check_all_mbt(phb);
+}
+
+void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon)
+{
+ uint32_t offset = phb->regs[PHB_INT_NOTIFY_INDEX >> 3];
+
+ monitor_printf(mon, "PHB4[%x:%x] Source %08x .. %08x\n",
+ phb->chip_id, phb->phb_id,
+ offset, offset + phb->xsrc.nr_irqs - 1);
+ xive_source_pic_print_info(&phb->xsrc, 0, mon);
+}
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
new file mode 100644
index 0000000000..fd92041d69
--- /dev/null
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -0,0 +1,593 @@
+/*
+ * QEMU PowerPC PowerNV (POWER9) PHB4 model
+ *
+ * Copyright (c) 2018-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "qemu/log.h"
+#include "target/ppc/cpu.h"
+#include "hw/ppc/fdt.h"
+#include "hw/pci-host/pnv_phb4_regs.h"
+#include "hw/pci-host/pnv_phb4.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+#include "hw/ppc/pnv.h"
+#include "hw/qdev-properties.h"
+
+#include <libfdt.h>
+
+#define phb_pec_error(pec, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb4_pec[%d:%d]: " fmt "\n", \
+ (pec)->chip_id, (pec)->index, ## __VA_ARGS__)
+
+
+static uint64_t pnv_pec_nest_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return pec->nest_regs[reg];
+}
+
+static void pnv_pec_nest_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_NEST_PBCQ_HW_CONFIG:
+ case PEC_NEST_DROP_PRIO_CTRL:
+ case PEC_NEST_PBCQ_ERR_INJECT:
+ case PEC_NEST_PCI_NEST_CLK_TRACE_CTL:
+ case PEC_NEST_PBCQ_PMON_CTRL:
+ case PEC_NEST_PBCQ_PBUS_ADDR_EXT:
+ case PEC_NEST_PBCQ_PRED_VEC_TIMEOUT:
+ case PEC_NEST_CAPP_CTRL:
+ case PEC_NEST_PBCQ_READ_STK_OVR:
+ case PEC_NEST_PBCQ_WRITE_STK_OVR:
+ case PEC_NEST_PBCQ_STORE_STK_OVR:
+ case PEC_NEST_PBCQ_RETRY_BKOFF_CTRL:
+ pec->nest_regs[reg] = val;
+ break;
+ default:
+ phb_pec_error(pec, "%s @0x%"HWADDR_PRIx"=%"PRIx64"\n", __func__,
+ addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_nest_xscom_ops = {
+ .read = pnv_pec_nest_xscom_read,
+ .write = pnv_pec_nest_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_pec_pci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return pec->pci_regs[reg];
+}
+
+static void pnv_pec_pci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_PCI_PBAIB_HW_CONFIG:
+ case PEC_PCI_PBAIB_READ_STK_OVR:
+ pec->pci_regs[reg] = val;
+ break;
+ default:
+ phb_pec_error(pec, "%s @0x%"HWADDR_PRIx"=%"PRIx64"\n", __func__,
+ addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_pci_xscom_ops = {
+ .read = pnv_pec_pci_xscom_read,
+ .write = pnv_pec_pci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_pec_stk_nest_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return stack->nest_regs[reg];
+}
+
+static void pnv_pec_stk_update_map(PnvPhb4PecStack *stack)
+{
+ PnvPhb4PecState *pec = stack->pec;
+ MemoryRegion *sysmem = pec->system_memory;
+ uint64_t bar_en = stack->nest_regs[PEC_NEST_STK_BAR_EN];
+ uint64_t bar, mask, size;
+ char name[64];
+
+ /*
+ * NOTE: This will really not work well if those are remapped
+ * after the PHB has created its sub regions. We could do better
+ * if we had a way to resize regions but we don't really care
+ * that much in practice as the stuff below really only happens
+ * once early during boot
+ */
+
+ /* Handle unmaps */
+ if (memory_region_is_mapped(&stack->mmbar0) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
+ memory_region_del_subregion(sysmem, &stack->mmbar0);
+ }
+ if (memory_region_is_mapped(&stack->mmbar1) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
+ memory_region_del_subregion(sysmem, &stack->mmbar1);
+ }
+ if (memory_region_is_mapped(&stack->phbbar) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
+ memory_region_del_subregion(sysmem, &stack->phbbar);
+ }
+ if (memory_region_is_mapped(&stack->intbar) &&
+ !(bar_en & PEC_NEST_STK_BAR_EN_INT)) {
+ memory_region_del_subregion(sysmem, &stack->intbar);
+ }
+
+ /* Update PHB */
+ pnv_phb4_update_regions(stack);
+
+ /* Handle maps */
+ if (!memory_region_is_mapped(&stack->mmbar0) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_MMIO0)) {
+ bar = stack->nest_regs[PEC_NEST_STK_MMIO_BAR0] >> 8;
+ mask = stack->nest_regs[PEC_NEST_STK_MMIO_BAR0_MASK];
+ size = ((~mask) >> 8) + 1;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-mmio0",
+ pec->chip_id, pec->index, stack->stack_no);
+ memory_region_init(&stack->mmbar0, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->mmbar0);
+ stack->mmio0_base = bar;
+ stack->mmio0_size = size;
+ }
+ if (!memory_region_is_mapped(&stack->mmbar1) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_MMIO1)) {
+ bar = stack->nest_regs[PEC_NEST_STK_MMIO_BAR1] >> 8;
+ mask = stack->nest_regs[PEC_NEST_STK_MMIO_BAR1_MASK];
+ size = ((~mask) >> 8) + 1;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-mmio1",
+ pec->chip_id, pec->index, stack->stack_no);
+ memory_region_init(&stack->mmbar1, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->mmbar1);
+ stack->mmio1_base = bar;
+ stack->mmio1_size = size;
+ }
+ if (!memory_region_is_mapped(&stack->phbbar) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_PHB)) {
+ bar = stack->nest_regs[PEC_NEST_STK_PHB_REGS_BAR] >> 8;
+ size = PNV_PHB4_NUM_REGS << 3;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-phb",
+ pec->chip_id, pec->index, stack->stack_no);
+ memory_region_init(&stack->phbbar, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->phbbar);
+ }
+ if (!memory_region_is_mapped(&stack->intbar) &&
+ (bar_en & PEC_NEST_STK_BAR_EN_INT)) {
+ bar = stack->nest_regs[PEC_NEST_STK_INT_BAR] >> 8;
+ size = PNV_PHB4_MAX_INTs << 16;
+ snprintf(name, sizeof(name), "pec-%d.%d-stack-%d-int",
+ stack->pec->chip_id, stack->pec->index, stack->stack_no);
+ memory_region_init(&stack->intbar, OBJECT(stack), name, size);
+ memory_region_add_subregion(sysmem, bar, &stack->intbar);
+ }
+
+ /* Update PHB */
+ pnv_phb4_update_regions(stack);
+}
+
+static void pnv_pec_stk_nest_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ PnvPhb4PecState *pec = stack->pec;
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_NEST_STK_PCI_NEST_FIR:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] = val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_CLR:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] &= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_SET:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR] |= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_MSK:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] = val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_MSKC:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] &= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_MSKS:
+ stack->nest_regs[PEC_NEST_STK_PCI_NEST_FIR_MSK] |= val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_ACT0:
+ case PEC_NEST_STK_PCI_NEST_FIR_ACT1:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_NEST_STK_PCI_NEST_FIR_WOF:
+ stack->nest_regs[reg] = 0;
+ break;
+ case PEC_NEST_STK_ERR_REPORT_0:
+ case PEC_NEST_STK_ERR_REPORT_1:
+ case PEC_NEST_STK_PBCQ_GNRL_STATUS:
+ /* Flag error ? */
+ break;
+ case PEC_NEST_STK_PBCQ_MODE:
+ stack->nest_regs[reg] = val & 0xff00000000000000ull;
+ break;
+ case PEC_NEST_STK_MMIO_BAR0:
+ case PEC_NEST_STK_MMIO_BAR0_MASK:
+ case PEC_NEST_STK_MMIO_BAR1:
+ case PEC_NEST_STK_MMIO_BAR1_MASK:
+ if (stack->nest_regs[PEC_NEST_STK_BAR_EN] &
+ (PEC_NEST_STK_BAR_EN_MMIO0 |
+ PEC_NEST_STK_BAR_EN_MMIO1)) {
+ phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+ }
+ stack->nest_regs[reg] = val & 0xffffffffff000000ull;
+ break;
+ case PEC_NEST_STK_PHB_REGS_BAR:
+ if (stack->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_PHB) {
+ phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+ }
+ stack->nest_regs[reg] = val & 0xffffffffffc00000ull;
+ break;
+ case PEC_NEST_STK_INT_BAR:
+ if (stack->nest_regs[PEC_NEST_STK_BAR_EN] & PEC_NEST_STK_BAR_EN_INT) {
+ phb_pec_error(pec, "Changing enabled BAR unsupported\n");
+ }
+ stack->nest_regs[reg] = val & 0xfffffff000000000ull;
+ break;
+ case PEC_NEST_STK_BAR_EN:
+ stack->nest_regs[reg] = val & 0xf000000000000000ull;
+ pnv_pec_stk_update_map(stack);
+ break;
+ case PEC_NEST_STK_DATA_FRZ_TYPE:
+ case PEC_NEST_STK_PBCQ_TUN_BAR:
+ /* Not used for now */
+ stack->nest_regs[reg] = val;
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4_pec: nest_xscom_write 0x%"HWADDR_PRIx
+ "=%"PRIx64"\n", addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_stk_nest_xscom_ops = {
+ .read = pnv_pec_stk_nest_xscom_read,
+ .write = pnv_pec_stk_nest_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static uint64_t pnv_pec_stk_pci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ uint32_t reg = addr >> 3;
+
+ /* TODO: add list of allowed registers and error out if not */
+ return stack->pci_regs[reg];
+}
+
+static void pnv_pec_stk_pci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PEC_PCI_STK_PCI_FIR:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_CLR:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR] &= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_SET:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR] |= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_MSK:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_MSKC:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR_MSK] &= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_MSKS:
+ stack->nest_regs[PEC_PCI_STK_PCI_FIR_MSK] |= val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_ACT0:
+ case PEC_PCI_STK_PCI_FIR_ACT1:
+ stack->nest_regs[reg] = val;
+ break;
+ case PEC_PCI_STK_PCI_FIR_WOF:
+ stack->nest_regs[reg] = 0;
+ break;
+ case PEC_PCI_STK_ETU_RESET:
+ stack->nest_regs[reg] = val & 0x8000000000000000ull;
+ /* TODO: Implement reset */
+ break;
+ case PEC_PCI_STK_PBAIB_ERR_REPORT:
+ break;
+ case PEC_PCI_STK_PBAIB_TX_CMD_CRED:
+ case PEC_PCI_STK_PBAIB_TX_DAT_CRED:
+ stack->nest_regs[reg] = val;
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb4_pec_stk: pci_xscom_write 0x%"HWADDR_PRIx
+ "=%"PRIx64"\n", addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pec_stk_pci_xscom_ops = {
+ .read = pnv_pec_stk_pci_xscom_read,
+ .write = pnv_pec_stk_pci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void pnv_pec_instance_init(Object *obj)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(obj);
+ int i;
+
+ for (i = 0; i < PHB4_PEC_MAX_STACKS; i++) {
+ object_initialize_child(obj, "stack[*]", &pec->stacks[i],
+ sizeof(pec->stacks[i]), TYPE_PNV_PHB4_PEC_STACK,
+ &error_abort, NULL);
+ }
+}
+
+static void pnv_pec_realize(DeviceState *dev, Error **errp)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(dev);
+ Error *local_err = NULL;
+ char name[64];
+ int i;
+
+ assert(pec->system_memory);
+
+ /* Create stacks */
+ for (i = 0; i < pec->num_stacks; i++) {
+ PnvPhb4PecStack *stack = &pec->stacks[i];
+ Object *stk_obj = OBJECT(stack);
+
+ object_property_set_int(stk_obj, i, "stack-no", &error_abort);
+ object_property_set_link(stk_obj, OBJECT(pec), "pec", &error_abort);
+ object_property_set_bool(stk_obj, true, "realized", errp);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+ }
+
+ /* Initialize the XSCOM regions for the PEC registers */
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest", pec->chip_id,
+ pec->index);
+ pnv_xscom_region_init(&pec->nest_regs_mr, OBJECT(dev),
+ &pnv_pec_nest_xscom_ops, pec, name,
+ PHB4_PEC_NEST_REGS_COUNT);
+
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci", pec->chip_id,
+ pec->index);
+ pnv_xscom_region_init(&pec->pci_regs_mr, OBJECT(dev),
+ &pnv_pec_pci_xscom_ops, pec, name,
+ PHB4_PEC_PCI_REGS_COUNT);
+}
+
+static int pnv_pec_dt_xscom(PnvXScomInterface *dev, void *fdt,
+ int xscom_offset)
+{
+ PnvPhb4PecState *pec = PNV_PHB4_PEC(dev);
+ PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(dev);
+ uint32_t nbase = pecc->xscom_nest_base(pec);
+ uint32_t pbase = pecc->xscom_pci_base(pec);
+ int offset, i;
+ char *name;
+ uint32_t reg[] = {
+ cpu_to_be32(nbase),
+ cpu_to_be32(pecc->xscom_nest_size),
+ cpu_to_be32(pbase),
+ cpu_to_be32(pecc->xscom_pci_size),
+ };
+
+ name = g_strdup_printf("pbcq@%x", nbase);
+ offset = fdt_add_subnode(fdt, xscom_offset, name);
+ _FDT(offset);
+ g_free(name);
+
+ _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
+
+ _FDT((fdt_setprop_cell(fdt, offset, "ibm,pec-index", pec->index)));
+ _FDT((fdt_setprop_cell(fdt, offset, "#address-cells", 1)));
+ _FDT((fdt_setprop_cell(fdt, offset, "#size-cells", 0)));
+ _FDT((fdt_setprop(fdt, offset, "compatible", pecc->compat,
+ pecc->compat_size)));
+
+ for (i = 0; i < pec->num_stacks; i++) {
+ PnvPhb4PecStack *stack = &pec->stacks[i];
+ PnvPHB4 *phb = &stack->phb;
+ int stk_offset;
+
+ name = g_strdup_printf("stack@%x", i);
+ stk_offset = fdt_add_subnode(fdt, offset, name);
+ _FDT(stk_offset);
+ g_free(name);
+ _FDT((fdt_setprop(fdt, stk_offset, "compatible", pecc->stk_compat,
+ pecc->stk_compat_size)));
+ _FDT((fdt_setprop_cell(fdt, stk_offset, "reg", i)));
+ _FDT((fdt_setprop_cell(fdt, stk_offset, "ibm,phb-index", phb->phb_id)));
+ }
+
+ return 0;
+}
+
+static Property pnv_pec_properties[] = {
+ DEFINE_PROP_UINT32("index", PnvPhb4PecState, index, 0),
+ DEFINE_PROP_UINT32("num-stacks", PnvPhb4PecState, num_stacks, 0),
+ DEFINE_PROP_UINT32("chip-id", PnvPhb4PecState, chip_id, 0),
+ DEFINE_PROP_LINK("system-memory", PnvPhb4PecState, system_memory,
+ TYPE_MEMORY_REGION, MemoryRegion *),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static uint32_t pnv_pec_xscom_pci_base(PnvPhb4PecState *pec)
+{
+ return PNV9_XSCOM_PEC_PCI_BASE + 0x1000000 * pec->index;
+}
+
+static uint32_t pnv_pec_xscom_nest_base(PnvPhb4PecState *pec)
+{
+ return PNV9_XSCOM_PEC_NEST_BASE + 0x400 * pec->index;
+}
+
+static void pnv_pec_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
+ PnvPhb4PecClass *pecc = PNV_PHB4_PEC_CLASS(klass);
+ static const char compat[] = "ibm,power9-pbcq";
+ static const char stk_compat[] = "ibm,power9-phb-stack";
+
+ xdc->dt_xscom = pnv_pec_dt_xscom;
+
+ dc->realize = pnv_pec_realize;
+ device_class_set_props(dc, pnv_pec_properties);
+
+ pecc->xscom_nest_base = pnv_pec_xscom_nest_base;
+ pecc->xscom_pci_base = pnv_pec_xscom_pci_base;
+ pecc->xscom_nest_size = PNV9_XSCOM_PEC_NEST_SIZE;
+ pecc->xscom_pci_size = PNV9_XSCOM_PEC_PCI_SIZE;
+ pecc->compat = compat;
+ pecc->compat_size = sizeof(compat);
+ pecc->stk_compat = stk_compat;
+ pecc->stk_compat_size = sizeof(stk_compat);
+}
+
+static const TypeInfo pnv_pec_type_info = {
+ .name = TYPE_PNV_PHB4_PEC,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(PnvPhb4PecState),
+ .instance_init = pnv_pec_instance_init,
+ .class_init = pnv_pec_class_init,
+ .class_size = sizeof(PnvPhb4PecClass),
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_PNV_XSCOM_INTERFACE },
+ { }
+ }
+};
+
+static void pnv_pec_stk_instance_init(Object *obj)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(obj);
+
+ object_initialize_child(obj, "phb", &stack->phb, sizeof(stack->phb),
+ TYPE_PNV_PHB4, &error_abort, NULL);
+}
+
+static void pnv_pec_stk_realize(DeviceState *dev, Error **errp)
+{
+ PnvPhb4PecStack *stack = PNV_PHB4_PEC_STACK(dev);
+ PnvPhb4PecState *pec = stack->pec;
+ char name[64];
+
+ assert(pec);
+
+ /* Initialize the XSCOM regions for the stack registers */
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-nest-stack-%d",
+ pec->chip_id, pec->index, stack->stack_no);
+ pnv_xscom_region_init(&stack->nest_regs_mr, OBJECT(stack),
+ &pnv_pec_stk_nest_xscom_ops, stack, name,
+ PHB4_PEC_NEST_STK_REGS_COUNT);
+
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-stack-%d",
+ pec->chip_id, pec->index, stack->stack_no);
+ pnv_xscom_region_init(&stack->pci_regs_mr, OBJECT(stack),
+ &pnv_pec_stk_pci_xscom_ops, stack, name,
+ PHB4_PEC_PCI_STK_REGS_COUNT);
+
+ /* PHB pass-through */
+ snprintf(name, sizeof(name), "xscom-pec-%d.%d-pci-stack-%d-phb",
+ pec->chip_id, pec->index, stack->stack_no);
+ pnv_xscom_region_init(&stack->phb_regs_mr, OBJECT(&stack->phb),
+ &pnv_phb4_xscom_ops, &stack->phb, name, 0x40);
+
+ /*
+ * Let the machine/chip realize the PHB object to customize more
+ * easily some fields
+ */
+}
+
+static Property pnv_pec_stk_properties[] = {
+ DEFINE_PROP_UINT32("stack-no", PnvPhb4PecStack, stack_no, 0),
+ DEFINE_PROP_LINK("pec", PnvPhb4PecStack, pec, TYPE_PNV_PHB4_PEC,
+ PnvPhb4PecState *),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_pec_stk_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ device_class_set_props(dc, pnv_pec_stk_properties);
+ dc->realize = pnv_pec_stk_realize;
+
+ /* TODO: reset regs ? */
+}
+
+static const TypeInfo pnv_pec_stk_type_info = {
+ .name = TYPE_PNV_PHB4_PEC_STACK,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(PnvPhb4PecStack),
+ .instance_init = pnv_pec_stk_instance_init,
+ .class_init = pnv_pec_stk_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_PNV_XSCOM_INTERFACE },
+ { }
+ }
+};
+
+static void pnv_pec_register_types(void)
+{
+ type_register_static(&pnv_pec_type_info);
+ type_register_static(&pnv_pec_stk_type_info);
+}
+
+type_init(pnv_pec_register_types);
diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
index e27efe9a24..354828bf13 100644
--- a/hw/ppc/Kconfig
+++ b/hw/ppc/Kconfig
@@ -135,6 +135,8 @@ config XIVE_SPAPR
default y
depends on PSERIES
select XIVE
+ select PCI
+ select PCIE_PORT
config XIVE_KVM
bool
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 9442e5eb63..d5ecec6321 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -40,6 +40,7 @@
#include "hw/intc/intc.h"
#include "hw/ipmi/ipmi.h"
#include "target/ppc/mmu-hash64.h"
+#include "hw/pci/msi.h"
#include "hw/ppc/xics.h"
#include "hw/qdev-properties.h"
@@ -622,9 +623,17 @@ static void pnv_chip_power8_pic_print_info(PnvChip *chip, Monitor *mon)
static void pnv_chip_power9_pic_print_info(PnvChip *chip, Monitor *mon)
{
Pnv9Chip *chip9 = PNV9_CHIP(chip);
+ int i, j;
pnv_xive_pic_print_info(&chip9->xive, mon);
pnv_psi_pic_print_info(&chip9->psi, mon);
+
+ for (i = 0; i < PNV9_CHIP_MAX_PEC; i++) {
+ PnvPhb4PecState *pec = &chip9->pecs[i];
+ for (j = 0; j < pec->num_stacks; j++) {
+ pnv_phb4_pic_print_info(&pec->stacks[j].phb, mon);
+ }
+ }
}
static uint64_t pnv_chip_power8_xscom_core_base(PnvChip *chip,
@@ -748,6 +757,9 @@ static void pnv_init(MachineState *machine)
}
}
+ /* MSIs are supported on this platform */
+ msi_nonbroken = true;
+
/*
* Check compatibility of the specified CPU with the machine
* default.
@@ -1230,7 +1242,10 @@ static void pnv_chip_power8nvl_class_init(ObjectClass *klass, void *data)
static void pnv_chip_power9_instance_init(Object *obj)
{
+ PnvChip *chip = PNV_CHIP(obj);
Pnv9Chip *chip9 = PNV9_CHIP(obj);
+ PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
+ int i;
object_initialize_child(obj, "xive", &chip9->xive, sizeof(chip9->xive),
TYPE_PNV_XIVE, &error_abort, NULL);
@@ -1248,6 +1263,17 @@ static void pnv_chip_power9_instance_init(Object *obj)
object_initialize_child(obj, "homer", &chip9->homer, sizeof(chip9->homer),
TYPE_PNV9_HOMER, &error_abort, NULL);
+
+ for (i = 0; i < PNV9_CHIP_MAX_PEC; i++) {
+ object_initialize_child(obj, "pec[*]", &chip9->pecs[i],
+ sizeof(chip9->pecs[i]), TYPE_PNV_PHB4_PEC,
+ &error_abort, NULL);
+ }
+
+ /*
+ * Number of PHBs is the chip default
+ */
+ chip->num_phbs = pcc->num_phbs;
}
static void pnv_chip_quad_realize(Pnv9Chip *chip9, Error **errp)
@@ -1276,6 +1302,78 @@ static void pnv_chip_quad_realize(Pnv9Chip *chip9, Error **errp)
}
}
+static void pnv_chip_power9_phb_realize(PnvChip *chip, Error **errp)
+{
+ Pnv9Chip *chip9 = PNV9_CHIP(chip);
+ Error *local_err = NULL;
+ int i, j;
+ int phb_id = 0;
+
+ for (i = 0; i < PNV9_CHIP_MAX_PEC; i++) {
+ PnvPhb4PecState *pec = &chip9->pecs[i];
+ PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
+ uint32_t pec_nest_base;
+ uint32_t pec_pci_base;
+
+ object_property_set_int(OBJECT(pec), i, "index", &error_fatal);
+ /*
+ * PEC0 -> 1 stack
+ * PEC1 -> 2 stacks
+ * PEC2 -> 3 stacks
+ */
+ object_property_set_int(OBJECT(pec), i + 1, "num-stacks",
+ &error_fatal);
+ object_property_set_int(OBJECT(pec), chip->chip_id, "chip-id",
+ &error_fatal);
+ object_property_set_link(OBJECT(pec), OBJECT(get_system_memory()),
+ "system-memory", &error_abort);
+ object_property_set_bool(OBJECT(pec), true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ pec_nest_base = pecc->xscom_nest_base(pec);
+ pec_pci_base = pecc->xscom_pci_base(pec);
+
+ pnv_xscom_add_subregion(chip, pec_nest_base, &pec->nest_regs_mr);
+ pnv_xscom_add_subregion(chip, pec_pci_base, &pec->pci_regs_mr);
+
+ for (j = 0; j < pec->num_stacks && phb_id < chip->num_phbs;
+ j++, phb_id++) {
+ PnvPhb4PecStack *stack = &pec->stacks[j];
+ Object *obj = OBJECT(&stack->phb);
+
+ object_property_set_int(obj, phb_id, "index", &error_fatal);
+ object_property_set_int(obj, chip->chip_id, "chip-id",
+ &error_fatal);
+ object_property_set_int(obj, PNV_PHB4_VERSION, "version",
+ &error_fatal);
+ object_property_set_int(obj, PNV_PHB4_DEVICE_ID, "device-id",
+ &error_fatal);
+ object_property_set_link(obj, OBJECT(stack), "stack", &error_abort);
+ object_property_set_bool(obj, true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+ qdev_set_parent_bus(DEVICE(obj), sysbus_get_default());
+
+ /* Populate the XSCOM address space. */
+ pnv_xscom_add_subregion(chip,
+ pec_nest_base + 0x40 * (stack->stack_no + 1),
+ &stack->nest_regs_mr);
+ pnv_xscom_add_subregion(chip,
+ pec_pci_base + 0x40 * (stack->stack_no + 1),
+ &stack->pci_regs_mr);
+ pnv_xscom_add_subregion(chip,
+ pec_pci_base + PNV9_XSCOM_PEC_PCI_STK0 +
+ 0x40 * stack->stack_no,
+ &stack->phb_regs_mr);
+ }
+ }
+}
+
static void pnv_chip_power9_realize(DeviceState *dev, Error **errp)
{
PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
@@ -1378,6 +1476,13 @@ static void pnv_chip_power9_realize(DeviceState *dev, Error **errp)
/* Homer mmio region */
memory_region_add_subregion(get_system_memory(), PNV9_HOMER_BASE(chip),
&chip9->homer.regs);
+
+ /* PHBs */
+ pnv_chip_power9_phb_realize(chip, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
}
static uint32_t pnv_chip_power9_xscom_pcba(PnvChip *chip, uint64_t addr)
@@ -1404,6 +1509,7 @@ static void pnv_chip_power9_class_init(ObjectClass *klass, void *data)
k->xscom_core_base = pnv_chip_power9_xscom_core_base;
k->xscom_pcba = pnv_chip_power9_xscom_pcba;
dc->desc = "PowerNV Chip POWER9";
+ k->num_phbs = 6;
device_class_set_parent_realize(dc, pnv_chip_power9_realize,
&k->parent_realize);
@@ -1608,6 +1714,7 @@ static Property pnv_chip_properties[] = {
DEFINE_PROP_UINT32("nr-cores", PnvChip, nr_cores, 1),
DEFINE_PROP_UINT64("cores-mask", PnvChip, cores_mask, 0x0),
DEFINE_PROP_UINT32("nr-threads", PnvChip, nr_threads, 1),
+ DEFINE_PROP_UINT32("num-phbs", PnvChip, num_phbs, 0),
DEFINE_PROP_END_OF_LIST(),
};
diff --git a/include/hw/pci-host/pnv_phb4.h b/include/hw/pci-host/pnv_phb4.h
new file mode 100644
index 0000000000..c882bfd0aa
--- /dev/null
+++ b/include/hw/pci-host/pnv_phb4.h
@@ -0,0 +1,230 @@
+/*
+ * QEMU PowerPC PowerNV (POWER9) PHB4 model
+ *
+ * Copyright (c) 2018-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef PCI_HOST_PNV_PHB4_H
+#define PCI_HOST_PNV_PHB4_H
+
+#include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/ppc/xive.h"
+
+typedef struct PnvPhb4PecState PnvPhb4PecState;
+typedef struct PnvPhb4PecStack PnvPhb4PecStack;
+typedef struct PnvPHB4 PnvPHB4;
+typedef struct PnvChip PnvChip;
+
+/*
+ * We have one such address space wrapper per possible device under
+ * the PHB since they need to be assigned statically at qemu device
+ * creation time. The relationship to a PE is done later
+ * dynamically. This means we can potentially create a lot of these
+ * guys. Q35 stores them as some kind of radix tree but we never
+ * really need to do fast lookups so instead we simply keep a QLIST of
+ * them for now, we can add the radix if needed later on.
+ *
+ * We do cache the PE number to speed things up a bit though.
+ */
+typedef struct PnvPhb4DMASpace {
+ PCIBus *bus;
+ uint8_t devfn;
+ int pe_num; /* Cached PE number */
+#define PHB_INVALID_PE (-1)
+ PnvPHB4 *phb;
+ AddressSpace dma_as;
+ IOMMUMemoryRegion dma_mr;
+ MemoryRegion msi32_mr;
+ MemoryRegion msi64_mr;
+ QLIST_ENTRY(PnvPhb4DMASpace) list;
+} PnvPhb4DMASpace;
+
+/*
+ * PHB4 PCIe Root port
+ */
+#define TYPE_PNV_PHB4_ROOT_BUS "pnv-phb4-root-bus"
+#define TYPE_PNV_PHB4_ROOT_PORT "pnv-phb4-root-port"
+
+typedef struct PnvPHB4RootPort {
+ PCIESlot parent_obj;
+} PnvPHB4RootPort;
+
+/*
+ * PHB4 PCIe Host Bridge for PowerNV machines (POWER9)
+ */
+#define TYPE_PNV_PHB4 "pnv-phb4"
+#define PNV_PHB4(obj) OBJECT_CHECK(PnvPHB4, (obj), TYPE_PNV_PHB4)
+
+#define PNV_PHB4_MAX_LSIs 8
+#define PNV_PHB4_MAX_INTs 4096
+#define PNV_PHB4_MAX_MIST (PNV_PHB4_MAX_INTs >> 2)
+#define PNV_PHB4_MAX_MMIO_WINDOWS 32
+#define PNV_PHB4_MIN_MMIO_WINDOWS 16
+#define PNV_PHB4_NUM_REGS (0x3000 >> 3)
+#define PNV_PHB4_MAX_PEs 512
+#define PNV_PHB4_MAX_TVEs (PNV_PHB4_MAX_PEs * 2)
+#define PNV_PHB4_MAX_PEEVs (PNV_PHB4_MAX_PEs / 64)
+#define PNV_PHB4_MAX_MBEs (PNV_PHB4_MAX_MMIO_WINDOWS * 2)
+
+#define PNV_PHB4_VERSION 0x000000a400000002ull
+#define PNV_PHB4_DEVICE_ID 0x04c1
+
+#define PCI_MMIO_TOTAL_SIZE (0x1ull << 60)
+
+struct PnvPHB4 {
+ PCIExpressHost parent_obj;
+
+ PnvPHB4RootPort root;
+
+ uint32_t chip_id;
+ uint32_t phb_id;
+
+ uint64_t version;
+ uint16_t device_id;
+
+ char bus_path[8];
+
+ /* Main register images */
+ uint64_t regs[PNV_PHB4_NUM_REGS];
+ MemoryRegion mr_regs;
+
+ /* Extra SCOM-only register */
+ uint64_t scom_hv_ind_addr_reg;
+
+ /*
+ * Geometry of the PHB. There are two types, small and big PHBs, a
+ * number of resources (number of PEs, windows etc...) are doubled
+ * for a big PHB
+ */
+ bool big_phb;
+
+ /* Memory regions for MMIO space */
+ MemoryRegion mr_mmio[PNV_PHB4_MAX_MMIO_WINDOWS];
+
+ /* PCI side space */
+ MemoryRegion pci_mmio;
+ MemoryRegion pci_io;
+
+ /* On-chip IODA tables */
+ uint64_t ioda_LIST[PNV_PHB4_MAX_LSIs];
+ uint64_t ioda_MIST[PNV_PHB4_MAX_MIST];
+ uint64_t ioda_TVT[PNV_PHB4_MAX_TVEs];
+ uint64_t ioda_MBT[PNV_PHB4_MAX_MBEs];
+ uint64_t ioda_MDT[PNV_PHB4_MAX_PEs];
+ uint64_t ioda_PEEV[PNV_PHB4_MAX_PEEVs];
+
+ /*
+ * The internal PESTA/B is 2 bits per PE split into two tables, we
+ * store them in a single array here to avoid wasting space.
+ */
+ uint8_t ioda_PEST_AB[PNV_PHB4_MAX_PEs];
+
+ /* P9 Interrupt generation */
+ XiveSource xsrc;
+ qemu_irq *qirqs;
+
+ PnvPhb4PecStack *stack;
+
+ QLIST_HEAD(, PnvPhb4DMASpace) dma_spaces;
+};
+
+void pnv_phb4_pic_print_info(PnvPHB4 *phb, Monitor *mon);
+void pnv_phb4_update_regions(PnvPhb4PecStack *stack);
+extern const MemoryRegionOps pnv_phb4_xscom_ops;
+
+/*
+ * PHB4 PEC (PCI Express Controller)
+ */
+#define TYPE_PNV_PHB4_PEC "pnv-phb4-pec"
+#define PNV_PHB4_PEC(obj) \
+ OBJECT_CHECK(PnvPhb4PecState, (obj), TYPE_PNV_PHB4_PEC)
+
+#define TYPE_PNV_PHB4_PEC_STACK "pnv-phb4-pec-stack"
+#define PNV_PHB4_PEC_STACK(obj) \
+ OBJECT_CHECK(PnvPhb4PecStack, (obj), TYPE_PNV_PHB4_PEC_STACK)
+
+/* Per-stack data */
+struct PnvPhb4PecStack {
+ DeviceState parent;
+
+ /* My own stack number */
+ uint32_t stack_no;
+
+ /* Nest registers */
+#define PHB4_PEC_NEST_STK_REGS_COUNT 0x17
+ uint64_t nest_regs[PHB4_PEC_NEST_STK_REGS_COUNT];
+ MemoryRegion nest_regs_mr;
+
+ /* PCI registers (excluding pass-through) */
+#define PHB4_PEC_PCI_STK_REGS_COUNT 0xf
+ uint64_t pci_regs[PHB4_PEC_PCI_STK_REGS_COUNT];
+ MemoryRegion pci_regs_mr;
+
+ /* PHB pass-through XSCOM */
+ MemoryRegion phb_regs_mr;
+
+ /* Memory windows from PowerBus to PHB */
+ MemoryRegion mmbar0;
+ MemoryRegion mmbar1;
+ MemoryRegion phbbar;
+ MemoryRegion intbar;
+ uint64_t mmio0_base;
+ uint64_t mmio0_size;
+ uint64_t mmio1_base;
+ uint64_t mmio1_size;
+
+ /* The owner PEC */
+ PnvPhb4PecState *pec;
+
+ /* The actual PHB */
+ PnvPHB4 phb;
+};
+
+struct PnvPhb4PecState {
+ DeviceState parent;
+
+ /* PEC number in chip */
+ uint32_t index;
+ uint32_t chip_id;
+
+ MemoryRegion *system_memory;
+
+ /* Nest registers, excuding per-stack */
+#define PHB4_PEC_NEST_REGS_COUNT 0xf
+ uint64_t nest_regs[PHB4_PEC_NEST_REGS_COUNT];
+ MemoryRegion nest_regs_mr;
+
+ /* PCI registers, excluding per-stack */
+#define PHB4_PEC_PCI_REGS_COUNT 0x2
+ uint64_t pci_regs[PHB4_PEC_PCI_REGS_COUNT];
+ MemoryRegion pci_regs_mr;
+
+ /* Stacks */
+ #define PHB4_PEC_MAX_STACKS 3
+ uint32_t num_stacks;
+ PnvPhb4PecStack stacks[PHB4_PEC_MAX_STACKS];
+};
+
+#define PNV_PHB4_PEC_CLASS(klass) \
+ OBJECT_CLASS_CHECK(PnvPhb4PecClass, (klass), TYPE_PNV_PHB4_PEC)
+#define PNV_PHB4_PEC_GET_CLASS(obj) \
+ OBJECT_GET_CLASS(PnvPhb4PecClass, (obj), TYPE_PNV_PHB4_PEC)
+
+typedef struct PnvPhb4PecClass {
+ DeviceClass parent_class;
+
+ uint32_t (*xscom_nest_base)(PnvPhb4PecState *pec);
+ uint32_t xscom_nest_size;
+ uint32_t (*xscom_pci_base)(PnvPhb4PecState *pec);
+ uint32_t xscom_pci_size;
+ const char *compat;
+ int compat_size;
+ const char *stk_compat;
+ int stk_compat_size;
+} PnvPhb4PecClass;
+
+#endif /* PCI_HOST_PNV_PHB4_H */
diff --git a/include/hw/pci-host/pnv_phb4_regs.h b/include/hw/pci-host/pnv_phb4_regs.h
new file mode 100644
index 0000000000..55df2c3e5e
--- /dev/null
+++ b/include/hw/pci-host/pnv_phb4_regs.h
@@ -0,0 +1,553 @@
+/*
+ * QEMU PowerPC PowerNV (POWER9) PHB4 model
+ *
+ * Copyright (c) 2013-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef PCI_HOST_PNV_PHB4_REGS_H
+#define PCI_HOST_PNV_PHB4_REGS_H
+
+/*
+ * PEC XSCOM registers
+ *
+ * There a 3 PECs in P9. Each PEC can have several PHBs. Each PEC has some
+ * "global" registers and some "per-stack" (per-PHB) registers. Those are
+ * organized in two XSCOM ranges, the "Nest" range and the "PCI" range, each
+ * range contains both some "PEC" registers and some "per-stack" registers.
