Merge tag 'hw-misc-20250331' of https://github.com/philmd/qemu into staging

Misc HW patches

- Expose v7M System Control Space as little endian (Philippe)
- Deprecate MipsSim machine (Thomas)
- Impr

Merge tag 'hw-misc-20250331' of https://github.com/philmd/qemu into staging

Misc HW patches

- Expose v7M System Control Space as little endian (Philippe)
- Deprecate MipsSim machine (Thomas)
- Improve some devices categories / descriptions (Philippe)
- Correct memory_rw_debug() prototype (Richard)
- Do not expose i.MX 8M SoC as user-creatable (Bernhard)
- Do not expose some PLL & eFuse devices as user-creatable (Philippe)
- Do not reset Goldfish RTC time on machine reset (Heinrich)
- Fix incorrect BCM2835 AUX interrupt ID when RX disabled (Chung-Yi)
- Fix DesignWare PCI host bridge ATU_UPPER_TARGET register access (Philippe)
- Memory leak fixes (Bernhard & Zheng Huang)
- Prevent out-of-bound access in avr_print_insn (Richard)
- Fixes around MIPS page mask (Richard)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmfq8VYACgkQ4+MsLN6t
# wN4AvhAAyTWwGhLfelpPgfj6JHCNiUFUjp4R5a3Y2ROJ19UQ8pcK0RlE5jFNzA6G
# sUmy6cl4XK3ojT5EJ/FyVMlLniw9hWmOiIgHHLU+h2Ji+oCS3S2N2T2hFCs4vbT+
# SNjhN1RIdrlWnoSJZiiKM4njKcJxwvg0MCmvOgV70Njy+sVB9zu7YdA0i8yryXOy
# a0PDMS71hckF2HBizYrhYAhxPISK3oVoeLRUeGGQhZBUMmu+oZoEWp0DjeuMPoQv
# pUX0G7LAqNWCyhIXHEUYGAtSZJc08wEmoypbj1s9PDO5q6NEruCwiWyNHTBXzPsS
# ingMM66o2xPCk8BnWSRvpocTgi2QYI/nk+S9L5Gr+FWMGmCbiFAX6c7OH6t4jqz2
# HwqKDZ1FJzBnquT/5ABR5won0cvjsTGhr76oxEyeM3xrGKyysmrBXWYYXjnaidlc
# uzr4hc6UT6bYlN53SG1dZP6/aWWcK57MaqrJnjOmLi+VEUEC8p9iOjN+ED7QicBj
# Wc1TPMeE8TK7EVJoeor1PAyLHWE+oGDOb8Rcyauxge9cPcqZPWYeSp3HpwhLJb+K
# XbwFoSsQRCXT4acL70hkHyjfXtM1qu+g7dWFvEGPlqfuQMvfk4fOfwKbJVxb8UvO
# OO96TUPnhpxiC6gYxMRJ9ZwIbzyZ9+SG3loW1OVSmx3Ndth2mh8=
# =O3jG
# -----END PGP SIGNATURE-----
# gpg: Signature made Mon 31 Mar 2025 15:47:34 EDT
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20250331' of https://github.com/philmd/qemu: (23 commits)
target/mips: Simplify and fix update_pagemask
target/mips: Require even maskbits in update_pagemask
target/mips: Revert TARGET_PAGE_BITS_VARY
target/sparc: Log unimplemented ASI load/store accesses
target/avr: Fix buffer read in avr_print_insn
target/hppa: Remove duplicated CPU_RESOLVING_TYPE definition
hw/pci-host/designware: Fix ATU_UPPER_TARGET register access
hw/ufs: free irq on exit
hw/char/bcm2835_aux: Fix incorrect interrupt ID when RX disabled
hw/sd/sdhci: free irq on exit
hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize()
hw/nvram/xlnx-efuse: Do not expose as user-creatable
hw/misc/pll: Do not expose as user-creatable
hw/rtc/goldfish: keep time offset when resetting
hw/mips: Mark the "mipssim" machine as deprecated
hw/dma/i82374: Categorize and add description
hw/display/dm163: Add description
hw/block/m25p80: Categorize and add description
hw/core/cpu: Use size_t for memory_rw_debug len argument
hw/arm/fsl-imx8mp: Remove unused define
...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

hw/misc/pll: Do not expose as user-creatable

All these devices are part of SoC components and can not
be created manually.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Tho

hw/misc/pll: Do not expose as user-creatable

All these devices are part of SoC components and can not
be created manually.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20250325224310.8785-9-philmd@linaro.org>

show more ...

Merge tag 'pull-target-arm-20250225' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* hw/arm/smmuv3: Fill u.f_cd_fetch.addr for SMMU_EVT_F_CD_FETCH
* hw/arm/virt

Merge tag 'pull-target-arm-20250225' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* hw/arm/smmuv3: Fill u.f_cd_fetch.addr for SMMU_EVT_F_CD_FETCH
* hw/arm/virt: Support larger highmem MMIO regions
* machine: Centralize -machine dumpdtb option handling and report
attempt to dump nonexistent DTB as an error
* fpu: remove target ifdefs and build it only once
* target/arm: Refactor to move TCG-only vfp_helper code into tcg/
* target/arm/hvf: Disable SME feature
* target/arm/hvf: sign extend the data for a load operation when SSE=1
* hw/misc/npcm_clk: fix buffer-overflow
* hw/arm: Add i.MX 8M Plus EVK board ("imx8mp-evk")

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAme+BaQZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3kG0EACuWqAhqYdn2muu1Rc3WQMh
# uMOdb/f7oaqbCpeBEdV1dazWfZJQ1Zk05J31t+tdoYowqM7nS55Vw9zrSntoC6Ll
# IYRzBmGWE+FnsODKhA0wx/lQO08GeMTrkHoGM72hiwIjbuC/Nps9aOQ2GH6WOCjN
# TACXF1dYNpoy+H979yIwGMWH1SSgn1fS+9zw3LsKCGtbnt7g80DyWpb6qlfKPJ78
# KHmpth//sCPbu6UtsFKTBlIb0dYtAWTnRoS834WBq9bw51OPh81WoApSBkjV479z
# kTcLyaJnoTKsPnz+6A/z3Fm/qi4aATk4/eCCT2ry3Oyi3ffafSlBf/KiFqAZ0Fue
# vq6/b/wsVTdyjnkcptmCHJ+6qEhPshNi3F4hu8YOFQsx+6zFR7NUkZrNt/IQIhZB
# DOcjtMFymg/duEbRW9RdLeVC3Ds2qVuxnzEbLmNJntBp+jkhm5QkWf6ZEJ6iviOf
# tSP+SLOFyCT71BdQSIMhLJHS9UPJ3vzgGkN54YCLDYg24aNCMSe0nqLFMxfchQJm
# njn1BdyX4pDibXv6tdDJdtOv3sLgvVaZZKEGlTGtNx8kq8qmXnzIJl6iQSBTrmD5
# qMb4NxaYG6hpzSQOV+XxLQ1BdLNj2qXs90EU1Jqfp378sOdl6Oyx5po5NIcyp36o
# g+GsbLqphJL4DkosoH8eFA==
# =MBWK
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 26 Feb 2025 02:02:12 HKT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]
# gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20250225' of https://git.linaro.org/people/pmaydell/qemu-arm: (43 commits)
hw/arm/fsl-imx8mp: Add on-chip RAM
hw/arm/fsl-imx8mp: Add USB support
hw/arm/fsl-imx8mp: Add Ethernet controller
hw/arm/fsl-imx8mp: Implement general purpose timers
hw/arm/fsl-imx8mp: Add watchdog support
hw/arm/fsl-imx8mp: Add SPI controllers
hw/arm/fsl-imx8mp: Add I2C controllers
hw/arm/fsl-imx8mp: Add GPIO controllers
hw/arm/fsl-imx8mp: Add PCIe support
hw/arm/fsl-imx8mp: Add USDHC storage controllers
hw/arm/fsl-imx8mp: Add SNVS
hw/arm/fsl-imx8mp: Implement clock tree
hw/arm: Add i.MX 8M Plus EVK board
hw/gpio/pca955*: Move Kconfig switches next to implementations
hw/pci-host/designware: Prevent device attachment on internal PCIe root bus
hw/usb/hcd-dwc3: Align global registers size with Linux
hw/misc/npcm_clk: fix buffer-overflow
target/arm/hvf: sign extend the data for a load operation when SSE=1
target/arm/hvf: Disable SME feature
target/arm: Rename vfp_helper.c to vfp_fpscr.c
...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