+ *
+ * Finally the PCI range also contains an additional range per stack that
+ * passes through to some of the PHB own registers.
+ *
+ * PEC0 can contain 1 PHB (PHB0)
+ * PEC1 can contain 2 PHBs (PHB1 and PHB2)
+ * PEC2 can contain 3 PHBs (PHB3, PHB4 and PHB5)
+ */
+
+/*
+ * This is the "stack" offset, it's the offset from a given range base
+ * to the first "per-stack" registers and also the stride between
+ * stacks, thus for PEC2, the global registers are at offset 0, the
+ * PHB3 registers at offset 0x40, the PHB4 at offset 0x80 etc....
+ *
+ * It is *also* the offset to the pass-through SCOM region but in this case
+ * it is 0 based, ie PHB3 is at 0x100 PHB4 is a 0x140 etc..
+ */
+#define PEC_STACK_OFFSET 0x40
+
+/* XSCOM Nest global registers */
+#define PEC_NEST_PBCQ_HW_CONFIG 0x00
+#define PEC_NEST_DROP_PRIO_CTRL 0x01
+#define PEC_NEST_PBCQ_ERR_INJECT 0x02
+#define PEC_NEST_PCI_NEST_CLK_TRACE_CTL 0x03
+#define PEC_NEST_PBCQ_PMON_CTRL 0x04
+#define PEC_NEST_PBCQ_PBUS_ADDR_EXT 0x05
+#define PEC_NEST_PBCQ_PRED_VEC_TIMEOUT 0x06
+#define PEC_NEST_CAPP_CTRL 0x07
+#define PEC_NEST_PBCQ_READ_STK_OVR 0x08
+#define PEC_NEST_PBCQ_WRITE_STK_OVR 0x09
+#define PEC_NEST_PBCQ_STORE_STK_OVR 0x0a
+#define PEC_NEST_PBCQ_RETRY_BKOFF_CTRL 0x0b
+
+/* XSCOM Nest per-stack registers */
+#define PEC_NEST_STK_PCI_NEST_FIR 0x00
+#define PEC_NEST_STK_PCI_NEST_FIR_CLR 0x01
+#define PEC_NEST_STK_PCI_NEST_FIR_SET 0x02
+#define PEC_NEST_STK_PCI_NEST_FIR_MSK 0x03
+#define PEC_NEST_STK_PCI_NEST_FIR_MSKC 0x04
+#define PEC_NEST_STK_PCI_NEST_FIR_MSKS 0x05
+#define PEC_NEST_STK_PCI_NEST_FIR_ACT0 0x06
+#define PEC_NEST_STK_PCI_NEST_FIR_ACT1 0x07
+#define PEC_NEST_STK_PCI_NEST_FIR_WOF 0x08
+#define PEC_NEST_STK_ERR_REPORT_0 0x0a
+#define PEC_NEST_STK_ERR_REPORT_1 0x0b
+#define PEC_NEST_STK_PBCQ_GNRL_STATUS 0x0c
+#define PEC_NEST_STK_PBCQ_MODE 0x0d
+#define PEC_NEST_STK_MMIO_BAR0 0x0e
+#define PEC_NEST_STK_MMIO_BAR0_MASK 0x0f
+#define PEC_NEST_STK_MMIO_BAR1 0x10
+#define PEC_NEST_STK_MMIO_BAR1_MASK 0x11
+#define PEC_NEST_STK_PHB_REGS_BAR 0x12
+#define PEC_NEST_STK_INT_BAR 0x13
+#define PEC_NEST_STK_BAR_EN 0x14
+#define PEC_NEST_STK_BAR_EN_MMIO0 PPC_BIT(0)
+#define PEC_NEST_STK_BAR_EN_MMIO1 PPC_BIT(1)
+#define PEC_NEST_STK_BAR_EN_PHB PPC_BIT(2)
+#define PEC_NEST_STK_BAR_EN_INT PPC_BIT(3)
+#define PEC_NEST_STK_DATA_FRZ_TYPE 0x15
+#define PEC_NEST_STK_PBCQ_TUN_BAR 0x16
+
+/* XSCOM PCI global registers */
+#define PEC_PCI_PBAIB_HW_CONFIG 0x00
+#define PEC_PCI_PBAIB_READ_STK_OVR 0x02
+
+/* XSCOM PCI per-stack registers */
+#define PEC_PCI_STK_PCI_FIR 0x00
+#define PEC_PCI_STK_PCI_FIR_CLR 0x01
+#define PEC_PCI_STK_PCI_FIR_SET 0x02
+#define PEC_PCI_STK_PCI_FIR_MSK 0x03
+#define PEC_PCI_STK_PCI_FIR_MSKC 0x04
+#define PEC_PCI_STK_PCI_FIR_MSKS 0x05
+#define PEC_PCI_STK_PCI_FIR_ACT0 0x06
+#define PEC_PCI_STK_PCI_FIR_ACT1 0x07
+#define PEC_PCI_STK_PCI_FIR_WOF 0x08
+#define PEC_PCI_STK_ETU_RESET 0x0a
+#define PEC_PCI_STK_PBAIB_ERR_REPORT 0x0b
+#define PEC_PCI_STK_PBAIB_TX_CMD_CRED 0x0d
+#define PEC_PCI_STK_PBAIB_TX_DAT_CRED 0x0e
+
+/*
+ * PHB "SCOM" registers. This is accessed via the above window
+ * and provides a backdoor to the PHB when the AIB bus is not
+ * functional. Some of these directly map some of the PHB MMIO
+ * registers, some are specific and allow indirect access to a
+ * wider range of PHB registers
+ */
+#define PHB_SCOM_HV_IND_ADDR 0x00
+#define PHB_SCOM_HV_IND_ADDR_VALID PPC_BIT(0)
+#define PHB_SCOM_HV_IND_ADDR_4B PPC_BIT(1)
+#define PHB_SCOM_HV_IND_ADDR_AUTOINC PPC_BIT(2)
+#define PHB_SCOM_HV_IND_ADDR_ADDR PPC_BITMASK(51, 63)
+#define PHB_SCOM_HV_IND_DATA 0x01
+#define PHB_SCOM_ETU_LEM_FIR 0x08
+#define PHB_SCOM_ETU_LEM_FIR_AND 0x09
+#define PHB_SCOM_ETU_LEM_FIR_OR 0x0a
+#define PHB_SCOM_ETU_LEM_FIR_MSK 0x0b
+#define PHB_SCOM_ETU_LEM_ERR_MSK_AND 0x0c
+#define PHB_SCOM_ETU_LEM_ERR_MSK_OR 0x0d
+#define PHB_SCOM_ETU_LEM_ACT0 0x0e
+#define PHB_SCOM_ETU_LEM_ACT1 0x0f
+#define PHB_SCOM_ETU_LEM_WOF 0x10
+#define PHB_SCOM_ETU_PMON_CONFIG 0x17
+#define PHB_SCOM_ETU_PMON_CTR0 0x18
+#define PHB_SCOM_ETU_PMON_CTR1 0x19
+#define PHB_SCOM_ETU_PMON_CTR2 0x1a
+#define PHB_SCOM_ETU_PMON_CTR3 0x1b
+
+
+/*
+ * PHB MMIO registers
+ */
+
+/* PHB Fundamental register set A */
+#define PHB_LSI_SOURCE_ID 0x100
+#define PHB_LSI_SRC_ID PPC_BITMASK(4, 12)
+#define PHB_DMA_CHAN_STATUS 0x110
+#define PHB_DMA_CHAN_ANY_ERR PPC_BIT(27)
+#define PHB_DMA_CHAN_ANY_ERR1 PPC_BIT(28)
+#define PHB_DMA_CHAN_ANY_FREEZE PPC_BIT(29)
+#define PHB_CPU_LOADSTORE_STATUS 0x120
+#define PHB_CPU_LS_ANY_ERR PPC_BIT(27)
+#define PHB_CPU_LS_ANY_ERR1 PPC_BIT(28)
+#define PHB_CPU_LS_ANY_FREEZE PPC_BIT(29)
+#define PHB_CONFIG_DATA 0x130
+#define PHB_LOCK0 0x138
+#define PHB_CONFIG_ADDRESS 0x140
+#define PHB_CA_ENABLE PPC_BIT(0)
+#define PHB_CA_STATUS PPC_BITMASK(1, 3)
+#define PHB_CA_STATUS_GOOD 0
+#define PHB_CA_STATUS_UR 1
+#define PHB_CA_STATUS_CRS 2
+#define PHB_CA_STATUS_CA 4
+#define PHB_CA_BUS PPC_BITMASK(4, 11)
+#define PHB_CA_DEV PPC_BITMASK(12, 16)
+#define PHB_CA_FUNC PPC_BITMASK(17, 19)
+#define PHB_CA_BDFN PPC_BITMASK(4, 19) /* bus,dev,func */
+#define PHB_CA_REG PPC_BITMASK(20, 31)
+#define PHB_CA_PE PPC_BITMASK(39, 47)
+#define PHB_LOCK1 0x148
+#define PHB_PHB4_CONFIG 0x160
+#define PHB_PHB4C_32BIT_MSI_EN PPC_BIT(8)
+#define PHB_PHB4C_64BIT_MSI_EN PPC_BIT(14)
+#define PHB_RTT_BAR 0x168
+#define PHB_RTT_BAR_ENABLE PPC_BIT(0)
+#define PHB_RTT_BASE_ADDRESS_MASK PPC_BITMASK(8, 46)
+#define PHB_PELTV_BAR 0x188
+#define PHB_PELTV_BAR_ENABLE PPC_BIT(0)
+#define PHB_PELTV_BASE_ADDRESS PPC_BITMASK(8, 50)
+#define PHB_M32_START_ADDR 0x1a0
+#define PHB_PEST_BAR 0x1a8
+#define PHB_PEST_BAR_ENABLE PPC_BIT(0)
+#define PHB_PEST_BASE_ADDRESS PPC_BITMASK(8, 51)
+#define PHB_ASN_CMPM 0x1C0
+#define PHB_ASN_CMPM_ENABLE PPC_BIT(63)
+#define PHB_CAPI_CMPM 0x1C8
+#define PHB_CAPI_CMPM_ENABLE PPC_BIT(63)
+#define PHB_M64_AOMASK 0x1d0
+#define PHB_M64_UPPER_BITS 0x1f0
+#define PHB_NXLATE_PREFIX 0x1f8
+#define PHB_DMARD_SYNC 0x200
+#define PHB_DMARD_SYNC_START PPC_BIT(0)
+#define PHB_DMARD_SYNC_COMPLETE PPC_BIT(1)
+#define PHB_RTC_INVALIDATE 0x208
+#define PHB_RTC_INVALIDATE_ALL PPC_BIT(0)
+#define PHB_RTC_INVALIDATE_RID PPC_BITMASK(16, 31)
+#define PHB_TCE_KILL 0x210
+#define PHB_TCE_KILL_ALL PPC_BIT(0)
+#define PHB_TCE_KILL_PE PPC_BIT(1)
+#define PHB_TCE_KILL_ONE PPC_BIT(2)
+#define PHB_TCE_KILL_PSEL PPC_BIT(3)
+#define PHB_TCE_KILL_64K 0x1000 /* Address override */
+#define PHB_TCE_KILL_2M 0x2000 /* Address override */
+#define PHB_TCE_KILL_1G 0x3000 /* Address override */
+#define PHB_TCE_KILL_PENUM PPC_BITMASK(55, 63)
+#define PHB_TCE_SPEC_CTL 0x218
+#define PHB_IODA_ADDR 0x220
+#define PHB_IODA_AD_AUTOINC PPC_BIT(0)
+#define PHB_IODA_AD_TSEL PPC_BITMASK(11, 15)
+#define PHB_IODA_AD_MIST_PWV PPC_BITMASK(28, 31)
+#define PHB_IODA_AD_TADR PPC_BITMASK(54, 63)
+#define PHB_IODA_DATA0 0x228
+#define PHB_PHB4_GEN_CAP 0x250
+#define PHB_PHB4_TCE_CAP 0x258
+#define PHB_PHB4_IRQ_CAP 0x260
+#define PHB_PHB4_EEH_CAP 0x268
+#define PHB_PAPR_ERR_INJ_CTL 0x2b0
+#define PHB_PAPR_ERR_INJ_CTL_INB PPC_BIT(0)
+#define PHB_PAPR_ERR_INJ_CTL_OUTB PPC_BIT(1)
+#define PHB_PAPR_ERR_INJ_CTL_STICKY PPC_BIT(2)
+#define PHB_PAPR_ERR_INJ_CTL_CFG PPC_BIT(3)
+#define PHB_PAPR_ERR_INJ_CTL_RD PPC_BIT(4)
+#define PHB_PAPR_ERR_INJ_CTL_WR PPC_BIT(5)
+#define PHB_PAPR_ERR_INJ_CTL_FREEZE PPC_BIT(6)
+#define PHB_PAPR_ERR_INJ_ADDR 0x2b8
+#define PHB_PAPR_ERR_INJ_ADDR_MMIO PPC_BITMASK(16, 63)
+#define PHB_PAPR_ERR_INJ_MASK 0x2c0
+#define PHB_PAPR_ERR_INJ_MASK_CFG PPC_BITMASK(4, 11)
+#define PHB_PAPR_ERR_INJ_MASK_CFG_ALL PPC_BITMASK(4, 19)
+#define PHB_PAPR_ERR_INJ_MASK_MMIO PPC_BITMASK(16, 63)
+#define PHB_ETU_ERR_SUMMARY 0x2c8
+#define PHB_INT_NOTIFY_ADDR 0x300
+#define PHB_INT_NOTIFY_INDEX 0x308
+
+/* Fundamental register set B */
+#define PHB_VERSION 0x800
+#define PHB_CTRLR 0x810
+#define PHB_CTRLR_IRQ_PGSZ_64K PPC_BIT(11)
+#define PHB_CTRLR_IRQ_STORE_EOI PPC_BIT(12)
+#define PHB_CTRLR_MMIO_RD_STRICT PPC_BIT(13)
+#define PHB_CTRLR_MMIO_EEH_DISABLE PPC_BIT(14)
+#define PHB_CTRLR_CFG_EEH_BLOCK PPC_BIT(15)
+#define PHB_CTRLR_FENCE_LNKILL_DIS PPC_BIT(16)
+#define PHB_CTRLR_TVT_ADDR_SEL PPC_BITMASK(17, 19)
+#define TVT_DD1_1_PER_PE 0
+#define TVT_DD1_2_PER_PE 1
+#define TVT_DD1_4_PER_PE 2
+#define TVT_DD1_8_PER_PE 3
+#define TVT_DD1_16_PER_PE 4
+#define TVT_2_PER_PE 0
+#define TVT_4_PER_PE 1
+#define TVT_8_PER_PE 2
+#define TVT_16_PER_PE 3
+#define PHB_CTRLR_DMA_RD_SPACING PPC_BITMASK(28, 31)
+#define PHB_AIB_FENCE_CTRL 0x860
+#define PHB_TCE_TAG_ENABLE 0x868
+#define PHB_TCE_WATERMARK 0x870
+#define PHB_TIMEOUT_CTRL1 0x878
+#define PHB_TIMEOUT_CTRL2 0x880
+#define PHB_Q_DMA_R 0x888
+#define PHB_Q_DMA_R_QUIESCE_DMA PPC_BIT(0)
+#define PHB_Q_DMA_R_AUTORESET PPC_BIT(1)
+#define PHB_Q_DMA_R_DMA_RESP_STATUS PPC_BIT(4)
+#define PHB_Q_DMA_R_MMIO_RESP_STATUS PPC_BIT(5)
+#define PHB_Q_DMA_R_TCE_RESP_STATUS PPC_BIT(6)
+#define PHB_Q_DMA_R_TCE_KILL_STATUS PPC_BIT(7)
+#define PHB_TCE_TAG_STATUS 0x908
+
+/* FIR & Error registers */
+#define PHB_LEM_FIR_ACCUM 0xc00
+#define PHB_LEM_FIR_AND_MASK 0xc08
+#define PHB_LEM_FIR_OR_MASK 0xc10
+#define PHB_LEM_ERROR_MASK 0xc18
+#define PHB_LEM_ERROR_AND_MASK 0xc20
+#define PHB_LEM_ERROR_OR_MASK 0xc28
+#define PHB_LEM_ACTION0 0xc30
+#define PHB_LEM_ACTION1 0xc38
+#define PHB_LEM_WOF 0xc40
+#define PHB_ERR_STATUS 0xc80
+#define PHB_ERR1_STATUS 0xc88
+#define PHB_ERR_INJECT 0xc90
+#define PHB_ERR_LEM_ENABLE 0xc98
+#define PHB_ERR_IRQ_ENABLE 0xca0
+#define PHB_ERR_FREEZE_ENABLE 0xca8
+#define PHB_ERR_AIB_FENCE_ENABLE 0xcb0
+#define PHB_ERR_LOG_0 0xcc0
+#define PHB_ERR_LOG_1 0xcc8
+#define PHB_ERR_STATUS_MASK 0xcd0
+#define PHB_ERR1_STATUS_MASK 0xcd8
+
+#define PHB_TXE_ERR_STATUS 0xd00
+#define PHB_TXE_ERR1_STATUS 0xd08
+#define PHB_TXE_ERR_INJECT 0xd10
+#define PHB_TXE_ERR_LEM_ENABLE 0xd18
+#define PHB_TXE_ERR_IRQ_ENABLE 0xd20
+#define PHB_TXE_ERR_FREEZE_ENABLE 0xd28
+#define PHB_TXE_ERR_AIB_FENCE_ENABLE 0xd30
+#define PHB_TXE_ERR_LOG_0 0xd40
+#define PHB_TXE_ERR_LOG_1 0xd48
+#define PHB_TXE_ERR_STATUS_MASK 0xd50
+#define PHB_TXE_ERR1_STATUS_MASK 0xd58
+
+#define PHB_RXE_ARB_ERR_STATUS 0xd80
+#define PHB_RXE_ARB_ERR1_STATUS 0xd88
+#define PHB_RXE_ARB_ERR_INJECT 0xd90
+#define PHB_RXE_ARB_ERR_LEM_ENABLE 0xd98
+#define PHB_RXE_ARB_ERR_IRQ_ENABLE 0xda0
+#define PHB_RXE_ARB_ERR_FREEZE_ENABLE 0xda8
+#define PHB_RXE_ARB_ERR_AIB_FENCE_ENABLE 0xdb0
+#define PHB_RXE_ARB_ERR_LOG_0 0xdc0
+#define PHB_RXE_ARB_ERR_LOG_1 0xdc8
+#define PHB_RXE_ARB_ERR_STATUS_MASK 0xdd0
+#define PHB_RXE_ARB_ERR1_STATUS_MASK 0xdd8
+
+#define PHB_RXE_MRG_ERR_STATUS 0xe00
+#define PHB_RXE_MRG_ERR1_STATUS 0xe08
+#define PHB_RXE_MRG_ERR_INJECT 0xe10
+#define PHB_RXE_MRG_ERR_LEM_ENABLE 0xe18
+#define PHB_RXE_MRG_ERR_IRQ_ENABLE 0xe20
+#define PHB_RXE_MRG_ERR_FREEZE_ENABLE 0xe28
+#define PHB_RXE_MRG_ERR_AIB_FENCE_ENABLE 0xe30
+#define PHB_RXE_MRG_ERR_LOG_0 0xe40
+#define PHB_RXE_MRG_ERR_LOG_1 0xe48
+#define PHB_RXE_MRG_ERR_STATUS_MASK 0xe50
+#define PHB_RXE_MRG_ERR1_STATUS_MASK 0xe58
+
+#define PHB_RXE_TCE_ERR_STATUS 0xe80
+#define PHB_RXE_TCE_ERR1_STATUS 0xe88
+#define PHB_RXE_TCE_ERR_INJECT 0xe90
+#define PHB_RXE_TCE_ERR_LEM_ENABLE 0xe98
+#define PHB_RXE_TCE_ERR_IRQ_ENABLE 0xea0
+#define PHB_RXE_TCE_ERR_FREEZE_ENABLE 0xea8
+#define PHB_RXE_TCE_ERR_AIB_FENCE_ENABLE 0xeb0
+#define PHB_RXE_TCE_ERR_LOG_0 0xec0
+#define PHB_RXE_TCE_ERR_LOG_1 0xec8
+#define PHB_RXE_TCE_ERR_STATUS_MASK 0xed0
+#define PHB_RXE_TCE_ERR1_STATUS_MASK 0xed8
+
+/* Performance monitor & Debug registers */
+#define PHB_TRACE_CONTROL 0xf80
+#define PHB_PERFMON_CONFIG 0xf88
+#define PHB_PERFMON_CTR0 0xf90
+#define PHB_PERFMON_CTR1 0xf98
+#define PHB_PERFMON_CTR2 0xfa0
+#define PHB_PERFMON_CTR3 0xfa8
+
+/* Root complex config space memory mapped */
+#define PHB_RC_CONFIG_BASE 0x1000
+#define PHB_RC_CONFIG_SIZE 0x800
+
+/* PHB4 REGB registers */
+
+/* PBL core */
+#define PHB_PBL_CONTROL 0x1800
+#define PHB_PBL_TIMEOUT_CTRL 0x1810
+#define PHB_PBL_NPTAG_ENABLE 0x1820
+#define PHB_PBL_NBW_CMP_MASK 0x1830
+#define PHB_PBL_NBW_MASK_ENABLE PPC_BIT(63)
+#define PHB_PBL_SYS_LINK_INIT 0x1838
+#define PHB_PBL_BUF_STATUS 0x1840
+#define PHB_PBL_ERR_STATUS 0x1900
+#define PHB_PBL_ERR1_STATUS 0x1908
+#define PHB_PBL_ERR_INJECT 0x1910
+#define PHB_PBL_ERR_INF_ENABLE 0x1920
+#define PHB_PBL_ERR_ERC_ENABLE 0x1928
+#define PHB_PBL_ERR_FAT_ENABLE 0x1930
+#define PHB_PBL_ERR_LOG_0 0x1940
+#define PHB_PBL_ERR_LOG_1 0x1948
+#define PHB_PBL_ERR_STATUS_MASK 0x1950
+#define PHB_PBL_ERR1_STATUS_MASK 0x1958
+
+/* PCI-E stack */
+#define PHB_PCIE_SCR 0x1A00
+#define PHB_PCIE_SCR_SLOT_CAP PPC_BIT(15)
+#define PHB_PCIE_SCR_MAXLINKSPEED PPC_BITMASK(32, 35)
+
+
+#define PHB_PCIE_CRESET 0x1A10
+#define PHB_PCIE_CRESET_CFG_CORE PPC_BIT(0)
+#define PHB_PCIE_CRESET_TLDLP PPC_BIT(1)
+#define PHB_PCIE_CRESET_PBL PPC_BIT(2)
+#define PHB_PCIE_CRESET_PERST_N PPC_BIT(3)
+#define PHB_PCIE_CRESET_PIPE_N PPC_BIT(4)
+
+
+#define PHB_PCIE_HOTPLUG_STATUS 0x1A20
+#define PHB_PCIE_HPSTAT_PRESENCE PPC_BIT(10)
+
+#define PHB_PCIE_DLP_TRAIN_CTL 0x1A40
+#define PHB_PCIE_DLP_LINK_WIDTH PPC_BITMASK(30, 35)
+#define PHB_PCIE_DLP_LINK_SPEED PPC_BITMASK(36, 39)
+#define PHB_PCIE_DLP_LTSSM_TRC PPC_BITMASK(24, 27)
+#define PHB_PCIE_DLP_LTSSM_RESET 0
+#define PHB_PCIE_DLP_LTSSM_DETECT 1
+#define PHB_PCIE_DLP_LTSSM_POLLING 2
+#define PHB_PCIE_DLP_LTSSM_CONFIG 3
+#define PHB_PCIE_DLP_LTSSM_L0 4
+#define PHB_PCIE_DLP_LTSSM_REC 5
+#define PHB_PCIE_DLP_LTSSM_L1 6
+#define PHB_PCIE_DLP_LTSSM_L2 7
+#define PHB_PCIE_DLP_LTSSM_HOTRESET 8
+#define PHB_PCIE_DLP_LTSSM_DISABLED 9
+#define PHB_PCIE_DLP_LTSSM_LOOPBACK 10
+#define PHB_PCIE_DLP_TL_LINKACT PPC_BIT(23)
+#define PHB_PCIE_DLP_DL_PGRESET PPC_BIT(22)
+#define PHB_PCIE_DLP_TRAINING PPC_BIT(20)
+#define PHB_PCIE_DLP_INBAND_PRESENCE PPC_BIT(19)
+
+#define PHB_PCIE_DLP_CTL 0x1A78
+#define PHB_PCIE_DLP_CTL_BYPASS_PH2 PPC_BIT(4)
+#define PHB_PCIE_DLP_CTL_BYPASS_PH3 PPC_BIT(5)
+
+#define PHB_PCIE_DLP_TRWCTL 0x1A80
+#define PHB_PCIE_DLP_TRWCTL_EN PPC_BIT(0)
+
+#define PHB_PCIE_DLP_ERRLOG1 0x1AA0
+#define PHB_PCIE_DLP_ERRLOG2 0x1AA8
+#define PHB_PCIE_DLP_ERR_STATUS 0x1AB0
+#define PHB_PCIE_DLP_ERR_COUNTERS 0x1AB8
+
+#define PHB_PCIE_LANE_EQ_CNTL0 0x1AD0
+#define PHB_PCIE_LANE_EQ_CNTL1 0x1AD8
+#define PHB_PCIE_LANE_EQ_CNTL2 0x1AE0
+#define PHB_PCIE_LANE_EQ_CNTL3 0x1AE8
+#define PHB_PCIE_LANE_EQ_CNTL20 0x1AF0
+#define PHB_PCIE_LANE_EQ_CNTL21 0x1AF8
+#define PHB_PCIE_LANE_EQ_CNTL22 0x1B00 /* DD1 only */
+#define PHB_PCIE_LANE_EQ_CNTL23 0x1B08 /* DD1 only */
+#define PHB_PCIE_TRACE_CTRL 0x1B20
+#define PHB_PCIE_MISC_STRAP 0x1B30
+
+/* Error */
+#define PHB_REGB_ERR_STATUS 0x1C00
+#define PHB_REGB_ERR1_STATUS 0x1C08
+#define PHB_REGB_ERR_INJECT 0x1C10
+#define PHB_REGB_ERR_INF_ENABLE 0x1C20
+#define PHB_REGB_ERR_ERC_ENABLE 0x1C28
+#define PHB_REGB_ERR_FAT_ENABLE 0x1C30
+#define PHB_REGB_ERR_LOG_0 0x1C40
+#define PHB_REGB_ERR_LOG_1 0x1C48
+#define PHB_REGB_ERR_STATUS_MASK 0x1C50
+#define PHB_REGB_ERR1_STATUS_MASK 0x1C58
+
+/*
+ * IODA3 on-chip tables
+ */
+
+#define IODA3_TBL_LIST 1
+#define IODA3_TBL_MIST 2
+#define IODA3_TBL_RCAM 5
+#define IODA3_TBL_MRT 6
+#define IODA3_TBL_PESTA 7
+#define IODA3_TBL_PESTB 8
+#define IODA3_TBL_TVT 9
+#define IODA3_TBL_TCR 10
+#define IODA3_TBL_TDR 11
+#define IODA3_TBL_MBT 16
+#define IODA3_TBL_MDT 17
+#define IODA3_TBL_PEEV 20
+
+/* LIST */
+#define IODA3_LIST_P PPC_BIT(6)
+#define IODA3_LIST_Q PPC_BIT(7)
+#define IODA3_LIST_STATE PPC_BIT(14)
+
+/* MIST */
+#define IODA3_MIST_P3 PPC_BIT(48 + 0)
+#define IODA3_MIST_Q3 PPC_BIT(48 + 1)
+#define IODA3_MIST_PE3 PPC_BITMASK(48 + 4, 48 + 15)
+
+/* TVT */
+#define IODA3_TVT_TABLE_ADDR PPC_BITMASK(0, 47)
+#define IODA3_TVT_NUM_LEVELS PPC_BITMASK(48, 50)
+#define IODA3_TVE_1_LEVEL 0
+#define IODA3_TVE_2_LEVELS 1
+#define IODA3_TVE_3_LEVELS 2
+#define IODA3_TVE_4_LEVELS 3
+#define IODA3_TVE_5_LEVELS 4
+#define IODA3_TVT_TCE_TABLE_SIZE PPC_BITMASK(51, 55)
+#define IODA3_TVT_NON_TRANSLATE_50 PPC_BIT(56)
+#define IODA3_TVT_IO_PSIZE PPC_BITMASK(59, 63)
+
+/* PESTA */
+#define IODA3_PESTA_MMIO_FROZEN PPC_BIT(0)
+#define IODA3_PESTA_TRANS_TYPE PPC_BITMASK(5, 7)
+#define IODA3_PESTA_TRANS_TYPE_MMIOLOAD 0x4
+#define IODA3_PESTA_CA_CMPLT_TMT PPC_BIT(8)
+#define IODA3_PESTA_UR PPC_BIT(9)
+
+/* PESTB */
+#define IODA3_PESTB_DMA_STOPPED PPC_BIT(0)
+
+/* MDT */
+/* FIXME: check this field with Eric and add a B, C and D */
+#define IODA3_MDT_PE_A PPC_BITMASK(0, 15)
+#define IODA3_MDT_PE_B PPC_BITMASK(16, 31)
+#define IODA3_MDT_PE_C PPC_BITMASK(32, 47)
+#define IODA3_MDT_PE_D PPC_BITMASK(48, 63)
+
+/* MBT */
+#define IODA3_MBT0_ENABLE PPC_BIT(0)
+#define IODA3_MBT0_TYPE PPC_BIT(1)
+#define IODA3_MBT0_TYPE_M32 IODA3_MBT0_TYPE
+#define IODA3_MBT0_TYPE_M64 0
+#define IODA3_MBT0_MODE PPC_BITMASK(2, 3)
+#define IODA3_MBT0_MODE_PE_SEG 0
+#define IODA3_MBT0_MODE_MDT 1
+#define IODA3_MBT0_MODE_SINGLE_PE 2
+#define IODA3_MBT0_SEG_DIV PPC_BITMASK(4, 5)
+#define IODA3_MBT0_SEG_DIV_MAX 0
+#define IODA3_MBT0_SEG_DIV_128 1
+#define IODA3_MBT0_SEG_DIV_64 2
+#define IODA3_MBT0_SEG_DIV_8 3
+#define IODA3_MBT0_MDT_COLUMN PPC_BITMASK(4, 5)
+#define IODA3_MBT0_BASE_ADDR PPC_BITMASK(8, 51)
+
+#define IODA3_MBT1_ENABLE PPC_BIT(0)
+#define IODA3_MBT1_MASK PPC_BITMASK(8, 51)
+#define IODA3_MBT1_SEG_BASE PPC_BITMASK(55, 63)
+#define IODA3_MBT1_SINGLE_PE_NUM PPC_BITMASK(55, 63)
+
+/*
+ * IODA3 in-memory tables
+ */
+
+/*
+ * PEST
+ *
+ * 2x8 bytes entries, PEST0 and PEST1
+ */
+
+#define IODA3_PEST0_MMIO_CAUSE PPC_BIT(2)
+#define IODA3_PEST0_CFG_READ PPC_BIT(3)
+#define IODA3_PEST0_CFG_WRITE PPC_BIT(4)
+#define IODA3_PEST0_TTYPE PPC_BITMASK(5, 7)
+#define PEST_TTYPE_DMA_WRITE 0
+#define PEST_TTYPE_MSI 1
+#define PEST_TTYPE_DMA_READ 2
+#define PEST_TTYPE_DMA_READ_RESP 3
+#define PEST_TTYPE_MMIO_LOAD 4
+#define PEST_TTYPE_MMIO_STORE 5
+#define PEST_TTYPE_OTHER 7
+#define IODA3_PEST0_CA_RETURN PPC_BIT(8)
+#define IODA3_PEST0_UR_RETURN PPC_BIT(9)
+#define IODA3_PEST0_PCIE_NONFATAL PPC_BIT(10)
+#define IODA3_PEST0_PCIE_FATAL PPC_BIT(11)
+#define IODA3_PEST0_PARITY_UE PPC_BIT(13)
+#define IODA3_PEST0_PCIE_CORRECTABLE PPC_BIT(14)
+#define IODA3_PEST0_PCIE_INTERRUPT PPC_BIT(15)
+#define IODA3_PEST0_MMIO_XLATE PPC_BIT(16)
+#define IODA3_PEST0_IODA3_ERROR PPC_BIT(16) /* Same bit as MMIO xlate */
+#define IODA3_PEST0_TCE_PAGE_FAULT PPC_BIT(18)
+#define IODA3_PEST0_TCE_ACCESS_FAULT PPC_BIT(19)
+#define IODA3_PEST0_DMA_RESP_TIMEOUT PPC_BIT(20)
+#define IODA3_PEST0_AIB_SIZE_INVALID PPC_BIT(21)
+#define IODA3_PEST0_LEM_BIT PPC_BITMASK(26, 31)
+#define IODA3_PEST0_RID PPC_BITMASK(32, 47)
+#define IODA3_PEST0_MSI_DATA PPC_BITMASK(48, 63)
+
+#define IODA3_PEST1_FAIL_ADDR PPC_BITMASK(3, 63)
+
+
+#endif /* PCI_HOST_PNV_PHB4_REGS_H */
diff --git a/include/hw/pci/pcie_port.h b/include/hw/pci/pcie_port.h
index 7515430087..4b3d254b08 100644
--- a/include/hw/pci/pcie_port.h
+++ b/include/hw/pci/pcie_port.h
@@ -72,6 +72,7 @@ void pcie_chassis_del_slot(PCIESlot *s);
typedef struct PCIERootPortClass {
PCIDeviceClass parent_class;
DeviceRealize parent_realize;
+ DeviceReset parent_reset;
uint8_t (*aer_vector)(const PCIDevice *dev);
int (*interrupts_init)(PCIDevice *dev, Error **errp);
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index f225f2f6bf..805f9058f5 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -30,6 +30,7 @@
#include "hw/ppc/pnv_homer.h"
#include "hw/ppc/pnv_xive.h"
#include "hw/ppc/pnv_core.h"
+#include "hw/pci-host/pnv_phb4.h"
#define TYPE_PNV_CHIP "pnv-chip"
#define PNV_CHIP(obj) OBJECT_CHECK(PnvChip, (obj), TYPE_PNV_CHIP)
@@ -52,6 +53,8 @@ typedef struct PnvChip {
uint64_t cores_mask;
PnvCore **cores;
+ uint32_t num_phbs;
+
MemoryRegion xscom_mmio;
MemoryRegion xscom;
AddressSpace xscom_as;
@@ -93,6 +96,9 @@ typedef struct Pnv9Chip {
uint32_t nr_quads;
PnvQuad *quads;
+
+#define PNV9_CHIP_MAX_PEC 3
+ PnvPhb4PecState pecs[PNV9_CHIP_MAX_PEC];
} Pnv9Chip;
/*
@@ -120,6 +126,7 @@ typedef struct PnvChipClass {
/*< public >*/
uint64_t chip_cfam_id;
uint64_t cores_mask;
+ uint32_t num_phbs;
DeviceRealize parent_realize;
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index f74c81a980..0fc57b0367 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -94,6 +94,17 @@ typedef struct PnvXScomInterfaceClass {
#define PNV9_XSCOM_XIVE_BASE 0x5013000
#define PNV9_XSCOM_XIVE_SIZE 0x300
+#define PNV9_XSCOM_PEC_NEST_BASE 0x4010c00
+#define PNV9_XSCOM_PEC_NEST_SIZE 0x100
+
+#define PNV9_XSCOM_PEC_PCI_BASE 0xd010800
+#define PNV9_XSCOM_PEC_PCI_SIZE 0x200
+
+/* XSCOM PCI "pass-through" window to PHB SCOM */
+#define PNV9_XSCOM_PEC_PCI_STK0 0x100
+#define PNV9_XSCOM_PEC_PCI_STK1 0x140
+#define PNV9_XSCOM_PEC_PCI_STK2 0x180
+
/*
* Layout of the XSCOM PCB addresses (POWER 10)
*/
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 20/35] ppc/pnv: Add models for POWER8 PHB3 PCIe Host bridge
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (18 preceding siblings ...)