hw/misc/npcm_clk: fix buffer-overflow

Regression introduced by cf76c4
(hw/misc: Add nr_regs and cold_reset_values to NPCM CLK)

cold_reset_values has a different size, depending on device used
(NPCM

hw/misc/npcm_clk: fix buffer-overflow

Regression introduced by cf76c4
(hw/misc: Add nr_regs and cold_reset_values to NPCM CLK)

cold_reset_values has a different size, depending on device used
(NPCM7xx vs NPCM8xx). However, s->regs has a fixed size, which matches
NPCM8xx. Thus, when initializing a NPCM7xx, we go past cold_reset_values
ending.

Report by asan:
==2066==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55d68a3e97f0 at pc 0x7fcaf2b2d14b bp 0x7ffff0cc3890 sp 0x7ffff0cc3040
READ of size 196 at 0x55d68a3e97f0 thread T0
#0 0x7fcaf2b2d14a in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
#1 0x55d688447e0d in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
#2 0x55d688447e0d in npcm_clk_enter_reset ../hw/misc/npcm_clk.c:968
#3 0x55d6899b7213 in resettable_phase_enter ../hw/core/resettable.c:136
#4 0x55d6899a1ef7 in bus_reset_child_foreach ../hw/core/bus.c:97
#5 0x55d6899b717d in resettable_child_foreach ../hw/core/resettable.c:92
#6 0x55d6899b717d in resettable_phase_enter ../hw/core/resettable.c:129
#7 0x55d6899b4ead in resettable_container_child_foreach ../hw/core/resetcontainer.c:54
#8 0x55d6899b717d in resettable_child_foreach ../hw/core/resettable.c:92
#9 0x55d6899b717d in resettable_phase_enter ../hw/core/resettable.c:129
#10 0x55d6899b7bfa in resettable_assert_reset ../hw/core/resettable.c:55
#11 0x55d6899b8666 in resettable_reset ../hw/core/resettable.c:45
#12 0x55d688d15cd2 in qemu_system_reset ../system/runstate.c:527
#13 0x55d687fc5edd in qdev_machine_creation_done ../hw/core/machine.c:1738
#14 0x55d688d209bd in qemu_machine_creation_done ../system/vl.c:2779
#15 0x55d688d209bd in qmp_x_exit_preconfig ../system/vl.c:2807
#16 0x55d688d281fb in qemu_init ../system/vl.c:3838
#17 0x55d687ceab12 in main ../system/main.c:68
#18 0x7fcaef006249 (/lib/x86_64-linux-gnu/libc.so.6+0x27249)
#19 0x7fcaef006304 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x27304)
#20 0x55d687cf0010 in _start (/home/runner/work/qemu-ci/qemu-ci/build/qemu-system-arm+0x371c010)

0x55d68a3e97f0 is located 0 bytes to the right of global variable 'npcm7xx_cold_reset_values' defined in '../hw/misc/npcm_clk.c:134:23' (0x55d68a3e9780) of size 112

Impacted tests:
Summary of Failures:

check:
2/747 qemu:qtest+qtest-aarch64 / qtest-aarch64/qom-test ERROR 9.28s killed by signal 6 SIGABRT
4/747 qemu:qtest+qtest-arm / qtest-arm/qom-test ERROR 7.82s killed by signal 6 SIGABRT
32/747 qemu:qtest+qtest-aarch64 / qtest-aarch64/device-introspect-test ERROR 10.91s killed by signal 6 SIGABRT
35/747 qemu:qtest+qtest-arm / qtest-arm/device-introspect-test ERROR 11.33s killed by signal 6 SIGABRT
114/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_pwm-test ERROR 0.98s killed by signal 6 SIGABRT
115/747 qemu:qtest+qtest-aarch64 / qtest-aarch64/test-hmp ERROR 2.95s killed by signal 6 SIGABRT
117/747 qemu:qtest+qtest-arm / qtest-arm/test-hmp ERROR 2.54s killed by signal 6 SIGABRT
151/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_watchdog_timer-test ERROR 0.96s killed by signal 6 SIGABRT
247/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_adc-test ERROR 0.96s killed by signal 6 SIGABRT
248/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_gpio-test ERROR 1.05s killed by signal 6 SIGABRT
249/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_rng-test ERROR 0.97s killed by signal 6 SIGABRT
250/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_sdhci-test ERROR 0.97s killed by signal 6 SIGABRT
251/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_smbus-test ERROR 0.89s killed by signal 6 SIGABRT
252/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_timer-test ERROR 1.09s killed by signal 6 SIGABRT
253/747 qemu:qtest+qtest-arm / qtest-arm/npcm_gmac-test ERROR 1.12s killed by signal 6 SIGABRT
255/747 qemu:qtest+qtest-arm / qtest-arm/npcm7xx_emc-test ERROR 1.05s killed by signal 6 SIGABRT

check-functional:
22/203 qemu:func-thorough+func-arm-thorough+thorough / func-arm-arm_quanta_gsj ERROR 0.79s exit status 1
38/203 qemu:func-quick+func-aarch64 / func-aarch64-migration ERROR 1.97s exit status 1
45/203 qemu:func-quick+func-arm / func-arm-migration ERROR 1.90s exit status 1

Fixes: cf76c4e174e1 ("hw/misc: Add nr_regs and cold_reset_values to NPCM CLK")
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

Merge tag 'pull-target-arm-20250220' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* Fix some incorrect syndrome values in various sysreg traps
* Clean up sysre

Merge tag 'pull-target-arm-20250220' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
* Fix some incorrect syndrome values in various sysreg traps
* Clean up sysreg trap code to avoid similar future bugs
* Make boards/SoCs using a9mpcore and a15mpcore objects specify
number of GIC interrupts explicitly
* Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX
* target/arm: Use uint32_t in t32_expandimm_imm()
* New board model: NPCM845 Evaluation board "npcm845-evb"