2020-02-03 6:11 ` [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 21/35] ppc/pnv: change the PowerNV machine devices to be non user creatable David Gibson
` (15 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater,
David Gibson
From: Cédric Le Goater <clg@kaod.org>
This is a model of the PCIe Host Bridge (PHB3) found on a POWER8
processor. It includes the PowerBus logic interface (PBCQ), IOMMU
support, a single PCIe Gen.3 Root Complex, and support for MSI and LSI
interrupt sources as found on a POWER8 system using the XICS interrupt
controller.
The POWER8 processor comes in different flavors: Venice, Murano,
Naple, each having a different number of PHBs. To make things simpler,
the models provides 3 PHB3 per chip. Some platforms, like the
Firestone, can also couple PHBs on the first chip to provide more
bandwidth but this is too specific to model in QEMU.
XICS requires some adjustment to support the PHB3 MSI. The changes are
provided here but they could be decoupled in prereq patches.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200127144506.11132-3-clg@kaod.org>
[dwg: Use device_class_set_props()]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/intc/xics.c | 14 +-
hw/pci-host/Makefile.objs | 1 +
hw/pci-host/pnv_phb3.c | 1195 +++++++++++++++++++++++++++
hw/pci-host/pnv_phb3_msi.c | 349 ++++++++
hw/pci-host/pnv_phb3_pbcq.c | 357 ++++++++
hw/ppc/pnv.c | 69 +-
include/hw/pci-host/pnv_phb3.h | 164 ++++
include/hw/pci-host/pnv_phb3_regs.h | 450 ++++++++++
include/hw/ppc/pnv.h | 4 +
include/hw/ppc/pnv_xscom.h | 9 +
include/hw/ppc/xics.h | 5 +
11 files changed, 2614 insertions(+), 3 deletions(-)
create mode 100644 hw/pci-host/pnv_phb3.c
create mode 100644 hw/pci-host/pnv_phb3_msi.c
create mode 100644 hw/pci-host/pnv_phb3_pbcq.c
create mode 100644 include/hw/pci-host/pnv_phb3.h
create mode 100644 include/hw/pci-host/pnv_phb3_regs.h
diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index 785b607528..c5d507e707 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -217,7 +217,7 @@ void icp_eoi(ICPState *icp, uint32_t xirr)
}
}
-static void icp_irq(ICSState *ics, int server, int nr, uint8_t priority)
+void icp_irq(ICSState *ics, int server, int nr, uint8_t priority)
{
ICPState *icp = xics_icp_get(ics->xics, server);
@@ -512,8 +512,14 @@ void ics_write_xive(ICSState *ics, int srcno, int server,
static void ics_reject(ICSState *ics, uint32_t nr)
{
+ ICSStateClass *isc = ICS_GET_CLASS(ics);
ICSIRQState *irq = ics->irqs + nr - ics->offset;
+ if (isc->reject) {
+ isc->reject(ics, nr);
+ return;
+ }
+
trace_xics_ics_reject(nr, nr - ics->offset);
if (irq->flags & XICS_FLAGS_IRQ_MSI) {
irq->status |= XICS_STATUS_REJECTED;
@@ -524,8 +530,14 @@ static void ics_reject(ICSState *ics, uint32_t nr)
void ics_resend(ICSState *ics)
{
+ ICSStateClass *isc = ICS_GET_CLASS(ics);
int i;
+ if (isc->resend) {
+ isc->resend(ics);
+ return;
+ }
+
for (i = 0; i < ics->nr_irqs; i++) {
/* FIXME: filter by server#? */
if (ics->irqs[i].flags & XICS_FLAGS_IRQ_LSI) {
diff --git a/hw/pci-host/Makefile.objs b/hw/pci-host/Makefile.objs
index 8a296e2f93..8c87e8494d 100644
--- a/hw/pci-host/Makefile.objs
+++ b/hw/pci-host/Makefile.objs
@@ -21,3 +21,4 @@ common-obj-$(CONFIG_PCI_EXPRESS_XILINX) += xilinx-pcie.o
common-obj-$(CONFIG_PCI_EXPRESS_DESIGNWARE) += designware.o
obj-$(CONFIG_POWERNV) += pnv_phb4.o pnv_phb4_pec.o
+obj-$(CONFIG_POWERNV) += pnv_phb3.o pnv_phb3_msi.o pnv_phb3_pbcq.o
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
new file mode 100644
index 0000000000..f03399c406
--- /dev/null
+++ b/hw/pci-host/pnv_phb3.c
@@ -0,0 +1,1195 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/ppc/pnv.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+
+#define phb3_error(phb, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \
+ (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__)
+
+static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb)
+{
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3];
+ uint8_t bus, devfn;
+
+ if (!(addr >> 63)) {
+ return NULL;
+ }
+ bus = (addr >> 52) & 0xff;
+ devfn = (addr >> 44) & 0xff;
+
+ return pci_find_device(pci->bus, bus, devfn);
+}
+
+/*
+ * The CONFIG_DATA register expects little endian accesses, but as the
+ * region is big endian, we have to swap the value.
+ */
+static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off,
+ unsigned size, uint64_t val)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+
+ pdev = pnv_phb3_find_cfg_dev(phb);
+ if (!pdev) {
+ return;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return;
+ }
+ switch (size) {
+ case 1:
+ break;
+ case 2:
+ val = bswap16(val);
+ break;
+ case 4:
+ val = bswap32(val);
+ break;
+ default:
+ g_assert_not_reached();
+ }
+ pci_host_config_write_common(pdev, cfg_addr, limit, val, size);
+}
+
+static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off,
+ unsigned size)
+{
+ uint32_t cfg_addr, limit;
+ PCIDevice *pdev;
+ uint64_t val;
+
+ pdev = pnv_phb3_find_cfg_dev(phb);
+ if (!pdev) {
+ return ~0ull;
+ }
+ cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc;
+ cfg_addr |= off;
+ limit = pci_config_size(pdev);
+ if (limit <= cfg_addr) {
+ /*
+ * conventional pci device can be behind pcie-to-pci bridge.
+ * 256 <= addr < 4K has no effects.
+ */
+ return ~0ull;
+ }
+ val = pci_host_config_read_common(pdev, cfg_addr, limit, size);
+ switch (size) {
+ case 1:
+ return val;
+ case 2:
+ return bswap16(val);
+ case 4:
+ return bswap32(val);
+ default:
+ g_assert_not_reached();
+ }
+}
+
+static void pnv_phb3_check_m32(PnvPHB3 *phb)
+{
+ uint64_t base, start, size;
+ MemoryRegion *parent;
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ if (memory_region_is_mapped(&phb->mr_m32)) {
+ memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32);
+ }
+
+ if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = phb->regs[PHB_M32_BASE_ADDR >> 3];
+ start = phb->regs[PHB_M32_START_ADDR >> 3];
+ size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1;
+
+ /* Check if it matches an enabled MMIO region in the PBCQ */
+ if (memory_region_is_mapped(&pbcq->mmbar0) &&
+ base >= pbcq->mmio0_base &&
+ (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
+ parent = &pbcq->mmbar0;
+ base -= pbcq->mmio0_base;
+ } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
+ base >= pbcq->mmio1_base &&
+ (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
+ parent = &pbcq->mmbar1;
+ base -= pbcq->mmio1_base;
+ } else {
+ return;
+ }
+
+ /* Create alias */
+ memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32",
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_m32);
+}
+
+static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index)
+{
+ uint64_t base, start, size, m64;
+ MemoryRegion *parent;
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ if (memory_region_is_mapped(&phb->mr_m64[index])) {
+ /* Should we destroy it in RCU friendly way... ? */
+ memory_region_del_subregion(phb->mr_m64[index].container,
+ &phb->mr_m64[index]);
+ }
+
+ /* Get table entry */
+ m64 = phb->ioda_M64BT[index];
+
+ if (!(m64 & IODA2_M64BT_ENABLE)) {
+ return;
+ }
+
+ /* Grab geometry from registers */
+ base = GETFIELD(IODA2_M64BT_BASE, m64) << 20;
+ if (m64 & IODA2_M64BT_SINGLE_PE) {
+ base &= ~0x1ffffffull;
+ }
+ size = GETFIELD(IODA2_M64BT_MASK, m64) << 20;
+ size |= 0xfffc000000000000ull;
+ size = ~size + 1;
+ start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]);
+
+ /* Check if it matches an enabled MMIO region in the PBCQ */
+ if (memory_region_is_mapped(&pbcq->mmbar0) &&
+ base >= pbcq->mmio0_base &&
+ (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) {
+ parent = &pbcq->mmbar0;
+ base -= pbcq->mmio0_base;
+ } else if (memory_region_is_mapped(&pbcq->mmbar1) &&
+ base >= pbcq->mmio1_base &&
+ (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) {
+ parent = &pbcq->mmbar1;
+ base -= pbcq->mmio1_base;
+ } else {
+ return;
+ }
+
+ /* Create alias */
+ memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64",
+ &phb->pci_mmio, start, size);
+ memory_region_add_subregion(parent, base, &phb->mr_m64[index]);
+}
+
+static void pnv_phb3_check_all_m64s(PnvPHB3 *phb)
+{
+ uint64_t i;
+
+ for (i = 0; i < PNV_PHB3_NUM_M64; i++) {
+ pnv_phb3_check_m64(phb, i);
+ }
+}
+
+static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val)
+{
+ uint8_t server, prio;
+
+ phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER |
+ IODA2_LXIVT_PRIORITY |
+ IODA2_LXIVT_NODE_ID);
+ server = GETFIELD(IODA2_LXIVT_SERVER, val);
+ prio = GETFIELD(IODA2_LXIVT_PRIORITY, val);
+
+ /*
+ * The low order 2 bits are the link pointer (Type II interrupts).
+ * Shift back to get a valid IRQ server.
+ */
+ server >>= 2;
+
+ ics_write_xive(&phb->lsis, idx, server, prio, prio);
+}
+
+static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb,
+ unsigned *out_table, unsigned *out_idx)
+{
+ uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3];
+ unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg);
+ unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg);
+ unsigned int mask;
+ uint64_t *tptr = NULL;
+
+ switch (table) {
+ case IODA2_TBL_LIST:
+ tptr = phb->ioda_LIST;
+ mask = 7;
+ break;
+ case IODA2_TBL_LXIVT:
+ tptr = phb->ioda_LXIVT;
+ mask = 7;
+ break;
+ case IODA2_TBL_IVC_CAM:
+ case IODA2_TBL_RBA:
+ mask = 31;
+ break;
+ case IODA2_TBL_RCAM:
+ mask = 63;
+ break;
+ case IODA2_TBL_MRT:
+ mask = 7;
+ break;
+ case IODA2_TBL_PESTA:
+ case IODA2_TBL_PESTB:
+ mask = 255;
+ break;
+ case IODA2_TBL_TVT:
+ tptr = phb->ioda_TVT;
+ mask = 511;
+ break;
+ case IODA2_TBL_TCAM:
+ case IODA2_TBL_TDR:
+ mask = 63;
+ break;
+ case IODA2_TBL_M64BT:
+ tptr = phb->ioda_M64BT;
+ mask = 15;
+ break;
+ case IODA2_TBL_M32DT:
+ tptr = phb->ioda_MDT;
+ mask = 255;
+ break;
+ case IODA2_TBL_PEEV:
+ tptr = phb->ioda_PEEV;
+ mask = 3;
+ break;
+ default:
+ phb3_error(phb, "invalid IODA table %d", table);
+ return NULL;
+ }
+ index &= mask;
+ if (out_idx) {
+ *out_idx = index;
+ }
+ if (out_table) {
+ *out_table = table;
+ }
+ if (tptr) {
+ tptr += index;
+ }
+ if (adreg & PHB_IODA_AD_AUTOINC) {
+ index = (index + 1) & mask;
+ adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index);
+ }
+ phb->regs[PHB_IODA_ADDR >> 3] = adreg;
+ return tptr;
+}
+
+static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb)
+{
+ unsigned table;
+ uint64_t *tptr;
+
+ tptr = pnv_phb3_ioda_access(phb, &table, NULL);
+ if (!tptr) {
+ /* Return 0 on unsupported tables, not ff's */
+ return 0;
+ }
+ return *tptr;
+}
+
+static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val)
+{
+ unsigned table, idx;
+ uint64_t *tptr;
+
+ tptr = pnv_phb3_ioda_access(phb, &table, &idx);
+ if (!tptr) {
+ return;
+ }
+
+ /* Handle side effects */
+ switch (table) {
+ case IODA2_TBL_LXIVT:
+ pnv_phb3_lxivt_write(phb, idx, val);
+ break;
+ case IODA2_TBL_M64BT:
+ *tptr = val;
+ pnv_phb3_check_m64(phb, idx);
+ break;
+ default:
+ *tptr = val;
+ }
+}
+
+/*
+ * This is called whenever the PHB LSI, MSI source ID register or
+ * the PBCQ irq filters are written.
+ */
+void pnv_phb3_remap_irqs(PnvPHB3 *phb)
+{
+ ICSState *ics = &phb->lsis;
+ uint32_t local, global, count, mask, comp;
+ uint64_t baren;
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ /*
+ * First check if we are enabled. Unlike real HW we don't separate
+ * TX and RX so we enable if both are set
+ */
+ baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
+ if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) ||
+ !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) {
+ ics->offset = 0;
+ return;
+ }
+
+ /* Grab local LSI source ID */
+ local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3;
+
+ /* Grab global one and compare */
+ global = GETFIELD(PBCQ_NEST_LSI_SRC,
+ pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3;
+ if (global != local) {
+ /*
+ * This happens during initialization, let's come back when we
+ * are properly configured
+ */
+ ics->offset = 0;
+ return;
+ }
+
+ /* Get the base on the powerbus */
+ comp = GETFIELD(PBCQ_NEST_IRSN_COMP,
+ pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]);
+ mask = GETFIELD(PBCQ_NEST_IRSN_COMP,
+ pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]);
+ count = ((~mask) + 1) & 0x7ffff;
+ phb->total_irq = count;
+
+ /* Sanity checks */
+ if ((global + PNV_PHB3_NUM_LSI) > count) {
+ phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global,
+ count);
+ }
+
+ if (count > 2048) {
+ phb3_error(phb, "More interrupts than supported: %d", count);
+ }
+
+ if ((comp & mask) != comp) {
+ phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x",
+ comp, mask);
+ comp &= mask;
+ }
+ /* Setup LSI offset */
+ ics->offset = comp + global;
+
+ /* Setup MSI offset */
+ pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI);
+}
+
+static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val)
+{
+ /* Sanitize content */
+ val &= PHB_LSI_SRC_ID;
+ phb->regs[PHB_LSI_SOURCE_ID >> 3] = val;
+ pnv_phb3_remap_irqs(phb);
+}
+
+static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val)
+{
+ PnvPhb3DMASpace *ds;
+
+ /* Always invalidate all for now ... */
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ ds->pe_num = PHB_INVALID_PE;
+ }
+}
+
+
+static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds)
+{
+ uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
+
+ if (cfg & PHB_PHB3C_32BIT_MSI_EN) {
+ if (!memory_region_is_mapped(&ds->msi32_mr)) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ 0xffff0000, &ds->msi32_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(&ds->msi32_mr)) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi32_mr);
+ }
+ }
+
+ if (cfg & PHB_PHB3C_64BIT_MSI_EN) {
+ if (!memory_region_is_mapped(&ds->msi64_mr)) {
+ memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr),
+ (1ull << 60), &ds->msi64_mr);
+ }
+ } else {
+ if (memory_region_is_mapped(&ds->msi64_mr)) {
+ memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr),
+ &ds->msi64_mr);
+ }
+ }
+}
+
+static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb)
+{
+ PnvPhb3DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ pnv_phb3_update_msi_regions(ds);
+ }
+}
+
+void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size)
+{
+ PnvPHB3 *phb = opaque;
+ bool changed;
+
+ /* Special case configuration data */
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ pnv_phb3_config_write(phb, off & 0x3, size, val);
+ return;
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return;
+ }
+
+ /* Handle masking & filtering */
+ switch (off) {
+ case PHB_M64_UPPER_BITS:
+ val &= 0xfffc000000000000ull;
+ break;
+ case PHB_Q_DMA_R:
+ /*
+ * This is enough logic to make SW happy but we aren't actually
+ * quiescing the DMAs
+ */
+ if (val & PHB_Q_DMA_R_AUTORESET) {
+ val = 0;
+ } else {
+ val &= PHB_Q_DMA_R_QUIESCE_DMA;
+ }
+ break;
+ /* LEM stuff */
+ case PHB_LEM_FIR_AND_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val;
+ return;
+ case PHB_LEM_FIR_OR_MASK:
+ phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val;
+ return;
+ case PHB_LEM_ERROR_AND_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val;
+ return;
+ case PHB_LEM_ERROR_OR_MASK:
+ phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val;
+ return;
+ case PHB_LEM_WOF:
+ val = 0;
+ break;
+ }
+
+ /* Record whether it changed */
+ changed = phb->regs[off >> 3] != val;
+
+ /* Store in register cache first */
+ phb->regs[off >> 3] = val;
+
+ /* Handle side effects */
+ switch (off) {
+ case PHB_PHB3_CONFIG:
+ if (changed) {
+ pnv_phb3_update_all_msi_regions(phb);
+ }
+ /* fall through */
+ case PHB_M32_BASE_ADDR:
+ case PHB_M32_BASE_MASK:
+ case PHB_M32_START_ADDR:
+ if (changed) {
+ pnv_phb3_check_m32(phb);
+ }
+ break;
+ case PHB_M64_UPPER_BITS:
+ if (changed) {
+ pnv_phb3_check_all_m64s(phb);
+ }
+ break;
+ case PHB_LSI_SOURCE_ID:
+ if (changed) {
+ pnv_phb3_lsi_src_id_write(phb, val);
+ }
+ break;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ pnv_phb3_ioda_write(phb, val);
+ break;
+
+ /* RTC invalidation */
+ case PHB_RTC_INVALIDATE:
+ pnv_phb3_rtc_invalidate(phb, val);
+ break;
+
+ /* FFI request */
+ case PHB_FFI_REQUEST:
+ pnv_phb3_msi_ffi(&phb->msis, val);
+ break;
+
+ /* Silent simple writes */
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_RBA_BAR:
+ case PHB_IVT_BAR:
+ case PHB_FFI_LOCK:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+}
+
+uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size)
+{
+ PnvPHB3 *phb = opaque;
+ PCIHostState *pci = PCI_HOST_BRIDGE(phb);
+ uint64_t val;
+
+ if ((off & 0xfffc) == PHB_CONFIG_DATA) {
+ return pnv_phb3_config_read(phb, off & 0x3, size);
+ }
+
+ /* Other registers are 64-bit only */
+ if (size != 8 || off & 0x7) {
+ phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d",
+ off, size);
+ return ~0ull;
+ }
+
+ /* Default read from cache */
+ val = phb->regs[off >> 3];
+
+ switch (off) {
+ /* Simulate venice DD2.0 */
+ case PHB_VERSION:
+ return 0x000000a300000005ull;
+ case PHB_PCIE_SYSTEM_CONFIG:
+ return 0x441100fc30000000;
+
+ /* IODA table accesses */
+ case PHB_IODA_DATA0:
+ return pnv_phb3_ioda_read(phb);
+
+ /* Link training always appears trained */
+ case PHB_PCIE_DLP_TRAIN_CTL:
+ if (!pci_find_device(pci->bus, 1, 0)) {
+ return 0;
+ }
+ return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT;
+
+ /* FFI Lock */
+ case PHB_FFI_LOCK:
+ /* Set lock and return previous value */
+ phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE;
+ return val;
+
+ /* DMA read sync: make it look like it's complete */
+ case PHB_DMARD_SYNC:
+ return PHB_DMARD_SYNC_COMPLETE;
+
+ /* Silent simple reads */
+ case PHB_PHB3_CONFIG:
+ case PHB_M32_BASE_ADDR:
+ case PHB_M32_BASE_MASK:
+ case PHB_M32_START_ADDR:
+ case PHB_CONFIG_ADDRESS:
+ case PHB_IODA_ADDR:
+ case PHB_RTC_INVALIDATE:
+ case PHB_TCE_KILL:
+ case PHB_TCE_SPEC_CTL:
+ case PHB_PEST_BAR:
+ case PHB_PELTV_BAR:
+ case PHB_RTT_BAR:
+ case PHB_RBA_BAR:
+ case PHB_IVT_BAR:
+ case PHB_M64_UPPER_BITS:
+ case PHB_LEM_FIR_ACCUM:
+ case PHB_LEM_ERROR_MASK:
+ case PHB_LEM_ACTION0:
+ case PHB_LEM_ACTION1:
+ break;
+
+ /* Noise on anything else */
+ default:
+ qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n",
+ off, val);
+ }
+ return val;
+}
+
+static const MemoryRegionOps pnv_phb3_reg_ops = {
+ .read = pnv_phb3_reg_read,
+ .write = pnv_phb3_reg_write,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+ /* Check that out properly ... */
+ return irq_num & 3;
+}
+
+static void pnv_phb3_set_irq(void *opaque, int irq_num, int level)
+{
+ PnvPHB3 *phb = opaque;
+
+ /* LSI only ... */
+ if (irq_num > 3) {
+ phb3_error(phb, "Unknown IRQ to set %d", irq_num);
+ }
+ qemu_set_irq(phb->qirqs[irq_num], level);
+}
+
+static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds)
+{
+ uint64_t rtt, addr;
+ uint16_t rte;
+ int bus_num;
+
+ /* Already resolved ? */
+ if (ds->pe_num != PHB_INVALID_PE) {
+ return true;
+ }
+
+ /* We need to lookup the RTT */
+ rtt = ds->phb->regs[PHB_RTT_BAR >> 3];
+ if (!(rtt & PHB_RTT_BAR_ENABLE)) {
+ phb3_error(ds->phb, "DMA with RTT BAR disabled !");
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+
+ /* Read RTE */
+ bus_num = pci_bus_num(ds->bus);
+ addr = rtt & PHB_RTT_BASE_ADDRESS_MASK;
+ addr += 2 * ((bus_num << 8) | ds->devfn);
+ if (dma_memory_read(&address_space_memory, addr, &rte, sizeof(rte))) {
+ phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr);
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+ rte = be16_to_cpu(rte);
+
+ /* Fail upon reading of invalid PE# */
+ if (rte >= PNV_PHB3_NUM_PE) {
+ phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte);
+ /* Set error bits ? fence ? ... */
+ return false;
+ }
+ ds->pe_num = rte;
+ return true;
+}
+
+static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr,
+ bool is_write, uint64_t tve,
+ IOMMUTLBEntry *tlb)
+{
+ uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve);
+ int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve);
+ uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve);
+ uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve);
+ PnvPHB3 *phb = ds->phb;
+
+ /* Invalid levels */
+ if (lev > 4) {
+ phb3_error(phb, "Invalid #levels in TVE %d", lev);
+ return;
+ }
+
+ /* IO Page Size of 0 means untranslated, else use TCEs */
+ if (tps == 0) {
+ /*
+ * We only support non-translate in top window.
+ *
+ * TODO: Venice/Murano support it on bottom window above 4G and
+ * Naples suports it on everything
+ */
+ if (!(tve & PPC_BIT(51))) {
+ phb3_error(phb, "xlate for invalid non-translate TVE");
+ return;
+ }
+ /* TODO: Handle boundaries */
+
+ /* Use 4k pages like q35 ... for now */
+ tlb->iova = addr & 0xfffffffffffff000ull;
+ tlb->translated_addr = addr & 0x0003fffffffff000ull;
+ tlb->addr_mask = 0xfffull;
+ tlb->perm = IOMMU_RW;
+ } else {
+ uint32_t tce_shift, tbl_shift, sh;
+ uint64_t base, taddr, tce, tce_mask;
+
+ /* TVE disabled ? */
+ if (tts == 0) {
+ phb3_error(phb, "xlate for invalid translated TVE");
+ return;
+ }
+
+ /* Address bits per bottom level TCE entry */
+ tce_shift = tps + 11;
+
+ /* Address bits per table level */
+ tbl_shift = tts + 8;
+
+ /* Top level table base address */
+ base = tta << 12;
+
+ /* Total shift to first level */
+ sh = tbl_shift * lev + tce_shift;
+
+ /* TODO: Multi-level untested */
+ while ((lev--) >= 0) {
+ /* Grab the TCE address */
+ taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3);
+ if (dma_memory_read(&address_space_memory, taddr, &tce,
+ sizeof(tce))) {
+ phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr);
+ return;
+ }
+ tce = be64_to_cpu(tce);
+
+ /* Check permission for indirect TCE */
+ if ((lev >= 0) && !(tce & 3)) {
+ phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr);
+ phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ return;
+ }
+ sh -= tbl_shift;
+ base = tce & ~0xfffull;
+ }
+
+ /* We exit the loop with TCE being the final TCE */
+ tce_mask = ~((1ull << tce_shift) - 1);
+ tlb->iova = addr & tce_mask;
+ tlb->translated_addr = tce & tce_mask;
+ tlb->addr_mask = ~tce_mask;
+ tlb->perm = tce & 3;
+ if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) {
+ phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr);
+ phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr,
+ is_write ? 'W' : 'R', tve);
+ phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d",
+ tta, lev, tts, tps);
+ }
+ }
+}
+
+static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu,
+ hwaddr addr,
+ IOMMUAccessFlags flag,
+ int iommu_idx)
+{
+ PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr);
+ int tve_sel;
+ uint64_t tve, cfg;
+ IOMMUTLBEntry ret = {
+ .target_as = &address_space_memory,
+ .iova = addr,
+ .translated_addr = 0,
+ .addr_mask = ~(hwaddr)0,
+ .perm = IOMMU_NONE,
+ };
+ PnvPHB3 *phb = ds->phb;
+
+ /* Resolve PE# */
+ if (!pnv_phb3_resolve_pe(ds)) {
+ phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return ret;
+ }
+
+ /* Check top bits */
+ switch (addr >> 60) {
+ case 00:
+ /* DMA or 32-bit MSI ? */
+ cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3];
+ if ((cfg & PHB_PHB3C_32BIT_MSI_EN) &&
+ ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) {
+ phb3_error(phb, "xlate on 32-bit MSI region");
+ return ret;
+ }
+ /* Choose TVE XXX Use PHB3 Control Register */
+ tve_sel = (addr >> 59) & 1;
+ tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel];
+ pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret);
+ break;
+ case 01:
+ phb3_error(phb, "xlate on 64-bit MSI region");
+ break;
+ default:
+ phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr);
+ }
+ return ret;
+}
+
+#define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region"
+#define PNV_PHB3_IOMMU_MEMORY_REGION(obj) \
+ OBJECT_CHECK(IOMMUMemoryRegion, (obj), TYPE_PNV_PHB3_IOMMU_MEMORY_REGION)
+
+static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass,
+ void *data)
+{
+ IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+
+ imrc->translate = pnv_phb3_translate_iommu;
+}
+
+static const TypeInfo pnv_phb3_iommu_memory_region_info = {
+ .parent = TYPE_IOMMU_MEMORY_REGION,
+ .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
+ .class_init = pnv_phb3_iommu_memory_region_class_init,
+};
+
+/*
+ * MSI/MSIX memory region implementation.
+ * The handler handles both MSI and MSIX.
+ */
+static void pnv_phb3_msi_write(void *opaque, hwaddr addr,
+ uint64_t data, unsigned size)
+{
+ PnvPhb3DMASpace *ds = opaque;
+
+ /* Resolve PE# */
+ if (!pnv_phb3_resolve_pe(ds)) {
+ phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x",
+ ds->bus, pci_bus_num(ds->bus), ds->devfn);
+ return;
+ }
+
+ pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num);
+}
+
+/* There is no .read as the read result is undefined by PCI spec */
+static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size)
+{
+ PnvPhb3DMASpace *ds = opaque;
+
+ phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr);
+ return -1;
+}
+
+static const MemoryRegionOps pnv_phb3_msi_ops = {
+ .read = pnv_phb3_msi_read,
+ .write = pnv_phb3_msi_write,
+ .endianness = DEVICE_LITTLE_ENDIAN
+};
+
+static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ PnvPHB3 *phb = opaque;
+ PnvPhb3DMASpace *ds;
+
+ QLIST_FOREACH(ds, &phb->dma_spaces, list) {
+ if (ds->bus == bus && ds->devfn == devfn) {
+ break;
+ }
+ }
+
+ if (ds == NULL) {
+ ds = g_malloc0(sizeof(PnvPhb3DMASpace));
+ ds->bus = bus;
+ ds->devfn = devfn;
+ ds->pe_num = PHB_INVALID_PE;
+ ds->phb = phb;
+ memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr),
+ TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
+ OBJECT(phb), "phb3_iommu", UINT64_MAX);
+ address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr),
+ "phb3_iommu");
+ memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops,
+ ds, "msi32", 0x10000);
+ memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops,
+ ds, "msi64", 0x100000);
+ pnv_phb3_update_msi_regions(ds);
+
+ QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list);
+ }
+ return &ds->dma_as;
+}
+
+static void pnv_phb3_instance_init(Object *obj)
+{
+ PnvPHB3 *phb = PNV_PHB3(obj);
+
+ QLIST_INIT(&phb->dma_spaces);
+
+ /* LSI sources */
+ object_initialize_child(obj, "lsi", &phb->lsis, sizeof(phb->lsis),
+ TYPE_ICS, &error_abort, NULL);
+
+ /* Default init ... will be fixed by HW inits */
+ phb->lsis.offset = 0;
+
+ /* MSI sources */
+ object_initialize_child(obj, "msi", &phb->msis, sizeof(phb->msis),
+ TYPE_PHB3_MSI, &error_abort, NULL);
+
+ /* Power Bus Common Queue */
+ object_initialize_child(obj, "pbcq", &phb->pbcq, sizeof(phb->pbcq),
+ TYPE_PNV_PBCQ, &error_abort, NULL);
+
+ /* Root Port */
+ object_initialize_child(obj, "root", &phb->root, sizeof(phb->root),
+ TYPE_PNV_PHB3_ROOT_PORT, &error_abort, NULL);
+ qdev_prop_set_int32(DEVICE(&phb->root), "addr", PCI_DEVFN(0, 0));
+ qdev_prop_set_bit(DEVICE(&phb->root), "multifunction", false);
+}
+
+static void pnv_phb3_realize(DeviceState *dev, Error **errp)
+{
+ PnvPHB3 *phb = PNV_PHB3(dev);
+ PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+ PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
+ Error *local_err = NULL;
+ int i;
+
+ if (phb->phb_id >= PNV8_CHIP_PHB3_MAX) {
+ error_setg(errp, "invalid PHB index: %d", phb->phb_id);
+ return;
+ }
+
+ /* LSI sources */
+ object_property_set_link(OBJECT(&phb->lsis), OBJECT(pnv), "xics",
+ &error_abort);
+ object_property_set_int(OBJECT(&phb->lsis), PNV_PHB3_NUM_LSI, "nr-irqs",
+ &error_abort);
+ object_property_set_bool(OBJECT(&phb->lsis), true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ for (i = 0; i < phb->lsis.nr_irqs; i++) {
+ ics_set_irq_type(&phb->lsis, i, true);
+ }
+
+ phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs);
+
+ /* MSI sources */
+ object_property_set_link(OBJECT(&phb->msis), OBJECT(phb), "phb",
+ &error_abort);
+ object_property_set_link(OBJECT(&phb->msis), OBJECT(pnv), "xics",
+ &error_abort);
+ object_property_set_int(OBJECT(&phb->msis), PHB3_MAX_MSI, "nr-irqs",
+ &error_abort);
+ object_property_set_bool(OBJECT(&phb->msis), true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ /* Power Bus Common Queue */
+ object_property_set_link(OBJECT(&phb->pbcq), OBJECT(phb), "phb",
+ &error_abort);
+ object_property_set_bool(OBJECT(&phb->pbcq), true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ /* Controller Registers */
+ memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb,
+ "phb3-regs", 0x1000);
+
+ /*
+ * PHB3 doesn't support IO space. However, qemu gets very upset if
+ * we don't have an IO region to anchor IO BARs onto so we just
+ * initialize one which we never hook up to anything
+ */
+ memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000);
+ memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio",
+ PCI_MMIO_TOTAL_SIZE);
+
+ pci->bus = pci_register_root_bus(dev, "root-bus",
+ pnv_phb3_set_irq, pnv_phb3_map_irq, phb,
+ &phb->pci_mmio, &phb->pci_io,
+ 0, 4, TYPE_PNV_PHB3_ROOT_BUS);
+
+ pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb);
+
+ /* Add a single Root port */
+ qdev_prop_set_uint8(DEVICE(&phb->root), "chassis", phb->chip_id);
+ qdev_prop_set_uint16(DEVICE(&phb->root), "slot", phb->phb_id);
+ qdev_set_parent_bus(DEVICE(&phb->root), BUS(pci->bus));
+ qdev_init_nofail(DEVICE(&phb->root));
+}
+
+void pnv_phb3_update_regions(PnvPHB3 *phb)
+{
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ /* Unmap first always */
+ if (memory_region_is_mapped(&phb->mr_regs)) {
+ memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs);
+ }
+
+ /* Map registers if enabled */
+ if (memory_region_is_mapped(&pbcq->phbbar)) {
+ /* TODO: We should use the PHB BAR 2 register but we don't ... */
+ memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs);
+ }
+
+ /* Check/update m32 */
+ if (memory_region_is_mapped(&phb->mr_m32)) {
+ pnv_phb3_check_m32(phb);
+ }
+ pnv_phb3_check_all_m64s(phb);
+}
+
+static const char *pnv_phb3_root_bus_path(PCIHostState *host_bridge,
+ PCIBus *rootbus)
+{
+ PnvPHB3 *phb = PNV_PHB3(host_bridge);
+
+ snprintf(phb->bus_path, sizeof(phb->bus_path), "00%02x:%02x",
+ phb->chip_id, phb->phb_id);
+ return phb->bus_path;
+}
+
+static Property pnv_phb3_properties[] = {
+ DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0),
+ DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pnv_phb3_class_init(ObjectClass *klass, void *data)
+{
+ PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ hc->root_bus_path = pnv_phb3_root_bus_path;
+ dc->realize = pnv_phb3_realize;
+ device_class_set_props(dc, pnv_phb3_properties);
+ set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+}
+
+static const TypeInfo pnv_phb3_type_info = {
+ .name = TYPE_PNV_PHB3,
+ .parent = TYPE_PCIE_HOST_BRIDGE,
+ .instance_size = sizeof(PnvPHB3),
+ .class_init = pnv_phb3_class_init,
+ .instance_init = pnv_phb3_instance_init,
+};
+
+static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data)
+{
+ BusClass *k = BUS_CLASS(klass);
+
+ /*
+ * PHB3 has only a single root complex. Enforce the limit on the
+ * parent bus
+ */
+ k->max_dev = 1;
+}
+
+static const TypeInfo pnv_phb3_root_bus_info = {
+ .name = TYPE_PNV_PHB3_ROOT_BUS,
+ .parent = TYPE_PCIE_BUS,
+ .class_init = pnv_phb3_root_bus_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { INTERFACE_PCIE_DEVICE },
+ { }
+ },
+};
+
+static void pnv_phb3_root_port_realize(DeviceState *dev, Error **errp)
+{
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_GET_CLASS(dev);
+ Error *local_err = NULL;
+
+ rpc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+}
+
+static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
+
+ dc->desc = "IBM PHB3 PCIE Root Port";
+
+ device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
+ &rpc->parent_realize);
+
+ k->vendor_id = PCI_VENDOR_ID_IBM;
+ k->device_id = 0x03dc;
+ k->revision = 0;
+
+ rpc->exp_offset = 0x48;
+ rpc->aer_offset = 0x100;
+}
+
+static const TypeInfo pnv_phb3_root_port_info = {
+ .name = TYPE_PNV_PHB3_ROOT_PORT,
+ .parent = TYPE_PCIE_ROOT_PORT,
+ .instance_size = sizeof(PnvPHB3RootPort),
+ .class_init = pnv_phb3_root_port_class_init,
+};
+
+static void pnv_phb3_register_types(void)
+{
+ type_register_static(&pnv_phb3_root_bus_info);
+ type_register_static(&pnv_phb3_root_port_info);
+ type_register_static(&pnv_phb3_type_info);
+ type_register_static(&pnv_phb3_iommu_memory_region_info);
+}
+
+type_init(pnv_phb3_register_types)
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
new file mode 100644
index 0000000000..ecfc1b2c4e
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -0,0 +1,349 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/ppc/pnv.h"
+#include "hw/pci/msi.h"
+#include "monitor/monitor.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "sysemu/reset.h"
+
+static uint64_t phb3_msi_ive_addr(PnvPHB3 *phb, int srcno)
+{
+ uint64_t ivtbar = phb->regs[PHB_IVT_BAR >> 3];
+ uint64_t phbctl = phb->regs[PHB_CONTROL >> 3];
+
+ if (!(ivtbar & PHB_IVT_BAR_ENABLE)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed access to disable IVT BAR !");
+ return 0;
+ }
+
+ if (srcno >= (ivtbar & PHB_IVT_LENGTH_MASK)) {
+ qemu_log_mask(LOG_GUEST_ERROR, "MSI out of bounds (%d vs 0x%"PRIx64")",
+ srcno, (uint64_t) (ivtbar & PHB_IVT_LENGTH_MASK));
+ return 0;
+ }
+
+ ivtbar &= PHB_IVT_BASE_ADDRESS_MASK;
+
+ if (phbctl & PHB_CTRL_IVE_128_BYTES) {
+ return ivtbar + 128 * srcno;
+ } else {
+ return ivtbar + 16 * srcno;
+ }
+}
+
+static bool phb3_msi_read_ive(PnvPHB3 *phb, int srcno, uint64_t *out_ive)
+{
+ uint64_t ive_addr, ive;
+
+ ive_addr = phb3_msi_ive_addr(phb, srcno);
+ if (!ive_addr) {
+ return false;
+ }
+
+ if (dma_memory_read(&address_space_memory, ive_addr, &ive, sizeof(ive))) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed to read IVE at 0x%" PRIx64,
+ ive_addr);
+ return false;
+ }
+ *out_ive = be64_to_cpu(ive);
+
+ return true;
+}
+
+static void phb3_msi_set_p(Phb3MsiState *msi, int srcno, uint8_t gen)
+{
+ uint64_t ive_addr;
+ uint8_t p = 0x01 | (gen << 1);
+
+ ive_addr = phb3_msi_ive_addr(msi->phb, srcno);
+ if (!ive_addr) {
+ return;
+ }
+
+ if (dma_memory_write(&address_space_memory, ive_addr + 4, &p, 1)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to write IVE (set P) at 0x%" PRIx64, ive_addr);
+ }
+}
+
+static void phb3_msi_set_q(Phb3MsiState *msi, int srcno)
+{
+ uint64_t ive_addr;
+ uint8_t q = 0x01;
+
+ ive_addr = phb3_msi_ive_addr(msi->phb, srcno);
+ if (!ive_addr) {
+ return;
+ }
+
+ if (dma_memory_write(&address_space_memory, ive_addr + 5, &q, 1)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to write IVE (set Q) at 0x%" PRIx64, ive_addr);
+ }
+}
+
+static void phb3_msi_try_send(Phb3MsiState *msi, int srcno, bool force)
+{
+ ICSState *ics = ICS(msi);
+ uint64_t ive;
+ uint64_t server, prio, pq, gen;
+
+ if (!phb3_msi_read_ive(msi->phb, srcno, &ive)) {
+ return;
+ }
+
+ server = GETFIELD(IODA2_IVT_SERVER, ive);
+ prio = GETFIELD(IODA2_IVT_PRIORITY, ive);
+ if (!force) {
+ pq = GETFIELD(IODA2_IVT_Q, ive) | (GETFIELD(IODA2_IVT_P, ive) << 1);
+ } else {
+ pq = 0;
+ }
+ gen = GETFIELD(IODA2_IVT_GEN, ive);
+
+ /*
+ * The low order 2 bits are the link pointer (Type II interrupts).
+ * Shift back to get a valid IRQ server.
+ */
+ server >>= 2;
+
+ switch (pq) {
+ case 0: /* 00 */
+ if (prio == 0xff) {
+ /* Masked, set Q */
+ phb3_msi_set_q(msi, srcno);
+ } else {
+ /* Enabled, set P and send */
+ phb3_msi_set_p(msi, srcno, gen);
+ icp_irq(ics, server, srcno + ics->offset, prio);
+ }
+ break;
+ case 2: /* 10 */
+ /* Already pending, set Q */
+ phb3_msi_set_q(msi, srcno);
+ break;
+ case 1: /* 01 */
+ case 3: /* 11 */
+ default:
+ /* Just drop stuff if Q already set */
+ break;
+ }
+}
+
+static void phb3_msi_set_irq(void *opaque, int srcno, int val)
+{
+ Phb3MsiState *msi = PHB3_MSI(opaque);
+
+ if (val) {
+ phb3_msi_try_send(msi, srcno, false);
+ }
+}
+
+
+void pnv_phb3_msi_send(Phb3MsiState *msi, uint64_t addr, uint16_t data,
+ int32_t dev_pe)
+{
+ ICSState *ics = ICS(msi);
+ uint64_t ive;
+ uint16_t pe;
+ uint32_t src = ((addr >> 4) & 0xffff) | (data & 0x1f);
+
+ if (src >= ics->nr_irqs) {
+ qemu_log_mask(LOG_GUEST_ERROR, "MSI %d out of bounds", src);
+ return;
+ }
+ if (dev_pe >= 0) {
+ if (!phb3_msi_read_ive(msi->phb, src, &ive)) {
+ return;
+ }
+ pe = GETFIELD(IODA2_IVT_PE, ive);
+ if (pe != dev_pe) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "MSI %d send by PE#%d but assigned to PE#%d",
+ src, dev_pe, pe);
+ return;
+ }
+ }
+ qemu_irq_pulse(msi->qirqs[src]);
+}
+
+void pnv_phb3_msi_ffi(Phb3MsiState *msi, uint64_t val)
+{
+ /* Emit interrupt */
+ pnv_phb3_msi_send(msi, val, 0, -1);
+
+ /* Clear FFI lock */
+ msi->phb->regs[PHB_FFI_LOCK >> 3] = 0;
+}
+
+static void phb3_msi_reject(ICSState *ics, uint32_t nr)
+{
+ Phb3MsiState *msi = PHB3_MSI(ics);
+ unsigned int srcno = nr - ics->offset;
+ unsigned int idx = srcno >> 6;
+ unsigned int bit = 1ull << (srcno & 0x3f);
+
+ assert(srcno < PHB3_MAX_MSI);
+
+ msi->rba[idx] |= bit;
+ msi->rba_sum |= (1u << idx);
+}
+
+static void phb3_msi_resend(ICSState *ics)
+{
+ Phb3MsiState *msi = PHB3_MSI(ics);
+ unsigned int i, j;
+
+ if (msi->rba_sum == 0) {
+ return;
+ }
+
+ for (i = 0; i < 32; i++) {
+ if ((msi->rba_sum & (1u << i)) == 0) {
+ continue;
+ }
+ msi->rba_sum &= ~(1u << i);
+ for (j = 0; j < 64; j++) {
+ if ((msi->rba[i] & (1ull << j)) == 0) {
+ continue;
+ }
+ msi->rba[i] &= ~(1u << j);
+ phb3_msi_try_send(msi, i * 64 + j, true);
+ }
+ }
+}
+
+static void phb3_msi_reset(DeviceState *dev)
+{
+ Phb3MsiState *msi = PHB3_MSI(dev);
+ ICSStateClass *icsc = ICS_GET_CLASS(dev);
+
+ icsc->parent_reset(dev);
+
+ memset(msi->rba, 0, sizeof(msi->rba));
+ msi->rba_sum = 0;
+}
+
+static void phb3_msi_reset_handler(void *dev)
+{
+ phb3_msi_reset(dev);
+}
+
+void pnv_phb3_msi_update_config(Phb3MsiState *msi, uint32_t base,
+ uint32_t count)
+{
+ ICSState *ics = ICS(msi);
+
+ if (count > PHB3_MAX_MSI) {
+ count = PHB3_MAX_MSI;
+ }
+ ics->nr_irqs = count;
+ ics->offset = base;
+}
+
+static void phb3_msi_realize(DeviceState *dev, Error **errp)
+{
+ Phb3MsiState *msi = PHB3_MSI(dev);
+ ICSState *ics = ICS(msi);
+ ICSStateClass *icsc = ICS_GET_CLASS(ics);
+ Error *local_err = NULL;
+
+ assert(msi->phb);
+
+ icsc->parent_realize(dev, &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+
+ msi->qirqs = qemu_allocate_irqs(phb3_msi_set_irq, msi, ics->nr_irqs);
+
+ qemu_register_reset(phb3_msi_reset_handler, dev);
+}
+
+static void phb3_msi_instance_init(Object *obj)
+{
+ Phb3MsiState *msi = PHB3_MSI(obj);
+ ICSState *ics = ICS(obj);
+
+ object_property_add_link(obj, "phb", TYPE_PNV_PHB3,
+ (Object **)&msi->phb,
+ object_property_allow_set_link,
+ OBJ_PROP_LINK_STRONG,
+ &error_abort);
+
+ /* Will be overriden later */
+ ics->offset = 0;
+}
+
+static void phb3_msi_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ ICSStateClass *isc = ICS_CLASS(klass);
+
+ device_class_set_parent_realize(dc, phb3_msi_realize,
+ &isc->parent_realize);
+ device_class_set_parent_reset(dc, phb3_msi_reset,
+ &isc->parent_reset);
+
+ isc->reject = phb3_msi_reject;
+ isc->resend = phb3_msi_resend;
+}
+
+static const TypeInfo phb3_msi_info = {
+ .name = TYPE_PHB3_MSI,
+ .parent = TYPE_ICS,
+ .instance_size = sizeof(Phb3MsiState),
+ .class_init = phb3_msi_class_init,
+ .class_size = sizeof(ICSStateClass),
+ .instance_init = phb3_msi_instance_init,
+};
+
+static void pnv_phb3_msi_register_types(void)
+{
+ type_register_static(&phb3_msi_info);
+}
+
+type_init(pnv_phb3_msi_register_types);
+
+void pnv_phb3_msi_pic_print_info(Phb3MsiState *msi, Monitor *mon)
+{
+ ICSState *ics = ICS(msi);
+ int i;
+
+ monitor_printf(mon, "ICS %4x..%4x %p\n",
+ ics->offset, ics->offset + ics->nr_irqs - 1, ics);
+
+ for (i = 0; i < ics->nr_irqs; i++) {
+ uint64_t ive;
+
+ if (!phb3_msi_read_ive(msi->phb, i, &ive)) {
+ return;
+ }
+
+ if (GETFIELD(IODA2_IVT_PRIORITY, ive) == 0xff) {
+ continue;
+ }
+
+ monitor_printf(mon, " %4x %c%c server=%04x prio=%02x gen=%d\n",
+ ics->offset + i,
+ GETFIELD(IODA2_IVT_P, ive) ? 'P' : '-',
+ GETFIELD(IODA2_IVT_Q, ive) ? 'Q' : '-',
+ (uint32_t) GETFIELD(IODA2_IVT_SERVER, ive) >> 2,
+ (uint32_t) GETFIELD(IODA2_IVT_PRIORITY, ive),
+ (uint32_t) GETFIELD(IODA2_IVT_GEN, ive));
+ }
+}
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
new file mode 100644
index 0000000000..6f0c05be68
--- /dev/null
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -0,0 +1,357 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "qemu/log.h"
+#include "target/ppc/cpu.h"
+#include "hw/ppc/fdt.h"
+#include "hw/pci-host/pnv_phb3_regs.h"
+#include "hw/pci-host/pnv_phb3.h"
+#include "hw/ppc/pnv.h"
+#include "hw/ppc/pnv_xscom.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pci_bus.h"
+
+#include <libfdt.h>
+
+#define phb3_pbcq_error(pbcq, fmt, ...) \
+ qemu_log_mask(LOG_GUEST_ERROR, "phb3_pbcq[%d:%d]: " fmt "\n", \
+ (pbcq)->phb->chip_id, (pbcq)->phb->phb_id, ## __VA_ARGS__)
+
+static uint64_t pnv_pbcq_nest_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t offset = addr >> 3;
+
+ return pbcq->nest_regs[offset];
+}
+
+static uint64_t pnv_pbcq_pci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t offset = addr >> 3;
+
+ return pbcq->pci_regs[offset];
+}
+
+static uint64_t pnv_pbcq_spci_xscom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t offset = addr >> 3;
+
+ if (offset == PBCQ_SPCI_ASB_DATA) {
+ return pnv_phb3_reg_read(pbcq->phb,
+ pbcq->spci_regs[PBCQ_SPCI_ASB_ADDR], 8);
+ }
+ return pbcq->spci_regs[offset];
+}
+
+static void pnv_pbcq_update_map(PnvPBCQState *pbcq)
+{
+ uint64_t bar_en = pbcq->nest_regs[PBCQ_NEST_BAR_EN];
+ uint64_t bar, mask, size;
+
+ /*
+ * NOTE: This will really not work well if those are remapped
+ * after the PHB has created its sub regions. We could do better
+ * if we had a way to resize regions but we don't really care
+ * that much in practice as the stuff below really only happens
+ * once early during boot
+ */
+
+ /* Handle unmaps */
+ if (memory_region_is_mapped(&pbcq->mmbar0) &&
+ !(bar_en & PBCQ_NEST_BAR_EN_MMIO0)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->mmbar0);
+ }
+ if (memory_region_is_mapped(&pbcq->mmbar1) &&
+ !(bar_en & PBCQ_NEST_BAR_EN_MMIO1)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->mmbar1);
+ }
+ if (memory_region_is_mapped(&pbcq->phbbar) &&
+ !(bar_en & PBCQ_NEST_BAR_EN_PHB)) {
+ memory_region_del_subregion(get_system_memory(), &pbcq->phbbar);
+ }
+
+ /* Update PHB */
+ pnv_phb3_update_regions(pbcq->phb);
+
+ /* Handle maps */
+ if (!memory_region_is_mapped(&pbcq->mmbar0) &&
+ (bar_en & PBCQ_NEST_BAR_EN_MMIO0)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_MMIO_BAR0] >> 14;
+ mask = pbcq->nest_regs[PBCQ_NEST_MMIO_MASK0];
+ size = ((~mask) >> 14) + 1;
+ memory_region_init(&pbcq->mmbar0, OBJECT(pbcq), "pbcq-mmio0", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->mmbar0);
+ pbcq->mmio0_base = bar;
+ pbcq->mmio0_size = size;
+ }
+ if (!memory_region_is_mapped(&pbcq->mmbar1) &&
+ (bar_en & PBCQ_NEST_BAR_EN_MMIO1)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_MMIO_BAR1] >> 14;
+ mask = pbcq->nest_regs[PBCQ_NEST_MMIO_MASK1];
+ size = ((~mask) >> 14) + 1;
+ memory_region_init(&pbcq->mmbar1, OBJECT(pbcq), "pbcq-mmio1", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->mmbar1);
+ pbcq->mmio1_base = bar;
+ pbcq->mmio1_size = size;
+ }
+ if (!memory_region_is_mapped(&pbcq->phbbar)
+ && (bar_en & PBCQ_NEST_BAR_EN_PHB)) {
+ bar = pbcq->nest_regs[PBCQ_NEST_PHB_BAR] >> 14;
+ size = 0x1000;
+ memory_region_init(&pbcq->phbbar, OBJECT(pbcq), "pbcq-phb", size);
+ memory_region_add_subregion(get_system_memory(), bar, &pbcq->phbbar);
+ }
+
+ /* Update PHB */
+ pnv_phb3_update_regions(pbcq->phb);
+}
+
+static void pnv_pbcq_nest_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PBCQ_NEST_MMIO_BAR0:
+ case PBCQ_NEST_MMIO_BAR1:
+ case PBCQ_NEST_MMIO_MASK0:
+ case PBCQ_NEST_MMIO_MASK1:
+ if (pbcq->nest_regs[PBCQ_NEST_BAR_EN] &
+ (PBCQ_NEST_BAR_EN_MMIO0 |
+ PBCQ_NEST_BAR_EN_MMIO1)) {
+ phb3_pbcq_error(pbcq, "Changing enabled BAR unsupported");
+ }
+ pbcq->nest_regs[reg] = val & 0xffffffffc0000000ull;
+ break;
+ case PBCQ_NEST_PHB_BAR:
+ if (pbcq->nest_regs[PBCQ_NEST_BAR_EN] & PBCQ_NEST_BAR_EN_PHB) {
+ phb3_pbcq_error(pbcq, "Changing enabled BAR unsupported");
+ }
+ pbcq->nest_regs[reg] = val & 0xfffffffffc000000ull;
+ break;
+ case PBCQ_NEST_BAR_EN:
+ pbcq->nest_regs[reg] = val & 0xf800000000000000ull;
+ pnv_pbcq_update_map(pbcq);
+ pnv_phb3_remap_irqs(pbcq->phb);
+ break;
+ case PBCQ_NEST_IRSN_COMPARE:
+ case PBCQ_NEST_IRSN_MASK:
+ pbcq->nest_regs[reg] = val & PBCQ_NEST_IRSN_COMP;
+ pnv_phb3_remap_irqs(pbcq->phb);
+ break;
+ case PBCQ_NEST_LSI_SRC_ID:
+ pbcq->nest_regs[reg] = val & PBCQ_NEST_LSI_SRC;
+ pnv_phb3_remap_irqs(pbcq->phb);
+ break;
+ default:
+ phb3_pbcq_error(pbcq, "%s @0x%"HWADDR_PRIx"=%"PRIx64, __func__,
+ addr, val);
+ }
+}
+
+static void pnv_pbcq_pci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PBCQ_PCI_BAR2:
+ pbcq->pci_regs[reg] = val & 0xfffffffffc000000ull;
+ pnv_pbcq_update_map(pbcq);
+ default:
+ phb3_pbcq_error(pbcq, "%s @0x%"HWADDR_PRIx"=%"PRIx64, __func__,
+ addr, val);
+ }
+}
+
+static void pnv_pbcq_spci_xscom_write(void *opaque, hwaddr addr,
+ uint64_t val, unsigned size)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(opaque);
+ uint32_t reg = addr >> 3;
+
+ switch (reg) {
+ case PBCQ_SPCI_ASB_ADDR:
+ pbcq->spci_regs[reg] = val & 0xfff;
+ break;
+ case PBCQ_SPCI_ASB_STATUS:
+ pbcq->spci_regs[reg] &= ~val;
+ break;
+ case PBCQ_SPCI_ASB_DATA:
+ pnv_phb3_reg_write(pbcq->phb, pbcq->spci_regs[PBCQ_SPCI_ASB_ADDR],
+ val, 8);
+ break;
+ case PBCQ_SPCI_AIB_CAPP_EN:
+ case PBCQ_SPCI_CAPP_SEC_TMR:
+ break;
+ default:
+ phb3_pbcq_error(pbcq, "%s @0x%"HWADDR_PRIx"=%"PRIx64, __func__,
+ addr, val);
+ }
+}
+
+static const MemoryRegionOps pnv_pbcq_nest_xscom_ops = {
+ .read = pnv_pbcq_nest_xscom_read,
+ .write = pnv_pbcq_nest_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static const MemoryRegionOps pnv_pbcq_pci_xscom_ops = {
+ .read = pnv_pbcq_pci_xscom_read,
+ .write = pnv_pbcq_pci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static const MemoryRegionOps pnv_pbcq_spci_xscom_ops = {
+ .read = pnv_pbcq_spci_xscom_read,
+ .write = pnv_pbcq_spci_xscom_write,
+ .valid.min_access_size = 8,
+ .valid.max_access_size = 8,
+ .impl.min_access_size = 8,
+ .impl.max_access_size = 8,
+ .endianness = DEVICE_BIG_ENDIAN,
+};
+
+static void pnv_pbcq_default_bars(PnvPBCQState *pbcq)
+{
+ uint64_t mm0, mm1, reg;
+ PnvPHB3 *phb = pbcq->phb;
+
+ mm0 = 0x3d00000000000ull + 0x4000000000ull * phb->chip_id +
+ 0x1000000000ull * phb->phb_id;
+ mm1 = 0x3ff8000000000ull + 0x0200000000ull * phb->chip_id +
+ 0x0080000000ull * phb->phb_id;
+ reg = 0x3fffe40000000ull + 0x0000400000ull * phb->chip_id +
+ 0x0000100000ull * phb->phb_id;
+
+ pbcq->nest_regs[PBCQ_NEST_MMIO_BAR0] = mm0 << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_BAR1] = mm1 << 14;
+ pbcq->nest_regs[PBCQ_NEST_PHB_BAR] = reg << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_MASK0] = 0x3fff000000000ull << 14;
+ pbcq->nest_regs[PBCQ_NEST_MMIO_MASK1] = 0x3ffff80000000ull << 14;
+ pbcq->pci_regs[PBCQ_PCI_BAR2] = reg << 14;
+}
+
+static void pnv_pbcq_realize(DeviceState *dev, Error **errp)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(dev);
+ PnvPHB3 *phb;
+ char name[32];
+
+ assert(pbcq->phb);
+ phb = pbcq->phb;
+
+ /* TODO: Fix OPAL to do that: establish default BAR values */
+ pnv_pbcq_default_bars(pbcq);
+
+ /* Initialize the XSCOM region for the PBCQ registers */
+ snprintf(name, sizeof(name), "xscom-pbcq-nest-%d.%d",
+ phb->chip_id, phb->phb_id);
+ pnv_xscom_region_init(&pbcq->xscom_nest_regs, OBJECT(dev),
+ &pnv_pbcq_nest_xscom_ops, pbcq, name,
+ PNV_XSCOM_PBCQ_NEST_SIZE);
+ snprintf(name, sizeof(name), "xscom-pbcq-pci-%d.%d",
+ phb->chip_id, phb->phb_id);
+ pnv_xscom_region_init(&pbcq->xscom_pci_regs, OBJECT(dev),
+ &pnv_pbcq_pci_xscom_ops, pbcq, name,
+ PNV_XSCOM_PBCQ_PCI_SIZE);
+ snprintf(name, sizeof(name), "xscom-pbcq-spci-%d.%d",
+ phb->chip_id, phb->phb_id);
+ pnv_xscom_region_init(&pbcq->xscom_spci_regs, OBJECT(dev),
+ &pnv_pbcq_spci_xscom_ops, pbcq, name,
+ PNV_XSCOM_PBCQ_SPCI_SIZE);
+}
+
+static int pnv_pbcq_dt_xscom(PnvXScomInterface *dev, void *fdt,
+ int xscom_offset)
+{
+ const char compat[] = "ibm,power8-pbcq";
+ PnvPHB3 *phb = PNV_PBCQ(dev)->phb;
+ char *name;
+ int offset;
+ uint32_t lpc_pcba = PNV_XSCOM_PBCQ_NEST_BASE + 0x400 * phb->phb_id;
+ uint32_t reg[] = {
+ cpu_to_be32(lpc_pcba),
+ cpu_to_be32(PNV_XSCOM_PBCQ_NEST_SIZE),
+ cpu_to_be32(PNV_XSCOM_PBCQ_PCI_BASE + 0x400 * phb->phb_id),
+ cpu_to_be32(PNV_XSCOM_PBCQ_PCI_SIZE),
+ cpu_to_be32(PNV_XSCOM_PBCQ_SPCI_BASE + 0x040 * phb->phb_id),
+ cpu_to_be32(PNV_XSCOM_PBCQ_SPCI_SIZE)
+ };
+
+ name = g_strdup_printf("pbcq@%x", lpc_pcba);
+ offset = fdt_add_subnode(fdt, xscom_offset, name);
+ _FDT(offset);
+ g_free(name);
+
+ _FDT((fdt_setprop(fdt, offset, "reg", reg, sizeof(reg))));
+
+ _FDT((fdt_setprop_cell(fdt, offset, "ibm,phb-index", phb->phb_id)));
+ _FDT((fdt_setprop_cell(fdt, offset, "ibm,chip-id", phb->chip_id)));
+ _FDT((fdt_setprop(fdt, offset, "compatible", compat,
+ sizeof(compat))));
+ return 0;
+}
+
+static void phb3_pbcq_instance_init(Object *obj)
+{
+ PnvPBCQState *pbcq = PNV_PBCQ(obj);
+
+ object_property_add_link(obj, "phb", TYPE_PNV_PHB3,
+ (Object **)&pbcq->phb,
+ object_property_allow_set_link,
+ OBJ_PROP_LINK_STRONG,
+ &error_abort);
+}
+
+static void pnv_pbcq_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
+
+ xdc->dt_xscom = pnv_pbcq_dt_xscom;
+
+ dc->realize = pnv_pbcq_realize;
+}
+
+static const TypeInfo pnv_pbcq_type_info = {
+ .name = TYPE_PNV_PBCQ,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(PnvPBCQState),
+ .instance_init = phb3_pbcq_instance_init,
+ .class_init = pnv_pbcq_class_init,
+ .interfaces = (InterfaceInfo[]) {
+ { TYPE_PNV_XSCOM_INTERFACE },
+ { }
+ }
+};
+
+static void pnv_pbcq_register_types(void)
+{
+ type_register_static(&pnv_pbcq_type_info);
+}
+
+type_init(pnv_pbcq_register_types)
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index d5ecec6321..139c857b1e 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -616,8 +616,13 @@ static ISABus *pnv_isa_create(PnvChip *chip, Error **errp)
static void pnv_chip_power8_pic_print_info(PnvChip *chip, Monitor *mon)
{
Pnv8Chip *chip8 = PNV8_CHIP(chip);
+ int i;
ics_pic_print_info(&chip8->psi.ics, mon);
+ for (i = 0; i < chip->num_phbs; i++) {
+ pnv_phb3_msi_pic_print_info(&chip8->phbs[i].msis, mon);
+ ics_pic_print_info(&chip8->phbs[i].lsis, mon);
+ }
}
static void pnv_chip_power9_pic_print_info(PnvChip *chip, Monitor *mon)
@@ -1026,7 +1031,10 @@ static void pnv_chip_power10_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
static void pnv_chip_power8_instance_init(Object *obj)
{
+ PnvChip *chip = PNV_CHIP(obj);
Pnv8Chip *chip8 = PNV8_CHIP(obj);
+ PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
+ int i;
object_property_add_link(obj, "xics", TYPE_XICS_FABRIC,
(Object **)&chip8->xics,
@@ -1045,6 +1053,17 @@ static void pnv_chip_power8_instance_init(Object *obj)
object_initialize_child(obj, "homer", &chip8->homer, sizeof(chip8->homer),
TYPE_PNV8_HOMER, &error_abort, NULL);
+
+ for (i = 0; i < pcc->num_phbs; i++) {
+ object_initialize_child(obj, "phb[*]", &chip8->phbs[i],
+ sizeof(chip8->phbs[i]), TYPE_PNV_PHB3,
+ &error_abort, NULL);
+ }
+
+ /*
+ * Number of PHBs is the chip default
+ */
+ chip->num_phbs = pcc->num_phbs;
}
static void pnv_chip_icp_realize(Pnv8Chip *chip8, Error **errp)
@@ -1083,6 +1102,7 @@ static void pnv_chip_power8_realize(DeviceState *dev, Error **errp)
Pnv8Chip *chip8 = PNV8_CHIP(dev);
Pnv8Psi *psi8 = &chip8->psi;
Error *local_err = NULL;
+ int i;
assert(chip8->xics);
@@ -1163,6 +1183,33 @@ static void pnv_chip_power8_realize(DeviceState *dev, Error **errp)
/* Homer mmio region */
memory_region_add_subregion(get_system_memory(), PNV_HOMER_BASE(chip),
&chip8->homer.regs);
+
+ /* PHB3 controllers */
+ for (i = 0; i < chip->num_phbs; i++) {
+ PnvPHB3 *phb = &chip8->phbs[i];
+ PnvPBCQState *pbcq = &phb->pbcq;
+
+ object_property_set_int(OBJECT(phb), i, "index", &error_fatal);
+ object_property_set_int(OBJECT(phb), chip->chip_id, "chip-id",
+ &error_fatal);
+ object_property_set_bool(OBJECT(phb), true, "realized", &local_err);
+ if (local_err) {
+ error_propagate(errp, local_err);
+ return;
+ }
+ qdev_set_parent_bus(DEVICE(phb), sysbus_get_default());
+
+ /* Populate the XSCOM address space. */
+ pnv_xscom_add_subregion(chip,
+ PNV_XSCOM_PBCQ_NEST_BASE + 0x400 * phb->phb_id,
+ &pbcq->xscom_nest_regs);
+ pnv_xscom_add_subregion(chip,
+ PNV_XSCOM_PBCQ_PCI_BASE + 0x400 * phb->phb_id,
+ &pbcq->xscom_pci_regs);
+ pnv_xscom_add_subregion(chip,
+ PNV_XSCOM_PBCQ_SPCI_BASE + 0x040 * phb->phb_id,
+ &pbcq->xscom_spci_regs);
+ }
}
static uint32_t pnv_chip_power8_xscom_pcba(PnvChip *chip, uint64_t addr)
@@ -1178,6 +1225,7 @@ static void pnv_chip_power8e_class_init(ObjectClass *klass, void *data)
k->chip_cfam_id = 0x221ef04980000000ull; /* P8 Murano DD2.1 */
k->cores_mask = POWER8E_CORE_MASK;
+ k->num_phbs = 3;
k->core_pir = pnv_chip_core_pir_p8;
k->intc_create = pnv_chip_power8_intc_create;
k->intc_reset = pnv_chip_power8_intc_reset;
@@ -1201,6 +1249,7 @@ static void pnv_chip_power8_class_init(ObjectClass *klass, void *data)
k->chip_cfam_id = 0x220ea04980000000ull; /* P8 Venice DD2.0 */
k->cores_mask = POWER8_CORE_MASK;
+ k->num_phbs = 3;
k->core_pir = pnv_chip_core_pir_p8;
k->intc_create = pnv_chip_power8_intc_create;
k->intc_reset = pnv_chip_power8_intc_reset;
@@ -1224,6 +1273,7 @@ static void pnv_chip_power8nvl_class_init(ObjectClass *klass, void *data)
k->chip_cfam_id = 0x120d304980000000ull; /* P8 Naples DD1.0 */
k->cores_mask = POWER8_CORE_MASK;
+ k->num_phbs = 3;
k->core_pir = pnv_chip_core_pir_p8;
k->intc_create = pnv_chip_power8_intc_create;
k->intc_reset = pnv_chip_power8_intc_reset;
@@ -1748,14 +1798,23 @@ PowerPCCPU *pnv_chip_find_cpu(PnvChip *chip, uint32_t pir)
static ICSState *pnv_ics_get(XICSFabric *xi, int irq)
{
PnvMachineState *pnv = PNV_MACHINE(xi);
- int i;
+ int i, j;
for (i = 0; i < pnv->num_chips; i++) {
+ PnvChip *chip = pnv->chips[i];
Pnv8Chip *chip8 = PNV8_CHIP(pnv->chips[i]);
if (ics_valid_irq(&chip8->psi.ics, irq)) {
return &chip8->psi.ics;
}
+ for (j = 0; j < chip->num_phbs; j++) {
+ if (ics_valid_irq(&chip8->phbs[j].lsis, irq)) {
+ return &chip8->phbs[j].lsis;
+ }
+ if (ics_valid_irq(ICS(&chip8->phbs[j].msis), irq)) {
+ return ICS(&chip8->phbs[j].msis);
+ }
+ }
}
return NULL;
}
@@ -1763,11 +1822,17 @@ static ICSState *pnv_ics_get(XICSFabric *xi, int irq)
static void pnv_ics_resend(XICSFabric *xi)
{
PnvMachineState *pnv = PNV_MACHINE(xi);
- int i;
+ int i, j;
for (i = 0; i < pnv->num_chips; i++) {
+ PnvChip *chip = pnv->chips[i];
Pnv8Chip *chip8 = PNV8_CHIP(pnv->chips[i]);
+
ics_resend(&chip8->psi.ics);
+ for (j = 0; j < chip->num_phbs; j++) {
+ ics_resend(&chip8->phbs[j].lsis);
+ ics_resend(ICS(&chip8->phbs[j].msis));
+ }
}
}
diff --git a/include/hw/pci-host/pnv_phb3.h b/include/hw/pci-host/pnv_phb3.h
new file mode 100644
index 0000000000..75b787867a
--- /dev/null
+++ b/include/hw/pci-host/pnv_phb3.h
@@ -0,0 +1,164 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2014-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef PCI_HOST_PNV_PHB3_H
+#define PCI_HOST_PNV_PHB3_H
+
+#include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
+#include "hw/ppc/xics.h"
+
+typedef struct PnvPHB3 PnvPHB3;
+
+/*
+ * PHB3 XICS Source for MSIs
+ */
+#define TYPE_PHB3_MSI "phb3-msi"
+#define PHB3_MSI(obj) OBJECT_CHECK(Phb3MsiState, (obj), TYPE_PHB3_MSI)
+
+#define PHB3_MAX_MSI 2048
+
+typedef struct Phb3MsiState {
+ ICSState ics;
+ qemu_irq *qirqs;
+
+ PnvPHB3 *phb;
+ uint64_t rba[PHB3_MAX_MSI / 64];
+ uint32_t rba_sum;
+} Phb3MsiState;
+
+void pnv_phb3_msi_update_config(Phb3MsiState *msis, uint32_t base,
+ uint32_t count);
+void pnv_phb3_msi_send(Phb3MsiState *msis, uint64_t addr, uint16_t data,
+ int32_t dev_pe);
+void pnv_phb3_msi_ffi(Phb3MsiState *msis, uint64_t val);
+void pnv_phb3_msi_pic_print_info(Phb3MsiState *msis, Monitor *mon);
+
+
+/*
+ * We have one such address space wrapper per possible device under
+ * the PHB since they need to be assigned statically at qemu device
+ * creation time. The relationship to a PE is done later dynamically.
+ * This means we can potentially create a lot of these guys. Q35
+ * stores them as some kind of radix tree but we never really need to
+ * do fast lookups so instead we simply keep a QLIST of them for now,
+ * we can add the radix if needed later on.
+ *
+ * We do cache the PE number to speed things up a bit though.
+ */
+typedef struct PnvPhb3DMASpace {
+ PCIBus *bus;
+ uint8_t devfn;
+ int pe_num; /* Cached PE number */
+#define PHB_INVALID_PE (-1)
+ PnvPHB3 *phb;
+ AddressSpace dma_as;
+ IOMMUMemoryRegion dma_mr;
+ MemoryRegion msi32_mr;
+ MemoryRegion msi64_mr;
+ QLIST_ENTRY(PnvPhb3DMASpace) list;
+} PnvPhb3DMASpace;
+
+/*
+ * PHB3 Power Bus Common Queue
+ */
+#define TYPE_PNV_PBCQ "pnv-pbcq"
+#define PNV_PBCQ(obj) OBJECT_CHECK(PnvPBCQState, (obj), TYPE_PNV_PBCQ)
+
+typedef struct PnvPBCQState {
+ DeviceState parent;
+
+ uint32_t nest_xbase;
+ uint32_t spci_xbase;
+ uint32_t pci_xbase;
+#define PBCQ_NEST_REGS_COUNT 0x46
+#define PBCQ_PCI_REGS_COUNT 0x15
+#define PBCQ_SPCI_REGS_COUNT 0x5
+
+ uint64_t nest_regs[PBCQ_NEST_REGS_COUNT];
+ uint64_t spci_regs[PBCQ_SPCI_REGS_COUNT];
+ uint64_t pci_regs[PBCQ_PCI_REGS_COUNT];
+ MemoryRegion mmbar0;
+ MemoryRegion mmbar1;
+ MemoryRegion phbbar;
+ uint64_t mmio0_base;
+ uint64_t mmio0_size;
+ uint64_t mmio1_base;
+ uint64_t mmio1_size;
+ PnvPHB3 *phb;
+
+ MemoryRegion xscom_nest_regs;
+ MemoryRegion xscom_pci_regs;
+ MemoryRegion xscom_spci_regs;
+} PnvPBCQState;
+
+/*
+ * PHB3 PCIe Root port
+ */
+#define TYPE_PNV_PHB3_ROOT_BUS "pnv-phb3-root-bus"
+
+#define TYPE_PNV_PHB3_ROOT_PORT "pnv-phb3-root-port"
+
+typedef struct PnvPHB3RootPort {
+ PCIESlot parent_obj;
+} PnvPHB3RootPort;
+
+/*
+ * PHB3 PCIe Host Bridge for PowerNV machines (POWER8)
+ */
+#define TYPE_PNV_PHB3 "pnv-phb3"
+#define PNV_PHB3(obj) OBJECT_CHECK(PnvPHB3, (obj), TYPE_PNV_PHB3)
+
+#define PNV_PHB3_NUM_M64 16
+#define PNV_PHB3_NUM_REGS (0x1000 >> 3)
+#define PNV_PHB3_NUM_LSI 8
+#define PNV_PHB3_NUM_PE 256
+
+#define PCI_MMIO_TOTAL_SIZE (0x1ull << 60)
+
+struct PnvPHB3 {
+ PCIExpressHost parent_obj;
+
+ uint32_t chip_id;
+ uint32_t phb_id;
+ char bus_path[8];
+
+ uint64_t regs[PNV_PHB3_NUM_REGS];
+ MemoryRegion mr_regs;
+
+ MemoryRegion mr_m32;
+ MemoryRegion mr_m64[PNV_PHB3_NUM_M64];
+ MemoryRegion pci_mmio;
+ MemoryRegion pci_io;
+
+ uint64_t ioda_LIST[8];
+ uint64_t ioda_LXIVT[8];
+ uint64_t ioda_TVT[512];
+ uint64_t ioda_M64BT[16];
+ uint64_t ioda_MDT[256];
+ uint64_t ioda_PEEV[4];
+
+ uint32_t total_irq;
+ ICSState lsis;
+ qemu_irq *qirqs;
+ Phb3MsiState msis;
+
+ PnvPBCQState pbcq;
+
+ PnvPHB3RootPort root;
+
+ QLIST_HEAD(, PnvPhb3DMASpace) dma_spaces;
+};
+
+uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size);
+void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size);
+void pnv_phb3_update_regions(PnvPHB3 *phb);
+void pnv_phb3_remap_irqs(PnvPHB3 *phb);
+
+#endif /* PCI_HOST_PNV_PHB3_H */
diff --git a/include/hw/pci-host/pnv_phb3_regs.h b/include/hw/pci-host/pnv_phb3_regs.h
new file mode 100644
index 0000000000..a174ef1f70
--- /dev/null
+++ b/include/hw/pci-host/pnv_phb3_regs.h
@@ -0,0 +1,450 @@
+/*
+ * QEMU PowerPC PowerNV (POWER8) PHB3 model
+ *
+ * Copyright (c) 2013-2020, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef PCI_HOST_PNV_PHB3_REGS_H
+#define PCI_HOST_PNV_PHB3_REGS_H
+
+#include "qemu/host-utils.h"
+
+/*
+ * QEMU version of the GETFIELD/SETFIELD macros
+ *
+ * These are common with the PnvXive model.