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAme3Vk8ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3t8QD/48yOUtFwUMFrwbbszK5rss
# Ghhtk0ylKIxPQirgzjLUNq4hV2MZEtdmyiqaEllvA0aS839oWhFW0hbsGmoL/TVF
# tqXVP3Y1dMubmNHCGcgiFqaxaInnNSC9S1ALiEm5a37g519706WLXPVLqJJ9t31b
# uWHKT1hqxstzWSExhGrEkSEghcgN3u1KyCz0zyq9bk/F3OFWZfHNH6JqutQX18Ua
# 5HtcD1Pum6WjayBc3y4AYVYH4xyQclY7LPR+zKNf2d5GuZ+J6MlXMyfCuE2/J//m
# wHAtAoeuFhi/HFHR4vQP4L7HrhFrECbjfWha85F/rmiOAo6LnbICyPt4tAPe5So3
# FCtSHfht9ToulBqULE+F/AWVCdt8UeDRgOANSHFsMkxYiUK8QpMv8A2AtwJUqiMp
# WbAzw31f6SgANgFQObhoRNE3QyX8V53ZJAsPhDooTxwMiglqVTM3Xux8W2zz9FdU
# BTwCy23efBqKf4RWfeHjAXctGshePI1mTBJmvEKG5G5ligMNeg7ZiQqqfRVBagc/
# gpsQKNjpN9MVVds3thUvMCYO/9NOeeAtcVA2vW7qf7HrYaM72UngCPWjhNfAj/9I
# 9hxgqEnKC6qoD/zMyFv+XwqNlL1PuD79rbvN8TWFd/f8iBIYOY6WVEYmsi7WGugI
# WzYI93RqFaQhrpyHDcRVGw==
# =djUd
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 21 Feb 2025 00:20:31 HKT
# gpg: using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg: issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [full]
# gpg: aka "Peter Maydell <pmaydell@gmail.com>" [full]
# gpg: aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [full]
# gpg: aka "Peter Maydell <peter@archaic.org.uk>" [unknown]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83 15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20250220' of https://git.linaro.org/people/pmaydell/qemu-arm: (41 commits)
docs/system/arm: Add Description for NPCM8XX SoC
hw/arm: Add NPCM845 Evaluation board
hw/arm: Add NPCM8XX SoC
hw/net: Add NPCM8XX PCS Module
hw/misc: Support NPCM8XX CLK Module Registers
hw/misc: Add nr_regs and cold_reset_values to NPCM CLK
hw/misc: Move NPCM7XX CLK to NPCM CLK
hw/misc: Rename npcm7xx_clk to npcm_clk
hw/misc: Support 8-bytes memop in NPCM GCR module
hw/misc: Store DRAM size in NPCM8XX GCR Module
hw/misc: Add support for NPCM8XX GCR
hw/misc: Add nr_regs and cold_reset_values to NPCM GCR
hw/misc: Move NPCM7XX GCR to NPCM GCR
hw/misc: Rename npcm7xx_gcr to npcm_gcr
hw/ssi: Make flash size a property in NPCM7XX FIU
pc-bios: Add NPCM8XX vBootrom
roms: Update vbootrom to 1287b6e
target/arm: Use uint32_t in t32_expandimm_imm()
Kconfig: Extract CONFIG_USB_CHIPIDEA from CONFIG_IMX
hw/cpu/arm_mpcore: Remove default values for GIC external IRQs
...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

show more ...

hw/misc: Support NPCM8XX CLK Module Registers

NPCM8XX adds a few new registers and have a different set of reset
values to the CLK modules. This patch supports them.

This patch doesn't support the

hw/misc: Support NPCM8XX CLK Module Registers

NPCM8XX adds a few new registers and have a different set of reset
values to the CLK modules. This patch supports them.

This patch doesn't support the new clock values generated by these
registers. Currently no modules use these new clock values so they
are not necessary at this point.
Implementation of these clocks might be required when implementing
these modules.

Reviewed-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20250219184609.1839281-14-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/misc: Add nr_regs and cold_reset_values to NPCM CLK

These 2 values are different between NPCM7XX and NPCM8XX
CLKs. So we add them to the class and assign different values
to them.

Reviewed-by: P

hw/misc: Add nr_regs and cold_reset_values to NPCM CLK

These 2 values are different between NPCM7XX and NPCM8XX
CLKs. So we add them to the class and assign different values
to them.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20250219184609.1839281-13-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/misc: Move NPCM7XX CLK to NPCM CLK

A lot of NPCM7XX and NPCM8XX CLK modules share the same code,
this commit moves the NPCM7XX CLK to NPCM CLK for these
properties.

Reviewed-by: Peter Maydell <p

hw/misc: Move NPCM7XX CLK to NPCM CLK

A lot of NPCM7XX and NPCM8XX CLK modules share the same code,
this commit moves the NPCM7XX CLK to NPCM CLK for these
properties.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20250219184609.1839281-12-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/misc: Rename npcm7xx_clk to npcm_clk

NPCM7XX and NPCM8XX have a different set of CLK registers. This
commit changes the name of the clk files to be used by both
NPCM7XX and NPCM8XX CLK modules.

hw/misc: Rename npcm7xx_clk to npcm_clk

NPCM7XX and NPCM8XX have a different set of CLK registers. This
commit changes the name of the clk files to be used by both
NPCM7XX and NPCM8XX CLK modules.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20250219184609.1839281-11-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...