+ */
+static inline uint64_t GETFIELD(uint64_t mask, uint64_t word)
+{
+ return (word & mask) >> ctz64(mask);
+}
+
+static inline uint64_t SETFIELD(uint64_t mask, uint64_t word,
+ uint64_t value)
+{
+ return (word & ~mask) | ((value << ctz64(mask)) & mask);
+}
+
+/*
+ * PBCQ XSCOM registers
+ */
+
+#define PBCQ_NEST_IRSN_COMPARE 0x1a
+#define PBCQ_NEST_IRSN_COMP PPC_BITMASK(0, 18)
+#define PBCQ_NEST_IRSN_MASK 0x1b
+#define PBCQ_NEST_LSI_SRC_ID 0x1f
+#define PBCQ_NEST_LSI_SRC PPC_BITMASK(0, 7)
+#define PBCQ_NEST_REGS_COUNT 0x46
+#define PBCQ_NEST_MMIO_BAR0 0x40
+#define PBCQ_NEST_MMIO_BAR1 0x41
+#define PBCQ_NEST_PHB_BAR 0x42
+#define PBCQ_NEST_MMIO_MASK0 0x43
+#define PBCQ_NEST_MMIO_MASK1 0x44
+#define PBCQ_NEST_BAR_EN 0x45
+#define PBCQ_NEST_BAR_EN_MMIO0 PPC_BIT(0)
+#define PBCQ_NEST_BAR_EN_MMIO1 PPC_BIT(1)
+#define PBCQ_NEST_BAR_EN_PHB PPC_BIT(2)
+#define PBCQ_NEST_BAR_EN_IRSN_RX PPC_BIT(3)
+#define PBCQ_NEST_BAR_EN_IRSN_TX PPC_BIT(4)
+
+#define PBCQ_PCI_REGS_COUNT 0x15
+#define PBCQ_PCI_BAR2 0x0b
+
+#define PBCQ_SPCI_REGS_COUNT 0x5
+#define PBCQ_SPCI_ASB_ADDR 0x0
+#define PBCQ_SPCI_ASB_STATUS 0x1
+#define PBCQ_SPCI_ASB_DATA 0x2
+#define PBCQ_SPCI_AIB_CAPP_EN 0x3
+#define PBCQ_SPCI_CAPP_SEC_TMR 0x4
+
+/*
+ * PHB MMIO registers
+ */
+
+/* PHB Fundamental register set A */
+#define PHB_LSI_SOURCE_ID 0x100
+#define PHB_LSI_SRC_ID PPC_BITMASK(5, 12)
+#define PHB_DMA_CHAN_STATUS 0x110
+#define PHB_DMA_CHAN_ANY_ERR PPC_BIT(27)
+#define PHB_DMA_CHAN_ANY_ERR1 PPC_BIT(28)
+#define PHB_DMA_CHAN_ANY_FREEZE PPC_BIT(29)
+#define PHB_CPU_LOADSTORE_STATUS 0x120
+#define PHB_CPU_LS_ANY_ERR PPC_BIT(27)
+#define PHB_CPU_LS_ANY_ERR1 PPC_BIT(28)
+#define PHB_CPU_LS_ANY_FREEZE PPC_BIT(29)
+#define PHB_DMA_MSI_NODE_ID 0x128
+#define PHB_DMAMSI_NID_FIXED PPC_BIT(0)
+#define PHB_DMAMSI_NID PPC_BITMASK(24, 31)
+#define PHB_CONFIG_DATA 0x130
+#define PHB_LOCK0 0x138
+#define PHB_CONFIG_ADDRESS 0x140
+#define PHB_CA_ENABLE PPC_BIT(0)
+#define PHB_CA_BUS PPC_BITMASK(4, 11)
+#define PHB_CA_DEV PPC_BITMASK(12, 16)
+#define PHB_CA_FUNC PPC_BITMASK(17, 19)
+#define PHB_CA_REG PPC_BITMASK(20, 31)
+#define PHB_CA_PE PPC_BITMASK(40, 47)
+#define PHB_LOCK1 0x148
+#define PHB_IVT_BAR 0x150
+#define PHB_IVT_BAR_ENABLE PPC_BIT(0)
+#define PHB_IVT_BASE_ADDRESS_MASK PPC_BITMASK(14, 48)
+#define PHB_IVT_LENGTH_MASK PPC_BITMASK(52, 63)
+#define PHB_RBA_BAR 0x158
+#define PHB_RBA_BAR_ENABLE PPC_BIT(0)
+#define PHB_RBA_BASE_ADDRESS PPC_BITMASK(14, 55)
+#define PHB_PHB3_CONFIG 0x160
+#define PHB_PHB3C_64B_TCE_EN PPC_BIT(2)
+#define PHB_PHB3C_32BIT_MSI_EN PPC_BIT(8)
+#define PHB_PHB3C_64BIT_MSI_EN PPC_BIT(14)
+#define PHB_PHB3C_M32_EN PPC_BIT(16)
+#define PHB_RTT_BAR 0x168
+#define PHB_RTT_BAR_ENABLE PPC_BIT(0)
+#define PHB_RTT_BASE_ADDRESS_MASK PPC_BITMASK(14, 46)
+#define PHB_PELTV_BAR 0x188
+#define PHB_PELTV_BAR_ENABLE PPC_BIT(0)
+#define PHB_PELTV_BASE_ADDRESS PPC_BITMASK(14, 50)
+#define PHB_M32_BASE_ADDR 0x190
+#define PHB_M32_BASE_MASK 0x198
+#define PHB_M32_START_ADDR 0x1a0
+#define PHB_PEST_BAR 0x1a8
+#define PHB_PEST_BAR_ENABLE PPC_BIT(0)
+#define PHB_PEST_BASE_ADDRESS PPC_BITMASK(14, 51)
+#define PHB_M64_UPPER_BITS 0x1f0
+#define PHB_INTREP_TIMER 0x1f8
+#define PHB_DMARD_SYNC 0x200
+#define PHB_DMARD_SYNC_START PPC_BIT(0)
+#define PHB_DMARD_SYNC_COMPLETE PPC_BIT(1)
+#define PHB_RTC_INVALIDATE 0x208
+#define PHB_RTC_INVALIDATE_ALL PPC_BIT(0)
+#define PHB_RTC_INVALIDATE_RID PPC_BITMASK(16, 31)
+#define PHB_TCE_KILL 0x210
+#define PHB_TCE_KILL_ALL PPC_BIT(0)
+#define PHB_TCE_SPEC_CTL 0x218
+#define PHB_IODA_ADDR 0x220
+#define PHB_IODA_AD_AUTOINC PPC_BIT(0)
+#define PHB_IODA_AD_TSEL PPC_BITMASK(11, 15)
+#define PHB_IODA_AD_TADR PPC_BITMASK(55, 63)
+#define PHB_IODA_DATA0 0x228
+#define PHB_FFI_REQUEST 0x238
+#define PHB_FFI_LOCK_CLEAR PPC_BIT(3)
+#define PHB_FFI_REQUEST_ISN PPC_BITMASK(49, 59)
+#define PHB_FFI_LOCK 0x240
+#define PHB_FFI_LOCK_STATE PPC_BIT(0)
+#define PHB_XIVE_UPDATE 0x248 /* Broken in DD1 */
+#define PHB_PHB3_GEN_CAP 0x250
+#define PHB_PHB3_TCE_CAP 0x258
+#define PHB_PHB3_IRQ_CAP 0x260
+#define PHB_PHB3_EEH_CAP 0x268
+#define PHB_IVC_INVALIDATE 0x2a0
+#define PHB_IVC_INVALIDATE_ALL PPC_BIT(0)
+#define PHB_IVC_INVALIDATE_SID PPC_BITMASK(16, 31)
+#define PHB_IVC_UPDATE 0x2a8
+#define PHB_IVC_UPDATE_ENABLE_P PPC_BIT(0)
+#define PHB_IVC_UPDATE_ENABLE_Q PPC_BIT(1)
+#define PHB_IVC_UPDATE_ENABLE_SERVER PPC_BIT(2)
+#define PHB_IVC_UPDATE_ENABLE_PRI PPC_BIT(3)
+#define PHB_IVC_UPDATE_ENABLE_GEN PPC_BIT(4)
+#define PHB_IVC_UPDATE_ENABLE_CON PPC_BIT(5)
+#define PHB_IVC_UPDATE_GEN_MATCH PPC_BITMASK(6, 7)
+#define PHB_IVC_UPDATE_SERVER PPC_BITMASK(8, 23)
+#define PHB_IVC_UPDATE_PRI PPC_BITMASK(24, 31)
+#define PHB_IVC_UPDATE_GEN PPC_BITMASK(32, 33)
+#define PHB_IVC_UPDATE_P PPC_BITMASK(34, 34)
+#define PHB_IVC_UPDATE_Q PPC_BITMASK(35, 35)
+#define PHB_IVC_UPDATE_SID PPC_BITMASK(48, 63)
+#define PHB_PAPR_ERR_INJ_CTL 0x2b0
+#define PHB_PAPR_ERR_INJ_CTL_INB PPC_BIT(0)
+#define PHB_PAPR_ERR_INJ_CTL_OUTB PPC_BIT(1)
+#define PHB_PAPR_ERR_INJ_CTL_STICKY PPC_BIT(2)
+#define PHB_PAPR_ERR_INJ_CTL_CFG PPC_BIT(3)
+#define PHB_PAPR_ERR_INJ_CTL_RD PPC_BIT(4)
+#define PHB_PAPR_ERR_INJ_CTL_WR PPC_BIT(5)
+#define PHB_PAPR_ERR_INJ_CTL_FREEZE PPC_BIT(6)
+#define PHB_PAPR_ERR_INJ_ADDR 0x2b8
+#define PHB_PAPR_ERR_INJ_ADDR_MMIO PPC_BITMASK(16, 63)
+#define PHB_PAPR_ERR_INJ_MASK 0x2c0
+#define PHB_PAPR_ERR_INJ_MASK_CFG PPC_BITMASK(4, 11)
+#define PHB_PAPR_ERR_INJ_MASK_MMIO PPC_BITMASK(16, 63)
+#define PHB_ETU_ERR_SUMMARY 0x2c8
+
+/* UTL registers */
+#define UTL_SYS_BUS_CONTROL 0x400
+#define UTL_STATUS 0x408
+#define UTL_SYS_BUS_AGENT_STATUS 0x410
+#define UTL_SYS_BUS_AGENT_ERR_SEVERITY 0x418
+#define UTL_SYS_BUS_AGENT_IRQ_EN 0x420
+#define UTL_SYS_BUS_BURST_SZ_CONF 0x440
+#define UTL_REVISION_ID 0x448
+#define UTL_BCLK_DOMAIN_DBG1 0x460
+#define UTL_BCLK_DOMAIN_DBG2 0x468
+#define UTL_BCLK_DOMAIN_DBG3 0x470
+#define UTL_BCLK_DOMAIN_DBG4 0x478
+#define UTL_BCLK_DOMAIN_DBG5 0x480
+#define UTL_BCLK_DOMAIN_DBG6 0x488
+#define UTL_OUT_POST_HDR_BUF_ALLOC 0x4c0
+#define UTL_OUT_POST_DAT_BUF_ALLOC 0x4d0
+#define UTL_IN_POST_HDR_BUF_ALLOC 0x4e0
+#define UTL_IN_POST_DAT_BUF_ALLOC 0x4f0
+#define UTL_OUT_NP_BUF_ALLOC 0x500
+#define UTL_IN_NP_BUF_ALLOC 0x510
+#define UTL_PCIE_TAGS_ALLOC 0x520
+#define UTL_GBIF_READ_TAGS_ALLOC 0x530
+#define UTL_PCIE_PORT_CONTROL 0x540
+#define UTL_PCIE_PORT_STATUS 0x548
+#define UTL_PCIE_PORT_ERROR_SEV 0x550
+#define UTL_PCIE_PORT_IRQ_EN 0x558
+#define UTL_RC_STATUS 0x560
+#define UTL_RC_ERR_SEVERITY 0x568
+#define UTL_RC_IRQ_EN 0x570
+#define UTL_EP_STATUS 0x578
+#define UTL_EP_ERR_SEVERITY 0x580
+#define UTL_EP_ERR_IRQ_EN 0x588
+#define UTL_PCI_PM_CTRL1 0x590
+#define UTL_PCI_PM_CTRL2 0x598
+#define UTL_GP_CTL1 0x5a0
+#define UTL_GP_CTL2 0x5a8
+#define UTL_PCLK_DOMAIN_DBG1 0x5b0
+#define UTL_PCLK_DOMAIN_DBG2 0x5b8
+#define UTL_PCLK_DOMAIN_DBG3 0x5c0
+#define UTL_PCLK_DOMAIN_DBG4 0x5c8
+
+/* PCI-E Stack registers */
+#define PHB_PCIE_SYSTEM_CONFIG 0x600
+#define PHB_PCIE_BUS_NUMBER 0x608
+#define PHB_PCIE_SYSTEM_TEST 0x618
+#define PHB_PCIE_LINK_MANAGEMENT 0x630
+#define PHB_PCIE_LM_LINK_ACTIVE PPC_BIT(8)
+#define PHB_PCIE_DLP_TRAIN_CTL 0x640
+#define PHB_PCIE_DLP_TCTX_DISABLE PPC_BIT(1)
+#define PHB_PCIE_DLP_TCRX_DISABLED PPC_BIT(16)
+#define PHB_PCIE_DLP_INBAND_PRESENCE PPC_BIT(19)
+#define PHB_PCIE_DLP_TC_DL_LINKUP PPC_BIT(21)
+#define PHB_PCIE_DLP_TC_DL_PGRESET PPC_BIT(22)
+#define PHB_PCIE_DLP_TC_DL_LINKACT PPC_BIT(23)
+#define PHB_PCIE_SLOP_LOOPBACK_STATUS 0x648
+#define PHB_PCIE_SYS_LINK_INIT 0x668
+#define PHB_PCIE_UTL_CONFIG 0x670
+#define PHB_PCIE_DLP_CONTROL 0x678
+#define PHB_PCIE_UTL_ERRLOG1 0x680
+#define PHB_PCIE_UTL_ERRLOG2 0x688
+#define PHB_PCIE_UTL_ERRLOG3 0x690
+#define PHB_PCIE_UTL_ERRLOG4 0x698
+#define PHB_PCIE_DLP_ERRLOG1 0x6a0
+#define PHB_PCIE_DLP_ERRLOG2 0x6a8
+#define PHB_PCIE_DLP_ERR_STATUS 0x6b0
+#define PHB_PCIE_DLP_ERR_COUNTERS 0x6b8
+#define PHB_PCIE_UTL_ERR_INJECT 0x6c0
+#define PHB_PCIE_TLDLP_ERR_INJECT 0x6c8
+#define PHB_PCIE_LANE_EQ_CNTL0 0x6d0
+#define PHB_PCIE_LANE_EQ_CNTL1 0x6d8
+#define PHB_PCIE_LANE_EQ_CNTL2 0x6e0
+#define PHB_PCIE_LANE_EQ_CNTL3 0x6e8
+#define PHB_PCIE_STRAPPING 0x700
+
+/* Fundamental register set B */
+#define PHB_VERSION 0x800
+#define PHB_RESET 0x808
+#define PHB_CONTROL 0x810
+#define PHB_CTRL_IVE_128_BYTES PPC_BIT(24)
+#define PHB_AIB_RX_CRED_INIT_TIMER 0x818
+#define PHB_AIB_RX_CMD_CRED 0x820
+#define PHB_AIB_RX_DATA_CRED 0x828
+#define PHB_AIB_TX_CMD_CRED 0x830
+#define PHB_AIB_TX_DATA_CRED 0x838
+#define PHB_AIB_TX_CHAN_MAPPING 0x840
+#define PHB_AIB_TAG_ENABLE 0x858
+#define PHB_AIB_FENCE_CTRL 0x860
+#define PHB_TCE_TAG_ENABLE 0x868
+#define PHB_TCE_WATERMARK 0x870
+#define PHB_TIMEOUT_CTRL1 0x878
+#define PHB_TIMEOUT_CTRL2 0x880
+#define PHB_Q_DMA_R 0x888
+#define PHB_Q_DMA_R_QUIESCE_DMA PPC_BIT(0)
+#define PHB_Q_DMA_R_AUTORESET PPC_BIT(1)
+#define PHB_Q_DMA_R_DMA_RESP_STATUS PPC_BIT(4)
+#define PHB_Q_DMA_R_MMIO_RESP_STATUS PPC_BIT(5)
+#define PHB_Q_DMA_R_TCE_RESP_STATUS PPC_BIT(6)
+#define PHB_AIB_TAG_STATUS 0x900
+#define PHB_TCE_TAG_STATUS 0x908
+
+/* FIR & Error registers */
+#define PHB_LEM_FIR_ACCUM 0xc00
+#define PHB_LEM_FIR_AND_MASK 0xc08
+#define PHB_LEM_FIR_OR_MASK 0xc10
+#define PHB_LEM_ERROR_MASK 0xc18
+#define PHB_LEM_ERROR_AND_MASK 0xc20
+#define PHB_LEM_ERROR_OR_MASK 0xc28
+#define PHB_LEM_ACTION0 0xc30
+#define PHB_LEM_ACTION1 0xc38
+#define PHB_LEM_WOF 0xc40
+#define PHB_ERR_STATUS 0xc80
+#define PHB_ERR1_STATUS 0xc88
+#define PHB_ERR_INJECT 0xc90
+#define PHB_ERR_LEM_ENABLE 0xc98
+#define PHB_ERR_IRQ_ENABLE 0xca0
+#define PHB_ERR_FREEZE_ENABLE 0xca8
+#define PHB_ERR_AIB_FENCE_ENABLE 0xcb0
+#define PHB_ERR_LOG_0 0xcc0
+#define PHB_ERR_LOG_1 0xcc8
+#define PHB_ERR_STATUS_MASK 0xcd0
+#define PHB_ERR1_STATUS_MASK 0xcd8
+
+#define PHB_OUT_ERR_STATUS 0xd00
+#define PHB_OUT_ERR1_STATUS 0xd08
+#define PHB_OUT_ERR_INJECT 0xd10
+#define PHB_OUT_ERR_LEM_ENABLE 0xd18
+#define PHB_OUT_ERR_IRQ_ENABLE 0xd20
+#define PHB_OUT_ERR_FREEZE_ENABLE 0xd28
+#define PHB_OUT_ERR_AIB_FENCE_ENABLE 0xd30
+#define PHB_OUT_ERR_LOG_0 0xd40
+#define PHB_OUT_ERR_LOG_1 0xd48
+#define PHB_OUT_ERR_STATUS_MASK 0xd50
+#define PHB_OUT_ERR1_STATUS_MASK 0xd58
+
+#define PHB_INA_ERR_STATUS 0xd80
+#define PHB_INA_ERR1_STATUS 0xd88
+#define PHB_INA_ERR_INJECT 0xd90
+#define PHB_INA_ERR_LEM_ENABLE 0xd98
+#define PHB_INA_ERR_IRQ_ENABLE 0xda0
+#define PHB_INA_ERR_FREEZE_ENABLE 0xda8
+#define PHB_INA_ERR_AIB_FENCE_ENABLE 0xdb0
+#define PHB_INA_ERR_LOG_0 0xdc0
+#define PHB_INA_ERR_LOG_1 0xdc8
+#define PHB_INA_ERR_STATUS_MASK 0xdd0
+#define PHB_INA_ERR1_STATUS_MASK 0xdd8
+
+#define PHB_INB_ERR_STATUS 0xe00
+#define PHB_INB_ERR1_STATUS 0xe08
+#define PHB_INB_ERR_INJECT 0xe10
+#define PHB_INB_ERR_LEM_ENABLE 0xe18
+#define PHB_INB_ERR_IRQ_ENABLE 0xe20
+#define PHB_INB_ERR_FREEZE_ENABLE 0xe28
+#define PHB_INB_ERR_AIB_FENCE_ENABLE 0xe30
+#define PHB_INB_ERR_LOG_0 0xe40
+#define PHB_INB_ERR_LOG_1 0xe48
+#define PHB_INB_ERR_STATUS_MASK 0xe50
+#define PHB_INB_ERR1_STATUS_MASK 0xe58
+
+/* Performance monitor & Debug registers */
+#define PHB_TRACE_CONTROL 0xf80
+#define PHB_PERFMON_CONFIG 0xf88
+#define PHB_PERFMON_CTR0 0xf90
+#define PHB_PERFMON_CTR1 0xf98
+#define PHB_PERFMON_CTR2 0xfa0
+#define PHB_PERFMON_CTR3 0xfa8
+#define PHB_HOTPLUG_OVERRIDE 0xfb0
+#define PHB_HPOVR_FORCE_RESAMPLE PPC_BIT(9)
+#define PHB_HPOVR_PRESENCE_A PPC_BIT(10)
+#define PHB_HPOVR_PRESENCE_B PPC_BIT(11)
+#define PHB_HPOVR_LINK_ACTIVE PPC_BIT(12)
+#define PHB_HPOVR_LINK_BIFURCATED PPC_BIT(13)
+#define PHB_HPOVR_LINK_LANE_SWAPPED PPC_BIT(14)
+
+/*
+ * IODA2 on-chip tables
+ */
+
+#define IODA2_TBL_LIST 1
+#define IODA2_TBL_LXIVT 2
+#define IODA2_TBL_IVC_CAM 3
+#define IODA2_TBL_RBA 4
+#define IODA2_TBL_RCAM 5
+#define IODA2_TBL_MRT 6
+#define IODA2_TBL_PESTA 7
+#define IODA2_TBL_PESTB 8
+#define IODA2_TBL_TVT 9
+#define IODA2_TBL_TCAM 10
+#define IODA2_TBL_TDR 11
+#define IODA2_TBL_M64BT 16
+#define IODA2_TBL_M32DT 17
+#define IODA2_TBL_PEEV 20
+
+/* LXIVT */
+#define IODA2_LXIVT_SERVER PPC_BITMASK(8, 23)
+#define IODA2_LXIVT_PRIORITY PPC_BITMASK(24, 31)
+#define IODA2_LXIVT_NODE_ID PPC_BITMASK(56, 63)
+
+/* IVT */
+#define IODA2_IVT_SERVER PPC_BITMASK(0, 23)
+#define IODA2_IVT_PRIORITY PPC_BITMASK(24, 31)
+#define IODA2_IVT_GEN PPC_BITMASK(37, 38)
+#define IODA2_IVT_P PPC_BITMASK(39, 39)
+#define IODA2_IVT_Q PPC_BITMASK(47, 47)
+#define IODA2_IVT_PE PPC_BITMASK(48, 63)
+
+/* TVT */
+#define IODA2_TVT_TABLE_ADDR PPC_BITMASK(0, 47)
+#define IODA2_TVT_NUM_LEVELS PPC_BITMASK(48, 50)
+#define IODA2_TVE_1_LEVEL 0
+#define IODA2_TVE_2_LEVELS 1
+#define IODA2_TVE_3_LEVELS 2
+#define IODA2_TVE_4_LEVELS 3
+#define IODA2_TVE_5_LEVELS 4
+#define IODA2_TVT_TCE_TABLE_SIZE PPC_BITMASK(51, 55)
+#define IODA2_TVT_IO_PSIZE PPC_BITMASK(59, 63)
+
+/* PESTA */
+#define IODA2_PESTA_MMIO_FROZEN PPC_BIT(0)
+
+/* PESTB */
+#define IODA2_PESTB_DMA_STOPPED PPC_BIT(0)
+
+/* M32DT */
+#define IODA2_M32DT_PE PPC_BITMASK(8, 15)
+
+/* M64BT */
+#define IODA2_M64BT_ENABLE PPC_BIT(0)
+#define IODA2_M64BT_SINGLE_PE PPC_BIT(1)
+#define IODA2_M64BT_BASE PPC_BITMASK(2, 31)
+#define IODA2_M64BT_MASK PPC_BITMASK(34, 63)
+#define IODA2_M64BT_SINGLE_BASE PPC_BITMASK(2, 26)
+#define IODA2_M64BT_PE_HI PPC_BITMASK(27, 31)
+#define IODA2_M64BT_SINGLE_MASK PPC_BITMASK(34, 58)
+#define IODA2_M64BT_PE_LOW PPC_BITMASK(59, 63)
+
+/*
+ * IODA2 in-memory tables
+ */
+
+/*
+ * PEST
+ *
+ * 2x8 bytes entries, PEST0 and PEST1
+ */
+
+#define IODA2_PEST0_MMIO_CAUSE PPC_BIT(2)
+#define IODA2_PEST0_CFG_READ PPC_BIT(3)
+#define IODA2_PEST0_CFG_WRITE PPC_BIT(4)
+#define IODA2_PEST0_TTYPE PPC_BITMASK(5, 7)
+#define PEST_TTYPE_DMA_WRITE 0
+#define PEST_TTYPE_MSI 1
+#define PEST_TTYPE_DMA_READ 2
+#define PEST_TTYPE_DMA_READ_RESP 3
+#define PEST_TTYPE_MMIO_LOAD 4
+#define PEST_TTYPE_MMIO_STORE 5
+#define PEST_TTYPE_OTHER 7
+#define IODA2_PEST0_CA_RETURN PPC_BIT(8)
+#define IODA2_PEST0_UTL_RTOS_TIMEOUT PPC_BIT(8) /* Same bit as CA return */
+#define IODA2_PEST0_UR_RETURN PPC_BIT(9)
+#define IODA2_PEST0_UTL_NONFATAL PPC_BIT(10)
+#define IODA2_PEST0_UTL_FATAL PPC_BIT(11)
+#define IODA2_PEST0_PARITY_UE PPC_BIT(13)
+#define IODA2_PEST0_UTL_CORRECTABLE PPC_BIT(14)
+#define IODA2_PEST0_UTL_INTERRUPT PPC_BIT(15)
+#define IODA2_PEST0_MMIO_XLATE PPC_BIT(16)
+#define IODA2_PEST0_IODA2_ERROR PPC_BIT(16) /* Same bit as MMIO xlate */
+#define IODA2_PEST0_TCE_PAGE_FAULT PPC_BIT(18)
+#define IODA2_PEST0_TCE_ACCESS_FAULT PPC_BIT(19)
+#define IODA2_PEST0_DMA_RESP_TIMEOUT PPC_BIT(20)
+#define IODA2_PEST0_AIB_SIZE_INVALID PPC_BIT(21)
+#define IODA2_PEST0_LEM_BIT PPC_BITMASK(26, 31)
+#define IODA2_PEST0_RID PPC_BITMASK(32, 47)
+#define IODA2_PEST0_MSI_DATA PPC_BITMASK(48, 63)
+
+#define IODA2_PEST1_FAIL_ADDR PPC_BITMASK(3, 63)
+
+
+#endif /* PCI_HOST_PNV_PHB3_REGS_H */
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index 805f9058f5..fb4d0c0234 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -30,6 +30,7 @@
#include "hw/ppc/pnv_homer.h"
#include "hw/ppc/pnv_xive.h"
#include "hw/ppc/pnv_core.h"
+#include "hw/pci-host/pnv_phb3.h"
#include "hw/pci-host/pnv_phb4.h"
#define TYPE_PNV_CHIP "pnv-chip"
@@ -77,6 +78,9 @@ typedef struct Pnv8Chip {
PnvOCC occ;
PnvHomer homer;
+#define PNV8_CHIP_PHB3_MAX 4
+ PnvPHB3 phbs[PNV8_CHIP_PHB3_MAX];
+
XICSFabric *xics;
} Pnv8Chip;
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index 0fc57b0367..09156a5a7a 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -71,6 +71,15 @@ typedef struct PnvXScomInterfaceClass {
#define PNV_XSCOM_PBA_BASE 0x2013f00
#define PNV_XSCOM_PBA_SIZE 0x40
+#define PNV_XSCOM_PBCQ_NEST_BASE 0x2012000
+#define PNV_XSCOM_PBCQ_NEST_SIZE 0x46
+
+#define PNV_XSCOM_PBCQ_PCI_BASE 0x9012000
+#define PNV_XSCOM_PBCQ_PCI_SIZE 0x15
+
+#define PNV_XSCOM_PBCQ_SPCI_BASE 0x9013c00
+#define PNV_XSCOM_PBCQ_SPCI_SIZE 0x5
+
/*
* Layout of the XSCOM PCB addresses (POWER 9)
*/
diff --git a/include/hw/ppc/xics.h b/include/hw/ppc/xics.h
index 48a75aa4ab..9ed58ec7e9 100644
--- a/include/hw/ppc/xics.h
+++ b/include/hw/ppc/xics.h
@@ -101,6 +101,10 @@ struct ICSStateClass {
DeviceClass parent_class;
DeviceRealize parent_realize;
+ DeviceReset parent_reset;
+
+ void (*reject)(ICSState *s, uint32_t irq);
+ void (*resend)(ICSState *s);
};
struct ICSState {
@@ -161,6 +165,7 @@ void icp_set_mfrr(ICPState *icp, uint8_t mfrr);
uint32_t icp_accept(ICPState *ss);
uint32_t icp_ipoll(ICPState *ss, uint32_t *mfrr);
void icp_eoi(ICPState *icp, uint32_t xirr);
+void icp_irq(ICSState *ics, int server, int nr, uint8_t priority);
void icp_reset(ICPState *icp);
void ics_write_xive(ICSState *ics, int nr, int server,
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 21/35] ppc/pnv: change the PowerNV machine devices to be non user creatable
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (19 preceding siblings ...)
2020-02-03 6:11 ` [PULL 20/35] ppc/pnv: Add models for POWER8 PHB3 " David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 22/35] spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine David Gibson
` (14 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Thomas Huth, qemu-devel, groug, qemu-ppc,
Cédric Le Goater, David Gibson
From: Cédric Le Goater <clg@kaod.org>
The PowerNV machine emulates an OpenPOWER system and the PowerNV chip
devices are models of the internal logic of the POWER processor. They
can not be instantiated by the user on the QEMU command line.
The PHB3/PHB4 devices could be an exception in the future after some
rework on how the device tree is built. For the moment, exclude them
also.
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200129113720.7404-1-clg@kaod.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/pci-host/pnv_phb3.c | 2 ++
hw/pci-host/pnv_phb3_pbcq.c | 1 +
hw/pci-host/pnv_phb4.c | 3 ++-
hw/pci-host/pnv_phb4_pec.c | 2 ++
hw/ppc/pnv_core.c | 2 ++
hw/ppc/pnv_homer.c | 1 +
hw/ppc/pnv_lpc.c | 1 +
hw/ppc/pnv_occ.c | 1 +
8 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index f03399c406..74618fadf0 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -1115,6 +1115,7 @@ static void pnv_phb3_class_init(ObjectClass *klass, void *data)
dc->realize = pnv_phb3_realize;
device_class_set_props(dc, pnv_phb3_properties);
set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+ dc->user_creatable = false;
}
static const TypeInfo pnv_phb3_type_info = {
@@ -1168,6 +1169,7 @@ static void pnv_phb3_root_port_class_init(ObjectClass *klass, void *data)
device_class_set_parent_realize(dc, pnv_phb3_root_port_realize,
&rpc->parent_realize);
+ dc->user_creatable = false;
k->vendor_id = PCI_VENDOR_ID_IBM;
k->device_id = 0x03dc;
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
index 6f0c05be68..f232228b0e 100644
--- a/hw/pci-host/pnv_phb3_pbcq.c
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -335,6 +335,7 @@ static void pnv_pbcq_class_init(ObjectClass *klass, void *data)
xdc->dt_xscom = pnv_pbcq_dt_xscom;
dc->realize = pnv_pbcq_realize;
+ dc->user_creatable = false;
}
static const TypeInfo pnv_pbcq_type_info = {
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 61235d13a6..23cf093928 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1290,7 +1290,7 @@ static void pnv_phb4_class_init(ObjectClass *klass, void *data)
dc->realize = pnv_phb4_realize;
device_class_set_props(dc, pnv_phb4_properties);
set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
- dc->user_creatable = true;
+ dc->user_creatable = false;
dc->reset = pnv_phb4_reset;
xfc->notify = pnv_phb4_xive_notify;
@@ -1368,6 +1368,7 @@ static void pnv_phb4_root_port_class_init(ObjectClass *klass, void *data)
PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
dc->desc = "IBM PHB4 PCIE Root Port";
+ dc->user_creatable = false;
device_class_set_parent_realize(dc, pnv_phb4_root_port_realize,
&rpc->parent_realize);
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index fd92041d69..68e1db3eac 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -490,6 +490,7 @@ static void pnv_pec_class_init(ObjectClass *klass, void *data)
dc->realize = pnv_pec_realize;
device_class_set_props(dc, pnv_pec_properties);
+ dc->user_creatable = false;
pecc->xscom_nest_base = pnv_pec_xscom_nest_base;
pecc->xscom_pci_base = pnv_pec_xscom_pci_base;
@@ -568,6 +569,7 @@ static void pnv_pec_stk_class_init(ObjectClass *klass, void *data)
device_class_set_props(dc, pnv_pec_stk_properties);
dc->realize = pnv_pec_stk_realize;
+ dc->user_creatable = false;
/* TODO: reset regs ? */
}
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index f7247222bc..234562040d 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -325,6 +325,7 @@ static void pnv_core_class_init(ObjectClass *oc, void *data)
dc->realize = pnv_core_realize;
dc->unrealize = pnv_core_unrealize;
device_class_set_props(dc, pnv_core_properties);
+ dc->user_creatable = false;
}
#define DEFINE_PNV_CORE_TYPE(family, cpu_model) \
@@ -423,6 +424,7 @@ static void pnv_quad_class_init(ObjectClass *oc, void *data)
dc->realize = pnv_quad_realize;
device_class_set_props(dc, pnv_quad_properties);
+ dc->user_creatable = false;
}
static const TypeInfo pnv_quad_info = {
diff --git a/hw/ppc/pnv_homer.c b/hw/ppc/pnv_homer.c
index 93ae42f7e4..9a262629b7 100644
--- a/hw/ppc/pnv_homer.c
+++ b/hw/ppc/pnv_homer.c
@@ -360,6 +360,7 @@ static void pnv_homer_class_init(ObjectClass *klass, void *data)
dc->realize = pnv_homer_realize;
dc->desc = "PowerNV HOMER Memory";
device_class_set_props(dc, pnv_homer_properties);
+ dc->user_creatable = false;
}
static const TypeInfo pnv_homer_type_info = {
diff --git a/hw/ppc/pnv_lpc.c b/hw/ppc/pnv_lpc.c
index d1de98f04c..5989d723c5 100644
--- a/hw/ppc/pnv_lpc.c
+++ b/hw/ppc/pnv_lpc.c
@@ -762,6 +762,7 @@ static void pnv_lpc_class_init(ObjectClass *klass, void *data)
dc->realize = pnv_lpc_realize;
dc->desc = "PowerNV LPC Controller";
device_class_set_props(dc, pnv_lpc_properties);
+ dc->user_creatable = false;
}
static const TypeInfo pnv_lpc_info = {
diff --git a/hw/ppc/pnv_occ.c b/hw/ppc/pnv_occ.c
index 2173fac0e7..5a716c256e 100644
--- a/hw/ppc/pnv_occ.c
+++ b/hw/ppc/pnv_occ.c
@@ -280,6 +280,7 @@ static void pnv_occ_class_init(ObjectClass *klass, void *data)
dc->realize = pnv_occ_realize;
dc->desc = "PowerNV OCC Controller";
device_class_set_props(dc, pnv_occ_properties);
+ dc->user_creatable = false;
}
static const TypeInfo pnv_occ_type_info = {
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 22/35] spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (20 preceding siblings ...)
2020-02-03 6:11 ` [PULL 21/35] ppc/pnv: change the PowerNV machine devices to be non user creatable David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 23/35] target/ppc/cpu.h: Put macro parameter in parentheses David Gibson
` (13 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Michael Ellerman, qemu-devel, groug, qemu-ppc, David Gibson
For POWER9 DD2.2 cpus, the best current Spectre v2 indirect branch
mitigation is "count cache disabled", which is configured with:
-machine cap-ibs=fixed-ccd
However, this option isn't available on DD2.3 CPUs with KVM, because they
don't have the count cache disabled.
For POWER9 DD2.3 cpus, it is "count cache flush with assist", configured
with:
-machine cap-ibs=workaround,cap-ccf-assist=on
However this option isn't available on DD2.2 CPUs with KVM, because they
don't have the special CCF assist instruction this relies on.
On current machine types, we default to "count cache flush w/o assist",
that is:
-machine cap-ibs=workaround,cap-ccf-assist=off
This runs, with mitigation on both DD2.2 and DD2.3 host cpus, but has a
fairly significant performance impact.
It turns out we can do better. The special instruction that CCF assist
uses to trigger a count cache flush is a no-op on earlier CPUs, rather than
trapping or causing other badness. It doesn't, of itself, implement the
mitigation, but *if* we have count-cache-disabled, then the count cache
flush is unnecessary, and so using the count cache flush mitigation is
harmless.
Therefore for the new pseries-5.0 machine type, enable cap-ccf-assist by
default. Along with that, suppress throwing an error if cap-ccf-assist
is selected but KVM doesn't support it, as long as KVM *is* giving us
count-cache-disabled. To allow TCG to work out of the box, even though it
doesn't implement the ccf flush assist, downgrade the error in that case to
a warning. This matches several Spectre mitigations where we allow TCG
to operate for debugging, since we don't really make guarantees about TCG
security properties anyway.
While we're there, make the TCG warning for this case match that for other
mitigations.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Tested-by: Michael Ellerman <mpe@ellerman.id.au>
---
hw/ppc/spapr.c | 5 ++++-
hw/ppc/spapr_caps.c | 21 +++++++++++++++++----
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index a0076e5fbd..fe8266a1d1 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4397,7 +4397,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
smc->default_caps.caps[SPAPR_CAP_HPT_MAXPAGESIZE] = 16; /* 64kiB */
smc->default_caps.caps[SPAPR_CAP_NESTED_KVM_HV] = SPAPR_CAP_OFF;
smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_ON;
- smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
+ smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_ON;
spapr_caps_add_properties(smc, &error_abort);
smc->irq = &spapr_irq_dual;
smc->dr_phb_enabled = true;
@@ -4465,8 +4465,11 @@ DEFINE_SPAPR_MACHINE(5_0, "5.0", true);
*/
static void spapr_machine_4_2_class_options(MachineClass *mc)
{
+ SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
spapr_machine_5_0_class_options(mc);
compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+ smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
}
DEFINE_SPAPR_MACHINE(4_2, "4.2", false);
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index 481dfd2a27..7f933a98ed 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -485,11 +485,24 @@ static void cap_ccf_assist_apply(SpaprMachineState *spapr, uint8_t val,
uint8_t kvm_val = kvmppc_get_cap_count_cache_flush_assist();
if (tcg_enabled() && val) {
- /* TODO - for now only allow broken for TCG */
- error_setg(errp,
-"Requested count cache flush assist capability level not supported by tcg,"
- " try appending -machine cap-ccf-assist=off");
+ /* TCG doesn't implement anything here, but allow with a warning */
+ warn_report("TCG doesn't support requested feature, cap-ccf-assist=on");
} else if (kvm_enabled() && (val > kvm_val)) {
+ uint8_t kvm_ibs = kvmppc_get_cap_safe_indirect_branch();
+
+ if (kvm_ibs == SPAPR_CAP_FIXED_CCD) {
+ /*
+ * If we don't have CCF assist on the host, the assist
+ * instruction is a harmless no-op. It won't correctly
+ * implement the cache count flush *but* if we have
+ * count-cache-disabled in the host, that flush is
+ * unnnecessary. So, specifically allow this case. This
+ * allows us to have better performance on POWER9 DD2.3,
+ * while still working on POWER9 DD2.2 and POWER8 host
+ * cpus.
+ */
+ return;
+ }
error_setg(errp,
"Requested count cache flush assist capability level not supported by kvm,"
" try appending -machine cap-ccf-assist=off");
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 23/35] target/ppc/cpu.h: Put macro parameter in parentheses
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (21 preceding siblings ...)
2020-02-03 6:11 ` [PULL 22/35] spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 24/35] Wrapper function to wait on condition for the main loop mutex David Gibson
` (12 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell; +Cc: lvivier, qemu-devel, groug, qemu-ppc, David Gibson
From: BALATON Zoltan <balaton@eik.bme.hu>
Fix PPC_INPUT macro to work with more complex expressions by
protecting its argument with parentheses.
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-Id: <20200130021619.65FAB747871@zero.eik.bme.hu>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/cpu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 96aeea1934..3a1eb76004 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -180,7 +180,7 @@ enum {
POWERPC_EXCP_TRAP = 0x40,
};
-#define PPC_INPUT(env) (env->bus_model)
+#define PPC_INPUT(env) ((env)->bus_model)
/*****************************************************************************/
typedef struct opc_handler_t opc_handler_t;
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 24/35] Wrapper function to wait on condition for the main loop mutex
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (22 preceding siblings ...)
2020-02-03 6:11 ` [PULL 23/35] target/ppc/cpu.h: Put macro parameter in parentheses David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 25/35] ppc: spapr: Introduce FWNMI capability David Gibson
` (11 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
Introduce a wrapper function to wait on condition for
the main loop mutex. This function atomically releases
the main loop mutex and causes the calling thread to
block on the condition. This wrapper is required because
qemu_global_mutex is a static variable.
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20200130184423.20519-2-ganeshgr@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
cpus.c | 5 +++++
include/qemu/main-loop.h | 8 ++++++++
2 files changed, 13 insertions(+)
diff --git a/cpus.c b/cpus.c
index b612116f95..b4f8b84b61 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1839,6 +1839,11 @@ void qemu_mutex_unlock_iothread(void)
qemu_mutex_unlock(&qemu_global_mutex);
}
+void qemu_cond_wait_iothread(QemuCond *cond)
+{
+ qemu_cond_wait(cond, &qemu_global_mutex);
+}
+
static bool all_vcpus_paused(void)
{
CPUState *cpu;
diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index f6ba78ea73..a6d20b0719 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -295,6 +295,14 @@ void qemu_mutex_lock_iothread_impl(const char *file, int line);
*/
void qemu_mutex_unlock_iothread(void);
+/*
+ * qemu_cond_wait_iothread: Wait on condition for the main loop mutex
+ *
+ * This function atomically releases the main loop mutex and causes
+ * the calling thread to block on the condition.
+ */
+void qemu_cond_wait_iothread(QemuCond *cond);
+
/* internal interfaces */
void qemu_fd_register(int fd);
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 25/35] ppc: spapr: Introduce FWNMI capability
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (23 preceding siblings ...)
2020-02-03 6:11 ` [PULL 24/35] Wrapper function to wait on condition for the main loop mutex David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 26/35] target/ppc: Handle NMI guest exit David Gibson
` (10 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
Introduce fwnmi an spapr capability and add a helper function
which tries to enable it, which would be used by following patch
of the series. This patch by itself does not change the existing
behavior.
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
[eliminate cap_ppc_fwnmi, add fwnmi cap to migration state
and reprhase the commit message]
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20200130184423.20519-3-ganeshgr@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr.c | 2 ++
hw/ppc/spapr_caps.c | 18 ++++++++++++++++++
include/hw/ppc/spapr.h | 5 ++++-
target/ppc/kvm.c | 8 ++++++++
target/ppc/kvm_ppc.h | 6 ++++++
5 files changed, 38 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index fe8266a1d1..aa739e943f 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1992,6 +1992,7 @@ static const VMStateDescription vmstate_spapr = {
&vmstate_spapr_dtb,
&vmstate_spapr_cap_large_decr,
&vmstate_spapr_cap_ccf_assist,
+ &vmstate_spapr_cap_fwnmi,
NULL
}
};
@@ -4398,6 +4399,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
smc->default_caps.caps[SPAPR_CAP_NESTED_KVM_HV] = SPAPR_CAP_OFF;
smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_ON;
smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_ON;
+ smc->default_caps.caps[SPAPR_CAP_FWNMI_MCE] = SPAPR_CAP_OFF;
spapr_caps_add_properties(smc, &error_abort);
smc->irq = &spapr_irq_dual;
smc->dr_phb_enabled = true;
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index 7f933a98ed..393ee6845e 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -509,6 +509,14 @@ static void cap_ccf_assist_apply(SpaprMachineState *spapr, uint8_t val,
}
}
+static void cap_fwnmi_mce_apply(SpaprMachineState *spapr, uint8_t val,
+ Error **errp)
+{
+ if (!val) {
+ return; /* Disabled by default */
+ }
+}
+
SpaprCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
[SPAPR_CAP_HTM] = {
.name = "htm",
@@ -608,6 +616,15 @@ SpaprCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
.type = "bool",
.apply = cap_ccf_assist_apply,
},
+ [SPAPR_CAP_FWNMI_MCE] = {
+ .name = "fwnmi-mce",
+ .description = "Handle fwnmi machine check exceptions",
+ .index = SPAPR_CAP_FWNMI_MCE,
+ .get = spapr_cap_get_bool,
+ .set = spapr_cap_set_bool,
+ .type = "bool",
+ .apply = cap_fwnmi_mce_apply,
+ },
};
static SpaprCapabilities default_caps_with_cpu(SpaprMachineState *spapr,
@@ -747,6 +764,7 @@ SPAPR_CAP_MIG_STATE(hpt_maxpagesize, SPAPR_CAP_HPT_MAXPAGESIZE);
SPAPR_CAP_MIG_STATE(nested_kvm_hv, SPAPR_CAP_NESTED_KVM_HV);
SPAPR_CAP_MIG_STATE(large_decr, SPAPR_CAP_LARGE_DECREMENTER);
SPAPR_CAP_MIG_STATE(ccf_assist, SPAPR_CAP_CCF_ASSIST);
+SPAPR_CAP_MIG_STATE(fwnmi, SPAPR_CAP_FWNMI_MCE);
void spapr_caps_init(SpaprMachineState *spapr)
{
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 61f005c6f6..7bc5fc3a9e 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -79,8 +79,10 @@ typedef enum {
#define SPAPR_CAP_LARGE_DECREMENTER 0x08
/* Count Cache Flush Assist HW Instruction */
#define SPAPR_CAP_CCF_ASSIST 0x09
+/* FWNMI machine check handling */
+#define SPAPR_CAP_FWNMI_MCE 0x0A
/* Num Caps */
-#define SPAPR_CAP_NUM (SPAPR_CAP_CCF_ASSIST + 1)
+#define SPAPR_CAP_NUM (SPAPR_CAP_FWNMI_MCE + 1)
/*
* Capability Values
@@ -869,6 +871,7 @@ extern const VMStateDescription vmstate_spapr_cap_hpt_maxpagesize;
extern const VMStateDescription vmstate_spapr_cap_nested_kvm_hv;
extern const VMStateDescription vmstate_spapr_cap_large_decr;
extern const VMStateDescription vmstate_spapr_cap_ccf_assist;
+extern const VMStateDescription vmstate_spapr_cap_fwnmi;
static inline uint8_t spapr_get_cap(SpaprMachineState *spapr, int cap)
{
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index c05dde5985..4438d0c743 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2057,6 +2057,14 @@ void kvmppc_set_mpic_proxy(PowerPCCPU *cpu, int mpic_proxy)
}
}
+int kvmppc_set_fwnmi(void)
+{
+ PowerPCCPU *cpu = POWERPC_CPU(first_cpu);
+ CPUState *cs = CPU(cpu);
+
+ return kvm_vcpu_enable_cap(cs, KVM_CAP_PPC_FWNMI, 0);
+}
+
int kvmppc_smt_threads(void)
{
return cap_ppc_smt ? cap_ppc_smt : 1;
diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index b713097bfb..2c60dedd0d 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -27,6 +27,7 @@ void kvmppc_enable_h_page_init(void);
void kvmppc_set_papr(PowerPCCPU *cpu);
int kvmppc_set_compat(PowerPCCPU *cpu, uint32_t compat_pvr);
void kvmppc_set_mpic_proxy(PowerPCCPU *cpu, int mpic_proxy);
+int kvmppc_set_fwnmi(void);
int kvmppc_smt_threads(void);
void kvmppc_error_append_smt_possible_hint(Error *const *errp);
int kvmppc_set_smt_threads(int smt);
@@ -160,6 +161,11 @@ static inline void kvmppc_set_mpic_proxy(PowerPCCPU *cpu, int mpic_proxy)
{
}
+static inline int kvmppc_set_fwnmi(void)
+{
+ return -1;
+}
+
static inline int kvmppc_smt_threads(void)
{
return 1;
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 26/35] target/ppc: Handle NMI guest exit
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (24 preceding siblings ...)
2020-02-03 6:11 ` [PULL 25/35] ppc: spapr: Introduce FWNMI capability David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 27/35] target/ppc: Build rtas error log upon an MCE David Gibson
` (9 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
Memory error such as bit flips that cannot be corrected
by hardware are passed on to the kernel for handling.
If the memory address in error belongs to guest then
the guest kernel is responsible for taking suitable action.
Patch [1] enhances KVM to exit guest with exit reason
set to KVM_EXIT_NMI in such cases. This patch handles
KVM_EXIT_NMI exit.
[1] https://www.spinics.net/lists/kvm-ppc/msg12637.html
(e20bbd3d and related commits)
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20200130184423.20519-4-ganeshgr@linux.ibm.com>
[dwg: #ifdefs to fix compile for 32-bit target]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr.c | 8 ++++++++
hw/ppc/spapr_events.c | 37 +++++++++++++++++++++++++++++++++++++
include/hw/ppc/spapr.h | 10 ++++++++++
target/ppc/kvm.c | 18 ++++++++++++++++++
target/ppc/kvm_ppc.h | 2 ++
target/ppc/trace-events | 1 +
6 files changed, 76 insertions(+)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index aa739e943f..06e295cdf1 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1677,6 +1677,12 @@ static void spapr_machine_reset(MachineState *machine)
first_ppc_cpu->env.gpr[5] = 0;
spapr->cas_reboot = false;
+
+ spapr->mc_status = -1;
+ spapr->guest_machine_check_addr = -1;
+
+ /* Signal all vCPUs waiting on this condition */
+ qemu_cond_broadcast(&spapr->mc_delivery_cond);
}
static void spapr_create_nvram(SpaprMachineState *spapr)
@@ -2971,6 +2977,8 @@ static void spapr_machine_init(MachineState *machine)
kvmppc_spapr_enable_inkernel_multitce();
}
+
+ qemu_cond_init(&spapr->mc_delivery_cond);
}
static int spapr_kvm_type(MachineState *machine, const char *vm_type)
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index e355e000d0..dfc0de840a 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -40,6 +40,7 @@
#include "hw/ppc/spapr_drc.h"
#include "qemu/help_option.h"
#include "qemu/bcd.h"
+#include "qemu/main-loop.h"
#include "hw/ppc/spapr_ovec.h"
#include <libfdt.h>
@@ -622,6 +623,42 @@ void spapr_hotplug_req_remove_by_count_indexed(SpaprDrcType drc_type,
RTAS_LOG_V6_HP_ACTION_REMOVE, drc_type, &drc_id);
}
+void spapr_mce_req_event(PowerPCCPU *cpu)
+{
+ SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
+ CPUState *cs = CPU(cpu);
+
+ if (spapr->guest_machine_check_addr == -1) {
+ /*
+ * This implies that we have hit a machine check either when the
+ * guest has not registered FWNMI (i.e., "ibm,nmi-register" not
+ * called) or between system reset and "ibm,nmi-register".
+ * Fall back to the old machine check behavior in such cases.
+ */
+ cs->exception_index = POWERPC_EXCP_MCHECK;
+ ppc_cpu_do_interrupt(cs);
+ return;
+ }
+
+ while (spapr->mc_status != -1) {
+ /*
+ * Check whether the same CPU got machine check error
+ * while still handling the mc error (i.e., before
+ * that CPU called "ibm,nmi-interlock")
+ */
+ if (spapr->mc_status == cpu->vcpu_id) {
+ qemu_system_guest_panicked(NULL);
+ return;
+ }
+ qemu_cond_wait_iothread(&spapr->mc_delivery_cond);
+ /* Meanwhile if the system is reset, then just return */
+ if (spapr->guest_machine_check_addr == -1) {
+ return;
+ }
+ }
+ spapr->mc_status = cpu->vcpu_id;
+}
+
static void check_exception(PowerPCCPU *cpu, SpaprMachineState *spapr,
uint32_t token, uint32_t nargs,
target_ulong args,
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 7bc5fc3a9e..909d3976f9 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -191,6 +191,15 @@ struct SpaprMachineState {
* occurs during the unplug process. */
QTAILQ_HEAD(, SpaprDimmState) pending_dimm_unplugs;
+ /* State related to "ibm,nmi-register" and "ibm,nmi-interlock" calls */
+ target_ulong guest_machine_check_addr;
+ /*
+ * mc_status is set to -1 if mc is not in progress, else is set to the CPU
+ * handling the mc.
+ */
+ int mc_status;
+ QemuCond mc_delivery_cond;
+
/*< public >*/
char *kvm_type;
char *host_model;
@@ -804,6 +813,7 @@ void spapr_clear_pending_events(SpaprMachineState *spapr);
int spapr_max_server_number(SpaprMachineState *spapr);
void spapr_store_hpte(PowerPCCPU *cpu, hwaddr ptex,
uint64_t pte0, uint64_t pte1);
+void spapr_mce_req_event(PowerPCCPU *cpu);
/* DRC callbacks. */
void spapr_core_release(DeviceState *dev);
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 4438d0c743..56a6865521 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1705,6 +1705,13 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
ret = 0;
break;
+#if defined(TARGET_PPC64)
+ case KVM_EXIT_NMI:
+ trace_kvm_handle_nmi_exception();
+ ret = kvm_handle_nmi(cpu, run);
+ break;
+#endif
+
default:
fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
ret = -1;
@@ -2800,6 +2807,17 @@ int kvm_arch_msi_data_to_gsi(uint32_t data)
return data & 0xffff;
}
+#if defined(TARGET_PPC64)
+int kvm_handle_nmi(PowerPCCPU *cpu, struct kvm_run *run)
+{
+ cpu_synchronize_state(CPU(cpu));
+
+ spapr_mce_req_event(cpu);
+
+ return 0;
+}
+#endif
+
int kvmppc_enable_hwrng(void)
{
if (!kvm_enabled() || !kvm_check_extension(kvm_state, KVM_CAP_PPC_HWRNG)) {
diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index 2c60dedd0d..9e4f2357cc 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -84,6 +84,8 @@ void kvm_check_mmu(PowerPCCPU *cpu, Error **errp);
void kvmppc_set_reg_ppc_online(PowerPCCPU *cpu, unsigned int online);
void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset);
+int kvm_handle_nmi(PowerPCCPU *cpu, struct kvm_run *run);
+
#else
static inline uint32_t kvmppc_get_tbfreq(void)
diff --git a/target/ppc/trace-events b/target/ppc/trace-events
index 3dc6740706..6d15aa90b4 100644
--- a/target/ppc/trace-events
+++ b/target/ppc/trace-events
@@ -28,3 +28,4 @@ kvm_handle_papr_hcall(void) "handle PAPR hypercall"
kvm_handle_epr(void) "handle epr"
kvm_handle_watchdog_expiry(void) "handle watchdog expiry"
kvm_handle_debug_exception(void) "handle debug exception"
+kvm_handle_nmi_exception(void) "handle NMI exception"
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 27/35] target/ppc: Build rtas error log upon an MCE
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (25 preceding siblings ...)
2020-02-03 6:11 ` [PULL 26/35] target/ppc: Handle NMI guest exit David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 28/35] ppc: spapr: Handle "ibm, nmi-register" and "ibm, nmi-interlock" RTAS calls David Gibson
` (8 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
Upon a machine check exception (MCE) in a guest address space,
KVM causes a guest exit to enable QEMU to build and pass the
error to the guest in the PAPR defined rtas error log format.
This patch builds the rtas error log, copies it to the rtas_addr
and then invokes the guest registered machine check handler. The
handler in the guest takes suitable action(s) depending on the type
and criticality of the error. For example, if an error is
unrecoverable memory corruption in an application inside the
guest, then the guest kernel sends a SIGBUS to the application.
For recoverable errors, the guest performs recovery actions and
logs the error.
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
[Assume SLOF has allocated enough room for rtas error log]
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20200130184423.20519-5-ganeshgr@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr_events.c | 220 ++++++++++++++++++++++++++++++++++++++++-
hw/ppc/spapr_rtas.c | 26 +++++
include/hw/ppc/spapr.h | 6 +-
target/ppc/kvm.c | 4 +-
4 files changed, 253 insertions(+), 3 deletions(-)
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index dfc0de840a..54eaf28a9e 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -214,6 +214,104 @@ struct hp_extended_log {
struct rtas_event_log_v6_hp hp;
} QEMU_PACKED;
+struct rtas_event_log_v6_mc {
+#define RTAS_LOG_V6_SECTION_ID_MC 0x4D43 /* MC */
+ struct rtas_event_log_v6_section_header hdr;
+ uint32_t fru_id;
+ uint32_t proc_id;
+ uint8_t error_type;
+#define RTAS_LOG_V6_MC_TYPE_UE 0
+#define RTAS_LOG_V6_MC_TYPE_SLB 1
+#define RTAS_LOG_V6_MC_TYPE_ERAT 2
+#define RTAS_LOG_V6_MC_TYPE_TLB 4
+#define RTAS_LOG_V6_MC_TYPE_D_CACHE 5
+#define RTAS_LOG_V6_MC_TYPE_I_CACHE 7
+ uint8_t sub_err_type;
+#define RTAS_LOG_V6_MC_UE_INDETERMINATE 0
+#define RTAS_LOG_V6_MC_UE_IFETCH 1
+#define RTAS_LOG_V6_MC_UE_PAGE_TABLE_WALK_IFETCH 2
+#define RTAS_LOG_V6_MC_UE_LOAD_STORE 3
+#define RTAS_LOG_V6_MC_UE_PAGE_TABLE_WALK_LOAD_STORE 4
+#define RTAS_LOG_V6_MC_SLB_PARITY 0
+#define RTAS_LOG_V6_MC_SLB_MULTIHIT 1
+#define RTAS_LOG_V6_MC_SLB_INDETERMINATE 2
+#define RTAS_LOG_V6_MC_ERAT_PARITY 1
+#define RTAS_LOG_V6_MC_ERAT_MULTIHIT 2
+#define RTAS_LOG_V6_MC_ERAT_INDETERMINATE 3
+#define RTAS_LOG_V6_MC_TLB_PARITY 1
+#define RTAS_LOG_V6_MC_TLB_MULTIHIT 2
+#define RTAS_LOG_V6_MC_TLB_INDETERMINATE 3
+ uint8_t reserved_1[6];
+ uint64_t effective_address;
+ uint64_t logical_address;
+} QEMU_PACKED;
+
+struct mc_extended_log {
+ struct rtas_event_log_v6 v6hdr;
+ struct rtas_event_log_v6_mc mc;
+} QEMU_PACKED;
+
+struct MC_ierror_table {
+ unsigned long srr1_mask;
+ unsigned long srr1_value;
+ bool nip_valid; /* nip is a valid indicator of faulting address */
+ uint8_t error_type;
+ uint8_t error_subtype;
+ unsigned int initiator;
+ unsigned int severity;
+};
+
+static const struct MC_ierror_table mc_ierror_table[] = {
+{ 0x00000000081c0000, 0x0000000000040000, true,
+ RTAS_LOG_V6_MC_TYPE_UE, RTAS_LOG_V6_MC_UE_IFETCH,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000000081c0000, 0x0000000000080000, true,
+ RTAS_LOG_V6_MC_TYPE_SLB, RTAS_LOG_V6_MC_SLB_PARITY,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000000081c0000, 0x00000000000c0000, true,
+ RTAS_LOG_V6_MC_TYPE_SLB, RTAS_LOG_V6_MC_SLB_MULTIHIT,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000000081c0000, 0x0000000000100000, true,
+ RTAS_LOG_V6_MC_TYPE_ERAT, RTAS_LOG_V6_MC_ERAT_MULTIHIT,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000000081c0000, 0x0000000000140000, true,
+ RTAS_LOG_V6_MC_TYPE_TLB, RTAS_LOG_V6_MC_TLB_MULTIHIT,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000000081c0000, 0x0000000000180000, true,
+ RTAS_LOG_V6_MC_TYPE_UE, RTAS_LOG_V6_MC_UE_PAGE_TABLE_WALK_IFETCH,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, } };
+
+struct MC_derror_table {
+ unsigned long dsisr_value;
+ bool dar_valid; /* dar is a valid indicator of faulting address */
+ uint8_t error_type;
+ uint8_t error_subtype;
+ unsigned int initiator;
+ unsigned int severity;
+};
+
+static const struct MC_derror_table mc_derror_table[] = {
+{ 0x00008000, false,
+ RTAS_LOG_V6_MC_TYPE_UE, RTAS_LOG_V6_MC_UE_LOAD_STORE,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00004000, true,
+ RTAS_LOG_V6_MC_TYPE_UE, RTAS_LOG_V6_MC_UE_PAGE_TABLE_WALK_LOAD_STORE,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000800, true,
+ RTAS_LOG_V6_MC_TYPE_ERAT, RTAS_LOG_V6_MC_ERAT_MULTIHIT,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000400, true,
+ RTAS_LOG_V6_MC_TYPE_TLB, RTAS_LOG_V6_MC_TLB_MULTIHIT,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000080, true,
+ RTAS_LOG_V6_MC_TYPE_SLB, RTAS_LOG_V6_MC_SLB_MULTIHIT, /* Before PARITY */
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, },
+{ 0x00000100, true,
+ RTAS_LOG_V6_MC_TYPE_SLB, RTAS_LOG_V6_MC_SLB_PARITY,
+ RTAS_LOG_INITIATOR_CPU, RTAS_LOG_SEVERITY_ERROR_SYNC, } };
+
+#define SRR1_MC_LOADSTORE(srr1) ((srr1) & PPC_BIT(42))
+
typedef enum EventClass {
EVENT_CLASS_INTERNAL_ERRORS = 0,
EVENT_CLASS_EPOW = 1,
@@ -623,7 +721,125 @@ void spapr_hotplug_req_remove_by_count_indexed(SpaprDrcType drc_type,
RTAS_LOG_V6_HP_ACTION_REMOVE, drc_type, &drc_id);
}
-void spapr_mce_req_event(PowerPCCPU *cpu)
+static uint32_t spapr_mce_get_elog_type(PowerPCCPU *cpu, bool recovered,
+ struct mc_extended_log *ext_elog)
+{
+ int i;
+ CPUPPCState *env = &cpu->env;
+ uint32_t summary;
+ uint64_t dsisr = env->spr[SPR_DSISR];
+
+ summary = RTAS_LOG_VERSION_6 | RTAS_LOG_OPTIONAL_PART_PRESENT;
+ if (recovered) {
+ summary |= RTAS_LOG_DISPOSITION_FULLY_RECOVERED;
+ } else {
+ summary |= RTAS_LOG_DISPOSITION_NOT_RECOVERED;
+ }
+
+ if (SRR1_MC_LOADSTORE(env->spr[SPR_SRR1])) {
+ for (i = 0; i < ARRAY_SIZE(mc_derror_table); i++) {
+ if (!(dsisr & mc_derror_table[i].dsisr_value)) {
+ continue;
+ }
+
+ ext_elog->mc.error_type = mc_derror_table[i].error_type;
+ ext_elog->mc.sub_err_type = mc_derror_table[i].error_subtype;
+ if (mc_derror_table[i].dar_valid) {
+ ext_elog->mc.effective_address = cpu_to_be64(env->spr[SPR_DAR]);
+ }
+
+ summary |= mc_derror_table[i].initiator
+ | mc_derror_table[i].severity;
+
+ return summary;
+ }
+ } else {
+ for (i = 0; i < ARRAY_SIZE(mc_ierror_table); i++) {
+ if ((env->spr[SPR_SRR1] & mc_ierror_table[i].srr1_mask) !=
+ mc_ierror_table[i].srr1_value) {
+ continue;
+ }
+
+ ext_elog->mc.error_type = mc_ierror_table[i].error_type;
+ ext_elog->mc.sub_err_type = mc_ierror_table[i].error_subtype;
+ if (mc_ierror_table[i].nip_valid) {
+ ext_elog->mc.effective_address = cpu_to_be64(env->nip);
+ }
+
+ summary |= mc_ierror_table[i].initiator
+ | mc_ierror_table[i].severity;
+
+ return summary;
+ }
+ }
+
+ summary |= RTAS_LOG_INITIATOR_CPU;
+ return summary;
+}
+
+static void spapr_mce_dispatch_elog(PowerPCCPU *cpu, bool recovered)
+{
+ SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
+ CPUState *cs = CPU(cpu);
+ uint64_t rtas_addr;
+ CPUPPCState *env = &cpu->env;
+ PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
+ target_ulong msr = 0;
+ struct rtas_error_log log;
+ struct mc_extended_log *ext_elog;
+ uint32_t summary;
+
+ /*
+ * Properly set bits in MSR before we invoke the handler.
+ * SRR0/1, DAR and DSISR are properly set by KVM
+ */
+ if (!(*pcc->interrupts_big_endian)(cpu)) {
+ msr |= (1ULL << MSR_LE);
+ }
+
+ if (env->msr & (1ULL << MSR_SF)) {
+ msr |= (1ULL << MSR_SF);
+ }
+
+ msr |= (1ULL << MSR_ME);
+
+ ext_elog = g_malloc0(sizeof(*ext_elog));
+ summary = spapr_mce_get_elog_type(cpu, recovered, ext_elog);
+
+ log.summary = cpu_to_be32(summary);
+ log.extended_length = cpu_to_be32(sizeof(*ext_elog));
+
+ spapr_init_v6hdr(&ext_elog->v6hdr);
+ ext_elog->mc.hdr.section_id = cpu_to_be16(RTAS_LOG_V6_SECTION_ID_MC);
+ ext_elog->mc.hdr.section_length =
+ cpu_to_be16(sizeof(struct rtas_event_log_v6_mc));
+ ext_elog->mc.hdr.section_version = 1;
+
+ /* get rtas addr from fdt */
+ rtas_addr = spapr_get_rtas_addr();
+ if (!rtas_addr) {
+ /* Unable to fetch rtas_addr. Hence reset the guest */
+ ppc_cpu_do_system_reset(cs);
+ g_free(ext_elog);
+ return;
+ }
+
+ stq_be_phys(&address_space_memory, rtas_addr + RTAS_ERROR_LOG_OFFSET,
+ env->gpr[3]);
+ cpu_physical_memory_write(rtas_addr + RTAS_ERROR_LOG_OFFSET +
+ sizeof(env->gpr[3]), &log, sizeof(log));
+ cpu_physical_memory_write(rtas_addr + RTAS_ERROR_LOG_OFFSET +
+ sizeof(env->gpr[3]) + sizeof(log), ext_elog,
+ sizeof(*ext_elog));
+
+ env->gpr[3] = rtas_addr + RTAS_ERROR_LOG_OFFSET;
+ env->msr = msr;
+ env->nip = spapr->guest_machine_check_addr;
+
+ g_free(ext_elog);
+}
+
+void spapr_mce_req_event(PowerPCCPU *cpu, bool recovered)
{
SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
CPUState *cs = CPU(cpu);
@@ -657,6 +873,8 @@ void spapr_mce_req_event(PowerPCCPU *cpu)
}
}
spapr->mc_status = cpu->vcpu_id;
+
+ spapr_mce_dispatch_elog(cpu, recovered);
}
static void check_exception(PowerPCCPU *cpu, SpaprMachineState *spapr,
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 85135e0e1a..89b7eb6c54 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -476,6 +476,32 @@ void spapr_dt_rtas_tokens(void *fdt, int rtas)
}
}
+hwaddr spapr_get_rtas_addr(void)
+{
+ SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
+ int rtas_node;
+ const fdt32_t *rtas_data;
+ void *fdt = spapr->fdt_blob;
+
+ /* fetch rtas addr from fdt */
+ rtas_node = fdt_path_offset(fdt, "/rtas");
+ if (rtas_node < 0) {
+ return 0;
+ }
+
+ rtas_data = fdt_getprop(fdt, rtas_node, "linux,rtas-base", NULL);
+ if (!rtas_data) {
+ return 0;
+ }
+
+ /*
+ * We assume that the OS called RTAS instantiate-rtas, but some other
+ * OS might call RTAS instantiate-rtas-64 instead. This fine as of now
+ * as SLOF only supports 32-bit variant.
+ */
+ return (hwaddr)fdt32_to_cpu(*rtas_data);
+}
+
static void core_rtas_register_types(void)
{
spapr_rtas_register(RTAS_DISPLAY_CHARACTER, "display-character",
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 909d3976f9..652a5514e8 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -727,6 +727,9 @@ void spapr_load_rtas(SpaprMachineState *spapr, void *fdt, hwaddr addr);
#define RTAS_ERROR_LOG_MAX 2048
+/* Offset from rtas-base where error log is placed */
+#define RTAS_ERROR_LOG_OFFSET 0x30
+
#define RTAS_EVENT_SCAN_RATE 1
/* This helper should be used to encode interrupt specifiers when the related
@@ -813,7 +816,7 @@ void spapr_clear_pending_events(SpaprMachineState *spapr);
int spapr_max_server_number(SpaprMachineState *spapr);
void spapr_store_hpte(PowerPCCPU *cpu, hwaddr ptex,
uint64_t pte0, uint64_t pte1);
-void spapr_mce_req_event(PowerPCCPU *cpu);
+void spapr_mce_req_event(PowerPCCPU *cpu, bool recovered);
/* DRC callbacks. */
void spapr_core_release(DeviceState *dev);
@@ -904,4 +907,5 @@ void spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
#define SPAPR_OV5_XIVE_BOTH 0x80 /* Only to advertise on the platform */
void spapr_set_all_lpcrs(target_ulong value, target_ulong mask);
+hwaddr spapr_get_rtas_addr(void);
#endif /* HW_SPAPR_H */
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 56a6865521..7f44b1aa1a 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2810,9 +2810,11 @@ int kvm_arch_msi_data_to_gsi(uint32_t data)
#if defined(TARGET_PPC64)
int kvm_handle_nmi(PowerPCCPU *cpu, struct kvm_run *run)
{
+ bool recovered = run->flags & KVM_RUN_PPC_NMI_DISP_FULLY_RECOV;
+
cpu_synchronize_state(CPU(cpu));
- spapr_mce_req_event(cpu);
+ spapr_mce_req_event(cpu, recovered);
return 0;
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 28/35] ppc: spapr: Handle "ibm, nmi-register" and "ibm, nmi-interlock" RTAS calls
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (26 preceding siblings ...)
2020-02-03 6:11 ` [PULL 27/35] target/ppc: Build rtas error log upon an MCE David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 29/35] migration: Include migration support for machine check handling David Gibson
` (7 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
This patch adds support in QEMU to handle "ibm,nmi-register"
and "ibm,nmi-interlock" RTAS calls.
The machine check notification address is saved when the
OS issues "ibm,nmi-register" RTAS call.
This patch also handles the case when multiple processors
experience machine check at or about the same time by
handling "ibm,nmi-interlock" call. In such cases, as per
PAPR, subsequent processors serialize waiting for the first
processor to issue the "ibm,nmi-interlock" call. The second
processor that also received a machine check error waits
till the first processor is done reading the error log.
The first processor issues "ibm,nmi-interlock" call
when the error log is consumed.
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
[Register fwnmi RTAS calls in core_rtas_register_types()
where other RTAS calls are registered]
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Message-Id: <20200130184423.20519-6-ganeshgr@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr_caps.c | 10 +++++++
hw/ppc/spapr_rtas.c | 59 ++++++++++++++++++++++++++++++++++++++++++
include/hw/ppc/spapr.h | 4 ++-
3 files changed, 72 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index 393ee6845e..8b27d3ac09 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -515,6 +515,16 @@ static void cap_fwnmi_mce_apply(SpaprMachineState *spapr, uint8_t val,
if (!val) {
return; /* Disabled by default */
}
+
+ if (tcg_enabled()) {
+ warn_report("Firmware Assisted Non-Maskable Interrupts(FWNMI) not "
+ "supported in TCG");
+ } else if (kvm_enabled()) {
+ if (kvmppc_set_fwnmi() < 0) {
+ error_setg(errp, "Firmware Assisted Non-Maskable Interrupts(FWNMI) "
+ "not supported by KVM");
+ }
+ }
}
SpaprCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 89b7eb6c54..35d91260e6 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -399,6 +399,61 @@ static void rtas_get_power_level(PowerPCCPU *cpu, SpaprMachineState *spapr,
rtas_st(rets, 1, 100);
}
+static void rtas_ibm_nmi_register(PowerPCCPU *cpu,
+ SpaprMachineState *spapr,
+ uint32_t token, uint32_t nargs,
+ target_ulong args,
+ uint32_t nret, target_ulong rets)
+{
+ hwaddr rtas_addr;
+
+ if (spapr_get_cap(spapr, SPAPR_CAP_FWNMI_MCE) == SPAPR_CAP_OFF) {
+ rtas_st(rets, 0, RTAS_OUT_NOT_SUPPORTED);
+ return;
+ }
+
+ rtas_addr = spapr_get_rtas_addr();
+ if (!rtas_addr) {
+ rtas_st(rets, 0, RTAS_OUT_NOT_SUPPORTED);
+ return;
+ }
+
+ spapr->guest_machine_check_addr = rtas_ld(args, 1);
+ rtas_st(rets, 0, RTAS_OUT_SUCCESS);
+}
+
+static void rtas_ibm_nmi_interlock(PowerPCCPU *cpu,
+ SpaprMachineState *spapr,
+ uint32_t token, uint32_t nargs,
+ target_ulong args,
+ uint32_t nret, target_ulong rets)
+{
+ if (spapr_get_cap(spapr, SPAPR_CAP_FWNMI_MCE) == SPAPR_CAP_OFF) {
+ rtas_st(rets, 0, RTAS_OUT_NOT_SUPPORTED);
+ return;
+ }
+
+ if (spapr->guest_machine_check_addr == -1) {
+ /* NMI register not called */
+ rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+ return;
+ }
+
+ if (spapr->mc_status != cpu->vcpu_id) {
+ /* The vCPU that hit the NMI should invoke "ibm,nmi-interlock" */
+ rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+ return;
+ }
+
+ /*
+ * vCPU issuing "ibm,nmi-interlock" is done with NMI handling,
+ * hence unset mc_status.
+ */
+ spapr->mc_status = -1;
+ qemu_cond_signal(&spapr->mc_delivery_cond);
+ rtas_st(rets, 0, RTAS_OUT_SUCCESS);
+}
+
static struct rtas_call {
const char *name;
spapr_rtas_fn fn;
@@ -527,6 +582,10 @@ static void core_rtas_register_types(void)
rtas_set_power_level);
spapr_rtas_register(RTAS_GET_POWER_LEVEL, "get-power-level",
rtas_get_power_level);
+ spapr_rtas_register(RTAS_IBM_NMI_REGISTER, "ibm,nmi-register",
+ rtas_ibm_nmi_register);
+ spapr_rtas_register(RTAS_IBM_NMI_INTERLOCK, "ibm,nmi-interlock",
+ rtas_ibm_nmi_interlock);
}
type_init(core_rtas_register_types)
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 652a5514e8..f6f82d88aa 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -656,8 +656,10 @@ target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
#define RTAS_IBM_REMOVE_PE_DMA_WINDOW (RTAS_TOKEN_BASE + 0x28)
#define RTAS_IBM_RESET_PE_DMA_WINDOW (RTAS_TOKEN_BASE + 0x29)
#define RTAS_IBM_SUSPEND_ME (RTAS_TOKEN_BASE + 0x2A)
+#define RTAS_IBM_NMI_REGISTER (RTAS_TOKEN_BASE + 0x2B)
+#define RTAS_IBM_NMI_INTERLOCK (RTAS_TOKEN_BASE + 0x2C)
-#define RTAS_TOKEN_MAX (RTAS_TOKEN_BASE + 0x2B)
+#define RTAS_TOKEN_MAX (RTAS_TOKEN_BASE + 0x2D)
/* RTAS ibm,get-system-parameter token values */
#define RTAS_SYSPARM_SPLPAR_CHARACTERISTICS 20
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 29/35] migration: Include migration support for machine check handling
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (27 preceding siblings ...)
2020-02-03 6:11 ` [PULL 28/35] ppc: spapr: Handle "ibm, nmi-register" and "ibm, nmi-interlock" RTAS calls David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 30/35] ppc: spapr: Activate the FWNMI functionality David Gibson
` (6 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
This patch includes migration support for machine check
handling. Especially this patch blocks VM migration
requests until the machine check error handling is
complete as these errors are specific to the source
hardware and is irrelevant on the target hardware.
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
[Do not set FWNMI cap in post_load, now its done in .apply hook]
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Message-Id: <20200130184423.20519-7-ganeshgr@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr.c | 47 ++++++++++++++++++++++++++++++++++++++++++
hw/ppc/spapr_events.c | 16 +++++++++++++-
hw/ppc/spapr_rtas.c | 2 ++
include/hw/ppc/spapr.h | 2 ++
4 files changed, 66 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 06e295cdf1..137f5c9a33 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -46,6 +46,7 @@
#include "migration/qemu-file-types.h"
#include "migration/global_state.h"
#include "migration/register.h"
+#include "migration/blocker.h"
#include "mmu-hash64.h"
#include "mmu-book3s-v3.h"
#include "cpu-models.h"
@@ -1683,6 +1684,8 @@ static void spapr_machine_reset(MachineState *machine)
/* Signal all vCPUs waiting on this condition */
qemu_cond_broadcast(&spapr->mc_delivery_cond);
+
+ migrate_del_blocker(spapr->fwnmi_migration_blocker);
}
static void spapr_create_nvram(SpaprMachineState *spapr)
@@ -1965,6 +1968,42 @@ static const VMStateDescription vmstate_spapr_dtb = {
},
};
+static bool spapr_fwnmi_needed(void *opaque)
+{
+ SpaprMachineState *spapr = (SpaprMachineState *)opaque;
+
+ return spapr->guest_machine_check_addr != -1;
+}
+
+static int spapr_fwnmi_pre_save(void *opaque)
+{
+ SpaprMachineState *spapr = (SpaprMachineState *)opaque;
+
+ /*
+ * Check if machine check handling is in progress and print a
+ * warning message.
+ */
+ if (spapr->mc_status != -1) {
+ warn_report("A machine check is being handled during migration. The"
+ "handler may run and log hardware error on the destination");
+ }
+
+ return 0;
+}
+
+static const VMStateDescription vmstate_spapr_machine_check = {
+ .name = "spapr_machine_check",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = spapr_fwnmi_needed,
+ .pre_save = spapr_fwnmi_pre_save,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64(guest_machine_check_addr, SpaprMachineState),
+ VMSTATE_INT32(mc_status, SpaprMachineState),
+ VMSTATE_END_OF_LIST()
+ },
+};
+
static const VMStateDescription vmstate_spapr = {
.name = "spapr",
.version_id = 3,
@@ -1999,6 +2038,7 @@ static const VMStateDescription vmstate_spapr = {
&vmstate_spapr_cap_large_decr,
&vmstate_spapr_cap_ccf_assist,
&vmstate_spapr_cap_fwnmi,
+ &vmstate_spapr_machine_check,
NULL
}
};
@@ -2814,6 +2854,13 @@ static void spapr_machine_init(MachineState *machine)
spapr_create_lmb_dr_connectors(spapr);
}
+ if (spapr_get_cap(spapr, SPAPR_CAP_FWNMI_MCE) == SPAPR_CAP_ON) {
+ /* Create the error string for live migration blocker */
+ error_setg(&spapr->fwnmi_migration_blocker,
+ "A machine check is being handled during migration. The handler"
+ "may run and log hardware error on the destination");
+ }
+
/* Set up RTAS event infrastructure */
spapr_events_init(spapr);
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index 54eaf28a9e..884e455f02 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -43,6 +43,7 @@
#include "qemu/main-loop.h"
#include "hw/ppc/spapr_ovec.h"
#include <libfdt.h>
+#include "migration/blocker.h"
#define RTAS_LOG_VERSION_MASK 0xff000000
#define RTAS_LOG_VERSION_6 0x06000000
@@ -843,6 +844,8 @@ void spapr_mce_req_event(PowerPCCPU *cpu, bool recovered)
{
SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
CPUState *cs = CPU(cpu);
+ int ret;
+ Error *local_err = NULL;
if (spapr->guest_machine_check_addr == -1) {
/*
@@ -872,8 +875,19 @@ void spapr_mce_req_event(PowerPCCPU *cpu, bool recovered)
return;
}
}
- spapr->mc_status = cpu->vcpu_id;
+ ret = migrate_add_blocker(spapr->fwnmi_migration_blocker, &local_err);
+ if (ret == -EBUSY) {
+ /*
+ * We don't want to abort so we let the migration to continue.
+ * In a rare case, the machine check handler will run on the target.
+ * Though this is not preferable, it is better than aborting
+ * the migration or killing the VM.
+ */
+ warn_report("Received a fwnmi while migration was in progress");
+ }
+
+ spapr->mc_status = cpu->vcpu_id;
spapr_mce_dispatch_elog(cpu, recovered);
}
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 35d91260e6..883fe28465 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -50,6 +50,7 @@
#include "hw/ppc/fdt.h"
#include "target/ppc/mmu-hash64.h"
#include "target/ppc/mmu-book3s-v3.h"
+#include "migration/blocker.h"
static void rtas_display_character(PowerPCCPU *cpu, SpaprMachineState *spapr,
uint32_t token, uint32_t nargs,
@@ -452,6 +453,7 @@ static void rtas_ibm_nmi_interlock(PowerPCCPU *cpu,
spapr->mc_status = -1;
qemu_cond_signal(&spapr->mc_delivery_cond);
rtas_st(rets, 0, RTAS_OUT_SUCCESS);
+ migrate_del_blocker(spapr->fwnmi_migration_blocker);
}
static struct rtas_call {
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index f6f82d88aa..a1fba95c82 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -218,6 +218,8 @@ struct SpaprMachineState {
unsigned gpu_numa_id;
SpaprTpmProxy *tpm_proxy;
+
+ Error *fwnmi_migration_blocker;
};
#define H_SUCCESS 0
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 30/35] ppc: spapr: Activate the FWNMI functionality
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (28 preceding siblings ...)
2020-02-03 6:11 ` [PULL 29/35] migration: Include migration support for machine check handling David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 31/35] target/ppc: Use probe_access for LSW, STSW David Gibson
` (5 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Aravinda Prasad, qemu-devel, groug, Ganesh Goudar,
qemu-ppc, David Gibson
From: Aravinda Prasad <arawinda.p@gmail.com>
This patch sets the default value of SPAPR_CAP_FWNMI_MCE
to SPAPR_CAP_ON for machine type 5.0.
Signed-off-by: Aravinda Prasad <arawinda.p@gmail.com>
Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
Message-Id: <20200130184423.20519-8-ganeshgr@linux.ibm.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
hw/ppc/spapr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 137f5c9a33..c9b2e0a5e0 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4454,7 +4454,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
smc->default_caps.caps[SPAPR_CAP_NESTED_KVM_HV] = SPAPR_CAP_OFF;
smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_ON;
smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_ON;
- smc->default_caps.caps[SPAPR_CAP_FWNMI_MCE] = SPAPR_CAP_OFF;
+ smc->default_caps.caps[SPAPR_CAP_FWNMI_MCE] = SPAPR_CAP_ON;
spapr_caps_add_properties(smc, &error_abort);
smc->irq = &spapr_irq_dual;
smc->dr_phb_enabled = true;
@@ -4527,6 +4527,7 @@ static void spapr_machine_4_2_class_options(MachineClass *mc)
spapr_machine_5_0_class_options(mc);
compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
+ smc->default_caps.caps[SPAPR_CAP_FWNMI_MCE] = SPAPR_CAP_OFF;
}
DEFINE_SPAPR_MACHINE(4_2, "4.2", false);
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 31/35] target/ppc: Use probe_access for LSW, STSW
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (29 preceding siblings ...)
2020-02-03 6:11 ` [PULL 30/35] ppc: spapr: Activate the FWNMI functionality David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 32/35] target/ppc: Use probe_access for LMW, STMW David Gibson
` (4 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Richard Henderson, qemu-devel, groug, qemu-ppc,
Howard Spoelstra, David Gibson
From: Richard Henderson <richard.henderson@linaro.org>
Use a minimum number of mmu lookups for the contiguous bytes
that are accessed. If the lookup succeeds, we can finish the
operation with host addresses only.
Reported-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200129235040.24022-2-richard.henderson@linaro.org>
Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/mem_helper.c | 148 ++++++++++++++++++++++++++++++++++------
1 file changed, 128 insertions(+), 20 deletions(-)
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index e8e2a8ac2a..508d472a2f 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -56,6 +56,32 @@ static inline target_ulong addr_add(CPUPPCState *env, target_ulong addr,
}
}
+static void *probe_contiguous(CPUPPCState *env, target_ulong addr, uint32_t nb,
+ MMUAccessType access_type, int mmu_idx,
+ uintptr_t raddr)
+{
+ void *host1, *host2;
+ uint32_t nb_pg1, nb_pg2;
+
+ nb_pg1 = -(addr | TARGET_PAGE_MASK);
+ if (likely(nb <= nb_pg1)) {
+ /* The entire operation is on a single page. */
+ return probe_access(env, addr, nb, access_type, mmu_idx, raddr);
+ }
+
+ /* The operation spans two pages. */
+ nb_pg2 = nb - nb_pg1;
+ host1 = probe_access(env, addr, nb_pg1, access_type, mmu_idx, raddr);
+ addr = addr_add(env, addr, nb_pg1);
+ host2 = probe_access(env, addr, nb_pg2, access_type, mmu_idx, raddr);
+
+ /* If the two host pages are contiguous, optimize. */
+ if (host2 == host1 + nb_pg1) {
+ return host1;
+ }
+ return NULL;
+}
+
void helper_lmw(CPUPPCState *env, target_ulong addr, uint32_t reg)
{
for (; reg < 32; reg++) {
@@ -84,23 +110,65 @@ void helper_stmw(CPUPPCState *env, target_ulong addr, uint32_t reg)
static void do_lsw(CPUPPCState *env, target_ulong addr, uint32_t nb,
uint32_t reg, uintptr_t raddr)
{
- int sh;
+ int mmu_idx;
+ void *host;
+ uint32_t val;
- for (; nb > 3; nb -= 4) {
- env->gpr[reg] = cpu_ldl_data_ra(env, addr, raddr);
- reg = (reg + 1) % 32;
- addr = addr_add(env, addr, 4);
+ if (unlikely(nb == 0)) {
+ return;
}
- if (unlikely(nb > 0)) {
- env->gpr[reg] = 0;
- for (sh = 24; nb > 0; nb--, sh -= 8) {
- env->gpr[reg] |= cpu_ldub_data_ra(env, addr, raddr) << sh;
- addr = addr_add(env, addr, 1);
+
+ mmu_idx = cpu_mmu_index(env, false);
+ host = probe_contiguous(env, addr, nb, MMU_DATA_LOAD, mmu_idx, raddr);
+
+ if (likely(host)) {
+ /* Fast path -- the entire operation is in RAM at host. */
+ for (; nb > 3; nb -= 4) {
+ env->gpr[reg] = (uint32_t)ldl_be_p(host);
+ reg = (reg + 1) % 32;
+ host += 4;
+ }
+ switch (nb) {
+ default:
+ return;
+ case 1:
+ val = ldub_p(host) << 24;
+ break;
+ case 2:
+ val = lduw_be_p(host) << 16;
+ break;
+ case 3:
+ val = (lduw_be_p(host) << 16) | (ldub_p(host + 2) << 8);
+ break;
+ }
+ } else {
+ /* Slow path -- at least some of the operation requires i/o. */
+ for (; nb > 3; nb -= 4) {
+ env->gpr[reg] = cpu_ldl_mmuidx_ra(env, addr, mmu_idx, raddr);
+ reg = (reg + 1) % 32;
+ addr = addr_add(env, addr, 4);
+ }
+ switch (nb) {
+ default:
+ return;
+ case 1:
+ val = cpu_ldub_mmuidx_ra(env, addr, mmu_idx, raddr) << 24;
+ break;
+ case 2:
+ val = cpu_lduw_mmuidx_ra(env, addr, mmu_idx, raddr) << 16;
+ break;
+ case 3:
+ val = cpu_lduw_mmuidx_ra(env, addr, mmu_idx, raddr) << 16;
+ addr = addr_add(env, addr, 2);
+ val |= cpu_ldub_mmuidx_ra(env, addr, mmu_idx, raddr) << 8;
+ break;
}
}
+ env->gpr[reg] = val;
}
-void helper_lsw(CPUPPCState *env, target_ulong addr, uint32_t nb, uint32_t reg)
+void helper_lsw(CPUPPCState *env, target_ulong addr,
+ uint32_t nb, uint32_t reg)
{
do_lsw(env, addr, nb, reg, GETPC());
}
@@ -130,17 +198,57 @@ void helper_lswx(CPUPPCState *env, target_ulong addr, uint32_t reg,
void helper_stsw(CPUPPCState *env, target_ulong addr, uint32_t nb,
uint32_t reg)
{
- int sh;
+ uintptr_t raddr = GETPC();
+ int mmu_idx;
+ void *host;
+ uint32_t val;
- for (; nb > 3; nb -= 4) {
- cpu_stl_data_ra(env, addr, env->gpr[reg], GETPC());
- reg = (reg + 1) % 32;
- addr = addr_add(env, addr, 4);
+ if (unlikely(nb == 0)) {
+ return;
}
- if (unlikely(nb > 0)) {
- for (sh = 24; nb > 0; nb--, sh -= 8) {
- cpu_stb_data_ra(env, addr, (env->gpr[reg] >> sh) & 0xFF, GETPC());
- addr = addr_add(env, addr, 1);
+
+ mmu_idx = cpu_mmu_index(env, false);
+ host = probe_contiguous(env, addr, nb, MMU_DATA_STORE, mmu_idx, raddr);
+
+ if (likely(host)) {
+ /* Fast path -- the entire operation is in RAM at host. */
+ for (; nb > 3; nb -= 4) {
+ stl_be_p(host, env->gpr[reg]);
+ reg = (reg + 1) % 32;
+ host += 4;
+ }
+ val = env->gpr[reg];
+ switch (nb) {
+ case 1:
+ stb_p(host, val >> 24);
+ break;
+ case 2:
+ stw_be_p(host, val >> 16);
+ break;
+ case 3:
+ stw_be_p(host, val >> 16);
+ stb_p(host + 2, val >> 8);
+ break;
+ }
+ } else {
+ for (; nb > 3; nb -= 4) {
+ cpu_stl_mmuidx_ra(env, addr, env->gpr[reg], mmu_idx, raddr);
+ reg = (reg + 1) % 32;
+ addr = addr_add(env, addr, 4);
+ }
+ val = env->gpr[reg];
+ switch (nb) {
+ case 1:
+ cpu_stb_mmuidx_ra(env, addr, val >> 24, mmu_idx, raddr);
+ break;
+ case 2:
+ cpu_stw_mmuidx_ra(env, addr, val >> 16, mmu_idx, raddr);
+ break;
+ case 3:
+ cpu_stw_mmuidx_ra(env, addr, val >> 16, mmu_idx, raddr);
+ addr = addr_add(env, addr, 2);
+ cpu_stb_mmuidx_ra(env, addr, val >> 8, mmu_idx, raddr);
+ break;
}
}
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 32/35] target/ppc: Use probe_access for LMW, STMW
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (30 preceding siblings ...)
2020-02-03 6:11 ` [PULL 31/35] target/ppc: Use probe_access for LSW, STSW David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 33/35] target/ppc: Remove redundant mask in DCBZ David Gibson
` (3 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Richard Henderson, qemu-devel, groug, qemu-ppc,
Howard Spoelstra, David Gibson
From: Richard Henderson <richard.henderson@linaro.org>
Use a minimum number of mmu lookups for the contiguous bytes
that are accessed. If the lookup succeeds, we can finish the
operation with host addresses only.
Reported-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200129235040.24022-3-richard.henderson@linaro.org>
Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/mem_helper.c | 45 +++++++++++++++++++++++++++++------------
1 file changed, 32 insertions(+), 13 deletions(-)
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index 508d472a2f..e7d3a79d96 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -84,26 +84,45 @@ static void *probe_contiguous(CPUPPCState *env, target_ulong addr, uint32_t nb,
void helper_lmw(CPUPPCState *env, target_ulong addr, uint32_t reg)
{
- for (; reg < 32; reg++) {
- if (needs_byteswap(env)) {
- env->gpr[reg] = bswap32(cpu_ldl_data_ra(env, addr, GETPC()));
- } else {
- env->gpr[reg] = cpu_ldl_data_ra(env, addr, GETPC());
+ uintptr_t raddr = GETPC();
+ int mmu_idx = cpu_mmu_index(env, false);
+ void *host = probe_contiguous(env, addr, (32 - reg) * 4,
+ MMU_DATA_LOAD, mmu_idx, raddr);
+
+ if (likely(host)) {
+ /* Fast path -- the entire operation is in RAM at host. */
+ for (; reg < 32; reg++) {
+ env->gpr[reg] = (uint32_t)ldl_be_p(host);
+ host += 4;
+ }
+ } else {
+ /* Slow path -- at least some of the operation requires i/o. */
+ for (; reg < 32; reg++) {
+ env->gpr[reg] = cpu_ldl_mmuidx_ra(env, addr, mmu_idx, raddr);
+ addr = addr_add(env, addr, 4);
}
- addr = addr_add(env, addr, 4);
}
}
void helper_stmw(CPUPPCState *env, target_ulong addr, uint32_t reg)
{
- for (; reg < 32; reg++) {
- if (needs_byteswap(env)) {
- cpu_stl_data_ra(env, addr, bswap32((uint32_t)env->gpr[reg]),
- GETPC());
- } else {
- cpu_stl_data_ra(env, addr, (uint32_t)env->gpr[reg], GETPC());
+ uintptr_t raddr = GETPC();
+ int mmu_idx = cpu_mmu_index(env, false);
+ void *host = probe_contiguous(env, addr, (32 - reg) * 4,
+ MMU_DATA_STORE, mmu_idx, raddr);
+
+ if (likely(host)) {
+ /* Fast path -- the entire operation is in RAM at host. */
+ for (; reg < 32; reg++) {
+ stl_be_p(host, env->gpr[reg]);
+ host += 4;
+ }
+ } else {
+ /* Slow path -- at least some of the operation requires i/o. */
+ for (; reg < 32; reg++) {
+ cpu_stl_mmuidx_ra(env, addr, env->gpr[reg], mmu_idx, raddr);
+ addr = addr_add(env, addr, 4);
}
- addr = addr_add(env, addr, 4);
}
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 33/35] target/ppc: Remove redundant mask in DCBZ
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (31 preceding siblings ...)
2020-02-03 6:11 ` [PULL 32/35] target/ppc: Use probe_access for LMW, STMW David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 6:11 ` [PULL 34/35] target/ppc: Use probe_write for DCBZ David Gibson
` (2 subsequent siblings)
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Richard Henderson, qemu-devel, groug, qemu-ppc,
Howard Spoelstra, David Gibson
From: Richard Henderson <richard.henderson@linaro.org>
The value of addr has already been masked, just above.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200129235040.24022-4-richard.henderson@linaro.org>
Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/mem_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index e7d3a79d96..0cb78777e7 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -293,7 +293,7 @@ static void dcbz_common(CPUPPCState *env, target_ulong addr,
addr &= mask;
/* Check reservation */
- if ((env->reserve_addr & mask) == (addr & mask)) {
+ if ((env->reserve_addr & mask) == addr) {
env->reserve_addr = (target_ulong)-1ULL;
}
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 34/35] target/ppc: Use probe_write for DCBZ
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (32 preceding siblings ...)
2020-02-03 6:11 ` [PULL 33/35] target/ppc: Remove redundant mask in DCBZ David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-12 18:48 ` Greg Kurz
2020-02-03 6:11 ` [PULL 35/35] tests: Silence various warnings with pseries David Gibson
2020-02-03 10:41 ` [PULL 00/35] ppc-for-5.0 queue 20200203 Peter Maydell
35 siblings, 1 reply; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Richard Henderson, qemu-devel, groug, qemu-ppc,
Howard Spoelstra, David Gibson
From: Richard Henderson <richard.henderson@linaro.org>
Using probe_write instead of tlb_vaddr_to_host means that we
process watchpoints and notdirty pages more efficiently.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200129235040.24022-5-richard.henderson@linaro.org>
Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
target/ppc/mem_helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
index 0cb78777e7..98f589552b 100644
--- a/target/ppc/mem_helper.c
+++ b/target/ppc/mem_helper.c
@@ -298,7 +298,7 @@ static void dcbz_common(CPUPPCState *env, target_ulong addr,
}
/* Try fast path translate */
- haddr = tlb_vaddr_to_host(env, addr, MMU_DATA_STORE, mmu_idx);
+ haddr = probe_write(env, addr, dcbz_size, mmu_idx, retaddr);
if (haddr) {
memset(haddr, 0, dcbz_size);
} else {
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PULL 35/35] tests: Silence various warnings with pseries
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (33 preceding siblings ...)
2020-02-03 6:11 ` [PULL 34/35] target/ppc: Use probe_write for DCBZ David Gibson
@ 2020-02-03 6:11 ` David Gibson
2020-02-03 10:41 ` [PULL 00/35] ppc-for-5.0 queue 20200203 Peter Maydell
35 siblings, 0 replies; 48+ messages in thread
From: David Gibson @ 2020-02-03 6:11 UTC (permalink / raw)
To: peter.maydell
Cc: lvivier, Thomas Huth, qemu-devel, groug, qemu-ppc, David Gibson
From: Greg Kurz <groug@kaod.org>
Some default features of the pseries machine are only available with
KVM. Warnings are printed when the pseries machine is used with another
accelerator:
qemu-system-ppc64: warning: TCG doesn't support requested feature,
cap-ccf-assist=on
qemu-system-ppc64: warning: Firmware Assisted Non-Maskable
Interrupts(FWNMI) not supported in TCG
qemu-system-ppc64: warning: TCG doesn't support requested feature,
cap-ccf-assist=on
qemu-system-ppc64: warning: Firmware Assisted Non-Maskable
Interrupts(FWNMI) not supported in TCG
qemu-system-ppc64: warning: TCG doesn't support requested feature,
cap-ccf-assist=on
qemu-system-ppc64: warning: Firmware Assisted Non-Maskable
Interrupts(FWNMI) not supported in TCG
This is annoying for CI since it usually runs without KVM. We already
disable features that emit similar warnings thanks to properties of
the pseries machine, but this is open-coded in various
places. Consolidate the set of properties in a single place. Extend it
to silence the above warnings. And use it in the various tests that
start pseries machines.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <158059697130.1820292.7823434132030453110.stgit@bahia.lan>
Reviewed-by: Thomas Huth <thuth@redhat.com>
[dwg: Correct minor grammatical error]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
tests/qtest/boot-serial-test.c | 3 ++-
tests/qtest/libqos/libqos-spapr.h | 8 ++++++++
tests/qtest/prom-env-test.c | 3 ++-
tests/qtest/pxe-test.c | 7 ++++---
4 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
index 8e8c5b0a0f..85a3614286 100644
--- a/tests/qtest/boot-serial-test.c
+++ b/tests/qtest/boot-serial-test.c
@@ -15,6 +15,7 @@
#include "qemu/osdep.h"
#include "libqtest.h"
+#include "libqos/libqos-spapr.h"
static const uint8_t kernel_mcf5208[] = {
0x41, 0xf9, 0xfc, 0x06, 0x00, 0x00, /* lea 0xfc060000,%a0 */
@@ -112,7 +113,7 @@ static testdef_t tests[] = {
{ "ppc64", "40p", "-m 192", "Memory: 192M" },
{ "ppc64", "mac99", "", "PowerPC,970FX" },
{ "ppc64", "pseries",
- "-machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken",
+ "-machine " PSERIES_DEFAULT_CAPABILITIES,
"Open Firmware" },
{ "ppc64", "powernv8", "", "OPAL" },
{ "ppc64", "powernv9", "", "OPAL" },
diff --git a/tests/qtest/libqos/libqos-spapr.h b/tests/qtest/libqos/libqos-spapr.h
index dcb5c43ad3..d9c4c22343 100644
--- a/tests/qtest/libqos/libqos-spapr.h
+++ b/tests/qtest/libqos/libqos-spapr.h
@@ -7,4 +7,12 @@ QOSState *qtest_spapr_vboot(const char *cmdline_fmt, va_list ap);
QOSState *qtest_spapr_boot(const char *cmdline_fmt, ...);
void qtest_spapr_shutdown(QOSState *qs);
+/* List of capabilities needed to silence warnings with TCG */
+#define PSERIES_DEFAULT_CAPABILITIES \
+ "cap-cfpc=broken," \
+ "cap-sbbc=broken," \
+ "cap-ibs=broken," \
+ "cap-ccf-assist=off," \
+ "cap-fwnmi-mce=off"
+
#endif
diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
index 9be52c766f..60e6ec3153 100644
--- a/tests/qtest/prom-env-test.c
+++ b/tests/qtest/prom-env-test.c
@@ -21,6 +21,7 @@
#include "qemu/osdep.h"
#include "libqtest.h"
+#include "libqos/libqos-spapr.h"
#define MAGIC 0xcafec0de
#define ADDRESS 0x4000
@@ -54,7 +55,7 @@ static void test_machine(const void *machine)
*/
if (strcmp(machine, "pseries") == 0) {
extra_args = "-nodefaults"
- " -machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken";
+ " -machine " PSERIES_DEFAULT_CAPABILITIES;
}
qts = qtest_initf("-M %s -accel tcg %s -prom-env 'use-nvramrc?=true' "
diff --git a/tests/qtest/pxe-test.c b/tests/qtest/pxe-test.c
index f68d0aadbb..1161a773a4 100644
--- a/tests/qtest/pxe-test.c
+++ b/tests/qtest/pxe-test.c
@@ -17,6 +17,7 @@
#include "qemu-common.h"
#include "libqtest.h"
#include "boot-sector.h"
+#include "libqos/libqos-spapr.h"
#define NETNAME "net0"
@@ -46,15 +47,15 @@ static testdef_t x86_tests_slow[] = {
static testdef_t ppc64_tests[] = {
{ "pseries", "spapr-vlan",
- "-machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken,vsmt=8" },
+ "-machine vsmt=8," PSERIES_DEFAULT_CAPABILITIES },
{ "pseries", "virtio-net-pci",
- "-machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken,vsmt=8" },
+ "-machine vsmt=8," PSERIES_DEFAULT_CAPABILITIES },
{ NULL },
};
static testdef_t ppc64_tests_slow[] = {
{ "pseries", "e1000",
- "-machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken,vsmt=8" },
+ "-machine vsmt=8," PSERIES_DEFAULT_CAPABILITIES },
{ NULL },
};
--
2.24.1
^ permalink raw reply related [flat|nested] 48+ messages in thread
* Re: [PULL 00/35] ppc-for-5.0 queue 20200203
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
` (34 preceding siblings ...)
2020-02-03 6:11 ` [PULL 35/35] tests: Silence various warnings with pseries David Gibson
@ 2020-02-03 10:41 ` Peter Maydell
35 siblings, 0 replies; 48+ messages in thread
From: Peter Maydell @ 2020-02-03 10:41 UTC (permalink / raw)
To: David Gibson; +Cc: Laurent Vivier, qemu-ppc, QEMU Developers, Greg Kurz
On Mon, 3 Feb 2020 at 06:11, David Gibson <david@gibson.dropbear.id.au> wrote:
>
> The following changes since commit 28db64fce555a03b4ca256d5b6f4290abdfbd9e8:
>
> Merge remote-tracking branch 'remotes/stefanha/tags/tracing-pull-request' into staging (2020-01-31 17:37:00 +0000)
>
> are available in the Git repository at:
>
> git://github.com/dgibson/qemu.git tags/ppc-for-5.0-20200203
>
> for you to fetch changes up to 63d57c8f91d0d0e62fc4d91db6340a662b36a3c0:
>
> tests: Silence various warnings with pseries (2020-02-03 11:33:11 +1100)
>
> ----------------------------------------------------------------
> ppc patch queue 2020-02093
>
> This pull request supersedes ppc-for-5.0-20200131. The only changes
> are one extra patch to suppress some irritating warnings during tests
> under TCG, and an extra Tested-by in one of the other patches.
>
> Here's the next batch of patches for ppc and associated machine types.
> Highlights includes:
> * Remove the deprecated "prep" machine type and its OpenHackware
> firmware
> * Add TCG emulation of the msgsndp etc. supervisor privileged
> doorbell instructions
> * Allow "pnv" machine type to run Hostboot style firmwares
> * Add a virtual TPM device for spapr machines
> * Implement devices for POWER8 PHB3 and POWER9 PHB4 host bridges for
> the pnv machine type
> * Use faster Spectre mitigation by default for POWER9 DD2.3 machines
> * Introduce Firmware Assisted NMI dump facility for spapr machines
> * Fix a performance regression with load/store multiple instructions
> in TCG
>
> as well as some other assorted cleanups and fixes.
>
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/5.0
for any user-visible changes.
-- PMM
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-03 6:11 ` [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge David Gibson
@ 2020-02-05 13:26 ` Laurent Vivier
2020-02-05 14:31 ` Greg Kurz
2020-02-05 15:27 ` Cédric Le Goater
2022-03-31 17:51 ` Peter Maydell
1 sibling, 2 replies; 48+ messages in thread
From: Laurent Vivier @ 2020-02-05 13:26 UTC (permalink / raw)
To: David Gibson, peter.maydell
Cc: Cédric Le Goater, qemu-ppc, qemu-devel, groug
On 03/02/2020 07:11, David Gibson wrote:
> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>
> These changes introduces models for the PCIe Host Bridge (PHB4) of the
> POWER9 processor. It includes the PowerBus logic interface (PBCQ),
> IOMMU support, a single PCIe Gen.4 Root Complex, and support for MSI
> and LSI interrupt sources as found on a POWER9 system using the XIVE
> interrupt controller.
>
> POWER9 processor comes with 3 PHB4 PEC (PCI Express Controller) and
> each PEC can have several PHBs. By default,
>
> * PEC0 provides 1 PHB (PHB0)
> * PEC1 provides 2 PHBs (PHB1 and PHB2)
> * PEC2 provides 3 PHBs (PHB3, PHB4 and PHB5)
>
> Each PEC has a set "global" registers and some "per-stack" (per-PHB)
> registers. Those are organized in two XSCOM ranges, the "Nest" range
> and the "PCI" range, each range contains both some "PEC" registers and
> some "per-stack" registers.
>
> No default device layout is provided and PCI devices can be added on
> any of the available PCIe Root Port (pcie.0 .. 2 of a Power9 chip)
> with address 0x0 as the firwware (skiboot) only accepts a single
> device per root port. To run a simple system with a network and a
> storage adapters, use a command line options such as :
>
> -device e1000e,netdev=net0,mac=C0:FF:EE:00:00:02,bus=pcie.0,addr=0x0
> -netdev bridge,id=net0,helper=/usr/libexec/qemu-bridge-helper,br=virbr0,id=hostnet0
>
> -device megasas,id=scsi0,bus=pcie.1,addr=0x0
> -drive file=$disk,if=none,id=drive-scsi0-0-0-0,format=qcow2,cache=none
> -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2
>
> If more are needed, include a bridge.
>
> Multi chip is supported, each chip adding its set of PHB4 controllers
> and its PCI busses. The model doesn't emulate the EEH error handling.
>
> This model is not ready for hotplug yet.
>
> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> [ clg: - numerous cleanups
> - commit log
> - fix for broken LSI support
> - PHB pic printinfo
> - large QOM rework ]
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
> Message-Id: <20200127144506.11132-2-clg@kaod.org>
> [dwg: Use device_class_set_props()]
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
> hw/pci-host/Makefile.objs | 1 +
> hw/pci-host/pnv_phb4.c | 1438 +++++++++++++++++++++++++++
> hw/pci-host/pnv_phb4_pec.c | 593 +++++++++++
> hw/ppc/Kconfig | 2 +
> hw/ppc/pnv.c | 107 ++
> include/hw/pci-host/pnv_phb4.h | 230 +++++
> include/hw/pci-host/pnv_phb4_regs.h | 553 ++++++++++
> include/hw/pci/pcie_port.h | 1 +
> include/hw/ppc/pnv.h | 7 +
> include/hw/ppc/pnv_xscom.h | 11 +
> 10 files changed, 2943 insertions(+)
> create mode 100644 hw/pci-host/pnv_phb4.c
> create mode 100644 hw/pci-host/pnv_phb4_pec.c
> create mode 100644 include/hw/pci-host/pnv_phb4.h
> create mode 100644 include/hw/pci-host/pnv_phb4_regs.h
>
...
> diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
> index e27efe9a24..354828bf13 100644
> --- a/hw/ppc/Kconfig
> +++ b/hw/ppc/Kconfig
> @@ -135,6 +135,8 @@ config XIVE_SPAPR
> default y
> depends on PSERIES
> select XIVE
> + select PCI
> + select PCIE_PORT
This patch is about PowerNV, why do we add dependencies for pseries
configuration?
Thanks,
Laurent
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-05 13:26 ` Laurent Vivier
@ 2020-02-05 14:31 ` Greg Kurz
2020-02-05 15:27 ` Cédric Le Goater
1 sibling, 0 replies; 48+ messages in thread
From: Greg Kurz @ 2020-02-05 14:31 UTC (permalink / raw)
To: Laurent Vivier
Cc: peter.maydell, qemu-devel, qemu-ppc, Cédric Le Goater, David Gibson
On Wed, 5 Feb 2020 14:26:41 +0100
Laurent Vivier <lvivier@redhat.com> wrote:
> On 03/02/2020 07:11, David Gibson wrote:
> > From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> >
> > These changes introduces models for the PCIe Host Bridge (PHB4) of the
> > POWER9 processor. It includes the PowerBus logic interface (PBCQ),
> > IOMMU support, a single PCIe Gen.4 Root Complex, and support for MSI
> > and LSI interrupt sources as found on a POWER9 system using the XIVE
> > interrupt controller.
> >
> > POWER9 processor comes with 3 PHB4 PEC (PCI Express Controller) and
> > each PEC can have several PHBs. By default,
> >
> > * PEC0 provides 1 PHB (PHB0)
> > * PEC1 provides 2 PHBs (PHB1 and PHB2)
> > * PEC2 provides 3 PHBs (PHB3, PHB4 and PHB5)
> >
> > Each PEC has a set "global" registers and some "per-stack" (per-PHB)
> > registers. Those are organized in two XSCOM ranges, the "Nest" range
> > and the "PCI" range, each range contains both some "PEC" registers and
> > some "per-stack" registers.
> >
> > No default device layout is provided and PCI devices can be added on
> > any of the available PCIe Root Port (pcie.0 .. 2 of a Power9 chip)
> > with address 0x0 as the firwware (skiboot) only accepts a single
> > device per root port. To run a simple system with a network and a
> > storage adapters, use a command line options such as :
> >
> > -device e1000e,netdev=net0,mac=C0:FF:EE:00:00:02,bus=pcie.0,addr=0x0
> > -netdev bridge,id=net0,helper=/usr/libexec/qemu-bridge-helper,br=virbr0,id=hostnet0
> >
> > -device megasas,id=scsi0,bus=pcie.1,addr=0x0
> > -drive file=$disk,if=none,id=drive-scsi0-0-0-0,format=qcow2,cache=none
> > -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2
> >
> > If more are needed, include a bridge.
> >
> > Multi chip is supported, each chip adding its set of PHB4 controllers
> > and its PCI busses. The model doesn't emulate the EEH error handling.
> >
> > This model is not ready for hotplug yet.
> >
> > Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> > [ clg: - numerous cleanups
> > - commit log
> > - fix for broken LSI support
> > - PHB pic printinfo
> > - large QOM rework ]
> > Signed-off-by: Cédric Le Goater <clg@kaod.org>
> > Message-Id: <20200127144506.11132-2-clg@kaod.org>
> > [dwg: Use device_class_set_props()]
> > Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> > ---
> > hw/pci-host/Makefile.objs | 1 +
> > hw/pci-host/pnv_phb4.c | 1438 +++++++++++++++++++++++++++
> > hw/pci-host/pnv_phb4_pec.c | 593 +++++++++++
> > hw/ppc/Kconfig | 2 +
> > hw/ppc/pnv.c | 107 ++
> > include/hw/pci-host/pnv_phb4.h | 230 +++++
> > include/hw/pci-host/pnv_phb4_regs.h | 553 ++++++++++
> > include/hw/pci/pcie_port.h | 1 +
> > include/hw/ppc/pnv.h | 7 +
> > include/hw/ppc/pnv_xscom.h | 11 +
> > 10 files changed, 2943 insertions(+)
> > create mode 100644 hw/pci-host/pnv_phb4.c
> > create mode 100644 hw/pci-host/pnv_phb4_pec.c
> > create mode 100644 include/hw/pci-host/pnv_phb4.h
> > create mode 100644 include/hw/pci-host/pnv_phb4_regs.h
> >
> ...
> > diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
> > index e27efe9a24..354828bf13 100644
> > --- a/hw/ppc/Kconfig
> > +++ b/hw/ppc/Kconfig
> > @@ -135,6 +135,8 @@ config XIVE_SPAPR
> > default y
> > depends on PSERIES
> > select XIVE
> > + select PCI
> > + select PCIE_PORT
>
> This patch is about PowerNV, why do we add dependencies for pseries
> configuration?
>
This looks like an error. These should rather be added to config POWERNV
I guess.
> Thanks,
> Laurent
>
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-05 13:26 ` Laurent Vivier
2020-02-05 14:31 ` Greg Kurz
@ 2020-02-05 15:27 ` Cédric Le Goater
2020-02-05 16:29 ` Laurent Vivier
1 sibling, 1 reply; 48+ messages in thread
From: Cédric Le Goater @ 2020-02-05 15:27 UTC (permalink / raw)
To: Laurent Vivier, David Gibson, peter.maydell; +Cc: qemu-ppc, qemu-devel, groug
On 2/5/20 2:26 PM, Laurent Vivier wrote:
> On 03/02/2020 07:11, David Gibson wrote:
>> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>>
>> These changes introduces models for the PCIe Host Bridge (PHB4) of the
>> POWER9 processor. It includes the PowerBus logic interface (PBCQ),
>> IOMMU support, a single PCIe Gen.4 Root Complex, and support for MSI
>> and LSI interrupt sources as found on a POWER9 system using the XIVE
>> interrupt controller.
>>
>> POWER9 processor comes with 3 PHB4 PEC (PCI Express Controller) and
>> each PEC can have several PHBs. By default,
>>
>> * PEC0 provides 1 PHB (PHB0)
>> * PEC1 provides 2 PHBs (PHB1 and PHB2)
>> * PEC2 provides 3 PHBs (PHB3, PHB4 and PHB5)
>>
>> Each PEC has a set "global" registers and some "per-stack" (per-PHB)
>> registers. Those are organized in two XSCOM ranges, the "Nest" range
>> and the "PCI" range, each range contains both some "PEC" registers and
>> some "per-stack" registers.
>>
>> No default device layout is provided and PCI devices can be added on
>> any of the available PCIe Root Port (pcie.0 .. 2 of a Power9 chip)
>> with address 0x0 as the firwware (skiboot) only accepts a single
>> device per root port. To run a simple system with a network and a
>> storage adapters, use a command line options such as :
>>
>> -device e1000e,netdev=net0,mac=C0:FF:EE:00:00:02,bus=pcie.0,addr=0x0
>> -netdev bridge,id=net0,helper=/usr/libexec/qemu-bridge-helper,br=virbr0,id=hostnet0
>>
>> -device megasas,id=scsi0,bus=pcie.1,addr=0x0
>> -drive file=$disk,if=none,id=drive-scsi0-0-0-0,format=qcow2,cache=none
>> -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2
>>
>> If more are needed, include a bridge.
>>
>> Multi chip is supported, each chip adding its set of PHB4 controllers
>> and its PCI busses. The model doesn't emulate the EEH error handling.
>>
>> This model is not ready for hotplug yet.
>>
>> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>> [ clg: - numerous cleanups
>> - commit log
>> - fix for broken LSI support
>> - PHB pic printinfo
>> - large QOM rework ]
>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>> Message-Id: <20200127144506.11132-2-clg@kaod.org>
>> [dwg: Use device_class_set_props()]
>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>> ---
>> hw/pci-host/Makefile.objs | 1 +
>> hw/pci-host/pnv_phb4.c | 1438 +++++++++++++++++++++++++++
>> hw/pci-host/pnv_phb4_pec.c | 593 +++++++++++
>> hw/ppc/Kconfig | 2 +
>> hw/ppc/pnv.c | 107 ++
>> include/hw/pci-host/pnv_phb4.h | 230 +++++
>> include/hw/pci-host/pnv_phb4_regs.h | 553 ++++++++++
>> include/hw/pci/pcie_port.h | 1 +
>> include/hw/ppc/pnv.h | 7 +
>> include/hw/ppc/pnv_xscom.h | 11 +
>> 10 files changed, 2943 insertions(+)
>> create mode 100644 hw/pci-host/pnv_phb4.c
>> create mode 100644 hw/pci-host/pnv_phb4_pec.c
>> create mode 100644 include/hw/pci-host/pnv_phb4.h
>> create mode 100644 include/hw/pci-host/pnv_phb4_regs.h
>>
> ...
>> diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
>> index e27efe9a24..354828bf13 100644
>> --- a/hw/ppc/Kconfig
>> +++ b/hw/ppc/Kconfig
>> @@ -135,6 +135,8 @@ config XIVE_SPAPR
>> default y
>> depends on PSERIES
>> select XIVE
>> + select PCI
>> + select PCIE_PORT
>
> This patch is about PowerNV, why do we add dependencies for pseries
> configuration?
Bogus leftovers from the past. I think we can drop them.
Thanks,
C.
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-05 15:27 ` Cédric Le Goater
@ 2020-02-05 16:29 ` Laurent Vivier
2020-02-05 17:16 ` Cédric Le Goater
0 siblings, 1 reply; 48+ messages in thread
From: Laurent Vivier @ 2020-02-05 16:29 UTC (permalink / raw)
To: Cédric Le Goater, David Gibson, peter.maydell
Cc: qemu-ppc, qemu-devel, groug
On 05/02/2020 16:27, Cédric Le Goater wrote:
> On 2/5/20 2:26 PM, Laurent Vivier wrote:
>> On 03/02/2020 07:11, David Gibson wrote:
>>> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>>>
>>> These changes introduces models for the PCIe Host Bridge (PHB4) of the
>>> POWER9 processor. It includes the PowerBus logic interface (PBCQ),
>>> IOMMU support, a single PCIe Gen.4 Root Complex, and support for MSI
>>> and LSI interrupt sources as found on a POWER9 system using the XIVE
>>> interrupt controller.
>>>
>>> POWER9 processor comes with 3 PHB4 PEC (PCI Express Controller) and
>>> each PEC can have several PHBs. By default,
>>>
>>> * PEC0 provides 1 PHB (PHB0)
>>> * PEC1 provides 2 PHBs (PHB1 and PHB2)
>>> * PEC2 provides 3 PHBs (PHB3, PHB4 and PHB5)
>>>
>>> Each PEC has a set "global" registers and some "per-stack" (per-PHB)
>>> registers. Those are organized in two XSCOM ranges, the "Nest" range
>>> and the "PCI" range, each range contains both some "PEC" registers and
>>> some "per-stack" registers.
>>>
>>> No default device layout is provided and PCI devices can be added on
>>> any of the available PCIe Root Port (pcie.0 .. 2 of a Power9 chip)
>>> with address 0x0 as the firwware (skiboot) only accepts a single
>>> device per root port. To run a simple system with a network and a
>>> storage adapters, use a command line options such as :
>>>
>>> -device e1000e,netdev=net0,mac=C0:FF:EE:00:00:02,bus=pcie.0,addr=0x0
>>> -netdev bridge,id=net0,helper=/usr/libexec/qemu-bridge-helper,br=virbr0,id=hostnet0
>>>
>>> -device megasas,id=scsi0,bus=pcie.1,addr=0x0
>>> -drive file=$disk,if=none,id=drive-scsi0-0-0-0,format=qcow2,cache=none
>>> -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive-scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2
>>>
>>> If more are needed, include a bridge.
>>>
>>> Multi chip is supported, each chip adding its set of PHB4 controllers
>>> and its PCI busses. The model doesn't emulate the EEH error handling.
>>>
>>> This model is not ready for hotplug yet.
>>>
>>> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>>> [ clg: - numerous cleanups
>>> - commit log
>>> - fix for broken LSI support
>>> - PHB pic printinfo
>>> - large QOM rework ]
>>> Signed-off-by: Cédric Le Goater <clg@kaod.org>
>>> Message-Id: <20200127144506.11132-2-clg@kaod.org>
>>> [dwg: Use device_class_set_props()]
>>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>>> ---
>>> hw/pci-host/Makefile.objs | 1 +
>>> hw/pci-host/pnv_phb4.c | 1438 +++++++++++++++++++++++++++
>>> hw/pci-host/pnv_phb4_pec.c | 593 +++++++++++
>>> hw/ppc/Kconfig | 2 +
>>> hw/ppc/pnv.c | 107 ++
>>> include/hw/pci-host/pnv_phb4.h | 230 +++++
>>> include/hw/pci-host/pnv_phb4_regs.h | 553 ++++++++++
>>> include/hw/pci/pcie_port.h | 1 +
>>> include/hw/ppc/pnv.h | 7 +
>>> include/hw/ppc/pnv_xscom.h | 11 +
>>> 10 files changed, 2943 insertions(+)
>>> create mode 100644 hw/pci-host/pnv_phb4.c
>>> create mode 100644 hw/pci-host/pnv_phb4_pec.c
>>> create mode 100644 include/hw/pci-host/pnv_phb4.h
>>> create mode 100644 include/hw/pci-host/pnv_phb4_regs.h
>>>
>> ...
>>> diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
>>> index e27efe9a24..354828bf13 100644
>>> --- a/hw/ppc/Kconfig
>>> +++ b/hw/ppc/Kconfig
>>> @@ -135,6 +135,8 @@ config XIVE_SPAPR
>>> default y
>>> depends on PSERIES
>>> select XIVE
>>> + select PCI
>>> + select PCIE_PORT
>>
>> This patch is about PowerNV, why do we add dependencies for pseries
>> configuration?
>
> Bogus leftovers from the past. I think we can drop them.
I will prepare a patch for that.
Thanks,
Laurent
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-05 16:29 ` Laurent Vivier
@ 2020-02-05 17:16 ` Cédric Le Goater
0 siblings, 0 replies; 48+ messages in thread
From: Cédric Le Goater @ 2020-02-05 17:16 UTC (permalink / raw)
To: Laurent Vivier, David Gibson, peter.maydell; +Cc: qemu-ppc, qemu-devel, groug
>>>> diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
>>>> index e27efe9a24..354828bf13 100644
>>>> --- a/hw/ppc/Kconfig
>>>> +++ b/hw/ppc/Kconfig
>>>> @@ -135,6 +135,8 @@ config XIVE_SPAPR
>>>> default y
>>>> depends on PSERIES
>>>> select XIVE
>>>> + select PCI
>>>> + select PCIE_PORT
>>>
>>> This patch is about PowerNV, why do we add dependencies for pseries
>>> configuration?
>>
>> Bogus leftovers from the past. I think we can drop them.
>
> I will prepare a patch for that.
Thanks. Here is a small command line to check PCI adapters.
C.
$ qemu-system-ppc64 -machine powernv9 -nographic -device ich9-ahci,id=sata0,bus=pcie.1,addr=0x0 -device e1000e,mac=C0:FF:EE:00:01:03,bus=pcie.2,addr=0x0
[ 0.011935416,5] OPAL v6.4 starting...
[ 0.012528373,7] initial console log level: memory 7, driver 5
[ 0.012560514,6] CPU: P9 generation processor (max 4 threads/core)
[ 0.012575475,7] CPU: Boot CPU PIR is 0x0000 PVR is 0x004e1200
[ 0.012735128,7] OPAL table: 0x30101830 .. 0x30101da0, branch table: 0x30002000
[ 0.012945847,7] Assigning physical memory map table for nimbus
[ 0.013226493,7] FDT: Parsing fdt @0x1000000
[ 0.015091333,5] CHIP: Detected Qemu simulator
...
[ 6.259400309,5] PCI Summary:
[ 6.259731885,5] PHB#0000:00:00.0 [ROOT] 1014 04c1 R:00 C:060400 B:01..01
[ 6.260025513,5] PHB#0001:00:00.0 [ROOT] 1014 04c1 R:00 C:060400 B:01..01
[ 6.260263027,5] PHB#0001:01:00.0 [PCID] 8086 2922 R:02 C:010601 ( sata)
[ 6.260485810,5] PHB#0002:00:00.0 [ROOT] 1014 04c1 R:00 C:060400 B:01..01
[ 6.260691330,5] PHB#0002:01:00.0 [EP ] 8086 10d3 R:00 C:020000 ( ethernet)
[ 6.260873711,5] PHB#0003:00:00.0 [ROOT] 1014 04c1 R:00 C:060400 B:01..01
[ 6.261053114,5] PHB#0004:00:00.0 [ROOT] 1014 04c1 R:00 C:060400 B:01..01
[ 6.261237264,5] PHB#0005:00:00.0 [ROOT] 1014 04c1 R:00 C:060400 B:01..01
[ 6.261496700,4] FLASH: Failed to load VERSION data
[ 6.423913697,5] INIT: Waiting for kernel...
[ 6.424004918,5] INIT: platform wait for kernel load failed
[ 6.424114190,5] INIT: Assuming kernel at 0x20000000
[ 6.424232276,3] INIT: ELF header not found. Assuming raw binary.
[ 6.424407245,3] OCC: Unassigned OCC Common Area. No sensors found
[ 6.424629768,2] NVRAM: Failed to load
[ 6.494846301,0] FATAL: Kernel is zeros, can't execute!
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 34/35] target/ppc: Use probe_write for DCBZ
2020-02-03 6:11 ` [PULL 34/35] target/ppc: Use probe_write for DCBZ David Gibson
@ 2020-02-12 18:48 ` Greg Kurz
2020-02-12 22:36 ` Richard Henderson
0 siblings, 1 reply; 48+ messages in thread
From: Greg Kurz @ 2020-02-12 18:48 UTC (permalink / raw)
To: David Gibson
Cc: lvivier, peter.maydell, Richard Henderson, qemu-devel, qemu-ppc,
Howard Spoelstra
On Mon, 3 Feb 2020 17:11:22 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:
> From: Richard Henderson <richard.henderson@linaro.org>
>
> Using probe_write instead of tlb_vaddr_to_host means that we
> process watchpoints and notdirty pages more efficiently.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> Message-Id: <20200129235040.24022-5-richard.henderson@linaro.org>
> Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
> target/ppc/mem_helper.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
> index 0cb78777e7..98f589552b 100644
> --- a/target/ppc/mem_helper.c
> +++ b/target/ppc/mem_helper.c
> @@ -298,7 +298,7 @@ static void dcbz_common(CPUPPCState *env, target_ulong addr,
> }
>
> /* Try fast path translate */
> - haddr = tlb_vaddr_to_host(env, addr, MMU_DATA_STORE, mmu_idx);
> + haddr = probe_write(env, addr, dcbz_size, mmu_idx, retaddr);
Hi Richard,
This one is making coverity unhappy.
** CID 1419390: Memory - corruptions (OVERRUN)
______________________________________________________________________________________________________
*** CID 1419390: Memory - corruptions (OVERRUN)
/target/ppc/mem_helper.c: 301 in dcbz_common()
295 /* Check reservation */
296 if ((env->reserve_addr & mask) == addr) {
297 env->reserve_addr = (target_ulong)-1ULL;
298 }
299
300 /* Try fast path translate */
>>> CID 1419390: Memory - corruptions (OVERRUN)
>>> Overrunning callee's array of size 9 by passing argument "mmu_idx" (which evaluates to 9) in call to "probe_write".
301 haddr = probe_write(env, addr, dcbz_size, mmu_idx, retaddr);
302 if (haddr) {
303 memset(haddr, 0, dcbz_size);
304 } else {
305 /* Slow path */
306 for (i = 0; i < dcbz_size; i += 8) {
Can you have a look ?
Cheers,
--
Greg
> if (haddr) {
> memset(haddr, 0, dcbz_size);
> } else {
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 34/35] target/ppc: Use probe_write for DCBZ
2020-02-12 18:48 ` Greg Kurz
@ 2020-02-12 22:36 ` Richard Henderson
0 siblings, 0 replies; 48+ messages in thread
From: Richard Henderson @ 2020-02-12 22:36 UTC (permalink / raw)
To: Greg Kurz, David Gibson
Cc: lvivier, peter.maydell, qemu-ppc, qemu-devel, Howard Spoelstra
On 2/12/20 10:48 AM, Greg Kurz wrote:
> On Mon, 3 Feb 2020 17:11:22 +1100
> David Gibson <david@gibson.dropbear.id.au> wrote:
>
>> From: Richard Henderson <richard.henderson@linaro.org>
>>
>> Using probe_write instead of tlb_vaddr_to_host means that we
>> process watchpoints and notdirty pages more efficiently.
>>
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>> Message-Id: <20200129235040.24022-5-richard.henderson@linaro.org>
>> Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>> ---
>> target/ppc/mem_helper.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/target/ppc/mem_helper.c b/target/ppc/mem_helper.c
>> index 0cb78777e7..98f589552b 100644
>> --- a/target/ppc/mem_helper.c
>> +++ b/target/ppc/mem_helper.c
>> @@ -298,7 +298,7 @@ static void dcbz_common(CPUPPCState *env, target_ulong addr,
>> }
>>
>> /* Try fast path translate */
>> - haddr = tlb_vaddr_to_host(env, addr, MMU_DATA_STORE, mmu_idx);
>> + haddr = probe_write(env, addr, dcbz_size, mmu_idx, retaddr);
>
> Hi Richard,
>
> This one is making coverity unhappy.
>
>
> ** CID 1419390: Memory - corruptions (OVERRUN)
>
>
> ______________________________________________________________________________________________________
> *** CID 1419390: Memory - corruptions (OVERRUN)
> /target/ppc/mem_helper.c: 301 in dcbz_common()
> 295 /* Check reservation */
> 296 if ((env->reserve_addr & mask) == addr) {
> 297 env->reserve_addr = (target_ulong)-1ULL;
> 298 }
> 299
> 300 /* Try fast path translate */
>>>> CID 1419390: Memory - corruptions (OVERRUN)
>>>> Overrunning callee's array of size 9 by passing argument "mmu_idx" (which evaluates to 9) in call to "probe_write".
> 301 haddr = probe_write(env, addr, dcbz_size, mmu_idx, retaddr);
> 302 if (haddr) {
> 303 memset(haddr, 0, dcbz_size);
> 304 } else {
> 305 /* Slow path */
> 306 for (i = 0; i < dcbz_size; i += 8) {
>
>
> Can you have a look ?
That's a bit of a mystery, given
#define NB_MMU_MODES 10
So I wonder what array is supposed to be of size 9...
Ho hum. False positive. Expanding everything in the coverity gui shows it's
taking the definition from target/xtensa/cpu-param.h.
r~
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed
2020-02-03 6:10 ` [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed David Gibson
@ 2020-03-20 17:38 ` Peter Maydell
0 siblings, 0 replies; 48+ messages in thread
From: Peter Maydell @ 2020-03-20 17:38 UTC (permalink / raw)
To: David Gibson
Cc: Laurent Vivier, Philippe Mathieu-Daudé,
qemu-ppc, QEMU Developers, Greg Kurz
On Mon, 3 Feb 2020 at 06:11, David Gibson <david@gibson.dropbear.id.au> wrote:
>
> From: Greg Kurz <groug@kaod.org>
>
> Most of the option vector helpers have assertions to check their
> arguments aren't null. The guest can provide an arbitrary address
> for the CAS structure that would result in such null arguments.
> Fail CAS with H_PARAMETER and print a warning instead of aborting
> QEMU.
>
> Signed-off-by: Greg Kurz <groug@kaod.org>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> Message-Id: <157925255250.397143.10855183619366882459.stgit@bahia.lan>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
> hw/ppc/spapr_hcall.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
Hi; Coverity points out that this change introduces a
memory leak (CID 1421924):
>
> diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
> index f1799b1b70..ffb14641f9 100644
> --- a/hw/ppc/spapr_hcall.c
> +++ b/hw/ppc/spapr_hcall.c
> @@ -1703,7 +1703,15 @@ static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
> ov_table = addr;
>
> ov1_guest = spapr_ovec_parse_vector(ov_table, 1);
spapr_ovec_parse_vector() allocates memory...
> + if (!ov1_guest) {
> + warn_report("guest didn't provide option vector 1");
> + return H_PARAMETER;
> + }
> ov5_guest = spapr_ovec_parse_vector(ov_table, 5);
> + if (!ov5_guest) {
> + warn_report("guest didn't provide option vector 5");
> + return H_PARAMETER;
...but if we take this early exit code path it is never freed
(via spapr_ovec_cleanup()).
> + }
> if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) {
> error_report("guest requested hash and radix MMU, which is invalid.");
> exit(EXIT_FAILURE);
All the other error paths in the function either precede
allocation of the vectors or just call exit() rather than
returning, so this is the only leak.
thanks
-- PMM
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2020-02-03 6:11 ` [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge David Gibson
2020-02-05 13:26 ` Laurent Vivier
@ 2022-03-31 17:51 ` Peter Maydell
2022-04-01 1:59 ` Benjamin Herrenschmidt
1 sibling, 1 reply; 48+ messages in thread
From: Peter Maydell @ 2022-03-31 17:51 UTC (permalink / raw)
To: David Gibson; +Cc: lvivier, qemu-devel, groug, qemu-ppc, Cédric Le Goater
On Mon, 3 Feb 2020 at 06:11, David Gibson <david@gibson.dropbear.id.au> wrote:
>
> From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
>
> These changes introduces models for the PCIe Host Bridge (PHB4) of the
> POWER9 processor. It includes the PowerBus logic interface (PBCQ),
> IOMMU support, a single PCIe Gen.4 Root Complex, and support for MSI
> and LSI interrupt sources as found on a POWER9 system using the XIVE
> interrupt controller.
Hi; Coverity has just spotted an error in this old change
(CID 1487176):
> +++ b/hw/pci-host/pnv_phb4_pec.c
> +static void pnv_pec_pci_xscom_write(void *opaque, hwaddr addr,
> + uint64_t val, unsigned size)
> +{
> + PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
> + uint32_t reg = addr >> 3;
> +
> + switch (reg) {
> + case PEC_PCI_PBAIB_HW_CONFIG:
> + case PEC_PCI_PBAIB_READ_STK_OVR:
> + pec->pci_regs[reg] = val;
This write function switches on 'reg' and is written assuming
that these PEC_PCI* constants are valid array indexes...
> + break;
> + default:
> + phb_pec_error(pec, "%s @0x%"HWADDR_PRIx"=%"PRIx64"\n", __func__,
> + addr, val);
> + }
> +}
> +++ b/include/hw/pci-host/pnv_phb4.h
> +struct PnvPhb4PecState {
> + DeviceState parent;
> +
> + /* PEC number in chip */
> + uint32_t index;
> + uint32_t chip_id;
> +
> + MemoryRegion *system_memory;
> +
> + /* Nest registers, excuding per-stack */
> +#define PHB4_PEC_NEST_REGS_COUNT 0xf
> + uint64_t nest_regs[PHB4_PEC_NEST_REGS_COUNT];
> + MemoryRegion nest_regs_mr;
> +
> + /* PCI registers, excluding per-stack */
> +#define PHB4_PEC_PCI_REGS_COUNT 0x2
> + uint64_t pci_regs[PHB4_PEC_PCI_REGS_COUNT];
> + MemoryRegion pci_regs_mr;
...but we define the pci_regs[] array in PnvPhb4PecState to
have only 2 elements...
> +++ b/include/hw/pci-host/pnv_phb4_regs.h
> +/* XSCOM PCI global registers */
> +#define PEC_PCI_PBAIB_HW_CONFIG 0x00
> +#define PEC_PCI_PBAIB_READ_STK_OVR 0x02
...and here we define PEC_PCI_PBAIB_READ_STK_OVR as 2, which makes
it not a valid index into pci_regs[].
Which of these is wrong?
thanks
-- PMM
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2022-03-31 17:51 ` Peter Maydell
@ 2022-04-01 1:59 ` Benjamin Herrenschmidt
2022-04-01 8:54 ` Frederic Barrat
0 siblings, 1 reply; 48+ messages in thread
From: Benjamin Herrenschmidt @ 2022-04-01 1:59 UTC (permalink / raw)
To: Peter Maydell, David Gibson
Cc: lvivier, Cédric Le Goater, qemu-ppc, qemu-devel, groug
On Thu, 2022-03-31 at 18:51 +0100, Peter Maydell wrote:
>
> Hi; Coverity has just spotted an error in this old change
> (CID 1487176):
Oh my this is old ... I don't work for IBM anymore but I found the
relevant doc here:
https://wiki.raptorcs.com/w/images/a/a5/POWER9_PCIe_controller_v11_27JUL2018_pub.pdf
So....
> > +++ b/hw/pci-host/pnv_phb4_pec.c
> > +static void pnv_pec_pci_xscom_write(void *opaque, hwaddr addr,
> > + uint64_t val, unsigned size)
> > +{
> > + PnvPhb4PecState *pec = PNV_PHB4_PEC(opaque);
> > + uint32_t reg = addr >> 3;
> > +
> > + switch (reg) {
> > + case PEC_PCI_PBAIB_HW_CONFIG:
> > + case PEC_PCI_PBAIB_READ_STK_OVR:
> > + pec->pci_regs[reg] = val;
>
> This write function switches on 'reg' and is written assuming
> that these PEC_PCI* constants are valid array indexes...
They should be but...
> > + break;
> > + default:
> > + phb_pec_error(pec, "%s @0x%"HWADDR_PRIx"=%"PRIx64"\n",
> > __func__,
> > + addr, val);
> > + }
> > +}
> > +++ b/include/hw/pci-host/pnv_phb4.h
> > +struct PnvPhb4PecStatimages/images/e {
> > + DeviceState parent;
> > +
> > + /* PEC number in chip */
> > + uint32_t index;
> > + uint32_t chip_id;images/
> > +
> > + MemoryRegion *system_memory;
> > +
> > + /* Nest registers, excuding per-stack */
> > +#define PHB4_PEC_NEST_REGS_COUNT 0xf
> > + uint64_t nest_regs[PHB4_PEC_NEST_REGS_COUNT];
> > + MemoryRegion nest_regs_mr;
> > +
> > + /* PCI registers, excluding per-stack */
> > +#define PHB4_PEC_PCI_REGS_COUNT 0x2
> > + uint64_t pci_regs[PHB4_PEC_PCI_REGS_COUNT];
> > + MemoryRegion pci_regs_mr;
>
> ...but we define the pci_regs[] array in PnvPhb4PecState to
> have only 2 elements...
>
> > +++ b/include/hw/pci-host/pnv_phb4_regs.h
> > +/* XSCOM PCI global registers */
> > +#define PEC_PCI_PBAIB_HW_CONFIG 0x00
> > +#define PEC_PCI_PBAIB_READ_STK_OVR 0x02
>
> ...and here we define PEC_PCI_PBAIB_READ_STK_OVR as 2, which makes
> it not a valid index into pci_regs[].
>
>
> Which of these is wrong?
This one:
#define PHB4_PEC_PCI_REGS_COUNT 0x2
Should be
#define PHB4_PEC_PCI_REGS_COUNT 0x3
There is no register at 0x1 though.
Cheers,
Ben.
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge
2022-04-01 1:59 ` Benjamin Herrenschmidt
@ 2022-04-01 8:54 ` Frederic Barrat
0 siblings, 0 replies; 48+ messages in thread
From: Frederic Barrat @ 2022-04-01 8:54 UTC (permalink / raw)
To: Benjamin Herrenschmidt, Peter Maydell, David Gibson
Cc: lvivier, groug, qemu-ppc, Cédric Le Goater, qemu-devel
On 01/04/2022 03:59, Benjamin Herrenschmidt wrote:
> This one:
>
> #define PHB4_PEC_PCI_REGS_COUNT 0x2
>
> Should be
>
> #define PHB4_PEC_PCI_REGS_COUNT 0x3
>
> There is no register at 0x1 though.
Patch on the way....
Fred
^ permalink raw reply [flat|nested] 48+ messages in thread
end of thread, other threads:[~2022-04-01 9:12 UTC | newest]
Thread overview: 48+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-03 6:10 [PULL 00/35] ppc-for-5.0 queue 20200203 David Gibson
2020-02-03 6:10 ` [PULL 01/35] ppc/pnv: use QEMU unit definition MiB David Gibson
2020-02-03 6:10 ` [PULL 02/35] ppc/pnv: improve error logging when a PNOR update fails David Gibson
2020-02-03 6:10 ` [PULL 03/35] ppc:virtex_ml507: remove unused arguments David Gibson
2020-02-03 6:10 ` [PULL 04/35] hw/ppc/prep: Remove the deprecated "prep" machine and the OpenHackware BIOS David Gibson
2020-02-03 6:10 ` [PULL 05/35] target/ppc: Clarify the meaning of return values in kvm_handle_debug David Gibson
2020-02-03 6:10 ` [PULL 06/35] spapr: Fail CAS if option vector table cannot be parsed David Gibson
2020-03-20 17:38 ` Peter Maydell
2020-02-03 6:10 ` [PULL 07/35] target/ppc: Add privileged message send facilities David Gibson
2020-02-03 6:10 ` [PULL 08/35] target/ppc: add support for Hypervisor Facility Unavailable Exception David Gibson
2020-02-03 6:10 ` [PULL 09/35] spapr: Don't allow multiple active vCPUs at CAS David Gibson
2020-02-03 6:10 ` [PULL 10/35] ppc/pnv: Add support for HRMOR on Radix host David Gibson
2020-02-03 6:10 ` [PULL 11/35] ppc/pnv: remove useless "core-pir" property alias David Gibson
2020-02-03 6:11 ` [PULL 12/35] ppc/pnv: Add support for "hostboot" mode David Gibson
2020-02-03 6:11 ` [PULL 13/35] tpm: Move tpm_tis_show_buffer to tpm_util.c David Gibson
2020-02-03 6:11 ` [PULL 14/35] spapr: Implement get_dt_compatible() callback David Gibson
2020-02-03 6:11 ` [PULL 15/35] tpm_spapr: Support TPM for ppc64 using CRQ based interface David Gibson
2020-02-03 6:11 ` [PULL 16/35] tpm_spapr: Support suspend and resume David Gibson
2020-02-03 6:11 ` [PULL 17/35] hw/ppc/Kconfig: Enable TPM_SPAPR as part of PSERIES config David Gibson
2020-02-03 6:11 ` [PULL 18/35] docs/specs/tpm: reST-ify TPM documentation David Gibson
2020-02-03 6:11 ` [PULL 19/35] ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge David Gibson
2020-02-05 13:26 ` Laurent Vivier
2020-02-05 14:31 ` Greg Kurz
2020-02-05 15:27 ` Cédric Le Goater
2020-02-05 16:29 ` Laurent Vivier
2020-02-05 17:16 ` Cédric Le Goater
2022-03-31 17:51 ` Peter Maydell
2022-04-01 1:59 ` Benjamin Herrenschmidt
2022-04-01 8:54 ` Frederic Barrat
2020-02-03 6:11 ` [PULL 20/35] ppc/pnv: Add models for POWER8 PHB3 " David Gibson
2020-02-03 6:11 ` [PULL 21/35] ppc/pnv: change the PowerNV machine devices to be non user creatable David Gibson
2020-02-03 6:11 ` [PULL 22/35] spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine David Gibson
2020-02-03 6:11 ` [PULL 23/35] target/ppc/cpu.h: Put macro parameter in parentheses David Gibson
2020-02-03 6:11 ` [PULL 24/35] Wrapper function to wait on condition for the main loop mutex David Gibson
2020-02-03 6:11 ` [PULL 25/35] ppc: spapr: Introduce FWNMI capability David Gibson
2020-02-03 6:11 ` [PULL 26/35] target/ppc: Handle NMI guest exit David Gibson
2020-02-03 6:11 ` [PULL 27/35] target/ppc: Build rtas error log upon an MCE David Gibson
2020-02-03 6:11 ` [PULL 28/35] ppc: spapr: Handle "ibm, nmi-register" and "ibm, nmi-interlock" RTAS calls David Gibson
2020-02-03 6:11 ` [PULL 29/35] migration: Include migration support for machine check handling David Gibson
2020-02-03 6:11 ` [PULL 30/35] ppc: spapr: Activate the FWNMI functionality David Gibson
2020-02-03 6:11 ` [PULL 31/35] target/ppc: Use probe_access for LSW, STSW David Gibson
2020-02-03 6:11 ` [PULL 32/35] target/ppc: Use probe_access for LMW, STMW David Gibson
2020-02-03 6:11 ` [PULL 33/35] target/ppc: Remove redundant mask in DCBZ David Gibson
2020-02-03 6:11 ` [PULL 34/35] target/ppc: Use probe_write for DCBZ David Gibson
2020-02-12 18:48 ` Greg Kurz
2020-02-12 22:36 ` Richard Henderson
2020-02-03 6:11 ` [PULL 35/35] tests: Silence various warnings with pseries David Gibson
2020-02-03 10:41 ` [PULL 00/35] ppc-for-5.0 queue 20200203 Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.